Function at 0xa4173d
Capabilities:
Contain obfuscated stackstrings
Decompress data using aplib
Enumerate pe sections
Packed with generic packer
Parse pe header
Resolve function by parsing pe exports

Disassembly:
pushal
call 0xa41743
jmp 0xa41763
mov eax, dword [esp]
sub esp, 0xd8
push ebx
push ebp
push esi
mov ebx, 0xfffff000
push edi
and ebx, eax
mov ecx, 0x5a4d
cmp word [ebx], cx
jne 0xa4179c
mov eax, dword [ebx + 0x3c]
cmp eax, 0x1000
jbe 0xa41793
sub ebx, 0x1000
jmp 0xa41777
cmp dword [eax + ebx], 0x4550
je 0xa417a4
sub ebx, 0x1000
jmp 0xa41777
movzx edx, word [eax + ebx + 0x14]
add edx, eax
mov dword [esp + 0xe4], eax
movzx eax, word [eax + ebx + 6]
lea ecx, [edx + ebx + 0x18]
lea edx, [eax + eax*4 - 0xa]
lea eax, [eax + eax*4]
cmp dword [ecx + eax*8 - 0x28], 0x6274652e
lea ebp, [ecx + eax*8 - 0x28]
mov dword [esp + 0x18], ebx
lea edx, [ecx + edx*8]
jne 0xa417dd
sub edx, 0x28
sub ebp, 0x28
mov edx, dword [edx + 0xc]
mov eax, dword [edx + ebx]
mov esi, dword [ecx + 0x34]
add edx, ebx
add edx, 4
mov edi, dword [edx + 4]
mov dword [esp + 0xdc], eax
mov eax, dword [edx]
add edx, 4
add edx, 4
mov dword [esp + 0xe0], eax
mov eax, dword [edx]
add edx, 4
add esi, ebx
add esi, dword [esi]
mov dword [esp + 0x34], eax
mov eax, dword [edx]
add edx, 4
mov dword [esp + 0x10], edx
test eax, eax
jbe 0xa4184d
mov edx, eax
lea ecx, [ecx]
mov ebx, dword [esp + 0x10]
mov eax, dword [ebx]
add ebx, 4
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x18]
add eax, ebx
mov ebx, dword [ecx + 0x34]
add eax, ebx
mov ebx, dword [esp + 0x18]
sub ebx, dword [esp + 0xdc]
add dword [eax], ebx
sub edx, 1
jne 0xa41823
cmp dword [ebp], 0x70616d2e
je 0xa41c44
mov cl, 0xbb
mov al, 0xd0
mov byte [esp + 0x48], cl
mov byte [esp + 0x59], cl
mov byte [esp + 0x62], cl
mov byte [esp + 0x67], cl
mov cl, 0xb7
mov bl, 0xcc
mov dl, 0xf2
mov byte [esp + 0x50], al
mov byte [esp + 0x5f], al
mov byte [esp + 0x68], cl
mov byte [esp + 0x6a], cl
mov byte [esp + 0x6c], al
mov byte [esp + 0x74], al
mov byte [esp + 0x78], cl
mov byte [esp + 0x7c], al
mov byte [esp + 0x80], al
mov byte [esp + 0x81], al
mov cl, 0x65
mov al, 0x20
mov byte [esp + 0x40], 0xce
mov byte [esp + 0x41], 0xc4
mov byte [esp + 0x42], 0xbc
mov byte [esp + 0x43], 0xfe
mov byte [esp + 0x44], 0xd2
mov byte [esp + 0x45], 0xd1
mov byte [esp + 0x46], 0xcb
mov byte [esp + 0x47], 0xf0
mov byte [esp + 0x49], 0xb5
mov byte [esp + 0x4a], 0xa3
mov byte [esp + 0x4b], 0xa1
mov byte [esp + 0x4c], 0xb4
mov byte [esp + 0x4d], 0xcb
mov byte [esp + 0x4e], 0xb3
mov byte [esp + 0x4f], bl
mov byte [esp + 0x51], dl
mov byte [esp + 0x52], 0xbf
mov byte [esp + 0x53], 0xc9
mov byte [esp + 0x54], 0xc4
mov byte [esp + 0x55], 0xdc
mov byte [esp + 0x56], 0xd2
mov byte [esp + 0x57], 0xd1
mov byte [esp + 0x58], 0xb1
mov byte [esp + 0x5a], 0xb2
mov byte [esp + 0x5b], 0xa1
mov byte [esp + 0x5c], 0xb6
mov byte [esp + 0x5d], 0xbe
mov byte [esp + 0x5e], 0xb8
mov byte [esp + 0x60], 0xc8
mov byte [esp + 0x61], 0xbe
mov byte [esp + 0x63], dl
mov byte [esp + 0x64], 0xd5
mov byte [esp + 0x65], 0xdf
mov byte [esp + 0x66], 0xb1
mov byte [esp + 0x69], 0xc7
mov byte [esp + 0x6b], 0xa8
mov byte [esp + 0x6d], 0xde
mov byte [esp + 0x6e], 0xb8
mov byte [esp + 0x6f], 0xc4
mov byte [esp + 0x70], 0xa3
mov byte [esp + 0x71], 0xac
mov byte [esp + 0x72], 0xb3
mov byte [esp + 0x73], bl
mov byte [esp + 0x75], dl
mov byte [esp + 0x76], 0xce
mov byte [esp + 0x77], 0xde
mov byte [esp + 0x79], 0xa8
mov byte [esp + 0x7a], 0xbc
mov byte [esp + 0x7b], bl
mov byte [esp + 0x7d], 0xf8
mov byte [esp + 0x7e], 0xd4
mov byte [esp + 0x7f], 0xcb
mov byte [esp + 0x82], 0x21
mov byte [esp + 0x83], 0
mov byte [esp + 0x84], 0x54
mov byte [esp + 0x85], 0x68
mov byte [esp + 0x86], cl
mov byte [esp + 0x87], al
mov byte [esp + 0x88], 0x66
mov byte [esp + 0x89], 0x69
mov dl, 0x72
mov bl, 0x70
mov byte [esp + 0x95], bl
mov byte [esp + 0xa0], bl
mov bl, 0x61
mov byte [esp + 0x8b], cl
mov byte [esp + 0x97], cl
mov byte [esp + 0xaf], cl
mov byte [esp + 0xb2], cl
mov byte [esp + 0xb3], cl
mov byte [esp + 0xb9], cl
mov byte [esp + 0xbc], cl
mov byte [esp + 0xd2], cl
mov byte [esp + 0x8a], 0x6c
mov byte [esp + 0x8c], al
mov byte [esp + 0x8d], 0x69
mov byte [esp + 0x8e], 0x73
mov byte [esp + 0x8f], al
mov byte [esp + 0x90], 0x63
mov byte [esp + 0x91], 0x6f
mov byte [esp + 0x92], dl
mov byte [esp + 0x93], dl
mov byte [esp + 0x94], 0x75
mov byte [esp + 0x96], 0x74
mov byte [esp + 0x98], 0x64
mov byte [esp + 0x99], 0x21
mov byte [esp + 0x9a], al
mov byte [esp + 0x9b], 0x54
mov byte [esp + 0x9c], 0x68
mov byte [esp + 0x9d], 0x69
mov byte [esp + 0x9e], 0x73
mov byte [esp + 0x9f], al
mov byte [esp + 0xa1], dl
mov byte [esp + 0xa2], 0x6f
mov byte [esp + 0xa3], 0x67
mov byte [esp + 0xa4], dl
mov byte [esp + 0xa5], bl
mov byte [esp + 0xa6], 0x6d
mov byte [esp + 0xa7], al
mov byte [esp + 0xa8], 0x6d
mov byte [esp + 0xa9], bl
mov byte [esp + 0xaa], 0x79
mov byte [esp + 0xab], al
mov byte [esp + 0xac], 0x68
mov byte [esp + 0xad], bl
mov byte [esp + 0xae], 0x76
mov byte [esp + 0xb0], al
mov byte [esp + 0xb1], 0x62
mov byte [esp + 0xb4], 0x6e
mov byte [esp + 0xb5], al
mov byte [esp + 0xb6], 0x69
mov byte [esp + 0xb7], 0x6e
mov byte [esp + 0xb8], 0x66
mov byte [esp + 0xba], 0x63
mov byte [esp + 0xbb], 0x74
mov byte [esp + 0xbd], 0x64
mov byte [esp + 0xbe], al
mov byte [esp + 0xbf], 0x62
mov byte [esp + 0xc0], 0x79
mov byte [esp + 0xc1], al
mov byte [esp + 0xc2], bl
mov byte [esp + 0xc3], al
mov byte [esp + 0xc4], 0x76
mov byte [esp + 0xc5], 0x69
mov byte [esp + 0xc6], dl
mov byte [esp + 0xc7], 0x75
mov byte [esp + 0xc8], 0x73
mov byte [esp + 0xc9], al
mov byte [esp + 0xca], 0x6f
mov byte [esp + 0xcb], dl
mov byte [esp + 0xcc], al
mov byte [esp + 0xcd], 0x63
mov byte [esp + 0xce], dl
mov byte [esp + 0xcf], bl
mov byte [esp + 0xd0], 0x63
mov byte [esp + 0xd1], 0x6b
mov byte [esp + 0xd3], 0x64
mov byte [esp + 0xd4], 0x21
mov byte [esp + 0xd5], 0
push 0
lea ecx, [esp + 0x88]
push ecx
lea edx, [esp + 0x48]
push edx
push 0
call fcn.00a4221c
nop
push 0
call fcn.00a4225b
nop
mov ebx, dword [esp + 0x34]
push 0x40
push 0x1000
push ebx
xor ebp, ebp
push ebp
call fcn.00a4229c
nop
mov dword [esp + 0x3c], eax
cmp esi, ebp
je 0xa420ca
cmp eax, ebp
je 0xa420ca
or eax, 0xffffffff
mov dword [esp + 0x14], ebp
mov dword [esp + 0xd8], ebp
xor ecx, ecx
lea ebp, [edi - 1]
mov dword [esp + 0x38], eax
mov dword [esp + 0x20], ebp
test edi, edi
je 0xa420cd
lea edx, [ebx - 1]
mov dword [esp + 0x28], edx
test ebx, ebx
je 0xa420cd
mov al, byte [esi]
mov ebx, dword [esp + 0x3c]
mov byte [ebx], al
mov eax, dword [esp + 0x2c]
inc ebx
inc esi
mov dword [esp + 0x24], ebx
mov edi, edi
mov edx, ecx
dec ecx
test edx, edx
jne 0xa41cd0
mov eax, ebp
dec ebp
mov dword [esp + 0x20], ebp
test eax, eax
je 0xa420ca
movzx eax, byte [esi]
inc esi
lea ecx, [edx + 7]
mov edx, eax
shr edx, 7
and edx, 1
add eax, eax
test edx, edx
je 0xa4209f
mov edx, ecx
dec ecx
test edx, edx
jne 0xa41cff
mov eax, ebp
dec ebp
mov dword [esp + 0x20], ebp
test eax, eax
je 0xa420ca
movzx eax, byte [esi]
inc esi
lea ecx, [edx + 7]
mov edx, eax
shr edx, 7
and edx, 1
add eax, eax
test edx, edx
je 0xa41e6e
mov edx, ecx
dec ecx
test edx, edx
jne 0xa41d2e
mov eax, ebp
dec ebp
mov dword [esp + 0x20], ebp
test eax, eax
je 0xa420ca
movzx eax, byte [esi]
inc esi
lea ecx, [edx + 7]
mov edx, eax
shr edx, 7
and edx, 1
add eax, eax
test edx, edx
je 0xa41ddb
xor edi, edi
lea ebp, [edi + 4]
mov edx, ecx
dec ecx
test edx, edx
jne 0xa41d66
mov eax, dword [esp + 0x20]
mov ecx, eax
dec eax
mov dword [esp + 0x20], eax
test ecx, ecx
je 0xa420ca
movzx eax, byte [esi]
inc esi
lea ecx, [edx + 7]
mov edx, eax
shr edx, 7
and edx, 1
add eax, eax
sub ebp, 1
lea edi, [edx + edi*2]
jne 0xa41d45
mov edx, dword [esp + 0x28]
test edi, edi
je 0xa41db7
mov ebp, dword [esp + 0x34]
sub ebp, edx
cmp edi, ebp
ja 0xa420ca
mov ebp, edx
dec edx
mov dword [esp + 0x28], edx
test ebp, ebp
je 0xa420ca
mov ebp, dword [esp + 0x20]
mov edx, ebx
sub edx, edi
mov dl, byte [edx]
mov byte [ebx], dl
inc ebx
mov dword [esp + 0x14], 0
jmp 0xa41cad
mov edi, edx
dec edx
mov dword [esp + 0x28], edx
test edi, edi
je 0xa420ca
mov ebp, dword [esp + 0x20]
mov byte [ebx], 0
inc ebx
mov dword [esp + 0x14], 0
jmp 0xa41cad
mov edx, ebp
dec ebp
mov dword [esp + 0x20], ebp
test edx, edx
je 0xa420ca
movzx edx, byte [esi]
mov edi, edx
and edi, 1
inc esi
add edi, 2
shr edx, 1
mov dword [esp + 0x14], edx
je 0xa41e61
mov ebp, dword [esp + 0x34]
sub ebp, dword [esp + 0x28]
cmp edx, ebp
ja 0xa420ca
cmp edi, dword [esp + 0x28]
ja 0xa420ca
sub dword [esp + 0x28], edi
test edi, edi
je 0xa41e38
mov ebp, ebx
sub ebp, edx
mov dl, byte [ebp]
mov byte [ebx], dl
inc ebx
inc ebp
sub edi, 1
jne 0xa41e24
mov edx, dword [esp + 0x14]
mov dword [esp + 0x24], ebx
mov ebp, dword [esp + 0x20]
cmp dword [esp + 0xd8], 0
mov dword [esp + 0x38], edx
mov dword [esp + 0x14], 1
je 0xa41cb3
sub ebx, dword [esp + 0x3c]
mov eax, ebx
jmp 0xa420cd
mov dword [esp + 0xd8], 1
jmp 0xa41e3c
mov edi, 1
mov edx, ecx
dec ecx
test edx, edx
jne 0xa41e90
mov eax, ebp
dec ebp
mov dword [esp + 0x20], ebp
test eax, eax
je 0xa420ca
movzx eax, byte [esi]
inc esi
lea ecx, [edx + 7]
mov edx, eax
shr edx, 7
and edx, 1
add eax, eax
test edi, edi
js 0xa420ca
lea edi, [edx + edi*2]
mov edx, ecx
dec ecx
test edx, edx
jne 0xa41ec2
mov eax, ebp
dec ebp
mov dword [esp + 0x20], ebp
test eax, eax
je 0xa420ca
movzx eax, byte [esi]
inc esi
lea ecx, [edx + 7]
mov edx, eax
shr edx, 7
and edx, 1
add eax, eax
test edx, edx
jne 0xa41e73
cmp dword [esp + 0x14], edx
jne 0xa41f9c
cmp edi, 2
jne 0xa41f97
lea edi, [edx + 1]
mov edx, ecx
dec ecx
test edx, edx
jne 0xa41f03
mov eax, ebp
dec ebp
mov dword [esp + 0x20], ebp
test eax, eax
je 0xa420ca
movzx eax, byte [esi]
inc esi
lea ecx, [edx + 7]
mov edx, eax
shr edx, 7
and edx, 1
add eax, eax
test edi, edi
js 0xa420ca
lea edi, [edx + edi*2]
mov edx, ecx
dec ecx
test edx, edx
jne 0xa41f35
mov eax, ebp
dec ebp
mov dword [esp + 0x20], ebp
test eax, eax
je 0xa420ca
movzx eax, byte [esi]
inc esi
lea ecx, [edx + 7]
mov edx, eax
shr edx, 7
and edx, 1
add eax, eax
test edx, edx
jne 0xa41ee6
mov ebx, dword [esp + 0x34]
sub ebx, dword [esp + 0x28]
mov edx, dword [esp + 0x38]
mov ebp, edi
cmp edx, ebx
ja 0xa420ca
cmp edi, dword [esp + 0x28]
ja 0xa420ca
sub dword [esp + 0x28], edi
mov ebx, dword [esp + 0x24]
test edi, edi
je 0xa4208e
mov edi, ebx
sub edi, edx
mov dl, byte [edi]
mov byte [ebx], dl
inc ebx
inc edi
sub ebp, 1
jne 0xa41f77
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x14], 1
jmp 0xa41cb3
lea edx, [edi - 3]
jmp 0xa41f9f
lea edx, [edi - 2]
cmp edx, 0xfffffe
ja 0xa420ca
mov edi, ebp
dec ebp
mov dword [esp + 0x20], ebp
test edi, edi
je 0xa420ca
movzx edi, byte [esi]
shl edx, 8
add edx, edi
mov ebx, edx
mov dword [esp + 0x14], ebx
inc esi
mov edi, 1
jmp 0xa41fd3
mov edx, ecx
dec ecx
test edx, edx
jne 0xa41ff0
mov eax, ebp
dec ebp
mov dword [esp + 0x20], ebp
test eax, eax
je 0xa420ca
movzx eax, byte [esi]
inc esi
lea ecx, [edx + 7]
mov edx, eax
shr edx, 7
and edx, 1
add eax, eax
test edi, edi
js 0xa420ca
lea edi, [edx + edi*2]
mov edx, ecx
dec ecx
test edx, edx
jne 0xa42022
mov eax, ebp
dec ebp
mov dword [esp + 0x20], ebp
test eax, eax
je 0xa420ca
movzx eax, byte [esi]
inc esi
lea ecx, [edx + 7]
mov edx, eax
shr edx, 7
and edx, 1
add eax, eax
test edx, edx
jne 0xa41fd3
mov ebp, edi
cmp ebx, 0x7d00
jb 0xa4203d
lea ebp, [edi + 1]
cmp ebx, 0x500
jb 0xa42046
inc ebp
cmp ebx, 0x80
jae 0xa42051
add ebp, 2
mov edx, dword [esp + 0x34]
sub edx, dword [esp + 0x28]
cmp ebx, edx
ja 0xa420ca
cmp ebp, dword [esp + 0x28]
ja 0xa420ca
sub dword [esp + 0x28], ebp
test ebp, ebp
je 0xa42086
mov edx, dword [esp + 0x24]
mov edi, edx
sub edi, ebx
mov bl, byte [edi]
mov byte [edx], bl
inc edx
inc edi
sub ebp, 1
jne 0xa42073
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x24], edx
mov dword [esp + 0x38], ebx
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x14], 1
jmp 0xa41cb3
mov edx, ebp
dec ebp
mov dword [esp + 0x20], ebp
test edx, edx
je 0xa420ca
mov edx, dword [esp + 0x28]
mov edi, edx
dec edx
mov dword [esp + 0x28], edx
test edi, edi
je 0xa420ca
mov dl, byte [esi]
mov byte [ebx], dl
mov dword [esp + 0x14], 0
jmp 0xa41cab
or eax, 0xffffffff
mov ecx, dword [esp + 0x34]
cmp eax, ecx
je 0xa420f1
mov eax, dword [esp + 0x3c]
push 0x4000
push ecx
push eax
call fcn.00a422de
nop
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd8
ret
mov eax, dword [esp + 0x10]
mov esi, dword [eax]
add eax, 4
mov dword [esp + 0x38], 0
mov dword [esp + 0x10], eax
test esi, esi
je 0xa4218a
jmp 0xa42113
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
add eax, 4
mov dword [esp + 0x10], eax
xor eax, eax
test edx, edx
jbe 0xa42142
mov ecx, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
add edi, ecx
mov ecx, dword [esp + 0x18]
lea ebp, [esi + ecx]
mov cl, byte [eax + edi]
mov byte [eax + ebp], cl
inc eax
cmp eax, edx
jb 0xa42137
mov eax, dword [esp + 0x10]
mov ebx, dword [eax]
add eax, 4
mov dword [esp + 0x10], eax
test ebx, ebx
je 0xa4215e
lea eax, [edx + esi]
cmp ebx, eax
jbe 0xa4215e
mov ecx, ebx
jmp 0xa42171
lea eax, [edx + esi]
cmp dword [esp + 0xe0], eax
jbe 0xa42180
mov ecx, dword [esp + 0xe0]
sub ecx, edx
sub ecx, esi
mov esi, dword [esp + 0x18]
lea edi, [eax + esi]
xor al, al
rep stosb byte es:[edi], al
add dword [esp + 0x38], edx
mov esi, ebx
test ebx, ebx
jne 0xa42113
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x3c]
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
push 0x4000
push edx
push eax
call fcn.00a4231f
nop
mov edx, dword [esp + 0xe4]
mov edx, dword [edx + ebp + 0x80]
mov esi, dword [edi]
mov eax, dword [edx + ebp + 0x10]
mov ecx, dword [edi + 4]
add edi, 4
sub eax, edx
add edi, 4
sub ecx, eax
je 0xa421de
add eax, esi
add eax, ebp
sub edx, esi
mov esi, ecx
nop
mov cl, byte [edx + eax]
mov byte [eax], cl
inc eax
sub esi, 1
jne 0xa421d3
mov ecx, dword [edi + 4]
add edi, 4
add edi, 4
test ecx, ecx
jbe 0xa42209
jmp 0xa421f3
mov eax, dword [edi]
mov edx, ebp
sub edx, dword [esp + 0xdc]
add edi, 4
add dword [eax + ebp], edx
sub ecx, 1
jne 0xa421f3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd8
add esp, 4
popal
jmp 0x5ae5f2