Function at 0x45c2e0
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x4fca20]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
lea eax, [ebp - 0x10]
push eax
push str.NTDLL.DLL
mov dword [ebp - 0x4c], ecx
mov bl, 0x72
mov dword [ebp - 0x10], 0x4c72644c
mov dword [ebp - 0xc], 0x4464616f
mov word [ebp - 8], 0x6c6c
mov byte [ebp - 6], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
lea ecx, [ebp - 0x28]
push ecx
push str.NTDLL.DLL
mov dword [0x4fe920], eax
mov dword [ebp - 0x28], 0x4772644c
mov dword [ebp - 0x24], 0x72507465
mov dword [ebp - 0x20], 0x6465636f
mov dword [ebp - 0x1c], 0x41657275
mov dword [ebp - 0x18], 0x65726464
mov word [ebp - 0x14], 0x7373
mov byte [ebp - 0x12], 0
call esi
push eax
call edi
cmp dword [0x4fe920], 0
mov dword [0x4fe924], eax
je 0x45c741
test eax, eax
je 0x45c741
lea edx, [ebp - 0x48]
push edx
push str.NTDLL.DLL
mov word [ebp - 0x48], 0x644c
mov byte [ebp - 0x46], bl
mov dword [ebp - 0x45], 0x50746547
mov byte [ebp - 0x41], bl
mov dword [ebp - 0x40], 0x6465636f
mov byte [ebp - 0x3c], 0x75
mov byte [ebp - 0x3b], bl
mov dword [ebp - 0x3a], 0x64644165
mov byte [ebp - 0x36], bl
mov dword [ebp - 0x35], 0x46737365
mov byte [ebp - 0x31], 0x6f
mov byte [ebp - 0x30], bl
mov dword [ebp - 0x2f], 0x6c6c6143
mov byte [ebp - 0x2b], 0x65
mov byte [ebp - 0x2a], bl
mov byte [ebp - 0x29], 0
call esi
push eax
call edi
cmp dword [0x4fe940], 0
mov dword [0x4fe928], eax
jne 0x45c3ff
push str.NtOpenKeyEx
push str.NTDLL.DLL
call esi
push eax
call edi
mov dword [0x4fe940], eax
cmp dword [0x4fe944], 0
jne 0x45c41c
push str.NtQueryValueKey
push str.NTDLL.DLL
call esi
push eax
call edi
mov dword [0x4fe944], eax
cmp dword [0x4fe93c], 0
jne 0x45c439
push str.SHGetKnownFolderPath
push str.Shell32.DLL
call esi
push eax
call edi
mov dword [0x4fe93c], eax
mov eax, dword [0x4fe920]
push 0x45bdd0
push eax
push 0x4d303c
call fcn.00459ee0
mov ecx, dword [0x4fe924]
push 0x45bd10
push ecx
push 0x4d303c
call fcn.00459ee0
mov edx, dword [0x4fe928]
push 0x45bd50
push edx
push 0x4d303c
call fcn.00459ee0
mov eax, dword [0x4fe948]
push 0x45a500
push eax
push 0x4d3030
call fcn.00459ee0
mov ecx, dword [0x4fe94c]
push 0x45a880
push ecx
push 0x4d3030
call fcn.00459ee0
mov edx, dword [0x4fe950]
push 0x4598b0
push edx
push str.Winmm.dll
call fcn.00459ee0
mov eax, dword [0x4fe954]
add esp, 0x48
push 0x459870
push eax
push str.Winmm.dll
call fcn.00459ee0
mov ecx, dword [0x4fe92c]
push 0x4598f0
push ecx
push str.Comctl32.dll
call fcn.00459ee0
mov edx, dword [0x4fe958]
push method.ATL::CComObject_class_CATLBrowserHost_.virtual_12
push edx
push str.Wininet.dll
call fcn.00459ee0
mov eax, dword [0x4fc264]
push method.AlxLocalExecuter.1.virtual_128
push eax
push str.Wintrust.dll
call fcn.00459ee0
mov ecx, dword [0x4fe95c]
push 0x459af0
push ecx
push str.Crypt32.dll
call fcn.00459ee0
mov edx, dword [0x4fe960]
push 0x459910
push edx
push str.User32.dll
call fcn.00459ee0
mov eax, dword [0x4fe970]
add esp, 0x48
push 0x459a30
push eax
push str.User32.dll
call fcn.00459ee0
mov ecx, dword [0x4fe974]
push 0x459a50
push ecx
push str.User32.dll
call fcn.00459ee0
mov edx, dword [0x4fe978]
push 0x459a70
push edx
push str.User32.dll
call fcn.00459ee0
mov eax, dword [0x4fe97c]
push 0x459a90
push eax
push str.User32.dll
call fcn.00459ee0
mov ecx, dword [0x4fe980]
push 0x459aa0
push ecx
push str.User32.dll
call fcn.00459ee0
mov edx, dword [0x4fe984]
push 0x459ac0
push edx
push str.User32.dll
call fcn.00459ee0
mov eax, dword [0x4fe988]
add esp, 0x48
push 0x45aa00
push eax
push str.User32.dll
call fcn.00459ee0
mov ecx, dword [0x4fe964]
push 0x459930
push ecx
push str.Wininet.dll
call fcn.00459ee0
mov edx, dword [0x4fe968]
push 0x4599a0
push edx
push str.Wininet.dll
call fcn.00459ee0
mov eax, dword [0x4fe96c]
push 0x459a10
push eax
push str.Winmm.dll
call fcn.00459ee0
mov ecx, dword [0x4fe930]
push 0x459a20
push ecx
push str.Credui.dll
call fcn.00459ee0
mov edx, dword [0x4fe934]
push 0x459a20
push edx
push str.Credui.dll
call fcn.00459ee0
mov eax, dword [0x4fe938]
add esp, 0x48
push 0x459ae0
push eax
push str.dfdll.dll
call fcn.00459ee0
mov ecx, dword [0x4fc268]
push method.AlxLocalExecuter.1.virtual_128
push ecx
push str.DSound.dll
call fcn.00459ee0
mov edx, dword [0x4fe98c]
push method.AlxLocalExecuter.1.virtual_128
push edx
push str.Winmm.dll
call fcn.00459ee0
mov eax, dword [0x4fe990]
push 0x459c00
push eax
push str.Gdi32.dll
call fcn.00459ee0
mov ecx, dword [0x4fe93c]
push 0x45a680
push ecx
push str.Shell32.dll
call fcn.00459ee0
mov edx, dword [0x4fe994]
push 0x45ae70
push edx
push str.Kernel32.dll
call fcn.00459ee0
mov eax, dword [0x4fe998]
add esp, 0x48
push 0x45aed0
push eax
push str.Kernel32.dll
call fcn.00459ee0
mov ecx, dword [0x4fe940]
push 0x459cd0
push ecx
push 0x4d303c
call fcn.00459ee0
mov edx, dword [0x4fe944]
push 0x45ac90
push edx
push 0x4d303c
call fcn.00459ee0
mov eax, dword [0x4fe99c]
push method.boost::detail::sp_counted_impl_p_class_KServerList_.virtual_12
push eax
push str.Comdlg32.dll
call fcn.00459ee0
mov ecx, dword [0x4fe9a0]
push method.boost::detail::sp_counted_impl_p_class_KServerList_.virtual_12
push ecx
push str.Comdlg32.dll
call fcn.00459ee0
add esp, 0x3c
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x4c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047e4d2
mov esp, ebp
pop ebp
ret