Function at 0x443370
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4751e1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push ebx
push ebp
mov ebp, ecx
push esi
push edi
xor edi, edi
lea esi, [ebp + 0x74]
mov ebx, 4
push edi
mov ecx, esi
mov byte [esp + 0x1c], 0
mov byte [esp + 0x1d], bl
mov byte [esp + 0x1e], bl
mov byte [esp + 0x1f], bl
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], 5
mov byte [esp + 0x22], 5
mov byte [esp + 0x23], 5
mov byte [esp + 0x24], 5
mov byte [esp + 0x25], 6
mov byte [esp + 0x26], 6
mov byte [esp + 0x27], 6
mov byte [esp + 0x28], 7
mov byte [esp + 0x29], 7
mov byte [esp + 0x2a], 7
mov byte [esp + 0x2b], 7
mov byte [esp + 0x2c], 8
mov byte [esp + 0x2d], 8
mov byte [esp + 0x2e], 8
mov byte [esp + 0x2f], 8
mov byte [esp + 0x30], 9
mov byte [esp + 0x31], 9
mov byte [esp + 0x32], 9
mov byte [esp + 0x33], 9
mov byte [esp + 0x34], 0xa
mov byte [esp + 0x35], 0xa
mov byte [esp + 0x36], 0xa
mov byte [esp + 0x37], 0xa
mov byte [esp + 0x38], 0xb
mov byte [esp + 0x39], 0xb
mov byte [esp + 0x3a], 0xb
mov byte [esp + 0x3b], 0xb
mov byte [esp + 0x3c], 0
mov byte [esp + 0x3d], 0x40
mov byte [esp + 0x3e], 0x10
mov byte [esp + 0x3f], bl
mov byte [esp + 0x40], 1
mov byte [esp + 0x41], 0x40
mov byte [esp + 0x42], 0x10
mov byte [esp + 0x43], bl
mov byte [esp + 0x44], 1
mov byte [esp + 0x45], 0x10
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], 1
mov byte [esp + 0x48], 0x40
mov byte [esp + 0x49], 0x10
mov byte [esp + 0x4a], bl
mov byte [esp + 0x4b], 1
mov byte [esp + 0x4c], 0x40
mov byte [esp + 0x4d], 0x10
mov byte [esp + 0x4e], bl
mov byte [esp + 0x4f], 1
mov byte [esp + 0x50], 0x40
mov byte [esp + 0x51], 0x10
mov byte [esp + 0x52], bl
mov byte [esp + 0x53], 1
mov byte [esp + 0x54], 0x40
mov byte [esp + 0x55], 0x10
mov byte [esp + 0x56], bl
mov byte [esp + 0x57], 1
mov byte [esp + 0x58], 0x40
mov byte [esp + 0x59], 0x10
mov byte [esp + 0x5a], bl
mov byte [esp + 0x5b], 1
call fcn.0044e8c0
movzx ax, al
push eax
mov ecx, esi
call fcn.0044e8c0
xor ecx, ecx
mov cl, byte [ebp + 0x40]
sub ecx, edi
je 0x443e83
sub ecx, 0x20
je 0x443b33
dec ecx
je 0x4438e0
push 6
push 0x487654
lea ecx, [esp + 0x74]
call fcn.0044e650
mov ecx, dword [ebp + 0x84]
lea ebx, [ebp + 0x7c]
push eax
push 1
push ecx
mov ecx, ebx
mov dword [esp + 0x134], 0xe
call fcn.00413f00
or edi, 0xffffffff
lea ecx, [esp + 0x6c]
mov dword [esp + 0x128], edi
call fcn.0044e6f0
push 6
push 0x48764c
lea ecx, [esp + 0x64]
call fcn.0044e650
mov ecx, dword [ebx + 8]
push eax
push 1
push ecx
mov ecx, ebx
mov dword [esp + 0x134], 0xf
call fcn.00413f00
lea ecx, [esp + 0x5c]
mov dword [esp + 0x128], edi
call fcn.0044e6f0
xor ecx, ecx
mov cl, byte [ebp + 0x40]
movzx dx, byte [esp + ecx + 0x18]
push edx
mov ecx, esi
call fcn.0044e8c0
xor ecx, ecx
mov cl, byte [ebp + 0x40]
test byte [esp + ecx + 0x38], al
je 0x443745
push ecx
mov byte [0x493771], 1
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x487654
call fcn.0044e650
lea edx, [esp + 0xc4]
push edx
call fcn.0045ad10
add esp, 8
mov esi, eax
mov eax, dword [esi + 8]
mov ecx, dword [0x47814c]
mov edi, eax
mov dword [esp + 0x128], 0x10
cmp ecx, edi
lea ebx, [ebp + 0x64]
mov dword [esp + 0x10], edi
jae 0x4435f0
mov dword [esp + 0x10], ecx
mov edi, ecx
cmp ebx, esi
jne 0x443658
mov eax, dword [ebx + 8]
mov esi, ecx
cmp eax, edi
jae 0x443602
call fcn.00467640
mov ecx, ebx
call fcn.00414790
mov eax, dword [ebx + 8]
sub eax, edi
cmp eax, esi
jae 0x443614
mov esi, eax
test esi, esi
jbe 0x443648
mov ecx, dword [ebx + 4]
sub eax, esi
add ecx, edi
push eax
lea edx, [esi + ecx]
push edx
push ecx
call fcn.00467d80
mov edi, dword [ebx + 8]
add esp, 0xc
sub edi, esi
mov ecx, ebx
push 0
push edi
call fcn.00413860
test al, al
je 0x443648
push edi
mov ecx, ebx
call fcn.00413840
push 0
push 0
mov ecx, ebx
call fcn.00413720
jmp 0x4436de
test edi, edi
jbe 0x4436a0
cmp edi, eax
jne 0x4436a0
mov eax, dword [esi + 4]
test eax, eax
jne 0x44366c
mov eax, 0x478288
cmp byte [eax - 1], 0xfe
jae 0x4436a0
push 1
mov ecx, ebx
call fcn.00413460
mov eax, dword [esi + 4]
test eax, eax
jne 0x443687
mov eax, 0x478288
mov dword [ebx + 4], eax
mov ecx, dword [esi + 8]
mov dword [ebx + 8], ecx
mov esi, dword [esi + 0xc]
mov dword [ebx + 0xc], esi
mov cl, byte [eax - 1]
inc cl
mov byte [eax - 1], cl
jmp 0x4436de
push 1
push edi
mov ecx, ebx
call fcn.00413860
test al, al
je 0x4436de
mov esi, dword [esi + 4]
test esi, esi
jne 0x4436ba
mov esi, 0x478288
mov eax, dword [ebx + 4]
mov ecx, edi
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x10]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx + 8], eax
mov ebx, dword [ebx + 4]
add ebx, eax
mov byte [ebx], 0
mov eax, dword [esp + 0xc4]
xor esi, esi
cmp eax, esi
mov dword [esp + 0x128], 0xffffffff
je 0x44372b
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x443722
cmp al, 0xff
je 0x443722
dec al
mov byte [ecx], al
mov dword [esp + 0xc4], esi
mov dword [esp + 0xc8], esi
mov dword [esp + 0xcc], esi
jmp 0x4438c5
push ecx
call fcn.00467320
add esp, 4
mov dword [esp + 0xc4], esi
mov dword [esp + 0xc8], esi
mov dword [esp + 0xcc], esi
jmp 0x4438c5
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x48764c
call fcn.0044e650
lea eax, [esp + 0xf4]
push eax
call fcn.0045ad10
add esp, 8
mov esi, eax
mov eax, dword [esi + 8]
mov ecx, dword [0x47814c]
mov edi, eax
mov dword [esp + 0x128], 0x11
cmp ecx, edi
lea ebx, [ebp + 0x64]
mov dword [esp + 0x10], edi
jae 0x443791
mov dword [esp + 0x10], ecx
mov edi, ecx
cmp ebx, esi
jne 0x4437f5
mov eax, dword [ebx + 8]
mov esi, ecx
cmp eax, edi
jae 0x4437a3
call fcn.00467640
mov ecx, ebx
call fcn.00414790
mov eax, dword [ebx + 8]
sub eax, edi
cmp eax, esi
jae 0x4437b5
mov esi, eax
test esi, esi
jbe 0x4437e9
mov ecx, dword [ebx + 4]
sub eax, esi
add ecx, edi
push eax
lea edx, [ecx + esi]
push edx
push ecx
call fcn.00467d80
mov edi, dword [ebx + 8]
add esp, 0xc
sub edi, esi
mov ecx, ebx
push 0
push edi
call fcn.00413860
test al, al
je 0x4437e9
push edi
mov ecx, ebx
call fcn.00413840
mov ecx, ebx
call fcn.00414790
jmp 0x44387b
test edi, edi
jbe 0x44383d
cmp edi, eax
jne 0x44383d
mov eax, dword [esi + 4]
test eax, eax
jne 0x443809
mov eax, 0x478288
cmp byte [eax - 1], 0xfe
jae 0x44383d
push 1
mov ecx, ebx
call fcn.00413460
mov eax, dword [esi + 4]
test eax, eax
jne 0x443824
mov eax, 0x478288
mov dword [ebx + 4], eax
mov ecx, dword [esi + 8]
mov dword [ebx + 8], ecx
mov esi, dword [esi + 0xc]
mov dword [ebx + 0xc], esi
mov cl, byte [eax - 1]
inc cl
mov byte [eax - 1], cl
jmp 0x44387b
push 1
push edi
mov ecx, ebx
call fcn.00413860
test al, al
je 0x44387b
mov esi, dword [esi + 4]
test esi, esi
jne 0x443857
mov esi, 0x478288
mov eax, dword [ebx + 4]
mov ecx, edi
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x10]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 4]
mov dword [ebx + 8], eax
add eax, ecx
mov byte [eax], 0
mov eax, dword [esp + 0xf4]
xor esi, esi
cmp eax, esi
mov dword [esp + 0x128], 0xffffffff
je 0x4438b0
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x4438a7
cmp al, 0xff
je 0x4438a7
dec al
mov byte [ecx], al
jmp 0x4438b0
push ecx
call fcn.00467320
add esp, 4
mov dword [esp + 0xf4], esi
mov dword [esp + 0xf8], esi
mov dword [esp + 0xfc], esi
xor eax, eax
mov al, byte [ebp + 0x40]
mov cl, byte [esp + eax + 0x38]
mov dl, byte [esp + eax + 0x18]
push ecx
push edx
mov ecx, ebp
call fcn.004490e0
jmp 0x443f4b
test al, al
jne 0x443974
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 6
push 0x4877e4
call fcn.0044e650
lea eax, [esp + 0x74]
push eax
call fcn.0045ad10
add esp, 8
mov ecx, dword [0x47814c]
mov dword [esp + 0x128], 9
push ecx
push edi
push eax
lea ecx, [ebp + 0x64]
call fcn.00413260
mov eax, dword [esp + 0x74]
mov dword [esp + 0x128], 0xffffffff
cmp eax, edi
je 0x443963
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x44395a
cmp al, 0xff
je 0x44395a
dec al
mov byte [ecx], al
mov dword [esp + 0x74], edi
mov dword [esp + 0x78], edi
mov dword [esp + 0x7c], edi
jmp 0x443aa4
push ecx
call fcn.00467320
add esp, 4
mov dword [esp + 0x74], edi
mov dword [esp + 0x78], edi
mov dword [esp + 0x7c], edi
jmp 0x443aa4
push ecx
cmp al, 1
mov ecx, esp
jne 0x443a20
mov dword [esp + 0x18], esp
push 6
push 0x4877dc
call fcn.0044e650
lea edx, [esp + 0xe4]
push edx
call fcn.0045ad10
add esp, 8
mov ecx, dword [0x47814c]
mov dword [esp + 0x128], 0xa
push ecx
push edi
push eax
lea ecx, [ebp + 0x64]
call fcn.00413260
mov eax, dword [esp + 0xe4]
mov dword [esp + 0x128], 0xffffffff
cmp eax, edi
je 0x443a06
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x4439fd
cmp al, 0xff
je 0x4439fd
dec al
mov byte [ecx], al
mov dword [esp + 0xe4], edi
mov dword [esp + 0xe8], edi
mov dword [esp + 0xec], edi
jmp 0x443aa4
push ecx
call fcn.00467320
add esp, 4
mov dword [esp + 0xe4], edi
mov dword [esp + 0xe8], edi
mov dword [esp + 0xec], edi
jmp 0x443aa4
mov dword [esp + 0x18], esp
push 6
push 0x48760c
call fcn.0044e650
lea edx, [esp + 0xa4]
push edx
call fcn.0045ad10
add esp, 8
mov ecx, dword [0x47814c]
mov dword [esp + 0x128], 0xb
push ecx
push edi
push eax
lea ecx, [ebp + 0x64]
call fcn.00413260
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x128], 0xffffffff
cmp eax, edi
je 0x443a8f
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x443a86
cmp al, 0xff
je 0x443a86
dec al
mov byte [ecx], al
jmp 0x443a8f
push ecx
call fcn.00467320
add esp, 4
mov dword [esp + 0xa4], edi
mov dword [esp + 0xa8], edi
mov dword [esp + 0xac], edi
push 6
push 0x4877e4
lea ecx, [esp + 0x6c]
mov byte [ebp + 0x41], 0
mov byte [ebp + 0x42], 1
call fcn.0044e650
mov ecx, dword [ebp + 0x84]
lea esi, [ebp + 0x7c]
push eax
push 1
push ecx
mov ecx, esi
mov dword [esp + 0x134], 0xc
call fcn.00413f00
or edi, 0xffffffff
lea ecx, [esp + 0x64]
mov dword [esp + 0x128], edi
call fcn.0044e6f0
push 6
push 0x4877dc
lea ecx, [esp + 0x60]
call fcn.0044e650
mov ecx, dword [esi + 8]
push eax
push 1
push ecx
mov ecx, esi
mov dword [esp + 0x134], 0xd
call fcn.00413f00
lea ecx, [esp + 0x58]
mov dword [esp + 0x128], edi
call fcn.0044e6f0
mov ecx, ebp
call fcn.00448d40
jmp 0x443f4b
test al, al
jne 0x443bdf
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 6
push 0x4877d4
call fcn.0044e650
lea edx, [esp + 0xb4]
push edx
call fcn.0045ad10
add esp, 8
mov ecx, dword [0x47814c]
mov dword [esp + 0x128], 2
push ecx
push edi
push eax
lea ecx, [ebp + 0x64]
call fcn.00413260
mov eax, dword [esp + 0xb4]
mov dword [esp + 0x128], 0xffffffff
cmp eax, edi
je 0x443bc5
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x443bbc
cmp al, 0xff
je 0x443bbc
dec al
mov byte [ecx], al
mov dword [esp + 0xb4], edi
mov dword [esp + 0xb8], edi
mov dword [esp + 0xbc], edi
jmp 0x443db7
push ecx
call fcn.00467320
add esp, 4
mov dword [esp + 0xb4], edi
mov dword [esp + 0xb8], edi
mov dword [esp + 0xbc], edi
jmp 0x443db7
cmp al, 1
jne 0x443c8b
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 6
push 0x4877cc
call fcn.0044e650
lea edx, [esp + 0xd4]
push edx
call fcn.0045ad10
add esp, 8
mov ecx, dword [0x47814c]
mov dword [esp + 0x128], 3
push ecx
push edi
push eax
lea ecx, [ebp + 0x64]
call fcn.00413260
mov eax, dword [esp + 0xd4]
mov dword [esp + 0x128], 0xffffffff
cmp eax, edi
je 0x443c71
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x443c68
cmp al, 0xff
je 0x443c68
dec al
mov byte [ecx], al
mov dword [esp + 0xd4], edi
mov dword [esp + 0xd8], edi
mov dword [esp + 0xdc], edi
jmp 0x443db7
push ecx
call fcn.00467320
add esp, 4
mov dword [esp + 0xd4], edi
mov dword [esp + 0xd8], edi
mov dword [esp + 0xdc], edi
jmp 0x443db7
push ecx
cmp al, 2
mov ecx, esp
jne 0x443d33
mov dword [esp + 0x18], esp
push 6
push 0x4877c4
call fcn.0044e650
lea edx, [esp + 0x84]
push edx
call fcn.0045ad10
add esp, 8
mov ecx, dword [0x47814c]
mov dword [esp + 0x128], ebx
push ecx
push edi
push eax
lea ecx, [ebp + 0x64]
call fcn.00413260
mov eax, dword [esp + 0x84]
mov dword [esp + 0x128], 0xffffffff
cmp eax, edi
je 0x443d19
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x443d10
cmp al, 0xff
je 0x443d10
dec al
mov byte [ecx], al
mov dword [esp + 0x84], edi
mov dword [esp + 0x88], edi
mov dword [esp + 0x8c], edi
jmp 0x443db7
push ecx
call fcn.00467320
add esp, 4
mov dword [esp + 0x84], edi
mov dword [esp + 0x88], edi
mov dword [esp + 0x8c], edi
jmp 0x443db7
mov dword [esp + 0x18], esp
push 6
push 0x48760c
call fcn.0044e650
lea edx, [esp + 0x94]
push edx
call fcn.0045ad10
add esp, 8
mov ecx, dword [0x47814c]
mov dword [esp + 0x128], 5
push ecx
push edi
push eax
lea ecx, [ebp + 0x64]
call fcn.00413260
mov eax, dword [esp + 0x94]
mov dword [esp + 0x128], 0xffffffff
cmp eax, edi
je 0x443da2
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x443d99
cmp al, 0xff
je 0x443d99
dec al
mov byte [ecx], al
jmp 0x443da2
push ecx
call fcn.00467320
add esp, 4
mov dword [esp + 0x94], edi
mov dword [esp + 0x98], edi
mov dword [esp + 0x9c], edi
push 6
push 0x4877d4
lea ecx, [esp + 0x68]
mov byte [ebp + 0x41], 0
mov byte [ebp + 0x42], 1
mov byte [ebp + 0x43], 2
call fcn.0044e650
mov ecx, dword [ebp + 0x84]
lea esi, [ebp + 0x7c]
push eax
push 1
push ecx
mov ecx, esi
mov dword [esp + 0x134], 6
call fcn.00413f00
or edi, 0xffffffff
lea ecx, [esp + 0x60]
mov dword [esp + 0x128], edi
call fcn.0044e6f0
push 6
push 0x4877cc
lea ecx, [esp + 0x70]
call fcn.0044e650
mov ecx, dword [esi + 8]
push eax
push 1
push ecx
mov ecx, esi
mov dword [esp + 0x134], 7
call fcn.00413f00
lea ecx, [esp + 0x68]
mov dword [esp + 0x128], edi
call fcn.0044e6f0
push 6
push 0x4877c4
lea ecx, [esp + 0x1c]
call fcn.0044e650
mov ecx, dword [esi + 8]
push eax
push 1
push ecx
mov ecx, esi
mov dword [esp + 0x134], 8
call fcn.00413f00
lea ecx, [esp + 0x14]
mov dword [esp + 0x128], edi
call fcn.0044e6f0
mov ecx, ebp
call fcn.00448d40
jmp 0x443f4b
push 6
mov ecx, esi
call fcn.0044e8c0
test al, 0x40
je 0x443ee8
push ecx
mov byte [0x493771], 1
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x487644
call fcn.0044e650
lea edx, [esp + 0x104]
push edx
call fcn.0045ad10
add esp, 8
mov ecx, dword [0x47814c]
mov dword [esp + 0x128], edi
push ecx
push edi
push eax
lea ecx, [ebp + 0x64]
call fcn.00413260
mov dword [esp + 0x128], 0xffffffff
push 1
lea ecx, [esp + 0x104]
jmp 0x443f3b
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x48763c
call fcn.0044e650
lea edx, [esp + 0x114]
push edx
call fcn.0045ad10
add esp, 8
mov ecx, dword [0x47814c]
mov dword [esp + 0x128], 1
push ecx
push edi
push eax
lea ecx, [ebp + 0x64]
call fcn.00413260
mov dword [esp + 0x128], 0xffffffff
push 1
lea ecx, [esp + 0x114]
call fcn.00413460
push 0x40
push 6
mov ecx, ebp
call fcn.00448ec0
mov ecx, dword [esp + 0x120]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x11c
ret