Function at 0x401721
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x254
call fcn.00402af0
mov dword [esp], 0xa76409bd
mov dword [esp + 4], 0xde0b6b3
call fcn.004015a7
mov dword [esp], 0xa76409b1
mov dword [esp + 4], 0xde0b6b3
call fcn.004015a7
mov dword [esp], 0xa764090f
mov dword [esp + 4], 0xde0b6b3
call fcn.004015a7
mov dword [esp], 0xa76408df
mov dword [esp + 4], 0xde0b6b3
call fcn.004015a7
mov dword [esp], 0xa76408a9
mov dword [esp + 4], 0xde0b6b3
call fcn.004015a7
mov dword [esp], 0xa7640859
mov dword [esp + 4], 0xde0b6b3
call fcn.004015a7
mov dword [esp], 0xa7640831
mov dword [esp + 4], 0xde0b6b3
call fcn.004015a7
mov dword [esp], 0xa7640801
mov dword [esp + 4], 0xde0b6b3
call fcn.004015a7
mov dword [esp], 0xa76407a1
mov dword [esp + 4], 0xde0b6b3
call fcn.004015a7
mov dword [esp], 0xa76409b1
mov dword [esp + 4], 0xde0b6b3
call fcn.004015a7
pxor xmm0, xmm0
movups xmmword [ebp - 0x8c], xmm0
movups xmmword [ebp - 0x84], xmm0
pxor xmm0, xmm0
movups xmmword [ebp - 0xa4], xmm0
movups xmmword [ebp - 0x9c], xmm0
pxor xmm0, xmm0
movups xmmword [ebp - 0xbc], xmm0
movups xmmword [ebp - 0xb4], xmm0
mov word [ebp - 0xd0], 0x6c
mov word [ebp - 0xce], 0x6c
mov word [ebp - 0xcc], 0x64
mov word [ebp - 0xca], 0x2e
mov word [ebp - 0xc8], 0x33
mov word [ebp - 0xc6], 0x32
mov word [ebp - 0xc4], 0x65
mov word [ebp - 0xc2], 0x73
mov word [ebp - 0xc0], 0x55
mov word [ebp - 0xbe], 0
mov word [ebp - 0xea], 0x6c
mov word [ebp - 0xe8], 0x6c
mov word [ebp - 0xe6], 0x64
mov word [ebp - 0xe4], 0x2e
mov word [ebp - 0xe2], 0x32
mov word [ebp - 0xe0], 0x33
mov word [ebp - 0xde], 0x6c
mov word [ebp - 0xdc], 0x65
mov word [ebp - 0xda], 0x6e
mov word [ebp - 0xd8], 0x72
mov word [ebp - 0xd6], 0x65
mov word [ebp - 0xd4], 0x4b
mov word [ebp - 0xd2], 0
mov word [ebp - 0xfe], 0x6c
mov word [ebp - 0xfc], 0x6c
mov word [ebp - 0xfa], 0x64
mov word [ebp - 0xf8], 0x2e
mov word [ebp - 0xf6], 0x6c
mov word [ebp - 0xf4], 0x6c
mov word [ebp - 0xf2], 0x64
mov word [ebp - 0xf0], 0x74
mov word [ebp - 0xee], 0x6e
mov word [ebp - 0xec], 0
lea eax, [ebp - 0xd0]
mov dword [esp], eax
call fcn.004016ad
lea eax, [ebp - 0xea]
mov dword [esp], eax
call fcn.004016ad
lea eax, [ebp - 0xfe]
mov dword [esp], eax
call fcn.004016ad
mov dword [ebp - 0x109], 0x64446c6c
mov dword [ebp - 0x105], 0x724c6f61
mov dword [ebp - 0x102], 0x4c6472
mov dword [ebp - 0x113], 0x2e646c6c
mov dword [ebp - 0x10f], 0x74646c6c
mov word [ebp - 0x10b], 0x6e
mov dword [ebp - 0x120], 0x2e646c6c
mov dword [ebp - 0x11c], 0x656c3332
mov dword [ebp - 0x11b], 0x6e656c33
mov dword [ebp - 0x117], 0x4b6572
lea eax, [ebp - 0x109]
mov dword [esp], eax
call fcn.00401648
lea eax, [ebp - 0x113]
mov dword [esp], eax
call fcn.00401648
lea eax, [ebp - 0x120]
mov dword [esp], eax
call fcn.00401648
lea eax, [ebp - 0xd0]
mov dword [esp + 4], eax
lea eax, [ebp - 0x64]
mov dword [esp], eax
call fcn.00401554
lea eax, [ebp - 0xea]
mov dword [esp + 4], eax
lea eax, [ebp - 0x6c]
mov dword [esp], eax
call fcn.00401554
lea eax, [ebp - 0xfe]
mov dword [esp + 4], eax
lea eax, [ebp - 0x74]
mov dword [esp], eax
call fcn.00401554
mov dword [ebp - 0x8c], 0x18
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x80], 0x40
lea eax, [ebp - 0x64]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 0
mov dword [ebp - 0xa4], 0x18
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x98], 0x40
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0xbc], 0x18
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb0], 0x40
lea eax, [ebp - 0x74]
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 0
movdqu xmm0, xmmword [str.AeldnaHeludoMteGyromeMssecorPetissecorPtnerruCteAofnIradnelaCmun__]
movups xmmword [ebp - 0x131], xmm0
mov byte [ebp - 0x121], 0
lea eax, [ebp - 0x131]
mov dword [esp], eax
call fcn.00401648
lea eax, [ebp - 0x120]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
lea edx, [ebp - 0x131]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x140], 0x72657373
mov dword [ebp - 0x13c], 0x63416464
mov dword [ebp - 0x139], 0x50726f63
mov dword [ebp - 0x135], 0x476574
lea eax, [ebp - 0x140]
mov dword [esp], eax
call fcn.00401648
lea eax, [ebp - 0x120]
mov dword [esp], eax
mov eax, dword [ebp - 0x10]
call eax
sub esp, 4
lea edx, [ebp - 0x140]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14d], 0x6c6c6f63
mov dword [ebp - 0x149], 0x75616c41
mov dword [ebp - 0x148], 0x7475616c
mov dword [ebp - 0x144], 0x566972
lea eax, [ebp - 0x14d]
mov dword [esp], eax
call fcn.00401648
lea eax, [ebp - 0x120]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
lea edx, [ebp - 0x14d]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x14]
call eax
sub esp, 8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x15c], 0x74656374
mov dword [ebp - 0x158], 0x6c50726f
mov dword [ebp - 0x155], 0x7475616c
mov dword [ebp - 0x151], 0x566972
lea eax, [ebp - 0x15c]
mov dword [esp], eax
call fcn.00401648
lea eax, [ebp - 0x120]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
lea edx, [ebp - 0x15c]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x14]
call eax
sub esp, 8
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x113]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
lea edx, [ebp - 0x109]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x14]
call eax
sub esp, 8
mov dword [ebp - 0x20], eax
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x3000
mov dword [esp + 4], 0x13
mov dword [esp], 0
mov eax, dword [ebp - 0x18]
call eax
sub esp, 0x10
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
add eax, 2
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x15d], 0xb8
mov dword [ebp - 0x161], 0x77457265
mov word [ebp - 0x164], 0xe0ff
mov byte [ebp - 0x162], 0xc3
lea eax, [ebp - 0x161]
mov edx, dword [ebp - 0x28]
mov dword [eax], edx
mov dword [esp + 8], 2
mov dword [esp + 4], 0x405050
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call fcn.004014f0
mov eax, dword [ebp - 0x24]
lea edx, [eax + 2]
mov dword [esp + 8], 1
lea eax, [ebp - 0x15d]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.004014f0
mov eax, dword [ebp - 0x24]
lea edx, [eax + 3]
mov dword [esp + 8], 4
lea eax, [ebp - 0x161]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.004014f0
mov eax, dword [ebp - 0x24]
lea edx, [eax + 7]
mov dword [esp + 8], 3
lea eax, [ebp - 0x164]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.004014f0
mov dword [ebp - 0x168], 0
lea eax, [ebp - 0x168]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0x1e
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
mov eax, dword [ebp - 0x1c]
call eax
sub esp, 0x10
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x16c], 0
lea eax, [ebp - 0x16c]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x64]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [ebp - 0x2c]
call eax
sub esp, 0x10
mov dword [ebp - 0x170], 0
lea eax, [ebp - 0x170]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x6c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [ebp - 0x2c]
call eax
sub esp, 0x10
mov dword [ebp - 0x174], 0
lea eax, [ebp - 0x174]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x74]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [ebp - 0x2c]
call eax
sub esp, 0x10
mov eax, dword [ebp - 0x170]
lea edx, [ebp - 0x140]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x14]
call eax
sub esp, 8
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x170]
lea edx, [ebp - 0x14d]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
call eax
sub esp, 8
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x170]
lea edx, [ebp - 0x15c]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
call eax
sub esp, 8
mov dword [ebp - 0x38], eax
movdqu xmm0, xmmword [0x405540]
movups xmmword [ebp - 0x187], xmm0
mov dword [ebp - 0x178], 0x577269
lea eax, [ebp - 0x187]
mov dword [esp], eax
call fcn.00401648
mov eax, dword [ebp - 0x170]
lea edx, [ebp - 0x187]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
call eax
sub esp, 8
mov dword [ebp - 0x3c], eax
movdqu xmm0, xmmword [0x405550]
movups xmmword [ebp - 0x199], xmm0
mov word [ebp - 0x189], 0x47
lea eax, [ebp - 0x199]
mov dword [esp], eax
call fcn.00401648
mov eax, dword [ebp - 0x170]
lea edx, [ebp - 0x199]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
call eax
sub esp, 8
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x218], str.000186e8_0700_0000_404d_03c0ca6928f0
mov dword [ebp - 0x214], str.3bd3b809_2e6b_0000_00fd_7bf7e80e0000
mov dword [ebp - 0x210], str.c3166820_caaf_9219_41b4_2fa8a0790e17
mov dword [ebp - 0x20c], str.eab3bf1b_8433_ca3f_d867_46f7a1dccb37
mov dword [ebp - 0x208], str.6d9287f8_9edf_59a3_05ec_ff3a222248f7
mov dword [ebp - 0x204], str.1ac9b918_a8f8_6e51_389e_6efb55a5d74c
mov dword [ebp - 0x200], str.1b3f16dd_0147_daf8_a551_e926f1e06a0e
mov dword [ebp - 0x1fc], str.88c9dfee_08fa_706c_ec73_a2f0f5c6324a
mov dword [ebp - 0x1f8], str.4609fea4_2697_0687_2083_45aef47a19db
mov dword [ebp - 0x1f4], str.1db5a68a_6b08_39c7_232e_7dff24309e0f
mov dword [ebp - 0x1f0], str.e1e70a32_0fdb_8026_eca0_d911112f3d53
mov dword [ebp - 0x1ec], str.adfd2614_9df0_c687_c899_ce2ac8aa45d6
mov dword [ebp - 0x1e8], str.5391d230_a0c4_faf6_c9b3_095fbb820d18
mov dword [ebp - 0x1e4], str.645cf007_6a93_74d5_f603_53657fc998b2
mov dword [ebp - 0x1e0], str.5534f68f_5e24_d435_0a35_88e5d735e5a8
mov dword [ebp - 0x1dc], str.8ef31eaa_349c_50ca_4aae_d412448f67fe
mov dword [ebp - 0x1d8], str.354bca0d_a1bb_2a28_b259_9fc62e21f0e4
mov dword [ebp - 0x1d4], str.246a7fea_708f_d8df_ffac_d281232ed5fd
mov dword [ebp - 0x1d0], str.f569822e_d70c_32d3_57a9_0aaedfbc2d2a
mov dword [ebp - 0x1cc], str.a9c87893_f7bf_b662_a4ee_35fbd377b45d
mov dword [ebp - 0x1c8], str.80658bf9_4b45_9071_15a3_e27dec6009be
mov dword [ebp - 0x1c4], str.55ad8d55_509c_dd4f_0824_172c8bbec78a
mov dword [ebp - 0x1c0], str.fd5faba9_52e1_5e42_9fb6_e68a0268f6d9
mov dword [ebp - 0x1bc], str.ebfd088d_20e2_8362_67cc_a9db07167c0c
mov dword [ebp - 0x1b8], str.70684275_2dd4_6584_c9cb_07eb0404befa
mov dword [ebp - 0x1b4], str.db4b0ff0_0f59_c94c_c109_fb460f46d24e
mov dword [ebp - 0x1b0], str.550441c1_04eb_8ad1_1d54_8171086828f0
mov dword [ebp - 0x1ac], str.f6420fb9_4181_1f0c_5d48_9deb04609949
mov dword [ebp - 0x1a8], str.1041c15b_83bf_00c7_eb04_9066f0aaf751
mov dword [ebp - 0x1a4], str.aa04eb14_da91_c183_4918_64eb040443a9
mov dword [ebp - 0x1a0], str.1c41c1fb_ff0e_00e1_0000_000000000000
mov dword [ebp - 0x44], 0x1f
mov eax, dword [ebp - 0x44]
shl eax, 4
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jne 0x402087
mov eax, 0xffffffff
jmp 0x402247
mov dword [ebp - 0xc], 0
jmp 0x4020da
mov eax, dword [ebp - 0xc]
shl eax, 4
mov edx, eax
mov eax, dword [ebp - 0x48]
add edx, eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x218]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.RPCRT4.dll_UuidFromStringA]
call eax
sub esp, 8
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x4020d6
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, 0xffffffff
jmp 0x402247
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x44]
jl 0x402090
mov eax, dword [ebp - 0x44]
shl eax, 4
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], 0
movdqu xmm0, xmmword [0x405560]
movups xmmword [ebp - 0x22a], xmm0
mov word [ebp - 0x21a], 0x45
lea eax, [ebp - 0x22a]
mov dword [esp], eax
call fcn.00401648
mov eax, dword [ebp - 0x170]
lea edx, [ebp - 0x22a]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
call eax
sub esp, 8
mov dword [ebp - 0x58], eax
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x3000
mov eax, dword [ebp - 0x50]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [ebp - 0x34]
call eax
sub esp, 0x10
mov dword [ebp - 0x54], eax
mov dword [esp], 0xa7640859
mov dword [esp + 4], 0xde0b6b3
call fcn.004015a7
lea eax, [ebp - 0x230]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x20
mov eax, dword [ebp - 0x50]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x54]
mov dword [esp], eax
mov eax, dword [ebp - 0x38]
call eax
sub esp, 0x10
mov dword [esp], 0xa7640801
mov dword [esp + 4], 0xde0b6b3
call fcn.004015a7
lea eax, [ebp - 0x230]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x40
mov eax, dword [ebp - 0x50]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x54]
mov dword [esp], eax
mov eax, dword [ebp - 0x38]
call eax
sub esp, 0x10
mov dword [esp], 0xa76409b1
mov dword [esp + 4], 0xde0b6b3
call fcn.004015a7
mov eax, dword [ebp - 0x40]
call eax
mov dword [esp + 0x10], 0
mov edx, dword [ebp - 0x4c]
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0x48]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x54]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x3c]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x54]
mov dword [esp + 0xc], 0x15
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x400
mov dword [esp], eax
mov eax, dword [ebp - 0x58]
call eax
sub esp, 0x10
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret