Function at 0x4012d0
Capabilities:
Check if file exists
Delete file
Enumerate files on windows
Enumerate processes
Get common file path
Get file size
Move file
Query environment variable
Read file on windows
Terminate process
Terminate process by name
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x18684
call fcn.0040ac80
mov eax, dword [0x411034]
xor eax, esp
mov dword [esp + 0x18680], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
push str._silent
push edi
mov dword [esp + 0x20], edi
call fcn.00404163
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
add esp, 8
test eax, eax
je 0x401394
push str._silentnoiekill
push edi
call fcn.00404163
add esp, 8
test eax, eax
je 0x401394
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ecx, 0x412
cmp ax, cx
jne 0x401360
push str._uninstall
push edi
call fcn.00404163
add esp, 8
push 0x40001
push 0x40ebf7
test eax, eax
jne 0x401359
push 0x40ec28
jmp 0x40136f
push 0x40ec80
jmp 0x40136f
push 0x40001
push 0x40ebf7
push str.All_browsers_should_be_shut_down._When_you_click_OK__All_browsers_should_be_closed.
push 0
call esi
cmp eax, 1
je 0x401394
mov eax, 0xffffff9c
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18680]
xor ecx, esp
call fcn.00403998
mov esp, ebp
pop ebp
ret 0x10
call fcn.004038c0
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.c:Program_FilesTerutenWebCubeAgentCubeU_.exe
call esi
push str.c:Program_FilesTerutenWebCubeAgentCubeU64_.exe
call esi
push str.c:Program_FilesTerutenWebCubeAgentCubeU64A_.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU_.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64_.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64A_.exe
call esi
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.c:Program_FilesTerutenWebCubeAgentCubeU_.exe
push str.c:Program_FilesTerutenWebCubeAgentCubeU.exe
call esi
push str.c:Program_FilesTerutenWebCubeAgentCubeU64_.exe
push str.c:Program_FilesTerutenWebCubeAgentCubeU64.exe
call esi
push str.c:Program_FilesTerutenWebCubeAgentCubeU64A_.exe
push str.c:Program_FilesTerutenWebCubeAgentCubeU64A.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU_.exe
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64_.exe
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64A_.exe
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64A.exe
call esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0x10], esi
cmp esi, 0xffffffff
jne 0x401445
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18680]
xor ecx, esp
call fcn.00403998
mov esp, ebp
pop ebp
ret 0x10
lea edx, [esp + 0x28]
push edx
push esi
mov dword [esp + 0x30], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x401480
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18680]
xor ecx, esp
call fcn.00403998
mov esp, ebp
pop ebp
ret 0x10
lea eax, [esp + 0x4c]
mov dword [esp + 0x2c0], 0xf
mov dword [esp + 0x2bc], 0
mov byte [esp + 0x2ac], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4014a5
sub eax, edx
push eax
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x2b0]
call fcn.004031d0
mov edx, dword [esp + 0x2c0]
mov ecx, dword [esp + 0x2ac]
cmp edx, 0x10
jb 0x401d3e
mov dword [esp + 0xc], ecx
test ecx, ecx
je 0x401510
mov eax, ecx
cmp edx, 0x10
jae 0x4014ed
lea eax, [esp + 0x2ac]
cmp eax, dword [esp + 0xc]
ja 0x401510
mov eax, ecx
cmp edx, 0x10
jae 0x401501
lea eax, [esp + 0x2ac]
mov ebx, dword [esp + 0x2bc]
add eax, ebx
cmp dword [esp + 0xc], eax
jbe 0x40152a
call fcn.00403ec9
mov edx, dword [esp + 0x2c0]
mov ebx, dword [esp + 0x2bc]
mov ecx, dword [esp + 0x2ac]
mov eax, ecx
cmp edx, 0x10
jae 0x401538
lea eax, [esp + 0x2ac]
lea edi, [ebx + eax]
test edi, edi
je 0x401565
mov eax, ecx
cmp edx, 0x10
jae 0x40154d
lea eax, [esp + 0x2ac]
cmp eax, edi
ja 0x401565
mov eax, ecx
cmp edx, 0x10
jae 0x40155f
lea eax, [esp + 0x2ac]
add eax, ebx
cmp edi, eax
jbe 0x40157f
call fcn.00403ec9
mov edx, dword [esp + 0x2c0]
mov ebx, dword [esp + 0x2bc]
mov ecx, dword [esp + 0x2ac]
cmp edx, 0x10
jb 0x401d4e
mov esi, ecx
test ecx, ecx
je 0x4015b4
mov eax, ecx
cmp edx, 0x10
jae 0x40159c
lea eax, [esp + 0x2ac]
cmp eax, esi
ja 0x4015b4
mov eax, ecx
cmp edx, 0x10
jae 0x4015ae
lea eax, [esp + 0x2ac]
add ebx, eax
cmp esi, ebx
jbe 0x4015b9
call fcn.00403ec9
mov ecx, dword [esp + 0xc]
push ecx
lea eax, [esp + 0x2ac]
push eax
mov eax, dword [esp + 0x298]
mov byte [esp + 0x28], 0
mov edx, dword [esp + 0x28]
push edx
push eax
push edi
lea ecx, [esp + 0x2a4]
push esi
push ecx
call fcn.00403830
add esp, 0x1c
push 0xf
push str.tuctlsystem.exe
lea edx, [esp + 0x2b0]
push edx
call fcn.004032e0
cmp eax, 0xffffffff
je 0x401624
mov eax, dword [esp + 0x30]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x2c0], 0x10
jb 0x40163e
mov ecx, dword [esp + 0x2ac]
push ecx
call fcn.00403ac9
add esp, 4
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x28]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401480
push eax
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0x10], esi
cmp esi, 0xffffffff
je 0x40142b
lea ecx, [esp + 0x28]
push ecx
push esi
mov dword [esp + 0x30], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40145c
jmp 0x401690
lea eax, [esp + 0x4c]
mov dword [esp + 0x2c0], 0xf
mov dword [esp + 0x2bc], 0
mov byte [esp + 0x2ac], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4016b5
sub eax, edx
push eax
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x2b0]
call fcn.004031d0
mov edx, dword [esp + 0x2c0]
mov ecx, dword [esp + 0x2ac]
cmp edx, 0x10
jb 0x401d5a
mov dword [esp + 0xc], ecx
test ecx, ecx
je 0x401720
mov eax, ecx
cmp edx, 0x10
jae 0x4016fd
lea eax, [esp + 0x2ac]
cmp eax, dword [esp + 0xc]
ja 0x401720
mov eax, ecx
cmp edx, 0x10
jae 0x401711
lea eax, [esp + 0x2ac]
mov ebx, dword [esp + 0x2bc]
add eax, ebx
cmp dword [esp + 0xc], eax
jbe 0x40173a
call fcn.00403ec9
mov edx, dword [esp + 0x2c0]
mov ebx, dword [esp + 0x2bc]
mov ecx, dword [esp + 0x2ac]
mov eax, ecx
cmp edx, 0x10
jae 0x401748
lea eax, [esp + 0x2ac]
lea edi, [eax + ebx]
test edi, edi
je 0x401775
mov eax, ecx
cmp edx, 0x10
jae 0x40175d
lea eax, [esp + 0x2ac]
cmp eax, edi
ja 0x401775
mov eax, ecx
cmp edx, 0x10
jae 0x40176f
lea eax, [esp + 0x2ac]
add eax, ebx
cmp edi, eax
jbe 0x40178f
call fcn.00403ec9
mov edx, dword [esp + 0x2c0]
mov ebx, dword [esp + 0x2bc]
mov ecx, dword [esp + 0x2ac]
cmp edx, 0x10
jb 0x401d6a
mov esi, ecx
test ecx, ecx
je 0x4017c4
mov eax, ecx
cmp edx, 0x10
jae 0x4017ac
lea eax, [esp + 0x2ac]
cmp eax, esi
ja 0x4017c4
mov eax, ecx
cmp edx, 0x10
jae 0x4017be
lea eax, [esp + 0x2ac]
add eax, ebx
cmp esi, eax
jbe 0x4017c9
call fcn.00403ec9
mov ecx, dword [esp + 0xc]
push ecx
lea eax, [esp + 0x2ac]
push eax
mov eax, dword [esp + 0x298]
mov byte [esp + 0x28], 0
mov edx, dword [esp + 0x28]
push edx
push eax
push edi
lea ecx, [esp + 0x2a4]
push esi
push ecx
call fcn.00403830
add esp, 0x1c
push 0xa
push str.chrome.exe
lea edx, [esp + 0x2b0]
push edx
call fcn.004032e0
cmp eax, 0xffffffff
jne 0x401aa3
push 0xb
push str.firefox.exe
lea eax, [esp + 0x2b0]
push eax
call fcn.004032e0
cmp eax, 0xffffffff
jne 0x401aa3
push 9
push str.opera.exe
lea ecx, [esp + 0x2b0]
push ecx
call fcn.004032e0
cmp eax, 0xffffffff
jne 0x401aa3
push 0xa
push str.safari.exe
lea edx, [esp + 0x2b0]
push edx
call fcn.004032e0
cmp eax, 0xffffffff
jne 0x401aa3
lea eax, [esp + 0x2a8]
push eax
mov edx, str.cubee.exe
call fcn.004031b0
cmp eax, 0xffffffff
jne 0x401aa3
lea ecx, [esp + 0x2a8]
push ecx
mov edx, str.cubeu.exe
call fcn.004031b0
cmp eax, 0xffffffff
jne 0x401aa3
lea edx, [esp + 0x2a8]
push edx
mov edx, str.cubeu64.exe
call fcn.004031b0
cmp eax, 0xffffffff
jne 0x401aa3
lea eax, [esp + 0x2a8]
push eax
mov edx, str.cubeu64a.exe
call fcn.004031b0
cmp eax, 0xffffffff
jne 0x401aa3
lea ecx, [esp + 0x2a8]
push ecx
mov edx, str.iexplore.exe
call fcn.004031b0
cmp eax, 0xffffffff
je 0x40190b
mov edx, dword [esp + 0x18]
push str._silentnoiekill
push edx
call fcn.00404163
add esp, 8
test eax, eax
jne 0x401aa3
lea eax, [esp + 0x2a8]
push eax
mov edx, str.tmw.exe
call fcn.004031b0
cmp eax, 0xffffffff
jne 0x401aa3
lea ecx, [esp + 0x2a8]
push ecx
mov edx, str.tmw64a.exe
call fcn.004031b0
cmp eax, 0xffffffff
jne 0x401aa3
lea edx, [esp + 0x2a8]
push edx
mov edx, str.tmw64.exe
call fcn.004031b0
cmp eax, 0xffffffff
jne 0x401aa3
lea eax, [esp + 0x2a8]
push eax
mov edx, str.webcubeagent.exe
call fcn.004031b0
cmp eax, 0xffffffff
jne 0x401aa3
lea ecx, [esp + 0x2a8]
push ecx
mov edx, str.turound.exe
call fcn.004031b0
cmp eax, 0xffffffff
jne 0x401aa3
lea edx, [esp + 0x2a8]
push edx
mov edx, str.turound64.exe
call fcn.004031b0
cmp eax, 0xffffffff
jne 0x401aa3
lea eax, [esp + 0x2a8]
push eax
mov edx, str.turound64a.exe
call fcn.004031b0
cmp eax, 0xffffffff
jne 0x401aa3
lea ecx, [esp + 0x2a8]
push ecx
mov edx, str.texe.exe
call fcn.004031b0
cmp eax, 0xffffffff
jne 0x401aa3
lea edx, [esp + 0x2a8]
push edx
mov edx, str.texe64.exe
call fcn.004031b0
cmp eax, 0xffffffff
jne 0x401aa3
lea eax, [esp + 0x2a8]
push eax
mov edx, str.texe64a.exe
call fcn.004031b0
cmp eax, 0xffffffff
jne 0x401aa3
lea ecx, [esp + 0x2a8]
push ecx
mov edx, str.tremote_server.exe
call fcn.004031b0
cmp eax, 0xffffffff
jne 0x401aa3
lea edx, [esp + 0x2a8]
push edx
mov edx, str.microsoftedge.exe
call fcn.004031b0
cmp eax, 0xffffffff
jne 0x401aa3
lea eax, [esp + 0x2a8]
push eax
mov edx, str.microsoftedgecp.exe
call fcn.004031b0
cmp eax, 0xffffffff
jne 0x401aa3
lea ecx, [esp + 0x2a8]
push ecx
mov edx, str.w_browser.exe
call fcn.004031b0
cmp eax, 0xffffffff
jne 0x401aa3
lea edx, [esp + 0x2a8]
push edx
mov edx, str.msedge.exe
call fcn.004031b0
cmp eax, 0xffffffff
jne 0x401aa3
lea eax, [esp + 0x2a8]
push eax
mov edx, str.whale.exe
call fcn.004031b0
cmp eax, 0xffffffff
je 0x401ac4
mov ecx, dword [esp + 0x30]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x2c0], 0x10
jb 0x401ade
mov edx, dword [esp + 0x2ac]
push edx
call fcn.00403ac9
add esp, 4
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x28]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401690
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.c:Program_FilesTerutenWebCubeAgentCubeU_.exe
call esi
push str.c:Program_FilesTerutenWebCubeAgentCubeU64_.exe
call esi
push str.c:Program_FilesTerutenWebCubeAgentCubeU64A_.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU_.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64_.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64A_.exe
call esi
push 0x103
lea eax, [esp + 0x585]
push 0
push eax
mov byte [esp + 0x58c], 0
call fcn.00404770
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
add esp, 0xc
push 0
push 0x1c
lea ecx, [esp + 0x588]
push ecx
push 0
call esi
push str.MicrosoftInternet_ExplorerRecovery
lea edx, [esp + 0x584]
push 0x104
push edx
call fcn.00403f41
lea eax, [esp + 0x58c]
add esp, 0xc
push eax
call fcn.00401160
add esp, 4
push 0
push 0x1c
lea ecx, [esp + 0x690]
push ecx
push 0
call esi
push str.GoogleChromeUser_DataDefaultPreferences
lea edx, [esp + 0x68c]
push 0x7fff
push edx
call fcn.00403f41
add esp, 0xc
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x6a0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x401d92
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
add ebx, 0x3e8
push ebx
call fcn.0040430a
add esp, 4
push 0
lea ecx, [esp + 0x14]
push ecx
push ebx
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x10]
push edx
push esi
mov edx, str.exit_type
call fcn.004010c0
mov ebx, eax
mov eax, dword [esp + 0x18]
push eax
push esi
mov edx, str._exit_type_:_Crashed_
call fcn.004010c0
add esp, 0x10
cmp eax, 0xffffffff
je 0x401d76
mov ecx, dword [esp + 0x10]
sub ecx, ebx
push ecx
lea edx, [ebx + esi]
push edx
mov edx, str._exit_type_:_Crashed_
call fcn.004010c0
mov edx, dword [0x40f1ac]
mov ecx, dword [0x40f1a8]
add esp, 8
add ebx, eax
mov eax, dword [str._exit_type_:_Normal_]
mov dword [esp + 0x290], eax
mov eax, dword [0x40f1b0]
mov dword [esp + 0x298], edx
mov dl, byte [0x40f1b8]
mov dword [esp + 0x294], ecx
mov ecx, dword [0x40f1b4]
mov dword [esp + 0x29c], eax
lea eax, [esp + 0x290]
mov byte [esp + 0x2a4], dl
mov dword [esp + 0x2a0], ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401cb8
sub eax, edx
mov ecx, eax
lea eax, [ebx + 1]
cmp eax, dword [esp + 0x10]
jge 0x401cde
lea esp, [esp]
mov dl, byte [eax + esi]
mov byte [eax + esi - 1], dl
inc eax
cmp eax, dword [esp + 0x10]
jl 0x401cd0
mov byte [eax + esi - 1], 0
push ecx
lea eax, [esp + 0x294]
push eax
add ebx, esi
push ebx
call fcn.004047f0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
push edi
call ebx
push 0
push 0
push 5
push 0
push 0
push 0x40000000
lea ecx, [esp + 0x6a0]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x401d7d
mov eax, dword [esp + 0x10]
push 0
lea edx, [esp + 0x14]
push edx
dec eax
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call ebx
jmp 0x401d7d
lea eax, [esp + 0x2ac]
mov dword [esp + 0xc], eax
jmp 0x4014df
lea esi, [esp + 0x2ac]
jmp 0x40158e
lea eax, [esp + 0x2ac]
mov dword [esp + 0xc], eax
jmp 0x4016ef
lea esi, [esp + 0x2ac]
jmp 0x40179e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.00403c0d
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
add esp, 4
push 0
push 0x1c
lea ecx, [esp + 0x2f8]
push ecx
push 0
call esi
push str.GoogleChromeUser_DataDefaultCurrent_Session
lea edx, [esp + 0x2f4]
push 0x104
push edx
call fcn.00403f41
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
lea eax, [esp + 0x2f0]
push eax
call edi
push 0x40ebf7
lea ecx, [esp + 0x2f4]
push 0x104
push ecx
call fcn.00403ed9
add esp, 0xc
push 0
push 0x1c
lea edx, [esp + 0x2f8]
push edx
push 0
call esi
push str.GoogleChromeUser_DataDefaultCookies
lea eax, [esp + 0x2f4]
push 0x104
push eax
call fcn.00403f41
add esp, 0xc
lea ecx, [esp + 0x2f0]
push ecx
call edi
xor edi, edi
lea esp, [esp]
lea edx, [esp + 0x3f8]
push edx
lea eax, [esp + 0x2f4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x401e5d
push 0x12c
call ebx
lea ecx, [esp + 0x2f0]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x12c
call ebx
inc edi
cmp edi, 5
jl 0x401e20
mov edx, dword [esp + 0x18]
push str._uninstall
push edx
call fcn.00404163
add esp, 8
test eax, eax
je 0x403143
push 0
push 0x1c
lea eax, [esp + 0x690]
push eax
push 0
call esi
push str.GoogleChromeUser_DataLocal_State
lea ecx, [esp + 0x68c]
push 0x7fff
push ecx
call fcn.00403f41
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
add esp, 0xc
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea edx, [esp + 0x6a0]
push edx
call edi
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x402122
push 0
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
add esi, 0x3e8
push esi
call fcn.0040430a
add esp, 4
push 0
mov ebx, eax
lea eax, [esp + 0x10]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [esp + 0xc]
push edi
push ebx
mov edx, str.protocol_handler
call fcn.004010c0
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
jne 0x401f6e
mov ecx, 0x10
mov esi, str._protocol_handler_:___excluded_schemes_:___webcube_:false___
lea edi, [esp + 0x2a8]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x2a8]
movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401f33
sub eax, edx
mov edi, eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], edi
cmp eax, 1
jb 0x401f5c
lea esi, [edi + ebx]
mov edi, edi
mov cl, byte [eax + ebx]
mov byte [esi + eax], cl
dec eax
cmp eax, 1
jae 0x401f50
push edi
lea edx, [esp + 0x2ac]
push edx
lea eax, [ebx + 1]
push eax
jmp 0x4020bd
mov eax, edi
sub eax, esi
lea ecx, [esi + ebx]
push eax
push ecx
mov edx, str._webcube_:true
mov dword [esp + 0x20], eax
call fcn.004010c0
mov ecx, dword [esp + 0x20]
add esp, 8
cmp eax, 0xffffffff
push ecx
lea eax, [esi + ebx]
push eax
je 0x40201d
call fcn.004010c0
mov edx, dword [str._webcube_:false]
mov ecx, dword [0x40f2b4]
add esp, 8
add esi, eax
mov eax, dword [0x40f2b0]
mov dword [esp + 0x290], edx
mov edx, dword [0x40f2b8]
mov dword [esp + 0x294], eax
lea eax, [esp + 0x290]
mov dword [esp + 0x29c], edx
mov dword [esp + 0x298], ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401fe1
sub eax, edx
cmp edi, esi
jle 0x401fff
lea ecx, [edi + ebx + 1]
sub edi, esi
mov dl, byte [ecx - 1]
mov byte [ecx], dl
dec ecx
sub edi, 1
jne 0x401ff4
push eax
lea eax, [esp + 0x294]
push eax
add esi, ebx
push esi
call fcn.004047f0
mov dword [esp + 0x20], 1
jmp 0x4020c2
mov edx, str.excluded_schemes
call fcn.004010c0
add esi, eax
add esp, 8
cmp byte [esi + ebx], 0x7b
je 0x402039
inc esi
cmp byte [esi + ebx], 0x7b
jne 0x402032
mov eax, dword [0x40f2d4]
mov edx, dword [str._webcube_:false_]
mov ecx, dword [0x40f2d8]
mov dword [esp + 0x294], eax
mov al, byte [0x40f2e0]
mov dword [esp + 0x290], edx
mov edx, dword [0x40f2dc]
mov byte [esp + 0x2a0], al
lea eax, [esp + 0x290]
mov dword [esp + 0x29c], edx
mov dword [esp + 0x298], ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402082
sub eax, edx
cmp edi, esi
mov ecx, eax
mov dword [esp + 0x14], ecx
mov eax, edi
jle 0x4020ab
lea edi, [ecx + ebx]
lea ebx, [ebx]
mov cl, byte [eax + ebx]
mov byte [edi + eax], cl
dec eax
cmp eax, esi
jg 0x4020a0
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x294]
push eax
lea ecx, [esi + ebx + 1]
push ecx
call fcn.004047f0
mov edx, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
push edx
call edi
push 0
push 0
push 5
push 0
push 0
push 0x40000000
lea eax, [esp + 0x6a0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x402113
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x10]
push ecx
add eax, edx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call edi
push ebx
call fcn.00403c0d
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
add esp, 4
push 0x7fff
lea ecx, [esp + 0x68c]
push ecx
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push str.Opera_SoftwareOpera_StableLocal_State
lea edx, [esp + 0x68c]
push 0x7fff
push edx
call fcn.00403f41
add esp, 0xc
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea eax, [esp + 0x6a0]
push eax
call edi
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x4023ea
push 0
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
add esi, 0x3e8
push esi
call fcn.0040430a
add esp, 4
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
mov ebx, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [esp + 0xc]
push edi
push ebx
mov edx, str.protocol_handler
call fcn.004010c0
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
jne 0x40221c
mov ecx, 0x10
mov esi, str._protocol_handler_:___excluded_schemes_:___webcube_:_false___
lea edi, [esp + 0x2a8]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x2a8]
movsw word es:[edi], word [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4021e1
sub eax, edx
mov edi, eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], edi
cmp eax, 1
jb 0x40220c
lea esi, [edi + ebx]
lea esp, [esp]
mov dl, byte [eax + ebx]
mov byte [esi + eax], dl
dec eax
cmp eax, 1
jae 0x402200
push edi
lea eax, [esp + 0x2ac]
lea ecx, [ebx + 1]
jmp 0x402383
mov eax, edi
sub eax, esi
lea ecx, [esi + ebx]
push eax
push ecx
mov edx, str._webcube_:_true
mov dword [esp + 0x20], eax
call fcn.004010c0
add esp, 8
cmp eax, 0xffffffff
lea eax, [esi + ebx]
je 0x4022dc
mov edx, dword [esp + 0x18]
push edx
push eax
mov edx, str._webcube_:_true
call fcn.004010c0
mov ecx, dword [0x40f370]
mov edx, dword [0x40f374]
add esp, 8
add esi, eax
mov eax, dword [str._webcube_:_false]
mov dword [esp + 0x290], eax
mov eax, dword [0x40f378]
mov dword [esp + 0x294], ecx
mov cl, byte [0x40f37c]
mov dword [esp + 0x29c], eax
lea eax, [esp + 0x290]
mov dword [esp + 0x298], edx
mov byte [esp + 0x2a0], cl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4022a0
sub eax, edx
cmp edi, esi
jle 0x4022be
lea ecx, [edi + ebx + 1]
sub edi, esi
mov dl, byte [ecx - 1]
mov byte [ecx], dl
dec ecx
sub edi, 1
jne 0x4022b3
push eax
lea eax, [esp + 0x294]
push eax
add esi, ebx
push esi
call fcn.004047f0
mov dword [esp + 0x20], 1
jmp 0x40238a
mov ecx, dword [esp + 0x18]
push ecx
push eax
mov edx, str.excluded_schemes
call fcn.004010c0
add esi, eax
add esp, 8
cmp byte [esi + ebx], 0x7b
je 0x4022fe
inc esi
cmp byte [esi + ebx], 0x7b
jne 0x4022f7
mov eax, dword [0x40f384]
mov edx, dword [str._webcube_:_false_]
mov ecx, dword [0x40f388]
mov dword [esp + 0x294], eax
mov ax, word [0x40f390]
mov dword [esp + 0x290], edx
mov edx, dword [0x40f38c]
mov word [esp + 0x2a0], ax
lea eax, [esp + 0x290]
mov dword [esp + 0x29c], edx
mov dword [esp + 0x298], ecx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402350
sub eax, edx
cmp edi, esi
mov ecx, eax
mov dword [esp + 0x14], ecx
mov eax, edi
jle 0x402373
lea edi, [ecx + ebx]
mov cl, byte [eax + ebx]
mov byte [edi + eax], cl
dec eax
cmp eax, esi
jg 0x402368
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x294]
lea ecx, [esi + ebx + 1]
push eax
push ecx
call fcn.004047f0
mov edx, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
push edx
call edi
push 0
push 0
push 5
push 0
push 0
push 0x40000000
lea eax, [esp + 0x6a0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4023db
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x10]
push ecx
add eax, edx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call edi
push ebx
call fcn.00403c0d
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
add esp, 4
push 0x7fff
lea ecx, [esp + 0x68c]
push ecx
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push str.MozillaFirefoxProfilesdefault
lea edx, [esp + 0x68c]
push 0x7fff
push edx
call fcn.00403f41
add esp, 0xc
lea eax, [esp + 0x150]
push eax
lea ecx, [esp + 0x68c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40264e
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x688]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402450
sub eax, edx
cmp byte [esp + eax + 0x687], 0x5c
je 0x402477
lea ecx, [esp + 0x688]
dec ecx
jmp 0x402470
dec eax
cmp byte [ecx + eax], 0x5c
jne 0x402470
lea edx, [esp + 0x17c]
push edx
mov ecx, 0x7fff
sub ecx, eax
push ecx
lea edx, [esp + eax + 0x690]
push edx
call fcn.00403ed9
add esp, 0xc
push str.mimeTypes.rdf
lea eax, [esp + 0x68c]
push 0x7fff
push eax
call fcn.00403f41
add esp, 0xc
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea ecx, [esp + 0x6a0]
push ecx
call edi
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x40264e
push 0
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
add ebx, 0x3e8
push ebx
call fcn.0040430a
add esp, 4
push 0
lea edx, [esp + 0x10]
push edx
mov esi, eax
push ebx
push esi
push edi
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0xc]
push eax
push esi
mov edx, str._RDF:Description
call fcn.004010c0
add esp, 8
cmp eax, 0xffffffff
jne 0x40258e
mov ecx, 0x61
mov esi, str.__xml_version_1.0____RDF:RDF_xmlns:NC_http:__home.netscape.com_NC_rdf__xmlns:RDF_http:__www.w3.org_1999_02_22_rdf_syntax_ns___RDF:Description_RDF:about_urn:scheme:webcube__NC:value_webcube___NC:handlerProp_RDF:resource_urn:scheme:handler:webcube_____RDF:Description__RDF:Description_RDF:about_urn:scheme:handler:webcube__NC:useSystemDefault_true__NC:alwaysAsk_false______RDF:RDF_
lea edi, [esp + 0x3f8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [esp + 0x3f8]
movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402541
sub eax, edx
mov edi, eax
lea esi, [edi + 1]
cmp ebx, esi
jae 0x40256d
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00403c0d
add esp, 4
push esi
call fcn.0040430a
add esp, 4
mov ebx, eax
jmp 0x402571
mov ebx, dword [esp + 0x14]
lea edx, [esp + 0x3f8]
push edx
push esi
push ebx
mov dword [esp + 0x18], 0
call fcn.00403ed9
mov byte [edi + ebx], 0
jmp 0x4025f0
mov ecx, 0x3e
mov esi, str._RDF:Description_RDF:about_urn:scheme:webcube__NC:value_webcube___NC:handlerProp_RDF:resource_urn:scheme:handler:webcube_____RDF:Description__RDF:Description_RDF:about_urn:scheme:handler:webcube__NC:useSystemDefault_true__NC:alwaysAsk_false____
lea edi, [esp + 0x3f8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ecx, [esp + 0x3f8]
movsb byte es:[edi], byte [esi]
lea esi, [ecx + 1]
mov edi, edi
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4025b0
sub ecx, esi
mov esi, dword [esp + 0x14]
mov edi, ecx
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jl 0x4025db
lea edx, [edi + esi]
lea ebx, [ebx]
mov bl, byte [ecx + esi]
mov byte [ecx + edx], bl
dec ecx
cmp ecx, eax
jge 0x4025d0
push edi
lea ecx, [esp + 0x3fc]
push ecx
add eax, esi
push eax
call fcn.004047f0
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
add esp, 0xc
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 5
push 0
push 0
push 0x40000000
lea eax, [esp + 0x6a0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40263f
mov edx, dword [esp + 0xc]
push 0
lea ecx, [esp + 0x10]
push ecx
add edi, edx
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.00403c0d
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
add esp, 4
push 0x7fff
lea eax, [esp + 0x868c]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push str.MozillaFirefoxProfilesdefault
lea ecx, [esp + 0x868c]
push 0x7fff
push ecx
call fcn.00403f41
add esp, 0xc
lea edx, [esp + 0x150]
push edx
lea eax, [esp + 0x868c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
je 0x4028e3
lea ebx, [esp + 0x8688]
dec ebx
mov dword [esp + 0x18], ebx
nop
push 0x7fff
lea ecx, [esp + 0x1068d]
push 0
push ecx
mov byte [esp + 0x10694], 0
call fcn.00404770
lea esi, [esp + 0x8694]
add esp, 0xc
lea ecx, [esi + 1]
lea esp, [esp]
mov al, byte [esi]
inc esi
test al, al
jne 0x4026e0
sub esi, ecx
cmp byte [ebx + esi], 0x5c
je 0x4026f7
nop
dec esi
cmp byte [ebx + esi], 0x5c
jne 0x4026f0
lea edx, [esp + 0x8688]
push edx
lea eax, [esp + 0x1068c]
push 0x7fff
push eax
call fcn.00403ed9
add esp, 0xc
lea ecx, [esp + 0x17c]
push ecx
mov edx, 0x7fff
sub edx, esi
push edx
lea eax, [esp + esi + 0x10690]
push eax
call fcn.00403ed9
add esp, 0xc
push str.cert_override.txt
lea ecx, [esp + 0x1068c]
push 0x7fff
push ecx
call fcn.00403f41
add esp, 0xc
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea edx, [esp + 0x106a0]
push edx
call edi
mov esi, eax
mov dword [esp + 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x402797
push 0
push 0
push 1
push 0
push 0
push 0x40000000
lea eax, [esp + 0x106a0]
push eax
call edi
mov esi, eax
mov dword [esp + 0x10], eax
cmp esi, 0xffffffff
je 0x4028c8
mov edi, dword [esp + 0x10]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
add esi, 0x3e8
push esi
mov dword [esp + 0x24], esi
call fcn.0040430a
add esp, 4
push 0
lea ecx, [esp + 0x18]
push ecx
push esi
mov ebx, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x14]
mov byte [edx + ebx], 0
mov eax, dword [esp + 0x14]
mov ecx, 0x53
mov esi, str._r_n127.0.0.1:4568_tOID.2.16.840.1.101.3.4.2.1_tB1:09:04:20:17:5C:7E:B3:DF:2B:BC:BE:E5:47:3C:B5:96:D6:38:DD:A1:E3:9F:ED:29:C8:CA:EA:2A:C1:F5:89_tU_tAAAAAAAAAAAAAAAJAAAAdgD39_8l_kErOzB0MQswCQYDVQQGEwJLUjEOMAwGA1UECAwFU2VvdWwxDjAMBgNVBAcMBVNlb3VsMRAwDgYDVQQKDAdUZXJ1dGVuMRIwEAYDVQQDDAkxMjcuMC4wLjExHzAdBgkqhkiG9w0BCQEWEGN1YmVAdGVydXRlbi5jb20
lea edi, [esp + 0x3f8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push eax
push ebx
lea edx, [esp + 0x400]
movsb byte es:[edi], byte [esi]
call fcn.004010c0
add esp, 8
cmp eax, 0xffffffff
jne 0x4028aa
mov edi, edx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x402815
mov esi, dword [esp + 0x20]
sub edi, ecx
lea ecx, [edi + 1]
cmp esi, ecx
jae 0x402845
push ebx
call fcn.00403c0d
mov edx, dword [esp + 0x18]
lea eax, [edi + edx + 1]
add esp, 4
push eax
call fcn.0040430a
add esp, 4
mov ebx, eax
lea ecx, [esp + 0x3f8]
push ecx
push esi
push ebx
call fcn.00403f41
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea eax, [edi + edx]
push ecx
mov byte [eax + ebx], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 5
push 0
push 0
push 0x40000000
lea edx, [esp + 0x106a0]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4028b5
mov ecx, dword [esp + 0x14]
push 0
lea eax, [esp + 0x18]
push eax
add edi, ecx
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
jmp 0x4028af
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.00403c0d
mov ebx, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
add esp, 4
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x150]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4026b0
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x7fff
lea eax, [esp + 0x868c]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push str.MozillaFirefoxProfilesdefault
lea ecx, [esp + 0x868c]
push 0x7fff
push ecx
call fcn.00403f41
add esp, 0xc
lea edx, [esp + 0x150]
push edx
lea eax, [esp + 0x868c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
je 0x402b3c
lea eax, [esp + 0x8688]
dec eax
mov dword [esp + 0x18], eax
nop
push 0x7fff
lea ecx, [esp + 0x1068d]
push 0
push ecx
mov byte [esp + 0x10694], 0
call fcn.00404770
lea esi, [esp + 0x8694]
add esp, 0xc
lea ecx, [esi + 1]
lea esp, [esp]
mov al, byte [esi]
inc esi
test al, al
jne 0x402980
mov eax, dword [esp + 0x18]
sub esi, ecx
cmp byte [eax + esi], 0x5c
je 0x40299a
dec esi
cmp byte [eax + esi], 0x5c
jne 0x402993
lea edx, [esp + 0x8688]
push edx
lea eax, [esp + 0x1068c]
push 0x7fff
push eax
call fcn.00403ed9
add esp, 0xc
lea ecx, [esp + 0x17c]
push ecx
mov edx, 0x7fff
sub edx, esi
push edx
lea eax, [esp + esi + 0x10690]
push eax
call fcn.00403ed9
add esp, 0xc
push str.prefs.js
lea ecx, [esp + 0x1068c]
push 0x7fff
push ecx
call fcn.00403f41
add esp, 0xc
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea edx, [esp + 0x106a0]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402b21
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
add esi, 0x3e8
push esi
call fcn.0040430a
add esp, 4
mov edi, eax
push 0
lea eax, [esp + 0x14]
push eax
push esi
push edi
push ebx
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov byte [ecx + edi], 0
mov edx, dword [esp + 0x10]
mov ecx, 0xb
mov esi, str.user_pref__privacy.cpd.siteSettings___true__
lea edi, [esp + 0x2a8]
rep movsd dword es:[edi], dword [esi]
push edx
push eax
lea edx, [esp + 0x2b0]
movsb byte es:[edi], byte [esi]
call fcn.004010c0
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
je 0x402b0d
mov eax, edx
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402a90
sub eax, edx
push ebx
mov dword [esp + 0x294], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 5
push 0
push 0
push 0x40000000
lea ecx, [esp + 0x106a0]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x402b14
mov eax, dword [esp + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [esp + 0x24]
push edx
push edi
push eax
push esi
mov dword [esp + 0x34], 0
call ebx
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x290]
push 0
sub edx, eax
lea ecx, [esp + 0x24]
push ecx
add eax, edi
add eax, dword [esp + 0x1c]
sub edx, edi
push edx
push eax
push esi
call ebx
push esi
jmp 0x402b0e
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
push eax
call fcn.00403c0d
add esp, 4
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x150]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402950
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push str.c:Program_FilesTerutenWebCubeAgentCubeU.exe
call esi
test eax, eax
jne 0x402b93
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU.exe
call esi
test eax, eax
jne 0x402b93
push str.c:Program_FilesTerutenWebCubeAgentCubeU64.exe
call esi
test eax, eax
jne 0x402b93
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64.exe
call esi
test eax, eax
jne 0x402b93
push str.c:Program_FilesTerutenWebCubeAgentCubeU64A.exe
call esi
test eax, eax
jne 0x402b93
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64A.exe
call esi
test eax, eax
je 0x403143
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.c:Program_FilesTerutenWebCubeAgentCubeU_.exe
call esi
push str.c:Program_FilesTerutenWebCubeAgentCubeU64_.exe
call esi
push str.c:Program_FilesTerutenWebCubeAgentCubeU64A_.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU_.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64_.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64A_.exe
call esi
push str.c:Program_FilesTerutenWebCubeAgentCubeU_.exe
push str.c:Program_FilesTerutenWebCubeAgentCubeU.exe
call fcn.004043d4
push str.c:Program_FilesTerutenWebCubeAgentCubeU64_.exe
push str.c:Program_FilesTerutenWebCubeAgentCubeU64.exe
call fcn.004043d4
push str.c:Program_FilesTerutenWebCubeAgentCubeU64A_.exe
push str.c:Program_FilesTerutenWebCubeAgentCubeU64A.exe
call fcn.004043d4
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU_.exe
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU.exe
call fcn.004043d4
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64_.exe
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64.exe
call fcn.004043d4
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64A_.exe
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64A.exe
call fcn.004043d4
add esp, 0x30
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0x10], esi
cmp esi, 0xffffffff
je 0x40142b
lea ecx, [esp + 0x28]
push ecx
push esi
mov dword [esp + 0x30], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40145c
jmp 0x402c60
lea eax, [esp + 0x4c]
mov dword [esp + 0x2c0], 0xf
mov dword [esp + 0x2bc], 0
mov byte [esp + 0x2ac], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402c85
sub eax, edx
push eax
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x2b0]
call fcn.004031d0
mov edx, dword [esp + 0x2c0]
mov ecx, dword [esp + 0x2ac]
cmp edx, 0x10
jb 0x402e91
mov esi, ecx
mov dword [esp + 0x20], esi
test ecx, ecx
je 0x402cee
mov eax, ecx
cmp edx, 0x10
jae 0x402ccf
lea eax, [esp + 0x2ac]
cmp eax, esi
ja 0x402cee
mov eax, ecx
cmp edx, 0x10
jae 0x402ce1
lea eax, [esp + 0x2ac]
mov ebx, dword [esp + 0x2bc]
add eax, ebx
cmp esi, eax
jbe 0x402d08
call fcn.00403ec9
mov edx, dword [esp + 0x2c0]
mov ebx, dword [esp + 0x2bc]
mov ecx, dword [esp + 0x2ac]
mov eax, ecx
cmp edx, 0x10
jae 0x402d16
lea eax, [esp + 0x2ac]
lea edi, [ebx + eax]
test edi, edi
je 0x402d43
mov eax, ecx
cmp edx, 0x10
jae 0x402d2b
lea eax, [esp + 0x2ac]
cmp eax, edi
ja 0x402d43
mov eax, ecx
cmp edx, 0x10
jae 0x402d3d
lea eax, [esp + 0x2ac]
add eax, ebx
cmp edi, eax
jbe 0x402d5d
call fcn.00403ec9
mov edx, dword [esp + 0x2c0]
mov ebx, dword [esp + 0x2bc]
mov ecx, dword [esp + 0x2ac]
cmp edx, 0x10
jb 0x402ea1
mov esi, ecx
test ecx, ecx
je 0x402d92
mov eax, ecx
cmp edx, 0x10
jae 0x402d7a
lea eax, [esp + 0x2ac]
cmp eax, esi
ja 0x402d92
mov eax, ecx
cmp edx, 0x10
jae 0x402d8c
lea eax, [esp + 0x2ac]
add ebx, eax
cmp esi, ebx
jbe 0x402d97
call fcn.00403ec9
mov ecx, dword [esp + 0x20]
push ecx
lea eax, [esp + 0x2ac]
push eax
mov byte [esp + 0x298], 0
mov edx, dword [esp + 0x298]
mov eax, dword [esp + 0x298]
push edx
push eax
push edi
lea ecx, [esp + 0x2c]
push esi
push ecx
call fcn.00403830
add esp, 0x1c
push 0xf
push str.tuctlsystem.exe
lea edx, [esp + 0x2b0]
push edx
call fcn.004032e0
cmp eax, 0xffffffff
je 0x402e05
mov eax, dword [esp + 0x30]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x2c0], 0x10
jb 0x402e1f
mov ecx, dword [esp + 0x2ac]
push ecx
call fcn.00403ac9
add esp, 4
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x28]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x402c60
mov ecx, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0x10], esi
cmp esi, 0xffffffff
je 0x40142b
lea edx, [esp + 0x28]
push edx
push esi
mov dword [esp + 0x30], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x402eb0
push esi
call edi
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18680]
xor ecx, esp
call fcn.00403998
mov esp, ebp
pop ebp
ret 0x10
lea esi, [esp + 0x2ac]
mov dword [esp + 0x20], esi
jmp 0x402cc1
lea esi, [esp + 0x2ac]
jmp 0x402d6c
lea eax, [esp + 0x4c]
mov dword [esp + 0x2c0], 0xf
mov dword [esp + 0x2bc], 0
mov byte [esp + 0x2ac], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402ed5
sub eax, edx
push eax
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x2b0]
call fcn.004031d0
mov edx, dword [esp + 0x2c0]
mov ecx, dword [esp + 0x2ac]
cmp edx, 0x10
jb 0x40315c
mov dword [esp + 0xc], ecx
test ecx, ecx
je 0x402f40
mov eax, ecx
cmp edx, 0x10
jae 0x402f1d
lea eax, [esp + 0x2ac]
cmp eax, dword [esp + 0xc]
ja 0x402f40
mov eax, ecx
cmp edx, 0x10
jae 0x402f31
lea eax, [esp + 0x2ac]
mov ebx, dword [esp + 0x2bc]
add eax, ebx
cmp dword [esp + 0xc], eax
jbe 0x402f5a
call fcn.00403ec9
mov edx, dword [esp + 0x2c0]
mov ebx, dword [esp + 0x2bc]
mov ecx, dword [esp + 0x2ac]
mov eax, ecx
cmp edx, 0x10
jae 0x402f68
lea eax, [esp + 0x2ac]
lea edi, [eax + ebx]
test edi, edi
je 0x402f95
mov eax, ecx
cmp edx, 0x10
jae 0x402f7d
lea eax, [esp + 0x2ac]
cmp eax, edi
ja 0x402f95
mov eax, ecx
cmp edx, 0x10
jae 0x402f8f
lea eax, [esp + 0x2ac]
add eax, ebx
cmp edi, eax
jbe 0x402faf
call fcn.00403ec9
mov edx, dword [esp + 0x2c0]
mov ebx, dword [esp + 0x2bc]
mov ecx, dword [esp + 0x2ac]
cmp edx, 0x10
jb 0x40316c
mov esi, ecx
test ecx, ecx
je 0x402fe4
mov eax, ecx
cmp edx, 0x10
jae 0x402fcc
lea eax, [esp + 0x2ac]
cmp eax, esi
ja 0x402fe4
mov eax, ecx
cmp edx, 0x10
jae 0x402fde
lea eax, [esp + 0x2ac]
add eax, ebx
cmp esi, eax
jbe 0x402fe9
call fcn.00403ec9
mov ecx, dword [esp + 0xc]
push ecx
lea eax, [esp + 0x2ac]
push eax
mov byte [esp + 0x298], 0
mov edx, dword [esp + 0x298]
mov eax, dword [esp + 0x298]
push edx
push eax
push edi
lea ecx, [esp + 0x34]
push esi
push ecx
call fcn.00403830
add esp, 0x1c
push 9
push str.cubeu.exe
lea edx, [esp + 0x2b0]
push edx
call fcn.004032e0
cmp eax, 0xffffffff
jne 0x40304f
push 0xb
push str.cubeu64.exe
lea eax, [esp + 0x2b0]
push eax
call fcn.004032e0
cmp eax, 0xffffffff
je 0x403070
mov ecx, dword [esp + 0x30]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x2c0], 0x10
jb 0x40308a
mov edx, dword [esp + 0x2ac]
push edx
call fcn.00403ac9
add esp, 4
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x28]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x402eb0
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.c:Program_FilesTerutenWebCubeAgentCubeU_.exe
call esi
push str.c:Program_FilesTerutenWebCubeAgentCubeU64_.exe
call esi
push str.c:Program_FilesTerutenWebCubeAgentCubeU64A_.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU_.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64_.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64A_.exe
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push str.c:Program_FilesTerutenWebCubeAgentCubeU.exe
call esi
test eax, eax
jne 0x40312f
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU.exe
call esi
test eax, eax
jne 0x40312f
push str.c:Program_FilesTerutenWebCubeAgentCubeU64.exe
call esi
test eax, eax
jne 0x40312f
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64.exe
call esi
test eax, eax
jne 0x40312f
push str.c:Program_FilesTerutenWebCubeAgentCubeU64A.exe
call esi
test eax, eax
jne 0x40312f
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64A.exe
call esi
test eax, eax
je 0x403143
push 0x30
push 0x40f804
push str.CubeU_CubeU64.exe
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x1868c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00403998
mov esp, ebp
pop ebp
ret 0x10
lea eax, [esp + 0x2ac]
mov dword [esp + 0xc], eax
jmp 0x402f0f
lea esi, [esp + 0x2ac]
jmp 0x402fbe