Function at 0x402cc0
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings

Disassembly:
jmp 0x402cc0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x410
mov rdi, rsp
movabs rcx, 0x104
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x420]
mov qword [rsp + 0x3c8], 0xfffffffffffffffe
mov rax, qword [0x00492070]
xor rax, rsp
mov qword [rsp + 0x408], rax
mov byte [rsp + 0x38], 0x22
mov byte [rsp + 0x39], 3
mov byte [rsp + 0x3a], 0x16
mov byte [rsp + 0x3b], 0x23
mov byte [rsp + 0x3c], 0x15
mov byte [rsp + 0x3d], 0x1f
mov byte [rsp + 0x3e], 0x5a
mov byte [rsp + 0x3f], 0x54
mov byte [rsp + 0x40], 0x4a
mov byte [rsp + 0x41], 0x29
mov byte [rsp + 0x42], 0x1c
mov byte [rsp + 0x43], 0x1f
mov byte [rsp + 0x44], 0
mov byte [rsp + 0x64], 0x69
mov byte [rsp + 0x65], 0x66
mov byte [rsp + 0x66], 0x64
mov byte [rsp + 0x67], 0
mov byte [rsp + 0x84], 0x4d
mov byte [rsp + 0x85], 0x70
mov byte [rsp + 0x86], 0x73
mov byte [rsp + 0x87], 0
lea rax, [rsp + 0x84]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x64]
mov r8d, 0xc
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0xa8]
call fcn.00401069
nop
lea rax, [rsp + 0x268]
mov qword [rsp + 0x298], rax
lea rdx, [rsp + 0xa8]
mov rcx, qword [rsp + 0x298]
call fcn.0040119f
mov qword [rsp + 0x3d0], rax
mov dl, 1
mov rcx, qword [rsp + 0x3d0]
call fcn.004012b7
mov qword [rsp + 0xe8], rax
mov byte [rsp + 0xf8], 0xe
mov byte [rsp + 0xf9], 0x2a
mov byte [rsp + 0xfa], 0xb
mov byte [rsp + 0xfb], 0x15
mov byte [rsp + 0xfc], 0x28
mov byte [rsp + 0xfd], 0x21
mov byte [rsp + 0xfe], 0x23
mov byte [rsp + 0xff], 0x2e
mov byte [rsp + 0x100], 0x1e
mov byte [rsp + 0x101], 0
mov byte [rsp + 0x102], 0
mov r8d, 3
lea rdx, [0x0047afc4]
lea rcx, [rsp + 0x64]
call fcn.0040a430
mov r8d, 3
lea rdx, [0x0047afc8]
lea rcx, [rsp + 0x84]
call fcn.0040a430
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x2d0], rax
lea rax, [rsp + 0x84]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x64]
mov r8d, 0xa
lea rdx, [rsp + 0xf8]
mov rcx, qword [rsp + 0x2d0]
call fcn.00401069
mov qword [rsp + 0x3d8], rax
mov rdx, qword [rsp + 0x3d8]
mov rcx, qword [rsp + 0xe8]
call fcn.0040118b
mov qword [rsp + 0x118], rax
mov r8d, 0x1000
mov edx, 0x5dc
mov ecx, 0x40000
call qword [rsp + 0x118]
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x138], 0
lea rax, [rsp + 0x140]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov byte [rsp + 0x168], 0
mov byte [rsp + 0x169], 0xc
mov byte [rsp + 0x16a], 0x2a
mov byte [rsp + 0x16b], 0x2c
mov byte [rsp + 0x16c], 0x1d
mov byte [rsp + 0x16d], 0x38
mov byte [rsp + 0x16e], 7
mov byte [rsp + 0x16f], 0x4b
mov byte [rsp + 0x170], 0x20
mov byte [rsp + 0x171], 0x28
mov byte [rsp + 0x172], 5
mov byte [rsp + 0x173], 0
mov r8d, 3
lea rdx, [0x0047afcc]
lea rcx, [rsp + 0x64]
call fcn.0040a430
mov r8d, 3
lea rdx, [0x0047afd0]
lea rcx, [rsp + 0x84]
call fcn.0040a430
lea rax, [rsp + 0x84]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x64]
mov r8d, 0xb
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x198]
call fcn.00401069
nop
lea rax, [rsp + 0x2d8]
mov qword [rsp + 0x308], rax
lea rdx, [rsp + 0x198]
mov rcx, qword [rsp + 0x308]
call fcn.0040119f
mov qword [rsp + 0x3e0], rax
xor edx, edx
mov rcx, qword [rsp + 0x3e0]
call fcn.004012b7
mov qword [rsp + 0x1d8], rax
cmp qword [rsp + 0x1d8], 0
jne 0x403058
mov dword [rsp + 0x310], 0
lea rcx, [rsp + 0x198]
call fcn.0040124e
nop
lea rcx, [rsp + 0xa8]
call fcn.0040124e
mov eax, dword [rsp + 0x310]
jmp 0x403266
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x148], rax
lea rax, [rsp + 0x318]
mov qword [rsp + 0x348], rax
lea rax, [rsp + 0x350]
mov qword [rsp + 0x380], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rdx, rax
mov rcx, qword [rsp + 0x380]
call fcn.00401055
mov qword [rsp + 0x3e8], rax
mov rdx, qword [rsp + 0x3e8]
mov rcx, qword [rsp + 0x348]
call fcn.00401163
mov qword [rsp + 0x3f0], rax
mov rax, qword [rsp + 0x3f0]
mov qword [rsp + 0x3f8], rax
mov r9, qword [rsp + 0x3f8]
mov r8, qword [rsp + 0x1d8]
mov rdx, qword [rsp + 0xe8]
lea rcx, [rsp + 0x138]
call fcn.0040127b
mov byte [rsp + 0x1e8], 4
mov byte [rsp + 0x1e9], 0x15
mov byte [rsp + 0x1ea], 0x26
mov byte [rsp + 0x1eb], 0x23
mov byte [rsp + 0x1ec], 0x33
mov byte [rsp + 0x1ed], 0x19
mov byte [rsp + 0x1ee], 0x76
mov byte [rsp + 0x1ef], 0x43
mov byte [rsp + 0x1f0], 0x7e
mov byte [rsp + 0x1f1], 0x26
mov byte [rsp + 0x1f2], 0x2f
mov byte [rsp + 0x1f3], 0x1c
mov byte [rsp + 0x1f4], 0
mov r8d, 3
lea rdx, [0x0047afd4]
lea rcx, [rsp + 0x64]
call fcn.0040a430
mov r8d, 3
lea rdx, [0x0047afd8]
lea rcx, [rsp + 0x84]
call fcn.0040a430
lea rax, [rsp + 0x84]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x64]
mov r8d, 0xc
lea rdx, [rsp + 0x1e8]
lea rcx, [rsp + 0x218]
call fcn.00401069
nop
lea rax, [rsp + 0x388]
mov qword [rsp + 0x3b8], rax
lea rdx, [rsp + 0x218]
mov rcx, qword [rsp + 0x3b8]
call fcn.0040119f
mov qword [rsp + 0x400], rax
xor edx, edx
mov rcx, qword [rsp + 0x400]
call fcn.004012b7
mov qword [rsp + 0x258], rax
lea rdx, [rsp + 0x138]
mov rcx, qword [rsp + 0x258]
call fcn.00401208
xor r8d, r8d
mov rdx, qword [rsp + 0x138]
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumThreadWindows]
mov dword [rsp + 0x3c0], 0
lea rcx, [rsp + 0x218]
call fcn.0040124e
nop
lea rcx, [rsp + 0x198]
call fcn.0040124e
nop
lea rcx, [rsp + 0xa8]
call fcn.0040124e
mov eax, dword [rsp + 0x3c0]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x0047baa0]
call fcn.00409610
mov rax, rdi
mov rcx, qword [rsp + 0x408]
xor rcx, rsp
call fcn.004095f0
add rsp, 0x410
pop rdi
ret