Function at 0x410b40
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x568
mov qword [rsp + 0x450], 0xfffffffffffffffe
mov rax, qword [0x00419040]
xor rax, rsp
mov qword [rsp + 0x550], rax
mov qword [rsp + 0x68], 0
mov word [rsp + 0x118], 0x50
mov word [rsp + 0x11a], 0x6e
mov word [rsp + 0x11c], 0x65
mov word [rsp + 0x11e], 0x4d
mov word [rsp + 0x120], 0x65
mov word [rsp + 0x122], 0x63
mov word [rsp + 0x124], 0x77
mov word [rsp + 0x126], 0x49
mov word [rsp + 0x128], 0x63
mov word [rsp + 0x12a], 0x6e
mov word [rsp + 0x12c], 0x43
mov word [rsp + 0x12e], 0x67
mov word [rsp + 0x130], 0x59
mov word [rsp + 0x132], 0
mov word [rsp + 0xa8], 0x79
mov word [rsp + 0xaa], 0x4a
mov word [rsp + 0xac], 0x79
mov word [rsp + 0xae], 0x79
mov word [rsp + 0xb0], 0x70
mov word [rsp + 0xb2], 0
lea rax, [rsp + 0x138]
mov qword [rsp + 0x160], rax
lea rax, [rsp + 0x168]
mov qword [rsp + 0x190], rax
lea rdx, [rsp + 0xa8]
mov rcx, qword [rsp + 0x160]
call fcn.00401c30
mov qword [rsp + 0x458], rax
mov rax, qword [rsp + 0x458]
mov qword [rsp + 0x460], rax
lea rdx, [rsp + 0x118]
mov rcx, qword [rsp + 0x190]
call fcn.00401c30
mov qword [rsp + 0x468], rax
mov r8, qword [rsp + 0x460]
mov rdx, qword [rsp + 0x468]
lea rcx, [rsp + 0x70]
call fcn.00410150
nop
mov word [rsp + 0x100], 0x53
mov word [rsp + 0x102], 0x43
mov word [rsp + 0x104], 0x55
mov word [rsp + 0x106], 0x52
mov word [rsp + 0x108], 0x45
mov word [rsp + 0x10a], 0x50
mov word [rsp + 0x10c], 0x46
mov word [rsp + 0x10e], 0x45
mov word [rsp + 0x110], 0
mov word [rsp + 0xb8], 0x41
mov word [rsp + 0xba], 0x4f
mov word [rsp + 0xbc], 0x50
mov word [rsp + 0xbe], 0x59
mov word [rsp + 0xc0], 0x69
mov word [rsp + 0xc2], 0x50
mov word [rsp + 0xc4], 0x4f
mov word [rsp + 0xc6], 0
call fcn.0040ffd0
lea rax, [rsp + 0x1c8]
mov qword [rsp + 0x1f0], rax
lea rax, [rsp + 0x1f8]
mov qword [rsp + 0x220], rax
lea rax, [rsp + 0x198]
mov qword [rsp + 0x1c0], rax
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0x1f0]
call fcn.00401c30
mov qword [rsp + 0x470], rax
mov rax, qword [rsp + 0x470]
mov qword [rsp + 0x478], rax
lea rdx, [rsp + 0x100]
mov rcx, qword [rsp + 0x220]
call fcn.00401c30
mov qword [rsp + 0x480], rax
mov r8, qword [rsp + 0x478]
mov rdx, qword [rsp + 0x480]
lea rcx, [rsp + 0x228]
call fcn.00410150
mov qword [rsp + 0x488], rax
mov rax, qword [rsp + 0x488]
mov qword [rsp + 0x490], rax
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x1c0]
call fcn.004018f0
mov qword [rsp + 0x498], rax
mov rcx, qword [rsp + 0x490]
call fcn.00401ac0
mov qword [rsp + 0x4a0], rax
mov rdx, qword [rsp + 0x498]
mov rcx, qword [rsp + 0x578]
call fcn.0040ffe0
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, qword [rsp + 0x4a0]
mov rdx, rcx
mov rcx, 0xffffffff80000001
call rax
nop
lea rcx, [rsp + 0x228]
call fcn.004019c0
cmp qword [rsp + 0x68], 0
jne 0x410ec1
lea rcx, [rsp + 0x70]
call fcn.004019c0
nop
mov rcx, qword [rsp + 0x570]
call fcn.00401f60
jmp 0x41143c
mov word [rsp + 0x48], 0x51
mov word [rsp + 0x4a], 0x69
mov word [rsp + 0x4c], 0x61
mov word [rsp + 0x4e], 0x54
mov word [rsp + 0x50], 0x6b
mov word [rsp + 0x52], 0x6c
mov word [rsp + 0x54], 0x55
mov word [rsp + 0x56], 0x65
mov word [rsp + 0x58], 0x66
mov word [rsp + 0x5a], 0x76
mov word [rsp + 0x5c], 0x6b
mov word [rsp + 0x5e], 0x57
mov word [rsp + 0x60], 0x77
mov word [rsp + 0x62], 0x45
mov word [rsp + 0x64], 0
mov word [rsp + 0x98], 0x5a
mov word [rsp + 0x9a], 0x45
mov word [rsp + 0x9c], 0x75
mov word [rsp + 0x9e], 0x62
mov word [rsp + 0xa0], 0x47
mov word [rsp + 0xa2], 0x53
mov word [rsp + 0xa4], 0
lea rax, [rsp + 0x250]
mov qword [rsp + 0x278], rax
lea rax, [rsp + 0x280]
mov qword [rsp + 0x2a8], rax
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x278]
call fcn.00401c30
mov qword [rsp + 0x4a8], rax
mov rax, qword [rsp + 0x4a8]
mov qword [rsp + 0x4b0], rax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x2a8]
call fcn.00401c30
mov qword [rsp + 0x4b8], rax
mov r8, qword [rsp + 0x4b0]
mov rdx, qword [rsp + 0x4b8]
lea rcx, [rsp + 0x2b0]
call fcn.00410150
mov qword [rsp + 0x4c0], rax
mov rax, qword [rsp + 0x4c0]
mov qword [rsp + 0x4c8], rax
mov rdx, qword [rsp + 0x4c8]
lea rcx, [rsp + 0x70]
call fcn.004019e0
nop
lea rcx, [rsp + 0x2b0]
call fcn.004019c0
mov word [rsp + 0xe0], 0x6f
mov word [rsp + 0xe2], 0x68
mov word [rsp + 0xe4], 0x49
mov word [rsp + 0xe6], 0x76
mov word [rsp + 0xe8], 0x69
mov word [rsp + 0xea], 0x79
mov word [rsp + 0xec], 0
mov word [rsp + 0xf0], 0x64
mov word [rsp + 0xf2], 0x73
mov word [rsp + 0xf4], 0x46
mov word [rsp + 0xf6], 0x56
mov word [rsp + 0xf8], 0x70
mov word [rsp + 0xfa], 0x59
mov word [rsp + 0xfc], 0
call fcn.0040ffd0
lea rax, [rsp + 0x310]
mov qword [rsp + 0x338], rax
lea rax, [rsp + 0x340]
mov qword [rsp + 0x368], rax
lea rax, [rsp + 0x2e0]
mov qword [rsp + 0x308], rax
lea rdx, [rsp + 0xf0]
mov rcx, qword [rsp + 0x338]
call fcn.00401c30
mov qword [rsp + 0x4d0], rax
mov rax, qword [rsp + 0x4d0]
mov qword [rsp + 0x4d8], rax
lea rdx, [rsp + 0xe0]
mov rcx, qword [rsp + 0x368]
call fcn.00401c30
mov qword [rsp + 0x4e0], rax
mov r8, qword [rsp + 0x4d8]
mov rdx, qword [rsp + 0x4e0]
lea rcx, [rsp + 0x370]
call fcn.00410150
mov qword [rsp + 0x4e8], rax
mov rax, qword [rsp + 0x4e8]
mov qword [rsp + 0x4f0], rax
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x308]
call fcn.004018f0
mov qword [rsp + 0x4f8], rax
mov rcx, qword [rsp + 0x570]
call fcn.00401f80
mov qword [rsp + 0x500], rax
xor edx, edx
mov rcx, qword [rsp + 0x570]
call fcn.00402030
mov qword [rsp + 0x508], rax
mov rcx, qword [rsp + 0x4f0]
call fcn.00401ac0
mov qword [rsp + 0x510], rax
mov rdx, qword [rsp + 0x4f8]
mov rcx, qword [rsp + 0x578]
call fcn.0040ffe0
mov rcx, qword [rsp + 0x500]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x508]
mov qword [rsp + 0x20], rcx
mov r9d, 3
xor r8d, r8d
mov rcx, qword [rsp + 0x510]
mov rdx, rcx
mov rcx, qword [rsp + 0x68]
call rax
test eax, eax
je 0x411221
mov dword [rsp + 0x518], 1
jmp 0x41122c
mov dword [rsp + 0x518], 0
movzx eax, byte [rsp + 0x518]
mov byte [rsp + 0x2d8], al
lea rcx, [rsp + 0x370]
call fcn.004019c0
movzx eax, byte [rsp + 0x2d8]
test eax, eax
je 0x411271
lea rcx, [rsp + 0x70]
call fcn.004019c0
nop
mov rcx, qword [rsp + 0x570]
call fcn.00401f60
jmp 0x41143c
mov word [rsp + 0xc8], 0x54
mov word [rsp + 0xca], 0x68
mov word [rsp + 0xcc], 0x68
mov word [rsp + 0xce], 0x57
mov word [rsp + 0xd0], 0x6e
mov word [rsp + 0xd2], 0x72
mov word [rsp + 0xd4], 0x74
mov word [rsp + 0xd6], 0x79
mov word [rsp + 0xd8], 0x4d
mov word [rsp + 0xda], 0x68
mov word [rsp + 0xdc], 0x7a
mov word [rsp + 0xde], 0
mov word [rsp + 0x38], 0x63
mov word [rsp + 0x3a], 0x64
mov word [rsp + 0x3c], 0x42
mov word [rsp + 0x3e], 0x55
mov word [rsp + 0x40], 0
lea rax, [rsp + 0x398]
mov qword [rsp + 0x3c0], rax
lea rax, [rsp + 0x3c8]
mov qword [rsp + 0x3f0], rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x3c0]
call fcn.00401c30
mov qword [rsp + 0x520], rax
mov rax, qword [rsp + 0x520]
mov qword [rsp + 0x528], rax
lea rdx, [rsp + 0xc8]
mov rcx, qword [rsp + 0x3f0]
call fcn.00401c30
mov qword [rsp + 0x530], rax
mov r8, qword [rsp + 0x528]
mov rdx, qword [rsp + 0x530]
lea rcx, [rsp + 0x3f8]
call fcn.00410150
mov qword [rsp + 0x538], rax
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x540], rax
mov rdx, qword [rsp + 0x540]
lea rcx, [rsp + 0x70]
call fcn.004019e0
nop
lea rcx, [rsp + 0x3f8]
call fcn.004019c0
call fcn.0040ffd0
lea rax, [rsp + 0x420]
mov qword [rsp + 0x448], rax
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x448]
call fcn.004018f0
mov qword [rsp + 0x548], rax
mov rdx, qword [rsp + 0x548]
mov rcx, qword [rsp + 0x578]
call fcn.0040ffe0
mov rcx, qword [rsp + 0x68]
call rax
nop
lea rcx, [rsp + 0x70]
call fcn.004019c0
nop
mov rcx, qword [rsp + 0x570]
call fcn.00401f60
jmp 0x41143c
mov rcx, qword [rsp + 0x550]
xor rcx, rsp
call fcn.00406150
add rsp, 0x568
ret