Function at 0x417b96
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3e4
push ebx
push esi
push edi
xor ebx, ebx
push 0x206
lea eax, [ebp - 0x3e2]
push ebx
push eax
mov word [ebp - 0x3e4], bx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x3e4]
push eax
push 0x272c
push dword [0x41d42c]
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x2c
push 3
lea eax, [ebp - 0x3e4]
push eax
lea eax, [ebp - 0x1dc]
push eax
call fcn.00406477
add esp, 0x10
push 0x10
mov esi, eax
pop ecx
lea edi, [ebp - 0x5c]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x5c]
cmp eax, ebx
je 0x417c2f
cmp word [eax], bx
je 0x417c2f
mov ecx, dword [ebp - 0x58]
cmp ecx, ebx
je 0x417c2f
cmp word [ecx], bx
je 0x417c2f
push eax
push ecx
call fcn.00403470
pop ecx
push eax
call fcn.00406710
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
jne 0x417c41
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
mov esi, eax
cmp esi, ebx
je 0x418007
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push esi
push 0x30
push dword [ebp + 8]
call edi
push 0x200
push 0x800
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push dword [0x41d42c]
mov dword [ebp - 0x14], 6
push eax
push ebx
mov dword [ebp - 0x10], 0x28
mov dword [ebp - 0xc], 0x2a8
mov dword [ebp - 8], 0x19e
call fcn.0040869d
add esp, 0x1c
cmp eax, ebx
mov dword [0x41d404], eax
je 0x418007
push 0x800000
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push dword [0x41d42c]
mov dword [ebp - 0x14], 0x2b4
push eax
mov dword [ebp - 0x10], 0x28
mov dword [ebp - 0xc], 0x3a
mov dword [ebp - 8], 0x19e
call fcn.00408521
add esp, 0x14
cmp eax, ebx
mov dword [0x41d408], eax
je 0x418007
push 0x20
pop eax
push 3
push esi
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
push dword [0x41d42c]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
push ebx
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x10], 4
call fcn.00408678
add esp, 0x18
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x418007
push 1
push dword [0x41d42c]
call dword [sym.imp.USER32.dll_LoadIconW]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x418007
push 2
push dword [0x41d42c]
call dword [sym.imp.USER32.dll_LoadIconW]
cmp eax, ebx
mov dword [0x41c8e4], eax
je 0x418007
push dword [ebp - 4]
push 1
push 0x80
push dword [ebp + 8]
call edi
push ebx
push dword [ebp - 4]
push 0x170
push dword [ebp - 0x18]
call edi
mov dword [0x41d3ec], esi
mov dword [0x41c8e0], esi
mov esi, 0x9e
push esi
lea eax, [ebp - 0x19a]
push ebx
push eax
mov word [ebp - 0x19c], bx
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0xfa]
push ebx
push eax
mov word [ebp - 0xfc], bx
call sub.MSVCRT.dll_memset
push 0x41d6f8
call fcn.004063ee
add esp, 0x1c
push eax
lea eax, [ebp - 0xfc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x2e
push ebx
lea eax, [ebp - 0xfc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
je 0x417dd7
mov word [eax], bx
push 0x4031c4
push 0x40319c
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0x19c]
push 0x403188
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x30
pop esi
push 0xa
pop edi
push 0x300
push dword [0x41d3ec]
lea eax, [ebp - 0x14]
push dword [ebp + 8]
mov dword [ebp - 0x14], esi
push dword [0x41d42c]
mov dword [ebp - 0x10], edi
push eax
lea eax, [ebp - 0x19c]
push eax
mov dword [ebp - 0xc], 0x154
mov dword [ebp - 8], 0x14
call fcn.0040864c
add esp, 0x2c
test eax, eax
je 0x418007
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x14], 0x1ea
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
sub eax, 0x804
je 0x417e95
push 0x50
mov esi, 0x41c9a0
push esi
push 0x272b
push dword [0x41d42c]
call dword [sym.imp.USER32.dll_LoadStringW]
push 1
push edi
push 0x272a
push ebx
call fcn.0041518a
add esp, 0x10
mov dword [0x41c8e8], eax
jmp 0x417fc8
push 0x1c
lea eax, [ebp - 0x54]
mov word [ebp - 0x2e], si
push eax
mov esi, 0x41c9a0
push esi
mov word [ebp - 0x54], 0x732d
mov word [ebp - 0x52], 0x722f
mov word [ebp - 0x50], 0x5fc0
mov word [ebp - 0x4e], 0xff08
mov word [ebp - 0x4c], 0x652a
mov word [ebp - 0x4a], 0x62fb
mov word [ebp - 0x48], 0x6349
mov word [ebp - 0x46], 0x8d58
mov word [ebp - 0x44], 0x4e
mov word [ebp - 0x42], 0x5f
mov word [ebp - 0x40], 0x63
mov word [ebp - 0x3e], 0x37
mov word [ebp - 0x3c], pe_nt_image_headers32
mov word [ebp - 0x3a], 0x36
mov word [ebp - 0x38], 0x2ff2
mov word [ebp - 0x36], pe_nt_image_headers32
mov word [ebp - 0x34], 0x34
mov word [ebp - 0x32], 0x31
mov word [ebp - 0x30], 0x3a
mov word [ebp - 0x2c], 0x2fec
mov word [ebp - 0x2a], 0x41
mov word [ebp - 0x28], 0x52
mov word [ebp - 0x26], 0x55
mov word [ebp - 0x24], 0x3b
mov word [ebp - 0x22], 0x55
mov word [ebp - 0x20], 0x54
mov word [ebp - 0x1e], 0x50
call fcn.0040684e
push 0x6de
mov edi, 0x41c060
push edi
call fcn.0040660d
add esp, 0x14
cmp eax, 0x2ed04ef2
jne 0x417fc8
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 4]
push eax
push edi
mov dword [ebp - 4], 0x6de
call fcn.00414f93
mov ecx, eax
add esp, 0xc
cmp ecx, ebx
mov dword [ebp - 0x18], ecx
je 0x417fc8
push ecx
call fcn.004075f2
add esp, 4
test al, al
je 0x417f9f
add ecx, 2
mov dword [0x41c8e8], ecx
jmp 0x417fc8
mov edi, dword [ebp - 4]
add edi, 0x10
lea eax, [edi + edi]
push eax
call fcn.004033c0
push edi
push dword [ebp - 0x18]
mov dword [0x41c8e8], eax
push eax
call fcn.0040340d
push dword [ebp - 0x18]
call sub.MSVCRT.dll_free
add esp, 0x14
push 1
push 0xa
push 0x65
push ebx
mov dword [0x41c8ec], esi
call fcn.0041518a
add esp, 0x10
cmp eax, ebx
mov dword [0x41d3fc], eax
je 0x418007
cmp dword [0x41c8e8], ebx
je 0x418007
sub esp, 0x10
mov edi, esp
push dword [ebp + 8]
lea esi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00410c8a
add esp, 0x14
jmp 0x41800a
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret