Function at 0x436d30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10c
mov ebx, edx
mov dword [ebp - 0x118], ecx
mov esi, dword [ebp + 8]
mov eax, dword [0x4a1088]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x88], 0x6e
mov dword [ebp - 0x8c], 0x776f6873
mov dword [ebp - 0x90], 0x2d746f6e
mov eax, dword [esi + 0x10]
mov dword [ebp - 0xfc], eax
cmp eax, 9
jne 0x436db3
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x436d84
mov eax, dword [esi]
lea ecx, [ebp - 0x90]
push 9
push ecx
push eax
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
xor edi, edi
test eax, eax
jne 0x436db3
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00448b70
mov eax, edi
add esp, 0x10c
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [ebx + 0x10]
cmp dword [ebx + 0x14], 0x10
jb 0x436dbe
mov ebx, dword [ebx]
cmp edx, 0xf
mov dword [ebp - 0xf8], edx
ja 0x436dda
movups xmm0, xmmword [ebx]
movups xmmword [ebp - 0xf0], xmm0
mov edi, 0xf
jmp 0x436e47
mov ecx, edx
or ecx, 0xf
mov eax, SysReAllocString
cmp ecx, eax
cmovae ecx, eax
cmp ecx, 0xfff
mov dword [ebp - 0x108], ecx
jb 0x436e10
lea eax, [ecx + 0x24]
push eax
call fcn.004484c5
add esp, 4
mov ecx, eax
add eax, 0x23
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x436e1c
lea eax, [ecx + 1]
push eax
call fcn.004484c5
add esp, 4
mov dword [ebp - 0xf0], eax
mov edi, dword [ebp - 0xf8]
lea ecx, [edi + 1]
push ecx
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
add esp, 0xc
mov eax, dword [esi + 0x10]
mov dword [ebp - 0xfc], eax
mov edi, dword [ebp - 0x108]
mov dword [ebp - 0x108], edi
mov dword [ebp - 0xe0], edx
mov dword [ebp - 0xdc], edi
cmp dword [esi + 0x14], 0x10
jb 0x436e61
mov esi, dword [esi]
mov ebx, dword [ebp - 0xfc]
lea eax, [ebp - 0xd8]
cmp ebx, 0xf
ja 0x436e7f
movups xmm0, xmmword [esi]
movups xmmword [eax], xmm0
mov edi, 0xf
jmp 0x436edb
or ebx, 0xf
mov eax, SysReAllocString
cmp ebx, eax
cmovae ebx, eax
mov edi, ebx
cmp ebx, 0xfff
jb 0x436eaf
lea eax, [ebx + 0x24]
push eax
call fcn.004484c5
add esp, 4
mov ecx, eax
add eax, 0x23
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x436ebb
lea eax, [ebx + 1]
push eax
call fcn.004484c5
add esp, 4
mov dword [ebp - 0xd8], eax
mov ebx, dword [ebp - 0xfc]
lea ecx, [ebx + 1]
push ecx
push esi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 0xf8]
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xc4], edi
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ecx + 0x10]
cmp dword [ecx + 0x14], 0x10
mov dword [ebp - 0x110], edi
jb 0x436efb
mov ecx, dword [ecx]
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0xc0]
cmp ebx, 0xf
ja 0x436f16
movups xmm0, xmmword [ecx]
movups xmmword [eax], xmm0
mov ecx, 0xf
jmp 0x436f7b
mov dword [ebp - 0x100], ecx
mov ecx, ebx
or ecx, 0xf
mov eax, SysReAllocString
cmp ecx, eax
cmovae ecx, eax
mov edi, ecx
cmp ecx, 0xfff
jb 0x436f4e
lea eax, [ecx + 0x24]
push eax
call fcn.004484c5
add esp, 4
mov ecx, eax
add eax, 0x23
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x436f5a
lea eax, [ecx + 1]
push eax
call fcn.004484c5
add esp, 4
mov dword [ebp - 0xc0], eax
lea ecx, [ebx + 1]
push ecx
push dword [ebp - 0x100]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, edi
mov edx, dword [ebp - 0xf8]
mov dword [ebp - 0x104], ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ecx
mov ebx, dword [esi + 0x10]
cmp dword [esi + 0x14], 0x10
jb 0x436f98
mov esi, dword [esi]
lea eax, [ebp - 0xa8]
cmp ebx, 0xf
mov dword [ebp - 0x100], ecx
ja 0x436fb6
movups xmm0, xmmword [esi]
movups xmmword [eax], xmm0
mov esi, 0xf
jmp 0x437016
mov ecx, ebx
or ecx, 0xf
mov eax, SysReAllocString
cmp ecx, eax
cmovae ecx, eax
mov edi, ecx
cmp ecx, 0xfff
jb 0x436fe8
lea eax, [ecx + 0x24]
push eax
call fcn.004484c5
add esp, 4
mov ecx, eax
add eax, 0x23
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x436ff4
lea eax, [ecx + 1]
push eax
call fcn.004484c5
add esp, 4
mov dword [ebp - 0xa8], eax
lea ecx, [ebx + 1]
push ecx
push esi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 0x100]
mov edx, dword [ebp - 0xf8]
mov esi, edi
lea edi, [ebp - 0xf0]
mov eax, dword [edi]
mov dword [edi + 0x58], ebx
cmp dword [ebp - 0x108], 0x10
mov dword [ebp - 0x114], esi
mov dword [edi + 0x5c], esi
mov dword [ebp - 0x10c], eax
cmovae edi, eax
mov dword [ebp - 0x78], 2
cmp edx, 0xf
ja 0x437056
lea eax, [ebp - 0x74]
movups xmm0, xmmword [edi]
movups xmmword [eax], xmm0
mov esi, 0xf
jmp 0x4370b1
mov esi, edx
or esi, 0xf
mov eax, SysReAllocString
cmp esi, eax
cmovae esi, eax
cmp esi, 0xfff
jb 0x437086
lea eax, [esi + 0x24]
push eax
call fcn.004484c5
add esp, 4
mov ecx, eax
add eax, 0x23
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x437092
lea eax, [esi + 1]
push eax
call fcn.004484c5
add esp, 4
mov dword [ebp - 0x74], eax
mov ebx, dword [ebp - 0xf8]
lea ecx, [ebx + 1]
push ecx
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebx
add esp, 0xc
mov ecx, dword [ebp - 0x100]
mov ebx, dword [ebp - 0x104]
mov dword [ebp - 0x64], edx
cmp dword [ebp - 0x110], 0x10
mov dword [ebp - 0x60], esi
mov eax, dword [ebp - 0xd8]
lea edx, [ebp - 0xd8]
mov dword [ebp - 0xf8], eax
cmovae edx, eax
mov edi, dword [ebp - 0xfc]
cmp edi, 0xf
ja 0x4370f4
lea eax, [ebp - 0x5c]
movups xmm0, xmmword [edx]
movups xmmword [eax], xmm0
mov esi, 0xf
jmp 0x437152
mov dword [ebp - 0x104], edx
mov esi, edi
or esi, 0xf
mov eax, SysReAllocString
cmp esi, eax
cmovae esi, eax
cmp esi, 0xfff
jb 0x43712a
lea eax, [esi + 0x24]
push eax
call fcn.004484c5
add esp, 4
mov ecx, eax
add eax, 0x23
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x437136
lea eax, [esi + 1]
push eax
call fcn.004484c5
add esp, 4
mov dword [ebp - 0x5c], eax
lea ecx, [edi + 1]
push ecx
push dword [ebp - 0x104]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 0x100]
mov dword [ebp - 0x4c], edi
cmp ecx, 0x10
mov dword [ebp - 0x48], esi
mov esi, dword [ebp - 0xc0]
lea ecx, [ebp - 0xc0]
cmovae ecx, esi
cmp ebx, 0xf
ja 0x43717f
lea eax, [ebp - 0x44]
movups xmm0, xmmword [ecx]
movups xmmword [eax], xmm0
mov edi, 0xf
jmp 0x4371d7
mov dword [ebp - 0xfc], ecx
mov edi, ebx
or edi, 0xf
mov eax, SysReAllocString
cmp edi, eax
cmovae edi, eax
cmp edi, 0xfff
jb 0x4371b5
lea eax, [edi + 0x24]
push eax
call fcn.004484c5
add esp, 4
mov ecx, eax
add eax, 0x23
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x4371c1
lea eax, [edi + 1]
push eax
call fcn.004484c5
add esp, 4
mov dword [ebp - 0x44], eax
lea ecx, [ebx + 1]
push ecx
push dword [ebp - 0xfc]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, ebx
lea ebx, [ebp - 0x2c]
mov dword [ebx - 8], eax
mov dword [ebx - 4], edi
mov ecx, ebx
lea edx, [ebp - 0xa8]
call fcn.004507f0
mov byte [ebx + 0x18], 1
lea edi, [ebp - 0x78]
lea ebx, [ebp - 0xf4]
mov ecx, dword [ebp - 0x118]
mov edx, ebx
push edi
call fcn.0042f060
add esp, 4
mov ecx, edi
call fcn.0042f3a0
mov edi, dword [ebx]
mov edx, dword [ebp - 0x114]
cmp edx, 0x10
mov ebx, dword [ebp - 0x108]
jb 0x437258
mov eax, dword [ebp - 0xa8]
cmp edx, 0xfff
jb 0x43724d
mov ecx, dword [eax - 4]
add eax, 0xfffffffc
sub eax, ecx
cmp eax, 0x20
jae 0x437309
add edx, 0x24
mov eax, ecx
jmp 0x43724e
inc edx
push edx
push eax
call fcn.004484f5
add esp, 8
mov ecx, dword [ebp - 0x100]
cmp ecx, 0x10
jb 0x43728e
cmp ecx, 0xfff
jb 0x437283
mov eax, dword [esi - 4]
add esi, 0xfffffffc
sub esi, eax
cmp esi, 0x20
jae 0x437309
add ecx, 0x24
mov esi, eax
jmp 0x437284
inc ecx
push ecx
push esi
call fcn.004484f5
add esp, 8
mov ecx, dword [ebp - 0x110]
cmp ecx, 0x10
jb 0x4372ca
cmp ecx, 0xfff
jb 0x4372b9
mov edx, dword [ebp - 0xf8]
mov eax, dword [edx - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x437309
add ecx, 0x24
jmp 0x4372c0
inc ecx
mov eax, dword [ebp - 0xf8]
push ecx
push eax
call fcn.004484f5
add esp, 8
cmp ebx, 0x10
jb 0x436d9c
cmp ebx, 0xfff
jb 0x4372f3
mov ecx, dword [ebp - 0x10c]
mov eax, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, eax
cmp ecx, 0x20
jae 0x437309
add ebx, 0x24
jmp 0x4372fa
inc ebx
mov eax, dword [ebp - 0x10c]
push ebx
push eax
call fcn.004484f5
add esp, 8
jmp 0x436d9c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3