Function at 0x401544
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x970
mov eax, dword [0x485730]
and dword [ebp - 0xc4], 0
mov dword [ebp - 0xf4], eax
mov eax, dword [0x485734]
push esi
mov esi, dword [ebx]
push edi
mov edi, dword [ebx + 4]
mov dword [ebp - 0xf0], eax
lea eax, [ebp - 0xc4]
mov dword [ebp - 0xe4], esi
call fcn.0040153d
mov eax, dword [0x485738]
add dword [ebp - 0xc4], 0x23f
mov dword [ebp - 0xf8], eax
mov eax, dword [0x48573c]
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], 0x20
mov dword [ebp + 0x70], 2
add dword [ebp + 0x70], 3
mov eax, dword [0x24a326c]
mov ecx, esi
shl ecx, 4
add ecx, dword [ebp - 0xf8]
cmp eax, 0xfa9
jne 0x4015da
mov dword [0x24a3268], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4015e8
and dword [0x24a2cf4], 0
mov eax, dword [ebp - 0xe4]
shr eax, 5
mov dword [ebp + 0x74], eax
mov eax, dword [ebp + 0x74]
add eax, dword [ebp - 0xec]
mov edx, dword [ebp - 0xc4]
add edx, esi
xor eax, edx
xor eax, ecx
sub edi, eax
cmp dword [0x24a326c], 0xc
mov dword [0x24a3264], 0xf4ea3dee
mov dword [ebp + 0x74], eax
jne 0x401632
push 0
lea eax, [ebp - 0x8f8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov eax, edi
shr eax, 5
mov dword [ebp + 0x74], eax
mov eax, dword [ebp - 0xf0]
add dword [ebp + 0x74], eax
mov ecx, dword [ebp - 0xc4]
mov eax, edi
shl eax, 4
add eax, dword [ebp - 0xf4]
add ecx, edi
xor eax, ecx
cmp dword [0x24a326c], 0xb03
mov dword [ebp - 0xe4], eax
jne 0x40167c
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp + 0x74]
xor ecx, eax
sub esi, ecx
mov dword [ebp - 0xe4], esi
mov dword [ebp + 0x3c], 0x72ef4d12
mov dword [ebp + 0x6c], 0x667a8f03
mov dword [ebp - 0xa0], 0x74eb31e9
mov dword [ebp - 0x4c], 0x3e01a6
mov dword [ebp - 0x14], 0x31c38e55
mov dword [ebp - 0xb0], 0x72297fa
mov dword [ebp - 0x74], 0x58102752
mov dword [ebp - 0xc8], 0x3511d0e6
mov dword [ebp - 0x6c], 0x2d857b28
mov dword [ebp + 0x38], 0x97e3837
mov dword [ebp + 0x54], 0xe1ab73f
mov dword [ebp - 0xbc], 0x18d08cdb
mov dword [ebp - 0x28], 0x1d941164
mov dword [ebp + 0x5c], 0x5406190b
mov dword [ebp - 0x90], 0x88fefab
mov dword [ebp - 0x40], 0x45f6d7d
mov dword [ebp - 0x20], 0x4187963d
mov dword [ebp + 0x10], 0x25cc7e9c
mov dword [ebp - 0x44], 0x3590bb86
mov dword [ebp - 0xe0], 0x580bdfc5
mov dword [ebp - 0xb4], 0x7c15733e
mov dword [ebp - 0xc], 0x83fb90b
mov dword [ebp - 4], 0x18dcf915
mov dword [ebp - 0x70], 0x6bcce2ae
mov dword [ebp + 0x50], 0xef49651
mov dword [ebp - 0x3c], 0x23d8d51c
mov dword [ebp + 0x44], 0x16126415
mov dword [ebp - 0x88], 0x44b04db6
mov dword [ebp - 0xa8], 0x24aae8b1
mov dword [ebp - 0x34], 0x65fd8d98
mov dword [ebp - 0x38], 0x583762f0
mov dword [ebp - 0xb8], 0x1513b7a7
mov dword [ebp + 0x20], 0x1802c670
mov dword [ebp - 0xac], 0xf7c92fe
mov dword [ebp - 0x80], 0x74d37a51
mov dword [ebp], 0x17abbd3d
mov dword [ebp + 0x58], 0x529ae9f7
mov dword [ebp + 4], 0x5aa86f3e
mov dword [ebp - 0x50], 0x3a65bf1e
mov dword [ebp - 0x10], 0x7672def6
mov dword [ebp - 0x8c], 0x2243bd14
mov dword [ebp - 0x98], 0x4c273f6d
mov dword [ebp - 0xc0], 0x1cfa349
mov dword [ebp - 0x2c], 0x2b7d43ba
mov dword [ebp - 8], 0x545ac286
mov dword [ebp - 0x64], 0x5264ce66
mov dword [ebp - 0xa4], 0x3c4837cf
mov dword [ebp + 0x64], 0x7c586549
mov dword [ebp + 0x2c], 0x9cd3349
mov dword [ebp - 0x60], 0x780d3546
mov dword [ebp + 0x60], 0x21e3555f
mov dword [ebp - 0xdc], 0x2c60148d
mov dword [ebp - 0xd0], 0x69d867cc
mov dword [ebp - 0x48], 0xae78f71
mov dword [ebp + 0xc], 0xe7d96f2
mov dword [ebp - 0x9c], 0x59084214
mov dword [ebp - 0xcc], 0x3d452aef
mov dword [ebp + 0x40], 0x34f599f4
mov dword [ebp - 0xd4], 0xaa33e49
mov dword [ebp + 0x28], 0x77c2236c
mov dword [ebp - 0x24], 0x36a014c0
mov dword [ebp - 0xd8], 0x1e27746
mov dword [ebp + 0x68], 0x46697512
mov dword [ebp - 0x68], 0x10c82555
mov dword [ebp - 0x30], 0x25543165
mov dword [ebp + 0x30], 0x35515437
mov dword [ebp - 0x84], 0x503f330b
mov dword [ebp - 0x7c], 0x7cd920ca
mov dword [ebp - 0x94], 0x4a3af65c
mov dword [ebp + 0x14], 0x371cfb7
mov dword [ebp + 0x4c], 0x24118c47
mov dword [ebp + 0x1c], 0x5092c2c
mov dword [ebp - 0x18], 0x18921620
mov dword [ebp + 8], 0x6f9e58d
mov dword [ebp + 0x34], 0x67c97c2f
mov dword [ebp + 0x48], 0x4f8bf301
mov dword [ebp - 0x5c], 0x7902178b
mov dword [ebp + 0x24], 0x78030743
mov dword [ebp - 0x78], 0x1e01ab1d
mov dword [ebp - 0x1c], 0x78b71ec6
mov dword [ebp + 0x18], 0x44a6b9d
mov dword [ebp - 0x54], 0x1ba850d8
mov dword [ebp - 0x58], 0x185ce861
add dword [ebp - 0xc4], 0x61c88647
dec dword [ebp - 0xe8]
jne 0x4015ae
mov dword [ebx + 4], edi
pop edi
mov dword [ebx], esi
pop esi
add ebp, 0x78
leave
ret