Function at 0x451180
Capabilities:
Encode data using xor
Enumerate processes
Execute command
Set console window title

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b52d2
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x638bb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x68], 0x716949
xor ecx, ecx
mov byte [ebp - 0x64], 1
nop word [eax + eax]
mov al, cl
add al, 0x1f
xor byte [ebp + ecx - 0x68], al
inc ecx
cmp ecx, 3
jb 0x4511c0
lea eax, [ebp - 0x68]
mov byte [ebp - 0x64], 0
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
movaps xmm0, xmmword [0x62ae80]
xor ecx, ecx
movups xmmword [ebp - 0x23c], xmm0
mov byte [ebp - 0x22c], 1
nop
mov al, cl
add al, 0x1f
xor byte [ebp + ecx - 0x23c], al
inc ecx
cmp ecx, 0xf
jb 0x451200
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea edx, [ebp - 0x23c]
mov byte [ebp - 0x22c], 0
call fcn.00455a70
mov ecx, 0x63f1a8
call fcn.0044d990
mov dword [ebp - 0x68], 0x524c7c
xor ecx, ecx
mov byte [ebp - 0x64], 1
mov al, cl
add al, 0x1f
xor byte [ebp + ecx - 0x68], al
inc ecx
cmp ecx, 3
jb 0x451240
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea eax, [ebp - 0x68]
push eax
mov byte [ebp - 0x64], 0
call esi
add esp, 4
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 0xf
mov byte [ebp - 0xa8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 0xf
mov byte [ebp - 0x90], 0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 0xf
mov byte [ebp - 0xc0], 0
push 0xfffffffffffffff5
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, eax
mov dword [ebp - 0x68], 0x524c7c
mov byte [ebp - 0x64], 1
xor ecx, ecx
nop
mov al, cl
add al, 0x1f
xor byte [ebp + ecx - 0x68], al
inc ecx
cmp ecx, 3
jb 0x4512d0
lea eax, [ebp - 0x68]
mov byte [ebp - 0x64], 0
push eax
call esi
add esp, 4
mov dword [ebp - 0x68], 0x716949
mov byte [ebp - 0x64], 1
xor ecx, ecx
mov al, cl
add al, 0x1f
xor byte [ebp + ecx - 0x68], al
inc ecx
cmp ecx, 3
jb 0x4512f8
lea eax, [ebp - 0x68]
mov byte [ebp - 0x64], 0
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov esi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push 4
push edi
call esi
movaps xmm0, xmmword [0x62aed0]
xor ecx, ecx
movups xmmword [ebp - 0x224], xmm0
mov dword [ebp - 0x214], 0x110a4a
mov byte [ebp - 0x210], 1
mov al, cl
add al, 0x1f
xor byte [ebp + ecx - 0x224], al
inc ecx
cmp ecx, 0x13
jb 0x451340
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea edx, [ebp - 0x224]
mov byte [ebp - 0x210], 0
call fcn.00455a70
push 0xb
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea edx, [ebp - 0xa8]
call fcn.0045a040
push 4
push edi
call esi
movaps xmm0, xmmword [0x62aee0]
xor ecx, ecx
movups xmmword [ebp - 0x224], xmm0
mov dword [ebp - 0x214], 0x1001015
nop
mov al, cl
add al, 0x1f
xor byte [ebp + ecx - 0x224], al
inc ecx
cmp ecx, 0x12
jb 0x4513a0
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea edx, [ebp - 0x224]
mov byte [ebp - 0x211], 0
call fcn.00455a70
push 0xb
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea edx, [ebp - 0x90]
call fcn.0045a040
push 4
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n____________________________________________________________________________________________________
call fcn.00455a70
push 4
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n_____________________________________________dMMMb.____________.adOOOOOOOOOOOOba.________________dMMMb_
call fcn.00455a70
push 4
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n___________________________________________dP__YMMb_________dOOOOOOOOOOOOOOOOOOb____________aMMP___Yb
call fcn.00455a70
push 4
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n__________________________________________V______Mb________dOOOOOOOOOOOOOOOOOOOOOb__________dM______V
call fcn.00455a70
push 4
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n___________________________________________________Mb.______dOOOOOOOOOOOOOOOOOOOOOOOb________dM
call fcn.00455a70
push 4
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n___________________________________________________YMb.____OOOOOOOOOOOOOOOOOOOOOOOOO_____dMP
call fcn.00455a70
push 4
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n_______________________________________________________YMMM_OPYOOOOOOOOOOOP_YO_MMMP_____
call fcn.00455a70
push 4
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n______________________________________________dMMMb.______OO______YOOOOOP_____OO________dMMMb.
call fcn.00455a70
push 4
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n____________________________________________dP___YMba_______OOb_______OOO______dOO_______aMMP__Yb._
call fcn.00455a70
push 4
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n_______________________________________________________YMMMM__OOOo_____OOO_____oOOO_MMMMP
call fcn.00455a70
push 4
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n_______________________________________________aa.______YMMb__OOOb.__dOOOb.__dOOOdMMP________aa.
call fcn.00455a70
push 4
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n_____________________________________________dMYYMba.___________OOOOOOOOOOOOOOOOO____________adMYYMb.
call fcn.00455a70
push 4
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n____________________________________________MP____YMMba._______OOOOOOOOOOOOOOOOO_________adMMP____YM.
call fcn.00455a70
push 4
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n___________________________________________MP________YMMMba.__YOOOOPVVVVVYOOOOP____adMMMMP_________YM
call fcn.00455a70
push 4
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n___________________________________________YMb___________YMMMM__OOOOI_____IOOOOO_MMMMP_____________dMP
call fcn.00455a70
push 4
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n_____________________________________________Mb.____________YMMMb_OOOI_____IOOOOdMMMP_______________dM
call fcn.00455a70
push 4
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n___________________________________________________________________OObNNNNNdOO______________________
call fcn.00455a70
push 4
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n______________________________________________________________________OOOOO
call fcn.00455a70
sub esp, 0x18
lea eax, [ebp - 0x90]
mov ecx, esp
mov dword [ebp - 0x64], esp
push eax
call fcn.004536a0
sub esp, 0x18
mov byte [ebp - 4], 3
lea eax, [ebp - 0xa8]
mov ecx, esp
push eax
call fcn.004536a0
mov ecx, 0x63f1a8
mov byte [ebp - 4], 2
call fcn.0044e7a0
push 0xa
push edi
call esi
movaps xmm0, xmmword [0x62ae50]
xor ecx, ecx
movups xmmword [ebp - 0x23c], xmm0
mov byte [ebp - 0x22c], 1
nop dword [eax]
mov al, cl
add al, 0x1f
xor byte [ebp + ecx - 0x23c], al
inc ecx
cmp ecx, 0xf
jb 0x4515b0
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea edx, [ebp - 0x23c]
mov byte [ebp - 0x22c], 0
call fcn.00455a70
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x68], 0x524c7c
xor ecx, ecx
mov byte [ebp - 0x64], 1
mov al, cl
add al, 0x1f
xor byte [ebp + ecx - 0x68], al
inc ecx
cmp ecx, 3
jb 0x4515f1
lea eax, [ebp - 0x68]
mov byte [ebp - 0x64], 0
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
mov dword [ebp - 0x68], 0x716949
mov byte [ebp - 0x64], 1
xor ecx, ecx
nop dword [eax]
mov al, cl
add al, 0x1f
xor byte [ebp + ecx - 0x68], al
inc ecx
cmp ecx, 3
jb 0x451620
lea eax, [ebp - 0x68]
mov byte [ebp - 0x64], 0
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push 0xa
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n_________________________________________
call fcn.00455a70
push 0xa
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n_____________________________________________VIP.2____________________
call fcn.00455a70
push 0xa
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n______________________________________________Username:
call fcn.00455a70
cmp dword [0x63f21c], 0x10
mov edx, 0x63f208
push dword [0x63f218]
cmovae edx, dword [0x63f208]
mov ecx, eax
call fcn.0045a710
add esp, 4
push 0xa
push edi
call esi
push 0x63f28c
lea ecx, [ebp - 0x240]
call fcn.004536a0
mov byte [ebp - 4], 4
lea eax, [ebp - 0x240]
cmp dword [ebp - 0x22c], 0x10
push 0xa
cmovae eax, dword [ebp - 0x240]
push 0
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
cdq
add esp, 0xc
mov ecx, edx
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x6c], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x22c]
cmp edx, 0x10
jb 0x451728
mov ecx, dword [ebp - 0x240]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x451718
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x451718
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.005b0e2a
mov eax, dword [ebp - 0x64]
add esp, 8
mov ecx, dword [ebp - 0x6c]
mov byte [ebp - 4], 2
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x264]
mov dword [ebp - 0x230], 0
push eax
mov dword [ebp - 0x22c], 0xf
mov byte [ebp - 0x240], 0
mov dword [ebp - 0x64], ecx
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
mov eax, dword [ebp - 0x244]
movups xmm0, xmmword [ebp - 0x264]
mov dword [ebp - 0xc4], eax
lea eax, [ebp - 0xe4]
push eax
movups xmmword [ebp - 0xe4], xmm0
push str.__m__d__y
movups xmm0, xmmword [ebp - 0x254]
lea eax, [ebp - 0x60]
push 0x50
push eax
movups xmmword [ebp - 0xd4], xmm0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x218], 0
add esp, 0x18
mov dword [ebp - 0x214], 0xf
mov byte [ebp - 0x228], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4517c2
sub ecx, edx
lea eax, [ebp - 0x60]
push ecx
push eax
lea ecx, [ebp - 0x228]
call fcn.004546a0
mov byte [ebp - 4], 6
mov edx, str._n______________________________________________Expired_Date:
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00455a70
cmp dword [ebp - 0x214], 0x10
lea edx, [ebp - 0x228]
push dword [ebp - 0x218]
cmovae edx, dword [ebp - 0x228]
mov ecx, eax
call fcn.0045a710
add esp, 4
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x214]
cmp edx, 0x10
jb 0x451853
mov ecx, dword [ebp - 0x228]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x451849
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x451849
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.005b0e2a
add esp, 8
push 0xa
push edi
mov byte [ebp - 4], 2
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n_____________________________________________Thanks_You_For_Use_______
call fcn.00455a70
push 0xa
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n_________________________________________
call fcn.00455a70
push 0xa
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n____________________________________________d8888_888____d8P___.d8888b.
call fcn.00455a70
push 0xa
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n___________________________________________d88888_888___d8P___d88P__Y88b
call fcn.00455a70
push 0xa
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n__________________________________________d88P888_888__d8P___________888
call fcn.00455a70
push 0xa
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n_________________________________________d88P_888_888d88K__________.d88P
call fcn.00455a70
push 0xa
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n________________________________________d88P__888_8888888b_____.od888P
call fcn.00455a70
push 0xa
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n_______________________________________d88P___888_888__Y88b___d88P
call fcn.00455a70
push 0xa
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n______________________________________d8888888888_888___Y88b__888
call fcn.00455a70
push 0xa
push edi
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n_____________________________________d88P_____888_888____Y88b_888888888
call fcn.00455a70
push 0xc
push edi
call esi
movaps xmm0, xmmword [0x62ae60]
xor ecx, ecx
movups xmmword [ebp - 0x23c], xmm0
mov word [ebp - 0x22c], 0x100
nop word [eax + eax]
mov al, cl
add al, 0x1f
xor byte [ebp + ecx - 0x23c], al
inc ecx
cmp ecx, 0x10
jb 0x451950
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea edx, [ebp - 0x23c]
mov byte [ebp - 0x22b], 0
call fcn.00455a70
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 0x18
mov dword [ebp - 0x70], 0
mov ecx, esp
xorps xmm0, xmm0
movq qword [ebp - 0x78], xmm0
push 6
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.576686
mov byte [ecx], 0
call fcn.004546a0
lea eax, [ebp - 0x78]
mov ecx, 0x63f1a8
push eax
call fcn.0044f8c0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x228]
push 7
push str.MAT.exe
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 0xf
mov byte [ebp - 0x228], 0
call fcn.004546a0
push 0
mov byte [ebp - 4], 9
push 2
mov dword [ebp - 0x20c], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x6c], eax
cmp eax, 0xffffffff
jne 0x451a55
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x214]
cmp edx, 0x10
jb 0x451ba2
mov ecx, dword [ebp - 0x228]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x451a4e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x451a4e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
jmp 0x451b9a
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Process32First]
lea edx, [ebp - 0x1e8]
lea ecx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x451a70
mov edi, dword [ebp - 0x214]
lea eax, [ebp - 0x1e8]
mov esi, dword [ebp - 0x228]
sub edx, ecx
cmp edi, 0x10
lea ecx, [ebp - 0x228]
push edx
mov edx, dword [ebp - 0x218]
cmovae ecx, esi
push eax
call fcn.00456040
add esp, 8
test eax, eax
jne 0x451af3
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 4], 0xb
cmp edi, 0x10
jb 0x451ccc
inc edi
mov eax, esi
cmp edi, 0x1000
jb 0x451cc2
mov esi, dword [esi - 4]
add edi, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x451cc2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x451b67
nop word [eax + eax]
lea eax, [ebp - 0x1e8]
lea edx, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x451b20
sub eax, edx
lea ecx, [ebp - 0x228]
mov edx, dword [ebp - 0x218]
cmp edi, 0x10
push eax
lea eax, [ebp - 0x1e8]
cmovae ecx, esi
push eax
call fcn.00456040
add esp, 8
test eax, eax
je 0x451ca7
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x451b10
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0xd
cmp edi, 0x10
jb 0x451ba2
inc edi
mov eax, esi
cmp edi, 0x1000
jb 0x451b98
mov esi, dword [esi - 4]
add edi, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x451aed
push edi
push esi
call fcn.005b0e2a
add esp, 8
mov byte [ebp - 4], 8
push str.Process_not_found_n
call fcn.004475e0
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 8
or esi, 0xffffffff
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x451c0e
mov edx, dword [ebp - 0x70]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x451bef
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x451aed
push edx
push ecx
call fcn.005b0e2a
add esp, 8
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0
mov byte [ebp - 4], 0x20
mov edx, dword [ebp - 0x7c]
cmp edx, 0x10
jb 0x451c49
mov ecx, dword [ebp - 0x90]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x451c3f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x451aed
push edx
push ecx
call fcn.005b0e2a
add esp, 8
mov dword [ebp - 4], 0x21
mov edx, dword [ebp - 0x94]
cmp edx, 0x10
jb 0x451c8a
mov ecx, dword [ebp - 0xa8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x451c80
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x451aed
push edx
push ecx
call fcn.005b0e2a
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b0882
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 4], 0xc
jmp 0x451ac1
push edi
push esi
call fcn.005b0e2a
add esp, 8
mov byte [ebp - 4], 8
mov esi, dword [ebp - 0x6c]
test esi, esi
je 0x451ba6
movaps xmm0, xmmword [0x62aef0]
xor ecx, ecx
movups xmmword [ebp - 0x228], xmm0
mov dword [ebp - 0x218], 0x1c1f1e5c
mov dword [ebp - 0x214], 0x1b1a1d
mov byte [ebp - 0x210], 1
nop word [eax + eax]
mov al, cl
add al, 0x1f
xor byte [ebp + ecx - 0x228], al
inc ecx
cmp ecx, 0x17
jb 0x451d10
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea edx, [ebp - 0x228]
mov byte [ebp - 0x210], 0
call fcn.00455a70
push esi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x451d76
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenProcess_failed:_0x_X_n
call fcn.004475e0
push str.PAUSE
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 0xc
mov esi, 0xfffffffe
jmp 0x451bc1
mov edi, dword [sym.imp.KERNEL32.dll_IsWow64Process]
lea eax, [ebp - 0x6c]
push eax
push esi
mov dword [ebp - 0x6c], 0
call edi
test eax, eax
jne 0x451da4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cant_confirm_target_process_architecture:_0x_X_n
call fcn.004475e0
add esp, 8
jmp 0x451dc0
lea eax, [ebp - 0x64]
mov dword [ebp - 0x64], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x64]
je 0x451dec
push str.Invalid_Process_Architecture._n
call fcn.004475e0
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.PAUSE
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
mov esi, 0xfffffffd
jmp 0x451bc1
movaps xmm0, xmmword [0x62ae90]
xor ecx, ecx
movups xmmword [ebp - 0x228], xmm0
mov dword [ebp - 0x218], 0x1c1f1e01
mov word [ebp - 0x214], 0x100
nop
mov al, cl
add al, 0x1f
xor byte [ebp + ecx - 0x228], al
inc ecx
cmp ecx, 0x14
jb 0x451e10
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea edx, [ebp - 0x228]
mov byte [ebp - 0x213], 0
call fcn.00455a70
mov edx, dword [ebp - 0x78]
mov ecx, esi
call fcn.00447250
test al, al
jne 0x451e70
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Error_while_mapping._n
call fcn.004475e0
push str.PAUSE
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 8
mov esi, 0xfffffffc
jmp 0x451bc1
movaps xmm0, xmmword [0x62ae70]
xor ecx, ecx
movups xmmword [ebp - 0x224], xmm0
mov word [ebp - 0x214], 1
mov byte [ebp - 0x212], 1
mov al, cl
add al, 0x1f
xor byte [ebp + ecx - 0x224], al
inc ecx
cmp ecx, 0x11
jb 0x451e90
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea edx, [ebp - 0x224]
mov byte [ebp - 0x212], 0
call fcn.00455a70
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x6297a4
call fcn.004475e0
add esp, 4
xor esi, esi
jmp 0x451bc1