Function at 0x461f30
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7f8e9a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2e4
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], esi
mov eax, dword [edi + 0x1dc]
mov dword [ebp - 0x18], edi
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov cl, byte [edx + eax + 8]
test cl, cl
je 0x463a01
mov al, byte [edi + 0x1d4]
test al, al
jne 0x4627c3
mov ebx, dword [edi + 0x1d8]
mov ecx, dword [ebx + 0x254]
mov dword [ebp - 0x1c], esi
test ecx, ecx
jne 0x461f9a
xor edx, edx
jmp 0x461fb3
mov edx, dword [ebx + 0x258]
mov eax, 0x4bda12f7
sub edx, ecx
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp esi, edx
ja 0x46263d
test ecx, ecx
jne 0x461fc3
xor edx, edx
jmp 0x461fdc
mov edx, dword [ebx + 0x258]
mov eax, 0x4bda12f7
sub edx, ecx
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp esi, edx
sete al
test al, al
mov byte [ebp - 0x12], al
je 0x461ff0
mov cl, byte [ebx + 0x2d8]
jmp 0x461ff9
lea eax, [esi + esi*2]
lea edx, [eax + eax*8]
mov cl, byte [ecx + edx*4]
test cl, cl
je 0x4624f8
lea ecx, [ebp - 0xf8]
call fcn.004034c0
mov edi, vtable.ascstring.0
mov dword [ebp - 0xf8], edi
lea ecx, [ebp - 0x98]
mov dword [ebp - 4], 0
call fcn.004034c0
mov dword [ebp - 0x98], edi
mov al, byte [ebp - 0x12]
push 0xffffffffffffffff
test al, al
mov byte [ebp - 4], 1
push 0
je 0x46206c
lea eax, [ebx + 0x2e0]
lea ecx, [ebp - 0xf8]
push eax
call fcn.00428c90
lea esi, [ebx + 0x2f4]
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x98]
call fcn.00428c90
mov edx, dword [esi]
mov ecx, esi
jmp 0x4620b3
mov ecx, dword [ebx + 0x254]
lea eax, [esi + esi*2]
lea esi, [eax + eax*8]
shl esi, 2
lea eax, [esi + ecx + 8]
lea ecx, [ebp - 0xf8]
push eax
call fcn.00428c90
mov eax, dword [ebx + 0x254]
push 0xffffffffffffffff
push 0
lea ecx, [esi + eax + 0x1c]
push ecx
lea ecx, [ebp - 0x98]
call fcn.00428c90
mov eax, dword [ebx + 0x254]
mov edx, dword [esi + eax + 0x1c]
lea ecx, [esi + eax + 0x1c]
push 0x8fca00
call dword [edx + 0x24]
push eax
call fcn.005e7529
add esp, 8
mov dword [ebp - 0x38], eax
mov al, byte [ebp - 0x12]
xor esi, esi
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 0x34], al
call fcn.00404c40
mov edi, str.Initializing
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.Initializing
lea ecx, [ebp - 0x34]
call fcn.004030a0
mov al, byte [ebp - 0x12]
mov byte [ebp - 4], 2
test al, al
mov edx, str.FTP_to_SFTP_bridge
jne 0x46210a
mov edx, str.client_side_client_2_server_forwarding
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
lea ecx, [ebp - 0x34]
call fcn.00476620
lea ecx, [ebp - 0xf4]
lea edx, [ebp - 0xe0]
push ecx
push str._on
push edx
call fcn.0044e080
push 0x8fb81c
push eax
lea eax, [ebp - 0xd0]
mov byte [ebp - 4], 3
push eax
call fcn.0044de30
lea ecx, [ebp - 0x94]
lea edx, [ebp - 0x174]
push ecx
push eax
push edx
mov byte [ebp - 4], 4
call fcn.0044df50
add esp, 0x24
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 5
call fcn.00476540
push 1
lea ecx, [ebp - 0x174]
mov byte [ebp - 4], 4
call fcn.00404c40
push 1
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 3
call fcn.00404c40
push 1
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 2
call fcn.00404c40
mov al, byte [ebp - 0x12]
mov byte [ebp - 4], 6
test al, al
je 0x4622a8
push 0x80
call fcn.007d7320
mov edi, eax
add esp, 4
mov dword [ebp - 0x20], edi
cmp edi, esi
mov byte [ebp - 4], 7
je 0x4621f8
push 1
mov ecx, edi
call fcn.00463bd0
lea ecx, [edi + 0x58]
mov byte [ebp - 4], 8
call fcn.00421460
lea ecx, [edi + 0x6c]
mov byte [ebp - 4], 9
call fcn.00421460
jmp 0x4621fa
xor edi, edi
mov dword [ebp - 0x84], edi
mov byte [ebp - 0x80], 1
mov byte [ebp - 0x7f], 0
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x70], esi
call fcn.004413f0
mov dword [ebp - 0x58], esi
mov eax, dword [ebp - 0xf0]
mov byte [ebp - 4], 0xb
cmp eax, esi
jne 0x46222d
mov eax, 0x8522f4
mov ecx, dword [ebp - 0x38]
push ecx
push eax
lea ecx, [ebp - 0x70]
call fcn.00691dc0
push eax
lea ecx, [edi + 0x20]
call fcn.00479ba0
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0xa
call fcn.0040e080
push esi
mov ecx, edi
call fcn.00692820
push 0xffffffffffffffff
lea edx, [ebx + 0x2e0]
push esi
lea ecx, [edi + 0x58]
push edx
call fcn.00428c90
push 0xffffffffffffffff
lea eax, [ebx + 0x308]
push esi
lea ecx, [edi + 0x6c]
push eax
call fcn.00428c90
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 0x84]
add ecx, 0x1e0
push edx
mov eax, dword [ecx + 8]
push eax
call fcn.0047e7f0
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 6
call fcn.0047f050
jmp 0x462400
push 0x78
call fcn.007d7320
mov edi, eax
add esp, 4
mov dword [ebp - 0x20], edi
cmp edi, esi
mov byte [ebp - 4], 0xc
je 0x4622da
push 1
lea ecx, [edi + 4]
call fcn.00463bd0
lea ecx, [edi + 0x5c]
mov byte [ebp - 4], 0xd
call fcn.00479b30
mov dword [ebp - 0x20], edi
jmp 0x4622df
mov dword [ebp - 0x20], esi
mov edi, esi
mov dword [ebp - 0x4c], edi
mov byte [ebp - 0x48], 1
mov byte [ebp - 0x47], 0
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 0xe
mov byte [edi], 0
mov dword [ebp - 0x13c], esi
call fcn.004413f0
mov dword [ebp - 0x124], esi
mov eax, dword [ebp - 0xf0]
mov byte [ebp - 4], 0xf
cmp eax, esi
jne 0x46231b
mov eax, 0x8522f4
mov ecx, dword [ebp - 0x38]
push ecx
push eax
lea ecx, [ebp - 0x13c]
call fcn.00691dc0
push eax
lea ecx, [edi + 0x24]
call fcn.00479ba0
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 0xe
call fcn.0040e080
push esi
lea ecx, [edi + 4]
call fcn.00692820
mov eax, dword [ebp - 0x1c]
mov edi, dword [ebx + 0x254]
lea esi, [eax + eax*2]
lea esi, [esi + esi*8]
shl esi, 2
call dword [sym.imp.KERNEL32.dll_GetACP]
push eax
lea edx, [esi + edi + 0x30]
lea eax, [ebp - 0x164]
push edx
push eax
call fcn.00481eb0
add esp, 0xc
test eax, eax
mov byte [ebp - 4], 0x10
je 0x462386
lea edi, [eax + 4]
jmp 0x462388
xor edi, edi
mov eax, dword [ebx + 0x254]
mov edx, dword [esi + eax + 0x44]
lea ecx, [esi + eax + 0x44]
call dword [edx + 0x24]
push 0x8fca00
push eax
call fcn.005e7529
mov ecx, dword [edi + 4]
add esp, 8
test ecx, ecx
jne 0x4623b3
mov ecx, 0x8522f4
push eax
mov eax, dword [ebp - 0x20]
push ecx
lea ecx, [eax + 0x5c]
call fcn.00691dc0
push 1
lea ecx, [ebp - 0x14c]
mov byte [ebp - 4], 0xe
call fcn.00404c40
push 1
lea ecx, [ebp - 0x160]
call fcn.00404c40
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 0x4c]
add ecx, 0x1f0
push edx
mov eax, dword [ecx + 8]
push eax
call fcn.0047e9f0
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 6
call fcn.0047f0c0
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetACP]
mov esi, eax
lea eax, [ebp - 0x34]
push 0x901c04
lea ecx, [ebp - 0xbc]
push eax
push ecx
call fcn.0044de30
add esp, 0xc
mov edi, eax
lea ecx, [ebp - 0x120]
call fcn.004034c0
lea edx, [ebp - 0x11]
lea ecx, [ebp - 0x108]
push edx
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x10c], esi
call fcn.00478ac0
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0x1f
mov dword [ebp - fcn.00577d70], vtable.dbcsstring.0
call fcn.00577bc0
push 0xffffffffffffffff
push 0
push edi
lea ecx, [ebp - 0x11c]
call fcn.00402e90
push 0x10000
lea eax, [ebp - 0x120]
push 2
push eax
mov byte [ebp - 4], 0x20
call fcn.0048e9a0
add esp, 0xc
lea ecx, [ebp - 0x108]
mov byte [ebp - 4], 0x1d
push 1
call fcn.00404c40
push 1
lea ecx, [ebp - 0x11c]
call fcn.00404c40
push 1
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 2
call fcn.00404c40
push 1
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.00404c40
push 1
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0
call fcn.00404c40
push 1
lea ecx, [ebp - 0xf4]
mov dword [ebp - 4], 0xffffffff
call fcn.00404c40
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
inc esi
jmp 0x461f89
mov eax, dword [edi + 0x2b0]
test eax, eax
je 0x4627bc
mov eax, dword [edi + 0x1d8]
add eax, 0x274
lea ecx, [eax + 0x1c]
test ecx, ecx
je 0x462662
lea esi, [eax + 0x20]
jmp 0x462664
xor esi, esi
lea edx, [eax + 8]
test edx, edx
je 0x462670
add eax, 0xc
jmp 0x462672
xor eax, eax
push eax
lea eax, [ebp - 0xe0]
push str.Initializing_SOCKS___HTTP_CONNECT_proxy_on
push eax
call fcn.0044e080
push 0x8fb81c
lea ecx, [ebp - 0xbc]
push eax
push ecx
mov dword [ebp - 4], 0x21
call fcn.0044de30
push esi
lea edx, [ebp - 0x34]
push eax
push edx
mov byte [ebp - 4], 0x22
call fcn.0044df50
add esp, 0x24
push 1
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 0x25
call fcn.00404c40
push 1
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 0x24
call fcn.00404c40
mov ecx, dword [edi + 0x2b0]
push 0
add ecx, 8
mov byte [ebp - 4], 0x26
call fcn.00692820
mov dword [ebp - 4], 0x24
call dword [sym.imp.KERNEL32.dll_GetACP]
mov esi, eax
lea eax, [ebp - 0x34]
push 0x901c04
lea ecx, [ebp - 0xd0]
push eax
push ecx
call fcn.0044de30
add esp, 0xc
mov ebx, eax
lea ecx, [ebp - 0xac]
call fcn.004034c0
mov dl, byte [ebp - 0x11]
push 0
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x34
mov dword [ebp - 0x98], esi
mov byte [ebp - 0x94], dl
call fcn.00404c40
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 0x35
mov dword [ebp - 0xac], vtable.dbcsstring.0
call fcn.00577bc0
push 0xffffffffffffffff
push 0
push ebx
lea ecx, [ebp - 0xac]
call fcn.00421480
push 0x10000
lea eax, [ebp - 0xac]
push 2
push eax
mov byte [ebp - 4], 0x36
call fcn.0048e9a0
add esp, 0xc
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x33
push 1
call fcn.00404c40
push 1
lea ecx, [ebp - 0xa8]
call fcn.00404c40
push 1
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0x24
call fcn.00404c40
push 1
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.00404c40
mov byte [edi + 0x1d4], 1
mov al, byte [edi + 0x1d5]
test al, al
mov byte [ebp - 0x12], al
jne 0x46295c
mov eax, dword [edi + 0xd4]
test eax, eax
jne 0x46295c
mov eax, dword [edi + 0x29c]
test eax, eax
jne 0x46295c
mov al, byte [edi + 0x210]
test al, al
je 0x462913
mov eax, dword [edi + 0x1d8]
mov cl, byte [eax + 0x24c]
test cl, cl
je 0x462885
mov cl, byte [ebp - 0x11]
push 0
mov byte [ebp - 0x34], cl
lea ecx, [ebp - 0x34]
call fcn.00404c40
mov edi, str.srvside_c2s_invite_bitvise.com
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.srvside_c2s_invite_bitvise.com
lea ecx, [ebp - 0x34]
call fcn.004030a0
mov ebx, 0x37
push 0
lea ecx, [ebp - 0x120]
mov dword [ebp - 4], ebx
call fcn.005e55cb
mov ecx, dword [ebp - 0x18]
push 0
lea edx, [ebp - 0x34]
push eax
push edx
mov byte [ebp - 4], 0x38
call fcn.005a6de0
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], bl
call fcn.005e579e
push 1
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.00404c40
mov edi, dword [ebp - 0x18]
mov eax, dword [edi + 0x1d8]
mov cl, byte [eax + 0x260]
test cl, cl
je 0x46290c
mov cl, byte [ebp - 0x11]
push 0
mov byte [ebp - 0x34], cl
lea ecx, [ebp - 0x34]
call fcn.00404c40
mov edi, str.srvside_s2c_invite_bitvise.com
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.srvside_s2c_invite_bitvise.com
lea ecx, [ebp - 0x34]
call fcn.004030a0
mov ebx, 0x39
push 0
lea ecx, [ebp - 0x120]
mov dword [ebp - 4], ebx
call fcn.005e55cb
mov ecx, dword [ebp - 0x18]
push 0
lea edx, [ebp - 0x34]
push eax
push edx
mov byte [ebp - 4], 0x3a
call fcn.005a6de0
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], bl
call fcn.005e579e
push 1
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.00404c40
mov edi, dword [ebp - 0x18]
mov byte [edi + 0x210], 0
mov ecx, edi
call fcn.0045e790
test al, al
jne 0x46295c
lea ecx, [ebp - 0x1c]
call fcn.00488ce0
mov dword [ebp - 4], 0x3b
call fcn.00488af0
test eax, eax
je 0x462946
push 1
push 4
call fcn.00488af0
mov ecx, eax
call fcn.00416aa0
lea ecx, [ebp - 0x1c]
mov byte [edi + 0x1d5], 1
mov dword [ebp - 4], 0xffffffff
call fcn.00488d20
mov al, byte [edi + 0x1d5]
test al, al
je 0x463a01
cmp al, byte [ebp - 0x12]
je 0x462c75
lea eax, [ebp - 0x34]
push eax
call fcn.004a7a30
add esp, 4
mov esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
cmp esi, eax
mov dword [ebp - 4], 0x3c
je 0x462a3b
mov ebx, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetACP]
lea ecx, [ebp - 0x7c]
mov edi, eax
call fcn.004034c0
mov cl, byte [ebp - 0x11]
push 0
mov byte [ebp - 0x64], cl
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x3d
mov dword [ebp - 0x68], edi
call fcn.00404c40
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x3e
mov dword [ebp - 0x7c], vtable.dbcsstring.0
call fcn.00577bc0
mov edi, str.Opening_SFTP_session.
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.Opening_SFTP_session.
lea ecx, [ebp - 0x78]
call fcn.004030a0
push 0
lea edx, [ebp - 0x7c]
push 2
push edx
mov byte [ebp - 4], 0x3f
call fcn.0048e9a0
add esp, 0xc
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x3c
push 1
call fcn.00404c40
push 1
lea ecx, [ebp - 0x78]
call fcn.00404c40
mov eax, dword [ebx + 0x1d8]
mov ecx, dword [esi]
push eax
push ecx
push ebx
call fcn.0045ae60
mov eax, dword [ebp - 0x2c]
add esi, 4
add esp, 0xc
cmp esi, eax
jne 0x462997
mov esi, dword [ebp - 0x18]
mov eax, dword [esi + 0x1d8]
mov cl, byte [eax + 0x194]
test cl, cl
je 0x462c4f
lea ecx, [eax + 0x540]
mov eax, dword [eax + 0x548]
cmp eax, 0x10
jb 0x462bb4
push 0xffffffffffffffff
push 0x10
call fcn.0040f500
jmp 0x462bc3
mov edx, 0x10
push 0
sub edx, eax
push edx
call fcn.004766e0
lea ecx, [ebp - 0x1ec]
mov dword [ebp - 0x1f0], 0
call fcn.00443e10
lea ecx, [ebp - 0x1d4]
mov byte [ebp - 4], 0x40
call fcn.00443e10
lea ecx, [ebp - 0x1bc]
mov byte [ebp - 4], 0x41
call fcn.00443e10
mov esi, dword [esi + 0x1d8]
mov byte [ebp - 4], 0x42
add esi, 0x540
mov ecx, esi
call fcn.004049d0
mov esi, dword [esi + 4]
lea eax, [ebp - 0x1f0]
push eax
push 0x10
push esi
call fcn.006d46b0
add esp, 0xc
lea ecx, [ebp - 0x1b8]
mov byte [ebp - 4], 0x44
call fcn.00432a70
lea ecx, [ebp - 0x1d0]
mov byte [ebp - 4], 0x43
call fcn.00432a70
lea ecx, [ebp - 0x1e8]
mov byte [ebp - 4], 0x3c
call fcn.00432a70
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
push ecx
push edx
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.004c11d0
mov eax, dword [ebp - 0x30]
push eax
call fcn.007d7349
mov edi, dword [ebp - 0x18]
add esp, 4
mov eax, dword [edi + 0xd4]
test eax, eax
jne 0x462cb9
mov eax, dword [edi + 0x29c]
test eax, eax
jne 0x462cb9
lea esi, [edi + 0x21c]
mov ecx, esi
mov dword [ebp - 0x4c], esi
call fcn.006d09e0
mov byte [ebp - 0x48], 1
mov ecx, edi
mov dword [ebp - 4], 0x45
call fcn.0045eb60
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.006d0a70
xor edx, edx
mov ecx, dword [edi + 0x1f4]
mov dword [ebp - 0x38], edx
test ecx, ecx
jne 0x462ccc
xor eax, eax
jmp 0x462cd7
mov eax, dword [edi + 0x1f8]
sub eax, ecx
sar eax, 3
cmp edx, eax
je 0x462d00
mov ecx, dword [edi + 0x1f4]
mov esi, dword [ecx + edx*8]
lea ecx, [esi + 4]
call fcn.00692c60
test al, al
je 0x462cfa
push esi
push edi
call fcn.004684c0
add esp, 8
mov edx, dword [ebp - 0x38]
inc edx
jmp 0x462cbb
xor edx, edx
mov ecx, dword [edi + 0x1e4]
mov dword [ebp - 0x38], edx
test ecx, ecx
jne 0x462d13
xor eax, eax
jmp 0x462d1e
mov eax, dword [edi + 0x1e8]
sub eax, ecx
sar eax, 3
cmp edx, eax
je 0x462d46
mov eax, dword [edi + 0x1e4]
mov esi, dword [eax + edx*8]
mov ecx, esi
call fcn.00692c60
test al, al
je 0x462d40
push esi
push edi
call fcn.00467e70
add esp, 8
mov edx, dword [ebp - 0x38]
inc edx
jmp 0x462d02
mov eax, dword [edi + 0x204]
mov ecx, dword [edi + 0x208]
cmp eax, ecx
mov dword [ebp - 0x38], eax
je 0x462f10
jmp 0x462d62
mov eax, dword [ebp - 0x38]
mov esi, dword [eax]
mov ecx, dword [edi + 0x1d8]
push 0
mov dword [ebp - 0x20], ecx
mov edx, dword [esi + 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x462ee1
cmp dword [esi], 0
jne 0x462de1
mov ecx, dword [esi + 0x5c]
lea eax, [ebp - 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x462e21
call dword [sym.imp.KERNEL32.dll_GetACP]
push eax
push 0xffffffffffffffff
push str.Remote_Desktop_client_closed.
lea ecx, [ebp - 0x120]
call fcn.0041d680
push 0
lea edx, [ebp - 0x120]
push 4
push edx
mov dword [ebp - 4], 0x46
call fcn.0048e9a0
add esp, 0xc
lea ecx, [ebp - 0x120]
mov dword [ebp - 4], 0xffffffff
call fcn.00403b50
mov eax, dword [ebp - 0x38]
mov ecx, dword [edi + 0x208]
push eax
add eax, 8
push ecx
push eax
call fcn.004825f0
mov ebx, dword [edi + 0x208]
add esp, 0xc
lea esi, [ebx - 8]
cmp esi, ebx
je 0x462e15
push 0
mov ecx, esi
call fcn.00482d80
add esi, 8
cmp esi, ebx
jne 0x462e05
add dword [edi + 0x208], 0xfffffff8
jmp 0x462eff
mov eax, dword [ebp - 0x1c]
push 0
push 0xa
lea ecx, [ebp - 0xd0]
push eax
push ecx
call fcn.00482170
push eax
lea edx, [ebp - 0xe0]
push str.Remote_Desktop_client_closed_with_exit_code
push edx
mov dword [ebp - 4], 0x47
call fcn.0044e080
push 0x8fb874
push eax
lea eax, [ebp - 0xbc]
mov byte [ebp - 4], 0x48
push eax
call fcn.0044de30
add esp, 0x28
mov esi, eax
mov byte [ebp - 4], 0x49
call dword [sym.imp.KERNEL32.dll_GetACP]
push eax
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0xac]
call fcn.0041def0
push 0
lea ecx, [ebp - 0xac]
push 4
push ecx
mov byte [ebp - 4], 0x4a
call fcn.0048e9a0
add esp, 0xc
lea ecx, [ebp - 0xac]
call fcn.00403b50
push 1
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 0x48
call fcn.00404c40
push 1
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 0x47
call fcn.00404c40
push 1
lea ecx, [ebp - 0xd0]
mov dword [ebp - 4], 0xffffffff
call fcn.00404c40
jmp 0x462de1
lea ecx, [esi + 4]
call fcn.00692c60
test al, al
je 0x462efb
mov edx, dword [ebp - 0x20]
push edx
push esi
push edi
call fcn.00469530
add esp, 0xc
add dword [ebp - 0x38], 8
mov eax, dword [ebp - 0x38]
mov ecx, dword [edi + 0x208]
cmp eax, ecx
jne 0x462d5f
lea ecx, [edi + 0x21c]
mov dword [ebp - 0x84], ecx
call fcn.006d09e0
mov byte [ebp - 0x80], 1
mov al, byte [edi + 0x250]
mov dword [ebp - 4], 0x4b
test al, al
jne 0x462f4a
mov ecx, dword [edi + 0x1d8]
mov al, byte [ecx + 0xb8]
test al, al
je 0x46300a
mov edx, dword [edi + 0x1d8]
mov al, byte [edx + 0xb8]
test al, al
je 0x462fe4
call dword [sym.imp.KERNEL32.dll_GetACP]
lea ecx, [ebp - 0x7c]
mov esi, eax
call fcn.004034c0
mov al, byte [ebp - 0x11]
push 0
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x4c
mov dword [ebp - 0x68], esi
mov byte [ebp - 0x64], al
call fcn.00404c40
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x4d
mov dword [ebp - 0x7c], vtable.dbcsstring.0
call fcn.00577bc0
mov edi, str.Auto_opening_SFTP_session.
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.Auto_opening_SFTP_session.
lea ecx, [ebp - 0x78]
call fcn.004030a0
push 0
lea ecx, [ebp - 0x7c]
push 2
push ecx
mov byte [ebp - 4], 0x4e
call fcn.0048e9a0
add esp, 0xc
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x4b
push 1
call fcn.00404c40
push 1
lea ecx, [ebp - 0x78]
call fcn.00404c40
mov edi, dword [ebp - 0x18]
mov edx, dword [edi + 0x1d8]
push edx
push 0
push edi
call fcn.0045ae60
mov eax, dword [edi + 0x1d8]
mov byte [edi + 0x250], 0
add esp, 0xc
mov byte [eax + 0xb8], 0
mov al, byte [edi + 0x251]
test al, al
jne 0x463028
mov ecx, dword [edi + 0x1d8]
mov al, byte [ecx + 0xb9]
test al, al
je 0x4632ef
mov edx, dword [edi + 0x1d8]
mov ebx, dword [ebp - 0x18]
mov al, byte [edx + 0xb9]
test al, al
je 0x46322c
lea eax, [ebp - 0xbc]
mov ecx, ebx
push eax
call fcn.0046cd80
lea esi, [ebx + 0x254]
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
mov byte [ebp - 4], 0x4f
call fcn.00402e90
push 1
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 0x4b
call fcn.00404c40
mov edi, 0x901024
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esi + 8]
push 0x901024
push ecx
push eax
mov ecx, esi
call fcn.004830c0
test eax, eax
jne 0x4630d6
mov dl, byte [ebp - 0x11]
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 0x34], dl
call fcn.00404c40
mov edi, 0x901024
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x901024
lea ecx, [ebp - 0x34]
call fcn.004030a0
mov eax, dword [ebp - 0x24]
or al, 1
mov dword [ebp - 0x24], eax
lea esi, [ebp - 0x34]
mov byte [ebp - 4], 0x50
jmp 0x4630fc
push 0x901018
lea eax, [ebp - 0xbc]
push esi
push eax
call fcn.0044de30
mov esi, eax
mov eax, dword [ebp - 0x24]
add esp, 0xc
or al, 2
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0x51
mov cl, byte [esi]
push 0
mov byte [ebp - 0x44], cl
lea ecx, [ebp - 0x44]
call fcn.00404c40
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x44]
call fcn.00402e90
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0x54
test al, 2
je 0x46313c
mov ecx, dword [ebp - 0x24]
push 1
and ecx, 0xfffffffd
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0xbc]
call fcn.00404c40
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0x53
test al, 1
je 0x463154
push 1
lea ecx, [ebp - 0x34]
call fcn.00404c40
lea edx, [ebp - 0x44]
lea eax, [ebp - 0xd0]
push edx
push str.Auto_opening
push eax
call fcn.0044e080
add esp, 0xc
mov esi, eax
mov byte [ebp - 4], 0x55
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0x900ffc
lea ecx, [ebp - 0xe0]
push esi
push ecx
mov edi, eax
call fcn.0044de30
add esp, 0xc
mov esi, eax
lea ecx, [ebp - 0x7c]
call fcn.004034c0
mov dl, byte [ebp - 0x11]
push 0
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x57
mov dword [ebp - 0x68], edi
mov byte [ebp - 0x64], dl
call fcn.00404c40
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x58
mov dword [ebp - 0x7c], vtable.dbcsstring.0
call fcn.00577bc0
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x7c]
call fcn.00421480
push 0
lea eax, [ebp - 0x7c]
push 2
push eax
mov byte [ebp - 4], 0x59
call fcn.0048e9a0
add esp, 0xc
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x56
push 1
call fcn.00404c40
push 1
lea ecx, [ebp - 0x78]
call fcn.00404c40
push 1
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 0x55
call fcn.00404c40
push 1
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0x53
call fcn.00404c40
push 1
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x4b
call fcn.00404c40
mov dword [ebp - 0x4c], 0
mov byte [ebp - 0x48], 1
mov byte [ebp - 0x47], 0
mov edi, 0x901024
or ecx, 0xffffffff
xor eax, eax
lea esi, [ebx + 0x254]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp - 4], 0x5a
push ecx
mov ecx, dword [esi + 8]
push 0x901024
push ecx
push eax
mov ecx, esi
call fcn.004830c0
test eax, eax
je 0x4632bc
mov eax, dword [ebx + 0x25c]
test eax, eax
je 0x4632bc
lea ecx, [ebp - 0x68]
call fcn.004034c0
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x5b
mov dword [ebp - 0x68], vtable.ascstring.0
call fcn.00402e90
mov edx, dword [ebx + 0x1d8]
lea eax, [ebp - 0x68]
push edx
push eax
push ebx
mov byte [ebp - 4], 0x5c
call fcn.004669d0
add esp, 0xc
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x5a
push 1
call fcn.00404c40
jmp 0x4632cc
mov ecx, dword [ebx + 0x1d8]
push ecx
push ebx
call fcn.00463c40
add esp, 8
mov edx, dword [ebx + 0x1d8]
mov byte [ebx + 0x251], 0
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x4b
mov byte [edx + 0xb9], 0
call fcn.0062b8b0
mov edi, dword [ebp - 0x18]
mov al, byte [edi + 0x252]
test al, al
jne 0x463310
mov eax, dword [edi + 0x1d8]
mov cl, byte [eax + 0xba]
test cl, cl
je 0x4639cb
mov edi, dword [ebp - 0x18]
mov ecx, dword [edi + 0x1d8]
mov al, byte [ecx + 0xba]
test al, al
je 0x4633c5
call dword [sym.imp.KERNEL32.dll_GetACP]
lea ecx, [ebp - 0xac]
mov esi, eax
call fcn.004034c0
mov dl, byte [ebp - 0x11]
push 0
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x5d
mov dword [ebp - 0x98], esi
mov byte [ebp - 0x94], dl
call fcn.00404c40
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 0x5e
mov dword [ebp - 0xac], vtable.dbcsstring.0
call fcn.00577bc0
mov edi, str.Auto_opening_Remote_Desktop_session.
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.Auto_opening_Remote_Desktop_session.
lea ecx, [ebp - 0xa8]
call fcn.004030a0
push 0
lea eax, [ebp - 0xac]
push 2
push eax
mov byte [ebp - 4], 0x5f
call fcn.0048e9a0
add esp, 0xc
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x4b
push 1
call fcn.00404c40
push 1
lea ecx, [ebp - 0xa8]
call fcn.00404c40
mov al, byte [0x951344]
test al, 1
jne 0x463456
mov cl, al
or cl, 1
mov byte [0x951344], cl
call dword [sym.imp.KERNEL32.dll_GetACP]
mov ecx, 0x95131c
mov esi, eax
call fcn.004034c0
mov cl, byte [ebp - 0x11]
push 0
mov byte [0x951334], cl
mov ecx, 0x951334
mov byte [ebp - 4], 0x60
mov dword [0x951330], esi
call fcn.00404c40
mov ecx, 0x95131c
mov byte [ebp - 4], 0x61
mov dword [0x95131c], 0x85219c
call fcn.00577bc0
mov edi, str.Listening_for_Remote_Desktop_client_2_server_connection_on
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.Listening_for_Remote_Desktop_client_2_server_connection_on
mov ecx, 0x951320
call fcn.004030a0
push 0x46ab70
mov byte [ebp - 4], 0x4b
call fcn.007ac037
add esp, 4
push 0x7c
call fcn.007d7320
mov esi, eax
add esp, 4
mov dword [ebp - 0xc0], esi
test esi, esi
mov byte [ebp - 4], 0x62
je 0x4634a1
push 1
lea ecx, [esi + 4]
mov dword [esi], 0
call fcn.00463bd0
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 0x63
mov dword [esi + 0x5c], 0
mov byte [esi + 0x64], 1
mov byte [esi + 0x65], 1
mov byte [esi + 0x66], 1
call fcn.004413f0
jmp 0x4634a3
xor esi, esi
mov dword [ebp - 0x3c], esi
mov byte [ebp - 0x38], 1
mov byte [ebp - 0x37], 0
lea ecx, [ebp - 0x1d0]
mov byte [ebp - 4], 0x64
mov dword [ebp - 0x20], esi
call fcn.0057deb0
lea edx, [ebp - 0x50]
lea ecx, [ebp - 0x1d0]
push edx
call fcn.0057ded0
mov esi, eax
push 0x866ac4
mov ecx, esi
call fcn.0057dac0
test al, al
je 0x4634f1
push 0x866ac4
mov ecx, esi
call fcn.0057da90
test al, al
je 0x463520
lea eax, [ebp - 0x30]
push 0x866ac4
push eax
lea ecx, [ebp - 0x1d0]
call fcn.0057ded0
mov ecx, eax
call fcn.0057da90
test al, al
je 0x463527
lea ecx, [ebp - 0x1d0]
call fcn.0057df80
cmp eax, 2
jl 0x463527
mov esi, str.127.0.0.1
jmp 0x46352c
mov esi, str.127.0.0.2
lea ecx, [ebp - 0x68]
call fcn.004034c0
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 4], 0x65
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x68], vtable.ascstring.0
push ecx
push esi
lea ecx, [ebp - 0x64]
call fcn.004030a0
mov byte [ebp - 4], 0x67
mov dword [ebp - 0x1c], 0
mov edi, dword [ebp - 0x18]
mov esi, 0xd3d
cmp esi, 0xd3d
jne 0x463588
mov ecx, dword [edi + 0x18]
push 0xffff
push 0x2710
mov ecx, dword [ecx]
mov edx, dword [ecx]
call dword [edx + 0x14]
mov esi, eax
jmp 0x463568
mov bl, 0x68
xor edi, edi
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], bl
mov dword [ebp - 0xa0], edi
call fcn.004413f0
mov dword [ebp - 0x88], edi
mov eax, dword [ebp - 0x60]
mov byte [ebp - 4], 0x69
cmp eax, edi
jne 0x4635b6
mov eax, 0x8522f4
push esi
push eax
lea ecx, [ebp - 0xa0]
call fcn.00691dc0
mov esi, dword [ebp - 0x20]
push eax
lea ecx, [esi + 0x24]
call fcn.00479ba0
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], bl
call fcn.0040e080
add esi, 4
push edi
mov ecx, esi
call fcn.00692820
mov ecx, dword [esi + 0x3c]
lea eax, [esi + 0x3c]
cmp ecx, edi
mov byte [ebp - 4], 0x67
jne 0x4635fd
mov ecx, esi
call fcn.00692eb0
lea ecx, [ebp - 0xd0]
push ecx
mov ecx, eax
call fcn.00692460
push eax
lea edx, [ebp - 0xe0]
push 0x951320
push edx
mov byte [ebp - 4], 0x6b
call fcn.0044df50
add esp, 0xc
mov esi, eax
mov bl, 0x6c
mov byte [ebp - 4], bl
call dword [sym.imp.KERNEL32.dll_GetACP]
mov edi, eax
push 0x901c04
lea eax, [ebp - 0xbc]
push esi
push eax
call fcn.0044de30
add esp, 0xc
mov esi, eax
lea ecx, [ebp - 0xac]
call fcn.004034c0
mov cl, byte [ebp - 0x11]
push 0
mov byte [ebp - 0x94], cl
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x6e
mov dword [ebp - 0x98], edi
call fcn.00404c40
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 0x6f
mov dword [ebp - 0xac], vtable.dbcsstring.0
call fcn.00577bc0
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0xac]
call fcn.00421480
push 0
lea edx, [ebp - 0xac]
push 2
push edx
mov byte [ebp - 4], 0x70
call fcn.0048e9a0
add esp, 0xc
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x6d
push 1
call fcn.00404c40
push 1
lea ecx, [ebp - 0xa8]
call fcn.00404c40
push 1
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], bl
call fcn.00404c40
push 1
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 0x6b
call fcn.00404c40
push 1
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0x67
call fcn.00404c40
mov edi, dword [ebp - 0x18]
mov eax, dword [edi + 0x1dc]
mov ecx, dword [eax + 0x54]
lea esi, [eax + 0x54]
test ecx, ecx
je 0x46372a
call fcn.00463a20
test al, al
jne 0x46372a
push 0
mov ecx, esi
call fcn.00690310
mov eax, dword [edi + 0x1d8]
mov esi, dword [esi]
mov ecx, dword [ebp - 0x20]
add eax, 0x3c
push esi
push eax
push ecx
call fcn.0049e3e0
add esp, 0xc
test al, al
je 0x463760
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x208]
lea ecx, [edx + 0x200]
lea edx, [ebp - 0x3c]
push edx
push eax
call fcn.0047ebf0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], 0x66
push 1
lea ecx, [ebp - 0x64]
mov byte [eax + 0x252], 0
mov eax, dword [eax + 0x1d8]
mov byte [ebp - 4], 0x64
mov byte [eax + 0xba], 0
call fcn.00404c40
mov ecx, dword [ebp - 0x3c]
mov byte [ebp - 4], 0x4b
test ecx, ecx
je 0x4639cb
mov al, byte [ebp - 0x38]
test al, al
je 0x4639c4
mov al, byte [ebp - 0x37]
test al, al
je 0x4639bd
push 3
call fcn.0047f2b0
jmp 0x4639c4
push 1
call fcn.0047f310
mov dword [ebp - 0x3c], 0
mov esi, dword [ebp - 0x18]
mov al, byte [esi + 0x253]
test al, al
je 0x4639e8
push esi
call fcn.00469df0
add esp, 4
mov byte [esi + 0x253], 0
mov al, byte [ebp - 0x80]
mov dword [ebp - 4], 0xffffffff
test al, al
je 0x463a01
mov ecx, dword [ebp - 0x84]
call fcn.006d0a70
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret