Function at 0x454d9e
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Contain obfuscated stackstrings
Create directory
Create thread
Delete registry key
Get common file path
Get number of processors
Parse pe header
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c4daa
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2148
call fcn.0057edb0
mov eax, dword [0x6c56f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x2054], edi
xor esi, esi
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], esi
mov dword [edi + 0xc], esi
mov dword [ebp - 4], esi
lea eax, [edi + 0x24]
push eax
call fcn.004084c2
mov byte [ebp - 4], 1
lea eax, [edi + 0x28]
push eax
call fcn.004084c2
mov byte [ebp - 4], 2
lea ecx, [edi + 0x2c]
call fcn.004010c4
mov byte [ebp - 4], 3
lea ecx, [edi + 0x30]
call fcn.004010c4
mov byte [ebp - 4], 4
lea ecx, [edi + 0x34]
call fcn.004010c4
mov byte [ebp - 4], 5
lea ecx, [edi + 0x38]
call fcn.004010c4
mov byte [ebp - 4], 6
lea ecx, [edi + 0x3c]
call fcn.004010c4
mov byte [ebp - 4], 7
lea ecx, [edi + 0x40]
call fcn.004010c4
mov byte [ebp - 4], 8
lea ecx, [edi + 0x44]
call fcn.004010c4
mov byte [ebp - 4], 9
mov dword [edi + 0x48], esi
mov byte [edi + 0x4c], 0
mov byte [edi + 0x68], 0
or ebx, 0xffffffff
mov dword [edi + 0x6c], ebx
mov dword [edi + 0x70], 0xd
mov dword [edi + 0x74], 0x1e
mov dword [edi + 0x78], esi
mov byte [edi + 0x7c], 0
mov dword [edi + 0x80], 1
mov byte [edi + 0x84], 1
push 0x67b04c
lea eax, [edi + 0x88]
push eax
call fcn.00408518
mov byte [ebp - 4], 0xa
lea esi, [edi + 0x8c]
mov ecx, esi
call fcn.004010c4
mov byte [ebp - 4], 0xb
xor eax, eax
inc eax
mov dword [edi + 0x90], eax
lea ecx, [edi + 0x94]
mov dword [ebp - 0x2048], ecx
push 0
push eax
call fcn.0040eb7d
pop ecx
pop ecx
mov dword [ebp - 0x2064], eax
mov dword [ebp - 0x203c], eax
mov byte [ebp - 4], 0xc
test eax, eax
je 0x454ef4
mov ecx, dword [ebp - 0x2048]
mov dword [eax], ecx
jmp 0x454ef6
xor eax, eax
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x2048]
mov dword [ecx], eax
mov byte [ebp - 4], 0x11
call fcn.0046d6c5
mov edx, dword [ebp - 0x2048]
lea ecx, [edx + 0x18]
mov dword [ecx], eax
mov byte [eax + 0x1ad], 1
mov eax, dword [ecx]
mov dword [eax + 4], eax
mov eax, dword [ecx]
mov dword [eax], eax
mov ecx, dword [ecx]
mov dword [ecx + 8], ecx
and dword [edx + 0x1c], 0
mov byte [ebp - 4], 0x13
lea eax, [edi + 0xb4]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 0x14
and dword [edi + 0xcc], 0
lea eax, [edi + 0xd0]
push eax
call fcn.00413d70
mov byte [ebp - 4], 0x15
lea eax, [edi + 0xf0]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 0x16
lea eax, [edi + 0x108]
mov dword [ebp - 0x2048], eax
push 0
push 1
call fcn.0040eb7d
pop ecx
pop ecx
mov dword [ebp - 0x2064], eax
mov dword [ebp - 0x203c], eax
mov byte [ebp - 4], 0x17
test eax, eax
je 0x454fa1
mov ecx, dword [ebp - 0x2048]
mov dword [eax], ecx
jmp 0x454fa3
xor eax, eax
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x2048]
mov dword [ecx], eax
mov byte [ebp - 4], 0x1c
call fcn.0043e393
mov edx, dword [ebp - 0x2048]
lea ecx, [edx + 0x18]
mov dword [ecx], eax
mov byte [eax + 0x15], 1
mov eax, dword [ecx]
mov dword [eax + 4], eax
mov eax, dword [ecx]
mov dword [eax], eax
mov ecx, dword [ecx]
mov dword [ecx + 8], ecx
and dword [edx + 0x1c], 0
mov byte [ebp - 4], 0x1e
lea eax, [edi + 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 0x1f
mov dword [edi + 0x140], 0x64
and dword [edi + 0x144], 0
mov byte [ebp - 4], 0x20
push 0x4549a9
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.0040fae5
call fcn.00472e7b
push 4
call fcn.00579757
pop ecx
mov dword [ebp - 0x203c], eax
mov byte [ebp - 4], 0x21
test eax, eax
je 0x455044
and dword [eax], 0
push eax
push 0x693178
call sub.ADVAPI32.dll_ConvertStringSidToSidW
mov eax, dword [ebp - 0x203c]
jmp 0x455046
xor eax, eax
mov byte [ebp - 4], 0x20
mov dword [0x6ddd34], eax
call fcn.0042e69d
call fcn.004549db
push ebx
push 0x67b1b4
call fcn.004c1c50
mov dword [ebp - 0x203c], eax
mov byte [ebp - 4], 0x22
push ebx
push 0x67b1b0
call fcn.004c1c50
mov dword [ebp - 0x204c], eax
mov byte [ebp - 4], 0x23
push ebx
push 0x67b1ac
call fcn.004c1c50
mov dword [ebp - 0x2060], eax
mov byte [ebp - 4], 0x24
push ebx
push 0x67b1a8
call fcn.004c1c50
mov dword [ebp - 0x205c], eax
mov byte [ebp - 4], 0x25
push ebx
push 0x67b1a4
call fcn.004c1c50
mov dword [ebp - 0x2104], eax
mov byte [ebp - 4], 0x26
push ebx
push 0x67b1a0
call fcn.004c1c50
mov dword [ebp - 0x20fc], eax
mov byte [ebp - 4], 0x27
push ebx
push 0x67b19c
call fcn.004c1c50
mov dword [ebp - 0x20f4], eax
mov byte [ebp - 4], 0x28
push ebx
push 0x67b198
call fcn.004c1c50
add esp, 0x40
mov dword [ebp - 0x20ec], eax
mov byte [ebp - 4], 0x29
push ebx
push 0x67b194
call fcn.004c1c50
mov dword [ebp - 0x20e4], eax
mov byte [ebp - 4], 0x2a
push ebx
push 0x67b190
call fcn.004c1c50
mov dword [ebp - 0x20dc], eax
mov byte [ebp - 4], 0x2b
push ebx
push 0x67b18c
call fcn.004c1c50
mov dword [ebp - 0x20d4], eax
mov byte [ebp - 4], 0x2c
push ebx
push 0x67b188
call fcn.004c1c50
mov dword [ebp - 0x20cc], eax
mov byte [ebp - 4], 0x2d
push ebx
push 0x67b184
call fcn.004c1c50
mov dword [ebp - 0x20c4], eax
mov byte [ebp - 4], 0x2e
push ebx
push 0x67b180
call fcn.004c1c50
mov dword [ebp - 0x20bc], eax
mov byte [ebp - 4], 0x2f
push ebx
push 0x67b17c
call fcn.004c1c50
mov dword [ebp - 0x20b4], eax
mov byte [ebp - 4], 0x30
push ebx
push 0x67b178
call fcn.004c1c50
add esp, 0x40
mov dword [ebp - 0x20ac], eax
mov byte [ebp - 4], 0x31
push ebx
push 0x67b174
call fcn.004c1c50
mov dword [ebp - 0x20a4], eax
mov byte [ebp - 4], 0x32
push ebx
push 0x67b170
call fcn.004c1c50
mov dword [ebp - 0x209c], eax
mov byte [ebp - 4], 0x33
push ebx
push 0x67b16c
call fcn.004c1c50
mov dword [ebp - 0x2094], eax
mov byte [ebp - 4], 0x34
push ebx
push 0x67b168
call fcn.004c1c50
mov dword [ebp - 0x208c], eax
mov byte [ebp - 4], 0x35
push ebx
push 0x67b164
call fcn.004c1c50
mov dword [ebp - 0x2084], eax
mov byte [ebp - 4], 0x36
push ebx
push 0x67b160
call fcn.004c1c50
mov dword [ebp - 0x207c], eax
mov byte [ebp - 4], 0x37
push ebx
push 0x67b15c
call fcn.004c1c50
mov dword [ebp - 0x2074], eax
mov byte [ebp - 4], 0x38
push ebx
push 0x67b158
call fcn.004c1c50
add esp, 0x40
mov dword [ebp - 0x206c], eax
mov byte [ebp - 4], 0x39
push ebx
push 0x67b154
call fcn.004c1c50
mov dword [ebp - 0x20e0], eax
mov byte [ebp - 4], 0x3a
push ebx
push 0x67b150
call fcn.004c1c50
mov dword [ebp - 0x2118], eax
mov byte [ebp - 4], 0x3b
push ebx
push 0x67b14c
call fcn.004c1c50
mov dword [ebp - 0x20d8], eax
mov byte [ebp - 4], 0x3c
push ebx
push 0x67b148
call fcn.004c1c50
mov dword [ebp - 0x2150], eax
mov byte [ebp - 4], 0x3d
push ebx
push 0x67b144
call fcn.004c1c50
mov dword [ebp - 0x20d0], eax
mov byte [ebp - 4], 0x3e
push ebx
push 0x67b140
call fcn.004c1c50
mov dword [ebp - 0x2110], eax
mov byte [ebp - 4], 0x3f
push ebx
push 0x67b13c
call fcn.004c1c50
mov dword [ebp - 0x20c8], eax
mov byte [ebp - 4], 0x40
push ebx
push 0x67b138
call fcn.004c1c50
add esp, 0x40
mov dword [ebp - 0x2130], eax
mov byte [ebp - 4], 0x41
push ebx
push 0x67b134
call fcn.004c1c50
mov dword [ebp - 0x2068], eax
mov byte [ebp - 4], 0x42
push ebx
push 0x67b130
call fcn.004c1c50
mov dword [ebp - 0x2108], eax
mov byte [ebp - 4], 0x43
push ebx
push 0x67b12c
call fcn.004c1c50
mov dword [ebp - 0x20b8], eax
mov byte [ebp - 4], 0x44
push ebx
push 0x67b128
call fcn.004c1c50
mov dword [ebp - 0x2140], eax
mov byte [ebp - 4], 0x45
push ebx
push 0x67b124
call fcn.004c1c50
mov dword [ebp - 0x20b0], eax
mov byte [ebp - 4], 0x46
push ebx
push 0x67b120
call fcn.004c1c50
mov dword [ebp - 0x2100], eax
mov byte [ebp - 4], 0x47
push ebx
push 0x67b11c
call fcn.004c1c50
mov dword [ebp - 0x20a8], eax
mov byte [ebp - 4], 0x48
push ebx
push 0x67b118
call fcn.004c1c50
add esp, 0x40
mov dword [ebp - 0x2128], eax
mov byte [ebp - 4], 0x49
push ebx
push 0x67b114
call fcn.004c1c50
mov dword [ebp - 0x20a0], eax
mov byte [ebp - 4], 0x4a
push ebx
push 0x67b10c
call fcn.004c1c50
mov dword [ebp - 0x20f8], eax
mov byte [ebp - 4], 0x4b
push ebx
push 0x67b108
call fcn.004c1c50
mov dword [ebp - 0x2098], eax
mov byte [ebp - 4], 0x4c
push ebx
push 0x67b104
call fcn.004c1c50
mov dword [ebp - 0x2148], eax
mov byte [ebp - 4], 0x4d
push ebx
push 0x67b100
call fcn.004c1c50
mov dword [ebp - 0x2090], eax
mov byte [ebp - 4], 0x4e
push ebx
push 0x67b0fc
call fcn.004c1c50
mov dword [ebp - 0x20f0], eax
mov byte [ebp - 4], 0x4f
push ebx
push 0x67b0f8
call fcn.004c1c50
mov dword [ebp - 0x2088], eax
mov byte [ebp - 4], 0x50
push ebx
push 0x67b0f4
call fcn.004c1c50
add esp, 0x40
mov dword [ebp - 0x2120], eax
mov byte [ebp - 4], 0x51
push ebx
push 0x67b0f0
call fcn.004c1c50
mov dword [ebp - 0x2080], eax
mov byte [ebp - 4], 0x52
push ebx
push 0x67b0ec
call fcn.004c1c50
mov dword [ebp - 0x20e8], eax
mov byte [ebp - 4], 0x53
push ebx
push 0x67b0e8
call fcn.004c1c50
mov dword [ebp - 0x2078], eax
mov byte [ebp - 4], 0x54
push ebx
push 0x67b0e4
call fcn.004c1c50
mov dword [ebp - 0x2138], eax
mov byte [ebp - 4], 0x55
push ebx
push 0x67b0e0
call fcn.004c1c50
mov dword [ebp - 0x2070], eax
mov byte [ebp - 4], 0x56
push ebx
push 0x67b0dc
call fcn.004c1c50
mov dword [ebp - 0x2154], eax
mov byte [ebp - 4], 0x57
push ebx
push 0x67b0d8
call fcn.004c1c50
mov dword [ebp - 0x214c], eax
mov byte [ebp - 4], 0x58
push ebx
push 0x67b0d4
call fcn.004c1c50
add esp, 0x40
mov dword [ebp - 0x2144], eax
mov byte [ebp - 4], 0x59
push ebx
push 0x67b0d0
call fcn.004c1c50
mov dword [ebp - 0x213c], eax
mov byte [ebp - 4], 0x5a
push ebx
push 0x67b0cc
call fcn.004c1c50
mov dword [ebp - 0x2134], eax
mov byte [ebp - 4], 0x5b
push ebx
push 0x67b0c8
call fcn.004c1c50
mov dword [ebp - 0x212c], eax
mov byte [ebp - 4], 0x5c
push ebx
push 0x67b0c4
call fcn.004c1c50
mov dword [ebp - 0x2124], eax
mov byte [ebp - 4], 0x5d
push ebx
push 0x67b0c0
call fcn.004c1c50
mov dword [ebp - 0x211c], eax
mov byte [ebp - 4], 0x5e
push ebx
push 0x67b0bc
call fcn.004c1c50
mov dword [ebp - 0x2114], eax
mov byte [ebp - 4], 0x5f
push ebx
push 0x67b0b8
call fcn.004c1c50
mov dword [ebp - 0x210c], eax
mov byte [ebp - 4], 0x60
push ebx
push 0x67b0b4
call fcn.004c1c50
add esp, 0x40
mov dword [ebp - 0x20c0], eax
mov byte [ebp - 4], 0x61
lea eax, [ebp - 0x20c0]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x210c]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2114]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x211c]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2124]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x212c]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2134]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x213c]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2144]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x214c]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2154]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2070]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2138]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2078]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20e8]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2080]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2120]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2088]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20f0]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2090]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2148]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2098]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20f8]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20a0]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2128]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20a8]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2100]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20b0]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2140]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20b8]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2108]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2068]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2130]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20c8]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2110]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20d0]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2150]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20d8]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2118]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20e0]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x206c]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2074]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x207c]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2084]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x208c]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2094]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x209c]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20a4]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20ac]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20b4]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20bc]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20c4]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20cc]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20d4]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20dc]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20e4]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20ec]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20f4]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20fc]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2104]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x205c]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2060]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x204c]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x203c]
push eax
mov ecx, esi
call fcn.00401d91
mov byte [ebp - 4], 0x60
lea ecx, [ebp - 0x20c0]
call fcn.004010b0
mov byte [ebp - 4], 0x5f
lea ecx, [ebp - 0x210c]
call fcn.004010b0
mov byte [ebp - 4], 0x5e
lea ecx, [ebp - 0x2114]
call fcn.004010b0
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x211c]
call fcn.004010b0
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0x2124]
call fcn.004010b0
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0x212c]
call fcn.004010b0
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x2134]
call fcn.004010b0
mov byte [ebp - 4], 0x59
lea ecx, [ebp - 0x213c]
call fcn.004010b0
mov byte [ebp - 4], 0x58
lea ecx, [ebp - 0x2144]
call fcn.004010b0
mov byte [ebp - 4], 0x57
lea ecx, [ebp - 0x214c]
call fcn.004010b0
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0x2154]
call fcn.004010b0
mov byte [ebp - 4], 0x55
lea ecx, [ebp - 0x2070]
call fcn.004010b0
mov byte [ebp - 4], 0x54
lea ecx, [ebp - 0x2138]
call fcn.004010b0
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0x2078]
call fcn.004010b0
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0x20e8]
call fcn.004010b0
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x2080]
call fcn.004010b0
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0x2120]
call fcn.004010b0
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x2088]
call fcn.004010b0
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0x20f0]
call fcn.004010b0
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x2090]
call fcn.004010b0
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0x2148]
call fcn.004010b0
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x2098]
call fcn.004010b0
mov byte [ebp - 4], 0x4a
lea ecx, [ebp - 0x20f8]
call fcn.004010b0
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x20a0]
call fcn.004010b0
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x2128]
call fcn.004010b0
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x20a8]
call fcn.004010b0
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0x2100]
call fcn.004010b0
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x20b0]
call fcn.004010b0
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x2140]
call fcn.004010b0
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x20b8]
call fcn.004010b0
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x2108]
call fcn.004010b0
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x2068]
call fcn.004010b0
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x2130]
call fcn.004010b0
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x20c8]
call fcn.004010b0
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x2110]
call fcn.004010b0
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x20d0]
call fcn.004010b0
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x2150]
call fcn.004010b0
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x20d8]
call fcn.004010b0
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x2118]
call fcn.004010b0
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x20e0]
call fcn.004010b0
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x206c]
call fcn.004010b0
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x2074]
call fcn.004010b0
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x207c]
call fcn.004010b0
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x2084]
call fcn.004010b0
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x208c]
call fcn.004010b0
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x2094]
call fcn.004010b0
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x209c]
call fcn.004010b0
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x20a4]
call fcn.004010b0
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x20ac]
call fcn.004010b0
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x20b4]
call fcn.004010b0
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x20bc]
call fcn.004010b0
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x20c4]
call fcn.004010b0
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x20cc]
call fcn.004010b0
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x20d4]
call fcn.004010b0
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x20dc]
call fcn.004010b0
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x20e4]
call fcn.004010b0
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x20ec]
call fcn.004010b0
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x20f4]
call fcn.004010b0
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x20fc]
call fcn.004010b0
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x2104]
call fcn.004010b0
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x205c]
call fcn.004010b0
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x2060]
call fcn.004010b0
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x204c]
call fcn.004010b0
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x203c]
call fcn.004010b0
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push 0x67b1b8
push eax
call fcn.00408518
mov byte [ebp - 4], 0x62
mov byte [ebp - 4], 0x20
call fcn.0042d522
test eax, eax
jne 0x455d41
push eax
call fcn.0057b2eb
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push 0x67b1d8
push eax
call fcn.00408518
mov byte [ebp - 4], 0x63
mov byte [ebp - 4], 0x20
call fcn.0042d5aa
xor esi, esi
inc esi
cmp dword [0x6c438c], esi
jl 0x455d5f
push 0x67b1f8
push 0x67b200
push esi
call fcn.00538922
add esp, 0xc
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push 0x67b210
push eax
call fcn.00408518
mov byte [ebp - 4], 0x64
mov byte [ebp - 4], 0x20
call fcn.0042d522
mov dword [0x6de628], eax
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push 0x67b22c
push eax
call fcn.00408518
mov byte [ebp - 4], 0x65
mov byte [ebp - 4], 0x20
call fcn.0042d522
mov dword [0x6de624], eax
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push 0x67b24c
push eax
call fcn.00408518
mov byte [ebp - 4], 0x66
mov byte [ebp - 4], 0x20
call fcn.0042d522
mov dword [0x6de620], eax
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push 0x67b264
push eax
call fcn.00408518
mov byte [ebp - 4], 0x67
mov byte [ebp - 4], 0x20
call fcn.0042d522
mov dword [0x6de61c], eax
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push 0x67b280
push eax
call fcn.00408518
mov byte [ebp - 4], 0x68
mov byte [ebp - 4], 0x20
call fcn.0042d522
mov dword [0x6de62c], eax
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push 0x67b298
push eax
call fcn.00408518
mov byte [ebp - 4], 0x69
mov byte [ebp - 4], 0x20
call fcn.0042d522
mov dword [0x6c83f4], eax
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push 0x67b2b8
push eax
call fcn.00408518
mov byte [ebp - 4], 0x6a
mov byte [ebp - 4], 0x20
call fcn.0042d522
mov dword [0x6c83f8], eax
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.Beh1
push eax
call fcn.00408518
mov byte [ebp - 4], 0x6b
mov byte [ebp - 4], 0x20
call fcn.0042d522
mov dword [0x6c83fc], eax
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.Beh21
push eax
call fcn.00408518
mov byte [ebp - 4], 0x6c
mov byte [ebp - 4], 0x20
call fcn.0042d522
mov dword [0x6c8400], eax
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push 0x67b2e8
push eax
call fcn.00408518
mov byte [ebp - 4], 0x6d
mov byte [ebp - 4], 0x20
call fcn.0042d522
mov dword [0x6c8404], eax
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push 0x67b2fc
push eax
call fcn.00408518
mov byte [ebp - 4], 0x6e
mov byte [ebp - 4], 0x20
call fcn.0042d522
mov dword [0x6c8464], eax
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push 0x67b318
push eax
call fcn.00408518
mov byte [ebp - 4], 0x6f
mov byte [ebp - 4], 0x20
call fcn.0042d522
mov dword [0x6c83e4], eax
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push 0x67b33c
push eax
call fcn.00408518
mov byte [ebp - 4], 0x70
mov byte [ebp - 4], 0x20
call fcn.0042d522
mov dword [0x6c83e8], eax
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.SuperUSB
push eax
call fcn.00408518
mov byte [ebp - 4], 0x71
mov byte [ebp - 4], 0x20
call fcn.0042d522
mov dword [0x6c8408], eax
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push 0x67b374
push eax
call fcn.00408518
mov byte [ebp - 4], 0x72
mov byte [ebp - 4], 0x20
call fcn.0042d522
mov dword [0x6de638], eax
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.AllowUSBSigned
push eax
call fcn.00408518
mov byte [ebp - 4], 0x73
mov byte [ebp - 4], 0x20
call fcn.0042d522
mov dword [0x6c83c4], eax
push 0x20
call fcn.00579757
pop ecx
mov dword [ebp - 0x203c], eax
mov byte [ebp - 4], 0x74
test eax, eax
je 0x455ff4
push eax
call fcn.0040f899
jmp 0x455ff6
xor eax, eax
mov byte [ebp - 4], 0x20
mov dword [0x6de66c], eax
push str._restorem.db
push ecx
mov eax, esp
mov dword [ebp - 0x2060], esp
push eax
call fcn.004740f0
pop ecx
mov byte [ebp - 4], 0x75
lea eax, [ebp - 0x204c]
push eax
mov byte [ebp - 4], 0x20
call fcn.004040c8
pop ecx
pop ecx
mov byte [ebp - 4], 0x76
lea ecx, [ebp - 0x203c]
push ecx
mov esi, eax
call fcn.00413787
pop ecx
pop ecx
mov byte [ebp - 4], 0x77
push dword [eax]
mov ecx, dword [0x6de66c]
call fcn.00410181
mov byte [ebp - 4], 0x76
lea ecx, [ebp - 0x203c]
call fcn.00408418
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x204c]
call fcn.00408418
call fcn.0041c3df
mov esi, 0x6de8f0
mov dword [ebp - 0x205c], esi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x78
lea eax, [ebp - 0x204c]
push eax
call fcn.004740f0
mov byte [ebp - 4], 0x79
mov dword [esp], 0x67b3b4
lea ecx, [ebp - 0x203c]
push ecx
mov ecx, eax
call fcn.0040fcd8
pop ecx
pop ecx
mov byte [ebp - 4], 0x7a
mov eax, dword [eax]
push 0
push eax
mov ecx, 0x6de8ec
call fcn.0043178a
mov byte [ebp - 4], 0x79
lea ecx, [ebp - 0x203c]
call fcn.00408559
mov byte [ebp - 4], 0x78
lea ecx, [ebp - 0x204c]
call fcn.00408559
push 0x6de8ec
call fcn.00431848
test al, al
jne 0x456124
xor eax, eax
push eax
push eax
push eax
push 0x45693b
push eax
push eax
call fcn.0057b57b
add esp, 0x18
mov dword [0x6de668], eax
cmp dword [0x6c438c], 1
jl 0x456124
push str.PCDB_ready
push 0x67b3d0
push 1
call fcn.00538922
add esp, 0xc
mov byte [ebp - 4], 0x20
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor esi, esi
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x6de65c], eax
mov byte [edi + 0x50], 0
push 0x6ddd38
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x400
lea eax, [ebp - 0x2018]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
lea eax, [ebp - 0x2018]
push eax
call fcn.0057c155
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x2018]
push eax
lea eax, [ebp - 0x2058]
push eax
call fcn.00408518
mov byte [ebp - 4], 0x7b
push str.msav.db
lea eax, [ebp - 0x203c]
push eax
lea ecx, [ebp - 0x2058]
call fcn.0040fcd8
pop ecx
pop ecx
mov byte [ebp - 4], 0x7c
mov edi, 0x6df54c
call fcn.0040857c
mov byte [ebp - 4], 0x7b
lea ecx, [ebp - 0x203c]
call fcn.00408559
push esi
push 0x23
lea eax, [ebp - 0x818]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edi, [ebp - 0x818]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x4561de
mov esi, str.AVHome
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x203c]
push eax
call fcn.00408518
mov byte [ebp - 4], 0x7d
push str.cache.db
lea ecx, [ebp - 0x2064]
push ecx
mov ecx, eax
call fcn.0040fcd8
pop ecx
pop ecx
mov byte [ebp - 4], 0x7f
lea ecx, [ebp - 0x203c]
call fcn.00408559
push 0
lea eax, [ebp - 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edi, [ebp - 0x818]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x456244
mov esi, 0x67b418
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor esi, esi
push esi
lea eax, [ebp - 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str._sc6.db
lea eax, [ebp - 0x203c]
push eax
lea ecx, [ebp - 0x2058]
call fcn.0040fcd8
pop ecx
pop ecx
mov byte [ebp - 4], 0x80
mov edi, 0x6df4b0
call fcn.0040857c
mov byte [ebp - 4], 0x7f
lea ecx, [ebp - 0x203c]
call fcn.00408559
push 0x3c
call fcn.00579757
pop ecx
mov dword [ebp - 0x203c], eax
mov byte [ebp - 4], 0x81
cmp eax, esi
je 0x4562c0
push 0x67b430
push eax
call fcn.004894b0
jmp 0x4562c2
xor eax, eax
mov byte [ebp - 4], 0x7f
mov dword [0x6de644], eax
push esi
push dword [0x6df4b0]
mov ecx, eax
call fcn.004899e0
push str._scr4.db
lea eax, [ebp - 0x203c]
push eax
lea ecx, [ebp - 0x2058]
call fcn.0040fcd8
pop ecx
pop ecx
mov byte [ebp - 4], 0x82
mov edi, 0x6df42c
call fcn.0040857c
mov byte [ebp - 4], 0x7f
lea ecx, [ebp - 0x203c]
call fcn.00408559
push 0x3c
call fcn.00579757
pop ecx
mov dword [ebp - 0x203c], eax
mov byte [ebp - 4], 0x83
cmp eax, esi
je 0x456332
push 0x67b458
push eax
call fcn.004894b0
jmp 0x456334
xor eax, eax
mov byte [ebp - 4], 0x7f
mov dword [0x6de648], eax
push esi
push dword [0x6df42c]
mov ecx, eax
call fcn.004899e0
push str._scai4.db
lea eax, [ebp - 0x203c]
push eax
lea ecx, [ebp - 0x2058]
call fcn.0040fcd8
pop ecx
pop ecx
mov byte [ebp - 4], 0x84
mov edi, 0x6dee14
call fcn.0040857c
mov byte [ebp - 4], 0x7f
lea ecx, [ebp - 0x203c]
call fcn.00408559
push 0x3c
call fcn.00579757
pop ecx
mov dword [ebp - 0x203c], eax
mov byte [ebp - 4], 0x85
cmp eax, esi
je 0x4563a4
push 0x67b480
push eax
call fcn.004894b0
jmp 0x4563a6
xor eax, eax
mov byte [ebp - 4], 0x7f
mov dword [0x6de64c], eax
push esi
push dword [0x6dee14]
mov ecx, eax
call fcn.004899e0
lea eax, [ebp - 0x818]
push eax
call fcn.00432f94
pop ecx
call fcn.0042e855
mov eax, dword [ebp - 0x2054]
mov dword [0x6de658], eax
mov byte [ebp - 0x203d], 0
mov dword [ebp - 0x2050], esi
mov dword [ebp - 0x2044], 0x400
xor eax, eax
mov word [ebp - 0x1018], ax
push 0x7fe
push esi
lea eax, [ebp - 0x1016]
push eax
call fcn.0057e5e0
add esp, 0xc
lea eax, [ebp - 0x2044]
push eax
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x2050]
push eax
push 0x67b494
push 0x67b49c
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4564b6
mov eax, dword [ebp - 0x2044]
cmp eax, esi
je 0x4564b6
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x1018], cx
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x203c]
push eax
call fcn.00474d20
pop ecx
pop ecx
mov byte [ebp - 4], 0x86
lea esi, [ebp - 0x203c]
call fcn.004084ab
push ecx
mov esi, esp
mov dword [ebp - 0x204c], esp
push eax
call fcn.00401019
mov byte [ebp - 4], 0x87
push 0x67b4c0
push 0x67b4c8
mov byte [ebp - 4], 0x86
call fcn.00401aba
mov byte [ebp - 0x203d], 1
mov byte [ebp - 4], 0x7f
lea ecx, [ebp - 0x203c]
call fcn.00408418
xor esi, esi
mov dword [ebp - 0x2050], esi
mov dword [ebp - 0x2044], 0x400
lea eax, [ebp - 0x2044]
push eax
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x2050]
push eax
push 0x67b4d0
push 0x67b4d8
push edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x45655f
mov eax, dword [ebp - 0x2044]
cmp eax, esi
je 0x45655f
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x1018], cx
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x203c]
push eax
call fcn.00474d20
mov byte [ebp - 4], 0x88
mov eax, dword [eax]
add esp, 4
mov esi, esp
mov dword [ebp - 0x204c], esp
push eax
call fcn.00401019
mov byte [ebp - 4], 0x89
push 0x67b4fc
push 0x67b504
mov byte [ebp - 4], 0x88
call fcn.00401aba
mov byte [ebp - 4], 0x7f
lea ecx, [ebp - 0x203c]
call fcn.00408418
mov byte [ebp - 0x203d], 1
xor esi, esi
mov dword [ebp - 0x2048], ebx
mov dword [ebp - 0x2050], esi
mov dword [ebp - 0x2044], 4
lea eax, [ebp - 0x2044]
push eax
lea eax, [ebp - 0x2048]
push eax
lea eax, [ebp - 0x2050]
push eax
push 0x67b50c
push 0x67b514
push edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0x2048], ebx
je 0x456719
cmp dword [ebp - 0x2048], 1
jne 0x4566fc
push esi
push 0x67b538
push 0x67b544
call fcn.00401924
xor eax, eax
mov word [ebp - 0x1818], ax
push 0x7fe
push esi
lea eax, [ebp - 0x1816]
push eax
call fcn.0057e5e0
add esp, 0xc
mov dword [ebp - 0x2050], esi
mov dword [ebp - 0x2044], 0x400
lea eax, [ebp - 0x2044]
push eax
lea eax, [ebp - 0x1818]
push eax
lea eax, [ebp - 0x2050]
push eax
push 0x67b54c
push 0x67b554
push edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x45668d
mov eax, dword [ebp - 0x2044]
cmp eax, esi
je 0x45668d
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x1818], cx
lea eax, [ebp - 0x1818]
push eax
lea eax, [ebp - 0x203c]
push eax
call fcn.00474d20
pop ecx
pop ecx
mov byte [ebp - 4], 0x8a
lea esi, [ebp - 0x203c]
call fcn.004084ab
push ecx
mov esi, esp
mov dword [ebp - 0x204c], esp
push eax
call fcn.00401019
mov byte [ebp - 4], 0x8b
push 0x67b578
push 0x67b584
mov byte [ebp - 4], 0x8a
call fcn.00401aba
mov byte [ebp - 4], 0x7f
lea ecx, [ebp - 0x203c]
call fcn.00408418
xor esi, esi
mov dword [ebp - 0x2050], esi
mov dword [ebp - 0x2044], 0x400
lea eax, [ebp - 0x2044]
push eax
lea eax, [ebp - 0x1818]
push eax
lea eax, [ebp - 0x2050]
push eax
push 0x67b58c
push 0x67b594
push edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x45670d
mov eax, dword [ebp - 0x2044]
cmp eax, esi
je 0x45670d
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x1818], cx
lea eax, [ebp - 0x1818]
push eax
call fcn.00579d57
pop ecx
push eax
push 0x67b5b8
push 0x67b5c4
call fcn.00401849
jmp 0x45670d
push 1
push 0x67b5cc
push 0x67b5d8
call fcn.00401924
push str.Softwarepchiktmp
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp byte [ebp - 0x203d], 0
jne 0x45672a
cmp dword [ebp - 0x2048], ebx
je 0x45672f
call fcn.00401cbc
mov ecx, dword [ebp - 0x2054]
call fcn.004650e8
mov ecx, dword [ebp - 0x2054]
call fcn.004654ef
call fcn.00468811
push esi
push esi
xor esi, esi
inc esi
call fcn.00456e95
pop ecx
pop ecx
xor esi, esi
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push 0x67b604
push eax
call fcn.00408518
mov byte [ebp - 4], 0x8c
mov byte [ebp - 4], 0x7f
call fcn.0042d522
cmp eax, 1
jne 0x456785
push eax
call fcn.0045727a
lea eax, [ebp - 0x2038]
push eax
call fcn.0040f899
mov byte [ebp - 4], 0x8d
push esi
lea ecx, [ebp - 0x2038]
call fcn.00410181
mov edi, dword [ebp - 0x2054]
test al, al
je 0x4567ca
lea eax, [edi + 0xd0]
push eax
lea eax, [ebp - 0x2038]
push eax
call fcn.00411b09
lea eax, [ebp - 0x2038]
push eax
call fcn.004125df
mov byte [ebp - 4], 0x7f
lea eax, [ebp - 0x2038]
push eax
call fcn.0040f8c5
push 0x20
call fcn.00579757
pop ecx
mov dword [ebp - 0x203c], eax
mov byte [ebp - 4], 0x8e
cmp eax, esi
je 0x4567f8
push eax
call fcn.0040f899
jmp 0x4567fa
xor eax, eax
mov byte [ebp - 4], 0x7f
mov dword [0x6df494], eax
push esi
mov ecx, eax
call fcn.00410181
mov ecx, edi
call fcn.00460fb5
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.USBPassword
push eax
call fcn.00408518
mov byte [ebp - 4], 0x8f
mov byte [ebp - 4], 0x7f
call fcn.0042d522
mov dword [edi + 0xcc], eax
push esi
push esi
push edi
push 0x456d92
push esi
push esi
call fcn.0057b57b
push esi
push esi
push edi
push 0x456bb2
push esi
push esi
call fcn.0057b57b
push esi
push esi
push edi
push 0x456980
push esi
push esi
call fcn.0057b57b
add esp, 0x48
mov edi, 0x6df220
mov ecx, edi
call fcn.00449fcd
call fcn.00424f55
push esi
push esi
push edi
push 0x44a19d
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x6df284], eax
call fcn.004315de
call fcn.00431181
call fcn.00431446
call fcn.00431149
mov byte [ebp - 4], 0x7b
lea ecx, [ebp - 0x2064]
call fcn.00408559
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x2058]
call fcn.00408559
mov dword [ebp - 4], 0x1f
jmp 0x4568f8
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2054]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005796dc
leave
ret