Function at 0x414160
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4482f3
mov eax, dword fs:[0]
push eax
sub esp, 0x160
push ebx
push esi
push edi
mov eax, dword [0x47699c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, fcn.00414160
xor ecx, ecx
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x50], ecx
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], esi
call fcn.00410760
mov dword [ebp - 4], 1
mov edi, dword [ebp + 8]
jmp 0x4141c0
mov ebx, dword [esi + 0x8c]
push edi
mov dword [esi + 0x8c], edi
call fcn.00407e70
push eax
push 0x4513b0
call fcn.00443a34
mov edx, dword [esi + 0x8c]
lea ecx, [ebp - 0x24]
push edx
push ecx
call fcn.00407f10
mov ecx, dword [eax]
mov dword [esi + 0x90], ecx
mov ax, word [eax + 4]
add esp, 0x14
mov word [esi + 0x94], ax
cmp edx, 0xa
ja case.default.0x41420c
jmp dword [edx*4 + 0x4149f0]
mov ecx, esi
call fcn.004119c0
xor ecx, ecx
test al, al
sete cl
lea ecx, [ecx + ecx + 3]
mov edi, ecx
jmp 0x4141c0
cmp ebx, 2
jne 0x414586
push 0x476a08
mov ecx, esi
call fcn.004132d0
test al, al
jne 0x414586
cmp byte [0x476aa2], al
jne 0x414586
lea edi, [ebx + 3]
jmp 0x4141c0
mov eax, dword [esi + 0x7c]
mov ecx, dword [esi + 0x68]
push 1
push eax
push ecx
mov ecx, esi
call fcn.0040da00
mov edi, 6
jmp 0x4141c0
cmp dword [esi + 0x40], 0
mov edi, 8
je 0x4141c0
mov eax, dword [esi + 0x30]
mov edx, dword [eax + 0x2d4c]
mov ecx, dword [edx + 0xc]
mov edx, dword [ecx + eax + 0x2d4c]
lea ecx, [ecx + eax + 0x2d4c]
mov eax, dword [edx + 4]
call eax
mov eax, dword [eax]
sub eax, 0
jne 0x4144c0
push 0x451390
call dword [0x44f924]
add esp, 4
test al, al
jne 0x4141c0
push 8
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x90]
push edx
mov edi, 0x407fa0
xor ebx, ebx
call fcn.0040e140
mov byte [ebp - 4], 0x26
add esp, 4
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
mov dword [ebp - 0x10], ecx
call fcn.0040f710
mov byte [ebp - 4], 0x28
sub esp, 8
mov ecx, esp
lea eax, [ebp - 0x34]
mov dword [ebp - 0x10], esp
push eax
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x1c], ecx
call fcn.004107f0
mov byte [ebp - 4], 0x2a
mov esi, dword [esi + 0x40]
push 1
mov byte [ebp - 4], 0x26
mov ecx, esi
call dword [0x44f9dc]
mov byte [ebp - 4], 1
mov esi, dword [0x44f45c]
lea ecx, [ebp - 0x90]
call esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x40], 0
mov edi, 9
je 0x4141c0
push edi
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0xc0]
push edx
call fcn.0040e140
add esp, 0xc
mov byte [ebp - 4], 0x3e
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040f710
mov byte [ebp - 4], 0x41
mov edi, dword [0x44f45c]
lea ecx, [ebp - 0xc0]
call edi
push 0x451370
lea ecx, [ebp - 0x108]
call dword [0x44f860]
mov byte [ebp - 4], 0x47
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x6c]
push ecx
call fcn.0040d3d0
mov byte [ebp - 4], 0x48
push eax
lea edx, [ebp - 0x7c]
push edx
call fcn.0040e900
mov bl, 0x49
mov byte [ebp - 4], bl
add esp, 8
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
mov dword [ebp - 0x10], ecx
call fcn.0040fac0
mov byte [ebp - 4], 0x4b
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x2c]
push ecx
mov byte [ebp - 4], bl
call dword [0x44f5b4]
add esp, 0x10
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x7c]
call edi
mov byte [ebp - 4], 0x55
lea ecx, [ebp - 0x6c]
call edi
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0x108]
call dword [0x44f8a0]
mov ebx, dword [0x44f46c]
sub esp, 8
mov ecx, esp
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x24], esp
push edx
mov dword [ebp - 0x10], ecx
call ebx
mov byte [ebp - 4], 0x5e
sub esp, 8
mov ecx, esp
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x10], esp
push eax
mov dword [ebp - 0x1c], ecx
call ebx
mov byte [ebp - 4], 0x61
mov eax, dword [esi + 0x7c]
mov ecx, dword [esi + 0x68]
push eax
mov edx, eax
mov edx, dword [edx]
push ecx
mov ebx, ecx
push edx
push ebx
lea ecx, [ebp - 0x124]
call fcn.0040ecb0
mov byte [ebp - 4], 0x62
mov ecx, dword [esi + 0x40]
push eax
mov byte [ebp - 4], 0x63
call dword [0x44f91c]
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0x124]
call fcn.0040de70
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x2c]
call edi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3c]
call edi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
sub eax, 1
je 0x4142c4
sub eax, 1
je 0x414762
lea eax, [ebp - 0x24]
push ebx
push eax
mov dword [esi + 0x8c], ebx
call fcn.00407f10
mov ecx, dword [eax]
mov dword [esi + 0x90], ecx
mov dx, word [eax + 4]
add esp, 8
mov word [esi + 0x94], dx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call dword [0x44f45c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
jmp 0x4144f8
push 2
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0xb4]
push edx
call fcn.0040e140
mov bl, 4
mov byte [ebp - 4], bl
add esp, 4
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
mov dword [ebp - 0x10], ecx
call fcn.0040f710
mov byte [ebp - 4], 6
mov byte [ebp - 4], bl
mov ecx, esi
call fcn.00413fc0
mov byte [ebp - 4], 1
mov esi, dword [0x44f45c]
lea ecx, [ebp - 0xb4]
call esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
jmp 0x4144f8
cmp dword [esi + 0x44], 0
lea edi, [esi + 0x44]
je 0x4145b8
mov ecx, edi
call fcn.004093a0
push 0x43
push 0
push 0
push 0
push 0
add eax, 4
mov eax, dword [eax]
push 0
push eax
call dword [0x44f2b8]
jmp 0x41473b
push 0xbd8
call fcn.00442b66
add esp, 4
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0x10
test eax, eax
je 0x4145e1
mov edx, dword [esi + 0x30]
push 1
push edx
mov ecx, eax
call fcn.004373d0
mov ebx, eax
jmp 0x4145e3
xor ebx, ebx
mov byte [ebp - 4], 1
mov eax, dword [edi]
cmp eax, ebx
je 0x41461e
test eax, eax
je 0x414602
mov ecx, dword [eax + 0x20]
mov edx, dword [ecx + 4]
push edi
lea ecx, [edx + eax + 0x20]
call dword [0x44f484]
mov dword [edi], ebx
test ebx, ebx
je 0x41461e
mov eax, dword [ebx + 0x20]
mov ecx, dword [eax + 4]
push 0x408d90
push edi
lea ecx, [ecx + ebx + 0x20]
call dword [0x44f464]
push 3
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x9c]
push eax
call fcn.0040e140
add esp, 0xc
mov byte [ebp - 4], 0x11
push eax
lea ecx, [ebp - 0x64]
call fcn.0040f710
mov byte [ebp - 4], 0x13
mov eax, dword [edi]
test eax, eax
jne 0x414660
lea ecx, [ebp - 0x16c]
call dword [0x44f820]
mov byte [ebp - 4], 0x14
push eax
call fcn.004014d0
mov ebx, dword [0x44f73c]
lea ecx, [ebp - 0x64]
push ecx
mov ecx, dword [eax + 0x20]
lea edx, [ebp + 8]
push edx
mov edx, dword [ecx + 8]
lea ecx, [edx + eax + 0x28]
call ebx
lea ecx, [ebp + 8]
call dword [0x44f44c]
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x64]
call dword [0x44f45c]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x9c]
call dword [0x44f45c]
mov eax, 0x409b30
xor ecx, ecx
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x30], ecx
push eax
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
call fcn.00410640
mov byte [ebp - 4], 0x1d
mov eax, dword [edi]
test eax, eax
jne 0x4146df
lea ecx, [ebp - 0x16c]
call dword [0x44f820]
mov byte [ebp - 4], 0x1e
push eax
call fcn.004014d0
lea ecx, [ebp - 0x5c]
push ecx
mov ecx, dword [eax + 0x20]
lea edx, [ebp - 0x44]
push edx
mov edx, dword [ecx + 8]
lea ecx, [edx + eax + 0x28]
call ebx
lea ecx, [ebp - 0x44]
call dword [0x44f44c]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5c]
call dword [0x44f45c]
mov edi, dword [edi]
test edi, edi
jne 0x414725
lea ecx, [ebp - 0x16c]
call dword [0x44f820]
mov byte [ebp - 4], 0x21
push eax
call fcn.004014d0
mov eax, dword [edi + 0x20]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx + edi + 0x20]
mov eax, dword [edx]
lea ecx, [ecx + edi + 0x20]
push 1
push 1
call eax
jmp 0x4144f8
cmp edx, 6
jne 0x41475d
push 0
call dword [0x44f918]
add esp, 4
test eax, eax
jne 0x41475d
push 7
mov ecx, esi
call fcn.00414160
jmp 0x4144f8
push 8
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0xa8]
push edx
mov edi, 0x407fa0
xor ebx, ebx
call fcn.0040e140
mov byte [ebp - 4], 0x32
add esp, 4
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
mov dword [ebp - 0x1c], ecx
call fcn.0040f710
mov byte [ebp - 4], 0x34
sub esp, 8
mov ecx, esp
lea eax, [ebp - 0x34]
mov dword [ebp - 0x1c], esp
push eax
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], ecx
call fcn.004107f0
mov byte [ebp - 4], 0x36
mov esi, dword [esi + 0x40]
push 1
mov byte [ebp - 4], 0x32
mov ecx, esi
call dword [0x44f914]
mov byte [ebp - 4], 1
mov esi, dword [0x44f45c]
lea ecx, [ebp - 0xa8]
call esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xa
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x50]
push edx
call fcn.0040e140
add esp, 0xc
mov byte [ebp - 4], 0x6a
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040f710
mov byte [ebp - 4], 0x6d
mov esi, dword [0x44f45c]
lea ecx, [ebp - 0x50]
call esi
push 0x45134c
lea ecx, [ebp - 0xe4]
call dword [0x44f860]
mov byte [ebp - 4], 0x73
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x74]
push ecx
call fcn.0040d3d0
mov byte [ebp - 4], 0x74
push eax
lea edx, [ebp - 0x84]
push edx
call fcn.0040e900
mov bl, 0x75
mov byte [ebp - 4], bl
add esp, 8
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
mov dword [ebp - 0x10], ecx
call fcn.0040fac0
mov byte [ebp - 4], 0x77
lea eax, [ebp - 0xe4]
push eax
lea ecx, [ebp - 0x2c]
push ecx
mov byte [ebp - 4], bl
call dword [0x44f5b4]
add esp, 0x10
mov byte [ebp - 4], 0x79
lea ecx, [ebp - 0x84]
call esi
mov byte [ebp - 4], 0x81
lea ecx, [ebp - 0x74]
call esi
mov bl, 0x87
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xe4]
call dword [0x44f8a0]
mov edi, dword [0x44f46c]
sub esp, 8
mov ecx, esp
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x24], esp
push edx
mov dword [ebp - 0x10], ecx
call edi
mov byte [ebp - 4], 0x8a
sub esp, 8
mov ecx, esp
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x10], esp
push eax
mov dword [ebp - 0x1c], ecx
call edi
mov byte [ebp - 4], 0x8d
call dword [0x44f69c]
mov byte [ebp - 4], bl
mov ecx, eax
call dword [0x44f788]
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x2c]
call esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3c]
call esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi + 0x30]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push 1
call eax
mov ecx, dword [esi + 0x34]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push 1
call eax
push 0x493e0
lea ecx, [ebp - 0x40]
push str.LocalVMware_KVM_application_mutex_D26466E6_8415_4255_96B0_F7A54C46F7E4
push ecx
call fcn.00405890
add esp, 0xc
mov byte [ebp - 4], 0x94
mov edi, dword [eax]
mov dword [eax], 0
mov dword [ebp - 0x24], edi
mov byte [ebp - 4], 0x96
mov eax, dword [ebp - 0x40]
mov ebx, eax
test eax, eax
je 0x4149a6
mov ecx, dword [eax]
test ecx, ecx
je 0x41499d
add eax, 4
cmp byte [eax], 0
mov dword [ebp - 0x1c], eax
je 0x414988
push ecx
call dword [0x44f10c]
mov edx, dword [ebx]
push edx
call dword [0x44f114]
mov eax, dword [ebp - 0x1c]
mov dword [ebx], 0
mov byte [eax], 0
push ebx
call fcn.00442ae6
add esp, 4
mov esi, dword [esi + 0xc]
mov ecx, dword [esi + 4]
push ecx
call dword [0x44f2c4]
mov byte [ebp - 4], 1
test edi, edi
je 0x4149ea
mov eax, dword [edi]
test eax, eax
je 0x4149e1
cmp byte [edi + 4], 0
je 0x4149ce
push eax
call dword [0x44f10c]
mov edx, dword [edi]
push edx
call dword [0x44f114]
mov dword [edi], 0
mov byte [edi + 4], 0
push edi
call fcn.00442ae6
add esp, 4
jmp 0x4144f8