Function at 0x407500
Capabilities:
Create thread
Execute command
Set console window title

Disassembly:
push ebp
mov eax, 0x3340
mov ebp, esp
push edi
push ebx
call fcn.00413740
sub esp, eax
lea eax, [ebp - 8]
mov dword [ebp - 0x32f4], sym.___gxx_personality_sj0
mov dword [ebp - 0x32ec], eax
lea eax, [ebp - 0x330c]
mov dword [ebp - 0x32e4], esp
mov dword [ebp - 0x32f0], 0x4e0e48
mov dword [ebp - 0x32e8], 0x4080d8
mov dword [esp], eax
call dbg._Unwind_SjLj_Register
mov dword [ebp - 0x32d8], 1
mov dword [ebp - 0x32d4], 0
mov dword [esp], 0xfffffff5
mov dword [ebp - 0x3308], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [ebp - 0x32d8]
sub esp, 4
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
sub esp, 8
mov dword [esp], str.mode_con_cols76_lines20
call sym._system
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edi, eax
lea eax, [ebp - 0x32d0]
mov dword [esp + 4], eax
mov dword [ebp - 0x3310], edi
mov dword [esp], edi
lea edi, [ebp - 0x3004]
call dword [sym.imp.USER32.dll_GetWindowRect]
sub esp, 8
mov dword [esp + 4], 0xfffffff0
mov eax, dword [ebp - 0x3310]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
sub esp, 8
and eax, 0xfff8ffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0xfffffff0
mov eax, dword [ebp - 0x3310]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov edx, dword [ebp - 0x32d0]
mov ecx, dword [ebp - 0x32cc]
sub esp, 0xc
mov dword [esp + 0x18], 0
mov ebx, dword [ebp - 0x32c4]
sub ebx, ecx
mov dword [esp + 0x14], ebx
mov ebx, dword [ebp - 0x32c8]
mov dword [esp + 8], edx
sub ebx, edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x3310]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetWindowPos]
sub esp, 0x1c
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x3310]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
sub esp, 8
mov dword [esp + 8], 2
mov dword [esp + 4], 0xf060
mov dword [esp], eax
call dword [sym.imp.USER32.dll_RemoveMenu]
sub esp, 0xc
mov dword [esp], 0x4e6243
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
sub esp, 4
call sym.DisableFastMake__
xor eax, eax
mov ecx, 0x3ff
mov dword [ebp - 0x3008], 0
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x3008]
mov dword [esp], 0
mov dword [esp + 8], 0x1000
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x3008]
sub esp, 0xc
mov dword [esp + 4], 0x5c
mov dword [esp], eax
call sym._strrchr
lea edx, [ebp - 0x3008]
mov byte [eax], 0
lea eax, [ebp - 0x1000]
mov dword [ebp - 0x1008], eax
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x4076fc
mov ecx, eax
mov byte [esp + 8], 0
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
lea ecx, [ebp - 0x1008]
mov ebx, eax
add bl, al
lea eax, [ebp - 0x3008]
sbb edx, 3
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [ebp - 0x3308], 0xffffffff
call method.void_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_construct_char_const__char_const__char_const__std::forward_iterator_tag_
mov eax, 0x3fffffff
sub eax, dword [ebp - 0x1004]
sub esp, 0xc
cmp eax, 0xe
jbe 0x4080c2
mov dword [esp + 4], 0xf
lea ecx, [ebp - 0x1008]
mov dword [esp], str.DataVirusPath
mov dword [ebp - 0x3308], 1
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_int_
lea edi, [ebp - 0x32b8]
lea ecx, [eax + 8]
sub esp, 8
mov dword [ebp - 0x32c0], edi
mov edx, dword [eax]
cmp edx, ecx
je 0x407ee0
mov dword [ebp - 0x32c0], edx
mov edx, dword [eax + 8]
mov dword [ebp - 0x32b8], edx
mov edx, dword [eax + 4]
mov byte [eax + 8], 0
lea edi, [ebp - 0x1000]
mov dword [ebp - 0x32bc], edx
mov dword [eax], ecx
mov dword [eax + 4], 0
mov eax, dword [ebp - 0x1008]
cmp eax, edi
je 0x4077e7
mov dword [esp], eax
call sym.operator_delete_void_
lea eax, [ebp - 0x32a0]
mov byte [ebp - 0x32a0], 0
lea ecx, [ebp - 0x32a8]
mov dword [ebp - 0x32a8], eax
lea eax, [ebp - 0x32c0]
mov dword [ebp - 0x32a4], 0
mov dword [esp], eax
mov dword [ebp - 0x3308], 2
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_assign_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
mov eax, 0x3fffffff
sub eax, dword [ebp - 0x32a4]
sub esp, 4
cmp eax, 1
jbe 0x4080b6
mov dword [esp + 4], 2
lea ecx, [ebp - 0x32a8]
mov dword [esp], 0x4e6709
mov dword [ebp - 0x3308], 2
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_int_
sub esp, 8
lea edi, [ebp - 0x3248]
mov dword [esp + 4], edi
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__findfirst]
mov dword [ebp - 0x3314], eax
cmp eax, 0xffffffff
je 0x407a3f
lea esi, [esi]
mov edx, dword [ebp - 0x3248]
test edx, edx
je 0x407a05
lea eax, [ebp - 0x32c0]
lea ecx, [ebp - 0x32a8]
mov dword [esp], eax
mov dword [ebp - 0x3308], 2
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_assign_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
sub esp, 4
cmp dword [ebp - 0x32a4], 0x3fffffff
je 0x4080aa
mov dword [esp + 4], 1
lea ecx, [ebp - 0x32a8]
mov dword [esp], 0x4e6364
mov dword [ebp - 0x3308], 2
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_int_
sub esp, 8
lea ecx, [ebp - 0x3234]
mov ebx, dword [ecx]
add ecx, 4
lea edx, [ebx - 0x1010101]
not ebx
and edx, ebx
and edx, 0x80808080
je 0x4078f4
mov ebx, edx
lea edi, [ebp - 0x3234]
shr ebx, 0x10
test edx, 0x8080
cmove edx, ebx
lea ebx, [ecx + 2]
cmove ecx, ebx
mov ebx, edx
add bl, dl
mov edx, 0x3fffffff
sbb ecx, 3
sub edx, dword [eax + 4]
sub ecx, edi
cmp ecx, edx
ja 0x408094
lea edi, [ebp - 0x3234]
mov dword [esp + 4], ecx
mov ecx, eax
mov dword [esp], edi
mov dword [ebp - 0x3308], 2
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_int_
sub esp, 8
lea edi, [ebp - 0x1000]
lea ecx, [ebp - 0x1008]
mov dword [ebp - 0x1008], edi
mov edx, dword [eax]
mov byte [esp + 8], 0
mov edi, dword [eax + 4]
mov dword [esp], edx
add edi, edx
mov dword [esp + 4], edi
call method.void_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_construct_char__char__char__std::forward_iterator_tag_
mov eax, dword [ebp - 0x1008]
sub esp, 0xc
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [esp], eax
mov dword [ebp - 0x3308], 3
call sym.operator_new___unsigned_int_
mov edi, eax
mov eax, dword [ebp - 0x1008]
mov dword [esp + 4], eax
mov dword [ebp - 0x3310], edi
mov dword [esp], edi
call sym._strcpy
mov eax, dword [ebp - 0x3310]
mov dword [esp], eax
call sym.LockFileToEasy_char_const_
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x3310]
lea edi, [ebp - 0x1000]
mov dword [esp], eax
call sym.operator_delete_void__unsigned_int_
mov eax, dword [ebp - 0x1008]
cmp eax, edi
je 0x407a05
mov dword [esp], eax
call sym.operator_delete_void_
lea eax, [ebp - 0x3248]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3314]
mov dword [esp], eax
mov dword [ebp - 0x3308], 2
call dword [sym.imp.msvcrt.dll__findnext]
test eax, eax
je 0x407888
mov eax, dword [ebp - 0x3314]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__findclose]
mov dword [esp + 4], 0x4e6118
mov dword [esp], str.DataMBRData.data
mov dword [ebp - 0x3308], 2
call sym._fopen
test eax, eax
je 0x407e70
lea eax, [ebp - 0x1000]
lea ecx, [ebp - 0x1008]
mov dword [ebp - 0x1008], eax
mov byte [esp + 8], 0
mov dword [esp + 4], 0x4e61b4
mov dword [esp], str.DataWhiteList.VirusDat
mov dword [ebp - 0x3308], 2
call method.void_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_construct_char_const__char_const__char_const__std::forward_iterator_tag_
sub esp, 0xc
lea eax, [ebp - 0x1008]
mov dword [esp], eax
mov dword [ebp - 0x3308], 4
call sym.GetFileSize_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
mov dword [ebp - 0x3310], eax
mov eax, dword [ebp - 0x1008]
lea edi, [ebp - 0x1000]
cmp eax, edi
je 0x407ad3
mov dword [esp], eax
call sym.operator_delete_void_
mov eax, dword [ebp - 0x3310]
test eax, eax
je 0x407c40
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym.__Z12VirusLibKillPv_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x3308], 2
mov dword [ebp - 0x3310], eax
call eax
sub esp, 0x18
mov dword [ebp - 0x3314], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym.__Z19ErgodicAdminProcessPv_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov edi, dword [ebp - 0x3310]
call edi
sub esp, 0x18
mov dword [ebp - 0x3318], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym.__Z18ErgodicPathProcessPv_4
mov dword [esp + 4], 0
mov dword [esp], 0
mov edi, dword [ebp - 0x3310]
call edi
mov edi, dword [ebp - 0x3314]
sub esp, 0x18
mov dword [ebp - 0x331c], eax
mov dword [esp], edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x3310], edi
call edi
mov ebx, dword [ebp - 0x331c]
sub esp, 4
mov dword [esp], ebx
mov edi, dword [ebp - 0x3310]
call edi
mov eax, dword [ebp - 0x3318]
sub esp, 4
mov dword [esp], eax
mov edi, dword [ebp - 0x3310]
call edi
mov eax, dword [ebp - 0x32a8]
lea edi, [ebp - 0x32a0]
sub esp, 4
cmp eax, edi
je 0x407c0a
mov dword [esp], eax
call sym.operator_delete_void_
mov eax, dword [ebp - 0x32c0]
lea edi, [ebp - 0x32b8]
cmp eax, edi
je 0x407c22
mov dword [esp], eax
call sym.operator_delete_void_
lea eax, [ebp - 0x330c]
mov dword [esp], eax
call sym.__Unwind_SjLj_Unregister
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [esp + 0xc], 0x1034
mov dword [esp + 8], 0x4e6243
mov dword [esp + 4], 0x4e6740
mov dword [esp], 0
mov dword [ebp - 0x3314], eax
mov dword [ebp - 0x3308], 2
call eax
sub esp, 0x10
cmp eax, 6
jne 0x407ae1
mov dword [esp + 4], 0
mov dword [esp], 2
call sym._CreateToolhelp32Snapshot_8
mov dword [ebp - 0x3310], eax
mov ecx, 0x4a
xor eax, eax
lea edi, [ebp - 0x3130]
rep stosd dword es:[edi], eax
sub esp, 8
mov dword [ebp - 0x3130], 0x128
lea esi, [esi]
nop
lea eax, [ebp - 0x3130]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3310]
mov dword [esp], eax
mov dword [ebp - 0x3308], 2
call sym._Process32Next_8
sub esp, 8
test eax, eax
je 0x407f10
xor eax, eax
lea edi, [ebp - 0x2004]
mov ecx, 0x3ff
mov dword [ebp - 0x2008], 0
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x1004]
mov ecx, 0x3ff
mov dword [ebp - 0x1008], 0
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2008]
mov dword [esp + 4], eax
lea eax, [ebp - 0x310c]
mov dword [esp], eax
call sym.GetProcessPath_char__char_
lea eax, [ebp - 0x1008]
mov dword [esp + 4], eax
lea eax, [ebp - 0x310c]
mov dword [esp], eax
call sym.GetProcessPath_char__char_
cmp byte [ebp - 0x2008], 0
je 0x407cc0
lea eax, [ebp - 0x2008]
mov dword [esp + 4], 0x5c
mov dword [esp], eax
call sym._strrchr
lea ecx, [ebp - 0x3290]
mov byte [eax], 0
lea eax, [ebp - 0x3288]
mov dword [ebp - 0x3290], eax
mov byte [esp + 8], 0
mov dword [esp + 4], 0x4e66ca
mov dword [esp], str.C:Windows
call method.void_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_construct_char_const__char_const__char_const__std::forward_iterator_tag_
sub esp, 0xc
lea eax, [ebp - 0x3270]
lea ecx, [ebp - 0x3278]
mov dword [ebp - 0x3278], eax
mov byte [esp + 8], 0
mov dword [esp + 4], 0x4e66de
mov dword [esp], str.C:WindowsSystem32
mov dword [ebp - 0x3308], 5
call method.void_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_construct_char_const__char_const__char_const__std::forward_iterator_tag_
sub esp, 0xc
lea eax, [ebp - 0x2008]
lea ecx, [ebp - 0x3290]
mov dword [esp], eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.compare_char_const__const
sub esp, 4
test eax, eax
je 0x407e30
lea eax, [ebp - 0x2008]
lea ecx, [ebp - 0x3278]
mov dword [esp], eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.compare_char_const__const
sub esp, 4
test eax, eax
je 0x407e30
lea eax, [ebp - 0x310c]
mov dword [esp], eax
mov dword [ebp - 0x3308], 9
call sym.IsProcessElevatedForName_char_
test al, al
jne 0x407f49
nop
mov eax, dword [ebp - 0x3278]
lea edi, [ebp - 0x3270]
cmp eax, edi
je 0x407e48
mov dword [esp], eax
call sym.operator_delete_void_
mov eax, dword [ebp - 0x3290]
lea edi, [ebp - 0x3288]
cmp eax, edi
je 0x407cc0
mov dword [esp], eax
call sym.operator_delete_void_
jmp 0x407cc0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [esp + 0xc], 0x1034
mov dword [esp + 8], 0x4e6243
mov dword [esp + 4], 0x4e670c
mov dword [esp], 0
mov dword [ebp - 0x3314], eax
call eax
sub esp, 0x10
cmp eax, 6
jne 0x407a65
call sym.CopyMBR__
mov dword [esp + 0xc], 0x1040
mov dword [esp + 8], 0x4e6243
mov dword [esp + 4], 0x4e6735
mov dword [esp], 0
mov eax, dword [ebp - 0x3314]
call eax
sub esp, 0x10
jmp 0x407a65
mov edx, dword [eax + 8]
mov dword [ebp - 0x32b8], edx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x32b4], edx
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x32b0], edx
mov edx, dword [eax + 0x14]
mov dword [ebp - 0x32ac], edx
jmp 0x4077b9
mov dword [esp + 0xc], 0x1040
mov dword [esp + 8], 0x4e6243
mov dword [esp + 4], 0x4e676f
mov dword [esp], 0
mov eax, dword [ebp - 0x3314]
mov dword [ebp - 0x3308], 2
call eax
sub esp, 0x10
jmp 0x407ae1
lea eax, [ebp - 0x3258]
lea edx, [ebp - 0x1008]
mov dword [ebp - 0x3260], eax
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x407f5b
mov ecx, eax
mov byte [esp + 8], 0
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
lea ecx, [ebp - 0x3260]
mov ebx, eax
add bl, al
lea eax, [ebp - 0x1008]
sbb edx, 3
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [ebp - 0x3308], 0xa
call method.void_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_construct_char_const__char_const__char_const__std::forward_iterator_tag_
sub esp, 0xc
lea eax, [ebp - 0x3260]
mov dword [esp], eax
mov dword [ebp - 0x3308], 6
call sym.WhiteList_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
mov edx, eax
mov eax, dword [ebp - 0x3260]
test dl, dl
jne 0x408079
lea edi, [ebp - 0x3258]
cmp eax, edi
je 0x407fef
mov dword [esp], eax
call sym.operator_delete_void_
lea eax, [ebp - 0x3258]
lea edx, [ebp - 0x1008]
mov dword [ebp - 0x3260], eax
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x408001
mov ecx, eax
mov byte [esp + 8], 0
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
lea ecx, [ebp - 0x3260]
mov ebx, eax
add bl, al
lea eax, [ebp - 0x1008]
sbb edx, 3
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [ebp - 0x3308], 7
call method.void_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_construct_char_const__char_const__char_const__std::forward_iterator_tag_
sub esp, 0xc
lea eax, [ebp - 0x3260]
mov dword [esp], eax
mov dword [ebp - 0x3308], 8
call sym.WriteList_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
mov eax, dword [ebp - 0x3260]
lea edi, [ebp - 0x3258]
cmp eax, edi
je 0x407e30
mov dword [esp], eax
call sym.operator_delete_void_
jmp 0x407e30
mov dword [esp], 0x4e6348
mov dword [ebp - 0x3308], 2
call method.std.__throw_length_error_char_const_
mov dword [esp], 0x4e6348
call method.std.__throw_length_error_char_const_
mov dword [esp], 0x4e6348
call method.std.__throw_length_error_char_const_
mov dword [esp], 0x4e6348
mov dword [ebp - 0x3308], 1
call method.std.__throw_length_error_char_const_
add ebp, 8
mov eax, dword [ebp - 0x3304]
cmp dword [ebp - 0x3308], 9
mov dword [ebp - 0x3310], eax
ja case.default.0x4080f6
mov eax, dword [ebp - 0x3308]
jmp dword [eax*4 + 0x4e677c]
ud2
mov eax, dword [ebp - 0x3260]
lea edx, [ebp - 0x3258]
cmp eax, edx
je case.0x4080f6.2
mov dword [esp], eax
call sym.operator_delete_void_
mov eax, dword [ebp - 0x3278]
lea edx, [ebp - 0x3270]
cmp eax, edx
je case.0x4080f6.4
mov dword [esp], eax
call sym.operator_delete_void_
mov eax, dword [ebp - 0x3290]
lea edx, [ebp - 0x3288]
cmp eax, edx
je case.0x4080f6.7
mov dword [esp], eax
call sym.operator_delete_void_
mov eax, dword [ebp - 0x32a8]
lea edx, [ebp - 0x32a0]
cmp eax, edx
je 0x40815f
mov dword [esp], eax
call sym.operator_delete_void_
mov eax, dword [ebp - 0x32c0]
lea edx, [ebp - 0x32b8]
cmp eax, edx
je 0x408177
mov dword [esp], eax
call sym.operator_delete_void_
mov eax, dword [ebp - 0x3310]
mov dword [esp], eax
mov dword [ebp - 0x3308], 0xffffffff
call dbg._Unwind_SjLj_Resume
mov eax, dword [ebp - 0x1008]
lea edx, [ebp - 0x1000]
cmp eax, edx
jne 0x40813f
jmp case.0x4080f6.7
mov eax, dword [ebp - 0x1008]
lea edx, [ebp - 0x1000]
cmp eax, edx
jne 0x40816f
jmp 0x408177