Function at 0x42cd14
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x4e9dcd
call fcn.0047b598
sub esp, 0x174
cmp dword [0x53b9e4], 2
push ebx
push esi
mov esi, ecx
jne 0x42cf63
mov eax, dword [0x53b9e8]
xor ebx, ebx
mov eax, dword [eax + 4]
cmp eax, ebx
je 0x42cf63
mov cl, byte [eax]
cmp cl, 0x2d
je 0x42cd57
cmp cl, 0x2f
jne 0x42cf63
lea ecx, [ebp - 0x48]
inc eax
push ecx
push eax
mov byte [ebp - 0x48], 0x70
mov byte [ebp - 0x47], 0x6f
mov byte [ebp - 0x46], 0x70
mov byte [ebp - 0x45], 0x66
mov byte [ebp - 0x44], 0x6c
mov byte [ebp - 0x43], 0x61
mov byte [ebp - 0x42], 0x73
mov byte [ebp - 0x41], 0x68
mov byte [ebp - 0x40], bl
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x42cf63
push 0x5c
call fcn.004dcbe4
pop ecx
mov ecx, eax
mov dword [ebp - 0x54], ecx
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x42cdaa
push ebx
call fcn.004128b6
jmp 0x42cdac
xor eax, eax
or dword [ebp - 4], 0xffffffff
push edi
push ebx
push pe_nt_image_headers32
mov ecx, eax
mov dword [esi + 0x790], eax
mov dword [esi + 0x1c], eax
call fcn.004dcdf2
mov ecx, esi
call fcn.004e3d20
push 0x4a
xor eax, eax
pop ecx
lea edi, [ebp - 0x17f]
mov byte [ebp - 0x180], bl
mov byte [ebp - 0x18], 0x61
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x3c]
mov edi, 0x534198
push eax
lea eax, [ebp - 0x180]
push 0xff
push eax
lea eax, [ebp - 0x24]
push edi
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0x12], 0x6c
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x68
mov byte [ebp - 0xe], bl
mov byte [ebp - 0x3c], 0x70
mov byte [ebp - 0x3b], 0x6f
mov byte [ebp - 0x3a], 0x77
mov byte [ebp - 0x39], 0x65
mov byte [ebp - 0x38], 0x72
mov byte [ebp - 0x37], 0x70
mov byte [ebp - 0x36], 0x6c
mov byte [ebp - 0x35], 0x61
mov byte [ebp - 0x34], 0x79
mov byte [ebp - 0x33], 0x65
mov byte [ebp - 0x32], 0x72
mov byte [ebp - 0x31], 0x2e
mov byte [ebp - 0x30], 0x69
mov byte [ebp - 0x2f], 0x6e
mov byte [ebp - 0x2e], 0x69
mov byte [ebp - 0x2d], bl
mov byte [ebp - 0x24], 0x70
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x68
mov byte [ebp - 0x20], bl
mov byte [ebp - 0x1c], 0x75
mov byte [ebp - 0x1b], 0x72
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x77
mov byte [ebp - 0x2a], 0x6e
mov byte [ebp - 0x29], 0x64
mov byte [ebp - 0x28], bl
call fcn.00405a57
lea eax, [ebp - 0x180]
lea ecx, [ebp - 0x4c]
push eax
call fcn.004dc6dc
mov esi, 0x12c
mov dword [ebp - 4], 1
push esi
push ebx
lea eax, [ebp - 0x180]
push eax
call fcn.0047b7a0
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x180]
push 0xff
push eax
lea eax, [ebp - 0x1c]
push edi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00405a57
lea eax, [ebp - 0x180]
lea ecx, [ebp - 0x50]
push eax
call fcn.004dc6dc
push esi
lea eax, [ebp - 0x180]
push ebx
push eax
mov byte [ebp - 4], 2
call fcn.0047b7a0
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x2c]
push ebx
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00403a68
mov ebx, eax
call fcn.00406132
mov esi, dword [ebp - 0x50]
mov edi, dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push esi
push ebx
push edi
call fcn.0040616c
add esp, 0x10
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 1
call fcn.004dc66e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.004dc66e
push 1
pop eax
pop edi
jmp 0x42cf65
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret