Function at 0x468f50
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3e4
mov eax, dword [0x541a34]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x234], 0
push 0x44f5a0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.0048b790
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x230]
call fcn.004579b0
lea ecx, [ebp - 0x230]
call fcn.0045e270
push eax
lea ecx, [ebp - 0x210]
call fcn.0044dc60
push str._kfdsjldsjfldsjfdsdh3dh
lea ecx, [ebp - 0x210]
push ecx
call fcn.00459040
add esp, 8
movzx edx, al
test edx, edx
je 0x4690a4
mov dword [0x5431fc], 0x65
lea ecx, [ebp - 0x230]
call fcn.0045e270
push eax
lea ecx, [ebp - 0x21c]
call fcn.0044dc60
lea ecx, [ebp - 0x21c]
call fcn.004432d0
cmp eax, 3
jle 0x46900a
lea ecx, [ebp - 0x21c]
call fcn.00463840
mov dword [0x545268], eax
mov dword [0x54526c], edx
lea ecx, [ebp - 0x230]
call fcn.0045e270
push eax
lea ecx, [ebp - 0x21c]
call fcn.00458e40
lea ecx, [ebp - 0x21c]
call fcn.004432d0
cmp eax, 4
jle 0x469051
mov dword [0x54525c], 1
lea ecx, [ebp - 0x21c]
call fcn.004432f0
push eax
mov ecx, 0x545260
call fcn.00458f10
call fcn.0045dbc0
mov ecx, eax
call fcn.004cc180
call fcn.0045dbc0
mov ecx, eax
call fcn.004cd700
mov dword [ebp - 0x340], 0
lea ecx, [ebp - 0x21c]
call fcn.0044dfa0
lea ecx, [ebp - 0x210]
call fcn.0044dfa0
lea ecx, [ebp - 0x230]
call fcn.00458790
mov eax, dword [ebp - 0x340]
jmp 0x46a347
push 0x505790
lea eax, [ebp - 0x210]
push eax
call fcn.00459040
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x46911f
mov dword [0x5431fc], 0xc9
call fcn.0046e920
lea ecx, [ebp - 0x20c]
call fcn.00496730
mov ecx, dword [0x544d0c]
call fcn.0049eb30
mov dword [ebp - 0x360], 0
lea ecx, [ebp - 0x20c]
call fcn.00458590
lea ecx, [ebp - 0x210]
call fcn.0044dfa0
lea ecx, [ebp - 0x230]
call fcn.00458790
mov eax, dword [ebp - 0x360]
jmp 0x46a347
push str._dns
lea ecx, [ebp - 0x298]
call fcn.00457cd0
lea edx, [ebp - 0x298]
push edx
lea eax, [ebp - 0x210]
push eax
call fcn.00459010
add esp, 8
mov byte [ebp - 0x215], al
lea ecx, [ebp - 0x298]
call fcn.0044dfa0
movzx ecx, byte [ebp - 0x215]
test ecx, ecx
je 0x4695f7
call fcn.00460390
lea ecx, [ebp - 0x238]
call fcn.00457ba0
lea ecx, [ebp - 0x230]
call fcn.0045e270
push eax
lea edx, [ebp - 0x3d4]
push edx
call fcn.0045f7b0
add esp, 8
mov ecx, dword [eax]
mov dword [ebp - 0x34], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x30], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x2c], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x28], edx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x238]
call fcn.0045aeb0
push 1
push 1
push 0
lea ecx, [ebp - 0x2b0]
call fcn.0044dab0
lea ecx, [ebp - 0x230]
call fcn.0045e270
push eax
lea ecx, [ebp - 0x220]
call fcn.0044dcf0
lea ecx, [ebp - 0x220]
push ecx
call fcn.004de2ed
push eax
lea edx, [ebp - 0x2b0]
push edx
call fcn.00461ab0
add esp, 0xc
lea ecx, [ebp - 0x230]
call fcn.0045e270
push eax
lea eax, [ebp - 0x3e4]
push eax
call fcn.0045f7b0
add esp, 8
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x2b0]
call fcn.004b15c0
push eax
lea ecx, [ebp - 0x2b0]
call fcn.0043ffc0
push eax
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x238]
call fcn.00463290
mov dword [ebp - 0x3b8], eax
lea ecx, [ebp - 0x2b0]
call fcn.004b15c0
push eax
lea ecx, [ebp - 0x2b0]
call fcn.0043ffc0
push eax
lea edx, [ebp - 0x370]
push edx
call fcn.0045a530
add esp, 0xc
mov ecx, eax
call fcn.004432f0
push eax
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x8c]
push ecx
call fcn.0045de80
add esp, 8
mov ecx, eax
call fcn.0043ccc0
push eax
lea ecx, [ebp - 0x220]
call fcn.004432f0
push eax
lea edx, [ebp - 0x368]
push edx
call fcn.0045c960
add esp, 4
mov ecx, eax
call fcn.004432f0
push eax
lea ecx, [ebp - 0x364]
call fcn.0044dcf0
mov ecx, eax
call fcn.004432f0
push eax
push str._s_send_domain:_s_to__s____s_r_n
call fcn.00436750
add esp, 0x14
lea ecx, [ebp - 0x364]
call fcn.0044dfe0
lea ecx, [ebp - 0x368]
call fcn.0044dfa0
lea ecx, [ebp - 0x8c]
call fcn.0043a380
lea ecx, [ebp - 0x370]
call fcn.0044dfe0
push 0
push 0x2000
lea ecx, [ebp - 0x2b0]
call fcn.0044e840
push 0xfa0
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2b0]
call fcn.004b15c0
push eax
lea ecx, [ebp - 0x2b0]
call fcn.0043ffc0
push eax
lea ecx, [ebp - 0x238]
call fcn.004621e0
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0
jg 0x469414
lea ecx, [ebp - 0x378]
push ecx
call fcn.0045c960
add esp, 4
mov ecx, eax
call fcn.004432f0
push eax
lea ecx, [ebp - 0x374]
call fcn.0044dcf0
mov ecx, eax
call fcn.004432f0
push eax
push str._s_recv_time_out_r_n
call fcn.00436750
add esp, 8
lea ecx, [ebp - 0x374]
call fcn.0044dfe0
lea ecx, [ebp - 0x378]
call fcn.0044dfa0
mov dword [ebp - 0x37c], 0
lea ecx, [ebp - 0x220]
call fcn.0044dfe0
lea ecx, [ebp - 0x2b0]
call fcn.0044df00
lea ecx, [ebp - 0x238]
call fcn.004589e0
lea ecx, [ebp - 0x210]
call fcn.0044dfa0
lea ecx, [ebp - 0x230]
call fcn.00458790
mov eax, dword [ebp - 0x37c]
jmp 0x46a347
lea ecx, [ebp - 0x398]
call fcn.00457650
lea edx, [ebp - 0x398]
push edx
mov eax, dword [ebp - 0x268]
push eax
lea ecx, [ebp - 0x2b0]
call fcn.0043ffc0
push eax
call fcn.00459ee0
add esp, 0xc
push 0
lea ecx, [ebp - 0x2b0]
call fcn.004b15c0
push eax
lea ecx, [ebp - 0x2b0]
call fcn.0043ffc0
push eax
lea ecx, [ebp - 0x380]
push ecx
call fcn.0045cf30
add esp, 0x10
push eax
lea ecx, [ebp - 0x220]
call fcn.00458e80
lea ecx, [ebp - 0x380]
call fcn.0044dfe0
lea ecx, [ebp - 0x398]
call fcn.00481d50
test eax, eax
je 0x4694c2
push 0
lea ecx, [ebp - 0x398]
call fcn.00476f90
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.0045d6e0
add esp, 8
or dword [ebp - 0x234], 1
mov ecx, eax
call fcn.0043ccc0
mov dword [ebp - 0x278], eax
jmp 0x4694cc
mov dword [ebp - 0x278], str.no_get_ip
mov ecx, dword [ebp - 0x268]
push ecx
lea ecx, [ebp - 0x2b0]
call fcn.0043ffc0
push eax
lea edx, [ebp - 0x38c]
push edx
call fcn.0045a530
add esp, 0xc
mov ecx, eax
call fcn.004432f0
push eax
mov eax, dword [ebp - 0x278]
push eax
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x74]
push edx
call fcn.0045de80
add esp, 8
mov ecx, eax
call fcn.0043ccc0
push eax
lea ecx, [ebp - 0x220]
call fcn.004432f0
push eax
lea eax, [ebp - 0x388]
push eax
call fcn.0045c960
add esp, 4
mov ecx, eax
call fcn.004432f0
push eax
lea ecx, [ebp - 0x384]
call fcn.0044dcf0
mov ecx, eax
call fcn.004432f0
push eax
push str._s_recv_from__s_ip:_s_recv_data:___s__s_r_n
call fcn.00436750
add esp, 0x18
lea ecx, [ebp - 0x384]
call fcn.0044dfe0
lea ecx, [ebp - 0x388]
call fcn.0044dfa0
lea ecx, [ebp - 0x74]
call fcn.0043a380
lea ecx, [ebp - 0x38c]
call fcn.0044dfe0
mov ecx, dword [ebp - 0x234]
and ecx, 1
je 0x46959b
and dword [ebp - 0x234], 0xfffffffe
lea ecx, [ebp - 0x5c]
call fcn.0043a380
mov dword [ebp - 0x2b4], 0
lea ecx, [ebp - 0x398]
call fcn.00458330
lea ecx, [ebp - 0x220]
call fcn.0044dfe0
lea ecx, [ebp - 0x2b0]
call fcn.0044df00
lea ecx, [ebp - 0x238]
call fcn.004589e0
lea ecx, [ebp - 0x210]
call fcn.0044dfa0
lea ecx, [ebp - 0x230]
call fcn.00458790
mov eax, dword [ebp - 0x2b4]
jmp 0x46a347
push str._ddns
lea ecx, [ebp - 0x27c]
call fcn.00457cd0
lea edx, [ebp - 0x27c]
push edx
lea eax, [ebp - 0x210]
push eax
call fcn.00459010
add esp, 8
mov byte [ebp - 0x211], al
lea ecx, [ebp - 0x27c]
call fcn.0044dfa0
movzx ecx, byte [ebp - 0x211]
test ecx, ecx
je 0x469868
lea ecx, [ebp - 0x230]
call fcn.0045e270
push eax
lea ecx, [ebp - 0x24c]
call fcn.0044dc60
lea ecx, [ebp - 0x230]
call fcn.0045e270
push eax
lea ecx, [ebp - 0x240]
call fcn.0044dc60
lea ecx, [ebp - 0x230]
call fcn.0045e270
push eax
lea ecx, [ebp - 0x264]
call fcn.0044dc60
lea ecx, [ebp - 0x240]
call fcn.004432f0
push eax
lea ecx, [ebp - 0x24c]
call fcn.004432f0
push eax
call fcn.00460f40
add esp, 8
test eax, eax
je 0x469763
lea ecx, [ebp - 0x264]
call fcn.00463870
cmp eax, 1
jne 0x4696bf
jmp 0x46975e
push 0
push 0x50585c
push str._ok.
lea edx, [ebp - 0x240]
push edx
push 0x505870
lea eax, [ebp - 0x24c]
push eax
push 0x50587c
lea ecx, [ebp - 0x2c4]
push ecx
call fcn.004594c0
add esp, 0xc
push eax
lea edx, [ebp - 0x2c0]
push edx
call fcn.0044e040
add esp, 0xc
push eax
lea eax, [ebp - 0x2bc]
push eax
call fcn.00459420
add esp, 0xc
push eax
lea ecx, [ebp - 0x2b8]
push ecx
call fcn.0044e040
add esp, 0xc
mov ecx, eax
call fcn.004432f0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x2b8]
call fcn.0044dfa0
lea ecx, [ebp - 0x2bc]
call fcn.0044dfa0
lea ecx, [ebp - 0x2c0]
call fcn.0044dfa0
lea ecx, [ebp - 0x2c4]
call fcn.0044dfa0
jmp 0x469817
lea ecx, [ebp - 0x264]
call fcn.00463870
cmp eax, 1
jne 0x469778
jmp 0x469817
push 0x10
push 0x505890
push str._fail.
lea edx, [ebp - 0x240]
push edx
push str._to
lea eax, [ebp - 0x24c]
push eax
push str.lsz_file
lea ecx, [ebp - 0x2d4]
push ecx
call fcn.004594c0
add esp, 0xc
push eax
lea edx, [ebp - 0x2d0]
push edx
call fcn.0044e040
add esp, 0xc
push eax
lea eax, [ebp - 0x2cc]
push eax
call fcn.00459420
add esp, 0xc
push eax
lea ecx, [ebp - 0x2c8]
push ecx
call fcn.0044e040
add esp, 0xc
mov ecx, eax
call fcn.004432f0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x2c8]
call fcn.0044dfa0
lea ecx, [ebp - 0x2cc]
call fcn.0044dfa0
lea ecx, [ebp - 0x2d0]
call fcn.0044dfa0
lea ecx, [ebp - 0x2d4]
call fcn.0044dfa0
mov dword [ebp - 0x2d8], 0
lea ecx, [ebp - 0x264]
call fcn.0044dfa0
lea ecx, [ebp - 0x240]
call fcn.0044dfa0
lea ecx, [ebp - 0x24c]
call fcn.0044dfa0
lea ecx, [ebp - 0x210]
call fcn.0044dfa0
lea ecx, [ebp - 0x230]
call fcn.00458790
mov eax, dword [ebp - 0x2d8]
jmp 0x46a347
push str._crash
lea ecx, [ebp - 0x280]
call fcn.00457cd0
lea edx, [ebp - 0x280]
push edx
lea eax, [ebp - 0x210]
push eax
call fcn.00459010
add esp, 8
mov byte [ebp - 0x212], al
lea ecx, [ebp - 0x280]
call fcn.0044dfa0
movzx ecx, byte [ebp - 0x212]
test ecx, ecx
je 0x46994b
lea ecx, [ebp - 0x230]
call fcn.0045e270
push eax
lea ecx, [ebp - 0x260]
call fcn.0044dc60
lea ecx, [ebp - 0x260]
call fcn.004432f0
push eax
call fcn.00460350
add esp, 4
test eax, eax
je 0x469910
push 0
lea ecx, [ebp - 0x284]
call fcn.0044dcc0
lea edx, [ebp - 0x284]
push edx
lea ecx, [ebp - 0x260]
call fcn.004432f0
push eax
call fcn.00461fe0
add esp, 8
lea ecx, [ebp - 0x284]
call fcn.0044dfe0
mov dword [ebp - 0x2dc], 0
lea ecx, [ebp - 0x260]
call fcn.0044dfa0
lea ecx, [ebp - 0x210]
call fcn.0044dfa0
lea ecx, [ebp - 0x230]
call fcn.00458790
mov eax, dword [ebp - 0x2dc]
jmp 0x46a347
push str._delete_configs
lea ecx, [ebp - 0x288]
call fcn.00457cd0
lea eax, [ebp - 0x288]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.00459010
add esp, 8
mov byte [ebp - 0x213], al
lea ecx, [ebp - 0x288]
call fcn.0044dfa0
movzx edx, byte [ebp - 0x213]
test edx, edx
je 0x4699c6
call fcn.0045dad0
mov ecx, eax
call fcn.004c5a80
mov dword [ebp - 0x2e0], 0
lea ecx, [ebp - 0x210]
call fcn.0044dfa0
lea ecx, [ebp - 0x230]
call fcn.00458790
mov eax, dword [ebp - 0x2e0]
jmp 0x46a347
push str._delete_configs2
lea ecx, [ebp - 0x28c]
call fcn.00457cd0
lea eax, [ebp - 0x28c]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.00459010
add esp, 8
mov byte [ebp - 0x214], al
lea ecx, [ebp - 0x28c]
call fcn.0044dfa0
movzx edx, byte [ebp - 0x214]
test edx, edx
je 0x469a14
call fcn.0045dad0
mov ecx, eax
call fcn.004c5a80
mov dword [0x5431fc], 0
call fcn.00468360
push str..rreemm
lea ecx, [ebp - 0x2e8]
call fcn.0044dc60
push eax
call fcn.0044f1a0
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.004594c0
add esp, 0xc
mov ecx, eax
call fcn.004432f0
push eax
call fcn.00460350
add esp, 4
mov dword [ebp - 0x2ec], eax
lea ecx, [ebp - 0x2e4]
call fcn.0044dfa0
lea ecx, [ebp - 0x2e8]
call fcn.0044dfa0
cmp dword [ebp - 0x2ec], 0
je 0x469af7
push 0
call fcn.0045d130
push eax
push str._del__s_.rreemm
call fcn.0045d130
push eax
push str._c_cd__d__
lea ecx, [ebp - 0x2f8]
call fcn.00457cd0
push eax
lea ecx, [ebp - 0x2f4]
push ecx
call fcn.0044e040
add esp, 0xc
push eax
lea edx, [ebp - 0x2f0]
push edx
call fcn.0044e040
add esp, 0xc
mov ecx, eax
call fcn.004432f0
push eax
push 0x505958
call fcn.004634d0
add esp, 0x10
lea ecx, [ebp - 0x2f0]
call fcn.0044dfa0
lea ecx, [ebp - 0x2f4]
call fcn.0044dfa0
lea ecx, [ebp - 0x2f8]
call fcn.0044dfa0
call fcn.004931a0
push 0x505968
push 0x505980
lea eax, [ebp - 0x300]
push eax
call fcn.0045c670
add esp, 8
push eax
lea ecx, [ebp - 0x2fc]
push ecx
call fcn.0044e040
add esp, 0xc
mov ecx, eax
call fcn.004432f0
push eax
push 0x505990
push 0x505994
push 0x5059a4
lea edx, [ebp - 0x244]
push edx
call fcn.0045e490
add esp, 0x14
lea ecx, [ebp - 0x2fc]
call fcn.0044dfa0
lea ecx, [ebp - 0x300]
call fcn.0044dfa0
lea ecx, [ebp - 0x274]
call fcn.00457650
push 1
push 0x5059b4
lea ecx, [ebp - 0x244]
call fcn.004432f0
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.00463530
add esp, 0x10
lea ecx, [ebp - 0x274]
call fcn.00481d50
test eax, eax
je 0x469cf9
lea ecx, [ebp - 0x274]
call fcn.00481d50
sub eax, 1
push eax
lea ecx, [ebp - 0x274]
call fcn.00476f90
push eax
lea ecx, [ebp - 0x290]
call fcn.0044dc30
lea ecx, [ebp - 0x274]
call fcn.004674b0
lea ecx, [ebp - 0x274]
call fcn.00481d50
test eax, eax
jne 0x469c44
push 0x5059b8
push 0x5059d0
lea ecx, [ebp - 0x308]
push ecx
call fcn.0045c670
add esp, 8
push eax
lea edx, [ebp - 0x304]
push edx
call fcn.0044e040
add esp, 0xc
mov ecx, eax
call fcn.004432f0
push eax
push 0x5059e0
push 0x5059e4
push 0x5059f4
call fcn.00463480
add esp, 0x10
lea ecx, [ebp - 0x304]
call fcn.0044dfa0
lea ecx, [ebp - 0x308]
call fcn.0044dfa0
jmp 0x469cd5
push 0x505a04
push 0x505a1c
lea eax, [ebp - 0x314]
push eax
call fcn.0045c670
add esp, 8
push eax
lea ecx, [ebp - 0x310]
push ecx
call fcn.0044e040
add esp, 0xc
mov ecx, eax
call fcn.004432f0
push eax
push 0x505a2c
push 0x505a30
push 0x505a34
lea edx, [ebp - 0x274]
push edx
lea eax, [ebp - 0x30c]
push eax
call fcn.004601d0
add esp, 0x14
mov ecx, eax
call fcn.004432f0
push eax
push 0x505a38
push 0x505a48
call fcn.00463480
add esp, 0x10
lea ecx, [ebp - 0x30c]
call fcn.0044dfa0
lea ecx, [ebp - 0x310]
call fcn.0044dfa0
lea ecx, [ebp - 0x314]
call fcn.0044dfa0
lea ecx, [ebp - 0x290]
call fcn.004432f0
push eax
call fcn.0045ea70
add esp, 4
lea ecx, [ebp - 0x290]
call fcn.0044dfa0
jmp 0x469b8e
mov dword [0x5431fc], 2
lea ecx, [ebp - 0x248]
call fcn.00457ba0
push 0
push str.Aieorjslflidekjfldskjfldskhfljds
push 0
push 0
lea ecx, [ebp - 0x248]
call fcn.0045a730
test eax, eax
je 0x469dad
push 0x505a9c
push 0x505ac4
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0
je 0x469d61
push 0
push 0
push 0x76e
mov ecx, dword [ebp - 0x294]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebp - 0x318], 0
lea ecx, [ebp - 0x248]
call fcn.004588d0
lea ecx, [ebp - 0x274]
call fcn.00458470
lea ecx, [ebp - 0x244]
call fcn.0044dfa0
lea ecx, [ebp - 0x210]
call fcn.0044dfa0
lea ecx, [ebp - 0x230]
call fcn.00458790
mov eax, dword [ebp - 0x318]
jmp 0x46a347
mov dword [0x5431fc], 3
call fcn.0045d880
movzx edx, byte [eax + 0x38]
test edx, edx
je 0x469ee4
push 0
lea ecx, [ebp - 0x25c]
call fcn.0044dcc0
push str.begin_Main_process__r_n
lea eax, [ebp - 0x25c]
push eax
call fcn.0044ed70
add esp, 8
call fcn.0045d880
lea ecx, [ebp - 0x334]
push ecx
call fcn.0045e800
add esp, 4
push eax
push 0x505aec
push 0xd6
lea edx, [ebp - 0x330]
push edx
call fcn.0044ef60
add esp, 8
push eax
push str.wWinMain_
push 0x505b4c
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x32c]
push ecx
call fcn.0044e180
add esp, 0xc
push eax
lea edx, [ebp - 0x328]
push edx
call fcn.0044e180
add esp, 0xc
push eax
lea eax, [ebp - 0x324]
push eax
call fcn.0044e0e0
add esp, 0xc
push eax
lea ecx, [ebp - 0x320]
push ecx
call fcn.0044e180
add esp, 0xc
push eax
lea edx, [ebp - 0x31c]
push edx
call fcn.0044e0e0
add esp, 0xc
mov ecx, eax
call fcn.004432f0
push eax
call fcn.0045d880
mov ecx, eax
call fcn.00459d30
lea ecx, [ebp - 0x31c]
call fcn.0044dfe0
lea ecx, [ebp - 0x320]
call fcn.0044dfe0
lea ecx, [ebp - 0x324]
call fcn.0044dfe0
lea ecx, [ebp - 0x328]
call fcn.0044dfe0
lea ecx, [ebp - 0x32c]
call fcn.0044dfe0
lea ecx, [ebp - 0x330]
call fcn.0044dfe0
lea ecx, [ebp - 0x334]
call fcn.0044dfe0
lea ecx, [ebp - 0x25c]
call fcn.0044dfe0
push 0
call fcn.0044f1a0
push eax
lea eax, [ebp - 0x338]
push eax
call fcn.0045d330
add esp, 0xc
mov ecx, eax
call fcn.004432f0
push eax
lea ecx, [ebp - 0x258]
push ecx
call fcn.0045e640
add esp, 8
lea ecx, [ebp - 0x338]
call fcn.0044dfa0
lea ecx, [ebp - 0x258]
call fcn.00481d50
cmp eax, 1
jbe 0x469f9a
mov dword [ebp - 0x23c], 0
jmp 0x469f48
mov edx, dword [ebp - 0x23c]
add edx, 1
mov dword [ebp - 0x23c], edx
lea ecx, [ebp - 0x258]
call fcn.00481d50
cmp dword [ebp - 0x23c], eax
jge 0x469f9a
mov eax, dword [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x258]
call fcn.00476f90
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esi], eax
je 0x469f98
push 0
mov ecx, dword [ebp - 0x23c]
push ecx
lea ecx, [ebp - 0x258]
call fcn.00476f90
mov edx, dword [eax]
push edx
call fcn.00460790
add esp, 8
jmp 0x469f39
lea ecx, [ebp - 0x258]
call fcn.0049e5c0
mov dword [0x5431fc], 4
call fcn.0046e920
call fcn.00460390
push 2
call fcn.0045dc20
mov ecx, eax
call fcn.0045ab90
mov dword [0x5431fc], 5
lea ecx, [ebp - 0x35c]
call fcn.0048fc20
push 0
push 0x4636a0
lea ecx, [ebp - 0x35c]
call fcn.0045b2c0
call fcn.0045da70
push str.pipewkeimauiuu
call fcn.0045da10
mov ecx, eax
call fcn.004970a0
push 0x3e8
push 1
call fcn.0045da10
mov ecx, eax
call fcn.004634a0
mov dword [0x5431fc], 6
push 0x505b70
call fcn.0045db60
mov ecx, eax
call fcn.00489220
push 0
call fcn.0045b340
add esp, 4
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0
jne 0x46a102
push 0x10
push 0x505b80
lea eax, [ebp - 0x344]
push eax
call fcn.0045df30
add esp, 4
push eax
push str.error
lea ecx, [ebp - 0x36c]
push ecx
call fcn.004594c0
add esp, 0xc
mov ecx, eax
call fcn.004432f0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x36c]
call fcn.0044dfa0
lea ecx, [ebp - 0x344]
call fcn.0044dfa0
mov dword [ebp - 0x348], 0
lea ecx, [ebp - 0x35c]
call fcn.00458920
lea ecx, [ebp - 0x258]
call fcn.00458330
lea ecx, [ebp - 0x248]
call fcn.004588d0
lea ecx, [ebp - 0x274]
call fcn.00458470
lea ecx, [ebp - 0x244]
call fcn.0044dfa0
lea ecx, [ebp - 0x210]
call fcn.0044dfa0
lea ecx, [ebp - 0x230]
call fcn.00458790
mov eax, dword [ebp - 0x348]
jmp 0x46a347
mov dword [0x5431fc], 7
mov dword [ebp - 0x3b4], 0
xor edx, edx
mov dword [ebp - 0x3b0], edx
mov dword [ebp - 0x3ac], edx
mov dword [ebp - 0x3a8], edx
mov dword [ebp - 0x3a4], edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 0x39c], edx
push 0
push 0
push 0
lea eax, [ebp - 0x3b4]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x46a18d
cmp dword [ebp - 0x3b0], 0x76e
jne 0x46a171
push 0
push 0
push 0x7b
call fcn.0045da10
mov ecx, eax
call fcn.004632d0
lea ecx, [ebp - 0x3b4]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0x3b4]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x46a13c
mov dword [0x5431fc], 0x33
push 0
call fcn.0044f1a0
push eax
lea eax, [ebp - 0x34c]
push eax
call fcn.0045d330
add esp, 0xc
mov ecx, eax
call fcn.004432f0
push eax
lea ecx, [ebp - 0x3c4]
push ecx
call fcn.0045e640
add esp, 8
push eax
lea ecx, [ebp - 0x258]
call fcn.00458d70
lea ecx, [ebp - 0x3c4]
call fcn.00458330
lea ecx, [ebp - 0x34c]
call fcn.0044dfa0
lea ecx, [ebp - 0x258]
call fcn.00481d50
cmp eax, 1
jbe 0x46a2bb
mov dword [ebp - 0x224], 0
jmp 0x46a216
mov edx, dword [ebp - 0x224]
add edx, 1
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x258]
call fcn.00481d50
cmp dword [ebp - 0x224], eax
jge 0x46a2bb
mov eax, dword [ebp - 0x224]
push eax
lea ecx, [ebp - 0x258]
call fcn.00476f90
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esi], eax
je 0x46a2b6
push 0x64
push 0
mov ecx, dword [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x258]
call fcn.00476f90
mov edx, dword [eax]
push edx
call fcn.00463be0
add esp, 0xc
test eax, eax
jne 0x46a2b6
push 0
mov eax, dword [ebp - 0x224]
push eax
lea ecx, [ebp - 0x258]
call fcn.00476f90
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x350]
push edx
call fcn.0045c1d0
add esp, 8
mov ecx, eax
call fcn.004432f0
push eax
push 0x505bb8
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x350]
call fcn.0044dfa0
jmp 0x46a207
mov dword [0x5431fc], 0x34
push 0
push 0
push 0x505bc4
push str.taskkill.exe
push 0x505c04
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [0x5431fc], 0x35
mov dword [ebp - 0x354], 0
lea ecx, [ebp - 0x35c]
call fcn.00458920
lea ecx, [ebp - 0x258]
call fcn.00458330
lea ecx, [ebp - 0x248]
call fcn.004588d0
lea ecx, [ebp - 0x274]
call fcn.00458470
lea ecx, [ebp - 0x244]
call fcn.0044dfa0
lea ecx, [ebp - 0x210]
call fcn.0044dfa0
lea ecx, [ebp - 0x230]
call fcn.00458790
mov eax, dword [ebp - 0x354]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d219c
mov esp, ebp
pop ebp
ret 0x10