Function at 0x414420
Capabilities:
Delete directory
Get common file path
Get hostname
Persist via run registry key
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x510da7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x99c
mov dword [ebp - 0x8c8], ecx
mov ecx, 0x5b5b78
call fcn.0050f5b0
push 0x5b8578
push 0x5b4e30
call sub.MSVCRT.dll_strcpy
add esp, 8
call fcn.004f6b65
mov dword [0x5b853c], eax
call fcn.004033aa
mov dword [0x5b84c8], eax
call fcn.00403407
test eax, eax
je 0x414490
cmp dword [0x5b84c8], 0
je 0x414490
mov dword [0x5b84d4], 1
cmp dword [0x5b84d4], 0
je 0x4144a4
push 0x5b84c0
call dword [0x5b84cc]
push 0x51b0e4
push 0x51b0f4
push 0x80000002
lea eax, [ebp - 0x838]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x8cc], eax
mov ecx, dword [ebp - 0x8cc]
mov dword [ebp - 0x8d0], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x8d0]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x82c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x838]
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x82c]
push eax
call fcn.00401fca
add esp, 4
lea ecx, [ebp - 0x83c]
push ecx
call fcn.00401d93
add esp, 4
mov dword [ebp - 0x8d4], eax
mov edx, dword [ebp - 0x8d4]
mov dword [ebp - 0x8d8], edx
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x8d8]
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x83c]
call sub.MFC42.DLL_CString::CString
push 0x5b6504
call fcn.00401fca
add esp, 4
push 0x5b6504
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x834], eax
mov eax, dword [ebp - 0x8c8]
mov ecx, dword [ebp - 0x834]
mov dword [eax + 0x17c], ecx
jmp 0x4145b9
mov edx, dword [ebp - 0x8c8]
mov eax, dword [edx + 0x17c]
sub eax, 1
mov ecx, dword [ebp - 0x8c8]
mov dword [ecx + 0x17c], eax
mov edx, dword [ebp - 0x8c8]
cmp dword [edx + 0x17c], 0
jle 0x4145e4
mov eax, dword [ebp - 0x8c8]
mov ecx, dword [eax + 0x17c]
movsx edx, byte [ecx + 0x5b6504]
cmp edx, 0x5c
jne 0x4145e2
jmp 0x4145e4
jmp 0x41459e
mov eax, dword [ebp - 0x8c8]
mov ecx, dword [eax + 0x17c]
mov byte [ecx + 0x5b6504], 0
lea edx, [ebp - 0x82c]
push edx
push 0x5b6504
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x414623
mov dword [0x5b8518], 1
mov dword [0x5b851c], 1
push str._DEBUG
push 1
lea eax, [ebp - 0x844]
push eax
call fcn.00401ddf
add esp, 8
mov dword [ebp - 0x8dc], eax
mov ecx, dword [ebp - 0x8dc]
mov dword [ebp - 0x8e0], ecx
mov dword [ebp - 4], 2
mov edx, dword [ebp - 0x8e0]
push edx
call fcn.0050f610
mov byte [ebp - 0x840], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x844]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x840]
and eax, 0xff
test eax, eax
je 0x41468f
mov dword [0x5b8510], 1
push str._SALTAREG
push 1
lea ecx, [ebp - 0x84c]
push ecx
call fcn.00401ddf
add esp, 8
mov dword [ebp - 0x8e4], eax
mov edx, dword [ebp - 0x8e4]
mov dword [ebp - 0x8e8], edx
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x8e8]
push eax
call fcn.0050f610
mov byte [ebp - 0x848], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84c]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0x848]
and ecx, 0xff
test ecx, ecx
je 0x4146fc
mov dword [0x5b8514], 1
push 0x51b14c
push 1
lea edx, [ebp - 0x854]
push edx
call fcn.00401ddf
add esp, 8
mov dword [ebp - 0x8ec], eax
mov eax, dword [ebp - 0x8ec]
mov dword [ebp - 0x8f0], eax
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x8f0]
push ecx
call fcn.0050f610
mov byte [ebp - 0x850], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x854]
call sub.MFC42.DLL_CString::CString
mov edx, dword [ebp - 0x850]
and edx, 0xff
test edx, edx
je 0x414769
mov dword [0x5b8518], 1
push str._NOAVISA
push 1
lea eax, [ebp - 0x85c]
push eax
call fcn.00401ddf
add esp, 8
mov dword [ebp - 0x8f4], eax
mov ecx, dword [ebp - 0x8f4]
mov dword [ebp - 0x8f8], ecx
mov dword [ebp - 4], 5
mov edx, dword [ebp - 0x8f8]
push edx
call fcn.0050f610
mov byte [ebp - 0x858], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x85c]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x858]
and eax, 0xff
test eax, eax
je 0x4147df
mov dword [0x5b8518], 1
mov dword [0x5b851c], 1
push str._REEXEC
push 1
lea ecx, [ebp - 0x864]
push ecx
call fcn.00401ddf
add esp, 8
mov dword [ebp - 0x8fc], eax
mov edx, dword [ebp - 0x8fc]
mov dword [ebp - 0x900], edx
mov dword [ebp - 4], 6
mov eax, dword [ebp - 0x900]
push eax
call fcn.0050f610
mov byte [ebp - 0x860], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x864]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0x860]
and ecx, 0xff
test ecx, ecx
je 0x414866
call fcn.004ae964
push 0
push str.EliStartPage_v50.12
push str.Preparada_la_Ejecuci
mov ecx, dword [ebp - 0x8c8]
call sub.MFC42.DLL_CWnd::MessageBoxA
push 0
call dword [sym.imp.MSVCRT.dll_exit]
lea edx, [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.DLL_GetSystemTime]
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
cmp eax, 0x7e7
jg 0x4148c9
mov ecx, dword [ebp - 0x2c]
and ecx, 0xffff
cmp ecx, 0x7e7
jne 0x41489e
mov edx, dword [ebp - 0x2a]
and edx, 0xffff
cmp edx, 8
jg 0x4148c9
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
cmp eax, 0x7e7
jne 0x414910
mov ecx, dword [ebp - 0x2a]
and ecx, 0xffff
cmp ecx, 8
jne 0x414910
mov edx, dword [ebp - 0x26]
and edx, 0xffff
cmp edx, 0xa
jl 0x414910
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x2a]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x26]
and edx, 0xffff
push edx
push 0x51b1b0
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
cmp dword [0x5b851c], 0
jne 0x414910
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x51b26c
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x51b29c
push 0x5b6504
push 0x80000002
lea eax, [ebp - 0x868]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x904], eax
mov ecx, dword [ebp - 0x904]
mov dword [ebp - 0x908], ecx
mov dword [ebp - 4], 7
mov ecx, dword [ebp - 0x908]
call fcn.0050f0b0
push eax
push 0x5b83b8
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x868]
call sub.MFC42.DLL_CString::CString
push str.CurrentVersion
push 0x5b6504
push 0x80000002
lea edx, [ebp - 0x86c]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x90c], eax
mov eax, dword [ebp - 0x90c]
mov dword [ebp - 0x910], eax
mov dword [ebp - 4], 8
mov ecx, dword [ebp - 0x910]
call fcn.0050f0b0
push eax
push 0x5b82b8
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x86c]
call sub.MFC42.DLL_CString::CString
push str.CurrentBuildNumber
push 0x5b6504
push 0x80000002
lea ecx, [ebp - 0x870]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x914], eax
mov edx, dword [ebp - 0x914]
mov dword [ebp - 0x918], edx
mov dword [ebp - 4], 9
mov ecx, dword [ebp - 0x918]
call fcn.0050f0b0
push eax
push 0x5b81b8
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x870]
call sub.MFC42.DLL_CString::CString
push str.CSDVersion
push 0x5b6504
push 0x80000002
lea eax, [ebp - 0x874]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x91c], eax
mov ecx, dword [ebp - 0x91c]
mov dword [ebp - 0x920], ecx
mov dword [ebp - 4], 0xa
mov ecx, dword [ebp - 0x920]
call fcn.0050f0b0
push eax
push 0x5b80b8
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x874]
call sub.MFC42.DLL_CString::CString
push 0x51b2d8
push 0x5b83b8
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x414b9b
push 0x51b2e0
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x51b30c
push 0x5b6504
push 0x80000002
lea edx, [ebp - 0x878]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x924], eax
mov eax, dword [ebp - 0x924]
mov dword [ebp - 0x928], eax
mov dword [ebp - 4], 0xb
mov ecx, dword [ebp - 0x928]
call fcn.0050f0b0
push eax
push 0x5b83b8
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call sub.MFC42.DLL_CString::CString
push str.VersionNumber
push 0x5b6504
push 0x80000002
lea ecx, [ebp - 0x87c]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x92c], eax
mov edx, dword [ebp - 0x92c]
mov dword [ebp - 0x930], edx
mov dword [ebp - 4], 0xc
mov ecx, dword [ebp - 0x930]
call fcn.0050f0b0
push eax
push 0x5b82b8
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x87c]
call sub.MFC42.DLL_CString::CString
push 0x51b328
push 0x5b83b8
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x414bc4
push str.Desconocido
push 0x5b83b8
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x51b33c
push 0x5b82b8
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x414bed
push 0x51b344
push 0x5b82b8
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x51b348
push 0x5b81b8
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x414c16
push 0x51b350
push 0x5b81b8
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x51b354
push 0x5b80b8
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x414c3f
push 0x5b857c
push 0x5b80b8
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b80b8
call fcn.00401fca
add esp, 4
push 0x100
push 0x5b7eb4
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push 0x5b7eb4
call fcn.00401fca
add esp, 4
push 0x100
push 0x5b7db4
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push 0x5b7db4
call fcn.00401fca
add esp, 4
push 0x5b7eb4
push 0x5b7ba4
call sub.MSVCRT.dll_strcpy
add esp, 8
mov byte [0x5b7ba7], 0
mov dword [0x5b4124], 0x100
push 0x5b4124
push 0x5b7bb4
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
push 0x51b35c
push 0x51b364
push 0x80000001
lea eax, [ebp - 0x880]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x934], eax
mov ecx, dword [ebp - 0x934]
mov dword [ebp - 0x938], ecx
mov dword [ebp - 4], 0xd
mov ecx, dword [ebp - 0x938]
call fcn.0050f0b0
push eax
push 0x5b7aa4
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x880]
call sub.MFC42.DLL_CString::CString
push 0x5b7aa4
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x834], eax
mov edx, dword [ebp - 0x8c8]
mov dword [edx + 0x17c], 3
jmp 0x414d5b
mov eax, dword [ebp - 0x8c8]
mov ecx, dword [eax + 0x17c]
add ecx, 1
mov edx, dword [ebp - 0x8c8]
mov dword [edx + 0x17c], ecx
mov eax, dword [ebp - 0x8c8]
mov ecx, dword [eax + 0x17c]
cmp ecx, dword [ebp - 0x834]
jge 0x414d8b
mov edx, dword [ebp - 0x8c8]
mov eax, dword [edx + 0x17c]
movsx ecx, byte [eax + 0x5b7aa4]
cmp ecx, 0x5c
jne 0x414d89
jmp 0x414d8b
jmp 0x414d40
mov edx, dword [ebp - 0x8c8]
mov eax, dword [edx + 0x17c]
mov byte [eax + 0x5b7aa4], 0
push 0x51b3a8
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.Common_Startup
push 0x5b6504
push 0x80000002
lea ecx, [ebp - 0x884]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x93c], eax
mov edx, dword [ebp - 0x93c]
mov dword [ebp - 0x940], edx
mov dword [ebp - 4], 0xe
mov eax, dword [ebp - 0x940]
push eax
mov ecx, 0x5b7670
call sub.MFC42.DLL_CString::operator_1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x884]
call sub.MFC42.DLL_CString::CString
push str.Common_Start_Menu
push 0x5b6504
push 0x80000002
lea ecx, [ebp - 0x888]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x944], eax
mov edx, dword [ebp - 0x944]
mov dword [ebp - 0x948], edx
mov dword [ebp - 4], 0xf
mov eax, dword [ebp - 0x948]
push eax
mov ecx, 0x5b7668
call sub.MFC42.DLL_CString::operator_1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x888]
call sub.MFC42.DLL_CString::CString
push str.Common_Programs
push 0x5b6504
push 0x80000002
lea ecx, [ebp - 0x88c]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x94c], eax
mov edx, dword [ebp - 0x94c]
mov dword [ebp - 0x950], edx
mov dword [ebp - 4], 0x10
mov eax, dword [ebp - 0x950]
push eax
mov ecx, 0x5b7660
call sub.MFC42.DLL_CString::operator_1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88c]
call sub.MFC42.DLL_CString::CString
push str.Common_AppData
push 0x5b6504
push 0x80000002
lea ecx, [ebp - 0x890]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x954], eax
mov edx, dword [ebp - 0x954]
mov dword [ebp - 0x958], edx
mov dword [ebp - 4], 0x11
mov eax, dword [ebp - 0x958]
push eax
mov ecx, 0x5b7650
call sub.MFC42.DLL_CString::operator_1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x890]
call sub.MFC42.DLL_CString::CString
push str.Common_Favorites
push 0x5b6504
push 0x80000002
lea ecx, [ebp - 0x894]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x95c], eax
mov edx, dword [ebp - 0x95c]
mov dword [ebp - 0x960], edx
mov dword [ebp - 4], 0x12
mov eax, dword [ebp - 0x960]
push eax
mov ecx, 0x5b7638
call sub.MFC42.DLL_CString::operator_1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x894]
call sub.MFC42.DLL_CString::CString
push str.Common_Desktop
push 0x5b6504
push 0x80000002
lea ecx, [ebp - 0x898]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x964], eax
mov edx, dword [ebp - 0x964]
mov dword [ebp - 0x968], edx
mov dword [ebp - 4], 0x13
mov eax, dword [ebp - 0x968]
push eax
mov ecx, 0x5b7630
call sub.MFC42.DLL_CString::operator_1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x898]
call sub.MFC42.DLL_CString::CString
push str.Common_Documents
push 0x5b6504
push 0x80000002
lea ecx, [ebp - 0x89c]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x96c], eax
mov edx, dword [ebp - 0x96c]
mov dword [ebp - 0x970], edx
mov dword [ebp - 4], 0x14
mov eax, dword [ebp - 0x970]
push eax
mov ecx, 0x5b7628
call sub.MFC42.DLL_CString::operator_1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x89c]
call sub.MFC42.DLL_CString::CString
push str.Common_Templates
push 0x5b6504
push 0x80000002
lea ecx, [ebp - 0x8a0]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x974], eax
mov edx, dword [ebp - 0x974]
mov dword [ebp - 0x978], edx
mov dword [ebp - 4], 0x15
mov eax, dword [ebp - 0x978]
push eax
mov ecx, 0x5b7618
call sub.MFC42.DLL_CString::operator_1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8a0]
call sub.MFC42.DLL_CString::CString
push 0x51b47c
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.CommonFilesDir
push 0x5b6504
push 0x80000002
lea ecx, [ebp - 0x8a4]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x97c], eax
mov edx, dword [ebp - 0x97c]
mov dword [ebp - 0x980], edx
mov dword [ebp - 4], 0x16
mov eax, dword [ebp - 0x980]
push eax
mov ecx, 0x5b765c
call sub.MFC42.DLL_CString::operator_1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8a4]
call sub.MFC42.DLL_CString::CString
push str.ProgramFilesDir
push 0x5b6504
push 0x80000002
lea ecx, [ebp - 0x8a8]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x984], eax
mov edx, dword [ebp - 0x984]
mov dword [ebp - 0x988], edx
mov dword [ebp - 4], 0x17
mov eax, dword [ebp - 0x988]
push eax
mov ecx, 0x5b7658
call sub.MFC42.DLL_CString::operator_1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8a8]
call sub.MFC42.DLL_CString::CString
mov ecx, 0x5b7630
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b6504
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x834], eax
mov ecx, dword [ebp - 0x8c8]
mov edx, dword [ebp - 0x834]
mov dword [ecx + 0x17c], edx
jmp 0x4151a0
mov eax, dword [ebp - 0x8c8]
mov ecx, dword [eax + 0x17c]
sub ecx, 1
mov edx, dword [ebp - 0x8c8]
mov dword [edx + 0x17c], ecx
mov eax, dword [ebp - 0x8c8]
cmp dword [eax + 0x17c], 0
jle 0x4151cb
mov ecx, dword [ebp - 0x8c8]
mov edx, dword [ecx + 0x17c]
movsx eax, byte [edx + 0x5b6504]
cmp eax, 0x5c
jne 0x4151c9
jmp 0x4151cb
jmp 0x415185
mov ecx, dword [ebp - 0x8c8]
mov edx, dword [ecx + 0x17c]
mov byte [edx + 0x5b6504], 0
push 0x5b6504
push 0x5b7678
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.S_1_5_20SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x51b514
push 0x5b6504
push 0x80000003
lea eax, [ebp - 0x8ac]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x98c], eax
mov ecx, dword [ebp - 0x98c]
mov dword [ebp - 0x990], ecx
mov dword [ebp - 4], 0x18
mov edx, dword [ebp - 0x990]
push edx
mov ecx, 0x5b7648
call sub.MFC42.DLL_CString::operator_1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8ac]
call sub.MFC42.DLL_CString::CString
push 0
push 0x5b7eb4
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push 0
push 0x5b7db4
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push 0x51b51c
push 1
lea eax, [ebp - 0x8b4]
push eax
call fcn.00401ddf
add esp, 8
mov dword [ebp - 0x994], eax
mov ecx, dword [ebp - 0x994]
mov dword [ebp - 0x998], ecx
mov dword [ebp - 4], 0x19
mov edx, dword [ebp - 0x998]
push edx
call fcn.0050f630
mov byte [ebp - 0x8b0], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8b4]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x8b0]
and eax, 0xff
test eax, eax
je 0x4152f2
push 0x51b528
call fcn.00402131
add esp, 4
push str.WSCRIPT.EXE
call fcn.00402131
add esp, 4
lea ecx, [ebp - 0x1c]
call fcn.0050f530
push 0x5b7eb4
push str._sOffline_Web_PagesCACHE.TXT
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
push 0x5b7db4
push 0x51b568
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
call fcn.00495686
push 0x5b8580
push 0x5b5c04
call sub.MSVCRT.dll_strcpy
add esp, 8
call fcn.0050cd7b
mov ecx, dword [ebp - 0x8c8]
mov dword [ecx + 0x17c], 0
jmp 0x415389
mov edx, dword [ebp - 0x8c8]
mov eax, dword [edx + 0x17c]
add eax, 1
mov ecx, dword [ebp - 0x8c8]
mov dword [ecx + 0x17c], eax
mov ecx, 0x5b5730
call fcn.0050f110
mov edx, dword [ebp - 0x8c8]
cmp dword [edx + 0x17c], eax
jge 0x415431
mov eax, dword [ebp - 0x8c8]
mov ecx, dword [eax + 0x17c]
push ecx
mov ecx, 0x5b5730
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.D41D8CD98F00B204E9800998ECF8427E
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x415416
push str.1276481102F218C981E0324180BAFD9F
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x415416
push str.3962F17C657B1E77E144E69DFD1D35A5
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x41542c
push 0
push 0
push str.MD5_no_aceptado__de_0_bytes__bloque_de_00s_o_FFs_
call sub.MFC42.DLL_AfxMessageBox
push 0
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x41536e
mov ecx, 0x5b5730
call fcn.0050f110
test eax, eax
jne 0x41545f
cmp dword [0x5b851c], 0
jne 0x41545f
push 0
push str.EliStartPage_v50.12
push str.ERROR._nNo_ha_sido_Posible_Cargar_las_Cadenas_V
mov ecx, dword [ebp - 0x8c8]
call sub.MFC42.DLL_CWnd::MessageBoxA
mov ecx, 0x5b5730
call fcn.0050f110
push eax
push str._d_Cadenas_V
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, dword [ebp - 0x8c8]
add ecx, 0x200
call sub.MFC42.DLL_CWnd::SetWindowTextA
push 0x51b664
mov ecx, dword [ebp - 0x8c8]
add ecx, 0x3c0
call fcn.0050f650
push str.Se_aconseja_desactivar_temporalmente_el_residente_del_AntiVirus_
mov ecx, dword [ebp - 0x8c8]
add ecx, 0x3c0
call fcn.0050f650
push str.para_que_la_exploraci
mov ecx, dword [ebp - 0x8c8]
add ecx, 0x3c0
call fcn.0050f650
push 0x51b6e0
push 1
lea edx, [ebp - 0x8bc]
push edx
call fcn.00401ddf
add esp, 8
mov dword [ebp - 0x99c], eax
mov eax, dword [ebp - 0x99c]
mov dword [ebp - 0x9a0], eax
mov dword [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x9a0]
push ecx
call fcn.0050f610
mov byte [ebp - 0x8b8], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8bc]
call sub.MFC42.DLL_CString::CString
mov edx, dword [ebp - 0x8b8]
and edx, 0xff
test edx, edx
je 0x415565
push 0x51b6e4
push 0x5b7fb4
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x51b6e8
mov ecx, dword [ebp - 0x8c8]
add ecx, 0x180
call sub.MFC42.DLL_CWnd::SetWindowTextA
jmp 0x4157b4
cmp dword [0x5b8518], 0
jne 0x415594
push 4
push str.EliStartPage_v50.12
push str.Para_TODOS_los_Usuarios_del_Sistema._n_n
mov ecx, dword [ebp - 0x8c8]
call sub.MFC42.DLL_CWnd::MessageBoxA
cmp eax, 6
jne 0x415594
mov dword [0x5b8518], 1
lea ecx, [ebp - 0x1c]
call fcn.0050f550
lea ecx, [ebp - 0x1c]
call fcn.0050f570
call sub.MSVCRT.dll__ftol
mov dword [ebp - 0x830], eax
cmp dword [ebp - 0x830], 4
jg 0x4155d2
mov eax, dword [ebp - 0x830]
imul eax, eax, 0x3e8
mov ecx, 0xfa0
sub ecx, eax
push ecx
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x51b75c
push 1
lea edx, [ebp - 0x8c4]
push edx
call fcn.00401ddf
add esp, 8
mov dword [ebp - 0x9a4], eax
mov eax, dword [ebp - 0x9a4]
mov dword [ebp - 0x9a8], eax
mov dword [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x9a8]
push ecx
call fcn.0050f630
mov byte [ebp - 0x8c0], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c4]
call sub.MFC42.DLL_CString::CString
mov edx, dword [ebp - 0x8c0]
and edx, 0xff
test edx, edx
je 0x415642
push 0x51b768
call fcn.00402131
add esp, 4
call fcn.004f67db
call fcn.0041664c
mov dword [0x5b4120], 0
jmp 0x415665
mov eax, dword [0x5b4120]
add eax, 1
mov dword [0x5b4120], eax
mov ecx, 0x5b7890
call fcn.0050f110
cmp dword [0x5b4120], eax
jge 0x4156d0
mov ecx, dword [0x5b4120]
push ecx
mov ecx, 0x5b7890
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b79a4
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [0x5b4120]
push edx
mov ecx, 0x5b7878
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b78a4
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x8c8]
call fcn.004157c2
jmp 0x415658
call fcn.004f1d2d
cmp dword [0x5b84d4], 0
je 0x4156ea
mov eax, dword [0x5b84c0]
push eax
call dword [0x5b84d0]
cmp dword [0x5b851c], 1
jne 0x415718
push 0x64
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Beep]
push 0x12c
push 0x2ee
call dword [sym.imp.KERNEL32.DLL_Beep]
push 0
call dword [sym.imp.MSVCRT.dll_exit]
push 0x5b8584
push 0x5b5c04
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x415740
push str.Troyano
push 0x5b5c04
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b8500], 1
jne 0x415761
push 0x5b5c04
push str.Eliminado__s
push 0x5b6d04
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
cmp dword [0x5b8500], 2
jne 0x415782
push 0x5b5c04
push str.Detectado__s_nReinicie_para_Completar_la_Limpieza.
push 0x5b6d04
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
cmp dword [0x5b8500], 3
jne 0x41579d
push str._nEliminados_Ficheros_Complementarios.
push 0x5b6d04
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b8500], 0
je 0x4157b4
push 0
push 0
push 0x5b6d04
call sub.MFC42.DLL_AfxMessageBox
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret