Function at 0x4662e0
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3e4
mov eax, dword [0x541a34]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x234], 0
push 0x44f6c0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.00488060
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x230]
call fcn.00456450
lea ecx, [ebp - 0x230]
call fcn.0045c970
push eax
lea ecx, [ebp - 0x210]
call fcn.0044ddc0
push str._kfdsjldsjfldsjfdsdh3dh
lea ecx, [ebp - 0x210]
push ecx
call fcn.00457920
add esp, 8
movzx edx, al
test edx, edx
je 0x466434
mov dword [0x5431fc], 0x65
lea ecx, [ebp - 0x230]
call fcn.0045c970
push eax
lea ecx, [ebp - 0x21c]
call fcn.0044ddc0
lea ecx, [ebp - 0x21c]
call fcn.00443470
cmp eax, 3
jle 0x46639a
lea ecx, [ebp - 0x21c]
call fcn.00461c50
mov dword [0x545268], eax
mov dword [0x54526c], edx
lea ecx, [ebp - 0x230]
call fcn.0045c970
push eax
lea ecx, [ebp - 0x21c]
call fcn.00457780
lea ecx, [ebp - 0x21c]
call fcn.00443470
cmp eax, 4
jle 0x4663e1
mov dword [0x54525c], 1
lea ecx, [ebp - 0x21c]
call fcn.00443490
push eax
mov ecx, 0x545260
call fcn.00457850
call fcn.0045c2c0
mov ecx, eax
call fcn.004cb0e0
call fcn.0045c2c0
mov ecx, eax
call fcn.004cd520
mov dword [ebp - 0x340], 0
lea ecx, [ebp - 0x21c]
call fcn.0044e100
lea ecx, [ebp - 0x210]
call fcn.0044e100
lea ecx, [ebp - 0x230]
call fcn.00457110
mov eax, dword [ebp - 0x340]
jmp 0x4676d7
push 0x505620
lea eax, [ebp - 0x210]
push eax
call fcn.00457920
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x4664af
mov dword [0x5431fc], 0xc9
call fcn.0046bab0
lea ecx, [ebp - 0x20c]
call fcn.00493390
mov ecx, dword [0x544d0c]
call fcn.0049b8e0
mov dword [ebp - 0x360], 0
lea ecx, [ebp - 0x20c]
call fcn.00456f10
lea ecx, [ebp - 0x210]
call fcn.0044e100
lea ecx, [ebp - 0x230]
call fcn.00457110
mov eax, dword [ebp - 0x360]
jmp 0x4676d7
push str._dns
lea ecx, [ebp - 0x298]
call fcn.004566f0
lea edx, [ebp - 0x298]
push edx
lea eax, [ebp - 0x210]
push eax
call fcn.004578f0
add esp, 8
mov byte [ebp - 0x215], al
lea ecx, [ebp - 0x298]
call fcn.0044e100
movzx ecx, byte [ebp - 0x215]
test ecx, ecx
je 0x466987
call fcn.0045e960
lea ecx, [ebp - 0x238]
call fcn.0048c470
lea ecx, [ebp - 0x230]
call fcn.0045c970
push eax
lea edx, [ebp - 0x3d4]
push edx
call fcn.0045dd80
add esp, 8
mov ecx, dword [eax]
mov dword [ebp - 0x34], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x30], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x2c], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x28], edx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x238]
call fcn.00459680
push 1
push 1
push 0
lea ecx, [ebp - 0x2b0]
call fcn.0044dc10
lea ecx, [ebp - 0x230]
call fcn.0045c970
push eax
lea ecx, [ebp - 0x220]
call fcn.0044de50
lea ecx, [ebp - 0x220]
push ecx
call fcn.004de0bd
push eax
lea edx, [ebp - 0x2b0]
push edx
call fcn.0045ff30
add esp, 0xc
lea ecx, [ebp - 0x230]
call fcn.0045c970
push eax
lea eax, [ebp - 0x3e4]
push eax
call fcn.0045dd80
add esp, 8
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x2b0]
call fcn.004ae3c0
push eax
lea ecx, [ebp - 0x2b0]
call fcn.00443a60
push eax
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x238]
call fcn.00461710
mov dword [ebp - 0x3b8], eax
lea ecx, [ebp - 0x2b0]
call fcn.004ae3c0
push eax
lea ecx, [ebp - 0x2b0]
call fcn.00443a60
push eax
lea edx, [ebp - 0x370]
push edx
call fcn.00458d00
add esp, 0xc
mov ecx, eax
call fcn.00443490
push eax
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x8c]
push ecx
call fcn.0045c580
add esp, 8
mov ecx, eax
call fcn.0043d050
push eax
lea ecx, [ebp - 0x220]
call fcn.00443490
push eax
lea edx, [ebp - 0x368]
push edx
call fcn.0045b130
add esp, 4
mov ecx, eax
call fcn.00443490
push eax
lea ecx, [ebp - 0x364]
call fcn.0044de50
mov ecx, eax
call fcn.00443490
push eax
push str._s_send_domain:_s_to__s____s_r_n
call fcn.00436750
add esp, 0x14
lea ecx, [ebp - 0x364]
call fcn.0044e140
lea ecx, [ebp - 0x368]
call fcn.0044e100
lea ecx, [ebp - 0x8c]
call fcn.0043a420
lea ecx, [ebp - 0x370]
call fcn.0044e140
push 0
push 0x2000
lea ecx, [ebp - 0x2b0]
call fcn.0044e960
push 0xfa0
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2b0]
call fcn.004ae3c0
push eax
lea ecx, [ebp - 0x2b0]
call fcn.00443a60
push eax
lea ecx, [ebp - 0x238]
call fcn.00460660
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0
jg 0x4667a4
lea ecx, [ebp - 0x378]
push ecx
call fcn.0045b130
add esp, 4
mov ecx, eax
call fcn.00443490
push eax
lea ecx, [ebp - 0x374]
call fcn.0044de50
mov ecx, eax
call fcn.00443490
push eax
push str._s_recv_time_out_r_n
call fcn.00436750
add esp, 8
lea ecx, [ebp - 0x374]
call fcn.0044e140
lea ecx, [ebp - 0x378]
call fcn.0044e100
mov dword [ebp - 0x37c], 0
lea ecx, [ebp - 0x220]
call fcn.0044e140
lea ecx, [ebp - 0x2b0]
call fcn.0044e060
lea ecx, [ebp - 0x238]
call fcn.00457340
lea ecx, [ebp - 0x210]
call fcn.0044e100
lea ecx, [ebp - 0x230]
call fcn.00457110
mov eax, dword [ebp - 0x37c]
jmp 0x4676d7
lea ecx, [ebp - 0x398]
call fcn.004a0150
lea edx, [ebp - 0x398]
push edx
mov eax, dword [ebp - 0x268]
push eax
lea ecx, [ebp - 0x2b0]
call fcn.00443a60
push eax
call fcn.004586b0
add esp, 0xc
push 0
lea ecx, [ebp - 0x2b0]
call fcn.004ae3c0
push eax
lea ecx, [ebp - 0x2b0]
call fcn.00443a60
push eax
lea ecx, [ebp - 0x380]
push ecx
call fcn.0045b6e0
add esp, 0x10
push eax
lea ecx, [ebp - 0x220]
call fcn.004577c0
lea ecx, [ebp - 0x380]
call fcn.0044e140
lea ecx, [ebp - 0x398]
call fcn.004ae400
test eax, eax
je 0x466852
push 0
lea ecx, [ebp - 0x398]
call fcn.004855a0
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.0045bdd0
add esp, 8
or dword [ebp - 0x234], 1
mov ecx, eax
call fcn.0043d050
mov dword [ebp - 0x278], eax
jmp 0x46685c
mov dword [ebp - 0x278], str.no_get_ip
mov ecx, dword [ebp - 0x268]
push ecx
lea ecx, [ebp - 0x2b0]
call fcn.00443a60
push eax
lea edx, [ebp - 0x38c]
push edx
call fcn.00458d00
add esp, 0xc
mov ecx, eax
call fcn.00443490
push eax
mov eax, dword [ebp - 0x278]
push eax
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x74]
push edx
call fcn.0045c580
add esp, 8
mov ecx, eax
call fcn.0043d050
push eax
lea ecx, [ebp - 0x220]
call fcn.00443490
push eax
lea eax, [ebp - 0x388]
push eax
call fcn.0045b130
add esp, 4
mov ecx, eax
call fcn.00443490
push eax
lea ecx, [ebp - 0x384]
call fcn.0044de50
mov ecx, eax
call fcn.00443490
push eax
push str._s_recv_from__s_ip:_s_recv_data:___s__s_r_n
call fcn.00436750
add esp, 0x18
lea ecx, [ebp - 0x384]
call fcn.0044e140
lea ecx, [ebp - 0x388]
call fcn.0044e100
lea ecx, [ebp - 0x74]
call fcn.0043a420
lea ecx, [ebp - 0x38c]
call fcn.0044e140
mov ecx, dword [ebp - 0x234]
and ecx, 1
je 0x46692b
and dword [ebp - 0x234], 0xfffffffe
lea ecx, [ebp - 0x5c]
call fcn.0043a420
mov dword [ebp - 0x2b4], 0
lea ecx, [ebp - 0x398]
call fcn.00456cf0
lea ecx, [ebp - 0x220]
call fcn.0044e140
lea ecx, [ebp - 0x2b0]
call fcn.0044e060
lea ecx, [ebp - 0x238]
call fcn.00457340
lea ecx, [ebp - 0x210]
call fcn.0044e100
lea ecx, [ebp - 0x230]
call fcn.00457110
mov eax, dword [ebp - 0x2b4]
jmp 0x4676d7
push str._ddns
lea ecx, [ebp - 0x27c]
call fcn.004566f0
lea edx, [ebp - 0x27c]
push edx
lea eax, [ebp - 0x210]
push eax
call fcn.004578f0
add esp, 8
mov byte [ebp - 0x211], al
lea ecx, [ebp - 0x27c]
call fcn.0044e100
movzx ecx, byte [ebp - 0x211]
test ecx, ecx
je 0x466bf8
lea ecx, [ebp - 0x230]
call fcn.0045c970
push eax
lea ecx, [ebp - 0x24c]
call fcn.0044ddc0
lea ecx, [ebp - 0x230]
call fcn.0045c970
push eax
lea ecx, [ebp - 0x240]
call fcn.0044ddc0
lea ecx, [ebp - 0x230]
call fcn.0045c970
push eax
lea ecx, [ebp - 0x264]
call fcn.0044ddc0
lea ecx, [ebp - 0x240]
call fcn.00443490
push eax
lea ecx, [ebp - 0x24c]
call fcn.00443490
push eax
call fcn.0045f510
add esp, 8
test eax, eax
je 0x466af3
lea ecx, [ebp - 0x264]
call fcn.00461c80
cmp eax, 1
jne 0x466a4f
jmp 0x466aee
push 0
push 0x5056cc
push str._ok.
lea edx, [ebp - 0x240]
push edx
push 0x5056e0
lea eax, [ebp - 0x24c]
push eax
push 0x5056ec
lea ecx, [ebp - 0x2c4]
push ecx
call fcn.00457cc0
add esp, 0xc
push eax
lea edx, [ebp - 0x2c0]
push edx
call fcn.0044e180
add esp, 0xc
push eax
lea eax, [ebp - 0x2bc]
push eax
call fcn.00457c20
add esp, 0xc
push eax
lea ecx, [ebp - 0x2b8]
push ecx
call fcn.0044e180
add esp, 0xc
mov ecx, eax
call fcn.00443490
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x2b8]
call fcn.0044e100
lea ecx, [ebp - 0x2bc]
call fcn.0044e100
lea ecx, [ebp - 0x2c0]
call fcn.0044e100
lea ecx, [ebp - 0x2c4]
call fcn.0044e100
jmp 0x466ba7
lea ecx, [ebp - 0x264]
call fcn.00461c80
cmp eax, 1
jne 0x466b08
jmp 0x466ba7
push 0x10
push 0x505700
push str._fail.
lea edx, [ebp - 0x240]
push edx
push str._to
lea eax, [ebp - 0x24c]
push eax
push str.lsz_file
lea ecx, [ebp - 0x2d4]
push ecx
call fcn.00457cc0
add esp, 0xc
push eax
lea edx, [ebp - 0x2d0]
push edx
call fcn.0044e180
add esp, 0xc
push eax
lea eax, [ebp - 0x2cc]
push eax
call fcn.00457c20
add esp, 0xc
push eax
lea ecx, [ebp - 0x2c8]
push ecx
call fcn.0044e180
add esp, 0xc
mov ecx, eax
call fcn.00443490
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x2c8]
call fcn.0044e100
lea ecx, [ebp - 0x2cc]
call fcn.0044e100
lea ecx, [ebp - 0x2d0]
call fcn.0044e100
lea ecx, [ebp - 0x2d4]
call fcn.0044e100
mov dword [ebp - 0x2d8], 0
lea ecx, [ebp - 0x264]
call fcn.0044e100
lea ecx, [ebp - 0x240]
call fcn.0044e100
lea ecx, [ebp - 0x24c]
call fcn.0044e100
lea ecx, [ebp - 0x210]
call fcn.0044e100
lea ecx, [ebp - 0x230]
call fcn.00457110
mov eax, dword [ebp - 0x2d8]
jmp 0x4676d7
push str._crash
lea ecx, [ebp - 0x280]
call fcn.004566f0
lea edx, [ebp - 0x280]
push edx
lea eax, [ebp - 0x210]
push eax
call fcn.004578f0
add esp, 8
mov byte [ebp - 0x212], al
lea ecx, [ebp - 0x280]
call fcn.0044e100
movzx ecx, byte [ebp - 0x212]
test ecx, ecx
je 0x466cdb
lea ecx, [ebp - 0x230]
call fcn.0045c970
push eax
lea ecx, [ebp - 0x260]
call fcn.0044ddc0
lea ecx, [ebp - 0x260]
call fcn.00443490
push eax
call fcn.0045e920
add esp, 4
test eax, eax
je 0x466ca0
push 0
lea ecx, [ebp - 0x284]
call fcn.0044de20
lea edx, [ebp - 0x284]
push edx
lea ecx, [ebp - 0x260]
call fcn.00443490
push eax
call fcn.00460460
add esp, 8
lea ecx, [ebp - 0x284]
call fcn.0044e140
mov dword [ebp - 0x2dc], 0
lea ecx, [ebp - 0x260]
call fcn.0044e100
lea ecx, [ebp - 0x210]
call fcn.0044e100
lea ecx, [ebp - 0x230]
call fcn.00457110
mov eax, dword [ebp - 0x2dc]
jmp 0x4676d7
push str._delete_configs
lea ecx, [ebp - 0x288]
call fcn.004566f0
lea eax, [ebp - 0x288]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.004578f0
add esp, 8
mov byte [ebp - 0x213], al
lea ecx, [ebp - 0x288]
call fcn.0044e100
movzx edx, byte [ebp - 0x213]
test edx, edx
je 0x466d56
call fcn.0045c1d0
mov ecx, eax
call fcn.004c2fb0
mov dword [ebp - 0x2e0], 0
lea ecx, [ebp - 0x210]
call fcn.0044e100
lea ecx, [ebp - 0x230]
call fcn.00457110
mov eax, dword [ebp - 0x2e0]
jmp 0x4676d7
push str._delete_configs2
lea ecx, [ebp - 0x28c]
call fcn.004566f0
lea eax, [ebp - 0x28c]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.004578f0
add esp, 8
mov byte [ebp - 0x214], al
lea ecx, [ebp - 0x28c]
call fcn.0044e100
movzx edx, byte [ebp - 0x214]
test edx, edx
je 0x466da4
call fcn.0045c1d0
mov ecx, eax
call fcn.004c2fb0
mov dword [0x5431fc], 0
call fcn.004656f0
push str..rreemm
lea ecx, [ebp - 0x2e8]
call fcn.0044ddc0
push eax
call fcn.0044f2c0
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00457cc0
add esp, 0xc
mov ecx, eax
call fcn.00443490
push eax
call fcn.0045e920
add esp, 4
mov dword [ebp - 0x2ec], eax
lea ecx, [ebp - 0x2e4]
call fcn.0044e100
lea ecx, [ebp - 0x2e8]
call fcn.0044e100
cmp dword [ebp - 0x2ec], 0
je 0x466e87
push 0
call fcn.0045b8e0
push eax
push str._del__s_.rreemm
call fcn.0045b8e0
push eax
push str._c_cd__d__
lea ecx, [ebp - 0x2f8]
call fcn.004566f0
push eax
lea ecx, [ebp - 0x2f4]
push ecx
call fcn.0044e180
add esp, 0xc
push eax
lea edx, [ebp - 0x2f0]
push edx
call fcn.0044e180
add esp, 0xc
mov ecx, eax
call fcn.00443490
push eax
push 0x5057c8
call fcn.00461950
add esp, 0x10
lea ecx, [ebp - 0x2f0]
call fcn.0044e100
lea ecx, [ebp - 0x2f4]
call fcn.0044e100
lea ecx, [ebp - 0x2f8]
call fcn.0044e100
call fcn.0048fac0
push 0x5057d8
push 0x5057f0
lea eax, [ebp - 0x300]
push eax
call fcn.0045ae40
add esp, 8
push eax
lea ecx, [ebp - 0x2fc]
push ecx
call fcn.0044e180
add esp, 0xc
mov ecx, eax
call fcn.00443490
push eax
push 0x505800
push 0x505804
push 0x505814
lea edx, [ebp - 0x244]
push edx
call fcn.0045cb90
add esp, 0x14
lea ecx, [ebp - 0x2fc]
call fcn.0044e100
lea ecx, [ebp - 0x300]
call fcn.0044e100
lea ecx, [ebp - 0x274]
call fcn.004a0150
push 1
push 0x505824
lea ecx, [ebp - 0x244]
call fcn.00443490
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.004619b0
add esp, 0x10
lea ecx, [ebp - 0x274]
call fcn.004ae400
test eax, eax
je 0x467089
lea ecx, [ebp - 0x274]
call fcn.004ae400
sub eax, 1
push eax
lea ecx, [ebp - 0x274]
call fcn.004855a0
push eax
lea ecx, [ebp - 0x290]
call fcn.0044dd90
lea ecx, [ebp - 0x274]
call fcn.00464860
lea ecx, [ebp - 0x274]
call fcn.004ae400
test eax, eax
jne 0x466fd4
push 0x505828
push 0x505840
lea ecx, [ebp - 0x308]
push ecx
call fcn.0045ae40
add esp, 8
push eax
lea edx, [ebp - 0x304]
push edx
call fcn.0044e180
add esp, 0xc
mov ecx, eax
call fcn.00443490
push eax
push 0x505850
push 0x505854
push 0x505864
call fcn.00461900
add esp, 0x10
lea ecx, [ebp - 0x304]
call fcn.0044e100
lea ecx, [ebp - 0x308]
call fcn.0044e100
jmp 0x467065
push 0x505874
push 0x50588c
lea eax, [ebp - 0x314]
push eax
call fcn.0045ae40
add esp, 8
push eax
lea ecx, [ebp - 0x310]
push ecx
call fcn.0044e180
add esp, 0xc
mov ecx, eax
call fcn.00443490
push eax
push 0x50589c
push 0x5058a0
push 0x5058a4
lea edx, [ebp - 0x274]
push edx
lea eax, [ebp - 0x30c]
push eax
call fcn.0045e7a0
add esp, 0x14
mov ecx, eax
call fcn.00443490
push eax
push 0x5058a8
push 0x5058b8
call fcn.00461900
add esp, 0x10
lea ecx, [ebp - 0x30c]
call fcn.0044e100
lea ecx, [ebp - 0x310]
call fcn.0044e100
lea ecx, [ebp - 0x314]
call fcn.0044e100
lea ecx, [ebp - 0x290]
call fcn.00443490
push eax
call fcn.0045d170
add esp, 4
lea ecx, [ebp - 0x290]
call fcn.0044e100
jmp 0x466f1e
mov dword [0x5431fc], 2
lea ecx, [ebp - 0x248]
call fcn.0048c470
push 0
push str.Aieorjslflidekjfldskjfldskhfljds
push 0
push 0
lea ecx, [ebp - 0x248]
call fcn.00458f00
test eax, eax
je 0x46713d
push 0x50590c
push 0x505934
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0
je 0x4670f1
push 0
push 0
push 0x76e
mov ecx, dword [ebp - 0x294]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebp - 0x318], 0
lea ecx, [ebp - 0x248]
call fcn.00457230
lea ecx, [ebp - 0x274]
call fcn.00456df0
lea ecx, [ebp - 0x244]
call fcn.0044e100
lea ecx, [ebp - 0x210]
call fcn.0044e100
lea ecx, [ebp - 0x230]
call fcn.00457110
mov eax, dword [ebp - 0x318]
jmp 0x4676d7
mov dword [0x5431fc], 3
call fcn.0045bf70
movzx edx, byte [eax + 0x38]
test edx, edx
je 0x467274
push 0
lea ecx, [ebp - 0x25c]
call fcn.0044de20
push str.begin_Main_process__r_n
lea eax, [ebp - 0x25c]
push eax
call fcn.0044ee90
add esp, 8
call fcn.0045bf70
lea ecx, [ebp - 0x334]
push ecx
call fcn.0045cf00
add esp, 4
push eax
push 0x50595c
push 0xca
lea edx, [ebp - 0x330]
push edx
call fcn.0044f080
add esp, 8
push eax
push str.wWinMain_
push 0x5059bc
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x32c]
push ecx
call fcn.0044e2c0
add esp, 0xc
push eax
lea edx, [ebp - 0x328]
push edx
call fcn.0044e2c0
add esp, 0xc
push eax
lea eax, [ebp - 0x324]
push eax
call fcn.0044e220
add esp, 0xc
push eax
lea ecx, [ebp - 0x320]
push ecx
call fcn.0044e2c0
add esp, 0xc
push eax
lea edx, [ebp - 0x31c]
push edx
call fcn.0044e220
add esp, 0xc
mov ecx, eax
call fcn.00443490
push eax
call fcn.0045bf70
mov ecx, eax
call fcn.00458500
lea ecx, [ebp - 0x31c]
call fcn.0044e140
lea ecx, [ebp - 0x320]
call fcn.0044e140
lea ecx, [ebp - 0x324]
call fcn.0044e140
lea ecx, [ebp - 0x328]
call fcn.0044e140
lea ecx, [ebp - 0x32c]
call fcn.0044e140
lea ecx, [ebp - 0x330]
call fcn.0044e140
lea ecx, [ebp - 0x334]
call fcn.0044e140
lea ecx, [ebp - 0x25c]
call fcn.0044e140
push 0
call fcn.0044f2c0
push eax
lea eax, [ebp - 0x338]
push eax
call fcn.0045ba20
add esp, 0xc
mov ecx, eax
call fcn.00443490
push eax
lea ecx, [ebp - 0x258]
push ecx
call fcn.0045cd40
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0044e100
lea ecx, [ebp - 0x258]
call fcn.004ae400
cmp eax, 1
jbe 0x46732a
mov dword [ebp - 0x23c], 0
jmp 0x4672d8
mov edx, dword [ebp - 0x23c]
add edx, 1
mov dword [ebp - 0x23c], edx
lea ecx, [ebp - 0x258]
call fcn.004ae400
cmp dword [ebp - 0x23c], eax
jge 0x46732a
mov eax, dword [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x258]
call fcn.004855a0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esi], eax
je 0x467328
push 0
mov ecx, dword [ebp - 0x23c]
push ecx
lea ecx, [ebp - 0x258]
call fcn.004855a0
mov edx, dword [eax]
push edx
call fcn.0045ed60
add esp, 8
jmp 0x4672c9
lea ecx, [ebp - 0x258]
call fcn.0049b2a0
mov dword [0x5431fc], 4
call fcn.0046bab0
call fcn.0045e960
push 2
call fcn.0045c320
mov ecx, eax
call fcn.00459360
mov dword [0x5431fc], 5
lea ecx, [ebp - 0x35c]
call fcn.004ca8e0
push 0
push 0x461ab0
lea ecx, [ebp - 0x35c]
call fcn.00459a90
call fcn.0045c170
push str.pipewkeimauiuu
call fcn.0045c110
mov ecx, eax
call fcn.00493c70
push 0x3e8
push 1
call fcn.0045c110
mov ecx, eax
call fcn.00461920
mov dword [0x5431fc], 6
push 0x5059e0
call fcn.0045c260
mov ecx, eax
call fcn.00485a80
push 0
call fcn.00459b10
add esp, 4
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0
jne 0x467492
push 0x10
push 0x5059f0
lea eax, [ebp - 0x344]
push eax
call fcn.0045c630
add esp, 4
push eax
push str.error
lea ecx, [ebp - 0x36c]
push ecx
call fcn.00457cc0
add esp, 0xc
mov ecx, eax
call fcn.00443490
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x36c]
call fcn.0044e100
lea ecx, [ebp - 0x344]
call fcn.0044e100
mov dword [ebp - 0x348], 0
lea ecx, [ebp - 0x35c]
call fcn.00457280
lea ecx, [ebp - 0x258]
call fcn.00456cf0
lea ecx, [ebp - 0x248]
call fcn.00457230
lea ecx, [ebp - 0x274]
call fcn.00456df0
lea ecx, [ebp - 0x244]
call fcn.0044e100
lea ecx, [ebp - 0x210]
call fcn.0044e100
lea ecx, [ebp - 0x230]
call fcn.00457110
mov eax, dword [ebp - 0x348]
jmp 0x4676d7
mov dword [0x5431fc], 7
mov dword [ebp - 0x3b4], 0
xor edx, edx
mov dword [ebp - 0x3b0], edx
mov dword [ebp - 0x3ac], edx
mov dword [ebp - 0x3a8], edx
mov dword [ebp - 0x3a4], edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 0x39c], edx
push 0
push 0
push 0
lea eax, [ebp - 0x3b4]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x46751d
cmp dword [ebp - 0x3b0], 0x76e
jne 0x467501
push 0
push 0
push 0x7b
call fcn.0045c110
mov ecx, eax
call fcn.00461750
lea ecx, [ebp - 0x3b4]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0x3b4]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x4674cc
mov dword [0x5431fc], 0x33
push 0
call fcn.0044f2c0
push eax
lea eax, [ebp - 0x34c]
push eax
call fcn.0045ba20
add esp, 0xc
mov ecx, eax
call fcn.00443490
push eax
lea ecx, [ebp - 0x3c4]
push ecx
call fcn.0045cd40
add esp, 8
push eax
lea ecx, [ebp - 0x258]
call fcn.004576b0
lea ecx, [ebp - 0x3c4]
call fcn.00456cf0
lea ecx, [ebp - 0x34c]
call fcn.0044e100
lea ecx, [ebp - 0x258]
call fcn.004ae400
cmp eax, 1
jbe 0x46764b
mov dword [ebp - 0x224], 0
jmp 0x4675a6
mov edx, dword [ebp - 0x224]
add edx, 1
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x258]
call fcn.004ae400
cmp dword [ebp - 0x224], eax
jge 0x46764b
mov eax, dword [ebp - 0x224]
push eax
lea ecx, [ebp - 0x258]
call fcn.004855a0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esi], eax
je 0x467646
push 0x64
push 0
mov ecx, dword [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x258]
call fcn.004855a0
mov edx, dword [eax]
push edx
call fcn.00461ff0
add esp, 0xc
test eax, eax
jne 0x467646
push 0
mov eax, dword [ebp - 0x224]
push eax
lea ecx, [ebp - 0x258]
call fcn.004855a0
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x350]
push edx
call fcn.0045a9a0
add esp, 8
mov ecx, eax
call fcn.00443490
push eax
push 0x505a30
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x350]
call fcn.0044e100
jmp 0x467597
mov dword [0x5431fc], 0x34
push 0
push 0
push 0x505a3c
push str.taskkill.exe
push 0x505a7c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [0x5431fc], 0x35
mov dword [ebp - 0x354], 0
lea ecx, [ebp - 0x35c]
call fcn.00457280
lea ecx, [ebp - 0x258]
call fcn.00456cf0
lea ecx, [ebp - 0x248]
call fcn.00457230
lea ecx, [ebp - 0x274]
call fcn.00456df0
lea ecx, [ebp - 0x244]
call fcn.0044e100
lea ecx, [ebp - 0x210]
call fcn.0044e100
lea ecx, [ebp - 0x230]
call fcn.00457110
mov eax, dword [ebp - 0x354]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d1fac
mov esp, ebp
pop ebp
ret 0x10