Function at 0x4f1ecc
Capabilities:
Check if file exists
Copy file
Create directory
Get file attributes
Persist via winlogon helper dll registry key
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x513517
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x4858
call fcn.005106b0
lea ecx, [ebp - 0x828]
call sub.MFC42.DLL_CStringArray::CStringArray
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
push 0x5b78a4
push str._sSoftwareMicrosoftWindows_NTCurrentVersionWinlogon
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5a72a8
push 0x5b6504
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5a72b4
push 0x5a72c0
push 0x80000002
lea eax, [ebp - 0x4838]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x4848], eax
mov ecx, dword [ebp - 0x4848]
mov dword [ebp - 0x484c], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x484c]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x4834]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4838]
call sub.MFC42.DLL_CString::CString
push 0x5a72f8
lea eax, [ebp - 0x4834]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4f210e
push 0x5a7300
lea ecx, [ebp - 0x4834]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4f210e
push 0x5b8f08
lea edx, [ebp - 0x4834]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4f210e
lea ecx, [ebp - 0x828]
call fcn.0050f5b0
lea eax, [ebp - 0x4834]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x2034], eax
mov dword [ebp - 0x82c], 0
mov dword [ebp - 0x2030], 0
jmp 0x4f203c
mov ecx, dword [ebp - 0x82c]
add ecx, 1
mov dword [ebp - 0x82c], ecx
mov edx, dword [ebp - 0x2030]
add edx, 1
mov dword [ebp - 0x2030], edx
mov eax, dword [ebp - 0x82c]
cmp eax, dword [ebp - 0x2034]
jge 0x4f210e
mov ecx, dword [ebp - 0x82c]
movsx edx, byte [ebp + ecx - 0x4834]
cmp edx, 0x2c
jne 0x4f20be
mov eax, dword [ebp - 0x82c]
movsx ecx, byte [ebp + eax - 0x4835]
cmp ecx, 0x20
jne 0x4f2084
mov edx, dword [ebp - 0x2030]
mov byte [ebp + edx - 0x815], 0
jmp 0x4f2092
mov eax, dword [ebp - 0x2030]
mov byte [ebp + eax - 0x814], 0
movsx ecx, byte [ebp - 0x814]
test ecx, ecx
je 0x4f20af
lea edx, [ebp - 0x814]
push edx
lea ecx, [ebp - 0x828]
call fcn.0050f680
mov dword [ebp - 0x2030], 0xffffffff
jmp 0x4f201e
mov eax, dword [ebp - 0x2030]
mov ecx, dword [ebp - 0x82c]
mov dl, byte [ebp + ecx - 0x4834]
mov byte [ebp + eax - 0x814], dl
mov eax, dword [ebp - 0x2034]
sub eax, 1
cmp dword [ebp - 0x82c], eax
jne 0x4f2109
mov ecx, dword [ebp - 0x2030]
mov byte [ebp + ecx - 0x813], 0
lea edx, [ebp - 0x814]
push edx
lea ecx, [ebp - 0x828]
call fcn.0050f680
jmp 0x4f201e
push 0x5b8f0c
lea eax, [ebp - 0x182c]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 0x82c], 0
jmp 0x4f213d
mov ecx, dword [ebp - 0x82c]
add ecx, 1
mov dword [ebp - 0x82c], ecx
lea ecx, [ebp - 0x828]
call fcn.0050f110
cmp dword [ebp - 0x82c], eax
jge 0x4f310f
mov edx, dword [ebp - 0x82c]
push edx
lea ecx, [ebp - 0x828]
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
lea eax, [ebp - 0x814]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
movsx ecx, byte [ebp - 0x814]
cmp ecx, 0x22
jne 0x4f2211
lea edx, [ebp - 0x814]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x2034], eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x2030], 0
jmp 0x4f21cd
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x2030]
add ecx, 1
mov dword [ebp - 0x2030], ecx
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x2034]
jge 0x4f2203
mov eax, dword [ebp - 0x14]
movsx ecx, byte [ebp + eax - 0x814]
cmp ecx, 0x22
jne 0x4f21ea
jmp 0x4f2203
mov edx, dword [ebp - 0x2030]
mov eax, dword [ebp - 0x14]
mov cl, byte [ebp + eax - 0x814]
mov byte [ebp + edx - 0x814], cl
jmp 0x4f21b5
mov edx, dword [ebp - 0x2030]
mov byte [ebp + edx - 0x814], 0
movsx eax, byte [ebp - 0x813]
cmp eax, 0x3a
je 0x4f2250
lea ecx, [ebp - 0x814]
push ecx
push 0x5b7db4
push 0x5a7308
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
lea edx, [ebp - 0x814]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0x202c]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea edx, [ebp - 0x202c]
push edx
call fcn.00401fca
add esp, 4
push str.ARCHIVOS_DE_PROGRAMA_
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f22c4
push str.PROGRAM_FILES_
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f22c4
push str.PROGRAM_FILES__X86__
lea edx, [ebp - 0x202c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4f248b
push ecx
mov ecx, esp
mov dword [ebp - 0x483c], esp
lea eax, [ebp - 0x814]
push eax
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 0x4850], eax
call fcn.004ae7b8
add esp, 4
mov dword [ebp - 0x4854], eax
cmp dword [ebp - 0x4854], 0
jne 0x4f248b
lea ecx, [ebp - 0x814]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4f248b
lea edx, [ebp - 0x814]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x2034], eax
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0x3834]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x2034]
mov dword [ebp - 0x82c], edx
jmp 0x4f2358
mov eax, dword [ebp - 0x82c]
sub eax, 1
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x82c], 0
jle 0x4f2378
mov ecx, dword [ebp - 0x82c]
movsx edx, byte [ebp + ecx - 0x3834]
cmp edx, 0x5c
jne 0x4f2376
jmp 0x4f2378
jmp 0x4f2349
mov eax, dword [ebp - 0x82c]
mov byte [ebp + eax - 0x3834], 0
lea ecx, [ebp - 0x3834]
push ecx
push 0x54
push str.RamnitPATH
push 0x5a735c
push 0x80000002
call fcn.00402bb9
add esp, 0x14
mov edx, dword [ebp - 0x82c]
add edx, 1
mov dword [ebp - 0x82c], edx
mov dword [ebp - 0x2030], 0
jmp 0x4f23df
mov eax, dword [ebp - 0x2030]
add eax, 1
mov dword [ebp - 0x2030], eax
mov ecx, dword [ebp - 0x82c]
add ecx, 1
mov dword [ebp - 0x82c], ecx
mov edx, dword [ebp - 0x82c]
cmp edx, dword [ebp - 0x2034]
jge 0x4f2409
mov eax, dword [ebp - 0x2030]
mov ecx, dword [ebp - 0x82c]
mov dl, byte [ebp + ecx - 0x3834]
mov byte [ebp + eax - 0x3834], dl
jmp 0x4f23c1
mov eax, dword [ebp - 0x2030]
mov byte [ebp + eax - 0x3834], 0
lea ecx, [ebp - 0x3834]
push ecx
push 0x54
push str.RamnitFILE
push 0x5a73a0
push 0x80000002
call fcn.00402bb9
add esp, 0x14
cmp dword [0x5b851c], 0
jne 0x4f244e
push 0
push 0
push str.Detectado_W32.Ramnit.F_nReinicie_el_Sistema_para_completar_la_Limpieza.
call sub.MFC42.DLL_AfxMessageBox
push str.Detectado_W32.Ramnit.F_n
mov ecx, 0x5b5b78
call fcn.0050f680
lea edx, [ebp - 0x814]
push edx
push str._Userinit__..._s...__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
call fcn.004ae964
push ecx
mov ecx, esp
mov dword [ebp - 0x4840], esp
lea eax, [ebp - 0x814]
push eax
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 0x4858], eax
call fcn.004ae7b8
add esp, 4
mov dword [ebp - 0x485c], eax
cmp dword [ebp - 0x485c], 0
jne 0x4f24c2
jmp 0x4f212e
push 0
lea ecx, [ebp - 0x814]
push ecx
call fcn.004f9b07
add esp, 8
test eax, eax
je 0x4f2b38
push str.APPCONF32.EXE
lea edx, [ebp - 0x202c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.ARCHIVERFORWIN.EXE
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.AUDIOTREIBER_X64.EXE
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.BLAY.COM
lea edx, [ebp - 0x202c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.BOOTLIST32.EXE
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.BOOTWINDOWS.EXE
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.BSI.BUND.EXE
lea edx, [ebp - 0x202c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.CLIENTMON.EXE
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.CLIENTMONITOR.EXE
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.CLIENTSVR.EXE
lea edx, [ebp - 0x202c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.CP40.EXE
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.CPNET.EXE
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.CTFMON.EXE
lea edx, [ebp - 0x202c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.DCSCMINIMDCSC.EXE
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.DESKTOPLAYER.EXE
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.FSNAPSHOT_X86.EXE
lea edx, [ebp - 0x202c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.INETSERV.EXE
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.INSTALLCALC.EXE
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.INTEL32.EXE
lea edx, [ebp - 0x202c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.INTERNT.EXE
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.IPROTECT.EXE
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.KSPRSKYLABS1.EXE
lea edx, [ebp - 0x202c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.LOCALSYS64.EXE
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.MICROSOFTCSRSS.EXE
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.MISSAU.EXE
lea edx, [ebp - 0x202c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.MSDCSCMSDCSC.EXE
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.MSDCMSDCVC.EXE
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.MSDCSCMSSYSTEM.EXE
lea edx, [ebp - 0x202c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.MSDCSCWINLOGIN.EXE
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.NTOS.EXE
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.NTFSOURS.EXE
lea edx, [ebp - 0x202c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.OEMBIOS.EXE
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.PING.EXE
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.RUN64DLLSYS.EXE
lea edx, [ebp - 0x202c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.SDRA64.EXE
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.SECPOL.EXE
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.SERVIES.EXE
lea edx, [ebp - 0x202c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push 0x5a76c8
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.SVCINIT.EXE
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.SVCPACK.EXE
lea edx, [ebp - 0x202c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push 0x5a76f4
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.SYSTEMRUNDLL32.EXE
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.TASKMGR.EXE
lea edx, [ebp - 0x202c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.TWEXT.EXE
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.TWEX.EXE
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.UESIUQCR.EXE
lea edx, [ebp - 0x202c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.UOYZSYDZ.EXE
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push 0x5a7764
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.VSHOST32.EXE
lea edx, [ebp - 0x202c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.WATERMARK.EXE
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.WINDOWS64.EXE
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.WINLOGON32.EXE
lea edx, [ebp - 0x202c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.WINLOGON86.EXE
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.WINDUPDTWINUPDATE.EXE
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.WSAUPDATER.EXE
lea edx, [ebp - 0x202c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.WMSDKNS.EXE
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2b38
push str.XAMPPGIFT.EXE
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4f2b4e
lea edx, [ebp - 0x202c]
push edx
mov ecx, 0x5b5bf0
call fcn.0050f680
jmp 0x4f212e
lea eax, [ebp - 0x202c]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x2034], eax
cmp dword [ebp - 0x2034], 0x2c
jne 0x4f2b9b
push str.SYSTEM32_
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4f2b9b
lea edx, [ebp - 0x202c]
push edx
mov ecx, 0x5b5bf0
call fcn.0050f680
jmp 0x4f212e
push str.BINARYSOUNDX.EXE
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4f2bb9
jmp 0x4f212e
lea ecx, [ebp - 0x182c]
push ecx
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b6504
call fcn.00401fca
add esp, 4
lea edx, [ebp - 0x202c]
push edx
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f2c30
mov eax, dword [ebp - 0x82c]
push eax
lea ecx, [ebp - 0x828]
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x182c]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5a7828
lea edx, [ebp - 0x182c]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
push str.ALMXPMGR.EXE
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f301e
push str.G_DATAINTERNETSECURITYAVKKIDAVKCKS.EXE
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f301e
push str.G_DATAINTERNETSECURITYAVKTRAYAVKTRAY.EXE
lea edx, [ebp - 0x202c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f301e
push str.DPAGENT.EXE
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f301e
push str.EZSHELLSTART.EXE
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f301e
push str.EZRECOVER.EXE
lea edx, [ebp - 0x202c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f301e
push str.KUSRINIT.EXE
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f301e
push str.NWWHK32.EXE
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f301e
push str.PCSPEEDUPNOTIFIER.EXE
lea edx, [ebp - 0x202c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f301e
push str.ISAFEWPK.EXE
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f301e
push str.SECURECONNECTOR.EXE
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f301e
push str.SFTDCC.EXE
lea edx, [ebp - 0x202c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f301e
push str.SKIPMETROSUITE.EXE
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f301e
push str.SMCHK.EXE
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f301e
push str.SSOLAUNCHER.EXE
lea edx, [ebp - 0x202c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f301e
push str.SSOSHELL.EXE
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f301e
push str.SYSTEM32RDPINIT.EXE
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f301e
push 0x5a7994
lea edx, [ebp - 0x202c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f301e
push 0x5a79ac
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f301e
push str.SYSWOW64USERINIT.EXE
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f301e
push str.TSIRCUSR.EXE
lea edx, [ebp - 0x202c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f301e
push str.WSCTOOL.EXE
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f301e
push str.WSSM.EXE
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f301e
lea edx, [ebp - 0x814]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x2034], eax
mov eax, dword [ebp - 0x2034]
mov dword [ebp - 0x14], eax
jmp 0x4f2ef4
mov ecx, dword [ebp - 0x14]
sub ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jle 0x4f2f0e
mov edx, dword [ebp - 0x14]
movsx eax, byte [ebp + edx - 0x814]
cmp eax, 0x5c
jne 0x4f2f0c
jmp 0x4f2f0e
jmp 0x4f2eeb
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x2030], 0
jmp 0x4f2f3b
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x2030]
add eax, 1
mov dword [ebp - 0x2030], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x2034]
jge 0x4f2f5f
mov edx, dword [ebp - 0x2030]
mov eax, dword [ebp - 0x14]
mov cl, byte [ebp + eax - 0x814]
mov byte [ebp + edx - 0x3834], cl
jmp 0x4f2f23
mov edx, dword [ebp - 0x2030]
mov byte [ebp + edx - 0x3834], 0
push 0x5b7ba4
push str._sMuestras
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
lea eax, [ebp - 0x3834]
push eax
push 0x5b7ba4
push str._sMuestras_s__UserInit_.vir
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0
push 0x5b6504
lea ecx, [ebp - 0x814]
push ecx
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea edx, [ebp - 0x3834]
push edx
push 0x5b7ba4
lea eax, [ebp - 0x814]
push eax
push str._UserInit____s__n__Por_favor__envienos_el_INFOSAT.TXT_y_una_muestra_del_fichero_n___sMuestras_s__UserInit_.vir_n__a__virus_satinfo.es_._Gracias._n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
cmp dword [0x5b851c], 0
jne 0x4f300f
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
push 0x5b7db4
push str._sUserinit.exe
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
call fcn.00401fca
add esp, 4
push 0x5b6504
lea ecx, [ebp - 0x202c]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4f3062
mov dword [ebp - 0x10], 1
push 0x5b7eb4
push 0x5a7ad8
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
call fcn.00401fca
add esp, 4
push 0x5b6504
lea edx, [ebp - 0x202c]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4f30a6
mov dword [ebp - 0x10], 1
push 0x5b7db4
push str._sRdpinit.exe
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
call fcn.00401fca
add esp, 4
push 0x5b6504
lea eax, [ebp - 0x202c]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4f30ea
mov dword [ebp - 0x10], 1
push str.SYSTEM32USERINIT.EXE
lea ecx, [ebp - 0x202c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4f310a
mov dword [ebp - 0x10], 1
jmp 0x4f212e
cmp dword [ebp - 0x10], 0
jne 0x4f31bb
push 0x5b7eb4
push str._sSysWOW64Userinit.exe
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push ecx
mov ecx, esp
mov dword [ebp - 0x4844], esp
push 0x5b6504
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 0x4860], eax
call fcn.004ae7b8
add esp, 4
mov dword [ebp - 0x4864], eax
cmp dword [ebp - 0x4864], 0
je 0x4f3184
lea edx, [ebp - 0x182c]
push edx
push 0x5b7eb4
push str._sSysWOW64Userinit.exe__s
lea eax, [ebp - 0x3034]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
jmp 0x4f31a5
lea ecx, [ebp - 0x182c]
push ecx
push 0x5b7db4
push str._sUserinit.exe__s
lea edx, [ebp - 0x3034]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x3034]
push eax
lea ecx, [ebp - 0x182c]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea edx, [ebp - 0x182c]
push edx
lea eax, [ebp - 0x4834]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4f3225
lea ecx, [ebp - 0x182c]
push ecx
push 0x54
push str.UserInit
push 0x5a7b78
push 0x80000002
call fcn.00402bb9
add esp, 0x14
lea edx, [ebp - 0x182c]
push edx
lea eax, [ebp - 0x4834]
push eax
push str.Restaurado__Userinit__n_Userinit_anterior_____s__n_Userinit_actual_______s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x828]
call fcn.0051046c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret