Function at 0x402110
Capabilities:
Check mutex on windows
Hide graphical window
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x27c
mov eax, dword [0x41a00c]
xor eax, esp
mov dword [esp + 0x278], eax
mov eax, dword [ebp + 8]
movaps xmm0, xmmword [0x417ea0]
mov dword [esp + 0x10], eax
mov eax, dword fs:[0x2c]
push ebx
push esi
push edi
mov edi, dword [eax]
movups xmmword [esp + 0x24], xmm0
mov byte [esp + 0x34], 0xfb
mov dword [esp + 0x20], edi
mov eax, dword [edi + 0xd0]
test al, 1
jne 0x4021a5
xorps xmm0, xmm0
mov byte [edi + 0x121], 1
movlpd qword [esp + 0x10], xmm0
or eax, 1
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [edi + 0xd0], eax
nop dword [eax]
mov al, byte [esp + ecx + 0x24]
mov byte [ecx + edi + 0x110], al
add ecx, 1
adc edx, 0
jne 0x402198
cmp ecx, 0x11
jb 0x402180
push 0x412e50
call fcn.004064fb
add esp, 4
cmp byte [edi + 0x121], 0
lea ebx, [edi + 0x110]
je 0x4021f4
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov ecx, esi
mov eax, 0x9b1301fb
and ecx, 7
mov edx, 0x4fc10367
shl ecx, 3
call fcn.00412640
xor byte [esi + ebx], al
add esi, 1
adc edi, 0
jne 0x4021ec
cmp esi, 0x11
jb 0x4021c5
mov edi, dword [esp + 0x20]
mov byte [ebx + 0x11], 0
push ebx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x4026ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4026ed
call fcn.00405310
call fcn.00404510
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.004049e0
push sym.NeverSleep.exe_long_int___cdecl__AmsiScanBuffer__struct_HAMSICONTEXT_____void___unsigned_long_int__wchar_t_const___struct_HAMSISESSION_____enum_AMSI_RESULT__
push 0x41a894
call fcn.00403f70
call fcn.00404570
movaps xmm0, xmmword [0x417ec0]
mov eax, dword [edi + 0x150]
mov dword [esp + 0x274], 0x4064995e
mov dword [esp + 0x278], 0x3144667d
movups xmmword [esp + 0x244], xmm0
movaps xmm0, xmmword [0x417e50]
movups xmmword [esp + 0x254], xmm0
movaps xmm0, xmmword [0x417eb0]
movups xmmword [esp + 0x264], xmm0
test al, 1
jne 0x4022d8
xorps xmm0, xmm0
mov byte [edi + 0x10c], 1
movlpd qword [esp + 0x10], xmm0
or eax, 1
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [edi + 0x150], eax
mov al, byte [esp + ecx + 0x244]
mov byte [ecx + edi + 0xd4], al
add ecx, 1
adc edx, 0
jne 0x4022cb
cmp ecx, 0x38
jb 0x4022b0
push 0x412e10
call fcn.004064fb
add esp, 4
cmp byte [edi + 0x10c], 0
lea ebx, [edi + 0xd4]
je 0x40232f
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
nop dword [eax + eax]
mov ecx, esi
mov eax, 0x2137eb3b
and ecx, 7
mov edx, 0x3137030b
shl ecx, 3
call fcn.00412640
xor byte [esi + ebx], al
add esi, 1
adc edi, 0
jne 0x402327
cmp esi, 0x38
jb 0x402300
mov edi, dword [esp + 0x20]
mov byte [ebx + 0x38], 0
mov ecx, ebx
call fcn.00401e80
movaps xmm0, xmmword [0x417ed0]
mov eax, dword [edi + 0x220]
mov dword [esp + 0x274], 0x1b66fa56
mov dword [esp + 0x278], 0x548db5cc
mov dword [esp + 0x27c], 0x66afa4f
mov word [esp + 0x280], 0xbee7
mov byte [esp + 0x282], 0xf9
movups xmmword [esp + 0x244], xmm0
movaps xmm0, xmmword [0x417e60]
movups xmmword [esp + 0x254], xmm0
movaps xmm0, xmmword [0x417ef0]
movups xmmword [esp + 0x264], xmm0
test al, 1
jne 0x4023e9
xorps xmm0, xmm0
mov byte [edi + 0x217], 1
movlpd qword [esp + 0x10], xmm0
or eax, 1
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [edi + 0x220], eax
mov al, byte [esp + ecx + 0x244]
mov byte [ecx + edi + 0x1d8], al
add ecx, 1
adc edx, 0
jne 0x4023dc
cmp ecx, 0x3f
jb 0x4023c1
push 0x412dd0
call fcn.004064fb
add esp, 4
cmp byte [edi + 0x217], 0
lea edi, [edi + 0x1d8]
je 0x40243b
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
nop dword [eax]
mov ecx, esi
mov eax, 0x69038921
and ecx, 7
mov edx, 0x31f9cd89
shl ecx, 3
call fcn.00412640
xor byte [esi + edi], al
add esi, 1
adc ebx, 0
jne 0x402437
cmp esi, 0x3f
jb 0x402410
mov byte [edi + 0x3f], 0
mov ecx, edi
call fcn.00401e80
call fcn.00402710
mov edi, eax
cmp byte [edi + 0x51], 0
je 0x40248b
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov ecx, esi
mov eax, 0x4fa9f3ff
and ecx, 7
mov edx, 0x792b379f
shl ecx, 3
call fcn.00412640
xor byte [esi + edi], al
add esi, 1
adc ebx, 0
jne 0x402487
cmp esi, 0x51
jb 0x402460
mov byte [edi + 0x51], 0
mov ecx, edi
call fcn.00401e80
call fcn.00401c00
push SysStringLen
call dword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
mov ecx, dword [0x41a890]
xor edx, edx
mov ebx, dword [esp + 0x1c]
test eax, eax
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x41b5b0
push 0x67
cmovne ecx, edx
push ebx
mov dword [0x41a890], ecx
call esi
push 0x64
push 0x41b4e8
push 0x6d
push ebx
call esi
mov edi, dword [sym.imp.USER32.dll_LoadIconW]
push 0x6b
push ebx
mov dword [esp + 0x24c], 0x30
mov dword [esp + 0x250], 3
mov dword [esp + 0x254], 0x402800
mov dword [esp + 0x258], 0
mov dword [esp + 0x25c], 0
mov dword [esp + 0x260], ebx
call edi
push 0x7f00
push 0
mov dword [esp + 0x264], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x6c
push dword [esp + 0x25c]
mov dword [esp + 0x268], eax
mov dword [esp + 0x26c], 6
mov dword [esp + 0x270], 0x6d
mov dword [esp + 0x274], 0x41b4e8
call edi
mov dword [esp + 0x270], eax
lea eax, [esp + 0x244]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push ebx
push 0
push 0
push 0
push SysReAllocString
push 0
push SysReAllocString
push 0xcf0000
push 0x41b5b0
push 0x41b4e8
push 0
mov dword [0x41b4e0], ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
je 0x4026d4
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x1e4
lea eax, [esp + 0x5c]
push 0
push eax
call fcn.00407fd0
mov eax, dword [0x41a890]
add esp, 0xc
neg eax
mov dword [esp + 0x40], 0x3bc
mov dword [esp + 0x44], esi
sbb eax, eax
mov dword [esp + 0x48], 0x3e9
add eax, 0x82
mov dword [esp + 0x4c], 7
push eax
push dword [0x41b4e0]
mov dword [esp + 0x58], 0x401
call edi
cmp dword [0x41a890], 0
mov ecx, str.Sleep_Disabled
mov dword [esp + 0x54], eax
mov eax, str.Sleep_Enabled
cmove eax, ecx
push eax
lea eax, [esp + 0x5c]
push 0x80
push eax
call fcn.00409e1e
add esp, 0xc
lea eax, [esp + 0x40]
push eax
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
push 0x6d
push ebx
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
push 0
push 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x2c]
push 0
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x4026b9
mov ebx, dword [sym.imp.USER32.dll_TranslateAcceleratorW]
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x20]
push dword [esp + 0x2c]
call ebx
test eax, eax
jne 0x4026a4
lea eax, [esp + 0x24]
push eax
call esi
lea eax, [esp + 0x24]
push eax
call edi
push 0
push 0
push 0
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x402683
mov eax, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x278]
xor ecx, esp
call fcn.004063ac
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x278]
xor ecx, esp
call fcn.004063ac
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0x284]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004063ac
mov esp, ebp
pop ebp
ret 0x10