Function at 0x4b3830
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56124a
mov eax, dword fs:[0]
push eax
sub esp, 0x340
mov eax, dword [0x5c04b4]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x344], edx
mov ebx, ecx
mov dword [ebp - 0x340], ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x33c], 0
mov al, 1
mov byte [ebp - 0x335], al
mov esi, dword [0x5c6b7c]
test esi, esi
je 0x4b43c1
cmp dword [esi + 0x170], 0
jne 0x4b43c1
lea eax, [esi + 0x16c]
mov ecx, 1
lock xadd dword [eax], ecx
mov dword [ebp - 0x348], esi
mov dword [ebp - 4], 0
push str.SignaturesEnable
lea ecx, [ebp - 0x124]
call fcn.0045af20
mov byte [ebp - 4], 1
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x1c4]
push eax
mov ecx, ebx
call fcn.00451340
mov byte [ebp - 4], 2
push 1
mov ecx, eax
call fcn.00451250
push eax
push 0x31771
mov edx, edi
mov ecx, esi
call fcn.004a3720
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c4]
call fcn.00440820
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x124]
call fcn.00440820
push str.AdvancedHeuristicsEnable
lea ecx, [ebp - 0xa4]
call fcn.0045af20
mov byte [ebp - 4], 3
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x204]
push eax
mov ecx, ebx
call fcn.00451340
mov byte [ebp - 4], 4
push 1
mov ecx, eax
call fcn.00451250
push eax
push 0x31777
mov edx, edi
mov ecx, esi
call fcn.004a3720
add esp, 8
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x204]
call fcn.00440820
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa4]
call fcn.00440820
push str.HeuristicsEnable
lea ecx, [ebp - 0x1a4]
call fcn.0045af20
mov byte [ebp - 4], 5
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x2a4]
push eax
mov ecx, ebx
call fcn.00451340
mov byte [ebp - 4], 6
push 1
mov ecx, eax
call fcn.00451250
push eax
push 0x31772
mov edx, edi
mov ecx, esi
call fcn.004a3720
add esp, 8
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2a4]
call fcn.00440820
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1a4]
call fcn.00440820
mov eax, dword [ebp - 0x344]
cmp byte [eax + 3], 0
je 0x4b3a48
push str.CloudEnable
lea ecx, [ebp - 0xc4]
call fcn.0045af20
mov byte [ebp - 4], 7
mov dword [ebp - 0x33c], 1
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x224]
push eax
mov ecx, ebx
call fcn.00451340
mov dword [ebp - 4], 8
mov dword [ebp - 0x33c], 3
push 1
mov ecx, eax
call fcn.00451250
jmp 0x4b3a4a
xor eax, eax
push eax
push 0x3178c
mov edx, edi
mov ecx, esi
call fcn.004a3720
add esp, 8
mov dword [ebp - 4], 7
mov eax, dword [ebp - 0x33c]
test al, 2
je 0x4b3a87
and eax, 0xfffffffd
mov dword [ebp - 0x33c], eax
lea ecx, [ebp - 0x224]
call fcn.00440820
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 4], 0
test al, 1
je 0x4b3aa6
and eax, 0xfffffffe
mov dword [ebp - 0x33c], eax
lea ecx, [ebp - 0xc4]
call fcn.00440820
push str.AggressiveMode
lea ecx, [ebp - 0x144]
call fcn.0045af20
mov byte [ebp - 4], 9
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x324]
push eax
mov ecx, ebx
call fcn.00451340
mov byte [ebp - 4], 0xa
push 0
mov ecx, eax
call fcn.00451250
push eax
push 0x31791
mov edx, edi
mov ecx, esi
call fcn.004a3720
add esp, 8
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x324]
call fcn.00440820
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x144]
call fcn.00440820
push str.LogAllEnable
lea ecx, [ebp - 0xe4]
call fcn.0045af20
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x244]
push eax
mov ecx, ebx
call fcn.00451340
mov byte [ebp - 4], 0xc
push 0
mov ecx, eax
call fcn.00451250
push eax
push 0x31778
mov edx, edi
mov ecx, esi
call fcn.004a3720
add esp, 8
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x244]
call fcn.00440820
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xe4]
call fcn.00440820
push str.CleanLevel
lea ecx, [ebp - 0x184]
call fcn.0045af20
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp - 0x2c4]
push eax
mov ecx, ebx
call fcn.00451340
mov byte [ebp - 4], 0xe
push 1
mov ecx, eax
call fcn.00451250
push eax
push 0x5177b
mov edx, edi
mov ecx, esi
call fcn.004a3720
add esp, 8
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x2c4]
call fcn.00440820
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x184]
call fcn.00440820
push str.AdwareEnable
lea ecx, [ebp - 0x104]
call fcn.0045af20
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x264]
push eax
mov ecx, ebx
call fcn.00451340
mov byte [ebp - 4], 0x10
push 1
mov ecx, eax
call fcn.00451250
push eax
push 0x31779
mov edx, edi
mov ecx, esi
call fcn.004a3720
add esp, 8
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x264]
call fcn.00440820
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x104]
call fcn.00440820
mov ecx, dword [ebp - 0x344]
movzx eax, byte [ecx + 2]
push eax
push 0x3177a
mov edx, edi
mov ecx, esi
call fcn.004a3720
mov eax, dword [ebp - 0x344]
movzx eax, byte [eax + 1]
push eax
push 0x3178e
mov edx, edi
mov ecx, esi
call fcn.004a3720
mov eax, dword [ebp - 0x344]
movzx eax, byte [eax]
push eax
push 0x31785
mov edx, edi
mov ecx, esi
call fcn.004a3720
add esp, 0x18
push str.ArchiveUseDefaults
lea ecx, [ebp - 0x164]
call fcn.0045af20
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x304]
push eax
mov ecx, ebx
call fcn.00451340
mov byte [ebp - 4], 0x12
push 1
mov ecx, eax
call fcn.0045b000
mov bl, al
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x304]
call fcn.00440820
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x164]
call fcn.00440820
test bl, bl
je 0x4b3d13
push 0
push 0x51786
mov edx, edi
mov ecx, esi
call fcn.004a3720
push 0
push 0x51787
mov edx, edi
mov ecx, esi
call fcn.004a3720
add esp, 0x10
mov ebx, dword [ebp - 0x340]
jmp 0x4b3ddc
push str.MaxArchiveLevel
lea ecx, [ebp - 0x74]
call fcn.0045af20
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x284]
push eax
mov ebx, dword [ebp - 0x340]
mov ecx, ebx
call fcn.00451340
mov byte [ebp - 4], 0x14
push 0
mov ecx, eax
call fcn.00451250
push eax
push 0x51786
mov edx, edi
mov ecx, esi
call fcn.004a3720
add esp, 8
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x284]
call fcn.00440820
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x74]
call fcn.00440820
push str.MaxTempFileSize
lea ecx, [ebp - 0x94]
call fcn.0045af20
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x1e4]
push eax
mov ecx, ebx
call fcn.00451340
mov byte [ebp - 4], 0x16
push 0
mov ecx, eax
call fcn.00451250
push eax
push 0x51787
mov edx, edi
mov ecx, esi
call fcn.004a3720
add esp, 8
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x1e4]
call fcn.00440820
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x94]
call fcn.00440820
push str.FileLimitsUseDefaults
lea ecx, [ebp - 0xb4]
call fcn.0045af20
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0x1d4]
push eax
mov ecx, ebx
call fcn.00451340
mov byte [ebp - 4], 0x18
push 1
mov ecx, eax
call fcn.0045b000
mov bl, al
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1d4]
call fcn.00440820
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb4]
call fcn.00440820
test bl, bl
je 0x4b3e64
push 0
push 0x5178a
mov edx, edi
mov ecx, esi
call fcn.004a3720
push 0
push 0x51788
mov edx, edi
mov ecx, esi
call fcn.004a3720
add esp, 0x10
mov ebx, dword [ebp - 0x340]
jmp 0x4b3f36
push str.MaxScanFileSize
lea ecx, [ebp - 0xd4]
call fcn.0045af20
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0x1f4]
push eax
mov ebx, dword [ebp - 0x340]
mov ecx, ebx
call fcn.00451340
mov byte [ebp - 4], 0x1a
push 0
mov ecx, eax
call fcn.00451250
push eax
push 0x5178a
mov edx, edi
mov ecx, esi
call fcn.004a3720
add esp, 8
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x1f4]
call fcn.00440820
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xd4]
call fcn.00440820
push str.ScanObjectTimeout
lea ecx, [ebp - 0xf4]
call fcn.0045af20
mov byte [ebp - 4], 0x1b
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x214]
push eax
mov ecx, ebx
call fcn.00451340
mov byte [ebp - 4], 0x1c
push 0
mov ecx, eax
call fcn.00451250
push eax
push 0x51788
mov edx, edi
mov ecx, esi
call fcn.004a3720
add esp, 8
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x214]
call fcn.00440820
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xf4]
call fcn.00440820
push str.FileEnable
lea ecx, [ebp - 0x114]
call fcn.0045af20
mov byte [ebp - 4], 0x1d
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x234]
push eax
mov ecx, ebx
call fcn.00451340
mov byte [ebp - 4], 0x1e
push 1
mov ecx, eax
call fcn.00451250
push eax
push 0x3177c
mov edx, edi
mov ecx, esi
call fcn.004a3720
add esp, 8
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x234]
call fcn.00440820
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x114]
call fcn.00440820
push str.ArchiveEnable
lea ecx, [ebp - 0x134]
call fcn.0045af20
mov byte [ebp - 4], 0x1f
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x254]
push eax
mov ecx, ebx
call fcn.00451340
mov byte [ebp - 4], 0x20
push 1
mov ecx, eax
call fcn.00451250
push eax
push 0x3177e
mov edx, edi
mov ecx, esi
call fcn.004a3720
add esp, 8
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x254]
call fcn.00440820
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.00440820
push str.SectorEnable
lea ecx, [ebp - 0x154]
call fcn.0045af20
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x274]
push eax
mov ecx, ebx
call fcn.00451340
mov byte [ebp - 4], 0x22
push 1
mov ecx, eax
call fcn.00451250
push eax
push 0x3177d
mov edx, edi
mov ecx, esi
call fcn.004a3720
add esp, 8
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x274]
call fcn.00440820
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x154]
call fcn.00440820
push str.SfxEnable
lea ecx, [ebp - 0x174]
call fcn.0045af20
mov byte [ebp - 4], 0x23
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0x294]
push eax
mov ecx, ebx
call fcn.00451340
mov byte [ebp - 4], 0x24
push 1
mov ecx, eax
call fcn.00451250
push eax
push 0x3177f
mov edx, edi
mov ecx, esi
call fcn.004a3720
add esp, 8
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x294]
call fcn.00440820
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x174]
call fcn.00440820
push str.RtpEnable
lea ecx, [ebp - 0x194]
call fcn.0045af20
mov byte [ebp - 4], 0x25
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x2b4]
push eax
mov ecx, ebx
call fcn.00451340
mov byte [ebp - 4], 0x26
push 1
mov ecx, eax
call fcn.00451250
push eax
push 0x31780
mov edx, edi
mov ecx, esi
call fcn.004a3720
add esp, 8
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x2b4]
call fcn.00440820
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x194]
call fcn.00440820
push str.MailEnable
lea ecx, [ebp - 0x1b4]
call fcn.0045af20
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x1b4]
push eax
lea eax, [ebp - 0x2d4]
push eax
mov ecx, ebx
call fcn.00451340
mov byte [ebp - 4], 0x28
push 1
mov ecx, eax
call fcn.00451250
push eax
push 0x31781
mov edx, edi
mov ecx, esi
call fcn.004a3720
add esp, 8
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x2d4]
call fcn.00440820
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1b4]
call fcn.00440820
push str.MailEnable
lea ecx, [ebp - 0x84]
call fcn.0045af20
mov byte [ebp - 4], 0x29
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x2f4]
push eax
mov ecx, ebx
call fcn.00451340
mov byte [ebp - 4], 0x2a
push 1
mov ecx, eax
call fcn.00451250
push eax
push 0x31782
mov edx, edi
mov ecx, esi
call fcn.004a3720
add esp, 8
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x2f4]
call fcn.00440820
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x84]
call fcn.00440820
push str.MemoryEnable
lea ecx, [ebp - 0x44]
call fcn.0045af20
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x314]
push eax
mov ecx, ebx
call fcn.00451340
mov byte [ebp - 4], 0x2c
push 1
mov ecx, eax
call fcn.00451250
push eax
push 0x31783
mov edx, edi
mov ecx, esi
call fcn.004a3720
add esp, 8
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x314]
call fcn.00440820
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.00440820
push str.SmartEnable
lea ecx, [ebp - 0x54]
call fcn.0045af20
mov byte [ebp - 4], 0x2d
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x334]
push eax
mov ecx, ebx
call fcn.00451340
mov byte [ebp - 4], 0x2e
push 1
mov ecx, eax
call fcn.00451250
push eax
push 0x3178b
mov edx, edi
mov ecx, esi
call fcn.004a3720
add esp, 8
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x334]
call fcn.00440820
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.00440820
push 0x58ad90
push 0xe1774
mov edx, edi
mov ecx, esi
call fcn.004a3750
add esp, 8
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], 0
xor eax, eax
mov word [ebp - 0x30], ax
mov byte [ebp - 4], 0x2f
push str.ExcludeExtensions
lea ecx, [ebp - 0x64]
call fcn.0045af20
mov byte [ebp - 4], 0x30
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x2e4]
push eax
mov ecx, ebx
call fcn.00451340
mov byte [ebp - 4], 0x31
lea edx, [ebp - 0x30]
mov ecx, eax
call fcn.004b31a0
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x2e4]
call fcn.00440820
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x64]
call fcn.00440820
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x4b434e
lea eax, [ebp - 0x30]
push eax
push 0xe1776
mov edx, edi
mov ecx, esi
call fcn.004a3750
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.0041d580
mov dword [ebp - 4], 0xffffffff
jmp 0x4b438f
mov bl, byte [ebp - 0x335]
lea eax, [esi + 0x16c]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
jne 0x4b43bf
cmp dword [esi + 0x170], 0
je 0x4b43bf
mov ecx, esi
call fcn.004f5900
push esi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00553510
mov esp, ebp
pop ebp
ret