Function at 0x4af430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54c1b4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x13a8
call fcn.004faf00
mov eax, dword [0x5ab980]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp + 8]
push eax
mov byte [ebp - 4], 4
call fcn.00512659
lea ecx, [ebp + 8]
mov byte [ebp - 4], 5
push ecx
call fcn.0041f9c0
add esp, 4
lea edx, [ebp + 8]
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 6
push str.Drives_machine.txt
push edx
push eax
call fcn.00512b79
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 7
call fcn.00512a1d
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 6
call fcn.005128e4
mov ecx, dword [ebp - 0x40]
push 0x1001
push ecx
lea ecx, [ebp - 0x30]
call fcn.00517044
mov edx, dword [0x5b8cb0]
mov byte [ebp - 4], 8
mov bl, 9
mov edi, dword [edx + 0x948]
test edi, edi
je 0x4af552
mov eax, edi
mov edi, dword [edi]
mov esi, dword [eax + 8]
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.00441e60
mov ecx, dword [esi + 0x64]
mov edx, dword [esi + 0x60]
mov eax, dword [eax]
push ecx
mov ecx, dword [esi + 0x5c]
push edx
mov edx, dword [esi + 0x58]
push ecx
push edx
push eax
lea ecx, [ebp - 0x14]
push str._s_t_I64u_t_I64u_r_n
push ecx
mov byte [ebp - 4], bl
call fcn.0050e6c7
add esp, 0x1c
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 8
call fcn.005128e4
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4af540
mov eax, dword [esi + 0xbc]
test eax, eax
jne 0x4af4e6
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax - 8]
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.005172f8
jmp 0x4af4e6
lea ecx, [ebp - 0x30]
call fcn.005173bc
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 6
call fcn.005170e4
lea edx, [ebp + 8]
push str.Apps_machine.txt
lea eax, [ebp - 0x18]
push edx
mov dword [ebp - 4], 5
push eax
mov byte [ebp - 4], 0xb
call fcn.00512b79
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xc
call fcn.00512a1d
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xb
call fcn.005128e4
mov ecx, dword [ebp - 0x34]
push 0x1001
push ecx
lea ecx, [ebp - 0x30]
call fcn.00517044
mov edx, dword [0x5b8cb0]
mov byte [ebp - 4], 0xd
mov ebx, dword [edx + 0x854]
test ebx, ebx
je 0x4af66f
mov eax, ebx
mov ebx, dword [ebx]
mov esi, dword [eax + 8]
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
call fcn.00419510
mov edi, eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xe
push ecx
mov ecx, esi
call fcn.00419510
mov ecx, dword [esi + 0xc0]
xor edx, edx
test ecx, ecx
mov ecx, dword [esi + 0xb4]
mov byte [ebp - 4], 0xf
sete dl
push edx
mov edx, dword [esi + 0x100]
push ecx
mov ecx, dword [edi]
push edx
mov edx, dword [eax]
push ecx
push edx
lea eax, [ebp - 0x14]
push str._s_t_s_t_s_t_i_t_i_r_n
push eax
call fcn.0050e6c7
add esp, 0x1c
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xe
call fcn.005128e4
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xd
call fcn.005128e4
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4af64c
mov eax, dword [esi + 0xb8]
test eax, eax
je 0x4af5bd
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax - 8]
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.005172f8
jmp 0x4af5bd
lea ecx, [ebp - 0x30]
call fcn.005173bc
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xb
call fcn.005170e4
lea ecx, [ebp + 8]
push str.Files_Dirs_machine.txt
lea edx, [ebp - 0x1c]
push ecx
mov dword [ebp - 4], 5
push edx
mov byte [ebp - 4], 0x11
call fcn.00512b79
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x12
call fcn.00512a1d
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x11
call fcn.005128e4
mov eax, dword [ebp - 0x3c]
push 0x1001
push eax
lea ecx, [ebp - 0x30]
call fcn.00517044
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 0x13
call fcn.0044b480
mov ecx, dword [0x5b8cb0]
push 1
add ecx, 0x930
push ecx
lea ecx, [ebp - 0x90]
call fcn.0044b500
mov esi, eax
test esi, esi
je 0x4af834
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4af737
mov edx, dword [esi + 8]
and edx, 0xf
cmp dl, 2
jne 0x4af816
mov eax, dword [esi + 0xbc]
test eax, eax
jne 0x4af816
mov eax, dword [esi + 0xb8]
test al, 0xc0
je 0x4af816
test al, 0x30
jbe 0x4af816
lea eax, [esi + 0x40]
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x1c]
call fcn.0050ee55
mov ecx, dword [ebp - 0x1c]
lea edx, [esi + 0x48]
mov dword [ebp - 0x54], ecx
push 0xffffffffffffffff
push edx
lea ecx, [ebp - 0x18]
call fcn.0050ee55
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x20]
push str._Y__m__d
push ecx
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x5c], eax
call fcn.0050ef3a
mov dword [ebp - 0x48], eax
lea edx, [ebp - 0x44]
push str._Y__m__d
push edx
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0x14
call fcn.0050ef3a
mov ebx, eax
lea eax, [ebp - 0x58]
mov ecx, esi
push eax
mov byte [ebp - 4], 0x15
call fcn.00441ca0
mov edi, eax
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x16
push ecx
mov ecx, esi
call fcn.00441d60
mov edx, dword [ebp - 0x48]
mov byte [ebp - 4], 0x17
mov ecx, dword [edx]
mov edx, dword [ebx]
push ecx
mov ecx, dword [esi + 0x5c]
push edx
mov edx, dword [esi + 0x58]
push ecx
mov ecx, dword [edi]
push edx
mov edx, dword [eax]
push ecx
push edx
lea eax, [ebp - 0x14]
push str._s_t_s_t_I64u_t_s_t_s
push eax
call fcn.0050e6c7
add esp, 0x20
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x16
call fcn.005128e4
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x15
call fcn.005128e4
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x14
call fcn.005128e4
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x13
call fcn.005128e4
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax - 8]
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.005172f8
lea ecx, [ebp - 0x90]
call fcn.0044b560
jmp 0x4af6f3
lea ecx, [ebp - 0x30]
call fcn.005173bc
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x11
call fcn.005170e4
mov edi, dword [ebp + 0xc]
lea ecx, [ebp + 8]
push str.Users_machine.txt
lea edx, [ebp + 0xc]
push ecx
mov dword [ebp - 4], 5
push edx
mov byte [ebp - 4], 0x19
call fcn.00512b79
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x1a
call fcn.00512a1d
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0x19
call fcn.005128e4
mov eax, dword [ebp - 0x38]
push 0x1001
push eax
lea ecx, [ebp - 0x30]
call fcn.00517044
mov eax, dword [0x5b8cb0]
mov byte [ebp - 4], 0x1b
mov ecx, dword [eax + 0x770]
test ecx, ecx
je 0x4afbb5
test edi, edi
je 0x4afa0c
lea ecx, [ebp - 0x13b8]
call fcn.004b6e20
mov eax, dword [0x5ab980]
mov dword [ebp - 0x20], eax
mov dword [ebp + 0xc], eax
mov esi, dword [0x5bc59c]
mov byte [ebp - 4], 0x1e
test esi, esi
je 0x4af941
mov eax, esi
mov esi, dword [esi]
add eax, 8
lea ecx, [ebp - 0x13b8]
push eax
call fcn.004b70f0
test edi, edi
je 0x4af8f6
cmp word [ebp - 0x6f4], 1
jne 0x4af8d1
mov ecx, dword [ebp - 0x13ac]
mov eax, dword [0x5b8cb0]
mov edx, dword [ebp - 0x13b0]
push ecx
mov ecx, dword [eax + 0xdc]
push edx
push ecx
lea edx, [ebp - 0x14]
push str._s_t_s_t_s_r_n
push edx
call fcn.0050e6c7
mov eax, dword [ebp - 0x14]
add esp, 0x14
mov ecx, dword [eax - 8]
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.005172f8
jmp 0x4af8d1
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0x1d
call fcn.005128e4
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x1c
call fcn.005128e4
lea eax, [ebp - 0xd58]
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x738]
mov byte [ebp - 4], 0x2a
call fcn.00467880
lea ecx, [ebp - 0xcec]
mov byte [ebp - 4], 0x29
call fcn.00510e5f
lea ecx, [ebp - 0xd08]
mov byte [ebp - 4], 0x28
call fcn.0048ba80
lea ecx, [ebp - 0xd24]
mov byte [ebp - 4], 0x27
call fcn.00511c40
lea ecx, [ebp - 0xd28]
mov byte [ebp - 4], 0x26
call fcn.005128e4
lea ecx, [ebp - 0xd2c]
mov byte [ebp - 4], 0x25
call fcn.005128e4
lea ecx, [ebp - 0xd48]
mov byte [ebp - 4], 0x24
call fcn.005128e4
lea ecx, [ebp - 0xd4c]
mov byte [ebp - 4], 0x23
call fcn.005128e4
lea ecx, [ebp - 0xd50]
mov byte [ebp - 4], 0x22
call fcn.005128e4
lea ecx, [ebp - 0xd54]
mov byte [ebp - 4], 0x21
call fcn.005128e4
lea ecx, [ebp - 0x13b4]
mov byte [ebp - 4], 0x1f
call fcn.00446520
jmp 0x4afc9c
mov esi, eax
mov bl, 0x2b
mov edi, dword [esi + 0x758]
test edi, edi
je 0x4afca0
mov eax, edi
mov edi, dword [edi]
add eax, 8
lea ecx, [ebp - 0x6ec]
push eax
call fcn.004c3ba0
mov eax, dword [ebp - 0x6cc]
mov byte [ebp - 4], bl
test eax, eax
jne 0x4afb25
mov eax, dword [ebp - 0x6c4]
test eax, eax
je 0x4afb25
mov ecx, dword [ebp - 0x6e4]
mov edx, dword [ebp - 0x6e8]
mov eax, dword [esi + 0xdc]
push ecx
push edx
push eax
lea ecx, [ebp - 0x14]
push str._s_t_s_t_s_r_n
push ecx
call fcn.0050e6c7
mov eax, dword [ebp - 0x14]
add esp, 0x14
mov ecx, dword [eax - 8]
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.005172f8
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 0x3f
call fcn.00467880
lea ecx, [ebp - 0x680]
mov byte [ebp - 4], 0x3e
call fcn.00510e5f
lea ecx, [ebp - 0x69c]
mov byte [ebp - 4], 0x3d
call fcn.0048ba80
lea ecx, [ebp - 0x6b8]
mov byte [ebp - 4], 0x3c
call fcn.00511c40
lea ecx, [ebp - 0x6bc]
mov byte [ebp - 4], 0x3b
call fcn.005128e4
lea ecx, [ebp - 0x6c0]
mov byte [ebp - 4], 0x3a
call fcn.005128e4
lea ecx, [ebp - 0x6dc]
mov byte [ebp - 4], 0x39
call fcn.005128e4
lea ecx, [ebp - 0x6e0]
mov byte [ebp - 4], 0x38
call fcn.005128e4
lea ecx, [ebp - 0x6e4]
mov byte [ebp - 4], 0x37
call fcn.005128e4
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x6e8]
call fcn.005128e4
mov byte [ebp - 4], 0x1b
jmp 0x4afa16
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 0x35
call fcn.00467880
lea ecx, [ebp - 0x680]
mov byte [ebp - 4], 0x34
call fcn.00510e5f
lea ecx, [ebp - 0x69c]
mov byte [ebp - 4], 0x33
call fcn.0048ba80
lea ecx, [ebp - 0x6b8]
mov byte [ebp - 4], 0x32
call fcn.00511c40
lea ecx, [ebp - 0x6bc]
mov byte [ebp - 4], 0x31
call fcn.005128e4
lea ecx, [ebp - 0x6c0]
mov byte [ebp - 4], 0x30
call fcn.005128e4
lea ecx, [ebp - 0x6dc]
mov byte [ebp - 4], 0x2f
call fcn.005128e4
lea ecx, [ebp - 0x6e0]
mov byte [ebp - 4], 0x2e
call fcn.005128e4
lea ecx, [ebp - 0x6e4]
mov byte [ebp - 4], 0x2d
call fcn.005128e4
mov byte [ebp - 4], 0x2c
jmp 0x4afb11
add eax, 0xf8
lea ecx, [ebp - 0x6ec]
push eax
call fcn.004c3ba0
mov edx, dword [ebp - 0x6e4]
mov ecx, dword [0x5b8cb0]
mov eax, dword [ebp - 0x6e8]
push edx
mov edx, dword [ecx + 0xdc]
push eax
push edx
lea eax, [ebp - 0x14]
push str._s_t_s_t_s_r_n
push eax
mov byte [ebp - 4], 0x40
call fcn.0050e6c7
mov eax, dword [ebp - 0x14]
add esp, 0x14
mov ecx, dword [eax - 8]
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.005172f8
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 0x4a
call fcn.00467880
lea ecx, [ebp - 0x680]
mov byte [ebp - 4], 0x49
call fcn.00510e5f
lea ecx, [ebp - 0x69c]
mov byte [ebp - 4], 0x48
call fcn.0048ba80
lea ecx, [ebp - 0x6b8]
mov byte [ebp - 4], 0x47
call fcn.00511c40
lea ecx, [ebp - 0x6bc]
mov byte [ebp - 4], 0x46
call fcn.005128e4
lea ecx, [ebp - 0x6c0]
mov byte [ebp - 4], 0x45
call fcn.005128e4
lea ecx, [ebp - 0x6dc]
mov byte [ebp - 4], 0x44
call fcn.005128e4
lea ecx, [ebp - 0x6e0]
mov byte [ebp - 4], 0x43
call fcn.005128e4
lea ecx, [ebp - 0x6e4]
mov byte [ebp - 4], 0x42
call fcn.005128e4
lea ecx, [ebp - 0x6e8]
mov byte [ebp - 4], 0x41
call fcn.005128e4
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x30]
call fcn.005173bc
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x19
call fcn.005170e4
lea ecx, [ebp + 8]
mov dword [ebp - 4], 4
call fcn.005128e4
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 3
call fcn.005128e4
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 2
call fcn.005128e4
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.005128e4
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0
call fcn.005128e4
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.005128e4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8