Function at 0x4721f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x670a68
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x4478
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor esi, esi
mov dword [ebp - 0x4478], esi
mov dword [ebp - 4], esi
call fcn.0045f200
call fcn.0045f3a0
cmp eax, esi
je 0x473903
mov ebx, dword [0x72bb88]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp ebx, esi
je 0x473903
cmp dword [ebx], esi
je 0x473903
mov byte [ebp - 0xb28], 0
push 0x7ff
push esi
lea eax, [ebp - 0xb27]
push eax
call fcn.005dfd60
mov byte [ebp - 0x404c], 0
push 0x7ff
push esi
lea ecx, [ebp - 0x404b]
push ecx
call fcn.005dfd60
mov byte [ebp - 0x184c], 0
push 0x3ff
push esi
lea edx, [ebp - 0x184b]
push edx
call fcn.005dfd60
add esp, 0x24
mov eax, dword [ebx]
cmp byte [eax], 0x3a
jne 0x4722bf
inc eax
mov dword [ebp - 0x446c], eax
cmp eax, esi
je 0x4722fc
push eax
lea eax, [ebp - 0x404c]
push eax
call edi
push 1
lea ecx, [ebp - 0x404c]
push ecx
call fcn.00515650
push 0x800
lea edx, [ebp - 0xb28]
push edx
lea eax, [ebp - 0x404c]
push eax
call fcn.004e82a0
add esp, 0xc
push 0x5c
lea ecx, [ebp - 0xb28]
push ecx
call fcn.005e0a00
add esp, 8
mov esi, eax
test esi, esi
je 0x47233b
inc esi
movzx edx, byte [esi]
mov byte [ebp - 0x444d], dl
mov byte [esi], 0
lea eax, [ebp - 0xb28]
push eax
lea ecx, [ebp - 0x184c]
push ecx
call edi
movzx edx, byte [ebp - 0x444d]
mov byte [esi], dl
jmp 0x472341
lea esi, [ebp - 0xb28]
test esi, esi
je 0x4738f9
cmp byte [esi], 0
je 0x4738f9
push esi
call fcn.004dd6c0
add esp, 4
cmp eax, 0x3ff
jae 0x4738f9
mov byte [ebp - 0x1244], 0
push 0x40f
push 0
lea eax, [ebp - 0x1243]
push eax
call fcn.005dfd60
mov byte [ebp - 0x144c], 0
push 0x103
push 0
lea ecx, [ebp - 0x144b]
push ecx
call fcn.005dfd60
add esp, 0x18
mov dword [ebp - 0x4470], 0
push esi
lea edx, [ebp - 0x444c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebx + 0xc]
cmp eax, 4
jbe 0x4723d4
lea ecx, [ebp - 0x144c]
push ecx
lea edx, [ebp - 0xb28]
push edx
push eax
call fcn.00545880
add esp, 0xc
push 0x2e
lea eax, [ebp - 0x444c]
push eax
call fcn.005e0a00
add esp, 8
mov edi, eax
test edi, edi
je 0x4738f9
cmp dword [ebx + 0xc], 0
jbe 0x4738f9
mov dword [ebp - 0x4468], 0
push str.dsNcService.exe
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x472439
push str.PulseSetupClient.exe
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x472439
push str.dsNetworkConnect.exe
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x47244c
cmp dword [0x72cefc], 0
je 0x47244c
push 2
call fcn.0044dda0
add esp, 4
push 0x631384
push edi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x472480
push eax
lea ecx, [ebp - 0xb28]
push ecx
push esi
call fcn.00450170
add esp, 0xc
test eax, eax
je 0x472480
mov edi, 1
mov dword [ebp - 0x4468], edi
jmp 0x472485
mov edi, 1
push 0
lea edx, [ebp - 0xb28]
push edx
push 0
call fcn.00469a90
add esp, 0xc
test eax, eax
jne 0x4724c5
push eax
push esi
push eax
call fcn.00469a90
add esp, 0xc
test eax, eax
jne 0x4724c5
cmp dword [0x6e9198], edi
jne 0x4724cd
push str.InetInfo.exe
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4724cd
mov dword [ebp - 0x4468], edi
jmp 0x4724d9
cmp dword [ebp - 0x4468], edi
jne 0x472664
push str.SBDDesktop.exe
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x472638
lea eax, [ebp - 0xb28]
push eax
push esi
call fcn.0045ca70
add esp, 8
test eax, eax
jne 0x472638
push str.wget.exe
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x472537
push eax
push str.wgwin_
lea ecx, [ebp - 0xb28]
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x472638
cmp dword [0x6e9198], edi
jne 0x472555
push str.InetInfo.exe
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x472638
mov edx, dword [ebx + 0xc]
push 0
push edx
push 0
push 0x2000700
call dword [0x6e9118]
add esp, 0x10
mov esi, eax
test esi, esi
jl 0x4725a9
mov eax, dword [ebx + 0xc]
push eax
lea ecx, [ebp - 0xb28]
push ecx
push str.___Process___s:_d__Registered_For_FSBP__4_
lea edx, [ebp - 0x1244]
push edx
call fcn.005dfb23
push 0
push edi
lea eax, [ebp - 0x1244]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x20
jmp 0x47363a
mov byte [ebp - 0xd30], 0
push 0x103
push 0
lea ecx, [ebp - 0xd2f]
push ecx
call fcn.005dfd60
lea edx, [ebp - 0xd30]
push edx
push esi
call fcn.0044c900
add esp, 0x14
cmp byte [ebp - 0xd30], 0
jne 0x4725f6
push esi
mov eax, dword [ebx + 0xc]
push eax
lea ecx, [ebp - 0xb28]
push ecx
push str.___Process___s:_d__Registration_For_FSBP_Failed__4___Error_Returned:_0x_x
lea edx, [ebp - 0x1244]
push edx
jmp 0x472614
lea eax, [ebp - 0xd30]
push eax
mov ecx, dword [ebx + 0xc]
push ecx
lea edx, [ebp - 0xb28]
push edx
push str.___Process___s:_d__Registration_For_FSBP_Failed__4___Error_Returned:__s
lea eax, [ebp - 0x1244]
push eax
call fcn.005dfb23
add esp, 0x14
push 0
push edi
lea ecx, [ebp - 0x1244]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x47363a
push 0
push 5
mov edx, dword [ebx + 0xc]
push edx
lea eax, [ebp - 0xb28]
push eax
call fcn.0045b2a0
push 0
push edi
push 0
push 0x2000fa1
call dword [0x6e9118]
add esp, 0x20
jmp 0x47363a
push str.svchost.exe
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x472711
push 0x8000
call fcn.005e20e4
add esp, 4
mov esi, eax
test esi, esi
je 0x47363a
mov dword [ebp - 0x448c], 0
mov byte [esi], 0
lea ecx, [ebp - 0x448c]
push ecx
push esi
push 0
mov edx, dword [ebx + 0xc]
push edx
call fcn.004f9ab0
add esp, 0x10
cmp byte [esi], 0
je 0x47270b
push 0
push str.LocalSystemNetworkRestricted
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4726e3
push 0
push str.netsvcs
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x47270b
push 0
push 7
mov eax, dword [ebx + 0xc]
push eax
lea ecx, [ebp - 0xb28]
push ecx
call fcn.0045b2a0
push 0
push 1
push 0
push 0x2000fa1
call dword [0x6e9118]
add esp, 0x20
push esi
jmp 0x473632
cmp dword [0x68628c], 0
je 0x4728f9
push 0
push str.IObit_Uninstaller
lea edx, [ebp - 0xb28]
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4727de
push str.unins000.exe
push esi
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x4727de
mov eax, dword [ebx + 0xc]
push eax
lea ecx, [ebp - 0xb28]
push ecx
push str._CPL__MEM__Force_Terminating_Uninstaller:__s__pid:_u_
lea edx, [ebp - 0x328]
push edx
call fcn.005dfb23
push 0
push edi
lea eax, [ebp - 0x328]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x20
push 0
mov ecx, dword [ebx + 0xc]
push ecx
call fcn.0050fb00
mov edx, dword [str._ST__IOBit_Blocked]
mov dword [ebp - 0x120], edx
mov eax, dword [0x6311f4]
mov dword [ebp - 0x11c], eax
mov ecx, dword [0x6311f8]
mov dword [ebp - 0x118], ecx
mov edx, dword [0x6311fc]
mov dword [ebp - 0x114], edx
mov ax, word [0x631200]
mov word [ebp - 0x110], ax
mov cl, byte [0x631202]
mov byte [ebp - 0x10e], cl
jmp 0x47363a
cmp dword [0x68628c], 0
je 0x4728f9
cmp byte [ebp - 0x184c], 0
je 0x4728f9
push str.TuRes.dll
lea edx, [ebp - 0x184c]
push edx
call fcn.004ec4e0
add esp, 8
test eax, eax
jne 0x4728f9
push str.unins000.exe
push esi
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x4728f9
mov dword [ebp - 0x4458], 0
lea eax, [ebp - 0x4458]
push eax
lea ecx, [ebp - 0xb28]
push ecx
call fcn.004f1610
mov ecx, dword [ebp - 0x4458]
test ecx, ecx
je 0x47363a
cmp byte [ecx], 0
je 0x4728c5
push eax
push str.GAVRILA
push ecx
call fcn.004f5ad0
add esp, 0xc
cmp eax, 0xffffffff
je 0x4728bf
mov edx, dword [ebx + 0xc]
push edx
lea eax, [ebp - 0xb28]
push eax
push str._CPL__MEM__Force_Terminating_Uninstaller:__s__pid:_u_
lea ecx, [ebp - 0x328]
push ecx
call fcn.005dfb23
push 0
push 1
lea edx, [ebp - 0x328]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
push 0
mov eax, dword [ebx + 0xc]
push eax
call fcn.0050fb00
mov ecx, 7
mov esi, str._ST__TotalUninstall_Blocked
lea edi, [ebp - 0x120]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x4458]
push ecx
call fcn.005e0865
push 0
push 0
push str.Tu.
lea ecx, [ebp - 0x184c]
push ecx
call fcn.00517250
add esp, 0x14
mov edx, dword [ebx + 0xc]
push edx
call fcn.004f28b0
push 0
push eax
call fcn.0050fb00
jmp 0x47363a
cmp dword [0x686078], 0
je 0x4729b0
push 0
push str.IObit
lea eax, [ebp - 0xb28]
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4729b0
mov ecx, dword [ebx + 0xc]
push ecx
lea edx, [ebp - 0xb28]
push edx
push str._CPL__MEM__Force_Terminating_IOBit_Process:__s__pid:_u_
lea eax, [ebp - 0x328]
push eax
call fcn.005dfb23
push 0
push edi
lea ecx, [ebp - 0x328]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
push 0
mov edx, dword [ebx + 0xc]
push edx
call fcn.0050fb00
mov eax, dword [str._ST__IOBit_Blocked_A_]
mov dword [ebp - 0x120], eax
mov ecx, dword [0x631164]
mov dword [ebp - 0x11c], ecx
mov edx, dword [0x631168]
mov dword [ebp - 0x118], edx
mov eax, dword [0x63116c]
mov dword [ebp - 0x114], eax
mov ecx, dword [0x631170]
mov dword [ebp - 0x110], ecx
mov dx, word [0x631174]
mov word [ebp - 0x10c], dx
jmp 0x47363a
cmp dword [0x68607c], 0
je 0x472a4e
push 0
push str.ilockmsg.exe
lea eax, [ebp - 0xb28]
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x472a4e
push 0
push 0
push 0
lea ecx, [ebp - 0x4470]
push ecx
lea edx, [ebp - 0xb28]
push edx
call fcn.004ec5a0
add esp, 0x14
test eax, eax
jne 0x472a4e
cmp dword [ebp - 0x4470], 0x14000
jae 0x472a4e
mov eax, dword [ebx + 0xc]
push eax
lea ecx, [ebp - 0xb28]
push ecx
push str._CPL__MEM__Force_Terminating_ILockMsg_Process:__s__pid:_u_
lea edx, [ebp - 0x328]
push edx
call fcn.005dfb23
push 0
push edi
lea eax, [ebp - 0x328]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x20
push 0
mov ecx, dword [ebx + 0xc]
push ecx
call fcn.0050fb00
mov byte [ebp - 0x120], 0
jmp 0x47363a
cmp dword [0x68628c], 0
je 0x472c8b
push 0
push str.WiseProgram
lea edx, [ebp - 0xb28]
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x472a91
push 0
push str.WiseDelete
lea eax, [ebp - 0xb28]
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x472b10
mov ecx, dword [ebx + 0xc]
push ecx
lea edx, [ebp - 0xb28]
push edx
push str._CPL__MEM__Force_Terminating_WiseProgram_Uninstaller_Process:__s__pid:_u_
lea eax, [ebp - 0x328]
push eax
call fcn.005dfb23
push 0
push edi
lea ecx, [ebp - 0x328]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
push 0
mov edx, dword [ebx + 0xc]
push edx
call fcn.0050fb00
mov eax, dword [str._ST__Wise_Blocked]
mov dword [ebp - 0x120], eax
mov ecx, dword [0x6310a0]
mov dword [ebp - 0x11c], ecx
mov edx, dword [0x6310a4]
mov dword [ebp - 0x118], edx
mov eax, dword [0x6310a8]
mov dword [ebp - 0x114], eax
mov cx, word [0x6310ac]
mov word [ebp - 0x110], cx
jmp 0x47363a
cmp dword [0x68628c], 0
je 0x472c8b
push 0
push str.Revo_Uninstaller
lea edx, [ebp - 0xb28]
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x472bcd
push str.uninst.exe
push esi
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x472bcd
mov eax, dword [ebx + 0xc]
push eax
lea ecx, [ebp - 0xb28]
push ecx
push str._CPL__MEM__Force_Terminating_Uninstaller:__s__pid:_u_
lea edx, [ebp - 0x328]
push edx
call fcn.005dfb23
push 0
push edi
lea eax, [ebp - 0x328]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x20
push 0
mov ecx, dword [ebx + 0xc]
push ecx
call fcn.0050fb00
mov edx, dword [str._ST__Revo_Blocked]
mov dword [ebp - 0x120], edx
mov eax, dword [0x63106c]
mov dword [ebp - 0x11c], eax
mov ecx, dword [0x631070]
mov dword [ebp - 0x118], ecx
mov edx, dword [0x631074]
mov dword [ebp - 0x114], edx
mov ax, word [0x631078]
mov word [ebp - 0x110], ax
jmp 0x47363a
cmp dword [0x68628c], 0
je 0x472c8b
push str.RevoUn.exe
push esi
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x472c02
push str.RevoUPort.exe
push esi
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x472c8b
mov ecx, dword [ebx + 0xc]
push ecx
lea edx, [ebp - 0xb28]
push edx
push str._CPL__MEM__Force_Terminating_Uninstaller:__s__pid:_u_
lea eax, [ebp - 0x328]
push eax
call fcn.005dfb23
push 0
push edi
lea ecx, [ebp - 0x328]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
push 0
mov edx, dword [ebx + 0xc]
push edx
call fcn.0050fb00
mov eax, dword [str._ST__Revo_Blocked_B_]
mov dword [ebp - 0x120], eax
mov ecx, dword [0x631038]
mov dword [ebp - 0x11c], ecx
mov edx, dword [0x63103c]
mov dword [ebp - 0x118], edx
mov eax, dword [0x631040]
mov dword [ebp - 0x114], eax
mov ecx, dword [0x631044]
mov dword [ebp - 0x110], ecx
mov dl, byte [0x631048]
mov byte [ebp - 0x10c], dl
jmp 0x47363a
cmp dword [0x7302c0], 0
je 0x472d27
push str.adb.exe
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x472d27
mov eax, dword [ebx + 0xc]
push eax
lea ecx, [ebp - 0xb28]
push ecx
push str._CPL__MEM__Force_Terminating_ADB:__s__pid:_u_
lea edx, [ebp - 0x328]
push edx
call fcn.005dfb23
push 0
push edi
lea eax, [ebp - 0x328]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x20
push 0
mov ecx, dword [ebx + 0xc]
push ecx
call fcn.0050fb00
mov edx, dword [str._ST__ADB_Blocked]
mov dword [ebp - 0x120], edx
mov eax, dword [0x630fec]
mov dword [ebp - 0x11c], eax
mov ecx, dword [0x630ff0]
mov dword [ebp - 0x118], ecx
mov edx, dword [0x630ff4]
mov dword [ebp - 0x114], edx
mov al, byte [0x630ff8]
mov byte [ebp - 0x110], al
jmp 0x47363a
mov eax, dword [0x7302bc]
cmp eax, edi
je 0x472d39
cmp eax, 0xb
jne 0x472dda
push str.msconfig.exe
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x472dda
mov ecx, dword [ebx + 0xc]
push ecx
lea edx, [ebp - 0xb28]
push edx
push str._CPL__MEM__Force_Terminating_MSConfig:__s__pid:_u_
lea eax, [ebp - 0x328]
push eax
call fcn.005dfb23
push 0
push edi
lea ecx, [ebp - 0x328]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
push 0
mov edx, dword [ebx + 0xc]
push edx
call fcn.0050fb00
mov eax, dword [str._ST__MSConfig_Blocked]
mov dword [ebp - 0x120], eax
mov ecx, dword [0x630f90]
mov dword [ebp - 0x11c], ecx
mov edx, dword [0x630f94]
mov dword [ebp - 0x118], edx
mov eax, dword [0x630f98]
mov dword [ebp - 0x114], eax
mov ecx, dword [0x630f9c]
mov dword [ebp - 0x110], ecx
mov dx, word [0x630fa0]
mov word [ebp - 0x10c], dx
jmp 0x47363a
push str.rundll32.exe
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x472f2a
push 0x8000
call fcn.005e20e4
add esp, 4
mov edi, eax
test edi, edi
je 0x47363a
mov dword [ebp - 0x4488], 0
mov byte [edi], 0
lea eax, [ebp - 0x4488]
push eax
push edi
push 0
mov ecx, dword [ebx + 0xc]
push ecx
call fcn.004f9ab0
add esp, 0x10
mov ecx, edi
lea edx, [ecx + 1]
mov dword [ebp - 0x4454], edx
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x472e35
sub ecx, dword [ebp - 0x4454]
mov dword [ebp - 0x4454], ecx
cmp ecx, 0x800
jae 0x472e7c
push edi
push eax
push esi
push str._CPL__MEM___s_found_started_with_Res:_u__Param:_s
lea eax, [ebp - 0x384c]
push eax
call fcn.005dfb23
push 0
push 1
lea ecx, [ebp - 0x384c]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x24
cmp byte [edi], 0
je 0x473631
cmp dword [ebp - 0x4454], 0x800
jae 0x473631
push 1
push edi
call fcn.0045cc40
add esp, 8
test eax, eax
je 0x473631
push edi
push str._CPL__MEM__TERMINATE__CmdLine:__s
lea edx, [ebp - 0x384c]
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0x384c]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
push 0
mov ecx, dword [ebx + 0xc]
push ecx
call fcn.0050fb00
mov edx, dword [str._ST__RunDLL32_Blocked]
mov dword [ebp - 0x120], edx
mov eax, dword [0x630f20]
mov dword [ebp - 0x11c], eax
mov ecx, dword [0x630f24]
mov dword [ebp - 0x118], ecx
mov edx, dword [0x630f28]
mov dword [ebp - 0x114], edx
mov eax, dword [0x630f2c]
mov dword [ebp - 0x110], eax
mov cx, word [0x630f30]
mov word [ebp - 0x10c], cx
jmp 0x473631
cmp dword [0x686288], 0
jbe 0x47313c
push str.ntvdm.exe
push esi
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x47313c
mov byte [ebp - 0x1c4c], al
push 0x3ff
push eax
lea edx, [ebp - 0x1c4b]
push edx
call fcn.005dfd60
mov byte [ebp - 0x384c], 0
push 0xfff
push 0
lea eax, [ebp - 0x384b]
push eax
call fcn.005dfd60
add esp, 0x18
cmp dword [0x686288], 2
jne 0x473070
mov ecx, dword [str._ST__NTVDM_Blocked]
mov dword [ebp - 0x120], ecx
mov edx, dword [0x630f00]
mov dword [ebp - 0x11c], edx
mov eax, dword [0x630f04]
mov dword [ebp - 0x118], eax
mov ecx, dword [0x630f08]
mov dword [ebp - 0x114], ecx
mov dx, word [0x630f0c]
mov word [ebp - 0x110], dx
mov al, byte [0x630f0e]
mov byte [ebp - 0x10e], al
lea edx, [ebp - 0x384c]
push edx
lea eax, [ebp - 0x1c4c]
push eax
mov ecx, dword [ebx + 0xc]
push ecx
lea edx, [ebp - 0xb28]
push edx
push str._CPL__MEM__Force_Terminating_NTVDM:__s__pid:_u___Parent:__s___s_
lea eax, [ebp - 0x328]
push eax
call fcn.005dfb23
push 0
push edi
lea ecx, [ebp - 0x328]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x28
push 0
mov edx, dword [ebx + 0xc]
push edx
call fcn.0050fb00
mov eax, dword [str._ST__NTVDM_Blocked_C_]
mov dword [ebp - 0x120], eax
mov ecx, dword [0x630ea4]
mov dword [ebp - 0x11c], ecx
mov edx, dword [0x630ea8]
mov dword [ebp - 0x118], edx
mov eax, dword [0x630eac]
mov dword [ebp - 0x114], eax
mov ecx, dword [0x630eb0]
mov dword [ebp - 0x110], ecx
mov dx, word [0x630eb4]
mov word [ebp - 0x10c], dx
jmp 0x47363a
mov ecx, dword [ebx + 0xc]
push ecx
call fcn.004f28b0
cmp eax, 4
jbe 0x473092
lea edx, [ebp - 0x384c]
push edx
lea ecx, [ebp - 0x1c4c]
push ecx
push eax
call fcn.00515670
push 0
push str.lsass
lea edx, [ebp - 0x1c4c]
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4730fa
mov eax, dword [str._ST__NTVDM_Blocked_B_]
mov dword [ebp - 0x120], eax
mov ecx, dword [0x630e84]
mov dword [ebp - 0x11c], ecx
mov edx, dword [0x630e88]
mov dword [ebp - 0x118], edx
mov eax, dword [0x630e8c]
mov dword [ebp - 0x114], eax
mov ecx, dword [0x630e90]
mov dword [ebp - 0x110], ecx
mov dx, word [0x630e94]
mov word [ebp - 0x10c], dx
jmp 0x472fd7
lea eax, [ebp - 0x384c]
push eax
lea ecx, [ebp - 0x1c4c]
push ecx
lea edx, [ebp - 0xb28]
push edx
push str._CPL__MEM__NOT_Terminating_NTVDM:__s_as_Parent_is__s___s_
lea eax, [ebp - 0x328]
push eax
call fcn.005dfb23
push 0
push edi
lea ecx, [ebp - 0x328]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x24
jmp 0x47363a
push str.MsMpEng.exe
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4731d7
call fcn.004d9b00
test eax, eax
je 0x4731d7
mov eax, dword [ebx + 0xc]
push eax
lea ecx, [ebp - 0xb28]
push ecx
push str._CPL__MEM___s:_d_Found_Running__Re_registering_our_process_with_WSC...
lea edx, [ebp - 0x328]
push edx
call fcn.005dfb23
push 0
push edi
lea eax, [ebp - 0x328]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x20
push str.AVRegisteredWithWsc
push 0x6111b8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e9430
push str.ASRegisteredWithWsc
push 0x6111b8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e9430
call fcn.004190e0
push 0x226
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
call fcn.0054cde0
add esp, 8
jmp 0x47363a
push str.powershell.exe
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x473381
push str.schtasks.exe
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x473381
push str.cmd.exe
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x473381
push str.msiexec.exe
push esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x473369
push 0x8000
call fcn.005e20e4
add esp, 4
mov edi, eax
test edi, edi
je 0x47363a
mov dword [ebp - 0x4490], 0
mov byte [edi], 0
lea ecx, [ebp - 0x4490]
push ecx
push edi
push 0
mov edx, dword [ebx + 0xc]
push edx
call fcn.004f9ab0
add esp, 0x10
test eax, eax
je 0x47331d
cmp byte [edi], 0
je 0x47331d
push 0x20
push edi
call fcn.005e0940
add esp, 8
test eax, eax
jne 0x4732d5
push esi
push str._CPL__MEM___s_started_without_CmdLine_Param._Will_check_for_Miner_Activity...
lea eax, [ebp - 0x384c]
push eax
call fcn.005dfb23
push 0
push 1
lea ecx, [ebp - 0x384c]
push ecx
push 0x6aec98
call fcn.004311c0
mov edx, dword [ebx + 0xc]
push edx
push 0
push 0x45efd0
call fcn.005e07ac
push 0
push eax
push str.CBD_7mPP_Mem
call fcn.00420720
add esp, 0x34
jmp 0x473631
push 0x7fe
push edi
lea eax, [ebp - 0x204c]
push eax
call fcn.004d5c40
lea ecx, [ebp - 0x204c]
push ecx
push esi
push str._CPL__MEM___s_started_with_CmdParam:__s
lea edx, [ebp - 0x384c]
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0x384c]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x2c
jmp 0x473631
push esi
push str._CPL__MEM__GCMDFAIL____s_started_possibly_without_CmdLine_Param._Will_check_for_Miner_Activity...
lea ecx, [ebp - 0x1c4c]
push ecx
call fcn.005dfb23
push 0
push 1
lea edx, [ebp - 0x1c4c]
push edx
push 0x6aec98
call fcn.004311c0
mov eax, dword [ebx + 0xc]
push eax
push 0
push 0x45efd0
call fcn.005e07ac
push 0
push eax
push str.CBD_7mPP_Mem1
call fcn.00420720
add esp, 0x34
jmp 0x473631
lea ecx, [ebp - 0xb28]
push ecx
mov edx, dword [ebx + 0xc]
push edx
call fcn.0045c7a0
add esp, 8
jmp 0x47363a
push 0x8000
call fcn.005e20e4
add esp, 4
mov edi, eax
test edi, edi
je 0x47363a
mov dword [ebp - 0x4480], 0
mov byte [edi], 0
lea eax, [ebp - 0x4480]
push eax
push edi
push 0
mov ecx, dword [ebx + 0xc]
push ecx
call fcn.004f9ab0
add esp, 0x10
mov dword [ebp - 0x4484], eax
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4733c6
sub eax, edx
mov dword [ebp - 0x4464], eax
cmp byte [edi], cl
je 0x4735f3
xor eax, eax
mov dword [ebp - 0x4474], eax
mov dword [ebp - 0x445c], eax
mov dword [ebp - 0x4460], eax
push str.powershell.exe
push esi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x473418
push 0
push str.powershell
push edi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x473422
mov dword [ebp - 0x4460], 1
cmp dword [0x7302a8], 0
je 0x47343e
cmp dword [ebp - 0x4460], 0
je 0x47343e
mov dword [ebp - 0x4474], 1
push edi
call fcn.005da810
add esp, 4
mov dword [ebp - 0x4454], eax
test eax, eax
jne 0x47347f
cmp dword [ebp - 0x4460], eax
je 0x47347f
cmp dword [0x7302ac], eax
jne 0x47347f
push eax
push str.SCM_Event
push edi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x47347f
mov dword [ebp - 0x445c], 1
cmp dword [0x71de6c], 0
je 0x4734d9
mov byte [ebp - 0x1348], 0
push 0x103
push 0
lea edx, [ebp - 0x1347]
push edx
call fcn.005dfd60
mov eax, dword [ebp - 0x445c]
push eax
mov ecx, dword [ebp - 0x4454]
push ecx
push str._PSInf_B____u__PSInf_Scm___u
lea edx, [ebp - 0x1348]
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0x1348]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x2c
cmp dword [ebp - 0x4474], 0
jne 0x4735f3
cmp dword [ebp - 0x4454], 0
jne 0x4734fc
cmp dword [ebp - 0x445c], 0
je 0x4735f3
lea ecx, [ebp - 0x284c]
cmp dword [ebp - 0x4464], 0x800
jae 0x473534
push edi
push str._CPL__MEM__TERMINATE__CmdLine:__s
push ecx
call fcn.005dfb23
push 0
push 1
lea edx, [ebp - 0x284c]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x473598
mov eax, dword [ebp - 0x4464]
push eax
push str._CPL__MEM__TERMINATE__CmdLine:__see_next_line_as_length_is__d_
push ecx
call fcn.005dfb23
push 0
push 1
lea edx, [ebp - 0x284c]
push edx
push 0x6aec98
call fcn.004311c0
push 0x1000
push 0
lea eax, [ebp - 0x284c]
push eax
call fcn.005dfd60
push 0x800
push edi
lea ecx, [ebp - 0x284c]
push ecx
call fcn.004d5c40
push 0
push 1
lea edx, [ebp - 0x284c]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x44
push 0
mov eax, dword [ebx + 0xc]
push eax
call fcn.0050fb00
mov dword [ebp - 0x4478], 1
mov ecx, dword [str._ST__PowerShell_Blocked]
mov dword [ebp - 0x120], ecx
mov edx, dword [0x630c2c]
mov dword [ebp - 0x11c], edx
mov eax, dword [0x630c30]
mov dword [ebp - 0x118], eax
mov ecx, dword [0x630c34]
mov dword [ebp - 0x114], ecx
mov edx, dword [0x630c38]
mov dword [ebp - 0x110], edx
mov eax, dword [0x630c3c]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x4464], 0x800
jae 0x473631
push edi
mov ecx, dword [ebp - 0x4484]
push ecx
push esi
push str._CPL__MEM___s_started_with_Res:_u__Param:_s
lea edx, [ebp - 0x284c]
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0x284c]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x24
push edi
call fcn.005e0865
add esp, 4
cmp dword [0x6e916c], 0
jne 0x473650
cmp dword [0x6e9174], 0
je 0x4738f9
mov dword [ebp - 0x447c], 0
mov ecx, dword [ebx + 0xc]
push ecx
call fcn.004f28b0
mov esi, eax
lea edx, [ebp - 0x447c]
push edx
push esi
mov eax, dword [ebx + 0xc]
push eax
mov ecx, dword [ebp - 0x446c]
push ecx
call fcn.0046ab10
add esp, 0x10
test eax, eax
je 0x4738f9
mov edx, dword [ebx + 0xc]
push 0
push edx
push 0
push 0x2000708
call dword [0x6e9118]
add esp, 0x10
mov edi, eax
test edi, edi
jl 0x4736f1
push 0
mov eax, dword [ebx + 0xc]
push eax
call fcn.005438d0
push 0
call fcn.00540450
push eax
push esi
mov ecx, dword [ebx + 0xc]
push ecx
lea edx, [ebp - 0xb28]
push edx
push str.___Process___s:_u__ppid:_u___Registered_For_PFACC__4___PidC___u_
lea eax, [ebp - 0x1244]
push eax
call fcn.005dfb23
push 0
push 1
lea ecx, [ebp - 0x1244]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x34
jmp 0x4737da
mov byte [ebp - 0xc2c], 0
push 0x103
push 0
lea edx, [ebp - 0xc2b]
push edx
call fcn.005dfd60
lea eax, [ebp - 0xc2c]
push eax
push edi
call fcn.0044c900
add esp, 0x14
cmp byte [ebp - 0xc2c], 0
jne 0x47373f
push edi
push esi
mov ecx, dword [ebx + 0xc]
push ecx
lea edx, [ebp - 0xb28]
push edx
push str.___Process___s:_u__ppid:_u___Registration_For_PFACC_Failed__4___Error_Returned:_0x_x
lea eax, [ebp - 0x1244]
push eax
jmp 0x47375e
lea ecx, [ebp - 0xc2c]
push ecx
push esi
mov edx, dword [ebx + 0xc]
push edx
lea eax, [ebp - 0xb28]
push eax
push str.___Process___s:_u__ppid:_u___Registration_For_PFACC_Failed__4___Error_Returned:__s
lea ecx, [ebp - 0x1244]
push ecx
call fcn.005dfb23
add esp, 0x18
push 0
push 1
lea edx, [ebp - 0x1244]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp edi, 0xc0000001
jne 0x4737da
push str.___Removing_Self_Protection_of_process_as_count_exceeded__4_.
lea eax, [ebp - 0x1244]
push eax
call fcn.005dfb23
xor edi, edi
push edi
push 1
lea ecx, [ebp - 0x1244]
push ecx
push 0x6aec98
call fcn.004311c0
push edi
push 2
push edi
push 0x2000501
call dword [0x6e9118]
push edi
push 2
push edi
push 0x2000601
call dword [0x6e9118]
add esp, 0x38
mov dword [0x6e9174], edi
mov dword [0x6e916c], edi
mov edx, dword [ebx + 0xc]
push 0
push edx
push 0
push 0x2000702
call dword [0x6e9118]
add esp, 0x10
mov edi, eax
test edi, edi
jl 0x473830
push esi
mov eax, dword [ebx + 0xc]
push eax
lea ecx, [ebp - 0xb28]
push ecx
push str.___Process___s:_d__ppid:_d___Registered_For_PRACC__4_
lea edx, [ebp - 0x1244]
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0x1244]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x24
jmp 0x4738bd
mov byte [ebp - 0xe34], 0
push 0x103
push 0
lea ecx, [ebp - 0xe33]
push ecx
call fcn.005dfd60
lea edx, [ebp - 0xe34]
push edx
push edi
call fcn.0044c900
add esp, 0x14
cmp byte [ebp - 0xe34], 0
jne 0x47387e
push edi
push esi
mov eax, dword [ebx + 0xc]
push eax
lea ecx, [ebp - 0xb28]
push ecx
push str.___Process___s:_d__ppid:_d___Registration_For_PRACC_Failed__4___Error_Returned:_0x_x
lea edx, [ebp - 0x1244]
push edx
jmp 0x47389d
lea eax, [ebp - 0xe34]
push eax
push esi
mov ecx, dword [ebx + 0xc]
push ecx
lea edx, [ebp - 0xb28]
push edx
push str.___Process___s:_d__ppid:_d___Registration_For_PRACC_Failed__4___Error_Returned:__s
lea eax, [ebp - 0x1244]
push eax
call fcn.005dfb23
add esp, 0x18
push 0
push 1
lea ecx, [ebp - 0x1244]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [ebx + 0xc], 0
jbe 0x4738f9
cmp dword [ebp - 0x447c], 0
jne 0x4738f9
mov byte [ebp - 0x224], 0
push 0x103
push 0
lea edx, [ebp - 0x223]
push edx
call fcn.005dfd60
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebx + 0xc]
push ecx
call fcn.00543930
add esp, 0x14
mov ebx, dword [ebx + 0x18]
xor esi, esi
jmp 0x472253
cmp dword [0x72bb88], esi
je 0x473926
push esi
push esi
push 0x72bb88
call fcn.004f7600
add esp, 0xc
mov dword [0x72bb88], esi
mov dword [0x72c268], esi
cmp dword [ebp - 0x4478], esi
je 0x473968
push str.RunMSA1
push 0x6111b8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e9430
call fcn.00418f40
jmp 0x473968
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret