Function at 0x483f80
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Link many functions at runtime
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50d11c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
mov ebx, ecx
xor eax, eax
lea ecx, [ebx + 0xc]
mov dword [ebp - 0x10], ebx
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
push esi
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 7
push edi
mov word [ecx], ax
mov dword [ebp - 4], eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], 7
mov word [ebx + 0x30], ax
mov dword [ebx + 0x48], eax
mov dword [ebx + 0x4c], eax
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x54], eax
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x5c], 7
mov word [ebx + 0x48], ax
mov dword [ebx + 0x60], eax
mov dword [ebx + 0x64], eax
mov dword [ebx + 0x68], eax
mov dword [ebx + 0x6c], eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x74], 0xf
mov byte [ebx + 0x60], al
mov dword [ebx + 0x78], eax
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x88], eax
mov dword [ebx + 0x8c], 0xf
mov byte [ebx + 0x78], al
push 0x6f
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_119.0.0.0_Safari_537.36
mov byte [ebp - 4], 4
call fcn.0046caf0
cmp byte [0x53782c], 0
jne 0x484348
mov dword [ebp - 0x1d], 0xbfb8bca3
xor ecx, ecx
mov dword [ebp - 0x19], 0xd5aaadac
mov dword [ebp - 0x15], 0x929198
mov byte [ebp - 0x11], 1
lea ecx, [ecx]
lea eax, [ecx - 0xc]
xor byte [ebp + ecx - 0x1d], al
inc ecx
cmp ecx, 0xb
jb 0x484070
lea eax, [ebp - 0x1d]
mov byte [ebp - 0x11], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
mov dword [ebp - 0x2d], 0xbf989ca3
mov dword [ebp - 0x29], 0xb88a8d8c
xor ecx, ecx
mov dword [ebp - 0x25], 0x9a909393
mov dword [ebp - 0x21], 0x1007563
jmp 0x4840b0
lea eax, [ecx - 0xc]
xor byte [ebp + ecx - 0x2d], al
inc ecx
cmp ecx, 0xe
jb 0x4840b0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [ebp - 0x2d]
push eax
push edi
mov byte [ebp - 0x1e], 0
call esi
mov dword [0x53722c], eax
xor ecx, ecx
mov dword [ebp - 0x32], 0xbf989ca3
mov dword [ebp - 0x2e], 0xaa8a8d8c
mov dword [ebp - 0x2a], 0x868c9889
mov dword [ebp - 0x26], 0x67636448
mov dword [ebp - 0x22], 0x757761
mov byte [ebp - 0x1e], 1
lea esp, [esp]
lea eax, [ecx - 0xc]
xor byte [ebp + ecx - 0x32], al
inc ecx
cmp ecx, 0x13
jb 0x484100
lea eax, [ebp - 0x32]
mov byte [ebp - 0x1e], 0
push eax
push edi
call esi
mov dword [0x537230], eax
xor ecx, ecx
mov dword [ebp - 0x2a], 0xbf989ca3
mov dword [ebp - 0x26], 0xb48a8d8c
mov dword [ebp - 0x22], 0x90988c
mov byte [ebp - 0x1e], 1
lea eax, [ecx - 0xc]
xor byte [ebp + ecx - 0x2a], al
inc ecx
cmp ecx, 0xb
jb 0x484138
lea eax, [ebp - 0x2a]
mov byte [ebp - 0x1e], 0
push eax
push edi
call esi
mov dword [0x537218], eax
xor ecx, ecx
mov dword [ebp - 0x31], 0xbf989ca3
mov dword [ebp - 0x2d], 0xb48a8d8c
mov dword [ebp - 0x29], 0xad90988c
mov dword [ebp - 0x25], 0x66777065
mov dword [ebp - 0x21], 0x1007177
lea ebx, [ebx]
lea eax, [ecx - 0xc]
xor byte [ebp + ecx - 0x31], al
inc ecx
cmp ecx, 0x12
jb 0x484180
lea eax, [ebp - 0x31]
mov byte [ebp - 0x1e], 0
push eax
push edi
call esi
mov dword [0x537234], eax
xor ecx, ecx
mov dword [ebp - 0x38], 0xbf989ca3
mov dword [ebp - 0x34], 0xaa8a8d8c
mov dword [ebp - 0x30], 0x868c9889
mov dword [ebp - 0x2c], 0x62766044
mov dword [ebp - 0x28], 0x6e677345
mov dword [ebp - 0x24], 0x67686864
mov word [ebp - 0x20], 0x69
mov byte [ebp - 0x1e], 1
lea eax, [ecx - 0xc]
xor byte [ebp + ecx - 0x38], al
inc ecx
cmp ecx, 0x19
jb 0x4841d3
lea eax, [ebp - 0x38]
mov byte [ebp - 0x1e], 0
push eax
push edi
call esi
mov dword [0x537238], eax
xor ecx, ecx
mov dword [ebp - 0x31], 0xbf989ca3
mov dword [ebp - 0x2d], 0xa88a8d8c
mov dword [ebp - 0x29], 0xad9a9399
mov dword [ebp - 0x25], 0x66777065
mov dword [ebp - 0x21], 0x1007177
lea eax, [ecx - 0xc]
xor byte [ebp + ecx - 0x31], al
inc ecx
cmp ecx, 0x12
jb 0x484215
lea eax, [ebp - 0x31]
mov byte [ebp - 0x1e], 0
push eax
push edi
call esi
mov dword [0x537114], eax
xor ecx, ecx
mov dword [ebp - 0x35], 0xbf989ca3
mov dword [ebp - 0x31], 0xa98a8d8c
mov dword [ebp - 0x2d], 0x969b9e99
mov dword [ebp - 0x29], 0x66506476
mov dword [ebp - 0x25], 0x69697577
mov dword [ebp - 0x21], 0x1006c7b
mov edi, edi
lea eax, [ecx - 0xc]
xor byte [ebp + ecx - 0x35], al
inc ecx
cmp ecx, 0x16
jb 0x484260
lea eax, [ebp - 0x35]
mov byte [ebp - 0x1e], 0
push eax
push edi
call esi
mov dword [0x537224], eax
xor ecx, ecx
mov dword [ebp - 0x2e], 0xbf989ca3
mov dword [ebp - 0x2a], 0xa98a8d8c
mov dword [ebp - 0x26], 0xbb9a9c99
mov dword [ebp - 0x22], 0x637561
mov byte [ebp - 0x1e], 1
nop
lea eax, [ecx - 0xc]
xor byte [ebp + ecx - 0x2e], al
inc ecx
cmp ecx, 0xf
jb 0x4842a0
lea eax, [ebp - 0x2e]
mov byte [ebp - 0x1e], 0
push eax
push edi
call esi
mov dword [0x537228], eax
xor ecx, ecx
mov dword [ebp - 0x31], 0xbf989ca3
mov dword [ebp - 0x2d], 0xb88a8d8c
mov dword [ebp - 0x29], 0x9a8d9290
mov dword [ebp - 0x25], 0x676c6048
mov dword [ebp - 0x21], 0x1006068
lea eax, [ecx - 0xc]
xor byte [ebp + ecx - 0x31], al
inc ecx
cmp ecx, 0x12
jb 0x4842e2
lea eax, [ebp - 0x31]
mov byte [ebp - 0x1e], 0
push eax
push edi
call esi
mov dword [0x537220], eax
xor ecx, ecx
mov dword [ebp - 0x31], 0xbf989ca3
mov dword [ebp - 0x2d], 0xa88a8d8c
mov dword [ebp - 0x29], 0x96aa8999
mov dword [ebp - 0x25], 0x766d646d
mov dword [ebp - 0x21], 0x1007670
lea eax, [ecx - 0xc]
xor byte [ebp + ecx - 0x31], al
inc ecx
cmp ecx, 0x12
jb 0x484324
lea eax, [ebp - 0x31]
mov byte [ebp - 0x1e], 0
push eax
push edi
call esi
mov dword [0x53721c], eax
mov byte [0x53782c], 1
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret