Function at 0x558c10
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x71e52a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x218
push ebx
push esi
push edi
push 0
mov esi, ecx
push 0x20
mov dword [esp + 0x14], esi
call fcn.00555c90
test eax, eax
je 0x559991
lea ecx, [esp + 0x30]
call fcn.005b3190
lea ecx, [esp + 0x10]
mov dword [esp + 0x22c], 0
call fcn.005b3190
lea ecx, [esp + 0x28]
mov byte [esp + 0x22c], 1
call fcn.005b3190
lea ecx, [esp + 0x1c]
mov byte [esp + 0x22c], 2
call fcn.005b3190
lea ecx, [esp + 0x218]
mov byte [esp + 0x22c], 3
call fcn.005b3190
lea ecx, [esp + 0x60]
mov byte [esp + 0x22c], 4
call fcn.005b3190
mov eax, dword [esi + 0x24c]
xor ecx, ecx
test eax, eax
mov bl, 5
mov byte [esp + 0x22c], bl
mov dword [esp + 0x40], ecx
jle 0x559925
mov edi, dword [ebp + 8]
xor edx, edx
mov dword [esp + 0x3c], edx
test edx, edx
jl case.default.0x558d62
cmp ecx, eax
jge case.default.0x558d62
mov esi, dword [esi + 0x254]
add esi, edx
test esi, esi
je case.default.0x558d62
mov cl, byte [esi + 0x11]
cmp cl, 0xff
je 0x558d14
mov eax, 1
shl eax, cl
mov ecx, dword [esp + 0xc]
test dword [ecx + 0x294], eax
je case.default.0x558d62
mov cx, word [esi]
cmp cx, 0x20
jne case.default.0x558d62
mov ax, word [esi + 2]
lea edx, [esp + 0x1c]
push edx
lea edx, [esp + 0x2c]
push edx
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x3c]
push edx
push 0xff
push 0xffff
push eax
push ecx
mov ecx, dword [esp + 0x2c]
call fcn.00554e00
movzx eax, word [esi + 2]
cmp eax, 0xa
ja case.default.0x558d62
movzx eax, byte [eax + 0x5599b8]
jmp dword [eax*4 + 0x5599a8]
push 0x73d5d8
lea ecx, [esp + 0x7c]
call fcn.005e5a90
push 0x748ed0
lea ecx, [esp + 0xcc]
mov byte [esp + 0x230], 6
call fcn.005e5a90
mov ecx, dword [0x7a39fc]
mov ecx, dword [ecx + 4]
push 0x96b7
lea edx, [esp + 0x114]
push edx
mov byte [esp + 0x234], 7
call fcn.005edeb0
push eax
lea eax, [esp + 0x194]
push eax
mov ecx, edi
mov byte [esp + 0x234], 8
call fcn.005e5d10
lea ecx, [esp + 0xc8]
push ecx
lea edx, [esp + 0xec]
push edx
mov ecx, eax
mov byte [esp + 0x234], 9
call fcn.005e5d10
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1d4]
push edx
mov ecx, eax
mov byte [esp + 0x234], 0xa
call fcn.005e5d10
lea ecx, [esp + 0x78]
push ecx
lea edx, [esp + 0x104]
push edx
mov ecx, eax
mov byte [esp + 0x234], 0xb
call fcn.005e5d10
push eax
mov ecx, edi
mov byte [esp + 0x230], 0xc
call fcn.005e5c50
lea ecx, [esp + 0x100]
mov byte [esp + 0x22c], 0xb
call fcn.005e5c20
lea ecx, [esp + 0x1d0]
mov byte [esp + 0x22c], 0xa
call fcn.005e5c20
lea ecx, [esp + 0xe8]
mov byte [esp + 0x22c], 9
call fcn.005e5c20
lea ecx, [esp + 0x190]
mov byte [esp + 0x22c], 8
call fcn.005e5c20
lea ecx, [esp + 0x110]
mov byte [esp + 0x22c], 7
call fcn.005e5c20
lea ecx, [esp + 0xc8]
mov byte [esp + 0x22c], 6
call fcn.005e5c20
lea ecx, [esp + 0x78]
mov byte [esp + 0x22c], bl
call fcn.005e5c20
mov al, byte [esi + 9]
mov si, word [esi + 6]
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x3c]
mov byte [esp + 0x54], al
push edx
lea eax, [esp + 0x5c]
mov ecx, dword [esp + 0x58]
push eax
push ecx
mov ecx, dword [esp + 0x1c]
push esi
call fcn.005554d0
mov eax, dword [esp + 0x38]
mov edx, dword [0x7a39fc]
mov ecx, dword [edx + 4]
lea esi, [eax + eax*2]
push 0xbfef
lea eax, [esp + 0x1a4]
push eax
mov dword [esp + 0x40], esi
call fcn.005edeb0
mov dword [esp + 0x58], eax
mov ecx, dword [0x7a39fc]
mov ecx, dword [ecx + 4]
push 0xbb06
lea edx, [esp + 0x124]
push edx
mov byte [esp + 0x234], 0xd
call fcn.005edeb0
mov dword [esp + 0x5c], eax
mov eax, dword [0x7a39fc]
mov ecx, dword [eax + 4]
push 0x96ae
lea edx, [esp + 0x214]
push edx
mov byte [esp + 0x234], 0xe
call fcn.005edeb0
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x58]
push eax
mov byte [esp + 0x230], 0xf
call fcn.005e5670
mov ecx, dword [esp + 0x60]
push eax
call fcn.005e5670
mov ecx, dword [esp + 0x20]
push eax
push esi
call fcn.005e5670
mov ecx, dword [esp + 0x64]
push eax
push ecx
lea edx, [esp + 0x78]
push str._d____s___d__s___s__d_n
push edx
call fcn.005e5680
add esp, 0x20
lea ecx, [esp + 0x210]
mov byte [esp + 0x22c], 0xe
call fcn.005e5c20
lea ecx, [esp + 0x120]
mov byte [esp + 0x22c], 0xd
call fcn.005e5c20
lea ecx, [esp + 0x1a0]
mov byte [esp + 0x22c], bl
call fcn.005e5c20
push 0x73d5cc
lea ecx, [esp + 0x6c]
call fcn.005e5a90
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x1e4]
push ecx
mov ecx, edi
mov byte [esp + 0x234], 0x10
call fcn.005e5d10
lea edx, [esp + 0x68]
push edx
lea ecx, [esp + 0x134]
mov byte [esp + 0x230], 0x11
push ecx
mov ecx, eax
call fcn.005e5d10
push eax
mov ecx, edi
mov byte [esp + 0x230], 0x12
call fcn.005e5c50
lea ecx, [esp + 0x130]
mov byte [esp + 0x22c], 0x11
call fcn.005e5c20
lea ecx, [esp + 0x1e0]
mov byte [esp + 0x22c], 0x10
call fcn.005e5c20
lea ecx, [esp + 0x68]
jmp 0x5598f3
push 0x73d5d8
lea ecx, [esp + 0xbc]
call fcn.005e5a90
push 0x748ed0
lea ecx, [esp + 0x8c]
mov byte [esp + 0x230], 0x13
call fcn.005e5a90
mov edx, dword [0x7a39fc]
mov ecx, dword [edx + 4]
push 0x96b7
lea eax, [esp + 0x164]
push eax
mov byte [esp + 0x234], 0x14
call fcn.005edeb0
push eax
lea ecx, [esp + 0x204]
push ecx
mov ecx, edi
mov byte [esp + 0x234], 0x15
call fcn.005e5d10
lea edx, [esp + 0x88]
push edx
lea ecx, [esp + 0x154]
push ecx
mov ecx, eax
mov byte [esp + 0x234], 0x16
call fcn.005e5d10
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x1b4]
push ecx
mov ecx, eax
mov byte [esp + 0x234], 0x17
call fcn.005e5d10
lea edx, [esp + 0xb8]
push edx
lea ecx, [esp + 0x144]
push ecx
mov ecx, eax
mov byte [esp + 0x234], 0x18
call fcn.005e5d10
push eax
mov ecx, edi
mov byte [esp + 0x230], 0x19
call fcn.005e5c50
lea ecx, [esp + 0x140]
mov byte [esp + 0x22c], 0x18
call fcn.005e5c20
lea ecx, [esp + 0x1b0]
mov byte [esp + 0x22c], 0x17
call fcn.005e5c20
lea ecx, [esp + 0x150]
mov byte [esp + 0x22c], 0x16
call fcn.005e5c20
lea ecx, [esp + 0x200]
mov byte [esp + 0x22c], 0x15
call fcn.005e5c20
lea ecx, [esp + 0x160]
mov byte [esp + 0x22c], 0x14
call fcn.005e5c20
lea ecx, [esp + 0x88]
mov byte [esp + 0x22c], 0x13
call fcn.005e5c20
lea ecx, [esp + 0xb8]
mov byte [esp + 0x22c], bl
call fcn.005e5c20
mov dl, byte [esi + 9]
mov ax, word [esi + 6]
mov cx, word [esi + 2]
mov si, word [esi]
mov byte [esp + 0x48], dl
lea edx, [esp + 0x1c]
push edx
lea edx, [esp + 0x2c]
push edx
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x3c]
push edx
mov edx, dword [esp + 0x58]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x28]
push esi
call fcn.00554e00
push 0x748dd0
lea ecx, [esp + 0xdc]
call fcn.005e5a90
push 0x73d5d8
lea ecx, [esp + 0x9c]
mov byte [esp + 0x230], 0x1a
call fcn.005e5a90
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x184]
push ecx
mov ecx, edi
mov byte [esp + 0x234], 0x1b
call fcn.005e5d10
lea edx, [esp + 0x98]
push edx
lea ecx, [esp + 0x1f4]
push ecx
mov ecx, eax
mov byte [esp + 0x234], 0x1c
call fcn.005e5d10
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x174]
push ecx
mov ecx, eax
mov byte [esp + 0x234], 0x1d
call fcn.005e5d10
lea edx, [esp + 0xd8]
push edx
lea ecx, [esp + 0x1c4]
push ecx
mov ecx, eax
mov byte [esp + 0x234], 0x1e
call fcn.005e5d10
push eax
mov ecx, edi
mov byte [esp + 0x230], 0x1f
call fcn.005e5c50
lea ecx, [esp + 0x1c0]
mov byte [esp + 0x22c], 0x1e
call fcn.005e5c20
lea ecx, [esp + 0x170]
mov byte [esp + 0x22c], 0x1d
call fcn.005e5c20
lea ecx, [esp + 0x1f0]
mov byte [esp + 0x22c], 0x1c
call fcn.005e5c20
lea ecx, [esp + 0x180]
mov byte [esp + 0x22c], 0x1b
call fcn.005e5c20
lea ecx, [esp + 0x98]
mov byte [esp + 0x22c], 0x1a
call fcn.005e5c20
lea ecx, [esp + 0xd8]
jmp 0x5598f3
push 0x748ed0
lea ecx, [esp + 0xac]
call fcn.005e5a90
mov edx, dword [0x7a39fc]
mov ecx, dword [edx + 4]
push 0x96b7
lea eax, [esp + 0x10c]
push eax
mov byte [esp + 0x234], 0x20
call fcn.005edeb0
push eax
lea ecx, [esp + 0xfc]
push ecx
mov ecx, edi
mov byte [esp + 0x234], 0x21
call fcn.005e5d10
lea edx, [esp + 0xa8]
push edx
lea ecx, [esp + 0xf4]
push ecx
mov ecx, eax
mov byte [esp + 0x234], 0x22
call fcn.005e5d10
push eax
mov ecx, edi
mov byte [esp + 0x230], 0x23
call fcn.005e5c50
lea ecx, [esp + 0xf0]
mov byte [esp + 0x22c], 0x22
call fcn.005e5c20
lea ecx, [esp + 0xf8]
mov byte [esp + 0x22c], 0x21
call fcn.005e5c20
lea ecx, [esp + 0x108]
mov byte [esp + 0x22c], 0x20
call fcn.005e5c20
lea ecx, [esp + 0xa8]
mov byte [esp + 0x22c], bl
call fcn.005e5c20
mov dl, byte [esi + 9]
mov ax, word [esi + 6]
mov cx, word [esi + 2]
mov byte [esp + 0x4c], dl
lea edx, [esp + 0x1c]
push edx
lea edx, [esp + 0x2c]
push edx
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x3c]
push edx
mov edx, dword [esp + 0x5c]
push edx
push eax
xor eax, eax
mov ax, word [esi]
push ecx
mov ecx, dword [esp + 0x28]
push eax
call fcn.00554e00
push str.DC_SAVE
lea ecx, [esp + 0x74]
call fcn.005e5a90
mov al, byte [esi + 9]
mov ecx, dword [0x7a3a28]
mov ecx, dword [ecx + 0xb8]
mov ecx, dword [ecx + 0x90]
lea edx, [esp + 0x24]
push edx
lea edx, [esp + 0x74]
movzx eax, al
push edx
push eax
mov byte [esp + 0x238], 0x24
call fcn.00413660
mov byte [esp + 0x22c], bl
lea ecx, [esp + 0x70]
call fcn.005e5c20
push 0x748dd0
lea ecx, [esp + 0xa4]
call fcn.005e5a90
push 0x73d5d8
lea ecx, [esp + 0x94]
mov byte [esp + 0x230], 0x25
call fcn.005e5a90
push 0x73d5d8
lea ecx, [esp + 0x84]
mov byte [esp + 0x230], 0x26
call fcn.005e5a90
mov ecx, dword [esp + 0x24]
push ecx
lea ecx, [esp + 0x18c]
mov byte [esp + 0x230], 0x27
call fcn.005e5bc0
mov esi, eax
mov edx, dword [0x7a39fc]
mov ecx, dword [edx + 4]
push 0xbfef
lea eax, [esp + 0x17c]
push eax
mov byte [esp + 0x234], 0x28
call fcn.005edeb0
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x16c]
push edx
mov ecx, edi
mov byte [esp + 0x234], 0x29
call fcn.005e5d10
lea ecx, [esp + 0x80]
push ecx
lea edx, [esp + 0x15c]
push edx
mov ecx, eax
mov byte [esp + 0x234], 0x2a
call fcn.005e5d10
mov ecx, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x14c]
push edx
mov ecx, eax
mov byte [esp + 0x234], 0x2b
call fcn.005e5d10
lea ecx, [esp + 0x90]
push ecx
lea edx, [esp + 0x13c]
push edx
mov ecx, eax
mov byte [esp + 0x234], 0x2c
call fcn.005e5d10
push esi
lea ecx, [esp + 0x12c]
push ecx
mov ecx, eax
mov byte [esp + 0x234], 0x2d
call fcn.005e5d10
lea edx, [esp + 0xa0]
push edx
lea ecx, [esp + 0x11c]
push ecx
mov ecx, eax
mov byte [esp + 0x234], 0x2e
call fcn.005e5d10
mov byte [esp + 0x22c], 0x2f
push eax
mov ecx, edi
call fcn.005e5c50
lea ecx, [esp + 0x118]
mov byte [esp + 0x22c], 0x2e
call fcn.005e5c20
lea ecx, [esp + 0x128]
mov byte [esp + 0x22c], 0x2d
call fcn.005e5c20
lea ecx, [esp + 0x138]
mov byte [esp + 0x22c], 0x2c
call fcn.005e5c20
lea ecx, [esp + 0x148]
mov byte [esp + 0x22c], 0x2b
call fcn.005e5c20
lea ecx, [esp + 0x158]
mov byte [esp + 0x22c], 0x2a
call fcn.005e5c20
lea ecx, [esp + 0x168]
mov byte [esp + 0x22c], 0x29
call fcn.005e5c20
lea ecx, [esp + 0x178]
mov byte [esp + 0x22c], 0x28
call fcn.005e5c20
lea ecx, [esp + 0x188]
mov byte [esp + 0x22c], 0x27
call fcn.005e5c20
lea ecx, [esp + 0x80]
mov byte [esp + 0x22c], 0x26
call fcn.005e5c20
lea ecx, [esp + 0x90]
mov byte [esp + 0x22c], 0x25
call fcn.005e5c20
lea ecx, [esp + 0xa0]
jmp 0x5598f3
push 0x73d5d8
lea ecx, [esp + 0xc4]
call fcn.005e5a90
push 0x748ed0
lea ecx, [esp + 0xb4]
mov byte [esp + 0x230], 0x30
call fcn.005e5a90
mov edx, dword [0x7a39fc]
mov ecx, dword [edx + 4]
push 0x96b7
lea eax, [esp + 0x1dc]
push eax
mov byte [esp + 0x234], 0x31
call fcn.005edeb0
push eax
lea ecx, [esp + 0x1cc]
push ecx
mov ecx, edi
mov byte [esp + 0x234], 0x32
call fcn.005e5d10
lea edx, [esp + 0xb0]
push edx
lea ecx, [esp + 0x1bc]
push ecx
mov ecx, eax
mov byte [esp + 0x234], 0x33
call fcn.005e5d10
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x1ac]
push ecx
mov ecx, eax
mov byte [esp + 0x234], 0x34
call fcn.005e5d10
lea edx, [esp + 0xc0]
push edx
lea ecx, [esp + 0x19c]
push ecx
mov ecx, eax
mov byte [esp + 0x234], 0x35
call fcn.005e5d10
push eax
mov ecx, edi
mov byte [esp + 0x230], 0x36
call fcn.005e5c50
lea ecx, [esp + 0x198]
mov byte [esp + 0x22c], 0x35
call fcn.005e5c20
lea ecx, [esp + 0x1a8]
mov byte [esp + 0x22c], 0x34
call fcn.005e5c20
lea ecx, [esp + 0x1b8]
mov byte [esp + 0x22c], 0x33
call fcn.005e5c20
lea ecx, [esp + 0x1c8]
mov byte [esp + 0x22c], 0x32
call fcn.005e5c20
lea ecx, [esp + 0x1d8]
mov byte [esp + 0x22c], 0x31
call fcn.005e5c20
lea ecx, [esp + 0xb0]
mov byte [esp + 0x22c], 0x30
call fcn.005e5c20
lea ecx, [esp + 0xc0]
mov byte [esp + 0x22c], bl
call fcn.005e5c20
mov dl, byte [esi + 9]
mov ax, word [esi + 6]
mov cx, word [esi + 2]
mov si, word [esi]
mov byte [esp + 0x44], dl
lea edx, [esp + 0x1c]
push edx
lea edx, [esp + 0x2c]
push edx
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x3c]
push edx
mov edx, dword [esp + 0x54]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x28]
push esi
call fcn.00554e00
push 0x748dd0
lea ecx, [esp + 0xe4]
call fcn.005e5a90
push 0x748dd4
lea ecx, [esp + 0xd4]
mov byte [esp + 0x230], 0x37
call fcn.005e5a90
lea eax, [esp + 0xd0]
push eax
lea ecx, [esp + 0x20c]
push ecx
mov ecx, edi
mov byte [esp + 0x234], 0x38
call fcn.005e5d10
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x1fc]
push ecx
mov ecx, eax
mov byte [esp + 0x234], 0x39
call fcn.005e5d10
lea edx, [esp + 0xe0]
push edx
lea ecx, [esp + 0x1ec]
push ecx
mov ecx, eax
mov byte [esp + 0x234], 0x3a
call fcn.005e5d10
push eax
mov ecx, edi
mov byte [esp + 0x230], 0x3b
call fcn.005e5c50
lea ecx, [esp + 0x1e8]
mov byte [esp + 0x22c], 0x3a
call fcn.005e5c20
lea ecx, [esp + 0x1f8]
mov byte [esp + 0x22c], 0x39
call fcn.005e5c20
lea ecx, [esp + 0x208]
mov byte [esp + 0x22c], 0x38
call fcn.005e5c20
lea ecx, [esp + 0xd0]
mov byte [esp + 0x22c], 0x37
call fcn.005e5c20
lea ecx, [esp + 0xe0]
mov byte [esp + 0x22c], bl
call fcn.005e5c20
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0x24c]
inc ecx
add edx, 0x1c
cmp ecx, eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x3c], edx
jl 0x558cd5
lea ecx, [esp + 0x60]
mov byte [esp + 0x22c], 4
call fcn.005e5c20
lea ecx, [esp + 0x218]
mov byte [esp + 0x22c], 3
call fcn.005e5c20
lea ecx, [esp + 0x1c]
mov byte [esp + 0x22c], 2
call fcn.005e5c20
lea ecx, [esp + 0x28]
mov byte [esp + 0x22c], 1
call fcn.005e5c20
lea ecx, [esp + 0x10]
mov byte [esp + 0x22c], 0
call fcn.005e5c20
lea ecx, [esp + 0x30]
mov dword [esp + 0x22c], 0xffffffff
call fcn.005e5c20
mov ecx, dword [esp + 0x224]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4