Function at 0x40eb3f
Capabilities:
Acquire debug privileges
Check os version
Create process on windows
Hide graphical window

Disassembly:
mov eax, 0x420b8e
call fcn.00414f70
mov eax, 0x1974
call fcn.00416200
mov eax, dword [ebp + 0x10]
push ebx
push esi
sub eax, 6
push edi
je 0x40f6b6
sub eax, 0xa
je 0x40f659
sub eax, 0x3e
je 0x40f649
sub eax, 0xc2
je 0x40efe0
dec eax
je 0x40ebd6
dec eax
jne 0x40f6d4
cmp word [ebp + 0x14], 0xf020
jne 0x40f6d4
cmp dword [0x43088c], 0
mov edi, dword [ebp + 8]
je 0x40f683
mov esi, dword [edi + 0x45038]
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, esi
jne 0x40f683
push 1
push esi
mov ecx, 0x441dc0
call fcn.004141e2
push 0
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40f683
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
movzx esi, ax
shr eax, 0x10
cmp esi, 0x8016
mov dword [ebp + 0x14], eax
jl 0x40ebfd
cmp esi, 0x8034
jg 0x40ebfd
push esi
mov ecx, ebx
call fcn.0040fd7c
mov eax, 0x7ef
cmp esi, eax
jg 0x40ee9c
je 0x40ee2a
mov eax, 0x3f3
cmp esi, eax
jg 0x40ed81
je 0x40ed3b
dec esi
je 0x40ecd0
dec esi
je 0x40ec6f
sub esi, 3
je 0x40ec44
dec esi
jne 0x40f6d4
mov ecx, ebx
call fcn.0041264d
push 1
jmp 0x40ecb7
mov esi, 0x441dc0
mov ecx, esi
call fcn.0041424c
push 1
mov ecx, esi
push dword [ebx + 0x45038]
call fcn.004141e2
push 0
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40f6d4
xor esi, esi
cmp dword [0x4884b0], esi
je 0x40ec82
mov ecx, ebx
call fcn.0040ea54
jmp 0x40ecad
cmp dword [0x430890], esi
je 0x40ecb5
push 1
mov ecx, 0x441dc0
push dword [ebx + 0x45038]
call fcn.004141e2
push esi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, ebx
call fcn.00411377
push 1
pop eax
jmp 0x40f6d6
push 2
push dword [ebx + 0x45038]
call dword [sym.imp.USER32.dll_EndDialog]
push 1
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x40f6d4
xor edi, edi
mov ecx, ebx
push edi
push edi
call fcn.0041144a
test eax, eax
je 0x40f6d4
cmp dword [0x430894], edi
je 0x40f6d4
cmp dword [0x4884b0], edi
je 0x40ed13
push edi
push 0x800e
push 0x111
push dword [ebx + 0x45038]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x40f6d4
lea esi, [ebx + 0x45038]
push edi
mov ecx, 0x441dc0
push dword [esi]
call fcn.004141e2
push edi
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, ebx
call fcn.00411377
jmp 0x40f6d4
push 0x48849c
push eax
mov ecx, ebx
call fcn.0040ea21
push dword [0x48849c]
push str.topmost
call fcn.0040bf91
pop ecx
xor eax, eax
cmp dword [0x48849c], eax
pop ecx
push 3
push eax
push eax
push eax
push eax
je 0x40ed6e
push 0xffffffffffffffff
jmp 0x40ed70
push 0xfffffffffffffffe
push dword [ebx + 0x45038]
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x40f6d4
sub esi, 0x3f5
je 0x40ee0e
dec esi
dec esi
je 0x40ee04
sub esi, 0x19
je 0x40edb1
sub esi, 0x3d6
jne 0x40f6d4
push dword [ebp + 0xc]
mov ecx, ebx
call fcn.00410ea4
jmp 0x40f6d4
cmp dword [ebp + 0x14], 7
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
jne 0x40eddc
push 0x38
call fcn.0040bd5e
pop ecx
push eax
push 0x411
push dword [ebx + 0x45038]
call esi
push eax
call edi
cmp dword [ebp + 0x14], 8
jne 0x40f6d4
push 0x35
call fcn.0040bd5e
pop ecx
push eax
push 0x411
push dword [ebx + 0x45038]
call esi
push eax
call edi
jmp 0x40f6d4
call fcn.0040bdc8
jmp 0x40f6d4
xor esi, esi
push 5
cmp dword [0x48775c], esi
push esi
push esi
jne 0x40ee26
push 0x17
call fcn.0040bbd0
pop ecx
jmp 0x40ee8a
push 0x18
jmp 0x40ee1e
mov eax, dword [0x434820]
xor esi, esi
mov dword [ebp - 0x980], eax
mov ecx, 0x1ff
xor eax, eax
cmp dword [0x48775c], esi
lea edi, [ebp - 0x97c]
rep stosd dword es:[edi], eax
jne 0x40ee52
push 0x14
jmp 0x40ee54
push 0x15
call fcn.0040bbd0
pop ecx
push dword [0x426d1c]
push str.Program
push str._seitepaypal
push eax
lea eax, [ebp - 0x980]
push str._s_s_s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x980]
push 5
push esi
push esi
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40f6d4
mov eax, 0x8036
cmp esi, eax
jg 0x40ef06
je 0x40eefa
sub esi, 0x1e61
je 0x40eeeb
sub esi, 0x61ad
je 0x40eedf
sub esi, 6
je 0x40eecf
dec esi
jne 0x40f6d4
mov ecx, ebx
call fcn.004103a9
jmp 0x40f6d4
push 0
push 1
mov ecx, ebx
call fcn.0041144a
jmp 0x40f6d4
mov ecx, ebx
call fcn.0040ea54
jmp 0x40f6d4
push dword [ebp + 0xc]
mov ecx, ebx
call fcn.0041064e
jmp 0x40f6d4
mov ecx, ebx
call fcn.00412018
jmp 0x40f6d4
mov eax, 0x8037
cmp esi, eax
je 0x40ef47
jle 0x40f6d4
cmp esi, 0x8039
jle 0x40ef3a
cmp esi, 0xabe4
jne 0x40f6d4
push dword [ebx + 0x45038]
call fcn.00409183
pop ecx
jmp 0x40f6d4
push esi
mov ecx, ebx
call fcn.004124df
jmp 0x40f6d4
push eax
lea eax, [ebp - 0x80]
push dword [ebx + 0x4502c]
push eax
call fcn.0040d7f0
mov esi, eax
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x1c]
add esp, 0xc
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebx + 0x4502c]
call dword [sym.imp.USER32.dll_ClientToScreen]
mov esi, 0x8037
push 1
push esi
push 0x403
push dword [ebx + 0x4502c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebx + 0x45038]
mov dword [0x4880bc], eax
call fcn.00412229
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push 0x4348d8
call fcn.0040117e
push 3
mov ecx, 0x4880b8
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.00407ef3
mov eax, dword [ebx + 0x4502c]
mov dword [0x43482c], esi
mov dword [0x434830], eax
jmp 0x40ecad
push 0x43068c
push str.hotkey
call fcn.0040c0bd
pop ecx
xor esi, esi
pop ecx
push esi
call dword [sym.imp.ole32.dll_OleInitialize]
mov ecx, dword [ebp + 8]
call fcn.0040e720
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push esi
push 0xc
call edi
push eax
push 0xb
call edi
mov ebx, dword [sym.imp.USER32.dll_LoadImageW]
push eax
push 1
push 0x6b
push dword [0x4419b4]
call ebx
push esi
push 0x32
mov dword [ebp + 0x14], eax
call edi
push eax
push 0x31
call edi
push eax
push 1
push 0x6b
push dword [0x4419b4]
call ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push esi
push 0x80
push dword [ebp + 0xc]
call ebx
push dword [ebp + 0x14]
push 1
push 0x80
push dword [ebp + 0xc]
call ebx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push 0xbd7
push eax
mov dword [ecx + 0x45038], eax
mov dword [0x4884a4], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp + 0x14], eax
call fcn.00403988
test al, al
je 0x40f0a6
push 0x89
push dword [0x4419b4]
call dword [sym.imp.USER32.dll_LoadBitmapW]
push eax
push esi
push 0x172
push dword [ebp + 0x14]
call ebx
push 0x31
call edi
cmp eax, 0x10
jle 0x40f196
lea ecx, [ebp - 0x2c]
call fcn.0040106e
lea ecx, [ebp - 0x1c]
call fcn.0040106e
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
push dword [edi + 0x45038]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x1c]
push eax
push 0xfbe
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x1c]
push eax
push dword [edi + 0x45038]
mov edi, dword [sym.imp.USER32.dll_ScreenToClient]
call edi
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x45038]
call edi
lea ecx, [ebp - 0x2c]
call fcn.0040109e
fild dword [ebp - 0x24]
fmul qword [0x422680]
call fcn.00415b4c
push esi
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
call fcn.0040109e
push eax
push esi
push esi
push esi
push dword [ebp + 0x14]
call dword [sym.imp.USER32.dll_SetWindowPos]
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2c]
call fcn.0040109e
push eax
push esi
push esi
lea ecx, [ebp - 0x3c]
call fcn.0040107e
push esi
push esi
push 0x173
mov dword [ebp + 0x10], esi
push dword [ebp + 0x14]
call ebx
lea ecx, [ebp - 0x3c]
mov dword [ebp + 0x10], eax
call fcn.004010a4
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040109e
push eax
lea eax, [ebp + 0x10]
push eax
call fcn.004027f3
add esp, 0xc
push dword [ebp + 0x10]
push esi
push 0x172
push dword [ebp + 0x14]
call ebx
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.004100ab
push dword [0x4884b4]
push str.show_control_menu
call fcn.0040bfa9
push dword [0x430894]
mov dword [0x4884b4], eax
push str.hide_if_run
call fcn.0040bfa9
push dword [0x4884b8]
mov dword [0x430894], eax
push str.hide_if_run_favorit
call fcn.0040bfa9
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [0x4884b8], eax
push dword [ebp + 0xc]
call fcn.0040f829
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
call edi
call fcn.0041622f
mov ecx, 0x488470
mov dword [0x487f9c], eax
call fcn.0041472e
call fcn.004031cb
mov ecx, dword [ebp + 8]
call fcn.00411386
push str.USER32.DLL
call edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.AllowSetForegroundWindow
push eax
mov dword [ebp + 0x14], eax
call edi
push str.LockSetForegroundWindow
mov dword [0x488480], eax
push dword [ebp + 0x14]
call edi
push 0x488468
push 0x430bf0
push 7
push esi
push 0x422638
mov dword [0x488484], eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
lea eax, [ebp + 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40f2b8
xor eax, eax
lea edi, [ebp - 0x18]
mov dword [ebp - 0x1c], 1
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push eax
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x40f2b8
push esi
push esi
lea eax, [ebp - 0x1c]
push 0x10
push eax
push esi
push dword [ebp + 0x18]
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x434820]
push 0x3f
mov dword [ebp - 0x180], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x17c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x180]
push 0x80
push eax
push 0x6d
push dword [0x4419b4]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x180]
push esi
push eax
call fcn.0041490b
pop ecx
mov edi, 0xf1
pop ecx
mov dword [0x487f78], eax
push esi
push eax
push edi
push 0x3f7
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call ebx
push dword [0x488494]
push str.m_set_focus
call fcn.0040bfa9
push dword [0x430890]
mov dword [0x488494], eax
push str.tray_if_close
call fcn.0040bfa9
push dword [0x4884b0]
mov dword [0x430890], eax
push str.hide_if_close
call fcn.0040bfa9
push dword [0x4884a8]
mov dword [0x4884b0], eax
push str.start_tray
call fcn.0040bfa9
push dword [0x4884ac]
mov dword [0x4884a8], eax
push str.start_hiden
call fcn.0040bfa9
push dword [0x43088c]
mov dword [0x4884ac], eax
push str.tray_if_minimize
call fcn.0040bfa9
push dword [0x4884c4]
mov dword [0x43088c], eax
push str.show_icons_by_mouse
call fcn.0040bfa9
push dword [0x4884c8]
mov dword [0x4884c4], eax
push str.hide_taskbar
call fcn.0040bfa9
add esp, 0x40
mov dword [0x4884c8], eax
push dword [0x48849c]
push str.topmost
call fcn.0040bfa9
pop ecx
mov dword [0x48849c], eax
pop ecx
push esi
push eax
push edi
push 0x3f3
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call ebx
push 3
push esi
push esi
push esi
push esi
xor eax, eax
cmp dword [0x48849c], esi
setne al
dec eax
dec eax
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x45038]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, str.regedit
lea edi, [ebp - 0x1980]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
mov ecx, 0x3fc
xor eax, eax
lea edi, [ebp - 0x1970]
push 0x410
push dword [esi + 0x45038]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
call edi
push 0
push 0
push 0x407
push eax
mov dword [esi + 0x400c], eax
call ebx
push 7
push eax
call fcn.00414a30
pop ecx
lea eax, [ebp - 0x1980]
pop ecx
push eax
push 0x410
push dword [esi + 0x45038]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov ecx, esi
call fcn.004117a3
call fcn.0041219f
push 0x34
lea eax, [ebp - 0x70]
push 0
push eax
call fcn.00414b40
add esp, 0xc
mov dword [ebp - 0x70], 0x34
push 0
push 0
push 0x406
push dword [esi + 0x400c]
call ebx
lea ecx, [ebp - 0x70]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetComboBoxInfo]
cmp dword [ebp - 0x40], 0
je 0x40f4d2
push 0x40eb09
push 0xfffffffffffffffc
push dword [ebp - 0x40]
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [0x4884f4], eax
push 0x24
call fcn.00415745
pop ecx
mov ecx, eax
mov dword [ebp + 8], ecx
xor eax, eax
cmp ecx, eax
mov dword [ebp - 4], eax
je 0x40f4f6
call fcn.004035a3
mov eax, dword [ebp + 8]
mov dword [eax], 0x422658
mov ecx, dword [esi + 0x400c]
or dword [ebp - 4], 0xffffffff
push eax
mov dword [eax + 0x20], ecx
push dword [esi + 0x400c]
call dword [sym.imp.ole32.dll_RegisterDragDrop]
push 0x114
push 0
push 0x487fa0
call fcn.00414b40
add esp, 0xc
mov dword [0x487fa0], 0x114
push 0x487fa0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [0x487fa4], 6
jae 0x40f55c
mov eax, 0x434410
push eax
push eax
push 0x40c
push dword [ebp + 0xc]
call edi
push eax
call fcn.0040e2b6
add esp, 0xc
push 0x3ea
push dword [ebp + 0xc]
call edi
push 2
push 0
push 0x407
push eax
mov dword [ebp + 8], eax
call ebx
push 0x64
push 0
push 0x408
push dword [ebp + 8]
call ebx
push dword [0x43089c]
push str.auto_hide_icons_sec
call fcn.0040bfa9
mov dword [0x43089c], eax
imul eax, eax, 0x3e8
mov dword [ebp + 0x14], eax
pop ecx
fild dword [ebp + 0x14]
pop ecx
fmul qword [0x422650]
call fcn.00415b4c
movzx eax, ax
shl eax, 0x10
push eax
push 0
push 0x401
push 0x40c
push dword [ebp + 0xc]
call edi
push eax
call ebx
mov eax, dword [0x43089c]
push 0
imul eax, eax, 0x3e8
mov dword [ebp + 0x14], eax
fild dword [ebp + 0x14]
fmul qword [0x422650]
call fcn.00415b4c
push eax
push 0x402
push 0x40c
push dword [ebp + 0xc]
call edi
push eax
call ebx
push 0
mov edi, 0x405
push dword [0x43089c]
push edi
push dword [ebp + 8]
call ebx
push dword [0x43089c]
push 1
push edi
push dword [ebp + 8]
call ebx
call fcn.0041622f
push 0
push 0xc8
push 0xfa0
mov dword [0x487f98], eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, esi
call fcn.00411909
jmp 0x40f6d4
push dword [ebp + 0x18]
mov ecx, dword [ebp + 8]
push dword [ebp + 0x14]
call fcn.0041112e
jmp 0x40f6d4
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.0041264d
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
xor ebx, ebx
push ebx
push dword [0x488464]
call esi
cmp dword [0x4884b0], ebx
je 0x40f68a
mov ecx, edi
call fcn.0040ea54
mov ecx, edi
jmp 0x40eca8
cmp dword [0x430890], ebx
je 0x40f6d4
push 1
mov ecx, 0x441dc0
push dword [edi + 0x45038]
call fcn.004141e2
mov ecx, edi
call fcn.00411377
push ebx
push dword [ebp + 0xc]
call esi
jmp 0x40ecad
cmp word [ebp + 0x14], 0
je 0x40f6cd
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x45038]
mov dword [0x487628], eax
jmp 0x40f6d4
and dword [0x487628], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x14