Function at 0x4a0f10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x38
cmp dword [esp + 0x4c], 0
je 0x4a0f63
mov esi, dword [esp + 0x50]
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [esp + 0x1c]
push 0
push 1
push eax
push 0
push edi
push 0
push 0x11ff
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
setne al
mov byte [esp + 3], al
je 0x4a0f6a
movzx ecx, byte [esi]
test cl, 1
je 0x4a0f7e
mov ecx, dword [esi + 4]
jmp 0x4a0f80
mov al, 1
jmp 0x4a11e0
movzx ecx, byte [esi]
test cl, 1
je 0x4a1210
mov ecx, dword [esi + 4]
jmp 0x4a1212
shr ecx, 1
mov dword [esp + 0x18], ecx
lea ebx, [ecx + 2]
cmp ebx, 0xfffffff8
jae 0x4a1303
cmp ebx, 0xb
jae 0x4a0fc2
xorps xmm0, xmm0
movsd qword [esp + 4], xmm0
mov dword [esp + 0xc], 0
add bl, bl
mov byte [esp + 4], bl
lea ebp, [esp + 5]
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x4a0ffd
test byte [esi], 1
je 0x4a0ff1
mov esi, dword [esi + 8]
jmp 0x4a0ff2
mov esi, ebx
or esi, 7
lea eax, [esi + 1]
push eax
call sub.libc.dll_operator_new_unsigned_int_
add esp, 4
mov ebp, eax
add esi, 2
mov dword [esp + 4], esi
mov esi, dword [esp + 0x50]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov ebx, dword [esp + 0x18]
test byte [esi], 1
jne 0x4a0fbd
inc esi
push ebx
push esi
push ebp
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
add esp, 0xc
mov word [ebp + ebx], 0x203a
mov byte [ebp + ebx + 2], 0
lea ecx, [esp + 4]
push dword [esp + 0x1c]
call fcn.00504a62
movzx ebx, byte [eax]
mov bh, byte [eax + 1]
movzx ecx, word [eax + 6]
mov word [esp + 0x30], cx
mov ecx, dword [eax + 2]
mov dword [esp + 0x2c], ecx
mov esi, dword [eax + 8]
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
mov ebp, dword [esp + 0x4c]
test byte [ebp], 1
je 0x4a1052
push dword [ebp + 8]
call sub.libc.dll_operator_delete_void_
add esp, 4
mov byte [ebp], bl
mov byte [ebp + 1], bh
mov eax, dword [esp + 0x2c]
mov dword [ebp + 2], eax
movzx eax, word [esp + 0x30]
mov word [ebp + 6], ax
mov dword [ebp + 8], esi
test byte [esp + 4], 1
je 0x4a107e
push dword [esp + 0xc]
call sub.libc.dll_operator_delete_void_
add esp, 4
test edi, edi
je 0x4a12e0
xor eax, eax
mov esi, 0x11
mov ecx, 0xf
xor edx, edx
nop word cs:[eax + eax]
mov ebx, edi
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789ABCDEF]
mov byte [esp + esi + 3], bl
mov ebx, eax
shld ebx, edi, 0x1c
dec esi
shr edx, 4
cmp ecx, edi
mov edi, 0
sbb edi, eax
mov edi, ebx
mov eax, edx
jb 0x4a10a0
mov ebx, 0x11
sub ebx, esi
cmp ebx, 0xfffffff8
jae 0x4a12fa
cmp ebx, 0xa
ja 0x4a10f1
mov eax, ebx
add al, bl
mov byte [esp + 0x20], al
lea edi, [esp + 0x21]
cmp esi, 0x11
jne 0x4a111c
jmp 0x4a112f
mov ebp, ebx
or ebp, 7
lea eax, [ebp + 1]
push eax
call sub.libc.dll_operator_new_unsigned_int_
add esp, 4
mov edi, eax
mov dword [esp + 0x28], eax
add ebp, 2
mov dword [esp + 0x20], ebp
mov ebp, dword [esp + 0x4c]
mov dword [esp + 0x24], ebx
cmp esi, 0x11
je 0x4a112f
lea eax, [esp + esi]
add eax, 4
push ebx
push eax
push edi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
add edi, ebx
mov byte [edi], 0
lea ecx, [esp + 0x20]
push str.__0x
push 0
call fcn.00504a74
mov ecx, dword [eax + 8]
mov dword [esp + 0x34], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x2c], xmm0
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
lea ecx, [esp + 0x2c]
push 0x5158f5
call fcn.00504a62
mov ecx, dword [eax + 8]
mov dword [esp + 0xc], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 4], xmm0
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
movzx eax, byte [esp + 4]
test al, 1
je 0x4a11a1
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
jmp 0x4a11a7
shr eax, 1
lea edx, [esp + 5]
mov ecx, ebp
push eax
push edx
call fcn.00504a68
test byte [esp + 4], 1
jne 0x4a11e8
test byte [esp + 0x2c], 1
jne 0x4a11fb
test byte [esp + 0x20], 1
je 0x4a11d1
push dword [esp + 0x28]
call sub.libc.dll_operator_delete_void_
add esp, 4
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
movzx eax, byte [esp + 3]
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
push dword [esp + 0xc]
call sub.libc.dll_operator_delete_void_
add esp, 4
test byte [esp + 0x2c], 1
je 0x4a11be
push dword [esp + 0x34]
call sub.libc.dll_operator_delete_void_
add esp, 4
test byte [esp + 0x20], 1
jne 0x4a11c5
jmp 0x4a11d1
shr ecx, 1
mov dword [esp + 0x18], ecx
lea ebx, [ecx + 0xf]
cmp ebx, 0xfffffff8
jae 0x4a1303
cmp ebx, 0xa
ja 0x4a1248
xorps xmm0, xmm0
movsd qword [esp + 4], xmm0
mov dword [esp + 0xc], 0
add bl, bl
mov byte [esp + 4], bl
lea ebp, [esp + 5]
mov ebx, dword [esp + 0x18]
jmp 0x4a1276
mov esi, ebx
or esi, 7
lea eax, [esi + 1]
push eax
call sub.libc.dll_operator_new_unsigned_int_
add esp, 4
mov ebp, eax
add esi, 2
mov dword [esp + 4], esi
mov esi, dword [esp + 0x50]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x4a128c
test byte [esi], 1
je 0x4a1280
mov esi, dword [esi + 8]
jmp 0x4a1281
inc esi
push ebx
push esi
push ebp
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
add esp, 0xc
mov dword [ebp + ebx + 0xb], 0x726f7272
mov dword [ebp + ebx + 8], 0x7265206e
mov dword [ebp + ebx + 4], 0x776f6e6b
mov dword [ebp + ebx], 0x6e55203a
mov byte [ebp + ebx + 0xf], 0
mov ebp, dword [esp + 0x4c]
test byte [ebp], 1
je 0x4a12c6
push dword [ebp + 8]
call sub.libc.dll_operator_delete_void_
add esp, 4
mov eax, dword [esp + 0xc]
mov dword [ebp + 8], eax
movsd xmm0, qword [esp + 4]
movsd qword [ebp], xmm0
test edi, edi
jne 0x4a1086
mov byte [esp + 0x14], 0x30
mov esi, 0x10
mov ebx, 0x11
sub ebx, esi
cmp ebx, 0xfffffff8
jb 0x4a10d9
lea ecx, [esp + 0x20]
call fcn.00401af0
lea ecx, [esp + 4]
call fcn.00401af0
int3