Function at 0x563760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x6c
push ebx
mov ebx, dword [esp + 0x80]
push ebp
push esi
mov esi, dword [esp + 0x7c]
push edi
push 0
push dword [ebx]
mov ebp, dword [esi + 0x160]
mov dword [esp + 0x44], ebp
mov dword [esp + 0x18], 0
mov dword [esp + 0x24], 0
lea edi, [ebp + 0x14]
push edi
push esi
call fcn.005608e0
add esp, 0x10
mov dword [esp + 0x18], eax
test eax, eax
jne 0x5637eb
push dword [ebx]
lea eax, [ebp + 0x50]
push eax
call fcn.00561fd0
add esp, 8
test eax, eax
je 0x56384c
push 0x18
push eax
push edi
push esi
call fcn.005608e0
add esp, 0x10
mov dword [esp + 0x18], eax
test eax, eax
je 0x56384c
cmp byte [esi + 0xe8], 0
je 0x5637eb
push eax
push esi
call fcn.00562fb0
add esp, 8
test eax, eax
je 0x56384c
mov eax, dword [esp + 0x18]
push dword [esi + 0x184]
mov ebp, dword [esp + 0x88]
push dword [esi + 0x178]
mov ebx, dword [eax + 0xc]
push dword [esp + 0x90]
mov eax, dword [ebp + 0x24]
push ebp
mov dword [esp + 0x3c], ebx
call eax
mov edi, dword [esi + 0x178]
mov ecx, eax
mov dword [esp + 0x34], ecx
add esp, 0x10
add ecx, ebx
cmp ecx, edi
jle 0x563879
mov eax, dword [esi + 0x10]
add ecx, 0x10
mov dword [esi + 0x178], ecx
shl ecx, 4
push ecx
push dword [esi + 0x184]
call eax
add esp, 8
test eax, eax
jne 0x563859
mov dword [esi + 0x178], edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x6c
ret
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x184], eax
cmp ecx, edi
jle 0x563879
push eax
mov eax, dword [ebp + 0x24]
push ecx
push dword [esp + 0x90]
push ebp
call eax
add esp, 0x10
mov edx, dword [esi + 0x184]
xor ecx, ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x28], ecx
cmp dword [esp + 0x24], ecx
jle 0x563a10
mov dword [esp + 0x20], ecx
jmp 0x5638a0
mov eax, dword [esi + 0x184]
mov edi, dword [eax + ecx]
mov eax, dword [ebp + 0x1c]
push edi
push ebp
call eax
add eax, edi
push eax
push edi
push ebp
push esi
call fcn.0055fc30
mov edi, eax
add esp, 0x18
test edi, edi
je 0x56384c
mov eax, dword [edi]
cmp word [eax - 2], 0
jne 0x563ac3
mov edx, dword [esp + 0x14]
mov ecx, 1
mov word [eax - 2], cx
mov ecx, dword [esp + 0x10]
mov eax, dword [edi]
mov dword [edx + ecx*4], eax
inc ecx
mov edx, dword [esp + 0x20]
add edx, dword [esi + 0x184]
mov dword [esp + 0x10], ecx
cmp byte [edx + 0xc], 0
jne 0x563970
cmp byte [edi + 8], 0
mov byte [esp + 0x30], 1
je 0x563938
xor eax, eax
test ebx, ebx
jle 0x563938
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx + 0x14]
cmp edi, dword [ecx]
je 0x563922
inc eax
add ecx, 0xc
cmp eax, ebx
jl 0x563914
jmp 0x563938
mov ebx, dword [esp + 0x18]
lea eax, [eax + eax*2]
mov ecx, dword [ebx + 0x14]
mov ebx, dword [esp + 0x2c]
mov al, byte [ecx + eax*4 + 4]
mov byte [esp + 0x30], al
lea eax, [esi + 0x19c]
push eax
push dword [edx + 8]
push dword [edx + 4]
push dword [esp + 0x3c]
push ebp
push esi
call fcn.005636e0
add esp, 0x18
test eax, eax
jne 0x5641a0
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
lea ecx, [eax + edx*4]
mov eax, dword [esi + 0x1ac]
mov dword [ecx], eax
jmp 0x56399c
push dword [edx + 8]
lea eax, [esi + 0x19c]
push dword [edx + 4]
push ebp
push eax
call fcn.00562630
mov edx, dword [esp + 0x20]
add esp, 0x10
mov ecx, dword [esp + 0x14]
mov dword [ecx + edx*4], eax
lea ecx, [ecx + edx*4]
test eax, eax
je 0x56384c
mov eax, dword [esi + 0x1a8]
mov dword [esi + 0x1ac], eax
mov eax, dword [edi + 4]
test eax, eax
je 0x5639e9
cmp byte [edi + 9], 0
je 0x5639d7
push dword [esp + 0x90]
push dword [ecx]
push edi
push eax
push esi
call fcn.0055b830
add esp, 0x14
test eax, eax
jne 0x5641a0
dec dword [esp + 0x10]
jmp 0x5639ee
mov eax, dword [edi]
mov ecx, 2
inc edx
inc dword [esp + 0x1c]
mov word [eax - 2], cx
jmp 0x5639ea
inc edx
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
inc eax
add ecx, 0x10
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], ecx
cmp eax, dword [esp + 0x24]
jl 0x5638a0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x10]
mov dword [esi + 0x17c], ebp
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x563af8
mov ecx, dword [ecx]
cmp word [ecx - 2], 0
je 0x563af8
xor eax, eax
test ebp, ebp
jle 0x563a50
lea esp, [esp]
cmp dword [edx + eax*4], ecx
je 0x563aed
add eax, 2
cmp eax, ebp
jl 0x563a40
mov eax, dword [esp + 0x18]
xor edi, edi
test ebx, ebx
jle 0x563b61
xor ebx, ebx
mov ecx, dword [eax + 0x14]
mov eax, dword [ecx + ebx]
add ecx, ebx
mov edx, dword [eax]
cmp word [edx - 2], 0
jne 0x563aaf
mov ebp, dword [ecx + 8]
mov dword [esp + 0x38], ebp
test ebp, ebp
je 0x563aab
mov ebp, dword [eax + 4]
test ebp, ebp
je 0x563b36
cmp byte [eax + 9], 0
je 0x563b07
push dword [esp + 0x90]
push dword [esp + 0x3c]
push eax
push ebp
push esi
call fcn.0055b830
add esp, 0x14
test eax, eax
jne 0x5641a0
mov ebp, dword [esp + 0x10]
inc edi
add ebx, 0xc
cmp edi, dword [esp + 0x2c]
jge 0x563b61
mov eax, dword [esp + 0x18]
jmp 0x563a60
cmp ebp, dword [esi + 0x90]
jne 0x563ae0
mov ecx, dword [esp + 0x28]
mov eax, dword [esi + 0x184]
add ecx, ecx
mov eax, dword [eax + ecx*8]
mov dword [esi + 0x11c], eax
pop edi
pop esi
pop ebp
mov eax, 8
pop ebx
add esp, 0x6c
ret
mov dword [esi + 0x180], eax
jmp 0x563a50
mov dword [esi + 0x180], 0xffffffff
jmp 0x563a54
mov ebp, dword [esp + 0x10]
mov eax, 2
inc dword [esp + 0x1c]
mov word [edx - 2], ax
mov eax, dword [ecx]
mov edx, dword [esp + 0x14]
mov eax, dword [eax]
mov dword [edx + ebp*4], eax
mov eax, dword [ecx + 8]
mov dword [edx + ebp*4 + 4], eax
add ebp, 2
mov dword [esp + 0x10], ebp
jmp 0x563aaf
mov ebp, dword [esp + 0x10]
mov eax, 1
mov word [edx - 2], ax
mov eax, dword [ecx]
mov edx, dword [esp + 0x14]
mov eax, dword [eax]
mov dword [edx + ebp*4], eax
mov eax, dword [ecx + 8]
mov dword [edx + ebp*4 + 4], eax
add ebp, 2
mov dword [esp + 0x10], ebp
jmp 0x563aaf
mov eax, dword [esp + 0x14]
xor edx, edx
mov dword [esp + 0x30], edx
mov dword [eax + ebp*4], 0
cmp dword [esp + 0x1c], edx
je 0x563fd5
mov eax, dword [esi + 0x18c]
mov edi, 1
mov bl, byte [esi + 0x190]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
movzx ecx, bl
add eax, eax
shl edi, cl
sar eax, cl
mov dword [esp + 0x28], edi
test eax, eax
je 0x563c15
mov ebp, dword [esp + 0x1c]
mov cl, bl
lea esp, [esp]
mov eax, ebp
sar eax, cl
inc cl
test eax, eax
jne 0x563bb0
mov ebp, dword [esp + 0x10]
mov byte [esi + 0x190], cl
cmp cl, 3
jae 0x563bd0
mov byte [esi + 0x190], 3
mov cl, byte [esi + 0x190]
mov edi, 1
shl edi, cl
mov dword [esp + 0x28], edi
lea eax, [edi + edi*2]
shl eax, 2
push eax
push dword [esi + 0x188]
mov eax, dword [esi + 0x10]
call eax
add esp, 8
test eax, eax
jne 0x563c0d
pop edi
mov byte [esi + 0x190], bl
mov eax, 1
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret
mov dword [esi + 0x188], eax
jmp 0x563c1d
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x563c49
or eax, 0xffffffff
mov edx, edi
mov dword [esp + 0x20], eax
test edi, edi
je 0x563c47
lea ecx, [edi + edi*2]
shl ecx, 2
mov eax, dword [esi + 0x188]
lea ecx, [ecx - 0xc]
mov dword [ecx + eax], 0xffffffff
dec edx
jne 0x563c30
mov eax, dword [esp + 0x20]
xor edx, edx
dec eax
mov dword [esp + 0x20], eax
mov dword [esi + 0x18c], eax
test ebp, ebp
jle 0x563ff7
mov eax, dword [esp + 0x14]
mov edi, dword [eax + edx*4]
lea ecx, [eax + edx*4]
mov dword [esp + 0x40], ecx
cmp word [edi - 2], 2
jne 0x563fbb
mov eax, dword [esi + 0x1d8]
test eax, eax
je 0x563c8c
push eax
call fcn.00560220
add esp, 4
mov ebx, eax
jmp 0x563c92
mov ebx, dword [esi + 0x1ec]
xor edx, edx
mov dword [esp + 0x44], 0x70736575
mov eax, edx
mov dword [esp + 0x48], 0x736f6d65
xor eax, 0x646f7261
mov dword [esp + 0x54], 0x6e657261
mov dword [esp + 0x50], eax
mov ecx, ebx
lea eax, [esp + 0x64]
mov dword [esp + 0x58], 0x6c796765
mov dword [esp + 0x6c], eax
xor ecx, 0x6e646f6d
xor eax, eax
mov dword [esp + 0x4c], ecx
push eax
mov word [edi - 2], ax
xor edx, 0x74656462
mov eax, dword [esp + 0x40]
xor ebx, 0x79746573
push edi
add eax, 0x28
mov dword [esp + 0x64], ebx
push eax
push esi
mov dword [esp + 0x70], edx
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
call fcn.005608e0
add esp, 0x10
test eax, eax
je 0x56384c
mov eax, dword [eax + 4]
test eax, eax
je 0x56384c
mov ecx, dword [eax + 4]
mov dword [esp + 0x38], ecx
test ecx, ecx
je 0x56404e
xor ebx, ebx
cmp dword [ecx + 0x14], ebx
jle 0x563d86
nop
mov eax, dword [ecx + 0x10]
movzx ebp, word [eax + ebx*2]
mov eax, dword [esi + 0x1a8]
cmp eax, dword [esi + 0x1a4]
jne 0x563d70
lea eax, [esi + 0x19c]
push eax
call fcn.00562440
add esp, 4
test al, al
je 0x56384c
mov ecx, dword [esp + 0x38]
mov eax, dword [esi + 0x1a8]
inc ebx
mov word [eax], bp
add dword [esi + 0x1a8], 2
cmp ebx, dword [ecx + 0x14]
jl 0x563d40
mov eax, dword [ecx + 0x14]
add eax, eax
push eax
push dword [ecx + 0x10]
lea eax, [esp + 0x4c]
push eax
call fcn.005631f0
add esp, 0xc
lea esp, [esp]
mov ax, word [edi]
add edi, 2
cmp ax, 0x3a
jne 0x563da0
xor ecx, ecx
mov eax, edi
cmp word [edi], cx
je 0x563dbf
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x563db5
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x48]
push edi
push eax
call fcn.005631f0
add esp, 0xc
mov eax, dword [esi + 0x1a8]
cmp eax, dword [esi + 0x1a4]
jne 0x563df6
lea eax, [esi + 0x19c]
push eax
call fcn.00562440
add esp, 4
test al, al
je 0x56384c
mov ecx, dword [esi + 0x1a8]
movzx eax, word [edi]
mov word [ecx], ax
add dword [esi + 0x1a8], 2
mov eax, dword [esi + 0x1a8]
mov dword [esp + 0x24], eax
movzx eax, word [edi]
add edi, 2
test ax, ax
jne 0x563dd1
lea eax, [esp + 0x44]
push eax
call fcn.00563090
mov edi, dword [esi + 0x188]
mov ecx, eax
mov eax, dword [esp + 0x2c]
add esp, 4
mov ebp, dword [esp + 0x20]
dec eax
mov ebx, eax
mov dword [esp + 0x2c], ecx
and ebx, ecx
mov dword [esp + 0x34], eax
xor dl, dl
lea ecx, [ebx + ebx*2]
shl ecx, 2
cmp dword [ecx + edi], ebp
mov ebp, dword [esp + 0x10]
jne 0x563ef4
lea ecx, [ecx]
mov ebp, dword [esp + 0x2c]
cmp ebp, dword [edi + ecx + 4]
mov ebp, dword [esp + 0x10]
jne 0x563eac
mov eax, dword [esi + 0x1ac]
mov edi, dword [edi + ecx + 8]
movzx ecx, word [eax]
cmp cx, word [edi]
jne 0x563e98
sub edi, eax
test cx, cx
je 0x563ae0
movzx ecx, word [eax + 2]
add eax, 2
cmp cx, word [eax + edi]
je 0x563e82
cmp word [eax], 0
je 0x563ae0
mov edi, dword [esi + 0x188]
mov eax, dword [esp + 0x34]
test dl, dl
jne 0x563eca
movzx ecx, byte [esi + 0x190]
mov edx, eax
not edx
shr eax, 2
and edx, dword [esp + 0x2c]
dec ecx
shr edx, cl
and dl, al
or dl, 1
movzx ecx, dl
cmp ebx, ecx
jge 0x563edb
mov eax, dword [esp + 0x28]
sub eax, ecx
add ebx, eax
jmp 0x563edd
sub ebx, ecx
mov eax, dword [esp + 0x20]
lea ecx, [ebx + ebx*2]
shl ecx, 2
cmp dword [ecx + edi], eax
mov eax, dword [esp + 0x34]
je 0x563e60
cmp byte [esi + 0xe9], 0
je 0x563f6d
mov ecx, dword [esp + 0x24]
mov ax, word [esi + 0x1d4]
mov word [ecx - 2], ax
mov eax, dword [esp + 0x38]
mov eax, dword [eax]
mov edi, dword [eax]
jmp 0x563f20
mov eax, dword [esi + 0x1a8]
cmp eax, dword [esi + 0x1a4]
jne 0x563f45
lea eax, [esi + 0x19c]
push eax
call fcn.00562440
add esp, 4
test al, al
je 0x56384c
mov ecx, dword [esi + 0x1a8]
movzx eax, word [edi]
mov word [ecx], ax
add dword [esi + 0x1a8], 2
mov eax, dword [esi + 0x1a8]
mov dword [esp + 0x24], eax
movzx eax, word [edi]
add edi, 2
test ax, ax
jne 0x563f20
dec dword [esp + 0x1c]
mov edx, dword [esi + 0x1ac]
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x1ac], ecx
lea ecx, [ebx + ebx*2]
mov ebx, dword [esp + 0x20]
mov dword [eax], edx
mov eax, dword [esi + 0x188]
mov dword [eax + ecx*4], ebx
mov eax, dword [esi + 0x188]
mov ebx, dword [esp + 0x2c]
mov dword [eax + ecx*4 + 4], ebx
mov eax, dword [esi + 0x188]
mov dword [eax + ecx*4 + 8], edx
mov edx, dword [esp + 0x30]
je 0x563fd2
mov eax, dword [esp + 0x14]
jmp 0x563fc1
xor ecx, ecx
mov word [edi - 2], cx
add edx, 2
mov dword [esp + 0x30], edx
cmp edx, ebp
jl 0x563c60
jmp 0x563ff7
add edx, 2
cmp edx, ebp
jge 0x563ff7
mov esi, dword [esp + 0x14]
lea ecx, [ecx]
mov eax, dword [esi + edx*4]
xor ecx, ecx
add edx, 2
mov word [eax - 2], cx
cmp edx, ebp
jl 0x563fe0
mov esi, dword [esp + 0x80]
mov eax, dword [esp + 0x90]
mov ecx, dword [eax]
test ecx, ecx
je 0x564016
mov eax, dword [ecx + 0xc]
xor edx, edx
mov eax, dword [eax]
mov word [eax - 2], dx
mov ecx, dword [ecx + 4]
test ecx, ecx
jne 0x564004
cmp byte [esi + 0xe8], 0
je 0x56419e
mov eax, dword [esp + 0x18]
mov ebx, dword [eax + 4]
test ebx, ebx
je 0x56405b
mov ebx, dword [ebx + 4]
test ebx, ebx
je 0x56404e
mov ebp, dword [esp + 0x8c]
mov edi, dword [ebp]
nop
mov ax, word [edi]
add edi, 2
cmp ax, 0x3a
jne 0x564040
jmp 0x564077
pop edi
pop esi
pop ebp
mov eax, 0x1b
pop ebx
add esp, 0x6c
ret
mov eax, dword [esp + 0x3c]
mov ebx, dword [eax + 0x9c]
test ebx, ebx
je 0x56419e
mov ebp, dword [esp + 0x8c]
mov edi, dword [ebp]
xor edx, edx
mov dword [esp + 0x3c], edx
cmp byte [esi + 0xe9], dl
je 0x5640a0
mov eax, dword [ebx]
mov ecx, dword [eax]
test ecx, ecx
je 0x5640a0
lea ecx, [ecx]
mov ax, word [ecx]
lea ecx, [ecx + 2]
inc edx
test ax, ax
jne 0x564090
mov dword [esp + 0x3c], edx
mov dword [ebp + 4], edi
mov eax, dword [ebx + 0x14]
mov dword [ebp + 0x10], eax
mov eax, dword [ebx]
mov eax, dword [eax]
mov dword [ebp + 8], eax
mov dword [ebp + 0x14], edx
xor ebp, ebp
mov ax, word [edi + ebp*2]
inc ebp
test ax, ax
jne 0x5640b5
mov eax, dword [ebx + 0x14]
add eax, edx
add eax, ebp
cmp eax, dword [ebx + 0x18]
jle 0x564146
add eax, 0x18
mov dword [esp + 0x40], eax
add eax, eax
push eax
mov eax, dword [esi + 0xc]
call eax
mov ecx, eax
add esp, 4
mov dword [esp + 0x80], ecx
test ecx, ecx
je 0x56384c
mov eax, dword [esp + 0x40]
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x14]
add eax, eax
push eax
push dword [ebx + 0x10]
push ecx
call sub.MSVCRT.dll_memcpy
mov ecx, dword [esi + 0x168]
add esp, 0xc
test ecx, ecx
je 0x564131
mov edx, dword [esp + 0x80]
lea esp, [esp]
mov eax, dword [ecx + 0xc]
cmp eax, dword [ebx + 0x10]
jne 0x56412b
mov dword [ecx + 0xc], edx
mov ecx, dword [ecx]
test ecx, ecx
jne 0x564120
push dword [ebx + 0x10]
mov eax, dword [esi + 0x14]
call eax
mov eax, dword [esp + 0x84]
add esp, 4
mov dword [ebx + 0x10], eax
mov ecx, dword [ebx + 0x14]
add ebp, ebp
mov eax, dword [ebx + 0x10]
push ebp
push edi
lea eax, [eax + ecx*2]
push eax
mov dword [esp + 0x8c], eax
call sub.MSVCRT.dll_memcpy
mov ecx, dword [esp + 0x48]
add esp, 0xc
test ecx, ecx
je 0x564192
mov edx, dword [esp + 0x80]
mov ax, word [esi + 0x1d4]
mov word [edx + ebp - 2], ax
lea eax, [ecx + ecx]
push eax
mov eax, dword [ebx]
push dword [eax]
lea eax, [edx + ebp]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebx + 0x10]
mov ebx, dword [esp + 0x8c]
mov dword [ebx], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret