Function at 0x402370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4033c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
mov cl, 0x61
mov al, 0x64
push ebx
push esi
mov byte [ebp - 0x55], cl
mov byte [ebp - 0x54], al
mov byte [ebp - 0x51], cl
mov byte [ebp - 0x50], al
mov byte [ebp - 0x3f], al
push edi
mov dl, 0x52
mov cl, 0x45
mov al, 0x6c
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x58], 0x49
mov byte [ebp - 0x57], 0x73
mov byte [ebp - 0x56], 0x42
mov byte [ebp - 0x53], dl
mov byte [ebp - 0x52], 0x65
mov byte [ebp - 0x4f], 0x50
mov byte [ebp - 0x4e], 0x74
mov byte [ebp - 0x4d], 0x72
mov byte [ebp - 0x4c], 0
mov byte [ebp - 0x48], 0x4b
mov byte [ebp - 0x47], cl
mov byte [ebp - 0x46], dl
mov byte [ebp - 0x45], 0x4e
mov byte [ebp - 0x44], cl
mov byte [ebp - 0x43], 0x4c
mov byte [ebp - 0x42], 0x33
mov byte [ebp - 0x41], 0x32
mov byte [ebp - 0x40], 0x2e
mov byte [ebp - 0x3e], al
mov byte [ebp - 0x3d], al
mov byte [ebp - 0x3c], 0
nop
nop
nop
push eax
pop eax
inc eax
dec eax
add eax, 1
sub eax, 1
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call esi
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2c], eax
nop
bt eax, 0xe0
xor ah, 0x3d
sub al, 0xb5
test ebp, ebx
xor al, al
xadd eax, eax
xadd ah, al
neg eax
imul eax, ebx, 0x78b3bbf9
inc eax
imul eax, edx, 0xf9539b11
and eax, 0xc7e2d3ce
movsx eax, si
bsf eax, ecx
movsx eax, bx
btc eax, 0xb
dec eax
test cl, bl
mov eax, 0x2e383802
mov ah, 0x3d
mov ah, 0x8e
shrd eax, ebp, cl
movzx eax, dh
movsx eax, bl
test ecx, eax
shrd eax, esi, cl
rcl ah, 0x62
test ecx, edi
imul eax, ebp
bsf eax, edx
xadd al, ah
test edi, esi
dec al
bswap eax
dec ah
sub al, cl
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], 1
mov edx, dword [edi + 4]
mov dword [ebp - 0x14], edx
nop
nop
nop
push eax
pop eax
inc eax
dec eax
add eax, 1
sub eax, 1
push 0
call esi
mov eax, dword [edi]
add eax, 0x80
mov ecx, dword [eax + 4]
test ecx, ecx
jbe 0x4026b2
mov ebx, dword [eax]
mov eax, dword [ebp - 0x14]
add ebx, eax
mov dword [ebp - 0x28], ebx
push 0x14
push ebx
call dword [ebp - 0x2c]
test eax, eax
jne 0x4026b2
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x4026b2
mov ecx, dword [ebp - 0x14]
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, 0xffffffff
mov dword [ebp - 0x24], eax
je 0x4026ab
nop
nop
nop
push eax
pop eax
inc eax
dec eax
add eax, 1
sub eax, 1
push 0
call esi
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 8]
lea eax, [edx*4 + 4]
push eax
push ecx
call fcn.004016f0
add esp, 8
mov dword [edi + 8], eax
test eax, eax
je 0x4026ab
nop
nop
nop
push eax
pop eax
inc eax
dec eax
add eax, 1
sub eax, 1
push 0
call esi
mov edx, dword [edi + 0xc]
mov eax, dword [edi + 8]
mov ecx, dword [ebp - 0x24]
mov dword [eax + edx*4], ecx
mov edx, dword [edi + 0xc]
inc edx
mov dword [edi + 0xc], edx
mov eax, dword [ebx]
test eax, eax
je 0x40256b
mov edx, dword [ebp - 0x14]
mov esi, dword [ebx + 0x10]
add eax, edx
mov dword [ebp - 0x18], eax
mov eax, edx
add esi, eax
jmp 0x402577
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebp - 0x14]
lea esi, [eax + ecx]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
test eax, eax
je 0x40267e
test eax, 0x80000000
je 0x4025bc
and eax, 0xffff
push eax
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi], eax
lea edx, [ebp - 0x34]
push 0x404a40
push edx
mov dword [ebp - 4], 2
mov dword [ebp - 0x34], 0x42
call sub.MSVCRT.dll__CxxThrowException
lea ecx, [ebp - 0x30]
push 0x404a40
push ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0x42
call sub.MSVCRT.dll__CxxThrowException
mov edx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov esi, dword [edx]
add esi, ebx
nop
nop
nop
push eax
pop eax
inc eax
dec eax
add eax, 1
sub eax, 1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x24]
add esi, 2
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov eax, 0x4025a0
ret
nop
nop
nop
push eax
pop eax
inc eax
dec eax
add eax, 1
sub eax, 1
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4026b2
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add ebx, 0x14
mov dword [ebp - 0x28], ebx
jmp 0x4024cc
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret