Function at 0x4851e0
Capabilities:
Access peb ldr_data
Encode data using xor
Link many functions at runtime
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x515c8c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
mov ebx, ecx
xor eax, eax
lea ecx, [ebx + 0xc]
mov dword [ebp - 0x10], ebx
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 7
mov word [ecx], ax
mov dword [ebp - 4], eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], 7
mov word [ebx + 0x30], ax
mov byte [ebp - 4], 1
mov dword [ebx + 0x48], eax
mov dword [ebx + 0x4c], eax
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x54], eax
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x5c], 7
mov word [ebx + 0x48], ax
mov byte [ebp - 4], 2
mov dword [ebx + 0x60], eax
mov dword [ebx + 0x64], eax
mov dword [ebx + 0x68], eax
mov dword [ebx + 0x6c], eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x74], 0xf
mov byte [ebx + 0x60], al
mov byte [ebp - 4], 3
mov dword [ebx + 0x78], eax
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x88], eax
mov dword [ebx + 0x8c], 0xf
mov byte [ebx + 0x78], al
mov byte [ebp - 4], 4
push 0x6f
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_119.0.0.0_Safari_537.36
call fcn.00468230
cmp byte [0x544854], 0
jne 0x4855c2
mov dword [ebp - 0x1d], 0xa2a7a1b0
xor ecx, ecx
mov dword [ebp - 0x19], 0xc0bdb8bf
mov dword [ebp - 0x15], 0x9d9c8b
mov byte [ebp - 0x11], 1
lea eax, [ecx - 0x19]
xor byte [ebp + ecx - 0x1d], al
inc ecx
cmp ecx, 0xb
jb 0x4852d7
push esi
push edi
lea eax, [ebp - 0x1d]
mov byte [ebp - 0x11], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
mov dword [ebp - 0x2d], 0xa28781b0
mov dword [ebp - 0x29], 0xad9d989f
xor ecx, ecx
mov dword [ebp - 0x25], 0x979f9e80
mov dword [ebp - 0x21], 0x1008090
lea eax, [ecx - 0x19]
xor byte [ebp + ecx - 0x2d], al
inc ecx
cmp ecx, 0xe
jb 0x485314
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [ebp - 0x2d]
push eax
push edi
mov byte [ebp - 0x1e], 0
call esi
mov dword [0x54418c], eax
xor ecx, ecx
mov dword [ebp - 0x32], 0xa28781b0
mov dword [ebp - 0x2e], 0xbf9d989f
mov dword [ebp - 0x2a], 0x8b83959a
mov dword [ebp - 0x26], 0x929491bb
mov dword [ebp - 0x22], 0x8a8a92
mov byte [ebp - 0x1e], 1
lea eax, [ecx - 0x19]
xor byte [ebp + ecx - 0x32], al
inc ecx
cmp ecx, 0x13
jb 0x485360
lea eax, [ebp - 0x32]
mov byte [ebp - 0x1e], 0
push eax
push edi
call esi
mov dword [0x544190], eax
xor ecx, ecx
mov dword [ebp - 0x2a], 0xa28781b0
mov dword [ebp - 0x26], 0xa19d989f
mov dword [ebp - 0x22], 0x9f959f
mov byte [ebp - 0x1e], 1
lea eax, [ecx - 0x19]
xor byte [ebp + ecx - 0x2a], al
inc ecx
cmp ecx, 0xb
jb 0x485398
lea eax, [ebp - 0x2a]
mov byte [ebp - 0x1e], 0
push eax
push edi
call esi
mov dword [0x544178], eax
xor ecx, ecx
mov dword [ebp - 0x31], 0xa28781b0
mov dword [ebp - 0x2d], 0xa19d989f
mov dword [ebp - 0x29], 0xa09f959f
mov dword [ebp - 0x25], 0x93808596
mov dword [ebp - 0x21], 0x1008c84
lea ebx, [ebx]
lea eax, [ecx - 0x19]
xor byte [ebp + ecx - 0x31], al
inc ecx
cmp ecx, 0x12
jb 0x4853e0
lea eax, [ebp - 0x31]
mov byte [ebp - 0x1e], 0
push eax
push edi
call esi
mov dword [0x544194], eax
xor ecx, ecx
mov dword [ebp - 0x38], 0xa28781b0
mov dword [ebp - 0x34], 0xbf9d989f
mov dword [ebp - 0x30], 0x8b83959a
mov dword [ebp - 0x2c], 0x978195b7
mov dword [ebp - 0x28], 0x93988eb6
mov dword [ebp - 0x24], 0x929f9d97
mov word [ebp - 0x20], 0x9a
mov byte [ebp - 0x1e], 1
lea eax, [ecx - 0x19]
xor byte [ebp + ecx - 0x38], al
inc ecx
cmp ecx, 0x19
jb 0x485433
lea eax, [ebp - 0x38]
mov byte [ebp - 0x1e], 0
push eax
push edi
call esi
mov dword [0x544198], eax
xor ecx, ecx
mov dword [ebp - 0x31], 0xa28781b0
mov dword [ebp - 0x2d], 0xbd9d989f
mov dword [ebp - 0x29], 0xa0959e8a
mov dword [ebp - 0x25], 0x93808596
mov dword [ebp - 0x21], 0x1008c84
lea eax, [ecx - 0x19]
xor byte [ebp + ecx - 0x31], al
inc ecx
cmp ecx, 0x12
jb 0x485475
lea eax, [ebp - 0x31]
mov byte [ebp - 0x1e], 0
push eax
push edi
call esi
mov dword [0x544074], eax
xor ecx, ecx
mov dword [ebp - 0x35], 0xa28781b0
mov dword [ebp - 0x31], 0xbc9d989f
mov dword [ebp - 0x2d], 0x9b94938a
mov dword [ebp - 0x29], 0x93a79185
mov dword [ebp - 0x25], 0x94968884
mov dword [ebp - 0x21], 0x1009988
mov edi, edi
lea eax, [ecx - 0x19]
xor byte [ebp + ecx - 0x35], al
inc ecx
cmp ecx, 0x16
jb 0x4854c0
lea eax, [ebp - 0x35]
mov byte [ebp - 0x1e], 0
push eax
push edi
call esi
mov dword [0x544184], eax
xor ecx, ecx
mov dword [ebp - 0x2e], 0xa28781b0
mov dword [ebp - 0x2a], 0xbc9d989f
mov dword [ebp - 0x26], 0xb695918a
mov dword [ebp - 0x22], 0x948092
mov byte [ebp - 0x1e], 1
nop
lea eax, [ecx - 0x19]
xor byte [ebp + ecx - 0x2e], al
inc ecx
cmp ecx, 0xf
jb 0x485500
lea eax, [ebp - 0x2e]
mov byte [ebp - 0x1e], 0
push eax
push edi
call esi
mov dword [0x544188], eax
xor ecx, ecx
mov dword [ebp - 0x31], 0xa28781b0
mov dword [ebp - 0x2d], 0xad9d989f
mov dword [ebp - 0x29], 0x97829f83
mov dword [ebp - 0x25], 0x929b95bb
mov dword [ebp - 0x21], 0x1009d9b
lea eax, [ecx - 0x19]
xor byte [ebp + ecx - 0x31], al
inc ecx
cmp ecx, 0x12
jb 0x485542
lea eax, [ebp - 0x31]
mov byte [ebp - 0x1e], 0
push eax
push edi
call esi
mov dword [0x544180], eax
xor ecx, ecx
mov dword [ebp - 0x31], 0xa28781b0
mov dword [ebp - 0x2d], 0xbd9d989f
mov dword [ebp - 0x29], 0x9ba5848a
mov dword [ebp - 0x25], 0x839a919e
mov dword [ebp - 0x21], 0x1008b83
lea eax, [ecx - 0x19]
xor byte [ebp + ecx - 0x31], al
inc ecx
cmp ecx, 0x12
jb 0x485584
lea eax, [ebp - 0x31]
mov byte [ebp - 0x1e], 0
push eax
push edi
call esi
mov dword [0x54417c], eax
mov byte [0x544854], 1
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret