Function at 0x44e1d0
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x4e0240]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
lea eax, [ebp - 0x10]
push eax
push str.NTDLL.DLL
mov dword [ebp - 0x4c], ecx
mov bl, 0x72
mov dword [ebp - 0x10], 0x4c72644c
mov dword [ebp - 0xc], 0x4464616f
mov word [ebp - 8], 0x6c6c
mov byte [ebp - 6], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
lea ecx, [ebp - 0x28]
push ecx
push str.NTDLL.DLL
mov dword [0x4e20a4], eax
mov dword [ebp - 0x28], 0x4772644c
mov dword [ebp - 0x24], 0x72507465
mov dword [ebp - 0x20], 0x6465636f
mov dword [ebp - 0x1c], 0x41657275
mov dword [ebp - 0x18], 0x65726464
mov word [ebp - 0x14], 0x7373
mov byte [ebp - 0x12], 0
call esi
push eax
call edi
cmp dword [0x4e20a4], 0
mov dword [0x4e20a8], eax
je 0x44e5a5
test eax, eax
je 0x44e5a5
lea edx, [ebp - 0x48]
push edx
push str.NTDLL.DLL
mov word [ebp - 0x48], 0x644c
mov byte [ebp - 0x46], bl
mov dword [ebp - 0x45], 0x50746547
mov byte [ebp - 0x41], bl
mov dword [ebp - 0x40], 0x6465636f
mov byte [ebp - 0x3c], 0x75
mov byte [ebp - 0x3b], bl
mov dword [ebp - 0x3a], 0x64644165
mov byte [ebp - 0x36], bl
mov dword [ebp - 0x35], 0x46737365
mov byte [ebp - 0x31], 0x6f
mov byte [ebp - 0x30], bl
mov dword [ebp - 0x2f], 0x6c6c6143
mov byte [ebp - 0x2b], 0x65
mov byte [ebp - 0x2a], bl
mov byte [ebp - 0x29], 0
call esi
push eax
call edi
cmp dword [0x4e20c4], 0
mov dword [0x4e20ac], eax
jne 0x44e2ef
push str.NtQueryValueKey
push str.NTDLL.DLL
call esi
push eax
call edi
mov dword [0x4e20c4], eax
cmp dword [0x4e20c0], 0
jne 0x44e30c
push str.SHGetKnownFolderPath
push str.Shell32.DLL
call esi
push eax
call edi
mov dword [0x4e20c0], eax
mov eax, dword [0x4e20a4]
push 0x44ded0
push eax
push 0x4bb01c
call fcn.0044c760
mov ecx, dword [0x4e20a8]
push 0x44de30
push ecx
push 0x4bb01c
call fcn.0044c760
mov edx, dword [0x4e20ac]
push 0x44de70
push edx
push 0x4bb01c
call fcn.0044c760
mov eax, dword [0x4e20c8]
push 0x44cb90
push eax
push 0x4bb010
call fcn.0044c760
mov ecx, dword [0x4e20cc]
push 0x44ccf0
push ecx
push 0x4bb010
call fcn.0044c760
mov edx, dword [0x4e20d0]
push 0x44c3a0
push edx
push str.Winmm.dll
call fcn.0044c760
mov eax, dword [0x4e20d4]
add esp, 0x48
push 0x44c360
push eax
push str.Winmm.dll
call fcn.0044c760
mov ecx, dword [0x4e20b0]
push 0x44c3e0
push ecx
push str.Comctl32.dll
call fcn.0044c760
mov edx, dword [0x4e20d8]
push method.ATL::CComObject_class_CATLBrowserHost_.virtual_12
push edx
push str.Wininet.dll
call fcn.0044c760
mov eax, dword [0x4dfad4]
push method.AlxLocalExecuter.1.virtual_128
push eax
push str.Wintrust.dll
call fcn.0044c760
mov ecx, dword [0x4e20dc]
push 0x44c5e0
push ecx
push str.Crypt32.dll
call fcn.0044c760
mov edx, dword [0x4e20e0]
push 0x44c400
push edx
push str.User32.dll
call fcn.0044c760
mov eax, dword [0x4e20f0]
add esp, 0x48
push 0x44c520
push eax
push str.User32.dll
call fcn.0044c760
mov ecx, dword [0x4e20f4]
push 0x44c540
push ecx
push str.User32.dll
call fcn.0044c760
mov edx, dword [0x4e20f8]
push 0x44c560
push edx
push str.User32.dll
call fcn.0044c760
mov eax, dword [0x4e20fc]
push 0x44c580
push eax
push str.User32.dll
call fcn.0044c760
mov ecx, dword [0x4e2100]
push 0x44c590
push ecx
push str.User32.dll
call fcn.0044c760
mov edx, dword [0x4e2104]
push 0x44c5b0
push edx
push str.User32.dll
call fcn.0044c760
mov eax, dword [0x4e2108]
add esp, 0x48
push 0x44cf10
push eax
push str.User32.dll
call fcn.0044c760
mov ecx, dword [0x4e20e4]
push 0x44c420
push ecx
push str.Wininet.dll
call fcn.0044c760
mov edx, dword [0x4e20e8]
push 0x44c490
push edx
push str.Wininet.dll
call fcn.0044c760
mov eax, dword [0x4e20ec]
push 0x44c500
push eax
push str.Winmm.dll
call fcn.0044c760
mov ecx, dword [0x4e20b4]
push 0x44c510
push ecx
push str.Credui.dll
call fcn.0044c760
mov edx, dword [0x4e20b8]
push 0x44c510
push edx
push str.Credui.dll
call fcn.0044c760
mov eax, dword [0x4e20bc]
add esp, 0x48
push 0x44c5d0
push eax
push str.dfdll.dll
call fcn.0044c760
mov ecx, dword [0x4dfad8]
push method.AlxLocalExecuter.1.virtual_128
push ecx
push str.DSound.dll
call fcn.0044c760
mov edx, dword [0x4e210c]
push method.AlxLocalExecuter.1.virtual_128
push edx
push str.Winmm.dll
call fcn.0044c760
mov eax, dword [0x4e2110]
push 0x44c6f0
push eax
push str.Gdi32.dll
call fcn.0044c760
mov ecx, dword [0x4e20c0]
push 0x44ce50
push ecx
push str.Shell32.dll
call fcn.0044c760
mov edx, dword [0x4e20c4]
push 0x44d1a0
push edx
push 0x4bb01c
call fcn.0044c760
add esp, 0x48
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x4c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046e452
mov esp, ebp
pop ebp
ret