Function at 0x4ecf4f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe34
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x28], 0xa5a5
mov word [ebp - 0x1b4], 0xa
jmp 0x4ed31f
call fcn.004e959a
mov dword [ebx + 4], eax
call fcn.004e959a
mov dword [ebx + 0xc], eax
jmp case.0x4ed45b.8
xor ecx, ecx
movzx eax, cx
mov edx, eax
imul edx, eax
imul edx, eax
imul edx, eax
add edx, 7
sub edx, 7
je 0x4ecfae
dec edx
je 0x4ecfb7
sub edx, 0xf
je 0x4ed063
jmp 0x4ed00a
inc word [ebp - 0x1ae]
jmp 0x4ed00a
movzx esi, word [ebp - 0x1ae]
mov eax, esi
mov edi, 3
cdq
idiv edi
dec edx
setne al
and eax, 1
mov edi, eax
mov eax, esi
mov esi, 5
cdq
idiv esi
cmp edx, 2
setne al
and eax, 1
or edi, eax
je 0x4ed001
mov dx, word [ebp - 0x1b0]
mov word [ebp - 0x1b6], dx
mov word [ebp - 0x1b2], 1
jmp 0x4ed00a
mov word [ebp - 0x1b2], 0
inc ecx
cmp cx, 3
jb 0x4ecf8a
jmp case.0x4ed5be.0
mov ecx, dword [ebx + 0x28]
xor dword [ebx], ecx
mov eax, dword [ebx + 0x28]
xor dword [ebx + 4], eax
mov edx, dword [ebx + 0x28]
xor dword [ebx + 8], edx
mov ecx, dword [ebx + 0x28]
xor dword [ebx + 0xc], ecx
mov eax, dword [ebx + 0x28]
xor dword [ebx + 0x10], eax
mov edx, dword [ebx + 0x28]
xor dword [ebx + 0x14], edx
xor eax, eax
lea edx, [ebx + 0x18]
mov ecx, eax
and ecx, 0x80000003
jns 0x4ed051
dec ecx
or ecx, 0xfffffffc
inc ecx
mov cl, byte [ebx + ecx + 0x28]
inc eax
xor byte [edx], cl
inc edx
cmp eax, 0x10
jl 0x4ed042
jmp case.0x4ed45b.8
xor ecx, ecx
movzx eax, cx
mov edx, eax
imul edx, eax
add edx, eax
inc edx
cmp edx, 0x15
jg 0x4ed092
je 0x4ed10f
dec edx
je 0x4ed0d2
sub edx, 2
je 0x4ed0ff
sub edx, 4
je 0x4ed0bd
sub edx, 6
je 0x4ed0e9
jmp 0x4ed159
sub edx, 0x1f
je 0x4ed0ae
sub edx, 0xc
je 0x4ed14a
sub edx, 0xe
je 0x4ed129
jmp 0x4ed159
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
shr dword [ebp - 0x24], 0x10
jmp 0x4ed159
mov edx, dword [ebp - 0x18]
imul edx, dword [ebp - 0x14]
and edx, 0xffff
mov dword [ebp - 0x20], edx
jmp 0x4ed159
mov eax, dword [ebp - 0x28]
shr eax, 0x10
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x28]
and edx, 0xffff
mov dword [ebp - 0x14], edx
jmp 0x4ed159
cmp dword [ebp - 0x10], 0
je 0x4ed159
mov eax, dword [ebp - 0x10]
imul dword [ebp - 0x1c]
and eax, 0xffff
add dword [ebp - 0x20], eax
jmp 0x4ed159
mov dword [ebp - 0x18], 0x15a
mov dword [ebp - 0x1c], 0x4e35
jmp 0x4ed159
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
imul edx, dword [ebp - 0x14]
shl eax, 0x10
and eax, 0xffff0000
add edx, eax
inc edx
mov dword [ebp - 0x24], edx
jmp 0x4ed159
movzx edx, word [ebp - 0x1b2]
and edx, 0x80000001
jns 0x4ed13d
dec edx
or edx, 0xfffffffe
inc edx
sub edx, 1
jb 0x4ed403
je 0x4ed169
jmp 0x4ed159
and dword [ebp - 0x24], 0x7fff
mov ax, word [ebp - 0x24]
mov word [ebp - 0x2a], ax
inc ecx
cmp cx, 8
jb 0x4ed065
jmp case.0x4ed268.0
xor ecx, ecx
movzx eax, cx
mov edx, eax
imul edx, eax
imul edx, eax
inc edx
cmp edx, 0x1c
jg 0x4ed196
je 0x4ed1ed
dec edx
je 0x4ed232
dec edx
je 0x4ed1d8
sub edx, 7
je case.default.0x4ed268
jmp 0x4ed2f4
sub edx, 0x41
je 0x4ed1b2
sub edx, 0x3d
je 0x4ed2da
sub edx, 0x5b
je 0x4ed257
jmp 0x4ed2f4
movzx edx, word [ebp - 0xa]
movzx eax, word [ebp - 0xc]
lea edx, [ebp + edx*8 - 0x1cc]
inc word [edx + eax*2]
mov ax, word [ebp - 0x1b0]
mov word [ebp - 0x1b6], ax
jmp 0x4ed2f4
movzx eax, word [ebp - 0x2a]
mov esi, 3
cdq
idiv esi
mov word [ebp - 0xc], dx
jmp 0x4ed2f4
movzx edx, word [ebp - 0xa]
xor eax, eax
lea edx, [ebp + edx*8 - 0x1cc]
mov dword [ebp - 0x34], edx
movzx edx, word [ebp - 0xa]
lea edx, [ebp + edx*8 - 0x1cc]
mov dword [ebp - 0x30], edx
movzx edx, word [ebp - 0xc]
mov esi, dword [ebp - 0x30]
mov dx, word [esi + edx*2]
mov esi, dword [ebp - 0x34]
cmp dx, word [esi]
jbe 0x4ed222
mov word [ebp - 0xc], ax
inc eax
add dword [ebp - 0x34], 2
cmp ax, 3
jb 0x4ed20b
jmp 0x4ed2f4
movzx eax, word [ebp - 0x2a]
mov esi, 9
cdq
idiv esi
mov word [ebp - 0x2a], dx
movzx eax, word [ebp - 0x2a]
mov esi, 3
cdq
idiv esi
mov word [ebp - 0xa], ax
jmp 0x4ed2f4
movzx eax, word [ebp - 0x2a]
mov esi, 9
cdq
idiv esi
cmp edx, 8
ja case.default.0x4ed268
jmp dword [edx*4 + 0x4ed26f]
movzx eax, word [ebp - 0xc]
xor edx, edx
lea eax, [ebp + eax*2 - 0x1cc]
mov dword [ebp - 0x30], eax
movzx eax, word [ebp - 0xc]
lea eax, [ebp + eax*2 - 0x1cc]
mov dword [ebp - 0x34], eax
movzx eax, word [ebp - 0xa]
mov esi, dword [ebp - 0x34]
mov ax, word [esi + eax*8]
mov esi, dword [ebp - 0x30]
cmp ax, word [esi]
jbe 0x4ed2cd
mov word [ebp - 0xa], dx
inc edx
add dword [ebp - 0x30], 8
cmp dx, 3
jb 0x4ed2b6
jmp 0x4ed2f4
movzx eax, word [ebp - 0xa]
lea edx, [eax + eax*2]
add dx, word [ebp - 0xc]
mov word [ebp - 0x2a], dx
mov ax, word [ebp - 0x2a]
mov word [ebp - 0x1b0], ax
inc ecx
cmp cx, 7
jb 0x4ed16b
jmp case.0x4ed268.0
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [ecx + 5]
mov dword [ebx], eax
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
xor eax, eax
mov al, byte [ecx]
mov dword [ebx + 8], eax
jmp case.0x4ed45b.8
xor ecx, ecx
movzx edx, cx
cmp edx, 5
ja case.default.0x4ed329
jmp dword [edx*4 + 0x4ed330]
xor edx, edx
lea eax, [ebp - 0x1cc]
mov dword [ebp - 0x38], eax
xor eax, eax
mov esi, dword [ebp - 0x38]
mov word [esi], 0
inc eax
add esi, 2
cmp ax, 3
jb 0x4ed358
inc edx
add dword [ebp - 0x38], 8
cmp dx, 3
jb 0x4ed353
jmp case.default.0x4ed329
mov word [ebp - 0x1c6], 0
jmp case.default.0x4ed329
inc word [ebp - 0x1c0]
jmp case.default.0x4ed329
mov word [ebp - 0x1b6], 0xffff
jmp case.default.0x4ed329
mov word [ebp - 0x1ae], 0
jmp case.default.0x4ed329
mov word [ebp - 0x1b0], 0
inc ecx
cmp cx, 6
jb 0x4ed321
jmp case.0x4ed268.0
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [edx + 1]
mov dword [ebx + 0x10], ecx
mov eax, dword [ebp + 8]
mov edx, dword [eax]
cmp dword [edx + 9], 0
je case.0x4ed45b.8
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov al, byte [eax]
cmp al, 1
je case.0x4ed45b.8
cmp al, 7
je case.0x4ed45b.8
push 0x10
lea eax, [ebx + 0x18]
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
push dword [ecx + 9]
push eax
call fcn.004e90d0
add esp, 0xc
jmp case.0x4ed45b.8
movzx ecx, word [ebp - 0x2a]
mov eax, ecx
mov esi, 7
cdq
idiv esi
cmp edx, 2
sete al
and eax, 1
mov esi, eax
mov eax, ecx
mov ecx, 0xb
cdq
idiv ecx
cmp edx, 5
sete al
and eax, 1
or esi, eax
je 0x4ed44f
mov dx, word [ebp - 0x1b0]
mov word [ebp - 0x1b6], dx
mov word [ebp - 0x1b2], 1
jmp 0x4ed063
movzx ecx, word [ebp - 0x1c6]
cmp ecx, 9
ja case.0x4ed45b.3
jmp dword [ecx*4 + 0x4ed462]
call fcn.004e959a
mov dword [ebx + 0x14], eax
call fcn.004e959a
mov dword [ebx + 0x28], eax
jmp case.0x4ed45b.8
cmp byte [ebp + 0x10], 1
jne case.0x4ed45b.8
mov byte [ebp - 0x1ac], 0x47
mov byte [ebp - 0x1ab], 0x65
mov byte [ebp - 0x1aa], 0x74
mov byte [ebp - 0x1a9], 0x53
mov byte [ebp - 0x1a8], 0x79
mov byte [ebp - 0x1a7], 0x73
mov byte [ebp - 0x1a6], 0x74
mov byte [ebp - 0x1a5], 0x65
mov byte [ebp - 0x1a4], 0x6d
mov byte [ebp - 0x1a3], 0x54
mov byte [ebp - 0x1a2], 0x69
mov byte [ebp - 0x1a1], 0x6d
mov byte [ebp - 0x1a0], 0x65
mov byte [ebp - 0x19f], 0
call fcn.004e9129
lea edx, [ebp - 0x1ac]
push edx
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 8], eax
lea eax, [ebp - 0x198]
push eax
call dword [ebp - 8]
mov cl, byte [ebp - 0x198]
mov byte [ebx + 0x28], cl
mov al, byte [ebp - 0x196]
mov byte [ebx + 0x2a], al
mov dl, byte [ebx + 0x29]
xor byte [ebx + 0x28], dl
mov cl, byte [ebx + 0x2b]
xor byte [ebx + 0x2a], cl
jmp case.0x4ed45b.8
mov eax, dword [ebx + 0x14]
xor dword [ebx], eax
mov edx, dword [ebx + 0x14]
xor dword [ebx + 4], edx
mov ecx, dword [ebx + 0x14]
xor dword [ebx + 8], ecx
mov eax, dword [ebx + 0x14]
xor dword [ebx + 0xc], eax
mov edx, dword [ebx + 0x14]
xor dword [ebx + 0x10], edx
xor ecx, ecx
movzx eax, cx
mov edx, eax
imul edx, eax
lea eax, [eax + eax*2]
add edx, eax
inc edx
dec edx
je 0x4ed591
sub edx, 4
je 0x4ed59a
sub edx, 6
je 0x4ed5eb
sub edx, 8
je 0x4ed063
jmp case.default.0x4ed5be
inc word [ebp - 0x1c6]
jmp case.default.0x4ed5be
mov dx, word [ebp - 0x1c6]
cmp dx, word [ebp - 0x1b4]
jne case.default.0x4ed5be
movzx eax, word [ebp - 0x1ae]
mov esi, 9
cdq
idiv esi
cmp edx, 8
ja case.default.0x4ed5be
jmp dword [edx*4 + 0x4ed5c5]
mov word [ebp - 0x1b2], 1
inc ecx
cmp cx, 4
jb 0x4ed56b
mov eax, dword [ebx + 4]
xor dword [ebx], eax
mov edx, dword [ebx + 0xc]
xor dword [ebx], edx
mov ecx, dword [ebx + 0xc]
xor dword [ebx + 4], ecx
mov eax, dword [ebx + 0xc]
xor dword [ebx + 8], eax
jmp case.0x4ed45b.8
push 0x10
push 0
lea edx, [ebp - 0x48]
push edx
call fcn.004e910b
add esp, 0xc
lea ecx, [ebp - 0x48]
push ecx
call fcn.004ecbd8
pop ecx
lea eax, [ebp - 0x188]
push eax
push 0
push 0
lea edx, [ebp - 0x48]
push edx
push 0
push 0
call fcn.004eb227
add esp, 0x18
mov esi, 0x2c
cmp byte [ebp + 0x10], 1
jne 0x4ed6c4
sub esi, 4
mov eax, esi
mov edx, esi
and eax, 0xf
mov edi, esi
sub edx, eax
lea eax, [ebp - 0x74]
mov dword [ebp - 4], edx
push esi
push ebx
push eax
sub edi, 0x10
call fcn.004e90d0
add esp, 0xc
lea edx, [ebp - 0x188]
push edx
lea ecx, [ebp - 0x74]
push ecx
mov eax, dword [ebp - 4]
shl eax, 3
push eax
push ebx
call fcn.004eb331
add esp, 0x10
lea edx, [ebp - 0x74]
push esi
push edx
push ebx
call fcn.004e90d0
add esp, 0xc
lea ecx, [ebp - 0x188]
add ebx, edi
lea eax, [ebp - 0x74]
push ecx
push ebx
add eax, edi
push 0x80
push eax
call fcn.004eb331
add esp, 0x10
jmp 0x4ed72b
mov edx, esi
mov ecx, esi
and edx, 0xf
mov edi, esi
sub ecx, edx
lea eax, [ebp - 0x74]
mov dword [ebp - 4], ecx
push esi
push ebx
push eax
sub edi, 0x10
call fcn.004e90d0
add esp, 0xc
lea edx, [ebp - 0x188]
push edx
lea ecx, [ebp - 0x74]
push ecx
mov eax, dword [ebp - 4]
shl eax, 3
push eax
push ebx
call fcn.004eb331
add esp, 0x10
lea edx, [ebp - 0x74]
push esi
push edx
push ebx
call fcn.004e90d0
add esp, 0xc
mov eax, edi
lea ecx, [ebp - 0x188]
add ebx, eax
push ecx
push ebx
lea edx, [ebp - 0x74]
push 0x80
add edx, eax
push edx
call fcn.004eb331
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret