Function at 0x40163a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x90
call fcn.004028e0
mov dword [esp], 0x5d8a0577
mov dword [esp + 4], 0x1634578
call fcn.00401510
mov dword [esp], 0x5d8a0657
mov dword [esp + 4], 0x1634578
call fcn.00401510
mov dword [esp], 0xa7640801
mov dword [esp + 4], 0xde0b6b3
call fcn.00401510
mov dword [esp], 0xa76406c1
mov dword [esp + 4], 0xde0b6b3
call fcn.00401510
mov dword [esp], 0xa76409bd
mov dword [esp + 4], 0xde0b6b3
call fcn.00401510
mov dword [esp], 0xa764090f
mov dword [esp + 4], 0xde0b6b3
call fcn.00401510
mov dword [esp], 0x5d8a0625
mov dword [esp + 4], 0x1634578
call fcn.00401510
mov dword [esp], 0xa76408df
mov dword [esp + 4], 0xde0b6b3
call fcn.00401510
mov dword [esp], 0x5d8a076f
mov dword [esp + 4], 0x1634578
call fcn.00401510
mov dword [ebp - 0x5c], str.0082e8fc_0000_8960_e531_c0648b50308b
mov dword [ebp - 0x58], str.528b0c52_8b14_2872_0fb7_4a2631ffac3c
mov dword [ebp - 0x54], str.2c027c61_c120_0dcf_01c7_e2f252578b52
mov dword [ebp - 0x50], str.3c4a8b10_4c8b_7811_e348_01d1518b5920
mov dword [ebp - 0x4c], str.498bd301_e318_493a_8b34_8b01d631ffac
mov dword [ebp - 0x48], str.010dcfc1_38c7_75e0_f603_7df83b7d2475
mov dword [ebp - 0x44], str.588b58e4_0124_66d3_8b0c_4b8b581c01d3
mov dword [ebp - 0x40], str.018b048b_89d0_2444_245b_5b61595a51ff
mov dword [ebp - 0x3c], str.5a5f5fe0_128b_8deb_5d6a_018d85b20000
mov dword [ebp - 0x38], str.31685000_6f8b_ff87_d5bb_f0b5a25668a6
mov dword [ebp - 0x34], str.ff9dbd95_3cd5_7c06_0a80_fbe07505bb47
mov dword [ebp - 0x30], str.6a6f7213_5300_d5ff_6361_6c632e657865
mov dword [ebp - 0x2c], str.00000000_0000_0000_0000_000000000000
mov dword [ebp - 0x10], 0xd
mov eax, dword [ebp - 0x10]
shl eax, 4
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40178b
mov eax, 0xffffffff
jmp 0x4018f1
mov dword [ebp - 0xc], 0
jmp 0x4017db
mov eax, dword [ebp - 0xc]
shl eax, 4
mov edx, eax
mov eax, dword [ebp - 0x14]
add edx, eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x5c]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.RPCRT4.dll_UuidFromStringA]
call eax
sub esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4017d7
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, 0xffffffff
jmp 0x4018f1
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jl 0x401794
mov eax, dword [ebp - 0x10]
shl eax, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x6d], 0x31414c67
mov dword [ebp - 0x69], 0x6d637135
mov dword [ebp - 0x65], 0x36315551
mov dword [ebp - 0x61], 0x305a677a
mov byte [ebp - 0x5d], 0
mov dword [ebp - 0x20], 0x11
mov eax, dword [ebp - 0x20]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x6d]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.004015d4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x78], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
call eax
sub esp, 4
mov dword [ebp - 0x24], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov edx, eax
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], 0x3000
lea eax, [ebp - 0x74]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
lea eax, [ebp - 0x78]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.004023bf
mov ebx, dword [ebp - 0x78]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov edx, eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], edx
call fcn.00402376
mov eax, dword [ebp - 0x78]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateFiber]
call eax
sub esp, 0xc
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SwitchToFiber]
call eax
sub esp, 4
mov eax, 0
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret