Function at 0x4018c0
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x90
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov cl, byte [esp + 0x89]
mov dl, 0x78
mov dword [esp + 0x3c], eax
mov al, cl
mul dl
mov byte [esp + 0x89], al
mov dword [esp + 0x84], 0
mov dword [esp + 0x80], 0x1631a389
mov dword [esp + 0x70], 0xec75e55
mov word [esp + 0x8a], 0x6262
mov esi, dword [esp + 0x3c]
mov al, byte [esi]
mov di, word [esp + 0x8a]
movzx ebx, al
mov ax, di
xor ax, 0xd50d
mov word [esp + 0x8a], ax
mov edx, dword [esp + 0x70]
mov byte [esp + 0x89], cl
xor edx, 0xec75eed
cmp ebx, edx
mov byte [esp + 0x3b], cl
mov word [esp + 0x38], di
mov dword [esp + 0x34], ebx
je 0x401abc
jmp 0x401a7a
mov eax, dword [esp + 0x70]
add eax, 0xf138a7c9
mov dword [esp + 0x50], eax
mov eax, esp
mov dword [eax], 0
mov eax, dword [sym.imp.USER32.dll_TranslateMessage]
call eax
sub esp, 4
mov ecx, dword [esp + 0x34]
add ecx, 0x7a93794a
mov dword [esp + 0x74], ecx
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 8], 0
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov ecx, dword [sym.imp.ADVAPI32.dll_RegLoadAppKeyW]
mov dword [esp + 0x30], eax
call ecx
sub esp, 0x14
mov ecx, dword [esp + 0x64]
inc ecx
mov dword [esp + 0x64], ecx
mov dword [esp + 0x2c], eax
jmp 0x401ac9
lea eax, [esp + 0x54]
mov dword [esp + 0x54], 0x5f73655f
mov dword [esp + 0x58], 0x5f70705f
mov dword [esp + 0x5c], 0x5f5f5f
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x7c]
mov esi, 0x2bc86b34
mov dword [esp + 0x28], eax
mov eax, ecx
mov dword [esp + 0x24], edx
mul esi
mov ecx, dword [esp + 0x24]
imul ecx, ecx, 0x2bc86b34
add edx, ecx
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], edx
mov byte [esp + 0x54], 0x74
mov byte [esp + 0x57], 0x74
mov byte [esp + 0x58], 0x61
mov byte [esp + 0x5b], 0x2e
mov dword [esp + 0x78], 0x809a04
mov dword [esp + 0x7c], 0
mov byte [esp + 0x5c], 0x65
mov byte [esp + 0x5d], 0x78
mov byte [esp + 0x5e], 0x65
mov eax, esp
mov ecx, dword [esp + 0x28]
mov dword [eax], ecx
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov bl, byte [esp + 0x3b]
or bl, bl
mov byte [esp + 0x89], bl
cmp eax, 0
jne 0x401ba2
jmp 0x401b60
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x34]
add ecx, ecx
mov dword [esp + 0x74], ecx
movzx eax, byte [eax]
cmp eax, 0x6a
je 0x401b19
jmp 0x4019d1
mov eax, dword [esp + 0x78]
and eax, 0x4d06b232
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], 0
mov dword [esp + 0x4c], 0
jmp 0x401b6c
mov dword [esp + 0x4c], 1
jmp 0x401b6c
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x84]
xor eax, 0x17957c53
mov edx, dword [esp + 0x64]
mov esi, dword [esp + 0x34]
xor esi, 0xeec187b
mov dword [esp + 0x74], esi
mov dword [esp + 0x60], edx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
xor edx, edx
mov esi, 0x67210d57
sub esi, ecx
sbb edx, eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], esi
jb 0x401a9a
jmp 0x401b23
mov dword [esp + 0x4c], 1
jmp 0x401b6c
cmp dword [esp + 0x60], 0x3ff
jl 0x40195f
jmp 0x401a9a
mov al, byte [esp + 0x3b]
and al, al
mov ecx, dword [esp + 0x70]
mov byte [esp + 0x89], al
xor ecx, 0xec75e55
mov dword [esp + 0x64], ecx
jmp 0x401ac9
mov dword [esp + 0x4c], 0
jmp 0x401b6c
call fcn.00406cc0
cmp eax, 0
jne 0x401b56
jmp 0x401b36
mov ax, word [esp + 0x38]
and ax, ax
mov word [esp + 0x8a], ax
mov eax, dword [esp + 0x4c]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 0x7c], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x4c], 1
jmp 0x401b6c
mov dword [esp + 0x6c], 0
mov dword [esp + 0x68], 0x7e1c20bd
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x34]
imul esi, edx, 0xb8aebf3
xor edi, edi
mov ebx, 0x17de7e0f
sub ebx, ecx
sbb edi, eax
mov dword [esp + 0x74], esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebx
jb 0x401b88
jmp 0x401ba2