Function at 0x4010ab
Capabilities:
Check for debugger via api
Contain obfuscated stackstrings
Encrypt data using tea

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x210
mov eax, dword [ebp + 0x7c]
push ebx
mov ebx, dword [eax + 4]
push esi
push edi
mov edi, dword [eax]
mov eax, dword [0x46cb90]
mov dword [ebp - 0x194], eax
mov eax, dword [0x46cb94]
xor ecx, ecx
mov dword [ebp - 0x190], eax
lea eax, [ebp - 0x180]
mov dword [ebp - 0x184], edi
mov dword [ebp - 0x180], ecx
call fcn.004010a4
add dword [ebp - 0x180], 0x23f
cmp dword [0x20d3264], 0x14
jne 0x40110b
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov eax, dword [0x46cb98]
mov dword [ebp - 0x198], eax
mov eax, dword [0x46cb9c]
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x188], 0x20
mov dword [ebp + 0x6c], 2
add dword [ebp + 0x6c], 3
mov eax, dword [0x20d3264]
mov ecx, edi
shl ecx, 4
add ecx, dword [ebp - 0x198]
cmp eax, 0xfa9
jne 0x401157
mov dword [0x20d3260], 0xedeb2e40
cmp eax, 0x3eb
jne 0x401165
and dword [0x20d2cec], 0
mov eax, dword [ebp - 0x184]
shr eax, 5
mov dword [ebp + 0x70], eax
mov eax, dword [ebp + 0x70]
add eax, dword [ebp - 0x18c]
mov edx, dword [ebp - 0x180]
add edx, edi
xor eax, edx
xor eax, ecx
sub ebx, eax
mov eax, ebx
shr eax, 5
mov dword [0x20d325c], 0xf4ea3dee
mov dword [ebp + 0x70], eax
mov eax, dword [ebp - 0x190]
add dword [ebp + 0x70], eax
mov eax, dword [ebp - 0x180]
mov esi, ebx
shl esi, 4
add esi, dword [ebp - 0x194]
add eax, ebx
xor esi, eax
cmp dword [0x20d3264], 0xb03
jne 0x4011d0
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
and dword [ebp - 0x184], 0
mov dword [ebp - 0x19c], esi
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x184], eax
mov eax, dword [ebp + 0x70]
xor dword [ebp - 0x184], eax
sub edi, dword [ebp - 0x184]
mov dword [ebp - 0x184], edi
mov dword [ebp + 0xc], 0x72ef4d12
mov dword [ebp - 0x118], 0x667a8f03
mov dword [ebp - 0x90], 0x74eb31e9
mov dword [ebp - 0xac], 0x3e01a6
mov dword [ebp - 0x74], 0x31c38e55
mov dword [ebp - 0xc8], 0x72297fa
mov dword [ebp - 0xe4], 0x58102752
mov dword [ebp - 0x70], 0x3511d0e6
mov dword [ebp - 0xdc], 0x2d857b28
mov dword [ebp + 0x10], 0x97e3837
mov dword [ebp + 0x44], 0xe1ab73f
mov dword [ebp - 0x15c], 0x18d08cdb
mov dword [ebp - 0x150], 0x1d941164
mov dword [ebp + 0x4c], 0x5406190b
mov dword [ebp - 0x68], 0x88fefab
mov dword [ebp - 0x158], 0x45f6d7d
mov dword [ebp - 0x100], 0x4187963d
mov dword [ebp - 0xe0], 0x25cc7e9c
mov dword [ebp - 0xa4], 0x3590bb86
mov dword [ebp - 0x88], 0x580bdfc5
mov dword [ebp - 0x154], 0x7c15733e
mov dword [ebp - 0x6c], 0x83fb90b
mov dword [ebp - 0x64], 0x18dcf915
mov dword [ebp - 0x10], 0x6bcce2ae
mov dword [ebp + 0x38], 0xef49651
mov dword [ebp - 0x9c], 0x23d8d51c
mov dword [ebp + 0x14], 0x16126415
mov dword [ebp - 0xf8], 0x44b04db6
mov dword [ebp - 0xb0], 0x24aae8b1
mov dword [ebp - 0x94], 0x65fd8d98
mov dword [ebp - 0x110], 0x583762f0
mov dword [ebp - 0x20], 0x1513b7a7
mov dword [ebp - 0x138], 0x1802c670
mov dword [ebp - 0x14c], 0xf7c92fe
mov dword [ebp - 0x40], 0x74d37a51
mov dword [ebp - 0x170], 0x17abbd3d
mov dword [ebp + 0x40], 0x529ae9f7
mov dword [ebp - 0x5c], 0x5aa86f3e
mov dword [ebp - 0x160], 0x3a65bf1e
mov dword [ebp - 0x50], 0x7672def6
mov dword [ebp - 0x104], 0x2243bd14
mov dword [ebp - 0x80], 0x4c273f6d
mov dword [ebp - 0x148], 0x1cfa349
mov dword [ebp - 0x8c], 0x2b7d43ba
mov dword [ebp - 0x48], 0x545ac286
mov dword [ebp - 0xd4], 0x5264ce66
mov dword [ebp - 0x144], 0x3c4837cf
mov dword [ebp + 0x54], 0x7c586549
mov dword [ebp - 0x14], 0x9cd3349
mov dword [ebp - 0x130], 0x780d3546
mov dword [ebp + 0x48], 0x21e3555f
mov dword [ebp - 0xa8], 0x2c60148d
mov dword [ebp - 0x38], 0x69d867cc
mov dword [ebp + 0x50], 0xae78f71
mov dword [ebp - 0x54], 0xe7d96f2
mov dword [ebp - 0x13c], 0x59084214
mov dword [ebp - 8], 0x3d452aef
mov dword [ebp + 0x18], 0x34f599f4
mov dword [ebp - 0xc0], 0xaa33e49
mov dword [ebp - 0xd0], 0x77c2236c
mov dword [ebp - 0x84], 0x36a014c0
mov dword [ebp - 0x60], 0x1e27746
mov dword [ebp + 0x5c], 0x46697512
mov dword [ebp], 0x10c82555
mov dword [ebp - 0x16c], 0x25543165
mov dword [ebp - 0x168], 0x35515437
mov dword [ebp - 0xfc], 0x503f330b
mov dword [ebp - 0xf4], 0x7cd920ca
mov dword [ebp - 0x134], 0x4a3af65c
mov dword [ebp - 0x4c], 0x371cfb7
mov dword [ebp + 0x1c], 0x24118c47
mov dword [ebp - 0x44], 0x5092c2c
mov dword [ebp - 0x164], 0x18921620
mov dword [ebp - 0xe8], 0x6f9e58d
mov dword [ebp - 0xc], 0x67c97c2f
mov dword [ebp + 0x20], 0x4f8bf301
mov dword [ebp - 0xcc], 0x7902178b
mov dword [ebp - 0x3c], 0x78030743
mov dword [ebp - 0x30], 0x1e01ab1d
mov dword [ebp - 0x7c], 0x78b71ec6
mov dword [ebp - 0x178], 0x44a6b9d
mov dword [ebp - 0xc4], 0x1ba850d8
mov dword [ebp - 0x17c], 0x185ce861
mov dword [ebp - 0x12c], 0x2911790d
mov dword [ebp - 0x34], 0x7c31d707
mov dword [ebp - 0x124], 0x664def03
mov dword [ebp - 0x140], 0x5f21de35
mov dword [ebp - 0x120], 0x4fb1bb7e
mov dword [ebp + 8], 0x27821341
mov dword [ebp + 0x24], 0x30862079
mov dword [ebp + 0x28], 0x25111442
mov dword [ebp - 0x18], 0x4e02d732
mov dword [ebp + 0x58], 0x4cd33a0f
mov dword [ebp - 0x11c], 0x2100beb0
mov dword [ebp - 0x2c], 0x40fa3c3c
mov dword [ebp - 0xb8], 0x9362b40
mov dword [ebp - 0x24], 0x2764259c
mov dword [ebp - 0xa0], 0x36e225d3
mov dword [ebp - 4], 0x311c31aa
mov dword [ebp - 0xf0], 0x7347bc1f
mov dword [ebp + 0x64], 0x2d410ec8
mov dword [ebp - 0xec], 0x331d6b96
mov dword [ebp - 0xbc], 0x191c1243
mov dword [ebp + 0x2c], 0x2c07279
mov dword [ebp + 0x34], 0x19069671
mov dword [ebp - 0x174], 0x3a9e469c
mov dword [ebp + 0x68], 0x24319aa8
mov dword [ebp - 0x78], 0x6c27b109
mov dword [ebp + 0x30], 0x4e7b3265
mov dword [ebp - 0x114], 0x9412236
mov dword [ebp - 0x28], 0x79c96a5b
mov dword [ebp - 0x58], 0x50c8584b
mov dword [ebp - 0xd8], 0x2f1ebe88
mov dword [ebp + 0x60], 0x8992f9d
mov dword [ebp + 4], 0x2cd6fecd
mov dword [ebp - 0x98], 0x4bfe1558
mov dword [ebp - 0x108], 0x32fd6507
mov dword [ebp - 0x1c], 0x162459d0
mov dword [ebp - 0x10c], 0x67575ab
mov dword [ebp - 0x128], 0x106a6a9d
mov dword [ebp - 0xb4], 0x39a4d373
mov dword [ebp + 0x3c], 0x47fa18a4
mov eax, 0x618653c6
mul dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
mov eax, 0x7b764fe9
mul dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
mov eax, 0x2cf6b28a
mul dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
mov eax, 0x3b4b65f8
mul dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
mov eax, 0x34fd82c1
mul dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
mov eax, 0x77d98f1b
mul dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
mov eax, 0x7a13899c
mul dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
add dword [ebp + 0xc], 0x54ea7e6a
sub dword [ebp + 0xc], 0x3659f636
sub dword [ebp + 0xc], 0x441c9e6b
mov eax, 0x51db1173
mul dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
add dword [ebp - 0xac], 0x7b8e6770
mov eax, 0x12225bd1
mul dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
sub dword [ebp - 0xac], 0x10c4a0bb
add dword [ebp - 0xac], 0x6f0a89fa
add dword [ebp - 0x90], 0x4fe8c273
add dword [ebp - 0x74], 0x3895f028
mov eax, 0x20709b23
mul dword [ebp - 0xc8]
mov eax, dword [ebp - 0xc8]
mov eax, 0x457987b1
mul dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
mov eax, 0x2ca44047
mul dword [ebp - 0xdc]
mov eax, dword [ebp - 0xdc]
sub dword [ebp - 0xe4], 0x50386b83
sub dword [ebp - 0x90], 0x71ef8650
mov eax, 0x5cc3ef92
mul dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
add dword [ebp - 0x180], 0x61c88647
dec dword [ebp - 0x188]
jne 0x40112b
mov eax, dword [ebp + 0x7c]
mov dword [eax], edi
pop edi
pop esi
mov dword [eax + 4], ebx
pop ebx
add ebp, 0x74
leave
ret 4