Function at 0x40a8f4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x494f13
call fcn.00486614
sub esp, 0x98
push esi
push edi
push 0
lea ecx, [ebp - 0xa4]
call fcn.0047e407
and dword [ebp - 4], 0
lea ecx, [ebp - 0xa4]
call fcn.0047e492
mov eax, dword [0x4bb1a0]
mov dword [ebp - 0x10], eax
mov edi, dword [0x4a23e0]
mov esi, 0x4bb67c
mov eax, esi
mov byte [ebp - 4], 1
test eax, eax
jne 0x40a943
xor eax, eax
jmp 0x40a946
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.00403db8
mov esi, 0x4bb294
mov eax, esi
test eax, eax
je 0x40a95e
push esi
call edi
push ebx
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.00403db8
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0xa4]
push eax
call fcn.0047e7a0
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
push eax
mov byte [ebp - 4], 2
push dword [eax - 8]
call fcn.00403db8
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004015f7
mov ebx, 0x4cb3a8
push ebx
call fcn.00486c25
test eax, eax
pop ecx
jbe 0x40a9cc
mov eax, esi
test eax, eax
je 0x40a9af
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.00403db8
mov eax, ebx
test eax, eax
je 0x40a9c2
push ebx
call edi
push ebx
push eax
lea ecx, [ebp - 0x10]
call fcn.00403db8
lea ecx, [ebp - 0x24]
call fcn.0047d5a4
mov esi, 0x4bb434
mov eax, esi
test eax, eax
je 0x40a9e2
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.00403db8
lea eax, [ebp - 0x14]
push eax
call fcn.0047d616
pop ecx
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
push eax
mov byte [ebp - 4], 3
push dword [eax - 8]
call fcn.00403db8
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004015f7
call fcn.00411f9c
mov esi, 0x4bbf98
mov ebx, eax
mov eax, esi
test eax, eax
je 0x40aa29
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.00403db8
mov esi, str.Admin_privelegies:
mov eax, esi
test eax, eax
je 0x40aa41
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.00403db8
test ebx, ebx
pop ebx
mov esi, 0x4bbf68
jne 0x40aa5a
mov esi, 0x4bbf60
test esi, esi
jne 0x40aa62
xor eax, eax
jmp 0x40aa65
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.00403db8
mov esi, str.__command_line_
mov eax, esi
test eax, eax
je 0x40aa7d
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.00403db8
cmp dword [ebp + 8], 0
jne 0x40aa91
xor eax, eax
jmp 0x40aa96
push dword [ebp + 8]
call edi
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
push eax
call fcn.00403db8
mov esi, 0x4bb430
mov eax, esi
test eax, eax
je 0x40aab0
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.00403db8
push 1
push dword [ebp - 0x10]
call fcn.0040afa6
pop ecx
pop ecx
lea ecx, [ebp - 0x10]
call fcn.00403be5
lea eax, [ebp - 0x20]
push eax
call fcn.0040a7ef
pop ecx
push eax
lea eax, [ebp - 0x14]
push str.The_Log_File:__
push eax
mov byte [ebp - 4], 4
call fcn.00403d54
push esi
push eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 5
push eax
call fcn.00403cf0
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.004016bd
lea ecx, [ebp + 8]
mov byte [ebp - 4], 5
call fcn.004015f7
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.004015f7
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.004015f7
lea eax, [ebp - 0x1c]
push eax
call fcn.0041d191
mov edi, eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 7
mov dword [esp], 0x4bb42c
call fcn.00401623
push str.DesktopName:__
push eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 8
push eax
call fcn.00403cf0
push edi
push eax
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 9
push eax
call fcn.00403c43
push esi
push eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 0xa
push eax
call fcn.00403cf0
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
push eax
mov byte [ebp - 4], 0xb
push dword [eax - 8]
call fcn.00403db8
mov byte [ebp - 4], 0xa
lea ecx, [ebp + 8]
call fcn.004015f7
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 9
call fcn.004015f7
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 8
call fcn.004015f7
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 7
call fcn.004015f7
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.004015f7
call dword [0x4a2354]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004167bf
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x1c]
push str.__PID:__
push eax
mov byte [ebp - 4], 0xc
call fcn.00403d54
push esi
push eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 0xd
push eax
call fcn.00403cf0
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xe
call fcn.00403e34
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0xd
call fcn.004015f7
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xc
call fcn.004015f7
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.004015f7
push 1
push dword [ebp - 0x10]
call fcn.0040afa6
and byte [ebp - 4], 0
pop ecx
pop ecx
lea ecx, [ebp - 0x10]
call fcn.004015f7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa4]
call fcn.0047e2e6
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret