Function at 0x401000
Capabilities:
Contain obfuscated stackstrings
Encode data using base64

Disassembly:
push 0xffffffffffffffff
push 0x41e3ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x94
push ebx
push ebp
mov ebp, dword [esp + 0xb0]
xor ebx, ebx
push esi
cmp ebp, ebx
push edi
mov dword [esp + 0x14], ebx
jne 0x401089
mov ebp, dword [esp + 0xb4]
mov al, byte [esp + 0x13]
xor edi, edi
or ecx, 0xffffffff
mov byte [ebp], al
xor eax, eax
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
mov ecx, ebp
push ebx
call fcn.00401e50
test al, al
je 0x4018e6
mov edi, dword [ebp + 4]
mov ecx, ebx
mov edx, ecx
xor esi, esi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebp
call fcn.00401e30
jmp 0x4018e6
mov esi, dword [esp + 0xc0]
mov byte [esp + 0x28], bl
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], bl
mov dword [esi], ebx
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], bl
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], bl
mov byte [esp + 0x2f], bl
mov byte [esp + 0x30], bl
mov byte [esp + 0x31], bl
mov byte [esp + 0x32], bl
mov byte [esp + 0x33], bl
mov byte [esp + 0x34], bl
mov byte [esp + 0x35], bl
mov byte [esp + 0x36], bl
mov byte [esp + 0x37], bl
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], bl
mov byte [esp + 0x3e], bl
mov byte [esp + 0x3f], bl
mov byte [esp + 0x40], bl
mov byte [esp + 0x41], bl
mov byte [esp + 0x42], bl
mov byte [esp + 0x43], bl
mov byte [esp + 0x44], bl
mov byte [esp + 0x45], bl
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], bl
mov byte [esp + 0x48], bl
mov byte [esp + 0x49], bl
mov byte [esp + 0x4a], bl
mov byte [esp + 0x4b], bl
mov byte [esp + 0x4c], bl
mov byte [esp + 0x4d], bl
mov byte [esp + 0x4e], bl
mov byte [esp + 0x4f], bl
mov byte [esp + 0x50], bl
mov byte [esp + 0x51], bl
mov byte [esp + 0x52], bl
mov byte [esp + 0x53], 0x3e
mov byte [esp + 0x54], bl
mov byte [esp + 0x55], bl
mov byte [esp + 0x56], bl
mov byte [esp + 0x57], 0x3f
mov byte [esp + 0x58], 0x34
mov byte [esp + 0x59], 0x35
mov byte [esp + 0x5a], 0x36
mov byte [esp + 0x5b], 0x37
mov byte [esp + 0x5c], 0x38
mov byte [esp + 0x5d], 0x39
mov byte [esp + 0x5e], 0x3a
mov byte [esp + 0x5f], 0x3b
mov byte [esp + 0x60], 0x3c
mov byte [esp + 0x61], 0x3d
mov byte [esp + 0x62], bl
mov byte [esp + 0x63], bl
mov byte [esp + 0x64], bl
mov byte [esp + 0x65], bl
mov byte [esp + 0x66], bl
mov byte [esp + 0x67], bl
mov byte [esp + 0x68], bl
mov byte [esp + 0x69], bl
mov byte [esp + 0x6a], 1
mov byte [esp + 0x6b], 2
mov byte [esp + 0x6c], 3
mov byte [esp + 0x6d], 4
mov byte [esp + 0x6e], 5
mov byte [esp + 0x6f], 6
mov byte [esp + 0x70], 7
mov byte [esp + 0x71], 8
mov byte [esp + 0x72], 9
mov byte [esp + 0x73], 0xa
mov byte [esp + 0x74], 0xb
mov byte [esp + 0x75], 0xc
mov byte [esp + 0x76], 0xd
mov al, byte [esp + 0x13]
mov edi, 0x4290a0
mov byte [esp + 0x18], al
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + 0x7b], 0xe
mov edi, ecx
lea ecx, [esp + 0x1c]
push edi
mov byte [esp + 0x80], 0xf
mov byte [esp + 0x81], 0x10
mov byte [esp + 0x82], 0x11
mov byte [esp + 0x83], 0x12
mov byte [esp + 0x84], 0x13
mov byte [esp + 0x85], 0x14
mov byte [esp + 0x86], 0x15
mov byte [esp + 0x87], 0x16
mov byte [esp + 0x88], 0x17
mov byte [esp + 0x89], 0x18
mov byte [esp + 0x8a], 0x19
mov byte [esp + 0x8b], bl
mov byte [esp + 0x8c], bl
mov byte [esp + 0x8d], bl
mov byte [esp + 0x8e], bl
mov byte [esp + 0x8f], bl
mov byte [esp + 0x90], bl
mov byte [esp + 0x91], 0x1a
mov byte [esp + 0x92], 0x1b
mov byte [esp + 0x93], 0x1c
mov byte [esp + 0x94], 0x1d
mov byte [esp + 0x95], 0x1e
mov byte [esp + 0x96], 0x1f
mov byte [esp + 0x97], 0x20
mov byte [esp + 0x98], 0x21
mov byte [esp + 0x99], 0x22
mov byte [esp + 0x9a], 0x23
mov byte [esp + 0x9b], 0x24
mov byte [esp + 0x9c], 0x25
mov byte [esp + 0x9d], 0x26
mov byte [esp + 0x9e], 0x27
mov byte [esp + 0x9f], 0x28
mov byte [esp + 0xa0], 0x29
mov byte [esp + 0xa1], 0x2a
mov byte [esp + 0xa2], 0x2b
mov byte [esp + 0xa3], 0x2c
mov byte [esp + 0xa4], 0x2d
mov byte [esp + 0xa5], 0x2e
mov byte [esp + 0xa6], 0x2f
mov byte [esp + 0xa7], 0x30
mov byte [esp + 0xa8], 0x31
mov byte [esp + 0xa9], 0x32
mov byte [esp + 0xaa], 0x33
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], edi
call fcn.00401e50
test al, al
je 0x4013a3
mov ecx, edi
mov edi, dword [esp + 0x1c]
mov edx, ecx
mov esi, 0x4290a0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
call fcn.00401e30
mov esi, dword [esp + 0xc0]
mov eax, dword [esp + 0xbc]
mov dword [esp + 0xac], ebx
cdq
and edx, 3
add eax, edx
sar eax, 2
dec eax
cmp eax, ebx
jle 0x401521
mov esi, eax
movsx ecx, byte [ebp]
movsx edx, byte [ebp + 1]
mov al, byte [esp + ecx + 0x28]
inc ebp
mov cl, byte [esp + edx + 0x28]
inc ebp
mov byte [esp + 0x15], cl
movsx edx, byte [ebp]
inc ebp
mov dl, byte [esp + edx + 0x28]
inc ebp
mov byte [esp + 0x16], dl
movsx edx, byte [ebp - 1]
shr cl, 4
mov dl, byte [esp + edx + 0x28]
and cl, 3
shl al, 2
mov byte [esp + 0x17], dl
mov edx, dword [esp + 0x20]
or cl, al
mov eax, dword [0x4201d8]
sub eax, edx
mov byte [esp + 0x13], cl
cmp eax, 1
ja 0x401419
call fcn.004059fb
mov ecx, dword [esp + 0x20]
push ebx
lea edi, [ecx + 1]
lea ecx, [esp + 0x1c]
push edi
call fcn.00401e50
test al, al
je 0x40144d
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
movsx edx, byte [esp + 0x13]
add ecx, eax
mov dh, dl
mov byte [ecx], dl
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], edi
mov byte [ecx + edi], bl
mov al, byte [esp + 0x16]
mov cl, byte [esp + 0x15]
mov edx, dword [0x4201d8]
shr al, 2
and al, 0xf
shl cl, 4
or al, cl
mov ecx, dword [esp + 0x20]
sub edx, ecx
mov byte [esp + 0x13], al
cmp edx, 1
ja 0x401479
call fcn.004059fb
mov eax, dword [esp + 0x20]
push ebx
lea ecx, [esp + 0x1c]
lea edi, [eax + 1]
push edi
call fcn.00401e50
test al, al
je 0x4014ad
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
movsx ecx, byte [esp + 0x13]
add eax, edx
mov ch, cl
mov byte [eax], cl
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], edi
mov byte [eax + edi], bl
mov al, byte [esp + 0x17]
mov cl, byte [esp + 0x16]
mov edx, dword [esp + 0x20]
and al, 0x3f
shl cl, 6
or al, cl
mov ecx, dword [0x4201d8]
sub ecx, edx
mov byte [esp + 0x13], al
cmp ecx, 1
ja 0x4014d6
call fcn.004059fb
mov edx, dword [esp + 0x20]
push ebx
lea ecx, [esp + 0x1c]
lea edi, [edx + 1]
push edi
call fcn.00401e50
test al, al
je 0x40150a
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
movsx eax, byte [esp + 0x13]
add edx, ecx
mov ah, al
mov byte [edx], al
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x20], edi
mov byte [edx + edi], bl
mov eax, dword [esp + 0xc0]
mov ecx, dword [eax]
add ecx, 3
dec esi
mov dword [eax], ecx
jne 0x4013c5
mov esi, eax
mov al, byte [ebp + 2]
cmp al, 0x3d
jne 0x4015a4
cmp byte [ebp + 3], al
jne 0x40159c
movsx eax, byte [ebp]
movsx edx, byte [ebp + 1]
mov cl, byte [esp + eax + 0x28]
mov al, byte [esp + edx + 0x28]
mov edx, dword [esp + 0x20]
shr al, 4
and al, 3
shl cl, 2
or al, cl
mov byte [esp + 0x13], al
mov eax, dword [0x4201d8]
sub eax, edx
cmp eax, 1
ja 0x401560
call fcn.004059fb
mov ecx, dword [esp + 0x20]
push ebx
lea edi, [ecx + 1]
lea ecx, [esp + 0x1c]
push edi
call fcn.00401e50
test al, al
je 0x401594
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
movsx edx, byte [esp + 0x13]
add ecx, eax
mov dh, dl
mov byte [ecx], dl
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], edi
mov byte [ecx + edi], bl
mov eax, dword [esi]
inc eax
jmp 0x4017eb
cmp al, 0x3d
je 0x4017ed
cmp byte [ebp + 3], 0x3d
jne 0x401691
movsx edx, byte [ebp]
movsx ecx, byte [ebp + 1]
mov al, byte [esp + edx + 0x28]
inc ebp
mov cl, byte [esp + ecx + 0x28]
movsx edx, byte [ebp + 1]
mov byte [esp + 0x15], cl
mov dl, byte [esp + edx + 0x28]
shr cl, 4
and cl, 3
mov byte [esp + 0x16], dl
mov edx, dword [esp + 0x20]
shl al, 2
or cl, al
mov eax, dword [0x4201d8]
sub eax, edx
mov byte [esp + 0x13], cl
cmp eax, 1
ja 0x4015f3
call fcn.004059fb
mov ecx, dword [esp + 0x20]
push ebx
lea edi, [ecx + 1]
lea ecx, [esp + 0x1c]
push edi
call fcn.00401e50
test al, al
je 0x401627
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
movsx edx, byte [esp + 0x13]
add ecx, eax
mov dh, dl
mov byte [ecx], dl
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], edi
mov byte [ecx + edi], bl
mov al, byte [esp + 0x16]
mov cl, byte [esp + 0x15]
mov edx, dword [0x4201d8]
shr al, 2
and al, 0xf
shl cl, 4
or al, cl
mov ecx, dword [esp + 0x20]
sub edx, ecx
mov byte [esp + 0x13], al
cmp edx, 1
ja 0x401653
call fcn.004059fb
mov eax, dword [esp + 0x20]
push ebx
lea ecx, [esp + 0x1c]
lea edi, [eax + 1]
push edi
call fcn.00401e50
test al, al
je 0x401687
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
movsx ecx, byte [esp + 0x13]
add eax, edx
mov ch, cl
mov byte [eax], cl
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], edi
mov byte [eax + edi], bl
mov eax, dword [esi]
add eax, 2
jmp 0x4017eb
cmp al, 0x3d
je 0x4017ed
cmp byte [ebp + 3], 0x3d
je 0x4017ed
movsx ecx, byte [ebp]
movsx edx, byte [ebp + 1]
mov al, byte [esp + ecx + 0x28]
inc ebp
mov cl, byte [esp + edx + 0x28]
inc ebp
mov byte [esp + 0x15], cl
movsx edx, byte [ebp]
shr cl, 4
mov dl, byte [esp + edx + 0x28]
and cl, 3
mov byte [esp + 0x16], dl
movsx edx, byte [ebp + 1]
shl al, 2
mov dl, byte [esp + edx + 0x28]
or cl, al
mov eax, dword [0x4201d8]
mov byte [esp + 0x17], dl
mov edx, dword [esp + 0x20]
mov byte [esp + 0x13], cl
sub eax, edx
cmp eax, 1
ja 0x4016f5
call fcn.004059fb
mov ecx, dword [esp + 0x20]
push ebx
lea edi, [ecx + 1]
lea ecx, [esp + 0x1c]
push edi
call fcn.00401e50
test al, al
je 0x401729
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
movsx edx, byte [esp + 0x13]
add ecx, eax
mov dh, dl
mov byte [ecx], dl
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], edi
mov byte [ecx + edi], bl
mov al, byte [esp + 0x16]
mov cl, byte [esp + 0x15]
mov edx, dword [0x4201d8]
shr al, 2
and al, 0xf
shl cl, 4
or al, cl
mov ecx, dword [esp + 0x20]
sub edx, ecx
mov byte [esp + 0x13], al
cmp edx, 1
ja 0x401755
call fcn.004059fb
mov eax, dword [esp + 0x20]
push ebx
lea ecx, [esp + 0x1c]
lea edi, [eax + 1]
push edi
call fcn.00401e50
test al, al
je 0x401789
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
movsx ecx, byte [esp + 0x13]
add eax, edx
mov ch, cl
mov byte [eax], cl
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], edi
mov byte [eax + edi], bl
mov al, byte [esp + 0x17]
mov cl, byte [esp + 0x16]
mov edx, dword [esp + 0x20]
and al, 0x3f
shl cl, 6
or al, cl
mov ecx, dword [0x4201d8]
sub ecx, edx
mov byte [esp + 0x13], al
cmp ecx, 1
ja 0x4017b2
call fcn.004059fb
mov edx, dword [esp + 0x20]
push ebx
lea ecx, [esp + 0x1c]
lea edi, [edx + 1]
push edi
call fcn.00401e50
test al, al
je 0x4017e6
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
movsx eax, byte [esp + 0x13]
add edx, ecx
mov ah, al
mov byte [edx], al
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x20], edi
mov byte [edx + edi], bl
mov eax, dword [esi]
add eax, 3
mov dword [esi], eax
mov ebp, dword [esp + 0xb4]
mov al, byte [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov byte [ebp], al
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
mov eax, dword [0x4201d8]
mov edi, ecx
cmp eax, edi
mov dword [esp + 0x14], edi
jae 0x40181d
mov dword [esp + 0x14], eax
mov edi, eax
lea edx, [esp + 0x18]
cmp ebp, edx
jne 0x40183c
push eax
push edi
mov ecx, ebp
call fcn.00401d10
push ebx
push ebx
mov ecx, ebp
call fcn.00401d10
jmp 0x4018c2
cmp edi, ebx
jbe 0x401888
cmp edi, ecx
jne 0x401888
mov eax, dword [esp + 0x1c]
cmp eax, ebx
jne 0x401851
mov eax, 0x4201dc
cmp byte [eax - 1], 0xfe
jae 0x401888
push 1
mov ecx, ebp
call fcn.00401c20
mov eax, dword [esp + 0x1c]
cmp eax, ebx
jne 0x40186d
mov eax, 0x4201dc
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [ebp + 4], eax
mov dword [ebp + 8], ecx
mov dword [ebp + 0xc], edx
mov cl, byte [eax - 1]
inc cl
mov byte [eax - 1], cl
jmp 0x4018c2
push 1
push edi
mov ecx, ebp
call fcn.00401e50
test al, al
je 0x4018c2
mov esi, dword [esp + 0x1c]
cmp esi, ebx
jne 0x4018a3
mov esi, 0x4201dc
mov ecx, edi
mov edi, dword [ebp + 4]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, ebp
call fcn.00401e30
mov ecx, dword [esp + 0x1c]
cmp ecx, ebx
je 0x4018e6
mov al, byte [ecx - 1]
cmp al, bl
je 0x4018dc
cmp al, 0xff
je 0x4018dc
dec al
mov byte [ecx - 1], al
jmp 0x4018e6
dec ecx
push ecx
call fcn.004059f0
add esp, 4
mov ecx, dword [esp + 0xa4]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xa0
ret 0x10