Function at 0x419065
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aae8f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x2984
call sub.ntdll.dll__chkstk
push edi
mov dword [ebp - 0x298c], ecx
push 0
mov ecx, dword [ebp - 0x298c]
add ecx, 4
call fcn.00401480
push 0
push 0xc
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 0xb
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 1
push 0x80
mov ecx, 0x53e6e8
call fcn.00401430
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [ebp - 0x10], eax
push 1
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x298c]
add ecx, 4
call fcn.00401450
push 0
push 0x32
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 0x31
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 1
push 0x80
mov ecx, 0x53e6e8
call fcn.00401430
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [ebp - 0x118], eax
push 0
mov ecx, dword [ebp - 0x118]
push ecx
mov ecx, dword [ebp - 0x298c]
add ecx, 4
call fcn.00401450
push 0x436
mov ecx, dword [ebp - 0x298c]
add ecx, 4
call fcn.00402ad0
push eax
mov ecx, dword [ebp - 0x298c]
add ecx, 0x1c
call fcn.004029a0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x64
push 0
push 0x4c2e70
push 0
mov ecx, dword [ebp - 0x298c]
add ecx, 0x1c
call fcn.00402b90
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x12c
push 0
push 0x4c2e7c
push 1
mov ecx, dword [ebp - 0x298c]
add ecx, 0x1c
call fcn.00402b90
push 0
push 0x20
mov ecx, dword [ebp - 0x298c]
add ecx, 0x1c
call fcn.00402aa0
mov dword [ebp - 0x278], 0
mov ecx, 0x54
xor eax, eax
lea edi, [ebp - 0x274]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x280], 1
mov dword [ebp - 0x27c], 1
lea ecx, [ebp - 0x124]
call fcn.00430110
mov dword [ebp - 4], 0
mov byte [ebp - 0x114], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp - 0x298c]
add ecx, 0x1c
call fcn.00402c60
cmp dword [ebp - 0x280], 0
je 0x41960f
push 0x154
lea edx, [ebp - 0x278]
push edx
push 0
push 0
push 0x80002018
call fcn.0047cac0
mov dword [ebp - 0x2990], eax
mov eax, dword [ebp - 0x2990]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2990]
call dword [edx + 0x1c]
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 0
jg 0x419257
jmp 0x41960f
push str.Return_info__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0x254]
push ecx
call fcn.0047d311
add esp, 4
mov byte [ebp - 0x304], 0
mov ecx, 0x1f
xor eax, eax
lea edi, [ebp - 0x303]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x4c2e98
push 0x80
lea edx, [ebp - 0x304]
push edx
call fcn.00407f00
lea eax, [ebp - 0x2fb]
push eax
lea ecx, [ebp - 0x150]
push ecx
call fcn.004488d1
add esp, 8
mov byte [ebp - 0x1304], 0
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x1303]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [ebp - 0x254]
push edx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x419431
mov ecx, dword [ebp - 0x298c]
add ecx, 0x1c
call fcn.004029c0
mov dword [ebp - 0x1b08], eax
lea eax, [ebp - 0x274]
push eax
mov ecx, dword [ebp - 0x1b08]
push ecx
mov ecx, dword [ebp - 0x298c]
add ecx, 0x1c
call fcn.00402c30
mov dword [ebp - 0x1b34], eax
lea edx, [ebp - 0x304]
push edx
push 1
mov eax, dword [ebp - 0x1b34]
push eax
mov ecx, dword [ebp - 0x298c]
add ecx, 0x1c
call fcn.004029e0
mov byte [ebp - 0x1704], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x1703]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x1b04], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x1b03]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x400
lea ecx, [ebp - 0x1704]
push ecx
lea edx, [ebp - 0x274]
push edx
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.0045221b
add esp, 0x10
mov byte [ebp - 0x1b30], 0
mov ecx, 9
xor eax, eax
lea edi, [ebp - 0x1b2f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ecx, [ebp - 0x1b30]
push ecx
lea edx, [ebp - 0x150]
push edx
call fcn.004488d1
add esp, 8
push 0x400
lea eax, [ebp - 0x1b04]
push eax
lea ecx, [ebp - 0x1b30]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea edx, [ebp - 0x1b30]
push edx
call fcn.0045221b
add esp, 0x10
lea eax, [ebp - 0x1b04]
push eax
lea ecx, [ebp - 0x1b04]
push ecx
lea edx, [ebp - 0x1704]
push edx
push 0x4c2ea4
push 0x1000
lea eax, [ebp - 0x1304]
push eax
call fcn.0040a150
add esp, 0x18
jmp 0x4195f4
mov ecx, dword [ebp - 0x298c]
add ecx, 0x1c
call fcn.004029c0
mov dword [ebp - 0x294c], eax
lea ecx, [ebp - 0x274]
push ecx
mov edx, dword [ebp - 0x294c]
push edx
mov ecx, dword [ebp - 0x298c]
add ecx, 0x1c
call fcn.00402c30
mov dword [ebp - 0x2978], eax
lea eax, [ebp - 0x254]
push eax
push 1
mov ecx, dword [ebp - 0x2978]
push ecx
mov ecx, dword [ebp - 0x298c]
add ecx, 0x1c
call fcn.004029e0
mov byte [ebp - 0x1f34], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x1f33]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x2948], 0
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x2947]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x2134], 0
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x2133]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x400
lea edx, [ebp - 0x1f34]
push edx
lea eax, [ebp - 0x274]
push eax
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea ecx, [ebp - 0x274]
push ecx
call fcn.0045221b
add esp, 0x10
push 0x800
lea edx, [ebp - 0x2948]
push edx
lea eax, [ebp - 0x254]
push eax
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea ecx, [ebp - 0x254]
push ecx
call fcn.0045221b
add esp, 0x10
mov byte [ebp - 0x2148], 0
xor edx, edx
mov dword [ebp - 0x2147], edx
mov dword [ebp - 0x2143], edx
mov dword [ebp - 0x213f], edx
mov dword [ebp - 0x213b], edx
mov word [ebp - 0x2137], dx
mov byte [ebp - 0x2135], dl
mov byte [ebp - 0x2974], 0
mov ecx, 9
xor eax, eax
lea edi, [ebp - 0x2973]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0
lea eax, [ebp - 0x2148]
push eax
lea ecx, [ebp - 0x254]
push ecx
call fcn.0042a9c3
add esp, 0xc
lea edx, [ebp - 0x2974]
push edx
lea eax, [ebp - 0x2148]
push eax
call fcn.004488d1
add esp, 8
push 0x200
lea ecx, [ebp - 0x2134]
push ecx
lea edx, [ebp - 0x2974]
push edx
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea eax, [ebp - 0x2974]
push eax
call fcn.0045221b
add esp, 0x10
lea ecx, [ebp - 0x2134]
push ecx
lea edx, [ebp - 0x2948]
push edx
lea eax, [ebp - 0x1f34]
push eax
push str.TorFWProcessName_sPath_sMD5_s
push 0x1000
lea ecx, [ebp - 0x1304]
push ecx
call fcn.0040a150
add esp, 0x18
lea edx, [ebp - 0x1304]
push edx
call fcn.0045239a
mov dword [ebp - 0x27c], 0
jmp 0x419205
cmp dword [ebp - 0x27c], 0
je 0x41968e
mov ecx, dword [ebp - 0x298c]
add ecx, 0x1c
call fcn.004029c0
mov dword [ebp - 0x297c], eax
lea eax, [ebp - 0x274]
push eax
mov ecx, dword [ebp - 0x297c]
push ecx
mov ecx, dword [ebp - 0x298c]
add ecx, 0x1c
call fcn.00402c30
mov dword [ebp - 0x2980], eax
push 0x4c2eec
push 1
mov edx, dword [ebp - 0x2980]
push edx
mov ecx, dword [ebp - 0x298c]
add ecx, 0x1c
call fcn.004029e0
mov dword [ebp - 0x2984], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x124]
call fcn.0043013b
mov eax, dword [ebp - 0x2984]
jmp 0x4196bb
push str.m_VirusListOut_end______n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 0x2988], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x124]
call fcn.0043013b
mov eax, dword [ebp - 0x2988]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret 0x10