Function at 0x404090
Capabilities:
Check for time delay via gettickcount
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x68
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
mov byte [esp + 0x4e], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
vmovsd xmm0, qword [0x45a250]
vmovsd qword [esp + 0x44], xmm0
nop
test eax, eax
nop
mov byte [esp + 0x4c], 0x6c
nop
test eax, eax
nop
mov byte [esp + 0x4d], 0x6c
lea eax, [esp + 0x44]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call edi
vmovups xmm0, xmmword [str.BorvWlwcflDox]
vmovups xmmword [esp + 4], xmm0
mov dword [esp + 0x13], 0x476a69
nop
test eax, eax
nop
nop
test eax, eax
nop
mov byte [esp + 4], 0x50
nop
test eax, eax
nop
nop
test eax, eax
nop
mov byte [esp + 6], 0x73
nop
test eax, eax
nop
mov byte [esp + 7], 0x74
nop
test eax, eax
nop
mov byte [esp + 8], 0x54
nop
test eax, eax
nop
mov byte [esp + 9], 0x68
nop
test eax, eax
nop
mov byte [esp + 0xa], 0x72
nop
test eax, eax
nop
mov byte [esp + 0xb], 0x65
nop
test eax, eax
nop
mov byte [esp + 0xc], 0x61
nop
test eax, eax
nop
mov byte [esp + 0xd], 0x64
nop
test eax, eax
nop
mov byte [esp + 0xe], 0x4d
nop
test eax, eax
nop
mov byte [esp + 0xf], 0x65
nop
test eax, eax
nop
mov byte [esp + 0x10], 0x73
nop
test eax, eax
nop
mov byte [esp + 0x11], 0x73
nop
test eax, eax
nop
mov byte [esp + 0x12], 0x61
nop
test eax, eax
nop
mov byte [esp + 0x13], 0x67
nop
test eax, eax
nop
mov byte [esp + 0x14], 0x65
nop
test eax, eax
nop
mov byte [esp + 0x15], 0x57
lea ebx, [esp + 4]
mov ecx, eax
mov edx, ebx
call fcn.004031f0
mov dword [esp + 0x64], eax
nop
test eax, eax
nop
mov esi, dword [0x48ab3c]
mov byte [esp + 0x45], 0x65
mov byte [esp + 0x50], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
mov byte [esp + 0x44], 0x6b
nop
test eax, eax
nop
nop
test eax, eax
nop
mov byte [esp + 0x46], 0x72
nop
test eax, eax
nop
mov byte [esp + 0x47], 0x6e
nop
test eax, eax
nop
mov byte [esp + 0x48], 0x65
nop
test eax, eax
nop
mov byte [esp + 0x49], 0x6c
nop
test eax, eax
nop
mov byte [esp + 0x4a], 0x33
nop
test eax, eax
nop
mov byte [esp + 0x4b], 0x32
nop
test eax, eax
nop
mov byte [esp + 0x4c], 0x2e
nop
test eax, eax
nop
mov byte [esp + 0x4d], 0x64
nop
test eax, eax
nop
mov byte [esp + 0x4e], 0x6c
nop
test eax, eax
nop
mov byte [esp + 0x4f], 0x6c
lea ecx, [esp + 0x44]
mov ebp, ecx
call fcn.00403510
vmovups xmm0, xmmword [str.UeuAvvwci_byiljFt]
vmovups xmmword [esp + 4], xmm0
mov dword [esp + 0x13], 0x74466a
nop
test eax, eax
nop
nop
test eax, eax
nop
mov byte [esp + 4], 0x47
nop
test eax, eax
nop
nop
test eax, eax
nop
mov byte [esp + 6], 0x74
nop
test eax, eax
nop
mov byte [esp + 7], 0x43
nop
test eax, eax
nop
mov byte [esp + 8], 0x75
nop
test eax, eax
nop
mov byte [esp + 9], 0x72
nop
test eax, eax
nop
mov byte [esp + 0xa], 0x72
nop
test eax, eax
nop
mov byte [esp + 0xb], 0x65
nop
test eax, eax
nop
mov byte [esp + 0xc], 0x6e
nop
test eax, eax
nop
mov byte [esp + 0xd], 0x74
nop
test eax, eax
nop
mov byte [esp + 0xe], 0x54
nop
test eax, eax
nop
mov byte [esp + 0xf], 0x68
nop
test eax, eax
nop
mov byte [esp + 0x10], 0x72
nop
test eax, eax
nop
mov byte [esp + 0x11], 0x65
nop
test eax, eax
nop
mov byte [esp + 0x12], 0x61
nop
test eax, eax
nop
mov byte [esp + 0x13], 0x64
nop
test eax, eax
nop
mov byte [esp + 0x14], 0x49
nop
test eax, eax
nop
mov byte [esp + 0x15], 0x64
push ebx
push eax
call esi
mov esi, eax
nop
test eax, eax
nop
mov byte [esp + 0x4e], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
vmovsd xmm0, qword [0x45a250]
vmovsd qword [esp + 0x44], xmm0
nop
test eax, eax
nop
mov byte [esp + 0x4c], 0x6c
nop
test eax, eax
nop
mov byte [esp + 0x4d], 0x6c
push ebp
call edi
mov byte [esp + 5], 0x65
mov byte [esp + 0x10], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
mov byte [esp + 4], 0x50
nop
test eax, eax
nop
nop
test eax, eax
nop
mov byte [esp + 6], 0x65
nop
test eax, eax
nop
mov byte [esp + 7], 0x6b
nop
test eax, eax
nop
mov byte [esp + 8], 0x4d
nop
test eax, eax
nop
mov byte [esp + 9], 0x65
nop
test eax, eax
nop
mov byte [esp + 0xa], 0x73
nop
test eax, eax
nop
mov byte [esp + 0xb], 0x73
nop
test eax, eax
nop
mov byte [esp + 0xc], 0x61
nop
test eax, eax
nop
mov byte [esp + 0xd], 0x67
nop
test eax, eax
nop
mov byte [esp + 0xe], 0x65
nop
test eax, eax
nop
mov byte [esp + 0xf], 0x57
lea edx, [esp + 4]
mov ecx, eax
mov edi, edx
call fcn.004031f0
mov dword [esp + 0x60], eax
nop
test eax, eax
nop
nop
test eax, eax
nop
call esi
mov esi, eax
mov byte [esp + 4], 0x34
mov byte [esp + 6], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
mov byte [esp + 5], 0x30
push edi
call sub.msvcrt.dll_atoi
add esp, 4
mov edi, eax
mov byte [esp + 0x44], 0x31
mov byte [esp + 0x46], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
mov byte [esp + 0x45], 0x32
push ebp
call sub.msvcrt.dll_atoi
add esp, 4
mov ebx, eax
mov byte [esp], 0x31
mov byte [esp + 2], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
mov byte [esp + 1], 0x38
mov ebp, esp
push ebp
call sub.msvcrt.dll_atoi
add esp, 4
push eax
push ebx
push edi
push esi
call dword [esp + 0x74]
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
mov word [esp + 4], 0x30
lea eax, [esp + 4]
mov ebx, eax
push eax
call sub.msvcrt.dll_atoi
add esp, 4
mov esi, eax
nop
test eax, eax
nop
nop
test eax, eax
nop
mov word [esp], 0x30
push ebp
call sub.msvcrt.dll_atoi
add esp, 4
mov edi, eax
nop
test eax, eax
nop
nop
test eax, eax
nop
mov word [esp + 0x40], 0x30
lea eax, [esp + 0x40]
push eax
call sub.msvcrt.dll_atoi
add esp, 4
push eax
push edi
push esi
push 0xffffffffffffffff
lea eax, [esp + 0x54]
push eax
call dword [esp + 0x74]
test eax, eax
je 0x4046b7
mov esi, dword [esp + 0x48]
mov byte [esp + 4], 0x34
mov byte [esp + 6], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
mov byte [esp + 5], 0x30
mov ebp, ebx
push ebx
call sub.msvcrt.dll_atoi
add esp, 4
nop
test eax, eax
nop
nop
test eax, eax
nop
cmp esi, eax
jne 0x404744
movzx ebx, byte [esp + 0x7c]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov esi, eax
nop
test eax, eax
nop
mov byte [esp + 8], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
mov dword [esp + 4], 0x30303131
push ebp
call sub.msvcrt.dll_atoi
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
nop
test eax, eax
nop
call edi
nop
test eax, eax
nop
nop
test eax, eax
nop
test bl, bl
je 0x4047b5
mov edi, eax
nop
test eax, eax
nop
sub edi, esi
mov byte [esp + 8], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
mov dword [esp + 4], 0x30303031
push ebp
call sub.msvcrt.dll_atoi
add esp, 4
nop
test eax, eax
nop
cmp edi, eax
jae 0x4047b5
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
vmovsd xmm0, qword [0x48033a]
vmovsd qword [esp + 0x24], xmm0
vmovups ymm0, ymmword [str.Gus_kewbpiohbk6f3g_fgwkn_huwl]
vmovups ymmword [esp + 4], ymm0
nop
test eax, eax
nop
xor eax, eax
nop word cs:[eax + eax]
nop
test eax, eax
nop
lea ecx, [eax + 0xfe]
lea edx, [eax + 0x27]
cmp eax, 2
cmovb ecx, edx
xor byte [esp + eax + 4], cl
inc eax
cmp eax, 0x27
jne 0x404680
nop
test eax, eax
nop
vzeroupper
call fcn.00403a20
nop
test eax, eax
nop
xor eax, eax
jmp 0x4047bc
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
vmovups ymm0, ymmword [0x4802fa]
vmovups ymmword [esp + 0x18], ymm0
vmovups ymm0, ymmword [str.j_us_sg_bhmzd_x_z_aa_5b]
vmovups ymmword [esp + 4], ymm0
nop
test eax, eax
nop
xor eax, eax
nop word [eax + eax]
nop
test eax, eax
nop
lea ecx, [eax + 0xfe]
lea edx, [eax + 0x33]
cmp eax, 2
cmovb ecx, edx
xor byte [esp + eax + 4], cl
inc eax
cmp eax, 0x33
jne 0x404710
nop
test eax, eax
nop
vzeroupper
call fcn.00403a20
nop
test eax, eax
nop
xor eax, eax
jmp 0x4047bc
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
vmovups ymm0, ymmword [0x4802a0]
vmovups ymmword [esp + 0x20], ymm0
vmovups ymm0, ymmword [str.Ynwq_v]
vmovups ymmword [esp + 4], ymm0
nop
test eax, eax
nop
xor eax, eax
nop word [eax + eax]
nop
test eax, eax
nop
xor byte [esp + eax + 4], al
inc eax
cmp eax, 0x3b
jne 0x404790
nop
test eax, eax
nop
vzeroupper
call fcn.00403a20
nop
test eax, eax
nop
xor eax, eax
jmp 0x4047bc
nop
test eax, eax
nop
mov al, 1
add esp, 0x68
pop esi
pop edi
pop ebx
pop ebp
ret