Function at 0x42f800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push edi
xor eax, eax
push esi
push ebx
mov ecx, 0x41
sub esp, 0x16c
lea edi, [esp + 0x5c]
mov ebx, dword [esp + 0x180]
mov dword [esp + 0x5b], 0
mov dword [esp + 0x15c], 0
lea ebp, [esp + 0x5b]
rep stosd dword es:[edi], eax
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebp
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub esp, 0xc
test eax, eax
jne 0x42f8f1
call fcn.0042c430
mov esi, eax
lea edi, [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp + 0x40]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Get_module_filename_failed__error_id_is__lu
mov dword [esp + 0xc], 0x239
mov dword [esp + 4], 1
mov dword [esp + 8], edx
mov dword [esp], esi
mov dword [esp + 0x40], edi
mov dword [esp + 0x48], 0x4d746547
mov dword [esp + 0x4c], 0x6c75646f
mov dword [esp + 0x50], 0x74615065
mov byte [esp + 0x54], 0x68
mov dword [esp + 0x44], 0xd
mov byte [esp + 0x55], 0
call fcn.0042ce70
mov eax, dword [esp + 0x40]
cmp eax, edi
je 0x42f8d4
mov dword [esp], eax
call fcn.004ed8c0
lea eax, [ebx + 8]
mov dword [ebx + 4], 0
mov byte [ebx + 8], 0
mov dword [ebx], eax
add esp, 0x16c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea esi, [esp + 0x30]
mov dword [esp], ebp
mov dword [esp + 0x28], esi
call sub.msvcrt.dll_strlen
cmp eax, 0xf
mov edi, eax
ja 0x42f9f2
cmp eax, 1
je 0x42fa20
test edi, edi
mov eax, esi
jne 0x42fa05
mov dword [esp + 0x2c], edi
mov byte [eax + edi], 0
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x42f952
mov edx, dword [esp + 0x28]
lea eax, [ecx - 1]
lea esi, [esi]
lea edi, [edi]
cmp byte [edx + eax], 0x5c
je 0x42fa30
sub eax, 1
cmp eax, 0xffffffff
jne 0x42f940
call fcn.0042c430
lea edx, [esp + 0x40]
lea edi, [esp + 0x48]
mov dword [esp + 0x10], str.Module_path_is_illigal
mov dword [esp + 0xc], 0x240
mov dword [esp + 4], 1
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 0x40], edi
mov dword [esp + 0x48], 0x4d746547
mov dword [esp + 0x4c], 0x6c75646f
mov dword [esp + 0x50], 0x74615065
mov byte [esp + 0x54], 0x68
mov dword [esp + 0x44], 0xd
mov byte [esp + 0x55], 0
call fcn.0042ce70
mov eax, dword [esp + 0x40]
cmp eax, edi
je 0x42f9c1
mov dword [esp], eax
call fcn.004ed8c0
lea eax, [ebx + 8]
mov dword [ebx + 4], 0
mov byte [ebx + 8], 0
mov dword [ebx], eax
mov eax, dword [esp + 0x28]
cmp eax, esi
je 0x42f8e4
mov dword [esp], eax
call fcn.004ed8c0
add esp, 0x16c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [eax + 1]
mov dword [esp], eax
call fcn.004ed900
mov dword [esp + 0x30], edi
mov dword [esp + 0x28], eax
mov dword [esp + 8], edi
mov dword [esp + 4], ebp
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esp + 0x28]
jmp 0x42f91f
movzx eax, byte [esp + 0x5b]
mov byte [esp + 0x30], al
mov eax, esi
jmp 0x42f91f
lea edi, [eax + 1]
cmp edi, ecx
ja 0x42fa8e
mov dword [esp + 0x2c], edi
mov byte [edx + eax + 1], 0
lea eax, [ebx + 8]
mov dword [ebx], eax
mov eax, dword [esp + 0x28]
cmp eax, esi
je 0x42fa70
mov dword [ebx], eax
mov eax, dword [esp + 0x30]
mov dword [ebx + 8], eax
mov eax, dword [esp + 0x2c]
mov dword [ebx + 4], eax
add esp, 0x16c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
mov dword [ebx + 8], eax
mov eax, dword [esp + 0x34]
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 0x38]
mov dword [ebx + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [ebx + 0x14], eax
jmp 0x42fa56
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edi
mov dword [esp + 4], 0x4fdeb3
mov dword [esp], 0x4fdec8
call fcn.004e8380
mov ebx, eax
mov eax, dword [esp + 0x40]
cmp eax, edi
je 0x42fabc
mov dword [esp], eax
call fcn.004ed8c0
mov eax, dword [esp + 0x28]
cmp eax, esi
je 0x42facc
mov dword [esp], eax
call fcn.004ed8c0
mov dword [esp], ebx
call fcn.0043f8d0
mov ebx, eax
jmp 0x42fabc