Function at 0x47df40
Capabilities:
Check for software breakpoints
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f9873
mov eax, dword fs:[0]
push eax
sub esp, 0xaf4
mov eax, dword [0x66d4f4]
xor eax, ebp
mov dword [ebp - 0x234], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xab0], ecx
cmp dword [ebp + 8], 0
je 0x47df88
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x47e097
cmp dword [0x674020], 5
jge 0x47e090
mov edx, dword [0x674020]
add edx, 1
mov dword [0x674020], edx
push 1
push 2
lea ecx, [ebp - 0x94]
call fcn.0040a750
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
push 0x30
lea ecx, [ebp - 0x92d]
push ecx
call fcn.0048a550
add esp, 8
push eax
push 8
lea edx, [ebp - 0x938]
push edx
call fcn.005da062
add esp, 8
push eax
push 0x41f5f0
push 0x62a3d0
lea eax, [ebp - 0x94]
push eax
call fcn.00409270
add esp, 8
mov ecx, eax
call fcn.0041ea10
push eax
call fcn.0048a510
add esp, 8
push eax
call fcn.0048a570
add esp, 8
mov ecx, eax
call fcn.00419990
lea ecx, [ebp - 0x954]
push ecx
lea ecx, [ebp - 0x94]
call fcn.00408c00
mov dword [ebp - 0xab4], eax
mov edx, dword [ebp - 0xab4]
mov dword [ebp - 0xab8], edx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0xab8]
call fcn.0040b520
push eax
push 0x62a3e4
push 0x7e5
push 0x62a404
push 0xf0000000
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x954]
call fcn.0040b640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.004094e0
xor eax, eax
jmp 0x47eb50
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x47e161
push 1
push 2
lea ecx, [ebp - 0x114]
call fcn.0040a750
mov dword [ebp - 4], 2
mov ecx, dword [ebp + 8]
push ecx
push 0x62a418
lea edx, [ebp - 0x114]
push edx
call fcn.00409270
add esp, 8
push eax
call fcn.00409270
add esp, 8
lea eax, [ebp - 0x970]
push eax
lea ecx, [ebp - 0x114]
call fcn.00408c00
mov dword [ebp - 0xabc], eax
mov ecx, dword [ebp - 0xabc]
mov dword [ebp - 0xac0], ecx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0xac0]
call fcn.0040b520
push eax
push 0x62a42c
push 0x804
push 0x62a44c
push 0xf0000000
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x970]
call fcn.0040b640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x114]
call fcn.004094e0
xor eax, eax
jmp 0x47eb50
cmp dword [ebp + 0x10], 0
je 0x47e171
mov edx, dword [ebp + 0x10]
movsx eax, byte [edx]
test eax, eax
jne 0x47e178
mov dword [ebp + 0x10], 0x6181bb
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0xab0]
add ecx, 0xcc
push ecx
lea ecx, [ebp - 0x118]
call fcn.0040b5a0
mov dword [ebp - 4], 4
lea edx, [ebp - 0x120]
push edx
mov ecx, dword [ebp - 0xab0]
add ecx, 0x68
call fcn.0045bcc0
jmp 0x47e1c9
push 0
lea eax, [ebp - 0x978]
push eax
lea ecx, [ebp - 0x120]
call fcn.00483600
lea ecx, [ebp - 0x980]
push ecx
mov ecx, dword [ebp - 0xab0]
add ecx, 0x68
call fcn.0042fb90
push eax
lea ecx, [ebp - 0x120]
call fcn.004a2c30
movzx edx, al
test edx, edx
je 0x47e2de
lea ecx, [ebp - 0x120]
call fcn.004835e0
mov eax, dword [eax]
cmp eax, dword [ebp - 0x14]
jne 0x47e2d9
lea ecx, [ebp - 0x120]
call fcn.004835e0
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
jne 0x47e2d7
push 1
push 2
lea ecx, [ebp - 0x1a4]
call fcn.0040a750
mov byte [ebp - 4], 5
push str.:_QueryFromUpper
mov edx, dword [ebp + 8]
push edx
push 0x62a47c
lea eax, [ebp - 0x1a4]
push eax
call fcn.00409270
add esp, 8
push eax
call fcn.00409270
add esp, 8
push eax
call fcn.00409270
add esp, 8
lea ecx, [ebp - 0x99c]
push ecx
lea ecx, [ebp - 0x1a4]
call fcn.00408c00
mov dword [ebp - 0xac4], eax
mov edx, dword [ebp - 0xac4]
mov dword [ebp - 0xac8], edx
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0xac8]
call fcn.0040b520
push eax
push 0x62a484
push 0x819
push 0x62a4a4
push 0x12
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x99c]
call fcn.0040b640
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1a4]
call fcn.004094e0
jmp 0x47e2de
jmp 0x47e1b5
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x118]
call fcn.0040b580
cmp dword [ebp - 0x10], 0
je 0x47ea3c
mov dword [ebp - 0x1a8], 0
push 1
push 2
lea ecx, [ebp - 0x22c]
call fcn.0040a750
mov dword [ebp - 4], 7
mov eax, dword [ebp + 0x10]
push eax
push 0x62a4b8
mov ecx, dword [ebp + 0xc]
push ecx
push 0x30
lea edx, [ebp - 0x99d]
push edx
call fcn.0048a550
add esp, 8
push eax
push 8
lea eax, [ebp - 0x9a8]
push eax
call fcn.005da062
add esp, 8
push eax
push 0x41f5f0
push 0x62a4c4
mov ecx, dword [ebp + 8]
push ecx
push 0x62a4d0
lea edx, [ebp - 0x22c]
push edx
call fcn.00409270
add esp, 8
push eax
call fcn.00409270
add esp, 8
push eax
call fcn.00409270
add esp, 8
mov ecx, eax
call fcn.0041ea10
push eax
call fcn.0048a510
add esp, 8
push eax
call fcn.0048a570
add esp, 8
mov ecx, eax
call fcn.00419990
push eax
call fcn.00409270
add esp, 8
push eax
call fcn.00409270
add esp, 8
lea eax, [ebp - 0x9c4]
push eax
lea ecx, [ebp - 0x22c]
call fcn.00408c00
mov dword [ebp - 0xacc], eax
mov ecx, dword [ebp - 0xacc]
mov dword [ebp - 0xad0], ecx
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0xad0]
call fcn.0040b520
push eax
push 0x62a4dc
push 0x823
push 0x62a4fc
push 0x12
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x9c4]
call fcn.0040b640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.004094e0
push 0x400
push 0xcc
lea edx, [ebp - 0x634]
push edx
call fcn.005c0cf0
add esp, 0xc
mov dword [ebp - 0x230], 0
cmp dword [ebp + 0xc], 0x50001010
jne 0x47e680
push str.keyIASensData
mov eax, dword [ebp + 0x10]
push eax
call fcn.005065f0
add esp, 8
test eax, eax
je 0x47e680
lea ecx, [ebp - 0x644]
call fcn.00419780
mov dword [ebp - 4], 9
mov ecx, dword [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x9e0]
call fcn.0040b540
mov byte [ebp - 4], 0xa
push 0x62a520
lea edx, [ebp - 0x9e0]
push edx
lea ecx, [ebp - 0x644]
call fcn.00511c20
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x9e0]
call fcn.0040b640
push 0x62a524
lea ecx, [ebp - 0x700]
call fcn.0040b540
mov byte [ebp - 4], 0xb
push 0x62a530
lea ecx, [ebp - 0x71c]
call fcn.0040b540
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x700]
push eax
lea ecx, [ebp - 0x644]
call fcn.005104f0
lea ecx, [ebp - 0x71c]
push ecx
lea ecx, [ebp - 0x644]
call fcn.005104f0
lea ecx, [ebp - 0x700]
call fcn.0040b520
push eax
call fcn.005bde36
add esp, 4
mov dword [ebp - 0x720], eax
push 0
lea ecx, [ebp - 0x71c]
call fcn.0040b520
push eax
mov edx, dword [ebp - 0x720]
push edx
lea eax, [ebp - 0x660]
push eax
call fcn.0045f5a0
add esp, 0x10
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x660]
push ecx
lea edx, [ebp - 0x9fc]
push edx
lea ecx, [ebp - 0x661]
call fcn.00537c40
mov dword [ebp - 0xad4], eax
mov eax, dword [ebp - 0xad4]
mov dword [ebp - 0xad8], eax
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0xad8]
push ecx
lea ecx, [ebp - 0x660]
call fcn.0040b620
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x9fc]
call fcn.0040b640
push 1
push 2
lea ecx, [ebp - 0x6e4]
call fcn.0040a750
mov byte [ebp - 4], 0xf
lea edx, [ebp - 0x660]
push edx
push str.__extInfo
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x6e4]
push ecx
call fcn.00409270
add esp, 8
push eax
call fcn.00409270
add esp, 8
push eax
call fcn.00408950
add esp, 8
lea edx, [ebp - 0xa18]
push edx
lea ecx, [ebp - 0x6e4]
call fcn.00408c00
mov dword [ebp - 0xadc], eax
mov eax, dword [ebp - 0xadc]
mov dword [ebp - 0xae0], eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x230]
push ecx
mov ecx, dword [ebp - 0xae0]
call fcn.0040b520
push eax
mov edx, dword [ebp + 0xc]
push edx
call dword [ebp - 0x10]
mov dword [ebp - 0x1a8], eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xa18]
call fcn.0040b640
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x6e4]
call fcn.004094e0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x660]
call fcn.0040b640
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x71c]
call fcn.0040b640
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x700]
call fcn.0040b640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x644]
call fcn.004197e0
jmp 0x47e698
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [ebp - 0x10]
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0
je 0x47e6be
cmp dword [ebp - 0x230], 0
je 0x47e6b9
mov eax, dword [ebp - 0x230]
push eax
mov ecx, dword [ebp + 0x14]
call fcn.0040b4d0
jmp 0x47e7fb
cmp dword [ebp - 0x230], 0
je 0x47e7fb
push 1
push 2
lea ecx, [ebp - 0x7a4]
call fcn.0040a750
mov dword [ebp - 4], 0x11
push 0x62a548
mov ecx, dword [ebp + 0x10]
push ecx
push 0x62a554
mov edx, dword [ebp + 0xc]
push edx
push 0x30
lea eax, [ebp - 0xa19]
push eax
call fcn.0048a550
add esp, 8
push eax
push 8
lea ecx, [ebp - 0xa24]
push ecx
call fcn.005da062
add esp, 8
push eax
push 0x41f5f0
push 0x62a558
mov edx, dword [ebp + 8]
push edx
push 0x62a564
lea eax, [ebp - 0x7a4]
push eax
call fcn.00409270
add esp, 8
push eax
call fcn.00409270
add esp, 8
push eax
call fcn.00409270
add esp, 8
mov ecx, eax
call fcn.0041ea10
push eax
call fcn.0048a510
add esp, 8
push eax
call fcn.0048a570
add esp, 8
mov ecx, eax
call fcn.00419990
push eax
call fcn.00409270
add esp, 8
push eax
call fcn.00409270
add esp, 8
push eax
call fcn.00409270
add esp, 8
lea ecx, [ebp - 0xa40]
push ecx
lea ecx, [ebp - 0x7a4]
call fcn.00408c00
mov dword [ebp - 0xae4], eax
mov edx, dword [ebp - 0xae4]
mov dword [ebp - 0xae8], edx
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0xae8]
call fcn.0040b520
push eax
push 0x62a56c
push 0x850
push 0x62a58c
push 0xf0000000
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xa40]
call fcn.0040b640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7a4]
call fcn.004094e0
cmp dword [ebp - 0x230], 0
je 0x47e810
mov eax, dword [ebp - 0x230]
push eax
call fcn.0045f1d0
mov dword [ebp - 0x7a8], 0
jmp 0x47e82b
mov ecx, dword [ebp - 0x7a8]
add ecx, 1
mov dword [ebp - 0x7a8], ecx
cmp dword [ebp - 0x7a8], 0x400
jae 0x47e8f8
mov edx, dword [ebp - 0x7a8]
movzx eax, byte [ebp + edx - 0x634]
cmp eax, 0xcc
je 0x47e8f3
push 1
push 2
lea ecx, [ebp - 0x82c]
call fcn.0040a750
mov dword [ebp - 4], 0x13
push 0x62a5a0
lea ecx, [ebp - 0x82c]
push ecx
call fcn.00409270
add esp, 8
lea edx, [ebp - 0xa5c]
push edx
lea ecx, [ebp - 0x82c]
call fcn.00408c00
mov dword [ebp - 0xaec], eax
mov eax, dword [ebp - 0xaec]
mov dword [ebp - 0xaf0], eax
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0xaf0]
call fcn.0040b520
push eax
push 0x62a5ac
push 0x859
push 0x62a5cc
push 0xf0000000
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xa5c]
call fcn.0040b640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x82c]
call fcn.004094e0
jmp 0x47e81c
cmp dword [ebp - 0x1a8], 0
je 0x47ea3c
push 1
push 2
lea ecx, [ebp - 0x8ac]
call fcn.0040a750
mov dword [ebp - 4], 0x15
push 0x62a5e0
mov ecx, dword [ebp + 0x10]
push ecx
push 0x62a5f4
mov edx, dword [ebp + 0xc]
push edx
push 0x30
lea eax, [ebp - 0xa5d]
push eax
call fcn.0048a550
add esp, 8
push eax
push 8
lea ecx, [ebp - 0xa68]
push ecx
call fcn.005da062
add esp, 8
push eax
push 0x41f5f0
push 0x62a600
mov edx, dword [ebp + 8]
push edx
push 0x62a60c
lea eax, [ebp - 0x8ac]
push eax
call fcn.00409270
add esp, 8
push eax
call fcn.00409270
add esp, 8
push eax
call fcn.00409270
add esp, 8
mov ecx, eax
call fcn.0041ea10
push eax
call fcn.0048a510
add esp, 8
push eax
call fcn.0048a570
add esp, 8
mov ecx, eax
call fcn.00419990
push eax
call fcn.00409270
add esp, 8
push eax
call fcn.00409270
add esp, 8
push eax
call fcn.00409270
add esp, 8
lea ecx, [ebp - 0xa84]
push ecx
lea ecx, [ebp - 0x8ac]
call fcn.00408c00
mov dword [ebp - 0xaf4], eax
mov edx, dword [ebp - 0xaf4]
mov dword [ebp - 0xaf8], edx
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0xaf8]
call fcn.0040b520
push eax
push 0x62a614
push 0x85e
push 0x62a634
push 0x12
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xa84]
call fcn.0040b640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8ac]
call fcn.004094e0
mov eax, 1
jmp 0x47eb50
push 1
push 2
lea ecx, [ebp - 0x92c]
call fcn.0040a750
mov dword [ebp - 4], 0x17
push 0x62a648
mov eax, dword [ebp + 0x10]
push eax
push str._Query:
mov ecx, dword [ebp + 0xc]
push ecx
push 0x30
lea edx, [ebp - 0xa85]
push edx
call fcn.0048a550
add esp, 8
push eax
push 8
lea eax, [ebp - 0xa90]
push eax
call fcn.005da062
add esp, 8
push eax
push 0x41f5f0
push 0x62a668
lea ecx, [ebp - 0x92c]
push ecx
call fcn.00409270
add esp, 8
mov ecx, eax
call fcn.0041ea10
push eax
call fcn.0048a510
add esp, 8
push eax
call fcn.0048a570
add esp, 8
mov ecx, eax
call fcn.00419990
push eax
call fcn.00409270
add esp, 8
push eax
call fcn.00409270
add esp, 8
push eax
call fcn.00409270
add esp, 8
lea edx, [ebp - 0xaac]
push edx
lea ecx, [ebp - 0x92c]
call fcn.00408c00
mov dword [ebp - 0xafc], eax
mov eax, dword [ebp - 0xafc]
mov dword [ebp - 0xb00], eax
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0xb00]
call fcn.0040b520
push eax
push str.CPolicyManager::QueryFromUpper
push 0x862
push 0x62a698
push 0x12
call fcn.00408f70
mov ecx, eax
call fcn.00512650
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xaac]
call fcn.0040b640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x92c]
call fcn.004094e0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x234]
xor ecx, ebp
call fcn.005bd2d7
mov esp, ebp
pop ebp
ret 0x10