Function at 0x4057a0
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
lea eax, [ebp - 0xc]
push esi
push edi
push eax
call fcn.00405f60
push 0x4088f8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
lea ecx, [ebp - 0xc]
mov edx, dword [esi + 0x3c]
lea ebx, [edx + esi + 0x78]
mov edi, dword [edx + esi + 0x78]
lea edx, [ebp - 0x2c]
add edi, esi
push edx
push edi
push ebx
push esi
mov dword [ebp - 0x2c], 0x74726956
mov dword [ebp - 0x28], 0x416c6175
mov dword [ebp - 0x24], 0x636f6c6c
mov byte [ebp - 0x20], 0
call fcn.00405ec0
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0xc]
lea eax, [ebp - 0x2c]
push eax
push edi
push ebx
push esi
mov dword [ebp - 0x2c], 0x74726956
mov dword [ebp - 0x28], 0x466c6175
mov dword [ebp - 0x24], 0x656572
call fcn.00405ec0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x1000
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, 0x1000
mov esi, eax
mov eax, dword [ebp + 8]
mov ecx, esi
sub eax, esi
mov bl, byte [eax + ecx]
mov byte [ecx], bl
inc ecx
dec edx
jne 0x405842
mov ecx, esi
mov edx, 0x1000
call fcn.00405760
push 0x200
push 0
push edi
mov dword [0x40b7c4], esi
mov dword [0x40b7c8], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x40b7d0]
push 0x100
push eax
push ecx
mov dword [0x40b7cc], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [esi + 0x3c]
add eax, esi
mov dword [ebp - 8], eax
push 0x40
sub eax, 0xffffffe8
mov dword [ebp + 8], eax
mov eax, dword [eax + 0x38]
push 0x3000
push eax
push 0
call dword [ebp - 0x10]
mov ebx, eax
test ebx, ebx
je 0x405989
mov edi, ebx
push esi
mov eax, 0x40
call fcn.00406090
mov ecx, dword [ebp - 8]
mov edi, dword [ebx + 0x3c]
add edi, ebx
movzx eax, word [ecx + 0x14]
push ecx
call fcn.00406090
movzx edx, word [edi + 0x14]
mov ecx, dword [ebp - 8]
lea edi, [edx + edi + 0x18]
movzx eax, word [ecx + 0x14]
movzx ecx, word [ecx + 6]
add eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
or ecx, ecx
mov dword [ebp - 0x18], ecx
je 0x40594e
sub eax, edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], ecx
jmp 0x405903
mov eax, dword [ebp - 0x10]
add eax, edi
push eax
mov eax, 0x28
call fcn.00406090
sub edi, 0xffffffd8
dec dword [ebp - 8]
jne 0x405900
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x40594e
add eax, 0x14
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], ecx
jmp 0x405933
mov eax, dword [ebp - 8]
mov edi, dword [eax - 8]
mov ecx, dword [eax]
mov eax, dword [eax - 4]
add ecx, esi
add edi, ebx
push ecx
call fcn.00406090
sub dword [ebp - 8], 0xffffffd8
dec dword [ebp - 0x10]
jne 0x405930
mov eax, dword [ebp + 8]
push ebx
call fcn.00405e10
mov edx, dword [ebp + 8]
mov edi, ebx
push edx
call fcn.00405d80
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
add ecx, ebx
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
mov dword [eax + 8], ebx
mov eax, dword [edx + 0xc]
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], ecx
call ecx
push 0x8000
push 0
push ebx
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4