Function at 0x423680
Capabilities:
Contain obfuscated stackstrings
Enumerate process modules
Enumerate processes
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xac4
mov eax, dword [0x50f130]
xor eax, esp
mov dword [esp + 0xac0], eax
mov eax, 0x65
push ebx
mov ebx, 0x61
mov edx, 0x2e
mov ecx, 0x72
push esi
mov esi, 0x78
push edi
xor edi, edi
mov word [esp + 0x53a], bx
mov word [esp + 0x544], bx
mov word [esp + 0x548], dx
mov word [esp + 0x5b8], bx
mov ebx, 0x6e
mov word [esp + 0x5c8], dx
mov word [esp + 0x568], dx
mov edx, 0x6f
mov word [esp + 0x534], 0x56
mov word [esp + 0x536], 0x4d
mov word [esp + 0x538], 0x57
mov word [esp + 0x53c], cx
mov word [esp + 0x53e], ax
mov word [esp + 0x540], 0x54
mov word [esp + 0x542], cx
mov word [esp + 0x546], 0x79
mov word [esp + 0x54a], ax
mov word [esp + 0x54c], si
mov word [esp + 0x54e], ax
mov word [esp + 0x550], di
mov word [esp + 0x5b4], 0x54
mov word [esp + 0x5b6], ax
mov word [esp + 0x5ba], 0x6d
mov word [esp + 0x5bc], 0x56
mov word [esp + 0x5be], 0x69
mov word [esp + 0x5c0], ax
mov word [esp + 0x5c2], 0x77
mov word [esp + 0x5c4], ax
mov word [esp + 0x5c6], cx
mov word [esp + 0x5ca], ax
mov word [esp + 0x5cc], si
mov word [esp + 0x5ce], ax
mov word [esp + 0x5d0], di
mov word [esp + 0x554], 0x50
mov word [esp + 0x556], 0x43
mov word [esp + 0x558], 0x41
mov word [esp + 0x55a], bx
mov word [esp + 0x55c], 0x79
mov word [esp + 0x55e], 0x57
mov word [esp + 0x560], 0x68
mov word [esp + 0x562], ax
mov word [esp + 0x564], cx
mov word [esp + 0x566], ax
mov word [esp + 0x56a], ax
mov word [esp + 0x56c], si
mov word [esp + 0x56e], ax
mov word [esp + 0x570], di
mov word [esp + 0x4e4], 0x50
mov word [esp + 0x4e6], cx
mov word [esp + 0x4e8], dx
mov word [esp + 0x4ea], 0x63
mov word [esp + 0x4ec], 0x4d
mov word [esp + 0x4ee], dx
mov word [esp + 0x4f0], bx
mov word [esp + 0x4f2], 0x2e
mov word [esp + 0x4f4], ax
mov word [esp + 0x4f6], si
mov word [esp + 0x4f8], ax
mov word [esp + 0x4fa], di
mov word [esp + 0x594], 0x50
mov word [esp + 0x596], cx
mov word [esp + 0x598], dx
mov word [esp + 0x59a], 0x63
mov word [esp + 0x59c], 0x4d
mov word [esp + 0x59e], dx
mov word [esp + 0x5a0], bx
mov word [esp + 0x5a2], 0x36
mov word [esp + 0x5a4], 0x34
mov word [esp + 0x5a6], ax
mov word [esp + 0x5a8], 0x2e
mov word [esp + 0x5aa], ax
mov word [esp + 0x5ac], si
mov word [esp + 0x5ae], ax
mov word [esp + 0x5b0], di
mov word [esp + 0x4cc], 0x50
mov word [esp + 0x4ce], cx
mov word [esp + 0x4d0], dx
mov word [esp + 0x4d2], 0x63
mov word [esp + 0x4d4], 0x45
mov word [esp + 0x4d6], si
mov word [esp + 0x4d8], 0x70
mov word [esp + 0x4da], 0x2e
mov word [esp + 0x4dc], ax
mov word [esp + 0x4de], si
mov word [esp + 0x4e0], ax
mov word [esp + 0x4e2], di
mov word [esp + 0x518], 0x50
mov word [esp + 0x51a], cx
mov word [esp + 0x51c], dx
mov word [esp + 0x51e], 0x63
mov word [esp + 0x520], 0x45
mov word [esp + 0x522], si
mov word [esp + 0x524], 0x70
mov word [esp + 0x526], 0x36
mov word [esp + 0x528], 0x34
mov word [esp + 0x52a], 0x2e
mov word [esp + 0x52c], ax
mov word [esp + 0x52e], si
mov word [esp + 0x530], ax
mov word [esp + 0x532], di
mov word [esp + 0x4a0], 0x58
mov word [esp + 0x4a2], 0x75
mov word [esp + 0x4a4], ax
mov word [esp + 0x4a6], 0x74
mov word [esp + 0x4a8], cx
mov word [esp + 0x4aa], 0x2e
mov word [esp + 0x4ac], ax
mov word [esp + 0x4ae], si
mov word [esp + 0x4b0], ax
mov word [esp + 0x4b2], di
mov word [esp + 0x4fc], 0x50
mov word [esp + 0x4fe], 0x43
mov word [esp + 0x500], 0x48
mov word [esp + 0x502], 0x75
mov word [esp + 0x504], bx
mov word [esp + 0x506], 0x74
mov word [esp + 0x508], ax
mov word [esp + 0x50a], cx
mov word [esp + 0x50c], 0x2e
mov word [esp + 0x50e], ax
mov word [esp + 0x510], si
mov word [esp + 0x512], ax
mov word [esp + 0x514], di
mov word [esp + 0x574], 0x50
mov word [esp + 0x576], 0x43
mov word [esp + 0x578], 0x48
mov word [esp + 0x57a], 0x75
mov word [esp + 0x57c], bx
mov word [esp + 0x57e], 0x74
mov word [esp + 0x580], ax
mov word [esp + 0x582], cx
mov word [esp + 0x584], 0x36
mov word [esp + 0x586], 0x34
mov word [esp + 0x588], 0x2e
mov word [esp + 0x58a], ax
mov word [esp + 0x58c], si
mov word [esp + 0x58e], ax
mov word [esp + 0x590], di
mov word [esp + 0x4b4], dx
mov word [esp + 0x4b6], 0x6c
mov word [esp + 0x4b8], 0x6c
mov word [esp + 0x4ba], 0x79
mov word [esp + 0x4bc], 0x44
mov word [esp + 0x4be], 0x62
mov word [esp + 0x4c0], 0x67
mov word [esp + 0x4c2], 0x2e
mov word [esp + 0x4c4], ax
mov word [esp + 0x4c6], si
mov word [esp + 0x4c8], ax
mov word [esp + 0x4ca], di
mov word [esp + 0x5f8], 0x53
mov word [esp + 0x5fa], 0x79
mov word [esp + 0x5fc], 0x73
mov word [esp + 0x624], si
mov esi, 0x73
mov word [esp + 0x616], dx
mov word [esp + 0x62a], dx
mov word [esp + 0x5d8], dx
mov word [esp + 0x5de], si
mov word [esp + 0x5e0], si
mov word [esp + 0x5e2], si
mov esi, 0x20
mov word [esp + 0x5e8], dx
mov word [esp + 0x5f0], dx
mov word [esp + 0x63c], dx
mov word [esp + 0x654], dx
mov edx, 0x67
mov word [esp + 0x5fe], 0x69
mov word [esp + 0x600], bx
mov word [esp + 0x602], 0x74
mov word [esp + 0x604], ax
mov word [esp + 0x606], cx
mov word [esp + 0x608], bx
mov word [esp + 0x60a], 0x61
mov word [esp + 0x60c], 0x6c
mov word [esp + 0x60e], 0x73
mov word [esp + 0x610], 0x20
mov word [esp + 0x612], 0x50
mov word [esp + 0x614], cx
mov word [esp + 0x618], 0x63
mov word [esp + 0x61a], ax
mov word [esp + 0x61c], 0x73
mov word [esp + 0x61e], 0x73
mov word [esp + 0x620], 0x20
mov word [esp + 0x622], 0x45
mov word [esp + 0x626], 0x70
mov word [esp + 0x628], 0x6c
mov word [esp + 0x62c], cx
mov word [esp + 0x62e], ax
mov word [esp + 0x630], cx
mov word [esp + 0x632], di
mov word [esp + 0x5d4], 0x50
mov word [esp + 0x5d6], cx
mov word [esp + 0x5da], 0x63
mov word [esp + 0x5dc], ax
mov word [esp + 0x5e4], si
mov word [esp + 0x5e6], 0x4d
mov word [esp + 0x5ea], bx
mov word [esp + 0x5ec], 0x69
mov word [esp + 0x5ee], 0x74
mov word [esp + 0x5f2], cx
mov word [esp + 0x5f4], di
mov word [esp + 0x634], 0x57
mov word [esp + 0x636], 0x69
mov word [esp + 0x638], bx
mov word [esp + 0x63a], 0x44
mov word [esp + 0x63e], 0x77
mov word [esp + 0x640], 0x73
mov word [esp + 0x642], si
mov word [esp + 0x644], 0x47
mov word [esp + 0x646], 0x55
mov word [esp + 0x648], 0x49
mov word [esp + 0x64a], si
mov word [esp + 0x64c], 0x73
mov word [esp + 0x64e], 0x79
mov word [esp + 0x650], 0x6d
mov word [esp + 0x652], 0x62
mov word [esp + 0x656], 0x6c
mov word [esp + 0x658], 0x69
mov word [esp + 0x65a], 0x63
mov word [esp + 0x65c], si
mov word [esp + 0x65e], 0x64
mov word [esp + 0x660], ax
mov word [esp + 0x662], 0x62
mov word [esp + 0x664], 0x75
mov word [esp + 0x666], dx
mov word [esp + 0x668], dx
mov word [esp + 0x66a], ax
mov word [esp + 0x66c], cx
mov word [esp + 0x66e], di
mov word [esp + 0x670], 0x46
mov word [esp + 0x672], cx
mov word [esp + 0x674], ax
mov word [esp + 0x676], ax
mov word [esp + 0x69e], ax
mov word [esp + 0x6a8], ax
lea eax, [esp + 0x5b4]
mov dword [esp + 0x48], eax
mov word [esp + 0x698], dx
mov word [esp + 0x6a4], dx
mov word [esp + 0x6a6], dx
mov word [esp + 0x6aa], cx
lea eax, [esp + 0x594]
mov dword [esp + 0x54], eax
lea ecx, [esp + 0x554]
mov dword [esp + 0x4c], ecx
lea edx, [esp + 0x4e4]
mov dword [esp + 0x50], edx
lea eax, [esp + 0x4a0]
mov dword [esp + 0x60], eax
lea ecx, [esp + 0x4cc]
mov dword [esp + 0x58], ecx
lea edx, [esp + 0x518]
mov dword [esp + 0x5c], edx
lea eax, [esp + 0x534]
mov dword [esp + 0x6c], eax
lea ecx, [esp + 0x4fc]
lea edx, [esp + 0x574]
lea eax, [esp + 0x5d4]
mov dword [esp + 0x64], ecx
mov dword [esp + 0x68], edx
mov dword [esp + 0x3c], eax
lea ecx, [esp + 0x4b4]
lea edx, [esp + 0x5f8]
lea eax, [esp + 0x20]
mov dword [esp + 0x70], ecx
mov dword [esp + 0x38], edx
push eax
lea ecx, [esp + 0x638]
lea edx, [esp + 0x674]
push str.BootSpeedUpInfoEx2013
mov word [esp + 0x680], si
mov word [esp + 0x682], 0x33
mov word [esp + 0x684], 0x32
mov word [esp + 0x686], 0x2d
mov word [esp + 0x688], 0x62
mov word [esp + 0x68a], 0x69
mov word [esp + 0x68c], 0x74
mov word [esp + 0x68e], si
mov word [esp + 0x690], 0x41
mov word [esp + 0x692], bx
mov word [esp + 0x694], 0x61
mov word [esp + 0x696], 0x6c
mov word [esp + 0x698], 0x79
mov word [esp + 0x69a], 0x73
mov word [esp + 0x69c], 0x69
mov word [esp + 0x69e], bx
mov word [esp + 0x6a2], si
mov word [esp + 0x6a4], 0x44
mov word [esp + 0x6a8], 0x62
mov word [esp + 0x6aa], 0x75
mov word [esp + 0x6b4], di
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], edx
mov dword [esp + 0x28], edi
call fcn.00423220
add esp, 8
test eax, eax
je 0x42409c
cmp dword [esp + 0x20], edi
je 0x42409c
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xac0]
xor ecx, esp
call fcn.004b84de
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x1c]
push ecx
push str.BootSpeedUpInfoEx2014
mov dword [esp + 0x24], edi
call fcn.00423220
add esp, 8
test eax, eax
je 0x4240d3
cmp dword [esp + 0x1c], edi
je 0x4240d3
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xac0]
xor ecx, esp
call fcn.004b84de
mov esp, ebp
pop ebp
ret
xor eax, eax
push edi
push 2
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
je 0x4242c1
cmp esi, edi
je 0x4242c1
push 0x22c
lea edx, [esp + 0x7c]
push edi
push edx
call fcn.004be320
add esp, 0xc
lea eax, [esp + 0x78]
push eax
push esi
mov dword [esp + 0x80], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4242b0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jmp 0x424150
lea ecx, [esp + 0x9c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov esi, eax
cmp esi, edi
je 0x424281
push 0x206
lea edx, [esp + 0x6b6]
push edi
push edx
mov word [esp + 0x6bc], di
call fcn.004be320
push 0x103
lea eax, [esp + 0x6c0]
push esi
push eax
call fcn.004b857e
add esp, 0x18
lea ecx, [esp + 0x6b0]
push ecx
call dword [sym.imp.USER32.dll_CharUpperW]
push str.QQ.exe
lea edx, [esp + 0x6b4]
push edx
call ebx
test eax, eax
jne 0x4241d5
mov eax, dword [esp + 0x18]
cmp eax, 5
jae 0x4241d5
mov ecx, dword [esp + 0x80]
mov dword [esp + eax*4 + 0x24], ecx
add eax, 1
mov dword [esp + 0x18], eax
xor esi, esi
jmp 0x4241e0
mov edx, dword [esp + esi*4 + 0x48]
push edx
lea eax, [esp + 0x6b4]
push eax
call ebx
test eax, eax
je 0x42429a
add esi, 1
cmp esi, 0xb
jb 0x4241e0
cmp dword [esp + 0x14], edi
jne 0x424281
push 0x208
lea ecx, [esp + 0x8be]
push edi
push ecx
mov word [esp + 0x8c4], di
call fcn.004be320
lea edx, [esp + 0x8c4]
push edx
lea ecx, [esp + 0xac]
call fcn.00423290
add esp, 0x10
test eax, eax
je 0x424281
lea eax, [esp + 0x8b8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x424245
sub eax, edx
sar eax, 1
je 0x424281
xor esi, esi
jmp 0x424260
mov ecx, dword [esp + esi*4 + 0x38]
lea eax, [esp + 0x8b8]
push eax
push ecx
call fcn.004b9c1e
add esp, 8
test eax, eax
jne 0x4242a4
add esi, 1
cmp esi, 4
jb 0x424260
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x78]
push edx
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x424150
jmp 0x4242ac
mov dword [esp + 0x14], 1
jmp 0x424281
mov dword [esp + 0x14], 1
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x14], edi
jne 0x424378
xor ebx, ebx
cmp dword [esp + 0x18], edi
mov dword [esp + 0x10], edi
jbe 0x424378
mov ecx, dword [esp + ebx*4 + 0x24]
push ecx
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x42434a
lea edx, [esp + 0x78]
push edx
push esi
mov dword [esp + 0x80], 0x428
call sub.KERNEL32.dll_Module32FirstW
lea ebx, [ebx]
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
cmp eax, edi
je 0x424324
push str.remotecontrol.dll
push eax
call fcn.004b9e54
add esp, 8
test eax, eax
je 0x424335
lea ecx, [esp + 0x78]
push ecx
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x424300
jmp 0x42433d
mov dword [esp + 0x10], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], edi
jne 0x424370
add ebx, 1
cmp ebx, dword [esp + 0x18]
jb 0x4242d1
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xac0]
xor ecx, esp
call fcn.004b84de
mov esp, ebp
pop ebp
ret
mov dword [esp + 0x14], 1
mov ecx, dword [esp + 0xacc]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004b84de
mov esp, ebp
pop ebp
ret