Function at 0x415036
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [ebp + 0xc224], 0xffffffff
jl 0x415668
mov eax, 0x20202020
lea edi, [ebp + 0xdabc]
mov ecx, dword [edi - 4]
mov cl, 0x20
cmp ecx, eax
jne 0x415070
mov ecx, 0x40
repe scasd eax, dword es:[edi]
jne 0x415070
cmp al, byte [edi]
je 0x4152c2
mov byte [ebp + 0xf4a1], 0x30
mov word [ebp + 0xf4a2], 0x3030
mov byte [ebp + 0xf4a4], 0x30
mov al, byte [ebp + 0xdab9]
mov byte [ebp + 0xf4d1], al
mov ax, word [ebp + 0xdaba]
mov word [ebp + 0xf4d2], ax
lea esi, [ebp + 0xdabc]
lea edi, [ebp + 0xf4d4]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
mov al, byte [ebp + 0xdbbc]
mov byte [ebp + 0xf5d4], al
mov eax, 0x20202020
mov byte [ebp + 0xf5d5], al
mov word [ebp + 0xf5d6], ax
lea edi, [ebp + 0xf5d8]
mov ecx, 0x1b2
rep stosd dword es:[edi], eax
mov byte [ebp + 0xfca0], al
lea eax, [ebp + 0xf4a1]
mov dword [ebp + 0x34dd0], eax
mov dword [ebp + 0x34dd4], 4
lea eax, [ebp + 0x10757]
mov dword [ebp + 0x34de0], eax
mov dword [ebp + 0x34de4], 0x104
mov dword [ebp + 0x34df0], 0x1010600
lea eax, [ebp + 0x34dd0]
push eax
push 1
push 0x7d0
lea ecx, [ebp + 0xf4d1]
push ecx
lea eax, [ebp + 0x60]
push eax
mov dword [ebp + 0x8c], esp
call sub.carclw62.dll_CARC__Inspect
add esp, 0x14
lea esi, [ebp + 0xf4a1]
lea edi, [ebp - 0x40]
mov edx, 0x80000404
mov dword [ebp + 0x8c], esp
call sub.carclw62.dll_GOL_85
mov eax, dword [ebp - 0x40]
cmp eax, 1
jl 0x415172
cmp eax, 0x7d0
jle 0x415176
int 4
jmp 0x41515e
cmp byte [ebp + eax + 0xf4d0], 0x5c
je 0x4152c2
jmp 0x4151df
call fcn.00415189
lea esi, [ebp + 0x34d94]
lea edi, [ebp - 0x40]
mov edx, 0x80000504
mov dword [ebp + 0x8c], esp
call sub.carclw62.dll_GOL_85
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jl 0x41521a
cmp dword [ebp - 0x30], 0x104
jle 0x41521e
int 4
jmp 0x415203
mov dword [ebp - 0x40], 0x32303030
mov word [ebp - 0x3c], 0x3036
mov eax, dword [ebp + 0x34d94]
mov dword [ebp - 0x38], eax
mov al, byte [ebp + 0x34d98]
mov byte [ebp - 0x34], al
lea esi, [ebp - 0x34]
lea edi, [ebp - 0x3b]
mov edx, 0x506
mov dword [ebp + 0x8c], esp
call sub.carclw62.dll_GOL_S8
mov byte [ebp - 0x38], 0x30
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x37], eax
mov ax, word [ebp - 0x3c]
mov word [ebp - 0x33], ax
mov edi, dword [ebp - 0x4c]
lea esi, [edi + 0x11d]
lea edi, [ebp - 0x32]
mov edx, 0x107
mov dword [ebp + 0x8c], esp
call sub.carclw62.dll_GOL_A8
mov ebx, 1
lea esi, [ebp - 0x38]
lea edi, [ebp - 0x40]
mov edx, 0x704
mov dword [ebp + 0x8c], esp
call sub.carclw62.dll_GOL_85
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x40]
mov edi, dword [ebp - 0x4c]
lea esi, [edi + 0x31c]
lea edi, [ebp + eax + 0xdab8]
mov eax, 0x20202020
mov dword [ebp + 0x8c], esp
call sub.carclw62.dll_GOL_COPYFILL
mov eax, 0x20202020
lea edi, [ebp + 0xdbc0]
mov ecx, dword [edi - 4]
mov cl, 0x20
cmp ecx, eax
jne 0x4152ef
mov ecx, 0x40
repe scasd eax, dword es:[edi]
jne 0x4152ef
cmp al, byte [edi]
je 0x415668
mov byte [ebp + 0xf4a1], 0x30
mov word [ebp + 0xf4a2], 0x3030
mov byte [ebp + 0xf4a4], 0x30
mov al, byte [ebp + 0xdbbd]
mov byte [ebp + 0xf4d1], al
mov ax, word [ebp + 0xdbbe]
mov word [ebp + 0xf4d2], ax
lea esi, [ebp + 0xdbc0]
lea edi, [ebp + 0xf4d4]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
mov al, byte [ebp + 0xdcc0]
mov byte [ebp + 0xf5d4], al
mov eax, 0x20202020
mov byte [ebp + 0xf5d5], al
mov word [ebp + 0xf5d6], ax
lea edi, [ebp + 0xf5d8]
mov ecx, 0x1b2
rep stosd dword es:[edi], eax
mov byte [ebp + 0xfca0], al
lea eax, [ebp + 0xf4a1]
mov dword [ebp + 0x34dd0], eax
mov dword [ebp + 0x34dd4], 4
lea eax, [ebp + 0x10757]
mov dword [ebp + 0x34de0], eax
mov dword [ebp + 0x34de4], 0x104
mov dword [ebp + 0x34df0], 0x1010600
lea eax, [ebp + 0x34dd0]
push eax
push 1
push 0x7d0
lea ecx, [ebp + 0xf4d1]
push ecx
lea eax, [ebp + 0x60]
push eax
mov dword [ebp + 0x8c], esp
call sub.carclw62.dll_CARC__Inspect
add esp, 0x14
lea esi, [ebp + 0xf4a1]
lea edi, [ebp - 0x40]
mov edx, 0x80000404
mov dword [ebp + 0x8c], esp
call sub.carclw62.dll_GOL_85
mov eax, dword [ebp - 0x40]
cmp eax, 1
jl 0x4153f1
cmp eax, 0x7d0
jle 0x4153f5
int 4
jmp 0x4153dd
cmp byte [ebp + eax + 0xf4d0], 0x5c
je 0x4155bc
jmp 0x41545e
call fcn.00415408
lea esi, [ebp + 0x34d94]
lea edi, [ebp - 0x40]
mov edx, 0x80000504
mov dword [ebp + 0x8c], esp
call sub.carclw62.dll_GOL_85
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jl 0x415499
cmp dword [ebp - 0x30], 0x104
jle 0x41549d
int 4
jmp 0x415482
mov dword [ebp - 0x40], 0x32303030
mov word [ebp - 0x3c], 0x3036
mov eax, dword [ebp + 0x34d94]
mov dword [ebp - 0x38], eax
mov al, byte [ebp + 0x34d98]
mov byte [ebp - 0x34], al
lea esi, [ebp - 0x34]
lea edi, [ebp - 0x3b]
mov edx, 0x506
mov dword [ebp + 0x8c], esp
call sub.carclw62.dll_GOL_S8
mov byte [ebp - 0x38], 0x30
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x37], eax
mov ax, word [ebp - 0x3c]
mov word [ebp - 0x33], ax
mov edi, dword [ebp - 0x4c]
lea esi, [edi + 0x11d]
lea edi, [ebp - 0x32]
mov edx, 0x107
mov dword [ebp + 0x8c], esp
call sub.carclw62.dll_GOL_A8
mov ebx, 1
lea esi, [ebp - 0x38]
lea edi, [ebp - 0x40]
mov edx, 0x704
mov dword [ebp + 0x8c], esp
call sub.carclw62.dll_GOL_85
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x40]
mov edi, dword [ebp - 0x4c]
lea esi, [edi + 0x31c]
lea edi, [ebp + eax + 0xdbbc]
mov eax, 0x20202020
mov dword [ebp + 0x8c], esp
call sub.carclw62.dll_GOL_COPYFILL
mov byte [ebp + 0x34d94], 0x30
mov al, byte [ebp + 0xf4a1]
mov byte [ebp + 0x34d95], al
mov ax, word [ebp + 0xf4a2]
mov word [ebp + 0x34d96], ax
mov al, byte [ebp + 0xf4a4]
mov byte [ebp + 0x34d98], al
mov edi, dword [ebp - 0x4c]
lea esi, [edi + 0x11d]
lea edi, [ebp + 0x34d98]
mov edx, 0x105
mov dword [ebp + 0x8c], esp
call sub.carclw62.dll_GOL_A8
lea edi, [ebp + 0x34d98]
or byte [edi], 0x30
mov al, byte [ebp + 0x34d95]
mov byte [ebp + 0xf4a1], al
mov ax, word [ebp + 0x34d96]
mov word [ebp + 0xf4a2], ax
mov al, byte [ebp + 0x34d98]
mov byte [ebp + 0xf4a4], al
mov eax, 0x20202020
lea edi, [ebp + 0xdbc0]
mov ecx, dword [edi - 4]
mov cl, 0x20
cmp ecx, eax
jne 0x4155e9
mov ecx, 0x40
repe scasd eax, dword es:[edi]
jne 0x4155e9
cmp al, byte [edi]
je 0x415668
mov eax, dword [ebp + 0xc224]
test eax, eax
jne 0x415668
mov byte [ebp + 0x34d94], 0x30
mov al, byte [ebp + 0xf4a1]
mov byte [ebp + 0x34d95], al
mov ax, word [ebp + 0xf4a2]
mov word [ebp + 0x34d96], ax
mov al, byte [ebp + 0xf4a4]
mov byte [ebp + 0x34d98], al
mov edi, dword [ebp - 0x4c]
lea esi, [edi + 0x11d]
lea edi, [ebp + 0x34d98]
mov edx, 0x105
mov dword [ebp + 0x8c], esp
call sub.carclw62.dll_GOL_A8
lea edi, [ebp + 0x34d98]
or byte [edi], 0x30
lea esi, [ebp + 0x34d94]
lea edi, [ebp + 0xd718]
mov edx, 0xc0000504
mov dword [ebp + 0x8c], esp
call sub.carclw62.dll_GOL_85
mov dword [ebp + 0xc224], 0
cmp dword [ebp + 0xd718], 3
jb 0x41580c
cmp dword [ebp + 0xd718], 0x104
ja 0x41580c
mov eax, 0x20202020
lea edi, [ebp + 0xcde8]
mov ecx, 0x41
rep stosd dword es:[edi], eax
jmp 0x4156cd
lea eax, [ebp + 0xcde8]
mov dword [ebp + 0xe0], eax
call fcn.004156a6
mov eax, dword [ebp + 0x34d94]
cmp eax, 1
jl 0x4156f8
cmp eax, 0x104
jle 0x4156fc
int 4
jmp 0x4156e4
mov dword [ebp + 0xec], eax
cmp eax, 0x104
jle 0x415732
lea eax, [ebp + 0xdbbd]
mov dword [ebp + 0xec], eax
mov dword [ebp + 0xe4], 0
mov dword [ebp + 0xe8], 0x104
jmp 0x4157d6
mov edi, dword [ebp + 0xe0]
mov ebx, dword [ebp + 0xec]
mov ecx, dword [ebp + 0xec]
lea esi, [ebp + 0xdbbd]
mov eax, 0x20202020
mov dword [ebp + 0x8c], esp
call sub.carclw62.dll_GOL_COPYFILL
mov eax, 0x104
sub eax, dword [ebp + 0xec]
mov dword [ebp + 0xe8], eax
mov eax, dword [ebp + 0xec]
mov dword [ebp + 0xe4], eax
cmp dword [ebp + 0xe8], 0x104
jge 0x415798
lea eax, [ebp + 0xcce4]
mov dword [ebp + 0xec], eax
jmp 0x4157d6
mov edi, dword [ebp + 0xe0]
mov ebx, dword [ebp + 0xe4]
lea esi, [ebp + 0xcce4]
lea edi, [edi + ebx]
mov ecx, 0x104
mov dword [ebp + 0x8c], esp
call sub.carclw62.dll_GOL_COPYDATA
sub dword [ebp + 0xe8], 0x104
add dword [ebp + 0xe4], 0x104
jmp 0x41581f
mov edi, dword [ebp + 0xe0]
mov edx, dword [ebp + 0xe4]
mov esi, dword [ebp + 0xec]
mov ebx, dword [ebp + 0xe8]
mov ecx, dword [ebp + 0xe8]
lea edi, [edi + edx]
mov eax, 0x20202020
mov dword [ebp + 0x8c], esp
call sub.carclw62.dll_GOL_COPYFILL
jmp 0x41581f
lea esi, [ebp + 0xcce4]
lea edi, [ebp + 0xcde8]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov dword [ebp + 0x5be4], 0x4f434f4c
mov word [ebp + 0x5be8], 0x4f53
xor eax, eax
mov dword [ebp + 0x1d530], eax
mov word [ebp + 0x1d534], ax
cmp dword [ebp + 0xd718], 3
jb 0x4158b1
cmp dword [ebp + 0xd718], 0x104
ja 0x4158b1
push 0x10001
push 0x104
lea eax, [ebp + 0xcde8]
push eax
lea eax, [ebp + 0x60]
push eax
mov dword [ebp + 0x8c], esp
call sub.carclw62.dll_CARC__GetDynamicCallAddress
add esp, 0x10
mov dword [ebp + 0x84], eax
mov eax, dword [ebp + 0x84]
lea ecx, [ebp + 0xc4c0]
push ecx
push 0x10001
mov dword [ebp + 0x8c], esp
mov byte [ebp + 0x7b], 1
call eax
add esp, 8
mov byte [ebp + 0x7b], 0
jmp 0x4158ff
push 0x10001
push 0x104
lea eax, [ebp + 0xcce4]
push eax
lea eax, [ebp + 0x60]
push eax
mov dword [ebp + 0x8c], esp
call sub.carclw62.dll_CARC__GetDynamicCallAddress
add esp, 0x10
mov dword [ebp + 0x84], eax
mov eax, dword [ebp + 0x84]
lea ecx, [ebp + 0xc4c0]
push ecx
push 0x10001
mov dword [ebp + 0x8c], esp
mov byte [ebp + 0x7b], 1
call eax
add esp, 8
mov byte [ebp + 0x7b], 0
mov dword [ebp + 0x12708], 0x2d
call fcn.00419474
mov dword [ebp + 0x1c902], 0x17
call fcn.004194bf
mov dword [ebp + 0x1c902], 0x15
call fcn.004194bf
mov byte [ebp + 0x1caff], 0x4c
mov dword [ebp + 0x1cb00], 0x204f434f
lea edi, [ebp + 0x1cb04]
mov eax, 0x20202020
mov ecx, 0xf8
rep stosd dword es:[edi], eax
mov word [ebp + 0x1cee4], 0x2020
mov byte [ebp + 0x1cee6], 0x20
mov dword [ebp + 0x1c902], 5
call fcn.004194bf
lea edi, [ebp + 0x1cb0c]
mov al, byte [edi - 0xd]
cmp al, 0x4c
jne 0x4159ea
cmp dword [edi - 0xc], 0x2d4f434f
jne 0x4159ea
cmp dword [edi - 8], 0x2d524957
jne 0x4159ea
cmp dword [edi - 4], 0x444e4953
jne 0x4159ea
mov eax, 0x20202020
mov ecx, 0xf6
repe scasd eax, dword es:[edi]
jne 0x4159ea
cmp ax, word [edi]
jne 0x4159ea
cmp al, byte [edi + 2]
jne 0x4159ea
mov byte [ebp + 0xd23c], 0x4c
cmp byte [ebp + 0xd780], 0x66
jne 0x4159f1
mov byte [ebp + 0xd780], 0x4a
jmp 0x4159f1
mov byte [ebp + 0xd23c], 0
mov byte [ebp + 0x1caff], 0x4c
mov dword [ebp + 0x1cb00], 0x5f4f434f
mov dword [ebp + 0x1cb04], 0x504d4f43
mov dword [ebp + 0x1cb08], 0x52454c49
lea edi, [ebp + 0x1cb0c]
mov eax, 0x20202020
mov ecx, 0xf6
rep stosd dword es:[edi], eax
mov word [ebp + 0x1cee4], 0x2020
mov byte [ebp + 0x1cee6], 0x20
mov byte [ebp + 0x1cee7], 0x43
mov dword [ebp + 0x1cee8], 0x20202041
lea edi, [ebp + 0x1ceec]
mov eax, 0x20202020
mov ecx, 0xf8
rep stosd dword es:[edi], eax
mov word [ebp + 0x1d2cc], 0x2020
mov byte [ebp + 0x1d2ce], 0x20
mov dword [ebp + 0x1c902], 0x62
call fcn.004194bf
ret