Function at 0x404610
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
mov r11, rsp
sub rsp, 0x268
mov qword [rsp + 0x130], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov qword [r11 - 8], rsi
mov qword [r11 - 0x10], rdi
mov qword [r11 - 0x18], r12
mov qword [r11 - 0x20], r13
mov rax, qword [0x00419040]
xor rax, rsp
mov qword [rsp + 0x238], rax
mov r12, rdx
mov rbx, rcx
mov qword [r11 - 0x130], rcx
xor r13d, r13d
mov qword [r11 - 0x1e0], r13
mov word [r11 - 0x70], 0x50
mov word [r11 - 0x6e], 0x6e
mov word [r11 - 0x6c], 0x65
mov word [r11 - 0x6a], 0x4d
mov word [r11 - 0x68], 0x65
mov word [r11 - 0x66], 0x63
mov word [r11 - 0x64], 0x77
mov word [r11 - 0x62], 0x49
mov word [r11 - 0x60], 0x63
mov word [r11 - 0x5e], 0x6e
mov word [r11 - 0x5c], 0x43
mov word [r11 - 0x5a], 0x67
mov word [r11 - 0x58], 0x59
mov word [r11 - 0x56], r13w
mov word [rsp + 0x178], 0x79
mov word [rsp + 0x17a], 0x4a
mov word [rsp + 0x17c], 0x79
mov word [rsp + 0x17e], 0x79
mov word [rsp + 0x180], 0x70
mov word [r11 - 0xe6], r13w
lea rax, [r11 - 0x1b0]
mov qword [r11 - 0x1e8], rax
mov edx, 7
mov qword [r11 - 0x190], rdx
mov r8, r13
mov qword [r11 - 0x198], r13
mov word [r11 - 0x1a8], r8w
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [r11 - 0xf0]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rsi, rcx
movabs rbp, 0x7ffffffffffffffe
cmp rcx, rbp
jbe 0x40476e
call fcn.00410510
mov rdx, qword [rsp + 0xd8]
mov r8, qword [rsp + 0xd0]
cmp rdx, rsi
jae 0x40478d
mov rdx, rsi
lea rcx, [rsp + 0xb8]
call fcn.00407f40
mov rdx, qword [rsp + 0xd8]
jmp 0x4047b5
test rsi, rsi
jne 0x4047b5
mov qword [rsp + 0xd0], r13
lea rax, [rsp + 0xc0]
cmp rdx, 8
cmovae rax, qword [rsp + 0xc0]
mov word [rax], r13w
jmp 0x40480d
test rsi, rsi
je 0x40480d
lea rcx, [rsp + 0xc0]
cmp rdx, 8
cmovae rcx, qword [rsp + 0xc0]
lea rdi, [rsi + rsi]
add rdx, rdx
mov r9, rdi
lea r8, [rsp + 0x178]
call fcn.00408f60
mov qword [rsp + 0xd0], rsi
lea rax, [rsp + 0xc0]
cmp qword [rsp + 0xd8], 8
cmovae rax, qword [rsp + 0xc0]
mov word [rax + rdi], r13w
mov edx, 7
mov qword [rsp + 0x100], rdx
mov r8, r13
mov qword [rsp + 0xf8], r13
mov word [rsp + 0xe8], r8w
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1f8]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rsi, rcx
cmp rcx, rbp
jbe 0x404866
call fcn.00410510
mov rdx, qword [rsp + 0x100]
mov r8, qword [rsp + 0xf8]
cmp rdx, rsi
jae 0x404885
mov rdx, rsi
lea rcx, [rsp + 0xe0]
call fcn.00407f40
mov rdx, qword [rsp + 0x100]
jmp 0x4048ac
test rsi, rsi
jne 0x4048ac
mov qword [rsp + 0xf8], r13
lea rax, [rsp + 0xe8]
cmp rdx, 8
cmovae rax, qword [rsp + 0xe8]
mov word [rax], si
jmp 0x404905
test rsi, rsi
je 0x404905
lea rcx, [rsp + 0xe8]
cmp rdx, 8
cmovae rcx, qword [rsp + 0xe8]
lea rdi, [rsi + rsi]
add rdx, rdx
mov r9, rdi
lea r8, [rsp + 0x1f8]
call fcn.00408f60
mov qword [rsp + 0xf8], rsi
lea rax, [rsp + 0xe8]
cmp qword [rsp + 0x100], 8
cmovae rax, qword [rsp + 0xe8]
mov word [rax + rdi], 0
lea r8, [rsp + 0xb8]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x140]
call fcn.00401270
nop
mov word [rsp + 0x1c8], 0x53
mov word [rsp + 0x1ca], 0x43
mov word [rsp + 0x1cc], 0x55
mov word [rsp + 0x1ce], 0x52
mov word [rsp + 0x1d0], 0x45
mov word [rsp + 0x1d2], 0x50
mov word [rsp + 0x1d4], 0x46
mov word [rsp + 0x1d6], 0x45
mov word [rsp + 0x1d8], 0
mov word [rsp + 0x1b8], 0x41
mov word [rsp + 0x1ba], 0x4f
mov word [rsp + 0x1bc], 0x50
mov word [rsp + 0x1be], 0x59
mov word [rsp + 0x1c0], 0x69
mov word [rsp + 0x1c2], 0x50
mov word [rsp + 0x1c4], 0x4f
mov word [rsp + 0x1c6], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x80], rax
mov edx, 7
mov qword [rsp + 0x78], rdx
mov r8, r13
mov qword [rsp + 0x70], r13
mov word [rsp + 0x60], r8w
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1b8]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rsi, rcx
cmp rcx, rbp
jbe 0x404a24
call fcn.00410510
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
cmp rdx, rsi
jae 0x404a3d
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.00407f40
mov rdx, qword [rsp + 0x78]
jmp 0x404a5b
test rsi, rsi
jne 0x404a5b
mov qword [rsp + 0x70], r13
lea rax, [rsp + 0x60]
cmp rdx, 8
cmovae rax, qword [rsp + 0x60]
mov word [rax], si
jmp 0x404aa2
test rsi, rsi
je 0x404aa2
lea rcx, [rsp + 0x60]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x60]
lea rdi, [rsi + rsi]
add rdx, rdx
mov r9, rdi
lea r8, [rsp + 0x1b8]
call fcn.00408f60
mov qword [rsp + 0x70], rsi
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rax, qword [rsp + 0x60]
mov word [rdi + rax], 0
mov edx, 7
mov qword [rsp + 0x50], rdx
mov r8, r13
mov qword [rsp + 0x48], r13
mov word [rsp + 0x38], r8w
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1c8]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rsi, rcx
cmp rcx, rbp
jbe 0x404aec
call fcn.00410510
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
cmp rdx, rsi
jae 0x404b05
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.00407f40
mov rdx, qword [rsp + 0x50]
jmp 0x404b23
test rsi, rsi
jne 0x404b23
mov qword [rsp + 0x48], r13
lea rax, [rsp + 0x38]
cmp rdx, 8
cmovae rax, qword [rsp + 0x38]
mov word [rax], si
jmp 0x404b6a
test rsi, rsi
je 0x404b6a
lea rcx, [rsp + 0x38]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x38]
lea rdi, [rsi + rsi]
add rdx, rdx
mov r9, rdi
lea r8, [rsp + 0x1c8]
call fcn.00408f60
mov qword [rsp + 0x48], rsi
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rax, qword [rsp + 0x38]
mov word [rdi + rax], 0
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x108]
call fcn.00401270
mov rdi, rax
mov qword [rsp + 0xb0], 0xf
mov qword [rsp + 0xa8], r13
mov byte [rsp + 0x98], 0
mov r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x90]
call fcn.00407060
cmp qword [rdi + 0x20], 0x10
jb 0x404bcc
mov rdi, qword [rdi + 8]
jmp 0x404bd0
add rdi, 8
lea rdx, [rsp + 0x90]
mov rcx, r12
call fcn.004019b0
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x20], rcx
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000001
call rax
nop
cmp qword [rsp + 0x128], 0x10
jb 0x404c1b
mov rcx, qword [rsp + 0x110]
call fcn.00408f50
cmp qword [rsp + 0x88], 0
jne 0x404c79
cmp qword [rsp + 0x160], 0x10
jb 0x404c3e
mov rcx, qword [rsp + 0x148]
call fcn.00408f50
mov qword [rsp + 0x160], 0xf
mov qword [rsp + 0x158], r13
mov byte [rsp + 0x148], 0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x404c68
call fcn.00408f50
mov qword [rbx + 8], r13
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
jmp 0x4053ce
mov word [rsp + 0x218], 0x51
mov word [rsp + 0x21a], 0x69
mov word [rsp + 0x21c], 0x61
mov word [rsp + 0x21e], 0x54
mov word [rsp + 0x220], 0x6b
mov word [rsp + 0x222], 0x6c
mov word [rsp + 0x224], 0x55
mov word [rsp + 0x226], 0x65
mov word [rsp + 0x228], 0x66
mov word [rsp + 0x22a], 0x76
mov word [rsp + 0x22c], 0x6b
mov word [rsp + 0x22e], 0x57
mov word [rsp + 0x230], 0x77
mov word [rsp + 0x232], 0x45
mov word [rsp + 0x234], 0
mov word [rsp + 0x1a8], 0x5a
mov word [rsp + 0x1aa], 0x45
mov word [rsp + 0x1ac], 0x75
mov word [rsp + 0x1ae], 0x62
mov word [rsp + 0x1b0], 0x47
mov word [rsp + 0x1b2], 0x53
mov word [rsp + 0x1b4], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x80], rax
mov edx, 7
mov qword [rsp + 0x78], rdx
mov r8, r13
mov qword [rsp + 0x70], r13
mov word [rsp + 0x60], r8w
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1a8]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rsi, rcx
cmp rcx, rbp
jbe 0x404dac
call fcn.00410510
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
cmp rdx, rsi
jae 0x404dc5
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.00407f40
mov rdx, qword [rsp + 0x78]
jmp 0x404de3
test rsi, rsi
jne 0x404de3
mov qword [rsp + 0x70], r13
lea rax, [rsp + 0x60]
cmp rdx, 8
cmovae rax, qword [rsp + 0x60]
mov word [rax], si
jmp 0x404e2a
test rsi, rsi
je 0x404e2a
lea rcx, [rsp + 0x60]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x60]
lea rdi, [rsi + rsi]
add rdx, rdx
mov r9, rdi
lea r8, [rsp + 0x1a8]
call fcn.00408f60
mov qword [rsp + 0x70], rsi
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rax, qword [rsp + 0x60]
mov word [rax + rdi], 0
mov edx, 7
mov qword [rsp + 0x50], rdx
mov r8, r13
mov qword [rsp + 0x48], r13
mov word [rsp + 0x38], r8w
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x218]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rsi, rcx
cmp rcx, rbp
jbe 0x404e74
call fcn.00410510
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
cmp rdx, rsi
jae 0x404e8d
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.00407f40
mov rdx, qword [rsp + 0x50]
jmp 0x404eab
test rsi, rsi
jne 0x404eab
mov qword [rsp + 0x48], r13
lea rax, [rsp + 0x38]
cmp rdx, 8
cmovae rax, qword [rsp + 0x38]
mov word [rax], si
jmp 0x404ef2
test rsi, rsi
je 0x404ef2
lea rcx, [rsp + 0x38]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x38]
lea rdi, [rsi + rsi]
add rdx, rdx
mov r9, rdi
lea r8, [rsp + 0x218]
call fcn.00408f60
mov qword [rsp + 0x48], rsi
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rax, qword [rsp + 0x38]
mov word [rax + rdi], 0
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x108]
call fcn.00401270
nop
mov r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x140]
call fcn.00407060
nop
cmp qword [rsp + 0x128], 0x10
jb 0x404f3d
mov rcx, qword [rsp + 0x110]
call fcn.00408f50
mov word [rsp + 0x188], 0x6f
mov word [rsp + 0x18a], 0x68
mov word [rsp + 0x18c], 0x49
mov word [rsp + 0x18e], 0x76
mov word [rsp + 0x190], 0x69
mov word [rsp + 0x192], 0x79
mov word [rsp + 0x194], 0
mov word [rsp + 0x198], 0x64
mov word [rsp + 0x19a], 0x73
mov word [rsp + 0x19c], 0x46
mov word [rsp + 0x19e], 0x56
mov word [rsp + 0x1a0], 0x70
mov word [rsp + 0x1a2], 0x59
mov word [rsp + 0x1a4], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r13
mov word [rsp + 0x38], 0
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x198]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x198]
lea rcx, [rsp + 0x30]
call fcn.00407720
nop
mov qword [rsp + 0xb0], 7
mov qword [rsp + 0xa8], r13
mov word [rsp + 0x98], 0
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x188]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x90]
call fcn.00407720
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x108]
call fcn.00401270
mov rsi, rax
mov qword [rsp + 0x78], 0xf
mov qword [rsp + 0x70], r13
mov byte [rsp + 0x60], 0
mov r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x58]
call fcn.00407060
mov rcx, qword [rbx + 8]
test rcx, rcx
jne 0x4050c2
mov rdi, r13
jmp 0x4050c9
mov rdi, qword [rbx + 0x10]
sub rdi, rcx
test rcx, rcx
je 0x4050d7
mov rax, qword [rbx + 0x10]
sub rax, rcx
jne 0x4050dc
call fcn.004093e0
mov rbp, qword [rbx + 8]
cmp qword [rsi + 0x20], 0x10
jb 0x4050ed
mov rsi, qword [rsi + 8]
jmp 0x4050f1
add rsi, 8
lea rdx, [rsp + 0x58]
mov rcx, r12
call fcn.004019b0
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbp
mov r9d, 3
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x88]
call rax
test eax, eax
setne dil
cmp qword [rsp + 0x128], 0x10
jb 0x40513b
mov rcx, qword [rsp + 0x110]
call fcn.00408f50
test dil, dil
je 0x405193
cmp qword [rsp + 0x160], 0x10
jb 0x405158
mov rcx, qword [rsp + 0x148]
call fcn.00408f50
mov qword [rsp + 0x160], 0xf
mov qword [rsp + 0x158], r13
mov byte [rsp + 0x148], 0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x405182
call fcn.00408f50
mov qword [rbx + 8], r13
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
jmp 0x4053ce
mov word [rsp + 0x1e0], 0x54
mov word [rsp + 0x1e2], 0x68
mov word [rsp + 0x1e4], 0x68
mov word [rsp + 0x1e6], 0x57
mov word [rsp + 0x1e8], 0x6e
mov word [rsp + 0x1ea], 0x72
mov word [rsp + 0x1ec], 0x74
mov word [rsp + 0x1ee], 0x79
mov word [rsp + 0x1f0], 0x4d
mov word [rsp + 0x1f2], 0x68
mov word [rsp + 0x1f4], 0x7a
mov word [rsp + 0x1f6], 0
mov word [rsp + 0x168], 0x63
mov word [rsp + 0x16a], 0x64
mov word [rsp + 0x16c], 0x42
mov word [rsp + 0x16e], 0x55
mov word [rsp + 0x170], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r13
mov word [rsp + 0x38], 0
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x168]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x30]
call fcn.00407720
nop
mov qword [rsp + 0xb0], 7
mov qword [rsp + 0xa8], r13
mov word [rsp + 0x98], 0
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1e0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x90]
call fcn.00407720
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x108]
call fcn.00401270
nop
mov r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x140]
call fcn.00407060
nop
cmp qword [rsp + 0x128], 0x10
jb 0x40532a
mov rcx, qword [rsp + 0x110]
call fcn.00408f50
mov qword [rsp + 0xb0], 0xf
mov qword [rsp + 0xa8], r13
mov byte [rsp + 0x98], 0
mov r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x90]
call fcn.00407060
lea rdx, [rsp + 0x90]
mov rcx, r12
call fcn.004019b0
mov rcx, qword [rsp + 0x88]
call rax
nop
cmp qword [rsp + 0x160], 0x10
jb 0x405398
mov rcx, qword [rsp + 0x148]
call fcn.00408f50
mov qword [rsp + 0x160], 0xf
mov qword [rsp + 0x158], r13
mov byte [rsp + 0x148], 0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x4053c2
call fcn.00408f50
mov qword [rbx + 8], r13
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
mov rcx, qword [rsp + 0x238]
xor rcx, rsp
call fcn.00408d00
mov rbx, qword [rsp + 0x280]
mov rbp, qword [rsp + 0x288]
mov rsi, qword [rsp + 0x260]
mov rdi, qword [rsp + 0x258]
mov r12, qword [rsp + 0x250]
mov r13, qword [rsp + 0x248]
add rsp, 0x268
ret