Function at 0x4026f4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x5d3fc4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x230], ecx
mov eax, dword [ebp - 0x230]
cmp dword [eax + 0xd0], 0
je 0x40273b
mov eax, dword [ebp - 0x230]
push dword [eax + 0xd0]
call fcn.00406313
pop ecx
mov eax, dword [ebp - 0x230]
and dword [eax + 0xd0], 0
push 0x208
push 0
lea eax, [ebp - 0x22c]
push eax
call fcn.0054b9d0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x22c]
push eax
push 0
call fcn.00406070
add esp, 0xc
lea eax, [ebp - 0x22c]
push eax
call fcn.004059b1
pop ecx
push 2
pop eax
imul eax, eax, 3
push 0x2e
pop ecx
mov word [ebp + eax - 0x24], cx
push 2
pop eax
shl eax, 2
push 0x64
pop ecx
mov word [ebp + eax - 0x24], cx
push 2
pop eax
shl eax, 0
push 0x64
pop ecx
mov word [ebp + eax - 0x24], cx
push 2
pop eax
imul eax, eax, 0
push 0x64
pop ecx
mov word [ebp + eax - 0x24], cx
push 2
pop eax
imul eax, eax, 5
push 0x6c
pop ecx
mov word [ebp + eax - 0x24], cx
push 2
pop eax
imul eax, eax, 7
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0x10
jae 0x4027d1
jmp 0x4027d6
call fcn.00549e66
xor eax, eax
mov ecx, dword [ebp - 0x234]
mov word [ebp + ecx - 0x24], ax
push 2
pop eax
imul eax, eax, 6
push 0x6c
pop ecx
mov word [ebp + eax - 0x24], cx
push 2
pop eax
shl eax, 1
push 0x72
pop ecx
mov word [ebp + eax - 0x24], cx
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.00405afc
pop ecx
pop ecx
and dword [ebp - 0x23c], 0
lea eax, [ebp - 0x22c]
push eax
call fcn.00405bf2
pop ecx
test eax, eax
je 0x40297c
lea eax, [ebp - 0x22c]
push eax
call fcn.0040622d
pop ecx
mov ecx, dword [ebp - 0x230]
mov dword [ecx + 0xd0], eax
mov eax, dword [ebp - 0x230]
cmp dword [eax + 0xd0], 0
je 0x40297c
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [ebp + eax - 0x14], 0x4e
xor eax, eax
inc eax
shl eax, 3
mov byte [ebp + eax - 0x14], 0x61
xor eax, eax
inc eax
imul eax, eax, 0xb
mov byte [ebp + eax - 0x14], 0x65
xor eax, eax
inc eax
imul eax, eax, 7
mov byte [ebp + eax - 0x14], 0x68
xor eax, eax
inc eax
shl eax, 1
mov byte [ebp + eax - 0x14], 0x65
xor eax, eax
inc eax
imul eax, eax, 3
mov byte [ebp + eax - 0x14], 0x64
xor eax, eax
inc eax
imul eax, eax, 5
mov byte [ebp + eax - 0x14], 0x6f
xor eax, eax
inc eax
shl eax, 0
mov byte [ebp + eax - 0x14], 0x65
xor eax, eax
inc eax
shl eax, 2
mov byte [ebp + eax - 0x14], 0x54
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x14], 0x67
xor eax, eax
inc eax
imul eax, eax, 0xc
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0xd
jae 0x4028dc
jmp 0x4028e1
call fcn.00549e66
mov eax, dword [ebp - 0x238]
mov byte [ebp + eax - 0x14], 0
xor eax, eax
inc eax
imul eax, eax, 6
mov byte [ebp + eax - 0x14], 0x43
xor eax, eax
inc eax
imul eax, eax, 9
mov byte [ebp + eax - 0x14], 0x6e
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x230]
push dword [eax + 0xd0]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x230]
mov dword [ecx + 0xd4], eax
mov eax, dword [ebp - 0x230]
cmp dword [eax + 0xd4], 0
je 0x40297c
push 0
mov eax, dword [ebp - 0x230]
push dword [eax + 0xd0]
mov eax, dword [ebp - 0x230]
push dword [eax + 0xd4]
push 3
call fcn.00405730
add esp, 0x10
mov ecx, dword [ebp - 0x230]
mov dword [ecx + 0xd8], eax
mov eax, dword [ebp - 0x230]
cmp dword [eax + 0xd8], 0
je 0x40297c
mov dword [ebp - 0x23c], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00549a9a
leave
ret