Function at 0x4fc73c
Capabilities:
Delete file
Manipulate safe mode programs
Move file
Persist via lnk shortcut
Persist via run registry key
Persist via winlogon helper dll registry key
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5135f2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x33c
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x214], eax
push 0x5aa260
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4fc79f
push str.Explorer.exe
push 0x54
push str.Shell
push 0x5aa27c
push 0x80000002
call fcn.00402bb9
add esp, 0x14
push 0x5aa2b4
mov edx, dword [ebp + 0xc]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4fc844
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5aa2f0
push 0x5b6504
push 0x80000001
call fcn.00402ed5
add esp, 0xc
push 0x5aa2f8
push 0x5b6504
push 0x80000001
call fcn.00402ed5
add esp, 0xc
push 0x5b6504
push str..Default_s
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.load
lea ecx, [ebp - 0x20c]
push ecx
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5aa310
lea edx, [ebp - 0x20c]
push edx
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5aa314
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4fc8e4
mov ecx, dword [ebp + 8]
push ecx
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [0x5b84b8], 0
jmp 0x4fc889
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
mov eax, dword [0x5b84b8]
cmp eax, dword [ebp - 0x214]
jge 0x4fc8b6
mov ecx, dword [0x5b84b8]
movsx edx, byte [ecx + 0x5b6504]
cmp edx, 0x2e
jne 0x4fc8b4
mov eax, dword [0x5b84b8]
mov byte [eax + 0x5b6504], 0
jmp 0x4fc87a
push 0x5b6504
push str.SystemCurrentControlSetServices_s
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5aa340
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4fc984
mov ecx, dword [ebp + 8]
push ecx
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [0x5b84b8], 0
jmp 0x4fc929
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
mov eax, dword [0x5b84b8]
cmp eax, dword [ebp - 0x214]
jge 0x4fc956
mov ecx, dword [0x5b84b8]
movsx edx, byte [ecx + 0x5b6504]
cmp edx, 0x2e
jne 0x4fc954
mov eax, dword [0x5b84b8]
mov byte [eax + 0x5b6504], 0
jmp 0x4fc91a
push 0x5b6504
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogonNotify_s
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x5aa384
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4fca10
push 0x104
lea ecx, [ebp - 0x318]
push ecx
call dword [sym.imp.MSVCRT.dll__getcwd]
add esp, 8
movsx edx, byte [ebp - 0x316]
cmp edx, 0x5c
jne 0x4fc9e5
movsx eax, byte [ebp - 0x315]
test eax, eax
jne 0x4fc9e5
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x318]
push edx
push 0x5aa388
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
jmp 0x4fca03
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x318]
push ecx
push 0x5aa390
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
call fcn.0050c963
add esp, 4
push 0x5aa398
mov edx, dword [ebp + 0xc]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4fca51
mov eax, dword [ebp + 8]
push eax
push 0x5aa39c
push 0x80000002
call fcn.00402ed5
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5aa3f8
mov edx, dword [ebp + 0xc]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4fcaab
mov eax, dword [ebp + 8]
push eax
push 0x5aa3fc
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
push 0x5aa400
push 0x80000001
call fcn.00402ed5
add esp, 0xc
push 0x5b6504
push 0x5aa430
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5aa460
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4fcb46
mov edx, dword [ebp + 8]
push edx
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [0x5b84b8], 0
jmp 0x4fcaee
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov ecx, dword [0x5b84b8]
cmp ecx, dword [ebp - 0x214]
jge 0x4fcb1d
mov edx, dword [0x5b84b8]
movsx eax, byte [edx + 0x5b6504]
cmp eax, 0x2e
jne 0x4fcb1b
mov ecx, dword [0x5b84b8]
mov byte [ecx + 0x5b6504], 0
jmp 0x4fcae1
push str._Agent
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
push 0x5aa46c
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5aa49c
mov edx, dword [ebp + 0xc]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4fccc7
mov eax, dword [ebp + 8]
push eax
push 0x5aa4a0
push 0x80000001
call fcn.00402ed5
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 0x5aa4d0
push 0x80000001
call fcn.00402ed5
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0x5aa504
push 0x80000002
call fcn.00402ed5
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
push 0x5aa534
push 0x80000002
call fcn.00402ed5
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 0x5aa568
push 0x80000003
call fcn.00402ed5
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0x5aa5a0
push 0x80000003
call fcn.00402ed5
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [0x5b84b8], 0
jmp 0x4fcc0f
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
mov edx, dword [0x5b84b8]
cmp edx, dword [ebp - 0x214]
jge 0x4fcc3d
mov eax, dword [0x5b84b8]
movsx ecx, byte [eax + 0x5b6504]
cmp ecx, 0x2e
jne 0x4fcc3b
mov edx, dword [0x5b84b8]
mov byte [edx + 0x5b6504], 0
jmp 0x4fcc00
push 0x5b6504
push 0x5aa5dc
push 0x80000001
call fcn.00402ed5
add esp, 0xc
push 0x5b6504
push 0x5aa60c
push 0x80000001
call fcn.00402ed5
add esp, 0xc
push 0x5b6504
push 0x5aa640
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b6504
push 0x5aa670
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5b6504
push 0x5aa6a4
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5b6504
push str..DefaultSoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x5aa718
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4fcd69
mov ecx, dword [ebp + 8]
push ecx
push 0x5aa71c
push 0x80000001
call fcn.00402ed5
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0x5aa74c
push 0x80000002
call fcn.00402ed5
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
push str..DefaultSoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000003
call fcn.00402ed5
add esp, 0xc
push 0x104
push 0x5b6504
call dword [sym.imp.MSVCRT.dll__getcwd]
add esp, 8
mov byte [0x5b6506], 0
push 0x5aa7b4
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
push 0x5aa7c4
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4fcdee
mov edx, dword [ebp + 8]
push edx
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [0x5b84b8], 0
jmp 0x4fcda8
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov ecx, dword [0x5b84b8]
cmp ecx, dword [ebp - 0x214]
jge 0x4fcdd7
mov edx, dword [0x5b84b8]
movsx eax, byte [edx + 0x5b6504]
cmp eax, 0x2e
jne 0x4fcdd5
mov ecx, dword [0x5b84b8]
mov byte [ecx + 0x5b6504], 0
jmp 0x4fcd9b
push 0x5b6504
push str.SoftwareMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
push 0x80000002
call fcn.00402ed5
add esp, 0xc
push 0x5aa810
mov edx, dword [ebp + 0xc]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4fce16
push 0
push 0
push str.Reinicie_el_Sistema_en__Modo_Seguro_con_S
call sub.MFC42.DLL_AfxMessageBox
call fcn.004ae964
push 0x5aa870
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4fce72
push 0x104
push 0x5b6504
call dword [sym.imp.MSVCRT.dll__getcwd]
add esp, 8
mov byte [0x5b6506], 0
push 0x5aa874
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
push str.FGH_
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4fcf16
mov edx, dword [ebp + 8]
push edx
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [0x5b84b8], 0
jmp 0x4fceb5
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov ecx, dword [0x5b84b8]
cmp ecx, dword [ebp - 0x214]
jge 0x4fcefc
mov edx, dword [0x5b84b8]
movsx eax, byte [edx + 0x5b6504]
cmp eax, 0x2e
je 0x4fcef8
mov ecx, dword [0x5b84b8]
movsx edx, byte [ecx + 0x5b6504]
cmp edx, 0x20
jne 0x4fcefa
mov eax, dword [0x5b84b8]
movsx ecx, byte [eax + 0x5b6505]
cmp ecx, 0x20
jne 0x4fcefa
jmp 0x4fcefc
jmp 0x4fcea8
mov edx, dword [0x5b84b8]
mov byte [edx + 0x5b6504], 0
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push 0x5aa888
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4fcf91
mov ecx, dword [ebp + 8]
push ecx
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [0x5b84b8], 0
jmp 0x4fcf57
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
mov eax, dword [0x5b84b8]
cmp eax, dword [ebp - 0x214]
jge 0x4fcf84
mov ecx, dword [0x5b84b8]
movsx edx, byte [ecx + 0x5b6504]
cmp edx, 0x2e
jne 0x4fcf82
mov eax, dword [0x5b84b8]
mov byte [eax + 0x5b6503], 0
jmp 0x4fcf48
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push 0x5aa88c
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4fd096
mov edx, dword [ebp + 8]
push edx
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [0x5b84b8], 0
jmp 0x4fcfd4
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov ecx, dword [0x5b84b8]
cmp ecx, dword [ebp - 0x214]
jge 0x4fd003
mov edx, dword [0x5b84b8]
movsx eax, byte [edx + 0x5b6504]
cmp eax, 0x2e
jne 0x4fd001
mov ecx, dword [0x5b84b8]
mov byte [ecx + 0x5b6504], 0
jmp 0x4fcfc7
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push 0x104
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.MSVCRT.dll__getcwd]
add esp, 8
mov byte [ebp - 0x20a], 0
push 0x5aa890
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
lea ecx, [ebp - 0x20c]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push 0x5aa894
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
push 0
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
push 0x5aa89c
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4fd6e5
mov dword [0x5b4120], 0
jmp 0x4fd0ca
mov ecx, dword [0x5b4120]
add ecx, 1
mov dword [0x5b4120], ecx
mov ecx, 0x5b7890
call fcn.0050f110
cmp dword [0x5b4120], eax
jge 0x4fd649
push str.Start_Menu
push 0x5aa8ac
push 0x80000001
lea edx, [ebp - 0x31c]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0x330], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x330]
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x20c]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x31c]
call sub.MFC42.DLL_CString::CString
lea edx, [ebp - 0x20c]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x214], eax
mov dword [0x5b84b8], 3
jmp 0x4fd172
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov ecx, dword [0x5b84b8]
cmp ecx, dword [ebp - 0x214]
jge 0x4fd197
mov edx, dword [0x5b84b8]
movsx eax, byte [ebp + edx - 0x20c]
cmp eax, 0x5c
jne 0x4fd195
jmp 0x4fd197
jmp 0x4fd165
mov dword [ebp - 0x210], 0
jmp 0x4fd1c1
mov ecx, dword [ebp - 0x210]
add ecx, 1
mov dword [ebp - 0x210], ecx
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
mov eax, dword [0x5b84b8]
cmp eax, dword [ebp - 0x214]
jge 0x4fd1ea
mov ecx, dword [ebp - 0x210]
mov edx, dword [0x5b84b8]
mov al, byte [ebp + edx - 0x20c]
mov byte [ebp + ecx - 0x20c], al
jmp 0x4fd1a3
mov ecx, dword [ebp - 0x210]
mov byte [ebp + ecx - 0x20c], 0
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [0x5b4120]
push eax
mov ecx, 0x5b7890
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
push 0x5b7aa4
push 0x5aa8f4
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
push 2
push 0x5b6504
call fcn.004e6419
add esp, 8
push str.Desktop
push 0x5aa904
push 0x80000001
lea edx, [ebp - 0x320]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x334], eax
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0x338], eax
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x338]
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x20c]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x320]
call sub.MFC42.DLL_CString::CString
lea edx, [ebp - 0x20c]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x214], eax
mov dword [0x5b84b8], 3
jmp 0x4fd2cb
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov ecx, dword [0x5b84b8]
cmp ecx, dword [ebp - 0x214]
jge 0x4fd2f0
mov edx, dword [0x5b84b8]
movsx eax, byte [ebp + edx - 0x20c]
cmp eax, 0x5c
jne 0x4fd2ee
jmp 0x4fd2f0
jmp 0x4fd2be
mov dword [ebp - 0x210], 0
jmp 0x4fd31a
mov ecx, dword [ebp - 0x210]
add ecx, 1
mov dword [ebp - 0x210], ecx
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
mov eax, dword [0x5b84b8]
cmp eax, dword [ebp - 0x214]
jge 0x4fd343
mov ecx, dword [ebp - 0x210]
mov edx, dword [0x5b84b8]
mov al, byte [ebp + edx - 0x20c]
mov byte [ebp + ecx - 0x20c], al
jmp 0x4fd2fc
mov ecx, dword [ebp - 0x210]
mov byte [ebp + ecx - 0x20c], 0
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [0x5b4120]
push eax
mov ecx, 0x5b7890
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
push 0x5b7aa4
push 0x5aa94c
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
push 2
push 0x5b6504
call fcn.004e6419
add esp, 8
push str.Personal
push 0x5aa960
push 0x80000001
lea edx, [ebp - 0x324]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x340], eax
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x340]
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x20c]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x324]
call sub.MFC42.DLL_CString::CString
lea edx, [ebp - 0x20c]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x214], eax
mov dword [0x5b84b8], 3
jmp 0x4fd424
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov ecx, dword [0x5b84b8]
cmp ecx, dword [ebp - 0x214]
jge 0x4fd449
mov edx, dword [0x5b84b8]
movsx eax, byte [ebp + edx - 0x20c]
cmp eax, 0x5c
jne 0x4fd447
jmp 0x4fd449
jmp 0x4fd417
mov dword [ebp - 0x210], 0
jmp 0x4fd473
mov ecx, dword [ebp - 0x210]
add ecx, 1
mov dword [ebp - 0x210], ecx
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
mov eax, dword [0x5b84b8]
cmp eax, dword [ebp - 0x214]
jge 0x4fd49c
mov ecx, dword [ebp - 0x210]
mov edx, dword [0x5b84b8]
mov al, byte [ebp + edx - 0x20c]
mov byte [ebp + ecx - 0x20c], al
jmp 0x4fd455
mov ecx, dword [ebp - 0x210]
mov byte [ebp + ecx - 0x20c], 0
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [0x5b4120]
push eax
mov ecx, 0x5b7890
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
push 0x5b7aa4
push 0x5aa9a8
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
push 2
push 0x5b6504
call fcn.004e6419
add esp, 8
push str.Favorites
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
push 0x80000001
lea edx, [ebp - 0x328]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x348], eax
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x348]
call fcn.0050f0b0
push eax
lea ecx, [ebp - 0x20c]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x328]
call sub.MFC42.DLL_CString::CString
lea edx, [ebp - 0x20c]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x214], eax
mov dword [0x5b84b8], 3
jmp 0x4fd57d
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov ecx, dword [0x5b84b8]
cmp ecx, dword [ebp - 0x214]
jge 0x4fd5a2
mov edx, dword [0x5b84b8]
movsx eax, byte [ebp + edx - 0x20c]
cmp eax, 0x5c
jne 0x4fd5a0
jmp 0x4fd5a2
jmp 0x4fd570
mov dword [ebp - 0x210], 0
jmp 0x4fd5cc
mov ecx, dword [ebp - 0x210]
add ecx, 1
mov dword [ebp - 0x210], ecx
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
mov eax, dword [0x5b84b8]
cmp eax, dword [ebp - 0x214]
jge 0x4fd5f5
mov ecx, dword [ebp - 0x210]
mov edx, dword [0x5b84b8]
mov al, byte [ebp + edx - 0x20c]
mov byte [ebp + ecx - 0x20c], al
jmp 0x4fd5ae
mov ecx, dword [ebp - 0x210]
mov byte [ebp + ecx - 0x20c], 0
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [0x5b4120]
push eax
mov ecx, 0x5b7890
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
push 0x5b7aa4
push str._s_s_s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
push 2
push 0x5b6504
call fcn.004e6419
add esp, 8
jmp 0x4fd0bb
mov ecx, 0x5b7668
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 2
push 0x5b6504
call fcn.004e6419
add esp, 8
mov ecx, 0x5b7630
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 2
push 0x5b6504
call fcn.004e6419
add esp, 8
mov ecx, 0x5b7628
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 2
push 0x5b6504
call fcn.004e6419
add esp, 8
mov ecx, 0x5b7638
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 2
push 0x5b6504
call fcn.004e6419
add esp, 8
push 0x5aaa0c
mov edx, dword [ebp + 0xc]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4fd76d
cmp dword [0x5b8504], 0
jne 0x4fd76d
push 0x104
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.MSVCRT.dll__getcwd]
add esp, 8
mov byte [ebp - 0x315], 0
lea ecx, [ebp - 0x318]
push ecx
push str.Detectado_FakeTool_n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 4
push 0x5aaa54
push 0x5b6504
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x4fd76d
mov dword [0x5b8504], 1
push 2
lea edx, [ebp - 0x318]
push edx
call fcn.004e6419
add esp, 8
push 0x5aaa60
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4fd7fa
mov ecx, dword [ebp + 8]
push ecx
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [0x5b84b8], 0
jmp 0x4fd7ae
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
mov eax, dword [0x5b84b8]
cmp eax, dword [ebp - 0x214]
jge 0x4fd7db
mov ecx, dword [0x5b84b8]
movsx edx, byte [ecx + 0x5b6504]
cmp edx, 0x2e
jne 0x4fd7d9
mov eax, dword [0x5b84b8]
mov byte [eax + 0x5b6504], 0
jmp 0x4fd79f
push str..doc
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push 0x5aaa6c
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4fd9f1
mov edx, dword [ebp + 8]
push edx
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [0x5b84b8], 0
jmp 0x4fd83d
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov ecx, dword [0x5b84b8]
cmp ecx, dword [ebp - 0x214]
jge 0x4fd86c
mov edx, dword [0x5b84b8]
movsx eax, byte [edx + 0x5b6504]
cmp eax, 0x2e
jne 0x4fd86a
mov ecx, dword [0x5b84b8]
mov byte [ecx + 0x5b6504], 0
jmp 0x4fd830
push str.SystemCurrentControlSetServices_
lea edx, [ebp - 0x20c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b6504
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
lea ecx, [ebp - 0x20c]
push ecx
push 0x80000002
call fcn.00402a6b
add esp, 8
push str.SystemCurrentControlSetControlSafeBootMinimal_
lea edx, [ebp - 0x20c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b6504
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
lea ecx, [ebp - 0x20c]
push ecx
push 0x80000002
call fcn.00402a6b
add esp, 8
push 0x104
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.MSVCRT.dll__getcwd]
add esp, 8
mov byte [ebp - 0x10a], 0
push 0x5b6504
lea eax, [ebp - 0x10c]
push eax
push str._s_s.lnk
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
lea ecx, [ebp - 0x10c]
push ecx
push str._sAutorun.inf
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
lea edx, [ebp - 0x10c]
push edx
push str._smyporno.avi.lnk
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
lea eax, [ebp - 0x10c]
push eax
push str._spornmovs.lnk
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
push 0x5aab08
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4fdaa7
push 0x104
lea edx, [ebp - 0x318]
push edx
call dword [sym.imp.MSVCRT.dll__getcwd]
add esp, 8
mov byte [ebp - 0x316], 0
push 0x5aab0c
lea eax, [ebp - 0x318]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
push 0
lea ecx, [ebp - 0x318]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea edx, [ebp - 0x318]
push edx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
push 0x104
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.MSVCRT.dll__getcwd]
add esp, 8
mov byte [ebp - 0x316], 0
push str.USB_Drivers
lea ecx, [ebp - 0x318]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0
lea edx, [ebp - 0x318]
push edx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea eax, [ebp - 0x318]
push eax
call fcn.004e6241
add esp, 4
push 0x5aab2c
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4fdb92
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [0x5b84b8], 0
jmp 0x4fdaee
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
mov edx, dword [0x5b84b8]
cmp edx, dword [ebp - 0x214]
jge 0x4fdb1e
mov eax, dword [0x5b84b8]
movsx ecx, byte [ebp + eax - 0x20c]
cmp ecx, 0x2e
jne 0x4fdb1c
mov edx, dword [0x5b84b8]
mov byte [ebp + edx - 0x20c], 0
jmp 0x4fdadf
lea eax, [ebp - 0x20c]
push eax
push 0x5b7eb4
push str._sTasks_s.job
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
lea ecx, [ebp - 0x20c]
push ecx
push 0x5b7db4
push str._sTasks_s.
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
push 0x5aab50
mov edx, dword [ebp + 0xc]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4fdc99
push 0x104
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.MSVCRT.dll__getcwd]
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [0x5b84b8], 0
jmp 0x4fdbec
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
mov eax, dword [0x5b84b8]
cmp eax, dword [ebp - 0x214]
jge 0x4fdc19
mov ecx, dword [0x5b84b8]
movsx edx, byte [ecx + 0x5b6504]
cmp edx, 0x2e
jne 0x4fdc17
mov eax, dword [0x5b84b8]
mov byte [eax + 0x5b6504], 0
jmp 0x4fdbdd
push str..vxe
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 1]
cmp eax, 0x3a
je 0x4fdc6e
push 0x5b6404
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x318]
push edx
push str._s_s_____Infectado_con___s___renombrado_a_.VXE__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
jmp 0x4fdc8a
push 0x5b6404
mov eax, dword [ebp + 8]
push eax
push str._s_____Infectado_con___s___renombrado_a_.VXE__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
push 0x5aabc0
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4fdcce
push 4
push str.ATENCION
push str.Detectado_mIRC_Sospechoso._n
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
jne 0x4fdcce
mov eax, 1
jmp 0x4fdcd0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret