Function at 0x401c10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov al, 0x45
mov cl, 0x6c
mov byte [ebp - 0x37], al
mov byte [ebp - 0x34], al
mov al, 0x64
mov byte [ebp - 0x2e], cl
mov byte [ebp - 0x2d], cl
mov cl, 0x61
push ebx
mov byte [ebp - 0x2f], al
mov byte [ebp - 0x24], al
mov byte [ebp - 0x20], al
push esi
mov byte [ebp - 0x25], cl
mov byte [ebp - 0x21], cl
lea eax, [ebp - 0x28]
push edi
lea ecx, [ebp - 0x38]
mov dl, 0x52
push eax
push ecx
mov byte [ebp - 0x38], 0x4b
mov byte [ebp - 0x36], dl
mov byte [ebp - 0x35], 0x4e
mov byte [ebp - 0x33], 0x4c
mov byte [ebp - 0x32], 0x33
mov byte [ebp - 0x31], 0x32
mov byte [ebp - 0x30], 0x2e
mov byte [ebp - 0x2c], 0
mov byte [ebp - 0x28], 0x49
mov byte [ebp - 0x27], 0x73
mov byte [ebp - 0x26], 0x42
mov byte [ebp - 0x23], dl
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x1f], 0x50
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x72
mov byte [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [0x40ef2c]
mov edi, dword [ebp + 8]
mov esi, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 8], 1
mov edx, dword [edi + 4]
mov dword [ebp - 4], edx
call fcn.00404130
mov ebx, dword [edi]
add ebx, 0x80
call fcn.00404130
mov eax, dword [ebx + 4]
test eax, eax
jbe 0x402068
nop
bt eax, 0xe0
xor ah, 0x3d
sub al, 0xb5
test ebp, ebx
xor al, al
xadd eax, eax
xadd ah, al
neg eax
imul eax, ebx, 0x78b3bbf9
inc eax
imul eax, edx, 0xf9539b11
and eax, 0xc7e2d3ce
movsx eax, si
bsf eax, ecx
movsx eax, bx
btc eax, 0xb
dec eax
test cl, bl
mov eax, 0x2e383802
mov ah, 0x3d
mov ah, 0x8e
shrd eax, ebp, cl
movzx eax, dh
movsx eax, bl
test ecx, eax
shrd eax, esi, cl
rcl ah, 0x62
test ecx, edi
imul eax, ebp
bsf eax, edx
xadd al, ah
test edi, esi
dec al
bswap eax
dec ah
sub al, cl
mov ebx, dword [ebx]
mov ecx, dword [ebp - 4]
add ebx, ecx
mov dword [ebp - 0x10], ebx
nop
bt eax, 0xe0
xor ah, 0x3d
sub al, 0xb5
test ebp, ebx
xor al, al
xadd eax, eax
xadd ah, al
neg eax
imul eax, ebx, 0x78b3bbf9
inc eax
imul eax, edx, 0xf9539b11
and eax, 0xc7e2d3ce
movsx eax, si
bsf eax, ecx
movsx eax, bx
btc eax, 0xb
dec eax
test cl, bl
mov eax, 0x2e383802
mov ah, 0x3d
mov ah, 0x8e
shrd eax, ebp, cl
movzx eax, dh
movsx eax, bl
test ecx, eax
shrd eax, esi, cl
rcl ah, 0x62
test ecx, edi
imul eax, ebp
bsf eax, edx
xadd al, ah
test edi, esi
dec al
bswap eax
dec ah
sub al, cl
push 0x14
push ebx
call esi
test eax, eax
jne 0x402068
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401dbc
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp + 8]
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x402068
call fcn.00404130
push 0
call esi
push 0
call esi
push 0
call esi
call fcn.00404130
push 0
call esi
push 0
call esi
call fcn.00404130
call fcn.00404130
call fcn.00404130
call fcn.00404130
push 0
call esi
push 0
call esi
call fcn.00404130
call fcn.00404130
call fcn.00404130
call fcn.00404130
call fcn.00404130
mov eax, dword [ebx + 0xc]
mov edx, dword [ebp - 4]
add eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0xc], eax
call fcn.00404130
push 0
call esi
push 0
call esi
call fcn.00404130
call fcn.00404130
call fcn.00404130
call fcn.00404130
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x402057
push 0
call esi
call fcn.00404130
push 0
call esi
call fcn.00404130
call fcn.00404130
call fcn.00404130
call fcn.00404130
call fcn.00404130
call fcn.00404130
call fcn.00404130
call fcn.00404130
mov ecx, dword [edi + 0xc]
mov eax, dword [edi + 8]
lea edx, [ecx*4 + 4]
push edx
push eax
call fcn.00404460
add esp, 8
mov dword [edi + 8], eax
call fcn.00404130
call fcn.00404130
call fcn.00404130
call fcn.00404130
call fcn.00404130
call fcn.00404130
call fcn.00404130
call fcn.00404130
call fcn.00404130
push 0
call esi
mov eax, dword [edi + 8]
test eax, eax
je 0x402048
call fcn.00404130
mov ecx, dword [edi + 0xc]
mov edx, dword [edi + 8]
mov eax, dword [ebp - 0xc]
push 0
mov dword [edx + ecx*4], eax
mov eax, dword [edi + 0xc]
inc eax
mov dword [edi + 0xc], eax
call esi
push 0
call esi
push 0
call esi
call fcn.00404130
mov eax, dword [ebx]
push 0
test eax, eax
je 0x401f39
call esi
push 0
call esi
push 0
call esi
call fcn.00404130
mov edi, dword [ebp - 4]
mov ecx, dword [ebx]
add edi, ecx
call fcn.00404130
mov ebx, dword [ebx + 0x10]
mov eax, dword [ebp - 4]
add ebx, eax
jmp 0x401f6a
call esi
push 0
call esi
push 0
call esi
mov edi, dword [ebp - 4]
mov eax, dword [ebx + 0x10]
push 0
add edi, eax
call esi
push 0
call esi
push 0
call esi
call fcn.00404130
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 4]
add ebx, dword [ecx + 0x10]
call fcn.00404130
push 0
call esi
push 0
call esi
push 0
call esi
cmp dword [edi], 0
je 0x40200a
push 0
call esi
push 0
call esi
push 0
call esi
call fcn.00404130
mov eax, dword [edi]
test eax, 0x80000000
mov dword [ebp - 0x14], eax
je 0x401fb8
call fcn.00404130
mov edx, dword [edi]
mov eax, dword [ebp - 0xc]
and edx, 0xffff
push edx
push eax
call dword [0x40ef2c]
mov dword [ebx], eax
jmp 0x401fd9
call fcn.00404130
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
lea eax, [ecx + edx + 2]
mov ecx, dword [ebp - 0xc]
push eax
push ecx
call dword [0x40ef2c]
mov dword [ebx], eax
call fcn.00404130
push 0
call esi
push 0
call esi
push 0
call esi
cmp dword [ebx], 0
je 0x401ff9
mov eax, dword [edi + 4]
add edi, 4
add ebx, 4
test eax, eax
jne 0x401f7f
jmp 0x40200a
call fcn.00404130
mov dword [ebp - 8], 0
call fcn.00404130
push 0
call esi
push 0
call esi
push 0
call esi
call fcn.00404130
mov eax, dword [ebp - 8]
test eax, eax
je 0x402063
mov eax, dword [ebp - 0x10]
push 0x14
add eax, 0x14
push eax
mov dword [ebp - 0x10], eax
call dword [ebp - 0x18]
test eax, eax
je 0x401db6
call fcn.00404130
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00404130
call fcn.00404130
call fcn.00404130
call fcn.00404130
mov dword [ebp - 8], 0
call fcn.00404130
call fcn.00404130
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret