Function at 0x405cd7
Capabilities:
Contain obfuscated stackstrings
Enumerate processes
Terminate process

Disassembly:
push ebp
sub esp, 0x128
lea ebp, [esp - 4]
mov eax, dword [0x489170]
xor eax, ebp
mov dword [ebp + 0x128], eax
push 0x40
mov eax, 0x4648e9
call fcn.00448a26
push ecx
mov dword [ebp - 0x14], esp
mov ebx, esp
sub esp, 0x1c
mov esi, ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
mov edi, str.DQ4CCk8VBAwR
push edi
call fcn.004023b7
push ebx
call fcn.00404227
add esp, 0x20
call fcn.00404e14
xor ebx, ebx
pop ecx
cmp al, bl
je 0x405d32
xor eax, eax
jmp 0x40610d
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.installing
call fcn.004044c1
push ecx
mov eax, esp
mov dword [ebp - 0x10], esp
sub esp, 0x1c
mov dword [ebp - 0x10], esp
mov ecx, esp
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], eax
call fcn.004023b7
mov eax, dword [ebp - 0x10]
push eax
call fcn.00404227
or dword [ebp - 4], 0xffffffff
add esp, 0x20
call fcn.00404fbb
pop ecx
pop ecx
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [ebp - 0x14], eax
call fcn.00426a02
mov eax, dword [eax + 4]
push dword [eax + 0x60]
lea ecx, [ebp - 0x1c]
call fcn.004044c1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.TwQZBA
mov dword [ebp - 4], 1
call fcn.004023b7
lea eax, [ebp - 0x10]
push eax
call fcn.00404227
add esp, 0x20
mov eax, dword [eax]
push dword [eax - 0xc]
lea ecx, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 2
call fcn.00403e7b
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.0040127b
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x124
lea eax, [ebp + 4]
push ebx
push eax
mov dword [ebp - 0x20], ebx
call fcn.00448370
add esp, 0xc
lea eax, [ebp]
push eax
push edi
mov dword [ebp], 0x128
call sub.KERNEL32.dll_Process32First
call fcn.00426b70
push eax
lea ecx, [ebp - 0x10]
call fcn.00403730
lea eax, [ebp + 0x24]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.0040404b
push 0x46ce60
lea ecx, [ebp - 0x10]
call fcn.0040404b
mov eax, dword [ebp - 0x1c]
push dword [eax - 0xc]
lea ecx, [ebp - 0x10]
push eax
call fcn.00403e7b
push dword [ebp - 0x1c]
lea eax, [ebp + 0x24]
push eax
call fcn.004564c6
pop ecx
pop ecx
test eax, eax
jne 0x405e5e
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x14]
jne 0x405e7d
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.0040127b
lea eax, [ebp]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x405e0a
jmp 0x405eac
push eax
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040127b
mov ecx, dword [ebp - 0x1c]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.0040127b
push 0xc
call fcn.00424aa4
pop ecx
cmp eax, ebx
je 0x405ed4
push 0x60
pop ecx
mov byte [eax], bl
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
jmp 0x405ed6
xor eax, eax
cmp dword [0x4990e8], 3
mov dword [0x48a5f0], eax
jne 0x405f1b
mov eax, dword [0x4990ec]
push dword [eax + 4]
mov ecx, 0x48a61c
call fcn.00403fcf
mov eax, dword [0x4990ec]
push dword [eax + 8]
call fcn.0044b837
mov dword [0x48a5f4], eax
mov eax, dword [0x4990ec]
pop ecx
push dword [eax + 4]
mov ecx, 0x48a620
call fcn.00403fcf
lea eax, [ebp - 0x14]
push eax
call fcn.00404355
pop ecx
mov ecx, eax
mov dword [ebp - 4], 4
call fcn.00403d52
push eax
lea ecx, [ebp - 0x20]
call fcn.00403949
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 6
call fcn.0040127b
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.FggPGRE
call fcn.004023b7
lea eax, [ebp - 0x1c]
push eax
call fcn.00404227
add esp, 0x20
push dword [eax]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 7
call fcn.0040383f
cmp eax, 0xffffffff
mov eax, str._AppData_
jg 0x405f87
mov eax, str._AppDataLocalLow_
push eax
lea ecx, [ebp - 0x24]
call fcn.004044c1
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 9
call fcn.0040127b
push ecx
mov dword [ebp - 0x18], esp
mov edi, esp
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.RDETDgYTAAwnCA0EEkQ9JwgNBC4RBA8EEzETDj0EGQINFAUETxUZFQ
call fcn.004023b7
push edi
call fcn.00404227
add esp, 0x20
mov ecx, esi
call fcn.00405bf4
or dword [0x48a5f4], eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.PSUOFg8NDgAFLAAPAAYEEz0EGQINFAUETxUZFQ
call fcn.004023b7
lea eax, [ebp - 0x14]
push eax
call fcn.00404227
add esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
lea eax, [ebp - 0x24]
push eax
push ecx
mov byte [ebp - 4], 0xa
call fcn.00403ff4
add esp, 0xc
mov ecx, esi
call fcn.00405bf4
mov ecx, dword [ebp - 0x14]
or dword [0x48a5f4], eax
add ecx, 0xfffffff0
mov byte [ebp - 4], 9
call fcn.0040127b
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.PSwAGRYEAxIEABMCCT0IDxIVAA0NBAVPAgcG
call fcn.004023b7
lea eax, [ebp - 0x14]
push eax
call fcn.00404227
add esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
lea eax, [ebp - 0x24]
push eax
push ecx
mov byte [ebp - 4], 0xb
call fcn.00403ff4
add esp, 0xc
mov ecx, esi
call fcn.00405bf4
mov ecx, dword [ebp - 0x14]
or dword [0x48a5f4], eax
add ecx, 0xfffffff0
mov byte [ebp - 4], 9
call fcn.0040127b
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
lea ecx, [ebp - 0x4c]
call fcn.00425c0e
mov dword [ebp - 0x4c], 0x46c9c8
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x4c]
push eax
mov ecx, esi
call fcn.0042517a
mov ecx, esi
call fcn.004255ab
push ebx
call fcn.0042b60d
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.DhEVCAwUDAgPEhUADQ0EEw
call fcn.004023b7
lea eax, [ebp - 0x18]
push eax
call fcn.00404227
add esp, 0x20
push dword [eax]
mov ecx, esi
mov byte [ebp - 4], 0xd
call fcn.0042ac00
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xc
call fcn.0040127b
mov ecx, esi
mov byte [esi + 0xa4], 1
call fcn.004033f6
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 9
call fcn.00425c52
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.0040127b
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0040127b
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x128]
xor ecx, ebp
call fcn.00448a17
add ebp, 0x12c
leave
ret