Function at 0x401947
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x410d6b
push eax
mov dword fs:[0], esp
sub esp, 0xcac
push esi
push edi
mov dword [esp + 0xc], 0x19ac1f2e
mov dword [esp + 8], 0x5f95acd9
mov dword [esp + 0x10], 0x5180829b
mov dword [esp + 0x14], 0x1ccc377c
mov dword [esp + 0x34], 0x43b29a2c
mov dword [esp + 0x24], 0x1109f3d1
mov dword [esp + 0x2c], 0x5c4aae1a
mov dword [esp + 0x1c], 0x4e757e39
mov dword [esp + 0x18], 0x7ea84dc7
mov dword [esp + 0x20], 0x2462bc31
mov dword [esp + 0x70], 0x149c7692
mov dword [esp + 0x94], 0x400db490
mov dword [esp + 0x28], 0x127c64a9
mov dword [esp + 0x60], 0x181f5526
mov dword [esp + 0x3c], 0x1ec81a5f
mov dword [esp + 0x30], 0x5ed76764
mov dword [esp + 0x80], 0x75e92202
mov dword [esp + 0x38], 0x6d5308bd
mov dword [esp + 0x50], 0x511cf560
mov dword [esp + 0x4c], 0xe8ef72
mov dword [esp + 0x68], 0x1a54711e
mov dword [esp + 0x90], 0x5a35f7f1
mov dword [esp + 0x54], 0x17d5ded
mov dword [esp + 0x8c], 0x6dbcdfc1
mov dword [esp + 0x44], 0x32f16b60
mov dword [esp + 0x40], 0x736f2545
mov dword [esp + 0x78], 0x7218196c
mov dword [esp + 0x58], 0x2d6c3c3f
mov dword [esp + 0x48], 0x1127fcf7
mov dword [esp + 0x5c], 0x1b69b247
mov dword [esp + 0x64], 0x1e24a7dd
mov dword [esp + 0x6c], 0x6953e4fd
mov dword [esp + 0x74], 0x1a593632
mov dword [esp + 0x7c], 0x5939a991
mov dword [esp + 0x84], 0x42b93e0
mov eax, 0x4db83974
mul dword [esp + 0xc]
mov eax, dword [esp + 0xc]
add dword [esp + 0xc], 0x325454c1
sub dword [esp + 0xc], 0xf1df4e8
add dword [esp + 0xc], 0x70c5dd15
sub dword [esp + 8], 0x106bceeb
add dword [esp + 8], 0x105522f3
sub dword [esp + 8], 0x3e69267a
add dword [esp + 0x14], 0x645c0756
sub dword [esp + 0xc], 0x5989193b
add dword [esp + 8], 0x69b02dab
mov eax, 0x174226b
mul dword [esp + 8]
mov eax, dword [esp + 8]
sub dword [esp + 0x10], 0x4441c554
add dword [esp + 0x34], 0x402a380d
mov eax, 0x7ac405eb
mul dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, 0x363c5938
mul dword [esp + 0x10]
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 0xd8f4c89
add dword [esp + 0x14], 0x5fca7cf4
sub dword [esp + 0x24], 0x185911a7
add dword [esp + 0x1c], 0x49d2af4
add dword [esp + 0x2c], 0x37bb66ea
add dword [esp + 0x10], 0x21870240
mov eax, 0x38cdd83d
mul dword [esp + 0x18]
mov eax, dword [esp + 0x18]
sub dword [esp + 8], 0x7411751a
mov eax, 0x79bb7a31
mul dword [esp + 0x18]
mov eax, dword [esp + 0x18]
sub dword [esp + 0x2c], 0x6e184dff
add dword [esp + 0x1c], 0x39e28f6c
mov eax, 0x11f51bb9
mul dword [esp + 0x10]
mov eax, dword [esp + 0x10]
sub dword [esp + 0x18], 0x1f7f13d7
sub dword [esp + 0x18], 0x60106b11
sub dword [esp + 0x14], 0x39c630b1
add dword [esp + 0x20], 0x5edc9f0f
sub dword [esp + 0x10], 0x73f34f3f
mov eax, 0x5a52a8ff
mul dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, 0x6d2d823c
mul dword [esp + 0x28]
mov eax, dword [esp + 0x28]
sub dword [esp + 0xc], 0x2fa0f88f
sub dword [esp + 0x34], 0x42a6017c
add dword [esp + 0x14], 0x5f04d22b
add dword [esp + 8], 0xf3060f4
add dword [esp + 0x20], 0x4ddedd50
mov eax, 0x22f0de27
mul dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, 0x6d7066c8
mul dword [esp + 0x50]
mov eax, dword [esp + 0x50]
add dword [esp + 0x28], 0x41ad4585
sub dword [esp + 0x38], 0x43f94165
mov eax, 0x32306a9f
mul dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, 0x1292f0b0
mul dword [esp + 0x44]
mov eax, dword [esp + 0x44]
mov eax, 0x1a116a6f
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
add dword [esp + 0x30], 0x7104dc19
add dword [esp + 0x4c], 0x2d4583f6
mov eax, 0x66a76c53
mul dword [esp + 0x30]
mov eax, dword [esp + 0x30]
sub dword [esp + 0x40], 0x786f44d1
sub dword [esp + 0x24], 0x5239d75f
sub dword [esp + 0x28], 0x34bb77a0
sub dword [esp + 0x48], 0x13066554
sub dword [esp + 0x3c], 0x1a0ee67b
sub dword [esp + 0x38], 0x2d8650a5
xor edi, edi
mov esi, edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp esi, 0xb8615b
jg 0x401cb2
inc esi
cmp esi, 0x1e70dee2
jl 0x401c98
cmp dword [0x65ed04], 0x400
jne 0x401d3a
push edi
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoA]
push edi
push edi
call dword [sym.imp.USER32.dll_DdeCmpStringHandles]
push edi
push 0x431040
call fcn.004037c5
push str.zidexidafusit
push edi
call fcn.00403874
add esp, 0x10
lea ecx, [esp + 0x98]
call fcn.00401df8
push edi
mov dword [esp + 0xcc0], edi
call fcn.00403474
pop ecx
push edi
push edi
call fcn.00403a3d
push edi
push edi
push edi
call fcn.00403b77
add esp, 0x14
xorps xmm0, xmm0
call fcn.004010d0
push edi
call fcn.00403c52
or dword [esp + 0xcc0], 0xffffffff
pop ecx
lea ecx, [esp + 0x98]
call fcn.00401e1d
mov esi, edi
push edi
lea eax, [esp + 0xb4]
push eax
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0x58bc14
jle 0x401d70
cmp dword [esp + 0x88], 0x7a45f535
jne 0x401d79
inc esi
cmp esi, 0xe154
jl 0x401d3c
mov eax, dword [0x41a694]
mov dword [0x65ed04], eax
call fcn.004015be
mov esi, 0x3078f
cmp dword [0x65ed04], 0x51f
jne 0x401da8
push edi
lea eax, [esp + 0x4b4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec esi
jne 0x401d8d
mov ecx, dword [esp + 0xcb4]
xor eax, eax
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10