Function at 0x403470
Capabilities:
Create process on windows
Get common file path
Get program files directory
Read .ini file
Schedule task via at

Disassembly:
push 0xffffffffffffffff
push 0x40579d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x13c
push ebx
push ebp
push esi
xor ebx, ebx
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], ebx
call fcn.00405284
mov ecx, dword [0x4091c0]
mov ebp, dword [esp + 0x15c]
cmp ecx, ebx
mov dword [esp + 0x154], ebx
je 0x4034cd
cmp dword [ecx + 0x20], ebx
je 0x4034cd
cmp ebp, ebx
je 0x40356c
push 0x408a08
call sub.MFC42.DLL_CWnd::SetWindowTextA
cmp ebp, ebx
je 0x4034d6
call fcn.00404db0
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push str.disacert.dl_
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x90]
push 0x408fec
push str._s_s
push 0x408ee8
rep stosd dword es:[edi], eax
call esi
push str.disacert.dll
push 0x408fec
push str._s_s
push 0x408de4
call esi
push 0x28
push ebx
push str.disacert.dll
call fcn.00402ac0
push ebx
push ebp
push 0x408de4
push 0x408ee8
call fcn.00402d60
add esp, 0x3c
test eax, eax
jne 0x40357b
cmp ebp, ebx
je 0x40357b
push 0x28
push ebx
push 0x4089c8
call fcn.00402ac0
add esp, 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x154], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x4042c2
push 0x408060
call sub.MFC42.DLL_CWnd::SetWindowTextA
jmp 0x4034d6
push str.disacert_1k.dl_
push 0x408fec
push str._s_s
push 0x408ee8
call esi
push str.disacert_1k.dll
push 0x408fec
push str._s_s
push 0x408de4
call esi
push 0x28
push 1
push str.disacert_1k.dll
call fcn.00402ac0
push ebx
push ebp
push 0x408de4
push 0x408ee8
call fcn.00402d60
add esp, 0x3c
test eax, eax
jne 0x4035df
cmp ebp, ebx
je 0x4035df
push 0x28
push 1
push 0x408990
jmp 0x403549
push str.disacert_1kND.dl_
push 0x408fec
push str._s_s
push 0x408ee8
call esi
push str.disacert_1kND.dll
push 0x408fec
push str._s_s
push 0x408de4
call esi
push 0x28
push 2
push str.disacert_1kND.dll
call fcn.00402ac0
push ebx
push ebp
push 0x408de4
push 0x408ee8
call fcn.00402d60
add esp, 0x3c
test eax, eax
jne 0x403643
cmp ebp, ebx
je 0x403643
push 0x28
push 2
push 0x40894c
jmp 0x403549
push str.ChkTrust.ex_
push 0x408fec
push str._s_s
push 0x408ee8
call esi
push str.ChkTrust.exe
push 0x408fec
push str._s_s
push 0x408de4
call esi
mov ebx, 3
push 0x28
push ebx
push str.ChkTrust.exe
call fcn.00402ac0
push 0
push ebp
push 0x408de4
push 0x408ee8
call fcn.00402d60
add esp, 0x3c
test eax, eax
jne 0x4036ab
test ebp, ebp
je 0x4036ab
push 0x28
push ebx
push 0x408914
jmp 0x403549
push str.ep1kdl20.dll
push 0x408fec
push str._susbdriver_s
push 0x408ee8
call esi
push str.ep1kdl20.dll
push 0x408ce0
push str._sSystem32_s
push 0x408de4
call esi
push 0x28
push 4
push str.ep1kdl20.dll
call fcn.00402ac0
push 0
push ebp
push 0x408de4
push 0x408ee8
call fcn.00402d60
add esp, 0x3c
test eax, eax
jne 0x403710
test ebp, ebp
je 0x403710
push 0x28
push 4
push 0x4088cc
jmp 0x403549
push str.FT_ND_API.dll
push 0x408fec
push str._susbdriver_s
push 0x408ee8
call esi
push str.FT_ND_API.dll
push 0x408ce0
push str._sSystem32_s
push 0x408de4
call esi
push 0x28
push 5
push str.FT_ND_API.dll
call fcn.00402ac0
push 0
push ebp
push 0x408de4
push 0x408ee8
call fcn.00402d60
add esp, 0x3c
test eax, eax
jne 0x403775
test ebp, ebp
je 0x403775
push 0x28
push 5
push 0x4088a4
jmp 0x403549
push str.eps1k.INF
push 0x408fec
push str._susbdriver_s
push 0x408ee8
call esi
push str.eps1k.INF
push 0x408ce0
push str._sinf_s
push 0x408de4
call esi
push 0x28
push 6
push str.eps1k.INF
call fcn.00402ac0
add esp, 0x2c
test ebp, ebp
je 0x4037dc
push 0
push 0x408de4
push 0x408ee8
call fcn.004033c0
add esp, 0xc
test eax, eax
jne 0x4037f3
push 0x28
push 6
push 0x408878
jmp 0x403549
push 0x408ee8
call fcn.00403420
push 0x408de4
call fcn.00403420
add esp, 8
push str.eps1k.sys
push 0x408fec
push str._susbdriver_s
push 0x408ee8
call esi
push str.eps1k.sys
push 0x408ce0
push str._sSystem32drivers_s
push 0x408de4
call esi
push 0x28
push 7
push str.eps1k.sys
call fcn.00402ac0
add esp, 0x2c
test ebp, ebp
je 0x40385a
push 0
push 0x408de4
push 0x408ee8
call fcn.004033c0
add esp, 0xc
test eax, eax
jne 0x403871
push 0x28
push 7
push 0x408840
jmp 0x403549
push 0x408ee8
call fcn.00403420
push 0x408de4
call fcn.00403420
add esp, 8
push str.usbic1k.SYS
push 0x408fec
push str._susbdriver_s
push 0x408ee8
call esi
push str.usbic1k.SYS
push 0x408ce0
push str._sSystem32drivers_s
push 0x408de4
call esi
push 0x28
push 8
push str.usbic1k.sys
call fcn.00402ac0
add esp, 0x2c
test ebp, ebp
je 0x4038dc
push 0
push 0x408de4
push 0x408ee8
call fcn.004033c0
add esp, 0xc
test eax, eax
jne 0x403a78
push 0x28
push 8
push 0x408814
jmp 0x403549
push 0x408ee8
call fcn.00403420
push 0x408de4
call fcn.00403420
push str.USBProxy.dll
push 0x408fec
push str._s_s
push 0x408de4
call esi
push 0x28
push 9
push 0x4087f0
call fcn.00402ac0
push 0
push 0x408de4
call fcn.00403130
add esp, 0x2c
lea eax, [esp + 0xcc]
push 0
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [esp + 0xcc]
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x18]
mov byte [esp + 0x154], 1
call fcn.00405284
push str._adt_tpn_server.his
lea ecx, [esp + 0x18]
mov byte [esp + 0x158], 2
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CStdioFile::CStdioFile
mov edx, dword [esp + 0x14]
push 0
push 0x4000
push edx
lea ecx, [esp + 0x40]
mov byte [esp + 0x160], bl
call sub.MFC42.DLL_CStdioFile::Open
test eax, eax
je 0x403a12
lea eax, [esp + 0x18]
lea ecx, [esp + 0x34]
push eax
call sub.MFC42.DLL_CStdioFile::ReadString
test eax, eax
je 0x403a09
mov edi, dword [sym.imp.WININET.dll_InternetSetCookieA]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
push str.https:__
push edx
call sub.MFC42.DLL_operator_1
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x158], 4
call fcn.004052fc
lea ecx, [esp + 0x20]
mov byte [esp + 0x154], bl
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x18]
push str.0_expires__Sat__01_Jan_2030_00:00:00_GMT
push str.IsUseOcx
push eax
call edi
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x38]
call sub.MFC42.DLL_CStdioFile::ReadString
test eax, eax
jne 0x4039b0
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CStdioFile::Close
lea ecx, [esp + 0x34]
mov byte [esp + 0x154], 2
call fcn.00405320
lea ecx, [esp + 0x18]
mov byte [esp + 0x154], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x154], 0
call sub.MFC42.DLL_CString::CString
push str.USBCtrl.dll
push 0x408fec
push str._s_s
push 0x408de4
call esi
push 0x28
push 0xa
push 0x40877c
call fcn.00402ac0
push 0
push 0x408de4
call fcn.00403130
add esp, 0x24
push str.USBProxy.dl_
push 0x408fec
push str._s_s
push 0x408ee8
call esi
push str.USBProxy.dll
push 0x408fec
push str._s_s
push 0x408de4
call esi
push 0x28
push 0xb
push str.USBProxy.dll
call fcn.00402ac0
push 0
push ebp
push 0x408de4
push 0x408ee8
call fcn.00402d60
add esp, 0x3c
test eax, eax
jne 0x403add
test ebp, ebp
je 0x403add
push 0x28
push 0xb
push 0x408754
jmp 0x403549
push str.USBCtrl.dl_
push 0x408fec
push str._s_s
push 0x408ee8
call esi
push str.USBCtrl.dll
push 0x408fec
push str._s_s
push 0x408de4
call esi
push 0x28
push 0xc
push str.USBCtrl.dll
call fcn.00402ac0
xor edi, edi
push edi
push ebp
push 0x408de4
push 0x408ee8
call fcn.00402d60
add esp, 0x3c
test eax, eax
jne 0x403b65
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, 0xa
jle 0x403b44
test ebp, ebp
jne 0x403bca
push 0x3e8
call ebx
push 0
push ebp
push 0x408de4
push 0x408ee8
inc edi
call fcn.00402d60
add esp, 0x10
test eax, eax
je 0x403b37
push str.TpnMangr.ex_
push 0x408fec
push str._s_s
push 0x408ee8
call esi
push str.TpnMangr.exe
push 0x408fec
push str._s_s
push 0x408de4
call esi
push 0x28
push 0xd
push str.TpnMangr.exe
call fcn.00402ac0
push 0
push ebp
push 0x408de4
push 0x408ee8
call fcn.00402d60
add esp, 0x3c
test eax, eax
jne 0x403bd8
test ebp, ebp
je 0x403bd8
push 0x28
push 0xd
push 0x408710
jmp 0x403549
push 0x28
push 0xc
push 0x4086fc
jmp 0x403549
push str.USBCtrl.dll
push 0x408fec
push str._s_s
push 0x408de4
call esi
push 0x28
push 0xe
push 0x4086ec
call fcn.00402ac0
push ebp
push 0x408de4
call fcn.00403130
add esp, 0x24
test eax, eax
jne 0x403c20
test ebp, ebp
je 0x403c20
push 0x28
push 0xe
push 0x4086d8
jmp 0x403549
push str.USBProxy.dll
push 0x408fec
push str._s_s
push 0x408de4
call esi
push 0x28
push 0xf
push 0x4086c4
call fcn.00402ac0
push ebp
push 0x408de4
call fcn.00403130
add esp, 0x24
test eax, eax
jne 0x403c68
test ebp, ebp
je 0x403c6c
push 0x28
push 0xf
push 0x4086ac
jmp 0x403549
test ebp, ebp
jne 0x403ca1
push str.AVpnSrv.exe
push 0x408fec
push str._s_s
push 0x408de4
call esi
push 0x28
push 0x10
push 0x408690
call fcn.00402ac0
push 0
push 0
push 0x408de4
call fcn.004042e0
add esp, 0x28
push str.adtcore.dl_
push 0x408fec
push str._s_s
push 0x408ee8
call esi
push str.adtcore.dll
push 0x408fec
push str._s_s
push 0x408de4
call esi
push 0x28
push 0x11
push str.adtcore.dll
call fcn.00402ac0
push 0
push ebp
push 0x408de4
push 0x408ee8
call fcn.00402d60
add esp, 0x3c
test eax, eax
jne 0x403d06
test ebp, ebp
je 0x403d06
push 0x28
push 0x11
push 0x408664
jmp 0x403549
push str.socksclient.dl_
push 0x408fec
push str._s_s
push 0x408ee8
call esi
push str.socksclient.dll
push 0x408fec
push str._s_s
push 0x408de4
call esi
push 0x28
push 0x12
push str.socksclient.dll
call fcn.00402ac0
push 0
push ebp
push 0x408de4
push 0x408ee8
call fcn.00402d60
add esp, 0x3c
test eax, eax
jne 0x403d6b
test ebp, ebp
je 0x403d6b
push 0x28
push 0x12
push 0x40862c
jmp 0x403549
push str.ver.ver
push 0x408fec
push str._s_s
push 0x408ee8
mov ebx, 0x13
call esi
add esp, 0x10
lea edx, [esp + 0x8c]
push 0x408ee8
push 0x14
push edx
push 0x408cd8
push str.ADTVNIC
push 0x408618
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, 0x4083d4
lea edi, [esp + 0x8c]
mov dl, byte [edi]
mov cl, dl
cmp dl, byte [eax]
jne 0x403ddd
test cl, cl
je 0x403dd9
mov dl, byte [edi + 1]
mov cl, dl
cmp dl, byte [eax + 1]
jne 0x403ddd
add edi, 2
add eax, 2
test cl, cl
jne 0x403db9
xor eax, eax
jmp 0x403de2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x403e38
test ebp, ebp
push 0x28
push 0x13
je 0x403df5
push 0x408608
jmp 0x403dfa
push 0x4085f8
call fcn.00402ac0
add esp, 0xc
push ebp
call fcn.004043e0
add esp, 4
mov dword [0x4091bc], eax
test eax, eax
jne 0x403e26
test ebp, ebp
je 0x403e33
push 0x28
push 0x13
push 0x4085e4
jmp 0x403549
cmp eax, 2
jne 0x403e33
mov dword [esp + 0x1c], 1
mov ebx, 0x14
push str.AVpnSrv.ex_
push 0x408fec
push str._s_s
push 0x408ee8
call esi
push str.AVpnSrv.exe
push 0x408fec
push str._s_s
push 0x408de4
call esi
push 0x28
push ebx
push str.AVpnSrv.exe
call fcn.00402ac0
push 0
push ebp
push 0x408de4
push 0x408ee8
call fcn.00402d60
add esp, 0x3c
test eax, eax
jne 0x403e9b
test ebp, ebp
je 0x403e9b
push 0x28
push ebx
push 0x4085c4
jmp 0x403549
inc ebx
test ebp, ebp
je 0x403ee4
push str.AVpnSrv.exe
push 0x408fec
push str._s_s
push 0x408de4
call esi
push 0x28
push ebx
push 0x4085b4
call fcn.00402ac0
push 0
push ebp
push 0x408de4
call fcn.004042e0
add esp, 0x28
test eax, eax
jne 0x403ee4
push 0x28
push ebx
push 0x4085a0
jmp 0x403549
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x48]
inc ebx
rep stosd dword es:[edi], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x48], 0x44
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
test ebp, ebp
mov dword [esp + 0x30], eax
mov word [esp + 0x78], ax
je 0x403f7c
push str.Setup.exe_1
lea ecx, [esp + 0x18]
push 0x4091b8
push ecx
call sub.MFC42.DLL_operator
push 0x400
lea ecx, [esp + 0x18]
mov byte [esp + 0x158], 5
call sub.MFC42.DLL_CString::GetBuffer
lea edx, [esp + 0x24]
lea ecx, [esp + 0x48]
push edx
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
or edi, 0xffffffff
lea ecx, [esp + 0x14]
push edi
call sub.MFC42.DLL_CString::ReleaseBuffer
lea ecx, [esp + 0x14]
mov byte [esp + 0x154], 0
call sub.MFC42.DLL_CString::CString
jmp 0x403fe4
push str.Setup.exe_0
lea edx, [esp + 0x18]
push 0x4091b8
push edx
call sub.MFC42.DLL_operator
push 0x400
lea ecx, [esp + 0x18]
mov byte [esp + 0x158], 6
call sub.MFC42.DLL_CString::GetBuffer
lea ecx, [esp + 0x24]
lea edx, [esp + 0x48]
push ecx
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0xffffffffffffffff
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::ReleaseBuffer
lea ecx, [esp + 0x14]
mov byte [esp + 0x154], 0
call sub.MFC42.DLL_CString::CString
or edi, 0xffffffff
mov eax, dword [esp + 0x24]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test ebp, ebp
jne 0x404025
push str.AdtRdp.ocx
push 0x408fec
push str._s_s
push 0x408de4
call esi
push 0x28
push ebx
push 0x40856c
call fcn.00402ac0
push ebp
push 0x408de4
call fcn.00403130
add esp, 0x24
inc ebx
test ebp, ebp
jne 0x40405b
push str.AdtTsc.ocx
push 0x408fec
push str._s_s
push 0x408de4
call esi
push 0x28
push ebx
push 0x408550
call fcn.00402ac0
push ebp
push 0x408de4
call fcn.00403130
add esp, 0x24
push str.AdtRdp.oc_
push 0x408fec
push str._s_s
push 0x408ee8
inc ebx
call esi
push str.AdtRdp.ocx
push 0x408fec
push str._s_s
push 0x408de4
call esi
push 0x28
push ebx
push str.AdtRdp.ocx
call fcn.00402ac0
push 0
push ebp
push 0x408de4
push 0x408ee8
call fcn.00402d60
add esp, 0x3c
test eax, eax
jne 0x4040bf
test ebp, ebp
je 0x4040bf
push 0x28
push ebx
push 0x408530
jmp 0x4041a9
push str.AdtTsc.oc_
push 0x408fec
push str._s_s
push 0x408ee8
inc ebx
call esi
push str.AdtTsc.ocx
push 0x408fec
push str._s_s
push 0x408de4
call esi
push 0x28
push ebx
push str.AdtTsc.ocx
call fcn.00402ac0
push 0
push ebp
push 0x408de4
push 0x408ee8
call fcn.00402d60
add esp, 0x3c
test eax, eax
jne 0x404123
test ebp, ebp
je 0x404123
push 0x28
push ebx
push 0x408510
jmp 0x4041a9
push str.AdtTsc.ocx
push 0x408fec
push str._s_s
push 0x408de4
inc ebx
call esi
push 0x28
push ebx
push 0x408500
call fcn.00402ac0
push ebp
push 0x408de4
call fcn.00403130
add esp, 0x24
test eax, eax
jne 0x404167
test ebp, ebp
je 0x404167
push 0x28
push ebx
push 0x4084ec
jmp 0x4041a9
push str.AdtRdp.ocx
push 0x408fec
push str._s_s
push 0x408de4
inc ebx
call esi
push 0x28
push ebx
push 0x4084dc
call fcn.00402ac0
push ebp
push 0x408de4
call fcn.00403130
add esp, 0x24
test eax, eax
jne 0x4041c8
test ebp, ebp
je 0x4041c8
push 0x28
push ebx
push 0x4084c8
call fcn.00402ac0
add esp, 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x154], edi
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x4042c2
inc ebx
push 0x28
test ebp, ebp
push ebx
je 0x4041d7
push 0x4084b4
jmp 0x4041dc
push 0x4084a0
call fcn.00402ac0
add esp, 0xc
push ebp
call fcn.004049a0
add esp, 4
inc ebx
test ebp, ebp
push 0x28
push ebx
je 0x4041fc
push 0x408494
jmp 0x404201
push 0x408488
call fcn.00402ac0
add esp, 0xc
push ebp
call fcn.004047a0
add esp, 4
inc ebx
test ebp, ebp
push 0x28
jne 0x4042af
push ebx
push 0x408478
call fcn.00402ac0
push 0x408fec
call fcn.00404520
add esp, 0x10
push 0x28
push 0x28
push 0x40846c
call fcn.00402ac0
push str.ver.ver
push 0x408468
call fcn.00404b60
push str.ver.ver
push 0x408464
call fcn.00404b60
push str.ver.ver
push 0x408460
call fcn.00404b60
mov eax, dword [0x4091c0]
add esp, 0x24
test eax, eax
je 0x404290
mov eax, dword [eax + 0x20]
test eax, eax
je 0x404290
push 0
push 0
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x154], edi
test eax, eax
lea ecx, [esp + 0x10]
je 0x4042b8
call sub.MFC42.DLL_CString::CString
mov eax, 2
jmp 0x4042c2
push 0x28
push 0x408454
jmp 0x40423e
call sub.MFC42.DLL_CString::CString
mov eax, 1
mov ecx, dword [esp + 0x14c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x148
ret