Function at 0x4226a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x58a4e6
mov eax, dword fs:[0]
push eax
sub esp, 0x108
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x110]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x74]
push eax
call fcn.00423e60
mov dword [esp + 0x118], 0
xor eax, eax
mov dword [esp + 0xbc], 0
mov dword [esp + 0xc0], 0
mov dword [esp + 0xc0], 7
mov dword [esp + 0xbc], 0
mov word [esp + 0xac], ax
mov byte [esp + 0x118], 1
lea edx, [esp + 0xac]
lea ecx, [eax + 6]
call fcn.00411f00
cmp byte [esi + 0x12], 0
je 0x422c49
cmp dword [esp + 0xbc], 0
je 0x422c49
push 0x5ab300
lea ecx, [esp + 0xc8]
call fcn.00403a70
mov byte [esp + 0x118], 2
lea eax, [esp + 0xc4]
push eax
lea ecx, [esp + 0x44]
call fcn.004b8170
mov byte [esp + 0x118], 4
cmp dword [esp + 0xd8], 8
jb 0x42279f
push dword [esp + 0xc4]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0xd8], 7
mov dword [esp + 0xec], eax
mov dword [esp + 0xf0], eax
mov dword [esp + 0xd4], 0
mov word [esp + 0xc4], ax
mov dword [esp + 0xf0], 7
mov dword [esp + 0xec], eax
mov word [esp + 0xdc], ax
mov byte [esp + 0x118], 5
lea eax, [esp + 0xdc]
push eax
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x48]
call fcn.004b8320
test al, al
jne 0x422830
cmp dword [esp + 0xf0], 8
lea eax, [esp + 0xdc]
mov dword [esp + 0xec], 0
cmovae eax, dword [esp + 0xdc]
xor ecx, ecx
mov word [eax], cx
cmp dword [esp + 0xec], 0
je 0x422bf7
xorps xmm0, xmm0
xor eax, eax
movdqu xmmword [esp + 0x9c], xmm0
mov dword [esp + 0xa0], 0
movdqu xmmword [esp + 0x8c], xmm0
mov dword [esp + 0xa4], 0
mov dword [esp + 0x8c], 0xffffffff
mov dword [esp + 0xa4], 7
mov dword [esp + 0xa0], 0
mov word [esp + 0x90], ax
mov byte [esp + 0x118], 7
mov dword [esp + 0xa8], eax
mov byte [esp + 0x118], 8
lea eax, [esp + 0xdc]
push ecx
push 2
push ecx
push eax
lea ecx, [esp + 0x9c]
call fcn.004b84a0
test al, al
je 0x422be3
push str._DEFAULT__r_n
lea ecx, [esp + 0xf8]
mov dword [esp + 0x40], 0
call fcn.004039b0
mov byte [esp + 0x118], 9
lea ecx, [esp + 0x3c]
cmp dword [esp + 0x108], 0x10
lea eax, [esp + 0xf4]
push 0
cmovae eax, dword [esp + 0xf8]
push ecx
push dword [esp + 0x10c]
lea ecx, [esp + 0x98]
push eax
call fcn.004b8520
push str.BASEURL
lea ecx, [esp + 0xc8]
call fcn.00403a70
mov byte [esp + 0x118], 0xa
lea eax, [esp + 0x74]
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0xd0]
call fcn.004047c0
push 0x5a8400
lea ecx, [esp + 0xc8]
call fcn.00403b70
push 0
lea edx, [esp + 0xc8]
lea ecx, [esp + 0x28]
call fcn.004b1890
add esp, 4
mov byte [esp + 0x118], 0xb
lea ecx, [esp + 0xf4]
push eax
call fcn.0040df80
mov byte [esp + 0x118], 0xa
lea ecx, [esp + 0x24]
call fcn.00403a00
cmp dword [esp + 0x108], 0x10
lea ecx, [esp + 0x3c]
push 0
push ecx
push dword [esp + 0x10c]
lea eax, [esp + 0x100]
cmovae eax, dword [esp + 0x100]
lea ecx, [esp + 0x98]
push eax
call fcn.004b8520
push str._InternetShortcut__r_n
lea ecx, [esp + 0xf8]
call fcn.0042a4f0
cmp dword [esp + 0x108], 0x10
lea ecx, [esp + 0x3c]
push 0
push ecx
push dword [esp + 0x10c]
lea eax, [esp + 0x100]
cmovae eax, dword [esp + 0x100]
lea ecx, [esp + 0x98]
push eax
call fcn.004b8520
push str.URL
lea ecx, [esp + 0xc8]
call fcn.0040bc40
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0xd0]
call fcn.004047c0
push 0x5a8400
lea ecx, [esp + 0xc8]
call fcn.00403b70
push 0
lea edx, [esp + 0xc8]
lea ecx, [esp + 0x28]
call fcn.004b1890
add esp, 4
mov byte [esp + 0x118], 0xc
lea ecx, [esp + 0xf4]
push eax
call fcn.0040df80
mov byte [esp + 0x118], 0xa
lea ecx, [esp + 0x24]
call fcn.00403a00
cmp dword [esp + 0x108], 0x10
lea ecx, [esp + 0x3c]
push 0
push ecx
push dword [esp + 0x10c]
lea eax, [esp + 0x100]
cmovae eax, dword [esp + 0x100]
lea ecx, [esp + 0x98]
push eax
call fcn.004b8520
push str.IconFilehttp:__www.2345.com_favicon.ico_r_n
lea ecx, [esp + 0xf8]
call fcn.0042a4f0
cmp dword [esp + 0x108], 0x10
lea ecx, [esp + 0x3c]
push 0
push ecx
push dword [esp + 0x10c]
lea eax, [esp + 0x100]
cmovae eax, dword [esp + 0x100]
lea ecx, [esp + 0x98]
push eax
call fcn.004b8520
push str.IconIndex1_r_n
lea ecx, [esp + 0xf8]
call fcn.0042a4f0
cmp dword [esp + 0x108], 0x10
lea ecx, [esp + 0x3c]
push 0
push ecx
push dword [esp + 0x10c]
lea eax, [esp + 0x100]
cmovae eax, dword [esp + 0x100]
lea ecx, [esp + 0x98]
push eax
call fcn.004b8520
lea ecx, [esp + 0x8c]
call fcn.004b7e80
push 0x5ab388
lea ecx, [esp + 0x28]
call fcn.00403a70
mov byte [esp + 0x118], 0xd
lea eax, [esp + 0x24]
push eax
lea edx, [esp + 0xb0]
lea ecx, [esp + 0x10]
call fcn.004b2290
add esp, 4
mov byte [esp + 0x118], 0xe
lea ecx, [esp + 0xac]
push eax
call fcn.00403b00
mov byte [esp + 0x118], 0xd
lea ecx, [esp + 0xc]
call fcn.00403b40
mov byte [esp + 0x118], 0xa
lea ecx, [esp + 0x24]
call fcn.00403b40
lea edx, [esp + 0xac]
lea ecx, [esp + 0xdc]
call fcn.004bb910
mov byte [esp + 0x118], 9
lea ecx, [esp + 0xc4]
call fcn.00403b40
mov byte [esp + 0x118], 8
lea ecx, [esp + 0xf4]
call fcn.00403a00
mov byte [esp + 0x118], 5
lea ecx, [esp + 0x8c]
call fcn.004b7de0
mov byte [esp + 0x118], 4
cmp dword [esp + 0xf0], 8
jb 0x422c18
push dword [esp + 0xdc]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0xf0], 7
mov dword [esp + 0xec], 0
mov word [esp + 0xdc], ax
mov byte [esp + 0x118], 1
lea ecx, [esp + 0x40]
call fcn.004b8210
mov byte [esp + 0x118], 0
cmp dword [esp + 0xc0], 8
jb 0x422c6a
push dword [esp + 0xac]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0xc0], 7
mov dword [esp + 0xbc], 0
mov word [esp + 0xac], ax
mov dword [esp + 0x118], 0xffffffff
cmp dword [esp + 0x88], 8
jb 0x422cab
push dword [esp + 0x74]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x88], 7
mov dword [esp + 0x84], 0
mov word [esp + 0x74], ax
mov ecx, dword [esp + 0x110]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00564de8
add esp, 0x114
ret