Function at 0x4100cc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
mov edi, 0x428920
push esi
xor esi, esi
push ebx
xor ebx, ebx
push ecx
sub esp, 0x88
mov eax, dword [ecx]
mov dword [ebp - 0x4e], 0x5245564f
movaps xmm0, xmmword [str.__command_varia____eval_flags_]
movaps xmm1, xmmword [0x42da80]
mov dword [ebp - 0x52], 0x454b414d
mov dword [ebp - 0x6c], eax
xor eax, eax
mov dword [ebp - 0x4c], 0x49525245
mov dword [ebp - 0x48], 0x534544
mov dword [ebp - 0x20], 0x73656c62
mov dword [ebp - 0x1c], 0x2d2a2d
mov dword [ebp - 0x34], 0x292d2a
mov dword [ebp - 0x5c], eax
movups xmmword [ebp - 0x30], xmm0
movups xmmword [ebp - 0x44], xmm1
mov eax, dword [edi]
mov dword [ebp - 0x60], eax
test eax, eax
je 0x41041c
mov dl, byte [edi + 0xc]
test dl, 2
je case.0x410171.7
cmp dword [ebp - 0x6c], 0
je 0x410165
test dl, 4
jne case.0x410171.7
mov eax, dword [edi + 4]
cmp eax, 7
ja case.default.0x410171
jmp dword [eax*4 + 0x42c3dc]
mov ecx, dword [edi + 8]
mov ecx, dword [ecx]
test ecx, ecx
setne byte [ebp - 0x64]
and eax, 1
cmp byte [ebp - 0x64], al
je case.0x410171.7
mov eax, dword [edi + 0x14]
test eax, eax
je 0x4101a3
and dl, 8
jne 0x4101a3
cmp ecx, dword [eax]
je case.0x410171.7
mov eax, 0x20
call fcn.004212d8
sub esp, eax
xor eax, eax
lea edx, [esp + 0x2b]
and edx, 0xfffffff0
mov dword [edx + 4], edi
mov dword [edx + 8], eax
jmp 0x410265
mov eax, dword [edi + 0x14]
mov edx, dword [edi + 8]
test eax, eax
je 0x4101d7
mov eax, dword [eax]
cmp dword [edx], eax
je case.0x410171.7
mov eax, dword [edi + 0x10]
test eax, eax
je 0x4101e4
mov eax, dword [eax]
cmp dword [edx], eax
je 0x410248
mov eax, 0x30
call fcn.004212d8
sub esp, eax
mov eax, dword [edi + 8]
lea ecx, [esp + 0x2b]
mov eax, dword [eax]
and ecx, 0xfffffff0
mov dword [esp + 4], 0x42c3c3
mov dword [esp], ecx
mov dword [esp + 8], eax
mov dword [ebp - 0x60], ecx
call fcn.0040f750
jmp 0x4102d1
mov eax, dword [edi + 0x14]
test eax, eax
je 0x410232
mov edx, dword [edi + 8]
fld qword [eax]
fld qword [edx]
fucompi st(1)
fstp st(0)
jp 0x410232
je case.0x410171.7
mov eax, dword [edi + 0x10]
test eax, eax
je 0x41029e
mov edx, dword [edi + 8]
fld qword [eax]
fld qword [edx]
fucompi st(1)
fstp st(0)
jp 0x41029e
jne 0x41029e
mov eax, 0x20
call fcn.004212d8
sub esp, eax
lea edx, [esp + 0x2b]
and edx, 0xfffffff0
mov dword [edx + 4], edi
mov dword [edx + 8], 0x42c0db
xor eax, eax
mov dword [edx], eax
test esi, esi
je 0x410274
mov eax, dword [ebp - 0x5c]
mov dword [eax], edx
jmp 0x410276
mov esi, edx
cmp dword [ebp - 0x60], 0x7f
jg 0x410287
mov dword [ebp - 0x5c], edx
add ebx, 3
jmp case.0x410171.7
mov eax, dword [edi + 0x18]
mov dword [ebp - 0x5c], edx
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea ebx, [ebx + eax + 5]
jmp case.0x410171.7
mov eax, 0x70
call fcn.004212d8
sub esp, eax
mov eax, dword [edi + 8]
lea ecx, [esp + 0x2b]
movsd xmm2, qword [eax]
and ecx, 0xfffffff0
mov dword [esp + 4], 0x42c3c6
mov dword [esp], ecx
movsd qword [esp + 8], xmm2
mov dword [ebp - 0x60], ecx
call fcn.0040f750
mov eax, 0x20
call fcn.004212d8
mov ecx, dword [ebp - 0x60]
sub esp, eax
xor eax, eax
lea edx, [esp + 0x2b]
and edx, 0xfffffff0
mov dword [edx + 4], edi
mov dword [edx + 8], ecx
mov dword [edx], eax
test esi, esi
je 0x4102fc
mov eax, dword [ebp - 0x5c]
mov dword [eax], edx
jmp 0x4102fe
mov esi, edx
mov dword [ebp - 0x5c], edx
mov dword [esp], ecx
call sub.msvcrt.dll_strlen
inc eax
lea eax, [eax + eax*2]
add ebx, eax
cmp dword [edi], 0x7f
jmp 0x410360
mov eax, dword [edi + 8]
mov ecx, dword [eax]
test ecx, ecx
je case.0x410171.7
mov eax, 0x20
call fcn.004212d8
sub esp, eax
xor eax, eax
lea edx, [esp + 0x2b]
and edx, 0xfffffff0
mov dword [edx + 4], edi
mov dword [edx + 8], ecx
mov dword [edx], eax
test esi, esi
je 0x410349
mov eax, dword [ebp - 0x5c]
mov dword [eax], edx
jmp 0x41034b
mov esi, edx
mov dword [ebp - 0x5c], edx
mov dword [esp], ecx
call sub.msvcrt.dll_strlen
inc eax
lea eax, [eax + eax*2]
add ebx, eax
cmp dword [ebp - 0x60], 0x7f
jle case.0x410171.7
mov eax, dword [edi + 0x18]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea ebx, [ebx + eax + 2]
jmp case.0x410171.7
mov eax, dword [edi + 8]
mov eax, dword [eax]
mov dword [ebp - 0x68], eax
test eax, eax
je case.0x410171.7
xor eax, eax
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x64]
cmp eax, dword [ecx + 4]
jae case.0x410171.7
mov eax, 0x20
call fcn.004212d8
mov ecx, dword [ebp - 0x64]
sub esp, eax
mov eax, dword [ebp - 0x68]
lea edx, [esp + 0x2b]
mov eax, dword [eax]
and edx, 0xfffffff0
mov dword [edx + 4], edi
mov eax, dword [eax + ecx*4]
xor ecx, ecx
mov dword [edx], ecx
mov dword [edx + 8], eax
test esi, esi
je 0x4103cd
mov ecx, dword [ebp - 0x5c]
mov dword [ecx], edx
jmp 0x4103cf
mov esi, edx
test eax, eax
jne 0x4103d8
add ebx, 3
jmp 0x4103ec
mov dword [ebp - 0x5c], edx
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x5c]
inc eax
lea eax, [eax + eax*2]
add ebx, eax
cmp dword [ebp - 0x60], 0x7f
jle 0x410407
mov eax, dword [edi + 0x18]
mov dword [ebp - 0x5c], edx
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x5c]
lea ebx, [ebx + eax + 2]
inc dword [ebp - 0x64]
mov dword [ebp - 0x5c], edx
jmp 0x41038f
call sub.msvcrt.dll_abort
add edi, 0x20
jmp 0x41013d
lea eax, [ebx + 0x53]
lea ecx, [ebx + 0x38]
shr eax, 4
shl eax, 4
call fcn.004212d8
sub esp, eax
lea eax, [esp + 0x2b]
and eax, 0xfffffff0
mov ebx, eax
xor eax, eax
mov edi, ebx
rep stosb byte es:[edi], al
lea eax, [ebx + 1]
mov byte [ebx], 0x2d
mov dword [ebp - 0x5c], eax
mov edi, eax
test esi, esi
je 0x4104be
cmp dword [esi + 8], 0
jne 0x410485
mov eax, dword [esi + 4]
mov eax, dword [eax]
cmp eax, 0x7f
jg 0x410485
inc edi
mov byte [edi - 1], al
mov esi, dword [esi]
jmp 0x410449
mov word [edi], 0x2d20
mov eax, dword [esi + 4]
mov edx, dword [eax]
lea eax, [edi + 3]
cmp edx, 0x7f
jg 0x41048b
mov byte [edi + 2], dl
mov edx, dword [esi + 8]
test edx, edx
jne 0x4104a3
mov esi, dword [esi]
mov edi, eax
test esi, esi
jne 0x410465
jmp 0x4104be
mov byte [edi + 2], 0x2d
mov edx, dword [esi + 4]
mov edx, dword [edx + 0x18]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00411893
jmp 0x41047a
cmp byte [edx], 0
je 0x410481
mov edx, dword [esi + 4]
cmp dword [edx], 0x7f
jle 0x4104b4
mov byte [eax], 0x3d
inc eax
mov edx, dword [esi + 8]
call fcn.0040f704
jmp 0x410481
mov eax, dword [ebp - 0x5c]
cmp edi, eax
jne 0x4104ca
mov byte [ebx], 0
mov edi, ebx
mov eax, dword [0x428eb8]
mov edx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2d
jne 0x4104e4
xor eax, eax
cmp byte [ebx + 1], 0x20
sete al
add eax, eax
add eax, ebx
xor esi, esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 1
mov dword [esp + 8], eax
mov dword [esp + 4], 6
mov dword [esp], 0x42c3c9
call fcn.0041a7fb
cmp dword [0x431934], 0
je 0x410535
movups xmm3, xmmword [ebp - 0x44]
mov eax, dword [ebp - 0x35]
mov byte [edi], 0x20
add edi, 0x14
movups xmmword [edi - 0x13], xmm3
mov dword [edi - 4], eax
cmp dword [0x4314d4], 0
lea esi, [ebp - 0x52]
je 0x410544
lea esi, [ebp - 0x30]
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov dword [esp + 4], eax
mov dword [ebp - 0x60], eax
mov dword [esp], esi
call fcn.0041aaba
test eax, eax
je 0x410584
mov eax, dword [eax + 4]
test eax, eax
je 0x410584
cmp byte [eax], 0
mov ecx, dword [ebp - 0x60]
je 0x410584
lea eax, [edi + 6]
mov dword [edi], 0x202d2d20
mov word [edi + 4], 0x2824
mov edi, eax
rep movsb byte es:[edi], byte [esi]
mov byte [edi], 0x29
mov eax, dword [0x428eb8]
cmp byte [ebx], 0x2d
cmove ebx, dword [ebp - 0x5c]
cmp dword [0x431544], 1
mov edx, dword [eax + 4]
sbb eax, eax
xor ecx, ecx
add eax, 3
mov dword [ebp - 0x5c], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 8], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], eax
mov dword [esp + 4], 9
mov dword [esp], 0x42c3d0
call fcn.0041a7fb
or byte [eax + 0x18], 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret