Function at 0x411a02
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
mov eax, 0x496257
call fcn.00486614
sub esp, 0xa8
push ebx
push esi
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.0045db1a
pop ecx
mov eax, dword [ebp - 0x14]
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [eax - 8], esi
je 0x411d5d
mov word [ebp - 0xb0], 0x36
mov word [ebp - 0xae], 0x1c
mov word [ebp - 0xac], 1
mov word [ebp - 0xaa], 0x2b
mov word [ebp - 0xa8], 0x4d
mov word [ebp - 0xa6], 0x2c
mov word [ebp - 0xa4], 0x2d
mov word [ebp - 0xa2], 0x23
mov word [ebp - 0xa0], 0x45
mov word [ebp - 0x9e], 2
mov word [ebp - 0x9c], 3
mov word [ebp - 0x9a], 4
mov word [ebp - 0x98], 0x1a
mov word [ebp - 0x96], 5
mov word [ebp - 0x94], 6
mov word [ebp - 0x92], 0x65
mov word [ebp - 0x90], 0x13
mov word [ebp - 0x8e], 9
mov word [ebp - 0x8c], 0x25
mov word [ebp - 0x8a], 0x38
mov word [ebp - 0x88], 0x29
mov word [ebp - 0x86], 0xb
mov word [ebp - 0x84], 0xc
mov word [ebp - 0x82], 0x56
mov word [ebp - 0x80], 0x37
mov word [ebp - 0x7e], 7
mov word [ebp - 0x7c], 8
mov word [ebp - 0x7a], 0x47
mov word [ebp - 0x78], 0xd
mov word [ebp - 0x76], 0x39
mov word [ebp - 0x74], 0xe
mov word [ebp - 0x72], 0xf
mov word [ebp - 0x70], 0x21
mov word [ebp - 0x6e], 0x10
mov word [ebp - 0x6c], 0x11
mov word [ebp - 0x6a], 0x4b
mov word [ebp - 0x68], 0x60
mov word [ebp - 0x66], 0x3f
mov word [ebp - 0x64], 0x57
mov word [ebp - 0x62], 0x12
mov word [ebp - 0x60], 0x40
mov word [ebp - 0x5e], 0x26
mov word [ebp - 0x5c], 0x27
mov word [ebp - 0x5a], 0x2f
mov word [ebp - 0x58], 0x3e
mov word [ebp - 0x56], 0x4c
mov word [ebp - 0x54], 0x58
mov word [ebp - 0x52], 0x4e
mov word [ebp - 0x50], 0x50
mov word [ebp - 0x4e], 0x61
mov word [ebp - 0x4c], 0x14
mov word [ebp - 0x4a], 0x48
mov word [ebp - 0x48], 0x15
mov word [ebp - 0x46], 0x16
mov word [ebp - 0x44], 0x46
mov word [ebp - 0x42], 0x18
mov word [ebp - 0x40], 0x19
mov word [ebp - 0x3e], 0x4f
mov word [ebp - 0x3c], 0x1a
mov word [ebp - 0x3a], 0x59
mov word [ebp - 0x38], 0x1b
mov word [ebp - 0x36], 0x24
mov word [ebp - 0x34], 0xa
mov word [ebp - 0x32], 0x41
mov word [ebp - 0x30], 0x1d
mov word [ebp - 0x2e], 0x5a
mov word [ebp - 0x2c], 0x49
mov word [ebp - 0x2a], 0x44
mov word [ebp - 0x28], 0x4a
mov word [ebp - 0x26], 0x1e
mov word [ebp - 0x24], 0x1f
mov word [ebp - 0x22], 0x22
mov word [ebp - 0x20], 0x20
mov word [ebp - 0x1e], 0x43
mov word [ebp - 0x1c], 0x2a
mov dword [ebp - 0x18], esi
lea edi, [ebp - 0xb0]
mov si, word [edi]
mov eax, dword [0x4bb1a0]
movzx ebx, si
mov dword [ebp - 0x10], eax
push 0x65
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00401877
test eax, eax
je 0x411c7b
mov eax, dword [ebp - 0x10]
mov dword [eax - 8], 0x65
mov eax, dword [ebp - 0x10]
and word [eax + 0xca], 0
mov eax, dword [ebp - 0x10]
push 0x64
push eax
push 0x59
push ebx
call dword [0x4a2338]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004018df
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.00486b05
pop ecx
test eax, eax
pop ecx
je 0x411d06
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], 2
jle 0x411cd8
lea eax, [ebp - 0xb4]
push 2
push eax
lea ecx, [ebp - 0x10]
call fcn.00403edc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.004016bd
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 1
call fcn.004015f7
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.00486b05
pop ecx
test eax, eax
pop ecx
je 0x411d06
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004015f7
inc dword [ebp - 0x18]
inc edi
inc edi
cmp dword [ebp - 0x18], 0x4b
jl 0x411c43
jmp 0x411d17
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004015f7
test si, si
jne 0x411d1b
xor esi, esi
jmp 0x411d5d
push str.kernel32.dll
call dword [0x4a23d0]
test eax, eax
je 0x411d17
push str.SetThreadUILanguage
push eax
call dword [0x4a23a4]
test eax, eax
je 0x411d17
or esi, 0x400
push esi
call eax
xor ecx, ecx
test ax, ax
setne cl
mov edi, ecx
test edi, edi
je 0x411d5b
movzx eax, si
push eax
call dword [0x4a231c]
mov esi, edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004015f7
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret