Function at 0x403f00
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40e1f8
push 0x40d946
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2d0
push ebx
push esi
push edi
xor edi, edi
push edi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
call esi
mov byte [ebp - 0x2d4], 0x52
mov byte [ebp - 0x2d3], 0x45
mov byte [ebp - 0x2d2], 0x47
mov byte [ebp - 0x2d1], 0x5f
mov al, 0x44
mov byte [ebp - 0x2d0], al
mov byte [ebp - 0x2cf], 0x57
mov byte [ebp - 0x2ce], 0x4f
mov byte [ebp - 0x2cd], 0x52
mov byte [ebp - 0x2cc], al
mov byte [ebp - 0x2cb], 0
mov byte [ebp - 0x58], 0x52
mov byte [ebp - 0x57], 0x45
mov byte [ebp - 0x56], 0x47
mov byte [ebp - 0x55], 0x5f
mov byte [ebp - 0x54], 0x4d
mov byte [ebp - 0x53], 0x55
mov byte [ebp - 0x52], 0x4c
mov byte [ebp - 0x51], 0x54
mov dl, 0x49
mov byte [ebp - 0x50], dl
mov byte [ebp - 0x4f], 0x5f
mov byte [ebp - 0x4e], 0x53
mov byte [ebp - 0x4d], 0x5a
mov byte [ebp - 0x4c], 0
mov byte [ebp - 0x1bc], 0x52
mov byte [ebp - 0x1bb], 0x45
mov byte [ebp - 0x1ba], 0x47
mov byte [ebp - 0x1b9], 0x5f
mov byte [ebp - 0x1b8], 0x45
mov byte [ebp - 0x1b7], 0x58
mov byte [ebp - 0x1b6], 0x50
mov byte [ebp - 0x1b5], 0x41
mov cl, 0x4e
mov byte [ebp - 0x1b4], cl
mov byte [ebp - 0x1b3], al
mov byte [ebp - 0x1b2], 0x5f
mov byte [ebp - 0x1b1], 0x53
mov byte [ebp - 0x1b0], 0x5a
mov byte [ebp - 0x1af], 0
mov byte [ebp - 0x188], 0x52
mov byte [ebp - 0x187], 0x45
mov byte [ebp - 0x186], 0x47
mov byte [ebp - 0x185], 0x5f
mov byte [ebp - 0x184], 0x42
mov byte [ebp - 0x183], dl
mov byte [ebp - 0x182], cl
mov byte [ebp - 0x181], 0x41
mov byte [ebp - 0x180], 0x52
mov byte [ebp - 0x17f], 0x59
mov byte [ebp - 0x17e], 0
mov bl, 0x25
mov byte [ebp - 0x48], bl
mov byte [ebp - 0x47], 0x2d
mov byte [ebp - 0x46], 0x32
mov byte [ebp - 0x45], 0x34
mov byte [ebp - 0x44], 0x73
mov byte [ebp - 0x43], 0x20
mov byte [ebp - 0x42], bl
mov byte [ebp - 0x41], 0x2d
mov byte [ebp - 0x40], 0x31
mov byte [ebp - 0x3f], 0x35
mov byte [ebp - 0x3e], 0x73
mov byte [ebp - 0x3d], 0x20
mov byte [ebp - 0x3c], 0x30
mov al, 0x78
mov byte [ebp - 0x3b], al
mov byte [ebp - 0x3a], bl
mov byte [ebp - 0x39], al
mov byte [ebp - 0x38], 0x28
mov byte [ebp - 0x37], bl
mov byte [ebp - 0x36], 0x64
mov byte [ebp - 0x35], 0x29
mov byte [ebp - 0x34], 0x20
mov byte [ebp - 0x33], 0xd
mov al, 0xa
mov byte [ebp - 0x32], al
mov byte [ebp - 0x31], 0
mov byte [ebp - 0x74], bl
mov byte [ebp - 0x73], 0x2d
mov byte [ebp - 0x72], 0x32
mov byte [ebp - 0x71], 0x34
mov byte [ebp - 0x70], 0x73
mov byte [ebp - 0x6f], 0x20
mov byte [ebp - 0x6e], bl
mov byte [ebp - 0x6d], 0x2d
mov byte [ebp - 0x6c], 0x31
mov byte [ebp - 0x6b], 0x35
mov byte [ebp - 0x6a], 0x73
mov byte [ebp - 0x69], 0x20
mov byte [ebp - 0x68], 0xd
mov byte [ebp - 0x67], al
mov byte [ebp - 0x66], 0
push str.RegQueryValueExA
push 0x410218
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x1c0], edi
mov byte [ebp - 0x2dc], 0x52
mov byte [ebp - 0x2db], 0x45
mov byte [ebp - 0x2da], 0x47
mov byte [ebp - 0x2d9], 0x5f
mov byte [ebp - 0x2d8], 0x53
mov byte [ebp - 0x2d7], 0x5a
mov byte [ebp - 0x2d6], 0
mov ecx, 8
xor eax, eax
lea edi, [ebp - 0x1a8]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [ebp - 0x178]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [ebp - 0x2c4]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x2c], bl
mov byte [ebp - 0x2b], 0x2d
mov byte [ebp - 0x2a], 0x32
mov byte [ebp - 0x29], 0x34
mov byte [ebp - 0x28], 0x73
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], bl
mov byte [ebp - 0x25], 0x2d
mov byte [ebp - 0x24], 0x31
mov byte [ebp - 0x23], 0x35
mov byte [ebp - 0x22], 0x73
mov byte [ebp - 0x21], 0x20
mov byte [ebp - 0x20], bl
mov byte [ebp - 0x1f], 0x73
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0xd
mov byte [ebp - 0x1c], 0x6e
mov byte [ebp - 0x1b], al
mov dword [ebp - 4], eax
push eax
call esi
push 0
call esi
push 0
call esi
push 0
call esi
lea eax, [ebp - 0x2c8]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x412100]
test eax, eax
je 0x40420f
push 0
call esi
push 0
call esi
push 0
call esi
push 0
call esi
mov dword [ebp - 0x60], 0xffffffff
mov dword [ebp - 4], 0xffffffff
call fcn.0040464e
jmp 0x40468b
mov eax, dword [ebp + 0x24]
cmp eax, 3
ja case.0x404227.5
jmp dword [eax*4 + 0x4046a4]
mov eax, dword [ebp + 0x14]
dec eax
cmp eax, 6
ja case.0x404227.5
jmp dword [eax*4 + 0x4046b4]
mov dword [ebp - 0x30], 0x104
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x178]
push edx
lea eax, [ebp + 0x14]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x2c8]
push edx
call dword [ebp - 0x17c]
test eax, eax
jne case.0x404227.5
push eax
call esi
push 0
call esi
push 0
call esi
push 0
call esi
lea eax, [ebp - 0x178]
push eax
call fcn.00403de0
push eax
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.00405320
add esp, 0xc
mov dword [ebp - 0x60], 1
mov dword [ebp - 4], 0xffffffff
call fcn.0040464e
jmp 0x40468b
push 0
call esi
mov dword [ebp - 0x30], 0x104
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x178]
push eax
lea ecx, [ebp + 0x14]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x2c8]
push eax
call dword [ebp - 0x17c]
test eax, eax
jne case.0x404227.5
push eax
call esi
push 0
call esi
push 0
call esi
push 0
call esi
lea edi, [ebp - 0x178]
mov dword [ebp - 0x64], edi
mov ebx, dword [sym.imp.MSVCRT.dll_strchr]
cmp byte [edi], 0
push 0
je 0x40433e
call esi
push 0
call esi
push 0
call esi
push 0
call esi
push 0x104
push edi
lea ecx, [ebp - 0x2c4]
push ecx
call fcn.00403e20
add esp, 0xc
push 0
call esi
push 0x104
push 0x410214
lea edx, [ebp - 0x2c4]
push edx
call fcn.00403e20
push 0
push edi
call ebx
add esp, 0x14
inc eax
mov edi, eax
mov dword [ebp - 0x64], edi
jmp 0x4042ea
call esi
lea eax, [ebp - 0x2c4]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.00405320
add esp, 8
jmp case.0x404217.3
mov dword [ebp - 0x30], 4
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x1ac]
push eax
lea ecx, [ebp + 0x14]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x2c8]
push eax
call dword [ebp - 0x17c]
test eax, eax
jne case.0x404227.5
push eax
call esi
push 0
call esi
push 0
call esi
push 0
call esi
mov ecx, dword [ebp - 0x1ac]
push ecx
push 0x41026c
mov edx, dword [ebp + 0x18]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
jmp 0x404280
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
lea eax, [ebp + 0x14]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x2c8]
push edx
call dword [ebp - 0x17c]
test eax, eax
jne case.0x404227.5
jmp case.0x404217.3
mov ebx, dword [ebp + 0x18]
push 0
call esi
push 0
call esi
push 0
call esi
push 0
call esi
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x178]
rep stosd dword es:[edi], eax
push eax
call esi
mov dword [ebp - 0x30], 0x104
push 0
call esi
mov ecx, dword [ebp - 0x1c0]
mov eax, ecx
inc ecx
mov dword [ebp - 0x1c0], ecx
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x178]
push edx
push eax
mov eax, dword [ebp - 0x2c8]
push eax
call dword [0x412104]
test eax, eax
jne case.0x404227.5
lea ecx, [ebp - 0x178]
push ecx
push str.__s__r_n
lea edx, [ebp - 0x2c4]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
call esi
lea eax, [ebp - 0x2c4]
push eax
push ebx
call fcn.00405350
add esp, 8
push 0
call esi
mov dword [ebp - 0x60], 1
jmp 0x4043e8
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push 0
call esi
push 0
call esi
push 0
call esi
push 0
call esi
mov ecx, 8
xor eax, eax
lea edi, [ebp - 0x1a8]
rep stosd dword es:[edi], eax
push eax
call esi
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x178]
rep stosd dword es:[edi], eax
push eax
call esi
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x2c4]
rep stosd dword es:[edi], eax
push eax
call esi
mov dword [ebp - 0x5c], 0x20
push 0
call esi
mov dword [ebp - 0x30], 0x104
push 0
call esi
mov ecx, dword [ebp - 0x1c0]
mov eax, ecx
inc ecx
mov dword [ebp - 0x1c0], ecx
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x178]
push edx
lea ecx, [ebp + 0x14]
push ecx
push 0
lea edx, [ebp - 0x5c]
push edx
lea ecx, [ebp - 0x1a8]
push ecx
push eax
mov edx, dword [ebp - 0x2c8]
push edx
call dword [0x4120fc]
test eax, eax
jne case.0x404227.5
push eax
call esi
mov eax, dword [ebp + 0x14]
dec eax
cmp eax, 6
ja case.0x404540.5
jmp dword [eax*4 + 0x4046d0]
push 0
call esi
lea ecx, [ebp - 0x178]
push ecx
lea edx, [ebp - 0x2dc]
push edx
lea eax, [ebp - 0x1a8]
push eax
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x2c4]
push edx
call ebx
add esp, 0x14
jmp case.0x404540.5
push 0
call esi
lea eax, [ebp - 0x178]
push eax
lea ecx, [ebp - 0x1bc]
push ecx
lea edx, [ebp - 0x1a8]
push edx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x2c4]
push ecx
call ebx
add esp, 0x14
jmp case.0x404540.5
push 0
call esi
lea edx, [ebp - 0x178]
push edx
lea eax, [ebp - 0x178]
push eax
lea ecx, [ebp - 0x2d4]
push ecx
lea edx, [ebp - 0x1a8]
push edx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c4]
push ecx
call ebx
add esp, 0x18
jmp case.0x404540.5
push 0
call esi
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 0x1a8]
push eax
lea ecx, [ebp - 0x74]
push ecx
lea edx, [ebp - 0x2c4]
push edx
call ebx
add esp, 0x10
jmp case.0x404540.5
push 0
call esi
lea eax, [ebp - 0x188]
push eax
lea ecx, [ebp - 0x1a8]
push ecx
lea edx, [ebp - 0x74]
push edx
lea eax, [ebp - 0x2c4]
push eax
call ebx
add esp, 0x10
push 0
call esi
push 0
call esi
push 0
call esi
push 0
call esi
push 0
call esi
lea ecx, [ebp - 0x2c4]
push ecx
mov edx, dword [ebp + 0x18]
push edx
call fcn.00405350
add esp, 8
mov dword [ebp - 0x60], 1
jmp 0x404493
push 0
call esi
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret