Function at 0x41e4c6
Capabilities:
Check os version
Contain obfuscated stackstrings
Get disk information
Query or enumerate registry value
Set console window title

Disassembly:
mov eax, 0x43359f
call fcn.004269c8
sub esp, 0x48c
mov eax, dword [0x44de90]
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], eax
push 0x104
lea eax, [ebp - 0x448]
xor edi, edi
push eax
inc edi
push ebx
mov dword [ebp - 0x45c], ebx
mov dword [ebp - 0x44c], ebx
mov dword [ebp - 0x470], ebx
mov dword [ebp - 0x454], ebx
mov dword [ebp - 0x494], ebx
mov dword [ebp - 0x468], ebx
mov dword [ebp - 0x488], ebx
mov dword [ebp - 0x48c], edi
mov dword [ebp - 0x484], edi
mov byte [ebp - 0x1c], 0xa9
mov byte [ebp - 0x1b], 0x96
mov byte [ebp - 0x1a], 0x8d
mov byte [ebp - 0x19], 0x8a
mov byte [ebp - 0x18], 0x8c
mov byte [ebp - 0x17], 0xff
mov byte [0x451a28], bl
mov byte [0x451a29], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41e570
mov eax, dword [ebp + 0xc]
push dword [eax]
lea eax, [ebp - 0x448]
push eax
call fcn.00425600
pop ecx
pop ecx
push str.Utility_for_cleaning_infection_by:_nI_Worm.Zafi.b_nI_Worm.Bagle.at_au_cx_dw_nVirus.Win32.Implinker.a_nNot_a_virus.AdWare.Visiter_nTrojan.Win32.Krotten_nEmail_Worm.Win32.Brontok.n_nBackdoor.Win32.Allaple.a_nTrojan_Spy.Win32.Goldun.mg_nEmail_Worm.Win32.Warezov_nTrojan_Spy.Win32.Banker.cmb__variants__nBackdoor.Win32.Vanbot.bk_nWorm.Win32.VB.gj_nVirus.Win32.GpCode.ai_nVirus.Win32.VB.he_nIM_Worm.Win32.Sohanad.as_nP2P_Worm.Win32.Malas.b__nVirus.Win32.AutoRun.acw__nWorm.Win32.VB.jn__nTrojan.Win32.KillAV.nj__nWorm.Win32.AutoRun.cby__nTrojan.Win32.Agent.aec__nTrojan_Downloader.Win32.Todon.an__nWorm.Win32.AutoRun.czz_daa_dhq_dfx__nNet_Worm.Win32.Rovud.a_c__nTrojan.Win32.ConnectionServices.x_aa__nWorm.Win32.AutoRun.dtx__nWorm.Win32.AutoRun.hr__nBackdoor.Win32.Agent.lad__nnot_a_virus:FraudTool.Win32.UltimateDefender.cm__nTrojan_Downloader.Win32.Agent.wbu__nBackdoor.Win32.Small.cyb__nnot_a_virus:FraudTool.Win32.XPSecurityCenter.c__nnot_a_virus:Downloader.Win32.VistaAntivirus.a__nnot_a_virus:FraudTool.Win32.UltimateAntivirus.an__nnot_a_virus:FraudTool.Win32.UltimateAntivirus.ap__nTrojan_Spy.Win32.Zbot.dlh__nTrojan_Downloader.Win32.Small.abpz__nRootkit.Win32.Ressdt.br__nWorm.Win32.AutoRun.lsf__nWorm.Win32.AutoRun.epo__nWorm.Win32.AutoRun.enw__nBackdoor.Win32.UltimateDefender.a__nWorm.Win32.AutoRun.pwi__nWorm.Win32.AutoRun.pfh__nWorm.Win32.AutoRun.qhk__nWorm.Win32.AutoRun.ouu__nWorm.Win32.AutoRun.bnb__nWorm.Win32.AutoRun.ll__nAdWare.Win32.Cinmus.sxy__nTrojan.Win32.Autoit.eo__nWorm.Win32.AutoRun.sct__nWorm.Win32.AutoRun.qkn__nnot_a_virus:AdWare.Win32.Cinmus.wsu__nTrojan_Ransom.Win32.Taras.a_c__nTrojan_Dropper.Win32.Agent.ztu__nTrojan_Downloader.Win32.Agent.Apnd__nWorm.Win32.Autorun.qpa__nNet_Worm.Win32.Kido.j__nWorm.Win32.Autorun.dcw__nTrojan.Win32.Feedel.gen__nTrojan.Win32.Pakes.mak__nNet_Worm.Win32.Kido.r_t__nWorm.VBS.Autorun.cq__nWorm.Win32.Pinit.ac_ae_af_ft_gen__nNet_Worm.Win32.Kido.bw_db_fk_fo_fx_s_dh_ee_gh_fa_gy_ca_by_if_eo_bx_bh_bg_ha_hr_da_dz_cg_eg_eq_bz_do_fw_du_cv_dv_dq_ed_em_bo_bk_bm_cs_ia_gg_cy_gb_hf__nTrojan.Win32.Autoit.vu__nWorm.Win32.FlyStudio.bh__nstart_klwk_utility_with__i____or__h_command_line_to_see_more_information._nVersion_12.0.0.20_nCopyright__C__Kaspersky_Lab__Antropov_Alexey__Vitaly_Kamluk__Boris_Yampolsky_2000_2008._All_rights_reserved._n_n
call fcn.00425036
mov esi, 0x44dc28
push esi
call fcn.00426157
push ebx
push ebx
push ebx
lea eax, [ebp - 0x448]
push edi
push eax
call fcn.00423920
add esp, 0x1c
cmp eax, ebx
je 0x41e5e8
call fcn.00426376
test eax, eax
je 0x41e5ac
call fcn.004262b5
jmp 0x41e59c
push str.Authentication_of_utility_failed._nProbable_cause:_n__the_module_was_corrupted_during_downloading_via_the_Internet_n__virus_infection_or_other_type_of_hack_n_nRecommend_redownload_this_module._nDo_you_want_to_continue_to_work___Y___yes__N___no__n
call fcn.00425036
push esi
call fcn.00426157
pop ecx
pop ecx
call fcn.004262b5
mov esi, eax
xor eax, eax
cmp esi, 0x79
setne al
xor ecx, ecx
cmp esi, 0x59
setne cl
test ecx, eax
jne 0x41f5d1
push 0x434408
call fcn.00425036
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0x240]
push eax
mov dword [ebp - 0x240], 0x94
call esi
test eax, eax
jne 0x41e624
lea eax, [ebp - 0x240]
push eax
mov dword [ebp - 0x240], 0x94
call esi
test eax, eax
jne 0x41e624
push 4
pop eax
jmp 0x41f5d6
cmp dword [ebp + 8], edi
mov eax, dword [ebp - 0x230]
mov dword [0x451a2c], eax
jle 0x41e8b4
mov dword [ebp - 0x450], edi
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x450], eax
jge 0x41e8b4
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x450]
lea esi, [eax + ecx*4]
push 0x4400ac
push dword [esi]
call fcn.0042766e
test eax, eax
pop ecx
pop ecx
jne 0x41e678
or dword [ebp - 0x44c], 0x48
mov dword [ebp - 0x45c], edi
push 0x4400a8
push dword [esi]
call fcn.0042766e
test eax, eax
pop ecx
pop ecx
jne 0x41e697
or dword [ebp - 0x44c], 0x10
mov dword [ebp - 0x45c], edi
push str._path
push dword [esi]
call fcn.0042766e
test eax, eax
pop ecx
pop ecx
jne 0x41e6c9
inc dword [ebp - 0x450]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x450]
lea esi, [eax + ecx*4]
mov eax, dword [esi]
mov dword [ebp - 0x470], eax
mov dword [ebp - 0x45c], edi
push str._gpcode_single
push dword [esi]
call fcn.0042766e
test eax, eax
pop ecx
pop ecx
jne 0x41e6fe
inc dword [ebp - 0x450]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x450]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x494], edi
mov dword [ebp - 0x490], eax
jmp 0x41e8a9
push str._gpcode_key
push dword [esi]
call fcn.0042766e
test eax, eax
pop ecx
pop ecx
jne 0x41e733
inc dword [ebp - 0x450]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x450]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x454], edi
mov dword [ebp - 0x46c], eax
jmp 0x41e8a9
push 0x440080
push dword [esi]
call fcn.0042766e
test eax, eax
pop ecx
pop ecx
jne 0x41e74b
mov dword [ebp - 0x488], edi
push 0x44007c
push dword [esi]
call fcn.0042766e
test eax, eax
pop ecx
pop ecx
jne 0x41e763
mov dword [ebp - 0x468], edi
push 0x440078
push dword [esi]
call fcn.0042766e
test eax, eax
pop ecx
pop ecx
jne 0x41e77b
mov dword [ebp - 0x484], ebx
push 4
pop edi
push edi
push str._Rpt
push dword [esi]
call fcn.00427839
add esp, 0xc
test eax, eax
jne 0x41e7ee
mov byte [ebp - 0x455], bl
mov eax, dword [esi]
mov al, byte [edi + eax]
xor ecx, ecx
cmp al, 0x3d
setne cl
xor edx, edx
cmp al, bl
setne dl
test edx, ecx
je 0x41e7cb
cmp al, 0x61
jne 0x41e7ba
mov byte [ebp - 0x455], 1
cmp al, 0x6f
jne 0x41e7c8
mov dword [0x451cdc], 1
inc edi
jmp 0x41e798
mov eax, dword [esi]
cmp byte [eax + edi], 0x3d
jne 0x41e7d4
inc edi
movzx ecx, byte [ebp - 0x455]
push ecx
lea ecx, [ebp - 0x448]
push ecx
add eax, edi
push eax
call fcn.00419714
add esp, 0xc
push 0x44006c
push dword [esi]
call fcn.0042766e
mov edi, eax
neg edi
push 0x440068
push dword [esi]
sbb edi, edi
inc edi
call fcn.0042766e
neg eax
sbb eax, eax
push 0x440064
push dword [esi]
inc eax
or edi, eax
call fcn.0042766e
add esp, 0x18
neg eax
sbb eax, eax
inc eax
or edi, eax
je 0x41e86a
push str.Command_line:_n_s_n____to_force_scanning_of_hard_drives._n_n___to_force_scanning_of_mapped_network_drives._n_path__path_to_scan____to_force_scanning_specified_path_n_rd___to_force_restoring_registry_values._n_tn___include_scanning_of_mapped_network_drives._n_y___do_not_request_key_press._n_nr___do_not_reboot_system_automatically_in_any_cases_n_Rpt_ao___Report_file_path_____create_report_file_n_ta___add_to_existing_report_file_n_to___report_only__do_not_cure_delete_infected_files__n_gpcode_key__key_for_decryption___see_readme.txt__gpcode_single__file_to_decrypt___see_readme.txt__i_____h____show_command_line_info._n_nReturn_codes:_n0___nothing_to_clean_n1___system_was_disinfected_n2___to_finalize_removal_of_infection_you_should_reboot_system_n3___to_finalize_removal_of_infection_you_should_reboot_system_and_start_this_program_the_second_time_n4___program_error.
call fcn.00425036
pop ecx
call fcn.00426376
test eax, eax
je 0x41e847
call fcn.004262b5
jmp 0x41e837
push str._nPress_any_key_to_continue.
call fcn.00425036
mov dword [esp], 0x44dc28
call fcn.00426157
pop ecx
call fcn.004262b5
xor eax, eax
jmp 0x41f5d6
push 0xa
push str._DrvDeinst
push dword [esi]
call fcn.00427839
add esp, 0xc
test eax, eax
jne 0x41e8a6
push str.KLMoveFileExDrv
call fcn.0041a2cf
pop ecx
call fcn.00412a8a
lea eax, [ebp - 0x490]
push eax
lea eax, [ebp - 0x46c]
push eax
call fcn.0041bae1
pop ecx
pop ecx
jmp 0x41e863
xor edi, edi
inc edi
inc dword [ebp - 0x450]
jmp 0x41e63e
lea ecx, [ebp - 0x1ac]
call fcn.00418c09
push str.klwk.ini
lea ecx, [ebp - 0x1ac]
mov byte [ebp - 4], 1
call fcn.00418e89
cmp eax, ebx
je 0x41e9f7
push str.Reading_initialization_data__n_n
call fcn.00425036
pop ecx
push ebx
push str.QuietMode
mov esi, str.Main
push esi
lea ecx, [ebp - 0x1ac]
call fcn.00419064
push ebx
push str.NotReboot
push esi
lea ecx, [ebp - 0x1ac]
mov dword [ebp - 0x468], eax
call fcn.00419064
xor ecx, ecx
cmp eax, ebx
sete cl
push ebx
push str.LocalScan
push esi
mov dword [ebp - 0x484], ecx
lea ecx, [ebp - 0x1ac]
call fcn.00419064
cmp eax, ebx
je 0x41e945
or dword [ebp - 0x44c], 0x48
mov dword [ebp - 0x45c], edi
push ebx
push str.NetScan
push esi
lea ecx, [ebp - 0x1ac]
call fcn.00419064
cmp eax, ebx
je 0x41e968
or dword [ebp - 0x44c], 0x10
mov dword [ebp - 0x45c], edi
push 0x40
pop ecx
mov byte [ebp - 0x344], bl
xor eax, eax
lea edi, [ebp - 0x343]
rep stosd dword es:[edi], eax
push str.NotFound
stosw word es:[edi], ax
push str.ReportFile
push esi
lea ecx, [ebp - 0x1ac]
stosb byte es:[edi], al
call fcn.00419003
push eax
lea eax, [ebp - 0x344]
push eax
call fcn.00425600
cmp byte [ebp - 0x344], 0x30
pop ecx
pop ecx
je 0x41e9d5
push ebx
push str.AddReport
push esi
lea ecx, [ebp - 0x1ac]
call fcn.00419064
push eax
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x344]
push eax
call fcn.00419714
add esp, 0xc
push ebx
push str.ReportOnly
push esi
lea ecx, [ebp - 0x1ac]
call fcn.00419064
lea ecx, [ebp - 0x1ac]
mov dword [0x451cdc], eax
call fcn.00418fe3
push str.Removing_malicious_applications...
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push str.Do_not_start_any_applications_while_scanning_is_in_progress__n_n
call fcn.00425036
mov dword [esp], 0x44dc28
call fcn.00426157
mov dword [esp], 0x451b38
mov esi, 0x451b34
push esi
push 0x43fbe0
mov edi, str.kernel32.dll
push edi
call fcn.004195d0
push 0x451b3c
push esi
push 0x43fbd0
push edi
mov dword [0x451df0], eax
call fcn.004195d0
push 0x451b40
push esi
push 0x43fbc4
push edi
mov dword [0x451df4], eax
call fcn.004195d0
push 0x451b44
push esi
push 0x43fbb8
push edi
mov dword [0x451df8], eax
call fcn.004195d0
add esp, 0x40
push 0x451b48
push esi
push 0x43fba0
push edi
mov dword [0x451dfc], eax
call fcn.004195d0
push 0x451b4c
push esi
push 0x43fb90
push edi
mov dword [0x451e00], eax
call fcn.004195d0
push 0x451b50
push esi
push 0x43fb7c
push edi
mov dword [0x451e04], eax
call fcn.004195d0
push 0x451b54
push esi
push 0x43fb68
push edi
mov dword [0x451e08], eax
call fcn.004195d0
add esp, 0x40
push 0x451ba0
push esi
push str.MoveFileExA
push edi
mov dword [0x451e0c], eax
call fcn.004195d0
push 0x451ba4
push esi
push str.RegCreateKeyExA
push str.Advapi32.dll
mov dword [0x451e10], eax
call fcn.004195d0
push 0x451ba8
push esi
push 0x43fb2c
push str.Advapi32.dll
mov dword [0x451e14], eax
call fcn.004195d0
push 0x451bac
push esi
push 0x43fb20
push str.Advapi32.dll
mov dword [0x451e18], eax
call fcn.004195d0
add esp, 0x40
push 0x451bb0
push esi
push 0x43fb10
push str.Advapi32.dll
mov dword [0x451e1c], eax
call fcn.004195d0
push 0x451bb4
push esi
push 0x43fb00
push str.Advapi32.dll
mov dword [0x451e20], eax
call fcn.004195d0
push 0x451bb8
push esi
push 0x43faec
push str.Advapi32.dll
mov dword [0x451e24], eax
call fcn.004195d0
push 0x451bbc
push esi
push 0x43fadc
push str.Advapi32.dll
mov dword [0x451e28], eax
call fcn.004195d0
add esp, 0x40
push 0x451bc0
push esi
push str.RegQueryInfoKeyA
push str.Advapi32.dll
mov dword [0x451e2c], eax
call fcn.004195d0
push 0x451bc4
push esi
push str.RegEnumValueA
push str.Advapi32.dll
mov dword [0x451e30], eax
call fcn.004195d0
push 0x451bc8
push esi
push str.RegEnumKeyA
push str.Advapi32.dll
mov dword [0x451e34], eax
call fcn.004195d0
push 0x451bcc
push esi
push 0x43faa0
push edi
mov dword [0x451e38], eax
call fcn.004195d0
add esp, 0x40
push 0x451bd0
push esi
push 0x43fa90
push edi
mov dword [0x451e3c], eax
call fcn.004195d0
add esp, 0x10
mov dword [0x451e40], eax
call fcn.00423038
cmp dword [ebp - 0x454], ebx
jne 0x41eca8
lea eax, [ebp - 0x454]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
mov dword [ebp - 0x454], ebx
call dword [0x451e18]
cmp eax, ebx
jne 0x41ecb9
push 4
pop eax
mov dword [ebp - 0x498], eax
mov dword [ebp - 0x46c], eax
lea eax, [ebp - 0x498]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x46c]
push eax
push ebx
push str.WinCode
push dword [ebp - 0x454]
mov dword [ebp - 0x450], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41ecb9
mov eax, dword [ebp - 0x450]
jmp 0x41ecb4
push dword [ebp - 0x46c]
call fcn.004275c4
pop ecx
mov dword [0x44ed00], eax
cmp dword [ebp - 0x494], ebx
je 0x41ece1
push str.Single_file_decryption_mode._n
call fcn.00425036
push dword [0x44ed00]
push dword [ebp - 0x490]
call fcn.00415d31
add esp, 0xc
jmp 0x41ed37
mov esi, 0x451ce8
push esi
call fcn.00425700
test eax, eax
pop ecx
jne 0x41ed0f
push 0x104
push esi
push ebx
call dword [0x451e0c]
cmp eax, ebx
jne 0x41ed0f
mov eax, dword [ebp + 0xc]
push dword [eax]
push esi
call fcn.00425600
pop ecx
pop ecx
call fcn.00419498
cmp dword [ebp - 0x488], ebx
mov dword [ebp - 0x454], eax
mov dword [ebp - 0x460], ebx
mov dword [ebp - 0x464], 3
je 0x41ed4a
call fcn.0041c35e
lea ecx, [ebp - 0x1ac]
mov byte [ebp - 4], bl
call fcn.00418e84
jmp 0x41e863
call fcn.0041dafa
cmp al, bl
je 0x41ed71
push ebx
call fcn.00410513
pop ecx
mov esi, eax
lea ecx, [ebp - 0x1ac]
mov byte [ebp - 4], bl
call fcn.00418e84
mov eax, esi
jmp 0x41f5d6
call fcn.004030e8
xor esi, esi
cmp eax, ebx
je 0x41ed8c
or dword [ebp - 0x44c], 0x48
inc esi
mov dword [ebp - 0x45c], esi
jmp 0x41ed8d
inc esi
call fcn.004032d4
cmp eax, ebx
je 0x41eda3
or dword [ebp - 0x44c], 0x48
mov dword [ebp - 0x45c], esi
call fcn.00412a8a
call fcn.00417e1b
call fcn.0041ddea
cmp eax, ebx
je 0x41ede8
push 0xa
push 0xe6
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x41eddb
push 0x80
push 0x2500
push eax
call fcn.00418827
add esp, 0xc
or dword [ebp - 0x44c], 0x4c
mov dword [ebp - 0x45c], esi
call fcn.0041dbb9
cmp al, bl
je 0x41f023
mov byte [ebp - 0x90], 0x55
mov byte [ebp - 0x8f], 0x8b
mov byte [ebp - 0x8e], 0xec
mov byte [ebp - 0x8d], 0x51
mov byte [ebp - 0x8c], 0x53
mov byte [ebp - 0x8b], 0x56
mov byte [ebp - 0x8a], 0x8b
mov byte [ebp - 0x89], 0x75
mov byte [ebp - 0x88], 8
mov byte [ebp - 0x87], 0x57
mov byte [ebp - 0x86], 0x33
mov byte [ebp - 0x85], 0xff
mov byte [ebp - 0x84], 0x57
mov byte [ebp - 0x83], 0x68
mov byte [ebp - 0x82], 0x80
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], bl
mov byte [ebp - 0x7f], bl
mov byte [ebp - 0x7e], 0x6a
mov byte [ebp - 0x7d], 3
mov byte [ebp - 0x7c], 0x57
mov byte [ebp - 0x7b], 0x8d
mov byte [ebp - 0x7a], 0x5e
mov byte [ebp - 0x79], 0x1c
mov byte [ebp - 0x78], 0x6a
mov byte [ebp - 0x77], 1
mov byte [ebp - 0x76], 0x68
mov byte [ebp - 0x75], bl
mov byte [ebp - 0x74], bl
mov byte [ebp - 0x73], bl
mov byte [ebp - 0x72], 0x80
mov byte [ebp - 0x71], 0x53
mov byte [ebp - 0x70], 0xff
mov byte [ebp - 0x6f], 0x56
mov byte [ebp - 0x6e], 4
mov byte [ebp - 0x6d], 0x89
mov byte [ebp - 0x6c], 0x45
mov byte [ebp - 0x6b], 0xfc
mov byte [ebp - 0x6a], 0x8d
mov byte [ebp - 0x69], 0x86
mov byte [ebp - 0x68], 0x20
mov byte [ebp - 0x67], 1
mov byte [ebp - 0x66], bl
mov byte [ebp - 0x65], bl
mov byte [ebp - 0x64], 0x50
mov byte [ebp - 0x63], 0x57
mov byte [ebp - 0x62], 0x57
mov byte [ebp - 0x61], 0xff
mov byte [ebp - 0x60], 0x56
mov byte [ebp - 0x5f], 8
mov byte [ebp - 0x5e], 0x89
mov byte [ebp - 0x5d], 0x45
mov byte [ebp - 0x5c], 8
mov byte [ebp - 0x5b], 0xff
mov byte [ebp - 0x5a], 0x56
mov byte [ebp - 0x59], 0xc
mov byte [ebp - 0x58], 0x3d
mov byte [ebp - 0x57], 0xb7
mov byte [ebp - 0x56], bl
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], bl
mov byte [ebp - 0x53], 0x75
mov byte [ebp - 0x52], 0x15
mov byte [ebp - 0x51], 0xff
mov byte [ebp - 0x50], 0x75
mov byte [ebp - 0x4f], 8
mov byte [ebp - 0x4e], 0xff
mov byte [ebp - 0x4d], 0x56
mov byte [ebp - 0x4c], 0x10
mov byte [ebp - 0x4b], 0xff
mov byte [ebp - 0x4a], 0x75
mov byte [ebp - 0x49], 8
mov byte [ebp - 0x48], 0xff
mov byte [ebp - 0x47], 0x16
mov byte [ebp - 0x46], 0x68
mov byte [ebp - 0x45], 0x10
mov byte [ebp - 0x44], 0x27
mov byte [ebp - 0x43], bl
mov byte [ebp - 0x42], bl
mov byte [ebp - 0x41], 0xff
mov byte [ebp - 0x40], 0x56
push 0x72
lea eax, [ebp - 0x90]
push ebx
push eax
mov byte [ebp - 0x3f], 0x14
mov byte [ebp - 0x3e], 0xeb
mov byte [ebp - 0x3d], 0xd2
mov byte [ebp - 0x3c], 0xff
mov byte [ebp - 0x3b], 0x75
mov byte [ebp - 0x3a], 0xfc
mov byte [ebp - 0x39], 0xff
mov byte [ebp - 0x38], 0x16
mov byte [ebp - 0x37], 0xff
mov byte [ebp - 0x36], 0x75
mov byte [ebp - 0x35], 8
mov byte [ebp - 0x34], 0xff
mov byte [ebp - 0x33], 0x56
mov byte [ebp - 0x32], 0x10
mov byte [ebp - 0x31], 0xff
mov byte [ebp - 0x30], 0x75
mov byte [ebp - 0x2f], 8
mov byte [ebp - 0x2e], 0xff
mov byte [ebp - 0x2d], 0x16
mov byte [ebp - 0x2c], 0x57
mov byte [ebp - 0x2b], 0x53
mov byte [ebp - 0x2a], 0xff
mov byte [ebp - 0x29], 0x56
mov byte [ebp - 0x28], 0x18
mov byte [ebp - 0x27], 0x5f
mov byte [ebp - 0x26], 0x5e
mov byte [ebp - 0x25], 0x33
mov byte [ebp - 0x24], 0xc0
mov byte [ebp - 0x23], 0x5b
mov byte [ebp - 0x22], 0xc9
mov byte [ebp - 0x21], 0xc2
mov byte [ebp - 0x20], 4
mov byte [ebp - 0x1f], bl
call fcn.004192a9
add esp, 0xc
push 0xa
push 0xed
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x41f016
push 0x80
push 0x36b0
push eax
call fcn.00418827
add esp, 0xc
or dword [ebp - 0x44c], 0x4c
mov dword [ebp - 0x45c], esi
mov esi, dword [ebp - 0x454]
cmp esi, ebx
je 0x41f047
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x41f043
push dword [esi + 0x24]
push 2
call eax
pop ecx
pop ecx
mov dword [ebp - 0x464], eax
mov esi, dword [esi]
jmp 0x41f029
push str.Scanning_registry:_n
mov dword [ebp - 0x464], 3
call fcn.00419ab0
mov edi, 0x451a20
push edi
mov esi, 0x451a24
push esi
mov dword [0x451a24], ebx
mov dword [0x451a20], ebx
call fcn.0041bae1
add esp, 0xc
push edi
push esi
call fcn.0041be13
mov edx, dword [0x451a24]
pop ecx
pop ecx
mov ecx, dword [0x451a20]
add ecx, edx
jne 0x41f098
cmp eax, ebx
jbe 0x41f09d
xor edi, edi
inc edi
jmp 0x41f0a3
mov edi, dword [ebp - 0x45c]
call fcn.0041a4a5
call fcn.0041dbee
cmp al, bl
jne 0x41f0ba
call fcn.0041e4a4
cmp al, bl
je 0x41f0cb
xor edi, edi
inc edi
or dword [ebp - 0x44c], 0x48
mov byte [0x451a29], 1
push str.Scanning_memory:_n
call fcn.00419ab0
lea eax, [ebp - 0x460]
push eax
push dword [ebp - 0x454]
lea eax, [ebp - 0x464]
push eax
mov dword [0x451a08], ebx
mov dword [0x451a0c], ebx
mov dword [0x451a10], ebx
mov dword [0x451a14], ebx
mov dword [0x451a18], ebx
mov dword [0x451a1c], ebx
call fcn.00422069
add esp, 0x10
cmp dword [ebp - 0x464], 1
jne 0x41f12f
xor edi, edi
inc edi
or dword [ebp - 0x44c], 0x48
mov byte [0x451a29], 1
cmp dword [ebp - 0x464], 2
jne 0x41f150
xor edi, edi
inc edi
or dword [ebp - 0x44c], 0x48
mov byte [0x451a28], 1
mov byte [0x451a29], 1
mov eax, dword [ebp - 0x460]
cmp eax, ebx
je 0x41f1c4
cmp eax, ebx
je 0x41f1c4
mov ecx, dword [eax + 8]
push dword [ecx + 0x34]
push dword [eax + 4]
push str._s_tinfected_t_s_n
call fcn.00419ab0
add esp, 0xc
cmp dword [0x451cdc], ebx
jne 0x41f19d
mov eax, dword [ebp - 0x460]
push 1
push dword [eax + 8]
push dword [eax + 4]
call fcn.004019f5
add esp, 0xc
push 0x44dc28
call fcn.00426157
pop ecx
mov eax, dword [ebp - 0x460]
push dword [eax + 4]
mov esi, dword [eax]
call fcn.00425476
push dword [ebp - 0x460]
call fcn.00425476
pop ecx
mov eax, esi
pop ecx
mov dword [ebp - 0x460], eax
jmp 0x41f15a
mov dword [ebp - 0x460], ebx
call fcn.0041a439
push dword [0x451a08]
push str._nmodules_t_t_t_t_t:_d_n
call fcn.00419ab0
push dword [0x451a0c]
push str.infected_t_t_t_t:_d_n
call fcn.00419ab0
push dword [0x451a10]
push str.disinfected_t_t_t_t:_d_n
call fcn.00419ab0
push dword [0x451a14]
push str.will_be_disinfected_after_reboot_t:_d_n
call fcn.00419ab0
push dword [0x451a18]
push str.deleted_t_t_t_t_t:_d_n
call fcn.00419ab0
push dword [0x451a1c]
push str.will_be_deleted_after_reboot_t_t:_d_n_n
call fcn.00419ab0
mov esi, dword [ebp - 0x454]
add esp, 0x30
cmp esi, ebx
je 0x41f270
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x41f26c
push dword [esi + 0x24]
push 3
call eax
pop ecx
mov dword [ebp - 0x464], eax
dec eax
pop ecx
jne 0x41f26c
push esi
push 0x4349c5
call fcn.0040483e
pop ecx
xor edi, edi
pop ecx
mov byte [0x451a29], 1
inc edi
mov esi, dword [esi]
jmp 0x41f238
cmp edi, ebx
je 0x41f347
mov dword [ebp - 0x450], 0x63
mov esi, 0x451a30
mov eax, dword [ebp - 0x450]
cmp eax, 0x7a
jg 0x41f2e9
push 0x43f804
push esi
mov byte [0x451a30], al
mov byte [0x451a31], bl
call fcn.00425610
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
xor edx, edx
inc edx
mov ecx, eax
mov eax, dword [ebp - 0x44c]
shl edx, cl
test eax, edx
je 0x41f2e1
push esi
push str.Scanning__s_drive:_n
call fcn.00419ab0
push 0x451a08
push dword [ebp - 0x454]
push esi
call fcn.0041da47
add esp, 0x14
inc dword [ebp - 0x450]
jmp 0x41f287
cmp dword [ebp - 0x470], ebx
je 0x41f347
push dword [ebp - 0x470]
call fcn.00425700
mov edi, eax
lea eax, [edi + 1]
cmp eax, 0x104
pop ecx
jae 0x41f347
push dword [ebp - 0x470]
push esi
call fcn.00425600
lea eax, [edi + 0x451a30]
cmp byte [eax - 1], 0x5c
pop ecx
pop ecx
je 0x41f328
mov word [eax], 0x5c
push esi
push str.Scanning__s_directory:_n
call fcn.00419ab0
push 0x451a08
push dword [ebp - 0x454]
push esi
call fcn.0041da47
add esp, 0x14
push dword [ebp - 0x454]
call fcn.004195a2
xor edi, edi
inc edi
push edi
push ebx
mov esi, str.__1___
push esi
push ebx
push ebx
call fcn.0041b7fd
add esp, 0x18
push edi
push ebx
push esi
push ebx
push edi
call fcn.0041b7fd
add esp, 0x14
push edi
push ebx
push esi
push ebx
push 2
call fcn.0041b7fd
add esp, 0x14
push edi
push ebx
push esi
push ebx
push 4
call fcn.0041b7fd
add esp, 0x14
push edi
push ebx
push esi
push ebx
push 7
call fcn.0041b7fd
add esp, 0x14
push 0x4349c5
push ebx
push ebx
push ebx
push str.DisableRegistryTools
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call fcn.0041aa5e
add esp, 0x1c
cmp byte [0x451a29], bl
je 0x41f413
xor eax, eax
cmp eax, 6
jge 0x41f3dc
mov cl, byte [ebp + eax - 0x1c]
not cl
mov byte [ebp + eax - 0xa0], cl
inc eax
jmp 0x41f3c7
lea eax, [ebp - 0xa0]
push eax
push eax
push str.We_recommend_to_use_Kaspersky_Anti__s_to_scan_your_hard_drive._nYou_can_download_free_trial_version_of_Kaspersky_Anti__s_from_nhttp:__www.kaspersky.com__n_n
call fcn.00425036
push 0xa
lea eax, [ebp - 0xa0]
push ebx
push eax
call fcn.00425190
mov edi, 0x44dc28
push edi
call fcn.00426157
add esp, 0x1c
mov dword [ebp - 0x48c], ebx
jmp 0x41f418
mov edi, 0x44dc28
cmp byte [0x451a28], bl
je 0x41f4ff
cmp dword [ebp - 0x484], ebx
je 0x41f4e3
cmp dword [ebp - 0x468], ebx
jne 0x41f475
call fcn.00426376
test eax, eax
je 0x41f448
call fcn.004262b5
jmp 0x41f438
push str._nTo_finalize_removal_of_infection_and_avoid_loosing_of_data_program_will_reboot_your_PC_now._nClose_all_programs_and_choose_Y_to_restart_or_N_to_continue._n.
call fcn.00425036
push edi
call fcn.00426157
pop ecx
pop ecx
call fcn.004262b5
mov esi, eax
xor eax, eax
cmp esi, 0x79
sete al
xor ecx, ecx
cmp esi, 0x59
sete cl
or eax, ecx
je 0x41f4e3
cmp dword [0x451ce0], ebx
je 0x41f4d6
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x476]
push eax
movzx eax, word [ebp - 0x478]
push eax
movzx eax, word [ebp - 0x480]
push eax
movzx eax, word [ebp - 0x47e]
push eax
movzx eax, word [ebp - 0x47a]
push eax
push str.scan_finished__d__d__d__d:_d._n_n_n
push dword [0x451ce0]
call fcn.00424eec
push dword [0x451ce0]
call fcn.00425e5d
mov dword [0x451ce0], ebx
add esp, 0x20
call fcn.0042095f
cmp al, bl
jne 0x41f5a7
push str.You_should_close_all_programs_and_restart_your_PC_now_nto_finalize_removal_of_infection._n
call fcn.00425036
push edi
call fcn.00426157
pop ecx
pop ecx
mov dword [0x44c9e8], 2
cmp dword [ebp - 0x48c], ebx
je 0x41f51a
push str.Nothing_to_clean._n
call fcn.00419ab0
pop ecx
mov dword [0x44c9e8], ebx
jmp 0x41f524
mov dword [0x44c9e8], 1
cmp dword [0x451ce0], ebx
je 0x41f57f
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x476]
push eax
movzx eax, word [ebp - 0x478]
push eax
movzx eax, word [ebp - 0x480]
push eax
movzx eax, word [ebp - 0x47e]
push eax
movzx eax, word [ebp - 0x47a]
push eax
push str.scan_finished__d__d__d__d:_d._n_n_n
push dword [0x451ce0]
call fcn.00424eec
push dword [0x451ce0]
call fcn.00425e5d
add esp, 0x20
cmp dword [ebp - 0x468], ebx
jne 0x41f5a7
call fcn.00426376
test eax, eax
je 0x41f597
call fcn.004262b5
jmp 0x41f587
push str._nPress_any_key_to_continue.
call fcn.00425036
pop ecx
call fcn.004262b5
mov esi, dword [0x44c9e8]
jmp 0x41ed5c
mov eax, dword [0x44c9e8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.00425221
pop edi
pop esi
pop ebx
leave
ret