Function at 0x416640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51cb80
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x562494]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
mov edx, 0x54a9d0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x14]
call fcn.00406850
add esp, 4
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x3c], 0x6e0041
mov dword [ebp - 0x38], 0x740079
mov dword [ebp - 0x34], 0x690068
mov dword [ebp - 0x30], 0x67006e
mov dword [ebp - 0x2c], 0x6c002e
mov dword [ebp - 0x28], 0x6b006e
mov word [ebp - 0x24], ax
call fcn.00409bb0
mov ecx, eax
test ecx, ecx
je 0x4169b0
mov eax, dword [ecx]
push 2
push 0xc
call dword [eax]
test eax, eax
je 0x4169ba
cmp dword [eax + 8], 0xc
lea ecx, [eax + 0x10]
mov dword [ebp - 0x18], ecx
jl 0x4169a6
xor eax, eax
mov dword [ecx - 0xc], 0xc
mov word [ecx + 0x18], ax
mov edx, 0x18
lea eax, [ebp - 0x3c]
push 0x18
push eax
call fcn.0040a070
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004069d0
add esp, 0x14
mov byte [ebp - 4], 3
or esi, 0xffffffff
mov ecx, dword [ebp - 0x18]
mov eax, esi
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jg 0x416771
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4169bf
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ebx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4169bf
push 0
push dword [edx + 4]
call edi
mov ecx, dword [ebp - 0x1c]
call fcn.004131c0
mov byte [ebp - 4], 0
mov eax, esi
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4167bc
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4169c8
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ebx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4169c8
push 0
push dword [edx + 4]
call edi
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x416802
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4169d1
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ebx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4169d1
push 0
push dword [edx + 4]
call edi
push ecx
mov edx, 0x54a9a0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
call fcn.00406850
add esp, 4
mov dword [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x58], 0x6e0041
mov dword [ebp - 0x54], 0x740079
mov dword [ebp - 0x50], 0x690068
mov dword [ebp - 0x4c], 0x67006e
mov dword [ebp - 0x48], 0x6c002e
mov dword [ebp - 0x44], 0x6b006e
mov word [ebp - 0x40], ax
call fcn.00409bb0
mov ecx, eax
test ecx, ecx
je 0x4169da
mov eax, dword [ecx]
push 2
push 0xc
call dword [eax]
test eax, eax
je 0x4169e4
cmp dword [eax + 8], 0xc
lea ecx, [eax + 0x10]
mov dword [ebp - 0x14], ecx
jl 0x4169a6
xor eax, eax
mov dword [ecx - 0xc], 0xc
mov word [ecx + 0x18], ax
mov edx, 0x18
lea eax, [ebp - 0x58]
push 0x18
push eax
call fcn.0040a070
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004069d0
add esp, 0x14
mov byte [ebp - 4], 7
mov eax, esi
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4168ff
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4169e9
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ebx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4169e9
push 0
push dword [edx + 4]
call edi
mov ecx, dword [ebp - 0x20]
call fcn.004131c0
mov byte [ebp - 4], 4
mov eax, esi
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41694a
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4169f2
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ebx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4169f2
push 0
push dword [edx + 4]
call edi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], esi
dec esi
test esi, esi
jg 0x41698a
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4169fb
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4169fb
push 0
push dword [edx + 4]
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004affa8
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.0040a130
push 0x80004005
call fcn.0040a130
call fcn.00409240
mov ecx, edx
call ebx
jmp 0x416771
mov ecx, edx
call ebx
jmp 0x4167bc
mov ecx, edx
call ebx
jmp 0x416802
push 0x80004005
call fcn.0040a130
call fcn.00409240
mov ecx, edx
call ebx
jmp 0x4168ff
mov ecx, edx
call ebx
jmp 0x41694a
mov ecx, edx
call esi
jmp 0x41698a