Function at 0x467c48
Capabilities:
Check for software breakpoints
Contain obfuscated stackstrings
Extract resource via kernel32 functions
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24a8
test al, 0x24
add byte [eax], al
call fcn.0049dcc0
push ebx
push esi
push edi
push 0x2349
push 0x68
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x245c], eax
cmp dword [ebp - 0x245c], 0
jne 0x467c94
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.0046765f
add esp, 4
test eax, eax
je 0x467c8d
jmp 0x4682ba
xor eax, eax
jmp 0x4682bf
mov edx, dword [ebp - 0x245c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x234c], eax
cmp dword [ebp - 0x234c], 0
jne 0x467cbb
xor eax, eax
jmp 0x4682bf
je 0x467cc0
jne 0x467cc0
jmp 0x467c4c
mov ecx, dword [ebp - 0x234c]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [0x4a07fc], eax
cmp dword [0x4a07fc], 0
jne 0x467ce2
xor eax, eax
jmp 0x4682bf
mov edx, dword [ebp - 0x245c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
push 0x2320
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov ecx, dword [0x4a07fc]
lea edx, [ecx + eax - 0x2320]
push edx
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov ecx, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x2478], ecx
mov esi, dword [ebp - 0x2478]
mov al, byte [esi]
cmp al, 0xcc
je 0x467ebb
mov edx, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2488], edx
mov esi, dword [ebp - 0x2488]
mov al, byte [esi]
cmp al, 0xcc
je 0x467ebb
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x2480], eax
mov esi, dword [ebp - 0x2480]
mov al, byte [esi]
cmp al, 0xcc
je 0x467ebb
mov ecx, dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x2484], ecx
mov esi, dword [ebp - 0x2484]
mov al, byte [esi]
cmp al, 0xcc
je 0x467ebb
mov edx, dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x247c], edx
mov esi, dword [ebp - 0x247c]
mov al, byte [esi]
cmp al, 0xcc
je 0x467ebb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3ff
div ecx
mov dword [0x4a06e8], edx
mov byte [ebp - 0x2340], 0x14
mov byte [ebp - 0x233f], 0x28
mov byte [ebp - 0x233e], 0x30
mov byte [ebp - 0x233d], 0x60
mov byte [ebp - 0x233c], 0xc8
mov byte [ebp - 0x233b], 0x30
mov byte [ebp - 0x233a], 0x45
mov byte [ebp - 0x2339], 0x12
mov byte [ebp - 0x2338], 0x18
mov byte [ebp - 0x2337], 0x61
mov byte [ebp - 0x2336], 0xe
mov byte [ebp - 0x2335], 0
mov byte [ebp - 0x2334], 0x22
mov byte [ebp - 0x2333], 0
mov byte [ebp - 0x2332], 0x20
mov byte [ebp - 0x2331], 0
mov byte [ebp - 0x2330], 0x90
mov byte [ebp - 0x232f], 0x66
mov byte [ebp - 0x232e], 0xe
mov byte [ebp - 0x232d], 0
mov byte [ebp - 0x232c], 0xe8
mov byte [ebp - 0x232b], 2
mov byte [ebp - 0x232a], 0x7f
mov byte [ebp - 0x2329], 0x3a
mov byte [ebp - 0x2328], 0x6b
mov byte [ebp - 0x2327], 0x23
mov byte [ebp - 0x2326], 0x36
mov byte [ebp - 0x2325], 0x20
mov byte [ebp - 0x2324], 0x80
mov byte [ebp - 0x2323], 0x60
mov byte [ebp - 0x2322], 0x30
mov byte [ebp - 0x2321], 0
push 0x1d0
lea edx, [ebp - 0x2340]
push edx
push 0x64
mov eax, dword [ebp + 0xc]
add eax, 0xec
push eax
call fcn.0046b64d
add esp, 0x10
mov dword [ebp - 0x2344], 0
push 0x2320
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x2320]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, 1
test eax, eax
je 0x468250
push 0x2320
lea ecx, [ebp - 0x2320]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x2458]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x228]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x22c]
push ecx
mov edx, dword [ebp - 0x2344]
push edx
call fcn.004720e0
test eax, eax
je 0x467f9a
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x224]
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0xec
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x11e
push eax
push 0
call fcn.00467baa
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x248c], eax
mov ecx, dword [ebp - 0x248c]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x2490], eax
push 0
mov edx, dword [ebp - 0x2490]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x2490]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4682bf
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx + 0x238]
cmp edx, 0xa
jl 0x46805b
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 0x238]
cmp ecx, 0x20
jge 0x46805b
lea edx, [ebp - 0x2458]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x230]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x234]
push eax
mov ecx, dword [ebp - 0x2344]
push ecx
call fcn.00472410
test eax, eax
je 0x46805b
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x224]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 0xec
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x11e
push edx
push 0
call fcn.00467baa
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x2494], eax
mov eax, dword [ebp - 0x2494]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x2498], eax
push 0
mov ecx, dword [ebp - 0x2498]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp - 0x2498]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4682bf
lea eax, [ebp - 0x2458]
push eax
push 0xc
mov ecx, dword [ebp + 0xc]
add ecx, 0xe0
push ecx
call fcn.0046b5b2
add esp, 0xc
test eax, eax
jne 0x468081
xor eax, eax
jmp 0x4682bf
lea edx, [ebp - 0x2458]
push edx
push 0xe0
mov eax, dword [ebp + 0xc]
push eax
call fcn.0046b5b2
add esp, 0xc
test eax, eax
jne 0x4680a4
xor eax, eax
jmp 0x4682bf
mov ecx, dword [ebp + 0xc]
add ecx, 0x2bc
push ecx
push 0xe0
mov edx, dword [ebp + 0xc]
push edx
call fcn.0046b941
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0xe0]
push ecx
push 0x450710
lea edx, [ebp - 0x2468]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0xe4]
push ecx
push 0x450714
lea edx, [ebp - 0x2474]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x2458]
push eax
push 0
lea ecx, [ebp - 0x2474]
push ecx
lea edx, [ebp - 0x2468]
push edx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 0xe9]
push ecx
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 0xea]
push eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx + 1]
push edx
call fcn.00469cb1
add esp, 0x1c
test eax, eax
jne 0x468155
mov eax, dword [ebp - 0x2344]
add eax, 1
mov dword [ebp - 0x2344], eax
jmp 0x467edd
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx + 0x11]
test edx, edx
je 0x46818c
lea eax, [ebp - 0x2458]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004673c3
add esp, 8
test eax, eax
jne 0x46818c
mov edx, dword [ebp - 0x2344]
add edx, 1
mov dword [ebp - 0x2344], edx
jmp 0x467edd
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 0x12]
test ecx, ecx
je 0x4681c3
lea edx, [ebp - 0x2458]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00467460
add esp, 8
test eax, eax
jne 0x4681c3
mov ecx, dword [ebp - 0x2344]
add ecx, 1
mov dword [ebp - 0x2344], ecx
jmp 0x467edd
lea edx, [ebp - 0x2458]
push edx
lea eax, [ebp - 0x2474]
push eax
lea ecx, [ebp - 0x2468]
push ecx
push 0
lea edx, [ebp - 0x2350]
push edx
call fcn.00472050
test eax, eax
jne 0x46823c
lea eax, [ebp - 0x2458]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 0x13]
test eax, eax
je 0x468218
lea ecx, [ebp - 0x2458]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [0x4a06c8]
push 0x10
mov eax, dword [ebp + 0xc]
add eax, 0x230c
push eax
lea ecx, [ebp - 0x24a8]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, 1
jmp 0x4682bf
mov edx, dword [ebp - 0x2344]
add edx, 1
mov dword [ebp - 0x2344], edx
jmp 0x467edd
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x224]
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0xec
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x11e
push eax
push 0
call fcn.00467baa
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x2348], eax
mov ecx, dword [ebp - 0x2348]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x2354], eax
push 0
mov edx, dword [ebp - 0x2354]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x2354]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4682bf
jmp 0x467cf8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret