Function at 0x401634
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, ecx
lea esi, [ebp - 4]
mov ebx, eax
call fcn.00402cc0
mov edi, dword [ebp - 4]
movzx eax, word [edi]
push eax
mov esi, edi
call fcn.004034bd
pop ecx
test eax, eax
je 0x4016b0
inc esi
inc esi
movzx eax, word [esi]
push eax
call fcn.004034bd
pop ecx
test eax, eax
jne 0x40165c
cmp esi, edi
je 0x4016b0
push dword [edi - 0xc]
sub esi, edi
sar esi, 1
mov dword [ebp - 0x10], esi
lea esi, [ebp - 4]
call fcn.00402ba7
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx - 0xc]
mov edi, dword [ebp - 0x10]
mov esi, ecx
lea edx, [eax + edi*2]
sub esi, edi
lea edi, [esi + esi + 2]
push edi
push edx
lea ecx, [ecx + ecx + 2]
push ecx
push eax
call fcn.00402734
add esp, 0x10
mov eax, esi
lea edx, [ebp - 4]
call fcn.00402bf1
lea eax, [ebp - 4]
call fcn.004026e4
mov edi, dword [ebp - 4]
mov eax, dword [edi - 0xc]
test eax, eax
jle 0x4016da
push 0x3b
push edi
call fcn.00403808
pop ecx
pop ecx
test eax, eax
je 0x4016da
sub eax, edi
sar eax, 1
mov esi, eax
test esi, esi
jg 0x4016eb
xor esi, esi
lea eax, [edi - 0x10]
call fcn.00402aa7
mov eax, esi
jmp 0x4019a7
mov ecx, esi
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.004026ae
mov ecx, dword [edi - 0xc]
lea eax, [esi + 1]
mov esi, ecx
sub esi, eax
mov edx, eax
mov dword [ebp - 0xc], edx
test eax, eax
jge 0x401712
and dword [ebp - 0xc], 0
mov edx, dword [ebp - 0xc]
test esi, esi
jge 0x401718
xor esi, esi
mov eax, 0x7fffffff
sub eax, edx
cmp eax, esi
jl 0x40174c
lea eax, [edx + esi]
cmp eax, ecx
jle 0x40172e
mov esi, ecx
sub esi, edx
cmp edx, ecx
jle 0x401734
xor esi, esi
test edx, edx
jne 0x401756
cmp esi, ecx
jne 0x401756
lea eax, [edi - 0x10]
call fcn.00402753
add eax, 0x10
mov dword [ebp - 0xc], eax
jmp 0x401771
push 0x80070057
call fcn.00402bcd
lea eax, [ebp - 4]
call fcn.0040268a
mov ecx, dword [ebp - 0xc]
lea ecx, [edi + ecx*2]
push ecx
mov edi, esi
mov ecx, eax
lea esi, [ebp - 0xc]
call fcn.00402634
lea eax, [ebp - 0xc]
lea edi, [ebp - 4]
call fcn.00401dda
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.00402aa7
mov edi, dword [ebp - 4]
cmp dword [edi - 0xc], 0
jl 0x4018e6
push str.XmlPath:
push edi
call fcn.00403c4f
pop ecx
pop ecx
test eax, eax
je 0x4018e6
sub eax, edi
sar eax, 1
mov esi, eax
test esi, esi
jle 0x4018e6
cmp dword [ebx + 4], 0
je 0x4018b5
mov ecx, dword [edi - 0xc]
lea eax, [ebp - 0x10]
sub ecx, esi
push eax
sub ecx, 8
lea eax, [ebp - 4]
call fcn.004025eb
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
call fcn.00401557
lea ecx, [esi - 1]
lea edx, [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.004026ae
mov esi, dword [ebx + 4]
mov dword [ebp - 0x28], esi
rdtsc
mov ecx, dword [0x410a04]
mov dword [ebp - 0x20], eax
mov eax, dword [ecx]
push esi
mov dword [ebp - 0x1c], edx
call dword [eax + 8]
mov eax, dword [esi]
push str.desk
push esi
call dword [eax + 0x2c]
lea ecx, [ebp - 0x28]
call fcn.00401e69
mov esi, dword [ebx + 4]
mov dword [ebp - 0x28], esi
rdtsc
mov ecx, dword [0x410a04]
mov dword [ebp - 0x20], eax
mov eax, dword [ecx]
push esi
mov dword [ebp - 0x1c], edx
call dword [eax + 8]
mov eax, dword [esi]
push ebx
mov ebx, dword [ebp - 0x14]
push 0x401618
push 0x40dc20
push ebx
push dword [ebp - 0xc]
push 0x457
push esi
call dword [eax + 0x28]
lea ecx, [ebp - 0x28]
call fcn.00401e69
push 0xffffffffffffffff
push dword [0x4109d0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x401884
mov eax, dword [0x4109d0]
test eax, eax
je 0x401884
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [0x4109d0], 0
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.00402aa7
lea eax, [ebx - 0x10]
call fcn.00402aa7
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00402aa7
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00402aa7
xor esi, esi
inc esi
jmp 0x4016dc
mov ecx, esi
lea edx, [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.004026ae
lea edi, [ebp - 4]
call fcn.00401dda
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00402aa7
mov eax, edi
call fcn.004026e4
mov eax, edi
call fcn.004026e4
mov edi, dword [ebp - 4]
push 0x2e
push edi
call fcn.00403cb0
pop ecx
pop ecx
test eax, eax
je 0x4018fc
sub eax, edi
sar eax, 1
test eax, eax
jg 0x40190c
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00402aa7
jmp 0x4016da
mov ecx, dword [edi - 0xc]
sub ecx, eax
lea eax, [ebp - 0x14]
push eax
dec ecx
lea eax, [ebp - 4]
call fcn.004025eb
mov esi, dword [ebp - 0x14]
push 0x40dba4
push esi
call fcn.0040ad95
pop ecx
pop ecx
test eax, eax
jne 0x401946
push eax
mov ebx, edi
call fcn.004019ac
test eax, eax
je 0x40198a
lea eax, [esi - 0x10]
jmp 0x40189d
push 0x40dbac
push esi
call fcn.0040ad95
pop ecx
pop ecx
test eax, eax
jne 0x40195b
push 1
jmp 0x401933
push 0x40dbb4
push esi
call fcn.0040ad95
pop ecx
pop ecx
test eax, eax
jne 0x40198a
mov ebx, dword [ebp - 8]
push edi
push ebx
call fcn.00401afb
test eax, eax
je 0x40198d
lea eax, [esi - 0x10]
call fcn.00402aa7
lea eax, [ebx - 0x10]
jmp 0x4018a8
mov ebx, dword [ebp - 8]
lea eax, [esi - 0x10]
call fcn.00402aa7
lea eax, [ebx - 0x10]
call fcn.00402aa7
lea eax, [edi - 0x10]
call fcn.00402aa7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret