Function at 0x40a4ee
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 3
call fcn.004355f2
mov edi, eax
test edi, edi
je 0x40a861
push ebx
push esi
mov ebx, 0x2d0
push ebx
push 1
call fcn.00478d6e
mov esi, eax
test esi, esi
je 0x40a85f
push ebx
xor ebx, ebx
push ebx
push esi
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x65
call fcn.004355f2
mov dword [esi + 0x4c], eax
test eax, eax
je 0x40a57a
sub eax, edi
mov dword [esi + 0x48], eax
lea eax, [ebp - 0x2c]
push 0x40
push eax
lea eax, [esi + 4]
mov dword [ebp - 0x2c], 0x78457350
push eax
mov dword [ebp - 0x28], 0x70537469
mov dword [ebp - 0x24], 0x61696365
mov dword [ebp - 0x20], 0x6370416c
mov dword [ebp - 0x1c], ebx
call fcn.0047d6a8
mov byte [esi + 0x43], bl
push 0x66
call fcn.004355f2
mov dword [esi + 0x9c], eax
test eax, eax
je 0x40a5c4
sub eax, edi
mov dword [esi + 0x98], eax
lea eax, [ebp - 0x2c]
push 0x40
push eax
lea eax, [esi + 0x54]
mov dword [ebp - 0x2c], 0x72467845
push eax
mov dword [ebp - 0x28], 0x61436565
mov dword [ebp - 0x24], 0x61426c6c
mov dword [ebp - 0x20], 0x6b63
call fcn.0047d6a8
mov byte [esi + 0x93], bl
push 0x67
call fcn.004355f2
mov dword [esi + 0xec], eax
test eax, eax
je 0x40a614
sub eax, edi
mov dword [esi + 0xe8], eax
lea eax, [ebp - 0x2c]
push 0x40
push eax
lea eax, [esi + 0xa4]
mov dword [ebp - 0x2c], 0x45707350
push eax
mov dword [ebp - 0x28], 0x4e746978
mov dword [ebp - 0x24], 0x616d726f
mov dword [ebp - 0x20], 0x6370416c
mov dword [ebp - 0x1c], ebx
call fcn.0047d6a8
mov byte [esi + 0xe3], bl
push 0x64
call fcn.004355f2
mov dword [esi + 0x13c], eax
test eax, eax
jne 0x40a637
call fcn.0047f5ba
push 0x64
call fcn.004355f2
mov dword [esi + 0x13c], eax
mov eax, dword [esi + 0x13c]
test eax, eax
je 0x40a67d
sub eax, edi
mov dword [esi + 0x138], eax
lea eax, [ebp - 0x2c]
push 0x40
push eax
lea eax, [esi + 0xf4]
mov dword [ebp - 0x2c], 0x45707350
push eax
mov dword [ebp - 0x28], 0x54746978
mov dword [ebp - 0x24], 0x61657268
mov dword [ebp - 0x20], 0x64
call fcn.0047d6a8
mov byte [esi + 0x133], bl
push 0x63
call fcn.004355f2
mov dword [esi + 0x18c], eax
test eax, eax
je 0x40a6df
sub eax, edi
mov dword [esi + 0x188], eax
lea eax, [ebp - 0x2c]
push 0x40
push eax
lea eax, [esi + 0x144]
mov dword [ebp - 0x2c], 0x54707350
push eax
mov dword [ebp - 0x28], 0x696d7265
mov dword [ebp - 0x24], 0x6574616e
mov dword [ebp - 0x20], 0x65726854
mov dword [ebp - 0x1c], 0x79426461
mov dword [ebp - 0x18], 0x6e696f50
mov dword [ebp - 0x14], 0x726574
call fcn.0047d6a8
mov byte [esi + 0x183], bl
push 0x1cd
call fcn.004355f2
mov dword [esi + 0x1dc], eax
test eax, eax
je 0x40a72f
sub eax, edi
mov dword [esi + 0x1d8], eax
lea eax, [ebp - 0x2c]
push 0x40
push eax
lea eax, [esi + 0x194]
mov dword [ebp - 0x2c], 0x6146694b
push eax
mov dword [ebp - 0x28], 0x61437473
mov dword [ebp - 0x24], 0x6e456c6c
mov dword [ebp - 0x20], 0x797274
call fcn.0047d6a8
mov byte [esi + 0x1d3], bl
push 0x23f
call fcn.004355f2
mov dword [esi + 0x22c], eax
test eax, eax
jne 0x40a758
call fcn.0047efe4
push 0x23f
call fcn.004355f2
mov dword [esi + 0x22c], eax
mov eax, dword [esi + 0x22c]
test eax, eax
je 0x40a7a1
sub eax, edi
mov dword [esi + 0x228], eax
lea eax, [ebp - 0x2c]
push 0x40
push eax
lea eax, [esi + 0x1e4]
mov dword [ebp - 0x2c], 0x6e49694b
push eax
mov dword [ebp - 0x28], 0x74726573
mov dword [ebp - 0x24], 0x75657551
mov dword [ebp - 0x20], 0x63704165
mov dword [ebp - 0x1c], ebx
call fcn.0047d6a8
mov byte [esi + 0x223], bl
push 0x33c
call fcn.004355f2
mov dword [esi + 0x27c], eax
test eax, eax
je 0x40a7f1
sub eax, edi
mov dword [esi + 0x278], eax
lea eax, [ebp - 0x2c]
push 0x40
push eax
lea eax, [esi + 0x234]
mov dword [ebp - 0x2c], 0x66706f49
push eax
mov dword [ebp - 0x28], 0x6c6c6143
mov dword [ebp - 0x24], 0x76697244
mov dword [ebp - 0x20], 0x7265
call fcn.0047d6a8
mov byte [esi + 0x273], bl
push 0x2aa
call fcn.004355f2
mov dword [esi + 0x2cc], eax
test eax, eax
je 0x40a848
sub eax, edi
mov dword [esi + 0x2c8], eax
lea eax, [ebp - 0x2c]
push 0x40
push eax
lea eax, [esi + 0x284]
mov dword [ebp - 0x2c], 0x66706f49
push eax
mov dword [ebp - 0x28], 0x706d6f43
mov dword [ebp - 0x24], 0x6574656c
mov dword [ebp - 0x20], 0x75716552
mov dword [ebp - 0x1c], 0x747365
call fcn.0047d6a8
mov byte [esi + 0x2c3], bl
push 9
push 0x23d
call fcn.004356b2
push esi
push 0x23e
call fcn.004356b2
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00489f30
mov esp, ebp
pop ebp
ret