Function at 0x401af2
Capabilities:
Contain obfuscated stackstrings
Identify system language via api
Parse pe header
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x433278
push 0x42ea10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x7ef7ffff
movsx eax, byte [0x438c18]
push eax
call fcn.0040aa18
add byte [0x438c21], al
push 0xbcf1ffff
movsx eax, byte [0x438c19]
push eax
call fcn.0040a96f
add esp, 0x10
add word [0x438c2e], ax
mov esi, 0x104
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x124]
push eax
push 0xe
call fcn.0040ebd2
pop ecx
call eax
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x228]
push eax
push 0x3e
call fcn.0040ebd2
pop ecx
call eax
mov al, byte [0x438c32]
add al, byte [0x438c1a]
add byte [0x438c1b], al
mov eax, dword [0x438948]
xor ebx, ebx
cmp eax, ebx
jne 0x402602
push dword [0x438c5c]
movsx eax, word [0x438c2c]
push eax
push 0x3a7dffff
call dword [sym.imp.KERNEL32.dll_MulDiv]
add word [0x438c32], ax
mov byte [0x438c1e], 1
mov eax, dword [0x438c58]
inc eax
mov word [0x438c24], ax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2d8], ebx
mov dword [ebp - 0x20], 7
push dword [0x438c54]
push 0xf6efffff
call fcn.0040a933
mov byte [0x438c18], al
movsx eax, word [0x438c2e]
push eax
push dword [0x438c4c]
call fcn.0040a933
add esp, 0x10
add dword [0x438c40], eax
call fcn.0040192e
test al, al
jne 0x4025f4
mov word [0x438c30], 1
dec word [0x438c2a]
movsx eax, word [0x438c34]
push eax
movsx eax, byte [0x438c18]
push eax
call fcn.0040aa4f
pop ecx
pop ecx
add byte [0x438c1c], al
mov dword [ebp - 0x20], 0xa
mov byte [ebp - 0x238], 0x5f
mov byte [ebp - 0x237], 0x5f
mov byte [ebp - 0x236], 0x2d
mov byte [ebp - 0x235], 0x5f
mov byte [ebp - 0x234], 0x50
mov byte [ebp - 0x233], 0x4a
mov byte [ebp - 0x232], 0x40
mov byte [ebp - 0x231], 0x46
mov byte [ebp - 0x230], 3
mov byte [ebp - 0x288], 0x5f
mov byte [ebp - 0x287], 0x5f
mov byte [ebp - 0x286], 0x2d
mov byte [ebp - 0x285], 0x5f
mov byte [ebp - 0x284], 0x4d
mov byte [ebp - 0x283], 0x57
mov byte [ebp - 0x282], 0x4a
mov byte [ebp - 0x281], 0x40
mov byte [ebp - 0x280], 0x46
mov byte [ebp - 0x27f], 3
mov byte [ebp - 0x2d0], 0x5f
mov byte [ebp - 0x2cf], 0x5f
mov byte [ebp - 0x2ce], 0x2d
mov byte [ebp - 0x2cd], 0x5f
mov byte [ebp - 0x2cc], 0x50
mov byte [ebp - 0x2cb], 0x4a
mov byte [ebp - 0x2ca], 0x54
mov byte [ebp - 0x2c9], 0x55
mov byte [ebp - 0x2c8], 0x4a
mov byte [ebp - 0x2c7], 0x47
mov byte [ebp - 0x2c6], 0x50
mov byte [ebp - 0x2c5], 0x57
mov byte [ebp - 0x2c4], 0x42
mov byte [ebp - 0x2c3], 0x51
mov byte [ebp - 0x2c2], 0x57
mov byte [ebp - 0x2c1], 3
inc byte [0x438c21]
push ebx
mov esi, 0x80
push esi
push 3
push ebx
push 3
mov edi, 0x80000000
push edi
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.004017dc
pop ecx
pop ecx
push eax
push 0x36
call fcn.0040ebd2
pop ecx
call eax
mov dword [ebp - 0x2d4], eax
cmp eax, 0xffffffff
jne 0x402566
push ebx
push esi
push 3
push ebx
push 3
push edi
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.004017dc
pop ecx
pop ecx
push eax
push 0x36
call fcn.0040ebd2
pop ecx
call eax
mov dword [ebp - 0x2d4], eax
cmp eax, 0xffffffff
jne 0x402566
push ebx
push esi
push 3
push ebx
push 3
push edi
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x2d0]
push eax
call fcn.004017dc
pop ecx
pop ecx
push eax
push 0x36
call fcn.0040ebd2
pop ecx
call eax
mov dword [ebp - 0x2d4], eax
cmp eax, 0xffffffff
jne 0x402566
mov al, byte [0x438c21]
mov byte [0x438c21], al
movsx ax, byte [0x438c1d]
or eax, dword [0x438c5c]
add word [0x438c2e], ax
movsx eax, word [0x438c30]
push eax
movsx eax, byte [0x438c1c]
push eax
call fcn.0040aa83
add byte [0x438c1e], al
mov dword [ebp - 0x20], 8
mov byte [ebp - 0x2c0], 0x68
mov byte [ebp - 0x2bf], 0x66
mov byte [ebp - 0x2be], 0x71
mov byte [ebp - 0x2bd], 0x6d
mov byte [ebp - 0x2bc], 0x66
mov byte [ebp - 0x2bb], 0x6f
mov byte [ebp - 0x2ba], 0x30
mov byte [ebp - 0x2b9], 0x31
mov byte [ebp - 0x2b8], 3
mov byte [ebp - 0x2b4], 0x56
mov byte [ebp - 0x2b3], 0x6d
mov byte [ebp - 0x2b2], 0x6b
mov byte [ebp - 0x2b1], 0x62
mov byte [ebp - 0x2b0], 0x6d
mov byte [ebp - 0x2af], 0x67
mov byte [ebp - 0x2ae], 0x6f
mov byte [ebp - 0x2ad], 0x66
mov byte [ebp - 0x2ac], 0x67
mov byte [ebp - 0x2ab], 0x46
mov byte [ebp - 0x2aa], 0x7b
mov byte [ebp - 0x2a9], 0x60
mov byte [ebp - 0x2a8], 0x66
mov byte [ebp - 0x2a7], 0x73
mov byte [ebp - 0x2a6], 0x77
mov byte [ebp - 0x2a5], 0x6a
mov byte [ebp - 0x2a4], 0x6c
mov byte [ebp - 0x2a3], 0x6d
mov byte [ebp - 0x2a2], 0x45
mov byte [ebp - 0x2a1], 0x6a
mov byte [ebp - 0x2a0], 0x6f
mov byte [ebp - 0x29f], 0x77
mov byte [ebp - 0x29e], 0x66
mov byte [ebp - 0x29d], 0x71
mov byte [ebp - 0x29c], 3
push 0x3b11ffff
push 0xe105ffff
call fcn.0040aa4f
add word [0x438c28], ax
push 0xe1efffff
push 0xa41dffff
call fcn.0040a933
mov word [0x438c2a], ax
movsx eax, word [0x438c32]
push eax
push 0xc6c1ffff
call fcn.0040aac5
mov dword [0x438c38], eax
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x2c0]
push eax
call fcn.004017dc
add esp, 0x28
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x298], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
add dword [0x438c50], eax
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x2b4]
push eax
call fcn.004017dc
pop ecx
pop ecx
push eax
push dword [ebp - 0x298]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
movzx eax, byte [eax]
cmp eax, 0xffffffcc
jne 0x402015
mov al, byte [0x438c1b]
mov cl, byte [0x438c21]
sub eax, ecx
mov byte [0x438c1d], al
push 0x6a71ffff
push 0x3dd5ffff
call fcn.0040a96f
add byte [0x438c1f], al
push 0x162fffff
push 0x2f65ffff
call fcn.0040a96f
add esp, 0x10
add word [0x438c22], ax
jmp 0x4025f4
inc byte [0x438c20]
mov eax, dword [0x438c50]
mov ecx, dword [0x438c40]
lea eax, [eax + ecx + 0xbb3ffff]
mov dword [0x438c50], eax
push 0xddb1ffff
movsx eax, word [0x438c2a]
push eax
call fcn.0040aa4f
pop ecx
pop ecx
mov dword [0x438c38], eax
push 1
pop eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
push 0xb59fffff
push dword [0x438c54]
call fcn.0040aa83
pop ecx
pop ecx
add byte [0x438c1d], al
push edx
push ecx
push eax
and eax, 0xda41ffff
and ecx, 0xbefffff
and ecx, 0xa221ffff
dec edx
pop eax
pop ecx
pop edx
xor ebx, ebx
push ecx
push ebx
push eax
sub ebx, ecx
xor eax, eax
or ecx, ecx
nop
dec ebx
pop eax
pop ebx
pop ecx
mov ecx, 0xa
push edx
push ebx
push eax
sub eax, edx
or edx, ebx
xor eax, eax
add eax, 0x67bfffff
inc edx
pop eax
pop ebx
pop edx
mov eax, 0x564d5868
push edx
push ebx
push eax
dec ebx
imul edx, edx, 0x4d45ffff
or eax, 0x4e5bffff
sub ebx, 0x2097ffff
pop eax
pop ebx
pop edx
mov dx, 0x5658
push edx
push ecx
push eax
imul eax, eax
and edx, 0x44b9ffff
dec ecx
inc edx
nop
pop eax
pop ecx
pop edx
in eax, dx
cmp ebx, 0x564d5868
sete al
push ecx
push ebx
push eax
nop
inc eax
add ecx, 0xd7a3ffff
add ebx, ebx
dec eax
pop eax
pop ebx
pop ecx
movzx eax, al
push ecx
push ebx
push eax
inc eax
nop
dec ebx
imul ecx, ecx, 0x4761ffff
pop eax
pop ebx
pop ecx
mov dword [ebp - 0x2d8], eax
push edx
push ecx
push ebx
push eax
or ecx, 0x68e1ffff
nop
mov ebx, eax
sub edx, 0x4ba7ffff
pop eax
pop ebx
pop ecx
pop edx
movsx eax, word [0x438c26]
push eax
movsx eax, byte [0x438c1b]
push eax
call fcn.0040aa83
pop ecx
pop ecx
add word [0x438c34], ax
mov word [0x438c24], 1
xor ebx, ebx
mov dword [ebp - 4], ebx
jmp 0x402181
mov byte [0x438c21], 1
push 1
pop esi
mov dword [0x438c3c], esi
cmp dword [ebp - 0x2d8], ebx
jne 0x4025f4
mov eax, dword [0x438c5c]
imul eax, eax, 0x2f51ffff
mov byte [0x438c1a], al
movsx eax, word [0x438c2e]
push eax
push 0x4a49ffff
call fcn.0040aa4f
pop ecx
pop ecx
mov word [0x438c32], ax
cmp byte [0x438c19], bl
jne 0x4021dc
cmp word [0x438c22], bx
jne 0x4021dc
xor eax, eax
jmp 0x4021de
mov eax, esi
add word [0x438c2a], ax
push 2
pop edi
mov dword [ebp - 0x20], edi
push 0x40
mov eax, 0x1000
push eax
push eax
push ebx
push 0x59
call fcn.0040ebd2
pop ecx
call eax
mov dword [ebp - 0x23c], eax
dec byte [0x438c1c]
mov esi, dword [0x432cbc]
mov dword [ebp - 0x22c], esi
mov al, byte [esi]
sub al, 3
movzx eax, al
add eax, 3
and al, 0xfc
call fcn.0042e9e0
mov dword [ebp - 0x18], esp
mov eax, esp
push 5
push esi
push eax
call fcn.0042bd2b
pop ecx
pop ecx
push eax
push dword [ebp - 0x23c]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov word [0x438c2e], 1
mov dword [ebp - 4], edi
mov al, byte [0x438c1f]
dec al
add byte [0x438c1a], al
mov ax, word [0x438c32]
inc ax
add word [0x438c34], ax
movsx eax, byte [0x438c1b]
push eax
movsx eax, word [0x438c22]
push eax
call fcn.0040a9a5
pop ecx
pop ecx
add byte [0x438c18], al
push ecx
push ebx
nop
mov ebx, 0x28b3ffff
xor ebx, ecx
pop ebx
pop ecx
pushal
push edx
push ecx
push ebx
nop
inc ebx
add edx, 0x15d9ffff
inc ebx
and edx, 0xb0d5ffff
nop
imul ecx, ecx, 0xfb59ffff
pop ebx
pop ecx
pop edx
mov ebx, dword [ebp - 0x23c]
push edx
push ecx
push ebx
push eax
and eax, edx
mov ecx, eax
mov edx, ecx
dec ebx
sub edx, 0xfc3ffff
dec eax
sub ebx, 0x5d89ffff
pop eax
pop ebx
pop ecx
pop edx
call ebx
push ecx
push eax
imul eax, ecx
inc eax
or eax, 0x4f53ffff
dec eax
and ecx, ecx
add eax, 0x388bffff
pop eax
pop ecx
popal
push edx
push ebx
push eax
dec edx
and eax, 0xd63fffff
and ebx, edx
pop eax
pop ebx
pop edx
inc dword [ebp - 0x2d8]
push edx
push ecx
push ebx
push eax
inc edx
imul ebx, eax
xor ecx, edx
mov eax, 0x1219ffff
nop
and eax, 0x322dffff
and edx, eax
pop eax
pop ebx
pop ecx
pop edx
mov word [0x438c2c], 1
mov ax, word [0x438c22]
mov cx, word [0x438c24]
sub eax, ecx
mov word [0x438c22], ax
xor esi, esi
mov dword [ebp - 4], esi
jmp 0x402381
push 0x63cbffff
push 0xc39dffff
call fcn.0040a8f9
mov dword [0x438c5c], eax
mov al, byte [0x438c2a]
sub byte [0x438c1b], al
movsx eax, word [0x438c24]
push eax
push 0x5dedffff
call fcn.0040aac5
add esp, 0x10
mov byte [0x438c1d], al
push 0x8000
push esi
push dword [ebp - 0x23c]
push 0x5a
call fcn.0040ebd2
pop ecx
call eax
call dword [sym.imp.USER32.dll_GetInputState]
mov byte [0x438c19], al
movsx eax, word [0x438c30]
or eax, 0x8637ffff
add dword [0x438c58], eax
push 0x6b0dffff
movsx eax, byte [0x438c1d]
push eax
call fcn.0040a9a5
pop ecx
pop ecx
add byte [0x438c20], al
cmp dword [ebp - 0x2d8], esi
jne 0x4025f4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
add word [0x438c28], ax
push 0x9e2fffff
push dword [0x438c44]
call fcn.0040a9a5
add byte [0x438c1f], al
push 3
pop ebx
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x294], 0x5f
mov byte [ebp - 0x293], 0x5f
mov byte [ebp - 0x292], 0x2d
mov byte [ebp - 0x291], 0x5f
mov byte [ebp - 0x290], 0x55
mov byte [ebp - 0x28f], 0x4e
mov byte [ebp - 0x28e], 0x47
mov byte [ebp - 0x28d], 0x51
mov byte [ebp - 0x28c], 0x55
mov byte [ebp - 0x28b], bl
push 0x8521ffff
push 0x4be3ffff
call fcn.0040a9a5
add esp, 0x10
mov word [0x438c2c], ax
push esi
push 0x80
push ebx
push esi
push ebx
push 0x80000000
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x294]
push eax
call fcn.004017dc
pop ecx
pop ecx
push eax
push 0x36
call fcn.0040ebd2
pop ecx
call eax
mov dword [ebp - 0x2d4], eax
cmp eax, 0xffffffff
je 0x402548
movsx eax, byte [0x438c20]
push eax
movsx eax, byte [0x438c1e]
push eax
call fcn.0040aac5
pop ecx
pop ecx
add word [0x438c2a], ax
movsx eax, word [0x438c2a]
movsx ecx, byte [0x438c21]
add ecx, dword [0x438c38]
add ecx, eax
mov dword [0x438c38], ecx
push dword [ebp - 0x2d4]
push 0x33
call fcn.0040ebd2
pop ecx
call eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov word [0x438c24], ax
movsx eax, word [0x438c34]
push eax
push dword [0x438c4c]
call fcn.0040aac5
pop ecx
pop ecx
add byte [0x438c21], al
jmp 0x4025f4
push 0xdd09ffff
push dword [0x438c3c]
call fcn.0040aac5
pop ecx
pop ecx
add byte [0x438c1d], al
int3
push 0xc57bffff
push 0xe211ffff
call fcn.0040aa4f
pop ecx
pop ecx
mov dword [0x438c3c], eax
push dword [ebp - 0x2d4]
push 0x33
call fcn.0040ebd2
pop ecx
call eax
inc word [0x438c2e]
push dword [0x438c48]
push 0x9eabffff
call fcn.0040aa4f
pop ecx
pop ecx
mov byte [0x438c1f], al
mov ax, word [0x438c2c]
imul eax, eax, 0x2003ffff
mov word [0x438c28], ax
jmp 0x4025f4
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
mov dword [0x438948], eax
jmp 0x402605
mov dword [ebp - 0x20], eax
movsx eax, byte [0x438c18]
push eax
push 0xafc9ffff
call fcn.0040a933
mov word [0x438c24], ax
push 0xdefffff
movsx eax, word [0x438c2e]
push eax
call fcn.0040aa83
add word [0x438c22], ax
push 0x88d5ffff
movsx eax, byte [0x438c1a]
push eax
call fcn.0040aa83
add esp, 0x18
add word [0x438c30], ax
movsx eax, byte [0x438c1e]
mov ecx, dword [0x438c3c]
lea eax, [ecx + eax - 0x227a0001]
mov dword [0x438c3c], eax
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0x2e4]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret