Function at 0x421120
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5498c2
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
push ebx
push esi
push edi
mov eax, dword [0x5bf364]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x70], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - 0x70], vtable.CVolObject.0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x70], vtable.rg_n::rg_n72530.0
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0x18]
cmp dword [eax + 0x12c], 0
jl 0x4216b3
jg 0x42119d
cmp dword [eax + 0x128], 0
jbe 0x4216b3
mov eax, dword [0x5c78ec]
test eax, eax
jne 0x4211b9
cmp dword [0x5c7904], 0
mov eax, 0x580994
cmovne eax, dword [0x5c78fc]
mov ecx, 0x5894bc
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4211e6
test dx, dx
je 0x4211e2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4211e6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4211c0
xor eax, eax
jmp 0x4211eb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x421323
lea ecx, [ebp - 0x64]
call fcn.00405c90
mov byte [ebp - 4], 2
mov dword [ebp - 0x64], vtable.CWConstString.0
mov dword [ebp - 0x58], 0x5894c0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebx + 0xd6c]
call fcn.0044f700
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x54]
call fcn.00405c00
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x64], vtable.CVolObject.0
call fcn.00405c90
mov byte [ebp - 4], 7
mov dword [ebp - 0x38], vtable.CWConstString.0
mov dword [ebp - 0x2c], 0x5891e0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x64]
call fcn.00405c90
mov byte [ebp - 4], 9
mov dword [ebp - 0x64], vtable.CWConstString.0
mov dword [ebp - 0x58], 0x5894d4
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x38]
push eax
push 0
lea eax, [ebp - 0x64]
mov ecx, ebx
push eax
call fcn.0044f940
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x54]
call fcn.00405c00
mov byte [ebp - 4], 8
mov dword [ebp - 0x64], vtable.CVolObject.0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x28]
call fcn.00405c00
mov byte [ebp - 4], 1
mov eax, dword [ebx + 0x23ac]
mov dword [ebp - 0x38], vtable.CVolObject.0
test eax, eax
jne 0x4212cf
cmp dword [ebx + 0x23c4], eax
mov eax, 0x580994
je 0x4212cf
mov eax, dword [ebx + 0x23bc]
push 1
push 0
push 0
push eax
push 0x58d0c4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x9c]
call fcn.00444ae0
mov byte [ebp - 4], 0x11
mov ecx, eax
call fcn.0047ac40
test eax, eax
jle 0x42131a
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0x12
jmp 0x4215e9
cmp dword [ebx + 0x2390], 1
jne 0x421607
lea ecx, [ebp - 0x38]
call fcn.00405c90
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x38], vtable.CWConstString.0
mov dword [ebp - 0x2c], 0x5894f8
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebx + 0xd6c]
call fcn.0044f700
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x28]
call fcn.00405c00
mov byte [ebp - 4], 1
mov ecx, 0xbb8
mov dword [ebp - 0x38], vtable.CVolObject.0
call fcn.004570d0
lea ecx, [ebp - 0x9c]
call fcn.00405c90
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x38]
call fcn.00405c90
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x38], vtable.CWConstString.0
mov dword [ebp - 0x2c], str.S_MRck_W
mov byte [ebp - 4], 0x1b
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebx + 0x102c]
call fcn.0044f700
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x28]
call fcn.00405c00
mov byte [ebp - 4], 0x19
lea ecx, [ebx + 0x102c]
push 0x8000
mov dword [ebp - 0x38], vtable.CVolObject.0
call fcn.0044bc60
lea ecx, [ebp - 0x38]
call fcn.00405c90
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x38], vtable.CWConstString.0
mov dword [ebp - 0x2c], 0x589530
mov byte [ebp - 4], 0x20
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebx + 0xd6c]
call fcn.0044f700
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x28]
call fcn.00405c00
mov byte [ebp - 4], 0x19
lea ecx, [ebx + 0x1b3c]
push 0x32
mov dword [ebp - 0x38], vtable.CVolObject.0
call fcn.0044cc80
lea ecx, [ebp - 0x54]
call fcn.00498a50
mov esi, eax
mov byte [ebp - 4], 0x24
lea edx, [ebx + 0x23a0]
mov ecx, dword [ebp + 0x18]
add ecx, 0x38
push ecx
lea ecx, [ebp - 0x38]
call fcn.0049d790
add esp, 4
mov ecx, eax
mov byte [ebp - 4], 0x25
lea eax, [ebp - 0x9c]
or dword [esi + 4], 1
push eax
sub esp, 8
lea eax, [ebx + 0x247c]
push eax
push esi
push ecx
lea ecx, [ebx + 0x23d0]
call fcn.00451520
mov dword [ebx + 0x2478], eax
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x28]
call fcn.00405c00
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x38], vtable.CVolObject.0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x54]
call fcn.00405c00
cmp dword [ebx + 0x2478], 0
jne 0x4215e5
push 0
lea ecx, [ebx + 0x1b3c]
call fcn.0044cc80
lea ecx, [ebp - 0x64]
call fcn.00405c90
mov byte [ebp - 4], 0x28
mov dword [ebp - 0x64], vtable.CWConstString.0
mov dword [ebp - 0x58], 0x5891e0
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x38]
call fcn.00405c90
mov byte [ebp - 4], 0x2a
mov dword [ebp - 0x38], vtable.CWConstString.0
mov dword [ebp - 0x2c], 0x58966c
mov byte [ebp - 4], 0x2b
lea edx, [ebp - 0x38]
push 0x588684
lea ecx, [ebp - 0xc8]
call fcn.0049d910
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x9c]
push ecx
mov edx, eax
lea ecx, [ebp - 0xf4]
call fcn.0049d790
add esp, 8
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x64]
push ecx
push 0
push eax
mov ecx, ebx
call fcn.0044f940
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0xe4]
call fcn.00405c00
mov byte [ebp - 4], 0x2c
mov dword [ebp - 0xf4], vtable.CVolObject.0
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0xb8]
call fcn.00405c00
mov byte [ebp - 4], 0x2b
mov dword [ebp - 0xc8], vtable.CVolObject.0
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x28]
call fcn.00405c00
mov byte [ebp - 4], 0x29
mov dword [ebp - 0x38], vtable.CVolObject.0
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x54]
call fcn.00405c00
mov byte [ebp - 4], 0x19
lea ecx, [ebx + 0x23a0]
mov dword [ebp - 0x64], vtable.CVolObject.0
call fcn.00457560
lea ecx, [ebp - 0xc8]
call fcn.00444ae0
mov byte [ebp - 4], 0x38
mov ecx, eax
call fcn.0047ac00
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0xb8]
call fcn.00405c00
mov byte [ebp - 4], 0x19
mov dword [ebp - 0xc8], vtable.CVolObject.0
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x8c]
call fcn.00405c00
mov byte [ebp - 4], 1
mov dword [ebp - 0x9c], vtable.CVolObject.0
jmp 0x4216b3
lea ecx, [ebp - 0x64]
call fcn.00405c90
mov byte [ebp - 4], 0x3d
mov dword [ebp - 0x64], vtable.CWConstString.0
mov dword [ebp - 0x58], 0x5891e0
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x38]
call fcn.00405c90
mov byte [ebp - 4], 0x3f
mov dword [ebp - 0x38], vtable.CWConstString.0
mov dword [ebp - 0x2c], 0x5896b0
mov byte [ebp - 4], 0x40
lea eax, [ebp - 0x64]
push eax
push 0
lea eax, [ebp - 0x38]
mov ecx, ebx
push eax
call fcn.0044f940
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x28]
call fcn.00405c00
mov byte [ebp - 4], 0x3e
mov dword [ebp - 0x38], vtable.CVolObject.0
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x54]
call fcn.00405c00
mov byte [ebp - 4], 1
mov eax, dword [ebx + 0x23ac]
mov dword [ebp - 0x64], vtable.CVolObject.0
test eax, eax
jne 0x42169f
cmp dword [ebx + 0x23c4], eax
mov eax, 0x580994
je 0x42169f
mov eax, dword [ebx + 0x23bc]
push 1
push 0
push 0
push eax
push 0x58d0c4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov dword [ebp - 0x70], vtable.CVolObject.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14