Function at 0x402a00
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525930
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x5c87f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
push 0x5685d0
lea ecx, [ebp - 0x3c]
push ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x3c], 0x30
call fcn.0050ef27
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x535250
push 0x535214
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
mov dword [ebp - 0x30], eax
nop
nop
nop
nop
nop
nop
nop
nop
push 0x535230
push 0x535214
call edi
push eax
call esi
mov dword [ebp - 0x38], eax
inc eax
dec ebx
dec eax
inc ebx
lea edx, [ebp - 0x24]
push edx
push 0x535214
mov dword [ebp - 0x24], 0x50746547
mov dword [ebp - 0x20], 0x65636f72
mov dword [ebp - 0x1c], 0x65487373
mov word [ebp - 0x18], 0x7061
mov byte [ebp - 0x16], 0
call edi
push eax
call esi
mov dword [ebp - 0x34], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x28]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x402ae8
inc eax
dec ebx
dec eax
inc ebx
mov eax, 0x402ae1
ret
mov esi, dword [eax + 0x3c]
add esi, eax
cmp dword [esi], 0x4550
mov dword [ebp - 0x2c], esi
je 0x402afe
mov eax, 0x402ae1
ret
inc eax
dec ebx
dec eax
inc ebx
mov edx, dword [esi + 0x50]
mov eax, dword [esi + 0x34]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x2000
push edx
push eax
call ebx
mov edi, eax
test edi, edi
jne 0x402b2f
mov ecx, dword [esi + 0x50]
push 4
push 0x2000
push ecx
push eax
call ebx
mov edi, eax
inc eax
dec ebx
dec eax
inc ebx
xor ebx, ebx
cmp edi, ebx
jne 0x402b3f
mov eax, 0x402ae1
ret
nop
nop
nop
nop
push 0x14
push ebx
call dword [ebp - 0x34]
push eax
call dword [ebp - 0x30]
mov esi, eax
mov dword [ebp - 0x30], esi
mov dword [esi + 4], edi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x10], ebx
nop
nop
nop
nop
nop
nop
nop
mov ebx, dword [ebp - 0x2c]
mov edx, dword [ebx + 0x50]
push 4
push 0x1000
push edx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebx + 0x54]
push 4
push 0x1000
push eax
push edi
call dword [ebp - 0x38]
mov ebx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov edx, dword [ecx + 0x54]
add edx, dword [eax + 0x3c]
push edx
push eax
push ebx
call fcn.0050ef80
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 0x3c]
add ecx, ebx
add esp, 0xc
mov dword [esi], ecx
inc eax
dec ebx
dec eax
inc ebx
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov edx, dword [esi]
push esi
push ebx
push eax
mov dword [edx + 0x34], edi
call fcn.00401d40
add esp, 0xc
nop
nop
nop
nop
nop
mov eax, edi
sub eax, dword [ebx + 0x34]
je 0x402bee
push eax
push esi
call fcn.00402160
add esp, 8
nop
nop
nop
nop
nop
nop
nop
push esi
call fcn.00402270
add esp, 4
nop
nop
nop
nop
nop
nop
push esi
call fcn.00401fe0
add esp, 4
nop
nop
nop
nop
nop
nop
mov ecx, dword [esi]
mov eax, dword [ecx + 0x28]
test eax, eax
je 0x402c33
add eax, edi
nop
nop
nop
push 0
push 1
push edi
call eax
inc eax
dec ebx
dec eax
inc ebx
mov dword [esi + 0x10], 1
mov eax, 0x402c39
ret