Function at 0x404230
Capabilities:
Check for sandbox username or hostname
Create process on windows
Create thread
Delete registry key
Delete registry value
Delete service
Get hostname
Get session user name
Parse pe header
Query or enumerate registry value
Set registry value
Shutdown system
Start service
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x464a0e
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x63c00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x98], ecx
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0xa4], 0
test edx, edx
je 0x4042a4
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x94], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404292
sub ecx, dword [ebp - 0x94]
mov dword [ebp - 0x28], edx
jmp 0x4042af
xor ecx, ecx
mov dword [ebp - 0x28], 0
xor edx, edx
cmp ecx, 0xa
je 0x408939
cmp ecx, 0x14
je 0x4082cb
cmp ecx, 0xb
je 0x40800c
cmp ecx, 9
je 0x407f7b
cmp ecx, 0x15
je 0x407410
cmp ecx, 0x13
je 0x407102
cmp ecx, 0x16
je 0x406ba0
cmp ecx, 0x18
je 0x406940
cmp ecx, 0x11
je 0x406591
cmp ecx, 0x12
je 0x405f02
cmp ecx, 0x17
je 0x405bd8
cmp ecx, 0xe
je 0x4057d9
cmp ecx, 0x1b
je 0x4054c6
cmp ecx, 0x24
je 0x4052e2
cmp ecx, 0x22
je 0x4051b1
cmp ecx, 0x19
je 0x404f75
cmp ecx, 0x1e
je 0x404ee2
cmp ecx, 0x1f
je 0x404e4e
cmp ecx, 0x1c
je 0x404c46
cmp ecx, 8
je 0x404b49
cmp ecx, 0x10
je 0x4049a3
cmp ecx, 0xc
je 0x404669
cmp ecx, 0xf
je 0x4045a8
cmp ecx, 0x1a
je 0x40443a
cmp ecx, 0x21
jne 0x408bbf
cmp edx, str.IsActivationRebootActionTriggered
je 0x4043b3
mov esi, str.IsActivationRebootActionTriggered
xor ecx, ecx
sub esi, edx
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x408bbf
inc ecx
inc edx
cmp ecx, 0x21
jb 0x4043a1
cmp dword [ebp + 0x10], 0
jne 0x408bbf
mov ecx, dword [0x642bd4]
test ecx, ecx
jne 0x4043cb
xor esi, esi
jmp 0x4043db
xor eax, eax
cmp ecx, 1
sete al
mov dword [ebp - 0x94], eax
mov esi, eax
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0xaf
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0xb0
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.IsUninstallActionTriggered
je 0x40446b
mov eax, str.IsUninstallActionTriggered
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0x94], eax
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x4044ee
mov eax, dword [ebp - 0x94]
inc esi
inc ecx
cmp esi, 0x1a
jb 0x404453
cmp dword [ebp + 0x10], 0
jne 0x4044ee
mov ecx, dword [0x642bc4]
test ecx, ecx
jne 0x40447f
xor esi, esi
jmp 0x40448f
xor eax, eax
cmp ecx, 1
sete al
mov dword [ebp - 0x94], eax
mov esi, eax
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0xab
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0xac
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.ActivationFlag_LicenseFile
je 0x404512
mov esi, str.ActivationFlag_LicenseFile
xor ecx, ecx
sub esi, edx
nop
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x408bbf
inc ecx
inc edx
cmp ecx, 0x1a
jb 0x404500
cmp dword [ebp + 0x10], 0
jne 0x408bbf
mov esi, dword [0x642bd8]
mov dword [ebp - 0x98], esi
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
test esi, esi
je 0x404554
mov eax, esi
xor esi, esi
mov ecx, eax
cmp word [ecx], si
je 0x404556
lea eax, [eax + 2]
inc esi
cmp word [eax], 0
jne 0x404548
jmp 0x404556
xor esi, esi
call fcn.004016b0
push 0
push esi
push dword [ebp - 0x98]
mov eax, dword [eax + 0x218]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0xb1
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0xb2
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.ExecuteWithFlag
je 0x4045d2
mov esi, str.ExecuteWithFlag
xor ecx, ecx
sub esi, edx
nop dword [eax]
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x408bbf
inc ecx
inc edx
cmp ecx, 0xf
jb 0x4045c0
cmp dword [ebp + 0x10], 1
jne 0x408bbf
sub esp, 0x10
mov esi, esp
call fcn.004016b0
push esi
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push dword [ebp - 0x9c]
push esi
mov eax, dword [eax + 0x208]
call eax
call fcn.00413560
mov esi, eax
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [eax + 0x1fc]
call ecx
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0xa7
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0xa8
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.VerifyRootCA
je 0x404698
mov eax, str.VerifyRootCA
xor ecx, ecx
sub eax, edx
mov dword [ebp - 0x94], eax
mov al, byte [eax + edx]
cmp al, byte [edx]
jne 0x408bbf
mov eax, dword [ebp - 0x94]
inc ecx
inc edx
cmp ecx, 0xc
jb 0x404680
cmp dword [ebp + 0x10], 1
jne 0x408bbf
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push esi
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [eax + 0x208]
call eax
push ecx
lea eax, [ebp - 0x48]
mov dword [ebp - 4], 0x9a
push eax
lea ecx, [ebp - 0x30]
call fcn.00402a30
cmp dword [ebp - 0x34], 8
lea ecx, [ebp - 0x48]
cmovae ecx, dword [ebp - 0x48]
cmp word [ecx], 0
jne 0x404872
push 0x2712
call fcn.0045669c
mov esi, eax
add esp, 4
test esi, esi
jne 0x404771
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x40473b
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x404731
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408be4
push edx
push ecx
call fcn.0044df88
add esp, 8
xor eax, eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov dword [ebp - 4], 0x9b
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov esi, 1
jmp 0x40493d
push 0x2712
push 0
push esi
call fcn.0044f970
add esp, 0xc
push 0x1388
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, esi
call fcn.00412f00
push esi
test eax, eax
je 0x404810
call fcn.004533f0
mov edx, dword [ebp - 0x34]
add esp, 4
cmp edx, 8
jb 0x4047dd
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4047d3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408bdf
push edx
push ecx
call fcn.0044df88
add esp, 8
xor eax, eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov dword [ebp - 4], 0x9c
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [eax + 0x200]
call eax
xor esi, esi
jmp 0x40493d
call fcn.004533f0
mov edx, dword [ebp - 0x34]
add esp, 4
cmp edx, 8
jb 0x404852
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x404848
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408bdf
push edx
push ecx
call fcn.0044df88
add esp, 8
xor eax, eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov dword [ebp - 4], 0x9d
jmp 0x404927
call fcn.00412f00
mov edx, dword [ebp - 0x34]
test eax, eax
je 0x4048d5
cmp edx, 8
jb 0x4048b5
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4048ab
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408be4
push edx
push ecx
call fcn.0044df88
add esp, 8
xor eax, eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov dword [ebp - 4], 0x9e
jmp 0x4047f8
cmp edx, 8
jb 0x40490c
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x404902
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408be4
push edx
push ecx
call fcn.0044df88
add esp, 8
xor eax, eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov dword [ebp - 4], 0x9f
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov esi, 2
mov dword [ebp - 4], 0xffffffff
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0xa1
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0xa2
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.RetrieveDPIScale
je 0x4049d8
mov eax, str.RetrieveDPIScale
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0x94], eax
nop dword [eax]
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x404a8f
mov eax, dword [ebp - 0x94]
inc esi
inc ecx
cmp esi, 0x10
jb 0x4049c0
cmp dword [ebp + 0x10], 0
jne 0x404a8f
push 0
mov esi, 1
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x94], eax
test eax, eax
je 0x404a30
push 0x58
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push dword [ebp - 0x94]
mov dword [ebp - 0x98], eax
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 0x98]
cmp eax, 0x64
je 0x404a30
imul ecx, eax, 0x64
mov eax, 0xaaaaaaab
mul ecx
mov esi, edx
shr esi, 6
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0x92
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x93
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.CheckLicenseFile
je 0x404ab2
mov esi, str.CheckLicenseFile
xor ecx, ecx
sub esi, edx
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x408bbf
inc ecx
inc edx
cmp ecx, 0x10
jb 0x404aa0
cmp dword [ebp + 0x10], 1
jne 0x408bbf
sub esp, 0x10
mov esi, esp
call fcn.004016b0
push esi
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push dword [ebp - 0x9c]
push esi
mov eax, dword [eax + 0x208]
call eax
call fcn.004133d0
mov esi, eax
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [eax + 0x1fc]
call ecx
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0xa5
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0xa6
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.RebootOS
je 0x404b72
mov esi, str.RebootOS
xor ecx, ecx
sub esi, edx
nop word [eax + eax]
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x408bbf
inc ecx
inc edx
cmp ecx, 8
jb 0x404b60
cmp dword [ebp + 0x10], 0
jne 0x408bbf
lea eax, [ebp - 0x94]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x404b9b
lea esi, [eax + 1]
jmp 0x404bfa
lea eax, [ebp - 0x1c]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 1
push eax
push 0
push dword [ebp - 0x94]
mov dword [ebp - 0x14], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x404be3
mov esi, 2
jmp 0x404bfa
push 0x80030003
push 0x12
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb esi, esi
and esi, 0xfffffffd
add esi, 3
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x30]
push ecx
call eax
mov dword [ebp - 4], 0x90
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x91
jmp 0x408baa
cmp edx, str.Uninstall_TaskSchedulerEntry
je 0x404c74
mov eax, str.Uninstall_TaskSchedulerEntry
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0x94], eax
nop
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x404ce0
mov eax, dword [ebp - 0x94]
inc esi
inc ecx
cmp esi, 0x1c
jb 0x404c60
cmp dword [ebp + 0x10], 0
jne 0x404ce0
call fcn.00412c30
mov esi, eax
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [eax + 0x1fc]
call ecx
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0x87
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x88
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.ActivationFlag_ServerAddress
je 0x404d18
mov eax, str.ActivationFlag_ServerAddress
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0x94], eax
nop dword [eax]
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x404db0
mov eax, dword [ebp - 0x94]
inc esi
inc ecx
cmp esi, 0x1c
jb 0x404d00
cmp dword [ebp + 0x10], 0
jne 0x404db0
mov esi, dword [0x642bb8]
mov dword [ebp - 0x98], esi
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
test esi, esi
je 0x404d5c
mov eax, esi
xor esi, esi
mov ecx, eax
cmp word [ecx], si
je 0x404d5e
nop
lea eax, [eax + 2]
inc esi
cmp word [eax], 0
jne 0x404d50
jmp 0x404d5e
xor esi, esi
call fcn.004016b0
push 0
push esi
push dword [ebp - 0x98]
mov eax, dword [eax + 0x218]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0xb3
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0xb4
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.ActivationFlag_ServerPortSSL
je 0x404dd3
mov esi, str.ActivationFlag_ServerPortSSL
xor ecx, ecx
sub esi, edx
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x408bbf
inc ecx
inc edx
cmp ecx, 0x1c
jb 0x404dc1
cmp dword [ebp + 0x10], 0
jne 0x408bbf
mov esi, dword [0x642bbc]
call fcn.004016b0
lea ecx, [ebp - 0x90]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x90]
push ecx
call eax
mov dword [ebp - 4], 0xb7
call fcn.004016b0
lea ecx, [ebp - 0x90]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0xb8
call fcn.004016b0
lea ecx, [ebp - 0x90]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.Uninstall_UIAndInstallDirectory
je 0x404e72
mov esi, str.Uninstall_UIAndInstallDirectory
xor ecx, ecx
sub esi, edx
nop
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x408bbf
inc ecx
inc edx
cmp ecx, 0x1f
jb 0x404e60
cmp dword [ebp + 0x10], 0
jne 0x408bbf
call fcn.00412470
mov esi, eax
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [eax + 0x1fc]
call ecx
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0x83
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x84
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.InstallSetRansompodKeySecurity
je 0x404f05
mov esi, str.InstallSetRansompodKeySecurity
xor ecx, ecx
sub esi, edx
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x408bbf
inc ecx
inc edx
cmp ecx, 0x1e
jb 0x404ef3
cmp dword [ebp + 0x10], 0
jne 0x408bbf
call fcn.004115e0
mov esi, eax
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [eax + 0x1fc]
call ecx
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0x79
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x7a
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.InstallTaskSchedulerEntry
je 0x404fa8
mov eax, str.InstallTaskSchedulerEntry
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0x94], eax
nop
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x40501d
mov eax, dword [ebp - 0x94]
inc esi
inc ecx
cmp esi, 0x19
jb 0x404f90
cmp dword [ebp + 0x10], 0
jne 0x40501d
mov ecx, dword [ebp - 0x98]
lea ecx, [ecx - 0x10]
call fcn.00410510
mov esi, eax
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [eax + 0x1fc]
call ecx
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0x75
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x76
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.ConvertPathToNTEquivalent
je 0x405058
mov eax, str.ConvertPathToNTEquivalent
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0x94], eax
nop word [eax + eax]
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x405116
mov eax, dword [ebp - 0x94]
inc esi
inc ecx
cmp esi, 0x19
jb 0x405040
cmp dword [ebp + 0x10], 1
jne 0x405116
sub esp, 0x10
mov esi, esp
call fcn.004016b0
push esi
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push dword [ebp - 0x9c]
push esi
mov eax, dword [eax + 0x208]
call eax
call fcn.0040b020
mov esi, eax
mov dword [ebp - 0x98], esi
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [eax + 0x1fc]
call ecx
test esi, esi
je 0x4050c2
mov ecx, esi
xor esi, esi
mov eax, ecx
cmp word [eax], si
je 0x4050c4
lea ecx, [ecx + 2]
inc esi
cmp word [ecx], 0
jne 0x4050b6
jmp 0x4050c4
xor esi, esi
call fcn.004016b0
push 0
push esi
push dword [ebp - 0x98]
mov eax, dword [eax + 0x218]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0x98
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x99
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.ActivationFlag_ServerPort
je 0x405142
mov esi, str.ActivationFlag_ServerPort
xor ecx, ecx
sub esi, edx
nop word [eax + eax]
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x408bbf
inc ecx
inc edx
cmp ecx, 0x19
jb 0x405130
cmp dword [ebp + 0x10], 0
jne 0x408bbf
mov esi, dword [0x642bc0]
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0xb5
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0xb6
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.CheckRansompodInitializationStatus
je 0x4051d4
mov esi, str.CheckRansompodInitializationStatus
xor ecx, ecx
sub esi, edx
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x408bbf
inc ecx
inc edx
cmp ecx, 0x22
jb 0x4051c2
cmp dword [ebp + 0x10], 0
jne 0x408bbf
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], 0
push eax
push 0x2011f
push 0
push str.SOFTWARERansompod
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x405225
mov esi, 1
jmp 0x405283
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 4
push eax
lea eax, [ebp - 0x94]
push eax
push 0
push 0
push 0x46d25c
push dword [ebp - 0xa0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xa0]
cmp eax, 2
jne 0x40526a
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 3
jmp 0x405283
test eax, eax
je 0x40527b
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 2
jmp 0x405283
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0x6f
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x70
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.CheckRansompodInitializationRegistry
je 0x405318
mov eax, str.CheckRansompodInitializationRegistry
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0x94], eax
nop dword [eax + eax]
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x405433
mov eax, dword [ebp - 0x94]
inc esi
inc ecx
cmp esi, 0x24
jb 0x405300
cmp dword [ebp + 0x10], 0
jne 0x405433
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x9c], 0
push eax
push 0x2011f
push 0
push str.SOFTWARERansompod
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x98], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40535f
mov esi, 1
jmp 0x4053d4
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x98]
push eax
push 0
push 0
push 0
push str.Path_32
push dword [ebp - 0x9c]
call esi
cmp eax, 2
jne 0x4053c3
lea eax, [ebp - 0x98]
push eax
push 0
push 0
push 0
push str.PathTemp
push dword [ebp - 0x9c]
call esi
push dword [ebp - 0x9c]
cmp eax, 2
jne 0x4053b6
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 2
jmp 0x4053d4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 3
jmp 0x4053d4
push dword [ebp - 0x9c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 4
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0x6d
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x6e
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.InstallSetRansompodDirectorySecurity
je 0x405456
mov esi, str.InstallSetRansompodDirectorySecurity
xor ecx, ecx
sub esi, edx
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x408bbf
inc ecx
inc edx
cmp ecx, 0x24
jb 0x405444
cmp dword [ebp + 0x10], 0
jne 0x408bbf
call fcn.00411810
mov esi, eax
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [eax + 0x1fc]
call ecx
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0x7b
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x7c
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.ReadMultiStringFromRegistry
je 0x4054f4
mov eax, str.ReadMultiStringFromRegistry
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0x94], eax
nop
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x405561
mov eax, dword [ebp - 0x94]
inc esi
inc ecx
cmp esi, 0x1b
jb 0x4054e0
cmp dword [ebp + 0x10], 1
jne 0x405561
sub esp, 0x10
mov esi, esp
call fcn.004016b0
push esi
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push dword [ebp - 0x9c]
push esi
mov eax, dword [eax + 0x208]
call eax
lea eax, [ebp - 0x40]
push eax
call fcn.0040c6d0
mov esi, eax
mov dword [ebp - 4], 0x50
call fcn.004016b0
push esi
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x51
call fcn.004016b0
lea ecx, [ebp - 0x40]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.Uninstall_FilesAndShortCuts
je 0x405594
mov eax, str.Uninstall_FilesAndShortCuts
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0x94], eax
nop word [eax + eax]
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x405600
mov eax, dword [ebp - 0x94]
inc esi
inc ecx
cmp esi, 0x1b
jb 0x405580
cmp dword [ebp + 0x10], 0
jne 0x405600
call fcn.004120a0
mov esi, eax
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [eax + 0x1fc]
call ecx
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0x7f
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x80
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.UninstallExecuteSelfAsAdmin
je 0x405638
mov eax, str.UninstallExecuteSelfAsAdmin
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0x94], eax
nop dword [eax]
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x405725
mov eax, dword [ebp - 0x94]
inc esi
inc ecx
cmp esi, 0x1b
jb 0x405620
cmp dword [ebp + 0x10], 0
jne 0x405725
push 0x2710
call fcn.0045669c
mov esi, eax
add esp, 4
test esi, esi
jne 0x40565a
lea esi, [eax + 1]
jmp 0x4056b6
push 0x2710
push 0
push esi
call fcn.0044f970
add esp, 0xc
push 0x1388
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x405689
push esi
call fcn.004533f0
mov esi, 2
jmp 0x4056b3
push 5
push 0
push str._uninstall
push esi
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lfence
push esi
cmp eax, 0x20
jg 0x405715
call fcn.004533f0
mov esi, 3
add esp, 4
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0xa9
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0xaa
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
call fcn.004533f0
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp edx, str.IsActivationActionTriggered
je 0x405752
mov esi, str.IsActivationActionTriggered
xor ecx, ecx
sub esi, edx
nop word [eax + eax]
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x408bbf
inc ecx
inc edx
cmp ecx, 0x1b
jb 0x405740
cmp dword [ebp + 0x10], 0
jne 0x408bbf
mov ecx, dword [0x642bd0]
test ecx, ecx
jne 0x40576a
xor esi, esi
jmp 0x40577a
xor eax, eax
cmp ecx, 1
sete al
mov dword [ebp - 0x94], eax
mov esi, eax
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0xad
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0xae
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.HashDataSHA256
je 0x405809
mov esi, edx
xor ecx, ecx
sub esi, str.HashDataSHA256
nop dword [eax + eax]
mov al, byte [ecx + str.HashDataSHA256]
cmp al, byte [esi + ecx + str.HashDataSHA256]
jne 0x405908
inc ecx
cmp ecx, 0xe
jb 0x4057f0
cmp dword [ebp + 0x10], 2
jne 0x405908
sub esp, 0x10
mov dword [ebp - 0xa4], esp
mov esi, esp
call fcn.004016b0
push esi
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
mov edi, dword [ebp - 0x9c]
mov eax, dword [eax + 0x208]
lea ecx, [edi + 0x10]
push ecx
push esi
call eax
sub esp, 0x10
mov dword [ebp - 4], 0x40
mov esi, esp
call fcn.004016b0
push esi
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push edi
push esi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0xffffffff
call fcn.0040c160
push eax
lea ecx, [ebp - 0x58]
call fcn.00402920
mov dword [ebp - 4], 0x41
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
mov esi, dword [ebp - 0x34]
mov edi, dword [ebp - 0x38]
call fcn.004016b0
push 0xffff
push esi
push edi
mov eax, dword [eax + 0x218]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x58]
cmp eax, ecx
je 0x4058cb
push eax
call fcn.0044dfb9
add esp, 4
mov dword [ebp - 4], 0x42
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push dword [ebp - 0xa0]
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x43
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.GetLicenseType
je 0x405939
mov eax, str.GetLicenseType
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0x94], eax
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x405aa1
mov eax, dword [ebp - 0x94]
inc esi
inc ecx
cmp esi, 0xe
jb 0x405921
cmp dword [ebp + 0x10], 0
jne 0x405aa1
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x9c], 0
push eax
push 0x20119
push 0
push str.SOFTWARERansompod
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x98], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x405983
mov esi, 0x46cef8
jmp 0x405a32
lea eax, [ebp - 0x98]
push eax
push 0
push 0
push 0
push str.cType
push dword [ebp - 0x9c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x98]
lea eax, [eax*2 + 0xa]
push eax
call fcn.0045669c
mov esi, eax
add esp, 4
test esi, esi
jne 0x4059d0
push dword [ebp - 0x9c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x46cef8
jmp 0x405a32
mov eax, dword [ebp - 0x98]
lea eax, [eax*2 + 0xa]
push eax
push 0
push esi
call fcn.0044f970
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
push esi
push 0
push 0
push str.cType
push dword [ebp - 0x9c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x405a26
push esi
call fcn.004533f0
add esp, 4
push dword [ebp - 0x9c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x46cef8
jmp 0x405a32
push dword [ebp - 0x9c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x30]
push eax
call fcn.004016b0
mov eax, dword [eax + 0x1fc]
call eax
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0xa0], ecx
cmp word [esi], cx
je 0x405a62
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x405a52
mov dword [ebp - 0xa0], ecx
call fcn.004016b0
push 0
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x30]
mov eax, dword [eax + 0x218]
push esi
push ecx
call eax
mov dword [ebp - 4], 0x67
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x68
jmp 0x408baa
cmp edx, str.AddEntryToList
je 0x405ac4
mov esi, str.AddEntryToList
xor ecx, ecx
sub esi, edx
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x408bbf
inc ecx
inc edx
cmp ecx, 0xe
jb 0x405ab2
cmp dword [ebp + 0x10], 3
jne 0x408bbf
sub esp, 0x10
mov dword [ebp - 0xa4], esp
mov esi, esp
call fcn.004016b0
push esi
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
mov ecx, dword [ebp - 0x9c]
add ecx, 0x20
push ecx
mov eax, dword [eax + 0x208]
push esi
call eax
sub esp, 0x10
mov dword [ebp - 4], 0x94
mov dword [ebp - 0x94], esp
mov esi, esp
call fcn.004016b0
push esi
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
mov ecx, dword [ebp - 0x9c]
add ecx, 0x10
push ecx
mov eax, dword [eax + 0x208]
push esi
call eax
sub esp, 0x10
mov byte [ebp - 4], 0x95
mov esi, esp
call fcn.004016b0
push esi
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push dword [ebp - 0x9c]
push esi
mov eax, dword [eax + 0x208]
call eax
mov ecx, dword [ebp - 0x98]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.0040b1d0
mov esi, eax
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [eax + 0x1fc]
call ecx
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0x96
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x97
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.RemoveDWORDFromRegistry
je 0x405c0f
mov eax, str.RemoveDWORDFromRegistry
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0x94], eax
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x405e6d
mov eax, dword [ebp - 0x94]
inc esi
inc ecx
cmp esi, 0x17
jb 0x405bf1
mov esi, dword [ebp - 0x9c]
cmp dword [ebp + 0x10], 1
jne 0x405e6d
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push esi
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [eax + 0x208]
call eax
push ecx
lea eax, [ebp - 0x48]
mov dword [ebp - 4], 0x33
push eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x9c], 0
call fcn.00402a30
cmp dword [ebp - 0x34], 8
lea eax, [ebp - 0x9c]
push eax
push 0x2011f
push 0
push str.SOFTWARERansompod
lea esi, [ebp - 0x48]
cmovae esi, dword [ebp - 0x48]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x405cf7
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x405cc1
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405cb7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408be9
push edx
push ecx
call fcn.0044df88
add esp, 8
xor eax, eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov dword [ebp - 4], 0x34
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov esi, 1
jmp 0x405e07
push esi
push dword [ebp - 0x9c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x9c]
test eax, eax
je 0x405d8d
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 0x9c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x405d5a
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405d50
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408be9
push edx
push ecx
call fcn.0044df88
add esp, 8
xor eax, eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov dword [ebp - 4], 0x35
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov esi, 2
jmp 0x405e07
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 0x9c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x405dd9
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405dcf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408be9
push edx
push ecx
call fcn.0044df88
add esp, 8
xor eax, eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov dword [ebp - 4], 0x36
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [eax + 0x200]
call eax
xor esi, esi
mov dword [ebp - 4], 0xffffffff
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0x38
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x39
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.RansompodServiceReplace
je 0x405e92
mov esi, str.RansompodServiceReplace
xor ecx, ecx
sub esi, edx
nop
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x408bbf
inc ecx
inc edx
cmp ecx, 0x17
jb 0x405e80
cmp dword [ebp + 0x10], 0
jne 0x408bbf
call fcn.0040cfb0
mov esi, eax
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [eax + 0x1fc]
call ecx
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0x52
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x53
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.SetDWORDInRegistry
je 0x405f3e
mov eax, str.SetDWORDInRegistry
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0x94], eax
nop dword [eax + eax]
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x406253
mov eax, dword [ebp - 0x94]
inc esi
inc ecx
cmp esi, 0x12
jb 0x405f20
mov esi, dword [ebp - 0x9c]
cmp dword [ebp + 0x10], 2
jne 0x406253
call fcn.004016b0
lea ecx, [ebp - 0xb4]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
lea ecx, [esi + 0x10]
push ecx
lea ecx, [ebp - 0xb4]
mov eax, dword [eax + 0x208]
push ecx
call eax
mov dword [ebp - 4], 0x25
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push esi
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [eax + 0x208]
call eax
push ecx
lea eax, [ebp - 0x48]
mov dword [ebp - 4], 0x27
push eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x98], 0
call fcn.00402a30
mov byte [ebp - 4], 0x28
lea esi, [ebp - 0x48]
cmp dword [ebp - 0x34], 8
cmovae esi, dword [ebp - 0x48]
call fcn.004016b0
lea ecx, [ebp - 0x94]
push ecx
lea ecx, [ebp - 0xb4]
mov eax, dword [eax + 0x21c]
push ecx
call eax
xor ecx, ecx
test eax, eax
lea eax, [ebp - 0x98]
cmove ecx, dword [ebp - 0x94]
push eax
push 0x2011f
push 0
push str.SOFTWARERansompod
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xa0], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4060a9
mov byte [ebp - 4], 0x27
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x40605b
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406051
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408bee
push edx
push ecx
call fcn.0044df88
add esp, 8
xor eax, eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov byte [ebp - 4], 0x29
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov dword [ebp - 4], 0x2a
call fcn.004016b0
lea ecx, [ebp - 0xb4]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov esi, 1
jmp 0x4061ed
push 4
lea eax, [ebp - 0xa0]
push eax
push 4
push 0
push esi
push dword [ebp - 0x98]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x98]
test eax, eax
je 0x406163
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0x27
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x406115
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40610b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408bee
push edx
push ecx
call fcn.0044df88
add esp, 8
xor eax, eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov byte [ebp - 4], 0x2b
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov dword [ebp - 4], 0x2c
call fcn.004016b0
lea ecx, [ebp - 0xb4]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov esi, 2
jmp 0x4061ed
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0x27
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x4061a7
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40619d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408bee
push edx
push ecx
call fcn.0044df88
add esp, 8
xor eax, eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov byte [ebp - 4], 0x2d
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov dword [ebp - 4], 0x2e
call fcn.004016b0
lea ecx, [ebp - 0xb4]
push ecx
mov eax, dword [eax + 0x200]
call eax
xor esi, esi
mov dword [ebp - 4], 0xffffffff
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0x31
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x32
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.InitializeLogSynch
je 0x406288
mov eax, str.InitializeLogSynch
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0x94], eax
nop dword [eax]
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x40632f
mov eax, dword [ebp - 0x94]
inc esi
inc ecx
cmp esi, 0x12
jb 0x406270
cmp dword [ebp + 0x10], 0
jne 0x40632f
push 8
call fcn.0044dd07
add esp, 4
mov dword [ebp - 0xa4], eax
lea ecx, [ebp - 0x94]
mov dword [eax], 0x40e880
push ecx
push 0
push eax
push 0x413bc0
push 0
push 0
mov dword [eax + 4], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push 0
push 3
push 0
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0x6b
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x6c
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.InstallConfigFiles
je 0x406368
mov eax, str.InstallConfigFiles
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0x94], eax
nop dword [eax + eax]
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x406408
mov eax, dword [ebp - 0x94]
inc esi
inc ecx
cmp esi, 0x12
jb 0x406350
cmp dword [ebp + 0x10], 1
jne 0x406408
sub esp, 0x10
mov esi, esp
call fcn.004016b0
push esi
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push dword [ebp - 0x9c]
push esi
mov eax, dword [eax + 0x208]
call eax
mov ecx, dword [ebp - 0x98]
lea ecx, [ecx - 0x10]
call fcn.0040f150
mov esi, eax
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [eax + 0x1fc]
call ecx
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0x71
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x72
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.Uninstall_Services
je 0x406432
mov esi, str.Uninstall_Services
xor ecx, ecx
sub esi, edx
nop dword [eax]
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x408bbf
inc ecx
inc edx
cmp ecx, 0x12
jb 0x406420
cmp dword [ebp + 0x10], 0
jne 0x408bbf
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
mov dword [ebp - 0x94], esi
test esi, esi
jne 0x40645f
lea esi, [eax + 1]
jmp 0x406532
push 0x10000
push str.RnspodSrv
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ecx, eax
mov dword [ebp - 0x98], ecx
test ecx, ecx
jne 0x40649a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
je 0x4064c8
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, 2
jmp 0x406532
push ecx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push dword [ebp - 0x98]
test eax, eax
jne 0x4064c2
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 0x94]
call esi
mov esi, 3
jmp 0x406532
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x10000
push str.Ransompod_TD
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x98], eax
test eax, eax
jne 0x4064fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
je 0x406529
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, 2
jmp 0x406532
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push dword [ebp - 0x98]
test eax, eax
jne 0x406523
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, 3
jmp 0x406532
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor esi, esi
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0x81
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x82
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.SetFlagInRegistry
je 0x4065c8
mov eax, str.SetFlagInRegistry
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0x94], eax
nop word [eax + eax]
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x40669e
mov eax, dword [ebp - 0x94]
inc esi
inc ecx
cmp esi, 0x11
jb 0x4065b0
cmp dword [ebp + 0x10], 2
jne 0x40669e
sub esp, 0x10
mov dword [ebp - 0xa4], esp
mov esi, esp
call fcn.004016b0
push esi
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
mov ecx, dword [ebp - 0x9c]
add ecx, 0x10
push ecx
mov eax, dword [eax + 0x208]
push esi
call eax
sub esp, 0x10
mov dword [ebp - 4], 0x1a
mov esi, esp
call fcn.004016b0
push esi
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push dword [ebp - 0x9c]
push esi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0xffffffff
call fcn.0040ba80
mov esi, eax
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [eax + 0x1fc]
call ecx
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0x1b
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x1c
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.PopulateProcessID
je 0x4066cb
mov eax, str.PopulateProcessID
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0x94], eax
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x406738
mov eax, dword [ebp - 0x94]
inc esi
inc ecx
cmp esi, 0x11
jb 0x4066b7
cmp dword [ebp + 0x10], 0
jne 0x406738
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [eax + 0x1fc]
call ecx
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0x56
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x57
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.GetClientUserName
je 0x406769
mov eax, str.GetClientUserName
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0x94], eax
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x406859
mov eax, dword [ebp - 0x94]
inc esi
inc ecx
cmp esi, 0x11
jb 0x406751
cmp dword [ebp + 0x10], 0
jne 0x406859
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov eax, dword [ebp - 0x98]
lea eax, [eax*2 + 2]
push eax
call fcn.0045669c
mov esi, eax
add esp, 4
mov dword [ebp - 0xa0], esi
test esi, esi
je 0x4067e2
mov eax, dword [ebp - 0x98]
lea eax, [eax*2 + 2]
push eax
push 0
push esi
call fcn.0044f970
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x4067ed
push esi
call fcn.004533f0
add esp, 4
mov esi, 0x46cef8
mov dword [ebp - 0xa0], esi
lea eax, [ebp - 0x30]
push eax
call fcn.004016b0
mov eax, dword [eax + 0x1fc]
call eax
mov ecx, dword [ebp - 0xa0]
mov eax, esi
xor esi, esi
cmp word [ecx], si
je 0x40681a
nop dword [eax]
lea eax, [eax + 2]
inc esi
cmp word [eax], 0
jne 0x406810
call fcn.004016b0
push 0
push esi
push dword [ebp - 0xa0]
mov eax, dword [eax + 0x218]
lea ecx, [ebp - 0x30]
push ecx
call eax
mov dword [ebp - 4], 0x5a
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x5b
jmp 0x408baa
cmp edx, str.GetCustomerString
je 0x406882
mov esi, str.GetCustomerString
xor ecx, ecx
sub esi, edx
nop word [eax + eax]
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x408bbf
inc ecx
inc edx
cmp ecx, 0x11
jb 0x406870
cmp dword [ebp + 0x10], 1
jne 0x408bbf
sub esp, 0x10
mov esi, esp
call fcn.004016b0
push esi
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push dword [ebp - 0x9c]
push esi
mov eax, dword [eax + 0x208]
call eax
call fcn.0040d5a0
mov esi, eax
mov dword [ebp - 0x98], esi
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [eax + 0x1fc]
call ecx
test esi, esi
je 0x4068ec
mov ecx, esi
xor esi, esi
mov eax, ecx
cmp word [eax], si
je 0x4068ee
lea ecx, [ecx + 2]
inc esi
cmp word [ecx], 0
jne 0x4068e0
jmp 0x4068ee
xor esi, esi
call fcn.004016b0
push 0
push esi
push dword [ebp - 0x98]
mov eax, dword [eax + 0x218]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0x65
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x66
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.RetrieveLicenseTotalDays
je 0x406978
mov eax, str.RetrieveLicenseTotalDays
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0x94], eax
nop dword [eax]
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x406ad5
mov eax, dword [ebp - 0x94]
inc esi
inc ecx
cmp esi, 0x18
jb 0x406960
cmp dword [ebp + 0x10], 0
jne 0x406ad5
push 0xc8
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x94], 4
mov dword [ebp - 0x98], 0
call fcn.0045669c
mov esi, eax
add esp, 4
test esi, esi
jne 0x4069bd
mov esi, 0x46cef8
jmp 0x406a66
push 0x64
push 0
push esi
call fcn.0044f970
add esp, 0xc
lea eax, [ebp - 0xa0]
push eax
push 0x20119
push 0
push str.SOFTWARERansompod
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4069fc
push esi
call fcn.004533f0
add esp, 4
mov esi, 0x46cef8
jmp 0x406a66
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x98]
push eax
push 0
push 0
push 0x46d0f4
push dword [ebp - 0xa0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x406a3f
push esi
call fcn.004533f0
add esp, 4
push dword [ebp - 0xa0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x46cef8
jmp 0x406a66
push dword [ebp - 0xa0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xa
push esi
push dword [ebp - 0x98]
mov dword [ebp - 0xa0], 0
call fcn.004564f9
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
call fcn.004016b0
mov eax, dword [eax + 0x1fc]
call eax
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0x9c], ecx
cmp word [esi], cx
je 0x406a96
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x406a86
mov dword [ebp - 0x9c], ecx
call fcn.004016b0
push 0
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x30]
mov eax, dword [eax + 0x218]
push esi
push ecx
call eax
mov dword [ebp - 4], 0xe
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0xf
jmp 0x408baa
cmp edx, str.GetClientAvailableMemory
je 0x406b02
mov esi, str.GetClientAvailableMemory
xor ecx, ecx
sub esi, edx
nop word [eax + eax]
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x408bbf
inc ecx
inc edx
cmp ecx, 0x18
jb 0x406af0
cmp dword [ebp + 0x10], 0
jne 0x408bbf
call fcn.0040d4e0
push eax
lea ecx, [ebp - 0x58]
call fcn.00402920
mov dword [ebp - 4], 0x62
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
mov esi, dword [ebp - 0x34]
mov edi, dword [ebp - 0x38]
call fcn.004016b0
push 0xffff
push esi
push edi
mov eax, dword [eax + 0x218]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x58]
cmp eax, ecx
je 0x406b63
push eax
call fcn.0044dfb9
add esp, 4
mov dword [ebp - 4], 0x63
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push dword [ebp - 0xa0]
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x64
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.RetrieveLicenseDaysStr
je 0x406bcb
mov esi, edx
xor ecx, ecx
sub esi, str.RetrieveLicenseDaysStr
mov al, byte [ecx + str.RetrieveLicenseDaysStr]
cmp al, byte [esi + ecx + str.RetrieveLicenseDaysStr]
jne 0x406d2f
inc ecx
cmp ecx, 0x16
jb 0x406bb2
cmp dword [ebp + 0x10], 0
jne 0x406d2f
push 0xc8
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x94], 4
mov dword [ebp - 0x98], 0
call fcn.0045669c
mov esi, eax
add esp, 4
test esi, esi
jne 0x406c10
mov esi, 0x46cef8
jmp 0x406cb9
push 0x64
push 0
push esi
call fcn.0044f970
add esp, 0xc
lea eax, [ebp - 0xa0]
push eax
push 0x20119
push 0
push str.SOFTWARERansompod
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x406c4f
push esi
call fcn.004533f0
add esp, 4
mov esi, 0x46cef8
jmp 0x406cb9
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x98]
push eax
push 0
push 0
push 0x46cf3c
push dword [ebp - 0xa0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x406c92
push esi
call fcn.004533f0
add esp, 4
push dword [ebp - 0xa0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x46cef8
jmp 0x406cb9
push dword [ebp - 0xa0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xa
push esi
push dword [ebp - 0x98]
mov dword [ebp - 0xa0], 0
call fcn.004564f9
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
call fcn.004016b0
mov eax, dword [eax + 0x1fc]
call eax
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0x9c], ecx
cmp word [esi], cx
je 0x406cf0
nop dword [eax]
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x406ce0
mov dword [ebp - 0x9c], ecx
call fcn.004016b0
push 0
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x30]
mov eax, dword [eax + 0x218]
push esi
push ecx
call eax
mov dword [ebp - 4], 0xc
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0xd
jmp 0x408baa
cmp edx, str.ReadStringFromRegistry
je 0x406d68
mov eax, str.ReadStringFromRegistry
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0x94], eax
nop dword [eax + eax]
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x406e2d
mov eax, dword [ebp - 0x94]
inc esi
inc ecx
cmp esi, 0x16
jb 0x406d50
cmp dword [ebp + 0x10], 1
jne 0x406e2d
sub esp, 0x10
mov esi, esp
call fcn.004016b0
push esi
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push dword [ebp - 0x9c]
push esi
mov eax, dword [eax + 0x208]
call eax
call fcn.0040bf50
push eax
lea ecx, [ebp - 0x58]
call fcn.00402920
mov dword [ebp - 4], 0x3a
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
mov esi, dword [ebp - 0x34]
mov edi, dword [ebp - 0x38]
call fcn.004016b0
push 0xffff
push esi
push edi
mov eax, dword [eax + 0x218]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x58]
cmp eax, ecx
je 0x406df0
push eax
call fcn.0044dfb9
add esp, 4
mov dword [ebp - 4], 0x3b
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push dword [ebp - 0xa0]
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x3c
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.GetClientProcessorName
je 0x406e68
mov eax, str.GetClientProcessorName
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0x94], eax
nop word [eax + eax]
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x406fce
mov eax, dword [ebp - 0x94]
inc esi
inc ecx
cmp esi, 0x16
jb 0x406e50
cmp dword [ebp + 0x10], 0
jne 0x406fce
movaps xmm0, xmmword [0x636a60]
push 0x40
movups xmmword [ebp - 0x30], xmm0
call fcn.0045669c
push 0x40
push 0
push eax
mov dword [ebp - 0x98], eax
call fcn.0044f970
add esp, 0x10
lea edi, [ebp - 0x30]
mov eax, SysReAllocString
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov edi, SysReAllocString
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x9c], eax
mov eax, edi
xor ecx, ecx
push ebx
cpuid
mov dword [ebp - 0x94], ebx
pop ebx
lea esi, [ebp - 0x30]
mov dword [esi], eax
lea eax, [ebp - 0x30]
mov esi, dword [ebp - 0x94]
mov dword [eax + 4], esi
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x98]
cmp edi, reloc.OLEAUT32.dll_SysReAllocString
jne 0x406efc
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [eax], xmm0
jmp 0x406f1e
cmp edi, reloc.WS2_32.dll_closesocket
jne 0x406f0e
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [eax + 0x10], xmm0
jmp 0x406f1e
cmp edi, reloc.WS2_32.dll_connect
jne 0x406f1e
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [eax + 0x20], xmm0
mov ecx, dword [ebp - 0x9c]
inc edi
cmp edi, ecx
jle 0x406ec0
cmp ecx, reloc.WS2_32.dll_connect
jae 0x406f3f
push eax
call fcn.004533f0
add esp, 4
mov eax, 0x46d034
push eax
lea ecx, [ebp - 0x58]
call fcn.00402920
mov dword [ebp - 4], 0x5c
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
mov esi, dword [ebp - 0x34]
mov edi, dword [ebp - 0x38]
call fcn.004016b0
push 0xffff
push esi
push edi
mov eax, dword [eax + 0x218]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x58]
cmp eax, ecx
je 0x406f91
push eax
call fcn.0044dfb9
add esp, 4
mov dword [ebp - 4], 0x5d
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push dword [ebp - 0xa0]
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x5e
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.DisableProblematicTask
je 0x406ffb
mov eax, str.DisableProblematicTask
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0x94], eax
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x407067
mov eax, dword [ebp - 0x94]
inc esi
inc ecx
cmp esi, 0x16
jb 0x406fe7
cmp dword [ebp + 0x10], 0
jne 0x407067
call fcn.00411140
mov esi, eax
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [eax + 0x1fc]
call ecx
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0x77
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x78
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.Uninstall_SandboxFiles
je 0x407092
mov esi, str.Uninstall_SandboxFiles
xor ecx, ecx
sub esi, edx
nop dword [eax + eax]
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x408bbf
inc ecx
inc edx
cmp ecx, 0x16
jb 0x407080
cmp dword [ebp + 0x10], 0
jne 0x408bbf
call fcn.00411c50
mov esi, eax
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [eax + 0x1fc]
call ecx
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0x7d
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x7e
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.RetrieveLicenseDays
je 0x407139
mov esi, edx
xor ecx, ecx
sub esi, str.RetrieveLicenseDays
nop dword [eax]
nop dword [eax + eax]
mov al, byte [ecx + str.RetrieveLicenseDays]
cmp al, byte [esi + ecx + str.RetrieveLicenseDays]
jne 0x407229
inc ecx
cmp ecx, 0x13
jb 0x407120
cmp dword [ebp + 0x10], 0
jne 0x407229
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x9c], 0
push eax
push 0x20119
push 0
push str.SOFTWARERansompod
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x94], 4
mov dword [ebp - 0x98], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x407188
or esi, 0xffffffff
jmp 0x4071dd
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x98]
push eax
push 0
push 0
push 0x46cf3c
push dword [ebp - 0x9c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x9c]
cmp eax, 2
jne 0x4071c3
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0xfffffffd
jmp 0x4071dd
test eax, eax
jne 0x4071b6
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x98]
mov dword [ebp - 0x9c], 0
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0xa
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0xb
jmp 0x4080bc
cmp edx, str.SetStringInRegistry
je 0x407259
mov esi, edx
xor ecx, ecx
sub esi, str.SetStringInRegistry
nop dword [eax + eax]
mov al, byte [ecx + str.SetStringInRegistry]
cmp al, byte [esi + ecx + str.SetStringInRegistry]
jne 0x40732f
inc ecx
cmp ecx, 0x13
jb 0x407240
cmp dword [ebp + 0x10], 2
jne 0x40732f
sub esp, 0x10
mov dword [ebp - 0xa4], esp
mov esi, esp
call fcn.004016b0
push esi
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
mov ecx, dword [ebp - 0x9c]
add ecx, 0x10
push ecx
mov eax, dword [eax + 0x208]
push esi
call eax
sub esp, 0x10
mov dword [ebp - 4], 0x3d
mov esi, esp
call fcn.004016b0
push esi
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push dword [ebp - 0x9c]
push esi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0xffffffff
call fcn.0040bc60
mov esi, eax
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [eax + 0x1fc]
call ecx
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0x3e
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x3f
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.CalculateFileSHA256
je 0x407352
mov esi, str.CalculateFileSHA256
xor ecx, ecx
sub esi, edx
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x408bbf
inc ecx
inc edx
cmp ecx, 0x13
jb 0x407340
cmp dword [ebp + 0x10], 1
jne 0x408bbf
sub esp, 0x10
mov esi, esp
call fcn.004016b0
push esi
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push dword [ebp - 0x9c]
push esi
mov eax, dword [eax + 0x208]
call eax
call fcn.004131d0
mov esi, eax
mov dword [ebp - 0x98], esi
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [eax + 0x1fc]
call ecx
test esi, esi
je 0x4073bc
mov ecx, esi
xor esi, esi
mov eax, ecx
cmp word [eax], si
je 0x4073be
lea ecx, [ecx + 2]
inc esi
cmp word [ecx], 0
jne 0x4073b0
jmp 0x4073be
xor esi, esi
call fcn.004016b0
push 0
push esi
push dword [ebp - 0x98]
mov eax, dword [eax + 0x218]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0xa3
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0xa4
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.RetrieveSoftwareState
je 0x407455
mov eax, edx
xor ecx, ecx
sub eax, str.RetrieveSoftwareState
mov dword [ebp - 0x94], eax
nop word [eax + eax]
mov edi, dword [ebp - 0x94]
mov al, byte [ecx + str.RetrieveSoftwareState]
cmp al, byte [ecx + edi + str.RetrieveSoftwareState]
mov edi, dword [ebp - 0xa0]
jne 0x40754e
inc ecx
cmp ecx, 0x15
jb 0x407430
cmp dword [ebp + 0x10], 0
jne 0x40754e
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], 0
push eax
push 0x20119
push 0
push str.SOFTWARERansompod
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x94], 4
mov dword [ebp - 0x98], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4074a4
or esi, 0xffffffff
jmp 0x407502
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x98]
push eax
push 0
push 0
push 0x46cf44
push dword [ebp - 0xa0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xa0]
test eax, eax
je 0x4074de
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0xfffffffe
jmp 0x407502
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [ebp - 0xa0], 0
cmp dword [ebp - 0x98], 1
sete al
mov dword [ebp - 0x9c], eax
mov esi, eax
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 8
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 9
jmp 0x4080bc
cmp edx, str.ReadDWORDFromRegistry
je 0x40758e
mov eax, str.ReadDWORDFromRegistry
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0x94], eax
nop word [eax + eax]
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x407877
mov eax, dword [ebp - 0x94]
inc esi
inc ecx
cmp esi, 0x15
jb 0x407570
mov esi, dword [ebp - 0x9c]
cmp dword [ebp + 0x10], 1
jne 0x407877
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push esi
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [eax + 0x208]
call eax
push ecx
lea eax, [ebp - 0x48]
mov dword [ebp - 4], 0x1d
push eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x98], 0
call fcn.00402a30
cmp dword [ebp - 0x34], 8
lea eax, [ebp - 0xa0]
push eax
push 0x20119
push 0
push str.SOFTWARERansompod
lea esi, [ebp - 0x48]
cmovae esi, dword [ebp - 0x48]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40767e
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x40764a
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407640
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408bf3
push edx
push ecx
call fcn.0044df88
add esp, 8
xor eax, eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov dword [ebp - 4], 0x1e
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [eax + 0x200]
call eax
or esi, 0xffffffff
jmp 0x407811
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 4
push eax
lea eax, [ebp - 0x98]
push eax
push 0
push 0
push esi
push dword [ebp - 0xa0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xa0]
cmp eax, 2
jne 0x407728
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x4076f2
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4076e8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408bf3
push edx
push ecx
call fcn.0044df88
add esp, 8
xor eax, eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov dword [ebp - 4], 0x1f
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov esi, 0xfffffffd
jmp 0x407811
test eax, eax
je 0x40779f
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x40776c
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407762
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408bf3
push edx
push ecx
call fcn.0044df88
add esp, 8
xor eax, eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov dword [ebp - 4], 0x20
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov esi, 0xfffffffe
jmp 0x407811
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x98]
cmp edx, 8
jb 0x4077e5
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4077db
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408bf3
push edx
push ecx
call fcn.0044df88
add esp, 8
xor eax, eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov dword [ebp - 4], 0x21
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov dword [ebp - 4], 0xffffffff
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0x23
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x24
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.CompareTwoWideStrings
je 0x4078a9
mov esi, edx
xor ecx, ecx
sub esi, str.CompareTwoWideStrings
nop dword [eax]
mov al, byte [ecx + str.CompareTwoWideStrings]
cmp al, byte [esi + ecx + str.CompareTwoWideStrings]
jne 0x40797f
inc ecx
cmp ecx, 0x15
jb 0x407890
cmp dword [ebp + 0x10], 2
jne 0x40797f
sub esp, 0x10
mov dword [ebp - 0xa4], esp
mov esi, esp
call fcn.004016b0
push esi
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
mov ecx, dword [ebp - 0x9c]
add ecx, 0x10
push ecx
mov eax, dword [eax + 0x208]
push esi
call eax
sub esp, 0x10
mov dword [ebp - 4], 0x44
mov esi, esp
call fcn.004016b0
push esi
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push dword [ebp - 0x9c]
push esi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0xffffffff
call fcn.0040c520
mov esi, eax
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [eax + 0x1fc]
call ecx
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0x45
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x46
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.RansompodServiceStart
je 0x4079b8
mov eax, str.RansompodServiceStart
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0x94], eax
nop dword [eax + eax]
mov al, byte [ecx + eax]
cmp al, byte [ecx]
jne 0x407a9f
mov eax, dword [ebp - 0x94]
inc esi
inc ecx
cmp esi, 0x15
jb 0x4079a0
cmp dword [ebp + 0x10], 0
jne 0x407a9f
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa0000000
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x4079e7
lea esi, [eax + 1]
jmp 0x407a40
push 0x10
push str.RnspodSrv
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x98], eax
test eax, eax
jne 0x407a0d
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, 2
jmp 0x407a40
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x407a34
call esi
push dword [ebp - 0x98]
call esi
mov esi, 3
jmp 0x407a40
call esi
push dword [ebp - 0x98]
call esi
xor esi, esi
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0x54
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x55
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.GetClientComputerName
je 0x407ad8
mov eax, str.GetClientComputerName
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0x94], eax
nop dword [eax + eax]
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x407bc9
mov eax, dword [ebp - 0x94]
inc esi
inc ecx
cmp esi, 0x15
jb 0x407ac0
cmp dword [ebp + 0x10], 0
jne 0x407bc9
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov eax, dword [ebp - 0x98]
lea eax, [eax*2 + 2]
push eax
call fcn.0045669c
mov esi, eax
add esp, 4
mov dword [ebp - 0xa0], esi
test esi, esi
je 0x407b51
mov eax, dword [ebp - 0x98]
lea eax, [eax*2 + 2]
push eax
push 0
push esi
call fcn.0044f970
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x407b5c
push esi
call fcn.004533f0
add esp, 4
mov esi, 0x46cef8
mov dword [ebp - 0xa0], esi
lea eax, [ebp - 0x30]
push eax
call fcn.004016b0
mov eax, dword [eax + 0x1fc]
call eax
mov ecx, dword [ebp - 0xa0]
mov eax, esi
xor esi, esi
cmp word [ecx], si
je 0x407b8a
nop dword [eax]
lea eax, [eax + 2]
inc esi
cmp word [eax], 0
jne 0x407b80
call fcn.004016b0
push 0
push esi
push dword [ebp - 0xa0]
mov eax, dword [eax + 0x218]
lea ecx, [ebp - 0x30]
push ecx
call eax
mov dword [ebp - 4], 0x58
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x59
jmp 0x408baa
cmp edx, str.InstallConfigRegistry
je 0x407bfa
mov eax, str.InstallConfigRegistry
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0x94], eax
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x407c6f
mov eax, dword [ebp - 0x94]
inc esi
inc ecx
cmp esi, 0x15
jb 0x407be2
cmp dword [ebp + 0x10], 0
jne 0x407c6f
mov ecx, dword [ebp - 0x98]
lea ecx, [ecx - 0x10]
call fcn.0040fa30
mov esi, eax
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [eax + 0x1fc]
call ecx
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0x73
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x74
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.Uninstall_RegistryKey
je 0x407ca8
mov eax, str.Uninstall_RegistryKey
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0x94], eax
nop dword [eax + eax]
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x407d97
mov eax, dword [ebp - 0x94]
inc esi
inc ecx
cmp esi, 0x15
jb 0x407c90
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x407d9a
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
push 0x100
push str.SOFTWARERansompodExplorer
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x407cdb
cmp eax, 2
je 0x407cdb
mov esi, 1
jmp 0x407d38
push 0
push 0x200
push str.SOFTWARERansompodExplorer
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x407cf7
cmp eax, 2
jne 0x407cd4
push 0
push 0x100
push str.SOFTWARERansompod
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x407d1a
cmp eax, 2
je 0x407d1a
mov esi, 2
jmp 0x407d38
push 0
push 0x200
push str.SOFTWARERansompod
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x407d36
cmp eax, 2
jne 0x407d13
xor esi, esi
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0x85
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x86
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
mov esi, dword [ebp + 0x10]
cmp edx, str.ParseRegistrationData
je 0x407dc9
mov eax, str.ParseRegistrationData
xor ecx, ecx
sub eax, edx
mov dword [ebp - 0x94], eax
mov al, byte [eax + edx]
cmp al, byte [edx]
jne 0x408bbf
mov eax, dword [ebp - 0x94]
inc ecx
inc edx
cmp ecx, 0x15
jb 0x407db1
cmp esi, 6
jne 0x408bbf
sub esp, 0x10
mov dword [ebp - 0xa4], esp
mov esi, esp
call fcn.004016b0
push esi
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
mov ecx, dword [ebp - 0x9c]
add ecx, 0x50
push ecx
mov eax, dword [eax + 0x208]
push esi
call eax
sub esp, 0x10
mov dword [ebp - 4], 0x89
mov dword [ebp - 0x94], esp
mov esi, esp
call fcn.004016b0
push esi
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
mov ecx, dword [ebp - 0x9c]
add ecx, 0x40
push ecx
mov eax, dword [eax + 0x208]
push esi
call eax
sub esp, 0x10
mov byte [ebp - 4], 0x8a
mov dword [ebp - 0xa0], esp
mov esi, esp
call fcn.004016b0
push esi
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
mov ecx, dword [ebp - 0x9c]
add ecx, 0x30
push ecx
mov eax, dword [eax + 0x208]
push esi
call eax
sub esp, 0x10
mov byte [ebp - 4], 0x8b
mov dword [ebp - 0xb8], esp
mov esi, esp
call fcn.004016b0
push esi
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
mov ecx, dword [ebp - 0x9c]
add ecx, 0x20
push ecx
mov eax, dword [eax + 0x208]
push esi
call eax
sub esp, 0x10
mov byte [ebp - 4], 0x8c
mov dword [ebp - 0xa8], esp
mov esi, esp
call fcn.004016b0
push esi
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
mov ecx, dword [ebp - 0x9c]
add ecx, 0x10
push ecx
mov eax, dword [eax + 0x208]
push esi
call eax
mov byte [ebp - 4], 0x8d
sub esp, 0x10
mov esi, esp
call fcn.004016b0
push esi
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push dword [ebp - 0x9c]
push esi
mov eax, dword [eax + 0x208]
call eax
mov ecx, dword [ebp - 0x98]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.0040d980
mov esi, eax
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [eax + 0x1fc]
call ecx
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 0x8e
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x8f
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.showBuild
je 0x407fa2
mov esi, str.showBuild
xor ecx, ecx
sub esi, edx
nop dword [eax]
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x408bbf
inc ecx
inc edx
cmp ecx, 9
jb 0x407f90
cmp dword [ebp + 0x10], 0
jne 0x408bbf
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
mov eax, str.1102
xor esi, esi
lea eax, [eax + 2]
inc esi
cmp word [eax], 0
jne 0x407fc4
call fcn.004016b0
push 0
push esi
push str.1102
mov eax, dword [eax + 0x218]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 6
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 7
jmp 0x4080bc
cmp edx, str.showVersion
je 0x40803d
mov eax, str.showVersion
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0x94], eax
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x4080d4
mov eax, dword [ebp - 0x94]
inc esi
inc ecx
cmp esi, 0xb
jb 0x408025
cmp dword [ebp + 0x10], 0
jne 0x4080d4
call fcn.0040aeb0
mov esi, eax
mov dword [ebp - 0x98], esi
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [eax + 0x1fc]
call ecx
test esi, esi
je 0x408080
mov ecx, esi
xor esi, esi
mov eax, ecx
cmp word [eax], si
je 0x408082
lea ecx, [ecx + 2]
inc esi
cmp word [ecx], 0
jne 0x408074
jmp 0x408082
xor esi, esi
call fcn.004016b0
push 0
push esi
push dword [ebp - 0x98]
mov eax, dword [eax + 0x218]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 4], 4
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 5
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.MarginDates
je 0x4080f7
mov esi, str.MarginDates
xor ecx, ecx
sub esi, edx
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x408bbf
inc ecx
inc edx
cmp ecx, 0xb
jb 0x4080e5
cmp dword [ebp + 0x10], 2
jne 0x408bbf
call fcn.004016b0
lea ecx, [ebp - 0x40]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
mov esi, dword [ebp - 0x9c]
mov eax, dword [eax + 0x208]
lea ecx, [esi + 0x10]
push ecx
lea ecx, [ebp - 0x40]
push ecx
call eax
mov dword [ebp - 4], 0x47
call fcn.004016b0
lea ecx, [ebp - 0x68]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push esi
lea ecx, [ebp - 0x68]
push ecx
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x4a
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push 0
push 3
push 0
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x20]
push ecx
call eax
mov dword [ebp - 0xa4], 0x100
call fcn.004016b0
lea ecx, [ebp - 0xac]
push ecx
lea ecx, [ebp - 0x68]
mov eax, dword [eax + 0x22c]
push ecx
call eax
test eax, eax
jne 0x4081b6
movsd xmm0, qword [ebp - 0xac]
jmp 0x4081b9
xorps xmm0, xmm0
movsd qword [ebp - 0x28], xmm0
call fcn.004016b0
lea ecx, [ebp - 0x94]
push ecx
lea ecx, [ebp - 0x40]
mov eax, dword [eax + 0x21c]
push ecx
call eax
movsd xmm1, qword [ebp - 0x28]
xor ecx, ecx
test eax, eax
cmove ecx, dword [ebp - 0x94]
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x636960]
subsd xmm1, xmm0
movsd qword [ebp - 0x28], xmm1
call fcn.004016b0
lea ecx, [ebp - 0x90]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
movsd xmm0, qword [ebp - 0x28]
lea ecx, [ebp - 0x90]
push 0
push 4
mov eax, dword [eax + 0x230]
sub esp, 8
movsd qword [esp], xmm0
push ecx
call eax
mov byte [ebp - 4], 0x4b
call fcn.004016b0
lea ecx, [ebp - 0x90]
push ecx
lea ecx, [ebp - 0x20]
mov eax, dword [eax + 0x208]
push ecx
call eax
mov byte [ebp - 4], 0x4c
call fcn.004016b0
lea ecx, [ebp - 0x90]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov byte [ebp - 4], 0x4d
call fcn.004016b0
lea ecx, [ebp - 0x68]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov byte [ebp - 4], 0x4e
call fcn.004016b0
lea ecx, [ebp - 0x40]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov byte [ebp - 4], 0x48
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x4f
call fcn.004016b0
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.RetrieveSoftwarePath
je 0x4082fc
mov eax, str.RetrieveSoftwarePath
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0xa4], eax
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x408393
mov eax, dword [ebp - 0xa4]
inc esi
inc ecx
cmp esi, 0x14
jb 0x4082e4
cmp dword [ebp + 0x10], 0
jne 0x408393
call fcn.0040ace0
mov esi, eax
mov dword [ebp - 0x98], esi
call fcn.004016b0
lea ecx, [ebp - 0x40]
push ecx
mov ecx, dword [eax + 0x1fc]
call ecx
test esi, esi
je 0x40833f
mov ecx, esi
xor esi, esi
mov eax, ecx
cmp word [eax], si
je 0x408341
lea ecx, [ecx + 2]
inc esi
cmp word [ecx], 0
jne 0x408333
jmp 0x408341
xor esi, esi
call fcn.004016b0
push 0
push esi
push dword [ebp - 0x98]
mov eax, dword [eax + 0x218]
lea ecx, [ebp - 0x40]
push ecx
call eax
mov dword [ebp - 4], 2
call fcn.004016b0
lea ecx, [ebp - 0x40]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 3
call fcn.004016b0
lea ecx, [ebp - 0x40]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.ReadFlagFromRegistry
je 0x4083c8
mov eax, str.ReadFlagFromRegistry
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0xa4], eax
nop dword [eax]
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x4087a8
mov eax, dword [ebp - 0xa4]
inc esi
inc ecx
cmp esi, 0x14
jb 0x4083b0
cmp dword [ebp + 0x10], 1
jne 0x4087a8
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [eax + 0x208]
call eax
push ecx
mov dword [ebp - 4], 0x10
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0xa4], 4
mov dword [ebp - 0x98], 0
call fcn.00402a30
cmp dword [ebp - 0x5c], 8
lea eax, [ebp - 0x9c]
push eax
push 0x20119
push 0
push str.SOFTWARERansompod
lea esi, [ebp - 0x70]
cmovae esi, dword [ebp - 0x70]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4084c7
mov edx, dword [ebp - 0x5c]
cmp edx, 8
jb 0x408493
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408489
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408bf8
push edx
push ecx
call fcn.0044df88
add esp, 8
xor eax, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
mov dword [ebp - 4], 0x11
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [eax + 0x200]
call eax
or esi, 0xffffffff
jmp 0x408742
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x98]
push eax
push 0
push 0
push esi
push dword [ebp - 0x9c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x9c]
cmp eax, 2
jne 0x4085f6
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x46cf48
mov cx, word [esi]
cmp cx, word [eax]
jne 0x408526
test cx, cx
je 0x408522
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x408526
add esi, 4
add eax, 4
test cx, cx
jne 0x408500
xor eax, eax
jmp 0x40852b
sbb eax, eax
or eax, 1
mov edx, dword [ebp - 0x5c]
test eax, eax
jne 0x408589
cmp edx, 8
jb 0x408569
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40855f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408bf8
push edx
push ecx
call fcn.0044df88
add esp, 8
xor eax, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
mov dword [ebp - 4], 0x12
jmp 0x40872f
cmp edx, 8
jb 0x4085c0
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4085b6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408bf8
push edx
push ecx
call fcn.0044df88
add esp, 8
xor eax, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
mov dword [ebp - 4], 0x13
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov esi, 0xfffffffe
jmp 0x408742
test eax, eax
je 0x408657
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x5c]
cmp edx, 8
jb 0x40863a
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x408630
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408bf8
push edx
push ecx
call fcn.0044df88
add esp, 8
xor eax, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
mov dword [ebp - 4], 0x14
jmp 0x4085db
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x98], 0
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0x9c], 0
je 0x4086dd
cmp edx, 8
jb 0x4086aa
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4086a0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408bf8
push edx
push ecx
call fcn.0044df88
add esp, 8
xor eax, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
mov dword [ebp - 4], 0x15
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov esi, 1
jmp 0x408742
cmp edx, 8
jb 0x408714
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40870a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408bf8
push edx
push ecx
call fcn.0044df88
add esp, 8
xor eax, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
mov dword [ebp - 4], 0x16
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [eax + 0x200]
call eax
xor esi, esi
mov dword [ebp - 4], 0xffffffff
call fcn.004016b0
lea ecx, [ebp - 0x40]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x40]
push ecx
call eax
mov dword [ebp - 4], 0x18
call fcn.004016b0
lea ecx, [ebp - 0x40]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x19
call fcn.004016b0
lea ecx, [ebp - 0x40]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.GetClientWindowsName
je 0x4087d9
mov eax, str.GetClientWindowsName
xor esi, esi
sub eax, edx
mov ecx, edx
mov dword [ebp - 0xa4], eax
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x408877
mov eax, dword [ebp - 0xa4]
inc esi
inc ecx
cmp esi, 0x14
jb 0x4087c1
cmp dword [ebp + 0x10], 0
jne 0x408877
call fcn.0040d200
push eax
lea ecx, [ebp - 0x80]
call fcn.00402920
mov dword [ebp - 4], 0x5f
call fcn.004016b0
lea ecx, [ebp - 0x40]
push ecx
mov eax, dword [eax + 0x1fc]
call eax
mov esi, dword [ebp - 0x5c]
mov edi, dword [ebp - 0x60]
call fcn.004016b0
push 0xffff
push esi
push edi
mov eax, dword [eax + 0x218]
lea ecx, [ebp - 0x40]
push ecx
call eax
mov eax, dword [ebp - 0x60]
lea ecx, [ebp - 0x80]
cmp eax, ecx
je 0x40883a
push eax
call fcn.0044dfb9
add esp, 4
mov dword [ebp - 4], 0x60
call fcn.004016b0
lea ecx, [ebp - 0x40]
push ecx
push dword [ebp - 0xa0]
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x61
call fcn.004016b0
lea ecx, [ebp - 0x40]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.GetLicenseFeatureSet
je 0x4088a2
mov esi, str.GetLicenseFeatureSet
xor ecx, ecx
sub esi, edx
nop dword [eax + eax]
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x408bbf
inc ecx
inc edx
cmp ecx, 0x14
jb 0x408890
cmp dword [ebp + 0x10], 1
jne 0x408bbf
sub esp, 0x10
mov esi, esp
call fcn.004016b0
push esi
mov eax, dword [eax + 0x1fc]
call eax
call fcn.004016b0
push dword [ebp - 0x9c]
push esi
mov eax, dword [eax + 0x208]
call eax
call fcn.0040d730
mov esi, eax
call fcn.004016b0
lea ecx, [ebp - 0x40]
push ecx
mov ecx, dword [eax + 0x1fc]
call ecx
call fcn.004016b0
push 0
push 3
push esi
mov eax, dword [eax + 0x220]
lea ecx, [ebp - 0x40]
push ecx
call eax
mov dword [ebp - 4], 0x69
call fcn.004016b0
lea ecx, [ebp - 0x40]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 0x6a
call fcn.004016b0
lea ecx, [ebp - 0x40]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
cmp edx, str.PingServer
je 0x408962
mov esi, str.PingServer
xor ecx, ecx
sub esi, edx
nop word [eax + eax]
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x408bbf
inc ecx
inc edx
cmp ecx, 0xa
jb 0x408950
cmp dword [ebp + 0x10], 0
jne 0x408bbf
lea eax, [ebp - 0x98]
mov dword [ebp - 0x9c], 0
push eax
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x98], 0
push eax
mov edx, str._api_v1_getdate
xor ecx, ecx
call fcn.00413e20
add esp, 8
mov dword [ebp - 0xa4], eax
test eax, eax
jne 0x408b07
mov esi, dword [ebp - 0x9c]
push 0x7d
push esi
call fcn.0044f370
add esp, 8
test eax, eax
jne 0x4089d8
push dword [ebp - 0x98]
call fcn.004533f0
add esp, 4
mov esi, 0x46d1e0
jmp 0x408b3c
sub eax, esi
mov dword [ebp - 0x94], eax
add eax, 0xa
push eax
mov dword [ebp - 0xa4], eax
call fcn.0045669c
mov esi, eax
add esp, 4
mov dword [ebp - 0xa0], esi
test esi, esi
jne 0x408a14
push dword [ebp - 0x98]
call fcn.004533f0
add esp, 4
mov dword [ebp - 0x98], esi
jmp 0x408a20
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x98], eax
push dword [ebp - 0xa4]
push 0
push esi
call fcn.0044f970
mov eax, dword [ebp - 0x94]
add eax, 2
push eax
push dword [ebp - 0x9c]
push esi
call fcn.0044fb10
push dword [ebp - 0x98]
call fcn.004533f0
add esp, 0x1c
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x94], eax
test eax, eax
jne 0x408a83
push esi
call fcn.004533f0
add esp, 4
mov esi, 0x46d1e0
jmp 0x408b3c
lea eax, [eax*2 + 0xa]
push eax
mov dword [ebp - 0xa4], eax
call fcn.0045669c
mov esi, eax
add esp, 4
test esi, esi
jne 0x408ab7
push dword [ebp - 0xa0]
call fcn.004533f0
add esp, 4
mov esi, 0x46d1e0
jmp 0x408b3c
push dword [ebp - 0xa4]
push 0
push esi
call fcn.0044f970
add esp, 0xc
push dword [ebp - 0x94]
push esi
push 0xffffffffffffffff
push dword [ebp - 0xa0]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push dword [ebp - 0xa0]
test eax, eax
jne 0x408afd
call fcn.004533f0
add esp, 4
mov esi, 0x46d1e0
jmp 0x408b3c
call fcn.004533f0
add esp, 4
jmp 0x408b3c
push 0xa
call fcn.0045669c
mov esi, eax
add esp, 4
test esi, esi
jne 0x408b1e
mov esi, 0x46d1e0
jmp 0x408b3c
push 0xa
xorps xmm0, xmm0
push esi
push dword [ebp - 0xa4]
movq qword [esi], xmm0
mov word [esi + 8], 0
call fcn.004564f9
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
call fcn.004016b0
mov eax, dword [eax + 0x1fc]
call eax
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0x98], ecx
cmp word [esi], cx
je 0x408b70
nop dword [eax]
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x408b60
mov dword [ebp - 0x98], ecx
call fcn.004016b0
push 0
push dword [ebp - 0x98]
lea ecx, [ebp - 0x30]
mov eax, dword [eax + 0x218]
push esi
push ecx
call eax
mov dword [ebp - 4], 0
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
push edi
mov eax, dword [eax + 0x208]
call eax
mov dword [ebp - 4], 1
call fcn.004016b0
lea ecx, [ebp - 0x30]
push ecx
mov eax, dword [eax + 0x200]
call eax
mov al, 1
jmp 0x408bc1
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044daed
mov esp, ebp
pop ebp
ret 0x14
call fcn.0045376f
call fcn.0045376f
call fcn.0045376f
call fcn.0045376f
call fcn.0045376f
call fcn.0045376f
int3