Function at 0x416987
Capabilities:
Bypass windows file protection
Read file on windows
Terminate process

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43a478
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x8188
call fcn.004241f0
mov eax, dword [0x449020]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.kernel32
mov byte [ebp - 0x8189], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x416a2c
push str.SetDllDirectoryW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x416a04
push 0x4422dc
mov ecx, edi
call dword [0x43c270]
call edi
push str.SetDefaultDllDirectories
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x416a2c
push 0x800
mov ecx, esi
call dword [0x43c270]
call esi
mov byte [ebp - 0x8189], 1
cmp byte [str.xlistpos], 0x78
mov dword [ebp - 0x8038], str.version.dll
mov dword [ebp - 0x8034], str.DXGIDebug.dll
mov dword [ebp - 0x8030], str.sfc_os.dll
mov dword [ebp - 0x802c], str.SSPICLI.DLL
mov dword [ebp - 0x8028], str.rsaenh.dll
mov dword [ebp - 0x8024], str.UXTheme.dll
mov dword [ebp - 0x8020], str.dwmapi.dll
mov dword [ebp - 0x801c], str.cryptbase.dll
mov dword [ebp - 0x8110], str.lpk.dll
mov dword [ebp - 0x810c], str.usp10.dll
mov dword [ebp - 0x8108], str.clbcatq.dll
mov dword [ebp - 0x8104], str.comres.dll
mov dword [ebp - 0x8100], str.ws2_32.dll
mov dword [ebp - 0x80fc], str.ws2help.dll
mov dword [ebp - 0x80f8], str.psapi.dll
mov dword [ebp - 0x80f4], str.ieframe.dll
mov dword [ebp - 0x80f0], str.ntshrui.dll
mov dword [ebp - 0x80ec], str.atl.dll
mov dword [ebp - 0x80e8], str.setupapi.dll
mov dword [ebp - 0x80e4], str.apphelp.dll
mov dword [ebp - 0x80e0], str.userenv.dll
mov dword [ebp - 0x80dc], str.netapi32.dll
mov dword [ebp - 0x80d8], str.shdocvw.dll
mov dword [ebp - 0x80d4], str.crypt32.dll
mov dword [ebp - 0x80d0], str.msasn1.dll
mov dword [ebp - 0x80cc], str.cryptui.dll
mov dword [ebp - 0x80c8], str.wintrust.dll
mov dword [ebp - 0x80c4], str.shell32.dll
mov dword [ebp - 0x80c0], str.secur32.dll
mov dword [ebp - 0x80bc], str.cabinet.dll
mov dword [ebp - 0x80b8], str.oleaccrc.dll
mov dword [ebp - 0x80b4], str.ntmarta.dll
mov dword [ebp - 0x80b0], str.profapi.dll
mov dword [ebp - 0x80ac], str.WindowsCodecs.dll
mov dword [ebp - 0x80a8], str.srvcli.dll
mov dword [ebp - 0x80a4], str.cscapi.dll
mov dword [ebp - 0x80a0], str.slc.dll
mov dword [ebp - 0x809c], str.imageres.dll
mov dword [ebp - 0x8098], str.dnsapi.DLL
mov dword [ebp - 0x8094], str.iphlpapi.DLL
mov dword [ebp - 0x8090], str.WINNSI.DLL
mov dword [ebp - 0x808c], str.netutils.dll
mov dword [ebp - 0x8088], str.mpr.dll
mov dword [ebp - 0x8084], str.devrtl.dll
mov dword [ebp - 0x8080], str.propsys.dll
mov dword [ebp - 0x807c], str.mlang.dll
mov dword [ebp - 0x8078], str.samcli.dll
mov dword [ebp - 0x8074], str.samlib.dll
mov dword [ebp - 0x8070], str.wkscli.dll
mov dword [ebp - 0x806c], str.dfscli.dll
mov dword [ebp - 0x8068], str.browcli.dll
mov dword [ebp - 0x8064], str.rasadhlp.dll
mov dword [ebp - 0x8060], str.dhcpcsvc6.dll
mov dword [ebp - 0x805c], str.dhcpcsvc.dll
mov dword [ebp - 0x8058], str.XmlLite.dll
mov dword [ebp - 0x8054], str.linkinfo.dll
mov dword [ebp - 0x8050], str.cryptsp.dll
mov dword [ebp - 0x804c], str.RpcRtRemote.dll
mov dword [ebp - 0x8048], str.aclui.dll
mov dword [ebp - 0x8044], str.dsrole.dll
mov dword [ebp - 0x8040], str.peerdist.dll
je 0x416dbd
push str.xlistpos
call fcn.0042ce8a
mov edi, eax
pop ecx
test edi, edi
je 0x416dbd
lea ecx, [ebp - 0x8128]
call fcn.00411cbb
xor eax, eax
lea ecx, [ebp - 0x8128]
push eax
push eax
push 3
push eax
push 1
push SysReAllocString
mov dword [ebp - 4], eax
call fcn.0040126f
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x416da7
push 0
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, edi
jne 0x416da7
push 0
lea eax, [ebp - 0x8194]
push eax
push 0x7ffe
lea eax, [ebp - 0x8018]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x416da7
mov eax, dword [ebp - 0x8194]
and eax, 0xfffffffe
cmp eax, 0x8000
jae 0x4170b5
xor ecx, ecx
mov word [ebp + eax - 0x8018], cx
lea eax, [ebp - 0x8018]
push eax
lea ecx, [ebp - 0x8140]
call fcn.00401d16
lea ecx, [ebp - 0x8158]
call fcn.004021e6
mov byte [ebp - 4], 2
and dword [ebp - 0x8190], 0
jmp 0x416d75
call fcn.0040126f
mov ecx, eax
call fcn.004170bb
lea eax, [ebp - 0x8158]
push eax
lea edx, [ebp - 0x8190]
lea ecx, [ebp - 0x8140]
call fcn.0041629d
lea ecx, [ebp - 0x8158]
test al, al
jne 0x416d69
call fcn.00401e5c
lea ecx, [ebp - 0x8140]
call fcn.00401e5c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8128]
call fcn.00401e5c
lea ecx, [ebp - 0x8170]
call fcn.00411cbb
lea edx, [ebp - 0x8170]
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x8188]
call fcn.00410bbe
xor edi, edi
mov byte [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x8190], edi
mov dword [ebp - 0x8194], eax
lea esi, [eax]
call fcn.004103ac
cmp eax, 0x600
jb 0x416e37
mov ecx, dword [ebp + esi*4 - 0x8038]
call fcn.004170bb
test eax, eax
je 0x416e37
push 0xffffffffffffffff
push str.DXGIDebug.dll
push 0xffffffffffffffff
push dword [ebp + esi*4 - 0x8038]
push 0x1001
push 0x400
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x416e7e
mov esi, dword [ebp + esi*4 - 0x8038]
lea ecx, [ebp - 0x8128]
push esi
call fcn.00401d16
lea edx, [ebp - 0x8128]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x8170]
call fcn.00410e16
lea ecx, [ebp - 0x8128]
mov byte [ebp - 4], 4
call fcn.00401e5c
lea ecx, [ebp - 0x8170]
call fcn.0040f325
cmp eax, 0xffffffff
jne 0x416e96
mov eax, dword [ebp - 0x8194]
inc eax
mov dword [ebp - 0x8194], eax
cmp eax, 8
jb 0x416df4
jmp 0x416e9e
mov edi, esi
mov dword [ebp - 0x8190], esi
cmp byte [ebp - 0x8189], 0
jne 0x416f05
xor esi, esi
mov eax, dword [ebp + esi*4 - 0x8110]
lea ecx, [ebp - 0x8128]
push eax
call fcn.00401d16
lea edx, [ebp - 0x8128]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x8170]
call fcn.00410e16
lea ecx, [ebp - 0x8128]
mov byte [ebp - 4], 4
call fcn.00401e5c
lea ecx, [ebp - 0x8170]
call fcn.0040f325
cmp eax, 0xffffffff
jne 0x416ef8
inc esi
cmp esi, 0x35
jb 0x416ea9
jmp 0x416f05
mov edi, dword [ebp + esi*4 - 0x8110]
mov dword [ebp - 0x8190], edi
test edi, edi
je 0x417081
lea ecx, [ebp - 0x8170]
call fcn.0041100e
call fcn.004103ac
cmp eax, 0x600
jb 0x416fde
mov ecx, str.dwmapi.dll
call fcn.004170bb
mov ecx, str.uxtheme.dll
call fcn.004170bb
push 6
pop ecx
lea esi, [ebp - 0x8188]
lea edi, [ebp - 0x8128]
rep movsd dword es:[edi], dword [esi]
push 6
pop ecx
lea esi, [ebp - 0x8170]
lea edi, [ebp - 0x8158]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0xf1
call fcn.00414325
sub esp, 0x18
lea esi, [ebp - 0x8128]
push 6
pop ecx
mov edi, esp
sub esp, 0x18
rep movsd dword es:[edi], dword [esi]
push 6
pop ecx
mov edi, esp
lea esi, [ebp - 0x8158]
push dword [ebp - 0x8190]
rep movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x8140]
push eax
call fcn.00416532
add esp, 0x3c
mov ecx, 0xf0
mov byte [ebp - 4], 7
call fcn.00414325
push eax
lea ecx, [ebp - 0x8128]
call fcn.00401d16
push 0x30
lea eax, [ebp - 0x8128]
xor ecx, ecx
push eax
lea edx, [ebp - 0x8140]
call fcn.0041d3ee
lea ecx, [ebp - 0x8128]
call fcn.00401e5c
jmp 0x41706e
sub esp, 0x18
lea esi, [ebp - 0x8188]
lea eax, [ebp - 0x8140]
push 6
pop ecx
mov edi, esp
sub esp, 0x18
rep movsd dword es:[edi], dword [esi]
push 6
pop ecx
mov edi, esp
lea esi, [ebp - 0x8170]
push dword [ebp - 0x8190]
rep movsd dword es:[edi], dword [esi]
push str.Please_remove__s_from__s_folder._It_is_unsecure_to_run__s_until_it_is_done.
push eax
call fcn.00416532
add esp, 0x3c
call dword [sym.imp.KERNEL32.dll_AllocConsole]
test eax, eax
je 0x41706e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_AttachConsole]
lea ecx, [ebp - 0x8140]
call fcn.00401891
mov edi, eax
call fcn.0040126f
push 0xfffffffffffffff4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
lea ecx, [ebp - 0x8194]
push ecx
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
lea ecx, [ebp - 0x8140]
call fcn.00401e5c
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x8188]
call fcn.00401e5c
lea ecx, [ebp - 0x8170]
call fcn.00401e5c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00423145
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
call fcn.004233fd
int3