Function at 0x45a4d7
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xd2c
push ebx
push ebp
push esi
mov ebp, ecx
lea ecx, [esp + 0x14]
push edi
call fcn.0040491d
push ecx
lea eax, [esp + 0x42c]
push eax
push ecx
call fcn.00444c46
lea eax, [esp + 0x428]
push eax
lea ecx, [esp + 0x1c]
call fcn.004039c0
xor eax, eax
lea ebx, [ebp + 0xcb9e]
mov dword [esp + 0x14], eax
cmp word [ebx], ax
je 0x45a76d
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
test ecx, ecx
je 0x45a771
lea eax, [edx + 5]
cmp eax, dword [esp + 0x24]
jae 0x45a563
lea edi, [ecx + edx*2]
mov esi, str.ref
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
add ecx, 5
mov dword [esp + 0x20], ecx
xor edx, edx
mov word [eax + ecx*2], dx
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x45a771
test ebx, ebx
je 0x45a5b9
mov esi, ebx
lea edi, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, word [esp + 0x14]
jne 0x45a574
sub esi, edi
sar esi, 1
je 0x45a5b9
lea eax, [edx + esi]
cmp eax, dword [esp + 0x24]
jae 0x45a5b9
lea eax, [esi + esi]
push eax
lea eax, [ecx + edx*2]
push ebx
push eax
call fcn.0041d880
mov ecx, dword [esp + 0x2c]
add esp, 0xc
mov eax, dword [esp + 0x1c]
add ecx, esi
mov dword [esp + 0x20], ecx
xor edx, edx
mov word [eax + ecx*2], dx
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x45a771
xor eax, eax
push 0x46cf58
push ecx
mov ebx, eax
mov esi, eax
call fcn.0041d0fe
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x45a691
test esi, esi
jne 0x45a60d
mov ebx, dword [esp + 0x24]
xor ecx, ecx
push 0x45f8cc
push 2
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041bf4d
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x45a691
lea ecx, [edi + 2]
xor eax, eax
push ecx
push 0x46ccb4
mov word [edi], ax
push dword [esp + 0x24]
push 0x46cf68
push 0xffffffffffffffff
push ebx
push esi
call fcn.00401ea4
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [esp + 0x20], eax
cmp eax, ecx
jb 0x45a643
lea eax, [ecx - 1]
mov dword [esp + 0x20], eax
add eax, eax
push eax
push esi
push dword [esp + 0x24]
call fcn.0041d880
mov eax, dword [esp + 0x2c]
xor edx, edx
mov ecx, dword [esp + 0x28]
add esp, 0xc
mov word [ecx + eax*2], dx
mov eax, dword [esp + 0x1c]
sub edi, eax
sar edi, 1
push 0x46cf58
lea eax, [eax + edi*2]
add eax, 6
push eax
call fcn.0041d0fe
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x45a5de
test esi, esi
je 0x45a691
push esi
call fcn.0041bf56
pop ecx
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x45a771
xor eax, eax
push 0x46cf5c
push ecx
mov ebx, eax
mov esi, eax
call fcn.0041d0fe
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x45a76d
test esi, esi
jne 0x45a6e9
mov ebx, dword [esp + 0x24]
xor ecx, ecx
push 0x45f8cc
push 2
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041bf4d
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x45a76d
lea ecx, [edi + 4]
xor eax, eax
push ecx
push 0x46ccbc
mov word [edi], ax
push dword [esp + 0x24]
push 0x46cf68
push 0xffffffffffffffff
push ebx
push esi
call fcn.00401ea4
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [esp + 0x20], eax
cmp eax, ecx
jb 0x45a71f
lea eax, [ecx - 1]
mov dword [esp + 0x20], eax
add eax, eax
push eax
push esi
push dword [esp + 0x24]
call fcn.0041d880
mov eax, dword [esp + 0x2c]
xor edx, edx
mov ecx, dword [esp + 0x28]
add esp, 0xc
mov word [ecx + eax*2], dx
mov eax, dword [esp + 0x1c]
sub edi, eax
sar edi, 1
push 0x46cf5c
lea eax, [eax + edi*2]
add eax, 6
push eax
call fcn.0041d0fe
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x45a6ba
test esi, esi
je 0x45a76d
push esi
call fcn.0041bf56
pop ecx
mov ecx, dword [esp + 0x1c]
push ecx
lea eax, [ebp + 0xc17c]
push eax
call fcn.0043fb4a
xor esi, esi
inc esi
test al, al
jne 0x45a7fd
push dword [esp + 0x1c]
lea eax, [esp + 0x53c]
mov dword [esp + 0x538], 0x400
mov dword [esp + 0x530], eax
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x534], ebx
mov word [esp + 0x53c], ax
lea eax, [esp + 0x52c]
push str.https:__www.mql5.com__lang__auth_register_nobannertrueutm_campaignmql5.registerutm_mediumspecialutm_sourceweb.installer_s
push eax
mov dword [esp + 0x534], 0x46cf80
call fcn.004011fb
add esp, 0xc
lea eax, [esp + 0x528]
push str.enruzhjadeptes
push eax
call fcn.0044c2be
push esi
push ebx
push ebx
push dword [esp + 0x538]
push 0x46cf84
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 0xd4c]
and dword [ebp + 0xc168], 0xfffffffb
pop edi
mov dword [eax], esi
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0xd2c
ret 0x10