Function at 0x411b2e
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
mov eax, 0x497b4f
call fcn.00487e80
sub esp, 0xa8
push ebx
push esi
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.0045e1cb
pop ecx
mov eax, dword [ebp - 0x14]
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [eax - 8], esi
je 0x411e89
mov word [ebp - 0xb0], 0x36
mov word [ebp - 0xae], 0x1c
mov word [ebp - 0xac], 1
mov word [ebp - 0xaa], 0x2b
mov word [ebp - 0xa8], 0x4d
mov word [ebp - 0xa6], 0x2c
mov word [ebp - 0xa4], 0x2d
mov word [ebp - 0xa2], 0x23
mov word [ebp - 0xa0], 0x45
mov word [ebp - 0x9e], 2
mov word [ebp - 0x9c], 3
mov word [ebp - 0x9a], 4
mov word [ebp - 0x98], 0x1a
mov word [ebp - 0x96], 5
mov word [ebp - 0x94], 6
mov word [ebp - 0x92], 0x65
mov word [ebp - 0x90], 0x13
mov word [ebp - 0x8e], 9
mov word [ebp - 0x8c], 0x25
mov word [ebp - 0x8a], 0x38
mov word [ebp - 0x88], 0x29
mov word [ebp - 0x86], 0xb
mov word [ebp - 0x84], 0xc
mov word [ebp - 0x82], 0x56
mov word [ebp - 0x80], 0x37
mov word [ebp - 0x7e], 7
mov word [ebp - 0x7c], 8
mov word [ebp - 0x7a], 0x47
mov word [ebp - 0x78], 0xd
mov word [ebp - 0x76], 0x39
mov word [ebp - 0x74], 0xe
mov word [ebp - 0x72], 0xf
mov word [ebp - 0x70], 0x21
mov word [ebp - 0x6e], 0x10
mov word [ebp - 0x6c], 0x11
mov word [ebp - 0x6a], 0x4b
mov word [ebp - 0x68], 0x60
mov word [ebp - 0x66], 0x3f
mov word [ebp - 0x64], 0x57
mov word [ebp - 0x62], 0x12
mov word [ebp - 0x60], 0x40
mov word [ebp - 0x5e], 0x26
mov word [ebp - 0x5c], 0x27
mov word [ebp - 0x5a], 0x2f
mov word [ebp - 0x58], 0x3e
mov word [ebp - 0x56], 0x4c
mov word [ebp - 0x54], 0x58
mov word [ebp - 0x52], 0x4e
mov word [ebp - 0x50], 0x50
mov word [ebp - 0x4e], 0x61
mov word [ebp - 0x4c], 0x14
mov word [ebp - 0x4a], 0x48
mov word [ebp - 0x48], 0x15
mov word [ebp - 0x46], 0x16
mov word [ebp - 0x44], 0x46
mov word [ebp - 0x42], 0x18
mov word [ebp - 0x40], 0x19
mov word [ebp - 0x3e], 0x4f
mov word [ebp - 0x3c], 0x1a
mov word [ebp - 0x3a], 0x59
mov word [ebp - 0x38], 0x1b
mov word [ebp - 0x36], 0x24
mov word [ebp - 0x34], 0xa
mov word [ebp - 0x32], 0x41
mov word [ebp - 0x30], 0x1d
mov word [ebp - 0x2e], 0x5a
mov word [ebp - 0x2c], 0x49
mov word [ebp - 0x2a], 0x44
mov word [ebp - 0x28], 0x4a
mov word [ebp - 0x26], 0x1e
mov word [ebp - 0x24], 0x1f
mov word [ebp - 0x22], 0x22
mov word [ebp - 0x20], 0x20
mov word [ebp - 0x1e], 0x43
mov word [ebp - 0x1c], 0x2a
mov dword [ebp - 0x18], esi
lea edi, [ebp - 0xb0]
mov si, word [edi]
mov eax, dword [0x4bc1a0]
movzx ebx, si
mov dword [ebp - 0x10], eax
push 0x65
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00401880
test eax, eax
je 0x411da7
mov eax, dword [ebp - 0x10]
mov dword [eax - 8], 0x65
mov eax, dword [ebp - 0x10]
and word [eax + 0xca], 0
mov eax, dword [ebp - 0x10]
push 0x64
push eax
push 0x59
push ebx
call dword [0x4a3338]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004018e8
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.00488395
pop ecx
test eax, eax
pop ecx
je 0x411e32
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], 2
jle 0x411e04
lea eax, [ebp - 0xb4]
push 2
push eax
lea ecx, [ebp - 0x10]
call fcn.00403ed9
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.004016c6
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 1
call fcn.00401600
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.00488395
pop ecx
test eax, eax
pop ecx
je 0x411e32
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00401600
inc dword [ebp - 0x18]
inc edi
inc edi
cmp dword [ebp - 0x18], 0x4b
jl 0x411d6f
jmp 0x411e43
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00401600
test si, si
jne 0x411e47
xor esi, esi
jmp 0x411e89
push str.kernel32.dll
call dword [0x4a33d0]
test eax, eax
je 0x411e43
push str.SetThreadUILanguage
push eax
call dword [0x4a33a4]
test eax, eax
je 0x411e43
or esi, 0x400
push esi
call eax
xor ecx, ecx
test ax, ax
setne cl
mov edi, ecx
test edi, edi
je 0x411e87
movzx eax, si
push eax
call dword [0x4a331c]
mov esi, edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401600
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret