Function at 0x4466c0
Capabilities:
Create http request
Download url
Encode data using xor
Enumerate processes
Read data from internet
Receive data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44acf0
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x1470
call fcn.004495d0
mov eax, dword [0x46c040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x1028], xmm0
mov dword [ebp - method.ATL::CAccessToken.virtual_0], vtable.ATL::CAccessToken.0
mov dword [ebp - 0x1024], 0
mov dword [ebp - 0x1020], 0
mov dword [ebp - 0x101c], 0
push 0x60
lea eax, [ebp - 0x10f8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x10f8]
call fcn.00446290
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x132c]
push ecx
push 0x20008
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x44680b
mov eax, dword [ebp - 0x1028]
lea ecx, [ebp - 0x1028]
call dword [eax + 4]
mov eax, dword [ebp - 0x132c]
lea ecx, [ebp - 0x1028]
sub esp, 8
mov dword [ebp - 0x1024], eax
lea eax, [ebp - 0x10f8]
push eax
call fcn.00447fb0
test al, al
je 0x44680b
lea ecx, [ebp - 0x10f8]
call fcn.00446420
lea ecx, [ebp - 0x147c]
push 3
mov dword [ebp - 0x1480], ecx
lea ecx, [ebp - 0x1480]
push eax
call fcn.00447b50
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1094]
push dword [ebp - 0x1480]
call fcn.004054f0
mov eax, dword [ebp - 0x1480]
lea ecx, [ebp - 0x147c]
cmp eax, ecx
je 0x44681b
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x44681b
push str.none
lea ecx, [ebp - 0x1094]
call fcn.004054f0
lea ecx, [ebp - 0x10f8]
call fcn.004463a0
mov ecx, dword [ebp - 0x1020]
mov eax, dword [ebp - 0x1024]
mov dword [ebp - method.ATL::CAccessToken.virtual_0], vtable.ATL::CAccessToken.0
test ecx, ecx
je 0x44685c
test eax, eax
je 0x446852
push ecx
push eax
call dword [sym.imp.USERENV.dll_UnloadUserProfile]
mov eax, dword [ebp - 0x1024]
mov dword [ebp - 0x1020], 0
test eax, eax
je 0x446871
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1024], 0
push 4
push dword [ebp - 0x101c]
call fcn.00448802
mov dword [ebp - 0x101c], 0
add esp, 8
mov byte [ebp - 4], 5
mov eax, dword [0x467818]
mov edx, dword [ebx + 0x18]
movq xmm0, qword [str.__aCbb]
mov dword [ebp - 0x1054], eax
mov al, byte [0x46781c]
mov byte [ebp - 0x132d], al
mov byte [ebp - 0x1050], al
mov eax, 0x7fffffff
sub eax, edx
movq qword [ebp - 0x105c], xmm0
mov dword [ebp - 0x1334], edx
cmp eax, 0x30
jb 0x447a28
cmp dword [ebx + 0x1c], 0xf
lea eax, [ebx + 8]
lea ecx, [edx + 0x30]
mov dword [ebp - 0x1358], 0
cmova eax, dword [ebx + 8]
lea edi, [ebp - 0x1368]
mov esi, 0xf
mov dword [ebp - 0x1338], eax
mov dword [ebp - 0x1354], 0
xorps xmm0, xmm0
mov dword [ebp - 0x1034], ecx
movups xmmword [ebp - 0x1368], xmm0
cmp ecx, esi
jbe 0x4469a7
mov esi, ecx
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x446961
mov ecx, 0x80000000
mov esi, 0x7fffffff
add ecx, 0x23
push ecx
call fcn.00448581
add esp, 4
test eax, eax
je 0x4471c1
mov ecx, dword [ebp - 0x1034]
lea edi, [eax + 0x23]
mov edx, dword [ebp - 0x1334]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x4469a1
mov eax, 0x16
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
cmp eax, 0x1000
jb 0x446982
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x447a2d
jmp 0x446939
test eax, eax
je 0x44699f
push eax
call fcn.00448581
mov ecx, dword [ebp - 0x1034]
add esp, 4
mov edx, dword [ebp - 0x1334]
mov edi, eax
jmp 0x4469a1
xor edi, edi
mov dword [ebp - 0x1368], edi
movups xmm0, xmmword [str.https:__amphaise.technology_OnuljVVZEP.php_name]
mov dword [ebp - 0x1358], ecx
lea eax, [edi + 0x30]
mov dword [ebp - 0x1354], esi
movups xmmword [edi], xmm0
push edx
movups xmm0, xmmword [0x46769c]
push dword [ebp - 0x1338]
movups xmmword [edi + 0x10], xmm0
push eax
movups xmm0, xmmword [0x4676ac]
movups xmmword [edi + 0x20], xmm0
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x1334]
add esp, 0xc
mov byte [edi + eax + 0x30], 0
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x1354]
mov eax, edx
mov ecx, dword [ebp - 0x1358]
sub eax, ecx
cmp eax, 4
jb 0x446a37
lea eax, [ecx + 4]
cmp edx, 0xf
mov dword [ebp - 0x1358], eax
lea eax, [ebp - 0x1368]
cmova eax, dword [ebp - 0x1368]
mov dword [eax + ecx], 0x3d777026
mov byte [eax + ecx + 4], 0
lea eax, [ebp - 0x1368]
jmp 0x446a58
push 4
push str.pw
mov byte [ebp - 0x1338], 0
lea ecx, [ebp - 0x1368]
push dword [ebp - 0x1338]
push 4
call fcn.00408300
mov dword [ebp - 0x13b8], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x13c8], xmm0
mov dword [ebp - 0x13b4], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x13c8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x13b8], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebx + 0x20]
mov byte [ebp - 4], 7
push eax
lea edx, [ebp - 0x13c8]
lea ecx, [ebp - 0x13f8]
call fcn.00448280
add esp, 4
mov edi, eax
mov byte [ebp - 4], 8
mov edx, dword [edi + 0x14]
mov eax, edx
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp eax, 6
jb 0x446af7
lea eax, [ecx + 6]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0xf
jbe 0x446ade
mov eax, dword [edi]
push 6
lea esi, [eax + ecx]
push str.hwid
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 6], 0
jmp 0x446b16
push 6
push str.hwid
mov byte [ebp - 0x1338], 0
mov ecx, edi
push dword [ebp - 0x1338]
push 6
call fcn.00408300
mov edi, eax
mov dword [ebp - 0x13a0], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x13b0], xmm0
mov dword [ebp - 0x139c], 0
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x13b0], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x13a0], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
lea eax, [ebp - 0x1094]
mov byte [ebp - 4], 9
push eax
lea edx, [ebp - 0x13b0]
lea ecx, [ebp - 0x13e0]
call fcn.00448280
add esp, 4
mov edi, eax
mov byte [ebp - 4], 0xa
mov edx, dword [edi + 0x14]
mov eax, edx
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp eax, 5
jb 0x446bb8
lea eax, [ecx + 5]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0xf
jbe 0x446b9f
mov eax, dword [edi]
push 5
lea esi, [eax + ecx]
push str.key
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 5], 0
jmp 0x446bd7
push 5
push str.key
mov byte [ebp - 0x1338], 0
mov ecx, edi
push dword [ebp - 0x1338]
push 5
call fcn.00408300
mov edi, eax
mov dword [ebp - 0x1388], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x1398], xmm0
mov dword [ebp - 0x1384], 0
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x1398], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x1388], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov byte [ebp - 4], 0xb
cmp byte [ebp - 0x132d], 0
je 0x446d78
xor edx, edx
cmp dword [0x493b80], 2
mov dword [ebp - 0x1334], edx
jl 0x446d41
movaps xmm2, xmmword [0x4679e0]
mov edx, 8
movaps xmm3, xmmword [0x467ac0]
movaps xmm1, xmm2
punpckldq xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
mov dword [ebp - 0x1334], edx
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x467a10]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movaps xmm2, xmmword [0x4679f0]
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
andps xmm1, xmmword [0x467a70]
movd xmm0, dword [ebp - 0x105c]
packuswb xmm1, xmm1
paddb xmm1, xmmword [str.0000000000000000]
xorps xmm1, xmm0
movaps xmm0, xmm2
movd dword [ebp - 0x105c], xmm1
movaps xmm1, xmm2
punpckldq xmm1, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x467a10]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
andps xmm1, xmmword [0x467a70]
movd xmm0, dword [ebp - 0x1058]
packuswb xmm1, xmm1
paddb xmm1, xmmword [str.0000000000000000]
xorps xmm1, xmm0
movd dword [ebp - 0x1058], xmm1
mov eax, 0x4bda12f7
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0x1334]
movsx eax, al
mov cl, dl
imul eax, eax, 0x36
sub cl, al
add cl, 0x30
xor byte [ebp + edx - 0x105c], cl
inc edx
mov dword [ebp - 0x1334], edx
cmp edx, 0xd
jl 0x446d41
lea eax, [ebp - 0x105c]
push eax
lea ecx, [ebp - 0x1398]
call fcn.00405430
mov dword [ebp - 0x1340], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x1350], xmm0
mov dword [ebp - 0x133c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x1350], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1340], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
cmp dword [ebp - 0x133c], 0xf
lea ecx, [ebp - 0x1350]
mov eax, dword [ebp - 0x1340]
cmova ecx, dword [ebp - 0x1350]
mov byte [eax + ecx], 0
movups xmm1, xmmword [ebp - 0x1350]
mov byte [ebp - 0x1350], 0
movq xmm0, qword [ebp - 0x1340]
movups xmmword [ebp - 0x1380], xmm1
mov dword [ebp - 0x1340], 0
movq qword [ebp - 0x1370], xmm0
mov dword [ebp - 0x133c], 0xf
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1380]
cmp dword [ebp - 0x136c], 0xf
mov eax, dword [ebp - 0x1370]
movd edx, xmm1
cmova ecx, edx
add eax, ecx
cmp dword [ebp - 0x136c], 0xf
lea ecx, [ebp - 0x1380]
cmova ecx, edx
push ecx
push eax
push ecx
lea ecx, [ebp - 0x1068]
call fcn.00448160
push 0
push 0
push 0
push 0
push str.HTTPGET
mov byte [ebp - 4], 0xe
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
mov dword [ebp - 0x1334], edi
test edi, edi
je 0x446ec6
cmp dword [ebp - 0x1054], 7
lea eax, [ebp - 0x1068]
push 0
cmova eax, dword [ebp - 0x1068]
push 0x4000100
push 0
push 0
push eax
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov esi, eax
mov dword [ebp - 0x1338], esi
test esi, esi
jne 0x4471c7
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.Error
lea ecx, [ebp - 0x104c]
call fcn.004054f0
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x1054]
cmp ecx, 7
jbe 0x446f1a
mov edx, dword [ebp - 0x1068]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x446f10
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x447364
push ecx
push edx
call fcn.00448802
add esp, 8
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x136c]
cmp ecx, 0xf
jbe 0x446f58
mov edx, dword [ebp - 0x1380]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x446f4e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4471c1
push ecx
push edx
call fcn.00448802
add esp, 8
mov dword [ebp - 0x1370], 0
mov dword [ebp - 0x136c], 0xf
mov byte [ebp - 0x1380], 0
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x133c]
cmp ecx, 0xf
jbe 0x446fb1
mov edx, dword [ebp - 0x1350]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x446fa7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4471c1
push ecx
push edx
call fcn.00448802
add esp, 8
mov dword [ebp - 0x1340], 0
mov dword [ebp - 0x133c], 0xf
mov byte [ebp - 0x1350], 0
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x1384]
cmp ecx, 0xf
jbe 0x44700a
mov edx, dword [ebp - 0x1398]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x447000
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4471c1
push ecx
push edx
call fcn.00448802
add esp, 8
mov dword [ebp - 0x1388], 0
mov dword [ebp - 0x1384], 0xf
mov byte [ebp - 0x1398], 0
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x13cc]
cmp ecx, 0xf
jbe 0x447063
mov edx, dword [ebp - 0x13e0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x447059
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4471c1
push ecx
push edx
call fcn.00448802
add esp, 8
mov dword [ebp - 0x13d0], 0
mov dword [ebp - 0x13cc], 0xf
mov byte [ebp - 0x13e0], 0
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x139c]
cmp ecx, 0xf
jbe 0x4470bc
mov edx, dword [ebp - 0x13b0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4470b2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4471c1
push ecx
push edx
call fcn.00448802
add esp, 8
mov dword [ebp - 0x13a0], 0
mov dword [ebp - 0x139c], 0xf
mov byte [ebp - 0x13b0], 0
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x13e4]
cmp ecx, 0xf
jbe 0x447115
mov edx, dword [ebp - 0x13f8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x44710b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4471c1
push ecx
push edx
call fcn.00448802
add esp, 8
mov dword [ebp - 0x13e8], 0
mov dword [ebp - 0x13e4], 0xf
mov byte [ebp - 0x13f8], 0
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x13b4]
cmp ecx, 0xf
jbe 0x44716a
mov edx, dword [ebp - 0x13c8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x447160
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4471c1
push ecx
push edx
call fcn.00448802
add esp, 8
mov dword [ebp - 0x13b8], 0
mov dword [ebp - 0x13b4], 0xf
mov byte [ebp - 0x13c8], 0
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x1354]
cmp ecx, 0xf
jbe 0x447374
mov edx, dword [ebp - 0x1368]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x44736a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x44736a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
xorps xmm0, xmm0
mov dword [ebp - 0x1020], 0
movups xmmword [ebp - 0x1030], xmm0
mov dword [ebp - 0x101c], 0xf
mov byte [ebp - 0x1030], 0
lea eax, [ebp - 0x1034]
mov byte [ebp - 4], 0xf
push eax
push 0xfff
lea eax, [ebp - 0x1018]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4472dd
mov eax, dword [ebp - 0x1034]
test eax, eax
je 0x4472d7
cmp eax, 0x1000
jae 0x447a32
lea edi, [ebp - 0x1018]
mov byte [ebp + eax - 0x1018], 0
lea ecx, [edi + 1]
nop dword [eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x447240
mov edx, dword [ebp - 0x101c]
sub edi, ecx
mov ecx, dword [ebp - 0x1020]
mov eax, edx
sub eax, ecx
push edi
cmp edi, eax
ja 0x447295
lea eax, [ecx + edi]
cmp edx, 0xf
mov dword [ebp - 0x1020], eax
lea esi, [ebp - 0x1030]
cmova esi, dword [ebp - 0x1030]
lea eax, [ebp - 0x1018]
add esi, ecx
push eax
push esi
call sub.VCRUNTIME140.dll_memmove
mov byte [edi + esi], 0
add esp, 0xc
mov esi, dword [ebp - 0x1338]
jmp 0x4472b5
lea eax, [ebp - 0x1018]
mov byte [ebp - 0x132c], 0
push eax
push dword [ebp - 0x132c]
lea ecx, [ebp - 0x1030]
push edi
call fcn.00408300
lea eax, [ebp - 0x1034]
push eax
push 0xfff
lea eax, [ebp - 0x1018]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x447212
mov edi, dword [ebp - 0x1334]
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push edi
call esi
movups xmm0, xmmword [ebp - 0x1030]
mov byte [ebp - 0x1030], 0
movups xmmword [ebp - 0x104c], xmm0
movq xmm0, qword [ebp - 0x1020]
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x1054]
movq qword [ebp - 0x103c], xmm0
mov dword [ebp - 0x1020], 0
mov dword [ebp - 0x101c], 0xf
cmp ecx, 7
jbe 0x446f1a
mov edx, dword [ebp - 0x1068]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x446f10
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x446f10
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00448802
add esp, 8
mov eax, dword [ebp - 0x1038]
lea edx, [ebp - 0x104c]
mov edi, dword [ebp - 0x104c]
cmp eax, 0xf
mov ecx, dword [ebp - 0x103c]
cmova edx, edi
mov dword [ebp - 0x1358], 0
mov dword [ebp - 0x1354], 0xf
mov byte [ebp - 0x1368], 0
cmp ecx, 1
jne 0x447443
mov edi, ecx
mov esi, str.1234
sub edi, 4
jb 0x4473d3
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x4473d8
add edx, 4
add esi, 4
sub edi, 4
jae 0x4473c2
cmp edi, 0xfffffffc
je 0x44740c
mov al, byte [edx]
cmp al, byte [esi]
jne 0x447405
cmp edi, 0xfffffffd
je 0x44740c
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x447405
cmp edi, 0xfffffffe
je 0x44740c
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x447405
cmp edi, 0xffffffff
je 0x44740c
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x44740c
sbb eax, eax
or eax, 1
jmp 0x44740e
xor eax, eax
test eax, eax
jne 0x447437
push 0x10
push str.Failed
push str.Authentication_error.
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, dword [ebp - 0x104c]
mov byte [ebp - 0x132d], 0
jmp 0x44780b
mov edi, dword [ebp - 0x104c]
mov eax, dword [ebp - 0x1038]
cmp eax, 0xf
lea edx, [ebp - 0x104c]
cmova edx, edi
cmp ecx, 1
jne 0x4474e5
mov edi, ecx
mov esi, 0x4671fc
sub edi, 4
jb 0x447475
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x44747a
add edx, 4
add esi, 4
sub edi, 4
jae 0x447464
cmp edi, 0xfffffffc
je 0x4474ae
mov al, byte [edx]
cmp al, byte [esi]
jne 0x4474a7
cmp edi, 0xfffffffd
je 0x4474ae
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x4474a7
cmp edi, 0xfffffffe
je 0x4474ae
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x4474a7
cmp edi, 0xffffffff
je 0x4474ae
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x4474ae
sbb eax, eax
or eax, 1
jmp 0x4474b0
xor eax, eax
test eax, eax
jne 0x4474d9
push 0x10
push str.Failed
push str.This_user_is_banned.
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, dword [ebp - 0x104c]
mov byte [ebp - 0x132d], 0
jmp 0x44780b
mov edi, dword [ebp - 0x104c]
mov eax, dword [ebp - 0x1038]
cmp eax, 0xf
lea edx, [ebp - 0x104c]
cmova edx, edi
cmp ecx, 1
jne 0x447587
mov edi, ecx
mov esi, 0x467200
sub edi, 4
jb 0x447517
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x44751c
add edx, 4
add esi, 4
sub edi, 4
jae 0x447506
cmp edi, 0xfffffffc
je 0x447550
mov al, byte [edx]
cmp al, byte [esi]
jne 0x447549
cmp edi, 0xfffffffd
je 0x447550
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x447549
cmp edi, 0xfffffffe
je 0x447550
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x447549
cmp edi, 0xffffffff
je 0x447550
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x447550
sbb eax, eax
or eax, 1
jmp 0x447552
xor eax, eax
test eax, eax
jne 0x44757b
push 0x10
push str.Failed
push str.HWID_mismatch.
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, dword [ebp - 0x104c]
mov byte [ebp - 0x132d], 0
jmp 0x44780b
mov edi, dword [ebp - 0x104c]
mov eax, dword [ebp - 0x1038]
cmp eax, 0xf
lea edx, [ebp - 0x104c]
cmova edx, edi
cmp ecx, 1
jne 0x447629
mov edi, ecx
mov esi, 0x467204
sub edi, 4
jb 0x4475b9
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x4475be
add edx, 4
add esi, 4
sub edi, 4
jae 0x4475a8
cmp edi, 0xfffffffc
je 0x4475f2
mov al, byte [edx]
cmp al, byte [esi]
jne 0x4475eb
cmp edi, 0xfffffffd
je 0x4475f2
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x4475eb
cmp edi, 0xfffffffe
je 0x4475f2
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x4475eb
cmp edi, 0xffffffff
je 0x4475f2
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x4475f2
sbb eax, eax
or eax, 1
jmp 0x4475f4
xor eax, eax
test eax, eax
jne 0x44761d
push 0x10
push str.Failed
push str.Contact_an_admin__API_.
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, dword [ebp - 0x104c]
mov byte [ebp - 0x132d], 0
jmp 0x44780b
mov edi, dword [ebp - 0x104c]
mov eax, dword [ebp - 0x1038]
cmp eax, 0xf
lea edx, [ebp - 0x104c]
cmova edx, edi
cmp ecx, 4
jne 0x44792c
mov esi, str.true
sub ecx, ecx
jb 0x447658
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x44765d
add edx, 4
add esi, 4
sub ecx, 4
jae 0x447647
cmp ecx, 0xfffffffc
je 0x447691
mov al, byte [edx]
cmp al, byte [esi]
jne 0x44768a
cmp ecx, 0xfffffffd
je 0x447691
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x44768a
cmp ecx, 0xfffffffe
je 0x447691
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x44768a
cmp ecx, 0xffffffff
je 0x447691
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x447691
sbb eax, eax
or eax, 1
jmp 0x447693
xor eax, eax
test eax, eax
jne 0x447926
movaps xmm0, xmmword [0x467b20]
xor ecx, ecx
movups xmmword [ebp - 0x107c], xmm0
mov dword [ebp - 0x105c], 0x91b4adad
movaps xmm0, xmmword [0x467b00]
movups xmmword [ebp - 0x106c], xmm0
mov dword [ebp - 0x1058], 0xfaf4998c
mov dword [ebp - 0x1054], 0xa0a7aee7
mov word [ebp - 0x1050], 0x100
mov al, cl
sub al, 0x5f
xor byte [ebp + ecx - 0x107c], al
inc ecx
cmp ecx, 0x2c
jb 0x4476e0
push ecx
lea eax, [ebp - 0x1050]
mov byte [ebp - 0x104f], 0
push eax
lea eax, [ebp - 0x107c]
push eax
lea ecx, [ebp - 0x1030]
call fcn.0040c7f0
push 0
push 0
push str.C:WindowsShellComponentsTaskFlowUI_32.dll
push str.https:__amphaise.technology_HGJsjghGHJghsGH.dll
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
push 0
push 2
mov dword [ebp - 0x1328], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x1328]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x447794
lea eax, [ebp - 0x1328]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x447794
lea eax, [ebp - 0x1304]
push str.csgo.exe
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x4478e5
lea eax, [ebp - 0x1328]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x447764
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push str.Failed
push str.csgo.exe_not_found.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x101c]
mov byte [ebp - 0x132d], 1
cmp ecx, 0xf
jbe 0x4477f0
mov edx, dword [ebp - 0x1030]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4477e6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4478df
push ecx
push edx
call fcn.00448802
add esp, 8
mov dword [ebp - 0x1020], 0
mov dword [ebp - 0x101c], 0xf
mov byte [ebp - 0x1030], 0
mov eax, dword [ebp - 0x1038]
cmp eax, 0xf
jbe 0x447841
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x447837
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4478df
push ecx
push edi
call fcn.00448802
add esp, 8
mov ecx, dword [ebp - 0x1080]
cmp ecx, 0xf
jbe 0x447877
mov edx, dword [ebp - 0x1094]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x44786d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4478df
push ecx
push edx
call fcn.00448802
add esp, 8
mov ecx, dword [ebx + 0x1c]
cmp ecx, 0xf
jbe 0x4478a7
mov edx, dword [ebx + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x44789d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4478df
push ecx
push edx
call fcn.00448802
add esp, 8
mov ecx, dword [ebx + 0x34]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0xf
mov byte [ebx + 8], 0
cmp ecx, 0xf
jbe 0x44791b
mov edx, dword [ebx + 0x20]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x447911
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x447911
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov ecx, dword [ebp - 0x1320]
test ecx, ecx
je 0x44779b
cmp dword [ebp - 0x101c], 0xf
lea edx, [ebp - 0x1030]
cmova edx, dword [ebp - 0x1030]
call fcn.004465e0
jmp 0x4477af
push ecx
push edx
call fcn.00448802
add esp, 8
mov al, byte [ebp - 0x132d]
jmp 0x447a0a
mov eax, dword [ebp - 0x1038]
cmp eax, 0xf
jbe 0x44795c
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x447952
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4479fa
push ecx
push edi
call fcn.00448802
add esp, 8
mov ecx, dword [ebp - 0x1080]
cmp ecx, 0xf
jbe 0x447992
mov edx, dword [ebp - 0x1094]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x447988
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4479fa
push ecx
push edx
call fcn.00448802
add esp, 8
mov ecx, dword [ebx + 0x1c]
cmp ecx, 0xf
jbe 0x4479c2
mov edx, dword [ebx + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4479b8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4479fa
push ecx
push edx
call fcn.00448802
add esp, 8
mov ecx, dword [ebx + 0x34]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0xf
mov byte [ebx + 8], 0
cmp ecx, 0xf
jbe 0x447a0a
mov edx, dword [ebx + 0x20]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x447a00
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x447a00
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00448802
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00448493
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00401200
call fcn.00401160
call fcn.00448aec
int3