Function at 0x44e880
Capabilities:
Encode data using xor
Enumerate processes
Execute command
Set console window title

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b1eea
mov eax, dword fs:[0]
push eax
sub esp, 0x280
mov eax, dword [0x634bc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x74], 0xcbeaf6ce
xor ecx, ecx
mov dword [ebp - 0x70], 0xc5a8ebe9
mov dword [ebp - 0x6c], 0xe8e8eae5
mov word [ebp - 0x68], 0xfc
mov byte [ebp - 0x66], 1
nop
mov al, cl
sub al, 0x7e
xor byte [ebp + ecx - 0x74], al
inc ecx
cmp ecx, 0xd
jb 0x44e8d0
lea eax, [ebp - 0x74]
mov byte [ebp - 0x66], 0
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
movaps xmm0, xmmword [0x627540]
xor ecx, ecx
movups xmmword [ebp - 0x74], xmm0
mov byte [ebp - 0x64], 1
mov al, cl
sub al, 0x7e
xor byte [ebp + ecx - 0x74], al
inc ecx
cmp ecx, 0xf
jb 0x44e908
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea edx, [ebp - 0x74]
mov byte [ebp - 0x64], 0
call fcn.00452c00
mov ecx, 0x63b1b8
call fcn.0044c930
mov dword [ebp - 0x68], 0xf7efe1
xor ecx, ecx
mov byte [ebp - 0x64], 1
nop
mov al, cl
sub al, 0x7e
xor byte [ebp + ecx - 0x68], al
inc ecx
cmp ecx, 3
jb 0x44e940
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea eax, [ebp - 0x68]
push eax
mov byte [ebp - 0x64], 0
call edi
xorps xmm0, xmm0
mov dword [ebp - 0xa8], 0
movups xmmword [ebp - 0xb8], xmm0
add esp, 4
mov dword [ebp - 0xa4], 0xf
mov byte [ebp - 0xb8], 0
mov dword [ebp - 4], 0
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0xf
mov byte [ebp - 0xa0], 0
movups xmmword [ebp - 0x104], xmm0
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0xf0], 0xf
mov byte [ebp - 0x104], 0
push 0xfffffffffffffff5
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov dword [ebp - 0x68], 0xf7efe1
mov dword [ebp - 0x78], esi
xor ecx, ecx
mov byte [ebp - 0x64], 1
nop
mov al, cl
sub al, 0x7e
xor byte [ebp + ecx - 0x68], al
inc ecx
cmp ecx, 3
jb 0x44e9f0
lea eax, [ebp - 0x68]
mov byte [ebp - 0x64], 0
push eax
call edi
add esp, 4
mov dword [ebp - 0x74], 0xcbeaf6ce
mov dword [ebp - 0x70], 0xc5a8ebe9
xor ecx, ecx
mov dword [ebp - 0x6c], 0xe8e8eae5
mov word [ebp - 0x68], 0xfc
mov byte [ebp - 0x66], 1
nop dword [eax]
mov al, cl
sub al, 0x7e
xor byte [ebp + ecx - 0x74], al
inc ecx
cmp ecx, 0xd
jb 0x44ea30
lea eax, [ebp - 0x74]
mov byte [ebp - 0x66], 0
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push 2
push esi
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.________________________________d8888888____d8P__.d8888b._n
call fcn.00452c00
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._______________________________d88888888___d8P__d88P__Y88b_n
call fcn.00452c00
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.______________________________d88P888888__d8P__________888_n
call fcn.00452c00
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._____________________________d88P_888888d88K_________.d88P_n
call fcn.00452c00
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.____________________________d88P__8888888888b____.od888P__n
call fcn.00452c00
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.___________________________d88P___888888__Y88b__d88P___n
call fcn.00452c00
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.__________________________d8888888888888___Y88b_888_n
call fcn.00452c00
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._________________________d88P_____888888____Y88b888888888_n
call fcn.00452c00
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.____Made_by_:_n
call fcn.00452c00
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x625d28
call fcn.00452c00
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.____________King_Hunto_________________n
call fcn.00452c00
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x625d28
call fcn.00452c00
push 4
push esi
call edi
movaps xmm0, xmmword [0x6275f0]
xor ecx, ecx
movups xmmword [ebp - 0x244], xmm0
mov dword [ebp - 0x234], 0xb4a9f7
mov byte [ebp - 0x230], 1
nop dword [eax]
mov al, cl
sub al, 0x7e
xor byte [ebp + ecx - 0x244], al
inc ecx
cmp ecx, 0x13
jb 0x44eb40
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea edx, [ebp - 0x244]
mov byte [ebp - 0x230], 0
call fcn.00452c00
push 0xb
push esi
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea edx, [ebp - 0xb8]
call fcn.004531a0
push 4
push esi
call edi
movaps xmm0, xmmword [0x6275d0]
xor ecx, ecx
movups xmmword [ebp - 0x240], xmm0
mov dword [ebp - 0x230], 0x100b3a8
nop
mov al, cl
sub al, 0x7e
xor byte [ebp + ecx - 0x240], al
inc ecx
cmp ecx, 0x12
jb 0x44eba0
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea edx, [ebp - 0x240]
mov byte [ebp - 0x22d], 0
call fcn.00452c00
push 0xb
push esi
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea edx, [ebp - 0xa0]
call fcn.004531a0
sub esp, 0x18
lea eax, [ebp - 0xa0]
mov ecx, esp
mov dword [ebp - 0x7c], esp
push eax
call fcn.00450a40
sub esp, 0x18
mov byte [ebp - 4], 3
lea eax, [ebp - 0xb8]
mov ecx, esp
push eax
call fcn.00450a40
mov ecx, 0x63b1b8
mov byte [ebp - 4], 2
call fcn.0044d1b0
push 0xa
push esi
call edi
movaps xmm0, xmmword [0x627600]
xor ecx, ecx
movups xmmword [ebp - 0x264], xmm0
mov dword [ebp - 0x254], 0xf6fde7b2
mov dword [ebp - 0x250], 0xb7b6b9b7
mov dword [ebp - 0x24c], 0xb2b5b4
mov byte [ebp - 0x248], 1
mov al, cl
sub al, 0x7e
xor byte [ebp + ecx - 0x264], al
inc ecx
cmp ecx, 0x1b
jb 0x44ec50
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea edx, [ebp - 0x264]
mov byte [ebp - 0x248], 0
call fcn.00452c00
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x68], 0xf7efe1
xor ecx, ecx
mov byte [ebp - 0x64], 1
mov al, cl
sub al, 0x7e
xor byte [ebp + ecx - 0x68], al
inc ecx
cmp ecx, 3
jb 0x44ec91
lea eax, [ebp - 0x68]
mov byte [ebp - 0x64], 0
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
mov dword [ebp - 0x74], 0xcbeaf6ce
mov dword [ebp - 0x70], 0xc5a8ebe9
xor ecx, ecx
mov dword [ebp - 0x6c], 0xe8e8eae5
mov word [ebp - 0x68], 0xfc
mov byte [ebp - 0x66], 1
mov al, cl
sub al, 0x7e
xor byte [ebp + ecx - 0x74], al
inc ecx
cmp ecx, 0xd
jb 0x44ecd1
lea eax, [ebp - 0x74]
mov byte [ebp - 0x66], 0
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push 0xa
push esi
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n________________________________________XNXX_XNXX_XNXX_XNXX_XNXX_XNXX_XNXX________
call fcn.00452c00
push 0xe
push esi
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n______________________________________________Username:
call fcn.00452c00
cmp dword [0x63b22c], 0xf
mov edx, 0x63b218
push dword [0x63b228]
cmova edx, dword [0x63b218]
mov ecx, eax
call fcn.00457d90
add esp, 4
push 0xe
push esi
call edi
push 0x63b29c
lea ecx, [ebp - 0x260]
call fcn.00450a40
mov byte [ebp - 4], 4
lea eax, [ebp - 0x260]
cmp dword [ebp - 0x24c], 0xf
push 0xa
cmova eax, dword [ebp - 0x260]
push 0
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
add esp, 0xc
cdq
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 2
mov esi, eax
mov edi, edx
call fcn.00451c80
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x6c], esi
push eax
lea eax, [ebp - 0x28c]
mov dword [ebp - 0x68], edi
push eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
mov eax, dword [ebp - 0x26c]
movups xmm0, xmmword [ebp - 0x28c]
mov dword [ebp - 0xc0], eax
lea eax, [ebp - 0xe0]
push eax
movups xmmword [ebp - 0xe0], xmm0
push str.__m__d__y
movups xmm0, xmmword [ebp - 0x27c]
lea eax, [ebp - 0x60]
push 0x50
push eax
movups xmmword [ebp - 0xd0], xmm0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
xorps xmm0, xmm0
mov dword [ebp - 0x234], 0
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x230], 0
add esp, 0x18
lea edx, [ecx + 1]
movups xmmword [ebp - 0x244], xmm0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44ee07
sub ecx, edx
lea eax, [ebp - 0x60]
push ecx
push eax
lea ecx, [ebp - 0x244]
call fcn.00453710
mov byte [ebp - 4], 5
mov edx, str._n______________________________________________Expired_Date:
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00452c00
cmp dword [ebp - 0x230], 0xf
lea edx, [ebp - 0x244]
push dword [ebp - 0x234]
cmova edx, dword [ebp - 0x244]
mov ecx, eax
call fcn.00457d90
add esp, 4
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x244]
call fcn.00451c80
mov esi, dword [ebp - 0x78]
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push 0xa
push esi
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._n________________________________________XNXX_XNXX_XNXX_XNXX_XNXX_XNXX_XNXX________
call fcn.00452c00
push 0xc
push esi
call edi
movaps xmm0, xmmword [0x6275e0]
xor ecx, ecx
movups xmmword [ebp - 0x268], xmm0
mov word [ebp - 0x248], 0x8c
movaps xmm0, xmmword [0x627550]
movups xmmword [ebp - 0x258], xmm0
mov byte [ebp - 0x246], 1
nop dword [eax + eax]
mov al, cl
sub al, 0x7e
xor byte [ebp + ecx - 0x268], al
inc ecx
cmp ecx, 0x21
jb 0x44eec0
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea edx, [ebp - 0x268]
mov byte [ebp - 0x246], 0
call fcn.00452c00
movaps xmm0, xmmword [0x6275c0]
xor ecx, ecx
movups xmmword [ebp - 0xec], xmm0
mov word [ebp - 0xbc], 0x100
movaps xmm0, xmmword [0x627570]
movups xmmword [ebp - 0xdc], xmm0
movaps xmm0, xmmword [0x627560]
movups xmmword [ebp - 0xcc], xmm0
nop
mov al, cl
sub al, 0x7e
xor byte [ebp + ecx - 0xec], al
inc ecx
cmp ecx, 0x30
jb 0x44ef20
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea edx, [ebp - 0xec]
mov byte [ebp - 0xbb], 0
call fcn.00452c00
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 0x18
mov dword [ebp - 0x80], 0
mov ecx, esp
xorps xmm0, xmm0
movq qword [ebp - 0x88], xmm0
push 6
movups xmmword [ecx], xmm0
push str.443359
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00453710
lea eax, [ebp - 0x88]
mov ecx, 0x63b1b8
push eax
call fcn.0044db30
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x244]
push 7
xorps xmm0, xmm0
mov dword [ebp - 0x234], 0
push str.MAT.exe
movups xmmword [ebp - 0x244], xmm0
mov dword [ebp - 0x230], 0
call fcn.00453710
push 0
mov byte [ebp - 4], 7
push 2
mov dword [ebp - 0x22c], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x44f0c0
lea eax, [ebp - 0x22c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
lea edx, [ebp - 0x208]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x44f007
sub edx, ecx
lea eax, [ebp - 0x208]
cmp dword [ebp - 0x230], 0xf
lea ecx, [ebp - 0x244]
push edx
cmova ecx, dword [ebp - 0x244]
mov edx, dword [ebp - 0x234]
push eax
call fcn.004533a0
add esp, 8
test eax, eax
je 0x44f13d
mov edi, dword [sym.imp.KERNEL32.dll_Process32Next]
lea eax, [ebp - 0x22c]
push eax
push esi
call edi
test eax, eax
je 0x44f0b9
nop word [eax + eax]
lea eax, [ebp - 0x208]
lea edx, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44f070
sub eax, edx
lea ecx, [ebp - 0x244]
cmp dword [ebp - 0x230], 0xf
mov edx, dword [ebp - 0x234]
cmova ecx, dword [ebp - 0x244]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.004533a0
add esp, 8
test eax, eax
je 0x44f13d
lea eax, [ebp - 0x22c]
push eax
push esi
call edi
test eax, eax
jne 0x44f060
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 6
call fcn.00451c80
push str.Process_not_found_n
call fcn.004472c0
push str.juii_bro_ort_berk_ak_te__......_n
call fcn.004472c0
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 0xc
or esi, 0xffffffff
lea ecx, [ebp - 0x88]
call fcn.00451b50
lea ecx, [ebp - 0x104]
call fcn.00451c80
lea ecx, [ebp - 0xa0]
call fcn.00451c80
lea ecx, [ebp - 0xb8]
call fcn.00451c80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ad814
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x244]
mov edi, dword [ebp - 0x224]
call fcn.00451c80
test edi, edi
je 0x44f0cf
movaps xmm0, xmmword [0x6275b0]
xor ecx, ecx
movups xmmword [ebp - 0x260], xmm0
mov dword [ebp - 0x250], 0xbbbabde1
mov dword [ebp - 0x24c], 0xb6b9b8
mov byte [ebp - 0x248], 1
nop
mov al, cl
sub al, 0x7e
xor byte [ebp + ecx - 0x260], al
inc ecx
cmp ecx, 0x17
jb 0x44f190
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea edx, [ebp - 0x260]
mov byte [ebp - 0x248], 0
call fcn.00452c00
push edi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x44f1fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenProcess_failed:_0x_X_n
call fcn.004472c0
push str.bro_nh_oy_berk_hack_jmuy_Run_as_admin_ort_sdap_nh_te__......_n
call fcn.004472c0
push str.PAUSE
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 0x10
lea esi, [edi - 2]
jmp 0x44f0f4
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x44f22a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cant_confirm_target_process_architecture:_0x_X_n
call fcn.004472c0
add esp, 8
jmp 0x44f24a
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x78]
je 0x44f272
push str.Invalid_Process_Architecture._n
call fcn.004472c0
add esp, 4
push edi
call esi
push str.PAUSE
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
mov esi, 0xfffffffd
jmp 0x44f0f4
movaps xmm0, xmmword [0x627590]
xor ecx, ecx
movups xmmword [ebp - 0x244], xmm0
mov dword [ebp - 0x234], 0xbbbabdbc
mov word [ebp - 0x230], 0x100
mov al, cl
sub al, 0x7e
xor byte [ebp + ecx - 0x244], al
inc ecx
cmp ecx, 0x14
jb 0x44f295
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea edx, [ebp - 0x244]
mov byte [ebp - 0x22f], 0
call fcn.00452c00
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.__lg_tv_mi_jkj___n
call fcn.00452c00
mov edx, dword [ebp - 0x88]
mov ecx, edi
call fcn.00446f20
test al, al
jne 0x44f304
push edi
call esi
push str.Error_while_mapping._n
call fcn.004472c0
push str.PAUSE
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 8
mov esi, 0xfffffffc
jmp 0x44f0f4
movaps xmm0, xmmword [0x627580]
xor ecx, ecx
movups xmmword [ebp - 0x240], xmm0
mov word [ebp - 0x230], 0xbc
mov byte [ebp - 0x22e], 1
mov al, cl
sub al, 0x7e
xor byte [ebp + ecx - 0x240], al
inc ecx
cmp ecx, 0x11
jb 0x44f324
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea edx, [ebp - 0x240]
mov byte [ebp - 0x22e], 0
call fcn.00452c00
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call esi
push 0x625f2c
call fcn.004472c0
add esp, 4
xor esi, esi
jmp 0x44f0f4