Function at 0x49dc30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60043e
mov eax, dword fs:[0]
push eax
sub esp, 0x1bc
mov eax, dword [0x672494]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0xf0]
mov ebx, dword [ebp + 0xc]
push 6
push str.sysenv
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xdc], 0xf
mov byte [ebp - 0xf0], 0
call fcn.0040eb70
lea eax, [esi + 0x150]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0xf0]
mov ecx, ebx
push eax
call fcn.004953e0
mov ecx, eax
call fcn.00495180
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0xdc]
cmp edx, 0x10
jb 0x49dcf7
mov ecx, dword [ebp - 0xf0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x49dced
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49e7e9
push edx
push ecx
call fcn.004d0c91
add esp, 8
push 6
push str.appenv
lea ecx, [ebp - 0xf0]
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xdc], 0xf
mov byte [ebp - 0xf0], 0
call fcn.0040eb70
lea eax, [esi + 0x160]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0xf0]
mov ecx, ebx
push eax
call fcn.004953e0
mov ecx, eax
call fcn.00495180
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0xdc]
cmp edx, 0x10
jb 0x49dd88
mov ecx, dword [ebp - 0xf0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x49dd7e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49e7ee
push edx
push ecx
call fcn.004d0c91
add esp, 8
push 4
push str.user
lea ecx, [ebp - 0xf0]
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xdc], 0xf
mov byte [ebp - 0xf0], 0
call fcn.0040eb70
lea eax, [esi + 0x140]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0xf0]
mov ecx, ebx
push eax
call fcn.004953e0
mov ecx, eax
call fcn.00495180
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0xdc]
cmp edx, 0x10
jb 0x49de19
mov ecx, dword [ebp - 0xf0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x49de0f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49e7f3
push edx
push ecx
call fcn.004d0c91
add esp, 8
push 9
push str.timestamp
lea ecx, [ebp - 0xf0]
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xdc], 0xf
mov byte [ebp - 0xf0], 0
call fcn.0040eb70
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x114]
push 6
push str.sysenv
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x100], 0xf
mov byte [ebp - 0x114], 0
call fcn.0040eb70
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 4
mov esi, dword [esi + 0x118]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemTimeAsFileTime]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
sub ecx, 0xd53e8000
push 0
push 0x2710
sbb eax, 0x19db1de
push eax
push ecx
call fcn.004d1c30
sub eax, dword [esi + 0x18]
mov ecx, edx
mov dword [ebp - 0xf8], eax
lea eax, [ebp - 0xf0]
sbb ecx, dword [esi + 0x1c]
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0xf4], ecx
push eax
mov ecx, ebx
call fcn.004953e0
mov ecx, eax
call fcn.004953e0
mov esi, eax
cmp dword [esi + 8], 6
je 0x49def3
mov ecx, esi
call fcn.00495ad0
mov dword [esi + 8], 6
mov eax, dword [ebp - 0xf8]
mov dword [esi], eax
mov eax, dword [ebp - 0xf4]
mov dword [esi + 4], eax
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x100]
cmp edx, 0x10
jb 0x49df42
mov ecx, dword [ebp - 0x114]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x49df38
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49e7f8
push edx
push ecx
call fcn.004d0c91
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0xdc]
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x100], 0xf
mov byte [ebp - 0x114], 0
cmp edx, 0x10
jb 0x49df9e
mov ecx, dword [ebp - 0xf0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x49df94
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49e7fd
push edx
push ecx
call fcn.004d0c91
add esp, 8
push 0xb0
lea eax, [ebp - 0xd8]
mov dword [ebp - 0x28], 0x4a383534
push 0
push eax
mov dword [ebp - 0x24], 0x2573
call fcn.0056c1d0
add esp, 4
lea ecx, [ebp - 0xd8]
call fcn.00428700
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x168]
push 9
push str.timestamp
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x154], 0xf
mov byte [ebp - 0x168], 0
call fcn.0040eb70
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x12c]
push 6
push str.sysenv
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0xf
mov byte [ebp - 0x12c], 0
call fcn.0040eb70
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xf0]
push 7
push str.session
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xdc], 0xf
mov byte [ebp - 0xf0], 0
call fcn.0040eb70
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x150]
push 6
push str.sysenv
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0xf
mov byte [ebp - 0x150], 0
call fcn.0040eb70
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1b0]
push 6
push str.app_id
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x19c], 0xf
mov byte [ebp - 0x1b0], 0
call fcn.0040eb70
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x198]
push 6
push str.sysenv
mov dword [ebp - 0x188], 0
mov dword [ebp - 0x184], 0xf
mov byte [ebp - 0x198], 0
call fcn.0040eb70
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x180]
push 5
push str.agent
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x16c], 0xf
mov byte [ebp - 0x180], 0
call fcn.0040eb70
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x114]
push 6
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x100], 0xf
mov byte [ebp - 0x114], 0
push str.sysenv
call fcn.0040eb70
lea eax, [ebp - 0x1c8]
mov byte [ebp - 4], 0xf
push eax
lea eax, [ebp - 0xf0]
mov ecx, ebx
push eax
lea eax, [ebp - 0x150]
push eax
call fcn.004953e0
mov ecx, eax
call fcn.004953e0
mov ecx, eax
call fcn.004956c0
mov esi, eax
lea eax, [ebp - 0x168]
mov byte [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x12c]
mov ecx, ebx
push eax
call fcn.004953e0
mov ecx, eax
call fcn.004953e0
cmp dword [eax + 8], 6
jne 0x49e1c1
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0xf8], ecx
mov dword [ebp - 0xf4], eax
jmp 0x49e1e4
xorps xmm0, xmm0
movlpd qword [ebp - 0xfc], xmm0
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xf8], eax
lea eax, [ebp - 0x1b0]
mov ecx, ebx
push eax
lea eax, [ebp - 0x198]
push eax
call fcn.004953e0
mov ecx, eax
call fcn.004953e0
cmp dword [eax + 8], 6
jne 0x49e219
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], eax
jmp 0x49e233
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x134], eax
lea eax, [ebp - 0x180]
mov ecx, ebx
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.004953e0
mov ecx, eax
call fcn.004953e0
cmp dword [eax + 8], 6
jne 0x49e265
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x138], eax
jmp 0x49e27c
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
cmp dword [edi + 0x14], 0x10
mov eax, dword [edi + 0x10]
jb 0x49e287
mov edi, dword [edi]
push eax
mov edx, edi
lea ecx, [ebp - 0xc8]
call fcn.0040d530
add esp, 4
mov ecx, eax
push dword [ebp - 0x130]
push dword [ebp - 0x134]
push dword [ebp - 0x138]
push dword [ebp - 0x14]
call fcn.0049da90
mov ecx, eax
call fcn.0049da90
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
jb 0x49e2c6
mov esi, dword [esi]
push ecx
mov edx, esi
mov ecx, eax
call fcn.0040d530
add esp, 4
lea ecx, [ebp - 0x28]
push ecx
push dword [ebp - 0xf4]
mov ecx, eax
push dword [ebp - 0xf8]
call fcn.0049da90
push eax
call fcn.0040f1d0
mov byte [ebp - 4], 0xf
add esp, 8
mov edx, dword [ebp - 0x1b4]
cmp edx, 0x10
jb 0x49e331
mov ecx, dword [ebp - 0x1c8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x49e327
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49e802
push edx
push ecx
call fcn.004d0c91
add esp, 8
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x100]
mov dword [ebp - 0x1b8], 0
mov dword [ebp - 0x1b4], 0xf
mov byte [ebp - 0x1c8], 0
cmp edx, 0x10
jb 0x49e38a
mov ecx, dword [ebp - 0x114]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x49e380
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49e807
push edx
push ecx
call fcn.004d0c91
add esp, 8
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x16c]
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x100], 0xf
mov byte [ebp - 0x114], 0
cmp edx, 0x10
jb 0x49e3e3
mov ecx, dword [ebp - 0x180]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x49e3d9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49e80c
push edx
push ecx
call fcn.004d0c91
add esp, 8
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x184]
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x16c], 0xf
mov byte [ebp - 0x180], 0
cmp edx, 0x10
jb 0x49e43c
mov ecx, dword [ebp - 0x198]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x49e432
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49e811
push edx
push ecx
call fcn.004d0c91
add esp, 8
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x19c]
mov dword [ebp - 0x188], 0
mov dword [ebp - 0x184], 0xf
mov byte [ebp - 0x198], 0
cmp edx, 0x10
jb 0x49e495
mov ecx, dword [ebp - 0x1b0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x49e48b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49e816
push edx
push ecx
call fcn.004d0c91
add esp, 8
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x13c]
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x19c], 0xf
mov byte [ebp - 0x1b0], 0
cmp edx, 0x10
jb 0x49e4ee
mov ecx, dword [ebp - 0x150]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x49e4e4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49e81b
push edx
push ecx
call fcn.004d0c91
add esp, 8
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0xdc]
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0xf
mov byte [ebp - 0x150], 0
cmp edx, 0x10
jb 0x49e547
mov ecx, dword [ebp - 0xf0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x49e53d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49e820
push edx
push ecx
call fcn.004d0c91
add esp, 8
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x118]
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xdc], 0xf
mov byte [ebp - 0xf0], 0
cmp edx, 0x10
jb 0x49e5a0
mov ecx, dword [ebp - 0x12c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x49e596
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49e825
push edx
push ecx
call fcn.004d0c91
add esp, 8
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x154]
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0xf
mov byte [ebp - 0x12c], 0
cmp edx, 0x10
jb 0x49e5f9
mov ecx, dword [ebp - 0x168]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x49e5ef
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49e82a
push edx
push ecx
call fcn.004d0c91
add esp, 8
push 4
push str.sign
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0xf
mov byte [ebp - 0x150], 0
call fcn.0040eb70
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x12c]
push 6
push str.sysenv
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0xf
mov byte [ebp - 0x12c], 0
call fcn.0040eb70
push ecx
lea eax, [ebp - 0x168]
mov byte [ebp - 4], 0x12
push eax
lea ecx, [ebp - 0xc0]
call fcn.00427670
sub esp, 0x18
mov byte [ebp - 4], 0x13
lea edx, [ebp - 0x168]
mov ecx, esp
call fcn.004a6410
lea ecx, [ebp - 0x20]
call fcn.004a6670
mov edi, eax
lea eax, [ebp - 0x150]
mov byte [ebp - 4], 0x14
push eax
lea eax, [ebp - 0x12c]
mov ecx, ebx
push eax
call fcn.004953e0
mov ecx, eax
call fcn.004953e0
mov esi, eax
mov ecx, esi
call fcn.00495ad0
mov ecx, dword [edi]
mov dword [esi], ecx
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 8]
mov dword [esi + 8], ecx
lea ecx, [ebp - 0x20]
mov dword [edi], 0
mov dword [edi + 8], 0
call fcn.00495300
mov edx, dword [ebp - 0x154]
cmp edx, 0x10
jb 0x49e714
mov ecx, dword [ebp - 0x168]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x49e70a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49e82f
push edx
push ecx
call fcn.004d0c91
add esp, 8
mov edx, dword [ebp - 0x118]
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x154], 0xf
mov byte [ebp - 0x168], 0
cmp edx, 0x10
jb 0x49e769
mov ecx, dword [ebp - 0x12c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x49e75f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49e834
push edx
push ecx
call fcn.004d0c91
add esp, 8
mov edx, dword [ebp - 0x13c]
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0xf
mov byte [ebp - 0x12c], 0
cmp edx, 0x10
jb 0x49e7be
mov ecx, dword [ebp - 0x150]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x49e7b4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49e839
push edx
push ecx
call fcn.004d0c91
add esp, 8
lea ecx, [ebp - 0xd8]
call fcn.00427720
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d0a85
mov esp, ebp
pop ebp
ret 8
call fcn.0056efe9
call fcn.0056efe9
call fcn.0056efe9
call fcn.0056efe9
call fcn.0056efe9
call fcn.0056efe9
call fcn.0056efe9
call fcn.0056efe9
call fcn.0056efe9
call fcn.0056efe9
call fcn.0056efe9
call fcn.0056efe9
call fcn.0056efe9
call fcn.0056efe9
call fcn.0056efe9
call fcn.0056efe9
call fcn.0056efe9
int3