Function at 0x4ad7f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x86196d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf8
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x18]
xor edi, edi
call fcn.004b5e00
mov eax, dword [0x8ab26c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov ebp, dword [esp + 0x118]
lea eax, [esp + 0x64]
push eax
push ebp
lea ecx, [esi + 4]
mov dword [esp + 0x118], edi
call fcn.004afdc0
cmp eax, edi
je 0x4ade0f
add eax, 0x10
lea ecx, [esp + 0x18]
push eax
call fcn.00444600
push 0x493e0
push edi
push ebp
mov ecx, esi
call fcn.004abef0
test eax, eax
je 0x4adedd
push ebp
mov ecx, esi
call fcn.004aec60
test eax, eax
je 0x4adfaf
push ebp
mov ecx, esi
call fcn.004ab720
test eax, eax
jne 0x4ae081
mov ecx, dword [esp + 0x24]
push edi
push edi
push 3
push edi
push 3
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
or esi, 0xffffffff
cmp eax, esi
je 0x4add52
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x5c]
lea ecx, [esp + 0x10]
push edx
call fcn.00617440
mov eax, dword [esp + 0x44]
mov byte [esp + 0x110], 0x25
cmp eax, 1
jne 0x4ada0b
push 6
lea ecx, [esp + 0x68]
call fcn.004b5e30
mov bl, 0x26
lea ecx, [esp + 0x94]
mov byte [esp + 0x110], bl
call fcn.004df100
lea eax, [esp + 0x94]
lea ecx, [esp + 0x64]
push eax
push ecx
mov ecx, 0x9cded8
mov byte [esp + 0x118], 0x27
call fcn.004dd4b0
cmp dword [esp + 0xc8], 1
jne 0x4ad97a
push str.winrdlv3.exe
push str.rundll32.exe
lea ecx, [esp + 0x18]
call fcn.00619e90
push str.winrdlv3.exe
push str.Rundll32.exe
lea ecx, [esp + 0x18]
call fcn.00619e90
push str.winrdlv3.exe
push str.RUNDLL32.EXE
lea ecx, [esp + 0x18]
call fcn.00619e90
lea ecx, [esp + 0xf0]
mov byte [esp + 0x110], 0x2b
call fcn.00831eeb
lea ecx, [esp + 0xd0]
mov byte [esp + 0x110], 0x2a
call fcn.00636c90
lea ecx, [esp + 0xc4]
mov byte [esp + 0x110], 0x29
call fcn.00617ec0
lea ecx, [esp + 0xb4]
mov byte [esp + 0x110], 0x28
call fcn.0061ebe0
lea ecx, [esp + 0x9c]
mov byte [esp + 0x110], 0x2c
call fcn.004ae2f0
lea ecx, [esp + 0x94]
mov byte [esp + 0x110], bl
call fcn.004b5e20
lea ecx, [esp + 0x64]
mov byte [esp + 0x110], 0x25
call fcn.004b5e20
mov eax, dword [esp + 0x44]
cmp eax, 1
je 0x4ada43
cmp eax, 3
je 0x4ada43
cmp eax, 4
jne 0x4add3c
mov eax, dword [0x9dce80]
test eax, eax
je 0x4add3c
push str.CModuleMgr::Run_4
push str.ModuleMgr
push esi
push 0x9dc5ec
call fcn.006600d0
add esp, 0x10
jmp 0x4add3c
mov ebp, dword [esp + 0x11c]
cmp ebp, esi
jne 0x4ada52
mov ebp, dword [esp + 0x50]
mov ebx, dword [esp + 0x120]
test ebx, ebx
jne 0x4ada6a
mov edx, dword [esp + 0x48]
mov dword [esp + 0x120], edx
mov ebx, edx
cmp ebp, esi
je 0x4ae210
test ebx, ebx
je 0x4ae210
cmp dword [esp + 0x124], esi
jne 0x4adae5
cmp ebx, 2
jne 0x4adae5
lea ecx, [esp + 0x80]
call fcn.0082b045
push ebp
lea eax, [esp + 0x84]
push str.explorer.exe
push eax
mov byte [esp + 0x11c], 0x36
call fcn.006f9960
mov eax, dword [esp + 0x94]
add esp, 0xc
test eax, eax
je 0x4ae153
mov ecx, dword [esp + 0x84]
mov byte [esp + 0x110], 0x25
mov edx, dword [ecx]
lea ecx, [esp + 0x80]
mov dword [esp + 0x124], edx
call fcn.0082b078
mov esi, dword [esp + 0x128]
test esi, esi
je 0x4adb08
push 0x947bb0
lea ecx, [esp + 0x14]
call fcn.00618b00
push esi
lea ecx, [esp + 0x14]
call fcn.00618b00
cmp ebx, 1
jne 0x4adba9
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x64]
push eax
call fcn.00831f5f
mov ecx, dword [esp + 0x24]
mov esi, dword [eax]
mov bl, 0x40
push ecx
lea ecx, [esp + 0x18]
mov byte [esp + 0x114], bl
call fcn.00831f5f
mov eax, dword [eax]
push 0
push 0
push esi
push eax
mov byte [esp + 0x120], 0x41
call fcn.006f8b80
add esp, 0x10
lea ecx, [esp + 0x14]
mov edi, eax
mov byte [esp + 0x110], bl
call fcn.00831eeb
lea ecx, [esp + 0x64]
mov byte [esp + 0x110], 0x25
call fcn.00831eeb
mov eax, dword [0x9dce80]
test eax, eax
je 0x4add3c
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
push edx
push eax
push edi
push str.CModuleMgr::Run_1__lu___s____s_
push str.ModuleMgr
push 0xffffffffffffffff
push 0x9dc5ec
call fcn.006600d0
add esp, 0x1c
jmp 0x4add3c
mov eax, dword [esp + 0x34]
xor ebx, ebx
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4adbb8
mov ebx, eax
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x124]
push 0
push 0
push ebp
push ebx
push ecx
push 0
push esi
call fcn.006f9120
mov edi, eax
mov eax, dword [0x9dce80]
add esp, 0x1c
test eax, eax
je 0x4adc0f
test ebx, ebx
mov eax, ebx
jne 0x4adbeb
mov eax, str.NULL
mov edx, dword [esp + 0x10]
push eax
push ebp
push edx
push esi
push edi
push 0
push str.CModuleMgr::Run_2__lu__lu__lu___s___lu___s_
push str.ModuleMgr
push 0xffffffffffffffff
push 0x9dc5ec
call fcn.006600d0
add esp, 0x28
test edi, edi
jne 0x4add3c
cmp dword [esp + 0x120], 2
jne 0x4add3c
lea ecx, [esp + 0x6c]
call fcn.0082b045
lea eax, [esp + 0x6c]
push ebp
push eax
mov byte [esp + 0x118], 0x42
call fcn.006f9940
mov eax, dword [esp + 0x7c]
add esp, 8
xor esi, esi
test eax, eax
jle 0x4add2b
mov ecx, dword [esp + 0x70]
mov eax, dword [ecx + esi*4]
mov ecx, dword [esp + 0x124]
cmp ecx, eax
je 0x4add0b
lea edx, [esp + 0x14]
push eax
push edx
call fcn.006f9890
add esp, 8
lea ecx, [esp + 0x14]
mov byte [esp + 0x110], 0x43
call fcn.00832485
push 0x947958
lea ecx, [esp + 0x18]
call fcn.00825d23
cmp eax, 0xffffffff
jne 0x4adcfa
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x10]
push 0
push 0
mov edx, dword [ecx + esi*4]
push ebp
push ebx
push eax
push 0
push edx
call fcn.006f9120
mov edi, eax
mov eax, dword [0x9dce80]
add esp, 0x1c
test eax, eax
je 0x4adcf6
test ebx, ebx
mov eax, ebx
jne 0x4adccd
mov eax, str.NULL
mov ecx, dword [esp + 0x70]
push eax
mov eax, dword [esp + 0x14]
push ebp
mov edx, dword [ecx + esi*4]
push eax
push edx
push edi
push str.CModuleMgr::Run_22__lu__lu___s___lu___s_
push str.ModuleMgr
push 0xffffffffffffffff
push 0x9dc5ec
call fcn.006600d0
add esp, 0x24
test edi, edi
jne 0x4add1a
lea ecx, [esp + 0x14]
mov byte [esp + 0x110], 0x42
call fcn.00831eeb
mov eax, dword [esp + 0x74]
inc esi
cmp esi, eax
jl 0x4adc52
jmp 0x4add2b
lea ecx, [esp + 0x14]
mov byte [esp + 0x110], 0x42
call fcn.00831eeb
lea ecx, [esp + 0x6c]
mov byte [esp + 0x110], 0x25
call fcn.0082b078
lea ecx, [esp + 0x10]
mov byte [esp + 0x110], 0
call fcn.00617ec0
or esi, 0xffffffff
jmp 0x4add77
cmp dword [0x9dce80], edi
je 0x4add77
mov eax, dword [esp + 0x24]
push eax
push str.CModuleMgr::Run_3___s_
push str.ModuleMgr
push esi
push 0x9dc5ec
call fcn.006600d0
add esp, 0x14
lea ecx, [esp + 0x5c]
mov dword [esp + 0x110], 0x4c
call fcn.00617ec0
lea ecx, [esp + 0x58]
mov byte [esp + 0x110], 0x4b
call fcn.00617ec0
lea ecx, [esp + 0x54]
mov byte [esp + 0x110], 0x4a
call fcn.00617ec0
lea ecx, [esp + 0x34]
mov byte [esp + 0x110], 0x49
call fcn.00617ec0
lea ecx, [esp + 0x30]
mov byte [esp + 0x110], 0x48
call fcn.00617ec0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x110], 0x47
call fcn.00617ec0
lea ecx, [esp + 0x28]
mov byte [esp + 0x110], 0x46
call fcn.00617ec0
lea ecx, [esp + 0x24]
mov byte [esp + 0x110], 0x45
call fcn.00617ec0
mov byte [esp + 0x110], 0x44
jmp 0x4ae2b4
mov eax, dword [0x9dce80]
cmp eax, edi
je 0x4ade31
push str.CModuleMgr::Run_5
push str.ModuleMgr
push 0xffffffffffffffff
push 0x9dc5ec
call fcn.006600d0
add esp, 0x10
lea ecx, [esp + 0x5c]
mov dword [esp + 0x110], 9
call fcn.00617ec0
lea ecx, [esp + 0x58]
mov byte [esp + 0x110], 8
call fcn.00617ec0
lea ecx, [esp + 0x54]
mov byte [esp + 0x110], 7
call fcn.00617ec0
lea ecx, [esp + 0x34]
mov byte [esp + 0x110], 6
call fcn.00617ec0
lea ecx, [esp + 0x30]
mov byte [esp + 0x110], 5
call fcn.00617ec0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x110], 4
call fcn.00617ec0
lea ecx, [esp + 0x28]
mov byte [esp + 0x110], 3
call fcn.00617ec0
lea ecx, [esp + 0x24]
mov byte [esp + 0x110], 2
call fcn.00617ec0
lea ecx, [esp + 0x20]
mov byte [esp + 0x110], 1
call fcn.00617ec0
mov dword [esp + 0x110], 0xffffffff
jmp 0x4ae2c4
mov eax, dword [0x9dce80]
cmp eax, edi
je 0x4adf03
mov ecx, dword [ebp + 4]
push ecx
push str.CModuleMgr::Run_6__lu
push str.ModuleMgr
push 0xffffffffffffffff
push 0x9dc5ec
call fcn.006600d0
add esp, 0x14
lea ecx, [esp + 0x5c]
mov dword [esp + 0x110], 0x12
call fcn.00617ec0
lea ecx, [esp + 0x58]
mov byte [esp + 0x110], 0x11
call fcn.00617ec0
lea ecx, [esp + 0x54]
mov byte [esp + 0x110], 0x10
call fcn.00617ec0
lea ecx, [esp + 0x34]
mov byte [esp + 0x110], 0xf
call fcn.00617ec0
lea ecx, [esp + 0x30]
mov byte [esp + 0x110], 0xe
call fcn.00617ec0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x110], 0xd
call fcn.00617ec0
lea ecx, [esp + 0x28]
mov byte [esp + 0x110], 0xc
call fcn.00617ec0
lea ecx, [esp + 0x24]
mov byte [esp + 0x110], 0xb
call fcn.00617ec0
lea ecx, [esp + 0x20]
mov byte [esp + 0x110], 0xa
call fcn.00617ec0
mov dword [esp + 0x110], 0xffffffff
jmp 0x4ae2c4
mov eax, dword [0x9dce80]
cmp eax, edi
je 0x4adfd5
mov edx, dword [ebp + 4]
push edx
push str.CModuleMgr::Run_66__lu
push str.ModuleMgr
push 0xffffffffffffffff
push 0x9dc5ec
call fcn.006600d0
add esp, 0x14
lea ecx, [esp + 0x5c]
mov dword [esp + 0x110], 0x1b
call fcn.00617ec0
lea ecx, [esp + 0x58]
mov byte [esp + 0x110], 0x1a
call fcn.00617ec0
lea ecx, [esp + 0x54]
mov byte [esp + 0x110], 0x19
call fcn.00617ec0
lea ecx, [esp + 0x34]
mov byte [esp + 0x110], 0x18
call fcn.00617ec0
lea ecx, [esp + 0x30]
mov byte [esp + 0x110], 0x17
call fcn.00617ec0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x110], 0x16
call fcn.00617ec0
lea ecx, [esp + 0x28]
mov byte [esp + 0x110], 0x15
call fcn.00617ec0
lea ecx, [esp + 0x24]
mov byte [esp + 0x110], 0x14
call fcn.00617ec0
lea ecx, [esp + 0x20]
mov byte [esp + 0x110], 0x13
call fcn.00617ec0
mov dword [esp + 0x110], 0xffffffff
jmp 0x4ae2c4
mov eax, dword [0x9dce80]
cmp eax, edi
je 0x4ae0a7
mov eax, dword [ebp + 4]
push eax
push str.CModuleMgr::Run_666__lu
push str.ModuleMgr
push 0xffffffffffffffff
push 0x9dc5ec
call fcn.006600d0
add esp, 0x14
lea ecx, [esp + 0x5c]
mov dword [esp + 0x110], 0x24
call fcn.00617ec0
lea ecx, [esp + 0x58]
mov byte [esp + 0x110], 0x23
call fcn.00617ec0
lea ecx, [esp + 0x54]
mov byte [esp + 0x110], 0x22
call fcn.00617ec0
lea ecx, [esp + 0x34]
mov byte [esp + 0x110], 0x21
call fcn.00617ec0
lea ecx, [esp + 0x30]
mov byte [esp + 0x110], 0x20
call fcn.00617ec0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x110], 0x1f
call fcn.00617ec0
lea ecx, [esp + 0x28]
mov byte [esp + 0x110], 0x1e
call fcn.00617ec0
lea ecx, [esp + 0x24]
mov byte [esp + 0x110], 0x1d
call fcn.00617ec0
lea ecx, [esp + 0x20]
mov byte [esp + 0x110], 0x1c
call fcn.00617ec0
mov dword [esp + 0x110], 0xffffffff
jmp 0x4ae2c4
lea ecx, [esp + 0x80]
mov byte [esp + 0x110], 0x25
call fcn.0082b078
lea ecx, [esp + 0x10]
mov byte [esp + 0x110], 0
call fcn.00617ec0
lea ecx, [esp + 0x5c]
mov dword [esp + 0x110], 0x3f
call fcn.00617ec0
lea ecx, [esp + 0x58]
mov byte [esp + 0x110], 0x3e
call fcn.00617ec0
lea ecx, [esp + 0x54]
mov byte [esp + 0x110], 0x3d
call fcn.00617ec0
lea ecx, [esp + 0x34]
mov byte [esp + 0x110], 0x3c
call fcn.00617ec0
lea ecx, [esp + 0x30]
mov byte [esp + 0x110], 0x3b
call fcn.00617ec0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x110], 0x3a
call fcn.00617ec0
lea ecx, [esp + 0x28]
mov byte [esp + 0x110], 0x39
call fcn.00617ec0
lea ecx, [esp + 0x24]
mov byte [esp + 0x110], 0x38
call fcn.00617ec0
mov byte [esp + 0x110], 0x37
jmp 0x4ae2b4
lea ecx, [esp + 0x10]
mov byte [esp + 0x110], 0
call fcn.00617ec0
lea ecx, [esp + 0x5c]
mov dword [esp + 0x110], 0x35
call fcn.00617ec0
lea ecx, [esp + 0x58]
mov byte [esp + 0x110], 0x34
call fcn.00617ec0
lea ecx, [esp + 0x54]
mov byte [esp + 0x110], 0x33
call fcn.00617ec0
lea ecx, [esp + 0x34]
mov byte [esp + 0x110], 0x32
call fcn.00617ec0
lea ecx, [esp + 0x30]
mov byte [esp + 0x110], 0x31
call fcn.00617ec0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x110], 0x30
call fcn.00617ec0
lea ecx, [esp + 0x28]
mov byte [esp + 0x110], 0x2f
call fcn.00617ec0
lea ecx, [esp + 0x24]
mov byte [esp + 0x110], 0x2e
call fcn.00617ec0
mov byte [esp + 0x110], 0x2d
lea ecx, [esp + 0x20]
call fcn.00617ec0
mov dword [esp + 0x110], esi
lea ecx, [esp + 0x18]
call fcn.004b5e20
mov ecx, dword [esp + 0x108]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x104
ret 0x14