Function at 0x409c90
Capabilities:
Contain obfuscated stackstrings
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52f469
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1b0
push esi
push edi
mov ecx, 0x56c279
mov dword [ebp - 4], 2
call fcn.00500c8d
lea eax, [ebp + 0x20]
push eax
lea ecx, [ebp - 0x1bc]
call fcn.00403fc0
lea eax, [ebp + 0x20]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x1a4]
call fcn.00403fc0
lea eax, [ebp + 0x20]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x18c]
call fcn.00403fc0
xor eax, eax
mov byte [ebp - 4], 5
mov word [ebp - 0x1c], ax
lea ecx, [ebp - 0x1a]
lea eax, [ebp - 0xd]
mov dword [ebp - 0x44], 0
push eax
push ecx
lea edx, [ebp - 0x34]
mov dword [ebp - 0x34], 0x41005c
push edx
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x30], 0x700070
mov dword [ebp - 0x2c], 0x69006c
mov dword [ebp - 0x28], 0x610063
mov dword [ebp - 0x24], 0x690074
mov dword [ebp - 0x20], 0x6e006f
call fcn.00404100
push dword [eax]
lea ecx, [ebp - 0x1bc]
mov byte [ebp - 4], 6
call fcn.0040beb0
cmp dword [eax + 0x14], 8
jb 0x409d61
mov eax, dword [eax]
lea ecx, [ebp - 0x88]
push ecx
lea ecx, [ebp - 0x44]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 5
mov esi, eax
call fcn.0040bc60
test esi, esi
jne 0x40aaaa
xor eax, eax
mov dword [ebp - 0xc4], 0x410020
mov word [ebp - 0xb4], ax
lea ecx, [ebp - 0xb2]
mov word [ebp - 0xdc], ax
lea edx, [ebp - 0xc4]
mov word [ebp - 0x90], ax
lea eax, [ebp - 0xd]
push eax
push ecx
push edx
lea ecx, [ebp - 0x174]
mov dword [ebp - 0xc0], 0x740075
mov dword [ebp - 0xbc], 0x6f0068
mov dword [ebp - 0xb8], 0x730072
mov dword [ebp - 0xf0], 0x500047
mov dword [ebp - 0xec], 0x200054
mov dword [ebp - 0xe8], 0x680043
mov dword [ebp - 0xe4], 0x6f0072
mov dword [ebp - 0xe0], 0x65006d
mov dword [ebp - 0x98], 0x680054
mov dword [ebp - 0x94], 0x200065
call fcn.00404100
mov edi, eax
lea eax, [ebp - 0xd]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0xda]
push ecx
lea edx, [ebp - 0xf0]
push edx
lea ecx, [ebp - 0x168]
call fcn.00404100
mov esi, dword [eax]
mov byte [ebp - 4], 8
call fcn.004056c0
mov ecx, eax
test ecx, ecx
je 0x40aaf3
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
push esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 9
call fcn.00404ac0
test al, al
jne 0x409ebc
test esi, esi
jne 0x409e9e
xor ecx, ecx
jmp 0x409eb2
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409ea3
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x14]
call fcn.00406790
lea eax, [ebp - 0xd]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x8e]
push ecx
lea edx, [ebp - 0x98]
push edx
lea ecx, [ebp - 0x15c]
call fcn.00404100
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xb
push ecx
push dword [eax]
lea eax, [ebp - 0x124]
push eax
call fcn.00404680
push dword [edi]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.004045b0
add esp, 0x18
mov edx, dword [ebp - 0x124]
or edi, 0xffffffff
mov byte [ebp - 4], 0xe
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x409f2d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x15c]
call fcn.0040bc60
mov edx, dword [ebp - 0x14]
mov eax, edi
mov byte [ebp - 4], 0x10
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x409f56
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x168]
call fcn.0040bc60
lea ecx, [ebp - 0x174]
mov byte [ebp - 4], 0x12
call fcn.0040bc60
xor eax, eax
mov dword [ebp - 0x40], 0x700041
mov word [ebp - 0x1c], ax
lea ecx, [ebp - 0x1a]
lea eax, [ebp - 0xd]
mov dword [ebp - 0x3c], 0x6c0070
push eax
push ecx
lea edx, [ebp - 0x40]
mov dword [ebp - 0x38], 0x630069
push edx
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x34], 0x740061
mov dword [ebp - 0x30], 0x6f0069
mov dword [ebp - 0x2c], 0x43006e
mov dword [ebp - 0x28], 0x6d006f
mov dword [ebp - 0x24], 0x610070
mov dword [ebp - 0x20], 0x79006e
call fcn.00404100
mov esi, dword [eax]
mov byte [ebp - 4], 0x13
call fcn.004056c0
mov ecx, eax
test ecx, ecx
je 0x40aafd
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
push esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x14
call fcn.00404ac0
test al, al
jne 0x40a029
test esi, esi
jne 0x40a007
xor ecx, ecx
jmp 0x40a01f
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a010
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x14]
call fcn.00406790
mov eax, dword [ebp - 0x84]
mov esi, dword [ebp - 0x14]
mov byte [ebp - 4], 0x13
mov ecx, dword [eax - 0xc]
lea ecx, [ecx*2 + 2]
push ecx
push eax
push 1
push 0
push esi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40a067
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x12
call fcn.0040bc60
call fcn.004056c0
mov ecx, eax
test ecx, ecx
je 0x40ab07
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
push 0x536a60
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x15
call fcn.00404ac0
test al, al
jne 0x40a0b6
push 5
push 0x536a60
lea ecx, [ebp - 0x14]
call fcn.00406790
xor eax, eax
mov byte [ebp - 4], 0x16
mov word [ebp - 0x54], ax
lea ecx, [ebp - 0x52]
lea eax, [ebp - 0xd]
mov dword [ebp - 0x80], 0x700041
push eax
push ecx
lea edx, [ebp - 0x80]
mov dword [ebp - 0x7c], 0x6c0070
push edx
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x78], 0x630069
mov dword [ebp - 0x74], 0x740061
mov dword [ebp - 0x70], 0x6f0069
mov dword [ebp - 0x6c], 0x44006e
mov dword [ebp - 0x68], 0x730065
mov dword [ebp - 0x64], 0x720063
mov dword [ebp - 0x60], 0x700069
mov dword [ebp - 0x5c], 0x690074
mov dword [ebp - 0x58], 0x6e006f
call fcn.00404100
mov esi, dword [eax]
mov byte [ebp - 4], 0x17
call fcn.004056c0
mov ecx, eax
test ecx, ecx
je 0x40ab11
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x18
call fcn.00404ac0
test al, al
jne 0x40a17d
test esi, esi
jne 0x40a15f
xor ecx, ecx
jmp 0x40a173
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a164
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x18]
call fcn.00406790
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
mov byte [ebp - 4], 0x17
mov ecx, dword [eax - 0xc]
lea ecx, [ecx*2 + 2]
push ecx
push eax
push 1
push 0
push esi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40a1b8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x16
call fcn.0040bc60
cmp dword [ebp + 0x1c], 8
lea esi, [ebp + 8]
cmovae esi, dword [ebp + 8]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40a1d5
sub esi, ecx
mov dword [ebp - 0x38], 0x700041
lea eax, [ebp - 0xd]
sar esi, 1
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x34], 0x6c0070
push ecx
lea edx, [ebp - 0x38]
mov dword [ebp - 0x30], 0x630069
push edx
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x2c], 0x740061
mov dword [ebp - 0x28], 0x6f0069
mov dword [ebp - 0x24], 0x49006e
mov dword [ebp - 0x20], 0x6f0063
mov dword [ebp - 0x1c], 0x6e
call fcn.00404100
mov eax, dword [eax]
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x48], eax
call fcn.004056c0
mov ecx, eax
test ecx, ecx
je 0x40ab1b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
push dword [ebp - 0x48]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x1a
call fcn.00404ac0
test al, al
jne 0x40a29a
mov edx, dword [ebp - 0x48]
test edx, edx
jne 0x40a276
xor ecx, ecx
jmp 0x40a290
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x50], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a280
sub ecx, dword [ebp - 0x50]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x18]
call fcn.00406790
cmp dword [ebp + 0x1c], 8
lea eax, [esi*2 + 2]
mov esi, dword [ebp - 0x18]
lea ecx, [ebp + 8]
cmovae ecx, dword [ebp + 8]
push eax
push ecx
push 1
push 0
push esi
push dword [ebp - 0x44]
mov byte [ebp - 4], 0x19
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40a2da
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x16
call fcn.0040bc60
xor eax, eax
mov dword [ebp - 0x108], 0x500047
mov word [ebp - 0xf4], ax
lea ecx, [ebp - 0xf2]
lea eax, [ebp - 0xd]
mov dword [ebp - 0x104], 0x200054
push eax
push ecx
lea edx, [ebp - 0x108]
mov dword [ebp - 0x100], 0x680043
push edx
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0xfc], 0x6f0072
mov dword [ebp - 0xf8], 0x65006d
call fcn.00404100
mov esi, dword [eax]
mov byte [ebp - 4], 0x1b
call fcn.004056c0
mov ecx, eax
test ecx, ecx
je 0x40ab25
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x1c
call fcn.00404ac0
test al, al
jne 0x40a39a
test esi, esi
jne 0x40a37c
xor ecx, ecx
jmp 0x40a390
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a381
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x18]
call fcn.00406790
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x1e
call fcn.0040bc60
lea eax, [ebp - 0xd]
mov dword [ebp - 0x38], 0x700041
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x34], 0x6c0070
push ecx
lea edx, [ebp - 0x38]
mov dword [ebp - 0x30], 0x630069
push edx
lea ecx, [ebp - 0x138]
mov dword [ebp - 0x2c], 0x740061
mov dword [ebp - 0x28], 0x6f0069
mov dword [ebp - 0x24], 0x4e006e
mov dword [ebp - 0x20], 0x6d0061
mov dword [ebp - 0x1c], 0x65
call fcn.00404100
mov esi, dword [eax]
mov byte [ebp - 4], 0x1f
call fcn.004056c0
mov ecx, eax
test ecx, ecx
je 0x40ab2f
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4c], eax
push esi
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x20
call fcn.00404ac0
test al, al
jne 0x40a459
test esi, esi
jne 0x40a433
xor ecx, ecx
jmp 0x40a44f
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a440
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x4c]
call fcn.00406790
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x4c]
mov byte [ebp - 4], 0x1f
mov ecx, dword [eax - 0xc]
lea ecx, [ecx*2 + 2]
push ecx
push eax
push 1
push 0
push esi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40a494
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 0x1e
call fcn.0040bc60
lea eax, [ebp - 0xd]
mov dword [ebp - 0xd8], 0x530054
push eax
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0xd4], 0x720042
push ecx
lea edx, [ebp - 0xd8]
mov dword [ebp - 0xd0], 0x77006f
push edx
lea ecx, [ebp - 0x138]
mov dword [ebp - 0xcc], 0x650073
mov dword [ebp - 0xc8], 0x72
call fcn.00404100
mov esi, dword [eax]
mov byte [ebp - 4], 0x21
call fcn.004056c0
mov ecx, eax
test ecx, ecx
je 0x40ab39
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4c], eax
push esi
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x22
call fcn.00404ac0
test al, al
jne 0x40a54b
test esi, esi
jne 0x40a52d
xor ecx, ecx
jmp 0x40a541
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a532
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x4c]
call fcn.00406790
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 0x24
call fcn.0040bc60
xor eax, eax
mov dword [ebp - 0x38], 0x700041
mov word [ebp - 0x1c], ax
lea ecx, [ebp - 0x1a]
lea eax, [ebp - 0xd]
mov dword [ebp - 0x34], 0x550070
push eax
push ecx
lea edx, [ebp - 0x38]
mov dword [ebp - 0x30], 0x650073
push edx
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x2c], 0x4d0072
mov dword [ebp - 0x28], 0x64006f
mov dword [ebp - 0x24], 0x6c0065
mov dword [ebp - 0x20], 0x640049
call fcn.00404100
mov esi, dword [eax]
mov byte [ebp - 4], 0x25
call fcn.004056c0
mov ecx, eax
test ecx, ecx
je 0x40ab43
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x48], eax
push esi
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x26
call fcn.00404ac0
test al, al
jne 0x40a609
test esi, esi
jne 0x40a5e3
xor ecx, ecx
jmp 0x40a5ff
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a5f0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x48]
call fcn.00406790
mov edi, dword [ebp - 0x4c]
mov esi, dword [ebp - 0x48]
mov byte [ebp - 4], 0x25
mov eax, dword [edi - 0xc]
lea eax, [eax*2 + 2]
push eax
push edi
push 1
push 0
push esi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40a645
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x24
call fcn.0040bc60
xor eax, eax
mov dword [ebp - 0x34], 0x44005c
mov word [ebp - 0x1c], ax
lea ecx, [ebp - 0x1a]
lea eax, [ebp - 0xd]
mov dword [ebp - 0x30], 0x660065
push eax
push ecx
lea edx, [ebp - 0x34]
mov dword [ebp - 0x2c], 0x750061
push edx
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x28], 0x74006c
mov dword [ebp - 0x24], 0x630049
mov dword [ebp - 0x20], 0x6e006f
call fcn.00404100
push dword [eax]
lea ecx, [ebp - 0x1a4]
mov byte [ebp - 4], 0x27
call fcn.0040beb0
cmp dword [eax + 0x14], 8
jb 0x40a6b4
mov eax, dword [eax]
lea ecx, [ebp - 0x88]
push ecx
lea ecx, [ebp - 0x44]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x24
mov esi, eax
call fcn.0040bc60
test esi, esi
jne 0x40aa31
mov esi, dword [ebp + 0x1c]
lea edx, [ebp + 8]
cmp esi, 8
cmovae edx, dword [ebp + 8]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x40a701
sub edx, ecx
lea ecx, [ebp + 8]
sar edx, 1
cmp esi, 8
cmovae ecx, dword [ebp + 8]
lea eax, [edx*2 + 2]
push eax
push ecx
push 1
push 0
push 0x536970
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0xd]
mov dword [ebp - 0x40], 0x73005c
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x3c], 0x650068
push ecx
lea edx, [ebp - 0x40]
mov dword [ebp - 0x38], 0x6c006c
push edx
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x34], 0x6f005c
mov dword [ebp - 0x30], 0x650070
mov dword [ebp - 0x2c], 0x5c006e
mov dword [ebp - 0x28], 0x6f0063
mov dword [ebp - 0x24], 0x6d006d
mov dword [ebp - 0x20], 0x6e0061
mov dword [ebp - 0x1c], 0x64
call fcn.00404100
push dword [eax]
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 0x28
call fcn.0040beb0
cmp dword [eax + 0x14], 8
jb 0x40a7ab
mov eax, dword [eax]
lea ecx, [ebp - 0x88]
push ecx
lea ecx, [ebp - 0x44]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x24
mov esi, eax
call fcn.0040bc60
test esi, esi
jne 0x40aa31
lea eax, [ebp - 0xd]
mov dword [ebp - 0x80], 0x2d0020
push eax
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x7c], 0x73002d
push ecx
lea edx, [ebp - 0x80]
mov dword [ebp - 0x78], 0x6e0069
push edx
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x74], 0x6c0067
mov dword [ebp - 0x70], 0x2d0065
mov dword [ebp - 0x6c], 0x720061
mov dword [ebp - 0x68], 0x750067
mov dword [ebp - 0x64], 0x65006d
mov dword [ebp - 0x60], 0x74006e
mov dword [ebp - 0x5c], 0x250020
mov dword [ebp - 0x58], 0x31
call fcn.00404100
mov dword [ebp - 0x8c], eax
mov edx, dword [ebp + 0x48]
mov ecx, bind
sub ecx, edx
mov byte [ebp - 4], 0x29
mov dword [ebp - 0x50], edx
cmp ecx, 1
jb 0x40ab4d
cmp dword [ebp + 0x4c], 8
lea eax, [ebp + 0x38]
mov dword [ebp - 0x110], esi
lea ecx, [edx + 1]
cmovae eax, dword [ebp + 0x38]
xorps xmm0, xmm0
mov dword [ebp - 0x10c], esi
mov esi, 7
mov dword [ebp - 0x12c], eax
lea eax, [ebp - 0x120]
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x48], eax
movups xmmword [ebp - 0x120], xmm0
cmp ecx, esi
jbe 0x40a8ed
mov esi, ecx
or esi, 7
cmp esi, 0x7ffffffe
jbe 0x40a8c2
mov esi, bind
jmp 0x40a8cc
mov eax, 0xa
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x120]
call fcn.00403670
mov ecx, dword [ebp - 0x128]
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x110], ecx
mov ecx, 0x22
mov dword [ebp - 0x10c], esi
mov word [eax], cx
lea ecx, [eax + 2]
lea eax, [edx + edx]
push eax
push dword [ebp - 0x12c]
push ecx
call fcn.005039a0
mov eax, dword [ebp - 0x48]
xor edx, edx
mov ecx, dword [ebp - 0x50]
mov word [eax + ecx*2 + 2], dx
push 0x536a34
lea eax, [ebp - 0x120]
mov byte [ebp - 4], 0x2a
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00403730
mov ecx, dword [ebp - 0x8c]
mov byte [ebp - 4], 0x2b
push dword [ecx]
push eax
lea eax, [ebp - 0x150]
push eax
call fcn.00403730
add esp, 0x24
lea ecx, [ebp - 0x30]
call fcn.00403120
mov ecx, dword [ebp - 0x10c]
mov byte [ebp - 4], 0x29
cmp ecx, 8
jb 0x40a9a2
mov edx, dword [ebp - 0x120]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40a998
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ab52
push ecx
push edx
call fcn.00500c7f
add esp, 8
xor eax, eax
mov dword [ebp - 0x110], 0
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x10c], 7
mov word [ebp - 0x120], ax
call fcn.0040bc60
mov esi, dword [ebp - 0x13c]
lea edx, [ebp - 0x150]
cmp esi, 8
cmovae edx, dword [ebp - 0x150]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x40a9e3
sub edx, ecx
lea ecx, [ebp - 0x150]
sar edx, 1
cmp esi, 8
cmovae ecx, dword [ebp - 0x150]
lea eax, [edx*2 + 2]
push eax
push ecx
push 1
push 0
push 0x536970
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x150]
call fcn.00403120
or esi, 0xffffffff
mov byte [ebp - 4], 0x1e
mov eax, esi
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x40aa4f
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x18]
mov eax, esi
add edx, 0xfffffff0
mov byte [ebp - 4], 0x16
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40aa6d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
mov eax, esi
add edx, 0xfffffff0
mov byte [ebp - 4], 0x12
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40aa8b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x84]
add edx, 0xfffffff0
mov byte [ebp - 4], 5
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x40aaaa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x18c]
call fcn.00403120
lea ecx, [ebp - 0x1a4]
call fcn.00403120
lea ecx, [ebp - 0x1bc]
call fcn.00403120
lea ecx, [ebp + 8]
call fcn.00403120
lea ecx, [ebp + 0x20]
call fcn.00403120
lea ecx, [ebp + 0x38]
call fcn.00403120
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404a90
push 0x80004005
call fcn.00404a90
push 0x80004005
call fcn.00404a90
push 0x80004005
call fcn.00404a90
push 0x80004005
call fcn.00404a90
push 0x80004005
call fcn.00404a90
push 0x80004005
call fcn.00404a90
push 0x80004005
call fcn.00404a90
push 0x80004005
call fcn.00404a90
call fcn.00402980
call fcn.00507f1f
int3