Function at 0x4ec7f7
Capabilities:
Copy file
Create directory
Delete file
Enumerate files on windows
Get common file path
Move file
Persist via run registry key
Query or enumerate registry value
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5133ff
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1c44
call fcn.005106b0
lea ecx, [ebp - 0xc10]
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 4], 0
mov dword [0x5b84b8], 0
jmp 0x4ec844
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov ecx, 0x5b5b48
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4eca13
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b48
call fcn.0050f5d0
mov edx, dword [eax]
push edx
mov eax, dword [0x5b7658]
push eax
push 0x5a411c
lea ecx, [ebp - 0x116c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
mov edx, dword [0x5b84b8]
push edx
mov ecx, 0x5b5b48
call fcn.0050f5d0
mov eax, dword [eax]
push eax
mov ecx, dword [0x5b7658]
push ecx
push str._s__x86__s
lea edx, [ebp - 0x1a6c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
mov eax, dword [0x5b84b8]
push eax
mov ecx, 0x5b5b48
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
mov edx, dword [0x5b7658]
push edx
push str._s_s_Browser_Enhancer
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b48
call fcn.0050f5d0
mov edx, dword [eax]
push edx
mov eax, dword [0x5b7658]
push eax
push str._s__x86__s_Browser_Enhancer
lea ecx, [ebp - 0xc0c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push ecx
mov ecx, esp
mov dword [ebp - 0x1b70], esp
lea edx, [ebp - 0x116c]
push edx
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 0x1bbc], eax
call fcn.004ae8a4
add esp, 4
mov dword [ebp - 0x1bc0], eax
cmp dword [ebp - 0x1bc0], 0
jne 0x4ec9e3
push ecx
mov ecx, esp
mov dword [ebp - 0x1b74], esp
lea eax, [ebp - 0x1a6c]
push eax
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 0x1bc4], eax
call fcn.004ae8a4
add esp, 4
mov dword [ebp - 0x1bc8], eax
cmp dword [ebp - 0x1bc8], 0
jne 0x4ec9e3
push ecx
mov ecx, esp
mov dword [ebp - 0x1b78], esp
lea edx, [ebp - 0x80c]
push edx
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 0x1bcc], eax
call fcn.004ae8a4
add esp, 4
mov dword [ebp - 0x1bd0], eax
cmp dword [ebp - 0x1bd0], 0
jne 0x4ec9e3
push ecx
mov ecx, esp
mov dword [ebp - 0x1b7c], esp
lea eax, [ebp - 0xc0c]
push eax
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 0x1bd4], eax
call fcn.004ae8a4
add esp, 4
mov dword [ebp - 0x1bd8], eax
cmp dword [ebp - 0x1bd8], 0
je 0x4eca0e
cmp dword [0x5b851c], 0
jne 0x4ec9fa
push 0
push 0
push str.Detectado_AdWare.Wajam_nPor_favor__Reinicie_de_nuevo_para_Completar_la_Eliminaci
call sub.MFC42.DLL_AfxMessageBox
push str.Detectado_AdWare.Wajam_n
mov ecx, 0x5b5b78
call fcn.0050f680
call fcn.004ae964
jmp 0x4ec837
push 0x5a41d4
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
lea ecx, [ebp - 0x1b80]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1bdc], eax
mov edx, dword [ebp - 0x1bdc]
mov dword [ebp - 0x1be0], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1be0]
push eax
lea ecx, [ebp - 0xc10]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1b80]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc10]
push ecx
push 0x5a4220
lea edx, [ebp - 0x1b6c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5a4230
lea eax, [ebp - 0x1b6c]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0xd6c], eax
cmp dword [ebp - 0xd6c], 0
je 0x4ecb59
mov ecx, dword [ebp - 0xd6c]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea edx, [ebp - 0x1b6c]
push edx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
mov eax, dword [ebp - 0xc10]
push eax
push str._sSYSCRON.EXE
lea ecx, [ebp - 0x1b6c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5a4244
lea edx, [ebp - 0x1b6c]
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0xd6c], eax
cmp dword [ebp - 0xd6c], 0
jne 0x4ecb39
cmp dword [0x5b851c], 0
jne 0x4ecb23
push 0
push 0
push 0x5a4248
call sub.MFC42.DLL_AfxMessageBox
push 0x5a42b4
mov ecx, 0x5b5b78
call fcn.0050f680
call fcn.004ae964
jmp 0x4ecb59
mov eax, dword [ebp - 0xd6c]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea ecx, [ebp - 0x1b6c]
push ecx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
push 0x5a42e4
push str.SystemCurrentControlSetServicesAFSEGTGF_Windows_Service
push 0x80000002
lea edx, [ebp - 0x1b84]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1be4], eax
mov eax, dword [ebp - 0x1be4]
mov dword [ebp - 0x1be8], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1be8]
push ecx
lea ecx, [ebp - 0xc10]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1b84]
call sub.MFC42.DLL_CString::CString
push 0x5a432c
lea ecx, [ebp - 0xc10]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ecbf7
cmp dword [0x5b851c], 0
jne 0x4ecbe3
push 0
push 0
push 0x5a4334
call sub.MFC42.DLL_AfxMessageBox
push 0x5a43c4
mov ecx, 0x5b5b78
call fcn.0050f680
call fcn.004ae964
mov dword [0x5b4120], 0
jmp 0x4ecc12
mov edx, dword [0x5b4120]
add edx, 1
mov dword [0x5b4120], edx
mov ecx, 0x5b7890
call fcn.0050f110
cmp dword [0x5b4120], eax
jge 0x4ecd96
mov eax, dword [0x5b4120]
push eax
mov ecx, 0x5b7878
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
push str._sSoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.Startup
push 0x5b6504
push 0x80000003
lea edx, [ebp - 0x1b88]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1bec], eax
mov eax, dword [ebp - 0x1bec]
mov dword [ebp - 0x1bf0], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1bf0]
push ecx
lea ecx, [ebp - 0xc10]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1b88]
call sub.MFC42.DLL_CString::CString
mov edx, dword [0x5b4120]
push edx
mov ecx, 0x5b7890
call fcn.0050f5d0
mov eax, dword [eax]
push eax
mov ecx, dword [ebp - 0xc10]
push ecx
push str._s_s.vbe
lea edx, [ebp - 0x116c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
mov eax, dword [0x5b4120]
push eax
mov ecx, 0x5b7890
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0xc10]
push edx
push str._s_s_box.vbe
lea eax, [ebp - 0x1a6c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push ecx
mov ecx, esp
mov dword [ebp - 0x1b8c], esp
lea edx, [ebp - 0x116c]
push edx
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 0x1bf4], eax
call fcn.004ae7b8
add esp, 4
mov dword [ebp - 0x1bf8], eax
cmp dword [ebp - 0x1bf8], 0
jne 0x4ecd66
push ecx
mov ecx, esp
mov dword [ebp - 0x1b90], esp
lea eax, [ebp - 0x1a6c]
push eax
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 0x1bfc], eax
call fcn.004ae7b8
add esp, 4
mov dword [ebp - 0x1c00], eax
cmp dword [ebp - 0x1c00], 0
je 0x4ecd91
cmp dword [0x5b851c], 0
jne 0x4ecd7d
push 0
push 0
push str.Detectado_Malware.VBE_nPor_favor__Reinicie_de_nuevo_para_Completar_la_Eliminaci
call sub.MFC42.DLL_AfxMessageBox
push str.Detectado_Malware.VBE_n
mov ecx, 0x5b5b78
call fcn.0050f680
call fcn.004ae964
jmp 0x4ecc03
push 0x5b7db4
push str._sPrueba.sat
lea ecx, [ebp - 0x1b6c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5a44d4
lea edx, [ebp - 0x1b6c]
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0xd6c], eax
cmp dword [ebp - 0xd6c], 0
je 0x4ece91
mov eax, dword [ebp - 0xd6c]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea ecx, [ebp - 0x1b6c]
push ecx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
push 0x5b7db4
lea edx, [ebp - 0x1b6c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.POOF
lea eax, [ebp - 0x1b6c]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5a44e0
lea ecx, [ebp - 0x1b6c]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0xd6c], eax
cmp dword [ebp - 0xd6c], 0
jne 0x4ece71
cmp dword [0x5b851c], 0
jne 0x4ece5b
push 0
push 0
push 0x5a44e4
call sub.MFC42.DLL_AfxMessageBox
push 0x5a457c
mov ecx, 0x5b5b78
call fcn.0050f680
call fcn.004ae964
jmp 0x4ece91
mov edx, dword [ebp - 0xd6c]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea eax, [ebp - 0x1b6c]
push eax
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
push 0x5b7ba4
push str._s_Recycle_
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0xd58]
push ecx
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4eceeb
cmp dword [0x5b851c], 0
jne 0x4eced7
push 0
push 0
push 0x5a45b8
call sub.MFC42.DLL_AfxMessageBox
push str.Detectado_Spy.Zbot.VZA
mov ecx, 0x5b5b78
call fcn.0050f680
call fcn.004ae964
push 0x5b7ba4
push str._sRecycle.Bin
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0xd58]
push edx
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4ecf45
cmp dword [0x5b851c], 0
jne 0x4ecf31
push 0
push 0
push str.Detectado_Spyeye__RootKit__nPor_favor__Reinicie_de_nuevo_para_Completar_la_Eliminaci
call sub.MFC42.DLL_AfxMessageBox
push str.Detectado_Spyeye__RootKit__n
mov ecx, 0x5b5b78
call fcn.0050f680
call fcn.004ae964
push str.ActiveUpdate
push 0x5a46e0
push 0x80000001
lea eax, [ebp - 0x1b94]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1c04], eax
mov ecx, dword [ebp - 0x1c04]
mov dword [ebp - 0x1c08], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x1c08]
push edx
lea ecx, [ebp - 0xc10]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1b94]
call sub.MFC42.DLL_CString::CString
push 0x5a4710
lea ecx, [ebp - 0xc10]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ecfe3
cmp dword [0x5b851c], 0
jne 0x4ecfcf
push 0
push 0
push 0x5a4718
call sub.MFC42.DLL_AfxMessageBox
push 0x5a4784
mov ecx, 0x5b5b78
call fcn.0050f680
call fcn.004ae964
push str.Bluetooth
push 0x5a47c0
push 0x80000001
lea eax, [ebp - 0x1b98]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1c0c], eax
mov ecx, dword [ebp - 0x1c0c]
mov dword [ebp - 0x1c10], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x1c10]
push edx
lea ecx, [ebp - 0xc10]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1b98]
call sub.MFC42.DLL_CString::CString
push 0x5a47f0
lea ecx, [ebp - 0xc10]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ed081
cmp dword [0x5b851c], 0
jne 0x4ed06d
push 0
push 0
push 0x5a47f8
call sub.MFC42.DLL_AfxMessageBox
push 0x5a4864
mov ecx, 0x5b5b78
call fcn.0050f680
call fcn.004ae964
push str.Common_User_Runtime
push 0x5a48a8
push 0x80000001
lea eax, [ebp - 0x1b9c]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1c14], eax
mov ecx, dword [ebp - 0x1c14]
mov dword [ebp - 0x1c18], ecx
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x1c18]
push edx
lea ecx, [ebp - 0xc10]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1b9c]
call sub.MFC42.DLL_CString::CString
push 0x5a48d8
lea ecx, [ebp - 0xc10]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ed11f
cmp dword [0x5b851c], 0
jne 0x4ed10b
push 0
push 0
push 0x5a48e0
call sub.MFC42.DLL_AfxMessageBox
push 0x5a494c
mov ecx, 0x5b5b78
call fcn.0050f680
call fcn.004ae964
push str.dnt748487g84
push 0x5a498c
push 0x80000001
lea eax, [ebp - 0x1ba0]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1c1c], eax
mov ecx, dword [ebp - 0x1c1c]
mov dword [ebp - 0x1c20], ecx
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x1c20]
push edx
lea ecx, [ebp - 0xc10]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1ba0]
call sub.MFC42.DLL_CString::CString
push 0x5a49bc
lea ecx, [ebp - 0xc10]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ed1bd
cmp dword [0x5b851c], 0
jne 0x4ed1a9
push 0
push 0
push 0x5a49c4
call sub.MFC42.DLL_AfxMessageBox
push 0x5a4a30
mov ecx, 0x5b5b78
call fcn.0050f680
call fcn.004ae964
push str.Google_Updater_2.0
push 0x5a4a74
push 0x80000001
lea eax, [ebp - 0x1ba4]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1c24], eax
mov ecx, dword [ebp - 0x1c24]
mov dword [ebp - 0x1c28], ecx
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x1c28]
push edx
lea ecx, [ebp - 0xc10]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1ba4]
call sub.MFC42.DLL_CString::CString
push 0x5a4aa4
lea ecx, [ebp - 0xc10]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ed25b
cmp dword [0x5b851c], 0
jne 0x4ed247
push 0
push 0
push 0x5a4aac
call sub.MFC42.DLL_AfxMessageBox
push 0x5a4b18
mov ecx, 0x5b5b78
call fcn.0050f680
call fcn.004ae964
push str.Java_Update_Controller
push 0x5a4b60
push 0x80000001
lea eax, [ebp - 0x1ba8]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1c2c], eax
mov ecx, dword [ebp - 0x1c2c]
mov dword [ebp - 0x1c30], ecx
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x1c30]
push edx
lea ecx, [ebp - 0xc10]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1ba8]
call sub.MFC42.DLL_CString::CString
push 0x5a4b90
lea ecx, [ebp - 0xc10]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ed2f9
cmp dword [0x5b851c], 0
jne 0x4ed2e5
push 0
push 0
push 0x5a4b98
call sub.MFC42.DLL_AfxMessageBox
push 0x5a4c04
mov ecx, 0x5b5b78
call fcn.0050f680
call fcn.004ae964
push str.Realtek_Audio_Manager
push 0x5a4c4c
push 0x80000001
lea eax, [ebp - 0x1bac]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1c34], eax
mov ecx, dword [ebp - 0x1c34]
mov dword [ebp - 0x1c38], ecx
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x1c38]
push edx
lea ecx, [ebp - 0xc10]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1bac]
call sub.MFC42.DLL_CString::CString
push 0x5a4c7c
lea ecx, [ebp - 0xc10]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ed397
cmp dword [0x5b851c], 0
jne 0x4ed383
push 0
push 0
push 0x5a4c84
call sub.MFC42.DLL_AfxMessageBox
push 0x5a4cf0
mov ecx, 0x5b5b78
call fcn.0050f680
call fcn.004ae964
push str.Skype
push 0x5a4d28
push 0x80000001
lea eax, [ebp - 0x1bb0]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1c3c], eax
mov ecx, dword [ebp - 0x1c3c]
mov dword [ebp - 0x1c40], ecx
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x1c40]
push edx
lea ecx, [ebp - 0xc10]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1bb0]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0xc10]
call fcn.0050f0b0
push eax
lea eax, [ebp - 0x116c]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x116c]
push ecx
call fcn.00401fca
add esp, 4
push str.SKYPEPHONESKYPE.EXE
lea edx, [ebp - 0x1a6c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5a4d70
lea ecx, [ebp - 0xc10]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ed48e
lea eax, [ebp - 0x1a6c]
push eax
lea ecx, [ebp - 0x116c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ed48e
cmp dword [0x5b851c], 0
jne 0x4ed47a
push 0
push 0
push 0x5a4d78
call sub.MFC42.DLL_AfxMessageBox
push 0x5a4de4
mov ecx, 0x5b5b78
call fcn.0050f680
call fcn.004ae964
push str.System_Run_Updater
push 0x5a4e28
push 0x80000001
lea edx, [ebp - 0x1bb4]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1c44], eax
mov eax, dword [ebp - 0x1c44]
mov dword [ebp - 0x1c48], eax
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x1c48]
push ecx
lea ecx, [ebp - 0xc10]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1bb4]
call sub.MFC42.DLL_CString::CString
push 0x5a4e58
lea ecx, [ebp - 0xc10]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ed52c
cmp dword [0x5b851c], 0
jne 0x4ed518
push 0
push 0
push 0x5a4e60
call sub.MFC42.DLL_AfxMessageBox
push 0x5a4ecc
mov ecx, 0x5b5b78
call fcn.0050f680
call fcn.004ae964
push str.Task_Protect_2.3
push 0x5a4f10
push 0x80000001
lea edx, [ebp - 0x1bb8]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x1c4c], eax
mov eax, dword [ebp - 0x1c4c]
mov dword [ebp - 0x1c50], eax
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x1c50]
push ecx
lea ecx, [ebp - 0xc10]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1bb8]
call sub.MFC42.DLL_CString::CString
push 0x5a4f40
lea ecx, [ebp - 0xc10]
call fcn.0050f0b0
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ed5ca
cmp dword [0x5b851c], 0
jne 0x4ed5b6
push 0
push 0
push 0x5a4f48
call sub.MFC42.DLL_AfxMessageBox
push 0x5a4fb4
mov ecx, 0x5b5b78
call fcn.0050f680
call fcn.004ae964
mov dword [ebp - 0xd68], 0
mov dword [ebp - 0xd64], 0
lea edx, [ebp - 0xd68]
push edx
push 0x20119
push 0
push 0x5a4fe4
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4ed722
mov dword [ebp - 0xd64], 0
jmp 0x4ed61f
mov eax, dword [ebp - 0xd64]
add eax, 1
mov dword [ebp - 0xd64], eax
mov dword [ebp - 0xc18], 0x400
mov byte [ebp - 0x40c], 0
mov dword [ebp - 0xc14], 0x400
mov byte [ebp - 0x166c], 0
lea ecx, [ebp - 0xc14]
push ecx
lea edx, [ebp - 0x166c]
push edx
push 0
push 0
lea eax, [ebp - 0xc18]
push eax
lea ecx, [ebp - 0x40c]
push ecx
mov edx, dword [ebp - 0xd64]
push edx
mov eax, dword [ebp - 0xd68]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x4ed70e
lea ecx, [ebp - 0x40c]
push ecx
call fcn.00401fca
add esp, 4
lea edx, [ebp - 0x166c]
push edx
call fcn.00401fca
add esp, 4
lea eax, [ebp - 0x40c]
push eax
push str._s0_
lea ecx, [ebp - 0x1b6c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x1b6c]
push edx
call fcn.00401fca
add esp, 4
lea eax, [ebp - 0x1b6c]
push eax
lea ecx, [ebp - 0x166c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4ed70c
cmp dword [0x5b851c], 0
jne 0x4ed6f8
push 0
push 0
push 0x5a501c
call sub.MFC42.DLL_AfxMessageBox
push 0x5a5088
mov ecx, 0x5b5b78
call fcn.0050f680
call fcn.004ae964
jmp 0x4ed710
jmp 0x4ed715
jmp 0x4ed610
mov edx, dword [ebp - 0xd68]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xd60], 0
lea eax, [ebp - 0x126c]
push eax
push 0x100
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
lea ecx, [ebp - 0x126c]
push ecx
push str._ssrv.tmp
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov dword [0x5b84b8], 0
jmp 0x4ed773
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
cmp dword [0x5b84b8], 0x104
jae 0x4ed78e
mov eax, dword [0x5b84b8]
mov byte [ebp + eax - 0xd2c], 0
jmp 0x4ed764
lea ecx, [ebp - 0xd58]
push ecx
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov dword [ebp - 0xd5c], eax
movsx edx, byte [ebp - 0xd2c]
test edx, edx
jne 0x4ed7b6
jmp 0x4ed8b2
cmp dword [ebp - 0xd38], 0
jne 0x4ed7c4
jmp 0x4ed896
lea eax, [ebp - 0xd2c]
push eax
lea ecx, [ebp - 0x126c]
push ecx
push 0x5a50c4
lea edx, [ebp - 0x1b6c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0
lea eax, [ebp - 0x1b6c]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push 0x5b7ba4
push 0x5a50cc
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
lea ecx, [ebp - 0xd2c]
push ecx
push 0x5b7ba4
push str._sMuestras_s.vir
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0
push 0x5b6504
lea edx, [ebp - 0x1b6c]
push edx
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
lea eax, [ebp - 0x1b6c]
push eax
push str._s.vir
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
lea ecx, [ebp - 0x1b6c]
push ecx
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
push 0
lea edx, [ebp - 0x1b6c]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
mov dword [ebp - 0xd60], 1
lea eax, [ebp - 0xd58]
push eax
mov ecx, dword [ebp - 0xd5c]
push ecx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x4ed7a6
mov edx, dword [ebp - 0xd5c]
push edx
call dword [sym.imp.KERNEL32.DLL_FindClose]
cmp dword [ebp - 0xd60], 0
je 0x4ed90b
push 0x5b7ba4
push str.Detectado_Worm.Rorpian_nReinicie_de_nuevo_para_Completar_la_Eliminaci
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
cmp dword [0x5b851c], 0
jne 0x4ed8f7
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
call fcn.004ae964
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc10]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret