Function at 0x465a45
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x1c], edx
push edi
mov dword [ebp - 0x10], esi
mov bl, 0x37
mov dword [ebp - 0x2a], 0x45527c37
xor eax, eax
mov dword [ebp - 0x26], 0x45b5259
mov dword [ebp - 0x22], 0x5b531905
mov word [ebp - 0x1e], 0x5b
xor byte [ebp + eax - 0x29], bl
inc eax
cmp eax, 0xc
jae 0x465a84
mov bl, byte [ebp - 0x2a]
jmp 0x465a75
mov edi, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
lea eax, [ebp - 0x29]
push eax
mov byte [ebp - 0x1d], 0
call edi
test eax, eax
je 0x465aa4
mov edx, 0x49d4bc
mov ecx, eax
call fcn.00401390
lea ecx, [ebp - 0x60]
push ecx
push esi
call eax
test eax, eax
jne 0x465ab9
mov eax, 0x200
jmp 0x465e79
mov ebx, dword [ebp - 0x60]
mov esi, ebx
and esi, 1
mov eax, ebx
mov ecx, esi
or ecx, 2
and al, 2
mov eax, ebx
cmove ecx, esi
mov edx, ecx
or edx, 4
and al, 4
cmove edx, ecx
mov ecx, ebx
mov eax, edx
or eax, 0x10
and ecx, 0x10
cmove eax, edx
mov edx, eax
or edx, 0x20
and bl, 0x20
mov ebx, 0x81000000
cmove edx, eax
test ecx, ecx
mov eax, 0x41000000
cmove eax, ebx
or edx, eax
mov dword [ebp - 8], edx
test esi, esi
jne 0x465b12
or edx, 0x800000
mov dword [ebp - 8], edx
xor ebx, ebx
mov dword [ebp - 0x2a], 0x26311f54
mov cl, 0x54
mov dword [ebp - 0x26], 0x6738313a
mov dword [ebp - 0x22], 0x38307a66
mov eax, ebx
mov word [ebp - 0x1e], 0x38
xor byte [ebp + eax - 0x29], cl
inc eax
cmp eax, 0xc
jae 0x465b42
mov cl, byte [ebp - 0x2a]
jmp 0x465b33
lea eax, [ebp - 0x29]
mov byte [ebp - 0x1d], bl
push eax
call edi
test eax, eax
jne 0x465b53
mov eax, ebx
jmp 0x465b5f
mov edx, 0x494b70
mov ecx, eax
call fcn.00401390
mov esi, dword [ebp - 0x10]
push ebx
push esi
call eax
mov ecx, eax
mov dword [ebp - 0xc], ecx
cmp ecx, 0x28
jbe 0x465dc7
mov cl, 0x4a
mov dword [ebp - 0x2a], 0x382f014a
mov dword [ebp - 0x26], 0x79262f24
mov eax, ebx
mov dword [ebp - 0x22], 0x262e6478
mov word [ebp - 0x1e], 0x26
xor byte [ebp + eax - 0x29], cl
inc eax
cmp eax, 0xc
jae 0x465ba2
mov cl, byte [ebp - 0x2a]
jmp 0x465b93
lea eax, [ebp - 0x29]
mov byte [ebp - 0x1d], bl
push eax
call edi
test eax, eax
jne 0x465bb3
mov eax, ebx
jmp 0x465bbf
mov edx, 0x494d4c
mov ecx, eax
call fcn.00401390
push ebx
push ebx
push ebx
push esi
call eax
push 0x2a
pop ebx
mov cl, 0x46
mov dword [ebp - 0x2a], 0x34230d46
mov word [ebp - 0x26], 0x2328
xor eax, eax
mov byte [ebp - 0x24], bl
mov dword [ebp - 0x23], 0x22687475
mov byte [ebp - 0x1f], bl
mov byte [ebp - 0x1e], bl
mov byte [ebp - 0x1d], 0
xor byte [ebp + eax - 0x29], cl
inc eax
cmp eax, 0xc
jae 0x465bfc
mov cl, byte [ebp - 0x2a]
jmp 0x465bed
lea eax, [ebp - 0x29]
mov byte [ebp - 0x1d], 0
push eax
call edi
test eax, eax
je 0x465c16
mov edx, 0x494d30
mov ecx, eax
call fcn.00401390
push 0
lea ecx, [ebp - 0x14]
push ecx
push 2
lea ecx, [ebp - 4]
push ecx
push esi
call eax
push 0x78
pop ecx
mov byte [ebp - 0x2a], cl
xor eax, eax
mov dword [ebp - 0x29], 0x160a1d33
mov dword [ebp - 0x25], 0x4a4b141d
mov dword [ebp - 0x21], 0x14141c56
mov byte [ebp - 0x1d], 0
xor byte [ebp + eax - 0x29], cl
inc eax
cmp eax, 0xc
jae 0x465c55
mov cl, byte [ebp - 0x2a]
jmp 0x465c46
lea eax, [ebp - 0x29]
mov byte [ebp - 0x1d], 0
push eax
call edi
test eax, eax
je 0x465c6f
mov edx, 0x494d4c
mov ecx, eax
call fcn.00401390
push 0
push 0
push 0x24
push esi
call eax
xor edx, edx
mov dword [ebp - 0x2a], 0x17002e65
mov cl, 0x65
mov dword [ebp - 0x26], 0x5609000b
mov dword [ebp - 0x22], 0x9014b57
mov eax, edx
mov word [ebp - 0x1e], 9
xor byte [ebp + eax - 0x29], cl
inc eax
cmp eax, 0xc
jae 0x465ca8
mov cl, byte [ebp - 0x2a]
jmp 0x465c99
lea eax, [ebp - 0x29]
mov byte [ebp - 0x1d], dl
push eax
call edi
test eax, eax
je 0x465cc1
mov edx, 0x494d30
mov ecx, eax
call fcn.00401390
push 0
lea ecx, [ebp - 0x14]
push ecx
push 4
lea ecx, [ebp - 0x10]
push ecx
push esi
call eax
mov ecx, dword [ebp - 0xc]
mov eax, 0x54ad
cmp word [ebp - 4], ax
jne 0x465dc7
mov eax, dword [ebp - 0x10]
add eax, 0x34
cmp ecx, eax
jbe 0x465dc7
push 0x2e
xor edx, edx
mov dword [ebp - 0x29], 0x405c4b65
pop ecx
mov byte [ebp - 0x2a], cl
mov eax, edx
mov dword [ebp - 0x25], 0x1c1d424b
mov dword [ebp - 0x21], 0x42424a00
mov byte [ebp - 0x1d], dl
xor byte [ebp + eax - 0x29], cl
inc eax
cmp eax, 0xc
jae 0x465d21
mov cl, byte [ebp - 0x2a]
jmp 0x465d12
lea eax, [ebp - 0x29]
mov byte [ebp - 0x1d], dl
push eax
call edi
test eax, eax
je 0x465d3a
mov edx, 0x494d4c
mov ecx, eax
call fcn.00401390
push 0
push 0
push dword [ebp - 0x10]
push esi
call eax
mov byte [ebp - 0x2a], bl
xor eax, eax
mov dword [ebp - 0x29], 0x44584f61
mov dword [ebp - 0x25], 0x1819464f
mov dword [ebp - 0x21], 0x46464e04
mov byte [ebp - 0x1d], 0
xor byte [ebp + eax - 0x29], bl
inc eax
cmp eax, 0xc
jae 0x465d71
mov bl, byte [ebp - 0x2a]
jmp 0x465d62
lea eax, [ebp - 0x29]
xor ebx, ebx
push eax
mov byte [ebp - 0x1d], bl
call edi
test eax, eax
jne 0x465d84
mov eax, ebx
jmp 0x465d90
mov edx, 0x494d30
mov ecx, eax
call fcn.00401390
push ebx
lea ecx, [ebp - 0x14]
push ecx
push 4
lea ecx, [ebp - 0x18]
push ecx
push esi
call eax
mov eax, dword [ebp - 0x18]
cmp eax, 0x5a4d
je 0x465dbd
cmp eax, 0x454e
je 0x465dbd
cmp eax, 0x454c
je 0x465dbd
cmp eax, 0x4550
jne 0x465dcc
mov eax, dword [ebp - 8]
or eax, 0x400000
jmp 0x465dcf
mov eax, dword [ebp - 8]
jmp 0x465dd2
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
test edx, edx
je 0x465ddb
mov dword [edx], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x465de4
mov dword [eax], ecx
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x465e4e
mov ecx, dword [ebp - 0x54]
mov ebx, 0x19db1de
mov eax, dword [ebp - 0x50]
sub ecx, 0xd53e8000
push 0
mov edi, 0x989680
sbb eax, ebx
push edi
push eax
push ecx
call fcn.00486510
mov ecx, dword [ebp - 0x4c]
mov dword [esi], eax
sub ecx, 0xd53e8000
mov eax, dword [ebp - 0x48]
push 0
push edi
sbb eax, ebx
mov dword [esi + 4], edx
push eax
push ecx
call fcn.00486510
mov ecx, dword [ebp - 0x5c]
mov dword [esi + 8], eax
sub ecx, 0xd53e8000
mov eax, dword [ebp - 0x58]
push 0
push edi
sbb eax, ebx
mov dword [esi + 0xc], edx
push eax
push ecx
call fcn.00486510
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x465e77
push dword [ebp - 0x48]
lea edx, [ebp - 8]
push dword [ebp - 0x4c]
lea ecx, [ebp - 4]
call fcn.004659e8
movzx eax, word [ebp - 8]
pop ecx
pop ecx
movzx ecx, word [ebp - 4]
shl ecx, 0x10
or ecx, eax
mov dword [esi], ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret