Function at 0x4bd370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x9c]
push ebx
lea ebx, [ebp - 0x8c]
sub esp, 0xb0
mov dword [ebp - 0xa0], eax
mov esi, dword [sym.imp.kernel32.dll_GetTimeFormatA]
mov dword [ebp - 0x9c], 0x2020202
mov dword [ebp - 0x98], 0x2020202
mov dword [ebp - 0x94], 0x2020202
mov dword [ebp - 0x90], 0x2020202
mov dword [ebp - 0x8c], 0x73697270
mov dword [ebp - 0x88], 0x656e6974
mov byte [ebp - 0x84], 0
mov dword [eax + 0x34], 0xdeadbeef
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], 0x5da7c4
mov dword [esp + 4], 8
mov dword [esp], 0x409
call esi
mov ecx, ebx
sub esp, 0x18
mov edx, eax
mov eax, 0x221
mov dword [esp + 4], str.ERROR_INVALID_PARAMETER
mov dword [esp], 0x57
call fcn.004b49b0
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x94], 0x380008
mov dword [ebp - 0x90], 0x16000d
mov dword [eax + 0x34], 0xdeadbeef
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], 0x5da7c4
mov dword [esp + 4], 8
mov dword [esp], 0x409
call esi
mov ecx, ebx
sub esp, 0x18
mov edx, eax
mov eax, 0x22a
mov dword [esp], 0x5da7d4
call fcn.004b9ce0
mov byte [ebp - 0x84], 0
mov dword [ebp - 0x8c], 0x73697270
mov dword [ebp - 0x88], 0x656e6974
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], 0x5da7e0
mov dword [esp + 4], 0x80000008
mov dword [esp], 0x409
call esi
mov ecx, ebx
sub esp, 0x18
mov edx, eax
mov eax, 0x22f
mov dword [esp + 4], str.ERROR_INVALID_FLAGS
mov dword [esp], 0x3ec
call fcn.004b49b0
mov eax, dword [ebp - 0xa0]
mov dword [eax + 0x34], 0xdeadbeef
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], 2
mov dword [esp + 0xc], 0x5da7e3
mov dword [esp + 4], 8
mov dword [esp], 0x409
call esi
xor ecx, ecx
sub esp, 0x18
mov edx, eax
mov eax, 0x237
mov dword [esp + 4], str.ERROR_INSUFFICIENT_BUFFER
mov dword [esp], 0x7a
call fcn.004b49b0
mov eax, dword [ebp - 0xa0]
mov dword [eax + 0x34], 0xdeadbeef
mov dword [esp + 8], edi
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x5da7c4
mov dword [esp + 4], 8
mov dword [esp], 0x409
call esi
xor ecx, ecx
sub esp, 0x18
mov edx, eax
mov eax, 0x23c
mov dword [esp], 0x5da7d4
call fcn.004b9ce0
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x80000001
mov dword [esp], 0x409
call esi
mov ecx, ebx
sub esp, 0x18
mov edx, eax
mov eax, 0x240
mov dword [esp], 0x5da7e7
call fcn.004b9ce0
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], 0x5da7ec
mov dword [esp + 4], 1
mov dword [esp], 0x409
call esi
mov ecx, ebx
sub esp, 0x18
mov edx, eax
mov eax, 0x244
mov dword [esp], 0x5d880b
call fcn.004b9ce0
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x80000002
mov dword [esp], 0x409
call esi
mov ecx, ebx
sub esp, 0x18
mov edx, eax
mov eax, 0x248
mov dword [esp], 0x5da7f5
call fcn.004b9ce0
mov byte [ebp - 0x84], 0
mov dword [ebp - 0x8c], 0x73697270
mov dword [ebp - 0x88], 0x656e6974
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], 0x5da7fd
mov dword [esp + 4], 2
mov dword [esp], 0x409
call esi
mov ecx, ebx
sub esp, 0x18
mov edx, eax
mov eax, 0x24d
mov dword [esp], 0x5da7f5
call fcn.004b9ce0
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], 0x5da806
mov dword [esp + 4], 2
mov dword [esp], 0x409
call esi
mov ecx, ebx
sub esp, 0x18
mov edx, eax
mov eax, 0x251
mov dword [esp], 0x5da815
call fcn.004b9ce0
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], 0x5da81e
mov dword [esp + 4], 2
mov dword [esp], 0x409
call esi
mov ecx, ebx
sub esp, 0x18
mov edx, eax
mov eax, 0x255
mov dword [esp], 0x5d880b
call fcn.004b9ce0
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], 0x5da825
mov dword [esp + 4], 0
mov dword [esp], 0x409
call esi
mov ecx, ebx
sub esp, 0x18
mov edx, eax
mov eax, 0x259
mov dword [esp], 0x5da82a
call fcn.004b9ce0
mov eax, 0xd
mov word [ebp - 0x94], ax
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], 0x5da825
mov dword [esp + 4], 0
mov dword [esp], 0x409
call esi
mov ecx, ebx
sub esp, 0x18
mov edx, eax
mov eax, 0x25e
mov dword [esp], 0x5da82f
call fcn.004b9ce0
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], 0x5da834
mov dword [esp + 4], 4
mov dword [esp], 0x409
call esi
mov ecx, ebx
sub esp, 0x18
mov edx, eax
mov eax, 0x262
mov dword [esp], 0x5da83d
call fcn.004b9ce0
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], 0x5da7fd
mov dword [esp + 4], 8
mov dword [esp], 0x409
call esi
mov ecx, ebx
sub esp, 0x18
mov edx, eax
mov eax, 0x266
mov dword [esp], 0x5da841
call fcn.004b9ce0
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], 0x5da84d
mov dword [esp + 4], 8
mov dword [esp], 0x409
call esi
mov ecx, ebx
sub esp, 0x18
mov edx, eax
mov eax, 0x26a
mov dword [esp], 0x5da853
call fcn.004b9ce0
mov edx, 3
mov dword [ebp - 0x94], 0x5000e
mov word [ebp - 0x90], dx
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], 0x5da85c
mov dword [esp + 4], 0
mov dword [esp], 0x409
call esi
mov ecx, ebx
sub esp, 0x18
mov edx, eax
mov eax, 0x271
mov dword [esp], 0x5da875
call fcn.004b9ce0
xor ecx, ecx
mov word [ebp - 0x94], cx
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], 0x5da88f
mov dword [esp + 4], 0
mov dword [esp], 0x409
call esi
mov ecx, ebx
sub esp, 0x18
mov edx, eax
mov eax, 0x276
mov dword [esp], 0x5da899
call fcn.004b9ce0
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], 0x5da7fd
mov dword [esp + 4], 0
mov dword [esp], 0x409
call esi
mov ecx, ebx
sub esp, 0x18
mov edx, eax
mov eax, 0x27a
mov dword [esp], 0x5da8a4
call fcn.004b9ce0
mov dword [ebp - 0x94], 0x380008
mov dword [ebp - 0x90], 0x16000d
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], 0x5da8b0
mov dword [esp + 4], 0
mov dword [esp], 0x409
call esi
mov ecx, ebx
sub esp, 0x18
mov edx, eax
mov eax, 0x287
mov dword [esp], 0x5da8e8
call fcn.004b9ce0
mov byte [ebp - 0x84], 0
mov dword [ebp - 0x8c], 0x73697270
mov dword [ebp - 0x88], 0x656e6974
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 0x5da91c
mov dword [esp + 4], 0
mov dword [esp], 0x409
call esi
xor ecx, ecx
sub esp, 0x18
mov edx, eax
mov eax, 0x28c
mov dword [esp], 0x5da921
call fcn.004b9ce0
call fcn.0057d110
mov ecx, dword [sym.imp.msvcrt.dll_strcmp]
mov dword [eax], 0x5d8897
mov dword [eax + 4], 0x28d
mov dword [esp], ebx
mov dword [esp + 4], 0x5d8a5d
mov dword [ebp - 0xa4], ecx
call ecx
mov dword [esp + 8], ebx
test eax, eax
mov dword [esp + 4], 0x5d8a68
sete al
movzx eax, al
mov dword [esp], eax
call fcn.004b46e0
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], 0x5da928
mov dword [esp + 4], 0
mov dword [esp], 0x409
call esi
mov ecx, ebx
sub esp, 0x18
mov edx, eax
mov eax, 0x291
mov dword [esp], 0x5da958
call fcn.004b9ce0
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], 0x5da97a
mov dword [esp + 4], 0
mov dword [esp], 0x409
call esi
mov ecx, ebx
sub esp, 0x18
mov edx, eax
mov eax, 0x295
mov dword [esp], 0x5da97e
call fcn.004b9ce0
mov byte [ebp - 0x84], 0
mov dword [ebp - 0x8c], 0x73697270
mov dword [ebp - 0x88], 0x656e6974
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], str.
mov dword [esp + 4], 0
mov dword [esp], 0x409
call esi
mov ecx, ebx
sub esp, 0x18
mov edx, eax
mov eax, 0x29a
mov dword [esp], 0x5da97e
call fcn.004b9ce0
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], 0x5da985
mov dword [esp + 4], 0
mov dword [esp], 0x409
call esi
mov ecx, ebx
sub esp, 0x18
mov edx, eax
mov eax, 0x29e
mov dword [esp], 0x5da98e
call fcn.004b9ce0
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], 0x5da991
mov dword [esp + 4], 0
mov dword [esp], 0x409
call esi
mov ecx, ebx
sub esp, 0x18
mov edx, eax
mov eax, 0x2a2
mov dword [esp], 0x5da99c
call fcn.004b9ce0
mov byte [ebp - 0x84], 0
mov dword [ebp - 0x8c], 0x73697270
mov dword [ebp - 0x88], 0x656e6974
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], 0x5da9a4
mov dword [esp + 4], 0
mov dword [esp], 0x409
call esi
mov ecx, ebx
sub esp, 0x18
mov edx, eax
mov eax, 0x2a7
mov dword [esp], 0x5da99c
call fcn.004b9ce0
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], 0x5da9ae
mov dword [esp + 4], 4
mov dword [esp], 0x409
call esi
mov ecx, ebx
sub esp, 0x18
mov edx, eax
mov eax, 0x2ab
mov dword [esp], 0x5d880b
call fcn.004b9ce0
mov eax, 0x19
mov dword [ebp - 0x8c], 0x73697270
mov word [ebp - 0x94], ax
mov dword [ebp - 0x88], 0x656e6974
mov byte [ebp - 0x84], 0
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], 0x5da9ae
mov dword [esp + 4], 0
mov dword [esp], 0x409
call esi
mov ecx, ebx
sub esp, 0x18
mov edx, eax
mov eax, 0x2b1
mov dword [esp + 4], str.ERROR_INVALID_PARAMETER
mov dword [esp], 0x57
call fcn.004b49b0
mov eax, dword [ebp - 0xa0]
mov dword [eax + 0x34], 0xdeadbeef
mov eax, 0xc
mov word [ebp - 0x94], ax
mov eax, 0x3c
mov word [ebp - 0x9a], ax
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0xc], 0x5da84d
mov dword [esp + 4], 0
mov dword [esp], 0x409
call esi
mov ecx, ebx
sub esp, 0x18
mov edx, eax
mov eax, 0x2b8
mov dword [esp], 0x5da9b6
call fcn.004b9ce0
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], 5
mov dword [esp + 0xc], 0x5da9bf
mov dword [esp + 4], 0
mov dword [esp], 0x411
call esi
mov ecx, ebx
sub esp, 0x18
mov edx, eax
mov eax, 0x2c1
mov dword [esp], 0x5da9c3
call fcn.004b9ce0
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], 4
mov dword [esp + 0xc], 0x5da9bf
mov dword [esp + 4], 0
mov dword [esp], 0x411
call esi
sub esp, 0x18
mov edx, eax
xor ecx, ecx
mov eax, 0x2c4
mov dword [esp + 4], str.ERROR_INSUFFICIENT_BUFFER
mov dword [esp], 0x7a
call fcn.004b49b0
mov eax, dword [ebp - 0xa0]
mov dword [eax + 0x34], 0xdeadbeef
mov dword [esp + 8], edi
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x5da9bf
mov dword [esp + 4], 0
mov dword [esp], 0x411
call esi
xor ecx, ecx
sub esp, 0x18
mov edx, eax
mov eax, 0x2c8
mov dword [esp], 0x5da9c3
call fcn.004b9ce0
mov byte [ebp - 0x84], 0
mov dword [ebp - 0x8c], 0x73697270
mov dword [ebp - 0x88], 0x656e6974
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 0x5da9bf
mov dword [esp + 4], 0
mov dword [esp], 0x411
call esi
xor ecx, ecx
sub esp, 0x18
mov edx, eax
mov eax, 0x2cc
mov dword [esp], 0x5da9c3
call fcn.004b9ce0
call fcn.0057d110
mov dword [eax], 0x5d8897
mov dword [eax + 4], 0x2cd
mov dword [esp], ebx
mov dword [esp + 4], 0x5d8a5d
mov ecx, dword [ebp - 0xa4]
call ecx
mov dword [esp + 8], ebx
test eax, eax
mov dword [esp + 4], 0x5d8a68
sete al
movzx eax, al
mov dword [esp], eax
call fcn.004b46e0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret