Function at 0x40946c
Capabilities:
Accept command line arguments
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ecx, 0x22
xor eax, eax
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x4ca]
mov esi, str.FVk_
push ebx
sub esp, 0x58c
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x4e4]
mov esi, 0x42e296
mov ecx, 0x1a
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0x318], al
inc eax
cmp eax, 0x100
jne 0x40949e
mov eax, dword [0x4297bc]
xor esi, esi
xor ebx, ebx
or eax, 0x28cb83bb
xor eax, 0xec3f226f
mov dword [0x4297bc], eax
mov dword [esp], str.A_global_group_cannot_have_a_universal_group_as_a_member.
mov edi, 0x19
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
push eax
mov eax, ebx
mov cl, byte [ebp + ebx - 0x318]
div edi
movzx eax, byte [ebp + edx - 0x4e4]
movzx edx, cl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x318]
mov byte [ebp + ebx - 0x318], al
inc ebx
mov byte [ebp + esi - 0x318], cl
cmp ebx, 0x100
jne 0x4094c5
mov edx, 0x429f00
mov ecx, 0x26
movzx eax, byte [edx]
inc edx
test al, al
je 0x409550
add ecx, eax
cmp ecx, 0x7e3
jbe 0x40951f
mov eax, dword [0x4297bc]
mov dword [esp], 0x429f00
mov dword [esp + 4], eax
call fcn.00411e2c
sub dword [0x4297bc], 0x367137fa
imul eax, dword [0x4297bc], 0xba83417c
xor edi, edi
xor esi, esi
xor ebx, ebx
sub eax, 0x7ce29d18
mov dword [0x4297bc], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.SDB_compression_algorithm_does_not_match_callback_algorithm.
mov dword [esp + 4], eax
mov dword [esp], eax
call fcn.00413e44
add dword [0x4297bc], 0x431f7727
inc ebx
movzx ebx, bl
mov cl, byte [ebp + ebx - 0x318]
lea eax, [ecx + esi]
movzx esi, al
mov al, byte [ebp + esi - 0x318]
mov byte [ebp + ebx - 0x318], al
mov byte [ebp + esi - 0x318], cl
add cl, byte [ebp + ebx - 0x318]
movzx ecx, cl
cmp byte [0x429f00], 0
mov al, byte [ebp + ecx - 0x318]
mov byte [ebp - 0x55c], al
je 0x4095e1
call fcn.00414f1c
xor dword [0x4297bc], 0x41e663f2
call fcn.0040fe70
imul eax, dword [0x4297bc], 0xca72fb73
and eax, 0x6fa59942
mov dword [0x4297bc], eax
mov dword [esp + 8], 0x429f00
mov dword [esp + 4], str.Access_to_the_HTTP_proxy_is_denied.
mov dword [esp], eax
call fcn.00414540
mov al, byte [ebp - 0x55c]
xor al, byte [ebp + edi - 0x4ca]
movzx eax, al
mov word [ebp + edi*2 - 0x3f4], ax
inc edi
cmp edi, 0x22
jne 0x409582
sub dword [0x4297bc], 0x3de29388
call dword [sym.imp.USER32.dll_GetDesktopWindow]
and eax, 0xa604e7b
sub eax, 0x31f9de72
mov dword [0x4297bc], eax
call fcn.004139cc
xor edx, edx
cmp byte [edx + 0x429f00], 0
je 0x40967d
inc edx
cmp edx, 0xdbc
jne 0x40965a
call fcn.00410648
xor dword [0x4297bc], 0xba78a293
jmp 0x40968f
mov eax, dword [0x4297bc]
or eax, 0xc8c66e46
cmp edx, 0x134
jle 0x4096b6
mov eax, dword [0x4297bc]
mov dword [esp + 4], str.Access_to_the_HTTP_proxy_is_denied.
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp], eax
call fcn.00413b84
mov eax, dword [0x4297bc]
sub eax, 0x7966c9a6
xor eax, 0xd2c43b0f
lea edi, [ebp - 0x4f7]
mov esi, 0x42e2b0
mov dword [0x4297bc], eax
mov dword [esp + 8], str.SDB_compression_algorithm_does_not_match_callback_algorithm.
mov dword [esp + 4], str.Access_to_the_HTTP_proxy_is_denied.
mov dword [esp], str.SDB_compression_algorithm_does_not_match_callback_algorithm.
call fcn.0040eec8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, 0x13
xor eax, eax
mov word [ebp - 0x3b0], 0
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x459]
mov esi, str.The_Platform_Manifest_file_was_not_valid.
mov ecx, 0x2a
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0x218], al
inc eax
cmp eax, 0x100
jne 0x409711
xor eax, eax
cmp word [eax + str.SDB_compression_algorithm_does_not_match_callback_algorithm.], 0
je 0x409746
add eax, 2
cmp eax, 0x26e2
jne 0x409722
add dword [0x4297bc], 0x7066cfe5
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
imul ebx, dword [0x4297bc], 0x29b76a48
mov edx, 0x429f00
mov ecx, 0x15d9
mov dword [0x4297bc], ebx
movzx eax, byte [edx]
inc edx
test al, al
je 0x40978c
add ecx, eax
cmp ecx, 0x264b
jbe 0x409760
mov dword [esp + 4], ebx
mov dword [esp], str.Access_to_the_HTTP_proxy_is_denied.
call fcn.00411e2c
sub dword [0x4297bc], 0x652c57a6
mov eax, dword [0x4297bc]
xor edi, edi
xor esi, esi
add eax, 0x3d306635
xor eax, 0xc64b2297
mov dword [0x4297bc], eax
call fcn.00413240
mov edx, dword [0x4297bc]
lea eax, [edx + 0x1dbb436c]
mov dword [0x4297bc], eax
xor eax, eax
cmp word [eax + str.SDB_compression_algorithm_does_not_match_callback_algorithm.], 0
je 0x4097e2
add eax, 2
cmp eax, 0x1de8
jne 0x4097bc
sub edx, 0x43bf7384
mov dword [0x4297bc], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
imul ebx, dword [0x4297bc], 0xec7ab04b
xor edx, edx
mov cl, byte [ebp + esi - 0x218]
lea eax, [ebx + 0x650175c0]
mov ebx, 0x29
mov dword [ebp - 0x55c], eax
mov dword [0x4297bc], eax
mov eax, esi
div ebx
mov al, byte [ebp + edx - 0x459]
add eax, ecx
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x218]
mov byte [ebp + esi - 0x218], al
inc esi
mov byte [ebp + edi - 0x218], cl
cmp esi, 0x100
jne 0x4097a9
xor esi, esi
xor ecx, ecx
xor edx, edx
inc edx
movzx edx, dl
mov al, byte [ebp + edx - 0x218]
add ecx, eax
movzx ecx, cl
mov bl, byte [ebp + ecx - 0x218]
mov byte [ebp + edx - 0x218], bl
imul ebx, dword [ebp - 0x55c], 0x6e0dc159
mov byte [ebp + ecx - 0x218], al
add al, byte [ebp + edx - 0x218]
movzx eax, al
mov al, byte [ebp + eax - 0x218]
xor al, byte [esi + ebp - 0x4f7]
mov dword [ebp - 0x55c], ebx
movzx eax, al
mov word [ebp + esi*2 - 0x4a8], ax
inc esi
cmp esi, 0x13
jne 0x409845
lea edi, [ebp - 0x481]
mov esi, 0x42e2ed
cmp byte [0x429f00], 0
mov word [ebp - 0x482], 0
mov ecx, 0xa
mov dword [0x4297bc], ebx
rep movsd dword es:[edi], dword [esi]
je 0x4098d9
sub ebx, 0x395f7453
mov dword [0x4297bc], ebx
lea edi, [ebp - 0x42f]
mov esi, str.Getting_the_shim_engine_exports_failed_with_status_0x_08lx
mov ecx, 0x3b
mov eax, dword [0x4297bc]
rep movsb byte es:[edi], byte [esi]
add eax, 0x3edc7da4
or eax, 0x18951b6b
mov dword [0x4297bc], eax
xor eax, eax
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x409901
xor edi, edi
xor ecx, ecx
mov esi, 0x3a
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x118]
div esi
movzx eax, byte [ebp + edx - 0x42f]
movzx edx, bl
add eax, edx
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x118]
mov byte [ebp + ecx - 0x118], al
inc ecx
mov byte [ebp + edi - 0x118], bl
cmp ecx, 0x100
jne 0x409919
xor edi, edi
xor esi, esi
xor ebx, ebx
inc ebx
movzx ebx, bl
mov cl, byte [ebp + ebx - 0x118]
lea eax, [ecx + esi]
movzx esi, al
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ebx - 0x118], al
mov byte [ebp + esi - 0x118], cl
add cl, byte [ebp + ebx - 0x118]
movzx ecx, cl
mov al, byte [ebp + ecx - 0x118]
mov byte [ebp - 0x55c], al
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
or dword [0x4297bc], 0x86115080
mov dword [esp], 0x1b4f
call dword [sym.imp.KERNEL32.dll_SetLastError]
push eax
mov eax, dword [0x4297bc]
or eax, 0x9a851052
mov dword [0x4297bc], eax
mov dword [esp], eax
call fcn.00411dd4
mov al, byte [ebp - 0x55c]
xor al, byte [ebp + edi - 0x481]
movzx eax, al
mov word [ebp + edi*2 - 0x368], ax
inc edi
cmp edi, 0x28
jne 0x40995c
xor eax, eax
cmp byte [eax + str.Access_to_the_HTTP_proxy_is_denied.], 0
je 0x409a12
inc eax
cmp eax, 0xcc9
jne 0x4099f2
imul eax, dword [0x4297bc], 0x1bcc214d
mov dword [0x4297bc], eax
mov eax, dword [0x4297bc]
mov ecx, str.Access_to_the_HTTP_proxy_is_denied.
mov ebx, 0x85d
mov word [ebp - 0x318], 0
sub eax, 0x2c191d53
xor eax, 0x1aa18719
and eax, 0xf55543d4
or eax, 0x6d5383cc
imul eax, eax, 0x9cfd9a0f
add eax, 0xacbfb6b
xor eax, 0x87708374
movsx edx, byte [ecx]
test dl, dl
je 0x409aaa
add ebx, edx
cmp ebx, 0x1a66
jbe 0x409a9d
xor eax, 0xce0691d5
mov dword [0x4297bc], eax
call fcn.004146d4
mov eax, dword [0x4297bc]
xor eax, 0xcda283c5
add eax, 0x24b5f58c
mov dword [0x4297bc], eax
call fcn.00410648
mov eax, dword [0x4297bc]
xor eax, 0x7f6d1555
or eax, 0x4bd41e69
add eax, 0x33539747
jmp 0x409aaf
or eax, 0x211c8a25
inc ecx
add eax, 0x765c516a
jmp 0x409a4e
add eax, 0x5ff94393
xor eax, 0xf644126f
lea edi, [ebp - 0x528]
mov esi, 0x416194
mov dword [0x4297bc], eax
call fcn.00410648
mov eax, dword [0x4297bc]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 0x14
and eax, 0xcb4d98d
or eax, 0x34dfe9ed
imul eax, eax, 0xe51bb11a
mov dword [0x4297bc], eax
mov eax, dword [0x4297bc]
mov dword [esp + 8], str.SDB_compression_algorithm_does_not_match_callback_algorithm.
mov dword [esp + 0xc], eax
mov dword [esp + 4], eax
mov dword [esp], eax
call fcn.00413e44
mov eax, dword [0x4297bc]
xor eax, 0x7bd8c853
imul eax, eax, 0x58252b13
add eax, 0x16a1ce1b
mov dword [0x4297bc], eax
mov dword [esp + 8], 0x429f00
mov dword [esp + 4], str.SDB_compression_algorithm_does_not_match_callback_algorithm.
mov dword [esp], str.Access_to_the_HTTP_proxy_is_denied.
call fcn.0040fa60
mov eax, dword [0x4297bc]
add edi, dword [ebp + esi*4 - 0x528]
inc esi
mov dword [ebp - 0x55c], edi
xor eax, 0x711a2728
mov dword [0x4297bc], eax
cmp esi, 4
jne 0x409af1
sub eax, 0x2a12aa56
mov ecx, 0x429f00
mov dword [0x4297bc], eax
mov dl, byte [ecx]
test dl, dl
je 0x409b92
sub edx, 0x30
cmp dl, 9
jbe 0x409b8f
and eax, 0x71a60683
mov dword [0x4297bc], eax
jmp 0x409b92
inc ecx
jmp 0x409b75
mov eax, dword [0x4297bc]
mov esi, 0x112d
sub eax, 0x1958eaff
mov dword [0x4297bc], eax
mov dword [esp + 0xc], eax
mov dword [esp + 4], eax
mov dword [esp], eax
mov dword [esp + 8], str.SDB_compression_algorithm_does_not_match_callback_algorithm.
call fcn.00413e44
mov edx, dword [0x4297bc]
mov ecx, str.SDB_compression_algorithm_does_not_match_callback_algorithm.
imul eax, edx, 0x8a80ea66
mov dword [0x4297bc], eax
movzx eax, word [ecx]
add ecx, 2
test ax, ax
je 0x409c03
add esi, eax
cmp esi, 0x173c
jbe 0x409bd4
imul edx, edx, 0xf383ce08
mov dword [0x4297bc], edx
mov dword [esp], 0x1e87
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
mov eax, dword [0x4297bc]
and eax, 0xfe2f7841
or eax, 0x47654ae
mov dword [0x4297bc], eax
call fcn.00410648
mov eax, dword [0x4297bc]
add eax, 0x7a42a245
mov edx, eax
and edx, 0xbd0f2648
mov dword [0x4297bc], edx
xor edx, edx
cmp byte [edx + str.Access_to_the_HTTP_proxy_is_denied.], 0
je 0x409c52
inc edx
cmp edx, 0x19f2
jne 0x409c36
and eax, 0x85082200
mov dword [0x4297bc], eax
cmp byte [0x429f00], 0
je 0x409c72
mov eax, dword [0x4297bc]
mov dword [esp], eax
call fcn.00411dd4
add dword [0x4297bc], 0x224b5249
xor dword [0x4297bc], 0x1474c1a3
call fcn.00410550
imul eax, dword [0x4297bc], 0xf01165b5
mov dword [0x4297bc], eax
call fcn.00410550
cmp byte [0x429f00], 0
je 0x409ca8
or dword [0x4297bc], 0x86c8e303
mov eax, dword [0x4297bc]
mov dword [esp + 4], str.Access_to_the_HTTP_proxy_is_denied.
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp], eax
call fcn.00413b84
mov eax, dword [0x4297bc]
and eax, 0x664c103d
xor eax, 0xa261b0c6
mov dword [0x4297bc], eax
mov dword [esp + 8], str.SDB_compression_algorithm_does_not_match_callback_algorithm.
mov dword [esp + 4], 0x429f00
mov dword [esp], str.SDB_compression_algorithm_does_not_match_callback_algorithm.
call fcn.0040eec8
mov eax, dword [0x4297bc]
or eax, 0xba818768
xor eax, 0xead7016e
imul eax, eax, 0x1df5b04b
mov dword [0x4297bc], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.SDB_compression_algorithm_does_not_match_callback_algorithm.
mov dword [esp + 4], eax
mov dword [esp], eax
call fcn.00413e44
mov edx, 0x429f00
mov ecx, 0x709
movzx eax, byte [edx]
inc edx
test al, al
je 0x409d6a
add ecx, eax
cmp ecx, 0x209a
jbe 0x409d31
mov eax, dword [0x4297bc]
or eax, 0xf870a27d
mov dword [0x4297bc], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0x429f00
mov dword [esp], eax
call fcn.00413b84
mov eax, dword [0x4297bc]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
sub eax, 0x6063923c
and eax, 0x400c9898
or eax, 0x8808
mov dword [0x4297bc], eax
call esi
mov eax, dword [0x4297bc]
and eax, 0x66478608
add eax, 0x5068ac3b
and eax, 0xe565bbb
mov dword [0x4297bc], eax
call fcn.004139cc
xor eax, eax
cmp byte [eax + 0x429f00], 0
je 0x409dcb
inc eax
cmp eax, 0x10dc
jne 0x409dab
imul eax, dword [0x4297bc], 0xd733ad96
mov dword [0x4297bc], eax
mov eax, dword [0x4297bc]
and eax, 0x2a012a5e
add eax, 0x58ebb481
mov dword [0x4297bc], eax
call fcn.00410550
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov eax, dword [0x4297bc]
and eax, 0xb0171b07
sub eax, 0xeaca304
mov dword [0x4297bc], eax
call esi
imul eax, eax, 0x3a611b36
add eax, 0x31a94e8e
mov dword [0x4297bc], eax
mov dword [esp], eax
call fcn.00411dd4
cmp byte [0x429f00], 0
je 0x409e2b
add dword [0x4297bc], 0x21f2bbe0
mov eax, dword [0x4297bc]
mov ecx, 0x429f00
or eax, 0xabac1e7e
xor eax, 0xc2300043
mov dword [0x4297bc], eax
mov dl, byte [ecx]
test dl, dl
je 0x409e61
sub edx, 0x30
cmp dl, 9
jbe 0x409e5e
add eax, 0x1d79976a
mov dword [0x4297bc], eax
jmp 0x409e61
inc ecx
jmp 0x409e44
mov eax, dword [0x4297bc]
xor edx, edx
or eax, 0xe626b92
mov dword [0x4297bc], eax
cmp byte [edx + 0x429f00], 0
je 0x409e90
inc edx
cmp edx, 0xd46
jne 0x409e72
xor eax, 0x106be4e8
mov dword [0x4297bc], eax
jmp 0x409e98
cmp edx, 0x990
jle 0x409e9d
call fcn.00410550
mov eax, dword [0x4297bc]
sub eax, 0x569813c1
imul eax, eax, 0x866cd658
xor eax, 0x6c7d05c9
sub eax, 0x5f416572
and eax, 0xa0290325
sub eax, 0x727271af
and eax, 0x65b885e3
add eax, 0x3d6dd804
xor eax, 0x7e4aa76e
sub eax, 0x1a4efc5e
mov dword [0x4297bc], eax
mov dword [esp], 0x1d23
call dword [sym.imp.USER32.dll_GetLastActivePopup]
imul eax, eax, 0x8ecd7d69
push ecx
sub eax, 0x196ec2f2
cmp byte [0x429f00], 0
mov dword [0x4297bc], eax
je 0x409f0b
xor eax, 0x6a014953
mov dword [0x4297bc], eax
imul eax, dword [0x4297bc], 0x5e2ba1ef
mov ecx, 0x429f00
or eax, 0x49e0ed52
mov dword [0x4297bc], eax
mov dl, byte [ecx]
test dl, dl
je 0x409f42
sub edx, 0x30
cmp dl, 9
jbe 0x409f3f
imul eax, eax, 0xb275ae29
mov dword [0x4297bc], eax
jmp 0x409f42
inc ecx
jmp 0x409f24
mov eax, dword [0x4297bc]
mov esi, 0x6d3
xor eax, 0xba5c1a65
sub eax, 0x3c017d66
xor eax, 0x9b9da95f
sub eax, 0xea2437e
and eax, 0xe34abf8
mov dword [0x4297bc], eax
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push edx
sub dword [0x4297bc], 0x293822de
call fcn.0040fe70
mov eax, dword [0x4297bc]
sub eax, 0x53d0b1b6
or eax, 0x7f9eca49
mov dword [0x4297bc], eax
call fcn.004146d4
mov eax, dword [0x4297bc]
mov ecx, str.SDB_compression_algorithm_does_not_match_callback_algorithm.
mov edi, eax
and edi, 0x887e165
mov dword [0x4297bc], edi
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x40a004
add esi, edx
cmp esi, 0x82d
jbe 0x409fb4
mov dword [esp], edi
call fcn.00411dd4
imul eax, dword [0x4297bc], 0x771ae692
mov dword [0x4297bc], eax
mov dword [esp + 0xc], eax
mov dword [esp + 4], eax
mov dword [esp], eax
mov dword [esp + 8], str.SDB_compression_algorithm_does_not_match_callback_algorithm.
call fcn.00413e44
imul eax, dword [0x4297bc], 0xf8043b39
jmp 0x40a009
and eax, 0x8072064
and eax, 0xa603eb09
mov dword [0x4297bc], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov eax, dword [0x4297bc]
sub eax, 0x5827b36e
and eax, 0xe6358b67
mov dword [0x4297bc], eax
mov dword [esp + 8], str.SDB_compression_algorithm_does_not_match_callback_algorithm.
mov dword [esp + 4], 0x429f00
mov dword [esp], str.SDB_compression_algorithm_does_not_match_callback_algorithm.
call fcn.0040eec8
mov ecx, 0x429f00
imul edx, dword [0x4297bc], 0x1f02d377
lea eax, [edx + 0x2779a2fd]
mov dword [0x4297bc], eax
mov al, byte [ecx]
test al, al
je 0x40a081
sub eax, 0x30
cmp al, 9
jbe 0x40a07e
sub edx, 0x372e4f70
mov dword [0x4297bc], edx
jmp 0x40a081
inc ecx
jmp 0x40a063
and dword [0x4297bc], 0x1b588a32
call fcn.004146d4
mov eax, dword [0x4297bc]
xor edx, edx
add eax, 0x43615036
mov dword [0x4297bc], eax
cmp word [edx + str.SDB_compression_algorithm_does_not_match_callback_algorithm.], 0
je 0x40a0c0
add edx, 2
cmp edx, 0x13b8
jne 0x40a0a1
or eax, 0x3bf34f26
mov dword [0x4297bc], eax
mov eax, dword [0x4297bc]
lea edi, [ebp - 0x518]
mov esi, 0x4161a4
add eax, 0x137cc067
or eax, 0xa7785232
mov dword [0x4297bc], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call fcn.00410550
mov eax, dword [0x4297bc]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 0x2f
and eax, 0x974a2491
xor eax, 0x99757edf
or eax, 0xc938b475
imul eax, eax, 0xb2f92a04
sub eax, 0x40e85fb
or eax, 0x9f1aedf5
xor eax, 0x96f908a0
mov dword [0x4297bc], eax
call fcn.004139cc
mov eax, dword [0x4297bc]
or eax, 0x9b03da12
xor eax, 0x9c9889a6
sub eax, 0x3181dce3
mov dword [0x4297bc], eax
call fcn.00410648
add edi, dword [ebp + esi*4 - 0x518]
inc esi
mov dword [ebp - 0x564], edi
cmp esi, 4
jne 0x40a126
and dword [0x4297bc], 0x9ec07031
mov esi, 0x14dc
mov dword [esp], 0xe67
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push eax
sub dword [0x4297bc], 0x3a806162
call dword [sym.imp.USER32.dll_GetDesktopWindow]
imul eax, eax, 0x8d149f74
sub eax, 0x14c11972
mov dword [0x4297bc], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
call fcn.00413240
mov edx, dword [0x4297bc]
mov ecx, str.SDB_compression_algorithm_does_not_match_callback_algorithm.
imul eax, edx, 0xb341dd66
mov dword [0x4297bc], eax
movzx eax, word [ecx]
add ecx, 2
test ax, ax
je 0x40a1db
add esi, eax
cmp esi, 0x1a86
jbe 0x40a1ba
imul edx, edx, 0xb654a37e
mov dword [0x4297bc], edx
mov eax, dword [0x4297bc]
lea esi, [ebp - 0x540]
lea edi, [ebp - 0x538]
lea ebx, [ebp - 0x530]
xor eax, 0x3c0b1ff6
add eax, 0x3cda8d0c
mov dword [0x4297bc], eax
call fcn.00410648
lea eax, [ebp - 0x3f4]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.0040dafc
lea eax, [ebp - 0x4a8]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.0040dafc
lea eax, [ebp - 0x368]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0040dafc
xor eax, eax
mov dword [ebp - 0x54c], eax
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 8], eax
lea eax, [ebp - 0x54c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edi
lea edi, [ebp - 0x3ac]
mov dword [esp + 0x28], 1
mov dword [esp + 4], esi
mov dword [esp], eax
mov eax, dword [0x41611c]
call dword [eax + 0x18]
xor eax, eax
mov ecx, 0x11
mov dword [ebp - 0x3b0], 0x48
rep stosd dword es:[edi], eax
sub esp, 0x2c
mov dword [esp], 0x34
call fcn.0040d2a0
mov dword [eax], 0x34
mov ebx, eax
mov eax, dword [ebp - 0x55c]
shl eax, 4
mov dword [ebx + eax + 4], 0x20005
movzx eax, word [ebp - 0x540]
mov dword [ebx + 0x14], 0x20010
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x53c]
mov dword [ebp - 0x544], 0x1000
mov dword [ebx + 0xc], eax
xor eax, eax
mov dword [ebx + 0x18], 8
mov dword [ebp - 0x548], eax
lea eax, [ebp - 0x548]
mov dword [ebx + 0x1c], eax
xor eax, eax
cmp byte [eax + str.Access_to_the_HTTP_proxy_is_denied.], 0
je 0x40a33c
inc eax
cmp eax, 0x196b
jne 0x40a304
mov eax, dword [0x4297bc]
mov dword [esp + 4], 0x429f00
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp], eax
call fcn.00413b84
add dword [0x4297bc], 0x16093bc8
mov eax, dword [0x4297bc]
xor eax, 0x7a5ece8e
mov dword [0x4297bc], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], str.Access_to_the_HTTP_proxy_is_denied.
mov dword [esp], eax
call fcn.00413b84
mov edx, str.SDB_compression_algorithm_does_not_match_callback_algorithm.
mov ecx, 0x1990
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x40a38c
add ecx, eax
cmp ecx, 0x26b7
jbe 0x40a36d
and dword [0x4297bc], 0x8f968030
mov eax, dword [0x4297bc]
mov ecx, 0x429f00
sub eax, 0x345cdd9c
imul eax, eax, 0xb0a4824c
mov dword [0x4297bc], eax
mov dl, byte [ecx]
test dl, dl
je 0x40a3c3
sub edx, 0x30
cmp dl, 9
jbe 0x40a3c0
add eax, 0x6620aa68
mov dword [0x4297bc], eax
jmp 0x40a3c3
inc ecx
jmp 0x40a3a6
imul eax, dword [0x4297bc], 0xe8d0f083
mov dword [0x4297bc], eax
mov dword [esp + 8], str.Access_to_the_HTTP_proxy_is_denied.
mov dword [esp + 4], 0x429f00
mov dword [esp], eax
call fcn.00414540
call fcn.0040c094
mov dword [ebp - 0x560], eax
dec eax
cmp eax, 0xfffffffd
ja 0x40a6c9
imul eax, dword [0x4297bc], 0xb4adfcb7
xor esi, esi
mov dword [ebp - 0x55c], esi
xor eax, 0x6ef7ea38
add eax, 0x5136a75e
mov dword [0x4297bc], eax
mov eax, dword [0x4297bc]
xor esi, esi
or eax, 0xdefd491c
imul eax, eax, 0xc6d44ca4
mov dword [0x4297bc], eax
call fcn.00414f1c
cmp word [esi + str.SDB_compression_algorithm_does_not_match_callback_algorithm.], 0
je 0x40a4a1
cmp esi, 0x4bde
jne 0x40a45a
sub dword [0x4297bc], 0x5d565fa2
jmp 0x40a4a1
mov edx, str.SDB_compression_algorithm_does_not_match_callback_algorithm.
mov ecx, 0x83
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x40a483
add ecx, eax
cmp ecx, 0x25af
jbe 0x40a464
sub dword [0x4297bc], 0x35eeb93a
mov eax, dword [0x4297bc]
add esi, 2
sub eax, 0x1daf6708
xor eax, 0x697d94b3
mov dword [0x4297bc], eax
call fcn.00410550
jmp 0x40a43c
call fcn.004139cc
mov eax, dword [0x4297bc]
and eax, 0x8fed606d
add eax, 0x2571937a
and eax, 0x288c4a21
mov dword [0x4297bc], eax
call fcn.0040fe70
mov eax, dword [0x4297bc]
or eax, 0xf387ec97
imul eax, eax, 0xfb325ba6
mov dword [0x4297bc], eax
call fcn.00413240
inc dword [ebp - 0x55c]
cmp dword [ebp - 0x55c], 4
jne 0x40a420
mov eax, dword [0x4297bc]
mov ecx, dword [ebp - 0x55c]
lea edi, [ebp - 0x508]
mov esi, 0x4161b4
rep movsd dword es:[edi], dword [esi]
mov edx, 0x15
xor edi, edi
or eax, 0x8805034
add eax, 0x698cd414
imul eax, eax, 0xe5e32185
mov dword [0x4297bc], eax
mov ecx, 0x429f00
mov al, byte [ecx]
test al, al
je 0x40a546
sub eax, 0x30
cmp al, 9
jbe 0x40a543
xor dword [0x4297bc], 0x817976d
jmp 0x40a546
inc ecx
jmp 0x40a52a
mov dword [ebp - 0x55c], edx
and dword [0x4297bc], 0x96f4633f
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov esi, dword [ebp - 0x55c]
add esi, dword [ebp + edi*4 - 0x508]
inc edi
mov edx, esi
cmp edi, 4
jne 0x40a525
xor eax, eax
cmp byte [eax + 0x429f00], 0
je 0x40a58e
inc eax
cmp eax, 0xef0
jne 0x40a573
add dword [0x4297bc], 0x17555b66
or dword [0x4297bc], 0x82908235
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
add eax, 0x3d0ecf86
and eax, 0xe5e0f3e5
imul eax, eax, 0xdcbca505
and eax, 0xc0002400
mov dword [0x4297bc], eax
cmp byte [edx + str.Access_to_the_HTTP_proxy_is_denied.], 0
je 0x40a5e0
inc edx
cmp edx, 0x102b
jne 0x40a5ba
add eax, 0x708b0cea
mov dword [0x4297bc], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ecx
mov eax, dword [0x4297bc]
add eax, 0x337bbb29
or eax, 0x73942dbf
mov dword [0x4297bc], eax
mov dword [esp], eax
call fcn.00411dd4
cmp byte [0x429f00], 0
je 0x40a60f
sub dword [0x4297bc], 0x63815bb8
add dword [0x4297bc], 0x7207cce8
mov dword [esp + 8], str.SDB_compression_algorithm_does_not_match_callback_algorithm.
mov dword [esp + 4], str.Access_to_the_HTTP_proxy_is_denied.
mov dword [esp], str.SDB_compression_algorithm_does_not_match_callback_algorithm.
call fcn.0040eec8
xor eax, eax
cmp byte [eax + str.Access_to_the_HTTP_proxy_is_denied.], 0
je 0x40a654
inc eax
cmp eax, 0x14d4
jne 0x40a637
or dword [0x4297bc], 0xb8e86f37
jmp 0x40a65b
cmp eax, 0x4b5
jle 0x40a66c
call fcn.00410550
mov eax, dword [0x4297bc]
xor eax, 0xe8d91f45
jmp 0x40a676
mov eax, dword [0x4297bc]
xor eax, 0x32b1ee74
sub eax, 0xb89a64
mov dword [0x4297bc], eax
call fcn.00410648
call dword [sym.imp.USER32.dll_GetForegroundWindow]
imul eax, eax, 0xfe88080a
or eax, 0xfda45bed
sub eax, 0x1b833de0
mov dword [0x4297bc], eax
call fcn.004139cc
xor eax, eax
test esi, esi
mov dword [ebx + 0x28], 4
setne al
shl eax, 0x11
or eax, 0x40000
mov dword [ebx + 0x24], eax
mov eax, dword [ebp - 0x560]
mov dword [ebx + 0x2c], eax
jmp 0x40a6cc
sub dword [ebx], 0x10
lea eax, [ebp - 0x3b0]
or dword [0x4297bc], 0x1bf7c7d3
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], eax
mov eax, dword [ebp - 0x54c]
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], eax
mov eax, dword [ebp - 0x564]
mov dword [esp + 0xc], 0x2000000
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x2000000
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00401097
mov esi, eax
mov eax, dword [ebp - 0x560]
mov dword [esp], eax
call fcn.00401065
mov dword [esp], ebx
call fcn.0040d2e4
mov eax, dword [ebp - 0x54c]
mov dword [esp], eax
mov eax, dword [0x41611c]
call dword [eax + 0x1c]
mov eax, esi
push edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret