Function at 0x4474ee
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 0x3d0
mov eax, 0x46fe72
call fcn.0046c4ec
xor edi, edi
mov dword [ebp - 0x390], 1
push edi
push 2
mov dword [ebp - 0x38c], edi
mov dword [ebp - 0x3b4], 0x104
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x394], eax
mov dword [ebp - 0x380], 0x128
test eax, eax
je 0x44811b
mov al, 0x26
mov dword [ebp - 0x128], 0x434a4372
movsx ecx, al
mov byte [ebp - 0x150], al
mov dword [ebp - 0x124], 0x4b475441
mov dword [ebp - 0x120], 0x435e4308
mov byte [ebp - 0x11c], 0
call fcn.0043e927
push 8
mov dword [ebp - 0x384], eax
xor edx, edx
pop esi
push edx
lea ecx, [ebp - 0x384]
call fcn.0043e966
mov dword [ebp + edx*4 - 0x14c], eax
inc edx
pop ecx
cmp edx, esi
jl 0x44757a
push 0xc
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.0043ec83
movsx ecx, byte [ebp - 0x150]
mov dword [ebp - 0x12c], eax
call fcn.0043e927
mov dword [ebp - 0x384], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x384]
call fcn.0043e966
mov dword [ebp + edx*4 - 0x14c], eax
inc edx
pop ecx
cmp edx, esi
jl 0x4475c2
push dword [0x4874a0]
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 0x12c]
call fcn.0043ecf9
test eax, eax
je 0x44760c
mov dl, byte [ebp - 0x150]
xor ecx, ecx
xor byte [ecx + eax], dl
inc ecx
cmp ecx, 0xc
jb 0x4475ff
mov byte [eax + 0xc], 0
movaps xmm0, xmmword [0x47e080]
mov dword [ebp - 0x258], eax
mov al, 0x2a
movsx ecx, al
mov byte [ebp - 0x154], al
movups xmmword [ebp - 0x12c], xmm0
mov byte [ebp - 0x11c], 0
call fcn.0043e927
mov dword [ebp - 0x384], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x384]
call fcn.0043e966
mov dword [ebp + edx*4 - 0x150], eax
inc edx
pop ecx
cmp edx, esi
jl 0x44763f
push 0x10
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x12c]
push eax
call fcn.0043ec83
movsx ecx, byte [ebp - 0x154]
mov dword [ebp - 0x130], eax
call fcn.0043e927
mov dword [ebp - 0x384], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x384]
call fcn.0043e966
mov dword [ebp + edx*4 - 0x150], eax
inc edx
pop ecx
cmp edx, esi
jl 0x447687
push dword [0x4874a0]
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x130]
call fcn.0043ecf9
mov ecx, eax
test ecx, ecx
je 0x4476e4
movsx eax, byte [ebp - 0x154]
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm1, xmm0, 0
movups xmm0, xmmword [ecx]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
mov byte [ecx + 0x10], 0
mov al, 0x2f
mov dword [ebp - 0x254], ecx
movsx ecx, al
mov byte [ebp - 0x14c], al
mov dword [ebp - 0x124], 0x4a434a7b
mov dword [ebp - 0x120], 0x424e5d48
mov word [ebp - 0x11c], 0x7473
mov byte [ebp - 0x11a], 0
call fcn.0043e927
mov dword [ebp - 0x384], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x384]
call fcn.0043e966
mov dword [ebp + edx*4 - 0x148], eax
inc edx
pop ecx
cmp edx, esi
jl 0x447726
push 0xa
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x124]
push eax
call fcn.0043ec83
movsx ecx, byte [ebp - 0x14c]
mov dword [ebp - 0x128], eax
call fcn.0043e927
mov dword [ebp - 0x384], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x384]
call fcn.0043e966
mov dword [ebp + edx*4 - 0x148], eax
inc edx
pop ecx
cmp edx, esi
jl 0x44776e
push dword [0x4874a0]
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 0x128]
call fcn.0043ecf9
test eax, eax
je 0x4477b8
mov dl, byte [ebp - 0x14c]
xor ecx, ecx
xor byte [ecx + eax], dl
inc ecx
cmp ecx, 0xa
jb 0x4477ab
mov byte [eax + 0xa], 0
movaps xmm0, xmmword [0x47dcd0]
push 0x71
pop ecx
mov dword [ebp - 0x250], eax
mov al, 0x49
mov byte [ebp - 0x11c], cl
movsx ecx, al
mov byte [ebp - 0x154], al
movups xmmword [ebp - 0x12c], xmm0
mov word [ebp - 0x11b], 0x150a
mov byte [ebp - 0x119], 0
call fcn.0043e927
mov dword [ebp - 0x384], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x384]
call fcn.0043e966
mov dword [ebp + edx*4 - 0x150], eax
inc edx
pop ecx
cmp edx, esi
jl 0x4477fd
push 0x13
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x12c]
push eax
call fcn.0043ec83
movsx ecx, byte [ebp - 0x154]
mov dword [ebp - 0x130], eax
call fcn.0043e927
mov dword [ebp - 0x384], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x384]
call fcn.0043e966
mov dword [ebp + edx*4 - 0x150], eax
inc edx
pop ecx
cmp edx, esi
jl 0x447845
push dword [0x4874a0]
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x130]
call fcn.0043ecf9
test eax, eax
je 0x44788f
mov dl, byte [ebp - 0x154]
xor ecx, ecx
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0x13
jb 0x447882
mov byte [eax + 0x13], 0
mov dword [ebp - 0x24c], eax
push 0x71
pop eax
movsx ecx, al
mov byte [ebp - 0x14c], al
mov dword [ebp - 0x124], 0x2e08141a
mov dword [ebp - 0x120], 0x10051015
mov word [ebp - 0x11c], 2
call fcn.0043e927
mov dword [ebp - 0x384], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x384]
call fcn.0043e966
mov dword [ebp + edx*4 - 0x148], eax
inc edx
pop ecx
cmp edx, 8
jl 0x4478cb
push 9
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x124]
push eax
call fcn.0043ec83
movsx ecx, byte [ebp - 0x14c]
mov dword [ebp - 0x128], eax
call fcn.0043e927
mov dword [ebp - 0x384], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x384]
call fcn.0043e966
mov dword [ebp + edx*4 - 0x148], eax
inc edx
pop ecx
cmp edx, 8
jl 0x447914
push dword [0x4874a0]
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 0x128]
call fcn.0043ecf9
test eax, eax
je 0x44795f
mov dl, byte [ebp - 0x14c]
xor ecx, ecx
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 9
jb 0x447952
mov byte [eax + 9], 0
lea ecx, [ebp - 0x258]
mov dword [ebp - 0x248], eax
push ecx
lea eax, [ebp - 0x244]
push eax
push ecx
lea ecx, [ebp - 0x3a0]
call fcn.004503f6
and dword [ebp - 4], 0
lea eax, [ebp - 0x35c]
push eax
lea ecx, [ebp - 0x19c]
call fcn.00450b02
mov ecx, dword [ebp - 0x3a0]
push ecx
push dword [ecx]
mov ecx, eax
call fcn.00450934
lea ecx, [ebp - 0x19c]
mov esi, eax
call fcn.00450a63
cmp esi, 0xffffffff
je 0x4480e9
push dword [ebp - 0x378]
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x4480e9
lea ecx, [ebp - 0x3b4]
push ecx
lea ecx, [ebp - 0x118]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameA]
test eax, eax
je 0x4480e9
mov al, 0x3a
mov dword [ebp - 0x120], 0x5b5e4e66
movsx ecx, al
mov byte [ebp - 0x148], al
mov dword [ebp - 0x11c], 0x665b4e
call fcn.0043e927
mov dword [ebp - 0x384], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x384]
call fcn.0043e966
mov dword [ebp + edx*4 - 0x144], eax
inc edx
pop ecx
cmp edx, 8
jl 0x447a21
push 7
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.0043ec83
movsx ecx, byte [ebp - 0x148]
mov dword [ebp - 0x124], eax
call fcn.0043e927
mov dword [ebp - 0x384], eax
xor edx, edx
push edx
lea ecx, [ebp - 0x384]
call fcn.0043e966
mov dword [ebp + edx*4 - 0x144], eax
inc edx
pop ecx
cmp edx, 8
jl 0x447a6a
push dword [0x4874a0]
lea eax, [ebp - 0x144]
push eax
push dword [ebp - 0x124]
call fcn.0043ecf9
mov esi, eax
test esi, esi
je 0x447ab7
mov cl, byte [ebp - 0x148]
xor eax, eax
xor byte [esi + eax], cl
inc eax
cmp eax, 7
jb 0x447aaa
mov byte [esi + 7], 0
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x1cc]
call fcn.00450b02
mov edx, eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 1
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x447ad8
sub ecx, edi
lea eax, [ecx - 0xd]
mov ecx, edx
push eax
push 0
lea eax, [ebp - 0x19c]
push eax
call fcn.004508aa
push esi
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1b4]
call fcn.00451348
pop ecx
lea ecx, [ebp - 0x19c]
call fcn.00450a63
lea ecx, [ebp - 0x1cc]
mov byte [ebp - 4], 5
call fcn.00450a63
mov byte [ebp - 0x3b8], 0
lea edx, [ebp - 0x1b4]
push dword [ebp - 0x3b8]
lea ecx, [ebp - 0x184]
call fcn.00452662
pop ecx
lea ecx, [ebp - 0x184]
mov byte [ebp - 4], 6
call fcn.0043ff6d
lea ecx, [ebp - 0x184]
mov byte [ebp - 0x385], al
call fcn.00450c8d
cmp byte [ebp - 0x385], 0
je 0x4480bd
mov byte [ebp - 0x3bc], 0
lea edx, [ebp - 0x1b4]
push dword [ebp - 0x3bc]
lea ecx, [ebp - 0x184]
mov byte [ebp - 4], 7
call fcn.00452662
pop ecx
push ecx
lea eax, [ebp - 0x184]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x3c8]
call fcn.0043fc13
lea ecx, [ebp - 0x184]
call fcn.00450c8d
lea eax, [ebp - 0x3c8]
push eax
lea ecx, [ebp - 0x3a8]
call fcn.0044144e
mov edi, dword [ebp - 0x3a8]
mov esi, dword [ebp - 0x3a4]
and dword [ebp - 0x3a8], 0
and dword [ebp - 0x3a4], 0
mov dword [ebp - 0x3b0], edi
mov dword [ebp - 0x3ac], esi
lea eax, [ebp - 0x3c8]
push eax
lea ecx, [ebp - 0x3d8]
call fcn.0044144e
mov ecx, dword [ebp - 0x3d4]
xor eax, eax
xorps xmm0, xmm0
mov dword [ebp - 0x384], eax
movlpd qword [ebp - 0x3d0], xmm0
and dword [ebp - 0x3d0], 0
and dword [ebp - 0x3cc], eax
test ecx, ecx
je 0x447c32
call fcn.0042a1eb
mov eax, dword [ebp - 0x384]
cmp edi, eax
je 0x448080
lea eax, [ebp - 0x244]
mov byte [ebp - 4], 0xd
add edi, 0x20
push eax
mov ecx, edi
call fcn.0043f245
push ecx
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 0xe
push ecx
mov ecx, eax
call fcn.0045137b
mov esi, dword [ebp - 0x38c]
or esi, 0x10
mov dword [ebp - 0x38c], esi
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 0x10
call fcn.00450c8d
mov eax, dword [ebp - 0x3a0]
lea ecx, [ebp - 0x16c]
push dword [eax + 0x10]
call fcn.00452304
test al, al
jne 0x447cc3
cmp dword [ebp - 0x15c], 0x11
jne 0x448046
cmp dword [ebp - 0x158], 0x10
lea eax, [ebp - 0x16c]
cmovae eax, dword [ebp - 0x16c]
cmp byte [eax + 0x10], 0x73
jne 0x448046
push ecx
lea eax, [ebp - 0x184]
mov ecx, edi
push eax
call fcn.0045137b
or esi, 0x80
mov dword [ebp - 0x38c], esi
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x1e4]
cmp dword [ebp - 0x170], 0x10
lea esi, [ebp - 0x184]
push eax
cmovae esi, dword [ebp - 0x184]
mov ecx, edi
call fcn.0043f245
push ecx
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 0x12
push ecx
mov ecx, eax
call fcn.0045137b
mov edi, dword [ebp - 0x38c]
or edi, 0x400
mov dword [ebp - 0x38c], edi
mov edx, dword [ebp - 0x390]
lea ecx, [ebp - 0x214]
mov byte [ebp - 4], 0x13
call fcn.0042dda3
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x3a0]
push eax
mov edx, dword [ecx + 8]
lea ecx, [ebp - 0x1fc]
call fcn.004512a8
pop ecx
push 0x47d640
mov edx, eax
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x22c]
call fcn.00451348
pop ecx
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 0x16
push ecx
push eax
push dword [ebp - 0x394]
lea ecx, [ebp - 0x1cc]
call fcn.00452342
or edi, 0x2000
mov dword [ebp - 0x38c], edi
mov byte [ebp - 4], 0x17
lea edx, [ebp - 0x1cc]
cmp dword [ebp - 0x1b8], 0x10
mov ecx, dword [0x48726c]
cmovae edx, dword [ebp - 0x1cc]
push 2
push 0
push esi
call fcn.0042dc39
add esp, 0xc
lea ecx, [ebp - 0x1cc]
call fcn.00450a63
lea ecx, [ebp - 0x22c]
call fcn.00450a63
lea ecx, [ebp - 0x1fc]
call fcn.00450a63
lea ecx, [ebp - 0x214]
call fcn.00450a63
lea ecx, [ebp - 0x19c]
call fcn.00450a63
lea ecx, [ebp - 0x1e4]
call fcn.00450c8d
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x184]
call fcn.00450a63
cmp dword [ebp - 0x15c], 0x11
jne 0x448046
push 0x10
push 0
lea eax, [ebp - 0x1e4]
push eax
lea ecx, [ebp - 0x16c]
call fcn.004508aa
push eax
lea ecx, [ebp - 0x16c]
call fcn.00450a86
lea ecx, [ebp - 0x1e4]
call fcn.00450a63
push 0x47d4c0
lea edx, [ebp - 0x1b4]
lea ecx, [ebp - 0x1fc]
call fcn.004512f8
pop ecx
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 0x18
push ecx
mov edx, eax
lea ecx, [ebp - 0x214]
call fcn.0045166b
pop ecx
push str.maps
mov edx, eax
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x1e4]
call fcn.00451348
pop ecx
mov byte [ebp - 0x3c0], 0
lea ecx, [ebp - 0x19c]
push dword [ebp - 0x3c0]
mov edx, eax
mov byte [ebp - 4], 0x1a
call fcn.00452662
pop ecx
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 0x1b
call fcn.0043ff6d
lea ecx, [ebp - 0x19c]
mov byte [ebp - 0x385], al
call fcn.00450c8d
lea ecx, [ebp - 0x1e4]
call fcn.00450a63
lea ecx, [ebp - 0x214]
call fcn.00450a63
lea ecx, [ebp - 0x1fc]
mov byte [ebp - 4], 0x10
call fcn.00450a63
cmp byte [ebp - 0x385], 0
je 0x448046
push 0x47d4c0
lea edx, [ebp - 0x1b4]
lea ecx, [ebp - 0x130]
call fcn.004512f8
pop ecx
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 0x1c
push ecx
mov edx, eax
lea ecx, [ebp - 0x1cc]
call fcn.0045166b
pop ecx
push str.maps
mov edx, eax
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x184]
call fcn.00451348
pop ecx
mov esi, eax
mov byte [ebp - 4], 0x1e
cmp dword [esi + 0x14], 0x10
jb 0x447f5b
mov esi, dword [esi]
mov edx, dword [ebp - 0x390]
lea ecx, [ebp - 0x19c]
call fcn.0042dda3
mov byte [ebp - 4], 0x1f
mov ecx, dword [ebp - 0x3a0]
push eax
mov edx, dword [ecx + 8]
lea ecx, [ebp - 0x22c]
call fcn.004512a8
pop ecx
push 0x47d640
mov edx, eax
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x1fc]
call fcn.00451348
pop ecx
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 0x21
push ecx
mov edx, eax
lea ecx, [ebp - 0x214]
call fcn.0045166b
pop ecx
push str.maps
mov edx, eax
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x1e4]
call fcn.00451348
pop ecx
mov byte [ebp - 4], 0x23
cmp dword [eax + 0x14], 0x10
jb 0x447fd9
mov eax, dword [eax]
mov ecx, dword [0x48726c]
mov edx, eax
push 2
push 0
push esi
call fcn.0042dc39
add esp, 0xc
lea ecx, [ebp - 0x1e4]
call fcn.00450a63
lea ecx, [ebp - 0x214]
call fcn.00450a63
lea ecx, [ebp - 0x1fc]
call fcn.00450a63
lea ecx, [ebp - 0x22c]
call fcn.00450a63
lea ecx, [ebp - 0x19c]
call fcn.00450a63
lea ecx, [ebp - 0x184]
call fcn.00450a63
lea ecx, [ebp - 0x1cc]
call fcn.00450a63
lea ecx, [ebp - 0x130]
call fcn.00450a63
lea ecx, [ebp - 0x16c]
call fcn.00450a63
lea ecx, [ebp - 0x3b0]
mov dword [ebp - 4], 0xc
call fcn.0043fc56
mov esi, dword [ebp - 0x3ac]
mov edi, dword [ebp - 0x3b0]
mov eax, dword [ebp - 0x384]
jmp 0x447c32
test esi, esi
je 0x44808b
mov ecx, esi
call fcn.0042a1eb
mov ecx, dword [ebp - 0x3c4]
test ecx, ecx
je 0x44809a
call fcn.0042a1eb
inc dword [ebp - 0x390]
mov dword [ebp - 4], 5
mov al, byte [0x48724f]
movzx ecx, al
test al, al
push 1
pop eax
cmove ecx, eax
mov byte [0x48724f], cl
cmp dword [ebp - 0x1a0], 0x10
lea eax, [ebp - 0x1b4]
cmovae eax, dword [ebp - 0x1b4]
xor ecx, ecx
mov dword [ebp - 0x1a4], ecx
mov byte [ebp - 4], cl
mov byte [eax], cl
lea ecx, [ebp - 0x1b4]
call fcn.00450a63
lea eax, [ebp - 0x380]
push eax
push dword [ebp - 0x394]
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x447983
mov eax, dword [ebp - 0x3a0]
lea ecx, [ebp - 0x3a0]
mov dword [ebp - 0x39c], eax
call fcn.004501e1
call fcn.0046c439
ret