Function at 0x64cffc
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x58
push esi
mov esi, dword [eax + 0xdec]
mov edx, dword [esi]
push edi
mov edi, dword [esp + 0x64]
push edi
mov ecx, esi
call dword [edx + 0x30]
test al, al
je 0x64d250
mov al, byte [esp + 0x68]
test al, al
je 0x64d250
push 0x604814
mov ecx, edi
call fcn.005723cc
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x3c]
test al, al
jne 0x64d050
mov ecx, edi
call fcn.00571e9c
pop edi
pop esi
add esp, 0x58
ret
push ebx
push ebp
push edi
lea ecx, [esp + 0x28]
call fcn.00571b6c
lea ecx, [esp + 0x38]
call fcn.00571d6c
mov edx, dword [esi]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
mov bl, 1
mov byte [esp + 0x7c], 0
call dword [edx + 0x24]
mov ebp, eax
test ebp, ebp
je 0x64d0da
test bl, bl
je 0x64d0c6
cmp dword [esp + 0x34], 1
jne 0x64d0a5
lea ecx, [esp + 0x38]
call fcn.00571d2c
push eax
call fcn.00611b5c
add esp, 4
cmp eax, 8
je 0x64d0b6
mov edx, dword [esi]
lea eax, [esp + 0x34]
push eax
push ebp
mov ecx, esi
call dword [edx + 0x28]
mov bl, al
jmp 0x64d083
lea ecx, [esp + 0x38]
push ecx
mov ecx, edi
mov bl, 1
call fcn.005723ac
jmp 0x64d0ca
mov bl, byte [esp + 0x74]
mov edx, dword [esi]
push ebp
mov ecx, esi
call dword [edx + 0x2c]
test bl, bl
jne 0x64d23c
lea eax, [esp + 0x10]
push 8
push eax
mov byte [esp + 0x50], 0x41
mov byte [esp + 0x51], 0x42
mov byte [esp + 0x52], 0x43
mov byte [esp + 0x53], 0x44
mov byte [esp + 0x54], 0x45
mov byte [esp + 0x55], 0x46
mov byte [esp + 0x56], 0x47
mov byte [esp + 0x57], 0x48
mov byte [esp + 0x58], 0x4a
mov byte [esp + 0x59], 0x4b
mov byte [esp + 0x5a], 0x4c
mov byte [esp + 0x5b], 0x4d
mov byte [esp + 0x5c], 0x4e
mov byte [esp + 0x5d], 0x50
mov byte [esp + 0x5e], 0x51
mov byte [esp + 0x5f], 0x52
mov byte [esp + 0x60], 0x53
mov byte [esp + 0x61], 0x54
mov byte [esp + 0x62], 0x55
mov byte [esp + 0x63], 0x56
mov byte [esp + 0x64], 0x57
mov byte [esp + 0x65], 0x58
mov byte [esp + 0x66], 0x59
mov byte [esp + 0x67], 0x5a
mov byte [esp + 0x68], 0x32
mov byte [esp + 0x69], 0x33
mov byte [esp + 0x6a], 0x34
mov byte [esp + 0x6b], 0x35
mov byte [esp + 0x6c], 0x36
mov byte [esp + 0x6d], 0x37
mov byte [esp + 0x6e], 0x38
mov byte [esp + 0x6f], 0x39
call fcn.0063308c
add esp, 8
test al, al
je 0x64d235
xor ecx, ecx
mov cl, byte [esp + 0x10]
xor eax, eax
mov al, byte [esp + 0x11]
mov byte [esp + 0x20], 0
and ecx, 0x1f
mov dl, byte [esp + ecx + 0x48]
and eax, 0x1f
mov cl, byte [esp + eax + 0x48]
mov byte [esp + 0x19], cl
mov byte [esp + 0x18], dl
xor ecx, ecx
mov cl, byte [esp + 0x13]
xor edx, edx
mov dl, byte [esp + 0x12]
and ecx, 0x1f
and edx, 0x1f
mov al, byte [esp + edx + 0x48]
mov dl, byte [esp + ecx + 0x48]
mov byte [esp + 0x1a], al
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov cl, al
movsx eax, ah
and eax, 0x1f
mov al, byte [esp + eax + 0x48]
mov byte [esp + 0x1d], al
mov ax, word [esp + 0x16]
and ecx, 0x1f
mov byte [esp + 0x1b], dl
mov dl, byte [esp + ecx + 0x48]
xor ecx, ecx
mov cl, al
movsx eax, ah
mov byte [esp + 0x1c], dl
and eax, 0x1f
mov al, byte [esp + eax + 0x48]
and ecx, 0x1f
mov dl, byte [esp + ecx + 0x48]
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
mov byte [esp + 0x22], dl
mov byte [esp + 0x23], al
call fcn.005723cc
mov edx, dword [esi]
push edi
mov ecx, esi
call dword [edx + 0x3c]
test al, al
jne 0x64d23c
mov ecx, edi
call fcn.00571e9c
lea ecx, [esp + 0x38]
call fcn.00571abc
lea ecx, [esp + 0x24]
call fcn.00571abc
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x58
ret