Function at 0x404650
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47776b
mov eax, dword fs:[0]
push eax
sub esp, 0x484
mov eax, dword [0x49606c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x450], 0
mov edi, 1
mov dword [ebp - 0x448], 0
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x42c], 1
mov dword [ebp - 0x434], 1
mov dword [ebp - 0x430], 0
call fcn.0044eb62
cmp dword [eax], edi
jle 0x404c35
nop dword [eax]
call fcn.0044eb6e
mov ecx, str._delay
mov eax, dword [eax]
mov eax, dword [eax + edi*4]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x404706
test dx, dx
je 0x404702
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x404706
add eax, 4
add ecx, 4
test dx, dx
jne 0x4046e0
xor eax, eax
jmp 0x40470b
sbb eax, eax
or eax, 1
test eax, eax
je 0x404c2a
call fcn.0044eb6e
mov ecx, 0x48a128
mov eax, dword [eax]
mov eax, dword [eax + edi*4]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x404748
test dx, dx
je 0x404744
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x404748
add eax, 4
add ecx, 4
test dx, dx
jne 0x404722
xor eax, eax
jmp 0x40474d
sbb eax, eax
or eax, 1
test eax, eax
je 0x404c1d
call fcn.0044eb6e
mov ecx, 0x48a130
mov eax, dword [eax]
mov eax, dword [eax + edi*4]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40478a
test dx, dx
je 0x404786
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40478a
add eax, 4
add ecx, 4
test dx, dx
jne 0x404764
xor eax, eax
jmp 0x40478f
sbb eax, eax
or eax, 1
test eax, eax
je 0x404c0a
call fcn.0044eb6e
mov ecx, 0x48a138
mov eax, dword [eax]
mov eax, dword [eax + edi*4]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4047cc
test dx, dx
je 0x4047c8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4047cc
add eax, 4
add ecx, 4
test dx, dx
jne 0x4047a6
xor eax, eax
jmp 0x4047d1
sbb eax, eax
or eax, 1
test eax, eax
je 0x404bf7
call fcn.0044eb6e
mov ecx, 0x48a140
mov eax, dword [eax]
mov eax, dword [eax + edi*4]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40480e
test dx, dx
je 0x40480a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40480e
add eax, 4
add ecx, 4
test dx, dx
jne 0x4047e8
xor eax, eax
jmp 0x404813
sbb eax, eax
or eax, 1
test eax, eax
je 0x404be4
call fcn.0044eb6e
mov ecx, 0x48a148
mov eax, dword [eax]
mov eax, dword [eax + edi*4]
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x404856
test dx, dx
je 0x404852
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x404856
add eax, 4
add ecx, 4
test dx, dx
jne 0x404830
xor eax, eax
jmp 0x40485b
sbb eax, eax
or eax, 1
test eax, eax
je 0x404bd1
call fcn.0044eb6e
push 4
push str._ki:
mov eax, dword [eax]
push dword [eax + edi*4]
call fcn.0044ebee
add esp, 0xc
test eax, eax
je 0x404bb3
call fcn.0044eb6e
mov ecx, 0x48a15c
mov eax, dword [eax]
mov eax, dword [eax + edi*4]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4048b9
test dx, dx
je 0x4048b5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4048b9
add eax, 4
add ecx, 4
test dx, dx
jne 0x404893
xor eax, eax
jmp 0x4048be
sbb eax, eax
or eax, 1
test eax, eax
je 0x404ba4
call fcn.0044eb6e
mov ecx, 0x48a164
mov eax, dword [eax]
mov eax, dword [eax + edi*4]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4048fb
test dx, dx
je 0x4048f7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4048fb
add eax, 4
add ecx, 4
test dx, dx
jne 0x4048d5
xor eax, eax
jmp 0x404900
sbb eax, eax
or eax, 1
test eax, eax
je 0x404b95
call fcn.0044eb6e
mov ecx, 0x48a16c
mov eax, dword [eax]
mov eax, dword [eax + edi*4]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40493d
test dx, dx
je 0x404939
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40493d
add eax, 4
add ecx, 4
test dx, dx
jne 0x404917
xor eax, eax
jmp 0x404942
sbb eax, eax
or eax, 1
test eax, eax
je 0x404b86
call fcn.0044eb6e
mov ecx, 0x48a104
mov eax, dword [eax]
mov eax, dword [eax + edi*4]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x404986
test dx, dx
je 0x404982
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x404986
add eax, 4
add ecx, 4
test dx, dx
jne 0x404960
xor eax, eax
jmp 0x40498b
sbb eax, eax
or eax, 1
test eax, eax
je 0x404b77
call fcn.0044eb6e
mov ecx, 0x48a174
mov eax, dword [eax]
mov eax, dword [eax + edi*4]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4049c8
test dx, dx
je 0x4049c4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4049c8
add eax, 4
add ecx, 4
test dx, dx
jne 0x4049a2
xor eax, eax
jmp 0x4049cd
sbb eax, eax
or eax, 1
test eax, eax
je 0x404b5e
call fcn.0044eb6e
mov ecx, 0x48a17c
mov eax, dword [eax]
mov eax, dword [eax + edi*4]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x404a0a
test dx, dx
je 0x404a06
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x404a0a
add eax, 4
add ecx, 4
test dx, dx
jne 0x4049e4
xor eax, eax
jmp 0x404a0f
sbb eax, eax
or eax, 1
test eax, eax
je 0x404b54
call fcn.0044eb6e
mov ecx, 0x48a184
mov eax, dword [eax]
mov eax, dword [eax + edi*4]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x404a4c
test dx, dx
je 0x404a48
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x404a4c
add eax, 4
add ecx, 4
test dx, dx
jne 0x404a26
xor eax, eax
jmp 0x404a51
sbb eax, eax
or eax, 1
test eax, eax
jne 0x404a63
call fcn.0044eb62
mov eax, dword [eax]
sub eax, edi
cmp eax, 3
jge 0x404ad5
call fcn.0044eb6e
mov ecx, 0x48a18c
mov eax, dword [eax]
mov eax, dword [eax + edi*4]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x404a98
test dx, dx
je 0x404a94
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x404a98
add eax, 4
add ecx, 4
test dx, dx
jne 0x404a72
xor eax, eax
jmp 0x404a9d
sbb eax, eax
or eax, 1
test eax, eax
je 0x404b45
call fcn.0044eb6e
push 5
push str._opt:
mov eax, dword [eax]
push dword [eax + edi*4]
call fcn.0044ebee
add esp, 0xc
test eax, eax
je 0x404b2a
inc edi
call fcn.0044eb62
cmp edi, dword [eax]
jl 0x4046d0
jmp 0x404c35
call fcn.0044eb6e
mov eax, dword [eax]
mov esi, dword [eax + edi*4 + 8]
call fcn.0044eb6e
push esi
mov eax, dword [eax]
mov edi, dword [eax + edi*4 + 4]
call fcn.0044e2f6
add esp, 4
test eax, eax
je 0x404b23
push eax
push 0
push 0x100400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x404b23
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
jmp 0x4051b9
call fcn.0044eb6e
mov eax, dword [eax]
mov eax, dword [eax + edi*4]
add eax, 0xa
push eax
call dword [sym.imp.KeyScramblerIE.DLL_KSSetOption]
xor eax, eax
jmp 0x4051b9
push 1
call dword [sym.imp.KeyScramblerIE.DLL_KSUpdate]
xor eax, eax
jmp 0x4051b9
mov dword [ebp - 0x448], 1
mov ebx, str.KSOmniProcEvent64_Logon
mov dword [ebp - 0x430], 1
mov esi, str.KSOmniProcEvent32_Logon
jmp 0x404c3f
mov dword [ebp - 0x434], 0
jmp 0x404c35
mov dword [ebp - 0x440], 1
jmp 0x404c35
mov dword [ebp - 0x448], 1
jmp 0x404c35
mov dword [ebp - 0x450], 1
jmp 0x404c35
call fcn.0044eb6e
mov eax, dword [eax]
mov eax, dword [eax + edi*4]
add eax, 8
push eax
call dword [sym.imp.KeyScramblerIE.DLL_KSSetKeyInfo]
neg eax
sbb eax, eax
inc eax
jmp 0x4051b9
push 0
push 1
push 0
call dword [sym.imp.KeyScramblerIE.DLL_KSPromptForKey]
xor eax, eax
jmp 0x4051b9
push 0
push 0
push 1
call dword [sym.imp.KeyScramblerIE.DLL_KSPromptForKey]
xor eax, eax
jmp 0x4051b9
push 1
push 0
push 0
call dword [sym.imp.KeyScramblerIE.DLL_KSPromptForKey]
xor eax, eax
jmp 0x4051b9
push 0
push 0
push 0
call dword [sym.imp.KeyScramblerIE.DLL_KSPromptForKey]
xor eax, eax
jmp 0x4051b9
call dword [sym.imp.KeyScramblerIE.DLL_KSOptions]
xor eax, eax
jmp 0x4051b9
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, str.KSOmniProcEvent
mov ebx, str.KSOmniProcEvent64
push esi
push 0
push 0x100000
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x43c], 1
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x44c], eax
test eax, eax
jne 0x404d40
cmp dword [ebp - 0x448], 0
mov dword [ebp - 0x43c], 0
jne 0x404d4d
push esi
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
mov dword [ebp - 0x44c], esi
test esi, esi
je 0x404d35
push 0
lea eax, [ebp - 0x428]
mov dword [ebp - 0x428], 0
push eax
push 1
push str.S:_ML__NW___LW_
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x444], 0
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x404d4d
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x424]
push eax
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorSacl]
test eax, eax
je 0x404d27
push dword [ebp - 0x438]
push 0
push 0
push 0
push 0x10
push 6
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
push dword [ebp - 0x428]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x404d4d
mov esi, dword [ebp - 0x424]
jmp 0x40519b
push eax
call edi
mov dword [ebp - 0x44c], 0
cmp dword [ebp - 0x430], 0
mov eax, str.KeyScrambler_Omni_Shutdown_Event_Logon
mov edi, str.KeyScrambler_Omni_Shutdown_Event
cmovne edi, eax
push edi
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
test esi, esi
je 0x404e15
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x404e2d
push 0
lea eax, [ebp - 0x428]
mov dword [ebp - 0x428], 0
push eax
push 1
push str.S:_ML__NW___LW_
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x424], 0
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x404e2d
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x444]
push eax
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorSacl]
test eax, eax
je 0x404e07
push dword [ebp - 0x438]
push 0
push 0
push 0
push 0x10
push 6
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
push dword [ebp - 0x428]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x404e2d
push edi
push 0
push 0x100002
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
test esi, esi
je 0x4051a2
cmp dword [ebp - 0x448], 0
je 0x404e42
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x405195
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push esi
call edi
test eax, eax
jne 0x404e70
cmp dword [ebp - 0x430], eax
jne 0x404e64
push 0x320
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x405195
cmp dword [ebp - 0x43c], 0
je 0x404eb2
cmp dword [ebp - 0x430], 0
jne 0x405195
push 0x124
push str.KeyScrambler___QFX_Software_Corporation
push str.An_instance_of_KeyScrambler_is_already_running.__It_must_be_shut_down_before_you_can_start_KeyScrambler_again._n_nDo_you_want_to_stop_the_currently_running_KeyScrambler_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x405195
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x405195
push 0
push esi
call edi
cmp eax, 0x102
jne 0x405195
xor eax, eax
mov word [ebp - 0x218], ax
cmp dword [ebp - 0x434], eax
je 0x404f17
cmp dword [ebp - 0x430], eax
jne 0x404f17
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x104
jne 0x404f08
cmp word [ebp - 0x12], 0
je 0x404f08
xor eax, eax
mov word [ebp - 0x218], ax
jmp 0x404f1d
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
jmp 0x404f1d
mov dword [ebp - 0x42c], eax
xorps xmm0, xmm0
mov dword [ebp - method.WTL::CMessageLoop.virtual_0], vtable.WTL::CMessageLoop.0
movups xmmword [ebp - 0x488], xmm0
mov dword [ebp - 0x478], 0
mov dword [ebp - 0x474], 0
mov dword [ebp - 4], 0
mov eax, dword [0x499430]
add eax, 0x10
push eax
mov dword [ebp - 0x444], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, dword [0x499494]
push 4
mov dword [ebp - 0x424], eax
mov ecx, dword [edi + 8]
inc ecx
push ecx
push dword [edi]
call fcn.0044eace
add esp, 0xc
test eax, eax
je 0x404fcd
mov dword [edi], eax
mov eax, dword [edi + 8]
push 4
inc eax
push eax
push dword [edi + 4]
call fcn.0044eace
add esp, 0xc
test eax, eax
je 0x404fcd
mov ecx, dword [edi + 8]
mov dword [edi + 4], eax
lea edx, [ecx*4]
mov ecx, dword [edi]
add ecx, edx
je 0x404fbe
mov eax, dword [ebp - 0x424]
mov dword [ecx], eax
mov eax, dword [edi + 4]
add eax, edx
je 0x404fca
lea ecx, [ebp - 0x48c]
mov dword [eax], ecx
inc dword [edi + 8]
push dword [ebp - 0x444]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x42c], 0
je 0x404fe7
call fcn.004040c0
mov edi, dword [ebp - 0x430]
lea eax, [ebp - 0x43c]
push eax
push dword [ebp - 0x450]
mov dword [ebp - 0x43c], 0
push edi
push dword [ebp - 0x434]
call dword [sym.imp.KeyScramblerIE.DLL_KSInit]
test eax, eax
je 0x405151
cmp dword [ebp - 0x42c], 0
je 0x405042
cmp dword [ebp - 0x43c], 0
je 0x405042
push 0x30
call fcn.0042e6a6
sub esp, 8
mov dword [ebp - 0x424], eax
mov ecx, eax
call fcn.004011b0
cmp dword [ebp - 0x440], 0
jne 0x40510b
cmp dword [ebp - 0x434], 0
je 0x40510b
test edi, edi
jne 0x40510b
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x440], edi
push eax
push str.kernel32
push edi
mov dword [ebp - 0x42c], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x4050ba
push str.IsWow64Process
push dword [ebp - 0x42c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x4050ae
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
push dword [ebp - 0x42c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x440], 0
je 0x40510b
push ebx
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
jne 0x40510b
push str.x64KeyScrambler.exe
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 1
push 0
push 0x48a104
lea eax, [ebp - 0x420]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x48c]
call fcn.0040ca70
push esi
mov dword [ebp - 0x454], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call dword [sym.imp.KeyScramblerIE.DLL_KSUninit]
cmp dword [ebp - 0x434], 0
je 0x405151
push 0
push 0
push 0
lea eax, [ebp - 0x424]
mov dword [ebp - 0x424], 8
push eax
push 0x10
call dword [sym.imp.USER32.dll_BroadcastSystemMessageW]
mov eax, dword [ebp - 0x47c]
test eax, eax
je 0x40516e
push eax
call fcn.0044e624
add esp, 4
mov dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0x478], 0
mov dword [ebp - 0x474], 0
test eax, eax
je 0x405195
push eax
call fcn.0044e624
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x4051a2
push esi
call edi
mov eax, dword [ebp - 0x44c]
test eax, eax
je 0x4051b3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x454]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042e658
mov esp, ebp
pop ebp
ret