Function at 0x403446
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x428
mov rbx, rcx
mov r9d, 2
mov r8d, 1
mov edx, 3
mov ecx, 0
call fcn.00403394
mov word [rsp + 0x416], 0x1d
mov word [rsp + 0x418], 0x50
mov word [rsp + 0x41a], 0x54
mov word [rsp + 0x41c], 0x42
mov word [rsp + 0x41e], 0x37
lea r8, [rsp + 0x416]
mov ecx, 0
mov r9d, 0x4bda12f7
mov eax, ecx
imul r9d
sar edx, 4
mov eax, ecx
sar eax, 0x1f
sub edx, eax
imul edx, edx, 0x36
mov eax, ecx
sub eax, edx
add eax, 0x33
xor word [r8], ax
add ecx, 1
add r8, 2
cmp ecx, 5
jne 0x4034bc
lea rdx, [rsp + 0x416]
mov r8d, 1
mov rcx, rbx
call fcn.00402b46
test eax, eax
je 0x403f78
mov rcx, rbx
call sub.msvcrt.dll_wcslen
test rax, rax
je 0x403f94
lea rdi, [rsp + 0x230]
lea rcx, [rsp + 0x308]
call fcn.004a4190
mov rax, qword [0x005baf50]
add rax, 0x10
mov qword [rsp + 0x308], rax
mov qword [rsp + 0x3e0], 0
mov byte [rsp + 0x3e8], 0
mov byte [rsp + 0x3e9], 0
mov qword [rsp + 0x3f0], 0
mov qword [rsp + 0x3f8], 0
mov qword [rsp + 0x400], 0
mov qword [rsp + 0x408], 0
mov rax, qword [0x005baab0]
mov rsi, qword [rax + 0x10]
mov qword [rsp + 0x230], rsi
mov r12, qword [rax + 0x18]
mov rax, qword [rsi - 0x18]
mov qword [rsp + rax + 0x230], r12
mov qword [rsp + 0x238], 0
mov rax, qword [rsp + 0x230]
add rdi, qword [rax - 0x18]
mov rcx, rdi
mov edx, 0
call fcn.004a5130
mov rax, qword [0x005baab0]
mov rdi, qword [rax + 0x20]
mov qword [rsp + 0x240], rdi
mov r13, qword [rax + 0x28]
mov rax, qword [rdi - 0x18]
mov qword [rsp + rax + 0x240], r13
mov rax, qword [rsp + 0x240]
mov rax, qword [rax - 0x18]
lea rcx, [rsp + rax + 0x240]
mov edx, 0
call fcn.004a5130
mov rax, qword [0x005baab0]
mov rbp, qword [rax + 8]
mov qword [rsp + 0x230], rbp
mov r14, qword [rax + 0x30]
mov rax, qword [rbp - 0x18]
mov qword [rsp + rax + 0x230], r14
mov rax, qword [0x005bacb0]
lea rdx, [rax + 0x18]
mov qword [rsp + 0x230], rdx
lea rdx, [rax + 0x68]
mov qword [rsp + 0x308], rdx
add rax, 0x40
mov qword [rsp + 0x240], rax
lea rcx, [rsp + 0x248]
call fcn.0047e600
jmp 0x4036b9
lea rdx, [rsp + 0x248]
lea rcx, [rsp + 0x308]
call fcn.004a5130
lea rcx, [rsp + 0x248]
mov r8d, 0xe
mov rdx, rbx
call fcn.0047ce90
test rax, rax
je 0x40370c
mov rax, qword [rsp + 0x230]
mov rax, qword [rax - 0x18]
lea rcx, [rsp + rax + 0x230]
mov edx, 0
call fcn.004a5300
jmp 0x403797
mov rax, qword [rsp + 0x230]
mov rax, qword [rax - 0x18]
lea rcx, [rsp + rax + 0x230]
mov edx, dword [rcx + 0x20]
or edx, 4
call fcn.004a5300
jmp 0x403797
lea rcx, [rsp + 0x290]
call fcn.0042d780
test al, al
je 0x403e92
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x230]
call fcn.0046e230
mov r15, qword [rsp + 0xa0]
lea rcx, [rsp + 0x230]
mov r8d, 0
mov edx, 0
call fcn.0046e120
cmp r15d, 0x1040
jbe 0x403825
mov r15d, r15d
mov rcx, r15
call fcn.004acb70
mov rbx, rax
mov rdx, r15
sub rdx, 1
js 0x403810
add rdx, rax
mov byte [rax], 0
add rax, 1
cmp rdx, rax
jns 0x403804
lea rcx, [rsp + 0x230]
mov r8, r15
mov rdx, rbx
call fcn.0046dd70
jmp 0x40382a
mov ebx, 0
lea rcx, [rsp + 0x248]
call fcn.0047d140
test rax, rax
je 0x403851
test rbx, rbx
je 0x403e97
mov ecx, 0x104
call fcn.004acb70
jmp 0x403872
mov rax, qword [rsp + 0x230]
mov rax, qword [rax - 0x18]
lea rcx, [rsp + rax + 0x230]
mov edx, dword [rcx + 0x20]
or edx, 4
call fcn.004a5300
jmp 0x40383c
mov qword [rsp + 0x88], rax
lea r15, [rsp + 0x170]
mov r8d, 0x81
lea rdx, [0x005b52e0]
mov rcx, r15
call sub.msvcrt.dll_memcpy
mov ecx, 0
mov r8d, 0x4bda12f7
mov eax, ecx
imul r8d
sar edx, 4
mov eax, ecx
sar eax, 0x1f
sub edx, eax
imul edx, edx, 0x36
mov eax, ecx
sub eax, edx
add eax, 0x33
xor byte [r15], al
add ecx, 1
add r15, 1
cmp ecx, 0x81
jne 0x4038a2
lea r8, [rsp + 0x170]
mov edx, 0x104
mov rcx, qword [rsp + 0x88]
call qword [0x005b1c70]
mov ecx, 0x18
call fcn.004acb70
mov r15, rax
mov dword [rax], 0x1f
mov dword [rax + 4], 3
mov dword [rax + 8], 0
mov dword [rax + 0xc], 0x13
mov dword [rax + 0x10], 0x37
mov dword [rax + 0x14], 0x36a
lea rax, [rsp + 0x170]
mov r8d, 0x81
lea rdx, [0x005b5240]
mov qword [rsp + 0x90], rax
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov r8, qword [rsp + 0x90]
mov ecx, 0
mov r9d, 0x4bda12f7
mov eax, ecx
imul r9d
sar edx, 4
mov eax, ecx
sar eax, 0x1f
sub edx, eax
imul edx, edx, 0x36
mov eax, ecx
sub eax, edx
add eax, 0x33
xor byte [r8], al
add ecx, 1
add r8, 1
cmp ecx, 0x81
jne 0x403956
lea r8, [rsp + 0x170]
mov edx, 0x104
mov rcx, qword [rsp + 0x88]
call qword [0x005b1c70]
movsxd rax, dword [r15 + 4]
mov rcx, qword [rsp + 0x88]
lea rax, [rcx + rax + 0x1f]
mov qword [rsp + 0x90], rax
mov rcx, r15
call fcn.004acb40
mov byte [rsp + 0x170], 0x70
mov byte [rsp + 0x171], 0xe
mov byte [rsp + 0x172], 0x69
mov byte [rsp + 0x173], 0x66
mov byte [rsp + 0x174], 0x45
mov byte [rsp + 0x175], 0x57
mov byte [rsp + 0x176], 0x5e
mov byte [rsp + 0x177], 0x48
mov byte [rsp + 0x178], 0x5a
mov byte [rsp + 0x179], 0x51
mov byte [rsp + 0x17a], 0x79
mov byte [rsp + 0x17b], 0x5f
mov byte [rsp + 0x17c], 0x4b
mov byte [rsp + 0x17d], 0x21
mov byte [rsp + 0x17e], 0x1d
mov byte [rsp + 0x17f], 0x12
mov byte [rsp + 0x180], 0x22
mov byte [rsp + 0x181], 0x27
mov byte [rsp + 0x182], 0x2e
mov byte [rsp + 0x183], 0x27
mov byte [rsp + 0x184], 0x20
mov byte [rsp + 0x185], 0x2d
mov byte [rsp + 0x186], 0x3a
mov byte [rsp + 0x187], 0x16
mov byte [rsp + 0x188], 6
mov byte [rsp + 0x189], 0x25
mov byte [rsp + 0x18a], 0x2e
mov byte [rsp + 0x18b], 0x3c
mov byte [rsp + 0x18c], 0x20
mov byte [rsp + 0x18d], 0x23
mov byte [rsp + 0x18e], 0x3e
mov byte [rsp + 0x18f], 0x34
mov byte [rsp + 0x190], 0x27
mov byte [rsp + 0x191], 0x7a
mov byte [rsp + 0x192], 2
mov byte [rsp + 0x193], 0x3f
mov byte [rsp + 0x194], 0x39
mov byte [rsp + 0x195], 0x3c
mov byte [rsp + 0x196], 0x36
mov byte [rsp + 0x197], 0x2d
mov byte [rsp + 0x198], 0x28
mov byte [rsp + 0x199], 0xf
mov byte [rsp + 0x19a], 0x29
mov byte [rsp + 0x19b], 0x31
mov byte [rsp + 0x19c], 0x2d
mov byte [rsp + 0x19d], 5
mov byte [rsp + 0x19e], 0x3e
mov byte [rsp + 0x19f], 0x5a
mov byte [rsp + 0x1a0], 0x14
mov byte [rsp + 0x1a1], 1
mov byte [rsp + 0x1a2], 0xe
mov byte [rsp + 0x1a3], 0x1f
mov byte [rsp + 0x1a4], 5
mov byte [rsp + 0x1a5], 0x5b
mov byte [rsp + 0x1a6], 0x57
mov byte [rsp + 0x1a7], 0xc
mov byte [rsp + 0x1a8], 0x57
mov byte [rsp + 0x1a9], 0x54
mov byte [rsp + 0x1aa], 0x40
mov byte [rsp + 0x1ab], 0x5d
mov byte [rsp + 0x1ac], 0x39
lea r8, [rsp + 0x170]
mov ecx, 0
mov r9d, 0x4bda12f7
mov eax, ecx
imul r9d
sar edx, 4
mov eax, ecx
sar eax, 0x1f
sub edx, eax
imul edx, edx, 0x36
mov eax, ecx
sub eax, edx
add eax, 0x33
xor byte [r8], al
add ecx, 1
add r8, 1
cmp ecx, 0x3d
jne 0x403bb8
lea r8, [rsp + 0x170]
mov edx, 0x104
mov rcx, qword [rsp + 0x88]
call qword [0x005b1c70]
lea rax, [rbx + 0x10]
mov qword [rsp + 0x98], rax
mov ecx, 0x40
call fcn.0040ad29
mov eax, eax
lea r15, [rbx + rax + 0x10]
lea rcx, [rsp + 0xb0]
mov r8, rbx
mov rdx, qword [rsp + 0x90]
call fcn.0040ad3f
mov ecx, 0x40
call fcn.0040ad29
mov r8d, eax
lea rcx, [rsp + 0xb0]
mov rdx, qword [rsp + 0x98]
call fcn.0040ae20
lea rdx, [rbx + 0x20]
lea rcx, [rsp + 0x170]
lea r8, [rbx + 0x30]
call fcn.0040ad3f
lea rcx, [rsp + 0x170]
mov r8d, dword [rbx + 0x1c]
mov rdx, r15
call fcn.0040ae20
mov eax, dword [rbx + 0x10]
mov dword [rsp + 0x90], eax
lea rax, [rsp + 0x170]
mov r8d, 0x81
lea rdx, [0x005b51a0]
mov qword [rsp + 0x98], rax
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov r8, qword [rsp + 0x98]
mov ecx, 0
mov r9d, 0x4bda12f7
mov eax, ecx
imul r9d
sar edx, 4
mov eax, ecx
sar eax, 0x1f
sub edx, eax
imul edx, edx, 0x36
mov eax, ecx
sub eax, edx
add eax, 0x33
xor byte [r8], al
add ecx, 1
add r8, 1
cmp ecx, 0x81
jne 0x403cbd
lea r8, [rsp + 0x170]
mov edx, 0x104
mov rcx, qword [rsp + 0x88]
call qword [0x005b1c70]
test r15, r15
je 0x403e72
cmp dword [rsp + 0x90], 0
je 0x403e72
mov rcx, qword [0x005e10f8]
test rcx, rcx
je 0x403d3e
mov rax, qword [0x005bb190]
call qword [rax + 0xc0]
mov qword [0x005e10f8], 0
mov eax, dword [rsp + 0x90]
mov qword [rsp + 0x90], rax
mov rax, qword [0x005bb190]
call qword [rax + 0xc8]
mov qword [rsp + 0x98], rax
mov rax, qword [0x005bb190]
call qword [rax + 0xd0]
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x68], 0x1770
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0x1770
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x90]
mov r8, r15
mov rdx, qword [rsp + 0x98]
mov ecx, eax
call fcn.00401ba0
cmp al, 1
sbb r15, r15
not r15
and r15d, 0x12345678
lea rax, [rsp + 0x170]
mov r8d, 0x81
lea rdx, [0x005b5100]
mov qword [rsp + 0x90], rax
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov r8, qword [rsp + 0x90]
mov ecx, 0
mov r9d, 0x4bda12f7
mov eax, ecx
imul r9d
sar edx, 4
mov eax, ecx
sar eax, 0x1f
sub edx, eax
imul edx, edx, 0x36
mov eax, ecx
sub eax, edx
add eax, 0x33
xor byte [r8], al
add ecx, 1
add r8, 1
cmp ecx, 0x81
jne 0x403e2a
lea r8, [rsp + 0x170]
mov edx, 0x104
mov rcx, qword [rsp + 0x88]
call qword [0x005b1c70]
jmp 0x403e78
mov r15d, 0
mov rcx, qword [rsp + 0x88]
call fcn.004acb40
mov rcx, rbx
call fcn.004acb40
mov rbx, r15
jmp 0x403e97
mov ebx, 0
mov rax, qword [0x005bacb0]
lea rdx, [rax + 0x18]
mov qword [rsp + 0x230], rdx
lea rdx, [rax + 0x68]
mov qword [rsp + 0x308], rdx
add rax, 0x40
mov qword [rsp + 0x240], rax
mov rax, qword [0x005bac90]
add rax, 0x10
mov qword [rsp + 0x248], rax
lea r15, [rsp + 0x230]
lea rcx, [rsp + 0x248]
call fcn.0047d140
lea rcx, [r15 + 0x60]
call fcn.00477500
mov rax, qword [0x005bad20]
add rax, 0x10
mov qword [rsp + 0x248], rax
lea rcx, [r15 + 0x50]
call fcn.00498330
mov qword [rsp + 0x230], rbp
mov rax, qword [rbp - 0x18]
mov qword [rsp + rax + 0x230], r14
mov qword [rsp + 0x240], rdi
mov rax, qword [rdi - 0x18]
mov qword [rsp + rax + 0x240], r13
mov qword [rsp + 0x230], rsi
mov rax, qword [rsi - 0x18]
mov qword [rsp + rax + 0x230], r12
mov qword [rsp + 0x238], 0
mov rax, qword [0x005baf50]
add rax, 0x10
mov qword [rsp + 0x308], rax
lea rcx, [r15 + 0xd8]
call fcn.004a4240
jmp 0x403f7d
mov ebx, 0
mov rax, rbx
add rsp, 0x428
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ebx, 0
jmp 0x403f7d