Function at 0x41efa0
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x57c54c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], esi
push edi
test esi, esi
je 0x41f347
call fcn.004074f0
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov eax, dword [edi + 4]
test eax, eax
je 0x41eff6
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0x52727453
push ecx
push eax
mov dword [ebp - 0xc], 0x49726843
mov word [ebp - 8], 0x41
call ebx
mov dword [edi + 0x28], eax
mov eax, dword [edi + 0x28]
push 0x5f
push 0
push esi
call eax
mov edi, eax
mov dword [ebp - 0x2c], 0x463525
call fcn.004074f0
mov dword [ebp - 0x40], eax
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41f03b
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x52727453
push eax
push ecx
mov dword [ebp - 0xc], 0x49727453
mov word [ebp - 8], 0x41
call ebx
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x24], eax
mov eax, ecx
mov eax, dword [eax + 0x24]
lea ecx, [ebp - 0x2c]
push ecx
push 0
push esi
call eax
test edi, edi
je 0x41f056
test eax, eax
je 0x41f058
cmp edi, eax
cmovb edi, eax
jmp 0x41f058
mov edi, eax
call fcn.004074f0
mov dword [ebp - 0x40], eax
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41f08a
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x52727453
push eax
push ecx
mov dword [ebp - 0xc], 0x49726843
mov word [ebp - 8], 0x41
call ebx
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x28], eax
mov eax, ecx
mov eax, dword [eax + 0x28]
push 0x76
push 0
push esi
call eax
mov esi, eax
mov dword [ebp - 0x30], 0x363725
call fcn.004074f0
mov dword [ebp - 0x40], eax
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41f0cf
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x52727453
push eax
push ecx
mov dword [ebp - 0xc], 0x49727453
mov word [ebp - 8], 0x41
call ebx
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x24], eax
mov eax, ecx
mov eax, dword [eax + 0x24]
lea ecx, [ebp - 0x30]
push ecx
push 0
push dword [ebp - 0x44]
call eax
test esi, esi
je 0x41f0ec
test eax, eax
je 0x41f0ee
cmp esi, eax
cmovb esi, eax
jmp 0x41f0ee
mov esi, eax
test edi, edi
je 0x41f321
test esi, esi
je 0x41f102
cmp edi, esi
jb 0x41f325
call fcn.004074f0
mov esi, eax
mov eax, dword [esi + 4]
test eax, eax
je 0x41f12e
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0x52727453
push ecx
push eax
mov dword [ebp - 0xc], 0x49726843
mov word [ebp - 8], 0x41
call ebx
mov dword [esi + 0x28], eax
mov edi, dword [ebp - 0x44]
mov eax, dword [esi + 0x28]
push 0x5f
push 0
push edi
call eax
mov ebx, eax
mov dword [ebp - 0x34], 0x463525
call fcn.004074f0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x40], eax
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41f17c
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x52727453
push eax
push ecx
mov dword [ebp - 0x24], 0x49727453
mov word [ebp - 0x20], 0x41
call esi
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x24], eax
mov eax, ecx
mov eax, dword [eax + 0x24]
lea ecx, [ebp - 0x34]
push ecx
push 0
push edi
call eax
test ebx, ebx
je 0x41f197
test eax, eax
je 0x41f1a1
cmp ebx, eax
cmovb ebx, eax
jmp 0x41f1a1
test eax, eax
je 0x41f347
mov ebx, eax
call fcn.004074f0
mov dword [ebp - 0x40], eax
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41f1d3
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x52727453
push eax
push ecx
mov dword [ebp - 0x18], 0x49726843
mov word [ebp - 0x14], 0x41
call esi
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x28], eax
mov eax, ecx
mov eax, dword [eax + 0x28]
push 0x5f
push ebx
push edi
call eax
mov edi, eax
mov dword [ebp - 0x38], 0x463525
call fcn.004074f0
mov dword [ebp - 0x40], eax
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41f217
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x52727453
push eax
push ecx
mov dword [ebp - 0x18], 0x49727453
mov word [ebp - 0x14], 0x41
call esi
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x24], eax
mov eax, ecx
mov eax, dword [eax + 0x24]
lea ecx, [ebp - 0x38]
push ecx
push ebx
push dword [ebp - 0x44]
call eax
test edi, edi
je 0x41f233
test eax, eax
je 0x41f235
cmp edi, eax
cmovb edi, eax
jmp 0x41f235
mov edi, eax
call fcn.004074f0
mov dword [ebp - 0x40], eax
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41f267
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x52727453
push eax
push ecx
mov dword [ebp - 0x18], 0x49726843
mov word [ebp - 0x14], 0x41
call esi
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x28], eax
mov eax, ecx
mov eax, dword [eax + 0x28]
push 0x40
push ebx
push dword [ebp - 0x44]
call eax
mov esi, eax
mov dword [ebp - 0x3c], 0x303425
call fcn.004074f0
mov dword [ebp - 0x40], eax
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41f2b1
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x52727453
push eax
push ecx
mov dword [ebp - 0x18], 0x49727453
mov word [ebp - 0x14], 0x41
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x24], eax
mov eax, ecx
mov eax, dword [eax + 0x24]
lea ecx, [ebp - 0x3c]
push ecx
push ebx
push dword [ebp - 0x44]
call eax
test esi, esi
je 0x41f2cd
test eax, eax
je 0x41f2cf
cmp esi, eax
cmovb esi, eax
jmp 0x41f2cf
mov esi, eax
test edi, edi
je 0x41f308
test esi, esi
je 0x41f2f1
cmp edi, esi
cmovae esi, edi
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00500b45
mov esp, ebp
pop ebp
ret 4
mov esi, edi
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00500b45
mov esp, ebp
pop ebp
ret 4
test esi, esi
je 0x41f347
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00500b45
mov esp, ebp
pop ebp
ret 4
test esi, esi
je 0x41f347
mov eax, dword [ebp - 0x48]
mov dword [eax + 0xa4], 1
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00500b45
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00500b45
mov esp, ebp
pop ebp
ret 4