Function at 0x4e5980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5c976d
push eax
mov dword fs:[0], esp
sub esp, 0x38
test byte [0x691258], 1
push ebx
push esi
push edi
mov edi, ecx
jne 0x4e5c81
or dword [0x691258], 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xd]
push ecx
lea edx, [ebp - 0x44]
push edx
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0x4e3170
mov byte [ebp - 0xd], 0x61
call fcn.004e8e00
add esp, 0xc
mov esi, eax
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
mov byte [ebp - 4], 1
mov byte [ebp - 0x18], 0x62
mov dword [ebp - 0x14], 0x4e3190
call fcn.004e7570
lea ecx, [ebp - 0x18]
push ecx
mov ecx, esi
mov byte [ebp - 0x18], 0x63
mov dword [ebp - 0x14], 0x4e31a0
call fcn.004e7570
lea edx, [ebp - 0x18]
push edx
mov ecx, esi
mov byte [ebp - 0x18], 0x64
mov dword [ebp - 0x14], 0x4e31b0
call fcn.004e7570
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
mov byte [ebp - 0x18], 0x65
mov dword [ebp - 0x14], 0x4e31d0
call fcn.004e7570
lea ecx, [ebp - 0x18]
push ecx
mov ecx, esi
mov byte [ebp - 0x18], 0x66
mov dword [ebp - 0x14], 0x4e37b0
call fcn.004e7570
lea edx, [ebp - 0x18]
push edx
mov ecx, esi
mov byte [ebp - 0x18], 0x67
mov dword [ebp - 0x14], 0x4e4be0
call fcn.004e7570
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
mov byte [ebp - 0x18], 0x68
mov dword [ebp - 0x14], 0x4e95d0
call fcn.004e7570
lea ecx, [ebp - 0x18]
push ecx
mov ecx, esi
mov byte [ebp - 0x18], 0x48
mov dword [ebp - 0x14], 0x4e95e0
call fcn.004e7570
lea edx, [ebp - 0x18]
push edx
mov ecx, esi
mov byte [ebp - 0x18], 0x69
mov dword [ebp - 0x14], 0x4e3820
call fcn.004e7570
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
mov byte [ebp - 0x18], 0x6a
mov dword [ebp - 0x14], 0x4e5720
call fcn.004e7570
lea ecx, [ebp - 0x18]
push ecx
mov byte [ebp - 0x18], 0x6b
mov dword [ebp - 0x14], 0x4e31f0
mov ecx, esi
call fcn.004e7570
lea edx, [ebp - 0x18]
push edx
mov ecx, esi
mov byte [ebp - 0x18], 0x6c
mov dword [ebp - 0x14], 0x4e3210
call fcn.004e7570
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
mov byte [ebp - 0x18], 0x6d
mov dword [ebp - 0x14], 0x4e3880
call fcn.004e7570
lea ecx, [ebp - 0x18]
push ecx
mov ecx, esi
mov byte [ebp - 0x18], 0x6e
mov dword [ebp - 0x14], 0x4e41a0
call fcn.004e7570
lea edx, [ebp - 0x18]
push edx
mov ecx, esi
mov byte [ebp - 0x18], 0x6f
mov dword [ebp - 0x14], 0x4e38d0
call fcn.004e7570
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
mov byte [ebp - 0x18], 0x70
mov dword [ebp - 0x14], 0x4e3220
call fcn.004e7570
lea ecx, [ebp - 0x18]
push ecx
mov ecx, esi
mov byte [ebp - 0x18], 0x71
mov dword [ebp - 0x14], 0x4e3350
call fcn.004e7570
lea edx, [ebp - 0x18]
push edx
mov ecx, esi
mov byte [ebp - 0x18], 0x72
mov dword [ebp - 0x14], 0x4e4c10
call fcn.004e7570
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
mov byte [ebp - 0x18], 0x73
mov dword [ebp - 0x14], 0x4e3910
call fcn.004e7570
lea ecx, [ebp - 0x18]
push ecx
mov ecx, esi
mov byte [ebp - 0x18], 0x74
mov dword [ebp - 0x14], 0x4e39e0
call fcn.004e7570
lea edx, [ebp - 0x18]
push edx
mov ecx, esi
mov byte [ebp - 0x18], 0x76
mov dword [ebp - 0x14], 0x4e8970
call fcn.004e7570
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
mov byte [ebp - 0x18], 0x56
mov dword [ebp - 0x14], 0x4e8980
call fcn.004e7570
lea ecx, [ebp - 0x18]
push ecx
mov ecx, esi
mov byte [ebp - 0x18], 0x77
mov dword [ebp - 0x14], 0x4e3ad0
call fcn.004e7570
lea edx, [ebp - 0x18]
push edx
mov ecx, esi
mov byte [ebp - 0x18], 0x2b
mov dword [ebp - 0x14], 0x4e3240
call fcn.004e7570
mov byte [ebp - 0x18], 0x2d
mov dword [ebp - 0x14], 0x4e3250
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.004e7570
lea ecx, [ebp - 0x18]
push ecx
mov ecx, esi
mov byte [ebp - 0x18], 0x40
mov dword [ebp - 0x14], 0x4e5560
call fcn.004e7570
lea edx, [ebp - 0x2c]
push edx
mov ecx, esi
call fcn.004e8f00
lea eax, [ebp - 0x2c]
push eax
mov ecx, 0x691248
mov byte [ebp - 4], 2
call fcn.004e80a0
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
push eax
push ecx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.004e7360
mov edx, dword [ebp - 0x28]
push edx
call fcn.0052d217
add esp, 4
lea ecx, [ebp - 0x44]
call fcn.0043b3f0
mov eax, dword [ebp - 0x44]
push eax
call fcn.0052d217
push 0x607cc0
call fcn.0052e444
add esp, 8
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov dword [edi + 0x280], eax
mov dword [edi + 0x27c], eax
mov eax, dword [edi + 0x1c8]
cmp dword [edi + 0x23c], eax
jae 0x4e5d58
mov ecx, dword [edi + 0x1cc]
cmp ecx, 0x10
jb 0x4e5cb4
mov eax, dword [edi + 0x1b8]
jmp 0x4e5cba
lea eax, [edi + 0x1b8]
mov esi, dword [edi + 0x23c]
cmp byte [esi + eax], 0x40
jne 0x4e5d20
lea edx, [esi + 1]
cmp edx, dword [edi + 0x1c8]
jae 0x4e5d20
cmp ecx, 0x10
jb 0x4e5cde
mov eax, dword [edi + 0x1b8]
jmp 0x4e5ce4
lea eax, [edi + 0x1b8]
lea eax, [esi + eax + 1]
push eax
lea ecx, [ebp - 0x14]
push ecx
mov ecx, 0x691248
call fcn.004e7150
mov eax, dword [ebp - 0x14]
cmp eax, dword [0x69124c]
je 0x4e5d0f
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
test al, al
jne 0x4e5d58
jmp 0x4e5d3f
cmp dword [edi + 0x1cc], 0x10
jb 0x4e5d2d
mov eax, dword [edi + 0x1b8]
jmp 0x4e5d33
cmp ecx, 0x10
jb 0x4e5d2d
mov eax, dword [edi + 0x1b8]
jmp 0x4e5d33
lea eax, [edi + 0x1b8]
push 0
add esi, eax
push esi
mov ecx, edi
call fcn.004e47b0
add dword [edi + 0x23c], 2
mov eax, dword [edi + 0x1c8]
cmp dword [edi + 0x23c], eax
jb 0x4e5ca1
cmp dword [edi + 0x230], 0x20
je 0x4e5f53
xor ebx, ebx
cmp dword [edi + 4], ebx
je 0x4e5e48
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov eax, dword [edi + 0x298]
sub eax, dword [edi + 0x120]
mov ecx, dword [edi + 0x258]
add eax, dword [edi + 0x290]
push 1
lea edx, [eax + ecx + 0x10]
mov eax, dword [edi + 0x28c]
mov ecx, dword [edi + 0x250]
push edx
lea edx, [eax + ecx + 0x10]
push edx
lea eax, [ebp - 0x24]
mov ebx, 4
push eax
mov dword [ebp - 4], ebx
call fcn.0044b580
add esp, 0x10
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 5
call fcn.00498070
mov eax, dword [ebp - 0x20]
mov byte [ebp - 4], bl
test eax, eax
je 0x4e5dfd
mov ebx, eax
add eax, 4
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x4e5dfd
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x4e5dfd
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
fldz
mov ecx, dword [edi + 4]
mov eax, dword [ecx]
mov edx, dword [ebp - 0x18]
mov eax, dword [eax + 0x2c]
push pe_nt_image_headers32
push 0
sub esp, 8
fst dword [esp + 4]
fstp dword [esp]
push edx
call eax
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [edi + 4]
call fcn.00456f30
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x4e5ece
lea edx, [ebx + 4]
or eax, 0xffffffff
lock xadd dword [edx], eax
jmp 0x4e5eae
mov eax, dword [edi + 0x298]
sub eax, dword [edi + 0x120]
mov ecx, dword [edi + 0x258]
add eax, dword [edi + 0x290]
push 1
lea edx, [eax + ecx + 0x10]
mov eax, dword [edi + 0x28c]
mov ecx, dword [edi + 0x250]
push edx
lea edx, [eax + ecx + 0x10]
push edx
lea eax, [ebp - 0x24]
push eax
call fcn.0044b580
add esp, 0x10
push eax
lea ecx, [edi + 4]
mov dword [ebp - 4], 6
call fcn.00498070
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x4e5ece
mov ebx, eax
add eax, 4
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x4e5ece
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
or edx, 0xffffffff
lea ecx, [ebx + 8]
lock xadd dword [ecx], edx
jne 0x4e5ece
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov edx, dword [edi + 4]
sub esp, 0xc
mov dword [ebp - 0x14], esp
mov ecx, esp
sub esp, 8
mov eax, esp
mov dword [ebp - 0x14], esp
mov dword [eax], edx
mov esi, dword [edi + 8]
mov dword [eax + 4], esi
test esi, esi
je 0x4e5ef9
add esi, 4
mov eax, 1
lock xadd dword [esi], eax
movzx edx, byte [0x69125c]
push edx
push fcn.004e7090
push ecx
call fcn.004e7400
add esp, 0x14
lea eax, [edi + 0x1a4]
push eax
lea ecx, [ebp - 0x1c]
push ecx
call fcn.004e7c40
mov esi, dword [ebp - 0x14]
add esp, 0x14
test esi, esi
je 0x4e5f53
lea edx, [esi + 4]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x4e5f53
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x4e5f53
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
cmp byte [edi + 0x29d], 0
je 0x4e5f63
mov ecx, edi
call fcn.004e3ea0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret