Function at 0x605b90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2dc
mov eax, dword [0x7e3000]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x3f1
mov word [ebp - 0x5c], ax
mov ecx, 0x386
mov word [ebp - 0x5a], cx
mov edx, 0x3eb
mov word [ebp - 0x58], dx
mov eax, 0x3c5
mov word [ebp - 0x56], ax
mov ecx, 0x3a0
mov word [ebp - 0x54], cx
mov edx, 0x3d8
mov word [ebp - 0x52], dx
mov eax, 0x3bd
mov word [ebp - 0x50], ax
mov ecx, 0x3bd
mov word [ebp - 0x4e], cx
mov dword [ebp - 0x2a8], 7
jmp 0x605c06
mov edx, dword [ebp - 0x2a8]
sub edx, 1
mov dword [ebp - 0x2a8], edx
cmp dword [ebp - 0x2a8], 0
jle 0x605c34
mov eax, dword [ebp - 0x2a8]
movzx ecx, word [ebp + eax*2 - 0x5c]
mov edx, dword [ebp - 0x2a8]
movzx eax, word [ebp + edx*2 - 0x5e]
xor ecx, eax
mov edx, dword [ebp - 0x2a8]
mov word [ebp + edx*2 - 0x5c], cx
jmp 0x605bf7
mov eax, 2
imul ecx, eax, 0
movzx edx, word [ebp + ecx - 0x5c]
xor edx, 0x395
mov eax, 2
imul ecx, eax, 0
mov word [ebp + ecx - 0x5c], dx
mov dword [ebp - 0x2c8], 0
mov edx, 0x4aaa
mov word [ebp - 0x78], dx
mov eax, 0x4acf
mov word [ebp - 0x76], ax
mov ecx, 0x4abd
mov word [ebp - 0x74], cx
mov edx, 0x4ad3
mov word [ebp - 0x72], dx
mov eax, 0x4ab6
mov word [ebp - 0x70], ax
mov ecx, 0x4ada
mov word [ebp - 0x6e], cx
mov edx, 0x4ae9
mov word [ebp - 0x6c], dx
mov eax, 0x4adb
mov word [ebp - 0x6a], ax
mov ecx, 0x4af5
mov word [ebp - 0x68], cx
mov edx, 0x4a91
mov word [ebp - 0x66], dx
mov eax, 0x4afd
mov word [ebp - 0x64], ax
mov ecx, 0x4a91
mov word [ebp - 0x62], cx
mov edx, 0x4a91
mov word [ebp - 0x60], dx
mov dword [ebp - 0x2ac], 0xc
jmp 0x605cee
mov eax, dword [ebp - 0x2ac]
sub eax, 1
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 0
jle 0x605d1c
mov ecx, dword [ebp - 0x2ac]
movzx edx, word [ebp + ecx*2 - 0x78]
mov eax, dword [ebp - 0x2ac]
movzx ecx, word [ebp + eax*2 - 0x7a]
xor edx, ecx
mov eax, dword [ebp - 0x2ac]
mov word [ebp + eax*2 - 0x78], dx
jmp 0x605cdf
mov ecx, 2
imul edx, ecx, 0
movzx eax, word [ebp + edx - 0x78]
xor eax, 0x4ae1
mov ecx, 2
imul edx, ecx, 0
mov word [ebp + edx - 0x78], ax
lea eax, [ebp - 0x78]
push eax
call fcn.006089e0
add esp, 4
mov dword [ebp - 0x2c0], eax
mov byte [ebp - 0x4c], 0x60
mov byte [ebp - 0x4b], 0x12
mov byte [ebp - 0x4a], 0x77
mov byte [ebp - 0x49], 0x16
mov byte [ebp - 0x48], 0x62
mov byte [ebp - 0x47], 7
mov byte [ebp - 0x46], 0x53
mov byte [ebp - 0x45], 0x3c
mov byte [ebp - 0x44], 0x53
mov byte [ebp - 0x43], 0x3f
mov byte [ebp - 0x42], 0x57
mov byte [ebp - 0x41], 0x32
mov byte [ebp - 0x40], 0x5e
mov byte [ebp - 0x3f], 0x2e
mov byte [ebp - 0x3e], 0x1d
mov byte [ebp - 0x3d], 0x2f
mov byte [ebp - 0x3c], 0x7c
mov byte [ebp - 0x3b], 0x12
mov byte [ebp - 0x3a], 0x73
mov byte [ebp - 0x39], 3
mov byte [ebp - 0x38], 0x70
mov byte [ebp - 0x37], 0x18
mov byte [ebp - 0x36], 0x77
mov byte [ebp - 0x35], 3
mov byte [ebp - 0x34], 3
mov dword [ebp - 0x2b0], 0x18
jmp 0x605dcc
mov ecx, dword [ebp - 0x2b0]
sub ecx, 1
mov dword [ebp - 0x2b0], ecx
cmp dword [ebp - 0x2b0], 0
jle 0x605df9
mov edx, dword [ebp - 0x2b0]
movsx eax, byte [ebp + edx - 0x4c]
mov ecx, dword [ebp - 0x2b0]
movsx edx, byte [ebp + ecx - 0x4d]
xor eax, edx
mov ecx, dword [ebp - 0x2b0]
mov byte [ebp + ecx - 0x4c], al
jmp 0x605dbd
mov edx, 1
imul eax, edx, 0
movsx ecx, byte [ebp + eax - 0x4c]
xor ecx, 0x23
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x4c], cl
lea ecx, [ebp - 0x4c]
push ecx
mov edx, dword [ebp - 0x2c0]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2cc], eax
mov byte [ebp - 0x30], 0xee
mov byte [ebp - 0x2f], 0x9c
mov byte [ebp - 0x2e], 0xf3
mov byte [ebp - 0x2d], 0x90
mov byte [ebp - 0x2c], 0xf5
mov byte [ebp - 0x2b], 0x86
mov byte [ebp - 0x2a], 0xf5
mov byte [ebp - 0x29], 0xc6
mov byte [ebp - 0x28], 0xf4
mov byte [ebp - 0x27], 0xb2
mov byte [ebp - 0x26], 0xdb
mov byte [ebp - 0x25], 0xa9
mov byte [ebp - 0x24], 0xda
mov byte [ebp - 0x23], 0xae
mov byte [ebp - 0x22], 0xf9
mov byte [ebp - 0x21], 0xf9
mov dword [ebp - 0x2b4], 0xf
jmp 0x605e87
mov eax, dword [ebp - 0x2b4]
sub eax, 1
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jle 0x605eb4
mov ecx, dword [ebp - 0x2b4]
movsx edx, byte [ebp + ecx - 0x30]
mov eax, dword [ebp - 0x2b4]
movsx ecx, byte [ebp + eax - 0x31]
xor edx, ecx
mov eax, dword [ebp - 0x2b4]
mov byte [ebp + eax - 0x30], dl
jmp 0x605e78
mov ecx, 1
imul edx, ecx, 0
movsx eax, byte [ebp + edx - 0x30]
xor eax, 0xbe
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x30], al
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x2c0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2d0], eax
mov dword [ebp - 0x2a4], 0x22c
mov byte [ebp - 0x10], 0xc7
mov byte [ebp - 0xf], 0xab
mov byte [ebp - 0xe], 0xc4
mov byte [ebp - 0xd], 0xb7
mov byte [ebp - 0xc], 0xd2
mov byte [ebp - 0xb], 0x9a
mov byte [ebp - 0xa], 0xfb
mov byte [ebp - 9], 0x95
mov byte [ebp - 8], 0xf1
mov byte [ebp - 7], 0x9d
mov byte [ebp - 6], 0xf8
mov byte [ebp - 5], 0xf8
mov dword [ebp - 0x2b8], 0xb
jmp 0x605f3e
mov edx, dword [ebp - 0x2b8]
sub edx, 1
mov dword [ebp - 0x2b8], edx
cmp dword [ebp - 0x2b8], 0
jle 0x605f6b
mov eax, dword [ebp - 0x2b8]
movsx ecx, byte [ebp + eax - 0x10]
mov edx, dword [ebp - 0x2b8]
movsx eax, byte [ebp + edx - 0x11]
xor ecx, eax
mov edx, dword [ebp - 0x2b8]
mov byte [ebp + edx - 0x10], cl
jmp 0x605f2f
mov eax, 1
imul ecx, eax, 0
movsx edx, byte [ebp + ecx - 0x10]
xor edx, 0x84
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x10], dl
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x2c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2d8], eax
mov dword [ebp - 0x2dc], 0
mov byte [ebp - 0x20], 0xb1
mov byte [ebp - 0x1f], 0xc3
mov byte [ebp - 0x1e], 0xac
mov byte [ebp - 0x1d], 0xcf
mov byte [ebp - 0x1c], 0xaa
mov byte [ebp - 0x1b], 0xd9
mov byte [ebp - 0x1a], 0xaa
mov byte [ebp - 0x19], 0x99
mov byte [ebp - 0x18], 0xab
mov byte [ebp - 0x17], 0xe5
mov byte [ebp - 0x16], 0x80
mov byte [ebp - 0x15], 0xf8
mov byte [ebp - 0x14], 0x8c
mov byte [ebp - 0x13], 0xdb
mov byte [ebp - 0x12], 0xdb
mov dword [ebp - 0x2bc], 0xe
jmp 0x606002
mov ecx, dword [ebp - 0x2bc]
sub ecx, 1
mov dword [ebp - 0x2bc], ecx
cmp dword [ebp - 0x2bc], 0
jle 0x60602f
mov edx, dword [ebp - 0x2bc]
movsx eax, byte [ebp + edx - 0x20]
mov ecx, dword [ebp - 0x2bc]
movsx edx, byte [ebp + ecx - 0x21]
xor eax, edx
mov ecx, dword [ebp - 0x2bc]
mov byte [ebp + ecx - 0x20], al
jmp 0x605ff3
mov edx, 1
imul eax, edx, 0
movsx ecx, byte [ebp + eax - 0x20]
xor ecx, 0xe1
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x20], cl
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x2c0]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2d4], eax
push 0
push 2
call dword [ebp - 0x2cc]
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0
je 0x6060da
lea eax, [ebp - 0x2a4]
push eax
mov ecx, dword [ebp - 0x2c4]
push ecx
call dword [ebp - 0x2d0]
test eax, eax
je 0x6060cd
lea edx, [ebp - 0x5c]
push edx
lea eax, [ebp - 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x6060b5
mov dword [ebp - 0x2c8], 1
lea ecx, [ebp - 0x2a4]
push ecx
mov edx, dword [ebp - 0x2c4]
push edx
call dword [ebp - 0x2d4]
test eax, eax
jne 0x606096
mov eax, dword [ebp - 0x2c4]
push eax
call dword [ebp - 0x2d8]
mov eax, dword [ebp - 0x2c8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00755942
mov esp, ebp
pop ebp
ret