Function at 0x401530
Capabilities:
Execute command
Query environment variable

Disassembly:
push rbp
push rbx
sub rsp, 0x428
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x3c0], ecx
mov qword [rbp + 0x3c8], rdx
call fcn.0040f280
lea rcx, str.APPDATA
call sub.msvcrt.dll_getenv
mov qword [rbp + 0x398], rax
lea rax, [rbp + 0x393]
mov rcx, rax
call fcn.004469d0
lea rdx, [rbp + 0x393]
lea rax, [rbp + 0x380]
mov r8, rdx
lea rdx, str.MicrosoftProtect_nulFIX_Google_Earth_Remi_Reset_V5.dll
mov rcx, rax
call fcn.0044faf0
lea rax, [rbp + 0x393]
mov rcx, rax
call main
lea rax, [rbp + 0x394]
mov rcx, rax
call fcn.004469d0
lea rcx, [rbp + 0x394]
mov rdx, qword [rbp + 0x398]
lea rax, [rbp + 0x370]
mov r8, rcx
mov rcx, rax
call fcn.0044faf0
lea rax, [rbp + 0x394]
mov rcx, rax
call main
lea rax, [rbp + 0x395]
mov rcx, rax
call fcn.004469d0
lea rdx, [rbp + 0x395]
lea rax, [rbp + 0x360]
mov r8, rdx
lea rdx, [0x00489043]
mov rcx, rax
call fcn.0044faf0
lea rax, [rbp + 0x395]
mov rcx, rax
call main
lea rdx, [rbp + 0x380]
lea rax, [rbp + 0x370]
mov rcx, rax
call fcn.004501e0
lea rax, [rbp + 0x396]
mov rcx, rax
call fcn.004469d0
lea rcx, [rbp + 0x396]
mov rdx, qword [rbp + 0x398]
lea rax, [rbp + 0x350]
mov r8, rcx
mov rcx, rax
call fcn.0044faf0
lea rax, [rbp + 0x396]
mov rcx, rax
call main
lea rax, [rbp + 0x397]
mov rcx, rax
call fcn.004469d0
lea rdx, [rbp + 0x397]
lea rax, [rbp + 0x340]
mov r8, rdx
lea rdx, str.MicrosoftProtectKFICND.dll
mov rcx, rax
call fcn.0044faf0
lea rax, [rbp + 0x397]
mov rcx, rax
call main
lea rdx, [rbp + 0x340]
lea rax, [rbp + 0x350]
mov rcx, rax
call fcn.004501e0
lea rcx, str.if_exist___appdata_MicrosoftProtectKFICND.dll___DEL__F_Q___appdata_MicrosoftProtectKFICND.dll____nul
call sub.msvcrt.dll_system
lea rcx, str.if_exist___appdata_MicrosoftProtectKFICND.bat___DEL__F_Q___appdata_MicrosoftProtectKFICND.bat____nul
call sub.msvcrt.dll_system
mov edx, 0x20
mov ecx, 0x10
call fcn.0046fdc0
mov ebx, eax
lea rax, [rbp + 0x350]
mov rcx, rax
call fcn.00426920
mov rdx, rax
lea rax, [rbp - 0x60]
mov r8d, ebx
mov rcx, rax
call fcn.0045e1e0
lea rax, [rbp - 0x60]
lea rdx, str._____BEGIN_CERTIFICATE_____
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp - 0x60]
lea rdx, str.QGVjaG8gb2ZmDQppZiBleGlzdCAiJWFwcGRhdGElXE1pY3Jvc29mdFxQcm90ZWN0
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp - 0x60]
lea rdx, str.XG51bFxcIiAoZ290byBzaWtkZCkgZWxzZSAoZ290byBub2tkZCkNCg0KOnNpa2Rk
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp - 0x60]
lea rdx, str.DQoNCmdvdG8gOmVvZg0KDQo6bm9rZGQNCg0KbWQgIiVhcHBkYXRhJVxNaWNyb3Nv
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp - 0x60]
lea rdx, str.ZnRcUHJvdGVjdFxudWxcXCINCg0KZ290byA6ZW9m
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp - 0x60]
lea rdx, str._____END_CERTIFICATE_____
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.0045e190
lea rcx, str.certutil__decode___appdata_MicrosoftProtectKFICND.dll____appdata_MicrosoftProtectKFICND.bat___nul
call sub.msvcrt.dll_system
lea rcx, str.call___appdata_MicrosoftProtectKFICND.bat_
call sub.msvcrt.dll_system
lea rcx, str.if_exist___appdata_MicrosoftProtectKFICND.dll___DEL__F_Q___appdata_MicrosoftProtectKFICND.dll____nul
call sub.msvcrt.dll_system
lea rcx, str.if_exist___appdata_MicrosoftProtectKFICND.bat___DEL__F_Q___appdata_MicrosoftProtectKFICND.bat____nul
call sub.msvcrt.dll_system
lea rcx, str.Attrib__S__H____appdata_MicrosoftProtect_nulFIX_Google_Earth_Remi_Reset_V5.dll____nul
call sub.msvcrt.dll_system
lea rcx, str.Attrib__S__H____appdata_MicrosoftProtect_nulFIX_Google_Earth_Remi_Reset_V5.bat____nul
call sub.msvcrt.dll_system
lea rcx, str.if_exist___appdata_MicrosoftProtect_nulFIX_Google_Earth_Remi_Reset_V5.dll___DEL__F_Q___appdata_MicrosoftProtect_nulFIX_Google_Earth_Remi_Reset_V5.dll____nul
call sub.msvcrt.dll_system
lea rcx, str.if_exist___appdata_MicrosoftProtect_nulFIX_Google_Earth_Remi_Reset_V5.bat___DEL__F_Q___appdata_MicrosoftProtect_nulFIX_Google_Earth_Remi_Reset_V5.bat____nul
call sub.msvcrt.dll_system
mov edx, 0x20
mov ecx, 0x10
call fcn.0046fdc0
mov ebx, eax
lea rax, [rbp + 0x370]
mov rcx, rax
call fcn.00426920
mov rdx, rax
lea rax, [rbp + 0x170]
mov r8d, ebx
mov rcx, rax
call fcn.0045e1e0
lea rax, [rbp + 0x170]
lea rdx, str._____BEGIN_CERTIFICATE_____
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.QEVDSE8gT0ZGDQpjbHMNCmVjaG8uDQplY2hvIERlc2luc3RhbGFuZG8gdmVyc2lv
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.biBubyBjb3JyZXNwb25kaWVudGUgZGUgR29vZ2xlIEVhcnRoLi4uDQplY2hvLg0K
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.ZWNoby4NCmVjaG8uDQpAY2xzDQpDb2xvciAwOQ0KZWNoby4NCmVjaG8uDQplY2hv
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.Lg0KQGVjaG8gICAgICDDn8Ofw5_Dn8Ofw5_Dn8Ofw5_Dn8Ofw5_Dn8Ofw5_Dn8Of
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.w5_Dn8Ofw5_Dn8Ofw5_Dn8Ofw5_Dn8Ofw5_Dn8Ofw5_Dn8Ofw5_Dn8Ofw5_Dn8Of
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.w5_Dn8Ofw5_Dn8Ofw5_Dn8Ofw5_Dn8Ofw5_Dn8Ofw5_Dn8Ofw5_Dn8Ofw5_Dn8Of
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.w5_Dn8Ofw58NCmVjaG8uDQpAZWNobyAJCQk4ODg4ODg4Yi4gIDg4ODg4ODg4ODgg
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.ODg4YiAgICAgZDg4OCA4ODg4ODg4ICAgICANCkBlY2hvIAkJCTg4OCAgIFk4OGIg
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.ODg4ICAgICAgICA4ODg4YiAgIGQ4ODg4ICAgODg4ICAgICAgDQpAZWNobyAJCQk4
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.ODggICAgODg4IDg4OCAgICAgICAgODg4ODhiLmQ4ODg4OCAgIDg4OCAgICAgICAN
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.CkBlY2hvIAkJCTg4OCAgIGQ4OFAgODg4ODg4OCAgICA4ODhZODg4ODhQODg4ICAg
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.ODg4ICAgICAgIA0KQGVjaG8gCQkJODg4ODg4OFAiICA4ODggICAgICAgIDg4OCBZ
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.ODg4UCA4ODggICA4ODggICAgIA0KQGVjaG8gCQkJODg4IFQ4OGIgICA4ODggICAg
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.ICAgIDg4OCAgWThQICA4ODggICA4ODggICAgICANCkBlY2hvIAkJCTg4OCAgVDg4
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.YiAgODg4ICAgICAgICA4ODggICAiICAgODg4ICAgODg4ICAgICAgDQpAZWNobyAJ
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.CQk4ODggICBUODhiIDg4ODg4ODg4ODggODg4ICAgICAgIDg4OCA4ODg4ODg4DQpA
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.ZWNobyAgICAgIMOfw5_Dn8Ofw5_Dn8Ofw5_Dn8Ofw5_Dn8Ofw5_Dn8Ofw5_Dn8Of
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.w5_Dn8Ofw5_Dn8Ofw5_Dn8Ofw5_Dn8Ofw5_Dn8Ofw5_Dn8Ofw5_Dn8Ofw5_Dn8Of
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.w5_Dn8Ofw5_Dn8Ofw5_Dn8Ofw5_Dn8Ofw5_Dn8Ofw5_Dn8Ofw5_Dn8Ofw5_Dn8Of
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.w5_DnyAgIA0KQGVjaG8gICAgICAgICAgICAgICBHRVNUT1IgREUgU09GVFdBUkUg
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.REUgSU5HRU5JRVJJQSBESVNFTk8gWSBBUlFVSVRFQ1RVUkENCmVjaG8uDQplY2hv
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.Lg0KZWNoby4NCmVjaG8gRW4gbGEgc2lndWllbnRlIHZlbnRhbmEgcHJlc2lvbmEg
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.SU5TVEFMQVIgeSBsdWVnbyBBQ0VQVEFSLi4uDQplY2hvLg0KZWNoby4NClJFTSBD
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.b21hbmRvIHBhcmEgZGVzaW5zdGFsYXIgR29vZ2xlIEVhcnRoIGRlIGZvcm1hIHNp
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.bGVuY2lvc2ENCk1zaUV4ZWMuZXhlIC9YezM0NzBBRDA4LTg1RjItNEIxRC04NDg3
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.LUZDNDc1MDczMjA4N30gL3FuDQoNCmVjaG8gRGVzaW5zdGFsYWNpw7NuIGNvbXBs
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.ZXRhZGEgOikuDQoNCg0KDQoNCkBlY2hvIG9mZg0KY2xzDQoNCmVjaG8uDQplY2hv
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.IEluc3RhbGFuZG8gdmVyc2lvbiBjb3JyZXNwb25kaWVudGUgZGUgR29vZ2xlIEVh
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.cnRoLi4uDQplY2hvLg0KDQpSRU0gQ29tYW5kbyBwYXJhIGVqZWN1dGFyIEdvb2ds
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.ZUVhcnRoUHJvU2V0dXAuZXhlIGRlc2RlIEM6XFdpbmRvd3MvR29vZ2xlRWFydGhQ
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.cm9TZXR1cC5leGUgKGFjdHVhbGl6YSAiQzpcV2luZG93cy9Hb29nbGVFYXJ0aFBy
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.b1NldHVwLmV4ZSIgc2Vnw7puIGxhIHViaWNhY2nDs24gZGVsIGFyY2hpdm8pDQpz
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.dGFydCAvd2FpdCBDOlxXaW5kb3dzL0dvb2dsZUVhcnRoUHJvU2V0dXAuZXhlDQoN
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.CmVjaG8gSW5zdGFsYWNpw7NuIGNvbXBsZXRhZGEuDQoNCkBlY2hvIG9mZg0KY2xz
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.DQoNCmVjaG8uDQplY2hvIEVqZWN1dGFuZG8gZWwgYXJjaGl2byBXaW5kb3dzIFJl
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.Z2lzdHJ5IEVkaXRvciBWZXJzaW9uIDUuMDAuLi4NCmVjaG8uDQoNClJFTSBDb21h
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.bmRvIHBhcmEgZWplY3V0YXIgZWwgYXJjaGl2byBpbmRvd3MgUmVnaXN0cnkgRWRp
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.dG9yIFZlcnNpb24gNS4wMCBkZXNkZSBDOlxXaW5kb3dzLw0KcmVnZWRpdC5leGUg
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.L3MgIkM6XFdpbmRvd3MvV2luZG93cyBSZWdpc3RyeSBFZGl0b3IgVmVyc2lvbiA1
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.LjAwLnJlZyINCg0KZWNobyBFamVjdWNpw7NuIGRlbCBhcmNoaXZvIFdpbmRvd3Mg
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str.UmVnaXN0cnkgRWRpdG9yIFZlcnNpb24gNS4wMCBjb21wbGV0YWRhLg0K
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
lea rdx, str._____END_CERTIFICATE_____
mov rcx, rax
call fcn.0046f810
mov rdx, qword [0x0048e820]
mov rcx, rax
call fcn.0044df00
lea rax, [rbp + 0x170]
mov rcx, rax
call fcn.0045e190
lea rcx, str.certutil__decode___appdata_MicrosoftProtect_nulFIX_Google_Earth_Remi_Reset_V5.dll____appdata_MicrosoftProtect_nulFIX_Google_Earth_Remi_Reset_V5.bat___nul
call sub.msvcrt.dll_system
lea rcx, str.Attrib_S_H____appdata_MicrosoftProtect_nulFIX_Google_Earth_Remi_Reset_V5.bat____nul
call sub.msvcrt.dll_system
lea rcx, str.Attrib_S_H____appdata_MicrosoftProtect_nulFIX_Google_Earth_Remi_Reset_V5.dll____nul
call sub.msvcrt.dll_system
lea rcx, str.call___appdata_MicrosoftProtect_nulFIX_Google_Earth_Remi_Reset_V5.bat_
call sub.msvcrt.dll_system
lea rcx, str.Attrib__S__H____appdata_MicrosoftProtect_nulFIX_Google_Earth_Remi_Reset_V5.dll____nul
call sub.msvcrt.dll_system
lea rcx, str.Attrib__S__H____appdata_MicrosoftProtect_nulFIX_Google_Earth_Remi_Reset_V5.bat____nul
call sub.msvcrt.dll_system
lea rcx, str.if_exist___appdata_MicrosoftProtect_nulFIX_Google_Earth_Remi_Reset_V5.dll___DEL__F_Q___appdata_MicrosoftProtect_nulFIX_Google_Earth_Remi_Reset_V5.dll____nul
call sub.msvcrt.dll_system
lea rcx, str.if_exist___appdata_MicrosoftProtect_nulFIX_Google_Earth_Remi_Reset_V5.bat___DEL__F_Q___appdata_MicrosoftProtect_nulFIX_Google_Earth_Remi_Reset_V5.bat____nul
call sub.msvcrt.dll_system
lea rax, [rbp + 0x170]
mov rcx, rax
call fcn.0045e820
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.0045e820
lea rax, [rbp + 0x340]
mov rcx, rax
call fcn.00450060
lea rax, [rbp + 0x350]
mov rcx, rax
call fcn.00450060
lea rax, [rbp + 0x360]
mov rcx, rax
call fcn.00450060
lea rax, [rbp + 0x370]
mov rcx, rax
call fcn.00450060
lea rax, [rbp + 0x380]
mov rcx, rax
call fcn.00450060
mov eax, 0
jmp 0x40209a
add rsp, 0x428
pop rbx
pop rbp
ret