Function at 0x4c40d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x530305
mov eax, dword fs:[0]
push eax
sub esp, 0x2ec
mov eax, dword [0x57f578]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x27c], esi
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x280], eax
mov eax, edi
mov dword [ebp - 0x2a0], edi
cmp dword [edi + 0x14], 0x10
mov dword [edi + 0x10], 0
jb 0x4c4128
mov eax, dword [edi]
push 0
lea ecx, [ebp - 0x29c]
mov byte [eax], 0
call fcn.00485ea0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2d0]
push 0
call fcn.00485ea0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2b8]
push 0
call fcn.00485ea0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x2b8]
push eax
mov ecx, esi
call fcn.004c3be0
test al, al
je 0x4c41b9
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x274], esp
push 0x538950
call fcn.00486080
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2b8]
push str.name
call fcn.004876d0
mov byte [ebp - 4], 2
mov ecx, eax
call fcn.00486460
lea eax, [ebp - 0x2b8]
push eax
lea ecx, [ebp - 0x2d0]
call fcn.00487730
push 0xa
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x28]
push str.HaoZip.exe
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.004092c0
mov byte [ebp - 4], 4
xor eax, eax
push 6
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 0
push 0x550e18
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.004092c0
mov byte [ebp - 4], 5
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.004c3e60
mov byte [ebp - 0x26d], al
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x40]
call fcn.00408080
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.00408080
cmp byte [ebp - 0x26d], 0
je 0x4c42a6
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x274], esp
push 0x538954
call fcn.00486080
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2b8]
push str.name
call fcn.004876d0
mov byte [ebp - 4], 2
mov ecx, eax
call fcn.00486460
lea eax, [ebp - 0x2b8]
push eax
lea ecx, [ebp - 0x2d0]
call fcn.00487730
push 0x10
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x40]
push str.2345Explorer.exe
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.004092c0
mov byte [ebp - 4], 7
xor eax, eax
push 0xc
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0
push str.2345Explorer
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.004092c0
mov byte [ebp - 4], 8
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004c3e60
mov byte [ebp - 0x26d], al
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x28]
call fcn.00408080
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.00408080
cmp byte [ebp - 0x26d], 0
je 0x4c4393
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x274], esp
push 0x538958
call fcn.00486080
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x2b8]
push str.name
call fcn.004876d0
mov byte [ebp - 4], 2
mov ecx, eax
call fcn.00486460
lea eax, [ebp - 0x2b8]
push eax
lea ecx, [ebp - 0x2d0]
call fcn.00487730
lea ecx, [ebp - 0x2d0]
call fcn.00487bc0
test al, al
je 0x4c43ae
mov byte [ebp - 0x26d], 0
jmp 0x4c4d6e
sub esp, 0x18
lea eax, [ebp - 0x2d0]
mov ecx, esp
mov dword [ebp - 0x274], esp
push eax
call fcn.004861e0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x29c]
push 0x53895c
call fcn.004876d0
mov byte [ebp - 4], 2
mov ecx, eax
call fcn.00486460
lea ecx, [ebp - 0x2e0]
call fcn.0042adf0
push 0x262a
push 0
push 9
push 0xa
lea ecx, [ebp - 0x2e0]
call fcn.0042ae10
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x2e0]
call fcn.0042aeb0
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00419970
mov byte [ebp - 4], 0xc
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x274], esp
push eax
call fcn.00486160
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x29c]
push str.exe_version
call fcn.004876d0
mov byte [ebp - 4], 0xc
mov ecx, eax
call fcn.00486460
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x58]
call fcn.004090a0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x274], esp
push 0x54f9f0
call fcn.00486080
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x29c]
push str.dll_version
call fcn.004876d0
mov byte [ebp - 4], 0xb
mov ecx, eax
call fcn.00486460
push 0x118
lea eax, [ebp - 0x268]
push 0
push eax
call fcn.004e8f30
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x26c], 0x11c
push eax
call fcn.0042a2f0
xor eax, eax
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 7
mov word [ebp - 0x88], ax
mov byte [ebp - 4], 0xf
push dword [ebp - 0x264]
lea eax, [ebp - 0x88]
push dword [ebp - 0x268]
push str._u._u
push eax
call fcn.0040d730
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00419970
mov byte [ebp - 4], 0x10
add esp, 0x10
mov ecx, esp
mov dword [ebp - 0x274], esp
push eax
call fcn.00486160
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x29c]
push str.os_version
call fcn.004876d0
mov byte [ebp - 4], 0x10
mov ecx, eax
call fcn.00486460
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x58]
call fcn.004090a0
call fcn.0042a260
test al, al
mov ecx, 0x40
mov edx, 0x20
cmovne edx, ecx
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x274], esp
push edx
call fcn.00485f90
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x29c]
push str.os_bit
call fcn.004876d0
mov byte [ebp - 4], 0xf
mov ecx, eax
call fcn.00486460
lea ecx, [ebp - 0xa0]
call fcn.00431500
mov byte [ebp - 4], 0x13
xor eax, eax
push 7
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0
push str.2345Pic
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.004092c0
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xa0]
call fcn.00431550
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x28]
call fcn.00408080
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0xa0]
call fcn.00432f20
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00419970
mov byte [ebp - 4], 0x16
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x274], esp
push eax
call fcn.00486160
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x29c]
push str.channel_id
call fcn.004876d0
mov byte [ebp - 4], 0x16
mov ecx, eax
call fcn.00486460
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x58]
call fcn.004090a0
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0xa0]
call fcn.00433210
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00419970
mov byte [ebp - 4], 0x19
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x274], esp
push eax
call fcn.00486160
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x29c]
push str.kuid
call fcn.004876d0
mov byte [ebp - 4], 0x19
mov ecx, eax
call fcn.00486460
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x58]
call fcn.004090a0
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0xa0]
call fcn.00433090
mov byte [ebp - 4], 0x1b
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00419970
mov byte [ebp - 4], 0x1c
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x274], esp
push eax
call fcn.00486160
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x29c]
push str.union_id
call fcn.004876d0
mov byte [ebp - 4], 0x1c
mov ecx, eax
call fcn.00486460
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x58]
call fcn.004090a0
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp - 0xa0]
call fcn.00433930
mov byte [ebp - 4], 0x1e
lea eax, [ebp - 0xf0]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00419970
mov byte [ebp - 4], 0x1f
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x274], esp
push eax
call fcn.00486160
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x29c]
push 0x549e38
call fcn.004876d0
mov byte [ebp - 4], 0x1f
mov ecx, eax
call fcn.00486460
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x58]
call fcn.004090a0
push 0
call fcn.004eddfc
sub esp, 0x14
mov ecx, esp
mov dword [ebp - 0x274], esp
push edx
push eax
call fcn.00486000
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x29c]
push str.local_time
call fcn.004876d0
mov byte [ebp - 4], 0x1e
mov ecx, eax
call fcn.00486460
xor eax, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
mov byte [ebp - 4], 0x22
lea eax, [ebp - 0x70]
push eax
call fcn.004d3c80
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00419970
mov byte [ebp - 4], 0x23
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x274], esp
push eax
call fcn.00486160
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x29c]
push str.processes
call fcn.004876d0
mov byte [ebp - 4], 0x23
mov ecx, eax
call fcn.00486460
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x58]
call fcn.004090a0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x274], esp
push dword [ebp - 0x280]
call fcn.00485f90
mov byte [ebp - 4], 0x25
push str.invoke_point
lea ecx, [ebp - 0x29c]
call fcn.004876d0
mov byte [ebp - 4], 0x22
mov ecx, eax
call fcn.00486460
lea ecx, [ebp - 0x284]
call fcn.00426180
mov byte [ebp - 4], 0x26
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea ecx, [ebp - 0x284]
call fcn.00427180
sub esp, 0x18
xor ecx, ecx
test al, al
mov dword [ebp - 0x274], esp
mov edx, esp
setne cl
push ecx
mov ecx, edx
call fcn.00485f90
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x29c]
push str.process_authority
call fcn.004876d0
mov byte [ebp - 4], 0x26
mov ecx, eax
call fcn.00486460
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x274], esp
call fcn.004cded0
movzx eax, al
mov ecx, esi
push eax
call fcn.004861b0
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x29c]
push str.uac_enabled
call fcn.004876d0
mov byte [ebp - 4], 0x26
mov ecx, eax
call fcn.00486460
mov ecx, dword [ebp - 0x27c]
lea ecx, [ecx + 8]
call fcn.00409140
mov esi, eax
mov dword [ebp - 0x280], esi
mov ecx, dword [esi]
cmp ecx, dword [esi + 4]
je 0x4c4bc1
push 0
lea ecx, [ebp - 0x58]
call fcn.00485ea0
mov byte [ebp - 4], 0x29
mov eax, 0x2aaaaaab
mov ecx, dword [esi + 4]
sub ecx, dword [esi]
imul ecx
mov dword [ebp - 0x27c], 0
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x274], eax
je 0x4c4b82
xor edi, edi
push 0
lea ecx, [ebp - 0x28]
call fcn.00485ea0
mov byte [ebp - 4], 0x2a
mov eax, dword [esi]
add eax, edi
cmp dword [eax + 0x14], 8
jb 0x4c498d
mov eax, dword [eax]
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x278], esp
push 0
push eax
call fcn.0040ce50
add esp, 8
mov ecx, esi
push edx
push eax
call fcn.00486040
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x28]
push str.time
call fcn.004876d0
mov byte [ebp - 4], 0x2a
mov ecx, eax
call fcn.00486460
mov esi, dword [ebp - 0x280]
mov eax, dword [esi]
add eax, 0x18
add eax, edi
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00419970
mov byte [ebp - 4], 0x2c
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x278], esp
push eax
call fcn.00486160
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x28]
push str.name
call fcn.004876d0
mov byte [ebp - 4], 0x2c
mov ecx, eax
call fcn.00486460
mov byte [ebp - 4], 0x2a
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x4c4a48
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4c4a3e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c4dc1
push edx
push ecx
call fcn.004e6b81
add esp, 8
mov eax, dword [esi]
add eax, 0x30
mov dword [ebp - 0x30], 0
add eax, edi
mov dword [ebp - 0x2c], 0xf
push eax
lea eax, [ebp - 0xb8]
mov byte [ebp - 0x40], 0
push eax
call fcn.00419970
mov byte [ebp - 4], 0x2e
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x278], esp
push eax
call fcn.00486160
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x28]
push 0x53894c
call fcn.004876d0
mov byte [ebp - 4], 0x2e
mov ecx, eax
call fcn.00486460
mov byte [ebp - 4], 0x2a
mov edx, dword [ebp - 0xa4]
cmp edx, 0x10
jb 0x4c4add
mov ecx, dword [ebp - 0xb8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4c4ad3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c4dc1
push edx
push ecx
call fcn.004e6b81
add esp, 8
mov eax, dword [esi]
add eax, 0x48
mov dword [ebp - 0xa8], 0
add eax, edi
mov dword [ebp - 0xa4], 0xf
mov byte [ebp - 0xb8], 0
cmp dword [eax + 0x14], 8
jb 0x4c4b07
mov eax, dword [eax]
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x278], esp
push 0
push eax
call fcn.0040ced0
add esp, 8
mov ecx, esi
push eax
call fcn.00485fc0
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x28]
push str.result
call fcn.004876d0
mov byte [ebp - 4], 0x2a
mov ecx, eax
call fcn.00486460
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x58]
call fcn.00487730
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x28]
call fcn.00486380
mov eax, dword [ebp - 0x27c]
add edi, 0x60
inc eax
mov dword [ebp - 0x27c], eax
cmp eax, dword [ebp - 0x274]
jae 0x4c4b7c
mov esi, dword [ebp - 0x280]
jmp 0x4c4973
mov edi, dword [ebp - 0x2a0]
sub esp, 0x18
lea eax, [ebp - 0x58]
mov ecx, esp
mov dword [ebp - 0x278], esp
push eax
call fcn.004861e0
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x29c]
push str.invoke_history
call fcn.004876d0
mov byte [ebp - 4], 0x29
mov ecx, eax
call fcn.00486460
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x58]
call fcn.00486380
push 0
lea ecx, [ebp - 0x2f8]
call fcn.00485ea0
mov byte [ebp - 4], 0x32
sub esp, 0x18
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x278], esp
mov ecx, esp
push eax
call fcn.004861e0
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x2f8]
push str.common_info
call fcn.004876d0
mov byte [ebp - 4], 0x32
mov ecx, eax
call fcn.00486460
lea ecx, [ebp - 0xd8]
call fcn.004812f0
mov byte [ebp - 4], 0x34
lea eax, [ebp - 0x2f8]
push eax
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0xd8]
call fcn.00481360
mov esi, eax
mov byte [ebp - 4], 0x35
cmp edi, esi
je 0x4c4c9c
mov ecx, dword [edi + 0x14]
cmp ecx, 0x10
jb 0x4c4c6a
mov eax, dword [edi]
inc ecx
cmp ecx, 0x1000
jb 0x4c4c60
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c4dc1
mov eax, edx
push ecx
push eax
call fcn.004e6b81
add esp, 8
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
movups xmm0, xmmword [esi]
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x58]
call fcn.004090a0
mov byte [ebp - 0x26d], 1
mov byte [ebp - 4], 0x32
mov dword [ebp - 0xd8], vtable.RCJson::FastWriter.0
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0xd4]
call fcn.004090a0
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0xd8]
call fcn.004812b0
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x2f8]
call fcn.00486380
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x284]
call fcn.00426200
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x70]
call fcn.00408080
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xf0]
call fcn.00408080
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x108]
call fcn.00408080
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x120]
call fcn.00408080
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x138]
call fcn.00408080
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xa0]
call fcn.0041f8b0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x88]
call fcn.00408080
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x150]
call fcn.00408080
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2b8]
call fcn.00486380
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2d0]
call fcn.00486380
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x29c]
call fcn.00486380
mov al, byte [ebp - 0x26d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e679a
mov esp, ebp
pop ebp
ret 8
call fcn.004ed63c
int3