Function at 0x467a45
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Contain obfuscated stackstrings
Create directory
Create thread
Delete registry key
Get common file path
Get number of processors
Parse pe header
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ce216
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2148
call fcn.00586dc0
mov eax, dword [0x6c56f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x205c], edi
xor esi, esi
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], esi
mov dword [edi + 0xc], esi
mov dword [ebp - 4], esi
lea eax, [edi + 0x24]
push eax
call fcn.0040855f
mov byte [ebp - 4], 1
lea eax, [edi + 0x28]
push eax
call fcn.0040855f
mov byte [ebp - 4], 2
lea ecx, [edi + 0x2c]
call fcn.004010c5
mov byte [ebp - 4], 3
lea ecx, [edi + 0x30]
call fcn.004010c5
mov byte [ebp - 4], 4
lea ecx, [edi + 0x34]
call fcn.004010c5
mov byte [ebp - 4], 5
lea ecx, [edi + 0x38]
call fcn.004010c5
mov byte [ebp - 4], 6
lea ecx, [edi + 0x3c]
call fcn.004010c5
mov byte [ebp - 4], 7
lea ecx, [edi + 0x40]
call fcn.004010c5
mov byte [ebp - 4], 8
lea ecx, [edi + 0x44]
call fcn.004010c5
mov byte [ebp - 4], 9
mov dword [edi + 0x48], esi
mov byte [edi + 0x4c], 0
mov byte [edi + 0x68], 0
or ebx, 0xffffffff
mov dword [edi + 0x6c], ebx
mov dword [edi + 0x70], 0xd
mov dword [edi + 0x74], 0x1e
mov dword [edi + 0x78], esi
mov byte [edi + 0x7c], 0
mov dword [edi + 0x80], 1
mov byte [edi + 0x84], 1
push 0x68e478
lea eax, [edi + 0x88]
push eax
call fcn.004085b5
mov byte [ebp - 4], 0xa
lea esi, [edi + 0x8c]
mov ecx, esi
call fcn.004010c5
mov byte [ebp - 4], 0xb
xor eax, eax
inc eax
mov dword [edi + 0x90], eax
lea ecx, [edi + 0x94]
mov dword [ebp - 0x2048], ecx
push 0
push eax
call fcn.0040e968
pop ecx
pop ecx
mov dword [ebp - 0x2064], eax
mov dword [ebp - 0x203c], eax
mov byte [ebp - 4], 0xc
test eax, eax
je 0x467b9b
mov ecx, dword [ebp - 0x2048]
mov dword [eax], ecx
jmp 0x467b9d
xor eax, eax
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x2048]
mov dword [ecx], eax
mov byte [ebp - 4], 0x11
call fcn.00480f78
mov edx, dword [ebp - 0x2048]
lea ecx, [edx + 0x18]
mov dword [ecx], eax
mov byte [eax + 0x1ad], 1
mov eax, dword [ecx]
mov dword [eax + 4], eax
mov eax, dword [ecx]
mov dword [eax], eax
mov ecx, dword [ecx]
mov dword [ecx + 8], ecx
and dword [edx + 0x1c], 0
mov byte [ebp - 4], 0x13
lea eax, [edi + 0xb4]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 0x14
and dword [edi + 0xcc], 0
lea eax, [edi + 0xd0]
push eax
call fcn.00416edf
mov byte [ebp - 4], 0x15
lea eax, [edi + 0xf0]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 0x16
lea eax, [edi + 0x108]
mov dword [ebp - 0x2048], eax
push 0
push 1
call fcn.0040e968
pop ecx
pop ecx
mov dword [ebp - 0x2064], eax
mov dword [ebp - 0x203c], eax
mov byte [ebp - 4], 0x17
test eax, eax
je 0x467c48
mov ecx, dword [ebp - 0x2048]
mov dword [eax], ecx
jmp 0x467c4a
xor eax, eax
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x2048]
mov dword [ecx], eax
mov byte [ebp - 4], 0x1c
call fcn.004360f0
mov edx, dword [ebp - 0x2048]
lea ecx, [edx + 0x18]
mov dword [ecx], eax
mov byte [eax + 0x15], 1
mov eax, dword [ecx]
mov dword [eax + 4], eax
mov eax, dword [ecx]
mov dword [eax], eax
mov ecx, dword [ecx]
mov dword [ecx + 8], ecx
and dword [edx + 0x1c], 0
mov byte [ebp - 4], 0x1e
lea eax, [edi + 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 0x1f
mov dword [edi + 0x140], 0x64
and dword [edi + 0x144], 0
mov byte [ebp - 4], 0x20
call fcn.0046790d
push 0x467523
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.00411526
call fcn.0044457b
call fcn.00436da5
push 4
call fcn.005812e3
pop ecx
mov dword [ebp - 0x203c], eax
mov byte [ebp - 4], 0x21
test eax, eax
je 0x467cf5
and dword [eax], 0
push eax
push str.S_1_5_80_956008885_3418522649_1831038044_1853292631_2271478464
call sub.ADVAPI32.dll_ConvertStringSidToSidW
mov eax, dword [ebp - 0x203c]
jmp 0x467cf7
xor eax, eax
mov byte [ebp - 4], 0x20
mov dword [0x6dd398], eax
call fcn.00433d44
call fcn.00467555
push ebx
push 0x68e57c
call fcn.004c9e40
mov dword [ebp - 0x203c], eax
mov byte [ebp - 4], 0x22
push ebx
push 0x68e578
call fcn.004c9e40
mov dword [ebp - 0x204c], eax
mov byte [ebp - 4], 0x23
push ebx
push 0x68e574
call fcn.004c9e40
mov dword [ebp - 0x2060], eax
mov byte [ebp - 4], 0x24
push ebx
push 0x68e570
call fcn.004c9e40
mov dword [ebp - 0x2054], eax
mov byte [ebp - 4], 0x25
push ebx
push 0x68e56c
call fcn.004c9e40
mov dword [ebp - 0x2104], eax
mov byte [ebp - 4], 0x26
push ebx
push 0x68e568
call fcn.004c9e40
mov dword [ebp - 0x20fc], eax
mov byte [ebp - 4], 0x27
push ebx
push 0x68e564
call fcn.004c9e40
mov dword [ebp - 0x20f4], eax
mov byte [ebp - 4], 0x28
push ebx
push 0x68e560
call fcn.004c9e40
add esp, 0x40
mov dword [ebp - 0x20ec], eax
mov byte [ebp - 4], 0x29
push ebx
push 0x68e55c
call fcn.004c9e40
mov dword [ebp - 0x20e4], eax
mov byte [ebp - 4], 0x2a
push ebx
push 0x68e558
call fcn.004c9e40
mov dword [ebp - 0x20dc], eax
mov byte [ebp - 4], 0x2b
push ebx
push 0x68e554
call fcn.004c9e40
mov dword [ebp - 0x20d4], eax
mov byte [ebp - 4], 0x2c
push ebx
push 0x68e550
call fcn.004c9e40
mov dword [ebp - 0x20cc], eax
mov byte [ebp - 4], 0x2d
push ebx
push 0x68e54c
call fcn.004c9e40
mov dword [ebp - 0x20c4], eax
mov byte [ebp - 4], 0x2e
push ebx
push 0x68e548
call fcn.004c9e40
mov dword [ebp - 0x20bc], eax
mov byte [ebp - 4], 0x2f
push ebx
push 0x68e544
call fcn.004c9e40
mov dword [ebp - 0x20b4], eax
mov byte [ebp - 4], 0x30
push ebx
push 0x68e540
call fcn.004c9e40
add esp, 0x40
mov dword [ebp - 0x20ac], eax
mov byte [ebp - 4], 0x31
push ebx
push 0x68e53c
call fcn.004c9e40
mov dword [ebp - 0x20a4], eax
mov byte [ebp - 4], 0x32
push ebx
push 0x68e538
call fcn.004c9e40
mov dword [ebp - 0x209c], eax
mov byte [ebp - 4], 0x33
push ebx
push 0x68e534
call fcn.004c9e40
mov dword [ebp - 0x2094], eax
mov byte [ebp - 4], 0x34
push ebx
push 0x68e530
call fcn.004c9e40
mov dword [ebp - 0x208c], eax
mov byte [ebp - 4], 0x35
push ebx
push 0x68e52c
call fcn.004c9e40
mov dword [ebp - 0x2084], eax
mov byte [ebp - 4], 0x36
push ebx
push 0x68e528
call fcn.004c9e40
mov dword [ebp - 0x207c], eax
mov byte [ebp - 4], 0x37
push ebx
push 0x68e524
call fcn.004c9e40
mov dword [ebp - 0x2074], eax
mov byte [ebp - 4], 0x38
push ebx
push 0x68e520
call fcn.004c9e40
add esp, 0x40
mov dword [ebp - 0x206c], eax
mov byte [ebp - 4], 0x39
push ebx
push 0x68e51c
call fcn.004c9e40
mov dword [ebp - 0x20e0], eax
mov byte [ebp - 4], 0x3a
push ebx
push 0x68e518
call fcn.004c9e40
mov dword [ebp - 0x2118], eax
mov byte [ebp - 4], 0x3b
push ebx
push 0x68e514
call fcn.004c9e40
mov dword [ebp - 0x20d8], eax
mov byte [ebp - 4], 0x3c
push ebx
push 0x68e510
call fcn.004c9e40
mov dword [ebp - 0x2150], eax
mov byte [ebp - 4], 0x3d
push ebx
push 0x68e50c
call fcn.004c9e40
mov dword [ebp - 0x20d0], eax
mov byte [ebp - 4], 0x3e
push ebx
push 0x68e508
call fcn.004c9e40
mov dword [ebp - 0x2110], eax
mov byte [ebp - 4], 0x3f
push ebx
push 0x68e504
call fcn.004c9e40
mov dword [ebp - 0x20c8], eax
mov byte [ebp - 4], 0x40
push ebx
push 0x68e500
call fcn.004c9e40
add esp, 0x40
mov dword [ebp - 0x2130], eax
mov byte [ebp - 4], 0x41
push ebx
push 0x68e4fc
call fcn.004c9e40
mov dword [ebp - 0x2068], eax
mov byte [ebp - 4], 0x42
push ebx
push 0x68e4f8
call fcn.004c9e40
mov dword [ebp - 0x2108], eax
mov byte [ebp - 4], 0x43
push ebx
push 0x68e4f4
call fcn.004c9e40
mov dword [ebp - 0x20b8], eax
mov byte [ebp - 4], 0x44
push ebx
push 0x68e4f0
call fcn.004c9e40
mov dword [ebp - 0x2140], eax
mov byte [ebp - 4], 0x45
push ebx
push 0x68e4ec
call fcn.004c9e40
mov dword [ebp - 0x20b0], eax
mov byte [ebp - 4], 0x46
push ebx
push 0x68e4e8
call fcn.004c9e40
mov dword [ebp - 0x2100], eax
mov byte [ebp - 4], 0x47
push ebx
push 0x68e4e4
call fcn.004c9e40
mov dword [ebp - 0x20a8], eax
mov byte [ebp - 4], 0x48
push ebx
push 0x68e4e0
call fcn.004c9e40
add esp, 0x40
mov dword [ebp - 0x2128], eax
mov byte [ebp - 4], 0x49
push ebx
push 0x68e4dc
call fcn.004c9e40
mov dword [ebp - 0x20a0], eax
mov byte [ebp - 4], 0x4a
push ebx
push str.HTML
call fcn.004c9e40
mov dword [ebp - 0x20f8], eax
mov byte [ebp - 4], 0x4b
push ebx
push 0x68e4d0
call fcn.004c9e40
mov dword [ebp - 0x2098], eax
mov byte [ebp - 4], 0x4c
push ebx
push 0x68e4cc
call fcn.004c9e40
mov dword [ebp - 0x2148], eax
mov byte [ebp - 4], 0x4d
push ebx
push 0x68e4c8
call fcn.004c9e40
mov dword [ebp - 0x2090], eax
mov byte [ebp - 4], 0x4e
push ebx
push 0x68e4c4
call fcn.004c9e40
mov dword [ebp - 0x20f0], eax
mov byte [ebp - 4], 0x4f
push ebx
push 0x68e4c0
call fcn.004c9e40
mov dword [ebp - 0x2088], eax
mov byte [ebp - 4], 0x50
push ebx
push 0x68e4bc
call fcn.004c9e40
add esp, 0x40
mov dword [ebp - 0x2120], eax
mov byte [ebp - 4], 0x51
push ebx
push 0x68e4b8
call fcn.004c9e40
mov dword [ebp - 0x2080], eax
mov byte [ebp - 4], 0x52
push ebx
push 0x68e4b4
call fcn.004c9e40
mov dword [ebp - 0x20e8], eax
mov byte [ebp - 4], 0x53
push ebx
push 0x68e4b0
call fcn.004c9e40
mov dword [ebp - 0x2078], eax
mov byte [ebp - 4], 0x54
push ebx
push 0x68e4ac
call fcn.004c9e40
mov dword [ebp - 0x2138], eax
mov byte [ebp - 4], 0x55
push ebx
push 0x68e4a8
call fcn.004c9e40
mov dword [ebp - 0x2070], eax
mov byte [ebp - 4], 0x56
push ebx
push 0x68e4a4
call fcn.004c9e40
mov dword [ebp - 0x2154], eax
mov byte [ebp - 4], 0x57
push ebx
push 0x68e4a0
call fcn.004c9e40
mov dword [ebp - 0x214c], eax
mov byte [ebp - 4], 0x58
push ebx
push 0x68e49c
call fcn.004c9e40
add esp, 0x40
mov dword [ebp - 0x2144], eax
mov byte [ebp - 4], 0x59
push ebx
push 0x68e498
call fcn.004c9e40
mov dword [ebp - 0x213c], eax
mov byte [ebp - 4], 0x5a
push ebx
push 0x68e494
call fcn.004c9e40
mov dword [ebp - 0x2134], eax
mov byte [ebp - 4], 0x5b
push ebx
push 0x68e490
call fcn.004c9e40
mov dword [ebp - 0x212c], eax
mov byte [ebp - 4], 0x5c
push ebx
push 0x68e48c
call fcn.004c9e40
mov dword [ebp - 0x2124], eax
mov byte [ebp - 4], 0x5d
push ebx
push 0x68e488
call fcn.004c9e40
mov dword [ebp - 0x211c], eax
mov byte [ebp - 4], 0x5e
push ebx
push 0x68e484
call fcn.004c9e40
mov dword [ebp - 0x2114], eax
mov byte [ebp - 4], 0x5f
push ebx
push 0x68e480
call fcn.004c9e40
mov dword [ebp - 0x210c], eax
mov byte [ebp - 4], 0x60
push ebx
push 0x68e47c
call fcn.004c9e40
add esp, 0x40
mov dword [ebp - 0x20c0], eax
mov byte [ebp - 4], 0x61
lea eax, [ebp - 0x20c0]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x210c]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x2114]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x211c]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x2124]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x212c]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x2134]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x213c]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x2144]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x214c]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x2154]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x2070]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x2138]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x2078]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x20e8]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x2080]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x2120]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x2088]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x20f0]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x2090]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x2148]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x2098]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x20f8]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x20a0]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x2128]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x20a8]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x2100]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x20b0]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x2140]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x20b8]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x2108]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x2068]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x2130]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x20c8]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x2110]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x20d0]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x2150]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x20d8]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x2118]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x20e0]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x206c]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x2074]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x207c]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x2084]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x208c]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x2094]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x209c]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x20a4]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x20ac]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x20b4]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x20bc]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x20c4]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x20cc]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x20d4]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x20dc]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x20e4]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x20ec]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x20f4]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x20fc]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x2104]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x2054]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x2060]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x204c]
push eax
mov ecx, esi
call fcn.00401d92
lea eax, [ebp - 0x203c]
push eax
mov ecx, esi
call fcn.00401d92
mov byte [ebp - 4], 0x60
lea ecx, [ebp - 0x20c0]
call fcn.004010b1
mov byte [ebp - 4], 0x5f
lea ecx, [ebp - 0x210c]
call fcn.004010b1
mov byte [ebp - 4], 0x5e
lea ecx, [ebp - 0x2114]
call fcn.004010b1
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x211c]
call fcn.004010b1
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0x2124]
call fcn.004010b1
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0x212c]
call fcn.004010b1
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x2134]
call fcn.004010b1
mov byte [ebp - 4], 0x59
lea ecx, [ebp - 0x213c]
call fcn.004010b1
mov byte [ebp - 4], 0x58
lea ecx, [ebp - 0x2144]
call fcn.004010b1
mov byte [ebp - 4], 0x57
lea ecx, [ebp - 0x214c]
call fcn.004010b1
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0x2154]
call fcn.004010b1
mov byte [ebp - 4], 0x55
lea ecx, [ebp - 0x2070]
call fcn.004010b1
mov byte [ebp - 4], 0x54
lea ecx, [ebp - 0x2138]
call fcn.004010b1
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0x2078]
call fcn.004010b1
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0x20e8]
call fcn.004010b1
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x2080]
call fcn.004010b1
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0x2120]
call fcn.004010b1
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x2088]
call fcn.004010b1
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0x20f0]
call fcn.004010b1
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x2090]
call fcn.004010b1
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0x2148]
call fcn.004010b1
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x2098]
call fcn.004010b1
mov byte [ebp - 4], 0x4a
lea ecx, [ebp - 0x20f8]
call fcn.004010b1
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x20a0]
call fcn.004010b1
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x2128]
call fcn.004010b1
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x20a8]
call fcn.004010b1
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0x2100]
call fcn.004010b1
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x20b0]
call fcn.004010b1
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x2140]
call fcn.004010b1
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x20b8]
call fcn.004010b1
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x2108]
call fcn.004010b1
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x2068]
call fcn.004010b1
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x2130]
call fcn.004010b1
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x20c8]
call fcn.004010b1
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x2110]
call fcn.004010b1
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x20d0]
call fcn.004010b1
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x2150]
call fcn.004010b1
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x20d8]
call fcn.004010b1
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x2118]
call fcn.004010b1
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x20e0]
call fcn.004010b1
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x206c]
call fcn.004010b1
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x2074]
call fcn.004010b1
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x207c]
call fcn.004010b1
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x2084]
call fcn.004010b1
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x208c]
call fcn.004010b1
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x2094]
call fcn.004010b1
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x209c]
call fcn.004010b1
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x20a4]
call fcn.004010b1
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x20ac]
call fcn.004010b1
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x20b4]
call fcn.004010b1
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x20bc]
call fcn.004010b1
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x20c4]
call fcn.004010b1
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x20cc]
call fcn.004010b1
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x20d4]
call fcn.004010b1
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x20dc]
call fcn.004010b1
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x20e4]
call fcn.004010b1
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x20ec]
call fcn.004010b1
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x20f4]
call fcn.004010b1
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x20fc]
call fcn.004010b1
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x2104]
call fcn.004010b1
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x2054]
call fcn.004010b1
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x2060]
call fcn.004010b1
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x204c]
call fcn.004010b1
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x203c]
call fcn.004010b1
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
mov esi, 0x68e580
push esi
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x62
mov byte [ebp - 4], 0x20
call fcn.004326bd
test eax, eax
jne 0x4689ef
push eax
call fcn.00583034
pop ecx
push eax
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push esi
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x63
mov byte [ebp - 4], 0x20
call fcn.00432745
xor esi, esi
inc esi
cmp dword [0x6c438c], esi
jl 0x468a0d
push 0x68e5a0
push str.CIkAV::CIkAV
push esi
call fcn.00540a02
add esp, 0xc
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.RealTimeFound
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x64
mov byte [ebp - 4], 0x20
call fcn.004326bd
mov dword [0x6ddc88], eax
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.RealTimeScanned
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x65
mov byte [ebp - 4], 0x20
call fcn.004326bd
mov dword [0x6ddc84], eax
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.ManualFound
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x66
mov byte [ebp - 4], 0x20
call fcn.004326bd
mov dword [0x6ddc80], eax
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.ManualScanned
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x67
mov byte [ebp - 4], 0x20
call fcn.004326bd
mov dword [0x6ddc7c], eax
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.CloudFound
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x68
mov byte [ebp - 4], 0x20
call fcn.004326bd
mov dword [0x6ddc8c], eax
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.RealtimeKeygen
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x69
mov byte [ebp - 4], 0x20
call fcn.004326bd
mov dword [0x6c79f8], eax
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.ScanKeygen
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x6a
mov byte [ebp - 4], 0x20
call fcn.004326bd
mov dword [0x6c79fc], eax
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.Beh1
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x6b
mov byte [ebp - 4], 0x20
call fcn.004326bd
mov dword [0x6c7a00], eax
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.Beh21
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x6c
mov byte [ebp - 4], 0x20
call fcn.004326bd
mov dword [0x6c7a04], eax
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.BehR1
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x6d
mov byte [ebp - 4], 0x20
call fcn.004326bd
mov dword [0x6dd394], eax
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.BehR21
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x6e
mov byte [ebp - 4], 0x20
call fcn.004326bd
mov dword [0x6c79c0], eax
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.EnableSSL
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x6f
mov byte [ebp - 4], 0x20
call fcn.004326bd
mov dword [0x6c7a08], eax
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.AVCategories
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x70
mov byte [ebp - 4], 0x20
call fcn.004326bd
mov dword [0x6c7a68], eax
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.ShowBandwidth90p
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x71
mov byte [ebp - 4], 0x20
call fcn.004326bd
mov dword [0x6c79e8], eax
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.ShowBandwidth100p
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x72
mov byte [ebp - 4], 0x20
call fcn.004326bd
mov dword [0x6c79ec], eax
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.SuperUSB
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x73
mov byte [ebp - 4], 0x20
call fcn.004326bd
mov dword [0x6c7a0c], eax
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.ExeUSB2
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x74
mov byte [ebp - 4], 0x20
call fcn.004326bd
mov dword [0x6ddc98], eax
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.AllowUSBSigned
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x75
mov byte [ebp - 4], 0x20
call fcn.004326bd
mov dword [0x6c79c8], eax
push 0x20
call fcn.005812e3
pop ecx
mov dword [ebp - 0x203c], eax
mov byte [ebp - 4], 0x76
test eax, eax
je 0x468cf1
push eax
call fcn.00410c73
jmp 0x468cf3
xor eax, eax
mov byte [ebp - 4], 0x20
mov dword [0x6ddcc0], eax
push str._restorem.db
push ecx
mov eax, esp
mov dword [ebp - 0x2060], esp
push eax
call fcn.00487d50
pop ecx
mov byte [ebp - 4], 0x77
lea eax, [ebp - 0x204c]
push eax
mov byte [ebp - 4], 0x20
call fcn.00404062
pop ecx
pop ecx
mov byte [ebp - 4], 0x78
lea ecx, [ebp - 0x203c]
push ecx
mov esi, eax
call fcn.0041683c
pop ecx
pop ecx
mov byte [ebp - 4], 0x79
push dword [eax]
mov ecx, dword [0x6ddcc0]
call fcn.00411be7
mov byte [ebp - 4], 0x78
lea ecx, [ebp - 0x203c]
call fcn.004084b5
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x204c]
call fcn.004084b5
call fcn.004212f3
lea eax, [ebp - 0x204c]
push eax
call fcn.00487d50
mov byte [ebp - 4], 0x7a
mov dword [esp], str.msrsrv.exe
lea ecx, [ebp - 0x203c]
push ecx
mov ecx, eax
call fcn.004116ea
mov byte [ebp - 4], 0x7b
push dword [eax]
call fcn.004213b5
add esp, 0xc
mov byte [ebp - 4], 0x7a
lea ecx, [ebp - 0x203c]
call fcn.004085f6
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x204c]
call fcn.004085f6
mov esi, 0x6ddec8
mov dword [ebp - 0x2054], esi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0x7c
lea eax, [ebp - 0x204c]
push eax
call fcn.00487d50
mov byte [ebp - 4], 0x7d
mov dword [esp], str.pc2.db
lea ecx, [ebp - 0x203c]
push ecx
mov ecx, eax
call fcn.004116ea
pop ecx
pop ecx
mov byte [ebp - 4], 0x7e
mov eax, dword [eax]
push 0
push eax
mov ecx, 0x6ddec4
call fcn.00440d93
mov byte [ebp - 4], 0x7d
lea ecx, [ebp - 0x203c]
call fcn.004085f6
mov byte [ebp - 4], 0x7c
lea ecx, [ebp - 0x204c]
call fcn.004085f6
push 0x6ddec4
call fcn.00440e4e
test al, al
jne 0x468e72
xor eax, eax
push eax
push eax
push eax
push 0x4695cf
push eax
push eax
call fcn.00583186
add esp, 0x18
mov dword [0x6ddcbc], eax
cmp dword [0x6c438c], 1
jl 0x468e72
push str.PCDB_ready
push str.CIkAV::CIkAV
push 1
call fcn.00540a02
add esp, 0xc
mov byte [ebp - 4], 0x20
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor esi, esi
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x6ddcb4], eax
mov byte [edi + 0x50], 0
push 0x6dd39c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x400
lea eax, [ebp - 0x2018]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
lea eax, [ebp - 0x2018]
push eax
call fcn.0058415f
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x2018]
push eax
lea eax, [ebp - 0x2058]
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x7f
push str.msav.db
lea eax, [ebp - 0x203c]
push eax
lea ecx, [ebp - 0x2058]
call fcn.004116ea
pop ecx
pop ecx
mov byte [ebp - 4], 0x80
mov edi, 0x6df278
call fcn.00408619
mov byte [ebp - 4], 0x7f
lea ecx, [ebp - 0x203c]
call fcn.004085f6
push esi
push 0x23
lea eax, [ebp - 0x818]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edi, [ebp - 0x818]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x468f2c
mov esi, str.AVHome
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x203c]
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x81
push str.cache.db
lea ecx, [ebp - 0x2064]
push ecx
mov ecx, eax
call fcn.004116ea
pop ecx
pop ecx
mov byte [ebp - 4], 0x83
lea ecx, [ebp - 0x203c]
call fcn.004085f6
push 0
lea eax, [ebp - 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edi, [ebp - 0x818]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x468f92
mov esi, 0x68e728
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor esi, esi
push esi
lea eax, [ebp - 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str._sc4.db
lea eax, [ebp - 0x203c]
push eax
lea ecx, [ebp - 0x2058]
call fcn.004116ea
pop ecx
pop ecx
mov byte [ebp - 4], 0x84
mov edi, 0x6df2b4
call fcn.00408619
mov byte [ebp - 4], 0x83
lea ecx, [ebp - 0x203c]
call fcn.004085f6
push 0x3c
call fcn.005812e3
pop ecx
mov dword [ebp - 0x203c], eax
mov byte [ebp - 4], 0x85
cmp eax, esi
je 0x469009
push eax
call fcn.0049e310
jmp 0x46900b
xor eax, eax
mov byte [ebp - 4], 0x83
mov dword [0x6ddca4], eax
push esi
push dword [0x6df2b4]
call fcn.0049e840
lea eax, [ebp - 0x818]
push eax
call fcn.004437fb
pop ecx
call fcn.0043404a
mov eax, dword [ebp - 0x205c]
mov dword [0x6ddcb0], eax
mov byte [ebp - 0x203d], 0
mov dword [ebp - 0x2050], esi
mov dword [ebp - 0x2044], 0x400
xor eax, eax
mov word [ebp - 0x1818], ax
push 0x7fe
push esi
lea eax, [ebp - 0x1816]
push eax
call fcn.00586790
add esp, 0xc
lea eax, [ebp - 0x2044]
push eax
lea eax, [ebp - 0x1818]
push eax
lea eax, [ebp - 0x2050]
push eax
push 0x68e740
push str.Softwarepchiktmp
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x469119
mov eax, dword [ebp - 0x2044]
cmp eax, esi
je 0x469119
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x1818], cx
lea eax, [ebp - 0x1818]
push eax
lea eax, [ebp - 0x203c]
push eax
call fcn.00488a10
pop ecx
pop ecx
mov byte [ebp - 4], 0x86
lea esi, [ebp - 0x203c]
call fcn.00408548
push ecx
mov esi, esp
mov dword [ebp - 0x204c], esp
push eax
call fcn.0040101a
mov byte [ebp - 4], 0x87
push 0x68ab50
push str.Main
mov byte [ebp - 4], 0x86
call fcn.00401ab7
mov byte [ebp - 0x203d], 1
mov byte [ebp - 4], 0x83
lea ecx, [ebp - 0x203c]
call fcn.004084b5
xor esi, esi
mov dword [ebp - 0x2050], esi
mov dword [ebp - 0x2044], 0x400
lea eax, [ebp - 0x2044]
push eax
lea eax, [ebp - 0x1818]
push eax
lea eax, [ebp - 0x2050]
push eax
push 0x68e76c
push str.Softwarepchiktmp
push edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4691c2
mov eax, dword [ebp - 0x2044]
cmp eax, esi
je 0x4691c2
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x1818], cx
lea eax, [ebp - 0x1818]
push eax
lea eax, [ebp - 0x203c]
push eax
call fcn.00488a10
mov byte [ebp - 4], 0x88
mov eax, dword [eax]
add esp, 4
mov esi, esp
mov dword [ebp - 0x204c], esp
push eax
call fcn.0040101a
mov byte [ebp - 4], 0x89
push str.Port
push str.Main
mov byte [ebp - 4], 0x88
call fcn.00401ab7
mov byte [ebp - 4], 0x83
lea ecx, [ebp - 0x203c]
call fcn.004084b5
mov byte [ebp - 0x203d], 1
xor esi, esi
mov dword [ebp - 0x2048], ebx
mov dword [ebp - 0x2050], esi
mov dword [ebp - 0x2044], 4
lea eax, [ebp - 0x2044]
push eax
lea eax, [ebp - 0x2048]
push eax
lea eax, [ebp - 0x2050]
push eax
push 0x68e774
push str.Softwarepchiktmp
push edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0x2048], ebx
je 0x46937c
cmp dword [ebp - 0x2048], 1
jne 0x46935f
push esi
push str.IsGlobal
push str.Update
call fcn.00401920
xor eax, eax
mov word [ebp - 0x1018], ax
push 0x7fe
push esi
lea eax, [ebp - 0x1016]
push eax
call fcn.00586790
add esp, 0xc
mov dword [ebp - 0x2050], esi
mov dword [ebp - 0x2044], 0x400
lea eax, [ebp - 0x2044]
push eax
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x2050]
push eax
push 0x68e77c
push str.Softwarepchiktmp
push edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4692f0
mov eax, dword [ebp - 0x2044]
cmp eax, esi
je 0x4692f0
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x1018], cx
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x203c]
push eax
call fcn.00488a10
pop ecx
pop ecx
mov byte [ebp - 4], 0x8a
lea esi, [ebp - 0x203c]
call fcn.00408548
push ecx
mov esi, esp
mov dword [ebp - 0x204c], esp
push eax
call fcn.0040101a
mov byte [ebp - 4], 0x8b
push str.LocalServer
push str.Update
mov byte [ebp - 4], 0x8a
call fcn.00401ab7
mov byte [ebp - 4], 0x83
lea ecx, [ebp - 0x203c]
call fcn.004084b5
xor esi, esi
mov dword [ebp - 0x2050], esi
mov dword [ebp - 0x2044], 0x400
lea eax, [ebp - 0x2044]
push eax
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x2050]
push eax
push 0x68a484
push str.Softwarepchiktmp
push edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x469370
mov eax, dword [ebp - 0x2044]
cmp eax, esi
je 0x469370
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x1018], cx
lea eax, [ebp - 0x1018]
push eax
call fcn.005818e3
pop ecx
push eax
push str.LocalPort
push str.Update
call fcn.00401843
jmp 0x469370
push 1
push str.IsGlobal
push str.Update
call fcn.00401920
push str.Softwarepchiktmp
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp byte [ebp - 0x203d], 0
jne 0x46938d
cmp dword [ebp - 0x2048], ebx
je 0x469392
call fcn.00401cbd
mov edi, dword [ebp - 0x205c]
mov ecx, edi
call fcn.004768b8
mov ecx, edi
call fcn.00476cb8
call fcn.0047b4d2
push esi
push 1
push esi
call fcn.00469c09
add esp, 0xc
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push 0x68e784
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x8c
mov byte [ebp - 4], 0x83
call fcn.004326bd
cmp eax, 1
jne 0x4693e4
push eax
call fcn.0046a222
lea eax, [ebp - 0x2038]
push eax
call fcn.00410c73
mov byte [ebp - 4], 0x8d
push esi
lea ecx, [ebp - 0x2038]
call fcn.00411be7
test al, al
je 0x469423
lea eax, [edi + 0xd0]
push eax
lea eax, [ebp - 0x2038]
push eax
call fcn.00413f9d
lea eax, [ebp - 0x2038]
push eax
call fcn.00414a32
mov byte [ebp - 4], 0x83
lea eax, [ebp - 0x2038]
push eax
call fcn.00410c9f
push 0x20
call fcn.005812e3
pop ecx
mov dword [ebp - 0x203c], eax
mov byte [ebp - 4], 0x8e
cmp eax, esi
je 0x469451
push eax
call fcn.00410c73
jmp 0x469453
xor eax, eax
mov byte [ebp - 4], 0x83
mov dword [0x6df210], eax
push esi
mov ecx, eax
call fcn.00411be7
push edi
call fcn.00472956
push esi
push ecx
mov eax, esp
mov dword [ebp - 0x203c], esp
push str.USBPassword
push eax
call fcn.004085b5
mov byte [ebp - 4], 0x8f
mov byte [ebp - 4], 0x83
call fcn.004326bd
mov dword [edi + 0xcc], eax
push esi
push esi
push edi
push 0x469a20
push esi
push esi
call fcn.00583186
push esi
push esi
push edi
push 0x469af7
push esi
push esi
call fcn.00583186
push esi
push esi
push edi
push 0x469840
push esi
push esi
call fcn.00583186
add esp, 0x48
push esi
push esi
push edi
push 0x469614
push esi
push esi
call fcn.00583186
push esi
push esi
push edi
push 0x47ae37
push esi
push esi
call fcn.00583186
push esi
push esi
push esi
push 0x467494
push esi
push esi
call fcn.00583186
add esp, 0x48
mov edi, 0x6def70
mov ecx, edi
call fcn.0045d4b5
call fcn.0042a54c
push esi
push esi
push edi
push 0x45d685
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x6def9c], eax
mov byte [ebp - 4], 0x7f
lea ecx, [ebp - 0x2064]
call fcn.004085f6
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x2058]
call fcn.004085f6
mov dword [ebp - 4], 0x1f
jmp 0x46956c
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x205c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00581268
leave
ret