Function at 0x40555d
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
lea eax, [ebp - 0x3c]
push edi
push eax
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
push ebx
mov byte [ebp - 0x2c], 0x4b
mov byte [ebp - 0x2b], 0x45
mov byte [ebp - 0x2a], 0x52
mov byte [ebp - 0x29], 0x4e
mov byte [ebp - 0x28], 0x45
mov byte [ebp - 0x27], 0x4c
mov byte [ebp - 0x26], 0x33
mov byte [ebp - 0x25], 0x32
mov byte [ebp - 0x24], 0x2e
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], 0x6c
mov byte [ebp - 0x21], 0x6c
mov byte [ebp - 0x20], bl
mov byte [ebp - 0x3c], 0x56
mov byte [ebp - 0x3b], 0x69
mov byte [ebp - 0x3a], 0x72
mov byte [ebp - 0x39], 0x74
mov byte [ebp - 0x38], 0x75
mov byte [ebp - 0x37], 0x61
mov byte [ebp - 0x36], 0x6c
mov byte [ebp - 0x35], 0x41
mov byte [ebp - 0x34], 0x6c
mov byte [ebp - 0x33], 0x6c
mov byte [ebp - 0x32], 0x6f
mov byte [ebp - 0x31], 0x63
mov byte [ebp - 0x30], bl
call fcn.004052b3
mov dword [ebp - 8], eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
mov byte [ebp - 0x4c], 0x47
mov byte [ebp - 0x4b], 0x65
mov byte [ebp - 0x4a], 0x74
mov byte [ebp - 0x49], 0x50
mov byte [ebp - 0x48], 0x72
mov byte [ebp - 0x47], 0x6f
mov byte [ebp - 0x46], 0x63
mov byte [ebp - 0x45], 0x65
mov byte [ebp - 0x44], 0x73
mov byte [ebp - 0x43], 0x73
mov byte [ebp - 0x42], 0x48
mov byte [ebp - 0x41], 0x65
mov byte [ebp - 0x40], 0x61
mov byte [ebp - 0x3f], 0x70
mov byte [ebp - 0x3e], bl
call fcn.004052b3
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
mov byte [ebp - 0x1c], 0x48
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x1a], 0x61
mov byte [ebp - 0x19], 0x70
mov byte [ebp - 0x18], 0x41
mov byte [ebp - 0x17], 0x6c
mov byte [ebp - 0x16], 0x6c
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x14], 0x63
mov byte [ebp - 0x13], bl
call fcn.004052b3
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
add esp, 0x24
cmp word [eax], 0x5a4d
jne 0x405767
mov esi, dword [eax + 0x3c]
add esi, eax
cmp dword [esi], 0x4550
jne 0x405767
mov edi, 0x2000
push 4
push edi
push dword [esi + 0x50]
push dword [esi + 0x34]
call dword [ebp - 8]
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x4056b2
push 4
push edi
push dword [esi + 0x50]
push ebx
call dword [ebp - 8]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x405767
push 0x14
push ebx
call dword [ebp - 0xc]
push eax
call dword [ebp - 0x10]
mov edi, eax
mov eax, dword [ebp - 4]
push 4
push 0x1000
mov dword [edi + 4], eax
mov dword [edi + 0xc], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0x10], ebx
push dword [esi + 0x50]
push eax
call dword [ebp - 8]
push 4
push 0x1000
push dword [esi + 0x54]
push dword [ebp - 4]
call dword [ebp - 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, dword [esi + 0x54]
push ecx
push eax
push dword [ebp - 8]
call sub.MSVCRT.dll_memcpy
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
push edi
push esi
mov eax, dword [ecx + 0x3c]
push ecx
add eax, edx
mov edx, dword [ebp - 4]
mov dword [edi], eax
mov dword [eax + 0x34], edx
call fcn.00405775
mov eax, dword [ebp - 4]
add esp, 0x18
sub eax, dword [esi + 0x34]
je 0x405730
push eax
push edi
call fcn.00405a1b
pop ecx
pop ecx
push edi
call fcn.00405a95
test eax, eax
pop ecx
je 0x405760
push edi
call fcn.0040588f
mov eax, dword [edi]
pop ecx
mov eax, dword [eax + 0x28]
cmp eax, ebx
je 0x40576e
mov ecx, dword [ebp - 4]
add eax, ecx
cmp eax, ebx
je 0x405760
xor esi, esi
push ebx
inc esi
push esi
push ecx
call eax
test eax, eax
jne 0x40576b
push edi
call fcn.00405ce2
pop ecx
xor eax, eax
jmp 0x405770
mov dword [edi + 0x10], esi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret