Function at 0x4a5b30
Capabilities:
Contain obfuscated stackstrings
Inspect section memory permissions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x531077
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xd78
mov eax, dword [0x566090]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xd08], ecx
mov eax, dword [ebx + 8]
lea edx, [ebp - 0x34]
mov dword [ebp - 0xcf0], 0
lea ecx, [ebp - 0x6ec]
mov dword [ebp - 0xcfc], 0
movaps xmm0, xmmword [str.CReinitProcess::CrashIdentifier:CrashedModuleInfendedInformationSubmitCrashEvento::FillModuleExt]
mov dword [ebp - 0xd14], eax
lea eax, [ebp - 0x194]
push eax
mov dword [ebp - 0x24], 0x203e2d20
mov byte [ebp - 0x20], 0
movups xmmword [ebp - 0x194], xmm0
mov dword [ebp - 0x184], 0x61657243
mov dword [ebp - 0x180], 0x72416574
mov dword [ebp - 0x17c], 0x76696863
mov word [ebp - 0x178], 0x65
mov dword [ebp - 0x34], 0x5244425b
mov dword [ebp - 0x30], 0x494e4945
mov dword [ebp - 0x2c], 0x3a205d54
mov word [ebp - 0x28], 0x203a
mov byte [ebp - 0x26], 0
call fcn.004ade80
add esp, 4
lea ecx, [ebp - 0x24]
mov edx, eax
push ecx
lea ecx, [ebp - 0x768]
call fcn.004adfc0
movaps xmm0, xmmword [str.CReinitProcess::CrashIdentifier:CrashedModuleInfendedInformationSubmitCrashEvento::FillModuleExt]
lea eax, [ebp - 0x1b4]
add esp, 4
mov dword [ebp - 0x1c], 0x202d3c20
lea edx, [ebp - 0x44]
mov byte [ebp - 0x18], 0
lea ecx, [ebp - 0x738]
mov dword [ebp - 0x1a4], 0x61657243
movups xmmword [ebp - 0x1b4], xmm0
push eax
mov dword [ebp - 0x1a0], 0x72416574
mov dword [ebp - 0x19c], 0x76696863
mov word [ebp - 0x198], 0x65
mov dword [ebp - 0x44], 0x5244425b
mov dword [ebp - 0x40], 0x494e4945
mov dword [ebp - 0x3c], 0x3a205d54
mov word [ebp - 0x38], 0x203a
mov byte [ebp - 0x36], 0
call fcn.004ade80
add esp, 4
lea ecx, [ebp - 0x1c]
mov edx, eax
push ecx
lea ecx, [ebp - 0x798]
call fcn.004adfc0
add esp, 4
call fcn.00441aa0
mov esi, eax
mov dword [ebp - 0xd70], 0
xorps xmm0, xmm0
mov dword [ebp - 0xd74], esi
lea eax, [ebp - 0x798]
movlpd qword [ebp - 0xd80], xmm0
mov dword [ebp - 0xd78], eax
mov ecx, dword [esi]
cmp dword [ecx], 0
je 0x4a5d2d
lea eax, [ebp - 0xd20]
movlpd qword [ebp - 0xd20], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0xd20]
mov ecx, dword [ebp - 0xd1c]
push 0x546f10
mov dword [ebp - 0xd80], eax
lea eax, [ebp - 0x768]
push eax
push str._s_s
push 0x546f10
push 0
push esi
mov dword [ebp - 0xd7c], ecx
call fcn.0043d760
add esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 0xd4c], 0
mov dword [ebp - 0xd48], 0x566b30
mov dword [ebp - 0x400], 0
xor eax, eax
mov dword [ebp - 0x3f0], 0
mov dword [ebp - 0x3ec], 7
mov word [ebp - 0x400], ax
mov byte [ebp - 4], 2
lea edx, [eax + 2]
mov esi, 0x64
mov ecx, 0x7fff
add esi, esi
cmp esi, 0x7fff
cmova esi, ecx
xor ecx, ecx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004fced4
mov edi, eax
add esp, 4
mov dword [ebp - 0xd3c], edi
push esi
push edi
push 0
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0xd10], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xcec], eax
test eax, eax
je 0x4a5dfb
cmp eax, 0x7a
jne 0x4a7cf1
push edi
mov byte [ebp - 4], 2
call fcn.004fcc7d
add esp, 4
mov ecx, 0x7fff
mov edx, 2
cmp esi, 0x7fff
jae 0x4a7d1e
jmp 0x4a5d80
test esi, esi
je 0x4a7cf1
cmp dword [ebp - 0xd10], esi
jae 0x4a7cf1
push ecx
lea eax, [ebp - 0xd0c]
mov dword [ebp - 0xd0c], edi
push eax
lea ecx, [ebp - 0x4a8]
call fcn.00481580
push edi
call fcn.004fcc7d
add esp, 4
lea eax, [ebp - 0x5b8]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x4a8]
call fcn.00459a40
lea ecx, [ebp - 0x4a8]
call fcn.00445ad0
mov edi, dword [ebp - 0xd08]
mov ecx, dword [ebp - 0xd14]
mov eax, dword [edi + 0x357c]
cmp byte [ecx + 0xc], 0
mov edx, dword [eax]
je 0x4a5e74
add edx, 0x1bd54
jmp 0x4a5e7a
add edx, 0x1ab3c
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a5e80
sub ecx, esi
mov dword [ebp - 0x3e8], 0
sar ecx, 1
push ecx
xor eax, eax
mov dword [ebp - 0x3d8], 0
push edx
lea ecx, [ebp - 0x3e8]
mov dword [ebp - 0x3d4], 7
mov word [ebp - 0x3e8], ax
mov byte [ebp - 4], 5
call fcn.00445880
mov esi, 0x7e00
mov dword [ebp - 0xce8], esi
mov dword [ebp - 0xcf0], esi
mov dword [ebp - 0xd38], 0
mov dword [ebp - 0xd34], 0
mov dword [ebp - 0xd30], 0
mov byte [ebp - 4], 8
mov eax, dword [edi + 0x357c]
mov dword [ebp - 0xd44], 0
mov ecx, dword [eax]
cmp dword [ecx + 0x5220], 0
jbe 0x4a65f7
mov eax, dword fs:[0x2c]
xor edx, edx
mov dword [ebp - 0xd10], edx
mov esi, dword [eax]
mov dword [ebp - 0xcec], esi
nop
mov eax, dword [0x56ae9c]
lea edi, [ecx + 0x5224]
add edi, edx
mov dword [ebp - 0xd50], edi
cmp eax, dword [esi + 4]
jg 0x4a7d47
mov eax, dword [0x56aea0]
cmp dword [eax], 0
je 0x4a6293
xor eax, eax
mov dword [ebp - 0x378], 0x80648041
lea edx, [ebp - 0x378]
mov dword [ebp - 0x374], 0x80698064
lea ecx, [ebp - 0x4e0]
mov dword [ebp - 0x370], 0x8067806e
mov dword [ebp - 0x36c], 0x80668020
mov dword [ebp - 0x368], 0x806c806f
mov dword [ebp - 0x364], 0x80658064
mov dword [ebp - 0x360], 0x80208072
mov dword [ebp - 0x35c], 0x806f8074
mov dword [ebp - 0x358], 0x80648020
mov dword [ebp - 0x354], 0x806d8075
mov dword [ebp - 0x350], 0x80208070
mov dword [ebp - 0x34c], 0x8069806c
mov dword [ebp - 0x348], 0x80748073
mov dword [ebp - 0x344], 0x8020803a
mov dword [ebp - 0x340], 0x807d807b
mov dword [ebp - 0x33c], 0x803a8020
mov dword [ebp - 0x338], 0x807b8020
mov dword [ebp - 0x334], 0x8020807d
mov dword [ebp - 0x330], 0x803e802d
mov dword [ebp - 0x32c], 0x807b8020
mov dword [ebp - 0x328], 0x8000807d
mov word [ebp - 0x324], ax
call fcn.00419a70
mov eax, dword [ebp - 0xce8]
or eax, 0x8000
mov byte [ebp - 4], 0xd
lea edx, [ebp - 0x4e0]
mov esi, dword [ebp - 0x5c]
or eax, 1
cmp dword [ebp - 0x4cc], 8
mov ecx, dword [edi + 0x2000]
cmovae edx, dword [ebp - 0x4e0]
mov dword [ebp - 0xce8], eax
mov dword [ebp - 0xcf0], eax
lea eax, [edi + 0x1000]
mov dword [ebp - 0x470], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x464], eax
mov eax, edx
mov dword [ebp - 0x474], esi
mov dword [ebp - 0x478], edi
mov dword [ebp - 0x468], ecx
lea esi, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4a60c0
sub esp, 0x10
sub eax, esi
mov ecx, esp
sar eax, 1
lea esi, [ebp - 0x478]
push eax
mov dword [ecx], 0x2cc
mov dword [ecx + 4], 0
mov dword [ecx + 8], esi
lea ecx, [ebp - 0x600]
push edx
call fcn.00426fd0
mov eax, dword [ebp - 0xce8]
add esp, 0x18
or eax, 0x10000
or eax, 2
mov dword [ebp - 4], 0xe
mov dword [ebp - 0xce8], eax
lea ecx, [ebp - 0x5a0]
mov dword [ebp - 0xcf0], eax
lea eax, [ebp - 0x600]
push eax
call fcn.00444e70
mov eax, dword [ebp - 0xce8]
or eax, 0x20000
mov dword [ebp - 4], 0xf
lea edi, [ebp - 0x5a0]
or eax, 4
mov dword [ebp - 0x1fc], 0x290028
cmp dword [ebp - 0x58c], 8
lea edx, [ebp - 0x3d0]
mov dword [ebp - 0xce8], eax
lea ecx, [ebp - 0xba8]
cmovae edi, dword [ebp - 0x5a0]
mov dword [ebp - 0xcf0], eax
lea eax, [ebp - 0x1fc]
push eax
mov dword [ebp - 0x1f8], 0x2d0020
mov dword [ebp - 0x1f4], 0x20
mov dword [ebp - 0x3d0], 0x42005b
mov dword [ebp - 0x3cc], 0x520044
mov dword [ebp - 0x3c8], 0x490045
mov dword [ebp - 0x3c4], 0x49004e
mov dword [ebp - 0x3c0], 0x5d0054
mov dword [ebp - 0x3bc], 0x3a0020
mov dword [ebp - 0x3b8], 0x20003a
mov dword [ebp - 0x3b4], 0x520043
mov dword [ebp - 0x3b0], 0x690065
mov dword [ebp - 0x3ac], 0x69006e
mov dword [ebp - 0x3a8], 0x500074
mov dword [ebp - 0x3a4], 0x6f0072
mov dword [ebp - 0x3a0], 0x650063
mov dword [ebp - 0x39c], 0x730073
mov dword [ebp - 0x398], 0x3a003a
mov dword [ebp - 0x394], 0x720043
mov dword [ebp - 0x390], 0x610065
mov dword [ebp - 0x38c], 0x650074
mov dword [ebp - 0x388], 0x720041
mov dword [ebp - 0x384], 0x680063
mov dword [ebp - 0x380], 0x760069
mov dword [ebp - 0x37c], 0x65
call fcn.004acb80
add esp, 4
mov esi, eax
call fcn.00441aa0
push edi
push 0
push esi
push 0
push eax
call fcn.0043ebb0
mov edi, dword [ebp - 0xd50]
add esp, 0x14
mov eax, dword [ebp - 0xce8]
test al, 4
je 0x4a62bd
and eax, 0xfffffffb
lea ecx, [ebp - 0x5a0]
mov dword [ebp - 0xce8], eax
mov dword [ebp - 0xcf0], eax
call fcn.00445ad0
mov eax, dword [ebp - 0xce8]
test al, 2
je 0x4a62e1
and eax, 0xfffffffd
lea ecx, [ebp - 0x600]
mov dword [ebp - 0xce8], eax
mov dword [ebp - 0xcf0], eax
call fcn.00445ad0
mov eax, dword [ebp - 0xce8]
mov dword [ebp - 4], 8
test al, 1
je 0x4a6306
and eax, 0xfffffffe
lea ecx, [ebp - 0x4e0]
mov dword [ebp - 0xce8], eax
mov dword [ebp - 0xcf0], eax
call fcn.00445ad0
push edi
lea ecx, [ebp - 0xd38]
call fcn.00459b70
test al, al
jne 0x4a65b2
xor eax, eax
mov dword [ebp - 0x31c], 0x80618057
lea edx, [ebp - 0x31c]
mov dword [ebp - 0x318], 0x806e8072
lea ecx, [ebp - 0x510]
mov dword [ebp - 0x314], 0x806e8069
mov dword [ebp - 0x310], 0x802c8067
mov dword [ebp - 0x30c], 0x80668020
mov dword [ebp - 0x308], 0x80698061
mov dword [ebp - 0x304], 0x8065806c
mov dword [ebp - 0x300], 0x80208064
mov dword [ebp - 0x2fc], 0x806f8074
mov dword [ebp - 0x2f8], 0x80618020
mov dword [ebp - 0x2f4], 0x80648064
mov dword [ebp - 0x2f0], 0x80668020
mov dword [ebp - 0x2ec], 0x806c806f
mov dword [ebp - 0x2e8], 0x80658064
mov dword [ebp - 0x2e4], 0x80008072
mov word [ebp - 0x2e0], ax
call fcn.00419a70
or dword [ebp - 0xce8], 0x40000
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x510]
cmp dword [ebp - 0x4fc], 8
lea edx, [ebp - 0xd54]
lea ecx, [ebp - 0x690]
cmovae eax, dword [ebp - 0x510]
mov dword [ebp - 0xd54], eax
call fcn.0041ccb0
push eax
lea ecx, [ebp - 0x4f8]
mov byte [ebp - 4], 0x11
call fcn.00444e70
mov eax, dword [ebp - 0xce8]
or eax, 0x100000
mov dword [ebp - 0xce8], eax
mov dword [ebp - 0xcf0], eax
mov byte [ebp - 4], 0x12
lea edi, [ebp - 0x4f8]
cmp dword [ebp - 0x4e4], 8
lea edx, [ebp - 0x234]
lea ecx, [ebp - 0xa90]
mov dword [ebp - 0x1c0], 0x290028
cmovae edi, dword [ebp - 0x4f8]
xor eax, eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x2dc]
push eax
mov dword [ebp - 0x1bc], 0x2d0020
mov dword [ebp - 0x1b8], 0x20
mov dword [ebp - 0x2dc], 0x520043
mov dword [ebp - 0x2d8], 0x690065
mov dword [ebp - 0x2d4], 0x69006e
mov dword [ebp - 0x2d0], 0x500074
mov dword [ebp - 0x2cc], 0x6f0072
mov dword [ebp - 0x2c8], 0x650063
mov dword [ebp - 0x2c4], 0x730073
mov dword [ebp - 0x2c0], 0x3a003a
mov dword [ebp - 0x2bc], 0x720043
mov dword [ebp - 0x2b8], 0x610065
mov dword [ebp - 0x2b4], 0x650074
mov dword [ebp - 0x2b0], 0x720041
mov dword [ebp - 0x2ac], 0x680063
mov dword [ebp - 0x2a8], 0x760069
mov dword [ebp - 0x2a4], 0x65
mov dword [ebp - 0x234], 0x42005b
mov dword [ebp - 0x230], 0x520044
mov dword [ebp - 0x22c], 0x490045
mov dword [ebp - 0x228], 0x49004e
mov dword [ebp - 0x224], 0x5d0054
mov dword [ebp - 0x220], 0x3a0020
mov dword [ebp - 0x21c], 0x20003a
call fcn.004aca10
add esp, 4
lea ecx, [ebp - 0x1c0]
mov edx, eax
push ecx
lea ecx, [ebp - 0xc10]
call fcn.004acb80
add esp, 4
mov esi, eax
call fcn.00441aa0
push edi
push 0
push esi
push 8
push eax
call fcn.0043ebb0
add esp, 0x14
lea ecx, [ebp - 0x4f8]
call fcn.00445ad0
lea ecx, [ebp - 0x690]
call fcn.00445ad0
lea ecx, [ebp - 0x510]
mov byte [ebp - 4], 8
call fcn.00445ad0
mov edi, dword [ebp - 0xd08]
mov esi, dword [ebp - 0xd44]
mov edx, dword [ebp - 0xd10]
inc esi
add edx, 0x2004
mov dword [ebp - 0xd44], esi
mov eax, dword [edi + 0x357c]
mov dword [ebp - 0xd10], edx
mov ecx, dword [eax]
cmp esi, dword [ecx + 0x5220]
mov esi, dword [ebp - 0xcec]
jb 0x4a5f30
mov esi, dword [ebp - 0xce8]
mov edi, dword [ebp - 0xd14]
mov eax, dword [eax]
cmp byte [edi + 0xc], 0
je 0x4a660d
mov eax, dword [eax + 0x1bd50]
jmp 0x4a6613
mov eax, dword [eax + 0x1ab38]
push eax
lea ecx, [ebp - 0xd38]
call fcn.0045ad30
test al, al
jne 0x4a6824
cmp dword [ebp - 0x3d4], 8
lea eax, [ebp - 0x3e8]
lea edx, [ebp - 0x118]
mov dword [ebp - 0x118], 0x80728045
cmovae eax, dword [ebp - 0x3e8]
lea ecx, [ebp - 0x15c]
mov dword [ebp - 0xcec], eax
mov dword [ebp - 0x114], 0x806f8072
mov dword [ebp - 0x110], 0x802c8072
mov dword [ebp - 0x10c], 0x80668020
mov dword [ebp - 0x108], 0x80698061
mov dword [ebp - 0x104], 0x8065806c
mov dword [ebp - 0x100], 0x80208064
mov dword [ebp - 0xfc], 0x806f8074
mov dword [ebp - 0xf8], 0x80618020
mov dword [ebp - 0xf4], 0x80648064
mov dword [ebp - 0xf0], 0x80648020
mov dword [ebp - 0xec], 0x806d8075
mov dword [ebp - 0xe8], 0x80208070
mov dword [ebp - 0xe4], 0x806f8074
mov dword [ebp - 0xe0], 0x80618020
mov dword [ebp - 0xdc], 0x80638072
mov dword [ebp - 0xd8], 0x80698068
mov dword [ebp - 0xd4], 0x80658076
mov dword [ebp - 0xd0], 0x8020803a
mov dword [ebp - 0xcc], 0x807d807b
mov dword [ebp - 0xc8], 0x8000
call fcn.00419a70
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x15c]
cmp dword [ebp - 0x148], 8
lea edx, [ebp - 0xd0c]
lea ecx, [ebp - 0x588]
cmovae eax, dword [ebp - 0x15c]
mov dword [ebp - 0xd0c], eax
lea eax, [ebp - 0xcec]
push eax
call fcn.0041cd30
add esp, 4
push eax
lea ecx, [ebp - 0x174]
mov byte [ebp - 4], 0x14
call fcn.00444e70
mov byte [ebp - 4], 0x15
lea edi, [ebp - 0x174]
cmp dword [ebp - 0x160], 8
lea ecx, [ebp - 0x270]
mov edx, str.CReinitProcess::CreateArchive
mov dword [ebp - 0x60], 0x290028
cmovae edi, dword [ebp - 0x174]
mov dword [ebp - 0x5c], 0x2d0020
mov dword [ebp - 0x58], 0x20
call fcn.004ac920
mov edx, str._BDREINIT__::
lea ecx, [ebp - 0x4c8]
mov esi, eax
call fcn.00419450
push esi
mov edx, eax
lea ecx, [ebp - 0xc0]
call fcn.004aca10
add esp, 4
lea ecx, [ebp - 0x60]
mov edx, eax
push ecx
lea ecx, [ebp - 0x898]
call fcn.004acb80
add esp, 4
mov esi, eax
call fcn.00441aa0
push edi
push 0
push esi
push 8
push eax
call fcn.0043ebb0
add esp, 0x14
lea ecx, [ebp - 0x174]
call fcn.00445ad0
lea ecx, [ebp - 0x588]
invalid