Function at 0x49bc90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [esp + 0x30], eax
lea eax, [esi + 0x28]
push eax
call fcn.004aabc0
mov ecx, eax
push 1
call fcn.004ab000
lea ecx, [esp + 0x2c]
mov dword [ecx], 0xffffffff
push eax
call fcn.0049e0f0
cmp byte [esi + 0x27], 0
js 0x49be84
lea eax, [esi + 0x1c]
mov ecx, dword [eax + 8]
mov dword [esp + 0x28], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x20], xmm0
lea eax, [esp + 0x1a]
mov byte [eax + 1], 0xa
mov ecx, str.event_type
lea edi, [esp + 0x10]
cmp edi, ecx
seta dl
cmp eax, ecx
setbe al
or al, dl
je 0x49c12a
mov word [esp + 0x18], 0x6570
mov dword [esp + 0x14], 0x79745f74
mov dword [esp + 0x10], 0x6e657665
mov byte [esp + 0x1a], 0
mov ecx, dword [esp + 0x2c]
push edi
call fcn.004ab340
lea edi, [esp + 0x20]
mov ecx, eax
push edi
call fcn.004ab140
cmp byte [esp + 0x1b], 0
jns 0x49bd54
push dword [esp + 0x10]
call fcn.006507ee
add esp, 4
cmp byte [esp + 0x2b], 0
jns 0x49bd67
push dword [esp + 0x20]
call fcn.006507ee
add esp, 4
push 0x18
call fcn.006507be
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], 0x80000018
mov dword [esp + 0x24], 0x12
lea ecx, [eax + 0x12]
mov edx, str.message_session_id
cmp eax, edx
seta bl
cmp ecx, edx
setbe cl
or cl, bl
je 0x49c12a
movups xmm0, xmmword [str.message_session_id]
movups xmmword [eax], xmm0
mov word [eax + 0x10], 0x6469
mov byte [eax + 0x12], 0
mov ecx, dword [esp + 0x2c]
push edi
call fcn.004ab340
mov ecx, eax
push dword [esi + 0x34]
call fcn.004ab280
cmp byte [esp + 0x2b], 0
mov ebx, dword [ebp + 8]
jns 0x49bddd
push dword [esp + 0x20]
call fcn.006507ee
add esp, 4
mov dword [esp], SysReAllocString
mov dword [esp + 4], 0
mov eax, dword [esi]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x7a29f4]
mov ecx, esi
lea eax, [esp + 0x2c]
push eax
call edi
lea ecx, [esp + 0xc]
mov dword [ecx], 0xffffffff
push ebx
call fcn.0049e0f0
mov eax, dword [esi + 8]
mov ebx, dword [esi + 0xc]
mov ecx, eax
or ecx, ebx
mov dword [esp + 8], esi
je 0x49beb3
mov ecx, eax
add ecx, 1
mov edx, SysReAllocString
adc edx, ebx
cmp ecx, 2
sbb edx, 0
jb 0x49be98
xor edx, edx
add eax, 0xb779c000
adc ebx, 0xffd6a169
mov ecx, SysReAllocString
cmovno ecx, ebx
cmovo eax, edx
mov edx, eax
add edx, 1
mov edi, SysReAllocString
adc edi, ecx
cmp edx, 2
sbb edi, 0
mov ebx, 0
mov edi, SysReAllocString
jb 0x49beb7
push 0
push 0x3e8
push ecx
push eax
call fcn.00678090
mov ebx, eax
mov edi, edx
jmp 0x49beb7
lea ecx, [esp + 0x20]
push dword [esi + 0x20]
push dword [esi + 0x1c]
call fcn.005cceb0
jmp 0x49bcec
mov eax, SysReAllocString
lea edi, [eax - 1]
test ebx, ebx
mov dword [esp], SysReAllocString
cmovs edi, eax
sar ebx, 0x1f
not ebx
jmp 0x49beb7
xor ebx, ebx
xor edi, edi
push 0x10
call fcn.006507be
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], reloc.WS2_32.dll_recv
mov dword [esp + 0x24], 0xe
lea ecx, [eax + 0xe]
mov esi, str.EventTimestamp
cmp eax, esi
seta dl
cmp ecx, esi
setbe cl
or cl, dl
je 0x49c12a
mov word [eax + 0xc], 0x706d
mov dword [eax + 8], 0x61747365
mov dword [eax + 4], 0x6d695474
mov dword [eax], 0x6e657645
mov byte [eax + 0xe], 0
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x20]
push eax
call fcn.004ab340
mov ecx, eax
push edi
push ebx
call fcn.004ab2a0
cmp byte [esp + 0x2b], 0
jns 0x49bf37
push dword [esp + 0x20]
call fcn.006507ee
add esp, 4
lea eax, [esp + 0x10]
push eax
call fcn.005d5a90
add esp, 4
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, eax
or edx, ecx
lea edi, [esp + 0x20]
je 0x49bfc8
mov edx, eax
add edx, 1
mov esi, SysReAllocString
adc esi, ecx
cmp edx, 2
sbb esi, 0
jb 0x49bfad
xor esi, esi
add eax, 0xb779c000
adc ecx, 0xffd6a169
mov edx, SysReAllocString
cmovno edx, ecx
cmovo eax, esi
mov ecx, eax
add ecx, 1
mov esi, SysReAllocString
adc esi, edx
cmp ecx, 2
sbb esi, 0
jb 0x49bfd7
push 0
push 0x3e8
push edx
push eax
call fcn.00678090
mov dword [esp + 4], eax
mov dword [esp], edx
jmp 0x49bfd7
mov edx, SysReAllocString
lea eax, [edx - 1]
test ecx, ecx
cmovns edx, eax
mov dword [esp], edx
sar ecx, 0x1f
not ecx
mov dword [esp + 4], ecx
jmp 0x49bfd7
mov dword [esp + 4], 0
mov dword [esp], 0
push 0x10
call fcn.006507be
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], reloc.WS2_32.dll_recv
mov dword [esp + 0x24], 0xd
lea ecx, [eax + 0xd]
mov edx, str.SentTimestamp
cmp eax, edx
seta bl
cmp ecx, edx
setbe cl
or cl, bl
mov esi, dword [esp + 8]
je 0x49c12a
mov dword [eax + 8], 0x6d617473
mov dword [eax + 4], 0x656d6954
mov dword [eax], 0x746e6553
mov word [eax + 0xc], 0x70
mov ecx, dword [esp + 0xc]
push edi
call fcn.004ab340
mov ecx, eax
push dword [esp]
push dword [esp + 8]
call fcn.004ab2a0
cmp byte [esp + 0x2b], 0
jns 0x49c058
push dword [esp + 0x20]
call fcn.006507ee
add esp, 4
push 0x10
call fcn.006507be
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], reloc.WS2_32.dll_recv
mov dword [esp + 0x24], 0xe
lea ecx, [eax + 0xe]
mov edx, str.OSPMessageUUID
cmp eax, edx
seta bl
cmp ecx, edx
setbe cl
or cl, bl
je 0x49c12a
add esi, 0x10
mov word [eax + 0xc], 0x4449
mov dword [eax + 8], 0x55556567
mov dword [eax + 4], 0x61737365
mov dword [eax], 0x4d50534f
mov byte [eax + 0xe], 0
lea ecx, [esp + 0xc]
push esi
push edi
call fcn.004811b0
cmp byte [esp + 0x2b], 0
jns 0x49c0cf
push dword [esp + 0x20]
call fcn.006507ee
add esp, 4
mov eax, dword [esp + 0xc]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x7b4788]
bt edx, ecx
jae 0x49c0f2
push eax
call fcn.00545f70
add esp, 4
mov eax, dword [esp + 0x2c]
mov ecx, eax
shr ecx, 0xe
mov edx, eax
shr edx, 0x13
mov edx, dword [edx*4 + 0x7b4788]
bt edx, ecx
jae 0x49c115
push eax
call fcn.00545f70
add esp, 4
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.00650d60
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
ud2