Function at 0x52ab28
Capabilities:
Terminate process

Disassembly:
call sub.user32.dll_IsWindow
test eax, eax
je 0x4ef36f
cmp dword [ebx + 4], 0
jmp 0x4b859b
test al, al
jne 0x4ef36f
cmp byte [ebx + 0x40], 0
jmp 0x4d2bf0
call sub.kernel32.dll_Sleep
push 0
jmp 0x52d0eb
je 0x471256
imul ecx, esi, 0x17fff8
add ecx, 4
mov edx, edi
lahf
movzx eax, si
mov eax, ebx
call fcn.004cdc9b
xor eax, eax
rcr ch, cl
cmp si, di
sub cl, 0xf5
push ebp
ror cx, 0x58
movzx ecx, sp
push 0x4ba067
xadd edx, ecx
push dword fs:[eax]
xor edx, ebp
cmp ah, bl
shl cx, 0x4c
mov dword fs:[eax], esp
sets ch
cmovae ax, sp
imul eax, esi, 0x2ffff
sar cx, 0x24
mov edx, dword [ebx + 0xc]
sbb cl, 0xda
sub cl, bh
btc ecx, ecx
lea eax, [edx + eax*8 - 0x17fff4]
mov dword [ebx + 8], eax
or ecx, ebp
xor eax, eax
jmp 0x56e3d4
pop ecx
mov bp, 0x2d0f
pop ebp
jmp 0x48a970
call sub.user32.dll_IsWindow
cmp eax, 1
mov dx, si
inc dl
sbb eax, eax
setnp dh
movzx edx, ax
inc eax
ror dx, 0xfa
mov byte [ebx + 0x1c], al
cmp ebp, 0x57070437
mov eax, dword [ebx + 4]
mov edx, dword [ebx + 8]
cmc
mov dword [edx + 4], eax
rcr al, cl
setle al
mov al, byte [ebx + 0x1c]
mov byte [ebp - 2], al
test edi, edi
cmp byte [ebx + 0x1c], 0
je 0x4c016d
cmp word [ebx + 0x2a], 0
jmp 0x4a5b42
ret 4
push eax
jmp 0x48873d
je 0x495193
lea eax, [ebx + 0x24]
call fcn.004b2273
xor eax, eax
mov al, byte [ebp + 8]
shl cl, 0x56
mov ecx, eax
shl ecx, 0xc
not eax
mov edx, edi
bswap eax
jmp 0x4d5f80
push eax
jmp 0x4657ba
mov eax, dword [eax]
jmp 0x48d204
jne 0x4db846
call sub.kernel32.dll_AllocConsole
mov eax, dword [0x42ea14]
mov edx, 0x3f3
call fcn.00403450
call fcn.0040349c
call fcn.00402af8
push 0xbb8
jmp 0x470164
je 0x4c016d
mov ecx, dword [ebx + 4]
movsx edx, cx
rdtsc
mov edx, ebx
setnp ah
lahf
cwde
mov eax, dword [ebx + 0x2c]
jmp 0x4c016a
mov eax, dword [eax]
jmp 0x4ec1e2
jne 0x4b85a9
call fcn.00417ecd
mov dword [ebx + 4], eax
push 0
mov eax, dword [ebx + 4]
push eax
mov eax, ebx
push 0x465
mov eax, dword [ebx + 0xc]
jmp 0x4b43d5
call dword [ebx + 0x28]
cmp byte [ebp - 1], 0
jmp 0x422a4a
call fcn.004cdc9b
mov esi, dword [ebx + 0xc]
cmp edx, edi
test esi, esi
jmp 0x53abec
mov eax, dword [ebx + 8]
jmp 0x49eb75
je 0x4ef36f
cmp dword [ebx + 0x24], 0
jmp 0x495185
jne 0x4ef36f
test edi, edi
jmp 0x4cb8ac
mov eax, ebx
jmp 0x4c03bb
call sub.kernel32.dll_TerminateProcess
mov dword [ebx + 0x44], esi
cmp al, 0x59
cmp byte [ebp + 8], 0
jmp 0x47123a
push eax
jmp 0x54f50e
mov al, byte [ebp - 2]
movzx ebp, bp
pop edi
movzx esi, sp
pop esi
bswap cx
pop ebx
mov ebp, edi
pop ecx
jmp 0x47a181
pop ecx
mov dword fs:[eax], edx
jmp 0x4c2c17
push ebp
mov ebp, esp
cmp ecx, edx
jmp 0x55d31b
call sub.kernel32.dll_GetCurrentProcess
push eax
jmp 0x4db841
je 0x4ef36f
mov eax, dword [esi]
jmp 0x4984eb
call sub.user32.dll_SendMessageA
mov esi, eax
test dh, 0x70
test esi, esi
jmp 0x4a17a7
add esp, 0xfffffff8
test edi, 0x32cc5764
cmc
push ebx
add ebx, 0x27f45b0d
bt bx, 0x62
push esi
sar bh, cl
push edi
bts ebx, eax
mov edi, 0x132e1d83
movsx ebx, bx
mov byte [ebp - 1], cl
mov edi, edx
cmp esp, esp
sub bx, 0x10d1
sar bl, 0x5c
mov ebx, eax
rol al, 0x33
shr al, 0
mov al, byte [ebx + 0x1c]
mov byte [ebp - 2], al
jmp 0x46e902
pop edx
mov ecx, ebp
movsx cx, cl
bswap ecx
pop ecx
jmp 0x515bef