Function at 0x43b650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x6c
mov eax, dword [0x567b10]
xor eax, esp
mov dword [esp + 0x68], eax
cmp dword [esp + 0x80], 0
je 0x43b713
mov ebx, dword [esp + 0x84]
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [esp + 0x18]
push 0
push 1
push eax
push 0
push edi
push 0
push 0x11ff
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
setne cl
mov byte [esp + 3], cl
je 0x43b71a
mov esi, dword [ebx + 0x10]
mov eax, esi
and eax, 0xfffffffe
cmp eax, 0x7ffffffe
je 0x43bddd
mov edx, dword [esp + 0x18]
mov ebp, dword [ebx]
mov eax, dword [ebx + 0x14]
mov dword [esp + 0xc], eax
lea eax, [esi + 2]
cmp eax, 0x10
mov dword [esp + 4], edx
mov dword [esp + 8], ebp
mov dword [esp + 0x10], eax
jb 0x43b778
or eax, 0xf
js 0x43b791
cmp eax, 0x16
mov ebx, 0x16
mov dword [esp + 0x14], eax
cmova ebx, eax
lea eax, [ebx + 1]
cmp ebx, 0xfff
jb 0x43b7b2
mov ebx, dword [esp + 0x14]
jmp 0x43b79b
mov bl, 1
jmp 0x43bdc2
mov esi, dword [ebx + 0x10]
mov eax, 0x7fffffff
sub eax, esi
cmp eax, 0xe
jbe 0x43bddd
mov edx, dword [ebx]
mov eax, dword [ebx + 0x14]
lea ebp, [esi + 0xf]
cmp ebp, 0x10
mov dword [esp + 4], ebp
jb 0x43b783
mov dword [esp + 0x10], eax
mov eax, ebp
or eax, 0xf
mov dword [esp + 8], edx
js 0x43b952
cmp eax, 0x16
mov ebx, 0x16
mov dword [esp + 0xc], eax
cmova ebx, eax
lea eax, [ebx + 1]
cmp ebx, 0xfff
jb 0x43b973
mov ebx, dword [esp + 0xc]
jmp 0x43b95c
lea ebp, [esp + 0x50]
mov ebx, 0xf
jmp 0x43b7c1
lea ebp, [esp + 0x50]
mov ebx, 0xf
jmp 0x43b98a
mov ebx, 0x7fffffff
mov eax, 0x80000000
add eax, 0x23
push eax
call fcn.00533f15
add esp, 4
lea ebp, [eax + 0x23]
and ebp, 0xffffffe0
mov dword [ebp - 4], eax
jmp 0x43b7bd
push eax
call fcn.00533f15
add esp, 4
mov ebp, eax
mov dword [esp + 0x50], ebp
mov eax, dword [esp + 0xc]
cmp eax, 0xf
mov eax, dword [esp + 0x84]
cmova eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], ebx
push esi
push eax
push ebp
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov word [ebp + esi], 0x203a
mov byte [ebp + esi + 2], 0
mov ebx, dword [esp + 4]
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
mov esi, edx
sub esi, ecx
cmp esi, eax
jae 0x43b83d
sub esp, 0x10
mov cl, byte [esp + 0x48]
mov byte [esp + 4], cl
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp], eax
lea ecx, [esp + 0x60]
call fcn.00405f90
mov ebp, eax
add eax, 0x14
lea ebx, [ebp + 0x10]
jmp 0x43b870
lea ebp, [esp + 0x50]
mov esi, eax
add esi, ecx
mov dword [esp + 0x60], esi
mov ebx, ebp
cmp edx, 0xf
jbe 0x43b854
mov ebx, dword [esp + 0x50]
add ecx, ebx
push eax
push dword [esp + 8]
push ecx
call sub.VCRUNTIME140.dll_memmove
lea eax, [esp + 0x70]
add esp, 0xc
mov byte [ebx + esi], 0
lea ebx, [esp + 0x60]
mov cl, byte [ebp]
movsd xmm0, qword [ebp + 8]
movsd qword [esp + 0x3f], xmm0
movsd xmm0, qword [ebp + 1]
movsd qword [esp + 0x38], xmm0
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov dword [ebx], 0
mov dword [eax], 0xf
mov byte [ebp], 0
mov ebx, dword [esp + 0x80]
mov eax, dword [ebx + 0x14]
cmp eax, 0x10
jb 0x43b8f1
mov dword [esp + 8], esi
mov ebp, edx
mov byte [esp + 4], cl
mov ecx, dword [ebx]
lea esi, [eax + 1]
cmp esi, 0x1000
jb 0x43b8dd
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x43bdd7
add eax, 0x24
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.00533ac0
add esp, 8
mov cl, byte [esp + 4]
mov edx, ebp
mov esi, dword [esp + 8]
mov byte [ebx], cl
movsd xmm0, qword [esp + 0x38]
movsd xmm1, qword [esp + 0x3f]
movsd qword [ebx + 8], xmm1
movsd qword [ebx + 1], xmm0
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x14], esi
mov eax, dword [esp + 0x64]
cmp eax, 0x10
jb 0x43ba24
mov ecx, dword [esp + 0x50]
lea esi, [eax + 1]
cmp esi, 0x1000
jb 0x43b943
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x43bdd7
add eax, 0x24
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.00533ac0
add esp, 8
jmp 0x43ba24
mov ebx, 0x7fffffff
mov eax, 0x80000000
add eax, 0x23
push eax
call fcn.00533f15
add esp, 4
lea ebp, [eax + 0x23]
and ebp, 0xffffffe0
mov dword [ebp - 4], eax
jmp 0x43b97e
push eax
call fcn.00533f15
add esp, 4
mov ebp, eax
mov dword [esp + 0x50], ebp
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x10]
cmp eax, 0xf
mov eax, dword [esp + 0x84]
cmova eax, edx
mov ecx, dword [esp + 4]
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], ebx
push esi
push eax
push ebp
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [ebp + esi], 0x6e55203a
mov dword [ebp + esi + 4], 0x776f6e6b
mov dword [ebp + esi + 8], 0x7265206e
mov dword [ebp + esi + 0xb], 0x726f7272
mov byte [ebp + esi + 0xf], 0
mov ebx, dword [esp + 0x80]
mov eax, dword [ebx + 0x14]
cmp eax, 0x10
jb 0x43ba11
mov ecx, dword [ebx]
lea esi, [eax + 1]
cmp esi, 0x1000
jb 0x43ba07
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x43bdd7
add eax, 0x24
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.00533ac0
add esp, 8
movsd xmm0, qword [esp + 0x60]
movsd qword [ebx + 0x10], xmm0
movups xmm0, xmmword [esp + 0x50]
movups xmmword [ebx], xmm0
mov eax, 0xf
lea ebp, [esp + 0x61]
test edi, edi
je 0x43ba9a
xor edx, edx
mov esi, ebp
xor ebx, ebx
nop word [eax + eax]
mov ecx, edi
and ecx, 0xf
mov eax, ecx
add al, 0x37
mov ah, cl
or ah, 0x30
cmp ecx, 0xa
movzx ecx, ah
movzx eax, al
cmovb eax, ecx
mov byte [esi - 1], al
shrd edi, ebx, 4
add esi, 0xffffffff
shr ebx, 4
add edx, 1
mov eax, edi
or eax, ebx
jne 0x43ba40
mov eax, 0xf
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
test edx, edx
mov ebx, dword [esp + 0x80]
jne 0x43bab4
xor eax, eax
mov ecx, 0xf
jmp 0x43baf8
lea esi, [esp + 0x60]
mov byte [esp + 0x60], 0x30
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
sub ebp, esi
cmp ebp, 0xf
jbe 0x43bad8
sub esp, 0xc
mov al, byte [esp + 0x28]
mov byte [esp + 4], al
mov dword [esp + 8], esi
mov dword [esp], ebp
lea ecx, [esp + 0x2c]
call fcn.00404140
jmp 0x43baf0
mov dword [esp + 0x30], ebp
lea eax, [esp + 0x20]
push ebp
push esi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [esp + ebp + 0x20], 0
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov edx, ecx
sub edx, eax
cmp edx, 4
jae 0x43bb41
sub esp, 0x14
mov al, byte [esp + 0x64]
mov byte [esp + 4], al
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], str.__0x
mov dword [esp + 8], 0
mov dword [esp], 4
lea ecx, [esp + 0x34]
call fcn.00418450
mov edi, eax
add eax, 0x14
lea ecx, [edi + 0x10]
jmp 0x43bbdd
lea edx, [eax + 4]
mov dword [esp + 0x30], edx
cmp ecx, 0xf
mov edx, dword [esp + 0x20]
lea edi, [esp + 0x20]
mov esi, edi
cmova esi, edx
mov ebp, 4
cmp esi, 0x5393ee
jae 0x43bb88
lea ebx, [esi + eax]
mov ebp, 4
cmp ebx, str.__0x
jb 0x43bb88
xor ebp, ebp
cmp esi, str.__0x
jbe 0x43bb88
mov ebx, str.__0x
mov ebp, esi
sub ebp, ebx
lea ebx, [esp + 0x30]
add eax, 1
add edx, 4
cmp ecx, 0xf
lea ecx, [esp + 0x24]
cmova ecx, edx
push eax
push esi
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
push ebp
push str.__0x
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, 4
sub ecx, ebp
lea eax, [ebp + 0x5393ee]
add esi, ebp
push ecx
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
mov ecx, ebx
lea eax, [esp + 0x40]
add esp, 0xc
mov ebx, dword [esp + 0x80]
movups xmm0, xmmword [edi]
movups xmmword [esp + 0x38], xmm0
movsd xmm0, qword [edi + 0x10]
movsd qword [esp + 0x48], xmm0
mov dword [ecx], 0
mov dword [eax], 0xf
mov byte [edi], 0
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
cmp ecx, edx
jne 0x43bc3e
sub esp, 0x10
mov al, byte [esp + 0x60]
mov byte [esp + 4], al
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0x537aa6
mov dword [esp], 1
lea ecx, [esp + 0x48]
call fcn.00405f90
lea ecx, [eax + 0x14]
lea esi, [eax + 0x10]
jmp 0x43bc62
lea eax, [esp + 0x38]
lea esi, [edx + 1]
mov dword [esp + 0x48], esi
mov edi, eax
cmp ecx, 0xf
jbe 0x43bc54
mov edi, dword [esp + 0x38]
lea ecx, [esp + 0x4c]
lea esi, [esp + 0x48]
mov word [edi + edx], 0x29
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x50], xmm0
movsd xmm0, qword [eax + 0x10]
movsd qword [esp + 0x60], xmm0
mov dword [esi], 0
mov dword [ecx], 0xf
mov byte [eax], 0
mov eax, dword [esp + 0x60]
cmp dword [esp + 0x64], 0xf
jbe 0x43bc95
mov ecx, dword [esp + 0x50]
jmp 0x43bc99
lea ecx, [esp + 0x50]
mov edx, dword [ebx + 0x10]
mov edi, dword [ebx + 0x14]
mov esi, edi
sub esi, edx
cmp esi, eax
jae 0x43bcc6
sub esp, 0x10
mov dl, byte [esp + 0x2c]
mov byte [esp + 4], dl
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp], eax
mov ecx, ebx
call fcn.00405f90
jmp 0x43bce4
lea esi, [edx + eax]
mov dword [ebx + 0x10], esi
cmp edi, 0x10
jb 0x43bcd3
mov ebx, dword [ebx]
add edx, ebx
push eax
push ecx
push edx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [ebx + esi], 0
mov eax, dword [esp + 0x64]
cmp eax, 0x10
jb 0x43bd1e
mov ecx, dword [esp + 0x50]
lea esi, [eax + 1]
cmp esi, 0x1000
jb 0x43bd14
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x43bdd7
add eax, 0x24
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.00533ac0
add esp, 8
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0xf
mov byte [esp + 0x50], 0
mov eax, dword [esp + 0x4c]
cmp eax, 0x10
jb 0x43bd69
mov ecx, dword [esp + 0x38]
lea esi, [eax + 1]
cmp esi, 0x1000
jb 0x43bd5f
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x43bdd7
add eax, 0x24
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.00533ac0
add esp, 8
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0xf
mov byte [esp + 0x38], 0
mov eax, dword [esp + 0x34]
cmp eax, 0x10
jb 0x43bdb4
mov ecx, dword [esp + 0x20]
lea esi, [eax + 1]
cmp esi, 0x1000
jb 0x43bdaa
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x43bdd7
add eax, 0x24
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.00533ac0
add esp, 8
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov bl, byte [esp + 3]
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.00533ace
mov eax, ebx
add esp, 0x6c
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
call fcn.00404240
int3