Function at 0x476aa4
Capabilities:
Packed with generic packer
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push eax
push ebx
push ecx
push edx
push esi
push edi
cmp dword [ebp + 8], 0xb8
jne 0x47683e
push 0x4041ac
push 0xffffffffffffffff
push 0xffffffffffffffff
call fcn.0046b9f1
add esp, 0xc
call fcn.0046b69f
jmp 0x476ad4
cmp dword [0x404f78], 0xf9
je 0x476856
cmp dword [0x404f78], 0xfa
jne 0x476859
sub esi, 2
mov ebx, dword [0x404f24]
push esi
push ebx
cmp word [esi], 0
jne 0x47686e
cmp esi, ebx
jl 0x47686e
sub esi, 2
cmp word [esi], 0x20
je 0x476886
cmp word [esi], 9
je 0x476886
cmp word [esi], 0xa
je 0x476886
cmp word [esi], 0xd
jne 0x47688b
sub esi, 2
jmp 0x47686e
mov edx, 0x466fe4
mov edi, edx
mov ecx, 0x400
xor eax, eax
rep stosd dword es:[edi], eax
mov ax, word [esi]
mov word [edx], ax
sub esi, 2
add edx, 2
cmp word [esi], 0x20
je 0x4768d1
cmp word [esi], 9
je 0x4768d1
cmp word [esi], 0xa
je 0x4768d1
cmp word [esi], 0x3a
je 0x4768d1
cmp esi, ebx
jl 0x4768d1
mov ax, word [esi]
mov word [edx], ax
sub esi, 2
add edx, 2
jmp 0x4768a7
push 0x466fe4
call dword [sym.imp.msvcrt.dll__wcsrev]
add esp, 4
pop ebx
pop esi
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp ebx, esi
jg 0x476a15
push dword [0x404f70]
push ebx
call fcn.00472e9b
test eax, eax
je 0x476a15
add eax, eax
add ebx, eax
add dword [ebp - 4], 1
cmp word [ebx], 0
je 0x476a15
push 0x403f30
push dword [0x404f70]
call dword [sym.imp.shlwapi.dll_StrStrW]
cmp eax, 0
je 0x476999
add eax, 0xa
mov edi, eax
cmp word [eax], 0
je 0x47694f
cmp word [eax], 0x23
je 0x47694f
cmp word [eax], 0xd
je 0x47694f
add eax, 2
jmp 0x476938
cmp word [eax], 0x23
jne 0x476a10
mov word [eax], 0
push edi
call dword [sym.imp.shlwapi.dll_PathFindFileNameW]
push eax
push dword [0x404f64]
call dword [sym.imp.kernel32.dll_lstrcpyW]
push dword [0x404f70]
push ebx
call fcn.00472e9b
mov ecx, dword [ebp - 4]
sub ecx, 1
mov eax, dword [ebp - 8]
mov dword [eax*4 + 0x444fe4], ecx
mov dword [ebp - 4], 0
add dword [ebp - 8], 1
push 0x403f24
push dword [0x404f70]
call dword [sym.imp.shlwapi.dll_StrStrW]
cmp eax, 0
je 0x476a10
add eax, 0xa
mov edi, eax
cmp word [eax], 0
je 0x4769cb
cmp word [eax], 0x23
je 0x4769cb
cmp word [eax], 0xd
je 0x4769cb
add eax, 2
jmp 0x4769b4
cmp word [eax], 0x23
jne 0x476a10
mov word [eax], 0
push edi
call dword [sym.imp.shlwapi.dll_PathFindFileNameW]
push eax
push dword [0x404f64]
call dword [sym.imp.kernel32.dll_lstrcpyW]
push dword [0x404f70]
push ebx
call fcn.00472e9b
cmp dword [ebp - 8], 0
jle 0x476a00
sub dword [ebp - 8], 1
mov eax, dword [ebp - 8]
mov ecx, dword [eax*4 + 0x444fe4]
sub ecx, 1
mov dword [ebp - 4], ecx
jmp 0x4768ef
call 0x476a24
or dword [eax], eax
and byte [eax], al
or eax, 0xa00
add bh, bh
xor eax, 0x404f70
call dword [sym.imp.shlwapi.dll_StrTrimW]
nop
call 0x476a40
or dword [eax], eax
and byte [eax], al
or eax, 0xa00
add byte [eax - 0x1c], ch
outsd dx, dword [esi]
inc esi
add bh, bh
adc eax, sym.imp.shlwapi.dll_StrTrimW
push dword [0x404f70]
push 0x466fe4
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x404f64]
nop
call 0x476aa4
and eax, 0xd007300
add byte [edx], cl
add byte [0x25000a00], cl
add byte [eax + eax + 0x3a], ah
add byte [eax], ah
add byte [0x2c007300], ah
add byte [eax], ah
add byte [esi], ch
add byte gs:[ecx], ah
jb 0x476a8c
and byte [eax], al
daa
add byte [0x27007300], ah
add byte [0xd000a00], cl
add byte [edx], cl
add byte [0x7300], ah
add bh, bh
xor eax, 0x404f74
call dword [sym.imp.user32.dll_wsprintfW]
add esp, 0x1c
push 0x1010
push 0x40417a
push dword [0x404f74]
push dword [0x4012e8]
call dword [sym.imp.user32.dll_MessageBoxW]
jmp fcn.0047414d
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
leave
ret 4