Function at 0x412322
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
mov eax, 0x499b57
call fcn.00489db4
sub esp, 0xa8
push ebx
push esi
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.0045fb61
pop ecx
mov eax, dword [ebp - 0x14]
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [eax - 8], esi
je 0x41267d
mov word [ebp - 0xb0], 0x36
mov word [ebp - 0xae], 0x1c
mov word [ebp - 0xac], 1
mov word [ebp - 0xaa], 0x2b
mov word [ebp - 0xa8], 0x4d
mov word [ebp - 0xa6], 0x2c
mov word [ebp - 0xa4], 0x2d
mov word [ebp - 0xa2], 0x23
mov word [ebp - 0xa0], 0x45
mov word [ebp - 0x9e], 2
mov word [ebp - 0x9c], 3
mov word [ebp - 0x9a], 4
mov word [ebp - 0x98], 0x1a
mov word [ebp - 0x96], 5
mov word [ebp - 0x94], 6
mov word [ebp - 0x92], 0x65
mov word [ebp - 0x90], 0x13
mov word [ebp - 0x8e], 9
mov word [ebp - 0x8c], 0x25
mov word [ebp - 0x8a], 0x38
mov word [ebp - 0x88], 0x29
mov word [ebp - 0x86], 0xb
mov word [ebp - 0x84], 0xc
mov word [ebp - 0x82], 0x56
mov word [ebp - 0x80], 0x37
mov word [ebp - 0x7e], 7
mov word [ebp - 0x7c], 8
mov word [ebp - 0x7a], 0x47
mov word [ebp - 0x78], 0xd
mov word [ebp - 0x76], 0x39
mov word [ebp - 0x74], 0xe
mov word [ebp - 0x72], 0xf
mov word [ebp - 0x70], 0x21
mov word [ebp - 0x6e], 0x10
mov word [ebp - 0x6c], 0x11
mov word [ebp - 0x6a], 0x4b
mov word [ebp - 0x68], 0x60
mov word [ebp - 0x66], 0x3f
mov word [ebp - 0x64], 0x57
mov word [ebp - 0x62], 0x12
mov word [ebp - 0x60], 0x40
mov word [ebp - 0x5e], 0x26
mov word [ebp - 0x5c], 0x27
mov word [ebp - 0x5a], 0x2f
mov word [ebp - 0x58], 0x3e
mov word [ebp - 0x56], 0x4c
mov word [ebp - 0x54], 0x58
mov word [ebp - 0x52], 0x4e
mov word [ebp - 0x50], 0x50
mov word [ebp - 0x4e], 0x61
mov word [ebp - 0x4c], 0x14
mov word [ebp - 0x4a], 0x48
mov word [ebp - 0x48], 0x15
mov word [ebp - 0x46], 0x16
mov word [ebp - 0x44], 0x46
mov word [ebp - 0x42], 0x18
mov word [ebp - 0x40], 0x19
mov word [ebp - 0x3e], 0x4f
mov word [ebp - 0x3c], 0x1a
mov word [ebp - 0x3a], 0x59
mov word [ebp - 0x38], 0x1b
mov word [ebp - 0x36], 0x24
mov word [ebp - 0x34], 0xa
mov word [ebp - 0x32], 0x41
mov word [ebp - 0x30], 0x1d
mov word [ebp - 0x2e], 0x5a
mov word [ebp - 0x2c], 0x49
mov word [ebp - 0x2a], 0x44
mov word [ebp - 0x28], 0x4a
mov word [ebp - 0x26], 0x1e
mov word [ebp - 0x24], 0x1f
mov word [ebp - 0x22], 0x22
mov word [ebp - 0x20], 0x20
mov word [ebp - 0x1e], 0x43
mov word [ebp - 0x1c], 0x2a
mov dword [ebp - 0x18], esi
lea edi, [ebp - 0xb0]
mov si, word [edi]
mov eax, dword [0x4bf1a0]
movzx ebx, si
mov dword [ebp - 0x10], eax
push 0x65
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00401885
test eax, eax
je 0x41259b
mov eax, dword [ebp - 0x10]
mov dword [eax - 8], 0x65
mov eax, dword [ebp - 0x10]
and word [eax + 0xca], 0
mov eax, dword [ebp - 0x10]
push 0x64
push eax
push 0x59
push ebx
call dword [0x4a6338]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004018ed
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.0048a2c5
pop ecx
test eax, eax
pop ecx
je 0x412626
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], 2
jle 0x4125f8
lea eax, [ebp - 0xb4]
push 2
push eax
lea ecx, [ebp - 0x10]
call fcn.00404571
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.004016cb
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 1
call fcn.00401605
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.0048a2c5
pop ecx
test eax, eax
pop ecx
je 0x412626
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00401605
inc dword [ebp - 0x18]
inc edi
inc edi
cmp dword [ebp - 0x18], 0x4b
jl 0x412563
jmp 0x412637
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00401605
test si, si
jne 0x41263b
xor esi, esi
jmp 0x41267d
push str.kernel32.dll
call dword [0x4a63d0]
test eax, eax
je 0x412637
push str.SetThreadUILanguage
push eax
call dword [0x4a63bc]
test eax, eax
je 0x412637
or esi, 0x400
push esi
call eax
xor ecx, ecx
test ax, ax
setne cl
mov edi, ecx
test edi, edi
je 0x41267b
movzx eax, si
push eax
call dword [0x4a631c]
mov esi, edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401605
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret