Function at 0x4789c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4efa21
mov eax, dword fs:[0]
push eax
sub esp, 0x48c
mov eax, dword [0x52910c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x494], edi
mov dword [ebp - 0x498], 0
mov dword [ebp - 0x458], 0x5b292907
mov dword [ebp - 0x454], 0x61696864
mov dword [ebp - 0x450], 0x6e29606e
mov word [ebp - 0x44c], 0x6e69
mov byte [ebp - 0x44a], 0
lea ecx, [ebp - 0x470]
mov dword [ebp - 4], 0
call fcn.004797c0
mov edx, eax
mov byte [ebp - 4], 1
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x457]
xor al, byte [ebp - 0x458]
mov byte [ebp + ecx - 0x449], al
inc ecx
cmp ecx, 0xd
jb 0x478a50
lea eax, [ebp - 0x449]
mov byte [ebp - 0x43c], 0
push eax
push edx
lea eax, [ebp - 0x488]
push eax
call fcn.00407900
add esp, 0xc
mov eax, dword [ebp - 0x45c]
cmp eax, 0x10
jb 0x478aa6
inc eax
lea ecx, [ebp - 0x470]
push eax
push dword [ebp - 0x470]
call fcn.004099a0
mov dword [ebp - 0x45c], 0xf
mov dword [ebp - 0x460], 0
mov byte [ebp - 0x470], 0
push 0x400
mov byte [ebp - 4], 4
lea eax, [ebp - 0x410]
xorps xmm0, xmm0
mov dword [ebp - 0x44f], 0
push 0
push eax
movq qword [ebp - 0x457], xmm0
mov word [ebp - 0x44b], 0
call fcn.004babe0
mov bh, 0x77
mov dword [ebp - 0x424], 0x73734203
mov byte [ebp - 0x489], bh
lea esi, [ebp - 0x488]
mov bh, 0x65
mov dword [ebp - 0x438], 0x6465690a
mov byte [ebp - 0x48a], bh
add esp, 0xc
cmp dword [ebp - 0x474], 0x10
mov bh, 0x64
mov byte [ebp - 0x48b], bh
mov al, 0x42
cmovae esi, dword [ebp - 0x488]
mov bh, 0x6c
xor al, byte [ebp - 0x424]
mov cl, 0x73
mov byte [ebp - 0x41b], al
mov dl, cl
mov al, byte [ebp - 0x424]
mov ah, 0x6a
xor cl, al
mov byte [ebp - 0x48c], bh
xor dl, al
mov byte [ebp - 0x41a], cl
mov cl, byte [ebp - 0x438]
xor ah, al
mov bh, 0x63
mov byte [ebp - 0x417], ah
mov byte [ebp - 0x48d], bh
mov bl, 0x4f
xor bl, al
mov dword [ebp - 0x420], 0x77706a4f
mov bh, 0x6d
mov byte [ebp - 0x41c], 0
mov byte [ebp - 0x48e], bh
mov ch, 0x70
mov bh, byte [ebp - 0x489]
xor ch, al
xor bh, al
mov dword [ebp - 0x434], 0x6d636c
mov al, byte [ebp - 0x48a]
mov dh, 0x69
xor al, cl
mov byte [ebp - 0x419], dl
mov byte [ebp - 0x42f], al
xor dh, cl
mov al, byte [ebp - 0x48b]
xor al, cl
mov byte [ebp - 0x418], bl
mov byte [ebp - 0x42e], al
mov al, byte [ebp - 0x48c]
xor al, cl
mov byte [ebp - 0x416], ch
mov byte [ebp - 0x42d], al
mov al, byte [ebp - 0x48d]
xor al, cl
mov byte [ebp - 0x415], bh
mov byte [ebp - 0x42c], al
mov al, byte [ebp - 0x48e]
xor al, cl
mov byte [ebp - 0x414], 0
push esi
mov byte [ebp - 0x42b], al
lea eax, [ebp - 0x410]
mov byte [ebp - 0x430], dh
mov byte [ebp - 0x42a], 0
push 0x400
push eax
push 0x509250
lea eax, [ebp - 0x41b]
push eax
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
cmp byte [ebp - 0x410], 0
jne 0x478c68
xor eax, eax
jmp 0x478c7a
lea eax, [ebp - 0x410]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x478c71
sub eax, edx
push eax
lea eax, [ebp - 0x410]
mov ecx, edi
push eax
call fcn.00409af0
mov ecx, dword [ebp - 0x474]
cmp ecx, 0x10
jb 0x478ca7
inc ecx
push ecx
push dword [ebp - 0x488]
lea ecx, [ebp - 0x488]
call fcn.004099a0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a1855
mov esp, ebp
pop ebp
ret