Function at 0x4231b0
Capabilities:
Contain obfuscated stackstrings
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x464a72
mov eax, dword fs:[0]
push eax
sub esp, 0xd4
push esi
push edi
mov eax, dword [0x5d500c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x40], edi
lea eax, [edi + 0x89b4]
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], eax
jne 0x423d95
mov eax, dword [ebp + 0x10]
cmp eax, 0x65
jne 0x42386e
call fcn.0042b730
cmp eax, 1
jne 0x423757
push 8
push dword [edi + 0x390]
call dword [0x5e2e90]
test eax, eax
jne 0x42338a
lea eax, [ebp - 0x3c]
mov ecx, 0x5db714
push eax
call fcn.00407dc0
mov dword [ebp - 4], 0
mov edx, 0x5beb00
mov ecx, eax
call fcn.0040c020
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401ff0
test esi, esi
je 0x4232e4
push 0x5beb08
lea ecx, [ebp - 0x3c]
call fcn.0040d470
mov dword [ebp - 4], 1
mov ecx, 0x5db714
push eax
call fcn.00407e30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401ff0
push 0x5beb10
lea ecx, [ebp - 0x3c]
call fcn.0040d470
mov dword [ebp - 4], 3
mov ecx, edi
push eax
call fcn.00423db0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401ff0
mov ecx, dword [edi + 0x89e4]
call fcn.0040b880
mov ecx, dword [edi + 0x89e0]
call fcn.0040b880
push ecx
mov ecx, 0x4257b0
call fcn.0040b8b0
mov dword [edi + 0x89dc], eax
jmp 0x42338a
lea eax, [ebp - 0x3c]
mov ecx, 0x5db714
push eax
call fcn.00407dc0
mov dword [ebp - 4], 5
mov edx, 0x5beb08
mov ecx, eax
call fcn.0040c020
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401ff0
test esi, esi
je 0x42338a
mov ecx, dword [edi + 0x89dc]
call fcn.0040b880
push 0x5beb20
lea ecx, [ebp - 0x98]
call fcn.0040d470
mov dword [ebp - 4], 6
mov ecx, edi
push eax
call fcn.00423db0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.00401ff0
push 0x5beb00
lea ecx, [ebp - 0x98]
call fcn.0040d470
mov dword [ebp - 4], 8
mov ecx, 0x5db714
push eax
call fcn.00407e30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.00401ff0
push 8
push dword [edi + 0x390]
call dword [0x5e2e90]
cmp eax, 1
jne 0x423574
lea eax, [ebp - 0x3c]
mov ecx, 0x5de004
push eax
call fcn.00407dc0
mov dword [ebp - 4], 0xa
mov edx, 0x5beb00
mov ecx, eax
call fcn.0040c020
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401ff0
lea eax, [ebp - 0x3c]
push eax
test esi, esi
je 0x4234b5
lea ecx, [edi + 0x2a94]
call fcn.00407f00
mov dword [ebp - 4], 0xb
mov edx, 0x5be34c
mov ecx, eax
call fcn.0042c990
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401ff0
test esi, esi
je 0x423574
push 0x5beb08
lea ecx, [ebp - 0x98]
call fcn.0040d470
mov dword [ebp - 4], 0xc
mov ecx, 0x5de004
push eax
call fcn.00407e30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.00401ff0
push 0x5beb30
lea ecx, [ebp - 0x98]
call fcn.0040d470
mov dword [ebp - 4], 0xe
mov ecx, edi
push eax
call fcn.00423db0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.00401ff0
push 1
push dword [edi + 0x2aa0]
call dword [0x5e2ea0]
mov ecx, dword [edi + 0x89e0]
call fcn.0040b880
mov ecx, dword [edi + 0x89dc]
call fcn.0040b880
push ecx
mov ecx, 0x423ff0
call fcn.0040b8b0
mov dword [edi + 0x89e4], eax
jmp 0x423574
mov ecx, 0x5de004
call fcn.00407dc0
mov dword [ebp - 4], 0x10
mov edx, 0x5beb08
mov ecx, eax
call fcn.0040c020
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401ff0
test esi, esi
je 0x423574
mov ecx, dword [edi + 0x89e4]
call fcn.0040b880
mov ecx, dword [edi + 0x89e4]
call fcn.0040b880
push 0x5beb40
lea ecx, [ebp - 0x98]
call fcn.0040d470
mov dword [ebp - 4], 0x11
mov ecx, edi
push eax
call fcn.00423db0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.00401ff0
push 0x5beb00
lea ecx, [ebp - 0x98]
call fcn.0040d470
mov dword [ebp - 4], 0x13
mov ecx, 0x5de004
push eax
call fcn.00407e30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.00401ff0
push 0
push dword [edi + 0x2aa0]
call dword [0x5e2ea0]
push 8
push dword [edi + 0x390]
call dword [0x5e2e90]
cmp eax, 2
jne 0x423d95
lea eax, [ebp - 0x3c]
mov ecx, 0x5df674
push eax
call fcn.00407dc0
mov dword [ebp - 4], 0x15
mov edx, 0x5beb00
mov ecx, eax
call fcn.0040c020
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401ff0
lea eax, [ebp - 0x3c]
push eax
test esi, esi
je 0x42369f
lea ecx, [edi + 0x4f74]
call fcn.00407f00
mov dword [ebp - 4], 0x16
mov edx, 0x5be34c
mov ecx, eax
call fcn.0042c990
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401ff0
test esi, esi
je 0x423d95
push 0x5beb08
lea ecx, [ebp - 0x3c]
call fcn.0040d470
mov dword [ebp - 4], 0x17
mov ecx, 0x5df674
push eax
call fcn.00407e30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401ff0
push 0x5beb50
lea ecx, [ebp - 0x3c]
call fcn.0040d470
mov dword [ebp - 4], 0x19
mov ecx, edi
push eax
call fcn.00423db0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401ff0
push 1
push dword [edi + 0x4f80]
call dword [0x5e2ea0]
push dword [edi + 0x89e0]
call dword [0x5d5a64]
mov ecx, dword [edi + 0x89e4]
call fcn.0040b880
mov ecx, dword [edi + 0x89dc]
call fcn.0040b880
push ecx
mov ecx, 0x424b30
call fcn.0040b8b0
mov dword [edi + 0x89e8], eax
jmp 0x423d95
mov ecx, 0x5df674
call fcn.00407dc0
mov dword [ebp - 4], 0x1b
mov edx, 0x5beb08
mov ecx, eax
call fcn.0040c020
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401ff0
test esi, esi
je 0x423d95
mov ecx, dword [edi + 0x89e8]
call fcn.0040b880
mov ecx, dword [edi + 0x89e8]
call fcn.0040b880
push 0x5beb60
lea ecx, [ebp - 0x3c]
call fcn.0040d470
mov dword [ebp - 4], 0x1c
mov ecx, edi
push eax
call fcn.00423db0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401ff0
push 0x5beb00
lea ecx, [ebp - 0x3c]
call fcn.0040d470
mov dword [ebp - 4], 0x1e
mov ecx, 0x5df674
push eax
call fcn.00407e30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401ff0
push 0
push dword [edi + 0x4f80]
call dword [0x5e2ea0]
jmp 0x423d95
mov edx, 0x5be34c
mov ecx, 0x5d5ac0
call fcn.0042c990
test eax, eax
je 0x4237f7
mov dword [ebp - 4], 0x20
lea ecx, [ebp - 0x3c]
call fcn.004022f0
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x10], 1
xor ecx, ecx
call fcn.00438a00
push str.VIP.exe_pay2
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x98]
call fcn.0043eb20
add esp, 4
mov byte [ebp - 4], 0x21
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x4237bc
cmp dword [eax + 0x24], ecx
mov ecx, 0x5be34c
je 0x4237bc
mov ecx, dword [eax + 0x1c]
push 1
call fcn.00438f50
add esp, 4
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x98]
call fcn.00401ff0
mov eax, 1
mov dword [ebp - 0x10], eax
and eax, 0xfffffffe
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401ff0
jmp 0x423d95
mov dword [ebp - 4], 0x22
lea ecx, [ebp - 0x3c]
call fcn.004022f0
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x10], 2
xor ecx, ecx
call fcn.00438a00
push str.VIP.exe_code2
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x98]
call fcn.0043eb20
add esp, 4
mov byte [ebp - 4], 0x23
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x423845
cmp dword [eax + 0x24], ecx
mov ecx, 0x5be34c
je 0x423845
mov ecx, dword [eax + 0x1c]
push 1
call fcn.00438f50
add esp, 4
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x98]
call fcn.00401ff0
mov eax, 2
mov dword [ebp - 0x10], eax
and eax, 0xfffffffd
jmp 0x4237e0
cmp eax, 0x66
jne 0x423d95
push 8
push dword [edi + 0x390]
call dword [0x5e2e90]
cmp eax, 1
jne 0x423d95
mov dword [ebp - 4], 0x24
push 7
push dword [0x5dd1a0]
call dword [0x5e2e84]
mov edx, eax
lea ecx, [ebp - 0x3c]
call fcn.004491d0
mov edx, 0x5beb00
mov dword [ebp - 0x10], 4
lea ecx, [ebp - 0x3c]
call fcn.0040c020
mov esi, eax
mov eax, 4
mov dword [ebp - 0x10], eax
and eax, 0xfffffffb
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401ff0
test esi, esi
je 0x423c49
lea ecx, [ebp - 0x6c]
call fcn.004022f0
mov dword [ebp - 4], 0x25
mov dword [ebp - 0x6c], vtable.CWConstString.0
mov dword [ebp - 0x60], 0x5beb08
mov dword [ebp - 4], 0x26
lea eax, [ebp - 0x6c]
push eax
mov ecx, 0x5dd194
call fcn.00407e30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.00401ff0
lea ecx, [ebp - 0x6c]
call fcn.004022f0
mov dword [ebp - 4], 0x28
mov dword [ebp - 0x6c], vtable.CWConstString.0
mov dword [ebp - 0x60], str.U_6R_N
mov dword [ebp - 4], 0x29
lea eax, [ebp - 0x6c]
push eax
lea ecx, [edi + 0x37d4]
call fcn.00407e30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.00401ff0
lea ecx, [ebp - 0xb4]
call fcn.0043b3f0
mov dword [ebp - 4], 0x2b
lea eax, [ebp - 0xb4]
push 0xa
push eax
mov eax, dword [0x5d9df0]
mov ecx, 0x5d9df0
push dword [edi + 0x8a4c]
call dword [eax + 0x18]
lea eax, [ebp - 0xb4]
push eax
lea ecx, [edi + 0x3684]
call fcn.00407d50
mov esi, dword [edi + 0x89e4]
lea eax, [ebp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call edi
mov esi, dword [ebp - 0x40]
lea eax, [ebp + 8]
push eax
mov esi, dword [esi + 0x89dc]
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp + 8]
push esi
call edi
lea ecx, [ebp - 0x6c]
call fcn.004022f0
mov byte [ebp - 4], 0x2c
mov dword [ebp - 0x6c], vtable.CWConstString.0
mov dword [ebp - 0x60], 0x5be34c
mov byte [ebp - 4], 0x2d
lea eax, [ebp - 0x6c]
mov ecx, dword [ebp - 0x40]
push eax
lea ecx, [ecx + 0x2a94]
call fcn.00407f80
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x6c]
call fcn.00401ff0
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x6c]
call fcn.004022f0
mov byte [ebp - 4], 0x30
push 0x102
call fcn.0044a7e0
push 0x102
mov esi, eax
push 0
push esi
mov dword [ebp + 8], esi
call fcn.0044beb0
movups xmm0, xmmword [str.0123456789]
push 0x12
movups xmmword [esi], xmm0
mov ecx, dword [0x5be344]
mov dword [esi + 0x10], ecx
mov ax, word [0x5be348]
mov word [esi + 0x14], ax
call fcn.0044a7e0
xorps xmm0, xmm0
mov dword [ebp + 0x10], eax
add esp, 0x14
mov edi, eax
mov esi, 8
movups xmmword [eax], xmm0
mov word [eax + 0x10], 0
call fcn.0044db85
xor edx, edx
mov ecx, 0xa
div ecx
mov eax, dword [ebp + 8]
push 1
lea eax, [eax + edx*2]
push eax
push edi
call fcn.0044dbb8
add esp, 0xc
add edi, 2
sub esi, 1
jne 0x423a87
push dword [ebp + 8]
call fcn.0044a7e9
mov eax, dword [ebp - 0x50]
add esp, 4
mov dword [ebp - 0x60], esi
mov esi, dword [ebp - 0x40]
test eax, eax
je 0x423ad1
push eax
mov eax, dword [ebp - 0x5c]
lea ecx, [ebp - 0x5c]
call dword [eax + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x4c], 0
cmp word [edi], 0
je 0x423af8
push edi
lea ecx, [ebp - 0x5c]
call fcn.0043bc70
push edi
call fcn.0044a7e9
mov edx, dword [ebp - 0x60]
add esp, 4
test edx, edx
jne 0x423b15
cmp dword [ebp - 0x48], 0
mov edx, 0x5be34c
cmovne edx, dword [ebp - 0x50]
lea ecx, [ebp - 0x3c]
call fcn.004022f0
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x3c]
push edx
mov dword [ebp - 0x3c], vtable.CWString.0
call fcn.0043d350
mov byte [ebp - 4], 0x30
mov edi, dword [ebp - 0x10]
or edi, 8
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x6c]
call fcn.00401ff0
lea ecx, [ebp - 0x98]
call fcn.004022f0
mov byte [ebp - 4], 0x32
mov dword [ebp - 0x98], vtable.CWConstString.0
mov dword [ebp - 0x8c], 0x5beb78
mov byte [ebp - 4], 0x33
lea eax, [ebp - 0x3c]
push eax
lea edx, [ebp - 0x98]
lea ecx, [ebp - 0xe0]
call fcn.0043e9a0
add esp, 4
mov byte [ebp - 4], 0x34
lea ecx, [esi + 0x2d44]
push eax
call fcn.00407f80
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0xe0]
call fcn.00401ff0
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x98]
call fcn.00401ff0
and edi, 0xfffffff7
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x3c]
call fcn.00401ff0
push dword [esi + 0x8a84]
call dword [0x5e2ed0]
push 0
push 0
push 0x427d10
mov dword [esi + 0x8a84], 0
push 0xe
mov dword [0x5e2974], 0
call dword [0x5d5a58]
lea ecx, [ebp - 0x3c]
mov dword [esi + 0x89e0], eax
call fcn.004022f0
mov byte [ebp - 4], 0x36
mov dword [ebp - 0x3c], vtable.CWConstString.0
mov dword [ebp - 0x30], 0x5beb84
mov byte [ebp - 4], 0x37
lea eax, [ebp - 0x3c]
push eax
mov ecx, esi
call fcn.00423db0
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x3c]
call fcn.00401ff0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0044dba6
add esp, 4
jmp 0x423d83
lea eax, [ebp - 0xe0]
mov ecx, 0x5dd194
push eax
call fcn.00407dc0
mov dword [ebp - 4], 0x39
mov edx, 0x5beb08
mov ecx, eax
call fcn.0040c020
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe0]
call fcn.00401ff0
test esi, esi
je 0x423d95
push 0x5beb94
lea ecx, [ebp - 0xe0]
call fcn.0040d470
mov dword [ebp - 4], 0x3a
lea ecx, [edi + 0x37d4]
push eax
call fcn.00407e30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe0]
call fcn.00401ff0
lea ecx, [ebp - 0xb4]
call fcn.0043b3f0
mov dword [ebp - 4], 0x3c
lea eax, [ebp - 0xb4]
push 0xa
push eax
mov eax, dword [0x5d9df0]
mov ecx, 0x5d9df0
push dword [edi + 0x8a50]
call dword [eax + 0x18]
lea eax, [ebp - 0xb4]
push eax
lea ecx, [edi + 0x3684]
call fcn.00407d50
push dword [edi + 0x8a84]
call dword [0x5e2ed0]
mov dword [edi + 0x8a84], 0
mov dword [0x5e2974], 0
push dword [edi + 0x89e0]
call dword [0x5d5a64]
push 0x5beba0
lea ecx, [ebp - 0xe0]
call fcn.0040d470
mov byte [ebp - 4], 0x3d
mov ecx, edi
push eax
call fcn.00423db0
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0xe0]
call fcn.00401ff0
push 0x5beb00
lea ecx, [ebp - 0xe0]
call fcn.0040d470
mov byte [ebp - 4], 0x3f
mov ecx, 0x5dd194
push eax
call fcn.00407e30
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0xe0]
call fcn.00401ff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb4]
call fcn.00402b40
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc