Function at 0x413e80
Capabilities:
Terminate process

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x24]
xor edx, edx
mov dword [0x65c5c8], eax
push ebx
mov ebx, 0x3881
mov dword [esp + 0x18], ebx
mov dword [esp + 4], edx
mov dword [esp + 8], edx
mov dword [esp + 0x10], 0x331d
mov dword [esp + 0xc], 0x318f
mov dword [esp + 0x14], 0x3b3c
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x10]
xor eax, 0x67e
push esi
push edi
cmp dword [esp + 0x10], eax
je 0x413fcd
mov eax, dword [0x65c49c]
xor ecx, ecx
inc ecx
mov esi, dword [esp + 0x10]
push 0x65c4a0
xor esi, 0x3894
mov dword [eax], ecx
mov eax, dword [0x65c49c]
mov dword [eax + 8], ecx
mov eax, dword [0x65c49c]
mov dword [0x65c4b8], edx
mov dword [0x65c4e0], edx
mov dword [0x65c4f0], edx
mov dword [0x65c4d0], 0x13
mov dword [eax + 0x54], edx
mov eax, dword [0x65c49c]
mov dword [0x65c514], ecx
mov dword [0x65c4f8], 6
mov dword [eax + 0x80], ecx
mov eax, dword [0x65c49c]
mov dword [0x65c534], ecx
mov dword [eax + 0x9c], ecx
mov eax, dword [0x65c49c]
mov dword [0x65c574], ecx
mov dword [0x65c578], edx
mov dword [0x65c540], 9
mov dword [0x65c560], 0x47
mov dword [0x65c56c], 0x49
mov dword [eax + 0xe0], edx
mov eax, dword [0x65c49c]
mov dword [0x65c588], edx
mov dword [eax + 0xf8], edx
mov eax, dword [0x65c49c]
mov dword [eax + 0x108], ecx
mov eax, dword [0x65c49c]
mov dword [eax + 0x114], ecx
mov dword [0x65c5b8], edx
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
sub edx, 0xd7
mov eax, dword [esp + 0x20]
xor ecx, ebx
xor eax, 0xe5f
push eax
push ecx
push edx
push esi
call fcn.00407e26
add esp, 0x14
mov dword [esp + 0x30], eax
push ebp
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x34]
add ebp, 0x7bc
mov esi, dword [esp + 0x34]
add edi, 0x156
mov edx, dword [esp + 0x10]
xor esi, 0xa88
mov ecx, dword [esp + 0x14]
add edx, 0x3881
mov eax, dword [esp + 0x1c]
add ecx, 0x318f
mov ebx, dword [0x65c49c]
sub eax, 0xd7
push eax
push ecx
push edx
push esi
push edi
push ebx
push ebp
call fcn.004013a0
mov dword [esp + 0x38], eax
add esp, 0x1c
mov eax, dword [esp + 0x34]
add eax, 0xfffff7a9
pop ebp
cmp dword [esp + 0x10], eax
jg 0x4141b5
mov eax, dword [esp + 0x10]
add eax, 0x3aeb
cmp dword [esp + 0xc], eax
je 0x414142
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
sub ebx, 0x9ad
mov esi, dword [esp + 0xc]
sub edi, 0x77d
mov ecx, dword [esp + 0x10]
add esi, 0x3894
mov eax, dword [esp + 0x10]
xor ecx, 0x318f
mov edx, dword [0x65c49c]
add eax, 0x3563
push eax
push ecx
push edx
push esi
push edi
push ebx
call fcn.00403a3e
mov dword [esp + 0x34], eax
mov edi, dword [esp + 0x34]
mov esi, dword [esp + 0x34]
sub edi, 0x18d
mov edx, dword [esp + 0x38]
add esi, 0x11b
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x48]
xor ecx, 0xd
push dword [0x65c49c]
xor eax, 0xad
push eax
push ecx
push edx
push esi
push edi
call fcn.00414380
mov dword [esp + 0x44], eax
mov eax, dword [0x65c49c]
push 0x65c4a0
mov dword [eax + 0x64], 0x54a000
add dword [esp + 0x64], 0xfffff79c
xor dword [esp + 0x48], 0xbae
mov ebx, dword [esp + 0x40]
mov edi, dword [esp + 0x64]
add ebx, 0x3aeb
mov esi, dword [esp + 0x54]
xor edi, 0xabe
mov edx, dword [esp + 0x44]
add esi, 0x2bb
mov ecx, dword [esp + 0x44]
add edx, 0x394b
mov eax, dword [esp + 0x48]
xor ecx, 0x3881
push eax
push ecx
push edx
push esi
push edi
push ebx
call fcn.00413ae7
mov dword [esp + 0x7c], eax
add esp, 0x4c
add dword [esp + 0x30], 0xfffff7a9
mov eax, dword [esp + 0x30]
jmp 0x4141b1
mov eax, dword [esp + 0x18]
or eax, dword [0x65c578]
cmp dword [0x65c4a8], eax
jae 0x4141b5
mov eax, dword [esp + 0xc]
mov ecx, dword [0x65c514]
sub ecx, eax
sub ecx, 0x3b3c
cmp dword [0x65c4a8], ecx
ja 0x4141b5
mov eax, dword [0x65c4f4]
imul eax, dword [0x65c56c]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
sub dword [0x65c578], eax
mov eax, dword [0x65c49c]
or edx, dword [eax + 0xb8]
mov eax, dword [esp + 0xc]
and ecx, edx
imul eax, ecx
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
add ecx, dword [0x65c544]
mov eax, dword [esp + 0x30]
imul eax, ecx
mov dword [esp + 0x30], eax
mov eax, dword [0x65c49c]
push dword [eax + 0xb0]
call dword [sym.imp.KERNEL32.dll_ExitProcess]