Function at 0x431500
Capabilities:
Contain obfuscated stackstrings
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Encode data using xor
Hash data using fnv
Read file on windows
Self delete

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448cf1
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x1328
call fcn.00445a10
mov eax, dword [0x467040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 1
push str.___A_Za_z_:___r_n__._dllexebatjarvbs__b
lea ecx, [ebp - 0x1248]
call fcn.004176e0
mov edx, esi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10a8]
call fcn.00412ce0
push 0xe
push str.memory.exe__p
push ecx
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00415940
mov dword [ebp - 0x1080], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x1090], xmm0
mov dword [ebp - 0x107c], 0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x1090], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1080], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1094]
cmp ecx, 7
jbe 0x431615
mov edx, dword [ebp - 0x10a8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43160b
mov edx, dword ds:[eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x43160b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00444ae8
add esp, 8
xor eax, eax
mov dword [ebp - 0x1098], 0
push eax
mov word [ebp - 0x10a8], ax
mov dword [ebp - 0x11e8], eax
lea eax, [ebp - 0x11ec]
push eax
lea eax, [ebp - 0x11a8]
mov dword [ebp - 0x1094], 7
push eax
lea eax, [ebp - 0x119c]
mov dword [ebp - 0x11ec], 0xc
push eax
mov dword [ebp - 0x11e4], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push 0
push 1
push dword [ebp - 0x119c]
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 0x40
lea eax, [ebp - 0x128c]
mov dword [ebp - 0x1290], 0x44
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 0x11a8]
lea ecx, [ebp - 0x1234]
or dword [ebp - 0x1264], 0x101
add esp, 0xc
mov dword [ebp - 0x1254], eax
xor eax, eax
cmp dword [ebp - 0x107c], 7
mov word [ebp - 0x1260], ax
lea eax, [ebp - 0x1090]
cmova eax, dword [ebp - 0x1090]
push ecx
lea ecx, [ebp - 0x1290]
push ecx
push 0
push 0
push 0x10
push 1
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4327a8
push dword [ebp - 0x11a8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1000
lea eax, [ebp - 0x1018]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov dword [ebp - 0x1068], 0
movups xmmword [ebp - 0x1078], xmm0
add esp, 0xc
mov dword [ebp - 0x1064], 0xf
mov byte [ebp - 0x1078], 0
mov byte [ebp - 4], 4
push 0x20
mov dword [ebp - 0x11d8], 0
call fcn.00444ab3
mov esi, eax
add esp, 4
mov dword [ebp - 0x11a0], esi
mov dword [ebp - 0x11dc], esi
mov dword [esi], esi
mov dword [esi + 4], esi
mov dword [ebp - 0x11d4], 0
mov dword [ebp - 0x11d0], 0
mov dword [ebp - 0x11cc], 0
mov byte [ebp - 4], 6
push 0x40
mov dword [ebp - 0x11c8], 7
mov dword [ebp - 0x11c4], 8
mov dword [ebp - 0x11e0], 0x3f800000
call fcn.00444ab3
add esp, 4
mov dword [ebp - 0x11b0], eax
mov dword [ebp - 0x11d4], eax
mov ecx, eax
lea edx, [eax + 0x40]
mov dword [ebp - 0x11d0], edx
mov dword [ebp - 0x11cc], edx
cmp eax, edx
je 0x4317d9
mov dword [ecx], esi
add ecx, 4
cmp ecx, edx
jne 0x4317d0
push 0
lea eax, [ebp - 0x11ac]
mov byte [ebp - 4], 7
push eax
push 0x1000
lea eax, [ebp - 0x1018]
push eax
push dword [ebp - 0x119c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
nop
test eax, eax
je 0x432731
nop dword [eax + eax]
mov eax, dword [ebp - 0x11ac]
test eax, eax
je 0x432731
push eax
lea eax, [ebp - 0x1018]
mov dword [ebp - 0x1098], 0
xorps xmm0, xmm0
mov dword [ebp - 0x1094], 0
push eax
lea ecx, [ebp - 0x10a8]
movups xmmword [ebp - 0x10a8], xmm0
call fcn.00406720
sub esp, 8
mov byte [ebp - 4], 8
lea eax, [ebp - 0x10a8]
lea ecx, [ebp - 0x1338]
push eax
call fcn.0042a5a0
xorps xmm0, xmm0
mov dword [ebp - 0x1020], 0
movups xmmword [ebp - 0x1030], xmm0
mov dword [ebp - 0x101c], 0xf
mov byte [ebp - 0x1030], 0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1338]
mov eax, dword [ebp - 0x1338]
push 0xa
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_char___thiscall_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const]
movzx eax, al
lea edx, [ebp - 0x1030]
push eax
lea ecx, [ebp - 0x1338]
call fcn.0040db00
add esp, 4
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::operator_bool_void_const]
test al, al
je 0x43261d
nop word [eax + eax]
cmp dword ds:[ebp - 0x101c], 0xf
lea ecx, [ebp - 0x1030]
mov esi, dword [ebp - 0x1030]
lea edi, [ebp - 0x1030]
mov edx, dword [ebp - 0x1020]
cmova ecx, esi
seta al
mov dword [ebp - 0x1190], esi
add ecx, edx
mov dword [ebp - 0x1188], edx
test al, al
cmovne edi, esi
mov dword [ebp - 0x118c], edi
cmp edi, ecx
je 0x43195a
mov esi, ecx
movzx eax, byte [edi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
add esp, 4
test eax, eax
je 0x43193c
inc edi
cmp edi, esi
jne 0x431926
mov edx, dword [ebp - 0x1020]
mov esi, dword [ebp - 0x1030]
mov dword [ebp - 0x118c], edi
mov dword [ebp - 0x1188], edx
mov dword [ebp - 0x1190], esi
cmp dword [ebp - 0x101c], 0xf
lea eax, [ebp - 0x1030]
cmova eax, esi
seta cl
mov dword [ebp - 0x1194], eax
test cl, cl
lea eax, [ebp - 0x1030]
cmovne eax, esi
lea esi, [edx + eax]
cmp esi, dword [ebp - 0x1194]
je 0x4319d5
mov edi, dword [ebp - 0x1194]
nop
lea eax, ds:[esi - 1]
mov dword [ebp - 0x1194], eax
movzx eax, byte [eax]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
add esp, 4
test eax, eax
je 0x4319b7
mov esi, dword [ebp - 0x1194]
cmp esi, edi
jne 0x431990
mov edx, dword [ebp - 0x1020]
mov eax, dword [ebp - 0x1030]
mov edi, dword [ebp - 0x118c]
mov dword [ebp - 0x1188], edx
mov dword [ebp - 0x1190], eax
cmp dword [ebp - 0x101c], 0xf
lea eax, [ebp - 0x1030]
cmova eax, dword [ebp - 0x1190]
seta cl
add edx, eax
lea eax, [ebp - 0x1030]
sub edx, esi
test cl, cl
mov ecx, esi
mov esi, dword [ebp - 0x1188]
je 0x431a19
sub ecx, dword [ebp - 0x1190]
mov eax, esi
sub eax, ecx
cmp eax, edx
cmovb edx, eax
mov eax, dword [ebp - 0x1190]
jmp 0x431a2a
sub ecx, eax
mov eax, esi
sub eax, ecx
cmp eax, edx
cmovb edx, eax
lea eax, [ebp - 0x1030]
mov dword [ebp - 0x1194], edx
lea edx, [ecx + eax]
mov eax, dword [ebp - 0x1194]
sub esi, eax
mov dword [ebp - 0x118c], ecx
add eax, edx
mov ecx, esi
sub ecx, dword [ebp - 0x118c]
inc ecx
push ecx
push eax
push edx
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp - 0x1030]
lea edx, [ebp - 0x1030]
add esp, 0xc
mov dword [ebp - 0x1020], esi
cmp dword [ebp - 0x101c], 0xf
mov dword [ebp - 0x118c], eax
seta cl
cmova edx, eax
test cl, cl
mov ecx, edx
je 0x431a97
sub ecx, eax
sub edi, edx
mov eax, esi
sub eax, ecx
cmp eax, edi
cmovb edi, eax
mov eax, dword [ebp - 0x118c]
jmp 0x431ab0
lea eax, [ebp - 0x1030]
sub edi, edx
sub ecx, eax
mov eax, esi
sub eax, ecx
cmp eax, edi
cmovb edi, eax
lea eax, [ebp - 0x1030]
lea edx, [eax + ecx]
mov dword [ebp - 0x1194], ecx
sub esi, edi
lea eax, [edx + edi]
mov ecx, esi
sub ecx, dword [ebp - 0x1194]
inc ecx
push ecx
push eax
push edx
call sub.VCRUNTIME140.dll_memmove
xorps xmm0, xmm0
mov dword [ebp - 0x1020], esi
movups xmmword [ebp - 0x1180], xmm0
mov dword [ebp - 0x1170], 4
mov dword [ebp - 0x116c], 0xf
mov dword [ebp - 0x1180], 0x6578652e
mov byte [ebp - 0x117c], 0
movups xmmword [ebp - 0x1168], xmm0
mov dword [ebp - 0x1158], 4
mov dword [ebp - 0x1154], 0xf
mov dword [ebp - 0x1168], 0x6c6c642e
mov byte [ebp - 0x1164], 0
movups xmmword [ebp - 0x1150], xmm0
mov dword [ebp - 0x1140], 4
mov dword [ebp - 0x113c], 0xf
mov dword [ebp - 0x1150], 0x7461622e
mov byte [ebp - 0x114c], 0
movups xmmword [ebp - 0x1138], xmm0
mov dword [ebp - 0x1128], 4
mov dword [ebp - 0x1124], 0xf
mov dword [ebp - 0x1138], 0x7362762e
mov byte [ebp - 0x1134], 0
movups xmmword [ebp - 0x1120], xmm0
mov dword [ebp - 0x1110], 4
mov dword [ebp - 0x110c], 0xf
mov dword [ebp - 0x1120], 0x72616a2e
mov byte [ebp - 0x111c], 0
movups xmmword [ebp - 0x1108], xmm0
mov dword [ebp - 0x10f8], 4
mov dword [ebp - 0x10f4], 0xf
mov dword [ebp - 0x1108], 0x3173702e
mov byte [ebp - 0x1104], 0
movzx eax, word [0x4574e0]
movups xmmword [ebp - 0x10f0], xmm0
mov word [ebp - 0x10f0], ax
mov al, byte [0x4574e2]
mov dword [ebp - 0x10e0], 3
mov dword [ebp - 0x10dc], 0xf
mov byte [ebp - 0x10ee], al
mov byte [ebp - 0x10ed], 0
movzx eax, word [0x4574e4]
movups xmmword [ebp - 0x10d8], xmm0
mov word [ebp - 0x10d8], ax
mov al, byte [0x4574e6]
mov dword [ebp - 0x10c8], 3
mov dword [ebp - 0x10c4], 0xf
mov byte [ebp - 0x10d6], al
mov byte [ebp - 0x10d5], 0
add esp, 8
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x10c0]
lea ecx, [ebp - 0x11c0]
push eax
lea eax, [ebp - 0x1180]
push eax
call fcn.00426f20
push 0x4059a0
push 8
mov byte [ebp - 4], 0x14
push 0x18
lea eax, [ebp - 0x1180]
push eax
call fcn.00444e54
mov eax, dword [ebp - 0x101c]
lea ecx, [ebp - 0x1030]
mov esi, dword [ebp - 0x1030]
cmp eax, 0xf
mov edi, dword [ebp - 0x1020]
cmova ecx, esi
mov dword [ebp - 0x1190], eax
seta byte [ebp - 0x1181]
mov dword [ebp - 0x1188], esi
mov dword [ebp - 0x1194], ecx
test edi, edi
je 0x431ce4
push edi
push 0x3a
push ecx
call sub.VCRUNTIME140.dll_memchr
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x431ce4
sub ecx, dword [ebp - 0x1194]
jmp 0x431ce7
or ecx, 0xffffffff
cmp byte [ebp - 0x1181], 0
lea edx, [ebp - 0x1030]
mov dword [ebp - 0x1194], ecx
cmovne edx, esi
mov dword [ebp - 0x118c], edx
cmp ecx, edi
jae 0x431d2c
mov eax, edi
sub eax, ecx
push eax
lea eax, [edx + ecx]
push 0x5c
push eax
lfence
call sub.VCRUNTIME140.dll_memchr
add esp, 0xc
test eax, eax
je 0x431d2c
sub eax, dword [ebp - 0x118c]
jmp 0x431d2f
or eax, 0xffffffff
cmp dword [ebp - 0x1194], 0xffffffff
je 0x431fba
nop dword [eax]
cmp eax, 0xffffffff
je 0x431fba
cmp dword [ebp - 0x1064], 0xf
lea eax, [ebp - 0x1078]
mov ecx, dword [ebp - 0x1068]
mov esi, 1
cmova eax, dword [ebp - 0x1078]
mov edx, 0x457518
cmp ecx, esi
jb 0x431ddf
sub ecx, esi
lfence
mov al, byte [ecx + eax]
cmp al, byte [edx]
je 0x431d83
sbb eax, eax
or eax, esi
jmp 0x431d85
xor eax, eax
test eax, eax
sete al
test al, al
je 0x431ddf
mov esi, dword [ebp - 0x11c0]
cmp esi, dword [ebp - 0x11bc]
je 0x431ddf
nop dword [eax]
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x431daa
mov eax, dword [esi]
cmp dword [ebp - 0x1190], 0xf
lea ecx, [ebp - 0x1030]
push dword [esi + 0x10]
cmova ecx, dword [ebp - 0x1188]
mov edx, edi
push eax
call fcn.0041cee0
add esp, 8
test al, al
jne 0x431ef0
add esi, 0x18
cmp esi, dword [ebp - 0x11bc]
jne 0x431da0
mov edx, dword [ebp - 0x1188]
mov ecx, dword [ebp - 0x1190]
xorps xmm0, xmm0
mov dword [ebp - 0x1224], 0
mov byte [ebp - 0x1220], 0
movups xmmword [ebp - 0x121c], xmm0
mov dword [ebp - 0x120c], 0
mov byte [ebp - 0x1208], 0
mov dword [ebp - 0x1204], 0
mov dword [ebp - 0x1200], 0
mov byte [ebp - 0x11fc], 0
mov dword [ebp - 0x11f8], 0
mov dword [ebp - 0x11f4], 0
mov byte [ebp - 0x11f0], 0
mov byte [ebp - 4], 0x15
test edi, edi
je 0x432549
cmp ecx, 0xf
lea eax, [ebp - 0x1030]
mov esi, 0x811c9dc5
cmova eax, edx
seta byte [ebp - 0x1181]
xor ecx, ecx
mov dword [ebp - 0x1194], eax
test edi, edi
je 0x431e97
mov edx, eax
nop
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x431e80
mov edx, dword [ebp - 0x1188]
mov ecx, dword [ebp - 0x11b0]
mov eax, 7
and eax, esi
mov esi, dword [ecx + eax*8 + 4]
cmp esi, dword [ebp - 0x11a0]
jne 0x431fc5
xor esi, esi
mov eax, dword [ebp - 0x11a0]
test esi, esi
cmovne eax, esi
cmp eax, dword [ebp - 0x11a0]
jne 0x432549
cmp byte ds:[ebp - 0x1181], 0
lea esi, [ebp - 0x1030]
je 0x432031
mov eax, edx
lea ecx, [edi + edx]
jmp 0x432041
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.____Detected_file_executed_with_special_characters.
nop dword [eax + eax]
call fcn.0040af60
push 0x40d840
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.____Line_1:
nop dword [eax]
call fcn.0040af60
cmp dword [ebp - 0x1064], 0xf
lea edx, [ebp - 0x1078]
push dword [ebp - 0x1068]
cmova edx, dword [ebp - 0x1078]
mov ecx, eax
call fcn.0040dd00
add esp, 4
mov ecx, eax
push 0x40d840
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.____Line_2:
call fcn.0040af60
cmp dword [ebp - 0x101c], 0xf
lea edx, [ebp - 0x1030]
push dword [ebp - 0x1020]
cmova edx, dword [ebp - 0x1030]
mov ecx, eax
call fcn.0040dd00
add esp, 4
mov ecx, eax
push 0x40d840
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [ebp - 0x101c]
mov edx, dword [ebp - 0x1030]
mov edi, dword [ebp - 0x1020]
mov dword [ebp - 0x1190], ecx
mov dword [ebp - 0x1188], edx
jmp 0x431deb
mov edx, esi
jmp 0x431de5
mov eax, dword [ecx + eax*8]
mov dword [ebp - 0x118c], eax
nop
cmp dword [esi + 0x1c], 0xf
lea eax, [esi + 8]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x1194], ecx
jbe 0x431fe4
mov eax, dword [eax]
cmp byte ds:[ebp - 0x1181], 0
lea ecx, [ebp - 0x1030]
push dword [ebp - 0x1194]
cmovne ecx, edx
mov edx, edi
push eax
call fcn.0041cee0
mov edx, dword [ebp - 0x1188]
add esp, 8
test al, al
jne 0x431eb6
nop word [eax + eax]
cmp esi, dword [ebp - 0x118c]
je 0x431eb4
mov esi, dword [esi + 4]
jmp 0x431fd0
lea ecx, [ebp - 0x1030]
mov edx, esi
add ecx, edi
lea eax, [ebp - 0x1030]
push edx
push ecx
push ecx
push eax
lea edx, [ebp - 0x1248]
lea ecx, [ebp - 0x1224]
call fcn.00432a00
mov esi, dword ds:[ebp - 0x121c]
add esp, 0x10
test al, al
je 0x432529
mov ecx, dword [ebp - 0x1218]
mov eax, 0x2aaaaaab
sub ecx, esi
mov dword [ebp - 0x11a4], esi
imul ecx
lea ecx, [ebp - 0x11f8]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmovne ecx, esi
cmp byte [ecx + 8], 0
je 0x4320a2
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x1194], ecx
jmp 0x4320a6
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x1050], 0
xorps xmm0, xmm0
mov dword [ebp - 0x104c], 0
movups xmmword [ebp - 0x1060], xmm0
cmp eax, ecx
jne 0x4320e3
xor edx, edx
mov esi, 0xf
mov dword [ebp - 0x1050], edx
mov dword [ebp - 0x104c], esi
mov byte [ebp - 0x1060], dl
jmp 0x4320fe
sub ecx, eax
push ecx
push eax
lea ecx, [ebp - 0x1060]
call fcn.00406720
mov esi, dword [ebp - 0x104c]
mov edx, dword [ebp - 0x1050]
mov edi, dword [ebp - 0x1060]
lea eax, [ebp - 0x1060]
cmp esi, 0xf
cmova eax, edi
seta cl
add eax, edx
mov dword [ebp - 0x118c], eax
lea eax, [ebp - 0x1060]
test cl, cl
je 0x43212a
lea esi, [edx + edi]
jmp 0x432133
lea esi, [edx + eax]
lea edi, [ebp - 0x1060]
push 0x22
push esi
push edi
call fcn.004445b0
mov edi, eax
cmp eax, esi
je 0x43215f
inc eax
cmp eax, esi
je 0x43215f
nop dword [eax]
mov cl, byte [eax]
cmp cl, 0x22
je 0x43215a
mov byte [edi], cl
inc edi
inc eax
cmp eax, esi
jne 0x432150
cmp dword [ebp - 0x104c], 0xf
lea ecx, [ebp - 0x1060]
mov esi, edi
lea edx, [ebp - 0x1060]
cmova ecx, dword [ebp - 0x1060]
seta byte [ebp - 0x1181]
sub esi, ecx
mov ecx, dword [ebp - 0x118c]
sub ecx, edi
mov edi, dword [ebp - 0x1050]
mov eax, edi
sub eax, esi
cmp eax, ecx
cmovb ecx, eax
cmp byte [ebp - 0x1181], 0
mov dword [ebp - 0x118c], ecx
cmovne edx, dword [ebp - 0x1060]
sub edi, ecx
mov eax, dword [ebp - 0x118c]
mov ecx, edi
sub ecx, esi
add edx, esi
inc ecx
add eax, edx
push ecx
push eax
push edx
call sub.VCRUNTIME140.dll_memmove
xorps xmm0, xmm0
mov dword [ebp - 0x1050], edi
xor eax, eax
mov dword [ebp - 0x1038], 0
movups xmmword [ebp - 0x1048], xmm0
add esp, 0xc
mov dword [ebp - 0x1034], 7
mov word [ebp - 0x1048], ax
push 0
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0x1060]
cmp dword [ebp - 0x104c], 0xf
push 0
cmova eax, dword [ebp - 0x1060]
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x118c], eax
test eax, eax
jle 0x43230f
lfence
mov esi, dword [ebp - 0x1038]
lea ecx, [eax - 1]
cmp ecx, esi
ja 0x432266
cmp dword [ebp - 0x1034], 7
lea eax, [ebp - 0x1048]
mov dword [ebp - 0x1038], ecx
cmova eax, dword [ebp - 0x1048]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x4322d0
mov edi, dword [ebp - 0x1034]
mov edx, ecx
mov eax, edi
sub edx, esi
sub eax, esi
cmp edx, eax
ja 0x4322b9
cmp edi, 7
mov dword [ebp - 0x1038], ecx
lea eax, [ebp - 0x1048]
cmova eax, dword [ebp - 0x1048]
mov dword [ebp - 0x1194], eax
lea edi, [eax + esi*2]
test edx, edx
je 0x4322a8
xor eax, eax
mov ecx, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov ecx, dword [ebp - 0x1194]
lea eax, [esi + edx]
xor edx, edx
mov word [ecx + eax*2], dx
jmp 0x4322d0
push ecx
push edx
push dword [ebp - 0x11a4]
lea ecx, [ebp - 0x1048]
push edx
lfence
call fcn.0040d9a0
push dword [ebp - 0x118c]
cmp dword [ebp - 0x1034], 7
lea ecx, [ebp - 0x1048]
lea eax, [ebp - 0x1060]
cmova ecx, dword [ebp - 0x1048]
cmp dword [ebp - 0x104c], 0xf
push ecx
cmova eax, dword [ebp - 0x1060]
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp dword [ebp - 0x1034], 7
lea eax, [ebp - 0x1048]
push dword [ebp - 0x1038]
cmova eax, dword [ebp - 0x1048]
push eax
call fcn.00404f40
add esp, 8
test al, al
jne 0x432445
mov byte [ebp - 0x11b4], al
lea edx, [ebp - 0x1048]
push dword [ebp - 0x11b4]
lea ecx, [ebp - 0x10c0]
call fcn.00406dc0
add esp, 4
lea ecx, [ebp - 0x10c0]
mov byte [ebp - 4], 0x18
call fcn.00404e80
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x10ac]
mov byte [ebp - 0x1181], al
cmp ecx, 7
jbe 0x4323b9
mov edx, dword [ebp - 0x10c0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4323a9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x431605
push ecx
push edx
call fcn.00444ae8
mov al, byte [ebp - 0x1181]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x10b0], 0
mov dword [ebp - 0x10ac], 7
mov word [ebp - 0x10c0], cx
test al, al
je 0x4323f1
lea eax, [ebp - 0x1048]
push eax
call fcn.00443080
test al, al
jne 0x432436
mov edx, str.___Executed__Unsigned_file:
jmp 0x4323f6
mov edx, str.___Executed__Deleted_file:
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
nop dword [eax]
call fcn.00408320
cmp dword [ebp - 0x1034], 7
lea edx, [ebp - 0x1048]
push dword [ebp - 0x1038]
cmova edx, dword [ebp - 0x1048]
mov ecx, eax
call fcn.00408f60
add esp, 4
mov ecx, eax
push 0x408660
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
lea ecx, ds:[ebp - 0x1048]
call fcn.00404f20
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x1034]
cmp ecx, 7
jbe 0x432489
mov edx, dword [ebp - 0x1048]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43247f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x431605
push ecx
push edx
call fcn.00444ae8
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x104c]
mov dword [ebp - 0x1038], 0
mov dword [ebp - 0x1034], 7
mov word [ebp - 0x1048], ax
cmp ecx, 0xf
jbe 0x4324e8
mov edx, dword ds:[ebp - 0x1060]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4324dc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x431605
push ecx
push edx
call fcn.00444ae8
add esp, 8
mov eax, dword [ebp - 0x101c]
mov edi, dword [ebp - 0x1020]
mov esi, dword [ebp - 0x11a4]
mov dword [ebp - 0x1190], eax
mov eax, dword [ebp - 0x1030]
mov dword [ebp - 0x1050], 0
mov dword [ebp - 0x104c], 0xf
mov byte [ebp - 0x1060], 0
mov dword [ebp - 0x1188], eax
jmp 0x43254f
mov eax, dword [ebp - 0x101c]
mov edi, dword [ebp - 0x1020]
mov dword [ebp - 0x1190], eax
mov eax, dword [ebp - 0x1030]
mov dword [ebp - 0x1188], eax
jmp 0x43254f
mov esi, dword [ebp - 0x121c]
cmp dword [ebp - 0x1190], 0xf
lea eax, [ebp - 0x1030]
push edi
cmova eax, dword [ebp - 0x1188]
lea ecx, [ebp - 0x1078]
push eax
call fcn.0041ab00
mov byte [ebp - 4], 0x14
test esi, esi
je 0x4325c8
mov ecx, dword ds:[ebp - 0x1214]
mov eax, 0x2aaaaaab
sub ecx, esi
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 2
cmp ecx, 0x1000
jb 0x4325bc
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x431605
push ecx
push esi
call fcn.00444ae8
add esp, 8
lea ecx, [ebp - 0x11c0]
mov byte [ebp - 4], 0xa
call fcn.0042a680
mov eax, dword [ebp - 0x1338]
lea ecx, [ebp - 0x1338]
push 0xa
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_char___thiscall_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const]
movzx eax, al
lea edx, [ebp - 0x1030]
push eax
lea ecx, [ebp - 0x1338]
call fcn.0040db00
add esp, 4
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::operator_bool_void_const]
test al, al
jne 0x4318e0
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x101c]
cmp ecx, 0xf
jbe 0x43265b
mov edx, dword [ebp - 0x1030]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x432651
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x431605
push ecx
push edx
call fcn.00444ae8
add esp, 8
mov eax, dword [ebp - 0x1338]
mov dword [ebp - 0x1020], 0
mov dword [ebp - 0x101c], 0xf
mov byte [ebp - 0x1030], 0
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istringstream_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_istringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebp - 0x1338]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ebp + ecx - 0x133c], eax
lea ecx, [ebp - 0x1328]
call fcn.0042ad20
lea ecx, [ebp - 0x1320]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_istream_char__struct_std::char_traits_char__::destructor_void_]
lea ecx, ds:[ebp - 0x12d8]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x1094]
cmp ecx, 0xf
jbe 0x432708
mov edx, dword ds:[ebp - 0x10a8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4326fc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x431605
push ecx
push edx
call fcn.00444ae8
add esp, 8
push 0
lea eax, [ebp - 0x11ac]
push eax
push 0x1000
lea eax, [ebp - 0x1018]
push eax
push dword [ebp - 0x119c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x431810
push 0xffffffffffffffff
push dword [ebp - 0x1234]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x1234]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x1230]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, ds:[ebp - 0x11e0]
call fcn.00432880
mov ecx, dword [ebp - 0x1064]
cmp ecx, 0xf
jbe 0x4327a8
mov edx, dword ds:[ebp - 0x1078]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43279e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x43279e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00444ae8
add esp, 8
push dword [ebp - 0x119c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x107c]
cmp ecx, 7
jbe 0x4327f6
mov edx, dword [ebp - 0x1090]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4327ec
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4327ec
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00444ae8
add esp, 8
xor eax, eax
mov dword [ebp - 0x1080], 0
lea ecx, [ebp - 0x1248]
mov dword [ebp - 0x107c], 7
mov word [ebp - 0x1090], ax
call fcn.00417bc0
mov edi, dword [ebp - 0x1238]
test edi, edi
je 0x432851
mov eax, dword [edi]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x44b694]
mov ecx, edi
call esi
mov edi, eax
test edi, edi
je 0x432851
mov ecx, dword [edi]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x44b694]
mov ecx, edi
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00444aa0
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret