Function at 0x46be90
Capabilities:
Acquire debug privileges
Check os version
Get disk information
Get disk size
Get memory capacity
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x538a60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.GlobalREACT
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call edi
test esi, esi
je 0x46c352
cmp eax, 0xb7
je 0x46c352
cmp eax, 5
je 0x46c352
lea eax, [ebp - 0x19c]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetControlSession_ManagerEnvironment
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46c34b
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x400
push eax
push 0x560e08
push 0
push 0
push str.PROCESSOR_ARCHITECTURE
push dword [ebp - 0x19c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x19c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea eax, [ebp - 0x198]
push eax
push 0
push 0x28
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
push eax
call ebx
test eax, eax
jne 0x46bf8f
call edi
cmp eax, 0x3f0
jne 0x46bf8f
push 2
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
test eax, eax
jne 0x46bf71
push str.environmentOk:_SecurityImpersonation_error_n
jmp 0x46c357
lea eax, [ebp - 0x198]
push eax
push 0
push 0x28
call esi
push eax
call ebx
test eax, eax
jne 0x46bf8f
push str.environmentOk:_OpenThreadToken_error_n
jmp 0x46c357
lea eax, [ebp - 0x1c]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x46bfb9
call edi
push eax
push str.environmentOk:_LookupPrivilegeValue_error:__u_n
call fcn.004bc829
add esp, 8
jmp 0x46c35f
mov eax, dword [ebp - 0x1c]
push 0
push 0
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
push 0x10
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
push 0
push dword [ebp - 0x198]
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x20], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x46c004
call edi
push eax
push str.environmentOk:_AdjustTokenPrivileges_error:__u_n
call fcn.004bc829
add esp, 8
jmp 0x46c35f
call edi
cmp eax, 0x514
jne 0x46c017
push str.You_must_execute_with_administrator_rights._n
jmp 0x46c357
push 0x1000
push 0x54ed60
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 9
jb 0x46c375
add eax, 0xfffffff7
je 0x46c344
add eax, eax
cmp eax, 0x2000
jae 0x46c389
push 0x54ed60
push str._sPGPsdk.dll
xor ecx, ecx
push 0x1000
push 0x550d60
mov word [eax + 0x54ed60], cx
call fcn.004bb50e
add esp, 0x10
mov edx, 0x528c30
mov ecx, 0x550d60
call fcn.0045d5f0
cmp byte [0x53eb77], 0
jne 0x46c09c
push 0x54ed60
push 0x1000
push 0x55ed60
call fcn.004bb73b
add esp, 0xc
movzx eax, word [0x55ed60]
push eax
push str._c:_
push 0x1000
push 0x550d60
call fcn.004bb50e
add esp, 0x10
push 0x550d60
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
je 0x46c0e8
cmp eax, 2
je 0x46c0ed
cmp eax, 3
je 0x46c0e8
push eax
push str.Unsupported_drive_type__code__d__see_MSDN_GetDriveType_n
call fcn.004bc829
add esp, 8
jmp 0x46c35f
cmp eax, 2
jne 0x46c152
push 0x1000
push 0x552d60
push 0
push 0
push 0
push 0
push 0
push 0x550d60
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x46c127
push 0x550d60
push str.Failed_to_get_volume_information__S_n
call fcn.004bc829
add esp, 8
jmp 0x46c35f
push 0x52655c
push 0x552d60
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x46c152
push 0x552d60
push str.REACT_requires_an_NTFS_formatted_drive_found__S_n
call fcn.004bc829
add esp, 8
jmp 0x46c35f
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x550d60
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
lea eax, [ebp - 0x70]
mov dword [ebp - 0x70], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x46c18f
push str.GlobalMemoryStatus_failed_n
jmp 0x46c357
cmp byte [0x53eb66], 0
je 0x46c2be
push str.Warning_:_Disk_space_checking_disabled__n
call fcn.004bc829
mov ecx, dword [ebp - 0x194]
add esp, 4
call fcn.0046bd70
push eax
push 0x550d60
push str.Disk_space_on__S_free___s__n
call fcn.004bc829
add esp, 0xc
cmp byte [0x53eb76], 0
je 0x46c259
mov eax, dword [0x53ec50]
xor edi, edi
test eax, eax
je 0x46c23a
push 0x1000
push eax
call fcn.004bbd22
mov ebx, eax
add esp, 8
xor esi, esi
test ebx, ebx
je 0x46c23a
mov ecx, dword [0x53ec50]
movsx ecx, byte [ecx + esi]
push ecx
push str._c:_
push 0x1000
push 0x550d60
call fcn.004bb50e
add esp, 0x10
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x550d60
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
add edi, dword [ebp - 0xc]
inc esi
cmp esi, ebx
jb 0x46c1f5
mov eax, edi
shr eax, 1
cmp dword [ebp - 0x194], eax
jae 0x46c259
push edi
push 0x55ed60
push str.Low_disk_space_on__S_to_acquire_disks___d_clusters_n
call fcn.004bc829
add esp, 0xc
push 0x11c
lea eax, [ebp - 0x190]
push 0
push eax
call fcn.004c13c0
add esp, 0xc
mov dword [ebp - 0x190], 0x11c
mov dword [ebp - 0x18c], 6
push 3
push 2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
push 2
lea eax, [ebp - 0x190]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
setne byte [0x53eb9d]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bae74
mov esp, ebp
pop ebp
ret
cmp byte [0x53eb9c], 0
je 0x46c306
mov edx, dword [ebp - 0x68]
xor edi, edi
mov esi, dword [ebp - 0x64]
mov ecx, edx
mov eax, esi
shrd ecx, eax, 0xc
shr eax, 0xc
cmp edi, eax
ja 0x46c1c7
jb 0x46c2f0
cmp dword [ebp - 0x194], ecx
jae 0x46c1c7
push esi
push edx
push 0x550d60
push str.Low_disk_space_on__S_to_store_memory__llu_n
call fcn.004bc829
add esp, 0x10
jmp 0x46c35f
mov ecx, dword [ebp - 0x194]
cmp ecx, 0x280000
jae 0x46c1c7
call fcn.0046bd70
push eax
push 0x550d60
push str.Low_disk_space_on__S_to_store_REACT_output__s_n
call fcn.004bc829
add esp, 0xc
push str.REACT_requires_at_least_10Gb_of_free_disk_space_n
call fcn.004bc829
add esp, 4
push str.This_check_can_be_suppresed_with_the_flag_nochecks_n
jmp 0x46c357
push str.Unexpected_rename_of_executable_n
jmp 0x46c357
push str.REACT_must_be_executed_with_Administrator_rights_n
jmp 0x46c357
push str.REACT_is_already_running_n
call fcn.004bc829
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bae74
mov esp, ebp
pop ebp
ret
push str.Failed_to_obtain_react.exe_module_path_n
call fcn.004bc829
add esp, 4
push 1
call fcn.004bcc8d
call fcn.004bbfd4
int3