Function at 0x476c70
Capabilities:
Encode data using xor
Terminate process

Disassembly:
mov eax, dword [0x55f4dc]
sub esp, 0xc
test eax, eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_PostMessageA]
push ebp
push esi
push edi
mov ebp, 1
jne 0x476d06
mov eax, dword [0x55f4d8]
test eax, eax
jne 0x476d06
cmp dword [0x55f4ec], ebp
jne 0x476d06
mov eax, dword [0x556f68]
mov ecx, dword [0x556f64]
mov edx, dword [0x556f60]
push 0xc350
push eax
push ecx
push edx
push 0xffffffffffffffff
call fcn.004769b0
add esp, 0x14
mov dword [0x55f4d8], ebp
call fcn.004dd9d5
test eax, eax
je 0x476d5a
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
test eax, eax
je 0x476d5a
call fcn.004dd9d5
test eax, eax
je 0x476cef
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x476cf1
xor eax, eax
mov eax, dword [eax + 0x1c]
push 0x983f
push 0x192f
push 0x9673
push eax
call ebx
push 0
call fcn.004c24ab
push eax
call fcn.004c27cf
add esp, 8
xor eax, eax
mov dl, al
xor dl, 0xb1
mov byte [esp + eax + 0x10], dl
inc eax
cmp eax, 0xa
jl 0x476d18
push 0x28
call fcn.004c27dc
push eax
call fcn.004c49f5
mov edi, dword [esp + 0x28]
mov dword [esp + 0x18], eax
lea eax, [edx + edx*4 + 0x32]
add esp, 8
lea esi, [eax + eax*4]
mov eax, dword [edi + 4]
shl esi, 2
cmp eax, 0x9675
jne 0x476d83
push 0
call fcn.004c5454
mov ecx, dword [0x556f5c]
and ecx, 0x2000
cmp ecx, 0x2000
jne 0x476d7c
push 0xffffffffffffffff
push 0x10
push 0x1aa
call fcn.004e5506
push 0
call fcn.004c5454
cmp eax, 0x9a31
jne 0x476dcb
call fcn.004dd9d5
test eax, eax
je 0x476dc4
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
test eax, eax
je 0x476dc4
call fcn.004dd9d5
test eax, eax
je 0x476db2
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
test eax, eax
jne 0x476db6
xor eax, eax
jmp 0x476db9
mov eax, dword [eax + 0x1c]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x476dcb
push 0
call fcn.004c5454
mov eax, dword [0x55f500]
imul eax, esi
cmp eax, 0xbb8
jbe 0x476ddc
shr esi, 1
cmp esi, 0x640
jb 0x476de9
mov esi, 0x640
mov eax, dword [edi + 4]
cmp eax, 0x10
jne 0x476f7d
cmp dword [edi + 8], 0x10f0
jne 0x476f7d
cmp dword [edi + 0xc], 0x2f0f
jne 0x476f7d
call fcn.004dd9d5
test eax, eax
je 0x476e78
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
test eax, eax
je 0x476e78
call fcn.004dd9d5
test eax, eax
je 0x476e35
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x476e37
xor eax, eax
mov eax, dword [eax + 0x1c]
push 0x88b8
push 0
push 0
push 0x9675
push eax
call fcn.004769b0
add esp, 0x14
call fcn.004dd9d5
test eax, eax
je 0x476e63
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x476e65
xor eax, eax
mov eax, dword [eax + 0x1c]
push 0
push 0
push 0x9930
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x55f4dc]
test eax, eax
je 0x476e90
mov eax, dword [0x556f5c]
or ah, 0x20
mov dword [0x556f5c], eax
jmp 0x476ead
cmp dword [0x55f4f4], ebp
je 0x476f38
cmp dword [0x55f4f8], ebp
je 0x476f38
mov eax, dword [0x556f5c]
and eax, 0x2000
push 0xffffffffffffffff
cmp eax, 0x2000
push 0x10
push 0x1aa
jne 0x476eed
call fcn.004e5506
call fcn.004dd9d5
test eax, eax
je 0x476f31
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
test eax, eax
je 0x476f31
call fcn.004dd9d5
test eax, eax
je 0x476f16
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x476f18
call fcn.004e5506
call fcn.004c5547
cdq
mov ecx, 0x30e
idiv ecx
mov esi, edx
push esi
call edi
add esp, 4
mov edx, esi
lea eax, [edx + 1]
mov ecx, 0x64
cdq
idiv ecx
jmp 0x476f09
xor eax, eax
mov eax, dword [eax + 0x1c]
push 0
push 0
push 0x9a31
push eax
call ebx
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push 0
call fcn.004c5454
push 0xffffffffffffffff
push 0x10
push 0x1aa
mov dword [0x556f5c], 0
call fcn.004e5506
call fcn.004dd9d5
test eax, eax
je 0x476f76
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
test eax, eax
je 0x476f76
call fcn.004dd9d5
test eax, eax
je 0x476f16
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x476f18
push 0
call fcn.004c5454
cmp eax, 0x9673
jne 0x477039
cmp dword [edi + 8], 0x192f
jne 0x477039
cmp dword [edi + 0xc], 0x983f
jne 0x477039
call fcn.004dd9d5
test eax, eax
je 0x47701d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
test eax, eax
je 0x47701d
call fcn.004dd9d5
test eax, eax
je 0x476fc8
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x476fca
xor eax, eax
mov edx, dword [eax + 0x1c]
lea ecx, [esi + 0xea60]
push ecx
push 0
push 0
push 0x9a31
push edx
call fcn.004769b0
add esp, 0x14
call fcn.004dd9d5
test eax, eax
je 0x476ff8
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x476ffa
xor eax, eax
mov eax, dword [eax + 0x1c]
push esi
push 0x2f0f
push 0x10f0
push 0x10
push eax
call fcn.004769b0
add esp, 0x14
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x57
div ecx
lea eax, [edx + 1]
mov ecx, 0x64
cdq
idiv ecx
jmp 0x47702c
cmp eax, 0x9674
jne 0x4770e7
cmp dword [edi + 8], 0x284f
jne 0x4770e7
cmp dword [edi + 0xc], 0x875f
jne 0x4770e7
call fcn.004dd9d5
test eax, eax
je 0x4770da
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
test eax, eax
je 0x4770da
call fcn.004dd9d5
test eax, eax
je 0x477084
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x477086
xor eax, eax
mov eax, dword [eax + 0x1c]
push esi
push 0x2f0f
push 0x10f0
push 0x10
push eax
call fcn.004769b0
add esp, 0x14
call fcn.004dd9d5
test eax, eax
je 0x4770b1
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x4770b3
xor eax, eax
mov edx, dword [eax + 0x1c]
lea ecx, [esi + esi + 0xafc8]
push ecx
push 0
push 0
push 0x9a31
push edx
call fcn.004769b0
add esp, 0x14
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
call fcn.004c5454
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret