Function at 0x41e930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb52c
mov eax, dword fs:[0]
push eax
sub esp, 0x48c
mov eax, dword [0x4d7bf4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x498], ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x480], ecx
mov byte [ebp - 0x224], 0
push 0x103
push 0
lea edx, [ebp - 0x223]
push edx
call fcn.004a0650
add esp, 0xc
push 0x104
lea eax, [ebp - 0x224]
push eax
push 0
mov ecx, dword [ebp - 0x480]
push ecx
call dword [0x4bc324]
mov edx, dword [ebp - 0x480]
push edx
call dword [0x4bc320]
mov byte [ebp - 0x47c], 0
push 0x103
push 0
lea eax, [ebp - 0x47b]
push eax
call fcn.004a0650
add esp, 0xc
mov ecx, 0x41
lea esi, [ebp - 0x224]
lea edi, [ebp - 0x47c]
rep movsd dword es:[edi], dword [esi]
push str..LNK
lea ecx, [ebp - 0x224]
push ecx
call dword [0x4bc3e0]
push eax
call fcn.0041a420
add esp, 8
test eax, eax
je 0x41ea34
push 0x104
lea edx, [ebp - 0x47c]
push edx
lea eax, [ebp - 0x224]
push eax
call fcn.0040d1a0
add esp, 0xc
movzx ecx, al
test ecx, ecx
jne 0x41ea32
xor eax, eax
jmp 0x41ef8e
jmp 0x41ea5c
push str..EXE
lea edx, [ebp - 0x224]
push edx
call dword [0x4bc3e0]
push eax
call fcn.0041a420
add esp, 8
test eax, eax
je 0x41ea55
jmp 0x41ea5c
xor eax, eax
jmp 0x41ef8e
lea eax, [ebp - 0x47c]
push eax
lea ecx, [ebp - 0x260]
call fcn.00406130
mov dword [ebp - 4], 0
push 0
push str.AppDataRoaming
lea ecx, [ebp - 0x260]
call fcn.0040d2b0
cmp eax, 0xffffffff
je 0x41eb15
lea ecx, [ebp - 0x260]
push ecx
mov ecx, dword [ebp - 0x498]
call fcn.00421740
movzx edx, al
test edx, edx
jne 0x41eb15
push 0x4cc5d4
lea ecx, [ebp - 0x2c]
call fcn.00406130
mov byte [ebp - 4], 1
push 0x4cc5e0
lea ecx, [ebp - 0x48]
call fcn.00406130
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x48]
push ecx
mov ecx, dword [ebp - 0x498]
call fcn.0041f260
lea ecx, [ebp - 0x48]
call fcn.004062d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.004062d0
mov dword [ebp - 0x488], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x260]
call fcn.004062d0
mov eax, dword [ebp - 0x488]
jmp 0x41ef8e
mov byte [ebp - 0x114], 0x37
mov byte [ebp - 0x113], 0x31
mov byte [ebp - 0x112], 0x31
mov byte [ebp - 0x111], 0x33
mov byte [ebp - 0x110], 0x35
mov byte [ebp - 0x10f], 0x66
mov byte [ebp - 0x10e], 0x39
mov byte [ebp - 0x10d], 0x64
mov byte [ebp - 0x10c], 0x30
mov byte [ebp - 0x10b], 0x34
mov byte [ebp - 0x10a], 0x61
mov byte [ebp - 0x109], 0x65
mov byte [ebp - 0x108], 0x34
mov byte [ebp - 0x107], 0x37
mov byte [ebp - 0x106], 0x65
mov byte [ebp - 0x105], 0x32
mov byte [ebp - 0x104], 0x39
mov byte [ebp - 0x103], 0x31
mov byte [ebp - 0x102], 0x65
mov byte [ebp - 0x101], 0x64
mov byte [ebp - 0x100], 0x64
mov byte [ebp - 0xff], 0x37
mov byte [ebp - 0xfe], 0x39
mov byte [ebp - 0xfd], 0x33
mov byte [ebp - 0xfc], 0x64
mov byte [ebp - 0xfb], 0x63
mov byte [ebp - 0xfa], 0x65
mov byte [ebp - 0xf9], 0x61
mov byte [ebp - 0xf8], 0x37
mov byte [ebp - 0xf7], 0x32
mov byte [ebp - 0xf6], 0x63
mov byte [ebp - 0xf5], 0x61
mov byte [ebp - 0xf4], 0
mov dword [ebp - 0x118], 0
lea edx, [ebp - 0x118]
push edx
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x260]
call fcn.0040bcd0
push eax
mov ecx, dword [ebp - 0x498]
add ecx, 0x58c
call fcn.00406570
movzx ecx, al
test ecx, ecx
je 0x41ec41
cmp dword [ebp - 0x118], 0
jne 0x41ecad
push 0x4cc5e8
lea ecx, [ebp - 0x64]
call fcn.00406130
mov byte [ebp - 4], 2
push 0x4cc5f4
lea ecx, [ebp - 0x80]
call fcn.00406130
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x80]
push eax
mov ecx, dword [ebp - 0x498]
call fcn.0041f260
lea ecx, [ebp - 0x80]
call fcn.004062d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.004062d0
mov dword [ebp - 0x48c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x260]
call fcn.004062d0
mov eax, dword [ebp - 0x48c]
jmp 0x41ef8e
mov ecx, dword [ebp - 0x118]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
mov dword [ebp - 0x244], edx
mov eax, dword [ebp - 0x118]
and eax, 0xffff
movzx ecx, ax
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x370], 0
cmp dword [ebp - 0x118], 0x384
jne 0x41ee3f
mov edx, dword [ebp - 0x498]
add edx, 0x590
push edx
lea ecx, [ebp - 0x260]
call fcn.004050f0
mov dword [ebp - 0x484], 0
cmp dword [ebp - 0x484], 0x14
jge 0x41ed86
lea ecx, [ebp - 0x260]
call fcn.0040bcd0
push eax
call fcn.0040f1b0
add esp, 4
test eax, eax
je 0x41ed38
jmp 0x41ed86
cmp dword [ebp - 0x370], 0
jne 0x41ed6a
lea eax, [ebp - 0x47c]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x244]
push edx
mov ecx, dword [ebp - 0x498]
call fcn.0041fcc0
movzx eax, al
mov dword [ebp - 0x370], eax
mov ecx, dword [ebp - 0x484]
add ecx, 1
mov dword [ebp - 0x484], ecx
push 0x3e8
call dword [0x4bc280]
jmp 0x41ed15
lea edx, [ebp - 0x118]
push edx
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x260]
call fcn.0040bcd0
push eax
mov ecx, dword [ebp - 0x498]
add ecx, 0x58c
call fcn.00406570
movzx ecx, al
test ecx, ecx
je 0x41edc1
cmp dword [ebp - 0x118], 0
jne 0x41ee3f
push 0x4cc5fc
lea ecx, [ebp - 0x9c]
call fcn.00406130
mov byte [ebp - 4], 3
push 0x4cc608
lea ecx, [ebp - 0xb8]
call fcn.00406130
lea edx, [ebp - 0x9c]
push edx
lea eax, [ebp - 0xb8]
push eax
mov ecx, dword [ebp - 0x498]
call fcn.0041f260
lea ecx, [ebp - 0xb8]
call fcn.004062d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x9c]
call fcn.004062d0
mov dword [ebp - 0x490], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x260]
call fcn.004062d0
mov eax, dword [ebp - 0x490]
jmp 0x41ef8e
mov ecx, dword [ebp - 0x118]
and ecx, 0xffff
movzx edx, cx
mov dword [ebp - 0x118], edx
mov eax, dword [ebp - 0x498]
add eax, 0x590
push eax
lea ecx, [ebp - 0x240]
call fcn.004092b0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 0x118]
push edx
mov ecx, dword [ebp - 0x498]
add ecx, 0x51c
call fcn.00416e10
lea eax, [ebp - 0x47c]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x244]
push edx
push str.dlq:_d_game:_d__s
lea eax, [ebp - 0x36c]
push eax
call fcn.00411970
add esp, 0x14
lea ecx, [ebp - 0x36c]
push ecx
call dword [0x4bc290]
cmp dword [ebp - 0x370], 0
jne 0x41ef4b
lea edx, [ebp - 0x47c]
push edx
mov eax, dword [ebp - 0x118]
push eax
mov ecx, dword [ebp - 0x244]
push ecx
mov ecx, dword [ebp - 0x498]
call fcn.0041fcc0
movzx edx, al
test edx, edx
jne 0x41ef4b
push 0x4cc624
lea ecx, [ebp - 0xd4]
call fcn.00406130
mov byte [ebp - 4], 5
push 0x4cc644
lea ecx, [ebp - 0xf0]
call fcn.00406130
lea eax, [ebp - 0xd4]
push eax
lea ecx, [ebp - 0xf0]
push ecx
mov ecx, dword [ebp - 0x498]
call fcn.0041f260
lea ecx, [ebp - 0xf0]
call fcn.004062d0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xd4]
call fcn.004062d0
mov edx, dword [ebp - 0x118]
push edx
mov ecx, dword [ebp - 0x498]
call fcn.0041f290
mov dword [ebp - 0x494], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x240]
call fcn.004062d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x260]
call fcn.004062d0
mov eax, dword [ebp - 0x494]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049d75c
mov esp, ebp
pop ebp
ret 0xc