Function at 0x4514ea
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x2a8
push 0x48c9c0
call fcn.004011b4
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebx]
mov dword [ebp - 0x2b4], edi
mov esi, dword [ebp + 0x10]
cmp edi, esi
jbe 0x451d61
push eax
call fcn.004509f2
mov dword [ebp - 0x2b8], eax
test eax, eax
je 0x451d61
mov eax, 0x690077
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x29c], 0x6c006e
mov dword [ebp - 0x298], 0x67006f
mov dword [ebp - 0x294], 0x6e006f
mov dword [ebp - 0x290], 0x65002e
mov dword [ebp - 0x28c], 0x650078
and dword [ebp - 0x288], 0
mov dword [ebp - 0x21c], 0x620077
mov dword [ebp - 0x218], 0x6d0065
mov dword [ebp - 0x214], 0x57005c
mov dword [ebp - 0x210], 0x6e0069
mov dword [ebp - 0x20c], 0x67004d
mov dword [ebp - 0x208], 0x74006d
mov dword [ebp - 0x204], 0x2e0052
mov dword [ebp - 0x200], 0x6c0064
push 0x6c
pop edx
mov dword [ebp - 0x1fc], edx
mov dword [ebp - 0xb0], 0x710074
mov dword [ebp - 0xac], 0x650075
mov dword [ebp - 0xa8], 0x790072
mov dword [ebp - 0xa4], 0x64002e
mov ecx, 0x6c006c
mov dword [ebp - 0xa0], ecx
and dword [ebp - 0x9c], 0
mov dword [ebp - 0x260], 0x720070
mov dword [ebp - 0x25c], 0x66006f
mov dword [ebp - 0x258], 0x760073
mov dword [ebp - 0x254], 0x2e0063
mov dword [ebp - 0x250], 0x6c0064
mov dword [ebp - 0x24c], edx
mov dword [ebp - 0x27c], 0x650077
mov dword [ebp - 0x278], 0x740076
mov dword [ebp - 0x274], 0x700061
mov dword [ebp - 0x270], 0x2e0069
mov dword [ebp - 0x26c], 0x6c0064
mov dword [ebp - 0x268], edx
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], 0x68006e
mov dword [ebp - 0x90], 0x740074
mov dword [ebp - 0x8c], 0x2e0070
lea eax, [ecx - 8]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], edx
mov dword [ebp - 0xc8], 0x650069
mov dword [ebp - 0xc4], 0x720066
mov dword [ebp - 0xc0], 0x6d0061
mov dword [ebp - 0xbc], 0x2e0065
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], edx
mov dword [ebp - 0x12c], 0x6d0069
mov dword [ebp - 0x128], 0x670061
mov eax, 0x720065
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], 0x730065
mov dword [ebp - 0x11c], 0x64002e
mov dword [ebp - 0x118], ecx
and dword [ebp - 0x114], 0
lea edx, [eax - 1]
mov dword [ebp - 0x1f8], edx
mov ecx, 0x760069
mov dword [ebp - 0x1f4], ecx
mov dword [ebp - 0x1f0], eax
mov eax, 0x5c0073
mov dword [ebp - 0x1ec], eax
mov dword [ebp - 0x1e8], 0x75006c
mov dword [ebp - 0x1e4], 0x660061
mov dword [ebp - 0x1e0], 0x2e0073
mov dword [ebp - 0x1dc], 0x790073
mov dword [ebp - 0x1d8], 0x73
mov dword [ebp - 0x244], edx
mov dword [ebp - 0x240], ecx
mov dword [ebp - 0x23c], 0x720065
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], 0x6c0066
mov dword [ebp - 0x230], 0x6d0074
mov dword [ebp - 0x22c], 0x720067
mov dword [ebp - 0x228], 0x73002e
mov dword [ebp - 0x224], 0x730079
and dword [ebp - 0x220], 0
mov dword [ebp - 0x1b8], 0x640061
mov dword [ebp - 0x1b4], 0x730074
mov dword [ebp - 0x1b0], 0x680063
mov dword [ebp - 0x1ac], 0x6d0065
mov dword [ebp - 0x1a8], 0x2e0061
mov dword [ebp - 0x1a4], 0x6c0064
mov dword [ebp - 0x1a0], 0x6c
mov dword [ebp - 0x2c], 0x690063
mov dword [ebp - 0x28], 0x64002e
mov edx, 0x6c006c
mov dword [ebp - 0x24], edx
and dword [ebp - 0x20], 0
mov dword [ebp - 0x1d4], 0x630073
mov eax, 0x650068
mov dword [ebp - 0x1d0], eax
mov dword [ebp - 0x1cc], 0x730064
mov ecx, 0x630076
mov dword [ebp - 0x1c8], ecx
mov dword [ebp - 0x1c4], 0x64002e
mov dword [ebp - 0x1c0], edx
and dword [ebp - 0x1bc], 0
lea edx, [eax + 0xb]
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], 0x760072
mov dword [ebp - 0x140], 0x630069
mov dword [ebp - 0x13c], 0x730065
mov dword [ebp - 0x138], 0x65002e
mov dword [ebp - 0x134], 0x650078
and dword [ebp - 0x130], 0
mov dword [ebp - 0xe0], 0x750077
mov dword [ebp - 0xdc], 0x750061
mov dword [ebp - 0xd8], 0x6e0065
mov dword [ebp - 0xd4], 0x2e0067
mov dword [ebp - 0xd0], 0x6c0064
mov dword [ebp - 0xcc], 0x6c
mov dword [ebp - 0x80], 0x690077
mov dword [ebp - 0x7c], 0x73006e
mov dword [ebp - 0x78], 0x740061
mov dword [ebp - 0x74], 0x65002e
mov dword [ebp - 0x70], 0x650078
and dword [ebp - 0x6c], 0
mov dword [ebp - 0x40], 0x730070
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], 0x2e0064
mov dword [ebp - 0x34], 0x6c0064
mov dword [ebp - 0x30], 0x6c
mov dword [ebp - 0x68], 0x6d0071
mov dword [ebp - 0x64], 0x720067
mov dword [ebp - 0x60], 0x64002e
mov eax, 0x6c006c
mov dword [ebp - 0x5c], eax
and dword [ebp - 0x58], 0
mov dword [ebp - 0x110], 0x620074
mov dword [ebp - 0x10c], 0x730073
mov dword [ebp - 0x108], ecx
mov dword [ebp - 0x104], 0x64002e
mov dword [ebp - 0x100], eax
and dword [ebp - 0xfc], 0
mov dword [ebp - 0x54], 0x700067
mov dword [ebp - 0x50], 0x760073
mov dword [ebp - 0x4c], 0x2e0063
mov dword [ebp - 0x48], 0x6c0064
push 0x6c
pop ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0xf8], 0x690064
mov dword [ebp - 0xf4], 0x73006d
mov dword [ebp - 0xf0], 0x6f006a
mov dword [ebp - 0xec], 0x2e0062
mov dword [ebp - 0xe8], 0x6c0064
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x160], 0x750074
mov dword [ebp - 0x15c], 0x610070
mov dword [ebp - 0x158], 0x690070
mov dword [ebp - 0x154], 0x64002e
mov dword [ebp - 0x150], eax
xor edx, edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x180], 0x610072
mov dword [ebp - 0x17c], 0x610063
mov dword [ebp - 0x178], 0x650067
mov dword [ebp - 0x174], 0x74006e
mov ecx, 0x65002e
mov dword [ebp - 0x170], ecx
lea eax, [ecx + 0x4a]
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x19c], 0x70006c
mov dword [ebp - 0x198], 0x73006b
mov dword [ebp - 0x194], 0x740065
mov dword [ebp - 0x190], 0x700075
mov dword [ebp - 0x18c], ecx
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x184], edx
call fcn.00441d0a
mov dword [ebp - 0x2ac], eax
test eax, eax
je 0x451d61
push eax
call fcn.0047d80c
mov ecx, eax
mov dword [ebp - 0x2b0], ecx
and dword [ebp - 4], 0
mov dword [ebp - 0x2a4], esi
cmp esi, dword [ebx]
jae 0x451d4f
imul eax, esi, 0x210
add eax, 4
add eax, ebx
mov dword [ebp - 0x2a8], eax
push ecx
add eax, 0x10
push eax
push dword [ebp - 0x2ac]
call fcn.0047d8e4
test eax, eax
jne 0x451d3c
imul eax, esi, 0x108
mov ecx, dword [ebp - 0x2b0]
add ecx, eax
push 0x5c
pop eax
cmp ax, word [ebx + ecx*2 + 0x14]
jne 0x451d3c
mov eax, dword [ebp - 0x2b8]
dec eax
je 0x451b87
dec eax
je 0x451b78
dec eax
je 0x451b69
dec eax
jne 0x451d3c
lea eax, [ebx + 0x16]
lea eax, [eax + ecx*2]
push eax
lea eax, [ebp - 0x12c]
push eax
call fcn.0047d7a2
test eax, eax
jne 0x451d3c
dec dword [ebx]
lea eax, [edi - 1]
cmp esi, eax
je 0x451b5d
mov eax, edi
sub eax, esi
dec eax
imul eax, eax, 0x210
push eax
mov ecx, dword [ebp - 0x2a8]
lea eax, [ecx + 0x210]
push eax
push ecx
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
dec esi
mov dword [ebp - 0x2a4], esi
jmp 0x451d3c
lea eax, [ebx + 0x16]
lea eax, [eax + ecx*2]
push eax
lea eax, [ebp - 0xc8]
jmp 0x451b24
lea eax, [ebx + 0x16]
lea eax, [eax + ecx*2]
push eax
lea eax, [ebp - 0x98]
jmp 0x451b24
lea edi, [ebx + 0x16]
lea edi, [edi + ecx*2]
push edi
lea eax, [ebp - 0x2a0]
push eax
call fcn.0047d7a2
test eax, eax
je 0x451d2b
push edi
lea eax, [ebp - 0x21c]
push eax
call fcn.0047d7a2
test eax, eax
je 0x451d2b
push edi
lea eax, [ebp - 0xb0]
push eax
call fcn.0047d7a2
test eax, eax
je 0x451d2b
push edi
lea eax, [ebp - 0x260]
push eax
call fcn.0047d7a2
test eax, eax
je 0x451d2b
push edi
lea eax, [ebp - 0x27c]
push eax
call fcn.0047d7a2
test eax, eax
je 0x451d2b
push edi
lea eax, [ebp - 0x1f8]
push eax
call fcn.0047d7a2
test eax, eax
je 0x451d2b
push edi
lea eax, [ebp - 0x244]
push eax
call sub.ntoskrnl.exe__wcsicmp
pop ecx
pop ecx
test eax, eax
je 0x451d2b
push edi
lea eax, [ebp - 0x1b8]
push eax
call fcn.0047d7a2
test eax, eax
je 0x451d2b
push edi
lea eax, [ebp - 0x2c]
push eax
call fcn.0047d7a2
test eax, eax
je 0x451d2b
push edi
lea eax, [ebp - 0x1d4]
push eax
call fcn.0047d7a2
test eax, eax
je 0x451d2b
push edi
lea eax, [ebp - 0x148]
push eax
call fcn.0047d7a2
test eax, eax
je 0x451d2b
push edi
lea eax, [ebp - 0xe0]
push eax
call fcn.0047d7a2
test eax, eax
je 0x451d2b
push edi
lea eax, [ebp - 0x80]
push eax
call sub.ntoskrnl.exe__wcsicmp
pop ecx
pop ecx
test eax, eax
je 0x451d2b
push edi
lea eax, [ebp - 0x40]
push eax
call sub.ntoskrnl.exe__wcsicmp
pop ecx
pop ecx
test eax, eax
je 0x451d2b
push edi
lea eax, [ebp - 0x68]
push eax
call sub.ntoskrnl.exe__wcsicmp
pop ecx
pop ecx
test eax, eax
je 0x451d2b
push edi
lea eax, [ebp - 0x110]
push eax
call sub.ntoskrnl.exe__wcsicmp
pop ecx
pop ecx
test eax, eax
je 0x451d2b
push edi
lea eax, [ebp - 0x54]
push eax
call sub.ntoskrnl.exe__wcsicmp
pop ecx
pop ecx
test eax, eax
je 0x451d2b
push edi
lea eax, [ebp - 0xf8]
push eax
call sub.ntoskrnl.exe__wcsicmp
pop ecx
pop ecx
test eax, eax
je 0x451d2b
push edi
lea eax, [ebp - 0x164]
push eax
call sub.ntoskrnl.exe__wcsicmp
pop ecx
pop ecx
test eax, eax
je 0x451d2b
push edi
lea eax, [ebp - 0x180]
push eax
call sub.ntoskrnl.exe__wcsicmp
pop ecx
pop ecx
test eax, eax
je 0x451d2b
push edi
lea eax, [ebp - 0x19c]
push eax
call sub.ntoskrnl.exe__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x451d36
mov edi, dword [ebp - 0x2b4]
jmp 0x451b32
mov edi, dword [ebp - 0x2b4]
inc esi
mov ecx, dword [ebp - 0x2b0]
jmp 0x451aae
mov dword [ebp - 4], 0xfffffffe
push dword [ebp - 0x2ac]
call fcn.00478d8c
call fcn.004011fc
ret 0xc