Function at 0x416470
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7ebe14
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov dword [esi], vtable.CBscDlg.0
push 0
mov dword [ebp - 4], 0x21
call fcn.0048e980
push 0
call fcn.0049b430
mov eax, dword [esi + 0x32c0]
lea ecx, [esi + 0x32c0]
add esp, 8
call dword [eax + 0x58]
mov edx, dword [esi + 0x30cc]
lea ecx, [esi + 0x30cc]
call dword [edx + 0x58]
call fcn.00488b00
test al, al
jne 0x416552
mov eax, dword [esi + 0xa0]
test eax, eax
jle 0x416552
mov dword [ebp - 0x18], eax
mov al, byte [ebp - 0x11]
push 0
lea ecx, [ebp - 0x34]
mov byte [ebp - 0x34], al
call fcn.00404f20
push 0x8fb824
call fcn.007ac4d2
add esp, 4
lea ecx, [ebp - 0x34]
push eax
push 0x8fb824
call fcn.00403980
mov byte [ebp - 4], 0x22
call fcn.00488b30
test eax, eax
je 0x416525
add eax, 4
jmp 0x416527
xor eax, eax
push 0
lea ecx, [ebp - 0x18]
push 0
lea edx, [ebp - 0x34]
push ecx
push edx
push eax
lea ecx, [ebp - 0x70]
call fcn.005db580
lea ecx, [ebp - 0x70]
call fcn.005d9ff0
push 1
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x21
call fcn.00404f20
lea ecx, [esi + 0x2cd8]
mov byte [ebp - 4], 0x23
call fcn.005e6286
test al, al
je 0x416574
mov eax, dword [esi + 0x2cdc]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [esi + 0x1dbc]
call fcn.005684a0
call fcn.00458a80
call fcn.00485100
call fcn.004a76b0
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0x32
test edi, edi
je 0x4165b6
call fcn.004a7a10
test eax, eax
je 0x4165b6
push 0x64
call ebx
dec edi
jmp 0x416599
lea edi, [esi + 0x3ab0]
mov dword [ebp - 4], 0x21
mov dword [ebp - 0x20], edi
lea eax, [edi + 0x44]
mov byte [ebp - 4], 0x28
test eax, eax
je 0x4165d6
lea ecx, [eax + 4]
jmp 0x4165d8
xor ecx, ecx
push 1
call fcn.00404f20
lea ecx, [edi + 0x34]
mov byte [ebp - 4], 0x27
call fcn.004313e0
lea ecx, [edi + 0x24]
mov byte [ebp - 4], 0x26
call fcn.004316b0
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0x25
call fcn.0078c620
lea ecx, [edi + 4]
mov byte [ebp - 4], 0x20
call fcn.0078c620
lea edi, [esi + 0x3a88]
mov dword [ebp - 0x20], edi
lea eax, [edi + 0x14]
mov byte [ebp - 4], 0x29
test eax, eax
je 0x416628
lea ecx, [eax + 4]
jmp 0x41662a
xor ecx, ecx
push 1
call fcn.00404c40
lea ecx, [edi + 4]
mov byte [ebp - 4], 0x1f
call fcn.00431260
lea eax, [esi + 0x3a68]
mov byte [ebp - 4], 0x1e
test eax, eax
je 0x416650
lea ecx, [eax + 4]
jmp 0x416652
xor ecx, ecx
push 1
call fcn.00404f20
lea edi, [esi + 0x399c]
mov dword [ebp - 0x20], edi
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 0x2b
call fcn.004338e0
lea eax, [edi + 0x1c]
mov byte [ebp - 4], 0x2a
test eax, eax
je 0x41667e
lea ecx, [eax + 4]
jmp 0x416680
xor ecx, ecx
push 1
call fcn.00404c40
lea eax, [edi + 4]
mov byte [ebp - 4], 0x1d
test eax, eax
je 0x416697
lea ecx, [eax + 4]
jmp 0x416699
xor ecx, ecx
push 1
call fcn.00404c40
lea ecx, [esi + 0x3988]
mov byte [ebp - 4], 0x1c
call fcn.0040e470
mov edi, dword [esi + 0x3984]
mov byte [ebp - 4], 0x1b
test edi, edi
je 0x4166d7
lea eax, [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x4166d7
test edi, edi
je 0x4166d7
mov edx, dword [edi]
push 1
mov ecx, edi
call dword [edx]
lea ecx, [esi + 0x3974]
mov byte [ebp - 4], 0x1a
call fcn.00431ce0
lea ecx, [esi + 0x395c]
mov byte [ebp - 4], 0x19
call fcn.00431ce0
lea ecx, [esi + 0x3944]
mov byte [ebp - 4], 0x18
call fcn.00431bf0
lea ecx, [esi + 0x392c]
mov byte [ebp - 4], 0x17
call fcn.00431bf0
lea edi, [esi + 0x35a0]
mov dword [ebp - 0x20], edi
lea ebx, [edi + 0x2e0]
mov dword [ebp - 0x24], ebx
lea ecx, [ebx + 0x50]
mov byte [ebp - 4], 0x35
call fcn.00414ba0
mov ecx, ebx
mov byte [ebp - 4], 0x34
call fcn.00414ba0
lea ecx, [edi + 0x29c]
call fcn.00415700
lea ecx, [edi + 0x238]
call fcn.00415610
lea ecx, [edi + 0x228]
mov byte [ebp - 4], 0x31
call fcn.00431af0
lea ecx, [edi + 0x214]
mov byte [ebp - 4], 0x30
call fcn.00431af0
lea ecx, [edi + 0x184]
call fcn.00415400
lea ecx, [edi + 0xd4]
mov byte [ebp - 4], 0x2e
call fcn.00415290
lea ecx, [edi + 0x98]
call fcn.00415210
lea eax, [edi + 0x80]
mov byte [ebp - 4], 0x2c
test eax, eax
je 0x4167a8
lea ecx, [eax + 4]
jmp 0x4167aa
xor ecx, ecx
push 1
call fcn.00404c40
mov ecx, edi
call fcn.004150b0
lea ecx, [esi + 0x359c]
mov byte [ebp - 4], 0x15
call fcn.006d09c0
lea ecx, [esi + 0x3580]
mov byte [ebp - 4], 0x14
call fcn.007d75e7
lea ecx, [esi + 0x357c]
mov byte [ebp - 4], 0x13
call fcn.007d75e7
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea edi, [esi + 0x3558]
mov byte [ebp - 4], 0x12
lea eax, [edi + 8]
mov dword [edi], vtable.CCriticalSection.0
push eax
call ebx
mov ecx, edi
call fcn.007a4708
lea edi, [esi + 0x3534]
mov byte [ebp - 4], 0x11
lea ecx, [edi + 8]
mov dword [edi], vtable.CCriticalSection.0
push ecx
call ebx
mov ecx, edi
call fcn.007a4708
lea eax, [esi + 0x3520]
mov byte [ebp - 4], 0x10
test eax, eax
je 0x416838
lea ecx, [eax + 4]
jmp 0x41683a
xor ecx, ecx
push 1
call fcn.00404c40
lea ecx, [esi + 0x350c]
mov byte [ebp - 4], 0xf
call fcn.007d1b34
lea edi, [esi + 0x32c0]
mov dword [ebp - 0x24], edi
lea ecx, [edi + 0x210]
mov byte [ebp - 4], 0x3a
mov dword [ecx], vtable.CRgn.0
call fcn.00635b00
lea ecx, [edi + 0x12c]
mov byte [ebp - 4], 0x39
call fcn.0063c4b0
lea ecx, [edi + 0xf4]
mov byte [ebp - 4], 0x38
call fcn.00416220
lea ecx, [edi + 0x74]
mov byte [ebp - 4], 0x37
call fcn.00412c50
mov eax, dword [edi + 0x70]
lea ebx, [edi + 0x44]
test eax, eax
mov byte [ebp - 4], 0x36
je 0x4168b4
mov ecx, ebx
call fcn.0043f580
mov eax, dword [ebx + 0x2c]
test eax, eax
jne 0x4168a6
mov ecx, edi
mov byte [ebp - 4], 0xe
call fcn.007d44cf
lea edi, [esi + 0x30cc]
mov dword [ebp - 0x24], edi
lea ecx, [edi + 0x1e8]
mov byte [ebp - 4], 0x3c
call fcn.007d1b34
lea ecx, [edi + 0xac]
mov byte [ebp - 4], 0x3b
call fcn.006337d0
mov ecx, edi
mov byte [ebp - 4], 0xd
call fcn.0040c1e0
lea ecx, [esi + 0x2d14]
mov byte [ebp - 4], 0xc
mov dword [ecx], vtable.CMenu.0
call fcn.007d7cbb
lea ecx, [esi + 0x2d0c]
mov byte [ebp - 4], 0xb
mov dword [ecx], vtable.CMenu.0
call fcn.007d7cbb
lea ecx, [esi + 0x2d04]
mov byte [ebp - 4], 0xa
mov dword [ecx], vtable.CMenu.0
call fcn.007d7cbb
lea ecx, [esi + 0x2cd8]
mov byte [ebp - 4], 9
call fcn.005e624b
lea edi, [esi + 0x1dbc]
mov dword [ebp - 0x24], edi
lea ebx, [edi + 0xe7c]
mov dword [ebp - 0x20], ebx
lea ecx, [ebx + 0x5c]
mov byte [ebp - 4], 0x43
call fcn.007d1977
mov ecx, ebx
mov byte [ebp - 4], 0x42
call fcn.007d31d4
lea eax, [edi + 0xe68]
mov byte [ebp - 4], 0x41
test eax, eax
je 0x41697b
lea ecx, [eax + 4]
jmp 0x41697d
xor ecx, ecx
push 1
call fcn.00404f20
lea ecx, [edi + 0xd5c]
mov byte [ebp - 4], 0x40
call fcn.00564870
lea ecx, [edi + 0x8e4]
mov byte [ebp - 4], 0x3f
call fcn.00565a70
lea ecx, [edi + 0x754]
mov byte [ebp - 4], 0x3e
call fcn.00563ed0
lea ecx, [edi + 0x88]
mov byte [ebp - 4], 0x3d
call fcn.00415f50
mov ecx, edi
mov byte [ebp - 4], 8
call fcn.007e064c
lea ecx, [esi + 0x1d80]
mov byte [ebp - 4], 7
call fcn.007dfaa6
lea ecx, [esi + 0x1d44]
mov byte [ebp - 4], 6
call fcn.007dfaa6
lea ecx, [esi + 0x1c0c]
mov byte [ebp - 4], 5
call fcn.006337d0
lea ecx, [esi + 0x1ab0]
mov byte [ebp - 4], 4
call fcn.006361c0
lea ecx, [esi + 0x130]
mov byte [ebp - 4], 3
call fcn.0040c400
lea ecx, [esi + 0x128]
mov byte [ebp - 4], 2
call fcn.007d75e7
lea ecx, [esi + 0x124]
mov byte [ebp - 4], 1
call fcn.007d75e7
lea edi, [esi + 0xac]
mov dword [ebp - 0x24], edi
lea ecx, [edi + 0x68]
mov byte [ebp - 4], 0x45
call fcn.007d9db8
lea ecx, [edi + 0x40]
mov byte [ebp - 4], 0x44
call fcn.007d75e7
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.007dfa4c
lea ecx, [esi + 0x8c]
mov dword [ebp - 4], 0x47
call fcn.0040d0f0
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 0x46
call fcn.0040c310
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.00415840
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret