Function at 0x4109b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5c8aa2
push eax
mov eax, dword [0x63dffc]
mov dword fs:[0], esp
sub esp, 0xae4
test eax, eax
push ebx
push ebp
push esi
push edi
je 0x4112ca
mov ecx, 0xd
mov esi, 0x63f860
lea edi, [esp + 0x18]
push 0
rep movsd dword es:[edi], dword [esi]
mov ecx, 0xd
mov esi, 0x63f828
mov edi, 0x63f860
lea eax, [esp + 0x18]
push 0
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00410660
mov eax, dword [eax]
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
add esp, 0xc
lea edx, [esp + 0x4c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
call fcn.00598032
mov ebx, 1
call fcn.0059890a
test eax, eax
je 0x410a53
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x410a55
xor eax, eax
push eax
push 0x5df958
call fcn.00598737
mov ebp, eax
mov eax, dword [0x63e6f8]
add esp, 8
test eax, eax
jne 0x4110d7
mov eax, dword [0x63dff8]
test eax, eax
je 0x4110d7
mov eax, dword [0x63dfe8]
test eax, eax
jne 0x4110d7
mov eax, dword [0x63dff0]
push 0
test eax, eax
je 0x410d3b
lea ecx, [esp + 0x254]
call fcn.0044cc70
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x324]
push eax
mov dword [esp + 0xb00], 0
call fcn.005981bb
lea ecx, [esp + 0x250]
call fcn.005979ba
cmp eax, 1
jne 0x410b01
mov edi, dword [esp + 0x324]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x4c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x8a0]
mov dword [esp + 0xafc], 0x13
call fcn.005aa341
lea ecx, [esp + 0x864]
mov byte [esp + 0xafc], 0x12
call fcn.005aa49d
lea ecx, [esp + 0x828]
mov byte [esp + 0xafc], 0x11
call fcn.005aa341
lea ecx, [esp + 0x7ec]
mov byte [esp + 0xafc], 0x10
call fcn.005aa444
lea ecx, [esp + 0x7b0]
mov byte [esp + 0xafc], 0xf
call fcn.005aa196
lea ecx, [esp + 0x774]
mov byte [esp + 0xafc], 0xe
call fcn.005aa196
lea ecx, [esp + 0x738]
mov byte [esp + 0xafc], 0xd
call fcn.005aa196
lea ecx, [esp + 0x6fc]
mov byte [esp + 0xafc], 0xc
call fcn.005aa196
lea ecx, [esp + 0x6c0]
mov byte [esp + 0xafc], 0xb
call fcn.005aa444
lea ecx, [esp + 0x684]
mov byte [esp + 0xafc], 0xa
call fcn.005aa196
lea ecx, [esp + 0x648]
mov byte [esp + 0xafc], 9
call fcn.005aa444
lea ecx, [esp + 0x60c]
mov byte [esp + 0xafc], 8
call fcn.005aa444
lea ecx, [esp + 0x5d0]
mov byte [esp + 0xafc], 7
call fcn.005aa341
lea ecx, [esp + 0x594]
mov byte [esp + 0xafc], 6
call fcn.005aa444
lea ecx, [esp + 0x558]
mov byte [esp + 0xafc], 5
call fcn.005aa444
lea ecx, [esp + 0x51c]
mov byte [esp + 0xafc], 4
call fcn.005aa196
lea ecx, [esp + 0x4e0]
mov byte [esp + 0xafc], 3
call fcn.005aa196
push fcn.00410570
push 0xa
lea ecx, [esp + 0x330]
push 0x2c
push ecx
mov byte [esp + 0xb0c], 2
call fcn.004f4e7e
lea esi, [esp + 0x250]
lea edx, [esp + 0x2fc]
neg esi
sbb esi, esi
and esi, edx
mov dword [esp + 0x14], esi
lea ecx, [esi + 0x28]
mov byte [esp + 0xafc], 0x18
call fcn.00598032
lea ecx, [esi + 0x20]
mov byte [esp + 0xafc], 0x17
call fcn.00598032
lea ecx, [esi + 0x18]
mov byte [esp + 0xafc], 0x16
call fcn.00598032
lea ecx, [esi + 0xc]
mov byte [esp + 0xafc], 0x15
call fcn.00598032
lea ecx, [esi + 4]
mov byte [esp + 0xafc], 0x14
call fcn.00598032
mov ecx, esi
mov byte [esp + 0xafc], 1
call fcn.00598032
lea eax, [esp + 0x2b8]
mov dword [esp + 0xafc], 0x19
mov dword [esp + 0x14], eax
mov dword [esp + method.CGdiObject.virtual_0], vtable.CGdiObject.0
lea ecx, [esp + 0x2b8]
mov byte [esp + 0xafc], 0x1a
call fcn.0059c109
lea ecx, [esp + 0x250]
mov dword [esp + 0xafc], 0xffffffff
call fcn.005975b7
jmp 0x410d69
push 0
push 0
lea ecx, [esp + 0x58]
push 0
push ecx
push 0
mov ecx, ebp
call fcn.0042c530
mov ecx, eax
call fcn.00424520
push eax
call fcn.0043c510
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x4112ba
lea edi, [esp + 0x4c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x8f0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x61d9e0]
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
je 0x410e62
lea ecx, [esp + 0x9f4]
lea edx, [esp + 0x150]
push ecx
lea eax, [esp + 0x8f4]
push edx
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x58]
push ecx
push edx
call fcn.004f64dc
lea edi, [esp + 0x164]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x150]
lea esi, [esp + ecx + 0x14f]
cmp esi, eax
jbe 0x410e07
movsx ecx, byte [esi]
push ecx
call fcn.004f63b6
add esp, 4
test eax, eax
jne 0x410e07
dec esi
lea edx, [esp + 0x150]
cmp esi, edx
ja 0x410deb
movsx eax, byte [esi]
push eax
call fcn.004f63b6
add esp, 4
test eax, eax
je 0x410e4c
lea ecx, [esp + 0x150]
cmp esi, ecx
jbe 0x410e4c
movsx edx, byte [esi]
push edx
call fcn.004f63b6
add esp, 4
test eax, eax
je 0x410e40
dec esi
lea eax, [esp + 0x150]
cmp esi, eax
ja 0x410e22
jmp 0x410e4c
lea ecx, [esp + 0x150]
cmp esi, ecx
jbe 0x410e4c
inc esi
push esi
call fcn.004f66ae
mov ecx, dword [0x61d9e4]
add esp, 4
add eax, ecx
mov dword [0x61d9e8], eax
test ebx, ebx
je 0x4111f0
mov eax, dword [0x63dff0]
push 0
test eax, eax
je 0x4110fb
lea ecx, [esp + 0x254]
call fcn.0044cc70
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x324]
push eax
mov dword [esp + 0xb00], 0x1b
call fcn.005981bb
lea ecx, [esp + 0x250]
push ecx
push 0
mov ecx, ebp
call fcn.0042c530
mov ecx, eax
call fcn.004253e0
mov edi, eax
lea ecx, [esp + 0x8a0]
mov dword [esp + 0xafc], 0x2e
call fcn.005aa341
lea ecx, [esp + 0x864]
mov byte [esp + 0xafc], 0x2d
call fcn.005aa49d
lea ecx, [esp + 0x828]
mov byte [esp + 0xafc], 0x2c
call fcn.005aa341
lea ecx, [esp + 0x7ec]
mov byte [esp + 0xafc], 0x2b
call fcn.005aa444
lea ecx, [esp + 0x7b0]
mov byte [esp + 0xafc], 0x2a
call fcn.005aa196
lea ecx, [esp + 0x774]
mov byte [esp + 0xafc], 0x29
call fcn.005aa196
lea ecx, [esp + 0x738]
mov byte [esp + 0xafc], 0x28
call fcn.005aa196
lea ecx, [esp + 0x6fc]
mov byte [esp + 0xafc], 0x27
call fcn.005aa196
lea ecx, [esp + 0x6c0]
mov byte [esp + 0xafc], 0x26
call fcn.005aa444
lea ecx, [esp + 0x684]
mov byte [esp + 0xafc], 0x25
call fcn.005aa196
lea ecx, [esp + 0x648]
mov byte [esp + 0xafc], 0x24
call fcn.005aa444
lea ecx, [esp + 0x60c]
mov byte [esp + 0xafc], 0x23
call fcn.005aa444
lea ecx, [esp + 0x5d0]
mov byte [esp + 0xafc], 0x22
call fcn.005aa341
lea ecx, [esp + 0x594]
mov byte [esp + 0xafc], 0x21
call fcn.005aa444
lea ecx, [esp + 0x558]
mov byte [esp + 0xafc], 0x20
call fcn.005aa444
mov byte [esp + 0xafc], 0x1f
lea ecx, [esp + 0x51c]
call fcn.005aa196
lea ecx, [esp + 0x4e0]
mov byte [esp + 0xafc], 0x1e
call fcn.005aa196
push fcn.00410570
push 0xa
lea edx, [esp + 0x330]
push 0x2c
push edx
mov byte [esp + 0xb0c], 0x1d
call fcn.004f4e7e
lea esi, [esp + 0x250]
lea eax, [esp + 0x2fc]
neg esi
sbb esi, esi
and esi, eax
mov dword [esp + 0x14], esi
lea ecx, [esi + 0x28]
mov byte [esp + 0xafc], 0x33
call fcn.00598032
lea ecx, [esi + 0x20]
mov byte [esp + 0xafc], 0x32
call fcn.00598032
lea ecx, [esi + 0x18]
mov byte [esp + 0xafc], 0x31
call fcn.00598032
lea ecx, [esi + 0xc]
mov byte [esp + 0xafc], 0x30
call fcn.00598032
lea ecx, [esi + 4]
mov byte [esp + 0xafc], 0x2f
call fcn.00598032
mov ecx, esi
mov byte [esp + 0xafc], 0x1c
call fcn.00598032
lea ecx, [esp + 0x2b8]
mov dword [esp + 0xafc], 0x34
call fcn.00411460
lea ecx, [esp + 0x250]
mov dword [esp + 0xafc], 0xffffffff
call fcn.005975b7
jmp 0x411110
mov eax, dword [0x61d9e0]
test eax, eax
je 0x410e6a
mov edx, dword [0x61d9e4]
mov eax, dword [0x61d9e8]
add eax, edx
mov dword [0x61d9e8], eax
jmp 0x410e6a
mov ecx, ebp
call fcn.0042c530
mov edx, dword [eax]
lea ecx, [esp + 0x4c]
push ecx
mov ecx, eax
call dword [edx + 0x78]
mov edi, eax
test edi, edi
je 0x4111f0
mov eax, dword [esp + 0xb04]
test eax, eax
jne 0x411128
call fcn.00410920
mov edx, dword [0x61d9e8]
mov ecx, 0x63e1f0
push edx
push str.StartNo
push str.QuickSave
call fcn.004bae50
mov eax, dword [0x63e00c]
test eax, eax
jne 0x411170
mov eax, dword [0x63dff0]
test eax, eax
je 0x411161
lea eax, [esp + 0x4c]
mov ecx, 0x63dfd4
push eax
jmp 0x41116b
lea ecx, [esp + 0x4c]
push ecx
mov ecx, 0x63dfdc
call fcn.005981bb
mov eax, dword [0x63dff0]
test eax, eax
jne 0x411267
mov ecx, dword [0x63dfdc]
push 0
lea edx, [esp + 0x154]
push 0
lea eax, [esp + 0x18]
push edx
push eax
push ecx
call fcn.004f64dc
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x63f66c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x150]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x63f66c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x411267
mov eax, dword [0x63e000]
test eax, eax
je 0x411267
mov eax, dword [0x63dfec]
test eax, eax
jne 0x411267
call fcn.004105f0
mov eax, dword [0x63094c]
mov dword [esp + 0x10], eax
push 0x93
lea ecx, [esp + 0x14]
mov dword [esp + 0xb00], 0x35
call fcn.005985fc
push str._r_n_r_n
lea ecx, [esp + 0x14]
call fcn.0059840e
lea ecx, [esp + 0x4c]
push ecx
lea ecx, [esp + 0x14]
call fcn.0059840e
push 0xffffffffffffffff
push 0
push 0x93
call fcn.005a00ab
lea ecx, [esp + 0x10]
mov dword [esp + 0xafc], 0xffffffff
call fcn.00598032
mov eax, dword [0x61d9ec]
test eax, eax
je 0x4112ba
cmp dword [0x61d9e8], eax
jbe 0x4112ba
mov eax, dword [0x63dff4]
test eax, eax
je 0x41128d
mov dword [0x61d9e8], 1
jmp 0x41129b
mov eax, dword [0x63e000]
test eax, eax
je 0x41129b
call fcn.004105f0
mov eax, dword [0x63e004]
test eax, eax
je 0x4112ba
mov edx, dword [0x63e14c]
push 0
push 0
push 0x10
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, 0xd
lea esi, [esp + 0x18]
mov edi, 0x63f860
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xaf4]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xaf0
ret