Function at 0x449d1e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x34
mov eax, 0x5baee8
call fcn.00580e6b
push 0x6c9c44
mov dword [ebp - 0x28], 0x6c9c10
call fcn.0044884e
xor ebx, ebx
mov dword [ebp - 4], ebx
push ebx
mov esi, 0x6c9c74
push 1
mov dword [ebp - 0x24], esi
call fcn.0040eaf4
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x449d64
mov dword [eax], esi
jmp 0x449d66
xor eax, eax
mov byte [ebp - 4], bl
mov dword [0x6c9c74], eax
mov byte [ebp - 4], 6
call fcn.004508ed
mov dword [0x6c9c8c], eax
mov byte [eax + 0x49], 1
mov eax, dword [0x6c9c8c]
mov dword [eax + 4], eax
mov eax, dword [0x6c9c8c]
mov dword [eax], eax
mov eax, dword [0x6c9c8c]
mov dword [eax + 8], eax
mov dword [0x6c9c90], ebx
mov byte [ebp - 4], 8
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x6c9c94
call esi
mov byte [ebp - 4], 9
push 0x6c9cac
call esi
mov byte [ebp - 4], 0xa
push ebx
mov edi, 0x6c9cc4
push 1
mov dword [ebp - 0x24], edi
call fcn.0040eaf4
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xb
cmp eax, ebx
je 0x449de1
mov dword [eax], edi
jmp 0x449de3
xor eax, eax
mov byte [ebp - 4], 0xa
mov dword [0x6c9cc4], eax
mov byte [ebp - 4], 0x10
call fcn.00450fbb
mov dword [0x6c9cdc], eax
mov byte [eax + 0x19], 1
mov eax, dword [0x6c9cdc]
mov dword [eax + 4], eax
mov eax, dword [0x6c9cdc]
mov dword [eax], eax
mov eax, dword [0x6c9cdc]
mov dword [eax + 8], eax
mov dword [0x6c9ce0], ebx
mov byte [ebp - 4], 0x12
push 0x6c9ce4
call esi
mov byte [ebp - 4], 0x13
push 0x6c9cfc
call fcn.0043df79
mov byte [ebp - 4], 0x14
push 0x6c9d1c
call esi
mov byte [ebp - 4], 0x15
push 0x6c9d34
call fcn.0043df79
mov byte [ebp - 4], 0x16
push 0x6c9d54
call esi
mov byte [ebp - 4], 0x17
push 0x6c9d6c
call fcn.0043df79
mov byte [ebp - 4], 0x18
push 0x6c9d8c
call esi
mov byte [ebp - 4], 0x19
push ebx
mov edi, 0x6c9da4
push 1
mov dword [ebp - 0x24], edi
call fcn.0040eaf4
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0x1a
cmp eax, ebx
je 0x449e99
mov dword [eax], edi
jmp 0x449e9b
xor eax, eax
mov byte [ebp - 4], 0x19
mov dword [0x6c9da4], eax
mov byte [ebp - 4], 0x1f
call fcn.00450fbb
mov dword [0x6c9dbc], eax
mov byte [eax + 0x19], 1
mov eax, dword [0x6c9dbc]
mov dword [eax + 4], eax
mov eax, dword [0x6c9dbc]
mov dword [eax], eax
mov eax, dword [0x6c9dbc]
mov dword [eax + 8], eax
mov dword [0x6c9dc0], ebx
mov byte [ebp - 4], 0x21
mov edi, 0x6c9dc4
push edi
call fcn.0040f817
mov byte [ebp - 4], 0x22
push 0x6c9c5c
call esi
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x6c9c10], eax
push str.docs.db
lea eax, [ebp - 0x14]
push eax
call fcn.0040f8bd
mov byte [ebp - 4], 0x23
lea eax, [ebp - 0x24]
push eax
call fcn.0046f870
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x20]
push ecx
mov esi, eax
call fcn.004136d2
mov byte [ebp - 4], 0x25
push dword [eax]
lea eax, [ebp - 0x18]
push eax
call fcn.00470550
add esp, 0x14
mov byte [ebp - 4], 0x26
push dword [eax]
mov ecx, edi
call fcn.004100fc
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x18]
call fcn.00408461
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x20]
call fcn.004085a2
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x24]
call fcn.004085a2
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x14]
call fcn.004085a2
lea eax, [ebp - 0x40]
push eax
push edi
call fcn.004131ff
mov byte [ebp - 4], 0x27
mov esi, dword [ebp - 0x34]
cmp esi, dword [ebp - 0x30]
jbe 0x449f95
call fcn.0057451a
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], esi
mov esi, dword [ebp - 0x30]
cmp dword [ebp - 0x34], esi
jbe 0x449fab
call fcn.0057451a
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x449fb7
cmp eax, dword [ebp - 0x40]
je 0x449fbc
call fcn.0057451a
cmp dword [ebp - 0x18], esi
je 0x44a04e
lea esi, [ebp - 0x1c]
call fcn.0043c532
add eax, 8
push dword [eax]
lea eax, [ebp - 0x20]
push eax
call fcn.00470690
mov byte [ebp - 4], 0x28
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00471ae0
add esp, 0x10
mov edi, eax
mov byte [ebp - 4], 0x29
call fcn.0043c532
cmp dword [eax + 0xc], ebx
push edi
push 0x6c8f68
setne byte [ebp - 0xd]
call fcn.0043dfac
mov cl, byte [ebp - 0xd]
mov byte [eax], cl
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x24]
call fcn.004085a2
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x20]
call fcn.004085a2
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
jne 0x44a04a
call fcn.0057451a
xor eax, eax
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [eax + 0x10]
jb 0x44a041
call fcn.0057451a
add dword [ebp - 0x18], 0x10
jmp 0x449f9e
mov eax, dword [eax]
jmp 0x44a034
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x24], esp
push str.DocsEnabled2
push eax
call fcn.00408561
mov byte [ebp - 4], 0x2a
mov byte [ebp - 4], 0x27
call fcn.0042c61b
push 1
push ecx
mov dword [0x6c8b08], eax
mov eax, esp
mov dword [ebp - 0x24], esp
push str.TTEnabled
push eax
call fcn.00408561
mov byte [ebp - 4], 0x2b
mov byte [ebp - 4], 0x27
call fcn.0042c61b
mov dword [0x6b2a24], eax
call fcn.00449812
mov byte [ebp - 4], 0x22
lea eax, [ebp - 0x40]
push eax
call fcn.00413a5d
or dword [ebp - 4], 0xffffffff
mov eax, 0x6c9c10
call fcn.00580f43
ret