Function at 0x453ca0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Create directory
Create thread
Delete registry key
Get common file path
Get number of processors
Parse pe header
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586181
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2218
call fcn.005027c0
mov eax, dword [0x6531f0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x2060], esi
xor edi, edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [ebp - 4], edi
lea eax, [esi + 0x24]
push eax
call fcn.0040cb50
mov byte [ebp - 4], 1
lea ecx, [esi + 0x28]
push ecx
call fcn.0040cb50
mov byte [ebp - 4], 2
lea eax, [esi + 0x30]
mov dword [ebp - 0x2040], eax
mov dword [eax], 0x651074
mov edx, 0x651074
mov ebx, 1
mov eax, ebx
lock xadd dword [edx], eax
mov byte [ebp - 4], 4
lea eax, [esi + 0x34]
mov dword [ebp - 0x2040], eax
mov dword [eax], edx
mov ecx, edx
mov edx, ebx
lock xadd dword [ecx], edx
mov byte [ebp - 4], 6
lea eax, [esi + 0x38]
mov dword [ebp - 0x2040], eax
mov dword [eax], ecx
mov eax, ecx
mov ecx, ebx
lock xadd dword [eax], ecx
mov byte [ebp - 4], 8
lea eax, [esi + 0x3c]
mov dword [ebp - 0x2040], eax
mov dword [eax], 0x651074
mov edx, 0x651074
mov eax, ebx
lock xadd dword [edx], eax
mov byte [ebp - 4], 0xa
lea eax, [esi + 0x40]
mov dword [ebp - 0x2040], eax
mov dword [eax], edx
mov ecx, edx
mov edx, ebx
lock xadd dword [ecx], edx
mov byte [ebp - 4], 0xc
lea eax, [esi + 0x44]
mov dword [ebp - 0x2040], eax
mov dword [eax], ecx
mov eax, ecx
mov ecx, ebx
lock xadd dword [eax], ecx
mov byte [ebp - 4], 0xe
lea eax, [esi + 0x48]
mov dword [ebp - 0x2040], eax
mov dword [eax], 0x651074
mov edx, 0x651074
mov eax, ebx
lock xadd dword [edx], eax
mov byte [ebp - 4], 0x10
mov dword [esi + 0x4c], edi
mov byte [esi + 0x50], 0
mov dword [esi + 0x6c], ebx
mov byte [esi + 0x70], bl
lea ecx, [esi + 0x74]
push ecx
mov ecx, 0x6359d0
call fcn.004026a0
mov byte [ebp - 4], 0x11
mov dword [esi + 0x78], edi
lea eax, [esi + 0x7c]
mov dword [ebp - 0x2040], eax
mov dword [eax], 0x651074
mov edx, 0x651074
mov eax, ebx
lock xadd dword [edx], eax
mov byte [ebp - 4], 0x13
mov dword [esi + 0x80], ebx
lea ecx, [esi + 0x84]
push ecx
call fcn.00463620
mov byte [ebp - 4], 0x14
lea eax, [esi + 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 0x15
mov dword [esi + 0xbc], edi
mov dword [esi + 0xc0], 0x64
mov dword [esi + 0xc4], edi
mov dword [esi + 0xc8], edi
mov bl, 0x16
mov byte [ebp - 4], bl
push 0x453a10
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 4
call fcn.004fdddd
add esp, 4
mov dword [ebp - 0x215c], eax
mov byte [ebp - 4], 0x17
cmp eax, edi
je 0x453e83
mov dword [eax], edi
push eax
push str.S_1_5_80_956008885_3418522649_1831038044_1853292631_2271478464
call sub.ADVAPI32.dll_ConvertStringSidToSidW
mov eax, dword [ebp - 0x215c]
jmp 0x453e85
xor eax, eax
mov byte [ebp - 4], bl
mov dword [0x66adec], eax
call fcn.00430dc0
call fcn.00432600
push ecx
mov edx, esp
mov dword [ebp - 0x2040], esp
push edx
mov ecx, 0x635834
call fcn.004026a0
mov byte [ebp - 4], 0x18
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.004301f0
mov dword [0x66b088], eax
xor edi, edi
push ecx
mov eax, esp
mov dword [ebp - 0x2040], esp
push eax
mov ecx, str.RealTimeScanned
call fcn.004026a0
mov byte [ebp - 4], 0x19
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.004301f0
mov dword [0x66b084], eax
push ecx
mov ecx, esp
mov dword [ebp - 0x2040], esp
push ecx
mov ecx, 0x6359d4
call fcn.004026a0
mov byte [ebp - 4], 0x1a
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.004301f0
mov dword [0x66b080], eax
push ecx
mov edx, esp
mov dword [ebp - 0x2040], esp
push edx
mov ecx, str.ManualScanned
call fcn.004026a0
mov byte [ebp - 4], 0x1b
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.004301f0
mov dword [0x66b07c], eax
push ecx
mov eax, esp
mov dword [ebp - 0x2040], esp
push eax
mov ecx, 0x633ab0
call fcn.004026a0
mov byte [ebp - 4], 0x1c
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.004301f0
mov dword [0x66b090], eax
push ecx
mov ecx, esp
mov dword [ebp - 0x2040], esp
push ecx
mov ecx, str.WebScanned
call fcn.004026a0
mov byte [ebp - 4], 0x1d
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.004301f0
mov dword [0x66b08c], eax
mov edi, 1
push ecx
mov edx, esp
mov dword [ebp - 0x2040], esp
push edx
mov ecx, str.ManualAlert
call fcn.004026a0
mov byte [ebp - 4], 0x1e
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.004301f0
mov dword [0x6563f0], eax
xor edi, edi
push ecx
mov eax, esp
mov dword [ebp - 0x2040], esp
push eax
mov ecx, str.RealtimeAlert
call fcn.004026a0
mov byte [ebp - 4], 0x1f
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.004301f0
mov dword [0x66b094], eax
mov edi, 1
push ecx
mov ecx, esp
mov dword [ebp - 0x2040], esp
push ecx
mov ecx, str.SuperUSB
call fcn.004026a0
mov byte [ebp - 4], 0x20
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.004301f0
mov dword [0x6563f4], eax
xor edi, edi
push ecx
mov edx, esp
mov dword [ebp - 0x2040], esp
push edx
mov ecx, str.ExeUSB
call fcn.004026a0
mov byte [ebp - 4], 0x21
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.004301f0
mov dword [0x66b09c], eax
push ecx
mov eax, esp
mov dword [ebp - 0x2040], esp
push eax
mov ecx, str.EnableSSL
call fcn.004026a0
mov byte [ebp - 4], 0x22
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.004301f0
mov dword [0x66b098], eax
mov edi, 1
push ecx
mov ecx, esp
mov dword [ebp - 0x2040], esp
push ecx
mov ecx, str.ShowBandwidth90p
call fcn.004026a0
mov byte [ebp - 4], 0x23
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.004301f0
mov dword [0x6563d8], eax
push ecx
mov edx, esp
mov dword [ebp - 0x2040], esp
push edx
mov ecx, str.ShowBandwidth100p
call fcn.004026a0
mov byte [ebp - 4], 0x24
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.004301f0
mov dword [0x6563dc], eax
push ecx
mov eax, esp
mov dword [ebp - 0x2040], esp
push eax
mov ecx, str.RecoverUSB
call fcn.004026a0
mov byte [ebp - 4], 0x25
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.004301f0
mov dword [0x6563e0], eax
push 0xffffffffffffffff
push 0x635aec
call fcn.00483890
mov dword [ebp - 0x2108], eax
mov byte [ebp - 4], 0x26
push 0xffffffffffffffff
push 0x635ae8
call fcn.00483890
mov dword [ebp - 0x2100], eax
mov byte [ebp - 4], 0x27
push 0xffffffffffffffff
push 0x635ae4
call fcn.00483890
mov dword [ebp - 0x20f8], eax
mov byte [ebp - 4], 0x28
push 0xffffffffffffffff
push 0x635ae0
call fcn.00483890
mov dword [ebp - 0x20f0], eax
mov byte [ebp - 4], 0x29
push 0xffffffffffffffff
push 0x635adc
call fcn.00483890
mov dword [ebp - 0x20e8], eax
mov byte [ebp - 4], 0x2a
push 0xffffffffffffffff
push 0x635ad8
call fcn.00483890
mov dword [ebp - 0x20e0], eax
mov byte [ebp - 4], 0x2b
push 0xffffffffffffffff
push 0x635ad4
call fcn.00483890
mov dword [ebp - 0x20d8], eax
mov byte [ebp - 4], 0x2c
push 0xffffffffffffffff
push 0x635ad0
call fcn.00483890
add esp, 0x40
mov dword [ebp - 0x20d0], eax
mov byte [ebp - 4], 0x2d
push 0xffffffffffffffff
push 0x635acc
call fcn.00483890
mov dword [ebp - 0x20c8], eax
mov byte [ebp - 4], 0x2e
push 0xffffffffffffffff
push 0x635ac8
call fcn.00483890
mov dword [ebp - 0x20c0], eax
mov byte [ebp - 4], 0x2f
push 0xffffffffffffffff
push 0x635ac4
call fcn.00483890
mov dword [ebp - 0x20b8], eax
mov byte [ebp - 4], 0x30
push 0xffffffffffffffff
push 0x635ac0
call fcn.00483890
mov dword [ebp - 0x20b0], eax
mov byte [ebp - 4], 0x31
push 0xffffffffffffffff
push 0x635abc
call fcn.00483890
mov dword [ebp - 0x2104], eax
mov byte [ebp - 4], 0x32
push 0xffffffffffffffff
push 0x635ab8
call fcn.00483890
mov dword [ebp - 0x212c], eax
mov byte [ebp - 4], 0x33
push 0xffffffffffffffff
push 0x635ab4
call fcn.00483890
mov dword [ebp - 0x20fc], eax
mov byte [ebp - 4], 0x34
push 0xffffffffffffffff
push 0x635ab0
call fcn.00483890
add esp, 0x40
mov dword [ebp - 0x20a4], eax
mov byte [ebp - 4], 0x35
push 0xffffffffffffffff
push 0x635aac
call fcn.00483890
mov dword [ebp - 0x20f4], eax
mov byte [ebp - 4], 0x36
push 0xffffffffffffffff
push 0x635aa8
call fcn.00483890
mov dword [ebp - 0x2124], eax
mov byte [ebp - 4], 0x37
push 0xffffffffffffffff
push 0x635aa4
call fcn.00483890
mov dword [ebp - 0x20ec], eax
mov byte [ebp - 4], 0x38
push 0xffffffffffffffff
push 0x635aa0
call fcn.00483890
mov dword [ebp - 0x213c], eax
mov byte [ebp - 4], 0x39
push 0xffffffffffffffff
push 0x635a9c
call fcn.00483890
mov dword [ebp - 0x20e4], eax
mov byte [ebp - 4], 0x3a
push 0xffffffffffffffff
push 0x635a98
call fcn.00483890
mov dword [ebp - 0x211c], eax
mov byte [ebp - 4], 0x3b
push 0xffffffffffffffff
push 0x635a94
call fcn.00483890
mov dword [ebp - 0x20dc], eax
mov byte [ebp - 4], 0x3c
push 0xffffffffffffffff
push 0x635a90
call fcn.00483890
add esp, 0x40
mov dword [ebp - 0x2154], eax
mov byte [ebp - 4], 0x3d
push 0xffffffffffffffff
push 0x635a8c
call fcn.00483890
mov dword [ebp - 0x20d4], eax
mov byte [ebp - 4], 0x3e
push 0xffffffffffffffff
push 0x635a88
call fcn.00483890
mov dword [ebp - 0x2114], eax
mov byte [ebp - 4], 0x3f
push 0xffffffffffffffff
push 0x635a84
call fcn.00483890
mov dword [ebp - 0x20cc], eax
mov byte [ebp - 4], 0x40
push 0xffffffffffffffff
push 0x635a80
call fcn.00483890
mov dword [ebp - 0x2134], eax
mov byte [ebp - 4], 0x41
push 0xffffffffffffffff
push 0x635a7c
call fcn.00483890
mov dword [ebp - 0x20c4], eax
mov byte [ebp - 4], 0x42
push 0xffffffffffffffff
push 0x635a78
call fcn.00483890
mov dword [ebp - 0x210c], eax
mov byte [ebp - 4], 0x43
push 0xffffffffffffffff
push 0x635a74
call fcn.00483890
mov dword [ebp - 0x20bc], eax
mov byte [ebp - 4], 0x44
push 0xffffffffffffffff
push 0x635a70
call fcn.00483890
add esp, 0x40
mov dword [ebp - 0x2144], eax
mov byte [ebp - 4], 0x45
push 0xffffffffffffffff
push 0x635a6c
call fcn.00483890
mov dword [ebp - 0x2120], eax
mov byte [ebp - 4], 0x46
push 0xffffffffffffffff
push 0x635a68
call fcn.00483890
mov dword [ebp - 0x2118], eax
mov byte [ebp - 4], 0x47
push 0xffffffffffffffff
push 0x635a64
call fcn.00483890
mov dword [ebp - 0x20ac], eax
mov byte [ebp - 4], 0x48
push 0xffffffffffffffff
push 0x635a60
call fcn.00483890
mov dword [ebp - 0x20b4], eax
mov byte [ebp - 4], 0x49
push 0xffffffffffffffff
push 0x635a5c
call fcn.00483890
mov dword [ebp - 0x2158], eax
mov byte [ebp - 4], 0x4a
push 0xffffffffffffffff
push 0x635a58
call fcn.00483890
mov dword [ebp - 0x2150], eax
mov byte [ebp - 4], 0x4b
push 0xffffffffffffffff
push 0x635a54
call fcn.00483890
mov dword [ebp - 0x2148], eax
mov byte [ebp - 4], 0x4c
push 0xffffffffffffffff
push 0x635a50
call fcn.00483890
add esp, 0x40
mov dword [ebp - 0x2140], eax
mov byte [ebp - 4], 0x4d
push 0xffffffffffffffff
push 0x635a4c
call fcn.00483890
mov dword [ebp - 0x2138], eax
mov byte [ebp - 4], 0x4e
push 0xffffffffffffffff
push str.HTML
call fcn.00483890
mov dword [ebp - 0x2130], eax
mov byte [ebp - 4], 0x4f
push 0xffffffffffffffff
push 0x635a40
call fcn.00483890
mov dword [ebp - 0x2128], eax
mov byte [ebp - 4], 0x50
push 0xffffffffffffffff
push 0x635a3c
call fcn.00483890
mov dword [ebp - 0x214c], eax
mov byte [ebp - 4], 0x51
push 0xffffffffffffffff
push 0x635a38
call fcn.00483890
mov dword [ebp - 0x2058], eax
mov byte [ebp - 4], 0x52
push 0xffffffffffffffff
push 0x635a34
call fcn.00483890
mov dword [ebp - 0x2050], eax
mov byte [ebp - 4], 0x53
push 0xffffffffffffffff
push 0x635a30
call fcn.00483890
mov dword [ebp - 0x208c], eax
mov byte [ebp - 4], 0x54
push 0xffffffffffffffff
push 0x635a2c
call fcn.00483890
add esp, 0x40
mov dword [ebp - 0x2074], eax
mov byte [ebp - 4], 0x55
push 0xffffffffffffffff
push 0x635a28
call fcn.00483890
mov dword [ebp - 0x2094], eax
mov byte [ebp - 4], 0x56
push 0xffffffffffffffff
push 0x635a24
call fcn.00483890
mov dword [ebp - 0x206c], eax
mov byte [ebp - 4], 0x57
push 0xffffffffffffffff
push 0x635a20
call fcn.00483890
mov dword [ebp - 0x2084], eax
mov byte [ebp - 4], 0x58
push 0xffffffffffffffff
push 0x635a1c
call fcn.00483890
mov dword [ebp - 0x204c], eax
mov byte [ebp - 4], 0x59
push 0xffffffffffffffff
push 0x635a18
call fcn.00483890
mov dword [ebp - 0x209c], eax
mov byte [ebp - 4], 0x5a
push 0xffffffffffffffff
push 0x635a14
call fcn.00483890
mov dword [ebp - 0x205c], eax
mov byte [ebp - 4], 0x5b
push 0xffffffffffffffff
push 0x635a10
call fcn.00483890
mov dword [ebp - 0x207c], eax
mov byte [ebp - 4], 0x5c
push 0xffffffffffffffff
push 0x635a0c
call fcn.00483890
add esp, 0x40
mov dword [ebp - 0x2054], eax
mov byte [ebp - 4], 0x5d
push 0xffffffffffffffff
push 0x635a08
call fcn.00483890
mov dword [ebp - 0x20a0], eax
mov byte [ebp - 4], 0x5e
push 0xffffffffffffffff
push 0x635a04
call fcn.00483890
mov dword [ebp - 0x2098], eax
mov byte [ebp - 4], 0x5f
push 0xffffffffffffffff
push 0x635a00
call fcn.00483890
mov dword [ebp - 0x2090], eax
mov byte [ebp - 4], 0x60
push 0xffffffffffffffff
push 0x6359fc
call fcn.00483890
mov dword [ebp - 0x2088], eax
mov byte [ebp - 4], 0x61
push 0xffffffffffffffff
push 0x6359f8
call fcn.00483890
mov dword [ebp - 0x2080], eax
mov byte [ebp - 4], 0x62
push 0xffffffffffffffff
push 0x6359f4
call fcn.00483890
mov dword [ebp - 0x2078], eax
mov byte [ebp - 4], 0x63
push 0xffffffffffffffff
push 0x6359f0
call fcn.00483890
mov dword [ebp - 0x2068], eax
mov byte [ebp - 4], 0x64
push 0xffffffffffffffff
push 0x6359ec
call fcn.00483890
add esp, 0x40
mov dword [ebp - 0x2064], eax
mov byte [ebp - 4], 0x65
lea eax, [esi + 0x7c]
mov dword [ebp - 0x203c], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov edi, dword [ebp - 0x203c]
cmp ecx, 1
je 0x45469d
push 1
push closesocket
mov ecx, edi
call fcn.00402bd0
lea edx, [ebp - 0x2064]
push edx
push eax
mov ecx, edi
call fcn.00402cf0
jmp 0x4546c1
lea eax, [ebp - 0x2064]
push eax
lea ecx, [ebp - 0x2198]
push ecx
mov ecx, edi
call fcn.00402cf0
mov ecx, edi
call fcn.0047ccc0
mov edx, dword [ebp - 0x2198]
mov dword [eax], edx
mov edi, dword [edi]
mov eax, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp eax, 1
je 0x4546ef
push 1
push closesocket
call fcn.00402bd0
lea ecx, [ebp - 0x2068]
push ecx
push eax
mov ecx, edi
call fcn.00402cf0
jmp 0x454711
lea edx, [ebp - 0x2068]
push edx
lea eax, [ebp - 0x2178]
push eax
call fcn.00402cf0
mov ecx, edi
call fcn.0047ccc0
mov ecx, dword [ebp - 0x2178]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x45473f
push 1
push closesocket
call fcn.00402bd0
lea ecx, [ebp - 0x2078]
push ecx
push eax
mov ecx, edi
call fcn.00402cf0
jmp 0x454761
lea edx, [ebp - 0x2078]
push edx
lea eax, [ebp - 0x2180]
push eax
call fcn.00402cf0
mov ecx, edi
call fcn.0047ccc0
mov ecx, dword [ebp - 0x2180]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x45478f
push 1
push closesocket
call fcn.00402bd0
lea ecx, [ebp - 0x2080]
push ecx
push eax
mov ecx, edi
call fcn.00402cf0
jmp 0x4547b1
lea edx, [ebp - 0x2080]
push edx
lea eax, [ebp - 0x2188]
push eax
call fcn.00402cf0
mov ecx, edi
call fcn.0047ccc0
mov ecx, dword [ebp - 0x2188]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x4547df
push 1
push closesocket
call fcn.00402bd0
lea ecx, [ebp - 0x2088]
push ecx
push eax
mov ecx, edi
call fcn.00402cf0
jmp 0x454801
lea edx, [ebp - 0x2088]
push edx
lea eax, [ebp - 0x21a8]
push eax
call fcn.00402cf0
mov ecx, edi
call fcn.0047ccc0
mov ecx, dword [ebp - 0x21a8]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x45482f
push 1
push closesocket
call fcn.00402bd0
lea ecx, [ebp - 0x2090]
push ecx
push eax
mov ecx, edi
call fcn.00402cf0
jmp 0x454851
lea edx, [ebp - 0x2090]
push edx
lea eax, [ebp - 0x21b0]
push eax
call fcn.00402cf0
mov ecx, edi
call fcn.0047ccc0
mov ecx, dword [ebp - 0x21b0]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x45487f
push 1
push closesocket
call fcn.00402bd0
lea ecx, [ebp - 0x2098]
push ecx
push eax
mov ecx, edi
call fcn.00402cf0
jmp 0x4548a1
lea edx, [ebp - 0x2098]
push edx
lea eax, [ebp - 0x21b8]
push eax
call fcn.00402cf0
mov ecx, edi
call fcn.0047ccc0
mov ecx, dword [ebp - 0x21b8]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x4548cf
push 1
push closesocket
call fcn.00402bd0
lea ecx, [ebp - 0x20a0]
push ecx
push eax
mov ecx, edi
call fcn.00402cf0
jmp 0x4548f1
lea edx, [ebp - 0x20a0]
push edx
lea eax, [ebp - 0x2194]
push eax
call fcn.00402cf0
mov ecx, edi
call fcn.0047ccc0
mov ecx, dword [ebp - 0x2194]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x45491f
push 1
push closesocket
call fcn.00402bd0
lea ecx, [ebp - 0x2054]
push ecx
push eax
mov ecx, edi
call fcn.00402cf0
jmp 0x454941
lea edx, [ebp - 0x2054]
push edx
lea eax, [ebp - 0x2164]
push eax
call fcn.00402cf0
mov ecx, edi
call fcn.0047ccc0
mov ecx, dword [ebp - 0x2164]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x45496f
push 1
push closesocket
call fcn.00402bd0
lea ecx, [ebp - 0x207c]
push ecx
push eax
mov ecx, edi
call fcn.00402cf0
jmp 0x454991
lea edx, [ebp - 0x207c]
push edx
lea eax, [ebp - 0x21b4]
push eax
call fcn.00402cf0
mov ecx, edi
call fcn.0047ccc0
mov ecx, dword [ebp - 0x21b4]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x4549bf
push 1
push closesocket
call fcn.00402bd0
lea ecx, [ebp - 0x205c]
push ecx
push eax
mov ecx, edi
call fcn.00402cf0
jmp 0x4549e1
lea edx, [ebp - 0x205c]
push edx
lea eax, [ebp - 0x216c]
push eax
call fcn.00402cf0
mov ecx, edi
call fcn.0047ccc0
mov ecx, dword [ebp - 0x216c]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x454a0f
push 1
push closesocket
call fcn.00402bd0
lea ecx, [ebp - 0x209c]
push ecx
push eax
mov ecx, edi
call fcn.00402cf0
jmp 0x454a31
lea edx, [ebp - 0x209c]
push edx
lea eax, [ebp - 0x219c]
push eax
call fcn.00402cf0
mov ecx, edi
call fcn.0047ccc0
mov ecx, dword [ebp - 0x219c]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x454a5f
push 1
push closesocket
call fcn.00402bd0
lea ecx, [ebp - 0x204c]
push ecx
push eax
mov ecx, edi
call fcn.00402cf0
jmp 0x454a81
lea edx, [ebp - 0x204c]
push edx
lea eax, [ebp - 0x2174]
push eax
call fcn.00402cf0
mov ecx, edi
call fcn.0047ccc0
mov ecx, dword [ebp - 0x2174]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x454aaf
push 1
push closesocket
call fcn.00402bd0
lea ecx, [ebp - 0x2084]
push ecx
push eax
mov ecx, edi
call fcn.00402cf0
jmp 0x454ad1
lea edx, [ebp - 0x2084]
push edx
lea eax, [ebp - 0x21ac]
push eax
call fcn.00402cf0
mov ecx, edi
call fcn.0047ccc0
mov ecx, dword [ebp - 0x21ac]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x454aff
push 1
push closesocket
call fcn.00402bd0
lea ecx, [ebp - 0x206c]
push ecx
push eax
mov ecx, edi
call fcn.00402cf0
jmp 0x454b21
lea edx, [ebp - 0x206c]
push edx
lea eax, [ebp - 0x217c]
push eax
call fcn.00402cf0
mov ecx, edi
call fcn.0047ccc0
mov ecx, dword [ebp - 0x217c]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x454b4f
push 1
push closesocket
call fcn.00402bd0
lea ecx, [ebp - 0x2094]
push ecx
push eax
mov ecx, edi
call fcn.00402cf0
jmp 0x454b71
lea edx, [ebp - 0x2094]
push edx
lea eax, [ebp - 0x21a4]
push eax
call fcn.00402cf0
mov ecx, edi
call fcn.0047ccc0
mov ecx, dword [ebp - 0x21a4]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x454b9f
push 1
push closesocket
call fcn.00402bd0
lea ecx, [ebp - 0x2074]
push ecx
push eax
mov ecx, edi
call fcn.00402cf0
jmp 0x454bc1
lea edx, [ebp - 0x2074]
push edx
lea eax, [ebp - 0x2184]
push eax
call fcn.00402cf0
mov ecx, edi
call fcn.0047ccc0
mov ecx, dword [ebp - 0x2184]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x454bef
push 1
push closesocket
call fcn.00402bd0
lea ecx, [ebp - 0x208c]
push ecx
push eax
mov ecx, edi
call fcn.00402cf0
jmp 0x454c11
lea edx, [ebp - 0x208c]
push edx
lea eax, [ebp - 0x2190]
push eax
call fcn.00402cf0
mov ecx, edi
call fcn.0047ccc0
mov ecx, dword [ebp - 0x2190]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x454c3f
push 1
push closesocket
call fcn.00402bd0
lea ecx, [ebp - 0x2050]
push ecx
push eax
mov ecx, edi
call fcn.00402cf0
jmp 0x454c61
lea edx, [ebp - 0x2050]
push edx
lea eax, [ebp - 0x218c]
push eax
call fcn.00402cf0
mov ecx, edi
call fcn.0047ccc0
mov ecx, dword [ebp - 0x218c]
mov dword [eax], ecx
mov edi, dword [edi]
mov edx, dword [edi]
mov edi, dword [ebp - 0x203c]
mov ecx, edi
cmp edx, 1
je 0x454c8f
push 1
push closesocket
call fcn.00402bd0
lea ecx, [ebp - 0x2058]
push ecx
push eax
mov ecx, edi
call fcn.00402cf0
jmp 0x454cb1
lea edx, [ebp - 0x2058]
push edx
lea eax, [ebp - 0x2070]
push eax
call fcn.00402cf0
mov ecx, edi
call fcn.0047ccc0
mov ecx, dword [ebp - 0x2070]
mov dword [eax], ecx
lea edx, [ebp - 0x2108]
push edx
lea eax, [ebp - 0x2100]
push eax
lea ecx, [ebp - 0x20f8]
push ecx
lea edx, [ebp - 0x20f0]
push edx
lea eax, [ebp - 0x20e8]
push eax
lea ecx, [ebp - 0x20e0]
push ecx
lea edx, [ebp - 0x20d8]
push edx
lea eax, [ebp - 0x20d0]
push eax
lea ecx, [ebp - 0x20c8]
push ecx
lea edx, [ebp - 0x20c0]
push edx
lea eax, [ebp - 0x20b8]
push eax
lea ecx, [ebp - 0x20b0]
push ecx
lea edx, [ebp - 0x2104]
push edx
lea eax, [ebp - 0x212c]
push eax
lea ecx, [ebp - 0x20fc]
push ecx
lea edx, [ebp - 0x20a4]
push edx
lea eax, [ebp - 0x20f4]
push eax
lea ecx, [ebp - 0x2124]
push ecx
lea edx, [ebp - 0x20ec]
push edx
lea eax, [ebp - 0x213c]
push eax
lea ecx, [ebp - 0x20e4]
push ecx
lea edx, [ebp - 0x211c]
push edx
lea eax, [ebp - 0x20dc]
push eax
lea ecx, [ebp - 0x2154]
push ecx
lea edx, [ebp - 0x20d4]
push edx
lea eax, [ebp - 0x2114]
push eax
lea ecx, [ebp - 0x20cc]
push ecx
lea edx, [ebp - 0x2134]
push edx
lea eax, [ebp - 0x20c4]
push eax
lea ecx, [ebp - 0x210c]
push ecx
lea edx, [ebp - 0x20bc]
push edx
lea eax, [ebp - 0x2144]
push eax
lea ecx, [ebp - 0x2120]
push ecx
lea edx, [ebp - 0x2118]
push edx
lea eax, [ebp - 0x20ac]
push eax
lea ecx, [ebp - 0x20b4]
push ecx
lea edx, [ebp - 0x2158]
push edx
lea eax, [ebp - 0x2150]
push eax
lea ecx, [ebp - 0x2148]
push ecx
lea edx, [ebp - 0x2140]
push edx
lea eax, [ebp - 0x2138]
push eax
lea ecx, [ebp - 0x2130]
push ecx
lea edx, [ebp - 0x2128]
push edx
lea eax, [ebp - 0x214c]
push eax
mov ecx, edi
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov ecx, eax
call fcn.00452190
mov byte [ebp - 4], 0x64
lea ecx, [ebp - 0x2064]
call fcn.00497990
mov byte [ebp - 4], 0x63
lea ecx, [ebp - 0x2068]
call fcn.00497990
mov byte [ebp - 4], 0x62
lea ecx, [ebp - 0x2078]
call fcn.00497990
mov byte [ebp - 4], 0x61
lea ecx, [ebp - 0x2080]
call fcn.00497990
mov byte [ebp - 4], 0x60
lea ecx, [ebp - 0x2088]
call fcn.00497990
mov byte [ebp - 4], 0x5f
lea ecx, [ebp - 0x2090]
call fcn.00497990
mov byte [ebp - 4], 0x5e
lea ecx, [ebp - 0x2098]
call fcn.00497990
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x20a0]
call fcn.00497990
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0x2054]
call fcn.00497990
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0x207c]
call fcn.00497990
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x205c]
call fcn.00497990
mov byte [ebp - 4], 0x59
lea ecx, [ebp - 0x209c]
call fcn.00497990
mov byte [ebp - 4], 0x58
lea ecx, [ebp - 0x204c]
call fcn.00497990
mov byte [ebp - 4], 0x57
lea ecx, [ebp - 0x2084]
call fcn.00497990
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0x206c]
call fcn.00497990
mov byte [ebp - 4], 0x55
lea ecx, [ebp - 0x2094]
call fcn.00497990
mov byte [ebp - 4], 0x54
lea ecx, [ebp - 0x2074]
call fcn.00497990
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0x208c]
call fcn.00497990
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0x2050]
call fcn.00497990
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x2058]
call fcn.00497990
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0x214c]
call fcn.00497990
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x2128]
call fcn.00497990
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0x2130]
call fcn.00497990
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x2138]
call fcn.00497990
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0x2140]
call fcn.00497990
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x2148]
call fcn.00497990
mov byte [ebp - 4], 0x4a
lea ecx, [ebp - 0x2150]
call fcn.00497990
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x2158]
call fcn.00497990
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x20b4]
call fcn.00497990
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x20ac]
call fcn.00497990
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0x2118]
call fcn.00497990
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x2120]
call fcn.00497990
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x2144]
call fcn.00497990
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x20bc]
call fcn.00497990
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x210c]
call fcn.00497990
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x20c4]
call fcn.00497990
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x2134]
call fcn.00497990
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x20cc]
call fcn.00497990
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x2114]
call fcn.00497990
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x20d4]
call fcn.00497990
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x2154]
call fcn.00497990
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x20dc]
call fcn.00497990
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x211c]
call fcn.00497990
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x20e4]
call fcn.00497990
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x213c]
call fcn.00497990
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x20ec]
call fcn.00497990
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x2124]
call fcn.00497990
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x20f4]
call fcn.00497990
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x20a4]
call fcn.00497990
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x20fc]
call fcn.00497990
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x212c]
call fcn.00497990
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x2104]
call fcn.00497990
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x20b0]
call fcn.00497990
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x20b8]
call fcn.00497990
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x20c0]
call fcn.00497990
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x20c8]
call fcn.00497990
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x20d0]
call fcn.00497990
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x20d8]
call fcn.00497990
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x20e0]
call fcn.00497990
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x20e8]
call fcn.00497990
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x20f0]
call fcn.00497990
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x20f8]
call fcn.00497990
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x2100]
call fcn.00497990
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x2108]
call fcn.00497990
xor edi, edi
push ecx
mov ecx, esp
mov dword [ebp - 0x2070], esp
push ecx
mov ecx, 0x635af0
call fcn.004026a0
mov byte [ebp - 4], 0x66
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.004301f0
test eax, eax
jne 0x455326
call fcn.00452140
push eax
push ecx
mov edx, esp
mov dword [ebp - 0x2070], esp
push edx
mov ecx, 0x635af0
call fcn.004026a0
mov byte [ebp - 4], 0x67
mov byte [ebp - 4], bl
call fcn.004302e0
cmp dword [0x65236c], 1
jl 0x455343
push 0x635b10
push str.CIkAV::CIkAV
push 1
call fcn.004fa3c2
add esp, 0xc
push 0
call fcn.00469d50
add esp, 4
mov dword [0x66b074], eax
test eax, eax
je 0x4554c1
push 0x400
lea eax, [ebp - 0x2018]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
lea ecx, [ebp - 0x2018]
push ecx
call fcn.004fed59
add esp, 8
xor edx, edx
mov word [eax], dx
lea eax, [ebp - 0x2048]
push eax
lea ecx, [ebp - 0x2018]
call fcn.004026a0
mov byte [ebp - 4], 0x68
lea ecx, [ebp - 0x2048]
push ecx
lea edx, [ebp - 0x21a0]
push edx
mov ebx, str._sshisgui.exe
call fcn.0042b340
add esp, 8
mov byte [ebp - 4], 0x69
lea edi, [ebp - 0x2048]
call fcn.0040e9d0
mov bl, 0x68
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x21a0]
call fcn.00402750
mov dword [ebp - 0x2028], 0x737a8864
mov eax, 0xc2d9
mov word [ebp - 0x2024], ax
mov ecx, 0x4337
mov word [ebp - 0x2022], cx
mov byte [ebp - 0x2020], 0xb4
mov byte [ebp - 0x201f], 0x9a
mov byte [ebp - 0x201e], 0xb5
mov byte [ebp - 0x201d], 0xe3
mov byte [ebp - 0x201c], 0x58
mov byte [ebp - 0x201b], 0x15
mov byte [ebp - 0x201a], 0xb9
mov byte [ebp - 0x2019], 0xbb
mov ecx, dword [0x66b074]
mov edx, dword [ecx]
lea eax, [ebp - 0x2028]
push eax
mov edx, dword [edx + 4]
call edx
mov eax, 0x632b00
lea ecx, [ebp - 0x21d4]
call fcn.0040c640
mov byte [ebp - 4], 0x6a
mov ecx, dword [0x66b074]
mov eax, dword [ecx]
lea edx, [ebp - 0x21d4]
push edx
mov eax, dword [eax + 0xc]
call eax
mov byte [ebp - 4], bl
lea esi, [ebp - 0x21d4]
call fcn.0042f9c0
mov esi, edi
call fcn.0040cd10
lea ecx, [ebp - 0x2228]
call fcn.0040c640
mov byte [ebp - 4], 0x6b
mov ecx, dword [0x66b074]
mov edx, dword [ecx]
lea eax, [ebp - 0x2228]
push eax
mov edx, dword [edx + 8]
call edx
mov byte [ebp - 4], bl
lea esi, [ebp - 0x2228]
call fcn.0042f9c0
mov byte [ebp - 4], 0x16
mov ecx, edi
call fcn.00402750
mov esi, dword [ebp - 0x2060]
push 1
call fcn.00469d50
add esp, 4
mov dword [0x66b078], eax
test eax, eax
je 0x45563f
push 0x400
lea eax, [ebp - 0x1018]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
lea ecx, [ebp - 0x1018]
push ecx
call fcn.004fed59
add esp, 8
xor edx, edx
mov word [eax], dx
lea eax, [ebp - 0x2044]
push eax
lea ecx, [ebp - 0x1018]
call fcn.004026a0
mov byte [ebp - 4], 0x6c
lea ecx, [ebp - 0x2044]
push ecx
lea edx, [ebp - 0x2160]
push edx
mov ebx, str._sshisgui.exe
call fcn.0042b340
add esp, 8
mov byte [ebp - 4], 0x6d
lea edi, [ebp - 0x2044]
call fcn.0040e9d0
mov bl, 0x6c
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x2160]
call fcn.00402750
mov dword [ebp - 0x2038], 0x737a8864
mov eax, 0xc2d9
mov word [ebp - 0x2034], ax
mov ecx, 0x4337
mov word [ebp - 0x2032], cx
mov byte [ebp - 0x2030], 0xb4
mov byte [ebp - 0x202f], 0x9a
mov byte [ebp - 0x202e], 0xb5
mov byte [ebp - 0x202d], 0xe3
mov byte [ebp - 0x202c], 0x58
mov byte [ebp - 0x202b], 0x15
mov byte [ebp - 0x202a], 0xb9
mov byte [ebp - 0x2029], 0xbc
mov ecx, dword [0x66b078]
mov edx, dword [ecx]
lea eax, [ebp - 0x2038]
push eax
mov edx, dword [edx + 4]
call edx
mov eax, 0x632b00
lea ecx, [ebp - 0x220c]
call fcn.0040c640
mov byte [ebp - 4], 0x6e
mov ecx, dword [0x66b078]
mov eax, dword [ecx]
lea edx, [ebp - 0x220c]
push edx
mov eax, dword [eax + 0xc]
call eax
mov byte [ebp - 4], bl
lea esi, [ebp - 0x220c]
call fcn.0042f9c0
mov esi, edi
call fcn.0040cd10
lea ecx, [ebp - 0x21f0]
call fcn.0040c640
mov byte [ebp - 4], 0x6f
mov ecx, dword [0x66b078]
mov edx, dword [ecx]
lea eax, [ebp - 0x21f0]
push eax
mov edx, dword [edx + 8]
call edx
mov byte [ebp - 4], bl
lea esi, [ebp - 0x21f0]
call fcn.0042f9c0
mov byte [ebp - 4], 0x16
mov ecx, edi
call fcn.00402750
mov esi, dword [ebp - 0x2060]
call fcn.00424240
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x66b0b0], eax
mov byte [esi + 0x54], 0
push 0x66adf8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x400
lea eax, [ebp - 0x1818]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
lea ecx, [ebp - 0x1818]
push ecx
call fcn.004fed59
add esp, 8
xor edx, edx
mov word [eax], dx
lea eax, [ebp - 0x20a8]
push eax
lea ecx, [ebp - 0x1818]
call fcn.004026a0
mov byte [ebp - 4], 0x70
lea ecx, [ebp - 0x20a8]
push ecx
lea edx, [ebp - 0x2168]
push edx
mov ebx, str.msav.db
call fcn.0042b340
add esp, 8
mov byte [ebp - 4], 0x71
mov edi, 0x66bd58
call fcn.0040e9d0
mov byte [ebp - 4], 0x70
lea ecx, [ebp - 0x2168]
call fcn.00402750
push 0
push 0x23
lea eax, [ebp - 0x818]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x818]
add eax, 0xfffffffe
lea ebx, [ebx]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x455700
mov ecx, dword [str.SSHHome]
mov dword [eax], ecx
mov edx, dword [0x635b5c]
mov dword [eax + 4], edx
mov ecx, dword [0x635b60]
mov dword [eax + 8], ecx
mov edx, dword [0x635b64]
mov dword [eax + 0xc], edx
mov cx, word [0x635b68]
mov word [eax + 0x10], cx
push 0
lea edx, [ebp - 0x818]
push edx
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call edi
lea eax, [ebp - 0x818]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x455754
mov ecx, dword [0x635b6c]
mov dword [eax], ecx
mov dx, word [0x635b70]
mov word [eax + 4], dx
push 0
lea eax, [ebp - 0x818]
push eax
call edi
lea ecx, [ebp - 0x818]
push ecx
call fcn.00440820
add esp, 4
call fcn.00453b30
push 0
push 0
push 1
push 0
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
call edi
mov dword [0x66b0a4], eax
push 0
push 1
push 1
push 0
call edi
mov dword [esi + 0x2c], eax
call fcn.00431030
mov dword [0x66b0ac], esi
mov dword [ebp - 0x2110], 0xffffffff
mov dword [ebp - 0x2040], 0
mov dword [ebp - 0x2170], 4
lea edx, [ebp - 0x2170]
push edx
lea eax, [ebp - 0x2110]
push eax
lea ecx, [ebp - 0x2040]
push ecx
push 0x635b74
push str.Software_sshiktmp
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp - 0x2110]
cmp eax, 0xffffffff
je 0x455837
push eax
push str.ServerIndex
push str.Update
call fcn.00401e90
push str.Software_sshiktmp
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
call fcn.00402620
mov ecx, esi
call fcn.004624a0
push esi
call fcn.00462b10
call fcn.004632d0
push 0
push 0
mov ebx, 1
call fcn.00456bf0
xor edi, edi
push ecx
mov edx, esp
mov dword [ebp - 0x2040], esp
push edx
mov ecx, 0x635bac
call fcn.004026a0
mov byte [ebp - 4], 0x72
mov byte [ebp - 4], 0x70
mov ecx, edi
call fcn.004301f0
cmp eax, ebx
jne 0x455887
mov bl, bl
call fcn.004570c0
mov ecx, esi
call fcn.0045cc50
xor edi, edi
push ecx
mov eax, esp
mov dword [ebp - 0x2040], esp
push eax
mov ecx, str.USBPassword
call fcn.004026a0
mov byte [ebp - 4], 0x73
mov byte [ebp - 4], 0x70
mov ecx, edi
call fcn.004301f0
mov dword [esi + 0xbc], eax
push edi
push edi
push esi
push 0x463260
push edi
push edi
call fcn.004ff05b
push edi
push edi
push esi
push 0x456930
push edi
push edi
call fcn.004ff05b
push edi
push edi
push esi
push 0x4567e0
push edi
push edi
call fcn.004ff05b
add esp, 0x48
push edi
push edi
push esi
push 0x456530
push edi
push edi
call fcn.004ff05b
push edi
push edi
push esi
push 0x4559f0
push edi
push edi
call fcn.004ff05b
add esp, 0x30
mov ecx, 0x66bbe0
call fcn.0044de20
push edi
push edi
push 0x66bbe0
push 0x44e220
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x66bc0c], eax
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x20a8]
call fcn.00402750
mov dword [ebp - 4], 0x15
jmp 0x455975
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fdb4a
mov esp, ebp
pop ebp
ret