Function at 0x4021f0
Capabilities:
Check for peb ntglobalflag flag
Check os version
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x55f51c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x100
push ebx
push ebp
mov ebp, ecx
xor ebx, ebx
mov cl, 0xf9
mov al, 0x60
mov dl, 0x38
push esi
push edi
mov byte [esp + 0x20], 0xe
mov byte [esp + 0x21], cl
mov byte [esp + 0x22], al
mov byte [esp + 0x23], 4
mov byte [esp + 0x24], 0xff
mov byte [esp + 0x25], 0x30
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], bl
mov byte [esp + 0x28], bl
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], bl
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], 0x74
mov byte [esp + 0x2f], 0xe
mov byte [esp + 0x30], cl
mov byte [esp + 0x31], al
mov byte [esp + 0x32], 4
mov byte [esp + 0x33], 0xff
mov byte [esp + 0x34], 0x34
mov byte [esp + 0x35], bl
mov byte [esp + 0x36], bl
mov byte [esp + 0x37], bl
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], 0x70
mov byte [esp + 0x3e], 0xe
mov byte [esp + 0x3f], cl
mov byte [esp + 0x40], al
mov byte [esp + 0x41], 4
mov byte [esp + 0x42], 0xff
mov byte [esp + 0x43], 0x3c
mov byte [esp + 0x44], bl
mov byte [esp + 0x45], bl
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], bl
mov byte [esp + 0x48], bl
mov byte [esp + 0x49], bl
mov byte [esp + 0x4a], bl
mov byte [esp + 0x4b], bl
mov byte [esp + 0x4c], 0x68
mov byte [esp + 0x4d], 0xe
mov byte [esp + 0x4e], cl
mov byte [esp + 0x4f], al
mov byte [esp + 0x50], 4
mov byte [esp + 0x51], 0xff
mov byte [esp + 0x52], dl
mov byte [esp + 0x53], bl
mov byte [esp + 0x54], bl
mov byte [esp + 0x55], bl
mov byte [esp + 0x56], bl
mov byte [esp + 0x57], bl
mov byte [esp + 0x58], bl
mov byte [esp + 0x59], bl
mov byte [esp + 0x5a], bl
mov byte [esp + 0x5b], 0x6c
mov byte [esp + 0x5c], 0xe
mov byte [esp + 0x5d], cl
mov byte [esp + 0x5e], al
mov byte [esp + 0x5f], 4
mov byte [esp + 0x60], bl
mov byte [esp + 0x61], 0x30
mov byte [esp + 0x62], bl
mov byte [esp + 0x63], bl
mov byte [esp + 0x64], bl
mov byte [esp + 0x65], bl
mov byte [esp + 0x66], bl
mov byte [esp + 0x67], bl
mov byte [esp + 0x8e], dl
mov dl, 0x22
mov byte [esp + 0x68], bl
mov byte [esp + 0x69], bl
mov byte [esp + 0x6a], 0x73
mov byte [esp + 0x6b], 0xe
mov byte [esp + 0x6c], cl
mov byte [esp + 0x6d], al
mov byte [esp + 0x6e], 4
mov byte [esp + 0x6f], bl
mov byte [esp + 0x70], 0x34
mov byte [esp + 0x71], bl
mov byte [esp + 0x72], bl
mov byte [esp + 0x73], bl
mov byte [esp + 0x74], bl
mov byte [esp + 0x75], bl
mov byte [esp + 0x76], bl
mov byte [esp + 0x77], bl
mov byte [esp + 0x78], bl
mov byte [esp + 0x79], 0x6f
mov byte [esp + 0x7a], 0xe
mov byte [esp + 0x7b], cl
mov byte [esp + 0x7c], al
mov byte [esp + 0x7d], 4
mov byte [esp + 0x7e], bl
mov byte [esp + 0x7f], 0x3c
mov byte [esp + 0x80], bl
mov byte [esp + 0x81], bl
mov byte [esp + 0x82], bl
mov byte [esp + 0x83], bl
mov byte [esp + 0x84], bl
mov byte [esp + 0x85], bl
mov byte [esp + 0x86], bl
mov byte [esp + 0x87], bl
mov byte [esp + 0x88], 0x67
mov byte [esp + 0x89], 0xe
mov byte [esp + 0x8a], cl
mov byte [esp + 0x8b], al
mov byte [esp + 0x8c], 4
mov byte [esp + 0x8d], bl
mov byte [esp + 0x8f], bl
mov byte [esp + 0x90], bl
mov byte [esp + 0x91], bl
mov byte [esp + 0x92], bl
mov byte [esp + 0x93], bl
mov byte [esp + 0x94], bl
mov byte [esp + 0x95], bl
mov byte [esp + 0x96], bl
mov byte [esp + 0x97], 0x6b
mov byte [esp + 0x98], 0xe
mov byte [esp + 0x99], cl
mov byte [esp + 0x9a], al
mov byte [esp + 0x9b], 4
mov byte [esp + 0x9c], 0xff
mov byte [esp + 0x9d], dl
mov byte [esp + 0x9e], 0xff
mov byte [esp + 0x9f], 0x32
mov byte [esp + 0xa0], bl
mov byte [esp + 0xa1], bl
mov byte [esp + 0xa2], bl
mov byte [esp + 0xa3], bl
mov byte [esp + 0xa4], bl
mov byte [esp + 0xa5], bl
mov byte [esp + 0xa6], 0x51
mov byte [esp + 0xa7], 0xe
mov byte [esp + 0xa8], cl
mov byte [esp + 0xa9], al
mov byte [esp + 0xaa], 4
mov byte [esp + 0xab], bl
mov byte [esp + 0xac], dl
mov byte [esp + 0xad], 0xff
mov byte [esp + 0xae], 0x32
mov byte [esp + 0xaf], bl
mov byte [esp + 0xb0], bl
mov byte [esp + 0xb1], bl
mov byte [esp + 0xb2], bl
mov byte [esp + 0xb3], bl
mov byte [esp + 0xb4], bl
mov byte [esp + 0xb5], 0x50
mov byte [esp + 0xb6], 0xe
mov byte [esp + 0xb7], cl
mov byte [esp + 0xb8], al
mov byte [esp + 0xb9], 4
mov byte [esp + 0xba], 0xff
mov byte [esp + 0xbb], dl
mov byte [esp + 0xbc], 0xff
mov byte [esp + 0xbd], 0x36
mov byte [esp + 0xbe], bl
mov byte [esp + 0xbf], bl
mov byte [esp + 0xc0], bl
mov byte [esp + 0xc1], bl
mov byte [esp + 0xc2], bl
mov byte [esp + 0xc3], bl
mov byte [esp + 0xc4], 0x4d
mov byte [esp + 0xc5], 0xe
mov byte [esp + 0xc6], cl
mov byte [esp + 0xc7], al
mov byte [esp + 0xc8], 4
mov byte [esp + 0xc9], bl
mov byte [esp + 0xca], dl
mov byte [esp + 0xcb], 0xff
mov byte [esp + 0xcc], 0x36
mov byte [esp + 0xcd], bl
mov byte [esp + 0xce], bl
mov byte [esp + 0xcf], bl
mov byte [esp + 0xd0], bl
mov byte [esp + 0xd1], bl
mov byte [esp + 0xd2], bl
mov byte [esp + 0xd3], 0x4c
mov byte [esp + 0xd4], 0xe
mov byte [esp + 0xd5], cl
mov byte [esp + 0xd6], al
mov byte [esp + 0xd7], 4
mov byte [esp + 0xd8], 0xff
mov byte [esp + 0xd9], dl
mov byte [esp + 0xda], 0xff
mov byte [esp + 0xdb], 0x3e
mov byte [esp + 0xdc], bl
mov byte [esp + 0xdd], bl
mov byte [esp + 0xde], bl
mov byte [esp + 0xdf], bl
mov byte [esp + 0xe0], bl
mov byte [esp + 0xe1], bl
mov byte [esp + 0xe2], 0x45
mov byte [esp + 0xe3], 0xe
mov byte [esp + 0xe4], cl
mov byte [esp + 0xe5], al
mov byte [esp + 0xe6], 4
mov byte [esp + 0xe7], bl
mov byte [esp + 0xe8], dl
mov byte [esp + 0xe9], 0xff
mov byte [esp + 0xea], 0x3e
mov byte [esp + 0xeb], bl
mov byte [esp + 0xec], bl
mov byte [esp + 0xed], bl
mov byte [esp + 0xee], bl
mov byte [esp + 0xef], bl
mov byte [esp + 0xf0], bl
mov byte [esp + 0xf1], 0x44
mov byte [esp + 0xf2], 0xe
mov byte [esp + 0xf3], cl
mov byte [esp + 0xf4], al
mov byte [esp + 0xf5], 4
mov byte [esp + 0xf6], 0xff
mov byte [esp + 0xf7], dl
mov byte [esp + 0xf8], 0xff
mov byte [esp + 0xf9], 0x3a
mov byte [esp + 0xfa], bl
mov byte [esp + 0xfb], bl
mov byte [esp + 0xfc], bl
mov byte [esp + 0xfd], bl
mov byte [esp + 0xfe], bl
mov byte [esp + 0xff], bl
mov byte [esp + 0x100], 0x49
mov byte [esp + 0x101], 0xe
mov byte [esp + 0x102], cl
mov byte [esp + 0x103], al
mov byte [esp + 0x104], 4
mov byte [esp + 0x105], bl
mov byte [esp + 0x106], dl
mov byte [esp + 0x107], 0xff
mov byte [esp + 0x108], 0x3a
push ebx
push 1
push ecx
mov byte [esp + 0x115], bl
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x59b910
mov byte [esp + 0x11e], bl
mov byte [esp + 0x11f], bl
mov byte [esp + 0x120], bl
mov byte [esp + 0x121], bl
mov byte [esp + 0x122], bl
mov byte [esp + 0x123], 0x48
call fcn.005318a0
push ecx
mov dword [esp + 0x128], ebx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x59ba18
call fcn.005318a0
or esi, 0xffffffff
mov ecx, 0x5c6628
mov dword [esp + 0x128], esi
call fcn.00533b90
mov ecx, ebp
call fcn.00403920
push ebx
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x59b910
call fcn.005318a0
push ecx
mov dword [esp + 0x128], 1
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x59ba10
call fcn.005318a0
mov ecx, 0x5c6628
mov dword [esp + 0x128], esi
call fcn.00533b90
mov ecx, ebp
call fcn.004030d0
cmp ax, bx
jge 0x40287d
xor ax, ax
jmp 0x4030ad
cmp ax, 1
jne 0x4028c8
push ebx
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x59b910
call fcn.005318a0
push ecx
mov dword [esp + 0x128], 2
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x59ba08
call fcn.005318a0
mov ecx, 0x5c6628
mov dword [esp + 0x128], esi
call fcn.00533b90
push ebx
push 4
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x59b910
call fcn.005318a0
push ecx
mov dword [esp + 0x128], 3
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x59ba00
call fcn.005318a0
mov ecx, 0x5c6628
mov dword [esp + 0x128], esi
call fcn.00533b90
cmp ax, 4
jne 0x402922
mov ecx, ebp
call fcn.004031a0
xor ax, ax
jmp 0x4030ad
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x59b910
call fcn.005318a0
push ecx
mov dword [esp + 0x128], 4
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x59b9f8
call fcn.005318a0
mov ecx, 0x5c6628
mov dword [esp + 0x128], esi
call fcn.00533b90
mov ecx, ebp
call fcn.004030d0
cmp ax, 1
jne 0x402966
mov al, byte [esp + 0x120]
cmp al, 5
je 0x402a33
push ebx
push 4
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x59b910
call fcn.005318a0
push ecx
mov dword [esp + 0x128], 5
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x59b9f0
call fcn.005318a0
mov ecx, 0x5c6628
mov dword [esp + 0x128], esi
call fcn.00533b90
cmp ax, 4
jne 0x4029dc
mov ecx, ebp
call fcn.004031a0
xor ax, ax
jmp 0x4030ad
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x59b910
call fcn.005318a0
push ecx
mov dword [esp + 0x128], 6
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x59ba08
call fcn.005318a0
mov ecx, 0x5c6628
mov dword [esp + 0x128], esi
call fcn.00533b90
mov ecx, ebp
call fcn.004030d0
cmp ax, bx
jne 0x402a20
mov al, byte [esp + 0x120]
cmp al, 4
jne 0x402c86
push ebx
push 4
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x59b910
call fcn.005318a0
push ecx
mov dword [esp + 0x128], 7
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x59ba00
call fcn.005318a0
mov ecx, 0x5c6628
mov dword [esp + 0x128], esi
call fcn.00533b90
cmp ax, 4
jne 0x402a95
mov ecx, ebp
call fcn.004031a0
xor ax, ax
jmp 0x4030ad
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x59b910
call fcn.005318a0
push ecx
mov dword [esp + 0x128], 8
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x59b9e8
call fcn.005318a0
mov ecx, 0x5c6628
mov dword [esp + 0x128], esi
call fcn.00533b90
lea esi, [ebp + 0xc]
lea edi, [ebp + 0x78]
push 2
push esi
push 0x59b1f0
mov ecx, edi
call fcn.0043cb50
push 2
push esi
push 0x59b2e0
mov ecx, edi
call fcn.0043cb50
push 2
push esi
push 0x59b268
mov ecx, edi
call fcn.0043cb50
push 2
push esi
push 0x59b358
mov ecx, edi
call fcn.0043cb50
mov dword [esp + 0x10], 5
push 2
push esi
push 0x59b268
mov ecx, edi
call fcn.0043cb50
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
jne 0x402b23
push 2
push esi
push 0x59b3d0
mov ecx, edi
call fcn.0043cb50
push 2
push esi
push 0x59b268
mov ecx, edi
call fcn.0043cb50
push 2
push esi
push 0x59b448
mov ecx, edi
call fcn.0043cb50
push ebx
push 4
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x59b910
call fcn.005318a0
push ecx
mov dword [esp + 0x128], 9
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x59b9f0
call fcn.005318a0
mov ecx, 0x5c6628
mov dword [esp + 0x128], 0xffffffff
call fcn.00533b90
cmp ax, 4
jne 0x402bc8
mov ecx, ebp
call fcn.004031a0
xor ax, ax
jmp 0x4030ad
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x59b910
call fcn.005318a0
push ecx
mov dword [esp + 0x128], 0xa
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x59b9e0
call fcn.005318a0
mov ecx, 0x5c6628
mov dword [esp + 0x128], 0xffffffff
call fcn.00533b90
push 2
push esi
push 0x59b4c0
mov ecx, edi
call fcn.0043cb50
push 2
push esi
push 0x59b268
mov ecx, edi
call fcn.0043cb50
push 2
push esi
push 0x59b538
mov ecx, edi
call fcn.0043cb50
push 2
push esi
push 0x59b268
mov ecx, edi
call fcn.0043cb50
push 2
push esi
push 0x59b5b0
mov ecx, edi
call fcn.0043cb50
push 2
push esi
push 0x59b268
mov ecx, edi
call fcn.0043cb50
push 2
push esi
push 0x59b628
mov ecx, edi
call fcn.0043cb50
push 2
push esi
push 0x59b268
jmp 0x402fc2
cmp al, 5
push ebx
jne 0x402d30
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x59b910
call fcn.005318a0
push ecx
mov dword [esp + 0x128], 0xb
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x59b9e0
call fcn.005318a0
mov ecx, 0x5c6628
mov dword [esp + 0x128], esi
call fcn.00533b90
lea esi, [ebp + 0xc]
lea edi, [ebp + 0x78]
push 2
push esi
push 0x59b1f0
mov ecx, edi
call fcn.0043cb50
push 2
push esi
push 0x59b808
mov ecx, edi
call fcn.0043cb50
push 2
push esi
push 0x59b268
mov ecx, edi
call fcn.0043cb50
push 2
push esi
push 0x59b268
mov ecx, edi
call fcn.0043cb50
push 2
push esi
push 0x59b880
mov ecx, edi
call fcn.0043cb50
push 2
push esi
push 0x59b268
jmp 0x402fc2
push 4
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x59b910
call fcn.005318a0
push ecx
mov dword [esp + 0x128], 0xc
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x59ba00
call fcn.005318a0
mov ecx, 0x5c6628
mov dword [esp + 0x128], esi
call fcn.00533b90
cmp ax, 4
jne 0x402d89
mov ecx, ebp
call fcn.004031a0
xor ax, ax
jmp 0x4030ad
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x59b910
call fcn.005318a0
push ecx
mov dword [esp + 0x128], 0xd
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x59b9d8
call fcn.005318a0
mov ecx, 0x5c6628
mov dword [esp + 0x128], esi
call fcn.00533b90
lea esi, [ebp + 0xc]
lea edi, [ebp + 0x78]
push 2
push esi
push 0x59b1f0
mov ecx, edi
call fcn.0043cb50
push 0x1f4
call fcn.0043d4c0
mov eax, dword [esp + 0x124]
add esp, 4
and eax, 0xff
mov ecx, edi
mov dword [esp + 0x14], eax
push 2
lea eax, [eax + eax*2]
push esi
lea eax, [eax + eax*4]
mov dword [esp + 0x18], eax
lea eax, [esp + eax + 0x28]
push eax
call fcn.0043cb50
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x59b910
call fcn.005318a0
push ecx
mov dword [esp + 0x128], 0xe
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x59b9f8
call fcn.005318a0
mov ecx, 0x5c6628
mov dword [esp + 0x128], 0xffffffff
call fcn.00533b90
mov ecx, ebp
call fcn.004030d0
cmp ax, 1
jne 0x402e60
push ebx
push 4
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x59b910
call fcn.005318a0
push ecx
mov dword [esp + 0x128], 0xf
mov ecx, esp
mov dword [esp + 0x2c], esp
push 6
push 0x59ba00
call fcn.005318a0
mov ecx, 0x5c6628
mov dword [esp + 0x128], 0xffffffff
call fcn.00533b90
cmp ax, 4
jne 0x402ecb
mov ecx, ebp
call fcn.004031a0
xor ax, ax
jmp 0x4030ad
mov ecx, dword [esp + 0x10]
push 2
push esi
lea edx, [esp + ecx + 0x64]
mov ecx, edi
push edx
call fcn.0043cb50
push ebx
push 4
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x59b910
call fcn.005318a0
push ecx
mov dword [esp + 0x128], 0x10
mov ecx, esp
mov dword [esp + 0x2c], esp
push 6
push 0x59b9f0
call fcn.005318a0
mov ecx, 0x5c6628
mov dword [esp + 0x128], 0xffffffff
call fcn.00533b90
cmp ax, 4
jne 0x402f3c
mov ecx, ebp
call fcn.004031a0
xor ax, ax
jmp 0x4030ad
push ebx
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x59b910
call fcn.005318a0
push ecx
mov dword [esp + 0x128], 0x11
mov ecx, esp
mov dword [esp + 0x2c], esp
push 6
push 0x59b9e0
call fcn.005318a0
mov ecx, 0x5c6628
mov dword [esp + 0x128], 0xffffffff
call fcn.00533b90
mov eax, dword [esp + 0x14]
push 2
push esi
mov ecx, edi
lea eax, [eax + eax*2]
lea eax, [eax + eax*4]
shl eax, 1
mov dword [esp + 0x1c], eax
lea eax, [esp + eax + 0xa0]
push eax
call fcn.0043cb50
push 0x3e8
call fcn.0043d4c0
mov ecx, dword [esp + 0x18]
add esp, 4
push 2
lea edx, [esp + ecx + 0xab]
push esi
push edx
mov ecx, edi
call fcn.0043cb50
push ebx
push 4
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x59b910
call fcn.005318a0
push ecx
mov dword [esp + 0x128], 0x12
mov ecx, esp
mov dword [esp + 0x2c], esp
push 6
push 0x59ba00
call fcn.005318a0
mov ecx, 0x5c6628
mov dword [esp + 0x128], 0xffffffff
call fcn.00533b90
cmp ax, 4
jne 0x403027
mov ecx, ebp
call fcn.004031a0
xor ax, ax
jmp 0x4030ad
push 2
push esi
push 0x59b6a0
mov ecx, edi
call fcn.0043cb50
push 2
push esi
push 0x59b718
mov ecx, edi
call fcn.0043cb50
cmp byte [ebp + 0x72], bl
jne 0x403059
push 2
push esi
push 0x59b790
mov ecx, edi
call fcn.0043cb50
push ebx
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x59b910
call fcn.005318a0
push ecx
mov dword [esp + 0x128], 0x13
mov ecx, esp
mov dword [esp + 0x2c], esp
push 6
push 0x59b9d0
call fcn.005318a0
mov ecx, 0x5c6628
mov dword [esp + 0x128], 0xffffffff
call fcn.00533b90
mov ecx, ebp
call fcn.004038f0
mov ax, 1
mov ecx, dword [esp + 0x110]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x10c
ret 4