Function at 0x1004a7f6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
adc eax, esi
inc esp
or eax, 0x1ba63c0
add byte [eax], al
add byte [ebx - 0x3e], ch
adc al, dh
inc esp
add eax, 0x1b969c0
add byte [eax], al
add byte [ebx - 0x2f], ch
daa
mov byte [ebp + edx - 0x40], 0x6c
mov eax, 1
imul ecx, eax, 0x1b
mov byte [ebp + ecx - 0x40], 0x2d
mov edx, 1
imul eax, edx, 0x2f
mov dword [ebp - 0x5ec], eax
cmp dword [ebp - 0x5ec], 0x30
jae 0x1004a83c
jmp 0x1004a841
call 0x10072a07
mov ecx, dword [ebp - 0x5ec]
mov byte [ebp + ecx - 0x40], 0
mov edx, 1
imul eax, edx, 0x26
mov byte [ebp + eax - 0x40], 0x72
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x40], 0x2d
mov eax, 1
imul ecx, eax, 0x2e
mov byte [ebp + ecx - 0x40], 0x64
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x40], 0x43
mov ecx, 1
shl ecx, 4
mov byte [ebp + ecx - 0x40], 0x70
mov edx, 1
imul eax, edx, 0x22
mov byte [ebp + eax - 0x40], 0x72
mov ecx, 1
imul edx, ecx, 0xc
mov byte [ebp + edx - 0x40], 0x3a
mov eax, 1
imul ecx, eax, 0x19
mov byte [ebp + ecx - 0x40], 0x2f
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x40], 0x70
mov ecx, 1
imul edx, ecx, 0xf
mov byte [ebp + edx - 0x40], 0x70
mov eax, 1
imul ecx, eax, 0x16
mov byte [ebp + ecx - 0x40], 0x69
mov edx, 1
imul eax, edx, 0x25
mov byte [ebp + eax - 0x40], 0x75
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x5bc]
call fcn.1004fa57
mov ecx, dword [ebp + 0x14]
call fcn.1004f61f
push eax
mov ecx, dword [ebp + 0x14]
call fcn.1004f648
push eax
lea ecx, [ebp - 0x5bc]
call fcn.1004f634
push eax
lea ecx, [ebp - 0x5bc]
call fcn.1004f660
push eax
mov edx, dword [ebp - 0x5d4]
push edx
call dword [sym.imp.WININET.dll_HttpSendRequestA]
mov dword [ebp - 0x5e4], eax
lea ecx, [ebp - 0x5bc]
call fcn.1004f95f
jmp 0x1004a968
cmp dword [ebp - 0x5e4], 0
je 0x1004ac16
movzx ecx, byte [ebp + 0x18]
test ecx, ecx
je 0x1004ab10
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x554], 4
mov dword [ebp - 0x608], 0
lea edx, [ebp - 0x554]
push edx
lea eax, [ebp - 0x5c0]
push eax
push 0x69
mov ecx, dword [ebp - 0x5d4]
push ecx
call dword [sym.imp.WININET.dll_InternetQueryOptionA]
test eax, eax
je 0x1004ab10
mov dword [ebp - 0x5e0], 0
mov edx, dword [ebp - 0x5c0]
cmp dword [edx + 0x10], 0
je 0x1004ab03
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 0x5c0]
mov eax, dword [edx + 0x10]
mov ecx, dword [ecx + eax]
mov dword [ebp - 0x5e0], ecx
mov edx, dword [ebp - 0x5e0]
cmp dword [edx + 0xc], 0
jbe 0x1004ab03
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 0x5e0]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + ecx]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x5d8], edx
cmp dword [ebp - 0x5d8], 0
je 0x1004ab03
mov byte [ebp - 0x5c6], 0
push 0x1006d16f
mov ecx, dword [ebp - 0x5cc]
add ecx, 0x43c
call 0x10065bef
mov eax, dword [ebp - 0x5d8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 4]
sub edx, 1
mov dword [ebp - 0x5dc], edx
jmp 0x1004aa75
mov eax, dword [ebp - 0x5dc]
sub eax, 1
mov dword [ebp - 0x5dc], eax
cmp dword [ebp - 0x5dc], 0
jl 0x1004aad1
mov ecx, dword [ebp - 0x5d8]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 8]
mov ecx, dword [ebp - 0x5dc]
mov dl, byte [eax + ecx]
mov byte [ebp - 0x5c6], dl
movzx eax, byte [ebp - 0x5c6]
push eax
push str._.2x
push 3
lea ecx, [ebp - 0x550]
push ecx
call fcn.1004b1a4
add esp, 0x10
lea edx, [ebp - 0x550]
push edx
mov ecx, dword [ebp - 0x5cc]
add ecx, 0x43c
call fcn.1004f95f
jmp 0x1004aa66
mov dword [ebp - 0x5fc], 0x400
mov eax, dword [ebp - 0x5fc]
push eax
mov ecx, dword [ebp - 0x5cc]
add ecx, 0x39
push ecx
push 3
mov edx, dword [ebp - 0x5d8]
mov eax, dword [edx + 0xc]
add eax, 0x18
push eax
push 1
call dword [sym.imp.CRYPT32.dll_CertNameToStrA]
mov ecx, dword [ebp - 0x5c0]
push ecx
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateChain]
mov dword [ebp - 0x55c], 0x100
push 0
lea edx, [ebp - 0x55c]
push edx
lea eax, [ebp - 0x140]
push eax
push 0x13
mov ecx, dword [ebp - 0x5d4]
push ecx
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x1004ab71
lea edx, [ebp - 0x140]
push edx
call 0x1007ef98
add esp, 4
mov dword [ebp - 0x5e8], eax
cmp dword [ebp - 0x5e8], 0xc8
jge 0x1004ab6a
cmp dword [ebp - 0x5e8], 0x12c
jge 0x1004ab71
mov byte [ebp - 0x5c5], 1
lea ecx, [ebp - 0x5a4]
call fcn.1004fdbc
mov byte [ebp - 4], 2
mov dword [ebp - 0x548], 0
lea eax, [ebp - 0x548]
push eax
push 0x400
lea ecx, [ebp - 0x544]
push ecx
mov edx, dword [ebp - 0x5d4]
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1004abf8
cmp dword [ebp - 0x548], 0
je 0x1004abf8
mov eax, dword [ebp - 0x548]
mov dword [ebp - 0x5f4], eax
cmp dword [ebp - 0x5f4], 0x401
jae 0x1004abd1
jmp 0x1004abd6
call 0x10072d9c
mov ecx, dword [ebp - 0x5f4]
mov byte [ebp + ecx - 0x544], 0
lea edx, [ebp - 0x544]
push edx
lea ecx, [ebp - 0x5a4]
call 0x10065d76
jmp 0x1004ab8a
lea eax, [ebp - 0x5a4]
push eax
mov ecx, dword [ebp + 0xc]
call 0x1004fbb7
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5a4]
call fcn.1004fc36
mov ecx, dword [ebp - 0x5d4]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 0x5cc]
call 0x10094e3e
mov dl, byte [ebp - 0x5c5]
mov byte [ebp - 0x5cd], dl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58c]
call fcn.1004fc69
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x574]
call fcn.1004fc7b
mov al, byte [ebp - 0x5cd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call 0x10072737
invalid