Function at 0x401000
Capabilities:
Decode data using base64 via winapi
Encode data using xor
Get system information on windows
Persist via application shimming
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x944
mov eax, dword [0x452004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x7cc], ecx
push 0x40
push eax
mov dword [ebp - 0x7f8], eax
mov dword [ebp - 0x7fc], eax
lea eax, [ebp - 0x300]
push eax
mov dword [ebp - 0x7e8], 0
mov dword [ebp - 0x7ec], 0
call fcn.00415060
add esp, 0xc
mov dword [ebp - 0x7e0], 0
lea eax, [ebp - 0x32c]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea eax, [ebp - 0x7f4]
mov dword [ebp - 0x7f4], 0
push eax
lea eax, [ebp - 0x80c]
push eax
push ecx
call fcn.0040c7c0
test al, al
je 0x4011d8
mov edi, dword ds:[ebp - 0x80c]
mov edx, dword [0x453ac4]
lea esi, [edi + edi]
lea ecx, [esi + 0xa]
call fcn.00409c00
mov ebx, eax
xor ecx, ecx
lea eax, [ebx + 8]
mov dword [ebp - 0x808], ebx
mov edx, edi
mov dword [ebx + 4], eax
mov dword [ebx], esi
mov word [eax + esi], cx
push dword [ebx + 4]
mov ecx, dword [ebp - 0x7f4]
call fcn.0040aa40
mov esi, dword [ebx]
lea eax, [ebp - 0x2bc]
mov edi, dword [ebx + 4]
push eax
lea eax, [ebp - 0x2c0]
shr esi, 1
push eax
lea eax, [ebp - 0x57c]
mov dword [ebp - 0x57c], 0
push eax
push 0
push 1
push esi
push edi
mov dword [ebp - 0x2c0], 0
mov dword [ebp - 0x2bc], 0
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
or ebx, 0xffffffff
test eax, eax
je 0x401171
push dword [ebp - 0x57c]
push 0
push dword [0x453afc]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x7f0], eax
test eax, eax
je 0x401171
lea ecx, [ebp - 0x2bc]
push ecx
lea ecx, [ebp - 0x2c0]
push ecx
lea ecx, [ebp - 0x57c]
push ecx
push eax
push 1
push esi
push edi
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
jne 0x4011eb
push dword [ebp - 0x7f0]
push eax
push dword [0x453afc]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp - 0x7cc]
lea ecx, [ebp - 0x300]
mov dword [eax + 0x1c], 3
call fcn.00404a00
mov eax, dword [ebp - 0x7f4]
test eax, eax
je 0x4011a6
push eax
push 0
push dword [0x453afc]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ecx, dword [ebp - 0x808]
mov eax, ebx
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4011be
call fcn.00409ce0
mov eax, dword [ebp - 0x7e0]
test eax, eax
je 0x4011d8
lea ecx, [eax - 8]
lock xadd dword [ecx + 4], ebx
dec ebx
jne 0x4011d8
call fcn.00409ce0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413aae
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x300]
call fcn.004039c0
test eax, eax
je 0x401258
mov ecx, dword [ebp - 0x57c]
lea eax, [ebp - 0x300]
mov esi, dword [ebp - 0x7f0]
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x300], ecx
mov dword [ebp - 0x2fc], 0
mov dword [ebp - 0x2d4], 0x4042e0
mov dword [eax + 0x34], esi
mov eax, dword [ebp - 0x2c8]
mov dword [eax + 0x38], ecx
lea ecx, [ebp - 0x300]
call fcn.00403ee0
test eax, eax
jne 0x40128b
lea ecx, [ebp - 0x300]
call fcn.00404a00
mov eax, dword [ebp - 0x7cc]
mov dword [eax + 0x1c], 3
lea ecx, [ebp - 0x300]
call fcn.00404a00
push dword ds:[ebp - 0x7f0]
push 0
push dword [0x453afc]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x401189
xor edi, edi
lea ecx, [ecx]
cmp edi, dword [ebp - 0x2f0]
jae 0x40148e
lea eax, [ebp - 0x578]
mov edx, edi
push eax
lea ecx, [ebp - 0x300]
call fcn.00404340
test eax, eax
je 0x401488
lea edx, [ebp - 0x534]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4012c1
sub edx, ecx
lea ecx, [ebp - 0x534]
call fcn.0040ab40
mov esi, eax
mov dword [ebp - 0x8bc], 0x3c
push ecx
lea edx, [ebp - 0x8bc]
mov dword [ebp - 0x8b8], str.ProcessHacker.exe.settings.xml
mov ecx, esi
call fcn.0040a400
lea esp, [esp]
cmp eax, 0xffffffff
jne 0x401488
push ecx
lea edx, [ebp - 0x8e8]
mov dword [ebp - 0x8e8], 0x1e
mov ecx, esi
mov dword [ebp - 0x8e4], str.usernotesdb.xml
call fcn.0040a400
cmp eax, 0xffffffff
jne 0x401488
cmp word [ebp - 0x32c], 9
mov eax, dword [esi + 4]
mov ecx, dword [esi]
jne 0x4013de
mov dword [ebp - 0x8f8], 0xc
mov dword [ebp - 0x8f4], str.32bit_
mov dword [ebp - 0x8fc], eax
mov dword [ebp - 0x900], 0xc
cmp ecx, 0xc
jb 0x40138d
push 1
lea edx, [ebp - 0x8f8]
lea ecx, [ebp - 0x900]
call fcn.0040a140
test al, al
jne 0x401488
cmp dword [esi], 8
mov eax, dword [esi + 4]
mov dword [ebp - 0x908], 8
mov dword [ebp - 0x904], str.x32_
mov dword [ebp - 0x90c], eax
mov dword [ebp - 0x910], 8
jb 0x401464
push 1
lea edx, [ebp - 0x908]
lea ecx, [ebp - 0x910]
call fcn.0040a140
test al, al
je 0x401464
inc edi
jmp 0x401290
mov dword [ebp - 0x918], 0xc
mov dword [ebp - 0x914], str.64bit_
mov dword [ebp - 0x810], eax
mov dword [ebp - 0x814], 0xc
cmp ecx, 0xc
jb 0x40141e
push 1
lea edx, [ebp - 0x918]
lea ecx, [ebp - 0x814]
call fcn.0040a140
test al, al
jne 0x401488
cmp dword [esi], 8
mov eax, dword [esi + 4]
mov dword [ebp - 0x81c], 8
mov dword [ebp - 0x818], str.x64_
mov dword [ebp - 0x820], eax
mov dword [ebp - 0x824], 8
jb 0x401464
push 1
lea edx, [ebp - 0x81c]
lea ecx, [ebp - 0x824]
call fcn.0040a140
lea ecx, [ecx]
test al, al
jne 0x401488
mov eax, dword [ebp - 0x7e8]
add eax, dword [ebp - 0x550]
mov dword [ebp - 0x7e8], eax
mov eax, dword [ebp - 0x7ec]
adc eax, dword [ebp - 0x54c]
mov dword [ebp - 0x7ec], eax
inc edi
jmp 0x401290
mov eax, dword ds:[ebp - 0x7cc]
push 0
push 0
push 0x467
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageW]
fld qword [0x4501c0]
xor eax, eax
fstp qword [ebp - 0x938]
mov dword ds:[ebp - 0x804], eax
cmp eax, dword [ebp - 0x2f0]
jae 0x401f91
lea ecx, [ebp - 0x7c8]
mov dword [ebp - 0x7dc], 0xffffffff
push ecx
mov edx, eax
lea ecx, [ebp - 0x300]
call fcn.00404340
test eax, eax
je 0x401ee8
lea edx, [ebp - 0x784]
lea ecx, [edx + 1]
jmp 0x401500
mov al, byte [edx]
inc edx
test al, al
jne 0x401500
sub edx, ecx
lea ecx, [ebp - 0x784]
call fcn.0040ab40
mov edi, eax
mov dword [ebp - 0x82c], 0x3c
push ecx
lea edx, [ebp - 0x82c]
mov dword [ebp - 0x828], str.ProcessHacker.exe.settings.xml
mov ecx, edi
call fcn.0040a400
jmp 0x401540
cmp eax, 0xffffffff
jne 0x401ee8
push ecx
lea edx, [ebp - 0x834]
mov dword [ebp - 0x834], 0x1e
mov ecx, edi
mov dword [ebp - 0x830], str.usernotesdb.xml
call fcn.0040a400
cmp eax, 0xffffffff
jne 0x401ee8
cmp word [ebp - 0x32c], 9
mov eax, dword [edi + 4]
mov ecx, dword [edi]
jne 0x401706
mov dword [ebp - 0x83c], 0xc
mov dword [ebp - 0x838], str.32bit_
mov dword [ebp - 0x840], eax
mov dword [ebp - 0x844], 0xc
cmp ecx, 0xc
jb 0x4015cd
push 1
lea edx, [ebp - 0x83c]
lea ecx, [ebp - 0x844]
call fcn.0040a140
test al, al
jne 0x401ee8
cmp dword [edi], 8
mov eax, dword [edi + 4]
mov dword [ebp - 0x84c], 8
mov dword [ebp - 0x848], str.x32_
mov dword [ebp - 0x850], eax
mov dword [ebp - 0x854], 8
jb 0x401614
push 1
lea edx, [ebp - 0x84c]
lea ecx, [ebp - 0x854]
call fcn.0040a140
test al, al
jne 0x401ee8
cmp dword ds:[edi], 0xc
mov eax, dword [edi + 4]
mov dword [ebp - 0x85c], 0xc
mov dword [ebp - 0x858], str.64bit_
mov dword [ebp - 0x860], eax
mov dword [ebp - 0x864], 0xc
jb 0x4016c5
push 1
lea edx, [ebp - 0x85c]
lea ecx, [ebp - 0x864]
call fcn.0040a140
test al, al
je 0x4016c5
mov esi, dword [edi]
mov eax, dword [edi + 4]
and esi, 0xfffffffe
mov edx, dword [0x453ac4]
sub esi, 0xc
add eax, 0xc
mov dword [ebp - 0x7d0], eax
lea ecx, [esi + 0xa]
call fcn.00409c00
mov ebx, eax
xor ecx, ecx
lea eax, [ebx + 8]
mov dword [ebx + 4], eax
mov dword [ebx], esi
mov word [eax + esi], cx
mov eax, dword [ebp - 0x7d0]
test eax, eax
je 0x4016a8
push esi
push eax
push dword [ebx + 4]
call fcn.00415e30
add esp, 0xc
mov eax, edi
mov edi, ebx
test eax, eax
je 0x4016c5
lea ecx, [eax - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4016c5
mov edi, edi
call fcn.00409ce0
cmp dword [edi], 8
mov eax, dword [edi + 4]
mov dword [ebp - 0x86c], 8
mov dword [ebp - 0x868], str.x64_
mov dword [ebp - 0x870], eax
mov dword [ebp - 0x874], 8
jb 0x4018f0
lea edx, [ebp - 0x86c]
lea ecx, [ebp - 0x874]
jmp 0x401881
mov dword [ebp - 0x87c], 0xc
mov dword [ebp - 0x878], str.64bit_
mov dword [ebp - 0x880], eax
mov dword [ebp - 0x884], 0xc
cmp ecx, 0xc
jb 0x40174d
push 1
lea edx, [ebp - 0x87c]
lea ecx, [ebp - 0x884]
call fcn.0040a140
test al, al
jne 0x401ee8
cmp dword [edi], 8
mov eax, dword [edi + 4]
mov dword [ebp - 0x88c], 8
mov dword [ebp - 0x888], str.x64_
mov dword [ebp - 0x890], eax
mov dword [ebp - 0x894], 8
jb 0x401794
push 1
lea edx, [ebp - 0x88c]
lea ecx, [ebp - 0x894]
call fcn.0040a140
test al, al
jne 0x401ee8
cmp dword ds:[edi], 0xc
mov eax, dword [edi + 4]
mov dword [ebp - 0x89c], 0xc
mov dword [ebp - 0x898], str.32bit_
mov dword [ebp - 0x8a0], eax
mov dword [ebp - 0x8a4], 0xc
jb 0x401845
push 1
lea edx, [ebp - 0x89c]
lea ecx, [ebp - 0x8a4]
call fcn.0040a140
test al, al
je 0x401845
mov esi, dword [edi]
mov eax, dword [edi + 4]
and esi, 0xfffffffe
mov edx, dword [0x453ac4]
sub esi, 0xc
add eax, 0xc
mov dword [ebp - 0x7d0], eax
lea ecx, [esi + 0xa]
call fcn.00409c00
mov ebx, eax
xor ecx, ecx
lea eax, [ebx + 8]
mov dword [ebx + 4], eax
mov dword [ebx], esi
mov word [eax + esi], cx
mov eax, dword [ebp - 0x7d0]
test eax, eax
je 0x401828
push esi
push eax
push dword [ebx + 4]
call fcn.00415e30
add esp, 0xc
mov eax, edi
mov edi, ebx
test eax, eax
je 0x401845
lea ecx, [eax - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x401845
mov edi, edi
call fcn.00409ce0
cmp dword [edi], 8
mov eax, dword [edi + 4]
mov dword [ebp - 0x8ac], 8
mov dword [ebp - 0x8a8], str.x32_
mov dword [ebp - 0x8b0], eax
mov dword [ebp - 0x8b4], 8
jb 0x4018f0
lea edx, [ebp - 0x8ac]
lea ecx, [ebp - 0x8b4]
push 1
call fcn.0040a140
test al, al
je 0x4018f0
mov esi, dword [edi]
mov eax, dword [edi + 4]
and esi, 0xfffffffe
mov edx, dword [0x453ac4]
sub esi, 8
add eax, 8
mov dword [ebp - 0x7d0], eax
lea ecx, [esi + 0xa]
call fcn.00409c00
mov ebx, eax
xor ecx, ecx
lea eax, [ebx + 8]
mov dword [ebx], esi
mov dword [ebx + 4], eax
mov word [eax + esi], cx
mov eax, dword [ebp - 0x7d0]
test eax, eax
je 0x4018d5
push esi
push eax
push dword [ebx + 4]
call fcn.00415e30
add esp, 0xc
mov eax, edi
mov edi, ebx
test eax, eax
je 0x4018f0
lea ecx, [eax - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4018f0
call fcn.00409ce0
mov ecx, dword [ebp - 0x2c8]
mov edx, dword [ebp - 0x7c8]
mov dword [ebp - 0x7d4], edx
test ecx, ecx
je 0x401f7c
cmp edx, dword [ebp - 0x2f0]
jae 0x401f7c
cmp dword ds:[ebp - 0x2ec], 1
jne 0x401f7c
lfence
mov eax, dword [ecx + 0x10]
mov ebx, dword [eax + edx*4]
add ebx, dword [ecx]
je 0x401f7c
mov ebx, dword [ebx + 0x18]
mov dword [ebp - 0x800], ebx
cmp ebx, 0x7fffffff
ja 0x401f7c
mov esi, dword ds:[ebp - 0x2e4]
mov ecx, esi
push ebx
push 1
push dword [ebp - 0x2d8]
call dword [0x42b26c]
call esi
mov esi, eax
mov dword [ebp - 0x7d0], esi
test esi, esi
je 0x401f7c
mov edx, dword [ebp - 0x7d4]
lea ecx, [ebp - 0x300]
sub esp, 0xc
push ebx
push esi
call fcn.00404520
test eax, eax
je 0x401f65
mov esi, ebx
or edx, 0xffffffff
mov ebx, dword [ebp - 0x7d0]
test esi, esi
je 0x4019d7
mov al, byte [ebx]
lea ebx, [ebx + 1]
movzx ecx, al
mov eax, ecx
shr ecx, 4
xor eax, edx
shr edx, 4
and eax, 0xf
xor edx, dword [eax*4 + 0x432710]
mov eax, edx
shr edx, 4
and eax, 0xf
xor ecx, eax
xor edx, dword [ecx*4 + 0x432710]
sub esi, 1
jne 0x4019a5
not edx
cmp edx, dword [ebp - 0x7b0]
jne 0x401f4d
test edi, edi
je 0x4019f5
mov ecx, dword [edi + 4]
jmp 0x4019f7
xor ecx, ecx
mov esi, dword [ebp - 0x7cc]
mov eax, dword [esi + 0x18]
test eax, eax
je 0x401a09
mov eax, dword [eax + 4]
jmp 0x401a0b
xor eax, eax
push ecx
push 0x4322c0
push eax
push 3
call fcn.0040a5a0
add esp, 0x10
mov dword [ebp - 0x7e0], eax
lea edx, [ebp - 0x7dc]
mov ecx, dword [eax + 4]
call fcn.0040b460
mov ebx, eax
test ebx, ebx
je 0x401acb
mov edi, dword [ebp - 0x7dc]
cmp edi, 0xffffffff
je 0x401f17
mov eax, dword ds:[ebx + 4]
add edi, edi
mov edx, dword [0x453ac4]
mov dword [ebp - 0x7d4], eax
lea ecx, [edi + 0xa]
call fcn.00409c00
mov esi, eax
xor eax, eax
lea ecx, [esi + 8]
mov dword [esi], edi
mov dword [esi + 4], ecx
mov word [ecx + edi], ax
mov eax, dword [ebp - 0x7d4]
test eax, eax
je 0x401a8c
push edi
push eax
push dword [esi + 4]
call fcn.00415e30
add esp, 0xc
mov ecx, esi
call fcn.004096e0
lfence
test eax, eax
js 0x401ef4
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x401ab4
lfence
call fcn.00409ce0
lea ecx, [ebx - 8]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [ecx + 4], eax
dec eax
jne 0x401ace
call fcn.00409ce0
jmp 0x401ace
or ebx, 0xffffffff
push 0
push 0
lea eax, [ebp - 0x8f0]
push eax
mov eax, dword [ebp - 0x7e0]
push dword [eax + 4]
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus]
test eax, eax
js 0x401f3b
push 0
push 0
push 0x60
push 5
push 7
push 0x80
lea eax, [ebp - 0x8f0]
mov dword [ebp - 0x930], 0x18
mov dword [ebp - 0x928], eax
lea eax, [ebp - 0x940]
push 0
push eax
lea eax, [ebp - 0x930]
mov dword [ebp - 0x92c], 0
push eax
push 0x12019f
lea eax, [ebp - 0x7e4]
mov dword [ebp - 0x924], 0x40
push eax
mov dword [ebp - 0x920], 0
mov dword [ebp - 0x91c], 0
call dword [sym.imp.ntdll.dll_NtCreateFile]
mov esi, eax
lea eax, [ebp - 0x8f0]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
test esi, esi
js 0x401f3b
mov ebx, dword ds:[ebp - 0x800]
lea eax, [ebp - 0x308]
mov edi, dword [ebp - 0x7d0]
mov esi, dword [ebp - 0x7e4]
push 0
push 0
push ebx
push edi
push eax
push 0
push 0
push 0
push esi
call dword [sym.imp.ntdll.dll_NtWriteFile]
test eax, eax
js 0x401f26
cmp dword [ebp - 0x304], ebx
jne 0x401f26
mov eax, dword [ebp - 0x7f8]
mov ecx, dword [ebp - 0x7fc]
add eax, ebx
mov dword [ebp - 0x8c8], eax
adc ecx, 0
mov dword [ebp - 0x7f8], eax
mov eax, ecx
mov dword [ebp - 0x7fc], ecx
and eax, 0x7fffffff
mov dword [ebp - 0x8d0], 0
mov dword [ebp - 0x8c4], eax
and ecx, 0x80000000
fild qword [ebp - 0x8c8]
mov eax, dword [ebp - 0x7e8]
mov dword [ebp - 0x8cc], ecx
mov dword [ebp - 0x8d8], eax
fild qword [ebp - 0x8d0]
mov eax, dword [ebp - 0x7ec]
mov ecx, eax
and eax, 0x7fffffff
and ecx, 0x80000000
mov dword [ebp - 0x8d4], eax
lfence
fchs
mov dword [ebp - 0x8dc], ecx
faddp st(1)
mov dword [ebp - 0x8e0], 0
mov ecx, dword [ebp - 0x7e0]
fstp qword [ebp - 0x7d8]
fld qword [ebp - 0x7d8]
fild qword [ebp - 0x8d8]
fild qword [ebp - 0x8e0]
fchs
faddp st(1)
fstp qword [ebp - 0x7d8]
fdiv qword [ebp - 0x7d8]
fstp dword [ebp - 0x7d4]
fld dword [ebp - 0x7d4]
fmul qword [ebp - 0x938]
fstp dword [ebp - 0x7d0]
call fcn.0040b7a0
mov ebx, eax
mov dword [ebp - 0x2b8], 1
mov dword [ebp - 0x2a8], 0x18
mov dword [ebp - 0x2a4], 0x4322c4
mov dword [ebp - 0x2a0], 1
test ebx, ebx
je 0x401cc9
mov edx, dword [ebx + 4]
jmp 0x401cce
mov edx, 0x4321fc
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x7d4], eax
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401ce0
sub ecx, dword ds:[ebp - 0x7d4]
sar ecx, 1
push 0
push 0x208
mov dword [ebp - 0x28c], edx
mov edx, 2
lea eax, [ecx + ecx]
mov dword [ebp - 0x290], eax
lea ecx, [ebp - 0x2b8]
lea eax, [ebp - 0x210]
push eax
call fcn.0040e960
test al, al
je 0x401d46
lea eax, ds:[ebp - 0x210]
push eax
mov eax, dword [ebp - 0x7cc]
push 3
push 0x472
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x7f8]
lea ecx, [ebp - 0x2b8]
fld dword [ebp - 0x7d0]
mov edx, 7
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x7fc]
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0x7e8]
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x7ec]
mov dword [ebp - 0x25c], eax
mov eax, 1
push 0
mov word [ebp - 0x23c], ax
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x210]
push 0x208
push eax
fstp qword [ebp - 0x230]
mov dword [ebp - 0x2b8], 1
mov dword [ebp - 0x2a8], 0x14
mov dword [ebp - 0x2a4], str.Progress:
mov dword [ebp - 0x2a0], 0xc
mov dword [ebp - 0x288], 1
mov dword [ebp - 0x278], 8
mov dword [ebp - 0x274], str._of
mov dword [ebp - 0x270], 0xc
mov dword [ebp - 0x258], 1
mov dword [ebp - 0x248], 4
mov dword [ebp - 0x244], 0x43220c
mov dword [ebp - 0x240], 0x4b
mov dword [ebp - 0x218], 4
mov dword [ebp - 0x214], 0x4322f8
call fcn.0040e960
mov edi, edi
test al, al
je 0x401e66
lea eax, ds:[ebp - 0x210]
push eax
mov eax, dword [ebp - 0x7cc]
push 0
push 0x472
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageW]
fld dword [ebp - 0x7d0]
fnstcw word [ebp - 0x7da]
movzx eax, word [ebp - 0x7da]
or eax, 0xc00
mov dword [ebp - 0x7d4], eax
push 0
fldcw word [ebp - 0x7d4]
fistp qword [ebp - 0x7d8]
mov eax, dword [ebp - 0x7d8]
push eax
mov eax, dword [ebp - 0x7cc]
fldcw word [ebp - 0x7da]
push 0x46a
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageW]
test ebx, ebx
je 0x401ecd
lea ecx, [ebx - 8]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [ecx + 4], eax
dec eax
jne 0x401ed0
call fcn.00409ce0
jmp 0x401ed0
or ebx, 0xffffffff
test esi, esi
je 0x401ede
push esi
lfence
call dword [sym.imp.ntdll.dll_NtClose]
push edi
call fcn.00416f21
add esp, 4
mov eax, dword [ebp - 0x804]
inc eax
jmp 0x4014b4
mov eax, dword [ebp - 0x7cc]
mov ecx, esi
mov dword [eax + 0x1c], 0x150
call fcn.00409cc0
mov ecx, ebx
call fcn.00409cc0
or ebx, 0xffffffff
jmp 0x401265
mov dword [esi + 0x1c], 0x570
or ebx, 0xffffffff
jmp 0x401265
mov eax, dword [ebp - 0x7cc]
or ebx, 0xffffffff
mov dword [eax + 0x1c], 0x570
jmp 0x401265
mov eax, dword [ebp - 0x7cc]
mov dword [eax + 0x1c], 0x570
jmp 0x401265
mov eax, dword ds:[ebp - 0x7cc]
or ebx, 0xffffffff
mov dword [eax + 0x1c], 0x17
jmp 0x401265
push esi
push dword [ebp - 0x2d8]
mov esi, dword [ebp - 0x2e0]
mov ecx, esi
call dword [0x42b26c]
call esi
mov eax, dword [ebp - 0x7cc]
or ebx, 0xffffffff
mov dword [eax + 0x1c], 0x3ee
jmp 0x401265
lea ecx, [ebp - 0x300]
call fcn.00404a00
push dword [ebp - 0x7f0]
push 0
push dword [0x453afc]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp - 0x7f4]
test eax, eax
je 0x401fc9
push eax
push 0
push dword [0x453afc]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ecx, dword [ebp - 0x808]
mov eax, ebx
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x401fe5
lea esp, [esp]
call fcn.00409ce0
mov eax, dword [ebp - 0x7e0]
test eax, eax
je 0x401fff
lea ecx, [eax - 8]
lock xadd dword [ecx + 4], ebx
dec ebx
jne 0x401fff
call fcn.00409ce0
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413aae
mov esp, ebp
pop ebp
ret