Function at 0x405460
Capabilities:
Create process on windows
Create thread
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e13b
mov eax, dword fs:[0]
push eax
sub esp, 0x894
mov eax, dword [0x498040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x2f4], edi
push 0
push 0
push 0
push 0x40c6f0
push 0
push 0
mov dword [ebp - 0x294], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [edi + 0x28], 0xa
jne 0x407546
cmp dword [edi + 0x40], 0x40
jne 0x407546
xorps xmm0, xmm0
mov dword [ebp - 0xb8], 0
movups xmmword [ebp - 0xc8], xmm0
mov dword [ebp - 0xb4], 0xf
movups xmmword [ebp - 0x108], xmm0
mov byte [ebp - 0xc8], 0
lea eax, [ebp - 0x108]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
lea eax, [ebp - 0x28c]
mov dword [ebp - 0x28c], 0
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.RPCRT4.dll_UuidToStringA]
test eax, eax
jne 0x405558
mov edx, dword [ebp - 0x28c]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405535
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0xc8]
call fcn.00411890
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeA]
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
mov byte [ebp - 4], 1
lea eax, [ebp - 0xc8]
mov ecx, 0x10
mov dword [ebp - 0x3ec], 0
cmp dword [ebp - 0xb8], ecx
movups xmmword [ebp - 0x3fc], xmm0
cmovb ecx, dword [ebp - 0xb8]
cmp dword [ebp - 0xb4], 0xf
push ecx
cmova eax, dword [ebp - 0xc8]
lea ecx, [ebp - 0x3fc]
push eax
mov dword [ebp - 0x3e8], 0
call fcn.00413000
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x4055f7
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4055ed
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
movups xmm0, xmmword [ebp - 0x3fc]
push ecx
lea eax, [ebp - 0x2a7]
mov byte [ebp - 0x3fc], 0
push eax
movups xmmword [ebp - 0x38], xmm0
lea eax, [ebp - 0x2a8]
mov word [ebp - 0x2a8], 0x2d
movq xmm0, qword [ebp - 0x3ec]
lea ecx, [ebp - 0x52c]
push eax
movq qword [ebp - 0x28], xmm0
mov dword [ebp - 0x3ec], 0
mov dword [ebp - 0x3e8], 0xf
mov byte [ebp - 0x2a6], 0
call fcn.00412240
mov byte [ebp - 4], 2
lea eax, [ebp - 0x38]
cmp dword [ebp - 0x24], 0xf
push dword [ebp - 0x28]
cmova eax, dword [ebp - 0x38]
push eax
push ecx
lea ecx, [ebp - 0x52c]
call fcn.00415780
mov dword [ebp - 0x38c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x39c], xmm0
mov dword [ebp - 0x388], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x39c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x38c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x518]
cmp ecx, 0xf
jbe 0x4056f7
mov edx, dword [ebp - 0x52c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4056ed
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
mov dword [ebp - 0x51c], 0
mov dword [ebp - 0x518], 0xf
mov byte [ebp - 0x52c], 0
lea eax, [edi + 0x30]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x39c]
mov dword [ebp - 0x294], eax
call fcn.0040f220
mov dword [ebp - 0x374], 0
lea esi, [edi + 0x1cc]
mov dword [ebp - 0x370], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x384], xmm0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x384], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x374], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x384]
cmp esi, eax
je 0x4057f7
mov ecx, dword [esi + 0x14]
cmp ecx, 0xf
jbe 0x4057b4
mov eax, dword [esi]
inc ecx
cmp ecx, 0x1000
jb 0x4057aa
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
mov eax, edx
push ecx
push eax
call fcn.004250be
add esp, 8
mov dword [esi + 0x10], 0
mov eax, 0xf
mov dword [esi + 0x14], 0xf
movups xmm0, xmmword [ebp - 0x384]
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x374]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x374], 0
mov dword [ebp - 0x370], eax
mov byte [ebp - 0x384], 0
jmp 0x4057fd
mov eax, dword [ebp - 0x370]
cmp eax, 0xf
jbe 0x405833
mov edx, dword [ebp - 0x384]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x405829
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x388]
mov dword [ebp - 0x374], 0
mov dword [ebp - 0x370], 0xf
mov byte [ebp - 0x384], 0
cmp ecx, 0xf
jbe 0x40588c
mov edx, dword [ebp - 0x39c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405882
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0x38c], 0
mov dword [ebp - 0x388], 0xf
mov byte [ebp - 0x39c], 0
call fcn.00409eb0
mov byte [ebp - 4], 4
call fcn.00425ca0
mov ecx, eax
mov dword [ebp - 0x364], 0xb9a1baf2
mov dword [ebp - 0x360], 0xbfb3abbd
mov eax, edi
mov word [ebp - 0x35c], 0xe1
mov byte [ebp - 0x35a], 1
cmp dword [edi + 0x14], 0xf
mov dword [ebp - 0x36c], ecx
jbe 0x4058f1
mov eax, dword [edi]
push 0
push eax
push ecx
call fcn.0042a070
add esp, 0xc
mov dword [ebp - 0x31c], eax
mov dword [ebp - 0x334], 0xbab7bbf2
xor ecx, ecx
mov dword [ebp - 0x330], 0x100e4bd
mov dword [ebp - 0x34c], 0xb4b8b0f2
mov dword [ebp - 0x348], 0xe6a3bcb3
mov word [ebp - 0x344], pe_nt_image_headers32
mov dword [ebp - 0x32c], 0xa4b7bdf2
mov dword [ebp - 0x328], 0x100e4b0
mov dword [ebp - 0x2a4], 0xa5b3a3f2
mov word [ebp - 0x2a0], 0xe5
mov byte [ebp - 0x29e], 1
mov dword [ebp - 0x2f0], 0xb2a6aca0
mov dword [ebp - 0x2ec], 0xb2b4b0e5
mov word [ebp - 0x2e8], 0xa8
mov byte [ebp - 0x2e6], 1
nop dword [eax + eax]
mov al, cl
sub al, 0x2c
xor byte [ebp + ecx - 0x2a4], al
inc ecx
cmp ecx, 5
jb 0x405990
push ecx
lea eax, [ebp - 0x29f]
mov byte [ebp - 0x29e], 0
push eax
lea eax, [ebp - 0x2a4]
push eax
lea ecx, [ebp - 0x43c]
call fcn.00412240
mov byte [ebp - 4], 5
cmp byte [ebp - 0x2e6], 0
je 0x4059e9
xor ecx, ecx
mov al, cl
sub al, 0x2c
xor byte [ebp + ecx - 0x2f0], al
inc ecx
cmp ecx, 9
jb 0x4059d1
mov byte [ebp - 0x2e6], 0
push ecx
lea eax, [ebp - 0x2e7]
push eax
lea eax, [ebp - 0x2f0]
push eax
lea ecx, [ebp - 0x424]
call fcn.00412240
lea eax, [ebp - 0x43c]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x424]
push eax
push dword [ebp - 0x294]
lea ecx, [ebp - 0x454]
call fcn.004146d0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x410]
cmp ecx, 0xf
jbe 0x405a64
mov edx, dword [ebp - 0x424]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405a5a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x428]
mov dword [ebp - 0x414], 0
mov dword [ebp - 0x410], 0xf
mov byte [ebp - 0x424], 0
cmp ecx, 0xf
jbe 0x405abd
mov edx, dword [ebp - 0x43c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405ab3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x428], 0xf
mov byte [ebp - 0x43c], 0
lea eax, [edi + 0x48]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x454]
call fcn.0040f220
mov dword [ebp - 0x3d4], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x3e4], xmm0
mov dword [ebp - 0x3d0], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x3e4], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x3d4], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x32c]
mov byte [ebp - 4], 8
push eax
lea edx, [ebp - 0x3e4]
lea ecx, [ebp - 0x58c]
call fcn.00407760
add esp, 4
mov esi, eax
mov byte [ebp - 4], 9
lea edx, [ebp - 0xe0]
cmp dword [ebp - 0xcc], 0xf
mov eax, dword [esi + 0x14]
cmova edx, dword [ebp - 0xe0]
mov ecx, dword [esi + 0x10]
mov edi, dword [ebp - 0xd0]
mov dword [ebp - 0x368], eax
sub eax, ecx
mov dword [ebp - 0x29c], ecx
cmp edi, eax
ja 0x405bc8
cmp dword [ebp - 0x368], 0xf
lea eax, [edi + ecx]
mov dword [esi + 0x10], eax
mov eax, esi
mov dword [ebp - 0x298], esi
jbe 0x405ba7
mov eax, dword [esi]
mov dword [ebp - 0x298], eax
push edi
add eax, ecx
push edx
push eax
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp - 0x298]
add esp, 0xc
mov ecx, dword [ebp - 0x29c]
add eax, edi
mov byte [eax + ecx], 0
jmp 0x405be1
push edi
push edx
mov byte [ebp - 0x29c], 0
mov ecx, esi
push dword [ebp - 0x29c]
push edi
call fcn.00412ea0
mov esi, eax
mov dword [ebp - 0x3bc], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x3cc], xmm0
mov dword [ebp - 0x3b8], 0
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x3cc], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x3bc], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
lea eax, [ebp - 0x34c]
mov byte [ebp - 4], 0xa
push eax
lea edx, [ebp - 0x3cc]
lea ecx, [ebp - 0x574]
call fcn.00407860
add esp, 4
mov esi, eax
mov byte [ebp - 4], 0xb
lea edx, [ebp - 0x38]
cmp dword [ebp - 0x24], 0xf
mov eax, dword [esi + 0x14]
cmova edx, dword [ebp - 0x38]
mov ecx, dword [esi + 0x10]
mov edi, dword [ebp - 0x28]
mov dword [ebp - 0x29c], eax
sub eax, ecx
mov dword [ebp - 0x368], ecx
cmp edi, eax
ja 0x405cb2
cmp dword [ebp - 0x29c], 0xf
lea eax, [edi + ecx]
mov dword [esi + 0x10], eax
mov eax, esi
mov dword [ebp - 0x298], esi
jbe 0x405c91
mov eax, dword [esi]
mov dword [ebp - 0x298], eax
push edi
add eax, ecx
push edx
push eax
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp - 0x298]
add esp, 0xc
mov ecx, dword [ebp - 0x368]
add eax, edi
mov byte [eax + ecx], 0
jmp 0x405ccb
push edi
push edx
mov byte [ebp - 0x29c], 0
mov ecx, esi
push dword [ebp - 0x29c]
push edi
call fcn.00412ea0
mov esi, eax
mov dword [ebp - 0x3a4], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x3b4], xmm0
mov dword [ebp - 0x3a0], 0
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x3b4], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x3a4], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
lea eax, [ebp - 0x334]
mov byte [ebp - 4], 0xc
push eax
lea edx, [ebp - 0x3b4]
lea ecx, [ebp - 0x55c]
call fcn.00407760
push dword [ebp - 0x31c]
mov edx, eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x544]
call fcn.00411d00
lea ecx, [ebp - 0x364]
mov byte [ebp - 4], 0xe
push ecx
mov edx, eax
lea ecx, [ebp - 0x61c]
call fcn.004079e0
add esp, 0xc
mov edi, dword [ebp - 0x2f4]
mov byte [ebp - 4], 0xf
lea ecx, [edi + 0x18]
push ecx
mov ecx, eax
call fcn.0040f220
mov dword [ebp - 0xa0], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0xb0], xmm0
mov dword [ebp - 0x9c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xb0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xa0], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov eax, 0x7ffc
mov dword [ebp - 0x298], eax
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x608]
cmp ecx, 0xf
jbe 0x405e03
mov edx, dword [ebp - 0x61c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405df9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
mov dword [ebp - 0x60c], 0
mov dword [ebp - 0x608], 0xf
mov byte [ebp - 0x61c], 0
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x530]
cmp ecx, 0xf
jbe 0x405e5c
mov edx, dword [ebp - 0x544]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405e52
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
mov dword [ebp - 0x534], 0
mov dword [ebp - 0x530], 0xf
mov byte [ebp - 0x544], 0
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x548]
cmp ecx, 0xf
jbe 0x405eb5
mov edx, dword [ebp - 0x55c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405eab
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
mov dword [ebp - 0x54c], 0
mov dword [ebp - 0x548], 0xf
mov byte [ebp - 0x55c], 0
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x3a0]
cmp ecx, 0xf
jbe 0x405f0e
mov edx, dword [ebp - 0x3b4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405f04
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
mov dword [ebp - 0x3a4], 0
mov dword [ebp - 0x3a0], 0xf
mov byte [ebp - 0x3b4], 0
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x560]
cmp ecx, 0xf
jbe 0x405f67
mov edx, dword [ebp - 0x574]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405f5d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
mov dword [ebp - 0x564], 0
mov dword [ebp - 0x560], 0xf
mov byte [ebp - 0x574], 0
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x3b8]
cmp ecx, 0xf
jbe 0x405fc0
mov edx, dword [ebp - 0x3cc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405fb6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
mov dword [ebp - 0x3bc], 0
mov dword [ebp - 0x3b8], 0xf
mov byte [ebp - 0x3cc], 0
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x578]
cmp ecx, 0xf
jbe 0x406019
mov edx, dword [ebp - 0x58c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40600f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
mov dword [ebp - 0x57c], 0
mov dword [ebp - 0x578], 0xf
mov byte [ebp - 0x58c], 0
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x3d0]
cmp ecx, 0xf
jbe 0x406072
mov edx, dword [ebp - 0x3e4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406068
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
mov dword [ebp - 0x3d4], 0
mov dword [ebp - 0x3d0], 0xf
mov byte [ebp - 0x3e4], 0
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x440]
cmp ecx, 0xf
jbe 0x4060cb
mov edx, dword [ebp - 0x454]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4060c1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
lea esi, [edi + 0x78]
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x440], 0xf
mov ecx, esi
mov byte [ebp - 0x454], 0
cmp dword [esi + 0x14], 0xf
jbe 0x4060f3
mov ecx, dword [esi]
mov edx, dword [esi + 0x10]
push 0
push 0x48f822
call fcn.0041a610
add esp, 8
test al, al
je 0x406116
cmp dword [edi + 0x88], 0
je 0x406707
mov byte [ebp - 0x31c], 0
lea ecx, [ebp - 0x46c]
push dword [ebp - 0x31c]
mov edx, esi
call fcn.00417da0
add esp, 4
lea ecx, [ebp - 0x46c]
mov byte [ebp - 4], 0x1a
call fcn.00404fc0
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x458]
mov byte [ebp - 0x28d], al
cmp ecx, 7
jbe 0x406192
mov edx, dword [ebp - 0x46c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x406182
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
mov al, byte [ebp - 0x28d]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x458], 7
mov word [ebp - 0x46c], cx
test al, al
jne 0x40620c
movaps xmm0, xmmword [0x491c50]
movups xmmword [ebp - 0x6f4], xmm0
push 0x10
movaps xmm0, xmmword [0x491b90]
movups xmmword [ebp - 0x6e4], xmm0
push ecx
movaps xmm0, xmmword [0x491af0]
lea ecx, [ebp - 0x6f4]
movups xmmword [ebp - 0x6d4], xmm0
mov word [ebp - 0x6c4], 0x2a
mov byte [ebp - 0x6c2], 1
call fcn.00407ae0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push 0xb8
lea eax, [ebp - 0x288]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push esi
lea ecx, [ebp - 0x288]
call fcn.0040e370
xorps xmm0, xmm0
mov dword [ebp - 0x70], 0
movups xmmword [ebp - 0x80], xmm0
mov dword [ebp - 0x6c], 0xf
mov byte [ebp - 0x80], 0
movups xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0xf
mov byte [ebp - 0x50], 0
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x288]
mov eax, dword [ebp - 0x288]
push 0xa
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_char___thiscall_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const]
movzx eax, al
lea edx, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x288]
call fcn.00417de0
movaps xmm0, xmmword [0x491c20]
lea ecx, [ebp - 0x5bc]
movups xmmword [ebp - 0x758], xmm0
mov edx, str.certutil__hashfile__
mov word [ebp - 0x728], pe_nt_image_headers32
movaps xmm0, xmmword [0x491c70]
movups xmmword [ebp - 0x748], xmm0
push esi
movaps xmm0, xmmword [0x491a20]
movups xmmword [ebp - 0x738], xmm0
call fcn.00411bd0
lea ecx, [ebp - 0x758]
mov byte [ebp - 4], 0x1e
push ecx
mov edx, eax
lea ecx, [ebp - 0x5a4]
call fcn.00407e10
add esp, 0xc
mov byte [ebp - 4], 0x1f
cmp dword [eax + 0x14], 0xf
jbe 0x4062f2
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x604]
push eax
call fcn.00407c80
mov edi, eax
lea eax, [ebp - 0x50]
cmp eax, edi
je 0x406370
mov ecx, dword [ebp - 0x3c]
cmp ecx, 0xf
jbe 0x40633c
mov edx, dword [ebp - 0x50]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406332
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0xf
mov byte [ebp - 0x50], 0
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x50], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x40], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov ecx, dword [ebp - 0x5f0]
cmp ecx, 0xf
jbe 0x4063aa
mov edx, dword [ebp - 0x604]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4063a0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x590]
mov dword [ebp - 0x5f4], 0
mov dword [ebp - 0x5f0], 0xf
mov byte [ebp - 0x604], 0
cmp ecx, 0xf
jbe 0x406403
mov edx, dword [ebp - 0x5a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4063f9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
mov byte [ebp - 4], 0x1d
mov ecx, dword [ebp - 0x5a8]
mov dword [ebp - 0x594], 0
mov dword [ebp - 0x590], 0xf
mov byte [ebp - 0x5a4], 0
cmp ecx, 0xf
jbe 0x40645c
mov edx, dword [ebp - 0x5bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406452
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
mov dword [ebp - 0x5ac], 0
xor ecx, ecx
mov dword [ebp - 0x5a8], 0xf
mov byte [ebp - 0x5bc], 0
mov dword [ebp - 0x2c0], 0xbcb9a1f2
mov dword [ebp - 0x2bc], 0xe7b7bd
mov byte [ebp - 0x2b8], 1
mov al, cl
sub al, 0x2c
xor byte [ebp + ecx - 0x2c0], al
inc ecx
cmp ecx, 7
jb 0x406494
lea ecx, [ebp - 0x2c0]
mov byte [ebp - 0x2b8], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4064b5
mov edi, bind
sub ecx, edx
mov edx, dword [ebp - 0x70]
mov eax, edi
sub eax, edx
cmp eax, ecx
jb 0x4075b2
cmp dword [ebp - 0x6c], 0xf
lea eax, [ebp - 0x80]
push edx
cmova eax, dword [ebp - 0x80]
push eax
push ecx
lea eax, [ebp - 0x2c0]
push eax
push ecx
push dword [ebp - 0x294]
lea ecx, [ebp - 0x484]
call fcn.004148b0
lea eax, [ebp - 0x484]
mov byte [ebp - 4], 0x20
push eax
lea ecx, [ebp - 0xb0]
call fcn.0040f220
mov byte [ebp - 4], 0x1d
mov ecx, dword [ebp - 0x470]
cmp ecx, 0xf
jbe 0x40654d
mov edx, dword [ebp - 0x484]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406543
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
mov dword [ebp - 0x474], 0
xor ecx, ecx
mov dword [ebp - 0x470], 0xf
mov byte [ebp - 0x484], 0
mov dword [ebp - 0x2cc], 0xb6bea1f2
mov dword [ebp - 0x2c8], 0xe7b1ab
mov byte [ebp - 0x2c4], 1
mov al, cl
sub al, 0x2c
xor byte [ebp + ecx - 0x2cc], al
inc ecx
cmp ecx, 7
jb 0x406585
lea ecx, [ebp - 0x2cc]
mov byte [ebp - 0x2c4], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4065a6
sub ecx, edx
mov eax, edi
mov edx, dword [esi + 0x10]
sub eax, edx
cmp eax, ecx
jb 0x4075b2
cmp dword [esi + 0x14], 0xf
jbe 0x4065c6
mov esi, dword [esi]
push edx
push esi
push ecx
lea eax, [ebp - 0x2cc]
push eax
push ecx
push dword [ebp - 0x294]
lea ecx, [ebp - 0x49c]
call fcn.004148b0
mov esi, 0x60007ffc
mov dword [ebp - 0x298], esi
lea eax, [ebp - 0x49c]
mov byte [ebp - 4], 0x21
push eax
lea ecx, [ebp - 0xb0]
call fcn.0040f220
mov byte [ebp - 4], 0x1d
mov ecx, dword [ebp - 0x488]
cmp ecx, 0xf
jbe 0x406641
mov edx, dword [ebp - 0x49c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406637
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x48c], 0
mov dword [ebp - 0x488], 0xf
mov byte [ebp - 0x49c], 0
cmp ecx, 0xf
jbe 0x406694
mov edx, dword [ebp - 0x50]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40668a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0xf
mov byte [ebp - 0x50], 0
cmp ecx, 0xf
jbe 0x4066de
mov edx, dword [ebp - 0x80]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4066d4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
lea ecx, [ebp - 0x288]
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0xf
mov byte [ebp - 0x80], 0
mov byte [ebp - 4], 0x19
call fcn.00408330
mov edi, dword [ebp - 0x2f4]
jmp 0x40670c
mov esi, 0x7ffc
push dword [ebp - 0x36c]
call fcn.00425c60
sub esp, 0x14
lea eax, [edi + 0x60]
mov ecx, esp
mov dword [ebp - 0x36c], esp
push eax
call fcn.0040f360
sub esp, 0x18
mov byte [ebp - 4], 0x22
lea eax, [ebp - 0xb0]
mov ecx, esp
push eax
call fcn.0040f360
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x19
call fcn.00409720
add esp, 0x30
mov byte [ebp - 4], 0x23
cmp dword [ebp - 0x88], 0x10
movaps xmm0, xmmword [0x4919e0]
movups xmmword [ebp - 0x678], xmm0
mov byte [ebp - 0x668], 1
jne 0x40681d
lea eax, [ebp - 0x5d4]
push eax
lea ecx, [ebp - 0x678]
call fcn.00407f00
mov ecx, eax
or esi, 0x10000000
mov dword [ebp - 0x298], esi
cmp dword [ecx + 0x14], 0xf
mov eax, dword [ecx + 0x10]
jbe 0x4067a3
mov ecx, dword [ecx]
cmp dword [ebp - 0x84], 0xf
lea edx, [ebp - 0x98]
mov esi, dword [ebp - 0x88]
cmova edx, dword [ebp - 0x98]
cmp esi, eax
jne 0x40681d
sub esi, 4
jb 0x4067d7
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x4067dc
add edx, 4
add ecx, 4
sub esi, 4
jae 0x4067c6
cmp esi, 0xfffffffc
je 0x406810
mov al, byte [edx]
cmp al, byte [ecx]
jne 0x406809
cmp esi, 0xfffffffd
je 0x406810
mov al, byte [edx + 1]
cmp al, byte [ecx + 1]
jne 0x406809
cmp esi, 0xfffffffe
je 0x406810
mov al, byte [edx + 2]
cmp al, byte [ecx + 2]
jne 0x406809
cmp esi, 0xffffffff
je 0x406810
mov al, byte [edx + 3]
cmp al, byte [ecx + 3]
je 0x406810
sbb eax, eax
or eax, 1
jmp 0x406812
xor eax, eax
mov byte [ebp - 0x28d], 1
test eax, eax
je 0x406824
mov byte [ebp - 0x28d], 0
test dword [ebp - 0x298], 0x10000000
je 0x406885
mov ecx, dword [ebp - 0x5c0]
cmp ecx, 0xf
jbe 0x40686a
mov edx, dword [ebp - 0x5d4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406860
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
mov dword [ebp - 0x5c4], 0
mov dword [ebp - 0x5c0], 0xf
mov byte [ebp - 0x5d4], 0
cmp byte [ebp - 0x28d], 0
je 0x4068f7
movaps xmm0, xmmword [0x491c30]
lea ecx, [ebp - 0x6c0]
movups xmmword [ebp - 0x6c0], xmm0
push 0x10
movaps xmm0, xmmword [0x491bd0]
movups xmmword [ebp - 0x6b0], xmm0
push 0
movaps xmm0, xmmword [0x491aa0]
movups xmmword [ebp - 0x6a0], xmm0
mov dword [ebp - 0x680], 0x387166
movaps xmm0, xmmword [0x491b00]
movups xmmword [ebp - 0x690], xmm0
mov byte [ebp - 0x67c], 1
call fcn.00407fa0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push 0
push 1
sub esp, 0x28
lea edx, [ebp - 0x98]
mov eax, esp
lea ecx, [ebp - 0x68]
mov dword [eax + 0x24], 0
call fcn.00412410
add esp, 0x30
mov byte [ebp - 4], 0x24
lea eax, [ebp - 0x70c]
push eax
lea ecx, [ebp - 0x340]
mov dword [ebp - 0x340], 0xa4a5b0b9
mov dword [ebp - 0x33c], 0xbfbeb9
mov byte [ebp - 0x338], 1
call fcn.0040d630
lea eax, [ebp - 0x70c]
mov byte [ebp - 4], 0x25
push eax
lea ecx, [ebp - 0x68]
call fcn.0040e7b0
lea ecx, [ebp - 0xf8]
push ecx
mov ecx, eax
call fcn.00411ee0
lea ecx, [ebp - 0x70c]
mov byte [ebp - 4], 0x27
call fcn.0040f2d0
push 0xb0
lea eax, [ebp - 0x1d0]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 8
lea ecx, [ebp - 0x1d0]
call fcn.0040d570
sub esp, 8
mov byte [ebp - 4], 0x28
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
call fcn.0040ef20
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x98]
mov edi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
sub edi, edx
call fcn.004018d0
mov ecx, dword [ebp - 0x294]
mov esi, eax
call fcn.004018d0
push edi
push edx
push dword [ebp - 0x88]
mov ecx, eax
push esi
mov esi, dword [ebp - 0x2f4]
mov edx, dword [esi + 0x40]
call fcn.0041e8e0
mov eax, dword [ebp - 0x1c]
add esp, 0x10
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x294], eax
cmp edi, eax
je 0x406a7a
nop dword [eax + eax]
mov al, byte [edi]
lea ecx, [ebp - 0x1c0]
push 0x402770
mov byte [ebp - 0x28d], al
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov esi, eax
lea eax, [ebp - 0x8a0]
push 0
push 2
push eax
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
mov byte [ecx + esi + 0x40], 0x30
call dword [sym.imp.MSVCP140.dll_struct_std::_Smanip_long_long___int64_____cdecl_std::setw_long_long___int64__]
push dword [eax + 0xc]
mov ecx, dword [eax]
push dword [eax + 8]
mov eax, dword [esi]
mov eax, dword [eax + 4]
add eax, esi
push eax
call ecx
movzx eax, byte [ebp - 0x28d]
add esp, 0x18
mov ecx, esi
push eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___int_]
inc edi
cmp edi, dword [ebp - 0x294]
jne 0x406a10
mov esi, dword [ebp - 0x2f4]
cmp dword [0x498498], 0xf
lea eax, [ebp - 0x5ec]
mov edi, 0x498484
lea ecx, [ebp - 0x1d0]
cmova edi, dword [0x498484]
push eax
call fcn.0040d480
cmp dword [eax + 0x14], 0xf
jbe 0x406aa7
mov eax, dword [eax]
movd xmm1, dword [edi]
movd xmm0, dword [eax]
mov ecx, dword [ebp - 0x5d8]
punpcklbw xmm0, xmm0
punpcklbw xmm1, xmm1
punpcklwd xmm0, xmm0
punpcklwd xmm1, xmm1
psrad xmm0, 0x18
psrad xmm1, 0x18
xorps xmm1, xmm0
movaps xmm0, xmm1
psrldq xmm0, 8
orps xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
orps xmm1, xmm0
movd edi, xmm1
cmp ecx, 0xf
jbe 0x406b20
mov edx, dword [ebp - 0x5ec]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406b16
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
mov dword [ebp - 0x5dc], 0
mov dword [ebp - 0x5d8], 0xf
mov byte [ebp - 0x5ec], 0
test edi, edi
je 0x406b91
mov edx, dword [ebp - 0xe8]
sub esp, 0x18
mov eax, bind
mov ecx, esp
sub eax, edx
mov dword [ebp - 0x294], ecx
cmp eax, 0x6b
jb 0x4075b2
cmp dword [ebp - 0xe4], 0xf
lea eax, [ebp - 0xf8]
push edx
cmova eax, dword [ebp - 0xf8]
push eax
push 0x6b
push str.Signature_checksum_failed._Request_was_tampered_with_or_session_ended_most_likely.__echo:__echo_Message:
push ecx
push dword [ebp - 0x294]
call fcn.004148b0
call fcn.00409ce0
add esp, 0x18
sub esp, 0x10
lea eax, [ebp - 0x68]
mov ecx, esp
push eax
call fcn.0040eb10
mov ecx, esi
call fcn.00403ec0
mov dword [ebp - 0x2d8], 0xb4b5a0a7
xor ecx, ecx
mov dword [ebp - 0x2d4], 0xa9aabd
mov byte [ebp - 0x2d0], 1
mov al, cl
sub al, 0x2c
xor byte [ebp + ecx - 0x2d8], al
inc ecx
cmp ecx, 7
jb 0x406bc3
push ecx
lea eax, [ebp - 0x2d1]
mov byte [ebp - 0x2d0], 0
push eax
lea eax, [ebp - 0x2d8]
push eax
lea ecx, [ebp - 0x4b4]
call fcn.00412240
lea eax, [ebp - 0x4b4]
mov byte [ebp - 4], 0x2a
push eax
lea ecx, [ebp - 0x68]
call fcn.0040e7b0
xor edx, edx
cmp byte [eax], 4
lea ecx, [eax + 8]
cmovne ecx, edx
mov al, byte [ecx]
mov byte [ebp - 4], 0x29
mov ecx, dword [ebp - 0x4a0]
mov byte [ebp - 0x28d], al
cmp ecx, 0xf
jbe 0x406c5f
mov edx, dword [ebp - 0x4b4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406c4f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
mov al, byte [ebp - 0x28d]
add esp, 8
mov dword [ebp - 0x4a4], 0
mov dword [ebp - 0x4a0], 0xf
mov byte [ebp - 0x4b4], 0
test al, al
je 0x4071a1
mov dword [ebp - 0x318], 0x84a1b0ba
xor ecx, ecx
mov dword [ebp - 0x314], 0xb2a9aabd
mov dword [ebp - 0x310], 0x100b3b3
mov al, cl
sub al, 0x2c
xor byte [ebp + ecx - 0x318], al
inc ecx
cmp ecx, 0xa
jb 0x406ca2
push ecx
lea eax, [ebp - 0x30e]
mov byte [ebp - 0x30d], 0
push eax
lea eax, [ebp - 0x318]
push eax
lea ecx, [ebp - 0x4cc]
call fcn.00412240
lea eax, [ebp - 0x4cc]
mov byte [ebp - 4], 0x2b
push eax
lea ecx, [ebp - 0x68]
call fcn.0040e7b0
xor edx, edx
cmp byte [eax], 4
lea ecx, [eax + 8]
cmovne ecx, edx
mov al, byte [ecx]
mov byte [ebp - 4], 0x29
mov ecx, dword [ebp - 0x4b8]
mov byte [ebp - 0x28d], al
cmp ecx, 0xf
jbe 0x406d3e
mov edx, dword [ebp - 0x4cc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406d2e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
mov al, byte [ebp - 0x28d]
add esp, 8
mov dword [ebp - 0x4bc], 0
mov dword [ebp - 0x4b8], 0xf
mov byte [ebp - 0x4cc], 0
test al, al
je 0x406d65
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x30c], 0xa4a5b0a7
xor ecx, ecx
mov dword [ebp - 0x308], 0xb2b4b6b1
mov word [ebp - 0x304], 0xb8
mov byte [ebp - 0x302], 1
nop dword [eax + eax]
mov al, cl
sub al, 0x2c
xor byte [ebp + ecx - 0x30c], al
inc ecx
cmp ecx, 9
jb 0x406d90
push ecx
lea eax, [ebp - 0x303]
mov byte [ebp - 0x302], 0
push eax
lea eax, [ebp - 0x30c]
push eax
lea ecx, [ebp - 0x4e4]
call fcn.00412240
lea eax, [ebp - 0x4e4]
mov byte [ebp - 4], 0x2c
push eax
lea ecx, [ebp - 0x68]
call fcn.0040e7b0
cmp byte [eax], 3
jne 0x406ddf
mov eax, dword [eax + 8]
jmp 0x406de1
xor eax, eax
cmp dword [eax + 0x14], 0xf
mov ecx, eax
jbe 0x406deb
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [esi + 0x1b4]
call fcn.00411890
mov byte [ebp - 4], 0x29
mov ecx, dword [ebp - 0x4d0]
cmp ecx, 0xf
jbe 0x406e38
mov edx, dword [ebp - 0x4e4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406e2e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
mov dword [ebp - 0x4d4], 0
xor ecx, ecx
mov dword [ebp - 0x4d0], 0xf
mov byte [ebp - 0x4e4], 0
mov byte [0x4990e0], 1
mov dword [ebp - 0x2b4], 0xbea6a5b5
mov dword [ebp - 0x2b0], 0xb5bfb6
mov byte [ebp - 0x2ac], 1
nop word [eax + eax]
mov al, cl
sub al, 0x2c
xor byte [ebp + ecx - 0x2b4], al
inc ecx
cmp ecx, 7
jb 0x406e80
push ecx
lea eax, [ebp - 0x2ad]
mov byte [ebp - 0x2ac], 0
push eax
lea eax, [ebp - 0x2b4]
push eax
lea ecx, [ebp - 0x4fc]
call fcn.00412240
sub esp, 0x10
mov byte [ebp - 4], 0x2d
lea eax, [ebp - 0x4fc]
mov esi, esp
lea ecx, [ebp - 0x68]
push eax
call fcn.0040e7b0
push eax
mov ecx, esi
call fcn.0040eb10
mov ecx, dword [ebp - 0x2f4]
call fcn.00403d80
mov ecx, dword [ebp - 0x4e8]
cmp ecx, 0xf
jbe 0x406f17
mov edx, dword [ebp - 0x4fc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406f0d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
mov dword [ebp - 0x4ec], 0
mov dword [ebp - 0x4e8], 0xf
mov byte [ebp - 0x4fc], 0
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x406f7b
mov edx, dword [ebp - 0x18]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x406f5c
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push edx
push ecx
call fcn.004250be
add esp, 8
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x1d0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebp - 0x1d0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x1d4], eax
lea ecx, [ebp - 0x1b8]
call fcn.0040d3d0
lea ecx, [ebp - 0x1b0]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void_]
lea ecx, [ebp - 0x168]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov ecx, dword [ebp - 0xe4]
cmp ecx, 0xf
jbe 0x406fff
mov edx, dword [ebp - 0xf8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406ff5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
lea ecx, [ebp - 0x68]
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0xe4], 0xf
mov byte [ebp - 0xf8], 0
call fcn.0040eaf0
mov ecx, dword [ebp - 0x84]
cmp ecx, 0xf
jbe 0x40705c
mov edx, dword [ebp - 0x98]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x407052
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
mov ecx, dword [ebp - 0x9c]
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0xf
mov byte [ebp - 0x98], 0
cmp ecx, 0xf
jbe 0x4070b1
mov edx, dword [ebp - 0xb0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4070a7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
mov ecx, dword [ebp - 0xcc]
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 0xf
mov byte [ebp - 0xb0], 0
cmp ecx, 0xf
jbe 0x407106
mov edx, dword [ebp - 0xe0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4070fc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0xcc], 0xf
mov byte [ebp - 0xe0], 0
cmp ecx, 0xf
jbe 0x407151
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x407147
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
mov ecx, dword [ebp - 0xb4]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
cmp ecx, 0xf
jbe 0x40752b
mov edx, dword [ebp - 0xc8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x407521
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x407521
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
xorps xmm0, xmm0
mov dword [ebp - 0x300], 0xb6a0bbbd
push 0x18
mov dword [ebp - 0x2fc], 0xadbeb0b4
mov dword [ebp - 0x2f8], 0x100afb9
movq qword [ebp - 0x404], xmm0
mov byte [ebp - 0x40c], 3
movlpd qword [ebp - 0x58], xmm0
call fcn.00424e3d
mov edx, eax
add esp, 4
lea eax, [ebp - 0x11]
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x58], eax
mov byte [ebp - 4], 0x2e
cmp byte [ebp - 0x2f5], 0
je 0x407218
xor ecx, ecx
nop word [eax + eax]
mov al, cl
sub al, 0x2c
xor byte [ebp + ecx - 0x300], al
inc ecx
cmp ecx, 0xa
jb 0x407200
mov byte [ebp - 0x2f5], 0
push ecx
lea eax, [ebp - 0x2f6]
mov ecx, edx
push eax
lea eax, [ebp - 0x300]
push eax
call fcn.00412240
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x404], eax
mov byte [ebp - 4], 0x2f
xor ecx, ecx
mov dword [ebp - 0x2e4], 0xa4a5b0b9
mov dword [ebp - 0x2e0], 0xbfbeb9
mov byte [ebp - 0x2dc], 1
nop
mov al, cl
sub al, 0x2c
xor byte [ebp + ecx - 0x2e4], al
inc ecx
cmp ecx, 7
jb 0x407260
push ecx
lea eax, [ebp - 0x2dd]
mov byte [ebp - 0x2dc], 0
push eax
lea eax, [ebp - 0x2e4]
push eax
lea ecx, [ebp - 0x514]
call fcn.00412240
lea eax, [ebp - 0x514]
mov byte [ebp - 4], 0x30
push eax
lea ecx, [ebp - 0x68]
call fcn.0040e7b0
lea edx, [ebp - 0x40c]
mov ecx, eax
call fcn.0040e4b0
mov byte [ebp - 4], 0x2f
mov ecx, dword [ebp - 0x500]
mov byte [ebp - 0x28d], al
cmp ecx, 0xf
jbe 0x4072f6
mov edx, dword [ebp - 0x514]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4072ec
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40719b
push ecx
push edx
call fcn.004250be
add esp, 8
lea ecx, [ebp - 0x40c]
mov dword [ebp - 0x504], 0
mov dword [ebp - 0x500], 0xf
mov byte [ebp - 0x514], 0
mov byte [ebp - 4], 0x29
call fcn.0040eaf0
cmp byte [ebp - 0x28d], 0
je 0x406f32
lea eax, [ebp - 0x724]
mov dword [ebp - 0x358], 0xb9a1bab0
push eax
lea ecx, [ebp - 0x358]
mov dword [ebp - 0x354], 0xbfbbb6b4
mov word [ebp - 0x350], pe_nt_image_headers32
call fcn.0040e490
lea eax, [ebp - 0x724]
mov byte [ebp - 4], 0x31
push eax
lea ecx, [ebp - 0x68]
call fcn.0040e7b0
lea ecx, [ebp - 0x120]
push ecx
mov ecx, eax
call fcn.00411ee0
lea ecx, [ebp - 0x724]
call fcn.0040f2d0
mov edx, 0x48f822
lea ecx, [ebp - 0x120]
call fcn.00411db0
test al, al
je 0x4074de
movaps xmm0, xmmword [0x491b60]
lea ecx, [ebp - 0x890]
movups xmmword [ebp - 0x890], xmm0
push 0x10
movaps xmm0, xmmword [0x491bc0]
movups xmmword [ebp - 0x880], xmm0
push 0
movaps xmm0, xmmword [0x491a30]
movups xmmword [ebp - 0x870], xmm0
mov dword [ebp - 0x760], 0x7e6a7167
movaps xmm0, xmmword [0x491ad0]
movups xmmword [ebp - 0x860], xmm0
mov word [ebp - 0x75c], 0x26
movaps xmm0, xmmword [0x491a80]
movups xmmword [ebp - 0x850], xmm0
mov byte [ebp - 0x75a], 1
movaps xmm0, xmmword [0x491a70]
movups xmmword [ebp - 0x840], xmm0
movaps xmm0, xmmword [0x491ab0]
movups xmmword [ebp - 0x830], xmm0
movaps xmm0, xmmword [0x491a40]
movups xmmword [ebp - 0x820], xmm0
movaps xmm0, xmmword [str.t__2x55:88_]
movups xmmword [ebp - 0x810], xmm0
movaps xmm0, xmmword [0x491a10]
movups xmmword [ebp - 0x800], xmm0
movaps xmm0, xmmword [0x491c90]
movups xmmword [ebp - 0x7f0], xmm0
movaps xmm0, xmmword [0x491ca0]
movups xmmword [ebp - 0x7e0], xmm0
movaps xmm0, xmmword [0x491c60]
movups xmmword [ebp - 0x7d0], xmm0
movaps xmm0, xmmword [0x491c00]
movups xmmword [ebp - 0x7c0], xmm0
movaps xmm0, xmmword [0x491bf0]
movups xmmword [ebp - 0x7b0], xmm0
movaps xmm0, xmmword [0x491be0]
movups xmmword [ebp - 0x7a0], xmm0
movaps xmm0, xmmword [0x491b40]
movups xmmword [ebp - 0x790], xmm0
movaps xmm0, xmmword [0x491b80]
movups xmmword [ebp - 0x780], xmm0
movaps xmm0, xmmword [0x491ac0]
movups xmmword [ebp - 0x770], xmm0
call fcn.00408140
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x407519
lea ecx, [ebp - 0x120]
call fcn.004018d0
lea ecx, [ebp - 0x324]
mov dword [ebp - 0x324], 0xb9b3a5bb
mov edx, eax
mov word [ebp - 0x320], pe_nt_image_headers32
call fcn.004082f0
push 1
push 0
push 0
push edx
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push ecx
push edx
call fcn.004250be
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424d75
mov esp, ebp
pop ebp
ret
movaps xmm0, xmmword [0x491c40]
lea ecx, [ebp - 0x664]
movups xmmword [ebp - 0x664], xmm0
push 0x10
movaps xmm0, xmmword [0x491c80]
movups xmmword [ebp - 0x654], xmm0
push 0
movaps xmm0, xmmword [0x491ae0]
movups xmmword [ebp - 0x644], xmm0
mov dword [ebp - 0x624], 0x74387b7d
movaps xmm0, xmmword [0x491b10]
movups xmmword [ebp - 0x634], xmm0
mov dword [ebp - 0x620], 0x1006968
call fcn.004075c0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call fcn.00401fb0
int3