Function at 0x40a8fe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x497d63
call fcn.0048945c
sub esp, 0x98
push esi
push edi
push 0
lea ecx, [ebp - 0xa4]
call fcn.004813a6
and dword [ebp - 4], 0
lea ecx, [ebp - 0xa4]
call fcn.00481431
mov eax, dword [0x4be1a0]
mov dword [ebp - 0x10], eax
mov edi, dword [0x4a53e0]
mov esi, 0x4be6b0
mov eax, esi
mov byte [ebp - 4], 1
test eax, eax
jne 0x40a94d
xor eax, eax
jmp 0x40a950
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.00403dba
mov esi, 0x4be2c8
mov eax, esi
test eax, eax
je 0x40a968
push esi
call edi
push ebx
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.00403dba
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0xa4]
push eax
call fcn.0048173f
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
push eax
mov byte [ebp - 4], 2
push dword [eax - 8]
call fcn.00403dba
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00401605
mov ebx, 0x4ce788
push ebx
call fcn.00489a75
test eax, eax
pop ecx
jbe 0x40a9d6
mov eax, esi
test eax, eax
je 0x40a9b9
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.00403dba
mov eax, ebx
test eax, eax
je 0x40a9cc
push ebx
call edi
push ebx
push eax
lea ecx, [ebp - 0x10]
call fcn.00403dba
lea ecx, [ebp - 0x24]
call fcn.0046f90c
mov esi, 0x4be468
mov eax, esi
test eax, eax
je 0x40a9ec
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.00403dba
lea eax, [ebp - 0x14]
push eax
call fcn.004805b1
pop ecx
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
push eax
mov byte [ebp - 4], 3
push dword [eax - 8]
call fcn.00403dba
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00401605
call fcn.004120e2
mov esi, 0x4befc8
mov ebx, eax
mov eax, esi
test eax, eax
je 0x40aa33
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.00403dba
mov esi, str.Admin_privelegies:
mov eax, esi
test eax, eax
je 0x40aa4b
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.00403dba
test ebx, ebx
pop ebx
mov esi, 0x4bef98
jne 0x40aa64
mov esi, 0x4bef90
test esi, esi
jne 0x40aa6c
xor eax, eax
jmp 0x40aa6f
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.00403dba
mov esi, str.__command_line_
mov eax, esi
test eax, eax
je 0x40aa87
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.00403dba
cmp dword [ebp + 8], 0
jne 0x40aa9b
xor eax, eax
jmp 0x40aaa0
push dword [ebp + 8]
call edi
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
push eax
call fcn.00403dba
mov esi, 0x4be464
mov eax, esi
test eax, eax
je 0x40aaba
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.00403dba
push 1
push dword [ebp - 0x10]
call fcn.0040afb0
pop ecx
pop ecx
lea ecx, [ebp - 0x10]
call fcn.00403be7
lea eax, [ebp - 0x20]
push eax
call fcn.0040a7f9
pop ecx
push eax
lea eax, [ebp - 0x14]
push str.The_Log_File:__
push eax
mov byte [ebp - 4], 4
call fcn.00403d56
push esi
push eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 5
push eax
call fcn.00403cf2
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.004016cb
lea ecx, [ebp + 8]
mov byte [ebp - 4], 5
call fcn.00401605
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.00401605
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.00401605
lea eax, [ebp - 0x1c]
push eax
call fcn.0041db7f
mov edi, eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 7
mov dword [esp], 0x4be460
call fcn.00401631
push str.DesktopName:__
push eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 8
push eax
call fcn.00403cf2
push edi
push eax
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 9
push eax
call fcn.00403c45
push esi
push eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 0xa
push eax
call fcn.00403cf2
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
push eax
mov byte [ebp - 4], 0xb
push dword [eax - 8]
call fcn.00403dba
mov byte [ebp - 4], 0xa
lea ecx, [ebp + 8]
call fcn.00401605
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 9
call fcn.00401605
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 8
call fcn.00401605
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 7
call fcn.00401605
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00401605
call dword [0x4a5354]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00416993
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x1c]
push str.__PID:__
push eax
mov byte [ebp - 4], 0xc
call fcn.00403d56
push esi
push eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 0xd
push eax
call fcn.00403cf2
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xe
call fcn.00403e36
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0xd
call fcn.00401605
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xc
call fcn.00401605
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00401605
push 1
push dword [ebp - 0x10]
call fcn.0040afb0
and byte [ebp - 4], 0
pop ecx
pop ecx
lea ecx, [ebp - 0x10]
call fcn.00401605
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa4]
call fcn.00481285
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret