Function at 0x409890
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov esi, esp
call fcn.00409af0
sub esp, 0x30
mov edi, esp
and edi, 0xfffffff8
mov esp, edi
push eax
mov ebx, esp
jmp 0x4098b2
call fcn.00409af0
sub esp, 0x100
mov dword [esi + 8], esp
jmp 0x4098c2
call fcn.00433390
test al, 1
jne 0x4098d0
jmp 0x409ab6
mov al, byte [ebx]
mov byte [esi + 4], al
mov byte [edi], 0xc4
mov byte [edi + 1], 0x61
mov byte [edi + 2], 0xcd
mov byte [edi + 3], 0x63
mov byte [edi + 4], 0xca
mov byte [edi + 5], 0x65
mov byte [edi + 6], 0xf3
mov byte [edi + 7], 0x67
mov byte [edi + 8], 0xfc
mov byte [edi + 9], 0x69
mov byte [edi + 0xa], 0xcc
mov byte [edi + 0xb], 0x6b
mov byte [edi + 0xc], 0xcd
mov byte [edi + 0xd], 0x6d
mov byte [edi + 0xe], 0xfa
mov byte [edi + 0xf], 0x6f
mov byte [edi + 0x10], 0xc3
mov byte [edi + 0x11], 0x51
mov byte [edi + 0x12], 0xfa
mov byte [edi + 0x13], 0x53
mov byte [edi + 0x14], 0xfd
mov byte [edi + 0x15], 0x55
mov byte [edi + 0x16], 0xc2
mov byte [edi + 0x17], 0x57
mov byte [edi + 0x18], 0xf4
mov byte [edi + 0x19], 0x59
mov byte [edi + 0x1a], 0xfb
mov byte [edi + 0x1b], 0x5b
mov byte [edi + 0x1c], 0xc8
mov byte [edi + 0x1d], 0x5d
mov byte [edi + 0x1e], 0xca
mov byte [edi + 0x1f], 0x5f
mov byte [edi + 0x20], 0xe5
mov byte [edi + 0x21], 0x41
mov byte [edi + 0x22], 0x42
mov byte [edi + 0x23], 0x43
mov eax, 0x24
mov byte [edi + eax], 0
add eax, 1
cmp eax, 0x2c
jne 0x409969
mov dword [esi], 0
mov eax, dword [esi]
cmp eax, 0x2c
jae 0x4099b3
mov eax, dword [esi]
mov ecx, dword [esi]
movzx ecx, byte [edi + ecx]
mov edx, eax
add edx, 0x650f5610
mov ebx, 0xef
sub ebx, eax
xor ebx, edx
and ebx, ecx
xor ebx, edx
mov dword [esi + 0xc], ebx
mov eax, dword [esi + 0xc]
add al, 0x90
mov ecx, dword [esi]
mov byte [edi + ecx], al
mov eax, dword [esi]
inc eax
mov dword [esi], eax
jmp 0x40997b
xor eax, eax
sub esp, 0xc
mov dword [esp], 0
mov dword [esp + 4], 1
mov dword [esp + 8], edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
call fcn.0042c2c0
test al, 1
jne 0x4099e1
jmp 0x409a9c
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, 0
jl 0x409a9c
xor eax, eax
sub esp, 0x24
mov dword [esp], 0
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
cmp eax, 0
setge al
test al, 1
jne 0x409a62
jmp 0x409a94
call fcn.0040aa90
test al, 1
jne 0x409a6d
jmp 0x409a94
lea eax, str.system_or_character_via_spellings_glyphs_a_is_uses_that_in_their_modified_other_on_often_reflection_or_resemblance_on_it_leetspeak__used_similarity_internet._play_eleet_the_of_the_replacements_of_primarily_ways
sub esp, 8
mov ecx, dword [esi + 8]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00409ad0
add esp, 8
call fcn.0040cf70
call fcn.0040bf00
jmp 0x409a94
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x409a9c
cmp edi, 0
je 0x409aaf
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x409aaf
call fcn.00433820
jmp 0x409ab6
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]