Function at 0x404819
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d0
push ebx
push esi
push edi
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and eax, 0x12
xor edx, edx
mov ecx, 0x63984b5e
div ecx
mov dword [ebp - 0x1a8], edx
mov eax, 0xf1
imul eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x1b8], eax
push 0x29
pop eax
imul eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x1c0], eax
mov eax, 0xb9
and eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp - 0x1d0]
or eax, 0x30ed
mov dword [ebp - 0x1a4], eax
mov ecx, dword [ebp - 0x1a4]
or ecx, 0xdffcf2d
mov eax, 0xc2
xor edx, edx
div ecx
mov dword [ebp - 0x1b4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
and ecx, 0x10c
or ecx, 0x5b2147d0
mov eax, dword [ebp - 0x1b4]
xor edx, edx
div ecx
mov dword [ebp - 0x1bc], edx
mov eax, dword [ebp - 0x1bc]
or eax, 0x63
mov dword [ebp - 0x1cc], eax
push 6
pop ecx
or ecx, 0x2d1d13bb
mov eax, dword [ebp - 0x1cc]
xor edx, edx
div ecx
mov dword [ebp - 0x1a0], edx
push 0x47
pop eax
sub eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x1b0]
add eax, 0x4ccb243f
mov dword [ebp - 0x1c4], eax
push 0x49
pop eax
imul eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x1ac], eax
mov eax, 0x4c82
sub eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x1c8]
mov dword [0x4231dc], eax
push bp
pop bp
xor eax, eax
add eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
pop dword [ebp - 0x118]
add eax, dword [0x4231d4]
mov dword [0x4231d8], eax
push 0x50
push 0x5c
push 0x5d
push 0xb
push 0xaa
mov eax, 0xea
push 0x5e
pop ecx
call fcn.00403918
add esp, 0x14
mov dword [0x4231dc], eax
mov dword [ebp - 0x120], 0x9e6df9da
mov dword [ebp - 0x134], 0x888c4b57
mov dword [ebp - 0x148], 0x888c4b57
mov dword [ebp - 0x14c], 0x26f1c819
mov dword [ebp - 0x140], 0xc5747cb
or dword [ebp - 0x128], 0xffffffff
mov dword [ebp - 0x11c], 0x12b80e24
mov dword [ebp - 0x144], 0xed47f1db
mov dword [ebp - 0x150], 0x6b2475be
mov dword [ebp - 0x138], 0x6b2475be
push eax
pop dword [ebp - 0x13c]
mov edx, dword [0x411168]
sub edx, dword [ebp - 0x120]
xor edx, 0xca
lea esi, [esi]
mov eax, dword [ebp - 0x134]
xor eax, dword [ebp - 0x148]
add eax, dword [ebp - 0x114]
mov ah, ah
mov edx, dword [0x41116c]
or edx, dword [ebp - 0x14c]
xor edx, 0x82
not edx
push bp
pop bp
mov ecx, eax
push dword [ebp - 0x140]
pop dword [ebp - 0x130]
mov edx, 0x56
lea eax, [eax]
rdtsc
lea ebp, [ebp]
mov edx, dword [0x411170]
xor edx, dword [0x411174]
and edx, 0x3f
push esi
pop dword [ebp - 0x12c]
xor eax, dword [ebp - 0x128]
mov dword [ebp - 0x114], eax
not dword [ebp - 0x114]
not eax
push eax
pop dword [ebp - 0x154]
mov edx, dword [ebp - 0x11c]
or edx, dword [ebp - 0x144]
xor edx, 0x7f
not edx
push esp
pop dword [ebp - 0x124]
mov eax, dword [ebp - 0x150]
sub eax, dword [ebp - 0x138]
xor eax, ecx
lea ecx, [ecx]
mov edx, 0x95
call fcn.004047ad
mov dword [ebp - 0x168], 0x9f02b752
mov dword [ebp - 0x160], 0x123329ea
mov dword [ebp - 0x164], 0xbebb6e80
mov dword [ebp - 0x170], 0xbebb6e80
or dword [ebp - 0x158], 0xffffffff
mov dword [ebp - 0x15c], 0xaf3a8787
mov dword [ebp - 0x16c], 0x4911f5de
push bp
pop bp
xor edx, edx
add edx, 0xd5
mov sp, sp
mov eax, dword [ebp - 0x168]
xor eax, dword [0x411178]
xor eax, dword [ebp - 8]
push dword [ebp - 0x160]
pop dword [0x4231d0]
mov edx, 0x23
mov ah, ah
mov ecx, dword [ebp - 0x164]
sub ecx, dword [ebp - 0x170]
xor ecx, eax
push ecx
pop ecx
mov edx, 0x3e
mov edi, edi
rdtsc
push di
pop di
xor edx, edx
or edx, 0xb9
push bx
pop bx
and eax, dword [ebp - 0x158]
mov dword [ebp - 8], eax
mov eax, eax
mov edx, dword [ebp - 0x15c]
xor edx, dword [0x41117c]
and edx, 0x60
push esp
pop esp
mov eax, dword [ebp - 0x16c]
or eax, dword [0x411180]
and eax, ecx
push sp
pop sp
xor edx, edx
sub edx, 1
xor edx, 0xbf
not edx
call fcn.004047ce
mov dword [ebp - 0x19c], 0xee29823e
mov dword [ebp - 0x17c], 0xee29823e
mov dword [ebp - 0x188], 0xbcf7c70d
mov dword [ebp - 0x194], 0x430838f2
mov dword [ebp - 0x178], 0xf5919afa
and dword [ebp - 0x184], 0
mov dword [ebp - 0x18c], 0x2640d37b
mov dword [ebp - 0x180], 0xb0faae76
push ax
pop ax
mov edx, dword [ebp - 0x19c]
sub edx, dword [ebp - 0x17c]
add edx, 0xf7
mov cx, cx
mov eax, dword [ebp - 0x188]
xor eax, dword [ebp - 0x194]
xor eax, dword [ebp - 0xc]
not eax
lea esp, [esp]
xor edx, edx
xor edx, 0xbc
lea esi, [esi]
mov ecx, dword [ebp - 0x178]
xor ecx, dword [0x411184]
or ecx, eax
push ecx
pop dword [ebp - 0x190]
mov edx, 0xc6
lea edx, [edx]
rdtsc
push ebx
pop dword [ebp - 0x198]
xor edx, edx
sub edx, 1
xor edx, 0x38
not edx
push ecx
pop dword [ebp - 0x174]
add eax, dword [ebp - 0x184]
mov dword [ebp - 0xc], eax
push sp
pop sp
xor edx, edx
dec edx
xor edx, 0x44
not edx
lea ebp, [ebp]
mov eax, dword [ebp - 0x18c]
xor eax, dword [0x411188]
xor eax, ecx
not eax
mov eax, eax
mov edx, dword [0x41118c]
or edx, dword [ebp - 0x180]
xor edx, 0x58
not edx
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xa
jle 0x404c80
xor eax, eax
jmp 0x404c9f
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x114]
xor edx, edx
div ecx
cmp eax, 0xc
jbe 0x404978
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret