Function at 0x4ff498
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push 0x5b7cb4
lea eax, [ebp - 0x200]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5ab14c
lea ecx, [ebp - 0x200]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
mov edx, dword [ebp + 8]
push edx
call fcn.0050c456
add esp, 4
test eax, eax
je 0x4ff506
push 0x5ab15c
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0
jne 0x4ff504
xor eax, eax
jmp 0x509b4f
jmp 0x4ff52e
push 0x5ab160
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0
jne 0x4ff52e
xor eax, eax
jmp 0x509b4f
mov dword [ebp - 0x404], 1
jmp 0x4ff549
mov dword [0x5b84b8], 0
jmp 0x4ff562
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
cmp dword [0x5b84b8], 0x200
jge 0x4ff57e
mov ecx, dword [0x5b84b8]
mov byte [ebp + ecx - 0x400], 0
jmp 0x4ff555
mov edx, dword [ebp - 0x408]
push edx
push 0x200
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.MSVCRT.dll_fgets]
add esp, 0xc
lea ecx, [ebp - 0x400]
push ecx
call fcn.00401fca
add esp, 4
cmp dword [ebp - 0x404], 2
jne 0x4ff60e
push str.ICON__SYSTEMM4.EXE_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ff5e2
push str.ICON__SYSTEMM7.EXE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ff60e
push str.Agent.GXI_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
je 0x4ff620
cmp dword [ebp - 0x404], 4
jne 0x4ff664
push str.OPENMARSIANO.EXE_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ff664
push str.Autoit.AO_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 6
jne 0x4ff6b1
push str.SHELLOPENCOMMANDWSCRIPT.EXE_.AUTORUN.VBS_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ff6b1
push str.AutoRun.A_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x4ff6fe
push str.OPENCOMINE.EXE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ff6fe
push str.AutoRun.G_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 3
je 0x4ff710
cmp dword [ebp - 0x404], 4
jne 0x4ff754
push str.OPEN.AUTORUN.EXE_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ff754
push str.AutoRun.H_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 6
jne 0x4ff7b9
push str.SHELLOPENCOMMANDSETUP.EXE_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ff78d
push str.SHELLOPENCOMMANDSVCHOST.EXE_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ff7b9
push str.AutoRun.O_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x4ff806
push 0x5ab2a0
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ff806
push str.AutoRun.P_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 4
jne 0x4ff853
push str.SHELLOPENCOMMANDRUNDLL32.EXE_.DESKTOP.DLL_INSTALLM_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ff853
push str.AutoRun.Q_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 3
jne 0x4ff8a1
push str.SHELLAUTORUNCOMMANDWSCRIPT.EXE_HCQ9D_
lea edx, [ebp - 0x400]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4ff8a1
push str.AutoRun.S_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
je 0x4ff8b3
cmp dword [ebp - 0x404], 3
jne 0x4ff90f
push str.OPENSCVH0ST.EXE_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ff8e3
push str.OPENWSCRIPT.EXE_..VBS_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ff90f
push str.AutoRun.AL_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x4ff95c
push str.SHELLEXECUTEWINDOWS.CMD_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ff95c
push str.AutoRun.AX_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 7
jne 0x4ff9a9
push str.OPENPRTWYO.EXE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ff9a9
push str.AutoRun.BZ_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x4ff9f7
push str.OPENMJ.EXE
lea edx, [ebp - 0x400]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4ff9f7
push str.AutoRun.CC_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x4ffa45
push str.OPENYT8A.EXE
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4ffa45
push str.AutoRun.CY_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 4
jne 0x4ffa92
push str.ACTION_AUTORUN.EXE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ffa92
push str.AutoRun.DA_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
je 0x4ffaa4
cmp dword [ebp - 0x404], 7
jne 0x4ffb18
push str.SHELLEXECUTENOTEPAD.EXE_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ffaec
push str.OPENRECYCLED.EXE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ffaec
push str.OPENRECYCLE.EXE_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ffb18
push str.AutoRun.DQ_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x4ffb95
push str.OPENLONG.EXE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ffb69
push str.OPENSONG.EXE_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ffb69
push str.OPENUFO.EXE_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ffb95
push str.AutoRun.HT_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x4ffbe2
push str.SHELLEXECUTEPROTECTOR.EXE_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ffbe2
push str.AutoRun.IQ_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x4ffc2f
push 0x5ab4fc
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ffc2f
push str.AutoRun.IZ_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 3
jne 0x4ffc7c
push str.OPENPENDRIVE.EXE_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ffc7c
push str.AutoRun.NP_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x4ffcc9
push str.OPENSSDPDISCOVV.EXE_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ffcc9
push str.AutoRun.NZ_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x4ffd16
push str.OPENHOOK.EXE__n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ffd16
push str.AutoRun.SY_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x4ffd63
push str.SHELLVERB_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ffd63
push str.AutoRun.AAE_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 3
jne 0x4ffdb0
push 0x5ab5b0
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ffdb0
push str.AutoRun.AAJ_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 3
jne 0x4ffdfd
push str.OPENMARCO.EXE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ffdfd
push str.AutoRun.ADM_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x4ffe7a
push str.OPENMICROSOFT.COM_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ffe4e
push str.OPENMICROSOFT.EXE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ffe4e
push str.OPENMICROS1.EXE_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ffe7a
push str.AutoRun.AIN_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
je 0x4ffe8c
cmp dword [ebp - 0x404], 3
jne 0x4ffed1
push str.SHELLEXECUTE_RESYCLEDBOOT.COM
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4ffed1
push str.AutoRun.AOP_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x4fff1e
push str.OPENMS_DOS.COM_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4fff1e
push str.AutoRun.BBD_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 3
jne 0x4fff6b
push str.OPENSOS.EXE_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4fff6b
push str.AutoRun.BLG_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x4fffeb
push 0x5ab6d4
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4fffeb
push str.DRV32.EXE
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4fffbf
push 0x5ab6f0
lea edx, [ebp - 0x400]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4fffeb
push str.AutoRun.CZG_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x500038
push str.OPENCLEAN.EXE_OPEN_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x500038
push str.AutoRun.CZL_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x500085
push str.OPENFUWUQI.EXE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x500085
push str.AutoRun.DFO_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x500171
push 0x5ab764
lea edx, [ebp - 0x400]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x500171
push str.DLL32.EXE
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x500145
push str.IUHX32.EXE
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x500145
push str.IUHI64.EXE
lea edx, [ebp - 0x400]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x500145
push str.KEYGEN.EXE
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x500145
push str.SIC32.EXE
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x500145
push str.SPOOLSV.EXE
lea edx, [ebp - 0x400]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x500171
push str.AutoRun.DHA_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x5001be
push str.OPEN__CSRSS.EXE_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x5001be
push str.AutoRun.DKK_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x50020b
push str.OPENRECICLAJE.EXE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x50020b
push str.AutoRun.EEY_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 4
jne 0x500258
push str.OPENRECYCLERDISC.BAT_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x500258
push str.AutoRun.EJQ_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x5002a5
push str.OPENUSBDRIVER.EXE_E_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x5002a5
push str.AutoRun.FLO_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x5002f2
push str.OPEN1.EXE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x5002f2
push str.AutoRun.FUA_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x50033f
push str.OPENNUEVA_CARPETAA.EXE_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x50033f
push str.AutoRun.JVB_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 3
jne 0x50038d
push str.SHELLOPENCOMMANDMSFS.PIF
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50038d
push str.AutoRun.LSS_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 3
jne 0x5003da
push str.OPENSYSTEM.EXE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x5003da
push str.AutoRun.LWX_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x500427
push str.SHELLEXECUTECHAVO.EXE_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x500427
push str.AutoRun.MVX_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 3
jne 0x500475
push str.SHELLOPENCOMMANDCSG.PIF
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x500475
push str.AutoRun.NIN_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x5004dc
push 0x5ab980
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x5004dc
push str.OPENFILES.EXE
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x5004dc
push str.AutoRun.ZWV_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 1
jne 0x500529
push str._TWAINDLL_TE_TIENE_POR_LOS_CUERNOS__QUEDASTE_MAMANDO_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x500529
push str.AutoRun.AAWY_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 1
jne 0x500576
push str._SAPO__AGA_LO_SUYO_PROPIO_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x500576
push str.AutoRun.AAWZ_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x5005dd
push 0x5aba30
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x5005dd
push str.SYSTEM.BAT
lea edx, [ebp - 0x400]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x5005dd
push str.AutoRun.ABHI_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 4
jne 0x50062a
push str.OPENRECYCLERSYSYER.BAT_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x50062a
push str.AutoRun.ABHJ_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 4
jne 0x500677
push str.OPENRECYCLERSYSYERY.BAT_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x500677
push str.AutoRun.ABHK_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x5006c4
push str.OPENRECYCLERSETUP32.EXE_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x5006c4
push str.AutoRun.AESJ_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x500711
push str.OPENAEXRGYHDFG_2352_26235_2322322_624621221_2622255W89E85T5.EXE_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x500711
push str.AutoRun.BQDO_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x500776
push str.OPENWKSM.EXE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x50074a
push str.OPEN_W_K_S_M.EXE_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x500776
push str.AutoRun.WKSM_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 3
jne 0x5007c3
push str.SHELLEXECUTE_AFIDO.EXE__n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x5007c3
push str.AutoRun.Afido_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x500810
push str.OPENSMS.EXE_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x500810
push 0x5abbc0
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x50085d
push str.OPENSYSANTI.EXE_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x50085d
push str.AutoRun.AntiAV_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x5008aa
push str.SHELLEXECUTESYSTEM.EXE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x5008aa
push str.AutoRun.Arhost.B_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x5008f7
push str.OPEN__BR.EXE_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x5008f7
push str.AutoRun.Ariana_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 7
jne 0x500944
push str.SHELLEXECUTE___CKOR.EXE___n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x500944
push str.AutoRun.Bat.Y_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x500991
push str.OPENBACKUPRESTORERECYCLER.EXE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x500991
push str.AutoRun.Cftmon_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x5009de
push str.ICONCRSSCR.EXE_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x5009de
push str.AutoRun.CRSSCR_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 3
jne 0x500a2b
push str.SHELLEXECUTEAKARO.EXE_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x500a2b
push str.AutoRun.FakeAVG_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 3
je 0x500a3d
cmp dword [ebp - 0x404], 4
jne 0x500ab1
push str.SHELLEXECUTE___FOTO.EXE___n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x500a85
push str.SHELLOPENCOMMANDFOTO.EXE__n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x500a85
push str.SHELLAUTOCOMMANDFOTOFOTO.EXE__n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x500ab1
push str.AutoRun.Foto_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x500afe
push str.OPENFOTOFOTO.EXE_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x500afe
push str.AutoRun.Foto2_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x500bff
push str.OPENDRIVERFILESDRAGO.EXE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x500bd3
push str.OPENDRIVERFILESDRIVER.EXE_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x500bd3
push str.OPENDRIVERFILESDT.EXE_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x500bd3
push str.OPENNOTGLOWEKN.EXE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x500bd3
push str.OPENVIDIUNUKDRG.EXE_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x500bd3
push str.OPENCONFIGS_1_5_21_1482476501_1644491937_682003330_1013USR.EXE_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x500bd3
push str.OPENRECYCLED_0_060_0000000000_1_11111_2222222WINDM.EXE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x500bd3
push str.OPENRECYCLERK_1_3542_4232123213_7676767_8888886WINS.EXE_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x500bff
push str.AutoRun.Hamweq_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x500c4c
push str.OPENDLL32.EXE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x500c4c
push str.AutoRun.Hamweq.G_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x500c99
push str.OPEN.HIGHSPEED_DRIVERS.EXE_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x500c99
push str.AutoRun.HighSpeed_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x500ce6
push str.OPENSVCHOSTX.EXE__AUTORUN_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x500ce6
push str.AutoRun.Huehueten_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 3
jne 0x500d33
push str.OPENITWAINN32.DLL.EXE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x500d33
push str.AutoRun.KillWin_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x500d80
push str.OPEN.LILITH.COM_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x500d80
push str.AutoRun.lilith_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 4
jne 0x500dcd
push str.OPENNTSYS.EXE_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x500dcd
push str.AutoRun.NTsys_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x500e1a
push str.OPENPROTECTIVEBEE.EXE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x500e1a
push str.AutoRun.ProtBee_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x500e67
push str.OPENRESTOREAUTORUN.EXE_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x500e67
push str.AutoRun.Restore_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x500eb4
push str.OPENHALO_3_GAME.EXE__FLASH_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x500eb4
push str.AutoRun.Subot_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x500f01
push str.OPENEXPLORER.EXE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x500f01
push str.AutoRun.Server_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 5
jne 0x500f4e
push str.SHELLOPENCOMMANDRESTORE.EXE_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x500f4e
push str.AutoRun.Sulunch_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x500f9c
push str.:M.EXE__S
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x500f9c
push str.AutoRun.Swimnag_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 6
jne 0x501003
push str.SHELLEXECUTERECYCLER
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x501003
push str.MSCONFIG.EXE
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x501003
push str.AutoRun.Sysdevop_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x501050
push str.OPENNOVA_PASTA.EXE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x501050
push str.AutoRun.System_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x5010cd
push str.OPENMOBNNPNISYST.EXE_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x5010a1
push str.OPENMOBNTANISYST.EXE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x5010a1
push str.OPENMOMHNPNISYST.EXE_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x5010cd
push str.AutoRun.Tamilo_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x50111a
push str.OPENUSB.EXE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x50111a
push str.AutoRun.Tarantula_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x501167
push str.OPENTARANTULA.EXE_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x501167
push str.AutoRun.Tarantula2_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 5
jne 0x5011b4
push str.OPEN.SISTEMAUPDATE.EXE_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x5011b4
push str.AutoRun.Update_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x501201
push str.SHELLEXECUTEWSCRIPT_USBDRIVER.VBE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x501201
push str.AutoRun.USBDriver_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x50124e
push str.OPENCNTMON.EXE__C_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x50124e
push str.AutoRun.VB.DA_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x50129b
push str.OPENIMPORTANTE.EXE_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x50129b
push str.AutoRun.VB.GS_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x50131b
push str.OPENDRIVESGUIDEINFO
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50131b
push 0x5ac340
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x5012ef
push 0x5ac350
lea edx, [ebp - 0x400]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50131b
push str.AutoRun.VB.ML_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 4
jne 0x501368
push str.SHELLEXECUTE.PUMAS.EXE_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x501368
push str.AutoRun.VB.AFR_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x5013b5
push str.OPENAUTO.CMD_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x5013b5
push str.AutoRun.VB.BCZ_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x501402
push str.OPENSETUPINSTALL.EXE_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x501402
push str.AutoRun.VB.QEV_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x50144f
push str.OPENDRIVERUSBUSB2.EXE_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x50144f
push str.AutoRun.VBinder.G_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x50149c
push str.OPENDRIVERUSBUSB3.EXE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x50149c
push str.AutoRun.VBinder.H_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x501501
push str.OPENARERUNNINGOF.EXE_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x5014d5
push str.OPENTHEDANCEDEATH.EXE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x501501
push str.AutoRun.VBInject.DD_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x50154e
push str.SHELLEXECUTEWSCRIPT.EXE__E:VBSCRIPT.ENCODE_MICROSOFT.DAT_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x50154e
push str.AutoRun.VBS.DAT_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x5015b5
push str.OPENWSCRIPT.EXE
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x5015b5
push str.:FUCKOFFICE.VBS_n
lea edx, [ebp - 0x400]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x5015b5
push str.AutoRun.VBS.FuckOffice_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x501602
push str.OPEN:TEM1000.EXE_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x501602
push str.AutoRun.VBS.Michelle_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x50164f
push str.SHELLOPENCOMMANDWSCRIPT.EXE_MKG.VBS_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x50164f
push str.AutoRun.VBSCuban_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x50169c
push str.OPENVENDETTA.EXE_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x50169c
push str.AutoRun.Vendetta_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x5016e9
push str.SHELLEXECUTEWINDOWS.BAT__n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x5016e9
push str.AutoRun.WinBat_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 3
jne 0x501736
push str.OPENSETUP.EXE__AUTO_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x501736
push str.AutoRun.Wind_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x501783
push str.OPENSHOCKX.EXE_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x501783
push str.AutoRun.Windaus.BX_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 4
jne 0x5017e8
push str.SHELLEXECUTEWINCSA.EXE_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x5017bc
push str.SHELLEXECUTEU3DRIVER.EXE_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x5017e8
push str.AutoRun.Winsrc_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x501835
push str.OPENSAFEDRV.EXE_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x501835
push str.AutoRun.Yeltminky_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x501882
push str.OPENDRIVERUSBUSB2DRV.EXE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x501882
push str.AutoRun.Yoybot.L_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x5018e7
push str.OPENYNKTYUNHERTYUYHJHGJ.EXE_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x5018bb
push str.OPEN.SYSTEMNHEZTYSYST.EXE_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x5018e7
push str.AutoRun.Zupar_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x501ce2
push 0x5ac770
lea edx, [ebp - 0x400]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x501ce2
push str.AUTORUNIT.EXE
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x501cb6
push str.CFMON.EXE
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x501cb6
push str.CFXER.EXE
lea edx, [ebp - 0x400]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x501cb6
push str.CUTEPHOTO.EXE
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x501cb6
push str.EXE32.EXE
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x501cb6
push str.FURIO.EXE
lea edx, [ebp - 0x400]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x501cb6
push str.GPL.EXE
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x501cb6
push 0x5ac934
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 4
jne 0x501d2f
push str.OPENRECYCLERWINUSB.EXE_n
lea ecx, [ebp - 0x400]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x501d2f
push 0x5ac968
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x501d96
push str.OPENCONFIG
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x501d96
push str.CFG.EXE
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x501d96
push 0x5ac998
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x501dfd
push str.OPENDRIVER
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x501dfd
push str.SVCHOST.EXE
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x501dfd
push 0x5ac9cc
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x501ed0
push str.OPENRESTORE
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x501ed0
push str.DARK.EXE
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x501ea4
push str.ISE32.EXE
lea edx, [ebp - 0x400]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x501ea4
push str.OGARD.EXE
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x501ea4
push 0x5aca34
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [ebp - 0x408]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x501f50
push str.OPENSYSTEM
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x501f50
push str.USB.EXE
lea edx, [ebp - 0x400]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x501f24
push str.AUTORUN.EXE
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x501f50
push str.AutoRun_Recycle__inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 9
jne 0x501fb5
push str.GLOBOBAR.OCX___0X10_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x501f89
push str.AZESEARCH4.OCX___0X10_n
lea eax, [ebp - 0x400]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x501fb5
push str.AZESearch_inf_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
jmp 0x509b4f
cmp dword [ebp - 0x404], 2
jne 0x502002
push str.OPENSYS.EXE_n
lea edx, [ebp - 0x400]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x502002
cmp dword [ebp - 0x404], 2
jne 0x50204f
mov esp, ebp
pop ebp
ret