Function at 0x4304c0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x47a73e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov dword [esi + 0x88], 0x47b25c
mov dword [esp + 0x28], 0x7f8a
mov dword [esp + 0x2c], 0x7f00
mov dword [esp + 0x30], 0x7f03
mov dword [esp + 0x34], 0x7f89
mov dword [esp + 0x38], 0x7f8b
mov dword [esp + 0x3c], 0x7f01
mov dword [esp + 0x40], 0x7f81
mov dword [esp + 0x44], 0x7f88
mov dword [esp + 0x48], 0x7f80
mov dword [esp + 0x4c], 0x7f86
mov dword [esp + 0x50], 0x7f83
mov dword [esp + 0x54], 0x7f85
mov dword [esp + 0x58], 0x7f82
mov dword [esp + 0x5c], 0x7f84
mov dword [esp + 0x60], 0x7f04
mov dword [esp + 0x64], 0x7f02
lea ebp, [esp + 0x28]
lea edi, [esi + 0xcc]
mov ebx, 0x10
mov eax, dword [ebp]
push eax
push 0
mov dword [edi - 0x40], eax
call dword [0x493f5c]
mov dword [edi], eax
add ebp, 4
add edi, 4
dec ebx
jne 0x43057b
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov al, 0x74
mov byte [esp + 0x1a], al
mov byte [esp + 0x23], al
lea eax, [esp + 0x18]
mov dword [esp + 0x70], 0
push eax
push str.KERNEL32.dll
mov dword [esi], 0x47b260
mov byte [esp + 0x20], 0x47
mov byte [esp + 0x21], 0x65
mov byte [esp + 0x23], 0x54
mov byte [esp + 0x24], 0x69
mov byte [esp + 0x25], 0x63
mov byte [esp + 0x26], 0x6b
mov byte [esp + 0x27], 0x43
mov byte [esp + 0x28], 0x6f
mov byte [esp + 0x29], 0x75
mov byte [esp + 0x2a], 0x6e
mov byte [esp + 0x2c], 0
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
push str.GetDesktopWindow
push str.USER32.dll
mov ebx, eax
call edi
push eax
call ebp
push str.GetDC
push str.USER32.dll
mov dword [esp + 0x18], eax
call edi
push eax
call ebp
mov ebp, dword [esp + 0x78]
mov edi, eax
lea eax, [ebp - 1]
cmp eax, 0x1f
ja case.0x430639.2
xor ecx, ecx
mov cl, byte [eax + 0x4307ec]
jmp dword [ecx*4 + 0x4307e4]
mov dword [esi + 0x70], ebp
jmp 0x43064c
mov dword [esi + 0x70], 8
mov ecx, esi
call fcn.00430fc0
test al, al
jne 0x430667
call dword [esp + 0x10]
push eax
mov dword [esi + 0x10c], eax
call edi
mov dword [esi + 0x44], eax
mov dword [esi + 0x10], 0xcc0020
mov byte [esi + 4], 1
call ebx
mov ecx, dword [esp + 0x80]
mov dword [esi + 0x14], eax
mov eax, 0x3e8
xor edx, edx
div ecx
mov dl, byte [esp + 0x7c]
mov edi, dword [0x493f3c]
xor ebx, ebx
mov dword [esi + 8], ecx
push ebx
mov byte [esi + 0xc], dl
mov dword [esi + 0x18], eax
call edi
push 1
mov dword [esi + 0x28], eax
call edi
mov dword [esi + 0x2c], eax
mov eax, 0x20
cdq
idiv dword [esi + 0x70]
mov edi, dword [0x493f10]
mov dword [esi + 0x30], ebx
mov byte [esi + 0x24], al
mov eax, dword [esi + 0x44]
push eax
call edi
mov ecx, dword [esi + 0x44]
mov dword [esi + 0x4c], eax
push ecx
call edi
push ebx
mov dword [esi + 0x80], eax
call edi
push ebx
mov dword [esi + 0x48], eax
call edi
mov edx, dword [esi + 0x28]
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x70]
lea edi, [esi + 0x5c]
lea ebp, [esi + 0x60]
push 1
push edx
push eax
mov ecx, esi
mov dword [edi], ebx
mov dword [ebp], ebx
call fcn.00430d10
mov ecx, dword [esi + 0x2c]
mov edx, dword [esi + 0x28]
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x70]
push ecx
push edx
push eax
mov ecx, esi
call fcn.00430d10
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x70]
push 1
push ecx
push edx
mov ecx, esi
mov dword [esi + 0x68], eax
call fcn.00430d10
mov ecx, dword [esi + 0x44]
push ebx
mov dword [esi + 0x6c], eax
mov eax, dword [esi + 0x64]
push ebx
push edi
mov edi, dword [0x493f14]
push ebx
push eax
push ecx
call edi
mov dword [esi + 0x54], eax
push ebx
mov edx, dword [esi + 0x68]
mov eax, dword [esi + 0x44]
push ebx
push ebp
push ebx
push edx
push eax
call edi
mov edx, dword [esi + 0x68]
push ebx
lea ecx, [esi + 0x78]
push ebx
mov dword [esi + 0x58], eax
mov eax, dword [esi + 0x44]
push ecx
push ebx
push edx
push eax
call edi
mov ecx, dword [esi + 0x58]
mov edx, dword [esi + 0x4c]
mov edi, dword [0x493f18]
push ecx
push edx
mov dword [esi + 0x84], eax
call edi
mov eax, dword [esi + 0x54]
mov ecx, dword [esi + 0x48]
push eax
push ecx
call edi
mov edx, dword [esi + 0x84]
mov eax, dword [esi + 0x80]
push edx
push eax
call edi
mov ecx, dword [esi + 0x2c]
mov edx, dword [esi + 0x28]
push ecx
push edx
push ebx
lea eax, [esi + 0x34]
push ebx
push eax
call dword [0x493f38]
mov ecx, dword [esi + 0x68]
mov edx, dword [ecx + 0x14]
shl edx, 1
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x68]
xor edx, edx
add esp, 4
mov eax, dword [eax + 0x14]
mov ecx, dword [esp + 0x68]
div dword [esi + 0x2c]
mov dword [esi + 0x20], ebx
pop edi
mov dword [esi + 0x74], eax
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x64
ret 0xc
xor edx, edx
xor ebx, ebx
mov dl, byte [eax]
mov bl, byte [eax + 2]
mov ebp, edx
lea edx, [ebp + ebp]
sub edx, ebx
lea edi, [edx*8]
sub edi, edx
xor edx, edx
mov dl, byte [eax + 3]
lea edx, [edx + edx*2]
add edi, edx
xor edx, edx
mov dl, byte [eax + 1]
lea ebx, [edx + edx*2]
shl ebx, 3
sub ebx, edx
xor edx, edx
mov dl, byte [eax + 4]
add edi, ebx
sub edi, edx
sub edi, ecx
add edi, 0x10
jns 0x440655
xor edi, edi
jmp 0x440667
cmp edi, 0x1fe0
jle 0x440664
mov edi, 0xff
jmp 0x440667
sar edi, 5
sub ebp, ecx
xor ebx, ebx
lea edx, [edi + ebp + 1]
sar edx, 1
mov byte [esi], dl
mov bl, byte [eax + 4]
xor edx, edx
mov edi, ebx
mov dl, byte [eax + 1]
mov ebp, edx
xor edx, edx
mov dl, byte [eax + 3]
add edx, edx
sub edi, edx
xor edx, edx
mov dl, byte [eax]
sub edi, edx
xor edx, edx
mov dl, byte [eax + 2]
lea edi, [edi + edi*2]
lea edx, [edx + edx*4]
lea edi, [edi + edx*4]
lea edx, [ebp + ebp*8]
lea edx, [ebp + edx*2]
add edi, edx
xor edx, edx
mov dl, byte [eax + 5]
sub edi, edx
sub edi, ecx
add edi, 0x10
jns 0x4406b8
xor edi, edi
jmp 0x4406ca
cmp edi, 0x1fe0
jle 0x4406c7
mov edi, 0xff
jmp 0x4406ca
sar edi, 5
sub ebp, ecx
xor ebx, ebx
lea edx, [edi + ebp + 1]
sar edx, 1
mov byte [esi + 1], dl
mov bl, byte [eax + 1]
xor edx, edx
mov dl, byte [eax + 2]
mov ebp, edx
xor edx, edx
mov dl, byte [eax + 4]
add edx, ebx
xor ebx, ebx
add edx, edx
mov bl, byte [eax]
mov edi, edx
xor edx, edx
mov dl, byte [eax + 5]
sub edx, edi
lea edi, [edx + edx*2]
xor edx, edx
mov dl, byte [eax + 3]
add edx, ebp
lea edx, [edx + edx*4]
lea edx, [ebx + edx*2]
lea edi, [edi + edx*2 + 0x10]
xor edx, edx
mov dl, byte [eax + 6]
sub edi, edx
sub edi, ecx
jns 0x44071a
xor edi, edi
jmp 0x44072c
cmp edi, 0x1fe0
jle 0x440729
mov edi, 0xff
jmp 0x44072c
sar edi, 5
sub ebp, ecx
xor ebx, ebx
lea edx, [edi + ebp + 1]
sar edx, 1
mov byte [esi + 2], dl
mov bl, byte [eax + 2]
xor edx, edx
mov dl, byte [eax + 3]
mov ebp, edx
xor edx, edx
mov dl, byte [eax + 5]
add edx, ebx
xor ebx, ebx
mov bl, byte [eax + 6]
add edx, edx
mov edi, ebx
sub edi, edx
xor edx, edx
mov dl, byte [eax + 1]
add edi, edx
xor edx, edx
mov dl, byte [eax + 4]
add edx, ebp
lea edi, [edi + edi*2]
lea edx, [edx + edx*4]
lea edi, [edi + edx*4]
xor edx, edx
mov dl, byte [eax + 7]
sub edi, edx
xor edx, edx
mov dl, byte [eax]
sub edi, edx
sub edi, ecx
add edi, 0x10
jns 0x440784
xor edi, edi
jmp 0x440796
cmp edi, 0x1fe0
jle 0x440793
mov edi, 0xff
jmp 0x440796
sar edi, 5
sub ebp, ecx
xor ebx, ebx
lea edx, [edi + ebp + 1]
sar edx, 1
mov byte [esi + 3], dl
mov bl, byte [eax + 3]
xor edx, edx
mov dl, byte [eax + 4]
mov ebp, edx
xor edx, edx
mov dl, byte [eax + 6]
add edx, ebx
xor ebx, ebx
mov bl, byte [eax + 7]
add edx, edx
mov edi, ebx
sub edi, edx
xor edx, edx
mov dl, byte [eax + 2]
add edi, edx
xor edx, edx
mov dl, byte [eax + 5]
add edx, ebp
lea edi, [edi + edi*2]
lea edx, [edx + edx*4]
lea edi, [edi + edx*4]
xor edx, edx
mov dl, byte [eax + 8]
sub edi, edx
xor edx, edx
mov dl, byte [eax + 1]
sub edi, edx
sub edi, ecx
add edi, 0x10
jns 0x4407ef
xor edi, edi
jmp 0x440801
cmp edi, 0x1fe0
jle 0x4407fe
mov edi, 0xff
jmp 0x440801
sar edi, 5
sub ebp, ecx
xor ebx, ebx
lea edx, [edi + ebp + 1]
sar edx, 1
mov byte [esi + 4], dl
mov bl, byte [eax + 4]
xor edx, edx
mov dl, byte [eax + 5]
mov ebp, edx
xor edx, edx
mov dl, byte [eax + 7]
add edx, ebx
xor ebx, ebx
mov bl, byte [eax + 3]
add edx, edx
mov edi, ebx
sub edi, edx
xor edx, edx
mov dl, byte [eax + 8]
add edi, edx
xor edx, edx
mov dl, byte [eax + 6]
add edx, ebp
lea edi, [edi + edi*2]
lea edx, [edx + edx*4]
lea edi, [edi + edx*4]
xor edx, edx
mov dl, byte [eax + 9]
sub edi, edx
xor edx, edx
mov dl, byte [eax + 2]
sub edi, edx
sub edi, ecx
add edi, 0x10
jns 0x44085a
xor edi, edi
jmp 0x44086c
cmp edi, 0x1fe0
jle 0x440869
mov edi, 0xff
jmp 0x44086c
sar edi, 5
sub ebp, ecx
xor ebx, ebx
lea edx, [edi + ebp + 1]
sar edx, 1
mov byte [esi + 5], dl
mov bl, byte [eax + 8]
xor edx, edx
mov dl, byte [eax + 6]
mov ebp, edx
xor edx, edx
mov dl, byte [eax + 5]
add edx, ebx
xor ebx, ebx
mov bl, byte [eax + 9]
add edx, edx
mov edi, ebx
sub edi, edx
xor edx, edx
mov dl, byte [eax + 4]
add edi, edx
xor edx, edx
mov dl, byte [eax + 7]
add edx, ebp
lea edi, [edi + edi*2]
lea edx, [edx + edx*4]
lea edi, [edi + edx*4]
xor edx, edx
mov dl, byte [eax + 3]
sub edi, edx
xor edx, edx
mov dl, byte [eax + 0xa]
sub edi, edx
sub edi, ecx
add edi, 0x10
jns 0x4408c5
xor edi, edi
jmp 0x4408d7
cmp edi, 0x1fe0
jle 0x4408d4
mov edi, 0xff
jmp 0x4408d7
sar edi, 5
sub ebp, ecx
xor ebx, ebx
lea edx, [edi + ebp + 1]
sar edx, 1
mov byte [esi + 6], dl
mov bl, byte [eax + 6]
pop eax
push es
xor edx, edx
mov dl, byte [eax + 7]
mov ebp, edx
xor edx, edx
mov dl, byte [eax + 9]
add edx, ebx
xor ebx, ebx
mov bl, byte [eax + 5]
add edx, edx
mov edi, ebx
sub edi, edx
xor edx, edx
mov dl, byte [eax + 0xa]
add edi, edx
xor edx, edx
mov dl, byte [eax + 8]
add edx, ebp
lea edi, [edi + edi*2]
lea edx, [edx + edx*4]
lea edi, [edi + edx*4]
xor edx, edx
mov dl, byte [eax + 0xb]
sub edi, edx
xor edx, edx
mov dl, byte [eax + 4]
sub edi, edx
sub edi, ecx
add edi, 0x10
jns 0x440930
xor edi, edi
jmp 0x440942
cmp edi, 0x1fe0
jle 0x44093f
mov edi, 0xff
jmp 0x440942
sar edi, 5
sub ebp, ecx
xor ebx, ebx
lea edx, [edi + ebp + 1]
sar edx, 1
mov byte [esi + 7], dl
mov bl, byte [eax + 0xa]
xor edx, edx
mov dl, byte [eax + 8]
mov ebp, edx
xor edx, edx
mov dl, byte [eax + 7]
add edx, ebx
xor ebx, ebx
mov bl, byte [eax + 0xb]
add edx, edx
mov edi, ebx
sub edi, edx
xor edx, edx
mov dl, byte [eax + 6]
add edi, edx
xor edx, edx
mov dl, byte [eax + 9]
add edx, ebp
lea edi, [edi + edi*2]
lea edx, [edx + edx*4]
lea edi, [edi + edx*4]
xor edx, edx
mov dl, byte [eax + 5]
sub edi, edx
xor edx, edx
mov dl, byte [eax + 0xc]
sub edi, edx
sub edi, ecx
add edi, 0x10
jns 0x44099b
xor edi, edi
jmp 0x4409ad
cmp edi, 0x1fe0
jle 0x4409aa
mov edi, 0xff
jmp 0x4409ad
sar edi, 5
sub ebp, ecx
xor ebx, ebx
lea edx, [edi + ebp + 1]
sar edx, 1
mov byte [esi + 8], dl
mov bl, byte [eax + 8]
xor edx, edx
mov dl, byte [eax + 9]
mov ebp, edx
xor edx, edx
mov dl, byte [eax + 0xb]
add edx, ebx
xor ebx, ebx
mov bl, byte [eax + 7]
add edx, edx
mov edi, ebx
sub edi, edx
xor edx, edx
mov dl, byte [eax + 0xc]
add edi, edx
xor edx, edx
mov dl, byte [eax + 0xa]
add edx, ebp
lea edi, [edi + edi*2]
lea edx, [edx + edx*4]
lea edi, [edi + edx*4]
xor edx, edx
mov dl, byte [eax + 0xd]
sub edi, edx
xor edx, edx
mov dl, byte [eax + 6]
sub edi, edx
sub edi, ecx
add edi, 0x10
jns 0x440a06
xor edi, edi
jmp 0x440a18
cmp edi, 0x1fe0
jle 0x440a15
mov edi, 0xff
jmp 0x440a18
sar edi, 5
sub ebp, ecx
xor ebx, ebx
lea edx, [edi + ebp + 1]
sar edx, 1
mov byte [esi + 9], dl
mov bl, byte [eax + 0xc]
xor edx, edx
mov dl, byte [eax + 0xa]
mov ebp, edx
xor edx, edx
mov dl, byte [eax + 9]
add edx, ebx
xor ebx, ebx
mov bl, byte [eax + 0xd]
add edx, edx
mov edi, ebx
sub edi, edx
xor edx, edx
mov dl, byte [eax + 8]
add edi, edx
xor edx, edx
mov dl, byte [eax + 0xb]
add edx, ebp
lea edi, [edi + edi*2]
lea edx, [edx + edx*4]
lea edi, [edi + edx*4]
xor edx, edx
mov dl, byte [eax + 7]
sub edi, edx
xor edx, edx
mov dl, byte [eax + 0xe]
sub edi, edx
sub edi, ecx
add edi, 0x10
jns 0x440a71
xor edi, edi
jmp 0x440a83
cmp edi, 0x1fe0
jle 0x440a80
mov edi, 0xff
jmp 0x440a83
sar edi, 5
sub ebp, ecx
xor ebx, ebx
lea edx, [edi + ebp + 1]
sar edx, 1
mov byte [esi + 0xa], dl
mov bl, byte [eax + 0xa]
xor edx, edx
mov dl, byte [eax + 0xb]
mov ebp, edx
xor edx, edx
mov dl, byte [eax + 0xd]
add edx, ebx
xor ebx, ebx
mov bl, byte [eax + 9]
add edx, edx
mov edi, ebx
sub edi, edx
xor edx, edx
mov dl, byte [eax + 0xe]
add edi, edx
xor edx, edx
mov dl, byte [eax + 0xc]
add edx, ebp
lea edi, [edi + edi*2]
lea edx, [edx + edx*4]
lea edi, [edi + edx*4]
xor edx, edx
mov dl, byte [eax + 0xf]
sub edi, edx
xor edx, edx
mov dl, byte [eax + 8]
sub edi, edx
sub edi, ecx
add edi, 0x10
jns 0x440adc
xor edi, edi
jmp 0x440aee
cmp edi, 0x1fe0
jle 0x440aeb
mov edi, 0xff
jmp 0x440aee
sar edi, 5
sub ebp, ecx
xor ebx, ebx
lea edx, [edi + ebp + 1]
sar edx, 1
mov byte [esi + 0xb], dl
mov bl, byte [eax + 0xe]
xor edx, edx
mov dl, byte [eax + 0xc]
mov ebp, edx
xor edx, edx
mov dl, byte [eax + 0xb]
add edx, ebx
xor ebx, ebx
mov bl, byte [eax + 0xf]
add edx, edx
mov edi, ebx
sub edi, edx
xor edx, edx
mov dl, byte [eax + 0xa]
add edi, edx
xor edx, edx
mov dl, byte [eax + 0xd]
add edx, ebp
lea edi, [edi + edi*2]
lea edx, [edx + edx*4]
lea edi, [edi + edx*4]
xor edx, edx
mov dl, byte [eax + 9]
sub edi, edx
xor edx, edx
mov dl, byte [eax + 0x10]
sub edi, edx
sub edi, ecx
add edi, 0x10
jns 0x440b47
xor edi, edi
jmp 0x440b59
cmp edi, 0x1fe0
jle 0x440b56
mov edi, 0xff
jmp 0x440b59
sar edi, 5
sub ebp, ecx
xor ebx, ebx
lea edx, [edi + ebp + 1]
sar edx, 1
mov byte [esi + 0xc], dl
mov bl, byte [eax + 0xc]
xor edx, edx
mov dl, byte [eax + 0xd]
mov ebp, edx
xor edx, edx
mov dl, byte [eax + 0xf]
add edx, ebx
xor ebx, ebx
add edx, edx
mov bl, byte [eax + 0x10]
mov edi, edx
xor edx, edx
mov dl, byte [eax + 0xb]
sub edx, edi
lea edi, [edx + edx*2]
xor edx, edx
mov dl, byte [eax + 0xe]
add edx, ebp
lea edx, [edx + edx*4]
lea edx, [ebx + edx*2]
lea edi, [edi + edx*2 + 0x10]
xor edx, edx
mov dl, byte [eax + 0xa]
sub edi, edx
sub edi, ecx
jns 0x440baa
xor edi, edi
jmp 0x440bbc
cmp edi, 0x1fe0
jle 0x440bb9
mov edi, 0xff
jmp 0x440bbc
sar edi, 5
sub ebp, ecx
xor ebx, ebx
lea edx, [edi + ebp + 1]
sar edx, 1
mov byte [esi + 0xd], dl
mov bl, byte [eax + 0xc]
xor edx, edx
mov edi, ebx
mov dl, byte [eax + 0xe]
mov ebp, edx
xor edx, edx
mov dl, byte [eax + 0xd]
add edx, edx
sub edi, edx
xor edx, edx
mov dl, byte [eax + 0x10]
sub edi, edx
xor edx, edx
mov dl, byte [eax + 0xf]
lea edi, [edi + edi*2]
lea ebx, [edx + edx*8]
lea edx, [edx + ebx*2]
add edi, edx
lea edx, [ebp + ebp*4]
lea edi, [edi + edx*4]
xor edx, edx
mov dl, byte [eax + 0xb]
sub edi, edx
sub edi, ecx
add edi, 0x10
jns 0x440c0e
xor edi, edi
jmp 0x440c20
cmp edi, 0x1fe0
jle 0x440c1d
mov edi, 0xff
jmp 0x440c20
sar edi, 5
sub ebp, ecx
xor ebx, ebx
lea edx, [edi + ebp + 1]
sar edx, 1
mov byte [esi + 0xe], dl
xor edx, edx
mov dl, byte [eax + 0xf]
mov bl, byte [eax + 0xe]
mov ebp, edx
xor edx, edx
mov dl, byte [eax + 0x10]
add edx, edx
sub edx, ebx
lea edi, [edx*8]
sub edi, edx
xor edx, edx
mov dl, byte [eax + 0xd]
lea edx, [edx + edx*2]
add edi, edx
lea edx, [ebp + ebp*2]
shl edx, 3
sub edx, ebp
add edi, edx
xor edx, edx
mov dl, byte [eax + 0xc]
sub edi, edx
sub edi, ecx
add edi, 0x10
jns 0x440c70
xor edi, edi
jmp 0x440c82
cmp edi, 0x1fe0
jle 0x440c7f
mov edi, 0xff
jmp 0x440c82
sar edi, 5
sub ebp, ecx
lea edx, [edi + ebp + 1]
sar edx, 1
mov byte [esi + 0xf], dl
mov edx, dword [esp + 0x20]
add eax, edx
add esi, edx
mov edx, dword [esp + 0x1c]
dec edx
mov dword [esp + 0x1c], edx
jne 0x440610
pop edi
pop esi
pop ebp
pop ebx
ret