Function at 0x4e930c
Capabilities:
Create directory
Delete file
Persist via appinit_dlls registry key
Persist via winlogon helper dll registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51334d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x9328
call fcn.005106b0
mov dword [ebp - 0x1514], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x6e24], 0
mov dword [ebp - 0x5a1c], 0
push 0x5a2678
push str.CLSID02E98619_C5A6_441B_9501_95988F7E0101InprocServer32
push 0x80000000
lea eax, [ebp - 0x9028]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x912c], eax
mov ecx, dword [ebp - 0x912c]
mov dword [ebp - 0x9130], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x9130]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x6a20]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9028]
call sub.MFC42.DLL_CString::CString
push 0x5a26b8
push str.CLSID259BA022_2005_45E9_A965_10EDB9C00605InprocServer32
push 0x80000000
lea eax, [ebp - 0x902c]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9134], eax
mov ecx, dword [ebp - 0x9134]
mov dword [ebp - 0x9138], ecx
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x9138]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x4514]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x902c]
call sub.MFC42.DLL_CString::CString
push 0x5a26f8
push str.CLSID259BA022_2005_45E9_A965_10EDB9C00618InprocServer32
push 0x80000000
lea eax, [ebp - 0x9030]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x913c], eax
mov ecx, dword [ebp - 0x913c]
mov dword [ebp - 0x9140], ecx
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x9140]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x2514]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9030]
call sub.MFC42.DLL_CString::CString
push 0x5a2738
push str.CLSID31EE3286_D785_4E3F_95FC_51D00FDABC01InprocServer32
push 0x80000000
lea eax, [ebp - 0x9034]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9144], eax
mov ecx, dword [ebp - 0x9144]
mov dword [ebp - 0x9148], ecx
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x9148]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x1d14]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9034]
call sub.MFC42.DLL_CString::CString
push 0x5a2778
push str.CLSID3D70343E_636E_4FDC_AFF1_5907C3C4021FInprocServer32
push 0x80000000
lea eax, [ebp - 0x9038]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x914c], eax
mov ecx, dword [ebp - 0x914c]
mov dword [ebp - 0x9150], ecx
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x9150]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x1110]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9038]
call sub.MFC42.DLL_CString::CString
push 0x5a27b8
push str.CLSID6BB18EFE_F2C7_457C_81FE_705757171FA0InprocServer32
push 0x80000000
lea eax, [ebp - 0x903c]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9154], eax
mov ecx, dword [ebp - 0x9154]
mov dword [ebp - 0x9158], ecx
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 0x9158]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x8424]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x903c]
call sub.MFC42.DLL_CString::CString
push 0x5a27f8
push str.CLSIDB29BE267_3A64_4F7E_8A57_75FB5E900506InprocServer32
push 0x80000000
lea eax, [ebp - 0x9040]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x915c], eax
mov ecx, dword [ebp - 0x915c]
mov dword [ebp - 0x9160], ecx
mov dword [ebp - 4], 6
mov ecx, dword [ebp - 0x9160]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x5214]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9040]
call sub.MFC42.DLL_CString::CString
push 0x5a2838
push str.CLSIDF3727275_224F_4AB0_8642_7D461EFB82D8InprocServer32
push 0x80000000
lea eax, [ebp - 0x9044]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9164], eax
mov ecx, dword [ebp - 0x9164]
mov dword [ebp - 0x9168], ecx
mov dword [ebp - 4], 7
mov ecx, dword [ebp - 0x9168]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x1914]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9044]
call sub.MFC42.DLL_CString::CString
push 0x5a2878
push str.CLSIDF85E86D8_F796_4C97_AAA2_26664A98A42CInprocServer32
push 0x80000000
lea eax, [ebp - 0x9048]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x916c], eax
mov ecx, dword [ebp - 0x916c]
mov dword [ebp - 0x9170], ecx
mov dword [ebp - 4], 8
mov ecx, dword [ebp - 0x9170]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x510]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9048]
call sub.MFC42.DLL_CString::CString
push 0x5a28b8
push str.SystemCurrentControlSetServicescmdService
push 0x80000002
lea eax, [ebp - 0x904c]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9174], eax
mov ecx, dword [ebp - 0x9174]
mov dword [ebp - 0x9178], ecx
mov dword [ebp - 4], 9
mov ecx, dword [ebp - 0x9178]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x1510]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x904c]
call sub.MFC42.DLL_CString::CString
push 0x5a28f4
lea eax, [ebp - 0x8024]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x8024]
push ecx
push str._s_sndu32
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5a2940
push 0x5b6504
push 0x80000002
lea edx, [ebp - 0x9050]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x917c], eax
mov eax, dword [ebp - 0x917c]
mov dword [ebp - 0x9180], eax
mov dword [ebp - 4], 0xa
mov ecx, dword [ebp - 0x9180]
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x5614]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9050]
call sub.MFC42.DLL_CString::CString
lea edx, [ebp - 0x8024]
push edx
push str._s_sslx32
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5a2954
push 0x5b6504
push 0x80000002
lea eax, [ebp - 0x9054]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9184], eax
mov ecx, dword [ebp - 0x9184]
mov dword [ebp - 0x9188], ecx
mov dword [ebp - 4], 0xb
mov ecx, dword [ebp - 0x9188]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x6220]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9054]
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x8024]
push eax
push str._s_tcpR32
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5a2968
push 0x5b6504
push 0x80000002
lea ecx, [ebp - 0x9058]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x918c], eax
mov edx, dword [ebp - 0x918c]
mov dword [ebp - 0x9190], edx
mov dword [ebp - 4], 0xc
mov ecx, dword [ebp - 0x9190]
call fcn.0050f0b0
push eax
lea eax, [ebp - 0x5e1c]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9058]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x8024]
push ecx
push str._sxptptt
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5a297c
push 0x5b6504
push 0x80000002
lea edx, [ebp - 0x905c]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9194], eax
mov eax, dword [ebp - 0x9194]
mov dword [ebp - 0x9198], eax
mov dword [ebp - 4], 0xd
mov ecx, dword [ebp - 0x9198]
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x4114]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x905c]
call sub.MFC42.DLL_CString::CString
lea edx, [ebp - 0x8024]
push edx
push str._smmxf32
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5a2990
push 0x5b6504
push 0x80000002
lea eax, [ebp - 0x9060]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x919c], eax
mov ecx, dword [ebp - 0x919c]
mov dword [ebp - 0x91a0], ecx
mov dword [ebp - 4], 0xe
mov ecx, dword [ebp - 0x91a0]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x2114]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9060]
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x8024]
push eax
push str._smfreedft
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5a29a4
push 0x5b6504
push 0x80000002
lea ecx, [ebp - 0x9064]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x91a4], eax
mov edx, dword [ebp - 0x91a4]
mov dword [ebp - 0x91a8], edx
mov dword [ebp - 4], 0xf
mov ecx, dword [ebp - 0x91a8]
call fcn.0050f0b0
push eax
lea eax, [ebp - 0x4e14]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9064]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x8024]
push ecx
push str._syvsvga
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5a29b8
push 0x5b6504
push 0x80000002
lea edx, [ebp - 0x9068]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x91ac], eax
mov eax, dword [ebp - 0x91ac]
mov dword [ebp - 0x91b0], eax
mov dword [ebp - 4], 0x10
mov ecx, dword [ebp - 0x91b0]
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x4914]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9068]
call sub.MFC42.DLL_CString::CString
lea edx, [ebp - 0x8024]
push edx
push str._sCBSSREG
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5a29cc
push 0x5b6504
push 0x80000002
lea eax, [ebp - 0x906c]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x91b4], eax
mov ecx, dword [ebp - 0x91b4]
mov dword [ebp - 0x91b8], ecx
mov dword [ebp - 4], 0x11
mov ecx, dword [ebp - 0x91b8]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x3d14]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x906c]
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x8024]
push eax
push str._s_rpcc
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5a29dc
push 0x5b6504
push 0x80000002
lea ecx, [ebp - 0x9070]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x91bc], eax
mov edx, dword [ebp - 0x91bc]
mov dword [ebp - 0x91c0], edx
mov dword [ebp - 4], 0x12
mov ecx, dword [ebp - 0x91c0]
call fcn.0050f0b0
push eax
lea eax, [ebp - 0x8824]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9070]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x8024]
push ecx
push str._sNotifyc
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5a29f0
push 0x5b6504
push 0x80000002
lea edx, [ebp - 0x9074]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x91c4], eax
mov eax, dword [ebp - 0x91c4]
mov dword [ebp - 0x91c8], eax
mov dword [ebp - 4], 0x13
mov ecx, dword [ebp - 0x91c8]
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x910]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9074]
call sub.MFC42.DLL_CString::CString
lea edx, [ebp - 0x8024]
push edx
push str._sWLCTRL32
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5a2a04
push 0x5b6504
push 0x80000002
lea eax, [ebp - 0x9078]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x91cc], eax
mov ecx, dword [ebp - 0x91cc]
mov dword [ebp - 0x91d0], ecx
mov dword [ebp - 4], 0x14
mov ecx, dword [ebp - 0x91d0]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x6e20]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9078]
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x8024]
push eax
push str._sWINCTRL32
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5a2a1c
push 0x5b6504
push 0x80000002
lea ecx, [ebp - 0x907c]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x91d4], eax
mov edx, dword [ebp - 0x91d4]
mov dword [ebp - 0x91d8], edx
mov dword [ebp - 4], 0x15
mov ecx, dword [ebp - 0x91d8]
call fcn.0050f0b0
push eax
lea eax, [ebp - 0x8c24]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x907c]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x8024]
push ecx
push str._sWINNT32
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5a2a30
push 0x5b6504
push 0x80000002
lea edx, [ebp - 0x9080]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x91dc], eax
mov eax, dword [ebp - 0x91dc]
mov dword [ebp - 0x91e0], eax
mov dword [ebp - 4], 0x16
mov ecx, dword [ebp - 0x91e0]
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x7624]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9080]
call sub.MFC42.DLL_CString::CString
lea edx, [ebp - 0x8024]
push edx
push str._sWINNT64
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5a2a44
push 0x5b6504
push 0x80000002
lea eax, [ebp - 0x9084]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x91e4], eax
mov ecx, dword [ebp - 0x91e4]
mov dword [ebp - 0x91e8], ecx
mov dword [ebp - 4], 0x17
mov ecx, dword [ebp - 0x91e8]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x5a18]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9084]
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x8024]
push eax
push str._s_GbPluginAbn
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5a2a5c
push 0x5b6504
push 0x80000002
lea ecx, [ebp - 0x9088]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x91ec], eax
mov edx, dword [ebp - 0x91ec]
mov dword [ebp - 0x91f0], edx
mov dword [ebp - 4], 0x18
mov ecx, dword [ebp - 0x91f0]
call fcn.0050f0b0
push eax
lea eax, [ebp - 0x7a24]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9088]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x8024]
push ecx
push str._s_GbPluginBb
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5a2a74
push 0x5b6504
push 0x80000002
lea edx, [ebp - 0x908c]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x91f4], eax
mov eax, dword [ebp - 0x91f4]
mov dword [ebp - 0x91f8], eax
mov dword [ebp - 4], 0x19
mov ecx, dword [ebp - 0x91f8]
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x7224]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x908c]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 0x5a1c], 0
lea edx, [ebp - 0x6e24]
push edx
push 0x20119
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogonNotify
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4eaef1
push 0x100
lea eax, [ebp - 0x10c]
push eax
mov ecx, dword [ebp - 0x5a1c]
mov dword [ebp - 0x91fc], ecx
mov edx, dword [ebp - 0x91fc]
push edx
mov eax, dword [ebp - 0x6e24]
push eax
mov ecx, dword [ebp - 0x5a1c]
add ecx, 1
mov dword [ebp - 0x5a1c], ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x4eaee4
lea edx, [ebp - 0x10c]
push edx
call fcn.00401fca
add esp, 4
mov dword [ebp - 0x110], 0
mov dword [0x5b84b8], 0
jmp 0x4e9fd7
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov ecx, 0x5b5b60
call fcn.0050f110
cmp dword [0x5b84b8], eax
jge 0x4ea021
mov ecx, dword [0x5b84b8]
push ecx
mov ecx, 0x5b5b60
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ea01f
mov dword [ebp - 0x110], 1
jmp 0x4e9fca
cmp dword [ebp - 0x110], 0
je 0x4ea02f
jmp 0x4e9f62
lea eax, [ebp - 0x10c]
push eax
push 0x5a2abc
lea ecx, [ebp - 0x8024]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5a2afc
lea edx, [ebp - 0x8024]
push edx
push 0x80000002
lea eax, [ebp - 0x9090]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9200], eax
mov ecx, dword [ebp - 0x9200]
mov dword [ebp - 0x9204], ecx
mov dword [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x9204]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x7e24]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9090]
call sub.MFC42.DLL_CString::CString
push 0x5a2b04
lea eax, [ebp - 0x8024]
push eax
push 0x80000002
lea ecx, [ebp - 0x9094]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9208], eax
mov edx, dword [ebp - 0x9208]
mov dword [ebp - 0x920c], edx
mov dword [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x920c]
call fcn.0050f0b0
push eax
lea eax, [ebp - 0x9024]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9094]
call sub.MFC42.DLL_CString::CString
push 0x5a2b0c
lea ecx, [ebp - 0x7e24]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ea189
push 0x5a2b10
lea edx, [ebp - 0x9024]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ea189
push str.Sistema_Infectado_por_el_AutoRun.Swimnag_n
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b851c], 0
jne 0x4ea170
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 0x1514], 1
push 0x5a2b40
lea eax, [ebp - 0x8024]
push eax
push 0x80000002
lea ecx, [ebp - 0x9098]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9210], eax
mov edx, dword [ebp - 0x9210]
mov dword [ebp - 0x9214], edx
mov dword [ebp - 4], 0x1c
mov ecx, dword [ebp - 0x9214]
call fcn.0050f0b0
push eax
lea eax, [ebp - 0x7e24]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9098]
call sub.MFC42.DLL_CString::CString
push 0x5a2b48
lea ecx, [ebp - 0x8024]
push ecx
push 0x80000002
lea edx, [ebp - 0x909c]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9218], eax
mov eax, dword [ebp - 0x9218]
mov dword [ebp - 0x921c], eax
mov dword [ebp - 4], 0x1d
mov ecx, dword [ebp - 0x921c]
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x9024]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x909c]
call sub.MFC42.DLL_CString::CString
push str.OnStartup
lea edx, [ebp - 0x7e24]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ea2c7
push str.OnShutdown
lea eax, [ebp - 0x9024]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ea2c7
push str.Sistema_Infectado_por_el_Downloader.AWX_n
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b851c], 0
jne 0x4ea2ae
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 0x1514], 1
push 0x5a2b98
lea ecx, [ebp - 0x8024]
push ecx
push 0x80000002
lea edx, [ebp - 0x90a0]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9220], eax
mov eax, dword [ebp - 0x9220]
mov dword [ebp - 0x9224], eax
mov dword [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x9224]
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x7e24]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90a0]
call sub.MFC42.DLL_CString::CString
push 0x5a2ba0
lea edx, [ebp - 0x8024]
push edx
push 0x80000002
lea eax, [ebp - 0x90a4]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9228], eax
mov ecx, dword [ebp - 0x9228]
mov dword [ebp - 0x922c], ecx
mov dword [ebp - 4], 0x1f
mov ecx, dword [ebp - 0x922c]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x9024]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90a4]
call sub.MFC42.DLL_CString::CString
push 0x5a2ba8
lea eax, [ebp - 0x7e24]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ea3c3
push 0x5a2bb0
lea ecx, [ebp - 0x9024]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ea3f3
push 0x5a2bb8
lea edx, [ebp - 0x7e24]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ea435
push 0x5a2bbc
lea eax, [ebp - 0x9024]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ea435
push str.Sistema_Infectado_por_el_Downloader.ConHook_n
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b851c], 0
jne 0x4ea41c
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 0x1514], 1
push 0x5a2bf0
lea ecx, [ebp - 0x8024]
push ecx
push 0x80000002
lea edx, [ebp - 0x90a8]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9230], eax
mov eax, dword [ebp - 0x9230]
mov dword [ebp - 0x9234], eax
mov dword [ebp - 4], 0x20
mov ecx, dword [ebp - 0x9234]
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x7e24]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90a8]
call sub.MFC42.DLL_CString::CString
push str.NotifyStartup
lea edx, [ebp - 0x7e24]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ea4f5
push str.Sistema_Infectado_por_el_Downloader.ConHook2_n
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b851c], 0
jne 0x4ea4dc
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 0x1514], 1
push 0x5a2c38
lea eax, [ebp - 0x8024]
push eax
push 0x80000002
lea ecx, [ebp - 0x90ac]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9238], eax
mov edx, dword [ebp - 0x9238]
mov dword [ebp - 0x923c], edx
mov dword [ebp - 4], 0x21
mov ecx, dword [ebp - 0x923c]
call fcn.0050f0b0
push eax
lea eax, [ebp - 0x7e24]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90ac]
call sub.MFC42.DLL_CString::CString
push 0x5a2c40
lea ecx, [ebp - 0x8024]
push ecx
push 0x80000002
lea edx, [ebp - 0x90b0]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9240], eax
mov eax, dword [ebp - 0x9240]
mov dword [ebp - 0x9244], eax
mov dword [ebp - 4], 0x22
mov ecx, dword [ebp - 0x9244]
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x9024]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90b0]
call sub.MFC42.DLL_CString::CString
push str.WLEventLogon
lea edx, [ebp - 0x7e24]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ea633
push str.WLEventLogoff
lea eax, [ebp - 0x9024]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ea633
push str.Sistema_Infectado_por_el_Downloader.ConHook3_n
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b851c], 0
jne 0x4ea61a
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 0x1514], 1
push 0x5a2c98
lea ecx, [ebp - 0x8024]
push ecx
push 0x80000002
lea edx, [ebp - 0x90b4]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9248], eax
mov eax, dword [ebp - 0x9248]
mov dword [ebp - 0x924c], eax
mov dword [ebp - 4], 0x23
mov ecx, dword [ebp - 0x924c]
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x7e24]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90b4]
call sub.MFC42.DLL_CString::CString
push 0x5a2ca0
lea edx, [ebp - 0x8024]
push edx
push 0x80000002
lea eax, [ebp - 0x90b8]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9250], eax
mov ecx, dword [ebp - 0x9250]
mov dword [ebp - 0x9254], ecx
mov dword [ebp - 4], 0x24
mov ecx, dword [ebp - 0x9254]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x9024]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90b8]
call sub.MFC42.DLL_CString::CString
push str.Shutdown
lea eax, [ebp - 0x8024]
push eax
push 0x80000002
lea ecx, [ebp - 0x90bc]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9258], eax
mov edx, dword [ebp - 0x9258]
mov dword [ebp - 0x925c], edx
mov dword [ebp - 4], 0x25
mov ecx, dword [ebp - 0x925c]
call fcn.0050f0b0
push eax
lea eax, [ebp - 0xd10]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90bc]
call sub.MFC42.DLL_CString::CString
push str.WinLogon
lea ecx, [ebp - 0x7e24]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ea7ef
push str.WinLogoff
lea edx, [ebp - 0x9024]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ea7ef
push str.WinShutdown
lea eax, [ebp - 0xd10]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ea7ef
push str.Sistema_Infectado_por_el_LOOK2ME_n
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b851c], 0
jne 0x4ea7d6
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 0x1514], 1
push 0x5a2cfc
lea ecx, [ebp - 0x8024]
push ecx
push 0x80000002
lea edx, [ebp - 0x90c0]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9260], eax
mov eax, dword [ebp - 0x9260]
mov dword [ebp - 0x9264], eax
mov dword [ebp - 4], 0x26
mov ecx, dword [ebp - 0x9264]
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x7e24]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90c0]
call sub.MFC42.DLL_CString::CString
push str.LogonWinEvent
lea edx, [ebp - 0x7e24]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ea8af
push str.Sistema_Infectado_por_el_Malware_notify__n
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b851c], 0
jne 0x4ea896
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 0x1514], 1
push 0x5a2d40
lea eax, [ebp - 0x8024]
push eax
push 0x80000002
lea ecx, [ebp - 0x90c4]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9268], eax
mov edx, dword [ebp - 0x9268]
mov dword [ebp - 0x926c], edx
mov dword [ebp - 4], 0x27
mov ecx, dword [ebp - 0x926c]
call fcn.0050f0b0
push eax
lea eax, [ebp - 0x7e24]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90c4]
call sub.MFC42.DLL_CString::CString
push 0x5a2d48
lea ecx, [ebp - 0x8024]
push ecx
push 0x80000002
lea edx, [ebp - 0x90c8]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9270], eax
mov eax, dword [ebp - 0x9270]
mov dword [ebp - 0x9274], eax
mov dword [ebp - 4], 0x28
mov ecx, dword [ebp - 0x9274]
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x9024]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90c8]
call sub.MFC42.DLL_CString::CString
push 0x5a2d50
lea edx, [ebp - 0x7e24]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ea9ed
push 0x5a2d54
lea eax, [ebp - 0x9024]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ea9ed
push str.Sistema_Infectado_por_el_Morphine_notify__n
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b851c], 0
jne 0x4ea9d4
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 0x1514], 1
push 0x5a2d84
lea ecx, [ebp - 0x8024]
push ecx
push 0x80000002
lea edx, [ebp - 0x90cc]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9278], eax
mov eax, dword [ebp - 0x9278]
mov dword [ebp - 0x927c], eax
mov dword [ebp - 4], 0x29
mov ecx, dword [ebp - 0x927c]
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x7e24]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90cc]
call sub.MFC42.DLL_CString::CString
push str.OnUserLogon
lea edx, [ebp - 0x7e24]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4eaaad
push str.Sistema_Infectado_por_el_Polipos_notify__n
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b851c], 0
jne 0x4eaa94
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 0x1514], 1
push 0x5a2dc4
lea eax, [ebp - 0x8024]
push eax
push 0x80000002
lea ecx, [ebp - 0x90d0]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9280], eax
mov edx, dword [ebp - 0x9280]
mov dword [ebp - 0x9284], edx
mov dword [ebp - 4], 0x2a
mov ecx, dword [ebp - 0x9284]
call fcn.0050f0b0
push eax
lea eax, [ebp - 0x7e24]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90d0]
call sub.MFC42.DLL_CString::CString
push 0x5a2dcc
lea ecx, [ebp - 0x8024]
push ecx
push 0x80000002
lea edx, [ebp - 0x90d4]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9288], eax
mov eax, dword [ebp - 0x9288]
mov dword [ebp - 0x928c], eax
mov dword [ebp - 4], 0x2b
mov ecx, dword [ebp - 0x928c]
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x9024]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90d4]
call sub.MFC42.DLL_CString::CString
push str.UserLogOn
lea edx, [ebp - 0x7e24]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4eabeb
push str.UserLogOff
lea eax, [ebp - 0x9024]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4eabeb
push str.Sistema_Infectado_por_el_PsapiAnalyzer_n
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b851c], 0
jne 0x4eabd2
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 0x1514], 1
push str.Logon
lea ecx, [ebp - 0x8024]
push ecx
push 0x80000002
lea edx, [ebp - 0x90d8]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9290], eax
mov eax, dword [ebp - 0x9290]
mov dword [ebp - 0x9294], eax
mov dword [ebp - 4], 0x2c
mov ecx, dword [ebp - 0x9294]
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x7e24]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90d8]
call sub.MFC42.DLL_CString::CString
push 0x5a2e1c
lea edx, [ebp - 0x8024]
push edx
push 0x80000002
lea eax, [ebp - 0x90dc]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9298], eax
mov ecx, dword [ebp - 0x9298]
mov dword [ebp - 0x929c], ecx
mov dword [ebp - 4], 0x2d
mov ecx, dword [ebp - 0x929c]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x9024]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90dc]
call sub.MFC42.DLL_CString::CString
push str.WLEventStart
lea eax, [ebp - 0x7e24]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ead29
push str.WLEventStop
lea ecx, [ebp - 0x9024]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4ead29
push str.Sistema_Infectado_por_el_AdSpy_Standar_n
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b851c], 0
jne 0x4ead10
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 0x1514], 1
push 0x5a2e68
lea edx, [ebp - 0x8024]
push edx
push 0x80000002
lea eax, [ebp - 0x90e0]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x92a0], eax
mov ecx, dword [ebp - 0x92a0]
mov dword [ebp - 0x92a4], ecx
mov dword [ebp - 4], 0x2e
mov ecx, dword [ebp - 0x92a4]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x7e24]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90e0]
call sub.MFC42.DLL_CString::CString
push str.Logoff
lea eax, [ebp - 0x8024]
push eax
push 0x80000002
lea ecx, [ebp - 0x90e4]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x92a8], eax
mov edx, dword [ebp - 0x92a8]
mov dword [ebp - 0x92ac], edx
mov dword [ebp - 4], 0x2f
mov ecx, dword [ebp - 0x92ac]
call fcn.0050f0b0
push eax
lea eax, [ebp - 0x9024]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90e4]
call sub.MFC42.DLL_CString::CString
push str.SysLogon
lea ecx, [ebp - 0x7e24]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4eae25
push str.SysLogoff
lea edx, [ebp - 0x9024]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4eae9d
push str.OnEvent
lea eax, [ebp - 0x7e24]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4eae9d
push 0x5a2e98
lea ecx, [ebp - 0x7e24]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4eae6d
push str.RealLogoff
lea edx, [ebp - 0x9024]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4eae9d
push str.RealLogon
lea eax, [ebp - 0x7e24]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4eaedf
push str.PealLogoff
lea ecx, [ebp - 0x9024]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4eaedf
push str.Sistema_Infectado_por_el_VUNDO_n
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b851c], 0
jne 0x4eaec6
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 0x1514], 1
jmp 0x4e9f62
mov edx, dword [ebp - 0x6e24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x5a2ee8
lea eax, [ebp - 0x7a24]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4eaf23
push 0x5a2ef0
lea ecx, [ebp - 0x7224]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4eaf65
push str.Sistema_Infectado_por_el_Spy.Banker.GB_n
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b851c], 0
jne 0x4eaf4c
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 0x1514], 1
push 0x5a2f20
lea edx, [ebp - 0x1d14]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4eafc0
push str.Sistema_Infectado_por_el_BROWSELA_n
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b851c], 0
jne 0x4eafa7
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 0x1514], 1
push 0x5a2f4c
lea eax, [ebp - 0x1510]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4eb01b
push str.Sistema_Infectado_por_el_COMMAD_n
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b851c], 0
jne 0x4eb002
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 0x1514], 1
push 0x5a2f78
lea ecx, [ebp - 0x910]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4eb076
push str.Sistema_Infectado_por_el_CWS.AlfaSearch_n
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b851c], 0
jne 0x4eb05d
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 0x1514], 1
push 0x5a2fac
lea edx, [ebp - 0x4514]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4eb0c1
push 0x5a2fb4
lea eax, [ebp - 0x2514]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4eb0c1
push 0x5a2fbc
lea ecx, [ebp - 0x5214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4eb103
push str.Sistema_Infectado_por_el_Downloader.AXG_n
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b851c], 0
jne 0x4eb0ea
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 0x1514], 1
push 0x5a2ff0
lea edx, [ebp - 0x6e20]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4eb167
push 0x5a2ff8
lea eax, [ebp - 0x8c24]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4eb167
push 0x5a3000
lea ecx, [ebp - 0x7624]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4eb167
push 0x5a3008
lea edx, [ebp - 0x5a18]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4eb1a9
push str.Sistema_Infectado_por_el_DownLoader.Cutwail_n
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b851c], 0
jne 0x4eb190
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 0x1514], 1
push 0x5a3040
lea eax, [ebp - 0x6a20]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4eb204
push str.Sistema_Infectado_por_el_DownLoader.PHIDE_n
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b851c], 0
jne 0x4eb1eb
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 0x1514], 1
push 0x5a3074
push 0x5a307c
push 0x80000002
lea ecx, [ebp - 0x90e8]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x92b0], eax
mov edx, dword [ebp - 0x92b0]
mov dword [ebp - 0x92b4], edx
mov dword [ebp - 4], 0x30
mov ecx, dword [ebp - 0x92b4]
call fcn.0050f0b0
push eax
lea eax, [ebp - 0x3914]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90e8]
call sub.MFC42.DLL_CString::CString
push 0x5a30b4
lea ecx, [ebp - 0x3914]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4eb3da
push 0x5b8ed4
lea edx, [ebp - 0x3914]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4eb3da
push 0x5a30bc
push 0x5a30c4
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5a30fc
push 0x5a3104
push 0x80000002
lea eax, [ebp - 0x90ec]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x92b8], eax
mov ecx, dword [ebp - 0x92b8]
mov dword [ebp - 0x92bc], ecx
mov dword [ebp - 4], 0x31
mov ecx, dword [ebp - 0x92bc]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x7e24]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90ec]
call sub.MFC42.DLL_CString::CString
push 0x5a313c
lea eax, [ebp - 0x7e24]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4eb3ba
push 0x5b8ed8
lea ecx, [ebp - 0x7e24]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4eb3ba
push 0x5a3144
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b851c], 0
jne 0x4eb37a
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
lea edx, [ebp - 0x3914]
push edx
push 0x54
push 0x5a3174
push 0x5a317c
push 0x80000002
call fcn.00402bb9
add esp, 0x14
mov dword [ebp - 0x1514], 1
call fcn.004ae964
jmp 0x4eb3da
lea eax, [ebp - 0x3914]
push eax
push 0x54
push 0x5a31b4
push 0x5a31bc
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push 0x5a31f4
push 0x5a31fc
push 0x80000002
lea ecx, [ebp - 0x90f0]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x92c0], eax
mov edx, dword [ebp - 0x92c0]
mov dword [ebp - 0x92c4], edx
mov dword [ebp - 4], 0x32
mov ecx, dword [ebp - 0x92c4]
call fcn.0050f0b0
push eax
lea eax, [ebp - 0x3914]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90f0]
call sub.MFC42.DLL_CString::CString
push 0x5a3240
lea ecx, [ebp - 0x3914]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4eb5b0
push 0x5b8edc
lea edx, [ebp - 0x3914]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4eb5b0
push 0x5a3248
push 0x5a3250
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push str.system
push 0x5a329c
push 0x80000002
lea eax, [ebp - 0x90f4]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x92c8], eax
mov ecx, dword [ebp - 0x92c8]
mov dword [ebp - 0x92cc], ecx
mov dword [ebp - 4], 0x33
mov ecx, dword [ebp - 0x92cc]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x7e24]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90f4]
call sub.MFC42.DLL_CString::CString
push 0x5a32e0
lea eax, [ebp - 0x7e24]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4eb590
push 0x5b8ee0
lea ecx, [ebp - 0x7e24]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4eb590
push str.Sistema_Infectado_por_el_Flush_o_DNSChanger_n
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b851c], 0
jne 0x4eb550
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
lea edx, [ebp - 0x3914]
push edx
push 0x54
push str.Flush
push 0x5a3320
push 0x80000002
call fcn.00402bb9
add esp, 0x14
mov dword [ebp - 0x1514], 1
call fcn.004ae964
jmp 0x4eb5b0
lea eax, [ebp - 0x3914]
push eax
push 0x54
push str.System
push str.SoftwareWow6432NodeMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push 0x5a33b0
lea ecx, [ebp - 0x5614]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4eb663
push 0x5a33b8
lea edx, [ebp - 0x6220]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4eb663
push 0x5a33c0
lea eax, [ebp - 0x5e1c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4eb663
push 0x5a33c8
lea ecx, [ebp - 0x4114]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4eb663
push 0x5a33d0
lea edx, [ebp - 0x2114]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4eb663
push 0x5a33d8
lea eax, [ebp - 0x4e14]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4eb663
push 0x5a33e0
lea ecx, [ebp - 0x4914]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4eb6a5
push str.Sistema_Infectado_por_el_HAXDOOR_n
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b851c], 0
jne 0x4eb68c
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 0x1514], 1
push 0x5a340c
lea edx, [ebp - 0x3d14]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4eb700
push str.Sistema_Infectado_por_el_Malware.CBSS_n
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b851c], 0
jne 0x4eb6e7
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 0x1514], 1
push 0x5b7db4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.RPCC.DLL
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5a3448
lea eax, [ebp - 0x8824]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4eb76d
push ecx
mov ecx, esp
mov dword [ebp - 0x90f8], esp
push 0x5b6504
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 0x92d0], eax
call fcn.004ae7b8
add esp, 4
mov dword [ebp - 0x92d4], eax
cmp dword [ebp - 0x92d4], 0
je 0x4eb7af
push str.Sistema_Infectado_por_el_Malware.RPCC_n
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b851c], 0
jne 0x4eb796
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 0x1514], 1
push 0x5a3478
push 0x5a3484
push 0x80000002
lea ecx, [ebp - 0x90fc]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x92d8], eax
mov edx, dword [ebp - 0x92d8]
mov dword [ebp - 0x92dc], edx
mov dword [ebp - 4], 0x34
mov ecx, dword [ebp - 0x92dc]
call fcn.0050f0b0
push eax
lea eax, [ebp - 0x7e24]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90fc]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x7e24]
push ecx
call fcn.00401fca
add esp, 4
push 0x5b7db4
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5a34bc
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push ecx
mov ecx, esp
mov dword [ebp - 0x9100], esp
push 0x5b6504
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 0x92e0], eax
call fcn.004ae7b8
add esp, 4
mov dword [ebp - 0x92e4], eax
cmp dword [ebp - 0x92e4], 0
jne 0x4eb88f
push 0x5a34c8
lea edx, [ebp - 0x7e24]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4eb8d1
push str.Sistema_Infectado_por_el_PWS_NTOS_n
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b851c], 0
jne 0x4eb8b8
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 0x1514], 1
push 0x5a34f8
push 0x5a3504
push 0x80000002
lea eax, [ebp - 0x9104]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x92e8], eax
mov ecx, dword [ebp - 0x92e8]
mov dword [ebp - 0x92ec], ecx
mov dword [ebp - 4], 0x35
mov ecx, dword [ebp - 0x92ec]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x6620]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9104]
call sub.MFC42.DLL_CString::CString
push 0x5a353c
lea eax, [ebp - 0x6620]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ebb56
push 0x5b8ee4
lea ecx, [ebp - 0x6620]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ebb56
push 0x5a3544
push 0x5a3550
push 0x80000002
call fcn.00402ed5
add esp, 0xc
test eax, eax
jne 0x4ebb56
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x5a3588
push 0x5a3594
push 0x80000002
lea edx, [ebp - 0x9108]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x92f0], eax
mov eax, dword [ebp - 0x92f0]
mov dword [ebp - 0x92f4], eax
mov dword [ebp - 4], 0x36
mov ecx, dword [ebp - 0x92f4]
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x7e24]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9108]
call sub.MFC42.DLL_CString::CString
lea edx, [ebp - 0x7e24]
push edx
call fcn.00401fca
add esp, 4
push 0x5a35cc
lea eax, [ebp - 0x7e24]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ebb36
push 0x5b8ee8
lea ecx, [ebp - 0x7e24]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ebb36
push 0x5a35d4
lea edx, [ebp - 0x7e24]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ebb36
push str.Sistema_Infectado_por_el_Spy.ZBot_n
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b851c], 0
jne 0x4eba8a
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
lea eax, [ebp - 0x6620]
push eax
push str._Userinit___s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
lea ecx, [ebp - 0x7e24]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x5e20], eax
mov edx, dword [ebp - 0x5e20]
mov byte [ebp + edx - 0x7e25], 0
lea eax, [ebp - 0x7e24]
push eax
push 0x54
push str.ZBot
push 0x5a362c
push 0x80000002
call fcn.00402bb9
add esp, 0x14
lea ecx, [ebp - 0x6620]
push ecx
push 0x54
push 0x5a3664
push 0x5a3670
push 0x80000002
call fcn.00402bb9
add esp, 0x14
mov dword [ebp - 0x1514], 1
call fcn.004ae964
jmp 0x4ebb56
lea edx, [ebp - 0x6620]
push edx
push 0x54
push str.Userinit
push 0x5a36b4
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push 0x5a36ec
lea eax, [ebp - 0x8424]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4ebbba
push 0x5a36f4
lea ecx, [ebp - 0x510]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4ebbba
push 0x5a36fc
lea edx, [ebp - 0x1110]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4ebbba
push 0x5a3704
lea eax, [ebp - 0x1914]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ebbfc
push str.Sistema_Infectado_por_el_SDOPTIMIZER_n
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b851c], 0
jne 0x4ebbe3
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 0x1514], 1
push 0x5a3734
push 0x5a3744
push 0x80000002
lea ecx, [ebp - 0x910c]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x92f8], eax
mov edx, dword [ebp - 0x92f8]
mov dword [ebp - 0x92fc], edx
mov dword [ebp - 4], 0x37
mov ecx, dword [ebp - 0x92fc]
call fcn.0050f0b0
push eax
lea eax, [ebp - 0x3514]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x910c]
call sub.MFC42.DLL_CString::CString
push 0x5a377c
lea ecx, [ebp - 0x3514]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ebf8e
push 0x5b8eec
lea edx, [ebp - 0x3514]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ebf8e
push 0x5a3784
push 0x5a3794
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x5a37cc
push 0x5a37dc
push 0x80000002
lea eax, [ebp - 0x9110]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9300], eax
mov ecx, dword [ebp - 0x9300]
mov dword [ebp - 0x9304], ecx
mov dword [ebp - 4], 0x38
mov ecx, dword [ebp - 0x9304]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x7e24]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9110]
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x7e24]
push eax
call fcn.00401fca
add esp, 4
push 0x5a3814
lea ecx, [ebp - 0x7e24]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ebf6e
push 0x5b8ef0
lea edx, [ebp - 0x7e24]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ebf6e
push str.BINVC64LO
lea eax, [ebp - 0x7e24]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ebf6e
push 0x5a3828
lea ecx, [ebp - 0x7e24]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ebf6e
push 0x5a3834
lea edx, [ebp - 0x7e24]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ebf6e
movsx eax, byte [ebp - 0x7e23]
cmp eax, 0x3a
jne 0x4ebe23
lea ecx, [ebp - 0x7e24]
push ecx
lea edx, [ebp - 0x3514]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x3514]
push eax
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
push 0
lea ecx, [ebp - 0x3514]
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
lea edx, [ebp - 0x3514]
push edx
push 0x54
push 0x5a3840
push 0x5a3850
push 0x80000002
call fcn.00402bb9
add esp, 0x14
jmp 0x4ebf1d
push 0x5b7eb4
lea eax, [ebp - 0x3514]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5a3888
lea ecx, [ebp - 0x3514]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
lea edx, [ebp - 0x7e24]
push edx
lea eax, [ebp - 0x3514]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
lea ecx, [ebp - 0x3514]
push ecx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
push 0
lea edx, [ebp - 0x3514]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
lea eax, [ebp - 0x3514]
push eax
push 0x54
push 0x5a388c
push 0x5a389c
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push 0x5b7db4
lea ecx, [ebp - 0x3514]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5a38d4
lea edx, [ebp - 0x3514]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
lea eax, [ebp - 0x7e24]
push eax
lea ecx, [ebp - 0x3514]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
lea edx, [ebp - 0x3514]
push edx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
push 0
lea eax, [ebp - 0x3514]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
lea ecx, [ebp - 0x3514]
push ecx
push 0x54
push 0x5a38d8
push 0x5a38e8
push 0x80000002
call fcn.00402bb9
add esp, 0x14
lea edx, [ebp - 0x3514]
push edx
push 0x5a3920
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
cmp dword [0x5b851c], 0
jne 0x4ebf4e
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 0x1514], 1
call fcn.004ae964
jmp 0x4ebf8e
lea eax, [ebp - 0x3514]
push eax
push 0x54
push 0x5a3990
push 0x5a39a0
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push 0x5a39d8
push 0x5a39e8
push 0x80000002
lea ecx, [ebp - 0x9114]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9308], eax
mov edx, dword [ebp - 0x9308]
mov dword [ebp - 0x930c], edx
mov dword [ebp - 4], 0x39
mov ecx, dword [ebp - 0x930c]
call fcn.0050f0b0
push eax
lea eax, [ebp - 0x3514]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9114]
call sub.MFC42.DLL_CString::CString
push 0x5a3a2c
lea ecx, [ebp - 0x3514]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ec320
push 0x5b8ef4
lea edx, [ebp - 0x3514]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ec320
push 0x5a3a34
push 0x5a3a44
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x5a3a88
push 0x5a3a98
push 0x80000002
lea eax, [ebp - 0x9118]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9310], eax
mov ecx, dword [ebp - 0x9310]
mov dword [ebp - 0x9314], ecx
mov dword [ebp - 4], 0x3a
mov ecx, dword [ebp - 0x9314]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x7e24]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9118]
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x7e24]
push eax
call fcn.00401fca
add esp, 4
push 0x5a3adc
lea ecx, [ebp - 0x7e24]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ec300
push 0x5b8ef8
lea edx, [ebp - 0x7e24]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ec300
push str.BINVC32LO
lea eax, [ebp - 0x7e24]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ec300
push str.CSAUSER.DLL
lea ecx, [ebp - 0x7e24]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ec300
push str.WINMM.DLL
lea edx, [ebp - 0x7e24]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ec300
movsx eax, byte [ebp - 0x7e23]
cmp eax, 0x3a
jne 0x4ec1b5
lea ecx, [ebp - 0x7e24]
push ecx
lea edx, [ebp - 0x3514]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x3514]
push eax
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
push 0
lea ecx, [ebp - 0x3514]
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
lea edx, [ebp - 0x3514]
push edx
push 0x54
push 0x5a3b08
push 0x5a3b18
push 0x80000002
call fcn.00402bb9
add esp, 0x14
jmp 0x4ec2af
push 0x5b7eb4
lea eax, [ebp - 0x3514]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5a3b5c
lea ecx, [ebp - 0x3514]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
lea edx, [ebp - 0x7e24]
push edx
lea eax, [ebp - 0x3514]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
lea ecx, [ebp - 0x3514]
push ecx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
push 0
lea edx, [ebp - 0x3514]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
lea eax, [ebp - 0x3514]
push eax
push 0x54
push str.TroyanoAppInit2
push 0x5a3b70
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push 0x5b7db4
lea ecx, [ebp - 0x3514]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5a3bb4
lea edx, [ebp - 0x3514]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
lea eax, [ebp - 0x7e24]
push eax
lea ecx, [ebp - 0x3514]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
lea edx, [ebp - 0x3514]
push edx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
push 0
lea eax, [ebp - 0x3514]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
lea ecx, [ebp - 0x3514]
push ecx
push 0x54
push str.TroyanoAppInit1
push 0x5a3bc8
push 0x80000002
call fcn.00402bb9
add esp, 0x14
lea edx, [ebp - 0x3514]
push edx
push str.Sistema_Infectado_por_Troyano_de_AppInit_n_s_nPuede_Requerir_Arrancar_en_Consola_de_Reparaci
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
cmp dword [0x5b851c], 0
jne 0x4ec2e0
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 0x1514], 1
call fcn.004ae964
jmp 0x4ec320
lea eax, [ebp - 0x3514]
push eax
push 0x54
push 0x5a3c7c
push 0x5a3c8c
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push 0x5a3cd0
push 0x5a3ce8
push 0x80000002
lea ecx, [ebp - 0x911c]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9318], eax
mov edx, dword [ebp - 0x9318]
mov dword [ebp - 0x931c], edx
mov dword [ebp - 4], 0x3b
mov ecx, dword [ebp - 0x931c]
call fcn.0050f0b0
push eax
push 0x5b4b28
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x911c]
call sub.MFC42.DLL_CString::CString
push 0x5a3d10
push 0x5b4b28
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4ec5ff
push 0x5b8efc
push 0x5b4b28
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ec5ff
push 0x5a3d18
push 0x4d
push 0x5a3d20
push 0x5a3d38
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x5a3d60
push 0x5a3d78
push 0x80000002
lea eax, [ebp - 0x9120]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x9320], eax
mov ecx, dword [ebp - 0x9320]
mov dword [ebp - 0x9324], ecx
mov dword [ebp - 4], 0x3c
mov ecx, dword [ebp - 0x9324]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x7e24]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9120]
call sub.MFC42.DLL_CString::CString
push str.msv1_0
lea eax, [ebp - 0x7e24]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ec5e1
push 0x5b4b28
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x5e20], eax
mov ecx, dword [ebp - 0x5e20]
mov dword [0x5b84b8], ecx
jmp 0x4ec490
mov edx, dword [0x5b84b8]
sub edx, 1
mov dword [0x5b84b8], edx
cmp dword [0x5b84b8], 0xffffffff
jle 0x4ec4ae
mov eax, dword [0x5b84b8]
movsx ecx, byte [eax + 0x5b4b28]
cmp ecx, 0xa
jne 0x4ec4ac
jmp 0x4ec4ae
jmp 0x4ec481
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
mov dword [ebp - 0x5618], 0
jmp 0x4ec4e5
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov ecx, dword [ebp - 0x5618]
add ecx, 1
mov dword [ebp - 0x5618], ecx
mov edx, dword [0x5b84b8]
cmp edx, dword [ebp - 0x5e20]
jge 0x4ec50d
mov eax, dword [ebp - 0x5618]
mov ecx, dword [0x5b84b8]
mov dl, byte [ecx + 0x5b4b28]
mov byte [eax + 0x5b4b28], dl
jmp 0x4ec4c9
mov eax, dword [ebp - 0x5618]
mov byte [eax + 0x5b4b28], 0
push 0x5b4b28
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x5e20], eax
mov ecx, dword [ebp - 0x5e20]
movsx edx, byte [ecx + 0x5b4b24]
cmp edx, 0x2e
je 0x4ec551
push str..DLL
push 0x5b4b28
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b4b28
call fcn.00401fca
add esp, 4
push str.SESAMI.DLL
push 0x5b4b28
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4ec5df
push 0x5b4b28
push 0x54
push str.Vundo9
push 0x5a3dc4
push 0x80000002
call fcn.00402bb9
add esp, 0x14
mov dword [ebp - 0x1514], 1
call fcn.004ae964
push 0x5b4b28
push str.Sistema_Infectado_por_el_Vundo9_n__s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
cmp dword [0x5b851c], 0
jne 0x4ec5d0
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
jmp 0x4ec5ff
push 0x5b4b28
push 0x4d
push str.Authentication_Packages
push str.SYSTEMCurrentControlSetControlLsa
push 0x80000002
call fcn.00402bb9
add esp, 0x14
cmp dword [ebp - 0x1514], 0
jne 0x4ec60d
jmp 0x4ec7e9
lea eax, [ebp - 0x9124]
push eax
call fcn.00401d93
add esp, 4
mov dword [ebp - 0x9328], eax
mov ecx, dword [ebp - 0x9328]
mov dword [ebp - 0x932c], ecx
mov dword [ebp - 4], 0x3d
mov ecx, dword [ebp - 0x932c]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x4a14]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9124]
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x4a14]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x5e20], eax
mov ecx, dword [ebp - 0x5e20]
mov dword [0x5b84b8], ecx
jmp 0x4ec694
mov edx, dword [0x5b84b8]
sub edx, 1
mov dword [0x5b84b8], edx
cmp dword [0x5b84b8], 0
jle 0x4ec6c1
mov eax, dword [0x5b84b8]
movsx ecx, byte [ebp + eax - 0x4a14]
cmp ecx, 0x5c
jne 0x4ec6bf
mov edx, dword [0x5b84b8]
mov byte [ebp + edx - 0x4a14], 0
jmp 0x4ec6c1
jmp 0x4ec685
push str.EliNotif.dll
lea eax, [ebp - 0x4a14]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
push ecx
mov ecx, esp
mov dword [ebp - 0x9128], esp
lea edx, [ebp - 0x4a14]
push edx
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 0x9330], eax
call fcn.004ae7b8
add esp, 4
mov dword [ebp - 0x9334], eax
cmp dword [ebp - 0x9334], 0
jne 0x4ec732
cmp dword [0x5b851c], 0
jne 0x4ec71e
push 0
push 0
push str.No_Detectada_Utilidad__ELINOTIF.DLL__n_Necesaria_para_la_Limpieza__nPor_favor__bajeseala_de_la_Secci
call sub.MFC42.DLL_AfxMessageBox
push str.No_Detectada_Utilidad__ELINOTIF.DLL___Necesaria_para_la_Limpieza__n
mov ecx, 0x5b5b78
call fcn.0050f680
jmp 0x4ec7e9
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogonNotifySatinfo
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5a3f9c
push 0x44
push str.Asynchronous
push 0x5b6504
push 0x80000002
call fcn.00402bb9
add esp, 0x14
lea eax, [ebp - 0x4a14]
push eax
push 0x54
push str.DllName
push 0x5b6504
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push 0x5a3fb8
push 0x44
push str.Impersonate
push 0x5b6504
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push str.EliNotify
push 0x54
push 0x5a3fd4
push 0x5b6504
push 0x80000002
call fcn.00402bb9
add esp, 0x14
cmp dword [0x5b851c], 0
jne 0x4ec7d5
push 0
push 0
push str.Instalada_Utilidad__ELINOTIF.DLL__nReinicie_de_Nuevo_para_Completar_la_Limpieza._nCompruebe_que_es_una_Veri
call sub.MFC42.DLL_AfxMessageBox
push str.Instalada_Utilidad__ELINOTIF.DLL___Reinicie_de_Nuevo_para_Completar_la_Limpieza__n
mov ecx, 0x5b5b78
call fcn.0050f680
call fcn.004ae964
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret