Function at 0x43cc4f
Capabilities:
Contain obfuscated stackstrings
Enumerate processes
Get installed programs
Parse pe header

Disassembly:
push 0x4e4
mov eax, 0x4ad524
call fcn.0047d2fc
xor edi, edi
lea ecx, [ebp - 0x4ec]
mov ebx, edi
mov dword [ebp - 0x4ec], edi
mov dword [ebp - 0x4e8], edi
call fcn.0043e48f
mov dword [ebp - 0x4ec], eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x4d0], edi
mov dword [ebp - 0x4cc], edi
mov dword [ebp - 0x4c8], edi
mov esi, str.dd87ac54b602da220ff4f6723dc24e7b
mov byte [ebp - 4], 1
push esi
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push esi
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.305a123ef0c11830e091e041ccf71e78
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.faebf6cbb44b048beae1e81534e5c910
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.ef4264b6f594b8dc46ac399f6ec61bd9
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
mov byte [ebp - 4], 1
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.0043c065
push str.bc53cd7acb3cf8f46337d2b8975db3f6
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.e7df620d09d06ef76bf36f4c8d3c9437
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.5ac082ed99dc9cc507e959e9772e68be
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.c19cd7ac42a5cbf532a6f38304dae0e5
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.15b436bbba3d6e3abe43f5ba2e473632
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.335e6e136bdb8e462f9cc21ddd754859
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xc
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.3c6c610aa0558cdd8136c8eaaf172dc1
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xd
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.51ce0e230df71de1ed419bf75d0bf340
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xe
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.e29a441397164acede277e820255ed25
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xf
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.4f4246dfb45d6a36c0cf653fd9af3fb0
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x10
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.b3699325c9084bb9f208ab7979170057
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x11
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.1a1b07c615996b176ab96577c85c32c7
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x12
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.233a79a276584ddf1857328cc5540ac8
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x13
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.3fa00dc8f0db42b0edac4e261d66a0d5
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x14
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.fa2a5fe61af40c16c4916c1d445ae266
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x15
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.670a0310e4802aef46e9de9d376667a9
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x16
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.9c6bce4fb25261ff991dcd6447f757c1
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x17
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.8257faddd75ad6bbf266dae2a60e3457
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x18
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.162cd69656790648becdd0b6b9489024
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x19
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.1251cd44c0c2519dddbd276437551185
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x1a
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.4298fc15c5a8f13285e20d00d2c88788
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x1b
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.29deecce5a77168829daa0026c976469
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x1c
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.ce8b28a42fe49221fdd491407d5873d5
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x1d
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
mov byte [ebp - 4], 1
push 1
lea ecx, [ebp - 0x28]
call fcn.0043c065
push str.5cef2e62eaaf1a5d5db6696447fff25c
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x1e
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.7e7e9fe15ea1c3a04cd84a07d797ed4b
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x1f
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.4faf3c350541d4b87d5acf5222c7cf70
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x20
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.47e6478118ebfe8e4df19c2f1ec5244f
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x21
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.eff6c8ceb32d30c746820694e03a6200
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x22
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.92b040771b0343bf12b8595b60d9a7d4
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x23
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.7cfdca073a269f9167da129b45a08d51
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x24
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.43a96460030192e478ad03e5f1485468
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x25
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.6ef9629c6598f4d4bb85ad73560160be
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x26
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.d090ce50f9ba7e4bedb8076bd4d0ff26
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x27
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.f10213277189ffbd06f2a20def24e99c
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x28
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.2488c8cb5e4095ce03ba2361c14d4ff6
lea ecx, [ebp - 0x28]
call fcn.0040c220
mov byte [ebp - 4], 0x29
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.a289f9379cb78231aa821250ce344bc4
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x2a
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.7386a62370c7187465956e82b786ea7a
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x2b
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.c5ea87f8574ab4272558b7178293f8e6
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x2c
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.990bbf246c2fea44a680d557b3f242ac
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x2d
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.6b42b48ba6916c67f01f1eae4ef8b075
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x2e
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.f27f608e9d26e8f39231e1ec82516e9d
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x2f
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.169b2a0474e4fecd3d7a2aeb64f72b79
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x30
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.fe3831ac5b87194c0c87654fb47de4db
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x31
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.2217fabcfa4de0f9852152a13e883ba2
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x32
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.a92d6e1a285362cc3f0d68d1d6138eec
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x33
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.7c9c711f1a52594ecdf7eb429fa15796
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x34
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.2648d9e3daf4ae4e0d0b9c7dfd33cd31
lea ecx, [ebp - 0xa0]
call fcn.0040c220
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 0x35
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.e13186f55c7aca54b52af05293136bee
lea ecx, [ebp - 0x88]
call fcn.0040c220
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 0x36
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.e61170177e6d76aa147d6bc718d04517
lea ecx, [ebp - 0x70]
call fcn.0040c220
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0x37
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.a1f67c32a62bf215e6b2b0410b4021c4
lea ecx, [ebp - 0x58]
call fcn.0040c220
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x38
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.594a19dcf2f9d25d09c17cefd738a229
lea ecx, [ebp - 0x40]
call fcn.0040c220
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x39
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
push edi
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.0043c065
push str.c416a08a585c65f648ffecf1529ae2d7
lea ecx, [ebp - 0xb8]
call fcn.0040c220
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 0x3a
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004144a0
mov byte [ebp - 4], 1
push edi
push 1
lea ecx, [ebp - 0xb8]
call fcn.0043c065
push 0x22c
lea eax, [ebp - 0x4c4]
push edi
push eax
call fcn.00459150
add esp, 0xc
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x43d750
jmp 0x43e105
lea eax, [ebp - 0x4c4]
mov dword [ebp - 0x4c4], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x43d808
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], edi
mov word [ebp - 0x40], ax
cmp word [ebp - 0x4a0], ax
jne 0x43d789
mov eax, edi
jmp 0x43d796
lea eax, [ebp - 0x4a0]
push eax
call fcn.0046a4eb
pop ecx
push eax
lea eax, [ebp - 0x4a0]
push eax
lea ecx, [ebp - 0x40]
call fcn.00407a30
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x3b
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00440737
pop ecx
pop ecx
push edi
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x3d
call fcn.00407970
lea eax, [ebp - 0x58]
push eax
call fcn.00440529
cmp dword [ebp - 0x44], 0x10
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push eax
lea eax, [ebp - 0x4ec]
push eax
call fcn.0043e421
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
push edi
push 1
call fcn.0043c065
lea eax, [ebp - 0x4c4]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x43d76c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [ebp - 0x44], 7
mov esi, 0x4b04e0
mov dword [ebp - 0x48], edi
push esi
mov word [ebp - 0x58], ax
call fcn.0046a4eb
pop ecx
push eax
push esi
lea ecx, [ebp - 0x58]
call fcn.00407a30
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x3e
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.00440737
pop ecx
pop ecx
xor esi, esi
mov byte [ebp - 4], 0x40
push edi
inc esi
lea ecx, [ebp - 0x58]
push esi
call fcn.00407970
mov ecx, dword [ebp - 0x4ec]
mov eax, dword [ecx]
mov dword [ebp - 0x4d4], eax
cmp eax, ecx
je 0x43d972
mov edi, dword [ebp - 0x4d0]
add eax, 0x10
cmp dword [eax + 0x14], 0x10
jb 0x43d88b
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x40]
call fcn.0040c220
mov esi, 0x4b4a04
mov byte [ebp - 4], 0x41
push esi
call fcn.0046a510
pop ecx
push eax
push esi
lea ecx, [ebp - 0x40]
call fcn.004103b0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x40]
call fcn.004102b0
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
call fcn.0043935a
lea eax, [ebp - 0x70]
push eax
call fcn.0043f9d7
add esp, 0x1c
mov esi, edi
mov byte [ebp - 4], 0x42
cmp edi, dword [ebp - 0x4cc]
je 0x43d936
cmp dword [esi + 0x14], 0x10
jb 0x43d8f3
mov eax, dword [esi]
jmp 0x43d8f5
mov eax, esi
push eax
lea ecx, [ebp - 0x88]
call fcn.0040c220
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x70]
call fcn.0043e789
neg eax
lea ecx, [ebp - 0x88]
sbb al, al
add al, 1
jne 0x43dff7
push 0
push 1
call fcn.0043c065
add esi, 0x18
cmp esi, dword [ebp - 0x4cc]
jne 0x43d8e9
xor esi, esi
lea ecx, [ebp - 0x70]
push 0
inc esi
push esi
call fcn.0043c065
push 0
push esi
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x40
call fcn.0043c065
lea ecx, [ebp - 0x4d4]
call fcn.0043c50f
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0x4ec]
jne 0x43d880
xor edi, edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
push str.dbc1b43630e53968644e76a676267b78
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x43
call fcn.0040c220
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 0x44
push eax
lea ecx, [ebp - 0x34]
call fcn.004144a0
push edi
push esi
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x43
call fcn.0043c065
push str.d7a4038180799cd1075f56f8d326f64d
lea ecx, [ebp - 0x28]
call fcn.0040c220
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x45
push eax
lea ecx, [ebp - 0x34]
call fcn.004144a0
push edi
push esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x43
call fcn.0043c065
push str.5f292a80d7a99beead88c7f843f6579d
lea ecx, [ebp - 0xa0]
call fcn.0040c220
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 0x46
push eax
lea ecx, [ebp - 0x34]
call fcn.004144a0
push edi
push esi
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0x43
call fcn.0043c065
push str.3f9d8a89a27a227274cb702bd82232e1
lea ecx, [ebp - 0x70]
call fcn.0040c220
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0x47
push eax
lea ecx, [ebp - 0x34]
call fcn.004144a0
push edi
push esi
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x43
call fcn.0043c065
push str.e1b4770b18bcf496c0acc8d0d3f8f598
lea ecx, [ebp - 0x58]
call fcn.0040c220
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x48
push eax
lea ecx, [ebp - 0x34]
call fcn.004144a0
push edi
push esi
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x43
call fcn.0043c065
push str.c71fee3b1066ad8982e576c7b8ccf8fb
lea ecx, [ebp - 0x190]
call fcn.0040c220
mov byte [ebp - 4], 0x49
lea eax, [ebp - 0x190]
push eax
lea ecx, [ebp - 0x34]
call fcn.004144a0
push edi
push esi
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0x43
call fcn.0043c065
push str.a02e46669ce3c272c263c84059d1133d
lea ecx, [ebp - 0x1a8]
call fcn.0040c220
lea eax, [ebp - 0x1a8]
mov byte [ebp - 4], 0x4a
push eax
lea ecx, [ebp - 0x34]
call fcn.004144a0
push edi
push esi
lea ecx, [ebp - 0x1a8]
mov byte [ebp - 4], 0x43
call fcn.0043c065
push str.ad4ab9314dd0b1187256cf3ac82bc248
lea ecx, [ebp - 0xe8]
call fcn.0040c220
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 0x4b
push eax
lea ecx, [ebp - 0x34]
call fcn.004144a0
push edi
push esi
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 0x43
call fcn.0043c065
push str.aeb4d75c66a9d745bee214a254337de2
lea ecx, [ebp - 0x178]
call fcn.0040c220
lea eax, [ebp - 0x178]
mov byte [ebp - 4], 0x4c
push eax
lea ecx, [ebp - 0x34]
call fcn.004144a0
push edi
push esi
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 0x43
call fcn.0043c065
push str.c1299bb3c3d16ca9906c5e69eb29792e
lea ecx, [ebp - 0x160]
call fcn.0040c220
lea eax, [ebp - 0x160]
mov byte [ebp - 4], 0x4d
push eax
lea ecx, [ebp - 0x34]
call fcn.004144a0
push edi
push esi
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 0x43
call fcn.0043c065
push str.8a184a58bcafeaad924db9d7b65585bc
lea ecx, [ebp - 0x148]
call fcn.0040c220
lea eax, [ebp - 0x148]
mov byte [ebp - 4], 0x4e
push eax
lea ecx, [ebp - 0x34]
call fcn.004144a0
push edi
push esi
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], 0x43
call fcn.0043c065
push str.b646a6b2d4d933eef8a115c89b12327f
lea ecx, [ebp - 0x130]
call fcn.0040c220
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 0x4f
push eax
lea ecx, [ebp - 0x34]
call fcn.004144a0
push edi
push esi
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0x43
call fcn.0043c065
push str.99a36f768e427f9c8347929cc525702c
lea ecx, [ebp - 0x118]
call fcn.0040c220
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 0x50
push eax
lea ecx, [ebp - 0x34]
call fcn.004144a0
push edi
push esi
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0x43
call fcn.0043c065
push str.6ca92bff263fcc264c777dad495ad9ec
lea ecx, [ebp - 0x100]
call fcn.0040c220
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 0x51
push eax
lea ecx, [ebp - 0x34]
call fcn.004144a0
push edi
push esi
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 0x43
call fcn.0043c065
push str.571284040f78342ff4b79e9d26403432
lea ecx, [ebp - 0x1c0]
call fcn.0040c220
lea eax, [ebp - 0x1c0]
mov byte [ebp - 4], 0x52
push eax
lea ecx, [ebp - 0x34]
call fcn.004144a0
push edi
push esi
lea ecx, [ebp - 0x1c0]
mov byte [ebp - 4], 0x43
call fcn.0043c065
push str.d9d017ee49b0e193a0b27e8695b24f3f
lea ecx, [ebp - 0x1d8]
call fcn.0040c220
lea eax, [ebp - 0x1d8]
mov byte [ebp - 4], 0x53
push eax
lea ecx, [ebp - 0x34]
call fcn.004144a0
push edi
push esi
lea ecx, [ebp - 0x1d8]
mov byte [ebp - 4], 0x43
call fcn.0043c065
push str.47754584b7dbc1ae752fe7d5ab650973
lea ecx, [ebp - 0x1f0]
call fcn.0040c220
lea eax, [ebp - 0x1f0]
mov byte [ebp - 4], 0x54
push eax
lea ecx, [ebp - 0x34]
call fcn.004144a0
push edi
push esi
lea ecx, [ebp - 0x1f0]
mov byte [ebp - 4], 0x43
call fcn.0043c065
push str.07276c8ee896aec2fe781a8db198c04f
lea ecx, [ebp - 0x208]
call fcn.0040c220
lea eax, [ebp - 0x208]
mov byte [ebp - 4], 0x55
push eax
lea ecx, [ebp - 0x34]
call fcn.004144a0
push edi
push esi
lea ecx, [ebp - 0x208]
mov byte [ebp - 4], 0x43
call fcn.0043c065
push str.8b7328d1d64229278771510f7b01082a
lea ecx, [ebp - 0x220]
call fcn.0040c220
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 0x56
push eax
lea ecx, [ebp - 0x34]
call fcn.004144a0
push edi
push esi
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 0x43
call fcn.0043c065
push str.53850fad76380bbf5700ae907dfa5dd9
lea ecx, [ebp - 0x238]
call fcn.0040c220
lea eax, [ebp - 0x238]
mov byte [ebp - 4], 0x57
push eax
lea ecx, [ebp - 0x34]
call fcn.004144a0
push edi
push esi
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0x43
call fcn.0043c065
push str.64c9af9e391e8a7b2ba936c0974b2cc4
lea ecx, [ebp - 0x250]
call fcn.0040c220
lea eax, [ebp - 0x250]
mov byte [ebp - 4], 0x58
push eax
lea ecx, [ebp - 0x34]
call fcn.004144a0
push edi
push esi
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 0x43
call fcn.0043c065
push str.87a7c6e5df13e552f2b11f4696f73958
lea ecx, [ebp - 0x268]
call fcn.0040c220
lea eax, [ebp - 0x268]
mov byte [ebp - 4], 0x59
push eax
lea ecx, [ebp - 0x34]
call fcn.004144a0
push edi
push esi
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 0x43
call fcn.0043c065
push str.2b0b7e50820946f8947a4e36e873d383
lea ecx, [ebp - 0x280]
call fcn.0040c220
lea eax, [ebp - 0x280]
mov byte [ebp - 4], 0x5a
push eax
lea ecx, [ebp - 0x34]
call fcn.004144a0
mov byte [ebp - 4], 0x43
push edi
push esi
lea ecx, [ebp - 0x280]
call fcn.0043c065
lea ecx, [ebp - 0x4e0]
mov dword [ebp - 0x4e0], edi
mov dword [ebp - 0x4dc], edi
call fcn.0043e48f
mov dword [ebp - 0x4e0], eax
xor eax, eax
mov byte [ebp - 4], 0x5b
mov esi, 0x4c94e4
mov dword [ebp - 0x74], 7
push esi
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x78], edi
mov word [ebp - 0x88], ax
call fcn.004079e0
push esi
lea ecx, [ebp - 0x298]
mov byte [ebp - 4], 0x5c
call fcn.004078d0
lea eax, [ebp - 0x4d4]
mov dword [ebp - 0x4d4], edi
push eax
push 0x109
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push reloc.WS2_32.dll_bind
mov byte [ebp - 4], 0x5d
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x43deb4
lea eax, [ebp - 0x4e0]
push eax
push dword [ebp - 0x4d4]
call fcn.0043eafd
pop ecx
pop ecx
push dword [ebp - 0x4d4]
call esi
lea eax, [ebp - 0x4d4]
push eax
push 9
push 0
push 0x4b1b58
push reloc.WS2_32.dll_bind
call edi
test eax, eax
jne 0x43deeb
lea eax, [ebp - 0x4e0]
push eax
push dword [ebp - 0x4d4]
call fcn.0043eafd
pop ecx
pop ecx
push dword [ebp - 0x4d4]
call esi
lea eax, [ebp - 0x4d4]
push eax
push 9
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push reloc.WS2_32.dll_accept
call edi
test eax, eax
jne 0x43df22
lea eax, [ebp - 0x4e0]
push eax
push dword [ebp - 0x4d4]
call fcn.0043eafd
pop ecx
pop ecx
push dword [ebp - 0x4d4]
call esi
lea eax, [ebp - 0x4d4]
push eax
push 0x109
push 0
push str.SoftwareMicrosoft_
push reloc.WS2_32.dll_bind
call edi
test eax, eax
jne 0x43df5c
lea eax, [ebp - 0x4e0]
push eax
push dword [ebp - 0x4d4]
call fcn.0043eafd
pop ecx
pop ecx
push dword [ebp - 0x4d4]
call esi
mov ecx, dword [ebp - 0x4e0]
xor esi, esi
mov eax, dword [ecx]
mov dword [ebp - 0x4e4], eax
cmp eax, ecx
je 0x43e0c8
mov edi, dword [ebp - 0x34]
add eax, 0x10
cmp dword [eax + 0x14], 0x10
jb 0x43df82
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x70]
call fcn.0040c220
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0x5e
push eax
call fcn.00440529
pop ecx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x58]
call fcn.0043935a
push 0x4b4a04
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x5f
call fcn.0041ac60
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x58]
call fcn.004102b0
sub esp, 0x18
lea eax, [ebp - 0x58]
mov ecx, esp
push eax
call fcn.0043935a
lea eax, [ebp - 0x28]
push eax
call fcn.0043f9d7
add esp, 0x1c
mov esi, edi
mov byte [ebp - 4], 0x60
cmp edi, dword [ebp - 0x30]
je 0x43e058
cmp dword [esi + 0x14], 0x10
jb 0x43e01c
mov eax, dword [esi]
jmp 0x43e01e
xor ebx, ebx
xor esi, esi
push esi
inc ebx
push ebx
call fcn.0043c065
push esi
push ebx
lea ecx, [ebp - 0x70]
call fcn.0043c065
push esi
push ebx
lea ecx, [ebp - 0x40]
call fcn.0043c065
jmp 0x43e0f7
mov eax, esi
push eax
lea ecx, [ebp - 0xa0]
call fcn.0040c220
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0043e789
neg eax
lea ecx, [ebp - 0xa0]
sbb al, al
add al, 1
jne 0x43e09e
push 0
push 1
call fcn.0043c065
add esi, 0x18
cmp esi, dword [ebp - 0x30]
jne 0x43dfed
xor esi, esi
lea ecx, [ebp - 0x28]
push esi
push 1
call fcn.0043c065
push esi
push 1
lea ecx, [ebp - 0x58]
call fcn.0043c065
push esi
push 1
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x5d
call fcn.0043c065
lea ecx, [ebp - 0x4e4]
call fcn.0043c50f
mov eax, dword [ebp - 0x4e4]
cmp eax, dword [ebp - 0x4e0]
jne 0x43df77
jmp 0x43e0c8
xor ebx, ebx
xor esi, esi
push esi
inc ebx
push ebx
call fcn.0043c065
push esi
push ebx
lea ecx, [ebp - 0x28]
call fcn.0043c065
push esi
push ebx
lea ecx, [ebp - 0x58]
call fcn.0043c065
push esi
push ebx
lea ecx, [ebp - 0x70]
call fcn.0043c065
push esi
push 1
lea ecx, [ebp - 0x298]
call fcn.00407970
push esi
push 1
lea ecx, [ebp - 0x88]
call fcn.00407970
lea ecx, [ebp - 0x4e0]
call fcn.0043c4dd
lea ecx, [ebp - 0x34]
call fcn.0043e6c1
push esi
push 1
lea ecx, [ebp - 0xd0]
call fcn.0043c065
lea ecx, [ebp - 0x4d0]
call fcn.0043e6c1
lea ecx, [ebp - 0x4ec]
call fcn.0043c4dd
mov eax, ebx
call fcn.0047d2b7
ret