Function at 0x41d04d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x38
mov eax, 0x467f39
call fcn.00448a59
mov edi, ecx
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov al, byte [ebp + 0xc]
mov byte [edi + 0xe8], al
test al, al
je 0x41d084
push ebx
push ebx
push ebx
push ebx
push 0x46eb18
call fcn.004280bf
mov dword [edi + 0x330], eax
cmp byte [ebp + 8], 0
mov dword [edi + 0xec], ebx
mov dword [ebp - 4], ebx
je 0x41d0e4
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push ebx
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.i_temp.temp
mov byte [ebp - 4], 1
call fcn.004044c1
push ecx
mov dword [ebp - 0x24], esp
mov esi, esp
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.EgQVFBEExQP
mov byte [ebp - 4], 2
call fcn.004023b7
push esi
call fcn.00404227
add esp, 0x20
mov byte [ebp - 4], 0
call fcn.0040b261
add esp, 0xc
mov ecx, edi
call fcn.0041a069
push 0x46cb2d
lea ecx, [ebp + 0xc]
call fcn.004044c1
mov byte [ebp - 4], 3
xor edi, edi
cmp edi, dword [0x48a860]
jge 0x41d1dd
mov eax, edi
imul eax, eax, 0xa14
cmp byte [eax + 0x48aedc], 0
je 0x41d27e
lea eax, [eax + 0x48ac80]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00403949
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.BQ4WDw0OAAUMAA8ABgQT
mov byte [ebp - 4], 4
call fcn.004023b7
lea eax, [ebp - 0x20]
push eax
call fcn.00404227
mov esi, dword [ebp - 0x1c]
or dword [ebp - 0x14], 1
add esp, 0x20
push dword [eax]
push esi
call fcn.0044b58e
pop ecx
pop ecx
test eax, eax
je 0x41d17a
push str.downloadmanager_alot
push esi
call fcn.0044b58e
pop ecx
pop ecx
test eax, eax
je 0x41d17a
xor bl, bl
jmp 0x41d17c
mov bl, 1
test byte [ebp - 0x14], 1
je 0x41d191
mov ecx, dword [ebp - 0x20]
and dword [ebp - 0x14], 0xfffffffe
add ecx, 0xfffffff0
call fcn.0040127b
test bl, bl
je 0x41d270
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.U09R
call fcn.004023b7
lea eax, [ebp - 0x20]
push eax
call fcn.00404227
add esp, 0x20
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 5
call fcn.00403f82
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0040127b
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 3
call fcn.0040127b
xor ebx, ebx
push 0x46cb2d
lea ecx, [ebp + 0xc]
call fcn.00403446
cmp eax, ebx
jne 0x41d2e5
xor edi, edi
cmp edi, dword [0x48a860]
jge 0x41d2e5
mov eax, edi
imul eax, eax, 0xa14
cmp byte [eax + 0x48aedc], 0
je 0x41d390
lea eax, [eax + 0x48ac80]
push eax
lea ecx, [ebp - 0x20]
call fcn.00403949
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.EQ0AGAMTGBUE
mov byte [ebp - 4], 6
call fcn.004023b7
lea eax, [ebp - 0x1c]
push eax
call fcn.00404227
mov esi, dword [ebp - 0x20]
or dword [ebp - 0x14], 2
add esp, 0x20
push dword [eax]
push esi
call fcn.0044b58e
pop ecx
pop ecx
test eax, eax
je 0x41d284
push str.browseforchange
push esi
call fcn.0044b58e
pop ecx
pop ecx
test eax, eax
je 0x41d284
xor bl, bl
jmp 0x41d286
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 3
call fcn.0040127b
xor ebx, ebx
inc edi
jmp 0x41d0fe
mov bl, 1
test byte [ebp - 0x14], 2
je 0x41d29b
mov ecx, dword [ebp - 0x1c]
and dword [ebp - 0x14], 0xfffffffd
add ecx, 0xfffffff0
call fcn.0040127b
test bl, bl
je 0x41d384
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.UE9Q
call fcn.004023b7
lea eax, [ebp - 0x1c]
push eax
call fcn.00404227
add esp, 0x20
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 7
call fcn.00403f82
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0040127b
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 3
call fcn.0040127b
lea eax, [ebp + 8]
push eax
call fcn.0040988e
pop ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.U09R
mov byte [ebp - 4], 8
call fcn.004023b7
lea eax, [ebp - 0x20]
push eax
call fcn.00404227
add esp, 0x20
push dword [eax]
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 9
call fcn.00403446
mov ecx, dword [ebp - 0x20]
test eax, eax
sete bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 8
call fcn.0040127b
sub esp, 0x1c
mov ecx, esp
test bl, bl
je 0x41d4a5
mov dword [ebp - 0x24], esp
push str.UU9R
call fcn.004023b7
lea eax, [ebp - 0x20]
push eax
call fcn.00404227
add esp, 0x20
push dword [eax]
or dword [ebp - 0x14], 4
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0xa
call fcn.00403446
test eax, eax
je 0x41d396
push 0x46fa20
lea ecx, [ebp + 8]
call fcn.00403446
test eax, eax
je 0x41d396
xor bl, bl
jmp 0x41d398
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 3
call fcn.0040127b
inc edi
jmp 0x41d1f4
mov bl, 1
test byte [ebp - 0x14], 4
mov dword [ebp - 4], 8
je 0x41d3b0
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0040127b
test bl, bl
je 0x41d7bf
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
mov esi, 0x46cb2d
push esi
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push esi
mov byte [ebp - 4], 0xb
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push esi
mov byte [ebp - 4], 0xc
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str..NET_2.0
mov byte [ebp - 4], 0xd
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.true
mov byte [ebp - 4], 0xe
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push esi
mov byte [ebp - 4], 0xf
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push esi
mov byte [ebp - 4], 0x10
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.dotnet
mov byte [ebp - 4], 0x11
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x38], esp
push str._q:a__c:_install__l__q_
mov byte [ebp - 4], 0x12
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x3c], esp
push str.dotnetfx.exe
mov byte [ebp - 4], 0x13
call fcn.004044c1
push ecx
mov dword [ebp - 0x40], esp
mov esi, esp
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x40], esp
push str.CRUVEVtOTgUOFg8NDgAFTwwIAhMOEg4HFU8CDgxOBQ4WDw0OAAVOVE5XTlZOVFdWVlRZAFJMVlRYBExVVlIETAMHWQdMVFNQVFVVUllUV1QATgUOFQ8EFQcZTwQZBA
mov byte [ebp - 4], 0x14
call fcn.004023b7
push esi
call fcn.00404227
mov edi, dword [ebp - 0x18]
add esp, 0x20
mov ecx, edi
mov byte [ebp - 4], 8
call fcn.0041cd2b
jmp 0x41d7c2
mov dword [ebp - 0x40], esp
push str.UE9Q
call fcn.004023b7
lea eax, [ebp - 0x20]
push eax
call fcn.00404227
add esp, 0x20
push dword [eax]
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0x15
call fcn.00403446
mov ecx, dword [ebp - 0x20]
test eax, eax
sete bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 8
call fcn.0040127b
test bl, bl
je 0x41d7bf
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x40], esp
push str.UU9R
call fcn.004023b7
lea eax, [ebp - 0x20]
push eax
call fcn.00404227
add esp, 0x20
push dword [eax]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x16
call fcn.00403446
mov ecx, dword [ebp - 0x20]
test eax, eax
sete bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 8
call fcn.0040127b
test bl, bl
je 0x41d6cc
push ecx
mov ecx, esp
mov dword [ebp - 0x40], esp
mov edi, 0x46cb2d
push edi
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x3c], esp
push edi
mov byte [ebp - 4], 0x17
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x38], esp
push edi
mov byte [ebp - 4], 0x18
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str..NET_1.1
mov byte [ebp - 4], 0x19
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
mov ebx, str.true
push ebx
mov byte [ebp - 4], 0x1a
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push edi
mov byte [ebp - 4], 0x1b
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push edi
mov byte [ebp - 4], 0x1c
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.dotnet
mov byte [ebp - 4], 0x1d
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str._q:a__c:_install__l__q_
mov byte [ebp - 4], 0x1e
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.dotnetfx.exe
mov byte [ebp - 4], 0x1f
call fcn.004044c1
push ecx
mov dword [ebp - 0x44], esp
mov esi, esp
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x44], esp
push str.CRUVEVtOTgUOFg8NDgAFTwwIAhMOEg4HFU8CDgxOBQ4WDw0OAAVOAE4ATgJOAAACUlhTU1dMWVlTVExVVQIETFhRBFJMAwdZU1FSBFZVUVFXTgUOFQ8EFQcZTwQZBA
mov byte [ebp - 4], 0x20
call fcn.004023b7
push esi
call fcn.00404227
mov ecx, dword [ebp - 0x18]
add esp, 0x20
mov byte [ebp - 4], 8
call fcn.0041cd2b
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push edi
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x40], esp
push edi
mov byte [ebp - 4], 0x21
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x3c], esp
push edi
mov byte [ebp - 4], 0x22
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x38], esp
push str..NET_1.1_SP1
mov byte [ebp - 4], 0x23
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push ebx
mov byte [ebp - 4], 0x24
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push edi
mov byte [ebp - 4], 0x25
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push edi
mov byte [ebp - 4], 0x26
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.dotnet_sp1
mov byte [ebp - 4], 0x27
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push 0x46f8b0
mov byte [ebp - 4], 0x28
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.NDP1.1sp1_KB867460_X86.exe
mov byte [ebp - 4], 0x29
call fcn.004044c1
mov byte [ebp - 4], 0x2a
jmp 0x41d792
call fcn.00419bef
test al, al
je 0x41d7bf
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
mov esi, 0x46cb2d
push esi
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x40], esp
push esi
mov byte [ebp - 4], 0x2b
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x3c], esp
push esi
mov byte [ebp - 4], 0x2c
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x38], esp
push str..NET_1.1_SP1
mov byte [ebp - 4], 0x2d
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.true
mov byte [ebp - 4], 0x2e
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push esi
mov byte [ebp - 4], 0x2f
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push esi
mov byte [ebp - 4], 0x30
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.dotnet_sp1
mov byte [ebp - 4], 0x31
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push 0x46f8b0
mov byte [ebp - 4], 0x32
call fcn.004044c1
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.NDP1.1sp1_KB867460_X86.exe
mov byte [ebp - 4], 0x33
call fcn.004044c1
mov byte [ebp - 4], 0x34
push ecx
mov dword [ebp - 0x14], esp
mov esi, esp
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.CRUVEVtOTgUOFg8NDgAFTwwIAhMOEg4HFU8CDgxOBQ4WDw0OAAVOWU4DTlVOWQNVAAUFBVlMBFhUVkxVBQQATAMFA1lMAlUEUVEAB1QDWFUDTi8lMVBPUBIRUEwqI1lXVlVXUUw5WVdPBBkE
call fcn.004023b7
push esi
call fcn.00404227
mov ecx, dword [ebp - 0x18]
add esp, 0x20
mov byte [ebp - 4], 8
call fcn.0041cd2b
mov edi, dword [ebp - 0x18]
xor esi, esi
inc esi
cmp esi, dword [0x48a860]
mov ecx, edi
jge 0x41d7d8
push esi
call fcn.0041c1f7
inc esi
jmp 0x41d7c5
xor esi, esi
push esi
call fcn.0041c1f7
mov eax, dword [edi + 0x348]
cmp dword [eax - 0xc], esi
jle 0x41d7f2
mov ecx, edi
call fcn.0041951c
mov eax, dword [edi + 0x34c]
cmp dword [eax - 0xc], esi
jle 0x41d804
mov ecx, edi
call fcn.0041988c
push ecx
lea eax, [edi + 0x338]
mov dword [ebp - 0x44], esp
mov ecx, esp
push eax
call fcn.00403949
mov ecx, dword [edi + 0x330]
add ecx, 0x44
call fcn.004210c0
push esi
push 0x3e8
push 1
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040127b
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0040127b
call fcn.00448afe
ret 8