Function at 0x4f90a1
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push 0x28
mov eax, 0x4ed3ae
call 0x5bf387
mov si, cx
call fcn.004f97c3
mov dword [ebp - 0x30], eax
mov byte [eax + 0x13], 1
mov eax, dword [ebp - 0x30]
mov dword [eax + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [eax], eax
mov eax, dword [ebp - 0x30]
mov dword [eax + 8], eax
and dword [ebp - 0x2c], 0
and dword [ebp - 4], 0
mov word [ebp - 0x10], 0x8029
mov byte [ebp - 0xe], 0x13
mov byte [ebp - 0xd], 0x30
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
lea ebx, [ebp - 0x34]
mov word [ebp - 0x1a], 0x2d
call fcn.004f9c61
mov word [ebp - 0x10], 0x802a
mov byte [ebp - 0xe], 0x13
mov byte [ebp - 0xd], 0x31
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x2e
call fcn.004f9c61
mov word [ebp - 0x10], 0x802b
mov byte [ebp - 0xe], 0x13
mov byte [ebp - 0xd], 0x32
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x2f
call fcn.004f9c61
mov word [ebp - 0x10], 0x8044
mov byte [ebp - 0xe], 3
mov byte [ebp - 0xd], 0x76
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0xe
call fcn.004f9c61
mov word [ebp - 0x10], 0x801a
mov byte [ebp - 0xe], 3
mov byte [ebp - 0xd], 0x27
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x25
call fcn.004f9c61
mov word [ebp - 0x10], 0x801b
mov byte [ebp - 0xe], 3
mov byte [ebp - 0xd], 0x25
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x15
call fcn.004f9c61
mov word [ebp - 0x10], 0x79ec
mov byte [ebp - 0xe], 3
mov byte [ebp - 0xd], 0x77
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
mov word [ebp - 0x1a], 0x2c
push eax
lea edi, [ebp - 0x28]
call fcn.004f9c61
mov word [ebp - 0x10], 0x7a06
mov byte [ebp - 0xe], 3
mov byte [ebp - 0xd], 0x1b
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x4f
call fcn.004f9c61
mov word [ebp - 0x10], 0x8026
mov byte [ebp - 0xe], 3
mov byte [ebp - 0xd], 0x71
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x4d
call fcn.004f9c61
mov word [ebp - 0x10], 0x79ea
mov byte [ebp - 0xe], 3
mov byte [ebp - 0xd], 0x72
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x10
call fcn.004f9c61
mov word [ebp - 0x10], 0x79f0
mov byte [ebp - 0xe], 3
mov byte [ebp - 0xd], 0x74
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x12
call fcn.004f9c61
mov word [ebp - 0x10], 0x814e
mov byte [ebp - 0xe], 3
mov byte [ebp - 0xd], 0x75
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x7d
call fcn.004f9c61
mov word [ebp - 0x10], 0x8020
mov byte [ebp - 0xe], 0x13
mov byte [ebp - 0xd], 0x41
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x7a
call fcn.004f9c61
mov word [ebp - 0x10], 0x801f
mov byte [ebp - 0xe], 0x13
mov byte [ebp - 0xd], 0x42
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x7b
call fcn.004f9c61
mov word [ebp - 0x10], 0x8022
mov byte [ebp - 0xe], 0x13
mov byte [ebp - 0xd], 0x5a
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
mov word [ebp - 0x1a], 0x50
push eax
lea edi, [ebp - 0x28]
call fcn.004f9c61
mov word [ebp - 0x10], 0x8015
mov byte [ebp - 0xe], 0xb
mov byte [ebp - 0xd], 0x47
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x26
call fcn.004f9c61
mov word [ebp - 0x10], 0x2af8
mov byte [ebp - 0xe], 0xb
mov byte [ebp - 0xd], 0x50
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 6
call fcn.004f9c61
mov word [ebp - 0x10], 0x7a1f
mov byte [ebp - 0xe], 3
mov byte [ebp - 0xd], 0x20
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x4e
call fcn.004f9c61
mov word [ebp - 0x10], 0x2af9
mov byte [ebp - 0xe], 0xb
mov byte [ebp - 0xd], 0x53
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 7
call fcn.004f9c61
mov word [ebp - 0x10], 0x8018
mov byte [ebp - 0xe], 7
mov byte [ebp - 0xd], 0x27
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x51
call fcn.004f9c61
mov word [ebp - 0x10], 0x8019
mov byte [ebp - 0xe], 7
mov byte [ebp - 0xd], 0x25
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x52
call fcn.004f9c61
mov word [ebp - 0x10], 0x8016
mov byte [ebp - 0xe], 0xb
mov byte [ebp - 0xd], 0x27
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x13
call fcn.004f9c61
mov word [ebp - 0x10], 0x8017
mov byte [ebp - 0xe], 0xb
mov byte [ebp - 0xd], 0x25
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x14
call fcn.004f9c61
mov word [ebp - 0x10], 0x801c
mov byte [ebp - 0xe], 0xb
mov byte [ebp - 0xd], 0x26
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x29
call fcn.004f9c61
mov word [ebp - 0x10], 0x801d
mov byte [ebp - 0xe], 0xb
mov byte [ebp - 0xd], 0x28
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x2a
call fcn.004f9c61
mov word [ebp - 0x10], 0x801e
mov byte [ebp - 0xe], 0xb
mov byte [ebp - 0xd], 0x52
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x2b
call fcn.004f9c61
mov word [ebp - 0x10], 0x8013
mov byte [ebp - 0xe], 3
mov byte [ebp - 0xd], 0x21
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x27
call fcn.004f9c61
mov word [ebp - 0x10], 0x8014
mov byte [ebp - 0xe], 3
mov byte [ebp - 0xd], 0x22
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x28
call fcn.004f9c61
mov word [ebp - 0x10], 0x803d
mov byte [ebp - 0xe], 0x13
mov byte [ebp - 0xd], 0x56
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x40
call fcn.004f9c61
mov word [ebp - 0x10], 0x8010
mov byte [ebp - 0xe], 0xb
mov byte [ebp - 0xd], 0x45
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 9
call fcn.004f9c61
mov word [ebp - 0x10], 0x8023
mov byte [ebp - 0xe], 0xb
mov byte [ebp - 0xd], 0x54
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x4b
call fcn.004f9c61
mov word [ebp - 0x10], 0x7a0f
mov byte [ebp - 0xe], 3
mov byte [ebp - 0xd], 0x73
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x11
call fcn.004f9c61
mov word [ebp - 0x10], 0x7af9
mov byte [ebp - 0xe], 0xb
mov byte [ebp - 0xd], 0x44
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0xa
call fcn.004f9c61
mov word [ebp - 0x10], 0x8003
mov byte [ebp - 0xe], 0xb
mov byte [ebp - 0xd], 0x4f
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 5
call fcn.004f9c61
mov word [ebp - 0x10], 0x8005
mov byte [ebp - 0xe], 0x13
mov byte [ebp - 0xd], 0x4f
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x16
call fcn.004f9c61
mov word [ebp - 0x10], 0x8004
mov byte [ebp - 0xe], 0xb
mov byte [ebp - 0xd], 0x55
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 8
call fcn.004f9c61
mov word [ebp - 0x10], 0x8032
mov byte [ebp - 0xe], 3
mov byte [ebp - 0xd], 0x28
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x18
call fcn.004f9c61
mov word [ebp - 0x10], 0x8031
mov byte [ebp - 0xe], 3
mov byte [ebp - 0xd], 0x26
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x17
call fcn.004f9c61
mov word [ebp - 0x10], 0x8033
mov byte [ebp - 0xe], 0xb
mov byte [ebp - 0xd], 0x4d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x42
call fcn.004f9c61
mov word [ebp - 0x10], 0x8082
mov byte [ebp - 0xe], 0x13
mov byte [ebp - 0xd], 0x45
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x4a
call fcn.004f9c61
mov word [ebp - 0x10], 0x803e
mov byte [ebp - 0xe], 0x13
mov byte [ebp - 0xd], 0x4a
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x49
call fcn.004f9c61
mov word [ebp - 0x10], 0x803b
mov byte [ebp - 0xe], 0x13
mov byte [ebp - 0xd], 0x53
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a]
push eax
lea edi, [ebp - 0x28]
mov word [ebp - 0x1a], 0x41
call fcn.004f9c61
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx + 4]
mov edx, ecx
xor ebx, ebx
jmp 0x4f972f
cmp word [eax + 0xc], si
jae 0x4f972b
mov eax, dword [eax + 8]
jmp 0x4f972f
mov edx, eax
mov eax, dword [eax]
cmp byte [eax + 0x13], bl
je 0x4f9720
cmp edx, ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], eax
je 0x4f974c
cmp si, word [edx + 0xc]
jb 0x4f974c
lea eax, [ebp - 0x14]
jmp 0x4f9758
lea eax, [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
lea eax, [ebp - 0x24]
mov edx, dword [eax]
cmp edx, ebx
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], esi
mov edi, ecx
je 0x4f9770
lea eax, [ebp - 0x34]
cmp edx, eax
je 0x4f9775
call 0x5b9e21
cmp esi, edi
jne 0x4f9787
mov eax, dword [ebp + 8]
mov word [eax], bx
mov byte [eax + 2], bl
mov byte [eax + 3], bl
jmp 0x4f97af
lea esi, [ebp - 0x1c]
call fcn.0053a8e2
mov ax, word [eax + 2]
mov edi, dword [ebp + 8]
mov word [edi], ax
call fcn.0053a8e2
mov al, byte [eax + 4]
mov byte [edi + 2], al
call fcn.0053a8e2
mov al, byte [eax + 5]
mov byte [edi + 3], al
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x34]
call fcn.004f97ed
call 0x5bf426
ret 4