Function at 0x40ab54
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x28
mov eax, 0x448480
call fcn.00434949
mov edi, dword [ebp + 8]
lea ecx, [edi + 4]
mov dword [edi], vtable.CSerialManager.0
call fcn.00401cc4
and dword [ebp - 4], 0
lea ecx, [edi + 8]
call fcn.00401cc4
lea ecx, [edi + 0x10c]
call fcn.00401cc4
lea ecx, [edi + 0x110]
call fcn.00401cc4
lea ecx, [edi + 0x114]
call fcn.00401cc4
lea ecx, [edi + 0x118]
call fcn.00401cc4
lea ecx, [edi + 0x11c]
call fcn.00401cc4
lea ecx, [edi + 0x120]
call fcn.00401cc4
lea esi, [edi + 0x124]
mov ecx, esi
call fcn.00401cc4
push 0
mov byte [ebp - 4], 8
call fcn.0043218a
pop ecx
push eax
call fcn.0043215b
mov ecx, esi
mov dword [esp], 0x45164c
call fcn.00401afc
call fcn.00419238
push eax
lea ecx, [ebp - 0x10]
call fcn.004017d2
mov eax, 0x1000
mov ecx, 0x800
mov byte [ebp - 4], 9
call fcn.0040851a
mov esi, eax
lea eax, [esi + 1]
push eax
call fcn.00410c0e
and dword [ebp - 0x14], 0
test esi, esi
pop ecx
mov ebx, eax
jle 0x40ac3c
push 0x7e
pop eax
push 0x20
pop ecx
call fcn.0040851a
mov ecx, dword [ebp - 0x14]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
mov byte [ecx + ebx], al
jl 0x40ac23
push ebx
lea ecx, [ebp - 0x10]
mov byte [ebx + esi], 0
call fcn.00401afc
push ebx
call fcn.00410c13
mov eax, esi
cdq
and edx, 7
add eax, edx
pop ecx
mov esi, eax
sar esi, 3
push esi
push 0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.004015c1
push eax
lea ecx, [edi + 4]
mov byte [ebp - 4], 0xa
call fcn.0040191d
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004017b8
lea eax, [esi + esi]
push eax
mov dword [ebp - 0x18], eax
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.004015c1
push eax
lea ecx, [edi + 8]
mov byte [ebp - 4], 0xb
call fcn.0040191d
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004017b8
mov ebx, esi
imul ebx, ebx, 3
push ebx
push dword [ebp - 0x18]
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.004015c1
push eax
lea ecx, [edi + 0x10c]
mov byte [ebp - 4], 0xc
call fcn.0040191d
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004017b8
mov eax, esi
shl eax, 2
push eax
mov dword [ebp - 0x14], eax
push ebx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.004015c1
push eax
lea ecx, [edi + 0x110]
mov byte [ebp - 4], 0xd
call fcn.0040191d
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004017b8
mov ebx, esi
imul ebx, ebx, 5
push ebx
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.004015c1
push eax
lea ecx, [edi + 0x114]
mov byte [ebp - 4], 0xe
call fcn.0040191d
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004017b8
mov eax, esi
imul eax, eax, 6
push eax
mov dword [ebp - 0x14], eax
push ebx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.004015c1
push eax
lea ecx, [edi + 0x118]
mov byte [ebp - 4], 0xf
call fcn.0040191d
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004017b8
imul esi, esi, 7
push esi
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.004015c1
lea ebx, [edi + 0x11c]
push eax
mov ecx, ebx
mov byte [ebp - 4], 0x10
call fcn.0040191d
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004017b8
push esi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.00408c14
push eax
lea ecx, [edi + 0x120]
mov byte [ebp - 4], 0x11
call fcn.0040191d
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004017b8
mov ecx, edi
call fcn.0040affa
lea esi, [edi + 0x10c]
push esi
push ecx
mov dword [ebp - 0x1c], esp
mov ecx, esp
push ebx
call fcn.00401ca6
call fcn.0040bb2b
jmp 0x40ae1b
mov ebx, dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
call ebx
push str.NtQueryInformationProcess
mov dword [ebp - 0x18], eax
push str.ntdll.dll
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
mov dword [ebp - 0x1c], eax
jne 0x40ae49
and dword [ebp - 0x14], eax
jmp 0x40ae91
push dword [ebp - 0x18]
or dword [ebp - 0x14], 0xffffffff
push 0
push 0x400
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
test eax, eax
mov dword [ebp - 0x18], eax
jne 0x40ae6a
or dword [ebp - 0x14], 0xffffffff
jmp 0x40ae91
push 0
push 0x18
lea ecx, [ebp - 0x34]
push ecx
push 0
push eax
call dword [ebp - 0x1c]
test eax, eax
jne 0x40ae82
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
call ebx
push eax
call fcn.0040cea7
cmp dword [ebp - 0x14], 0
pop ecx
je 0x40af37
test eax, eax
je 0x40af37
cmp dword [ebp - 0x14], eax
jne 0x40af37
push dword [ebp - 0x14]
lea ebx, [ebp - 0x14]
call fcn.0040cf3a
mov byte [ebp - 4], 0x13
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [esp], str.explorer.exe
push dword [ebp - 0x14]
call esi
test eax, eax
jne 0x40af14
push str.cmd.exe
push dword [ebp - 0x14]
call esi
test eax, eax
jne 0x40af14
push 0x14
lea eax, [ebp - 0x1c]
lea esi, [edi + 0x10c]
push eax
mov ecx, esi
call fcn.00408c37
push eax
mov ecx, esi
mov byte [ebp - 4], 0x14
call fcn.0040191d
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004017b8
jmp 0x40af32
lea eax, [edi + 0x10c]
push eax
push ecx
lea eax, [edi + 0x11c]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
call fcn.00401ca6
call fcn.0040bb2b
mov ecx, dword [ebp - 0x14]
jmp 0x40af53
push 0x14
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
call fcn.00408c37
push eax
mov ecx, esi
mov byte [ebp - 4], 0x12
call fcn.0040191d
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004017b8
jmp 0x40af6b
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004017b8
mov eax, edi
call fcn.00434a21
ret 4