Function at 0x4081f7
Capabilities:
Connect to wmi namespace via wbemlocator
Contain obfuscated stackstrings
Encode data using xor
Enumerate process modules
Get disk information
Get disk size
Get system firmware table
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41a1db
mov eax, dword fs:[0]
push eax
mov eax, 0x26dc
call fcn.00419590
mov eax, dword [0x41f040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x24f4], esi
lea ecx, [ebp - 0x26e8]
call fcn.0040380e
lea ecx, [ebp - 0x25f0]
call fcn.004066bd
lea ecx, [ebp - 0x2564]
call fcn.004065b8
movaps xmm0, xmmword [0x401f50]
xor ecx, ecx
movups xmmword [ebp - 0x21a0], xmm0
mov dword [ebp - 0x2190], 0x32322f73
mov dword [ebp - 0x218c], 0x32323232
mov word [ebp - 0x2188], 0x502
mov byte [ebp - 0x2186], 0
mov al, byte [ebp - 0x21a0]
xor byte [ebp + ecx - 0x219f], al
inc ecx
cmp ecx, 0x19
jb 0x408285
lea eax, [ebp - 0x219f]
mov byte [ebp - 0x2186], 0
push eax
push esi
call fcn.00406799
movaps xmm0, xmmword [0x401fe0]
pop ecx
pop ecx
movups xmmword [ebp - 0x22f4], xmm0
mov word [ebp - 0x22e4], 0xa0d
xor ecx, ecx
mov byte [ebp - 0x22e2], 0
movsx eax, byte [ebp - 0x22f4]
and eax, 0x8000000f
jns 0x4082e1
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x22f3], al
inc ecx
cmp ecx, 0x11
jb 0x4082ce
lea eax, [ebp - 0x22f3]
mov byte [ebp - 0x22e2], 0
push eax
push esi
call fcn.00406799
mov edx, dword [ebp - 0x26dc]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x26e8]
call fcn.004064a5
call eax
mov dl, 0x41
mov edi, eax
push 0x41
mov byte [ebp - 0x24e9], dl
pop ecx
xor eax, eax
add ecx, 0xffffffbf
inc eax
shl eax, cl
test edi, eax
je 0x408820
push 0x104
xor ecx, ecx
mov byte [ebp - 0x24fc], dl
mov edx, dword [ebp - 0x26d8]
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x2574]
mov byte [ebp - 0x24f9], cl
push eax
push ecx
push ecx
push ecx
push ecx
mov ecx, dword [ebp - 0x26e8]
lea eax, [ebp - 0x24fc]
push eax
mov word [ebp - 0x24fb], 0x5c3a
call fcn.004064a5
call eax
test eax, eax
je 0x408820
lea eax, [ebp - 0x24fc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
dec eax
sub eax, 1
je 0x408560
sub eax, 1
je 0x408513
sub eax, 1
je 0x4084ab
sub eax, 1
je 0x40846c
sub eax, 1
je 0x408414
xor edx, edx
mov dword [ebp - 0x20b4], 0x25201b4e
mov cl, 0x4e
mov dword [ebp - 0x20b0], 0x20392120
mov dword [ebp - 0x20ac], 0x273c0a6e
mov eax, edx
mov word [ebp - 0x20a8], 0x2b38
mov byte [ebp - 0x20a6], dl
xor byte [ebp + eax - 0x20b3], cl
inc eax
cmp eax, 0xd
jae 0x408403
mov cl, byte [ebp - 0x20b4]
jmp 0x4083ee
mov byte [ebp - 0x20a6], dl
lea ecx, [ebp - 0x20b3]
jmp 0x4085a4
xor edx, edx
mov dword [ebp - 0x2068], 0x51455614
mov al, 0x14
mov dword [ebp - 0x2064], 0x776d4824
mov word [ebp - 0x2060], 0x6f
mov ecx, edx
movsx eax, al
and eax, 0x8000000f
jns 0x408446
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x2067], al
inc ecx
cmp ecx, 8
jae 0x40845b
mov al, byte [ebp - 0x2068]
jmp 0x408437
mov byte [ebp - 0x205f], dl
lea ecx, [ebp - 0x2067]
jmp 0x4085a4
movaps xmm0, xmmword [0x402380]
xor edx, edx
movups xmmword [ebp - 0x2344], xmm0
mov word [ebp - 0x2334], 0x7f
mov ecx, edx
mov al, byte [ebp - 0x2344]
xor byte [ebp + ecx - 0x2343], al
inc ecx
cmp ecx, 0x10
jb 0x408487
mov byte [ebp - 0x2333], dl
lea ecx, [ebp - 0x2343]
jmp 0x4085a4
xor edx, edx
mov dword [ebp - 0x20a4], 0x77685173
mov al, 0x73
mov dword [ebp - 0x20a0], 0x6e75727a
mov dword [ebp - 0x209c], 0x6c754723
mov ecx, edx
mov word [ebp - 0x2098], 0x6879
mov byte [ebp - 0x2096], dl
movsx eax, al
and eax, 0x8000000f
jns 0x4084ed
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x20a3], al
inc ecx
cmp ecx, 0xd
jae 0x408502
mov al, byte [ebp - 0x20a4]
jmp 0x4084de
mov byte [ebp - 0x2096], dl
lea ecx, [ebp - 0x20a3]
jmp 0x4085a4
xor edx, edx
mov dword [ebp - 0x2084], 0x5a4b6422
mov cl, 0x22
mov dword [ebp - 0x2080], 0x66024647
mov dword [ebp - 0x207c], 0x47544b50
mov eax, edx
mov byte [ebp - 0x2078], dl
xor byte [ebp + eax - 0x2083], cl
inc eax
cmp eax, 0xb
jae 0x408552
mov cl, byte [ebp - 0x2084]
jmp 0x40853d
mov byte [ebp - 0x2078], dl
lea ecx, [ebp - 0x2083]
jmp 0x4085a4
movaps xmm0, xmmword [0x4024c0]
xor edx, edx
movups xmmword [ebp - 0x23a8], xmm0
mov byte [ebp - 0x2398], dl
mov ecx, edx
movsx eax, byte [ebp - 0x23a8]
and eax, 0x8000000f
jns 0x40858b
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x23a7], al
inc ecx
cmp ecx, 0xf
jb 0x408578
mov byte [ebp - 0x2398], dl
lea ecx, [ebp - 0x23a7]
mov al, 5
mov dword [ebp - 0x2074], 0x782a6005
mov dword [ebp - 0x2070], 0x25322562
mov dword [ebp - 0x206c], 0xf782a
movsx eax, al
and eax, 0x8000000f
jns 0x4085d3
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + edx - 0x2073], al
inc edx
cmp edx, 0xa
jae 0x4085e8
mov al, byte [ebp - 0x2074]
jmp 0x4085c4
push ecx
lea eax, [ebp - 0x24fc]
mov byte [ebp - 0x2069], 0
push eax
lea eax, [ebp - 0x2073]
push eax
push esi
call fcn.00406799
add esp, 0x10
test byte [ebp - 0x2574], 0x80
je 0x40864b
mov cl, 0x15
mov dword [ebp - 0x2038], 0x53415b15
mov word [ebp - 0x2034], 0x46
xor eax, eax
xor byte [ebp + eax - 0x2037], cl
inc eax
cmp eax, 4
jae 0x40863c
mov cl, byte [ebp - 0x2038]
jmp 0x408627
mov byte [ebp - 0x2033], 0
lea edx, [ebp - 0x2037]
jmp 0x40869a
mov al, 0xe
mov dword [ebp - 0x2048], 0x624f540e
mov word [ebp - 0x2044], 0x4041
xor ecx, ecx
mov byte [ebp - 0x2042], 0
movsx eax, al
and eax, 0x8000000f
jns 0x408678
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x2047], al
inc ecx
cmp ecx, 5
jae 0x40868d
mov al, byte [ebp - 0x2048]
jmp 0x408669
mov byte [ebp - 0x2042], 0
lea edx, [ebp - 0x2047]
movaps xmm0, xmmword [0x401f00]
xor ecx, ecx
push 3
pop eax
movups xmmword [ebp - 0x2308], xmm0
mov byte [ebp - 0x22f8], 0x7a
mov byte [ebp - 0x22f7], al
mov byte [ebp - 0x22f6], 0
mov al, byte [ebp - 0x2308]
xor byte [ebp + ecx - 0x2307], al
inc ecx
cmp ecx, 0x11
jb 0x4086c1
push edx
lea eax, [ebp - 0x2307]
mov byte [ebp - 0x22f6], 0
push eax
push esi
call fcn.00406799
add esp, 0xc
lea eax, [ebp - 0x25a0]
push eax
lea eax, [ebp - 0x25a8]
push eax
lea eax, [ebp - 0x25d0]
push eax
lea eax, [ebp - 0x24fc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x4087d3
mov edx, dword [ebp - 0x25a4]
mov ecx, dword [ebp - 0x25a8]
call fcn.00419a00
mulsd xmm0, qword [0x401c28]
mov edx, dword [ebp - 0x259c]
mov ecx, dword [ebp - 0x25a0]
movsd qword [ebp - 0x2584], xmm0
call fcn.00419a00
movaps xmm1, xmmword [0x402140]
xor ecx, ecx
mulsd xmm0, qword [0x401c28]
push 3
movups xmmword [ebp - 0x23d0], xmm1
pop eax
movaps xmm1, xmmword [0x401ea0]
movups xmmword [ebp - 0x23c0], xmm1
mov dword [ebp - 0x23b0], 0x4e296f3b
mov word [ebp - 0x23ac], 0x44b
mov byte [ebp - 0x23aa], al
mov byte [ebp - 0x23a9], 0
mov al, byte [ebp - 0x23d0]
xor byte [ebp + ecx - 0x23cf], al
inc ecx
cmp ecx, 0x26
jb 0x408791
sub esp, 0x10
mov byte [ebp - 0x23a9], 0
lea eax, [ebp - 0x23cf]
movsd qword [esp + 8], xmm0
movsd xmm0, qword [ebp - 0x2584]
movsd qword [esp], xmm0
push eax
push esi
call fcn.00406799
add esp, 0x18
jmp 0x408820
movaps xmm0, xmmword [0x401da0]
xor ecx, ecx
movups xmmword [ebp - 0x21dc], xmm0
mov dword [ebp - 0x21cc], 0x2d2c292c
mov dword [ebp - 0x21c8], 0x482c35
mov al, byte [ebp - 0x21dc]
xor byte [ebp + ecx - 0x21db], al
inc ecx
cmp ecx, 0x16
jb 0x4087f7
lea eax, [ebp - 0x21db]
mov byte [ebp - 0x21c5], 0
push eax
push esi
call fcn.00406799
pop ecx
pop ecx
mov al, byte [ebp - 0x24e9]
inc al
movsx ecx, al
mov dl, al
mov byte [ebp - 0x24e9], al
cmp ecx, 0x5a
jbe 0x408324
xor eax, eax
push eax
push eax
mov dword [ebp - 0x2504], eax
mov dword [ebp - 0x2500], eax
mov dword [ebp - 0x2510], eax
mov dword [ebp - 0x2508], eax
mov dword [ebp - 0x251c], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x408a1e
xor eax, eax
push eax
push eax
push eax
push 3
push eax
push eax
push eax
push 0xffffffffffffffff
push eax
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x408a18
lea eax, [ebp - 0x2504]
push eax
push 0x401044
push 1
push 0
push 0x401054
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x408a18
mov dword [ebp - 0x22b4], 0xffb0ffad
xor eax, eax
mov dword [ebp - 0x22b0], 0xffabffb0
mov dword [ebp - 0x22ac], 0xffbcffa3
mov dword [ebp - 0x22a8], 0xffb2ffb6
mov dword [ebp - 0x22a4], 0xffcdffa9
mov dword [ebp - 0x22a0], 0xffacffa3
mov dword [ebp - 0x229c], 0xff9cff9a
mov dword [ebp - 0x2298], 0xff8dff8a
mov dword [ebp - 0x2294], 0xff8bff96
mov dword [ebp - 0x2290], 0xffa3ff86
mov dword [ebp - 0x228c], 0xff96ffb2
mov dword [ebp - 0x2288], 0xff8dff9c
mov dword [ebp - 0x2284], 0xff8cff90
mov dword [ebp - 0x2280], 0xff99ff90
mov dword [ebp - 0x227c], 0xffa9ff8b
mov dword [ebp - 0x2278], 0xff93ff90
mov dword [ebp - 0x2274], 0xff92ff8a
mov dword [ebp - 0x2270], 0xffbaff9a
mov dword [ebp - 0x226c], 0xff9cff91
mov dword [ebp - 0x2268], 0xff86ff8d
mov dword [ebp - 0x2264], 0xff8bff8f
mov dword [ebp - 0x2260], 0xff90ff96
mov dword [ebp - 0x225c], 0xff91
not word [ebp + eax*2 - 0x22b4]
inc eax
cmp eax, 0x2d
jb 0x408992
xor eax, eax
lea ecx, [ebp - 0x2524]
mov word [ebp - 0x225a], ax
lea eax, [ebp - 0x22b4]
push eax
call fcn.0040685d
and dword [ebp - 4], 0
mov edx, dword [eax]
test edx, edx
je 0x4089c9
mov edx, dword [edx]
jmp 0x4089cb
xor edx, edx
mov eax, dword [ebp - 0x2504]
lea esi, [ebp - 0x2500]
push esi
xor esi, esi
push esi
mov ecx, dword [eax]
push esi
push esi
push esi
push esi
push esi
push edx
push eax
call dword [ecx + 0xc]
or dword [ebp - 4], 0xffffffff
mov esi, eax
mov ecx, dword [ebp - 0x2524]
test ecx, ecx
je 0x408a06
call fcn.004068f3
xor eax, eax
mov dword [ebp - 0x2524], eax
jmp 0x408a08
xor eax, eax
test esi, esi
jns 0x408a37
mov eax, dword [ebp - 0x2504]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00418755
leave
ret
push eax
push eax
push 3
pop ecx
push ecx
push ecx
push eax
push eax
push 0xa
push dword [ebp - 0x2500]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x408a60
mov eax, dword [ebp - 0x2500]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x408a0c
mov dword [ebp - 0x2240], 0xffbaffac
xor eax, eax
mov dword [ebp - 0x223c], 0xffbaffb3
mov dword [ebp - 0x2238], 0xffabffbc
mov dword [ebp - 0x2234], 0xffd5ffdf
mov dword [ebp - 0x2230], 0xffb9ffdf
mov dword [ebp - 0x222c], 0xffb0ffad
mov dword [ebp - 0x2228], 0xffdfffb2
mov dword [ebp - 0x2224], 0xff96ffa8
mov dword [ebp - 0x2220], 0xffccff91
mov dword [ebp - 0x221c], 0xffa0ffcd
mov dword [ebp - 0x2218], 0xff91ffba
mov dword [ebp - 0x2214], 0xff8dff9c
mov dword [ebp - 0x2210], 0xff8fff86
mov dword [ebp - 0x220c], 0xff9eff8b
mov dword [ebp - 0x2208], 0xff93ff9d
mov dword [ebp - 0x2204], 0xffa9ff9a
mov dword [ebp - 0x2200], 0xff93ff90
mov dword [ebp - 0x21fc], 0xff92ff8a
mov dword [ebp - 0x21f8], 0xff9a
not word [ebp + eax*2 - 0x2240]
inc eax
cmp eax, 0x25
jb 0x408b20
xor eax, eax
lea ecx, [ebp - 0x2520]
mov word [ebp - 0x21f6], ax
lea eax, [ebp - 0x2240]
push eax
call fcn.0040685d
mov edi, eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [ebp - 0x20bc], 0xffaeffa8
mov dword [ebp - 0x20b8], 0xffb3
not word [ebp + eax*2 - 0x20bc]
inc eax
cmp eax, 3
jb 0x408b68
xor eax, eax
lea ecx, [ebp - 0x2530]
mov word [ebp - 0x20b6], ax
lea eax, [ebp - 0x20bc]
push eax
call fcn.0040685d
mov byte [ebp - 4], 2
mov eax, dword [eax]
test eax, eax
je 0x408b9f
mov esi, dword [eax]
jmp 0x408ba1
xor esi, esi
mov eax, dword [edi]
test eax, eax
je 0x408bab
mov edx, dword [eax]
jmp 0x408bad
xor edx, edx
mov eax, dword [ebp - 0x2500]
lea edi, [ebp - 0x2510]
push edi
push 0
push 0x30
mov ecx, dword [eax]
push edx
push esi
push eax
call dword [ecx + 0x50]
mov ecx, dword [ebp - 0x2530]
mov esi, eax
test ecx, ecx
je 0x408bde
call fcn.004068f3
and dword [ebp - 0x2530], 0
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x2520]
test ecx, ecx
je 0x408bf8
call fcn.004068f3
and dword [ebp - 0x2520], 0
test esi, esi
jns 0x408eef
jmp 0x408a52
mov eax, dword [ecx]
lea edx, [ebp - 0x251c]
push edx
lea edx, [ebp - 0x2508]
push edx
push 1
push 0xffffffffffffffff
push ecx
call dword [eax + 0x10]
cmp dword [ebp - 0x251c], 0
je 0x408efd
mov dword [ebp - 0x20f4], 0xff8dffbb
xor eax, eax
mov dword [ebp - 0x20f0], 0xff89ff96
mov dword [ebp - 0x20ec], 0xffb3ff9a
mov dword [ebp - 0x20e8], 0xff8bff9a
mov dword [ebp - 0x20e4], 0xff9aff8b
mov dword [ebp - 0x20e0], 0xff8d
not word [ebp + eax*2 - 0x20f4]
inc eax
cmp eax, 0xb
jb 0x408c68
push 0
xor eax, eax
lea edx, [ebp - 0x25c8]
push 0
mov word [ebp - 0x20de], ax
mov eax, dword [ebp - 0x2508]
push edx
push 0
lea edx, [ebp - 0x20f4]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x10]
xor eax, eax
mov dword [ebp - 0x21c4], 0xff8dffaf
mov dword [ebp - 0x21c0], 0xff8bff90
mov dword [ebp - 0x21bc], 0xff9cff9a
mov dword [ebp - 0x21b8], 0xff96ff8b
mov dword [ebp - 0x21b4], 0xff91ff90
mov dword [ebp - 0x21b0], 0xff8bffac
mov dword [ebp - 0x21ac], 0xff8bff9e
mov dword [ebp - 0x21a8], 0xff8cff8a
mov word [ebp - 0x21a4], ax
movups xmm0, xmmword [ebp + eax*2 - 0x21c4]
andnps xmm0, xmmword [0x402650]
movups xmmword [ebp + eax*2 - 0x21c4], xmm0
add eax, 8
cmp eax, 0x10
jb 0x408cf8
push 0
xor eax, eax
lea edx, [ebp - 0x25b8]
push 0
mov word [ebp - 0x21a4], ax
mov eax, dword [ebp - 0x2508]
push edx
push 0
lea edx, [ebp - 0x21c4]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x408ec9
push 3
pop eax
cmp word [ebp - 0x25b8], ax
jne 0x408ec9
cmp dword [ebp - 0x25b0], 0
je 0x408ec9
push dword [ebp - 0x25c0]
call fcn.00418480
cmp dword [ebp - 0x25b0], 1
mov edi, eax
jne 0x408dbd
mov dl, 0x3f
mov dword [ebp - 0x24f8], 0x7d5e3f
xor ecx, ecx
movsx eax, dl
and eax, 0x8000000f
jns 0x408d98
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x24f7], al
inc ecx
cmp ecx, 2
jae 0x408dad
mov dl, byte [ebp - 0x24f8]
jmp 0x408d89
xor edx, edx
lea esi, [ebp - 0x24f7]
mov byte [ebp - 0x24f5], dl
jmp 0x408e05
xor edx, edx
mov dword [ebp - 0x2028], 0x69695273
mov al, 0x73
mov byte [ebp - 0x2024], dl
mov ecx, edx
movsx eax, al
and eax, 0x8000000f
jns 0x408de2
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x2027], al
inc ecx
push 3
pop eax
cmp ecx, eax
jae 0x408df9
mov al, byte [ebp - 0x2028]
jmp 0x408dd3
mov byte [ebp - 0x2024], dl
lea esi, [ebp - 0x2027]
movaps xmm0, xmmword [0x401eb0]
mov ecx, edx
movups xmmword [ebp - 0x22e0], xmm0
mov dword [ebp - 0x22d0], 0x117a2c
movsx eax, byte [ebp - 0x22e0]
and eax, 0x8000000f
jns 0x408e32
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x22df], al
inc ecx
cmp ecx, 0x12
jb 0x408e1f
push edi
mov edi, dword [ebp - 0x24f4]
lea eax, [ebp - 0x22df]
push eax
push edi
mov byte [ebp - 0x22cd], dl
call fcn.00406799
movaps xmm0, xmmword [0x401e80]
add esp, 0xc
movups xmmword [ebp - 0x2114], xmm0
mov dword [ebp - 0x2104], 0x79667958
xor ecx, ecx
mov dword [ebp - 0x2100], 0x253f787a
mov dword [ebp - 0x20fc], 0xf12782a
mov byte [ebp - 0x20f8], 0
movsx eax, byte [ebp - 0x2114]
and eax, 0x8000000f
jns 0x408ea4
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x2113], al
inc ecx
cmp ecx, 0x1b
jb 0x408e91
push esi
lea eax, [ebp - 0x2113]
mov byte [ebp - 0x20f8], 0
push eax
push edi
call fcn.00406799
add esp, 0xc
lea eax, [ebp - 0x25c8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x25b8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x2508]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2510]
test ecx, ecx
jne 0x408c05
mov eax, dword [ebp - 0x2500]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x2504]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2510]
test ecx, ecx
je 0x408f25
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
movaps xmm0, xmmword [0x4021b0]
xor ecx, ecx
movups xmmword [ebp - 0x20dc], xmm0
mov dword [ebp - 0x20cc], 0x8b2f5461
mov dword [ebp - 0x20c8], 0x4c4c4c2f
mov dword [ebp - 0x20c4], 0x1c4c4c4c
mov word [ebp - 0x20c0], 0x19
movsx eax, byte [ebp - 0x20dc]
and eax, 0x8000000f
jns 0x408f75
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x20db], al
inc ecx
cmp ecx, 0x1c
jb 0x408f62
mov edi, dword [ebp - 0x24f4]
lea eax, [ebp - 0x20db]
push eax
push edi
mov byte [ebp - 0x20bf], 0
call fcn.00406799
movaps xmm0, xmmword [0x401de0]
pop ecx
movups xmmword [ebp - 0x2404], xmm0
pop ecx
movaps xmm0, xmmword [0x401df0]
xor ecx, ecx
movups xmmword [ebp - 0x23f4], xmm0
mov word [ebp - 0x23e4], 1
mov al, byte [ebp - 0x2404]
xor byte [ebp + ecx - 0x2403], al
inc ecx
cmp ecx, 0x20
jb 0x408fc5
mov edx, dword [ebp - 0x2558]
lea eax, [ebp - 0x24f0]
mov ecx, dword [ebp - 0x2564]
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push eax
lea eax, [ebp - 0x2403]
mov byte [ebp - 0x23e3], 0
push eax
push esi
call fcn.004064a5
call eax
test eax, eax
jne 0x4091f3
movaps xmm0, xmmword [0x4023f0]
mov eax, 0x104
xor edx, edx
mov dword [ebp - 0x2578], eax
mov dword [ebp - 0x256c], eax
mov ecx, edx
movups xmmword [ebp - 0x2394], xmm0
mov word [ebp - 0x2384], 0x80
movsx eax, byte [ebp - 0x2394]
and eax, 0x8000000f
jns 0x40904d
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x2393], al
inc ecx
cmp ecx, 0x10
jb 0x40903a
mov ecx, dword [ebp - 0x2564]
lea eax, [ebp - 0x2578]
push eax
lea eax, [ebp - 0x31c]
mov byte [ebp - 0x2383], dl
push eax
push edx
push edx
mov edx, dword [ebp - 0x2560]
lea eax, [ebp - 0x2393]
push eax
push dword [ebp - 0x24f0]
call fcn.004064a5
call eax
test eax, eax
jne 0x409100
movaps xmm0, xmmword [0x4025f0]
xor ecx, ecx
movups xmmword [ebp - 0x214c], xmm0
mov dword [ebp - 0x213c], 0x84737e81
mov dword [ebp - 0x2138], 0x2f498372
mov dword [ebp - 0x2134], 0x198234
movsx eax, byte [ebp - 0x214c]
and eax, 0x8000000f
jns 0x4090d5
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x214b], al
inc ecx
cmp ecx, 0x1a
jb 0x4090c2
lea eax, [ebp - 0x31c]
mov byte [ebp - 0x2131], 0
push eax
lea eax, [ebp - 0x214b]
push eax
push edi
call fcn.004067bd
add esp, 0xc
movaps xmm0, xmmword [0x402350]
xor edx, edx
movups xmmword [ebp - 0x231c], xmm0
mov word [ebp - 0x230c], 0x6f77
mov ecx, edx
mov byte [ebp - 0x230a], dl
movsx eax, byte [ebp - 0x231c]
and eax, 0x8000000f
jns 0x409134
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x231b], al
inc ecx
cmp ecx, 0x11
jb 0x409121
mov ecx, dword [ebp - 0x2564]
lea eax, [ebp - 0x256c]
push eax
lea eax, [ebp - 0x218]
mov byte [ebp - 0x230a], dl
push eax
push edx
push edx
mov edx, dword [ebp - 0x2560]
lea eax, [ebp - 0x231b]
push eax
push dword [ebp - 0x24f0]
call fcn.004064a5
call eax
test eax, eax
jne 0x4091da
movaps xmm0, xmmword [0x402130]
xor ecx, ecx
movups xmmword [ebp - 0x2168], xmm0
mov dword [ebp - 0x2158], 0x5c73495e
mov dword [ebp - 0x2154], 0x1d075850
mov dword [ebp - 0x2150], 0x374e18
mov al, byte [ebp - 0x2168]
xor byte [ebp + ecx - 0x2167], al
inc ecx
cmp ecx, 0x1a
jb 0x4091a9
lea eax, [ebp - 0x218]
mov byte [ebp - 0x214d], 0
push eax
lea eax, [ebp - 0x2167]
push eax
push edi
call fcn.004067bd
add esp, 0xc
push dword [ebp - 0x24f0]
mov edx, dword [ebp - 0x2554]
mov ecx, dword [ebp - 0x2564]
call fcn.004064a5
call eax
movaps xmm0, xmmword [0x402510]
xor edx, edx
movups xmmword [ebp - 0x24e8], xmm0
mov ecx, edx
mov dword [ebp - 0x252c], edx
movaps xmm0, xmmword [0x402220]
movups xmmword [ebp - 0x24d8], xmm0
mov dword [ebp - 0x2498], 0x47525041
movaps xmm0, xmmword [0x402200]
movups xmmword [ebp - 0x24c8], xmm0
mov dword [ebp - 0x2494], 0x4c415c
movaps xmm0, xmmword [0x402100]
movups xmmword [ebp - 0x24b8], xmm0
movaps xmm0, xmmword [0x402230]
movups xmmword [ebp - 0x24a8], xmm0
mov al, byte [ebp - 0x24e8]
xor byte [ebp + ecx - 0x24e7], al
inc ecx
cmp ecx, 0x56
jb 0x409257
mov ecx, dword [ebp - 0x2564]
lea eax, [ebp - 0x24f0]
push eax
lea eax, [ebp - 0x24e7]
mov byte [ebp - 0x2491], dl
mov edx, dword [ebp - 0x2558]
push eax
push esi
call fcn.004064a5
call eax
test eax, eax
jne 0x4093ec
push 4
pop eax
xor edx, edx
mov dword [ebp - 0x2598], eax
mov dword [ebp - 0x2568], eax
mov ecx, edx
mov al, 0x5c
mov dword [ebp - 0x205c], 0x6d7a515c
mov dword [ebp - 0x2058], 0x7071786e
mov byte [ebp - 0x2054], dl
movsx eax, al
and eax, 0x8000000f
jns 0x4092d8
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x205b], al
inc ecx
cmp ecx, 7
jae 0x4092ed
mov al, byte [ebp - 0x205c]
jmp 0x4092c9
mov ecx, dword [ebp - 0x2564]
lea eax, [ebp - 0x2568]
push eax
lea eax, [ebp - 0x252c]
mov byte [ebp - 0x2054], dl
push eax
lea eax, [ebp - 0x2598]
push eax
push edx
mov edx, dword [ebp - 0x2560]
lea eax, [ebp - 0x205b]
push eax
push dword [ebp - 0x24f0]
call fcn.004064a5
call eax
test eax, eax
jne 0x4093d3
xor ecx, ecx
cmp dword [ebp - 0x252c], 1
jne 0x40937c
movaps xmm0, xmmword [0x401fc0]
movups xmmword [ebp - 0x22cc], xmm0
mov dword [ebp - 0x22bc], 0x5c5b3233
mov byte [ebp - 0x22b8], cl
mov al, byte [ebp - 0x22cc]
xor byte [ebp + ecx - 0x22cb], al
inc ecx
cmp ecx, 0x13
jb 0x40935a
mov byte [ebp - 0x22b8], 0
lea eax, [ebp - 0x22cb]
jmp 0x4093ca
movaps xmm0, xmmword [0x402420]
movups xmmword [ebp - 0x2258], xmm0
mov dword [ebp - 0x2248], 0x1b72737a
mov word [ebp - 0x2244], 0x18
movsx eax, byte [ebp - 0x2258]
and eax, 0x8000000f
jns 0x4093b0
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x2257], al
inc ecx
cmp ecx, 0x14
jb 0x40939d
mov byte [ebp - 0x2243], 0
lea eax, [ebp - 0x2257]
push eax
push edi
call fcn.00406799
pop ecx
pop ecx
push dword [ebp - 0x24f0]
mov edx, dword [ebp - 0x2554]
mov ecx, dword [ebp - 0x2564]
call fcn.004064a5
call eax
movaps xmm0, xmmword [0x402090]
xor edx, edx
movups xmmword [ebp - 0x2490], xmm0
mov ecx, edx
mov dword [ebp - 0x2528], edx
movaps xmm0, xmmword [0x402390]
movups xmmword [ebp - 0x2480], xmm0
mov word [ebp - 0x2460], 0x6776
movaps xmm0, xmmword [0x4022c0]
movups xmmword [ebp - 0x2470], xmm0
mov byte [ebp - 0x245e], dl
mov al, byte [ebp - 0x2490]
xor byte [ebp + ecx - 0x248f], al
inc ecx
cmp ecx, 0x31
jb 0x40942f
mov ecx, dword [ebp - 0x2564]
lea eax, [ebp - 0x24f0]
push eax
lea eax, [ebp - 0x248f]
mov byte [ebp - 0x245e], dl
mov edx, dword [ebp - 0x2558]
push eax
push esi
call fcn.004064a5
call eax
test eax, eax
jne 0x4095dc
movaps xmm0, xmmword [0x401d30]
xor edx, edx
push 4
pop eax
mov dword [ebp - 0x2590], eax
mov ecx, edx
mov dword [ebp - 0x2594], eax
movups xmmword [ebp - 0x21f4], xmm0
mov dword [ebp - 0x21e4], 0x252b2827
mov word [ebp - 0x21e0], 0x2d2c
mov byte [ebp - 0x21de], dl
mov al, byte [ebp - 0x21f4]
xor byte [ebp + ecx - 0x21f3], al
inc ecx
cmp ecx, 0x15
jb 0x4094ac
mov ecx, dword [ebp - 0x2564]
lea eax, [ebp - 0x2594]
push eax
lea eax, [ebp - 0x2528]
mov byte [ebp - 0x21de], dl
push eax
lea eax, [ebp - 0x2590]
push eax
push edx
mov edx, dword [ebp - 0x2560]
lea eax, [ebp - 0x21f3]
push eax
push dword [ebp - 0x24f0]
call fcn.004064a5
call eax
test eax, eax
jne 0x4095c3
xor ecx, ecx
cmp dword [ebp - 0x2528], 1
jne 0x40956e
movaps xmm0, xmmword [0x4025e0]
movups xmmword [ebp - 0x2184], xmm0
mov dword [ebp - 0x2174], 0x784f2a44
mov dword [ebp - 0x2170], 0x6f766c6b
mov word [ebp - 0x216c], 0x146e
mov byte [ebp - 0x216a], cl
movsx eax, byte [ebp - 0x2184]
and eax, 0x8000000f
jns 0x409552
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x2183], al
inc ecx
cmp ecx, 0x19
jb 0x40953f
mov byte [ebp - 0x216a], 0
lea eax, [ebp - 0x2183]
jmp 0x4095ba
movaps xmm0, xmmword [0x402370]
movups xmmword [ebp - 0x2130], xmm0
mov dword [ebp - 0x2120], 0x765b3f25
mov dword [ebp - 0x211c], 0x737d7e6c
mov dword [ebp - 0x2118], 0x157b7a
mov al, byte [ebp - 0x2130]
xor byte [ebp + ecx - 0x212f], al
inc ecx
cmp ecx, 0x1a
jb 0x40959a
mov byte [ebp - 0x2115], 0
lea eax, [ebp - 0x212f]
push eax
push edi
call fcn.00406799
pop ecx
pop ecx
push dword [ebp - 0x24f0]
mov edx, dword [ebp - 0x2554]
mov ecx, dword [ebp - 0x2564]
call fcn.004064a5
call eax
xor eax, eax
push eax
push eax
push eax
push 0x41435049
call dword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
movaps xmm0, xmmword [0x401dd0]
mov esi, eax
movups xmmword [ebp - 0x2358], xmm0
mov word [ebp - 0x2348], 0x17
xor ecx, ecx
movsx eax, byte [ebp - 0x2358]
and eax, 0x8000000f
jns 0x40961a
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x2357], al
inc ecx
cmp ecx, 0x10
jb 0x409607
lea eax, [ebp - 0x2357]
mov byte [ebp - 0x2347], 0
push eax
push edi
call fcn.00406799
pop ecx
pop ecx
test esi, esi
je 0x4096cb
push esi
call fcn.00418ad6
pop ecx
push esi
mov edi, eax
push edi
push 0
push 0x41435049
call dword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
test eax, eax
je 0x4096be
xor esi, esi
movaps xmm0, xmmword [0x401e40]
xor ecx, ecx
movups xmmword [ebp - 0x2330], xmm0
mov word [ebp - 0x2320], 0x194b
mov byte [ebp - 0x231e], 0
mov al, byte [ebp - 0x2330]
xor byte [ebp + ecx - 0x232f], al
inc ecx
cmp ecx, 0x11
jb 0x409683
mov byte [ebp - 0x231e], 0
movzx eax, byte [esi + edi]
push eax
push esi
lea eax, [ebp - 0x232f]
push eax
push dword [ebp - 0x24f4]
call fcn.00406799
add esp, 0x10
inc esi
cmp esi, 0x10
jl 0x409663
push edi
call fcn.00418adf
mov edi, dword [ebp - 0x24f4]
pop ecx
movaps xmm0, xmmword [0x4022f0]
xor ecx, ecx
movups xmmword [ebp - 0x245c], xmm0
movaps xmm0, xmmword [0x401c50]
movups xmmword [ebp - 0x244c], xmm0
movsx eax, byte [ebp - 0x245c]
and eax, 0x8000000f
jns 0x4096fc
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x245b], al
inc ecx
cmp ecx, 0x1e
jb 0x4096e9
lea eax, [ebp - 0x245b]
mov byte [ebp - 0x243d], 0
push eax
push edi
call fcn.00406799
movaps xmm0, xmmword [0x401ec0]
pop ecx
pop ecx
movups xmmword [ebp - 0x236c], xmm0
mov word [ebp - 0x235c], 0x2f
xor ecx, ecx
mov al, byte [ebp - 0x236c]
xor byte [ebp + ecx - 0x236b], al
inc ecx
cmp ecx, 0x10
jb 0x409738
lea eax, [ebp - 0x236b]
mov byte [ebp - 0x235b], 0
push eax
push edi
call fcn.00406799
pop ecx
pop ecx
lea eax, [ebp - 0x258c]
push eax
push 0x1000
lea eax, [ebp - 0x2020]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x409842
mov esi, dword [ebp - 0x258c]
xor edi, edi
shr esi, 2
mov dword [ebp - 0x2588], esi
test esi, esi
je 0x40983c
push dword [ebp + edi*4 - 0x2020]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x2580], eax
test eax, eax
je 0x409833
push 0x104
lea ecx, [ebp - 0x114]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
test eax, eax
je 0x409827
push 3
mov cl, 0x12
mov dword [ebp - 0x2030], 0x18613712
mov byte [ebp - 0x202c], 0
xor eax, eax
pop esi
xor byte [ebp + eax - 0x202f], cl
inc eax
cmp eax, esi
jae 0x4097fe
mov cl, byte [ebp - 0x2030]
jmp 0x4097ea
lea eax, [ebp - 0x114]
mov byte [ebp - 0x202c], 0
push eax
lea eax, [ebp - 0x202f]
push eax
push dword [ebp - 0x24f4]
call fcn.00406799
mov esi, dword [ebp - 0x2588]
add esp, 0xc
push dword [ebp - 0x2580]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, esi
jb 0x40979b
mov edi, dword [ebp - 0x24f4]
movaps xmm0, xmmword [0x401e30]
xor ecx, ecx
movups xmmword [ebp - 0x2380], xmm0
mov word [ebp - 0x2370], 0x27
mov al, byte [ebp - 0x2380]
xor byte [ebp + ecx - 0x237f], al
inc ecx
cmp ecx, 0x10
jb 0x40985b
lea eax, [ebp - 0x237f]
mov byte [ebp - 0x236f], 0
push eax
push edi
call fcn.00406799
movaps xmm0, xmmword [0x402490]
xor edx, edx
movups xmmword [ebp - 0x243c], xmm0
pop ecx
movaps xmm0, xmmword [0x402470]
movups xmmword [ebp - 0x242c], xmm0
pop ecx
movaps xmm0, xmmword [0x402480]
mov ecx, edx
movups xmmword [ebp - 0x241c], xmm0
mov dword [ebp - 0x240c], 0x6c6c6174
mov byte [ebp - 0x2408], dl
movsx eax, byte [ebp - 0x243c]
and eax, 0x8000000f
jns 0x4098d5
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x243b], al
inc ecx
cmp ecx, 0x33
jb 0x4098c2
lea eax, [ebp - 0x250c]
mov byte [ebp - 0x2408], dl
push eax
push 0x20019
push edx
lea eax, [ebp - 0x243b]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408a1e
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [ebp - 0x2518]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push eax
lea eax, [ebp - 0x820]
mov esi, ecx
push eax
push ecx
jmp 0x409b35
lea eax, [ebp - 0x2514]
inc esi
push eax
push 0x20019
push 0
lea eax, [ebp - 0x820]
push eax
push dword [ebp - 0x250c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409b20
mov eax, 0x400
mov dword [ebp - 0x2094], 0x7f65480c
xor edx, edx
mov dword [ebp - 0x257c], eax
mov dword [ebp - 0x2570], eax
mov cl, 0xc
mov dword [ebp - 0x2090], 0x756d607c
mov eax, edx
mov dword [ebp - 0x208c], 0x69616d42
mov byte [ebp - 0x2088], dl
xor byte [ebp + eax - 0x2093], cl
inc eax
cmp eax, 0xb
jae 0x4099ab
mov cl, byte [ebp - 0x2094]
jmp 0x409996
mov ecx, dword [ebp - 0x2564]
lea eax, [ebp - 0x257c]
push eax
lea eax, [ebp - 0x1020]
mov byte [ebp - 0x2088], dl
push eax
push edx
push edx
mov edx, dword [ebp - 0x2560]
lea eax, [ebp - 0x2093]
push eax
push dword [ebp - 0x2514]
call fcn.004064a5
call eax
test eax, eax
jne 0x409a43
mov al, 0x5f
mov dword [ebp - 0x2040], 0x82343c5f
mov word [ebp - 0x203c], 0x2f
xor ecx, ecx
movsx eax, al
and eax, 0x8000000f
jns 0x409a0b
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x203f], al
inc ecx
cmp ecx, 4
jae 0x409a20
mov al, byte [ebp - 0x2040]
jmp 0x4099fc
lea eax, [ebp - 0x1020]
mov byte [ebp - 0x203b], 0
push eax
lea eax, [ebp - 0x203f]
push eax
push dword [ebp - 0x24f4]
call fcn.00406799
add esp, 0xc
movaps xmm0, xmmword [0x401c60]
xor edx, edx
movups xmmword [ebp - 0x23e0], xmm0
mov ecx, edx
mov al, byte [ebp - 0x23e0]
xor byte [ebp + ecx - 0x23df], al
inc ecx
cmp ecx, 0xe
jb 0x409a55
mov ecx, dword [ebp - 0x2564]
lea eax, [ebp - 0x2570]
push eax
lea eax, [ebp - 0xc20]
mov byte [ebp - 0x23d1], dl
push eax
push edx
push edx
mov edx, dword [ebp - 0x2560]
lea eax, [ebp - 0x23df]
push eax
push dword [ebp - 0x2514]
call fcn.004064a5
call eax
test eax, eax
jne 0x409b07
mov al, 0x34
mov dword [ebp - 0x2050], 0x77295f34
mov word [ebp - 0x204c], 0xe61
xor ecx, ecx
mov byte [ebp - 0x204a], 0
movsx eax, al
and eax, 0x8000000f
jns 0x409acf
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x204f], al
inc ecx
cmp ecx, 5
jae 0x409ae4
mov al, byte [ebp - 0x2050]
jmp 0x409ac0
lea eax, [ebp - 0xc20]
mov byte [ebp - 0x204a], 0
push eax
lea eax, [ebp - 0x204f]
push eax
push dword [ebp - 0x24f4]
call fcn.00406799
add esp, 0xc
push dword [ebp - 0x2514]
mov edx, dword [ebp - 0x2554]
mov ecx, dword [ebp - 0x2564]
call fcn.004064a5
call eax
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x2518]
push eax
lea eax, [ebp - 0x820]
push eax
push esi
push dword [ebp - 0x250c]
mov dword [ebp - 0x2518], 0x400
call edi
test eax, eax
je 0x409931
push dword [ebp - 0x250c]
mov edx, dword [ebp - 0x2554]
mov ecx, dword [ebp - 0x2564]
call fcn.004064a5
call eax
jmp 0x408a1e