Function at 0x48779c
Capabilities:
Contain obfuscated stackstrings
Get common file path
Set registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a8
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x4a0]
push edi
push eax
call fcn.0044e0ff
lea ecx, [ebp - 0x494]
mov dword [esp], 0x527fb4
call fcn.00402af5
call fcn.0044b4f2
test eax, eax
jne 0x4877e1
xor ebx, ebx
inc ebx
jmp 0x487c12
lea eax, [ebp - 0x284]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x4877ff
xor ebx, ebx
jmp 0x487c12
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x48c]
push esi
push eax
call fcn.00516cf0
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x284]
add esp, 0xc
push str.volume.htm
push eax
call esi
push str.mute.mid
lea eax, [ebp - 0x48c]
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
lea eax, [ebp - 0x284]
xor ebx, ebx
push ebx
push 0x180
push 2
push ebx
push 3
push 0x40000000
push eax
call esi
push ebx
push 0x180
push 2
push ebx
push 3
mov edi, eax
lea eax, [ebp - 0x48c]
push 0x40000000
push eax
mov dword [ebp - 0x490], edi
call esi
mov esi, eax
cmp edi, 0xffffffff
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x498], esi
je 0x487c0a
cmp esi, 0xffffffff
je 0x487c02
push 0x31
mov dword [ebp - 0x49c], ebx
call fcn.004044d6
pop ecx
test eax, eax
je 0x4878c1
lea ecx, [ebp - 0x49c]
push ecx
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocStringLen
call eax
jmp 0x4878d8
lea eax, [ebp - 0x49c]
push eax
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x487913
mov esi, dword [ebp - 0x49c]
push 0x45
call fcn.004044d6
pop ecx
push 4
push 0x527ff0
push 1
push ebx
push str.Check_Associations
push esi
test eax, eax
je 0x487902
call eax
jmp 0x487908
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x49c]
call fcn.00402f04
push ebx
lea eax, [ebp - 0x4a8]
mov dword [ebp - 0x4a8], ebx
push eax
mov esi, str._html__body__bgsound_src_.mute.mid_
push esi
call sub.msvcrt.dll_strlen
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
pop ecx
push eax
push esi
mov esi, dword [ebp - 0x490]
push esi
call edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
lea eax, [ebp - 0x4a8]
mov dword [ebp - 0x7c], 0x6468544d
push eax
push 0x75
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x78], 0x6000000
push eax
push dword [ebp - 0x498]
mov dword [ebp - 0x74], 0x2000100
mov dword [ebp - 0x70], 0x544dc000
mov dword [ebp - 0x6c], 0x6b72
mov dword [ebp - 0x68], 0xff003b00
mov dword [ebp - 0x64], 0x69540503
mov dword [ebp - 0x60], 0x656c74
mov dword [ebp - 0x5c], 0x430902ff
mov dword [ebp - 0x58], 0x6f706d6f
mov dword [ebp - 0x54], 0x3a726573
mov dword [ebp - 0x50], 0x801ff00
mov dword [ebp - 0x4c], 0x616d6552
mov dword [ebp - 0x48], 0x3a736b72
mov dword [ebp - 0x44], 0x351ff00
mov dword [ebp - 0x40], 0x20a107
mov dword [ebp - 0x3c], 0x40458ff
mov dword [ebp - 0x38], 0x81802
mov dword [ebp - 0x34], 0x259ff
mov dword [ebp - 0x30], 0x2fff0000
mov dword [ebp - 0x2c], 0x72544d00
mov dword [ebp - 0x28], 0x6b
mov dword [ebp - 0x24], 0x21ff001c
mov dword [ebp - 0x20], 0xff000001
mov dword [ebp - 0x1c], 0x654d0603
mov dword [ebp - 0x18], 0x79646f6c
mov dword [ebp - 0x14], 0x7bb002b0
mov dword [ebp - 0x10], 0x78b00000
mov dword [ebp - 0xc], 0x2fff0000
mov byte [ebp - 8], bl
call edi
push dword [ebp - 0x498]
call esi
call fcn.00403e8d
test eax, eax
je 0x487b5f
lea eax, [ebp - 0x490]
push str.360DeskAna64.exe
push eax
call fcn.00431b99
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x494]
call fcn.00402bd6
mov ecx, dword [ebp - 0x490]
lea ecx, [ecx - 0x10]
call fcn.004042e9
mov edi, dword [ebp - 0x494]
push edi
call fcn.0041505c
pop ecx
test eax, eax
je 0x487c18
push ebx
push edi
call fcn.00425e47
pop ecx
pop ecx
test eax, eax
je 0x487c18
call fcn.00403a64
push eax
lea ecx, [ebp - 0x498]
call fcn.00402a6b
lea eax, [ebp - 0x284]
mov esi, str.ievolume___s____s_
push eax
push dword [ebp - 0x4a0]
lea eax, [ebp - 0x498]
push esi
push eax
call fcn.00415254
add esp, 0x10
mov ecx, 0x576d98
push ebx
push ebx
push dword [ebp - 0x498]
push edi
push str.open
push ebx
call fcn.004dba26
call fcn.00403a64
push eax
lea ecx, [ebp - 0x490]
call fcn.00402a6b
lea eax, [ebp - 0x4a4]
push eax
call fcn.00488082
mov edi, dword [ebp - 0x4a4]
lea eax, [ebp - 0x284]
push eax
push edi
lea eax, [ebp - 0x490]
push esi
push eax
call fcn.00415254
mov esi, dword [ebp - 0x490]
add esp, 0x14
mov ecx, 0x576d98
push ebx
push ebx
push esi
push dword [ebp - 0x494]
push str.open
push ebx
call fcn.004dba26
lea ecx, [edi - 0x10]
mov ebx, eax
call fcn.004042e9
lea ecx, [esi - 0x10]
call fcn.004042e9
mov ecx, dword [ebp - 0x498]
mov edi, dword [ebp - 0x494]
add ecx, 0xfffffff0
jmp 0x487bfb
lea eax, [ebp - 0x4a4]
push str.360DeskAna.exe
push eax
call fcn.00431b99
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x494]
call fcn.00402bd6
mov ecx, dword [ebp - 0x4a4]
lea ecx, [ecx - 0x10]
call fcn.004042e9
mov edi, dword [ebp - 0x494]
push edi
call fcn.0041505c
pop ecx
test eax, eax
je 0x487c18
push ebx
push edi
call fcn.00425e47
pop ecx
pop ecx
test eax, eax
je 0x487c18
call fcn.00403a64
push eax
lea ecx, [ebp - 0x490]
call fcn.00402a6b
lea eax, [ebp - 0x284]
push eax
push dword [ebp - 0x4a0]
lea eax, [ebp - 0x490]
push str.ievolume___s____s_
push eax
call fcn.00415254
mov esi, dword [ebp - 0x490]
add esp, 0x10
mov ecx, 0x576d98
push ebx
push ebx
push esi
push edi
push str.open
push ebx
call fcn.004dba26
mov ebx, eax
lea ecx, [esi - 0x10]
call fcn.004042e9
jmp 0x487c18
push dword [ebp - 0x490]
call edi
cmp esi, 0xffffffff
je 0x487c12
push esi
call edi
mov edi, dword [ebp - 0x494]
lea ecx, [edi - 0x10]
call fcn.004042e9
mov ecx, dword [ebp - 0x4a0]
lea ecx, [ecx - 0x10]
call fcn.004042e9
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00522d04
leave
ret