Function at 0x40a846
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x494d07
call fcn.0048642c
sub esp, 0x98
push esi
push edi
push 0
lea ecx, [ebp - 0xa4]
call fcn.0047e1ca
and dword [ebp - 4], 0
lea ecx, [ebp - 0xa4]
call fcn.0047e255
mov eax, dword [0x4bb1a0]
mov dword [ebp - 0x10], eax
mov edi, dword [0x4a23e0]
mov esi, 0x4bb67c
mov eax, esi
mov byte [ebp - 4], 1
test eax, eax
jne 0x40a895
xor eax, eax
jmp 0x40a898
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.00403d53
mov esi, 0x4bb294
mov eax, esi
test eax, eax
je 0x40a8b0
push esi
call edi
push ebx
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.00403d53
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0xa4]
push eax
call fcn.0047e563
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
push eax
mov byte [ebp - 4], 2
push dword [eax - 8]
call fcn.00403d53
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004015f7
mov ebx, 0x4cb3a8
push ebx
call fcn.00486a45
test eax, eax
pop ecx
jbe 0x40a91e
mov eax, esi
test eax, eax
je 0x40a901
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.00403d53
mov eax, ebx
test eax, eax
je 0x40a914
push ebx
call edi
push ebx
push eax
lea ecx, [ebp - 0x10]
call fcn.00403d53
lea ecx, [ebp - 0x24]
call fcn.0047d35f
mov esi, 0x4bb434
mov eax, esi
test eax, eax
je 0x40a934
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.00403d53
lea eax, [ebp - 0x14]
push eax
call fcn.0047d3d1
pop ecx
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
push eax
mov byte [ebp - 4], 3
push dword [eax - 8]
call fcn.00403d53
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004015f7
call fcn.00411ef4
mov esi, 0x4bbf98
mov ebx, eax
mov eax, esi
test eax, eax
je 0x40a97b
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.00403d53
mov esi, str.Admin_privelegies:
mov eax, esi
test eax, eax
je 0x40a993
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.00403d53
test ebx, ebx
pop ebx
mov esi, 0x4bbf68
jne 0x40a9ac
mov esi, 0x4bbf60
test esi, esi
jne 0x40a9b4
xor eax, eax
jmp 0x40a9b7
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.00403d53
mov esi, str.__command_line_
mov eax, esi
test eax, eax
je 0x40a9cf
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.00403d53
cmp dword [ebp + 8], 0
jne 0x40a9e3
xor eax, eax
jmp 0x40a9e8
push dword [ebp + 8]
call edi
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
push eax
call fcn.00403d53
mov esi, 0x4bb430
mov eax, esi
test eax, eax
je 0x40aa02
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.00403d53
push 1
push dword [ebp - 0x10]
call fcn.0040aef8
pop ecx
pop ecx
lea ecx, [ebp - 0x10]
call fcn.00403b80
lea eax, [ebp - 0x20]
push eax
call fcn.0040a741
pop ecx
push eax
lea eax, [ebp - 0x14]
push str.The_Log_File:__
push eax
mov byte [ebp - 4], 4
call fcn.00403cef
push esi
push eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 5
push eax
call fcn.00403c8b
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.004016bd
lea ecx, [ebp + 8]
mov byte [ebp - 4], 5
call fcn.004015f7
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.004015f7
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.004015f7
lea eax, [ebp - 0x1c]
push eax
call fcn.0041d0c2
mov edi, eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 7
mov dword [esp], 0x4bb42c
call fcn.00401623
push str.DesktopName:__
push eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 8
push eax
call fcn.00403c8b
push edi
push eax
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 9
push eax
call fcn.00403bde
push esi
push eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 0xa
push eax
call fcn.00403c8b
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
push eax
mov byte [ebp - 4], 0xb
push dword [eax - 8]
call fcn.00403d53
mov byte [ebp - 4], 0xa
lea ecx, [ebp + 8]
call fcn.004015f7
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 9
call fcn.004015f7
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 8
call fcn.004015f7
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 7
call fcn.004015f7
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.004015f7
call dword [0x4a2354]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00416732
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x1c]
push str.__PID:__
push eax
mov byte [ebp - 4], 0xc
call fcn.00403cef
push esi
push eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 0xd
push eax
call fcn.00403c8b
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xe
call fcn.00403dcf
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0xd
call fcn.004015f7
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xc
call fcn.004015f7
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.004015f7
push 1
push dword [ebp - 0x10]
call fcn.0040aef8
and byte [ebp - 4], 0
pop ecx
pop ecx
lea ecx, [ebp - 0x10]
call fcn.004015f7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa4]
call fcn.0047e0a9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret