Function at 0x46af53
Capabilities:
Delete file

Disassembly:
push 0x98
mov eax, 0x5cee5b
call fcn.0058ec5e
and dword [ebp - 4], 0
and dword [ebp - 0x18], 0
xor esi, esi
inc esi
mov dword [ebp - 4], esi
push dword [ebp + 8]
call fcn.0040855f
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 2
call fcn.0046a19a
mov edi, eax
mov byte [ebp - 0x26], 1
test edi, edi
je 0x46b027
push dword [ebp + 0x10]
lea eax, [ebp - 0x20]
push eax
call fcn.004085b5
mov byte [ebp - 4], 3
lea eax, [ebp - 0x20]
call fcn.00408807
push 0x68cd50
xor ecx, ecx
lea esi, [ebp - 0x20]
call fcn.0042b6cc
or ebx, 0xffffffff
cmp eax, ebx
jne 0x46afe0
push 0x68cd78
xor ecx, ecx
call fcn.0042b6cc
cmp eax, ebx
jne 0x46afe0
push str._threattank
xor ecx, ecx
call fcn.0042b6cc
cmp eax, ebx
je 0x46afe4
mov byte [ebp - 0x26], 0
push 0x6810d0
xor ecx, ecx
lea esi, [ebp - 0x20]
call fcn.0042b6cc
test eax, eax
jne 0x46affa
mov byte [ebp - 0x26], al
cmp byte [ebp - 0x26], 0
je 0x46b013
lea eax, [ebp - 0x20]
push eax
mov ecx, edi
call fcn.0047586f
test al, al
je 0x46b013
mov byte [ebp - 0x26], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.004085f6
cmp byte [ebp - 0x26], 0
je 0x46b098
jmp 0x46b02a
or ebx, 0xffffffff
push 0
push 0
push 0x6c79fc
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x46b098
push dword [ebp + 0x10]
lea eax, [ebp - 0x24]
push eax
call fcn.004085b5
mov byte [ebp - 4], 4
lea eax, [ebp - 0x24]
call fcn.00408807
push str.keygen
xor ecx, ecx
lea esi, [ebp - 0x24]
call fcn.0042b6cc
cmp eax, ebx
jne 0x46b088
push str.serial
xor ecx, ecx
call fcn.0042b6cc
cmp eax, ebx
jne 0x46b088
push str.crack
xor ecx, ecx
call fcn.0042b6cc
cmp eax, ebx
je 0x46b08c
mov byte [ebp - 0x26], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.004085f6
mov byte [ebp - 0x3a], 0
mov byte [ebp - 0x3b], 0
cmp byte [ebp - 0x26], 0
je 0x46c5b4
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x24]
add dword [edi + 0x38], eax
mov eax, dword [ebp + 0x28]
adc dword [edi + 0x3c], eax
lea eax, [ebp - 0x34]
push eax
call fcn.0040844d
mov byte [ebp - 4], 5
mov eax, dword [ebp + 0x10]
call fcn.00487670
mov dword [ebp - 0x64], eax
mov byte [ebp - 4], 6
cmp eax, ebx
je 0x46c4e3
push eax
call fcn.0048b000
test al, al
jne 0x46c4e3
cmp dword [edi + 0x18], 0x3e8
jne 0x46b781
cmp byte [ebp + 0x30], al
jne 0x46b774
push dword [ebp + 0x10]
lea eax, [ebp - 0x1c]
push eax
call fcn.004085b5
push 7
pop esi
mov byte [ebp - 4], 7
lea eax, [ebp - 0x1c]
call fcn.00408807
mov byte [ebp - 0x2d], 1
push str.:programdata
lea eax, [ebp - 0x38]
push eax
call fcn.004085b5
mov byte [ebp - 4], 8
mov dword [ebp - 0x18], 3
lea eax, [ebp - 0x38]
lea edx, [ebp - 0x1c]
call fcn.0048a200
test al, al
jne 0x46b1cd
push str.:program_files
lea eax, [ebp - 0x14]
push eax
call fcn.004085b5
mov dword [ebp - 4], 9
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x1c]
call fcn.0048a200
test al, al
jne 0x46b1cd
push str.:program_files__x86_
lea eax, [ebp - 0x20]
push eax
call fcn.004085b5
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x18], 0xf
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0048a200
test al, al
jne 0x46b1cd
push str.:windows_servicing
lea eax, [ebp - 0x24]
push eax
call fcn.004085b5
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x18], 0x1f
lea eax, [ebp - 0x24]
lea edx, [ebp - 0x1c]
call fcn.0048a200
test al, al
jne 0x46b1cd
xor bl, bl
jmp 0x46b1cf
mov bl, 1
mov dword [ebp - 4], 0xa
test byte [ebp - 0x18], 0x10
je 0x46b1e8
and dword [ebp - 0x18], 0xffffffef
lea ecx, [ebp - 0x24]
call fcn.004085f6
mov dword [ebp - 4], 9
test byte [ebp - 0x18], 8
je 0x46b201
and dword [ebp - 0x18], 0xfffffff7
lea ecx, [ebp - 0x20]
call fcn.004085f6
mov dword [ebp - 4], 8
test byte [ebp - 0x18], 4
je 0x46b21a
and dword [ebp - 0x18], 0xfffffffb
lea ecx, [ebp - 0x14]
call fcn.004085f6
mov dword [ebp - 4], esi
test byte [ebp - 0x18], 2
je 0x46b22f
and dword [ebp - 0x18], 0xfffffffd
lea ecx, [ebp - 0x38]
call fcn.004085f6
test bl, bl
jne 0x46b2a7
mov eax, dword [0x6c79d4]
shl eax, 0x14
cdq
mov ebx, eax
mov esi, edx
push ecx
mov eax, esp
mov dword [ebp - 0x2c], esp
lea ecx, [ebp - 0x1c]
push ecx
push eax
call fcn.00408586
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 7
call fcn.00429ba5
pop ecx
cmp edx, esi
jl 0x46b268
jg 0x46b2a7
cmp eax, ebx
ja 0x46b2a7
cmp dword [0x6c79d8], 0
je 0x46b2ab
push str.keygen
xor ecx, ecx
lea esi, [ebp - 0x1c]
call fcn.0042b6cc
cmp eax, 0xffffffff
jne 0x46b2a7
push str.serial
xor ecx, ecx
call fcn.0042b6cc
cmp eax, 0xffffffff
jne 0x46b2a7
push str.crack
xor ecx, ecx
call fcn.0042b6cc
cmp eax, 0xffffffff
je 0x46b2ab
mov byte [ebp - 0x2d], 0
push str.hp_
xor ecx, ecx
lea esi, [ebp - 0x1c]
call fcn.0042b6cc
or ebx, 0xffffffff
cmp eax, ebx
jne 0x46b301
push str.laserjet
xor ecx, ecx
call fcn.0042b6cc
cmp eax, ebx
jne 0x46b301
push str.printer
xor ecx, ecx
call fcn.0042b6cc
cmp eax, ebx
jne 0x46b301
push str.scanner
xor ecx, ecx
call fcn.0042b6cc
cmp eax, ebx
jne 0x46b301
push str._mfp
xor ecx, ecx
call fcn.0042b6cc
cmp eax, ebx
je 0x46b305
mov byte [ebp - 0x2d], 0
cmp byte [ebp - 0x2d], 0
je 0x46b768
push 0x2e
lea esi, [ebp - 0x1c]
call fcn.0042b71b
cmp eax, ebx
je 0x46b768
lea ecx, [eax + 1]
lea eax, [ebp - 0x14]
push eax
mov edx, esi
call fcn.0042b7fa
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x14]
call fcn.00408807
lea eax, [ebp - 0x24]
push eax
call fcn.0040855f
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00408586
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x68c7dc
call fcn.00409ed0
test eax, eax
je 0x46b387
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x68eef0
call fcn.00409ed0
test eax, eax
je 0x46b387
lea eax, [ebp - 0x20]
call fcn.0042b739
jmp 0x46b395
push 0x68eef8
lea eax, [ebp - 0x20]
push eax
call fcn.0040865a
mov ebx, str.Malware.
cmp dword [0x6ddbc4], 1
jne 0x46b40a
push ebx
lea eax, [ebp - 0x44]
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x40]
push ecx
mov esi, eax
call fcn.0041691a
mov byte [ebp - 4], 0x11
push str..DeepDive
lea ecx, [ebp - 0x38]
push ecx
mov ecx, eax
call fcn.004116ea
add esp, 0x10
mov byte [ebp - 4], 0x12
lea edi, [ebp - 0x24]
call fcn.00408619
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x38]
call fcn.004085f6
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x40]
call fcn.004085f6
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x44]
call fcn.004085f6
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x24]
cmp dword [eax - 0xc], 0
jne 0x46b4dd
mov eax, 0x6de1d4
mov dword [ebp - 0x48], eax
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x13
and dword [ebp - 0x68], 0
mov eax, dword [0x6de21c]
sub eax, dword [0x6de218]
sar eax, 2
cmp dword [ebp - 0x68], eax
jae 0x46b465
mov edi, dword [ebp - 0x68]
mov esi, 0x6de20c
call fcn.0041e10a
push dword [eax]
lea eax, [ebp - 0x14]
push eax
call fcn.00408696
test eax, eax
je 0x46b469
inc dword [ebp - 0x68]
mov edi, dword [ebp + 0xc]
jmp 0x46b42e
xor al, al
je 0x46b4d0
push ebx
lea eax, [ebp - 0x38]
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x40]
push ecx
mov esi, eax
call fcn.0041691a
mov byte [ebp - 4], 0x15
push str..DeepDive
lea ecx, [ebp - 0x44]
push ecx
mov ecx, eax
call fcn.004116ea
add esp, 0x10
mov byte [ebp - 4], 0x16
lea edi, [ebp - 0x24]
call fcn.00408619
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x44]
call fcn.004085f6
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x40]
call fcn.004085f6
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x38]
call fcn.004085f6
mov edi, dword [ebp + 0xc]
mov byte [ebp - 4], 0xf
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c820
call fcn.00409ed0
test eax, eax
je 0x46b607
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c828
call fcn.00409ed0
test eax, eax
je 0x46b607
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c830
call fcn.00409ed0
test eax, eax
je 0x46b607
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c838
call fcn.00409ed0
test eax, eax
je 0x46b607
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c840
call fcn.00409ed0
test eax, eax
je 0x46b607
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c848
call fcn.00409ed0
test eax, eax
je 0x46b607
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c850
call fcn.00409ed0
test eax, eax
je 0x46b607
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c858
call fcn.00409ed0
test eax, eax
je 0x46b607
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c860
call fcn.00409ed0
test eax, eax
je 0x46b607
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c868
call fcn.00409ed0
test eax, eax
je 0x46b607
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c870
call fcn.00409ed0
test eax, eax
je 0x46b607
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c878
call fcn.00409ed0
test eax, eax
je 0x46b607
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c880
call fcn.00409ed0
test eax, eax
je 0x46b607
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c888
call fcn.00409ed0
test eax, eax
je 0x46b607
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c890
call fcn.00409ed0
test eax, eax
jne 0x46b66e
push ebx
lea eax, [ebp - 0x40]
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x44]
push ecx
mov esi, eax
call fcn.0041691a
mov byte [ebp - 4], 0x18
push str..DeepScript
lea ecx, [ebp - 0x48]
push ecx
mov ecx, eax
call fcn.004116ea
add esp, 0x10
mov byte [ebp - 4], 0x19
lea edi, [ebp - 0x24]
call fcn.00408619
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x48]
call fcn.004085f6
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x44]
call fcn.004085f6
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x40]
call fcn.004085f6
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x24]
cmp dword [eax - 0xc], 0
je 0x46b744
mov byte [ebp - 4], 0x1a
mov byte [ebp - 0x39], 0
mov byte [ebp - 0x25], 0
push dword [ebp + 0x10]
lea eax, [ebp - 0x48]
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x64]
call fcn.00434b8a
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x48]
call fcn.004085f6
cmp byte [ebp - 0x39], 0
jne 0x46b72b
cmp byte [ebp - 0x25], 0
jne 0x46b72b
push 0x1b7740
push dword [0x6ddcbc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, 0x6ddec8
mov dword [ebp - 0x2c], esi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x1c
push 0x6ddec4
call fcn.00440e4e
test al, al
je 0x46b720
lea eax, [ebp - 0x1c]
push eax
call fcn.00440d0e
test al, al
jne 0x46b720
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c830
call fcn.00409ed0
test eax, eax
jne 0x46b715
push dword [ebp - 0x1c]
call fcn.00429bec
pop ecx
test al, al
je 0x46b720
push dword [ebp - 0x24]
lea eax, [ebp - 0x34]
call fcn.0040fedc
mov byte [ebp - 4], 0x1a
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0xf
jmp 0x46b744
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x20]
call fcn.004085f6
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x24]
call fcn.004085f6
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x14]
call fcn.004085f6
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1c]
call fcn.004085f6
cmp dword [edi + 0x18], 0x3e8
je 0x46beeb
mov eax, dword [ebp - 0x34]
cmp dword [eax - 0xc], 0
jne 0x46beeb
mov byte [ebp - 0x25], 0
mov byte [ebp - 0x70], 0
xor eax, eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
lea edi, [ebp - 0x88]
mov ebx, dword [ebp - 0x64]
lea esi, [ebp - 0x60]
call fcn.00487df0
cmp byte [ebp - 0x54], 0
je 0x46beeb
cmp byte [ebp - 0x70], 0
je 0x46beeb
mov edi, dword [ebp - 0x84]
cmp edi, dword [ebp - 0x74]
jb 0x46b7ef
ja 0x46b7e7
mov eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x78]
jbe 0x46b7ef
mov esi, dword [ebp - 0x88]
jmp 0x46b7f5
mov esi, dword [ebp - 0x78]
mov edi, dword [ebp - 0x74]
lea eax, [ebp - 0x34]
push eax
push edi
push esi
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push dword [ebp - 0x58]
call fcn.0049e540
xor ebx, ebx
test al, al
je 0x46b820
mov eax, dword [ebp - 0x34]
cmp dword [eax - 0xc], ebx
je 0x46b820
mov byte [ebp - 0x3b], 1
jmp 0x46beeb
push dword [ebp + 0x10]
lea eax, [ebp - 0x38]
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x1e
lea eax, [ebp - 0x3a]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [ebp - 0x38]
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x64]
call fcn.00434167
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x38]
call fcn.004085f6
push edi
push esi
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push dword [ebp - 0x58]
lea ecx, [ebp - 0x34]
call fcn.0049e3e0
mov eax, dword [ebp - 0x34]
cmp dword [eax - 0xc], ebx
jne 0x46beeb
cmp dword [0x6ddc70], ebx
je 0x46beeb
push ebx
push ebx
push 0x6c7a24
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 1
jne 0x46beeb
mov esi, dword [ebp + 0xc]
add esi, 0x20
push esi
mov ecx, str.Quick
call fcn.00409ed0
test eax, eax
je 0x46b8c1
push esi
mov ecx, str.Full
call fcn.00409ed0
test eax, eax
jne 0x46beeb
cmp byte [ebp + 0x30], 0
jne 0x46beeb
push dword [ebp + 0x10]
lea eax, [ebp - 0x1c]
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x1f
lea eax, [ebp - 0x1c]
call fcn.00408807
mov byte [ebp - 0x27], 1
push str.:programdata
lea eax, [ebp - 0x14]
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x20
or dword [ebp - 0x18], 0x20
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x1c]
call fcn.0048a200
test al, al
jne 0x46b992
push str.:program_files
lea eax, [ebp - 0x20]
push eax
call fcn.004085b5
mov dword [ebp - 4], 0x21
or dword [ebp - 0x18], 0x40
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0048a200
test al, al
jne 0x46b992
push str.:program_files__x86_
lea eax, [ebp - 0x24]
push eax
call fcn.004085b5
mov dword [ebp - 4], 0x22
or dword [ebp - 0x18], 0x80
lea eax, [ebp - 0x24]
lea edx, [ebp - 0x1c]
call fcn.0048a200
test al, al
jne 0x46b992
push str.:windows_servicing
lea eax, [ebp - 0x38]
push eax
call fcn.004085b5
mov dword [ebp - 4], 0x23
or dword [ebp - 0x18], 0x100
lea eax, [ebp - 0x38]
lea edx, [ebp - 0x1c]
call fcn.0048a200
test al, al
jne 0x46b992
xor bl, bl
jmp 0x46b994
mov bl, 1
mov dword [ebp - 4], 0x22
test dword [ebp - 0x18], 0x100
je 0x46b9b3
and dword [ebp - 0x18], 0xfffffeff
lea ecx, [ebp - 0x38]
call fcn.004085f6
mov dword [ebp - 4], 0x21
test byte [ebp - 0x18], 0x80
je 0x46b9cf
and dword [ebp - 0x18], 0xffffff7f
lea ecx, [ebp - 0x24]
call fcn.004085f6
mov dword [ebp - 4], 0x20
test byte [ebp - 0x18], 0x40
je 0x46b9e8
and dword [ebp - 0x18], 0xffffffbf
lea ecx, [ebp - 0x20]
call fcn.004085f6
mov dword [ebp - 4], 0x1f
test byte [ebp - 0x18], 0x20
je 0x46ba01
and dword [ebp - 0x18], 0xffffffdf
lea ecx, [ebp - 0x14]
call fcn.004085f6
test bl, bl
jne 0x46ba79
mov eax, dword [0x6c79d4]
shl eax, 0x14
cdq
mov edi, eax
mov esi, edx
push ecx
mov eax, esp
mov dword [ebp - 0x2c], esp
lea ecx, [ebp - 0x1c]
push ecx
push eax
call fcn.00408586
mov byte [ebp - 4], 0x24
mov byte [ebp - 4], 0x1f
call fcn.00429ba5
pop ecx
cmp edx, esi
jl 0x46ba3a
jg 0x46ba79
cmp eax, edi
ja 0x46ba79
cmp dword [0x6c79d8], 0
je 0x46ba7d
push str.keygen
xor ecx, ecx
lea esi, [ebp - 0x1c]
call fcn.0042b6cc
cmp eax, 0xffffffff
jne 0x46ba79
push str.serial
xor ecx, ecx
call fcn.0042b6cc
cmp eax, 0xffffffff
jne 0x46ba79
push str.crack
xor ecx, ecx
call fcn.0042b6cc
cmp eax, 0xffffffff
je 0x46ba7d
mov byte [ebp - 0x27], 0
push str.hp_
xor ecx, ecx
lea esi, [ebp - 0x1c]
call fcn.0042b6cc
or edi, 0xffffffff
cmp eax, edi
jne 0x46bad3
push str.laserjet
xor ecx, ecx
call fcn.0042b6cc
cmp eax, edi
jne 0x46bad3
push str.printer
xor ecx, ecx
call fcn.0042b6cc
cmp eax, edi
jne 0x46bad3
push str.scanner
xor ecx, ecx
call fcn.0042b6cc
cmp eax, edi
jne 0x46bad3
push str._mfp
xor ecx, ecx
call fcn.0042b6cc
cmp eax, edi
je 0x46bad7
mov byte [ebp - 0x27], 0
cmp byte [ebp - 0x27], 0
je 0x46bedf
xor ebx, ebx
cmp dword [0x6c7a28], ebx
je 0x46bafb
lea eax, [ebp - 0x1c]
push eax
call fcn.0041dd4d
test al, al
je 0x46bafb
mov byte [ebp - 0x27], bl
cmp byte [ebp - 0x27], 0
je 0x46bedf
push 0x2e
lea esi, [ebp - 0x1c]
call fcn.0042b71b
cmp eax, edi
je 0x46bedf
lea ecx, [eax + 1]
lea eax, [ebp - 0x14]
push eax
mov edx, esi
call fcn.0042b7fa
mov byte [ebp - 4], 0x25
lea eax, [ebp - 0x14]
call fcn.00408807
lea eax, [ebp - 0x20]
push eax
call fcn.0040855f
mov byte [ebp - 4], 0x26
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00408586
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x68c7dc
call fcn.00409ed0
test eax, eax
je 0x46bb7d
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x68eef0
call fcn.00409ed0
test eax, eax
je 0x46bb7d
lea eax, [ebp - 0x24]
call fcn.0042b739
jmp 0x46bb8b
push 0x68eef8
lea eax, [ebp - 0x24]
push eax
call fcn.0040865a
cmp dword [0x6c79cc], ebx
je 0x46bcde
cmp dword [0x6ddbc4], 1
jne 0x46bc08
push str.Malware.
lea eax, [ebp - 0x40]
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x44]
push ecx
mov esi, eax
call fcn.0041691a
mov byte [ebp - 4], 0x29
push str..DeepDive
lea ecx, [ebp - 0x48]
push ecx
mov ecx, eax
call fcn.004116ea
add esp, 0x10
mov byte [ebp - 4], 0x2a
lea edi, [ebp - 0x20]
call fcn.00408619
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x48]
call fcn.004085f6
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x44]
call fcn.004085f6
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x40]
call fcn.004085f6
mov eax, dword [ebp - 0x20]
cmp dword [eax - 0xc], ebx
jne 0x46bcde
xor bl, bl
mov eax, 0x6de1d4
mov dword [ebp - 0x2c], eax
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x2b
xor edi, edi
mov dword [ebp - 0xa4], edi
mov eax, dword [0x6de21c]
sub eax, dword [0x6de218]
sar eax, 2
cmp edi, eax
jae 0x46bc5f
mov esi, 0x6de20c
call fcn.0041e10a
push dword [eax]
lea eax, [ebp - 0x14]
push eax
call fcn.00408696
test eax, eax
je 0x46bc63
inc edi
jmp 0x46bc2b
test bl, bl
je 0x46bcd1
push str.Malware.
lea eax, [ebp - 0x54]
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x94]
push ecx
mov esi, eax
call fcn.0041691a
mov byte [ebp - 4], 0x2d
push str..DeepDive
lea ecx, [ebp - 0x38]
push ecx
mov ecx, eax
call fcn.004116ea
add esp, 0x10
mov byte [ebp - 4], 0x2e
lea edi, [ebp - 0x20]
call fcn.00408619
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x38]
call fcn.004085f6
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x94]
call fcn.004085f6
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x54]
call fcn.004085f6
mov byte [ebp - 4], 0x27
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x6ddc74], 0
je 0x46be23
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c820
call fcn.00409ed0
test eax, eax
je 0x46be15
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c828
call fcn.00409ed0
test eax, eax
je 0x46be15
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c830
call fcn.00409ed0
test eax, eax
je 0x46be15
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c838
call fcn.00409ed0
test eax, eax
je 0x46be15
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c840
call fcn.00409ed0
test eax, eax
je 0x46be15
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c848
call fcn.00409ed0
test eax, eax
je 0x46be15
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c850
call fcn.00409ed0
test eax, eax
je 0x46be15
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c858
call fcn.00409ed0
test eax, eax
je 0x46be15
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c860
call fcn.00409ed0
test eax, eax
je 0x46be15
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c868
call fcn.00409ed0
test eax, eax
je 0x46be15
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c870
call fcn.00409ed0
test eax, eax
je 0x46be15
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c878
call fcn.00409ed0
test eax, eax
je 0x46be15
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c880
call fcn.00409ed0
test eax, eax
je 0x46be15
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c888
call fcn.00409ed0
test eax, eax
je 0x46be15
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c890
call fcn.00409ed0
test eax, eax
jne 0x46be23
push str.Malware.DeepScript
lea eax, [ebp - 0x20]
push eax
call fcn.0040865a
mov eax, dword [ebp - 0x20]
cmp dword [eax - 0xc], 0
je 0x46bebb
mov byte [ebp - 4], 0x2f
cmp byte [ebp - 0x25], 0
jne 0x46beb4
cmp byte [ebp - 0x3a], 0
jne 0x46beb4
push 0x1b7740
push dword [0x6ddcbc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, 0x6ddec8
mov dword [ebp - 0x2c], esi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x30
push 0x6ddec4
call fcn.00440e4e
test al, al
je 0x46bea9
lea eax, [ebp - 0x1c]
push eax
call fcn.00440d0e
test al, al
jne 0x46bea9
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x68c830
call fcn.00409ed0
test eax, eax
jne 0x46be9e
push dword [ebp - 0x1c]
call fcn.00429bec
pop ecx
test al, al
je 0x46bea9
push dword [ebp - 0x20]
lea eax, [ebp - 0x34]
call fcn.0040fedc
mov byte [ebp - 4], 0x2f
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0x27
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x24]
call fcn.004085f6
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x20]
call fcn.004085f6
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x14]
call fcn.004085f6
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1c]
call fcn.004085f6
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x18], 0x3e8
je 0x46bfce
mov ecx, dword [ebp - 0x34]
xor eax, eax
cmp dword [ecx - 0xc], eax
jne 0x46bfce
cmp dword [ebp + 0x28], eax
jl 0x46bfce
jg 0x46bf1d
cmp dword [ebp + 0x24], eax
jbe 0x46bfce
cmp dword [ebp + 0x28], 0xffffffff
ja 0x46bfce
jb 0x46bf33
cmp dword [ebp + 0x24], 0xffffffff
jae 0x46bfce
cmp dword [0x6c79c4], eax
je 0x46bfce
mov byte [ebp - 0x49], al
lea eax, [ebp - 0x49]
push eax
push 0
push dword [ebp + 0x24]
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.00411618
mov byte [ebp - 4], 0x32
lea edi, [ebp - 0x34]
call fcn.004084d8
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2c]
call fcn.004084b5
mov eax, dword [ebp - 0x34]
cmp dword [eax - 0xc], 0
je 0x46bfce
push 0x6ddc8c
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push dword [0x6ddc8c]
push ecx
mov eax, esp
mov dword [ebp - 0x54], esp
push str.CloudFound
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x33
mov byte [ebp - 4], 6
call fcn.00432745
push 0x68cde0
lea eax, [ebp - 0x2c]
push eax
mov esi, edi
call fcn.0041683c
pop ecx
pop ecx
mov byte [ebp - 4], 0x34
call fcn.004084d8
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2c]
call fcn.004084b5
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x18], 0x3e8
je 0x46c03c
mov eax, dword [ebp - 0x34]
cmp dword [eax - 0xc], 0
jne 0x46c03c
cmp dword [ebp + 0x28], 0
jl 0x46c03c
jg 0x46bff1
cmp dword [ebp + 0x24], 0
jbe 0x46c03c
cmp dword [ebp + 0x28], 0xffffffff
ja 0x46c03c
jb 0x46bfff
cmp dword [ebp + 0x24], 0xffffffff
jae 0x46c03c
push dword [ebp + 0x24]
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.0044461f
mov byte [ebp - 4], 0x35
lea edi, [ebp - 0x34]
call fcn.004084d8
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2c]
call fcn.004084b5
mov eax, dword [ebp - 0x34]
cmp dword [eax - 0xc], 0
je 0x46c03c
push str.Ransomware.
mov eax, edi
push eax
call fcn.0042b29b
mov eax, dword [ebp - 0x34]
cmp dword [eax - 0xc], 0
je 0x46c4e0
push dword [ebp + 0x10]
lea eax, [ebp - 0x24]
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x36
lea eax, [ebp - 0x24]
call fcn.00408807
mov byte [ebp - 0x25], 0
mov ebx, dword [ebp + 0xc]
lea eax, [ebx + 0xe4]
mov dword [ebp - 0x2c], eax
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x37
add ebx, 0xc0
mov eax, dword [ebx + 0x18]
and dword [ebp - 0x58], 0
mov dword [ebp - 0x54], eax
mov eax, dword [ebx]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x98]
push eax
call fcn.00417035
lea edi, [ebp - 0x58]
mov esi, eax
call fcn.004355da
test al, al
je 0x46c0c0
lea eax, [ebp - 0x24]
push eax
push ebx
lea ebx, [ebp - 0x5c]
call fcn.00416f59
mov byte [ebp - 0x25], 1
mov byte [ebp - 4], 0x36
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [ebp - 0x25], 0
je 0x46c4d4
push dword [ebp + 0x10]
lea eax, [ebp - 0x40]
push eax
call fcn.00488a10
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 0x38
mov ebx, dword [ebp + 0xc]
lea edi, [ebx + 0xe0]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x44]
push eax
mov esi, edi
call fcn.004167ea
mov byte [ebp - 4], 0x39
push 0x682870
lea ecx, [ebp - 0x48]
push ecx
mov esi, eax
call fcn.0041683c
mov byte [ebp - 4], 0x3a
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x94]
push ecx
mov esi, eax
call fcn.004167ea
mov byte [ebp - 4], 0x3b
push 0x688e8c
lea ecx, [ebp - 0x54]
push ecx
mov esi, eax
call fcn.0041683c
add esp, 0x28
mov byte [ebp - 4], 0x3c
call fcn.004084d8
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x54]
call fcn.004084b5
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x94]
call fcn.004084b5
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x48]
call fcn.004084b5
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x44]
call fcn.004084b5
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x40]
call fcn.004084b5
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.00420afa
pop ecx
pop ecx
mov byte [ebp - 4], 0x3d
mov edi, dword [ebp + 8]
call fcn.00408619
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x38]
call fcn.004085f6
push edi
call fcn.00465e0b
pop ecx
lea eax, [ebp - 0x90]
push eax
call fcn.004659de
mov byte [ebp - 4], 0x3e
mov eax, dword [ebp + 0x2c]
xor ebx, ebx
cmp dword [eax - 0xc], ebx
je 0x46c1e4
lea eax, [ebp + 0x2c]
jmp 0x46c1fb
push dword [ebp + 0x10]
lea eax, [ebp - 0x2c]
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x3f
or dword [ebp - 0x18], 0x200
lea edi, [ebp - 0x90]
call fcn.00408619
mov dword [ebp - 4], 0x3e
test dword [ebp - 0x18], 0x200
je 0x46c225
and dword [ebp - 0x18], 0xfffffdff
lea ecx, [ebp - 0x2c]
call fcn.004085f6
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x74]
call fcn.00408619
cmp dword [ebp + 0x1c], ebx
je 0x46c251
lea eax, [ebp - 0x8c]
push eax
push dword [ebp + 0x1c]
lea eax, [ebp - 0x90]
push eax
push dword [ebp + 0xc]
call fcn.0046aad8
add esp, 0x10
lea eax, [ebp - 0x90]
push eax
mov edi, dword [ebp + 0x18]
lea esi, [edi + 0x1c]
call fcn.0047c348
cmp byte [ebp + 0x20], bl
jne 0x46c27c
push ebx
push ebx
push 0x6c79f0
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
mov byte [ebp - 0x20], bl
jne 0x46c280
mov byte [ebp - 0x20], 1
push ebx
push dword [ebp - 0x20]
push ecx
mov eax, esp
mov dword [ebp - 0x2c], esp
push dword [ebp + 8]
push eax
call fcn.00408586
mov byte [ebp - 4], 0x40
push ecx
mov eax, esp
mov dword [ebp - 0x54], esp
lea ecx, [ebp - 0x90]
push ecx
push eax
call fcn.00408586
mov byte [ebp - 4], 0x41
push dword [ebp + 0xc]
mov byte [ebp - 4], 0x3e
mov ebx, edi
call fcn.0046a92c
add esp, 0x14
push 0x6ddc80
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
xor edi, edi
mov dword [ebp - 0x9c], edi
mov eax, dword [ebp - 0x7c]
sub eax, dword [ebp - 0x80]
sar eax, 2
cmp edi, eax
jae 0x46c33c
push 0x6ddc7c
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call esi
push 0x6ddc80
call esi
push 0
push dword [ebp - 0x20]
push ecx
mov eax, esp
mov dword [ebp - 0x2c], esp
push dword [ebp + 8]
push eax
call fcn.00408586
mov byte [ebp - 4], 0x42
lea esi, [ebp - 0x8c]
call fcn.0041e10a
push ecx
mov ecx, esp
mov dword [ebp - 0x54], esp
push eax
push ecx
call fcn.00408586
mov byte [ebp - 4], 0x43
push dword [ebp + 0xc]
mov byte [ebp - 4], 0x3e
mov ebx, dword [ebp + 0x18]
call fcn.0046a92c
add esp, 0x14
inc edi
jmp 0x46c2cc
push dword [0x6ddc80]
push ecx
mov eax, esp
mov dword [ebp - 0x2c], esp
push str.ManualFound
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x44
mov byte [ebp - 4], 0x3e
call fcn.00432745
cmp byte [ebp + 0x20], 0
jne 0x46c37d
push 0
push 0
push 0x6c79f0
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x46c4c4
mov ecx, dword [ebp - 0x7c]
sub ecx, dword [ebp - 0x80]
sar ecx, 2
inc ecx
mov eax, dword [ebp + 0xc]
add dword [eax + 0x40], ecx
mov edi, dword [ebp + 0x10]
push edi
call fcn.00421f7e
pop ecx
mov esi, 0x80
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
push edi
call fcn.00424fac
pop ecx
pop ecx
push 1
mov esi, dword [ebp + 8]
call fcn.00408830
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x2c], esp
push eax
call fcn.0040820f
mov byte [ebp - 4], 0x45
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x54], esp
push edi
call fcn.0040820f
mov byte [ebp - 4], 0x46
mov byte [ebp - 4], 0x3e
call fcn.0046711c
add esp, 0x3c
mov byte [ebp - 0x39], 0
push edi
lea eax, [ebp - 0x38]
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x47
push dword [ebp + 8]
lea esi, [ebp - 0x38]
call fcn.00429d76
pop ecx
mov bl, al
neg bl
sbb bl, bl
inc bl
mov byte [ebp - 4], 0x3e
mov ecx, esi
call fcn.004085f6
test bl, bl
je 0x46c4b4
push 0x68bbb4
lea eax, [ebp - 0x38]
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x48
lea eax, [ebp - 0x38]
mov ecx, dword [ebp + 8]
call fcn.004890b0
mov bl, al
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x38]
call fcn.004085f6
test bl, bl
je 0x46c471
lea eax, [ebp - 0x39]
push eax
push 1
push dword [ebp + 0x24]
lea eax, [ebp - 0x2c]
push eax
mov ecx, edi
call fcn.00411618
lea ecx, [ebp - 0x2c]
call fcn.004084b5
cmp byte [ebp - 0x39], 0
jne 0x46c478
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edi, edi
mov dword [ebp - 0xa0], edi
mov eax, dword [ebp - 0x7c]
mov ecx, eax
sub ecx, dword [ebp - 0x80]
sar ecx, 2
cmp edi, ecx
jae 0x46c4b7
lea esi, [ebp - 0x8c]
call fcn.0041e10a
push eax
call fcn.00425b8c
pop ecx
test al, al
je 0x46c4b1
call fcn.0041e10a
push eax
call fcn.00425bf7
pop ecx
inc edi
jmp 0x46c47a
mov eax, dword [ebp - 0x7c]
sub eax, dword [ebp - 0x80]
sar eax, 2
inc eax
mov ecx, dword [ebp + 0x18]
add dword [ecx + 8], eax
mov byte [ebp - 4], 0x36
lea eax, [ebp - 0x90]
push eax
call fcn.0046c5e3
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x24]
call fcn.004085f6
mov edi, dword [ebp + 0xc]
cmp byte [ebp + 0x14], 0
je 0x46c506
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax - 0xc]
push dword [edi]
test eax, eax
setne al
movzx eax, al
push eax
call fcn.004661c7
pop ecx
pop ecx
inc dword [edi + 0x28]
cmp byte [ebp - 0x3b], 0
jne 0x46c593
cmp dword [edi + 0x18], 0x3e8
je 0x46c593
cmp byte [ebp - 0x3a], 0
jne 0x46c593
mov eax, dword [ebp - 0x34]
cmp dword [eax - 0xc], 0
jne 0x46c593
lea eax, [ebp - 0x60]
push eax
call fcn.00465b40
mov byte [ebp - 4], 0x49
push dword [ebp + 0x10]
lea eax, [ebp - 0x60]
push eax
call fcn.0040865a
mov eax, dword [ebp - 0x60]
cmp dword [eax - 0xc], 0
je 0x46c586
lea eax, [ebp - 0x34]
lea edi, [ebp - 0x5c]
call fcn.004084d8
mov esi, dword [ebp + 0xc]
lea ebx, [esi + 0x134]
mov dword [ebp - 0x2c], ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x4a
lea eax, [ebp - 0x60]
push eax
lea edi, [esi + 0x118]
call fcn.0047c5e6
mov byte [ebp - 4], 0x49
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 4], 6
lea eax, [ebp - 0x60]
push eax
call fcn.0046c621
mov byte [ebp - 4], 5
cmp dword [ebp - 0x64], 0xffffffff
je 0x46c5a6
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x34]
call fcn.004084b5
jmp 0x46c5ba
mov eax, dword [ebp + 0xc]
inc dword [eax + 0x44]
mov dword [ebp - 4], 1
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x2c]
call fcn.004085f6
mov eax, dword [ebp + 8]
call fcn.0058ed03
ret