Function at 0x4031a5
Capabilities:
Contain obfuscated stackstrings
Move file
Set console window title
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4ac
push esi
mov dword [ebp - 0x20], 0x78ea2189
mov dword [ebp - 0x78], 0x4c56f655
mov dword [ebp - 0x50], 0x67ad96c
mov dword [ebp - 0x70], 0x511b7c29
mov dword [ebp - 0x5c], 0x7f744afb
mov dword [ebp - 0x44], 0xbc5b5bd
mov dword [ebp - 8], 0x4659ee16
mov dword [ebp - 0x2c], 0x7bc6b025
mov dword [ebp - 0x6c], 0x37837059
mov dword [ebp - 0x40], 0x17643edc
mov dword [ebp - 0x7c], 0x21496f0
mov dword [ebp - 0x88], 0x4990eca6
mov dword [ebp - 0x3c], 0x4f283546
mov dword [ebp - 0x14], 0x52a213d
mov dword [ebp - 0x8c], 0x1657ccd0
mov dword [ebp - 0x30], 0x6532eef3
mov dword [ebp - 0x54], 0x454f0d39
mov dword [ebp - 0x4c], 0x25acdca
mov dword [ebp - 0x74], 0x36cf089
mov dword [ebp - 0x68], 0x589608e3
mov dword [ebp - 0x48], 0x28d41c48
mov dword [ebp - 4], 0xafaa6b9
mov dword [ebp - 0x1c], 0x3a8f33bb
mov dword [ebp - 0x60], 0x4e61e723
mov dword [ebp - 0x90], 0x34c30ae1
mov dword [ebp - 0x24], 0x6c9f9b1
mov dword [ebp - 0x38], 0x3c49d0ec
mov dword [ebp - 0x34], 0x64326d23
mov dword [ebp - 0x28], 0x7d1bd07a
mov dword [ebp - 0x10], 0x609d9e1c
mov dword [ebp - 0x64], 0x3340e30
mov dword [ebp - 0x18], 0x54a1a0be
mov dword [ebp - 0x84], 0x7c1cdbf
mov dword [ebp - 0x80], 0x51555171
mov dword [ebp - 0xc], 0x5ca8f96d
mov dword [ebp - 0x58], 0x6ec93e52
sub dword [ebp - 0x20], 0x1dd541ca
sub dword [ebp - 0x20], 0x60b537df
add dword [ebp - 0x20], 0x4427c9c4
sub dword [ebp - 0x20], 0x77253dc2
add dword [ebp - 0x20], 0x38825e74
sub dword [ebp - 0x20], 0x7fae27c9
sub dword [ebp - 0x20], 0x79830353
add dword [ebp - 0x20], 0x22dc48a9
add dword [ebp - 0x50], 0x6ee70e
add dword [ebp - 0x70], 0x4c637722
add dword [ebp - 0x70], 0x2f6d5a07
add dword [ebp - 8], 0x1ee609d3
add dword [ebp - 0x44], 0x46256eb7
add dword [ebp - 8], 0x52826d60
add dword [ebp - 0x70], 0x2dd64314
sub dword [ebp - 0x44], 0x15f607e4
add dword [ebp - 8], 0x48443f03
sub dword [ebp - 0x70], 0x71de80c1
add dword [ebp - 8], 0x5f2e6438
sub dword [ebp - 0x6c], 0x4487bb7c
add dword [ebp - 0x20], 0x36dd151c
add dword [ebp - 0x78], 0x54c0e364
sub dword [ebp - 0x2c], 0x2a58babb
add dword [ebp - 0x70], 0x31c2a688
add dword [ebp - 0x20], 0x23855c12
sub dword [ebp - 0x44], 0x504654fa
add dword [ebp - 0x50], 0x3dcbbe18
add dword [ebp - 0x2c], 0x244fd2fe
add dword [ebp - 8], 0x54a37c2
sub dword [ebp - 0x20], 0x243f1809
add dword [ebp - 0x40], 0x2b6767de
sub dword [ebp - 0x50], 0x53a65a29
add dword [ebp - 0x78], 0x4c3fdb00
sub dword [ebp - 0x44], 0x546b4ddc
sub dword [ebp - 0x40], 0x8bc3fb4
add dword [ebp - 0x2c], 0x75e81eee
sub dword [ebp - 0x20], 0x4255851b
add dword [ebp - 0x5c], 0x6ecd6380
sub dword [ebp - 0x7c], 0x2770fb2a
add dword [ebp - 0x30], 0x2c5de5d8
sub dword [ebp - 0x14], 0x22fac472
add dword [ebp - 0x3c], 0x5a1c2bb4
add dword [ebp - 0x2c], 0x54d8ecaa
sub dword [ebp - 0x44], 0x46262e62
add dword [ebp - 0x30], 0x6551053
add dword [ebp - 0x6c], 0x4b6fdc04
add dword [ebp - 0x6c], 0x3a0dbc85
sub dword [ebp - 0x50], 0x60a44abe
sub dword [ebp - 0x14], 0x616e0a07
add dword [ebp - 0x6c], 0xe495d63
sub dword [ebp - 0x78], 0x13487c76
add dword [ebp - 0x3c], 0x56c277e4
add dword [ebp - 0x6c], 0x14870e1f
add dword [ebp - 0x4c], 0x4c0de4af
add dword [ebp - 0x14], 0x7bf4d7e8
add dword [ebp - 0x88], 0x680186e
sub dword [ebp - 0x14], 0x3eea4219
sub dword [ebp - 8], 0xe31d955
sub dword [ebp - 0x2c], 0x35f86dd9
sub dword [ebp - 0x2c], 0x3dff57fa
add dword [ebp - 0x44], 0x2b51c3ce
add dword [ebp - 0x70], 0x1befd10f
add dword [ebp - 0x54], 0x484b4049
sub dword [ebp - 0x70], 0x7c1ef2e2
sub dword [ebp - 8], 0x6fb81645
add dword [ebp - 0x8c], 0x4b608e35
add dword [ebp - 0x54], 0x4b5d405c
sub dword [ebp - 0x44], 0x1a3059ef
add dword [ebp - 0x40], 0x74ab2ddc
sub dword [ebp - 0x30], 0x4ef53f20
add dword [ebp - 0x2c], 0x18b94c28
add dword [ebp - 0x1c], 0x1259ec2f
add dword [ebp - 0x20], 0x631684bf
add dword [ebp - 0x50], 0x69a6e271
add dword [ebp - 0x78], 0x78bcde06
add dword [ebp - 0x44], 0x2b81e20
sub dword [ebp - 0x20], 0x2ef859da
sub dword [ebp - 0x50], 0x77360994
add dword [ebp - 0x3c], 0x1f36cecb
add dword [ebp - 0x2c], 0x648c8e6c
add dword [ebp - 0x48], 0x7c750c57
add dword [ebp - 8], 0x79bbe8f9
add dword [ebp - 0x6c], 0xdd259f5
sub dword [ebp - 0x8c], 0x431ba4d5
sub dword [ebp - 0x1c], 0x51e22a00
add dword [ebp - 0x1c], 0x7a0974cc
sub dword [ebp - 0x44], 0x744ad64e
sub dword [ebp - 0x2c], 0x10b97c95
sub dword [ebp - 0x60], 0x3491834a
add dword [ebp - 0x90], 0x7d205dc5
add dword [ebp - 4], 0x4a01090a
add dword [ebp - 0x88], 0x72a947b2
add dword [ebp - 0x44], 0x3ebf96b5
add dword [ebp - 0x70], 0x61b13e54
sub dword [ebp - 0x88], 0x2b39743e
add dword [ebp - 0x88], 0xcc4c43a
add dword [ebp - 0x68], 0x4d13fa81
sub dword [ebp - 0x30], 0x2512892e
sub dword [ebp - 0x7c], 0x7a567ba1
sub dword [ebp - 0x24], 0x524f2c05
sub dword [ebp - 0x2c], 0x17079e47
add dword [ebp - 0x88], 0x24bd9487
add dword [ebp - 0x88], 0x73df155c
add dword [ebp - 0x90], 0x7296efd5
add dword [ebp - 0x78], 0x4b7b7bc3
sub dword [ebp - 0x38], 0x487ea33c
sub dword [ebp - 0x70], 0x3f874266
sub dword [ebp - 0x6c], 0x73e0e833
add dword [ebp - 0x78], 0x2e7154
add dword [ebp - 0x24], 0x59b53177
add dword [ebp - 0x78], 0x30eefb10
add dword [ebp - 0x14], 0x5e3cc7c5
sub dword [ebp - 0x24], 0x79589b6b
add dword [ebp - 0x1c], 0x301cf8f0
add dword [ebp - 0x6c], 0x36a7d5e
add dword [ebp - 0x54], 0x27a2f31c
sub dword [ebp - 0x5c], 0x9702847
sub dword [ebp - 0x28], 0x29a7359
add dword [ebp - 0x6c], 0x5954e8ce
add dword [ebp - 0x74], 0x601918f0
add dword [ebp - 0x20], 0xc56aa40
sub dword [ebp - 0x10], 0x5e90bc47
sub dword [ebp - 0x20], 0x1cb5b284
sub dword [ebp - 0x7c], 0x7bbadab0
sub dword [ebp - 4], 0x260c0b1b
add dword [ebp - 0x50], 0x36908767
add dword [ebp - 0x90], 0x1b250939
add dword [ebp - 0x50], 0x3832ce3
sub dword [ebp - 0x30], 0x25eb7f4a
add dword [ebp - 0x34], 0x2a41da93
sub dword [ebp - 0x50], 0x48267bff
sub dword [ebp - 0x44], 0x2561c46c
sub dword [ebp - 0x60], 0x79669f
add dword [ebp - 0x6c], 0x61d5865a
add dword [ebp - 0x6c], 0x5f533b42
add dword [ebp - 0x90], 0x45d0fbec
add dword [ebp - 0x2c], 0x55a598a5
add dword [ebp - 0x6c], 0x5b2091e1
add dword [ebp - 0x18], 0x4e798867
add dword [ebp - 8], 0x46c6a7c6
add dword [ebp - 0x60], 0x4fa1af8f
add dword [ebp - 0x54], 0x6fca9ab
sub dword [ebp - 0x78], 0x2fafde2
sub dword [ebp - 0x20], 0x6dbd37fe
sub dword [ebp - 0x64], 0x6060e804
add dword [ebp - 0x44], 0x3760726d
add dword [ebp - 0xc], 0x19c43911
add dword [ebp - 0x3c], 0x693c1593
sub dword [ebp - 0x84], 0x177528af
add dword [ebp - 0x60], 0x7b34a37e
sub dword [ebp - 0x78], 0x60a8713
add dword [ebp - 0x58], 0x67a1bbd7
add dword [ebp - 0x80], 0x6a00423d
add dword [ebp - 0x90], 0x4f82f0b7
xor esi, esi
cmp dword [0xacf704], 0x26
jne 0x403792
push esi
push esi
push esi
call fcn.004041af
push esi
push esi
push esi
push esi
call fcn.00404114
push esi
call fcn.00404053
push esi
call fcn.00404083
push esi
push esi
call fcn.00403f47
push esi
call fcn.00403de8
push esi
call fcn.00404053
add esp, 0x34
lea ecx, [ebp - 0xac]
call fcn.00403938
call fcn.00403cd1
push esi
call fcn.00403cc6
push esi
call fcn.00403be6
push esi
call fcn.00403b09
push esi
push esi
call fcn.00403ac9
push esi
call fcn.00403a95
add esp, 0x18
lea ecx, [ebp - 0xac]
call fcn.00403959
mov eax, dword [0x412dd4]
mov dword [0xacf704], eax
xor ecx, ecx
cmp ecx, 0x1737
jne 0x4037b2
mov edx, dword [0x412008]
mov dword [0xad1288], edx
inc ecx
cmp ecx, 0x79a863
jl 0x40379e
cmp eax, 0x81
jne 0x403849
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
push 0x401594
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
push esi
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
push esi
lea eax, [ebp - 0x4ac]
push eax
push esi
call dword [sym.imp.KERNEL32.dll__hread]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x4015a0
push 0x4015d0
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push esi
call dword [sym.imp.KERNEL32.dll_UnregisterWait]
push esi
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.00402e99
xor eax, eax
pop esi
leave
ret 0x10