Function at 0x463f40
Capabilities:
Create process on windows
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af34b
mov eax, dword fs:[0]
push eax
sub esp, 0x540
mov eax, dword [0x4e54fc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x518], edi
cmp dword [ebp + 0x1c], 0
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x51c], edx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x524], esi
mov dword [ebp - 0x528], 0
jne 0x465643
mov ecx, dword [ebp + 0xc]
cmp ecx, 0x470
jne 0x463fcb
lea eax, [ebp - 0x520]
push eax
push edx
push dword [ebp + 0x10]
push ecx
mov ecx, edi
call fcn.0045b800
mov dword [esi], eax
mov eax, 1
jmp 0x465645
mov eax, dword [ebp + 0x10]
cmp ecx, 0x46e
jne 0x464012
cmp byte [edi + 0x32d], 0
jne 0x463ff9
push eax
push 0x100
push 0x40b
push dword [edi + 0x204]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp + 0x10]
push eax
call fcn.0047dfa3
add esp, 4
mov dword [esi], 0
mov eax, 1
jmp 0x465645
cmp ecx, 5
jne 0x464058
cmp eax, 1
je 0x46402b
push 1
mov ecx, edi
call fcn.004683c0
mov edx, dword [ebp - 0x51c]
cmp dword [edi + 0x2e8], 0
je 0x46404d
mov eax, edx
lea ecx, [edi + 0x250]
shr eax, 0x10
cwde
push 1
sub eax, 0xc8
push eax
call fcn.00466c80
mov dword [esi], 0
jmp 0x4640f7
cmp ecx, 1
jne 0x46407c
lea eax, [ebp - 0x520]
push eax
push edx
push dword [ebp + 0x10]
push ecx
mov ecx, edi
call fcn.0045c450
mov dword [esi], eax
mov eax, 1
jmp 0x465645
cmp ecx, 2
jne 0x4640ae
lea ecx, [ebp - 0x520]
mov dword [ebp - 0x520], 1
push ecx
push edx
push eax
push 2
mov ecx, edi
call fcn.0045d780
cmp dword [ebp - 0x520], 0
mov dword [esi], eax
jne 0x464008
jmp 0x4640f7
cmp ecx, 0x10
jne 0x4640eb
mov eax, dword [edi + 0x318]
nop
cmp eax, 1
jle 0x46404d
push 0
push 0x8033
push 0x111
mov byte [edi + 0x32c], 1
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [esi], 0
mov eax, 1
jmp 0x465645
cmp ecx, 0x11f
je 0x464384
mov eax, dword fs:[0x2c]
mov ecx, dword [0x4fcc44]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x4fc948]
cmp eax, dword [ecx + 0xc]
jg 0x46567f
mov edx, dword [ebp + 0xc]
cmp edx, dword [0x4fc944]
jne 0x464218
mov edx, dword [edi + 0x320]
test byte [edx + 0x30], 0x40
je 0x46414c
mov dword [edi + 0x320], 0
mov eax, 1
mov dword [esi], 0
jmp 0x465645
mov edx, dword [edx + 0x34]
lea eax, [edi + 0x324]
test edx, edx
jne 0x46415d
xor ecx, ecx
jmp 0x46417b
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x54], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x464165
sub ecx, dword [ebp - 0x54]
lea eax, [edi + 0x324]
sar ecx, 1
push ecx
push edx
mov ecx, eax
call fcn.004056b0
push 0
push 0
push 0x1304
push dword [edi + 0xa8]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4641f9
cmp byte [edi + 0x32c], 0
jne 0x4641f9
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], 8
push eax
push dword [edi + 0xd4]
xorps xmm0, xmm0
push 0x133c
push dword [edi + 0xa8]
movlpd qword [ebp - 0xa0], xmm0
movlpd qword [ebp - 0x98], xmm0
movlpd qword [ebp - 0x90], xmm0
movlpd qword [ebp - 0x88], xmm0
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x84]
jmp 0x4641fb
xor ecx, ecx
push 0
push dword [edi + 0x320]
call fcn.00474f10
mov dword [esi], 0
mov eax, 1
jmp 0x465645
cmp edx, 0x4e
jne 0x4642ce
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 8], 0xfffffd1b
jne 0x4652ff
push 0
push 0
push 0x1304
push dword [edi + 0xa8]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x464384
cmp byte [edi + 0x32c], 0
jne 0x464384
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], 8
push eax
push dword [edi + 0xd4]
xorps xmm0, xmm0
push 0x133c
push dword [edi + 0xa8]
movlpd qword [ebp - 0xa0], xmm0
movlpd qword [ebp - 0x98], xmm0
movlpd qword [ebp - 0x90], xmm0
movlpd qword [ebp - 0x88], xmm0
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x84]
test ecx, ecx
je 0x464384
push 1
call fcn.00475c50
mov dword [esi], 0
mov eax, 1
jmp 0x465645
cmp edx, 0x111
jne 0x4651f6
mov ecx, dword [ebp + 0x10]
movzx eax, cx
mov dword [ebp - 0x520], 0x8033
mov edx, eax
cmp word [ebp - 0x520], ax
jne 0x464394
cmp byte [edi + 0x32d], 0
jne 0x464384
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x4c7a1c
push 0x115
push 0x40b
push dword [edi + 0x204]
call esi
push 0
push 0
lea ecx, [edi + 0x40]
mov byte [edi + 0x32d], 1
push 0x8033
call fcn.00467c10
push 1
call fcn.0041dc70
add esp, 4
push str.Cancelling...
push 0x100
push 0x40b
push dword [edi + 0x204]
call esi
mov esi, dword [edi + 0x308]
mov eax, dword [edi + 0x30c]
mov edi, eax
cmp esi, edi
je 0x46437e
nop
mov ecx, dword [esi]
call fcn.00474c60
add esi, 4
cmp esi, edi
jne 0x464370
mov esi, dword [ebp - 0x524]
mov dword [esi], 0
mov eax, 1
jmp 0x465645
mov eax, 0x8037
cmp ax, dx
jne 0x4643ba
push dword [edi + 0x2b8]
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [esi], 0
mov eax, 1
jmp 0x465645
mov eax, 0xe124
cmp ax, dx
jne 0x4643ed
lea eax, [ebp - 0x520]
shr ecx, 0x10
push eax
push dword [ebp - 0x51c]
push 0xe124
push ecx
mov ecx, edi
call fcn.0045e2d0
mov dword [esi], eax
mov eax, 1
jmp 0x465645
mov eax, 0x803d
cmp ax, dx
jne 0x4644b2
cmp dword [edi + 0x320], 0
je 0x464384
push 0
push 0
push 0x1304
push dword [edi + 0xa8]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x464494
cmp byte [edi + 0x32c], 0
jne 0x464494
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], 8
push eax
push dword [edi + 0xd4]
xorps xmm0, xmm0
push 0x133c
push dword [edi + 0xa8]
movlpd qword [ebp - 0xa0], xmm0
movlpd qword [ebp - 0x98], xmm0
movlpd qword [ebp - 0x90], xmm0
movlpd qword [ebp - 0x88], xmm0
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x84]
push 0
push dword [edi + 0x320]
call fcn.00474f10
mov dword [esi], 0
mov eax, 1
jmp 0x465645
xor ecx, ecx
push ecx
push dword [edi + 0x320]
call fcn.00474f10
mov dword [esi], 0
mov eax, 1
jmp 0x465645
mov eax, 0x8041
cmp ax, dx
jne 0x46457c
cmp dword [edi + 0x320], 0
je 0x464384
push 0
push 0
push 0x1304
push dword [edi + 0xa8]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x46455d
cmp byte [edi + 0x32c], 0
jne 0x46455d
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], 8
push eax
push dword [edi + 0xd4]
xorps xmm0, xmm0
push 0x133c
push dword [edi + 0xa8]
movlpd qword [ebp - 0xa0], xmm0
movlpd qword [ebp - 0x98], xmm0
movlpd qword [ebp - 0x90], xmm0
movlpd qword [ebp - 0x88], xmm0
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x84]
push 1
push dword [edi + 0x320]
call fcn.00474f10
mov dword [esi], 0
mov eax, 1
jmp 0x465645
push 1
push dword [edi + 0x320]
xor ecx, ecx
call fcn.00474f10
mov dword [esi], 0
mov eax, 1
jmp 0x465645
mov eax, 0xe803
cmp ax, dx
jne 0x4645ba
cmp byte [edi + 0x32d], 0
jne 0x464384
mov eax, dword [edi + 0x318]
nop
cmp eax, 1
jg 0x464384
mov ecx, edi
call fcn.004557a0
mov dword [esi], 0
mov eax, 1
jmp 0x465645
lea eax, [edx + 0x100]
mov dword [ebp - 0x520], 0xfd
cmp ax, word [ebp - 0x520]
ja 0x4645f5
lea eax, [edx - 0xff00]
lea ecx, [edi + 0x84]
push eax
call fcn.00466870
mov dword [esi], 0
mov eax, 1
jmp 0x465645
mov eax, 0x8008
cmp ax, dx
jne 0x4646df
push 0
push 0x800a
push eax
lea ecx, [edi + 0x40]
push eax
call fcn.00467e00
call fcn.00458bd0
mov dword [ebp - 0x518], eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x68]
push 0x4b571c
push ecx
mov ecx, eax
call fcn.0046f270
lea eax, [ebp - 0x68]
mov dword [ebp - 0x528], 1
push str.LightTheme
push eax
call fcn.004101c0
mov ecx, 1
mov byte [ebp - 0x511], al
mov dword [ebp - 0x528], ecx
add esp, 8
and ecx, 0xfffffffe
mov dword [ebp - 0x528], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.00402b30
cmp byte [ebp - 0x511], 0
jne 0x464384
push str.LightTheme
lea ecx, [ebp - 0x80]
call fcn.004026f0
mov dword [ebp - 4], 2
lea eax, [ebp - 0x80]
cmp dword [ebp - 0x6c], 8
mov ecx, dword [ebp - 0x518]
cmovae eax, dword [ebp - 0x80]
push eax
push 0x4b571c
call fcn.0046fca0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.00402b30
mov ecx, dword [ebp - 0x518]
push 0
call fcn.0046fb50
call fcn.0043cea0
test al, al
jmp 0x464918
mov eax, 0x8009
cmp ax, dx
jne 0x464830
push 0
call fcn.0047be90
add esp, 4
cmp eax, 0x4563
jb 0x46480b
push 0
push 0x800a
push 0x8008
lea ecx, [edi + 0x40]
push 0x8009
call fcn.00467e00
call fcn.00458bd0
mov dword [ebp - 0x518], eax
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x68]
push 0x4b571c
push ecx
mov ecx, eax
call fcn.0046f270
lea eax, [ebp - 0x68]
mov dword [ebp - 0x528], 2
push str.DarkTheme
push eax
call fcn.004101c0
mov ecx, 2
mov byte [ebp - 0x511], al
mov dword [ebp - 0x528], ecx
add esp, 8
and ecx, 0xfffffffd
mov dword [ebp - 0x528], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.00402b30
cmp byte [ebp - 0x511], 0
jne 0x464002
push str.DarkTheme
lea ecx, [ebp - 0x80]
call fcn.004026f0
mov dword [ebp - 4], 4
lea eax, [ebp - 0x80]
cmp dword [ebp - 0x6c], 8
mov ecx, dword [ebp - 0x518]
cmovae eax, dword [ebp - 0x80]
push eax
push 0x4b571c
call fcn.0046fca0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.00402b30
mov ecx, dword [ebp - 0x518]
push 0
call fcn.0046fb50
call fcn.0043cea0
test al, al
jne 0x464002
push 0
push 0
push 0x10
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.0046e840
mov dword [esi], 0
mov eax, 1
jmp 0x465645
push 0x10
push 0x4b4b70
push str.The_dark_theme_requires_Windows_10__version_1809_or_higher.
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [esi], 0
mov eax, 1
jmp 0x465645
mov eax, 0x800a
cmp ax, dx
jne 0x464942
push 0
push eax
push 0x8008
lea ecx, [edi + 0x40]
push eax
call fcn.00467e00
call fcn.00458bd0
mov dword [ebp - 0x518], eax
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x68]
push 0x4b571c
push ecx
mov ecx, eax
call fcn.0046f270
cmp dword [ebp - 0x58], 0
mov eax, 4
mov dword [ebp - 0x528], 4
mov dword [ebp - 0x528], eax
setne byte [ebp - 0x511]
and eax, 0xfffffffb
mov dword [ebp - 0x528], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.00402b30
cmp byte [ebp - 0x511], 0
je 0x464384
push 0x4c7a1c
lea ecx, [ebp - 0x80]
call fcn.004026f0
mov dword [ebp - 4], 6
lea eax, [ebp - 0x80]
cmp dword [ebp - 0x6c], 8
mov ecx, dword [ebp - 0x518]
cmovae eax, dword [ebp - 0x80]
push eax
push 0x4b571c
call fcn.0046fca0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.00402b30
mov ecx, dword [ebp - 0x518]
push 0
call fcn.0046fb50
call fcn.00466ef0
mov byte [ebp - 0x511], al
call fcn.0043cea0
cmp al, byte [ebp - 0x511]
je 0x464384
push 0
push 0
push 0x10
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.0046e840
mov dword [esi], 0
mov eax, 1
jmp 0x465645
mov eax, 0x802a
cmp ax, dx
jne 0x4649f8
call fcn.00458bd0
mov esi, eax
push str.AlwaysOnTop
mov ecx, esi
call fcn.0044f310
neg eax
lea ecx, [ebp - 0x80]
push str.AlwaysOnTop
sbb eax, eax
inc eax
mov dword [ebp - 0x54], eax
call fcn.004026f0
mov dword [ebp - 4], 7
lea eax, [ebp - 0x54]
push 3
push eax
lea eax, [ebp - 0x80]
mov ecx, esi
push eax
call fcn.0044f3c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.00402b30
push str.AlwaysOnTop
mov ecx, esi
call fcn.0044f310
push 3
push 0
xor ecx, ecx
mov esi, eax
push 0
push 0
test esi, esi
push 0
setne cl
add ecx, 0xfffffffe
push ecx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
xor eax, eax
lea ecx, [edi + 0x40]
test esi, esi
push 0
setne al
push eax
push 0x802a
call fcn.00467d00
mov eax, dword [ebp - 0x524]
mov dword [eax], 0
mov eax, 1
jmp 0x465645
mov eax, 0x802b
cmp ax, dx
jne 0x464a97
call fcn.00458bd0
mov edi, eax
push str.HideEmptyEntries
mov ecx, edi
call fcn.0044f310
neg eax
lea ecx, [ebp - 0x80]
push str.HideEmptyEntries
sbb eax, eax
inc eax
mov dword [ebp - 0x54], eax
call fcn.004026f0
mov dword [ebp - 4], 8
lea eax, [ebp - 0x54]
push 3
push eax
lea eax, [ebp - 0x80]
mov ecx, edi
push eax
call fcn.0044f3c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.00402b30
mov esi, dword [ebp - 0x518]
mov ecx, edi
push 0
push str.HideEmptyEntries
call fcn.0044f310
push eax
push 0x802b
lea ecx, [esi + 0x40]
call fcn.00467d00
mov ecx, esi
add ecx, 0x3c
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov eax, dword [ebp - 0x524]
mov dword [eax], 0
mov eax, 1
jmp 0x465645
mov eax, 0x802d
cmp ax, dx
jne 0x464b0f
call fcn.00458bd0
mov edi, eax
push str.HideWindowsEntries
mov ecx, edi
call fcn.0044f310
neg eax
lea ecx, [ebp - 0x80]
push str.HideWindowsEntries
sbb eax, eax
inc eax
mov dword [ebp - 0x54], eax
call fcn.004026f0
mov dword [ebp - 4], 9
lea eax, [ebp - 0x54]
push 3
push eax
lea eax, [ebp - 0x80]
mov ecx, edi
push eax
call fcn.0044f3c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.00402b30
mov esi, dword [ebp - 0x518]
mov ecx, edi
push 0
push str.HideWindowsEntries
call fcn.0044f310
push eax
push 0x802d
jmp 0x464a6f
mov eax, 0x802c
cmp ax, dx
jne 0x464c33
call fcn.00458bd0
push str.HideMicrosoftEntries
mov ecx, eax
mov dword [ebp - 0x518], eax
call fcn.0044f310
neg eax
lea ecx, [ebp - 0x80]
push str.HideMicrosoftEntries
sbb eax, eax
inc eax
mov dword [ebp - 0x54], eax
call fcn.004026f0
mov dword [ebp - 4], 0xa
lea eax, [ebp - 0x54]
mov ecx, dword [ebp - 0x518]
push 3
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.0044f3c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.00402b30
mov ecx, dword [ebp - 0x518]
push 0
push str.HideMicrosoftEntries
call fcn.0044f310
push eax
push 0x802c
lea ecx, [edi + 0x40]
call fcn.00467d00
mov ecx, dword [ebp - 0x518]
push str.HideMicrosoftEntries
call fcn.0044f310
test eax, eax
je 0x464c05
push str.HideWindowsEntries
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x54], 1
call fcn.004026f0
mov dword [ebp - 4], 0xb
lea eax, [ebp - 0x54]
mov ecx, dword [ebp - 0x518]
push 3
push eax
lea eax, [ebp - 0x98]
push eax
call fcn.0044f3c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.00402b30
push 0
push 1
push 0x802d
lea ecx, [edi + 0x40]
call fcn.00467d00
xor eax, eax
jmp 0x464c0a
mov eax, 1
push 0
push eax
push 0x802d
lea ecx, [edi + 0x40]
call fcn.00467c10
mov eax, dword [edi + 0x3c]
lea ecx, [edi + 0x3c]
call dword [eax + 0x2c]
mov dword [esi], 0
mov eax, 1
jmp 0x465645
mov eax, 0x802e
cmp ax, dx
jne 0x464cb4
call fcn.00458bd0
mov edi, eax
push str.HideVirusTotalCleanEntries
mov ecx, edi
call fcn.0044f310
neg eax
lea ecx, [ebp - 0x98]
push str.HideVirusTotalCleanEntries
sbb eax, eax
inc eax
mov dword [ebp - 0x54], eax
call fcn.004026f0
mov dword [ebp - 4], 0xc
lea eax, [ebp - 0x54]
push 3
push eax
lea eax, [ebp - 0x98]
mov ecx, edi
push eax
call fcn.0044f3c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.00402b30
mov esi, dword [ebp - 0x518]
mov ecx, edi
push 0
push str.HideVirusTotalCleanEntries
call fcn.0044f310
push eax
push 0x802e
jmp 0x464a6f
mov eax, 0x802f
cmp ax, dx
jne 0x464ce7
lea eax, [ebp - 0x520]
shr ecx, 0x10
push eax
push dword [ebp - 0x51c]
push 0x802f
push ecx
mov ecx, edi
call fcn.004605f0
mov dword [esi], eax
mov eax, 1
jmp 0x465645
mov eax, 0x8030
cmp ax, dx
jne 0x464d1a
lea eax, [ebp - 0x520]
shr ecx, 0x10
push eax
push dword [ebp - 0x51c]
push 0x8030
push ecx
mov ecx, edi
call fcn.0045fc60
mov dword [esi], eax
mov eax, 1
jmp 0x465645
mov eax, 0xe141
cmp ax, dx
jne 0x464d43
push 0
push 0
push 0x10
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [esi], 0
mov eax, 1
jmp 0x465645
mov eax, 0x801d
cmp ax, dx
jne 0x464d79
push 1
push 0
push 0
push str.https:__docs.microsoft.com_en_us_sysinternals_downloads_autoruns
push str.open
push dword [ebp - 0x51c]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [esi], 0
mov eax, 1
jmp 0x465645
mov eax, 0xe140
cmp ax, dx
jne 0x464ec5
lea eax, [ebp - 0x544]
mov dword [ebp - 0x548], 0
mov dword [ebp - 0x52c], eax
mov dword [ebp - 0x538], 0
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x534], 0
mov dword [ebp - 0x530], 0
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x54c], 0x4b52c8
mov dword [ebp - 4], 0x12
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, eax
mov eax, dword [ebp - 0x538]
test eax, eax
jne 0x464e08
call fcn.0047c2a0
mov dword [ebp - 0x538], eax
test eax, eax
jne 0x464e08
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x464e87
push 0
push 0
push eax
call fcn.0047c3a2
lea eax, [ebp - 0x54c]
mov dword [ebp - 0x544], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x540], eax
mov dword [ebp - 0x58], 0x4e6144
mov byte [ebp - 0x54], 0
mov byte [ebp - 4], 0x13
push 0x4e6144
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4e615c]
mov dword [ebp - 0x53c], eax
lea eax, [ebp - 0x544]
mov byte [ebp - 0x54], 1
mov dword [0x4e615c], eax
mov byte [ebp - 4], 0x12
push 0x4e6144
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0x4670b0
push edi
push 0x64
push dword [0x4fc9c0]
mov byte [ebp - 0x54], 0
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x544]
mov dword [ebp - 0x52c], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x538]
test eax, eax
je 0x464384
push eax
call fcn.0047c34c
mov dword [esi], 0
mov eax, 1
jmp 0x465645
mov eax, 0x801f
cmp ax, dx
jne 0x464f02
call fcn.0046e8b0
mov byte [ebp - 0x511], al
test al, al
je 0x464ef3
push 0
push 0
push 0x10
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov al, byte [ebp - 0x511]
movzx eax, al
mov dword [esi], eax
mov eax, 1
jmp 0x465645
mov eax, 0xe103
cmp ax, dx
jne 0x464f35
lea eax, [ebp - 0x520]
shr ecx, 0x10
push eax
push dword [ebp - 0x51c]
push 0xe103
push ecx
mov ecx, edi
call fcn.0045e070
mov dword [esi], eax
mov eax, 1
jmp 0x465645
mov eax, 0xe101
cmp ax, dx
jne 0x465098
mov ax, word [0x4b5d3c]
movups xmm0, xmmword [str.Computer]
push 0x2e
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x3e]
push 0
push eax
movups xmmword [ebp - 0x50], xmm0
call fcn.0047f8f0
add esp, 0xc
mov dword [ebp - 0x54], 0x20
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov esi, dword [edi + 4]
lea eax, [ebp - 0x510]
push 0x58
push 0
push eax
mov dword [ebp - 0x4b8], 1
call fcn.0047f8f0
lea eax, [ebp - 0x2b4]
mov dword [ebp - 0x510], 0x58
mov dword [ebp - 0x4f4], eax
lea eax, [ebp - 0x4b4]
mov dword [ebp - 0x4ec], eax
mov eax, dword [0x4fc9c0]
mov dword [ebp - 0x508], eax
xor eax, eax
mov word [ebp - 0x2b4], ax
mov word [ebp - 0x4b4], ax
lea eax, [ebp - 0x50]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x2b4]
mov dword [ebp - 0x4f0], 0x104
push 0x104
push eax
mov dword [ebp - 0x4d4], 0x4b5db0
mov dword [ebp - 0x4e8], 0x100
mov dword [ebp - 0x4dc], 0x881000
mov dword [ebp - 0x504], str.Autoruns_files__.arn_
mov dword [ebp - 0x50c], esi
call fcn.0048d34b
push eax
call fcn.00406930
add esp, 0x20
mov dword [ebp - 0x4e0], str.Open_Autoruns_Scan
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp dword [ebp - 0x50c], 0
jne 0x46504e
mov dword [ebp - 0x50c], eax
cmp dword [ebp - 0x4b8], 0
lea eax, [ebp - 0x510]
push eax
je 0x465066
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
jmp 0x46506c
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
test eax, eax
je 0x46437e
lea eax, [ebp - 0x2b4]
mov ecx, edi
push eax
call fcn.00460a50
mov esi, dword [ebp - 0x524]
mov eax, 1
mov dword [esi], 0
jmp 0x465645
mov eax, 0x8007
cmp ax, dx
jne 0x4650cb
lea eax, [ebp - 0x520]
shr ecx, 0x10
push eax
push dword [ebp - 0x51c]
push 0x8007
push ecx
mov ecx, edi
call fcn.0045f910
mov dword [esi], eax
mov eax, 1
jmp 0x465645
mov dword [ebp - 0x520], 0x8029
mov eax, edx
cmp word [ebp - 0x520], dx
jne 0x465109
lea eax, [ebp - 0x520]
shr ecx, 0x10
push eax
push dword [ebp - 0x51c]
push 0x8029
push ecx
mov ecx, edi
call fcn.0045db20
mov dword [esi], eax
mov eax, 1
jmp 0x465645
lea eax, [edx - 0x1388]
cmp ax, 0x63
ja 0x465304
mov eax, dword [edi + 0x7c]
mov ecx, edx
add eax, 0x1388
cmp ecx, eax
je 0x4651b0
mov eax, dword [edi + 0x318]
nop
cmp eax, 1
jle 0x465167
mov ecx, dword [edi + 4]
push 0x30
push ecx
mov eax, esp
push ecx
mov dword [eax], 0x81
mov eax, esp
push ecx
mov dword [eax], str.Cannot_switch_profiles_while_scanning._Wait_or_cancel_the_scan.
call fcn.004432e0
add esp, 0x10
mov dword [esi], 0
mov eax, 1
jmp 0x465645
lea eax, [ecx - 0x1388]
mov ecx, edi
push eax
call fcn.00467340
test al, al
jne 0x4651a9
mov ecx, dword [edi + 4]
push 0x40
push ecx
mov eax, esp
push ecx
mov dword [eax], 0x10
mov eax, esp
push ecx
mov dword [eax], str.Error_loading_profile.
call fcn.004432e0
add esp, 0x10
mov dword [esi], 0
mov eax, 1
jmp 0x465645
mov ecx, edi
call fcn.004557a0
mov ecx, dword [edi + 0x74]
mov eax, 0x38e38e39
sub ecx, dword [edi + 0x70]
imul ecx
push 0
sar edx, 4
lea ecx, [edi + 0x40]
mov eax, edx
add edx, 0x1387
shr eax, 0x1f
add eax, edx
push eax
mov eax, dword [edi + 0x7c]
push 0x1388
add eax, 0x1388
push eax
call fcn.00467e00
mov dword [esi], 0
mov eax, 1
jmp 0x465645
cmp edx, 0x18
jne 0x4652fa
cmp byte [0x4fc93c], 0
jne 0x464002
mov byte [0x4fc93c], 1
call fcn.00458bd0
push str.MainWindowPlacement
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x518], eax
call fcn.004026f0
mov dword [ebp - 4], 0x19
lea eax, [ebp - 0x80]
mov ecx, dword [ebp - 0x518]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.00450170
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x524], eax
cmp byte [eax + 0xd], 0
jne 0x465278
cmp dword [eax + 0x24], 8
lea ecx, [eax + 0x10]
jb 0x46525f
mov ecx, dword [ecx]
cmp dword [ebp - 0x6c], 8
lea eax, [ebp - 0x80]
push ecx
cmovae eax, dword [ebp - 0x80]
push eax
call fcn.0048cccb
add esp, 8
test eax, eax
jns 0x465286
mov eax, dword [ebp - 0x518]
mov eax, dword [eax]
mov dword [ebp - 0x524], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.00402b30
mov ecx, dword [ebp - 0x524]
mov eax, dword [ecx + 0x44]
movups xmm1, xmmword [eax]
movups xmmword [ebp - 0xac], xmm1
movups xmm0, xmmword [eax + 0x10]
psrldq xmm1, 8
movups xmmword [ebp - 0x9c], xmm0
movq xmm0, qword [eax + 0x20]
movq qword [ebp - 0x8c], xmm0
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x84], eax
movd eax, xmm1
test eax, eax
je 0x464002
lea eax, [ebp - 0xac]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowPlacement]
mov dword [esi], 0
mov eax, 1
jmp 0x465645
mov ecx, dword [ebp + 0x10]
jmp 0x465307
mov ecx, dword [ebp + 0x10]
jmp 0x46530d
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x51c]
mov esi, dword [ebp - 0x524]
cmp edx, 0x117
jne 0x465354
lea edx, [ebp - 0x518]
mov dword [ebp - 0x518], 1
push edx
push eax
push ecx
push 0x117
lea ecx, [edi + 0x40]
call fcn.0045f0b0
cmp dword [ebp - 0x518], 0
mov dword [esi], eax
je 0x465470
mov eax, 1
jmp 0x465645
cmp edx, 0x111
jne 0x4653fb
cmp byte [edi + 0x56], 0
je 0x4653ca
mov eax, ecx
shr eax, 0x10
cmp eax, 1
jne 0x4653ca
mov edx, dword [edi + 0x50]
movzx eax, cx
mov ecx, dword [edi + 0x4c]
mov dword [ebp - 0x520], eax
test edx, edx
je 0x4653ca
movzx eax, word [ecx]
mov dword [ebp - 0x524], 0xffff
cmp ax, word [ebp - 0x524]
je 0x4653ca
nop dword [eax]
cmp word [ebp - 0x520], ax
je 0x4653e4
movzx eax, word [ecx + 4]
add ecx, 4
mov edi, eax
add edx, 8
mov dword [ebp - 0x52c], edi
mov edi, dword [ebp - 0x518]
cmp ax, word [ebp - 0x524]
jne 0x4653a0
xor eax, eax
mov dword [esi], 0
test eax, eax
je 0x465470
mov eax, 1
jmp 0x465645
movzx eax, word [edx]
mov ecx, 1
test eax, 0x100
mov eax, 0
cmovne eax, ecx
jmp 0x4653cc
cmp edx, 5
jne 0x465416
cmp ecx, 1
je 0x46540e
push 1
mov ecx, edi
call fcn.004683c0
mov dword [esi], 1
jmp 0x465470
cmp edx, 0x4e
jne 0x465470
mov edx, dword [eax + 8]
cmp edx, 0xfffffcbe
jne 0x46543f
push 0
mov ecx, edi
call fcn.004683c0
mov dword [esi], 0
mov eax, 1
jmp 0x465645
cmp edx, 0xfffffcb7
jne 0x465470
lea edx, [ebp - 0x518]
mov dword [ebp - 0x518], 1
push edx
push eax
push ecx
mov ecx, edi
call fcn.0045bd40
cmp dword [ebp - 0x518], 0
mov dword [esi], eax
jne 0x464008
mov eax, dword [ebp + 0xc]
mov ecx, edi
push 0
push esi
push dword [ebp - 0x51c]
push dword [ebp + 0x10]
push eax
push dword [ebp - 0x54]
call fcn.004621e0
test eax, eax
jne 0x464008
mov eax, dword [ebp + 0xc]
cmp eax, 0x111
jne 0x4654fb
push dword [edi + 0x88]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4654f8
mov eax, dword [edi + 0xd4]
test eax, eax
js 0x4654f8
push eax
lea ecx, [edi + 0x84]
call fcn.00459190
push 1
push esi
push dword [ebp - 0x51c]
mov ecx, dword [eax]
push dword [ebp + 0x10]
push 0x111
mov edx, dword [ecx]
mov ecx, eax
push dword [ebp - 0x54]
call edx
test eax, eax
jne 0x464008
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x518], 1
add eax, 0xffffffd5
jmp 0x465524
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x518], 1
cmp eax, 0x132
ja 0x4655c1
je case.0x4655d8.307
add eax, 0xffffffd5
cmp eax, 0xea
ja case.0x4655d8.313
movzx eax, byte [eax + 0x4656ec]
jmp dword [eax*4 + 0x4656cc]
mov ecx, dword [ebp - 0x51c]
xor eax, eax
test ecx, ecx
mov edx, ecx
cmove edx, eax
jmp 0x465618
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx]
jmp 0x465618
mov eax, dword [ebp + 0x10]
test eax, eax
je case.0x4655d8.313
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x14]
jmp 0x46561b
cmp dword [ebp + 0x10], 0
je case.0x4655d8.313
mov eax, dword [ebp - 0x51c]
push dword [eax + 4]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [ebp - 0x51c]
mov edx, eax
jmp 0x465618
mov eax, dword [ebp + 0x10]
test eax, eax
je case.0x4655d8.313
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 8]
jmp 0x46561b
mov eax, dword [ebp + 0x10]
test eax, eax
je case.0x4655d8.313
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0xc]
jmp 0x46561b
add eax, 0xfffffecd
cmp eax, 0xdd
ja case.0x4655d8.313
movzx eax, byte [eax + 0x4657e4]
jmp dword [eax*4 + 0x4657d8]
mov eax, dword [ebp + 0x10]
movzx ecx, ax
sub ecx, 1
je 0x465606
sub ecx, 1
je 0x465606
shr eax, 0x10
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [ebp - 0x51c]
mov edx, eax
jmp 0x465618
mov ecx, dword [ebp - 0x51c]
mov edx, ecx
jmp 0x46561b
mov ecx, dword [ebp - 0x51c]
mov edx, ecx
mov eax, dword [ebp + 0x10]
test edx, edx
je case.0x4655d8.313
mov edi, dword [ebp + 0xc]
push ecx
push eax
lea eax, [edi + 0x2000]
push eax
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esi], eax
test eax, eax
jne 0x465672
lea eax, [edi - 0x132]
cmp eax, 6
ja 0x465672
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047df69
mov esp, ebp
pop ebp
ret 0x18
mov dword [ebp - 0x518], 0
mov dword [esi], 1
xor eax, eax
cmp dword [ebp - 0x518], eax
setne al
jmp 0x465645
push 0x4fc948
call fcn.0047df05
add esp, 4
cmp dword [0x4fc948], 0xffffffff
jne 0x464117
mov dword [ebp - 4], 0
push str.commdlg_FindReplace
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x4fc944], eax
mov dword [ebp - 4], 0xffffffff
push 0x4fc948
call fcn.0047deb4
add esp, 4
jmp 0x464117