Function at 0x401007
Capabilities:
Contain obfuscated stackstrings
Encrypt data using tea

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xa20
mov eax, dword [ebp + 0x7c]
push ebx
mov ebx, dword [eax]
push esi
mov esi, dword [eax + 4]
mov eax, dword [0x422b20]
mov dword [ebp - 0x198], eax
mov eax, dword [0x422b24]
xor ecx, ecx
mov dword [ebp - 0x188], eax
push edi
lea eax, [ebp + 0x70]
mov dword [ebp - 0x17c], ebx
mov dword [ebp + 0x70], ecx
mov dword [ebp - 0x194], 0x9e3779b9
call fcn.00401000
add dword [ebp + 0x70], 0x23f
cmp dword [0x2810ac4], 0x14
jne 0x401090
xor eax, eax
mov word [ebp - 0x1ac], ax
lea edi, [ebp - 0x1aa]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ecx
stosw word es:[edi], ax
lea eax, [ebp - 0x9ac]
push eax
push 0x41f948
lea eax, [ebp - 0x1ac]
push eax
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov eax, dword [0x422b28]
mov dword [ebp - 0x19c], eax
mov eax, dword [0x422b2c]
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x180], 0x20
jmp 0x4010b8
mov esi, dword [ebp - 0x184]
mov dword [ebp + 0x54], 2
add dword [ebp + 0x54], 3
mov eax, dword [0x2810ac4]
mov edi, ebx
shl edi, 4
add edi, dword [ebp - 0x19c]
cmp eax, 0xfa9
jne 0x4010e4
mov dword [0x2810ac0], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010fa
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
and dword [0x281054c], 0
mov ecx, dword [ebp + 0x70]
add ecx, ebx
mov eax, dword [ebp - 0x17c]
shr eax, 5
mov dword [ebp + 0x6c], eax
mov eax, dword [ebp + 0x6c]
add eax, dword [ebp - 0x190]
mov dword [0x2810abc], 0xf4ea3dee
xor eax, ecx
mov ecx, dword [ebp + 0x70]
xor eax, edi
sub esi, eax
mov eax, esi
shr eax, 5
mov dword [ebp - 0x184], esi
add ecx, esi
mov dword [ebp + 0x6c], eax
mov eax, dword [ebp - 0x188]
add dword [ebp + 0x6c], eax
shl esi, 4
add esi, dword [ebp - 0x198]
xor edi, edi
xor esi, ecx
cmp dword [0x2810ac4], 0xb03
jne 0x401163
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 0x18c], esi
mov dword [ebp - 0x17c], edi
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp + 0x6c]
xor dword [ebp - 0x17c], eax
sub ebx, dword [ebp - 0x17c]
mov dword [ebp - 0x17c], ebx
mov dword [ebp + 0x40], 0xffc637a
mov dword [ebp + 0x60], 0x5a30d42
mov dword [ebp + 0x38], 0x20a02506
mov dword [ebp + 0x68], 0x6317a00b
mov dword [ebp + 0x58], 0xd867557
mov dword [ebp + 0x48], 0x295c993c
mov dword [ebp + 0x30], 0x67897f3f
mov dword [ebp + 0x44], 0x66827f19
mov dword [ebp + 0x50], 0x6e437e53
mov dword [ebp - 0xb8], 0x4909150e
mov dword [ebp + 0x5c], 0x473a0b4e
mov dword [ebp + 0x34], 0x501f7cbb
mov dword [ebp + 0x64], 0x7d4a8cb1
mov dword [ebp - 0x150], 0x5034f01e
mov dword [ebp], 0x203d7a30
mov dword [ebp - 0x164], 0x35e34b8b
mov dword [ebp - 0x15c], 0xd89d27f
mov dword [ebp + 0x4c], 0x37f3d53
mov dword [ebp + 0x3c], 0x56383d6b
mov dword [ebp - 0xac], 0x2b740e00
mov dword [ebp - 0xdc], 0x4308790a
mov dword [ebp - 0x158], 0x5c8d759f
mov dword [ebp - 0x14c], 0x31805d58
mov dword [ebp + 0xc], 0xff6cbc6
mov dword [ebp + 0x14], 0x8e7722a
mov dword [ebp - 0xa4], 0x614411f5
mov dword [ebp - 0xd4], 0x60010d0
mov dword [ebp + 0x1c], 0x159e418d
mov dword [ebp - 0xa0], 0x79643576
mov dword [ebp - 0x9c], 0x64c387b2
mov dword [ebp - 0x10c], 0xdb64e7d
mov dword [ebp - 0x94], 0xc3b9df3
mov dword [ebp - 0x174], 0x6eabd5e8
mov dword [ebp - 0x54], 0x3cbf8c2d
mov dword [ebp - 0x4c], 0x59c790ef
mov dword [ebp + 0x20], 0x12c714ae
mov dword [ebp - 0x80], 0x60f7fa3b
mov dword [ebp - 0x124], 0xbca79f9
mov dword [ebp - 0x44], 0x1db69cad
mov dword [ebp - 0xd0], 0x3dd7a91a
mov dword [ebp - 0x104], 0x3c34e3a7
mov dword [ebp - 0x50], 0x3f5d602b
mov dword [ebp - 0x30], 0x1a4a39f7
mov dword [ebp - 0xcc], 0x2740ee2c
mov dword [ebp - 0xe8], 0x360608da
mov dword [ebp + 8], 0x1dd47b92
mov dword [ebp - 0x1c], 0x55c52104
mov dword [ebp - 0xf8], 0x434ce96b
mov dword [ebp - 0x3c], 0x49fe406e
mov dword [ebp - 0x8c], 0x4bf61a7d
mov dword [ebp - 0x138], 0x6cd7685f
mov dword [ebp - 0x48], 0x4605664e
mov dword [ebp - 0x34], 0x6135c407
mov dword [ebp - 0x11c], 0x45dc6391
mov dword [ebp - 0x154], 0x3fdc26bd
mov dword [ebp - 0xfc], 0x1640eae6
mov dword [ebp + 0x24], 0x488b0b54
mov dword [ebp + 0x2c], 0x214e60d3
mov dword [ebp + 0x10], 0x5fd693d9
mov dword [ebp - 0xc8], 0x1d5ef42c
mov dword [ebp - 0x70], 0x57732149
mov dword [ebp - 0x108], 0x275894f
mov dword [ebp - 0x110], 0x5aa7b8db
mov dword [ebp - 0x170], 0x18304b22
mov dword [ebp - 0xf4], 0x645e530b
mov dword [ebp - 0x144], 0x676f7a2
mov dword [ebp - 0x13c], 0x733b6c2f
mov dword [ebp - 0x98], 0x4568181d
mov dword [ebp - 0x84], 0x6a7a6065
mov dword [ebp - 0x14], 0x2ad6dcc3
mov dword [ebp - 0x68], 0x570e4579
mov dword [ebp - 0x2c], 0x6b6c9f53
mov dword [ebp - 0x178], 0x66a38b1d
mov dword [ebp - 0xc], 0x4baa5d54
mov dword [ebp - 0x28], 0x3540c46f
mov dword [ebp - 0x24], 0x42110aaa
mov dword [ebp - 0xc4], 0x7c28745d
mov dword [ebp - 0x168], 0x4040d107
mov dword [ebp - 4], 0x7f5dbf15
mov dword [ebp - 0x20], 0x69c4cc8a
mov dword [ebp - 0x7c], 0xa33d3ed
mov dword [ebp - 0x40], 0x50b50f5b
mov dword [ebp - 0x134], 0x71e2a0d6
mov dword [ebp + 0x18], 0x4d33fe88
mov dword [ebp - 0xf0], 0x6c06085d
mov dword [ebp + 0x28], 0x5d0249a7
mov dword [ebp - 0xe0], 0x5e106256
mov dword [ebp - 0x74], 0x151683b0
mov dword [ebp - 0x16c], 0x3680e0d3
mov dword [ebp - 0x6c], 0x347ea9b
mov dword [ebp - 0x60], 0x3284f0fc
mov dword [ebp - 0xbc], 0x1ea0dc6b
mov dword [ebp - 0x100], 0xfaf39ec
mov dword [ebp - 0x18], 0x126e7262
mov dword [ebp - 0xb4], 0x470e7d78
mov dword [ebp - 0x140], 0x4415c99b
mov dword [ebp - 0x130], 0x24190a1b
mov dword [ebp - 0x58], 0x4c6b30c8
mov dword [ebp - 0xc0], 0x12130447
mov dword [ebp - 0x38], 0x2eec57d3
mov dword [ebp - 0x148], 0x3d58fdaa
mov dword [ebp - 0xb0], 0x3d24b8e
mov dword [ebp - 0x10], 0x190de8f4
mov dword [ebp - 0xd8], 0x5d3717cc
mov dword [ebp - 0x90], 0x6a70ff3
mov dword [ebp - 0x64], 0x507d80fe
mov dword [ebp - 0x114], 0x67a9ca00
mov dword [ebp + 4], 0x4daf8b5c
mov dword [ebp - 0x78], 0x7eeded65
mov dword [ebp - 0x118], 0x2c35e6bd
mov dword [ebp - 0x120], 0x566734d5
mov dword [ebp - 0x5c], 0x5d4b7d50
mov dword [ebp - 0x88], 0x6eb2a306
mov dword [ebp - 0xec], 0x48a0116a
mov dword [ebp - 8], 0x75f75c5c
mov dword [ebp - 0x12c], 0x7dfc25f0
mov dword [ebp - 0xe4], 0x5b879f23
mov dword [ebp - 0x160], 0x64ba7859
mov dword [ebp - 0x128], 0x5dd1c981
mov dword [ebp - 0xa8], 0x19c33fa2
sub dword [ebp + 0x60], 0x3ddf0581
add dword [ebp + 0x60], 0x10e934f4
add dword [ebp + 0x60], 0x6645b57c
mov eax, 0x5b5066c2
mul dword [ebp + 0x40]
mov eax, dword [ebp + 0x40]
sub dword [ebp + 0x40], 0x49959f44
add dword [ebp + 0x38], 0x965bde0
add dword [ebp + 0x40], 0x67517da4
add dword [ebp + 0x38], 0x625f8dcb
mov eax, 0x2ef92e4e
mul dword [ebp + 0x60]
mov eax, dword [ebp + 0x60]
add dword [ebp + 0x40], 0xb3f0ba5
sub dword [ebp + 0x40], 0x14fa2be4
mov eax, 0x7c7e816e
mul dword [ebp + 0x30]
mov eax, dword [ebp + 0x30]
mov eax, 0x5c805937
mul dword [ebp + 0x48]
mov eax, dword [ebp + 0x48]
sub dword [ebp + 0x50], 0x46492d8e
sub dword [ebp + 0x40], 0x6117f4d
mov eax, 0x725e3866
mul dword [ebp + 0x44]
mov eax, dword [ebp + 0x44]
sub dword [ebp + 0x40], 0x5225fb4e
mov eax, 0x4f17671c
mul dword [ebp + 0x34]
mov eax, dword [ebp + 0x34]
add dword [ebp + 0x40], 0x3c6ebc29
mov eax, 0x1f2121eb
mul dword [ebp + 0x34]
mov eax, dword [ebp + 0x34]
sub dword [ebp + 0x40], 0x6962dbc8
add dword [ebp + 0x64], 0x238f4c07
add dword [ebp + 0x68], 0x66f7148c
sub dword [ebp + 0x58], 0x31ae1a8c
add dword [ebp + 0x4c], 0x4d5f2a8e
sub dword [ebp + 0x40], 0x600abec8
add dword [ebp + 0x30], 0x145fcc10
add dword [ebp + 0x64], 0xa675322
sub dword [ebp + 0x64], 0x7e5bdaa0
sub dword [ebp + 0x44], 0x1ea13c85
add dword [ebp + 0x48], 0x337f2d6b
add dword [ebp + 0x38], 0x5758261b
sub dword [ebp + 0x40], 0x11408fec
mov eax, 0x7d14793f
mul dword [ebp + 0x60]
mov eax, dword [ebp + 0x60]
sub dword [ebp + 0x3c], 0x159a538a
mov eax, 0x575e3524
mul dword [ebp + 0x5c]
mov eax, dword [ebp + 0x5c]
mov eax, 0x28b56085
mov eax, dword [ebp - 0x194]
sub dword [ebp + 0x70], eax
dec dword [ebp - 0x180]
jne 0x4010b2
mov eax, dword [ebp + 0x7c]
mov ecx, dword [ebp - 0x184]
pop edi
pop esi
mov dword [eax], ebx
mov dword [eax + 4], ecx
pop ebx
add ebp, 0x74
leave
ret 4