Function at 0x443720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov edx, 0x4c49
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x7c
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x28], 0x52455355
mov dword [ebp - 0x24], 0x464f5250
lea eax, [ebx + 8]
mov dword [ebx + 4], 0
mov dword [ebx], eax
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x6c], eax
mov esi, eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
mov byte [ebx + 8], 0
mov dword [esp], eax
mov word [ebp - 0x20], dx
mov byte [ebp - 0x1e], 0x45
mov dword [ebp - 0x2c], 0xb
mov byte [ebp - 0x1d], 0
call fcn.0044de40
mov edi, eax
mov eax, dword [ebp - 0x30]
cmp eax, esi
je 0x443796
mov ecx, dword [ebp - 0x28]
mov dword [esp], eax
lea edx, [ecx + 1]
mov dword [esp + 4], edx
call fcn.00513b70
mov eax, edi
test al, al
je 0x4438a0
mov eax, dword [ebp - 0x6c]
lea edi, [ebp - 0x30]
mov byte [ebp - 0x1e], 0x45
mov dword [esp + 4], edi
mov dword [ebp - 0x30], eax
mov eax, 0x4c49
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x60]
mov dword [esp], eax
mov dword [ebp - 0x28], 0x52455355
mov dword [ebp - 0x24], 0x464f5250
mov dword [ebp - 0x2c], 0xb
mov byte [ebp - 0x1d], 0
call fcn.0044dd50
mov ecx, dword [ebp - 0x60]
lea esi, [ebp - 0x58]
mov eax, dword [ebx]
mov edx, dword [ebp - 0x5c]
cmp ecx, esi
je 0x443960
mov edi, dword [ebp - 0x58]
mov dword [ebp - 0x74], edi
cmp dword [ebp - 0x70], eax
je 0x443b70
mov dword [ebx], ecx
mov ecx, dword [ebp - 0x74]
mov edi, dword [ebx + 8]
mov dword [ebx + 4], edx
mov dword [ebx + 8], ecx
test eax, eax
je 0x443b78
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x5c], 0
mov byte [eax], 0
mov eax, dword [ebp - 0x60]
cmp eax, esi
je 0x44383f
mov edi, dword [ebp - 0x58]
mov dword [esp], eax
lea edx, [edi + 1]
mov dword [esp + 4], edx
call fcn.00513b70
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x6c]
je 0x443859
mov edi, dword [ebp - 0x28]
mov dword [esp], eax
lea edx, [edi + 1]
mov dword [esp + 4], edx
call fcn.00513b70
mov eax, dword [ebx + 4]
test eax, eax
je 0x44388d
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x44388d
cmp eax, 0x3fffffff
je 0x443c20
mov dword [esp + 4], 1
mov ecx, ebx
mov dword [esp], 0x53cc97
call fcn.004f4db0
sub esp, 8
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x48]
lea edi, [ebp - 0x40]
mov byte [ebp - 0x38], 0x45
mov dword [esp], eax
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x40], 0x454d4f48
mov dword [ebp - 0x3c], 0x56495244
mov dword [ebp - 0x44], 9
mov byte [ebp - 0x37], 0
call fcn.0044de40
test al, al
jne 0x4439d0
mov eax, dword [ebp - 0x48]
cmp eax, edi
je 0x4438ef
mov ecx, dword [ebp - 0x40]
mov dword [esp], eax
lea edx, [ecx + 1]
mov dword [esp + 4], edx
call fcn.00513b70
lea eax, [ebp - 0x30]
mov dword [esp], eax
call fcn.00443610
mov eax, dword [ebx]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
cmp ecx, dword [ebp - 0x6c]
je 0x443998
mov esi, dword [ebp - 0x28]
cmp dword [ebp - 0x70], eax
je 0x443bd0
mov edi, dword [ebx + 8]
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov dword [ebx + 8], esi
test eax, eax
je 0x443bd8
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], 0
mov byte [eax], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x6c]
je 0x443859
mov esi, dword [ebp - 0x28]
mov dword [esp], eax
lea edx, [esi + 1]
mov dword [esp + 4], edx
call fcn.00513b70
jmp 0x443859
test edx, edx
je 0x443982
cmp edx, 1
je 0x443bf0
mov dword [esp + 8], edx
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x5c]
mov eax, dword [ebx]
mov dword [ebx + 4], edx
mov byte [eax + edx], 0
mov eax, dword [ebp - 0x60]
jmp 0x44381c
test edx, edx
je 0x4439bd
cmp edx, 1
je 0x443c10
mov esi, dword [ebp - 0x6c]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], esi
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebx]
mov dword [ebx + 4], edx
mov byte [eax + edx], 0
mov eax, dword [ebp - 0x30]
jmp 0x443930
lea eax, [ebp - 0x30]
mov esi, dword [ebp - 0x6c]
mov dword [ebp - 0x28], 0x454d4f48
mov dword [esp], eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x24], 0x48544150
mov dword [ebp - 0x2c], 8
mov byte [ebp - 0x20], 0
call fcn.0044de40
mov edx, dword [ebp - 0x30]
mov byte [ebp - 0x74], al
cmp edx, esi
je 0x443a16
mov eax, dword [ebp - 0x28]
mov dword [esp], edx
add eax, 1
mov dword [esp + 4], eax
call fcn.00513b70
mov eax, dword [ebp - 0x48]
cmp eax, edi
je 0x443a2f
mov esi, dword [ebp - 0x40]
mov dword [esp], eax
lea edx, [esi + 1]
mov dword [esp + 4], edx
call fcn.00513b70
cmp byte [ebp - 0x74], 0
je 0x4438ef
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x28], 0x454d4f48
mov dword [ebp - 0x24], 0x56495244
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
mov dword [esp + 4], eax
lea eax, [ebp - 0x48]
mov dword [esp], eax
mov byte [ebp - 0x20], 0x45
mov dword [ebp - 0x2c], 9
mov byte [ebp - 0x1f], 0
call fcn.0044dd50
mov edx, dword [ebp - 0x48]
mov eax, dword [ebx]
mov ecx, dword [ebp - 0x44]
cmp edx, edi
je 0x443b88
mov esi, dword [ebp - 0x40]
mov dword [ebp - 0x74], esi
cmp dword [ebp - 0x70], eax
je 0x443bb8
mov dword [ebx + 4], ecx
mov ecx, dword [ebp - 0x74]
mov esi, dword [ebx + 8]
mov dword [ebx], edx
mov dword [ebx + 8], ecx
test eax, eax
je 0x443bc0
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x44], 0
mov byte [eax], 0
mov eax, dword [ebp - 0x48]
cmp eax, edi
je 0x443acc
mov esi, dword [ebp - 0x40]
mov dword [esp], eax
lea edx, [esi + 1]
mov dword [esp + 4], edx
call fcn.00513b70
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x6c]
je 0x443ae6
mov esi, dword [ebp - 0x28]
mov dword [esp], eax
lea edx, [esi + 1]
mov dword [esp + 4], edx
call fcn.00513b70
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], edi
mov dword [esp + 4], eax
lea eax, [ebp - 0x30]
mov dword [esp], eax
mov dword [ebp - 0x40], 0x454d4f48
mov dword [ebp - 0x3c], 0x48544150
mov dword [ebp - 0x44], 8
mov byte [ebp - 0x38], 0
call fcn.0044dd50
mov eax, dword [ebp - 0x2c]
mov ecx, ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call fcn.004f4db0
mov eax, dword [ebp - 0x30]
sub esp, 8
cmp eax, dword [ebp - 0x6c]
je 0x443b45
mov esi, dword [ebp - 0x28]
mov dword [esp], eax
lea edx, [esi + 1]
mov dword [esp + 4], edx
call fcn.00513b70
mov eax, dword [ebp - 0x48]
cmp eax, edi
je 0x443859
mov esi, dword [ebp - 0x40]
mov dword [esp], eax
lea edx, [esi + 1]
mov dword [esp + 4], edx
call fcn.00513b70
jmp 0x443859
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov dword [ebx + 8], edi
mov dword [ebp - 0x60], esi
lea esi, [ebp - 0x58]
mov eax, esi
jmp 0x44381c
test ecx, ecx
je 0x443ba6
cmp ecx, 1
je 0x443c00
mov dword [esp + 8], ecx
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebx]
mov dword [ebx + 4], ecx
mov byte [eax + ecx], 0
mov eax, dword [ebp - 0x48]
jmp 0x443aa9
mov dword [ebx], edx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], esi
mov dword [ebp - 0x48], edi
lea edi, [ebp - 0x40]
mov eax, edi
jmp 0x443aa9
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov dword [ebx + 8], esi
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x6c], eax
jmp 0x443930
movzx edx, byte [ebp - 0x58]
mov byte [eax], dl
mov edx, dword [ebp - 0x5c]
mov eax, dword [ebx]
jmp 0x443982
movzx edx, byte [ebp - 0x40]
mov byte [eax], dl
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebx]
jmp 0x443ba6
movzx edx, byte [ebp - 0x28]
mov byte [eax], dl
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebx]
jmp 0x4439bd
mov dword [esp], 0x53cc82
call fcn.00528c60
mov esi, eax
jmp 0x5244a4
mov edx, dword [ebp - 0x30]
cmp edx, dword [ebp - 0x6c]
je 0x5244be
mov eax, dword [ebp - 0x28]
mov dword [esp], edx
add eax, 1
mov dword [esp + 4], eax
call fcn.00513b70
mov edx, dword [ebx]
cmp dword [ebp - 0x70], edx
je 0x5244d7
mov eax, dword [ebx + 8]
mov dword [esp], edx
add eax, 1
mov dword [esp + 4], eax
call fcn.00513b70
mov dword [esp], esi
call fcn.00461820
mov edx, dword [ebp - 0x30]
cmp edx, dword [ebp - 0x6c]
je 0x5244f9
mov eax, dword [ebp - 0x28]
mov dword [esp], edx
add eax, 1
mov dword [esp + 4], eax
call fcn.00513b70
mov edx, dword [ebp - 0x48]
cmp edx, edi
je 0x5244be
mov eax, dword [ebp - 0x40]
mov dword [esp], edx
add eax, 1
mov dword [esp + 4], eax
call fcn.00513b70
jmp 0x5244be