Function at 0x417b50
Capabilities:
Accept command line arguments
Create directory
Create process on windows
Get common file path
Terminate process

Disassembly:
call fcn.00411157
push 0x40783e
push str.c:bkup
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x407e6d
push 4
pop eax
pop esi
mov dword [esi], eax
push 0x407c50
push 0
pop eax
pop esi
mov dword [esi], eax
push 0x406836
call fcn.004101de
push eax
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x406e39
push 7
push 0
push 0x406836
call fcn.0040c2e1
push eax
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x407c6c
call dword [sym.imp.Kernel32.dll_GetCommandLineA]
push eax
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x407c6c
call fcn.0040f3c6
not eax
and eax, 1
or eax, eax
je 0x417c12
push 0x407c6c
push 0x407e7a
call fcn.0040dd1f
push 0xf
call dword [sym.imp.Kernel32.dll_ExitProcess]
push 0x403538
pop esi
push dword [esi]
push 0
pop ebx
pop eax
cmp eax, ebx
mov eax, 1
jl 0x417c2e
xor eax, eax
or eax, eax
je 0x417c52
push 0x407c6c
push str._cmd_line_err
call fcn.0040dd1f
push 0xf
call dword [sym.imp.Kernel32.dll_ExitProcess]
push 0x403538
pop esi
push dword [esi]
push 0
pop ebx
pop eax
cmp eax, ebx
mov eax, 1
je 0x417c6e
xor eax, eax
or eax, eax
je 0x417c92
push str.__BKUP__4
push str.__BKUP_2024y_Usage
call fcn.0040dd1f
push 0xf
call dword [sym.imp.Kernel32.dll_ExitProcess]
push 0x403334
push 1
pop eax
mov ebx, 4
mul ebx
pop ebx
add eax, ebx
push eax
pop esi
push dword [esi]
push 0x407eb7
pop ebx
pop eax
push ebx
push eax
call dword [sym.imp.Kernel32.dll_lstrcmp]
cmp eax, 0
mov eax, 1
je 0x417ccc
xor eax, eax
or eax, eax
je 0x417ce4
push 0x407e6d
push 4
pop eax
pop esi
mov dword [esi], eax
jmp 0x417e07
push 0x403334
push 1
pop eax
mov ebx, 4
mul ebx
pop ebx
add eax, ebx
push eax
pop esi
push dword [esi]
push 0x407eba
pop ebx
pop eax
push ebx
push eax
call dword [sym.imp.Kernel32.dll_lstrcmp]
cmp eax, 0
mov eax, 1
je 0x417d1e
xor eax, eax
or eax, eax
je 0x417d36
push 0x407e6d
push 3
pop eax
pop esi
mov dword [esi], eax
jmp 0x417e07
push 0x403334
push 1
pop eax
mov ebx, 4
mul ebx
pop ebx
add eax, ebx
push eax
pop esi
push dword [esi]
push 0x407ebd
pop ebx
pop eax
push ebx
push eax
call dword [sym.imp.Kernel32.dll_lstrcmp]
cmp eax, 0
mov eax, 1
je 0x417d70
xor eax, eax
or eax, eax
je 0x417d93
push 0x407e6d
push 4
pop eax
pop esi
mov dword [esi], eax
push 0x407c50
push 1
pop eax
pop esi
mov dword [esi], eax
jmp 0x417e07
push 0x403334
push 1
pop eax
mov ebx, 4
mul ebx
pop ebx
add eax, ebx
push eax
pop esi
push dword [esi]
push 0x407ec1
pop ebx
pop eax
push ebx
push eax
call dword [sym.imp.Kernel32.dll_lstrcmp]
cmp eax, 0
mov eax, 1
je 0x417dcd
xor eax, eax
or eax, eax
je 0x417df0
push 0x407e6d
push 3
pop eax
pop esi
mov dword [esi], eax
push 0x407c50
push 1
pop eax
pop esi
mov dword [esi], eax
jmp 0x417e07
push str._usage_:__BKUP__4
push str.__BKUP_arg_bad
call fcn.0040dd1f
push 0x1f
call dword [sym.imp.Kernel32.dll_ExitProcess]
push 0x40743c
push 0x200
call dword [sym.imp.Kernel32.dll_GetCurrentDirectoryA]
push 0x40783e
push 0x40743c
call fcn.0040c4b7
or eax, eax
je 0x417f56
push 0x407f08
push 0x40783e
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x407f1f
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push str._DIR_PREFIX_NAME
push 0x40783e
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push str._is_protected
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
call fcn.0040dd1f
push 0xf
call dword [sym.imp.Kernel32.dll_ExitProcess]
push 0x407c44
push 0x40743c
call fcn.0040b1d2
pop esi
mov dword [esi], eax
push 0x407c40
push 0x407c44
pop esi
push dword [esi]
push 1
pop ebx
pop eax
sub eax, ebx
pop esi
mov dword [esi], eax
push 0x407c4c
push 0
pop eax
pop esi
mov dword [esi], eax
push 0x407c40
pop esi
push dword [esi]
push 0
pop ebx
pop eax
cmp eax, ebx
mov eax, 1
jge 0x417fa5
xor eax, eax
push eax
or eax, eax
je 0x417fe6
push 0x40743c
push 0x407c40
pop esi
push dword [esi]
pop eax
pop ebx
add eax, ebx
push eax
pop esi
xor eax, eax
mov al, byte [esi]
push eax
push 0x5c
pop ebx
pop eax
cmp eax, ebx
mov eax, 1
jne 0x417fda
xor eax, eax
push eax
pop ebx
pop eax
and eax, ebx
and eax, 1
push eax
pop eax
or eax, eax
je 0x418034
push 0x407c40
pop esi
sub dword [esi], 1
push 0x407c4c
push 0x40743c
push 0x407c40
pop esi
push dword [esi]
pop eax
pop ebx
add eax, ebx
push eax
pop esi
xor eax, eax
mov al, byte [esi]
push eax
push 0x5c
pop ebx
pop eax
cmp eax, ebx
mov eax, 1
je 0x41802c
xor eax, eax
pop esi
mov dword [esi], eax
jmp 0x417f89
push 0x407c50
pop esi
push dword [esi]
pop eax
or eax, eax
je 0x4180e4
push 0x407c4c
pop esi
push dword [esi]
pop eax
not eax
and eax, 1
or eax, eax
je 0x4180df
push 0x40743c
push 0
pop eax
pop ebx
add eax, ebx
push eax
pop esi
xor eax, eax
mov al, byte [esi]
push eax
push 0x63
pop ebx
pop eax
cmp eax, ebx
mov eax, 1
je 0x418084
xor eax, eax
push eax
push 0x40743c
push 0
pop eax
pop ebx
add eax, ebx
push eax
pop esi
xor eax, eax
mov al, byte [esi]
push eax
push 0x43
pop ebx
pop eax
cmp eax, ebx
mov eax, 1
je 0x4180ab
xor eax, eax
push eax
pop ebx
pop eax
or eax, ebx
and eax, 1
or eax, eax
je 0x4180da
push str._C:
push str._C:_ROOT_DIR_NOT_BACKUP
call fcn.0040dd1f
push 0xf
call dword [sym.imp.Kernel32.dll_ExitProcess]
jmp 0x4180df
jmp 0x418119
push 0x407c4c
pop esi
push dword [esi]
pop eax
not eax
and eax, 1
or eax, eax
je 0x418119
push 0x407f8a
push str._ROOT_DIR_NOT_BACKUP
call fcn.0040dd1f
push 0xf
call dword [sym.imp.Kernel32.dll_ExitProcess]
push 0x40783e
call fcn.00416b72
not eax
and eax, 1
or eax, eax
je 0x418174
push 0x407c60
push 0x40783e
call dword [sym.imp.Kernel32.dll_CreateDirectoryA]
not eax
and eax, 1
or eax, eax
je 0x41816f
push 0x40783e
push str._DIR_NOT_kreate
call fcn.0040dd1f
push 0xf
call dword [sym.imp.Kernel32.dll_ExitProcess]
jmp 0x418174
push 0x40783e
push 0x40783e
push 0x407fc0
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x407e6d
pop esi
push dword [esi]
push 1
pop ebx
pop eax
sub eax, ebx
push eax
push 0
push 0x406e39
call fcn.0040c2e1
push eax
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x40783e
push 0x40783e
push 0x407fc2
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x407e6d
pop esi
push dword [esi]
push 4
pop ebx
pop eax
cmp eax, ebx
mov eax, 1
je 0x4182a2
xor eax, eax
or eax, eax
je 0x418367
push 0x40783e
push 0x40783e
push 2
push 0x403548
pop eax
add eax, 6
push eax
pop esi
xor eax, eax
mov al, byte [esi]
mov ah, byte [esi + 1]
push eax
call fcn.0040ee17
push eax
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x407fc6
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
jmp 0x418367
push 0x40783e
push 0x40783e
push 0x4067b0
push 0x403548
pop eax
add eax, 2
push eax
pop esi
xor eax, eax
mov al, byte [esi]
mov ah, byte [esi + 1]
push eax
pop eax
sub eax, 1
mov ebx, 4
mul ebx
pop ebx
add eax, ebx
push eax
pop esi
push dword [esi]
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x406a37
push 0x407fc8
push 4
push 0x403548
pop eax
add eax, 0
push eax
pop esi
xor eax, eax
mov al, byte [esi]
mov ah, byte [esi + 1]
push eax
call fcn.0040ee17
push eax
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x40783e
push 0x40783e
push 0x406a37
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 1
pop eax
or eax, eax
je 0x41852b
push 0x40783e
call fcn.00416b72
not eax
and eax, 1
or eax, eax
je 0x418526
push 0x407c60
push 0x40783e
call dword [sym.imp.Kernel32.dll_CreateDirectoryA]
not eax
and eax, 1
or eax, eax
je 0x418521
push 0x40783e
push 0x407fca
call fcn.0040dd1f
push 0xf
call dword [sym.imp.Kernel32.dll_ExitProcess]
jmp 0x418526
jmp 0x41852b
push 0x40763d
push 0x407c44
pop esi
push dword [esi]
push 1
pop ebx
pop eax
sub eax, ebx
push eax
push 0x407c40
pop esi
push dword [esi]
push 1
pop ebx
pop eax
add eax, ebx
push eax
push 0x40743c
call fcn.0040c2e1
push eax
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x40723b
push 0
pop eax
pop ebx
add eax, ebx
push eax
push 0x22
pop eax
pop esi
mov byte [esi], al
push 0x40723b
push 1
pop eax
pop ebx
add eax, ebx
push eax
push 0
pop eax
pop esi
mov byte [esi], al
push 0x407a3f
push 0x40783e
push 0x407fdb
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x406e39
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x407fdd
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x40763d
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push str..TXT
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x407a3f
call fcn.00416c40
or eax, eax
je 0x418722
push 0x407a3f
push str._CRAZY_:_FILE_IS_EXIST
call fcn.0040dd1f
push 0xf
call dword [sym.imp.Kernel32.dll_ExitProcess]
push 0x407c48
push 0x1000
push 0x407a3f
call dword [sym.imp.Kernel32.dll__lcreat]
pop esi
mov dword [esi], eax
push 0x406c38
push 0x200
call dword [sym.imp.Kernel32.dll_GetCurrentDirectoryA]
push 0x406a37
push str._r_n__BKUP__c__Dvinyaninov_Andrey__AndreyDvinyaninov_2022_2024__r_n
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x406a37
call fcn.0040b1d2
push eax
push 0x406a37
push 0x407c48
pop esi
push dword [esi]
call dword [sym.imp.Kernel32.dll__lwrite]
push 0x406a37
push str._ADT__c__Dvinyaninov_Andrey__AndreyDvinyaninov_2002_2024___base_2000_year__r_n
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x406a37
call fcn.0040b1d2
push eax
push 0x406a37
push 0x407c48
pop esi
push dword [esi]
call dword [sym.imp.Kernel32.dll__lwrite]
push 0x406a37
push str._MTK__c__Dvinyaninov_Andrey__AndreyDvinyaninov_2014_2024___base_1000_year__r_n
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x406a37
call fcn.0040b1d2
push eax
push 0x406a37
push 0x407c48
pop esi
push dword [esi]
call dword [sym.imp.Kernel32.dll__lwrite]
push 0x406a37
push str._2023_2024_download_URL___drive.proton.me_urls_KWP7ZMPF2MLncqGRMdnlb6__r_n
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x406a37
call fcn.0040b1d2
push eax
push 0x406a37
push 0x407c48
pop esi
push dword [esi]
call dword [sym.imp.Kernel32.dll__lwrite]
push 0x406a37
push str._EMAIL_2016_2024_Dvinyaninov_Andrey__AndreyDvinyaninov___mtkrefer_protonmail.com__r_n
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x406a37
call fcn.0040b1d2
push eax
push 0x406a37
push 0x407c48
pop esi
push dword [esi]
call dword [sym.imp.Kernel32.dll__lwrite]
push 0x406a37
push str._Virustotal.com___main_antivirus_detected_all_right__r_n_r_n
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x406a37
call fcn.0040b1d2
push eax
push 0x406a37
push 0x407c48
pop esi
push dword [esi]
call dword [sym.imp.Kernel32.dll__lwrite]
push 9
push 0x406836
call fcn.0040b1d2
push eax
pop ebx
pop eax
add eax, ebx
push eax
push str._MTK_
push 0x406836
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x4081b5
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x407c48
pop esi
push dword [esi]
call dword [sym.imp.Kernel32.dll__lwrite]
push 0x406836
push str._UTC__LKL
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x40378d
pop esi
push dword [esi]
push 0
pop ebx
pop eax
cmp eax, ebx
mov eax, 1
jg 0x418974
xor eax, eax
or eax, eax
je 0x4189dd
push 0x406836
push 0x406836
push 0x4081c4
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
jmp 0x4189dd
push 0x406836
push 0x406836
push 4
push 0x40378d
pop esi
push dword [esi]
call fcn.0040ee17
push eax
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push str._minute
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x407c40
push 0x40378d
pop esi
push dword [esi]
push 6
pop ebx
pop eax
mov edx, eax
sar edx, 0x1f
idiv ebx
pop esi
mov dword [esi], eax
push 0x406836
push 0x406836
push 0x4081ce
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x40378d
pop esi
push dword [esi]
push 0
pop ebx
pop eax
cmp eax, ebx
mov eax, 1
jg 0x418b1a
xor eax, eax
or eax, eax
je 0x418b83
push 0x406836
push 0x406836
push 0x4081d0
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
jmp 0x418b83
push 0x406836
push 0x406836
push 1
push 3
push 0x407c40
pop esi
push dword [esi]
call fcn.0040ef8e
push eax
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push str._hour
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 2
push 0x406836
call fcn.0040b1d2
push eax
pop ebx
pop eax
add eax, ebx
push eax
push 0x406836
push 0x4081d8
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x407c48
pop esi
push dword [esi]
call dword [sym.imp.Kernel32.dll__lwrite]
push 0x406836
push str._KUR_DIR_
push 0x406c38
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x4081e7
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x406836
call fcn.0040b1d2
push eax
push 0x406836
push 0x407c48
pop esi
push dword [esi]
call dword [sym.imp.Kernel32.dll__lwrite]
push 0x406836
push str._LOG_
push 0x407a3f
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x4081f3
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x406836
call fcn.0040b1d2
push eax
push 0x406836
push 0x407c48
pop esi
push dword [esi]
call dword [sym.imp.Kernel32.dll__lwrite]
push 0x406836
push str._CMDLINE_
push 0x407c6c
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push str.__r_n
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x406836
call fcn.0040b1d2
push eax
push 0x406836
push 0x407c48
pop esi
push dword [esi]
call dword [sym.imp.Kernel32.dll__lwrite]
push 0x403538
pop esi
push dword [esi]
push 0
pop ebx
pop eax
cmp eax, ebx
mov eax, 1
jg 0x418eea
xor eax, eax
push eax
or eax, eax
je 0x418f1e
push 0x407c6c
call fcn.0040b1d2
push eax
push 1
pop ebx
pop eax
cmp eax, ebx
mov eax, 1
jg 0x418f12
xor eax, eax
push eax
pop ebx
pop eax
and eax, ebx
and eax, 1
push eax
pop eax
or eax, eax
je 0x418f6e
push 0x406836
push 0x408208
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x406836
push 0x40820c
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x406836
push 0x407c6c
call dword [sym.imp.User32.dll_CharToOemA]
jmp 0x418f6e
push 0x406836
push str.__r_n_USAGE_:__BKUP.EXE___3____4___r_n
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x406836
call fcn.0040b1d2
push eax
push 0x406836
push 0x407c48
pop esi
push dword [esi]
call dword [sym.imp.Kernel32.dll__lwrite]
push 0x406836
push str.__3___C:bkupXX_subdir__r_n
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x406836
call fcn.0040b1d2
push eax
push 0x406836
push 0x407c48
pop esi
push dword [esi]
call dword [sym.imp.Kernel32.dll__lwrite]
push 0x406836
push str.__4___C:bkupXXX_subdir__r_n
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x406836
call fcn.0040b1d2
push eax
push 0x406836
push 0x407c48
pop esi
push dword [esi]
call dword [sym.imp.Kernel32.dll__lwrite]
push 0x406836
push str._..___any_other_is_komment__r_n
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x406836
call fcn.0040b1d2
push eax
push 0x406836
push 0x407c48
pop esi
push dword [esi]
call dword [sym.imp.Kernel32.dll__lwrite]
push 0x406836
push 0x408290
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x406836
call fcn.0040b1d2
push eax
push 0x406836
push 0x407c48
pop esi
push dword [esi]
call dword [sym.imp.Kernel32.dll__lwrite]
push 0x406836
push str._7ZIP_or_BANDIZIP_or_WINRAR_call_to_zip_archive__r_n
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x406836
call fcn.0040b1d2
push eax
push 0x406836
push 0x407c48
pop esi
push dword [esi]
call dword [sym.imp.Kernel32.dll__lwrite]
push 0x407c48
pop esi
push dword [esi]
call dword [sym.imp.Kernel32.dll__lclose]
push 0x407c58
push 0x4082c8
push 0x4082da
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x4082e1
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
call fcn.00416c40
pop esi
mov dword [esi], eax
push 0x407c5c
push 0x4082e8
push 0x4082fa
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x408304
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
call fcn.00416c40
pop esi
mov dword [esi], eax
push 0x407c54
push 0x40830b
call fcn.00416c40
pop esi
mov dword [esi], eax
push 0x407c58
pop esi
push dword [esi]
push 0x407c5c
pop esi
push dword [esi]
pop ebx
pop eax
or eax, ebx
and eax, 1
push eax
push 0x407c54
pop esi
push dword [esi]
pop ebx
pop eax
or eax, ebx
and eax, 1
not eax
and eax, 1
or eax, eax
je 0x419261
push str.7zip_or_bandizip_or_winrar_not_found
push str.bkup
call fcn.0040dd1f
push 1
call dword [sym.imp.Kernel32.dll_ExitProcess]
push 0x407a3f
push 0x40783e
push 0x408355
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x406e39
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x408357
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x40763d
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x407c58
pop esi
push dword [esi]
pop eax
or eax, eax
je 0x419683
push 0x40703a
push 0x40723b
push 0x408359
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push str.7_Zip_
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push str.7z.exe
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x40723b
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x40703a
push 0x40703a
push 0x408379
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push str._r__tzip
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x40723b
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x407a3f
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x40723b
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 5
push 0x40703a
call dword [sym.imp.Kernel32.dll_WinExec]
push eax
push 0x20
pop ebx
pop eax
cmp eax, ebx
mov eax, 1
jbe 0x419646
xor eax, eax
or eax, eax
je 0x419667
push 0x10
push 0x408387
push 0x40703a
push 0
call dword [sym.imp.User32.dll_MessageBoxA]
jmp 0x419676
push 0x40703a
push str._bkup_7z_may_be_ok
call fcn.0040dd1f
push 0
call dword [sym.imp.Kernel32.dll_ExitProcess]
push 0x407c5c
pop esi
push dword [esi]
pop eax
or eax, eax
je 0x4199c3
push 0x40703a
push 0x40723b
push str.c:program_files_
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push str.Bandizip_
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push str.Bz.exe
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x40723b
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x40703a
push 0x40703a
push 0x4083cf
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x4083d3
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x40723b
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x407a3f
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x40723b
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push str._.
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 5
push 0x40703a
call dword [sym.imp.Kernel32.dll_WinExec]
push eax
push 0x20
pop ebx
pop eax
cmp eax, ebx
mov eax, 1
jbe 0x419986
xor eax, eax
or eax, eax
je 0x4199a7
push 0x10
push 0x4083dc
push 0x40703a
push 0
call dword [sym.imp.User32.dll_MessageBoxA]
jmp 0x4199b6
push 0x40703a
push str._bkup_Bandizip_may_be_ok
call fcn.0040dd1f
push 0
call dword [sym.imp.Kernel32.dll_ExitProcess]
push 0x407c54
pop esi
push dword [esi]
pop eax
or eax, eax
je 0x419d81
push 0x40703a
push 0x40723b
push str.c:program_fileswinrar_rar.exe
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x40723b
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 0x40703a
push 0x40703a
push str._a__r
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push str._logAF
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x40723b
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x407a3f
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x40723b
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push str..txt
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x40723b
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x407a3f
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push 0x40723b
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
push str..rar
mov esi, esp
push dword [esi]
call dword [sym.imp.Kernel32.dll_lstrlen]
push eax
push dword [esi + 4]
call dword [sym.imp.Kernel32.dll_lstrlen]
pop ebx
add eax, ebx
inc eax
push eax
push 0
call dword [sym.imp.Kernel32.dll_GlobalAlloc]
push eax
push dword [esi + 4]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcpy]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.Kernel32.dll_lstrcat]
pop eax
pop ebx
pop ebx
push eax
pop eax
pop esi
push 0x201
push eax
push esi
call dword [sym.imp.Kernel32.dll_lstrcpyn]
push 5
push 0x40703a
call dword [sym.imp.Kernel32.dll_WinExec]
push eax
push 0x20
pop ebx
pop eax
cmp eax, ebx
mov eax, 1
jbe 0x419d4c
xor eax, eax
or eax, eax
je 0x419d6d
push 0x10
push 0x408441
push 0x40703a
push 0
call dword [sym.imp.User32.dll_MessageBoxA]
jmp 0x419d7c
push 0x40703a
push str._bkup_RAR_may_be_ok
call fcn.0040dd1f
jmp 0x419d81
push 0
call dword [sym.imp.Kernel32.dll_ExitProcess]