Function at 0x4cdc9d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ed6e8
push 0x489ac0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffea4
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
cmp dword [ebp + 8], 0xffffffff
je 0x4cdcd2
cmp dword [ebp + 0x10], 0
jne 0x4cdcdc
mov eax, 0x57
jmp 0x4cdf8b
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x15c], 0
mov ecx, 6
xor eax, eax
lea edi, [ebp - 0x158]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x11c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x11b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x160], 0
mov byte [ebp - 0x128], 0x70
mov byte [ebp - 0x127], 0x73
mov byte [ebp - 0x126], 0x61
mov byte [ebp - 0x125], 0x70
mov byte [ebp - 0x124], 0x69
mov byte [ebp - 0x123], 0x2e
mov byte [ebp - 0x122], 0x64
mov byte [ebp - 0x121], 0x6c
mov byte [ebp - 0x120], 0x6c
mov byte [ebp - 0x11f], 0
mov byte [ebp - 0x13c], 0x47
mov byte [ebp - 0x13b], 0x65
mov byte [ebp - 0x13a], 0x74
mov byte [ebp - 0x139], 0x4d
mov byte [ebp - 0x138], 0x61
mov byte [ebp - 0x137], 0x70
mov byte [ebp - 0x136], 0x70
mov byte [ebp - 0x135], 0x65
mov byte [ebp - 0x134], 0x64
mov byte [ebp - 0x133], 0x46
mov byte [ebp - 0x132], 0x69
mov byte [ebp - 0x131], 0x6c
mov byte [ebp - 0x130], 0x65
mov byte [ebp - 0x12f], 0x4e
mov byte [ebp - 0x12e], 0x61
mov byte [ebp - 0x12d], 0x6d
mov byte [ebp - 0x12c], 0x65
mov byte [ebp - 0x12b], 0x41
mov byte [ebp - 0x12a], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x164], 0
push 0x1c
lea eax, [ebp - 0x15c]
push eax
mov ecx, dword [ebp - 0x164]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
jne 0x4cde2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x140], eax
jmp 0x4cdf3d
cmp dword [ebp - 0x144], 0x1000000
jne 0x4cdf1e
cmp dword [ebp - 0x14c], 0x1000
jne 0x4cdf1e
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0
jne 0x4cde7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x140], eax
jmp 0x4cdf3d
lea ecx, [ebp - 0x13c]
push ecx
mov edx, dword [ebp - 0x160]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
jne 0x4cdeae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x140], eax
jmp 0x4cdf3d
push 0x104
lea eax, [ebp - 0x11c]
push eax
mov ecx, dword [ebp - 0x158]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x168]
test eax, eax
je 0x4cdf1e
mov eax, dword [ebp + 0xc]
push eax
call fcn.0048ded0
add esp, 4
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x11c]
push edx
call fcn.0048ded0
add esp, 4
lea esi, [ebp + eax - 0x11c]
mov eax, dword [ebp + 0xc]
push eax
call fcn.0048ded0
add esp, 4
sub esi, eax
push esi
call fcn.00486e26
add esp, 0xc
test eax, eax
jne 0x4cdf1e
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x158]
mov dword [ecx], edx
jmp 0x4cdf3d
mov eax, dword [ebp - 0x164]
add eax, dword [ebp - 0x150]
mov dword [ebp - 0x164], eax
mov ecx, 1
test ecx, ecx
jne 0x4cddfe
mov dword [ebp - 4], 0xffffffff
jmp 0x4cdf6f
cmp dword [ebp - 0x160], 0
je 0x4cdf85
mov eax, dword [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc