Function at 0x401034
Capabilities:
Check for debugger via api
Contain obfuscated stackstrings
Encrypt data using tea

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x174
mov eax, dword [ebp + 0x7c]
push ebx
mov ebx, dword [eax + 4]
push esi
push edi
mov edi, dword [eax]
mov eax, dword [0x428f10]
mov dword [ebp - 0xf8], eax
mov eax, dword [0x428f14]
xor ecx, ecx
mov dword [ebp - 0xf4], eax
lea eax, [ebp - 0xe4]
mov dword [ebp - 0xe8], edi
mov dword [ebp - 0xe4], ecx
call fcn.0040102d
add dword [ebp - 0xe4], 0x23f
cmp dword [0x208f5f4], 0x14
jne 0x401094
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov eax, dword [0x428f18]
mov dword [ebp - 0xfc], eax
mov eax, dword [0x428f1c]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xec], 0x20
mov dword [ebp + 0x6c], 2
add dword [ebp + 0x6c], 3
mov eax, dword [0x208f5f4]
mov ecx, edi
shl ecx, 4
add ecx, dword [ebp - 0xfc]
cmp eax, 0xfa9
jne 0x4010e0
mov dword [0x208f5f0], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010ee
and dword [0x208f07c], 0
mov eax, dword [ebp - 0xe8]
shr eax, 5
mov dword [ebp + 0x70], eax
mov eax, dword [ebp + 0x70]
add eax, dword [ebp - 0xf0]
mov edx, dword [ebp - 0xe4]
add edx, edi
xor eax, edx
xor eax, ecx
sub ebx, eax
mov eax, ebx
shr eax, 5
mov dword [0x208f5ec], 0xf4ea3dee
mov dword [ebp + 0x70], eax
mov eax, dword [ebp - 0xf4]
add dword [ebp + 0x70], eax
mov eax, dword [ebp - 0xe4]
mov esi, ebx
shl esi, 4
add esi, dword [ebp - 0xf8]
add eax, ebx
xor esi, eax
cmp dword [0x208f5f4], 0xb03
jne 0x401159
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
and dword [ebp - 0xe8], 0
mov dword [ebp - 0x100], esi
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp + 0x70]
xor dword [ebp - 0xe8], eax
sub edi, dword [ebp - 0xe8]
mov dword [ebp - 0xe8], edi
mov dword [ebp + 0x38], 0x72ef4d12
mov dword [ebp + 0x68], 0x667a8f03
mov dword [ebp - 0xa4], 0x74eb31e9
mov dword [ebp - 0x50], 0x3e01a6
mov dword [ebp - 0x18], 0x31c38e55
mov dword [ebp - 0xb4], 0x72297fa
mov dword [ebp - 0x78], 0x58102752
mov dword [ebp - 0xcc], 0x3511d0e6
mov dword [ebp - 0x70], 0x2d857b28
mov dword [ebp + 0x34], 0x97e3837
mov dword [ebp + 0x50], 0xe1ab73f
mov dword [ebp - 0xc0], 0x18d08cdb
mov dword [ebp - 0x2c], 0x1d941164
mov dword [ebp + 0x58], 0x5406190b
mov dword [ebp - 0x94], 0x88fefab
mov dword [ebp - 0x44], 0x45f6d7d
mov dword [ebp - 0x24], 0x4187963d
mov dword [ebp + 0xc], 0x25cc7e9c
mov dword [ebp - 0x48], 0x3590bb86
mov dword [ebp - 0xdc], 0x580bdfc5
mov dword [ebp - 0xb8], 0x7c15733e
mov dword [ebp - 0x10], 0x83fb90b
mov dword [ebp - 8], 0x18dcf915
mov dword [ebp - 0x74], 0x6bcce2ae
mov dword [ebp + 0x4c], 0xef49651
mov dword [ebp - 0x40], 0x23d8d51c
mov dword [ebp + 0x40], 0x16126415
mov dword [ebp - 0x8c], 0x44b04db6
mov dword [ebp - 0xac], 0x24aae8b1
mov dword [ebp - 0x38], 0x65fd8d98
mov dword [ebp - 0x3c], 0x583762f0
mov dword [ebp - 0xbc], 0x1513b7a7
mov dword [ebp + 0x1c], 0x1802c670
mov dword [ebp - 0xb0], 0xf7c92fe
mov dword [ebp - 0x84], 0x74d37a51
mov dword [ebp - 4], 0x17abbd3d
mov dword [ebp + 0x54], 0x529ae9f7
mov dword [ebp], 0x5aa86f3e
mov dword [ebp - 0x54], 0x3a65bf1e
mov dword [ebp - 0x14], 0x7672def6
mov dword [ebp - 0x90], 0x2243bd14
mov dword [ebp - 0x9c], 0x4c273f6d
mov dword [ebp - 0xc4], 0x1cfa349
mov dword [ebp - 0x30], 0x2b7d43ba
mov dword [ebp - 0xc], 0x545ac286
mov dword [ebp - 0x68], 0x5264ce66
mov dword [ebp - 0xa8], 0x3c4837cf
mov dword [ebp + 0x60], 0x7c586549
mov dword [ebp + 0x28], 0x9cd3349
mov dword [ebp - 0x64], 0x780d3546
mov dword [ebp + 0x5c], 0x21e3555f
mov dword [ebp - 0xd4], 0x2c60148d
mov dword [ebp - 0xd8], 0x69d867cc
mov dword [ebp - 0x4c], 0xae78f71
mov dword [ebp + 8], 0xe7d96f2
mov dword [ebp - 0xa0], 0x59084214
mov dword [ebp - 0xd0], 0x3d452aef
mov dword [ebp + 0x3c], 0x34f599f4
mov dword [ebp - 0xc8], 0xaa33e49
mov dword [ebp + 0x24], 0x77c2236c
mov dword [ebp - 0x28], 0x36a014c0
mov dword [ebp - 0xe0], 0x1e27746
mov dword [ebp + 0x64], 0x46697512
mov dword [ebp - 0x6c], 0x10c82555
mov dword [ebp - 0x34], 0x25543165
mov dword [ebp + 0x2c], 0x35515437
mov dword [ebp - 0x88], 0x503f330b
mov dword [ebp - 0x80], 0x7cd920ca
mov dword [ebp - 0x98], 0x4a3af65c
mov dword [ebp + 0x10], 0x371cfb7
mov dword [ebp + 0x48], 0x24118c47
mov dword [ebp + 0x18], 0x5092c2c
mov dword [ebp - 0x1c], 0x18921620
mov dword [ebp + 4], 0x6f9e58d
mov dword [ebp + 0x30], 0x67c97c2f
mov dword [ebp + 0x44], 0x4f8bf301
mov dword [ebp - 0x60], 0x7902178b
mov dword [ebp + 0x20], 0x78030743
mov dword [ebp - 0x7c], 0x1e01ab1d
mov dword [ebp - 0x20], 0x78b71ec6
mov dword [ebp + 0x14], 0x44a6b9d
mov dword [ebp - 0x58], 0x1ba850d8
mov dword [ebp - 0x5c], 0x185ce861
add dword [ebp - 0xe4], 0x61c88647
dec dword [ebp - 0xec]
jne 0x4010b4
mov eax, dword [ebp + 0x7c]
mov dword [eax], edi
pop edi
pop esi
mov dword [eax + 4], ebx
pop ebx
add ebp, 0x74
leave
ret 4