Function at 0x4e2c43
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe34
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x28], 0xa5a5
mov word [ebp - 0x1b4], 0xa
jmp 0x4e3013
call fcn.004df28e
mov dword [ebx + 4], eax
call fcn.004df28e
mov dword [ebx + 0xc], eax
jmp case.0x4e314f.8
xor ecx, ecx
movzx eax, cx
mov edx, eax
imul edx, eax
imul edx, eax
imul edx, eax
add edx, 7
sub edx, 7
je 0x4e2ca2
dec edx
je 0x4e2cab
sub edx, 0xf
je 0x4e2d57
jmp 0x4e2cfe
inc word [ebp - 0x1ae]
jmp 0x4e2cfe
movzx esi, word [ebp - 0x1ae]
mov eax, esi
mov edi, 3
cdq
idiv edi
dec edx
setne al
and eax, 1
mov edi, eax
mov eax, esi
mov esi, 5
cdq
idiv esi
cmp edx, 2
setne al
and eax, 1
or edi, eax
je 0x4e2cf5
mov dx, word [ebp - 0x1b0]
mov word [ebp - 0x1b6], dx
mov word [ebp - 0x1b2], 1
jmp 0x4e2cfe
mov word [ebp - 0x1b2], 0
inc ecx
cmp cx, 3
jb 0x4e2c7e
jmp case.0x4e32b2.0
mov ecx, dword [ebx + 0x28]
xor dword [ebx], ecx
mov eax, dword [ebx + 0x28]
xor dword [ebx + 4], eax
mov edx, dword [ebx + 0x28]
xor dword [ebx + 8], edx
mov ecx, dword [ebx + 0x28]
xor dword [ebx + 0xc], ecx
mov eax, dword [ebx + 0x28]
xor dword [ebx + 0x10], eax
mov edx, dword [ebx + 0x28]
xor dword [ebx + 0x14], edx
xor eax, eax
lea edx, [ebx + 0x18]
mov ecx, eax
and ecx, 0x80000003
jns 0x4e2d45
dec ecx
or ecx, 0xfffffffc
inc ecx
mov cl, byte [ebx + ecx + 0x28]
inc eax
xor byte [edx], cl
inc edx
cmp eax, 0x10
jl 0x4e2d36
jmp case.0x4e314f.8
xor ecx, ecx
movzx eax, cx
mov edx, eax
imul edx, eax
add edx, eax
inc edx
cmp edx, 0x15
jg 0x4e2d86
je 0x4e2e03
dec edx
je 0x4e2dc6
sub edx, 2
je 0x4e2df3
sub edx, 4
je 0x4e2db1
sub edx, 6
je 0x4e2ddd
jmp 0x4e2e4d
sub edx, 0x1f
je 0x4e2da2
sub edx, 0xc
je 0x4e2e3e
sub edx, 0xe
je 0x4e2e1d
jmp 0x4e2e4d
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
shr dword [ebp - 0x24], 0x10
jmp 0x4e2e4d
mov edx, dword [ebp - 0x18]
imul edx, dword [ebp - 0x14]
and edx, 0xffff
mov dword [ebp - 0x20], edx
jmp 0x4e2e4d
mov eax, dword [ebp - 0x28]
shr eax, 0x10
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x28]
and edx, 0xffff
mov dword [ebp - 0x14], edx
jmp 0x4e2e4d
cmp dword [ebp - 0x10], 0
je 0x4e2e4d
mov eax, dword [ebp - 0x10]
imul dword [ebp - 0x1c]
and eax, 0xffff
add dword [ebp - 0x20], eax
jmp 0x4e2e4d
mov dword [ebp - 0x18], 0x15a
mov dword [ebp - 0x1c], 0x4e35
jmp 0x4e2e4d
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
imul edx, dword [ebp - 0x14]
shl eax, 0x10
and eax, 0xffff0000
add edx, eax
inc edx
mov dword [ebp - 0x24], edx
jmp 0x4e2e4d
movzx edx, word [ebp - 0x1b2]
and edx, 0x80000001
jns 0x4e2e31
dec edx
or edx, 0xfffffffe
inc edx
sub edx, 1
jb 0x4e30f7
je 0x4e2e5d
jmp 0x4e2e4d
and dword [ebp - 0x24], 0x7fff
mov ax, word [ebp - 0x24]
mov word [ebp - 0x2a], ax
inc ecx
cmp cx, 8
jb 0x4e2d59
jmp case.0x4e2f5c.0
xor ecx, ecx
movzx eax, cx
mov edx, eax
imul edx, eax
imul edx, eax
inc edx
cmp edx, 0x1c
jg 0x4e2e8a
je 0x4e2ee1
dec edx
je 0x4e2f26
dec edx
je 0x4e2ecc
sub edx, 7
je case.default.0x4e2f5c
jmp 0x4e2fe8
sub edx, 0x41
je 0x4e2ea6
sub edx, 0x3d
je 0x4e2fce
sub edx, 0x5b
je 0x4e2f4b
jmp 0x4e2fe8
movzx edx, word [ebp - 0xa]
movzx eax, word [ebp - 0xc]
lea edx, [ebp + edx*8 - 0x1cc]
inc word [edx + eax*2]
mov ax, word [ebp - 0x1b0]
mov word [ebp - 0x1b6], ax
jmp 0x4e2fe8
movzx eax, word [ebp - 0x2a]
mov esi, 3
cdq
idiv esi
mov word [ebp - 0xc], dx
jmp 0x4e2fe8
movzx edx, word [ebp - 0xa]
xor eax, eax
lea edx, [ebp + edx*8 - 0x1cc]
mov dword [ebp - 0x34], edx
movzx edx, word [ebp - 0xa]
lea edx, [ebp + edx*8 - 0x1cc]
mov dword [ebp - 0x30], edx
movzx edx, word [ebp - 0xc]
mov esi, dword [ebp - 0x30]
mov dx, word [esi + edx*2]
mov esi, dword [ebp - 0x34]
cmp dx, word [esi]
jbe 0x4e2f16
mov word [ebp - 0xc], ax
inc eax
add dword [ebp - 0x34], 2
cmp ax, 3
jb 0x4e2eff
jmp 0x4e2fe8
movzx eax, word [ebp - 0x2a]
mov esi, 9
cdq
idiv esi
mov word [ebp - 0x2a], dx
movzx eax, word [ebp - 0x2a]
mov esi, 3
cdq
idiv esi
mov word [ebp - 0xa], ax
jmp 0x4e2fe8
movzx eax, word [ebp - 0x2a]
mov esi, 9
cdq
idiv esi
cmp edx, 8
ja case.default.0x4e2f5c
jmp dword [edx*4 + 0x4e2f63]
movzx eax, word [ebp - 0xc]
xor edx, edx
lea eax, [ebp + eax*2 - 0x1cc]
mov dword [ebp - 0x30], eax
movzx eax, word [ebp - 0xc]
lea eax, [ebp + eax*2 - 0x1cc]
mov dword [ebp - 0x34], eax
movzx eax, word [ebp - 0xa]
mov esi, dword [ebp - 0x34]
mov ax, word [esi + eax*8]
mov esi, dword [ebp - 0x30]
cmp ax, word [esi]
jbe 0x4e2fc1
mov word [ebp - 0xa], dx
inc edx
add dword [ebp - 0x30], 8
cmp dx, 3
jb 0x4e2faa
jmp 0x4e2fe8
movzx eax, word [ebp - 0xa]
lea edx, [eax + eax*2]
add dx, word [ebp - 0xc]
mov word [ebp - 0x2a], dx
mov ax, word [ebp - 0x2a]
mov word [ebp - 0x1b0], ax
inc ecx
cmp cx, 7
jb 0x4e2e5f
jmp case.0x4e2f5c.0
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [ecx + 5]
mov dword [ebx], eax
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
xor eax, eax
mov al, byte [ecx]
mov dword [ebx + 8], eax
jmp case.0x4e314f.8
xor ecx, ecx
movzx edx, cx
cmp edx, 5
ja case.default.0x4e301d
jmp dword [edx*4 + 0x4e3024]
xor edx, edx
lea eax, [ebp - 0x1cc]
mov dword [ebp - 0x38], eax
xor eax, eax
mov esi, dword [ebp - 0x38]
mov word [esi], 0
inc eax
add esi, 2
cmp ax, 3
jb 0x4e304c
inc edx
add dword [ebp - 0x38], 8
cmp dx, 3
jb 0x4e3047
jmp case.default.0x4e301d
mov word [ebp - 0x1c6], 0
jmp case.default.0x4e301d
inc word [ebp - 0x1c0]
jmp case.default.0x4e301d
mov word [ebp - 0x1b6], 0xffff
jmp case.default.0x4e301d
mov word [ebp - 0x1ae], 0
jmp case.default.0x4e301d
mov word [ebp - 0x1b0], 0
inc ecx
cmp cx, 6
jb 0x4e3015
jmp case.0x4e2f5c.0
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [edx + 1]
mov dword [ebx + 0x10], ecx
mov eax, dword [ebp + 8]
mov edx, dword [eax]
cmp dword [edx + 9], 0
je case.0x4e314f.8
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov al, byte [eax]
cmp al, 1
je case.0x4e314f.8
cmp al, 7
je case.0x4e314f.8
push 0x10
lea eax, [ebx + 0x18]
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
push dword [ecx + 9]
push eax
call fcn.004dedc4
add esp, 0xc
jmp case.0x4e314f.8
movzx ecx, word [ebp - 0x2a]
mov eax, ecx
mov esi, 7
cdq
idiv esi
cmp edx, 2
sete al
and eax, 1
mov esi, eax
mov eax, ecx
mov ecx, 0xb
cdq
idiv ecx
cmp edx, 5
sete al
and eax, 1
or esi, eax
je 0x4e3143
mov dx, word [ebp - 0x1b0]
mov word [ebp - 0x1b6], dx
mov word [ebp - 0x1b2], 1
jmp 0x4e2d57
movzx ecx, word [ebp - 0x1c6]
cmp ecx, 9
ja case.0x4e314f.3
jmp dword [ecx*4 + 0x4e3156]
call fcn.004df28e
mov dword [ebx + 0x14], eax
call fcn.004df28e
mov dword [ebx + 0x28], eax
jmp case.0x4e314f.8
cmp byte [ebp + 0x10], 1
jne case.0x4e314f.8
mov byte [ebp - 0x1ac], 0x47
mov byte [ebp - 0x1ab], 0x65
mov byte [ebp - 0x1aa], 0x74
mov byte [ebp - 0x1a9], 0x53
mov byte [ebp - 0x1a8], 0x79
mov byte [ebp - 0x1a7], 0x73
mov byte [ebp - 0x1a6], 0x74
mov byte [ebp - 0x1a5], 0x65
mov byte [ebp - 0x1a4], 0x6d
mov byte [ebp - 0x1a3], 0x54
mov byte [ebp - 0x1a2], 0x69
mov byte [ebp - 0x1a1], 0x6d
mov byte [ebp - 0x1a0], 0x65
mov byte [ebp - 0x19f], 0
call fcn.004dee1d
lea edx, [ebp - 0x1ac]
push edx
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 8], eax
lea eax, [ebp - 0x198]
push eax
call dword [ebp - 8]
mov cl, byte [ebp - 0x198]
mov byte [ebx + 0x28], cl
mov al, byte [ebp - 0x196]
mov byte [ebx + 0x2a], al
mov dl, byte [ebx + 0x29]
xor byte [ebx + 0x28], dl
mov cl, byte [ebx + 0x2b]
xor byte [ebx + 0x2a], cl
jmp case.0x4e314f.8
mov eax, dword [ebx + 0x14]
xor dword [ebx], eax
mov edx, dword [ebx + 0x14]
xor dword [ebx + 4], edx
mov ecx, dword [ebx + 0x14]
xor dword [ebx + 8], ecx
mov eax, dword [ebx + 0x14]
xor dword [ebx + 0xc], eax
mov edx, dword [ebx + 0x14]
xor dword [ebx + 0x10], edx
xor ecx, ecx
movzx eax, cx
mov edx, eax
imul edx, eax
lea eax, [eax + eax*2]
add edx, eax
inc edx
dec edx
je 0x4e3285
sub edx, 4
je 0x4e328e
sub edx, 6
je 0x4e32df
sub edx, 8
je 0x4e2d57
jmp case.default.0x4e32b2
inc word [ebp - 0x1c6]
jmp case.default.0x4e32b2
mov dx, word [ebp - 0x1c6]
cmp dx, word [ebp - 0x1b4]
jne case.default.0x4e32b2
movzx eax, word [ebp - 0x1ae]
mov esi, 9
cdq
idiv esi
cmp edx, 8
ja case.default.0x4e32b2
jmp dword [edx*4 + 0x4e32b9]
mov word [ebp - 0x1b2], 1
inc ecx
cmp cx, 4
jb 0x4e325f
mov eax, dword [ebx + 4]
xor dword [ebx], eax
mov edx, dword [ebx + 0xc]
xor dword [ebx], edx
mov ecx, dword [ebx + 0xc]
xor dword [ebx + 4], ecx
mov eax, dword [ebx + 0xc]
xor dword [ebx + 8], eax
jmp case.0x4e314f.8
push 0x10
push 0
lea edx, [ebp - 0x48]
push edx
call fcn.004dedff
add esp, 0xc
lea ecx, [ebp - 0x48]
push ecx
call fcn.004e28cc
pop ecx
lea eax, [ebp - 0x188]
push eax
push 0
push 0
lea edx, [ebp - 0x48]
push edx
push 0
push 0
call fcn.004e0f1b
add esp, 0x18
mov esi, 0x2c
cmp byte [ebp + 0x10], 1
jne 0x4e33b8
sub esi, 4
mov eax, esi
mov edx, esi
and eax, 0xf
mov edi, esi
sub edx, eax
lea eax, [ebp - 0x74]
mov dword [ebp - 4], edx
push esi
push ebx
push eax
sub edi, 0x10
call fcn.004dedc4
add esp, 0xc
lea edx, [ebp - 0x188]
push edx
lea ecx, [ebp - 0x74]
push ecx
mov eax, dword [ebp - 4]
shl eax, 3
push eax
push ebx
call fcn.004e1025
add esp, 0x10
lea edx, [ebp - 0x74]
push esi
push edx
push ebx
call fcn.004dedc4
add esp, 0xc
lea ecx, [ebp - 0x188]
add ebx, edi
lea eax, [ebp - 0x74]
push ecx
push ebx
add eax, edi
push 0x80
push eax
call fcn.004e1025
add esp, 0x10
jmp 0x4e341f
mov edx, esi
mov ecx, esi
and edx, 0xf
mov edi, esi
sub ecx, edx
lea eax, [ebp - 0x74]
mov dword [ebp - 4], ecx
push esi
push ebx
push eax
sub edi, 0x10
call fcn.004dedc4
add esp, 0xc
lea edx, [ebp - 0x188]
push edx
lea ecx, [ebp - 0x74]
push ecx
mov eax, dword [ebp - 4]
shl eax, 3
push eax
push ebx
call fcn.004e1025
add esp, 0x10
lea edx, [ebp - 0x74]
push esi
push edx
push ebx
call fcn.004dedc4
add esp, 0xc
mov eax, edi
lea ecx, [ebp - 0x188]
add ebx, eax
push ecx
push ebx
lea edx, [ebp - 0x74]
push 0x80
add edx, eax
push edx
call fcn.004e1025
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret