Function at 0x402ca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x98
push ebx
xor eax, eax
mov dword [esp + 0x68], 0x65006b
push ebp
mov word [esp + 0x84], ax
mov eax, dword fs:[0x30]
mov dword [esp + 0x70], 0x6e0072
mov dword [esp + 0x74], 0x6c0065
mov dword [esp + 0x78], 0x320033
mov dword [esp + 0x7c], 0x64002e
mov dword [esp + 0x80], 0x6c006c
push esi
push edi
test eax, eax
je 0x402d57
mov eax, dword [eax + 0xc]
test eax, eax
je 0x402d57
mov ebx, dword [eax + 0xc]
lea ebp, [eax + 0xc]
cmp ebx, ebp
je 0x402d57
mov esi, dword [ebx + 0x30]
lea edi, [esp + 0x74]
nop dword [eax]
movzx eax, word [esi]
lea esi, [esi + 2]
lea ecx, [eax - 0x41]
cmp cx, 0x19
ja 0x402d22
add eax, 0x20
movzx edx, word [edi]
add edi, 2
lea ecx, [edx - 0x42]
cmp cx, 0x17
ja 0x402d34
add edx, 0x20
test ax, ax
je 0x402d48
cmp ax, dx
je 0x402d10
movzx ecx, dx
movzx eax, ax
sub eax, ecx
jmp 0x402d4d
movzx eax, dx
neg eax
test eax, eax
je 0x402d64
mov ebx, dword [ebx]
cmp ebx, ebp
jne 0x402d02
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x98
ret
mov edi, dword [ebx + 0x18]
test edi, edi
je 0x402d57
lea eax, [esp + 0x54]
mov dword [esp + 0x54], 0x50746547
push eax
push edi
mov dword [esp + 0x60], 0x41636f72
mov dword [esp + 0x64], 0x65726464
mov word [esp + 0x68], 0x7373
mov byte [esp + 0x6a], 0
call fcn.00402b50
mov ebx, eax
mov dword [esp + 0x24], 0x626f6c47
mov eax, fcn.00402b50
mov dword [esp + 0x28], 0x6c416c61
test ebx, ebx
mov dword [esp + 0x2c], 0x636f6c
mov dword [esp + 0x18], 0x626f6c47
cmove ebx, eax
mov dword [esp + 0x1c], 0x72466c61
lea eax, [esp + 0x24]
mov word [esp + 0x20], 0x6565
push eax
push edi
mov byte [esp + 0x2a], 0
call fcn.00402b50
mov ebp, eax
lea eax, [esp + 0x20]
push eax
push edi
call fcn.00402b50
add esp, 0x18
mov dword [esp + 0x90], eax
test ebp, ebp
je 0x402d57
test eax, eax
je 0x402d57
push 0x20
push pe_nt_image_headers32
call ebp
mov esi, eax
test esi, esi
je 0x402d57
mov eax, dword [esp + 0x90]
movaps xmm0, xmmword [0x401240]
mov dword [esi + 0x1c], eax
lea eax, [esp + 0x94]
push eax
push edi
mov dword [esi], ebx
mov dword [esi + 0x18], ebp
movups xmmword [esp + 0x9c], xmm0
mov byte [esp + 0xac], 0
call ebx
mov dword [esi + 4], eax
test eax, eax
je 0x402d57
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0x64616f4c
push eax
push edi
mov dword [esp + 0x40], 0x7262694c
mov dword [esp + 0x44], 0x41797261
mov byte [esp + 0x48], 0
call ebx
cmp dword [esi + 4], 0
mov dword [esi + 8], eax
je 0x402d57
lea eax, [esp + 0x44]
mov dword [esp + 0x44], 0x74726956
push eax
push edi
mov dword [esp + 0x50], 0x416c6175
mov dword [esp + 0x54], 0x636f6c6c
mov byte [esp + 0x58], 0
call ebx
cmp dword [esi + 4], 0
mov dword [esi + 0xc], eax
je 0x402d57
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x74726956
push eax
push edi
mov dword [esp + 0x34], 0x466c6175
mov dword [esp + 0x38], 0x656572
call ebx
cmp dword [esi + 4], 0
mov dword [esi + 0x10], eax
je 0x402d57
lea eax, [esp + 0x64]
mov dword [esp + 0x64], 0x74726956
push eax
push edi
mov dword [esp + 0x70], 0x506c6175
mov dword [esp + 0x74], 0x65746f72
mov word [esp + 0x78], 0x7463
mov byte [esp + 0x7a], 0
call ebx
cmp dword [esi + 4], 0
mov dword [esi + 0x14], eax
je 0x402d57
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x98
ret