Function at 0x421560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8b4
mov eax, dword [0x465040]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, byte [0x4692e8]
mov dword [ebp - 8], edx
push ebx
mov ebx, 0x7f
mov dword [ebp - 0x8b4], ebx
push esi
mov esi, ecx
push edi
sub eax, 0
je 0x421fc4
sub eax, 1
je 0x4216d9
sub eax, 1
jne 0x421fc4
mov byte [ebp - 0x88c], al
mov byte [ebp - 0x88b], 0x4a
mov byte [ebp - 0x88a], 0x59
mov byte [ebp - 0x889], 0x4a
mov byte [ebp - 0x888], 0x59
mov byte [ebp - 0x887], 0x12
mov byte [ebp - 0x886], 0x59
mov byte [ebp - 0x885], 0x4a
mov byte [ebp - 0x884], 0x59
mov byte [ebp - 0x883], 0x1d
mov byte [ebp - 0x882], 0x59
mov byte [ebp - 0x881], 0x60
mov byte [ebp - 0x880], 0x59
mov byte [ebp - 0x87f], 0x76
mov byte [ebp - 0x87e], 0x59
mov byte [ebp - 0x87d], 0x30
mov byte [ebp - 0x87c], 0x59
mov byte [ebp - 0x87b], 0x17
mov byte [ebp - 0x87a], 0x59
mov byte [ebp - 0x879], 0x1d
mov byte [ebp - 0x878], 0x59
mov byte [ebp - 0x877], 0x43
mov byte [ebp - 0x876], 0x59
mov byte [ebp - 0x875], 0x38
mov byte [ebp - 0x874], 0x59
mov byte [ebp - 0x873], 0x59
mov byte [ebp - 0x872], 0x59
mov al, byte [ebp - 0x88b]
mov al, byte [ebp - 0x88c]
test al, al
jne 0x4216ad
xor edi, edi
nop word [eax + eax]
mov al, byte [ebp + edi - 0x88b]
mov ecx, 0x59
movzx eax, al
sub ecx, eax
lea eax, [ecx + ecx*4]
shl eax, 3
cdq
idiv ebx
lea eax, [edx + 0x7f]
cdq
idiv ebx
mov byte [ebp + edi - 0x88b], dl
inc edi
cmp edi, 0x1a
jb 0x421680
push 0
push 0x40000080
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x88b]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x8b0], ebx
jmp 0x42180a
mov byte [ebp - 0x8ac], 0
mov byte [ebp - 0x8ab], 0x5a
mov byte [ebp - 0x8aa], 0x6c
mov byte [ebp - 0x8a9], 0x5a
mov byte [ebp - 0x8a8], 0x6c
mov byte [ebp - 0x8a7], 0x63
mov byte [ebp - 0x8a6], 0x6c
mov byte [ebp - 0x8a5], 0x5a
mov byte [ebp - 0x8a4], 0x6c
mov byte [ebp - 0x8a3], 0x4b
mov byte [ebp - 0x8a2], 0x6c
mov byte [ebp - 0x8a1], 0x24
mov byte [ebp - 0x8a0], 0x6c
mov byte [ebp - 0x89f], 0x79
mov byte [ebp - 0x89e], 0x6c
mov byte [ebp - 0x89d], 0x5b
mov byte [ebp - 0x89c], 0x6c
mov byte [ebp - 0x89b], 0x59
mov byte [ebp - 0x89a], 0x6c
mov byte [ebp - 0x899], 0x23
mov byte [ebp - 0x898], 0x6c
mov byte [ebp - 0x897], 0x3f
mov byte [ebp - 0x896], 0x6c
mov byte [ebp - 0x895], 0x31
mov byte [ebp - 0x894], 0x6c
mov byte [ebp - 0x893], 8
mov byte [ebp - 0x892], 0x6c
mov byte [ebp - 0x891], 0x6c
mov byte [ebp - 0x890], 0x6c
mov al, byte [ebp - 0x8ab]
mov al, byte [ebp - 0x8ac]
test al, al
jne 0x4217e6
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x8ab]
movzx eax, al
sub eax, 0x6c
lea eax, [eax + eax*8]
cdq
idiv ebx
lea eax, [edx + 0x7f]
cdq
idiv ebx
mov byte [ebp + ecx - 0x8ab], dl
inc ecx
cmp ecx, 0x1c
jb 0x4217c0
push 0
push 0x80
push 3
push 0
push 0
push 3
lea eax, [ebp - 0x8ab]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x8b0], eax
cmp ebx, 0xffffffff
je 0x421fbf
cmp dword [esi + 0x14], 7
mov edi, esi
jbe 0x42181d
mov edi, dword [esi]
mov byte [ebp - 0x870], 0
mov byte [ebp - 0x86f], 0x1a
mov byte [ebp - 0x86e], 0x33
mov byte [ebp - 0x86d], 0x23
mov byte [ebp - 0x86c], 0x33
mov byte [ebp - 0x86b], 0x69
mov byte [ebp - 0x86a], 0x33
mov byte [ebp - 0x869], 0x2d
mov byte [ebp - 0x868], 0x33
mov byte [ebp - 0x867], 0x43
mov byte [ebp - 0x866], 0x33
mov byte [ebp - 0x865], 0x28
mov byte [ebp - 0x864], 0x33
mov byte [ebp - 0x863], 0x6d
mov byte [ebp - 0x862], 0x33
mov byte [ebp - 0x861], 0x66
mov byte [ebp - 0x860], 0x33
mov byte [ebp - 0x85f], 0x47
mov byte [ebp - 0x85e], 0x33
mov byte [ebp - 0x85d], 0x4e
mov byte [ebp - 0x85c], 0x33
mov byte [ebp - 0x85b], 9
mov byte [ebp - 0x85a], 0x33
mov byte [ebp - 0x859], 0x3d
mov byte [ebp - 0x858], 0x33
mov byte [ebp - 0x857], 0x47
mov byte [ebp - 0x856], 0x33
mov byte [ebp - 0x855], 0x4e
mov byte [ebp - 0x854], 0x33
mov byte [ebp - 0x853], 0x77
mov byte [ebp - 0x852], 0x33
mov byte [ebp - 0x851], 0x2d
mov byte [ebp - 0x850], 0x33
mov byte [ebp - 0x84f], 0x24
mov byte [ebp - 0x84e], 0x33
mov byte [ebp - 0x84d], 0x4d
mov byte [ebp - 0x84c], 0x33
mov byte [ebp - 0x84b], 0x46
mov byte [ebp - 0x84a], 0x33
mov byte [ebp - 0x849], 0x38
mov byte [ebp - 0x848], 0x33
mov byte [ebp - 0x847], 0x2d
mov byte [ebp - 0x846], 0x33
mov byte [ebp - 0x845], 0x34
mov byte [ebp - 0x844], 0x33
mov byte [ebp - 0x843], 0x40
mov byte [ebp - 0x842], 0x33
mov byte [ebp - 0x841], 0x2d
mov byte [ebp - 0x840], 0x33
mov byte [ebp - 0x83f], 0x10
mov byte [ebp - 0x83e], 0x33
mov byte [ebp - 0x83d], 0x36
mov byte [ebp - 0x83c], 0x33
mov byte [ebp - 0x83b], 0x6d
mov byte [ebp - 0x83a], 0x33
mov byte [ebp - 0x839], 0x2d
mov byte [ebp - 0x838], 0x33
mov byte [ebp - 0x837], 0x1e
mov byte [ebp - 0x836], 0x33
mov byte [ebp - 0x835], 0x6d
mov byte [ebp - 0x834], 0x33
mov byte [ebp - 0x833], 0x36
mov byte [ebp - 0x832], 0x33
mov byte [ebp - 0x831], 0x58
mov byte [ebp - 0x830], 0x33
mov byte [ebp - 0x82f], 0x28
mov byte [ebp - 0x82e], 0x33
mov byte [ebp - 0x82d], 0x55
mov byte [ebp - 0x82c], 0x33
mov byte [ebp - 0x82b], 0x55
mov byte [ebp - 0x82a], 0x33
mov byte [ebp - 0x829], 0x2d
mov byte [ebp - 0x828], 0x33
mov byte [ebp - 0x827], 4
mov byte [ebp - 0x826], 0x33
mov byte [ebp - 0x825], 0x34
mov byte [ebp - 0x824], 0x33
mov byte [ebp - 0x823], 0x55
mov byte [ebp - 0x822], 0x33
mov byte [ebp - 0x821], 4
mov byte [ebp - 0x820], 0x33
mov byte [ebp - 0x81f], 0x33
mov byte [ebp - 0x81e], 0x33
mov al, byte [ebp - 0x86f]
mov al, byte [ebp - 0x870]
test al, al
jne 0x421aae
xor ecx, ecx
nop dword [eax]
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x86f]
movzx eax, al
sub eax, 0x33
imul eax, eax, 0x25
cdq
idiv dword [ebp - 0x8b4]
lea eax, [edx + 0x7f]
cdq
idiv dword [ebp - 0x8b4]
mov byte [ebp + ecx - 0x86f], dl
inc ecx
cmp ecx, 0x52
jb 0x421a80
push edi
push dword [ebp - 8]
lea eax, [ebp - 0x86f]
push eax
call fcn.00424150
movzx eax, byte [0x4692e8]
add esp, 0xc
mov dword [ebp - 0xc], 0
sub eax, 0
je 0x421d1c
sub eax, 1
je 0x421b16
sub eax, 1
jne 0x421d1c
mov eax, dword [ebp - 8]
push 0
mov dword [ebp - 0x814], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x808
lea eax, [ebp - 0x818]
mov dword [ebp - 0x818], 1
push eax
push 0x22e010
jmp 0x421b2b
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 4
lea eax, [ebp - 8]
push eax
push 0x22e044
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x421d1c
cmp dword [esi + 0x14], 7
jbe 0x421b42
mov esi, dword [esi]
mov byte [ebp - 0x854], 0
mov byte [ebp - 0x853], 0x59
mov byte [ebp - 0x852], 0x29
mov byte [ebp - 0x851], 0x1a
mov byte [ebp - 0x850], 0x29
mov byte [ebp - 0x84f], 0x2c
mov byte [ebp - 0x84e], 0x29
mov byte [ebp - 0x84d], 0x53
mov byte [ebp - 0x84c], 0x29
mov byte [ebp - 0x84b], 0x13
mov byte [ebp - 0x84a], 0x29
mov byte [ebp - 0x849], 0x10
mov byte [ebp - 0x848], 0x29
mov byte [ebp - 0x847], 0x14
mov byte [ebp - 0x846], 0x29
mov byte [ebp - 0x845], 0x24
mov byte [ebp - 0x844], 0x29
mov byte [ebp - 0x843], 0x76
mov byte [ebp - 0x842], 0x29
mov byte [ebp - 0x841], 0x39
mov byte [ebp - 0x840], 0x29
mov byte [ebp - 0x83f], 0x39
mov byte [ebp - 0x83e], 0x29
mov byte [ebp - 0x83d], 0x53
mov byte [ebp - 0x83c], 0x29
mov byte [ebp - 0x83b], 0x62
mov byte [ebp - 0x83a], 0x29
mov byte [ebp - 0x839], 0x76
mov byte [ebp - 0x838], 0x29
mov byte [ebp - 0x837], 0x10
mov byte [ebp - 0x836], 0x29
mov byte [ebp - 0x835], 0x41
mov byte [ebp - 0x834], 0x29
mov byte [ebp - 0x833], 0x1c
mov byte [ebp - 0x832], 0x29
mov byte [ebp - 0x831], 0x6a
mov byte [ebp - 0x830], 0x29
mov byte [ebp - 0x82f], 0x51
mov byte [ebp - 0x82e], 0x29
mov byte [ebp - 0x82d], 0x62
mov byte [ebp - 0x82c], 0x29
mov byte [ebp - 0x82b], 0x76
mov byte [ebp - 0x82a], 0x29
mov byte [ebp - 0x829], 0x4d
mov byte [ebp - 0x828], 0x29
mov byte [ebp - 0x827], 6
mov byte [ebp - 0x826], 0x29
mov byte [ebp - 0x825], 0x53
mov byte [ebp - 0x824], 0x29
mov byte [ebp - 0x823], 0x22
mov byte [ebp - 0x822], 0x29
mov byte [ebp - 0x821], 0x39
mov byte [ebp - 0x820], 0x29
mov byte [ebp - 0x81f], 0x29
mov byte [ebp - 0x81e], 0x29
mov al, byte [ebp - 0x853]
mov al, byte [ebp - 0x854]
test al, al
jne 0x421d10
xor edi, edi
lea ebx, [edi + 0x7f]
nop dword [eax + eax]
mov al, byte [ebp + edi - 0x853]
movzx ecx, al
sub ecx, 0x29
mov eax, ecx
shl eax, 5
sub eax, ecx
cdq
idiv ebx
lea eax, [edx + 0x7f]
cdq
idiv ebx
mov byte [ebp + edi - 0x853], dl
inc edi
cmp edi, 0x36
jb 0x421ce0
mov ebx, dword [ebp - 0x8b0]
push esi
lea eax, [ebp - 0x853]
jmp 0x421f9c
mov byte [ebp - 0x870], 0
mov byte [ebp - 0x86f], 0x36
mov byte [ebp - 0x86e], 0x74
mov byte [ebp - 0x86d], 3
mov byte [ebp - 0x86c], 0x74
mov byte [ebp - 0x86b], 1
mov byte [ebp - 0x86a], 0x74
mov byte [ebp - 0x869], 0x1e
mov byte [ebp - 0x868], 0x74
mov byte [ebp - 0x867], 0x5c
mov byte [ebp - 0x866], 0x74
mov byte [ebp - 0x865], 0x2b
mov byte [ebp - 0x864], 0x74
mov byte [ebp - 0x863], 0x25
mov byte [ebp - 0x862], 0x74
mov byte [ebp - 0x861], 0x40
mov byte [ebp - 0x860], 0x74
mov byte [ebp - 0x85f], 0x60
mov byte [ebp - 0x85e], 0x74
mov byte [ebp - 0x85d], 0x2b
mov byte [ebp - 0x85c], 0x74
mov byte [ebp - 0x85b], 0x17
mov byte [ebp - 0x85a], 0x74
mov byte [ebp - 0x859], 0x20
mov byte [ebp - 0x858], 0x74
mov byte [ebp - 0x857], 0x37
mov byte [ebp - 0x856], 0x74
mov byte [ebp - 0x855], 0x20
mov byte [ebp - 0x854], 0x74
mov byte [ebp - 0x853], 0x7a
mov byte [ebp - 0x852], 0x74
mov byte [ebp - 0x851], 0x5a
mov byte [ebp - 0x850], 0x74
mov byte [ebp - 0x84f], 0x10
mov byte [ebp - 0x84e], 0x74
mov byte [ebp - 0x84d], 0x20
mov byte [ebp - 0x84c], 0x74
mov byte [ebp - 0x84b], 0x30
mov byte [ebp - 0x84a], 0x74
mov byte [ebp - 0x849], 0x1e
mov byte [ebp - 0x848], 0x74
mov byte [ebp - 0x847], 0x50
mov byte [ebp - 0x846], 0x74
mov byte [ebp - 0x845], 0x16
mov byte [ebp - 0x844], 0x74
mov byte [ebp - 0x843], 0x40
mov byte [ebp - 0x842], 0x74
mov byte [ebp - 0x841], 0x30
mov byte [ebp - 0x840], 0x74
mov byte [ebp - 0x83f], 0x2b
mov byte [ebp - 0x83e], 0x74
mov byte [ebp - 0x83d], 6
mov byte [ebp - 0x83c], 0x74
mov byte [ebp - 0x83b], 0x1e
mov byte [ebp - 0x83a], 0x74
mov byte [ebp - 0x839], 0x50
mov byte [ebp - 0x838], 0x74
mov byte [ebp - 0x837], 0x20
mov byte [ebp - 0x836], 0x74
mov byte [ebp - 0x835], 0x10
mov byte [ebp - 0x834], 0x74
mov byte [ebp - 0x833], 0x1e
mov byte [ebp - 0x832], 0x74
mov byte [ebp - 0x831], 0x1c
mov byte [ebp - 0x830], 0x74
mov byte [ebp - 0x82f], 0x17
mov byte [ebp - 0x82e], 0x74
mov byte [ebp - 0x82d], 0x5c
mov byte [ebp - 0x82c], 0x74
mov byte [ebp - 0x82b], 0x67
mov byte [ebp - 0x82a], 0x74
mov byte [ebp - 0x829], 0x1e
mov byte [ebp - 0x828], 0x74
mov byte [ebp - 0x827], 0x58
mov byte [ebp - 0x826], 0x74
mov byte [ebp - 0x825], 6
mov byte [ebp - 0x824], 0x74
mov byte [ebp - 0x823], 0x74
mov byte [ebp - 0x822], 0x74
mov al, byte [ebp - 0x86f]
mov al, byte [ebp - 0x870]
test al, al
jne 0x421f93
xor esi, esi
lea ebx, [esi + 0x7f]
nop word [eax + eax]
mov al, byte [ebp + esi - 0x86f]
mov ecx, 0x74
movzx eax, al
sub ecx, eax
lea eax, [ecx + ecx*2]
shl eax, 3
cdq
idiv ebx
lea eax, [edx + 0x7f]
cdq
idiv ebx
mov byte [ebp + esi - 0x86f], dl
inc esi
cmp esi, 0x4e
jb 0x421f60
mov ebx, dword [ebp - 0x8b0]
push dword [ebp - 8]
lea eax, [ebp - 0x86f]
push eax
call fcn.00424150
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00437671
mov esp, ebp
pop ebp
ret
mov ebx, 0x7f
cmp dword [esi + 0x14], 7
jbe 0x421fcc
mov esi, dword [esi]
mov byte [ebp - 0x85c], 0
mov byte [ebp - 0x85b], 0x35
mov byte [ebp - 0x85a], 0x38
mov byte [ebp - 0x859], 0x1c
mov byte [ebp - 0x858], 0x38
mov byte [ebp - 0x857], 0x20
mov byte [ebp - 0x856], 0x38
mov byte [ebp - 0x855], 0x65
mov byte [ebp - 0x854], 0x38
mov byte [ebp - 0x853], 0x33
mov byte [ebp - 0x852], 0x38
mov byte [ebp - 0x851], 2
mov byte [ebp - 0x850], 0x38
mov byte [ebp - 0x84f], 0x4b
mov byte [ebp - 0x84e], 0x38
mov byte [ebp - 0x84d], 0x75
mov byte [ebp - 0x84c], 0x38
mov byte [ebp - 0x84b], 0x6c
mov byte [ebp - 0x84a], 0x38
mov byte [ebp - 0x849], 0x4b
mov byte [ebp - 0x848], 0x38
mov byte [ebp - 0x847], 0x53
mov byte [ebp - 0x846], 0x38
mov byte [ebp - 0x845], 0x21
mov byte [ebp - 0x844], 0x38
mov byte [ebp - 0x843], 0x41
mov byte [ebp - 0x842], 0x38
mov byte [ebp - 0x841], 0x4b
mov byte [ebp - 0x840], 0x38
mov byte [ebp - 0x83f], 0x5f
mov byte [ebp - 0x83e], 0x38
mov byte [ebp - 0x83d], 0x65
mov byte [ebp - 0x83c], 0x38
mov byte [ebp - 0x83b], 1
mov byte [ebp - 0x83a], 0x38
mov byte [ebp - 0x839], 0x75
mov byte [ebp - 0x838], 0x38
mov byte [ebp - 0x837], 0x21
mov byte [ebp - 0x836], 0x38
mov byte [ebp - 0x835], 0x41
mov byte [ebp - 0x834], 0x38
mov byte [ebp - 0x833], 0x4b
mov byte [ebp - 0x832], 0x38
mov byte [ebp - 0x831], 0x16
mov byte [ebp - 0x830], 0x38
mov byte [ebp - 0x82f], 0x65
mov byte [ebp - 0x82e], 0x38
mov byte [ebp - 0x82d], 1
mov byte [ebp - 0x82c], 0x38
mov byte [ebp - 0x82b], 0x61
mov byte [ebp - 0x82a], 0x38
mov byte [ebp - 0x829], 2
mov byte [ebp - 0x828], 0x38
mov byte [ebp - 0x827], 0x52
mov byte [ebp - 0x826], 0x38
mov byte [ebp - 0x825], 0x65
mov byte [ebp - 0x824], 0x38
mov byte [ebp - 0x823], 0x70
mov byte [ebp - 0x822], 0x38
mov byte [ebp - 0x821], 0x37
mov byte [ebp - 0x820], 0x38
mov byte [ebp - 0x81f], 0x38
mov byte [ebp - 0x81e], 0x38
mov al, byte [ebp - 0x85b]
mov al, byte [ebp - 0x85c]
test al, al
jne 0x4221c9
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x85b]
movzx eax, al
sub eax, 0x38
lea eax, [eax + eax*2]
shl eax, 2
cdq
idiv ebx
lea eax, [edx + 0x7f]
cdq
idiv ebx
mov byte [ebp + ecx - 0x85b], dl
inc ecx
cmp ecx, 0x3e
jb 0x4221a0
lea eax, [ebp - 0x85b]
push esi
push eax
call fcn.00424150
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
xor al, al
pop edi
pop esi
pop ebx
call fcn.00437671
mov esp, ebp
pop ebp
ret