Function at 0x47218d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x1ac
mov eax, 0x532163
call fcn.004fc737
xor ebx, ebx
push ebx
push ebx
lea eax, [ebp - 0x1a8]
call fcn.004b6cbe
sub esp, 0x18
mov dword [ebp - 4], 2
mov esi, esp
mov dword [ebp - 0x16c], esp
push 1
call fcn.004b5ad3
push str.version
lea eax, [ebp - 0x1a8]
push eax
mov byte [ebp - 4], 3
call fcn.004b6ff4
mov edi, eax
mov byte [ebp - 4], 2
call fcn.004b5dcd
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x16c], esp
push 4
call fcn.004b5ad3
push 0x549a5c
lea eax, [ebp - 0x1a8]
push eax
mov byte [ebp - 4], 4
call fcn.004b6ff4
mov edi, eax
mov byte [ebp - 4], 2
call fcn.004b5dcd
lea ecx, [ebp - 0x2c]
call fcn.0045059a
sub esp, 0x18
mov byte [ebp - 4], 5
mov edx, eax
mov esi, esp
mov dword [ebp - 0x16c], esp
call fcn.004b5b80
push str.device_id
lea eax, [ebp - 0x1a8]
push eax
mov byte [ebp - 4], 6
call fcn.004b6ff4
mov edi, eax
mov byte [ebp - 4], 5
call fcn.004b5dcd
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.004051a5
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x164], eax
push ebx
mov byte [ebp - 4], 7
call fcn.004f5c9c
pop ecx
push edx
push eax
push str._I64u
lea eax, [ebp - 0x164]
call fcn.0042ee4a
sub esp, 0xc
mov esi, esp
mov dword [ebp - 0x16c], esp
push dword [ebp - 0x164]
call fcn.004b5b54
mov byte [ebp - 4], 8
push str.time_stamp
lea eax, [ebp - 0x1a8]
push eax
call fcn.004b6ff4
mov edi, eax
mov byte [ebp - 4], 7
call fcn.004b5dcd
test byte [ebp + 8], 1
je 0x472347
push ebx
push str.Q360SafeMonClass
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, ebx
je 0x47233b
push ebx
push ebx
lea eax, [ebp - 0x188]
call fcn.004b6cbe
push ebx
push dword [ebp + 0xc]
mov ecx, eax
mov byte [ebp - 4], 0xb
call fcn.0047134a
pop ecx
pop ecx
cmp al, 1
jne 0x472326
lea eax, [ebp - 0x188]
push eax
push ecx
push str.ts_data
lea eax, [ebp - 0x1a8]
push eax
call fcn.004b6ff4
pop ecx
push eax
call fcn.004b703f
jmp 0x47232a
and dword [ebp + 8], 0xfffffffe
lea esi, [ebp - 0x188]
mov byte [ebp - 4], 7
call fcn.004b5d4a
jmp 0x472347
mov eax, dword [ebp + 8]
and eax, 0xfffffffe
or eax, 4
mov dword [ebp + 8], eax
test byte [ebp + 8], 4
je 0x4723a8
push ebx
push ebx
lea eax, [ebp - 0x188]
call fcn.004b6cbe
push 1
push dword [ebp + 0xc]
mov ecx, eax
mov byte [ebp - 4], 0xe
call fcn.0047134a
pop ecx
pop ecx
mov edi, str.ts_data
cmp al, 1
jne 0x472393
lea eax, [ebp - 0x188]
push eax
push ecx
push edi
lea eax, [ebp - 0x1a8]
push eax
call fcn.004b6ff4
pop ecx
push eax
call fcn.004b703f
jmp 0x472397
and dword [ebp + 8], 0xfffffffb
lea esi, [ebp - 0x188]
mov byte [ebp - 4], 7
call fcn.004b5d4a
jmp 0x4723ad
mov edi, str.ts_data
test byte [ebp + 8], 2
je 0x472400
push ebx
push ebx
lea eax, [ebp - 0x188]
call fcn.004b6cbe
push eax
mov byte [ebp - 4], 0x11
call fcn.004719d6
pop ecx
cmp al, 1
jne 0x4723ed
lea eax, [ebp - 0x188]
push eax
push ecx
push edi
lea eax, [ebp - 0x1a8]
push eax
call fcn.004b6ff4
pop ecx
push eax
call fcn.004b703f
jmp 0x4723f1
and dword [ebp + 8], 0xfffffffd
lea esi, [ebp - 0x188]
mov byte [ebp - 4], 7
call fcn.004b5d4a
test byte [ebp + 8], 8
je 0x472453
push ebx
push ebx
lea eax, [ebp - 0x188]
call fcn.004b6cbe
push eax
mov byte [ebp - 4], 0x14
call fcn.00471d84
pop ecx
cmp al, 1
jne 0x472440
lea eax, [ebp - 0x188]
push eax
push ecx
push edi
lea eax, [ebp - 0x1a8]
push eax
call fcn.004b6ff4
pop ecx
push eax
call fcn.004b703f
jmp 0x472444
and dword [ebp + 8], 0xfffffff7
lea esi, [ebp - 0x188]
mov byte [ebp - 4], 7
call fcn.004b5d4a
test byte [ebp + 8], 0x10
je 0x4724a6
push ebx
push ebx
lea eax, [ebp - 0x188]
call fcn.004b6cbe
push eax
mov byte [ebp - 4], 0x17
call fcn.00471e72
pop ecx
cmp al, 1
jne 0x472493
lea eax, [ebp - 0x188]
push eax
push ecx
push edi
lea eax, [ebp - 0x1a8]
push eax
call fcn.004b6ff4
pop ecx
push eax
call fcn.004b703f
jmp 0x472497
and dword [ebp + 8], 0xffffffef
lea esi, [ebp - 0x188]
mov byte [ebp - 4], 7
call fcn.004b5d4a
lea edi, [ebp - 0xbc]
call fcn.004b92b3
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x74]
push eax
mov ecx, edi
mov byte [ebp - 4], 0x18
call fcn.004b92d1
cmp dword [ebp - 0x60], ebx
jne 0x472507
push ebx
push 1
lea ecx, [ebp - 0x74]
call fcn.004051a5
lea esi, [ebp - 0xbc]
call fcn.004361ad
mov eax, dword [ebp - 0x164]
add eax, 0xfffffff0
call fcn.00405521
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x1a8]
call fcn.004b5d4a
xor eax, eax
call fcn.004fc7ba
ret
mov byte [ebp - 0x30], 0xd7
mov byte [ebp - 0x2f], 0x58
mov byte [ebp - 0x2e], 0x2f
mov byte [ebp - 0x2d], 0xee
mov byte [ebp - 0x2c], 0x26
mov byte [ebp - 0x2b], 0x17
mov byte [ebp - 0x2a], 0xb4
mov byte [ebp - 0x29], 0x1e
mov byte [ebp - 0x28], 0xe6
mov byte [ebp - 0x27], 0x8f
mov byte [ebp - 0x26], 0x3c
mov byte [ebp - 0x25], 0xb0
mov byte [ebp - 0x24], 0xc8
mov byte [ebp - 0x23], 0x31
mov byte [ebp - 0x22], 6
mov byte [ebp - 0x21], 0xd3
mov byte [ebp - 0x20], 0x2a
mov byte [ebp - 0x1f], 0xd1
mov byte [ebp - 0x1e], 0x83
mov byte [ebp - 0x1d], 0xfc
mov byte [ebp - 0x1c], 0xc9
mov byte [ebp - 0x1b], 0x43
mov byte [ebp - 0x1a], 0xa6
mov byte [ebp - 0x19], 0xf1
mov byte [ebp - 0x18], 0x31
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x16], 0x81
mov byte [ebp - 0x15], 0x70
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x7c
mov byte [ebp - 0x12], 0xee
mov byte [ebp - 0x11], 0x7f
call fcn.004c3c20
mov esi, eax
lea edx, [ebp - 0x30]
mov dword [ebp - 0x170], esi
call fcn.004c3c50
test al, al
je 0x4724cc
mov dword [ebp - 0x1b8], ebx
mov dword [ebp - 0x1b4], ebx
mov dword [ebp - 0x1b0], ebx
mov byte [ebp - 0x1ac], bl
lea eax, [ebp - 0x1b8]
mov byte [ebp - 4], 0x1a
call fcn.00470b22
test al, al
jne 0x472623
cmp esi, ebx
je 0x4725da
push esi
call fcn.004f29a6
pop ecx
lea edi, [ebp - 0x1b8]
mov byte [ebp - 4], 0x19
call fcn.00470bc5
push ebx
push 1
lea ecx, [ebp - 0x74]
call fcn.004051a5
lea esi, [ebp - 0xbc]
call fcn.004361ad
mov eax, dword [ebp - 0x164]
add eax, 0xfffffff0
call fcn.00405521
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x1a8]
call fcn.004b5d4a
mov eax, ebx
jmp 0x472501
xor eax, eax
lea edi, [ebp - 0x3b]
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x60]
mov eax, dword [0x590e04]
sub edi, 0xffffff80
mov dword [ebp - 0x15c], edi
mov ecx, 0x590e04
mov byte [ebp - 0x3c], 0x33
mov byte [ebp - 0x3b], 0x6d
mov byte [ebp - 0x3a], 0x74
mov byte [ebp - 0x39], 0x72
add edi, 0xc
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x168], eax
push edi
lea esi, [ebp - 0x168]
mov byte [ebp - 4], 0x1b
call fcn.0041adfb
mov ecx, dword [ebp - 0x168]
mov dword [ecx - 0xc], edi
mov dword [ebp - 0x18c], eax
mov byte [ecx + edi], bl
cmp eax, ebx
je 0x4726e9
cmp dword [ebp - 0x5c], 0x10
mov ecx, dword [ebp - 0x70]
jae 0x472699
lea ecx, [ebp - 0x70]
mov esi, dword [ebp - 0x170]
add eax, 0xc
push eax
push dword [ebp - 0x60]
lea edi, [ebp - 0x15c]
push ecx
call fcn.004c3ca0
mov esi, dword [ebp - 0x15c]
add esp, 0xc
push esi
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0x36], eax
push 0xc
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x18c]
call fcn.004f4830
lea edi, [esi + 0xc]
add esp, 0xc
mov eax, edi
lea esi, [ebp - 0x168]
call fcn.0041ae23
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x90]
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
call fcn.00404eb3
push str.http:__metro.ts.360safe.com:11010_ts_
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x1c
call fcn.0040531c
push edi
mov byte [ebp - 4], 0x1d
push dword [ebp - 0x168]
lea eax, [ebp - 0x1b8]
push eax
lea edx, [ebp - 0x98]
lea eax, [ebp - 0x58]
call fcn.00470be1
push ebx
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 0x15d], al
call fcn.004051a5
cmp byte [ebp - 0x15d], bl
je 0x472918
cmp dword [ebp - 0x94], 0xc
jbe 0x472918
push ebx
push ebx
lea eax, [ebp - 0x188]
call fcn.004b6cbe
lea eax, [ebp - 0x158]
push eax
mov byte [ebp - 4], 0x20
call fcn.004b775e
mov byte [ebp - 4], 0x21
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x94]
add eax, 0xc
push eax
push dword [ebp - 0x170]
lea eax, [ebp - 0x58]
add ecx, 0xfffffff4
push eax
call fcn.004748ff
add esp, 0xc
mov byte [ebp - 4], 0x22
cmp dword [ebp - 0x44], ebx
je 0x4727ed
cmp dword [ebp - 0x40], 0x10
mov eax, dword [ebp - 0x54]
jae 0x4727bf
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040531c
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x158]
push eax
lea ecx, [ebp - 0x188]
mov byte [ebp - 4], 0x23
call fcn.004b77c2
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.004051a5
push ebx
push 1
lea ecx, [ebp - 0x58]
call fcn.004051a5
lea eax, [ebp - 0x158]
mov byte [ebp - 4], 0x20
call fcn.0040b686
mov esi, str.ts_data
push esi
lea eax, [ebp - 0x188]
push eax
call fcn.004b70d9
cmp al, 1
jne 0x472909
push esi
lea eax, [ebp - 0x188]
push eax
call fcn.004b6ff4
cmp byte [eax + 8], 6
jne 0x472909
push esi
lea eax, [ebp - 0x188]
push eax
call fcn.004b6ff4
mov dword [ebp - 0x18c], eax
call fcn.004b6980
xor edi, edi
mov dword [ebp - 0x16c], eax
cmp eax, ebx
jbe 0x472909
push 0x54a60c
push ecx
mov ecx, dword [ebp - 0x18c]
push edi
call fcn.004b6b89
pop ecx
push eax
call fcn.004b6f92
lea edx, [ebp - 0x58]
mov ecx, eax
call fcn.004b60f0
push str.protection_status
lea esi, [ebp - 0x58]
mov byte [ebp - 4], 0x24
call fcn.00426296
test eax, eax
jne 0x4728a1
and dword [ebp - 0x15c], 0xfffffffa
jmp 0x4728ed
push str.boot_status
lea esi, [ebp - 0x58]
call fcn.00426296
test eax, eax
jne 0x4728bb
and dword [ebp - 0x15c], 0xfffffffd
jmp 0x4728ed
push str.cleanup_status
lea esi, [ebp - 0x58]
call fcn.00426296
test eax, eax
jne 0x4728d5
and dword [ebp - 0x15c], 0xfffffff7
jmp 0x4728ed
push str.common_status
lea esi, [ebp - 0x58]
call fcn.00426296
test eax, eax
jne 0x4728ed
and dword [ebp - 0x15c], 0xffffffef
push ebx
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x20
call fcn.004051a5
inc edi
cmp edi, dword [ebp - 0x16c]
jb 0x472860
lea esi, [ebp - 0x188]
mov byte [ebp - 4], 0x1c
call fcn.004b5d4a
cmp dword [ebp - 0x170], ebx
je 0x47292c
push dword [ebp - 0x170]
call fcn.004f29a6
pop ecx
push dword [ebp - 0x98]
call fcn.004f29a6
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
call fcn.004051a5
mov eax, dword [ebp - 0x168]
add eax, 0xfffffff0
call fcn.00405521
lea edi, [ebp - 0x1b8]
mov byte [ebp - 4], 0x19
call fcn.00470bc5
push ebx
push 1
lea ecx, [ebp - 0x74]
call fcn.004051a5
lea esi, [ebp - 0xbc]
call fcn.004361ad
mov eax, dword [ebp - 0x164]
add eax, 0xfffffff0
call fcn.00405521
mov ebx, dword [ebp - 0x15c]
jmp 0x47260d