Function at 0x1041df51
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xcd0
mov eax, 0x1044daa9
call fcn.1041f2fb
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0xc7c]
push 0xc2a
xor ebx, ebx
push ebx
push eax
call fcn.10421b80
add esp, 0xc
mov dword [ebp - 0xc80], ebx
call fcn.104131dc
push eax
lea ecx, [ebp - 0xc80]
call fcn.1040fe19
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x1041e1d5
cmp dword [edi + 8], 0x4a
jne 0x1041e1d5
mov esi, dword [edi]
test esi, esi
je 0x1041e1d5
mov eax, dword [esi]
cmp eax, 0x4cc7c
jne 0x1041e1c7
mov esi, dword [esi + 8]
lea edi, [ebp - 0xc7c]
push 0x64
pop eax
mov byte [ebp - 0xc9d], al
mov ecx, 0x30a
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xb53]
mov byte [ebp - 0xc84], bl
push eax
lea eax, [ebp - 0xc7c]
mov dword [ebp - 0xccc], 0x7977534d
push eax
lea eax, [ebp - 0xc57]
movsw word es:[edi], word [esi]
push eax
push ebx
sub esp, 0xc
mov dword [ebp - 0xcc8], 0x72595744
mov ecx, esp
mov dword [ebp - 0xcc4], 0x77384748
lea eax, [ebp - 0xc85]
mov dword [ebp - 0xcc0], 0x776f6d47
mov dword [ebp - 0xcbc], 0x3330674a
push dword [ebp - 0xc84]
mov dword [ebp - 0xcb8], 0x4d517a44
push eax
mov dword [ebp - 0xcb4], 0x39386a47
lea eax, [ebp - 0xccc]
mov dword [ebp - 0xcb0], 0x73454145
mov dword [ebp - 0xcac], 0x5a4d5147
mov dword [ebp - 0xca8], 0x4855784a
mov dword [ebp - 0xca4], 0x33565359
mov word [ebp - 0xca0], 0x7a66
mov byte [ebp - 0xc9e], 0x45
mov dword [ebp - 0xc9c], 0x3374484a
mov dword [ebp - 0xc98], 0x71386a45
mov dword [ebp - 0xc94], 0x584d474a
mov dword [ebp - 0xc90], 0x6a6b4745
mov dword [ebp - 0xc8c], 0x41415148
mov word [ebp - 0xc88], 0x4341
mov byte [ebp - 0xc86], 0x55
push eax
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.1040f5b3
lea eax, [ebp - 0xcdc]
push eax
call fcn.10412822
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.1041cba6
push eax
lea eax, [ebp - 0xc80]
push eax
call fcn.10412ccb
add esp, 0x14
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xcdc]
call fcn.1041c9ec
push 0x3c
lea eax, [ebp - 0x50]
push ebx
push eax
call fcn.10421b80
pop ecx
pop ecx
lea eax, [ebp - 0xc7c]
mov ecx, esp
push eax
call fcn.1040ff92
lea ecx, [ebp - 0x50]
call fcn.10410061
lea eax, [ebp - 0xb53]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x20]
call fcn.10410f20
lea eax, [ebp - 0x17b]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10410f20
lea eax, [ebp - 0x77]
push eax
lea ecx, [ebp - 0x18]
call fcn.10410f20
mov esi, dword [ebp - 0xc80]
lea eax, [ebp - 0x50]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0xc84], esp
push esi
call fcn.1040ff92
push ecx
lea eax, [ebp - 0x94b]
mov byte [ebp - 4], 4
mov ecx, esp
push eax
call fcn.1040ff04
mov byte [ebp - 4], 3
call fcn.104187f1
add esp, 0xc
call fcn.1042991a
push 0x64
pop ecx
cdq
idiv ecx
cmp edx, ecx
jg 0x1041e1ba
lea eax, [ebp - 0x50]
push eax
call fcn.104173be
pop ecx
lea ecx, [ebp - 0x50]
call fcn.10410baa
lea ecx, [esi - 0x10]
jmp 0x1041e1ec
cmp eax, 0x4d835
jne 0x1041e1d5
push ebx
call fcn.1041b427
pop ecx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [sym.imp.USER32.dll_CallNextHookEx]
mov ecx, dword [ebp - 0xc80]
lea ecx, [ecx - 0x10]
call fcn.1041709c
call fcn.1041f248
ret 0xc