Function at 0x487c00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x11
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.0048eb40
add esp, 0xc
xchg ebx, eax
xchg ebx, eax
ja 0x487c2e
xchg edi, eax
xchg edi, eax
lea esi, [esi + 0x46ea]
lea esi, [esi - 0x46ea]
jbe 0x487c2e
xor eax, 0x66b065b2
mov dl, 0x65
mov al, 0x66
mov cl, 0x6d
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], dl
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0x42
mov byte [ebp - 0x17], al
mov byte [ebp - 0x12], 0x76
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 8], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], cl
mov byte [ebp - 0xc], dl
mov byte [ebp - 0x15], 0x4e
mov byte [ebp - 0x10], al
mov byte [ebp - 0xb], cl
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], al
xor ebx, edi
xor ebx, edi
jge 0x487c81
jns 0x487c79
xchg ebx, ecx
xchg ebx, ecx
jl 0x487c81
or edi, 0x8ae8458a
pop ebp
in eax, dx
mov al, byte [ebp - 0x18]
mov bl, byte [ebp - 0x13]
mov dl, byte [ebp - 0xe]
mov cl, byte [ebp - 9]
dec al
dec bl
mov byte [ebp - 0x18], al
mov al, byte [ebp - 0x17]
dec dl
mov byte [ebp - 0x13], bl
mov bl, byte [ebp - 0x12]
dec cl
mov byte [ebp - 0xe], dl
mov dl, byte [ebp - 0xd]
mov byte [ebp - 9], cl
mov cl, byte [ebp - 0x16]
dec al
dec bl
mov byte [ebp - 0x17], al
mov al, byte [ebp - 0x11]
dec dl
mov byte [ebp - 0x12], bl
mov bl, byte [ebp - 0xc]
dec cl
mov byte [ebp - 0xd], dl
mov dl, byte [ebp - 0x15]
mov byte [ebp - 0x16], cl
mov cl, byte [ebp - 0x10]
dec al
dec bl
mov byte [ebp - 0x11], al
mov al, byte [ebp - 0xb]
dec dl
mov byte [ebp - 0xc], bl
mov bl, byte [ebp - 0x14]
dec cl
mov byte [ebp - 0x15], dl
mov dl, byte [ebp - 0xf]
mov byte [ebp - 0x10], cl
mov cl, byte [ebp - 0xa]
dec al
dec bl
dec dl
dec cl
mov byte [ebp - 0xb], al
mov byte [ebp - 0x14], bl
mov byte [ebp - 0xf], dl
mov byte [ebp - 0xa], cl
nop
cmp ecx, dword [esp]
and edi, edi
jl 0x487d17
pushf
or esp, 0
popf
mov esp, esp
jnp 0x487d14
jge 0x487d17
sub eax, 0xfffeb834
call fcn.00473550
mov ecx, eax
test ecx, ecx
jne 0x487d2b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
rol eax, 0x16
rol eax, 0xa
or edx, 0
jo 0x487d36
ror esi, 8
rol esi, 8
js 0x487d43
jbe 0x487d40
jns 0x487d43
mov ebp, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
push ecx
call fcn.00476d20
mov esi, eax
push 0x11
lea eax, [ebp - 0x18]
push 0
push eax
mov dword [ebp - 4], esi
call fcn.0048eb40
add esp, 0xc
or esp, 0
ja 0x487d7b
pushf
cmp edx, ecx
jnp 0x487d6d
jns 0x487d6f
lea esp, [esp]
popf
jb 0x487d76
ja 0x487d78
jbe 0x487d7b
xor eax, 0xb75f685
test esi, esi
jne 0x487d8a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
sub esp, 0
je 0x487d98
jge 0x487d91
jbe 0x487d93
lea eax, [eax]
jne 0x487d98
jmp 0x859b65f2
push esi
call fcn.004902f0
push 0x11
lea ecx, [ebp - 0x18]
push 0
push ecx
call fcn.0048eb40
add esp, 0x10
lea esp, [esp]
test eax, 0x5711
jne 0x487db8
jne 0x487dc1
jbe 0x487dbc
je 0x487dbe
je 0x487dc1
mov eax, 0x66b065b2
mov dl, 0x65
mov al, 0x66
mov cl, 0x6d
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], dl
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0x58
mov byte [ebp - 0x17], al
mov byte [ebp - 0x12], 0x76
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 8], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x11], cl
mov byte [ebp - 0xc], dl
mov byte [ebp - 0x15], 0x4e
mov byte [ebp - 0x10], al
mov byte [ebp - 0xb], cl
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], al
xchg edx, edi
xchg edx, edi
je 0x487e16
lea ebx, [ebx]
jmp 0x487e0e
lea eax, [eax]
lea esp, [esp]
jne 0x487e16
ljmp 0xed5d:0x8ae8458a
mov al, byte [ebp - 0x18]
mov bl, byte [ebp - 0x13]
mov dl, byte [ebp - 0xe]
mov cl, byte [ebp - 9]
dec al
dec bl
mov byte [ebp - 0x18], al
mov al, byte [ebp - 0x17]
dec dl
mov byte [ebp - 0x13], bl
mov bl, byte [ebp - 0x12]
dec cl
mov byte [ebp - 0xe], dl
mov dl, byte [ebp - 0xd]
mov byte [ebp - 9], cl
mov cl, byte [ebp - 0x16]
dec al
dec bl
mov byte [ebp - 0x17], al
mov al, byte [ebp - 0x11]
dec dl
mov byte [ebp - 0x12], bl
mov bl, byte [ebp - 0xc]
dec cl
mov byte [ebp - 0xd], dl
mov dl, byte [ebp - 0x15]
mov byte [ebp - 0x16], cl
mov cl, byte [ebp - 0x10]
dec al
dec bl
mov byte [ebp - 0x11], al
mov al, byte [ebp - 0xb]
dec dl
mov byte [ebp - 0xc], bl
mov bl, byte [ebp - 0x14]
dec cl
mov byte [ebp - 0x15], dl
mov dl, byte [ebp - 0xf]
mov byte [ebp - 0x10], cl
mov cl, byte [ebp - 0xa]
dec al
dec bl
dec dl
dec cl
mov byte [ebp - 0xb], al
mov byte [ebp - 0x14], bl
mov byte [ebp - 0xf], dl
mov byte [ebp - 0xa], cl
cmp ebx, 0x19cc
test dword [esp + 8], ebx
or edx, edx
jns 0x487ea4
jg 0x487eb1
pushf
jne 0x487eaa
popf
jge 0x487eae
jle 0x487eb1
jmp 0x47299f56
mov eax, dword [0x46e120]
test eax, eax
je 0x487ee6
test esp, 0x497a
jnp 0x487ed3
pushf
dec ebx
inc ebx
ror ebx, 2
rol ebx, 2
popf
jmp 0x487ed0
jp 0x487ed3
mov esp, 0x46e120a1
add byte [ebp + 0x5052e855], cl
mov eax, dword [0x46e120]
lea edx, [ebp - 0x18]
push edx
push eax
call fcn.00476d20
mov edi, eax
jmp 0x487ee9
mov edi, dword [ebp + 8]
clc
test dword [esp + 8], esi
ja 0x487efc
lea edx, [edx]
jo 0x487ef4
jmp 0x487ef6
js 0x487ef8
jbe 0x487efc
lcall 0xe84d, 0x8d116ada
push 0x11
lea ecx, [ebp - 0x18]
push 0
push ecx
call fcn.0048eb40
add esp, 0xc
shr esi, 0
not ecx
not ecx
jg 0x487f2f
pushf
xor edx, 0x4789
xor edx, 0x4789
jno 0x487f25
popf
lea esp, [esp]
jbe 0x487f2c
jle 0x487f2f
mov ecx, 0x3774ff85
test edi, edi
je 0x487f6a
add ecx, 0x171a
sub ecx, 0x171a
add esp, 0
jle 0x487f61
pushf
xor edx, 0
ror eax, 0x1e
ror eax, 2
xchg ecx, esi
xchg ecx, esi
shl ebx, 0
popf
xchg esp, esp
jnp 0x487f5c
mov esp, esp
jg 0x487f61
lcall 0, 0x8389e857
push edi
call fcn.004902f0
add esp, 4
clc
neg edi
neg edi
jbe 0x487f71
jg 0x487f88
lea esi, [esi + 0x56b]
lea esi, [esi - 0x56b]
jne 0x487f81
lea esp, [esp]
jle 0x487f88
xor edx, 0x5208558b
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4