Function at 0x41de70
Capabilities:
Check if file exists
Create process on windows
Delete file
Get disk information
Get disk size
Get file attributes
Hide graphical window
Manipulate console buffer
Parse credit card information
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43d3ab
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x10278
call fcn.0043c8d0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x4574c0]
mov dword [ebp - 0x10124], eax
mov eax, dword [0x4574c8]
push 0x10004
mov dword [ebp - 0x10130], eax
lea eax, [ebp - 0x100c8]
push 0
push eax
call fcn.0042a4e0
add esp, 0xc
mov dword [ebp - 0x10120], 0
lea eax, [ebp - 0x10288]
mov dword [ebp - 0x1022c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x10114], 0
mov dword [ebp - 0x100f8], 0
push 0x44
push 0
push eax
mov dword [ebp - 0x1012c], 0
movups xmmword [ebp - 0x10218], xmm0
call fcn.0042a4e0
xor eax, eax
mov dword [ebp - 0x10288], 0x44
add esp, 0xc
mov dword [ebp - 0x10100], eax
xor esi, esi
mov dword [ebp - 0x101f0], eax
mov dword [ebp - 0x1016c], eax
mov dword [ebp - 0x101ec], eax
push 0x30
mov dword [ebp - 0x101f8], eax
mov dword [ebp - 0x10208], eax
mov dword [ebp - 0x10204], eax
mov dword [ebp - 0x10110], eax
mov dword [ebp - 0x10118], eax
lea eax, [ebp - 0x10160]
push esi
push eax
mov dword [ebp - 0x10108], esi
call fcn.0042a4e0
mov ax, word [0x4574e0]
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
xorps xmm0, xmm0
mov word [ebp - 0x1c], ax
xor eax, eax
mov dword [ebp - 0x1a], 0x5c003a
push 0x30636
push eax
push dword [0x45764c]
mov word [ebp - 0x16], ax
mov dword [ebp - 0x10168], eax
mov dword [ebp - 0x1011c], eax
movq qword [ebp - 0x10228], xmm0
movups xmmword [ebp - 0x100f0], xmm0
mov dword [ebp - 0x1010c], eax
movups xmmword [ebp - 0x100e0], xmm0
movq qword [ebp - 0x100d0], xmm0
movq qword [ebp - 0x10200], xmm0
movq qword [ebp - 0x10240], xmm0
movq qword [ebp - 0x10238], xmm0
call edi
mov dword [ebp - 0x10104], eax
test eax, eax
je 0x41e048
push 0x300
push esi
push dword [0x45764c]
mov dword [ebp - 0x10140], 0x20
call edi
mov dword [ebp - 0x10148], eax
mov dword [ebp - 0x10138], eax
test eax, eax
jne 0x41e059
mov edx, dword [ebp - 0x10104]
push edx
push eax
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [0x45771c], 8
xor al, al
jmp 0x41f6fd
lea eax, [ebp - 0x10220]
mov dword [ebp - 0x10220], str.GOscdimg
push eax
push 0x104
push 0x457720
push 0x400
push 0
push dword [0x45631c]
push 0x2400
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
sub esp, 8
lea ecx, [ebp - 0x101e8]
push 0x457720
push dword [0x45633c]
sub esp, 8
push 0x457720
call fcn.00402d80
lea ecx, [ebp - 0x101e8]
mov dword [ebp - 4], 0
call fcn.00402fd0
push 0x4037c0
push 0xfa
push 0x65
push dword [ebp - 0x101e0]
lea eax, [ebp - 0x101e8]
mov dword [0x45754c], eax
call dword [sym.imp.USER32.dll_SetTimer]
movzx ecx, byte [ebp - 0x101aa]
test eax, eax
mov edx, 1
mov dword [ebp - 0x10164], 0
lea eax, [ebp - 0x10164]
mov dword [ebp - 0x1021c], edx
push eax
cmovne ecx, edx
mov dword [ebp - 0x101f4], 0
push 0x2000e
mov byte [ebp - 0x101aa], cl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x41e13a
xor eax, eax
jmp 0x41e15d
lea eax, [ebp - 0x101f4]
push eax
push 2
push dword [ebp - 0x10164]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
push dword [ebp - 0x10164]
call edi
mov eax, dword [ebp - 0x101f4]
mov dword [ebp - 0x10144], eax
mov eax, 1
mov dword [ebp - 0x10150], 0xffffffff
mov dword [ebp - 0x1014c], 0xffffffff
mov dword [0x45771c], 0
mov dword [ebp - 0x10128], eax
cmp dword [ebp - 0x10124], eax
jbe 0x41ea04
nop dword [eax + eax]
mov ecx, dword [ebp - 0x10130]
mov edi, dword [ecx + eax*4]
mov eax, dword [ebp - 0x101e4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jne 0x41e9c3
mov eax, dword [ebp - 0x10140]
cmp dword [ebp - 0x1013c], eax
jne 0x41e216
add eax, eax
mov dword [ebp - 0x10140], eax
lea eax, [eax + eax*2]
shl eax, 3
push eax
push dword [ebp - 0x10148]
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
mov dword [ebp - 0x10138], ecx
test ecx, ecx
je 0x41ea04
mov eax, dword [ebp - 0x1013c]
mov dword [ebp - 0x10148], ecx
lea eax, [eax + eax*2]
lea eax, [ecx + eax*8]
mov dword [ebp - 0x10138], eax
cmp word [edi], 0x2f
jne 0x41e6c0
movzx eax, word [edi + 2]
cmp eax, 0x47
je 0x41e22e
cmp eax, 0x67
jne 0x41e29b
movzx ecx, word [edi + 4]
cmp ecx, 0x4f
je 0x41e23c
cmp ecx, 0x6f
jne 0x41e29b
movzx ecx, word [edi + 6]
cmp ecx, 0x53
je 0x41e24a
cmp ecx, 0x73
jne 0x41e29b
movzx ecx, word [edi + 8]
cmp ecx, 0x43
je 0x41e258
cmp ecx, 0x63
jne 0x41e29b
movzx ecx, word [edi + 0xa]
cmp ecx, 0x44
je 0x41e266
cmp ecx, 0x64
jne 0x41e29b
movzx ecx, word [edi + 0xc]
cmp ecx, 0x49
je 0x41e274
cmp ecx, 0x69
jne 0x41e29b
movzx ecx, word [edi + 0xe]
cmp ecx, 0x4d
je 0x41e282
cmp ecx, 0x6d
jne 0x41e29b
movzx ecx, word [edi + 0x10]
cmp ecx, 0x47
je 0x41e290
cmp ecx, 0x67
jne 0x41e29b
cmp word [edi + 0x12], 0
je 0x41e970
cmp eax, 0x41
je 0x41e2a5
cmp eax, 0x61
jne 0x41e2cc
movzx ecx, word [edi + 4]
cmp ecx, 0x52
je 0x41e2b3
cmp ecx, 0x72
jne 0x41e2cc
cmp word [edi + 6], 0
jne 0x41e2cc
cmp dword [0x4574d4], 0
je 0x41f750
jmp 0x41e6c0
cmp eax, 0x41
je 0x41e2da
cmp eax, 0x61
jne 0x41e476
cmp word [edi + 4], 0x3d
jne 0x41e476
lea ecx, [edi + 6]
mov byte [ebp - 0x100f1], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x10178], xmm0
test ecx, ecx
je 0x41e461
movzx eax, word [ecx]
test ax, ax
je 0x41e461
nop
cmp ax, 9
je 0x41e3bc
cmp ax, 0x20
je 0x41e3bc
cmp ax, 0xd
je 0x41e3bc
cmp ax, 0xa
je 0x41e3bc
mov edx, 0xa0
cmp ax, dx
je 0x41e3bc
cmp ax, 0xc
je 0x41e3bc
cmp ax, 0xb
je 0x41e3bc
mov edx, 0x85
cmp ax, dx
je 0x41e3bc
mov edx, 0x2028
cmp ax, dx
je 0x41e3bc
mov edx, 0x2029
cmp ax, dx
je 0x41e3bc
mov edx, 0x202f
cmp ax, dx
je 0x41e3bc
mov edx, 0x1680
cmp ax, dx
je 0x41e3bc
mov edx, 0x180e
cmp ax, dx
je 0x41e3bc
mov edx, 0x1fff
cmp ax, dx
jbe 0x41e39e
mov edx, 0x200c
cmp ax, dx
jb 0x41e3bc
mov edx, 0x3000
cmp ax, dx
je 0x41e3bc
mov edx, 0xfeff
cmp ax, dx
je 0x41e3bc
mov edx, 0x205f
cmp ax, dx
jne 0x41e3c8
movzx eax, word [ecx + 2]
add ecx, 2
jmp 0x41e310
mov dword [ebp - 0x100fc], ecx
cmp ax, 0x2b
je 0x41e3e4
movzx edx, ax
cmp ax, 0x2d
jne 0x41e3f1
mov byte [ebp - 0x100f1], 1
movzx edx, word [ecx + 2]
add ecx, 2
mov dword [ebp - 0x100fc], ecx
mov esi, dword [ebp - 0x10178]
cmp dx, 0x30
jb 0x41e448
mov edi, dword [ebp - 0x10174]
movzx edx, dx
cmp dx, 0x39
ja 0x41e448
mov eax, esi
mov ecx, edi
shld ecx, eax, 2
shl eax, 2
add esi, eax
movzx eax, dx
cdq
adc edi, ecx
shld edi, esi, 1
add esi, esi
add esi, eax
mov eax, dword [ebp - 0x100fc]
adc edi, edx
sub esi, 0x30
sbb edi, 0
add eax, 2
mov dword [ebp - 0x100fc], eax
movzx eax, word [eax]
mov edx, eax
cmp eax, 0x30
jae 0x41e406
mov eax, esi
neg eax
cmp byte [ebp - 0x100f1], 0
cmove eax, esi
or dword [ebp - 0x10168], eax
jmp 0x41e970
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
or dword [ebp - 0x10168], eax
jmp 0x41e970
cmp eax, 0x50
je 0x41e484
cmp eax, 0x70
jne 0x41e58c
cmp word [edi + 4], 0x3d
jne 0x41e58c
test si, si
jne 0x41e58c
lea ecx, [edi + 6]
call fcn.00405730
mov esi, eax
test esi, esi
je 0x41e6c0
cmp dword [0x457638], 7
jne 0x41e578
movzx eax, word [esi]
cmp eax, 0x4f
je 0x41e4c8
cmp eax, 0x6f
jne 0x41e578
movzx eax, word [esi + 2]
cmp eax, 0x53
je 0x41e4da
cmp eax, 0x73
jne 0x41e578
movzx eax, word [esi + 4]
cmp eax, 0x43
je 0x41e4ec
cmp eax, 0x63
jne 0x41e578
movzx eax, word [esi + 6]
cmp eax, 0x44
je 0x41e4fa
cmp eax, 0x64
jne 0x41e578
movzx eax, word [esi + 8]
cmp eax, 0x49
je 0x41e508
cmp eax, 0x69
jne 0x41e578
movzx eax, word [esi + 0xa]
cmp eax, 0x4d
je 0x41e516
cmp eax, 0x6d
jne 0x41e578
movzx eax, word [esi + 0xc]
cmp eax, 0x47
je 0x41e524
cmp eax, 0x67
jne 0x41e578
lea eax, [edi + 6]
mov dword [ebp - 0x100f8], eax
test eax, eax
je 0x41e555
push 0x457630
mov edx, 0x7fff
mov ecx, eax
call fcn.00402470
test eax, eax
js 0x41e54f
movzx eax, word [0x457630]
jmp 0x41e572
mov eax, dword [ebp - 0x100f8]
mov dword [0x457630], 0
test eax, eax
je 0x41e570
cmp word [eax], 0
je 0x41e570
mov eax, 0x7fff
jmp 0x41e572
xor eax, eax
mov dword [ebp - 0x10108], eax
push esi
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x41e6c0
cmp eax, 0x42
je 0x41e59a
cmp eax, 0x62
jne 0x41e62d
cmp word [edi + 4], 0x3d
jne 0x41e62d
cmp word [ebp - 0x10118], 0
jne 0x41e62d
lea esi, [edi + 6]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41e6c0
test al, 0x10
jne 0x41e6c0
mov dword [ebp - 0x1012c], esi
test esi, esi
je 0x41e5fb
push 0x457630
mov edx, 0x7fff
mov ecx, esi
call fcn.00402470
test eax, eax
js 0x41e5fb
movzx esi, word [0x457630]
mov dword [ebp - 0x10118], esi
jmp 0x41e6c0
mov dword [0x457630], 0
test esi, esi
je 0x41e61e
cmp word [esi], 0
je 0x41e61e
mov dword [ebp - 0x10118], 0x7fff
jmp 0x41e6c0
mov dword [ebp - 0x10118], 0
jmp 0x41e6c0
cmp eax, 0x43
je 0x41e63b
cmp eax, 0x63
jne 0x41e6c0
cmp word [edi + 4], 0x3d
jne 0x41e6c0
cmp word [ebp - 0x10110], 0
jne 0x41e6c0
lea ecx, [edi + 6]
nop
movzx eax, word [ecx]
cmp eax, 0x20
je 0x41e65d
cmp eax, 9
jne 0x41e662
add ecx, 2
jmp 0x41e650
test ax, ax
je 0x41e6c0
lea esi, [edi + 6]
mov dword [ebp - 0x10114], esi
test esi, esi
je 0x41e698
push 0x457630
mov edx, 0x7fff
mov ecx, esi
call fcn.00402470
test eax, eax
js 0x41e698
movzx esi, word [0x457630]
mov dword [ebp - 0x10110], esi
jmp 0x41e6c0
mov dword [0x457630], 0
test esi, esi
je 0x41e6b6
cmp word [esi], 0
mov dword [ebp - 0x10110], 0x7fff
jne 0x41e6c0
mov dword [ebp - 0x10110], 0
push ecx
lea eax, [ebp - 0x1011c]
mov ecx, edi
push eax
lea edx, [ebp - 0x10104]
call fcn.00404830
add esp, 8
test al, al
je 0x41e970
mov ecx, dword [ebp - 0x10138]
mov ax, word [0x457638]
mov edi, dword [ebp - 0x10104]
push 0
push 0x2000080
push 3
mov word [ecx + 4], ax
mov ecx, dword [ebp - 0x1011c]
mov eax, dword [ebp - 0x10138]
sub ecx, edi
push 0
push 7
push 0x120089
sar ecx, 1
push edi
mov word [eax + 6], cx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41e74b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x41e970
cmp dword [0x4574d4], 0
je 0x41f756
jmp 0x41e970
mov eax, dword [ebp - 0x10138]
push 0x23
mov dword [ebp - 0x10200], 0
push 8
and dword [eax], 0x7fffffff
lea eax, [ebp - 0x10200]
push eax
lea eax, [ebp - 0x10228]
push eax
push esi
call dword [0x4576d0]
test eax, eax
jns 0x41e7d3
push 4
push 0x28
lea eax, [ebp - 0x100f0]
push eax
lea eax, [ebp - 0x10228]
push eax
push esi
call dword [0x4576d0]
test eax, eax
js 0x41e967
mov eax, dword [ebp - 0x100d0]
mov dword [ebp - 0x10200], eax
mov ax, word [edi + 8]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x41e7d3
cmp eax, 2
je 0x41e7d3
mov eax, dword [ebp - 0x10138]
or dword [eax], 0x80000000
cmp dword [ebp - 0x1010c], 0
jne 0x41e83b
mov eax, dword [ebp - 0x10138]
cmp dword [eax], 0
movzx eax, word [0x4574e0]
jl 0x41e7f2
movzx eax, word [edi + 8]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x10238]
push eax
lea eax, [ebp - 0x10240]
push eax
lea eax, [ebp - 0x10150]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x41e833
mov eax, dword [ebp - 0x10150]
or eax, dword [ebp - 0x1014c]
je 0x41e833
mov dword [ebp - 0x1010c], 1
jmp 0x41e83b
xor eax, eax
mov dword [ebp - 0x1010c], eax
mov eax, dword [ebp - 0x10200]
and eax, 0x410
cmp eax, 0x10
jne 0x41e967
push edi
lea edx, [ebp - 0x10160]
lea ecx, [ebp - 0x101e8]
call fcn.0041da10
add esp, 4
test al, al
jne 0x41e8af
cmp dword [0x45771c], 0
je 0x41e967
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
mov eax, dword [ebp - 0x101e4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jne 0x41f6ae
cmp dword [0x45771c], 5
jne 0x41ebd8
cmp dword [0x457638], eax
je 0x41e998
jmp 0x41ebd8
mov eax, dword [ebp - 0x10138]
cmp dword [eax], 0
jl 0x41e8eb
cmp dword [0x4574d4], 0
jne 0x41e8eb
movzx eax, word [eax + 6]
mov edx, edi
mov ecx, dword [ebp - 0x10144]
push 0x120156
push eax
call fcn.00403fc0
add esp, 8
test al, al
je 0x41e990
mov eax, dword [ebp - 0x10138]
movzx eax, word [eax + 4]
lea eax, [eax*2 + 0x3e]
push eax
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x10138]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 0x10138]
cmp dword [eax + 0x10], 0
je 0x41e9b4
movzx eax, word [eax + 4]
xor ecx, ecx
mov word [edi + eax*2], cx
mov ecx, dword [ebp - 0x10138]
movzx eax, word [ecx + 4]
lea eax, [eax*2 + 2]
push eax
push edi
push dword [ecx + 0x10]
call fcn.0043c9e0
add esp, 0xc
add dword [ebp - 0x10188], 1
adc dword [ebp - 0x10184], 0
inc dword [ebp - 0x10160]
add dword [ebp - 0x10138], 0x18
inc dword [ebp - 0x1013c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
mov eax, dword [ebp - 0x10128]
inc eax
mov dword [ebp - 0x10128], eax
cmp eax, dword [ebp - 0x10124]
jae 0x41ea04
mov esi, dword [ebp - 0x10108]
jmp 0x41e1a0
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
cmp dword [0x4574d4], 0
je 0x41f756
mov dword [0x45771c], 5
jmp 0x41ebd8
mov dword [0x45771c], 8
jmp 0x41ebd8
push 0x65
push dword [ebp - 0x101e0]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp - 0x101e4]
push 0
push 0
push 0x44413c
mov byte [ebp - 0x101aa], 0
mov ecx, dword [eax]
push 2
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp - 0x101e4]
push 0
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
jmp 0x41f6ae
cmp dword [ebp - 0x10188], 0
je 0x41f6ae
push 0x65
push dword [ebp - 0x101e0]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp - 0x101e4]
push 0
push 0
push 0x44413c
mov byte [ebp - 0x101aa], 0
mov ecx, dword [eax]
push 2
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp - 0x101e4]
push 0
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
cmp byte [ebp - 0x101af], 0
je 0x41ea8a
mov eax, dword [ebp - 0x101dc]
mov byte [ebp - 0x101af], 0
test eax, eax
je 0x41ea8a
push 0
push 0
push 0x40a
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x50000000
push 0xfffffffffffffff0
push dword [ebp - 0x101dc]
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov edi, dword [0x4576b0]
lea eax, [ebp - 0xc0]
lea esi, [edi + edi]
push esi
push 0x4574d8
push eax
call fcn.0043c9e0
movups xmm0, xmmword [str.Oscdimg.exe]
mov ax, word [0x44ccfc]
lea ecx, [ebp - 0xc0]
add esp, 0xc
movups xmmword [ebp + esi - 0xc0], xmm0
movq xmm0, qword [0x44ccf4]
movq qword [ebp + esi - 0xb0], xmm0
mov word [ebp + esi - 0xa8], ax
mov eax, dword [ebp - 0x100f8]
test eax, eax
push esi
cmovne ecx, eax
lea eax, [ebp - 0x70]
push 0x4574d8
push eax
mov dword [ebp - 0x10124], ecx
call fcn.0043c9e0
movups xmm0, xmmword [str.etfsboot.com]
mov eax, dword [0x44cd18]
add esp, 0xc
movups xmmword [ebp + esi - 0x70], xmm0
movq xmm0, qword [0x44cd10]
movq qword [ebp + esi - 0x60], xmm0
mov dword [ebp + esi - 0x58], eax
mov esi, dword [ebp - 0x1012c]
test esi, esi
jne 0x41eb41
lea eax, [edi + 0xd]
lea esi, [ebp - 0x70]
movzx eax, ax
mov dword [ebp - 0x1012c], esi
mov dword [ebp - 0x10118], eax
push dword [ebp - 0x10124]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call edi
cmp eax, 0xffffffff
je 0x41eb6d
push esi
call edi
cmp eax, 0xffffffff
je 0x41eb6d
mov esi, dword [ebp - 0x10194]
mov edi, dword [ebp - 0x10198]
jmp 0x41ec7c
cmp dword [0x4574d4], 0
je 0x41f750
mov edi, dword [ebp - 0x10198]
lea eax, [ebp - 0x70]
mov esi, dword [ebp - 0x10194]
lea ecx, [ebp - 0x101e8]
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.0041d590
add esp, 8
test al, al
jne 0x41ec53
mov eax, dword [0x45771c]
mov ecx, 2
test eax, eax
push 0
cmove eax, ecx
mov dword [0x45771c], eax
mov eax, dword [ebp - 0x101e4]
push 1
push str.Error:_Downloadin_Oscdimg.exe
push 1
mov ecx, dword [eax]
push eax
call dword [ecx + 0x28]
mov dword [ebp - 0x101e8], eax
cmp byte [ebp - 0x101aa], 0
je 0x41ec1d
push 0x65
push dword [ebp - 0x101e0]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp - 0x101e4]
push 0
push 0
push 0x44413c
mov byte [ebp - 0x101aa], 0
mov ecx, dword [eax]
push 2
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp - 0x101e4]
push 0
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
sub esp, 8
lea ecx, [ebp - 0x101e8]
call fcn.00403080
push 0x320
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push dword [0x45771c]
lea ecx, [ebp - 0x101e8]
push 0x5dc
call fcn.00403330
jmp 0x41f6ae
sub esp, 8
lea ecx, [ebp - 0x101e8]
push 0
push 0
call fcn.00403110
xorps xmm0, xmm0
mov dword [ebp - 0x10198], edi
movlpd qword [ebp - 0x10190], xmm0
mov dword [ebp - 0x10194], esi
mov eax, dword [ebp - 0x10110]
test ax, ax
je 0x41eccd
mov edi, dword [ebp - 0x10104]
movzx esi, ax
add esi, esi
push esi
push dword [ebp - 0x10114]
push edi
call fcn.0043c9e0
movq xmm0, qword [0x44cd7c]
add esp, 0xc
add dword [ebp - 0x10110], 4
movq qword [esi + edi], xmm0
mov ax, word [0x44cd84]
mov word [esi + edi + 8], ax
mov esi, dword [ebp - 0x10194]
mov edi, dword [ebp - 0x10198]
test esi, esi
jne 0x41ece2
cmp edi, 0x63
ja 0x41ece2
mov dword [ebp - 0x10180], 1
jmp 0x41ecf3
push 0
push 0x64
push esi
push edi
call fcn.0043d1d0
mov dword [ebp - 0x10180], eax
mov dword [ebp - 0x101a8], 1
mov dword [ebp - 0x101a4], 0
mov byte [ebp - 0x101a9], 1
call dword [sym.imp.KERNEL32.dll_AllocConsole]
lea eax, [ebp - 0x10208]
push eax
push 1
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
mov edi, eax
push 2
push edi
call esi
push 0
push edi
call esi
mov esi, dword [0x45754c]
xor eax, eax
mov dword [ebp - 0x1025c], 1
mov word [ebp - 0x10258], ax
mov ecx, dword [esi + 0x60]
call fcn.00428880
push 0x14
push 0x457550
mov dword [ebp - 0x10178], eax
push dword [esi + 0x54]
push dword [esi + 0x50]
call dword [sym.imp.SHLWAPI.dll_StrFormatByteSizeW]
movups xmm0, xmmword [str.GOscdimg:]
mov dword [ebp - 0x10174], eax
mov eax, dword [0x44cd98]
mov dword [0x457730], eax
lea eax, [ebp - 0x10178]
push eax
push 0xfa
push 0x457734
push 0x400
push 0
push dword [0x4563bc]
movups xmmword [0x457720], xmm0
push 0x2400
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov eax, dword [ebp - 0x101e4]
push 0
push 0
push 0x457720
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x28]
mov dword [ebp - 0x101e8], eax
mov eax, dword [ebp - 0x101e4]
push 0
mov byte [ebp - 0x101a9], 1
push 1
mov ecx, dword [eax]
push eax
call dword [ecx + 0x30]
mov ecx, dword [ebp - 0x10188]
mov dword [ebp - 0x101e8], eax
mov eax, dword [ebp - 0x10148]
mov dword [ebp - 0x1011c], ecx
mov dword [ebp - 0x10138], eax
test ecx, ecx
je 0x41f68b
mov edi, dword [ebp - 0x10100]
mov eax, dword [ebp - 0x101e4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jne 0x41f68b
mov eax, dword [ebp - 0x10190]
mov esi, dword [ebp - 0x10104]
mov dword [ebp - 0x10128], eax
mov eax, dword [ebp - 0x1018c]
mov dword [ebp - 0x10130], eax
mov eax, dword [ebp - 0x10110]
test ax, ax
je 0x41ee6c
movzx eax, ax
add eax, eax
jmp 0x41ef06
mov ecx, dword [ebp - 0x10138]
movzx eax, word [ecx + 4]
add eax, eax
push eax
push dword [ecx + 0x10]
push esi
call fcn.0043c9e0
mov eax, dword [ebp - 0x10138]
lea edx, [ebp - 0x10230]
movups xmm0, xmmword [str.SETUP.EXE]
add esp, 0xc
movzx eax, word [eax + 4]
movups xmmword [esi + eax*2], xmm0
lea ecx, [esi + eax*2]
mov eax, dword [0x44cdb0]
mov dword [ecx + 0x10], eax
mov ax, word [0x44cdb4]
mov word [ecx + 0x14], ax
mov ecx, esi
call fcn.00405670
cmp word [ebp - 0x1022a], 5
je 0x41eeec
movups xmm0, xmmword [str.__u2__h__m__o__b_]
movups xmmword [esi], xmm0
movups xmm0, xmmword [0x44cdc8]
movups xmmword [esi + 0x10], xmm0
mov ax, word [0x44cdd8]
mov word [esi + 0x20], ax
mov eax, 0x22
jmp 0x41ef06
movups xmm0, xmmword [str.__h__n__m__o__b_]
mov eax, 0x20
movups xmmword [esi], xmm0
movups xmm0, xmmword [0x44cdec]
movups xmmword [esi + 0x10], xmm0
mov ecx, dword [ebp - 0x10118]
mov dword [ebp - 0x100f8], eax
add eax, esi
movzx esi, cx
add esi, esi
push esi
push dword [ebp - 0x1012c]
push eax
call fcn.0043c9e0
mov eax, dword [ebp - 0x100f8]
add esp, 0xc
add eax, dword [ebp - 0x10104]
movq xmm0, qword [str.___l_]
add esi, eax
movq qword [esi], xmm0
mov ax, word [0x44ce08]
mov word [esi + 8], ax
add esi, 0xa
mov ecx, dword [ebp - 0x10138]
mov dword [ebp - 0x10100], ecx
movzx edx, word [ecx + 4]
cmp edx, 8
jae 0x41f024
mov eax, dword [ecx + 0x10]
push 0
push 0
push 0
mov ax, word [eax + 8]
push 0
push 0
push 0x7fff
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
or dword [ecx], 0x80000000
push esi
push eax
mov dword [ebp - 0x10100], esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x41f003
test esi, esi
je 0x41efce
push 0x457630
mov edx, 0x20
mov ecx, esi
call fcn.00402470
test eax, eax
js 0x41efce
movzx eax, word [0x457630]
movzx ecx, ax
mov dword [ebp - 0x1010c], eax
add ecx, ecx
jmp 0x41f071
mov dword [0x457630], 0
test esi, esi
je 0x41eff4
cmp word [esi], 0
je 0x41eff4
mov eax, 0x20
movzx ecx, ax
mov dword [ebp - 0x1010c], eax
add ecx, ecx
jmp 0x41f071
xor eax, eax
movzx ecx, ax
mov dword [ebp - 0x1010c], eax
add ecx, ecx
jmp 0x41f071
mov eax, dword [ebp - 0x10138]
mov ecx, 2
mov dword [ebp - 0x1010c], 1
mov eax, dword [eax + 0x10]
mov ax, word [eax + 8]
mov word [esi], ax
jmp 0x41f071
movzx eax, word [ecx + 6]
sub edx, eax
movzx ecx, dx
movzx edx, cx
cmp ecx, 0x20
mov dword [ebp - 0x1010c], ecx
mov ecx, 0x20
cmova edx, ecx
mov ecx, eax
mov eax, dword [ebp - 0x10100]
mov eax, dword [eax + 0x10]
lea ecx, [eax + ecx*2]
movzx eax, dx
add eax, eax
mov dword [ebp - 0x10100], ecx
push eax
push ecx
push esi
mov dword [ebp - 0x10114], eax
call fcn.0043c9e0
mov ecx, dword [ebp - 0x10114]
add esp, 0xc
mov eax, dword [0x44ce0c]
mov dword [ecx + esi], eax
movzx eax, word [0x44ce10]
mov word [ecx + esi + 4], ax
add esi, 6
add esi, ecx
mov ecx, dword [ebp - 0x10138]
movzx eax, word [ecx + 4]
lea eax, [eax*2 - 8]
push eax
mov eax, dword [ecx + 0x10]
add eax, 8
push eax
push esi
call fcn.0043c9e0
mov eax, dword [ebp - 0x10138]
add esp, 0xc
movzx eax, word [eax + 4]
lea edx, [esi + eax*2]
mov eax, dword [0x44ce0c]
mov dword [edx - 8], eax
movzx eax, word [0x44ce10]
mov word [edx - 4], ax
add edx, 0xfffffffe
mov ecx, dword [ebp - 0x10138]
mov dword [ebp - 0x100fc], edx
cmp dword [ecx], 0
jge 0x41f107
movzx esi, word [0x4576b4]
add esi, esi
mov dword [ebp - 0x100f8], esi
lea eax, [esi - 8]
push eax
mov eax, dword [0x4574d0]
add eax, 8
push eax
push edx
call fcn.0043c9e0
add esp, 0xc
jmp 0x41f135
movzx eax, word [ecx + 6]
lea eax, [eax*2 - 8]
push eax
mov eax, dword [ecx + 0x10]
add eax, 8
push eax
push edx
call fcn.0043c9e0
mov eax, dword [ebp - 0x10138]
add esp, 0xc
movzx esi, word [eax + 6]
add esi, esi
mov dword [ebp - 0x100f8], esi
mov eax, dword [ebp - 0x100fc]
mov ecx, dword [ebp - 0x1010c]
add eax, 0xfffffff8
add eax, esi
movzx esi, cx
add esi, esi
push esi
push dword [ebp - 0x10100]
push eax
call fcn.0043c9e0
mov edx, dword [ebp - 0x100fc]
add esp, 0xc
movq xmm0, qword [str..iso]
add edx, 0xfffffff8
add edx, dword [ebp - 0x100f8]
push 0
push 1
movq qword [esi + edx], xmm0
mov ax, word [0x44ce1c]
mov word [esi + edx + 8], ax
mov eax, dword [ebp - 0x101e4]
push edx
push 2
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov edx, dword [ebp - 0x100fc]
sub esi, edx
mov dword [ebp - 0x101e8], eax
mov eax, dword [ebp - 0x100f8]
add eax, edx
add eax, esi
sar eax, 1
test byte [ebp - 0x10168], 2
movzx esi, ax
jne 0x41f1f2
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41f1ec
mov ecx, dword [ebp - 0x100fc]
lea eax, [esi + 0x1f]
push eax
mov edx, esi
call fcn.00404280
movzx esi, word [0x457638]
mov edx, eax
add esp, 4
mov dword [ebp - 0x100fc], edx
jmp 0x41f1f2
mov edx, dword [ebp - 0x100fc]
movzx eax, si
mov dword [ebp - 0x100f8], eax
mov dword [edx + eax*2], 0x22
lea eax, [ebp - 0x10218]
push eax
lea eax, [ebp - 0x10288]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x10104]
push dword [ebp - 0x10124]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x41f5a8
xor esi, esi
nop dword [eax + eax]
lea eax, [ebp - 0x101ec]
push eax
push dword [ebp - 0x10218]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x41f26c
cmp dword [ebp - 0x101ec], 0x103
je 0x41f26c
inc esi
cmp esi, 0xee6b2800
jb 0x41f240
push dword [ebp - 0x10210]
call dword [sym.imp.KERNEL32.dll_AttachConsole]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
mov dword [0x45771c], 0
mov dword [ebp - 0x10100], ecx
mov ecx, dword [ebp - 0x10138]
mov dword [ebp - 0x10120], eax
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
test ecx, ecx
jne 0x41f2b9
cmp edx, 0x63
ja 0x41f2b9
mov dword [ebp - 0x10114], 1
jmp 0x41f2ca
push 0
push 0x64
push ecx
push edx
call fcn.0043d1d0
mov dword [ebp - 0x10114], eax
mov esi, dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
push 1
push dword [ebp - 0x10218]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x41f416
mov eax, dword [ebp - 0x101e4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jne 0x41f71b
lea eax, [ebp - 0x1016c]
push eax
push edi
push 0x8002
lea eax, [ebp - 0x100c8]
push eax
push dword [ebp - 0x10120]
call esi
test eax, eax
je 0x41f2d0
cmp dword [ebp - 0x1016c], 0
je 0x41f2d0
mov ecx, 0x7ffd
lea eax, [ebp - 0x100c8]
cmp word [eax], 0x25
je 0x41f345
add eax, 2
sub ecx, 1
jne 0x41f331
cmp word [eax], 0x25
jne 0x41f2d0
xor edx, edx
mov esi, 4
nop dword [eax]
sub esi, 1
je 0x41f366
movzx ecx, word [eax - 2]
sub eax, 2
cmp ecx, 0x30
jb 0x41f366
cmp ecx, 0x39
jbe 0x41f350
movzx ecx, word [eax + 2]
add eax, 2
cmp ecx, 0x30
jb 0x41f393
mov esi, ecx
cmp si, 0x39
ja 0x41f393
movzx ecx, si
lea edx, [edx + edx*4]
add eax, 2
lea edx, [edx - 0x18]
lea edx, [ecx + edx*2]
movzx ecx, word [eax]
mov esi, ecx
cmp ecx, 0x30
jae 0x41f374
mov esi, dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
cmp edx, dword [ebp - 0x10100]
je 0x41f2d0
mov ecx, dword [ebp - 0x10114]
mov eax, 0
imul ecx, edx
push 0
push dword [ebp - 0x10180]
mov dword [ebp - 0x10100], edx
add ecx, dword [ebp - 0x10128]
mov dword [ebp - 0x10190], ecx
adc eax, dword [ebp - 0x10130]
push eax
push ecx
mov dword [ebp - 0x1018c], eax
call fcn.0043d1d0
mov dword [ebp - 0x101a0], eax
mov dword [ebp - 0x1019c], edx
cmp edx, dword [ebp - 0x101a4]
jb 0x41f2d0
ja 0x41f406
cmp eax, dword [ebp - 0x101a8]
jbe 0x41f2d0
lea ecx, [ebp - 0x101e8]
call fcn.004031a0
jmp 0x41f2ca
push dword [ebp - 0x10218]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
push dword [ebp - 0x10214]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1016c]
push eax
push edi
push 0x8002
lea eax, [ebp - 0x100c8]
push eax
push dword [ebp - 0x10120]
call esi
xor esi, esi
mov byte [ebp - 0x10108], 0
mov dword [0x45771c], esi
lea edx, [ebp - 0x100c8]
mov eax, 0x7ff8
test eax, eax
je 0x41f47e
nop dword [eax]
cmp word [edx], 0x45
je 0x41f47e
add edx, 2
sub eax, 1
jne 0x41f470
cmp eax, 6
jbe 0x41f57d
movzx ecx, word [edx]
cmp ecx, 0x45
je 0x41f498
cmp ecx, 0x65
jne 0x41f57d
movzx ecx, word [edx + 2]
cmp ecx, 0x52
je 0x41f4aa
cmp ecx, 0x72
jne 0x41f57d
movzx ecx, word [edx + 4]
cmp ecx, 0x52
je 0x41f4bc
cmp ecx, 0x72
jne 0x41f57d
movzx ecx, word [edx + 6]
cmp ecx, 0x4f
je 0x41f4ce
cmp ecx, 0x6f
jne 0x41f57d
movzx ecx, word [edx + 8]
cmp ecx, 0x52
je 0x41f4e0
cmp ecx, 0x72
jne 0x41f57d
cmp word [edx + 0xa], 0x20
jne 0x41f55c
lea ecx, [edx + 0xc]
mov dword [ebp - 0x10100], ecx
movzx ecx, word [ecx]
cmp ecx, 0x30
jb 0x41f57d
cmp ecx, 0x39
ja 0x41f57d
mov edx, dword [ebp - 0x10100]
sub eax, 6
mov dword [ebp - 0x100f8], eax
je 0x41f54c
movzx eax, word [edx]
add eax, 0xffffffd0
cmp ax, 9
ja 0x41f546
movzx eax, word [edx]
lea esi, [esi + esi*4]
lea esi, [esi - 0x18]
add edx, 2
lea esi, [eax + esi*2]
mov eax, dword [ebp - 0x100f8]
dec eax
mov dword [0x45771c], esi
mov dword [ebp - 0x100f8], eax
test eax, eax
jne 0x41f512
jmp 0x41f54c
mov eax, dword [ebp - 0x100f8]
cmp word [edx], 0x3a
je 0x41f58d
xor esi, esi
mov dword [0x45771c], esi
jmp 0x41f57d
mov ecx, dword [ebp - 0x10108]
cmp word [edx + 0xa], 0x3a
movzx ecx, cl
mov dword [ebp - 0x10108], ecx
cmove ecx, dword [ebp - 0x1021c]
mov dword [ebp - 0x10108], ecx
test eax, eax
je 0x41f58d
add edx, 2
sub eax, 1
jne 0x41f465
cmp byte [ebp - 0x10108], 0
je 0x41f5ae
test esi, esi
mov eax, 0x3ee
cmove esi, eax
mov dword [0x45771c], esi
jmp 0x41f5ae
mov esi, dword [0x45771c]
mov eax, dword [ebp - 0x10138]
push 0
push dword [ebp - 0x10180]
mov ecx, dword [eax + 8]
add ecx, dword [ebp - 0x10128]
mov eax, dword [eax + 0xc]
adc eax, dword [ebp - 0x10130]
add dword [ebp - 0x10188], 0xffffffff
push eax
adc dword [ebp - 0x10184], 0xffffffff
push ecx
mov dword [ebp - 0x10190], ecx
mov dword [ebp - 0x1018c], eax
call fcn.0043d1d0
mov dword [ebp - 0x101a0], eax
mov dword [ebp - 0x1019c], edx
cmp edx, dword [ebp - 0x101a4]
jb 0x41f61e
ja 0x41f60d
cmp eax, dword [ebp - 0x101a8]
jbe 0x41f61e
lea ecx, [ebp - 0x101e8]
call fcn.004031a0
mov esi, dword [0x45771c]
test esi, esi
je 0x41f641
cmp dword [ebp - 0x1011c], 1
lea ecx, [ebp - 0x101e8]
sete al
movzx eax, al
push eax
push esi
push 0x3e8
call fcn.00403330
mov esi, dword [ebp - 0x101f0]
push esi
push dword [ebp - 0x10120]
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea eax, [ebp - 0x101f8]
push eax
push esi
push 0x4000
push 0x20
push dword [ebp - 0x10120]
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
mov esi, dword [ebp - 0x1011c]
add dword [ebp - 0x10138], 0x18
dec esi
mov dword [ebp - 0x1011c], esi
test esi, esi
jne 0x41ee25
lea ecx, [ebp - 0x101e8]
mov byte [ebp - 0x101a0], 0x64
call fcn.004031a0
push 0x258
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push dword [ebp - 0x10104]
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 8
lea ecx, [ebp - 0x10160]
call fcn.00403870
add esp, 8
lea ecx, [ebp - 0x101e8]
call fcn.00403270
cmp dword [0x45771c], 0
lea ecx, [ebp - 0x101e8]
sete byte [ebp - 0x100f1]
call fcn.00402f30
mov al, byte [ebp - 0x100f1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00428cd6
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x4c7
push dword [ebp - 0x10218]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
mov eax, dword [ebp - 0x100fc]
xor edx, edx
mov ecx, dword [ebp - 0x100f8]
push eax
mov word [eax + ecx*2], dx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x41f6ae
mov edi, dword [ebp - 0x10104]
push edi
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 0xc
lea edx, [ebp - 0x10160]
lea ecx, [ebp - 0x101e8]
call fcn.00403910
int3