Function at 0x4094d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov esi, esp
call fcn.00409740
push eax
mov dword [esi + 0x20], esp
sub esp, 0x18
mov ebx, esp
and ebx, 0xfffffff8
mov esp, ebx
push eax
mov edi, esp
sub esp, 0x100
mov dword [esi + 0x1c], esp
call fcn.0043d3f0
test al, 1
jne 0x40950b
jmp 0x409704
mov al, byte [edi]
mov byte [esi + 4], al
mov byte [ebx], 0x86
mov byte [ebx + 1], 0x61
mov byte [ebx + 2], 0xf7
mov byte [ebx + 3], 0x63
mov byte [ebx + 4], 0x87
mov byte [ebx + 5], 0x65
mov byte [ebx + 6], 0x8d
mov byte [ebx + 7], 0x67
mov byte [ebx + 8], 0x87
mov byte [ebx + 9], 0x69
mov byte [ebx + 0xa], 0x8c
mov byte [ebx + 0xb], 0x6b
mov byte [ebx + 0xc], 0x8a
mov byte [ebx + 0xd], 0x6d
mov byte [ebx + 0xe], 0x6e
mov byte [ebx + 0xf], 0x6f
mov eax, 0x10
mov byte [ebx + eax], 0
add eax, 1
cmp eax, 0x15
jne 0x409554
jmp 0x409562
mov dword [esi + 0xc], ebx
xor eax, eax
mov dword [esi + 8], eax
cmp eax, 0x15
jae 0x4095e0
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x18], ecx
movzx edx, byte [ecx + eax]
mov dword [esi + 0x10], edx
mov ecx, eax
and ecx, 0x280aeb0
xor eax, 0x280aeb0
lea ebx, [eax + ecx*2]
mov dword [esi + 0x14], ebx
and ebx, edx
mov edx, ebx
not edx
mov eax, ebx
add eax, eax
lea ecx, [edx + ebx*2]
mov edi, 0xfffffffe
sub edi, ecx
mov ecx, edi
and ecx, 0xfffffffd
sub eax, ebx
and eax, 2
imul eax, ecx
mov ecx, edi
and ecx, 2
or edi, 2
imul edi, ecx
add edi, eax
mov eax, dword [esi + 0x14]
or eax, dword [esi + 0x10]
sub edi, edx
and edi, eax
mov dword [esi + 0x24], edi
mov eax, dword [esi + 0x24]
add al, 0x30
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0x18]
mov byte [edx + ecx], al
mov eax, dword [esi + 8]
add eax, 1
jmp 0x409567
mov eax, dword [esi + 0xc]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], 0
mov dword [esp + 4], 1
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, dword [esi + 0x20]
jmp 0x409606
mov dword [edi], eax
jmp 0x40960a
call fcn.00433fa0
test al, 1
jne 0x409618
jmp 0x4096dd
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, 0
setge al
test al, 1
jne 0x409641
jmp 0x4096db
xor eax, eax
sub esp, 0x24
mov dword [esp], 0
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
cmp eax, 0
setge al
jmp 0x40969b
test al, 1
jne 0x4096a1
jmp 0x4096d5
call fcn.0040ab20
test al, 1
jne 0x4096ac
jmp 0x4096d3
lea eax, str.system_or_character_via_spellings_glyphs_a_is_uses_that_in_their_modified_other_on_often_reflection_or_resemblance_on_it_leetspeak__used_similarity_internet._play_eleet_the_of_the_replacements_of_primarily_ways
sub esp, 8
mov ecx, dword [esi + 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00409720
add esp, 8
call fcn.0040d860
call fcn.0040c4c0
jmp 0x4096d3
jmp 0x4096d5
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4096dd
mov eax, dword [edi]
jmp 0x4096e1
cmp eax, 0
setne al
test al, 1
jne 0x4096ed
jmp 0x4096fd
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4096fd
call fcn.0043d7f0
jmp 0x409704
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]