Function at 0x409970
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov esi, esp
call fcn.00409bc0
push eax
mov dword [esi + 0x1c], esp
sub esp, 0x18
mov ebx, esp
and ebx, 0xfffffff8
mov esp, ebx
push eax
mov edi, esp
sub esp, 0x100
mov dword [esi + 0x18], esp
call fcn.0043fc00
test al, 1
jne 0x4099ab
jmp 0x409b83
mov al, byte [edi]
mov byte [esi + 4], al
mov byte [ebx], 0xec
mov byte [ebx + 1], 0x85
mov byte [ebx + 2], 0x1f
mov byte [ebx + 3], 0x8b
mov byte [ebx + 4], 0xef
mov byte [ebx + 5], 0x89
mov byte [ebx + 6], 0xe5
mov byte [ebx + 7], 0x8f
mov byte [ebx + 8], 0x1f
mov byte [ebx + 9], 0x8d
mov byte [ebx + 0xa], 0xe6
mov byte [ebx + 0xb], 0xb3
mov byte [ebx + 0xc], 0xd8
mov byte [ebx + 0xd], 0xb1
mov byte [ebx + 0xe], 0xb0
mov byte [ebx + 0xf], 0xb7
mov eax, 0x10
mov byte [ebx + eax], 0
add eax, 1
cmp eax, 0x17
jne 0x4099f4
mov dword [esi + 0xc], ebx
xor eax, eax
mov dword [esi + 8], eax
mov edi, dword [esi + 8]
cmp edi, 0x17
jae 0x409a6b
mov eax, dword [esi + 0xc]
mov dword [esi + 0x14], eax
mov ebx, edi
not ebx
movzx eax, byte [eax + edi]
mov dword [esi + 0x10], eax
call fcn.00409bc0
call fcn.00409bc0
mov eax, dword [esi + 0x10]
mov dword [esi + 0x24], eax
and ebx, 0x654e2d7e
and edi, 0x9ab1d281
mov eax, dword [esi + 0x24]
sub ebx, edi
add ebx, 0xe61722ec
mov ecx, eax
or ecx, ebx
and eax, ebx
not ecx
or eax, ecx
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x20]
add al, 0xed
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0x14]
mov byte [edx + ecx], al
mov eax, dword [esi + 8]
add eax, 1
jmp 0x409a05
mov eax, dword [esi + 0xc]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], 0
mov dword [esp + 4], 1
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, dword [esi + 0x1c]
mov dword [edi], eax
call fcn.00436900
test al, 1
jne 0x409a9f
jmp 0x409b64
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, 0
jl 0x409b62
xor eax, eax
sub esp, 0x24
mov dword [esp], 0
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
cmp eax, 0
setge al
test al, 1
jne 0x409b20
jmp 0x409b5a
call fcn.0040b110
jmp 0x409b27
test al, 1
jne 0x409b2d
jmp 0x409b58
lea eax, str.system_or_character_via_spellings_glyphs_a_is_uses_that_in_their_modified_other_on_often_reflection_or_resemblance_on_it_leetspeak__used_similarity_internet._play_eleet_the_of_the_replacements_of_primarily_ways
sub esp, 8
mov ecx, dword [esi + 0x18]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00409ba0
add esp, 8
call fcn.0040df40
call fcn.0040c970
jmp 0x409b54
jmp 0x409b56
jmp 0x409b58
jmp 0x409b5a
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x409b62
jmp 0x409b64
cmp dword [edi], 0
setne al
test al, 1
jne 0x409b70
jmp 0x409b7e
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004400f0
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]