Function at 0x412f95
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x614
mov eax, 0x51fb5d
call fcn.004ebd02
mov esi, ecx
mov dword [ebp - 0x17c], esi
mov dword [ebp - 0x1e8], esi
xor ebx, ebx
push 0x3e9
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
lea ecx, [esi + 0x7b4]
mov al, 1
xchg byte [ecx], al
lea ecx, [esi + 0x800]
mov eax, dword [ecx]
nop
add eax, eax
xchg dword [ecx], eax
mov dword [ebp - 4], ebx
wait
push ecx
lea ecx, [ebp - 0x180]
call fcn.0042dce2
pop ecx
mov byte [ebp - 4], 1
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], 0xf
mov byte [ebp - 0x5c], bl
mov byte [ebp - 4], 2
xor eax, eax
lea edi, [ebp - 0x74]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xorps xmm0, xmm0
movsd qword [ebp - 0x64], xmm0
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantTimeToSystemTime]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x41304b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x160]
push eax
push 0x5500c0
push 0x17
push ebx
push 0x53e888
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4130a6
push dword [ebp - 0x160]
call dword [sym.imp.ole32.dll_OleRun]
mov esi, eax
test esi, esi
js 0x413091
mov ecx, dword [ebp - 0x160]
mov eax, dword [ecx]
lea edx, [ebp - 0x18]
push edx
push 0x550164
push ecx
call dword [eax]
mov esi, eax
mov eax, dword [ebp - 0x160]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
js 0x4130a6
mov eax, dword [ebp - 0x18]
jmp 0x4130ab
mov eax, ebx
mov dword [ebp - 0x18], eax
test eax, eax
je 0x413aa5
mov ecx, dword [eax]
push ebx
push ecx
push ecx
movsd xmm0, qword [ebp - 0x64]
movsd qword [esp], xmm0
push eax
call dword [ecx + 0xb0]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 4
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x413aa5
mov eax, dword [esi]
mov edi, dword [eax + 0x1c]
mov dword [ebp - 0x178], edi
push 0xc
call fcn.004eaf11
pop ecx
mov ecx, eax
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x1ec], ecx
mov byte [ebp - 4], 5
test ecx, ecx
je 0x413122
xor eax, eax
mov edi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ecx + 4], ebx
mov dword [ecx + 8], 1
mov dword [ecx], ebx
mov edi, dword [ebp - 0x178]
jmp 0x41312a
mov ecx, ebx
mov dword [ebp - 0x160], ecx
mov byte [ebp - 4], 4
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x413b8b
push ecx
push esi
call edi
mov eax, dword [ebp - 0x160]
push dword [eax]
lea ecx, [ebp - 0x8c]
call fcn.00423d92
mov byte [ebp - 4], 6
push 0x98
push ebx
lea eax, [ebp - 0x15c]
push eax
call fcn.004eddc0
pop ecx
pop ecx
lea ecx, [ebp - 0x15c]
call fcn.00422512
mov byte [ebp - 4], 7
push str._AND_TimeGenerated___
push str._AND__EventCode__1000_OR_EventCode__1002_OR_EventCode__1026_
push str._AND_EventType___3
push str._WHERE_Logfile__Application
push str.Win32_NTLogEvent
lea eax, [ebp - 0x15c]
push eax
call fcn.0042cb53
pop ecx
pop ecx
push eax
call fcn.0042cb53
pop ecx
pop ecx
push eax
call fcn.0042cb53
pop ecx
pop ecx
push eax
call fcn.0042cb53
pop ecx
pop ecx
push eax
call fcn.0042cb53
pop ecx
pop ecx
mov esi, eax
lea edx, [ebp - 0x8c]
lea ecx, [ebp - 0x408]
call fcn.0040aab1
mov byte [ebp - 4], 8
push 0x54bc10
push 0x578c10
push str._AND_Message_LIKE__
push 0x54bc2c
push eax
push esi
call fcn.0042cd1a
pop ecx
pop ecx
push eax
call fcn.0042cb53
pop ecx
pop ecx
push eax
call fcn.0042cb53
pop ecx
pop ecx
push eax
call fcn.0042cd1a
pop ecx
pop ecx
push eax
call fcn.0042cb53
pop ecx
pop ecx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x408]
call fcn.00426e9b
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x15c]
call fcn.004223f3
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x5c]
call fcn.00424088
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x420]
call fcn.00426e9b
lea ecx, [ebp - 0xc4]
call fcn.0040d3b1
mov byte [ebp - 4], 0xa
mov edi, dword [ebp - 0x17c]
mov eax, dword [edi + 0x7fc]
mov dword [ebp - 0x178], eax
nop
mov edx, eax
lea ecx, [ebp - 0x480]
call fcn.00407a57
mov byte [ebp - 4], 0xb
push eax
push 0x54b40c
lea ecx, [ebp - 0x3f0]
call fcn.0042d31e
mov byte [ebp - 4], 0xc
mov edx, dword [0x578c40]
lea ecx, [ebp - 0x468]
call fcn.00407a57
mov byte [ebp - 4], 0xd
push eax
push ecx
lea ecx, [ebp - 0x3c0]
call fcn.0042d35d
mov byte [ebp - 4], 0xe
push ecx
push ecx
lea ecx, [ebp - 0x390]
call fcn.0042d39e
mov byte [ebp - 4], 0xf
call fcn.0040d233
mov esi, 0x54bcdc
mov ecx, 0x54bce0
test al, al
cmove esi, ecx
mov dword [ebp - 0x360], ebx
mov dword [ebp - 0x350], ebx
mov dword [ebp - 0x34c], ebx
mov dword [ebp - 0x350], ebx
mov dword [ebp - 0x34c], 0xf
mov byte [ebp - 0x360], bl
push 4
push str.init
lea ecx, [ebp - 0x360]
call fcn.00423f7a
mov byte [ebp - 4], 0x10
push esi
lea ecx, [ebp - 0x348]
call fcn.004240ee
mov byte [ebp - 4], 0x11
mov byte [ebp - 4], 0x12
mov eax, dword [edi + 0x800]
mov dword [ebp - 0x178], eax
nop
mov edx, eax
lea ecx, [ebp - 0x4e0]
call fcn.00407a57
mov byte [ebp - 4], 0x13
push eax
push ecx
lea ecx, [ebp - 0x330]
call fcn.0042d3f1
mov byte [ebp - 4], 0x14
mov edx, dword [ebp - 0x90]
lea ecx, [ebp - 0x450]
call fcn.00407a57
mov esi, eax
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x300], ebx
mov dword [ebp - 0x2f0], ebx
mov dword [ebp - 0x2ec], ebx
mov dword [ebp - 0x2f0], ebx
mov dword [ebp - 0x2ec], 0xf
mov byte [ebp - 0x300], bl
push 0xd
push str.server_report
lea ecx, [ebp - 0x300]
call fcn.00423f7a
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x2e8], ebx
mov dword [ebp - 0x2d8], ebx
mov dword [ebp - 0x2d4], ebx
push esi
lea ecx, [ebp - 0x2e8]
call fcn.00427241
mov byte [ebp - 4], 0x17
mov byte [ebp - 4], 0x18
mov edx, dword [ebp - 0x94]
lea ecx, [ebp - 0x438]
call fcn.00407a57
mov esi, eax
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x2d0], ebx
mov dword [ebp - 0x2c0], ebx
mov dword [ebp - 0x2bc], ebx
mov dword [ebp - 0x2c0], ebx
mov dword [ebp - 0x2bc], 0xf
mov byte [ebp - 0x2d0], bl
push 0xa
push str.server_new
lea ecx, [ebp - 0x2d0]
call fcn.00423f7a
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x2b8], ebx
mov dword [ebp - 0x2a8], ebx
mov dword [ebp - 0x2a4], ebx
push esi
lea ecx, [ebp - 0x2b8]
call fcn.00427241
mov byte [ebp - 4], 0x1b
mov byte [ebp - 4], 0x1c
lea eax, [ebp - 0xac]
push eax
push str.server_hash_old
lea ecx, [ebp - 0x2a0]
call fcn.0042dd0c
mov byte [ebp - 4], 0x1d
lea eax, [ebp - 0xc4]
push eax
push str.server_hash_new
lea ecx, [ebp - 0x270]
call fcn.0042dd0c
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x3f0]
mov dword [ebp - 0x1f0], ecx
lea eax, [ebp - 0x240]
mov dword [ebp - 0x1ec], eax
push eax
push ecx
lea ecx, [ebp - 0x200]
call fcn.00421dee
mov byte [ebp - 4], 0x23
lea eax, [ebp - 0x200]
push eax
mov ecx, edi
call fcn.0041fa4e
mov byte [ebp - 4], 0x24
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x200]
call fcn.00421e7c
mov byte [ebp - 4], 0x21
push fcn.0040aff5
push 9
push 0x30
lea eax, [ebp - 0x3f0]
push eax
call fcn.004eaf41
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x438]
call fcn.00426e9b
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x450]
call fcn.00426e9b
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x4e0]
call fcn.00426e9b
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x468]
call fcn.00426e9b
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x480]
call fcn.00426e9b
xor eax, eax
lea edi, [ebp - 0x44]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
push str.SourceName
lea ecx, [ebp - 0x570]
call fcn.0040aec6
mov byte [ebp - 4], 0x25
push ebx
push str.InsertionStrings
lea ecx, [ebp - 0x540]
call fcn.0040aec6
mov byte [ebp - 4], 0x26
lea eax, [ebp - 0x570]
mov dword [ebp - 0x1f8], eax
lea eax, [ebp - 0x510]
mov dword [ebp - 0x1f4], eax
lea eax, [ebp - 0x1f8]
push eax
lea edx, [ebp - 0x5c]
lea ecx, [ebp - 0x44]
call fcn.0040b3a8
mov byte [ebp - 4], 0x28
mov dword [esp], fcn.0040aff5
push 2
push 0x30
lea eax, [ebp - 0x570]
push eax
call fcn.004eaf41
mov esi, dword [ebp - 0x44]
mov edi, dword [ebp - 0x40]
cmp esi, edi
je 0x4139b1
mov dword [ebp - 0x184], esi
mov dword [ebp - 0x160], edi
cmp esi, edi
je 0x4139b1
xorps xmm0, xmm0
movlpd qword [ebp - 0x24], xmm0
push ecx
push esi
lea ecx, [ebp - 0x24]
call fcn.0042f67c
mov byte [ebp - 4], 0x29
mov byte [ebp - 4], 0x2a
cmp dword [ebp - 0x20], 0
je 0x413993
mov edi, dword [ebp - 0x17c]
mov eax, dword [edi + 0x7fc]
mov dword [ebp - 0x178], eax
nop
mov edx, eax
lea ecx, [ebp - 0x498]
call fcn.00407a57
mov esi, eax
mov byte [ebp - 4], 0x2b
mov dword [ebp - 0x1e4], ebx
mov dword [ebp - 0x1d4], ebx
mov dword [ebp - 0x1d0], ebx
mov dword [ebp - 0x1d4], ebx
mov dword [ebp - 0x1d0], 0xf
mov byte [ebp - 0x1e4], bl
push 4
push 0x54b40c
lea ecx, [ebp - 0x1e4]
call fcn.00423f7a
mov byte [ebp - 4], 0x2c
lea eax, [ebp - 0x1e4]
push eax
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x24]
call fcn.0042f5ed
push esi
mov ecx, dword [eax]
add ecx, 0x28
call fcn.00424088
mov byte [ebp - 4], 0x2b
mov eax, dword [ebp - 0x1d0]
cmp eax, 0x10
jb 0x4136c9
inc eax
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x1e4]
mov dword [ebp - 0x164], ecx
cmp eax, 0x1000
jb 0x4136c0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.0040498f
pop ecx
pop ecx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x164]
push eax
push ecx
call fcn.004eb2ca
pop ecx
pop ecx
mov dword [ebp - 0x1d4], ebx
mov dword [ebp - 0x1d0], 0xf
mov byte [ebp - 0x1e4], bl
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x498]
call fcn.00426e9b
mov edx, dword [0x578c40]
lea ecx, [ebp - 0x4b0]
call fcn.00407a57
mov esi, eax
mov byte [ebp - 4], 0x2d
mov dword [ebp - 0x19c], ebx
mov dword [ebp - 0x18c], ebx
mov dword [ebp - 0x188], ebx
mov dword [ebp - 0x18c], ebx
mov dword [ebp - 0x188], 0xf
mov byte [ebp - 0x19c], bl
push 5
push str.appid
lea ecx, [ebp - 0x19c]
call fcn.00423f7a
mov byte [ebp - 4], 0x2e
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x24]
call fcn.0042f5ed
push esi
mov ecx, dword [eax]
add ecx, 0x28
call fcn.00424088
mov byte [ebp - 4], 0x2d
mov eax, dword [ebp - 0x188]
cmp eax, 0x10
jb 0x4137ae
inc eax
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x19c]
mov dword [ebp - 0x16c], ecx
cmp eax, 0x1000
jb 0x4137a5
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x16c]
push eax
call fcn.0040498f
pop ecx
pop ecx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x16c]
push eax
push ecx
call fcn.004eb2ca
pop ecx
pop ecx
mov dword [ebp - 0x18c], ebx
mov dword [ebp - 0x188], 0xf
mov byte [ebp - 0x19c], bl
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x4b0]
call fcn.00426e9b
mov dword [ebp - 0x1cc], ebx
mov dword [ebp - 0x1bc], ebx
mov dword [ebp - 0x1b8], ebx
mov dword [ebp - 0x1bc], ebx
mov dword [ebp - 0x1b8], 0xf
mov byte [ebp - 0x1cc], bl
push 3
push 0x54b41c
lea ecx, [ebp - 0x1cc]
call fcn.00423f7a
mov byte [ebp - 4], 0x2f
lea eax, [ebp - 0x1cc]
push eax
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x24]
call fcn.0042f5ed
push 0x578d28
mov ecx, dword [eax]
add ecx, 0x28
call fcn.0042405b
mov byte [ebp - 4], 0x2a
mov eax, dword [ebp - 0x1b8]
cmp eax, 0x10
jb 0x413880
inc eax
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x1cc]
mov dword [ebp - 0x170], ecx
cmp eax, 0x1000
jb 0x413877
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x170]
push eax
call fcn.0040498f
pop ecx
pop ecx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x170]
push eax
push ecx
call fcn.004eb2ca
pop ecx
pop ecx
mov dword [ebp - 0x1bc], ebx
mov dword [ebp - 0x1b8], 0xf
mov byte [ebp - 0x1cc], bl
mov edx, dword [ebp - 0x40]
sub edx, dword [ebp - 0x44]
sar edx, 3
lea ecx, [ebp - 0x4c8]
call fcn.00407abd
mov esi, eax
mov byte [ebp - 4], 0x30
mov dword [ebp - 0x1b4], ebx
mov dword [ebp - 0x1a4], ebx
mov dword [ebp - 0x1a0], ebx
mov dword [ebp - 0x1a4], ebx
push 0xf
pop eax
mov dword [ebp - 0x1a0], eax
mov byte [ebp - 0x1b4], bl
push eax
push str.event_log_error
lea ecx, [ebp - 0x1b4]
call fcn.00423f7a
mov byte [ebp - 4], 0x31
lea eax, [ebp - 0x1b4]
push eax
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x24]
call fcn.0042f5ed
push esi
mov ecx, dword [eax]
add ecx, 0x28
call fcn.00424088
mov byte [ebp - 4], 0x30
mov eax, dword [ebp - 0x1a0]
cmp eax, 0x10
jb 0x413957
inc eax
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x1b4]
mov dword [ebp - 0x168], ecx
cmp eax, 0x1000
jb 0x41394e
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x168]
push eax
call fcn.0040498f
pop ecx
pop ecx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x168]
push eax
push ecx
call fcn.004eb2ca
pop ecx
pop ecx
mov dword [ebp - 0x1a4], ebx
mov dword [ebp - 0x1a0], 0xf
mov byte [ebp - 0x1b4], bl
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x4c8]
call fcn.00426e9b
lea eax, [ebp - 0x24]
push eax
mov ecx, edi
call fcn.0041fa4e
mov esi, dword [ebp - 0x184]
mov edi, dword [ebp - 0x160]
mov byte [ebp - 4], 0x32
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x24]
call fcn.00421e7c
add esi, 8
mov dword [ebp - 0x184], esi
jmp 0x4135ce
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x44]
call fcn.004212a7
mov byte [ebp - 4], 0x33
mov byte [ebp - 4], 0x34
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xc4]
call fcn.0040d8fd
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x15c]
call fcn.0040a753
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x8c]
call fcn.00426c73
mov byte [ebp - 4], 3
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x413a22
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
mov dword [ebp - 0x1ec], eax
jne 0x413a1f
mov ecx, esi
call fcn.00408e0a
push 0xc
push esi
call fcn.004eb2ca
pop ecx
pop ecx
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x413a33
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x48]
cmp eax, 0x10
jb 0x413a77
inc eax
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x174], ecx
cmp eax, 0x1000
jb 0x413a6e
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x174]
push eax
call fcn.0040498f
pop ecx
pop ecx
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x174]
push eax
push ecx
call fcn.004eb2ca
pop ecx
pop ecx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], 0xf
mov byte [ebp - 0x5c], bl
mov byte [ebp - 4], bl
cmp byte [ebp - 0x17f], 0
je 0x413a95
call fcn.00413b96
wait
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x17c]
jmp 0x413b7d
push 0x80004003
jmp 0x413b90
push ebx
mov ecx, eax
call fcn.0044f5b4
call fcn.004ebc54
ret
push 0x8007000e
call fcn.004eaa00
int3