Function at 0x451d10
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47afd9
mov eax, dword fs:[0]
push eax
mov eax, 0x1198
call fcn.004779b0
mov eax, dword [0x49d008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1088], 0x4a
xor edx, edx
mov byte [ebp - 0x1084], 0x1f
mov byte [ebp - 0x1083], 0x24
mov byte [ebp - 0x1082], 0x3e
mov byte [ebp - 0x1081], 0x38
mov byte [ebp - 0x1080], 0x3f
mov byte [ebp - 0x107f], 0x39
mov byte [ebp - 0x107e], 0x3e
mov byte [ebp - 0x107d], 0x2f
mov byte [ebp - 0x107c], 0x2e
mov byte [ebp - 0x107b], 0x6a
mov byte [ebp - 0x107a], 0x1a
mov byte [ebp - 0x1079], 0x38
mov byte [ebp - 0x1078], 0x25
mov byte [ebp - 0x1077], 0x29
mov byte [ebp - 0x1076], 0x2f
mov byte [ebp - 0x1075], 0x39
mov byte [ebp - 0x1074], 0x39
mov al, byte [ebp - 0x1084]
mov byte [ebp - 0x1073], 0
mov al, byte [ebp + edx - 0x1084]
mov ecx, dword [ebp - 0x1088]
xor cl, al
mov byte [ebp + edx - 0x1084], cl
inc edx
cmp edx, 0x11
jb 0x451dd1
lea ecx, [ebp - 0x1084]
mov dword [ebp - 0x1028], 0
mov byte [ebp - 0x1073], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x1014], 0xf
mov byte [ebp - 0x1028], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x451e22
sub ecx, edx
lea eax, [ebp - 0x1084]
push ecx
push eax
lea ecx, [ebp - 0x1028]
call fcn.00474d00
mov dword [ebp - 4], 0
mov dword [ebp - 0x1044], 0
mov dword [ebp - 0x1034], 0
mov dword [ebp - 0x1030], 0xf
mov byte [ebp - 0x1044], 0
lea ecx, [ebp - 0x1144]
mov byte [ebp - 4], 1
call fcn.0043d1f0
lea ecx, [ebp - 0x1044]
cmp ecx, eax
je 0x451eab
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x1044], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1034], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x1130]
cmp ecx, 0x10
jb 0x451ee7
mov edx, dword [ebp - 0x1144]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x451edd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x451edd
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00476ef0
add esp, 8
lea eax, [ebp - 0x102c]
mov dword [ebp - 0x1134], 0
push eax
push 0x1000
lea eax, [ebp - 0x1010]
mov dword [ebp - 0x1130], 0xf
push eax
mov byte [ebp - 0x1144], 0
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x4529ba
mov edi, dword [ebp - 0x102c]
xor esi, esi
shr edi, 2
test edi, edi
je 0x451f47
mov ecx, dword [ebp + esi*4 - 0x1010]
test ecx, ecx
je 0x451f42
call fcn.00451440
inc esi
cmp esi, edi
jb 0x451f32
mov ecx, dword [0x4a0dfc]
mov eax, 0x2aaaaaab
sub ecx, dword [0x4a0df8]
imul ecx
sar edx, 2
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x451f89
mov ecx, dword [0x49f9e0]
mov eax, 0x2aaaaaab
sub ecx, dword [0x49f9dc]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x4529ba
mov dword [ebp - 0x108c], 0
test esi, esi
je 0x4529ba
xor edi, edi
mov dword [ebp - 0x1060], edi
nop dword [eax]
nop word [eax + eax]
mov byte [ebp - 0x1050], 0x32
xor ecx, ecx
mov byte [ebp - 0x104f], 0x3f
mov byte [ebp - 0x104e], 0x3d
mov byte [ebp - 0x104d], 0
mov al, byte [ebp - 0x1050]
nop dword [eax]
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x1050]
sub al, 0xd
mov byte [ebp + ecx - 0x1050], al
inc ecx
cmp ecx, 3
jb 0x451fe0
lea ecx, [ebp - 0x1050]
mov dword [ebp - 0x10c0], 0
mov dword [ebp - 0x10b0], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x10ac], 0xf
mov byte [ebp - 0x10c0], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x452024
sub ecx, edx
lea eax, [ebp - 0x1050]
push ecx
push eax
lea ecx, [ebp - 0x10c0]
call fcn.00474d00
mov byte [ebp - 4], 2
mov dword [ebp - 0x1068], 0x2c
mov eax, dword [ebp - 0x1068]
xor al, 0x20
mov byte [ebp - 0x1063], 0
mov byte [ebp - 0x1064], al
mov al, byte [ebp - 0x1064]
movzx eax, byte [ebp - 0x1064]
mov ecx, dword [ebp - 0x1068]
xor cl, al
mov dword [ebp - 0x10a8], 0
mov byte [ebp - 0x1064], cl
lea ecx, [ebp - 0x1064]
mov byte [ebp - 0x1063], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x1098], 0
mov dword [ebp - 0x1094], 0xf
mov byte [ebp - 0x10a8], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4520b3
sub ecx, edx
lea eax, [ebp - 0x1064]
push ecx
push eax
lea ecx, [ebp - 0x10a8]
call fcn.00474d00
lea eax, [ebp - 0x10c0]
mov byte [ebp - 4], 3
push eax
mov eax, dword [0x4a0df8]
lea esi, [ebp - 0x10a8]
sub esp, 0x18
add eax, edi
mov ecx, esp
push eax
call fcn.00474480
mov edx, esi
lea ecx, [ebp - 0x115c]
call fcn.0043c710
mov esi, dword [ebp - 0x1060]
mov edi, eax
add esi, dword [0x4a0df8]
add esp, 0x1c
cmp esi, edi
je 0x452179
mov ecx, dword [esi + 0x14]
cmp ecx, 0x10
jb 0x452147
mov eax, dword [esi]
inc ecx
cmp ecx, 0x1000
jb 0x45213d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x451ed7
mov eax, edx
push ecx
push eax
call fcn.00476ef0
add esp, 8
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
movups xmm0, xmmword [edi]
movups xmmword [esi], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov ecx, dword [ebp - 0x1148]
cmp ecx, 0x10
jb 0x4521b3
mov edx, dword [ebp - 0x115c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4521a9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x451ed7
push ecx
push edx
call fcn.00476ef0
add esp, 8
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1094]
mov dword [ebp - 0x114c], 0
mov dword [ebp - 0x1148], 0xf
mov byte [ebp - 0x115c], 0
cmp ecx, 0x10
jb 0x45220c
mov edx, dword [ebp - 0x10a8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x452202
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x451ed7
push ecx
push edx
call fcn.00476ef0
add esp, 8
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10ac]
mov dword [ebp - 0x1098], 0
mov dword [ebp - 0x1094], 0xf
mov byte [ebp - 0x10a8], 0
cmp ecx, 0x10
jb 0x452265
mov edx, dword [ebp - 0x10c0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x45225b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x451ed7
push ecx
push edx
call fcn.00476ef0
add esp, 8
mov dword [ebp - 0x10b0], 0
mov dword [ebp - 0x10ac], 0xf
mov byte [ebp - 0x10c0], 0
mov dword [ebp - 0x105c], 0x2d
mov eax, dword [ebp - 0x105c]
xor al, 0x25
mov byte [ebp - 0x1058], al
mov eax, dword [ebp - 0x105c]
inc al
xor al, 0x32
mov byte [ebp - 0x1057], al
mov eax, dword [ebp - 0x105c]
add al, 2
mov byte [ebp - 0x1055], 0
xor al, 0x30
xor edx, edx
mov byte [ebp - 0x1056], al
mov al, byte [ebp - 0x1058]
nop word [eax + eax]
mov al, byte [ebp + edx - 0x1058]
mov ecx, dword [ebp - 0x105c]
add cl, dl
xor cl, al
mov byte [ebp + edx - 0x1058], cl
inc edx
cmp edx, 3
jb 0x4522d0
lea ecx, [ebp - 0x1058]
mov dword [ebp - 0x10f0], 0
mov byte [ebp - 0x1055], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x10e0], 0
mov dword [ebp - 0x10dc], 0xf
mov byte [ebp - 0x10f0], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x452323
sub ecx, edx
lea eax, [ebp - 0x1058]
push ecx
push eax
lea ecx, [ebp - 0x10f0]
call fcn.00474d00
mov byte [ebp - 4], 4
mov dword [ebp - 0x1070], 0x72
mov eax, dword [ebp - 0x1070]
xor al, 0x20
mov byte [ebp - 0x106b], 0
mov byte [ebp - 0x106c], al
mov al, byte [ebp - 0x106c]
movzx eax, byte [ebp - 0x106c]
mov ecx, dword [ebp - 0x1070]
xor cl, al
mov dword [ebp - 0x10d8], 0
mov byte [ebp - 0x106c], cl
lea ecx, [ebp - 0x106c]
mov byte [ebp - 0x106b], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x10c8], 0
mov dword [ebp - 0x10c4], 0xf
mov byte [ebp - 0x10d8], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4523b2
sub ecx, edx
lea eax, [ebp - 0x106c]
push ecx
push eax
lea ecx, [ebp - 0x10d8]
call fcn.00474d00
lea eax, [ebp - 0x10f0]
mov byte [ebp - 4], 5
mov esi, dword [ebp - 0x1060]
lea edi, [ebp - 0x10d8]
push eax
mov eax, dword [0x49f9dc]
sub esp, 0x18
add eax, esi
mov ecx, esp
push eax
call fcn.00474480
mov edx, edi
lea ecx, [ebp - 0x1174]
call fcn.0043c710
add esi, dword [0x49f9dc]
mov edi, eax
add esp, 0x1c
cmp esi, edi
je 0x452478
mov ecx, dword [esi + 0x14]
cmp ecx, 0x10
jb 0x452446
mov eax, dword [esi]
inc ecx
cmp ecx, 0x1000
jb 0x45243c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x451ed7
mov eax, edx
push ecx
push eax
call fcn.00476ef0
add esp, 8
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
movups xmm0, xmmword [edi]
movups xmmword [esi], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov ecx, dword [ebp - 0x1160]
cmp ecx, 0x10
jb 0x4524b2
mov edx, dword [ebp - 0x1174]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4524a8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x451ed7
push ecx
push edx
call fcn.00476ef0
add esp, 8
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10c4]
mov dword [ebp - 0x1164], 0
mov dword [ebp - 0x1160], 0xf
mov byte [ebp - 0x1174], 0
cmp ecx, 0x10
jb 0x45250b
mov edx, dword [ebp - 0x10d8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x452501
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x451ed7
push ecx
push edx
call fcn.00476ef0
add esp, 8
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10dc]
mov dword [ebp - 0x10c8], 0
mov dword [ebp - 0x10c4], 0xf
mov byte [ebp - 0x10d8], 0
cmp ecx, 0x10
jb 0x452564
mov edx, dword [ebp - 0x10f0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x45255a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x451ed7
push ecx
push edx
call fcn.00476ef0
add esp, 8
mov dword [ebp - 0x10e0], 0
xor ecx, ecx
mov dword [ebp - 0x10dc], 0xf
mov byte [ebp - 0x10f0], 0
mov byte [ebp - 0x1054], 0x29
mov byte [ebp - 0x1053], 0x36
mov byte [ebp - 0x1052], 0x34
mov byte [ebp - 0x1051], 0
mov al, byte [ebp - 0x1054]
nop dword [eax]
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x1054]
sub al, 4
mov byte [ebp + ecx - 0x1054], al
inc ecx
cmp ecx, 3
jb 0x4525b0
lea ecx, [ebp - 0x1054]
mov dword [ebp - 0x1120], 0
mov dword [ebp - 0x1110], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x110c], 0xf
mov byte [ebp - 0x1120], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4525f4
sub ecx, edx
lea eax, [ebp - 0x1054]
push ecx
push eax
lea ecx, [ebp - 0x1120]
call fcn.00474d00
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1048]
mov byte [ebp - 0x1048], 0x2c
lea edx, [ecx + 1]
mov byte [ebp - 0x1047], 0
mov al, byte [ebp - 0x1048]
movzx eax, byte [ebp - 0x1048]
sub al, 0xc
mov dword [ebp - 0x1108], 0
mov byte [ebp - 0x1048], al
mov dword [ebp - 0x10f8], 0
mov dword [ebp - 0x10f4], 0xf
mov byte [ebp - 0x1108], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x452665
sub ecx, edx
lea eax, [ebp - 0x1048]
push ecx
push eax
lea ecx, [ebp - 0x1108]
call fcn.00474d00
lea eax, [ebp - 0x1120]
mov byte [ebp - 4], 7
push eax
sub esp, 0x18
lea eax, [ebp - 0x1028]
mov ecx, esp
lea esi, [ebp - 0x1108]
push eax
call fcn.00474480
mov edx, esi
lea ecx, [ebp - 0x118c]
call fcn.0043c710
mov esi, eax
add esp, 0x1c
lea eax, [ebp - 0x1028]
cmp eax, esi
je 0x452721
mov ecx, dword [ebp - 0x1014]
cmp ecx, 0x10
jb 0x4526f9
mov edx, dword [ebp - 0x1028]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4526ef
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x451ed7
push ecx
push edx
call fcn.00476ef0
add esp, 8
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x1028], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x1018], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov ecx, dword [ebp - 0x1178]
cmp ecx, 0x10
jb 0x45275b
mov edx, dword [ebp - 0x118c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x452751
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x451ed7
push ecx
push edx
call fcn.00476ef0
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10f4]
mov dword [ebp - 0x117c], 0
mov dword [ebp - 0x1178], 0xf
mov byte [ebp - 0x118c], 0
cmp ecx, 0x10
jb 0x4527b4
mov edx, dword [ebp - 0x1108]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4527aa
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x451ed7
push ecx
push edx
call fcn.00476ef0
add esp, 8
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x10f8], 0
mov dword [ebp - 0x10f4], 0xf
mov byte [ebp - 0x1108], 0
cmp ecx, 0x10
jb 0x45280d
mov edx, dword [ebp - 0x1120]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x452803
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x451ed7
push ecx
push edx
call fcn.00476ef0
add esp, 8
mov eax, dword [0x4a0df8]
sub esp, 0x18
mov edi, dword [ebp - 0x1060]
mov ecx, esp
add eax, edi
mov dword [ebp - 0x1090], esp
mov dword [ebp - 0x1110], 0
push eax
mov dword [ebp - 0x110c], 0xf
mov byte [ebp - 0x1120], 0
call fcn.00474480
sub esp, 0x18
mov byte [ebp - 4], 8
mov eax, dword [0x49f9dc]
mov ecx, esp
add eax, edi
mov dword [ebp - 0x1060], esp
push eax
call fcn.00474480
mov byte [ebp - 4], 9
xor ecx, ecx
mov byte [ebp - 0x104c], 0x57
mov byte [ebp - 0x104b], 0x4a
mov byte [ebp - 0x104a], 0
mov al, byte [ebp - 0x104c]
nop dword [eax]
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x104c]
sub al, 9
mov byte [ebp + ecx - 0x104c], al
inc ecx
cmp ecx, 2
jb 0x452890
sub esp, 0x18
lea ecx, [ebp - 0x104c]
mov edx, esp
mov dword [ebp - 0x1124], esp
lea esi, [ecx + 1]
mov dword [edx], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4528d0
sub ecx, esi
lea eax, [ebp - 0x104c]
push ecx
push eax
mov ecx, edx
call fcn.00474d00
sub esp, 0x18
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x1028]
mov dword [ebp - 0x1128], esp
mov ecx, esp
push eax
call fcn.00474480
sub esp, 0x18
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x1044]
mov ecx, esp
push eax
call fcn.00474480
lea ecx, [ebp - 0x11a4]
mov byte [ebp - 4], 1
call fcn.00445690
mov ecx, dword [ebp - 0x1190]
add esp, 0x78
cmp ecx, 0x10
jb 0x452964
mov edx, dword [ebp - 0x11a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x45295a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x451ed7
push ecx
push edx
call fcn.00476ef0
add esp, 8
mov ecx, dword [0x4a0dfc]
mov eax, 0x2aaaaaab
sub ecx, dword [0x4a0df8]
add edi, 0x18
mov esi, dword [ebp - 0x108c]
imul ecx
inc esi
mov dword [ebp - 0x1194], 0
sar edx, 2
mov eax, edx
mov dword [ebp - 0x1190], 0xf
shr eax, 0x1f
add eax, edx
mov byte [ebp - 0x11a4], 0
mov dword [ebp - 0x108c], esi
mov dword [ebp - 0x1060], edi
cmp esi, eax
jb 0x451fb0
mov eax, dword [ebp - 0x1030]
cmp eax, 0x10
jb 0x4529f2
mov edx, dword [ebp - 0x1044]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x4529e8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x452a1e
push ecx
push edx
call fcn.00476ef0
add esp, 8
mov ecx, dword [ebp - 0x1014]
cmp ecx, 0x10
jb 0x452a2e
mov edx, dword [ebp - 0x1028]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x452a24
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x452a24
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00476ef0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00476b4c
mov esp, ebp
pop ebp
ret