Function at 0x47f130
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e2963
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x66f040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x7c]
movdqa xmm0, xmmword [0x64e510]
mov dword [ebp - 0x88], eax
xor eax, eax
mov word [ebp - 0x24], ax
mov byte [ebp - 0x3e], al
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x6c]
movdqu xmmword [ebp - 0x6c], xmm0
push eax
movdqa xmm0, xmmword [0x64e270]
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x78], 0x4c5157
mov dword [ebp - 0x3c], 0x61004d
mov dword [ebp - 0x38], 0x75006e
mov dword [ebp - 0x34], 0x610066
mov dword [ebp - 0x30], 0x740063
mov dword [ebp - 0x2c], 0x720075
mov dword [ebp - 0x28], 0x720065
movdqu xmmword [ebp - 0x5c], xmm0
mov dword [ebp - 0x4c], 0x32336e69
mov dword [ebp - 0x48], 0x6f72505f
mov dword [ebp - 0x44], 0x73736563
mov word [ebp - 0x40], 0x726f
mov dword [ebp - 0x20], 0x61004e
mov dword [ebp - 0x1c], 0x65006d
call fcn.00464750
mov esi, eax
lea eax, [ebp - 0x78]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x84]
call fcn.00464750
mov byte [ebp - 4], 1
mov edx, dword [esi]
test edx, edx
je 0x47f225
mov edx, dword [edx]
jmp 0x47f227
xor edx, edx
mov eax, dword [eax]
test eax, eax
je 0x47f231
mov ecx, dword [eax]
jmp 0x47f233
xor ecx, ecx
mov eax, dword [edi]
lea esi, [ebp - 0x70]
push esi
push 0
push 0x30
push edx
push ecx
push edi
call dword [eax + 0x50]
mov esi, dword [ebp - 0x84]
mov edi, eax
mov edx, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test esi, esi
je 0x47f2a6
lea ecx, [esi + 8]
push ecx
call edx
test eax, eax
jne 0x47f296
test esi, esi
je 0x47f296
mov eax, dword [esi]
test eax, eax
je 0x47f276
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x47f28d
push eax
call fcn.0049a336
add esp, 4
mov dword [esi + 4], 0
push esi
call fcn.0049a336
add esp, 4
mov edx, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov dword [ebp - 0x84], 0
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x7c]
test esi, esi
je 0x47f2f5
lea eax, [esi + 8]
push eax
call edx
test eax, eax
jne 0x47f2f5
test esi, esi
je 0x47f2f5
mov eax, dword [esi]
test eax, eax
je 0x47f2d5
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x47f2ec
push eax
call fcn.0049a336
add esp, 4
mov dword [esi + 4], 0
push esi
call fcn.0049a336
add esp, 4
test edi, edi
jns 0x47f30a
push 0x669730
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], edi
push eax
call fcn.005c840b
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x80], 0
test ecx, ecx
je 0x47f420
mov edi, dword [sym.imp.OLEAUT32.dll_VariantInit]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov eax, dword [ecx]
lea edx, [ebp - 0x80]
push edx
lea edx, [ebp - 0x74]
push edx
push 1
push 0xffffffffffffffff
push ecx
call dword [eax + 0x10]
cmp dword [ebp - 0x80], 0
je 0x47f41d
mov eax, dword [ebp - 0x74]
lea edx, [ebp - 0xac]
push 0
push 0
push edx
mov ecx, dword [eax]
lea edx, [ebp - 0x20]
push 0
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x47f3a7
cmp word [ebp - 0xac], 8
jne 0x47f3a7
push dword [ebp - 0xa4]
call edi
cmp eax, 0x200
jae 0x47f39e
push 0x200
push dword [ebp - 0xa4]
push ebx
call fcn.005c5622
add esp, 0xc
or dword [0x6803c8], 0x10
lea eax, [ebp - 0xac]
push eax
call esi
mov eax, dword [ebp - 0x74]
lea edx, [ebp - 0x9c]
push 0
push 0
push edx
mov ecx, dword [eax]
lea edx, [ebp - 0x3c]
push 0
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x47f407
cmp word [ebp - 0x9c], 8
jne 0x47f407
push dword [ebp - 0x94]
call edi
cmp eax, 0x200
jae 0x47f3fe
push 0x200
push dword [ebp - 0x94]
push dword [ebp - 0x88]
call fcn.005c5622
add esp, 0xc
or dword [0x6803c8], 8
lea eax, [ebp - 0x9c]
push eax
call esi
mov eax, dword [ebp - 0x74]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 0x70]
test ecx, ecx
jne 0x47f330
jmp 0x47f420
mov ecx, dword [ebp - 0x70]
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005c02df
mov esp, ebp
pop ebp
ret