Function at 0x509b53
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x528
mov dword [ebp - 0x110], 0
mov dword [ebp - 4], 0
push 0x5b8f28
lea eax, [ebp - 0x31c]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [ebp - 4]
push ecx
push 0x5169c0
push 1
push 0
push 0x5169b0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jl 0x509c6d
mov dword [ebp - 0x320], 0
lea edx, [ebp - 0x320]
push edx
push 0x5169d0
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
push edx
call dword [ecx]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jl 0x509c61
push 0x104
lea eax, [ebp - 0x528]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
push 0
lea edx, [ebp - 0x528]
push edx
mov eax, dword [ebp - 0x320]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x320]
push edx
call dword [ecx + 0x14]
push 0
push 0
push 0x104
lea eax, [ebp - 0x31c]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov eax, dword [ebp - 4]
push eax
call dword [edx + 0xc]
push 0x104
lea ecx, [ebp - 0x214]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
push ecx
call dword [eax + 0x28]
mov edx, dword [ebp - 0x320]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x320]
push ecx
call dword [eax + 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
push ecx
call dword [eax + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
lea edx, [ebp - 0x31c]
push edx
call fcn.00401fca
add esp, 4
lea eax, [ebp - 0x214]
push eax
call fcn.00401fca
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x108]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x218], eax
mov ecx, dword [ebp - 0x218]
mov byte [ebp + ecx - 0x10c], 0
push str.GOOGLECHROME.A3X
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x509cfc
push str.AutoIt.JW_lnk_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
push str._C_START__CD__NJQ8ISHERE.EXE_START
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x509d40
push 0
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push str.AutoIt.Nateqj_lnk_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
push str._C_START_RUNCLUBSANDISK.EXE
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x509d84
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push str.AutoRun.ClubSanDisk_lnk_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
push str._C_START_WSCRIPT
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x509de1
push str..JS_START_EXPLORER
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x509de1
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push str.AutoRun.JS_Proslikefan_lnk_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
push str._C_START___
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x509e3e
push str._L.EXE
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x509e3e
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push str.AutoRun.Rombrast_lnk_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
push str._C__START__CD_SNKB0PTSNKB0PT.EXE
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x509e93
mov edx, dword [ebp + 8]
push edx
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push str.AutoRun.Snkb0pt_lnk_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
push str.URL.DLL_FILEPROTOCOLHANDLER_A3OJIH9L
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50a0e4
push str.URL.DLL_FILEPROTOCOLHANDLER_H3OJKIH9
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50a0e4
push str.URL.DLL_FILEPROTOCOLHANDLER_H3WJKIH9
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50a0e4
push str.URL.DLL_FILEPROTOCOLHANDLER_SL0ZPZ14
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50a0e4
push str.URL.DLL_FILEPROTOCOLHANDLER_SZPZL0ZS
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50a0e4
push str.URL.DLL_FILEPROTOCOLHANDLER_U45LUFEF
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50a0e4
push str.URL.DLL_FILEPROTOCOLHANDLER_U3OJIH9L
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50a0e4
push str.URL.DLL_FILEPROTOCOLHANDLER_UIAU3K3K
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50a0e4
push str.URL.DLL_FILEPROTOCOLHANDLER_Z3OJKIH9
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50a0e4
push str.URL.DLL_FILEPROTOCOLHANDLER_DRIVESGUIDEINFO
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50a0e4
push str.3F0EF91862C8A4D095C0
lea edx, [ebp - 0x31c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50a0e4
push str.A3OJIH9L
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50a0e4
push str.H3OJKIH9
lea ecx, [ebp - 0x31c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50a0e4
push str.H3WJKIH9
lea edx, [ebp - 0x31c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50a0e4
push str.SL0ZPZ14
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50a0e4
push str.SZPZL0ZS
lea ecx, [ebp - 0x31c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50a0e4
push str.U45LUFEF
lea edx, [ebp - 0x31c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50a0e4
push str.U3OJIH9L
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50a0e4
push str.UIAU3K3K
lea ecx, [ebp - 0x31c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50a0e4
push str.Z3OJKIH9
lea edx, [ebp - 0x31c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50a0e4
push str.DRIVESGUIDEINFO
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50a18b
mov ecx, dword [ebp + 8]
push ecx
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b6504
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x218], eax
mov edx, dword [ebp - 0x218]
movsx eax, byte [edx + 0x5b64ff]
cmp eax, 0xffffffa0
jne 0x50a136
mov ecx, dword [ebp - 0x218]
mov byte [ecx + 0x5b64ff], 0
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
jmp 0x50a16f
mov edx, dword [ebp - 0x218]
mov byte [edx + 0x5b6500], 0
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push str..EXE
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push str.AutoRun.VB.ML_lnk_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
push str._E:VBSCRIPT.ENCODE_MICROSOFT.DAT
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50a1c0
push str.AutoRun.VBS.DAT_lnk_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
push str..NFC_CRYS
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50a2d2
push str..FAT_CRYS
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50a2d2
push str..FAT32__REV_16
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50a2d2
push str..INIT_CRYS
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50a2d2
push str..INIT_KRNL
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50a2d2
push str..NIL_RUNDLL32
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50a2d2
push str..XXC_RUNDLL32
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50a2d2
push str..001___________RUNDLL32_CALC.EXE
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50a2d2
push str..INI_____RUNDLL32
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50a2d2
push str..INI______________LNK
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50a3ee
lea edx, [ebp - 0x214]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x214]
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [0x5b84b8], 0
jmp 0x50a316
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
mov edx, dword [0x5b84b8]
cmp edx, dword [ebp - 0x218]
jge 0x50a344
mov eax, dword [0x5b84b8]
movsx ecx, byte [eax + 0x5b6504]
cmp ecx, 0x2c
jne 0x50a342
mov edx, dword [0x5b84b8]
mov byte [edx + 0x5b6504], 0
jmp 0x50a307
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
push 0
push 0x5b1eb8
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push str.Autorun.inf
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
push 0
push 0x5b1ed0
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push str.Desktop.ini
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
push 0
push 0x5b1ee8
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push str.Thumbs.db
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
push 0xffffffffffffffa0
push 0x5b1f00
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push str.Dropper.Gamarue_lnk_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
push str._C_START_WSCRIPT.EXE__.TRASHES_
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50a423
push str.JS.Crisas_lnk_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
push str._C_START_0085004AD954D5AC3A3E310F1DEB0EAA.EXE
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_0378CBF2DFAE0C4D2204A99406BA997B.EXE
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_0BE9B5BE78FC1A603E5105B3437989A7.EXE
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_0FEB230408F974E810373E78F689E6ED.EXE
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_12CE4E06A81E8D54FD01D9B762F1B1BB.EXE
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_1B29E1500FAEBD568EB0B45E828F0B19.EXE
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_1DAFC34643F8E82EA7828E99698812E5.EXE
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_21DC4BD9C16558AFC1670B167071343D.EXE
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_2308AC362C4FA876DAC2B48050382080.EXE
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_23556FB1360F366337F97C924E76EAD3.EXE
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_37C62A0DA2F3441CBF32911711ED45E8.EXE
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_387F3DEFA8A402B3B786AE8F48B04E9E.EXE
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_3CA8BB44D940CC46F8550CC6C46EA0CE.EXE
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_4367CDBDE40489A342AB7738AF69FFA5.EXE
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_46D93431630FC8E404FED7204E708738.EXE
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_495805B679573CCEA2D1D456B52146D3.EXE
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_4AE1EB56BFA85E86E8AE077D43C4D4DA.EXE
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_4BF481BBB1F287075CF44D2F8D28B4A6.EXE
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_5336E13166F906F8C39BB74DBE1745C9.exe
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_5CD8F17F4086744065EB0992A09E05A2.EXE
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_5D5E3C1B562E3A75DC95740A35744AD0.EXE
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_5D62A9F23287219A94F3DD38391640C0.EXE
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_63894B452F11B718915AC1F1C2D1D210.EXE
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_6727C3AAA26457E24326BD6885470B01.EXE
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_6A57AB05E8F562330FE6CC534AAA6579.EXE
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_718E50F8C56141371FFD368176EE7B8A.EXE
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_7473A740EE91B3E5852F17361DA1E49F.EXE
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_78681353A11D91A449CEE6493CA95E80.EXE
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_7F84740653252D27BC8BB8DA28C18AB8.EXE
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_8786C37EC07A6009DB0B944Cf8472E70.exe
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_881C20E0B9874D571E58DA35AD97FEE1.EXE
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_8EE11C97894177D0B1CD8DC0DDA363eE.EXE
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_9B5B066774CC964BAF0A3B272E336678.EXE
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_9D73C3D7C98F6091514374A8419C180F.EXE
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_A4A583AA8C0B3AB775F52FA74CB6B35A.EXE
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_AA60F35F024139C51FE788EFC0B50AD7.EXE
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_AAC8DEF8ABD08A0A287AEB5D74C0DB08.EXE
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_AB2837E40BC7A40C9CBC1081E240091D.EXE
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_B59BC9008CF5DB0A294CE70588340C26.EXE
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_B8D41A36C0F1DE1AE26BF020F0FD54BC.EXE
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_BABE8364D0B44DE2EA6E4BCCCD70281E.EXE
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_C50968F33F54165F0BB150F09DEDB7D8.EXE
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_CC79ABFF0A7FD2E71C3ABF986BCB8494.EXE
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_CED389DAF1C7CE15E02498019B31330C.EXE
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_D1715F14623D232B9020F8CC542A43F1.EXE
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_D1D4FB33582C375EA197DD0F850B1DC0.EXE
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_D3056C6E51995D0644243513583E1BD4.EXE
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_D7089CDDB5C8421B544FD111F9CDC4E9.EXE
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_DAE31C02CB06222E776B9CCB9207EDB1.EXE
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_DC65A9714BCD75A4B984B7952600D23A.EXE
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_DCE1253CE7B8BE7E6FDDFAA541EBB372.EXE
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_E1E7A0DD0371F12B4C21D4D719934022.EXE
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_E79D569BA77562F0D4316E586835F0A2.EXE
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_EB617CEC8330A2E2839B84561521FD22.EXE
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50aa46
push str._C_START_FF2855B57F188C6ADFFA5D573007BA57.EXE
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50aa71
push 0
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push 0x5b299c
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
push str._C_START_CAGOHACK.EXE
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50aab5
push 0
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push 0x5b29d0
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
push str.WINDOWSDEFENDERNOTIFICATION.EXE
lea edx, [ebp - 0x31c]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50aaf9
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push str.Keylogger.Bladabindi_lnk_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
push str._C_START_SVCHOST.EXE
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50ab3d
push 0
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push str.Keylogger.Bladabindi.B_lnk_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
push str._C_START_TESLA.EXE
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50ab81
push 0
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push str.Keylogger.Bladabindi.D_lnk_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
push str._C_START_163B1C6078322E6BB4EB60CE24ACCDFD.EXE
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50abc5
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push str.Keylogger.Bladabindi.AI_lnk_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
push str._C_START_SYSTEM___VOLUME___INFORMATION.SCR
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50ac09
push 0
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push str.KeyLogger.Imminent_dr__lnk_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
push str.WINDOWS_UPDATESVCHOST.EXE
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50ac3e
push str.KeyLogger.Imminent_lnk_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
push str._C_START_MSOCACHE.PIF
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50ad68
lea edx, [ebp - 0x214]
push edx
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b6504
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
mov dword [0x5b84b8], eax
jmp 0x50ac9e
mov ecx, dword [0x5b84b8]
sub ecx, 1
mov dword [0x5b84b8], ecx
cmp dword [0x5b84b8], 0
jle 0x50acbd
mov edx, dword [0x5b84b8]
movsx eax, byte [edx + 0x5b6504]
cmp eax, 0x20
jne 0x50acbb
jmp 0x50acbd
jmp 0x50ac8f
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
mov dword [ebp - 0x10c], 0
jmp 0x50acf6
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
mov eax, dword [ebp - 0x10c]
add eax, 1
mov dword [ebp - 0x10c], eax
mov ecx, dword [0x5b84b8]
cmp ecx, dword [ebp - 0x218]
jge 0x50ad32
mov edx, dword [0x5b84b8]
movsx eax, byte [edx + 0x5b6504]
cmp eax, 0x26
jne 0x50ad18
jmp 0x50ad32
mov ecx, dword [ebp - 0x10c]
mov edx, dword [0x5b84b8]
mov al, byte [edx + 0x5b6504]
mov byte [ecx + 0x5b6504], al
jmp 0x50acd8
mov ecx, dword [ebp - 0x10c]
mov byte [ecx + 0x5b6504], 0
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push str.Keylogger.Virata_lnk_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
movsx edx, byte [ebp - 0x214]
cmp edx, 0xffffffa0
jne 0x50adc3
movsx eax, byte [ebp - 0x213]
cmp eax, 0x5c
jne 0x50adc3
movsx ecx, byte [ebp - 0x212]
cmp ecx, 0x7e
jne 0x50adc3
movsx edx, byte [ebp - 0x211]
cmp edx, 0x24
jne 0x50adc3
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push str.Malware._Bak_lnk_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
push str.WINDOWSUPDATE.EXE
lea ecx, [ebp - 0x31c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50ae07
push 0
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push str.Malware.DHCPMon_lnk_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
push str._C_START_SCR.EXE
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50ae4b
push 0
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push str.Malware.WebHelper_lnk_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
push str.___TYPE__
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50aec1
push str..EXE______TEMP__
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50aec1
push str..EXE_____TEMP__
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50aec1
push 0
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push str.Ransom.Spora_lnk_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
push 0x5b2c3c
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50af1e
push str..EXESTART_EXPLORER
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50af1e
push 0
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push str.Trojan.Comsirig_lnk_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
push str._C_START_CACHE_678589CCB271.PIF
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50af62
push 0
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push str.Trojan.Fsysna.D_lnk_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
push 0x5b2cb0
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50b0a5
push str..JSSTART
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50b0a5
lea ecx, [ebp - 0x214]
push ecx
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b6504
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x218], eax
mov edx, dword [ebp - 0x218]
mov dword [0x5b84b8], edx
jmp 0x50afde
mov eax, dword [0x5b84b8]
sub eax, 1
mov dword [0x5b84b8], eax
cmp dword [0x5b84b8], 0
jle 0x50affd
mov ecx, dword [0x5b84b8]
movsx edx, byte [ecx + 0x5b6504]
cmp edx, 0x20
jne 0x50affb
jmp 0x50affd
jmp 0x50afd1
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov dword [ebp - 0x10c], 0
jmp 0x50b034
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
mov edx, dword [ebp - 0x10c]
add edx, 1
mov dword [ebp - 0x10c], edx
mov eax, dword [0x5b84b8]
cmp eax, dword [ebp - 0x218]
jge 0x50b06f
mov ecx, dword [0x5b84b8]
movsx edx, byte [ecx + 0x5b6504]
cmp edx, 0x26
jne 0x50b055
jmp 0x50b06f
mov eax, dword [ebp - 0x10c]
mov ecx, dword [0x5b84b8]
mov dl, byte [ecx + 0x5b6504]
mov byte [eax + 0x5b6504], dl
jmp 0x50b016
mov eax, dword [ebp - 0x10c]
mov byte [eax + 0x5b6504], 0
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push str.Trojan.JS.Cryxos_lnk_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
push str.LINK.EXE
lea ecx, [ebp - 0x31c]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50b0f9
push 0
lea edx, [ebp - 0x31c]
push edx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
push str.Trojan.Nymeria_lnk_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
push str._C_START_SVHOST.EXESTART
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50b13d
push 0
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push str.Trojan.Startun_lnk_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
push str._C_START__CD__CMITROS.EXE_START__CD_
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50b1f8
push str._C_START__CD__FLASHFXP1.EXE_START__CD_
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50b1f8
push str._C_START__CD__PALOMA_.EXE_START__CD_
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50b1f8
push str._C_START__CD__SHOWGIRLS.EXE_START__CD_
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50b1f8
push str._C_START__CD__SYSDATE.EXE_START__CD_
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50b1f8
push str._C_START__CD__SYSTEME.EXE_START__CD_
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50b1f8
push str._C_START__CD__SYSTEMI.EXE_START__CD_
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50b311
lea ecx, [ebp - 0x214]
push ecx
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b6504
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x218], eax
mov edx, dword [ebp - 0x218]
mov dword [0x5b84b8], edx
jmp 0x50b23a
mov eax, dword [0x5b84b8]
sub eax, 1
mov dword [0x5b84b8], eax
cmp dword [0x5b84b8], 0
jle 0x50b259
mov ecx, dword [0x5b84b8]
movsx edx, byte [ecx + 0x5b6504]
cmp edx, 0x25
jne 0x50b257
jmp 0x50b259
jmp 0x50b22d
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
mov dword [ebp - 0x10c], 0
jmp 0x50b29f
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
mov eax, dword [ebp - 0x10c]
add eax, 1
mov dword [ebp - 0x10c], eax
mov ecx, dword [0x5b84b8]
cmp ecx, dword [ebp - 0x218]
jge 0x50b2db
mov edx, dword [0x5b84b8]
movsx eax, byte [edx + 0x5b6504]
cmp eax, 0x22
jne 0x50b2c1
jmp 0x50b2db
mov ecx, dword [ebp - 0x10c]
mov edx, dword [0x5b84b8]
mov al, byte [edx + 0x5b6504]
mov byte [ecx + 0x5b6504], al
jmp 0x50b281
mov ecx, dword [ebp - 0x10c]
mov byte [ecx + 0x5b6504], 0
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push 0x5b2e48
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
push str._C_START__CD__CMITROS.EXE_START_EXPLORER__ROOT_
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50b3cc
push str._C_START__CD__FLASHFXP1.EXE_START_EXPLORER__ROOT_
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50b3cc
push str._C_START__CD__PALOMA_.EXE_START_EXPLORER__ROOT_
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50b3cc
push str._C_START__CD__SHOWGIRLS.EXE_START_EXPLORER__ROOT_
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50b3cc
push str._C_START__CD__SYSDATE.EXE_START_EXPLORER__ROOT_
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50b3cc
push str._C_START__CD__SYSTEME.EXE_START_EXPLORER__ROOT_
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50b3cc
push str._C_START__CD__SYSTEMI.EXE_START_EXPLORER__ROOT_
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50b4d5
lea eax, [ebp - 0x214]
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b6504
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x218], eax
mov ecx, dword [ebp - 0x218]
mov dword [0x5b84b8], ecx
jmp 0x50b410
mov edx, dword [0x5b84b8]
sub edx, 1
mov dword [0x5b84b8], edx
cmp dword [0x5b84b8], 0
jle 0x50b42e
mov eax, dword [0x5b84b8]
movsx ecx, byte [eax + 0x5b6504]
cmp ecx, 0x25
jne 0x50b42c
jmp 0x50b42e
jmp 0x50b401
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
mov dword [ebp - 0x10c], 0
jmp 0x50b465
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov ecx, dword [ebp - 0x10c]
add ecx, 1
mov dword [ebp - 0x10c], ecx
mov edx, dword [0x5b84b8]
cmp edx, dword [ebp - 0x218]
jge 0x50b49f
mov eax, dword [0x5b84b8]
movsx ecx, byte [eax + 0x5b6504]
cmp ecx, 0x22
jne 0x50b486
jmp 0x50b49f
mov edx, dword [ebp - 0x10c]
mov eax, dword [0x5b84b8]
mov cl, byte [eax + 0x5b6504]
mov byte [edx + 0x5b6504], cl
jmp 0x50b449
mov edx, dword [ebp - 0x10c]
mov byte [edx + 0x5b6504], 0
push 0
push 0x5b6504
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push str.Trojan.Zapchast.B_lnk_
push 0x5b6404
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x50bd40
push 0x5b2fe4
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50b67a
push str..VBSSTART
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50b541
push str..VBESTART
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50b541
push str.EXPLORER
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50b56e
lea eax, [ebp - 0x214]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x218], eax
push str._C_START
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x50b847
push str..VBS_START
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50b6e2
push str.F_C__START__CD_CLICK.EXE_
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x50b879
mov esp, ebp
pop ebp
ret