Function at 0x401e60
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c300
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
push esi
push edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], esp
push 0x4211e8
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0xe
call fcn.004035bb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp + 8]
cmp word [eax], 0x5a4d
je 0x401ee0
mov eax, 0x401ecd
ret
mov edi, dword [eax + 0x3c]
add edi, eax
mov dword [ebp - 0x20], edi
cmp dword [edi], 0x4550
je 0x401f09
mov eax, 0x401ef6
ret
mov ecx, dword [edi + 0x50]
mov edx, dword [edi + 0x34]
push 4
push 0x2000
push ecx
push edx
call dword [0x427504]
mov esi, eax
test esi, esi
mov dword [ebp - 0x18], esi
jne 0x401f5c
mov eax, dword [edi + 0x50]
push 4
push 0x2000
push eax
push esi
call dword [0x427504]
test eax, eax
mov dword [ebp - 0x18], eax
jne 0x401f59
mov eax, 0x401f46
ret
mov esi, dword [ebp - 0x18]
mov al, 0x45
mov cl, 0x73
mov byte [ebp - 0x33], al
mov byte [ebp - 0x30], al
mov al, 0x6c
mov byte [ebp - 0x4c], cl
mov byte [ebp - 0x4b], cl
lea ecx, [ebp - 0x54]
mov byte [ebp - 0x2a], al
mov byte [ebp - 0x29], al
lea edx, [ebp - 0x34]
mov al, 0x65
push ecx
push edx
mov byte [ebp - 0x34], 0x4b
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4e
mov byte [ebp - 0x2f], 0x4c
mov byte [ebp - 0x2e], 0x33
mov byte [ebp - 0x2d], 0x32
mov byte [ebp - 0x2c], 0x2e
mov byte [ebp - 0x2b], 0x64
mov byte [ebp - 0x28], 0
mov byte [ebp - 0x54], 0x47
mov byte [ebp - 0x53], al
mov byte [ebp - 0x52], 0x74
mov byte [ebp - 0x51], 0x50
mov byte [ebp - 0x50], 0x72
mov byte [ebp - 0x4f], 0x6f
mov byte [ebp - 0x4e], 0x63
mov byte [ebp - 0x4d], al
mov byte [ebp - 0x4a], 0x48
mov byte [ebp - 0x49], al
mov byte [ebp - 0x48], 0x61
mov byte [ebp - 0x47], 0x70
mov byte [ebp - 0x46], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x14
push 0
call eax
push eax
call dword [0x4274f0]
mov ebx, eax
mov dword [ebp - 0x24], ebx
mov dword [ebx + 4], esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor eax, eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebx + 0x10], eax
mov eax, dword [edi + 0x50]
push 4
push 0x1000
push eax
push esi
call dword [0x427504]
mov ecx, dword [edi + 0x54]
push 4
push 0x1000
push ecx
push esi
call dword [0x427504]
mov esi, dword [ebp + 8]
mov edx, dword [edi + 0x54]
mov edi, eax
mov ecx, dword [esi + 0x3c]
add ecx, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3c]
add eax, edx
mov dword [ebx], eax
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x18]
push ebx
push edi
push ecx
mov dword [eax + 0x34], esi
call fcn.00402140
add esp, 0xc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [edi + 0x34]
mov eax, esi
sub eax, ecx
je 0x4020b0
push eax
push ebx
call fcn.00402380
add esp, 8
push ebx
call fcn.00402480
add esp, 4
test eax, eax
je 0x4020e0
push ebx
call fcn.00402240
mov eax, dword [ebx]
add esp, 4
mov eax, dword [eax + 0x28]
test eax, eax
je 0x402119
add eax, esi
test eax, eax
je 0x4020e0
push 0
push 1
push esi
call eax
test eax, eax
jne 0x402102
push ebx
call fcn.00402780
add esp, 4
mov eax, 0x4020ef
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebx + 0x10], 1
mov eax, 0x40211f
ret