Function at 0x427468
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Execute anti-debugging instructions
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x20c
mov byte [ebp - 0x128], 0
mov dword [ebp - 0x140], 0x7a7f6b5b
mov dword [ebp - 0x13c], 0x6d556568
mov dword [ebp - 0x138], 0x636d686c
mov dword [ebp - 0x134], 0x383a786b
mov dword [ebp - 0x130], 0x7e6c6258
mov dword [ebp - 0x12c], 0x667e787c
mov dword [ebp - 0x1ec], ecx
mov ecx, 0x18
mov eax, ecx
mov ebx, 0x1d
xor edx, edx
div ebx
xor byte [ebp + ecx - 0x158], dl
inc ecx
cmp ecx, 0x30
jne 0x4274c2
lea ecx, [ebp - 0x17d]
lea ebx, [ebp - 0x140]
call fcn.0042e3d8
mov eax, ecx
call fcn.004284d4
lea edx, [ebp - 0x140]
call fcn.0042839c
mov byte [ebp - 0x132], 0
mov ecx, 0xe
mov dword [ebp - 0x140], 0x637f7d5e
mov esi, eax
mov dword [ebp - 0x13c], 0x37707164
mov dword [ebp - 0x138], 0x7a6e4037
mov word [ebp - 0x134], 0x7e7a
mov eax, ecx
mov edi, 0x11
xor edx, edx
div edi
xor byte [ebp + ecx - 0x14e], dl
inc ecx
cmp ecx, 0x1c
jne 0x427532
lea ecx, [ebp - 0x17d]
call fcn.0042e3d8
mov eax, ecx
call fcn.004284d4
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, 0xd
push ebx
push ebx
lea ebx, [ebp - 0x140]
mov dword [ebp - 0x1f4], eax
mov dword [ebp - 0x140], 0x606d7350
mov dword [ebp - 0x13c], 0x34757661
mov dword [ebp - 0x138], 0x736f473a
mov word [ebp - 0x134], 0x78
mov eax, ecx
mov edi, 0xd
xor edx, edx
div edi
xor byte [ebp + ecx - 0x14d], dl
inc ecx
cmp ecx, 0x1a
jne 0x4275a3
lea ecx, [ebp - 0x17d]
call fcn.0042e3d8
mov eax, ecx
call fcn.004284d4
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edx
push edx
mov dword [ebp - 0x1f8], eax
mov word [ebp - 0x140], 0x30
mov dword [esp], ebx
call sub.msvcrt.dll_atoi
mov dword [esp], 2
mov dword [esp + 4], eax
call esi
push ecx
push ecx
mov dword [ebp - 0x1f0], eax
mov dword [ebp - 0x140], 0xc1eb1542
mov dword [ebp - 0x13c], 0x7c90ec48
mov byte [ebp - 0x138], 0x42
mov al, byte [0x4ddb18]
test al, al
jne 0x427662
mov dword [esp], 0x4ddb18
call fcn.004ceb90
test eax, eax
je 0x427662
mov dword [esp], ebx
mov ecx, 0x4e0e20
call fcn.0042e96c
push eax
mov dword [esp], 0x4d0000
call fcn.004013f0
mov dword [esp], 0x4ddb18
call fcn.004cec60
mov ecx, 0x4e0e20
lea edi, [ebp - 0x140]
mov esi, 0x4dd0e0
call fcn.0042e93c
mov dword [esp], 0x4e0e20
lea ebx, [ebp - 0x140]
call fcn.00422510
mov ecx, 0x37
mov dword [ebp - 0x17d], 0x49d0e672
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x4ddae0]
test al, al
jne 0x4276d9
mov dword [esp], 0x4ddae0
call fcn.004ceb90
test eax, eax
je 0x4276d9
mov dword [esp], ebx
mov ecx, 0x4e0cc0
call fcn.0042e834
push eax
mov dword [esp], 0x4d0004
call fcn.004013f0
mov dword [esp], 0x4ddae0
call fcn.004cec60
mov ecx, 0x4e0cc0
call fcn.0042e804
mov dword [esp], 0x4e0cc0
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4276fb
lea eax, [ebp - 0x17d]
call eax
cmp dword [ebp - 0x1f0], 0xffffffff
jne 0x427825
mov ecx, ebx
call fcn.0042e44c
call fcn.004ce700
mov ecx, 0x11
mov dword [ebp - 0x17d], eax
lea eax, [ebp - 0x17d]
mov dword [ebp - 0x179], edx
mov edx, ebx
call fcn.00428694
mov byte [ebp - 0x138], 0x42
mov dword [ebp - 0x140], 0xc1eb1542
mov dword [ebp - 0x13c], 0x7c90ec48
mov al, byte [0x4ddae8]
test al, al
jne 0x42778c
mov dword [esp], 0x4ddae8
call fcn.004ceb90
test eax, eax
je 0x42778c
mov dword [esp], ebx
mov ecx, 0x4e0d00
call fcn.0042e96c
push eax
mov dword [esp], 0x4d0010
call fcn.004013f0
mov dword [esp], 0x4ddae8
call fcn.004cec60
mov ecx, 0x4e0d00
lea edi, [ebp - 0x140]
mov esi, 0x4dd0e0
call fcn.0042e93c
mov dword [esp], 0x4e0d00
call fcn.00422510
mov ecx, 0x37
mov dword [ebp - 0x17d], 0x5de0ee76
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x4ddaf0]
test al, al
jne 0x427803
mov dword [esp], 0x4ddaf0
call fcn.004ceb90
test eax, eax
je 0x427803
lea eax, [ebp - 0x140]
mov ecx, 0x4e0d20
mov dword [esp], eax
call fcn.0042e834
push edi
mov dword [esp], 0x4d0020
call fcn.004013f0
mov dword [esp], 0x4ddaf0
call fcn.004cec60
mov ecx, 0x4e0d20
call fcn.0042e804
mov dword [esp], 0x4e0d20
call sub.msvcrt.dll_getenv
test eax, eax
je 0x427825
lea eax, [ebp - 0x17d]
call eax
mov eax, dword [ebp - 0x1ec]
cmp byte [eax], 0
je 0x427945
mov dword [ebp - 0x140], 0x62797953
mov ecx, 0x14
mov esi, dword [0x4de048]
lea ebx, [ebp - 0x140]
mov dword [ebp - 0x13c], 0x614e6e60
mov dword [ebp - 0x138], 0x71756968
mov dword [ebp - 0x134], 0x786a7e5a
mov dword [ebp - 0x130], 0x684a7d78
mov byte [ebp - 0x12c], 0
mov eax, ecx
mov edi, 0x17
xor edx, edx
div edi
xor byte [ebp + ecx - 0x154], dl
inc ecx
cmp ecx, 0x28
jne 0x42787e
lea ecx, [ebp - 0x17d]
call fcn.0042e3d8
mov eax, ecx
call fcn.004284d4
mov dword [esp + 4], ebx
mov dword [esp], eax
call esi
push ecx
push ecx
mov dword [ebp - 0x140], 0x40
mov dword [esp], ebx
call eax
push esi
mov esi, dword [ebp - 0x138]
mov edi, dword [ebp - 0x134]
mov dword [esp], str.1048576
call sub.msvcrt.dll_atoi
mov ecx, ebx
mov dword [ebp - 0x200], eax
call fcn.0042e538
mov dword [esp], ebx
call sub.msvcrt.dll_atoi
mov edx, dword [ebp - 0x200]
mov dword [ebp - 0x1fc], eax
mov dword [esp + 8], edx
sar edx, 0x1f
mov dword [esp + 0xc], edx
mov dword [esp], esi
mov dword [esp + 4], edi
call fcn.0040bd80
cmp dword [ebp - 0x1fc], eax
jle 0x427945
mov ecx, ebx
call fcn.0042e44c
call fcn.004ce700
mov ecx, 0x31
mov dword [ebp - 0x17d], eax
lea eax, [ebp - 0x17d]
mov dword [ebp - 0x179], edx
mov edx, ebx
jmp 0x428003
xor eax, eax
lea edi, [ebp - 0x140]
mov ecx, 0x4a
or ebx, 0xffffffff
rep stosd dword es:[edi], eax
lea esi, [ebp - 0x140]
mov dword [ebp - 0x140], 0x128
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x1f0]
mov dword [esp], eax
mov eax, dword [ebp - 0x1f4]
call eax
push edx
push edx
test eax, eax
je 0x42799c
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x1f0]
inc ebx
mov dword [esp], eax
mov eax, dword [ebp - 0x1f8]
call eax
push edi
push edi
jmp 0x42797e
lea ecx, [ebp - 0x17d]
call fcn.0042e544
mov dword [esp], ecx
call sub.msvcrt.dll_atoi
cmp ebx, eax
jg 0x4279c3
lea ecx, [ebp - 0x17d]
call fcn.0042e6a0
jmp 0x427b12
mov dword [ebp - 0x17d], 0xc1eb1542
mov dword [ebp - 0x179], 0x7c90ec48
mov byte [ebp - 0x175], 0x42
mov al, byte [0x4ddaf8]
test al, al
jne 0x427a23
mov dword [esp], 0x4ddaf8
call fcn.004ceb90
test eax, eax
je 0x427a23
lea eax, [ebp - 0x17d]
mov ecx, 0x4e0d60
mov dword [esp], eax
call fcn.0042e96c
push ebx
mov dword [esp], 0x4d002c
call fcn.004013f0
mov dword [esp], 0x4ddaf8
call fcn.004cec60
mov ecx, 0x4e0d60
mov esi, 0x4dd0e0
lea edi, [ebp - 0x17d]
call fcn.0042e93c
mov dword [esp], 0x4e0d60
call fcn.00422510
mov ecx, 0x37
mov dword [ebp - 0x190], 0x71f0f67a
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x4ddb00]
test al, al
jne 0x427a9a
mov dword [esp], 0x4ddb00
call fcn.004ceb90
test eax, eax
je 0x427a9a
lea eax, [ebp - 0x17d]
mov ecx, 0x4e0d80
mov dword [esp], eax
call fcn.0042e834
push ecx
mov dword [esp], 0x4d0030
call fcn.004013f0
mov dword [esp], 0x4ddb00
call fcn.004cec60
mov ecx, 0x4e0d80
call fcn.0042e804
mov dword [esp], 0x4e0d80
call sub.msvcrt.dll_getenv
test eax, eax
je 0x427abc
lea eax, [ebp - 0x190]
call eax
rdtsc
mov ecx, eax
mov ebx, edx
rdtsc
mov edi, dword [ebp - 0x1ec]
cmp byte [edi + 9], 0
je 0x427b39
sub eax, ecx
mov ecx, 0x1f4
sbb edx, ebx
mov ebx, eax
xor eax, eax
cmp ecx, ebx
sbb eax, edx
jae 0x427b39
mov esi, str.eotpldtc
mov ecx, 0x3d
lea edi, [ebp - 0x17d]
mov ebx, 0x3d
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x3c
mov eax, ecx
xor edx, edx
div ebx
xor byte [ebp + ecx - 0x1b9], dl
inc ecx
cmp ecx, 0x78
jne 0x427aff
call fcn.004ce700
mov ecx, 0x30
mov dword [ebp - 0x190], eax
lea eax, [ebp - 0x190]
mov dword [ebp - 0x18c], edx
lea edx, [ebp - 0x17d]
jmp 0x428003
mov eax, dword [ebp - 0x1ec]
cmp byte [eax + 2], 0
jne 0x427b4f
cmp byte [eax + 1], 0
je 0x428016
mov dword [ebp - 0x17d], 0xc1eb1542
mov dword [ebp - 0x179], 0x7c90ec48
mov byte [ebp - 0x175], 0x42
mov al, byte [0x4ddb08]
test al, al
jne 0x427baf
mov dword [esp], 0x4ddb08
call fcn.004ceb90
test eax, eax
je 0x427baf
lea eax, [ebp - 0x17d]
mov ecx, 0x4e0dc0
mov dword [esp], eax
call fcn.0042e96c
push edx
mov dword [esp], 0x4d003c
call fcn.004013f0
mov dword [esp], 0x4ddb08
call fcn.004cec60
mov ecx, 0x4e0dc0
mov esi, 0x4dd0e0
lea edi, [ebp - 0x17d]
call fcn.0042e93c
mov dword [esp], 0x4e0dc0
call fcn.00422510
mov ecx, 0x37
mov dword [ebp - 0x190], 0x8500fe7e
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x4ddb10]
test al, al
jne 0x427c26
mov dword [esp], 0x4ddb10
call fcn.004ceb90
test eax, eax
je 0x427c26
lea eax, [ebp - 0x17d]
mov ecx, 0x4e0de0
mov dword [esp], eax
call fcn.0042e834
push eax
mov dword [esp], 0x4d0040
call fcn.004013f0
mov dword [esp], 0x4ddb10
call fcn.004cec60
mov ecx, 0x4e0de0
call fcn.0042e804
mov dword [esp], 0x4e0de0
call sub.msvcrt.dll_getenv
test eax, eax
je 0x427c48
lea eax, [ebp - 0x190]
call eax
mov word [ebp - 0x17d], 0x31
lea eax, [ebp - 0x17d]
mov dword [esp], eax
call sub.msvcrt.dll_atoi
cpuid
mov dword [ebp - 0x190], eax
lea eax, [ebp - 0x19d]
mov dword [ebp - 0x18c], ebx
mov dword [ebp - 0x188], ecx
mov dword [ebp - 0x184], edx
mov word [ebp - 0x19d], 0x31
mov dword [esp], eax
call sub.msvcrt.dll_atoi
mov byte [ebp - 0x17b], 0
mov esi, dword [ebp - 0x188]
mov word [ebp - 0x17d], 0x3133
mov ebx, eax
lea eax, [ebp - 0x17d]
mov dword [esp], eax
call sub.msvcrt.dll_atoi
shlx ebx, ebx, eax
test ebx, esi
jne 0x427ccf
mov eax, dword [ebp - 0x1ec]
cmp byte [eax + 2], 0
jne 0x428016
mov eax, 0x40000000
cpuid
mov dword [ebp - 0x18c], ebx
lea edi, [ebp - 0x1de]
lea esi, [ebp - 0x188]
mov dword [ebp - 0x1de], ebx
lea ebx, [ebp - 0x17d]
mov dword [ebp - 0x188], ecx
mov dword [ebp - 0x184], edx
mov dword [ebp - 0x190], eax
mov word [ebp - 0x17d], 0x34
mov dword [esp], ebx
call sub.msvcrt.dll_atoi
lea edx, [ebp - 0x19d]
mov word [ebp - 0x19d], 0x34
mov dword [ebp - 0x1f0], eax
mov dword [esp], edx
call sub.msvcrt.dll_atoi
mov ecx, dword [ebp - 0x1f0]
mov word [ebp - 0x17d], 0x34
add eax, edi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
mov dword [esp], ebx
lea edi, [ebp - 0x1de]
lea esi, [ebp - 0x184]
call sub.msvcrt.dll_atoi
lea edx, [ebp - 0x19d]
mov word [ebp - 0x19d], 0x38
mov dword [ebp - 0x1f0], eax
mov dword [esp], edx
call sub.msvcrt.dll_atoi
mov ecx, dword [ebp - 0x1f0]
add eax, edi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x1d2], 0
mov al, byte [0x4dd5e8]
test al, al
jne 0x427f88
mov dword [esp], 0x4dd5e8
call fcn.004ceb90
test eax, eax
je 0x427f88
mov dword [ebp - 0x17d], 0x494c5647
mov ecx, 0xc
mov esi, 0xd
mov dword [ebp - 0x179], 0x504e4955
mov dword [ebp - 0x175], 0xa09084a
mov byte [ebp - 0x171], 0
mov eax, ecx
xor edx, edx
div esi
xor byte [ebp + ecx - 0x189], dl
inc ecx
cmp ecx, 0x18
jne 0x427ddd
mov dword [0x4def80], ebx
mov ecx, 0xc
lea edi, [ebp - 0x19d]
mov dword [ebp - 0x19d], 0x70626941
mov dword [ebp - 0x199], 0x606a776c
mov dword [ebp - 0x195], 0x7c412873
mov byte [ebp - 0x191], 0
mov eax, ecx
mov esi, 0xd
xor edx, edx
div esi
xor byte [ebp + ecx - 0x1a9], dl
inc ecx
cmp ecx, 0x18
jne 0x427e26
mov dword [ebp - 0x1aa], 0x63764d5a
mov ecx, 0xc
mov dword [ebp - 0x1a6], 0x4b536171
mov dword [ebp - 0x1a2], 0x6f7b6970
mov byte [ebp - 0x19e], 0
mov dword [0x4def84], edi
lea edi, [ebp - 0x1aa]
mov eax, ecx
mov esi, 0xd
xor edx, edx
div esi
xor byte [ebp + ecx - 0x1b6], dl
inc ecx
cmp ecx, 0x18
jne 0x427e74
mov dword [ebp - 0x1b7], 0x546f6554
mov ecx, 0xc
mov dword [ebp - 0x1b3], 0x635d494e
mov dword [ebp - 0x1af], 0x47445e69
mov byte [ebp - 0x1ab], 0
mov dword [0x4def88], edi
lea edi, [ebp - 0x1b7]
mov eax, ecx
mov esi, 0xd
xor edx, edx
div esi
xor byte [ebp + ecx - 0x1c3], dl
inc ecx
cmp ecx, 0x18
jne 0x427ec2
mov dword [ebp - 0x1c4], 0x226d727c
mov ecx, 0xc
mov dword [ebp - 0x1c0], 0x63757d6b
mov dword [ebp - 0x1bc], 0x2a297e75
mov byte [ebp - 0x1b8], 0
mov dword [0x4def8c], edi
lea edi, [ebp - 0x1c4]
mov eax, ecx
mov esi, 0xd
xor edx, edx
div esi
xor byte [ebp + ecx - 0x1d0], dl
inc ecx
cmp ecx, 0x18
jne 0x427f10
mov dword [ebp - 0x1d1], 0x7a6e425a
mov ecx, 0xc
mov dword [ebp - 0x1cd], 0x7e6a4655
mov dword [ebp - 0x1c9], 0x72664a51
mov byte [ebp - 0x1c5], 0
mov dword [0x4def90], edi
lea edi, [ebp - 0x1d1]
mov eax, ecx
mov esi, 0xd
xor edx, edx
div esi
xor byte [ebp + ecx - 0x1dd], dl
inc ecx
cmp ecx, 0x18
jne 0x427f5e
mov dword [0x4def94], edi
mov dword [esp], 0x4dd5e8
call fcn.004cec60
xor esi, esi
lea edi, [ebp - 0x1de]
mov dword [esp + 8], 0xd
mov dword [esp + 4], edi
mov eax, dword [esi + 0x4def80]
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x42800a
mov eax, dword [ebp - 0x1ec]
cmp byte [eax + 1], 0
je 0x42800a
mov esi, str._Uus_umwrrieocha7e2_aefxjm:ottm_AQR_vPW__aG_BN_rXFBEGRX
mov ecx, 0x3a
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x39
mov esi, 0x3b
mov eax, ecx
xor edx, edx
div esi
xor byte [ebp + ecx - 0x1b6], dl
inc ecx
cmp ecx, 0x72
jne 0x427fd2
call fcn.004ce700
mov ecx, 0x30
mov dword [ebp - 0x19d], eax
lea eax, [ebp - 0x19d]
mov dword [ebp - 0x199], edx
mov edx, ebx
call fcn.00428694
jmp 0x428016
add esi, 4
cmp esi, 0x18
jne 0x427f90
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret