Function at 0x4130d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51d4ba
mov eax, dword fs:[0]
push eax
sub esp, 0x96c
mov eax, dword [0x569564]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x964], ebx
mov dword [ebp - 0x970], ebx
mov dword [ebp - 0x96c], 0
push 0x54c968
lea ecx, [ebp - 0x900]
mov dword [ebp - 4], 1
call fcn.004075b0
mov dword [ebp - 0x8e8], 0
push str._INTERNET_
lea ecx, [ebp - 0x8e4]
mov byte [ebp - 4], 2
call fcn.004075b0
mov dword [ebp - 0x8cc], 1
push str._PROGRAMS_
lea ecx, [ebp - 0x8c8]
mov byte [ebp - 4], 3
call fcn.004075b0
mov dword [ebp - 0x8b0], 2
push str._CONTROLS_
lea ecx, [ebp - 0x8ac]
mov byte [ebp - 4], 4
call fcn.004075b0
mov dword [ebp - 0x894], 3
push str._PRINTERS_
lea ecx, [ebp - 0x890]
mov byte [ebp - 4], 5
call fcn.004075b0
mov dword [ebp - 0x878], 4
push str._PERSONAL_
lea ecx, [ebp - 0x874]
mov byte [ebp - 4], 6
call fcn.004075b0
mov dword [ebp - 0x85c], 5
push str._FAVORITES_
lea ecx, [ebp - 0x858]
mov byte [ebp - 4], 7
call fcn.004075b0
mov dword [ebp - 0x840], 6
push str._STARTUP_
lea ecx, [ebp - 0x83c]
mov byte [ebp - 4], 8
call fcn.004075b0
mov dword [ebp - 0x824], 7
push str._RECENT_
lea ecx, [ebp - 0x820]
mov byte [ebp - 4], 9
call fcn.004075b0
mov dword [ebp - 0x808], 8
push str._SENDTO_
lea ecx, [ebp - 0x804]
mov byte [ebp - 4], 0xa
call fcn.004075b0
mov dword [ebp - 0x7ec], 9
push str._BITBUCKET_
lea ecx, [ebp - 0x7e8]
mov byte [ebp - 4], 0xb
call fcn.004075b0
mov dword [ebp - 0x7d0], 0xa
push str._STARTMENU_
lea ecx, [ebp - 0x7cc]
mov byte [ebp - 4], 0xc
call fcn.004075b0
mov dword [ebp - 0x7b4], 0xb
push str._MYDOCUMENTS_
lea ecx, [ebp - 0x7b0]
mov byte [ebp - 4], 0xd
call fcn.004075b0
mov dword [ebp - 0x798], 5
push str._MYMUSIC_
lea ecx, [ebp - 0x794]
mov byte [ebp - 4], 0xe
call fcn.004075b0
mov dword [ebp - 0x77c], 0xd
push str._MYVIDEO_
lea ecx, [ebp - 0x778]
mov byte [ebp - 4], 0xf
call fcn.004075b0
mov dword [ebp - 0x760], 0xe
push str._DESKTOPDIRECTORY_
lea ecx, [ebp - 0x75c]
mov byte [ebp - 4], 0x10
call fcn.004075b0
mov dword [ebp - 0x744], 0x10
push str._DRIVES_
lea ecx, [ebp - 0x740]
mov byte [ebp - 4], 0x11
call fcn.004075b0
mov dword [ebp - 0x728], 0x11
push str._NETWORK_
lea ecx, [ebp - 0x724]
mov byte [ebp - 4], 0x12
call fcn.004075b0
mov dword [ebp - 0x70c], 0x12
push str._NETHOOD_
lea ecx, [ebp - 0x708]
mov byte [ebp - 4], 0x13
call fcn.004075b0
mov dword [ebp - 0x6f0], 0x13
push str._FONTS_
lea ecx, [ebp - 0x6ec]
mov byte [ebp - 4], 0x14
call fcn.004075b0
mov dword [ebp - 0x6d4], 0x14
push str._TEMPLATES_
lea ecx, [ebp - 0x6d0]
mov byte [ebp - 4], 0x15
call fcn.004075b0
mov dword [ebp - 0x6b8], 0x15
push str._COMMON_STARTMENU_
lea ecx, [ebp - 0x6b4]
mov byte [ebp - 4], 0x16
call fcn.004075b0
mov dword [ebp - 0x69c], 0x16
push str._COMMON_PROGRAMS_
lea ecx, [ebp - 0x698]
mov byte [ebp - 4], 0x17
call fcn.004075b0
mov dword [ebp - 0x680], 0x17
push str._COMMON_STARTUP_
lea ecx, [ebp - 0x67c]
mov byte [ebp - 4], 0x18
call fcn.004075b0
mov dword [ebp - 0x664], 0x18
push str._COMMON_DESKTOPDIRECTORY_
lea ecx, [ebp - 0x660]
mov byte [ebp - 4], 0x19
call fcn.004075b0
mov dword [ebp - 0x648], 0x19
push str._APPDATA_
lea ecx, [ebp - 0x644]
mov byte [ebp - 4], 0x1a
call fcn.004075b0
mov dword [ebp - 0x62c], 0x1a
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x628]
push str._PRINTHOOD_
call fcn.004075b0
mov dword [ebp - 0x610], 0x1b
push str._LOCAL_APPDATA_
lea ecx, [ebp - 0x60c]
mov byte [ebp - 4], 0x1c
call fcn.004075b0
mov dword [ebp - 0x5f4], 0x1c
push str._ALTSTARTUP_
lea ecx, [ebp - 0x5f0]
mov byte [ebp - 4], 0x1d
call fcn.004075b0
mov dword [ebp - 0x5d8], 0x1d
push str._COMMON_ALTSTARTUP_
lea ecx, [ebp - 0x5d4]
mov byte [ebp - 4], 0x1e
call fcn.004075b0
mov dword [ebp - 0x5bc], 0x1e
push str._COMMON_FAVORITES_
lea ecx, [ebp - 0x5b8]
mov byte [ebp - 4], 0x1f
call fcn.004075b0
mov dword [ebp - 0x5a0], 0x1f
push str._INTERNET_CACHE_
lea ecx, [ebp - 0x59c]
mov byte [ebp - 4], 0x20
call fcn.004075b0
mov dword [ebp - 0x584], 0x20
push str._COOKIES_
lea ecx, [ebp - 0x580]
mov byte [ebp - 4], 0x21
call fcn.004075b0
mov dword [ebp - 0x568], 0x21
push str._HISTORY_
lea ecx, [ebp - 0x564]
mov byte [ebp - 4], 0x22
call fcn.004075b0
mov dword [ebp - 0x54c], 0x22
push str._COMMON_APPDATA_
lea ecx, [ebp - 0x548]
mov byte [ebp - 4], 0x23
call fcn.004075b0
mov dword [ebp - 0x530], 0x23
push str._WINDOWS_
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 0x24
call fcn.004075b0
mov dword [ebp - 0x514], 0x24
push str._SYSTEM_
lea ecx, [ebp - 0x510]
mov byte [ebp - 4], 0x25
call fcn.004075b0
mov dword [ebp - 0x4f8], 0x25
push str._PROGRAM_FILES_
lea ecx, [ebp - 0x4f4]
mov byte [ebp - 4], 0x26
call fcn.004075b0
mov dword [ebp - 0x4dc], 0x26
push str._MYPICTURES_
lea ecx, [ebp - 0x4d8]
mov byte [ebp - 4], 0x27
call fcn.004075b0
mov dword [ebp - 0x4c0], 0x27
push str._PROFILE_
lea ecx, [ebp - 0x4bc]
mov byte [ebp - 4], 0x28
call fcn.004075b0
mov dword [ebp - 0x4a4], 0x28
push str._SYSTEMX86_
lea ecx, [ebp - 0x4a0]
mov byte [ebp - 4], 0x29
call fcn.004075b0
mov dword [ebp - 0x488], 0x29
push str._PROGRAM_FILESX86_
lea ecx, [ebp - 0x484]
mov byte [ebp - 4], 0x2a
call fcn.004075b0
mov dword [ebp - 0x46c], 0x2a
push str._PROGRAM_FILES_COMMON_
lea ecx, [ebp - 0x468]
mov byte [ebp - 4], 0x2b
call fcn.004075b0
mov dword [ebp - 0x450], 0x2b
push str._PROGRAM_FILES_COMMONX86_
lea ecx, [ebp - 0x44c]
mov byte [ebp - 4], 0x2c
call fcn.004075b0
mov dword [ebp - 0x434], 0x2c
push str._COMMON_TEMPLATES_
lea ecx, [ebp - 0x430]
mov byte [ebp - 4], 0x2d
call fcn.004075b0
mov dword [ebp - 0x418], 0x2d
push str._COMMON_DOCUMENTS_
lea ecx, [ebp - 0x414]
mov byte [ebp - 4], 0x2e
call fcn.004075b0
mov dword [ebp - 0x3fc], 0x2e
push str._COMMON_ADMINTOOLS_
lea ecx, [ebp - 0x3f8]
mov byte [ebp - 4], 0x2f
call fcn.004075b0
mov dword [ebp - 0x3e0], 0x2f
push str._ADMINTOOLS_
lea ecx, [ebp - 0x3dc]
mov byte [ebp - 4], 0x30
call fcn.004075b0
mov dword [ebp - 0x3c4], 0x30
push str._CONNECTIONS_
lea ecx, [ebp - 0x3c0]
mov byte [ebp - 4], 0x31
call fcn.004075b0
mov dword [ebp - 0x3a8], 0x31
push str._COMMON_MUSIC_
lea ecx, [ebp - 0x3a4]
mov byte [ebp - 4], 0x32
call fcn.004075b0
mov dword [ebp - 0x38c], 0x35
push str._COMMON_PICTURES_
lea ecx, [ebp - 0x388]
mov byte [ebp - 4], 0x33
call fcn.004075b0
mov dword [ebp - 0x370], 0x36
push str._COMMON_VIDEO_
lea ecx, [ebp - 0x36c]
mov byte [ebp - 4], 0x34
call fcn.004075b0
mov dword [ebp - 0x354], 0x37
push str._RESOURCES_
lea ecx, [ebp - 0x350]
mov byte [ebp - 4], 0x35
call fcn.004075b0
mov dword [ebp - 0x338], 0x38
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x334]
push str._RESOURCES_LOCALIZED_
call fcn.004075b0
mov dword [ebp - 0x31c], 0x39
push str._COMMON_OEM_LINKS_
lea ecx, [ebp - 0x318]
mov byte [ebp - 4], 0x37
call fcn.004075b0
mov dword [ebp - 0x300], 0x3a
push str._CDBURN_AREA_
lea ecx, [ebp - 0x2fc]
mov byte [ebp - 4], 0x38
call fcn.004075b0
mov dword [ebp - 0x2e4], 0x3b
push str._COMPUTERSNEARME_
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 0x39
call fcn.004075b0
mov dword [ebp - 0x2c8], 0x3d
push str._FLAG_CREATE_
lea ecx, [ebp - 0x2c4]
mov byte [ebp - 4], 0x3a
call fcn.004075b0
mov dword [ebp - 0x2ac], 0x8000
push str._FLAG_DONT_VERIFY_
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 0x3b
call fcn.004075b0
mov dword [ebp - 0x290], 0x4000
push str._FLAG_DONT_UNEXPAND_
lea ecx, [ebp - 0x28c]
mov byte [ebp - 4], 0x3c
call fcn.004075b0
mov dword [ebp - 0x274], 0x2000
push str._FLAG_NO_ALIAS_
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 0x3d
call fcn.004075b0
mov dword [ebp - 0x258], 0x1000
push str._FLAG_PER_USER_INIT_
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 0x3e
call fcn.004075b0
mov dword [ebp - 0x23c], 0x800
push str._FLAG_MASK_
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0x3f
call fcn.004075b0
mov dword [ebp - 0x220], 0xff00
push 0x54d0c4
lea ecx, [ebp - 0x930]
mov byte [ebp - 4], 0x40
call fcn.004075b0
push 0x54d0cc
lea ecx, [ebp - 0x918]
mov byte [ebp - 4], 0x41
call fcn.004075b0
push 0x54d0d0
push str.shell32.dll
mov byte [ebp - 4], 0x42
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x208
mov dword [ebp - 0x964], eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004e9750
add esp, 0xc
xor edi, edi
lea esi, [ebp - 0x900]
mov ecx, esi
mov byte [ebp - 4], 0x43
call fcn.00408f20
mov ecx, esi
push dword [eax]
push 0
call fcn.00409360
push eax
lea ecx, [ebp + 8]
call fcn.004127c0
mov byte [ebp - 4], 0x42
cmp eax, 0xffffffff
jne 0x413bb0
inc edi
add esi, 0x1c
cmp edi, 0x3f
jb 0x4138e2
lea ecx, [ebp - 0x930]
call fcn.00408f20
lea ecx, [ebp + 8]
push dword [eax]
lea eax, [ebp - 0x948]
push 0
push eax
call fcn.00412dd0
mov esi, eax
lea ecx, [ebp - 0x930]
mov byte [ebp - 4], 0x46
call fcn.00408f20
lea ecx, [ebp - 0x930]
mov eax, dword [eax]
mov dword [ebp - 0x968], eax
call fcn.00409360
mov ecx, esi
mov edi, eax
call fcn.00408f20
mov ecx, esi
mov eax, dword [eax]
mov dword [ebp - 0x964], eax
call fcn.00409360
mov ecx, eax
mov eax, dword [ebp - 0x968]
cmp dword [ebp - 0x964], eax
mov edx, eax
cmovb edx, dword [ebp - 0x964]
test edx, edx
jne 0x4139a7
xor esi, esi
test esi, esi
jne 0x4139c6
mov eax, dword [ebp - 0x968]
mov ecx, dword [ebp - 0x964]
cmp eax, ecx
jbe 0x4139c2
or esi, 0xffffffff
jmp 0x4139c6
mov ax, word [ecx]
cmp ax, word [edi]
jne 0x4139ba
add ecx, 2
add edi, 2
sub edx, 1
jmp 0x41398a
sbb esi, esi
and esi, 0xfffffffe
inc esi
jmp 0x41398e
sbb esi, esi
neg esi
lea ecx, [ebp - 0x948]
mov byte [ebp - 4], 0x42
call fcn.00409ad0
test esi, esi
jne 0x413a4b
lea ecx, [ebp - 0x930]
call fcn.00408f20
push 0xffffffffffffffff
lea ecx, [ebp + 8]
push dword [eax]
lea eax, [ebp - 0x960]
push eax
call fcn.00412dd0
push eax
sub esp, 0x18
mov byte [ebp - 4], 0x47
push esp
call fcn.00412fa0
add esp, 4
lea ecx, [ebp - 0x948]
call fcn.00412f20
add esp, 0x18
mov edx, eax
mov byte [ebp - 4], 0x48
mov ecx, ebx
call fcn.00412cd0
add esp, 4
mov dword [ebp - 0x96c], 1
lea ecx, [ebp - 0x948]
call fcn.00409ad0
lea ecx, [ebp - 0x960]
call fcn.00409ad0
jmp 0x413c27
lea ecx, [ebp - 0x918]
call fcn.00408f20
lea ecx, [ebp + 8]
push dword [eax]
lea eax, [ebp - 0x960]
push 0
push eax
call fcn.00412dd0
mov esi, eax
lea ecx, [ebp - 0x918]
mov byte [ebp - 4], 0x49
call fcn.00408f20
lea ecx, [ebp - 0x918]
mov eax, dword [eax]
mov dword [ebp - 0x964], eax
call fcn.00409360
mov ecx, esi
mov edi, eax
call fcn.00408f20
mov ecx, esi
mov eax, dword [eax]
mov dword [ebp - 0x968], eax
call fcn.00409360
mov ecx, eax
mov eax, dword [ebp - 0x964]
cmp dword [ebp - 0x968], eax
mov edx, eax
cmovb edx, dword [ebp - 0x968]
test edx, edx
jne 0x413ae0
xor esi, esi
test esi, esi
jne 0x413aff
mov eax, dword [ebp - 0x964]
mov ecx, dword [ebp - 0x968]
cmp eax, ecx
jbe 0x413afb
or esi, 0xffffffff
jmp 0x413aff
mov ax, word [ecx]
cmp ax, word [edi]
jne 0x413af3
add ecx, 2
add edi, 2
sub edx, 1
jmp 0x413abe
sbb esi, esi
and esi, 0xfffffffe
inc esi
jmp 0x413ac2
sbb esi, esi
neg esi
lea ecx, [ebp - 0x960]
mov byte [ebp - 4], 0x42
call fcn.00409ad0
test esi, esi
jne 0x413b7b
lea ecx, [ebp - 0x918]
call fcn.00408f20
push 0xffffffffffffffff
lea ecx, [ebp + 8]
push dword [eax]
lea eax, [ebp - 0x948]
push eax
call fcn.00412dd0
mov esi, eax
lea eax, [ebp - 0x960]
mov byte [ebp - 4], 0x4a
push eax
call fcn.00412fa0
add esp, 4
push esi
mov edx, eax
mov byte [ebp - 4], 0x4b
mov ecx, ebx
call fcn.00412cd0
add esp, 4
mov dword [ebp - 0x96c], 1
lea ecx, [ebp - 0x960]
call fcn.00409ad0
lea ecx, [ebp - 0x948]
call fcn.00409ad0
jmp 0x413c27
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x4c
call fcn.00407ad0
push eax
call fcn.00405fc0
add esp, 4
mov ecx, ebx
push eax
call fcn.00409150
push 0
push 0
mov ecx, ebx
call fcn.00409a10
lea eax, [ebp + 8]
mov ecx, ebx
push eax
call fcn.004140f0
jmp 0x413c1d
lea eax, [edi*8]
sub eax, edi
push 0
push dword [ebp + eax*4 - 0x8e8]
lea eax, [ebp - 0x218]
push eax
push 0
call dword [ebp - 0x964]
sub esp, 0x18
lea eax, [ebp - 0x218]
mov ecx, esp
mov dword [ebp - 0x964], esp
push eax
call fcn.004075b0
sub esp, 0x18
mov byte [ebp - 4], 0x44
mov ecx, esp
mov dword [ebp - 0x968], esp
push esi
call fcn.00407610
sub esp, 0x18
mov byte [ebp - 4], 0x45
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.00407610
mov ecx, ebx
mov byte [ebp - 4], 0x42
call fcn.004128b0
add esp, 0x48
mov dword [ebp - 0x96c], 1
lea ecx, [ebp - 0x918]
call fcn.00409ad0
lea ecx, [ebp - 0x930]
call fcn.00409ad0
push fcn.00412780
push 0x3f
push 0x1c
lea eax, [ebp - 0x900]
mov byte [ebp - 4], 1
push eax
call fcn.004acf94
lea ecx, [ebp + 8]
call fcn.00409ad0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ac267
mov esp, ebp
pop ebp
ret