Function at 0x4034c0
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x18], 0x4e52454b
push eax
mov dword [ebp - 0x14], 0x32334c45
mov dword [ebp - 0x10], 0x6c6c642e
mov byte [ebp - 0xc], 0
mov dword [ebp - 0x58], 0x74726956
mov dword [ebp - 0x54], 0x416c6175
mov dword [ebp - 0x50], 0x636f6c6c
mov byte [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0x4e52454b
mov dword [ebp - 0x44], 0x32334c45
mov dword [ebp - 0x40], 0x6c6c642e
mov byte [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x64616f4c
mov dword [ebp - 0x34], 0x7262694c
mov dword [ebp - 0x30], 0x41797261
mov byte [ebp - 0x2c], 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
call edi
test eax, eax
jne 0x403566
lea eax, [ebp - 0x18]
push eax
call ebx
test eax, eax
jne 0x403566
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
jmp 0x403572
lea ecx, [ebp - 0x58]
push ecx
push eax
call esi
mov ebx, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0xa8], 0x50746547
push eax
lea eax, [ebp - 0x78]
mov dword [ebp - 0xa4], 0x65636f72
push eax
mov dword [ebp - 0xa0], 0x65487373
mov word [ebp - 0x9c], 0x7061
mov byte [ebp - 0x9a], 0
mov dword [ebp - 0x78], 0x4e52454b
mov dword [ebp - 0x74], 0x32334c45
mov dword [ebp - 0x70], 0x6c6c642e
mov byte [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0x64616f4c
mov dword [ebp - 0x64], 0x7262694c
mov dword [ebp - 0x60], 0x41797261
mov byte [ebp - 0x5c], 0
call edi
push eax
call esi
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
call edi
test eax, eax
jne 0x4035fc
lea eax, [ebp - 0x18]
push eax
call dword [ebp - 8]
test eax, eax
jne 0x4035fc
mov dword [ebp - 8], eax
jmp 0x403609
lea ecx, [ebp - 0xa8]
push ecx
push eax
call esi
mov dword [ebp - 8], eax
lea eax, [ebp - 0x88]
mov dword [ebp - 0x28], 0x70616548
push eax
lea eax, [ebp - 0x98]
mov dword [ebp - 0x24], 0x6f6c6c41
push eax
mov word [ebp - 0x20], 0x63
mov dword [ebp - 0x98], 0x4e52454b
mov dword [ebp - 0x94], 0x32334c45
mov dword [ebp - 0x90], 0x6c6c642e
mov byte [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0x64616f4c
mov dword [ebp - 0x84], 0x7262694c
mov dword [ebp - 0x80], 0x41797261
mov byte [ebp - 0x7c], 0
call edi
push eax
call esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
call edi
test eax, eax
jne 0x403690
lea eax, [ebp - 0x18]
push eax
call dword [ebp - 4]
test eax, eax
jne 0x403690
xor esi, esi
jmp 0x403699
lea ecx, [ebp - 0x28]
push ecx
push eax
call esi
mov esi, eax
mov eax, 0x5a4d
cmp word [0x5cd8d0], ax
jne 0x403839
mov ecx, dword [0x5cd90c]
cmp dword [ecx + 0x5cd8d0], 0x4550
lea edi, [ecx + 0x5cd8d0]
jne 0x403839
push 4
push 0x2000
push dword [edi + 0x50]
push dword [edi + 0x34]
call ebx
mov dword [ebp - 4], eax
test eax, eax
jne 0x4036f5
push 4
push 0x2000
push dword [edi + 0x50]
push eax
call ebx
mov dword [ebp - 4], eax
test eax, eax
je 0x403839
push 0x14
push 0
call dword [ebp - 8]
push eax
call esi
mov esi, dword [ebp - 0x1c]
mov ebx, eax
mov eax, dword [ebp - 4]
push 4
push 0x1000
mov dword [ebx + 4], eax
mov dword [ebx + 0xc], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0x10], 0
push dword [edi + 0x50]
mov dword [ebp - 0xac], ebx
push eax
call esi
push 4
push 0x1000
push dword [edi + 0x54]
push dword [ebp - 4]
call esi
mov ecx, dword [edi + 0x54]
mov esi, eax
add ecx, dword [0x5cd90c]
push ecx
push 0x5cd8d0
push esi
call fcn.0054e7d0
mov eax, dword [0x5cd90c]
mov edx, edi
add eax, esi
mov esi, dword [ebp - 4]
mov dword [ebx], eax
push ebx
mov dword [eax + 0x34], esi
call fcn.00402e20
mov eax, esi
add esp, 0x10
sub eax, dword [edi + 0x34]
mov dword [ebp - 0x1c], eax
je 0x4037f8
mov edi, dword [ebx]
cmp dword [edi + 0xa4], 0
jbe 0x4037f8
mov ecx, dword [ebx + 4]
mov edi, dword [edi + 0xa0]
add edi, ecx
mov dword [ebp - 8], ecx
mov eax, dword [edi]
test eax, eax
je 0x4037f8
nop dword [eax + eax]
lea ebx, [eax + ecx]
xor esi, esi
mov ecx, dword [edi + 4]
lea edx, [edi + 8]
lea eax, [ecx - 8]
test eax, 0xfffffffe
jbe 0x4037e3
movzx eax, word [edx]
mov ecx, eax
and ecx, 0xf000
cmp ecx, 0x3000
jne 0x4037d3
mov ecx, dword [ebp - 0x1c]
and eax, 0xfff
add dword [eax + ebx], ecx
mov ecx, dword [edi + 4]
inc esi
add edx, 2
lea eax, [ecx - 8]
shr eax, 1
cmp esi, eax
jb 0x4037b5
mov eax, dword [edi + ecx]
add edi, ecx
mov ecx, dword [ebp - 8]
test eax, eax
jne 0x4037a0
mov ebx, dword [ebp - 0xac]
mov esi, dword [ebp - 4]
mov ecx, ebx
call fcn.00403170
test eax, eax
je 0x403832
mov ecx, ebx
call fcn.00402f70
mov eax, dword [ebx]
mov eax, dword [eax + 0x28]
test eax, eax
je 0x403829
add eax, esi
je 0x403832
push 0
push 1
push esi
call eax
test eax, eax
je 0x403832
mov dword [ebx + 0x10], 1
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, ebx
call fcn.00403910
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret