Function at 0x451c80
Capabilities:
Create process on windows
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x4b96f4
mov eax, dword fs:[0]
push eax
sub esp, 0x1c4
mov eax, dword [0x4de57c]
xor eax, esp
mov dword [esp + 0x1c0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4de57c]
xor eax, esp
push eax
lea eax, [esp + 0x1d8]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1e8]
xor ebx, ebx
cmp edi, ebx
mov ebp, ecx
jl 0x451e3f
mov ecx, dword [ebp + 0x3d4]
cmp ecx, ebx
lea esi, [ebp + 0x3d0]
mov dword [esp + 0x34], esi
je 0x451e3f
mov eax, dword [esi + 8]
sub eax, ecx
sar eax, 6
cmp edi, eax
jae 0x451e3f
cmp ecx, ebx
je 0x451d06
mov eax, dword [esi + 8]
sub eax, ecx
sar eax, 6
cmp edi, eax
jb 0x451d0b
call fcn.0048ed51
mov eax, edi
shl eax, 6
add eax, dword [esi + 4]
push 0xffffffffffffffff
push ebx
add eax, 0x24
mov edi, 0xf
push eax
lea ecx, [esp + 0xf0]
mov dword [esp + 0x108], edi
mov dword [esp + 0x104], ebx
mov byte [esp + 0xf4], bl
call fcn.00401cf0
lea eax, [esp + 0xe4]
push eax
mov dword [esp + 0x1e4], ebx
call fcn.0044e3f0
add esp, 4
push str.161AD4DC_D090_4891_875C_19930C8C2A30
lea ecx, [esp + 0x120]
call fcn.0044e150
cmp dword [esp + 0xfc], 0x10
mov eax, dword [esp + 0xe8]
mov byte [esp + 0x1e0], 1
jae 0x451d88
lea eax, [esp + 0xe8]
push str.chat.dll
push eax
call fcn.004903a0
add esp, 8
mov esi, eax
neg esi
sbb esi, esi
neg esi
mov dword [esp + 0x2c], esi
jne 0x451e6b
cmp dword [esp + 0xfc], 0x10
mov eax, dword [esp + 0xe8]
jae 0x451dc0
lea eax, [esp + 0xe8]
push str.netstorage.dll
push eax
call fcn.004903a0
add esp, 8
mov esi, eax
neg esi
sbb esi, esi
push 0x26
neg esi
push str.161AD4DC_D090_4891_875C_200908182A30
lea ecx, [esp + 0x124]
mov dword [esp + 0x34], esi
call fcn.0044b360
cmp esi, ebx
jne 0x451e6b
cmp dword [esp + 0x134], 8
jb 0x451e0b
mov ecx, dword [esp + 0x120]
push ecx
call fcn.0048d433
add esp, 4
cmp dword [esp + 0xfc], 0x10
mov dword [esp + 0x134], 7
mov dword [esp + 0x130], ebx
mov word [esp + 0x120], bx
jb 0x451e3f
mov edx, dword [esp + 0xe8]
push edx
call fcn.0048d433
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x1d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1c0]
xor ecx, esp
call fcn.0048de34
add esp, 0x1d0
ret 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x140]
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], bx
call fcn.0044ae60
call fcn.0044dd30
add esp, 0x1c
cmp esi, ebx
mov dword [esp + 0x30], eax
je 0x451ee0
mov esi, eax
cmp esi, ebx
je 0x451ee0
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x451ebc
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea ecx, [esp + 0x11c]
call fcn.00449ed0
lea ecx, [esp + 0xe4]
call fcn.00401cb0
jmp 0x451e3f
mov ecx, dword [esp + 0x1e8]
push ecx
mov ecx, dword [esp + 0x38]
call fcn.004458a0
add eax, 0x24
cmp dword [eax + 0x18], 0x10
jb 0x451eff
mov eax, dword [eax + 4]
jmp 0x451f02
add eax, 4
push eax
lea ecx, [esp + 0x1c]
call fcn.0041a910
mov esi, dword [esp + 0x18]
cmp esi, ebx
mov byte [esp + 0x1e0], 2
je 0x451f20
mov eax, dword [esi]
jmp 0x451f22
xor eax, eax
push eax
lea ecx, [esp + 0x158]
call fcn.0044e150
push 0xffffffffffffffff
push 1
push 0xffffffffffffffff
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x164]
mov byte [esp + 0x1f0], 3
mov dword [esp + 0x24], 0x5c
call fcn.004475d0
add eax, 1
push eax
lea ecx, [esp + 0x15c]
call fcn.00448a90
cmp esi, ebx
je 0x451f6e
mov esi, dword [esi]
jmp 0x451f70
xor esi, esi
push esi
lea ecx, [esp + 0x1ac]
call fcn.0044e150
mov ecx, dword [ebp + 4]
lea eax, [esp + 0x58]
push eax
push ecx
mov byte [esp + 0x1e8], 4
call dword [sym.imp.USER32.dll_GetWindowRect]
push str.__account:
lea ecx, [esp + 0xcc]
call fcn.0044e150
lea ecx, [esp + 0x38]
mov byte [esp + 0x1e0], 5
call fcn.00440e10
mov eax, dword [ebp + 0x374]
cmp eax, ebx
mov byte [esp + 0x1e0], 6
jne 0x451fcc
xor esi, esi
jmp 0x451fd4
mov esi, dword [ebp + 0x378]
sub esi, eax
cmp eax, ebx
je 0x451fe2
mov edx, dword [ebp + 0x378]
sub edx, eax
jne 0x451fe7
call fcn.0048ed51
mov eax, dword [ebp + 0x374]
push esi
push eax
lea ecx, [esp + 0x40]
call fcn.00402930
mov dword [esp + 0x150], edi
mov dword [esp + 0x14c], ebx
mov byte [esp + 0x13c], bl
lea ecx, [esp + 0x138]
push ecx
push 0x12
lea ecx, [esp + 0x40]
mov byte [esp + 0x1e8], 7
call fcn.0044fce0
lea edx, [esp + 0x138]
push 0x4bf904
push edx
call fcn.0041d400
add esp, 8
test al, al
jne 0x45230a
lea eax, [esp + 0x138]
push str.0000
push eax
call fcn.0041d400
add esp, 8
test al, al
jne 0x45230a
mov dword [esp + 0x118], edi
mov dword [esp + 0x114], ebx
mov byte [esp + 0x104], bl
mov dword [esp + 0x188], edi
mov dword [esp + 0x184], ebx
mov byte [esp + 0x174], bl
mov dword [esp + 0x1a4], edi
mov dword [esp + 0x1a0], ebx
mov byte [esp + 0x190], bl
lea ecx, [esp + 0x170]
push ecx
mov esi, 0x10
push esi
lea ecx, [esp + 0x40]
mov byte [esp + 0x1e8], 0xe
call fcn.0044fce0
cmp dword [esp + 0x188], esi
mov eax, dword [esp + 0x174]
jae 0x4520d7
lea eax, [esp + 0x174]
push eax
lea ecx, [esp + 0x18]
call fcn.0041a910
mov eax, dword [eax]
cmp eax, ebx
mov byte [esp + 0x1e0], 0xf
je 0x4520f3
mov eax, dword [eax]
jmp 0x4520f5
xor eax, eax
push eax
lea ecx, [esp + 0xcc]
call fcn.0044e1c0
lea ecx, [esp + 0x14]
mov byte [esp + 0x1e0], 0xe
call fcn.00425080
push str.__pswd:
lea ecx, [esp + 0xcc]
call fcn.0044e1c0
lea edx, [esp + 0x18c]
push edx
push 0x11
lea ecx, [esp + 0x40]
call fcn.0044fce0
cmp dword [esp + 0x1a4], esi
mov eax, dword [esp + 0x190]
jae 0x45214e
lea eax, [esp + 0x190]
push eax
lea ecx, [esp + 0x18]
call fcn.0041a910
mov eax, dword [eax]
cmp eax, ebx
mov byte [esp + 0x1e0], 0x10
je 0x45216a
mov eax, dword [eax]
jmp 0x45216c
xor eax, eax
push eax
lea ecx, [esp + 0xcc]
call fcn.0044e1c0
lea ecx, [esp + 0x14]
mov byte [esp + 0x1e0], 0xe
call fcn.00425080
push str.__pid:
lea ecx, [esp + 0xcc]
call fcn.0044e1c0
cmp dword [esp + 0x150], esi
mov eax, dword [esp + 0x13c]
jae 0x4521b2
lea eax, [esp + 0x13c]
push eax
lea ecx, [esp + 0x18]
call fcn.0041a910
mov eax, dword [eax]
cmp eax, ebx
mov byte [esp + 0x1e0], 0x11
je 0x4521ce
mov eax, dword [eax]
jmp 0x4521d0
xor eax, eax
push eax
lea ecx, [esp + 0xcc]
call fcn.0044e1c0
lea ecx, [esp + 0x14]
mov byte [esp + 0x1e0], 0xe
call fcn.00425080
lea eax, [esp + 0x100]
push eax
push 1
lea ecx, [esp + 0x40]
call fcn.0044fce0
push str.__pidaccount:
lea ecx, [esp + 0xcc]
call fcn.0044e1c0
cmp dword [esp + 0x118], esi
mov eax, dword [esp + 0x104]
jae 0x452229
lea eax, [esp + 0x104]
push eax
lea ecx, [esp + 0x18]
call fcn.0041a910
mov eax, dword [eax]
cmp eax, ebx
mov byte [esp + 0x1e0], 0x12
je 0x452245
mov eax, dword [eax]
jmp 0x452247
xor eax, eax
push eax
lea ecx, [esp + 0xcc]
call fcn.0044e1c0
lea ecx, [esp + 0x14]
mov byte [esp + 0x1e0], 0xe
call fcn.00425080
push esi
lea ecx, [esp + 0x1c8]
push ecx
push 2
lea ecx, [esp + 0x44]
call fcn.00402670
push str.__pidpswd:
lea ecx, [esp + 0xcc]
call fcn.0044e1c0
push esi
lea edx, [esp + 0x1c8]
push edx
lea eax, [esp + 0x70]
push eax
call fcn.00440c20
add esp, 0xc
cmp dword [eax + 0x18], esi
mov byte [esp + 0x1e0], 0x13
jb 0x4522b2
mov eax, dword [eax + 4]
jmp 0x4522b5
add eax, 4
push eax
lea ecx, [esp + 0x18]
call fcn.0041a910
mov eax, dword [eax]
cmp eax, ebx
mov byte [esp + 0x1e0], 0x14
je 0x4522d1
mov eax, dword [eax]
jmp 0x4522d3
xor eax, eax
push eax
lea ecx, [esp + 0xcc]
call fcn.0044e1c0
lea ecx, [esp + 0x14]
call fcn.00425080
lea ecx, [esp + 0x68]
call fcn.00401cb0
lea ecx, [esp + 0x18c]
call fcn.00401cb0
lea ecx, [esp + 0x170]
jmp 0x45241a
mov dword [esp + 0x118], edi
mov dword [esp + 0x114], ebx
mov byte [esp + 0x104], bl
lea ecx, [esp + 0x100]
push ecx
push 1
lea ecx, [esp + 0x40]
mov byte [esp + 0x1e8], 8
call fcn.0044fce0
mov eax, dword [esp + 0x104]
mov esi, 0x10
cmp dword [esp + 0x118], esi
jae 0x452356
lea eax, [esp + 0x104]
push eax
lea ecx, [esp + 0x18]
call fcn.0041a910
mov eax, dword [eax]
cmp eax, ebx
mov byte [esp + 0x1e0], 9
je 0x452372
mov eax, dword [eax]
jmp 0x452374
xor eax, eax
push eax
lea ecx, [esp + 0xcc]
call fcn.0044e1c0
lea ecx, [esp + 0x14]
mov byte [esp + 0x1e0], 8
call fcn.00425080
push str.__pswd:
lea ecx, [esp + 0xcc]
call fcn.0044e1c0
push esi
lea edx, [esp + 0x1c8]
push edx
push 2
lea ecx, [esp + 0x44]
call fcn.00402670
push esi
lea eax, [esp + 0x1c8]
push eax
lea ecx, [esp + 0x70]
push ecx
call fcn.00440c20
add esp, 0xc
cmp dword [eax + 0x18], esi
mov byte [esp + 0x1e0], 0xa
jb 0x4523df
mov eax, dword [eax + 4]
jmp 0x4523e2
add eax, 4
push eax
lea ecx, [esp + 0x18]
call fcn.0041a910
mov eax, dword [eax]
cmp eax, ebx
mov byte [esp + 0x1e0], 0xb
je 0x4523fe
mov eax, dword [eax]
jmp 0x452400
xor eax, eax
push eax
lea ecx, [esp + 0xcc]
call fcn.0044e1c0
lea ecx, [esp + 0x14]
call fcn.00425080
lea ecx, [esp + 0x68]
call fcn.00401cb0
lea ecx, [esp + 0x100]
mov byte [esp + 0x1e0], 7
call fcn.00401cb0
push str.__chatUrl:
lea ecx, [esp + 0xcc]
call fcn.0044e1c0
cmp dword [ebp + 0x420], esi
jb 0x452454
mov eax, dword [ebp + 0x40c]
jmp 0x45245a
lea eax, [ebp + 0x40c]
push eax
lea ecx, [esp + 0x18]
call fcn.0041a910
mov eax, dword [eax]
cmp eax, ebx
mov byte [esp + 0x1e0], 0x15
je 0x452476
mov eax, dword [eax]
jmp 0x452478
xor eax, eax
push eax
lea ecx, [esp + 0xcc]
call fcn.0044e1c0
lea ecx, [esp + 0x14]
call fcn.00425080
lea ecx, [esp + 0x138]
call fcn.00401cb0
lea ecx, [esp + 0x38]
mov byte [esp + 0x1e0], 5
call fcn.00440d70
push 0x40
lea edx, [esp + 0x8c]
push ebx
push edx
call fcn.0048ea70
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x70]
sub ecx, eax
mov dword [esp + 0xa8], ecx
mov ecx, dword [esp + 0x68]
add eax, 0x10
sub edx, ecx
mov dword [esp + 0xa0], eax
xor eax, eax
add ecx, 0x10
add esp, 0xc
mov dword [esp + 0x84], 0x44
mov word [esp + 0xb4], 1
mov dword [esp + 0xa0], edx
mov dword [esp + 0x98], ecx
mov dword [esp + 0xb0], 7
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0xdc]
push ebx
add eax, 1
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x1e8], 0x16
call fcn.0044fc10
mov eax, dword [esp + 0x20]
cmp eax, ebx
mov ecx, dword [esp + 0x24]
jne 0x45255f
xor esi, esi
jmp 0x452565
mov esi, ecx
sub esi, eax
sar esi, 1
mov edi, dword [esp + 0xcc]
mov ebp, 8
cmp dword [esp + 0xe0], ebp
jae 0x452581
lea edi, [esp + 0xcc]
cmp eax, ebx
je 0x45258b
sub ecx, eax
sar ecx, 1
jne 0x452594
call fcn.0048ed51
mov eax, dword [esp + 0x20]
lea ecx, [esi + esi]
push ecx
push edi
push eax
call fcn.004904b0
mov esi, dword [esp + 0x164]
add esp, 0xc
cmp dword [esp + 0x16c], ebp
jae 0x4525b9
lea esi, [esp + 0x158]
mov ecx, dword [esp + 0x20]
cmp ecx, ebx
je 0x4525cb
mov edx, dword [esp + 0x24]
sub edx, ecx
sar edx, 1
jne 0x4525d4
call fcn.0048ed51
mov ecx, dword [esp + 0x20]
cmp dword [esp + 0x1c0], ebp
mov eax, dword [esp + 0x1ac]
jae 0x4525eb
lea eax, [esp + 0x1ac]
lea edx, [esp + 0x48]
push edx
lea edx, [esp + 0x88]
push edx
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x452665
mov eax, dword [esp + 0x48]
push 0x1388
push eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov ecx, dword [esp + 0x4c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
cmp dword [esp + 0x2c], ebx
je 0x4526a0
sub esp, 0x1c
lea edx, [esp + 0x138]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
call fcn.0044d560
call fcn.0044dd30
mov ebp, eax
add esp, 0x1c
cmp ebp, ebx
jne 0x4526a4
mov eax, dword [esp + 0x48]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [esp + 0x48]
push ecx
call esi
lea ecx, [esp + 0x1c]
call fcn.0044ad80
lea ecx, [esp + 0xc8]
call fcn.00449ed0
lea ecx, [esp + 0x1a8]
call fcn.00449ed0
lea ecx, [esp + 0x154]
call fcn.00449ed0
lea ecx, [esp + 0x18]
call fcn.00425080
jmp 0x451ec3
mov ebp, dword [esp + 0x30]
mov edx, dword [esp + 0x48]
push edx
call esi
mov edi, dword [esp + 0x1e8]
mov esi, dword [esp + 0x34]
push edi
mov ecx, esi
call fcn.0044f080
cmp dword [eax + 0x18], ebp
je 0x4526ef
push edi
mov ecx, esi
call fcn.0044f080
mov eax, dword [eax + 0x18]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4526ef
push ebx
push ebx
push 0x10
push edi
mov ecx, esi
call fcn.0044f080
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
push edi
mov ecx, esi
call fcn.0044f080
lea ecx, [esp + 0x1c]
mov dword [eax + 0x18], ebp
call fcn.0044ad80
lea ecx, [esp + 0xc8]
call fcn.00449ed0
lea ecx, [esp + 0x1a8]
call fcn.00449ed0
lea ecx, [esp + 0x154]
call fcn.00449ed0
lea ecx, [esp + 0x18]
call fcn.00425080
lea ecx, [esp + 0x11c]
call fcn.00449ed0
lea ecx, [esp + 0xe4]
call fcn.00401cb0
mov eax, 1
jmp 0x451e41