Function at 0x4a31e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50d274
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x61ad68]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov ecx, edi
call dword [0x518b40]
cmp eax, 8
jne 0x4a3902
push 1
mov ecx, edi
call dword [0x518b3c]
push 0
lea ecx, [ebp - 0x3a]
push ecx
mov ecx, eax
call dword [0x5188b8]
mov ecx, eax
call dword [0x518340]
mov ebx, dword [ebp + 0x10]
cmp al, 0x64
jne 0x4a3259
mov eax, dword [ebx]
mov ecx, ebx
push 1
call dword [eax + 8]
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax + 0xc]
push 0
jmp 0x4a328b
cmp al, 0x2d
jne 0x4a3273
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax + 8]
mov eax, dword [ebx]
mov ecx, ebx
push 1
call dword [eax + 0xc]
push 0
jmp 0x4a328b
cmp al, 0x6c
jne 0x4a3292
mov eax, dword [ebx]
mov ecx, ebx
push 1
call dword [eax + 8]
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax + 0xc]
push 1
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x10]
push 7
mov ecx, edi
call dword [0x518b3c]
push eax
lea ecx, [ebp - 0x5c]
call dword [0x518b68]
mov ecx, ebx
mov dword [ebp - 4], 0
call fcn.004a8840
test al, al
je 0x4a32db
push 1
push 0
push 0x5286dc
push 3
lea ecx, [ebp - 0x5c]
call dword [0x518324]
cmp eax, 0xffffffff
je 0x4a32db
push eax
lea ecx, [ebp - 0x5c]
call dword [0x518334]
mov eax, dword [ebx]
lea ecx, [ebp - 0x5c]
push ecx
mov ecx, ebx
call dword [eax + 4]
push 3
mov ecx, edi
call dword [0x518b3c]
mov edx, dword [ebx]
mov ecx, ebx
push eax
call dword [edx + 0x14]
push 4
mov ecx, edi
call dword [0x518b3c]
mov edx, dword [ebx]
mov ecx, ebx
push eax
call dword [edx + 0x18]
push 5
mov ecx, edi
call dword [0x518b3c]
mov esi, dword [ebx]
mov ecx, eax
push 0xa
push 0
call dword [0x518304]
push edx
push eax
mov ecx, ebx
call dword [esi + 0x1c]
mov eax, dword [0x518ab8]
mov dword [ebp - 0x54], eax
push str.MMM_dd_yyyy
push 0xb
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call dword [0x518584]
push str.MMM__d_yyyy
push 0xb
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call dword [0x518584]
push str.MMM__d_hh:mm
push 0xc
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call dword [0x518584]
push str.MMM__d__yyyy
push 0xc
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 4
call dword [0x518584]
push str.MMM_dd_hh:mm
push 0xc
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 5
call dword [0x518584]
push str.MMM_dd__yyyy
push 0xc
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 6
call dword [0x518584]
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x54]
call fcn.00405d30
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x54]
call fcn.00405d30
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x54]
call fcn.00405d30
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x54]
call fcn.00405d30
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x54]
call fcn.00405d30
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x54]
call fcn.00405d30
lea ecx, [ebp - 0x44]
call dword [0x518b64]
lea ecx, [ebp - 0x3c]
call dword [0x518b64]
lea ecx, [ebp - 0x34]
call dword [0x518b64]
lea ecx, [ebp - 0x2c]
call dword [0x518b64]
lea ecx, [ebp - 0x28]
call dword [0x518b64]
lea ecx, [ebp - 0x24]
call dword [0x518b64]
push 6
mov ecx, edi
call dword [0x518b3c]
push eax
lea ecx, [ebp - 0x58]
call dword [0x518b68]
lea eax, [ebp - 0x3a]
mov byte [ebp - 4], 8
push eax
push 0
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x58]
call dword [0x51832c]
mov ecx, eax
call dword [0x5182ec]
lea ecx, [ebp - 0x58]
movzx eax, word [eax]
push eax
push 0
lea eax, [ebp - 0x38]
push eax
call dword [0x51832c]
mov ecx, eax
call dword [0x5182f8]
lea ecx, [ebp - 0x4c]
call dword [0x518510]
mov byte [ebp - 4], 9
xor edi, edi
nop dword [eax + eax]
push edi
lea ecx, [ebp - 0x54]
call dword [0x518b3c]
push 0
push 1
lea ecx, [ebp - 0x44]
mov esi, eax
call dword [0x5182a4]
push esi
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x44]
call dword [0x51829c]
push eax
lea ecx, [ebp - 0x4c]
call dword [0x51850c]
mov esi, dword [0x518850]
lea ecx, [ebp - 0x3c]
inc edi
call esi
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 9
call dword [0x5182a0]
lea ecx, [ebp - 0x54]
call dword [0x518b40]
cmp edi, eax
jge 0x4a34fc
lea ecx, [ebp - 0x4c]
call dword [0x5182c0]
test al, al
je 0x4a3490
cmp edi, 2
je 0x4a350a
cmp edi, 4
jne 0x4a35dd
mov edi, dword [0x5182bc]
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x4c]
call edi
mov ecx, eax
call dword [0x518788]
push eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x4c]
call edi
mov ecx, eax
call dword [0x51878c]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [0x518784]
add esp, 4
mov ecx, eax
call dword [0x518790]
push eax
lea ecx, [ebp - 0x30]
call dword [0x5182c8]
push eax
lea ecx, [ebp - 0x4c]
call dword [0x5182b8]
lea eax, [ebp - 0x44]
push eax
call dword [0x5185e4]
add esp, 4
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0xb
call dword [0x5182b4]
cmp edx, 0xffffffff
jg 0x4a358c
jl 0x4a3586
cmp eax, 0xfffeae80
jae 0x4a358c
mov byte [ebp - 0xd], 1
jmp 0x4a3590
mov byte [ebp - 0xd], 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 9
call esi
cmp byte [ebp - 0xd], 0
je 0x4a35dd
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x4c]
call edi
lea ecx, [ebp - 0x48]
call dword [0x518788]
push eax
lea ecx, [ebp - 0x48]
call dword [0x51878c]
push eax
lea ecx, [ebp - 0x48]
call dword [0x518790]
dec eax
lea ecx, [ebp - 0x48]
push eax
call dword [0x5182c4]
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x4c]
call dword [0x5182b8]
lea ecx, [ebp - 0x4c]
call dword [0x5182c0]
test al, al
je 0x4a35f5
mov eax, dword [ebx]
lea ecx, [ebp - 0x4c]
push ecx
mov ecx, ebx
call dword [eax + 0x2c]
mov ecx, dword [ebp + 8]
push 2
call dword [0x518b3c]
push eax
lea ecx, [ebp - 0x50]
call dword [0x518b68]
mov byte [ebp + 8], 0x72
lea ecx, [ebp - 0x3a]
push dword [ebp + 8]
mov byte [ebp - 4], 0xc
call dword [0x518aa0]
lea eax, [ebp + 0xa]
push eax
push 0
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x50]
call dword [0x51832c]
mov ecx, eax
call dword [0x5182fc]
lea ecx, [ebp - 0x2a]
mov ax, word [eax]
mov byte [ebp + 8], 0x77
push dword [ebp + 8]
mov word [ebp - 0x32], ax
call dword [0x518aa0]
lea eax, [ebp + 0xa]
push eax
push 1
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x50]
call dword [0x51832c]
mov ecx, eax
call dword [0x5182fc]
lea ecx, [ebp - 0x22]
mov ax, word [eax]
mov byte [ebp + 8], 0x78
push dword [ebp + 8]
mov word [ebp - 0x26], ax
call dword [0x518aa0]
lea eax, [ebp + 0xa]
push eax
push 2
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x50]
call dword [0x51832c]
mov ecx, eax
call dword [0x5182fc]
lea ecx, [ebp - 0x1c]
mov ax, word [eax]
mov byte [ebp + 8], 0x72
push dword [ebp + 8]
mov word [ebp - 0x1e], ax
call dword [0x518aa0]
lea eax, [ebp + 0xa]
push eax
push 3
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x50]
call dword [0x51832c]
mov ecx, eax
call dword [0x5182fc]
lea ecx, [ebp - 0x18]
mov ax, word [eax]
mov byte [ebp + 8], 0x77
push dword [ebp + 8]
mov word [ebp - 0x1a], ax
call dword [0x518aa0]
lea eax, [ebp + 0xa]
push eax
push 4
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x50]
call dword [0x51832c]
mov ecx, eax
call dword [0x5182fc]
mov ax, word [eax]
lea ecx, [ebp - 0x14]
mov byte [ebp + 8], 0x78
push dword [ebp + 8]
mov word [ebp - 0x16], ax
call dword [0x518aa0]
lea eax, [ebp + 0xa]
push eax
push 5
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x50]
call dword [0x51832c]
mov ecx, eax
call dword [0x5182fc]
lea ecx, [ebp - 0x10]
mov ax, word [eax]
mov byte [ebp + 8], 0x72
push dword [ebp + 8]
mov word [ebp - 0x12], ax
call dword [0x518aa0]
lea eax, [ebp + 0xa]
push eax
push 6
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x50]
call dword [0x51832c]
mov ecx, eax
call dword [0x5182fc]
lea ecx, [ebp - 0xe]
mov di, word [eax]
mov byte [ebp + 8], 0x77
push dword [ebp + 8]
call dword [0x518aa0]
lea eax, [ebp + 0xa]
push eax
push 7
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x50]
call dword [0x51832c]
mov ecx, eax
call dword [0x5182fc]
lea ecx, [ebp + 0xa]
mov si, word [eax]
mov byte [ebp + 8], 0x78
push dword [ebp + 8]
call dword [0x518aa0]
lea eax, [ebp - 0x42]
push eax
push 8
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x50]
call dword [0x51832c]
mov ecx, eax
call dword [0x5182fc]
xor edx, edx
mov ecx, 2
mov ax, word [eax]
cmp ax, word [ebp + 0xa]
sete dl
xor eax, eax
cmp si, word [ebp - 0xe]
mov esi, 8
cmove eax, ecx
mov ecx, 4
or edx, eax
xor eax, eax
cmp di, word [ebp - 0x10]
cmove eax, ecx
xor ecx, ecx
or edx, eax
mov ax, word [ebp - 0x12]
cmp ax, word [ebp - 0x14]
mov ax, word [ebp - 0x16]
cmove ecx, esi
mov esi, 0x10
or edx, ecx
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov ax, word [ebp - 0x1a]
cmove ecx, esi
mov esi, 0x20
or edx, ecx
xor ecx, ecx
cmp ax, word [ebp - 0x1c]
mov ax, word [ebp - 0x1e]
cmove ecx, esi
mov esi, 0x40
or edx, ecx
xor ecx, ecx
cmp ax, word [ebp - 0x22]
mov ax, word [ebp - 0x26]
cmove ecx, esi
mov esi, pe_nt_image_headers32
or edx, ecx
xor ecx, ecx
cmp ax, word [ebp - 0x2a]
mov ax, word [ebp - 0x32]
cmove ecx, esi
mov esi, 0x100
or edx, ecx
xor ecx, ecx
cmp ax, word [ebp - 0x3a]
mov eax, dword [ebx]
cmove ecx, esi
or edx, ecx
mov ecx, ebx
push edx
mov dword [ebp - 0x44], edx
call dword [eax + 0x28]
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
call fcn.004a8850
push dword [ebp + 0xc]
push eax
call dword [0x518834]
add esp, 8
mov byte [ebp + 0xb], al
lea ecx, [ebp - 0x34]
call dword [0x518b64]
mov ecx, dword [ebp - 0x44]
test cl, 4
jne 0x4a38aa
test esi, ecx
je 0x4a38a6
cmp byte [ebp + 0xb], 0
jne 0x4a38aa
xor cl, cl
jmp 0x4a38ac
mov cl, 1
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 0x24]
mov eax, dword [ebp - 0x44]
test al, 2
jne 0x4a38c9
test al, al
jns 0x4a38c5
cmp byte [ebp + 0xb], 0
jne 0x4a38c9
xor cl, cl
jmp 0x4a38ce
mov ecx, 1
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 0x20]
lea ecx, [ebp - 0x50]
call dword [0x518b64]
lea ecx, [ebp - 0x4c]
call dword [0x518850]
lea ecx, [ebp - 0x58]
call dword [0x518b64]
lea ecx, [ebp - 0x54]
call fcn.00405b00
lea ecx, [ebp - 0x5c]
call dword [0x518b64]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret