Function at 0x481e00
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Delete file
Delete registry key
Get file attributes
Move file
Parse pe header
Query or enumerate registry value
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x687b6e
mov eax, dword fs:[0]
push eax
sub esp, 0x374
mov eax, dword [0x740184]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
xor edi, edi
push str.invoff
mov dword [ebp - 0x218], 0
push ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x218], edi
call fcn.004b3fd6
add esp, 8
test eax, eax
jne 0x481eb1
push eax
push eax
push 3
push eax
push 3
push 0xc0000000
push str..CoreDevice
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x484c66
push edi
lea eax, [ebp - 0x218]
mov dword [ebp - 0x220], edi
push eax
push 4
lea eax, [ebp - 0x220]
push eax
push edi
push edi
push 0x80012808
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x484c66
push str.secure
push ebx
call fcn.004b3fd6
add esp, 8
test eax, eax
jne 0x481f0e
push eax
push eax
push 3
push eax
push 3
push 0xc0000000
push str..CoreDevice
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x484c66
push 0
lea eax, [ebp - 0x220]
push eax
push 0
push 0
push 0
push 0
push 0x80012804
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x484c66
push str.unhook
push ebx
call fcn.004b3fd6
add esp, 8
test eax, eax
jne 0x481f6b
push eax
push eax
push 3
push eax
push 3
push 0xc0000000
push str..CoreDevice
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x484c66
push 0
lea eax, [ebp - 0x220]
push eax
push 0
push 0
push 0
push 0
push 0x80012838
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x484c66
push str.check
push ebx
call fcn.004b3fd6
add esp, 8
test eax, eax
jne 0x482056
mov dword [ebp - 0x90], edi
mov dword [ebp - 0x94], vtable.utils::CHandleGuard.0
push eax
push eax
push 3
push eax
push 3
push 0xc0000000
push str..CoreDevice
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x48203e
cmp dword [ebp - 0x90], 0
je 0x481fce
mov eax, dword [ebp - 0x94]
lea ecx, [ebp - 0x94]
call dword [eax + 4]
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x90], esi
push eax
call fcn.004cc970
add esp, 4
push 9
push str.coreExist
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.0044edd0
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push 0x690084
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.004b3e2f
mov esi, eax
add esp, 8
test esi, esi
je 0x482026
push esi
push str.EXIST
call fcn.004b3eec
push esi
call fcn.004b38df
add esp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.0044da70
lea ecx, [ebp - 0x94]
call fcn.00481160
jmp 0x484c66
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x94]
mov edi, eax
call fcn.00481160
jmp 0x484c66
push str.check_os
push ebx
call fcn.004b3fd6
add esp, 8
test eax, eax
jne 0x482127
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], al
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 2
push eax
call fcn.00481ca0
add esp, 4
lea ecx, [ebp - 0x2c]
push 0x24
push str.8A2DC9BE_8FFA_458B_BF27_90C7D029AAF0
call fcn.0044edd0
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push 0x690084
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.004b3e2f
mov esi, eax
add esp, 8
test esi, esi
je 0x482112
call fcn.004d9f70
push esi
test al, al
jne 0x4820da
cmp dword [0x7400ec], 0x10
mov ecx, 0x7400d8
cmovae ecx, dword [0x7400d8]
push ecx
jmp 0x4820ee
cmp dword [0x7400d4], 0x10
mov eax, 0x7400c0
cmovae eax, dword [0x7400c0]
push eax
call fcn.004b3eec
add esp, 8
push esi
call fcn.004b3c56
push esi
call fcn.004b38df
add esp, 8
lea ecx, [ebp - 0x2c]
call fcn.0044da70
jmp 0x484c66
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x2c]
mov edi, eax
call fcn.0044da70
jmp 0x484c66
push str.check_win64
push ebx
call fcn.004b3fd6
add esp, 8
test eax, eax
jne 0x4821e0
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], al
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 3
push eax
call fcn.00481ca0
add esp, 4
lea ecx, [ebp - 0x2c]
push 0x24
push str.797FB43A_CC91_4c03_BD6F_81E6147C5FFA
call fcn.0044edd0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.004cb080
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
push 0x690084
cmovae ecx, dword [ebp - 0x2c]
mov bl, al
push ecx
call fcn.004b3e2f
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4821ce
push esi
test bl, bl
je 0x4821a5
push str.WIN64
jmp 0x4821aa
push str.WIN32
call fcn.004b3eec
add esp, 8
push esi
call fcn.004b3c56
push esi
call fcn.004b38df
add esp, 8
lea ecx, [ebp - 0x2c]
call fcn.0044da70
jmp 0x484c66
lea ecx, [ebp - 0x2c]
mov edi, 2
call fcn.0044da70
jmp 0x484c66
push str.delsrvc
push ebx
call fcn.004b3fd6
add esp, 8
test eax, eax
jne 0x4823a8
sub esp, 0x18
push esp
call fcn.0044d490
add esp, 4
lea ecx, [ebp - 0x214]
push 0x690110
call fcn.00457910
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 4
push ecx
lea ecx, [eax + 0x18]
call fcn.00454c10
lea ecx, [ebp - 0x214]
mov byte [ebp - 4], 6
call fcn.00450430
sub esp, 0x18
push esp
call fcn.0044d4e0
add esp, 4
lea ecx, [ebp - 0x364]
push 0x690110
call fcn.00457910
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 7
push ecx
lea ecx, [eax + 0x18]
call fcn.00454c10
lea ecx, [ebp - 0x364]
mov byte [ebp - 4], 9
call fcn.00450430
lea eax, [ebp - 0x2c]
push eax
call fcn.0044d440
add esp, 4
push 1
push 3
lea ecx, [ebp - 0x214]
mov byte [ebp - 4], 0xa
call fcn.00452f50
lea eax, [ebp - 0x204]
mov byte [ebp - 4], 0xb
push 0x690110
push eax
call fcn.00456150
add esp, 8
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
cmovae ecx, dword [ebp - 0x2c]
push 0x68ffec
push dword [ebp - 0x1c]
push ecx
push eax
call fcn.004576f0
add esp, 0xc
push eax
call fcn.00456150
mov edx, dword [ebp - 0x18]
add esp, 8
mov byte [ebp - 4], 9
cmp edx, 0x10
jb 0x482307
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4822fd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x484c84
push edx
push ecx
call fcn.0048af59
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0xc
push eax
lea ecx, [ebp - 0x1fc]
call fcn.00454c10
lea ecx, [ebp - 0x214]
call fcn.00450430
cmp dword [ebp - 0x30], 0x10
lea eax, [ebp - 0x44]
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
cmovae eax, dword [ebp - 0x44]
push eax
push closesocket
call esi
push str.SYSTEMCurrentControlSetServicesAgentManager
push closesocket
call esi
cmp dword [ebp - 0x78], 0x10
lea eax, [ebp - 0x8c]
cmovae eax, dword [ebp - 0x8c]
push eax
push closesocket
call esi
cmp dword [ebp - 0x60], 0x10
lea eax, [ebp - 0x74]
cmovae eax, dword [ebp - 0x74]
push eax
push closesocket
call esi
lea ecx, [ebp - 0x74]
call fcn.0044da70
lea ecx, [ebp - 0x8c]
call fcn.0044da70
lea ecx, [ebp - 0x44]
call fcn.0044da70
jmp 0x484c66
push str.checkversion
push ebx
call fcn.004b3fd6
add esp, 8
test eax, eax
jne 0x482444
push eax
push eax
push 3
push eax
push 3
push 0xc0000000
push str..CoreDevice
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov edi, 1
cmp esi, 0xffffffff
je 0x484c66
lea eax, [ebp - 0x40]
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x28], xmm0
call fcn.004ca670
add esp, 4
lea eax, [ebp - 0x220]
push 0
push eax
push 0x14
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0x80012c20
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x40]
jl 0x484c66
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x3c]
jl 0x484c66
xor edi, edi
jmp 0x484c66
push str.reboot
push ebx
call fcn.004b3fd6
add esp, 8
test eax, eax
jne 0x4824a9
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], edi
push eax
push str.SeShutdownPrivilege
call fcn.004818e0
add esp, 8
test eax, eax
jne 0x48247f
mov edi, dword [ebp - 0x218]
jmp 0x484c66
push 0x80040002
push 1
push 1
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExA]
test eax, eax
jne 0x484c66
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x484c66
push str.block
push ebx
call fcn.004b3fd6
add esp, 8
test eax, eax
jne 0x4825c2
push eax
push eax
push 3
push eax
push 3
push 0xc0000000
push str..CoreDevice
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x484c66
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea eax, [ebp - 0x220]
push 0
push eax
push 0x14
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], edi
push eax
push 0
push 0
push 0x80012c20
xorps xmm0, xmm0
push esi
movups xmmword [ebp - 0x28], xmm0
call ebx
test eax, eax
jne 0x48259d
lea eax, [ebp - 0x44]
push eax
call fcn.004cc970
add esp, 4
push 0x12
push str.coreBlockedOldMode
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0xd
call fcn.0044edd0
cmp dword [ebp - 0x30], 0x10
lea eax, [ebp - 0x44]
push 0x690084
cmovae eax, dword [ebp - 0x44]
push eax
call fcn.004b3e2f
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x48256b
push ebx
push str.block
call fcn.004b3eec
push ebx
call fcn.004b38df
add esp, 0xc
jmp 0x482573
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp dword [ebp - 0x30], 0x10
lea eax, [ebp - 0x44]
push 4
cmovae eax, dword [ebp - 0x44]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea ecx, [ebp - 0x44]
call fcn.0044da70
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x484c66
push 0
lea eax, [ebp - 0x220]
push eax
push 0
push 0
push 0
push 0
push 0x80012c08
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x484c66
push str.check_block
push ebx
call fcn.004b3fd6
add esp, 8
test eax, eax
jne 0x482760
push eax
push eax
push 3
push eax
push 3
push 0xc0000000
push str..CoreDevice
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x484c66
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea eax, [ebp - 0x220]
push 0
push eax
push 0x14
lea eax, [ebp - 0x28]
mov dword [ebp - 0x218], edi
push eax
push 0
push 0
push 0x80012c20
xorps xmm0, xmm0
mov dword [ebp - 0x18], edi
push esi
movups xmmword [ebp - 0x28], xmm0
call ebx
test eax, eax
jne 0x4826ab
lea eax, [ebp - 0x44]
push eax
call fcn.004cc970
add esp, 4
push 0x12
push str.coreBlockedOldMode
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0xe
call fcn.0044edd0
cmp dword [ebp - 0x30], 0x10
lea eax, [ebp - 0x44]
push 0x6901b8
cmovae eax, dword [ebp - 0x44]
push eax
call fcn.004b3e2f
add esp, 8
test eax, eax
je 0x482692
push eax
call fcn.004b38df
add esp, 4
mov dword [ebp - 0x218], 1
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0xffffffff
call fcn.0044da70
jmp 0x4826d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0xffffffff
mov edi, eax
call fcn.0044da70
jmp 0x4826d5
push 0
lea eax, [ebp - 0x220]
push eax
push 4
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x80012c04
push esi
call ebx
test eax, eax
jne 0x4826d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x218], 0
je 0x484c66
lea eax, [ebp - 0x44]
push eax
call fcn.004cc970
add esp, 4
push 0xb
push str.coreBlocked
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0xf
call fcn.0044edd0
cmp dword [ebp - 0x30], 0x10
lea eax, [ebp - 0x44]
push 0x690084
cmovae eax, dword [ebp - 0x44]
push eax
call fcn.004b3e2f
mov esi, eax
add esp, 8
test esi, esi
je 0x48274b
push esi
push str.BLOCKED
call fcn.004b3eec
push esi
call fcn.004b38df
add esp, 0xc
lea ecx, [ebp - 0x44]
call fcn.0044da70
jmp 0x484c66
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x44]
mov edi, eax
call fcn.0044da70
jmp 0x484c66
push str.install
push ebx
call fcn.004b3fd6
add esp, 8
test eax, eax
jne 0x482862
lea eax, [ebp - 0x8c]
push eax
call fcn.0044d3c0
mov esi, eax
lea eax, [ebp - 0xec]
mov dword [ebp - 4], 0x10
push eax
call fcn.004cc970
push esi
push eax
lea eax, [ebp - 0xd4]
mov byte [ebp - 4], 0x11
push eax
call fcn.004560d0
push 0x726f98
push eax
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 0x12
push eax
call fcn.00456080
push 0x740078
push eax
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x13
push eax
call fcn.0046d810
add esp, 0x2c
lea ecx, [ebp - 0x5c]
call fcn.0044da70
lea ecx, [ebp - 0xd4]
call fcn.0044da70
lea ecx, [ebp - 0xec]
call fcn.0044da70
lea ecx, [ebp - 0x8c]
call fcn.0044da70
mov dword [ebp - 0x94], 0x68ff84
mov dword [ebp - 0x90], 0
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 0x19
push eax
lea ecx, [ebp - 0x20]
call fcn.00485ba0
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x1a
push eax
lea ecx, [ebp - 0x20]
call fcn.00485bd0
mov edi, eax
test edi, edi
jne 0x482842
lea ecx, [ebp - 0x20]
call fcn.00485c30
mov edi, eax
lea ecx, [ebp - 0x20]
call fcn.00481160
lea ecx, [ebp - 0x94]
call fcn.00481230
lea ecx, [ebp - 0x74]
call fcn.0044da70
jmp 0x484c66
push str.installvcredist
push ebx
call fcn.004b3fd6
add esp, 8
test eax, eax
jne 0x48287e
call fcn.00484ee0
jmp 0x484c68
push str.hidesrvc
push ebx
call fcn.004b3fd6
add esp, 8
test eax, eax
jne 0x4828e7
push eax
push eax
push 3
push eax
push 3
push 0xc0000000
push str..CoreDevice
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x48249c
push 0
lea eax, [ebp - 0x220]
push eax
push 0
push 0
push 0
push 0
push 0x80012c18
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x4828db
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x484c66
push 6
push str.update
push ebx
call fcn.004b40d2
add esp, 0xc
test eax, eax
jne 0x482ae7
push 1
push 0x68ff4c
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], al
call fcn.0044eca0
push ebx
lea ecx, [ebp - 0x74]
mov dword [ebp - 4], 0x1b
call fcn.0044dac0
push 0
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0x1c
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0047d420
add esp, 0x10
lea ecx, [ebp - 0x74]
call fcn.0044da70
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x1f
call fcn.0044da70
mov ecx, dword [ebp - 0x34]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x38]
sub ecx, esi
imul ecx
mov dword [ebp - 0xac], 0
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
ja 0x4829d6
push 0xb
push str.coreUpdated
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0xa8], 0xf
mov byte [ebp - 0xbc], 0
call fcn.0044eca0
lea eax, [ebp - 0xbc]
mov byte [ebp - 4], 0x20
push 1
push eax
call fcn.004855e0
add esp, 8
lea ecx, [ebp - 0xbc]
call fcn.0044da70
lea ecx, [ebp - 0x38]
mov edi, 1
call fcn.00452a10
jmp 0x484c66
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xa8], 0
lea eax, [esi + 0x18]
mov byte [ebp - 4], 0x21
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.0047d4b0
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x22
push ecx
push eax
call fcn.0046e5d0
add esp, 0x10
lea ecx, [ebp - 0x5c]
call fcn.0044d800
mov dword [ebp - 0x94], 0x68ff84
mov dword [ebp - 0x90], 0
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 0x23
push eax
lea ecx, [ebp - 0x20]
call fcn.00485ba0
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 0x24
push eax
lea ecx, [ebp - 0x20]
call fcn.00485d00
mov edi, eax
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 0x25
mov dword [ebp - 0x20], vtable.utils::CHandleGuardImpl_struct_utils::DebugBreaker_.0
test eax, eax
je 0x482a80
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x482a80
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 6
jne 0x482a80
call fcn.0044e7f0
mov eax, dword [ebp - 0x90]
mov byte [ebp - 4], 0x21
test eax, eax
je 0x482a95
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xb
push str.coreUpdated
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.0044eca0
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0x26
push edi
push eax
call fcn.004855e0
add esp, 8
lea ecx, [ebp - 0x2c]
call fcn.0044da70
lea ecx, [ebp - 0xb0]
call fcn.00452a20
lea ecx, [ebp - 0x38]
call fcn.00452a10
jmp 0x484c66
push str.check_secure
push ebx
call fcn.004b3fd6
add esp, 8
test eax, eax
jne 0x482bf8
push eax
push eax
push 3
push eax
push 3
push 0xc0000000
push str..CoreDevice
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x218], edi
cmp eax, 0xffffffff
je 0x48249c
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xac], vtable.utils::CHandleGuard.0
push 0
lea ecx, [ebp - 0x90]
mov dword [ebp - 4], 0x27
push ecx
push 4
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x220], 1
push ecx
push 4
lea ecx, [ebp - 0x220]
push ecx
push 0x80012c28
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x482b85
lea ecx, [ebp - 0xac]
mov dword [ebp - 0x218], eax
call fcn.00481160
jmp 0x484c66
cmp dword [ebp - 0x218], 0
je 0x482be8
lea eax, [ebp - 0x2c]
push eax
call fcn.004cc970
add esp, 4
push 0x13
push str.coreSecurityEnabled
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x28
call fcn.0044edd0
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push 0x690084
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.004b3e2f
mov esi, eax
add esp, 8
test esi, esi
je 0x482be0
push esi
push str.ENABLED
call fcn.004b3eec
push esi
call fcn.004b38df
add esp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.0044da70
lea ecx, [ebp - 0xac]
call fcn.00481160
jmp 0x484c66
push 0xc
push str.copy_reg_key
push ebx
call fcn.004b40d2
add esp, 0xc
test eax, eax
jne 0x482e21
push 1
push 0x68ff4c
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], al
call fcn.0044eca0
push ebx
lea ecx, [ebp - 0x74]
mov dword [ebp - 4], 0x29
call fcn.0044dac0
push 0
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0x2a
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.0047d420
add esp, 0x10
lea ecx, [ebp - 0x74]
call fcn.0044da70
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x2d
call fcn.0044da70
mov ecx, dword [ebp - 0xac]
mov eax, 0x2aaaaaab
sub ecx, dword [ebp - 0xb0]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
ja 0x482cdf
push 0xa
push str.coreCopied
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
call fcn.0044eca0
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 0x2e
push 1
push eax
call fcn.004855e0
add esp, 8
lea ecx, [ebp - 0x44]
call fcn.0044da70
lea ecx, [ebp - 0xb0]
mov edi, 1
call fcn.00452a10
jmp 0x484c66
mov eax, dword [ebp - 0xb0]
add eax, 0x30
mov byte [ebp - 4], 0x2f
push eax
lea eax, [ebp - 0xd4]
push eax
call fcn.0047d4b0
add esp, 8
mov esi, eax
mov ecx, dword [ebp - 0xb0]
lea eax, [ebp - 0x5c]
add ecx, 0x18
mov byte [ebp - 4], 0x30
push ecx
push eax
call fcn.0047d4b0
add esp, 8
push esi
push closesocket
push eax
push closesocket
mov byte [ebp - 4], 0x31
call fcn.004d1a90
add esp, 0x10
lea ecx, [ebp - 0x5c]
call fcn.0044d800
lea ecx, [ebp - 0xd4]
call fcn.0044d800
push 0xa
xor edi, edi
mov dword [ebp - 4], 0x2d
push str.coreCopied
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
call fcn.0044eca0
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 0x35
push edi
push eax
call fcn.004855e0
add esp, 8
lea ecx, [ebp - 0x44]
call fcn.0044da70
lea ecx, [ebp - 0xb0]
call fcn.00452a10
jmp 0x484c66
push 0x13
push str.delete_after_reboot
push ebx
call fcn.004b40d2
add esp, 0xc
test eax, eax
jne 0x483128
push 1
push 0x68ff4c
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x94], edi
mov dword [ebp - 0x90], 0xf
mov byte [ebp - 0xa4], al
call fcn.0044eca0
push ebx
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0x36
call fcn.0044dac0
push 0
lea eax, [ebp - 0xa4]
mov byte [ebp - 4], 0x37
push eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.0047d420
add esp, 0x10
lea ecx, [ebp - 0x8c]
call fcn.0044da70
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x3a
call fcn.0044da70
mov ecx, dword [ebp - 0xac]
mov eax, 0x2aaaaaab
sub ecx, dword [ebp - 0xb0]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
ja 0x482f23
push 0xb
push str.coreDeleted
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.0044eca0
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0x3b
push 1
push eax
call fcn.004855e0
add esp, 8
lea ecx, [ebp - 0x2c]
call fcn.0044da70
lea ecx, [ebp - 0xb0]
mov edi, 1
call fcn.00452a10
jmp 0x484c66
mov eax, dword [ebp - 0xb0]
add eax, 0x18
mov byte [ebp - 4], 0x3c
push eax
lea eax, [ebp - 0xd4]
push eax
call fcn.0047d4b0
add esp, 8
mov ebx, eax
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 0x3d
push eax
call fcn.004cd120
add esp, 4
mov esi, eax
mov eax, dword [esi + 0x10]
lea edi, [esi + 0x10]
mov byte [ebp - 4], 0x3e
test eax, eax
je 0x484c89
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x482f70
mov ecx, dword [esi]
movzx eax, word [ecx + eax*2 - 2]
cmp eax, 0x2f
je 0x482fd3
cmp eax, 0x5c
je 0x482fd3
xor eax, eax
mov dword [ebp - 0x34], 0
mov word [ebp - 0x44], ax
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x30], 7
mov eax, dword [edi]
inc eax
mov byte [ebp - 4], 0x3f
push eax
mov dword [ebp - 0x218], 0x80
call fcn.00452ac0
cmp dword [esi + 0x14], 8
jb 0x482fb5
mov esi, dword [esi]
push dword [edi]
lea ecx, [ebp - 0x44]
push esi
call fcn.0044f170
push 0x5c
lea ecx, [ebp - 0x44]
call fcn.0046f9b0
mov dword [ebp - 4], 0x3e
jmp 0x482fdc
push esi
lea ecx, [ebp - 0x44]
call fcn.0044d8b0
push ebx
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 0x40
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.00456820
add esp, 0xc
lea ecx, [ebp - 0x44]
call fcn.0044d800
lea ecx, [ebp - 0x5c]
call fcn.0044d800
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x44
call fcn.0044d800
lea ecx, [ebp - 0x28]
call fcn.004d82e0
cmp dword [ebp - 0x60], 8
lea eax, [ebp - 0x74]
push 4
cmovae eax, dword [ebp - 0x74]
push 0
push eax
mov byte [ebp - 4], 0x45
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x484caa
lea ecx, [ebp - 0x28]
call fcn.004d8400
lea ecx, [ebp - 0x74]
call fcn.0044d800
push 0xb
xor edi, edi
mov dword [ebp - 4], 0x3a
push str.coreDeleted
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.0044eca0
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0x4a
push edi
push eax
call fcn.004855e0
add esp, 8
lea ecx, [ebp - 0x2c]
call fcn.0044da70
lea ecx, [ebp - 0xb0]
call fcn.00452a10
jmp 0x484c66
push 0xc
push str.remove_cache
push ebx
call fcn.004b40d2
add esp, 0xc
test eax, eax
jne 0x483519
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 4], 0x4b
call fcn.0044d470
add esp, 4
push 1
push 3
lea ecx, [ebp - 0x214]
mov byte [ebp - 4], 0x4c
call fcn.0044dc80
lea eax, [ebp - 0x204]
mov byte [ebp - 4], 0x4d
push str.SYSTEMCurrentControlSetServices_
push eax
call fcn.0047d860
add esp, 8
lea ecx, [ebp - 0x44]
cmp dword [ebp - 0x30], 8
cmovae ecx, dword [ebp - 0x44]
push dword [ebp - 0x34]
push ecx
push eax
call fcn.004808a0
add esp, 0xc
push str.Settings
push eax
call fcn.0047d860
mov edx, dword [ebp - 0x30]
add esp, 8
mov byte [ebp - 4], 0x4b
cmp edx, 8
jb 0x4831e8
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4831de
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x484ce4
push edx
push ecx
call fcn.0048af59
add esp, 8
xor eax, eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
lea eax, [ebp - 0xa4]
mov byte [ebp - 4], 0x4e
push eax
lea ecx, [ebp - 0x214]
call fcn.0044dbc0
lea ecx, [ebp - 0x214]
call fcn.0044d300
cmp dword [ebp - 0x90], 8
lea ecx, [ebp - 0x218]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0xa4]
cmovae eax, dword [ebp - 0xa4]
push ecx
push 0xf003f
push 0
push eax
push closesocket
mov byte [ebp - 4], 0x51
mov dword [ebp - 0x218], 0
call esi
test eax, eax
jne 0x484ce9
jmp 0x4832c8
mov edi, dword [ebp - 0x218]
push str.HashDBDir
lea ecx, [ebp - 0xbc]
mov dword [ebp - 4], 0x50
call fcn.0044d860
cmp dword [ebp - 0x90], 8
lea ecx, [ebp - 0x220]
push ecx
push 1
lea eax, [ebp - 0xa4]
mov byte [ebp - 4], 0x54
cmovae eax, dword [ebp - 0xa4]
push 0
push eax
push closesocket
mov dword [ebp - 0x220], 0
call esi
test eax, eax
jne 0x484d60
cmp dword [ebp - 0xa8], 8
lea eax, [ebp - 0xbc]
mov esi, dword [ebp - 0x220]
cmovae eax, dword [ebp - 0xbc]
push 0
push 0
push 0
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x484d44
test eax, eax
jne 0x484d44
mov byte [ebp - 4], 0x56
test esi, esi
je 0x483375
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x483375
call fcn.0044e7f0
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], 0x59
test edi, edi
je 0x483401
cmp dword [ebp - 0xa8], 8
lea ecx, [ebp - 0x2c]
lea eax, [ebp - 0xbc]
cmovae eax, dword [ebp - 0xbc]
push ecx
push eax
push edi
call fcn.004d26e0
add esp, 0xc
test eax, eax
jne 0x483401
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x484d0a
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmovae eax, dword [ebp - 0x2c]
push eax
call esi
push str._journal
lea ecx, [ebp - 0x2c]
call fcn.00452b60
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call esi
lea ecx, [ebp - 0x2c]
call fcn.0044d800
lea ecx, [ebp - 0xbc]
call fcn.0044d800
lea ecx, [ebp - 0xa4]
call fcn.0044d800
push 0xb
xor edi, edi
mov dword [ebp - 4], 0xffffffff
push str.coreDeleted
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x78], 0xf
mov byte [ebp - 0x8c], 0
call fcn.0044eca0
lea eax, [ebp - 0x8c]
mov dword [ebp - 4], 0x5e
push edi
push eax
call fcn.004855e0
add esp, 8
lea ecx, [ebp - 0x8c]
call fcn.0044da70
jmp 0x484c66
push 0x1d
push str.delete_driver_remover_scripts
push ebx
call fcn.004b40d2
add esp, 0xc
test eax, eax
jne 0x483a38
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.004cb080
mov byte [ebp - 0x219], al
lea eax, [ebp - 0xd4]
push eax
call fcn.0044d4c0
mov esi, eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 0x5f
push eax
call fcn.004ccab0
push esi
push eax
lea eax, [ebp - 0xa4]
mov byte [ebp - 4], 0x60
push eax
call fcn.00456820
add esp, 0x18
lea ecx, [ebp - 0x5c]
call fcn.0044d800
lea ecx, [ebp - 0xd4]
call fcn.0044d800
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 0
cmp byte [ebp - 0x219], 0
mov byte [ebp - 4], 0x65
jne 0x4836c4
push 0
lea ecx, [ebp - 0x1f8]
call fcn.004d4020
push str..bat
lea eax, [ebp - 0xa4]
mov byte [ebp - 4], 0x66
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.004568a0
add esp, 0xc
push eax
lea ecx, [ebp - 0x1f8]
mov byte [ebp - 4], 0x67
call fcn.004d7250
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x66
call fcn.0044d800
push str..exe
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0xd4]
push eax
call fcn.004568a0
add esp, 0xc
push eax
lea ecx, [ebp - 0x1f8]
mov byte [ebp - 4], 0x68
call fcn.004d71a0
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x66
call fcn.0044d800
push str..bat
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.004568a0
add esp, 0xc
push eax
lea ecx, [ebp - 0x1f8]
mov byte [ebp - 4], 0x69
call fcn.004d71a0
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x66
call fcn.0044d800
push str..exe
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0xd4]
push eax
call fcn.004568a0
add esp, 0xc
push eax
lea ecx, [ebp - 0x1f8]
mov byte [ebp - 4], 0x6a
call fcn.004d7250
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x66
call fcn.0044d800
lea ecx, [ebp - 0x1f8]
call fcn.004d58a0
lea ecx, [ebp - 0x1f8]
mov byte [ebp - 4], 0x65
call fcn.004d4410
jmp 0x483957
push 1
push 0x68ff4c
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 0xf
mov byte [ebp - 0x8c], 0
call fcn.0044eca0
push ebx
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 0x6b
call fcn.0044dac0
push 0
lea eax, [ebp - 0x8c]
mov byte [ebp - 4], 0x6c
push eax
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0047d420
add esp, 0x10
lea ecx, [ebp - 0xec]
call fcn.0044da70
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0x6f
call fcn.0044da70
mov ecx, dword [ebp - 0x1c]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x20]
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
ja 0x48375d
mov edi, 1
jmp 0x48394b
lea eax, [esi + 0x18]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0047d4b0
add esp, 8
push str.__remove
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x70
call fcn.0044d860
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 0x71
cmovae eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
lea eax, [ebp - 0x44]
push eax
je 0x484dbc
lea ecx, [ebp - 0xd4]
call fcn.0044d8b0
push 0x726798
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 0x75
call fcn.0044d860
push str..bat
lea eax, [ebp - 0xa4]
mov byte [ebp - 4], 0x76
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.004568a0
add esp, 0xc
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 0x77
push ecx
push eax
push 1
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00481680
add esp, 0x14
lea ecx, [ebp - 0x5c]
call fcn.0044d800
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 0x75
call fcn.0044d800
push 0x726798
lea ecx, [ebp - 0x8c]
call fcn.0044d860
push str..exe
lea eax, [ebp - 0xa4]
mov byte [ebp - 4], 0x78
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.004568a0
add esp, 0xc
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0x79
push ecx
push eax
push 2
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00481680
add esp, 0x14
lea ecx, [ebp - 0x5c]
call fcn.0044d800
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0x75
call fcn.0044d800
push 0x726798
lea ecx, [ebp - 0xec]
call fcn.0044d860
push str..exe
lea eax, [ebp - 0xa4]
mov byte [ebp - 4], 0x7a
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.004568a0
add esp, 0xc
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 0x7b
push ecx
push eax
push 1
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00481680
add esp, 0x14
lea ecx, [ebp - 0x5c]
call fcn.0044d800
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 0x75
call fcn.0044d800
push 0x726798
lea ecx, [ebp - 0x8c]
call fcn.0044d860
push str..bat
lea eax, [ebp - 0xa4]
mov byte [ebp - 4], 0x7c
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.004568a0
add esp, 0xc
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0x7d
push ecx
push eax
push 2
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00481680
add esp, 0x14
lea ecx, [ebp - 0x5c]
call fcn.0044d800
lea ecx, [ebp - 0x8c]
call fcn.0044d800
lea ecx, [ebp - 0xd4]
call fcn.00481040
lea ecx, [ebp - 0x74]
call fcn.0044d800
lea ecx, [ebp - 0x44]
call fcn.0044d800
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x65
call fcn.00452a10
push 0xb
push str.coreDeleted
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0xf
mov byte [ebp - 0x74], 0
call fcn.0044eca0
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x7e
push edi
push eax
call fcn.004855e0
add esp, 8
lea ecx, [ebp - 0x74]
call fcn.0044da70
jmp 0x483a1d
lea ecx, [ebp - 0xb0]
call fcn.00452a20
lea ecx, [ebp - 0xa4]
call fcn.0044d800
jmp 0x484c66
push 0x1e
push str.install_driver_remover_scripts
push ebx
call fcn.004b40d2
add esp, 0xc
test eax, eax
jne 0x483e29
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.004cb080
mov byte [ebp - 0x219], al
lea eax, [ebp - 0xd4]
push eax
call fcn.0044d4c0
mov esi, eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 0x81
push eax
call fcn.004ccab0
push esi
push eax
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x82
push eax
call fcn.00456820
add esp, 0x18
lea ecx, [ebp - 0x5c]
call fcn.0044d800
lea ecx, [ebp - 0xd4]
call fcn.0044d800
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 0
mov byte [ebp - 4], 0x87
call fcn.004dc5f0
cmp byte [ebp - 0x219], 0
jne 0x483bbf
push 0
lea ecx, [ebp - 0x1f8]
call fcn.004d4020
xor eax, eax
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 7
mov word [ebp - 0x8c], ax
push str..bat
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x89
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.004568a0
add esp, 0xc
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0x8a
push ecx
push eax
lea ecx, [ebp - 0x1f8]
call fcn.004d55c0
lea ecx, [ebp - 0x5c]
call fcn.0044d800
lea ecx, [ebp - 0x8c]
call fcn.0044d800
xor eax, eax
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 7
mov word [ebp - 0x8c], ax
push str..exe
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x8b
push eax
lea eax, [ebp - 0xd4]
push eax
call fcn.004568a0
add esp, 0xc
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0x8c
push ecx
push eax
lea ecx, [ebp - 0x1f8]
call fcn.004d5500
lea ecx, [ebp - 0xd4]
call fcn.0044d800
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0x88
call fcn.0044d800
lea ecx, [ebp - 0x1f8]
call fcn.004d58a0
lea ecx, [ebp - 0x1f8]
call fcn.004d4410
jmp 0x483e11
push 0x68ff4c
lea ecx, [ebp - 0xa4]
call fcn.0044dac0
push ebx
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 0x8d
call fcn.0044dac0
push 0
lea eax, [ebp - 0xa4]
mov byte [ebp - 4], 0x8e
push eax
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0047d420
add esp, 0x10
lea ecx, [ebp - 0xec]
call fcn.0044da70
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x91
call fcn.0044da70
lea ecx, [ebp - 0x20]
call fcn.004529f0
cmp eax, 1
ja 0x483c30
mov edi, 1
jmp 0x483d6c
mov eax, dword [ebp - 0x20]
add eax, 0x18
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0047d4b0
add esp, 8
push str.__add
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0x92
call fcn.0044d860
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 0x93
cmovae eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
lea eax, [ebp - 0x44]
push eax
je 0x484e1b
lea ecx, [ebp - 0x104]
call fcn.0044d8b0
push 0x726798
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x97
call fcn.0044d860
push str..bat
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x98
push eax
lea eax, [ebp - 0x124]
push eax
call fcn.004568a0
add esp, 0xc
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x99
push ecx
push eax
push 1
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00481680
add esp, 0x14
lea ecx, [ebp - 0x124]
call fcn.0044d800
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x97
call fcn.0044d800
push 0x726798
lea ecx, [ebp - 0x5c]
call fcn.0044d860
push str..exe
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x9a
push eax
lea eax, [ebp - 0x124]
push eax
call fcn.004568a0
add esp, 0xc
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x9b
push ecx
push eax
push 2
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00481680
add esp, 0x14
lea ecx, [ebp - 0x124]
call fcn.0044d800
lea ecx, [ebp - 0x5c]
call fcn.0044d800
lea ecx, [ebp - 0x104]
call fcn.00481040
lea ecx, [ebp - 0x8c]
call fcn.0044d800
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x91
call fcn.0044d800
push str.coreDeleted
lea ecx, [ebp - 0x5c]
call fcn.0044dac0
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 0x9c
push edi
push eax
call fcn.004855e0
add esp, 8
lea ecx, [ebp - 0x5c]
call fcn.0044da70
lea ecx, [ebp - 0x20]
call fcn.00452a10
jmp 0x483e11
lea ecx, [ebp - 0xb0]
call fcn.00452a20
lea ecx, [ebp - 0x74]
call fcn.0044d800
jmp 0x484c66
push 0x16
push str.remove_helper_from_gpo
push ebx
call fcn.004b40d2
add esp, 0xc
test eax, eax
jne 0x48414b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.004cb080
mov byte [ebp - 0x219], al
mov dword [ebp - 0xb0], edi
mov dword [ebp - 0xac], edi
mov dword [ebp - 0xa8], edi
lea eax, [ebp - 0xec]
mov dword [ebp - 4], 0x9f
push eax
call fcn.0044d3f0
mov esi, eax
lea eax, [ebp - 0x124]
mov byte [ebp - 4], 0xa0
push eax
call fcn.004ccab0
push esi
push eax
lea eax, [ebp - 0x104]
mov byte [ebp - 4], 0xa1
push eax
call fcn.00456820
push str.AgentManagerHelper.exe
push eax
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0xa2
push eax
call fcn.0044f680
add esp, 0x24
lea ecx, [ebp - 0x104]
call fcn.0044d800
lea ecx, [ebp - 0x124]
call fcn.0044d800
lea ecx, [ebp - 0xec]
call fcn.0044d800
cmp byte [ebp - 0x219], 0
mov byte [ebp - 4], 0xa7
jne 0x483f2e
push 0
lea ecx, [ebp - 0x1f8]
call fcn.004d4020
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0xa8
push eax
lea ecx, [ebp - 0x1f8]
call fcn.004d7040
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x1f8]
call fcn.004d70f0
lea ecx, [ebp - 0x1f8]
call fcn.004d58a0
lea ecx, [ebp - 0x1f8]
mov byte [ebp - 4], 0xa7
call fcn.004d4410
jmp 0x484098
push 0x68ff4c
lea ecx, [ebp - 0xd4]
call fcn.0044dac0
push ebx
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0xa9
call fcn.0044dac0
push 0
lea eax, [ebp - 0xd4]
mov byte [ebp - 4], 0xaa
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x98]
push eax
call fcn.0047d420
add esp, 0x10
lea ecx, [ebp - 0x5c]
call fcn.0044da70
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0xad
call fcn.0044da70
lea ecx, [ebp - 0x98]
call fcn.004529f0
cmp eax, 1
ja 0x483f9c
mov edi, 1
jmp 0x484089
mov eax, dword [ebp - 0x98]
add eax, 0x18
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0047d4b0
add esp, 8
push str.__remove
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0xae
call fcn.0044d860
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0xaf
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x484e7a
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x44]
call fcn.0044d8b0
push 0x726798
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0xb2
call fcn.0044d860
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 0xb3
push eax
lea eax, [ebp - 0x74]
push eax
push 4
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00481680
add esp, 0x14
mov byte [ebp - 4], 0xb2
lea ecx, [ebp - 0x5c]
call fcn.0044d800
push 0x726798
lea ecx, [ebp - 0xd4]
call fcn.0044d860
lea eax, [ebp - 0xd4]
mov byte [ebp - 4], 0xb4
push eax
lea eax, [ebp - 0x74]
push eax
push 8
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00481680
add esp, 0x14
lea ecx, [ebp - 0xd4]
call fcn.0044d800
lea ecx, [ebp - 0x44]
call fcn.00481040
lea ecx, [ebp - 0x8c]
call fcn.0044d800
lea ecx, [ebp - 0x2c]
call fcn.0044d800
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0xa7
call fcn.00452a10
push str.coreDeleted
lea ecx, [ebp - 0x5c]
call fcn.0044dac0
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 0xb5
push edi
push eax
call fcn.004855e0
add esp, 8
lea ecx, [ebp - 0x5c]
call fcn.0044da70
jmp 0x484133
lea ecx, [ebp - 0x74]
call fcn.0044d800
lea ecx, [ebp - 0xb0]
call fcn.00452a20
jmp 0x484c66
push 0xd
push str.set_cert_hash
push ebx
call fcn.004b40d2
add esp, 0xc
test eax, eax
jne 0x48447d
push 0x68ff4c
lea ecx, [ebp - 0xd4]
call fcn.0044dac0
push ebx
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 0xb8
call fcn.0044dac0
push 0
lea eax, [ebp - 0xd4]
mov byte [ebp - 4], 0xb9
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0047d420
add esp, 0x10
lea ecx, [ebp - 0x5c]
call fcn.0044da70
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0xbc
call fcn.0044da70
lea ecx, [ebp - 0x20]
call fcn.004529f0
cmp eax, 1
ja 0x484206
push str.coreSetHash
lea ecx, [ebp - 0xec]
call fcn.0044dac0
lea eax, [ebp - 0xec]
mov byte [ebp - 4], 0xbd
push 1
push eax
call fcn.004855e0
add esp, 8
lea ecx, [ebp - 0xec]
call fcn.0044da70
lea ecx, [ebp - 0x20]
mov edi, 1
call fcn.00452a10
jmp 0x484c66
lea eax, [ebp - 0x124]
mov byte [ebp - 4], 0xbe
push eax
call fcn.0044d3f0
add esp, 4
mov esi, eax
lea eax, [ebp - 0x104]
mov byte [ebp - 4], 0xbf
push eax
call fcn.004ccab0
add esp, 4
push esi
push eax
lea eax, [ebp - 0xec]
mov byte [ebp - 4], 0xc0
push eax
call fcn.00456820
add esp, 0xc
lea ecx, [ebp - 0x104]
call fcn.0044d800
lea ecx, [ebp - 0x124]
mov byte [ebp - 4], 0xc3
call fcn.0044d800
lea eax, [ebp - 0xb0]
push 0
push eax
call fcn.0045e140
add esp, 8
cmp dword [ebp - 0xac], 0
mov byte [ebp - 4], 0xc4
jne 0x4842a4
push str.Cant_create_certificate_storage.
lea ecx, [ebp - 0x98]
call fcn.0044c070
lea eax, [ebp - 0x94]
mov dword [ebp - 0x98], vtable.std::exception.0
push eax
call fcn.004a18c9
add esp, 4
lea eax, [ebp - 0x38]
push 0
push eax
call fcn.00450e40
add esp, 8
cmp dword [ebp - 0x34], 0
mov byte [ebp - 4], 0xc5
jne 0x4842e5
push str.Cant_create_certificate_config.
lea ecx, [ebp - 0x98]
call fcn.0044c070
lea eax, [ebp - 0x94]
mov dword [ebp - 0x98], vtable.std::exception.0
push eax
call fcn.004a18c9
add esp, 4
mov edi, dword [ebp - 0xac]
sub esp, 0xc
mov esi, esp
mov dword [ebp - 0x90], esi
mov dword [esi], vtable.utils::CRefPtr_struct_cert::ICertificateConfig___struct_cert::ICertificateConfig__struct_utils::IRefObject__.0
mov eax, dword [ebp - 0x34]
mov dword [esi + 4], eax
mov ecx, dword [ebp - 0x30]
mov dword [esi + 8], ecx
test ecx, ecx
je 0x484311
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esi], vtable.utils::CSharedPtr_struct_cert::ICertificateConfig_.0
lea ecx, [ebp - 0xec]
mov eax, dword [edi]
push 0
push ecx
mov ecx, edi
call dword [eax]
mov ecx, dword [ebp - 0xac]
mov edx, dword [ebp - 0x20]
add edx, 0x18
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0x60]
call eax
test al, al
jne 0x484367
push str.Invalid_hash_format.
lea ecx, [ebp - 0x98]
call fcn.0044c070
lea eax, [ebp - 0x94]
mov dword [ebp - 0x98], vtable.std::exception.0
push eax
call fcn.004a18c9
add esp, 4
mov ecx, dword [ebp - 0xac]
mov eax, dword [ebp - 0x20]
add eax, 0x18
push eax
mov edx, dword [ecx]
call dword [edx + 0x30]
lea ecx, [ebp - 0x38]
xor edi, edi
call fcn.00450eb0
mov ecx, dword [ebp - 0xa8]
mov byte [ebp - 4], 0xc6
mov dword [ebp - 0xb0], vtable.utils::CRefPtr_struct_cert::ICertificateStorage___struct_cert::ICertificateStorage__struct_utils::IRefObject__.0
test ecx, ecx
je 0x4843a0
mov eax, dword [ecx]
call dword [eax + 8]
lea ecx, [ebp - 0xec]
call fcn.0044d800
jmp 0x4843fa
push str.coreSetHash
lea ecx, [ebp - 0xec]
mov dword [ebp - 4], 0xbc
call fcn.0044dac0
lea eax, [ebp - 0xec]
mov byte [ebp - 4], 0xca
push edi
push eax
call fcn.004855e0
add esp, 8
lea ecx, [ebp - 0xec]
call fcn.0044da70
lea ecx, [ebp - 0x20]
call fcn.00452a10
jmp 0x484c66
push str.terminate
push ebx
call fcn.004b3fd6
add esp, 8
test eax, eax
jne 0x4845f8
lea ecx, [ebp - 0x130]
mov dword [ebp - 4], 0xcb
call fcn.004863a0
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 0xcc
push eax
lea ecx, [ebp - 0x10c]
call fcn.004cf8a0
push 0
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 0xcd
call fcn.004d0670
mov ecx, dword [ebp - 0xf8]
mov byte [ebp - 4], 0xcc
test ecx, ecx
je 0x484532
mov eax, dword [ebp - 0xf0]
sub eax, ecx
sar eax, 2
lea edx, [eax*4]
mov eax, ecx
cmp edx, 0x1000
jb 0x48450a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x484ed3
push edx
push ecx
call fcn.0048af59
add esp, 8
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0x104]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
je 0x484545
push eax
call esi
mov eax, dword [ebp - 0x10c]
test eax, eax
je 0x484552
push eax
call esi
lea ecx, [ebp - 0x128]
call fcn.0044d800
push str.coreTerminate
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 0xffffffff
xor edi, edi
call fcn.0044dac0
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 0xd1
push edi
push eax
call fcn.004855e0
add esp, 8
lea ecx, [ebp - 0x5c]
call fcn.0044da70
jmp 0x484c66
push 0xa
push str.infinstall
push ebx
call fcn.004b40d2
add esp, 0xc
test eax, eax
jne 0x4847cc
push 0x68ff4c
lea ecx, [ebp - 0xd4]
call fcn.0044dac0
push ebx
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 0xd2
call fcn.0044dac0
push 0
lea eax, [ebp - 0xd4]
mov byte [ebp - 4], 0xd3
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0047d420
add esp, 0x10
lea ecx, [ebp - 0x5c]
call fcn.0044da70
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0xd6
call fcn.0044da70
lea ecx, [ebp - 0x20]
call fcn.004529f0
cmp eax, 1
ja 0x484683
lea ecx, [ebp - 0x20]
call fcn.00452a10
mov eax, 1
jmp 0x484c68
push str.DefaultInstall
lea ecx, [ebp - 0x74]
call fcn.0044d860
mov byte [ebp - 4], 0xd7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.004cb080
add esp, 4
lea ecx, [ebp - 0x74]
test al, al
je 0x4846b1
push str..ntamd64
jmp 0x4846b6
push str..ntx86
call fcn.00452b60
push str._128
lea ecx, [ebp - 0x74]
call fcn.00452b60
mov eax, dword [ebp - 0x20]
add eax, 0x18
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0047d4b0
mov edi, eax
lea eax, [ebp - 0xec]
mov byte [ebp - 4], 0xd8
push eax
call fcn.0044d3f0
mov esi, eax
lea eax, [ebp - 0xd4]
mov byte [ebp - 4], 0xd9
push eax
call fcn.004ccab0
push esi
push eax
lea eax, [ebp - 0x124]
mov byte [ebp - 4], 0xda
push eax
call fcn.00456820
push 0x7260f0
push eax
lea eax, [ebp - 0x104]
mov byte [ebp - 4], 0xdb
push eax
call fcn.0044f680
push edi
push eax
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 0xdc
push eax
call fcn.00456820
add esp, 0x34
lea ecx, [ebp - 0x104]
call fcn.0044d800
lea ecx, [ebp - 0x124]
call fcn.0044d800
lea ecx, [ebp - 0xd4]
call fcn.0044d800
lea ecx, [ebp - 0xec]
call fcn.0044d800
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0xe2
call fcn.0044d800
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x8c]
push eax
call fcn.0046da90
add esp, 0xc
lea eax, [ebp - 0x8c]
cmp dword [ebp - 0x78], 8
cmovae eax, dword [ebp - 0x8c]
push 0
push eax
push 0
push 0
call sub.SETUPAPI.dll_InstallHinfSectionW
lea ecx, [ebp - 0x8c]
xor edi, edi
call fcn.0044d800
lea ecx, [ebp - 0x5c]
call fcn.0044d800
lea ecx, [ebp - 0x74]
call fcn.0044d800
lea ecx, [ebp - 0x20]
call fcn.00452a10
jmp 0x484c66
push 0x15
push str.unloadable_disconnect
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x60], 0xf
mov byte [ebp - 0x74], 0
call fcn.0044eca0
lea eax, [ebp - 0x74]
push eax
push ebx
call fcn.00481890
add esp, 8
lea ecx, [ebp - 0x74]
mov bl, al
call fcn.0044da70
test bl, bl
je 0x484a6b
lea ecx, [ebp - 0x164]
call fcn.00480f90
push 0x68ff4c
lea ecx, [ebp - 0xd4]
mov dword [ebp - 4], 0xe3
call fcn.0044dac0
push dword [ebp - 0x220]
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0xe4
call fcn.0044dac0
push 0
lea eax, [ebp - 0xd4]
mov byte [ebp - 4], 0xe5
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0047d420
add esp, 0x10
lea ecx, [ebp - 0x5c]
call fcn.0044da70
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0xe8
call fcn.0044da70
lea ecx, [ebp - 0x20]
call fcn.004529f0
cmp eax, 2
jae 0x48489a
lea ecx, [ebp - 0x20]
call fcn.00452a10
lea ecx, [ebp - 0x164]
call fcn.00481270
mov eax, 0x57
jmp 0x484c68
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x104]
add eax, 0x18
push eax
call fcn.0044db00
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 0xe9
push ecx
push eax
call fcn.0045c460
add esp, 8
mov byte [ebp - 4], 0xe8
lea ecx, [ebp - 0x104]
call fcn.0044da70
lea ecx, [ebp - 0x36c]
call fcn.00480f60
lea eax, [ebp - 0xd4]
mov byte [ebp - 4], 0xea
push eax
call fcn.0044d510
mov esi, eax
lea eax, [ebp - 0x124]
mov byte [ebp - 4], 0xeb
push eax
call fcn.00481ad0
push eax
lea eax, [ebp - 0x104]
mov byte [ebp - 4], 0xec
push eax
call fcn.0044cf30
push esi
push eax
lea eax, [ebp - 0xec]
mov byte [ebp - 4], 0xed
push eax
call fcn.00456820
add esp, 0x1c
lea ecx, [ebp - 0x104]
call fcn.0044d800
lea ecx, [ebp - 0x124]
call fcn.0044d800
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0xf1
call fcn.0044d800
lea eax, [ebp - 0x5c]
push eax
call fcn.0044d650
mov esi, dword [ebp - 0x220]
lea ecx, [ebp - 0xec]
push ecx
push eax
lea eax, [ebp - 0x36c]
mov byte [ebp - 4], 0xf2
push esi
push eax
call fcn.004db6f0
add esp, 0x14
mov byte [ebp - 4], 0xf1
lea ecx, [ebp - 0x5c]
call fcn.0044d800
cmp esi, 2
jne 0x4849f5
push str.Delete_Old_Unloadable_Driver_Service.
lea ecx, [ebp - 0x5c]
call fcn.0044dac0
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 0xf3
push eax
lea ecx, [ebp - 0x36c]
call fcn.00481db0
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0xf1
call fcn.0044da70
lea eax, [ebp - 0x36c]
push eax
call fcn.004dbc60
add esp, 4
mov edx, str.Failed
test al, al
mov ecx, str.Successful
cmove ecx, edx
push ecx
lea ecx, [ebp - 0x5c]
call fcn.0044dac0
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 0xf4
push eax
lea ecx, [ebp - 0x36c]
call fcn.00481db0
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0xf1
call fcn.0044da70
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x364]
call fcn.0044dbc0
push eax
lea ecx, [ebp - 0x148]
call fcn.00452b90
lea ecx, [ebp - 0x5c]
call fcn.0044d800
lea eax, [ebp - 0x74]
push eax
call fcn.00481c70
lea ecx, [ebp - 0x164]
mov byte [ebp - 4], 0xf5
push ecx
push eax
call fcn.00485420
add esp, 0xc
lea ecx, [ebp - 0x74]
call fcn.0044da70
lea ecx, [ebp - 0xec]
call fcn.0044d800
lea ecx, [ebp - 0x364]
call fcn.0044d300
lea ecx, [ebp - 0x20]
call fcn.00452a10
lea ecx, [ebp - 0x164]
call fcn.00481270
jmp 0x484c66
push 0x16
push str.unloadable_remove_hook
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x60], 0xf
mov byte [ebp - 0x74], 0
call fcn.0044eca0
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x220]
call fcn.00481890
add esp, 8
lea ecx, [ebp - 0x74]
mov bl, al
call fcn.0044da70
test bl, bl
je 0x484c61
lea ecx, [ebp - 0x164]
call fcn.00480f90
mov dword [ebp - 4], 0xf6
lea ecx, [ebp - 0x36c]
mov byte [ebp - 4], 0xf7
call fcn.00480f60
lea eax, [ebp - 0xd4]
mov byte [ebp - 4], 0xf8
push eax
call fcn.0044d510
add esp, 4
mov esi, eax
lea eax, [ebp - 0x124]
mov byte [ebp - 4], 0xf9
push eax
call fcn.00481ad0
add esp, 4
push eax
lea eax, [ebp - 0x104]
mov byte [ebp - 4], 0xfa
push eax
call fcn.0044cf30
add esp, 8
push esi
push eax
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 0xfb
push eax
call fcn.00456820
add esp, 0xc
lea ecx, [ebp - 0x104]
call fcn.0044d800
lea ecx, [ebp - 0x124]
call fcn.0044d800
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0xff
call fcn.0044d800
lea eax, [ebp - 0xec]
push eax
call fcn.0044d650
add esp, 4
lea ecx, [ebp - 0x36c]
mov dword [ebp - 4], 0x100
push ecx
lea ecx, [ebp - 0x5c]
push ecx
push eax
call fcn.004daba0
add esp, 0xc
mov dword [ebp - 4], 0xff
lea ecx, [ebp - 0xec]
call fcn.0044d800
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x364]
call fcn.0044dbc0
push eax
lea ecx, [ebp - 0x148]
call fcn.00452b90
lea ecx, [ebp - 0x74]
call fcn.0044d800
lea ecx, [ebp - 0x5c]
call fcn.0044d800
lea ecx, [ebp - 0x364]
call fcn.0044d300
jmp 0x484c0a
push 0x24
push str.3004A908_13A4_429D_B7C1_17562BEEE750
lea ecx, [ebp - 0x74]
mov dword [ebp - 4], 0xf6
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0xf
mov byte [ebp - 0x74], 0
call fcn.0044eca0
lea eax, [ebp - 0x164]
mov dword [ebp - 4], 0x103
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.00485420
add esp, 8
lea ecx, [ebp - 0x74]
call fcn.0044da70
lea ecx, [ebp - 0x164]
call fcn.00481270
jmp 0x484c66
mov edi, 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0048b49a
mov esp, ebp
pop ebp
ret
call fcn.004aae7a
push str.Cannot_normalize_empty_directory_name_:_invalid_param
lea ecx, [ebp - 0x260]
call fcn.0044c070
push 0x73d15c
lea eax, [ebp - 0x260]
push eax
call fcn.004a18e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.Cant_mark_file_to_delete.
lea ecx, [ebp - 0x104]
mov esi, eax
call fcn.0044dac0
push esi
push eax
lea ecx, [ebp - 0x294]
mov byte [ebp - 4], 0x46
call fcn.00450300
push 0x73d438
lea eax, [ebp - 0x294]
push eax
call fcn.004a18e8
call fcn.004aae7a
push str.failed_to_open_registry_key
lea ecx, [ebp - 0x26c]
call fcn.0044c070
push 0x73d15c
lea eax, [ebp - 0x26c]
push eax
call fcn.004a18e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.Cant_found_the_cache_file.
lea ecx, [ebp - 0x104]
mov esi, eax
call fcn.0044dac0
push esi
push eax
lea ecx, [ebp - 0x2a4]
mov byte [ebp - 4], 0x5a
call fcn.00450300
push 0x73d438
lea eax, [ebp - 0x2a4]
push eax
call fcn.004a18e8
mov byte [ebp - 4], 0x55
test esi, esi
je 0x484d5c
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x484d5c
call fcn.0044e7f0
mov byte [ebp - 4], 0x54
push 1
push 3
lea ecx, [ebp - 0x214]
call fcn.00452f50
lea eax, [ebp - 0x204]
mov byte [ebp - 4], 0x57
push str.Cant_found_reg_key_of_the_cache.
push eax
call fcn.00456150
add esp, 8
lea eax, [ebp - 0x104]
lea ecx, [ebp - 0x214]
push eax
call fcn.00452f30
push 2
push eax
lea ecx, [ebp - 0x2b4]
mov byte [ebp - 4], 0x58
call fcn.00450300
push 0x73d438
lea eax, [ebp - 0x2b4]
push eax
call fcn.004a18e8
lea eax, [ebp - 0x104]
push eax
call fcn.0047d770
add esp, 8
push eax
lea eax, [ebp - 0x124]
mov byte [ebp - 4], 0x72
push str.File
push eax
call fcn.0045f300
add esp, 0xc
push str._doesnt_exists
push eax
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 0x73
push eax
call fcn.00456080
add esp, 0xc
push eax
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 0x74
call fcn.0044c020
push 0x73d15c
lea eax, [ebp - 0x278]
push eax
call fcn.004a18e8
lea eax, [ebp - 0x124]
push eax
call fcn.0047d770
add esp, 8
push eax
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 0x94
push str.File
push eax
call fcn.0045f300
add esp, 0xc
push str._doesnt_exists
push eax
lea eax, [ebp - 0xd4]
mov byte [ebp - 4], 0x95
push eax
call fcn.00456080
add esp, 0xc
push eax
lea ecx, [ebp - 0x284]
mov byte [ebp - 4], 0x96
call fcn.0044c020
push 0x73d15c
lea eax, [ebp - 0x284]
push eax
call fcn.004a18e8
push 1
lea ecx, [ebp - 0x98]
call fcn.004529d0
push eax
lea eax, [ebp - 0x5c]
push str.File
push eax
call fcn.00456640
add esp, 0xc
push str._doesnt_exists
push eax
lea eax, [ebp - 0xd4]
mov byte [ebp - 4], 0xb0
push eax
call fcn.00456080
add esp, 0xc
push eax
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 0xb1
call fcn.0044c020
push 0x73d15c
lea eax, [ebp - 0x254]
push eax
call fcn.004a18e8
call fcn.004aae7a
int3