Function at 0x494c80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x5c0290]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x18
push ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call edi
mov esi, eax
test esi, esi
je 0x494f55
push 1
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x18
push eax
push esi
call sub.IPHLPAPI.DLL_GetTcpTable
cmp eax, 0x7a
jne 0x494cf3
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 8]
push ebx
call esi
push eax
call edi
mov esi, eax
test esi, esi
je 0x494f55
push 1
lea eax, [ebp - 8]
push eax
push esi
call sub.IPHLPAPI.DLL_GetTcpTable
test eax, eax
jne 0x494f68
xor edi, edi
cmp dword [esi], ebx
jle 0x494f44
lea eax, [esi + 0x14]
mov dword [ebp - 0x10], eax
jmp 0x494d20
movzx eax, word [eax]
push eax
call dword [sym.imp.WSOCK32.dll_ntohs]
movzx eax, ax
mov ecx, 0x6bb
cmp ax, cx
jne 0x494eef
sub esp, 0xc
mov dword [ebp - 0xbc], 0x6b745864
mov ecx, esp
mov dword [ebp - 0xb8], 0x76315866
lea eax, [ebp - 0x12]
mov dword [ebp - 0xb4], 0x686c6765
mov dword [ebp - 0xb0], 0x4e415245
or ebx, 1
push dword [ebp - 0x10]
mov dword [ebp - 0xac], 0x464d5165
push eax
lea eax, [ebp - 0xbc]
mov dword [ebp - 0xa8], 0x78706a4c
mov dword [ebp - 0xa4], 0x46515364
mov dword [ebp - 0xa0], 0x36307a44
mov dword [ebp - 0x9c], 0x696f4249
mov dword [ebp - 0x98], 0x4d417763
mov dword [ebp - 0x94], 0x6a774742
mov dword [ebp - 0x90], 0x55303342
mov dword [ebp - 0x8c], 0x72384445
mov dword [ebp - 0x88], 0x31395142
mov dword [ebp - 0x84], 0x78703349
mov dword [ebp - 0x80], 0x306c6845
mov dword [ebp - 0x7c], 0x36526844
mov dword [ebp - 0x78], 0x4f345749
mov dword [ebp - 0x74], 0x65385247
mov dword [ebp - 0x70], 0x4e6b6946
mov dword [ebp - 0x6c], 0x31634341
mov dword [ebp - 0x68], 0x4e736a4f
mov dword [ebp - 0x64], 0x386c7841
mov dword [ebp - 0x60], 0x30414141
mov dword [ebp - 0x5c], 0x49776a41
mov dword [ebp - 0x58], 0x6b6b4261
mov dword [ebp - 0x54], 0x4e4d6e4b
mov dword [ebp - 0x50], 0x6c516a43
mov dword [ebp - 0x4c], 0x35304465
mov dword [ebp - 0x48], 0x76355446
mov dword [ebp - 0x44], 0x47494748
mov dword [ebp - 0x40], 0x756f3347
mov dword [ebp - 0x3c], 0x41387a4b
mov dword [ebp - 0x38], 0x30354261
mov dword [ebp - 0x34], 0x746f4446
mov dword [ebp - 0x30], 0x7939674c
mov dword [ebp - 0x2c], 0x764d5243
mov dword [ebp - 0x28], 0x77596946
mov dword [ebp - 0x24], 0x62597743
mov dword [ebp - 0x20], 0x4a774263
mov dword [ebp - 0x1c], 0x66597a45
mov dword [ebp - 0x18], 0x41414141
mov word [ebp - 0x14], 0x4164
push eax
push 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
call fcn.004660a0
lea eax, [ebp - 0xc8]
push eax
call fcn.0047fb90
add esp, 0x10
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
je 0x494f8c
lea eax, [ebp - 0x148]
mov byte [ebp - 9], 1
cmp eax, ecx
jne 0x494ef3
mov byte [ebp - 9], 0
test bl, 1
je 0x494f2c
mov eax, dword [ebp - 0xc8]
and ebx, 0xfffffffe
test eax, eax
je 0x494f2c
push eax
call fcn.0053c1e0
add esp, 4
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xc0], 0
cmp byte [ebp - 9], 0
jne 0x494f79
mov eax, dword [ebp - 0x10]
inc edi
add eax, 0x14
mov dword [ebp - 0x10], eax
cmp edi, dword [esi]
jl 0x494d20
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
call eax
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053d3a0
mov esp, ebp
pop ebp
ret
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
call eax
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053d3a0
mov esp, ebp
pop ebp
ret
push str.invalid_vector_T__subscript
call fcn.0053af06
int3