Function at 0x4043e0
Capabilities:
Contain obfuscated stackstrings
Delete file
Encode data using xor
Get graphical window text
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x428a61
mov eax, dword fs:[0]
push eax
mov eax, 0x13bc
call fcn.00420170
mov eax, dword [0x431060]
xor eax, esp
mov dword [esp + 0x13b8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x431060]
xor eax, esp
push eax
lea eax, [esp + 0x13d0]
mov dword fs:[0], eax
mov eax, dword [esp + 0x13e0]
mov ebp, dword [esp + 0x13e4]
mov dword [esp + 0x1c], eax
xor eax, eax
xor ebx, ebx
mov dword [esp + 0xaf4], eax
mov dword [esp + 0xaf8], eax
mov dword [esp + 0xafc], eax
mov dword [esp + 0xb00], eax
mov dword [esp + 0xb04], eax
mov dword [esp + 0xb08], eax
mov cl, 0x6c
mov dword [esp + 0xa31], eax
mov dword [esp + 0xa35], eax
mov dword [esp + 0xa39], eax
mov word [esp + 0xa3d], ax
mov byte [esp + 0xa3f], al
mov al, 0x6e
mov dl, 0x65
mov byte [esp + 0xa42], al
mov byte [esp + 0xa45], al
xor eax, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x14], ebx
mov byte [esp + 0xaec], 0x44
mov byte [esp + 0xaed], 0x4e
mov byte [esp + 0xaee], 0x46
mov byte [esp + 0xaef], 0x2e
mov byte [esp + 0xaf0], dl
mov byte [esp + 0xaf1], 0x78
mov byte [esp + 0xaf2], dl
mov byte [esp + 0xaf3], bl
mov byte [esp + 0xa20], 0x69
mov byte [esp + 0xa21], 0x6d
mov byte [esp + 0xa22], dl
mov byte [esp + 0xa23], 0x64
mov byte [esp + 0xa24], cl
mov byte [esp + 0xa25], cl
mov byte [esp + 0xa26], 0x68
mov byte [esp + 0xa27], 0x6f
mov byte [esp + 0xa28], 0x73
mov byte [esp + 0xa29], 0x74
mov byte [esp + 0xa2a], 0x31
mov byte [esp + 0xa2b], 0x30
mov byte [esp + 0xa2c], 0x2e
mov byte [esp + 0xa2d], 0x64
mov byte [esp + 0xa2e], cl
mov byte [esp + 0xa2f], cl
mov byte [esp + 0xa30], bl
mov byte [esp + 0xa40], 0x70
mov byte [esp + 0xa41], 0x69
mov byte [esp + 0xa43], 0x79
mov byte [esp + 0xa44], 0x69
mov byte [esp + 0xa46], 0x2e
mov byte [esp + 0xa47], 0x64
mov byte [esp + 0xa48], cl
mov byte [esp + 0xa49], cl
mov byte [esp + 0xa4a], bl
mov dword [esp + 0xa4b], eax
mov dword [esp + 0xa4f], eax
mov dword [esp + 0xa53], eax
mov dword [esp + 0xa57], eax
mov dword [esp + 0xa5b], eax
mov byte [esp + 0xa5f], al
mov byte [esp + 0xb0c], 0x73
mov byte [esp + 0xb0d], 0x76
mov byte [esp + 0xb0e], 0x63
mov byte [esp + 0xb0f], 0x68
mov byte [esp + 0xb10], 0x6f
mov byte [esp + 0xb11], 0x73
mov byte [esp + 0xb12], 0x74
mov byte [esp + 0xb13], 0x2e
mov byte [esp + 0xb14], dl
mov byte [esp + 0xb15], 0x78
mov byte [esp + 0xb16], dl
mov byte [esp + 0xb17], bl
mov dword [esp + 0xb18], eax
mov dword [esp + 0xb1c], eax
mov dword [esp + 0xb20], eax
mov dword [esp + 0xb24], eax
mov dword [esp + 0xb28], eax
push 0x103
lea ecx, [esp + 0xbb1]
push ebx
push ecx
mov byte [esp + 0xbb8], bl
call fcn.00417ce0
add esp, 0xc
push 0x3f
lea edx, [esp + 0xb71]
push ebx
push edx
mov byte [esp + 0xb78], bl
call fcn.00417ce0
add esp, 0xc
push 0xffffffffffffffff
lea eax, [ebp + 0xc]
push ebx
push eax
lea ecx, [esp + 0x8c]
mov dword [esp + 0xa4], 0xf
mov dword [esp + 0xa0], ebx
mov byte [esp + 0x90], bl
call fcn.00401c00
push 0x3f
lea eax, [esp + 0xb31]
push ebx
mov dword [esp + 0x13e0], ebx
push eax
mov byte [esp + 0xb38], bl
call fcn.00417ce0
add esp, 0xc
lea ecx, [esp + 0xb2c]
mov byte [esp + 0xa60], 0x2e
mov byte [esp + 0xa61], 0x64
mov byte [esp + 0xa62], 0x61
mov byte [esp + 0xa63], 0x74
mov byte [esp + 0xa64], bl
mov byte [esp + 0xa65], bl
mov dword [esp + 0xa66], ebx
call fcn.00402be0
lea ecx, [esp + 0xb6c]
call fcn.00403400
lea ecx, [esp + 0xa60]
push ecx
lea edx, [esp + 0xa44]
push edx
push 0x42e20c
push 0xffffffffffffffff
lea eax, [esp + 0xbbc]
push 0x103
push eax
call fcn.0041640e
lea ebx, [esp + 0xb04]
call fcn.00403700
mov esi, eax
push esi
call fcn.00416838
add esp, 0x1c
xor edi, edi
call fcn.0041684a
cdq
mov ecx, 0xff
idiv ecx
mov byte [esp + edi + 0xfcc], dl
call fcn.0041684a
cdq
mov ecx, 0xff
idiv ecx
inc edi
add byte [esp + edi + 0xfcb], dl
cmp edi, 0x400
jl 0x404762
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], 0
call fcn.0040a2e0
mov ebx, dword [esp + 0x88]
mov eax, 0xc0c0c0c1
mul esi
shr edx, 7
imul edx, edx, 0xaa
add esp, 4
sub esi, edx
cmp dword [esp + 0x98], 0x10
jae 0x4047d2
lea ebx, [esp + 0x84]
mov eax, 0xa
lea edi, [esp + 0x1321]
call fcn.00405d60
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x94]
mov dword [esp + 0x13bc], eax
mov byte [esp + esi + 0xfcc], 0
mov dword [esp + esi + 0xfcd], 0xffffffff
mov ecx, dword [ebx]
xor ecx, eax
xor eax, eax
mov dword [esp + esi + 0xfd1], ecx
test edi, edi
jle 0x40482b
lea esi, [esp + esi + 0xfd5]
mov dl, byte [eax + ebx]
mov byte [eax + esi], dl
inc eax
cmp eax, edi
jl 0x404820
mov cl, 0x2d
mov al, 0x44
mov dl, 0x32
mov bl, 0x42
mov byte [esp + 0xa6e], al
mov byte [esp + 0xa71], dl
mov byte [esp + 0xa7d], dl
mov dl, 0x33
mov byte [esp + 0xa8c], al
xor eax, eax
mov byte [esp + 0xa6c], 0x38
mov byte [esp + 0xa6d], 0x31
mov byte [esp + 0xa6f], 0x36
mov byte [esp + 0xa70], 0x31
mov byte [esp + 0xa72], bl
mov byte [esp + 0xa73], 0x46
mov byte [esp + 0xa74], cl
mov byte [esp + 0xa75], 0x37
mov byte [esp + 0xa76], 0x37
mov byte [esp + 0xa77], 0x36
mov byte [esp + 0xa78], 0x46
mov byte [esp + 0xa79], cl
mov byte [esp + 0xa7a], 0x34
mov byte [esp + 0xa7b], 0x63
mov byte [esp + 0xa7c], 0x36
mov byte [esp + 0xa7e], cl
mov byte [esp + 0xa7f], 0x39
mov byte [esp + 0xa80], 0x30
mov byte [esp + 0xa81], 0x35
mov byte [esp + 0xa82], 0x45
mov byte [esp + 0xa83], cl
mov byte [esp + 0xa84], 0x35
mov byte [esp + 0xa85], dl
mov byte [esp + 0xa86], 0x35
mov byte [esp + 0xa87], 0x43
mov byte [esp + 0xa88], 0x41
mov byte [esp + 0xa89], 0x45
mov byte [esp + 0xa8a], 0x41
mov byte [esp + 0xa8b], bl
mov byte [esp + 0xa8d], 0x37
mov byte [esp + 0xa8e], 0x38
mov byte [esp + 0xa8f], 0x38
mov byte [esp + 0xa90], 0
mov dword [esp + 0xa91], eax
mov dword [esp + 0xa95], eax
mov dword [esp + 0xa99], eax
mov dword [esp + 0xa9d], eax
mov dword [esp + 0xaa1], eax
mov dword [esp + 0xaa5], eax
mov word [esp + 0xaa9], ax
mov byte [esp + 0xaab], al
mov byte [esp + 0xaac], 0x36
mov byte [esp + 0xaad], bl
mov byte [esp + 0xaae], bl
mov byte [esp + 0xaaf], 0x30
mov byte [esp + 0xab0], 0x38
mov byte [esp + 0xab1], 0x37
mov byte [esp + 0xab2], bl
mov byte [esp + 0xab3], 0x43
mov byte [esp + 0xab4], cl
mov byte [esp + 0xab5], 0x43
mov byte [esp + 0xab6], dl
mov byte [esp + 0xab7], 0x36
mov byte [esp + 0xab8], 0x31
mov byte [esp + 0xab9], cl
mov byte [esp + 0xaba], 0x34
mov byte [esp + 0xabb], dl
mov byte [esp + 0xabc], 0x39
mov byte [esp + 0xabd], 0x63
mov byte [esp + 0xabe], cl
mov byte [esp + 0xabf], bl
mov byte [esp + 0xac0], 0x39
mov byte [esp + 0xac1], 0x41
mov byte [esp + 0xac2], 0x37
mov byte [esp + 0xac3], cl
mov byte [esp + 0xac4], 0x39
mov byte [esp + 0xac5], 0x46
mov byte [esp + 0xac6], 0x31
mov byte [esp + 0xac7], 0x34
mov byte [esp + 0xac8], 0x36
mov byte [esp + 0xac9], 0x35
mov byte [esp + 0xad0], al
mov dword [esp + 0xad1], eax
mov dword [esp + 0xad5], eax
mov dword [esp + 0xad9], eax
mov dword [esp + 0xadd], eax
mov dword [esp + 0xae1], eax
mov dword [esp + 0xae5], eax
mov word [esp + 0xae9], ax
mov byte [esp + 0xaeb], al
lea eax, [esp + 0xfcc]
push eax
lea ecx, [esp + 0xa70]
push ecx
mov byte [esp + 0xad2], dl
mov byte [esp + 0xad3], 0x31
mov byte [esp + 0xad4], 0x34
mov byte [esp + 0xad5], dl
mov byte [esp + 0xad6], dl
mov byte [esp + 0xad7], 0x43
call fcn.00411570
add esp, 8
test eax, eax
jne 0x404b06
mov edi, 0x259
jmp 0x404d11
lea edx, [esp + 0xaac]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x404b2c
mov edi, 0x25a
jmp 0x404d11
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x404b43
mov edi, 0x25b
jmp 0x404d11
lea eax, [esp + 0x9c]
push eax
call fcn.00411680
lea ecx, [esp + 0xa40]
push ecx
lea edx, [esp + 0xa0]
push edx
mov byte [esp + 0x13e0], 1
call fcn.00411a60
lea eax, [esp + 0xa40]
push eax
call fcn.004133d0
add esp, 4
lea esi, [esp + 0xe4]
mov dword [esp + 0xe4], vtable.CInjectIme.0
call fcn.0040fe40
mov byte [esp + 0x13d8], 2
call fcn.00405b50
test eax, eax
je 0x404bca
lea ecx, [esp + 0xaec]
push ecx
lea ecx, [esp + 0xa44]
call fcn.00410e00
add esp, 4
test eax, eax
jne 0x404c3f
mov edi, 0x226
jmp 0x404cf1
lea edx, [esp + 0xa20]
push edx
lea eax, [esp + 0xa0]
push eax
call fcn.00411a60
lea ecx, [esp + 0xa20]
push ecx
call fcn.004133d0
add esp, 4
lea edx, [esp + 0xa40]
push edx
lea eax, [esp + 0xa24]
push eax
lea ecx, [esp + 0xaf4]
push ecx
lea eax, [esp + 0xf0]
call fcn.004100c0
mov edi, eax
test edi, edi
je 0x404c3f
lea edx, [esp + 0xb0c]
push edx
lea edx, [esp + 0xa44]
lea ecx, [esp + 0xaf0]
call fcn.004159e0
add esp, 4
test eax, eax
je 0x404cf1
lea eax, [esp + 0xb2c]
push eax
mov ecx, eax
push ecx
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
je 0x404c5d
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xc8
call ebx
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 4]
push eax
call esi
mov esi, dword [esp + 0x14]
push 0x3a98
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [0x432fd4]
cmp eax, 0x102
jne 0x404cbc
test ecx, ecx
jne 0x404cac
xor eax, eax
imul eax, eax, 0x3e8
add eax, ecx
imul eax, eax, 0x3e8
add eax, 0x25c
jmp 0x404cef
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
cmp eax, 0x2c4
jne 0x404c97
mov edi, eax
jmp 0x404cf1
test ecx, ecx
je 0x404d7e
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
test eax, eax
je 0x404d7e
cmp eax, 0x2c4
jne 0x404cdc
mov edi, eax
jmp 0x404cf1
imul eax, eax, 0x3e8
add eax, ecx
imul eax, eax, 0x3e8
add eax, 0x244
mov edi, eax
lea ecx, [esp + 0xe4]
mov byte [esp + 0x13d8], 1
call fcn.0040fe00
lea ecx, [esp + 0x9c]
call fcn.00411710
lea ecx, [esp + 0x80]
mov dword [esp + 0x13d8], 0xffffffff
call fcn.004019b0
call fcn.00411640
mov eax, dword [esp + 0x14]
test eax, eax
je 0x404d3c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0xa40]
push ecx
call esi
lea edx, [esp + 0xbac]
push edx
call esi
lea eax, [esp + 0xa20]
push eax
call esi
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx + 4]
push edx
lea esi, [esp + 0xb70]
call fcn.0040f310
add esp, 4
xor eax, eax
jmp 0x405103
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0xa40]
push eax
call edi
lea ecx, [esp + 0xbac]
push ecx
call edi
lea edx, [esp + 0xa20]
push edx
call edi
push 0x103
lea eax, [esp + 0xdc1]
push 0
push eax
mov byte [esp + 0xdc8], 0
call fcn.00417ce0
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 4]
add esp, 0xc
push 0x104
lea ecx, [esp + 0xdc0]
push ecx
push 0x3e8
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea esi, [esp + 0xdbc]
call fcn.00405990
push 0x7d0
call ebx
lea ecx, [esp + 0xa40]
push ecx
call edi
lea edx, [esp + 0xbac]
push edx
call edi
lea eax, [esp + 0xa20]
push eax
call edi
xor edi, edi
lea esi, [esp + 0x18]
mov dword [esp + 0x18], edi
call fcn.00408300
mov ebx, dword [esp + 0x18]
xor eax, eax
mov edx, dword [ebp + 4]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov ecx, ebx
shl ecx, 0x10
mov eax, ebx
and eax, 0xff00
add ecx, eax
mov eax, ebx
shr eax, 8
and eax, 0xff00
shl ecx, 8
add ecx, eax
mov eax, ebx
shr eax, 0x18
mov dword [esp + 0x48], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x14], 0x18
lea esi, [ecx + eax]
movzx edi, bl
mov ecx, esi
xor ecx, edx
xor ecx, 0x39ba2d71
mov eax, ecx
shl eax, 0x10
mov edx, ecx
and edx, 0xff00
add eax, edx
mov edx, ecx
shr edx, 8
and edx, 0xff00
shl eax, 8
add eax, edx
shr ecx, 0x18
add eax, ecx
mov ecx, edi
rol eax, cl
mov cl, byte [esp + 0x14]
add cl, 2
movzx ecx, cl
sub eax, ebx
xor eax, 0x7ac9127b
mov edx, eax
shl edx, 0x10
mov ebp, eax
and ebp, 0xff00
add edx, ebp
mov ebp, eax
shl edx, 8
shr ebp, 8
and ebp, 0xff00
add edx, ebp
shr eax, 0x18
add edx, eax
sub edx, ebx
ror edx, cl
sub dword [esp + 0x14], 1
jns 0x404eb0
mov eax, ebx
and eax, 1
mov dword [esp + 0x18], eax
jne 0x404f31
sub edx, ebx
jmp 0x404f33
add edx, ebx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x6c], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x70], 0
mov dword [esp + 0x14], 0x18
mov ecx, esi
xor ecx, edx
xor ecx, 0x39ba2d71
mov eax, ecx
shl eax, 0x10
mov edx, ecx
and edx, 0xff00
add eax, edx
mov edx, ecx
shr edx, 8
and edx, 0xff00
shl eax, 8
add eax, edx
shr ecx, 0x18
add eax, ecx
mov ecx, edi
rol eax, cl
mov cl, byte [esp + 0x14]
add cl, 2
movzx ecx, cl
sub eax, ebx
xor eax, 0x7ac9127b
mov edx, eax
shl edx, 0x10
mov ebp, eax
and ebp, 0xff00
add edx, ebp
mov ebp, eax
shl edx, 8
shr ebp, 8
and ebp, 0xff00
add edx, ebp
shr eax, 0x18
add edx, eax
sub edx, ebx
ror edx, cl
sub dword [esp + 0x14], 1
jns 0x404f4e
cmp dword [esp + 0x18], 0
jne 0x404fcb
sub edx, ebx
jmp 0x404fcd
add edx, ebx
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x4c]
push ecx
mov dword [esp + 0x7c], edx
mov dword [esp + 0x80], 0
call fcn.0041642f
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x30]
push eax
call fcn.0041642f
push 0x103
lea ecx, [esp + 0xcc9]
push 0
push ecx
mov byte [esp + 0xcd0], 0
call fcn.00417ce0
add esp, 0x1c
push 0x103
lea edx, [esp + 0xec9]
push 0
push edx
mov byte [esp + 0xed0], 0
call fcn.00417ce0
add esp, 0xc
lea ecx, [esp + 0xec4]
call fcn.004034b0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x58]
inc ecx
push ecx
mov ecx, dword [esp + 0x60]
add edx, 0x76c
push edx
mov edx, dword [esp + 0x68]
push eax
mov eax, dword [esp + 0x70]
push ecx
mov ecx, dword [esp + 0x78]
push edx
mov edx, dword [esp + 0x80]
push eax
inc ecx
push ecx
add edx, 0x76c
push edx
lea eax, [esp + 0xef4]
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0xcec]
push 0x104
push ecx
call fcn.0041640e
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax + 4]
add esp, 0x40
lea edx, [esp + 0xcb4]
push edx
push 0x3eb
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
lea ecx, [esp + 0xe4]
mov byte [esp + 0x13d8], 1
call fcn.0040fe00
lea ecx, [esp + 0x9c]
call fcn.00411710
lea ecx, [esp + 0x80]
call fcn.004019b0
mov eax, 1
mov ecx, dword [esp + 0x13d0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x13b8]
xor ecx, esp
call fcn.00415dd3
add esp, 0x13c8
ret 8