Function at 0xb6d1bc
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
mov eax, 0xc7b0b0
call fcn.00be12c8
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0xc94188
lea ecx, [esi + 0x3de8]
mov dword [ebp - 4], 0x68
mov dword [ecx], 0xc9418c
call fcn.00b84770
mov eax, dword [esi + 0x3db8]
xor ebx, ebx
cmp eax, ebx
mov byte [ebp - 4], 0x67
je 0xb6d206
add eax, 0xfffffff4
push eax
call fcn.0042db7e
pop ecx
mov eax, dword [esi + 0x3db4]
cmp eax, ebx
mov byte [ebp - 4], 0x66
je 0xb6d21e
add eax, 0xfffffff4
push eax
call fcn.0042db7e
pop ecx
lea ecx, [esi + 0x3d64]
mov byte [ebp - 4], 0x65
mov dword [ecx], 0xc83654
call fcn.00419952
lea ecx, [esi + 0x3d40]
mov byte [ebp - 4], 0x64
mov dword [ecx], 0xc94190
call fcn.00b846e1
mov eax, dword [esi + 0x3d3c]
cmp eax, ebx
mov byte [ebp - 4], 0x63
je 0xb6d260
add eax, 0xfffffff4
push eax
call fcn.0042db7e
pop ecx
push edi
lea ecx, [esi + 0x3d00]
mov byte [ebp - 4], 0x62
call fcn.00b6d171
lea ecx, [esi + 0x3ce8]
mov byte [ebp - 4], 0x61
call fcn.00b84567
lea ecx, [esi + 0x3cb4]
mov byte [ebp - 4], 0x60
call fcn.00b844c3
lea ecx, [esi + 0x3c98]
mov byte [ebp - 4], 0x5f
call fcn.00b844a1
lea ecx, [esi + 0x3c8c]
call fcn.0040283f
lea ecx, [esi + 0x3c88]
call fcn.0040283f
lea ecx, [esi + 0x3c5c]
mov edi, 0xc8b9a8
mov byte [ebp - 4], 0x5c
mov dword [ecx], edi
call fcn.007deb58
lea ecx, [esi + 0x3c40]
mov byte [ebp - 4], 0x5b
mov dword [ecx], edi
call fcn.007deb58
lea ecx, [esi + 0x3c24]
mov edi, 0xc8b9ac
mov byte [ebp - 4], 0x5a
mov dword [ecx], edi
call fcn.007de950
lea ecx, [esi + 0x3c0c]
mov byte [ebp - 4], 0x59
mov dword [ecx], edi
call fcn.007de950
lea ecx, [esi + 0x3bf4]
mov byte [ebp - 4], 0x58
mov dword [ecx], edi
call fcn.007de950
lea ecx, [esi + 0x3bd4]
mov byte [ebp - 4], 0x57
mov dword [ecx], 0xc88fa4
call fcn.005256ec
mov eax, dword [esi + 0x3bb4]
cmp eax, ebx
mov byte [ebp - 4], 0x56
je 0xb6d33f
add eax, 0xfffffff4
push eax
call fcn.0042db7e
pop ecx
mov eax, dword [esi + 0x3bb0]
cmp eax, ebx
mov byte [ebp - 4], 0x55
je 0xb6d357
add eax, 0xfffffff4
push eax
call fcn.0042db7e
pop ecx
lea ecx, [esi + 0x3ba4]
mov byte [ebp - 4], 0x54
call fcn.00487d50
lea ecx, [esi + 0x3ba0]
mov byte [ebp - 4], 0x53
call fcn.00487b8d
lea ecx, [esi + 0x3b9c]
mov byte [ebp - 4], 0x52
call fcn.00487b8d
lea ecx, [esi + 0x3b98]
mov byte [ebp - 4], 0x51
call fcn.006358ea
lea ecx, [esi + 0x3b94]
mov byte [ebp - 4], 0x50
call fcn.004691dd
lea ecx, [esi + 0x3b88]
mov byte [ebp - 4], 0x4f
call fcn.0058d8f3
lea ecx, [esi + 0x3b7c]
mov byte [ebp - 4], 0x4e
call fcn.0089f081
lea ecx, [esi + 0x3b68]
mov byte [ebp - 4], 0x4d
mov dword [ecx], 0xc94194
call fcn.00b843f5
lea ecx, [esi + 0x3b4c]
mov byte [ebp - 4], 0x4c
mov dword [ecx], 0xc86650
call fcn.0056ecd1
lea ecx, [esi + 0x3b40]
mov byte [ebp - 4], 0x4b
call fcn.00b82852
lea ecx, [esi + 0x3b38]
mov byte [ebp - 4], 0x4a
call fcn.00b8283c
lea ecx, [esi + 0x3b30]
mov byte [ebp - 4], 0x49
call fcn.00b82826
lea ecx, [esi + 0x3b2c]
mov byte [ebp - 4], 0x48
call fcn.00b843bb
lea ecx, [esi + 0x3b24]
mov byte [ebp - 4], 0x47
call fcn.00b82810
lea ecx, [esi + 0x3b14]
mov byte [ebp - 4], 0x46
call fcn.00b827fa
lea ecx, [esi + 0x3b0c]
mov byte [ebp - 4], 0x45
call fcn.00b827e4
lea ecx, [esi + 0x3b04]
mov byte [ebp - 4], 0x44
call fcn.00b827ce
lea ecx, [esi + 0x3afc]
mov byte [ebp - 4], 0x43
call fcn.00b827b8
lea ecx, [esi + 0x3af4]
mov byte [ebp - 4], 0x42
call fcn.00b827a2
lea ecx, [esi + 0x3aec]
mov byte [ebp - 4], 0x41
call fcn.00b8278c
lea ecx, [esi + 0x3ae4]
mov byte [ebp - 4], 0x40
call fcn.00b82776
lea ecx, [esi + 0x3adc]
mov byte [ebp - 4], 0x3f
call fcn.00b82760
lea ecx, [esi + 0x3ad4]
mov byte [ebp - 4], 0x3e
call fcn.00b8274a
lea ecx, [esi + 0x3acc]
mov byte [ebp - 4], 0x3d
call fcn.00b82734
cmp dword [esi + 0x3ac8], ebx
lea edi, [esi + 0x3ac4]
mov byte [ebp - 4], 0x3c
je 0xb6d4e8
push ebx
mov ecx, edi
call fcn.00b8340f
mov dword [edi + 4], ebx
lea ecx, [esi + 0x3abc]
mov byte [ebp - 4], 0x3b
call fcn.00b8271e
lea ecx, [esi + 0x3ab4]
mov byte [ebp - 4], 0x3a
call fcn.00b82708
lea ecx, [esi + 0x3aac]
mov byte [ebp - 4], 0x39
call fcn.00b826f2
lea ecx, [esi + 0x3aa4]
mov byte [ebp - 4], 0x38
call fcn.00b826dc
lea ecx, [esi + 0x3a9c]
mov byte [ebp - 4], 0x37
call fcn.00b826c6
lea ecx, [esi + 0x3a94]
mov byte [ebp - 4], 0x36
call fcn.00957033
lea ecx, [esi + 0x3a8c]
mov byte [ebp - 4], 0x35
call fcn.009aba5c
lea ecx, [esi + 0x3a84]
mov byte [ebp - 4], 0x34
call fcn.00b826b0
lea ecx, [esi + 0x3a7c]
mov byte [ebp - 4], 0x33
call fcn.00b8269a
lea ecx, [esi + 0x3a74]
mov byte [ebp - 4], 0x32
call fcn.00b82684
lea ecx, [esi + 0x3a6c]
mov byte [ebp - 4], 0x31
call fcn.00b8266e
lea ecx, [esi + 0x3a64]
mov byte [ebp - 4], 0x30
call fcn.00b82658
lea ecx, [esi + 0x3a5c]
mov byte [ebp - 4], 0x2f
call fcn.00b82642
lea ecx, [esi + 0x3a54]
mov byte [ebp - 4], 0x2e
call fcn.005348ec
cmp dword [esi + 0x3a50], ebx
lea edi, [esi + 0x3a4c]
mov byte [ebp - 4], 0x2d
je 0xb6d5d7
push ebx
mov ecx, edi
call fcn.00b82f6b
mov dword [edi + 4], ebx
cmp dword [esi + 0x3a48], ebx
lea edi, [esi + 0x3a44]
mov byte [ebp - 4], 0x2c
je 0xb6d5f4
push ebx
mov ecx, edi
call fcn.00b82f3c
mov dword [edi + 4], ebx
cmp dword [esi + 0x3a40], ebx
lea edi, [esi + 0x3a3c]
mov byte [ebp - 4], 0x2b
je 0xb6d611
push ebx
mov ecx, edi
call fcn.00b82f0d
mov dword [edi + 4], ebx
cmp dword [esi + 0x3a38], ebx
lea edi, [esi + 0x3a34]
mov byte [ebp - 4], 0x2a
je 0xb6d62e
push ebx
mov ecx, edi
call fcn.00b82ede
mov dword [edi + 4], ebx
cmp dword [esi + 0x3a30], ebx
lea edi, [esi + 0x3a2c]
mov byte [ebp - 4], 0x29
je 0xb6d64b
push ebx
mov ecx, edi
call fcn.00b82eaf
mov dword [edi + 4], ebx
cmp dword [esi + 0x3a28], ebx
lea edi, [esi + 0x3a24]
mov byte [ebp - 4], 0x28
je 0xb6d668
push ebx
mov ecx, edi
call fcn.00b82e80
mov dword [edi + 4], ebx
cmp dword [esi + 0x3a20], ebx
lea edi, [esi + 0x3a1c]
mov byte [ebp - 4], 0x27
je 0xb6d685
push ebx
mov ecx, edi
call fcn.00b82e51
mov dword [edi + 4], ebx
cmp dword [esi + 0x3a18], ebx
lea edi, [esi + 0x3a14]
mov byte [ebp - 4], 0x26
je 0xb6d6a2
push ebx
mov ecx, edi
call fcn.00b82e22
mov dword [edi + 4], ebx
cmp dword [esi + 0x3a10], ebx
lea edi, [esi + 0x3a0c]
mov byte [ebp - 4], 0x25
je 0xb6d6bf
push ebx
mov ecx, edi
call fcn.00b82df3
mov dword [edi + 4], ebx
cmp dword [esi + 0x3a08], ebx
lea edi, [esi + 0x3a04]
mov byte [ebp - 4], 0x24
je 0xb6d6dc
push ebx
mov ecx, edi
call fcn.00b82dc4
mov dword [edi + 4], ebx
cmp dword [esi + 0x3a00], ebx
lea edi, [esi + 0x39fc]
mov byte [ebp - 4], 0x23
je 0xb6d6f9
push ebx
mov ecx, edi
call fcn.00b82d95
mov dword [edi + 4], ebx
cmp dword [esi + 0x39f8], ebx
lea edi, [esi + 0x39f4]
mov byte [ebp - 4], 0x22
je 0xb6d716
push ebx
mov ecx, edi
call fcn.00b82d66
mov dword [edi + 4], ebx
lea ecx, [esi + 0x39e8]
mov byte [ebp - 4], 0x21
call fcn.00406a50
mov eax, dword [esi + 0x39a4]
cmp eax, ebx
mov byte [ebp - 4], 0x1f
je 0xb6d742
mov edi, 0xd86a88
push eax
mov ecx, edi
call fcn.00403243
jmp 0xb6d747
mov edi, 0xd86a88
mov eax, dword [esi + 0x3998]
cmp eax, ebx
mov byte [ebp - 4], 0x1e
je 0xb6d75d
push eax
mov ecx, edi
call fcn.00403243
mov eax, dword [esi + 0x398c]
cmp eax, ebx
mov byte [ebp - 4], 0x1d
je 0xb6d773
push eax
mov ecx, edi
call fcn.00403243
mov eax, dword [esi + 0x3980]
cmp eax, ebx
mov byte [ebp - 4], 0x1c
je 0xb6d789
push eax
mov ecx, edi
call fcn.00403243
mov eax, dword [esi + 0x3974]
cmp eax, ebx
mov byte [ebp - 4], 0x1b
je 0xb6d79f
push eax
mov ecx, edi
call fcn.00403243
mov eax, dword [esi + 0x3968]
cmp eax, ebx
mov byte [ebp - 4], 0x1a
je 0xb6d7b5
push eax
mov ecx, edi
call fcn.00403243
mov edi, fcn.0042d282
push edi
push 4
push 8
lea eax, [esi + 0x3880]
push eax
mov byte [ebp - 4], 0x18
call fcn.00be189b
push edi
push 0x26
push 8
lea eax, [esi + 0x3750]
push eax
mov byte [ebp - 4], 0x17
call fcn.00be189b
push edi
push 0x26
push 8
lea eax, [esi + 0x3620]
push eax
mov byte [ebp - 4], 0x16
call fcn.00be189b
lea ecx, [esi + 0x361c]
mov byte [ebp - 4], 0x15
call fcn.00406a50
lea ecx, [esi + 0x3608]
mov byte [ebp - 4], 0x14
call fcn.00406a50
lea ecx, [esi + 0x35fc]
mov byte [ebp - 4], 0x13
call fcn.00b8437f
lea ecx, [esi + 0x35e4]
mov byte [ebp - 4], 0x12
call fcn.00b6d117
push fcn.004026b4
push 1
push 4
lea eax, [esi + 0x35dc]
push eax
mov byte [ebp - 4], 0x11
call fcn.00be189b
lea ecx, [esi + 0x35d4]
mov byte [ebp - 4], 0x10
call fcn.004026b4
lea ecx, [esi + 0x35cc]
mov byte [ebp - 4], 0xf
call fcn.004026b4
lea ecx, [esi + 0x35c4]
mov byte [ebp - 4], 0xe
call fcn.004026b4
lea ecx, [esi + 0x3598]
mov byte [ebp - 4], 0xd
call fcn.00b6d0ba
mov eax, dword [esi + 0x3594]
cmp eax, ebx
mov byte [ebp - 4], 0xc
je 0xb6d89e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x3590]
cmp eax, ebx
mov byte [ebp - 4], 0xb
je 0xb6d8b2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [esi + 0x3588]
mov byte [ebp - 4], 0xa
call fcn.00b823c8
lea ecx, [esi + 0x3560]
mov byte [ebp - 4], 9
call fcn.00406a50
cmp dword [esi + 0x3554], ebx
lea edi, [esi + 0x3550]
mov byte [ebp - 4], 8
je 0xb6d8ed
push ebx
mov ecx, edi
call fcn.00b82cca
mov dword [edi + 4], ebx
lea ecx, [esi + 0x3400]
mov byte [ebp - 4], 7
call fcn.00406a50
lea ecx, [esi + 0x33fc]
mov byte [ebp - 4], 6
call fcn.00406a50
lea ecx, [esi + 0x33cc]
mov byte [ebp - 4], 5
call fcn.00b6cf05
push 0x7c9bc3
push 8
push 8
lea eax, [esi + 0x32f0]
push eax
mov byte [ebp - 4], 4
call fcn.00be189b
cmp dword [esi + 0x20ac], ebx
lea edi, [esi + 0x20a8]
mov byte [ebp - 4], 3
je 0xb6d950
push ebx
mov ecx, edi
call fcn.0042daaf
mov dword [edi + 4], ebx
lea ecx, [esi + 0x204c]
mov byte [ebp - 4], 2
call fcn.00406a50
lea ecx, [esi + 0x2048]
mov byte [ebp - 4], 1
call fcn.00406a50
mov esi, dword [esi + 0x2044]
cmp esi, ebx
mov byte [ebp - 4], bl
pop edi
je 0xb6d987
push esi
mov ecx, 0xd86a88
call fcn.00403243
mov ecx, dword [ebp - 0xc]
pop esi
mov dword [0xd7c46c], ebx
pop ebx
mov dword fs:[0], ecx
leave
ret