Function at 0x489cb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61b063
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x144
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push str.vdsvrlnk.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ebx, ebx
cmp eax, ebx
mov dword [0x6b5100], eax
je 0x489f76
push str.GetDubServerInterface
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x489f76
call eax
mov esi, dword [ebp + 0xc]
cmp esi, ebx
mov dword [0x6b50fc], eax
je 0x489d3d
cmp byte [esi], bl
je 0x489d3d
mov edx, dword [eax]
mov edx, dword [edx]
lea ecx, [ebp - 0x150]
push ecx
mov ecx, eax
call edx
push 0x80
lea eax, [ebp - 0x150]
push esi
push eax
call fcn.005246bf
mov edi, dword [ebp + 8]
add esp, 0xc
jmp 0x489d68
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x150]
push ecx
push 0x4880a0
push edi
push 0xa4
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
test eax, eax
je 0x489f76
push 0x178
mov dword [ebp - 4], ebx
call fcn.005f7f03
mov ecx, eax
add esp, 4
mov dword [ebp - 0x14], ecx
cmp ecx, ebx
mov byte [ebp - 4], 1
je 0x489dad
mov eax, dword [0x6b48a0]
mov edx, dword [0x6b50f4]
add eax, 0x38
push eax
mov eax, dword [0x6b2d30]
push 0x6af1c0
push edi
push edx
push eax
call fcn.00489b20
mov ecx, eax
mov dword [ebp - 0x14], ecx
jmp 0x489db2
mov dword [ebp - 0x14], ebx
mov ecx, ebx
cmp ecx, ebx
mov byte [ebp - 4], bl
mov dword [ebp - 0x48], ecx
je 0x489dc5
mov edx, dword [ecx]
mov eax, dword [edx]
call eax
mov ecx, dword [ebp - 0x14]
cmp esi, ebx
mov byte [ebp - 4], 2
je 0x489dd5
cmp byte [esi], bl
jne 0x489f53
mov cl, byte [0x6af36b]
neg cl
push ebx
push ebx
lea edx, [ebp - 0x20]
sbb ecx, ecx
and ecx, 0x63a6c8
push ecx
push str.VirtualDub_AVIFile_signpost__.vdr_.avi_
push str.Save_.VDR_signpost_for_AVIFile_handler
push edi
push 0x7369676e
push edx
call fcn.00528829
add esp, 0x20
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 3
je 0x489f3c
mov ecx, dword [0x6b50fc]
mov eax, dword [ecx]
mov eax, dword [eax]
lea edx, [ebp - 0xd0]
push edx
call eax
lea edi, [ebp - 0xd0]
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
cmp al, bl
jne 0x489e30
mov cx, word [0x63a574]
lea eax, [ebp - 0x150]
mov word [edi], cx
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x489e50
lea edi, [ebp - 0xd0]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
cmp cl, bl
jne 0x489e64
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0xd0]
rep movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x489e87
sub eax, edx
mov edx, eax
and edx, 1
add eax, edx
mov edx, dword [ebp - 0x20]
lea ecx, [eax + 0xc]
push 0x312
mov dword [ebp - 0x40], ecx
push edx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x44], 0x46464952
mov dword [ebp - 0x3c], 0x4d524456
mov dword [ebp - 0x38], 0x48544150
mov dword [ebp - 0x34], eax
call fcn.00520821
push 0x14
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 4
call fcn.005202ba
lea eax, [ebp - 0xd0]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x489ee3
sub eax, edx
push eax
lea ecx, [ebp - 0xd0]
push ecx
lea ecx, [ebp - 0x30]
call fcn.005202ba
lea eax, [ebp - 0xd0]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x489f07
sub eax, edx
test al, 1
je 0x489f25
push 1
push 0x62aa66
lea ecx, [ebp - 0x30]
call fcn.005202ba
lea ecx, [ebp - 0x30]
call fcn.00520144
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.00520131
mov eax, dword [ebp - 0x20]
cmp eax, 0x6575cc
mov byte [ebp - 4], 2
je 0x489f50
push eax
call fcn.005f7371
add esp, 4
mov ecx, dword [ebp - 0x14]
mov eax, dword [0x6b50fc]
lea edx, [ebp - 0x150]
push edx
push eax
call fcn.00488cb0
mov ecx, dword [ebp - 0x14]
cmp ecx, ebx
mov byte [ebp - 4], bl
je 0x489f76
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret