Function at 0x40adfa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, 0x1484
call fcn.004d7290
sub esp, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [esp + 0x10], str.Starting_on_check_rc_files
mov dword [esp + 0xc], global___func__.126
mov dword [esp + 8], 0x1f
mov dword [esp + 4], str.rootcheck_check_rc_files.c
mov dword [esp], 0x4eae2e
call dbg._mtdebug1
jmp 0x40b541
mov dword [esp + 4], 0xa
lea eax, [ebp - 0x431]
mov dword [esp], eax
call sym._strchr
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x40ae6e
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0
lea eax, [ebp - 0x431]
mov dword [ebp - 0x1c], eax
jmp 0x40aea2
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
cmp al, 0x20
je 0x40ae8d
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
cmp al, 9
jne 0x40ae93
add dword [ebp - 0x1c], 1
jmp 0x40aea2
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
cmp al, 0x23
jne 0x40aeae
jmp 0x40b53b
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test al, al
jne 0x40ae79
jmp 0x40aeaf
nop
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test al, al
je 0x40b531
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
jmp 0x40aeef
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
cmp al, 0x20
je 0x40aedf
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
cmp al, 9
jne 0x40aeeb
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0
add dword [ebp - 0x1c], 1
jmp 0x40aef9
add dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test al, al
jne 0x40aecb
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test al, al
je 0x40b534
jmp 0x40af54
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
cmp al, 0x21
jne 0x40af37
add dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
cmp al, 0x20
je 0x40af2b
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
cmp al, 9
jne 0x40af54
add dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
jmp 0x40af5e
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
cmp al, 0x20
je 0x40af4f
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
cmp al, 9
jne 0x40b537
add dword [ebp - 0x1c], 1
nop
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test al, al
jne 0x40af09
mov dword [esp + 4], 0x3a
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._strchr
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x40af92
mov eax, dword [ebp - 0x24]
mov byte [eax], 0
add dword [ebp - 0x24], 1
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
cmp al, 0x3a
jne 0x40af92
add dword [ebp - 0x24], 1
mov dword [esp + 4], 0x20
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._strchr
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x40afd6
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0
mov dword [esp + 4], 9
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._strchr
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x40afd6
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0
add dword [ebp - 0x18], 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x2a
jne 0x40b1c5
mov eax, dword [0x550150]
cmp eax, 0x1ff
jle 0x40b02d
mov dword [esp + 0x14], 0x200
mov dword [esp + 0x10], str._1255_:_Maximum_number_of_global_files_reached:__d
mov dword [esp + 0xc], global___func__.126
mov dword [esp + 8], 0x7e
mov dword [esp + 4], str.rootcheck_check_rc_files.c
mov dword [esp], 0x4eae2e
call dbg._mterror
jmp 0x40b541
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x2f
jne 0x40b03f
add dword [ebp - 0xc], 1
mov eax, dword [0x550148]
mov edx, dword [0x550150]
shl edx, 2
lea ebx, [eax + edx]
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strdup
mov dword [ebx], eax
mov eax, dword [0x55014c]
mov edx, dword [0x550150]
shl edx, 2
lea ebx, [eax + edx]
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._strdup
mov dword [ebx], eax
mov eax, dword [0x55014c]
mov edx, dword [0x550150]
shl edx, 2
add eax, edx
mov eax, dword [eax]
test eax, eax
je 0x40b0ab
mov eax, dword [0x550148]
mov edx, dword [0x550150]
shl edx, 2
add eax, edx
mov eax, dword [eax]
test eax, eax
jne 0x40b187
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x4eae6c
mov dword [esp + 0xc], global___func__.126
mov dword [esp + 8], 0x8d
mov dword [esp + 4], str.rootcheck_check_rc_files.c
mov dword [esp], 0x4eae2e
call dbg._mterror
mov eax, dword [0x550148]
mov edx, dword [0x550150]
shl edx, 2
add eax, edx
mov eax, dword [eax]
test eax, eax
je 0x40b12b
mov eax, dword [0x550148]
mov edx, dword [0x550150]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov dword [esp], eax
call sym._free
mov eax, dword [0x55014c]
mov edx, dword [0x550150]
shl edx, 2
add eax, edx
mov eax, dword [eax]
test eax, eax
je 0x40b15b
mov eax, dword [0x55014c]
mov edx, dword [0x550150]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov dword [esp], eax
call sym._free
mov eax, dword [0x550148]
mov edx, dword [0x550150]
shl edx, 2
add eax, edx
mov dword [eax], 0
mov eax, dword [0x55014c]
mov edx, dword [0x550150]
shl edx, 2
add eax, edx
mov dword [eax], 0
mov eax, dword [0x550150]
add eax, 1
mov dword [0x550150], eax
mov eax, dword [0x550148]
mov edx, dword [0x550150]
shl edx, 2
add eax, edx
mov dword [eax], 0
mov eax, dword [0x55014c]
mov edx, dword [0x550150]
shl edx, 2
add eax, edx
mov dword [eax], 0
jmp 0x40b541
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strlen
cmp eax, 3
jbe 0x40b220
mov eax, dword [ebp - 0xc]
add eax, 1
movzx eax, byte [eax]
cmp al, 0x3a
jne 0x40b220
mov eax, dword [ebp - 0xc]
add eax, 2
movzx eax, byte [eax]
cmp al, 0x5c
jne 0x40b220
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x4eaea1
mov dword [esp + 4], 0x401
lea eax, [ebp - 0x832]
mov dword [esp], eax
call sym._snprintf_3
mov dword [ebp - 0x20], eax
jmp 0x40b257
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x5c
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x4eaea4
mov dword [esp + 4], 0x401
lea eax, [ebp - 0x832]
mov dword [esp], eax
call sym._snprintf_3
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
js 0x40b267
mov eax, dword [ebp - 0x20]
cmp eax, 0x400
jbe 0x40b2a2
lea eax, [ebp - 0x832]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Path_file_was_truncated___s__n
mov dword [esp + 0xc], global___func__.126
mov dword [esp + 8], 0xaf
mov dword [esp + 4], str.rootcheck_check_rc_files.c
mov dword [esp], 0x4eae2e
call dbg._mtdebug2
jmp 0x40b541
mov dword [esp + 4], 0x5c
lea eax, [ebp - 0x832]
mov dword [esp], eax
call sym._strrchr
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x40b53d
add dword [ebp - 0x28], 1
mov dword [esp + 8], 0x401
lea eax, [ebp - 0x832]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1433]
mov dword [esp], eax
call sym._strncpy
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strlen
mov ebx, eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._strlen
sub ebx, eax
mov edx, ebx
mov byte [ebp + edx - 0x1433], 0
lea eax, [ebp - 0x832]
mov dword [esp], eax
call dbg.check_ignore
test eax, eax
jne 0x40b540
lea eax, [ebp - 0x832]
mov dword [esp], eax
call dbg.is_file
test eax, eax
je 0x40b53a
mov dword [ebp - 0x1468], 0x746f6f52
mov dword [ebp - 0x1464], 0x2074696b
mov dword [ebp - 0x1460], 0x27732527
mov dword [ebp - 0x145c], 0x74656420
mov dword [ebp - 0x1458], 0x65746365
mov dword [ebp - 0x1454], 0x79622064
mov dword [ebp - 0x1450], 0x65687420
mov dword [ebp - 0x144c], 0x65727020
mov dword [ebp - 0x1448], 0x636e6573
mov dword [ebp - 0x1444], 0x666f2065
mov dword [ebp - 0x1440], 0x6c696620
mov dword [ebp - 0x143c], 0x25272065
mov dword [ebp - 0x1438], 0x2e27732a
mov byte [ebp - 0x1434], 0
lea eax, [ebp - 0x832]
mov dword [esp], eax
call sym._strlen
mov edx, eax
lea eax, [ebp - 0x832]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x1468]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._snprintf_3
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
js 0x40b4ce
mov eax, dword [ebp - 0x2c]
cmp eax, 0x7ff
ja 0x40b463
lea eax, [ebp - 0x832]
mov dword [esp], eax
call sym._strlen
mov edx, eax
lea eax, [ebp - 0x832]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x1468]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x800
lea eax, [ebp - 0x1032]
mov dword [esp], eax
call sym._snprintf_3
jmp 0x40b4b6
mov eax, dword [ebp - 0x2c]
sub eax, 0x7ff
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x832]
mov dword [esp], eax
call sym._strlen
sub eax, dword [ebp - 0x30]
mov edx, eax
lea eax, [ebp - 0x832]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x1468]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x800
lea eax, [ebp - 0x1032]
mov dword [esp], eax
call sym._snprintf_3
lea eax, [ebp - 0x1032]
mov dword [esp + 4], eax
mov dword [esp], 3
call dbg.notify_rk
jmp 0x40b528
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov ebx, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
lea edx, [ebp - 0x832]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x4eaecc
mov dword [esp + 0xc], global___func__.126
mov dword [esp + 8], 0xd2
mov dword [esp + 4], str.rootcheck_check_rc_files.c
mov dword [esp], 0x4eae2e
call dbg._mtdebug2
mov dword [ebp - 0x14], 1
jmp 0x40b541
nop
jmp 0x40b541
nop
jmp 0x40b541
nop
jmp 0x40b541
nop
jmp 0x40b541
nop
jmp 0x40b541
nop
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x431]
mov dword [esp], eax
call sym._fgets
test eax, eax
jne 0x40ae49
cmp dword [ebp - 0x14], 0
jne 0x40b5a7
mov eax, dword [ebp - 0x18]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.No_presence_of_public_rootkits_detected._Analyzed__d_files.
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x1032]
mov dword [esp], eax
call sym._snprintf_3
lea eax, [ebp - 0x1032]
mov dword [esp + 4], eax
mov dword [esp], 0
call dbg.notify_rk
nop
mov ebx, dword [ebp - 4]
leave
ret