Function at 0x42ec61
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
mov edx, 0xb
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x42ec68
call fcn.0045e790
push dword [esp + 0x38]
call fcn.0044e2f0
mov ebp, dword [0x47356c]
cmp dword [ebp + 0x34], 0
je 0x42ecb1
mov edx, 0x46105e
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x42ef91
mov ebp, dword [0x47356c]
mov ebx, dword [ebp + 0x20]
cmp ebx, 0xbb8
jge 0x42ece4
mov edx, 0x46105e
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x42ef91
mov dword [esp], 0x41435049
mov dword [esp + 4], 0x43494c53
mov dword [esp + 8], 0x4d44534d
mov eax, 0x469122
push eax
call sub.kernel32.dll_GetModuleHandleW
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], 0x176
mov ebp, str.GetSystemFirmwareTable
push ebp
push dword [esp + 0x14]
call sub.kernel32.dll_GetProcAddress
mov dword [esp + 0x18], eax
mov ebp, 0x46e34c
push ebp
push dword [esp + 0x14]
call sub.kernel32.dll_GetProcAddress
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x18], 0
je 0x42ed4d
cmp dword [esp + 0x1c], 0
je 0x42ed4d
mov eax, 1
jmp 0x42ed4f
xor eax, eax
and eax, eax
je 0x42ef87
push dword [esp + 0x20]
call fcn.0045ac20
mov dword [esp + 0x24], eax
push 0x200
call fcn.0045ac20
mov dword [esp + 0x28], eax
push 0x200
push dword [esp + 0x2c]
push dword [esp + 8]
call dword [esp + 0x28]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x18
push 0x200
push dword [esp + 0x38]
call fcn.0045ac80
lea eax, [esp + 0x18]
push eax
call fcn.0045e660
mov eax, 0x469178
push eax
push dword [esp + 0x18]
call fcn.0044f710
and eax, eax
je 0x42eee0
push dword [esp + 0x20]
push dword [esp + 0x28]
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [esp + 0x28]
and eax, eax
je 0x42eee0
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
mov eax, 0x461704
push eax
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x18
push 0xe
mov ebx, dword [esp + 0x40]
add ebx, 0xa
push ebx
call fcn.0045ac80
call fcn.0044e2d2
add dword [esp], edx
call fcn.0044f770
mov edx, 0x46da64
push edx
call fcn.0045e6f0
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
mov ebp, dword [esp + 0x30]
push ebp
pop ebp
movsx eax, word [ebp + 0xe4]
cdq
push edx
push eax
call fcn.0044f300
pop eax
mov edx, 0x461aa8
push edx
call fcn.0045e6f0
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
mov ebp, dword [esp + 0x30]
push ebp
pop ebp
movsx eax, word [ebp + 0xe2]
cdq
push edx
push eax
call fcn.0044f300
pop eax
lea eax, [esp + 0x10]
push eax
call fcn.0045e660
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
mov eax, 0x461704
push eax
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
mov eax, 0x461704
push eax
push dword [esp + 0x24]
call fcn.0044f770
call fcn.0044e2d2
add dword [esp], edx
call fcn.0044fff0
call fcn.0044e2f0
mov eax, str.MSDM
push eax
push dword [esp + 0x18]
call fcn.0044f710
and eax, eax
je 0x42ef57
push dword [esp + 0x20]
push dword [esp + 0x28]
push dword [esp + 0x10]
push dword [esp + 0xc]
call dword [esp + 0x28]
mov ebx, eax
cmp ebx, dword [esp + 0x20]
jg 0x42ef57
push dword [esp + 0xc]
mov edx, 0x46105e
pop ecx
call fcn.0044e300
je 0x42ef30
mov edx, str.OA_3
lea ecx, [esp + 0xc]
call fcn.0044e008
jmp 0x42ef57
mov edx, dword [esp + 0xc]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.___OA_3
push edx
call fcn.0045e6f0
lea eax, [esp + 0x10]
push eax
call fcn.0045e660
push dword [esp + 0x24]
call fcn.0045ac40
push dword [esp + 0x28]
call fcn.0045ac40
mov edx, dword [esp + 0xc]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
pop eax
push eax
call fcn.0044e2c0
pop edx
add eax, edx
jmp 0x42ef91
call fcn.0045e820
mov word [eax], 0
push dword [esp + 0xc]
call fcn.0045e7f0
push dword [esp + 0x14]
call fcn.0045e7f0
add esp, 0x2c
pop ebx
pop ebp
ret