Function at 0x41f920
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x57d54c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], esi
push edi
test esi, esi
je 0x41fcc7
call fcn.00407550
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov eax, dword [edi + 4]
test eax, eax
je 0x41f976
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0x52727453
push ecx
push eax
mov dword [ebp - 0xc], 0x49726843
mov word [ebp - 8], 0x41
call ebx
mov dword [edi + 0x28], eax
mov eax, dword [edi + 0x28]
push 0x5f
push 0
push esi
call eax
mov edi, eax
mov dword [ebp - 0x2c], 0x463525
call fcn.00407550
mov dword [ebp - 0x40], eax
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41f9bb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x52727453
push eax
push ecx
mov dword [ebp - 0xc], 0x49727453
mov word [ebp - 8], 0x41
call ebx
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x24], eax
mov eax, ecx
mov eax, dword [eax + 0x24]
lea ecx, [ebp - 0x2c]
push ecx
push 0
push esi
call eax
test edi, edi
je 0x41f9d6
test eax, eax
je 0x41f9d8
cmp edi, eax
cmovb edi, eax
jmp 0x41f9d8
mov edi, eax
call fcn.00407550
mov dword [ebp - 0x40], eax
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41fa0a
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x52727453
push eax
push ecx
mov dword [ebp - 0xc], 0x49726843
mov word [ebp - 8], 0x41
call ebx
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x28], eax
mov eax, ecx
mov eax, dword [eax + 0x28]
push 0x76
push 0
push esi
call eax
mov esi, eax
mov dword [ebp - 0x30], 0x363725
call fcn.00407550
mov dword [ebp - 0x40], eax
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41fa4f
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x52727453
push eax
push ecx
mov dword [ebp - 0xc], 0x49727453
mov word [ebp - 8], 0x41
call ebx
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x24], eax
mov eax, ecx
mov eax, dword [eax + 0x24]
lea ecx, [ebp - 0x30]
push ecx
push 0
push dword [ebp - 0x44]
call eax
test esi, esi
je 0x41fa6c
test eax, eax
je 0x41fa6e
cmp esi, eax
cmovb esi, eax
jmp 0x41fa6e
mov esi, eax
test edi, edi
je 0x41fca1
test esi, esi
je 0x41fa82
cmp edi, esi
jb 0x41fca5
call fcn.00407550
mov esi, eax
mov eax, dword [esi + 4]
test eax, eax
je 0x41faae
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0x52727453
push ecx
push eax
mov dword [ebp - 0xc], 0x49726843
mov word [ebp - 8], 0x41
call ebx
mov dword [esi + 0x28], eax
mov edi, dword [ebp - 0x44]
mov eax, dword [esi + 0x28]
push 0x5f
push 0
push edi
call eax
mov ebx, eax
mov dword [ebp - 0x34], 0x463525
call fcn.00407550
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x40], eax
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41fafc
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x52727453
push eax
push ecx
mov dword [ebp - 0x24], 0x49727453
mov word [ebp - 0x20], 0x41
call esi
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x24], eax
mov eax, ecx
mov eax, dword [eax + 0x24]
lea ecx, [ebp - 0x34]
push ecx
push 0
push edi
call eax
test ebx, ebx
je 0x41fb17
test eax, eax
je 0x41fb21
cmp ebx, eax
cmovb ebx, eax
jmp 0x41fb21
test eax, eax
je 0x41fcc7
mov ebx, eax
call fcn.00407550
mov dword [ebp - 0x40], eax
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41fb53
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x52727453
push eax
push ecx
mov dword [ebp - 0x18], 0x49726843
mov word [ebp - 0x14], 0x41
call esi
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x28], eax
mov eax, ecx
mov eax, dword [eax + 0x28]
push 0x5f
push ebx
push edi
call eax
mov edi, eax
mov dword [ebp - 0x38], 0x463525
call fcn.00407550
mov dword [ebp - 0x40], eax
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41fb97
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x52727453
push eax
push ecx
mov dword [ebp - 0x18], 0x49727453
mov word [ebp - 0x14], 0x41
call esi
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x24], eax
mov eax, ecx
mov eax, dword [eax + 0x24]
lea ecx, [ebp - 0x38]
push ecx
push ebx
push dword [ebp - 0x44]
call eax
test edi, edi
je 0x41fbb3
test eax, eax
je 0x41fbb5
cmp edi, eax
cmovb edi, eax
jmp 0x41fbb5
mov edi, eax
call fcn.00407550
mov dword [ebp - 0x40], eax
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41fbe7
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x52727453
push eax
push ecx
mov dword [ebp - 0x18], 0x49726843
mov word [ebp - 0x14], 0x41
call esi
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x28], eax
mov eax, ecx
mov eax, dword [eax + 0x28]
push 0x40
push ebx
push dword [ebp - 0x44]
call eax
mov esi, eax
mov dword [ebp - 0x3c], 0x303425
call fcn.00407550
mov dword [ebp - 0x40], eax
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41fc31
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x52727453
push eax
push ecx
mov dword [ebp - 0x18], 0x49727453
mov word [ebp - 0x14], 0x41
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x24], eax
mov eax, ecx
mov eax, dword [eax + 0x24]
lea ecx, [ebp - 0x3c]
push ecx
push ebx
push dword [ebp - 0x44]
call eax
test esi, esi
je 0x41fc4d
test eax, eax
je 0x41fc4f
cmp esi, eax
cmovb esi, eax
jmp 0x41fc4f
mov esi, eax
test edi, edi
je 0x41fc88
test esi, esi
je 0x41fc71
cmp edi, esi
cmovae esi, edi
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00501e95
mov esp, ebp
pop ebp
ret 4
mov esi, edi
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00501e95
mov esp, ebp
pop ebp
ret 4
test esi, esi
je 0x41fcc7
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00501e95
mov esp, ebp
pop ebp
ret 4
test esi, esi
je 0x41fcc7
mov eax, dword [ebp - 0x48]
mov dword [eax + 0xa4], 1
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00501e95
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00501e95
mov esp, ebp
pop ebp
ret 4