Function at 0x688f00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x950
mov eax, dword [0x901e0c]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x688f41
test ebx, ebx
je 0x688f41
mov edx, dword [ebx + 0x544]
test edx, edx
je 0x688f41
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x689400
cmp eax, 2
jg 0x688f50
test eax, eax
jg 0x6890d0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 3
jne 0x688f41
mov dword [esp + 0x14], pe_nt_image_headers32
lea esi, [esp + 0x1cc]
lea edi, [esp + 0x24c]
mov dword [esp + 0x10], ebx
mov eax, dword [0x902504]
mov dword [esp], 1
mov dword [esp + 0xc], eax
lea eax, [esp + 0x14c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp + 0x3c], eax
call fcn.00516d90
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], ebx
mov eax, dword [0x902504]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp], 2
mov dword [esp + 4], 0
call fcn.00516d90
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], ebx
mov eax, dword [0x902504]
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
mov dword [esp], 4
mov dword [esp + 4], 0
call fcn.00516d90
mov eax, dword [0x901e04]
cmp eax, 1
je 0x689438
cmp eax, 2
je 0x6891b8
test eax, eax
jne 0x688f41
mov eax, dword [0x901e0c]
cmp eax, 2
je 0x6896f8
cmp eax, 3
je 0x6895d8
cmp eax, 1
je 0x689550
lea eax, [esp + 0x34c]
mov dword [esp], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], 0
mov dword [esp + 4], eax
call fcn.0067f030
mov esi, dword [ebx + 0x1d0]
mov ebx, dword [ebx + 0x1cc]
mov dword [esp + 4], 0
mov edi, eax
mov eax, 0x816fb4
test esi, esi
cmove esi, eax
lea eax, [esp + 0x4c]
mov dword [esp], eax
call fcn.004fc4b0
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x18], edi
lea edi, [esp + 0x550]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x2cc]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x400
mov dword [esp], edi
call fcn.00723ce0
jmp 0x6892bd
mov dword [esp + 0x10], ebx
lea edi, [esp + 0x4c]
lea esi, [esp + 0x1cc]
mov dword [esp + 0x14], pe_nt_image_headers32
mov eax, dword [0x902504]
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
mov dword [esp], 1
mov dword [esp + 4], 0
call fcn.00516d90
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], eax
lea eax, [esp + 0x14c]
mov dword [esp], eax
mov dword [esp + 0x3c], eax
call fcn.00504f10
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], ebx
mov eax, dword [0x902504]
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
mov dword [esp], 2
mov dword [esp + 4], 0
call fcn.00516d90
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00504f10
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], ebx
mov eax, dword [0x902504]
mov dword [esp + 8], edi
lea edi, [esp + 0x24c]
mov dword [esp + 0xc], eax
mov dword [esp], 4
mov dword [esp + 4], 0
call fcn.00516d90
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00504f10
jmp 0x688ff5
mov eax, dword [0x901e0c]
cmp eax, 2
je 0x6896c0
cmp eax, 3
je 0x6895b0
cmp eax, 1
je 0x689578
lea eax, [esp + 0x34c]
mov dword [esp], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], 0
mov dword [esp + 4], eax
call fcn.0067f030
mov dword [esp], 0x816fc3
mov dword [esp + 0x30], eax
call fcn.007101e8
mov dword [esp], ebx
mov dword [esp + 8], eax
lea eax, [esp + 0xcc]
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
call fcn.0063c760
mov edx, dword [ebx + 0x1d0]
mov ebx, dword [ebx + 0x1cc]
mov dword [esp + 4], 0
mov dword [esp + 0x38], eax
mov eax, 0x816fb4
test edx, edx
cmove edx, eax
lea eax, [esp + 0x4c]
mov dword [esp], eax
mov dword [esp + 0x34], edx
call fcn.004fc4b0
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0x34]
mov dword [esp + 0x18], edi
mov dword [esp + 0xc], eax
lea edi, [esp + 0x550]
lea eax, [esp + 0x2cc]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x20], edx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x400
mov dword [esp], edi
call fcn.00723ce0
mov dword [esp + 8], edi
mov dword [esp + 4], 0x816fc9
mov dword [esp], 3
call fcn.004fc8f0
cmp dword [0x901c28], 2
mov dword [esp], edi
je 0x689420
call fcn.00723a18
mov edx, 0xa
mov word [edi + eax], dx
mov eax, dword [0x901e08]
test eax, eax
je 0x689540
cmp byte [eax], 0
mov edx, 0x816fb6
cmove eax, edx
lea ebx, [esp + 0x44c]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00723a00
mov dword [esp + 4], 3
mov dword [esp], ebx
call fcn.0050f9c0
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.0050b180
mov dword [esp], ebx
test al, al
je 0x6893f0
call fcn.00508ad0
mov esi, eax
test esi, esi
jne 0x6893b0
call dword [0x90b8e8]
mov dword [esp + 0xc], ebx
mov eax, dword [eax]
mov dword [esp + 4], 0x816fd8
mov dword [esp], 1
mov dword [esp + 8], eax
call fcn.004fc8f0
mov dword [esp], esi
call fcn.00508bb0
test eax, eax
jns 0x688f41
neg eax
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x817038
mov dword [esp], 1
call fcn.004fc8f0
jmp 0x688f41
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00508ea0
test eax, eax
jns 0x689378
neg eax
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x81700c
mov dword [esp], 1
call fcn.004fc8f0
jmp 0x689378
call fcn.00508a60
mov esi, eax
jmp 0x689350
mov dword [esp + 4], 0
mov eax, dword [edx + 0x1c]
mov dword [esp], eax
call fcn.004ec9c0
mov dword [ebp + 0xc], eax
mov eax, dword [0x901e0c]
jmp 0x688f34
call fcn.00723a18
mov ecx, 0xd
mov word [edi + eax], cx
jmp 0x6892f3
mov eax, dword [0x901e0c]
cmp eax, 2
je 0x689680
cmp eax, 3
je 0x689650
cmp eax, 1
je 0x689610
lea eax, [esp + 0x34c]
mov dword [esp], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], 0
mov dword [esp + 4], eax
call fcn.0067f030
mov dword [esp], 0x816fc3
mov dword [esp + 0x34], eax
call fcn.007101e8
mov dword [esp], ebx
mov dword [esp + 8], eax
lea eax, [esp + 0xcc]
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
call fcn.0063c760
mov edi, dword [ebx + 0x1d0]
mov ebx, dword [ebx + 0x1cc]
mov dword [esp + 4], 0
mov dword [esp + 0x38], eax
mov eax, 0x816fb4
test edi, edi
cmove edi, eax
lea eax, [esp + 0x4c]
mov dword [esp], eax
call fcn.004fc4b0
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0x34]
mov dword [esp + 0x1c], edi
mov dword [esp + 0xc], eax
lea edi, [esp + 0x550]
lea eax, [esp + 0x2cc]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x400
mov dword [esp], edi
call fcn.00723ce0
jmp 0x6892bd
mov eax, 0x816fb6
jmp 0x68930b
movdqu xmm0, xmmword [0x819470]
movdqu xmm1, xmmword [0x819480]
movups xmmword [esp + 0x2cc], xmm0
movups xmmword [esp + 0x2d5], xmm1
jmp 0x689034
movdqu xmm1, xmmword [0x819470]
movdqu xmm2, xmmword [0x8194b0]
movdqu xmm3, xmmword [0x819480]
movups xmmword [esp + 0x2dc], xmm2
movups xmmword [esp + 0x2cc], xmm1
movups xmmword [esp + 0x2e9], xmm3
jmp 0x6891d8
movdqu xmm7, xmmword [0x8194d0]
movdqu xmm0, xmmword [0x8194e0]
movups xmmword [esp + 0x2cc], xmm7
movups xmmword [esp + 0x2d7], xmm0
jmp 0x6891d8
mov dword [esp + 0x2d0], 0x73250973
mov dword [esp + 0x2cc], 0x25097325
mov dword [esp + 0x2d3], 0x73250973
mov dword [esp + 0x2d7], 0x732509
jmp 0x689034
movdqu xmm4, xmmword [0x819470]
movdqu xmm5, xmmword [0x8194b0]
mov dword [esp + 0x2ec], 0x222c2273
mov dword [esp + 0x2f0], 0x227325
movups xmmword [esp + 0x2cc], xmm4
movups xmmword [esp + 0x2dc], xmm5
jmp 0x689458
movdqu xmm0, xmmword [0x8194d0]
mov dword [esp + 0x2dc], 0x73250973
mov dword [esp + 0x2e0], 0x732509
movups xmmword [esp + 0x2cc], xmm0
jmp 0x689458
movdqu xmm6, xmmword [0x819490]
movdqu xmm7, xmmword [0x8194c0]
mov dword [esp + 0x2ec], 0x223b2273
mov dword [esp + 0x2f0], 0x227325
movups xmmword [esp + 0x2cc], xmm6
movups xmmword [esp + 0x2dc], xmm7
jmp 0x689458
movdqu xmm4, xmmword [0x819490]
movdqu xmm5, xmmword [0x8194c0]
movdqu xmm6, xmmword [0x8194a0]
movups xmmword [esp + 0x2dc], xmm5
movups xmmword [esp + 0x2cc], xmm4
movups xmmword [esp + 0x2e9], xmm6
jmp 0x6891d8
movdqu xmm2, xmmword [0x819490]
movdqu xmm3, xmmword [0x8194a0]
movups xmmword [esp + 0x2cc], xmm2
movups xmmword [esp + 0x2d5], xmm3
jmp 0x689034