Function at 0x6a1fb0
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x9c
mov esi, eax
mov eax, dword [eax + 0x160]
mov ebx, ecx
mov dword [esp + 0x38], eax
mov dword [esp], 0
lea edi, [eax + 0x14]
mov eax, dword [esp + 0xb0]
mov dword [esp + 0x14], edx
mov edx, edi
mov ecx, dword [eax]
mov eax, esi
call fcn.0069fc30
mov dword [esp + 0x34], eax
test eax, eax
je 0x6a2976
mov eax, dword [esp + 0x34]
mov edi, dword [eax + 0xc]
mov eax, dword [esi + 0x184]
mov dword [esp + 0xc], eax
mov dword [esp + 0x24], edi
mov eax, dword [esi + 0x178]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call dword [eax + 0x24]
add edi, eax
mov dword [esp + 0x28], eax
mov eax, edi
mov edi, dword [esi + 0x178]
cmp eax, edi
jle 0x6a2083
add eax, 0x10
mov dword [esi + 0x178], eax
shl eax, 4
mov dword [esp + 4], eax
mov eax, dword [esi + 0x184]
mov dword [esp], eax
call dword [esi + 0x10]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x6a22a0
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
mov dword [esi + 0x184], eax
cmp edi, edx
jge 0x6a208d
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [eax + 0x24]
mov eax, dword [esi + 0x184]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x28]
test ecx, ecx
jle 0x6a22b6
lea eax, [esi + 0x19c]
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x30], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], eax
jmp 0x6a2161
mov ecx, 1
cmp byte [ebx + 8], 0
jne 0x6a2220
mov edx, dword [esp + 0x2c]
mov dword [esp + 8], edx
mov edx, dword [eax + 8]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov dword [esp], eax
mov eax, esi
call fcn.006a1f30
test eax, eax
jne 0x6a2287
mov ecx, dword [esp + 0x1c]
mov eax, dword [esi + 0x1ac]
mov dword [ecx + edi + 4], eax
mov eax, dword [esi + 0x1a8]
mov dword [esi + 0x1ac], eax
mov edx, dword [ebx + 4]
test edx, edx
je 0x6a220c
cmp byte [ebx + 9], 0
jne 0x6a2260
mov eax, dword [esp + 0x20]
add eax, 2
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x30]
inc eax
mov dword [esp + 0x30], eax
mov eax, dword [ebx]
mov byte [eax - 1], 2
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x28], eax
je 0x6a22c6
mov edi, dword [esi + 0x184]
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
shl ebp, 4
add edi, ebp
mov ebx, dword [edi]
mov dword [esp], eax
mov dword [esp + 4], ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0x14]
add ebx, eax
mov eax, esi
mov dword [esp], ebx
mov ecx, dword [edi]
call fcn.006a0c40
mov ebx, eax
test eax, eax
je 0x6a22a6
mov eax, dword [eax]
cmp byte [eax - 1], 0
jne 0x6a23a6
mov byte [eax - 1], 1
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
lea edi, [eax*4]
mov eax, dword [ebx]
mov dword [ecx + edi], eax
mov eax, dword [esi + 0x184]
add eax, ebp
cmp byte [eax + 0xc], 0
je 0x6a20c4
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax + 4]
mov eax, dword [eax + 8]
lea ebp, [edx + edi + 4]
mov dword [esp], eax
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
call fcn.006a06f0
mov dword [ebp], eax
test eax, eax
je 0x6a22a6
mov eax, dword [esi + 0x1a8]
mov dword [esi + 0x1ac], eax
mov edx, dword [ebx + 4]
test edx, edx
jne 0x6a2120
mov eax, dword [esp + 0x20]
add eax, 2
mov dword [esp + 0x20], eax
jmp 0x6a2144
mov edx, dword [esp + 0x24]
test edx, edx
jle 0x6a20d3
mov ecx, dword [esp + 0x34]
mov ebp, dword [ecx + 0x14]
xor ecx, ecx
lea edx, [ebp + 0xc]
cmp ebx, dword [ebp]
jne 0x6a224a
jmp 0x6a2292
mov ebp, edx
add edx, 0xc
cmp dword [edx - 0xc], ebx
je 0x6a2292
inc ecx
cmp dword [esp + 0x24], ecx
jne 0x6a2240
mov ecx, 1
jmp 0x6a20d3
mov eax, dword [esp + 0xb4]
mov ecx, ebx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + edi + 4]
mov dword [esp], eax
mov eax, esi
call fcn.006a01b0
test eax, eax
je 0x6a2144
add esp, 0x9c
pop ebx
pop esi
pop edi
pop ebp
ret
xor ecx, ecx
mov cl, byte [ebp + 4]
jmp 0x6a20d3
mov dword [esi + 0x178], edi
add esp, 0x9c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x30], 0
mov dword [esp + 0x20], 0
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x34]
mov dword [esi + 0x17c], ebx
mov eax, dword [eax + 8]
test eax, eax
je 0x6a2660
mov edx, dword [eax]
cmp byte [edx - 1], 0
je 0x6a2660
test ebx, ebx
je 0x6a2320
mov eax, dword [esp + 0x1c]
cmp edx, dword [eax]
je 0x6a29d7
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
lea ecx, [eax - 1]
xor eax, eax
and ecx, 0xfffffffe
add ecx, 2
jmp 0x6a2319
cmp edx, dword [ebx + eax*4]
je 0x6a29d9
add eax, 2
cmp eax, ecx
jne 0x6a2310
mov ebp, dword [esp + 0x24]
test ebp, ebp
jle 0x6a2404
mov dword [esp + 0x14], esi
xor ebx, ebx
mov esi, dword [esp + 0x34]
jmp 0x6a237f
cmp byte [ecx + 9], 0
jne 0x6a23d0
mov byte [edi - 1], 2
mov edi, dword [esp + 0x30]
inc edi
mov dword [esp + 0x30], edi
mov edi, dword [esp + 0x20]
mov ecx, dword [eax]
mov ebp, dword [esp + 0x1c]
lea edx, [edi*4]
mov ecx, dword [ecx]
add edi, 2
mov dword [ebp + edx], ecx
mov dword [esp + 0x20], edi
mov eax, dword [eax + 8]
mov dword [ebp + edx + 4], eax
inc ebx
cmp dword [esp + 0x24], ebx
je 0x6a2400
lea eax, [ebx + ebx*2]
mov edx, dword [esi + 0x14]
lea eax, [edx + eax*4]
mov ecx, dword [eax]
mov edi, dword [ecx]
cmp byte [edi - 1], 0
jne 0x6a2374
mov ebp, dword [eax + 8]
test ebp, ebp
je 0x6a2374
mov edx, dword [ecx + 4]
test edx, edx
jne 0x6a2338
mov byte [edi - 1], 1
jmp 0x6a234f
mov ecx, dword [esp + 0x14]
mov eax, 8
cmp dword [esi + 0x90], ecx
jne 0x6a2287
mov edx, dword [esi + 0x184]
mov edx, dword [edx + ebp]
mov dword [esi + 0x11c], edx
jmp 0x6a2287
mov eax, dword [esp + 0xb4]
mov dword [esp], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
call fcn.006a01b0
test eax, eax
jne 0x6a2287
inc ebx
cmp dword [esp + 0x24], ebx
jne 0x6a237f
lea esi, [esi]
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0x30]
mov dword [eax + ebx*4], 0
test edx, edx
je 0x6a26d1
mov bl, byte [esi + 0x190]
lea eax, [edx + edx]
mov cl, bl
sar eax, cl
test eax, eax
jne 0x6a2450
mov edx, 1
mov eax, dword [esi + 0x18c]
shl edx, cl
mov dword [esp + 0x2c], edx
test eax, eax
je 0x6a2498
dec eax
mov dword [esp + 0x18], eax
jmp 0x6a24cb
mov eax, edx
sar eax, cl
inc ecx
test eax, eax
jne 0x6a2450
cmp cl, 2
jbe 0x6a2a87
mov edx, 1
mov eax, 0xc
shl edx, cl
mov byte [esi + 0x190], cl
mov dword [esp + 0x2c], edx
shl eax, cl
mov dword [esp + 4], eax
mov eax, dword [esi + 0x188]
mov dword [esp], eax
call dword [esi + 0x10]
test eax, eax
je 0x6a2aab
mov dword [esi + 0x188], eax
mov ebx, dword [esp + 0x2c]
test ebx, ebx
je 0x6a24c3
mov edx, dword [esp + 0x2c]
lea eax, [edx + edx*2 - 3]
shl eax, 2
nop
lea esi, [esi]
mov ecx, dword [esi + 0x188]
mov dword [ecx + eax], 0xffffffff
sub eax, 0xc
dec edx
jne 0x6a24b0
mov dword [esp + 0x18], 0xfffffffe
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
mov dword [esi + 0x18c], eax
test ebx, ebx
je 0x6a2703
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], 0
dec eax
mov dword [esp + 0x4c], eax
shr eax, 2
mov byte [esp + 0x4b], al
lea eax, [ebx - 1]
and eax, 0xfffffffe
add eax, 2
mov dword [esp + 0x3c], eax
lea eax, [esi + 0x19c]
mov dword [esp + 0x44], eax
jmp 0x6a252f
mov byte [edi - 1], 0
mov edx, dword [esp + 0x14]
add edx, 2
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x3c]
je 0x6a2703
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov edi, dword [eax + ebx*4]
cmp byte [edi - 1], 2
jne 0x6a2512
mov edx, dword [esi + 0x1d8]
test edx, edx
jne 0x6a2552
jmp 0x6a2aa0
mov edx, eax
mov eax, dword [edx + 0x1d8]
test eax, eax
jne 0x6a2550
add edx, 0x1ec
mov ecx, dword [edx]
mov dword [esp + 0x58], 0x70736575
mov eax, ecx
mov edx, ecx
xor eax, 0x79746573
xor edx, 0x6e646f6d
mov dword [esp + 0x70], eax
lea eax, [esp + 0x78]
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x60], edx
mov dword [esp + 0x5c], 0x736f6d65
mov dword [esp + 0x64], 0x646f7261
mov dword [esp + 0x68], 0x6e657261
mov dword [esp + 0x6c], 0x6c796765
mov dword [esp + 0x74], 0x74656462
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
lea edx, [eax + 0x28]
mov byte [edi - 1], 0
mov ecx, edi
mov dword [esp], 0
mov eax, esi
call fcn.0069fc30
test eax, eax
je 0x6a22a6
mov eax, dword [eax + 4]
test eax, eax
je 0x6a22a6
mov ebx, dword [eax + 4]
test ebx, ebx
je 0x6a2abb
mov ecx, dword [ebx + 0x14]
test ecx, ecx
jle 0x6a2850
xor ebp, ebp
jmp 0x6a262b
lea ecx, [eax + 1]
inc ebp
mov dword [esi + 0x1a8], ecx
mov byte [eax], dl
mov ecx, dword [ebx + 0x14]
cmp ecx, ebp
jle 0x6a2850
mov eax, dword [ebx + 0x10]
mov dl, byte [eax + ebp]
mov eax, dword [esi + 0x1a8]
cmp eax, dword [esi + 0x1a4]
jne 0x6a2614
mov ecx, dword [esp + 0x44]
mov byte [esp + 0x24], dl
call fcn.006a0440
test al, al
je 0x6a22a6
mov eax, dword [esi + 0x1a8]
mov dl, byte [esp + 0x24]
jmp 0x6a2614
mov dword [esi + 0x180], 0xffffffff
jmp 0x6a2320
mov edx, dword [esi + 0x1a8]
cmp byte [esi + 0xe9], 0
jne 0x6a29e4
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov eax, dword [esi + 0x1ac]
mov dword [esi + 0x1ac], edx
mov dword [ebx + ecx*4], eax
mov ebx, dword [esp + 0x18]
mov edx, dword [esi + 0x188]
dec dword [esp + 0x30]
mov dword [edx + edi], ebx
mov ebx, dword [esp + 0x28]
mov edx, dword [esi + 0x188]
mov dword [edx + edi + 4], ebx
mov edx, dword [esi + 0x188]
mov dword [edx + edi + 8], eax
jne 0x6a2516
mov eax, ecx
add eax, 2
mov dword [esp + 0x30], eax
mov ebx, dword [esp + 0x20]
cmp dword [esp + 0x30], ebx
jge 0x6a2703
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x30]
dec eax
mov ebx, dword [esp + 0x1c]
sub eax, ecx
and eax, 0xfffffffe
lea edx, [ebx + ecx*4]
add eax, ecx
lea ecx, [ebx + eax*4 + 8]
mov eax, dword [edx]
add edx, 8
cmp ecx, edx
mov byte [eax - 1], 0
jne 0x6a26f6
mov eax, dword [esp + 0xb4]
mov eax, dword [eax]
test eax, eax
je 0x6a2720
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov byte [edx - 1], 0
mov eax, dword [eax + 4]
test eax, eax
jne 0x6a2710
xor eax, eax
cmp byte [esi + 0xe8], 0
je 0x6a2287
mov edi, dword [esp + 0x34]
mov edx, dword [edi + 4]
test edx, edx
je 0x6a282b
mov edi, dword [edx + 4]
test edi, edi
je 0x6a2abb
mov eax, dword [esp + 0xb0]
mov ecx, dword [eax]
inc ecx
cmp byte [ecx - 1], 0x3a
jne 0x6a2752
xor ebp, ebp
cmp byte [esi + 0xe9], 0
je 0x6a2778
mov eax, dword [edi]
mov eax, dword [eax]
test eax, eax
je 0x6a2778
lea esi, [esi]
inc ebp
cmp byte [eax + ebp - 1], 0
jne 0x6a2770
mov eax, dword [esp + 0xb0]
mov ebx, dword [esp + 0xb0]
mov dword [eax + 4], ecx
mov eax, dword [edi + 0x14]
mov dword [ebx + 0x10], eax
mov eax, dword [edi]
mov eax, dword [eax]
mov dword [ebx + 0x14], ebp
mov dword [ebx + 8], eax
xor ebx, ebx
nop
lea esi, [esi]
inc ebx
cmp byte [ecx + ebx - 1], 0
jne 0x6a27a0
mov edx, dword [edi + 0x14]
lea eax, [edx + ebx]
add eax, ebp
cmp dword [edi + 0x18], eax
jge 0x6a2ae7
lea edx, [eax + 0x18]
mov dword [esp + 0x1c], ecx
mov dword [esp], edx
mov dword [esp + 0x18], edx
call dword [esi + 0xc]
mov ecx, eax
mov dword [esp + 0x14], eax
test eax, eax
je 0x6a22a6
mov edx, dword [esp + 0x18]
mov eax, dword [edi + 0x10]
mov dword [edi + 0x18], edx
mov edx, dword [edi + 0x14]
mov dword [esp + 8], edx
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esi + 0x168]
mov edx, dword [edi + 0x10]
test eax, eax
mov ecx, dword [esp + 0x1c]
jne 0x6a281a
jmp 0x6a2a2f
mov eax, dword [eax]
test eax, eax
je 0x6a2a2f
cmp dword [eax + 0xc], edx
jne 0x6a2810
mov edx, dword [esp + 0x14]
mov dword [eax + 0xc], edx
mov edx, dword [edi + 0x10]
jmp 0x6a2810
mov edi, dword [esp + 0x38]
mov edi, dword [edi + 0x9c]
test edi, edi
je 0x6a2287
mov eax, dword [esp + 0xb0]
mov ecx, dword [eax]
jmp 0x6a2759
mov edx, dword [ebx + 0x10]
lea eax, [esp + 0x58]
call fcn.0069efa0
lea esi, [esi]
inc edi
cmp byte [edi - 1], 0x3a
jne 0x6a2860
xor ecx, ecx
cmp byte [edi], 0
je 0x6a2877
nop
inc ecx
cmp byte [edi + ecx], 0
jne 0x6a2870
mov edx, edi
lea eax, [esp + 0x58]
call fcn.0069efa0
jmp 0x6a2899
lea edx, [eax + 1]
inc edi
mov dword [esi + 0x1a8], edx
mov cl, byte [edi - 1]
mov byte [eax], cl
cmp byte [edi - 1], 0
je 0x6a28c0
mov eax, dword [esi + 0x1a8]
cmp eax, dword [esi + 0x1a4]
jne 0x6a2884
mov ecx, dword [esp + 0x44]
call fcn.006a0440
test al, al
je 0x6a22a6
mov eax, dword [esi + 0x1a8]
jmp 0x6a2884
lea eax, [esp + 0x58]
call fcn.0069f080
mov ecx, dword [esi + 0x188]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x2c]
mov edi, eax
mov dword [esp + 0x28], eax
neg ecx
mov eax, dword [esp + 0x4c]
and ecx, edi
and eax, edi
xor edx, edx
mov dword [esp + 0x40], ecx
lea esi, [esi]
lea edi, [eax + eax*2]
mov ecx, dword [esp + 0x24]
shl edi, 2
mov ebp, dword [esp + 0x18]
add ecx, edi
cmp dword [ecx], ebp
jne 0x6a266f
mov edi, dword [esp + 0x28]
cmp dword [ecx + 4], edi
je 0x6a2944
test dl, dl
jne 0x6a292d
xor ecx, ecx
mov edx, dword [esp + 0x40]
mov cl, byte [esi + 0x190]
dec ecx
shr edx, cl
mov cl, byte [esp + 0x4b]
and edx, ecx
or edx, 1
xor ecx, ecx
mov cl, dl
cmp ecx, eax
jle 0x6a2940
mov edi, dword [esp + 0x2c]
sub edi, ecx
add eax, edi
jmp 0x6a28f0
sub eax, ecx
jmp 0x6a28f0
mov edi, dword [esi + 0x1ac]
mov ebp, dword [ecx + 8]
mov cl, byte [edi]
cmp cl, byte [ebp]
je 0x6a295f
jmp 0x6a2970
inc edi
inc ebp
mov cl, byte [edi]
cmp cl, byte [ebp]
jne 0x6a2970
test cl, cl
jne 0x6a2956
mov eax, 8
jmp 0x6a2287
test cl, cl
jne 0x6a2911
jmp 0x6a2963
mov eax, dword [esp + 0x38]
lea ecx, [eax + 0x50]
mov eax, dword [esp + 0xb0]
mov edx, dword [eax]
call fcn.006a0620
test eax, eax
je 0x6a22a6
mov ecx, eax
mov dword [esp], 0x18
mov edx, edi
mov eax, esi
call fcn.0069fc30
mov dword [esp + 0x34], eax
test eax, eax
je 0x6a22a6
cmp byte [esi + 0xe8], 0
je 0x6a1ff4
mov edx, eax
lea ecx, [eax + 4]
mov eax, esi
call fcn.006a1b20
test eax, eax
jne 0x6a1ff4
jmp 0x6a22a6
xor eax, eax
mov dword [esi + 0x180], eax
jmp 0x6a2320
mov al, byte [esi + 0x1d4]
mov byte [edx - 1], al
mov eax, dword [ebx]
mov ebx, dword [eax]
jmp 0x6a2a08
lea edx, [eax + 1]
inc ebx
mov dword [esi + 0x1a8], edx
mov cl, byte [ebx - 1]
mov byte [eax], cl
cmp byte [ebx - 1], 0
je 0x6a2a7c
mov eax, dword [esi + 0x1a8]
cmp eax, dword [esi + 0x1a4]
jne 0x6a29f3
mov ecx, dword [esp + 0x44]
call fcn.006a0440
test al, al
je 0x6a22a6
mov eax, dword [esi + 0x1a8]
jmp 0x6a29f3
mov dword [esp], edx
mov dword [esp + 0x18], ecx
call dword [esi + 0x14]
mov eax, dword [esp + 0x14]
mov dword [edi + 0x10], eax
mov edx, dword [edi + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov dword [esp + 8], ebx
add edx, eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x14], edx
call sub.msvcrt.dll_memcpy
test ebp, ebp
mov edx, dword [esp + 0x14]
jne 0x6a2ac5
mov esi, dword [esp + 0xb0]
mov eax, dword [edi + 0x10]
mov dword [esi], eax
xor eax, eax
jmp 0x6a2287
mov edx, dword [esi + 0x1a8]
jmp 0x6a2682
mov byte [esi + 0x190], 3
mov dword [esp + 0x2c], 8
mov eax, 0x60
jmp 0x6a247a
lea edx, [esi + 0x1ec]
jmp 0x6a2562
mov byte [esi + 0x190], bl
mov eax, 1
jmp 0x6a2287
mov eax, 0x1b
jmp 0x6a2287
mov al, byte [esi + 0x1d4]
mov byte [edx + ebx - 1], al
add edx, ebx
mov eax, dword [edi]
mov eax, dword [eax]
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.msvcrt.dll_memcpy
jmp 0x6a2a69
mov eax, dword [edi + 0x10]
mov dword [esp + 0x14], eax
jmp 0x6a2a47