Function at 0x41ec60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8b4
mov eax, dword [0x462040]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, byte [0x4662f0]
mov dword [ebp - 8], edx
push ebx
mov ebx, 0x7f
push esi
mov esi, ecx
push edi
sub eax, 0
je 0x41f6a7
sub eax, 1
je 0x41edc2
sub eax, 1
jne 0x41f6a7
mov byte [ebp - 0x88c], al
mov byte [ebp - 0x88b], 0x77
mov byte [ebp - 0x88a], 0x36
mov byte [ebp - 0x889], 0x77
mov byte [ebp - 0x888], 0x36
mov byte [ebp - 0x887], 0x17
mov byte [ebp - 0x886], 0x36
mov byte [ebp - 0x885], 0x77
mov byte [ebp - 0x884], 0x36
mov byte [ebp - 0x883], 0x3c
mov byte [ebp - 0x882], 0x36
mov byte [ebp - 0x881], 0x42
mov byte [ebp - 0x880], 0x36
mov byte [ebp - 0x87f], 0xd
mov byte [ebp - 0x87e], 0x36
mov byte [ebp - 0x87d], 0x14
mov byte [ebp - 0x87c], 0x36
mov byte [ebp - 0x87b], 0x56
mov byte [ebp - 0x87a], 0x36
mov byte [ebp - 0x879], 0x3c
mov byte [ebp - 0x878], 0x36
mov byte [ebp - 0x877], 0x6b
mov byte [ebp - 0x876], 0x36
mov byte [ebp - 0x875], 0x46
mov byte [ebp - 0x874], 0x36
mov byte [ebp - 0x873], 0x36
mov byte [ebp - 0x872], 0x36
mov al, byte [ebp - 0x88b]
mov al, byte [ebp - 0x88c]
test al, al
jne 0x41ed96
xor ecx, ecx
mov al, byte [ebp + ecx - 0x88b]
movzx eax, al
sub eax, 0x36
imul eax, eax, 0x13
cdq
idiv ebx
lea eax, [edx + 0x7f]
cdq
idiv ebx
mov byte [ebp + ecx - 0x88b], dl
inc ecx
cmp ecx, 0x1a
jb 0x41ed70
push 0
push 0x40000080
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x88b]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x8b0], ebx
jmp 0x41eeee
mov byte [ebp - 0x8ac], 0
mov byte [ebp - 0x8ab], 0x78
mov byte [ebp - 0x8aa], 0x1f
mov byte [ebp - 0x8a9], 0x78
mov byte [ebp - 0x8a8], 0x1f
mov byte [ebp - 0x8a7], 0xc
mov byte [ebp - 0x8a6], 0x1f
mov byte [ebp - 0x8a5], 0x78
mov byte [ebp - 0x8a4], 0x1f
mov byte [ebp - 0x8a3], 0x2e
mov byte [ebp - 0x8a2], 0x1f
mov byte [ebp - 0x8a1], 6
mov byte [ebp - 0x8a0], 0x1f
mov byte [ebp - 0x89f], 2
mov byte [ebp - 0x89e], 0x1f
mov byte [ebp - 0x89d], 0x6c
mov byte [ebp - 0x89c], 0x1f
mov byte [ebp - 0x89b], 5
mov byte [ebp - 0x89a], 0x1f
mov byte [ebp - 0x899], 0x12
mov byte [ebp - 0x898], 0x1f
mov byte [ebp - 0x897], 0x3f
mov byte [ebp - 0x896], 0x1f
mov byte [ebp - 0x895], 0x68
mov byte [ebp - 0x894], 0x1f
mov byte [ebp - 0x893], 0x58
mov byte [ebp - 0x892], 0x1f
mov byte [ebp - 0x891], 0x1f
mov byte [ebp - 0x890], 0x1f
mov al, byte [ebp - 0x8ab]
mov al, byte [ebp - 0x8ac]
test al, al
jne 0x41eeca
xor edi, edi
nop
mov al, byte [ebp + edi - 0x8ab]
movzx ecx, al
sub ecx, 0x1f
mov eax, ecx
shl eax, 5
sub eax, ecx
cdq
idiv ebx
lea eax, [edx + 0x7f]
cdq
idiv ebx
mov byte [ebp + edi - 0x8ab], dl
inc edi
cmp edi, 0x1c
jb 0x41eea0
push 0
push 0x80
push 3
push 0
push 0
push 3
lea eax, [ebp - 0x8ab]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x8b0], eax
cmp ebx, 0xffffffff
je 0x41f6a2
cmp dword [esi + 0x14], 7
mov dword [ebp - 0x8b4], esi
jbe 0x41ef0b
mov eax, dword [esi]
mov dword [ebp - 0x8b4], eax
mov byte [ebp - 0x870], 0
mov byte [ebp - 0x86f], 0x66
mov byte [ebp - 0x86e], 0x64
mov byte [ebp - 0x86d], 0x14
mov byte [ebp - 0x86c], 0x64
mov byte [ebp - 0x86b], 0x74
mov byte [ebp - 0x86a], 0x64
mov byte [ebp - 0x869], 0x46
mov byte [ebp - 0x868], 0x64
mov byte [ebp - 0x867], 0x35
mov byte [ebp - 0x866], 0x64
mov byte [ebp - 0x865], 0x2d
mov byte [ebp - 0x864], 0x64
mov byte [ebp - 0x863], 9
mov byte [ebp - 0x862], 0x64
mov byte [ebp - 0x861], 0x65
mov byte [ebp - 0x860], 0x64
mov byte [ebp - 0x85f], 0x49
mov byte [ebp - 0x85e], 0x64
mov byte [ebp - 0x85d], 0x6c
mov byte [ebp - 0x85c], 0x64
mov byte [ebp - 0x85b], 0x11
mov byte [ebp - 0x85a], 0x64
mov byte [ebp - 0x859], 0x17
mov byte [ebp - 0x858], 0x64
mov byte [ebp - 0x857], 0x49
mov byte [ebp - 0x856], 0x64
mov byte [ebp - 0x855], 0x6c
mov byte [ebp - 0x854], 0x64
mov byte [ebp - 0x853], 0x3b
mov byte [ebp - 0x852], 0x64
mov byte [ebp - 0x851], 0x46
mov byte [ebp - 0x850], 0x64
mov byte [ebp - 0x84f], 0x19
mov byte [ebp - 0x84e], 0x64
mov byte [ebp - 0x84d], 0x67
mov byte [ebp - 0x84c], 0x64
mov byte [ebp - 0x84b], 0x44
mov byte [ebp - 0x84a], 0x64
mov byte [ebp - 0x849], 0x7d
mov byte [ebp - 0x848], 0x64
mov byte [ebp - 0x847], 0x46
mov byte [ebp - 0x846], 0x64
mov byte [ebp - 0x845], 0x69
mov byte [ebp - 0x844], 0x64
mov byte [ebp - 0x843], 0x26
mov byte [ebp - 0x842], 0x64
mov byte [ebp - 0x841], 0x46
mov byte [ebp - 0x840], 0x64
mov byte [ebp - 0x83f], 0x34
mov byte [ebp - 0x83e], 0x64
mov byte [ebp - 0x83d], 0x73
mov byte [ebp - 0x83c], 0x64
mov byte [ebp - 0x83b], 9
mov byte [ebp - 0x83a], 0x64
mov byte [ebp - 0x839], 0x46
mov byte [ebp - 0x838], 0x64
mov byte [ebp - 0x837], 0x7a
mov byte [ebp - 0x836], 0x64
mov byte [ebp - 0x835], 9
mov byte [ebp - 0x834], 0x64
mov byte [ebp - 0x833], 0x73
mov byte [ebp - 0x832], 0x64
mov byte [ebp - 0x831], 0x1f
mov byte [ebp - 0x830], 0x64
mov byte [ebp - 0x82f], 0x2d
mov byte [ebp - 0x82e], 0x64
mov byte [ebp - 0x82d], 0x10
mov byte [ebp - 0x82c], 0x64
mov byte [ebp - 0x82b], 0x10
mov byte [ebp - 0x82a], 0x64
mov byte [ebp - 0x829], 0x46
mov byte [ebp - 0x828], 0x64
mov byte [ebp - 0x827], 0x77
mov byte [ebp - 0x826], 0x64
mov byte [ebp - 0x825], 0x69
mov byte [ebp - 0x824], 0x64
mov byte [ebp - 0x823], 0x10
mov byte [ebp - 0x822], 0x64
mov byte [ebp - 0x821], 0x77
mov byte [ebp - 0x820], 0x64
mov byte [ebp - 0x81f], 0x64
mov byte [ebp - 0x81e], 0x64
mov al, byte [ebp - 0x86f]
mov al, byte [ebp - 0x870]
test al, al
jne 0x41f1a2
xor edi, edi
lea ebx, [edi + 0x7f]
nop word [eax + eax]
mov al, byte [ebp + edi - 0x86f]
mov ecx, 0x64
movzx eax, al
sub ecx, eax
lea eax, [ecx + ecx*8]
add eax, eax
cdq
idiv ebx
lea eax, [edx + 0x7f]
cdq
idiv ebx
mov byte [ebp + edi - 0x86f], dl
inc edi
cmp edi, 0x52
jb 0x41f170
mov ebx, dword [ebp - 0x8b0]
push dword [ebp - 0x8b4]
lea eax, [ebp - 0x86f]
push dword [ebp - 8]
push eax
call fcn.00421550
movzx eax, byte [0x4662f0]
add esp, 0xc
mov dword [ebp - 0xc], 0
sub eax, 0
je 0x41f40f
sub eax, 1
je 0x41f20f
sub eax, 1
jne 0x41f40f
mov eax, dword [ebp - 8]
push 0
mov dword [ebp - 0x814], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x808
lea eax, [ebp - 0x818]
mov dword [ebp - 0x818], 1
push eax
push 0x22e010
jmp 0x41f224
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 4
lea eax, [ebp - 8]
push eax
push 0x22e044
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x41f40f
cmp dword [esi + 0x14], 7
jbe 0x41f23b
mov esi, dword [esi]
mov byte [ebp - 0x854], 0
mov byte [ebp - 0x853], 0x20
mov byte [ebp - 0x852], 0x30
mov byte [ebp - 0x851], 0x35
mov byte [ebp - 0x850], 0x30
mov byte [ebp - 0x84f], 0x2f
mov byte [ebp - 0x84e], 0x30
mov byte [ebp - 0x84d], 0x22
mov byte [ebp - 0x84c], 0x30
mov byte [ebp - 0x84b], 0xd
mov byte [ebp - 0x84a], 0x30
mov byte [ebp - 0x849], 0xe
mov byte [ebp - 0x848], 0x30
mov byte [ebp - 0x847], 0x37
mov byte [ebp - 0x846], 0x30
mov byte [ebp - 0x845], 0x5c
mov byte [ebp - 0x844], 0x30
mov byte [ebp - 0x843], 0x6b
mov byte [ebp - 0x842], 0x30
mov byte [ebp - 0x841], 0x55
mov byte [ebp - 0x840], 0x30
mov byte [ebp - 0x83f], 0x55
mov byte [ebp - 0x83e], 0x30
mov byte [ebp - 0x83d], 0x22
mov byte [ebp - 0x83c], 0x30
mov byte [ebp - 0x83b], 0x1d
mov byte [ebp - 0x83a], 0x30
mov byte [ebp - 0x839], 0x6b
mov byte [ebp - 0x838], 0x30
mov byte [ebp - 0x837], 0xe
mov byte [ebp - 0x836], 0x30
mov byte [ebp - 0x835], 0x28
mov byte [ebp - 0x834], 0x30
mov byte [ebp - 0x833], 0xa
mov byte [ebp - 0x832], 0x30
mov byte [ebp - 0x831], 0x6f
mov byte [ebp - 0x830], 0x30
mov byte [ebp - 0x82f], 0x4d
mov byte [ebp - 0x82e], 0x30
mov byte [ebp - 0x82d], 0x1d
mov byte [ebp - 0x82c], 0x30
mov byte [ebp - 0x82b], 0x6b
mov byte [ebp - 0x82a], 0x30
mov byte [ebp - 0x829], 0x24
mov byte [ebp - 0x828], 0x30
mov byte [ebp - 0x827], 0x66
mov byte [ebp - 0x826], 0x30
mov byte [ebp - 0x825], 0x22
mov byte [ebp - 0x824], 0x30
mov byte [ebp - 0x823], 8
mov byte [ebp - 0x822], 0x30
mov byte [ebp - 0x821], 0x55
mov byte [ebp - 0x820], 0x30
mov byte [ebp - 0x81f], 0x30
mov byte [ebp - 0x81e], 0x30
mov al, byte [ebp - 0x853]
mov al, byte [ebp - 0x854]
test al, al
jne 0x41f403
xor edi, edi
lea ebx, [edi + 0x7f]
mov al, byte [ebp + edi - 0x853]
movzx ecx, al
sub ecx, 0x30
mov eax, ecx
shl eax, 4
add eax, ecx
add eax, eax
cdq
idiv ebx
lea eax, [edx + 0x7f]
cdq
idiv ebx
mov byte [ebp + edi - 0x853], dl
inc edi
cmp edi, 0x36
jb 0x41f3d1
mov ebx, dword [ebp - 0x8b0]
push esi
lea eax, [ebp - 0x853]
jmp 0x41f67f
mov byte [ebp - 0x870], 0
mov byte [ebp - 0x86f], 0x12
mov byte [ebp - 0x86e], 0x51
mov byte [ebp - 0x86d], 1
mov byte [ebp - 0x86c], 0x51
mov byte [ebp - 0x86b], 0x55
mov byte [ebp - 0x86a], 0x51
mov byte [ebp - 0x869], 0xa
mov byte [ebp - 0x868], 0x51
mov byte [ebp - 0x867], 0x49
mov byte [ebp - 0x866], 0x51
mov byte [ebp - 0x865], 0x63
mov byte [ebp - 0x864], 0x51
mov byte [ebp - 0x863], 0x61
mov byte [ebp - 0x862], 0x51
mov byte [ebp - 0x861], 0x6a
mov byte [ebp - 0x860], 0x51
mov byte [ebp - 0x85f], 0x20
mov byte [ebp - 0x85e], 0x51
mov byte [ebp - 0x85d], 0x63
mov byte [ebp - 0x85c], 0x51
mov byte [ebp - 0x85b], 0x32
mov byte [ebp - 0x85a], 0x51
mov byte [ebp - 0x859], 0x35
mov byte [ebp - 0x858], 0x51
mov byte [ebp - 0x857], 0x67
mov byte [ebp - 0x856], 0x51
mov byte [ebp - 0x855], 0x35
mov byte [ebp - 0x854], 0x51
mov byte [ebp - 0x853], 0x53
mov byte [ebp - 0x852], 0x51
mov byte [ebp - 0x851], 0x1e
mov byte [ebp - 0x850], 0x51
mov byte [ebp - 0x84f], 0x5a
mov byte [ebp - 0x84e], 0x51
mov byte [ebp - 0x84d], 0x35
mov byte [ebp - 0x84c], 0x51
mov byte [ebp - 0x84b], 0x10
mov byte [ebp - 0x84a], 0x51
mov byte [ebp - 0x849], 0xa
mov byte [ebp - 0x848], 0x51
mov byte [ebp - 0x847], 0x45
mov byte [ebp - 0x846], 0x51
mov byte [ebp - 0x845], 0x5c
mov byte [ebp - 0x844], 0x51
mov byte [ebp - 0x843], 0x6a
mov byte [ebp - 0x842], 0x51
mov byte [ebp - 0x841], 0x10
mov byte [ebp - 0x840], 0x51
mov byte [ebp - 0x83f], 0x63
mov byte [ebp - 0x83e], 0x51
mov byte [ebp - 0x83d], 2
mov byte [ebp - 0x83c], 0x51
mov byte [ebp - 0x83b], 0xa
mov byte [ebp - 0x83a], 0x51
mov byte [ebp - 0x839], 0x45
mov byte [ebp - 0x838], 0x51
mov byte [ebp - 0x837], 0x35
mov byte [ebp - 0x836], 0x51
mov byte [ebp - 0x835], 0x5a
mov byte [ebp - 0x834], 0x51
mov byte [ebp - 0x833], 0xa
mov byte [ebp - 0x832], 0x51
mov byte [ebp - 0x831], 0x5e
mov byte [ebp - 0x830], 0x51
mov byte [ebp - 0x82f], 0x32
mov byte [ebp - 0x82e], 0x51
mov byte [ebp - 0x82d], 0x49
mov byte [ebp - 0x82c], 0x51
mov byte [ebp - 0x82b], 0x77
mov byte [ebp - 0x82a], 0x51
mov byte [ebp - 0x829], 0xa
mov byte [ebp - 0x828], 0x51
mov byte [ebp - 0x827], 0x72
mov byte [ebp - 0x826], 0x51
mov byte [ebp - 0x825], 2
mov byte [ebp - 0x824], 0x51
mov byte [ebp - 0x823], 0x51
mov byte [ebp - 0x822], 0x51
mov al, byte [ebp - 0x86f]
mov al, byte [ebp - 0x870]
test al, al
jne 0x41f676
xor ecx, ecx
lea esi, [ecx + 0x7f]
nop dword [eax]
mov al, byte [ebp + ecx - 0x86f]
movzx eax, al
sub eax, 0x51
imul eax, eax, 0x37
cdq
idiv esi
lea eax, [edx + 0x7f]
cdq
idiv esi
mov byte [ebp + ecx - 0x86f], dl
inc ecx
cmp ecx, 0x4e
jb 0x41f650
push dword [ebp - 8]
lea eax, [ebp - 0x86f]
push eax
call fcn.00421550
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434f21
mov esp, ebp
pop ebp
ret
mov ebx, 0x7f
cmp dword [esi + 0x14], 7
jbe 0x41f6af
mov esi, dword [esi]
mov byte [ebp - 0x85c], 0
mov byte [ebp - 0x85b], 0x4c
mov byte [ebp - 0x85a], 0x3f
mov byte [ebp - 0x859], 0xf
mov byte [ebp - 0x858], 0x3f
mov byte [ebp - 0x857], 0x28
mov byte [ebp - 0x856], 0x3f
mov byte [ebp - 0x855], 0x7a
mov byte [ebp - 0x854], 0x3f
mov byte [ebp - 0x853], 0
mov byte [ebp - 0x852], 0x3f
mov byte [ebp - 0x851], 0x2b
mov byte [ebp - 0x850], 0x3f
mov byte [ebp - 0x84f], 0x17
mov byte [ebp - 0x84e], 0x3f
mov byte [ebp - 0x84d], 0x5f
mov byte [ebp - 0x84c], 0x3f
mov byte [ebp - 0x84b], 7
mov byte [ebp - 0x84a], 0x3f
mov byte [ebp - 0x849], 0x17
mov byte [ebp - 0x848], 0x3f
mov byte [ebp - 0x847], 0x49
mov byte [ebp - 0x846], 0x3f
mov byte [ebp - 0x845], 0x4e
mov byte [ebp - 0x844], 0x3f
mov byte [ebp - 0x843], 0x18
mov byte [ebp - 0x842], 0x3f
mov byte [ebp - 0x841], 0x17
mov byte [ebp - 0x840], 0x3f
mov byte [ebp - 0x83f], 0x15
mov byte [ebp - 0x83e], 0x3f
mov byte [ebp - 0x83d], 0x7a
mov byte [ebp - 0x83c], 0x3f
mov byte [ebp - 0x83b], 5
mov byte [ebp - 0x83a], 0x3f
mov byte [ebp - 0x839], 0x5f
mov byte [ebp - 0x838], 0x3f
mov byte [ebp - 0x837], 0x4e
mov byte [ebp - 0x836], 0x3f
mov byte [ebp - 0x835], 0x18
mov byte [ebp - 0x834], 0x3f
mov byte [ebp - 0x833], 0x17
mov byte [ebp - 0x832], 0x3f
mov byte [ebp - 0x831], 0x29
mov byte [ebp - 0x830], 0x3f
mov byte [ebp - 0x82f], 0x7a
mov byte [ebp - 0x82e], 0x3f
mov byte [ebp - 0x82d], 5
mov byte [ebp - 0x82c], 0x3f
mov byte [ebp - 0x82b], 0x61
mov byte [ebp - 0x82a], 0x3f
mov byte [ebp - 0x829], 0x2b
mov byte [ebp - 0x828], 0x3f
mov byte [ebp - 0x827], 0x23
mov byte [ebp - 0x826], 0x3f
mov byte [ebp - 0x825], 0x7a
mov byte [ebp - 0x824], 0x3f
mov byte [ebp - 0x823], 0x20
mov byte [ebp - 0x822], 0x3f
mov byte [ebp - 0x821], 0x19
mov byte [ebp - 0x820], 0x3f
mov byte [ebp - 0x81f], 0x3f
mov byte [ebp - 0x81e], 0x3f
mov al, byte [ebp - 0x85b]
mov al, byte [ebp - 0x85c]
test al, al
jne 0x41f8ac
xor edi, edi
nop word [eax + eax]
mov al, byte [ebp + edi - 0x85b]
movzx ecx, al
sub ecx, 0x3f
lea eax, [ecx*8]
sub eax, ecx
cdq
idiv ebx
lea eax, [edx + 0x7f]
cdq
idiv ebx
mov byte [ebp + edi - 0x85b], dl
inc edi
cmp edi, 0x3e
jb 0x41f880
lea eax, [ebp - 0x85b]
push esi
push eax
call fcn.00421550
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
xor al, al
pop edi
pop esi
pop ebx
call fcn.00434f21
mov esp, ebp
pop ebp
ret