Function at 0x452790
Capabilities:
Contain obfuscated stackstrings
Enumerate gui resources
Parse pe header
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push reloc.kernel32.dll_FileTimeToLocalFileTime
mov eax, dword fs:[0]
push eax
sub esp, 0x78
push ebx
push esi
push edi
mov eax, dword [0x52bd60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [0x530408]
mov eax, esi
imul eax, esi
imul eax, esi
cdq
mov ecx, reloc.kernel32.dll_SetSystemTime
idiv ecx
cmp edx, 0xd
jne 0x4527df
dec esi
mov dword [0x530408], esi
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, str.St_rted_for:
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x45281f
movzx esi, ax
mov ecx, esi
call fcn.00405530
test eax, eax
je 0x45282c
push esi
push eax
lea ecx, [ebp - 0x14]
call fcn.00404a70
jmp 0x45282c
push str.St_rted_for:
lea ecx, [ebp - 0x14]
call fcn.004044d0
push str.Ki1lProce__
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 1
call fcn.004036e0
mov byte [ebp - 4], 2
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call fcn.00431c80
push dword [ebp + 8]
mov edx, eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 4
call fcn.00431c80
add esp, 8
mov byte [ebp - 4], 5
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x452899
push 0
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 4]
push eax
call fcn.004018b0
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
or ebx, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4528bc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4528dc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4528f9
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x452919
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45293c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 0x28], 0
call fcn.00453db0
mov esi, eax
mov eax, dword [0x530408]
imul eax, eax
cdq
mov ecx, reloc.kernel32.dll_IsProcessInJob
idiv ecx
mov dword [ebp - 0x14], esi
cmp edx, 2
jne 0x45297c
push reloc.kernel32.dll_MoveFileExW
push reloc.kernel32.dll_DebugActiveProcess
push str._d__d_n
call fcn.004b5c0f
add esp, 0xc
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
test esi, esi
jne 0x452af3
mov dword [ebp - 0x14], eax
mov eax, str.Could_not_find_the_proce___or_get_a_h_nd1e_of_it:
mov dword [ebp - 4], 6
test eax, 0xffff0000
jne 0x4529c4
movzx esi, ax
mov ecx, esi
call fcn.00405530
test eax, eax
je 0x4529d1
push esi
push eax
lea ecx, [ebp - 0x14]
call fcn.00404a70
jmp 0x4529d1
push str.Could_not_find_the_proce___or_get_a_h_nd1e_of_it:
lea ecx, [ebp - 0x14]
call fcn.004044d0
push str.KillProcess
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 7
call fcn.004036e0
mov byte [ebp - 4], 8
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 9
call fcn.00431c80
mov ecx, dword [ebp + 8]
push ecx
mov edx, eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xa
call fcn.00431c80
add esp, 8
mov byte [ebp - 4], reloc.kernel32.dll_ConvertDefaultLocale
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x452a3f
push 0
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 4]
push eax
call fcn.004018b0
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x452a5f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x452a7f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], 8
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x452a9c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x452abc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x452add
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 0x1c], eax
mov eax, str.H_ndle:
mov dword [ebp - 4], reloc.kernel32.dll_AssignProcessToJobObject
test eax, 0xffff0000
jne 0x452b23
movzx esi, ax
mov ecx, esi
call fcn.00405530
test eax, eax
je 0x452b30
push esi
push eax
lea ecx, [ebp - 0x1c]
call fcn.00404a70
jmp 0x452b30
push str.H_ndle:
lea ecx, [ebp - 0x1c]
call fcn.004044d0
mov dword [ebp - 4], reloc.kernel32.dll_CreateFileMappingW
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov eax, str.Found_the_proces_:
mov byte [ebp - 4], reloc.kernel32.dll_ReleaseActCtx
test eax, 0xffff0000
jne 0x452b74
movzx esi, ax
mov ecx, esi
call fcn.00405530
test eax, eax
je 0x452b81
push esi
push eax
lea ecx, [ebp - 0x18]
call fcn.00404a70
jmp 0x452b81
push str.Found_the_proces_:
lea ecx, [ebp - 0x18]
call fcn.004044d0
push str.KillProces_
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], reloc.kernel32.dll_UnmapViewOfFile
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_GetUserDefaultLangID
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x40]
call fcn.00431d20
mov edi, eax
mov byte [ebp - 4], reloc.kernel32.dll_GetDiskFreeSpaceA
mov edx, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [edx + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], reloc.kernel32.dll_SetSystemTime
call fcn.00431c80
mov ecx, dword [ebp + 8]
push ecx
mov edx, eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], reloc.kernel32.dll_OpenSemaphoreW
call fcn.00431c80
push 0x530a74
mov edx, eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], reloc.kernel32.dll_SetConsoleCursorPosition
call fcn.00431c80
lea ecx, [ebp - 0x1c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], reloc.kernel32.dll_GetConsoleOutputCP
call fcn.00431c80
push edi
mov edx, eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], reloc.kernel32.dll_OpenEventW
call fcn.00431c80
add esp, 0x14
mov edi, dword [ebp - 0x10]
mov byte [ebp - 4], reloc.kernel32.dll_SetCurrentDirectoryA
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x452c35
push 0
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [edi + 4]
push eax
call fcn.004018b0
mov byte [ebp - 4], reloc.kernel32.dll_OpenEventW
mov edx, dword [ebp - 0x2c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x452c55
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_GetConsoleOutputCP
mov edx, dword [ebp - 0x30]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x452c75
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_SetConsoleCursorPosition
mov edx, dword [ebp - 0x34]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x452c95
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_OpenSemaphoreW
mov edx, dword [ebp - 0x38]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x452cb5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_SetSystemTime
mov edx, dword [ebp - 0x3c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x452cd5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_GetDiskFreeSpaceA
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x452cf2
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_GetUserDefaultLangID
mov edx, dword [ebp - 0x40]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x452d12
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_UnmapViewOfFile
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x452d32
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_CreateFileMappingW
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x452d52
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x452d75
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov eax, str._tarting_1oop
mov dword [ebp - 4], reloc.kernel32.dll_IsProcessInJob
test eax, 0xffff0000
jne 0x452db5
movzx esi, ax
mov ecx, esi
call fcn.00405530
test eax, eax
je 0x452dc2
push esi
push eax
lea ecx, [ebp - 0x1c]
call fcn.00404a70
jmp 0x452dc2
push str._tarting_1oop
lea ecx, [ebp - 0x1c]
call fcn.004044d0
push str.KillProcess
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], reloc.kernel32.dll_CreateDirectoryW
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_GetSystemPowerStatus
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x40], esi
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], reloc.kernel32.dll_QueryDosDeviceW
call fcn.00431c80
add esp, 4
mov byte [ebp - 4], reloc.kernel32.dll_WritePrivateProfileSectionA
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x452e1e
push 0
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [edi + 4]
push eax
call fcn.004018b0
mov byte [ebp - 4], reloc.kernel32.dll_QueryDosDeviceW
mov edx, dword [ebp - 0x3c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x452e3e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_GetSystemPowerStatus
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x452e5b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_CreateDirectoryW
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x452e7b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x452e9e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov ecx, str.Loop_iteration:
shr ecx, 0x10
mov dword [ebp - 0x40], ecx
mov ecx, str.Ki11Proce_s
shr ecx, 0x10
mov dword [ebp - 0x3c], ecx
mov ecx, str.Waiting_for_proce_s_to__ign_l:
shr ecx, 0x10
mov dword [ebp - 0x4c], ecx
mov esi, str.Proce__:
shr esi, 0x10
mov ecx, str.Kil1Proce_s
xor eax, eax
shr ecx, 0x10
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x50], ecx
jmp 0x452ee6
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], reloc.kernel32.dll_lstrcpynW
test esi, esi
jne 0x452f27
mov eax, str.Proce__:
movzx esi, ax
mov ecx, esi
call fcn.00405530
test eax, eax
je 0x452f34
push esi
push eax
lea ecx, [ebp - 0x20]
call fcn.00404a70
jmp 0x452f34
push str.Proce__:
lea ecx, [ebp - 0x20]
call fcn.004044d0
mov dword [ebp - 4], reloc.kernel32.dll_CopyFileA
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], reloc.kernel32.dll_ReadProcessMemory
cmp dword [ebp - 0x40], 0
jne 0x452f77
mov eax, str.Loop_iteration:
movzx esi, ax
mov ecx, esi
call fcn.00405530
test eax, eax
je 0x452f84
push esi
push eax
lea ecx, [ebp - 0x18]
call fcn.00404a70
jmp 0x452f84
push str.Loop_iteration:
lea ecx, [ebp - 0x18]
call fcn.004044d0
mov byte [ebp - 4], reloc.kernel32.dll_GetStringTypeA
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], reloc.kernel32.dll_CreateProcessA
cmp dword [ebp - 0x3c], 0
jne 0x452fc4
mov eax, str.Ki11Proce_s
movzx esi, ax
mov ecx, esi
call fcn.00405530
test eax, eax
je 0x452fd3
push esi
push eax
lea ecx, [ebp - 0x1c]
call fcn.00404a70
jmp 0x452fd3
push reloc.kernel32.dll_ConvertDefaultLocale
push str.Ki11Proce_s
lea ecx, [ebp - 0x1c]
call fcn.004046b0
mov byte [ebp - 4], reloc.kernel32.dll_WaitForSingleObjectEx
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], reloc.kernel32.dll_CreateNamedPipeA
call fcn.00431c80
mov byte [ebp - 4], reloc.kernel32.dll_SetDllDirectoryA
push dword [ebp - 0x24]
mov edx, eax
lea ecx, [ebp - 0x44]
call fcn.00431be0
push 0x530a74
mov edx, eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], reloc.kernel32.dll_GetComputerNameExA
call fcn.00431c80
lea ecx, [ebp - 0x20]
push ecx
mov edx, eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], reloc.kernel32.dll_WakeConditionVariable
call fcn.00431c80
push dword [ebp + 8]
mov edx, eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], reloc.kernel32.dll_FormatMessageA
call fcn.00431c80
add esp, 0x14
mov byte [ebp - 4], reloc.kernel32.dll_CreateFileA
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x453062
push 0
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [edi + 4]
push eax
call fcn.004018b0
mov byte [ebp - 4], reloc.kernel32.dll_FormatMessageA
mov edx, dword [ebp - 0x34]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x453082
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_WakeConditionVariable
mov edx, dword [ebp - 0x30]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4530a2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_GetComputerNameExA
mov edx, dword [ebp - 0x2c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4530c2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_SetDllDirectoryA
mov edx, dword [ebp - 0x44]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4530e2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_CreateNamedPipeA
mov edx, dword [ebp - 0x48]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x453102
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_WaitForSingleObjectEx
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45311f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_GetStringTypeA
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45313f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_CopyFileA
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45315f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x453182
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
push dword [ebp - 0x28]
push reloc.kernel32.dll_GetLocaleInfoA
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], reloc.kernel32.dll_SetFileAttributesW
cmp dword [ebp - 0x4c], 0
jne 0x4531cf
mov eax, str.Waiting_for_proce_s_to__ign_l:
movzx esi, ax
mov ecx, esi
call fcn.00405530
test eax, eax
je 0x4531dc
push esi
push eax
lea ecx, [ebp - 0x1c]
call fcn.00404a70
jmp 0x4531dc
push str.Waiting_for_proce_s_to__ign_l:
lea ecx, [ebp - 0x1c]
call fcn.004044d0
mov dword [ebp - 4], reloc.kernel32.dll_AddVectoredExceptionHandler
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], reloc.kernel32.dll_LocalReAlloc
cmp dword [ebp - 0x50], 0
jne 0x45321f
mov eax, str.Kil1Proce_s
movzx esi, ax
mov ecx, esi
call fcn.00405530
test eax, eax
je 0x45322e
push esi
push eax
lea ecx, [ebp - 0x20]
call fcn.00404a70
jmp 0x45322e
push reloc.kernel32.dll_ConvertDefaultLocale
push str.Kil1Proce_s
lea ecx, [ebp - 0x20]
call fcn.004046b0
mov byte [ebp - 4], reloc.kernel32.dll_CreateSemaphoreW
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], reloc.kernel32.dll_GetShortPathNameA
call fcn.00431c80
push dword [ebp + 8]
mov edx, eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], reloc.kernel32.dll_GetFileAttributesExW
call fcn.00431c80
add esp, 8
mov byte [ebp - 4], reloc.kernel32.dll_GetTimeFormatW
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x453287
push 0
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [edi + 4]
push eax
call fcn.004018b0
mov byte [ebp - 4], reloc.kernel32.dll_GetFileAttributesExW
mov edx, dword [ebp - 0x54]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4532a7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_GetShortPathNameA
mov edx, dword [ebp - 0x58]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4532c7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_CreateSemaphoreW
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4532e4
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_AddVectoredExceptionHandler
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x453304
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x453327
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
push 0x1f4
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
je 0x45373b
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov eax, str.Timeout_while_w_iting_for_the_proce__:
mov dword [ebp - 4], reloc.kernel32.dll_GetVolumePathNamesForVolumeNameA
test eax, 0xffff0000
jne 0x45337d
movzx esi, ax
mov ecx, esi
call fcn.00405530
test eax, eax
je 0x45338a
push esi
push eax
lea ecx, [ebp - 0x1c]
call fcn.00404a70
jmp 0x45338a
push str.Timeout_while_w_iting_for_the_proce__:
lea ecx, [ebp - 0x1c]
call fcn.004044d0
mov dword [ebp - 4], reloc.kernel32.dll_GetDriveTypeW
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x20], eax
mov eax, str.Ki11Process
mov byte [ebp - 4], reloc.kernel32.dll_PowerCreateRequest
test eax, 0xffff0000
jne 0x4533ce
movzx esi, ax
mov ecx, esi
call fcn.00405530
test eax, eax
je 0x4533dd
push esi
push eax
lea ecx, [ebp - 0x20]
call fcn.00404a70
jmp 0x4533dd
push reloc.kernel32.dll_ConvertDefaultLocale
push str.Ki11Process
lea ecx, [ebp - 0x20]
call fcn.004046b0
mov byte [ebp - 4], reloc.kernel32.dll_GetProcessIoCounters
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], reloc.kernel32.dll_VerSetConditionMask
call fcn.00431c80
push dword [ebp + 8]
mov edx, eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], reloc.kernel32.dll_GetStringTypeExA
call fcn.00431c80
mov ecx, eax
add esp, 8
mov dword [ebp - 0x60], ecx
mov byte [ebp - 4], reloc.kernel32.dll_CreateActCtxW
mov eax, dword [edi]
mov edx, dword [ecx]
mov edi, dword [eax]
lea ecx, [edx - 0x10]
sub edi, 0x10
mov dword [ebp - 0x18], eax
cmp ecx, edi
je 0x45347a
cmp dword [edi + 0xc], 0
jl 0x45346e
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x45346e
call fcn.00404770
mov dword [ebp - 0x5c], eax
mov ecx, ebx
lea edx, [edi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x453464
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + reloc.kernel32.dll_IsBadStringPtrA]
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x18]
add eax, 0x10
mov dword [ecx], eax
jmp 0x45347a
push dword [edx - 0xc]
mov ecx, dword [ebp - 0x18]
push edx
call fcn.004046b0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x453496
push 2
push dword [ebp - 0x60]
lea edx, [ebp - 0x20]
push edx
add eax, 4
push eax
call fcn.004018b0
mov byte [ebp - 4], reloc.kernel32.dll_GetStringTypeExA
mov edx, dword [ebp - 0x64]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4534b6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_VerSetConditionMask
mov edx, dword [ebp - 0x68]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4534d6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_GetProcessIoCounters
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4534f3
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_GetDriveTypeW
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x453513
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x453536
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
push 0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
jne 0x4536fb
mov edx, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [edx + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov eax, str.TerminateProce___f_i1ed_for_the_proce__:
mov dword [ebp - 4], reloc.kernel32.dll_FindFirstFileExW
test eax, 0xffff0000
jne 0x45358f
movzx esi, ax
mov ecx, esi
call fcn.00405530
test eax, eax
je 0x45359c
push esi
push eax
lea ecx, [ebp - 0x1c]
call fcn.00404a70
jmp 0x45359c
push str.TerminateProce___f_i1ed_for_the_proce__:
lea ecx, [ebp - 0x1c]
call fcn.004044d0
mov dword [ebp - 4], reloc.kernel32.dll_GetConsoleScreenBufferInfo
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x20], eax
mov eax, str.Kil1Proces_
mov byte [ebp - 4], reloc.kernel32.dll_HeapSetInformation
test eax, 0xffff0000
jne 0x4535e0
movzx esi, ax
mov ecx, esi
call fcn.00405530
test eax, eax
je 0x4535ef
push esi
push eax
lea ecx, [ebp - 0x20]
call fcn.00404a70
jmp 0x4535ef
push reloc.kernel32.dll_ConvertDefaultLocale
push str.Kil1Proces_
lea ecx, [ebp - 0x20]
call fcn.004046b0
mov byte [ebp - 4], reloc.kernel32.dll_CreateFileMappingA
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x60], esi
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], reloc.kernel32.dll_SetDllDirectoryW
call fcn.00431c80
push dword [ebp + 8]
mov edx, eax
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], reloc.kernel32.dll_SystemTimeToTzSpecificLocalTime
call fcn.00431c80
add esp, 8
mov edi, eax
mov edx, dword [ebp - 0x10]
mov byte [ebp - 4], reloc.kernel32.dll_VerifyVersionInfoW
mov ecx, dword [edx]
push edi
call fcn.00403840
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x453658
push 2
push edi
lea edx, [ebp - 0x20]
push edx
add eax, 4
push eax
call fcn.004018b0
mov byte [ebp - 4], reloc.kernel32.dll_SystemTimeToTzSpecificLocalTime
mov edx, dword [ebp - 0x6c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x453678
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_SetDllDirectoryW
mov edx, dword [ebp - 0x70]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x453698
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_CreateFileMappingA
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4536b5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_GetConsoleScreenBufferInfo
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4536d5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4536f8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov edi, dword [ebp - 0x18]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x24], 5
jge 0x4538d4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 8]
call fcn.00453db0
mov esi, dword [ebp - 0x7c]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x452ee0
jmp 0x453a87
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov eax, str.Fini_hed_w_iting_for_the_process:
mov dword [ebp - 4], reloc.kernel32.dll_DosDateTimeToFileTime
test eax, 0xffff0000
jne 0x453771
movzx esi, ax
mov ecx, esi
call fcn.00405530
test eax, eax
je 0x45377e
push esi
push eax
lea ecx, [ebp - 0x1c]
call fcn.00404a70
jmp 0x45377e
push str.Fini_hed_w_iting_for_the_process:
lea ecx, [ebp - 0x1c]
call fcn.004044d0
mov dword [ebp - 4], reloc.kernel32.dll_ResumeThread
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x20], eax
mov eax, str.Ki1lProcess
mov byte [ebp - 4], reloc.kernel32.dll_RemoveDirectoryW
test eax, 0xffff0000
jne 0x4537c2
movzx esi, ax
mov ecx, esi
call fcn.00405530
test eax, eax
je 0x4537d1
push esi
push eax
lea ecx, [ebp - 0x20]
call fcn.00404a70
jmp 0x4537d1
push reloc.kernel32.dll_ConvertDefaultLocale
push str.Ki1lProcess
lea ecx, [ebp - 0x20]
call fcn.004046b0
mov byte [ebp - 4], reloc.kernel32.dll_SetEvent
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x60], esi
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], reloc.kernel32.dll_SetFileTime
call fcn.00431c80
push dword [ebp + 8]
mov edx, eax
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], reloc.kernel32.dll_MoveFileW
call fcn.00431c80
add esp, 8
mov byte [ebp - 4], reloc.kernel32.dll_FillConsoleOutputAttribute
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x45382a
push 0
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [edi + 4]
push eax
call fcn.004018b0
mov byte [ebp - 4], reloc.kernel32.dll_MoveFileW
mov edx, dword [ebp - 0x74]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45384a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_SetFileTime
mov edx, dword [ebp - 0x78]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45386a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_SetEvent
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x453887
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_ResumeThread
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4538a7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4538ca
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov edi, 1
jmp 0x4536fb
push str.Process:
lea ecx, [ebp - 0x1c]
call fcn.00403790
push str.8re_king_the_1oop
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], reloc.kernel32.dll_GetCurrentDirectoryW
call fcn.00403790
push str.Ki1lProcess
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], reloc.kernel32.dll_MapViewOfFile
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_SuspendThread
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x7c], esi
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x7c]
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], reloc.kernel32.dll_AcquireSRWLockShared
call fcn.00431c80
push 0x530a74
mov edx, eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], reloc.kernel32.dll_UnlockFile
call fcn.00431c80
lea ecx, [ebp - 0x1c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], reloc.kernel32.dll_GetFileInformationByHandle
call fcn.00431c80
push dword [ebp + 8]
mov edx, eax
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], reloc.kernel32.dll_GetFinalPathNameByHandleW
call fcn.00431c80
add esp, 0x10
mov edx, dword [ebp - 0x10]
mov byte [ebp - 4], reloc.kernel32.dll_UnlockFileEx
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x453987
push 0
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edx + 4]
push eax
call fcn.004018b0
mov byte [ebp - 4], reloc.kernel32.dll_GetFinalPathNameByHandleW
mov edx, dword [ebp - 0x78]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4539a7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_GetFileInformationByHandle
mov edx, dword [ebp - 0x74]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4539c7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_UnlockFile
mov edx, dword [ebp - 0x70]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4539e7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_AcquireSRWLockShared
mov edx, dword [ebp - 0x6c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x453a07
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_SuspendThread
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x453a24
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_MapViewOfFile
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x453a44
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_GetCurrentDirectoryW
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x453a64
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x453a87
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov eax, str.Proce_s:
mov dword [ebp - 4], reloc.kernel32.dll_FindFirstFileExA
test eax, 0xffff0000
jne 0x453ac7
movzx esi, ax
mov ecx, esi
call fcn.00405530
test eax, eax
je 0x453ad4
push esi
push eax
lea ecx, [ebp - 0x18]
call fcn.00404a70
jmp 0x453ad4
push str.Proce_s:
lea ecx, [ebp - 0x18]
call fcn.004044d0
mov dword [ebp - 4], reloc.kernel32.dll_FlushViewOfFile
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov eax, str._iterations
mov byte [ebp - 4], reloc.kernel32.dll_SystemTimeToFileTime
test eax, 0xffff0000
jne 0x453b18
movzx esi, ax
mov ecx, esi
call fcn.00405530
test eax, eax
je 0x453b25
push esi
push eax
lea ecx, [ebp - 0x1c]
call fcn.00404a70
jmp 0x453b25
push str._iterations
lea ecx, [ebp - 0x1c]
call fcn.004044d0
mov byte [ebp - 4], reloc.kernel32.dll_ReleaseSRWLockExclusive
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x20], eax
mov eax, str.Ended_the_loop_after
mov byte [ebp - 4], reloc.kernel32.dll_GetEnvironmentStrings
test eax, 0xffff0000
jne 0x453b66
movzx esi, ax
mov ecx, esi
call fcn.00405530
test eax, eax
je 0x453b73
push esi
push eax
lea ecx, [ebp - 0x20]
call fcn.00404a70
jmp 0x453b73
push str.Ended_the_loop_after
lea ecx, [ebp - 0x20]
call fcn.004044d0
push str.Kil1Proces_
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], reloc.kernel32.dll_EnumSystemLocalesA
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_CloseThreadpoolTimer
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x7c], esi
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x7c]
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], reloc.kernel32.dll_GetCurrentThread
call fcn.00431c80
mov byte [ebp - 4], reloc.kernel32.dll_GetLocaleInfoA
push dword [ebp - 0x24]
mov edx, eax
lea ecx, [ebp - 0x80]
call fcn.00431be0
lea ecx, [ebp - 0x1c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], reloc.kernel32.dll_RemoveDirectoryA
call fcn.00431c80
push 0x530a74
mov edx, eax
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], reloc.kernel32.dll_SetFileApisToOEM
call fcn.00431c80
lea ecx, [ebp - 0x18]
push ecx
mov edx, eax
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], reloc.kernel32.dll_FileTimeToSystemTime
call fcn.00431c80
push dword [ebp + 8]
mov edx, eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], reloc.kernel32.dll_DebugBreak
call fcn.00431c80
add esp, 0x18
mov edx, dword [ebp - 0x10]
mov byte [ebp - 4], reloc.kernel32.dll_GetUserDefaultUILanguage
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x453c2b
push 0
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [edx + 4]
push eax
call fcn.004018b0
mov byte [ebp - 4], reloc.kernel32.dll_DebugBreak
mov edx, dword [ebp - 0x60]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x453c4b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_FileTimeToSystemTime
mov edx, dword [ebp - 0x5c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x453c6b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_SetFileApisToOEM
mov edx, dword [ebp - 0x50]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x453c8b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_RemoveDirectoryA
mov edx, dword [ebp - 0x4c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x453cab
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_GetLocaleInfoA
mov edx, dword [ebp - 0x80]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x453ccb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_GetCurrentThread
mov edx, dword [ebp - 0x84]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x453cee
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_CloseThreadpoolTimer
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x453d0b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_EnumSystemLocalesA
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x453d2b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_ReleaseSRWLockExclusive
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x453d4b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_FlushViewOfFile
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x453d6b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x453d8c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
xor eax, eax
cmp edi, 1
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4