Function at 0x40b0c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x49879b
call fcn.00489db4
sub esp, 0x98
push esi
push edi
push 0
lea ecx, [ebp - 0xa4]
call fcn.00481c91
and dword [ebp - 4], 0
lea ecx, [ebp - 0xa4]
call fcn.00481d1c
mov eax, dword [0x4bf1a0]
mov dword [ebp - 0x10], eax
mov edi, dword [0x4a63e0]
mov esi, 0x4bf728
mov eax, esi
mov byte [ebp - 4], 1
test eax, eax
jne 0x40b10f
xor eax, eax
jmp 0x40b112
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.0040444d
mov esi, 0x4bf2c8
mov eax, esi
test eax, eax
je 0x40b12a
push esi
call edi
push ebx
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.0040444d
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0xa4]
push eax
call fcn.0048202a
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
push eax
mov byte [ebp - 4], 2
push dword [eax - 8]
call fcn.0040444d
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00401605
mov ebx, 0x4cf898
push ebx
call fcn.0048a3a4
test eax, eax
pop ecx
jbe 0x40b198
mov eax, esi
test eax, eax
je 0x40b17b
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.0040444d
mov eax, ebx
test eax, eax
je 0x40b18e
push ebx
call edi
push ebx
push eax
lea ecx, [ebp - 0x10]
call fcn.0040444d
lea ecx, [ebp - 0x24]
call fcn.00480d20
mov esi, 0x4bf468
mov eax, esi
test eax, eax
je 0x40b1ae
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.0040444d
lea eax, [ebp - 0x14]
push eax
call fcn.00480d92
pop ecx
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
push eax
mov byte [ebp - 4], 3
push dword [eax - 8]
call fcn.0040444d
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00401605
call fcn.004128bc
mov esi, 0x4c0030
mov ebx, eax
mov eax, esi
test eax, eax
je 0x40b1f5
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.0040444d
mov esi, str.Admin_privelegies:
mov eax, esi
test eax, eax
je 0x40b20d
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.0040444d
test ebx, ebx
pop ebx
mov esi, 0x4c0000
jne 0x40b226
mov esi, 0x4bfff8
test esi, esi
jne 0x40b22e
xor eax, eax
jmp 0x40b231
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.0040444d
mov esi, str.__command_line_
mov eax, esi
test eax, eax
je 0x40b249
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.0040444d
cmp dword [ebp + 8], 0
jne 0x40b25d
xor eax, eax
jmp 0x40b262
push dword [ebp + 8]
call edi
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
push eax
call fcn.0040444d
mov esi, 0x4bf464
mov eax, esi
test eax, eax
je 0x40b27c
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.0040444d
push 1
push dword [ebp - 0x10]
call fcn.0040b772
pop ecx
pop ecx
lea ecx, [ebp - 0x10]
call fcn.0040427a
lea eax, [ebp - 0x20]
push eax
call fcn.0040afbb
pop ecx
push eax
lea eax, [ebp - 0x14]
push str.The_Log_File:__
push eax
mov byte [ebp - 4], 4
call fcn.004043e9
push esi
push eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 5
push eax
call fcn.00404385
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.004016cb
lea ecx, [ebp + 8]
mov byte [ebp - 4], 5
call fcn.00401605
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.00401605
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.00401605
lea eax, [ebp - 0x1c]
push eax
call fcn.0041e139
mov edi, eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 7
mov dword [esp], 0x4bf460
call fcn.00401631
push str.DesktopName:__
push eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 8
push eax
call fcn.00404385
push edi
push eax
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 9
push eax
call fcn.004042d8
push esi
push eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 0xa
push eax
call fcn.00404385
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
push eax
mov byte [ebp - 4], 0xb
push dword [eax - 8]
call fcn.0040444d
mov byte [ebp - 4], 0xa
lea ecx, [ebp + 8]
call fcn.00401605
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 9
call fcn.00401605
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 8
call fcn.00401605
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 7
call fcn.00401605
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00401605
call dword [0x4a6354]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00417172
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x1c]
push str.__PID:__
push eax
mov byte [ebp - 4], 0xc
call fcn.004043e9
push esi
push eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 0xd
push eax
call fcn.00404385
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xe
call fcn.004044c9
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0xd
call fcn.00401605
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xc
call fcn.00401605
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00401605
push 1
push dword [ebp - 0x10]
call fcn.0040b772
and byte [ebp - 4], 0
pop ecx
pop ecx
lea ecx, [ebp - 0x10]
call fcn.00401605
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa4]
call fcn.00481b70
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret