Function at 0x41ef30
Capabilities:
Contain obfuscated stackstrings
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a411f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3c8
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2d8], 0
mov dword [ebp - 4], 3
mov eax, dword [0x4d7094]
cmp eax, dword [0x4d377c]
jl 0x41efab
mov byte [ebp - 4], 2
lea ecx, [ebp + 8]
call fcn.00401c00
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x24]
call fcn.00401c00
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x40]
call fcn.00401c00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x5c]
call fcn.00401c00
jmp 0x41fbab
push str._msg_:__
lea ecx, [ebp - 0x14]
call fcn.0040fbc0
mov byte [ebp - 4], 4
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x40]
call fcn.0045c7c0
mov byte [ebp - 4], 6
lea ecx, [ebp + 8]
call fcn.00401c20
push eax
push 0x4ae534
lea ecx, [ebp - 0x40]
push ecx
call fcn.00402a00
add esp, 0xc
lea edx, [ebp - 0x40]
push edx
lea ecx, [ebp - 0x14]
call fcn.00408de0
push str.___url_:_
lea ecx, [ebp - 0x14]
call fcn.00415cd0
lea ecx, [ebp + 0x24]
call fcn.00401c20
push eax
push 0x4ae534
lea eax, [ebp - 0x40]
push eax
call fcn.00402a00
add esp, 0xc
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00408de0
push str.___WaitCreateFile_:_
lea ecx, [ebp - 0x14]
call fcn.00415cd0
push 0x4d7248
lea ecx, [ebp - 0x14]
call fcn.00408de0
push str.___MethodTrace_:_
lea ecx, [ebp - 0x14]
call fcn.00415cd0
push 0x4d7098
lea ecx, [ebp - 0x14]
call fcn.00408de0
mov byte [ebp - 4], 7
push 0x28
lea edx, [ebp - 0x68]
push edx
push 0x1001
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push str.___Language_:_
lea ecx, [ebp - 0x14]
call fcn.00415cd0
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x14]
call fcn.00415cd0
jmp 0x41f09b
mov dword [ebp - 4], 6
push str.___jscript_:_
lea ecx, [ebp - 0x14]
call fcn.00415cd0
push 0
push str.api_JSON.parse
mov ecx, 0x4d709c
call fcn.00411e10
test eax, eax
jle 0x41f0d6
push str.api_JSON.parse
lea ecx, [ebp - 0x14]
call fcn.00415cd0
jmp 0x41f217
push 0
push str.Error_Script
mov ecx, 0x4d709c
call fcn.00411e10
test eax, eax
jle 0x41f0fd
push str.Error_Script
lea ecx, [ebp - 0x14]
call fcn.00415cd0
jmp 0x41f217
push 0
push 0x4b00f4
mov ecx, 0x4d709c
call fcn.00411e10
test eax, eax
jle 0x41f124
push 0x4b00f4
lea ecx, [ebp - 0x14]
call fcn.00415cd0
jmp 0x41f217
mov ecx, 0x4d709c
call fcn.0045ca60
test eax, eax
jle 0x41f18e
push 0x4af2ac
push 0x19
lea ecx, [ebp - 0x74]
push ecx
mov ecx, 0x4d709c
call fcn.00420ae0
mov dword [ebp - 0x2dc], eax
mov edx, dword [ebp - 0x2dc]
mov dword [ebp - 0x2e0], edx
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x2d8]
or eax, 1
mov dword [ebp - 0x2d8], eax
mov ecx, dword [ebp - 0x2e0]
push ecx
call fcn.00411fc0
add esp, 8
movzx edx, al
test edx, edx
je 0x41f18e
mov dword [ebp - 0x2e4], 1
jmp 0x41f198
mov dword [ebp - 0x2e4], 0
mov al, byte [ebp - 0x2e4]
mov byte [ebp - 0x6d], al
mov dword [ebp - 4], 6
mov ecx, dword [ebp - 0x2d8]
and ecx, 1
je 0x41f1c2
and dword [ebp - 0x2d8], 0xfffffffe
lea ecx, [ebp - 0x74]
call fcn.0043bb20
movzx edx, byte [ebp - 0x6d]
test edx, edx
je 0x41f1d9
push str.DocumentCompleteExplorer1
lea ecx, [ebp - 0x14]
call fcn.00415cd0
jmp 0x41f217
push 0
push str.addLog..onExit
mov ecx, 0x4d709c
call fcn.00411e10
test eax, eax
jle 0x41f1fd
push str.onExit
lea ecx, [ebp - 0x14]
call fcn.00415cd0
jmp 0x41f217
push str.___jscript_:_
lea ecx, [ebp - 0x14]
call fcn.00415cd0
push str.Not_find
lea ecx, [ebp - 0x14]
call fcn.00415cd0
push str.___lno_:_
lea ecx, [ebp - 0x14]
call fcn.00415cd0
lea ecx, [ebp + 0x40]
call fcn.00401c20
push eax
push 0x4ae534
lea eax, [ebp - 0x40]
push eax
call fcn.00402a00
add esp, 0xc
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00408de0
push str.___version_:_
lea ecx, [ebp - 0x14]
call fcn.00415cd0
push 0x4d7244
lea ecx, [ebp - 0x14]
call fcn.00408de0
push str.___ieversion_:_
lea ecx, [ebp - 0x14]
call fcn.00415cd0
push ecx
mov ecx, esp
mov dword [ebp - 0x78], esp
push 0x4afef4
call fcn.004132d0
mov dword [ebp - 0x2e8], eax
mov edx, dword [ebp - 0x2e8]
mov dword [ebp - 0x2ec], edx
mov byte [ebp - 4], 0xa
push ecx
mov ecx, esp
mov dword [ebp - 0x7c], esp
push str.SOFTWAREMicrosoftInternet_Explorer
call fcn.004132d0
mov dword [ebp - 0x2f0], eax
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x2f4], eax
mov byte [ebp - 4], 0xb
push ecx
mov ecx, esp
mov dword [ebp - 0x80], esp
push str.HKEY_LOCAL_MACHINE
call fcn.004132d0
mov dword [ebp - 0x2f8], eax
mov ecx, dword [ebp - 0x2f8]
mov dword [ebp - 0x2fc], ecx
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 0xb
mov ecx, 0x4d70ac
call fcn.004563f0
mov dword [ebp - 0x300], eax
mov edx, dword [ebp - 0x300]
push edx
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 6
mov ecx, 0x4d70ac
call fcn.00456660
mov dword [ebp - 0x304], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00408de0
push str.___trace_:_
lea ecx, [ebp - 0x14]
call fcn.00415cd0
mov dword [ebp - 0x38], 0x4adb78
push 0xbb8
lea edx, [ebp - 0x124]
push edx
mov ecx, 0x4d709c
call fcn.00420ae0
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x30c], eax
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x30c]
call fcn.0043fc50
push eax
lea ecx, [ebp - 0x120]
call fcn.004123d0
mov dword [ebp - 0x310], eax
mov ecx, dword [ebp - 0x310]
mov dword [ebp - 0x314], ecx
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x314]
call fcn.0043fc50
push eax
lea ecx, [ebp - 0x9c]
call fcn.00401fb0
mov dword [ebp - 0x318], eax
mov edx, dword [ebp - 0x318]
mov dword [ebp - 0x31c], edx
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x31c]
call fcn.00401c20
push eax
push 0x4ae534
lea eax, [ebp - 0x40]
push eax
call fcn.00402a00
add esp, 0xc
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x9c]
call fcn.00401c00
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x120]
call fcn.00412410
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x124]
call fcn.0043bb20
push ecx
mov ecx, esp
mov dword [ebp - 0x128], esp
lea edx, [ebp - 0x40]
push edx
call fcn.004059f0
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x324], eax
mov byte [ebp - 4], 0x11
mov byte [ebp - 4], 0xd
call fcn.00405fd0
add esp, 4
mov dword [ebp - 0x328], eax
mov ecx, dword [ebp - 0x328]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x38]
push edx
lea ecx, [ebp - 0x30]
call fcn.00401fb0
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x30]
call fcn.00407140
push eax
lea ecx, [ebp - 0x30]
call fcn.00401c20
push eax
lea eax, [ebp - 0x144]
push eax
call fcn.00405db0
add esp, 0xc
mov dword [ebp - 0x32c], eax
mov ecx, dword [ebp - 0x32c]
mov dword [ebp - 0x330], ecx
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x330]
call fcn.00401c20
push eax
push 0x4ae534
lea edx, [ebp - 0x40]
push edx
call fcn.00402a00
add esp, 0xc
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x144]
call fcn.00401c00
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x14]
call fcn.00408de0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x6c]
call fcn.0045a790
mov byte [ebp - 4], 0x15
push str.___osname_:_
lea ecx, [ebp - 0x14]
call fcn.00415cd0
push ecx
mov ecx, esp
mov dword [ebp - 0x148], esp
push 0x4afe34
call fcn.004132d0
mov dword [ebp - 0x334], eax
mov ecx, dword [ebp - 0x334]
mov dword [ebp - 0x338], ecx
mov byte [ebp - 4], 0x16
lea edx, [ebp - 0x14c]
push edx
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x6c]
call fcn.0045acc0
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x340], eax
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x340]
push ecx
push 0x4adae8
push ecx
mov ecx, esp
mov dword [ebp - 0x150], esp
push 0x4afe70
call fcn.004132d0
mov dword [ebp - 0x344], eax
mov edx, dword [ebp - 0x344]
mov dword [ebp - 0x348], edx
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x154]
push eax
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x6c]
call fcn.0045acc0
mov dword [ebp - 0x34c], eax
mov ecx, dword [ebp - 0x34c]
mov dword [ebp - 0x350], ecx
mov byte [ebp - 4], 0x19
mov edx, dword [ebp - 0x350]
push edx
push 0x4adae8
push ecx
mov ecx, esp
mov dword [ebp - 0x158], esp
push str.osname
call fcn.004132d0
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x358], eax
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x15c]
push ecx
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x6c]
call fcn.0045acc0
mov dword [ebp - 0x35c], eax
mov edx, dword [ebp - 0x35c]
mov dword [ebp - 0x360], edx
mov byte [ebp - 4], 0x1b
mov eax, dword [ebp - 0x360]
push eax
lea ecx, [ebp - 0x160]
push ecx
call fcn.00420c40
add esp, 0xc
mov dword [ebp - 0x364], eax
mov edx, dword [ebp - 0x364]
mov dword [ebp - 0x368], edx
mov byte [ebp - 4], 0x1c
mov eax, dword [ebp - 0x368]
push eax
lea ecx, [ebp - 0x164]
push ecx
call fcn.00420ba0
add esp, 0xc
mov dword [ebp - 0x36c], eax
mov edx, dword [ebp - 0x36c]
mov dword [ebp - 0x370], edx
mov byte [ebp - 4], 0x1d
mov eax, dword [ebp - 0x370]
push eax
lea ecx, [ebp - 0x168]
push ecx
call fcn.00420c40
add esp, 0xc
mov dword [ebp - 0x374], eax
mov edx, dword [ebp - 0x374]
mov dword [ebp - 0x378], edx
mov byte [ebp - 4], 0x1e
mov eax, dword [ebp - 0x378]
push eax
lea ecx, [ebp - 0x16c]
push ecx
call fcn.00420ba0
add esp, 0xc
mov dword [ebp - 0x37c], eax
mov edx, dword [ebp - 0x37c]
mov dword [ebp - 0x380], edx
mov byte [ebp - 4], 0x1f
mov eax, dword [ebp - 0x380]
push eax
lea ecx, [ebp - 0x14]
call fcn.00408de0
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x16c]
call fcn.0043bb20
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x168]
call fcn.0043bb20
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x164]
call fcn.0043bb20
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x160]
call fcn.0043bb20
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x15c]
call fcn.0043bb20
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x154]
call fcn.0043bb20
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x14c]
call fcn.0043bb20
push str.___av_:_
lea ecx, [ebp - 0x14]
call fcn.00415cd0
push ecx
mov ecx, esp
mov dword [ebp - 0x170], esp
push 0x4afe1c
call fcn.004132d0
mov dword [ebp - 0x384], eax
mov ecx, dword [ebp - 0x384]
mov dword [ebp - 0x388], ecx
mov byte [ebp - 4], 0x20
lea edx, [ebp - 0x174]
push edx
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x6c]
call fcn.0045acc0
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x390], eax
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0x390]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00408de0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x174]
call fcn.0043bb20
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x6c]
call fcn.0045a7b0
jmp 0x41f7b7
mov dword [ebp - 4], 0x12
lea ecx, [ebp + 0x5c]
call fcn.00401c20
push eax
push 0x4ae534
lea edx, [ebp - 0x40]
push edx
call fcn.00402a00
add esp, 0xc
push 0
lea ecx, [ebp - 0x40]
call fcn.00420ce0
movzx eax, ax
cmp eax, 0x7b
jne 0x41f7f9
push str.___method_:_
lea ecx, [ebp - 0x14]
call fcn.00415cd0
jmp 0x41f806
push 0x4b004c
lea ecx, [ebp - 0x14]
call fcn.00415cd0
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00408de0
push 0x4afde4
lea ecx, [ebp - 0x14]
call fcn.00415cd0
mov ecx, 0x4d70b8
call fcn.0043fc50
push eax
lea ecx, [ebp - 0x14]
call fcn.00411db0
test eax, eax
jne 0x41f89e
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x30]
call fcn.00401c00
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x34]
call fcn.0043bb20
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x40]
call fcn.0043bb20
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.0043bb20
mov byte [ebp - 4], 2
lea ecx, [ebp + 8]
call fcn.00401c00
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x24]
call fcn.00401c00
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x40]
call fcn.00401c00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x5c]
call fcn.00401c00
jmp 0x41fbab
lea edx, [ebp - 0x14]
push edx
mov ecx, 0x4d70b8
call fcn.00413340
push 0x18
call fcn.004132a0
mov dword [ebp - 0x17c], eax
mov byte [ebp - 4], 0x23
cmp dword [ebp - 0x17c], 0
je 0x41f8d9
mov ecx, dword [ebp - 0x17c]
call fcn.004479d0
mov dword [ebp - 0x394], eax
jmp 0x41f8e3
mov dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x178], eax
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x178]
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x14]
call fcn.0043fc50
push eax
lea ecx, [ebp - 0x220]
call fcn.004123d0
mov dword [ebp - 0x398], eax
mov edx, dword [ebp - 0x398]
mov dword [ebp - 0x39c], edx
mov byte [ebp - 4], 0x24
mov ecx, dword [ebp - 0x39c]
call fcn.0043fc50
push eax
lea ecx, [ebp - 0x19c]
call fcn.00401fb0
mov dword [ebp - 0x3a0], eax
mov eax, dword [ebp - 0x3a0]
mov dword [ebp - 0x3a4], eax
mov byte [ebp - 4], 0x25
mov ecx, dword [ebp - 0x3a4]
call fcn.00401c20
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x180], esp
push eax
call fcn.00401fb0
mov dword [ebp - 0x3a8], eax
mov ecx, dword [ebp - 0x3a8]
mov dword [ebp - 0x3ac], ecx
mov byte [ebp - 4], 0x26
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x224], esp
push str.data
call fcn.00401fb0
mov dword [ebp - 0x3b0], eax
mov edx, dword [ebp - 0x3b0]
mov dword [ebp - 0x3b4], edx
mov byte [ebp - 4], 0x27
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x228], esp
push str.___dmp___
call fcn.00401fb0
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x3bc], eax
mov byte [ebp - 4], 0x28
mov ecx, 0x4d7238
call fcn.0043fc50
push eax
lea ecx, [ebp - 0x2cc]
call fcn.004123d0
mov dword [ebp - 0x3c0], eax
mov ecx, dword [ebp - 0x3c0]
mov dword [ebp - 0x3c4], ecx
mov byte [ebp - 4], 0x29
mov ecx, dword [ebp - 0x3c4]
call fcn.0043fc50
push eax
lea ecx, [ebp - 0x248]
call fcn.00401fb0
mov dword [ebp - 0x3c8], eax
mov edx, dword [ebp - 0x3c8]
mov dword [ebp - 0x3cc], edx
mov byte [ebp - 4], 0x2a
mov ecx, dword [ebp - 0x3cc]
call fcn.00401c20
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x22c], esp
push eax
call fcn.00401fb0
mov dword [ebp - 0x3d0], eax
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x3d4], eax
mov byte [ebp - 4], 0x2b
mov byte [ebp - 4], 0x2d
mov ecx, dword [ebp - 0x3c]
call fcn.00449ad0
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x248]
call fcn.00401c00
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x2cc]
call fcn.00412410
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x19c]
call fcn.00401c00
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x220]
call fcn.00412410
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x2d4], ecx
mov edx, dword [ebp - 0x2d4]
mov dword [ebp - 0x2d0], edx
cmp dword [ebp - 0x2d0], 0
je 0x41fae9
push 1
mov eax, dword [ebp - 0x2d0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2d0]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x3d8], eax
jmp 0x41faf3
mov dword [ebp - 0x3d8], 0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x30]
call fcn.00401c00
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x34]
call fcn.0043bb20
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x40]
call fcn.0043bb20
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.0043bb20
mov byte [ebp - 4], 2
lea ecx, [ebp + 8]
call fcn.00401c00
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x24]
call fcn.00401c00
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x40]
call fcn.00401c00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x5c]
call fcn.00401c00
jmp 0x41fbab
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret