Function at 0x42ff5d
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
mov eax, 0x4ea2e5
call fcn.0047b598
sub esp, 0x99c
push ebx
push esi
lea eax, [ebp - 0x58]
mov esi, ecx
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetClientRect]
xor ebx, ebx
cmp dword [esi + 0x458], ebx
jne 0x42ffb7
push 0x58
call fcn.004dcbe4
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x42ffa3
call fcn.00426106
jmp 0x42ffa5
xor eax, eax
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
mov dword [esi + 0x458], eax
je 0x430082
cmp dword [0x536ce4], ebx
je 0x42ffcf
push 1
push str.NoLoadList
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SetPropA]
cmp dword [esi + 0x8c], ebx
je 0x42ffe7
push 1
push str.AppStartupRun
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SetPropA]
mov ecx, dword [esi + 0x458]
push ebx
push ebx
push ebx
push 0xe90d
lea eax, [ebp - 0x58]
push esi
push eax
push 0x56000000
push 0x534198
push 0x4f7958
call fcn.00473114
test eax, eax
jne 0x430089
mov ecx, esi
call fcn.0042f7a2
test eax, eax
je 0x43003f
mov ecx, dword [esi + 0x458]
mov eax, dword [ecx]
call dword [eax + 0x58]
mov ecx, dword [esi + 0x458]
cmp ecx, ebx
je 0x430039
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov dword [esi + 0x458], ebx
push 0xffffffffffffffff
push ebx
push 0x801f
call fcn.004e156d
mov esi, str.http:__www.PPS.tv
push 5
push esi
call fcn.0042caa0
pop ecx
test eax, eax
pop ecx
jne 0x430069
push 5
push esi
call fcn.0042cbe2
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0xfffffffffffffff7
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
jmp 0x430296
push edi
push 0x41
pop ecx
xor eax, eax
lea edi, [ebp - 0x15f]
mov byte [ebp - 0x160], bl
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x160]
mov edi, 0x536c20
push eax
push str.0C921ABA_8602_4588_9157_1AAAD9396180
mov ecx, edi
call fcn.0042e8c4
lea eax, [ebp - 0x160]
lea ecx, [ebp - 0x14]
push eax
call fcn.004dc6dc
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 1
call fcn.004dcb82
mov al, byte [ebp - 0xd]
push ebx
lea ecx, [ebp - 0x48]
mov byte [ebp - 0x48], al
call fcn.004042bd
push dword [ebp - 0x14]
lea ecx, [ebp - 0x9a8]
mov byte [ebp - 4], 2
call fcn.00420fc5
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x9a8]
push eax
call fcn.0042116e
movzx eax, word [ebp - 0x22]
push eax
movzx eax, word [ebp - 0x24]
push eax
movzx eax, word [ebp - 0x26]
push eax
movzx eax, word [ebp - 0x28]
push eax
lea eax, [ebp - 0x160]
push str._d._d._d._d
push eax
call fcn.0047c0a0
lea eax, [ebp - 0x160]
push eax
call fcn.0047baa0
add esp, 0x1c
lea ecx, [ebp - 0x48]
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.00404203
lea ecx, [ebp - 0x9a8]
call fcn.00421159
mov al, byte [ebp - 0xd]
push ebx
lea ecx, [ebp - 0x38]
mov byte [ebp - 0x20], 0x31
mov byte [ebp - 0x1f], 0x2e
mov byte [ebp - 0x1e], 0x30
mov byte [ebp - 0x1d], 0x2e
mov byte [ebp - 0x1c], 0x30
mov byte [ebp - 0x1b], 0x2e
mov byte [ebp - 0x1a], 0x31
mov byte [ebp - 0x19], 0x30
mov byte [ebp - 0x18], 0x32
mov byte [ebp - 0x17], 0x30
mov byte [ebp - 0x16], bl
mov byte [ebp - 0x38], al
call fcn.004042bd
lea eax, [ebp - 0x20]
push eax
call fcn.0047baa0
pop ecx
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x38]
call fcn.00404203
lea eax, [ebp - 0x48]
mov ecx, edi
push eax
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 4], 3
call fcn.0042e9ae
cmp eax, ebx
jne 0x4301db
mov ecx, dword [esi + 0x488]
cmp ecx, ebx
je 0x4301db
mov eax, dword [esi + 0x458]
cmp eax, ebx
jne 0x4301d2
xor eax, eax
jmp 0x4301d5
mov eax, dword [eax + 0x1c]
push eax
call fcn.0041efd1
mov ecx, dword [esi + 0x45c]
mov eax, dword [esi + 0x458]
cmp ecx, ebx
jne 0x4301ef
xor ecx, ecx
jmp 0x4301f2
mov ecx, dword [ecx + 0x1c]
push ecx
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SetParent]
push eax
call fcn.004d9165
mov eax, dword [esi + 0x45c]
mov ecx, dword [esi + 0x458]
cmp eax, ebx
je 0x430217
mov eax, dword [eax + 0x1c]
jmp 0x430219
xor eax, eax
mov dword [ecx + 0x20], eax
lea ecx, [esi + 0x374]
call fcn.00427953
mov ecx, dword [esi + 0x458]
push eax
call fcn.00426243
mov eax, dword [esi + 0x458]
cmp eax, ebx
jne 0x430241
xor eax, eax
jmp 0x430244
mov eax, dword [eax + 0x1c]
mov edi, dword [sym.imp.USER32.dll_SetPropA]
push 1
push str.NoDrawEraseBkgnd
push eax
call edi
mov esi, dword [esi + 0x458]
cmp esi, ebx
je 0x430261
mov ebx, dword [esi + 0x1c]
push 1
pop esi
push esi
push str.ppclt
push ebx
call edi
push esi
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 2
call fcn.004042bd
push esi
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.004042bd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004dc66e
mov eax, esi
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret