Function at 0x403c96
Capabilities:
Terminate process

Disassembly:
add byte [edi], cl
test edx, esi
add byte [eax], al
add byte [edx + eax - 0x15], bh
add dh, byte [esp + edi*8 + 0x68]
and byte [ebx - 0x5497ffbf], al
xchg ebx, eax
inc ecx
add bh, bh
adc eax, sym.imp.KERNEL32.dll_lstrcmpiA
test eax, eax
jne 0x403bb0
push 0x418334
call fcn.0040533f
pop ecx
push eax
push 0x419120
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x403c6a
push 0x418324
push 0x4193ab
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x403c01
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x418334
call fcn.0040533f
pop ecx
push eax
push 0x419120
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x418340
push 0x419120
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x403c6a
push 0x418328
push 0x4193ab
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x403c35
je 0x403c1b
jne 0x403c1b
int 0x20
push 0x41834c
call fcn.0040533f
pop ecx
push eax
push 0x419120
call fcn.004051c0
pop ecx
pop ecx
jmp 0x403c6a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x418354
call fcn.0040533f
pop ecx
push eax
push 0x419120
call fcn.004051c0
pop ecx
pop ecx
jmp 0x403c84
pushf
push 0xa
jb 0x403c8f
js 0x403c94
jns 0x403c94
call 0x403f7b
add byte [ebx - 7], dh
call 0x403c96
jae 0x403c8f
add esp, 4
jb 0x403c9e
jae 0x403c9e
call 0x716449a1
add byte [ecx - 0x1d], bh
dec dword [esp]
jno 0x403ca3
jns 0x403c88
jp 0x403ca7
add esp, 4
popf
je 0x403cb1
jne 0x403cb1
call 0x4148191d
add byte [eax + 0x20], ch
xchg ecx, eax
inc ecx
add bh, bh
adc eax, sym.imp.KERNEL32.dll_lstrcatA
push 0x4107dc
push 0x419120
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jp 0x403cc6
jnp 0x403cc6
call 0x41d3bd32
add byte [eax + 0x20], ch
xchg ecx, eax
inc ecx
add bh, bh
adc eax, sym.imp.KERNEL32.dll_lstrcatA
push 0x419380
push 0x419120
call dword [sym.imp.KERNEL32.dll_lstrcatA]
call fcn.00401305
mov dword [ebp - 8], str.GraZZpwP55zm_nK_oC9v_NMQbsN15ycxs_kf1JX_iKXmwHRW_kF_ZnZq__KH99_tEouLE_CQ3K_14_zS5hoNCtWY_qfUG2R2z_cXsDoi9amAIRyS5fykbzepcCcvhHEX1m4_o_Rwwh3YQ_SNL6Bqhdf_FM4_c_iDf_Im8se_w_85uC8EOyFqM_o_y_e5fa1Q_j_qIszP6_t1t_3c4_iD_CXCM_hBvk3RjnMR17OBNgc3_Ji3_g_U_2_v_CIq_8_9Gpq73z_uOYM_2Ev9_3HZS5ToaxlFia4z_G7VLEORAwV_nvIsD_IaJq_FJZ_y7Ola_AayAPgejzUSurRJjcN_hOs_4zxQ6OBoi5F3O72_swrER3K___n_a_X__V_ZXj6XN_Tf1h72_n2i_un1_xdzQNVN_pA__Hj2NhA9ezUB_XvSwa_Tw8JIf_A8tE_nXIKn9_ETp7FH_2NvMXIgm1VLK8BZip_q__eS_QX_o__fMJxuj_l5_gPE5cnlDBD_g4u3T_N1qyeFhSqLS2_xsTt_YmBaOSpJ_M2N__a_1KMABN8w___FR8UaAukKbLpzJdV4R_lfHL_idcmkNdDt_eAhDRO88jiu_VG_fNC2_9h8QIS_EoJrzyedIJIUPa_FYo_eLd_hHl_Om36J_b3_e_9_WaWVM_3T1PLP_ZY4JtHFKiLmS_Mk_zdlg_c9lSFo_pdh__Yc__Frs_azR6__nPFUi_5SqwAIj1QT6v_M9yZ_UfgXQ_Av1_QPjD5_pkDbDFv3BM_EBwz5zYL5U_n82uR4_QM_F_GKNXeJ3K_F4_Z7ioDkRgzC7_ghxYe4G_BI_GzPbWFIX___X_Dt2y__kkqhXZmXRj4TnoM_1cVbhU1mU_V1i6bTAO__awbK_4cbZE_QSUKMWgIFe59T2go_o8avJa8otqA_u_SRNh5Z_A_UPo_SApOv_Kfp1FX__I6____whU__5ovc_DyuBxodRjsITyY_S9__QIL3eCvpwMFUqNv_I7wzn4A6VgyrKQ56ZZ_nqoACpa__uib_3_beJXq_k_r4a_9T4Pr___imCmf_Z1Z_t_b_e6mdX7m7N_VX__2ykGr_lT8qODLjiG_X_
mov dword [ebp - 4], str.UtgB7C2nBFV_JDu__JB__K_8k_i__B_Y_3fNkQBi___VQ_Loc_x5eZ_doNR5Ff3tTIKR9t4FlXs_uJSpsWW_zlxxO4rk_nL_qZ_Zy1_lyrNaWDTAFoqPnGmVP3w4_lU_n8A_H_H_s5mYLr_n_rH___8FSqc_o7b_f1Cx96fOg_YNqhZmuoG_Zm_ai_pJv5tlVSFRy4BaMU_8bEnr9_LOqe_kibyzbk9K_Wcy_3jf4nO__i_8lSCwBm1_LJ6t2lzgD_H_QaltF8B__MNiRALUD1Zkf_KqA_vo_GlmR_V_oZ_AznJ9Zqg___EVZ2d3_8sJd_72jGPkGw_j_4m_7S4y
ja 0x403cee
jbe 0x403cee
call 0x13082b9
cmp eax, dword [ecx]
mov dword [ebp - 0x10], str.K79beP4_ui_FwofF_1wesJi_rkw_Cqc_vs_i_T_FB_Y__d_KXLlJ_8wNAsb__4__L4HBfh_i_gOeBDKBRO_N_ZueY__QXrAT_b__T2nk3vSgMgbHx__8hXHG1VwP__L8iaX6I_8IGSrXAz86maZdS_SNFonr6WEtPOkh9F_4th_ypSdw4FvQ_He_ia4nc__RWF_wf_____Z_E9Qf_E_rfdPERdobMQGmJ_hW_23DJY6rub6IOS_J_JdS7cm5UQzB4_GxGnc_Q_P6h__Z5AN4b_Cxu_je_GwT6LlwuJm_Pq_KljM69IYlCGOjaTU_Zq9RJcc5aVgAi2sl__w_34KcpqoHqNY1y_m_UjT5a1fN1XJ9kj2DljGysCnRD_tBto_d2OL__Ao____1_nWNScCbA__91RJGdQiUWfUFE__TyS_4gsgfKQ_Uld83h8weK_OkcYMqO_WF_XySjpzqGb2GGuc_p_U_BB_358YDE_hO_RRduHhW_wVe3sk4v_QS_4CH9VfaO2Dpely_mmE_q_S4PpR2vr_jIM1_NN_QWRrIjD__NC2ENvrPNKR_SqPvnMEEI_3cvK1ZNcyD8PngwFw1hdzZl9Oqr_hs4Iu_Wf_S_pL_AVv6_T_lKIRo
pushf
push 0xa
jb 0x403d01
je 0x403d08
jne 0x403d08
call 0x4725ec
add byte [eax], al
call 0x403d0c
call 0xe937b0f3
call 0xeb450193
add ch, al
call 0x71644a16
add ch, al
call 0x2bb1a97
jae 0x403d01
call 0x504c0f7
jmp 0x403d13
dec dword [esp]
jno 0x403d1a
call 0x7b1db705
add ch, al
call 0x664501a7
popfd
jns 0x403cf9
jp 0x403d20
call 0x504c10b
add esp, 4
popf
jmp 0x403d29
push 0x419120
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x403ee4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0x1c], str.aNhSZ9IclIpy6fmFW8m_vGo_8mqE6Mv7_n8WK_RxXodK3_WO6BjEfvVi_D7f_kRwOw_jAkSQ7I13_2MhG_hHMK_gE__qGY3wHXHCGFrSa__U5c_JDM_kHwvGS_L_IoPfuw_JNONRzn_TzZb_EqHQv4triT11_yZvg5_Xmy9ATw8_OC_g_u6qOuy9_oYv4AxHpblWHVeQ__L__6liQsYrw_MWvIm7a_j__X6q1FAAc_k_lsc7UweieN_lissPRjr_SY_u_9geD8GZJ_es_trz4B7I_AyhVRyFF9L_CyEGni2ivtj7YYyHre4tWXHt_pJMM_39jv4O59Qe_sXTZ4e7M_X_GldMx9R_XIFmq_8sBaUOuWp31n__nMu_mItd_sYgbH_HN4mRlU_sAHlcuITekW2_nL_zkpSXf_PzMb_P_n_Rt_lQObSdbhA_KSjFNHD_x8279vyjX_ZyJha9
nop
nop
nop
nop
nop
nop
nop
nop
nop
movsx eax, byte [0x4193a9]
cmp eax, 0x31
jne 0x403dc1
mov dword [ebp - 0x24], str.Q_8c___q_Nbd6SKnOKg__DsFrcfO_pbEpP_GRoqz4JdVKtVkfqGHz1mVeE7Y_b_U2Kbxi5r_coHXdBSeC_oCaQxyu_7G_IJYVwSbFsEwTRp6Q44MdES_w18WBCek5NXX_AlvdYylFv_4_pP_jo_4K_Z7n4eFwWEvzG1uCFR2_meufDXkrgelivXD5pxdQpS2v2_ZRDtoPFY__i_43_Cx7QR2_94SnPHpfSiw6hWXz2_fTtzXTX8BVu_UiLYba_LDf_B_TSwJaKrXHy4OFQpv4p_AlNuYE3gUW_BP9ancCxYU8WBL2lDWtnxem7_Wt_Ow_Fwb3OfkNjSnCw_K_4_6mFfsZ__B_s_R__XQWgWR__dJ2_F4EaErDk_a4tcT_X__46bigXrp___BHqivCP4h_ZsTXCNRM_jfuIKDCiwj_Fpd7ryG1__gRG6msGUfzL_o2DM_pFbkG1gtD_DzEkgbmQhLDODF_vXe_G3_QrCCAWz_FeVc__Dh_4__1__EKYS43XICoZf8_sKm_wuj_JBxSXE_egjRBbhyWGnf_4iQaTTNSkc_j7gf_KxhzoQ_Sug6jVT_w_TP39Ke2YsgXetzuTDli__UAyU_xTFeMl_WhGtRBDKzeAE9eW_iHJ_YS_lOKrDhl_kQ_b_wdADG68dS_BfzNZWpP3_p__dpDWOpjd5a_4IPkI_hTBObz_FTY31_89b_TAV3blzFu__vaYZWdB_yJaMs92_Bsp_B_unPoQGTETm__dNDNlQ36EYK5Wfr_59f__aSV_1d_fv7fnar_aZNWpad_uFtjyMIJ__kBCCw_7__YDb7_hZKkrVjNt9M___JScFlf_89iNqM__ve9WJDc_tyn8_DAgF4p4h_3DnZ1MkkxWoQ4Y___uvK_uZM2_g5azRXtg_f_5cd_QKWR2K_iI1b_huV4VwA6rZ_gn6_vu__KlhMjeIy75ueBOP_HSH_6MyHE3e5v_8B9j6R_izOUMM__n_Opad_vmL_NF9NA_a_T26g_X_W__QP7_69_hK_gD_l_skdPp3rzo4Q_KCJ19q_mJS_5g_m_OJEXkzIDwzeUq_IKfqV__M_atUAzb5_W9f83NF1Po_E42ONw_9OprFVKn_6Efpx4o_l3a23UHhM_sG1N_e5__fBWqO3y8_B4yl5_ibVSf_oMww7ZELAKtRPtFD__ZrYkPgi_Q3vw3_1R_Yk8QiGHPJgQ_nAPGq__IQj63okQWx4Bp2_hln_bjmpYfIkl3zQ__RuBCy_B_l8_F_u9xW_tB_a_p99_wNPj_RT_5b1ddjIqWJi_MbO_4Nh_DpnIfuVysd5eESp_YvPKrin_aU_o73__mlj9elhq1tq8C38wAU___9PNBGmQvQywVX_8_L
push 0x41836c
push dword [0x419ff8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
jae 0x403d9d
je 0x403d9f
jne 0x403d9f
call 0x3ab3716
jne 0x403d98
push 3
push 0x419120
push dword [ebp + 8]
call dword [ebp - 0x20]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x403de7
push 0x418378
push dword [0x419ff8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
jno 0x403dda
jo 0x403dda
call 0x20a83e48
xchg ecx, eax
inc ecx
add bh, bh
jne 0x403dec
push 0
push 0x419120
push dword [ebp + 8]
call dword [ebp - 0x28]
jl 0x403dee
je 0x403df0
jne 0x403df0
add ebp, eax
call 0xbe503766
add eax, 0x4193af
je 0x403de9
movsx eax, byte [0x4193af]
cmp eax, 0x31
jne 0x403e28
mov dword [ebp - 0x30], str.sYX___EIGpoUw_YeJpbUXMl_xQFdgSSxnLyF_xOQx1_V__XX8_u_ADF6JQJmuiBId6_NUG_AxscAn8n_PqbNyvC1CLmzk_f_Ai2_YqDA_BMLJN_Ux_BIAHt__l1_DsCPXdd_xOM_cUD_7iO1f6olYIdKyy_Lcf___aCNvEW_Ccf9N88oH___GL_UlMpwLxF82P3xQSN32_f_yN3OLBUZRpBxAe__o_4__msV2__Pdh5MWCvTCq2OZPYWN_Tf__HS_D_vl21RwJA_vp_MfVw___wZIMKe6tq_w8AXvjyg5n1TFuWhLhfOvs_ThwRH__fLcQ_bh_KO5YFApZC_uRVhCU_l2DQXjck_jC_6HxcLzd2cbTqh_sHg_iDkRl_kdBDERZ_o_n_nFb6z_8t_uP8eN__NlJ7KjQ4Hw_oiVqMjyXKD_nmmz1__N_P1hBliAgfb5A6_r_cTCyst_XV2SmOBP2ta_syHDz_2j_RLWG_Mc_AtRsy3_dawJeTJCL_pcuU_c4MZQBhrcyHwqDwtE_Nk_UB_hvm_DsL1g__IVJMSMUbU_m1Z_b_Zw_z1_vRt_VJZtQtvtX_zZg5Ghg_7gl_BDEaaxWF__wMcJ6y_7_L3v_JeYr9U_h_t_Dzh_r3h_V3ziA_Kk_VJRK6wc_LKj__PK8dNwcrvlr5_T_3blOi_B_r_7qWKdC_x5Jc_zwV_d3xM_OBy__E6_9G6GjMXwgm24Q_ZCod_LVU_C4C6F_ORIHgv15SpV_cpBQDwfDEugh8yq_yS_iDYAU6_TyK_Muyp_m_m_o1_q_J_hhDnr4y_UvWWONLft2ghlG____Vf4u_buP_x__ldmNgocOCVB7_l_daU_usVWrd66kh_NlcjO4rBV_DbV_AAV_DEI__AJ4fWkD_vB7aCHG_4vexHR_TWw_XT__Tc_1O_9sy6za1cJ27km_j3jUfka593qT_bW_hk3wE9ukLysFrpgq2u_x5pp4_BecnaGr_c_ynwc3zi_R_Beqg7wCbB_XRbjZ_Fc_GJq96NdLUNtbB_9viuZOPaWdKcJB_IoWG__Zh___G_hg8Twmw_rhSXbk7w6kJUKz_Rs_mcozjTKdR_KHfhhpbN_qu82_O_j6BcGfkSO_jYJ_lzdW63OUuy_a_rNE__R_q1s_Csb__w_T5AG5P2E79_Z67_QCmgGvB__14e_gS_pKrpdet__G7MHebDwj3bpK4ocPJgA_Tg1FM_1k_uH5cdMkkaIjiIl62P5VKK4x36_F_w_sHTRThciwN5_O7Dc6__Pf4U____vPkTvdXuzf7ZJtfKA5fZgpBk_Z__bNI_T_i_Yn7dbQHA5lpsDXH_DboqJ_
push 0x418384
push dword [0x419ff8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2c], eax
jge 0x403e1e
jmp 0x403e1c
je 0x403e19
push 2
push 0x419120
call dword [ebp - 0x2c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movsx eax, byte [0x4194f6]
cmp eax, 0x30
je 0x403e4b
call fcn.004034dc
jl 0x403e4f
jmp 0x403e51
je 0x403e4d
cmp dword [ebp - 0x14], 0
jbe 0x403e62
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403e93
cmp dword [ebp - 0x14], 0xfffff830
jne 0x403e93
call fcn.00405a0b
cdq
mov ecx, 0x12c
idiv ecx
add edx, 0x3d
imul edx, edx, 0x3e8
mov dword [ebp - 0x14], edx
je 0x403e8a
jne 0x403e8a
int 0x20
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_Sleep]
jl 0x403e97
jmp 0x403e99
je 0x403e95
call fcn.0040100d
call fcn.004036d0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp - 0x14], 0xfffffc18
jne 0x403ed3
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [0x419ff0], 1
mov eax, 0x419120
jmp 0x403f08
pushf
jb 0x403ef2
je 0x403eed
jne 0x403eed
call fcn.004041d9
add byte [edx - 0xc], dh
call 0x403ef4
jb 0x403ee8
add esp, 4
popf
je 0x403efe
jne 0x403efe
call 0xa0306485
inc ecx
add byte [eax], al
and dword [0x419ff0], 0
mov eax, dword [ebp + 8]
leave