Function at 0x416eb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x630
push ebx
mov dl, 0x53
push ebp
push esi
mov byte [esp + 0x58], dl
mov byte [esp + 0x8b], dl
xor esi, esi
mov cl, 0x5c
mov al, 0x72
mov bl, 0x65
mov dl, 0x67
push edi
mov dword [esp + 0xac], esi
mov byte [esp + 0x5d], 0x4f
mov byte [esp + 0x5e], 0x46
mov byte [esp + 0x5f], 0x54
mov byte [esp + 0x60], 0x57
mov byte [esp + 0x61], 0x41
mov byte [esp + 0x62], 0x52
mov byte [esp + 0x63], 0x45
mov byte [esp + 0x64], cl
mov byte [esp + 0x65], 0x4d
mov byte [esp + 0x66], 0x69
mov byte [esp + 0x67], 0x63
mov byte [esp + 0x68], al
mov byte [esp + 0x69], 0x6f
mov byte [esp + 0x6a], 0x73
mov byte [esp + 0x6b], 0x6f
mov byte [esp + 0x6c], 0x66
mov byte [esp + 0x6d], 0x74
mov byte [esp + 0x6e], cl
mov byte [esp + 0x6f], 0x57
mov byte [esp + 0x70], 0x69
mov byte [esp + 0x71], 0x6e
mov byte [esp + 0x72], 0x64
mov byte [esp + 0x73], 0x6f
mov byte [esp + 0x74], 0x77
mov byte [esp + 0x75], 0x73
mov byte [esp + 0x76], cl
mov byte [esp + 0x77], 0x43
mov byte [esp + 0x78], 0x75
mov byte [esp + 0x79], al
mov byte [esp + 0x7a], al
mov byte [esp + 0x7b], bl
mov byte [esp + 0x7c], 0x6e
mov byte [esp + 0x7d], 0x74
mov byte [esp + 0x7e], 0x56
mov byte [esp + 0x7f], bl
mov byte [esp + 0x80], al
mov byte [esp + 0x81], 0x73
mov byte [esp + 0x82], 0x69
mov byte [esp + 0x83], 0x6f
mov byte [esp + 0x84], 0x6e
mov byte [esp + 0x85], cl
mov byte [esp + 0x86], 0x49
mov byte [esp + 0x87], 0x6e
mov byte [esp + 0x88], 0x74
mov byte [esp + 0x89], bl
mov byte [esp + 0x8a], al
mov byte [esp + 0x8b], 0x6e
mov byte [esp + 0x8c], bl
mov byte [esp + 0x8d], 0x74
mov byte [esp + 0x8e], 0x20
mov byte [esp + 0x90], bl
mov byte [esp + 0x91], 0x74
mov byte [esp + 0x92], 0x74
mov byte [esp + 0x93], 0x69
mov byte [esp + 0x94], 0x6e
mov byte [esp + 0x95], dl
mov byte [esp + 0x96], 0x73
mov byte [esp + 0x97], cl
mov byte [esp + 0x98], 0x35
mov byte [esp + 0x99], 0x2e
mov byte [esp + 0x9a], 0x30
mov byte [esp + 0x9b], cl
mov byte [esp + 0x9c], 0x55
mov byte [esp + 0x9d], 0x73
mov byte [esp + 0x9e], bl
mov byte [esp + 0x9f], al
mov byte [esp + 0xa0], 0x20
mov byte [esp + 0xa1], 0x41
push esi
mov byte [esp + 0xa6], dl
mov byte [esp + 0xa7], bl
mov byte [esp + 0xa8], 0x6e
mov byte [esp + 0xa9], 0x74
mov byte [esp + 0xaa], 0
call dword [sym.imp.MSVCRT.dll_time]
mov ebp, eax
mov al, 0x6c
add esp, 4
mov byte [esp + 0x3c], al
mov byte [esp + 0x30], al
mov cl, 0x62
lea eax, [esp + 0x10]
mov byte [esp + 0x3b], cl
mov byte [esp + 0x2f], cl
push eax
push 1
lea ecx, [esp + 0x64]
push esi
mov dl, 0x61
push ecx
push SysReAllocString
mov byte [esp + 0x48], 0x43
mov byte [esp + 0x49], 0x6f
mov byte [esp + 0x4a], 0x6d
mov byte [esp + 0x4b], 0x70
mov byte [esp + 0x4c], dl
mov byte [esp + 0x4d], 0x74
mov byte [esp + 0x4e], 0x69
mov byte [esp + 0x51], bl
mov byte [esp + 0x52], 0x20
mov byte [esp + 0x53], 0x77
mov byte [esp + 0x54], 0x69
mov byte [esp + 0x55], 0x6e
mov byte [esp + 0x56], 0x33
mov byte [esp + 0x57], 0x32
mov byte [esp + 0x58], 0x20
mov byte [esp + 0x59], 0
mov byte [esp + 0x3c], 0x43
mov byte [esp + 0x3d], 0x6f
mov byte [esp + 0x3e], 0x6d
mov byte [esp + 0x3f], 0x70
mov byte [esp + 0x40], dl
mov byte [esp + 0x41], 0x74
mov byte [esp + 0x42], 0x69
mov byte [esp + 0x45], bl
mov byte [esp + 0x46], 0
mov byte [esp + 0x30], 0x57
mov byte [esp + 0x31], 0x69
mov byte [esp + 0x32], 0x6e
mov byte [esp + 0x33], 0x64
mov byte [esp + 0x34], 0x6f
mov byte [esp + 0x35], 0x77
mov byte [esp + 0x36], 0x73
mov byte [esp + 0x37], 0x2f
mov byte [esp + 0x38], 0
call dword [0x43bbf8]
test eax, eax
jne 0x4172cc
lea edx, [esp + 0x14]
lea eax, [esp + 0x240]
push edx
mov edx, dword [esp + 0x14]
push eax
push esi
lea ecx, [esp + 0x34]
push esi
push ecx
push edx
mov dword [esp + 0x2c], 0x400
call dword [0x43bbf4]
test eax, eax
jne 0x4172b5
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
lea eax, [esp + 0x34]
lea ecx, [esp + 0x240]
push eax
push ecx
call edi
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4172b5
lea edx, [esp + 0x1c]
push edx
push ebx
call edi
mov edx, eax
add esp, 8
test edx, edx
je 0x4172b5
lea edi, [esp + 0x34]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x240]
mov dword [esp + 0xa8], ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0xa8]
lea edi, [esp + 0x240]
sub eax, edi
not ecx
dec ecx
lea eax, [eax + ebx + 6]
cmp ecx, eax
jbe 0x4172b5
mov ecx, 0x32
xor eax, eax
lea edi, [esp + 0xb0]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0xa8]
sub edx, eax
sub edx, ebx
test edx, edx
jle 0x4172b5
mov ecx, edx
lea esi, [eax + ebx]
lea edi, [esp + 0xb0]
lea eax, [esp + 0xb0]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [0x43bc3c]
mov edi, eax
xor ecx, ecx
cmp edi, 0xffffffff
setne cl
cmp edi, 0x7e42f8ec
mov esi, ecx
je 0x4172b1
cmp edi, 0xad5bf53f
je 0x4172b1
cmp edi, 0x7b4f6d92
je 0x4172b1
cmp edi, 0xda186fd2
je 0x4172b1
cmp edi, 0x4f390664
je 0x4172b1
cmp edi, 0xb71a4d89
jne 0x4172b9
xor esi, esi
jmp 0x4172b9
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push edx
call dword [0x43bc00]
test esi, esi
jne 0x417414
call fcn.00417cf0
mov esi, eax
test esi, esi
mov dword [esp + 0x14], esi
jne 0x417304
push eax
call dword [sym.imp.MSVCRT.dll_time]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 8
call dword [sym.imp.MSVCRT.dll_rand]
mov esi, eax
and esi, 0xff
add esi, 0x23456700
mov dword [esp + 0x14], esi
mov ecx, dword [esp + 0x17]
mov edx, dword [esp + 0x16]
mov al, 0x25
push ebp
mov byte [esp + 0x4c], al
mov byte [esp + 0x4e], al
mov byte [esp + 0x51], al
mov byte [esp + 0x54], al
mov byte [esp + 0x57], al
mov byte [esp + 0x59], al
mov byte [esp + 0x5b], al
lea eax, [esp + 0x20]
and ecx, 0xff
push eax
mov eax, dword [esp + 0x1d]
push ecx
and edx, 0xff
mov ecx, esi
and eax, 0xff
push edx
and ecx, 0xff
push eax
lea edx, [esp + 0x48]
push ecx
lea eax, [esp + 0x60]
push edx
lea ecx, [esp + 0x194]
push eax
push ecx
mov byte [esp + 0x6d], 0x73
mov byte [esp + 0x6f], 0x64
mov byte [esp + 0x70], 0x2e
mov byte [esp + 0x72], 0x64
mov byte [esp + 0x73], 0x2e
mov byte [esp + 0x75], 0x64
mov byte [esp + 0x76], 0x2e
mov byte [esp + 0x78], 0x64
mov byte [esp + 0x7a], 0x73
mov byte [esp + 0x7c], 0x75
mov byte [esp + 0x7d], 0
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x24
lea edx, [esp + 0xac]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x5c]
push edx
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push ecx
push SysReAllocString
call dword [0x43bc08]
test eax, eax
jne 0x417407
lea edi, [esp + 0x178]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x178]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 1
push eax
lea eax, [esp + 0x38]
push eax
push ecx
call dword [0x43bbf0]
mov edx, dword [esp + 0x10]
push edx
call dword [0x43bc00]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x630
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x630
ret