Function at 0x401e90
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c180
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
push esi
push edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], esp
push 0x433fd0
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0xe
call fcn.0040374b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp + 8]
cmp word [eax], 0x5a4d
je 0x401f10
mov eax, 0x401efd
ret
mov edi, dword [eax + 0x3c]
add edi, eax
mov dword [ebp - 0x20], edi
cmp dword [edi], 0x4550
je 0x401f39
mov eax, 0x401f26
ret
mov ecx, dword [edi + 0x50]
mov edx, dword [edi + 0x34]
push 4
push 0x2000
push ecx
push edx
call dword [0x43cd74]
mov esi, eax
test esi, esi
mov dword [ebp - 0x18], esi
jne 0x401f8c
mov eax, dword [edi + 0x50]
push 4
push 0x2000
push eax
push esi
call dword [0x43cd74]
test eax, eax
mov dword [ebp - 0x18], eax
jne 0x401f89
mov eax, 0x401f76
ret
mov esi, dword [ebp - 0x18]
mov al, 0x45
mov cl, 0x73
mov byte [ebp - 0x33], al
mov byte [ebp - 0x30], al
mov al, 0x6c
mov byte [ebp - 0x4c], cl
mov byte [ebp - 0x4b], cl
lea ecx, [ebp - 0x54]
mov byte [ebp - 0x2a], al
mov byte [ebp - 0x29], al
lea edx, [ebp - 0x34]
mov al, 0x65
push ecx
push edx
mov byte [ebp - 0x34], 0x4b
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4e
mov byte [ebp - 0x2f], 0x4c
mov byte [ebp - 0x2e], 0x33
mov byte [ebp - 0x2d], 0x32
mov byte [ebp - 0x2c], 0x2e
mov byte [ebp - 0x2b], 0x64
mov byte [ebp - 0x28], 0
mov byte [ebp - 0x54], 0x47
mov byte [ebp - 0x53], al
mov byte [ebp - 0x52], 0x74
mov byte [ebp - 0x51], 0x50
mov byte [ebp - 0x50], 0x72
mov byte [ebp - 0x4f], 0x6f
mov byte [ebp - 0x4e], 0x63
mov byte [ebp - 0x4d], al
mov byte [ebp - 0x4a], 0x48
mov byte [ebp - 0x49], al
mov byte [ebp - 0x48], 0x61
mov byte [ebp - 0x47], 0x70
mov byte [ebp - 0x46], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x14
push 0
call eax
push eax
call dword [0x43cd60]
mov ebx, eax
mov dword [ebp - 0x24], ebx
mov dword [ebx + 4], esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor eax, eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebx + 0x10], eax
mov eax, dword [edi + 0x50]
push 4
push 0x1000
push eax
push esi
call dword [0x43cd74]
mov ecx, dword [edi + 0x54]
push 4
push 0x1000
push ecx
push esi
call dword [0x43cd74]
mov esi, dword [ebp + 8]
mov edx, dword [edi + 0x54]
mov edi, eax
mov ecx, dword [esi + 0x3c]
add ecx, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3c]
add eax, edx
mov dword [ebx], eax
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x18]
push ebx
push edi
push ecx
mov dword [eax + 0x34], esi
call fcn.00402170
add esp, 0xc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [edi + 0x34]
mov eax, esi
sub eax, ecx
je 0x4020e0
push eax
push ebx
call fcn.004023b0
add esp, 8
push ebx
call fcn.004024b0
add esp, 4
test eax, eax
je 0x402110
push ebx
call fcn.00402270
mov eax, dword [ebx]
add esp, 4
mov eax, dword [eax + 0x28]
test eax, eax
je 0x402149
add eax, esi
test eax, eax
je 0x402110
push 0
push 1
push esi
call eax
test eax, eax
jne 0x402132
push ebx
call fcn.004027b0
add esp, 4
mov eax, 0x40211f
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebx + 0x10], 1
mov eax, 0x40214f
ret