Function at 0x410470
Capabilities:
Connect to wmi namespace via wbemlocator
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push ebx
push esi
push edi
push 0
push 0
mov edi, ecx
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x4104f2
mov cl, 0x56
mov byte [ebp - 1], 0
mov al, 0x66
mov byte [ebp - 3], cl
xor al, cl
mov byte [ebp - 1], 0
mov byte [ebp - 2], al
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
cmp byte [ebp - 2], 0
jne 0x4104ce
xor ecx, ecx
lea eax, [ebp - 2]
push ecx
push eax
mov ecx, edi
call fcn.00407390
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 2]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4104d4
sub ecx, edx
lea eax, [ebp - 2]
push ecx
push eax
mov ecx, edi
call fcn.00407390
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x41053c
call dword [sym.imp.ole32.dll_CoUninitialize]
mov cl, 0x1a
mov al, 0x2a
xor al, cl
mov byte [ebp - 3], cl
mov byte [ebp - 2], al
mov ecx, edi
lea eax, [ebp - 2]
mov byte [ebp - 1], 0
push eax
mov byte [ebp - 1], 0
call fcn.00406e80
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0x4327a0
push 1
push 0
push 0x432870
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x41056b
call dword [sym.imp.ole32.dll_CoUninitialize]
mov cl, 0x7e
mov al, 0x4e
jmp 0x410518
lea eax, [ebp - 0x74]
mov dword [ebp - 0x28], 0
push eax
call fcn.00410f10
mov esi, eax
mov ebx, 4
lea edx, [esi + 4]
movsx cx, byte [esi]
lea edx, [edx + 0xa]
xor word [edx - 0xc], cx
movsx eax, byte [esi]
xor word [edx - 0xa], ax
movsx eax, byte [esi]
xor word [edx - 8], ax
movsx eax, byte [esi]
xor word [edx - 6], ax
movsx eax, byte [esi]
xor word [edx - 4], ax
sub ebx, 1
jne 0x410585
xor eax, eax
lea ecx, [ebp - 0x20]
mov word [esi + 0x2a], ax
lea eax, [esi + 2]
push eax
call fcn.00406b80
cmp dword [eax + 0x14], 8
jb 0x4105cb
mov eax, dword [eax]
push eax
lea ecx, [ebp - 4]
call fcn.004010b0
mov eax, dword [eax]
test eax, eax
je 0x4105de
mov edx, dword [eax]
jmp 0x4105e0
xor edx, edx
mov eax, dword [ebp - 0x2c]
lea esi, [ebp - 0x28]
push esi
push 0
push 0
mov ecx, dword [eax]
push 0
push 0
push 0
push 0
push edx
push eax
call dword [ecx + 0xc]
lea ecx, [ebp - 4]
mov esi, eax
call fcn.00401110
lea ecx, [ebp - 0x20]
call fcn.00406b40
test esi, esi
jns 0x410628
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov cl, 0xc
mov al, 0x3c
jmp 0x410518
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [ebp - 0x28]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x410664
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov cl, 0x70
mov al, 0x40
jmp 0x410518
movaps xmm0, xmmword [0x43b8e0]
xor ecx, ecx
movups xmmword [ebp - 0x68], xmm0
mov dword [ebp - 0x48], 0
movaps xmm0, xmmword [0x43b8b0]
movups xmmword [ebp - 0x58], xmm0
mov al, byte [ebp - 0x68]
xor byte [ebp + ecx - 0x67], al
inc ecx
cmp ecx, 0x1e
jb 0x410683
lea eax, [ebp - 0x67]
mov byte [ebp - 0x49], 0
push eax
lea ecx, [ebp - 0x9c]
call fcn.0040f5a0
mov eax, dword [eax]
test eax, eax
je 0x4106ad
mov esi, dword [eax]
jmp 0x4106af
xor esi, esi
mov bl, 0x6b
mov byte [ebp - 9], 0
mov al, 0x3c
mov byte [ebp - 0xd], bl
xor al, bl
mov byte [ebp - 9], 0
mov cl, 0x3a
mov byte [ebp - 0xc], al
xor cl, bl
lea eax, [ebp - 0xc]
mov dl, 0x27
mov byte [ebp - 0xb], cl
xor dl, bl
lea ecx, [ebp - 4]
push eax
mov byte [ebp - 0xa], dl
call fcn.0040f5a0
mov edx, dword [eax]
test edx, edx
je 0x4106e7
mov edx, dword [edx]
jmp 0x4106e9
xor edx, edx
mov eax, dword [ebp - 0x28]
lea ebx, [ebp - 0x48]
push ebx
push 0
push 0x30
mov ecx, dword [eax]
push esi
push edx
push eax
call dword [ecx + 0x50]
lea ecx, [ebp - 4]
mov esi, eax
call fcn.00401110
lea ecx, [ebp - 0x9c]
call fcn.00401110
test esi, esi
jns 0x410736
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov cl, 0x76
mov al, 0x46
jmp 0x410518
mov ecx, dword [ebp - 0x48]
xor eax, eax
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x78], 7
mov dword [ebp - 0x7c], 0
mov word [ebp - 0x8c], ax
test ecx, ecx
je 0x410852
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea esi, [eax + 0x5c]
mov eax, dword [ecx]
lea edx, [ebp - 0x94]
push edx
lea edx, [ebp - 0x90]
push edx
push 1
push 0xffffffffffffffff
push ecx
call dword [eax + 0x10]
cmp dword [ebp - 0x94], 0
je 0x410852
mov al, 0x3d
mov dword [ebp - 0x60], 0x540059
mov byte [ebp - 0x62], al
xor ecx, ecx
mov dword [ebp - 0x5c], 0x4d004e
mov dword [ebp - 0x58], 0x5c0051
mov dword [ebp - 0x54], 0x730044
mov dword [ebp - 0x50], 0x50005c
mov dword [ebp - 0x4c], 0x58
nop dword [eax + eax]
cbw
xor word [ebp + ecx*2 - 0x60], ax
inc ecx
cmp ecx, 0xb
jae 0x4107e2
mov al, byte [ebp - 0x62]
jmp 0x4107d0
push 0
xor eax, eax
lea edx, [ebp - 0x18]
push 0
mov word [ebp - 0x4a], ax
mov eax, dword [ebp - 0x90]
push edx
push 0
lea edx, [ebp - 0x60]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x10]
mov edx, dword [ebp - 0x10]
cmp word [edx], 0
jne 0x41080f
xor ecx, ecx
jmp 0x410828
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410814
sub ecx, esi
mov esi, 0x5c
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x8c]
call fcn.00407130
lea eax, [ebp - 0x18]
push eax
call ebx
mov eax, dword [ebp - 0x90]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 0x48]
test ecx, ecx
jne 0x410775
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [ebp - 0x7c], 0
jne 0x4108ac
mov cl, 9
mov byte [ebp - 1], 0
mov al, 0x39
mov byte [ebp - 3], cl
xor al, cl
mov byte [ebp - 1], 0
mov byte [ebp - 2], al
mov ecx, edi
lea eax, [ebp - 2]
push eax
call fcn.00406e80
lea ecx, [ebp - 0x8c]
call fcn.00406b40
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x78], 8
lea eax, [ebp - 0x98]
lea esi, [ebp - 0x8c]
cmovae esi, dword [ebp - 0x8c]
lea ecx, [ebp - 0x8c]
push eax
call fcn.00410f70
push ecx
lea ecx, [ebp - 0x44]
push dword [eax]
push esi
call fcn.00410fe0
mov bl, 0x48
mov byte [ebp - 9], 0
mov al, 6
mov byte [ebp - 0xd], bl
mov cl, 0x67
mov byte [ebp - 9], 0
xor al, bl
xor cl, bl
mov dl, 9
mov byte [ebp - 0xc], al
push ecx
lea eax, [ebp - 0xc]
mov byte [ebp - 0xb], cl
xor dl, bl
lea ecx, [ebp - 0x44]
push eax
mov byte [ebp - 0xa], dl
call fcn.00406c10
cmp eax, 0xffffffff
je 0x41092b
mov al, 0x1f
mov cl, 0x2f
xor al, cl
mov byte [ebp - 1], 0
mov byte [ebp - 2], al
lea eax, [ebp - 2]
mov byte [ebp - 3], cl
mov byte [ebp - 1], 0
jmp 0x410ede
mov ch, 0x2a
mov byte [ebp - 9], 0
mov al, 0x6b
mov byte [ebp - 0xf], ch
mov cl, 0x5c
mov byte [ebp - 9], 0
mov ah, 0x5e
xor al, ch
xor ah, ch
mov byte [ebp - 0xe], al
xor cl, ch
mov byte [ebp - 0xa], ah
mov dl, 0x4b
mov byte [ebp - 0xd], cl
push ecx
mov bl, 0x59
lea eax, [ebp - 0xe]
xor dl, ch
xor bl, ch
push eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 0xc], dl
mov byte [ebp - 0xb], bl
call fcn.00406e80
push eax
lea ecx, [ebp - 0x44]
call fcn.00406c50
cmp eax, 0xffffffff
lea ecx, [ebp - 0x60]
setne bl
call fcn.00406d60
test bl, bl
je 0x410989
mov cl, 0x6c
mov al, 0x5d
jmp 0x410913
mov ch, 0x2d
mov byte [ebp - 9], 0
mov al, 0x6c
mov byte [ebp - 0xf], ch
mov cl, 0x5b
mov byte [ebp - 9], 0
mov ah, 0x4c
xor al, ch
xor ah, ch
mov byte [ebp - 0xe], al
xor cl, ch
mov byte [ebp - 0xa], ah
mov dl, 0x44
mov byte [ebp - 0xd], cl
push ecx
mov bl, 0x5f
lea eax, [ebp - 0xe]
xor dl, ch
xor bl, ch
push eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 0xc], dl
mov byte [ebp - 0xb], bl
call fcn.00406e80
push eax
lea ecx, [ebp - 0x44]
call fcn.00406c50
cmp eax, 0xffffffff
lea ecx, [ebp - 0x60]
setne bl
call fcn.00406d60
test bl, bl
je 0x4109ea
mov cl, 0x3b
mov al, 9
jmp 0x410913
mov byte [ebp - 0x13], 0x6a
mov al, 0x21
xor al, byte [ebp - 0x13]
mov dl, 0x19
mov byte [ebp - 0x12], al
mov cl, 0xb
mov al, byte [ebp - 0x13]
mov ch, 0x18
xor cl, al
mov byte [ebp - 0x21], 0x13
xor ch, al
mov byte [ebp - 0x11], cl
mov dh, dl
mov byte [ebp - 0xd], ch
xor dl, al
mov byte [ebp - 9], 0
xor dh, al
mov byte [ebp - 0x10], dl
mov ah, 0xf
mov byte [ebp - 0xc], dh
xor ah, al
mov byte [ebp - 9], 0
mov bl, 0x1a
mov byte [ebp - 0xe], ah
xor bl, al
mov bh, 1
xor bh, al
mov byte [ebp - 0xf], bl
mov al, byte [ebp - 0x21]
xor al, byte [ebp - 0x13]
mov byte [ebp - 0xa], al
lea eax, [ebp - 0x12]
push ecx
push eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 0xb], bh
call fcn.00406e80
push eax
lea ecx, [ebp - 0x44]
call fcn.00406c50
cmp eax, 0xffffffff
lea ecx, [ebp - 0x60]
setne bl
call fcn.00406d60
test bl, bl
je 0x410a70
mov cl, 0x7c
mov al, 0x4f
jmp 0x410913
mov ah, 0x70
mov byte [ebp - 9], 0
mov al, 0x35
mov byte [ebp - 0xe], ah
mov dl, al
mov byte [ebp - 9], 0
mov cl, 0x23
xor al, ah
xor cl, ah
mov byte [ebp - 0xd], al
mov bl, 0x24
mov byte [ebp - 0xc], cl
xor dl, ah
xor bl, ah
push ecx
lea eax, [ebp - 0xd]
mov byte [ebp - 0xb], dl
push eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 0xa], bl
call fcn.00406e80
push eax
lea ecx, [ebp - 0x44]
call fcn.00406c50
cmp eax, 0xffffffff
lea ecx, [ebp - 0x60]
setne bl
call fcn.00406d60
test bl, bl
je 0x410aca
mov cl, 1
mov al, 0x35
jmp 0x410913
mov ch, 0x2a
mov byte [ebp - 9], 0
mov cl, 0x4b
mov byte [ebp - 0xf], ch
mov ah, cl
mov byte [ebp - 9], 0
mov al, 0x7a
xor ah, ch
xor al, ch
mov byte [ebp - 0xa], ah
xor cl, ch
mov byte [ebp - 0xe], al
mov dl, 0x44
mov byte [ebp - 0xd], cl
push ecx
mov bl, 0x4e
lea eax, [ebp - 0xe]
xor dl, ch
xor bl, ch
push eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 0xc], dl
mov byte [ebp - 0xb], bl
call fcn.00406e80
push eax
lea ecx, [ebp - 0x44]
call fcn.00406c50
cmp eax, 0xffffffff
lea ecx, [ebp - 0x60]
setne bl
call fcn.00406d60
test bl, bl
je 0x410b2b
mov cl, 0x45
mov al, 0x70
jmp 0x410913
mov ch, 0x7b
mov byte [ebp - 9], 0
mov al, 0x3f
mov byte [ebp - 0xf], ch
mov cl, 9
mov byte [ebp - 9], 0
mov ah, 0x39
xor al, ch
xor ah, ch
mov byte [ebp - 0xe], al
xor cl, ch
mov byte [ebp - 0xa], ah
mov dl, 0x2c
mov byte [ebp - 0xd], cl
push ecx
mov bl, 0x3e
lea eax, [ebp - 0xe]
xor dl, ch
xor bl, ch
push eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 0xc], dl
mov byte [ebp - 0xb], bl
call fcn.00406e80
push eax
lea ecx, [ebp - 0x44]
call fcn.00406c50
cmp eax, 0xffffffff
lea ecx, [ebp - 0x60]
setne bl
call fcn.00406d60
test bl, bl
je 0x410b8a
mov al, 0x19
jmp 0x410911
mov bl, 0x7b
mov byte [ebp - 9], 0
mov al, 0x3a
mov byte [ebp - 0xd], bl
mov cl, 0x2d
mov byte [ebp - 9], 0
xor al, bl
xor cl, bl
mov dl, 0x3c
mov byte [ebp - 0xc], al
push ecx
lea eax, [ebp - 0xc]
mov byte [ebp - 0xb], cl
xor dl, bl
lea ecx, [ebp - 0x60]
push eax
mov byte [ebp - 0xa], dl
call fcn.00406e80
push eax
lea ecx, [ebp - 0x44]
call fcn.00406c50
cmp eax, 0xffffffff
lea ecx, [ebp - 0x60]
setne bl
call fcn.00406d60
test bl, bl
je 0x410bdd
mov cl, 0x60
mov al, 0x57
jmp 0x410913
mov bl, 0x55
mov byte [ebp - 9], 0
mov al, 0x66
mov byte [ebp - 0xd], bl
mov cl, 0x63
mov byte [ebp - 9], 0
xor al, bl
xor cl, bl
mov dl, 0x65
mov byte [ebp - 0xc], al
push ecx
lea eax, [ebp - 0xc]
mov byte [ebp - 0xb], cl
xor dl, bl
lea ecx, [ebp - 0x60]
push eax
mov byte [ebp - 0xa], dl
call fcn.00406e80
push eax
lea ecx, [ebp - 0x44]
call fcn.00406c50
cmp eax, 0xffffffff
lea ecx, [ebp - 0x60]
setne bl
call fcn.00406d60
test bl, bl
je 0x410c30
mov cl, 2
mov al, 0x3a
jmp 0x410913
mov cl, 0x20
mov dword [ebp - 0x15], 0x54496220
mov dword [ebp - 0x11], 0x45464544
xor eax, eax
mov dword [ebp - 0xd], 0x5245444e
mov byte [ebp - 9], 0
nop dword [eax]
xor byte [ebp + eax - 0x14], cl
inc eax
cmp eax, 0xb
jae 0x410c5f
mov cl, byte [ebp - 0x15]
jmp 0x410c50
push ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 9], 0
push eax
lea ecx, [ebp - 0x60]
call fcn.00406e80
push eax
lea ecx, [ebp - 0x44]
call fcn.00406c50
cmp eax, 0xffffffff
lea ecx, [ebp - 0x60]
setne bl
call fcn.00406d60
test bl, bl
je 0x410c94
mov cl, 0x52
mov al, 0x6b
jmp 0x410913
mov dh, 0x3f
mov byte [ebp - 9], 0
mov cl, 0x50
mov byte [ebp - 0x10], dh
mov ah, cl
mov byte [ebp - 9], 0
mov al, 0x71
mov ch, 0x51
xor al, dh
xor cl, dh
xor ah, dh
mov byte [ebp - 0xf], al
xor ch, dh
mov byte [ebp - 0xb], ah
mov dl, 0x4d
mov byte [ebp - 0xe], cl
push ecx
mov bl, 0x4b
mov byte [ebp - 0xa], ch
lea eax, [ebp - 0xf]
xor dl, dh
xor bl, dh
mov byte [ebp - 0xd], dl
push eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 0xc], bl
call fcn.00406e80
push eax
lea ecx, [ebp - 0x44]
call fcn.00406c50
cmp eax, 0xffffffff
lea ecx, [ebp - 0x60]
setne bl
call fcn.00406d60
test bl, bl
je 0x410d16
mov dl, 8
mov al, 0x39
mov cl, 0x38
xor al, dl
mov byte [ebp - 1], 0
xor cl, dl
mov byte [ebp - 3], al
mov byte [ebp - 4], dl
lea eax, [ebp - 3]
mov byte [ebp - 2], cl
mov byte [ebp - 1], 0
jmp 0x410ede
mov dh, 0x53
mov cl, 0x3c
xor al, al
mov byte [ebp - 0x10], dh
mov ah, cl
mov byte [ebp - 9], al
mov ch, 0x20
mov byte [ebp - 9], 0
xor al, dh
xor cl, dh
xor ah, dh
mov byte [ebp - 0xf], al
xor ch, dh
mov byte [ebp - 0xb], ah
mov dl, 0x23
mov byte [ebp - 0xe], cl
push ecx
mov bl, 0x3b
mov byte [ebp - 0xa], ch
lea eax, [ebp - 0xf]
xor dl, dh
xor bl, dh
mov byte [ebp - 0xd], dl
push eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 0xc], bl
call fcn.00406e80
push eax
lea ecx, [ebp - 0x44]
call fcn.00406c50
cmp eax, 0xffffffff
lea ecx, [ebp - 0x60]
setne bl
call fcn.00406d60
test bl, bl
je 0x410d7f
mov al, 0x38
mov dl, 9
mov cl, al
jmp 0x410cf9
mov dh, 0x4f
mov byte [ebp - 9], 0
mov cl, 0x20
mov byte [ebp - 0x10], dh
mov ch, cl
mov byte [ebp - 9], 0
mov al, 0xc
mov bl, cl
mov ah, 0x2b
xor al, dh
xor cl, dh
mov byte [ebp - 0xf], al
xor ah, dh
mov byte [ebp - 0xe], cl
xor ch, dh
mov byte [ebp - 0xb], ah
mov dl, 0x22
mov byte [ebp - 0xa], ch
push ecx
lea eax, [ebp - 0xf]
xor dl, dh
xor bl, dh
mov byte [ebp - 0xd], dl
push eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 0xc], bl
call fcn.00406e80
push eax
lea ecx, [ebp - 0x44]
call fcn.00406c50
cmp eax, 0xffffffff
lea ecx, [ebp - 0x60]
setne bl
call fcn.00406d60
test bl, bl
je 0x410de9
mov dl, 0x43
mov al, 0x72
mov cl, 0x71
jmp 0x410cf9
mov bl, 0x49
mov byte [ebp - 9], 0
mov al, 0x1b
mov byte [ebp - 0xd], bl
mov cl, 8
mov byte [ebp - 9], 0
xor al, bl
xor cl, bl
mov dl, 0x1f
mov byte [ebp - 0xc], al
push ecx
lea eax, [ebp - 0xc]
mov byte [ebp - 0xb], cl
xor dl, bl
lea ecx, [ebp - 0x60]
push eax
mov byte [ebp - 0xa], dl
call fcn.00406e80
push eax
lea ecx, [ebp - 0x44]
call fcn.00406c50
cmp eax, 0xffffffff
lea ecx, [ebp - 0x60]
setne bl
call fcn.00406d60
test bl, bl
je 0x410e3e
mov dl, 0x70
mov al, 0x41
mov cl, 0x44
jmp 0x410cf9
mov byte [ebp - 0x12], 0x19
mov al, 0x5d
xor al, byte [ebp - 0x12]
mov cl, 0x7c
mov bl, cl
mov byte [ebp - 0x11], al
mov al, byte [ebp - 0x12]
mov ah, 0x77
mov ch, 0x7d
mov byte [ebp - 9], 0
xor cl, al
mov byte [ebp - 9], 0
xor ch, al
mov byte [ebp - 0x10], cl
mov dh, bl
mov byte [ebp - 0xc], ch
xor ah, al
mov dl, 0x7f
mov bh, 0x6b
mov byte [ebp - 0xd], ah
xor dl, al
xor bl, al
xor dh, al
mov byte [ebp - 0xf], dl
xor bh, al
mov byte [ebp - 0xe], bl
push ecx
lea eax, [ebp - 0x11]
mov byte [ebp - 0xb], dh
push eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 0xa], bh
call fcn.00406e80
push eax
lea ecx, [ebp - 0x44]
call fcn.00406c50
cmp eax, 0xffffffff
lea ecx, [ebp - 0x60]
setne bl
call fcn.00406d60
test bl, bl
je 0x410eb9
mov dl, 0x34
mov al, 5
mov cl, 7
jmp 0x410cf9
mov bl, 0x56
mov byte [ebp - 9], 0
mov al, 0x18
mov byte [ebp - 0xd], bl
mov cl, 0x79
mov byte [ebp - 9], 0
xor al, bl
mov dl, 0x17
xor cl, bl
mov byte [ebp - 0xc], al
xor dl, bl
mov byte [ebp - 0xb], cl
mov byte [ebp - 0xa], dl
lea eax, [ebp - 0xc]
push eax
mov ecx, edi
call fcn.00406e80
lea ecx, [ebp - 0x44]
call fcn.00406d60
lea ecx, [ebp - 0x8c]
call fcn.00406b40
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret