Function at 0x401000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
mov ecx, ebx
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401020
sub ecx, edx
push esi
push edi
lea eax, [ecx + 2]
shr eax, 1
lea esi, [eax*4 + 4]
lea eax, [ecx + 2]
add eax, esi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x24], eax
xor edi, edi
mov dh, 1
lea ecx, [eax + esi]
xor esi, esi
mov dword [eax], ecx
xor al, al
mov dl, byte [ebx]
mov dword [ebp - 0xc], ecx
mov byte [ebp - 0x1e], al
mov byte [ebp - 0x1d], al
test dl, dl
je 0x4010e1
test al, al
je 0x40107a
cmp dl, 0x22
jne 0x401074
xor al, al
mov byte [ebp - 0x1e], al
jmp 0x4010d6
mov byte [ecx], dl
inc esi
inc ecx
jmp 0x4010d6
movsx eax, dl
add eax, 0xfffffff7
cmp eax, 0x19
ja case.0x40108c.11
movzx eax, byte [eax + 0x401330]
jmp dword [eax*4 + 0x401324]
mov al, 1
mov byte [ebp - 0x1e], al
mov byte [ebp - 0x1d], al
test dh, dh
je 0x4010d4
mov edx, dword [ebp - 0x24]
mov dword [edx + edi*4], ecx
inc edi
jmp 0x4010d4
cmp byte [ebp - 0x1d], 0
je 0x4010b3
mov byte [ecx], 0
inc esi
inc ecx
mov al, byte [ebp - 0x1e]
mov dh, 1
mov byte [ebp - 0x1d], 0
jmp 0x4010d6
mov byte [ebp - 0x1d], 1
test dh, dh
je 0x4010cd
mov eax, dword [ebp - 0x24]
mov dword [eax + edi*4], ecx
inc edi
mov al, byte [ebp - 0x1e]
inc esi
mov byte [ecx], dl
inc ecx
xor dh, dh
mov dl, byte [ebx + 1]
inc ebx
test dl, dl
jne 0x401064
mov ecx, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x24]
cmp edi, 2
mov byte [esi + ecx], 0
mov dword [ebx + edi*4], 0
pop edi
pop esi
jne 0x40130d
mov cl, 0x76
mov dword [ebp - 0x1c], 0x253e3776
mov dword [ebp - 0x18], 0x273f213e
xor eax, eax
mov dword [ebp - 0x14], 0x4744273d
mov word [ebp - 0x10], 0x46
nop dword [eax]
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 0xc
jae 0x40112f
mov cl, byte [ebp - 0x1c]
jmp 0x401120
mov eax, dword [ebx]
lea ecx, [ebp - 0x1b]
mov byte [ebp - 0xf], 0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401158
test dl, dl
je 0x401154
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401158
add eax, 2
add ecx, 2
test dl, dl
jne 0x401138
xor eax, eax
jmp 0x40115d
sbb eax, eax
or eax, 1
test eax, eax
je 0x401177
mov eax, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040145e
mov esp, ebp
pop ebp
ret 0x10
push dword [ebx + 4]
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
sub eax, 0x4cf00000
add esp, 4
cmp eax, 0x14d
ja 0x40125e
je 0x401257
lea ecx, [eax - 0x48]
cmp ecx, 0x88
ja case.0x401270.338
movzx ecx, byte [ecx + 0x401394]
jmp dword [ecx*4 + 0x40134c]
mov eax, str.Suspicious_Program_Detected__r_nPlease_close_tools_like_Bandicam_nDiscord_Overlay_etc___NAHIMIC___r_nUse_OBS_Screen_Capture_r_nRef_Code_:_P312
jmp 0x4012c2
mov eax, str.Cheat_Detected_r_nRef_Code_:_KLMO
jmp 0x4012c2
mov eax, str.Cheat_Detected_r_nRef_Code_:_SADW
jmp 0x4012c2
mov eax, str.Cheat_Detected_r_nRef_Code_:_SACA
jmp 0x4012c2
mov eax, str.Cheat_Detected_r_nRef_Code_:_RWQEQ
jmp 0x4012c2
mov eax, str.Cheat_Detected_r_nRef_Code_:_QWEQE_r_nIf_you_have_any_background_tools_running_for_overlays__etc._Please_close_them_
jmp 0x4012c2
mov eax, str.Cheat_Detected_r_nRef_Code_:_SADAS_r_nIf_you_have_any_background_tools_running_for_overlays__etc._Please_close_them_
jmp 0x4012c2
mov eax, str.Cheat_Detected_r_nRef_Code_:_ASDA_r_nIf_you_have_any_background_tools_running_for_overlays__etc._Please_close_them_
jmp 0x4012c2
mov eax, str.Cheat_Detected_r_nRef_Code_:_FGSDF_r_nIf_you_have_any_background_tools_running_for_overlays__etc._Please_close_them_
jmp 0x4012c2
mov eax, str.Cheat_Detected_r_nRef_Code_:_YYYY_r_nIf_you_have_any_background_tools_running_for_overlays__etc._Please_close_them_
jmp 0x4012c2
mov eax, str.Cheat_Detected_r_nRef_Code_:_POPO
jmp 0x4012c2
mov eax, str.Cheat_Detected_r_nRef_Code_:_PXPX
jmp 0x4012c2
mov eax, str.Cheat_Detected_r_nRef_Code_:_PZAE
jmp 0x4012c2
mov eax, str.Cheat_Detected_r_nRef_Code_:_PLVP
jmp 0x4012c2
mov eax, str.Cheat_Detected_r_nRef_Code_:_PQRE
jmp 0x4012c2
mov eax, str.Cheat_Detected_r_nRef_Code_:_PONM
jmp 0x4012c2
mov eax, str.Cheat_Detected_r_nRef_Code_:_QPQQ
jmp 0x4012c2
mov eax, str.Cheat_Detected_r_nRef_Code_:_FFFF
jmp 0x4012c2
lea ecx, [eax - 0x14e]
cmp ecx, 0x11
ja case.0x401270.338
movzx ecx, byte [ecx + 0x40144c]
jmp dword [ecx*4 + 0x401420]
mov eax, str.Cheat_Detected_r_nRef_Code_:_NNNN
jmp 0x4012c2
mov eax, str.Cheat_Detected_r_nRef_Code_:_QNNFN
jmp 0x4012c2
mov eax, str.Cheat_Detected_r_nRef_Code_:_QNNFZ
jmp 0x4012c2
mov eax, str.Cheat_Detected_r_nRef_Code_:_QNNFF
jmp 0x4012c2
mov eax, str.Cheat_Detected_r_nRef_Code_:_FFASD
jmp 0x4012c2
mov eax, str.Some_Services_didnt_start_correctly_nWe_Have_Started_it_for_u_:D_please_restart_the_computer_
jmp 0x4012c2
mov eax, str.Cheat_Detected_r_nRef_Code_:_FFFFF
jmp 0x4012c2
mov eax, str.Cheat_Detected_r_nRef_Code_:_FFFFFF
jmp 0x4012c2
mov eax, str.Cheat_Detected_r_nRef_Code_:_FFFFFFF
jmp 0x4012c2
mov eax, str.Cheat_Detected_r_nRef_Code_:_FFFFFFFF
jmp 0x4012c2
cmp byte [eax], 0
je 0x4012fa
mov dh, 5
mov byte [ebp - 7], 0
mov cl, 0x57
mov byte [ebp - 0xc], dh
mov ch, 0x60
mov byte [ebp - 7], 0
xor cl, dh
xor ch, dh
push 0
mov byte [ebp - 0xb], cl
mov dl, 0x64
mov byte [ebp - 8], ch
mov bl, 0x62
lea ecx, [ebp - 0xb]
xor dl, dh
push ecx
push eax
xor bl, dh
mov byte [ebp - 0xa], dl
push 0
mov byte [ebp - 9], bl
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040145e
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop ebx
call fcn.0040145e
mov esp, ebp
pop ebp
ret 0x10