Function at 0x4c21d0
Capabilities:
Create thread
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x6480b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
push fcn.0047fa60
call fcn.005d4af6
add esp, 4
push 0
push 4
push 0
push 1
call fcn.005d2ac2
add esp, 4
push eax
call fcn.005d4c51
mov eax, dword [0x64d304]
add esp, 0x10
test eax, eax
je 0x4c221f
push 0x5ef904
call eax
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x8001
mov dword [0x64929c], esi
call edi
push str.ifwlang.dll
mov esi, eax
call dword [0x648e68]
test eax, eax
push esi
cmove eax, dword [0x64929c]
mov dword [0x6492a0], eax
call edi
call fcn.004e2f70
neg eax
lea ecx, [ebp - 0x64]
push ecx
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push 0
push str.SoftwareTeraByte_UnlimitedImage
push reloc.WS2_32.dll_bind
call dword [0x648da0]
test eax, eax
jne 0x4c22b7
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 4
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push str.CodePage
push dword [ebp - 0x64]
call dword [0x648dac]
test eax, eax
jne 0x4c22ae
push dword [ebp - 0x50]
call fcn.004fbda0
add esp, 4
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [0x648e54]
xor edi, edi
push 0x649180
mov dword [0x649180], 0x114
call esi
cmp dword [0x649190], edi
jne 0x4c22ed
push edi
push 0x10
push 1
call fcn.004b84a0
add esp, 0xc
lea ebx, [edi + 1]
jmp 0x4c2e00
push 0x649180
mov dword [0x649180], 0x11c
call esi
cmp dword [0x649190], 2
jne 0x4c2315
cmp dword [0x649184], 6
mov eax, str.GlobalTERABYTE_IFW_DFCD0116
jae 0x4c231a
mov eax, str.TERABYTE_IFW_DFCD0116
push eax
push 0
push 0
call dword [0x648de4]
mov edi, eax
mov dword [ebp - 0x4c], edi
test edi, edi
jne 0x4c2336
lea ebx, [eax + 1]
jmp 0x4c2e00
cmp word [ebx], 0x20
jne 0x4c2349
nop dword [eax]
add ebx, 2
cmp word [ebx], 0x20
je 0x4c2340
xor edi, edi
mov dword [ebp - 0x3c], edi
nop
mov ecx, dword [edi*8 + 0x6447fc]
mov esi, ecx
lea edx, [esi + 2]
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4c2360
sub esi, edx
sar esi, 1
push esi
push ecx
push ebx
call fcn.005d1f45
add esp, 0xc
test eax, eax
jne 0x4c23c8
movzx eax, word [ebx + esi*2]
lea ecx, [ebx + esi*2]
mov edx, eax
test ax, ax
je 0x4c2485
cmp eax, 0x20
je 0x4c2485
cmp eax, 0x3a
jne 0x4c23c8
push 0
lea eax, [ebp - 0x40]
push eax
lea eax, [ecx + 2]
push eax
call fcn.005d1ea6
mov edx, dword [ebp - 0x40]
add esp, 0xc
movzx ecx, word [edx]
test cx, cx
je 0x4c2471
cmp ecx, 0x20
je 0x4c2471
inc edi
cmp edi, 6
jb 0x4c2350
movzx edx, word [ebx]
xor eax, eax
mov edi, ebx
xor ecx, ecx
cmp dx, 0x20
jne 0x4c23e9
nop dword [eax]
add edi, 2
cmp word [edi], 0x20
je 0x4c23e0
xor esi, esi
test ecx, ecx
je 0x4c24a8
cmp ecx, 2
jne 0x4c249b
mov dword [0x6492b4], 1
mov eax, dword [0x64d308]
test eax, eax
je 0x4c2416
push 0x64915c
call eax
push 0x10
lea eax, [ebp - 0x24]
push eax
push str.TBWinPE
call dword [0x648e28]
dec eax
cmp eax, 0xe
ja 0x4c26f4
mov ecx, 0x5f66fc
lea eax, [ebp - 0x24]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4c26e4
test dx, dx
je 0x4c246a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4c26e4
add eax, 4
add ecx, 4
test dx, dx
jne 0x4c2440
xor eax, eax
jmp 0x4c26e9
mov ecx, dword [edi*8 + 0x644800]
mov edi, edx
mov dword [ebp - 0x3c], ecx
movzx edx, word [edi]
jmp 0x4c23d7
mov edi, dword [edi*8 + 0x644800]
xor eax, eax
mov dword [ebp - 0x3c], edi
mov edi, ecx
mov ecx, dword [ebp - 0x3c]
jmp 0x4c23d7
cmp ecx, 1
jne 0x4c24a8
or esi, 0xffffffff
test eax, eax
cmovne esi, eax
cmp dword [0x6492b4], 0
jne 0x4c2406
push 0
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4c26d0
push str.GlobalTERABYTE_IFW_IC_D
push str.GlobalTERABYTE_IFW_IC_W
push str.GlobalTERABYTE_IFW_IC_R
push 1
lea ecx, [ebp - 0x2c]
call fcn.00480100
push 0x800
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x5f7200
call fcn.00480910
test al, al
je 0x4c2571
mov eax, dword [ebp - 0x3c]
xorps xmm0, xmm0
movq qword [ebp - 0x38], xmm0
mov dword [ebp - 0x30], 0
cmp eax, 3
jne 0x4c25d9
mov edi, dword [ebp - 0xc]
cmp edi, 0xc
jbe 0x4c252e
add edi, 0xfffffff4
mov eax, 0x1ffe
cmp edi, eax
cmova edi, eax
jmp 0x4c2530
xor edi, edi
lea eax, [ebp - 0x38]
push eax
push edi
push 0x7d0
push 0x64b2b8
push 0xffffffffffffffff
lea ecx, [ebp - 0x2c]
call fcn.004806d0
test eax, eax
jne 0x4c2571
cmp dword [ebp - 0x38], eax
jne 0x4c2571
mov eax, dword [ebp - 0x30]
cmp eax, 2
jbe 0x4c2571
cmp eax, edi
ja 0x4c2571
push 0x64b2b8
push 0
push 3
mov ecx, 0x64d3a8
call fcn.004d2840
mov edi, dword [ebp - 0x3c]
push esi
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4c26c6
cmp edi, 3
je 0x4c25bc
push 0
push 0x64432c
call dword [0x648ed4]
mov esi, eax
test esi, esi
je 0x4c25bc
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4c25b5
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp - 0x4c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
lea ecx, [ebp - 0x2c]
xor edi, edi
call fcn.00480230
lea ebx, [edi + 1]
jmp 0x4c2e06
cmp word [edi], 0
jne 0x4c25e4
cmp eax, 1
jne 0x4c2571
call fcn.004afdf0
mov edi, dword [ebp - 0x3c]
mov ecx, 0xea60
mov dword [ebp - 0x6c], eax
cmp edi, 1
lea eax, [ebp - 0x38]
mov dword [ebp - 0x58], edx
push eax
cmove ecx, esi
push ecx
push 0
push 0
push 0xfffffffffffffffe
lea ecx, [ebp - 0x2c]
call fcn.004806d0
mov dword [ebp - 0x40], eax
cmp esi, 0xffffffff
je 0x4c26a6
test esi, esi
je 0x4c26a6
call fcn.004afdf0
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x60], edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x4c264b
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x50], eax
jmp 0x4c2659
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x50], 0
mov ecx, dword [ebp - 0x68]
sub ecx, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x60]
sbb edx, dword [ebp - 0x58]
call fcn.0058c1d0
mov edx, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x3c]
movsd qword [ebp - 0x5c], xmm0
call fcn.0058c1d0
movsd xmm1, qword [ebp - 0x5c]
divsd xmm1, xmm0
mulsd xmm1, qword [0x5f8f10]
movaps xmm0, xmm1
call fcn.0058c0b0
test edx, edx
jb 0x4c26a1
ja 0x4c269d
cmp eax, esi
jbe 0x4c26a1
xor esi, esi
jmp 0x4c26a3
sub esi, eax
mov eax, dword [ebp - 0x40]
test eax, eax
jne 0x4c26b9
cmp dword [ebp - 0x38], eax
jne 0x4c26b9
test esi, esi
mov eax, 0xbb8
cmove esi, eax
lea ecx, [ebp - 0x2c]
call fcn.00480320
jmp 0x4c2574
lea ecx, [ebp - 0x2c]
call fcn.00480230
jmp 0x4c26d3
mov edi, dword [ebp - 0x3c]
cmp edi, 3
jne 0x4c2406
lea ebx, [edi - 2]
jmp 0x4c2dfd
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4c26f4
mov eax, 0x880020
jmp 0x4c26f6
xor eax, eax
mov dword [0x649150], eax
call fcn.0051e280
call fcn.0051e290
call fcn.004e2eb0
call fcn.00479f40
push ebx
call fcn.00505df0
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
push 0x1000
push 0x6492b8
call fcn.005100f0
add esp, 0x14
mov dword [ebp - 0x74], 8
lea eax, [ebp - 0x74]
mov dword [ebp - 0x70], 0xff
push eax
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
cmp dword [ebp - 0x44], 0
jle 0x4c289c
mov eax, dword [ebp - 0x48]
mov ecx, 0x5f7474
mov esi, dword [eax]
mov eax, esi
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4c2786
test dx, dx
je 0x4c2782
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4c2786
add eax, 4
add ecx, 4
test dx, dx
jne 0x4c2760
xor eax, eax
jmp 0x4c278b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4c2861
mov ecx, 0x5f747c
mov eax, esi
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4c27c6
test dx, dx
je 0x4c27c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4c27c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4c27a0
xor eax, eax
jmp 0x4c27cb
sbb eax, eax
or eax, 1
test eax, eax
je 0x4c2861
mov ecx, 0x5f7484
mov eax, esi
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4c2806
test dx, dx
je 0x4c2802
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4c2806
add eax, 4
add ecx, 4
test dx, dx
jne 0x4c27e0
xor eax, eax
jmp 0x4c280b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4c2861
push 0x5f7488
push esi
call fcn.005d09f9
add esp, 8
test eax, eax
jne 0x4c2831
push eax
call fcn.004ad9a0
add esp, 4
xor ebx, ebx
jmp 0x4c2de9
mov eax, dword [ebp - 0x48]
push str._shutdown
push dword [eax]
call fcn.005d09f9
add esp, 8
test eax, eax
jne 0x4c289c
push eax
mov dword [0x64f424], 8
call fcn.004ad9a0
add esp, 4
xor ebx, ebx
jmp 0x4c2de9
push str.RICHED20.DLL
call dword [0x648e3c]
test eax, eax
jne 0x4c287b
push str.RICHED20.DLL
call dword [0x648e68]
push 0
push 0x4c1bc0
push 0
push 0x9b
push dword [0x6492a0]
call dword [0x648ec4]
xor ebx, ebx
jmp 0x4c2de9
push 0x1000
push 0x6492b8
push 0
call dword [0x648e38]
push 0x6492b8
call fcn.0050e9a0
add esp, 4
mov dword [0x649154], eax
test eax, eax
je 0x4c2e4e
push 0x6492b8
call fcn.0050e9a0
add esp, 4
mov dword [0x649158], eax
test eax, eax
je 0x4c2e4e
push dword [0x649154]
call fcn.00504ca0
add esp, 4
cmp dword [0x6492b0], 0
jne 0x4c2bfc
call fcn.004b2950
test eax, eax
je 0x4c2bfc
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x4c2a4e
cmp dword [0x649184], 6
jne 0x4c2982
cmp dword [0x649188], 3
jne 0x4c2982
xor esi, esi
test eax, eax
jle 0x4c294d
nop dword [eax]
mov eax, dword [ebp - 0x48]
push str._nousbpwrfix
push dword [eax + esi*4]
call fcn.005d09f9
add esp, 8
test eax, eax
je 0x4c297f
inc esi
cmp esi, dword [ebp - 0x44]
jl 0x4c2930
xor esi, esi
nop
push 0xffffffffffffffff
push 0
push 0
push 0
push esi
call fcn.0050b6a0
add esp, 0x14
test eax, eax
je 0x4c296e
push eax
call fcn.0050ba00
add esp, 4
inc esi
cmp esi, 0x40
jb 0x4c2950
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x5c]
push eax
push 0
push 0x4a0c80
call fcn.005d21c2
add esp, 0xc
cmp eax, 0xffffffff
je 0x4c2ba2
cmp dword [0x64d33c], 0
je 0x4c2a3f
mov esi, dword [0x648f00]
push 0x1000
push 0x6492b8
push 0x214
push dword [0x6492a0]
mov dword [ebp - 0x40], 0
call esi
test eax, eax
jne 0x4c2a1a
push 0x1000
push 0x6492b8
push 0x214
push dword [0x64929c]
call esi
mov esi, eax
test esi, esi
jne 0x4c29ff
mov word [0x6492b8], ax
push 0x214
push str.Missing_String_ID__u:_Please_upgrade_the_language_file.
push 0x64d36c
call fcn.0050ee30
add esp, 0xc
test esi, esi
je 0x4c2a37
push 0x6492b8
call fcn.0050e9a0
add esp, 4
mov dword [ebp - 0x40], eax
push eax
push dword [0x6492a4]
call dword [0x64d33c]
lea ecx, [ebp - 0x40]
call fcn.0049a7e0
mov dword [0x64ddf0], 1
jmp 0x4c2ba2
push 5
push dword [0x6492a4]
mov dword [0x64f424], 0x100
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x64de14], 0
je 0x4c2a80
push 0
push 0x30
push 0xac
call fcn.004b84a0
add esp, 0xc
call fcn.00488070
call fcn.00487770
call fcn.004e2f70
mov ebx, dword [0x648da0]
neg eax
sbb esi, esi
lea eax, [ebp - 0x50]
push eax
and esi, 0x100
inc esi
push esi
push 0
push str.SOFTWAREMicrosoftWindows_DefenderWindows_Defender_Exploit_GuardControlled_Folder_Access
push reloc.WS2_32.dll_bind
call ebx
test eax, eax
jne 0x4c2af0
mov edi, dword [0x648dac]
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x58], 4
push eax
push 0
push 0
push str.EnableControlledFolderAccess
push dword [ebp - 0x50]
call edi
test eax, eax
je 0x4c2b11
mov dword [ebp - 0x3c], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x50]
call esi
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
call fcn.0050b6a0
add esp, 0x14
test eax, eax
je 0x4c2b6a
push eax
call fcn.0050ba00
add esp, 4
jmp 0x4c2b79
cmp dword [ebp - 0x3c], 0
je 0x4c2ae5
lea eax, [ebp - 0x40]
push eax
push esi
push 0
push str.AllowedApplications
push dword [ebp - 0x50]
call ebx
test eax, eax
jne 0x4c2ae5
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], 4
push eax
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push dword [0x649158]
push dword [ebp - 0x40]
call edi
test eax, eax
je 0x4c2b5d
push 0x30
push 0x24c
call fcn.004b5d80
add esp, 8
push dword [ebp - 0x40]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
jmp 0x4c2aeb
push 0x30
push 0xe5
call fcn.004b5d80
add esp, 8
push 1
push 1
push dword [0x6492a4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
push 0x28
push dword [0x6492a4]
call dword [0x648f20]
mov dword [0x64de18], 1
mov esi, dword [0x648edc]
lea eax, [ebp - 0x20]
push 0
push 0
push 0
push eax
call esi
test eax, eax
je 0x4c2bf4
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [0x648ec8]
lea eax, [ebp - 0x20]
push eax
push dword [0x6492a4]
call dword [0x648ef0]
test eax, eax
jne 0x4c2be4
lea eax, [ebp - 0x20]
push eax
call edi
lea eax, [ebp - 0x20]
push eax
call ebx
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call esi
test eax, eax
jne 0x4c2bc4
mov ebx, dword [0x64de08]
jmp 0x4c2c01
mov ebx, 0x47
push 1
call fcn.004e3c90
push 0
push 0
call fcn.0051ffb0
mov ecx, dword [0x64ddac]
add esp, 0xc
test ecx, ecx
je 0x4c2c2e
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x64ddac], 0
call fcn.0047c740
mov ecx, 0x64f488
call fcn.0050bf50
mov ecx, 0x64f304
call fcn.0050bf50
cmp dword [0x648fd0], 0
je 0x4c2c57
call fcn.0051e9d0
jmp 0x4c2c5c
call fcn.0051ef70
call fcn.0051cad0
call fcn.0050e620
call fcn.005106c0
push 0
push 0
call fcn.004d1930
add esp, 8
mov ecx, 0x64d36c
call fcn.0050f1a0
push 2
push dword [0x64f498]
call fcn.0058bb51
push 2
push dword [0x64f378]
mov dword [0x64f498], 0
call fcn.0058bb51
push 2
push dword [0x64f390]
mov dword [0x64f378], 0
call fcn.0058bb51
push 2
push dword [0x64f3a4]
mov dword [0x64f390], 0
call fcn.0058bb51
push dword [0x64f50c]
mov dword [0x64f3a4], 0
call fcn.0058bb5f
push dword [0x64f510]
mov dword [0x64f50c], 0
call fcn.0058bb5f
push 2
push dword [0x649154]
mov dword [0x64f510], 0
call fcn.0058bb51
push 2
push dword [0x649158]
call fcn.0058bb51
push dword [0x64f4a8]
call fcn.0058bb5f
push dword [0x64f4a4]
mov dword [0x64f4a8], 0
call fcn.0058bb5f
add esp, 0x40
mov dword [0x64f4a4], 0
push 2
push dword [0x64f4ac]
call fcn.0058bb51
push 2
push dword [0x64f430]
mov dword [0x64f4ac], 0
call fcn.0058bb51
push 2
push dword [0x64f64c]
mov dword [0x64f430], 0
call fcn.0058bb51
push 2
push dword [0x64f558]
mov dword [0x64f64c], 0
call fcn.0058bb51
push 2
push dword [0x64f59c]
mov dword [0x64f558], 0
call fcn.0058bb51
add esp, 0x28
mov dword [0x64f59c], 0
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp ebx, 0x47
jne 0x4c2de9
cmp dword [0x6492b0], 0
je 0x4c2de9
push 0
push 0
push 0xc0
call fcn.004b84a0
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x44]
call fcn.00505010
add esp, 8
call fcn.0047a0b0
mov edi, dword [ebp - 0x4c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x6492a0]
cmp eax, dword [0x64929c]
je 0x4c2e1a
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
js 0x4c2e26
cmp ebx, 0xff
jle 0x4c2e2b
mov ebx, 0xff
test edi, edi
je 0x4c2e39
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058bb64
mov esp, ebp
pop ebp
ret 0x10
push 0
push 0x10
push 0x94
call fcn.004b84a0
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov eax, 2
pop edi
pop esi
pop ebx
call fcn.0058bb64
mov esp, ebp
pop ebp
ret 0x10