Function at 0x4be44d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x188
mov eax, 0x638085
call fcn.0040ebd7
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], bl
lea ecx, [ebp - 0xb0]
mov dword [ebp - 4], ebx
call fcn.004ab0d4
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 1
call fcn.004ab0d4
push esi
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 2
call fcn.004ab7b0
test al, al
je 0x4beded
xor ecx, ecx
mov dword [edi], ebx
inc ecx
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0x48], ecx
lea ecx, [edi + 0x10]
mov dword [edi + 0x40], 0x1e
mov byte [edi + 0x44], bl
cmp dword [edi + 0x24], 8
mov dword [edi + 0x20], ebx
jb 0x4be4cd
mov ecx, dword [edi + 0x10]
xor eax, eax
lea esi, [edi + 0x64]
mov word [ecx], ax
mov eax, esi
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], ebx
jb 0x4be4e2
mov eax, dword [esi]
mov byte [eax], bl
lea ecx, [edi + 0x28]
cmp dword [edi + 0x3c], 8
mov dword [edi + 0x38], ebx
jb 0x4be4f3
mov ecx, dword [edi + 0x28]
xor eax, eax
mov word [ecx], ax
lea ecx, [edi + 0x7c]
cmp dword [edi + 0x90], 0x10
mov dword [edi + 0x8c], ebx
jb 0x4be50d
mov ecx, dword [edi + 0x7c]
lea eax, [edi + 0xac]
mov byte [ecx], bl
cmp dword [eax + 0x14], 0x10
mov ecx, eax
mov dword [eax + 0x10], ebx
jb 0x4be522
mov ecx, dword [eax]
mov byte [ecx], bl
lea ecx, [ebp - 0x28]
push 2
push 0x64c174
mov dword [edi + 0x10c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.00403902
push edi
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0xb0]
call fcn.004ab53d
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00403989
push 2
push 0x64b850
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.00403902
lea eax, [edi + 4]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xb0]
call fcn.004ab53d
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00403989
push 4
push str.land
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.00403902
lea eax, [edi + 8]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xb0]
call fcn.004ab53d
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00403989
push 6
push 0x64bfcc
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.00403902
lea eax, [edi + 0xc]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xb0]
call fcn.004ab53d
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00403989
push 3
push 0x6b4bac
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.00403902
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xb0]
call fcn.004ab642
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00403989
push 0x3a8
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.0040351b
lea eax, [ebp - 0x28]
push eax
call fcn.004acbe5
add esp, 0x20
lea ecx, [edi + 0x10]
push eax
call fcn.00403826
lea ecx, [ebp - 0x28]
call fcn.0040199e
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
push 3
cmovae eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x30], ebx
push 0x64c180
mov dword [ebp - 0x18], ebx
mov byte [eax], bl
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.00403902
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xb0]
call fcn.004ab642
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00403989
push 0x3a8
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.0040351b
lea eax, [ebp - 0x28]
push eax
call fcn.004acbe5
add esp, 0x20
lea ecx, [edi + 0x28]
push eax
call fcn.00403826
lea ecx, [ebp - 0x28]
call fcn.0040199e
lea ecx, [ebp - 0x78]
call fcn.004ab0d4
push 6
push str.config
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.00403902
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xb0]
call fcn.004ab591
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
mov bl, al
call fcn.00403989
test bl, bl
je 0x4bedcf
push 6
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.intert
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.00403902
lea eax, [edi + 0x40]
mov byte [ebp - 4], 0xb
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x78]
call fcn.004ab53d
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.00403989
push 5
push str.param
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.00403902
lea eax, [edi + 0xac]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x78]
call fcn.004ab642
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.00403989
push 7
push str.dllmain
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.00403902
lea eax, [edi + 0x7c]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x78]
call fcn.004ab642
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.00403989
push 7
push str.exename
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.00403902
lea eax, [edi + 0x94]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x78]
call fcn.004ab642
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.00403989
push 0xa
push str.returnbool
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.00403902
lea eax, [edi + 0x44]
mov byte [ebp - 4], 0xf
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x78]
call fcn.004ab6f3
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.00403989
push 7
push str.funtype
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.00403902
push esi
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x10
push eax
lea ecx, [ebp - 0x78]
call fcn.004ab642
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.00403989
push 5
push str.admin
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.00403902
lea eax, [edi + 0x4c]
mov byte [ebp - 4], 0x11
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x78]
call fcn.004ab642
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.00403989
push 4
push str.land
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.00403902
lea eax, [edi + 8]
mov byte [ebp - 4], 0x12
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x78]
call fcn.004ab53d
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.00403989
push 0xd
push str.firstdlldelay
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.00403902
lea eax, [edi + 0xc4]
mov byte [ebp - 4], 0x13
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x78]
call fcn.004ab642
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.00403989
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
push 0xa
cmovae eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x30], ebx
push str.usercfgtag
mov dword [ebp - 0x18], ebx
mov byte [eax], bl
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.00403902
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x14
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x78]
call fcn.004ab642
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
mov bl, al
call fcn.00403989
test bl, bl
je 0x4be9f4
xor eax, eax
cmp eax, dword [ebp - 0x30]
sbb eax, eax
neg eax
mov dword [edi + 0x48], eax
push 0xb
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.dlldelayqid
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.00403902
lea eax, [ebp - 0x190]
mov byte [ebp - 4], 0x15
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x78]
call fcn.004ab591
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.00403989
lea ecx, [ebp - 0x190]
call fcn.004ab77f
test eax, eax
jle 0x4beaad
mov esi, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x16
push eax
push esi
lea ecx, [ebp - 0x190]
call fcn.004ab73e
test al, al
je 0x4bea8e
lea ecx, [edi + 0xdc]
mov eax, dword [ecx + 4]
cmp dword [ecx + 8], eax
je 0x4bea84
lea eax, [ebp - 0x28]
push eax
call fcn.004abf51
jmp 0x4bea8e
lea edx, [ebp - 0x28]
push edx
push eax
call fcn.004abf95
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.00403989
lea ecx, [ebp - 0x190]
inc esi
call fcn.004ab77f
cmp esi, eax
jl 0x4bea46
lea esi, [edi + 0x64]
lea ecx, [ebp - 0x158]
call fcn.004ab0d4
push 7
push str.onlyqid
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.00403902
lea eax, [ebp - 0x158]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x78]
call fcn.004ab591
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x17
call fcn.00403989
lea ecx, [ebp - 0x158]
call fcn.004ab77f
test eax, eax
jle 0x4beb73
mov esi, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x19
push eax
push esi
lea ecx, [ebp - 0x158]
call fcn.004ab73e
test al, al
je 0x4beb54
lea ecx, [edi + 0xe8]
mov eax, dword [ecx + 4]
cmp dword [ecx + 8], eax
je 0x4beb4a
lea eax, [ebp - 0x28]
push eax
call fcn.004abf51
jmp 0x4beb54
lea edx, [ebp - 0x28]
push edx
push eax
call fcn.004abf95
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x17
call fcn.00403989
lea ecx, [ebp - 0x158]
inc esi
call fcn.004ab77f
cmp esi, eax
jl 0x4beb0c
lea esi, [edi + 0x64]
cmp dword [esi + 0x10], 0
jbe 0x4beba6
sub esp, 0x18
mov ecx, esp
push esi
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.0040351b
lea eax, [ebp - 0x28]
push eax
call fcn.004acb3b
add esp, 0x1c
mov ecx, esi
push eax
call fcn.00405b3d
lea ecx, [ebp - 0x28]
call fcn.00403989
lea ecx, [ebp - 0xe8]
call fcn.004ab0d4
push 0xb
push str.localbinary
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.00403902
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 0x1b
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x78]
call fcn.004ab591
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1a
mov bl, al
call fcn.00403989
test bl, bl
je 0x4bedb9
push 0x54
call fcn.0040e2b7
mov esi, eax
xor ebx, ebx
pop ecx
test esi, esi
je 0x4bec23
push 0x54
push ebx
push esi
call fcn.004edce0
add esp, 0xc
mov ecx, esi
call fcn.004be422
jmp 0x4bec25
mov eax, ebx
push 4
push str.name
lea ecx, [ebp - 0x28]
mov dword [edi + 0x10c], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.00403902
push dword [edi + 0x10c]
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x1c
push eax
lea ecx, [ebp - 0xe8]
call fcn.004ab642
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1a
call fcn.00403989
push 7
push str.lbparam
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.00403902
mov eax, dword [edi + 0x10c]
lea ecx, [ebp - 0xe8]
add eax, 0x30
mov byte [ebp - 4], 0x1d
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004ab642
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1a
call fcn.00403989
push 9
push str.lbdllmain
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.00403902
mov eax, dword [edi + 0x10c]
lea ecx, [ebp - 0xe8]
add eax, 0x18
mov byte [ebp - 4], 0x1e
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004ab642
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1a
call fcn.00403989
lea ecx, [ebp - 0x120]
call fcn.004ab0d4
push 8
push str.lbrunver
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.00403902
lea eax, [ebp - 0x120]
mov byte [ebp - 4], 0x20
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xe8]
call fcn.004ab591
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1f
call fcn.00403989
lea ecx, [ebp - 0x120]
mov esi, ebx
call fcn.004ab77f
test eax, eax
jle 0x4bedae
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x120]
cmovae eax, dword [ebp - 0x40]
mov byte [eax], bl
lea eax, [ebp - 0x40]
push eax
push esi
call fcn.004ab73e
mov ecx, dword [edi + 0x10c]
add ecx, 0x48
mov eax, dword [ecx + 4]
cmp dword [ecx + 8], eax
je 0x4bed94
lea eax, [ebp - 0x40]
push eax
call fcn.004abf51
jmp 0x4bed9e
lea edx, [ebp - 0x40]
push edx
push eax
call fcn.004abf95
lea ecx, [ebp - 0x120]
inc esi
call fcn.004ab77f
cmp esi, eax
jl 0x4bed58
lea ecx, [ebp - 0x120]
call fcn.004ab18a
lea ecx, [ebp - 0xe8]
call fcn.004ab18a
lea ecx, [ebp - 0x158]
call fcn.004ab18a
xor ebx, ebx
cmp dword [edi + 0x20], ebx
je 0x4bede5
cmp dword [edi + 0x8c], ebx
je 0x4bede5
cmp dword [edi + 0x38], ebx
je 0x4bede5
mov bl, 1
lea ecx, [ebp - 0x78]
call fcn.004ab18a
lea ecx, [ebp - 0x190]
call fcn.004ab18a
lea ecx, [ebp - 0xb0]
call fcn.004ab18a
lea ecx, [ebp - 0x40]
call fcn.00403989
mov al, bl
call fcn.0040eb81
ret