Function at 0x407b9d
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov dword [ebp - 0x10], 0xd3455974
mov esi, dword [ebp - 0x34]
mov ebx, 3
mov eax, dword [ebp - 0x10]
cmp eax, 0xda7bdffd
jle 0x407c2e
cmp eax, 0x20de22a7
jg 0x407c9a
cmp eax, 0xf811430c
jle 0x407d3e
cmp eax, 0x5508550
jg 0x407e64
cmp eax, 0xf811430d
je 0x40802f
cmp eax, 0xfb4b333a
je 0x408044
cmp eax, 0xfb8076a4
jne 0x407bb5
mov eax, dword [ebp - 0x14]
shr eax, 0xa
mov ecx, eax
imul ecx, eax
add eax, 0xffffff39
imul edx, ecx, 0x8845
dec edx
mov dword [ebp - 0x14], eax
mov eax, 0xb20f2e86
cmp edx, ecx
je 0x4082f1
mov eax, 0xd0c2f7c5
jmp 0x4082f1
cmp eax, 0xb5f477ef
jg 0x407ce3
cmp eax, 0x9e373214
jle 0x407d9c
cmp eax, 0xa7ce1159
jle 0x407ec7
cmp eax, 0xa7ce115a
je 0x408078
cmp eax, 0xa8f76dc7
je 0x40808a
cmp eax, 0xb20f2e86
jne 0x407bb5
shr esi, 1
imul esi, esi, 0x2a
add esi, 0xffffff1e
call fcn.004073f0
mov eax, 0x8d9cc3f2
cmp esi, 0x210000
jae 0x407c92
mov eax, 0xc39470f3
shr esi, 0xe
jmp 0x4082f1
cmp eax, 0x401cbff8
jg 0x407dd4
cmp eax, 0x359a0d91
jle 0x407efd
cmp eax, 0x359a0d92
je 0x4080b9
cmp eax, 0x3ab05a9a
je 0x4080dc
cmp eax, 0x3e390d85
jne 0x407bb5
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], 0xdd3fcad2
jmp 0x407bb5
cmp eax, 0xce8f1e7a
jg 0x407e1b
cmp eax, 0xc306e8fe
jle 0x407f3b
cmp eax, 0xc306e8ff
je 0x408109
cmp eax, 0xc39470f3
je 0x408141
cmp eax, 0xc8c246fb
jne 0x407bb5
push 0x8a
push str.Do_you_want_to_run_a_malware___n_Crypt_build_to_disable_this_message_
push dword [ebp - 0x2c]
call fcn.004333a0
add esp, 0xc
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], 0x20de22a8
jmp 0x407bb5
cmp eax, 0xe1fbda46
jle 0x407f82
cmp eax, 0xe1fbda47
je 0x40816c
cmp eax, 0xf66a3a0b
je 0x408181
cmp eax, 0xf76d8a21
jne 0x407bb5
mov eax, dword [ebp - 0x30]
mov ecx, dword [0x454772]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x45476e]
mov dword [eax + 8], ecx
mov ecx, dword [0x45476a]
mov dword [eax + 4], ecx
mov ecx, dword [str.Warning]
mov dword [eax], ecx
mov dword [ebp - 0x10], 0xa8f76dc7
jmp 0x407bb5
cmp eax, 0x960f2fcc
jle 0x407fa4
cmp eax, 0x960f2fcd
je 0x408199
cmp eax, 0x9a800166
je 0x4081b1
cmp eax, 0x9c1351a6
jne 0x407bb5
mov dword [ebp - 0x10], 0x3e390d85
jmp 0x407bb5
cmp eax, 0x67fee9d6
jle 0x407fe0
cmp eax, 0x67fee9d7
je 0x4081ce
cmp eax, 0x6a321757
je 0x4081f4
cmp eax, 0x71034d87
jne 0x407bb5
push eax
push eax
mov eax, esp
mov dword [ebp - 0x18], eax
sub esp, 8
mov eax, esp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0xe1fbda47
jmp 0x407bb5
cmp eax, 0xd2ab1c5e
jle 0x40800a
cmp eax, 0xd2ab1c5f
je 0x408213
cmp eax, 0xd3455974
je 0x40822e
cmp eax, 0xd4ae3d9d
jne 0x407bb5
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x44]
mov dword [ecx], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], 0x4b43c255
jmp 0x407bb5
cmp eax, 0x5508551
je 0x4081a5
cmp eax, 0x1c38c35f
je 0x408249
cmp eax, 0x20d7f323
jne 0x407bb5
imul eax, dword [ebp - 0x14], 0x8d
add eax, 0xffff8464
mov ecx, eax
imul ecx, eax
imul edx, ecx, 0xbc3
dec edx
shl eax, 7
add eax, 0xff820000
and eax, 0xffff8000
add eax, 0xffffff8c
mov dword [ebp - 0x14], eax
mov eax, 0x3ab05a9a
cmp ecx, edx
je 0x4082f1
mov eax, 0x20f928e9
jmp 0x4082f1
cmp eax, 0x9e373215
je 0x408258
cmp eax, 0xa4a0138a
jne 0x408335
mov eax, dword [ebp - 0x14]
shr eax, 0xa
lea eax, [eax + eax*2]
shl eax, 9
add eax, 0x21000
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x6a321757
jmp 0x407bb5
cmp eax, 0x20de22a8
je 0x408275
cmp eax, 0x21bcc696
jne 0x408342
mov eax, dword [ebp - 0x3c]
push dword [ebp - 0x28]
push 0
push dword [ebp - 0x20]
push ebx
push ebx
push 0x50000018
call eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x10], 0xb5f477f0
jmp 0x407bb5
cmp eax, 0xb5f477f0
je 0x4082ad
cmp eax, 0xbfa73207
jne 0x407bb5
imul esi, esi, 0x44a8400
add esi, 0xf3877060
call fcn.004073f0
call fcn.004073f0
mov eax, 0x67fee9d7
cmp esi, 0xf3
jl 0x4082f1
mov eax, 0xd3455974
jmp 0x4082f1
cmp eax, 0xda7bdffe
je 0x4082b9
cmp eax, 0xdd3fcad2
jne 0x407bb5
mov dword [ebp - 0x10], 0xc8c246fb
jmp 0x407bb5
cmp eax, 0x8d9cc3f2
je 0x4082da
cmp eax, 0x8db9f31a
jne 0x407bb5
mov eax, dword [ebp - 0x18]
mov cx, 0x88
mov word [eax], cx
mov eax, dword [ebp - 0x18]
mov word [eax + 2], cx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
mov dword [eax + 4], ecx
mov dword [ebp - 0x10], 0xfb4b333a
jmp 0x407bb5
cmp eax, 0x401cbff9
je 0x4082f9
cmp eax, 0x4b43c255
jne 0x407bb5
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x48]
mov dword [eax], ecx
mov dword [ebp - 0x10], 0xa4a0138a
jmp 0x407bb5
cmp eax, 0xce8f1e7b
je 0x408326
cmp eax, 0xd0c2f7c5
jne 0x407bb5
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], 0x3ab05a9a
jmp 0x407bb5
push eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], 0x71034d87
jmp 0x407bb5
mov eax, dword [ebp - 0x14]
shr eax, 0xb
lea ecx, [eax - 0x47]
imul ecx, ecx
add eax, eax
add eax, 0xffffff58
imul edx, ecx, 0x2e0f
dec edx
mov dword [ebp - 0x14], eax
mov eax, 0x401cbff9
cmp edx, ecx
je 0x4082f1
mov eax, 0x9a800166
jmp 0x4082f1
shl esi, 0x10
add esi, 0xffffffb7
mov dword [ebp - 0x10], 0xe1fbda47
jmp 0x407bb5
mov eax, dword [ebp - 0x14]
add eax, 0xffffffd5
mov ecx, eax
imul ecx, eax
imul edx, ecx, 0x77fd
dec edx
shl eax, 8
mov dword [ebp - 0x14], eax
mov eax, 0xbfa73207
cmp edx, ecx
je 0x4082f1
mov eax, 0xce8f1e7b
jmp 0x4082f1
imul esi, esi, 0xae6c
add esi, 0xff5658f4
and esi, 0xffffff80
or esi, 0x57
call fcn.00407b9d
mov dword [ebp - 0x10], 0x401cbff9
jmp 0x407bb5
push 0x11
push str.ZwRaiseHardError
push dword [ebp - 0x24]
call fcn.004333a0
add esp, 0xc
push dword [ebp - 0x24]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x10], 0x9c1351a6
jmp 0x407bb5
mov eax, dword [ebp - 0x14]
shr eax, 0xf
lea ecx, [eax + eax]
add ecx, 0xfffffef2
mov edx, eax
imul edx, eax
imul edi, edx, 0x4115
dec edi
and ecx, 0xfffffffc
mov dword [ebp - 0x14], ecx
mov eax, 0x359a0d92
cmp edi, edx
je 0x4082f1
mov eax, 0x9e373215
jmp 0x4082f1
imul esi, esi, 0xda0000
add esi, 0xdd160000
call fcn.004073f0
mov eax, 0xf66a3a0b
cmp esi, 0x2f800
jb 0x408164
mov eax, 0xa7ce115a
shr esi, 0xb
jmp 0x4082f1
push eax
sub esp, 8
mov eax, esp
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], 0x401cbff9
jmp 0x407bb5
push eax
sub esp, 0x88
mov eax, esp
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], 0xf811430d
jmp 0x407bb5
shl esi, 0xd
and esi, 0xffe000
add esi, 0xffffffd3
mov dword [ebp - 0x10], 0xf76d8a21
jmp 0x407bb5
mov eax, dword [ebp - 0x1c]
mov word [eax], 0xe
mov eax, dword [ebp - 0x1c]
add eax, 2
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x10], 0xc306e8ff
jmp 0x407bb5
shr esi, 5
and esi, 0x3ffff
imul esi, esi, 0x1a000
mov eax, 0xda7bdffe
test esi, esi
je 0x4082f1
mov eax, 0xf76d8a21
jmp 0x4082f1
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x20]
mov dword [eax + 8], 0x34
mov dword [ebp - 0x10], 0x21bcc696
jmp 0x407bb5
mov ecx, dword [ebp - 0x4c]
mov eax, 0xa3c1842f
cmp ecx, 8
je 0x4082f1
mov eax, 0x20d7f323
jmp 0x4082f1
push eax
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0x24], eax
push eax
mov eax, esp
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 0xf66a3a0b
jmp 0x407bb5
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0x8db9f31a
jmp 0x407bb5
mov eax, dword [ebp - 0x40]
mov word [eax], 0xe
mov eax, dword [ebp - 0x1c]
add eax, 4
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x10], 0xd4ae3d9d
jmp 0x407bb5
mov eax, dword [ebp - 0x14]
shr eax, 0xa
add eax, 0xffffffe2
imul ecx, eax, 0xa5
imul eax, eax
add ecx, 0xffffff0a
imul edx, eax, 0x2567
dec edx
mov dword [ebp - 0x14], ecx
mov ecx, 0x3ab05a9a
cmp edx, eax
je 0x4082a5
mov ecx, 0x5508551
mov dword [ebp - 0x10], ecx
jmp 0x407bb5
mov dword [ebp - 0x10], 0xd2ab1c5f
jmp 0x407bb5
imul eax, esi, 0x4074
shr eax, 5
mov esi, eax
shl esi, 0xd
sub esi, eax
sub esi, eax
mov eax, 0xd3455974
cmp esi, 0xb7
jb 0x4082ec
jmp 0x4082f1
add esi, 0x18
call fcn.004073f0
mov eax, 0xd3455974
cmp esi, 0x13
jl 0x4082f1
mov eax, 0xf66a3a0b
mov dword [ebp - 0x10], eax
jmp 0x407bb5
mov word [ebp - 0x50], 0x6c
mov dword [ebp - 0x54], 0x6c642e6c
mov dword [ebp - 0x58], 0x6c64746e
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x10], 0xfb8076a4
jmp 0x407bb5
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], 0x1c38c35f
jmp 0x407bb5
cmp eax, 0xa3c1842f
jne 0x407bb5
jmp 0x408358
cmp eax, 0x20f928e9
jne 0x407bb5
mov dword [ebp - 0x34], esi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x34], esi
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret