Function at 0x43ddd0
Capabilities:
Check for sandbox and av modules
Check for time delay via queryperformancecounter
Contain obfuscated stackstrings
Create thread
Encode data using xor
Get token membership
Hide graphical window
Hide thread from debugger
Log keystrokes via polling
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xc8
mov eax, dword [0x4c4080]
xor eax, esp
mov dword [esp + 0xc4], eax
mov eax, dword [ebp + 0x10]
push esi
push edi
push 0
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0
push 0x43ce80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp + 0xc]
mov dword [0x504c00], eax
call fcn.00434740
test eax, eax
jne 0x43e26b
push str.VBoxHook.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
push 0x80
push 3
push 0
xor ecx, ecx
test eax, eax
push 1
push 0x80000000
setne cl
push str..VBoxMiniRdrDN
mov dword [esp + 0x58], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov ecx, 1
mov eax, dword [esp + 0x3c]
cmovne eax, ecx
test eax, eax
jne 0x43e26b
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.SbieDll.dll
call edi
test eax, eax
jne 0x43e26b
lea eax, [esp + 0x48]
mov dword [esp + 0xc], str.VMWARE
push eax
push 0x20019
push 0
push str.SYSTEMControlSet001ServicesDiskEnum
push 0x80000002
mov dword [esp + 0x24], str.VBOX
mov dword [esp + 0x28], str.VIRTUAL
mov dword [esp + 0x50], 0x3f
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43df1d
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x8c]
push eax
push 0
push 0
push 0x4bb608
push dword [esp + 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43df13
xor esi, esi
push dword [esp + esi*4 + 0xc]
lea eax, [esp + 0x8c]
push eax
call fcn.00443fc0
add esp, 8
test eax, eax
jne 0x43e102
inc esi
cmp esi, 3
jb 0x43def1
push dword [esp + 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test eax, eax
jne 0x43e26b
call fcn.004347e0
test al, al
jne 0x43e26b
lea eax, [esp + 0x3c]
mov dword [esp + 0x40], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [esp + 0x68]
mov word [esp + 0x6c], 0x500
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x43ec0b
lea eax, [esp + 0x48]
mov dword [esp + 0x48], 0
push eax
push dword [esp + 0x40]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x43df91
mov dword [esp + 0x48], eax
push dword [esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [esp + 0x48], 0
je 0x43ec0b
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov ecx, str.ollydbg.exe
call fcn.00434b30
test al, al
jne 0x43ed0b
mov ecx, str.idaq64.exe
call fcn.00434b30
test al, al
jne 0x43ed0b
mov ecx, str.HxD.exe
call fcn.00434b30
test al, al
jne 0x43ed0b
mov ecx, str.ResourceHacker.exe
call fcn.00434b30
test al, al
jne 0x43ed0b
mov ecx, str.ProcessHacker.exe
call fcn.00434b30
test al, al
jne 0x43ed0b
mov ecx, str.idaq32.exe
call fcn.00434b30
test al, al
jne 0x43ed0b
mov ecx, str.httpdebugger.exe
call fcn.00434b30
test al, al
jne 0x43ed0b
mov ecx, str.windowrenamer.exe
call fcn.00434b30
test al, al
jne 0x43ed0b
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov esi, dword [esp + 0x18]
xorps xmm0, xmm0
movlpd qword [esp + 0x90], xmm0
push 0x7f00
push 0
mov dword [esp + 0xa4], 0
mov dword [esp + 0xb0], 0
mov dword [esp + 0x94], 0x43cd30
mov dword [esp + 0x90], 3
mov dword [esp + 0xa0], esi
mov dword [esp + 0xb4], str._FMLoader
call dword [sym.imp.USER32.dll_LoadCursorA]
lea ecx, [esp + 0x88]
mov dword [esp + 0xa0], eax
push ecx
mov dword [esp + 0xa8], 0xc
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x43e116
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0xc4]
xor ecx, esp
call fcn.0044279c
mov esp, ebp
pop ebp
ret
push dword [esp + 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x43df1f
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x84]
push 0
push esi
push 0
cdq
push 0
sub eax, edx
push 0x151
sar eax, 1
push 0x27c
sub eax, 0x4b
push eax
mov eax, dword [esp + 0x9c]
cdq
sub eax, edx
sar eax, 1
sub eax, 0x96
push eax
push 0x80000000
push str._FMLoader
push str._FMLoader
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4f73e4], eax
test eax, eax
jne 0x43e194
mov eax, 2
pop edi
pop esi
mov ecx, dword [esp + 0xc4]
xor ecx, esp
call fcn.0044279c
mov esp, ebp
pop ebp
ret
push 0x40000
push 0xffffffffffffffec
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0x20
call dword [sym.imp.d3d9.dll_Direct3DCreate9]
mov ecx, eax
mov dword [0x504c0c], ecx
test ecx, ecx
jne 0x43e1c8
push esi
push str._FMLoader
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov ecx, dword [0x504c0c]
push 0x504b00
push 0x504b08
push 0x40
push dword [0x4f73e4]
xorps xmm0, xmm0
mov dword [0x504b1c], 0
push 1
movlpd qword [0x504b08], xmm0
movlpd qword [0x504b14], xmm0
mov dword [0x504b24], 0
movlpd qword [0x504b34], xmm0
mov dword [0x504b28], 1
mov dword [0x504b20], 1
mov dword [0x504b10], 0
mov dword [0x504b2c], 1
mov dword [0x504b30], 0x50
mov dword [0x504b3c], 1
mov eax, dword [ecx]
push 0
push ecx
call dword [eax + 0x40]
test eax, eax
jns 0x43e281
mov eax, dword [0x504c0c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push esi
mov eax, dword [sym.imp.USER32.dll_UnregisterClassA]
push str._FMLoader
call eax
mov ecx, dword [esp + 0xcc]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.0044279c
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4f73e4]
mov dword [0x504ae8], eax
mov eax, dword [0x504b00]
push 0x504af8
mov dword [0x504ae0], eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x43e35b
push 0x504af0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x43e35b
mov ecx, dword [0x4c4b38]
mov eax, dword [0x504ae8]
mov dword [ecx + 0x28], 9
mov dword [ecx + 0x2c], 0x25
mov dword [ecx + 0x30], 0x27
mov dword [ecx + 0x34], 0x26
mov dword [ecx + 0x38], 0x28
mov dword [ecx + 0x3c], 0x21
mov dword [ecx + 0x40], 0x22
mov dword [ecx + 0x44], 0x24
mov dword [ecx + 0x48], 0x23
mov dword [ecx + 0x4c], 0x2e
mov dword [ecx + 0x50], 8
mov dword [ecx + 0x54], 0xd
mov dword [ecx + 0x58], 0x1b
mov dword [ecx + 0x5c], 0x41
mov dword [ecx + 0x60], 0x43
mov dword [ecx + 0x64], 0x56
mov dword [ecx + 0x68], 0x58
mov dword [ecx + 0x6c], 0x59
mov dword [ecx + 0x70], 0x5a
mov dword [ecx + 0xac], 0x433470
mov dword [ecx + 0xc8], eax
call fcn.004349c0
push 0
call edi
mov ecx, dword [eax + 0x3c]
mov ecx, dword [ecx + eax + 0xc8]
cmp dword [ecx + eax + 0xc], 0
jne 0x43ed0b
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.NtSetInformationThread
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0
push 0x11
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
call fcn.0043a490
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x43ecfa
push 0xa
push dword [0x4f73e4]
xorps xmm0, xmm0
mov dword [esp + 0x70], eax
movaps xmmword [esp + 0x58], xmm0
movq qword [esp + 0x68], xmm0
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x4f73e4]
call dword [sym.imp.USER32.dll_UpdateWindow]
call fcn.00439360
cmp dword [esp + 0x54], 0x12
je 0x43eb5f
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 1
push 0
push 0
push 0
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x43e428
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x43eb54
cmp dword [0x504ad8], 0
jne 0x43e43f
cmp dword [0x504ae0], 0
je 0x43e43f
call fcn.00433e30
mov esi, dword [0x4c4b38]
lea eax, [esp + 0x2c]
push eax
push dword [0x504ae8]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x34]
sub eax, dword [esp + 0x2c]
movd xmm1, eax
mov eax, dword [esp + 0x38]
sub eax, dword [esp + 0x30]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [esp + 0x40]
cvtdq2ps xmm0, xmm0
push eax
movss dword [esi + 4], xmm1
movss dword [esi + 8], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x40]
sub ecx, dword [0x504af0]
mov edx, dword [esp + 0x44]
sbb edx, dword [0x504af4]
call fcn.00469aa0
mov edx, dword [0x504afc]
mov ecx, dword [0x504af8]
cvtsd2ss xmm0, xmm0
movss dword [esp + 0x3c], xmm0
call fcn.00469aa0
movss xmm1, dword [esp + 0x3c]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [esi + 0xc], xmm1
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [0x504af0], eax
mov dword [0x504af4], ecx
call edi
shr eax, 0xf
and al, 1
push 0x10
mov byte [esi + 0xe1], al
call edi
shr eax, 0xf
and al, 1
push 0x12
mov byte [esi + 0xe2], al
call edi
shr eax, 0xf
and al, 1
mov byte [esi + 0xe4], 0
cmp byte [esi + 0xe0], 0
mov byte [esi + 0xe3], al
je 0x43e528
push 0
call dword [sym.imp.USER32.dll_SetCursor]
call fcn.004158d0
cmp byte [0x4f5a20], 0
je 0x43e9b0
movaps xmm0, xmmword [0x4bc650]
lea edx, [esp + 0x88]
xor ecx, ecx
movups xmmword [esp + 0x88], xmm0
call fcn.0041d9e0
movss xmm3, dword [0x4bc2a8]
lea eax, [esp + 0x48]
push 0x13f
push eax
mov edx, 0x4f5a20
mov dword [esp + 0x50], 0x441f0000
mov ecx, str._FMLoader
mov dword [esp + 0x54], 0x43a88000
call fcn.004199f0
mov esi, dword [0x4c4b38]
add esp, 8
mov eax, dword [esi + 0x1784]
mov ecx, dword [esi + 0x178c]
lea edx, [eax + eax*4]
mov eax, dword [ecx + edx*4 - 0x14]
movups xmm0, xmmword [ecx + edx*4 - 0x10]
add eax, 0x144
add eax, eax
movups xmmword [esi + eax*8], xmm0
dec dword [esi + 0x1784]
movss xmm1, dword [0x504b40]
movsd xmm2, qword [0x4bc2d8]
cvtps2pd xmm0, xmm1
comisd xmm2, xmm0
jbe 0x43e5e5
addss xmm1, dword [0x4bc258]
movss dword [0x504b40], xmm1
jmp 0x43e5ec
mov byte [0x4f5a20], 0
call fcn.00439970
test al, al
je 0x43ed01
cmp dword [0x4f5b08], 0xf
mov eax, 0x4f5af4
push dword [0x4f5b04]
cmova eax, dword [0x4f5af4]
mov ecx, 0x4f5adc
cmp dword [0x4f5af0], 0xf
mov edx, dword [0x4f5aec]
cmova ecx, dword [0x4f5adc]
push eax
push ecx
call fcn.00440b60
add esp, 0xc
mov edx, 0xe
cmp eax, 0xffffffff
mov ecx, 2
mov eax, 0x4bbd98
cmove ecx, edx
push ecx
mov ecx, str.Nao_Autorizado
cmovne ecx, eax
push ecx
mov ecx, 0x4f5aac
call fcn.0040c760
mov ecx, dword [0x4c4b38]
lea edx, [esp + 0x88]
mov eax, dword [ecx + 0x172c]
mov byte [eax + 0x86], 1
mov eax, dword [ecx + 0x172c]
mov ecx, 0x27
movss xmm0, dword [eax + 0x18]
subss xmm0, dword [eax + 0x5c]
movss xmm2, dword [eax + 0x1c]
subss xmm2, dword [eax + 0x60]
addss xmm0, dword [0x4bc344]
addss xmm2, dword [0x4bc3b0]
movss dword [eax + 0xb8], xmm0
movss dword [eax + 0xbc], xmm2
movss xmm1, dword [eax + 0xd0]
maxss xmm1, xmm0
movss xmm0, dword [eax + 0xd4]
maxss xmm0, xmm2
movss dword [eax + 0xd0], xmm1
movss dword [eax + 0xd4], xmm0
movaps xmm0, xmmword [0x4bc5f0]
movups xmmword [esp + 0x88], xmm0
call fcn.0041d9e0
movss xmm0, dword [0x504b40]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x44150000
mov dword [esp + 0x10], 0x42480000
call fcn.0041ef90
mov edi, dword [0x4f5a74]
xorps xmm0, xmm0
xor ecx, ecx
movss dword [0x504c04], xmm0
test edi, edi
je 0x43e766
mov edx, dword [0x4f5a78]
mov esi, dword [0x4f5a64]
nop word [eax + eax]
cmp edx, 0xf
mov eax, 0x4f5a64
cmova eax, esi
cmp byte [eax + ecx], 0x20
jne 0x43e761
addss xmm0, dword [0x4bc28c]
movss dword [0x504c04], xmm0
inc ecx
cmp ecx, edi
jb 0x43e740
movss xmm0, dword [0x4f5a14]
movss xmm2, dword [0x4bc2b8]
comiss xmm0, xmm2
jb 0x43e79a
movss xmm1, dword [0x4f5a18]
comiss xmm2, xmm1
jb 0x43e79a
addss xmm1, dword [0x4bc25c]
movss dword [0x4f5a18], xmm1
jmp 0x43e7af
comiss xmm2, xmm0
jb 0x43e7af
subss xmm0, dword [0x4bc25c]
movss dword [0x4f5a14], xmm0
mov ecx, dword [0x4c4b38]
mov dword [esp + 0x28], 0x3f800000
mov eax, dword [ecx + 0x172c]
mov byte [eax + 0x86], 1
mov eax, dword [ecx + 0x172c]
movss xmm0, dword [eax + 0x18]
subss xmm0, dword [eax + 0x5c]
movss xmm2, dword [eax + 0x1c]
subss xmm2, dword [eax + 0x60]
addss xmm0, dword [0x4bc344]
addss xmm2, dword [0x4bc3f8]
movss dword [eax + 0xb8], xmm0
movss dword [eax + 0xbc], xmm2
movss xmm1, dword [eax + 0xd0]
maxss xmm1, xmm0
movss xmm0, dword [eax + 0xd4]
maxss xmm0, xmm2
movss dword [eax + 0xd0], xmm1
movss dword [eax + 0xd4], xmm0
mov eax, 0x4f5a64
cmp dword [0x4f5a78], 0xf
movss xmm0, dword [0x4f5a14]
cmova eax, dword [0x4f5a64]
movss dword [esp + 0x1c], xmm0
movss xmm0, dword [0x4f5a18]
push eax
movss dword [esp + 0x24], xmm0
lea eax, [esp + 0x20]
movss xmm0, dword [0x4f5a1c]
push eax
movss dword [esp + 0x2c], xmm0
call fcn.0041dd20
mov ecx, dword [0x4c4b38]
push str.FelixDev6590
mov eax, dword [ecx + 0x172c]
mov byte [eax + 0x86], 1
mov eax, dword [ecx + 0x172c]
movss xmm0, dword [eax + 0x18]
subss xmm0, dword [eax + 0x5c]
movss xmm2, dword [eax + 0x1c]
subss xmm2, dword [eax + 0x60]
addss xmm0, dword [0x4bc438]
addss xmm2, dword [0x4bc3f8]
movss dword [eax + 0xb8], xmm0
movss dword [eax + 0xbc], xmm2
movss xmm1, dword [eax + 0xd0]
maxss xmm1, xmm0
movss xmm0, dword [eax + 0xd4]
maxss xmm0, xmm2
movss dword [eax + 0xd0], xmm1
movss dword [eax + 0xd4], xmm0
lea eax, [esp + 0x94]
movaps xmm0, xmmword [0x4bc5e0]
push eax
movups xmmword [esp + 0x98], xmm0
call fcn.0041dd20
mov ecx, dword [0x4c4b38]
push str.Powered_By:
mov eax, dword [ecx + 0x172c]
mov byte [eax + 0x86], 1
mov eax, dword [ecx + 0x172c]
movss xmm0, dword [eax + 0x18]
subss xmm0, dword [eax + 0x5c]
movss xmm2, dword [eax + 0x1c]
subss xmm2, dword [eax + 0x60]
addss xmm0, dword [0x4bc420]
addss xmm2, dword [0x4bc3f4]
movss dword [eax + 0xb8], xmm0
movss dword [eax + 0xbc], xmm2
movss xmm1, dword [eax + 0xd0]
maxss xmm1, xmm0
movss xmm0, dword [eax + 0xd4]
maxss xmm0, xmm2
movss dword [eax + 0xd0], xmm1
movss dword [eax + 0xd4], xmm0
lea eax, [esp + 0x9c]
movaps xmm0, xmmword [0x4bc640]
push eax
movups xmmword [esp + 0xa0], xmm0
call fcn.0041dd20
add esp, 0x18
call fcn.0041ceb0
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x43e9ee
call fcn.0043afa0
mov eax, dword [0x504b00]
push 0
push 7
push eax
mov ecx, dword [eax]
call dword [ecx + 0xe4]
mov eax, dword [0x504b00]
push 0
push 0x1b
push eax
mov ecx, dword [eax]
call dword [ecx + 0xe4]
mov eax, dword [0x504b00]
push 0
push 0xae
push eax
mov ecx, dword [eax]
call dword [ecx + 0xe4]
mov eax, dword [0x504b00]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa4]
test eax, eax
js 0x43eb39
cmp dword [0x504b48], 0
jne 0x43ea3f
push 0x4f5990
push 0x30d40
push 0x4c4b40
push dword [0x504b00]
call dword [sym.imp.d3dx9_43.dll_D3DXCreateTextureFromFileInMemory]
push 0x4f5994
push dword [0x504b00]
call dword [sym.imp.d3dx9_43.dll_D3DXCreateSprite]
inc dword [0x504b48]
call fcn.004175e0
cmp dword [0x504ae0], 0
je 0x43eaad
mov ecx, dword [0x504ae4]
test ecx, ecx
je 0x43ea67
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x504ae4], 0
mov ecx, dword [0x504adc]
test ecx, ecx
je 0x43ea81
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x504adc], 0
mov ecx, dword [0x504ad8]
mov esi, dword [0x4c4b38]
test ecx, ecx
je 0x43ea97
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x504ad8], 0
mov eax, dword [esi + 0x80]
mov dword [eax], 0
cmp dword [0x4f5ac0], 0xf
mov eax, 0x4f5aac
mov ecx, 0x4bbd98
cmova eax, dword [0x4f5aac]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x43eae5
test dl, dl
je 0x43eae1
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x43eae5
add eax, 2
add ecx, 2
test dl, dl
jne 0x43eac5
xor eax, eax
jmp 0x43eaea
sbb eax, eax
or eax, 1
test eax, eax
je 0x43eaf7
cmp byte [0x4f5a20], 0
je 0x43eb2b
mov eax, dword [0x4f5994]
push 0x10
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
mov eax, dword [0x4f5994]
push 0xffffffffffffffff
push 0x4f59a0
push 0
mov ecx, dword [eax]
push 0
push dword [0x4f5990]
push eax
call dword [ecx + 0x24]
mov eax, dword [0x4f5994]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [0x504b00]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa8]
mov eax, dword [0x504b00]
push 0
push 0
push 0
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x44]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x54], 0x12
jne 0x43e3f6
cmp dword [0x504ae0], 0
je 0x43ebc8
mov ecx, dword [0x504ae4]
test ecx, ecx
je 0x43eb82
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x504ae4], 0
mov ecx, dword [0x504adc]
test ecx, ecx
je 0x43eb9c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x504adc], 0
mov ecx, dword [0x504ad8]
mov esi, dword [0x4c4b38]
test ecx, ecx
je 0x43ebb2
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x504ad8], 0
mov eax, dword [esi + 0x80]
mov dword [eax], 0
call fcn.004166e0
mov ecx, dword [0x504b00]
mov dword [0x504ae0], 0
mov dword [0x504ae8], 0
test ecx, ecx
je 0x43ebf1
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [0x504c0c]
test ecx, ecx
je 0x43ec01
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [esp + 0x18]
push eax
jmp 0x43e25f
movaps xmm0, xmmword [str.R_7_r3_r36_____]
mov cl, 0x66
mov dl, cl
mov byte [esp + 0xc], 0x4d
xor cl, byte [esp + 0xc]
mov al, 0x2e
xor al, byte [esp + 0xc]
mov ch, 0x21
mov byte [esp + 0xd], al
mov ah, 0x6d
mov byte [esp + 0xe], cl
mov dh, 0x22
mov cl, byte [esp + 0xc]
mov byte [esp + 8], 0x2c
xor ch, cl
mov al, byte [esp + 8]
xor dl, cl
xor al, cl
mov byte [esp + 9], 0x29
mov byte [esp + 0x13], al
xor ah, cl
mov al, byte [esp + 9]
xor dh, cl
xor al, cl
mov byte [esp + 0xa], 0x28
mov byte [esp + 0x14], al
mov al, byte [esp + 0xa]
xor al, cl
mov byte [esp + 0xb], 0x3f
mov byte [esp + 0x15], al
mov al, byte [esp + 0xb]
xor al, cl
mov byte [esp + 0x17], 0
mov byte [esp + 0x11], ch
xor ecx, ecx
mov byte [esp + 0xf], dl
mov byte [esp + 0x10], ah
mov byte [esp + 0x12], dh
mov byte [esp + 0x16], al
mov byte [esp + 0x17], 0
movups xmmword [esp + 0x88], xmm0
mov dword [esp + 0x98], 0x26332026
mov word [esp + 0x9c], 0x203d
mov byte [esp + 0x9e], 0
nop dword [eax]
mov al, byte [esp + 0x88]
xor byte [esp + ecx + 0x89], al
inc ecx
cmp ecx, 0x15
jb 0x43ecc0
push 0
lea eax, [esp + 0x11]
mov byte [esp + 0xa2], 0
push eax
lea eax, [esp + 0x91]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.00452aab
push 1
call fcn.00452aab
mov ecx, str.Algo_Deu_Errado__Contate_o_Desenvolvedor.
call fcn.004387c0
push 0xffffffffffffffff
call fcn.00452aab
int3