Function at 0x4bde30
Capabilities:
Check for peb ntglobalflag flag
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x601a5e
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
push ebx
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x7c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x8c]
push edi
call fcn.004bf500
xor eax, eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x70], eax
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x1c]
mov esi, str.Keylogger
push ecx
mov dword [esp + 0x7c], esi
call fcn.004c0640
mov byte [esp + 0x84], 1
lea edx, [esp + 0x14]
push edx
mov ecx, str.Keylog
call fcn.0040b760
mov byte [esp + 0x84], 2
lea eax, [esp + 0x14]
push eax
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 1
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], esi
call fcn.004c0640
mov byte [esp + 0x84], 4
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Monitor
call fcn.0040b760
mov byte [esp + 0x84], 5
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 4
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
mov esi, str.Spyware
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], esi
call fcn.004c0640
mov byte [esp + 0x84], 7
lea ecx, [esp + 0x14]
push ecx
mov ecx, 0x6d97dc
call fcn.0040b760
mov byte [esp + 0x84], 8
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 7
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], esi
call fcn.004c0640
mov byte [esp + 0x84], 0xa
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.PasswordStealer
call fcn.0040b760
mov byte [esp + 0x84], 0xb
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0xa
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], str.Trojan
call fcn.004c0640
mov byte [esp + 0x84], 0xd
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Trojan
call fcn.0040b760
mov byte [esp + 0x84], 0xe
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0xd
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
mov esi, 0x6d9800
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], esi
call fcn.004c0640
mov byte [esp + 0x84], 0x10
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.0040b760
mov byte [esp + 0x84], 0x11
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x10
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], esi
call fcn.004c0640
mov byte [esp + 0x84], 0x13
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.RemoteControl
call fcn.0040b760
mov byte [esp + 0x84], 0x14
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x13
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], esi
call fcn.004c0640
mov byte [esp + 0x84], 0x16
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.RemoteConnection
call fcn.0040b760
mov byte [esp + 0x84], 0x17
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x16
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], esi
call fcn.004c0640
mov byte [esp + 0x84], 0x19
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.RemoteAdmin
call fcn.0040b760
mov byte [esp + 0x84], 0x1a
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x19
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], esi
call fcn.004c0640
mov byte [esp + 0x84], 0x1c
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.RemoteManipulator
call fcn.0040b760
mov byte [esp + 0x84], 0x1d
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x1c
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], esi
push eax
call fcn.004c0640
mov byte [esp + 0x84], 0x1f
lea ecx, [esp + 0x14]
push ecx
mov ecx, 0x6d9850
call fcn.0040b760
mov byte [esp + 0x84], 0x20
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x1f
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
mov esi, str.Ransomware
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], esi
call fcn.004c0640
mov byte [esp + 0x84], 0x22
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Ransom
call fcn.0040b760
mov byte [esp + 0x84], 0x23
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x22
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], esi
call fcn.004c0640
mov byte [esp + 0x84], 0x25
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Cryptor
call fcn.0040b760
mov byte [esp + 0x84], 0x26
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x25
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], esi
call fcn.004c0640
mov byte [esp + 0x84], 0x28
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Kryptik
call fcn.0040b760
mov byte [esp + 0x84], 0x29
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x28
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], esi
call fcn.004c0640
mov byte [esp + 0x84], 0x2b
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Blocker
call fcn.0040b760
mov byte [esp + 0x84], 0x2c
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x2b
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], str.Virus
call fcn.004c0640
mov byte [esp + 0x84], 0x2e
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Virus
call fcn.0040b760
mov byte [esp + 0x84], 0x2f
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x2e
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], str.Worm
call fcn.004c0640
mov byte [esp + 0x84], 0x31
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Worm
call fcn.0040b760
mov byte [esp + 0x84], 0x32
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x31
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], str.Hijacker
call fcn.004c0640
mov byte [esp + 0x84], 0x34
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Hijack
call fcn.0040b760
mov byte [esp + 0x84], 0x35
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x34
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], str.Rootkit
call fcn.004c0640
mov byte [esp + 0x84], 0x37
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Rootkit
call fcn.0040b760
mov byte [esp + 0x84], 0x38
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x37
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], str.Dialer
call fcn.004c0640
mov byte [esp + 0x84], 0x3a
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Dialer
call fcn.0040b760
mov byte [esp + 0x84], 0x3b
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x3a
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], str.Agent
call fcn.004c0640
mov byte [esp + 0x84], 0x3d
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Agent
call fcn.0040b760
mov byte [esp + 0x84], 0x3e
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x3d
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
mov esi, str.Hacktool
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], esi
call fcn.004c0640
mov byte [esp + 0x84], 0x40
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Hack
call fcn.0040b760
mov byte [esp + 0x84], 0x41
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x40
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], esi
call fcn.004c0640
mov byte [esp + 0x84], 0x43
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Tool
call fcn.0040b760
mov byte [esp + 0x84], 0x44
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x43
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], str.Dropper
push eax
call fcn.004c0640
mov byte [esp + 0x84], 0x46
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Drop
call fcn.0040b760
mov byte [esp + 0x84], 0x47
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x46
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], str.Injector
call fcn.004c0640
mov byte [esp + 0x84], 0x49
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Inject
call fcn.0040b760
mov byte [esp + 0x84], 0x4a
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x49
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], str.Downloader
call fcn.004c0640
mov byte [esp + 0x84], 0x4c
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Download
call fcn.0040b760
mov byte [esp + 0x84], 0x4d
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x4c
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], str.Exploit
call fcn.004c0640
mov byte [esp + 0x84], 0x4f
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Exploit
call fcn.0040b760
mov byte [esp + 0x84], 0x50
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x4f
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], str.Nuker
call fcn.004c0640
mov byte [esp + 0x84], 0x52
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Nuke
call fcn.0040b760
mov byte [esp + 0x84], 0x53
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x52
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], str.Rogue
call fcn.004c0640
mov byte [esp + 0x84], 0x55
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Rogue
call fcn.0040b760
mov byte [esp + 0x84], 0x56
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x55
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], str.Risk
call fcn.004c0640
mov byte [esp + 0x84], 0x58
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Risk
call fcn.0040b760
mov byte [esp + 0x84], 0x59
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x58
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], 0x6d993c
call fcn.004c0640
mov byte [esp + 0x84], 0x5b
lea ecx, [esp + 0x14]
push ecx
mov ecx, 0x6d993c
call fcn.0040b760
mov byte [esp + 0x84], 0x5c
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x5b
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
mov dword [esp + 0x70], ebx
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
mov esi, str.Adware
push eax
mov dword [esp + 0x7c], esi
call fcn.004c0640
mov byte [esp + 0x84], 0x5e
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.0040b760
mov byte [esp + 0x84], 0x5f
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x1c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x5e
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x1c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], esi
call fcn.004c0640
mov byte [esp + 0x84], 0x61
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Toolbar
call fcn.0040b760
mov byte [esp + 0x84], 0x62
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x20]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x24]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x61
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x24]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], esi
call fcn.004c0640
mov byte [esp + 0x84], 0x64
lea ecx, [esp + 0x14]
push ecx
mov ecx, 0x6d9950
call fcn.0040b760
mov byte [esp + 0x84], 0x65
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x28]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x2c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x64
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x2c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], str.Bundle
call fcn.004c0640
mov byte [esp + 0x84], 0x67
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Bundle
call fcn.0040b760
mov byte [esp + 0x84], 0x68
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x30]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x34]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x67
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x34]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], str.Joke
call fcn.004c0640
mov byte [esp + 0x84], 0x6a
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Joke
call fcn.0040b760
mov byte [esp + 0x84], 0x6b
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x38]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x3c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x6a
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x3c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x44]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], 0x6d9964
call fcn.004c0640
mov byte [esp + 0x84], 0x6d
lea ecx, [esp + 0x14]
push ecx
mov ecx, 0x6d9964
call fcn.0040b760
mov byte [esp + 0x84], 0x6e
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x40]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x44]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x6d
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x44]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x4c]
mov esi, 0x6d9968
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], esi
call fcn.004c0640
mov byte [esp + 0x84], 0x70
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.0040b760
mov byte [esp + 0x84], 0x71
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x48]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x4c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x70
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x4c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x54]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], esi
call fcn.004c0640
mov byte [esp + 0x84], 0x73
lea ecx, [esp + 0x14]
push ecx
mov ecx, 0x6d996c
call fcn.0040b760
mov byte [esp + 0x84], 0x74
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x50]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x54]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x73
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x54]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x5c]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], esi
call fcn.004c0640
mov byte [esp + 0x84], 0x76
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Unwanted
call fcn.0040b760
mov byte [esp + 0x84], 0x77
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x58]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x5c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x76
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x5c]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x64]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], str.Macro
call fcn.004c0640
mov byte [esp + 0x84], 0x79
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Macro
call fcn.0040b760
mov byte [esp + 0x84], 0x7a
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x60]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x64]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x79
lea ecx, [esp + 0x14]
call fcn.0040b810
xor ebx, ebx
mov byte [esp + 0x84], bl
lea ecx, [esp + 0x64]
call fcn.0040b810
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x6c]
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], str.Cookie
call fcn.004c0640
mov byte [esp + 0x84], 0x7c
lea ecx, [esp + 0x14]
push ecx
mov ecx, str.Cookie
call fcn.0040b760
mov byte [esp + 0x84], 0x7d
lea edx, [esp + 0x14]
push edx
call fcn.004bf550
mov ecx, dword [esp + 0x68]
mov dword [eax], ecx
lea ebx, [eax + 4]
lea eax, [esp + 0x6c]
call fcn.0040dcb0
mov byte [esp + 0x84], 0x7c
lea ecx, [esp + 0x14]
call fcn.0040b810
mov byte [esp + 0x84], 0
lea ecx, [esp + 0x6c]
call fcn.0040b810
mov dword [esp + 0x84], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x7c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x78
ret 4