Function at 0x497f00
Capabilities:
Encode data using xor
Resolve function by parsing pe exports
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x540ffc
mov eax, dword fs:[0]
push eax
sub esp, 0x570
mov eax, dword [0x463df0]
xor eax, esp
mov dword [esp + 0x56c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x463df0]
xor eax, esp
push eax
lea eax, [esp + 0x584]
mov dword fs:[0], eax
mov eax, dword [0x55af38]
test al, 1
jne 0x498bf5
xor esi, esi
or eax, 1
mov dword [0x55af38], eax
mov dword [0x59cf28], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov eax, dword [0x55af48]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
shr eax, 0x1f
mov dword [esp + 0x58c], esi
test al, 1
je 0x497fa7
call edi
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, dword [0x55af48]
and ecx, 0x3fffffff
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], eax
call fcn.004aaa50
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x9c
push esi
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
cmp ebx, esi
jne 0x497fd1
push 0x12
call edi
mov esi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push eax
call esi
jmp 0x497fd7
mov esi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push ebx
mov dword [ebx], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x497ffd
push ebx
push eax
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0xff
call edi
push eax
call esi
push 1
call fcn.0052796c
add esp, 4
test eax, eax
jne 0x498012
push 0x1c
call edi
push eax
call esi
call fcn.00527e20
test eax, eax
jne 0x498022
push 0x10
call edi
push eax
call esi
call fcn.00527fad
test eax, eax
jge 0x498035
push 0x1b
call fcn.0052827f
add esp, 4
push 1
call fcn.0052833e
add esp, 4
test eax, eax
je 0x49804c
push eax
call fcn.0052827f
add esp, 4
call fcn.00478640
mov ebp, eax
lea edi, [ebp + 0x30]
mov ecx, 0x27
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
call fcn.004abb90
mov ecx, ebp
call fcn.004abbb0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.004785c0
mov edi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
mov dword [edi + 0x218], eax
call eax
mov dword [ebp + 0x2c], eax
mov edx, 0x601
cmp word [ebp + 6], dx
push 0x400
setae al
mov byte [edi + 0x2b5], al
mov eax, 0x602
cmp word [ebp + 6], ax
mov esi, 0x55af38
setae al
mov byte [edi + 0x2b6], al
sub esi, dword [0x55af44]
lea ecx, [esp + 0x184]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x180]
push edx
lea ecx, [ebp + 8]
mov dword [ebp + 0x28], esi
call fcn.004b5f20
push pe_nt_image_headers32
lea eax, [esp + 0x80]
push 0
push eax
mov dword [esp + 0x178], 0xe
call fcn.00526600
add esp, 0xc
lea ecx, [esp + 0x170]
mov al, 0xe3
push ecx
lea ecx, [esp + 0x70]
mov byte [esp + 0x590], 1
mov byte [esp + 0x174], 0xd6
mov byte [esp + 0x175], 0xa5
mov byte [esp + 0x176], al
mov byte [esp + 0x177], 0x74
mov byte [esp + 0x178], 0x36
mov byte [esp + 0x179], 0xf2
mov byte [esp + 0x17a], al
mov byte [esp + 0x17b], 0x18
mov byte [esp + 0x17c], 0xa6
mov byte [esp + 0x17d], 0xab
mov byte [esp + 0x17e], 0xcc
mov byte [esp + 0x17f], 0xa4
mov byte [esp + 0x180], 0x76
mov byte [esp + 0x181], 0x95
mov byte [esp + 0x182], 0x69
mov byte [esp + 0x183], 0x73
call fcn.004bf600
lea ecx, [esp + 0x6c]
call fcn.004beab0
push 0x40ed8
push 0x55b04c
push 0x55b04c
lea ecx, [esp + 0x78]
call fcn.004bf000
push 0x55b04c
lea ecx, [esp + 0x70]
call fcn.004bf600
lea ecx, [esp + 0x6c]
call fcn.004beab0
push 0x30
push 0x55ce58
push 0x55ce58
lea ecx, [esp + 0x78]
call fcn.004bf000
mov ecx, edi
call fcn.00499050
test al, al
jne 0x498211
push 0xff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [0x55af38]
shr edx, 0xa
mov bl, 2
test dl, 1
je 0x498290
cmp dword [edi + 0x434], 0
je 0x498290
lea eax, [esp + 0x180]
push eax
lea ecx, [esp + 0x50]
call fcn.004bc7b0
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x50]
mov byte [esp + 0x590], bl
call fcn.004bc920
cmp dword [eax + 0x1c], 0x10
mov byte [esp + 0x58c], 3
jb 0x498263
mov eax, dword [eax + 8]
jmp 0x498266
add eax, 8
mov edx, dword [edi + 0x434]
push eax
call edx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x58c], bl
call fcn.004bbaf0
lea ecx, [esp + 0x4c]
mov byte [esp + 0x58c], 1
call fcn.004bbaf0
call fcn.00492eb0
mov ebx, 0x800000
test dword [0x55ce58], ebx
jne 0x4982f6
mov esi, dword [0x59cf40]
mov eax, dword [esi + 0x98]
mov edx, dword [eax + 0xc]
add esi, 0x98
mov ecx, esi
call edx
int3
mov ecx, ebp
call fcn.004abbe0
mov eax, dword [0x55af38]
shr eax, 1
test al, 1
jne 0x498330
mov edx, 0xd6a5e374
mov eax, 0x55af4c
mov esi, 0x40
mov ecx, dword [eax]
mov ebx, ecx
xor ebx, edx
mov dword [eax], ebx
add eax, 4
sub esi, 1
mov edx, ecx
jne 0x498317
or dword [0x55af38], 2
call fcn.0047f390
test dword [0x55ce58], 0x800000
mov ebx, eax
mov dword [esp + 0x28], ebx
jne 0x49836a
mov eax, dword [0x59cf40]
mov edx, dword [eax + 0x98]
lea esi, [eax + 0x98]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
invalid
push 0x55af38
mov ecx, ebx
call fcn.00493020
test al, al
jne 0x498413
mov ecx, dword [0x59cfac]
xor esi, esi
cmp ecx, esi
je 0x498398
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [0x59cfac], esi
mov ecx, dword [0x59cf64]
cmp ecx, esi
je 0x4983b0
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [0x59cf64], esi
mov ecx, dword [0x59cfb0]
cmp ecx, esi
je 0x4983c8
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [0x59cfb0], esi
mov ecx, dword [0x59cfa8]
cmp ecx, esi
je 0x4983e0
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [0x59cfa8], esi
mov ecx, dword [0x59e04c]
cmp ecx, esi
je 0x498404
mov esi, ecx
call fcn.00478120
push esi
call fcn.005265f5
add esp, 4
mov dword [0x59e04c], 0
call fcn.00527b3a
call fcn.0052799c
jmp 0x498c22
mov ecx, dword [0x55af38]
shr ecx, 8
test cl, 1
jne 0x49844e
mov edx, dword [ebx + 0x54]
shr edx, 0x17
test dl, 1
jne 0x49844e
cmp dword [edi + 0x2cc], 0
je 0x49844e
mov eax, dword [edi + 0x2d4]
push 0
call eax
mov ecx, dword [edi + 0x2cc]
push 0x495bb0
push 1
call ecx
test dword [0x55ce58], 0x800000
jne 0x49847e
mov esi, dword [0x59cf40]
mov edx, dword [esi + 0x98]
mov eax, dword [edx + 0xc]
add esi, 0x98
mov ecx, esi
call eax
invalid
cmp dword [0x55b05c], 0
jbe 0x498990
mov esi, dword [0x55b060]
mov ecx, dword [ebp + 0x2c]
lea esi, [esi + 0x589f24]
mov dword [esi], ecx
mov dword [esi + 4], 0x495a20
mov dword [esi + 8], 0x495150
mov dword [esi + 0xc], 0x497d20
test dword [0x55ce58], 0x800000
jne 0x4984e4
mov ebx, dword [0x59cf40]
mov edx, dword [ebx + 0x98]
mov eax, dword [edx + 0xc]
add ebx, 0x98
mov ecx, ebx
call eax
int3
mov dword [esi + 0x10], 0x4ae000
mov dword [esi + 0x14], fcn.004ad520
mov dword [esi + 0x18], 0x4ae020
mov dword [esi + 0x1c], fcn.004ad590
mov dword [esi + 0x20], 0x4ae040
mov dword [esi + 0x24], fcn.004ad600
mov dword [esi + 0x28], 0x4ae060
mov dword [esi + 0x2c], fcn.004ad6a0
mov dword [esi + 0x30], 0x4ae080
mov dword [esi + 0x34], fcn.004ad700
mov dword [esi + 0x38], 0x4acb30
mov dword [esi + 0x3c], 0x4ae0a0
mov dword [esi + 0x40], fcn.004ad7f0
mov dword [esi + 0x44], 0x4ae0c0
mov dword [esi + 0x48], fcn.004ad860
mov dword [esi + 0x4c], fcn.004ad8d0
mov dword [esi + 0x50], 0x4ad950
mov dword [esi + 0x54], fcn.004ad9c0
mov dword [esi + 0x58], 0x4ada40
mov dword [esi + 0x5c], 0x4adab0
mov dword [esi + 0x60], 0x4ae0e0
mov dword [esi + 0x64], fcn.004adae0
mov dword [esi + 0x68], 0x4ae100
mov dword [esi + 0x6c], fcn.004adb60
mov dword [esi + 0x70], fcn.004adbe0
mov dword [esi + 0x74], fcn.004adcc0
mov dword [esi + 0x78], fcn.004add90
mov dword [esi + 0x7c], fcn.004ade30
mov dword [esi + 0x80], 0x4b97a0
mov dword [esi + 0x84], 0x4ba7d0
mov dword [esi + 0x88], 0x4b8ea0
mov dword [esi + 0x8c], 0x4ba1d0
mov dword [esi + 0x90], 0x4b8fc0
mov dword [esi + 0x94], 0x4b9af0
mov dword [esi + 0x98], 0x4b9c00
mov dword [esi + 0x9c], 0x4ba900
mov dword [esi + 0xa0], 0x4b7aa0
mov dword [esi + 0xa4], 0x4b74a0
mov dword [esi + 0xa8], 0x4b75c0
mov dword [esi + 0xac], fcn.004b9d10
mov dword [esi + 0xb0], 0x4ba0b0
mov dword [esi + 0xb4], 0x4b72e0
mov dword [esi + 0xb8], 0x4ba550
mov dword [esi + 0xbc], 0x4b8900
mov dword [esi + 0xc0], fcn.004b8a20
mov dword [esi + 0xc4], 0x4b8b40
mov dword [esi + 0xc8], 0x4b8c60
mov dword [esi + 0xcc], 0x4b87e0
mov dword [esi + 0xd0], 0x4baa20
mov dword [esi + 0xd4], 0x4baca0
mov dword [esi + 0xd8], fcn.004badc0
mov dword [esi + 0xdc], fcn.004bb230
mov dword [esi + 0xe0], fcn.004bb2b0
mov dword [esi + 0xe4], 0x4baee0
mov dword [esi + 0xe8], 0x4ba410
mov dword [esi + 0xec], 0x4b90e0
mov dword [esi + 0xf0], 0x4b7bc0
mov dword [esi + 0xf4], 0x4ba2f0
mov dword [esi + 0xf8], 0x4bb000
mov dword [esi + 0xfc], 0x4bb120
mov dword [esi + 0x100], 0x4b8310
mov dword [esi + 0x104], fcn.004b76f0
mov dword [esi + 0x108], fcn.004b99e0
mov dword [esi + 0x10c], 0x4b7380
mov dword [esi + 0x110], 0x4b8d80
mov dword [esi + 0x114], fcn.004b7340
mov dword [esi + 0x118], 0x4b7fb0
mov dword [esi + 0x11c], 0x4b7830
mov dword [esi + 0x120], 0x4b9200
mov dword [esi + 0x124], fcn.004ba670
mov dword [esi + 0x128], fcn.004b98c0
mov dword [esi + 0x12c], fcn.004bb2b0
mov dword [esi + 0x130], 0x4b7d00
mov dword [esi + 0x134], 0x4b7e40
mov dword [esi + 0x138], 0x4b80d0
mov dword [esi + 0x13c], 0x4b81f0
mov dword [esi + 0x140], 0x4b8430
mov dword [esi + 0x144], 0x4b8560
mov dword [esi + 0x148], 0x4b7960
mov dword [esi + 0x14c], 0x4b9330
mov dword [esi + 0x150], 0x4b8690
mov dword [esi + 0x154], 0x4b9da0
mov dword [esi + 0x158], 0x4b7310
mov dword [esi + 0x15c], 0x4bab60
mov dword [esi + 0x160], fcn.004b9450
mov dword [esi + 0x164], fcn.004b9590
mov dword [esi + 0x168], fcn.004b96a0
mov dword [esi + 0x16c], 0x4bb3d0
mov dword [esi + 0x170], 0x4bb4d0
mov dword [esi + 0x174], 0x4bb5c0
mov dword [esi + 0x178], 0x51b5a0
mov dword [esi + 0x17c], 0x51bbc0
mov dword [esi + 0x180], 0x51bbd0
mov dword [esi + 0x184], 0x51bbc0
mov dword [esi + 0x188], 0x51bbd0
mov dword [esi + 0x18c], 0x51bbe0
mov dword [esi + 0x190], 0x51bfc0
mov dword [esi + 0x194], 0x51ce50
mov dword [esi + 0x198], 0x51d5f0
mov dword [esi + 0x19c], 0x51e220
mov dword [esi + 0x1a0], 0x51e2c0
mov dword [esi + 0x1a4], 0x51add0
mov dword [esi + 0x1a8], 0x51afa0
mov dword [esi + 0x1ac], 0x51ab90
mov dword [esi + 0x1b0], 0x51e2a0
mov dword [esi + 0x1b4], 0x51ed30
mov dword [esi + 0x1b8], 0x51bff0
mov dword [esi + 0x1bc], 0x51f080
mov dword [esi + 0x1c0], fcn.0051cab0
mov dword [esi + 0x1c4], fcn.0051b5c0
mov dword [esi + 0x1c8], 0x51d3c0
mov dword [esi + 0x1cc], 0x51ebf0
mov dword [esi + 0x1d0], 0x51ef70
mov dword [esi + 0x1d4], 0x51b8a0
mov dword [esi + 0x1d8], 0x51bcb0
mov dword [esi + 0x1dc], 0x51bd30
mov dword [esi + 0x1e0], 0x51b5b0
mov dword [esi + 0x1e4], 0x51e9c0
mov dword [esi + 0x1e8], 0x51ea40
mov dword [esi + 0x1ec], 0x51eac0
mov dword [esi + 0x1f0], 0x51eb60
mov dword [esi + 0x1f4], fcn.0051c190
mov dword [esi + 0x1f8], fcn.0051c690
mov dword [esi + 0x1fc], 0x51ab00
mov dword [esi + 0x200], fcn.0051bf70
mov dword [esi + 0x204], 0x51e640
mov dword [esi + 0x208], 0x51e760
mov dword [esi + 0x20c], 0x51e890
test dword [0x55ce58], 0x800000
jne 0x4989c5
mov esi, dword [0x59cf40]
mov edx, dword [esi + 0x98]
mov eax, dword [edx + 0xc]
add esi, 0x98
mov ecx, esi
call eax
mov byte [5], 5
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
mov ecx, esi
call eax
mov ecx, dword [ebx + 0x54]
mov edx, dword [0x55b054]
mov eax, dword [0x55b058]
shr ecx, 0x11
and cl, 1
push edx
lea ecx, [eax + 0x589f24]
sete dl
push ecx
mov ecx, dword [0x55b090]
movzx eax, dl
push eax
push ecx
call fcn.00497cb0
mov ecx, eax
call fcn.004a8da0
xor esi, esi
mov ecx, ebx
mov dword [0x55b090], esi
mov dword [0x55b054], esi
call fcn.004807a0
mov edx, dword [ebx + 0x54]
shr edx, 2
test dl, 1
je 0x498a52
mov eax, dword [0x55b06c]
mov ecx, dword [0x55b070]
push eax
mov eax, dword [0x55ce78]
lea edx, [ecx + 0x589f24]
push edx
push eax
call fcn.00497c10
mov ecx, eax
call fcn.004a0f20
mov dword [0x55ce78], esi
mov dword [0x55b06c], esi
mov dword [0x55b070], esi
mov eax, dword [ebx + 0x54]
mov ecx, eax
shr ecx, 3
test cl, 1
je 0x498a73
mov ebx, eax
shr ebx, 0x12
and bl, 1
call fcn.004941d0
mov byte [eax + 5], bl
mov ebx, dword [esp + 0x28]
test dword [0x55ce58], 0x800000
jne 0x498aa4
mov esi, dword [0x59cf40]
mov edx, dword [esi + 0x98]
mov eax, dword [edx + 0xc]
add esi, 0x98
mov ecx, esi
call eax
in ax, 0x64
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
mov ecx, esi
call eax
mov ecx, dword [0x55b07c]
mov edx, dword [0x55b078]
mov eax, dword [0x55b074]
push ecx
push edx
push eax
push 0x55af4c
call fcn.00495170
mov ecx, eax
call fcn.00495630
test dword [0x55b080], 0x10000000
je 0x498afa
mov ecx, dword [0x59e9dc]
mov edx, dword fs:[0x2c]
mov eax, dword [edx + ecx*4]
inc dword [eax + 0xee8e8]
push 0xd
call fcn.00525a7e
add esp, 4
mov dword [0x55b074], eax
xor eax, eax
test dword [0x55ce58], 0x800000
mov dword [0x55b078], eax
mov dword [0x55b07c], eax
jne 0x498b3b
mov esi, dword [0x59cf40]
mov eax, dword [esi + 0x98]
mov edx, dword [eax + 0xc]
add esi, 0x98
mov ecx, esi
call edx
mov byte [6], 6
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
mov eax, dword [0x55b080]
and al, 0x30
cmp al, 0x20
jne 0x498b7b
mov ecx, dword [ebx + 0x54]
shr ecx, 0x13
test cl, 1
jne 0x498b7b
mov edx, 0x600
cmp word [ebp + 6], dx
jae 0x498b7b
call fcn.00478640
add eax, 0xc
cmp dword [eax + 0x18], 0x10
jb 0x498b6f
mov eax, dword [eax + 4]
jmp 0x498b72
add eax, 4
push eax
mov eax, dword [edi + 0x220]
call eax
call fcn.00478640
mov ecx, dword [eax + 0x28]
add ecx, dword [0x55b08c]
test dword [0x55ce58], 0x800000
mov dword [0x59cf24], ecx
jne 0x498bbf
mov eax, dword [0x59cf40]
mov edx, dword [eax + 0x98]
lea esi, [eax + 0x98]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
in ax, 0x64
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
mov ecx, esi
call eax
mov ecx, dword [0x55af48]
and ecx, 0xc0000000
cmp ecx, 0x80000000
jne 0x498c22
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
jmp 0x498c22
shr eax, 8
test al, 1
je 0x498c22
mov eax, dword [0x55ce58]
shr eax, 4
test al, 1
jne 0x498c22
cmp dword [esp + 0x594], 0
jne 0x498c22
mov ecx, dword [esp + 0x598]
push ecx
call fcn.00497d40
add esp, 4
mov ecx, dword [esp + 0x584]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x56c]
xor ecx, esp
call fcn.00526a8a
add esp, 0x57c
ret