Function at 0x4a6b40
Capabilities:
Create pipe
Create process on windows
Get common file path
Get program files directory
Get startup folder
Move file
Read file on windows
Write file to startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51296c
mov eax, dword fs:[0]
push eax
mov eax, 0x2d94
call fcn.004e1f60
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x814]
push 0x802
push 0
push eax
mov dword [ebp - 0x2c68], esi
mov dword [ebp - 0x2c88], 0
call fcn.004e46b0
add esp, 0xc
lea eax, [ebp - 0x814]
push 0x400
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
lea ecx, [ebp - 0x814]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a6bb5
sub ecx, edx
sar ecx, 1
cmp word [ebp + ecx*2 - 0x816], 0x5c
je 0x4a6bf3
lea edi, [ebp - 0x814]
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x4a6be0
mov eax, dword [0x518b40]
mov dword [edi], eax
xor eax, eax
mov dword [ebp - 0x2860], 7
mov dword [ebp - 0x2864], 0
mov word [ebp - 0x2874], ax
cmp word [ebp - 0x814], ax
jne 0x4a6c1d
xor ecx, ecx
jmp 0x4a6c35
lea ecx, [ebp - 0x814]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a6c26
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0x2874]
call fcn.004051a0
push 0x52ae4c
lea eax, [ebp - 0x2874]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x297c]
push eax
call fcn.00403cd0
add esp, 0xc
mov eax, dword [ebp - 0x2860]
cmp eax, 8
jb 0x4a6c88
inc eax
lea ecx, [ebp - 0x2874]
push eax
push dword [ebp - 0x2874]
call fcn.004052a0
xor eax, eax
mov dword [ebp - 0x2950], 7
mov dword [ebp - 0x2954], 0
mov word [ebp - 0x2964], ax
mov byte [ebp - 4], 3
mov dword [ebp - 0x2860], 7
mov dword [ebp - 0x2864], eax
mov word [ebp - 0x2874], ax
cmp word [ebp - 0x814], ax
jne 0x4a6ccd
xor ecx, ecx
jmp 0x4a6ce5
lea ecx, [ebp - 0x814]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a6cd6
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0x2874]
call fcn.004051a0
push str.Minidump
lea eax, [ebp - 0x2874]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x28bc]
push eax
call fcn.00403cd0
push 1
push 0
push 0x52afb4
push eax
lea eax, [ebp - 0x29ac]
mov byte [ebp - 4], 5
push eax
call fcn.004a8520
add esp, 0x20
mov eax, dword [ebp - 0x28a8]
cmp eax, 8
jb 0x4a6d4f
inc eax
lea ecx, [ebp - 0x28bc]
push eax
push dword [ebp - 0x28bc]
call fcn.004052a0
xor eax, eax
mov dword [ebp - 0x28a8], 7
mov dword [ebp - 0x28ac], 0
mov word [ebp - 0x28bc], ax
mov eax, dword [ebp - 0x2860]
mov byte [ebp - 4], 8
cmp eax, 8
jb 0x4a6d8e
inc eax
lea ecx, [ebp - 0x2874]
push eax
push dword [ebp - 0x2874]
call fcn.004052a0
xor eax, eax
mov dword [ebp - 0x2860], 7
cmp dword [ebp - 0x299c], eax
mov word [ebp - 0x2874], ax
sete al
mov dword [ebp - 0x2864], 0
test al, al
je 0x4a6dcb
push esi
push str.NO_MINIDUMP_FOUND
call fcn.00419b10
add esp, 8
jmp 0x4a84d9
cmp dword [ebp - 0x2968], 8
lea ecx, [ebp - 0x2c5c]
mov esi, dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
lea eax, [ebp - 0x297c]
cmovae eax, dword [ebp - 0x297c]
push ecx
push eax
call esi
cmp eax, 0xffffffff
je 0x4a6f05
mov ecx, dword [ebp - 0x2c44]
mov edi, dword [sym.imp.KERNEL32.DLL_FindClose]
mov dword [ebp - 0x2c6c], ecx
mov ecx, dword [ebp - 0x2c48]
push eax
mov dword [ebp - 0x2c64], ecx
call edi
cmp dword [ebp - 0x2998], 8
lea ecx, [ebp - 0x2c5c]
lea eax, [ebp - 0x29ac]
cmovae eax, dword [ebp - 0x29ac]
push ecx
push eax
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x4a6f05
mov ecx, dword [ebp - 0x2c48]
sub ecx, dword [ebp - 0x2c64]
mov eax, dword [ebp - 0x2c44]
sbb eax, dword [ebp - 0x2c6c]
cdq
xor eax, edx
xor ecx, edx
sub ecx, edx
sbb eax, edx
test eax, eax
jg 0x4a6f02
jl 0x4a6e79
cmp ecx, 0xb2d05e00
jae 0x4a6f02
push str..cncrypt.dmp
lea eax, [ebp - 0x297c]
push eax
lea eax, [ebp - 0x288c]
push eax
call fcn.00438370
add esp, 0xc
lea ecx, [ebp - 0x2964]
push eax
call fcn.004256c0
lea ecx, [ebp - 0x288c]
call fcn.00495b40
cmp dword [ebp - 0x2950], 8
lea ecx, [ebp - 0x2964]
lea eax, [ebp - 0x297c]
cmovae ecx, dword [ebp - 0x2964]
cmp dword [ebp - 0x2968], 8
push ecx
cmovae eax, dword [ebp - 0x297c]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
test eax, eax
je 0x4a6ef7
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x2964]
push eax
lea ecx, [ebp - 0x29ac]
call fcn.00405080
jmp 0x4a6f02
lea ecx, [ebp - 0x2964]
call fcn.004a9360
push esi
call edi
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2c6c], esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 8
jb 0x4a6f36
mov eax, dword [ecx]
jmp 0x4a6f38
mov eax, ecx
xor edx, edx
push 0xffffffffffffffff
mov word [eax], dx
lea eax, [ebp - 0x297c]
push edx
push eax
call fcn.00405080
sub esp, 0x18
mov byte [ebp - 4], 9
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 8
jb 0x4a6f7b
mov eax, dword [ecx]
jmp 0x4a6f7d
mov eax, ecx
xor edx, edx
push 0xffffffffffffffff
mov word [eax], dx
lea eax, [ebp - 0x2964]
push edx
push eax
call fcn.00405080
lea ecx, [ebp - 0x2a0c]
mov byte [ebp - 4], 8
call fcn.004a65e0
push 0x44
lea eax, [ebp - 0x2cf0]
mov byte [ebp - 4], 0xa
push 0
push eax
call fcn.004e46b0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c98], xmm0
call fcn.0041bf70
test eax, eax
mov edx, str.Debugging_Tools_for_Windows__x86_
mov ecx, str.Debugging_Tools_for_Windows__x64_
cmove ecx, edx
push ecx
call fcn.004a8df0
add esp, 0x10
test eax, eax
jne 0x4a70b2
push eax
push str.ASK_DEBUGGER_INSTALL
call fcn.00419550
add esp, 8
cmp eax, 1
jne 0x4a84ce
mov eax, 0x64
call fcn.004e1f90
mov eax, esp
push 3
push 0x31
push str.http:__www.cncrypt.com_applink.html_version1.20
push eax
call fcn.00405530
mov esi, eax
call fcn.0041bf70
test eax, eax
mov edx, 0x52b0ac
mov ecx, 0x517634
lea eax, [ebp - 0x1818]
cmove ecx, edx
push ecx
push esi
push str.msiexec.exe__qb__i__sdestms_debug_tools_x_s
push eax
call fcn.004054c0
add esp, 0x10
lea eax, [ebp - 0x2c98]
push eax
lea eax, [ebp - 0x2cf0]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1818]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
je 0x4a713a
call fcn.00421850
push 0xffffffffffffffff
push dword [ebp - 0x2c98]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
call fcn.00421690
lea eax, [ebp - 0x2c6c]
push eax
push dword [ebp - 0x2c98]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
test eax, eax
je 0x4a84ce
cmp dword [ebp - 0x2c6c], 0
jne 0x4a84ce
push 0
push str.SYSTEM_CRASH_ANALYSIS_INFO
call fcn.00419550
add esp, 8
cmp eax, 2
je 0x4a84ce
push 0x44
lea eax, [ebp - 0x2cf0]
push 0
push eax
call fcn.004e46b0
add esp, 0xc
mov dword [ebp - 0x2ca4], 1
lea eax, [ebp - 0x2cac]
mov dword [ebp - 0x2cac], 0xc
xorps xmm0, xmm0
mov dword [ebp - 0x2ca8], 0
movups xmmword [ebp - 0x2c98], xmm0
push 0
push eax
lea eax, [ebp - 0x2c7c]
mov dword [ebp - 0x2c7c], 0xffffffff
push eax
lea eax, [ebp - 0x2c70]
mov dword [ebp - 0x2c70], 0xffffffff
push eax
call dword [sym.imp.KERNEL32.DLL_CreatePipe]
test eax, eax
jne 0x4a714d
push dword [ebp - 0x2c68]
call fcn.00417c00
add esp, 4
jmp 0x4a84ce
push 0
push 1
push dword [ebp - 0x2c70]
call dword [sym.imp.KERNEL32.DLL_SetHandleInformation]
mov eax, dword [ebp - 0x2c7c]
lea ecx, [ebp - 0x2c78]
or dword [ebp - 0x2cc4], 0x100
mov dword [ebp - 0x2cb8], 0xffffffff
mov dword [ebp - 0x2cb4], eax
mov dword [ebp - 0x2cf0], 0x44
mov dword [ebp - 0x2cb0], eax
call fcn.004a6510
xor eax, eax
mov dword [ebp - 0x2980], 7
mov dword [ebp - 0x2984], 0
mov word [ebp - 0x2994], ax
mov edi, dword [ebp - 0x2c68]
push eax
push 0x26
lea eax, [ebp - 0x1018]
mov byte [ebp - 4], 0xc
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4a7357
call fcn.0041bf70
test eax, eax
je 0x4a72a0
lea eax, [ebp - 0x1018]
push eax
lea ecx, [ebp - 0x2874]
call fcn.00403e70
push 0
push str.__x86_
lea ecx, [ebp - 0x2874]
mov byte [ebp - 4], 0xd
call fcn.004a94c0
cmp eax, 0xffffffff
je 0x4a7291
push eax
push 0
lea eax, [ebp - 0x288c]
push eax
lea ecx, [ebp - 0x2874]
call fcn.0042b8f0
push eax
lea ecx, [ebp - 0x2874]
call fcn.004256c0
lea ecx, [ebp - 0x288c]
call fcn.00495b40
cmp dword [ebp - 0x2860], 8
lea eax, [ebp - 0x2874]
cmovae eax, dword [ebp - 0x2874]
push eax
call fcn.00414f30
add esp, 4
test eax, eax
je 0x4a7291
cmp dword [ebp - 0x2860], 8
lea ecx, [ebp - 0x2874]
lea edx, [ebp - 0x1018]
cmovae ecx, dword [ebp - 0x2874]
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x4a7280
lea ecx, [ebp - 0x2874]
mov byte [ebp - 4], 0xc
call fcn.00495b40
lea eax, [ebp - 0x1018]
push eax
lea ecx, [ebp - 0x28bc]
call fcn.00403e70
push str.Debugging_Tools_for_Windows__
push eax
lea eax, [ebp - 0x28ec]
mov byte [ebp - 4], 0xe
push eax
call fcn.00403cd0
mov esi, eax
mov byte [ebp - 4], 0xf
call fcn.0041bf70
test eax, eax
mov edx, 0x52b17c
mov ecx, 0x52b174
lea eax, [ebp - 0x28d4]
cmove ecx, edx
push ecx
push esi
push eax
call fcn.00403cd0
push str._kd.exe
push eax
lea eax, [ebp - 0x288c]
mov byte [ebp - 4], 0x10
push eax
call fcn.00403cd0
add esp, 0x24
lea ecx, [ebp - 0x2994]
push eax
call fcn.004256c0
lea ecx, [ebp - 0x288c]
call fcn.00495b40
lea ecx, [ebp - 0x28d4]
call fcn.00495b40
lea ecx, [ebp - 0x28ec]
call fcn.00495b40
lea ecx, [ebp - 0x28bc]
mov byte [ebp - 4], 0xc
call fcn.00495b40
lea eax, [ebp - 0x2994]
push eax
lea ecx, [ebp - 0x2c78]
call fcn.004a95b0
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0x28bc]
call fcn.00403e70
push 1
push 0
lea ecx, [ebp - 0x28ec]
mov byte [ebp - 4], 0x11
push ecx
mov ecx, eax
call fcn.0042b8f0
push 0x52b1c8
push eax
lea eax, [ebp - 0x28d4]
mov byte [ebp - 4], 0x12
push eax
call fcn.00403cd0
push 0
push 1
push 0x52b1c4
push eax
lea eax, [ebp - 0x288c]
mov byte [ebp - 4], 0x13
push eax
call fcn.004a8520
add esp, 0x20
lea ecx, [ebp - 0x2994]
push eax
call fcn.004256c0
lea ecx, [ebp - 0x288c]
call fcn.00495b40
lea ecx, [ebp - 0x28d4]
call fcn.00495b40
lea ecx, [ebp - 0x28ec]
call fcn.00495b40
lea ecx, [ebp - 0x28bc]
mov byte [ebp - 4], 0xc
call fcn.00495b40
push str.Debuggerskd.exe
lea ecx, [ebp - 0x2994]
call fcn.0041ad40
lea eax, [ebp - 0x2994]
push eax
lea ecx, [ebp - 0x2c78]
call fcn.004a95b0
push str.kd.exe
lea ecx, [ebp - 0x288c]
call fcn.00403e70
lea eax, [ebp - 0x288c]
mov byte [ebp - 4], 0x14
push eax
lea ecx, [ebp - 0x2c78]
call fcn.004a9560
lea ecx, [ebp - 0x288c]
mov byte [ebp - 4], 0xc
call fcn.00495b40
lea eax, [ebp - 0x2c78]
xor esi, esi
push eax
lea eax, [ebp - 0x2874]
mov dword [ebp - 0x2c64], esi
push eax
call fcn.004a5ea0
add esp, 8
mov eax, dword [ebp - 0x2874]
lea ecx, [ebp - 0x2874]
mov byte [ebp - 4], 0x15
mov eax, dword [eax + 4]
call eax
test al, al
je 0x4a7663
mov edi, dword [ebp - 0x2860]
xor eax, eax
add edi, 8
cmp byte [ebp - 0x286f], al
sete al
mov byte [ebp - 0x286f], al
test al, al
je 0x4a7635
push edi
lea eax, [ebp - 0x288c]
push 0x518bd8
push eax
call fcn.004560a0
push str.___z__
push eax
lea eax, [ebp - 0x28d4]
mov byte [ebp - 4], 0x16
push eax
call fcn.00403cd0
lea ecx, [ebp - 0x29ac]
mov byte [ebp - 4], 0x17
push ecx
push eax
lea eax, [ebp - 0x28ec]
push eax
call fcn.00460c40
push str.___y_http:__msdl.microsoft.com_download_symbols__c__.bugcheck___analyze__v__q_
push eax
lea eax, [ebp - 0x28bc]
mov byte [ebp - 4], 0x18
push eax
call fcn.00403cd0
add esp, 0x30
cmp dword [eax + 0x14], 8
jb 0x4a7503
mov eax, dword [eax]
lea ecx, [ebp - 0x2c98]
push ecx
lea ecx, [ebp - 0x2cf0]
push ecx
push 0
push 0
push 0x8000000
push 1
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
mov ecx, dword [ebp - 0x28a8]
mov esi, eax
cmp ecx, 8
jb 0x4a7549
inc ecx
push ecx
push dword [ebp - 0x28bc]
lea ecx, [ebp - 0x28bc]
call fcn.004052a0
xor eax, eax
mov dword [ebp - 0x28a8], 7
mov word [ebp - 0x28bc], ax
mov eax, dword [ebp - 0x28d8]
mov dword [ebp - 0x28ac], 0
cmp eax, 8
jb 0x4a7584
inc eax
lea ecx, [ebp - 0x28ec]
push eax
push dword [ebp - 0x28ec]
call fcn.004052a0
xor eax, eax
mov dword [ebp - 0x28d8], 7
mov word [ebp - 0x28ec], ax
mov eax, dword [ebp - 0x28c0]
mov dword [ebp - 0x28dc], 0
cmp eax, 8
jb 0x4a75bf
inc eax
lea ecx, [ebp - 0x28d4]
push eax
push dword [ebp - 0x28d4]
call fcn.004052a0
xor eax, eax
mov dword [ebp - 0x28c0], 7
mov word [ebp - 0x28d4], ax
mov eax, dword [ebp - 0x2878]
mov dword [ebp - 0x28c4], 0
mov byte [ebp - 4], 0x15
cmp eax, 8
jb 0x4a75fe
inc eax
lea ecx, [ebp - 0x288c]
push eax
push dword [ebp - 0x288c]
call fcn.004052a0
test esi, esi
jne 0x4a762a
xor eax, eax
mov byte [ebp - 0x2870], 1
cmp byte [ebp - 0x286f], al
sete al
mov byte [ebp - 0x286f], al
test al, al
jne 0x4a74a2
mov esi, dword [ebp - 0x2c64]
jmp 0x4a7635
mov esi, 1
mov dword [ebp - 0x2c64], esi
mov eax, dword [ebp - 0x2874]
lea ecx, [ebp - 0x2874]
call dword [eax + 8]
mov eax, dword [ebp - 0x2874]
lea ecx, [ebp - 0x2874]
mov eax, dword [eax + 4]
call eax
test al, al
jne 0x4a7480
mov edi, dword [ebp - 0x2c68]
lea ecx, [ebp - 0x286c]
mov byte [ebp - 4], 0xc
call fcn.0040d3a0
push dword [ebp - 0x286c]
call fcn.00475290
add esp, 4
push edi
test esi, esi
jne 0x4a769d
call fcn.00417c00
push edi
push str.DEBUGGER_NOT_FOUND
call fcn.00419a00
add esp, 0xc
jmp 0x4a84a5
call fcn.004d30e0
add esp, 4
call fcn.00421850
push dword [ebp - 0x2c98]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call esi
push dword [ebp - 0x2c94]
call esi
push dword [ebp - 0x2c7c]
call esi
mov dword [ebp - 0x2890], 0xf
mov dword [ebp - 0x2894], 0
mov byte [ebp - 0x28a4], 0
mov esi, dword [sym.imp.KERNEL32.DLL_ReadFile]
lea eax, [ebp - 0x2c64]
push 0
push eax
push 0x1000
lea eax, [ebp - 0x2018]
mov byte [ebp - 4], 0x19
push eax
push dword [ebp - 0x2c70]
call esi
test eax, eax
je 0x4a774f
nop
push dword [ebp - 0x2c64]
lea eax, [ebp - 0x2018]
push eax
push dword [ebp - 0x2894]
lea ecx, [ebp - 0x28a4]
call fcn.00414160
push 0
lea eax, [ebp - 0x2c64]
push eax
push 0x1000
lea eax, [ebp - 0x2018]
push eax
push dword [ebp - 0x2c70]
call esi
test eax, eax
jne 0x4a7710
call fcn.00421690
cmp dword [ebp - 0x2890], 0x10
lea eax, [ebp - 0x28a4]
push 0x51e40c
cmovae eax, dword [ebp - 0x28a4]
push eax
call fcn.0042c460
add esp, 8
mov byte [ebp - 0x2c60], 0x60
neg eax
lea ecx, [ebp - 0x28a4]
sbb eax, eax
inc eax
push 1
mov dword [ebp - 0x2c64], eax
lea eax, [ebp - 0x2c60]
push 0
push eax
call fcn.00472b00
cmp eax, 0xffffffff
je 0x4a7805
mov byte [ebp - 0x2c60], 0x60
nop word [eax + eax]
cmp dword [ebp - 0x2890], 0x10
lea ecx, [ebp - 0x28a4]
push 1
cmovae ecx, dword [ebp - 0x28a4]
add ecx, eax
cmp dword [ebp - 0x2890], 0x10
lea eax, [ebp - 0x28a4]
cmovae eax, dword [ebp - 0x28a4]
sub ecx, eax
push ecx
lea ecx, [ebp - 0x28a4]
call fcn.00413cd0
push 1
push 0
lea eax, [ebp - 0x2c60]
push eax
lea ecx, [ebp - 0x28a4]
call fcn.00472b00
cmp eax, 0xffffffff
jne 0x4a77b0
push 0
push str.Bugcheck_code
lea ecx, [ebp - 0x28a4]
call fcn.004a9480
mov edi, eax
cmp edi, 0xffffffff
je 0x4a78ed
push 8
lea eax, [edi + 0xe]
push eax
lea eax, [ebp - 0x288c]
push eax
lea ecx, [ebp - 0x28a4]
call fcn.00497d10
cmp dword [eax + 0x14], 0x10
jb 0x4a7842
mov eax, dword [eax]
lea ecx, [ebp - 0x2ca0]
push ecx
push str._I64X
push eax
call fcn.004a9640
add esp, 0xc
lea ecx, [ebp - 0x288c]
mov esi, eax
call fcn.0040f9a0
cmp esi, 1
jne 0x4a78ed
push edi
push str.Arguments
lea ecx, [ebp - 0x28a4]
call fcn.004a9480
mov esi, eax
call fcn.0041bf70
neg eax
lea ecx, [ebp - 0x28a4]
sbb eax, eax
and eax, 8
add eax, 9
shl eax, 2
push eax
lea eax, [esi + 0xa]
push eax
lea eax, [ebp - 0x288c]
push eax
call fcn.00497d10
cmp dword [eax + 0x14], 0x10
jb 0x4a78b1
mov eax, dword [eax]
lea ecx, [ebp - 0x2844]
push ecx
lea ecx, [ebp - 0x284c]
push ecx
lea ecx, [ebp - 0x2854]
push ecx
lea ecx, [ebp - 0x285c]
push ecx
push str._I64X__I64X__I64X__I64X
push eax
call fcn.004a9640
add esp, 0x18
lea ecx, [ebp - 0x288c]
mov esi, eax
call fcn.0040f9a0
cmp esi, 4
je 0x4a7901
push 0
push str.ERR_PARAMETER_INCORRECT
call fcn.00419a00
add esp, 8
jmp 0x4a849a
lea ecx, [ebp - 0x294c]
call fcn.004a6370
push 0
push str.IMAGE_NAME:
lea ecx, [ebp - 0x28a4]
mov byte [ebp - 4], 0x1a
call fcn.004a9480
mov esi, eax
cmp esi, 0xffffffff
je 0x4a79c7
push 1
add esi, 0xd
mov byte [ebp - 0x2c60], 0xa
push esi
lea eax, [ebp - 0x2c60]
push eax
lea ecx, [ebp - 0x28a4]
call fcn.00472b00
cmp eax, 0xffffffff
je 0x4a79c7
sub eax, esi
lea ecx, [ebp - 0x28a4]
push eax
push esi
lea eax, [ebp - 0x288c]
push eax
call fcn.00497d10
mov ecx, eax
mov byte [ebp - 4], 0x1b
call fcn.00497ac0
mov edi, eax
test edi, edi
je 0x4a79ac
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a7980
sub ecx, edx
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x4a7998
xor eax, eax
jmp 0x4a79ac
lea eax, [esi + esi]
call fcn.004e1f90
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.00405530
push eax
lea ecx, [ebp - 0x294c]
call fcn.0043f1f0
lea ecx, [ebp - 0x288c]
mov byte [ebp - 4], 0x1a
call fcn.0040f9a0
push 0
push str.STACK_TEXT:
lea ecx, [ebp - 0x28a4]
call fcn.004a9480
mov esi, eax
cmp esi, 0xffffffff
jne 0x4a79f4
push 0
push str.ERR_PARAMETER_INCORRECT
call fcn.00419a00
add esp, 8
jmp 0x4a848f
push esi
push str.FOLLOWUP_IP:
lea ecx, [ebp - 0x28a4]
call fcn.004a9480
cmp eax, 0xffffffff
jne 0x4a7a25
push esi
push str.STACK_COMMAND:
lea ecx, [ebp - 0x28a4]
call fcn.004a9480
cmp eax, 0xffffffff
cmove eax, dword [ebp - 0x2894]
sub eax, esi
lea ecx, [ebp - 0x28a4]
push eax
push esi
lea eax, [ebp - 0x288c]
push eax
call fcn.00497d10
push eax
lea ecx, [ebp - 0x28a4]
call fcn.00495b80
lea ecx, [ebp - 0x288c]
call fcn.0040f9a0
lea ecx, [ebp - 0x2c84]
call fcn.004a6510
push 0
push 0x52b348
lea ecx, [ebp - 0x28a4]
mov byte [ebp - 4], 0x1c
call fcn.004a9480
mov esi, eax
cmp esi, 0xffffffff
je 0x4a7bc5
nop
push esi
push 0x52879c
lea ecx, [ebp - 0x28a4]
call fcn.004a9600
mov edi, eax
cmp edi, 0xffffffff
je 0x4a7bc5
push 1
push esi
lea eax, [ebp - 0x2c60]
mov byte [ebp - 0x2c60], 0xa
push eax
lea ecx, [ebp - 0x28a4]
call fcn.00472b00
mov esi, eax
cmp esi, 0xffffffff
jne 0x4a7ac6
mov esi, dword [ebp - 0x2894]
dec esi
mov eax, esi
lea ecx, [ebp - 0x28a4]
sub eax, edi
dec eax
push eax
lea eax, [edi + 1]
push eax
lea eax, [ebp - 0x2874]
push eax
call fcn.00497d10
push 1
push 0
lea eax, [ebp - 0x2c60]
mov byte [ebp - 4], 0x1d
push eax
lea ecx, [ebp - 0x2874]
mov byte [ebp - 0x2c60], 0x28
call fcn.00472b00
test eax, eax
jne 0x4a7b34
push 0xffffffffffffffff
push 1
lea eax, [ebp - 0x288c]
push eax
lea ecx, [ebp - 0x2874]
call fcn.00497d10
push eax
lea ecx, [ebp - 0x2874]
call fcn.00495b80
lea ecx, [ebp - 0x288c]
call fcn.0040f9a0
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x2c60]
mov byte [ebp - 0x2c60], 0x29
push eax
lea ecx, [ebp - 0x2874]
call fcn.00497c80
mov ecx, dword [ebp - 0x2864]
dec ecx
cmp eax, ecx
jne 0x4a7b88
push ecx
push 0
lea eax, [ebp - 0x288c]
push eax
lea ecx, [ebp - 0x2874]
call fcn.00497d10
push eax
lea ecx, [ebp - 0x2874]
call fcn.00495b80
lea ecx, [ebp - 0x288c]
call fcn.0040f9a0
lea eax, [ebp - 0x2874]
push eax
lea ecx, [ebp - 0x2c84]
call fcn.004a9510
lea ecx, [ebp - 0x2874]
mov byte [ebp - 4], 0x1c
call fcn.0040f9a0
push esi
push 0x52b348
lea ecx, [ebp - 0x28a4]
call fcn.004a9480
mov esi, eax
cmp esi, 0xffffffff
jne 0x4a7a80
cmp dword [ebp - 0x293c], 0
sete al
test al, al
je 0x4a7bda
mov edi, 0x518278
jmp 0x4a7c2c
cmp dword [ebp - 0x2938], 8
lea edi, [ebp - 0x294c]
cmovae edi, dword [ebp - 0x294c]
test edi, edi
je 0x4a7c2c
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a7bf7
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x4a7c15
xor edi, edi
jmp 0x4a7c2c
add esi, esi
mov eax, esi
call fcn.004e1f90
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.00418070
mov edi, eax
call fcn.0041b2c0
mov dword [ebp - 0x2c6c], eax
test eax, eax
jne 0x4a7c3f
xor esi, esi
jmp 0x4a7c7e
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a7c44
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x4a7c62
xor esi, esi
jmp 0x4a7c7e
add esi, esi
mov eax, esi
call fcn.004e1f90
mov eax, esp
push 3
push esi
push dword [ebp - 0x2c6c]
push eax
call fcn.00418070
mov esi, eax
push edi
mov edi, dword [ebp - 0x2c64]
mov eax, 0x52b34c
test edi, edi
mov ecx, 0x5255a0
cmove ecx, eax
push ecx
push dword [ebp - 0x2840]
push dword [ebp - 0x2844]
push dword [ebp - 0x2848]
push dword [ebp - 0x284c]
push dword [ebp - 0x2850]
push dword [ebp - 0x2854]
push dword [ebp - 0x2858]
push dword [ebp - 0x285c]
push dword [ebp - 0x2c9c]
push dword [ebp - 0x2ca0]
call fcn.0041bf70
test eax, eax
mov edx, 0x518280
mov ecx, 0x51827c
cmove ecx, edx
push ecx
call fcn.0041b2b0
push eax
call fcn.0041b2a0
push eax
call fcn.0041b290
push eax
push esi
lea eax, [ebp - 0x283c]
push str.https:__www.cncrypt.com_applink.html_version1.20destsyserr_reportos_sosver_d._d._darch_serr_I64xarg1_I64xarg2_I64xarg3_I64xarg4_I64xflag_sdrv_s
push eax
call fcn.00414d50
add esp, 0x4c
lea ecx, [ebp - 0x2da0]
xor esi, esi
push 1
push 3
call fcn.004a6390
lea eax, [ebp - 0x2c84]
mov byte [ebp - 4], 0x1e
push eax
lea eax, [ebp - 0x2874]
push eax
call fcn.004a5e30
add esp, 8
mov eax, dword [ebp - 0x2874]
lea ecx, [ebp - 0x2874]
mov byte [ebp - 4], 0x1f
mov eax, dword [eax + 4]
call eax
test al, al
je 0x4a7def
mov edi, dword [ebp - 0x2860]
xor eax, eax
add edi, 8
cmp byte [ebp - 0x286f], al
sete al
mov byte [ebp - 0x286f], al
test al, al
je 0x4a7dc1
push esi
lea eax, [ebp - 0x2d90]
push 0x518250
push eax
call fcn.0040e910
add esp, 8
mov ecx, eax
call fcn.0040fc90
push 0x51824c
push eax
call fcn.0040e910
push edi
push eax
call fcn.004a5670
xor eax, eax
mov byte [ebp - 0x2870], 1
add esp, 0x10
inc esi
cmp byte [ebp - 0x286f], al
sete al
mov byte [ebp - 0x286f], al
test al, al
jne 0x4a7d73
mov eax, dword [ebp - 0x2874]
lea ecx, [ebp - 0x2874]
call dword [eax + 8]
mov eax, dword [ebp - 0x2874]
lea ecx, [ebp - 0x2874]
mov eax, dword [eax + 4]
call eax
test al, al
jne 0x4a7d55
mov edi, dword [ebp - 0x2c64]
lea ecx, [ebp - 0x2874]
call fcn.004a66d0
xor eax, eax
mov dword [ebp - 0x28f0], 7
mov dword [ebp - 0x28f4], 0
mov word [ebp - 0x2904], ax
lea ecx, [ebp - 0x29c4]
call fcn.004a6370
cmp dword [ebp - 0x293c], 0
mov byte [ebp - 4], 0x21
sete al
test al, al
jne 0x4a8157
mov eax, 0x18
call fcn.004e1f90
mov eax, esp
push 3
push 0xc
push str.CnCrypt.SYS
push eax
call fcn.00405530
push eax
lea ecx, [ebp - 0x294c]
call fcn.0042b000
push eax
call fcn.004e85f7
add esp, 8
test eax, eax
je 0x4a8157
push str.SYSTEM_CRASH_UPDATE_DRIVER
call fcn.004bb8b0
add esp, 4
lea ecx, [ebp - 0x2934]
push eax
call fcn.00403e70
push 0x5171d0
push eax
lea eax, [ebp - 0x2874]
mov byte [ebp - 4], 0x22
push eax
call fcn.00403cd0
lea ecx, [ebp - 0x294c]
mov byte [ebp - 4], 0x23
push ecx
push eax
lea eax, [ebp - 0x288c]
push eax
call fcn.00460c40
add esp, 0x18
push eax
lea ecx, [ebp - 0x2904]
mov byte [ebp - 4], 0x24
call fcn.004a6aa0
lea ecx, [ebp - 0x288c]
call fcn.00495b40
lea ecx, [ebp - 0x2874]
call fcn.00495b40
lea ecx, [ebp - 0x2934]
call fcn.00495b40
lea ecx, [ebp - 0x28bc]
call fcn.004a6370
lea ecx, [ebp - 0x28ec]
call fcn.004a6370
lea ecx, [ebp - 0x28d4]
call fcn.004a6370
lea eax, [ebp - 0x814]
mov byte [ebp - 4], 0x27
push eax
lea ecx, [ebp - 0x2874]
call fcn.00403e70
push str.System32drivers_
push eax
lea eax, [ebp - 0x288c]
mov byte [ebp - 4], 0x28
push eax
call fcn.00403cd0
lea ecx, [ebp - 0x294c]
mov byte [ebp - 4], 0x29
push ecx
push eax
lea eax, [ebp - 0x2934]
push eax
call fcn.00460c40
lea ecx, [ebp - 0x28d4]
mov byte [ebp - 4], 0x2a
push ecx
lea ecx, [ebp - 0x28ec]
push ecx
lea ecx, [ebp - 0x28bc]
push ecx
lea ecx, [ebp - 0x29c4]
push ecx
push eax
call fcn.004a8840
add esp, 0x2c
lea ecx, [ebp - 0x2934]
mov esi, eax
call fcn.00495b40
lea ecx, [ebp - 0x288c]
call fcn.00495b40
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x2874]
call fcn.00495b40
test esi, esi
je 0x4a8122
lea ecx, [ebp - 0x2874]
call fcn.004a6370
cmp dword [ebp - 0x28ac], 0
mov byte [ebp - 4], 0x2b
sete al
test al, al
jne 0x4a7fdb
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x28bc]
push eax
lea ecx, [ebp - 0x2874]
call fcn.00404ed0
cmp dword [ebp - 0x28dc], 0
sete al
test al, al
jne 0x4a8023
lea eax, [ebp - 0x28ec]
push eax
lea eax, [ebp - 0x2934]
push 0x52b444
push eax
call fcn.004560a0
add esp, 0xc
push eax
lea ecx, [ebp - 0x2874]
mov byte [ebp - 4], 0x2c
call fcn.004a6aa0
lea ecx, [ebp - 0x2934]
mov byte [ebp - 4], 0x2b
call fcn.00495b40
cmp dword [ebp - 0x28c4], 0
sete al
test al, al
jne 0x4a806b
lea eax, [ebp - 0x28d4]
push eax
lea eax, [ebp - 0x2934]
push 0x52b444
push eax
call fcn.004560a0
add esp, 0xc
push eax
lea ecx, [ebp - 0x2874]
mov byte [ebp - 4], 0x2d
call fcn.004a6aa0
lea ecx, [ebp - 0x2934]
mov byte [ebp - 4], 0x2b
call fcn.00495b40
push 0
push 0x52b444
lea ecx, [ebp - 0x2874]
call fcn.004a94c0
test eax, eax
jne 0x4a80ae
push 0xffffffffffffffff
push 3
lea eax, [ebp - 0x2934]
push eax
lea ecx, [ebp - 0x2874]
call fcn.0042b8f0
push eax
lea ecx, [ebp - 0x2874]
call fcn.004256c0
lea ecx, [ebp - 0x2934]
call fcn.00495b40
cmp dword [ebp - 0x2864], 0
sete al
test al, al
jne 0x4a8113
lea eax, [ebp - 0x2874]
push eax
lea eax, [ebp - 0x288c]
push 0x52b44c
push eax
call fcn.004560a0
push 0x51acc4
push eax
lea eax, [ebp - 0x2934]
mov byte [ebp - 4], 0x2e
push eax
call fcn.00403cd0
add esp, 0x18
push eax
lea ecx, [ebp - 0x2904]
mov byte [ebp - 4], 0x2f
call fcn.004a6aa0
lea ecx, [ebp - 0x2934]
call fcn.00495b40
lea ecx, [ebp - 0x288c]
call fcn.00495b40
lea ecx, [ebp - 0x2874]
mov byte [ebp - 4], 0x27
call fcn.00495b40
push 0x5171d0
lea ecx, [ebp - 0x2904]
call fcn.0041ad40
lea ecx, [ebp - 0x28d4]
call fcn.00495b40
lea ecx, [ebp - 0x28ec]
call fcn.00495b40
lea ecx, [ebp - 0x28bc]
mov byte [ebp - 4], 0x21
call fcn.00495b40
test edi, edi
je 0x4a8184
push str.SYSTEM_CRASH_NO_CNCRYPT
call fcn.004bb8b0
add esp, 4
lea ecx, [ebp - 0x2904]
push eax
call fcn.0041ad40
push 0x5171d0
lea ecx, [ebp - 0x2904]
call fcn.0041ad40
cmp dword [ebp - 0x29b4], 0
sete al
test al, al
je 0x4a81af
push 0x518278
lea ecx, [ebp - 0x29dc]
call fcn.004a6310
mov edi, eax
mov byte [ebp - 4], 0x30
mov ecx, 1
jmp 0x4a8212
lea ecx, [ebp - 0x29c4]
call fcn.0042b000
mov edi, eax
test edi, edi
je 0x4a81f8
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a81c5
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x4a81e3
xor eax, eax
jmp 0x4a81f8
add esi, esi
mov eax, esi
call fcn.004e1f90
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.00418070
push eax
lea ecx, [ebp - 0x28bc]
call fcn.004a6310
mov edi, eax
mov dword [ebp - 4], 0x31
mov ecx, 2
lea eax, [ebp - 0x28ec]
mov dword [ebp - 0x2c88], ecx
mov dword [ebp - 0x2c68], ecx
lea ecx, [ebp - 0x2da0]
push eax
call fcn.00414a70
mov esi, eax
lea eax, [ebp - 0x283c]
mov dword [ebp - 4], 0x32
push eax
lea ecx, [ebp - 0x28d4]
call fcn.004a6310
push str.drvver
push eax
lea eax, [ebp - 0x288c]
mov byte [ebp - 4], 0x33
push eax
call fcn.004a5dd0
push edi
push eax
lea eax, [ebp - 0x2934]
mov byte [ebp - 4], 0x34
push eax
call fcn.004a5d60
push esi
push eax
lea eax, [ebp - 0x291c]
mov byte [ebp - 4], 0x35
push eax
call fcn.004a5d60
add esp, 0x24
lea ecx, [ebp - 0x2934]
call fcn.0040f9a0
lea ecx, [ebp - 0x288c]
call fcn.0040f9a0
lea ecx, [ebp - 0x28d4]
call fcn.0040f9a0
lea ecx, [ebp - 0x28ec]
call fcn.0040f9a0
mov eax, dword [ebp - 0x2c68]
test al, 2
je 0x4a82d8
and eax, 0xfffffffd
lea ecx, [ebp - 0x28bc]
mov dword [ebp - 0x2c68], eax
call fcn.0040f9a0
mov eax, dword [ebp - 0x2c68]
mov byte [ebp - 4], 0x3c
test al, 1
je 0x4a82eb
lea ecx, [ebp - 0x29dc]
call fcn.0040f9a0
mov edi, dword [ebp - 0x290c]
xor ecx, ecx
test edi, edi
jle 0x4a833c
mov edx, dword [ebp - 0x2908]
mov esi, dword [ebp - 0x291c]
cmp edx, 0x10
lea eax, [ebp - 0x291c]
cmovae eax, esi
cmp byte [eax + ecx], 0x2b
jne 0x4a8337
cmp edx, 0x10
lea eax, [ebp - 0x291c]
cmovae eax, esi
mov byte [eax + ecx], 0x2e
mov edx, dword [ebp - 0x2908]
mov edi, dword [ebp - 0x290c]
mov esi, dword [ebp - 0x291c]
inc ecx
cmp ecx, edi
jl 0x4a8303
push str.SYSTEM_CRASH_REPORT
call fcn.004bb8b0
add esp, 4
lea ecx, [ebp - 0x2904]
push eax
call fcn.0041ad40
push 0x5171d0
lea ecx, [ebp - 0x2904]
call fcn.0041ad40
cmp dword [ebp - 0x2908], 0x10
lea esi, [ebp - 0x291c]
cmovae esi, dword [ebp - 0x291c]
test esi, esi
jne 0x4a8381
xor eax, eax
jmp 0x4a83b2
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a8386
sub ecx, edx
lea edi, [ecx + 1]
cmp edi, 0x3fffffff
jle 0x4a839e
xor eax, eax
jmp 0x4a83b2
lea eax, [edi + edi]
call fcn.004e1f90
mov eax, esp
push 3
push edi
push esi
push eax
call fcn.00405530
push eax
lea ecx, [ebp - 0x2904]
call fcn.0041ad40
push 0x5171d0
lea ecx, [ebp - 0x2904]
call fcn.0041ad40
push str.ASK_SEND_ERROR_REPORT
call fcn.004bb8b0
add esp, 4
lea ecx, [ebp - 0x2904]
push eax
call fcn.0041ad40
cmp dword [ebp - 0x28f0], 8
lea eax, [ebp - 0x2904]
push 0
cmovae eax, dword [ebp - 0x2904]
push eax
call fcn.004198e0
add esp, 8
cmp eax, 6
jne 0x4a8428
cmp dword [ebp - 0x2908], 0x10
lea eax, [ebp - 0x291c]
cmovae eax, dword [ebp - 0x291c]
push eax
call fcn.00417e20
add esp, 4
lea ecx, [ebp - 0x291c]
call fcn.0040f9a0
lea ecx, [ebp - 0x29c4]
call fcn.00495b40
lea ecx, [ebp - 0x2904]
call fcn.00495b40
lea ecx, [ebp - 0x2d38]
call fcn.0040f9e0
lea eax, [ebp - 0x2d38]
mov byte [ebp - 4], 0x3f
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.004e13b9
add esp, 4
lea ecx, [ebp - 0x2c84]
call fcn.004a9380
push 1
push dword [ebp - 0x2c84]
lea ecx, [ebp - 0x2c84]
call fcn.004a9420
lea ecx, [ebp - 0x294c]
call fcn.00495b40
lea ecx, [ebp - 0x28a4]
call fcn.0040f9a0
lea ecx, [ebp - 0x2994]
call fcn.00495b40
lea ecx, [ebp - 0x2c78]
call fcn.0040d3a0
push 1
push dword [ebp - 0x2c78]
lea ecx, [ebp - 0x2c78]
call fcn.004a9420
lea ecx, [ebp - 0x2a0c]
call fcn.004a6730
lea ecx, [ebp - 0x29ac]
call fcn.00495b40
lea ecx, [ebp - 0x2964]
call fcn.00495b40
lea ecx, [ebp - 0x297c]
call fcn.00495b40
lea esp, [ebp - 0x2dac]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret