Function at 0x45adf0
Capabilities:
Create process on windows
Delete file
Get common file path
Get startup folder
Persist via run registry key
Self delete

Disassembly:
push ebx
mov ebx, esp
test dword [esp], esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60a25b
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x700
call fcn.005dfa60
mov eax, dword [0x6a704c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x6aa], cl
call fcn.00450d30
mov edi, bind
test al, al
jne 0x45af6c
push 8
mov dword [ebp - 0x648], 0
lea ecx, [ebp - 0x648]
push str.taskkill
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x634], 0xf
mov byte [ebp - 0x648], al
call fcn.00446eb0
mov dword [ebp - 4], 0
call fcn.00452730
mov ecx, edi
mov edx, dword [eax + 0x10]
sub ecx, edx
cmp ecx, 7
jb 0x45c5cd
cmp dword [eax + 0x14], 0x10
jb 0x45aeaa
mov eax, dword [eax]
push edx
push eax
push 7
push str._f__im
push ecx
push dword [ebp - 0x6b0]
lea ecx, [ebp - 0x660]
call fcn.004473d0
lea edx, [ebp - 0x660]
lea ecx, [ebp - 0x648]
call fcn.00451b80
mov edx, dword [ebp - 0x64c]
cmp edx, 0x10
jb 0x45af10
mov ecx, dword [ebp - 0x660]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45af06
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c5d2
push edx
push ecx
call fcn.005df326
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x634]
mov dword [ebp - 0x650], 0
mov dword [ebp - 0x64c], 0xf
mov byte [ebp - 0x660], 0
cmp edx, 0x10
jb 0x45af6c
mov ecx, dword [ebp - 0x648]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45af62
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c5d2
push edx
push ecx
call fcn.005df326
add esp, 8
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0045c840
mov ecx, eax
call fcn.0045ca20
call fcn.0045a1b0
call fcn.00458890
mov dword [ebp - 0x6c8], 0
mov dword [ebp - 0x6c4], 0
mov dword [ebp - 0x6c0], 0
mov dword [ebp - 4], 1
call fcn.0044f870
mov ecx, edi
mov edx, dword [eax + 0x10]
sub ecx, edx
cmp ecx, 0x15
jb 0x45c5d7
cmp dword [eax + 0x14], 0x10
jb 0x45afcf
mov eax, dword [eax]
push 0x15
push str.MediaGet2Luminati_m
push edx
push eax
push ecx
push dword [ebp - 0x6b0]
lea ecx, [ebp - 0x660]
call fcn.004473d0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x6c4]
cmp eax, dword [ebp - 0x6c0]
je 0x45b02e
movups xmm0, xmmword [ebp - 0x660]
mov dword [eax], 0
mov edx, 0xf
mov byte [ebp - 0x660], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x650]
movq qword [eax + 0x10], xmm0
add dword [ebp - 0x6c4], 0x18
jmp 0x45b047
lea ecx, [ebp - 0x660]
push ecx
push eax
lea ecx, [ebp - 0x6c8]
call fcn.00453790
mov edx, dword [ebp - 0x64c]
mov byte [ebp - 4], 1
cmp edx, 0x10
jb 0x45b07f
mov ecx, dword [ebp - 0x660]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45b075
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c645
push edx
push ecx
call fcn.005df326
add esp, 8
call fcn.0044f620
lea edx, [ebp - 0x6c8]
mov ecx, eax
call fcn.0044ea30
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x6af348]
mov dword [ebp - 0x6bc], ecx
cmp eax, dword [ecx + 4]
jle 0x45b0fa
push 0x6af348
call fcn.005df48a
add esp, 4
cmp dword [0x6af348], 0xffffffff
jne 0x45b0fa
push 0x60a7a0
mov dword [0x6af34c], 0
mov dword [0x6af35c], 0
mov dword [0x6af360], 0xf
call fcn.005df311
add esp, 4
push 0x6af348
call fcn.005df440
add esp, 4
cmp dword [0x6af35c], 0
jne 0x45b233
push 0x208
push 0
mov dword [ebp - 0x664], 0x104
call fcn.005e4cb3
mov esi, eax
add esp, 8
mov dword [ebp - 0x668], esi
push 1
push 0x1c
push esi
push 0
mov byte [ebp - 4], 3
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edx, esi
lea ecx, [ebp - 0x660]
call fcn.0044e3a0
push str.Media_Get_LLCMediaGet2_
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.00446fe0
mov ecx, 0x6af34c
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x648], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x648]
push eax
movq qword [ebp - 0x638], xmm0
call fcn.004470a0
mov edx, dword [ebp - 0x634]
cmp edx, 0x10
jb 0x45b1c9
mov ecx, dword [ebp - 0x648]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45b1bf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c5dc
push edx
push ecx
call fcn.005df326
add esp, 8
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x64c]
cmp edx, 0x10
jb 0x45b207
mov ecx, dword [ebp - 0x660]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45b1fd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c5dc
push edx
push ecx
call fcn.005df326
add esp, 8
mov dword [ebp - 0x650], 0
mov dword [ebp - 0x64c], 0xf
mov byte [ebp - 0x660], 0
mov byte [ebp - 4], 1
test esi, esi
je 0x45b233
push esi
call fcn.005e4cbe
add esp, 4
mov ecx, 0x6af34c
call fcn.0044e450
call fcn.0044f3d0
mov ecx, eax
call fcn.0044e450
mov ecx, dword [ebp - 0x6bc]
mov eax, dword [0x6af468]
cmp eax, dword [ecx + 4]
jle 0x45b2aa
push 0x6af468
call fcn.005df48a
add esp, 4
cmp dword [0x6af468], 0xffffffff
jne 0x45b2aa
push 0x60a8c0
mov dword [0x6af478], 0
mov dword [0x6af488], 0
mov dword [0x6af48c], 0xf
call fcn.005df311
add esp, 4
push 0x6af468
call fcn.005df440
add esp, 4
cmp dword [0x6af488], 0
jne 0x45b3e7
call fcn.00452940
mov esi, eax
call fcn.0044f9c0
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x6b0], ecx
mov ecx, edi
mov edi, dword [ebp - 0x6b0]
mov edx, dword [eax + 0x10]
sub ecx, edx
cmp ecx, edi
jb 0x45c5e1
cmp dword [eax + 0x14], 0x10
jb 0x45b2e9
mov eax, dword [eax]
cmp dword [esi + 0x14], 0x10
jb 0x45b2f1
mov esi, dword [esi]
push edi
push esi
push edx
push eax
push ecx
push dword [ebp - 0x6b0]
lea ecx, [ebp - 0x660]
call fcn.004473d0
push 0x679530
lea ecx, [ebp - 0x660]
mov byte [ebp - 4], 5
call fcn.00446fe0
mov ecx, 0x6af478
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x648], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x648]
push eax
movq qword [ebp - 0x638], xmm0
call fcn.004470a0
mov edx, dword [ebp - 0x634]
cmp edx, 0x10
jb 0x45b38e
mov ecx, dword [ebp - 0x648]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45b384
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c5e6
push edx
push ecx
call fcn.005df326
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x64c]
cmp edx, 0x10
jb 0x45b3cc
mov ecx, dword [ebp - 0x660]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45b3c2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c5e6
push edx
push ecx
call fcn.005df326
add esp, 8
mov dword [ebp - 0x650], 0
mov dword [ebp - 0x64c], 0xf
mov byte [ebp - 0x660], 0
mov ecx, 0x6af478
call fcn.0044e450
call fcn.00451f50
mov ecx, eax
call fcn.0044e450
xor esi, esi
xor edi, edi
mov dword [ebp - 0x668], esi
mov dword [ebp - 0x664], edi
mov ecx, dword [ebp - 0x6bc]
mov byte [ebp - 4], 6
mov eax, dword [0x6af470]
cmp eax, dword [ecx + 4]
jle 0x45b46a
push 0x6af470
call fcn.005df48a
add esp, 4
cmp dword [0x6af470], 0xffffffff
jne 0x45b46a
push 0x60a800
mov dword [0x6af524], edi
mov dword [0x6af534], edi
mov dword [0x6af538], 0xf
call fcn.005df311
add esp, 4
push 0x6af470
call fcn.005df440
add esp, 4
cmp dword [0x6af534], 0
jne 0x45b5ab
push 0x208
push 0
mov dword [ebp - 0x6b0], 0x104
call fcn.005e4cb3
add esp, 8
mov dword [ebp - 0x6b4], eax
push 1
push 0x10
push eax
push 0
mov byte [ebp - 4], 7
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edx, dword [ebp - 0x6b4]
lea ecx, [ebp - 0x660]
call fcn.0044e3a0
push 0x679530
mov ecx, eax
mov byte [ebp - 4], 8
call fcn.00446fe0
mov ecx, 0x6af524
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x6a8], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x6a8]
push eax
movq qword [ebp - 0x698], xmm0
call fcn.004470a0
mov edx, dword [ebp - 0x694]
cmp edx, 0x10
jb 0x45b53b
mov ecx, dword [ebp - 0x6a8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45b531
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c5eb
push edx
push ecx
call fcn.005df326
add esp, 8
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x64c]
cmp edx, 0x10
jb 0x45b579
mov ecx, dword [ebp - 0x660]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45b56f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c5eb
push edx
push ecx
call fcn.005df326
add esp, 8
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x6b4]
mov dword [ebp - 0x650], 0
mov dword [ebp - 0x64c], 0xf
mov byte [ebp - 0x660], 0
test eax, eax
je 0x45b5ab
push eax
call fcn.005e4cbe
add esp, 4
call fcn.004527e0
mov ecx, bind
sub ecx, dword [0x6af534]
mov edx, dword [eax + 0x10]
cmp ecx, edx
jb 0x45c5f0
cmp dword [0x6af538], 0x10
mov ecx, 0x6af524
cmovae ecx, dword [0x6af524]
cmp dword [eax + 0x14], 0x10
jb 0x45b5e1
mov eax, dword [eax]
push edx
push eax
push dword [0x6af534]
push ecx
push ecx
push dword [ebp - 0x6b0]
lea ecx, [ebp - 0x690]
call fcn.004473d0
push str..lnk
lea ecx, [ebp - 0x690]
mov byte [ebp - 4], 9
call fcn.00446fe0
push 0
push 0
push 0xffffffffffffffff
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x648], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x638], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x648]
cmp dword [ebp - 0x634], 0x10
cmovae eax, dword [ebp - 0x648]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x45b681
mov edi, eax
add eax, eax
push eax
push 0
mov dword [ebp - 0x664], edi
call fcn.005e4cb3
mov esi, eax
add esp, 8
mov dword [ebp - 0x668], esi
cmp dword [ebp - 0x634], 0x10
lea ecx, [ebp - 0x648]
push edi
cmovae ecx, dword [ebp - 0x648]
push esi
push 0xffffffffffffffff
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, dword [ebp - 0x634]
cmp edx, 0x10
jb 0x45b6e1
mov ecx, dword [ebp - 0x648]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45b6d7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c5f5
push edx
push ecx
call fcn.005df326
add esp, 8
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x67c]
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x634], 0xf
mov byte [ebp - 0x648], 0
cmp edx, 0x10
jb 0x45b73a
mov ecx, dword [ebp - 0x690]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45b730
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c5f5
push edx
push ecx
call fcn.005df326
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.004527e0
mov dword [ebp - 0x6b8], eax
call fcn.0044f9c0
mov edx, dword [ebp - 0x6b8]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x6b0], ecx
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x6b8], ecx
mov ecx, bind
sub ecx, dword [ebp - 0x6b0]
cmp ecx, dword [ebp - 0x6b8]
jb 0x45c5fa
cmp dword [eax + 0x14], 0x10
jb 0x45b788
mov eax, dword [eax]
cmp dword [edx + 0x14], 0x10
jb 0x45b790
mov edx, dword [edx]
push dword [ebp - 0x6b8]
push edx
push dword [ebp - 0x6b0]
push eax
push ecx
push dword [ebp - 0x6b0]
lea ecx, [ebp - 0x690]
call fcn.004473d0
push str..lnk
lea ecx, [ebp - 0x690]
mov byte [ebp - 4], 0xa
call fcn.00446fe0
push 0
push 0
push 0xffffffffffffffff
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x648], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x638], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x648]
cmp dword [ebp - 0x634], 0x10
cmovae eax, dword [ebp - 0x648]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
jbe 0x45b828
mov edi, eax
add eax, eax
push eax
push esi
call fcn.005e4cb3
add esp, 8
mov esi, eax
cmp dword [ebp - 0x634], 0x10
lea eax, [ebp - 0x648]
push edi
cmovae eax, dword [ebp - 0x648]
push esi
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, dword [ebp - 0x634]
cmp edx, 0x10
jb 0x45b888
mov ecx, dword [ebp - 0x648]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45b87e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c5ff
push edx
push ecx
call fcn.005df326
add esp, 8
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x67c]
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x634], 0xf
mov byte [ebp - 0x648], 0
cmp edx, 0x10
jb 0x45b8e1
mov ecx, dword [ebp - 0x690]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45b8d7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c5ff
push edx
push ecx
call fcn.005df326
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 1
test esi, esi
je 0x45b8f9
push esi
call fcn.005e4cbe
add esp, 4
push 0
mov dword [ebp - 0x678], 0
lea ecx, [ebp - 0x678]
push 0x679347
mov dword [ebp - 0x668], 0
mov dword [ebp - 0x664], 0xf
mov byte [ebp - 0x678], 0
call fcn.00446eb0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x648]
push 0xa
mov dword [ebp - 0x648], 0
push str.installId2
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x634], 0xf
mov byte [ebp - 0x648], 0
call fcn.00446eb0
mov byte [ebp - 4], 0xc
call fcn.00452500
mov edi, bind
mov ecx, edi
mov edx, dword [eax + 0x10]
sub ecx, edx
cmp ecx, 0xd
jb 0x45c604
cmp dword [eax + 0x14], 0x10
jb 0x45b991
mov eax, dword [eax]
push 0xd
push str.mediaget_info
push edx
push eax
push ecx
push dword [ebp - 0x6b0]
lea ecx, [ebp - 0x660]
call fcn.004473d0
lea eax, [ebp - 0x678]
push eax
lea eax, [ebp - 0x648]
push eax
lea edx, [ebp - 0x660]
call fcn.00450370
mov edx, dword [ebp - 0x64c]
add esp, 8
cmp edx, 0x10
jb 0x45ba02
mov ecx, dword [ebp - 0x660]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45b9f8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c609
push edx
push ecx
call fcn.005df326
add esp, 8
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x634]
mov dword [ebp - 0x650], 0
mov dword [ebp - 0x64c], 0xf
mov byte [ebp - 0x660], 0
cmp edx, 0x10
jb 0x45ba5b
mov ecx, dword [ebp - 0x648]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45ba51
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c609
push edx
push ecx
call fcn.005df326
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x664]
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x634], 0xf
mov byte [ebp - 0x648], 0
cmp edx, 0x10
jb 0x45bab4
mov ecx, dword [ebp - 0x678]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45baaa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c609
push edx
push ecx
call fcn.005df326
add esp, 8
push 0
mov dword [ebp - 0x678], 0
lea ecx, [ebp - 0x678]
push 0x679347
mov dword [ebp - 0x668], 0
mov dword [ebp - 0x664], 0xf
mov byte [ebp - 0x678], 0
call fcn.00446eb0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x648]
push 0xa
mov dword [ebp - 0x648], 0
push str.installId2
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x634], 0xf
mov byte [ebp - 0x648], 0
call fcn.00446eb0
lea eax, [ebp - 0x678]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0x648]
push eax
call fcn.004525b0
mov edx, eax
call fcn.00450370
mov byte [ebp - 4], 0xd
add esp, 8
mov edx, dword [ebp - 0x634]
cmp edx, 0x10
jb 0x45bb85
mov ecx, dword [ebp - 0x648]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45bb7b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c60e
push edx
push ecx
call fcn.005df326
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x664]
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x634], 0xf
mov byte [ebp - 0x648], 0
cmp edx, 0x10
jb 0x45bbde
mov ecx, dword [ebp - 0x678]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45bbd4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c60e
push edx
push ecx
call fcn.005df326
add esp, 8
call fcn.004525b0
mov ecx, edi
mov edx, dword [eax + 0x10]
sub ecx, edx
cmp ecx, 0x13
jb 0x45c613
cmp dword [eax + 0x14], 0x10
jb 0x45bbfb
mov eax, dword [eax]
push 0x13
push str.transfers_transfers
push edx
push eax
push ecx
push dword [ebp - 0x6b0]
lea ecx, [ebp - 0x690]
call fcn.004473d0
lea edx, [ebp - 0x690]
mov byte [ebp - 4], 0xf
mov ecx, reloc.WS2_32.dll_accept
call fcn.00450730
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x67c]
cmp edx, 0x10
jb 0x45bc68
mov ecx, dword [ebp - 0x690]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45bc5e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c618
push edx
push ecx
call fcn.005df326
add esp, 8
call fcn.004527e0
mov ecx, edi
mov edx, dword [eax + 0x10]
sub ecx, edx
cmp ecx, 0x34
jb 0x45c61d
cmp dword [eax + 0x14], 0x10
jb 0x45bc85
mov eax, dword [eax]
push edx
push eax
push 0x34
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push ecx
push dword [ebp - 0x6b0]
lea ecx, [ebp - 0x690]
call fcn.004473d0
lea edx, [ebp - 0x690]
mov byte [ebp - 4], 0x10
mov ecx, reloc.WS2_32.dll_accept
call fcn.00450730
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x67c]
cmp edx, 0x10
jb 0x45bcf2
mov ecx, dword [ebp - 0x690]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45bce8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c622
push edx
push ecx
call fcn.005df326
add esp, 8
push 0x2d
mov dword [ebp - 0x648], 0
lea ecx, [ebp - 0x648]
push str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x634], 0xf
mov byte [ebp - 0x648], 0
call fcn.00446eb0
mov byte [ebp - 4], 0x11
call fcn.004527e0
push eax
lea edx, [ebp - 0x648]
call fcn.004504f0
mov byte [ebp - 4], 1
add esp, 4
mov edx, dword [ebp - 0x634]
cmp edx, 0x10
jb 0x45bd7f
mov ecx, dword [ebp - 0x648]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45bd75
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c627
push edx
push ecx
call fcn.005df326
add esp, 8
mov esi, dword [ebp - 0x6bc]
mov eax, dword [0x6af444]
cmp eax, dword [esi + 4]
jle 0x45bdf9
push 0x6af444
call fcn.005df48a
add esp, 4
cmp dword [0x6af444], 0xffffffff
jne 0x45bdf9
mov byte [ebp - 4], 0x12
mov ecx, 0x6af450
push 0x24
push str.SoftwareClassesmediagettorrentfile
mov dword [0x6af450], 0
mov dword [0x6af460], 0
mov dword [0x6af464], 0xf
call fcn.00446eb0
push 0x60ab60
call fcn.005df311
add esp, 4
mov byte [ebp - 4], 1
push 0x6af444
call fcn.005df440
add esp, 4
mov edx, 0x6af450
mov ecx, reloc.WS2_32.dll_accept
call fcn.00450730
mov eax, dword [0x6af408]
cmp eax, dword [esi + 4]
jle 0x45be7c
push 0x6af408
call fcn.005df48a
add esp, 4
cmp dword [0x6af408], 0xffffffff
jne 0x45be7c
mov byte [ebp - 4], 0x13
mov ecx, 0x6af3e8
push 0x22
push str.SoftwareClassesmediagetvideofile
mov dword [0x6af3e8], 0
mov dword [0x6af3f8], 0
mov dword [0x6af3fc], 0xf
call fcn.00446eb0
push 0x60abc0
call fcn.005df311
add esp, 4
mov byte [ebp - 4], 1
push 0x6af408
call fcn.005df440
add esp, 4
mov edx, 0x6af3e8
mov ecx, reloc.WS2_32.dll_accept
call fcn.00450730
push 0x20
mov dword [ebp - 0x648], 0
lea ecx, [ebp - 0x648]
push str.Directory_shellPlayWithMediaGet
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x634], 0xf
mov byte [ebp - 0x648], 0
call fcn.00446eb0
lea edx, [ebp - 0x648]
mov byte [ebp - 4], 0x14
mov ecx, bind
call fcn.00450730
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x634]
cmp edx, 0x10
jb 0x45bf14
mov ecx, dword [ebp - 0x648]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45bf0a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c62c
push edx
push ecx
call fcn.005df326
add esp, 8
call fcn.0044f620
mov ecx, edi
mov edx, dword [eax + 0x10]
sub ecx, edx
cmp ecx, 0xc
jb 0x45c631
cmp dword [eax + 0x14], 0x10
jb 0x45bf31
mov eax, dword [eax]
push 0xc
push str.mediaget.exe
push edx
push eax
push ecx
push dword [ebp - 0x6b0]
lea ecx, [ebp - 0x690]
call fcn.004473d0
lea ecx, [ebp - 0x690]
call fcn.00451b00
mov edx, dword [ebp - 0x67c]
mov byte [ebp - 0x6a9], al
cmp edx, 0x10
jb 0x45bf9d
mov ecx, dword [ebp - 0x690]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45bf8d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c636
push edx
push ecx
call fcn.005df326
mov al, byte [ebp - 0x6a9]
add esp, 8
test al, al
je 0x45c050
push 0x13
mov dword [ebp - 0x648], 0
lea ecx, [ebp - 0x648]
push str.mg_new_exists_after
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x634], 0xf
mov byte [ebp - 0x648], 0
call fcn.00446eb0
mov byte [ebp - 4], 0x15
call fcn.0045c840
mov esi, eax
cmp dword [esi + 0x11c], 0
je 0x45c000
push 0x679ecc
lea ecx, [esi + 0x10c]
call fcn.00446fe0
lea eax, [ebp - 0x648]
push eax
lea ecx, [esi + 0x10c]
call fcn.0044b930
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x634]
cmp edx, 0x10
jb 0x45c050
mov ecx, dword [ebp - 0x648]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45c046
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c645
push edx
push ecx
call fcn.005df326
add esp, 8
call fcn.0044f3d0
mov ecx, dword [eax + 0x10]
sub edi, ecx
cmp edi, 0xc
jb 0x45c63b
cmp dword [eax + 0x14], 0x10
jb 0x45c06b
mov eax, dword [eax]
push 0xc
push str.mediaget.exe
push ecx
push eax
push ecx
push dword [ebp - 0x6b0]
lea ecx, [ebp - 0x690]
call fcn.004473d0
lea ecx, [ebp - 0x690]
call fcn.00451b00
mov edx, dword [ebp - 0x67c]
mov byte [ebp - 0x6a9], al
cmp edx, 0x10
jb 0x45c0d7
mov ecx, dword [ebp - 0x690]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45c0c7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c640
push edx
push ecx
call fcn.005df326
mov al, byte [ebp - 0x6a9]
add esp, 8
test al, al
je 0x45c18a
push 0x13
mov dword [ebp - 0x648], 0
lea ecx, [ebp - 0x648]
push str.mg_old_exists_after
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x634], 0xf
mov byte [ebp - 0x648], 0
call fcn.00446eb0
mov byte [ebp - 4], 0x16
call fcn.0045c840
mov esi, eax
cmp dword [esi + 0x11c], 0
je 0x45c13a
push 0x679ecc
lea ecx, [esi + 0x10c]
call fcn.00446fe0
lea eax, [ebp - 0x648]
push eax
lea ecx, [esi + 0x10c]
call fcn.0044b930
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x634]
cmp edx, 0x10
jb 0x45c18a
mov ecx, dword [ebp - 0x648]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45c180
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c645
push edx
push ecx
call fcn.005df326
add esp, 8
cmp byte [ebp - 0x6aa], 0
je 0x45c253
push 6
mov dword [ebp - 0x648], 0
lea ecx, [ebp - 0x648]
push str.silent
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x634], 0xf
mov byte [ebp - 0x648], 0
call fcn.00446eb0
mov byte [ebp - 4], 0x17
call fcn.0045c840
mov esi, eax
cmp dword [esi + 0x11c], 0
je 0x45c1f2
push 0x679ecc
lea ecx, [esi + 0x10c]
call fcn.00446fe0
lea eax, [ebp - 0x648]
push eax
lea ecx, [esi + 0x10c]
call fcn.0044b930
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x634]
cmp edx, 0x10
jb 0x45c253
mov ecx, dword [ebp - 0x648]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45c238
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c645
push edx
push ecx
call fcn.005df326
add esp, 8
call fcn.0045c840
mov ecx, eax
call fcn.0045ce00
jmp 0x45c511
call fcn.0045c840
mov ecx, eax
call fcn.0045ce00
cmp byte [ebp - 0x6aa], 0
jne 0x45c511
call fcn.0045c840
cmp dword [eax + 0xbc], 0
je 0x45c37e
mov dword [ebp - 0x660], 0
mov dword [ebp - 0x650], 0
mov dword [ebp - 0x64c], 0xf
mov byte [ebp - 0x660], 0
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x634], 0xf
mov byte [ebp - 0x648], 0
lea eax, [ebp - 0x660]
mov byte [ebp - 4], 0x19
push eax
call fcn.0045c840
lea edx, [ebp - 0x648]
lea ecx, [eax + 0xac]
call fcn.00451260
mov edx, dword [ebp - 0x634]
add esp, 4
cmp edx, 0x10
jb 0x45c326
mov ecx, dword [ebp - 0x648]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45c31c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c64a
push edx
push ecx
call fcn.005df326
add esp, 8
mov edx, dword [ebp - 0x64c]
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x634], 0xf
mov byte [ebp - 0x648], 0
cmp edx, 0x10
jb 0x45c511
mov ecx, dword [ebp - 0x660]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45c507
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c64a
jmp 0x45c507
mov eax, dword [0x6a7ad8]
cmp eax, 8
jne 0x45c392
call fcn.00453dc0
mov dword [0x6a7ad8], eax
mov dword [ebp - 0x648], 0
lea ecx, [ebp - 0x648]
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x634], 0xf
mov byte [ebp - 0x648], 0
sub eax, 1
je 0x45c3d9
sub eax, 1
je 0x45c3d0
push 0x16
push str.Uninstall_is_completed
jmp 0x45c3e0
push 0x1d
push str.Kaldrma_ilemi_tamamland
jmp 0x45c3e0
push 0x23
push 0x679b6c
call fcn.00446eb0
xor esi, esi
xor edi, edi
mov dword [ebp - 0x668], esi
mov dword [ebp - 0x664], edi
push edi
mov byte [ebp - 4], 0x1b
lea eax, [ebp - 0x648]
cmp dword [ebp - 0x634], 0x10
push edi
cmovae eax, dword [ebp - 0x648]
push 0xffffffffffffffff
push eax
push edi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x45c43e
mov edi, eax
add eax, eax
push eax
push esi
mov dword [ebp - 0x664], edi
call fcn.005e4cb3
mov esi, eax
add esp, 8
mov dword [ebp - 0x668], esi
cmp dword [ebp - 0x634], 0x10
lea ecx, [ebp - 0x648]
push edi
cmovae ecx, dword [ebp - 0x648]
push esi
push 0xffffffffffffffff
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call fcn.004527e0
mov edx, eax
lea ecx, [ebp - 0x690]
call fcn.004522d0
cmp dword [eax + 0x14], 8
jb 0x45c47e
mov eax, dword [eax]
push 0x40
push eax
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edx, dword [ebp - 0x67c]
cmp edx, 8
jb 0x45c4ca
mov ecx, dword [ebp - 0x690]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45c4c0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c64f
push edx
push ecx
call fcn.005df326
add esp, 8
test esi, esi
je 0x45c4d7
push esi
call fcn.005e4cbe
add esp, 4
mov edx, dword [ebp - 0x634]
cmp edx, 0x10
jb 0x45c511
mov ecx, dword [ebp - 0x648]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45c507
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c654
push edx
push ecx
call fcn.005df326
add esp, 8
push 0x44
lea eax, [ebp - 0x710]
push 0
push eax
call fcn.005e1a80
add esp, 0xc
lea eax, [ebp - 0x220]
xorps xmm0, xmm0
movups xmmword [ebp - 0x670], xmm0
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x220]
push eax
push str.cmd.exe__C_ping_1.1.1.1__n_1__w_3000___Nul__Del__f__q___s_
lea eax, [ebp - 0x630]
push 0x208
push eax
call fcn.004547c0
add esp, 0x10
lea eax, [ebp - 0x670]
push eax
lea eax, [ebp - 0x710]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [ebp - 0x630]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x66c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x670]
call esi
lea ecx, [ebp - 0x6c8]
call fcn.00453100
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005df097
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00446d70
call fcn.005e4e95
call fcn.00446d70
call fcn.005e4e95
call fcn.00446d70
call fcn.005e4e95
call fcn.005e4e95
call fcn.00446d70
call fcn.005e4e95
call fcn.00446d70
call fcn.005e4e95
call fcn.00446d70
call fcn.005e4e95
call fcn.005e4e95
call fcn.00446d70
call fcn.005e4e95
call fcn.00446d70
call fcn.005e4e95
call fcn.005e4e95
call fcn.005e4e95
call fcn.00446d70
call fcn.005e4e95
call fcn.00446d70
call fcn.005e4e95
call fcn.005e4e95
call fcn.005e4e95
call fcn.005e4e95
call fcn.005e4e95
int3