Function at 0x4013b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x8a4
mov eax, dword [0x40b004]
xor eax, esp
mov dword [esp + 0x89c], eax
push ebx
push ebp
push esi
push edi
push 0
push 0
push 3
push 0
push 3
mov edi, ecx
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4018ad
mov eax, 0xeeeeeeee
push 0x50
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
lea eax, [esp + 0x24]
push 0
push eax
call fcn.004060f0
add esp, 0xc
push 0
mov eax, 0xa
lea edx, [esp + 0x20]
push edx
push 0x50
mov byte [esp + 0x32], al
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x24]
push 0x50
mov dword [esp + 0x48], ecx
mov ecx, eax
push ecx
push 0x4d014
push esi
mov word [esp + 0x40], 0x2c
mov byte [esp + 0x43], 0
mov byte [esp + 0x44], 1
mov byte [esp + 0x45], 0
mov byte [esp + 0x48], 1
mov byte [esp + 0x47], 0
mov dword [esp + 0x4c], 6
mov dword [esp + 0x58], 0x30
mov byte [esp + 0x5c], 0xca
mov byte [esp + 0x5d], 5
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [esp + 0x14], 0x9502
jne 0x4018ad
cmp byte [esp + 0x18], 2
jne 0x4018ad
push 0x400
lea edx, [esp + 0x74]
push 0
push edx
call fcn.004060f0
push edi
lea edx, [esp + 0x80]
xor ecx, ecx
call fcn.00401280
add esp, 0x10
xor eax, eax
lea esp, [esp]
mov ecx, dword [esp + eax*8 + 0x70]
mov edx, ecx
shl edx, 0x10
mov dword [esp + 0x10], ecx
and ecx, 0xff00
add edx, ecx
movzx ecx, byte [esp + eax*8 + 0x73]
shl edx, 8
add edx, ecx
xor ecx, ecx
mov ch, byte [esp + 0x12]
add eax, 2
add edx, ecx
mov ecx, dword [esp + eax*8 + 0x64]
mov dword [esp + eax*8 + 0x60], edx
mov edx, ecx
shl edx, 0x10
mov dword [esp + 0x10], ecx
and ecx, 0xff00
add edx, ecx
movzx ecx, byte [esp + eax*8 + 0x67]
shl edx, 8
add edx, ecx
xor ecx, ecx
mov ch, byte [esp + 0x12]
add edx, ecx
mov ecx, dword [esp + eax*8 + 0x68]
mov dword [esp + eax*8 + 0x64], edx
mov edx, ecx
mov dword [esp + 0x10], ecx
shl edx, 0x10
and ecx, 0xff00
add edx, ecx
movzx ecx, byte [esp + eax*8 + 0x6b]
shl edx, 8
add edx, ecx
xor ecx, ecx
mov ch, byte [esp + 0x12]
add edx, ecx
mov ecx, dword [esp + eax*8 + 0x6c]
mov dword [esp + eax*8 + 0x68], edx
mov edx, ecx
mov dword [esp + 0x10], ecx
shl edx, 0x10
and ecx, 0xff00
add edx, ecx
movzx ecx, byte [esp + eax*8 + 0x6f]
shl edx, 8
add edx, ecx
xor ecx, ecx
mov ch, byte [esp + 0x12]
add edx, ecx
cmp eax, 0x1a
mov dword [esp + eax*8 + 0x6c], edx
jb 0x4014c0
push 0x400
lea edx, [esp + 0x4ac]
push 0
push edx
call fcn.004060f0
mov ecx, dword [esp + 0x134]
add ecx, 2
push edi
lea edx, [esp + 0x4b8]
call fcn.00401280
xor eax, eax
mov dword [esp + 0x4a8], eax
mov dword [esp + 0x4ac], eax
mov dword [esp + 0x4b0], eax
mov dword [esp + 0x4b4], eax
xor eax, eax
mov ah, byte [esp + 0x4da]
mov ecx, 0x9a
lea esi, [esp + 0x4b8]
lea edi, [esp + 0x80]
rep movsd dword es:[edi], dword [esi]
movzx cx, byte [esp + 0x4de]
or ax, cx
movzx eax, ax
movsw word es:[edi], word [esi]
movsx esi, ax
lea edx, [esp + 0x81]
add esp, 0x10
sub esi, edx
xor eax, eax
mov edi, 0x10
jmp 0x401610
lea ecx, [esp + eax + 0x71]
lea edx, [esi + ecx]
and edx, 0x80003fff
jns 0x401627
dec edx
or edx, 0xffffc000
inc edx
mov dl, byte [edx + 0x40bcb8]
xor dl, byte [ecx]
add eax, 1
sub edi, 1
mov byte [esp + eax + 0x497], dl
jne 0x401610
mov al, 0x31
mov cl, 0x48
mov dl, 0x59
mov byte [esp + 0x474], cl
mov byte [esp + 0x47a], cl
mov cl, 0x46
mov bl, 0x42
mov byte [esp + 0x475], al
mov byte [esp + 0x47b], al
mov byte [esp + 0x47d], al
mov byte [esp + 0x47f], dl
mov byte [esp + 0x480], cl
mov byte [esp + 0x481], al
mov byte [esp + 0x486], cl
mov byte [esp + 0x487], al
mov byte [esp + 0x48b], dl
mov byte [esp + 0x48c], cl
mov byte [esp + 0x48d], al
mov byte [esp + 0x492], cl
mov byte [esp + 0x493], al
mov byte [esp + 0x495], al
mov byte [esp + 0x497], dl
mov byte [esp + 0x476], 0x30
mov byte [esp + 0x477], 0x32
mov byte [esp + 0x478], 0x47
mov byte [esp + 0x479], 0x50
mov byte [esp + 0x47c], 0x30
mov byte [esp + 0x47e], bl
mov byte [esp + 0x482], 0x30
mov byte [esp + 0x483], 0x34
mov byte [esp + 0x484], 0x47
mov byte [esp + 0x485], 0x50
mov byte [esp + 0x488], 0x30
mov byte [esp + 0x489], 0x33
mov byte [esp + 0x48a], bl
mov byte [esp + 0x48e], 0x30
mov byte [esp + 0x48f], 0x32
mov byte [esp + 0x490], 0x47
mov byte [esp + 0x491], 0x50
mov byte [esp + 0x494], 0x30
mov byte [esp + 0x496], bl
mov eax, 0x10
lea ecx, [esp + 0x81]
lea edx, [esp + 0x498]
mov esi, dword [edx]
cmp esi, dword [ecx]
jne 0x40177f
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x401767
test eax, eax
je 0x4017dc
movzx esi, byte [edx]
movzx edi, byte [ecx]
sub esi, edi
jne 0x4017ce
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4017dc
movzx esi, byte [edx]
movzx edi, byte [ecx]
sub esi, edi
jne 0x4017ce
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4017dc
movzx esi, byte [edx]
movzx edi, byte [ecx]
sub esi, edi
jne 0x4017ce
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4017dc
movzx esi, byte [edx]
movzx eax, byte [ecx]
sub esi, eax
je 0x4017dc
test esi, esi
mov eax, 1
jg 0x4017de
or eax, 0xffffffff
jmp 0x4017de
xor eax, eax
test eax, eax
jne 0x4018ad
xor ebp, ebp
lea edi, [esp + 0x479]
mov eax, 5
lea ecx, [esp + 0x71]
lea edx, [edi - 5]
jmp 0x401800
mov esi, dword [edx]
cmp esi, dword [ecx]
jne 0x401818
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x401800
test eax, eax
je 0x401875
movzx ebx, byte [ecx]
movzx esi, byte [edx]
sub esi, ebx
jne 0x401867
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x401875
movzx ebx, byte [ecx]
movzx esi, byte [edx]
sub esi, ebx
jne 0x401867
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x401875
movzx ebx, byte [ecx]
movzx esi, byte [edx]
sub esi, ebx
jne 0x401867
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x401875
movzx ecx, byte [ecx]
movzx esi, byte [edx]
sub esi, ecx
je 0x401875
test esi, esi
mov eax, 1
jg 0x401877
or eax, 0xffffffff
jmp 0x401877
xor eax, eax
test eax, eax
jne 0x401886
mov dl, byte [edi]
cmp dl, byte [esp + 0x4b8]
je 0x4018a3
add ebp, 1
add edi, 6
cmp ebp, 6
mov dword [0x4109c8], 0xffffffff
jl 0x4017ef
mov al, 1
jmp 0x4018af
mov dword [0x4109c8], ebp
mov al, 1
jmp 0x4018af
xor al, al
mov ecx, dword [esp + 0x8ac]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00401e3a
add esp, 0x8a4
ret