Function at 0x467c58
Capabilities:
Check for software breakpoints
Contain obfuscated stackstrings
Extract resource via kernel32 functions
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24a8
test al, 0x24
add byte [eax], al
call fcn.0049dcf0
push ebx
push esi
push edi
push 0x2349
push 0x68
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x245c], eax
cmp dword [ebp - 0x245c], 0
jne 0x467ca4
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.0046766f
add esp, 4
test eax, eax
je 0x467c9d
jmp 0x4682ca
xor eax, eax
jmp 0x4682cf
mov edx, dword [ebp - 0x245c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x234c], eax
cmp dword [ebp - 0x234c], 0
jne 0x467ccb
xor eax, eax
jmp 0x4682cf
je 0x467cd0
jne 0x467cd0
jmp 0x467c5c
mov ecx, dword [ebp - 0x234c]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [0x4a082c], eax
cmp dword [0x4a082c], 0
jne 0x467cf2
xor eax, eax
jmp 0x4682cf
mov edx, dword [ebp - 0x245c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
push 0x2320
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov ecx, dword [0x4a082c]
lea edx, [ecx + eax - 0x2320]
push edx
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov ecx, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x2478], ecx
mov esi, dword [ebp - 0x2478]
mov al, byte [esi]
cmp al, 0xcc
je 0x467ecb
mov edx, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2488], edx
mov esi, dword [ebp - 0x2488]
mov al, byte [esi]
cmp al, 0xcc
je 0x467ecb
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x2480], eax
mov esi, dword [ebp - 0x2480]
mov al, byte [esi]
cmp al, 0xcc
je 0x467ecb
mov ecx, dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x2484], ecx
mov esi, dword [ebp - 0x2484]
mov al, byte [esi]
cmp al, 0xcc
je 0x467ecb
mov edx, dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x247c], edx
mov esi, dword [ebp - 0x247c]
mov al, byte [esi]
cmp al, 0xcc
je 0x467ecb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3ff
div ecx
mov dword [0x4a0718], edx
mov byte [ebp - 0x2340], 0x14
mov byte [ebp - 0x233f], 0x28
mov byte [ebp - 0x233e], 0x30
mov byte [ebp - 0x233d], 0x60
mov byte [ebp - 0x233c], 0xc8
mov byte [ebp - 0x233b], 0x30
mov byte [ebp - 0x233a], 0x45
mov byte [ebp - 0x2339], 0x12
mov byte [ebp - 0x2338], 0x18
mov byte [ebp - 0x2337], 0x61
mov byte [ebp - 0x2336], 0xe
mov byte [ebp - 0x2335], 0
mov byte [ebp - 0x2334], 0x22
mov byte [ebp - 0x2333], 0
mov byte [ebp - 0x2332], 0x20
mov byte [ebp - 0x2331], 0
mov byte [ebp - 0x2330], 0x90
mov byte [ebp - 0x232f], 0x66
mov byte [ebp - 0x232e], 0xe
mov byte [ebp - 0x232d], 0
mov byte [ebp - 0x232c], 0xe8
mov byte [ebp - 0x232b], 2
mov byte [ebp - 0x232a], 0x7f
mov byte [ebp - 0x2329], 0x3a
mov byte [ebp - 0x2328], 0x6b
mov byte [ebp - 0x2327], 0x23
mov byte [ebp - 0x2326], 0x36
mov byte [ebp - 0x2325], 0x20
mov byte [ebp - 0x2324], 0x80
mov byte [ebp - 0x2323], 0x60
mov byte [ebp - 0x2322], 0x30
mov byte [ebp - 0x2321], 0
push 0x1d0
lea edx, [ebp - 0x2340]
push edx
push 0x64
mov eax, dword [ebp + 0xc]
add eax, 0xec
push eax
call fcn.0046b67d
add esp, 0x10
mov dword [ebp - 0x2344], 0
push 0x2320
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x2320]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, 1
test eax, eax
je 0x468260
push 0x2320
lea ecx, [ebp - 0x2320]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x2458]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x228]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x22c]
push ecx
mov edx, dword [ebp - 0x2344]
push edx
call fcn.00472110
test eax, eax
je 0x467faa
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x224]
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0xec
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x11e
push eax
push 0
call fcn.00467bba
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x248c], eax
mov ecx, dword [ebp - 0x248c]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x2490], eax
push 0
mov edx, dword [ebp - 0x2490]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x2490]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4682cf
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx + 0x238]
cmp edx, 0xa
jl 0x46806b
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 0x238]
cmp ecx, 0x20
jge 0x46806b
lea edx, [ebp - 0x2458]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x230]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x234]
push eax
mov ecx, dword [ebp - 0x2344]
push ecx
call fcn.00472440
test eax, eax
je 0x46806b
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x224]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 0xec
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x11e
push edx
push 0
call fcn.00467bba
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x2494], eax
mov eax, dword [ebp - 0x2494]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x2498], eax
push 0
mov ecx, dword [ebp - 0x2498]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp - 0x2498]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4682cf
lea eax, [ebp - 0x2458]
push eax
push 0xc
mov ecx, dword [ebp + 0xc]
add ecx, 0xe0
push ecx
call fcn.0046b5e2
add esp, 0xc
test eax, eax
jne 0x468091
xor eax, eax
jmp 0x4682cf
lea edx, [ebp - 0x2458]
push edx
push 0xe0
mov eax, dword [ebp + 0xc]
push eax
call fcn.0046b5e2
add esp, 0xc
test eax, eax
jne 0x4680b4
xor eax, eax
jmp 0x4682cf
mov ecx, dword [ebp + 0xc]
add ecx, 0x2bc
push ecx
push 0xe0
mov edx, dword [ebp + 0xc]
push edx
call fcn.0046b971
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0xe0]
push ecx
push 0x450720
lea edx, [ebp - 0x2468]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0xe4]
push ecx
push 0x450724
lea edx, [ebp - 0x2474]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x2458]
push eax
push 0
lea ecx, [ebp - 0x2474]
push ecx
lea edx, [ebp - 0x2468]
push edx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 0xe9]
push ecx
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 0xea]
push eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx + 1]
push edx
call fcn.00469ce8
add esp, 0x1c
test eax, eax
jne 0x468165
mov eax, dword [ebp - 0x2344]
add eax, 1
mov dword [ebp - 0x2344], eax
jmp 0x467eed
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx + 0x11]
test edx, edx
je 0x46819c
lea eax, [ebp - 0x2458]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004673d3
add esp, 8
test eax, eax
jne 0x46819c
mov edx, dword [ebp - 0x2344]
add edx, 1
mov dword [ebp - 0x2344], edx
jmp 0x467eed
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 0x12]
test ecx, ecx
je 0x4681d3
lea edx, [ebp - 0x2458]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00467470
add esp, 8
test eax, eax
jne 0x4681d3
mov ecx, dword [ebp - 0x2344]
add ecx, 1
mov dword [ebp - 0x2344], ecx
jmp 0x467eed
lea edx, [ebp - 0x2458]
push edx
lea eax, [ebp - 0x2474]
push eax
lea ecx, [ebp - 0x2468]
push ecx
push 0
lea edx, [ebp - 0x2350]
push edx
call fcn.00472080
test eax, eax
jne 0x46824c
lea eax, [ebp - 0x2458]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 0x13]
test eax, eax
je 0x468228
lea ecx, [ebp - 0x2458]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [0x4a06f8]
push 0x10
mov eax, dword [ebp + 0xc]
add eax, 0x230c
push eax
lea ecx, [ebp - 0x24a8]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, 1
jmp 0x4682cf
mov edx, dword [ebp - 0x2344]
add edx, 1
mov dword [ebp - 0x2344], edx
jmp 0x467eed
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x224]
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0xec
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x11e
push eax
push 0
call fcn.00467bba
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x2348], eax
mov ecx, dword [ebp - 0x2348]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x2354], eax
push 0
mov edx, dword [ebp - 0x2354]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x2354]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4682cf
jmp 0x467d08
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret