Function at 0x4012e0
Capabilities:
Check if file exists
Delete file
Enumerate files on windows
Enumerate processes
Get common file path
Get file size
Move file
Query environment variable
Read file on windows
Terminate process
Terminate process by name
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x18684
call fcn.0040ac80
mov eax, dword [0x411034]
xor eax, esp
mov dword [esp + 0x18680], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
push str._silent
push edi
mov dword [esp + 0x20], edi
call fcn.00404153
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
add esp, 8
test eax, eax
je 0x4013a4
push str._silentnoiekill
push edi
call fcn.00404153
add esp, 8
test eax, eax
je 0x4013a4
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ecx, 0x412
cmp ax, cx
jne 0x401370
push str._uninstall
push edi
call fcn.00404153
add esp, 8
push 0x40001
push 0x40ebf7
test eax, eax
jne 0x401369
push 0x40ec28
jmp 0x40137f
push 0x40ec80
jmp 0x40137f
push 0x40001
push 0x40ebf7
push str.All_browsers_should_be_shut_down._When_you_click_OK__All_browsers_should_be_closed.
push 0
call esi
cmp eax, 1
je 0x4013a4
mov eax, 0xffffff9c
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18680]
xor ecx, esp
call fcn.00403988
mov esp, ebp
pop ebp
ret 0x10
call fcn.004038b0
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.c:Program_FilesTerutenWebCubeAgentCubeU_.exe
call esi
push str.c:Program_FilesTerutenWebCubeAgentCubeU64_.exe
call esi
push str.c:Program_FilesTerutenWebCubeAgentCubeU64A_.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU_.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64_.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64A_.exe
call esi
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.c:Program_FilesTerutenWebCubeAgentCubeU_.exe
push str.c:Program_FilesTerutenWebCubeAgentCubeU.exe
call esi
push str.c:Program_FilesTerutenWebCubeAgentCubeU64_.exe
push str.c:Program_FilesTerutenWebCubeAgentCubeU64.exe
call esi
push str.c:Program_FilesTerutenWebCubeAgentCubeU64A_.exe
push str.c:Program_FilesTerutenWebCubeAgentCubeU64A.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU_.exe
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64_.exe
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64A_.exe
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64A.exe
call esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0x10], esi
cmp esi, 0xffffffff
jne 0x401455
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18680]
xor ecx, esp
call fcn.00403988
mov esp, ebp
pop ebp
ret 0x10
lea edx, [esp + 0x28]
push edx
push esi
mov dword [esp + 0x30], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x401490
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18680]
xor ecx, esp
call fcn.00403988
mov esp, ebp
pop ebp
ret 0x10
lea eax, [esp + 0x4c]
mov dword [esp + 0x2c0], 0xf
mov dword [esp + 0x2bc], 0
mov byte [esp + 0x2ac], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4014b5
sub eax, edx
push eax
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x2b0]
call fcn.004031c0
mov edx, dword [esp + 0x2c0]
mov ecx, dword [esp + 0x2ac]
cmp edx, 0x10
jb 0x401d2e
mov dword [esp + 0xc], ecx
test ecx, ecx
je 0x401520
mov eax, ecx
cmp edx, 0x10
jae 0x4014fd
lea eax, [esp + 0x2ac]
cmp eax, dword [esp + 0xc]
ja 0x401520
mov eax, ecx
cmp edx, 0x10
jae 0x401511
lea eax, [esp + 0x2ac]
mov ebx, dword [esp + 0x2bc]
add eax, ebx
cmp dword [esp + 0xc], eax
jbe 0x40153a
call fcn.00403eb9
mov edx, dword [esp + 0x2c0]
mov ebx, dword [esp + 0x2bc]
mov ecx, dword [esp + 0x2ac]
mov eax, ecx
cmp edx, 0x10
jae 0x401548
lea eax, [esp + 0x2ac]
lea edi, [ebx + eax]
test edi, edi
je 0x401575
mov eax, ecx
cmp edx, 0x10
jae 0x40155d
lea eax, [esp + 0x2ac]
cmp eax, edi
ja 0x401575
mov eax, ecx
cmp edx, 0x10
jae 0x40156f
lea eax, [esp + 0x2ac]
add eax, ebx
cmp edi, eax
jbe 0x40158f
call fcn.00403eb9
mov edx, dword [esp + 0x2c0]
mov ebx, dword [esp + 0x2bc]
mov ecx, dword [esp + 0x2ac]
cmp edx, 0x10
jb 0x401d3e
mov esi, ecx
test ecx, ecx
je 0x4015c4
mov eax, ecx
cmp edx, 0x10
jae 0x4015ac
lea eax, [esp + 0x2ac]
cmp eax, esi
ja 0x4015c4
mov eax, ecx
cmp edx, 0x10
jae 0x4015be
lea eax, [esp + 0x2ac]
add ebx, eax
cmp esi, ebx
jbe 0x4015c9
call fcn.00403eb9
mov ecx, dword [esp + 0xc]
push ecx
lea eax, [esp + 0x2ac]
push eax
mov eax, dword [esp + 0x298]
mov byte [esp + 0x28], 0
mov edx, dword [esp + 0x28]
push edx
push eax
push edi
lea ecx, [esp + 0x2a4]
push esi
push ecx
call fcn.00403820
add esp, 0x1c
push 0xf
push str.tuctlsystem.exe
lea edx, [esp + 0x2b0]
push edx
call fcn.004032d0
cmp eax, 0xffffffff
je 0x401634
mov eax, dword [esp + 0x30]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x2c0], 0x10
jb 0x40164e
mov ecx, dword [esp + 0x2ac]
push ecx
call fcn.00403ab9
add esp, 4
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x28]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401490
push eax
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0x10], esi
cmp esi, 0xffffffff
je 0x40143b
lea ecx, [esp + 0x28]
push ecx
push esi
mov dword [esp + 0x30], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40146c
jmp 0x4016a0
lea eax, [esp + 0x4c]
mov dword [esp + 0x2c0], 0xf
mov dword [esp + 0x2bc], 0
mov byte [esp + 0x2ac], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4016c5
sub eax, edx
push eax
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x2b0]
call fcn.004031c0
mov edx, dword [esp + 0x2c0]
mov ecx, dword [esp + 0x2ac]
cmp edx, 0x10
jb 0x401d4a
mov dword [esp + 0xc], ecx
test ecx, ecx
je 0x401730
mov eax, ecx
cmp edx, 0x10
jae 0x40170d
lea eax, [esp + 0x2ac]
cmp eax, dword [esp + 0xc]
ja 0x401730
mov eax, ecx
cmp edx, 0x10
jae 0x401721
lea eax, [esp + 0x2ac]
mov ebx, dword [esp + 0x2bc]
add eax, ebx
cmp dword [esp + 0xc], eax
jbe 0x40174a
call fcn.00403eb9
mov edx, dword [esp + 0x2c0]
mov ebx, dword [esp + 0x2bc]
mov ecx, dword [esp + 0x2ac]
mov eax, ecx
cmp edx, 0x10
jae 0x401758
lea eax, [esp + 0x2ac]
lea edi, [eax + ebx]
test edi, edi
je 0x401785
mov eax, ecx
cmp edx, 0x10
jae 0x40176d
lea eax, [esp + 0x2ac]
cmp eax, edi
ja 0x401785
mov eax, ecx
cmp edx, 0x10
jae 0x40177f
lea eax, [esp + 0x2ac]
add eax, ebx
cmp edi, eax
jbe 0x40179f
call fcn.00403eb9
mov edx, dword [esp + 0x2c0]
mov ebx, dword [esp + 0x2bc]
mov ecx, dword [esp + 0x2ac]
cmp edx, 0x10
jb 0x401d5a
mov esi, ecx
test ecx, ecx
je 0x4017d4
mov eax, ecx
cmp edx, 0x10
jae 0x4017bc
lea eax, [esp + 0x2ac]
cmp eax, esi
ja 0x4017d4
mov eax, ecx
cmp edx, 0x10
jae 0x4017ce
lea eax, [esp + 0x2ac]
add eax, ebx
cmp esi, eax
jbe 0x4017d9
call fcn.00403eb9
mov ecx, dword [esp + 0xc]
push ecx
lea eax, [esp + 0x2ac]
push eax
mov eax, dword [esp + 0x298]
mov byte [esp + 0x28], 0
mov edx, dword [esp + 0x28]
push edx
push eax
push edi
lea ecx, [esp + 0x2a4]
push esi
push ecx
call fcn.00403820
add esp, 0x1c
push 0xa
push str.chrome.exe
lea edx, [esp + 0x2b0]
push edx
call fcn.004032d0
cmp eax, 0xffffffff
jne 0x401a98
push 0xb
push str.firefox.exe
lea eax, [esp + 0x2b0]
push eax
call fcn.004032d0
cmp eax, 0xffffffff
jne 0x401a98
push 9
push str.opera.exe
lea ecx, [esp + 0x2b0]
push ecx
call fcn.004032d0
cmp eax, 0xffffffff
jne 0x401a98
push 0xa
push str.safari.exe
lea edx, [esp + 0x2b0]
push edx
call fcn.004032d0
cmp eax, 0xffffffff
jne 0x401a98
lea eax, [esp + 0x2a8]
push eax
mov edx, str.cubee.exe
call fcn.004031a0
cmp eax, 0xffffffff
jne 0x401a98
lea ecx, [esp + 0x2a8]
push ecx
mov edx, str.cubeu.exe
call fcn.004031a0
cmp eax, 0xffffffff
jne 0x401a98
lea edx, [esp + 0x2a8]
push edx
mov edx, str.cubeu64.exe
call fcn.004031a0
cmp eax, 0xffffffff
jne 0x401a98
lea eax, [esp + 0x2a8]
push eax
mov edx, str.cubeu64a.exe
call fcn.004031a0
cmp eax, 0xffffffff
jne 0x401a98
lea ecx, [esp + 0x2a8]
push ecx
mov edx, str.iexplore.exe
call fcn.004031a0
cmp eax, 0xffffffff
je 0x40191b
mov edx, dword [esp + 0x18]
push str._silentnoiekill
push edx
call fcn.00404153
add esp, 8
test eax, eax
jne 0x401a98
lea eax, [esp + 0x2a8]
push eax
mov edx, str.tmw.exe
call fcn.004031a0
cmp eax, 0xffffffff
jne 0x401a98
lea ecx, [esp + 0x2a8]
push ecx
mov edx, str.tmw64a.exe
call fcn.004031a0
cmp eax, 0xffffffff
jne 0x401a98
lea edx, [esp + 0x2a8]
push edx
mov edx, str.tmw64.exe
call fcn.004031a0
cmp eax, 0xffffffff
jne 0x401a98
lea eax, [esp + 0x2a8]
push eax
mov edx, str.webcubeagent.exe
call fcn.004031a0
cmp eax, 0xffffffff
jne 0x401a98
lea ecx, [esp + 0x2a8]
push ecx
mov edx, str.turound.exe
call fcn.004031a0
cmp eax, 0xffffffff
jne 0x401a98
lea edx, [esp + 0x2a8]
push edx
mov edx, str.turound64.exe
call fcn.004031a0
cmp eax, 0xffffffff
jne 0x401a98
lea eax, [esp + 0x2a8]
push eax
mov edx, str.turound64a.exe
call fcn.004031a0
cmp eax, 0xffffffff
jne 0x401a98
lea ecx, [esp + 0x2a8]
push ecx
mov edx, str.texe.exe
call fcn.004031a0
cmp eax, 0xffffffff
jne 0x401a98
lea edx, [esp + 0x2a8]
push edx
mov edx, str.texe64.exe
call fcn.004031a0
cmp eax, 0xffffffff
jne 0x401a98
lea eax, [esp + 0x2a8]
push eax
mov edx, str.texe64a.exe
call fcn.004031a0
cmp eax, 0xffffffff
jne 0x401a98
lea ecx, [esp + 0x2a8]
push ecx
mov edx, str.tremote_server.exe
call fcn.004031a0
cmp eax, 0xffffffff
jne 0x401a98
lea edx, [esp + 0x2a8]
push edx
mov edx, str.microsoftedge.exe
call fcn.004031a0
cmp eax, 0xffffffff
jne 0x401a98
lea eax, [esp + 0x2a8]
push eax
mov edx, str.microsoftedgecp.exe
call fcn.004031a0
cmp eax, 0xffffffff
jne 0x401a98
lea ecx, [esp + 0x2a8]
push ecx
mov edx, str.w_browser.exe
call fcn.004031a0
cmp eax, 0xffffffff
jne 0x401a98
lea edx, [esp + 0x2a8]
push edx
mov edx, str.msedge.exe
call fcn.004031a0
cmp eax, 0xffffffff
je 0x401ab9
mov eax, dword [esp + 0x30]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x2c0], 0x10
jb 0x401ad3
mov ecx, dword [esp + 0x2ac]
push ecx
call fcn.00403ab9
add esp, 4
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x28]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4016a0
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.c:Program_FilesTerutenWebCubeAgentCubeU_.exe
call esi
push str.c:Program_FilesTerutenWebCubeAgentCubeU64_.exe
call esi
push str.c:Program_FilesTerutenWebCubeAgentCubeU64A_.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU_.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64_.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64A_.exe
call esi
push 0x103
lea edx, [esp + 0x585]
push 0
push edx
mov byte [esp + 0x58c], 0
call fcn.00404760
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
add esp, 0xc
push 0
push 0x1c
lea eax, [esp + 0x588]
push eax
push 0
call esi
push str.MicrosoftInternet_ExplorerRecovery
lea ecx, [esp + 0x584]
push 0x104
push ecx
call fcn.00403f31
lea edx, [esp + 0x58c]
add esp, 0xc
push edx
call fcn.00401160
add esp, 4
push 0
push 0x1c
lea eax, [esp + 0x690]
push eax
push 0
call esi
push str.GoogleChromeUser_DataDefaultPreferences
lea ecx, [esp + 0x68c]
push 0x7fff
push ecx
call fcn.00403f31
add esp, 0xc
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea edx, [esp + 0x6a0]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x401d82
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
add ebx, 0x3e8
push ebx
call fcn.004042fa
add esp, 4
push 0
mov esi, eax
lea eax, [esp + 0x14]
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x10]
push ecx
push esi
mov edx, str.exit_type
call fcn.004010c0
mov edx, dword [esp + 0x18]
push edx
push esi
mov edx, str._exit_type_:_Crashed_
mov ebx, eax
call fcn.004010c0
add esp, 0x10
cmp eax, 0xffffffff
je 0x401d66
mov eax, dword [esp + 0x10]
sub eax, ebx
push eax
lea ecx, [ebx + esi]
push ecx
call fcn.004010c0
mov edx, dword [str._exit_type_:_Normal_]
mov ecx, dword [0x40f1a0]
add esp, 8
add ebx, eax
mov eax, dword [0x40f19c]
mov dword [esp + 0x294], eax
mov eax, dword [0x40f1a8]
mov dword [esp + 0x290], edx
mov edx, dword [0x40f1a4]
mov dword [esp + 0x298], ecx
mov cl, byte [0x40f1ac]
mov dword [esp + 0x2a0], eax
lea eax, [esp + 0x290]
mov dword [esp + 0x29c], edx
mov byte [esp + 0x2a4], cl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401ca8
sub eax, edx
mov ecx, eax
lea eax, [ebx + 1]
cmp eax, dword [esp + 0x10]
jge 0x401cce
lea esp, [esp]
mov dl, byte [eax + esi]
mov byte [eax + esi - 1], dl
inc eax
cmp eax, dword [esp + 0x10]
jl 0x401cc0
mov byte [eax + esi - 1], 0
push ecx
lea eax, [esp + 0x294]
push eax
add ebx, esi
push ebx
call fcn.004047e0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
push edi
call ebx
push 0
push 0
push 5
push 0
push 0
push 0x40000000
lea ecx, [esp + 0x6a0]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x401d6d
mov eax, dword [esp + 0x10]
push 0
lea edx, [esp + 0x14]
push edx
dec eax
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call ebx
jmp 0x401d6d
lea eax, [esp + 0x2ac]
mov dword [esp + 0xc], eax
jmp 0x4014ef
lea esi, [esp + 0x2ac]
jmp 0x40159e
lea eax, [esp + 0x2ac]
mov dword [esp + 0xc], eax
jmp 0x4016ff
lea esi, [esp + 0x2ac]
jmp 0x4017ae
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.00403bfd
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
add esp, 4
push 0
push 0x1c
lea ecx, [esp + 0x2f8]
push ecx
push 0
call esi
push str.GoogleChromeUser_DataDefaultCurrent_Session
lea edx, [esp + 0x2f4]
push 0x104
push edx
call fcn.00403f31
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
lea eax, [esp + 0x2f0]
push eax
call edi
push 0x40ebf7
lea ecx, [esp + 0x2f4]
push 0x104
push ecx
call fcn.00403ec9
add esp, 0xc
push 0
push 0x1c
lea edx, [esp + 0x2f8]
push edx
push 0
call esi
push str.GoogleChromeUser_DataDefaultCookies
lea eax, [esp + 0x2f4]
push 0x104
push eax
call fcn.00403f31
add esp, 0xc
lea ecx, [esp + 0x2f0]
push ecx
call edi
xor edi, edi
lea esp, [esp]
lea edx, [esp + 0x3f8]
push edx
lea eax, [esp + 0x2f4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x401e4d
push 0x12c
call ebx
lea ecx, [esp + 0x2f0]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x12c
call ebx
inc edi
cmp edi, 5
jl 0x401e10
mov edx, dword [esp + 0x18]
push str._uninstall
push edx
call fcn.00404153
add esp, 8
test eax, eax
je 0x403133
push 0
push 0x1c
lea eax, [esp + 0x690]
push eax
push 0
call esi
push str.GoogleChromeUser_DataLocal_State
lea ecx, [esp + 0x68c]
push 0x7fff
push ecx
call fcn.00403f31
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
add esp, 0xc
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea edx, [esp + 0x6a0]
push edx
call edi
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x402112
push 0
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
add esi, 0x3e8
push esi
call fcn.004042fa
add esp, 4
push 0
mov ebx, eax
lea eax, [esp + 0x10]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [esp + 0xc]
push edi
push ebx
mov edx, str.protocol_handler
call fcn.004010c0
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
jne 0x401f5e
mov ecx, 0x10
mov esi, str._protocol_handler_:___excluded_schemes_:___webcube_:false___
lea edi, [esp + 0x2a8]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x2a8]
movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401f23
sub eax, edx
mov edi, eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], edi
cmp eax, 1
jb 0x401f4c
lea esi, [edi + ebx]
mov edi, edi
mov cl, byte [eax + ebx]
mov byte [esi + eax], cl
dec eax
cmp eax, 1
jae 0x401f40
push edi
lea edx, [esp + 0x2ac]
push edx
lea eax, [ebx + 1]
push eax
jmp 0x4020ad
mov eax, edi
sub eax, esi
lea ecx, [esi + ebx]
push eax
push ecx
mov edx, str._webcube_:true
mov dword [esp + 0x20], eax
call fcn.004010c0
mov ecx, dword [esp + 0x20]
add esp, 8
cmp eax, 0xffffffff
push ecx
lea eax, [esi + ebx]
push eax
je 0x40200d
call fcn.004010c0
mov edx, dword [str._webcube_:false]
mov ecx, dword [0x40f2ac]
add esp, 8
add esi, eax
mov eax, dword [0x40f2a8]
mov dword [esp + 0x290], edx
mov edx, dword [0x40f2b0]
mov dword [esp + 0x294], eax
lea eax, [esp + 0x290]
mov dword [esp + 0x29c], edx
mov dword [esp + 0x298], ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401fd1
sub eax, edx
cmp edi, esi
jle 0x401fef
lea ecx, [edi + ebx + 1]
sub edi, esi
mov dl, byte [ecx - 1]
mov byte [ecx], dl
dec ecx
sub edi, 1
jne 0x401fe4
push eax
lea eax, [esp + 0x294]
push eax
add esi, ebx
push esi
call fcn.004047e0
mov dword [esp + 0x20], 1
jmp 0x4020b2
mov edx, str.excluded_schemes
call fcn.004010c0
add esi, eax
add esp, 8
cmp byte [esi + ebx], 0x7b
je 0x402029
inc esi
cmp byte [esi + ebx], 0x7b
jne 0x402022
mov eax, dword [0x40f2cc]
mov edx, dword [str._webcube_:false_]
mov ecx, dword [0x40f2d0]
mov dword [esp + 0x294], eax
mov al, byte [0x40f2d8]
mov dword [esp + 0x290], edx
mov edx, dword [0x40f2d4]
mov byte [esp + 0x2a0], al
lea eax, [esp + 0x290]
mov dword [esp + 0x29c], edx
mov dword [esp + 0x298], ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402072
sub eax, edx
cmp edi, esi
mov ecx, eax
mov dword [esp + 0x14], ecx
mov eax, edi
jle 0x40209b
lea edi, [ecx + ebx]
lea ebx, [ebx]
mov cl, byte [eax + ebx]
mov byte [edi + eax], cl
dec eax
cmp eax, esi
jg 0x402090
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x294]
push eax
lea ecx, [esi + ebx + 1]
push ecx
call fcn.004047e0
mov edx, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
push edx
call edi
push 0
push 0
push 5
push 0
push 0
push 0x40000000
lea eax, [esp + 0x6a0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x402103
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x10]
push ecx
add eax, edx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call edi
push ebx
call fcn.00403bfd
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
add esp, 4
push 0x7fff
lea ecx, [esp + 0x68c]
push ecx
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push str.Opera_SoftwareOpera_StableLocal_State
lea edx, [esp + 0x68c]
push 0x7fff
push edx
call fcn.00403f31
add esp, 0xc
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea eax, [esp + 0x6a0]
push eax
call edi
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x4023da
push 0
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
add esi, 0x3e8
push esi
call fcn.004042fa
add esp, 4
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
mov ebx, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [esp + 0xc]
push edi
push ebx
mov edx, str.protocol_handler
call fcn.004010c0
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
jne 0x40220c
mov ecx, 0x10
mov esi, str._protocol_handler_:___excluded_schemes_:___webcube_:_false___
lea edi, [esp + 0x2a8]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x2a8]
movsw word es:[edi], word [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4021d1
sub eax, edx
mov edi, eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], edi
cmp eax, 1
jb 0x4021fc
lea esi, [edi + ebx]
lea esp, [esp]
mov dl, byte [eax + ebx]
mov byte [esi + eax], dl
dec eax
cmp eax, 1
jae 0x4021f0
push edi
lea eax, [esp + 0x2ac]
lea ecx, [ebx + 1]
jmp 0x402373
mov eax, edi
sub eax, esi
lea ecx, [esi + ebx]
push eax
push ecx
mov edx, str._webcube_:_true
mov dword [esp + 0x20], eax
call fcn.004010c0
add esp, 8
cmp eax, 0xffffffff
lea eax, [esi + ebx]
je 0x4022cc
mov edx, dword [esp + 0x18]
push edx
push eax
mov edx, str._webcube_:_true
call fcn.004010c0
mov ecx, dword [0x40f368]
mov edx, dword [0x40f36c]
add esp, 8
add esi, eax
mov eax, dword [str._webcube_:_false]
mov dword [esp + 0x290], eax
mov eax, dword [0x40f370]
mov dword [esp + 0x294], ecx
mov cl, byte [0x40f374]
mov dword [esp + 0x29c], eax
lea eax, [esp + 0x290]
mov dword [esp + 0x298], edx
mov byte [esp + 0x2a0], cl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402290
sub eax, edx
cmp edi, esi
jle 0x4022ae
lea ecx, [edi + ebx + 1]
sub edi, esi
mov dl, byte [ecx - 1]
mov byte [ecx], dl
dec ecx
sub edi, 1
jne 0x4022a3
push eax
lea eax, [esp + 0x294]
push eax
add esi, ebx
push esi
call fcn.004047e0
mov dword [esp + 0x20], 1
jmp 0x40237a
mov ecx, dword [esp + 0x18]
push ecx
push eax
mov edx, str.excluded_schemes
call fcn.004010c0
add esi, eax
add esp, 8
cmp byte [esi + ebx], 0x7b
je 0x4022ee
inc esi
cmp byte [esi + ebx], 0x7b
jne 0x4022e7
mov eax, dword [0x40f37c]
mov edx, dword [str._webcube_:_false_]
mov ecx, dword [0x40f380]
mov dword [esp + 0x294], eax
mov ax, word [0x40f388]
mov dword [esp + 0x290], edx
mov edx, dword [0x40f384]
mov word [esp + 0x2a0], ax
lea eax, [esp + 0x290]
mov dword [esp + 0x29c], edx
mov dword [esp + 0x298], ecx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402340
sub eax, edx
cmp edi, esi
mov ecx, eax
mov dword [esp + 0x14], ecx
mov eax, edi
jle 0x402363
lea edi, [ecx + ebx]
mov cl, byte [eax + ebx]
mov byte [edi + eax], cl
dec eax
cmp eax, esi
jg 0x402358
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x294]
lea ecx, [esi + ebx + 1]
push eax
push ecx
call fcn.004047e0
mov edx, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
push edx
call edi
push 0
push 0
push 5
push 0
push 0
push 0x40000000
lea eax, [esp + 0x6a0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4023cb
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x10]
push ecx
add eax, edx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call edi
push ebx
call fcn.00403bfd
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
add esp, 4
push 0x7fff
lea ecx, [esp + 0x68c]
push ecx
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push str.MozillaFirefoxProfilesdefault
lea edx, [esp + 0x68c]
push 0x7fff
push edx
call fcn.00403f31
add esp, 0xc
lea eax, [esp + 0x150]
push eax
lea ecx, [esp + 0x68c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40263e
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x688]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402440
sub eax, edx
cmp byte [esp + eax + 0x687], 0x5c
je 0x402467
lea ecx, [esp + 0x688]
dec ecx
jmp 0x402460
dec eax
cmp byte [ecx + eax], 0x5c
jne 0x402460
lea edx, [esp + 0x17c]
push edx
mov ecx, 0x7fff
sub ecx, eax
push ecx
lea edx, [esp + eax + 0x690]
push edx
call fcn.00403ec9
add esp, 0xc
push str.mimeTypes.rdf
lea eax, [esp + 0x68c]
push 0x7fff
push eax
call fcn.00403f31
add esp, 0xc
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea ecx, [esp + 0x6a0]
push ecx
call edi
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x40263e
push 0
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
add ebx, 0x3e8
push ebx
call fcn.004042fa
add esp, 4
push 0
lea edx, [esp + 0x10]
push edx
mov esi, eax
push ebx
push esi
push edi
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0xc]
push eax
push esi
mov edx, str._RDF:Description
call fcn.004010c0
add esp, 8
cmp eax, 0xffffffff
jne 0x402582
mov ecx, 0x61
mov esi, str.__xml_version_1.0____RDF:RDF_xmlns:NC_http:__home.netscape.com_NC_rdf__xmlns:RDF_http:__www.w3.org_1999_02_22_rdf_syntax_ns___RDF:Description_RDF:about_urn:scheme:webcube__NC:value_webcube___NC:handlerProp_RDF:resource_urn:scheme:handler:webcube_____RDF:Description__RDF:Description_RDF:about_urn:scheme:handler:webcube__NC:useSystemDefault_true__NC:alwaysAsk_false______RDF:RDF_
lea edi, [esp + 0x3f8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [esp + 0x3f8]
movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402535
sub eax, edx
mov edi, eax
lea esi, [edi + 1]
cmp ebx, esi
jae 0x402561
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00403bfd
add esp, 4
push esi
call fcn.004042fa
add esp, 4
mov ebx, eax
jmp 0x402565
mov ebx, dword [esp + 0x14]
lea edx, [esp + 0x3f8]
push edx
push esi
push ebx
mov dword [esp + 0x18], 0
call fcn.00403ec9
mov byte [edi + ebx], 0
jmp 0x4025e0
mov ecx, 0x3e
mov esi, str._RDF:Description_RDF:about_urn:scheme:webcube__NC:value_webcube___NC:handlerProp_RDF:resource_urn:scheme:handler:webcube_____RDF:Description__RDF:Description_RDF:about_urn:scheme:handler:webcube__NC:useSystemDefault_true__NC:alwaysAsk_false____
lea edi, [esp + 0x3f8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ecx, [esp + 0x3f8]
movsb byte es:[edi], byte [esi]
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4025a2
sub ecx, esi
mov esi, dword [esp + 0x14]
mov edi, ecx
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jl 0x4025cb
lea edx, [edi + esi]
lea esp, [esp]
mov bl, byte [ecx + esi]
mov byte [ecx + edx], bl
dec ecx
cmp ecx, eax
jge 0x4025c0
push edi
lea ecx, [esp + 0x3fc]
push ecx
add eax, esi
push eax
call fcn.004047e0
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
add esp, 0xc
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 5
push 0
push 0
push 0x40000000
lea eax, [esp + 0x6a0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40262f
mov edx, dword [esp + 0xc]
push 0
lea ecx, [esp + 0x10]
push ecx
add edi, edx
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.00403bfd
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
add esp, 4
push 0x7fff
lea eax, [esp + 0x868c]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push str.MozillaFirefoxProfilesdefault
lea ecx, [esp + 0x868c]
push 0x7fff
push ecx
call fcn.00403f31
add esp, 0xc
lea edx, [esp + 0x150]
push edx
lea eax, [esp + 0x868c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
je 0x4028d3
lea ebx, [esp + 0x8688]
dec ebx
mov dword [esp + 0x18], ebx
nop
push 0x7fff
lea ecx, [esp + 0x1068d]
push 0
push ecx
mov byte [esp + HeapAlloc], 0
call fcn.00404760
lea esi, [esp + 0x8694]
add esp, 0xc
lea ecx, [esi + 1]
lea esp, [esp]
mov al, byte [esi]
inc esi
test al, al
jne 0x4026d0
sub esi, ecx
cmp byte [ebx + esi], 0x5c
je 0x4026e7
nop
dec esi
cmp byte [ebx + esi], 0x5c
jne 0x4026e0
lea edx, [esp + 0x8688]
push edx
lea eax, [esp + 0x1068c]
push 0x7fff
push eax
call fcn.00403ec9
add esp, 0xc
lea ecx, [esp + 0x17c]
push ecx
mov edx, 0x7fff
sub edx, esi
push edx
lea eax, [esp + esi + 0x10690]
push eax
call fcn.00403ec9
add esp, 0xc
push str.cert_override.txt
lea ecx, [esp + 0x1068c]
push 0x7fff
push ecx
call fcn.00403f31
add esp, 0xc
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea edx, [esp + 0x106a0]
push edx
call edi
mov esi, eax
mov dword [esp + 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x402787
push 0
push 0
push 1
push 0
push 0
push 0x40000000
lea eax, [esp + 0x106a0]
push eax
call edi
mov esi, eax
mov dword [esp + 0x10], eax
cmp esi, 0xffffffff
je 0x4028b8
mov edi, dword [esp + 0x10]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
add esi, 0x3e8
push esi
mov dword [esp + 0x24], esi
call fcn.004042fa
add esp, 4
push 0
lea ecx, [esp + 0x18]
push ecx
push esi
mov ebx, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x14]
mov byte [edx + ebx], 0
mov eax, dword [esp + 0x14]
mov ecx, 0x53
mov esi, str._r_n127.0.0.1:4568_tOID.2.16.840.1.101.3.4.2.1_tB1:09:04:20:17:5C:7E:B3:DF:2B:BC:BE:E5:47:3C:B5:96:D6:38:DD:A1:E3:9F:ED:29:C8:CA:EA:2A:C1:F5:89_tU_tAAAAAAAAAAAAAAAJAAAAdgD39_8l_kErOzB0MQswCQYDVQQGEwJLUjEOMAwGA1UECAwFU2VvdWwxDjAMBgNVBAcMBVNlb3VsMRAwDgYDVQQKDAdUZXJ1dGVuMRIwEAYDVQQDDAkxMjcuMC4wLjExHzAdBgkqhkiG9w0BCQEWEGN1YmVAdGVydXRlbi5jb20
lea edi, [esp + 0x3f8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push eax
push ebx
lea edx, [esp + 0x400]
movsb byte es:[edi], byte [esi]
call fcn.004010c0
add esp, 8
cmp eax, 0xffffffff
jne 0x40289a
mov edi, edx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x402805
mov esi, dword [esp + 0x20]
sub edi, ecx
lea ecx, [edi + 1]
cmp esi, ecx
jae 0x402835
push ebx
call fcn.00403bfd
mov edx, dword [esp + 0x18]
lea eax, [edi + edx + 1]
add esp, 4
push eax
call fcn.004042fa
add esp, 4
mov ebx, eax
lea ecx, [esp + 0x3f8]
push ecx
push esi
push ebx
call fcn.00403f31
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea eax, [edi + edx]
push ecx
mov byte [eax + ebx], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 5
push 0
push 0
push 0x40000000
lea edx, [esp + 0x106a0]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4028a5
mov ecx, dword [esp + 0x14]
push 0
lea eax, [esp + 0x18]
push eax
add edi, ecx
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
jmp 0x40289f
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.00403bfd
mov ebx, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
add esp, 4
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x150]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4026a0
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x7fff
lea eax, [esp + 0x868c]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push str.MozillaFirefoxProfilesdefault
lea ecx, [esp + 0x868c]
push 0x7fff
push ecx
call fcn.00403f31
add esp, 0xc
lea edx, [esp + 0x150]
push edx
lea eax, [esp + 0x868c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
je 0x402b2c
lea eax, [esp + 0x8688]
dec eax
mov dword [esp + 0x18], eax
nop
push 0x7fff
lea ecx, [esp + 0x1068d]
push 0
push ecx
mov byte [esp + HeapAlloc], 0
call fcn.00404760
lea esi, [esp + 0x8694]
add esp, 0xc
lea ecx, [esi + 1]
lea esp, [esp]
mov al, byte [esi]
inc esi
test al, al
jne 0x402970
mov eax, dword [esp + 0x18]
sub esi, ecx
cmp byte [eax + esi], 0x5c
je 0x40298a
dec esi
cmp byte [eax + esi], 0x5c
jne 0x402983
lea edx, [esp + 0x8688]
push edx
lea eax, [esp + 0x1068c]
push 0x7fff
push eax
call fcn.00403ec9
add esp, 0xc
lea ecx, [esp + 0x17c]
push ecx
mov edx, 0x7fff
sub edx, esi
push edx
lea eax, [esp + esi + 0x10690]
push eax
call fcn.00403ec9
add esp, 0xc
push str.prefs.js
lea ecx, [esp + 0x1068c]
push 0x7fff
push ecx
call fcn.00403f31
add esp, 0xc
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea edx, [esp + 0x106a0]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402b11
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
add esi, 0x3e8
push esi
call fcn.004042fa
add esp, 4
mov edi, eax
push 0
lea eax, [esp + 0x14]
push eax
push esi
push edi
push ebx
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov byte [ecx + edi], 0
mov edx, dword [esp + 0x10]
mov ecx, 0xb
mov esi, str.user_pref__privacy.cpd.siteSettings___true__
lea edi, [esp + 0x2a8]
rep movsd dword es:[edi], dword [esi]
push edx
push eax
lea edx, [esp + 0x2b0]
movsb byte es:[edi], byte [esi]
call fcn.004010c0
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
je 0x402afd
mov eax, edx
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402a80
sub eax, edx
push ebx
mov dword [esp + 0x294], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 5
push 0
push 0
push 0x40000000
lea ecx, [esp + 0x106a0]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x402b04
mov eax, dword [esp + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [esp + 0x24]
push edx
push edi
push eax
push esi
mov dword [esp + 0x34], 0
call ebx
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x290]
push 0
sub edx, eax
lea ecx, [esp + 0x24]
push ecx
add eax, edi
add eax, dword [esp + 0x1c]
sub edx, edi
push edx
push eax
push esi
call ebx
push esi
jmp 0x402afe
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
push eax
call fcn.00403bfd
add esp, 4
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x150]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402940
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push str.c:Program_FilesTerutenWebCubeAgentCubeU.exe
call esi
test eax, eax
jne 0x402b83
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU.exe
call esi
test eax, eax
jne 0x402b83
push str.c:Program_FilesTerutenWebCubeAgentCubeU64.exe
call esi
test eax, eax
jne 0x402b83
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64.exe
call esi
test eax, eax
jne 0x402b83
push str.c:Program_FilesTerutenWebCubeAgentCubeU64A.exe
call esi
test eax, eax
jne 0x402b83
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64A.exe
call esi
test eax, eax
je 0x403133
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.c:Program_FilesTerutenWebCubeAgentCubeU_.exe
call esi
push str.c:Program_FilesTerutenWebCubeAgentCubeU64_.exe
call esi
push str.c:Program_FilesTerutenWebCubeAgentCubeU64A_.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU_.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64_.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64A_.exe
call esi
push str.c:Program_FilesTerutenWebCubeAgentCubeU_.exe
push str.c:Program_FilesTerutenWebCubeAgentCubeU.exe
call fcn.004043c4
push str.c:Program_FilesTerutenWebCubeAgentCubeU64_.exe
push str.c:Program_FilesTerutenWebCubeAgentCubeU64.exe
call fcn.004043c4
push str.c:Program_FilesTerutenWebCubeAgentCubeU64A_.exe
push str.c:Program_FilesTerutenWebCubeAgentCubeU64A.exe
call fcn.004043c4
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU_.exe
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU.exe
call fcn.004043c4
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64_.exe
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64.exe
call fcn.004043c4
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64A_.exe
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64A.exe
call fcn.004043c4
add esp, 0x30
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0x10], esi
cmp esi, 0xffffffff
je 0x40143b
lea ecx, [esp + 0x28]
push ecx
push esi
mov dword [esp + 0x30], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40146c
jmp 0x402c50
lea eax, [esp + 0x4c]
mov dword [esp + 0x2c0], 0xf
mov dword [esp + 0x2bc], 0
mov byte [esp + 0x2ac], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402c75
sub eax, edx
push eax
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x2b0]
call fcn.004031c0
mov edx, dword [esp + 0x2c0]
mov ecx, dword [esp + 0x2ac]
cmp edx, 0x10
jb 0x402e81
mov esi, ecx
mov dword [esp + 0x20], esi
test ecx, ecx
je 0x402cde
mov eax, ecx
cmp edx, 0x10
jae 0x402cbf
lea eax, [esp + 0x2ac]
cmp eax, esi
ja 0x402cde
mov eax, ecx
cmp edx, 0x10
jae 0x402cd1
lea eax, [esp + 0x2ac]
mov ebx, dword [esp + 0x2bc]
add eax, ebx
cmp esi, eax
jbe 0x402cf8
call fcn.00403eb9
mov edx, dword [esp + 0x2c0]
mov ebx, dword [esp + 0x2bc]
mov ecx, dword [esp + 0x2ac]
mov eax, ecx
cmp edx, 0x10
jae 0x402d06
lea eax, [esp + 0x2ac]
lea edi, [ebx + eax]
test edi, edi
je 0x402d33
mov eax, ecx
cmp edx, 0x10
jae 0x402d1b
lea eax, [esp + 0x2ac]
cmp eax, edi
ja 0x402d33
mov eax, ecx
cmp edx, 0x10
jae 0x402d2d
lea eax, [esp + 0x2ac]
add eax, ebx
cmp edi, eax
jbe 0x402d4d
call fcn.00403eb9
mov edx, dword [esp + 0x2c0]
mov ebx, dword [esp + 0x2bc]
mov ecx, dword [esp + 0x2ac]
cmp edx, 0x10
jb 0x402e91
mov esi, ecx
test ecx, ecx
je 0x402d82
mov eax, ecx
cmp edx, 0x10
jae 0x402d6a
lea eax, [esp + 0x2ac]
cmp eax, esi
ja 0x402d82
mov eax, ecx
cmp edx, 0x10
jae 0x402d7c
lea eax, [esp + 0x2ac]
add ebx, eax
cmp esi, ebx
jbe 0x402d87
call fcn.00403eb9
mov ecx, dword [esp + 0x20]
push ecx
lea eax, [esp + 0x2ac]
push eax
mov byte [esp + 0x298], 0
mov edx, dword [esp + 0x298]
mov eax, dword [esp + 0x298]
push edx
push eax
push edi
lea ecx, [esp + 0x2c]
push esi
push ecx
call fcn.00403820
add esp, 0x1c
push 0xf
push str.tuctlsystem.exe
lea edx, [esp + 0x2b0]
push edx
call fcn.004032d0
cmp eax, 0xffffffff
je 0x402df5
mov eax, dword [esp + 0x30]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x2c0], 0x10
jb 0x402e0f
mov ecx, dword [esp + 0x2ac]
push ecx
call fcn.00403ab9
add esp, 4
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x28]
push edx
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x402c50
mov ecx, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0x10], esi
cmp esi, 0xffffffff
je 0x40143b
lea edx, [esp + 0x28]
push edx
push esi
mov dword [esp + 0x30], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x402ea0
push esi
call edi
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18680]
xor ecx, esp
call fcn.00403988
mov esp, ebp
pop ebp
ret 0x10
lea esi, [esp + 0x2ac]
mov dword [esp + 0x20], esi
jmp 0x402cb1
lea esi, [esp + 0x2ac]
jmp 0x402d5c
lea eax, [esp + 0x4c]
mov dword [esp + 0x2c0], 0xf
mov dword [esp + 0x2bc], 0
mov byte [esp + 0x2ac], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402ec5
sub eax, edx
push eax
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x2b0]
call fcn.004031c0
mov edx, dword [esp + 0x2c0]
mov ecx, dword [esp + 0x2ac]
cmp edx, 0x10
jb 0x40314c
mov dword [esp + 0xc], ecx
test ecx, ecx
je 0x402f30
mov eax, ecx
cmp edx, 0x10
jae 0x402f0d
lea eax, [esp + 0x2ac]
cmp eax, dword [esp + 0xc]
ja 0x402f30
mov eax, ecx
cmp edx, 0x10
jae 0x402f21
lea eax, [esp + 0x2ac]
mov ebx, dword [esp + 0x2bc]
add eax, ebx
cmp dword [esp + 0xc], eax
jbe 0x402f4a
call fcn.00403eb9
mov edx, dword [esp + 0x2c0]
mov ebx, dword [esp + 0x2bc]
mov ecx, dword [esp + 0x2ac]
mov eax, ecx
cmp edx, 0x10
jae 0x402f58
lea eax, [esp + 0x2ac]
lea edi, [eax + ebx]
test edi, edi
je 0x402f85
mov eax, ecx
cmp edx, 0x10
jae 0x402f6d
lea eax, [esp + 0x2ac]
cmp eax, edi
ja 0x402f85
mov eax, ecx
cmp edx, 0x10
jae 0x402f7f
lea eax, [esp + 0x2ac]
add eax, ebx
cmp edi, eax
jbe 0x402f9f
call fcn.00403eb9
mov edx, dword [esp + 0x2c0]
mov ebx, dword [esp + 0x2bc]
mov ecx, dword [esp + 0x2ac]
cmp edx, 0x10
jb 0x40315c
mov esi, ecx
test ecx, ecx
je 0x402fd4
mov eax, ecx
cmp edx, 0x10
jae 0x402fbc
lea eax, [esp + 0x2ac]
cmp eax, esi
ja 0x402fd4
mov eax, ecx
cmp edx, 0x10
jae 0x402fce
lea eax, [esp + 0x2ac]
add eax, ebx
cmp esi, eax
jbe 0x402fd9
call fcn.00403eb9
mov ecx, dword [esp + 0xc]
push ecx
lea eax, [esp + 0x2ac]
push eax
mov byte [esp + 0x298], 0
mov edx, dword [esp + 0x298]
mov eax, dword [esp + 0x298]
push edx
push eax
push edi
lea ecx, [esp + 0x34]
push esi
push ecx
call fcn.00403820
add esp, 0x1c
push 9
push str.cubeu.exe
lea edx, [esp + 0x2b0]
push edx
call fcn.004032d0
cmp eax, 0xffffffff
jne 0x40303f
push 0xb
push str.cubeu64.exe
lea eax, [esp + 0x2b0]
push eax
call fcn.004032d0
cmp eax, 0xffffffff
je 0x403060
mov ecx, dword [esp + 0x30]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x2c0], 0x10
jb 0x40307a
mov edx, dword [esp + 0x2ac]
push edx
call fcn.00403ab9
add esp, 4
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x28]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x402ea0
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.c:Program_FilesTerutenWebCubeAgentCubeU_.exe
call esi
push str.c:Program_FilesTerutenWebCubeAgentCubeU64_.exe
call esi
push str.c:Program_FilesTerutenWebCubeAgentCubeU64A_.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU_.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64_.exe
call esi
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64A_.exe
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push str.c:Program_FilesTerutenWebCubeAgentCubeU.exe
call esi
test eax, eax
jne 0x40311f
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU.exe
call esi
test eax, eax
jne 0x40311f
push str.c:Program_FilesTerutenWebCubeAgentCubeU64.exe
call esi
test eax, eax
jne 0x40311f
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64.exe
call esi
test eax, eax
jne 0x40311f
push str.c:Program_FilesTerutenWebCubeAgentCubeU64A.exe
call esi
test eax, eax
jne 0x40311f
push str.c:Program_Files__x86_TerutenWebCubeAgentCubeU64A.exe
call esi
test eax, eax
je 0x403133
push 0x30
push 0x40f7fc
push str.CubeU_CubeU64.exe
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x1868c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00403988
mov esp, ebp
pop ebp
ret 0x10
lea eax, [esp + 0x2ac]
mov dword [esp + 0xc], eax
jmp 0x402eff
lea esi, [esp + 0x2ac]
jmp 0x402fae