Function at 0x5c494c
Capabilities:
Contain obfuscated stackstrings
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov eax, dword [0x7a8498]
xor eax, ebp
mov dword [esp + 0x148], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x7c047c]
test eax, eax
je 0x5c49b4
test ecx, ecx
je 0x5c4987
mov dword [ecx], eax
test esi, esi
je 0x5c4993
mov ecx, dword [0x7c0480]
mov dword [esi], ecx
test edi, edi
je 0x5c499f
mov ecx, dword [0x7c0484]
mov dword [edi], ecx
test edx, edx
je 0x5c4a5e
mov ecx, dword [0x7c0488]
mov dword [edx], ecx
jmp 0x5c4a5e
mov edi, dword [0x7c048c]
test edi, edi
jne 0x5c4a1c
mov eax, esp
mov word [eax + 8], 0x6c
mov dword [eax + 4], 0x6c642e6c
mov dword [eax], 0x6c64746e
mov word [esp + 0x38], 0x6e
mov dword [esp + 0x34], 0x6f697372
mov dword [esp + 0x30], 0x65567465
mov dword [esp + 0x2c], 0x476c7452
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x5c4a12
lea ecx, [esp + 0x2c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov dword [0x7c048c], eax
jmp 0x5c4a18
mov edi, dword [0x7c048c]
test edi, edi
je 0x5c4a50
lea ebx, [esp + 0x30]
push 0x118
push 0xff
push ebx
call fcn.006ccfc0
add esp, 0xc
mov dword [ebx - 4], 0x11c
mov ecx, edi
call dword [section..00cfg]
lea eax, [esp + 0x2c]
push eax
call edi
test eax, eax
je 0x5c4a86
mov ebx, dword [ebp + 8]
mov eax, dword [0x7c047c]
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x5c4a5e
mov dword [ecx], eax
mov ecx, ebx
push 0xffffffffffffffff
push dword [eax*4 + 0x7aa210]
call fcn.004aea40
mov ecx, dword [esp + 0x148]
xor ecx, ebp
call fcn.006c9121
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [esp + 0x38]
mov dword [0x7c0480], ecx
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
mov dword [0x7c0484], edx
mov dword [0x7c0488], eax
test esi, esi
je 0x5c4aa9
mov dword [esi], ecx
mov edi, dword [ebp + 0x14]
test edi, edi
mov esi, dword [ebp + 0x18]
je 0x5c4ab5
mov dword [edi], edx
test esi, esi
je 0x5c4abb
mov dword [esi], eax
add edx, 0xfffffffc
cmp edx, 7
ja case.default.0x5c4b33
jmp dword [edx*4 + 0x753af4]
cmp eax, 0x5a
je 0x5c4b99
cmp eax, 0xa
je 0x5c4ba8
test eax, eax
jne case.default.0x5c4b33
mov eax, dword [esp + 0x3c]
cmp eax, 1
je 0x5c4cb8
cmp eax, 2
jne 0x5c4a4d
mov dword [0x7c047c], 1
jmp 0x5c4a4d
cmp eax, 2
je 0x5c4bb7
cmp eax, 1
je 0x5c4c15
test eax, eax
jne case.default.0x5c4b33
mov dword [0x7c047c], 5
jmp 0x5c4a4d
cmp eax, 3
ja case.default.0x5c4b33
jmp dword [eax*4 + 0x753b14]
cmp byte [esp + 0x146], 1
jne 0x5c4c7c
mov dword [0x7c047c], 0xa
jmp 0x5c4a4d
mov dword [0x7c047c], 0
jmp 0x5c4a4d
cmp ecx, 0x55f0
jb 0x5c4b7d
mov dword [0x7c047c], 0x15
jmp 0x5c4a4d
call fcn.005c4cd6
test al, al
je 0x5c4c24
mov dword [0x7c047c], 0x12
jmp 0x5c4a4d
mov dword [0x7c047c], 4
jmp 0x5c4a4d
mov dword [0x7c047c], 3
jmp 0x5c4a4d
pcmpeqd xmm0, xmm0
mov eax, esp
movdqa xmmword [eax + 0x10], xmm0
movdqa xmmword [eax], xmm0
mov dword [eax + 0x20], 0xffffffff
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp byte [esp + 0x146], 1
jne 0x5c4bee
mov eax, 7
cmp word [esp], 9
je 0x5c4ccc
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x5c4cc7
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
test eax, eax
setne cl
lea eax, [ecx + ecx*8]
jmp 0x5c4ccc
mov dword [0x7c047c], 6
jmp 0x5c4a4d
mov dword [0x7c047c], 0x14
jmp 0x5c4a4d
cmp byte [esp + 0x146], 1
jne 0x5c4c8b
mov dword [0x7c047c], 0xc
jmp 0x5c4a4d
call fcn.005c4cd6
test al, al
je 0x5c4c9a
mov dword [0x7c047c], 0xe
jmp 0x5c4a4d
call fcn.005c4cd6
test al, al
je 0x5c4ca9
mov dword [0x7c047c], 0x10
jmp 0x5c4a4d
mov dword [0x7c047c], 0xb
jmp 0x5c4a4d
mov dword [0x7c047c], 0xd
jmp 0x5c4a4d
mov dword [0x7c047c], 0xf
jmp 0x5c4a4d
mov dword [0x7c047c], 0x11
jmp 0x5c4a4d
mov dword [0x7c047c], 2
jmp 0x5c4a4d
mov eax, 8
mov dword [0x7c047c], eax
jmp 0x5c4a4d