Function at 0x4caf13
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x188
mov eax, 0x64a303
call fcn.004e70a5
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], bl
lea ecx, [ebp - 0xb0]
mov dword [ebp - 4], ebx
call fcn.004c96f3
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 1
call fcn.004c96f3
push esi
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 2
call fcn.004ca011
test al, al
je 0x4cb8b3
xor ecx, ecx
mov dword [edi], ebx
inc ecx
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0x48], ecx
lea ecx, [edi + 0x10]
mov dword [edi + 0x40], 0x1e
mov byte [edi + 0x44], bl
cmp dword [edi + 0x24], 8
mov dword [edi + 0x20], ebx
jb 0x4caf93
mov ecx, dword [edi + 0x10]
xor eax, eax
lea esi, [edi + 0x64]
mov word [ecx], ax
mov eax, esi
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], ebx
jb 0x4cafa8
mov eax, dword [esi]
mov byte [eax], bl
lea ecx, [edi + 0x28]
cmp dword [edi + 0x3c], 8
mov dword [edi + 0x38], ebx
jb 0x4cafb9
mov ecx, dword [edi + 0x28]
xor eax, eax
mov word [ecx], ax
lea ecx, [edi + 0x7c]
cmp dword [edi + 0x90], 0x10
mov dword [edi + 0x8c], ebx
jb 0x4cafd3
mov ecx, dword [edi + 0x7c]
lea eax, [edi + 0xac]
mov byte [ecx], bl
cmp dword [eax + 0x14], 0x10
mov ecx, eax
mov dword [eax + 0x10], ebx
jb 0x4cafe8
mov ecx, dword [eax]
mov byte [ecx], bl
lea ecx, [ebp - 0x28]
push 2
push 0x6c7444
mov dword [edi + 0x10c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.0040eedd
push edi
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0xb0]
call fcn.004c9cf7
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0040ee34
push 2
push 0x65d524
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.0040eedd
lea eax, [edi + 4]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xb0]
call fcn.004c9cf7
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0040ee34
push 4
push str.land
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.0040eedd
lea eax, [edi + 8]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xb0]
call fcn.004c9cf7
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0040ee34
push 6
push 0x65d9e0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.0040eedd
lea eax, [edi + 0xc]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xb0]
call fcn.004c9cf7
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0040ee34
push 3
push 0x65e37c
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.0040eedd
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xb0]
call fcn.004c9dfc
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0040ee34
push 0x3a8
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.0040dd78
lea eax, [ebp - 0x28]
push eax
call fcn.004b7264
add esp, 0x20
lea ecx, [edi + 0x10]
push eax
call fcn.0040d2d8
lea ecx, [ebp - 0x28]
call fcn.0040b4f9
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
push 3
cmovae eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x30], ebx
push 0x65e380
mov dword [ebp - 0x18], ebx
mov byte [eax], bl
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.0040eedd
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xb0]
call fcn.004c9dfc
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0040ee34
push 0x3a8
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.0040dd78
lea eax, [ebp - 0x28]
push eax
call fcn.004b7264
add esp, 0x20
lea ecx, [edi + 0x28]
push eax
call fcn.0040d2d8
lea ecx, [ebp - 0x28]
call fcn.0040b4f9
lea ecx, [ebp - 0x78]
call fcn.004c96f3
push 6
push str.config
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.0040eedd
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xb0]
call fcn.004c9d4b
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
mov bl, al
call fcn.0040ee34
test bl, bl
je 0x4cb895
push 6
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.intert
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0040eedd
lea eax, [edi + 0x40]
mov byte [ebp - 4], 0xb
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x78]
call fcn.004c9cf7
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.0040ee34
push 5
push str.param
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.0040eedd
lea eax, [edi + 0xac]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x78]
call fcn.004c9dfc
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.0040ee34
push 7
push str.dllmain
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.0040eedd
lea eax, [edi + 0x7c]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x78]
call fcn.004c9dfc
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.0040ee34
push 7
push str.exename
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.0040eedd
lea eax, [edi + 0x94]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x78]
call fcn.004c9dfc
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.0040ee34
push 0xa
push str.returnbool
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.0040eedd
lea eax, [edi + 0x44]
mov byte [ebp - 4], 0xf
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x78]
call fcn.004c9ead
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.0040ee34
push 7
push str.funtype
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.0040eedd
push esi
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x10
push eax
lea ecx, [ebp - 0x78]
call fcn.004c9dfc
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.0040ee34
push 5
push str.admin
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.0040eedd
lea eax, [edi + 0x4c]
mov byte [ebp - 4], 0x11
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x78]
call fcn.004c9dfc
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.0040ee34
push 4
push str.land
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.0040eedd
lea eax, [edi + 8]
mov byte [ebp - 4], 0x12
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x78]
call fcn.004c9cf7
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.0040ee34
push 0xd
push str.firstdlldelay
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.0040eedd
lea eax, [edi + 0xc4]
mov byte [ebp - 4], 0x13
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x78]
call fcn.004c9dfc
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.0040ee34
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
push 0xa
cmovae eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x30], ebx
push str.usercfgtag
mov dword [ebp - 0x18], ebx
mov byte [eax], bl
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.0040eedd
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x14
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x78]
call fcn.004c9dfc
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
mov bl, al
call fcn.0040ee34
test bl, bl
je 0x4cb4ba
xor eax, eax
cmp eax, dword [ebp - 0x30]
sbb eax, eax
neg eax
mov dword [edi + 0x48], eax
push 0xb
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.dlldelayqid
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0040eedd
lea eax, [ebp - 0x190]
mov byte [ebp - 4], 0x15
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x78]
call fcn.004c9d4b
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.0040ee34
lea ecx, [ebp - 0x190]
call fcn.004c9f39
test eax, eax
jle 0x4cb573
mov esi, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x16
push eax
push esi
lea ecx, [ebp - 0x190]
call fcn.004c9ef8
test al, al
je 0x4cb554
lea ecx, [edi + 0xdc]
mov eax, dword [ecx + 4]
cmp dword [ecx + 8], eax
je 0x4cb54a
lea eax, [ebp - 0x28]
push eax
call fcn.004b63f7
jmp 0x4cb554
lea edx, [ebp - 0x28]
push edx
push eax
call fcn.004b643b
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
call fcn.0040ee34
lea ecx, [ebp - 0x190]
inc esi
call fcn.004c9f39
cmp esi, eax
jl 0x4cb50c
lea esi, [edi + 0x64]
lea ecx, [ebp - 0x158]
call fcn.004c96f3
push 7
push str.onlyqid
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.0040eedd
lea eax, [ebp - 0x158]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x78]
call fcn.004c9d4b
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x17
call fcn.0040ee34
lea ecx, [ebp - 0x158]
call fcn.004c9f39
test eax, eax
jle 0x4cb639
mov esi, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x19
push eax
push esi
lea ecx, [ebp - 0x158]
call fcn.004c9ef8
test al, al
je 0x4cb61a
lea ecx, [edi + 0xe8]
mov eax, dword [ecx + 4]
cmp dword [ecx + 8], eax
je 0x4cb610
lea eax, [ebp - 0x28]
push eax
call fcn.004b63f7
jmp 0x4cb61a
lea edx, [ebp - 0x28]
push edx
push eax
call fcn.004b643b
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x17
call fcn.0040ee34
lea ecx, [ebp - 0x158]
inc esi
call fcn.004c9f39
cmp esi, eax
jl 0x4cb5d2
lea esi, [edi + 0x64]
cmp dword [esi + 0x10], 0
jbe 0x4cb66c
sub esp, 0x18
mov ecx, esp
push esi
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.0040dd78
lea eax, [ebp - 0x28]
push eax
call fcn.004b71ba
add esp, 0x1c
mov ecx, esi
push eax
call fcn.0040d416
lea ecx, [ebp - 0x28]
call fcn.0040ee34
lea ecx, [ebp - 0xe8]
call fcn.004c96f3
push 0xb
push str.localbinary
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.0040eedd
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 0x1b
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x78]
call fcn.004c9d4b
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1a
mov bl, al
call fcn.0040ee34
test bl, bl
je 0x4cb87f
push 0x54
call fcn.004e6a1a
mov esi, eax
xor ebx, ebx
pop ecx
test esi, esi
je 0x4cb6e9
push 0x54
push ebx
push esi
call fcn.004fe600
add esp, 0xc
mov ecx, esi
call fcn.004caee8
jmp 0x4cb6eb
mov eax, ebx
push 4
push 0x65e3fc
lea ecx, [ebp - 0x28]
mov dword [edi + 0x10c], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.0040eedd
push dword [edi + 0x10c]
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x1c
push eax
lea ecx, [ebp - 0xe8]
call fcn.004c9dfc
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1a
call fcn.0040ee34
push 7
push str.lbparam
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.0040eedd
mov eax, dword [edi + 0x10c]
lea ecx, [ebp - 0xe8]
add eax, 0x30
mov byte [ebp - 4], 0x1d
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004c9dfc
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1a
call fcn.0040ee34
push 9
push str.lbdllmain
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.0040eedd
mov eax, dword [edi + 0x10c]
lea ecx, [ebp - 0xe8]
add eax, 0x18
mov byte [ebp - 4], 0x1e
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004c9dfc
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1a
call fcn.0040ee34
lea ecx, [ebp - 0x120]
call fcn.004c96f3
push 8
push str.lbrunver
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.0040eedd
lea eax, [ebp - 0x120]
mov byte [ebp - 4], 0x20
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xe8]
call fcn.004c9d4b
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1f
call fcn.0040ee34
lea ecx, [ebp - 0x120]
mov esi, ebx
call fcn.004c9f39
test eax, eax
jle 0x4cb874
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x120]
cmovae eax, dword [ebp - 0x40]
mov byte [eax], bl
lea eax, [ebp - 0x40]
push eax
push esi
call fcn.004c9ef8
mov ecx, dword [edi + 0x10c]
add ecx, 0x48
mov eax, dword [ecx + 4]
cmp dword [ecx + 8], eax
je 0x4cb85a
lea eax, [ebp - 0x40]
push eax
call fcn.004b63f7
jmp 0x4cb864
lea edx, [ebp - 0x40]
push edx
push eax
call fcn.004b643b
lea ecx, [ebp - 0x120]
inc esi
call fcn.004c9f39
cmp esi, eax
jl 0x4cb81e
lea ecx, [ebp - 0x120]
call fcn.004c97a9
lea ecx, [ebp - 0xe8]
call fcn.004c97a9
lea ecx, [ebp - 0x158]
call fcn.004c97a9
xor ebx, ebx
cmp dword [edi + 0x20], ebx
je 0x4cb8ab
cmp dword [edi + 0x8c], ebx
je 0x4cb8ab
cmp dword [edi + 0x38], ebx
je 0x4cb8ab
mov bl, 1
lea ecx, [ebp - 0x78]
call fcn.004c97a9
lea ecx, [ebp - 0x190]
call fcn.004c97a9
lea ecx, [ebp - 0xb0]
call fcn.004c97a9
lea ecx, [ebp - 0x40]
call fcn.0040ee34
mov al, bl
call fcn.004e704f
ret