Function at 0x4573b8
Capabilities:
Delete file

Disassembly:
push 0xa0
mov eax, 0x5beaa8
call fcn.00580e9e
and dword [ebp - 4], 0
and dword [ebp - 0x1c], 0
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call fcn.0040850b
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 2
call fcn.00456612
mov edi, eax
mov byte [ebp - 0x26], bl
test edi, edi
je 0x45747c
push dword [ebp + 0x10]
lea eax, [ebp - 0x24]
push eax
call fcn.00408561
mov byte [ebp - 4], 3
lea eax, [ebp - 0x24]
call fcn.004087b3
push str.protocolfilters.dll
xor ecx, ecx
lea esi, [ebp - 0x24]
call fcn.00426385
cmp eax, 0xffffffff
jne 0x457433
push str.nfapi.dll
xor ecx, ecx
call fcn.00426385
cmp eax, 0xffffffff
je 0x457437
mov byte [ebp - 0x26], 0
push 0x670fe8
xor ecx, ecx
lea esi, [ebp - 0x24]
call fcn.00426385
test eax, eax
jne 0x45744d
mov byte [ebp - 0x26], al
cmp byte [ebp - 0x26], 0
je 0x457466
lea eax, [ebp - 0x24]
push eax
mov ecx, edi
call fcn.0046105b
test al, al
je 0x457466
mov byte [ebp - 0x26], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.004085a2
cmp byte [ebp - 0x26], 0
je 0x4588cc
push 0
push 0
push 0x6b29fc
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x4574ed
push dword [ebp + 0x10]
lea eax, [ebp - 0x24]
push eax
call fcn.00408561
mov byte [ebp - 4], 4
lea eax, [ebp - 0x24]
call fcn.004087b3
push str.keygen
xor ecx, ecx
lea esi, [ebp - 0x24]
call fcn.00426385
cmp eax, 0xffffffff
jne 0x4574dd
push str.serial
xor ecx, ecx
call fcn.00426385
cmp eax, 0xffffffff
jne 0x4574dd
push str.crack
xor ecx, ecx
call fcn.00426385
cmp eax, 0xffffffff
je 0x4574e1
mov byte [ebp - 0x26], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.004085a2
cmp byte [ebp - 0x26], 0
je 0x4588cc
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x24]
add dword [edi + 0x38], eax
mov eax, dword [ebp + 0x28]
adc dword [edi + 0x3c], eax
lea eax, [ebp - 0x3c]
push eax
call fcn.004083f9
mov byte [ebp - 4], 5
mov eax, dword [ebp + 0x10]
call fcn.0046f190
mov dword [ebp - 0x64], eax
mov byte [ebp - 4], 6
cmp eax, 0xffffffff
je 0x458885
push eax
mov ebx, dword [0x6c8328]
call fcn.00472860
test al, al
jne 0x458885
cmp dword [edi + 0x18], 0x3e8
jne 0x457bd0
cmp byte [ebp + 0x30], al
jne 0x457bc3
push dword [ebp + 0x10]
lea eax, [ebp - 0x20]
push eax
call fcn.00408561
push 7
pop esi
mov byte [ebp - 4], 7
lea eax, [ebp - 0x20]
call fcn.004087b3
mov byte [ebp - 0x2d], 1
push str.:programdata
lea eax, [ebp - 0x34]
push eax
call fcn.00408561
mov byte [ebp - 4], 8
mov dword [ebp - 0x1c], 3
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x20]
call fcn.00471ba0
test al, al
jne 0x457621
push str.:program_files
lea eax, [ebp - 0x18]
push eax
call fcn.00408561
mov dword [ebp - 4], 9
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x20]
call fcn.00471ba0
test al, al
jne 0x457621
push str.:program_files__x86_
lea eax, [ebp - 0x2c]
push eax
call fcn.00408561
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x1c], 0xf
lea eax, [ebp - 0x2c]
lea edx, [ebp - 0x20]
call fcn.00471ba0
test al, al
jne 0x457621
push str.:windows_servicing
lea eax, [ebp - 0x24]
push eax
call fcn.00408561
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x1c], 0x1f
lea eax, [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00471ba0
test al, al
jne 0x457621
xor bl, bl
jmp 0x457623
mov bl, 1
mov dword [ebp - 4], 0xa
test byte [ebp - 0x1c], 0x10
je 0x45763c
and dword [ebp - 0x1c], 0xffffffef
lea ecx, [ebp - 0x24]
call fcn.004085a2
mov dword [ebp - 4], 9
test byte [ebp - 0x1c], 8
je 0x457655
and dword [ebp - 0x1c], 0xfffffff7
lea ecx, [ebp - 0x2c]
call fcn.004085a2
mov dword [ebp - 4], 8
test byte [ebp - 0x1c], 4
je 0x45766e
and dword [ebp - 0x1c], 0xfffffffb
lea ecx, [ebp - 0x18]
call fcn.004085a2
mov dword [ebp - 4], esi
test byte [ebp - 0x1c], 2
je 0x457683
and dword [ebp - 0x1c], 0xfffffffd
lea ecx, [ebp - 0x34]
call fcn.004085a2
test bl, bl
jne 0x4576fb
mov eax, dword [0x6b29d4]
shl eax, 0x14
cdq
mov ebx, eax
mov esi, edx
push ecx
mov eax, esp
mov dword [ebp - 0x50], esp
lea ecx, [ebp - 0x20]
push ecx
push eax
call fcn.00408532
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 7
call fcn.00424267
pop ecx
cmp edx, esi
jl 0x4576bc
jg 0x4576fb
cmp eax, ebx
ja 0x4576fb
cmp dword [0x6b29d8], 0
je 0x4576ff
push str.keygen
xor ecx, ecx
lea esi, [ebp - 0x20]
call fcn.00426385
cmp eax, 0xffffffff
jne 0x4576fb
push str.serial
xor ecx, ecx
call fcn.00426385
cmp eax, 0xffffffff
jne 0x4576fb
push str.crack
xor ecx, ecx
call fcn.00426385
cmp eax, 0xffffffff
je 0x4576ff
mov byte [ebp - 0x2d], 0
push str.hp_
xor ecx, ecx
lea esi, [ebp - 0x20]
call fcn.00426385
or ebx, 0xffffffff
cmp eax, ebx
jne 0x457755
push str.laserjet
xor ecx, ecx
call fcn.00426385
cmp eax, ebx
jne 0x457755
push str.printer
xor ecx, ecx
call fcn.00426385
cmp eax, ebx
jne 0x457755
push str.scanner
xor ecx, ecx
call fcn.00426385
cmp eax, ebx
jne 0x457755
push str._mfp
xor ecx, ecx
call fcn.00426385
cmp eax, ebx
je 0x457759
mov byte [ebp - 0x2d], 0
cmp byte [ebp - 0x2d], 0
je 0x457bb7
push 0x2e
lea esi, [ebp - 0x20]
call fcn.004263d2
cmp eax, ebx
je 0x457bb7
lea ecx, [eax + 1]
lea eax, [ebp - 0x18]
push eax
mov edx, esi
call fcn.004264b1
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x18]
call fcn.004087b3
lea eax, [ebp - 0x24]
push eax
call fcn.0040850b
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00408532
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x2c]
push eax
mov ecx, 0x67b0b0
call fcn.00409d39
test eax, eax
je 0x4577db
lea eax, [ebp - 0x2c]
push eax
mov ecx, 0x67d668
call fcn.00409d39
test eax, eax
je 0x4577db
lea eax, [ebp - 0x2c]
call fcn.004263f0
jmp 0x4577e9
push 0x67d670
lea eax, [ebp - 0x2c]
push eax
call fcn.00408606
mov ebx, str.Malware.
cmp dword [0x6c8b4c], 1
jne 0x45785e
push ebx
lea eax, [ebp - 0x48]
push eax
call fcn.00408561
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x44]
push ecx
mov esi, eax
call fcn.004136d2
mov byte [ebp - 4], 0x11
push str..DeepDive
lea ecx, [ebp - 0x34]
push ecx
mov ecx, eax
call fcn.0040fc53
add esp, 0x10
mov byte [ebp - 4], 0x12
lea edi, [ebp - 0x24]
call fcn.004085c5
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x34]
call fcn.004085a2
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x44]
call fcn.004085a2
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x48]
call fcn.004085a2
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x24]
cmp dword [eax - 0xc], 0
jne 0x45792c
mov eax, 0x6c8f50
mov dword [ebp - 0x4c], eax
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x13
xor edi, edi
mov dword [ebp - 0xa0], edi
mov eax, dword [0x6c8f98]
sub eax, dword [0x6c8f94]
sar eax, 2
cmp edi, eax
jae 0x4578b4
mov esi, 0x6c8f88
call fcn.00413946
push dword [eax]
lea eax, [ebp - 0x18]
push eax
call fcn.00408642
test eax, eax
je 0x4578b8
inc edi
jmp 0x457880
xor al, al
je 0x45791c
push ebx
lea eax, [ebp - 0x34]
push eax
call fcn.00408561
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x44]
push ecx
mov esi, eax
call fcn.004136d2
mov byte [ebp - 4], 0x15
push str..DeepDive
lea ecx, [ebp - 0x48]
push ecx
mov ecx, eax
call fcn.0040fc53
add esp, 0x10
mov byte [ebp - 4], 0x16
lea edi, [ebp - 0x24]
call fcn.004085c5
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x48]
call fcn.004085a2
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x44]
call fcn.004085a2
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x34]
call fcn.004085a2
mov byte [ebp - 4], 0xf
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b0f4
call fcn.00409d39
test eax, eax
je 0x457a56
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b0fc
call fcn.00409d39
test eax, eax
je 0x457a56
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b104
call fcn.00409d39
test eax, eax
je 0x457a56
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b10c
call fcn.00409d39
test eax, eax
je 0x457a56
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b114
call fcn.00409d39
test eax, eax
je 0x457a56
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b11c
call fcn.00409d39
test eax, eax
je 0x457a56
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b124
call fcn.00409d39
test eax, eax
je 0x457a56
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b12c
call fcn.00409d39
test eax, eax
je 0x457a56
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b134
call fcn.00409d39
test eax, eax
je 0x457a56
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b13c
call fcn.00409d39
test eax, eax
je 0x457a56
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b144
call fcn.00409d39
test eax, eax
je 0x457a56
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b14c
call fcn.00409d39
test eax, eax
je 0x457a56
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b154
call fcn.00409d39
test eax, eax
je 0x457a56
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b15c
call fcn.00409d39
test eax, eax
je 0x457a56
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b164
call fcn.00409d39
test eax, eax
jne 0x457abd
push ebx
lea eax, [ebp - 0x44]
push eax
call fcn.00408561
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x48]
push ecx
mov esi, eax
call fcn.004136d2
mov byte [ebp - 4], 0x18
push str..DeepScript
lea ecx, [ebp - 0x4c]
push ecx
mov ecx, eax
call fcn.0040fc53
add esp, 0x10
mov byte [ebp - 4], 0x19
lea edi, [ebp - 0x24]
call fcn.004085c5
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x4c]
call fcn.004085a2
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x48]
call fcn.004085a2
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x44]
call fcn.004085a2
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x24]
cmp dword [eax - 0xc], 0
je 0x457b93
mov byte [ebp - 4], 0x1a
mov byte [ebp - 0x36], 0
mov byte [ebp - 0x35], 0
push dword [ebp + 0x10]
lea eax, [ebp - 0x4c]
push eax
call fcn.00408561
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x64]
call fcn.0042f095
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x4c]
call fcn.004085a2
cmp byte [ebp - 0x36], 0
jne 0x457b7a
cmp byte [ebp - 0x35], 0
jne 0x457b7a
push 0x1b7740
push dword [0x6c8c50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, 0x6c8e5c
mov dword [ebp - 0x50], esi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x1c
push 0x6c8e58
call fcn.00431f05
test al, al
je 0x457b6f
lea eax, [ebp - 0x20]
push eax
call fcn.00431dc5
test al, al
jne 0x457b6f
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b104
call fcn.00409d39
test eax, eax
jne 0x457b64
push dword [ebp - 0x20]
call fcn.004242ae
pop ecx
test al, al
je 0x457b6f
push dword [ebp - 0x24]
lea eax, [ebp - 0x3c]
call fcn.0041348d
mov byte [ebp - 4], 0x1a
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0xf
jmp 0x457b93
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2c]
call fcn.004085a2
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x24]
call fcn.004085a2
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x18]
call fcn.004085a2
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x20]
call fcn.004085a2
cmp dword [edi + 0x18], 0x3e8
je 0x458334
mov eax, dword [ebp - 0x3c]
cmp dword [eax - 0xc], 0
jne 0x458334
mov byte [ebp - 0x3d], 0
mov byte [ebp - 0x7c], 0
xor eax, eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
lea edi, [ebp - 0x94]
mov ebx, dword [ebp - 0x64]
lea esi, [ebp - 0x5c]
call fcn.0046f910
cmp byte [ebp - 0x50], 0
je 0x458334
cmp byte [ebp - 0x7c], 0
je 0x458334
mov edi, dword [ebp - 0x90]
cmp edi, dword [ebp - 0x80]
jb 0x457c44
ja 0x457c3c
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x84]
jbe 0x457c44
mov esi, dword [ebp - 0x94]
jmp 0x457c4d
mov esi, dword [ebp - 0x84]
mov edi, dword [ebp - 0x80]
lea eax, [ebp - 0x3c]
push eax
push edi
push esi
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push dword [ebp - 0x54]
call fcn.00485c70
test al, al
jne 0x458334
xor ebx, ebx
mov byte [ebp - 0x35], bl
push dword [ebp + 0x10]
lea eax, [ebp - 0x34]
push eax
call fcn.00408561
mov byte [ebp - 4], 0x1e
lea eax, [ebp - 0x35]
push eax
lea eax, [ebp - 0x3d]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
push 0xffffffffffffffff
push 0xffffffffffffffff
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x64]
call fcn.0042ddf0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x34]
call fcn.004085a2
push edi
push esi
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push dword [ebp - 0x54]
lea ecx, [ebp - 0x3c]
call fcn.00485b10
mov eax, dword [ebp - 0x3c]
cmp dword [eax - 0xc], ebx
jne 0x458334
cmp dword [0x6c8bf8], ebx
je 0x458334
push ebx
push ebx
push 0x6b2a24
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 1
jne 0x458334
mov esi, dword [ebp + 0xc]
add esi, 0x20
push esi
mov ecx, str.Quick
call fcn.00409d39
test eax, eax
je 0x457d10
push esi
mov ecx, str.Full
call fcn.00409d39
test eax, eax
jne 0x458334
cmp byte [ebp + 0x30], 0
jne 0x458334
push dword [ebp + 0x10]
lea eax, [ebp - 0x20]
push eax
call fcn.00408561
mov byte [ebp - 4], 0x1f
lea eax, [ebp - 0x20]
call fcn.004087b3
mov byte [ebp - 0x25], 1
push str.:programdata
lea eax, [ebp - 0x18]
push eax
call fcn.00408561
mov byte [ebp - 4], 0x20
or dword [ebp - 0x1c], 0x20
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x20]
call fcn.00471ba0
test al, al
jne 0x457de1
push str.:program_files
lea eax, [ebp - 0x2c]
push eax
call fcn.00408561
mov dword [ebp - 4], 0x21
or dword [ebp - 0x1c], 0x40
lea eax, [ebp - 0x2c]
lea edx, [ebp - 0x20]
call fcn.00471ba0
test al, al
jne 0x457de1
push str.:program_files__x86_
lea eax, [ebp - 0x24]
push eax
call fcn.00408561
mov dword [ebp - 4], 0x22
or dword [ebp - 0x1c], 0x80
lea eax, [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00471ba0
test al, al
jne 0x457de1
push str.:windows_servicing
lea eax, [ebp - 0x34]
push eax
call fcn.00408561
mov dword [ebp - 4], 0x23
or dword [ebp - 0x1c], 0x100
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x20]
call fcn.00471ba0
test al, al
jne 0x457de1
xor bl, bl
jmp 0x457de3
mov bl, 1
mov dword [ebp - 4], 0x22
test dword [ebp - 0x1c], 0x100
je 0x457e02
and dword [ebp - 0x1c], 0xfffffeff
lea ecx, [ebp - 0x34]
call fcn.004085a2
mov dword [ebp - 4], 0x21
test byte [ebp - 0x1c], 0x80
je 0x457e1e
and dword [ebp - 0x1c], 0xffffff7f
lea ecx, [ebp - 0x24]
call fcn.004085a2
mov dword [ebp - 4], 0x20
test byte [ebp - 0x1c], 0x40
je 0x457e37
and dword [ebp - 0x1c], 0xffffffbf
lea ecx, [ebp - 0x2c]
call fcn.004085a2
mov dword [ebp - 4], 0x1f
test byte [ebp - 0x1c], 0x20
je 0x457e50
and dword [ebp - 0x1c], 0xffffffdf
lea ecx, [ebp - 0x18]
call fcn.004085a2
test bl, bl
jne 0x457ec8
mov eax, dword [0x6b29d4]
shl eax, 0x14
cdq
mov edi, eax
mov esi, edx
push ecx
mov eax, esp
mov dword [ebp - 0x50], esp
lea ecx, [ebp - 0x20]
push ecx
push eax
call fcn.00408532
mov byte [ebp - 4], 0x24
mov byte [ebp - 4], 0x1f
call fcn.00424267
pop ecx
cmp edx, esi
jl 0x457e89
jg 0x457ec8
cmp eax, edi
ja 0x457ec8
cmp dword [0x6b29d8], 0
je 0x457ecc
push str.keygen
xor ecx, ecx
lea esi, [ebp - 0x20]
call fcn.00426385
cmp eax, 0xffffffff
jne 0x457ec8
push str.serial
xor ecx, ecx
call fcn.00426385
cmp eax, 0xffffffff
jne 0x457ec8
push str.crack
xor ecx, ecx
call fcn.00426385
cmp eax, 0xffffffff
je 0x457ecc
mov byte [ebp - 0x25], 0
push str.hp_
xor ecx, ecx
lea esi, [ebp - 0x20]
call fcn.00426385
or edi, 0xffffffff
cmp eax, edi
jne 0x457f22
push str.laserjet
xor ecx, ecx
call fcn.00426385
cmp eax, edi
jne 0x457f22
push str.printer
xor ecx, ecx
call fcn.00426385
cmp eax, edi
jne 0x457f22
push str.scanner
xor ecx, ecx
call fcn.00426385
cmp eax, edi
jne 0x457f22
push str._mfp
xor ecx, ecx
call fcn.00426385
cmp eax, edi
je 0x457f26
mov byte [ebp - 0x25], 0
cmp byte [ebp - 0x25], 0
je 0x458328
xor ebx, ebx
cmp dword [0x6b2a28], ebx
je 0x457f4a
lea eax, [ebp - 0x20]
push eax
call fcn.00419c39
test al, al
je 0x457f4a
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x458328
push 0x2e
lea esi, [ebp - 0x20]
call fcn.004263d2
cmp eax, edi
je 0x458328
lea ecx, [eax + 1]
lea eax, [ebp - 0x18]
push eax
mov edx, esi
call fcn.004264b1
mov byte [ebp - 4], 0x25
lea eax, [ebp - 0x18]
call fcn.004087b3
lea eax, [ebp - 0x2c]
push eax
call fcn.0040850b
mov byte [ebp - 4], 0x26
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00408532
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x67b0b0
call fcn.00409d39
test eax, eax
je 0x457fcc
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x67d668
call fcn.00409d39
test eax, eax
je 0x457fcc
lea eax, [ebp - 0x24]
call fcn.004263f0
jmp 0x457fda
push 0x67d670
lea eax, [ebp - 0x24]
push eax
call fcn.00408606
cmp dword [0x6b29cc], ebx
je 0x458127
cmp dword [0x6c8b4c], 1
jne 0x458057
push str.Malware.
lea eax, [ebp - 0x44]
push eax
call fcn.00408561
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x48]
push ecx
mov esi, eax
call fcn.004136d2
mov byte [ebp - 4], 0x29
push str..DeepDive
lea ecx, [ebp - 0x4c]
push ecx
mov ecx, eax
call fcn.0040fc53
add esp, 0x10
mov byte [ebp - 4], 0x2a
lea edi, [ebp - 0x2c]
call fcn.004085c5
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x4c]
call fcn.004085a2
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x48]
call fcn.004085a2
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x44]
call fcn.004085a2
mov eax, dword [ebp - 0x2c]
cmp dword [eax - 0xc], ebx
jne 0x458127
xor bl, bl
mov eax, 0x6c8f50
mov dword [ebp - 0x50], eax
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x2b
xor edi, edi
mov dword [ebp - 0xac], edi
mov eax, dword [0x6c8f98]
sub eax, dword [0x6c8f94]
sar eax, 2
cmp edi, eax
jae 0x4580ae
mov esi, 0x6c8f88
call fcn.00413946
push dword [eax]
lea eax, [ebp - 0x18]
push eax
call fcn.00408642
test eax, eax
je 0x4580b2
inc edi
jmp 0x45807a
test bl, bl
je 0x45811a
push str.Malware.
lea eax, [ebp - 0x68]
push eax
call fcn.00408561
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x70]
push ecx
mov esi, eax
call fcn.004136d2
mov byte [ebp - 4], 0x2d
push str..DeepDive
lea ecx, [ebp - 0x34]
push ecx
mov ecx, eax
call fcn.0040fc53
add esp, 0x10
mov byte [ebp - 4], 0x2e
lea edi, [ebp - 0x2c]
call fcn.004085c5
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x34]
call fcn.004085a2
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x70]
call fcn.004085a2
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x68]
call fcn.004085a2
mov byte [ebp - 4], 0x27
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x6c8bfc], 0
je 0x45826c
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b0f4
call fcn.00409d39
test eax, eax
je 0x45825e
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b0fc
call fcn.00409d39
test eax, eax
je 0x45825e
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b104
call fcn.00409d39
test eax, eax
je 0x45825e
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b10c
call fcn.00409d39
test eax, eax
je 0x45825e
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b114
call fcn.00409d39
test eax, eax
je 0x45825e
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b11c
call fcn.00409d39
test eax, eax
je 0x45825e
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b124
call fcn.00409d39
test eax, eax
je 0x45825e
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b12c
call fcn.00409d39
test eax, eax
je 0x45825e
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b134
call fcn.00409d39
test eax, eax
je 0x45825e
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b13c
call fcn.00409d39
test eax, eax
je 0x45825e
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b144
call fcn.00409d39
test eax, eax
je 0x45825e
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b14c
call fcn.00409d39
test eax, eax
je 0x45825e
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b154
call fcn.00409d39
test eax, eax
je 0x45825e
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b15c
call fcn.00409d39
test eax, eax
je 0x45825e
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b164
call fcn.00409d39
test eax, eax
jne 0x45826c
push str.Malware.DeepScript
lea eax, [ebp - 0x2c]
push eax
call fcn.00408606
mov eax, dword [ebp - 0x2c]
cmp dword [eax - 0xc], 0
je 0x458304
mov byte [ebp - 4], 0x2f
cmp byte [ebp - 0x3d], 0
jne 0x4582fd
cmp byte [ebp - 0x35], 0
jne 0x4582fd
push 0x1b7740
push dword [0x6c8c50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, 0x6c8e5c
mov dword [ebp - 0x50], esi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x30
push 0x6c8e58
call fcn.00431f05
test al, al
je 0x4582f2
lea eax, [ebp - 0x20]
push eax
call fcn.00431dc5
test al, al
jne 0x4582f2
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67b104
call fcn.00409d39
test eax, eax
jne 0x4582e7
push dword [ebp - 0x20]
call fcn.004242ae
pop ecx
test al, al
je 0x4582f2
push dword [ebp - 0x2c]
lea eax, [ebp - 0x3c]
call fcn.0041348d
mov byte [ebp - 4], 0x2f
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0x27
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x24]
call fcn.004085a2
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x2c]
call fcn.004085a2
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x18]
call fcn.004085a2
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x20]
call fcn.004085a2
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x18], 0x3e8
je 0x45841a
mov eax, dword [ebp - 0x3c]
cmp dword [eax - 0xc], 0
jne 0x45841a
cmp dword [ebp + 0x28], 0
jl 0x45841a
jg 0x458367
cmp dword [ebp + 0x24], 0
jbe 0x45841a
cmp dword [ebp + 0x28], 0xffffffff
ja 0x45841a
jb 0x45837d
cmp dword [ebp + 0x24], 0xffffffff
jae 0x45841a
cmp dword [0x6b29c4], 0
je 0x45841a
mov byte [ebp - 0x5d], 0
lea eax, [ebp - 0x5d]
push eax
push 0
push dword [ebp + 0x24]
lea eax, [ebp - 0x50]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.0040fb52
mov byte [ebp - 4], 0x32
lea edi, [ebp - 0x3c]
call fcn.00408484
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x50]
call fcn.00408461
mov eax, dword [ebp - 0x3c]
cmp dword [eax - 0xc], 0
je 0x45841a
push 0x6c8c1c
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push dword [0x6c8c1c]
push ecx
mov eax, esp
mov dword [ebp - 0x68], esp
push str.CloudFound
push eax
call fcn.00408561
mov byte [ebp - 4], 0x33
mov byte [ebp - 4], 6
call fcn.0042c6a3
push 0x67b5fc
lea eax, [ebp - 0x50]
push eax
mov esi, edi
call fcn.004135f4
pop ecx
pop ecx
mov byte [ebp - 4], 0x34
call fcn.00408484
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x50]
call fcn.00408461
mov eax, dword [ebp - 0x3c]
cmp dword [eax - 0xc], 0
je 0x458882
push dword [ebp + 0x10]
lea eax, [ebp - 0x24]
push eax
call fcn.00408561
mov byte [ebp - 4], 0x35
lea eax, [ebp - 0x24]
call fcn.004087b3
mov ebx, dword [ebp + 0xc]
add ebx, 0xc0
mov eax, dword [ebx + 0x18]
and dword [ebp - 0x54], 0
mov dword [ebp - 0x50], eax
mov eax, dword [ebx]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.00413d60
lea edi, [ebp - 0x54]
mov esi, eax
call fcn.00427527
test al, al
je 0x458876
lea eax, [ebp - 0x24]
push eax
push ebx
lea ebx, [ebp - 0x58]
call fcn.00413c84
push dword [ebp + 0x10]
lea eax, [ebp - 0x44]
push eax
call fcn.00470550
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 0x36
mov ebx, dword [ebp + 0xc]
lea edi, [ebx + 0xe0]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x48]
push eax
mov esi, edi
call fcn.004135a2
mov byte [ebp - 4], 0x37
push 0x6767ec
lea ecx, [ebp - 0x4c]
push ecx
mov esi, eax
call fcn.004135f4
mov byte [ebp - 4], 0x38
push dword [ebp - 0x50]
lea ecx, [ebp - 0x70]
push ecx
mov esi, eax
call fcn.004135a2
mov byte [ebp - 4], 0x39
push 0x67892c
lea ecx, [ebp - 0x68]
push ecx
mov esi, eax
call fcn.004135f4
add esp, 0x28
mov byte [ebp - 4], 0x3a
call fcn.00408484
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x68]
call fcn.00408461
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x70]
call fcn.00408461
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x4c]
call fcn.00408461
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x48]
call fcn.00408461
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x44]
call fcn.00408461
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0041bece
pop ecx
pop ecx
mov byte [ebp - 4], 0x3b
mov edi, dword [ebp + 8]
call fcn.004085c5
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x34]
call fcn.004085a2
push edi
call fcn.00452573
pop ecx
lea eax, [ebp - 0x9c]
push eax
call fcn.004521ec
mov byte [ebp - 4], 0x3c
mov eax, dword [ebp + 0x2c]
xor ebx, ebx
cmp dword [eax - 0xc], ebx
je 0x45858a
lea eax, [ebp + 0x2c]
jmp 0x4585a1
push dword [ebp + 0x10]
lea eax, [ebp - 0x50]
push eax
call fcn.00408561
mov byte [ebp - 4], 0x3d
or dword [ebp - 0x1c], 0x200
lea edi, [ebp - 0x9c]
call fcn.004085c5
mov dword [ebp - 4], 0x3c
test dword [ebp - 0x1c], 0x200
je 0x4585cb
and dword [ebp - 0x1c], 0xfffffdff
lea ecx, [ebp - 0x50]
call fcn.004085a2
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x80]
call fcn.004085c5
cmp dword [ebp + 0x1c], ebx
je 0x4585f7
lea eax, [ebp - 0x98]
push eax
push dword [ebp + 0x1c]
lea eax, [ebp - 0x9c]
push eax
push dword [ebp + 0xc]
call fcn.00456f61
add esp, 0x10
lea eax, [ebp - 0x9c]
push eax
mov esi, dword [ebp + 0x18]
add esi, 0x1c
call fcn.004665e0
cmp byte [ebp + 0x20], bl
jne 0x458622
push ebx
push ebx
push 0x6b29f0
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
mov byte [ebp - 0x2c], bl
jne 0x458626
mov byte [ebp - 0x2c], 1
push ebx
push dword [ebp - 0x2c]
push ecx
mov eax, esp
mov dword [ebp - 0x50], esp
push dword [ebp + 8]
push eax
call fcn.00408532
mov byte [ebp - 4], 0x3e
push ecx
mov eax, esp
mov dword [ebp - 0x68], esp
lea ecx, [ebp - 0x9c]
push ecx
push eax
call fcn.00408532
mov byte [ebp - 4], 0x3f
push dword [ebp + 0xc]
mov byte [ebp - 4], 0x3c
mov ebx, dword [ebp + 0x18]
call fcn.00456db7
add esp, 0x14
push 0x6c8c10
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
xor edi, edi
mov dword [ebp - 0xa8], edi
mov eax, dword [ebp - 0x88]
sub eax, dword [ebp - 0x8c]
sar eax, 2
cmp edi, eax
jae 0x4586e9
push 0x6c8c0c
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call esi
push 0x6c8c10
call esi
push 0
push dword [ebp - 0x2c]
push ecx
mov eax, esp
mov dword [ebp - 0x50], esp
push dword [ebp + 8]
push eax
call fcn.00408532
mov byte [ebp - 4], 0x40
lea esi, [ebp - 0x98]
call fcn.00413946
push ecx
mov ecx, esp
mov dword [ebp - 0x68], esp
push eax
push ecx
call fcn.00408532
mov byte [ebp - 4], 0x41
push dword [ebp + 0xc]
mov byte [ebp - 4], 0x3c
mov ebx, dword [ebp + 0x18]
call fcn.00456db7
add esp, 0x14
inc edi
jmp 0x458673
push dword [0x6c8c10]
push ecx
mov eax, esp
mov dword [ebp - 0x50], esp
push str.ManualFound
push eax
call fcn.00408561
mov byte [ebp - 4], 0x42
mov byte [ebp - 4], 0x3c
call fcn.0042c6a3
cmp byte [ebp + 0x20], 0
jne 0x45872a
push 0
push 0
push 0x6b29f0
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x458866
mov ecx, dword [ebp - 0x88]
sub ecx, dword [ebp - 0x8c]
sar ecx, 2
inc ecx
mov eax, dword [ebp + 0xc]
add dword [eax + 0x40], ecx
push 1
mov esi, dword [ebp + 8]
call fcn.004087dc
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x50], esp
push eax
call fcn.004081bb
mov byte [ebp - 4], 0x43
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x68], esp
mov edi, dword [ebp + 0x10]
push edi
call fcn.004081bb
mov byte [ebp - 4], 0x44
mov byte [ebp - 4], 0x3c
call fcn.004537ea
add esp, 0x3c
mov byte [ebp - 0x36], 0
push edi
lea eax, [ebp - 0x34]
push eax
call fcn.00408561
mov byte [ebp - 4], 0x45
push dword [ebp + 8]
lea esi, [ebp - 0x34]
call fcn.00424ad0
pop ecx
mov bl, al
neg bl
sbb bl, bl
inc bl
mov byte [ebp - 4], 0x3c
mov ecx, esi
call fcn.004085a2
test bl, bl
je 0x458850
push 0x67a080
lea eax, [ebp - 0x34]
push eax
call fcn.00408561
mov byte [ebp - 4], 0x46
lea eax, [ebp - 0x34]
mov ecx, dword [ebp + 8]
call fcn.00470bf0
mov bl, al
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x34]
call fcn.004085a2
test bl, bl
je 0x458807
lea eax, [ebp - 0x36]
push eax
push 1
push dword [ebp + 0x24]
lea eax, [ebp - 0x50]
push eax
mov ecx, edi
call fcn.0040fb52
lea ecx, [ebp - 0x50]
call fcn.00408461
cmp byte [ebp - 0x36], 0
jne 0x45880e
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edi, edi
mov dword [ebp - 0xa4], edi
mov eax, dword [ebp - 0x88]
mov ecx, eax
sub ecx, dword [ebp - 0x8c]
sar ecx, 2
cmp edi, ecx
jae 0x458856
lea esi, [ebp - 0x98]
call fcn.00413946
push eax
call fcn.00420a85
pop ecx
test al, al
je 0x45884d
call fcn.00413946
push eax
call fcn.00420af0
pop ecx
inc edi
jmp 0x458810
mov eax, dword [ebp - 0x88]
sub eax, dword [ebp - 0x8c]
sar eax, 2
inc eax
mov ecx, dword [ebp + 0x18]
add dword [ecx + 8], eax
mov byte [ebp - 4], 0x35
lea eax, [ebp - 0x9c]
push eax
call fcn.004588f7
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x24]
call fcn.004085a2
mov edi, dword [ebp + 0xc]
cmp byte [ebp + 0x14], 0
je 0x4588a8
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax - 0xc]
push dword [edi]
test eax, eax
setne al
movzx eax, al
push eax
call fcn.0045292f
pop ecx
pop ecx
inc dword [edi + 0x28]
mov byte [ebp - 4], 5
cmp dword [ebp - 0x64], 0xffffffff
je 0x4588bb
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3c]
call fcn.00408461
xor ebx, ebx
inc ebx
jmp 0x4588d2
mov eax, dword [ebp + 0xc]
inc dword [eax + 0x44]
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x2c]
call fcn.004085a2
mov eax, dword [ebp + 8]
call fcn.00580f43
ret