Function at 0x4026d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x512b90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd8
push ebx
push esi
push edi
mov dword [ebp - 0xe0], ecx
lea ecx, [ebp - 0x20]
push 0x545d74
call fcn.0041fa80
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
call fcn.00520f30
push ecx
lea eax, [ebp - 0x8c]
mov word [ebp - 0x88], 0x3542
mov ecx, esp
mov dword [ebp - 0x76], 0x302d4444
push eax
mov dword [ebp - 0x85], 0x462d3238
mov dword [ebp - 0x72], 0x31443037
mov dword [ebp - 0x81], 0x2d314344
mov dword [ebp - 0x7d], 0x33434434
mov dword [ebp - 0x69], 0x7d3739
mov dword [ebp - 0x6d], 0x44353934
mov dword [ebp - 0x8c], 0x4132367b
mov byte [ebp - 0x86], 0x44
mov word [ebp - 0x79], 0x412d
mov byte [ebp - 0x6e], 0x44
mov byte [ebp - 0x77], 0x39
call fcn.0041fa80
lea ecx, [ebp - 0x30]
call fcn.00401c60
mov byte [ebp - 4], 1
lea eax, [ebp - 0xb4]
mov ecx, esp
mov dword [ebp - 0x9b], 0x32463043
push eax
mov dword [ebp - 0xb0], 0x45303441
mov dword [ebp - 0x95], 0x41463942
mov dword [ebp - 0x91], 0x7d4538
mov word [ebp - 0xab], 0x412d
mov word [ebp - 0xa0], 0x3738
mov word [ebp - 0xa8], 0x4246
mov word [ebp - 0xa5], 0x4234
mov word [ebp - 0x9d], 0x2d41
mov word [ebp - 0xa2], 0x2d43
mov byte [ebp - 0x9e], 0x34
mov word [ebp - 0x97], 0x3045
mov byte [ebp - 0xac], 0x46
mov byte [ebp - 0xa3], 0x46
mov dword [ebp - 0xb4], 0x3543377b
mov byte [ebp - 0xa6], 0x2d
mov byte [ebp - 0xa9], 0x30
call fcn.0041fa80
lea ecx, [ebp - 0x1c]
call fcn.00401c60
mov byte [ebp - 4], 2
lea eax, [ebp - 0xdc]
mov ecx, esp
mov dword [ebp - 0xdb], 0x30384436
push eax
mov word [ebp - 0xd3], 0x362d
mov word [ebp - 0xbe], 0x3046
mov dword [ebp - 0xcb], 0x382d6234
mov word [ebp - 0xd6], 0x3733
mov dword [ebp - 0xc4], 0x3733412d
mov dword [ebp - 0xb9], 0x7d4530
mov word [ebp - 0xbb], 0x3032
mov byte [ebp - 0xd7], 0x39
mov word [ebp - 0xcd], 0x3434
mov word [ebp - 0xc7], 0x3539
mov word [ebp - 0xc0], 0x3337
mov byte [ebp - 0xc5], 0x37
mov word [ebp - 0xd0], 0x3046
mov byte [ebp - 0xd4], 0x37
mov byte [ebp - 0xdc], 0x7b
mov byte [ebp - 0xbc], 0x32
mov byte [ebp - 0xd1], 0x41
mov byte [ebp - 0xce], 0x2d
call fcn.0041fa80
lea ecx, [ebp - 0x10]
call fcn.00401c60
add esp, 4
mov byte [ebp - 4], 3
or edi, 0xffffffff
mov ecx, dword [ebp - 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ecx - 0xc], 0
jne 0x4029e8
mov eax, dword [ebp - 0x1c]
lea ebx, [ecx - 0x10]
lea esi, [eax - 0x10]
cmp esi, ebx
je 0x40294c
cmp dword [ebx + 0xc], 0
jl 0x402940
mov edx, dword [esi]
cmp edx, dword [ebx]
jne 0x402940
mov ecx, esi
call fcn.0041fb60
mov ecx, ebx
mov esi, eax
call fcn.00420560
lea eax, [esi + 0x10]
mov dword [ebp - 0x10], eax
jmp 0x40294c
push dword [eax - 0xc]
lea ecx, [ebp - 0x10]
push eax
call fcn.0041f900
lea eax, [ebp - 0x3c]
mov word [ebp - 0x38], 0x2936
push eax
lea ecx, [ebp - 0x24]
mov word [ebp - 0x3b], 0x7828
mov byte [ebp - 0x3c], 0x20
mov byte [ebp - 0x36], 0
mov byte [ebp - 0x39], 0x38
call fcn.0041fa80
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4029aa
mov ecx, dword [ebp - 0x10]
cmp dword [ecx - 0xc], 0
jl 0x4029aa
push eax
push ecx
call fcn.00469139
add esp, 8
test eax, eax
je 0x4029a7
sub eax, dword [ebp - 0x10]
js 0x4029a7
push 0x545d74
push dword [ebp - 0x24]
lea ecx, [ebp - 0x10]
call fcn.00411d50
mov eax, dword [ebp - 0x24]
lea ecx, [eax - 0x10]
mov byte [ebp - 4], 3
mov eax, edi
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4029e2
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4029de
mov eax, dword [edx + 4]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [eax + 4]
call ebx
jmp 0x4029e8
mov ecx, edx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x5d], 0x6f726843
mov word [ebp - 0x4f], 0x6974
mov word [ebp - 0x4c], 0x5c6e
mov dword [ebp - 0x58], 0x70415c65
mov dword [ebp - 0x44], 0x6578652e
mov dword [ebp - 0x61], 0x5c656c67
mov dword [ebp - 0x49], 0x6d6f7268
mov dword [ebp - 0x53], 0x6163696c
mov byte [ebp - 0x40], 0
mov byte [ebp - 0x45], 0x65
mov word [ebp - 0x64], 0x6f47
mov byte [ebp - 0x59], 0x6d
mov byte [ebp - 0x4a], 0x63
mov byte [ebp - 0x54], 0x70
mov byte [ebp - 0x62], 0x6f
mov byte [ebp - 0x4d], 0x6f
call fcn.00420480
mov ecx, eax
test ecx, ecx
jne 0x402a55
push 0x80004005
call fcn.00420020
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x402a6a
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x402a6c
call edx
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], 0x255c7325
mov word [ebp - 0x28], 0x73
cmp dword [eax - 4], 1
jle 0x402a9a
push dword [eax - 0xc]
lea ecx, [ebp - 0x1c]
call fcn.0041fc50
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x64]
push ecx
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00419930
mov eax, dword [ebp - 0x1c]
push dword [eax - 8]
push eax
call fcn.00469a19
add esp, 0x18
test eax, eax
js 0x402bf6
mov ecx, dword [ebp - 0x1c]
cmp eax, dword [ecx - 8]
jg 0x402bf6
mov esi, dword [ebp - 0x18]
mov dword [ecx - 0xc], eax
mov ecx, dword [ebp - 0x1c]
mov byte [eax + ecx], 0
mov ecx, esi
call fcn.0052a710
test eax, eax
jne 0x402c00
mov eax, dword [ebp - 0x10]
cmp dword [eax - 4], 1
jle 0x402b02
push dword [eax - 0xc]
lea ecx, [ebp - 0x10]
call fcn.0041fc50
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x64]
push ecx
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00419930
mov eax, dword [ebp - 0x10]
push dword [eax - 8]
push eax
call fcn.00469a19
add esp, 0x18
test eax, eax
js 0x402bf6
mov ecx, dword [ebp - 0x10]
cmp eax, dword [ecx - 8]
jg 0x402bf6
mov esi, dword [ebp - 0x18]
mov dword [ecx - 0xc], eax
mov ecx, dword [ebp - 0x10]
mov byte [eax + ecx], 0
mov ecx, esi
call fcn.0052a710
test eax, eax
jne 0x402c00
mov eax, dword [ebp - 0x20]
cmp dword [eax - 4], 1
jle 0x402b6a
push dword [eax - 0xc]
lea ecx, [ebp - 0x20]
call fcn.0041fc50
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x64]
push ecx
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00419930
mov eax, dword [ebp - 0x20]
push dword [eax - 8]
push eax
call fcn.00469a19
add esp, 0x18
test eax, eax
js 0x402bf6
mov ecx, dword [ebp - 0x20]
cmp eax, dword [ecx - 8]
jg 0x402bf6
mov esi, dword [ebp - 0x18]
mov dword [ecx - 0xc], eax
mov ecx, dword [ebp - 0x20]
mov byte [eax + ecx], 0
mov ecx, esi
call fcn.0052a710
test eax, eax
jne 0x402c00
mov eax, dword [ebp - 0x30]
cmp dword [eax - 4], 1
jle 0x402bc6
push dword [eax - 0xc]
lea ecx, [ebp - 0x30]
call fcn.0041fc50
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x64]
push ecx
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00419930
add esp, 0xc
lea ecx, [ebp - 0x30]
call fcn.004120f0
mov esi, dword [ebp - 0x18]
mov ecx, esi
call fcn.0052a710
test eax, eax
jne 0x402c00
mov byte [ebp - 0x11], al
jmp 0x402c21
push 0x80070057
call fcn.00420020
push esi
lea eax, [ebp - 0x34]
mov word [ebp - 0x33], 0x73
push eax
push dword [ebp - 0xe0]
mov byte [ebp - 0x34], 0x25
call fcn.00419930
add esp, 0xc
mov byte [ebp - 0x11], 1
mov byte [ebp - 4], 3
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x402c51
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x402c4f
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call ebx
jmp 0x402c51
call edx
mov byte [ebp - 4], 2
mov eax, edi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x402c86
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x402c82
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call ebx
jmp 0x402c86
mov ecx, edx
call esi
mov byte [ebp - 4], 1
mov eax, edi
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x402cbb
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x402cb7
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call ebx
jmp 0x402cbb
mov ecx, edx
call esi
mov byte [ebp - 4], 0
mov eax, edi
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x402cf0
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x402cec
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call ebx
jmp 0x402cf0
mov ecx, edx
call esi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], edi
dec edi
test edi, edi
jg 0x402d38
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x402d34
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call ebx
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edx
call esi
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0x11]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret