Function at 0x401e06
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4017a0
push 0x4089b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffed4
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
cmp dword [ebp + 8], 0
je 0x401db5
cmp dword [ebp + 0xc], 0
jne 0x401dbc
cmp eax, eax
je 0x401dcc
into
mov esp, 0xc7daeea7
wait
adc cl, byte [edi]
test byte [edx], al
add byte [eax], al
add ah, ah
je 0x401dd4
in al, 0x1d
je 0x401ddc
jne 0xd9af08
mov eax, dword [ebp + 8]
mov dword [ebp - 0x130], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x12c], ecx
jmp 0x401dfc
push eax
call 0x401e06
je 0x401e6a
jns 0x401dbe
pop eax
pop eax
mov byte [ebp - 0x134], 0x58
mov byte [ebp - 0x133], 0x40
mov byte [ebp - 0x132], 0
mov byte [ebp - 0x13c], 0x53
mov byte [ebp - 0x13b], 0x40
mov byte [ebp - 0x13a], 0
mov byte [ebp - 0x128], 0x25
mov byte [ebp - 0x127], 0x64
mov byte [ebp - 0x126], 0x76
mov byte [ebp - 0x125], 0x65
mov byte [ebp - 0x124], 0x72
mov byte [ebp - 0x123], 0x79
mov byte [ebp - 0x122], 0x2e
mov byte [ebp - 0x121], 0x25
mov byte [ebp - 0x120], 0x73
mov byte [ebp - 0x11f], 0
cmp eax, eax
je 0x401e88
into
mov esp, 0xc7daeea7
wait
adc cl, byte [edi]
test byte [edx], al
add byte [eax], al
add ah, ah
sbb eax, 0x2840f
add byte [eax], al
je 0x401e90
in al, 0x1d
je 0x401e98
pop ds
sbb al, 0xf
test dword [esi], esp
xchg ecx, eax
cdq
add al, ch
dec ebp
xor byte [eax], al
add byte [ecx - 0x1377b], cl
inc edi
inc ebp
cld
add byte [eax], al
add byte [eax], al
jne 0xd9afc4
call 0x404ef0
mov dword [ebp - 0x138], eax
mov dword [ebp - 4], 0
jmp 0x401eb8
push eax
call 0x401ec2
je 0x401f26
jns 0x401e7a
pop eax
pop eax
lea edx, [ebp - 0x134]
push edx
mov eax, dword [ebp - 0x130]
push eax
call sub.MSVCRT.dll_strstr
add esp, 8
mov dword [ebp - 0x130], eax
cmp eax, eax
je 0x401ef0
into
mov esp, 0xc7daeea7
wait
adc cl, byte [edi]
test byte [edx], al
add byte [eax], al
add ah, ah
sbb eax, 0x2840f
add byte [eax], al
je 0x401ef8
in al, 0x1d
je 0x401f00
pop ds
sbb al, 0xf
test dword [esi], esp
xchg ecx, eax
cdq
add byte [ebp - 0x13b73], cl
call dword [ecx - 0x75]
xchg ebp, eax
aam 0xfe
invalid
jne 0xd9b02c
lea ecx, [ebp - 0x13c]
push ecx
mov edx, dword [ebp - 0x12c]
push edx
call sub.MSVCRT.dll_strstr
add esp, 8
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
je 0x40203b
invalid
add byte [eax], al
mov eax, dword [ebp - 0x12c]
mov byte [eax], 0
mov ecx, dword [ebp - 0x12c]
add ecx, 2
mov dword [ebp - 0x12c], ecx
cmp dword [ebp - 0x130], 0
je 0x401fe6
mov edx, dword [ebp - 0x130]
add edx, 2
mov dword [ebp - 0x130], edx
jmp 0x401f6b
push eax
call 0x401f75
je 0x401fd9
jns 0x401f2d
pop eax
pop eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x138]
push ecx
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 0x11c]
push eax
call dword [fcn.004010ac]
add esp, 0x10
mov ecx, dword [ebp - 0x12c]
mov edx, dword [ecx]
push edx
lea eax, [ebp - 0x11c]
push eax
mov ecx, dword [ebp - 0x130]
push ecx
invalid
call fcn.00401a00
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x11c]
push edx
call dword [ebp + 0x14]
add esp, 4
test eax, eax
jne 0x401fe6
jmp 0x401fd8
push eax
call 0x401fe2
je 0x402046
jns 0x401f9a
pop eax
pop eax
jmp 0x402065
jmp 0x401fee
push eax
call 0x401ff8
je 0x40205c
jns 0x401fb0
pop eax
pop eax
mov eax, dword [ebp - 0x12c]
add eax, 4
mov dword [ebp - 0x12c], eax
cmp eax, eax
je 0x402019
into
mov esp, 0xc7daeea7
wait
adc cl, byte [edi]
test byte [edx], al
add byte [eax], al
add ah, ah
sbb eax, 0x2840f
add byte [eax], al
je 0x402021
in al, 0x1d
je 0x402029
pop ds
sbb al, 0xf
test dword [esi], esp
xchg ecx, eax
cdq
add byte [ebx - 0x12b73], cl
dec dword [ecx - 0x12f73]
dec dword [ebx - 0x1376b]
inc dword [ebx - 0x6a76fe3e]
jne 0xd9b155
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 0x130], ecx
mov edx, dword [ebp - 0x138]
add edx, 1
mov dword [ebp - 0x138], edx
enter 0xfffffffffffffffe, 0xffffffffffffffff
cmp dword [ebp - 0x130], 0
je 0x402065
mov eax, dword [ebp - 0x12c]
sub eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jl 0x401eb0
mov dword [ebp - 4], 0xffffffff
jmp 0x40207e
mov eax, 1
jmp 0x402099