Function at 0x419a60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x46fb40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
lea eax, [ebp - 0x10]
push eax
push str.NTDLL.DLL
mov dword [ebp - 0x4c], ecx
mov bl, 0x72
mov dword [ebp - 0x10], 0x4c72644c
mov dword [ebp - 0xc], 0x4464616f
mov word [ebp - 8], 0x6c6c
mov byte [ebp - 6], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
lea ecx, [ebp - 0x28]
push ecx
push str.NTDLL.DLL
mov dword [0x471340], eax
mov dword [ebp - 0x28], 0x4772644c
mov dword [ebp - 0x24], 0x72507465
mov dword [ebp - 0x20], 0x6465636f
mov dword [ebp - 0x1c], 0x41657275
mov dword [ebp - 0x18], 0x65726464
mov word [ebp - 0x14], 0x7373
mov byte [ebp - 0x12], 0
call esi
push eax
call edi
cmp dword [0x471340], 0
mov dword [0x471344], eax
je 0x419de5
test eax, eax
je 0x419de5
lea edx, [ebp - 0x48]
push edx
push str.NTDLL.DLL
mov word [ebp - 0x48], 0x644c
mov byte [ebp - 0x46], bl
mov dword [ebp - 0x45], 0x50746547
mov byte [ebp - 0x41], bl
mov dword [ebp - 0x40], 0x6465636f
mov byte [ebp - 0x3c], 0x75
mov byte [ebp - 0x3b], bl
mov dword [ebp - 0x3a], 0x64644165
mov byte [ebp - 0x36], bl
mov dword [ebp - 0x35], 0x46737365
mov byte [ebp - 0x31], 0x6f
mov byte [ebp - 0x30], bl
mov dword [ebp - 0x2f], 0x6c6c6143
mov byte [ebp - 0x2b], 0x65
mov byte [ebp - 0x2a], bl
mov byte [ebp - 0x29], 0
call esi
push eax
call edi
mov dword [0x471348], eax
mov eax, dword [0x471340]
push 0x419770
push eax
push 0x45b1e4
call fcn.004182a0
mov ecx, dword [0x471344]
push 0x4196e0
push ecx
push 0x45b1e4
call fcn.004182a0
mov edx, dword [0x471348]
push 0x419720
push edx
push 0x45b1e4
call fcn.004182a0
mov eax, dword [0x471368]
push 0x418670
push eax
push 0x45b1d8
call fcn.004182a0
mov ecx, dword [0x47136c]
push 0x4187d0
push ecx
push 0x45b1d8
call fcn.004182a0
mov edx, dword [0x471370]
push 0x417ef0
push edx
push str.Winmm.dll
call fcn.004182a0
mov eax, dword [0x471374]
add esp, 0x48
push 0x417eb0
push eax
push str.Winmm.dll
call fcn.004182a0
mov ecx, dword [0x47134c]
push 0x417f30
push ecx
push str.Comctl32.dll
call fcn.004182a0
mov edx, dword [0x471378]
push method.ATL::CComObject_class_CATLBrowserHost_.virtual_12
push edx
push str.Wininet.dll
call fcn.004182a0
mov eax, dword [0x46f4d4]
push method.AlxLocalExecuter.1.virtual_128
push eax
push str.Wintrust.dll
call fcn.004182a0
mov ecx, dword [0x47137c]
push 0x418120
push ecx
push str.Crypt32.dll
call fcn.004182a0
mov edx, dword [0x471380]
push 0x417f40
push edx
push str.User32.dll
call fcn.004182a0
mov eax, dword [0x471388]
add esp, 0x48
push 0x418060
push eax
push str.User32.dll
call fcn.004182a0
mov ecx, dword [0x47138c]
push 0x418080
push ecx
push str.User32.dll
call fcn.004182a0
mov edx, dword [0x471390]
push 0x4180a0
push edx
push str.User32.dll
call fcn.004182a0
mov eax, dword [0x471394]
push 0x4180c0
push eax
push str.User32.dll
call fcn.004182a0
mov ecx, dword [0x471398]
push 0x4180d0
push ecx
push str.User32.dll
call fcn.004182a0
mov edx, dword [0x47139c]
push 0x4180f0
push edx
push str.User32.dll
call fcn.004182a0
mov eax, dword [0x4713a0]
add esp, 0x48
push 0x4189f0
push eax
push str.User32.dll
call fcn.004182a0
mov ecx, dword [0x471350]
push 0x417f60
push ecx
push str.Wininet.dll
call fcn.004182a0
mov edx, dword [0x471354]
push 0x417fd0
push edx
push str.Wininet.dll
call fcn.004182a0
mov eax, dword [0x471384]
push 0x418040
push eax
push str.Winmm.dll
call fcn.004182a0
mov ecx, dword [0x471358]
push 0x418050
push ecx
push str.Credui.dll
call fcn.004182a0
mov edx, dword [0x47135c]
push 0x418050
push edx
push str.Credui.dll
call fcn.004182a0
mov eax, dword [0x471360]
add esp, 0x48
push 0x418110
push eax
push str.dfdll.dll
call fcn.004182a0
mov ecx, dword [0x46f4d8]
push method.AlxLocalExecuter.1.virtual_128
push ecx
push str.DSound.dll
call fcn.004182a0
mov edx, dword [0x4713a4]
push method.AlxLocalExecuter.1.virtual_128
push edx
push str.Winmm.dll
call fcn.004182a0
mov eax, dword [0x4713a8]
push 0x418230
push eax
push str.Gdi32.dll
call fcn.004182a0
mov ecx, dword [0x471364]
push 0x418930
push ecx
push str.Shell32.dll
call fcn.004182a0
add esp, 0x3c
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x4c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00438fdb
mov esp, ebp
pop ebp
ret