Function at 0x489697
Capabilities:
Contain obfuscated stackstrings
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x529878
mov eax, dword fs:[0]
push eax
sub esp, 0xd84
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xd70], ecx
and dword [ebp - 0xd14], 0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc58]
call fcn.0040b2fe
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xd90]
call fcn.00416746
mov byte [ebp - 4], 3
push str.pluginsiips.ini
lea ecx, [ebp - 0xcd0]
call fcn.00409053
mov byte [ebp - 4], 4
push 0x5c
lea eax, [ebp - 0xcd0]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0xc88]
push eax
call fcn.00481988
add esp, 0x10
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xcd0]
call fcn.0040a62b
mov byte [ebp - 4], 8
mov byte [ebp - 4], 6
lea eax, [ebp - 0xcd0]
mov dword [ebp - 0xd6c], eax
mov byte [ebp - 4], 9
mov byte [ebp - 4], 0xa
mov byte [ebp - 4], 6
push 0x410
push 0
lea eax, [ebp - 0xc40]
push eax
call fcn.004b0090
add esp, 0xc
lea ecx, [ebp - 0xc88]
call fcn.0040a5f1
push eax
push 0x208
lea eax, [ebp - 0xc40]
push eax
push 0x541404
push str.DllPath
push str.IIPS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0xc40]
push eax
call fcn.004cc4f3
pop ecx
test eax, eax
je 0x4898cf
push 0x410
push 0
lea eax, [ebp - 0x420]
push eax
call fcn.004b0090
add esp, 0xc
push 0x5416cc
lea ecx, [ebp - 0xcb8]
call fcn.00409053
mov byte [ebp - 4], 0xb
push 0x5c
lea eax, [ebp - 0xcb8]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0xd00]
push eax
call fcn.00481988
add esp, 0x10
mov dword [ebp - 0xd20], eax
mov eax, dword [ebp - 0xd20]
mov dword [ebp - 0xd24], eax
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0xd24]
call fcn.0040a5f1
push eax
push 0x208
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0xc40]
push eax
lea ecx, [ebp - 0xd90]
call fcn.004174dd
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xd00]
call fcn.0040a62b
mov byte [ebp - 4], 0xe
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0xd00]
mov dword [ebp - 0xd68], eax
mov byte [ebp - 4], 0xf
mov byte [ebp - 4], 0x10
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xcb8]
call fcn.0040a62b
mov byte [ebp - 4], 0x12
mov byte [ebp - 4], 6
lea eax, [ebp - 0xcb8]
mov dword [ebp - 0xd64], eax
mov byte [ebp - 4], 0x13
mov byte [ebp - 4], 0x14
mov byte [ebp - 4], 6
push 0x208
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0xd90]
call fcn.00417604
lea eax, [ebp - 0x420]
push eax
call fcn.004cc4f3
pop ecx
mov dword [ebp - 0xd28], eax
push dword [ebp - 0xd28]
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0xc58]
call fcn.0040a770
mov eax, dword [ebp - 0xc48]
mov dword [ebp - 0xd2c], eax
cmp dword [ebp - 0xd2c], 0
jne 0x4898f0
mov dword [ebp - 0xd0c], 1
jmp 0x4898f7
and dword [ebp - 0xd0c], 0
movzx eax, byte [ebp - 0xd0c]
test eax, eax
je 0x489b64
lea ecx, [ebp - 0xd1c]
call fcn.00408fd4
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0xd18]
mov dword [ebp - 0xd30], eax
cmp dword [ebp - 0xd30], 0
je 0x489b55
push 0x5416f0
lea ecx, [ebp - 0xca0]
call fcn.00409053
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0xd74]
mov dword [ebp - 0xd08], eax
mov eax, dword [ebp - 0xd18]
mov dword [ebp - 0xd08], eax
push 0x5c
lea eax, [ebp - 0xca0]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0xce8]
push eax
call fcn.00481988
add esp, 0x10
mov dword [ebp - 0xd48], eax
mov eax, dword [ebp - 0xd48]
mov dword [ebp - 0xd44], eax
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0xd44]
call fcn.0040a5f1
mov dword [ebp - 0xd40], eax
push 0x10
push 0x5416dc
push dword [ebp - 0xd40]
mov eax, dword [ebp - 0xd08]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd08]
call dword [eax + 0x20]
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0xce8]
call fcn.0040a62b
mov byte [ebp - 4], 0x19
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0xce8]
mov dword [ebp - 0xd4c], eax
mov byte [ebp - 4], 0x1a
mov byte [ebp - 4], 0x1b
mov byte [ebp - 4], 0x16
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0xca0]
call fcn.0040a62b
mov byte [ebp - 4], 0x1d
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0xca0]
mov dword [ebp - 0xd50], eax
mov byte [ebp - 4], 0x1e
mov byte [ebp - 4], 0x1f
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0xd54]
mov dword [ebp - 0xd04], eax
mov eax, dword [ebp - 0xd18]
mov dword [ebp - 0xd04], eax
push 0x541700
push str.IIPSDllPath
push 0x541720
mov eax, dword [ebp - 0xd04]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd04]
call dword [eax + 0x2c]
push eax
lea ecx, [ebp - 0xc70]
call fcn.00409053
mov byte [ebp - 4], 0x20
mov eax, dword [ebp - 0xc60]
mov dword [ebp - 0xd3c], eax
cmp dword [ebp - 0xd3c], 0
jne 0x489a81
mov dword [ebp - 0xd10], 1
jmp 0x489a88
and dword [ebp - 0xd10], 0
movzx eax, byte [ebp - 0xd10]
test eax, eax
jne 0x489b26
push 0x410
push 0
lea eax, [ebp - 0x830]
push eax
call fcn.004b0090
add esp, 0xc
mov ecx, dword [ebp + 0x14]
call fcn.0040a5f1
mov dword [ebp - 0xd38], eax
push dword [ebp - 0xd38]
push 0x208
lea eax, [ebp - 0x830]
push eax
lea ecx, [ebp - 0xc70]
call fcn.0040a5f1
push eax
lea ecx, [ebp - 0xd90]
call fcn.004174dd
push 0x208
lea eax, [ebp - 0x830]
push eax
lea ecx, [ebp - 0xd90]
call fcn.00417604
lea eax, [ebp - 0x830]
push eax
call fcn.004cc4f3
pop ecx
mov dword [ebp - 0xd34], eax
push dword [ebp - 0xd34]
lea eax, [ebp - 0x830]
push eax
lea ecx, [ebp - 0xc58]
call fcn.0040a770
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xc70]
call fcn.0040a62b
mov byte [ebp - 4], 0x22
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0xc70]
mov dword [ebp - 0xd58], eax
mov byte [ebp - 4], 0x23
mov byte [ebp - 4], 0x24
mov byte [ebp - 4], 0x15
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xd1c]
call fcn.004090e6
lea eax, [ebp - 0xc58]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040b1fe
mov eax, dword [ebp - 0xd14]
or eax, 1
mov dword [ebp - 0xd14], eax
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xc88]
call fcn.0040a62b
mov byte [ebp - 4], 0x26
mov byte [ebp - 4], 3
lea eax, [ebp - 0xc88]
mov dword [ebp - 0xd5c], eax
mov byte [ebp - 4], 0x27
mov byte [ebp - 4], 0x28
mov byte [ebp - 4], 3
mov byte [ebp - 4], 0x29
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xd8c]
call fcn.004167ab
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0xc58]
call fcn.0040a62b
mov byte [ebp - 4], 0x2b
mov byte [ebp - 4], 1
lea eax, [ebp - 0xc58]
mov dword [ebp - 0xd60], eax
mov byte [ebp - 4], 0x2c
mov byte [ebp - 4], 0x2d
mov byte [ebp - 4], 1
mov byte [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ad99f
leave
ret 0x10