Function at 0x408bb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fa830
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x108
push ebx
push esi
push edi
mov edi, 0xc37010
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
lea edx, [ebp - 0x114]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x10], esp
mov eax, ecx
mov esi, edi
mov edi, edx
push 0xc37010
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push str._sFonts_
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x114]
or ecx, 0xffffffff
mov byte [ebp - 0x112], bl
push 0xddb594
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 4], ebx
mov edx, ecx
mov esi, edi
mov edi, 0xc4e090
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004f175f
lea eax, [ebp - 0x114]
push 0x514750
push eax
push 0x51473c
push 0xe43cd0
call fcn.004f175f
mov edi, 0xe43cd0
or ecx, 0xffffffff
xor eax, eax
push str.smss.exe
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0xddc214
mov dword [0xe56e3c], ecx
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
mov dword [0xe56f70], edx
push str.csrss.exe
push 0xddc214
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.winlogon.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f70], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esp, 0x4c
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.lsass.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f70], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push str.services.exe
rep movsb byte es:[edi], byte [esi]
push 0xddc214
lea ecx, [ebp - 0x114]
inc edx
push str._s_s
push ecx
mov dword [0xe56f70], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.svchost.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f70], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.userinit.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f70], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esp, 0x40
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.ctfmon.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f70], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.conime.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f70], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.spoolsv.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f70], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov dword [ebp - 0x14], esi
mov esi, edi
mov edi, dword [ebp - 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push str.wuauclt.exe
and ecx, 3
push 0xddc214
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
inc edx
push str._s_s
push ecx
mov dword [0xe56f70], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esp, 0x40
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.autochk.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f70], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.cmd.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
add edx, 2
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f70], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
shl esi, 8
add esi, 0xd77c90
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 0x14], esi
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.logon.scr
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push 0xddc214
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push str._s_s
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
mov dword [0xe56f70], edx
push ecx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.defrag.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f70], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esp, 0x40
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.rundll32.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f70], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.taskmgr.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f70], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.drwtsn32.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f70], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.netsh.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
mov dword [0xe56f70], edx
mov byte [ebp - 0x114], bl
push ecx
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esp, 0x40
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.ntvdm.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f70], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.regsvr32.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f70], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.regedit.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
mov dword [0xe56f70], edx
mov byte [ebp - 0x114], bl
push 0xddc214
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.attrib.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f70], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esp, 0x40
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.net.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f70], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.net1.exe
push 0xddc214
lea ecx, [ebp - 0x114]
inc edx
push str._s_s
push ecx
mov dword [0xe56f70], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.lockfile.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xc37010
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_another_s
push ecx
mov dword [0xe56f70], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.explorer.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xc37010
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f70], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esp, 0x40
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push str.wmiprvse.exe
and ecx, 3
push 0xddc214
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
inc edx
push str._swbem_s
push ecx
mov dword [0xe56f70], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.mmc.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f70], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.mshta.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f70], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push str.internat.exe
and ecx, 3
push 0xddc214
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
inc edx
push str._s_s
push ecx
mov dword [0xe56f70], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esp, 0x40
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.dumprep.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f70], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f70]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esp, 0x10
add esi, 0xd77c90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x32
mov dword [0xe56f70], edx
rep movsb byte es:[edi], byte [esi]
jne 0x409899
mov dword [0xe56f70], edx
push str.taskmgr.exe
push 0xddc214
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f74]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd6ce90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.services.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f74], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f74]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd6ce90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.lsass.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f74], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f74]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd6ce90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.userinit.exe
push 0xddc214
lea ecx, [ebp - 0x114]
inc edx
push str._s_s
push ecx
mov dword [0xe56f74], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f74]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esp, 0x40
add esi, 0xd6ce90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.explorer.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xc37010
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f74], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f74]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd6ce90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.logon.scr
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f74], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f74]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esp, 0x20
add esi, 0xd6ce90
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0xa
mov dword [0xe56f74], edx
rep movsb byte es:[edi], byte [esi]
jne 0x409aea
mov dword [0xe56f74], edx
push str.smss.exe
push 0xddc214
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f78]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd8a4bc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.csrss.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f78], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f78]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd8a4bc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.winlogon.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f78], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f78]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd8a4bc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.services.exe
push 0xddc214
lea ecx, [ebp - 0x114]
inc edx
push str._s_s
push ecx
mov dword [0xe56f78], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f78]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esp, 0x40
add esi, 0xd8a4bc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.lsass.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f78], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f78]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd8a4bc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.svchost.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f78], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f78]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd8a4bc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov esi, edi
mov edi, dword [ebp - 0x14]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push str.lockfile.exe
and ecx, 3
push 0xc37010
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
inc edx
push str._s_another_s
push ecx
mov dword [0xe56f78], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f78]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd8a4bc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.rundll32.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f78], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f78]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esp, 0x40
add esi, 0xd8a4bc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
push str.dllhost.exe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xddc214
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
push str._s_s
push ecx
mov dword [0xe56f78], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f78]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0xd8a4bc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov dword [ebp - 0x14], esi
mov esi, edi
mov edi, dword [ebp - 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push str.autochk.exe
and ecx, 3
push 0xddc214
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x114]
inc edx
push str._s_s
push ecx
mov dword [0xe56f78], edx
mov byte [ebp - 0x114], bl
call fcn.004f175f
mov edx, dword [0xe56f78]
lea edi, [ebp - 0x114]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esp, 0x20
add esi, 0xd8a4bc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x14
mov dword [0xe56f78], edx
rep movsb byte es:[edi], byte [esi]
jne 0x409ebe
mov dword [0xe56f78], edx
push str.c:endpcacheccProcMon.sys
call fcn.004abe70
add esp, 4
cmp eax, 0xffffffff
je 0x409f61
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [ebp - 0x14]
push ecx
push ebx
push ebx
push 0x4876a0
push ebx
push ebx
call esi
cmp eax, ebx
jne 0x409ef7
mov dword [0xe56e24], 1
lea edx, [ebp - 0x14]
push edx
push ebx
push ebx
push 0x487750
push ebx
push ebx
call esi
cmp dword [0xe56e24], ebx
jne 0x409f57
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push 0x487a00
push ebx
push ebx
call esi
push str.end_proc_init......
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [0xe56e24], 1
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret