Function at 0x401000
Capabilities:
Contain obfuscated stackstrings
Parse pe header
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414410
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x468
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], 0x135b
mov byte [ebp - 0x7d], 1
movzx eax, byte [ebp - 0x7d]
cmp eax, 1
jne 0x401046
mov dword [ebp - 0x14], 0x3ab
mov byte [ebp - 0x7d], 0
jmp 0x401030
mov byte [ebp - 0x7e], 1
movzx ecx, byte [ebp - 0x7e]
cmp ecx, 1
jne 0x401060
mov dword [ebp - 0x14], 0x10b1
mov byte [ebp - 0x7e], 0
jmp 0x40104a
cmp dword [ebp - 0x14], 0x10b1
jne 0x401070
mov dword [ebp - 0x14], 0x2413
mov dword [ebp - 4], 0
wait
mov dword [ebp - 0x14], 0x211a
wait
jmp 0x401088
mov dword [ebp - 4], 0xffffffff
jmp 0x401098
mov dword [ebp - 4], 2
wait
mov dword [ebp - 0x14], 0xc24
wait
jmp 0x4010b0
mov dword [ebp - 4], 0xffffffff
jmp 0x4010c0
mov byte [ebp - 0x7f], 1
movzx edx, byte [ebp - 0x7f]
cmp edx, 1
jne 0x4010da
mov dword [ebp - 0x14], 0xcae
mov byte [ebp - 0x7f], 0
jmp 0x4010c4
mov byte [ebp - 0x80], 1
movzx eax, byte [ebp - 0x80]
cmp eax, 1
jne 0x4010f4
mov dword [ebp - 0x14], 0xd9b
mov byte [ebp - 0x80], 0
jmp 0x4010de
cmp dword [ebp - 0x14], 0x23a4
jne 0x401106
mov dword [ebp - 0x14], 0xf09
jmp 0x401116
cmp dword [ebp - 0x14], 0xd9b
jne 0x401116
mov dword [ebp - 0x14], 0x1320
cmp dword [ebp - 0x14], 0x1320
jne 0x401126
mov dword [ebp - 0x14], 0xd05
mov byte [ebp - 0x81], 1
movzx ecx, byte [ebp - 0x81]
cmp ecx, 1
jne 0x401149
mov dword [ebp - 0x14], 0x1be6
mov byte [ebp - 0x81], 0
jmp 0x40112d
cmp dword [ebp - 0x14], 0x1be6
jne 0x401159
mov dword [ebp - 0x14], 0x1bae
cmp dword [ebp - 0x14], 0x1ef1
jne 0x40116b
mov dword [ebp - 0x14], 0x26cc
jmp 0x40117b
cmp dword [ebp - 0x14], 0x1bae
jne 0x40117b
mov dword [ebp - 0x14], 0x1168
cmp dword [ebp - 0x14], 0x1168
jne 0x40118b
mov dword [ebp - 0x14], 0xd6a
cmp dword [ebp - 0x14], 0xd6a
jne 0x40119b
mov dword [ebp - 0x14], 0x1cce
cmp dword [ebp - 0x14], 0x1cce
jne 0x4011ab
mov dword [ebp - 0x14], 0x174d
mov byte [ebp - 0x82], 1
movzx edx, byte [ebp - 0x82]
cmp edx, 1
jne 0x4011ce
mov dword [ebp - 0x14], 0x23e0
mov byte [ebp - 0x82], 0
jmp 0x4011b2
mov dword [ebp - 4], 4
wait
mov dword [ebp - 0x14], 0x180d
wait
jmp 0x4011e6
mov dword [ebp - 4], 0xffffffff
jmp 0x4011f6
cmp dword [ebp - 0x14], 0x1761
jne 0x401208
mov dword [ebp - 0x14], 0x1568
jmp 0x401218
cmp dword [ebp - 0x14], 0x180d
jne 0x401218
mov dword [ebp - 0x14], 0xb7f
mov dword [ebp - 4], 6
wait
mov dword [ebp - 0x14], 0x2242
wait
jmp 0x401230
mov dword [ebp - 4], 0xffffffff
jmp 0x401240
mov dword [ebp - 4], 8
wait
mov dword [ebp - 0x14], 0xb78
wait
jmp 0x401258
mov dword [ebp - 4], 0xffffffff
jmp 0x401268
cmp dword [ebp - 0x14], 0xb78
jne 0x401278
mov dword [ebp - 0x14], 0x178a
mov dword [ebp - 4], 0xa
wait
mov dword [ebp - 0x14], 0x22a3
wait
jmp 0x401290
mov dword [ebp - 4], 0xffffffff
jmp 0x4012a0
mov byte [ebp - 0x83], 1
movzx eax, byte [ebp - 0x83]
cmp eax, 1
jne 0x4012c3
mov dword [ebp - 0x14], 0x1dd5
mov byte [ebp - 0x83], 0
jmp 0x4012a7
mov dword [ebp - 4], 0xc
wait
mov dword [ebp - 0x14], 0x9af
wait
jmp 0x4012db
mov dword [ebp - 4], 0xffffffff
jmp 0x4012eb
cmp dword [ebp - 0x14], 0x99a
jne 0x4012fd
mov dword [ebp - 0x14], 0x1eee
jmp 0x40130d
cmp dword [ebp - 0x14], 0x9af
jne 0x40130d
mov dword [ebp - 0x14], 0x2553
cmp dword [ebp - 0x14], 0x2553
jne 0x40131d
mov dword [ebp - 0x14], 0xba0
cmp dword [ebp - 0x14], 0x9db
jne 0x40132f
mov dword [ebp - 0x14], 0x3dc
jmp 0x40133f
cmp dword [ebp - 0x14], 0xba0
jne 0x40133f
mov dword [ebp - 0x14], 0x11bc
mov dword [ebp - 4], 0xe
wait
mov dword [ebp - 0x14], 0x103c
wait
jmp 0x401357
mov dword [ebp - 4], 0xffffffff
jmp 0x401367
mov dword [ebp - 4], 0x10
wait
mov dword [ebp - 0x14], 0x17cc
wait
jmp 0x40137f
mov dword [ebp - 4], 0xffffffff
jmp 0x40138f
mov dword [ebp - 4], 0x12
wait
mov dword [ebp - 0x14], 0x1d89
wait
jmp 0x4013a7
mov dword [ebp - 4], 0xffffffff
jmp 0x4013b7
mov dword [ebp - 4], 0x14
wait
mov dword [ebp - 0x14], 0xa67
wait
jmp 0x4013cf
mov dword [ebp - 4], 0xffffffff
jmp 0x4013df
mov dword [ebp - 4], 0x16
wait
mov dword [ebp - 0x14], 0x1fd3
wait
jmp 0x4013f7
mov dword [ebp - 4], 0xffffffff
jmp 0x401407
cmp dword [ebp - 0x14], 0x1c97
jne 0x401419
mov dword [ebp - 0x14], 0x211a
jmp 0x401429
cmp dword [ebp - 0x14], 0x1fd3
jne 0x401429
mov dword [ebp - 0x14], 0x5c0
cmp dword [ebp - 0x14], 0xe9
jne 0x40143b
mov dword [ebp - 0x14], 0x249c
jmp 0x40144b
cmp dword [ebp - 0x14], 0x5c0
jne 0x40144b
mov dword [ebp - 0x14], 0x19ea
cmp dword [ebp - 0x14], 0x19ea
jne 0x40145b
mov dword [ebp - 0x14], 0x17a9
mov byte [ebp - 0x9a], 1
movzx ecx, byte [ebp - 0x9a]
cmp ecx, 1
jne 0x40147e
mov dword [ebp - 0x14], 0x575
mov byte [ebp - 0x9a], 0
jmp 0x401462
cmp dword [ebp - 0x14], 0x196
jne 0x401490
mov dword [ebp - 0x14], 0x1649
jmp 0x4014a0
cmp dword [ebp - 0x14], 0x575
jne 0x4014a0
mov dword [ebp - 0x14], 0x1dd7
mov dword [ebp - 4], 0x18
wait
mov dword [ebp - 0x14], 0xa53
wait
jmp 0x4014b8
mov dword [ebp - 4], 0xffffffff
jmp 0x4014c8
cmp dword [ebp - 0x14], 0x12c8
jne 0x4014da
mov dword [ebp - 0x14], 0x22a0
jmp 0x4014ea
cmp dword [ebp - 0x14], 0xa53
jne 0x4014ea
mov dword [ebp - 0x14], 0x24cc
mov dword [ebp - 4], 0x1a
wait
mov dword [ebp - 0x14], 0xa64
wait
jmp 0x401502
mov dword [ebp - 4], 0xffffffff
jmp 0x401512
mov dword [ebp - 4], 0x1c
wait
mov dword [ebp - 0x14], 0x35f
wait
jmp 0x40152a
mov dword [ebp - 4], 0xffffffff
jmp 0x40153a
cmp dword [ebp - 0x14], 0x85b
jne 0x40154c
mov dword [ebp - 0x14], 0x1c75
jmp 0x40155c
cmp dword [ebp - 0x14], 0x35f
jne 0x40155c
mov dword [ebp - 0x14], 0x2609
cmp dword [ebp - 0x14], 0xf5e
jne 0x40156e
mov dword [ebp - 0x14], 0x1b60
jmp 0x40157e
cmp dword [ebp - 0x14], 0x2609
jne 0x40157e
mov dword [ebp - 0x14], 0x16b6
cmp dword [ebp - 0x14], 0xd37
jne 0x401590
mov dword [ebp - 0x14], 0x2217
jmp 0x4015a0
cmp dword [ebp - 0x14], 0x16b6
jne 0x4015a0
mov dword [ebp - 0x14], 0x1a6e
cmp dword [ebp - 0x14], 0x1a6e
jne 0x4015b0
mov dword [ebp - 0x14], 0x1935
mov dword [ebp - 4], 0x1e
wait
mov dword [ebp - 0x14], 0x185d
wait
jmp 0x4015c8
mov dword [ebp - 4], 0xffffffff
jmp 0x4015d8
cmp dword [ebp - 0x14], 0x1c01
jne 0x4015ea
mov dword [ebp - 0x14], 0x25b8
jmp 0x4015fa
cmp dword [ebp - 0x14], 0x185d
jne 0x4015fa
mov dword [ebp - 0x14], 0x1ee3
mov dword [ebp - 4], 0x20
wait
mov dword [ebp - 0x14], 0x26d9
wait
jmp 0x401612
mov dword [ebp - 4], 0xffffffff
jmp 0x401622
cmp dword [ebp - 0x14], 0x1326
jne 0x401634
mov dword [ebp - 0x14], 0x1d3c
jmp 0x401644
cmp dword [ebp - 0x14], 0x26d9
jne 0x401644
mov dword [ebp - 0x14], 0x1aa1
cmp dword [ebp - 0x14], 0x1aa1
jne 0x401654
mov dword [ebp - 0x14], 0x11bf
cmp dword [ebp - 0x14], 0x1430
jne 0x401666
mov dword [ebp - 0x14], 0x2188
jmp 0x401676
cmp dword [ebp - 0x14], 0x11bf
jne 0x401676
mov dword [ebp - 0x14], 0x207a
cmp dword [ebp - 0x14], 0x70e
jne 0x401688
mov dword [ebp - 0x14], 0x1f5a
jmp 0x401698
cmp dword [ebp - 0x14], 0x207a
jne 0x401698
mov dword [ebp - 0x14], 0xb5e
mov dword [ebp - 4], 0x22
wait
mov dword [ebp - 0x14], 0x1b4b
wait
jmp 0x4016b0
mov dword [ebp - 4], 0xffffffff
jmp 0x4016c0
mov byte [ebp - 0x84], 1
movzx edx, byte [ebp - 0x84]
cmp edx, 1
jne 0x4016e3
mov dword [ebp - 0x14], 0x26d1
mov byte [ebp - 0x84], 0
jmp 0x4016c7
cmp dword [ebp - 0x14], 0x144d
jne 0x4016f5
mov dword [ebp - 0x14], 0x1fff
jmp 0x401705
cmp dword [ebp - 0x14], 0x26d1
jne 0x401705
mov dword [ebp - 0x14], 0x23d0
cmp dword [ebp - 0x14], 0x1356
jne 0x401717
mov dword [ebp - 0x14], 0x15a9
jmp 0x401727
cmp dword [ebp - 0x14], 0x23d0
jne 0x401727
mov dword [ebp - 0x14], 0xc06
cmp dword [ebp - 0x14], 0xc06
jne 0x401737
mov dword [ebp - 0x14], 0x212f
cmp dword [ebp - 0x14], 0xb51
jne 0x401749
mov dword [ebp - 0x14], 0x253e
jmp 0x401759
cmp dword [ebp - 0x14], 0x212f
jne 0x401759
mov dword [ebp - 0x14], 0x18d4
cmp dword [ebp - 0x14], 0x61f
jne 0x40176b
mov dword [ebp - 0x14], 0x1d42
jmp 0x40177b
cmp dword [ebp - 0x14], 0x18d4
jne 0x40177b
mov dword [ebp - 0x14], 0x256b
mov byte [ebp - 0x85], 1
movzx eax, byte [ebp - 0x85]
cmp eax, 1
jne 0x40179e
mov dword [ebp - 0x14], 0x2267
mov byte [ebp - 0x85], 0
jmp 0x401782
mov byte [ebp - 0x86], 1
movzx ecx, byte [ebp - 0x86]
cmp ecx, 1
jne 0x4017c1
mov dword [ebp - 0x14], 0x2224
mov byte [ebp - 0x86], 0
jmp 0x4017a5
mov byte [ebp - 0x87], 1
movzx edx, byte [ebp - 0x87]
cmp edx, 1
jne 0x4017e4
mov dword [ebp - 0x14], 0x1250
mov byte [ebp - 0x87], 0
jmp 0x4017c8
mov dword [ebp - 4], 0x24
wait
mov dword [ebp - 0x14], 0x4ea
wait
jmp 0x4017fc
mov dword [ebp - 4], 0xffffffff
jmp 0x40180c
mov dword [ebp - 4], 0x26
wait
mov dword [ebp - 0x14], 0xa6f
wait
jmp 0x401824
mov dword [ebp - 4], 0xffffffff
jmp 0x401834
cmp dword [ebp - 0x14], 0xa6f
jne 0x401844
mov dword [ebp - 0x14], 0x233d
mov dword [ebp - 4], 0x28
wait
mov dword [ebp - 0x14], 0x1437
wait
jmp 0x40185c
mov dword [ebp - 4], 0xffffffff
jmp 0x40186c
mov dword [ebp - 4], 0x2a
wait
mov dword [ebp - 0x14], 0xc8d
wait
jmp 0x401884
mov dword [ebp - 4], 0xffffffff
jmp 0x401894
cmp dword [ebp - 0x14], 0xc8d
jne 0x4018a4
mov dword [ebp - 0x14], 0xa24
cmp dword [ebp - 0x14], 0x38c
jne 0x4018b6
mov dword [ebp - 0x14], 0x19f8
jmp 0x4018c6
cmp dword [ebp - 0x14], 0xa24
jne 0x4018c6
mov dword [ebp - 0x14], 0x1d2e
mov dword [ebp - 4], 0x2c
wait
mov dword [ebp - 0x14], 0x222a
wait
jmp 0x4018de
mov dword [ebp - 4], 0xffffffff
jmp 0x4018ee
cmp dword [ebp - 0x14], 0x222a
jne 0x4018fe
mov dword [ebp - 0x14], 0x1121
mov dword [ebp - 4], 0x2e
wait
mov dword [ebp - 0x14], 0x22b5
wait
jmp 0x401916
mov dword [ebp - 4], 0xffffffff
jmp 0x401926
mov dword [ebp - 4], 0x30
wait
mov dword [ebp - 0x14], 0x1a67
wait
jmp 0x40193e
mov dword [ebp - 4], 0xffffffff
jmp 0x40194e
mov dword [ebp - 4], 0x32
wait
mov dword [ebp - 0x14], 0x264f
wait
jmp 0x401966
mov dword [ebp - 4], 0xffffffff
jmp 0x401976
mov byte [ebp - 0x88], 1
movzx eax, byte [ebp - 0x88]
cmp eax, 1
jne 0x401999
mov dword [ebp - 0x14], 0x1897
mov byte [ebp - 0x88], 0
jmp 0x40197d
mov dword [ebp - 4], 0x34
wait
mov dword [ebp - 0x14], 0x5fc
wait
jmp 0x4019b1
mov dword [ebp - 4], 0xffffffff
jmp 0x4019c1
mov dword [ebp - 4], 0x36
wait
mov dword [ebp - 0x14], 0xf13
wait
jmp 0x4019d9
mov dword [ebp - 4], 0xffffffff
jmp 0x4019e9
mov byte [ebp - 0x89], 1
movzx ecx, byte [ebp - 0x89]
cmp ecx, 1
jne 0x401a0c
mov dword [ebp - 0x14], 0x1a8a
mov byte [ebp - 0x89], 0
jmp 0x4019f0
cmp dword [ebp - 0x14], 0xaf9
jne 0x401a1e
mov dword [ebp - 0x14], 0x1dc5
jmp 0x401a2e
cmp dword [ebp - 0x14], 0x1a8a
jne 0x401a2e