Function at 0x454084
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Contain obfuscated stackstrings
Create directory
Create thread
Delete registry key
Get common file path
Get number of processors
Parse pe header
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5be020
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2148
call fcn.00578bc0
mov eax, dword [0x6b06f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x205c], edi
xor esi, esi
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], esi
mov dword [edi + 0xc], esi
mov dword [ebp - 4], esi
lea eax, [edi + 0x24]
push eax
call fcn.0040850b
mov byte [ebp - 4], 1
lea eax, [edi + 0x28]
push eax
call fcn.0040850b
mov byte [ebp - 4], 2
lea ecx, [edi + 0x2c]
call fcn.004010c4
mov byte [ebp - 4], 3
lea ecx, [edi + 0x30]
call fcn.004010c4
mov byte [ebp - 4], 4
lea ecx, [edi + 0x34]
call fcn.004010c4
mov byte [ebp - 4], 5
lea ecx, [edi + 0x38]
call fcn.004010c4
mov byte [ebp - 4], 6
lea ecx, [edi + 0x3c]
call fcn.004010c4
mov byte [ebp - 4], 7
lea ecx, [edi + 0x40]
call fcn.004010c4
mov byte [ebp - 4], 8
lea ecx, [edi + 0x44]
call fcn.004010c4
mov byte [ebp - 4], 9
mov dword [edi + 0x48], esi
mov byte [edi + 0x4c], 0
mov byte [edi + 0x68], 0
or ebx, 0xffffffff
mov dword [edi + 0x6c], ebx
mov dword [edi + 0x70], 0xd
mov dword [edi + 0x74], 0x1e
mov dword [edi + 0x78], esi
mov byte [edi + 0x7c], 0
mov dword [edi + 0x80], 1
mov byte [edi + 0x84], 1
push 0x67cc84
lea eax, [edi + 0x88]
push eax
call fcn.00408561
mov byte [ebp - 4], 0xa
lea esi, [edi + 0x8c]
mov ecx, esi
call fcn.004010c4
mov byte [ebp - 4], 0xb
xor eax, eax
inc eax
mov dword [edi + 0x90], eax
lea ecx, [edi + 0x94]
mov dword [ebp - 0x2048], ecx
push 0
push eax
call fcn.0040eaf4
pop ecx
pop ecx
mov dword [ebp - 0x2064], eax
mov dword [ebp - 0x203c], eax
mov byte [ebp - 4], 0xc
test eax, eax
je 0x4541da
mov ecx, dword [ebp - 0x2048]
mov dword [eax], ecx
jmp 0x4541dc
xor eax, eax
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x2048]
mov dword [ecx], eax
mov byte [ebp - 4], 0x11
call fcn.0046ac05
mov edx, dword [ebp - 0x2048]
lea ecx, [edx + 0x18]
mov dword [ecx], eax
mov byte [eax + 0x1ad], 1
mov eax, dword [ecx]
mov dword [eax + 4], eax
mov eax, dword [ecx]
mov dword [eax], eax
mov ecx, dword [ecx]
mov dword [ecx + 8], ecx
and dword [edx + 0x1c], 0
mov byte [ebp - 4], 0x13
lea eax, [edi + 0xb4]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 0x14
and dword [edi + 0xcc], 0
lea eax, [edi + 0xd0]
push eax
call fcn.00413c0a
mov byte [ebp - 4], 0x15
lea eax, [edi + 0xf0]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 0x16
lea eax, [edi + 0x108]
mov dword [ebp - 0x2048], eax
push 0
push 1
call fcn.0040eaf4
pop ecx
pop ecx
mov dword [ebp - 0x2064], eax
mov dword [ebp - 0x203c], eax
mov byte [ebp - 4], 0x17
test eax, eax
je 0x454287
mov ecx, dword [ebp - 0x2048]
mov dword [eax], ecx
jmp 0x454289
xor eax, eax
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x2048]
mov dword [ecx], eax
mov byte [ebp - 4], 0x1c
call fcn.0043077b
mov edx, dword [ebp - 0x2048]
lea ecx, [edx + 0x18]
mov dword [ecx], eax
mov byte [eax + 0x15], 1
mov eax, dword [ecx]
mov dword [eax + 4], eax
mov eax, dword [ecx]
mov dword [eax], eax
mov ecx, dword [ecx]
mov dword [ecx + 8], ecx
and dword [edx + 0x1c], 0
mov byte [ebp - 4], 0x1e
lea eax, [edi + 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 0x1f
mov dword [edi + 0x140], 0x64
and dword [edi + 0x144], 0
mov byte [ebp - 4], 0x20
call fcn.00453f4c
push 0x453b62
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.0040fa60
push 4
call fcn.005737a7
pop ecx
mov dword [ebp - 0x203c], eax
mov byte [ebp - 4], 0x21
test eax, eax
je 0x45432a
and dword [eax], 0
push eax
push str.S_1_5_80_956008885_3418522649_1831038044_1853292631_2271478464
call sub.ADVAPI32.dll_ConvertStringSidToSidW
mov eax, dword [ebp - 0x203c]
jmp 0x45432c
xor eax, eax
mov byte [ebp - 4], 0x20
mov dword [0x6c8328], eax
call fcn.0042da17
call fcn.00453b94
push ebx
push 0x67cd88
call fcn.004bbc60
mov dword [ebp - 0x203c], eax
mov byte [ebp - 4], 0x22
push ebx
push 0x67cd84
call fcn.004bbc60
mov dword [ebp - 0x2050], eax
mov byte [ebp - 4], 0x23
push ebx
push 0x67cd80
call fcn.004bbc60
mov dword [ebp - 0x2060], eax
mov byte [ebp - 4], 0x24
push ebx
push 0x67cd7c
call fcn.004bbc60
mov dword [ebp - 0x2054], eax
mov byte [ebp - 4], 0x25
push ebx
push 0x67cd78
call fcn.004bbc60
mov dword [ebp - 0x2104], eax
mov byte [ebp - 4], 0x26
push ebx
push 0x67cd74
call fcn.004bbc60
mov dword [ebp - 0x20fc], eax
mov byte [ebp - 4], 0x27
push ebx
push 0x67cd70
call fcn.004bbc60
mov dword [ebp - 0x20f4], eax
mov byte [ebp - 4], 0x28
push ebx
push 0x67cd6c
call fcn.004bbc60
add esp, 0x40
mov dword [ebp - 0x20ec], eax
mov byte [ebp - 4], 0x29
push ebx
push 0x67cd68
call fcn.004bbc60
mov dword [ebp - 0x20e4], eax
mov byte [ebp - 4], 0x2a
push ebx
push 0x67cd64
call fcn.004bbc60
mov dword [ebp - 0x20dc], eax
mov byte [ebp - 4], 0x2b
push ebx
push 0x67cd60
call fcn.004bbc60
mov dword [ebp - 0x20d4], eax
mov byte [ebp - 4], 0x2c
push ebx
push 0x67cd5c
call fcn.004bbc60
mov dword [ebp - 0x20cc], eax
mov byte [ebp - 4], 0x2d
push ebx
push 0x67cd58
call fcn.004bbc60
mov dword [ebp - 0x20c4], eax
mov byte [ebp - 4], 0x2e
push ebx
push 0x67cd54
call fcn.004bbc60
mov dword [ebp - 0x20bc], eax
mov byte [ebp - 4], 0x2f
push ebx
push 0x67cd50
call fcn.004bbc60
mov dword [ebp - 0x20b4], eax
mov byte [ebp - 4], 0x30
push ebx
push 0x67cd4c
call fcn.004bbc60
add esp, 0x40
mov dword [ebp - 0x20ac], eax
mov byte [ebp - 4], 0x31
push ebx
push 0x67cd48
call fcn.004bbc60
mov dword [ebp - 0x20a4], eax
mov byte [ebp - 4], 0x32
push ebx
push 0x67cd44
call fcn.004bbc60
mov dword [ebp - 0x209c], eax
mov byte [ebp - 4], 0x33
push ebx
push 0x67cd40
call fcn.004bbc60
mov dword [ebp - 0x2094], eax
mov byte [ebp - 4], 0x34
push ebx
push 0x67cd3c
call fcn.004bbc60
mov dword [ebp - 0x208c], eax
mov byte [ebp - 4], 0x35
push ebx
push 0x67cd38
call fcn.004bbc60
mov dword [ebp - 0x2084], eax
mov byte [ebp - 4], 0x36
push ebx
push 0x67cd34
call fcn.004bbc60
mov dword [ebp - 0x207c], eax
mov byte [ebp - 4], 0x37
push ebx
push 0x67cd30
call fcn.004bbc60
mov dword [ebp - 0x2074], eax
mov byte [ebp - 4], 0x38
push ebx
push 0x67cd2c
call fcn.004bbc60
add esp, 0x40
mov dword [ebp - 0x206c], eax
mov byte [ebp - 4], 0x39
push ebx
push 0x67cd28
call fcn.004bbc60
mov dword [ebp - 0x20e0], eax
mov byte [ebp - 4], 0x3a
push ebx
push 0x67cd24
call fcn.004bbc60
mov dword [ebp - 0x2118], eax
mov byte [ebp - 4], 0x3b
push ebx
push 0x67cd20
call fcn.004bbc60
mov dword [ebp - 0x20d8], eax
mov byte [ebp - 4], 0x3c
push ebx
push 0x67cd1c
call fcn.004bbc60
mov dword [ebp - 0x2150], eax
mov byte [ebp - 4], 0x3d
push ebx
push 0x67cd18
call fcn.004bbc60
mov dword [ebp - 0x20d0], eax
mov byte [ebp - 4], 0x3e
push ebx
push 0x67cd14
call fcn.004bbc60
mov dword [ebp - 0x2110], eax
mov byte [ebp - 4], 0x3f
push ebx
push 0x67cd10
call fcn.004bbc60
mov dword [ebp - 0x20c8], eax
mov byte [ebp - 4], 0x40
push ebx
push 0x67cd0c
call fcn.004bbc60
add esp, 0x40
mov dword [ebp - 0x2130], eax
mov byte [ebp - 4], 0x41
push ebx
push 0x67cd08
call fcn.004bbc60
mov dword [ebp - 0x2068], eax
mov byte [ebp - 4], 0x42
push ebx
push 0x67cd04
call fcn.004bbc60
mov dword [ebp - 0x2108], eax
mov byte [ebp - 4], 0x43
push ebx
push 0x67cd00
call fcn.004bbc60
mov dword [ebp - 0x20b8], eax
mov byte [ebp - 4], 0x44
push ebx
push 0x67ccfc
call fcn.004bbc60
mov dword [ebp - 0x2140], eax
mov byte [ebp - 4], 0x45
push ebx
push 0x67ccf8
call fcn.004bbc60
mov dword [ebp - 0x20b0], eax
mov byte [ebp - 4], 0x46
push ebx
push 0x67ccf4
call fcn.004bbc60
mov dword [ebp - 0x2100], eax
mov byte [ebp - 4], 0x47
push ebx
push 0x67ccf0
call fcn.004bbc60
mov dword [ebp - 0x20a8], eax
mov byte [ebp - 4], 0x48
push ebx
push 0x67ccec
call fcn.004bbc60
add esp, 0x40
mov dword [ebp - 0x2128], eax
mov byte [ebp - 4], 0x49
push ebx
push 0x67cce8
call fcn.004bbc60
mov dword [ebp - 0x20a0], eax
mov byte [ebp - 4], 0x4a
push ebx
push str.HTML
call fcn.004bbc60
mov dword [ebp - 0x20f8], eax
mov byte [ebp - 4], 0x4b
push ebx
push 0x67ccdc
call fcn.004bbc60
mov dword [ebp - 0x2098], eax
mov byte [ebp - 4], 0x4c
push ebx
push 0x67ccd8
call fcn.004bbc60
mov dword [ebp - 0x2148], eax
mov byte [ebp - 4], 0x4d
push ebx
push 0x67ccd4
call fcn.004bbc60
mov dword [ebp - 0x2090], eax
mov byte [ebp - 4], 0x4e
push ebx
push 0x67ccd0
call fcn.004bbc60
mov dword [ebp - 0x20f0], eax
mov byte [ebp - 4], 0x4f
push ebx
push 0x67cccc
call fcn.004bbc60
mov dword [ebp - 0x2088], eax
mov byte [ebp - 4], 0x50
push ebx
push 0x67ccc8
call fcn.004bbc60
add esp, 0x40
mov dword [ebp - 0x2120], eax
mov byte [ebp - 4], 0x51
push ebx
push 0x67ccc4
call fcn.004bbc60
mov dword [ebp - 0x2080], eax
mov byte [ebp - 4], 0x52
push ebx
push 0x67ccc0
call fcn.004bbc60
mov dword [ebp - 0x20e8], eax
mov byte [ebp - 4], 0x53
push ebx
push 0x67ccbc
call fcn.004bbc60
mov dword [ebp - 0x2078], eax
mov byte [ebp - 4], 0x54
push ebx
push 0x67ccb8
call fcn.004bbc60
mov dword [ebp - 0x2138], eax
mov byte [ebp - 4], 0x55
push ebx
push 0x67ccb4
call fcn.004bbc60
mov dword [ebp - 0x2070], eax
mov byte [ebp - 4], 0x56
push ebx
push 0x67ccb0
call fcn.004bbc60
mov dword [ebp - 0x2154], eax
mov byte [ebp - 4], 0x57
push ebx
push 0x67ccac
call fcn.004bbc60
mov dword [ebp - 0x214c], eax
mov byte [ebp - 4], 0x58
push ebx
push 0x67cca8
call fcn.004bbc60
add esp, 0x40
mov dword [ebp - 0x2144], eax
mov byte [ebp - 4], 0x59
push ebx
push 0x67cca4
call fcn.004bbc60
mov dword [ebp - 0x213c], eax
mov byte [ebp - 4], 0x5a
push ebx
push 0x67cca0
call fcn.004bbc60
mov dword [ebp - 0x2134], eax
mov byte [ebp - 4], 0x5b
push ebx
push 0x67cc9c
call fcn.004bbc60
mov dword [ebp - 0x212c], eax
mov byte [ebp - 4], 0x5c
push ebx
push 0x67cc98
call fcn.004bbc60
mov dword [ebp - 0x2124], eax
mov byte [ebp - 4], 0x5d
push ebx
push 0x67cc94
call fcn.004bbc60
mov dword [ebp - 0x211c], eax
mov byte [ebp - 4], 0x5e
push ebx
push 0x67cc90
call fcn.004bbc60
mov dword [ebp - 0x2114], eax
mov byte [ebp - 4], 0x5f
push ebx
push 0x67cc8c
call fcn.004bbc60
mov dword [ebp - 0x210c], eax
mov byte [ebp - 4], 0x60
push ebx
push 0x67cc88
call fcn.004bbc60
add esp, 0x40
mov dword [ebp - 0x20c0], eax
mov byte [ebp - 4], 0x61
lea eax, [ebp - 0x20c0]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x210c]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2114]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x211c]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2124]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x212c]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2134]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x213c]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2144]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x214c]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2154]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2070]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2138]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2078]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20e8]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2080]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2120]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2088]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20f0]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2090]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2148]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2098]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20f8]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20a0]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2128]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20a8]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2100]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20b0]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2140]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20b8]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2108]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2068]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2130]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20c8]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2110]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20d0]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2150]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20d8]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2118]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20e0]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x206c]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2074]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x207c]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2084]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x208c]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2094]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x209c]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20a4]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20ac]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20b4]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20bc]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20c4]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20cc]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20d4]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20dc]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20e4]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20ec]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20f4]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x20fc]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2104]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2054]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2060]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x2050]
push eax
mov ecx, esi
call fcn.00401d91
lea eax, [ebp - 0x203c]
push eax
mov ecx, esi
call fcn.00401d91
mov byte [ebp - 4], 0x60
lea ecx, [ebp - 0x20c0]
call fcn.004010b0
mov byte [ebp - 4], 0x5f
lea ecx, [ebp - 0x210c]
call fcn.004010b0
mov byte [ebp - 4], 0x5e
lea ecx, [ebp - 0x2114]
call fcn.004010b0
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x211c]
call fcn.004010b0
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0x2124]
call fcn.004010b0
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0x212c]
call fcn.004010b0
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x2134]
call fcn.004010b0
mov byte [ebp - 4], 0x59
lea ecx, [ebp - 0x213c]
call fcn.004010b0
mov byte [ebp - 4], 0x58
lea ecx, [ebp - 0x2144]
call fcn.004010b0
mov byte [ebp - 4], 0x57
lea ecx, [ebp - 0x214c]
call fcn.004010b0
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0x2154]
call fcn.004010b0
mov byte [ebp - 4], 0x55
lea ecx, [ebp - 0x2070]
call fcn.004010b0
mov byte [ebp - 4], 0x54
lea ecx, [ebp - 0x2138]
call fcn.004010b0
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0x2078]
call fcn.004010b0
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0x20e8]
call fcn.004010b0
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x2080]
call fcn.004010b0
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0x2120]
call fcn.004010b0
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x2088]
call fcn.004010b0
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0x20f0]
call fcn.004010b0
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x2090]
call fcn.004010b0
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0x2148]
call fcn.004010b0
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x2098]
call fcn.004010b0
mov byte [ebp - 4], 0x4a
lea ecx, [ebp - 0x20f8]
call fcn.004010b0
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x20a0]
call fcn.004010b0
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x2128]
call fcn.004010b0
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x20a8]
call fcn.004010b0
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0x2100]
call fcn.004010b0
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x20b0]
call fcn.004010b0
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x2140]
call fcn.004010b0
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x20b8]
call fcn.004010b0
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x2108]
call fcn.004010b0
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x2068]
call fcn.004010b0
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x2130]
call fcn.004010b0
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x20c8]
call fcn.004010b0
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x2110]
call fcn.004010b0
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x20d0]
call fcn.004010b0
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x2150]
call fcn.004010b0
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x20d8]
call fcn.004010b0
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x2118]
call fcn.004010b0
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x20e0]
call fcn.004010b0
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x206c]
call fcn.004010b0
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x2074]
call fcn.004010b0
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x207c]
call fcn.004010b0
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x2084]
call fcn.004010b0
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x208c]
call fcn.004010b0
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x2094]
call fcn.004010b0
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x209c]
call fcn.004010b0
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x20a4]
call fcn.004010b0
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x20ac]
call fcn.004010b0
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x20b4]
call fcn.004010b0
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x20bc]
call fcn.004010b0
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x20c4]
call fcn.004010b0
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x20cc]
call fcn.004010b0
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x20d4]
call fcn.004010b0
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x20dc]
call fcn.004010b0
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x20e4]
call fcn.004010b0
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x20ec]
call fcn.004010b0
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x20f4]
call fcn.004010b0
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x20fc]
call fcn.004010b0
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x2104]
call fcn.004010b0
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x2054]
call fcn.004010b0
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x2060]
call fcn.004010b0
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x2050]
call fcn.004010b0
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x203c]
call fcn.004010b0
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
mov esi, 0x67cd8c
push esi
push eax
call fcn.00408561
mov byte [ebp - 4], 0x62
mov byte [ebp - 4], 0x20
call fcn.0042c61b
test eax, eax
jne 0x455024
push eax
call fcn.0057533b
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push esi
push eax
call fcn.00408561
mov byte [ebp - 4], 0x63
mov byte [ebp - 4], 0x20
call fcn.0042c6a3
xor esi, esi
inc esi
cmp dword [0x6af38c], esi
jl 0x455042
push 0x67cdac
push str.CIkAV::CIkAV
push esi
call fcn.00532962
add esp, 0xc
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.RealTimeFound
push eax
call fcn.00408561
mov byte [ebp - 4], 0x64
mov byte [ebp - 4], 0x20
call fcn.0042c61b
mov dword [0x6c8c18], eax
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.RealTimeScanned
push eax
call fcn.00408561
mov byte [ebp - 4], 0x65
mov byte [ebp - 4], 0x20
call fcn.0042c61b
mov dword [0x6c8c14], eax
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.ManualFound
push eax
call fcn.00408561
mov byte [ebp - 4], 0x66
mov byte [ebp - 4], 0x20
call fcn.0042c61b
mov dword [0x6c8c10], eax
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.ManualScanned
push eax
call fcn.00408561
mov byte [ebp - 4], 0x67
mov byte [ebp - 4], 0x20
call fcn.0042c61b
mov dword [0x6c8c0c], eax
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.CloudFound
push eax
call fcn.00408561
mov byte [ebp - 4], 0x68
mov byte [ebp - 4], 0x20
call fcn.0042c61b
mov dword [0x6c8c1c], eax
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.RealtimeKeygen
push eax
call fcn.00408561
mov byte [ebp - 4], 0x69
mov byte [ebp - 4], 0x20
call fcn.0042c61b
mov dword [0x6b29f8], eax
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.ScanKeygen
push eax
call fcn.00408561
mov byte [ebp - 4], 0x6a
mov byte [ebp - 4], 0x20
call fcn.0042c61b
mov dword [0x6b29fc], eax
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.Beh1
push eax
call fcn.00408561
mov byte [ebp - 4], 0x6b
mov byte [ebp - 4], 0x20
call fcn.0042c61b
mov dword [0x6b2a00], eax
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.Beh21
push eax
call fcn.00408561
mov byte [ebp - 4], 0x6c
mov byte [ebp - 4], 0x20
call fcn.0042c61b
mov dword [0x6b2a04], eax
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.BehR1
push eax
call fcn.00408561
mov byte [ebp - 4], 0x6d
mov byte [ebp - 4], 0x20
call fcn.0042c61b
mov dword [0x6c8324], eax
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.BehR21
push eax
call fcn.00408561
mov byte [ebp - 4], 0x6e
mov byte [ebp - 4], 0x20
call fcn.0042c61b
mov dword [0x6b29c0], eax
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.EnableSSL
push eax
call fcn.00408561
mov byte [ebp - 4], 0x6f
mov byte [ebp - 4], 0x20
call fcn.0042c61b
mov dword [0x6b2a08], eax
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.AVCategories
push eax
call fcn.00408561
mov byte [ebp - 4], 0x70
mov byte [ebp - 4], 0x20
call fcn.0042c61b
mov dword [0x6b2a68], eax
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.ShowBandwidth90p
push eax
call fcn.00408561
mov byte [ebp - 4], 0x71
mov byte [ebp - 4], 0x20
call fcn.0042c61b
mov dword [0x6b29e8], eax
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.ShowBandwidth100p
push eax
call fcn.00408561
mov byte [ebp - 4], 0x72
mov byte [ebp - 4], 0x20
call fcn.0042c61b
mov dword [0x6b29ec], eax
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.SuperUSB
push eax
call fcn.00408561
mov byte [ebp - 4], 0x73
mov byte [ebp - 4], 0x20
call fcn.0042c61b
mov dword [0x6b2a0c], eax
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.ExeUSB2
push eax
call fcn.00408561
mov byte [ebp - 4], 0x74
mov byte [ebp - 4], 0x20
call fcn.0042c61b
mov dword [0x6c8c28], eax
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.AllowUSBSigned
push eax
call fcn.00408561
mov byte [ebp - 4], 0x75
mov byte [ebp - 4], 0x20
call fcn.0042c61b
mov dword [0x6b29c8], eax
push 0x20
call fcn.005737a7
pop ecx
mov dword [ebp - 0x203c], eax
mov byte [ebp - 4], 0x76
test eax, eax
je 0x455326
push eax
call fcn.0040f817
jmp 0x455328
xor eax, eax
mov byte [ebp - 4], 0x20
mov dword [0x6c8c54], eax
push str._restorem.db
push ecx
mov eax, esp
mov dword [ebp - 0x2060], esp
push eax
call fcn.0046f870
pop ecx
mov byte [ebp - 4], 0x77
lea eax, [ebp - 0x2050]
push eax
mov byte [ebp - 4], 0x20
call fcn.004040c8
pop ecx
pop ecx
mov byte [ebp - 4], 0x78
lea ecx, [ebp - 0x203c]
push ecx
mov esi, eax
call fcn.004135f4
pop ecx
pop ecx
mov byte [ebp - 4], 0x79
push dword [eax]
mov ecx, dword [0x6c8c54]
call fcn.004100fc
mov byte [ebp - 4], 0x78
lea ecx, [ebp - 0x203c]
call fcn.00408461
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x2050]
call fcn.00408461
call fcn.0041c65e
mov esi, 0x6c8e5c
mov dword [ebp - 0x2054], esi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x7a
lea eax, [ebp - 0x2050]
push eax
call fcn.0046f870
mov byte [ebp - 4], 0x7b
mov dword [esp], str.pc2.db
lea ecx, [ebp - 0x203c]
push ecx
mov ecx, eax
call fcn.0040fc53
pop ecx
pop ecx
mov byte [ebp - 4], 0x7c
mov eax, dword [eax]
push 0
push eax
mov ecx, 0x6c8e58
call fcn.00431e4a
mov byte [ebp - 4], 0x7b
lea ecx, [ebp - 0x203c]
call fcn.004085a2
mov byte [ebp - 4], 0x7a
lea ecx, [ebp - 0x2050]
call fcn.004085a2
push 0x6c8e58
call fcn.00431f05
test al, al
jne 0x455456
xor eax, eax
push eax
push eax
push eax
push 0x455b73
push eax
push eax
call fcn.005755cb
add esp, 0x18
mov dword [0x6c8c50], eax
cmp dword [0x6af38c], 1
jl 0x455456
push str.PCDB_ready
push str.CIkAV::CIkAV
push 1
call fcn.00532962
add esp, 0xc
mov byte [ebp - 4], 0x20
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor esi, esi
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x6c8c44], eax
mov byte [edi + 0x50], 0
push 0x6c832c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x400
lea eax, [ebp - 0x2018]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
lea eax, [ebp - 0x2018]
push eax
call fcn.005761a5
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x2018]
push eax
lea eax, [ebp - 0x2058]
push eax
call fcn.00408561
mov byte [ebp - 4], 0x7d
push str.msav.db
lea eax, [ebp - 0x203c]
push eax
lea ecx, [ebp - 0x2058]
call fcn.0040fc53
pop ecx
pop ecx
mov byte [ebp - 4], 0x7e
mov edi, 0x6c9ee0
call fcn.004085c5
mov byte [ebp - 4], 0x7d
lea ecx, [ebp - 0x203c]
call fcn.004085a2
push esi
push 0x23
lea eax, [ebp - 0x818]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edi, [ebp - 0x818]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x455510
mov esi, str.AVHome
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x203c]
push eax
call fcn.00408561
mov byte [ebp - 4], 0x7f
push str.cache.db
lea ecx, [ebp - 0x2064]
push ecx
mov ecx, eax
call fcn.0040fc53
pop ecx
pop ecx
mov byte [ebp - 4], 0x81
lea ecx, [ebp - 0x203c]
call fcn.004085a2
push 0
lea eax, [ebp - 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edi, [ebp - 0x818]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x455576
mov esi, 0x67cea0
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor esi, esi
push esi
lea eax, [ebp - 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str._sc3.db
lea eax, [ebp - 0x203c]
push eax
lea ecx, [ebp - 0x2058]
call fcn.0040fc53
pop ecx
pop ecx
mov byte [ebp - 4], 0x82
mov edi, 0x6c9f1c
call fcn.004085c5
mov byte [ebp - 4], 0x81
lea ecx, [ebp - 0x203c]
call fcn.004085a2
push 0x3c
call fcn.005737a7
pop ecx
mov dword [ebp - 0x203c], eax
mov byte [ebp - 4], 0x83
cmp eax, esi
je 0x4555ed
push eax
call fcn.00485a40
jmp 0x4555ef
xor eax, eax
mov byte [ebp - 4], 0x81
mov dword [0x6c8c34], eax
push esi
push dword [0x6c9f1c]
call fcn.00485f70
lea eax, [ebp - 0x818]
push eax
call fcn.004335aa
pop ecx
call fcn.0042dce7
mov eax, dword [ebp - 0x205c]
mov dword [0x6c8c40], eax
mov byte [ebp - 0x203d], 0
mov dword [ebp - 0x204c], esi
mov dword [ebp - 0x2044], 0x400
xor eax, eax
mov word [ebp - 0x1818], ax
push 0x7fe
push esi
lea eax, [ebp - 0x1816]
push eax
call fcn.005783f0
add esp, 0xc
lea eax, [ebp - 0x2044]
push eax
lea eax, [ebp - 0x1818]
push eax
lea eax, [ebp - 0x204c]
push eax
push 0x67ceb8
push str.Softwarepchiktmp
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4556fd
mov eax, dword [ebp - 0x2044]
cmp eax, esi
je 0x4556fd
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x1818], cx
lea eax, [ebp - 0x1818]
push eax
lea eax, [ebp - 0x203c]
push eax
call fcn.00470550
pop ecx
pop ecx
mov byte [ebp - 4], 0x84
lea esi, [ebp - 0x203c]
call fcn.004084f4
push ecx
mov esi, esp
mov dword [ebp - 0x2050], esp
push eax
call fcn.00401019
mov byte [ebp - 4], 0x85
push 0x679810
push str.Main
mov byte [ebp - 4], 0x84
call fcn.00401aba
mov byte [ebp - 0x203d], 1
mov byte [ebp - 4], 0x81
lea ecx, [ebp - 0x203c]
call fcn.00408461
xor esi, esi
mov dword [ebp - 0x204c], esi
mov dword [ebp - 0x2044], 0x400
lea eax, [ebp - 0x2044]
push eax
lea eax, [ebp - 0x1818]
push eax
lea eax, [ebp - 0x204c]
push eax
push 0x67cee4
push str.Softwarepchiktmp
push edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4557a6
mov eax, dword [ebp - 0x2044]
cmp eax, esi
je 0x4557a6
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x1818], cx
lea eax, [ebp - 0x1818]
push eax
lea eax, [ebp - 0x203c]
push eax
call fcn.00470550
mov byte [ebp - 4], 0x86
mov eax, dword [eax]
add esp, 4
mov esi, esp
mov dword [ebp - 0x2050], esp
push eax
call fcn.00401019
mov byte [ebp - 4], 0x87
push str.Port
push str.Main
mov byte [ebp - 4], 0x86
call fcn.00401aba
mov byte [ebp - 4], 0x81
lea ecx, [ebp - 0x203c]
call fcn.00408461
mov byte [ebp - 0x203d], 1
xor esi, esi
mov dword [ebp - 0x2048], ebx
mov dword [ebp - 0x204c], esi
mov dword [ebp - 0x2044], 4
lea eax, [ebp - 0x2044]
push eax
lea eax, [ebp - 0x2048]
push eax
lea eax, [ebp - 0x204c]
push eax
push 0x67ceec
push str.Softwarepchiktmp
push edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0x2048], ebx
je 0x455960
cmp dword [ebp - 0x2048], 1
jne 0x455943
push esi
push str.IsGlobal
push str.Update
call fcn.00401924
xor eax, eax
mov word [ebp - 0x1018], ax
push 0x7fe
push esi
lea eax, [ebp - 0x1016]
push eax
call fcn.005783f0
add esp, 0xc
mov dword [ebp - 0x204c], esi
mov dword [ebp - 0x2044], 0x400
lea eax, [ebp - 0x2044]
push eax
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x204c]
push eax
push 0x67cef4
push str.Softwarepchiktmp
push edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4558d4
mov eax, dword [ebp - 0x2044]
cmp eax, esi
je 0x4558d4
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x1018], cx
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x203c]
push eax
call fcn.00470550
pop ecx
pop ecx
mov byte [ebp - 4], 0x88
lea esi, [ebp - 0x203c]
call fcn.004084f4
push ecx
mov esi, esp
mov dword [ebp - 0x2050], esp
push eax
call fcn.00401019
mov byte [ebp - 4], 0x89
push str.LocalServer
push str.Update
mov byte [ebp - 4], 0x88
call fcn.00401aba
mov byte [ebp - 4], 0x81
lea ecx, [ebp - 0x203c]
call fcn.00408461
xor esi, esi
mov dword [ebp - 0x204c], esi
mov dword [ebp - 0x2044], 0x400
lea eax, [ebp - 0x2044]
push eax
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x204c]
push eax
push 0x679268
push str.Softwarepchiktmp
push edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x455954
mov eax, dword [ebp - 0x2044]
cmp eax, esi
je 0x455954
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x1018], cx
lea eax, [ebp - 0x1018]
push eax
call fcn.00573da7
pop ecx
push eax
push str.LocalPort
push str.Update
call fcn.00401849
jmp 0x455954
push 1
push str.IsGlobal
push str.Update
call fcn.00401924
push str.Softwarepchiktmp
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp byte [ebp - 0x203d], 0
jne 0x455971
cmp dword [ebp - 0x2048], ebx
je 0x455976
call fcn.00401cbc
mov edi, dword [ebp - 0x205c]
mov ecx, edi
call fcn.004620a4
mov ecx, edi
call fcn.004624ab
call fcn.004661a6
push esi
push 1
push esi
call fcn.004560d9
add esp, 0xc
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push 0x67cefc
push eax
call fcn.00408561
mov byte [ebp - 4], 0x8a
mov byte [ebp - 4], 0x81
call fcn.0042c61b
cmp eax, 1
jne 0x4559c8
push eax
call fcn.0045669a
lea eax, [ebp - 0x2038]
push eax
call fcn.0040f817
mov byte [ebp - 4], 0x8b
push esi
lea ecx, [ebp - 0x2038]
call fcn.004100fc
test al, al
je 0x455a07
lea eax, [edi + 0xd0]
push eax
lea eax, [ebp - 0x2038]
push eax
call fcn.00411a4c
lea eax, [ebp - 0x2038]
push eax
call fcn.004124e1
mov byte [ebp - 4], 0x81
lea eax, [ebp - 0x2038]
push eax
call fcn.0040f843
push 0x20
call fcn.005737a7
pop ecx
mov dword [ebp - 0x203c], eax
mov byte [ebp - 4], 0x8c
cmp eax, esi
je 0x455a35
push eax
call fcn.0040f817
jmp 0x455a37
xor eax, eax
mov byte [ebp - 4], 0x81
mov dword [0x6c9e4c], eax
push esi
mov ecx, eax
call fcn.004100fc
mov ecx, edi
call fcn.0045e058
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.USBPassword
push eax
call fcn.00408561
mov byte [ebp - 4], 0x8d
mov byte [ebp - 4], 0x81
call fcn.0042c61b
mov dword [edi + 0xcc], eax
push esi
push esi
push edi
push 0x455fc7
push esi
push esi
call fcn.005755cb
push esi
push esi
push edi
push 0x455de7
push esi
push esi
call fcn.005755cb
push esi
push esi
push edi
push 0x455bb8
push esi
push esi
call fcn.005755cb
add esp, 0x48
mov edi, 0x6c9c10
mov ecx, edi
call fcn.0044a203
push esi
push esi
push edi
push 0x44a401
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x6c9c3c], eax
call fcn.00431cbe
call fcn.00431861
call fcn.00431b26
call fcn.00431829
mov byte [ebp - 4], 0x7d
lea ecx, [ebp - 0x2064]
call fcn.004085a2
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x2058]
call fcn.004085a2
mov dword [ebp - 4], 0x1f
jmp 0x455b30
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x205c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0057372c
leave
ret