Function at 0x482ed0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x79d352
mov eax, dword fs:[0]
push eax
sub esp, 0x200
mov eax, dword [0x82f184]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x84
lea eax, [ebp - 0xac]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [ebp - 0x144], 0
add esp, 0xc
mov dword [ebp - 0x140], 7
mov word [ebp - 0x154], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], eax
lea eax, [edi + 0x120]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x154]
call fcn.00403b80
lea eax, [ebp - 0x154]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0xac]
call fcn.0059cdf0
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 4
call fcn.00404220
lea ecx, [ebp - 0x154]
call fcn.00404490
push edi
lea ecx, [ebp - 0x28]
call fcn.00404120
xor eax, eax
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 0x1a0], 7
mov word [ebp - 0x1b4], ax
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x194], eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x1b4]
call fcn.00403b80
lea eax, [ebp - 0x1b4]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0xac]
call fcn.0059d630
lea ecx, [ebp - 0x19c]
call fcn.00404220
lea ecx, [ebp - 0x1b4]
call fcn.00404490
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.00404490
push edi
lea ecx, [ebp - 0x28]
call fcn.00404120
xor eax, eax
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 0x1a0], 7
mov word [ebp - 0x1b4], ax
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x194], eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x1b4]
call fcn.00403b80
push ecx
lea eax, [ebp - 0x1b4]
mov byte [ebp - 4], 0xc
push eax
lea ecx, [ebp - 0xac]
call fcn.0059d810
lea ecx, [ebp - 0x19c]
call fcn.00404220
lea ecx, [ebp - 0x1b4]
call fcn.00404490
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.00404490
lea ebx, [edi + 0xa8]
push ebx
lea ecx, [ebp - 0x28]
call fcn.00404120
xor eax, eax
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 0x1a0], 7
mov word [ebp - 0x1b4], ax
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x194], eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xf
push eax
lea ecx, [ebp - 0x1b4]
call fcn.00403b80
lea eax, [ebp - 0x1b4]
mov byte [ebp - 4], 0x10
push eax
lea ecx, [ebp - 0xac]
call fcn.0059d780
lea ecx, [ebp - 0x19c]
call fcn.00404220
lea ecx, [ebp - 0x1b4]
call fcn.00404490
lea ecx, [ebp - 0x28]
call fcn.00404490
lea ecx, [ebp - 0xac]
call fcn.0059ceb0
xor eax, eax
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x140], 7
mov word [ebp - 0x154], ax
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], eax
lea esi, [edi + 0x138]
mov byte [ebp - 4], 0x12
push esi
lea ecx, [ebp - 0x154]
call fcn.00403b80
lea eax, [ebp - 0x154]
mov dword [ebp - 4], 0x13
push eax
call fcn.00419200
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.00404220
lea ecx, [ebp - 0x154]
call fcn.00404490
mov eax, 4
mov dword [ebp - 0x160], 0xd50096
mov dword [ebp - 0x164], eax
xor ecx, ecx
mov dword [ebp - 0x15c], 0xd000d4
mov dword [ebp - 0x158], 0xbc
nop dword [eax]
nop word [eax + eax]
lea eax, [ecx + 0xb8]
xor word [ebp + ecx*2 - 0x160], ax
inc ecx
mov eax, dword [ebp - 0x164]
cmp ecx, eax
jb 0x4831e0
xor ecx, ecx
push 0x7cd374
mov word [ebp + eax*2 - 0x160], cx
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00421b40
lea ecx, [edi + 0x60]
mov dword [ebp - 4], 0x14
push ecx
mov edx, eax
lea ecx, [ebp - 0x1f4]
call fcn.00413520
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 0x15
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00408060
add esp, 0x1c
lea ecx, [ebp - 0x1f4]
call fcn.00404490
lea ecx, [ebp - 0x20c]
call fcn.00404490
push 0x84
lea eax, [ebp - 0x130]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [ebp - 0x180], 0
add esp, 0xc
mov dword [ebp - 0x17c], 7
mov word [ebp - 0x190], ax
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x170], eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x1a
push eax
lea ecx, [ebp - 0x190]
call fcn.00403b80
lea eax, [ebp - 0x190]
mov byte [ebp - 4], 0x1b
push eax
lea ecx, [ebp - 0x130]
call fcn.0059cdf0
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 0x1d
call fcn.00404220
lea ecx, [ebp - 0x190]
call fcn.00404490
push edi
lea ecx, [ebp - 0x16c]
call fcn.00404120
xor eax, eax
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x140], 7
mov word [ebp - 0x154], ax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], eax
lea eax, [ebp - 0x16c]
mov byte [ebp - 4], 0x20
push eax
lea ecx, [ebp - 0x154]
call fcn.00403b80
lea eax, [ebp - 0x154]
mov byte [ebp - 4], 0x21
push eax
lea ecx, [ebp - 0x130]
call fcn.0059d630
lea ecx, [ebp - 0x13c]
call fcn.00404220
lea ecx, [ebp - 0x154]
call fcn.00404490
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 0x1d
call fcn.00404490
push edi
lea ecx, [ebp - 0x16c]
call fcn.00404120
xor eax, eax
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x140], 7
mov word [ebp - 0x154], ax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], eax
lea eax, [ebp - 0x16c]
mov byte [ebp - 4], 0x24
push eax
lea ecx, [ebp - 0x154]
call fcn.00403b80
push ecx
lea eax, [ebp - 0x154]
mov byte [ebp - 4], 0x25
push eax
lea ecx, [ebp - 0x130]
call fcn.0059d810
lea ecx, [ebp - 0x13c]
call fcn.00404220
lea ecx, [ebp - 0x154]
call fcn.00404490
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 0x1d
call fcn.00404490
push ebx
lea ecx, [ebp - 0x16c]
call fcn.00404120
xor eax, eax
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x140], 7
mov word [ebp - 0x154], ax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], eax
lea eax, [ebp - 0x16c]
mov byte [ebp - 4], 0x28
push eax
lea ecx, [ebp - 0x154]
call fcn.00403b80
lea eax, [ebp - 0x154]
mov byte [ebp - 4], 0x29
push eax
lea ecx, [ebp - 0x130]
call fcn.0059d780
lea ecx, [ebp - 0x13c]
call fcn.00404220
lea ecx, [ebp - 0x154]
call fcn.00404490
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 0x1d
call fcn.00404490
lea ecx, [ebp - 0x28]
call fcn.00429660
push 0x84
push 0
lea eax, [ebp - 0xac]
push eax
call sub.VCRUNTIME140.dll_memset
mov ecx, 0xe
mov dword [ebp - 0x150], 0xec0098
add esp, 0xc
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x14c], 0xd200d4
xor eax, eax
mov dword [ebp - 0x148], 0xce00d2
mov dword [ebp - 0x144], 0xde00ca
mov dword [ebp - 0x140], 0xad00ac
mov dword [ebp - 0x13c], 0xaf00ec
mov dword [ebp - 0x138], 0xae00aa
mov dword [ebp - 0x134], 0xc6
nop dword [eax]
nop word [eax + eax]
lea ecx, [eax + 0xb8]
xor word [ebp + eax*2 - 0x150], cx
inc eax
mov ecx, dword [ebp - 0x154]
cmp eax, ecx
jb 0x483510
xor eax, eax
push 0x7cd374
mov word [ebp + ecx*2 - 0x150], ax
lea eax, [ebp - 0x1a8]
push esi
push eax
call fcn.00421b40
lea ebx, [edi + 0x60]
mov byte [ebp - 4], 0x2a
push ebx
mov edx, eax
lea ecx, [ebp - 0x1f4]
call fcn.00413520
lea ecx, [ebp - 0x150]
mov byte [ebp - 4], 0x2b
push ecx
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00408060
add esp, 0x1c
xor ecx, ecx
mov dword [ebp - 0x1c8], 0
mov dword [ebp - 0x1c4], 7
mov word [ebp - 0x1d8], cx
mov dword [ebp - 0x1c0], ecx
mov dword [ebp - 0x1bc], ecx
mov dword [ebp - 0x1b8], ecx
push eax
lea ecx, [ebp - 0x1d8]
mov byte [ebp - 4], 0x2e
call fcn.00403b80
lea eax, [ebp - 0x1d8]
mov byte [ebp - 4], 0x2f
push eax
lea ecx, [ebp - 0xac]
call fcn.0059cdf0
lea ecx, [ebp - 0x1c0]
call fcn.00404220
lea ecx, [ebp - 0x1d8]
call fcn.00404490
lea ecx, [ebp - 0x20c]
call fcn.00404490
lea ecx, [ebp - 0x1f4]
call fcn.00404490
lea ecx, [ebp - 0x1a8]
mov byte [ebp - 4], 0x34
call fcn.00404490
lea esi, [edi + 0x18]
push esi
lea ecx, [ebp - 0x16c]
call fcn.00404120
xor eax, eax
mov dword [ebp - 0x180], 0
mov dword [ebp - 0x17c], 7
mov word [ebp - 0x190], ax
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x170], eax
lea eax, [ebp - 0x16c]
mov byte [ebp - 4], 0x37
push eax
lea ecx, [ebp - 0x190]
call fcn.00403b80
mov byte [ebp - 4], 0x38
lea eax, [ebp - 0x190]
push eax
lea ecx, [ebp - 0xac]
call fcn.0059d630
lea ecx, [ebp - 0x178]
call fcn.00404220
lea ecx, [ebp - 0x190]
call fcn.00404490
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 0x34
call fcn.00404490
sub esp, 0x18
lea eax, [edi + 0x30]
mov ecx, esp
push eax
call fcn.00404120
lea ecx, [ebp - 0xac]
call fcn.0059d6c0
push esi
lea ecx, [ebp - 0x16c]
call fcn.00404120
xor eax, eax
mov dword [ebp - 0x180], 0
mov dword [ebp - 0x17c], 7
mov word [ebp - 0x190], ax
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x170], eax
lea eax, [ebp - 0x16c]
mov byte [ebp - 4], 0x3b
push eax
lea ecx, [ebp - 0x190]
call fcn.00403b80
push ecx
lea eax, [ebp - 0x190]
mov byte [ebp - 4], 0x3c
push eax
lea ecx, [ebp - 0xac]
call fcn.0059d810
lea ecx, [ebp - 0x178]
call fcn.00404220
lea ecx, [ebp - 0x190]
call fcn.00404490
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 0x34
call fcn.00404490
lea eax, [ebp - 0x148]
mov ecx, esi
push eax
call fcn.00414d60
push eax
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 0x3d
call fcn.00404120
xor eax, eax
mov dword [ebp - 0x180], 0
mov dword [ebp - 0x17c], 7
mov word [ebp - 0x190], ax
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x170], eax
lea eax, [ebp - 0x16c]
mov byte [ebp - 4], 0x40
push eax
lea ecx, [ebp - 0x190]
call fcn.00403b80
lea eax, [ebp - 0x190]
mov byte [ebp - 4], 0x41
push eax
lea ecx, [ebp - 0xac]
call fcn.0059d780
lea ecx, [ebp - 0x178]
call fcn.00404220
lea ecx, [ebp - 0x190]
call fcn.00404490
lea ecx, [ebp - 0x16c]
call fcn.00404490
lea ecx, [ebp - 0x148]
call fcn.00404490
lea ecx, [ebp - 0xac]
call fcn.0059ceb0
lea ecx, [ebp - 0x130]
call fcn.0059ceb0
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.00404490
lea eax, [edi + 0x150]
push eax
lea eax, [edi + 0x48]
push eax
push ebx
call fcn.00481760
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0076d59e
mov esp, ebp
pop ebp
ret 0xc