Function at 0x41e5ad
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3e4
push ebx
push esi
push edi
xor ebx, ebx
push 0x206
lea eax, [ebp - 0x3e2]
push ebx
push eax
mov word [ebp - 0x3e4], bx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x3e4]
push eax
push 0x272c
push dword [0x423438]
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x2c
push 3
lea eax, [ebp - 0x3e4]
push eax
lea eax, [ebp - 0x1dc]
push eax
call fcn.0040ad20
add esp, 0x10
push 0x10
mov esi, eax
pop ecx
lea edi, [ebp - 0x5c]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x5c]
cmp eax, ebx
je 0x41e646
cmp word [eax], bx
je 0x41e646
mov ecx, dword [ebp - 0x58]
cmp ecx, ebx
je 0x41e646
cmp word [ecx], bx
je 0x41e646
push eax
push ecx
call fcn.00403b00
pop ecx
push eax
call fcn.0040b029
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
jne 0x41e658
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
mov edi, eax
cmp edi, ebx
je 0x41ea20
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push edi
push 0x30
push dword [ebp + 8]
call esi
push 0x200
push 0x800
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push dword [0x423438]
mov dword [ebp - 0x14], 6
push eax
push ebx
mov dword [ebp - 0x10], 0x28
mov dword [ebp - 0xc], 0x2a8
mov dword [ebp - 8], 0x19e
call fcn.0040ce17
add esp, 0x1c
cmp eax, ebx
mov dword [0x423414], eax
je 0x41ea20
push 0x200
push ebx
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push dword [0x423438]
mov dword [ebp - 0x14], 0x2b2
push eax
mov dword [ebp - 0x10], 0x28
mov dword [ebp - 0xc], 0x3c
mov dword [ebp - 8], 0x19e
call fcn.0040cc9a
add esp, 0x18
cmp eax, ebx
mov dword [0x423418], eax
je 0x41ea20
push 0x20
pop eax
push 3
push edi
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
push dword [0x423438]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
push ebx
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x10], 4
call fcn.0040cdf2
add esp, 0x18
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x41ea20
push 1
push dword [0x423438]
call dword [sym.imp.USER32.dll_LoadIconW]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x41ea20
push 2
push dword [0x423438]
call dword [sym.imp.USER32.dll_LoadIconW]
cmp eax, ebx
mov dword [0x4233f4], eax
je 0x41ea20
push dword [ebp - 4]
push 1
push 0x80
push dword [ebp + 8]
call esi
push ebx
push dword [ebp - 4]
push 0x170
push dword [ebp - 0x18]
call esi
mov esi, 0x9e
push esi
lea eax, [ebp - 0x19a]
push ebx
push eax
mov dword [0x4233e4], edi
mov dword [0x4233f0], edi
mov word [ebp - 0x19c], bx
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0xfa]
push ebx
push eax
mov word [ebp - 0xfc], bx
call sub.MSVCRT.dll_memset
push 0x423660
call fcn.0040ac85
add esp, 0x1c
push eax
lea eax, [ebp - 0xfc]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push 0x2e
push ebx
lea eax, [ebp - 0xfc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
je 0x41e7ef
mov word [eax], bx
push 0x4037f0
push 0x4037c8
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0x19c]
push 0x4037b4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x30
pop esi
push 0xa
pop edi
push 0x300
push dword [0x4233e4]
lea eax, [ebp - 0x14]
push dword [ebp + 8]
mov dword [ebp - 0x14], esi
push dword [0x423438]
mov dword [ebp - 0x10], edi
push eax
lea eax, [ebp - 0x19c]
push eax
mov dword [ebp - 0xc], 0x154
mov dword [ebp - 8], 0x14
call fcn.0040cdc6
add esp, 0x2c
test eax, eax
je 0x41ea20
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x14], 0x1ea
call dword [sym.imp.KERNEL32.DLL_GetSystemDefaultLangID]
movzx eax, ax
sub eax, 0x804
je 0x41e8ad
push 0x50
mov esi, 0x422998
push esi
push 0x272b
push dword [0x423438]
call dword [sym.imp.USER32.dll_LoadStringW]
push 1
push edi
push 0x272a
push ebx
call fcn.0041bae7
add esp, 0x10
mov dword [0x4233f8], eax
jmp 0x41e9e1
push 0x1c
lea eax, [ebp - 0x54]
mov word [ebp - 0x2e], si
push eax
mov esi, 0x422998
push esi
mov word [ebp - 0x54], 0x732d
mov word [ebp - 0x52], 0x722f
mov word [ebp - 0x50], 0x5fc0
mov word [ebp - 0x4e], 0xff08
mov word [ebp - 0x4c], 0x652a
mov word [ebp - 0x4a], 0x62fb
mov word [ebp - 0x48], 0x6349
mov word [ebp - 0x46], 0x8d58
mov word [ebp - 0x44], 0x4e
mov word [ebp - 0x42], 0x5f
mov word [ebp - 0x40], 0x63
mov word [ebp - 0x3e], 0x37
mov word [ebp - 0x3c], 0x40
mov word [ebp - 0x3a], 0x36
mov word [ebp - 0x38], 0x2ff2
mov word [ebp - 0x36], 0x40
mov word [ebp - 0x34], 0x34
mov word [ebp - 0x32], 0x31
mov word [ebp - 0x30], 0x3a
mov word [ebp - 0x2c], 0x2fec
mov word [ebp - 0x2a], 0x41
mov word [ebp - 0x28], 0x52
mov word [ebp - 0x26], 0x55
mov word [ebp - 0x24], 0x3b
mov word [ebp - 0x22], 0x55
mov word [ebp - 0x20], 0x54
mov word [ebp - 0x1e], 0x50
call fcn.0040b099
push 0x6de
mov edi, 0x422020
push edi
call fcn.0040af26
add esp, 0x14
cmp eax, 0x2ed04ef2
jne 0x41e9e1
push ebx
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 4]
push eax
push edi
mov dword [ebp - 4], 0x6de
call fcn.0041b8e7
mov ecx, eax
add esp, 0x10
cmp ecx, ebx
mov dword [ebp - 0x18], ecx
je 0x41e9e1
push ecx
call fcn.0040bd6b
add esp, 4
test al, al
je 0x41e9b8
add ecx, 2
mov dword [0x4233f8], ecx
jmp 0x41e9e1
mov edi, dword [ebp - 4]
add edi, 0x10
lea eax, [edi + edi]
push eax
call fcn.00403a40
push edi
push dword [ebp - 0x18]
mov dword [0x4233f8], eax
push eax
call fcn.00403ac4
push dword [ebp - 0x18]
call sub.MSVCRT.dll_free
add esp, 0x14
push 1
push 0xa
push 0x65
push ebx
mov dword [0x4233fc], esi
call fcn.0041bae7
add esp, 0x10
cmp eax, ebx
mov dword [0x42340c], eax
je 0x41ea20
cmp dword [0x4233f8], ebx
je 0x41ea20
sub esp, 0x10
mov edi, esp
push dword [ebp + 8]
lea esi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00416c65
add esp, 0x14
jmp 0x41ea23
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret