Function at 0x409110
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov esi, esp
call fcn.00409360
sub esp, 0x30
mov edi, esp
and edi, 0xfffffff8
mov esp, edi
push eax
mov ebx, esp
sub esp, 0x100
mov dword [esi + 8], esp
call fcn.004321b0
test al, 1
jne 0x409147
jmp 0x40932e
mov al, byte [ebx]
mov byte [esi + 4], al
mov byte [edi], 0x92
mov byte [edi + 1], 0x39
mov byte [edi + 2], 0x89
mov byte [edi + 3], 0x3b
mov byte [edi + 4], 0x94
mov byte [edi + 5], 0x3d
mov byte [edi + 6], 0x8b
mov byte [edi + 7], 0x3f
mov byte [edi + 8], 0x8a
mov byte [edi + 9], 1
mov byte [edi + 0xa], 0xa6
mov byte [edi + 0xb], 3
mov byte [edi + 0xc], 0xa1
mov byte [edi + 0xd], 5
mov byte [edi + 0xe], 0xb0
mov byte [edi + 0xf], 7
mov byte [edi + 0x10], 0xb3
mov byte [edi + 0x11], 9
mov byte [edi + 0x12], 0xa0
mov byte [edi + 0x13], 0xb
mov byte [edi + 0x14], 0xa1
mov byte [edi + 0x15], 0xd
mov byte [edi + 0x16], 0xb8
mov byte [edi + 0x17], 0xf
mov byte [edi + 0x18], 0xa2
mov byte [edi + 0x19], 0x11
mov byte [edi + 0x1a], 0xb3
mov byte [edi + 0x1b], 0x13
mov byte [edi + 0x1c], 0xa6
mov byte [edi + 0x1d], 0x15
mov byte [edi + 0x1e], 0xa0
mov byte [edi + 0x1f], 0x17
mov byte [edi + 0x20], 0xb1
mov byte [edi + 0x21], 0x19
mov byte [edi + 0x22], 0x18
mov byte [edi + 0x23], 0x1b
mov eax, 0x24
mov byte [edi + eax], 0
add eax, 1
cmp eax, 0x30
jne 0x4091e0
mov dword [esi], 0
mov eax, dword [esi]
cmp eax, 0x30
jae 0x40922a
mov eax, dword [esi]
mov ecx, dword [esi]
movzx ecx, byte [edi + ecx]
mov edx, eax
add edx, 0x42a70bd7
mov ebx, 0x28
sub ebx, eax
xor ebx, edx
and ebx, ecx
xor ebx, edx
mov dword [esi + 0xc], ebx
mov eax, dword [esi + 0xc]
add al, 0x1f
mov ecx, dword [esi]
mov byte [edi + ecx], al
mov eax, dword [esi]
inc eax
mov dword [esi], eax
jmp 0x4091f2
xor eax, eax
sub esp, 0xc
mov dword [esp], 0
mov dword [esp + 4], 1
mov dword [esp + 8], edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
call fcn.0042ae50
test al, 1
jne 0x409258
jmp 0x409312
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, 0
setge al
test al, 1
jne 0x409281
jmp 0x409312
xor eax, eax
sub esp, 0x24
mov dword [esp], 0
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
cmp eax, 0
jl 0x40930a
call fcn.0040a380
test al, 1
jne 0x4092e3
jmp 0x40930a
lea eax, str.system_or_character_via_spellings_glyphs_a_is_uses_that_in_their_modified_other_on_often_reflection_or_resemblance_on_it_leetspeak__used_similarity_internet._play_eleet_the_of_the_replacements_of_primarily_ways
sub esp, 8
mov ecx, dword [esi + 8]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00409340
add esp, 8
call fcn.0040cc60
call fcn.0040ba50
jmp 0x40930a
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x409312
cmp edi, 0
je 0x409327
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x409325
jmp 0x409327
call fcn.004324f0
jmp 0x40932e
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]