Function at 0x4315a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x60]
sub esp, 0x8c
mov esi, dword [ebp + 8]
mov dword [esp], ebx
call fcn.00430ee0
mov edi, dword [ebp - 0x5c]
test edi, edi
je 0x431663
mov dword [esp], ebx
mov ecx, esi
call fcn.004cdfc0
sub esp, 4
call fcn.0042c430
mov ecx, dword [esi]
lea edx, [ebp - 0x30]
lea ebx, [ebp - 0x28]
mov esi, 0x6874
mov dword [esp + 0x10], str.Browser_path_from_registry_is__s
mov dword [esp + 0xc], 0x18e
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp + 0x14], ecx
mov dword [esp], eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], 0x42746547
mov dword [ebp - 0x24], 0x73776f72
mov dword [ebp - 0x20], 0x61507265
mov word [ebp - 0x1c], si
mov dword [ebp - 0x2c], 0xe
mov byte [ebp - 0x1a], 0
call fcn.0042ce70
mov eax, dword [ebp - 0x30]
cmp eax, ebx
je 0x431642
mov dword [esp], eax
call fcn.004ed8c0
mov ebx, 1
mov edx, dword [ebp - 0x60]
lea eax, [ebp - 0x58]
cmp edx, eax
je 0x431659
mov dword [esp], edx
call fcn.004ed8c0
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0042c430
mov ecx, 0x6874
lea ebx, [ebp - 0x28]
mov dword [esp + 0x10], str.Get_browser_path_from_registry_failed
mov word [ebp - 0x1c], cx
lea ecx, [ebp - 0x30]
mov dword [esp + 0xc], 0x191
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 8], ecx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], 0x42746547
mov dword [ebp - 0x24], 0x73776f72
mov dword [ebp - 0x20], 0x61507265
mov dword [ebp - 0x2c], 0xe
mov byte [ebp - 0x1a], 0
call fcn.0042ce70
mov eax, dword [ebp - 0x30]
cmp eax, ebx
je 0x4316cd
mov dword [esp], eax
call fcn.004ed8c0
lea eax, [ebp - 0x48]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.004305e0
mov edi, dword [ebp - 0x44]
test edi, edi
jne 0x431770
call fcn.0042c430
lea edi, [ebp - 0x30]
mov edx, 0x6874
mov dword [esp + 0x10], str.Get_windows_path_failed
mov dword [esp + 0xc], 0x195
mov dword [esp + 4], 1
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], 0x42746547
mov dword [ebp - 0x24], 0x73776f72
mov dword [ebp - 0x20], 0x61507265
mov word [ebp - 0x1c], dx
mov dword [ebp - 0x2c], 0xe
mov byte [ebp - 0x1a], 0
call fcn.0042ce70
mov eax, dword [ebp - 0x30]
cmp eax, ebx
je 0x431752
mov dword [esp], eax
call fcn.004ed8c0
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x40]
cmp eax, edx
je 0x431764
mov dword [esp], eax
call fcn.004ed8c0
xor ebx, ebx
jmp 0x431647
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x30], ebx
mov ecx, eax
mov dword [ebp - 0x6c], eax
add ecx, edi
je 0x431787
test eax, eax
je 0x4318a8
cmp edi, 0xf
ja 0x431823
cmp edi, 1
mov eax, ebx
je 0x431840
mov ecx, dword [ebp - 0x6c]
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], edi
mov byte [eax + edi], 0
mov eax, 0x7fffffff
sub eax, dword [ebp - 0x2c]
cmp eax, 0x1d
jbe 0x4318f1
lea ecx, [ebp - 0x30]
mov dword [esp + 4], 0x1e
mov dword [esp], str.Internet_Exploreriexplore.exe
call fcn.004cde40
mov ecx, dword [ebp - 0x30]
sub esp, 8
mov eax, dword [esi]
mov edx, dword [ebp - 0x2c]
cmp ecx, ebx
je 0x431850
mov edi, dword [ebp - 0x28]
mov dword [ebp - 0x6c], edi
lea edi, [esi + 8]
cmp eax, edi
je 0x431870
mov dword [esi], ecx
mov ecx, dword [ebp - 0x6c]
test eax, eax
mov edi, dword [esi + 8]
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
je 0x43187b
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], 0
mov byte [eax], 0
jmp 0x431743
test edi, edi
js 0x43189c
lea eax, [edi + 1]
mov dword [esp], eax
call fcn.004ed900
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], edi
jmp 0x43179b
mov eax, dword [ebp - 0x6c]
movzx eax, byte [eax]
mov byte [ebp - 0x28], al
mov eax, ebx
jmp 0x4317b1
test edx, edx
je 0x431864
cmp edx, 1
jne 0x431885
movzx edx, byte [ebp - 0x28]
mov byte [eax], dl
mov edx, dword [ebp - 0x2c]
mov eax, dword [esi]
mov dword [esi + 4], edx
mov byte [eax + edx], 0
mov eax, dword [ebp - 0x30]
jmp 0x431814
mov eax, dword [ebp - 0x6c]
mov dword [esi], ecx
mov dword [esi + 4], edx
mov dword [esi + 8], eax
mov dword [ebp - 0x30], ebx
lea ebx, [ebp - 0x28]
mov eax, ebx
jmp 0x431814
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x2c]
mov eax, dword [esi]
jmp 0x431864
mov dword [esp], 0x4fdeff
call fcn.004e7d10
mov dword [esp], 0x4fe094
call fcn.004e7b80
mov esi, eax
mov eax, dword [ebp - 0x30]
cmp eax, ebx
je 0x4318c5
mov dword [esp], eax
call fcn.004ed8c0
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x40]
cmp eax, edx
je 0x4318d7
mov dword [esp], eax
call fcn.004ed8c0
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x58]
cmp eax, edx
je 0x4318e9
mov dword [esp], eax
call fcn.004ed8c0
mov dword [esp], esi
call fcn.0043f8d0
mov dword [esp], 0x4fe011
call fcn.004e7d10
mov esi, eax
mov eax, dword [ebp - 0x30]
cmp eax, ebx
jne 0x4318cf
jmp 0x4318d7