Function at 0x6471b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x663c04
mov eax, dword fs:[0]
push eax
sub esp, 0x52c
mov eax, dword [0x76c12c]
xor eax, esp
mov dword [esp + 0x528], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x76c12c]
xor eax, esp
push eax
lea eax, [esp + 0x540]
mov dword fs:[0], eax
lea eax, [esp + 0x3c]
push eax
call fcn.005e6d40
mov dword [esp + 0x548], 0
call fcn.0040b0d0
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
push 0x9f
lea ecx, [esp + 0x24]
push ecx
mov ecx, eax
call edx
mov ebx, 1
mov byte [esp + 0x548], bl
call fcn.0040b0d0
mov esi, eax
call fcn.0040b0d0
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
mov edi, eax
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
push 0xb1
push ecx
mov ecx, esi
call edx
mov byte [esp + 0x568], 2
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x58], esp
push 0xbf
push ecx
mov ecx, edi
call edx
mov byte [esp + 0x584], 3
cmp dword [esp + 0x70], 8
mov eax, dword [esp + 0x5c]
jae 0x647283
lea eax, [esp + 0x5c]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x70], esp
push 0x22
push eax
push ecx
call fcn.0055e800
add esp, 0xc
mov byte [esp + 0x5a0], 4
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
call esi
push eax
mov byte [esp + 0x5a4], bl
lea ecx, [esp + 0x520]
call fcn.005e6870
call fcn.0040b0d0
mov edi, eax
call fcn.0040b0d0
mov ebp, eax
call fcn.0040b0d0
mov edx, dword [edi]
mov ecx, dword [edx + 0x18]
push 5
sub esp, 0x1c
mov dword [esp + 0x34], eax
mov eax, esp
mov dword [esp + 0x38], esp
push 0xbd
push eax
push edi
call ecx
mov byte [esp + 0x574], 5
mov edx, dword [ebp]
mov ecx, dword [edx + 0x18]
sub esp, 0x10
mov eax, esp
mov dword [esp + 0x58], esp
push 0xbf
push eax
push ebp
call ecx
mov byte [esp + 0x590], 6
mov eax, dword [esp + 0x5c]
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
sub esp, 0x10
mov ecx, esp
mov dword [esp + 0x6c], esp
push 0xbc
push ecx
push eax
call edx
add esp, 0xc
mov byte [esp + 0x5a0], 7
call esi
push eax
mov byte [esp + 0x5a4], bl
lea ecx, [esp + 0x520]
call fcn.005e6870
call fcn.0040b0d0
mov edi, eax
call fcn.0040b0d0
mov ebp, eax
call fcn.0040b0d0
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
mov dword [esp + 0x34], eax
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xb2
push ecx
mov ecx, edi
call edx
mov byte [esp + 0x568], 8
mov eax, dword [ebp]
mov edx, dword [eax + 0xc]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x58], esp
push 0xbf
push ecx
mov ecx, ebp
call edx
mov byte [esp + 0x584], 9
mov ecx, dword [esp + 0x50]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
sub esp, 0x1c
mov edx, esp
mov dword [esp + 0x6c], esp
push 0xaa
push edx
call eax
mov byte [esp + 0x5a0], 0xa
call esi
push eax
mov byte [esp + 0x5a4], bl
lea ecx, [esp + 0x520]
call fcn.005e6870
call fcn.0040b0d0
mov edi, eax
call fcn.0040b0d0
mov ebp, eax
call fcn.0040b0d0
mov edx, dword [edi]
mov edx, dword [edx + 0xc]
push 0
sub esp, 0x1c
mov dword [esp + 0x34], eax
mov eax, esp
mov dword [esp + 0x38], esp
push 0xb3
push eax
mov ecx, edi
call edx
mov byte [esp + 0x568], 0xb
mov eax, dword [ebp]
mov edx, dword [eax + 0xc]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x58], esp
push 0xbf
push ecx
mov ecx, ebp
call edx
mov byte [esp + 0x584], 0xc
mov ecx, dword [esp + 0x50]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
sub esp, 0x1c
mov edx, esp
mov dword [esp + 0x6c], esp
push 0xa2
push edx
call eax
mov byte [esp + 0x5a0], 0xd
call esi
push eax
mov byte [esp + 0x5a4], bl
lea ecx, [esp + 0x520]
call fcn.005e6870
call fcn.0040b0d0
mov edi, eax
call fcn.0040b0d0
mov ebp, eax
call fcn.0040b0d0
mov edx, dword [edi]
push 0
mov dword [esp + 0x18], eax
sub esp, 0x1c
mov edx, dword [edx + 0xc]
mov eax, esp
mov dword [esp + 0x38], esp
push 0xb5
push eax
mov ecx, edi
call edx
mov byte [esp + 0x568], 0xe
mov eax, dword [ebp]
mov edx, dword [eax + 0xc]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x58], esp
push 0xbf
push ecx
mov ecx, ebp
call edx
mov byte [esp + 0x584], 0xf
mov ecx, dword [esp + 0x50]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
sub esp, 0x1c
mov edx, esp
mov dword [esp + 0x6c], esp
push 0xb4
push edx
call eax
mov byte [esp + 0x5a0], 0x10
call esi
push eax
mov byte [esp + 0x5a4], bl
lea ecx, [esp + 0x520]
call fcn.005e6870
call fcn.0040b0d0
mov edi, eax
call fcn.0040b0d0
mov ebp, eax
call fcn.0040b0d0
mov edx, dword [edi]
mov edx, dword [edx + 0xc]
push 0
sub esp, 0x1c
mov dword [esp + 0x34], eax
mov eax, esp
mov dword [esp + 0x38], esp
push 0xb3
push eax
mov ecx, edi
call edx
mov byte [esp + 0x568], 0x11
mov eax, dword [ebp]
mov edx, dword [eax + 0xc]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x58], esp
push 0xbf
push ecx
mov ecx, ebp
call edx
mov byte [esp + 0x584], 0x12
mov ecx, dword [esp + 0x50]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
sub esp, 0x1c
mov edx, esp
mov dword [esp + 0x6c], esp
push 0xa2
push edx
call eax
mov byte [esp + 0x5a0], 0x13
call esi
push eax
mov byte [esp + 0x5a4], bl
lea ecx, [esp + 0x520]
call fcn.005e6870
call fcn.0040b0d0
mov edi, eax
call fcn.0040b0d0
mov ebp, eax
call fcn.0040b0d0
mov edx, dword [edi]
mov edx, dword [edx + 0xc]
push 0
sub esp, 0x1c
mov dword [esp + 0x34], eax
mov eax, esp
mov dword [esp + 0x38], esp
push 0xb6
push eax
mov ecx, edi
call edx
mov byte [esp + 0x568], 0x14
mov eax, dword [ebp]
mov edx, dword [eax + 0xc]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x58], esp
push 0xbf
push ecx
mov ecx, ebp
call edx
mov byte [esp + 0x584], 0x15
mov ecx, dword [esp + 0x50]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
sub esp, 0x1c
mov edx, esp
mov dword [esp + 0x6c], esp
push 0xa3
push edx
call eax
mov byte [esp + 0x5a0], 0x16
call esi
push eax
mov byte [esp + 0x5a4], bl
lea ecx, [esp + 0x520]
call fcn.005e6870
call fcn.0040b0d0
mov edi, eax
call fcn.0040b0d0
push 0
sub esp, 0x1c
mov ecx, esp
xor edx, edx
mov dword [esp + 0x38], esp
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x6dcd00
mov ebp, eax
mov word [ecx], dx
call fcn.00401f00
mov byte [esp + 0x568], 0x17
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x58], esp
push 0xbf
push ecx
mov ecx, edi
call edx
mov byte [esp + 0x584], 0x18
mov eax, dword [ebp]
mov edx, dword [eax + 0xc]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x6c], esp
push 0xa5
push ecx
mov ecx, ebp
call edx
mov byte [esp + 0x5a0], 0x19
call esi
push eax
mov byte [esp + 0x5a4], bl
lea ecx, [esp + 0x520]
call fcn.005e6870
call fcn.0040b0d0
mov edi, eax
call fcn.0040b0d0
mov ebp, eax
call fcn.0040b0d0
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
mov dword [esp + 0x34], eax
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xc4
push ecx
mov ecx, edi
call edx
mov byte [esp + 0x568], 0x1a
mov eax, dword [ebp]
mov edx, dword [eax + 0xc]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x58], esp
push 0xc3
push ecx
mov ecx, ebp
call edx
mov byte [esp + 0x584], 0x1b
mov ecx, dword [esp + 0x50]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
sub esp, 0x1c
mov edx, esp
mov dword [esp + 0x6c], esp
push 0xc5
push edx
call eax
mov byte [esp + 0x5a0], 0x1c
call esi
push eax
mov byte [esp + 0x5a4], bl
lea ecx, [esp + 0x520]
call fcn.005e6870
call fcn.0040b0d0
mov edi, eax
call fcn.0040b0d0
mov ebp, eax
call fcn.0040b0d0
mov edx, dword [edi]
mov edx, dword [edx + 0xc]
push 0
sub esp, 0x1c
mov dword [esp + 0x34], eax
mov eax, esp
mov dword [esp + 0x38], esp
push 0xb8
push eax
mov ecx, edi
call edx
mov byte [esp + 0x568], 0x1d
mov eax, dword [ebp]
mov edx, dword [eax + 0xc]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x58], esp
push 0xbf
push ecx
mov ecx, ebp
call edx
mov byte [esp + 0x584], 0x1e
mov ecx, dword [esp + 0x50]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
sub esp, 0x1c
mov edx, esp
mov dword [esp + 0x6c], esp
push 0xa6
push edx
call eax
mov byte [esp + 0x5a0], 0x1f
call esi
push eax
mov byte [esp + 0x5a4], bl
lea ecx, [esp + 0x520]
call fcn.005e6870
call fcn.0040b0d0
mov edi, eax
call fcn.0040b0d0
mov ebp, eax
call fcn.0040b0d0
mov edx, dword [edi]
mov edx, dword [edx + 0xc]
push 0
sub esp, 0x1c
mov dword [esp + 0x34], eax
mov eax, esp
mov dword [esp + 0x38], esp
push 0xb9
push eax
mov ecx, edi
call edx
mov byte [esp + 0x568], 0x20
mov eax, dword [ebp]
mov edx, dword [eax + 0xc]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x58], esp
push 0xbf
push ecx
mov ecx, ebp
call edx
mov byte [esp + 0x584], 0x21
mov ecx, dword [esp + 0x50]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
sub esp, 0x1c
mov edx, esp
mov dword [esp + 0x6c], esp
push 0xa7
push edx
call eax
mov byte [esp + 0x5a0], 0x22
call esi
push eax
mov byte [esp + 0x5a4], bl
lea ecx, [esp + 0x520]
call fcn.005e6870
call fcn.0040b0d0
mov edi, eax
call fcn.0040b0d0
mov ebp, eax
call fcn.0040b0d0
mov edx, dword [edi]
mov edx, dword [edx + 0xc]
push ebx
sub esp, 0x1c
mov dword [esp + 0x34], eax
mov eax, esp
mov dword [esp + 0x38], esp
push 0xba
push eax
mov ecx, edi
call edx
mov byte [esp + 0x568], 0x23
mov eax, dword [ebp]
mov edx, dword [eax + 0xc]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x58], esp
push 0xbf
push ecx
mov ecx, ebp
call edx
mov byte [esp + 0x584], 0x24
mov ecx, dword [esp + 0x50]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
sub esp, 0x1c
mov edx, esp
mov dword [esp + 0x6c], esp
push 0xa8
push edx
call eax
mov byte [esp + 0x5a0], 0x25
call esi
push eax
mov byte [esp + 0x5a4], bl
lea ecx, [esp + 0x520]
call fcn.005e6870
call fcn.0040b0d0
mov edi, eax
call fcn.0040b0d0
push 3
sub esp, 0x1c
mov ecx, esp
xor edx, edx
mov dword [esp + 0x38], esp
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x6dcd04
mov ebp, eax
mov word [ecx], dx
call fcn.00401f00
mov byte [esp + 0x568], 0x26
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x58], esp
push 0xbf
push ecx
mov ecx, edi
call edx
mov byte [esp + 0x584], 0x27
mov eax, dword [ebp]
mov edx, dword [eax + 0xc]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x6c], esp
push 0xa9
push ecx
mov ecx, ebp
call edx
mov byte [esp + 0x5a0], 0x28
call esi
push eax
mov byte [esp + 0x5a4], bl
lea ecx, [esp + 0x520]
call fcn.005e6870
mov byte [esp + 0x548], 0
cmp dword [esp + 0x34], 8
jb 0x6479b9
mov eax, dword [esp + 0x20]
push eax
call fcn.0058d051
add esp, 4
xor ecx, ecx
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], cx
mov dword [esp + 0x548], 0xffffffff
lea edx, [esp + 0x3c]
push edx
call fcn.005e6c20
mov ecx, dword [esp + 0x540]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x528]
xor ecx, esp
call fcn.0058cf08
add esp, 0x538
ret