Function at 0x4275b0
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5af2e3
mov eax, dword fs:[0]
push eax
sub esp, 0x4a0
mov eax, dword [0x620024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x41c], 0
mov dword [ebp - 4], 0
call fcn.00449b3d
mov ecx, eax
test ecx, ecx
je 0x428b29
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x42c], eax
mov byte [ebp - 4], 1
mov eax, dword [0x62b984]
add eax, 0xfffffff0
push eax
call fcn.00405670
add esp, 4
lea edi, [eax + 0x10]
mov dword [ebp - 0x430], edi
lea ecx, [ebp - 0x458]
mov byte [ebp - 4], 2
call fcn.0044c4f3
lea eax, [edi - 0x10]
mov byte [ebp - 4], 4
mov ecx, dword [eax]
mov dword [ebp - 0x43c], eax
test ecx, ecx
je 0x42765a
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x427672
call fcn.00449b3d
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x428b33
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
push 0x11
push 0x5f61f8
push dword [edi - 0xc]
add eax, 0x10
mov dword [ebp - 0x41c], 1
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x418]
push edi
push eax
call fcn.00416370
mov esi, dword [ebp - 0x418]
add esp, 0x14
mov ecx, esi
call fcn.00429200
mov byte [ebp - 0x411], al
add esi, 0xfffffff0
mov dword [ebp - 0x41c], 0
or ecx, 0xffffffff
mov byte [ebp - 4], 3
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4276e5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov al, byte [ebp - 0x411]
test al, al
je 0x427784
mov byte [ebp - 4], 5
mov ecx, dword [edi - 0x10]
test ecx, ecx
je 0x427705
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x42771d
call fcn.00449b3d
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x428b3d
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
push 0x11
push 0x5f61f8
push dword [edi - 0xc]
add eax, 0x10
mov dword [ebp - 0x41c], 2
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x418]
push edi
push eax
call fcn.00416370
mov esi, dword [ebp - 0x418]
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x41c], 0
add esi, 0xfffffff0
mov byte [ebp - 4], 3
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x427784
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 6
mov ecx, dword [edi - 0x10]
test ecx, ecx
je 0x42779c
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x4277b4
call fcn.00449b3d
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x428b29
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
push 0xf
push 0x5f4038
push dword [edi - 0xc]
add eax, 0x10
mov dword [ebp - 0x41c], 4
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x418]
push edi
push eax
call fcn.00416370
mov eax, dword [ebp - 0x418]
add esp, 0x14
test eax, eax
je 0x428b29
mov ecx, dword [ebp + 8]
mov edx, eax
nop dword [eax + eax]
mov si, word [ecx]
cmp si, word [edx]
jne 0x427826
test si, si
je 0x427822
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x427826
add ecx, 4
add edx, 4
test si, si
jne 0x427800
xor esi, esi
jmp 0x42782b
sbb esi, esi
or esi, 1
lea edx, [eax - 0x10]
mov dword [ebp - 0x41c], 0
mov byte [ebp - 4], 3
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x427851
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
jne 0x427a29
push ecx
mov esi, esp
mov dword [ebp - 0x424], esi
call fcn.00449b3d
mov ecx, eax
test ecx, ecx
je 0x428b5b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
mov eax, 0x5f4038
mov byte [ebp - 4], 7
mov ecx, esi
test eax, 0xffff0000
jne 0x42789a
movzx eax, ax
push eax
call fcn.00403130
jmp 0x4278a6
push 0xf
push 0x5f4038
call fcn.00402d30
mov byte [ebp - 4], 3
call fcn.00428c70
add esp, 4
test al, al
je 0x427de2
mov byte [ebp - 4], 8
mov ecx, dword [edi - 0x10]
test ecx, ecx
je 0x4278d2
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x4278ea
call fcn.00449b3d
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x428b47
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
push 0x16
push 0x5f4078
push dword [edi - 0xc]
add eax, 0x10
mov dword [ebp - 0x41c], 8
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x418]
push edi
push eax
call fcn.00416370
mov esi, dword [ebp - 0x418]
add esp, 0x14
mov ecx, esi
call fcn.00429200
mov byte [ebp - 0x411], al
add esi, 0xfffffff0
mov dword [ebp - 0x41c], 0
or ecx, 0xffffffff
mov byte [ebp - 4], 3
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x42795d
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov al, byte [ebp - 0x411]
test al, al
je 0x427a06
push ecx
mov eax, esp
lea edx, [ebp - 0x430]
push 0x5f4078
push edx
push eax
lea esi, [ebp - 0x458]
call fcn.00415e40
add esp, 0xc
mov ecx, esi
call fcn.0041e3c0
add esp, 4
test al, al
je 0x427de2
cmp dword [ebp - 0x450], 0
jle 0x428b6f
mov esi, dword [ebp - 0x454]
mov byte [ebp - 4], 9
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x4279c2
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x4279da
call fcn.00449b3d
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x428b51
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x41c], 0x20
mov dword [ebp - 0x418], eax
mov eax, dword [esi]
push dword [eax - 0xc]
push eax
push 2
push 0x5f621c
jmp 0x427ca1
push 0x10
push str.EDEwOutlookGeneral.txt
push 0x5f6260
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [ebp - 0x411], 0
or esi, 0xffffffff
jmp 0x428671
mov byte [ebp - 4], 0xa
mov ecx, dword [edi - 0x10]
test ecx, ecx
je 0x427a41
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x427a59
call fcn.00449b3d
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x428b29
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
push 0xf
push 0x5f4058
push dword [edi - 0xc]
add eax, 0x10
mov dword [ebp - 0x41c], 0x40
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x418]
push edi
push eax
call fcn.00416370
mov eax, dword [ebp - 0x418]
add esp, 0x14
test eax, eax
je 0x428b29
mov ecx, dword [ebp + 8]
mov edx, eax
mov si, word [ecx]
cmp si, word [edx]
jne 0x427ac6
test si, si
je 0x427ac2
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x427ac6
add ecx, 4
add edx, 4
test si, si
jne 0x427aa0
xor esi, esi
jmp 0x427acb
sbb esi, esi
or esi, 1
lea edx, [eax - 0x10]
mov dword [ebp - 0x41c], 0
mov byte [ebp - 4], 3
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x427af1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
jne 0x427d72
push ecx
mov esi, esp
mov dword [ebp - 0x424], esi
call fcn.00449b3d
mov ecx, eax
test ecx, ecx
je 0x428b5b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
mov eax, 0x5f4058
mov byte [ebp - 4], 0xb
mov ecx, esi
test eax, 0xffff0000
jne 0x427b3a
movzx eax, ax
push eax
call fcn.00403130
jmp 0x427b46
push 0xf
push 0x5f4058
call fcn.00402d30
mov byte [ebp - 4], 3
call fcn.00428c70
add esp, 4
test al, al
je 0x427de2
mov byte [ebp - 4], 0xc
mov ecx, dword [edi - 0x10]
test ecx, ecx
je 0x427b72
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x427b8a
call fcn.00449b3d
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x428b65
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
push 0x17
push 0x5f40a8
push dword [edi - 0xc]
add eax, 0x10
mov dword [ebp - 0x41c], 0x80
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x418]
push edi
push eax
call fcn.00416370
mov esi, dword [ebp - 0x418]
add esp, 0x14
mov ecx, esi
call fcn.00429200
mov byte [ebp - 0x411], al
add esi, 0xfffffff0
mov dword [ebp - 0x41c], 0
or ecx, 0xffffffff
mov byte [ebp - 4], 3
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x427bfd
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov al, byte [ebp - 0x411]
test al, al
je 0x427d4f
push ecx
mov eax, esp
lea edx, [ebp - 0x430]
push 0x5f40a8
push edx
push eax
lea esi, [ebp - 0x458]
call fcn.00415e40
add esp, 0xc
mov ecx, esi
call fcn.0041e3c0
add esp, 4
test al, al
je 0x427de2
cmp dword [ebp - 0x450], 0
jle 0x428b6f
mov esi, dword [ebp - 0x454]
mov byte [ebp - 4], 0xd
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x427c62
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x427c7a
call fcn.00449b3d
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x428b74
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x41c], 0x200
mov dword [ebp - 0x418], eax
mov eax, dword [esi]
push dword [eax - 0xc]
push eax
push 2
push 0x5f62b0
lea eax, [ebp - 0x418]
push eax
call fcn.00416370
mov eax, dword [ebp - 0x418]
add esp, 0x14
mov esi, dword [ebp - 0x42c]
lea edi, [eax - 0x10]
lea edx, [esi - 0x10]
mov dword [ebp - 0x428], edx
cmp edi, edx
je 0x427d2a
cmp dword [edx + 0xc], 0
lea esi, [edx + 0xc]
jl 0x427d15
mov ecx, dword [edi]
cmp ecx, dword [edx]
jne 0x427d15
push edi
call fcn.00405670
add esp, 4
mov dword [ebp - 0x438], eax
or ecx, 0xffffffff
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x427d0a
mov esi, dword [ebp - 0x428]
push esi
mov ecx, dword [esi]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x438]
add eax, 0x10
mov dword [ebp - 0x42c], eax
jmp 0x427d24
push dword [eax - 0xc]
lea ecx, [ebp - 0x42c]
push eax
call fcn.00402d30
mov esi, dword [ebp - 0x42c]
mov dword [ebp - 0x41c], 0
or eax, 0xffffffff
mov byte [ebp - 4], 3
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x427d78
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x427d78
push 0x10
push str.EDEwOutlookSchedule.txt
push 0x5f6260
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [ebp - 0x411], 0
or esi, 0xffffffff
jmp 0x428671
mov esi, dword [ebp - 0x42c]
push 6
push 2
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x42c]
call fcn.00416150
mov ecx, 0x5f41ec
mov eax, dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x427dbb
test dx, dx
je 0x427db7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x427dbb
add eax, 4
add ecx, 4
test dx, dx
jne 0x427d95
xor edi, edi
jmp 0x427dc0
sbb edi, edi
or edi, 1
mov edx, dword [ebp - 0x428]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x427dde
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
jne 0x427df1
mov byte [ebp - 0x411], 0
or esi, 0xffffffff
jmp 0x428671
call fcn.0044bbac
mov ecx, dword [eax + 4]
call fcn.0044889d
push 0xa8
mov byte [ebp - 4], 0xe
call fcn.0043f966
mov edi, eax
mov dword [ebp - 0x428], eax
add esp, 4
mov dword [ebp - 0x424], edi
mov byte [ebp - 4], 0xf
test edi, edi
je 0x427e3b
push 0
push 0xc5
mov ecx, edi
call fcn.0043f9c1
mov dword [edi], vtable.CWaitDlg.0
jmp 0x427e43
xor edi, edi
mov dword [ebp - 0x428], edi
mov byte [ebp - 4], 0xe
mov ecx, edi
mov eax, dword [edi]
push 0
push 0xc5
call dword [eax + 0x164]
push 5
mov ecx, edi
call fcn.00441895
push 0x105
push 0
push 0
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_RedrawWindow]
push ecx
mov edi, esp
mov dword [ebp - 0x424], edi
call fcn.00449b3d
mov ecx, eax
test ecx, ecx
je 0x428b29
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
mov eax, str.OUTLOOK.EXE
mov byte [ebp - 4], 0x10
mov ecx, edi
test eax, 0xffff0000
jne 0x427eb4
movzx eax, ax
push eax
call fcn.00403130
jmp 0x427ec0
push 0xb
push str.OUTLOOK.EXE
call fcn.00402d30
mov byte [ebp - 4], 0xe
call fcn.00429540
add esp, 4
test al, al
je 0x427ee0
mov ecx, 0x3e8
call fcn.00428bf0
jmp 0x427e73
push ecx
mov edi, esp
mov dword [ebp - 0x424], edi
call fcn.00449b3d
mov ecx, eax
test ecx, ecx
je 0x428b29
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
mov ecx, str.SearchProtocolHost.exe
mov byte [ebp - 4], 0x11
shr ecx, 0x10
mov eax, str.SearchProtocolHost.exe
movzx eax, ax
test ecx, ecx
mov dword [ebp - 0x438], ecx
mov ecx, edi
mov dword [ebp - 0x434], eax
jne 0x427f32
push eax
call fcn.00403130
jmp 0x427f4a
push 0x16
push str.SearchProtocolHost.exe
call fcn.00402d30
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x434], eax
mov byte [ebp - 4], 0xe
call fcn.00429540
add esp, 4
test al, al
je 0x427fd0
mov ecx, 0x3e8
call fcn.00428bf0
push ecx
mov edi, esp
mov dword [ebp - 0x420], edi
call fcn.00449b3d
mov ecx, eax
test ecx, ecx
je 0x428b29
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0x12
mov ecx, edi
cmp dword [ebp - 0x438], 0
jne 0x427fb3
push dword [ebp - 0x434]
call fcn.00403130
mov byte [ebp - 4], 0xe
call fcn.00429260
add esp, 4
jmp 0x427ee0
push 0x16
push str.SearchProtocolHost.exe
call fcn.00402d30
mov byte [ebp - 4], 0xe
call fcn.00429260
add esp, 4
jmp 0x427ee0
mov ecx, 0xbb8
call fcn.00428bf0
push str.EDEwOutlook.exe
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.00415e40
add esp, 0xc
mov byte [ebp - 4], 0x13
xor eax, eax
mov word [ebp - 0x46a], ax
xorps xmm0, xmm0
mov eax, 5
movlpd qword [ebp - 0x4a8], xmm0
mov word [ebp - 0x47c], ax
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x4ac]
movlpd qword [ebp - 0x4a0], xmm0
push eax
push 0
push 0
push 0x20
push 1
push 0
push 0
push esi
push dword [ebp - 0x444]
movlpd qword [ebp - 0x498], xmm0
movlpd qword [ebp - 0x490], xmm0
movlpd qword [ebp - 0x488], xmm0
movlpd qword [ebp - 0x47a], xmm0
movlpd qword [ebp - 0x472], xmm0
mov dword [ebp - 0x4ac], 0x44
movups xmmword [ebp - 0x468], xmm0
mov dword [ebp - 0x480], 0x101
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4280b3
push 0xffffffffffffffff
push dword [ebp - 0x468]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x468]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x464]
call esi
call fcn.00449b3d
mov ecx, eax
test ecx, ecx
je 0x428b29
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0x438], edi
mov eax, dword [ebp - 0x43c]
mov byte [ebp - 4], 0x15
mov ecx, dword [eax]
test ecx, ecx
je 0x4280ef
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x428107
call fcn.00449b3d
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x428b7e
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x41c], 0x800
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x430]
push 0x11
push 0x5f61f8
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.00416370
mov esi, dword [ebp - 0x418]
add esp, 0x14
mov ecx, esi
call fcn.00429200
mov byte [ebp - 0x411], al
add esi, 0xfffffff0
mov dword [ebp - 0x41c], 0
or ecx, 0xffffffff
mov byte [ebp - 4], 0x14
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x428180
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov al, byte [ebp - 0x411]
test al, al
je 0x428620
call fcn.00449b3d
mov ecx, eax
test ecx, ecx
je 0x428b29
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x434], eax
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x434]
mov esi, dword [ebp - 0x430]
push esi
call fcn.00429970
mov edi, dword [ebp - 0x434]
mov eax, str.OfficeOutlook.txt
sub eax, edi
push 0x11
push str.OfficeOutlook.txt
mov ecx, dword [edi - 0xc]
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x418], ecx
call fcn.0058dd6a
mov edx, eax
mov ecx, SysReAllocString
mov eax, dword [ebp - 0x418]
sub ecx, edx
add esp, 8
mov dword [ebp - 0x420], edx
cmp ecx, eax
jl 0x428b1f
add edx, eax
js 0x428b1f
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, edx
or eax, ecx
jge 0x428230
push edx
lea ecx, [ebp - 0x434]
call fcn.0041ecb0
mov edi, dword [ebp - 0x434]
mov ecx, dword [ebp - 0x424]
mov eax, dword [ebp - 0x418]
lea edx, [ecx + edi]
cmp ecx, eax
jbe 0x428248
mov edx, str.OfficeOutlook.txt
mov ecx, dword [ebp - 0x420]
add eax, edi
push ecx
push edx
push ecx
push eax
call fcn.0041edd0
mov eax, dword [ebp - 0x418]
add esp, 0x10
add eax, dword [ebp - 0x420]
cmp eax, dword [edi - 8]
jg 0x428b1f
mov dword [edi - 0xc], eax
mov byte [eax + edi], 0
mov ecx, dword [edi - 0xc]
test ecx, ecx
js 0x428b1f
mov eax, dword [edi - 8]
mov edx, 1
sub edx, dword [edi - 4]
sub eax, ecx
or eax, edx
jge 0x4282a6
push ecx
lea ecx, [ebp - 0x434]
call fcn.0041ecb0
mov edi, dword [ebp - 0x434]
push 0x5f6370
push edi
call fcn.005910f4
add esp, 8
mov dword [ebp - 0x424], eax
test eax, eax
je 0x428345
call fcn.00449b3d
mov ecx, eax
test ecx, ecx
je 0x428b88
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x420], eax
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0x410]
push dword [ebp - 0x424]
push 0x400
push eax
call fcn.0058f6ad
add esp, 0xc
lea eax, [ebp - 0x410]
lea ecx, [ebp - 0x420]
push eax
call fcn.0041ebc0
mov esi, dword [ebp - 0x420]
lea ecx, [ebp - 0x438]
push esi
call fcn.00406060
mov byte [ebp - 4], 0x16
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x42833f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x430]
mov byte [ebp - 4], 0x18
mov ecx, dword [esi - 0x10]
test ecx, ecx
je 0x42835d
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x428375
call fcn.00449b3d
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x428b92
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
push 0x11
push 0x5f61f8
push dword [esi - 0xc]
add eax, 0x10
mov dword [ebp - 0x41c], 0x1000
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push esi
push eax
call fcn.00416370
mov esi, dword [ebp - 0x420]
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x41c], 0
add esi, 0xfffffff0
mov byte [ebp - 4], 0x16
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4283dc
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x14
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4283f8
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, str.OUTLOOK.EXE
shr edi, 0x10
push ecx
mov esi, esp
mov dword [ebp - 0x424], esi
call fcn.00449b3d
mov ecx, eax
test ecx, ecx
je 0x428b29
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 0x19
mov ecx, esi
test edi, edi
jne 0x42843e
mov eax, str.OUTLOOK.EXE
movzx eax, ax
push eax
call fcn.00403130
jmp 0x42844a
push 0xb
push str.OUTLOOK.EXE
call fcn.00402d30
mov byte [ebp - 4], 0x14
call fcn.00429540
add esp, 4
test al, al
je 0x428466
mov ecx, 0x3e8
call fcn.00428bf0
jmp 0x428400
mov eax, str.SearchProtocolHost.exe
shr eax, 0x10
mov dword [ebp - 0x420], eax
push ecx
mov esi, esp
mov dword [ebp - 0x424], esi
call fcn.00449b3d
mov ecx, eax
test ecx, ecx
je 0x428b29
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 0x1a
mov eax, str.SearchProtocolHost.exe
cmp dword [ebp - 0x420], 0
mov ecx, esi
movzx edi, ax
jne 0x4284b7
push edi
call fcn.00403130
jmp 0x4284c3
push 0x16
push str.SearchProtocolHost.exe
call fcn.00402d30
mov byte [ebp - 4], 0x14
call fcn.00429540
add esp, 4
test al, al
je 0x428544
mov ecx, 0x3e8
call fcn.00428bf0
push ecx
mov esi, esp
mov dword [ebp - 0x418], esi
call fcn.00449b3d
mov ecx, eax
test ecx, ecx
je 0x428b29
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 0x1b
mov ecx, esi
cmp dword [ebp - 0x420], 0
jne 0x428527
push edi
call fcn.00403130
mov byte [ebp - 4], 0x14
call fcn.00429260
add esp, 4
jmp 0x428474
push 0x16
push str.SearchProtocolHost.exe
call fcn.00402d30
mov byte [ebp - 4], 0x14
call fcn.00429260
add esp, 4
jmp 0x428474
mov eax, dword [ebp - 0x43c]
mov byte [ebp - 4], 0x1c
mov ecx, dword [eax]
test ecx, ecx
je 0x428561
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x428579
call fcn.00449b3d
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x428b9c
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x41c], 0x2000
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x430]
push 0xb
push 0x5f6374
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.00416370
mov esi, dword [ebp - 0x420]
add esp, 0x14
mov edi, dword [ebp - 0x438]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
mov dword [ebp - 0x41c], 0
mov byte [ebp - 4], 0x14
sete byte [ebp - 0x411]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4285f6
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x411], 0
je 0x4286fb
push 0x10
push 0x5f638c
push 0x5f63a8
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 0x411], 0
or esi, 0xffffffff
mov byte [ebp - 4], 0x13
add edi, 0xfffffff0
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x428645
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xe
mov eax, esi
mov edx, dword [ebp - 0x444]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x428666
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x43d]
call fcn.004170e0
lea ecx, [ebp - 0x458]
call fcn.0044c50a
mov edx, dword [ebp - 0x43c]
mov eax, esi
mov byte [ebp - 4], 1
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42869a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, esi
mov edx, dword [ebp - 0x42c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4286bb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x4286da
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov al, byte [ebp - 0x411]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00586281
mov esp, ebp
pop ebp
ret
mov ecx, 0xbb8
call fcn.00428bf0
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x4289d7
mov eax, dword [ebp - 0x43c]
mov byte [ebp - 4], 0x1d
mov ecx, dword [eax]
test ecx, ecx
je 0x428734
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x42874c
call fcn.00449b3d
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x428ba6
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x41c], 0x4000
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x430]
push 0xb
push 0x5f6374
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.00416370
mov esi, dword [ebp - 0x420]
add esp, 0x14
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
mov dword [ebp - 0x41c], 0
mov byte [ebp - 4], 0x14
sete byte [ebp - 0x411]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4287c5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x411], 0
je 0x4289b5
mov byte [ebp - 4], 0x1e
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x4287ed
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x428805
call fcn.00449b3d
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x428bb0
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x41c], 0x8000
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 8]
push dword [eax - 0xc]
push eax
push 0x20
lea eax, [ebp - 0x420]
push 0x5f6440
push eax
call fcn.00416370
add esp, 0x14
mov byte [ebp - 4], 0x1f
mov esi, dword [ebp - 0x420]
mov ecx, dword [esi - 0x10]
lea eax, [esi - 0x10]
mov dword [ebp - 0x424], eax
test ecx, ecx
je 0x428863
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x42887b
call fcn.00449b3d
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x428bba
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
push 0x22
push 0x5f63f8
push dword [esi - 0xc]
add eax, 0x10
mov dword [ebp - 0x41c], 0x18000
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x418]
push esi
push eax
call fcn.00416370
mov esi, dword [ebp - 0x418]
add esp, 0x14
push 0x30
push 0x5f638c
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x41c], 0x8000
add esi, 0xfffffff0
mov byte [ebp - 4], 0x1e
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4288eb
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x14
or eax, 0xffffffff
mov edx, dword [ebp - 0x424]
mov dword [ebp - 0x41c], 0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x428914
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x43c]
mov byte [ebp - 4], 0x20
mov ecx, dword [eax]
test ecx, ecx
je 0x428931
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x428949
call fcn.00449b3d
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x428bc4
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x41c], 0x20000
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x430]
push 0xb
push 0x5f6374
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.00416370
mov esi, dword [ebp - 0x420]
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 0x14
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x428620
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x428620
mov esi, dword [ebp - 0x428]
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 0x60]
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
mov byte [ebp - 0x411], 1
jmp 0x428627
mov byte [ebp - 4], 0x21
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x4289f2
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x428a0a
call fcn.00449b3d
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x428bce
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x41c], 0x40000
mov dword [ebp - 0x428], eax
mov eax, dword [ebp + 8]
push 0x18
push 0x5f6484
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.00416370
mov esi, dword [ebp - 0x428]
add esp, 0x14
push 0x10
push 0x5f638c
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x41c], 0
add esi, 0xfffffff0
mov byte [ebp - 4], 0x14
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x428a7d
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x43c]
mov byte [ebp - 4], 0x22
mov ecx, dword [eax]
test ecx, ecx
je 0x428a9a
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x428ab2
call fcn.00449b3d
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x428bd8
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x41c], 0x80000
mov dword [ebp - 0x428], eax
mov eax, dword [ebp - 0x430]
push 0xb
push 0x5f6374
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.00416370
mov esi, dword [ebp - 0x428]
add esp, 0x14
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov byte [ebp - 4], 0x14
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x428617
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x428617
push 0x80070057
call fcn.00403300
push 0x80004005
call fcn.00403300
push 0x80004005
call fcn.00403300
push 0x80004005
call fcn.00403300
push 0x80004005
call fcn.00403300
push 0x80004005
call fcn.00403300
push 0x80004005
call fcn.00403300
push 0x80004005
call fcn.00403300
call fcn.004498c5
push 0x80004005
call fcn.00403300
push 0x80004005
call fcn.00403300
push 0x80004005
call fcn.00403300
push 0x80004005
call fcn.00403300
push 0x80004005
call fcn.00403300
push 0x80004005
call fcn.00403300
push 0x80004005
call fcn.00403300
push 0x80004005
call fcn.00403300
push 0x80004005
call fcn.00403300
push 0x80004005
call fcn.00403300
push 0x80004005
call fcn.00403300
int3