Function at 0x433410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502b47
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x567e00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword fs:[0x2c]
mov ebx, 0x804
mov edx, dword [0x56d69c]
mov esi, dword [eax + edx*4]
mov eax, dword [0x56cca8]
cmp eax, dword [esi + 4]
jg 0x43350a
mov eax, dword [0x56ce68]
cmp eax, dword [esi + 4]
jg 0x434145
push 0x56c768
mov ecx, edi
call fcn.00423df0
mov ecx, edi
call fcn.00432f20
movzx esi, ax
xor ecx, ecx
xor eax, eax
cmp si, word [eax + 0x56c768]
je 0x43349d
add eax, 0x60
inc ecx
cmp eax, 0x540
jb 0x433487
jmp 0x4334b0
lea eax, [ecx + ecx*2]
mov ecx, edi
shl eax, 5
add eax, 0x56c768
push eax
call fcn.00423df0
push 0x56ccb0
lea ecx, [edi + 0x60]
call fcn.00423d70
xor ecx, ecx
xor eax, eax
cmp si, word [eax + 0x56ccb0]
je 0x4334e7
add eax, 0x58
inc ecx
cmp eax, 0x1b8
jb 0x4334c1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
imul eax, ecx, 0x58
lea ecx, [edi + 0x60]
add eax, 0x56ccb0
push eax
call fcn.00423d70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x56cca8
call fcn.004c7345
add esp, 4
cmp dword [0x56cca8], 0xffffffff
jne 0x43345c
mov eax, 0x409
mov dword [0x56c774], 0
mov word [0x56c768], ax
mov ecx, 0x56c774
push 0xf
xor eax, eax
mov dword [0x56c76c], 0x1bc
push str.Microsoft_YaHei
mov dword [0x56c770], 0x64
mov dword [0x56c784], 0
mov dword [0x56c788], 7
mov word [0x56c774], ax
call fcn.00403a70
push 0xf
xor eax, eax
mov dword [0x56c790], 0
push str.Microsoft_YaHei
mov ecx, 0x56c790
mov dword [ebp - 4], 0
mov dword [0x56c78c], 0x14
mov dword [0x56c7a0], 0
mov dword [0x56c7a4], 7
mov word [0x56c790], ax
call fcn.00403a70
push 0xf
xor eax, eax
mov dword [0x56c7ac], 0
push str.Microsoft_YaHei
mov ecx, 0x56c7ac
mov byte [ebp - 4], 1
mov dword [0x56c7a8], 0xc
mov dword [0x56c7bc], 0
mov dword [0x56c7c0], 7
mov word [0x56c7ac], ax
call fcn.00403a70
mov dword [0x56c7c4], 0xf
push 4
xor eax, eax
mov dword [0x56c7d4], 0
push 0x518c98
mov ecx, 0x56c7d4
mov dword [ebp - 4], 2
mov word [0x56c7c8], bx
mov dword [0x56c7cc], 0x162
mov dword [0x56c7d0], 0x1e
mov dword [0x56c7e4], 0
mov dword [0x56c7e8], 7
mov word [0x56c7d4], ax
call fcn.00403a70
push 4
xor eax, eax
mov dword [0x56c7f0], 0
push 0x518c98
mov ecx, 0x56c7f0
mov byte [ebp - 4], 3
mov dword [0x56c7ec], 0x16
mov dword [0x56c800], 0
mov dword [0x56c804], 7
mov word [0x56c7f0], ax
call fcn.00403a70
push 4
xor eax, eax
mov dword [0x56c80c], 0
push 0x518c98
mov ecx, 0x56c80c
mov byte [ebp - 4], 4
mov dword [0x56c808], 0xe
mov dword [0x56c81c], 0
mov dword [0x56c820], 7
mov word [0x56c80c], ax
call fcn.00403a70
mov dword [0x56c824], 0xf
mov eax, 0x404
mov byte [ebp - 4], 5
mov word [0x56c828], ax
push 0x12
xor eax, eax
mov dword [0x56c834], 0
push str.Microsoft_YaHei_UI
mov ecx, 0x56c834
mov dword [0x56c82c], 0x1d0
mov dword [0x56c830], 0x10e
mov dword [0x56c844], 0
mov dword [0x56c848], 7
mov word [0x56c834], ax
call fcn.00403a70
push 0x12
xor eax, eax
mov dword [0x56c850], 0
push str.Microsoft_YaHei_UI
mov ecx, 0x56c850
mov byte [ebp - 4], 6
mov dword [0x56c84c], 0x16
mov dword [0x56c860], 0
mov dword [0x56c864], 7
mov word [0x56c850], ax
call fcn.00403a70
push 0x12
xor eax, eax
mov dword [0x56c86c], 0
push str.Microsoft_YaHei_UI
mov ecx, 0x56c86c
mov byte [ebp - 4], 7
mov dword [0x56c868], 0xe
mov dword [0x56c87c], 0
mov dword [0x56c880], 7
mov word [0x56c86c], ax
call fcn.00403a70
mov dword [0x56c884], 0xf
mov eax, 0x411
mov dword [0x56c894], 0
mov word [0x56c888], ax
mov ecx, 0x56c894
push 0xf
xor eax, eax
mov byte [ebp - 4], 8
push str.Microsoft_YaHei
mov dword [0x56c88c], 0x158
mov dword [0x56c890], 0xaa
mov dword [0x56c8a4], 0
mov dword [0x56c8a8], 7
mov word [0x56c894], ax
call fcn.00403a70
push 0xf
xor eax, eax
mov dword [0x56c8b0], 0
push str.Microsoft_YaHei
mov ecx, 0x56c8b0
mov byte [ebp - 4], 9
mov dword [0x56c8ac], 0x14
mov dword [0x56c8c0], 0
mov dword [0x56c8c4], 7
mov word [0x56c8b0], ax
call fcn.00403a70
push 0xf
xor eax, eax
mov dword [0x56c8cc], 0
push str.Microsoft_YaHei
mov ecx, 0x56c8cc
mov byte [ebp - 4], 0xa
mov dword [0x56c8c8], 0xd
mov dword [0x56c8dc], 0
mov dword [0x56c8e0], 7
mov word [0x56c8cc], ax
call fcn.00403a70
mov dword [0x56c8e4], 0xd
mov eax, 0x407
mov byte [ebp - 4], 0xb
mov word [0x56c8e8], ax
mov dword [0x56c8ec], 0x1e4
push 6
xor eax, eax
mov dword [0x56c8f4], 0
push str.Tahoma
mov ecx, 0x56c8f4
mov dword [0x56c8f0], 0x2bc
mov dword [0x56c904], 0
mov dword [0x56c908], 7
mov word [0x56c8f4], ax
call fcn.00403a70
push 6
xor eax, eax
mov dword [0x56c910], 0
push str.Tahoma
mov ecx, 0x56c910
mov byte [ebp - 4], 0xc
mov dword [0x56c90c], 0xa
mov dword [0x56c920], 0
mov dword [0x56c924], 7
mov word [0x56c910], ax
call fcn.00403a70
xor eax, eax
mov dword [0x56c92c], 0
mov dword [0x56c928], 9
mov dword [0x56c93c], 0
mov dword [0x56c940], 7
mov word [0x56c92c], ax
mov dword [0x56c944], eax
mov ecx, 0x56c954
mov eax, 0xc0a
mov dword [0x56c954], 0
mov word [0x56c948], ax
xor eax, eax
push 6
push str.Tahoma
mov byte [ebp - 4], 0xd
mov dword [0x56c94c], 0x1da
mov dword [0x56c950], 0x258
mov dword [0x56c964], 0
mov dword [0x56c968], 7
mov word [0x56c954], ax
call fcn.00403a70
push 6
xor eax, eax
mov dword [0x56c970], 0
push str.Tahoma
mov ecx, 0x56c970
mov byte [ebp - 4], 0xe
mov dword [0x56c96c], 0xa
mov dword [0x56c980], 0
mov dword [0x56c984], 7
mov word [0x56c970], ax
call fcn.00403a70
xor eax, eax
mov dword [0x56c98c], 0
mov dword [0x56c988], 0xa
mov dword [0x56c99c], 0
mov dword [0x56c9a0], 7
mov word [0x56c98c], ax
mov dword [0x56c9a4], eax
mov ecx, 0x56c9b4
mov eax, 0x80a
mov dword [0x56c9b4], 0
mov word [0x56c9a8], ax
xor eax, eax
push 6
push str.Tahoma
mov byte [ebp - 4], 0xf
mov dword [0x56c9ac], 0x1da
mov dword [0x56c9b0], 0x258
mov dword [0x56c9c4], 0
mov dword [0x56c9c8], 7
mov word [0x56c9b4], ax
call fcn.00403a70
mov byte [ebp - 4], 0x10
mov dword [0x56c9cc], 0xa
push 6
xor eax, eax
mov dword [0x56c9d0], 0
push str.Tahoma
mov ecx, 0x56c9d0
mov dword [0x56c9e0], 0
mov dword [0x56c9e4], 7
mov word [0x56c9d0], ax
call fcn.00403a70
xor eax, eax
mov dword [0x56c9ec], 0
mov dword [0x56c9e8], 0xa
mov dword [0x56c9fc], 0
mov dword [0x56ca00], 7
mov word [0x56c9ec], ax
mov dword [0x56ca04], eax
mov ecx, 0x56ca14
mov eax, 0x40c
mov dword [0x56ca14], 0
mov word [0x56ca08], ax
xor eax, eax
push 6
push str.Tahoma
mov byte [ebp - 4], 0x11
mov dword [0x56ca0c], 0x1ee
mov dword [0x56ca10], 0x320
mov dword [0x56ca24], 0
mov dword [0x56ca28], 7
mov word [0x56ca14], ax
call fcn.00403a70
push 6
xor eax, eax
mov dword [0x56ca30], 0
push str.Tahoma
mov ecx, 0x56ca30
mov byte [ebp - 4], 0x12
mov dword [0x56ca2c], 0xa
mov dword [0x56ca40], 0
mov dword [0x56ca44], 7
mov word [0x56ca30], ax
call fcn.00403a70
xor eax, eax
mov dword [0x56ca4c], 0
mov dword [0x56ca48], 0xa
mov dword [0x56ca5c], 0
mov dword [0x56ca60], 7
mov word [0x56ca4c], ax
mov dword [0x56ca64], eax
mov ecx, 0x56ca74
mov eax, 0xc0c
mov dword [0x56ca74], 0
mov word [0x56ca68], ax
xor eax, eax
push 6
push str.Tahoma
mov byte [ebp - 4], 0x13
mov dword [0x56ca6c], 0x1ee
mov dword [0x56ca70], 0x320
mov dword [0x56ca84], 0
mov dword [0x56ca88], 7
mov word [0x56ca74], ax
call fcn.00403a70
push 6
xor eax, eax
mov dword [0x56ca90], 0
push str.Tahoma
mov ecx, 0x56ca90
mov byte [ebp - 4], 0x14
mov dword [0x56ca8c], 0xa
mov dword [0x56caa0], 0
mov dword [0x56caa4], 7
mov word [0x56ca90], ax
call fcn.00403a70
mov dword [0x56caa8], 0xa
mov dword [0x56caac], 0
mov dword [0x56cabc], 0
mov dword [0x56cac0], 7
xor eax, eax
mov word [0x56caac], ax
mov dword [0x56cac4], eax
mov ecx, 0x56cad4
mov eax, 0x416
mov dword [0x56cad4], 0
mov word [0x56cac8], ax
xor eax, eax
push 6
push str.Tahoma
mov byte [ebp - 4], 0x15
mov dword [0x56cacc], 0x1f8
mov dword [0x56cad0], 0x384
mov dword [0x56cae4], 0
mov dword [0x56cae8], 7
mov word [0x56cad4], ax
call fcn.00403a70
push 6
xor eax, eax
mov dword [0x56caf0], 0
push str.Tahoma
mov ecx, 0x56caf0
mov byte [ebp - 4], 0x16
mov dword [0x56caec], 0xa
mov dword [0x56cb00], 0
mov dword [0x56cb04], 7
mov word [0x56caf0], ax
call fcn.00403a70
xor eax, eax
mov dword [0x56cb0c], 0
mov dword [0x56cb08], 0xa
mov dword [0x56cb1c], 0
mov dword [0x56cb20], 7
mov word [0x56cb0c], ax
mov dword [0x56cb24], eax
mov ecx, 0x56cb34
mov eax, 0x816
mov dword [0x56cb34], 0
mov word [0x56cb28], ax
xor eax, eax
push 6
push str.Tahoma
mov byte [ebp - 4], 0x17
mov dword [0x56cb2c], 0x202
mov dword [0x56cb30], 0x514
mov dword [0x56cb44], 0
mov dword [0x56cb48], 7
mov word [0x56cb34], ax
call fcn.00403a70
push 6
xor eax, eax
mov dword [0x56cb50], 0
push str.Tahoma
mov ecx, 0x56cb50
mov byte [ebp - 4], 0x18
mov dword [0x56cb4c], 0xa
mov dword [0x56cb60], 0
mov dword [0x56cb64], 7
mov word [0x56cb50], ax
call fcn.00403a70
xor eax, eax
mov dword [0x56cb6c], 0
mov dword [0x56cb68], 0xa
mov dword [0x56cb7c], 0
mov dword [0x56cb80], 7
mov word [0x56cb6c], ax
mov dword [0x56cb84], eax
mov eax, 0x419
mov word [0x56cb88], ax
xor eax, eax
mov byte [ebp - 4], 0x19
mov dword [0x56cb8c], 0x20c
mov dword [0x56cb90], 0x44c
mov dword [0x56cb94], 0
mov dword [0x56cba4], 0
mov dword [0x56cba8], 7
push 6
push str.Tahoma
mov ecx, 0x56cb94
mov word [0x56cb94], ax
call fcn.00403a70
push 6
xor eax, eax
mov dword [0x56cbb0], 0
push str.Tahoma
mov ecx, 0x56cbb0
mov byte [ebp - 4], 0x1a
mov dword [0x56cbac], 0xa
mov dword [0x56cbc0], 0
mov dword [0x56cbc4], 7
mov word [0x56cbb0], ax
call fcn.00403a70
xor eax, eax
mov dword [0x56cbcc], 0
mov dword [0x56cbc8], 9
mov dword [0x56cbdc], 0
mov dword [0x56cbe0], 7
mov word [0x56cbcc], ax
mov dword [0x56cbe4], eax
mov ecx, 0x56cbf4
mov eax, 0x421
mov dword [0x56cbf4], 0
mov word [0x56cbe8], ax
xor eax, eax
push 6
push str.Tahoma
mov byte [ebp - 4], 0x1b
mov dword [0x56cbec], 0x216
mov dword [0x56cbf0], 0x4b0
mov dword [0x56cc04], 0
mov dword [0x56cc08], 7
mov word [0x56cbf4], ax
call fcn.00403a70
push 6
xor eax, eax
mov dword [0x56cc10], 0
push str.Tahoma
mov ecx, 0x56cc10
mov byte [ebp - 4], 0x1c
mov dword [0x56cc0c], 0xa
mov dword [0x56cc20], 0
mov dword [0x56cc24], 7
mov word [0x56cc10], ax
call fcn.00403a70
xor eax, eax
mov dword [0x56cc2c], 0
mov dword [0x56cc28], 9
mov dword [0x56cc3c], 0
mov dword [0x56cc40], 7
mov word [0x56cc2c], ax
mov dword [0x56cc44], eax
mov ecx, 0x56cc54
mov eax, 0x415
mov dword [0x56cc54], 0
mov word [0x56cc48], ax
xor eax, eax
push 6
push str.Tahoma
mov byte [ebp - 4], 0x1d
mov dword [0x56cc4c], 0x220
mov dword [0x56cc50], 0x578
mov dword [0x56cc64], 0
mov dword [0x56cc68], 7
mov word [0x56cc54], ax
call fcn.00403a70
xor eax, eax
mov dword [0x56cc70], 0
mov byte [ebp - 4], 0x1e
mov dword [0x56cc6c], 0xa
mov dword [0x56cc80], 0
mov dword [0x56cc84], 7
mov word [0x56cc70], ax
push 6
push str.Tahoma
mov ecx, 0x56cc70
call fcn.00403a70
xor eax, eax
mov dword [0x56cc8c], 0
push 0x511660
mov dword [0x56cc88], 9
mov dword [0x56cc9c], 0
mov dword [0x56cca0], 7
mov word [0x56cc8c], ax
mov dword [0x56cca4], eax
mov dword [ebp - 4], 0xffffffff
call fcn.004c71fd
push 0x56cca8
call fcn.004c72fb
add esp, 8
jmp 0x43345c
push 0x56ce68
call fcn.004c7345
add esp, 4
cmp dword [0x56ce68], 0xffffffff
jne 0x43346d
xor eax, eax
mov dword [0x56ccc8], 7
push eax
mov dword [0x56ccb4], eax
mov ecx, 0x56ccb4
push 0x516c74
mov word [0x56ccb0], ax
mov dword [0x56ccc4], eax
mov word [0x56ccb4], ax
call fcn.00403a70
xor eax, eax
mov dword [0x56ccd0], 0
push eax
push 0x516c74
mov ecx, 0x56ccd0
mov dword [ebp - 4], 0x1f
mov dword [0x56cccc], 0
mov dword [0x56cce0], 0
mov dword [0x56cce4], 7
mov word [0x56ccd0], ax
call fcn.00403a70
xor eax, eax
mov dword [0x56ccec], 0
push eax
push 0x516c74
mov ecx, 0x56ccec
mov byte [ebp - 4], 0x20
mov dword [0x56cce8], 0
mov dword [0x56ccfc], 0
mov dword [0x56cd00], 7
mov word [0x56ccec], ax
call fcn.00403a70
mov dword [0x56cd04], 0
push 2
xor eax, eax
mov dword [0x56cd0c], 0
push 0x518cdc
mov ecx, 0x56cd0c
mov dword [ebp - 4], 0x21
mov word [0x56cd08], bx
mov dword [0x56cd1c], 0
mov dword [0x56cd20], 7
mov word [0x56cd0c], ax
call fcn.00403a70
push 2
xor eax, eax
mov dword [0x56cd28], 0
push 0x518cdc
mov ecx, 0x56cd28
mov byte [ebp - 4], 0x22
mov dword [0x56cd24], 0x11
mov dword [0x56cd38], 0
mov dword [0x56cd3c], 7
mov word [0x56cd28], ax
call fcn.00403a70
push 2
xor eax, eax
mov dword [0x56cd44], 0
push 0x518cdc
mov ecx, 0x56cd44
mov byte [ebp - 4], 0x23
mov dword [0x56cd40], 0xa
mov dword [0x56cd54], 0
mov dword [0x56cd58], 7
mov word [0x56cd44], ax
call fcn.00403a70
mov dword [0x56cd5c], 0xc
mov eax, 0x404
mov dword [0x56cd64], 0
mov word [0x56cd60], ax
xor eax, eax
mov byte [ebp - 4], 0x24
mov dword [0x56cd74], 0
mov dword [0x56cd78], 7
mov word [0x56cd64], ax
push 4
push 0x518ce4
mov ecx, 0x56cd64
call fcn.00403a70
push 4
xor eax, eax
mov dword [0x56cd80], 0
push 0x518ce4
mov ecx, 0x56cd80
mov byte [ebp - 4], 0x25
mov dword [0x56cd7c], 0x11
mov dword [0x56cd90], 0
mov dword [0x56cd94], 7
mov word [0x56cd80], ax
call fcn.00403a70
push 4
xor eax, eax
mov dword [0x56cd9c], 0
push 0x518ce4
mov ecx, 0x56cd9c
mov byte [ebp - 4], 0x26
mov dword [0x56cd98], 9
mov dword [0x56cdac], 0
mov dword [0x56cdb0], 7
mov word [0x56cd9c], ax
call fcn.00403a70
mov dword [0x56cdb4], 0xb
mov eax, 0x409
mov dword [0x56cdbc], 0
mov word [0x56cdb8], ax
mov ecx, 0x56cdbc
push 6
xor eax, eax
mov byte [ebp - 4], 0x27
push str.Tahoma
mov dword [0x56cdcc], 0
mov dword [0x56cdd0], 7
mov word [0x56cdbc], ax
call fcn.00403a70
push 6
xor eax, eax
mov dword [0x56cdd8], 0
push str.Tahoma
mov ecx, 0x56cdd8
mov byte [ebp - 4], 0x28
mov dword [0x56cdd4], 0x14
mov dword [0x56cde8], 0
mov dword [0x56cdec], 7
mov word [0x56cdd8], ax
call fcn.00403a70
push 6
xor eax, eax
mov dword [0x56cdf4], 0
push str.Tahoma
mov ecx, 0x56cdf4
mov byte [ebp - 4], 0x29
mov dword [0x56cdf0], 0xc
mov dword [0x56ce04], 0
mov dword [0x56ce08], 7
mov word [0x56cdf4], ax
call fcn.00403a70
mov dword [0x56ce0c], 0xf
mov eax, 0x411
mov dword [0x56ce14], 0
mov word [0x56ce10], ax
mov ecx, 0x56ce14
push 0xa
xor eax, eax
mov byte [ebp - 4], 0x2a
push str.MS_PGothic
mov dword [0x56ce24], 0
mov dword [0x56ce28], 7
mov word [0x56ce14], ax
call fcn.00403a70
push 0xa
xor eax, eax
mov dword [0x56ce30], 0
push str.MS_PGothic
mov ecx, 0x56ce30
mov byte [ebp - 4], 0x2b
mov dword [0x56ce2c], 0xf
mov dword [0x56ce40], 0
mov dword [0x56ce44], 7
mov word [0x56ce30], ax
call fcn.00403a70
push 0xc
xor eax, eax
mov dword [0x56ce4c], 0
push str.MS_UI_Gothic
mov ecx, 0x56ce4c
mov byte [ebp - 4], 0x2c
mov dword [0x56ce48], 9
mov dword [0x56ce5c], 0
mov dword [0x56ce60], 7
mov word [0x56ce4c], ax
call fcn.00403a70
push 0x511640
mov dword [0x56ce64], 9
mov dword [ebp - 4], 0xffffffff
call fcn.004c71fd
push 0x56ce68
call fcn.004c72fb
add esp, 8
jmp 0x43346d