Function at 0x40b170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x514af8
mov eax, dword fs:[0]
push eax
sub esp, 0xad4
mov eax, dword [0x578bd4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0xa74]
call fcn.00415b60
mov dword [ebp - 4], 0
push str.SPM20
lea ecx, [ebp - 0x100]
call fcn.00415150
mov byte [ebp - 4], 1
push str.815B8D4F_8710_4C0F_B3CA_CA370CD5F4F9
lea ecx, [ebp - 0xe8]
call fcn.00415150
mov byte [ebp - 4], 2
push 0x527960
lea ecx, [ebp - 0xd0]
call fcn.00415150
lea ecx, [ebp - 0xb8]
call fcn.00415660
lea ecx, [ebp - 0xa0]
call fcn.00415660
mov byte [ebp - 4], 3
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x628]
call fcn.004162b0
mov dword [ebp - 0xa88], eax
mov ecx, dword [ebp - 0xa88]
mov dword [ebp - 0xadc], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0xadc]
push edx
lea ecx, [ebp - 0xa74]
call fcn.00422f50
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x628]
call fcn.00418090
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x100]
call fcn.00418090
push str.SPM21
lea ecx, [ebp - 0x178]
call fcn.00415150
mov byte [ebp - 4], 5
push str.051BB2A8_B974_4C61_9B80_5AA9ED5B08F8
lea ecx, [ebp - 0x160]
call fcn.00415150
mov byte [ebp - 4], 6
push 0x5279f0
lea ecx, [ebp - 0x148]
call fcn.00415150
lea ecx, [ebp - 0x130]
call fcn.00415660
lea ecx, [ebp - 0x118]
call fcn.00415660
mov byte [ebp - 4], 7
lea eax, [ebp - 0x178]
push eax
lea ecx, [ebp - 0x6a0]
call fcn.004162b0
mov dword [ebp - 0xa8c], eax
mov ecx, dword [ebp - 0xa8c]
mov dword [ebp - 0xa90], ecx
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0xa90]
push edx
lea ecx, [ebp - 0xa74]
call fcn.00422f50
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x6a0]
call fcn.00418090
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x178]
call fcn.00418090
push 0x527994
lea ecx, [ebp - 0x88]
call fcn.00415150
mov byte [ebp - 4], 9
push str.217036D3_7408_49B5_9C1E_6D1CFDF39721
lea ecx, [ebp - 0x70]
call fcn.00415150
mov byte [ebp - 4], 0xa
push str.PasswordManager.exe
lea ecx, [ebp - 0x58]
call fcn.00415150
lea ecx, [ebp - 0x40]
call fcn.00415660
lea ecx, [ebp - 0x28]
call fcn.00415660
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x718]
call fcn.004162b0
mov dword [ebp - 0xa98], eax
mov ecx, dword [ebp - 0xa98]
mov dword [ebp - 0xa9c], ecx
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0xa9c]
push edx
lea ecx, [ebp - 0xa74]
call fcn.00422f50
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x718]
call fcn.00418090
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x88]
call fcn.00418090
push str.SSS20
lea ecx, [ebp - 0x1f0]
call fcn.00415150
mov byte [ebp - 4], 0xd
push str.AFAC1089_E5B3_483C_B633_6F8BB1BADD07
lea ecx, [ebp - 0x1d8]
call fcn.00415150
mov byte [ebp - 4], 0xe
push 0x527a9c
lea ecx, [ebp - 0x1c0]
call fcn.00415150
lea ecx, [ebp - 0x1a8]
call fcn.00415660
lea ecx, [ebp - 0x190]
call fcn.00415660
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x1f0]
push eax
lea ecx, [ebp - 0x790]
call fcn.004162b0
mov dword [ebp - 0xaa0], eax
mov ecx, dword [ebp - 0xaa0]
mov dword [ebp - 0xaa4], ecx
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0xaa4]
push edx
lea ecx, [ebp - 0xa74]
call fcn.00422f50
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x790]
call fcn.00418090
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1f0]
call fcn.00418090
push str.SSS21
lea ecx, [ebp - 0x268]
call fcn.00415150
mov byte [ebp - 4], 0x11
push str.199B2CEE_0BCB_4558_9277_A825E684DFB1
lea ecx, [ebp - 0x250]
call fcn.00415150
mov byte [ebp - 4], 0x12
push 0x527b0c
lea ecx, [ebp - 0x238]
call fcn.00415150
lea ecx, [ebp - 0x220]
call fcn.00415660
lea ecx, [ebp - 0x208]
call fcn.00415660
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x5b0]
call fcn.004162b0
mov dword [ebp - 0xaa8], eax
mov ecx, dword [ebp - 0xaa8]
mov dword [ebp - 0xaac], ecx
mov byte [ebp - 4], 0x14
mov edx, dword [ebp - 0xaac]
push edx
lea ecx, [ebp - 0xa74]
call fcn.00422f50
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x5b0]
call fcn.00418090
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x268]
call fcn.00418090
push 0x527b70
lea ecx, [ebp - 0x2e0]
call fcn.00415150
mov byte [ebp - 4], 0x15
push str.7904995E_F590_4EE4_9846_97A6E7CF0366
lea ecx, [ebp - 0x2c8]
call fcn.00415150
mov byte [ebp - 4], 0x16
push str.Suite.exe
lea ecx, [ebp - 0x2b0]
call fcn.00415150
lea ecx, [ebp - 0x298]
call fcn.00415660
lea ecx, [ebp - 0x280]
call fcn.00415660
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0x2e0]
push eax
lea ecx, [ebp - 0x808]
call fcn.004162b0
mov dword [ebp - 0xab0], eax
mov ecx, dword [ebp - 0xab0]
mov dword [ebp - 0xab4], ecx
mov byte [ebp - 4], 0x18
mov edx, dword [ebp - 0xab4]
push edx
lea ecx, [ebp - 0xa74]
call fcn.00422f50
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x808]
call fcn.00418090
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2e0]
call fcn.00418090
push str.SAFE20
lea ecx, [ebp - 0x358]
call fcn.00415150
mov byte [ebp - 4], 0x19
push str.265B363C_EFC1_4075_8F6F_CB2FB66FD64F
lea ecx, [ebp - 0x340]
call fcn.00415150
mov byte [ebp - 4], 0x1a
push 0x527c40
lea ecx, [ebp - 0x328]
call fcn.00415150
lea ecx, [ebp - 0x310]
call fcn.00415660
lea ecx, [ebp - 0x2f8]
call fcn.00415660
mov byte [ebp - 4], 0x1b
lea eax, [ebp - 0x358]
push eax
lea ecx, [ebp - 0x880]
call fcn.004162b0
mov dword [ebp - 0xab8], eax
mov ecx, dword [ebp - 0xab8]
mov dword [ebp - 0xabc], ecx
mov byte [ebp - 4], 0x1c
mov edx, dword [ebp - 0xabc]
push edx
lea ecx, [ebp - 0xa74]
call fcn.00422f50
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x880]
call fcn.00418090
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x358]
call fcn.00418090
push str.SAFE21
lea ecx, [ebp - 0x3d0]
call fcn.00415150
mov byte [ebp - 4], 0x1d
push str.CB97DD71_2109_47BA_BD67_FD940A7840A9
lea ecx, [ebp - 0x3b8]
call fcn.00415150
mov byte [ebp - 4], 0x1e
push 0x527c64
lea ecx, [ebp - 0x3a0]
call fcn.00415150
lea ecx, [ebp - 0x388]
call fcn.00415660
lea ecx, [ebp - 0x370]
call fcn.00415660
mov byte [ebp - 4], 0x1f
lea eax, [ebp - 0x3d0]
push eax
lea ecx, [ebp - 0x8f8]
call fcn.004162b0
mov dword [ebp - 0xac0], eax
mov ecx, dword [ebp - 0xac0]
mov dword [ebp - 0xac8], ecx
mov byte [ebp - 4], 0x20
mov edx, dword [ebp - 0xac8]
push edx
lea ecx, [ebp - 0xa74]
call fcn.00422f50
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x8f8]
call fcn.00418090
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3d0]
call fcn.00418090
push 0x527cc8
lea ecx, [ebp - 0x448]
call fcn.00415150
mov byte [ebp - 4], 0x21
push str.6ACEAFA4_A8D9_4363_9CEE_CFEE3A10930B
lea ecx, [ebp - 0x430]
call fcn.00415150
mov byte [ebp - 4], 0x22
push str.Safe.exe
lea ecx, [ebp - 0x418]
call fcn.00415150
lea ecx, [ebp - 0x400]
call fcn.00415660
lea ecx, [ebp - 0x3e8]
call fcn.00415660
mov byte [ebp - 4], 0x23
lea eax, [ebp - 0x448]
push eax
lea ecx, [ebp - 0x970]
call fcn.004162b0
mov dword [ebp - 0xac4], eax
mov ecx, dword [ebp - 0xac4]
mov dword [ebp - 0xacc], ecx
mov byte [ebp - 4], 0x24
mov edx, dword [ebp - 0xacc]
push edx
lea ecx, [ebp - 0xa74]
call fcn.00422f50
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x970]
call fcn.00418090
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x448]
call fcn.00418090
push 0x527d3c
lea ecx, [ebp - 0x4c0]
call fcn.00415150
mov byte [ebp - 4], 0x25
push str.896614ED_00BD_4E0C_99AB_01C76EE416D9
lea ecx, [ebp - 0x4a8]
call fcn.00415150
mov byte [ebp - 4], 0x26
push str.OnlineShieldClient.exe
lea ecx, [ebp - 0x490]
call fcn.00415150
lea ecx, [ebp - 0x478]
call fcn.00415660
lea ecx, [ebp - 0x460]
call fcn.00415660
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x4c0]
push eax
lea ecx, [ebp - 0x9e8]
call fcn.004162b0
mov dword [ebp - 0xad0], eax
mov ecx, dword [ebp - 0xad0]
mov dword [ebp - 0xad4], ecx
mov byte [ebp - 4], 0x28
mov edx, dword [ebp - 0xad4]
push edx
lea ecx, [ebp - 0xa74]
call fcn.00422f50
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x9e8]
call fcn.00418090
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c0]
call fcn.00418090
push 0x527df0
lea ecx, [ebp - 0x538]
call fcn.00415150
mov byte [ebp - 4], 0x29
push str.3F3FB10C_7175_4D38_9335_3488B89C12AF
lea ecx, [ebp - 0x520]
call fcn.00415150
mov byte [ebp - 4], 0x2a
push str.OkayFreedomClient.exe
lea ecx, [ebp - 0x508]
call fcn.00415150
lea ecx, [ebp - 0x4f0]
call fcn.00415660
lea ecx, [ebp - 0x4d8]
call fcn.00415660
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0x538]
push eax
lea ecx, [ebp - 0xa60]
call fcn.004162b0
mov dword [ebp - 0xad8], eax
mov ecx, dword [ebp - 0xad8]
mov dword [ebp - 0xa94], ecx
mov byte [ebp - 4], 0x2c
mov edx, dword [ebp - 0xa94]
push edx
lea ecx, [ebp - 0xa74]
call fcn.00422f50
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0xa60]
call fcn.00418090
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x538]
call fcn.00418090
lea eax, [ebp - 0xa74]
mov dword [ebp - 0xa7c], eax
mov ecx, dword [ebp - 0xa7c]
call fcn.00418c00
mov dword [ebp - 0xa68], eax
mov ecx, dword [ebp - 0xa7c]
call fcn.0041f8b0
mov dword [ebp - 0xae0], eax
jmp 0x40b92e
mov ecx, dword [ebp - 0xa68]
add ecx, 0x78
mov dword [ebp - 0xa68], ecx
mov edx, dword [ebp - 0xa68]
cmp edx, dword [ebp - 0xae0]
je 0x40b9c6
mov eax, dword [ebp - 0xa68]
mov dword [ebp - 0xa78], eax
mov ecx, dword [ebp - 0xa78]
push ecx
call fcn.0040ad00
add esp, 4
mov byte [ebp - 0xa61], al
movzx edx, byte [ebp - 0xa61]
test edx, edx
je 0x40b978
mov dword [ebp - 0xa80], 0x527e58
jmp 0x40b982
mov dword [ebp - 0xa80], str.not
mov eax, dword [ebp - 0xa80]
push eax
mov ecx, dword [ebp - 0xa78]
call fcn.00420220
push eax
push str._____s_is__sinstalled.
push 0x57bc78
call fcn.00421a10
add esp, 0x10
movzx ecx, byte [ebp - 0xa61]
test ecx, ecx
je 0x40b9c1
mov edx, dword [ebp - 0xa78]
push edx
mov ecx, dword [ebp + 8]
call fcn.00422f80
jmp 0x40b91f
mov ecx, dword [ebp + 8]
call fcn.00423a40
push eax
push str._found__d_installed_Steganos_products.
push 0x57bc78
call fcn.00421a10
add esp, 0xc
mov ecx, dword [ebp + 8]
call fcn.00423a40
mov dword [ebp - 0xa84], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa74]
call fcn.00417bd0
mov eax, dword [ebp - 0xa84]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c9126
mov esp, ebp
pop ebp
ret