Function at 0x456d3c
Capabilities:
Delete file

Disassembly:
push 0xa0
mov eax, 0x5be618
call fcn.00580b7e
and dword [ebp - 4], 0
and dword [ebp - 0x1c], 0
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call fcn.004084d7
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 2
call fcn.00455f7a
mov edi, eax
mov byte [ebp - 0x26], bl
test edi, edi
je 0x456e00
push dword [ebp + 0x10]
lea eax, [ebp - 0x24]
push eax
call fcn.0040852d
mov byte [ebp - 4], 3
lea eax, [ebp - 0x24]
call fcn.0040877f
push 0x6752b0
xor ecx, ecx
lea esi, [ebp - 0x24]
call fcn.00426092
cmp eax, 0xffffffff
jne 0x456db7
push 0x6752d8
xor ecx, ecx
call fcn.00426092
cmp eax, 0xffffffff
je 0x456dbb
mov byte [ebp - 0x26], 0
push 0x6752ec
xor ecx, ecx
lea esi, [ebp - 0x24]
call fcn.00426092
test eax, eax
jne 0x456dd1
mov byte [ebp - 0x26], al
cmp byte [ebp - 0x26], 0
je 0x456dea
lea eax, [ebp - 0x24]
push eax
mov ecx, edi
call fcn.00460f2d
test al, al
je 0x456dea
mov byte [ebp - 0x26], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.0040856e
cmp byte [ebp - 0x26], 0
je 0x458254
push 0
push 0
push 0x6c03d8
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x456e71
push dword [ebp + 0x10]
lea eax, [ebp - 0x24]
push eax
call fcn.0040852d
mov byte [ebp - 4], 4
lea eax, [ebp - 0x24]
call fcn.0040877f
push 0x6752f0
xor ecx, ecx
lea esi, [ebp - 0x24]
call fcn.00426092
cmp eax, 0xffffffff
jne 0x456e61
push 0x675300
xor ecx, ecx
call fcn.00426092
cmp eax, 0xffffffff
jne 0x456e61
push 0x675310
xor ecx, ecx
call fcn.00426092
cmp eax, 0xffffffff
je 0x456e65
mov byte [ebp - 0x26], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.0040856e
cmp byte [ebp - 0x26], 0
je 0x458254
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x24]
add dword [edi + 0x38], eax
mov eax, dword [ebp + 0x28]
adc dword [edi + 0x3c], eax
lea eax, [ebp - 0x3c]
push eax
call fcn.004083c5
mov byte [ebp - 4], 5
mov eax, dword [ebp + 0x10]
call fcn.0046ee00
mov dword [ebp - 0x64], eax
mov byte [ebp - 4], 6
cmp eax, 0xffffffff
je 0x45820d
push eax
mov ebx, dword [0x6d5d08]
call fcn.00472430
test al, al
jne 0x45820d
cmp dword [edi + 0x18], 0x3e8
jne 0x45755d
cmp byte [ebp + 0x30], al
jne 0x457550
push dword [ebp + 0x10]
lea eax, [ebp - 0x20]
push eax
call fcn.0040852d
push 7
pop esi
mov byte [ebp - 4], 7
lea eax, [ebp - 0x20]
call fcn.0040877f
mov byte [ebp - 0x2d], 1
push 0x67531c
lea eax, [ebp - 0x34]
push eax
call fcn.0040852d
mov byte [ebp - 4], 8
mov dword [ebp - 0x1c], 3
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x20]
call fcn.00471760
test al, al
jne 0x456fa5
push 0x675338
lea eax, [ebp - 0x18]
push eax
call fcn.0040852d
mov dword [ebp - 4], 9
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x20]
call fcn.00471760
test al, al
jne 0x456fa5
push 0x675358
lea eax, [ebp - 0x2c]
push eax
call fcn.0040852d
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x1c], 0xf
lea eax, [ebp - 0x2c]
lea edx, [ebp - 0x20]
call fcn.00471760
test al, al
jne 0x456fa5
push 0x675384
lea eax, [ebp - 0x24]
push eax
call fcn.0040852d
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x1c], 0x1f
lea eax, [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00471760
test al, al
jne 0x456fa5
xor bl, bl
jmp 0x456fa7
mov bl, 1
mov dword [ebp - 4], 0xa
test byte [ebp - 0x1c], 0x10
je 0x456fc0
and dword [ebp - 0x1c], 0xffffffef
lea ecx, [ebp - 0x24]
call fcn.0040856e
mov dword [ebp - 4], 9
test byte [ebp - 0x1c], 8
je 0x456fd9
and dword [ebp - 0x1c], 0xfffffff7
lea ecx, [ebp - 0x2c]
call fcn.0040856e
mov dword [ebp - 4], 8
test byte [ebp - 0x1c], 4
je 0x456ff2
and dword [ebp - 0x1c], 0xfffffffb
lea ecx, [ebp - 0x18]
call fcn.0040856e
mov dword [ebp - 4], esi
test byte [ebp - 0x1c], 2
je 0x457007
and dword [ebp - 0x1c], 0xfffffffd
lea ecx, [ebp - 0x34]
call fcn.0040856e
test bl, bl
jne 0x45707f
mov eax, dword [0x6c03b0]
shl eax, 0x14
cdq
mov ebx, eax
mov esi, edx
push ecx
mov eax, esp
mov dword [ebp - 0x50], esp
lea ecx, [ebp - 0x20]
push ecx
push eax
call fcn.004084fe
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 7
call fcn.0041cd13
pop ecx
cmp edx, esi
jl 0x457040
jg 0x45707f
cmp eax, ebx
ja 0x45707f
cmp dword [0x6c03b4], 0
je 0x457083
push 0x6753ac
xor ecx, ecx
lea esi, [ebp - 0x20]
call fcn.00426092
cmp eax, 0xffffffff
jne 0x45707f
push 0x6753bc
xor ecx, ecx
call fcn.00426092
cmp eax, 0xffffffff
jne 0x45707f
push 0x6753cc
xor ecx, ecx
call fcn.00426092
cmp eax, 0xffffffff
je 0x457083
mov byte [ebp - 0x2d], 0
push 0x6753d8
xor ecx, ecx
lea esi, [ebp - 0x20]
call fcn.00426092
or ebx, 0xffffffff
cmp eax, ebx
jne 0x4570d9
push 0x6753e4
xor ecx, ecx
call fcn.00426092
cmp eax, ebx
jne 0x4570d9
push 0x6753f8
xor ecx, ecx
call fcn.00426092
cmp eax, ebx
jne 0x4570d9
push 0x675408
xor ecx, ecx
call fcn.00426092
cmp eax, ebx
jne 0x4570d9
push 0x675418
xor ecx, ecx
call fcn.00426092
cmp eax, ebx
je 0x4570dd
mov byte [ebp - 0x2d], 0
cmp byte [ebp - 0x2d], 0
je 0x457544
push 0x2e
lea esi, [ebp - 0x20]
call fcn.004260df
cmp eax, ebx
je 0x457544
lea ecx, [eax + 1]
lea eax, [ebp - 0x18]
push eax
mov edx, esi
call fcn.004261be
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x18]
call fcn.0040877f
lea eax, [ebp - 0x24]
push eax
call fcn.004084d7
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004084fe
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x2c]
push eax
mov ecx, 0x675424
call fcn.00409ce9
test eax, eax
je 0x45715f
lea eax, [ebp - 0x2c]
push eax
mov ecx, 0x67542c
call fcn.00409ce9
test eax, eax
je 0x45715f
lea eax, [ebp - 0x2c]
call fcn.004260fd
jmp 0x45716d
push 0x675434
lea eax, [ebp - 0x2c]
push eax
call fcn.004085d2
cmp dword [0x6d6528], 1
jne 0x4571e1
push 0x675450
lea eax, [ebp - 0x44]
push eax
call fcn.0040852d
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x40]
push ecx
mov esi, eax
call fcn.004136c3
mov byte [ebp - 4], 0x11
push 0x67543c
lea ecx, [ebp - 0x34]
push ecx
mov ecx, eax
call fcn.0040fc0a
add esp, 0x10
mov byte [ebp - 4], 0x12
lea edi, [ebp - 0x24]
call fcn.00408591
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x34]
call fcn.0040856e
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x40]
call fcn.0040856e
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x44]
call fcn.0040856e
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x24]
cmp dword [eax - 0xc], 0
jne 0x4572b5
xor bl, bl
mov eax, 0x6d6930
mov dword [ebp - 0x48], eax
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x13
xor edi, edi
mov dword [ebp - 0xa0], edi
mov eax, dword [0x6d6978]
sub eax, dword [0x6d6974]
sar eax, 2
cmp edi, eax
jae 0x457239
mov esi, 0x6d6968
call fcn.004138a1
push dword [eax]
lea eax, [ebp - 0x18]
push eax
call fcn.0040860e
test eax, eax
je 0x45723d
inc edi
jmp 0x457205
test bl, bl
je 0x4572a5
push 0x675478
lea eax, [ebp - 0x34]
push eax
call fcn.0040852d
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x40]
push ecx
mov esi, eax
call fcn.004136c3
mov byte [ebp - 4], 0x15
push 0x675464
lea ecx, [ebp - 0x44]
push ecx
mov ecx, eax
call fcn.0040fc0a
add esp, 0x10
mov byte [ebp - 4], 0x16
lea edi, [ebp - 0x24]
call fcn.00408591
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x44]
call fcn.0040856e
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x40]
call fcn.0040856e
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x34]
call fcn.0040856e
mov byte [ebp - 4], 0xf
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67548c
call fcn.00409ce9
test eax, eax
je 0x4573df
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x675494
call fcn.00409ce9
test eax, eax
je 0x4573df
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x67549c
call fcn.00409ce9
test eax, eax
je 0x4573df
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x6754a4
call fcn.00409ce9
test eax, eax
je 0x4573df
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x6754ac
call fcn.00409ce9
test eax, eax
je 0x4573df
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x6754b4
call fcn.00409ce9
test eax, eax
je 0x4573df
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x6754bc
call fcn.00409ce9
test eax, eax
je 0x4573df
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x6754c4
call fcn.00409ce9
test eax, eax
je 0x4573df
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x6754cc
call fcn.00409ce9
test eax, eax
je 0x4573df
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x6754d4
call fcn.00409ce9
test eax, eax
je 0x4573df
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x6754dc
call fcn.00409ce9
test eax, eax
je 0x4573df
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x6754e4
call fcn.00409ce9
test eax, eax
je 0x4573df
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x6754ec
call fcn.00409ce9
test eax, eax
je 0x4573df
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x6754f4
call fcn.00409ce9
test eax, eax
je 0x4573df
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x6754fc
call fcn.00409ce9
test eax, eax
jne 0x45744a
push 0x67551c
lea eax, [ebp - 0x40]
push eax
call fcn.0040852d
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x44]
push ecx
mov esi, eax
call fcn.004136c3
mov byte [ebp - 4], 0x18
push str..DeepScript
lea ecx, [ebp - 0x48]
push ecx
mov ecx, eax
call fcn.0040fc0a
add esp, 0x10
mov byte [ebp - 4], 0x19
lea edi, [ebp - 0x24]
call fcn.00408591
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x48]
call fcn.0040856e
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x44]
call fcn.0040856e
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x40]
call fcn.0040856e
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x24]
cmp dword [eax - 0xc], 0
je 0x457520
mov byte [ebp - 4], 0x1a
mov byte [ebp - 0x35], 0
mov byte [ebp - 0x36], 0
push dword [ebp + 0x10]
lea eax, [ebp - 0x48]
push eax
call fcn.0040852d
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x64]
call fcn.0042f3e4
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x48]
call fcn.0040856e
cmp byte [ebp - 0x35], 0
jne 0x457507
cmp byte [ebp - 0x36], 0
jne 0x457507
push 0x1b7740
push dword [0x6d662c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, 0x6d683c
mov dword [ebp - 0x50], esi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x1c
push 0x6d6838
call fcn.00432174
test al, al
je 0x4574fc
lea eax, [ebp - 0x20]
push eax
call fcn.00432031
test al, al
jne 0x4574fc
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x675530
call fcn.00409ce9
test eax, eax
jne 0x4574f1
push dword [ebp - 0x20]
call fcn.00423f77
pop ecx
test al, al
je 0x4574fc
push dword [ebp - 0x24]
lea eax, [ebp - 0x3c]
call fcn.0041347e
mov byte [ebp - 4], 0x1a
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0xf
jmp 0x457520
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2c]
call fcn.0040856e
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x24]
call fcn.0040856e
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x18]
call fcn.0040856e
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x20]
call fcn.0040856e
cmp dword [edi + 0x18], 0x3e8
je 0x457cc1
mov eax, dword [ebp - 0x3c]
cmp dword [eax - 0xc], 0
jne 0x457cc1
mov byte [ebp - 0x36], 0
mov byte [ebp - 0x7c], 0
xor eax, eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
lea edi, [ebp - 0x94]
mov ebx, dword [ebp - 0x64]
lea esi, [ebp - 0x5c]
call fcn.0046f580
cmp byte [ebp - 0x50], 0
je 0x457cc1
cmp byte [ebp - 0x7c], 0
je 0x457cc1
mov edi, dword [ebp - 0x90]
cmp edi, dword [ebp - 0x80]
jb 0x4575d1
ja 0x4575c9
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x84]
jbe 0x4575d1
mov esi, dword [ebp - 0x94]
jmp 0x4575da
mov esi, dword [ebp - 0x84]
mov edi, dword [ebp - 0x80]
lea eax, [ebp - 0x3c]
push eax
push edi
push esi
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push dword [ebp - 0x54]
call fcn.00485840
test al, al
jne 0x457cc1
xor ebx, ebx
mov byte [ebp - 0x35], bl
push dword [ebp + 0x10]
lea eax, [ebp - 0x34]
push eax
call fcn.0040852d
mov byte [ebp - 4], 0x1e
lea eax, [ebp - 0x35]
push eax
lea eax, [ebp - 0x36]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
push 0xffffffffffffffff
push 0xffffffffffffffff
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x64]
call fcn.0042e135
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x34]
call fcn.0040856e
push edi
push esi
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push dword [ebp - 0x54]
lea ecx, [ebp - 0x3c]
call fcn.004856e0
mov eax, dword [ebp - 0x3c]
cmp dword [eax - 0xc], ebx
jne 0x457cc1
cmp dword [0x6d65d4], ebx
je 0x457cc1
push ebx
push ebx
push 0x6c0404
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 1
jne 0x457cc1
mov esi, dword [ebp + 0xc]
add esi, 0x20
push esi
mov ecx, 0x675538
call fcn.00409ce9
test eax, eax
je 0x45769d
push esi
mov ecx, 0x675544
call fcn.00409ce9
test eax, eax
jne 0x457cc1
cmp byte [ebp + 0x30], 0
jne 0x457cc1
push dword [ebp + 0x10]
lea eax, [ebp - 0x20]
push eax
call fcn.0040852d
mov byte [ebp - 4], 0x1f
lea eax, [ebp - 0x20]
call fcn.0040877f
mov byte [ebp - 0x25], 1
push 0x675550
lea eax, [ebp - 0x18]
push eax
call fcn.0040852d
push 0x20
pop ebx
mov byte [ebp - 4], bl
or dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x20]
call fcn.00471760
test al, al
jne 0x45776f
push 0x67556c
lea eax, [ebp - 0x2c]
push eax
call fcn.0040852d
mov dword [ebp - 4], 0x21
or dword [ebp - 0x1c], 0x40
lea eax, [ebp - 0x2c]
lea edx, [ebp - 0x20]
call fcn.00471760
test al, al
jne 0x45776f
push 0x67558c
lea eax, [ebp - 0x24]
push eax
call fcn.0040852d
mov dword [ebp - 4], 0x22
or dword [ebp - 0x1c], 0x80
lea eax, [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00471760
test al, al
jne 0x45776f
push str.:windows_servicing
lea eax, [ebp - 0x34]
push eax
call fcn.0040852d
mov dword [ebp - 4], 0x23
or dword [ebp - 0x1c], 0x100
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x20]
call fcn.00471760
test al, al
mov byte [ebp - 0x2e], 0
je 0x457773
mov byte [ebp - 0x2e], 1
mov dword [ebp - 4], 0x22
test dword [ebp - 0x1c], 0x100
je 0x457792
and dword [ebp - 0x1c], 0xfffffeff
lea ecx, [ebp - 0x34]
call fcn.0040856e
mov dword [ebp - 4], 0x21
test byte [ebp - 0x1c], 0x80
je 0x4577ae
and dword [ebp - 0x1c], 0xffffff7f
lea ecx, [ebp - 0x24]
call fcn.0040856e
mov dword [ebp - 4], ebx
test byte [ebp - 0x1c], 0x40
je 0x4577c3
and dword [ebp - 0x1c], 0xffffffbf
lea ecx, [ebp - 0x2c]
call fcn.0040856e
mov dword [ebp - 4], 0x1f
test byte [ebp - 0x1c], bl
je 0x4577db
and dword [ebp - 0x1c], 0xffffffdf
lea ecx, [ebp - 0x18]
call fcn.0040856e
cmp byte [ebp - 0x2e], 0
jne 0x457855
mov eax, dword [0x6c03b0]
shl eax, 0x14
cdq
mov edi, eax
mov esi, edx
push ecx
mov eax, esp
mov dword [ebp - 0x50], esp
lea ecx, [ebp - 0x20]
push ecx
push eax
call fcn.004084fe
mov byte [ebp - 4], 0x24
mov byte [ebp - 4], 0x1f
call fcn.0041cd13
pop ecx
cmp edx, esi
jl 0x457816
jg 0x457855
cmp eax, edi
ja 0x457855
cmp dword [0x6c03b4], 0
je 0x457859
push 0x6755e0
xor ecx, ecx
lea esi, [ebp - 0x20]
call fcn.00426092
cmp eax, 0xffffffff
jne 0x457855
push 0x6755f0
xor ecx, ecx
call fcn.00426092
cmp eax, 0xffffffff
jne 0x457855
push 0x675600
xor ecx, ecx
call fcn.00426092
cmp eax, 0xffffffff
je 0x457859
mov byte [ebp - 0x25], 0
push 0x67560c
xor ecx, ecx
lea esi, [ebp - 0x20]
call fcn.00426092
or edi, 0xffffffff
cmp eax, edi
jne 0x4578af
push 0x675618
xor ecx, ecx
call fcn.00426092
cmp eax, edi
jne 0x4578af
push 0x67562c
xor ecx, ecx
call fcn.00426092
cmp eax, edi
jne 0x4578af
push 0x67563c
xor ecx, ecx
call fcn.00426092
cmp eax, edi
jne 0x4578af
push 0x67564c
xor ecx, ecx
call fcn.00426092
cmp eax, edi
je 0x4578b3
mov byte [ebp - 0x25], 0
cmp byte [ebp - 0x25], 0
je 0x457cb5
xor ebx, ebx
cmp dword [0x6c0408], ebx
je 0x4578d7
lea eax, [ebp - 0x20]
push eax
call fcn.00419888
test al, al
je 0x4578d7
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x457cb5
push 0x2e
lea esi, [ebp - 0x20]
call fcn.004260df
cmp eax, edi
je 0x457cb5
lea ecx, [eax + 1]
lea eax, [ebp - 0x18]
push eax
mov edx, esi
call fcn.004261be
mov byte [ebp - 4], 0x25
lea eax, [ebp - 0x18]
call fcn.0040877f
lea eax, [ebp - 0x2c]
push eax
call fcn.004084d7
mov byte [ebp - 4], 0x26
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004084fe
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x675658
call fcn.00409ce9
test eax, eax
je 0x457959
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x675660
call fcn.00409ce9
test eax, eax
je 0x457959
lea eax, [ebp - 0x24]
call fcn.004260fd
jmp 0x457967
push 0x675668
lea eax, [ebp - 0x24]
push eax
call fcn.004085d2
cmp dword [0x6c03a8], ebx
je 0x457ab4
cmp dword [0x6d6528], 1
jne 0x4579e4
push 0x675684
lea eax, [ebp - 0x40]
push eax
call fcn.0040852d
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x44]
push ecx
mov esi, eax
call fcn.004136c3
mov byte [ebp - 4], 0x29
push 0x675670
lea ecx, [ebp - 0x48]
push ecx
mov ecx, eax
call fcn.0040fc0a
add esp, 0x10
mov byte [ebp - 4], 0x2a
lea edi, [ebp - 0x2c]
call fcn.00408591
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x48]
call fcn.0040856e
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x44]
call fcn.0040856e
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x40]
call fcn.0040856e
mov eax, dword [ebp - 0x2c]
cmp dword [eax - 0xc], ebx
jne 0x457ab4
xor bl, bl
mov eax, 0x6d6930
mov dword [ebp - 0x50], eax
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x2b
xor edi, edi
mov dword [ebp - 0xac], edi
mov eax, dword [0x6d6978]
sub eax, dword [0x6d6974]
sar eax, 2
cmp edi, eax
jae 0x457a3b
mov esi, 0x6d6968
call fcn.004138a1
push dword [eax]
lea eax, [ebp - 0x18]
push eax
call fcn.0040860e
test eax, eax
je 0x457a3f
inc edi
jmp 0x457a07
test bl, bl
je 0x457aa7
push str.Malware.
lea eax, [ebp - 0x68]
push eax
call fcn.0040852d
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x70]
push ecx
mov esi, eax
call fcn.004136c3
mov byte [ebp - 4], 0x2d
push str..DeepDive
lea ecx, [ebp - 0x34]
push ecx
mov ecx, eax
call fcn.0040fc0a
add esp, 0x10
mov byte [ebp - 4], 0x2e
lea edi, [ebp - 0x2c]
call fcn.00408591
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x34]
call fcn.0040856e
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x70]
call fcn.0040856e
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x68]
call fcn.0040856e
mov byte [ebp - 4], 0x27
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x6d65d8], 0
je 0x457bf9
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x6756c0
call fcn.00409ce9
test eax, eax
je 0x457beb
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x6756c8
call fcn.00409ce9
test eax, eax
je 0x457beb
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x6756d0
call fcn.00409ce9
test eax, eax
je 0x457beb
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x6756d8
call fcn.00409ce9
test eax, eax
je 0x457beb
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x6756e0
call fcn.00409ce9
test eax, eax
je 0x457beb
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x6756e8
call fcn.00409ce9
test eax, eax
je 0x457beb
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x6756f0
call fcn.00409ce9
test eax, eax
je 0x457beb
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x6756f8
call fcn.00409ce9
test eax, eax
je 0x457beb
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x675700
call fcn.00409ce9
test eax, eax
je 0x457beb
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x675708
call fcn.00409ce9
test eax, eax
je 0x457beb
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x675710
call fcn.00409ce9
test eax, eax
je 0x457beb
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x675718
call fcn.00409ce9
test eax, eax
je 0x457beb
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x675720
call fcn.00409ce9
test eax, eax
je 0x457beb
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x675728
call fcn.00409ce9
test eax, eax
je 0x457beb
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x675730
call fcn.00409ce9
test eax, eax
jne 0x457bf9
push 0x675738
lea eax, [ebp - 0x2c]
push eax
call fcn.004085d2
mov eax, dword [ebp - 0x2c]
cmp dword [eax - 0xc], 0
je 0x457c91
mov byte [ebp - 4], 0x2f
cmp byte [ebp - 0x36], 0
jne 0x457c8a
cmp byte [ebp - 0x35], 0
jne 0x457c8a
push 0x1b7740
push dword [0x6d662c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, 0x6d683c
mov dword [ebp - 0x50], esi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x30
push 0x6d6838
call fcn.00432174
test al, al
je 0x457c7f
lea eax, [ebp - 0x20]
push eax
call fcn.00432031
test al, al
jne 0x457c7f
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x675760
call fcn.00409ce9
test eax, eax
jne 0x457c74
push dword [ebp - 0x20]
call fcn.00423f77
pop ecx
test al, al
je 0x457c7f
push dword [ebp - 0x2c]
lea eax, [ebp - 0x3c]
call fcn.0041347e
mov byte [ebp - 4], 0x2f
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0x27
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x24]
call fcn.0040856e
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x2c]
call fcn.0040856e
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x18]
call fcn.0040856e
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x20]
call fcn.0040856e
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp dword [eax + 0x18], 0x3e8
je 0x457da3
mov eax, dword [ebp - 0x3c]
cmp dword [eax - 0xc], ebx
jne 0x457da3
cmp dword [ebp + 0x28], ebx
jl 0x457da3
jg 0x457cf3
cmp dword [ebp + 0x24], ebx
jbe 0x457da3
cmp dword [ebp + 0x28], 0xffffffff
ja 0x457da3
jb 0x457d09
cmp dword [ebp + 0x24], 0xffffffff
jae 0x457da3
cmp dword [0x6c03a0], ebx
je 0x457da3
mov byte [ebp - 0x5d], 0
lea eax, [ebp - 0x5d]
push eax
push ebx
push dword [ebp + 0x24]
lea eax, [ebp - 0x50]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.0040fb09
mov byte [ebp - 4], 0x32
lea edi, [ebp - 0x3c]
call fcn.00408450
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x50]
call fcn.0040842d
mov eax, dword [ebp - 0x3c]
cmp dword [eax - 0xc], ebx
je 0x457da3
push 0x6d65f8
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push dword [0x6d65f8]
push ecx
mov eax, esp
mov dword [ebp - 0x50], esp
push 0x675768
push eax
call fcn.0040852d
mov byte [ebp - 4], 0x33
mov byte [ebp - 4], 6
call fcn.0042c986
push 0x675780
lea eax, [ebp - 0x50]
push eax
mov esi, edi
call fcn.004135e5
pop ecx
pop ecx
mov byte [ebp - 4], 0x34
call fcn.00408450
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x50]
call fcn.0040842d
mov eax, dword [ebp - 0x3c]
cmp dword [eax - 0xc], ebx
je 0x45820a
push dword [ebp + 0x10]
lea eax, [ebp - 0x24]
push eax
call fcn.0040852d
mov byte [ebp - 4], 0x35
lea eax, [ebp - 0x24]
call fcn.0040877f
mov ebx, dword [ebp + 0xc]
add ebx, 0xc0
mov eax, dword [ebx + 0x18]
and dword [ebp - 0x54], 0
mov dword [ebp - 0x50], eax
mov eax, dword [ebx]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.00413c83
lea edi, [ebp - 0x54]
mov esi, eax
call fcn.0040ad09
test al, al
je 0x4581fe
lea eax, [ebp - 0x24]
push eax
push ebx
lea ebx, [ebp - 0x58]
call fcn.00413ba7
push dword [ebp + 0x10]
lea eax, [ebp - 0x40]
push eax
call fcn.00470110
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 0x36
mov ebx, dword [ebp + 0xc]
lea edi, [ebx + 0xe0]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x44]
push eax
mov esi, edi
call fcn.00413593
mov byte [ebp - 4], 0x37
push 0x675788
lea ecx, [ebp - 0x48]
push ecx
mov esi, eax
call fcn.004135e5
mov byte [ebp - 4], 0x38
push dword [ebp - 0x50]
lea ecx, [ebp - 0x70]
push ecx
mov esi, eax
call fcn.00413593
mov byte [ebp - 4], 0x39
push 0x675784
lea ecx, [ebp - 0x68]
push ecx
mov esi, eax
call fcn.004135e5
add esp, 0x28
mov byte [ebp - 4], 0x3a
call fcn.00408450
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x68]
call fcn.0040842d
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x70]
call fcn.0040842d
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x48]
call fcn.0040842d
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x44]
call fcn.0040842d
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x40]
call fcn.0040842d
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.0041bb62
pop ecx
pop ecx
mov byte [ebp - 4], 0x3b
mov edi, dword [ebp + 8]
call fcn.00408591
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x50]
call fcn.0040856e
push edi
call fcn.00451e86
pop ecx
lea eax, [ebp - 0x9c]
push eax
call fcn.00451aff
mov byte [ebp - 4], 0x3c
mov eax, dword [ebp + 0x2c]
xor ebx, ebx
cmp dword [eax - 0xc], ebx
je 0x457f12
lea eax, [ebp + 0x2c]
jmp 0x457f29
push dword [ebp + 0x10]
lea eax, [ebp - 0x50]
push eax
call fcn.0040852d
mov byte [ebp - 4], 0x3d
or dword [ebp - 0x1c], 0x200
lea edi, [ebp - 0x9c]
call fcn.00408591
mov dword [ebp - 4], 0x3c
test dword [ebp - 0x1c], 0x200
je 0x457f53
and dword [ebp - 0x1c], 0xfffffdff
lea ecx, [ebp - 0x50]
call fcn.0040856e
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x80]
call fcn.00408591
cmp dword [ebp + 0x1c], ebx
je 0x457f7f
lea eax, [ebp - 0x98]
push eax
push dword [ebp + 0x1c]
lea eax, [ebp - 0x9c]
push eax
push dword [ebp + 0xc]
call fcn.004568e5
add esp, 0x10
lea eax, [ebp - 0x9c]
push eax
mov esi, dword [ebp + 0x18]
add esi, 0x1c
call fcn.004664ab
cmp byte [ebp + 0x20], bl
jne 0x457faa
push ebx
push ebx
push 0x6c03cc
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
mov byte [ebp - 0x2c], bl
jne 0x457fae
mov byte [ebp - 0x2c], 1
push ebx
push dword [ebp - 0x2c]
push ecx
mov eax, esp
mov dword [ebp - 0x50], esp
push dword [ebp + 8]
push eax
call fcn.004084fe
mov byte [ebp - 4], 0x3e
push ecx
mov eax, esp
mov dword [ebp - 0x68], esp
lea ecx, [ebp - 0x9c]
push ecx
push eax
call fcn.004084fe
mov byte [ebp - 4], 0x3f
push dword [ebp + 0xc]
mov byte [ebp - 4], 0x3c
mov ebx, dword [ebp + 0x18]
call fcn.0045673b
add esp, 0x14
push 0x6d65ec
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
xor edi, edi
mov dword [ebp - 0xa8], edi
mov eax, dword [ebp - 0x88]
sub eax, dword [ebp - 0x8c]
sar eax, 2
cmp edi, eax
jae 0x458071
push 0x6d65e8
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call esi
push 0x6d65ec
call esi
push 0
push dword [ebp - 0x2c]
push ecx
mov eax, esp
mov dword [ebp - 0x50], esp
push dword [ebp + 8]
push eax
call fcn.004084fe
mov byte [ebp - 4], 0x40
lea esi, [ebp - 0x98]
call fcn.004138a1
push ecx
mov ecx, esp
mov dword [ebp - 0x68], esp
push eax
push ecx
call fcn.004084fe
mov byte [ebp - 4], 0x41
push dword [ebp + 0xc]
mov byte [ebp - 4], 0x3c
mov ebx, dword [ebp + 0x18]
call fcn.0045673b
add esp, 0x14
inc edi
jmp 0x457ffb
push dword [0x6d65ec]
push ecx
mov eax, esp
mov dword [ebp - 0x50], esp
push 0x67578c
push eax
call fcn.0040852d
mov byte [ebp - 4], 0x42
mov byte [ebp - 4], 0x3c
call fcn.0042c986
cmp byte [ebp + 0x20], 0
jne 0x4580b2
push 0
push 0
push 0x6c03cc
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x4581ee
mov ecx, dword [ebp - 0x88]
sub ecx, dword [ebp - 0x8c]
sar ecx, 2
inc ecx
mov eax, dword [ebp + 0xc]
add dword [eax + 0x40], ecx
push 1
mov esi, dword [ebp + 8]
call fcn.004087a8
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x50], esp
push eax
call fcn.00408187
mov byte [ebp - 4], 0x43
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x68], esp
mov edi, dword [ebp + 0x10]
push edi
call fcn.00408187
mov byte [ebp - 4], 0x44
mov byte [ebp - 4], 0x3c
call fcn.0045310a
add esp, 0x3c
mov byte [ebp - 0x2e], 0
push edi
lea eax, [ebp - 0x34]
push eax
call fcn.0040852d
mov byte [ebp - 4], 0x45
push dword [ebp + 8]
lea esi, [ebp - 0x34]
call fcn.00424799
pop ecx
mov bl, al
neg bl
sbb bl, bl
inc bl
mov byte [ebp - 4], 0x3c
mov ecx, esi
call fcn.0040856e
test bl, bl
je 0x4581d8
push 0x6757a4
lea eax, [ebp - 0x34]
push eax
call fcn.0040852d
mov byte [ebp - 4], 0x46
lea eax, [ebp - 0x34]
mov ecx, dword [ebp + 8]
call fcn.004707b0
mov bl, al
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x34]
call fcn.0040856e
test bl, bl
je 0x45818f
lea eax, [ebp - 0x2e]
push eax
push 1
push dword [ebp + 0x24]
lea eax, [ebp - 0x50]
push eax
mov ecx, edi
call fcn.0040fb09
lea ecx, [ebp - 0x50]
call fcn.0040842d
cmp byte [ebp - 0x2e], 0
jne 0x458196
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edi, edi
mov dword [ebp - 0xa4], edi
mov eax, dword [ebp - 0x88]
mov ecx, eax
sub ecx, dword [ebp - 0x8c]
sar ecx, 2
cmp edi, ecx
jae 0x4581de
lea esi, [ebp - 0x98]
call fcn.004138a1
push eax
call fcn.004207c3
pop ecx
test al, al
je 0x4581d5
call fcn.004138a1
push eax
call fcn.0042082e
pop ecx
inc edi
jmp 0x458198
mov eax, dword [ebp - 0x88]
sub eax, dword [ebp - 0x8c]
sar eax, 2
inc eax
mov ecx, dword [ebp + 0x18]
add dword [ecx + 8], eax
mov byte [ebp - 4], 0x35
lea eax, [ebp - 0x9c]
push eax
call fcn.0045827f
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x24]
call fcn.0040856e
mov edi, dword [ebp + 0xc]
cmp byte [ebp + 0x14], 0
je 0x458230
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax - 0xc]
push dword [edi]
test eax, eax
setne al
movzx eax, al
push eax
call fcn.00452245
pop ecx
pop ecx
inc dword [edi + 0x28]
mov byte [ebp - 4], 5
cmp dword [ebp - 0x64], 0xffffffff
je 0x458243
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3c]
call fcn.0040842d
xor ebx, ebx
inc ebx
jmp 0x45825a
mov eax, dword [ebp + 0xc]
inc dword [eax + 0x44]
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x2c]
call fcn.0040856e
mov eax, dword [ebp + 8]
call fcn.00580c23
ret