Function at 0x469540
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56754a
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x5c3484]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xac], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0xa8], 1
cmp dword [0x5c3500], eax
je 0x46963f
push 0x57b10c
mov dword [ebp - 0xa0], eax
xor ebx, ebx
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x9c], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x469635
push str.RtlGetNtVersionNumbers
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x469611
lea ecx, [ebp - 0x9c]
push ecx
lea ecx, [ebp - 0xa4]
push ecx
lea ecx, [ebp - 0xa0]
push ecx
call eax
movzx eax, word [ebp - 0x9c]
mov ebx, 1
mov dword [ebp - 0x9c], eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
je 0x469635
mov eax, dword [0x5cd6c8]
mov ecx, 1
cmp dword [ebp - 0xa0], 6
cmovae eax, ecx
mov dword [0x5cd6c8], eax
mov dword [0x5c3500], 0
mov esi, dword [ebp - 0xac]
xor eax, eax
mov ecx, esi
mov dword [ebp - 0x8c], 0x7f007f
push 0x36
mov dword [ebp - 0x88], 0x7f007f
mov dword [ebp - 0x84], 0x7f007f
mov dword [ebp - 0x80], 0x7f007f
mov dword [ebp - 0x70], 0x5c002e
mov dword [ebp - 0x6c], 0x6f0063
mov dword [ebp - 0x68], 0x31006d
mov dword [ebp - 0x64], 0x7b002e
mov dword [ebp - 0x60], 0x310032
mov dword [ebp - 0x5c], 0x430045
mov dword [ebp - 0x58], 0x300032
mov dword [ebp - 0x54], 0x300032
mov dword [ebp - 0x50], 0x33002d
mov dword [ebp - 0x4c], 0x450041
mov dword [ebp - 0x48], 0x2d0041
mov dword [ebp - 0x44], 0x300031
mov dword [ebp - 0x40], 0x390036
mov dword [ebp - 0x3c], 0x41002d
mov dword [ebp - 0x38], 0x440032
mov dword [ebp - 0x34], 0x2d0044
mov dword [ebp - 0x30], 0x380030
mov dword [ebp - 0x2c], 0x300030
mov dword [ebp - 0x28], 0x420032
mov dword [ebp - 0x24], 0x300033
mov dword [ebp - 0x20], 0x300033
mov dword [ebp - 0x1c], 0x440039
mov dword [ebp - 0x18], 0x5c007d
mov word [ebp - 0x14], ax
push str.PCJIAMIRECYCLER.5ef4af3a_f726_11d0_b8a2_00c04fc309a4
cmp dword [0x5cd6c8], eax
je 0x4697e5
mov dword [ebp - 0x98], 0x7f005c
mov dword [ebp - 0x94], 0x7f007f
mov dword [ebp - 0x90], 0x7f007f
mov dword [ebp - 0x7c], 0x2e00e3
mov dword [ebp - 0x78], 0x5c002e
mov dword [ebp - 0x74], 0x2e002e
call fcn.00483380
lea ecx, [ebp - 0x98]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x469767
sub ecx, edx
lea eax, [ebp - 0x98]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00432e20
push 7
xor eax, eax
mov dword [ebp - 0xb4], 0
push str.PCjiami
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0xb0], 7
mov word [ebp - 0xc4], ax
call fcn.00483380
mov dword [ebp - 0xa8], 3
cmp dword [ebp - 0xb0], 8
lea ecx, [ebp - 0xc4]
push dword [ebp - 0xb4]
cmovae ecx, dword [ebp - 0xc4]
mov dword [ebp - 4], 1
push ecx
jmp 0x46988b
mov dword [ebp - 0x90], 0x7f005c
mov dword [ebp - 0x7c], 0x7f007f
mov dword [ebp - 0x78], 0x7f007f
mov dword [ebp - 0x74], 0x2e00e3
call fcn.00483380
lea eax, [ebp - 0x90]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x469812
sub eax, edx
mov ecx, esi
sar eax, 1
push eax
lea eax, [ebp - 0x90]
push eax
call fcn.00432e20
push 7
xor eax, eax
mov dword [ebp - 0xb4], 0
push str.PCjiami
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0xb0], 7
mov word [ebp - 0xc4], ax
call fcn.00483380
mov dword [ebp - 0xa8], 5
cmp dword [ebp - 0xb0], 8
lea eax, [ebp - 0xc4]
push dword [ebp - 0xb4]
cmovae eax, dword [ebp - 0xc4]
mov dword [ebp - 4], 2
push eax
mov ecx, esi
call fcn.00432e20
lea ecx, [ebp - 0xc4]
call fcn.004191d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045fbca
mov esp, ebp
pop ebp
ret 4