Function at 0x40a8d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ecx, 0x14
mov eax, 0x67
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x138]
mov esi, 0x44fe80
push ebx
lea ebx, [ebp - 0xe8]
sub esp, 0x194
mov word [ebp - 0x166], ax
rep movsd dword es:[edi], dword [esi]
mov edi, ebx
mov dword [ebp - 0x17a], 0x73696854
lea esi, [ebp - 0x17a]
mov dword [ebp - 0x176], 0x20736920
mov dword [ebp - 0x172], 0x65742061
mov dword [ebp - 0x16e], 0x73207473
mov dword [ebp - 0x16a], 0x6e697274
mov dword [ebp - 0x118], 0x44fd34
mov eax, ecx
mov ecx, 0x37
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x138]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
lea eax, [ebp - 0x164]
mov dword [esp], eax
mov dword [esp + 4], ebx
call dword [sym.imp.rpcrt4.dll_NdrClientInitializeNew]
mov dword [ebp - 0xd4], 0
sub esp, 0x10
mov dword [esp + 4], esi
mov dword [esp + 8], 0x44fd34
mov dword [esp], ebx
call dword [sym.imp.rpcrt4.dll_NdrPointerBufferSize]
sub esp, 0xc
call fcn.00448020
mov dword [eax], 0x44d655
mov dword [eax + 4], 0x80a
mov eax, dword [ebp - 0xd4]
mov dword [esp + 4], str.length__ld_n
cmp eax, 0x21
mov dword [esp + 8], eax
seta al
movzx eax, al
mov dword [esp], eax
call fcn.004062b0
mov eax, dword [ebp - 0xd4]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll_malloc]
mov dword [ebp - 0x188], eax
call eax
mov edx, dword [ebp - 0xe8]
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xe4], eax
mov dword [edx + 8], eax
add eax, dword [ebp - 0xd4]
mov dword [ebp - 0xdc], eax
mov dword [esp + 4], esi
mov dword [esp + 8], 0x44fd34
mov dword [esp], ebx
call dword [sym.imp.rpcrt4.dll_NdrPointerMarshall]
sub esp, 0xc
mov edi, eax
call fcn.00448020
mov dword [eax], 0x44d655
mov dword [eax + 4], 0x811
xor eax, eax
test edi, edi
sete al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], str.ret__p_n
call fcn.004062b0
mov edi, dword [ebp - 0xe4]
sub edi, dword [ebp - 0xe0]
call fcn.00448020
mov dword [eax], 0x44d655
mov dword [eax + 4], 0x813
mov dword [esp + 0x10], edi
mov eax, dword [ebp - 0xe0]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xe4]
mov dword [esp + 4], str.Buffer__p_Start__p_len__ld_n
mov dword [esp + 8], eax
xor eax, eax
cmp edi, 0x22
sete al
mov dword [esp], eax
call fcn.004062b0
call fcn.00448020
mov dword [eax], 0x44d655
mov dword [eax + 4], 0x815
mov dword [esp + 8], 0x16
mov dword [esp + 4], esi
mov esi, dword [ebp - 0xe0]
lea eax, [esi + 0xc]
lea esi, [ebp - 0x180]
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
mov dword [esp + 4], str.incorrectly_marshaled_n
test eax, eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.004062b0
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xd0], 0
mov dword [0x48306c], 0
mov dword [ebp - 0xe4], eax
mov dword [esp], 0x16
mov eax, dword [ebp - 0x188]
call eax
mov dword [ebp - 0x180], eax
mov edi, eax
mov dword [eax], 0x78787878
mov dword [eax + 4], 0x78787878
mov dword [eax + 8], 0x78787878
mov dword [eax + 0xc], 0x78787878
mov dword [eax + 0x10], 0x78787878
mov byte [eax + 0x14], 0x78
mov byte [eax + 0x15], 0
mov eax, dword [sym.imp.rpcrt4.dll_NdrPointerUnmarshall]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x44fd34
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [ebp - 0x184], eax
call eax
sub esp, 0x10
call fcn.00448020
mov dword [eax], 0x44d655
mov dword [eax + 4], 0x823
xor eax, eax
mov dword [esp + 4], str.mem_not_alloced_n
cmp dword [ebp - 0x180], edi
sete al
mov dword [esp], eax
call fcn.004062b0
call fcn.00448020
mov dword [eax], 0x44d655
mov dword [eax + 4], 0x824
mov eax, dword [0x48306c]
mov dword [esp + 4], str.alloc_called__d_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.004062b0
mov eax, dword [ebp - 0xe0]
mov dword [0x48306c], 0
mov dword [ebp - 0xe4], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0x44fd34
mov dword [esp + 4], esi
mov dword [esp], ebx
mov eax, dword [ebp - 0x184]
call eax
sub esp, 0x10
call fcn.00448020
mov dword [eax], 0x44d655
mov dword [eax + 4], 0x829
xor eax, eax
mov dword [esp + 4], str.mem_not_alloced_n
cmp dword [ebp - 0x180], edi
sete al
mov dword [esp], eax
call fcn.004062b0
call fcn.00448020
mov dword [eax], 0x44d655
mov dword [eax + 4], 0x82a
mov eax, dword [0x48306c]
mov dword [esp + 4], str.alloc_called__d_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.004062b0
mov eax, dword [ebp - 0x180]
cmp eax, edi
je 0x40ac84
mov dword [ebp - 0x18c], eax
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll_free]
mov eax, dword [ebp - 0x18c]
mov edx, dword [ebp - 0xe0]
mov edi, dword [sym.imp.rpcrt4.dll_NdrPointerFree]
mov dword [0x483068], 0
mov dword [ebp - 0xe4], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x44fd34
mov dword [esp], ebx
mov dword [ebp - 0x18c], edi
call edi
sub esp, 0xc
call fcn.00448020
mov dword [eax], 0x44d655
mov dword [eax + 4], 0x834
mov eax, dword [0x483068]
mov dword [esp + 4], str.free_called__d_n
cmp eax, 1
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.004062b0
add dword [0x48306c], 1
mov dword [esp], 0xa
mov eax, dword [ebp - 0x188]
call eax
mov edx, dword [ebp - 0xe0]
mov dword [0x483068], 0
mov dword [ebp - 0x180], eax
mov dword [ebp - 0xe4], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x44fd34
mov dword [esp], ebx
call edi
sub esp, 0xc
call fcn.00448020
mov dword [eax], 0x44d655
mov dword [eax + 4], 0x83a
mov eax, dword [0x483068]
mov dword [esp + 4], str.free_called__d_n
cmp eax, 1
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.004062b0
mov eax, dword [ebp - 0xe0]
mov dword [0x48306c], 0
mov byte [ebp - 0xc8], 0
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x180], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x44fd34
mov dword [esp + 4], esi
mov dword [esp], ebx
mov eax, dword [ebp - 0x184]
call eax
sub esp, 0x10
call fcn.00448020
mov ecx, 1
mov dword [eax], 0x44d655
mov edx, dword [ebp - 0x180]
mov dword [eax + 4], 0x842
mov eax, dword [ebp - 0xe0]
add eax, 0xc
cmp eax, edx
je 0x40ade9
mov ecx, edx
or ecx, dword [0x4b3310]
sete cl
movzx ecx, cl
mov dword [esp + 8], edx
mov dword [esp], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.mem_not_pointing_at_buffer__p__p_n
call fcn.004062b0
call fcn.00448020
mov dword [eax], 0x44d655
mov dword [eax + 4], 0x844
mov eax, dword [0x48306c]
mov dword [esp + 4], str.alloc_called__d_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.004062b0
mov eax, dword [ebp - 0xe0]
mov dword [0x48306c], 0
mov dword [ebp - 0x180], 0
mov dword [ebp - 0xe4], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0x44fd34
mov dword [esp + 4], esi
mov dword [esp], ebx
mov eax, dword [ebp - 0x184]
call eax
sub esp, 0x10
call fcn.00448020
mov ecx, 1
mov dword [eax], 0x44d655
mov edx, dword [ebp - 0x180]
mov dword [eax + 4], 0x84a
mov eax, dword [ebp - 0xe0]
add eax, 0xc
cmp eax, edx
je 0x40aeae
mov ecx, edx
or ecx, dword [0x4b3310]
sete cl
movzx ecx, cl
mov dword [esp + 8], edx
mov dword [esp], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.mem_not_pointing_at_buffer__p__p_n
call fcn.004062b0
call fcn.00448020
mov dword [eax], 0x44d655
mov dword [eax + 4], 0x84c
mov eax, dword [0x48306c]
mov dword [esp + 4], str.alloc_called__d_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.004062b0
mov dword [0x48306c], 0
mov dword [esp], 0x16
mov eax, dword [ebp - 0x188]
call eax
mov dword [ebp - 0x180], eax
mov edi, eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xe4], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x44fd34
mov dword [esp + 4], esi
mov dword [esp], ebx
mov eax, dword [ebp - 0x184]
call eax
sub esp, 0x10
call fcn.00448020
mov ecx, 1
mov dword [eax], 0x44d655
mov edx, dword [ebp - 0x180]
mov dword [eax + 4], 0x852
mov eax, dword [ebp - 0xe0]
add eax, 0xc
cmp eax, edx
je 0x40af80
mov ecx, edx
or ecx, dword [0x4b3310]
sete cl
movzx ecx, cl
mov dword [esp + 8], edx
mov dword [esp], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.mem_not_pointing_at_buffer__p__p_n
call fcn.004062b0
call fcn.00448020
mov dword [eax], 0x44d655
mov dword [eax + 4], 0x854
mov eax, dword [0x48306c]
mov dword [esp + 4], str.alloc_called__d_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.004062b0
mov eax, dword [ebp - 0xe0]
mov dword [0x48306c], 0
mov dword [ebp - 0x180], edi
mov dword [ebp - 0xe4], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0x44fd34
mov dword [esp + 4], esi
mov dword [esp], ebx
mov eax, dword [ebp - 0x184]
call eax
sub esp, 0x10
call fcn.00448020
mov ecx, 1
mov dword [eax], 0x44d655
mov edx, dword [ebp - 0x180]
mov dword [eax + 4], 0x85a
mov eax, dword [ebp - 0xe0]
add eax, 0xc
cmp eax, edx
je 0x40b040
xor ecx, ecx
mov esi, edx
or esi, dword [0x4b3310]
sete cl
mov dword [esp], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.mem_not_pointing_at_buffer__p__p_n
call fcn.004062b0
call fcn.00448020
mov dword [eax], 0x44d655
mov dword [eax + 4], 0x85c
mov eax, dword [0x48306c]
mov dword [esp + 4], str.alloc_called__d_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.004062b0
add dword [0x48306c], 1
mov dword [esp], 0xa
mov eax, dword [ebp - 0x188]
call eax
mov edx, dword [ebp - 0xe0]
mov dword [0x483068], 0
mov dword [ebp - 0x180], eax
mov dword [ebp - 0xe4], edx
mov dword [esp], ebx
mov dword [esp + 8], 0x44fd34
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18c]
call eax
sub esp, 0xc
call fcn.00448020
mov dword [eax], 0x44d655
mov dword [eax + 4], 0x862
mov eax, dword [0x483068]
mov dword [esp + 4], str.free_called__d_n
cmp eax, 1
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.004062b0
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll_free]
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax + 8]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_free]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret