Function at 0x445070
Capabilities:
Check for time delay via gettickcount
Check os version
Contain obfuscated stackstrings
Enumerate processes
Get disk size
Get process image filename
Resolve function by parsing pe exports
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d636b
mov eax, dword fs:[0]
push eax
sub esp, 0x5c0
mov eax, dword [0x52cc80]
xor eax, esp
mov dword [esp + 0x5b8], eax
push ebx
push esi
push edi
mov eax, dword [0x52cc80]
xor eax, esp
push eax
lea eax, [esp + 0x5d0]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x14], ebx
xor eax, eax
push 0x206
push eax
mov word [esp + 0x3c4], ax
lea eax, [esp + 0x3c6]
push eax
call fcn.004aee10
add esp, 0xc
mov dword [ebx + 0xec], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x48], eax
mov dword [esp + 0x3c], 0
cmp byte [ebx + 0x8d], 0
je 0x445117
mov esi, dword [ebx + 0xf8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x48]
cmp eax, esi
jb 0x445117
test esi, esi
jne 0x445edf
mov ecx, dword [0x531d90]
lea eax, [ecx + 1]
imul eax, ecx
cdq
mov ecx, 0xf
idiv ecx
cmp edx, 0xa
jne 0x445147
push 0x8d
push 0x8c
push str._d__d_n
call fcn.004aa9bb
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [esp + 0x20], esi
cmp esi, 0xffffffff
je 0x44649b
push 0x22c
lea eax, [esp + 0x58]
push 0
push eax
call fcn.004aee10
add esp, 0xc
lea eax, [esp + 0x54]
push eax
push esi
mov dword [esp + 0x5c], 0x22c
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x44645d
jmp 0x4451a0
mov eax, 0x63
mov word [esp + 0x3a4], ax
mov eax, 0x6d
mov word [esp + 0x3ac], ax
mov eax, 0x2e
mov word [esp + 0x3b0], ax
xor eax, eax
mov dword [esp + 0x294], eax
mov dword [esp + 0x298], eax
mov dword [esp + 0x3a8], 0x6f0072
mov word [esp + 0x3b8], ax
mov dword [esp + 0x298], 7
mov dword [esp + 0x294], eax
mov word [esp + 0x284], ax
cmp word [esp + 0x78], ax
je 0x445221
lea eax, [esp + 0x78]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x445212
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x28c]
call fcn.00449640
mov dword [esp + 0x5d8], 2
mov eax, 0x65
mov word [esp + 0x3b2], ax
mov word [esp + 0x3ae], ax
lea ecx, [esp + 0x3a4]
mov eax, 0x68
mov dword [esp + 0x3b4], 0x650078
mov word [esp + 0x3a6], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x445275
mov ebx, dword [esp + 0x294]
sub ecx, edx
sar ecx, 1
cmp dword [esp + 0x298], 8
lea edx, [esp + 0x284]
cmovae edx, dword [esp + 0x284]
cmp ebx, ecx
mov edi, ecx
cmovb edi, ebx
test edi, edi
je 0x4452cd
lea esi, [esp + 0x3a4]
mov ax, word [edx]
cmp ax, word [esi]
jne 0x4454ef
add edx, 2
add esi, 2
dec edi
jne 0x4452b4
mov esi, dword [esp + 0x20]
xor eax, eax
test eax, eax
jne 0x4452e4
cmp ebx, ecx
jb 0x4452e4
cmp ebx, ecx
setne al
test eax, eax
je 0x445504
mov dword [esp + 0x5d8], 0xffffffff
cmp dword [esp + 0x298], 8
jb 0x445308
push dword [esp + 0x284]
call fcn.004a9925
add esp, 4
xor eax, eax
mov word [esp + 0x284], ax
lea eax, [esp + 0x54]
push eax
push esi
mov dword [esp + 0x2a0], 7
mov dword [esp + 0x29c], 0
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4451a0
mov ebx, dword [esp + 0x14]
mov eax, dword [ebx + 0xec]
cmp eax, 0xffffffff
je 0x44534f
test eax, eax
jne 0x44535b
push dword [ebx + 0xf4]
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx + 0xec]
test eax, eax
je 0x4450f2
cmp eax, 0xffffffff
je 0x4450f2
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [esp + 0x20]
mov ecx, eax
call fcn.0043ec40
test eax, eax
je 0x4453ae
cmp dword [esp + 0x20], 0
je 0x4453ae
mov ecx, dword [esp + 0x28]
call fcn.0043ecc0
test al, al
jne 0x446040
mov eax, dword [0x52c6d8]
mov ecx, 0x52c6d8
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x24], esi
mov dword [esp + 0x5d8], 0x1d
mov eax, dword [0x52c6d8]
mov ecx, 0x52c6d8
mov dword [esp + 0x20], 0
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
mov byte [esp + 0x5d8], 0x1f
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [0x531d90]
lea ecx, [edx + 1]
lea eax, [edx + 2]
imul eax, ecx
imul eax, edx
cdq
mov ecx, 0xc
idiv ecx
cmp edx, 5
jne 0x445428
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x4457f7
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x44545c
push 0x104
lea ecx, [esp + 0x28]
call fcn.00402750
mov esi, dword [esp + 0x24]
cmp dword [esi - 8], 0x104
jl 0x446133
push 0x104
xor eax, eax
push esi
mov dword [esi - 0xc], 0x104
push eax
mov word [esi + 0x208], ax
push dword [ebx + 0xec]
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push ecx
mov edi, esp
lea ecx, [esi - 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], esp
mov dword [esp + 0x1c], edi
call fcn.004027c0
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x5dc], 0x21
mov byte [esp + 0x5dc], 0x1f
lea ecx, [esp + 0x50]
call fcn.0043cd60
add esp, 4
mov byte [esp + 0x5d8], 0x22
push eax
lea ecx, [esp + 0x14]
call fcn.004025b0
mov byte [esp + 0x5d8], 0x1f
mov edx, dword [esp + 0x4c]
jmp 0x445936
movzx eax, word [edx]
cmp ax, word [esi]
mov esi, dword [esp + 0x20]
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x4452cf
mov eax, dword [0x531d90]
imul eax, eax
cdq
mov ecx, 0x17
idiv ecx
cmp edx, 0x11
jne 0x44554d
push 0x28
call fcn.004a90f9
add esp, 4
mov edi, eax
xor esi, esi
call fcn.004aa2d7
add eax, dword [0x531d90]
inc esi
mov dword [edi + esi*4 - 4], eax
cmp esi, 0xa
jl 0x445527
mov eax, dword [edi + 0x24]
push edi
mov dword [0x531d90], eax
call fcn.004aa18b
add esp, 4
mov ebx, dword [esp + 0x14]
cmp dword [ebx + 0x190], 1
jne 0x445564
mov dword [ebx + 0x190], 2
mov edi, dword [esp + 0x6c]
push edi
push 0
push 0x1fffff
mov dword [esp + 0x34], edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [0x531d90]
mov dword [ebx + 0xec], eax
lea eax, [ecx + 1]
imul eax, ecx
cdq
mov ecx, 0xc
idiv ecx
cmp edx, 0xb
jne 0x4455bb
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x531d90]
test eax, eax
mov eax, 7
cmove ecx, eax
mov dword [0x531d90], ecx
mov eax, dword [ebx + 0xec]
test eax, eax
je 0x445776
test edi, edi
je 0x445776
mov edi, dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
push 0x104
lea ecx, [esp + 0x3c0]
push ecx
push eax
call edi
test eax, eax
je 0x445f7e
cmp word [esp + 0x3bc], 0
jne 0x4455fe
xor ecx, ecx
jmp 0x44561f
lea ecx, [esp + 0x3bc]
lea edx, [ecx + 2]
jmp 0x445610
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x445610
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x3c0]
push eax
lea ecx, [esp + 0x28c]
call fcn.00449640
mov eax, dword [esp + 0x294]
push 0xffffffffffffffff
add eax, 0xfffffff6
push eax
lea eax, [esp + 0x394]
push eax
lea ecx, [esp + 0x290]
call fcn.00449060
mov edx, eax
mov byte [esp + 0x5d8], 9
lea ecx, [esp + 0x3a4]
lea esi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x445670
sub ecx, esi
sar ecx, 1
push ecx
lea eax, [esp + 0x3a8]
push eax
push dword [edx + 0x10]
push ecx
mov ecx, edx
call fcn.00449490
test eax, eax
setne bl
mov byte [esp + 0x5d8], 2
cmp dword [esp + 0x3a0], 8
jb 0x4456b9
push dword [esp + 0x38c]
call fcn.004a9925
add esp, 4
xor eax, eax
test bl, bl
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x3a0], 7
mov dword [esp + 0x39c], 0
mov word [esp + 0x38c], ax
je 0x445729
push dword [ebx + 0xec]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x5c]
push eax
push 0
push 0x1fffff
mov dword [esp + 0x34], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebx + 0xec], eax
test eax, eax
je 0x445f43
push 0x104
lea ecx, [esp + 0x3c0]
push ecx
push eax
call edi
test eax, eax
je 0x445f08
mov dword [esp + 0x5d8], 0xffffffff
cmp dword [esp + 0x298], 8
jb 0x44574d
push dword [esp + 0x284]
call fcn.004a9925
add esp, 4
mov esi, dword [esp + 0x20]
xor eax, eax
mov dword [esp + 0x298], 7
mov dword [esp + 0x294], 0
mov word [esp + 0x284], ax
jmp 0x445340
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov edi, eax
mov eax, dword [esp + 0x5c]
push eax
push 0
push 0x1fffff
mov dword [esp + 0x34], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebx + 0xec], eax
test eax, eax
je 0x445fb9
push 0x104
lea ecx, [esp + 0x3c0]
push ecx
push eax
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
jne 0x445729
call esi
mov edx, eax
lea ecx, [esp + 0x29c]
call fcn.0043f390
mov byte [esp + 0x5d8], 7
push eax
call fcn.004412d0
push eax
lea ecx, [esp + 0x20]
call fcn.00442c60
push 0x516bbc
lea eax, [esp + 0x1c]
push eax
call fcn.004b183b
push ecx
lea eax, [esp + 0x3c0]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004024a0
mov byte [esp + 0x5dc], 0x24
mov byte [esp + 0x5dc], 0x1f
lea ecx, [esp + 0x54]
call fcn.0043cd60
add esp, 4
mov byte [esp + 0x5d8], 0x25
push eax
lea ecx, [esp + 0x14]
call fcn.004025b0
mov byte [esp + 0x5d8], 0x1f
mov edx, dword [esp + 0x50]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44585f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.00440380
push eax
lea ecx, [esp + 0x14]
call fcn.004037d0
test eax, eax
jne 0x445954
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or ecx, eax
jge 0x4458a4
push 0x104
lea ecx, [esp + 0x28]
call fcn.00402750
mov esi, dword [esp + 0x24]
cmp dword [esi - 8], 0x104
jl 0x446133
push 0x104
xor eax, eax
push esi
mov dword [esi - 0xc], 0x104
mov word [esi + 0x208], ax
push eax
mov eax, dword [esp + 0x20]
push dword [eax + 0xec]
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push ecx
mov edi, esp
lea ecx, [esi - 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], esp
mov dword [esp + 0x30], edi
call fcn.004027c0
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x5dc], 0x28
mov byte [esp + 0x5dc], 0x1f
lea ecx, [esp + 0x48]
call fcn.0043cd60
add esp, 4
mov byte [esp + 0x5d8], 0x29
push eax
lea ecx, [esp + 0x14]
call fcn.004025b0
mov byte [esp + 0x5d8], 0x1f
mov edx, dword [esp + 0x44]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x445950
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call ebx
mov ebx, eax
mov edi, dword [esp + 0x10]
cmp dword [edi - 0xc], 0
je 0x445975
call fcn.00440380
push eax
lea ecx, [esp + 0x14]
call fcn.004037d0
test eax, eax
jne 0x44632d
mov dword [esp + 0x2c], 0
cmp ebx, 0x714
jne 0x4459d4
lea ecx, [esp + 0x38]
call fcn.0043d540
mov byte [esp + 0x5d8], 0x2b
push eax
lea ecx, [esp + 0x14]
call fcn.004025b0
mov byte [esp + 0x5d8], 0x1f
mov edx, dword [esp + 0x38]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4459c6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
cmp dword [edi - 0xc], 0
je 0x4459f1
call fcn.00440380
push eax
lea ecx, [esp + 0x14]
call fcn.004037d0
test eax, eax
jne 0x44632d
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x29c]
mov dword [eax + 0xec], 0
call fcn.0043f390
mov dword [esp + 0x28], eax
mov byte [esp + 0x5d8], 0x2d
mov edx, ebx
lea ecx, [esp + 0x2fc]
call fcn.0043f390
mov dword [esp + 0x2c], eax
mov byte [esp + 0x5d8], 0x2e
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x2e4]
call fcn.0043f390
mov ebx, eax
mov byte [esp + 0x5d8], 0x2f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x2cc]
call fcn.0043f390
mov byte [esp + 0x5d8], 0x30
push 0x512aa4
mov edx, eax
lea ecx, [esp + 0x348]
call fcn.00427690
add esp, 4
mov byte [esp + 0x5d8], 0x31
push ebx
mov edx, eax
lea ecx, [esp + 0x318]
call fcn.00449cc0
add esp, 4
mov byte [esp + 0x5d8], 0x32
push 0x512aa4
mov edx, eax
lea ecx, [esp + 0x360]
call fcn.00427690
add esp, 4
mov byte [esp + 0x5d8], 0x33
push dword [esp + 0x2c]
mov edx, eax
lea ecx, [esp + 0x330]
call fcn.00449cc0
add esp, 4
mov byte [esp + 0x5d8], 0x34
push 0x512aa4
mov edx, eax
lea ecx, [esp + 0x378]
call fcn.00427690
add esp, 4
mov byte [esp + 0x5d8], 0x35
push dword [esp + 0x28]
mov edx, eax
lea ecx, [esp + 0x2b8]
call fcn.00449cc0
add esp, 4
mov byte [esp + 0x5d8], 0x37
cmp dword [esp + 0x388], 0x10
jb 0x445b32
push dword [esp + 0x374]
call fcn.004a9925
add esp, 4
mov dword [esp + 0x388], 0xf
mov dword [esp + 0x384], 0
mov byte [esp + 0x374], 0
mov byte [esp + 0x5d8], 0x38
cmp dword [esp + 0x340], 0x10
jb 0x445b71
push dword [esp + 0x32c]
call fcn.004a9925
add esp, 4
mov dword [esp + 0x340], 0xf
mov dword [esp + 0x33c], 0
mov byte [esp + 0x32c], 0
mov byte [esp + 0x5d8], 0x39
cmp dword [esp + 0x370], 0x10
jb 0x445bb0
push dword [esp + 0x35c]
call fcn.004a9925
add esp, 4
mov dword [esp + 0x370], 0xf
mov dword [esp + 0x36c], 0
mov byte [esp + 0x35c], 0
mov byte [esp + 0x5d8], 0x3a
cmp dword [esp + 0x328], 0x10
jb 0x445bef
push dword [esp + 0x314]
call fcn.004a9925
add esp, 4
mov dword [esp + 0x328], 0xf
mov dword [esp + 0x324], 0
mov byte [esp + 0x314], 0
mov byte [esp + 0x5d8], 0x3b
cmp dword [esp + 0x358], 0x10
jb 0x445c2e
push dword [esp + 0x344]
call fcn.004a9925
add esp, 4
mov dword [esp + 0x358], 0xf
mov dword [esp + 0x354], 0
mov byte [esp + 0x344], 0
mov byte [esp + 0x5d8], 0x3c
cmp dword [esp + 0x2e0], 0x10
jb 0x445c6d
push dword [esp + 0x2cc]
call fcn.004a9925
add esp, 4
mov dword [esp + 0x2e0], 0xf
mov dword [esp + 0x2dc], 0
mov byte [esp + 0x2cc], 0
mov byte [esp + 0x5d8], 0x3d
cmp dword [esp + 0x2f8], 0x10
jb 0x445cac
push dword [esp + 0x2e4]
call fcn.004a9925
add esp, 4
mov dword [esp + 0x2f8], 0xf
mov dword [esp + 0x2f4], 0
mov byte [esp + 0x2e4], 0
mov byte [esp + 0x5d8], 0x3e
cmp dword [esp + 0x310], 0x10
jb 0x445ceb
push dword [esp + 0x2fc]
call fcn.004a9925
add esp, 4
mov dword [esp + 0x310], 0xf
mov dword [esp + 0x30c], 0
mov byte [esp + 0x2fc], 0
mov byte [esp + 0x5d8], 0x3f
cmp dword [esp + 0x2b0], 0x10
jb 0x445d2a
push dword [esp + 0x29c]
call fcn.004a9925
add esp, 4
mov ecx, dword [esp + 0x3c]
mov eax, ecx
inc ecx
cmp eax, 5
mov dword [esp + 0x2b0], 0xf
mov dword [esp + 0x2ac], 0
mov byte [esp + 0x29c], 0
mov dword [esp + 0x3c], ecx
lea eax, [esp + 0x2b4]
jge 0x44642e
cmp dword [esp + 0x2c8], 0x10
lea ecx, [esp + 0x40]
cmovae eax, dword [esp + 0x2b4]
push eax
call fcn.004033a0
mov byte [esp + 0x5d8], 0x40
call fcn.00442240
push eax
lea ecx, [esp + 0x38]
call fcn.004024a0
mov byte [esp + 0x5d8], 0x41
lea ecx, [esp + 0x40]
push ecx
mov edx, eax
lea ecx, [esp + 0x34]
call fcn.0040e9b0
add esp, 4
mov byte [esp + 0x5d8], 0x42
mov eax, dword [eax]
mov ebx, dword [esp + 0x14]
push dword [eax - 0xc]
lea ecx, [ebx + 0xe0]
push eax
call fcn.0040f690
mov byte [esp + 0x5d8], 0x41
mov edx, dword [esp + 0x30]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x445df2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [esp + 0x5d8], 0x40
mov edx, dword [esp + 0x34]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x445e18
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [esp + 0x5d8], 0x3f
mov edx, dword [esp + 0x40]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x445e3e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx + 0xf4]
cdq
sub eax, edx
sar eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [esp + 0x5d8], 0x1f
cmp dword [esp + 0x2c8], 0x10
jb 0x445e71
push dword [esp + 0x2b4]
call fcn.004a9925
add esp, 4
mov dword [esp + 0x2c8], 0xf
mov dword [esp + 0x2c4], 0
mov byte [esp + 0x2b4], 0
mov byte [esp + 0x5d8], 0x1d
add edi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x445eb1
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x5d8], 0xffffffff
add esi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4450f2
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4450f2
mov eax, 1
mov ecx, dword [esp + 0x5d0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b8]
xor ecx, esp
call fcn.004a992a
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x29c]
call fcn.0043f390
mov byte [esp + 0x5d8], 0xb
push eax
call fcn.00442130
push eax
lea ecx, [esp + 0x20]
call fcn.00442c60
push 0x516bbc
lea eax, [esp + 0x1c]
push eax
call fcn.004b183b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x29c]
call fcn.0043f390
mov byte [esp + 0x5d8], 0xa
push eax
call fcn.00442ab0
push eax
lea ecx, [esp + 0x20]
call fcn.00442c60
push 0x516bbc
lea eax, [esp + 0x1c]
push eax
call fcn.004b183b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x29c]
call fcn.0043f390
mov byte [esp + 0x5d8], 8
push eax
call fcn.00442960
push eax
lea ecx, [esp + 0x20]
call fcn.00442c60
push 0x516bbc
lea eax, [esp + 0x1c]
push eax
call fcn.004b183b
call esi
mov edx, eax
lea ecx, [esp + 0x29c]
call fcn.0043f390
mov esi, eax
mov byte [esp + 0x5d8], 3
mov edx, edi
lea ecx, [esp + 0x2fc]
call fcn.0043f390
mov byte [esp + 0x5d8], 4
push 0x513f98
mov edx, eax
lea ecx, [esp + 0x2e8]
call fcn.00427690
add esp, 4
mov byte [esp + 0x5d8], 5
push esi
mov edx, eax
lea ecx, [esp + 0x2d0]
call fcn.00449cc0
add esp, 4
mov byte [esp + 0x5d8], 6
push eax
call fcn.00441bc0
push eax
lea ecx, [esp + 0x20]
call fcn.00442c60
push 0x516bbc
lea eax, [esp + 0x1c]
push eax
call fcn.004b183b
push ecx
mov ecx, dword [ebx + 0x88]
lea edi, [ebx + 0x88]
mov esi, esp
sub ecx, 0x10
mov dword [esp + 0x1c], esp
mov dword [esp + 0x38], esi
call fcn.004027c0
add eax, 0x10
mov dword [esi], eax
mov dword [esp + 0x5dc], 0xd
push ecx
mov ecx, dword [ebx + 0xd8]
mov esi, esp
sub ecx, 0x10
mov dword [esp + 0x3c], esp
mov dword [esp + 0x38], esi
call fcn.004027c0
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x5e0], 0xf
mov dword [esp + 0x5e0], 0xffffffff
call fcn.00420820
add esp, 8
test al, al
jne 0x446325
mov eax, dword [0x52c6d8]
mov ecx, 0x52c6d8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
mov dword [esp + 0x5d8], 0x11
mov edx, dword [0x531d90]
lea ecx, [edx + 1]
lea eax, [edx + 2]
imul eax, ecx
imul eax, edx
cdq
mov ecx, 0x15
idiv ecx
cmp edx, 7
jne 0x446100
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov ecx, dword [esp + 0x10]
mov edx, 1
mov eax, dword [ecx - 8]
sub edx, dword [ecx - 4]
sub eax, 0x104
or eax, edx
jge 0x44612a
push 0x104
lea ecx, [esp + 0x14]
call fcn.00402750
mov ecx, dword [esp + 0x10]
cmp dword [ecx - 8], 0x104
jge 0x44613d
push 0x80070057
call fcn.00401a60
push 0x104
mov dword [ecx - 0xc], 0x104
mov eax, dword [esp + 0x14]
xor edx, edx
push ecx
push edx
mov word [eax + 0x208], dx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x44619d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x29c]
call fcn.0043f390
mov byte [esp + 0x5d8], 0x12
push eax
call fcn.00440ef0
push eax
lea ecx, [esp + 0x20]
call fcn.00442c60
push 0x516bbc
lea eax, [esp + 0x1c]
push eax
call fcn.004b183b
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call fcn.004214c0
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x10]
mov eax, dword [eax - 0xc]
add eax, 0xfffffffc
push eax
lea eax, [esp + 0x38]
push eax
call fcn.00417350
mov byte [esp + 0x5d8], 0x13
push str.64.exe
mov edx, eax
lea ecx, [esp + 0x28]
call fcn.00417410
add esp, 4
mov byte [esp + 0x5d8], 0x15
lea ecx, [esp + 0x34]
call fcn.00402550
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push edi
call fcn.00403340
mov byte [esp + 0x5dc], 0x16
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00403340
mov byte [esp + 0x5e0], 0x17
mov byte [esp + 0x5e0], 0x15
call fcn.00420820
add esp, 8
test al, al
jne 0x446300
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x10]
mov eax, dword [eax - 0xc]
add eax, 0xfffffffc
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00417350
mov byte [esp + 0x5d8], 0x18
push 0x513fa4
mov edx, eax
lea ecx, [esp + 0x34]
call fcn.00417410
add esp, 4
mov byte [esp + 0x5d8], 0x19
push eax
lea ecx, [esp + 0x28]
call fcn.004025b0
mov byte [esp + 0x5d8], 0x18
lea ecx, [esp + 0x30]
call fcn.00402550
mov byte [esp + 0x5d8], 0x15
lea ecx, [esp + 0x38]
call fcn.00402550
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push edi
call fcn.00403340
mov byte [esp + 0x5dc], 0x1a
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.00403340
mov byte [esp + 0x5e0], 0x1b
mov byte [esp + 0x5e0], 0x15
call fcn.00420820
add esp, 8
test al, al
jne 0x446300
push 0x5114ec
call fcn.004424d0
push eax
lea ecx, [esp + 0x20]
call fcn.00442b90
push 0x516bbc
lea eax, [esp + 0x1c]
push eax
call fcn.004b183b
mov byte [esp + 0x5d8], 0x11
lea ecx, [esp + 0x24]
call fcn.00402550
mov dword [esp + 0x5d8], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00402550
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x513fc4
lea ecx, [esp + 0x14]
call fcn.004037d0
test eax, eax
jne 0x4463c3
mov eax, dword [esp + 0x14]
push esi
lea ecx, [esp + 0x18]
mov dword [eax + 0xec], 0
call fcn.00417110
mov byte [esp + 0x5d8], 0x48
push 0x5c
lea ecx, [esp + 0x18]
call fcn.00448f10
push 0x20
lea ecx, [esp + 0x18]
call fcn.00448f10
push 0x2f
lea ecx, [esp + 0x18]
call fcn.00448f10
mov eax, dword [esp + 0x14]
mov ecx, 1
sub ecx, dword [eax - 4]
or ecx, dword [eax - 8]
jge 0x4463a4
push 0
lea ecx, [esp + 0x18]
call fcn.00417be0
mov eax, dword [esp + 0x14]
push eax
call fcn.00442050
push eax
lea ecx, [esp + 0x20]
call fcn.00442b90
push 0x516bbc
lea eax, [esp + 0x1c]
push eax
call fcn.004b183b
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
lea ecx, [ebx + 0xc8]
call fcn.004025b0
mov eax, dword [esp + 0x28]
mov dword [ebx + 0xe8], eax
mov byte [esp + 0x5d8], 0x1d
add edi, 0xfffffff0
or ebx, 0xffffffff
lea eax, [edi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x446405
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x5d8], 0xffffffff
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x446427
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
jmp 0x445ee4
cmp dword [esp + 0x2c8], 0x10
cmovae eax, dword [esp + 0x2b4]
push eax
call fcn.00441b30
push eax
lea ecx, [esp + 0x20]
call fcn.00442b90
push 0x516bbc
lea eax, [esp + 0x1c]
push eax
call fcn.004b183b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x29c]
call fcn.0043f390
mov dword [esp + 0x5d8], 1
push eax
call fcn.00441a30
push eax
lea ecx, [esp + 0x20]
call fcn.00442c60
push 0x516bbc
lea eax, [esp + 0x1c]
push eax
call fcn.004b183b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [esp + 0x29c]
call fcn.0043f390
mov dword [esp + 0x5d8], 0
push eax
call fcn.00441da0
push eax
lea ecx, [esp + 0x20]
call fcn.00442c60
push 0x516bbc
lea eax, [esp + 0x1c]
push eax
call fcn.004b183b
int3