Function at 0x497e58
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x4d56db
call fcn.004d3f60
sub esp, 0xcc
mov ecx, dword [ebp + 0x14]
push ebx
push esi
push edi
xor ebx, ebx
or eax, 0xffffffff
xor edi, edi
mov word [ebp - 0xd8], 0x46
mov dword [ebp - 0xd4], str.Backup
mov word [ebp - 0xd0], 0x45
mov dword [ebp - 0xcc], 0x4e4fa0
mov word [ebp - 0xc8], 0x50
mov dword [ebp - 0xc4], 0x4e4f94
mov word [ebp - 0xc0], 0x43
mov dword [ebp - 0xbc], 0x4e4f8c
mov word [ebp - 0xb8], 0x42
mov dword [ebp - 0xb4], str.shell
mov word [ebp - 0xb0], 0x52
mov dword [ebp - 0xac], 0x4e4f7c
mov word [ebp - 0xa8], 0x41
mov dword [ebp - 0xa4], 0x4e0f8c
mov word [ebp - 0xa0], 0x54
mov dword [ebp - 0x9c], 0x4e0f4c
mov word [ebp - 0x98], 0x4c
mov dword [ebp - 0x94], 0x4e1150
mov word [ebp - 0x90], 0x47
mov dword [ebp - 0x8c], 0x4e0f68
mov word [ebp - 0x88], 0x49
mov dword [ebp - 0x84], 0x4e1158
mov word [ebp - 0x80], 0x59
mov dword [ebp - 0x7c], 0x4e0f70
mov word [ebp - 0x78], 0x44
mov dword [ebp - 0x74], str.Non_Continuable_Exception
mov word [ebp - 0x70], bx
mov dword [ebp - 0x6c], ebx
call fcn.004997ab
mov esi, dword [ebp + 0x10]
push 0x200
call fcn.00408cfc
mov eax, esi
mov eax, dword [eax]
cmp dword [eax - 4], ebx
jle 0x497f8c
mov dword [eax - 8], ebx
mov eax, esi
mov eax, dword [eax]
mov word [eax], bx
mov eax, dword [0x4fdad8]
mov dword [ebp - 0x20], eax
push 0x81c8
mov dword [ebp - 4], ebx
push dword [0x500378]
lea eax, [ebp - 0x20]
push eax
call fcn.00404433
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp eax, ebx
mov ecx, dword [eax - 8]
lea ecx, [eax + ecx*2]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], eax
je 0x498428
mov ecx, eax
cmp ecx, dword [ebp - 0x1c]
jae 0x49840d
cmp word [ecx], 0
je 0x49840d
push 2
mov ebx, ecx
pop esi
cmp word [ebx], 0x25
je 0x497ff6
add ebx, esi
cmp ebx, dword [ebp - 0x1c]
jb 0x497fe7
xor ebx, ebx
test ebx, ebx
je 0x49840d
mov eax, ebx
sub eax, ecx
sar eax, 1
add dword [ebp - 0x24], eax
cmp ebx, ecx
jbe 0x498030
push ecx
lea edi, [ebp - 0x3c]
call fcn.0040433b
push dword [ebp + 0x10]
call fcn.00406a90
mov eax, dword [ebp - 0x3c]
add eax, 0xfffffff4
cmp eax, dword [0x4fdadc]
je 0x498030
push eax
call fcn.00401faa
lea ecx, [ebx + 2]
mov di, word [ecx]
movzx eax, di
xor ebx, ebx
add ecx, esi
mov dword [ebp - 0x50], eax
sub eax, 0x28
mov dword [ebp + 8], ebx
mov dword [ebp - 0x10], ecx
je 0x4982aa
sub eax, 0x1a
je 0x498223
dec eax
je 0x4981f2
sub eax, esi
je 0x4981ce
dec eax
je 0x4981a9
sub eax, 0xa
je 0x498185
sub eax, esi
je 0x49814c
mov esi, dword [0x4fdad8]
mov dword [ebp - 0x18], esi
push 6
mov byte [ebp - 4], 4
pop eax
cmp di, word [ebp + eax*8 - 0xd8]
je 0x4980a4
inc eax
cmp eax, 0xe
jb 0x49808f
jmp 0x49813b
cmp di, 0x49
mov esi, dword [ebp + eax*8 - 0xd4]
jne 0x4980c0
push 0x4e28e0
lea eax, [ebp - 0x18]
call fcn.00403d06
jmp 0x4980f2
lea eax, [ebp - 0x4c]
push 0
push eax
mov eax, esi
call fcn.0040795c
push dword [eax]
lea eax, [ebp - 0x18]
push dword [ebp - 0x20]
push eax
call fcn.00406b8a
mov eax, dword [ebp - 0x4c]
add eax, 0xfffffff4
add esp, 0x14
cmp eax, dword [0x4fdadc]
je 0x4980f2
push eax
call fcn.00401faa
test esi, esi
je 0x498138
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 0xc]
mov ebx, esi
call fcn.0042aaba
mov esi, dword [ebp - 0x18]
push esi
push dword [ebp + 0x10]
call fcn.00497e3c
mov ebx, eax
mov eax, dword [ebp - 0x30]
add eax, 0xfffffff4
cmp eax, dword [0x4fdadc]
pop ecx
pop ecx
je 0x498128
push eax
call fcn.00401faa
test ebx, ebx
je 0x498130
xor eax, eax
jmp 0x498133
mov eax, dword [esi - 8]
mov dword [ebp + 8], eax
jmp 0x498144
mov esi, dword [ebp - 0x18]
push edi
push dword [ebp + 0x10]
call fcn.00406a76
lea eax, [esi - 0xc]
jmp 0x49838d
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp + 0xc]
call fcn.00497c97
push 0x4dd358
push dword [ebp + 0x10]
call fcn.00497e3c
mov ebx, eax
mov eax, dword [ebp - 0x58]
add eax, 0xfffffff4
cmp eax, dword [0x4fdadc]
pop ecx
pop ecx
je 0x49817d
push eax
call fcn.00401faa
mov dword [ebp - 0x2c], ebx
jmp 0x49839b
push dword [ebp + 0xc]
lea eax, [ebp - 0x44]
call fcn.00497b5d
push 0x4dd358
push dword [ebp + 0x10]
call fcn.00497e3c
pop ecx
mov ebx, eax
mov eax, dword [ebp - 0x44]
pop ecx
jmp 0x49838a
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0xc]
call fcn.004979f0
push 0x4dd358
push dword [ebp + 0x10]
call fcn.00497e3c
pop ecx
mov ebx, eax
mov eax, dword [ebp - 0x54]
pop ecx
jmp 0x49838a
push dword [ebp + 0xc]
lea eax, [ebp - 0x34]
call fcn.00497b0b
push 0x4dd358
push dword [ebp + 0x10]
call fcn.00497e3c
pop ecx
mov ebx, eax
mov eax, dword [ebp - 0x34]
pop ecx
jmp 0x49838a
push dword [ebp + 0xc]
lea ebx, [ebp - 0x38]
call fcn.0046487b
mov edi, dword [ebp - 0x38]
mov esi, dword [edi - 8]
test esi, esi
mov eax, edi
jne 0x49820e
mov eax, 0x4e4f74
push eax
push dword [ebp + 0x10]
call fcn.00403d2b
test esi, esi
mov ebx, esi
je 0x498293
and dword [ebp + 8], 0
jmp 0x4982a2
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x20]
mov edi, dword [0x4fdad8]
and eax, 0x7fffffff
cmp eax, 0xf4240
mov dword [ebp + 8], edi
jbe 0x49826c
test eax, eax
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
jge 0x49824e
fadd qword [0x4e9bc0]
fmul qword [0x4e9c60]
push ecx
push ecx
lea eax, [ebp + 8]
fstp qword [esp]
push 0x4e4f68
push eax
call fcn.00406b8a
add esp, 0x10
jmp 0x49828b
cmp eax, ebx
je 0x498200
xor edx, edx
mov ecx, 0x3e8
div ecx
push eax
lea eax, [ebp + 8]
push 0x4e4f60
push eax
call fcn.00406b8a
add esp, 0xc
mov edi, dword [ebp + 8]
jmp 0x498200
push 0x4e4f74
call dword [0x4dc4d8]
pop ecx
mov dword [ebp + 8], eax
lea eax, [edi - 0xc]
jmp 0x49838d
cmp ecx, dword [ebp - 0x1c]
mov eax, ecx
jae 0x4982c2
cmp word [eax], 0x29
je 0x498363
add eax, esi
cmp eax, dword [ebp - 0x1c]
jb 0x4982b1
xor esi, esi
test esi, esi
je 0x49839b
cmp esi, dword [ebp - 0x10]
jbe 0x49839b
push dword [ebp - 0x10]
mov eax, esi
sub eax, dword [ebp - 0x10]
lea edi, [ebp - 0x28]
sar eax, 1
call fcn.0040433b
mov eax, dword [0x4fdad8]
mov dword [ebp + 8], eax
push dword [ebp - 0x28]
lea eax, [ebp + 8]
push dword [ebp - 0x20]
push eax
call fcn.00406b8a
push dword [ebp - 0x28]
or eax, 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00402169
add esp, 0x10
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
mov eax, dword [eax]
push ecx
push dword [ebp + 0xc]
mov ebx, eax
call fcn.0042aaba
mov edi, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
call fcn.00497e3c
mov ebx, eax
mov eax, dword [ebp - 0x40]
add eax, 0xfffffff4
cmp eax, dword [0x4fdadc]
pop ecx
pop ecx
je 0x498347
push eax
call fcn.00401faa
mov eax, dword [ebp - 0x48]
add eax, 0xfffffff4
cmp eax, dword [0x4fdadc]
je 0x49835b
push eax
call fcn.00401faa
test ebx, ebx
je 0x49836a
xor eax, eax
jmp 0x49836d
mov esi, eax
jmp 0x4982c4
mov eax, dword [edi - 8]
mov dword [ebp + 8], eax
add esi, 2
lea eax, [edi - 0xc]
cmp eax, dword [0x4fdadc]
mov dword [ebp - 0x10], esi
je 0x498387
push eax
call fcn.00401faa
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff4
cmp eax, dword [0x4fdadc]
je 0x49839b
push eax
call fcn.00401faa
mov eax, dword [0x4fdad8]
mov dword [ebp - 0x68], eax
push dword [ebp - 0x50]
lea eax, [ebp - 0x68]
push 0x4e4f54
push eax
mov byte [ebp - 4], 5
call fcn.00406b8a
mov ecx, dword [ebp - 0x24]
add esp, 0xc
test ebx, ebx
mov dword [ebp - 0x64], ecx
mov eax, ebx
jne 0x4983ca
mov eax, dword [ebp + 8]
add ecx, eax
xor eax, eax
test ebx, ebx
setne al
lea edi, [ebp - 0x68]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x14]
call fcn.00499637
add dword [ebp - 0x14], ebx
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x68]
add eax, 0xfffffff4
cmp eax, dword [0x4fdadc]
je 0x498402
push eax
call fcn.00401faa
mov ecx, dword [ebp - 0x10]
test ecx, ecx
jne 0x497fcf
test ecx, ecx
je 0x498420
cmp word [ecx], 0
je 0x498420
push ecx
push dword [ebp + 0x10]
call fcn.00403d2b
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x2c]
jne 0x49842c
and dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0
jne 0x49843f
mov ecx, dword [ebp + 0x14]
or eax, 0xffffffff
xor edi, edi
call fcn.004997ab
mov eax, dword [ebp + 0x10]
call fcn.00403df1
mov eax, dword [ebp - 0x20]
pop edi
add eax, 0xfffffff4
cmp eax, dword [0x4fdadc]
pop esi
pop ebx
je 0x49845e
push eax
call fcn.00401faa
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
mov dword fs:[0], ecx
leave
ret