Function at 0x20004434
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
and byte [ebp - 0x35], 0
and byte [ebp - 0x34], 0
and byte [ebp - 0x33], 0
or byte [ebp - 0x2b], 0xff
push ebx
push esi
push edi
mov esi, 0x500000
xor edi, edi
push esi
push edi
mov byte [ebp - 0x24], 0xc6
mov byte [ebp - 0x23], 0x45
mov byte [ebp - 0x22], 0xfc
mov byte [ebp - 0x21], 6
mov byte [ebp - 0x20], 0x8b
mov byte [ebp - 0x1f], 0x17
mov byte [ebp - 0x1e], 0x8b
mov byte [ebp - 0x1d], 0x52
mov byte [ebp - 0x1c], 0x58
mov byte [ebp - 0x38], 0x8b
mov byte [ebp - 0x37], 0x82
mov byte [ebp - 0x36], 0x88
mov byte [ebp - 0x32], 0x83
mov byte [ebp - 0x31], 0xc4
mov byte [ebp - 0x30], 4
mov byte [ebp - 0x2f], 0x6a
mov byte [ebp - 0x2e], 1
mov byte [ebp - 0x2d], 0x8b
mov byte [ebp - 0x2c], 0xce
mov byte [ebp - 0x2a], 0xd0
mov byte [ebp - 0x29], 0x8b
mov byte [ebp - 0x28], 0xce
mov byte [ebp - 0x10], 0x8b
mov byte [ebp - 0xf], 0x4f
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x89
mov byte [ebp - 0xc], 0x8e
mov byte [ebp - 2], 0x81
mov byte [ebp - 1], 0x3d
mov byte [ebp - 0x18], 0x6a
mov byte [ebp - 0x17], 2
mov byte [ebp - 0x16], 0x8d
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x90
mov byte [ebp - 0x13], 0xe8
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
cmp ebx, edi
je 0x2000466a
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push 0x900000
push ebx
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x24]
push 9
push eax
push esi
push ebx
call fcn.20005edd
add esp, 0x1c
cmp eax, edi
je 0x2000452b
add eax, 0x900000
mov dword [0x2000d0f0], eax
add eax, 6
mov dword [0x2000d0f4], eax
lea eax, [ebp - 0x38]
push 0x11
push eax
push esi
push ebx
call fcn.20005edd
add esp, 0x10
cmp eax, edi
je 0x20004551
add eax, 0x900000
mov dword [0x2000d0f8], eax
add eax, 6
mov dword [0x2000d0fc], eax
lea eax, [ebp - 0x18]
push 6
push eax
push esi
push ebx
call fcn.20005edd
add esp, 0x10
cmp eax, edi
je 0x2000457f
add eax, 0x8fffd5
cmp dword [eax], 0x8b04c483
jne 0x2000457f
mov dword [0x2000d100], eax
add eax, 5
mov dword [0x2000d104], eax
lea eax, [ebp - 0x10]
push 5
push eax
push esi
push ebx
call fcn.20005edd
add esp, 0x10
cmp eax, edi
je 0x200045ae
add eax, 0x900003
mov dword [0x2000d108], eax
mov ecx, dword [eax + 2]
add eax, 6
mov dword [0x2000d10c], ecx
mov dword [0x2000d110], eax
mov esi, 0x200015dc
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, edi
jne 0x200045c5
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x200015d4
push eax
call esi
mov edi, eax
push 0x20
push ebx
push edi
push dword [0x2000d134]
call fcn.20005f69
add esp, 0x10
test eax, eax
je 0x20004621
lea eax, [ebp - 2]
push 2
push eax
push 0x20
push ebx
call fcn.20005edd
add esp, 0x10
test eax, eax
je 0x20004621
add eax, edi
mov dword [0x2000d11c], eax
mov ecx, dword [eax + 2]
add eax, 0xa
mov dword [0x2000d128], ecx
mov ecx, dword [eax - 4]
mov dword [0x2000d12c], ecx
mov dword [0x2000d130], eax
mov edi, 0x200015c4
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov dword [ebp - 8], eax
jne 0x2000463e
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 8], eax
mov edi, 0x200015bc
push edi
push dword [ebp - 8]
call esi
push edi
push dword [ebp - 8]
call esi
cmp byte [eax], 0xa1
jne 0x20004661
mov dword [0x2000d120], eax
mov eax, dword [eax + 1]
mov dword [0x2000d124], eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor edi, edi
cmp dword [0x2000d0f0], edi
je 0x2000469f
cmp dword [0x2000d108], edi
je 0x2000469f
cmp dword [0x2000d0f8], edi
je 0x2000469f
cmp dword [0x2000d11c], edi
je 0x2000469f
cmp dword [0x2000d100], edi
je 0x2000469f
cmp dword [0x2000d120], edi
je 0x2000469f
push 1
pop eax
jmp 0x200046a1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret