Function at 0x41cee0
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4843ef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1ebc
call fcn.00463720
mov eax, dword [0x4a57cc]
mov dword [ebp - 0x20], eax
push edi
mov dword [ebp - 0x1dd0], ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 1
lea ecx, [ebp - 0x14]
call fcn.00403c10
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00403c10
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1dd0]
mov dword [eax + 0x534], 1
mov ecx, dword [ebp + 8]
push ecx
push str._FROM_LOCAL_
call fcn.00403210
add esp, 8
test eax, eax
jne 0x41d1cd
mov edx, dword [ebp - 0x1dd0]
add edx, 4
push edx
lea ecx, [ebp - 0x428]
call fcn.0041e3d0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x428]
call fcn.0041e420
movzx eax, al
test eax, eax
je 0x41cfae
mov ecx, dword [ebp - 0x1dd0]
mov dword [ecx + 0x528], 1
mov edx, dword [ebp - 0x1dd0]
mov dword [edx + 0x52c], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x428]
call fcn.0041e400
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0xc], 0
je 0x41d1ad
push 0x400
lea eax, [ebp - 0x424]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x41d190
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
lea ecx, [ebp - 0x424]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0xffffffff
je 0x41d16c
lea edx, [ebp - 0x460]
push edx
mov eax, dword [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x41d13b
cmp dword [ebp - 0x440], 0
jne 0x41d103
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x124]
mov eax, dword [ebp + 0xc]
add edx, dword [eax + 0x128]
cmp dword [ebp - 0x43c], edx
jb 0x41d103
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x10], 1
mov ecx, dword [ebp + 0xc]
add ecx, 0x24
push ecx
lea ecx, [ebp - 0x1c]
call fcn.004205a0
lea edx, [ebp - 0x424]
push edx
lea ecx, [ebp - 0x14]
call fcn.004205a0
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x12c], 1
jne 0x41d101
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x128]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x124]
push ecx
lea edx, [ebp - 0x424]
push edx
mov ecx, dword [ebp - 0x1dd0]
call fcn.00419790
mov dword [ebp - 0x464], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x464]
cmp ecx, dword [eax + 0x130]
je 0x41d101
mov dword [ebp - 0x10], 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x130]
push eax
mov ecx, dword [ebp - 0x464]
push ecx
push str.CRC_mismatch:__d___d
mov edx, dword [ebp - 0x1dd0]
push edx
call fcn.0041e290
add esp, 0x10
jmp 0x41d139
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x128]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x124]
push eax
mov ecx, dword [ebp - 0x43c]
push ecx
mov edx, dword [ebp - 0x440]
push edx
push str.File_information_mismatch:__d___d___d___d
mov eax, dword [ebp - 0x1dd0]
push eax
call fcn.0041e290
add esp, 0x18
jmp 0x41d15d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x424]
push ecx
push str.Cannot_retrieve_file_info_from__s:_error_code___d
mov edx, dword [ebp - 0x1dd0]
push edx
call fcn.0041e290
add esp, 0x10
mov eax, dword [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41d18e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x424]
push ecx
push str.Cannot_open_module__s:_error_code___d
mov edx, dword [ebp - 0x1dd0]
push edx
call fcn.0041e290
add esp, 0x10
jmp 0x41d1ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cannot_retrieve_module_name:_error_code___d
mov eax, dword [ebp - 0x1dd0]
push eax
call fcn.0041e290
add esp, 0xc
jmp 0x41d1c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.FileInfo_needed
mov ecx, dword [ebp - 0x1dd0]
push ecx
call fcn.0041e290
add esp, 0xc
jmp 0x41d56f
lea ecx, [ebp - 0x580]
call fcn.00403c10
mov byte [ebp - 4], 3
mov dword [ebp - 0x578], 1
mov word [ebp - 0x584], 0
push 0x48bd80
mov edx, dword [ebp + 8]
push edx
call fcn.0040ad50
add esp, 8
mov dword [ebp - 0x574], eax
cmp dword [ebp - 0x574], 0
je 0x41d226
mov eax, dword [ebp - 0x574]
add eax, 3
push eax
lea ecx, [ebp - 0x580]
call fcn.004205a0
jmp 0x41d235
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x580]
call fcn.004205a0
push 7
push str.http:__
mov edx, dword [ebp + 8]
push edx
call fcn.00416340
add esp, 0xc
test eax, eax
jne 0x41d256
mov dword [ebp - 0x578], 0
push 0
push 0x3a
lea ecx, [ebp - 0x580]
call fcn.0041f910
mov dword [ebp - 0x57c], eax
cmp dword [ebp - 0x57c], 0xffffffff
je 0x41d3c8
mov eax, dword [ebp - 0x57c]
add eax, 1
push eax
push 0x2f
lea ecx, [ebp - 0x580]
call fcn.0041f910
mov dword [ebp - 0x570], eax
mov ecx, dword [ebp - 0x570]
sub ecx, dword [ebp - 0x57c]
sub ecx, 1
push ecx
mov edx, dword [ebp - 0x57c]
add edx, 1
push edx
lea eax, [ebp - 0x1d94]
push eax
lea ecx, [ebp - 0x580]
call fcn.0041f520
mov dword [ebp - 0x1dd4], eax
mov ecx, dword [ebp - 0x1dd4]
call fcn.00420d30
push eax
call fcn.0046406f
add esp, 4
mov word [ebp - 0x584], ax
lea ecx, [ebp - 0x1d94]
call fcn.00403ca0
lea ecx, [ebp - 0x580]
call fcn.00403ce0
sub eax, dword [ebp - 0x570]
push eax
lea ecx, [ebp - 0x1d98]
push ecx
lea ecx, [ebp - 0x580]
call fcn.0043ec10
mov dword [ebp - 0x1dd8], eax
mov edx, dword [ebp - 0x1dd8]
mov dword [ebp - 0x1ddc], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x57c]
push eax
lea ecx, [ebp - 0x1d9c]
push ecx
lea ecx, [ebp - 0x580]
call fcn.004137f0
mov dword [ebp - 0x1de0], eax
mov edx, dword [ebp - 0x1de0]
mov dword [ebp - 0x1de4], edx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x1ddc]
push eax
mov ecx, dword [ebp - 0x1de4]
push ecx
lea edx, [ebp - 0x1da0]
push edx
call fcn.00403370
add esp, 0xc
mov dword [ebp - 0x1de8], eax
mov eax, dword [ebp - 0x1de8]
mov dword [ebp - 0x1dec], eax
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x1dec]
push ecx
lea ecx, [ebp - 0x580]
call fcn.0041f710
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1da0]
call fcn.00403ca0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1d9c]
call fcn.00403ca0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1d98]
call fcn.00403ca0
mov edx, dword [ebp - 0x1dd0]
add edx, 4
push edx
lea ecx, [ebp - 0x588]
call fcn.0041e3d0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x588]
call fcn.0041e420
movzx eax, al
test eax, eax
je 0x41d413
mov ecx, dword [ebp - 0x1dd0]
mov dword [ecx + 0x528], 2
mov edx, dword [ebp - 0x1dd0]
mov dword [edx + 0x52c], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x588]
call fcn.0041e400
lea eax, [ebp - 0x56c]
push eax
call fcn.004157c0
add esp, 4
push 1
mov cx, word [ebp - 0x584]
push ecx
mov edx, dword [ebp - 0x578]
push edx
lea eax, [ebp - 0x56c]
push eax
lea ecx, [ebp - 0x580]
call fcn.00420d30
push eax
mov ecx, dword [ebp - 0x1dd0]
call fcn.0041c4d0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x41d4d1
push 0x2f
mov ecx, dword [ebp + 8]
push ecx
call fcn.004031f0
add esp, 8
add eax, 1
push eax
lea ecx, [ebp - 0x1c]
call fcn.004205a0
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x56c]
push eax
lea ecx, [ebp - 0x1da4]
push ecx
call fcn.0041f980
add esp, 0xc
mov dword [ebp - 0x1df0], eax
mov edx, dword [ebp - 0x1df0]
mov dword [ebp - 0x1df4], edx
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x1df4]
push eax
lea ecx, [ebp - 0x14]
call fcn.0041f710
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1da4]
call fcn.00403ca0
cmp dword [ebp - 0x10], 0
je 0x41d560
mov ecx, dword [ebp - 0x1dd0]
add ecx, 4
push ecx
lea ecx, [ebp - 0x58c]
call fcn.0041e3d0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x58c]
call fcn.0041e420
movzx edx, al
test edx, edx
je 0x41d551
mov eax, dword [ebp - 0x1dd0]
mov ecx, dword [eax + 0x52c]
add ecx, 1
mov edx, dword [ebp - 0x1dd0]
mov dword [edx + 0x52c], ecx
mov eax, dword [ebp - 0x1dd0]
mov dword [eax + 0x41c], 6
mov ecx, dword [ebp - 0x1dd0]
mov dword [ecx + 0x520], 1
mov edx, dword [ebp - 0x1dd0]
mov dword [edx + 0x524], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x58c]
call fcn.0041e400
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x580]
call fcn.00403ca0
cmp dword [ebp - 0x10], 0
je 0x41df59
push 4
lea eax, [ebp - 0x1dac]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0043ec10
mov dword [ebp - 0x1df8], eax
push str..cab
mov ecx, dword [ebp - 0x1df8]
call fcn.0040afd0
neg eax
sbb eax, eax
inc eax
mov byte [ebp - 0x1da5], al
lea ecx, [ebp - 0x1dac]
call fcn.00403ca0
movzx ecx, byte [ebp - 0x1da5]
test ecx, ecx
je 0x41de1d
lea ecx, [ebp - 0x150c]
call fcn.00411090
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x1510], 0
mov dword [ebp - 0x1514], 0
push 0
lea ecx, [ebp - 0x6b0]
call fcn.00423680
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x590]
call fcn.00403c10
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1518]
call fcn.00403c10
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1c]
call fcn.00403ce0
sub eax, 3
push eax
lea edx, [ebp - 0x1db0]
push edx
lea ecx, [ebp - 0x1c]
call fcn.004137f0
mov dword [ebp - 0x1dfc], eax
mov eax, dword [ebp - 0x1dfc]
mov dword [ebp - 0x1e00], eax
mov byte [ebp - 4], 0xe
push 0x48bd94
mov ecx, dword [ebp - 0x1e00]
push ecx
lea edx, [ebp - 0x1db4]
push edx
call fcn.00413870
add esp, 0xc
mov dword [ebp - 0x1e04], eax
mov eax, dword [ebp - 0x1e04]
mov dword [ebp - 0x1e08], eax
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x1e08]
push ecx
lea ecx, [ebp - 0x1518]
call fcn.0041f710
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x1db4]
call fcn.00403ca0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1db0]
call fcn.00403ca0
lea edx, [ebp - 0x69c]
push edx
call fcn.004157c0
add esp, 4
lea eax, [ebp - 0x69c]
mov dword [ebp - 0x1e0c], eax
mov ecx, dword [ebp - 0x1e0c]
inc ecx
mov dword [ebp - 0x1e10], ecx
mov edx, dword [ebp - 0x1e0c]
mov al, byte [edx]
mov byte [ebp - 0x1e11], al
inc dword [ebp - 0x1e0c]
cmp byte [ebp - 0x1e11], 0
jne 0x41d6d1
mov ecx, dword [ebp - 0x1e0c]
sub ecx, dword [ebp - 0x1e10]
mov dword [ebp - 0x1e18], ecx
je 0x41d7b7
lea edx, [ebp - 0x69c]
mov dword [ebp - 0x1e1c], edx
mov eax, dword [ebp - 0x1e1c]
inc eax
mov dword [ebp - 0x1e20], eax
mov ecx, dword [ebp - 0x1e1c]
mov dl, byte [ecx]
mov byte [ebp - 0x1e21], dl
inc dword [ebp - 0x1e1c]
cmp byte [ebp - 0x1e21], 0
jne 0x41d71f
mov eax, dword [ebp - 0x1e1c]
sub eax, dword [ebp - 0x1e20]
mov dword [ebp - 0x1e28], eax
mov ecx, dword [ebp - 0x1e28]
movsx edx, byte [ebp + ecx - 0x69d]
cmp edx, 0x5c
jne 0x41d7b7
lea eax, [ebp - 0x69c]
mov dword [ebp - 0x1e2c], eax
mov ecx, dword [ebp - 0x1e2c]
inc ecx
mov dword [ebp - 0x1e30], ecx
mov edx, dword [ebp - 0x1e2c]
mov al, byte [edx]
mov byte [ebp - 0x1e31], al
inc dword [ebp - 0x1e2c]
cmp byte [ebp - 0x1e31], 0
jne 0x41d77a
mov ecx, dword [ebp - 0x1e2c]
sub ecx, dword [ebp - 0x1e30]
mov dword [ebp - 0x1e38], ecx
mov edx, dword [ebp - 0x1e38]
mov byte [ebp + edx - 0x69d], 0
lea eax, [ebp - 0x69c]
push eax
lea ecx, [ebp - 0x1db8]
call fcn.00403c30
mov dword [ebp - 0x1e3c], eax
mov ecx, dword [ebp - 0x1e3c]
mov dword [ebp - 0x1e40], ecx
mov byte [ebp - 4], 0x10
push 0x48bd98
mov edx, dword [ebp - 0x1e40]
push edx
lea eax, [ebp - 0x1dbc]
push eax
call fcn.00413870
add esp, 0xc
mov dword [ebp - 0x1e44], eax
mov ecx, dword [ebp - 0x1e44]
mov dword [ebp - 0x1e48], ecx
mov byte [ebp - 4], 0x11
lea edx, [ebp - 0x1518]
push edx
mov eax, dword [ebp - 0x1e48]
push eax
lea ecx, [ebp - 0x1dc0]
push ecx
call fcn.00403370
add esp, 0xc
mov dword [ebp - 0x1e4c], eax
mov edx, dword [ebp - 0x1e4c]
mov dword [ebp - 0x1e50], edx
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x1e50]
push eax
lea ecx, [ebp - 0x590]
call fcn.0041f710
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1dc0]
call fcn.00403ca0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x1dbc]
call fcn.00403ca0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1db8]
call fcn.00403ca0
cmp dword [ebp - 0x18], 0
je 0x41d899
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x124]
mov dword [ebp - 0x1e54], edx
jmp 0x41d8a3
mov dword [ebp - 0x1e54], 0
lea ecx, [ebp - 0x1518]
call fcn.00420d30
push eax
mov eax, dword [ebp - 0x1e54]
push eax
lea ecx, [ebp - 0x14]
call fcn.00420d30
push eax
lea ecx, [ebp - 0x150c]
call fcn.004110e0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x41d90f
lea ecx, [ebp - 0x1510]
push ecx
push 0
lea ecx, [ebp - 0x590]
call fcn.00420d30
push eax
lea ecx, [ebp - 0x1518]
call fcn.00420d30
push eax
lea ecx, [ebp - 0x150c]
call fcn.004114a0
test eax, eax
je 0x41d90f
mov dword [ebp - 0x1e58], 1
jmp 0x41d919
mov dword [ebp - 0x1e58], 0
mov edx, dword [ebp - 0x1e58]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x41d93c
push str.FAIL_:_ExtractFileAs
mov eax, dword [ebp - 0x1dd0]
push eax
call fcn.0041e290
add esp, 8
cmp dword [ebp - 0x10], 0
je 0x41d9e9
cmp dword [ebp + 0x10], 0
je 0x41d9b3
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1e5c], ecx
mov edx, dword [ebp - 0x1e5c]
inc edx
mov dword [ebp - 0x1e60], edx
mov eax, dword [ebp - 0x1e5c]
mov cl, byte [eax]
mov byte [ebp - 0x1e61], cl
inc dword [ebp - 0x1e5c]
cmp byte [ebp - 0x1e61], 0
jne 0x41d962
mov edx, dword [ebp - 0x1e5c]
sub edx, dword [ebp - 0x1e60]
mov dword [ebp - 0x1e68], edx
je 0x41d9b3
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x590]
call fcn.00420d30
push eax
lea ecx, [ebp - 0x6b0]
call fcn.00423760
mov dword [ebp - 0x10], eax
jmp 0x41d9cf
push 0
lea ecx, [ebp - 0x590]
call fcn.00420d30
push eax
lea ecx, [ebp - 0x6b0]
call fcn.00423760
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x41d9e9
push str.FAIL_:_Load_INF
mov ecx, dword [ebp - 0x1dd0]
push ecx
call fcn.0041e290
add esp, 8
cmp dword [ebp - 0x10], 0
je 0x41dd63
lea ecx, [ebp - 0x6b0]
call fcn.00423b70
mov dword [ebp - 0x1528], eax
cmp dword [ebp - 0x10], 0
je 0x41dd63
cmp dword [ebp - 0x1528], 0
je 0x41dd63
mov edx, dword [ebp - 0x1528]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x1528]
call dword [eax + 4]
mov dword [ebp - 0x1e6c], eax
cmp dword [ebp - 0x1e6c], 2
je 0x41dca7
cmp dword [ebp - 0x1e6c], 3
je 0x41da5a
cmp dword [ebp - 0x1e6c], 4
je 0x41db1b
jmp 0x41dd4d
mov ecx, dword [ebp - 0x1dd0]
add ecx, 4
push ecx
lea ecx, [ebp - 0x152c]
call fcn.0041e3d0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x152c]
call fcn.0041e420
movzx edx, al
test edx, edx
je 0x41dabc
mov eax, dword [ebp - 0x1dd0]
mov dword [eax + 0x41c], 6
lea ecx, [ebp - 0x150c]
call fcn.00411740
mov ecx, dword [ebp - 0x1dd0]
mov dword [ecx + 0x520], eax
mov edx, dword [ebp - 0x1dd0]
mov dword [edx + 0x524], 0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x152c]
call fcn.0041e400
mov eax, dword [ebp - 0x1dd0]
push eax
lea ecx, [ebp - 0x1514]
push ecx
push 0
mov edx, dword [ebp - 0x1524]
push edx
lea ecx, [ebp - 0x150c]
call fcn.00411800
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x41db16
lea ecx, [ebp - 0x150c]
call fcn.00412a60
push eax
push str.FAIL_:_ExtractAllFiles____s
mov eax, dword [ebp - 0x1dd0]
push eax
call fcn.0041e290
add esp, 0xc
jmp 0x41dd4d
lea ecx, [ebp - 0x151c]
push ecx
lea edx, [ebp - 0x1520]
push edx
mov eax, dword [ebp - 0x1528]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x1528]
call dword [edx + 0x10]
cmp dword [ebp - 0x1520], 0
je 0x41dbf0
mov eax, dword [ebp - 0x1520]
mov dword [ebp - 0x1e70], eax
mov ecx, dword [ebp - 0x1e70]
inc ecx
mov dword [ebp - 0x1e74], ecx
mov edx, dword [ebp - 0x1e70]
mov al, byte [edx]
mov byte [ebp - 0x1e75], al
inc dword [ebp - 0x1e70]
cmp byte [ebp - 0x1e75], 0
jne 0x41db60
mov ecx, dword [ebp - 0x1e70]
sub ecx, dword [ebp - 0x1e74]
mov dword [ebp - 0x1e7c], ecx
je 0x41dbf0
cmp dword [ebp - 0x151c], 0
je 0x41dbf0
mov edx, dword [ebp - 0x151c]
mov dword [ebp - 0x1e80], edx
mov eax, dword [ebp - 0x1e80]
inc eax
mov dword [ebp - 0x1e84], eax
mov ecx, dword [ebp - 0x1e80]
mov dl, byte [ecx]
mov byte [ebp - 0x1e85], dl
inc dword [ebp - 0x1e80]
cmp byte [ebp - 0x1e85], 0
jne 0x41dbb3
mov eax, dword [ebp - 0x1e80]
sub eax, dword [ebp - 0x1e84]
mov dword [ebp - 0x1e8c], eax
je 0x41dbf0
mov dword [ebp - 0x1e90], 1
jmp 0x41dbfa
mov dword [ebp - 0x1e90], 0
mov ecx, dword [ebp - 0x1e90]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
jne 0x41dc1d
push str.FAIL_:_SetReg
mov edx, dword [ebp - 0x1dd0]
push edx
call fcn.0041e290
add esp, 8
mov eax, dword [ebp - 0x1520]
push eax
push str.HKLMSoftware_s
lea ecx, [ebp - 0x192c]
push ecx
call fcn.00463edd
add esp, 0xc
mov edx, dword [ebp - 0x151c]
mov dword [ebp - 0x1e94], edx
mov eax, dword [ebp - 0x1e94]
inc eax
mov dword [ebp - 0x1e98], eax
mov ecx, dword [ebp - 0x1e94]
mov dl, byte [ecx]
mov byte [ebp - 0x1e99], dl
inc dword [ebp - 0x1e94]
cmp byte [ebp - 0x1e99], 0
jne 0x41dc51
mov eax, dword [ebp - 0x1e94]
sub eax, dword [ebp - 0x1e98]
mov dword [ebp - 0x1ea0], eax
mov ecx, dword [ebp - 0x1ea0]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x151c]
push edx
push 1
lea eax, [ebp - 0x192c]
push eax
call fcn.00426410
add esp, 0x10
jmp 0x41dd4d
push 0
lea ecx, [ebp - 0x1524]
push ecx
mov edx, dword [ebp - 0x1528]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x1528]
call dword [eax + 0x10]
cmp dword [ebp - 0x1524], 0
je 0x41dd20
mov ecx, dword [ebp - 0x1524]
mov dword [ebp - 0x1ea4], ecx
mov edx, dword [ebp - 0x1ea4]
inc edx
mov dword [ebp - 0x1ea8], edx
mov eax, dword [ebp - 0x1ea4]
mov cl, byte [eax]
mov byte [ebp - 0x1ea9], cl
inc dword [ebp - 0x1ea4]
cmp byte [ebp - 0x1ea9], 0
jne 0x41dce3
mov edx, dword [ebp - 0x1ea4]
sub edx, dword [ebp - 0x1ea8]
mov dword [ebp - 0x1eb0], edx
je 0x41dd20
mov dword [ebp - 0x1eb4], 1
jmp 0x41dd2a
mov dword [ebp - 0x1eb4], 0
mov eax, dword [ebp - 0x1eb4]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x41dd4d
push str.FAIL_:_SetRoot
mov ecx, dword [ebp - 0x1dd0]
push ecx
call fcn.0041e290
add esp, 8
lea ecx, [ebp - 0x6b0]
call fcn.00423bd0
mov dword [ebp - 0x1528], eax
jmp 0x41da04
cmp dword [ebp - 0x1514], 0
je 0x41dda3
cmp dword [ebp - 0x10], 0
je 0x41dd83
mov edx, dword [ebp - 0x1514]
push edx
call fcn.00411d60
add esp, 4
jmp 0x41dd94
push 0
mov eax, dword [ebp - 0x1514]
push eax
call fcn.00411ad0
add esp, 8
mov ecx, dword [ebp - 0x1514]
push ecx
call fcn.00411e10
add esp, 4
cmp dword [ebp - 0x1510], 0
je 0x41ddca
mov edx, dword [ebp - 0x1510]
push edx
call fcn.00411cf0
add esp, 4
mov eax, dword [ebp - 0x1510]
push eax
call fcn.00411e60
add esp, 4
lea ecx, [ebp - 0x590]
call fcn.00420d30
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1518]
call fcn.00403ca0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x590]
call fcn.00403ca0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x6b0]
call fcn.00423710
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x150c]
call fcn.004110c0
jmp 0x41df59
push 4
lea ecx, [ebp - 0x1dc8]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.0043ec10
mov dword [ebp - 0x1eb8], eax
push str..exe
mov ecx, dword [ebp - 0x1eb8]
call fcn.0040afd0
neg eax
sbb eax, eax
inc eax
mov byte [ebp - 0x1dc1], al
lea ecx, [ebp - 0x1dc8]
call fcn.00403ca0
movzx edx, byte [ebp - 0x1dc1]
test edx, edx
je 0x41df59
mov ecx, 0x11
xor eax, eax
lea edi, [ebp - 0x1d74]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x1d74], 0x44
lea ecx, [ebp - 0x14]
call fcn.00420d30
mov dword [ebp - 0x1ebc], eax
lea eax, [ebp - 0x1d2c]
mov dword [ebp - 0x1ec0], eax
mov ecx, dword [ebp - 0x1ec0]
mov dword [ebp - 0x1ec4], ecx
mov edx, dword [ebp - 0x1ebc]
mov al, byte [edx]
mov byte [ebp - 0x1ec5], al
mov ecx, dword [ebp - 0x1ec0]
mov dl, byte [ebp - 0x1ec5]
mov byte [ecx], dl
mov eax, dword [ebp - 0x1ebc]
add eax, 1
mov dword [ebp - 0x1ebc], eax
mov ecx, dword [ebp - 0x1ec0]
add ecx, 1
mov dword [ebp - 0x1ec0], ecx
cmp byte [ebp - 0x1ec5], 0
jne 0x41dea8
lea edx, [ebp - 0x1d84]
push edx
lea eax, [ebp - 0x1d74]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [ebp - 0x1d2c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x41df1f
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0
je 0x41df59
cmp dword [ebp - 0x1d84], 0
je 0x41df59
push 0xffffffffffffffff
mov edx, dword [ebp - 0x1d84]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x1d84]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x14]
call fcn.00420d30
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0x10], 0
je 0x41dfb4
mov ecx, dword [ebp - 0x1dd0]
add ecx, 4
push ecx
lea ecx, [ebp - 0x1d88]
call fcn.0041e3d0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x1d88]
call fcn.0041e420
movzx edx, al
test edx, edx
je 0x41dfa5
mov eax, dword [ebp - 0x1dd0]
mov ecx, dword [eax + 0x52c]
add ecx, 1
mov edx, dword [ebp - 0x1dd0]
mov dword [edx + 0x52c], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1d88]
call fcn.0041e400
cmp dword [ebp - 0x10], 0
jne 0x41e027
mov eax, dword [ebp - 0x1dd0]
add eax, 4
push eax
lea ecx, [ebp - 0x1d8c]
call fcn.0041e3d0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x1d8c]
call fcn.0041e420
movzx ecx, al
test ecx, ecx
je 0x41e016
mov edx, dword [ebp - 0x1dd0]
cmp dword [edx + 0x534], 0
je 0x41e006
mov eax, dword [ebp - 0x1dd0]
mov dword [eax + 0x41c], 8
jmp 0x41e016
mov ecx, dword [ebp - 0x1dd0]
mov dword [ecx + 0x41c], 5
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1d8c]
call fcn.0041e400
jmp 0x41e071
mov edx, dword [ebp - 0x1dd0]
add edx, 4
push edx
lea ecx, [ebp - 0x1d90]
call fcn.0041e3d0
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x1d90]
call fcn.0041e420
movzx eax, al
test eax, eax
je 0x41e062
mov ecx, dword [ebp - 0x1dd0]
mov dword [ecx + 0x41c], 7
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1d90]
call fcn.0041e400
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x1dcc], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00403ca0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00403ca0
mov eax, dword [ebp - 0x1dcc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x20]
call fcn.004635af
pop edi
mov esp, ebp
pop ebp
ret 0xc