Function at 0x4136c0
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52e174
mov eax, dword fs:[0]
push eax
sub esp, 0x2e8
mov eax, dword [0x57a438]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x264], edi
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x2f4]
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x220], 0
push edx
mov ecx, dword [eax + 0x108]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.0042d530
push eax
lea ecx, [ebp - 0x220]
call fcn.00406cc0
lea ecx, [ebp - 0x2f4]
mov byte [ebp - 4], 2
call fcn.00416ed0
mov eax, dword [ebp - 0x220]
mov edx, str.closebtn
mov ecx, eax
mov si, word [ecx]
cmp si, word [edx]
jne 0x413777
test si, si
je 0x413773
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x413777
add ecx, 4
add edx, 4
test si, si
jne 0x413751
xor ecx, ecx
jmp 0x41377c
sbb ecx, ecx
or ecx, 1
or ebx, 0xffffffff
test ecx, ecx
jne 0x413842
cmp dword [edi + 0x31c], 1
je 0x413d7a
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x268], esp
mov dword [eax + 0x24], ecx
mov byte [ebp - 4], 3
xor eax, eax
mov dword [ebp - 0x254], 0x6c0063
mov dword [ebp - 0x250], 0x630069
mov dword [ebp - 0x24c], 0x5f006b
mov dword [ebp - 0x248], 0x780065
mov dword [ebp - 0x244], 0x740069
mov word [ebp - 0x240], ax
call fcn.00407b40
push eax
push 0xa
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x264]
call fcn.004070e0
mov byte [ebp - 4], 4
mov esi, dword [ebp - 0x264]
push 0
push 0
push 1
push 0
push esi
call fcn.004157c0
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.004aac80
mov byte [ebp - 4], 2
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x413d67
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x413d67
mov dword [ebp - 0x258], 0x740062
mov dword [ebp - 0x254], 0x5f006e
mov dword [ebp - 0x250], 0x6e0075
mov dword [ebp - 0x24c], 0x6e0069
mov dword [ebp - 0x248], 0x740073
mov dword [ebp - 0x244], 0x6c0061
mov dword [ebp - 0x240], 0x6c
call fcn.00407b40
push eax
push 0xd
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x21c]
call fcn.004070e0
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x413e78
mov ecx, dword [ebp - 0x220]
mov edx, eax
mov si, word [ecx]
cmp si, word [edx]
jne 0x4138de
test si, si
je 0x4138da
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x4138de
add ecx, 4
add edx, 4
test si, si
jne 0x4138b8
xor esi, esi
jmp 0x4138e3
sbb esi, esi
or esi, 1
lea edx, [eax - 0x10]
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4138fa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
jne 0x41390a
mov ecx, edi
call fcn.004144a0
jmp 0x413d67
xor eax, eax
mov dword [ebp - 0x258], 0x740062
mov dword [ebp - 0x254], 0x5f006e
mov dword [ebp - 0x250], 0x650066
mov dword [ebp - 0x24c], 0x640065
mov dword [ebp - 0x248], 0x610062
mov dword [ebp - 0x244], 0x6b0063
mov word [ebp - 0x240], ax
call fcn.00407b40
push eax
push 0xc
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x23c]
call fcn.004070e0
lea edx, [ebp - 0x23c]
lea ecx, [ebp - 0x220]
call fcn.00416d30
mov edx, dword [ebp - 0x23c]
mov ecx, ebx
mov byte [ebp - 0x235], al
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4139a3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov al, byte [ebp - 0x235]
test al, al
je 0x413db4
call fcn.00407b40
mov ecx, eax
test ecx, ecx
je 0x413e82
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x234], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0
call fcn.00427740
push 0x208
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 7
push 0
push eax
call fcn.004fecc0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
xor eax, eax
mov dword [ebp - 0x260], 0x690057
mov dword [ebp - 0x25c], 0x4f006e
mov dword [ebp - 0x258], 0x740070
mov dword [ebp - 0x254], 0x6d0069
mov dword [ebp - 0x250], 0x7a0069
mov dword [ebp - 0x24c], 0x720065
mov dword [ebp - 0x248], 0x65002e
mov dword [ebp - 0x244], 0x650078
mov word [ebp - 0x240], ax
call fcn.00407b40
push eax
push 0x10
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x224]
call fcn.004070e0
mov esi, dword [ebp - 0x224]
lea eax, [ebp - 0x218]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x413aba
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00407b40
mov ecx, eax
test ecx, ecx
je 0x413e8c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x23c]
call fcn.00406cc0
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 9
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.0040d8c0
mov byte [ebp - 4], 8
add esp, 8
mov edx, dword [ebp - 0x23c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413b28
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x268]
push eax
call fcn.004151f0
mov edi, eax
mov byte [ebp - 4], 0xa
cmp word [0x587d68], 0
jne 0x413bd6
push str.ntdll.dll
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x413bb2
push str.RtlGetNtVersionNumbers
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x413bab
lea ecx, [ebp - 0x228]
push ecx
lea ecx, [ebp - 0x22c]
push ecx
lea ecx, [ebp - 0x230]
push ecx
call eax
movzx eax, word [ebp - 0x228]
mov dword [ebp - 0x228], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 0x22c]
push dword [ebp - 0x230]
push 0x5611bc
push 0x104
push 0x587d68
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
call fcn.00407b40
mov ecx, eax
test ecx, ecx
je 0x413e96
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x23c], eax
push 0x587d68
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0xb
call fcn.00406e80
test al, al
jne 0x413c33
mov ecx, 0x587d68
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413c13
sub ecx, edx
sar ecx, 1
push ecx
push 0x587d68
lea ecx, [ebp - 0x23c]
call fcn.00406d90
lea eax, [ebp - 0x26c]
mov byte [ebp - 4], 0xc
push eax
call fcn.00413eb0
mov byte [ebp - 4], 0xd
push dword [edi]
mov esi, dword [ebp - 0x23c]
mov edi, dword [ebp - 0x224]
mov ebx, dword [eax]
push esi
push edi
call fcn.00415710
mov ecx, eax
call fcn.004a9630
push eax
call fcn.00415710
mov ecx, eax
call fcn.004a9650
push eax
call fcn.00415710
mov ecx, eax
call fcn.004a9b20
push eax
lea eax, [ebp - 0x234]
push ebx
push eax
call fcn.00407210
mov byte [ebp - 4], 0xc
or ebx, 0xffffffff
mov edx, dword [ebp - 0x26c]
add esp, 0x20
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413cb4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xa
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x413ccf
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 8
mov eax, ebx
mov edx, dword [ebp - 0x268]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413cf0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x234]
push 1
push 0
push 0
push esi
push 0x560838
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], 7
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x413d25
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 6
mov eax, ebx
mov edx, dword [ebp - 0x21c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x413d46
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x413d61
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x264]
push dword [ebp - 0x270]
mov ecx, edi
call fcn.00438eb0
mov eax, dword [ebp - 0x220]
mov dword [ebp - 4], 0xffffffff
lea edx, [eax - 0x10]
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x413d96
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ac694
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 0x260], 0x740062
mov dword [ebp - 0x25c], 0x5f006e
mov dword [ebp - 0x258], 0x6e0075
mov dword [ebp - 0x254], 0x6e0069
mov dword [ebp - 0x250], 0x740073
mov dword [ebp - 0x24c], 0x6c0061
mov dword [ebp - 0x248], 0x5f006c
mov dword [ebp - 0x244], 0x6e0065
mov dword [ebp - 0x240], 0x64
call fcn.00407b40
push eax
push 0x11
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x21c]
call fcn.004070e0
lea edx, [ebp - 0x21c]
lea ecx, [ebp - 0x220]
call fcn.00416d30
mov edx, dword [ebp - 0x21c]
mov ecx, ebx
mov byte [ebp - 0x235], al
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x413e62
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov al, byte [ebp - 0x235]
test al, al
je 0x413d67
push 1
mov ecx, edi
call fcn.00439890
jmp 0x413d67
push 0x80004005
call fcn.00407c80
push 0x80004005
call fcn.00407c80
push 0x80004005
call fcn.00407c80
push 0x80004005
call fcn.00407c80
int3