Function at 0x4b6be0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], edx
xor edi, edi
cmp dword [ebp + 0x18], 0
jne 0x4b6c07
cmp dword [ebp + 0x14], 0x42
jb 0x4b6c20
jmp 0x4b6c09
jl 0x4b6c20
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
sub eax, 0x42
sbb edx, 0
mov dword [ebp + 0x14], eax
mov dword [ebp + 0x18], edx
jmp 0x4b6d0d
lea eax, [ebp - 0x4a]
xor ecx, ecx
mov edx, 0x42
call fcn.004032f4
mov dword [ebp - 0x4a], pe_nt_image_headers32
mov word [ebp - 0x46], 0x52
mov word [ebp - 0x44], 0x4f
mov word [ebp - 0x42], 0x42
mov word [ebp - 0x40], 0x53
mov dword [ebp - 0x36], 0x1e
mov word [ebp - 0x32], 0x4e
mov word [ebp - 0x30], 0x54
mov word [ebp - 0x2e], 0x46
mov word [ebp - 0x2c], 0x53
mov dword [ebp - 0x1e], 2
mov word [ebp - 0x1a], 0x1910
mov eax, dword [ebx + 0x4c]
mov edx, dword [eax + 0x30]
mov eax, dword [eax + 0x2c]
add eax, 0x10
adc edx, 0
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], 0x47
mov word [ebp - 0x12], 0x55
mov word [ebp - 0x10], 0x52
mov word [ebp - 0xe], 0x45
mov eax, esi
xor edx, edx
add eax, dword [ebp + 0x14]
adc edx, dword [ebp + 0x18]
cmp edx, 0
jne 0x4b6cba
cmp eax, 0x42
jbe 0x4b6ccb
jmp 0x4b6cbc
jle 0x4b6ccb
mov eax, dword [ebp + 0x14]
mov edx, 0x42
sub edx, eax
mov dword [ebp - 8], edx
jmp 0x4b6cce
mov dword [ebp - 8], esi
mov eax, dword [ebp + 0x14]
lea edx, [ebp - 0x4a]
lea eax, [edx + eax]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.00402da0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
add dword [eax], edx
cmp esi, dword [ebp - 8]
ja 0x4b6cf6
xor eax, eax
jmp 0x4b6dba
mov eax, dword [ebp - 8]
add dword [ebp - 4], eax
sub esi, dword [ebp - 8]
mov dword [ebp + 0x14], 0
mov dword [ebp + 0x18], 0
mov ecx, dword [ebx + 0x4c]
mov eax, dword [ecx + 0x2c]
mov edx, dword [ecx + 0x30]
cmp edx, dword [ebp + 0x18]
jne 0x4b6d25
cmp eax, dword [ebp + 0x14]
ja 0x4b6d2b
jmp 0x4b6db8
jle 0x4b6db8
mov eax, esi
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x4c]
mov edx, dword [eax + 0x30]
mov eax, dword [eax + 0x2c]
sub eax, dword [ebp + 0x14]
sbb edx, dword [ebp + 0x18]
cmp edx, dword [esp + 4]
jne 0x4b6d4f
cmp eax, dword [esp]
pop edx
pop eax
jae 0x4b6d66
jmp 0x4b6d53
pop edx
pop eax
jge 0x4b6d66
mov eax, dword [ebx + 0x4c]
mov edx, dword [eax + 0x30]
mov eax, dword [eax + 0x2c]
sub eax, dword [ebp + 0x14]
sbb edx, dword [ebp + 0x18]
mov edi, eax
jmp 0x4b6d68
mov edi, esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push edi
cmp byte [ebx + 0x6c], 0
jne 0x4b6d7f
test byte [ebp + 0x13], 1
jne 0x4b6d7f
xor eax, eax
jmp 0x4b6d81
mov al, 1
push eax
mov eax, dword [ebp + 0x10]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, ebx
mov edx, ecx
mov ecx, dword [ebp - 4]
call fcn.004b62e4
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add dword [edx], ecx
cmp edi, dword [ebp - 8]
ja 0x4b6dba
test eax, eax
je 0x4b6db1
test byte [ebp + 0x10], 0x80
jne 0x4b6dba
cmp esi, dword [ebp - 8]
jbe 0x4b6dba
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14