Function at 0x402a40
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create pipe
Create process on windows
Get system information on windows
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42f6e1
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x6d8
mov eax, dword [0x43e040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x1f0003
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventExW]
mov dword [ebp - 0x470], eax
cmp dword [ebp - 0x470], 0
je 0x402ad7
push 0x4312c0
push 0x43f250
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x5cc], eax
push 0x406870
mov ecx, dword [ebp - 0x5cc]
call fcn.00408be0
mov eax, dword [ebp - 0x470]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x402b24
push 0x4312ec
push 0x43f310
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x628], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x624], eax
mov ecx, dword [ebp - 0x624]
push ecx
mov ecx, dword [ebp - 0x628]
call fcn.00408a10
mov dword [ebp - 0x62c], eax
push 0x406870
mov ecx, dword [ebp - 0x62c]
call fcn.00408be0
nop
push 0
push 0
push 0x200
push 0x200
push 1
push 0
push 3
push str..pipeMyPipe
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [ebp - 0x468], eax
cmp dword [ebp - 0x468], 0xffffffff
je 0x402c02
mov dword [ebp - 0x630], 2
push 0
push 0
lea edx, [ebp - 0x630]
push edx
mov eax, dword [ebp - 0x468]
push eax
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x402ba7
push 0x431338
push 0x43f250
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x4a0], eax
push 0x406870
mov ecx, dword [ebp - 0x4a0]
call fcn.00408be0
nop
jmp 0x402bf4
push 0x431378
push 0x43f310
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x4a8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x4a4], eax
mov ecx, dword [ebp - 0x4a4]
push ecx
mov ecx, dword [ebp - 0x4a8]
call fcn.00408a10
mov dword [ebp - 0x4ac], eax
push 0x406870
mov ecx, dword [ebp - 0x4ac]
call fcn.00408be0
nop
mov edx, dword [ebp - 0x468]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
push 0x43139c
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0
je 0x402c5b
push 0x4313b8
push 0x43f250
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x4b0], eax
push 0x406870
mov ecx, dword [ebp - 0x4b0]
call fcn.00408be0
mov eax, dword [ebp - 0x474]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x402ca8
push 0x4313ec
push 0x43f310
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x4b8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x4b4], eax
mov ecx, dword [ebp - 0x4b4]
push ecx
mov ecx, dword [ebp - 0x4b8]
call fcn.00408a10
mov dword [ebp - 0x4bc], eax
push 0x406870
mov ecx, dword [ebp - 0x4bc]
call fcn.00408be0
nop
push 0x431410
push 0x400
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 0
je 0x402d8f
push 0
push 0
push 0
push 0
push 0xf001f
mov edx, dword [ebp - 0x46c]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0
je 0x402d34
push 0x43142c
push 0x43f250
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x4c0], eax
push 0x406870
mov ecx, dword [ebp - 0x4c0]
call fcn.00408be0
mov eax, dword [ebp - 0x478]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
nop
jmp 0x402d81
push 0x431464
push 0x43f310
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x4c8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x4c4], eax
mov ecx, dword [ebp - 0x4c4]
push ecx
mov ecx, dword [ebp - 0x4c8]
call fcn.00408a10
mov dword [ebp - 0x4cc], eax
push 0x406870
mov ecx, dword [ebp - 0x4cc]
call fcn.00408be0
nop
mov edx, dword [ebp - 0x46c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
push 0x64
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x47c], eax
cmp dword [ebp - 0x47c], 0
je 0x402dde
push 0x431488
push 0x43f250
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x4d0], eax
push 0x406870
mov ecx, dword [ebp - 0x4d0]
call fcn.00408be0
mov eax, dword [ebp - 0x47c]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
nop
push 0x4314a4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0
je 0x402e34
push 0x4314b4
push 0x43f250
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x4d4], eax
push 0x406870
mov ecx, dword [ebp - 0x4d4]
call fcn.00408be0
mov ecx, dword [ebp - 0x480]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x402e81
push 0x4314dc
push 0x43f310
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x4dc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x4d8], eax
mov edx, dword [ebp - 0x4d8]
push edx
mov ecx, dword [ebp - 0x4dc]
call fcn.00408a10
mov dword [ebp - 0x4e0], eax
push 0x406870
mov ecx, dword [ebp - 0x4e0]
call fcn.00408be0
nop
lea eax, [ebp - 0x660]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
push 0x4314f8
push 0x43f250
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x4e4], eax
push 0x406870
mov ecx, dword [ebp - 0x4e4]
call fcn.00408be0
mov dword [ebp - 0x4e8], 0
mov ecx, dword [ebp - 0x4e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
test eax, eax
je 0x402f03
push 0x431548
push 0x43f250
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x4ec], eax
push 0x406870
mov ecx, dword [ebp - 0x4ec]
call fcn.00408be0
nop
jmp 0x402f50
push 0x431594
push 0x43f310
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x4f4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x4f0], eax
mov edx, dword [ebp - 0x4f0]
push edx
mov ecx, dword [ebp - 0x4f4]
call fcn.00408a10
mov dword [ebp - 0x4f8], eax
push 0x406870
mov ecx, dword [ebp - 0x4f8]
call fcn.00408be0
nop
push str.MyJob
push 0
push 0x1f003f
call dword [sym.imp.KERNEL32.dll_OpenJobObjectW]
mov dword [ebp - 0x458], eax
cmp dword [ebp - 0x458], 0
je 0x402fa9
push 0x4315c8
push 0x43f250
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x4fc], eax
push 0x406870
mov ecx, dword [ebp - 0x4fc]
call fcn.00408be0
mov eax, dword [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x402ff6
push 0x4315f8
push 0x43f310
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x504], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x500], eax
mov ecx, dword [ebp - 0x500]
push ecx
mov ecx, dword [ebp - 0x504]
call fcn.00408a10
mov dword [ebp - 0x508], eax
push 0x406870
mov ecx, dword [ebp - 0x508]
call fcn.00408be0
nop
cmp dword [ebp - 0x458], 0
je 0x403093
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov edx, dword [ebp - 0x458]
push edx
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
je 0x403046
push 0x431620
push 0x43f250
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x50c], eax
push 0x406870
mov ecx, dword [ebp - 0x50c]
call fcn.00408be0
nop
jmp 0x403093
push 0x431668
push 0x43f310
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x514], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x510], eax
mov eax, dword [ebp - 0x510]
push eax
mov ecx, dword [ebp - 0x514]
call fcn.00408a10
mov dword [ebp - 0x518], eax
push 0x406870
mov ecx, dword [ebp - 0x518]
call fcn.00408be0
nop
push 0x70
push 0
lea ecx, [ebp - 0x450]
push ecx
call fcn.00413910
add esp, 0xc
mov dword [ebp - 0x440], 2
push 0x70
lea edx, [ebp - 0x450]
push edx
push 9
mov eax, dword [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_SetInformationJobObject]
test eax, eax
je 0x4030f7
push 0x431688
push 0x43f250
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x51c], eax
push 0x406870
mov ecx, dword [ebp - 0x51c]
call fcn.00408be0
nop
jmp 0x403144
push 0x4316d4
push 0x43f310
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x524], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x520], eax
mov ecx, dword [ebp - 0x520]
push ecx
mov ecx, dword [ebp - 0x524]
call fcn.00408a10
mov dword [ebp - 0x528], eax
push 0x406870
mov ecx, dword [ebp - 0x528]
call fcn.00408be0
nop
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x488], eax
push 0x431704
push 0x43f250
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x52c], eax
mov edx, dword [ebp - 0x488]
push edx
mov ecx, dword [ebp - 0x52c]
call fcn.00408a10
mov dword [ebp - 0x530], eax
push 0x406870
mov ecx, dword [ebp - 0x530]
call fcn.00408be0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 0x484], eax
push 0
mov eax, dword [ebp - 0x484]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
je 0x4031da
push 0x431728
push 0x43f250
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x534], eax
push 0x406870
mov ecx, dword [ebp - 0x534]
call fcn.00408be0
nop
jmp 0x403227
push 0x431764
push 0x43f310
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x53c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x538], eax
mov ecx, dword [ebp - 0x538]
push ecx
mov ecx, dword [ebp - 0x53c]
call fcn.00408a10
mov dword [ebp - 0x540], eax
push 0x406870
mov ecx, dword [ebp - 0x540]
call fcn.00408be0
nop
lea edx, [ebp - 0x69c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x43178c
push 0x43f250
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x544], eax
mov eax, dword [ebp - 0x688]
push eax
mov ecx, dword [ebp - 0x544]
call fcn.00408a10
mov dword [ebp - 0x548], eax
push 0x406870
mov ecx, dword [ebp - 0x548]
call fcn.00408be0
nop
push 2
mov ecx, dword [ebp - 0x484]
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
je 0x4032b3
push 0x4317b0
push 0x43f250
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x54c], eax
push 0x406870
mov ecx, dword [ebp - 0x54c]
call fcn.00408be0
nop
jmp 0x403300
push 0x4317e8
push 0x43f310
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x554], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x550], eax
mov edx, dword [ebp - 0x550]
push edx
mov ecx, dword [ebp - 0x554]
call fcn.00408a10
mov dword [ebp - 0x558], eax
push 0x406870
mov ecx, dword [ebp - 0x558]
call fcn.00408be0
nop
lea eax, [ebp - 0x668]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimePreciseAsFileTime]
push 0x431810
push 0x43f250
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x55c], eax
push 0x406870
mov ecx, dword [ebp - 0x55c]
call fcn.00408be0
nop
lea ecx, [ebp - 0x560]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
test eax, eax
je 0x40339d
push 0x431834
push 0x43f250
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x568], eax
mov edx, dword [ebp - 0x560]
mov dword [ebp - 0x564], edx
mov eax, dword [ebp - 0x564]
push eax
mov ecx, dword [ebp - 0x568]
call fcn.00408a10
mov dword [ebp - 0x56c], eax
push 0x406870
mov ecx, dword [ebp - 0x56c]
call fcn.00408be0
nop
jmp 0x4033ea
push 0x431858
push 0x43f310
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x574], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x570], eax
mov ecx, dword [ebp - 0x570]
push ecx
mov ecx, dword [ebp - 0x574]
call fcn.00408a10
mov dword [ebp - 0x578], eax
push 0x406870
mov ecx, dword [ebp - 0x578]
call fcn.00408be0
nop
mov dword [ebp - 0x57c], 0x104
lea edx, [ebp - 0x57c]
push edx
lea eax, [ebp - 0x220]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x403450
push 0x431890
push 0x43f3c0
call fcn.00404170
add esp, 8
lea ecx, [ebp - 0x220]
push ecx
push eax
call fcn.00404170
add esp, 8
mov dword [ebp - 0x580], eax
push 0x4068b0
mov ecx, dword [ebp - 0x580]
call fcn.00408be0
nop
jmp 0x40349d
push 0x4318d4
push 0x43f310
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x588], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x584], eax
mov edx, dword [ebp - 0x584]
push edx
mov ecx, dword [ebp - 0x588]
call fcn.00408a10
mov dword [ebp - 0x58c], eax
push 0x406870
mov ecx, dword [ebp - 0x58c]
call fcn.00408be0
nop
mov dword [ebp - 0x590], 1
mov eax, dword [ebp - 0x590]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
test eax, eax
je 0x4034ea
push 0x431908
push 0x43f250
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x594], eax
push 0x406870
mov ecx, dword [ebp - 0x594]
call fcn.00408be0
nop
jmp 0x403537
push 0x431950
push 0x43f310
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x59c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x598], eax
mov ecx, dword [ebp - 0x598]
push ecx
mov ecx, dword [ebp - 0x59c]
call fcn.00408a10
mov dword [ebp - 0x5a0], eax
push 0x406870
mov ecx, dword [ebp - 0x5a0]
call fcn.00408be0
nop
lea edx, [ebp - 0x5a4]
push edx
mov eax, dword [ebp - 0x488]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x40359e
push 0x43197c
push 0x43f250
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x5ac], eax
mov ecx, dword [ebp - 0x5a4]
mov dword [ebp - 0x5a8], ecx
mov edx, dword [ebp - 0x5a8]
push edx
mov ecx, dword [ebp - 0x5ac]
call fcn.00408a10
mov dword [ebp - 0x5b0], eax
push 0x406870
mov ecx, dword [ebp - 0x5b0]
call fcn.00408be0
nop
jmp 0x4035eb
push 0x431994
push 0x43f310
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x5b8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x5b4], eax
mov eax, dword [ebp - 0x5b4]
push eax
mov ecx, dword [ebp - 0x5b8]
call fcn.00408a10
mov dword [ebp - 0x5bc], eax
push 0x406870
mov ecx, dword [ebp - 0x5bc]
call fcn.00408be0
nop
push 0
push 8
push 0
push 0
mov ecx, dword [ebp - 0x470]
push ecx
lea edx, [ebp - 0x65c]
push edx
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
je 0x403636
push 0x4319c0
push 0x43f250
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x5c0], eax
push 0x406870
mov ecx, dword [ebp - 0x5c0]
call fcn.00408be0
nop
jmp 0x403683
push 0x431a04
push 0x43f310
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x5c8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x5c4], eax
mov eax, dword [ebp - 0x5c4]
push eax
mov ecx, dword [ebp - 0x5c8]
call fcn.00408a10
mov dword [ebp - 0x60c], eax
push 0x406870
mov ecx, dword [ebp - 0x60c]
call fcn.00408be0
nop
push 0x1f0003
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerExW]
mov dword [ebp - 0x48c], eax
cmp dword [ebp - 0x48c], 0
je 0x4036db
push 0x431a24
push 0x43f250
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x5d0], eax
push 0x406870
mov ecx, dword [ebp - 0x5d0]
call fcn.00408be0
mov ecx, dword [ebp - 0x48c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x403728
push 0x431a60
push 0x43f310
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x5d8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x5d4], eax
mov edx, dword [ebp - 0x5d4]
push edx
mov ecx, dword [ebp - 0x5d8]
call fcn.00408a10
mov dword [ebp - 0x5dc], eax
push 0x406870
mov ecx, dword [ebp - 0x5dc]
call fcn.00408be0
nop
lea ecx, [ebp - 0x461]
call fcn.004070e0
mov dword [ebp - 0x5e0], eax
push str.C:Windows_system32_vboxservice.exe
lea ecx, [ebp - 0x3e0]
call fcn.004074f0
mov dword [ebp - 4], 0
push str.C:Windows_system32_vboxtray.exe
lea ecx, [ebp - 0x3c8]
call fcn.004074f0
mov byte [ebp - 4], 1
push str.C:Program_FilesOracleVirtualBox_Guest_AdditionsVBoxSF.sys
lea ecx, [ebp - 0x3b0]
call fcn.004074f0
mov byte [ebp - 4], 2
push str.C:WindowsSystem32driversVBoxMouse.sys
lea ecx, [ebp - 0x398]
call fcn.004074f0
mov byte [ebp - 4], 3
push str.C:Windows_system32_vmtoolsd.exe
lea ecx, [ebp - 0x380]
call fcn.004074f0
mov byte [ebp - 4], 4
push str.C:Windows_system32drivers_vmci.sys
lea ecx, [ebp - 0x368]
call fcn.004074f0
mov byte [ebp - 4], 5
push str.C:Windows_system32drivers_vmxnet.sys
lea ecx, [ebp - 0x350]
call fcn.004074f0
mov byte [ebp - 4], 6
push str.C:Program_FilesSandboxieSbieCtrl.exe
lea ecx, [ebp - 0x338]
call fcn.004074f0
mov byte [ebp - 4], 7
push str.C:Sandbox_
lea ecx, [ebp - 0x320]
call fcn.004074f0
mov byte [ebp - 4], 8
push str.C:Program_Filesqemuqemu_ga.exe
lea ecx, [ebp - 0x308]
call fcn.004074f0
mov byte [ebp - 4], 9
push str.C:VTRoot_
lea ecx, [ebp - 0x2f0]
call fcn.004074f0
mov byte [ebp - 4], 0xa
push str.C:UsersWDAGUtilityAccount_
lea ecx, [ebp - 0x2d8]
call fcn.004074f0
mov dword [ebp - 4], 0xb
lea eax, [ebp - 0x2c0]
push eax
lea ecx, [ebp - 0x3e0]
push ecx
lea ecx, [ebp - 0x670]
call fcn.004076b0
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x618], edx
mov dword [ebp - 0x614], eax
mov ecx, dword [ebp - 0x5e0]
push ecx
mov edx, dword [ebp - 0x614]
push edx
mov eax, dword [ebp - 0x618]
push eax
lea ecx, [ebp - 0x648]
call fcn.00407900
mov byte [ebp - 4], 0xd
push fcn.00408200
push 0xc
push 0x18
lea ecx, [ebp - 0x3e0]
push ecx
call fcn.00412284
nop
lea ecx, [ebp - 0x462]
call fcn.004070e0
mov dword [ebp - 0x5e4], eax
push str.vboxservice.exe
lea ecx, [ebp - 0x2b8]
call fcn.004074f0
mov byte [ebp - 4], 0xe
push str.vboxtray.exe
lea ecx, [ebp - 0x2a0]
call fcn.004074f0
mov byte [ebp - 4], 0xf
push str.vmtoolsd.exe
lea ecx, [ebp - 0x288]
call fcn.004074f0
mov byte [ebp - 4], 0x10
push str.SbieCtrl.exe
lea ecx, [ebp - 0x270]
call fcn.004074f0
mov byte [ebp - 4], 0x11
push str.qemu_ga.exe
lea ecx, [ebp - 0x258]
call fcn.004074f0
mov byte [ebp - 4], 0x12
lea edx, [ebp - 0x240]
push edx
lea eax, [ebp - 0x2b8]
push eax
lea ecx, [ebp - 0x678]
call fcn.004076b0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x620], ecx
mov dword [ebp - 0x61c], edx
mov eax, dword [ebp - 0x5e4]
push eax
mov ecx, dword [ebp - 0x61c]
push ecx
mov edx, dword [ebp - 0x620]
push edx
lea ecx, [ebp - 0x63c]
call fcn.00407900
mov byte [ebp - 4], 0x14
push fcn.00408200
push 5
push 0x18
lea eax, [ebp - 0x2b8]
push eax
call fcn.00412284
nop
call fcn.00401430
call fcn.00401780
call fcn.00401630
call fcn.00401550
call fcn.004014d0
call fcn.00401870
nop
lea ecx, [ebp - 0x648]
mov dword [ebp - 0x490], ecx
mov ecx, dword [ebp - 0x490]
call fcn.0040bb40
mov dword [ebp - 0x45c], eax
mov ecx, dword [ebp - 0x490]
call fcn.0040bb60
mov dword [ebp - 0x5e8], eax
jmp 0x4039ca
mov edx, dword [ebp - 0x45c]
add edx, 0x18
mov dword [ebp - 0x45c], edx
mov eax, dword [ebp - 0x45c]
cmp eax, dword [ebp - 0x5e8]
je 0x403a3a
mov ecx, dword [ebp - 0x45c]
mov dword [ebp - 0x494], ecx
mov edx, dword [ebp - 0x494]
push edx
call fcn.004012a0
add esp, 4
movzx eax, al
test eax, eax
je 0x403a38
push 0x431e64
push 0x43f3c0
call fcn.00404170
add esp, 8
mov ecx, dword [ebp - 0x494]
push ecx
push eax
call fcn.004044a0
add esp, 8
mov dword [ebp - 0x5ec], eax
push 0x4068b0
mov ecx, dword [ebp - 0x5ec]
call fcn.00408be0
call fcn.00401260
nop
jmp 0x4039bb
call fcn.004018f0
call fcn.00401970
call fcn.00401a50
call fcn.00401ad0
call fcn.00401bb0
call fcn.00401c30
call fcn.00401cc0
nop
lea edx, [ebp - 0x63c]
mov dword [ebp - 0x498], edx
mov ecx, dword [ebp - 0x498]
call fcn.0040bb40
mov dword [ebp - 0x460], eax
mov ecx, dword [ebp - 0x498]
call fcn.0040bb60
mov dword [ebp - 0x5f0], eax
jmp 0x403a9d
mov eax, dword [ebp - 0x460]
add eax, 0x18
mov dword [ebp - 0x460], eax
mov ecx, dword [ebp - 0x460]
cmp ecx, dword [ebp - 0x5f0]
je 0x403b0d
mov edx, dword [ebp - 0x460]
mov dword [ebp - 0x49c], edx
mov eax, dword [ebp - 0x49c]
push eax
call fcn.00401320
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x403b0b
push 0x431e88
push 0x43f3c0
call fcn.00404170
add esp, 8
mov edx, dword [ebp - 0x49c]
push edx
push eax
call fcn.004044a0
add esp, 8
mov dword [ebp - 0x5f4], eax
push 0x4068b0
mov ecx, dword [ebp - 0x5f4]
call fcn.00408be0
call fcn.00401260
nop
jmp 0x403a8e
call fcn.00401d60
call fcn.00401e00
call fcn.00401eb0
call fcn.00401ef0
call fcn.00401f80
call fcn.00402020
nop
push 0x431eb0
lea ecx, [ebp - 0x238]
call fcn.004074f0
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0x238]
push eax
call fcn.004012e0
add esp, 4
mov byte [ebp - 0x451], al
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x238]
call fcn.00408200
movzx ecx, byte [ebp - 0x451]
test ecx, ecx
je 0x403b9d
push 0x431ec8
push 0x43f3c0
call fcn.00404170
add esp, 8
mov dword [ebp - 0x5f8], eax
push 0x4068b0
mov ecx, dword [ebp - 0x5f8]
call fcn.00408be0
call fcn.00401260
nop
call fcn.004020c0
call fcn.00402190
call fcn.00402220
call fcn.00402280
call fcn.00402310
call fcn.004023a0
mov dword [ebp - 0x5fc], str.C:WindowsSystem32_notepad.exe
mov dword [ebp - 0x6e8], 0x24
push 0x40
push 0
lea edx, [ebp - 0x6e4]
push edx
call fcn.00413910
add esp, 0xc
call fcn.00402450
call fcn.00402520
call fcn.00402650
nop
lea eax, [ebp - 0x658]
push eax
lea ecx, [ebp - 0x6e8]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0x5fc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x403c8f
push 0x431f50
push 0x43f310
call fcn.00403e40
add esp, 8
mov dword [ebp - 0x604], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x600], eax
mov eax, dword [ebp - 0x600]
push eax
mov ecx, dword [ebp - 0x604]
call fcn.00408a10
mov dword [ebp - 0x608], eax
push 0x406870
mov ecx, dword [ebp - 0x608]
call fcn.00408be0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x63c]
call fcn.004083a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.004083a0
nop
jmp 0x403d01
call fcn.004026b0
call fcn.00402750
call fcn.004027b0
call fcn.004027f0
call fcn.004028e0
call fcn.00402960
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x658]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x658]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004125dc
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret