Function at 0x476c30
Capabilities:
Encode data using xor
Terminate process

Disassembly:
mov eax, dword [0x55f3dc]
sub esp, 0xc
test eax, eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_PostMessageA]
push ebp
push esi
push edi
mov ebp, 1
jne 0x476cc6
mov eax, dword [0x55f3d8]
test eax, eax
jne 0x476cc6
cmp dword [0x55f3ec], ebp
jne 0x476cc6
mov eax, dword [0x556e68]
mov ecx, dword [0x556e64]
mov edx, dword [0x556e60]
push 0xc350
push eax
push ecx
push edx
push 0xffffffffffffffff
call fcn.00476970
add esp, 0x14
mov dword [0x55f3d8], ebp
call fcn.004dd995
test eax, eax
je 0x476d1a
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
test eax, eax
je 0x476d1a
call fcn.004dd995
test eax, eax
je 0x476caf
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x476cb1
xor eax, eax
mov eax, dword [eax + 0x1c]
push 0x983f
push 0x192f
push 0x9673
push eax
call ebx
push 0
call fcn.004c246b
push eax
call fcn.004c278f
add esp, 8
xor eax, eax
mov dl, al
xor dl, 0xb1
mov byte [esp + eax + 0x10], dl
inc eax
cmp eax, 0xa
jl 0x476cd8
push 0x28
call fcn.004c279c
push eax
call fcn.004c49b5
mov edi, dword [esp + 0x28]
mov dword [esp + 0x18], eax
lea eax, [edx + edx*4 + 0x32]
add esp, 8
lea esi, [eax + eax*4]
mov eax, dword [edi + 4]
shl esi, 2
cmp eax, 0x9675
jne 0x476d43
push 0
call fcn.004c5414
mov ecx, dword [0x556e5c]
and ecx, 0x2000
cmp ecx, 0x2000
jne 0x476d3c
push 0xffffffffffffffff
push 0x10
push 0x1aa
call fcn.004e54c6
push 0
call fcn.004c5414
cmp eax, 0x9a31
jne 0x476d8b
call fcn.004dd995
test eax, eax
je 0x476d84
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
test eax, eax
je 0x476d84
call fcn.004dd995
test eax, eax
je 0x476d72
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
test eax, eax
jne 0x476d76
xor eax, eax
jmp 0x476d79
mov eax, dword [eax + 0x1c]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x476d8b
push 0
call fcn.004c5414
mov eax, dword [0x55f400]
imul eax, esi
cmp eax, 0xbb8
jbe 0x476d9c
shr esi, 1
cmp esi, 0x640
jb 0x476da9
mov esi, 0x640
mov eax, dword [edi + 4]
cmp eax, 0x10
jne 0x476f3d
cmp dword [edi + 8], 0x10f0
jne 0x476f3d
cmp dword [edi + 0xc], 0x2f0f
jne 0x476f3d
call fcn.004dd995
test eax, eax
je 0x476e38
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
test eax, eax
je 0x476e38
call fcn.004dd995
test eax, eax
je 0x476df5
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x476df7
xor eax, eax
mov eax, dword [eax + 0x1c]
push 0x88b8
push 0
push 0
push 0x9675
push eax
call fcn.00476970
add esp, 0x14
call fcn.004dd995
test eax, eax
je 0x476e23
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x476e25
xor eax, eax
mov eax, dword [eax + 0x1c]
push 0
push 0
push 0x9930
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x55f3dc]
test eax, eax
je 0x476e50
mov eax, dword [0x556e5c]
or ah, 0x20
mov dword [0x556e5c], eax
jmp 0x476e6d
cmp dword [0x55f3f4], ebp
je 0x476ef8
cmp dword [0x55f3f8], ebp
je 0x476ef8
mov eax, dword [0x556e5c]
and eax, 0x2000
push 0xffffffffffffffff
cmp eax, 0x2000
push 0x10
push 0x1aa
jne 0x476ead
call fcn.004e54c6
call fcn.004dd995
test eax, eax
je 0x476ef1
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
test eax, eax
je 0x476ef1
call fcn.004dd995
test eax, eax
je 0x476ed6
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x476ed8
call fcn.004e54c6
call fcn.004c5507
cdq
mov ecx, 0x30e
idiv ecx
mov esi, edx
push esi
call edi
add esp, 4
mov edx, esi
lea eax, [edx + 1]
mov ecx, 0x64
cdq
idiv ecx
jmp 0x476ec9
xor eax, eax
mov eax, dword [eax + 0x1c]
push 0
push 0
push 0x9a31
push eax
call ebx
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push 0
call fcn.004c5414
push 0xffffffffffffffff
push 0x10
push 0x1aa
mov dword [0x556e5c], 0
call fcn.004e54c6
call fcn.004dd995
test eax, eax
je 0x476f36
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
test eax, eax
je 0x476f36
call fcn.004dd995
test eax, eax
je 0x476ed6
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x476ed8
push 0
call fcn.004c5414
cmp eax, 0x9673
jne 0x476ff9
cmp dword [edi + 8], 0x192f
jne 0x476ff9
cmp dword [edi + 0xc], 0x983f
jne 0x476ff9
call fcn.004dd995
test eax, eax
je 0x476fdd
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
test eax, eax
je 0x476fdd
call fcn.004dd995
test eax, eax
je 0x476f88
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x476f8a
xor eax, eax
mov edx, dword [eax + 0x1c]
lea ecx, [esi + 0xea60]
push ecx
push 0
push 0
push 0x9a31
push edx
call fcn.00476970
add esp, 0x14
call fcn.004dd995
test eax, eax
je 0x476fb8
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x476fba
xor eax, eax
mov eax, dword [eax + 0x1c]
push esi
push 0x2f0f
push 0x10f0
push 0x10
push eax
call fcn.00476970
add esp, 0x14
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x57
div ecx
lea eax, [edx + 1]
mov ecx, 0x64
cdq
idiv ecx
jmp 0x476fec
cmp eax, 0x9674
jne 0x4770a7
cmp dword [edi + 8], 0x284f
jne 0x4770a7
cmp dword [edi + 0xc], 0x875f
jne 0x4770a7
call fcn.004dd995
test eax, eax
je 0x47709a
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
test eax, eax
je 0x47709a
call fcn.004dd995
test eax, eax
je 0x477044
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x477046
xor eax, eax
mov eax, dword [eax + 0x1c]
push esi
push 0x2f0f
push 0x10f0
push 0x10
push eax
call fcn.00476970
add esp, 0x14
call fcn.004dd995
test eax, eax
je 0x477071
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x477073
xor eax, eax
mov edx, dword [eax + 0x1c]
lea ecx, [esi + esi + 0xafc8]
push ecx
push 0
push 0
push 0x9a31
push edx
call fcn.00476970
add esp, 0x14
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
call fcn.004c5414
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret