Function at 0x428865
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x1ac
mov eax, 0x5957c1
call fcn.005607ac
xor ebx, ebx
push 0x1000
mov byte [ebp - 0x1a0], bl
call fcn.0042a90b
pop ecx
push 0xc
lea ecx, [ebp - 0x190]
mov dword [ebp - 0x19c], eax
call fcn.0042a761
lea ecx, [ebp - 0x190]
call fcn.00429c3f
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 4], ebx
push eax
mov word [ebp - 0x1f], 0x7265
mov byte [ebp - 0x20], 0x4b
mov word [ebp - 0x18], 0x642e
mov word [ebp - 0x15], 0x6c
mov dword [ebp - 0x1c], 0x32336c65
mov byte [ebp - 0x1d], 0x6e
mov byte [ebp - 0x16], 0x6c
mov dword [ebp - 0x30], 0x736f6c43
mov dword [ebp - 0x28], 0x656c64
mov dword [ebp - 0x2c], 0x6e614865
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [ebp - 0x1b4], eax
test eax, eax
jne 0x428917
lea ecx, [ebp - 0x190]
call fcn.00429c87
xor al, al
jmp 0x428bae
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
call esi
push eax
call edi
mov dword [ebp - 0x1a4], eax
test eax, eax
je 0x428905
lea eax, [ebp - 0x80]
mov dword [ebp - 0x7d], 0x642e6970
push eax
mov word [ebp - 0x80], 0x7350
mov byte [ebp - 0x7e], 0x61
mov word [ebp - 0x78], 0x6c
mov byte [ebp - 0x79], 0x6c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
mov dword [ebp - 0x1ac], esi
test esi, esi
je 0x428905
lea eax, [ebp - 0x48]
mov dword [ebp - 0x47], 0x506d756e
push eax
push esi
mov word [ebp - 0x3a], 0x6c75
mov dword [ebp - 0x40], 0x4d737365
mov word [ebp - 0x37], 0x73
mov byte [ebp - 0x48], 0x45
mov word [ebp - 0x3c], 0x646f
mov word [ebp - 0x43], 0x6f72
mov byte [ebp - 0x41], 0x63
mov byte [ebp - 0x38], 0x65
call edi
mov dword [ebp - 0x198], eax
test eax, eax
jne 0x4289ae
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x428905
lea eax, [ebp - 0x70]
mov dword [ebp - 0x68], 0x6c6c64
push eax
mov word [ebp - 0x6b], 0x6970
mov dword [ebp - 0x70], 0x776c6853
mov byte [ebp - 0x6c], 0x61
mov byte [ebp - 0x69], 0x2e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x1b8], eax
test eax, eax
je 0x428905
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x54], 0x656d614e
push ecx
push eax
mov dword [ebp - 0x59], 0x6c694664
mov word [ebp - 0x50], 0x41
mov dword [ebp - 0x5e], 0x69466874
mov word [ebp - 0x60], 0x6150
mov byte [ebp - 0x5a], 0x6e
mov byte [ebp - 0x55], 0x65
call edi
mov dword [ebp - 0x1a8], eax
test eax, eax
je 0x428b90
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x194]
mov dword [ebp - 0x1b0], eax
push ecx
push 0x1000
push dword [ebp - 0x19c]
push eax
call dword [ebp - 0x198]
test eax, eax
je 0x428b72
test dword [ebp - 0x194], 0xfffffffc
mov edi, ebx
jbe 0x428b72
push 0x104
lea eax, [ebp - 0x184]
push eax
mov eax, dword [ebp - 0x19c]
push dword [eax + edi*4]
call dword [ebp - 0x1a4]
test eax, eax
je 0x428b5a
lea eax, [ebp - 0x184]
push eax
call dword [ebp - 0x1a8]
push ebx
lea ecx, [ebp - 0x190]
mov esi, eax
call fcn.00429ddb
push eax
push esi
call fcn.00429a26
mov ebx, dword [ebp - 0x1a0]
test eax, eax
pop ecx
pop ecx
push 1
pop eax
movzx ebx, bl
lea ecx, [ebp - 0x190]
push eax
cmove ebx, eax
call fcn.00429ddb
push eax
push esi
call fcn.00429a26
xor edx, edx
pop ecx
pop ecx
inc edx
movzx ecx, bl
test eax, eax
push 2
cmovne edx, ecx
lea ecx, [ebp - 0x190]
mov dword [ebp - 0x198], edx
call fcn.00429ddb
push eax
push esi
call fcn.00429a26
pop ecx
pop ecx
mov ecx, dword [ebp - 0x198]
test eax, eax
push 1
pop eax
movzx ebx, cl
lea ecx, [ebp - 0x190]
push 3
cmove ebx, eax
call fcn.00429ddb
push eax
push esi
call fcn.00429a26
xor edx, edx
pop ecx
pop ecx
inc edx
movzx ecx, bl
test eax, eax
push 4
cmovne edx, ecx
lea ecx, [ebp - 0x190]
mov dword [ebp - 0x198], edx
call fcn.00429ddb
push eax
push esi
call fcn.00429a26
pop ecx
pop ecx
mov ecx, dword [ebp - 0x198]
test eax, eax
push 1
movzx ecx, cl
pop eax
cmove ecx, eax
xor ebx, ebx
mov dword [ebp - 0x1a0], ecx
mov eax, dword [ebp - 0x194]
inc edi
shr eax, 2
cmp edi, eax
jb 0x428a5f
mov esi, dword [ebp - 0x1ac]
push dword [ebp - 0x1b0]
call dword [ebp - 0x1b4]
push dword [ebp - 0x19c]
call fcn.0042a906
mov ebx, dword [ebp - 0x1a0]
pop ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
push dword [ebp - 0x1b8]
call esi
lea ecx, [ebp - 0x190]
call fcn.00429c87
mov al, bl
call fcn.00560756
ret