Function at 0x40bea0
Capabilities:
Execute command
Set console window title
Set current directory

Disassembly:
push ebp
mov eax, 0x42e0
mov ebp, esp
push edi
push ebx
call fcn.0041a2f0
sub esp, eax
lea eax, [ebp - 8]
lea edi, [ebp - 0x4004]
mov dword [ebp - 0x42b4], sym.___gxx_personality_sj0
mov dword [ebp - 0x42ac], eax
lea eax, [ebp - 0x42cc]
lea ebx, [ebp - 0x4008]
mov dword [ebp - 0x42a4], esp
mov dword [ebp - 0x42b0], 0x4f1408
mov dword [ebp - 0x42a8], 0x40c745
mov dword [esp], eax
call dbg._Unwind_SjLj_Register
mov dword [esp], str.Initialization:_Start_
mov dword [ebp - 0x42c8], 0xffffffff
call sym.void_log_char__23___char_const_____23__
mov dword [esp], str.Initialization:_Set_current_directory...
call sym.void_log_char__41___char_const_____41__
xor eax, eax
mov ecx, 0x3ff
mov dword [ebp - 0x4008], 0
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x4008]
mov dword [esp], 0
mov dword [esp + 4], edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [esp + 8], 0x1000
mov dword [ebp - 0x42d0], edi
call edi
lea edi, [ebp - 0x2004]
sub esp, 0xc
mov dword [esp], ebx
mov dword [esp + 4], 0x5c
call sym._strrchr
mov byte [eax], 0
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x3008]
mov dword [esp], ebx
mov dword [esp + 4], str.cd__d__s
call sym.sprintf_char__char_const__..._
mov dword [esp], ebx
lea ebx, [ebp - 0x4008]
call sym._system
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
sub esp, 4
mov dword [esp], str.Initialization:_Get_priviledge...
call sym.void_log_char__34___char_const_____34__
mov dword [esp], 5
call sym.GetAdmin_int_
call sym.GetDebugPrivilege__
mov dword [esp], str.Set_startup_items...
call sym.void_log_char__21___char_const_____21__
mov dword [esp], 1
call sym.SetStart_bool_
mov dword [esp], str.Initialization:_Set_window_title...
call sym.void_log_char__36___char_const_____36__
mov dword [esp], 0x4f609b
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
sub esp, 4
mov dword [esp], str.Initialization:_Disable_FastMake...
call sym.void_log_char__36___char_const_____36__
call sym.DisableFastMake__
mov dword [esp], str.Initialization:_Lock_files_in_quarantine_zone...
call sym.void_log_char__49___char_const_____49__
xor eax, eax
mov ecx, 0x3ff
mov dword [ebp - 0x2008], 0
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2008]
mov dword [esp], 0
mov dword [esp + 8], 0x1000
mov dword [esp + 4], eax
mov edi, dword [ebp - 0x42d0]
call edi
lea eax, [ebp - 0x2008]
sub esp, 0xc
mov dword [esp + 4], 0x5c
mov dword [esp], eax
call sym._strrchr
lea ecx, [ebp - 0x1008]
mov byte [eax], 0
lea eax, [ebp - 0x2008]
mov dword [esp], eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const___clone_.isra.0_
lea ecx, [ebp - 0x1008]
sub esp, 4
mov dword [esp], 0x4f6599
mov dword [ebp - 0x42c8], 1
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.append_char_const_
lea edi, [ebp - 0x4288]
lea ecx, [eax + 8]
sub esp, 4
mov dword [ebp - 0x4290], edi
mov edx, dword [eax]
cmp edx, ecx
je 0x40c5e0
mov dword [ebp - 0x4290], edx
mov edx, dword [eax + 8]
mov dword [ebp - 0x4288], edx
mov edx, dword [eax + 4]
mov byte [eax + 8], 0
lea edi, [ebp - 0x1000]
mov dword [ebp - 0x428c], edx
mov dword [eax], ecx
mov dword [eax + 4], 0
mov eax, dword [ebp - 0x1008]
cmp eax, edi
je 0x40c0ee
mov dword [esp], eax
call sym.operator_delete_void_
lea eax, [ebp - 0x4270]
mov byte [ebp - 0x4270], 0
lea ecx, [ebp - 0x4278]
mov dword [ebp - 0x4278], eax
lea eax, [ebp - 0x4290]
mov dword [ebp - 0x4274], 0
mov dword [esp], eax
mov dword [ebp - 0x42c8], 2
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_assign_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
sub esp, 4
lea ecx, [ebp - 0x4278]
mov dword [esp], 0x4f62e9
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.append_char_const_
sub esp, 4
lea edi, [ebp - 0x4248]
mov dword [esp + 4], edi
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__findfirst]
mov dword [ebp - 0x42d0], eax
cmp eax, 0xffffffff
je 0x40c2d6
lea esi, [esi]
mov edx, dword [ebp - 0x4248]
test edx, edx
je 0x40c29c
lea eax, [ebp - 0x4290]
lea ecx, [ebp - 0x4278]
mov dword [esp], eax
mov dword [ebp - 0x42c8], 2
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_assign_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
sub esp, 4
cmp dword [ebp - 0x4274], 0x3fffffff
je 0x40c723
mov dword [esp + 4], 1
lea ecx, [ebp - 0x4278]
mov dword [esp], 0x4f62f1
mov dword [ebp - 0x42c8], 2
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_int_
sub esp, 8
lea ecx, [ebp - 0x4234]
mov ebx, dword [ecx]
add ecx, 4
lea edx, [ebx - 0x1010101]
not ebx
and edx, ebx
and edx, 0x80808080
je 0x40c1d4
mov ebx, edx
lea edi, [ebp - 0x4234]
shr ebx, 0x10
test edx, 0x8080
cmove edx, ebx
lea ebx, [ecx + 2]
cmove ecx, ebx
mov ebx, edx
add bl, dl
mov edx, 0x3fffffff
sbb ecx, 3
sub edx, dword [eax + 4]
sub ecx, edi
cmp ecx, edx
ja 0x40c72f
lea edi, [ebp - 0x4234]
mov dword [esp + 4], ecx
mov ecx, eax
mov dword [esp], edi
mov dword [ebp - 0x42c8], 2
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_int_
sub esp, 8
lea edi, [ebp - 0x1000]
lea ecx, [ebp - 0x1008]
mov dword [ebp - 0x1008], edi
mov edx, dword [eax]
mov byte [esp + 8], 0
mov edi, dword [eax + 4]
mov dword [esp], edx
add edi, edx
mov dword [esp + 4], edi
call method.void_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_construct_char__char__char__std::forward_iterator_tag_
mov eax, dword [ebp - 0x1008]
sub esp, 0xc
mov dword [esp], eax
mov dword [ebp - 0x42c8], 3
call sym.LockFileToEasy_char_const_
mov eax, dword [ebp - 0x1008]
lea edi, [ebp - 0x1000]
cmp eax, edi
je 0x40c29c
mov dword [esp], eax
call sym.operator_delete_void_
lea eax, [ebp - 0x4248]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x42d0]
mov dword [esp], eax
mov dword [ebp - 0x42c8], 2
call dword [sym.imp.msvcrt.dll__findnext]
test eax, eax
je 0x40c168
mov eax, dword [ebp - 0x42d0]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__findclose]
mov dword [esp], str.Initialization:_Detection_MBR...
mov dword [ebp - 0x42c8], 2
call sym.void_log_char__33___char_const_____33__
mov dword [esp + 4], 0x4f6056
mov dword [esp], str.DataMBRData.data
mov dword [ebp - 0x42c8], 2
call sym._fopen
test eax, eax
je 0x40c550
mov dword [esp], str.Initialization:_Check_if_the_whitelist_is_initialized...
mov dword [ebp - 0x42c8], 2
call sym.void_log_char__57___char_const_____57__
mov dword [esp], str.DataWhiteList.VirusDat
lea ecx, [ebp - 0x1008]
mov dword [ebp - 0x42c8], 2
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const___clone_.isra.0_
sub esp, 4
lea eax, [ebp - 0x1008]
mov dword [esp], eax
mov dword [ebp - 0x42c8], 4
call sym.GetFileSize_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
mov dword [ebp - 0x42d0], eax
mov eax, dword [ebp - 0x1008]
lea edi, [ebp - 0x1000]
cmp eax, edi
je 0x40c37d
mov dword [esp], eax
call sym.operator_delete_void_
mov eax, dword [ebp - 0x42d0]
test eax, eax
je 0x40c3e8
mov dword [esp], str.Initialization:_All_done_
mov dword [ebp - 0x42c8], 2
call sym.void_log_char__26___char_const_____26__
mov eax, dword [ebp - 0x4278]
lea edi, [ebp - 0x4270]
cmp eax, edi
je 0x40c3b5
mov dword [esp], eax
call sym.operator_delete_void_
mov eax, dword [ebp - 0x4290]
lea edi, [ebp - 0x4288]
cmp eax, edi
je 0x40c3cd
mov dword [esp], eax
call sym.operator_delete_void_
lea eax, [ebp - 0x42cc]
mov dword [esp], eax
call sym.__Unwind_SjLj_Unregister
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
mov dword [esp], str.Initialization:_White_list_is_empty__Initialize_whitelist_
mov dword [ebp - 0x42c8], 2
call sym.void_log_char__59___char_const_____59__
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [esp + 0xc], 0x1034
mov dword [esp + 8], 0x4f609b
mov dword [esp + 4], 0x4f66bc
mov dword [esp], 0
mov dword [ebp - 0x42d8], eax
call eax
sub esp, 0x10
cmp eax, 6
jne 0x40c387
mov dword [esp], str.Initialization:_Whitelist_administrator_programs...
call sym.void_log_char__52___char_const_____52__
mov dword [esp + 4], 0
mov dword [esp], 2
call sym._CreateToolhelp32Snapshot_8
mov dword [ebp - 0x42d4], eax
mov ecx, 0x4a
xor eax, eax
lea edi, [ebp - 0x4130]
rep stosd dword es:[edi], eax
sub esp, 8
mov dword [ebp - 0x4130], 0x128
lea esi, [esi]
nop
lea eax, [ebp - 0x4130]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x42d4]
mov dword [esp], eax
mov dword [ebp - 0x42c8], 2
call sym._Process32Next_8
mov dword [ebp - 0x42d0], eax
sub esp, 8
test eax, eax
je 0x40c610
xor eax, eax
lea edi, [ebp - 0x1004]
mov ecx, 0x3ff
mov dword [ebp - 0x1008], 0
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1008]
mov dword [esp + 4], eax
lea eax, [ebp - 0x410c]
mov dword [esp], eax
call sym.GetProcessPath_char__char_
lea eax, [ebp - 0x410c]
mov dword [esp], eax
call sym.IsProcessElevatedForName_char_
test al, al
je 0x40c480
lea eax, [ebp - 0x1008]
lea ecx, [ebp - 0x4260]
mov dword [esp], eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const___clone_.isra.0_
sub esp, 4
lea eax, [ebp - 0x4260]
mov dword [esp], eax
mov dword [ebp - 0x42c8], 5
call sym.WriteList_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
mov eax, dword [ebp - 0x4260]
lea edx, [ebp - 0x4258]
cmp eax, edx
je 0x40c480
mov dword [esp], eax
call sym.operator_delete_void_
jmp 0x40c480
mov dword [esp], str.MBR_is_not_backed_up__Do_you_want_to_backup_
mov dword [ebp - 0x42c8], 2
call sym.void_log_char__45___char_const_____45__
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [esp + 0xc], 0x1034
mov dword [esp + 8], 0x4f609b
mov dword [esp + 4], 0x4f663c
mov dword [esp], 0
mov dword [ebp - 0x42d8], eax
call eax
sub esp, 0x10
cmp eax, 6
jne 0x40c312
mov dword [esp], str.Backup_MBR...
call sym.void_log_char__14___char_const_____14__
call sym.CopyMBR__
mov dword [esp + 0xc], 0x1040
mov dword [esp + 8], 0x4f609b
mov dword [esp + 4], 0x4f6673
mov dword [esp], 0
mov eax, dword [ebp - 0x42d8]
call eax
sub esp, 0x10
jmp 0x40c312
mov edx, dword [eax + 8]
mov dword [ebp - 0x4288], edx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x4284], edx
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x4280], edx
mov edx, dword [eax + 0x14]
mov dword [ebp - 0x427c], edx
jmp 0x40c0c0
lea eax, [ebp - 0x4260]
mov dword [esp], eax
mov dword [ebp - 0x42c8], 2
call sym.getStartupItems_abi:cxx11___
mov edx, dword [ebp - 0x4260]
cmp dword [ebp - 0x425c], edx
je 0x40c6df
lea esi, [esi]
mov eax, dword [ebp - 0x42d0]
lea ecx, [ebp - 0x1008]
lea eax, [eax + eax*2]
lea edx, [edx + eax*8]
lea eax, [ebp - 0x1000]
mov dword [ebp - 0x1008], eax
mov eax, dword [edx]
mov byte [esp + 8], 0
mov edi, dword [edx + 4]
mov dword [esp], eax
add edi, eax
mov dword [esp + 4], edi
mov dword [ebp - 0x42c8], 6
call method.void_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_construct_char__char__char__std::forward_iterator_tag_
sub esp, 0xc
lea eax, [ebp - 0x1008]
mov dword [esp], eax
mov dword [ebp - 0x42c8], 7
call sym.WriteList_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
mov eax, dword [ebp - 0x1008]
lea edi, [ebp - 0x1000]
cmp eax, edi
je 0x40c6b3
mov dword [esp], eax
call sym.operator_delete_void_
mov edx, dword [ebp - 0x4260]
mov eax, dword [ebp - 0x425c]
add dword [ebp - 0x42d0], 1
mov edi, dword [ebp - 0x42d0]
sub eax, edx
sar eax, 3
imul eax, eax, 0xaaaaaaab
cmp eax, edi
ja 0x40c640
mov dword [esp + 0xc], 0x1040
mov dword [esp + 8], 0x4f609b
mov dword [esp + 4], 0x4f673c
mov dword [esp], 0
mov eax, dword [ebp - 0x42d8]
mov dword [ebp - 0x42c8], 6
call eax
sub esp, 0x10
lea ecx, [ebp - 0x4260]
call method.std::vector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_______.vector__
jmp 0x40c387
mov dword [esp], 0x4f62d4
call method.std.__throw_length_error_char_const_
mov dword [esp], 0x4f62d4
mov dword [ebp - 0x42c8], 2
call method.std.__throw_length_error_char_const_
add ebp, 8
mov eax, dword [ebp - 0x42c4]
cmp dword [ebp - 0x42c8], 6
mov dword [ebp - 0x42d0], eax
ja case.default.0x40c763
mov eax, dword [ebp - 0x42c8]
jmp dword [eax*4 + 0x4f6764]
ud2
mov eax, dword [ebp - 0x1008]
lea edx, [ebp - 0x1000]
cmp eax, edx
je case.0x40c763.3
mov dword [esp], eax
call sym.operator_delete_void_
lea ecx, [ebp - 0x4260]
call method.std::vector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_______.vector__
mov eax, dword [ebp - 0x4278]
lea edx, [ebp - 0x4270]
cmp eax, edx
je 0x40c7a7
mov dword [esp], eax
call sym.operator_delete_void_
mov eax, dword [ebp - 0x4290]
lea edx, [ebp - 0x4288]
cmp eax, edx
je 0x40c7bf
mov dword [esp], eax
call sym.operator_delete_void_
mov eax, dword [ebp - 0x42d0]
mov dword [esp], eax
mov dword [ebp - 0x42c8], 0xffffffff
call dbg._Unwind_SjLj_Resume
mov eax, dword [ebp - 0x1008]
lea edx, [ebp - 0x1000]
cmp eax, edx
jne 0x40c7b7
jmp 0x40c7bf
mov eax, dword [ebp - 0x4260]
lea edx, [ebp - 0x4258]
cmp eax, edx
je case.0x40c763.7
mov dword [esp], eax
call sym.operator_delete_void_
jmp case.0x40c763.7
mov eax, dword [ebp - 0x1008]
lea edx, [ebp - 0x1000]
cmp eax, edx
jne 0x40c7f9
jmp case.0x40c763.7