Function at 0x405170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b173e
mov eax, dword fs:[0]
push eax
sub esp, 0x90
push ebx
push esi
push edi
mov eax, dword [0x639210]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], 0x649650
mov dword [0x649650], 0x607848
mov dword [ebp - 0x14], 0x64965c
mov dword [0x649660], 0
mov dword [0x649664], 0
call fcn.00417640
mov dword [0x649660], eax
mov dword [ebp - 4], 0
mov dword [0x649668], 0
mov dword [0x64966c], 0
mov dword [0x649670], 0
call fcn.00417640
mov dword [0x64966c], eax
mov dword [0x649674], 0
mov dword [0x64965c], 0
mov dword [ebp - 4], 1
xor eax, eax
mov dword [ebp - 0x14], 0x649678
mov dword [0x64968c], 7
mov dword [0x649688], 0
mov word [0x649678], ax
mov dword [0x6496a4], 0xf
mov dword [0x6496a0], eax
mov byte [0x649690], al
mov dword [0x6496bc], 7
mov dword [0x6496b8], eax
mov word [0x6496a8], ax
mov dword [0x6496d4], 0xf
mov dword [0x6496d0], eax
mov byte [0x6496c0], al
push eax
push 0x6079a0
mov ecx, 0x649678
mov byte [ebp - 4], 5
call fcn.0041d070
xor eax, eax
mov dword [ebp - 0x14], 0x6496d8
mov dword [0x6496ec], 7
mov dword [0x6496e8], 0
mov word [0x6496d8], ax
mov dword [0x649704], 0xf
mov dword [0x649700], eax
mov byte [0x6496f0], al
mov dword [0x64971c], 7
mov dword [0x649718], eax
mov word [0x649708], ax
mov dword [0x649734], 0xf
mov dword [0x649730], eax
mov byte [0x649720], al
push eax
push 0x6079a0
mov ecx, 0x6496d8
mov byte [ebp - 4], 0xa
call fcn.0041d070
xor eax, eax
mov dword [ebp - 0x14], 0x649738
mov dword [0x64974c], 7
mov dword [0x649748], 0
mov word [0x649738], ax
mov dword [0x649764], 0xf
mov dword [0x649760], eax
mov byte [0x649750], al
mov dword [0x64977c], 7
mov dword [0x649778], eax
mov word [0x649768], ax
mov dword [0x649794], 0xf
mov dword [0x649790], eax
mov byte [0x649780], al
push eax
push 0x6079a0
mov ecx, 0x649738
mov byte [ebp - 4], 0xf
call fcn.0041d070
xor eax, eax
mov dword [ebp - 0x14], 0x649798
mov dword [0x6497ac], 7
mov dword [0x6497a8], 0
mov word [0x649798], ax
mov dword [0x6497c4], 0xf
mov dword [0x6497c0], eax
mov byte [0x6497b0], al
mov dword [0x6497dc], 7
mov dword [0x6497d8], eax
mov word [0x6497c8], ax
mov dword [0x6497f4], 0xf
mov dword [0x6497f0], eax
mov byte [0x6497e0], al
push eax
push 0x6079a0
mov ecx, 0x649798
mov byte [ebp - 4], 0x14
call fcn.0041d070
xor eax, eax
mov dword [ebp - 0x14], 0x6497f8
mov dword [0x64980c], 7
mov dword [0x649808], 0
mov word [0x6497f8], ax
mov dword [0x649824], 0xf
mov dword [0x649820], eax
mov byte [0x649810], al
mov dword [0x64983c], 7
mov dword [0x649838], eax
mov word [0x649828], ax
mov dword [0x649854], 0xf
mov dword [0x649850], eax
mov byte [0x649840], al
push eax
push 0x6079a0
mov ecx, 0x6497f8
mov byte [ebp - 4], 0x19
call fcn.0041d070
xor eax, eax
mov dword [ebp - 0x14], 0x649858
mov dword [0x64986c], 7
mov dword [0x649868], 0
mov word [0x649858], ax
mov dword [0x649884], 0xf
mov dword [0x649880], eax
mov byte [0x649870], al
mov dword [0x64989c], 7
mov dword [0x649898], eax
mov word [0x649888], ax
mov dword [0x6498b4], 0xf
mov dword [0x6498b0], eax
mov byte [0x6498a0], al
push eax
push 0x6079a0
mov ecx, 0x649858
mov byte [ebp - 4], 0x1e
call fcn.0041d070
xor eax, eax
mov dword [ebp - 0x14], 0x6498b8
mov dword [0x6498cc], 7
mov dword [0x6498c8], 0
mov word [0x6498b8], ax
mov dword [0x6498e4], 0xf
mov dword [0x6498e0], eax
mov byte [0x6498d0], al
mov dword [0x6498fc], 7
mov dword [0x6498f8], eax
mov word [0x6498e8], ax
mov dword [0x649914], 0xf
mov dword [0x649910], eax
mov byte [0x649900], al
push eax
push 0x6079a0
mov ecx, 0x6498b8
mov byte [ebp - 4], 0x23
call fcn.0041d070
mov ecx, 0x649918
mov byte [ebp - 4], 0x24
call fcn.00402190
mov ecx, 0x649978
mov byte [ebp - 4], 0x25
call fcn.00402190
mov dword [0x6499dc], 0
mov dword [0x6499e0], 0
mov dword [0x6499e4], 0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0x27
push eax
push 0
mov ecx, 0x6499e8
mov dword [ebp - 0x14], 0
mov dword [0x6499e8], 0
mov dword [0x6499ec], 0
mov dword [0x6499f0], 0
call fcn.00417060
mov dword [0x6499f4], 0
mov byte [ebp - 4], 0x28
mov dword [0x6499f8], 0
mov dword [0x6499fc], 0
call fcn.004176d0
mov dword [0x6499f8], eax
mov ecx, 0x649a00
mov byte [ebp - 4], 0x29
call fcn.004124d0
mov ecx, 0x649a14
mov byte [ebp - 4], 0x2a
call fcn.0041ca30
mov dword [0x649a80], 0xf
mov dword [0x649a7c], 0
mov byte [0x649a6c], 0
mov byte [ebp - 4], 0x2c
mov dword [0x649a88], 0
mov dword [0x649a8c], 0
call fcn.00417700
mov dword [0x649a88], eax
mov ecx, 0x649a90
mov byte [ebp - 4], 0x2d
call fcn.0041ca30
xor eax, eax
mov dword [0x649ac4], 7
mov dword [0x649ac0], 0
mov word [0x649ab0], ax
mov dword [0x649ae0], 0xf
mov dword [0x649adc], eax
mov byte [0x649acc], al
mov dword [0x649ae4], eax
mov dword [0x649ae8], eax
mov dword [0x649aec], eax
mov dword [0x649b04], 0xf
mov dword [0x649b00], eax
mov byte [0x649af0], al
mov byte [ebp - 4], 0x32
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
lea eax, [ebp - 0x2c]
push edi
push eax
call fcn.0040c320
mov ebx, eax
mov esi, 0x649ab0
cmp ebx, esi
je 0x4056fc
cmp dword [0x649ac4], 8
jb 0x4056d8
push dword [0x649ab0]
call fcn.0043f3a3
add esp, 4
xor eax, eax
mov dword [0x649ac4], 7
push ebx
mov ecx, esi
mov dword [0x649ac0], 0
mov word [0x649ab0], ax
call fcn.0041cb80
cmp dword [ebp - 0x18], 8
jb 0x40570d
push dword [ebp - 0x2c]
call fcn.0043f3a3
add esp, 4
push edi
call fcn.0040c4f0
mov dword [0x649ac8], eax
call fcn.0040fe50
test eax, eax
je 0x405782
mov ecx, edi
call fcn.0040fdd0
test eax, eax
jne 0x405782
cmp dword [0x649ac4], 8
lea eax, [ebp - 0x9c]
push ecx
cmovae esi, dword [0x649ab0]
push esi
push eax
call fcn.004105e0
push edi
mov byte [ebp - 4], 0x34
push dword [0x649ac8]
push ecx
mov ecx, eax
call fcn.004026b0
push eax
push str.X64:PU._s:SID._lu:PID._.4d
lea eax, [ebp - 0x2c]
push eax
push 0x6495d0
call fcn.00410b10
add esp, 0x18
mov ecx, 0x649acc
push eax
call fcn.00411970
jmp 0x40580f
cmp dword [0x649ac4], 8
lea eax, [ebp - 0x9c]
push ecx
cmovae esi, dword [0x649ab0]
push esi
push eax
call fcn.004105e0
push edi
mov byte [ebp - 4], 0x33
push dword [0x649ac8]
push ecx
mov ecx, eax
call fcn.004026b0
push eax
push str.X86:PU._s:SID._lu:PID._.4d
lea eax, [ebp - 0x2c]
push eax
push 0x6495d0
call fcn.00410b10
mov esi, eax
add esp, 0x18
cmp esi, 0x649acc
je 0x40580f
cmp dword [0x649ae0], 0x10
jb 0x4057e9
push dword [0x649acc]
call fcn.0043f3a3
add esp, 4
push esi
mov ecx, 0x649acc
mov dword [0x649ae0], 0xf
mov dword [0x649adc], 0
mov byte [0x649acc], 0
call fcn.0041cab0
cmp dword [ebp - 0x18], 0x10
jb 0x405820
push dword [ebp - 0x2c]
call fcn.0043f3a3
add esp, 4
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 0x32
call fcn.00402220
mov esi, 0xa
push 0
push 0x6079a2
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
call fcn.0041da10
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0x35
push eax
mov ecx, 0x6499dc
call fcn.00411e20
mov byte [ebp - 4], 0x32
cmp dword [ebp - 0x18], 0x10
jb 0x40588e
push dword [ebp - 0x2c]
call fcn.0043f3a3
add esp, 4
dec esi
jne 0x405846
mov byte [ebp - 0xd], 0
lea eax, [ebp - 0xd]
mov ecx, 0x6499e8
push eax
cmp esi, 6
je 0x4058a7
mov byte [ebp - 0xd], 1
call fcn.00412460
inc esi
cmp esi, 0xa
jl 0x405891
mov ecx, dword [0x6499dc]
push 4
push str.NULL
call fcn.0041da10
mov ecx, dword [0x6499dc]
push 4
push str.INFO
lea ecx, [ecx + 0x18]
call fcn.0041da10
mov ecx, dword [0x6499dc]
push 8
push str.WARNNING
lea ecx, [ecx + 0x30]
call fcn.0041da10
mov ecx, dword [0x6499dc]
push 5
push str.ERROR
lea ecx, [ecx + 0x48]
call fcn.0041da10
mov ecx, dword [0x6499dc]
push 7
push str.PRIVATE
lea ecx, [ecx + 0x60]
call fcn.0041da10
mov ecx, dword [0x6499dc]
push 9
push str.EXCEPTION
lea ecx, [ecx + 0x78]
call fcn.0041da10
mov ecx, dword [0x6499dc]
push 5
push str.DEBUG
lea ecx, [ecx + 0x90]
call fcn.0041da10
xor esi, esi
mov dword [ebp - 0x14], esi
lea ebx, [ebx]
mov eax, dword [0x6499dc]
lea edi, [esi + esi*2]
cmp dword [eax + edi*8 + 0x10], 0
je 0x4059c0
lea ecx, [eax + edi*8]
mov edx, str.NULL
call fcn.004177e0
test al, al
jne 0x4059c0
mov edx, dword [0x6499dc]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x30]
lea edx, [edx + edi*8]
call fcn.00417d90
add esp, 4
push eax
mov ecx, 0x6499f8
mov byte [ebp - 4], 0x36
call fcn.004186c0
push eax
add eax, 0x10
push eax
push ecx
lea eax, [ebp - 0x3c]
mov ecx, 0x6499f8
push eax
call fcn.004186f0
mov byte [ebp - 4], 0x32
cmp dword [ebp - 0x1c], 0x10
jb 0x4059c0
push dword [ebp - 0x30]
call fcn.0043f3a3
add esp, 4
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0xa
jl 0x405950
movdqa xmm0, xmmword [0x60d0d0]
mov ecx, 0x649a6c
movdqa xmmword [0x649a40], xmm0
xorps xmm0, xmm0
push 4
push str.null
mov dword [0x649654], 0
mov dword [0x649658], 0
mov word [0x649a38], 0x101
mov dword [0x649a34], 0x64
mov dword [0x649a3c], 0
movdqa xmmword [0x649a50], xmm0
mov dword [0x649a60], 0
mov dword [0x649a64], 0xa
mov byte [0x649a68], 1
mov dword [0x649a84], 0
call fcn.0041da10
mov eax, 0x649650
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret