Function at 0x40f3c2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xd0
mov eax, 0x489b3a
call fcn.00458e93
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x50]
push eax
mov esi, ecx
call fcn.00412df1
and dword [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.0040c514
push eax
lea eax, [ebp - 0x50]
push eax
mov byte [ebp - 4], 2
call fcn.00412ee4
pop ecx
pop ecx
lea ecx, [ebp - 0x58]
call fcn.0040cfc5
and dword [ebp - 4], 0
push 0x49d158
lea eax, [ebp - 0x30]
call fcn.004017d2
xor eax, eax
mov byte [ebp - 4], 4
lea edi, [ebp - 0x58]
stosb byte es:[edi], al
push str..Root
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.00401e38
add esp, 0xc
mov byte [ebp - 4], 5
push dword [ebp - 0x58]
push eax
lea eax, [ebp - 0xa4]
call fcn.00412fc4
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0x50]
push eax
mov byte [ebp - 4], 6
call fcn.00412fe7
mov byte [ebp - 4], 7
cmp dword [eax + 0x18], 8
jb 0x40f473
mov eax, dword [eax + 4]
jmp 0x40f476
add eax, 4
mov ebx, eax
lea ecx, [ebp - 0xdc]
call fcn.0042aae0
mov ecx, dword [ebp - 0x54]
push 0xffffffffffffffff
add ecx, 0x48
push ecx
xor ebx, ebx
mov byte [ebp - 4], 8
call fcn.0040191e
xor edi, edi
push edi
inc ebx
push ebx
lea esi, [ebp - 0xdc]
call fcn.004019bb
push edi
push ebx
lea esi, [ebp - 0xc0]
call fcn.004019bb
push edi
push ebx
lea esi, [ebp - 0xa4]
call fcn.004019bb
push edi
push ebx
lea esi, [ebp - 0x7c]
mov byte [ebp - 4], 4
call fcn.004019bb
xor eax, eax
lea edi, [ebp - 0x58]
stosb byte es:[edi], al
push str..Type
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.00401e38
add esp, 0xc
mov byte [ebp - 4], 9
push dword [ebp - 0x58]
push eax
lea eax, [ebp - 0xa4]
call fcn.00412fc4
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x50]
push eax
mov byte [ebp - 4], 0xa
call fcn.00412fe7
mov byte [ebp - 4], 0xb
cmp dword [eax + 0x18], 8
jb 0x40f527
mov eax, dword [eax + 4]
jmp 0x40f52a
add eax, 4
mov ebx, dword [ebp - 0x54]
push eax
lea esi, [ebx + 0x64]
call fcn.004019a5
xor edi, edi
push edi
push 1
lea esi, [ebp - 0x7c]
call fcn.004019bb
push edi
push 1
lea esi, [ebp - 0xa4]
call fcn.004019bb
push edi
push 1
lea esi, [ebp - 0xc0]
mov byte [ebp - 4], 4
call fcn.004019bb
push str..DumpLogFileName._xmlattr_.enable
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.00401e38
add esp, 0xc
push edi
push eax
lea eax, [ebp - 0x50]
push eax
mov byte [ebp - 4], 0xc
call fcn.0040fe95
push edi
push 1
lea esi, [ebp - 0x7c]
mov dword [ebx + 0x38], eax
mov byte [ebp - 4], 4
call fcn.004019bb
push str..GetSupportToken._xmlattr_.enable
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.00401e38
add esp, 0xc
push edi
push eax
lea eax, [ebp - 0x50]
push eax
mov byte [ebp - 4], 0xd
call fcn.0040fe95
push edi
push 1
lea esi, [ebp - 0x7c]
mov dword [ebx + 0x34], eax
mov byte [ebp - 4], 4
call fcn.004019bb
push str..WindowsErrorReporting._xmlattr_.enable
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.00401e38
add esp, 0xc
push edi
push eax
lea eax, [ebp - 0x50]
push eax
mov byte [ebp - 4], 0xe
call fcn.0040fe95
push edi
push 1
lea esi, [ebp - 0x7c]
mov dword [ebx + 0x44], eax
mov byte [ebp - 4], 4
call fcn.004019bb
push str..Console._xmlattr_.hide
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.00401e38
add esp, 0xc
push edi
push eax
lea eax, [ebp - 0x50]
push eax
mov byte [ebp - 4], 0xf
call fcn.0040fe95
push edi
push 1
lea esi, [ebp - 0x7c]
mov dword [ebx + 8], eax
mov byte [ebp - 4], 4
call fcn.004019bb
push str..Reboot._xmlattr_.enable
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.00401e38
add esp, 0xc
push edi
push eax
lea eax, [ebp - 0x50]
push eax
mov byte [ebp - 4], 0x10
call fcn.0040fe95
push edi
push 1
lea esi, [ebp - 0x7c]
mov dword [ebx + 4], eax
mov byte [ebp - 4], 4
call fcn.004019bb
push str..Reboot._xmlattr_.silent
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.00401e38
add esp, 0xc
push edi
push eax
lea eax, [ebp - 0x50]
push eax
mov byte [ebp - 4], 0x11
call fcn.0040fe95
push edi
push 1
lea esi, [ebp - 0x7c]
mov dword [ebx + 0x3c], eax
mov byte [ebp - 4], 4
call fcn.004019bb
push str..Reboot._xmlattr_.prompt
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.00401e38
add esp, 0xc
push 1
push eax
lea eax, [ebp - 0x50]
push eax
mov byte [ebp - 4], 0x12
call fcn.0040fe95
push edi
push 1
lea esi, [ebp - 0x7c]
mov dword [ebx + 0x40], eax
mov byte [ebp - 4], 4
call fcn.004019bb
xor eax, eax
lea edi, [ebp - 0x58]
stosb byte es:[edi], al
push str..ClientEnvironmentProxy
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.00401e38
add esp, 0xc
mov byte [ebp - 4], 0x13
push dword [ebp - 0x58]
push eax
lea eax, [ebp - 0xa4]
call fcn.00412fc4
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x50]
push eax
mov byte [ebp - 4], 0x14
call fcn.00412fe7
push 0xffffffffffffffff
add ebx, 0x180
push ebx
xor ebx, ebx
mov byte [ebp - 4], 0x15
call fcn.0040191e
xor edi, edi
push edi
push 1
lea esi, [ebp - 0x7c]
call fcn.004019bb
push edi
push 1
lea esi, [ebp - 0xa4]
call fcn.004019bb
push edi
push 1
lea esi, [ebp - 0xc0]
mov byte [ebp - 4], 4
call fcn.004019bb
xor eax, eax
lea edi, [ebp - 0x58]
stosb byte es:[edi], al
push str..Reporting.OutputFileComment
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.00401e38
add esp, 0xc
mov byte [ebp - 4], 0x16
push dword [ebp - 0x58]
push eax
lea eax, [ebp - 0xa4]
call fcn.00412fc4
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x50]
push eax
mov byte [ebp - 4], 0x17
call fcn.00412fe7
mov ecx, dword [ebp - 0x54]
push 0xffffffffffffffff
add ecx, 0x9c
push ecx
mov byte [ebp - 4], 0x18
call fcn.0040191e
xor edi, edi
push edi
push 1
lea esi, [ebp - 0x7c]
call fcn.004019bb
push edi
push 1
lea esi, [ebp - 0xa4]
call fcn.004019bb
push edi
push 1
lea esi, [ebp - 0xc0]
mov byte [ebp - 4], 4
call fcn.004019bb
xor eax, eax
lea edi, [ebp - 0x58]
stosb byte es:[edi], al
push str..Reporting.UploadToDrive
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0xdc]
push eax
call fcn.00401e38
add esp, 0xc
mov byte [ebp - 4], 0x19
push dword [ebp - 0x58]
push eax
lea eax, [ebp - 0xa4]
call fcn.00412fc4
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0x50]
push eax
mov byte [ebp - 4], 0x1a
call fcn.00412fe7
push eax
lea eax, [ebp - 0x7c]
push eax
mov byte [ebp - 4], 0x1b
call fcn.004266b0
pop ecx
pop ecx
mov ecx, dword [ebp - 0x54]
push 0xffffffffffffffff
sub ecx, 0xffffff80
push ecx
mov byte [ebp - 4], 0x1c
call fcn.0040191e
xor edi, edi
push edi
inc ebx
push ebx
lea esi, [ebp - 0x7c]
call fcn.004019bb
push edi
push ebx
lea esi, [ebp - 0xc0]
call fcn.004019bb
push edi
push ebx
lea esi, [ebp - 0xa4]
call fcn.004019bb
push edi
push ebx
lea esi, [ebp - 0xdc]
mov byte [ebp - 4], 4
call fcn.004019bb
xor eax, eax
lea edi, [ebp - 0x58]
stosb byte es:[edi], al
push str..Reporting.FTP.Username
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.00401e38
add esp, 0xc
mov byte [ebp - 4], 0x1d
push dword [ebp - 0x58]
push eax
lea eax, [ebp - 0xa4]
call fcn.00412fc4
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x50]
push eax
mov byte [ebp - 4], 0x1e
call fcn.00412fe7
mov ecx, dword [ebp - 0x54]
push 0xffffffffffffffff
add ecx, 0xb8
push ecx
xor ebx, ebx
mov byte [ebp - 4], 0x1f
call fcn.0040191e
xor edi, edi
push edi
push 1
lea esi, [ebp - 0x7c]
call fcn.004019bb
push edi
push 1
lea esi, [ebp - 0xa4]
call fcn.004019bb
push edi
push 1
lea esi, [ebp - 0xc0]
mov byte [ebp - 4], 4
call fcn.004019bb
xor eax, eax
lea edi, [ebp - 0x58]
stosb byte es:[edi], al
push str..Reporting.FTP.Password
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.00401e38
add esp, 0xc
mov byte [ebp - 4], 0x20
push dword [ebp - 0x58]
push eax
lea eax, [ebp - 0xa4]
call fcn.00412fc4
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x50]
push eax
mov byte [ebp - 4], 0x21
call fcn.00412fe7
mov ecx, dword [ebp - 0x54]
push 0xffffffffffffffff
add ecx, 0xd4
push ecx
mov byte [ebp - 4], 0x22
call fcn.0040191e
xor edi, edi
push edi
push 1
lea esi, [ebp - 0x7c]
call fcn.004019bb
push edi
push 1
lea esi, [ebp - 0xa4]
call fcn.004019bb
push edi
push 1
lea esi, [ebp - 0xc0]
mov byte [ebp - 4], 4
call fcn.004019bb
xor eax, eax
lea edi, [ebp - 0x58]
stosb byte es:[edi], al
push str..Reporting.FTP.IP
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.00401e38
add esp, 0xc
mov byte [ebp - 4], 0x23
push dword [ebp - 0x58]
push eax
lea eax, [ebp - 0xa4]
call fcn.00412fc4
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x50]
push eax
mov byte [ebp - 4], 0x24
call fcn.00412fe7
mov ecx, dword [ebp - 0x54]
push 0xffffffffffffffff
add ecx, 0xf0
push ecx
mov byte [ebp - 4], 0x25
call fcn.0040191e
xor edi, edi
push edi
push 1
lea esi, [ebp - 0x7c]
call fcn.004019bb
push edi
push 1
lea esi, [ebp - 0xa4]
call fcn.004019bb
push edi
push 1
lea esi, [ebp - 0xc0]
mov byte [ebp - 4], 4
call fcn.004019bb
xor eax, eax
lea edi, [ebp - 0x58]
stosb byte es:[edi], al
push str..Reporting.FTP.FTPRemotePath
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.00401e38
add esp, 0xc
mov byte [ebp - 4], 0x26
push dword [ebp - 0x58]
push eax
lea eax, [ebp - 0xa4]
call fcn.00412fc4
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x50]
push eax
mov byte [ebp - 4], 0x27
call fcn.00412fe7
mov ecx, dword [ebp - 0x54]
push 0xffffffffffffffff
add ecx, 0x10c
push ecx
mov byte [ebp - 4], 0x28
call fcn.0040191e
push ebx
push 1
lea esi, [ebp - 0x7c]
call fcn.004019bb
push ebx
push 1
lea esi, [ebp - 0xa4]
call fcn.004019bb
push ebx
push 1
lea esi, [ebp - 0xc0]
mov byte [ebp - 4], 4
call fcn.004019bb
xor eax, eax
lea edi, [ebp - 0x58]
stosb byte es:[edi], al
push str..Reporting.FTP.Port
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x7c]
push eax
mov dword [ebp - 0x60], ebx
call fcn.00401e38
add esp, 0xc
mov byte [ebp - 4], 0x29
push dword [ebp - 0x58]
push eax
lea eax, [ebp - 0xa4]
call fcn.00412fc4
lea eax, [ebp - 0xa4]
push eax
lea esi, [ebp - 0x5c]
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x2a
call fcn.00414522
cmp byte [eax], bl
je 0x40fb15
add eax, 4
jmp 0x40fb18
lea eax, [ebp - 0x60]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x54]
push ebx
push 1
lea esi, [ebp - 0xa4]
mov dword [ecx + 0x128], eax
call fcn.004019bb
push ebx
push 1
lea esi, [ebp - 0x7c]
mov byte [ebp - 4], 4
call fcn.004019bb
xor eax, eax
lea edi, [ebp - 0x60]
stosb byte es:[edi], al
push str..Reporting.LogZipPassword
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.00401e38
add esp, 0xc
mov byte [ebp - 4], 0x2b
push dword [ebp - 0x60]
push eax
lea eax, [ebp - 0xa4]
call fcn.00412fc4
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x50]
push eax
mov byte [ebp - 4], 0x2c
call fcn.00412fe7
mov ecx, dword [ebp - 0x54]
push 0xffffffffffffffff
add ecx, 0x12c
push ecx
xor ebx, ebx
mov byte [ebp - 4], 0x2d
call fcn.0040191e
xor edi, edi
push edi
push 1
lea esi, [ebp - 0x7c]
call fcn.004019bb
push edi
push 1
lea esi, [ebp - 0xa4]
call fcn.004019bb
push edi
push 1
lea esi, [ebp - 0xc0]
mov byte [ebp - 4], 4
call fcn.004019bb
xor eax, eax
lea edi, [ebp - 0x60]
stosb byte es:[edi], al
push str..Reporting.HTTP.CurlURL
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.00401e38
add esp, 0xc
mov byte [ebp - 4], 0x2e
push dword [ebp - 0x60]
push eax
lea eax, [ebp - 0xa4]
call fcn.00412fc4
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x7c]
mov byte [ebp - 4], 0x2f
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.00412fe7
mov ecx, dword [ebp - 0x54]
push 0xffffffffffffffff
add ecx, 0x148
push ecx
mov byte [ebp - 4], 0x30
call fcn.0040191e
xor edi, edi
push edi
push 1
lea esi, [ebp - 0x7c]
call fcn.004019bb
push edi
push 1
lea esi, [ebp - 0xa4]
call fcn.004019bb
push edi
push 1
lea esi, [ebp - 0xc0]
mov byte [ebp - 4], 4
call fcn.004019bb
xor eax, eax
lea edi, [ebp - 0x60]
stosb byte es:[edi], al
push str..Reporting.HTTP.CurlOptions
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.00401e38
add esp, 0xc
mov byte [ebp - 4], 0x31
push dword [ebp - 0x60]
push eax
lea eax, [ebp - 0xa4]
call fcn.00412fc4
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x50]
push eax
mov byte [ebp - 4], 0x32
call fcn.00412fe7
mov ecx, dword [ebp - 0x54]
push 0xffffffffffffffff
add ecx, 0x164
push ecx
mov byte [ebp - 4], 0x33
call fcn.0040191e
xor edi, edi
push edi
inc ebx
push ebx
lea esi, [ebp - 0x7c]
call fcn.004019bb
push edi
push ebx
lea esi, [ebp - 0xa4]
call fcn.004019bb
push edi
push ebx
lea esi, [ebp - 0xc0]
mov byte [ebp - 4], 4
call fcn.004019bb
xor eax, eax
lea edi, [ebp - 0x60]
stosb byte es:[edi], al
push str..Plugins
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.00401e38
add esp, 0xc
mov byte [ebp - 4], 0x34
push dword [ebp - 0x60]
push eax
lea eax, [ebp - 0xa4]
call fcn.00412fc4
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x35
call fcn.00412e9c
push dword [ebp - 0x54]
mov ecx, eax
call fcn.0040ff56
xor edi, edi
push edi
push ebx
lea esi, [ebp - 0xa4]
call fcn.004019bb
push edi
push ebx
lea esi, [ebp - 0x7c]
call fcn.004019bb
push edi
push ebx
lea esi, [ebp - 0x30]
call fcn.004019bb
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x50]
push eax
call fcn.00412e64
mov eax, ebx
jmp 0x40fd75
call fcn.00458eef
ret 4