Function at 0x422450
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428e86
mov eax, dword fs:[0]
push eax
sub esp, 0x1a0
mov eax, dword [0x439040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
mov eax, ecx
mov dword [ebp - 0x98], ecx
cmp dword [ecx + 0x14], 0xf
jbe 0x422490
mov eax, dword [ecx]
push 1
push 0x40
push 1
push eax
lea ecx, [ebp - 0x1ac]
call fcn.004206f0
mov eax, dword [ebp - 0x1ac]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x1b0], eax
push 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
call fcn.0042601c
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x88]
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x90], eax
push 1
mov byte [ebp - 4], 2
call sub.MSVCP140.dll_private:_static_class_std::locale::_Locimp____cdecl_std::locale::_Init_bool_
add esp, 8
mov dword [ebp - 0x7c], eax
push 0
lea ecx, [ebp - 0x74]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::_Lockit::constructor_int_]
mov eax, dword [0x439880]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::locale::id_std::collate_char_::id]
mov byte [ebp - 4], 4
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x60], eax
call dword [sym.imp.MSVCP140.dll_public:_unsigned_int___thiscall_std::locale::id::operator_unsigned_int_void_]
mov edx, dword [ebp - 0x7c]
mov dword [ebp - 0x5c], eax
lea edi, [eax*4]
cmp eax, dword [edx + 0xc]
jae 0x422561
mov ecx, dword [edx + 8]
mov esi, dword [edi + ecx]
test esi, esi
jne 0x4225c0
jmp 0x422563
xor esi, esi
cmp byte [edx + 0x14], 0
je 0x42257c
call sub.MSVCP140.dll_private:_static_class_std::locale::_Locimp____cdecl_std::locale::_Getgloballocale_void_
mov ecx, dword [ebp - 0x5c]
cmp ecx, dword [eax + 0xc]
jae 0x422580
mov eax, dword [eax + 8]
mov esi, dword [edi + eax]
test esi, esi
jne 0x4225c0
mov esi, dword [ebp - 0x70]
test esi, esi
jne 0x4225c0
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.0040c560
add esp, 8
cmp eax, 0xffffffff
je 0x422ce7
mov esi, dword [ebp - 0x60]
mov dword [ebp - 0x70], esi
push esi
mov byte [ebp - 4], 5
call fcn.004257a0
mov eax, dword [esi]
add esp, 4
mov ecx, esi
call dword [eax + 4]
mov dword [0x439880], esi
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 3
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::_Lockit::destructor_void_]
lea eax, [ebp - 0x80]
mov dword [ebp - 0x88], esi
push eax
call fcn.00408e00
add esp, 4
mov dword [ebp - 0x84], eax
push 1
push 0x430bbb
push str._A_Za_z_:.._dllexebatjar___A_Za_z_:.._dllexebatjar_
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 6
call fcn.004082a0
xorps xmm0, xmm0
mov dword [ebp - 0xd0], 0
mov byte [ebp - 0xcc], 0
movups xmmword [ebp - 0xc8], xmm0
mov dword [ebp - 0xb8], 0
mov byte [ebp - 0xb4], 0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 0
mov byte [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa0], 0
mov byte [ebp - 0x9c], 0
movups xmmword [ebp - 0x58], xmm0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
mov eax, dword [ebp - 0x1ac]
lea ecx, [ebp - 0x1ac]
push 0xa
mov byte [ebp - 4], 9
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_char___thiscall_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const]
movzx eax, al
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x1ac]
push eax
call fcn.0041c860
add esp, 0xc
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::operator_bool_void_const]
test al, al
je 0x422b77
nop
cmp dword [ebp - 0x44], 0xf
lea esi, [ebp - 0x58]
mov edx, dword [ebp - 0x58]
lea edi, [ebp - 0x58]
mov eax, dword [ebp - 0x48]
seta cl
cmova esi, edx
test cl, cl
je 0x4226de
add eax, edx
jmp 0x4226e3
add eax, edi
lea edx, [ebp - 0x58]
push esi
push 0
lea ecx, [ebp - 0x8c]
push ecx
lea ecx, [ebp - 0xd0]
push ecx
push eax
push edx
call fcn.00420150
mov esi, dword [ebp - 0xc8]
add esp, 0x18
test al, al
je 0x422b32
mov ecx, dword [ebp - 0xc4]
mov eax, 0x2aaaaaab
sub ecx, esi
imul ecx
lea ecx, [ebp - 0xa4]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmovne ecx, esi
cmp byte [ecx + 8], 0
je 0x422741
mov eax, dword [ecx]
mov edx, eax
mov ecx, dword [ecx + 4]
mov esi, eax
mov dword [ebp - 0x74], ecx
jmp 0x422749
xor eax, eax
xor ecx, ecx
xor edx, edx
xor esi, esi
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x28], xmm0
cmp edx, ecx
jne 0x422775
xor esi, esi
mov byte [ebp - 0x28], 0
mov ecx, 0xf
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ecx
jmp 0x422787
sub ecx, esi
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.00407c80
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
mov byte [ebp - 4], 0xa
test esi, esi
je 0x422851
cmp ecx, 0xf
lea eax, [ebp - 0x28]
cmova eax, edi
seta dl
cmp byte [eax], 0x22
jne 0x4227eb
mov ecx, 1
test dl, dl
je 0x4227bd
xor edx, edx
mov eax, esi
sub eax, edx
cmp eax, ecx
cmovb ecx, eax
jmp 0x4227c8
xor edx, edx
lea edi, [ebp - 0x28]
cmp esi, 1
cmovb ecx, esi
sub esi, ecx
mov dword [ebp - 0x60], ecx
mov eax, dword [ebp - 0x60]
add edx, edi
add eax, edx
lea ecx, [esi + 1]
push ecx
push eax
push edx
call sub.VCRUNTIME140.dll_memmove
mov edi, dword [ebp - 0x28]
add esp, 0xc
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], esi
test esi, esi
je 0x422851
cmp ecx, 0xf
lea eax, [ebp - 0x28]
cmova eax, edi
seta dl
cmp byte [esi + eax - 1], 0x22
jne 0x422851
mov eax, esi
test dl, dl
je 0x422811
mov edx, edi
sub edx, edi
dec edx
add edx, esi
jmp 0x42281f
lea ecx, [ebp - 0x28]
mov edx, ecx
sub eax, ecx
dec edx
mov edi, ecx
add edx, eax
mov eax, esi
sub eax, edx
mov dword [ebp - 0x60], edx
mov ecx, 1
cmp eax, ecx
cmovb ecx, eax
add edx, edi
mov dword [ebp - 0x5c], ecx
sub esi, ecx
mov eax, dword [ebp - 0x5c]
mov ecx, esi
sub ecx, dword [ebp - 0x60]
add eax, edx
inc ecx
push ecx
push eax
push edx
call sub.VCRUNTIME140.dll_memmove
mov edi, dword [ebp - 0x28]
add esp, 0xc
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xdc]
push eax
lea ecx, [ebp - 0x68]
call fcn.0041fe30
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x5c], ecx
cmp byte [eax + 0xd], 0
jne 0x4228cb
add eax, 0x10
lea ecx, [ebp - 0x68]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004209f0
test al, al
jne 0x4228cb
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0xd4], eax
je 0x4228cb
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 9
cmp edx, 0xf
jbe 0x422b2c
inc edx
mov eax, edi
cmp edx, 0x1000
jb 0x4228c4
mov edi, dword [eax - 4]
add edx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x422c3a
push edx
push edi
jmp 0x422b24
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xf4]
push eax
lea ecx, [ebp - 0x68]
call fcn.0041fe30
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ebp - 0xe8], xmm0
cmp byte [eax + 0xd], 0
jne 0x42290b
add eax, 0x10
lea ecx, [ebp - 0x68]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004209f0
test al, al
je 0x42298b
cmp dword [ebp - 0x64], 0x6666666
je 0x422cf1
lea eax, [ebp - 0x68]
mov dword [ebp - 0x94], eax
push 0x28
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x90], 0
call fcn.0042601c
mov esi, eax
add esp, 4
mov dword [ebp - 0x90], esi
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xc
lea ecx, [esi + 0x10]
push eax
call fcn.004111e0
mov eax, dword [ebp - 0x5c]
lea ecx, [ebp - 0x68]
push esi
push dword [ebp - 0xe4]
mov dword [esi], eax
push dword [ebp - 0xe8]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov word [esi + 0xc], 0
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x90], 0
call fcn.00403b80
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x28]
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
xorps xmm0, xmm0
cmova eax, edi
seta cl
add eax, esi
lea esi, [ebp - 0x28]
test cl, cl
mov dword [ebp - 0x74], eax
movups xmmword [ebp - 0x40], xmm0
cmovne esi, edi
cmp esi, eax
jne 0x4229c9
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
jmp 0x422a59
sub eax, esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov edx, 7
mov dword [ebp - 0x2c], edx
cmp eax, 0x7ffffffe
ja 0x422cec
cmp eax, edx
jbe 0x422a21
or eax, edx
cmp eax, 0x7ffffffe
jbe 0x4229f7
mov eax, SysReAllocString
jmp 0x422a02
cmp eax, 0xa
mov ecx, 0xa
cmovb eax, ecx
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00402010
mov edx, dword [ebp - 0x5c]
add esp, 8
mov edi, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x2c], edx
movsx ax, byte [esi]
lea ecx, [ebp - 0x40]
cmp edx, 7
cmova ecx, dword [ebp - 0x40]
inc esi
movzx eax, ax
mov word [ecx + edi*2], ax
mov edi, dword [ebp - 0x30]
inc edi
mov dword [ebp - 0x30], edi
cmp esi, dword [ebp - 0x74]
je 0x422a48
mov edx, dword [ebp - 0x2c]
jmp 0x422a21
cmp dword [ebp - 0x2c], 7
lea eax, [ebp - 0x40]
cmova eax, dword [ebp - 0x40]
xor ecx, ecx
mov word [eax + edi*2], cx
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0xd
push eax
lea ecx, [ebp - 0x69]
call fcn.004040a0
test al, al
jne 0x422aa2
push str.___Suspicious_file_executed_with_task_scheduler:
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00405510
cmp dword [ebp - 0x14], 0xf
lea ecx, [ebp - 0x28]
push dword [ebp - 0x18]
cmova ecx, dword [ebp - 0x28]
push ecx
push eax
call fcn.0040f9c0
add esp, 0x14
mov ecx, eax
push 0x405750
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0xa
cmp ecx, 7
jbe 0x422ae0
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x422ad6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x422c3a
push ecx
push edx
call fcn.0042604c
add esp, 8
mov ecx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov byte [ebp - 4], 9
cmp ecx, 0xf
jbe 0x422b2c
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x422b22
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x422c3a
push ecx
push edx
call fcn.0042604c
add esp, 8
mov esi, dword [ebp - 0xc8]
mov eax, dword [ebp - 0x1ac]
lea ecx, [ebp - 0x1ac]
push 0xa
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_char___thiscall_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const]
movzx eax, al
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x1ac]
push eax
call fcn.0041c860
add esp, 0xc
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::operator_bool_void_const]
test al, al
jne 0x4226c0
jmp 0x422b7d
mov esi, dword [ebp - 0xc8]
lea ecx, [ebp - 0x19c]
call fcn.00422110
test eax, eax
jne 0x422ba4
push eax
mov eax, dword [ebp - 0x1ac]
lea ecx, [ebp - 0x1ac]
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
mov eax, dword [ebp - 0x98]
cmp dword [eax + 0x14], 0xf
jbe 0x422bb2
mov eax, dword [eax]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, dword [ebp - 0x44]
add esp, 4
cmp ecx, 0xf
jbe 0x422bec
mov edx, dword [ebp - 0x58]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x422be2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x422c3a
push ecx
push edx
call fcn.0042604c
add esp, 8
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
test esi, esi
je 0x422c4a
mov ecx, dword [ebp - 0xc0]
mov eax, 0x2aaaaaab
sub ecx, esi
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 2
cmp ecx, 0x1000
jb 0x422c40
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x422c40
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push esi
call fcn.0042604c
add esp, 8
mov ecx, dword [ebp - 0x8c]
test ecx, ecx
je 0x422c7f
or eax, 0xffffffff
lock xadd dword [ecx + 0x20], eax
jne 0x422c7f
mov esi, dword [ebp - 0x8c]
test esi, esi
je 0x422c7f
mov ecx, esi
lea eax, [esi + 0xc]
mov esi, dword [eax]
mov dword [eax], 0
push 1
mov eax, dword [ecx]
call dword [eax]
test esi, esi
jne 0x422c68
mov ecx, dword [ebp - 0x7c]
mov dword [ebp - 0x8c], 0
test ecx, ecx
je 0x422ca3
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test eax, eax
je 0x422ca3
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov eax, dword [ebp - 0x68]
push dword [eax + 4]
lea eax, [ebp - 0x68]
push eax
mov ecx, eax
call fcn.0041fda0
push 0x28
push dword [ebp - 0x68]
call fcn.0042604c
add esp, 8
lea ecx, [ebp - 0x1ac]
call fcn.00420aa0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00426399
mov esp, ebp
pop ebp
ret
call fcn.00403d90
call fcn.00403e20
call fcn.00403db0
int3