Function at 0x41a900
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x57254c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], esi
push edi
test esi, esi
je 0x41aca7
call fcn.00405960
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov eax, dword [edi + 4]
test eax, eax
je 0x41a956
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0x52727453
push ecx
push eax
mov dword [ebp - 0xc], 0x49726843
mov word [ebp - 8], 0x41
call ebx
mov dword [edi + 0x28], eax
mov eax, dword [edi + 0x28]
push 0x5f
push 0
push esi
call eax
mov edi, eax
mov dword [ebp - 0x2c], 0x463525
call fcn.00405960
mov dword [ebp - 0x40], eax
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41a99b
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x52727453
push eax
push ecx
mov dword [ebp - 0xc], 0x49727453
mov word [ebp - 8], 0x41
call ebx
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x24], eax
mov eax, ecx
mov eax, dword [eax + 0x24]
lea ecx, [ebp - 0x2c]
push ecx
push 0
push esi
call eax
test edi, edi
je 0x41a9b6
test eax, eax
je 0x41a9b8
cmp edi, eax
cmovb edi, eax
jmp 0x41a9b8
mov edi, eax
call fcn.00405960
mov dword [ebp - 0x40], eax
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41a9ea
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x52727453
push eax
push ecx
mov dword [ebp - 0xc], 0x49726843
mov word [ebp - 8], 0x41
call ebx
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x28], eax
mov eax, ecx
mov eax, dword [eax + 0x28]
push 0x76
push 0
push esi
call eax
mov esi, eax
mov dword [ebp - 0x30], 0x363725
call fcn.00405960
mov dword [ebp - 0x40], eax
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41aa2f
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x52727453
push eax
push ecx
mov dword [ebp - 0xc], 0x49727453
mov word [ebp - 8], 0x41
call ebx
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x24], eax
mov eax, ecx
mov eax, dword [eax + 0x24]
lea ecx, [ebp - 0x30]
push ecx
push 0
push dword [ebp - 0x44]
call eax
test esi, esi
je 0x41aa4c
test eax, eax
je 0x41aa4e
cmp esi, eax
cmovb esi, eax
jmp 0x41aa4e
mov esi, eax
test edi, edi
je 0x41ac81
test esi, esi
je 0x41aa62
cmp edi, esi
jb 0x41ac85
call fcn.00405960
mov esi, eax
mov eax, dword [esi + 4]
test eax, eax
je 0x41aa8e
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0x52727453
push ecx
push eax
mov dword [ebp - 0xc], 0x49726843
mov word [ebp - 8], 0x41
call ebx
mov dword [esi + 0x28], eax
mov edi, dword [ebp - 0x44]
mov eax, dword [esi + 0x28]
push 0x5f
push 0
push edi
call eax
mov ebx, eax
mov dword [ebp - 0x34], 0x463525
call fcn.00405960
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x40], eax
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41aadc
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x52727453
push eax
push ecx
mov dword [ebp - 0x24], 0x49727453
mov word [ebp - 0x20], 0x41
call esi
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x24], eax
mov eax, ecx
mov eax, dword [eax + 0x24]
lea ecx, [ebp - 0x34]
push ecx
push 0
push edi
call eax
test ebx, ebx
je 0x41aaf7
test eax, eax
je 0x41ab01
cmp ebx, eax
cmovb ebx, eax
jmp 0x41ab01
test eax, eax
je 0x41aca7
mov ebx, eax
call fcn.00405960
mov dword [ebp - 0x40], eax
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41ab33
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x52727453
push eax
push ecx
mov dword [ebp - 0x18], 0x49726843
mov word [ebp - 0x14], 0x41
call esi
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x28], eax
mov eax, ecx
mov eax, dword [eax + 0x28]
push 0x5f
push ebx
push edi
call eax
mov edi, eax
mov dword [ebp - 0x38], 0x463525
call fcn.00405960
mov dword [ebp - 0x40], eax
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41ab77
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x52727453
push eax
push ecx
mov dword [ebp - 0x18], 0x49727453
mov word [ebp - 0x14], 0x41
call esi
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x24], eax
mov eax, ecx
mov eax, dword [eax + 0x24]
lea ecx, [ebp - 0x38]
push ecx
push ebx
push dword [ebp - 0x44]
call eax
test edi, edi
je 0x41ab93
test eax, eax
je 0x41ab95
cmp edi, eax
cmovb edi, eax
jmp 0x41ab95
mov edi, eax
call fcn.00405960
mov dword [ebp - 0x40], eax
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41abc7
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x52727453
push eax
push ecx
mov dword [ebp - 0x18], 0x49726843
mov word [ebp - 0x14], 0x41
call esi
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x28], eax
mov eax, ecx
mov eax, dword [eax + 0x28]
push 0x40
push ebx
push dword [ebp - 0x44]
call eax
mov esi, eax
mov dword [ebp - 0x3c], 0x303425
call fcn.00405960
mov dword [ebp - 0x40], eax
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41ac11
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x52727453
push eax
push ecx
mov dword [ebp - 0x18], 0x49727453
mov word [ebp - 0x14], 0x41
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x24], eax
mov eax, ecx
mov eax, dword [eax + 0x24]
lea ecx, [ebp - 0x3c]
push ecx
push ebx
push dword [ebp - 0x44]
call eax
test esi, esi
je 0x41ac2d
test eax, eax
je 0x41ac2f
cmp esi, eax
cmovb esi, eax
jmp 0x41ac2f
mov esi, eax
test edi, edi
je 0x41ac68
test esi, esi
je 0x41ac51
cmp edi, esi
cmovae esi, edi
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f8955
mov esp, ebp
pop ebp
ret 4
mov esi, edi
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f8955
mov esp, ebp
pop ebp
ret 4
test esi, esi
je 0x41aca7
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f8955
mov esp, ebp
pop ebp
ret 4
test esi, esi
je 0x41aca7
mov eax, dword [ebp - 0x48]
mov dword [eax + 0x8c], 1
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f8955
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f8955
mov esp, ebp
pop ebp
ret 4