Function at 0x40a0fb
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xd0], ecx
lea edi, [ebp - 0x118]
xor ebx, ebx
stosd dword es:[edi], eax
push 0x72
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop eax
push 0x70
pop ecx
push 0x63
mov word [ebp - 0x54], ax
mov word [ebp - 0x4e], ax
mov word [ebp - 0x52], cx
pop ecx
push 0x74
pop eax
push 0x34
mov word [ebp - 0x4c], ax
pop eax
push 0x2e
mov word [ebp - 0x4a], ax
pop eax
push 0x64
mov word [ebp - 0x48], ax
pop eax
mov word [ebp - 0x46], ax
push 0x6c
pop eax
mov word [ebp - 0x44], ax
mov word [ebp - 0x42], ax
xor eax, eax
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x54]
push eax
mov word [ebp - 0x50], cx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
jne 0x40a17e
push 5
pop eax
jmp 0x40a506
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x6e
pop eax
push 0x72
mov byte [ebp - 0x23], al
mov byte [ebp - 0x20], al
pop eax
push 0x65
mov byte [ebp - 0x1d], al
pop eax
mov byte [ebp - 0x1c], al
mov byte [ebp - 0x1b], al
lea eax, [ebp - 0x28]
push eax
push esi
mov dword [ebp - 0x28], 0x42637052
mov byte [ebp - 0x24], 0x69
mov word [ebp - 0x22], 0x6964
mov word [ebp - 0x1f], 0x4667
mov byte [ebp - 0x1a], bl
call edi
mov dword [ebp - 0xcc], eax
test eax, eax
jne 0x40a1d1
mov eax, 0x6e8
jmp 0x40a506
movdqa xmm0, xmmword [0x41a8b0]
push 0x65
pop eax
mov byte [ebp - 0xd6], al
lea eax, [ebp - 0xec]
push eax
push esi
movdqu xmmword [ebp - 0xec], xmm0
mov dword [ebp - 0xdc], 0x706d6f43
mov word [ebp - 0xd8], 0x736f
mov word [ebp - 0xd5], 0x57
call edi
mov dword [ebp - 0xc8], eax
test eax, eax
je 0x40a1c7
push 0x72
pop eax
push 0x65
mov byte [ebp - 0x13], al
mov byte [ebp - 0xe], al
pop eax
mov byte [ebp - 0xd], al
mov byte [ebp - 0xc], al
lea eax, [ebp - 0x18]
push eax
push esi
mov dword [ebp - 0x18], 0x53637052
mov byte [ebp - 0x14], 0x74
mov dword [ebp - 0x12], 0x46676e69
mov word [ebp - 0xb], 0x57
call edi
mov dword [ebp - 0xc4], eax
test eax, eax
je 0x40a1c7
push 0x63
pop eax
push 0x38
pop edi
push 0x62
mov word [ebp - 0xc0], ax
pop eax
push 0x61
mov word [ebp - 0xbc], ax
pop eax
push 0x37
mov word [ebp - 0xba], ax
pop eax
push 0x33
mov word [ebp - 0xb8], ax
pop eax
push 0x64
pop ecx
push 0x32
mov word [ebp - 0xb6], ax
mov word [ebp - 0xb4], cx
pop ecx
push 0x2d
pop edx
push 0x64
mov word [ebp - 0xae], ax
pop eax
push 0x35
mov word [ebp - 0xac], ax
pop eax
push 0x34
mov word [ebp - 0xaa], ax
mov word [ebp - 0xa8], ax
pop eax
push 0x39
mov word [ebp - 0xa4], ax
mov word [ebp - 0xb2], cx
mov word [ebp - 0xa2], cx
pop ecx
push 0x63
pop eax
push 0x65
mov word [ebp - 0x9e], ax
pop eax
push 0x61
mov word [ebp - 0xbe], di
mov word [ebp - 0x9a], di
pop edi
push 0x63
mov word [ebp - 0xb0], dx
mov word [ebp - 0xa6], dx
mov word [ebp - 0x9c], dx
mov word [ebp - 0x98], ax
mov word [ebp - 0x92], dx
pop edx
push 0x34
pop eax
push 0x66
mov word [ebp - 0x8e], ax
mov word [ebp - 0x8c], ax
pop eax
push 0x30
mov word [ebp - 0x8a], ax
pop eax
push 0x36
mov word [ebp - 0x88], ax
mov word [ebp - 0x86], ax
pop eax
push 0x66
mov word [ebp - 0x94], di
pop edi
push edi
mov word [ebp - 0x84], ax
mov word [ebp - 0x80], ax
pop eax
mov word [ebp - 0xa0], cx
mov word [ebp - 0x96], cx
mov word [ebp - 0x90], dx
mov word [ebp - 0x82], di
mov word [ebp - 0x7e], cx
mov word [ebp - 0x7c], ax
push 0x6e
xor eax, eax
mov word [ebp - 0x7a], dx
mov dword [ebp - 0x78], eax
pop eax
push 0x61
pop edi
push 0x6c
mov word [ebp - 0x3c], ax
pop eax
push 0x72
mov word [ebp - 0x36], ax
pop eax
push 0x70
mov word [ebp - 0x34], ax
pop eax
mov word [ebp - 0x32], ax
xor eax, eax
mov dword [ebp - 0x2e], eax
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x3c]
mov word [ebp - 0x3a], dx
push eax
lea eax, [ebp - 0xc0]
mov word [ebp - 0x38], di
push eax
mov word [ebp - 0x30], dx
call dword [ebp - 0xc8]
mov edi, eax
test edi, edi
jne 0x40a4f3
movdqa xmm0, xmmword [0x41a8d0]
push 0x72
pop eax
push 0x6e
mov byte [ebp - 0x64], al
pop eax
push 0x64
pop ecx
mov byte [ebp - 0x62], al
mov byte [ebp - 0x5e], al
mov byte [ebp - 0x5b], al
lea eax, [ebp - 0x74]
push eax
push esi
movdqu xmmword [ebp - 0x74], xmm0
mov byte [ebp - 0x63], 0x69
mov word [ebp - 0x61], 0x4267
mov byte [ebp - 0x5f], 0x69
mov byte [ebp - 0x5d], cl
mov byte [ebp - 0x5c], 0x69
mov word [ebp - 0x5a], 0x5767
mov byte [ebp - 0x58], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40a1c7
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 8]
call eax
mov edi, eax
cmp dword [ebp - 8], ebx
je 0x40a451
lea eax, [ebp - 8]
push eax
call dword [ebp - 0xc4]
test edi, edi
jne 0x40a4f3
movdqa xmm0, xmmword [0x41a8e0]
push 0x6e
pop eax
push 0x66
mov byte [ebp - 0xf6], al
pop eax
mov byte [ebp - 0xf5], al
lea eax, [ebp - 0x108]
push eax
push esi
mov dword [ebp - 0x118], 1
mov dword [ebp - 0x10c], 3
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x110], ebx
movdqu xmmword [ebp - 0x108], xmm0
mov word [ebp - 0xf8], 0x4968
mov dword [ebp - 0xf4], 0x5778456f
mov byte [ebp - 0xf0], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40a1c7
lea ecx, [ebp - 0x118]
push ecx
push ebx
push ebx
push 0xa
push 6
push ebx
push dword [ebp - 4]
call eax
mov edi, eax
test edi, edi
jne 0x40a4f3
mov ecx, dword [ebp - 0xd0]
mov eax, dword [ebp - 4]
mov dword [ebp - 4], ebx
mov dword [ecx], eax
jmp 0x40a4f6
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40a504
lea eax, [ebp - 4]
push eax
call dword [ebp - 0xcc]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret