Function at 0x40224e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 5
jge 0x402154
push 0x40e1a0
push 0
call fcn.00405491
pop ecx
pop ecx
mov dword [ebp - 0x50], eax
push dword [ebp - 0x50]
mov eax, dword [ebp - 0x20]
imul eax, eax, 0x1a8
add eax, 0x419694
push eax
mov eax, dword [ebp - 0x20]
imul eax, eax, 0x1a8
add eax, 0x419735
push eax
call fcn.004051c0
pop ecx
pop ecx
push 0x40e1ac
push 0
call fcn.00405491
pop ecx
pop ecx
mov dword [ebp - 0x50], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
push dword [ebp - 0x50]
mov eax, dword [ebp - 0x20]
imul eax, eax, 0x1a8
add eax, 0x41983a
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x402038
call fcn.00401298
jno 0x40215e
jne 0x40215e
call 0x41d3d2ca
add byte [edx + 1], ch
push 0x4193b1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
jne 0x402172
je 0x402172
call 0xd0c43775
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
inc eax
add byte [0xb7], bh
jne 0x40219a
jge 0x402186
je 0x402188
jne 0x402188
call 0x86081aff
pop eax
invalid
jne 0x402181
mov dword [ebp - 0xa8], str.zcnCXZg1_3s8_mS6Yq85V_PCUb3RHUJ_OYmPf84TIV_nzZ_ES5JH_FiS_brZm_T2KxVC_s2C3cCw_Ey_5r_a_s_nVpfK__i4Cq_ngi_NozP_s_1ESL_D53iPtKvzL_e7i2Km7TKmU6Z9jW7V1o2Ck9qEuj8_PdUsulQ_z_Bc_bBJEBiN5xQ6F_gZiYO9_MNZ_aqqyV_GVsGzjL4_Uh597IHgBu_n_jh8Dqt_znY_aZuroF_ZBgotdK15vN4m9FmH_WwL9HoTWD_NOr8_L_xu_cXF493HzLYTr_AGp_u_LT5DQ_IIMIYyikEiLbWgMuVphQ6_b8hU5cew6ssBgWJ_itwF_pkknsRl1uXfDvIU6n1mklQ_SbS4WxecAXjvQAib_b_KbnNtm7WOWFV__ybwqe_nPzuyVWGDD_aAJg__wCumiYW3C3_USHN_mJHpVC6nG2Ot_7SWF_OBx6L_veJfePtCr_1DIbVEahZ_OcI7B__zAKERcd_8PEFnHq6Mmu_Dzi_nPnAEyoo__gg2tuPjOj9Q_cc_3J312f6Li_FG8EMQU_9RyxaRDoGdcDfK_IEC_8_1_C_vZ_G8Lc58C_wLiS_vvw_Vh9VDMBJEua__Iu_q2_hxT79_DpjaQ72_Ujk6A7dO6VL8KnoKbO_T2I__toUSAqC_21f3_4z__R_5YpWL8AhX__Vd__PIfVS_IhKRzijwl_duQiW_8v_2bFuxl_Gg_cyw_AEuw7Mh4RWZ
or eax, 0xffffffff
jmp 0x40280d
call fcn.004012f6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movsx eax, byte [0x41961d]
cmp eax, 0x31
jne 0x4021df
je 0x4021c5
jne 0x4021c5
jmp 0x5e74b1
call 0x40401c
test eax, eax
jne 0x4021d7
call 0x40410a
test eax, eax
je 0x4021df
or eax, 0xffffffff
jmp 0x40280d
je 0x4021e5
jne 0x4021e5
int 0x20
movsx eax, byte [0x41961f]
cmp eax, 0x31
jne 0x40221d
jne 0x4021f7
je 0x4021f7
call 0x1d4f0a94
add byte [eax], al
call 0x403f0a
test eax, eax
je 0x402208
or eax, 0xffffffff
jmp 0x40280d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0xac], str.BitXOkQ_fiUqntP_gRjbJ_iIy818uZQ_GrrcRbbd4Bk63cSli4_Max_w__ReSk_FSzUa__6_1gxE_YeHjJvcLbsKQ_X_zS6c_G_M4DfMRna_p__nWvvjnjCXHsMQCh1DayoCTfiRfmuSGJ_SDvpL68HdRJK_1FB2kdb_g_b__Tzpx_kPL_pN__Nb_Yw2xwLKbsTmk4tFVNbQx_vVR__OR5KYP1F_WSC8a_racF_4_EyU9Pp_nEC2fNpnSlE5I_SI_FdEx_t_OxbyXg__gS3S_tK8hXKbvoO_dpDPRI_dH__QBlFN_YDm4W6X_XaNzF7k_x_W6GXMsuNTq7hOYRz_j1_iPH_w_A5_8gMzA_aVuMXwC_vQtR4XvLqSXroEUTRpipB8kPJXAwWWmtyet_cCtUwgTjm_4Cbn4rD_YLk_e_DWf4nX_Pg_sPq_YsJYdRMZWhZ7w_Zr2FGF1W_263NG_I_AcEPLWYZKs_bU_z3Z38to_D69korOBXf_K67lEXDAWOp25dwc_h__rYq_R4L2qEK_bAD1a_3_QwNTtZauQHSk__tORKAU5_54pvZfZSu5__zyh48MS_f_rtReSN_CscX82mgPnFP_4_ETd_iPcKE6a_j3cy__VXdV___Yl_j4qGFWV_M__T_5oEX_x_pRIG5rY_F_E_2Aey6WTWo3I_fKIsZ_BegW6_7d_PeS9_ktmDQH_3NTd_EO2f57YgDHKVTM3qH_g9I_k___RW_7e_kXh2sM_NZ_d26tvQ1Z_527c6geB6fLUs33Bv2_D_eam3Hj8vCAP4aXD_oi_GygkX28RzaxL2MK4QC4PVIad6_V_qEk_YvicWFVuk_vfhoyuCWFYO9Mf_I_H_NzlX_ufX__NwFxz_YfrnFNJUmM_zcxJD_6kc_FIIGAY_mtiS9uSd_8yFt_PfQg__DVt_J1_TftGGq_43_SsT_Uv8N__JJ1rz6b_Rx26_ihgx_b_m_LUh9lzKUrWfsfc74_a3DgXVWJu
call fcn.004012fb
jb 0x402227
jae 0x402227
call 0x41d24a93
add al, ch
cmpsb byte [esi], byte es:[edi]
sbb byte [eax], al
add byte [ecx + 0x50], bl
push 0x419228
call 0x403ad7
pop ecx
push eax
push 0x419228
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pushf
jae 0x402247
je 0x40224c
jne 0x40224c
call fcn.00402533
add byte [edx - 0xc], dh
call 0x40224e
jb 0x402242
add esp, 4
popf
js 0x402258
jns 0x402258
call 0xa0305fdf
inc ecx
add byte [eax], al
cmp dword [0x419ff0], 0
je 0x402292
mov dword [ebp - 0xb0], str.U9njJdd2izJ____as_c__I_g4kG2pWyNF_H6__r6_YVnpU_r_Y5ZQ_I_EaMjaEmo3_q_qoRKw__J8LqB_529_Dz9G9Tfui2VSo_2NN__2__l9_mo_ATJZrT_d1g_aRD3iSZkZq__QdOWGw75tSwcXE7_rL2TT_yPX_bhH1_Rgf_kGsb__bD_jED_rzLPD_9GCU_VI_AB4fyb_9qWNAX_I9uK1fEtF_1t_UdsPa_qOzDmejl_8_e7En_9hUq_F_olts_eVebaDFvd_UBbLXlU9__mF
pushal
rdtsc
mov ebx, eax
mov ecx, edx
rdtsc
sub eax, ebx
sbb edx, ecx
rdtsc
add eax, ebx
adc edx, ecx
rdtsc
sub eax, ebx
jmp 0x402289
invalid
sbb edx, ecx
test edx, edx
jne 0x402285
popal
jmp 0x4022a2
mov dword [ebp - 0xb4], str.p_mO5I88di__
jge 0x4022a0
jmp 0x4022a2
jne 0x40229e
push 0x105
call fcn.0040542c
pop ecx
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x1c], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [0x419ff4], 0
je 0x4023c6
cmp dword [0x418444], 0
jne 0x4023c6
jno 0x4022f3
jne 0x4022f3
call 0x41c34f5f
add byte [eax + 0x3e], ch
xchg esi, eax
inc ecx
add bh, bh
adc eax, sym.imp.KERNEL32.dll_lstrcmpiA
push 0x41832c
push 0x41963e
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402320
je 0x40230c
jne 0x40230c
jmp 0x41d24b78
push 0x419228
push dword [ebp - 0x1c]
call fcn.004051c0
pop ecx
pop ecx
jmp 0x4023c4
push 0x418330
push 0x41963e
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x402349
clc
jae 0x402339
call 0x9f288c24
inc ecx
add bh, bh
jne 0x402325
push 0x419ee8
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4023c4
push 0x418334
call fcn.0040533f
pop ecx
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x40e9bc
push dword [ebp - 0x1c]
call fcn.004051d0
pop ecx
pop ecx
mov ecx, 4
call fcn.004023b2
jmp 0x40238f
pop ds
add byte [eax], al
add bl, ch
cli
call fcn.004023b0
jmp 0x411c8a
jmp 0x4023db
je 0x4023cc
jne 0x4023cc
int 0x20
push 0x419228
push dword [ebp - 0x1c]
call fcn.004051c0
pop ecx
pop ecx
call fcn.00401300
je 0x4023e5
jne 0x4023e5
jmp 0xc0f469b0
mov dword [ebp - 0x4c], str.kHMUusYbgTTYO__iL_PQFefXM_D1_Dx_Re_6m__1si_YaKMpGuQmxqR7zx5ZqxddSpK_mwtbeVJ_irbT9_N9sBFP_chMzJa_8sK4Orkmm7bYYqqjVkFZeMXJtghXsKj_YtGV_F_RyCANXA2gi
mov dword [ebp - 0x60], str.awBZ16dGBOggMI_Be31Kc_5Ub_O_r41L_DCJGRY_4J1KMMe9F6ogOcfczwR1WxJmi_M_rzIvuKNfgHgp__X5hU4mf_f__a47_VxLuaEzNJqTWSqZ_nfYHrCtH_4_2_a__AtpCD_HBg9__VntPkZ_J4U__SyGoQ8LGInceuPL_PHgq_Tooh9Ssas_lsi_hQkJj_VR_7n5R_RWWe_m8DEfVQc___b9I_U_Z8_wdz_5I6yf__NVTxM_f6QVkq3b_sY__P_xtsv__rwzYJs_V_wV_bEc_guDg_M369qaG1qA_49Gmg_5_YAyimCbK_l_t5_Ng_IK6tRSzGLTq_U3kJkE75uOtSQB3BGivhAmv5AlHoje__O55kyi_zq_PiXz4hy_B6_i__EnaOrhDa__bYogQ__MFpWvKr__PIB9o8RXW_P__STMEkz91AVPWzz3_nvXvgXya_gJo_Beih8aDjJ_rZ_NLFS2Dq_soz6_55_zmiHew8_MmnjRYnF_Y_lRQxG_mcM_u__a__jUgCssx_ewr214ihk_GYVpQ7g_L4ds_HeiT_lxvz5Z1Dm_N_Z_OLXHchZzhJO_U9EnNz_U5_xIsx3I5_lv_T_gX_NP2_X__vo___B_R_z5_mCOl57TLJCY7Mweo5qH7Nrq_LtUGmY2Azp4VW_HZN2I284C5Qw58___LY5wma8_ZxvQTTjrv9g9ROBCYZ_gB4gwjjsdQ_UhWqxz8LrPr6JAKdoe5Wh__tk_X1__4Y781y6o_HQz_JkpvrVML62YRsljEAH_MM2P5l2w3siiva8LodkaF9i_N6usGH1X__uoEJ_TqmcZxqcsY2PR4m__LxpWEe_BseL_IuTu__vMRsnK_15h__zyay25_1Ha9rfPfgHpN5FlvZo5Ddr3FB_vqRAbK2p_tjkAl_2IQkv1lYUHmM__pFaE_Z_Ja_jEOtNBX2ySCGdGGR_n6fiRCX9NNyq_WjxEY_SxwfuX9tpSux_S6Mr_T9_5lcx_BrqguGsr6sX2VPs_i2ZU_ivG1wZ3l_jnZjr4_9b7BZBhM_kULr_w3Hk5z_1bP8I_BDGhs__1__yytb7__F_dsP7uXeQ8__4c6_lx6LOU_83LrDQiUq__LW_u4Qe4yHqqWnj__t7LEr4sxGFHd_su7xF6_B3BiecVqu_RmvHrwh_j14XIQT_Qy_J___Jh_CbzPqZW1WnObhhOx27_p_bbvB3ueiFcQI_2vTC9K_BLISx_LCKeKC_yX_WlPmsd2Pz_P7if_P_gUtP4BRthsXjKzaO_OIeEaD1_d7Zy_g_TZ_Py_B_xMhYhhEU_Az_D5_5f2jbxyYFhgQRG77Y_DyprqdE_JY_s5__q_YQqV__FF3
push 0x105
call fcn.0040542c
pop ecx
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x14], eax
pushf
jb 0x40241b
jmp 0x402414
call 0x40241e
call 0xe9349706
add esp, 4
popf
jb 0x402411
call 0x6644e8a5
popfd
jmp 0x402426
push 0x105
call fcn.0040542c
pop ecx
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x24], eax
jl 0x402444
jmp 0x402446
je 0x402442
jge 0x40244a
jmp 0x40244c
jne 0x402448
jl 0x402453
je 0x402455
jne 0x402455
call 0x65c41dcb
lock add byte [ebx + 3], dh
je 0x40244e
and dword [ebp - 0x10], 0
jae 0x40245e
jb 0x40245e
call 0x2ec74a
inc dword [ebx - 0x14ff1f9b]
pop es
call fcn.00401305
and dword [ebp - 0x20], 0
jmp 0x402470