Function at 0x401c60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x63fbf0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov bl, 0x74
mov dword [ebp - 0x10], 0x6c64746e
mov dword [ebp - 0xc], 0x6c642e6c
mov word [ebp - 8], 0x6c
mov dword [ebp - 0x24], 0x4972644c
mov dword [ebp - 0x20], 0x6974696e
mov dword [ebp - 0x1c], 0x7a696c61
mov dword [ebp - 0x18], 0x75685465
mov word [ebp - 0x14], 0x6b6e
mov byte [ebp - 0x12], 0
call fcn.00560f90
xor edx, edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov ecx, dword [ebp - 0x30]
xor eax, eax
lea edi, [edx + ecx]
mov byte [ebp - 0x26], al
mov byte [ebp - 0x28], al
mov byte [ebp - 0x27], al
mov esi, edi
mov cl, byte [esi]
cmp cl, 0x2e
je 0x401d10
cmp cl, 0x3e
je 0x401d10
cmp cl, 0x36
je 0x401d10
cmp cl, 0x26
je 0x401d10
cmp cl, 0x64
je 0x401d10
cmp cl, 0x65
je 0x401d10
cmp cl, 0xf0
je 0x401d10
cmp cl, 0xf2
je 0x401d10
cmp cl, 0xf3
je 0x401d10
cmp cl, 0x66
je 0x401d15
cmp cl, 0x67
jne 0x401d62
cmp cl, 0x66
jne 0x401d19
mov byte [ebp - 0x28], 1
cmp cl, 0x67
jne 0x401d22
mov byte [ebp - 0x27], 1
inc esi
lea ecx, [edi + 0x10]
cmp esi, ecx
jbe 0x401cd7
xor esi, esi
mov al, byte [eax]
cmp al, 0xe8
je 0x401e81
cmp al, 0xe9
je 0x401e81
add edx, esi
mov dword [ebp - 0x2c], edx
cmp edx, 0x1000
jb 0x401cc4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00544a28
mov esp, ebp
pop ebp
ret
mov bl, byte [esi]
mov dword [ebp - 0x34], esi
cmp bl, 0xf
jne 0x401d7c
movzx eax, byte [esi + 1]
mov cl, byte [eax + 0x644c38]
inc esi
mov byte [ebp - 0x25], cl
jmp 0x401d98
movzx ecx, bl
mov al, byte [ecx + 0x644b38]
lea ecx, [ebx + 0x60]
cmp cl, 3
mov byte [ebp - 0x25], al
mov cl, al
ja 0x401d98
mov al, byte [ebp - 0x27]
mov byte [ebp - 0x28], al
inc esi
test cl, 0x20
je 0x401d9f
inc esi
test cl, 1
je 0x401e4c
mov cl, byte [esi]
mov dl, cl
mov al, cl
shr dl, 3
shr al, 6
and dl, 7
and cl, 7
inc esi
cmp bl, 0xf6
jne 0x401dca
test dl, dl
jne 0x401dd7
or byte [ebp - 0x25], 2
jmp 0x401dd7
cmp bl, 0xf7
jne 0x401dd7
test dl, dl
jne 0x401dd7
or byte [ebp - 0x25], 0x10
cmp cl, 4
sete dl
cmp byte [ebp - 0x27], 0
sete bl
and dl, bl
movzx ebx, al
cmp ebx, 3
ja case.default.0x401dee
jmp dword [ebx*4 + 0x401e9c]
cmp byte [ebp - 0x27], 0
je 0x401e06
cmp cl, 6
jne case.default.0x401dee
mov byte [ebp - 0x26], 2
jmp case.default.0x401dee
cmp cl, 5
jne case.default.0x401dee
mov byte [ebp - 0x26], 4
jmp case.default.0x401dee
mov byte [ebp - 0x26], 1
jmp case.default.0x401dee
cmp byte [ebp - 0x27], 0
sete cl
lea ecx, [ecx + ecx + 2]
mov byte [ebp - 0x26], cl
test dl, dl
je case.0x401dee.3
mov cl, byte [esi]
and cl, 7
cmp cl, 5
jne 0x401e3f
test al, al
je 0x401e3b
cmp al, 2
jne 0x401e3f
mov byte [ebp - 0x26], 4
inc esi
movzx edx, byte [ebp - 0x26]
mov cl, byte [ebp - 0x25]
add esi, edx
mov edx, dword [ebp - 0x2c]
test cl, 2
je 0x401e52
inc esi
test cl, 4
je 0x401e5a
add esi, 2
test cl, 8
je 0x401e62
add esi, 4
cmp byte [ebp - 0x28], 0
sete al
lea eax, [eax + eax + 2]
test cl, 0x10
je 0x401e77
movzx eax, al
add esi, eax
mov eax, dword [ebp - 0x34]
sub esi, edi
jmp 0x401d2c
mov ecx, dword [edi + 1]
lea eax, [ecx + edi + 5]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00544a28
mov esp, ebp
pop ebp
ret