Function at 0x417a70
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425158
push 0x4240d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x58], 0x47
mov byte [ebp - 0x57], 0x65
mov bl, 0x74
mov byte [ebp - 0x56], bl
mov byte [ebp - 0x55], 0x46
mov byte [ebp - 0x54], 0x69
mov byte [ebp - 0x53], 0x6c
mov byte [ebp - 0x52], 0x65
mov byte [ebp - 0x51], 0x41
mov byte [ebp - 0x50], bl
mov byte [ebp - 0x4f], bl
mov byte [ebp - 0x4e], 0x72
mov byte [ebp - 0x4d], 0x69
mov byte [ebp - 0x4c], 0x62
mov byte [ebp - 0x4b], 0x75
mov byte [ebp - 0x4a], bl
mov byte [ebp - 0x49], 0x65
mov byte [ebp - 0x48], 0x73
mov byte [ebp - 0x47], 0x41
mov byte [ebp - 0x46], 0
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x40]
call fcn.00417640
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov dword [ebp - 0x68], eax
mov byte [ebp - 0x38], 0x43
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x65
mov byte [ebp - 0x35], 0x61
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], 0x65
mov byte [ebp - 0x32], 0x44
mov byte [ebp - 0x31], 0x69
mov byte [ebp - 0x30], 0x72
mov byte [ebp - 0x2f], 0x65
mov byte [ebp - 0x2e], 0x63
mov byte [ebp - 0x2d], bl
mov byte [ebp - 0x2c], 0x6f
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x79
mov byte [ebp - 0x29], 0x41
mov byte [ebp - 0x28], 0
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x40]
call fcn.00417640
push eax
call esi
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x64], 0x43
mov byte [ebp - 0x63], 0x68
mov byte [ebp - 0x62], 0x61
mov byte [ebp - 0x61], 0x72
mov byte [ebp - 0x60], 0x4e
mov byte [ebp - 0x5f], 0x65
mov byte [ebp - 0x5e], 0x78
mov byte [ebp - 0x5d], bl
mov byte [ebp - 0x5c], 0x41
mov byte [ebp - 0x5b], 0
lea edx, [ebp - 0x64]
push edx
lea ecx, [ebp - 0x40]
call fcn.00417700
push eax
call esi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 4], 0
push str.lstrlenA
push 0x427080
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call esi
mov dword [ebp - 0x6c], eax
mov edi, dword [ebp + 8]
push edi
call eax
inc eax
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov ebx, eax
mov dword [ebp - 0x44], ebx
test ebx, ebx
je 0x417cfc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, ebx
mov dword [ebp - 0x1c], esi
cmp byte [ebx], 0x5c
jne 0x417c2c
lea eax, [ebx + 1]
cmp byte [eax], 0x5c
jne 0x417c2c
mov esi, eax
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
mov al, byte [esi]
test al, al
je 0x417c0a
cmp al, 0x5c
je 0x417c0a
push esi
call dword [ebp - 0x3c]
mov esi, eax
jmp 0x417bf5
cmp byte [esi], 0
je 0x417c13
inc esi
mov dword [ebp - 0x1c], esi
mov al, byte [esi]
test al, al
je 0x417c25
cmp al, 0x5c
je 0x417c25
push esi
call dword [ebp - 0x3c]
mov esi, eax
jmp 0x417c10
cmp byte [esi], 0
je 0x417c4b
jmp 0x417c47
lea eax, [ebx + 1]
cmp byte [eax], 0x3a
jne 0x417c4b
mov esi, eax
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
mov al, byte [esi]
test al, al
je 0x417c4b
cmp al, 0x5c
jne 0x417c4b
inc esi
mov dword [ebp - 0x1c], esi
mov al, byte [esi]
test al, al
je 0x417cc0
cmp al, 0x5c
jne 0x417cb8
mov byte [esi], 0
push ebx
call dword [ebp - 0x68]
mov dword [ebp - 0x24], eax
or edi, 0xffffffff
cmp eax, edi
jne 0x417c9f
push 0
push ebx
call dword [ebp - 0x20]
test eax, eax
jne 0x417cb5
push str.GetLastError
lea ecx, [ebp - 0x40]
call fcn.00417640
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x70], eax
call eax
cmp eax, 0xb7
je 0x417cb5
push ebx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov dword [ebp - 4], edi
jmp 0x417d03
and eax, 0x10
cmp al, 0x10
je 0x417cb5
push ebx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov dword [ebp - 4], edi
jmp 0x417d03
mov byte [esi], 0x5c
push esi
call dword [ebp - 0x3c]
mov esi, eax
jmp 0x417c48
mov dword [ebp - 4], 0xffffffff
push ebx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4