Function at 0x41aae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41b141
push eax
mov dword fs:[0], esp
sub esp, 4
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov esi, ecx
push 0
mov ebx, 3
push eax
lea edi, [esi + 0x68]
push 0xb9
call fcn.0042edc0
mov dword [ebp - 4], 0
mov ecx, edi
mov dword [esi + 0x64], ebx
call fcn.00444461
mov byte [ebp - 4], 1
lea ecx, [esi + 0xa4]
mov dword [edi], 0x465244
mov byte [ebp - 4], 2
call fcn.00444461
lea ecx, [esi + 0xe0]
mov byte [ebp - 4], bl
mov dword [esi + 0xa4], 0x465244
mov byte [ebp - 4], 2
mov ebx, 4
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 5
lea edi, [esi + 0x11c]
mov byte [ebp - 4], bl
mov ebx, 6
mov ecx, edi
mov dword [esi + 0xe0], 0x465244
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 7
lea ecx, [esi + 0x158]
mov dword [edi], 0x465244
mov byte [ebp - 4], bl
mov ebx, 8
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 9
lea edi, [esi + 0x194]
mov byte [ebp - 4], bl
mov ebx, 0xa
mov ecx, edi
mov dword [esi + 0x158], 0x46517c
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0xb
mov dword [edi], 0x46517c
lea ecx, [esi + 0x1d0]
mov byte [ebp - 4], bl
mov ebx, 0xc
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0xd
lea edi, [esi + 0x20c]
mov byte [ebp - 4], bl
mov ebx, 0xe
mov ecx, edi
mov dword [esi + 0x1d0], 0x465244
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0xf
lea ecx, [esi + 0x248]
mov dword [edi], 0x465244
mov byte [ebp - 4], bl
mov ebx, 0x10
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x11
lea edi, [esi + 0x284]
mov byte [ebp - 4], bl
mov ebx, 0x12
mov ecx, edi
mov dword [esi + 0x248], 0x465244
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x13
lea ecx, [esi + 0x2c0]
mov dword [edi], 0x465244
mov byte [ebp - 4], bl
mov ebx, 0x14
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x15
lea edi, [esi + 0x2fc]
mov byte [ebp - 4], bl
mov ebx, 0x16
mov ecx, edi
mov dword [esi + 0x2c0], 0x465244
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x17
lea ecx, [esi + 0x338]
mov dword [edi], 0x46517c
mov byte [ebp - 4], bl
mov ebx, 0x18
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x19
lea edi, [esi + 0x374]
mov byte [ebp - 4], bl
mov ebx, 0x1a
mov ecx, edi
mov dword [esi + 0x338], 0x46517c
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x1b
mov dword [edi], 0x46517c
mov byte [ebp - 4], bl
mov ebx, 0x1c
lea ecx, [esi + 0x3b0]
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x1d
lea edi, [esi + 0x3ec]
mov byte [ebp - 4], bl
mov ebx, 0x1e
mov ecx, edi
mov dword [esi + 0x3b0], 0x46517c
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x1f
lea ecx, [esi + 0x428]
mov dword [edi], 0x46517c
mov byte [ebp - 4], bl
mov ebx, 0x20
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x21
lea edi, [esi + 0x464]
mov byte [ebp - 4], bl
mov ebx, 0x22
mov ecx, edi
mov dword [esi + 0x428], 0x46517c
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x23
lea ecx, [esi + 0x4a0]
mov dword [edi], 0x46517c
mov byte [ebp - 4], bl
mov ebx, 0x24
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x25
lea ecx, [esi + 0x4dc]
mov byte [ebp - 4], bl
mov dword [esi + 0x4a0], 0x46517c
mov ebx, 0x26
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x27
lea edi, [esi + 0x518]
mov byte [ebp - 4], bl
mov ebx, 0x28
mov ecx, edi
mov dword [esi + 0x4dc], 0x46517c
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x29
lea ecx, [esi + 0x554]
mov dword [edi], 0x46517c
mov byte [ebp - 4], bl
mov ebx, 0x2a
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x2b
mov dword [esi + 0x554], 0x46517c
mov byte [ebp - 4], bl
mov ebx, 0x2c
mov byte [ebp - 4], bl
lea ecx, [esi + 0x590]
lea edi, [esi + 0x5cc]
call fcn.00444461
mov byte [ebp - 4], 0x2d
mov ecx, edi
mov byte [ebp - 4], bl
mov dword [esi + 0x590], 0x4653d4
mov ebx, 0x2e
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x2f
lea ecx, [esi + 0x608]
mov dword [edi], 0x465244
mov byte [ebp - 4], bl
mov ebx, 0x30
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x31
lea edi, [esi + 0x644]
mov byte [ebp - 4], bl
mov ebx, 0x32
mov ecx, edi
mov dword [esi + 0x608], 0x465244
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x33
lea ecx, [esi + 0x680]
mov dword [edi], 0x465244
mov byte [ebp - 4], bl
mov ebx, 0x34
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x35
lea ecx, [esi + 0x6bc]
mov byte [ebp - 4], bl
mov dword [esi + 0x680], 0x46517c
mov ebx, 0x36
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x37
lea edi, [esi + 0x6f8]
mov byte [ebp - 4], bl
mov ebx, 0x38
mov ecx, edi
mov dword [esi + 0x6bc], 0x46517c
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x39
lea ecx, [esi + 0x734]
mov dword [edi], 0x46517c
mov byte [ebp - 4], bl
mov ebx, 0x3a
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x3b
lea ecx, [esi + 0x770]
mov byte [ebp - 4], bl
mov dword [esi + 0x734], 0x46517c
mov ebx, 0x3c
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x3d
lea edi, [esi + 0x7ac]
mov byte [ebp - 4], bl
mov ebx, 0x3e
mov ecx, edi
mov dword [esi + 0x770], 0x46517c
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x3f
lea ecx, [esi + 0x7e8]
mov dword [edi], 0x46517c
mov byte [ebp - 4], bl
mov ebx, 0x40
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x41
lea edi, [esi + 0x824]
mov byte [ebp - 4], bl
mov ebx, 0x42
mov ecx, edi
mov dword [esi + 0x7e8], 0x46517c
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x43
lea ecx, [esi + 0x860]
mov dword [edi], 0x46517c
mov byte [ebp - 4], bl
mov ebx, 0x44
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x45
lea ecx, [esi + 0x89c]
mov byte [ebp - 4], bl
mov dword [esi + 0x860], 0x46517c
mov ebx, 0x46
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x47
lea edi, [esi + 0x8d8]
mov byte [ebp - 4], bl
mov ebx, 0x48
mov ecx, edi
mov dword [esi + 0x89c], 0x46517c
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x49
lea ecx, [esi + 0x914]
mov dword [edi], 0x46517c
mov byte [ebp - 4], bl
mov ebx, 0x4a
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x4b
lea ecx, [esi + 0x950]
mov byte [ebp - 4], bl
mov dword [esi + 0x914], 0x465244
mov ebx, 0x4c
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x4d
mov dword [esi + 0x950], 0x465244
lea edi, [esi + 0x98c]
mov byte [ebp - 4], bl
mov ebx, 0x4e
mov ecx, edi
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x4f
lea ecx, [esi + 0x9c8]
mov dword [edi], 0x465244
mov byte [ebp - 4], bl
mov ebx, 0x50
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x51
lea edi, [esi + 0xa04]
mov byte [ebp - 4], bl
mov ebx, 0x52
mov ecx, edi
mov dword [esi + 0x9c8], 0x46517c
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x53
lea ecx, [esi + 0xa40]
mov dword [edi], 0x46517c
mov byte [ebp - 4], bl
mov ebx, 0x54
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x55
lea ecx, [esi + 0xa7c]
mov byte [ebp - 4], bl
mov dword [esi + 0xa40], 0x46517c
mov ebx, 0x56
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x57
lea edi, [esi + 0xab8]
mov byte [ebp - 4], bl
mov ebx, 0x58
mov ecx, edi
mov dword [esi + 0xa7c], 0x46517c
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x59
lea ecx, [esi + 0xaf4]
mov dword [edi], 0x46517c
mov byte [ebp - 4], bl
mov ebx, 0x5a
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x5b
lea ecx, [esi + 0xb30]
mov byte [ebp - 4], bl
mov dword [esi + 0xaf4], 0x46517c
mov ebx, 0x5c
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x5d
mov dword [esi + 0xb30], 0x46517c
mov byte [ebp - 4], bl
mov ebx, 0x5e
lea edi, [esi + 0xb6c]
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.00444461
mov byte [ebp - 4], 0x5f
lea ecx, [esi + 0xba8]
mov dword [edi], 0x46517c
mov byte [ebp - 4], bl
mov ebx, 0x60
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x61
lea edi, [esi + 0xbe4]
mov byte [ebp - 4], bl
mov ebx, 0x62
mov ecx, edi
mov dword [esi + 0xba8], 0x46517c
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x63
lea ecx, [esi + 0xc20]
mov dword [edi], 0x465244
mov byte [ebp - 4], bl
mov ebx, 0x64
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x65
lea ecx, [esi + 0xc5c]
mov byte [ebp - 4], bl
mov dword [esi + 0xc20], 0x465244
mov ebx, 0x66
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x67
lea edi, [esi + 0xc98]
mov byte [ebp - 4], bl
mov ebx, 0x68
mov ecx, edi
mov dword [esi + 0xc5c], 0x465244
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x69
lea ecx, [esi + 0xcd4]
mov dword [edi], 0x46530c
mov byte [ebp - 4], bl
mov ebx, 0x6a
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x6b
lea edi, [esi + 0xd10]
mov byte [ebp - 4], bl
mov ebx, 0x6c
mov ecx, edi
mov dword [esi + 0xcd4], 0x46517c
mov byte [ebp - 4], bl
call fcn.00444461
mov byte [ebp - 4], 0x6d
mov dword [edi], 0x46517c
mov byte [ebp - 4], bl
mov ebx, 0x6e
mov byte [ebp - 4], bl
lea ecx, [esi + 0xd4c]
call fcn.00444461
lea ecx, [esi + 0xd88]
lea edi, [esi + 0xd8c]
mov byte [ebp - 4], 0x6f
mov dword [esi + 0xd4c], 0x46517c
mov byte [ebp - 4], 0x70
call fcn.00442379
mov byte [ebp - 4], 0x71
mov ecx, edi
call fcn.00442379
mov byte [ebp - 4], 0x72
lea ecx, [esi + 0xd90]
lea ebx, [esi + 0xd98]
call fcn.00442379
mov byte [ebp - 4], 0x73
lea ecx, [esi + 0xd94]
call fcn.00442379
mov byte [ebp - 4], 0x74
mov ecx, ebx
call fcn.00442379
mov byte [ebp - 4], 0x75
lea ecx, [esi + 0xd9c]
call fcn.00442379
mov byte [ebp - 4], 0x76
lea ecx, [esi + 0xda0]
call fcn.00442379
mov byte [ebp - 4], 0x77
lea ecx, [esi + 0xda4]
call fcn.00442379
mov byte [ebp - 4], 0x78
lea ecx, [esi + 0xda8]
call fcn.00442379
mov byte [ebp - 4], 0x79
lea ecx, [esi + 0xdac]
call fcn.00442379
mov byte [ebp - 4], 0x7a
lea ecx, [esi + 0xdb0]
call fcn.00442379
mov byte [ebp - 4], 0x7b
lea ecx, [esi + 0xdb4]
call fcn.00442379
mov byte [ebp - 4], 0x7c
lea ecx, [esi + 0xdb8]
call fcn.00442379
mov byte [ebp - 4], 0x7d
lea ecx, [esi + 0xdbc]
call fcn.00442379
mov byte [ebp - 4], 0x7e
lea ecx, [esi + 0xdc0]
call fcn.00442379
mov byte [ebp - 4], 0x7f
lea ecx, [esi + 0xdc4]
call fcn.00442379
mov byte [ebp - 4], pe_nt_image_headers32
lea ecx, [esi + 0xdc8]
call fcn.00442379
mov byte [ebp - 4], 0x81
lea ecx, [esi + 0xdcc]
call fcn.00442379
mov byte [ebp - 4], 0x82
lea ecx, [esi + 0xdd0]
call fcn.00442379
mov byte [ebp - 4], 0x83
lea ecx, [esi + 0xdd4]
call fcn.00442379
mov byte [ebp - 4], 0x84
lea ecx, [esi + 0xdd8]
call fcn.0040cb60
mov byte [ebp - 4], 0x85
lea ecx, [esi + 0xe28]
call fcn.0040cb60
mov byte [ebp - 4], 0x86
lea ecx, [esi + 0xe78]
call fcn.0040cb60
mov byte [ebp - 4], 0x87
lea ecx, [esi + 0xec8]
call fcn.0040cb60
mov byte [ebp - 4], 0x88
lea ecx, [esi + 0xf18]
call fcn.0040cb60
mov byte [ebp - 4], 0x89
lea ecx, [esi + 0xf68]
call fcn.0042a5f0
push 0x4721bc
lea ecx, [esi + 0xd88]
mov byte [ebp - 4], 0x8a
mov dword [esi + 0xf94], 1
mov dword [esi + 0xf8c], 0
mov dword [esi], 0x463388
call fcn.00442627
push 0x4721bc
mov ecx, edi
call fcn.00442627
push 0x4721bc
lea ecx, [esi + 0xd90]
call fcn.00442627
push 0x4721bc
lea ecx, [esi + 0xd94]
call fcn.00442627
push 0x4721bc
mov ecx, ebx
call fcn.00442627
push 0x4721bc
lea ecx, [esi + 0xd9c]
call fcn.00442627
push 0x4721bc
lea ecx, [esi + 0xda0]
call fcn.00442627
push 0x4721bc
lea ecx, [esi + 0xda4]
call fcn.00442627
push 0x4721bc
lea ecx, [esi + 0xda8]
call fcn.00442627
push 0x4721bc
lea ecx, [esi + 0xdac]
call fcn.00442627
push 0x4721bc
lea ecx, [esi + 0xdb0]
call fcn.00442627
push 0x4721bc
lea ecx, [esi + 0xdb4]
call fcn.00442627
push 0x4721bc
lea ecx, [esi + 0xdb8]
call fcn.00442627
push 0x4721bc
lea ecx, [esi + 0xdbc]
call fcn.00442627
push 0x4721bc
lea ecx, [esi + 0xdc0]
call fcn.00442627
push 0x4721bc
lea ecx, [esi + 0xdc4]
call fcn.00442627
push 0x4721bc
lea ecx, [esi + 0xdc8]
call fcn.00442627
push 0x4721bc
lea ecx, [esi + 0xdcc]
call fcn.00442627
push 0x4721bc
lea ecx, [esi + 0xdd0]
call fcn.00442627
push 0x4721bc
lea ecx, [esi + 0xdd4]
call fcn.00442627
mov eax, esi
pop edi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4