Function at 0x4263d0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Delete directory
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x594d57
mov eax, dword fs:[0]
push eax
sub esp, 0x34c
mov eax, dword [0x602c90]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x358]
mov esi, ecx
push eax
mov dword [ebp - 0x2ec], esi
call fcn.0043eb70
mov dword [ebp - 4], 0
cmp byte [esi + 0x20], 0
jne 0x4282f4
mov edi, esi
mov eax, dword [edi]
sub eax, 0x10
push eax
call fcn.00405370
add esp, 4
add eax, 0x10
mov dword [ebp - 0x328], eax
mov byte [ebp - 4], 1
mov esi, dword [edi + 8]
mov ecx, str.regkey
mov eax, esi
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x426476
test dx, dx
je 0x426472
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x426476
add eax, 4
add ecx, 4
test dx, dx
jne 0x426450
xor eax, eax
jmp 0x42647b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4264b9
mov ecx, str.REG_KEY
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4264ac
test dx, dx
je 0x4264a8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4264ac
add eax, 4
add ecx, 4
test dx, dx
jne 0x426486
xor eax, eax
jmp 0x4264b1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4265a0
push str.HKEY_LOCAL_MACHINE
push str.hklm
lea ecx, [edi + 0xc]
call fcn.00404af0
push str.HKEY_LOCAL_MACHINE
push str.HKLM
lea ecx, [edi + 0xc]
call fcn.00404af0
push str.HKEY_CURRENT_USER
push str.HKCU
lea ecx, [edi + 0xc]
call fcn.00404af0
push str.HKEY_CURRENT_USER
push str.hkcu
lea ecx, [edi + 0xc]
call fcn.00404af0
push 0x5c232c
lea ecx, [ebp - 0x2f4]
call fcn.00401d80
lea ecx, [ebp - 0x2f4]
push ecx
lea ecx, [edi + 0xc]
mov byte [ebp - 4], 2
call fcn.00449380
test al, al
je 0x42657a
mov eax, dword [edi + 8]
cmp dword [eax - 0xc], 0
jl 0x426551
push str.exists
push eax
call fcn.00560268
add esp, 8
test eax, eax
je 0x426551
sub eax, dword [edi + 8]
sar eax, 1
cmp eax, 0xffffffff
je 0x426551
mov byte [edi + 0x20], 1
mov eax, dword [edi + 0x14]
cmp dword [eax - 0xc], 0
jl 0x42657a
push str.exists
push eax
call fcn.00560268
add esp, 8
test eax, eax
je 0x42657a
sub eax, dword [edi + 0x14]
sar eax, 1
cmp eax, 0xffffffff
je 0x42657a
mov byte [edi + 0x20], 1
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x2f4]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4265a0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [edi + 8]
mov ecx, str.regvalue
mov eax, esi
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4265d6
test dx, dx
je 0x4265d2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4265d6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4265b0
xor eax, eax
jmp 0x4265db
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x426619
mov ecx, str.REG_VALUE
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42660c
test dx, dx
je 0x426608
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42660c
add eax, 4
add ecx, 4
test dx, dx
jne 0x4265e6
xor eax, eax
jmp 0x426611
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x426bf0
push 0x5c232c
lea ecx, [ebp - 0x2e0]
call fcn.00401d80
lea edx, [ebp - 0x2e0]
lea ecx, [edi + 0xc]
push edx
mov byte [ebp - 4], 3
call fcn.0044a210
test al, al
je 0x426b6e
push str.equals
lea ecx, [edi + 0x14]
call fcn.00420be0
test eax, eax
jne 0x426675
mov eax, dword [edi + 0x18]
push eax
lea ecx, [ebp - 0x2e0]
call fcn.00420be0
test eax, eax
jne 0x426b6e
mov byte [edi + 0x20], 1
jmp 0x426b74
push str.contains
lea ecx, [edi + 0x14]
call fcn.00420be0
test eax, eax
jne 0x426770
mov eax, dword [edi + 0x18]
test eax, eax
je 0x4266bc
mov ecx, dword [ebp - 0x2e0]
cmp dword [ecx - 0xc], 0
jl 0x4266bc
push eax
push ecx
call fcn.00560268
add esp, 8
test eax, eax
je 0x4266bc
sub eax, dword [ebp - 0x2e0]
sar eax, 1
cmp eax, 0xffffffff
je 0x4266bc
mov byte [edi + 0x20], 1
mov ecx, dword [edi + 0x18]
mov eax, dword [ecx - 0xc]
dec eax
js 0x427d4f
mov edx, ecx
cmp eax, dword [edx - 0xc]
jg 0x427d4f
cmp word [edx + eax*2], 0x2a
jne 0x426b74
lea eax, [ecx - 0x10]
push eax
call fcn.00405370
add eax, 0x10
add esp, 4
mov dword [ebp - 0x2dc], eax
mov byte [ebp - 4], 4
mov eax, dword [eax - 0xc]
dec eax
push eax
lea eax, [ebp - 0x2e4]
push eax
lea ecx, [ebp - 0x2dc]
call fcn.00429520
push eax
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 5
call fcn.00405100
lea ecx, [ebp - 0x2e4]
call fcn.004020d0
mov eax, dword [ebp - 0x2dc]
test eax, eax
je 0x42675c
mov ecx, dword [ebp - 0x2e0]
cmp dword [ecx - 0xc], 0
jl 0x42675c
push eax
push ecx
call fcn.00560268
add esp, 8
test eax, eax
je 0x42675c
sub eax, dword [ebp - 0x2e0]
sar eax, 1
jne 0x42675c
mov byte [edi + 0x20], 1
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 3
call fcn.004020d0
jmp 0x426b74
push str.greater
lea ecx, [edi + 0x14]
call fcn.00420be0
test eax, eax
jne 0x426b6e
mov eax, dword [ebp - 0x2e0]
add eax, 0xfffffff0
push eax
call fcn.00405370
lea ebx, [eax + 0x10]
add esp, 4
mov dword [ebp - 0x2dc], ebx
mov byte [ebp - 4], 6
mov eax, dword [edi + 0x18]
sub eax, 0x10
push eax
call fcn.00405370
lea edi, [eax + 0x10]
add esp, 4
mov dword [ebp - 0x2f0], edi
mov byte [ebp - 4], 7
mov esi, dword [ebx - 0xc]
dec esi
mov dword [ebp - 0x4c], 0x64636261
mov dword [ebp - 0x48], 0x68676665
mov dword [ebp - 0x44], 0x6c6b6a69
mov dword [ebp - 0x40], 0x706f6e6d
mov dword [ebp - 0x3c], 0x74737271
mov dword [ebp - 0x38], 0x78777675
mov dword [ebp - 0x34], 0x41417a79
mov dword [ebp - 0x30], 0x46454443
mov dword [ebp - 0x2c], 0x4a494847
mov dword [ebp - 0x28], 0x4e4d4c4b
mov dword [ebp - 0x24], 0x5251504f
mov dword [ebp - 0x20], 0x56555453
mov dword [ebp - 0x1c], 0x5a595857
mov dword [ebp - 0x18], 0x7b2d2928
mov dword [ebp - 0x14], 0x5c5d5b7d
js 0x426943
xor edi, edi
test esi, esi
js 0x427d4f
cmp esi, dword [ebx - 0xc]
jg 0x427d4f
movzx edx, word [ebx + esi*2]
movsx ecx, byte [ebp + edi - 0x4c]
cmp edx, ecx
jne 0x42692c
mov eax, dword [ebx - 0xc]
sub eax, esi
inc eax
push eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x2f4]
push ecx
lea ecx, [ebp - 0x2dc]
call fcn.00405020
mov ebx, eax
push esi
push 0
lea edx, [ebp - 0x2f8]
push edx
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 8
call fcn.00405020
push ebx
push eax
lea eax, [ebp - 0x2e4]
push eax
mov byte [ebp - 4], 9
call fcn.00420d00
add esp, 0xc
push eax
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 0xa
call fcn.00405100
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x2e4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4268da
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x2f8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426900
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x2f4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426926
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [ebp - 0x2dc]
inc edi
cmp edi, 0x3c
jb 0x426835
dec esi
jns 0x426833
mov edi, dword [ebp - 0x2f0]
mov eax, dword [ebx - 0xc]
xor esi, esi
mov dword [ebp - 0x2f4], esi
cmp eax, esi
jle 0x426a68
test esi, esi
js 0x427d4f
cmp esi, eax
jg 0x427d4f
cmp word [ebx + esi*2], 0x2e
jne 0x426a5c
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp eax, 1
jle 0x426a5c
mov eax, dword [ebx - 0xc]
sub eax, esi
inc eax
push eax
lea ecx, [esi + 1]
push ecx
lea edx, [ebp - 0x2e8]
push edx
lea ecx, [ebp - 0x2dc]
call fcn.00405020
mov ebx, eax
push esi
push 0
lea eax, [ebp - 0x2f8]
push eax
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 0xb
call fcn.00405020
push ebx
push eax
lea ecx, [ebp - 0x2e4]
push ecx
mov byte [ebp - 4], 0xc
call fcn.00420d00
add esp, 0xc
push eax
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 0xd
call fcn.00405100
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x2e4]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x426a0a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x2f8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426a30
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x2e8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426a56
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [ebp - 0x2dc]
mov eax, dword [ebx - 0xc]
inc esi
cmp esi, eax
jl 0x426956
mov eax, dword [edi - 0xc]
push eax
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
test esi, esi
jne 0x426a7e
call fcn.004022b0
mov edi, 0xf423f
xor ecx, ecx
cmp word [esi + ecx*2], 0
je 0x426a98
mov dl, byte [esi + ecx*2]
mov byte [ebp + ecx - 0xd0], dl
jmp 0x426aa2
xor edi, edi
mov byte [ebp + ecx - 0xd0], 0
inc ecx
cmp ecx, edi
jb 0x426a85
lea eax, [ebp - 0xd0]
push eax
call fcn.00560def
fstp qword [ebp - 0x310]
mov eax, dword [ebx - 0xc]
add esp, 4
push eax
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
test esi, esi
jne 0x426ad2
call fcn.004022b0
mov edi, 0xf423f
xor ecx, ecx
lea esp, [esp]
cmp word [esi + ecx*2], 0
je 0x426af3
mov dl, byte [esi + ecx*2]
mov byte [ebp + ecx - 0x90], dl
jmp 0x426afd
xor edi, edi
mov byte [ebp + ecx - 0x90], 0
inc ecx
cmp ecx, edi
jb 0x426ae0
lea eax, [ebp - 0x90]
push eax
call fcn.00560def
fcomp qword [ebp - 0x310]
add esp, 4
fnstsw ax
test ah, 0x41
jne 0x426b28
mov ecx, dword [ebp - 0x2ec]
mov byte [ecx + 0x20], 1
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x2f0]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x426b4e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add ebx, 0xfffffff0
mov byte [ebp - 4], 3
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426b6e
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
mov edi, dword [ebp - 0x2ec]
mov eax, dword [edi + 0x14]
mov ecx, str.search
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x426ba6
test dx, dx
je 0x426ba2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x426ba6
add eax, 4
add ecx, 4
test dx, dx
jne 0x426b80
xor eax, eax
jmp 0x426bab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x426bca
lea eax, [edi + 0x18]
push eax
lea ecx, [ebp - 0x321]
push ecx
lea ecx, [edi + 0xc]
call fcn.0044a540
test al, al
je 0x426bca
mov byte [edi + 0x20], 1
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x2e0]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x426bf0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [edi + 8]
mov ecx, str.file
mov eax, esi
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x426c26
test dx, dx
je 0x426c22
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x426c26
add eax, 4
add ecx, 4
test dx, dx
jne 0x426c00
xor eax, eax
jmp 0x426c2b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x426c6f
mov ecx, str.FILE
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x426c5c
test dx, dx
je 0x426c58
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x426c5c
add eax, 4
add ecx, 4
test dx, dx
jne 0x426c36
xor eax, eax
jmp 0x426c61
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x42731b
mov edi, dword [ebp - 0x2ec]
mov eax, dword [edi + 0xc]
mov ecx, dword [eax - 0xc]
lea esi, [edi + 0xc]
test ecx, ecx
jns 0x426c84
or edi, 0xffffffff
jmp 0x426e56
push str.ff
push eax
call fcn.00560268
add esp, 8
test eax, eax
jne 0x426c9e
or edi, 0xffffffff
jmp 0x426e56
sub eax, dword [esi]
sar eax, 1
mov edi, eax
cmp edi, 0xffffffff
je 0x426e56
push str._appdata_
lea ecx, [ebp - 0x2f4]
call fcn.00401d80
push 0x104
lea ecx, [ebp - 0x2d8]
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x2f4]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
push str.extensions.sqlite
lea ecx, [ebp - 0x2f0]
call fcn.00401d80
xor eax, eax
mov dword [ebp - 0x314], eax
mov dword [ebp - 0x310], eax
mov dword [ebp - 0x30c], eax
lea eax, [ebp - 0x2d8]
push eax
lea ecx, [ebp - 0x2e8]
mov byte [ebp - 4], 0x10
call fcn.00401d80
lea ecx, [ebp - 0x314]
push ecx
lea edx, [ebp - 0x2f0]
push edx
push eax
lea ecx, [ebp - 0x319]
mov byte [ebp - 4], 0x11
call fcn.00430fe0
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x2e8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426d58
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x310]
sub ecx, dword [ebp - 0x314]
sar ecx, 2
test ecx, ecx
je 0x426dfb
mov edx, dword [esi]
mov eax, dword [edx - 0xc]
sub eax, edi
sub eax, 4
push eax
lea eax, [ebp - 0x2e4]
push eax
mov ecx, esi
call fcn.00420c60
mov bl, 0x12
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x314]
push eax
push ecx
lea edx, [ebp - 0x2e8]
push edx
call fcn.00420d00
add esp, 0xc
push eax
mov ecx, esi
mov byte [ebp - 4], 0x13
call fcn.00405100
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x2e8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426dd5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x2e4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426dfb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ebx, [ebp - 0x314]
mov byte [ebp - 4], 0xf
call fcn.00421170
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x2f0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426e30
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x2f4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426e56
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi]
sub eax, 0x10
push eax
call fcn.00405370
add eax, 0x10
add esp, 4
mov dword [ebp - 0x2dc], eax
mov byte [ebp - 4], 0x14
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jl 0x42706b
push 0x5c20fc
push eax
call fcn.00560268
add esp, 8
test eax, eax
je 0x42706b
sub eax, dword [esi]
sar eax, 1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42706b
cmp edi, 0xffffffff
jne 0x42706b
push ebx
lea ecx, [ebp - 0x2e8]
push ecx
mov ecx, esi
call fcn.00429520
push eax
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 0x15
call fcn.00405100
mov byte [ebp - 4], 0x14
mov eax, dword [ebp - 0x2e8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, edi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x426eef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esi]
mov eax, dword [ecx - 0xc]
sub eax, ebx
sub eax, 2
push eax
lea edx, [ebp - 0x2e8]
push edx
mov ecx, esi
call fcn.00420c60
push eax
mov ecx, esi
mov byte [ebp - 4], 0x16
call fcn.00405100
mov byte [ebp - 4], 0x14
mov eax, dword [ebp - 0x2e8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426f3a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [ebp - 0x2dc]
push 0x104
lea ecx, [ebp - 0x2d8]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
push 0x5c64e8
lea ecx, [ebp - 0x2f0]
call fcn.00401d80
mov ebx, eax
lea eax, [ebp - 0x2d8]
push eax
lea ecx, [ebp - 0x2f8]
mov byte [ebp - 4], 0x17
call fcn.00401d80
push ebx
push eax
lea ecx, [ebp - 0x2e4]
push ecx
mov byte [ebp - 4], 0x18
call fcn.00420d00
add esp, 0xc
push esi
push eax
lea edx, [ebp - 0x2e8]
mov bl, 0x19
push edx
mov byte [ebp - 4], bl
call fcn.00420d00
add esp, 0xc
push eax
mov ecx, esi
mov byte [ebp - 4], 0x1a
call fcn.00405100
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x2e8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426fd7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x18
mov eax, dword [ebp - 0x2e4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426ffd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x17
mov eax, dword [ebp - 0x2f8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427023
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x14
mov eax, dword [ebp - 0x2f0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427049
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x5c20fc
push 0x5c64e8
mov ecx, esi
call fcn.00404af0
push 0x5c64e8
push 0x5c20fc
mov ecx, esi
call fcn.00404af0
mov ecx, dword [ebp - 0x2ec]
mov eax, dword [ecx + 0x14]
mov ecx, str.exists
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4270a6
test dx, dx
je 0x4270a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4270a6
add eax, 4
add ecx, 4
test dx, dx
jne 0x427080
xor eax, eax
jmp 0x4270ab
sbb eax, eax
sbb eax, 0xffffffff
mov edi, dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetFileAttributesExW]
test eax, eax
jne 0x4270f8
mov eax, dword [esi]
push eax
call edi
cmp eax, 0xffffffff
je 0x4270e4
mov eax, dword [esi]
lea edx, [ebp - 0x34]
push edx
push 0
push eax
call ebx
test eax, eax
je 0x4270da
cmp dword [ebp - 0x14], 0
je 0x4270e4
mov eax, dword [ebp - 0x2ec]
mov byte [eax + 0x20], 1
mov eax, dword [esi]
push eax
call edi
cmp eax, 0xffffffff
je 0x4270f8
mov ecx, dword [ebp - 0x2ec]
mov byte [ecx + 0x20], 1
mov edx, dword [ebp - 0x2ec]
mov eax, dword [edx + 0x14]
mov ecx, str.contains
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42712c
test dx, dx
je 0x427128
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42712c
add eax, 4
add ecx, 4
test dx, dx
jne 0x427106
xor eax, eax
jmp 0x427131
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4272f5
mov eax, dword [esi]
push eax
call edi
cmp eax, 0xffffffff
je 0x4272f5
mov eax, dword [esi]
lea ecx, [ebp - 0x34]
push ecx
push 0
push eax
call ebx
test eax, eax
je 0x427160
cmp dword [ebp - 0x14], 0
je 0x4272f5
lea ecx, [ebp - 0x340]
call fcn.004870cd
lea ecx, [ebp - 0x318]
mov byte [ebp - 4], 0x1b
call fcn.00473404
mov edi, vtable.CFileException.0
mov dword [ebp - 0x318], edi
call fcn.0047977b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x42719f
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x308], eax
lea ecx, [ebp - 0x308]
mov dword [ebp - 0x310], 0
mov dword [ebp - 0x30c], 0xffffffff
call fcn.00401ef0
mov bl, 0x1d
mov byte [ebp - 4], bl
call fcn.0047977b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4271ef
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x2e0], eax
lea ecx, [ebp - 0x318]
push ecx
mov byte [ebp - 4], 0x1e
mov esi, dword [esi]
push 0x2000
push esi
lea ecx, [ebp - 0x340]
call fcn.00486fab
test eax, eax
je 0x427295
lea edx, [ebp - 0x2e0]
push edx
lea ecx, [ebp - 0x340]
call fcn.004874cd
test eax, eax
je 0x42728a
mov esi, dword [ebp - 0x2ec]
nop
mov eax, dword [esi + 0x18]
test eax, eax
je 0x42726e
mov ecx, dword [ebp - 0x2e0]
cmp dword [ecx - 0xc], 0
jl 0x42726e
push eax
push ecx
call fcn.00560268
add esp, 8
test eax, eax
je 0x42726e
sub eax, dword [ebp - 0x2e0]
sar eax, 1
cmp eax, 0xffffffff
jne 0x427286
lea eax, [ebp - 0x2e0]
push eax
lea ecx, [ebp - 0x340]
call fcn.004874cd
test eax, eax
jne 0x427240
jmp 0x42728a
mov byte [esi + 0x20], 1
lea ecx, [ebp - 0x340]
call fcn.0048736e
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x2e0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4272ba
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x1b
mov eax, dword [ebp - 0x308]
add eax, 0xfffffff0
mov dword [ebp - 0x318], edi
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4272e6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x340]
mov byte [ebp - 4], 0x14
call fcn.004873ac
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x2dc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42731b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebp - 0x2ec]
mov esi, dword [edi + 8]
mov ecx, str.user
mov eax, esi
jmp 0x427330
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x427356
test dx, dx
je 0x427352
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x427356
add eax, 4
add ecx, 4
test dx, dx
jne 0x427330
xor eax, eax
jmp 0x42735b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x427399
mov ecx, str.USER
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42738c
test dx, dx
je 0x427388
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42738c
add eax, 4
add ecx, 4
test dx, dx
jne 0x427366
xor eax, eax
jmp 0x427391
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4274ba
mov eax, dword [edi + 0x14]
mov ecx, str.equals
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4273c7
test dx, dx
je 0x4273c3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4273c7
add eax, 4
add ecx, 4
test dx, dx
jne 0x4273a1
xor eax, eax
jmp 0x4273cc
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x42742a
mov eax, dword [edi + 0x18]
lea ecx, [edi + 0x18]
mov edx, str.admin
jmp 0x4273e0
mov si, word [eax]
cmp si, word [edx]
jne 0x427406
test si, si
je 0x427402
mov si, word [eax + 2]
cmp si, word [edx + 2]
jne 0x427406
add eax, 4
add edx, 4
test si, si
jne 0x4273e0
xor eax, eax
jmp 0x42740b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x42741d
push str.ADMIN
call fcn.00420be0
test eax, eax
jne 0x42742a
call fcn.0044b690
test eax, eax
je 0x42742a
mov byte [edi + 0x20], 1
mov eax, dword [edi + 0x14]
mov ecx, str.notequals
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x427458
test dx, dx
je 0x427454
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x427458
add eax, 4
add ecx, 4
test dx, dx
jne 0x427432
xor eax, eax
jmp 0x42745d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4274ba
mov eax, dword [edi + 0x18]
lea ecx, [edi + 0x18]
mov edx, str.admin
lea esp, [esp]
mov si, word [eax]
cmp si, word [edx]
jne 0x427496
test si, si
je 0x427492
mov si, word [eax + 2]
cmp si, word [edx + 2]
jne 0x427496
add eax, 4
add edx, 4
test si, si
jne 0x427470
xor eax, eax
jmp 0x42749b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4274ad
push str.ADMIN
call fcn.00420be0
test eax, eax
jne 0x4274ba
call fcn.0044b690
test eax, eax
jne 0x4274ba
mov byte [edi + 0x20], 1
mov esi, dword [edi + 8]
mov ecx, 0x5c67a0
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4274ea
test dx, dx
je 0x4274e6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4274ea
add eax, 4
add ecx, 4
test dx, dx
jne 0x4274c4
xor eax, eax
jmp 0x4274ef
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x427533
mov ecx, 0x5c67a8
mov eax, esi
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x427526
test dx, dx
je 0x427522
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x427526
add eax, 4
add ecx, 4
test dx, dx
jne 0x427500
xor eax, eax
jmp 0x42752b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x427927
lea ecx, [ebp - 0x33c]
push ecx
call fcn.0042a160
mov byte [ebp - 4], 0x1f
mov edx, dword [edi + 0xc]
cmp dword [edx - 0xc], 0
jle 0x4278df
push 0x5c232c
lea ecx, [ebp - 0x2dc]
call fcn.00401d80
push 0x5c232c
lea ecx, [ebp - 0x2e4]
mov byte [ebp - 4], 0x20
call fcn.00401d80
lea eax, [ebp - 0x2e4]
push eax
lea ecx, [ebp - 0x2dc]
push ecx
lea edx, [edi + 0xc]
lea ecx, [ebp - 0x33c]
mov byte [ebp - 4], 0x21
call fcn.0042b480
test al, al
je 0x427893
mov eax, dword [edi + 0x1c]
sub eax, 0x10
push eax
call fcn.00405370
add eax, 0x10
add esp, 4
mov dword [ebp - 0x2e0], eax
push 0x5c20fc
lea edx, [ebp - 0x2dc]
push edx
lea eax, [ebp - 0x2f0]
push eax
mov byte [ebp - 4], 0x22
call fcn.00420dc0
add esp, 0xc
lea ecx, [ebp - 0x2e0]
push ecx
push eax
lea edx, [ebp - 0x2e8]
mov bl, 0x23
push edx
mov byte [ebp - 4], bl
call fcn.00420d00
add esp, 0xc
push eax
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 0x24
call fcn.00405100
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x2e8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427624
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x22
mov eax, dword [ebp - 0x2f0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42764a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x5c20fc
push 0x5c64e8
lea ecx, [ebp - 0x2e0]
call fcn.00404af0
push 0x5c232c
lea ecx, [ebp - 0x2f8]
mov dword [ebp - 0x2f0], 0xffffffff
call fcn.00401d80
lea ecx, [ebp - 0x2f0]
push ecx
lea edx, [ebp - 0x2f8]
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 0x25
call fcn.00447ef0
test al, al
je 0x42783a
mov eax, dword [ebp - 0x2f0]
push 0xa
lea edx, [ebp - 0x30]
push edx
push eax
call fcn.00560616
add esp, 0xc
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x2f4]
call fcn.00420a50
push str.exists
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0x26
call fcn.00420be0
test eax, eax
je 0x4276fc
push str.equals
lea ecx, [edi + 0x14]
call fcn.00420be0
test eax, eax
je 0x4276fc
mov eax, dword [edi + 0x18]
push eax
lea ecx, [ebp - 0x2f4]
call fcn.00420be0
test eax, eax
je 0x427713
jmp 0x42770f
mov eax, dword [edi + 0x18]
push eax
lea ecx, [ebp - 0x2f4]
call fcn.00420be0
test eax, eax
jne 0x427713
mov byte [edi + 0x20], 1
lea edx, [ebp - 0x30]
push edx
lea ecx, [ebp - 0x308]
call fcn.00420a50
mov esi, eax
lea eax, [ebp - 0x2e0]
push eax
lea ecx, [ebp - 0x2fc]
push str._Detection_Rule_Exe:
mov bl, 0x27
push ecx
mov byte [ebp - 4], bl
call fcn.00420ea0
add esp, 0xc
push str._r:
push eax
lea edx, [ebp - 0x2f0]
push edx
mov byte [ebp - 4], 0x28
call fcn.00420dc0
add esp, 0xc
push esi
push eax
lea eax, [ebp - 0x2e8]
push eax
mov byte [ebp - 4], 0x29
call fcn.00420d00
add esp, 0xc
mov esi, eax
mov byte [ebp - 4], 0x2a
call fcn.0043f300
mov byte [ebp - 4], 0x29
mov eax, dword [ebp - 0x2e8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4277a3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x28
mov eax, dword [ebp - 0x2f0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4277c9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x2fc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4277ee
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x26
mov eax, dword [ebp - 0x308]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427814
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x25
mov eax, dword [ebp - 0x2f4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42783a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x2dc]
push ecx
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
mov byte [ebp - 4], 0x22
mov eax, dword [ebp - 0x2f8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42786d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x21
mov eax, dword [ebp - 0x2e0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427893
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x20
mov eax, dword [ebp - 0x2e4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4278b9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x1f
mov eax, dword [ebp - 0x2dc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4278df
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x338]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427905
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x33c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427927
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [edi + 8]
mov ecx, str.browser
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x427957
test dx, dx
je 0x427953
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x427957
add eax, 4
add ecx, 4
test dx, dx
jne 0x427931
xor eax, eax
jmp 0x42795c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x427996
mov ecx, str.BROWSER
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42798d
test dx, dx
je 0x427989
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42798d
add eax, 4
add ecx, 4
test dx, dx
jne 0x427967
xor eax, eax
jmp 0x427992
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x427a12
push 0x5c232c
lea ecx, [ebp - 0x2e0]
call fcn.00401d80
lea ecx, [ebp - 0x2e0]
push ecx
mov byte [ebp - 4], 0x2b
call fcn.00423250
mov eax, dword [edi + 0xc]
test eax, eax
je 0x4279ec
mov ecx, dword [ebp - 0x2e0]
cmp dword [ecx - 0xc], 0
jl 0x4279f2
push eax
push ecx
call fcn.00560268
add esp, 8
test eax, eax
je 0x4279ec
mov ecx, dword [ebp - 0x2e0]
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
je 0x4279f2
mov byte [edi + 0x20], 1
jmp 0x4279f2
mov ecx, dword [ebp - 0x2e0]
lea eax, [ecx - 0x10]
mov byte [ebp - 4], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x427a12
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [edi + 8]
mov ecx, 0x5c6808
mov eax, esi
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x427a46
test dx, dx
je 0x427a42
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x427a46
add eax, 4
add ecx, 4
test dx, dx
jne 0x427a20
xor eax, eax
jmp 0x427a4b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x427a85
mov ecx, 0x5c6810
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x427a7c
test dx, dx
je 0x427a78
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x427a7c
add eax, 4
add ecx, 4
test dx, dx
jne 0x427a56
xor eax, eax
jmp 0x427a81
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x427b00
push 0x5c232c
lea ecx, [ebp - 0x2e0]
call fcn.00401d80
lea esi, [ebp - 0x2e0]
mov byte [ebp - 4], 0x2c
call fcn.0044b440
mov eax, dword [edi + 0xc]
test eax, eax
je 0x427ada
mov ecx, dword [ebp - 0x2e0]
cmp dword [ecx - 0xc], 0
jl 0x427ae0
push eax
push ecx
call fcn.00560268
add esp, 8
test eax, eax
je 0x427ada
mov ecx, dword [ebp - 0x2e0]
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
je 0x427ae0
mov byte [edi + 0x20], 1
jmp 0x427ae0
mov ecx, dword [ebp - 0x2e0]
lea eax, [ecx - 0x10]
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427b00
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [edi + 8]
mov ecx, str.bits
mov eax, esi
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x427b36
test dx, dx
je 0x427b32
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x427b36
add eax, 4
add ecx, 4
test dx, dx
jne 0x427b10
xor eax, eax
jmp 0x427b3b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x427b79
mov ecx, str.BITS
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x427b6c
test dx, dx
je 0x427b68
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x427b6c
add eax, 4
add ecx, 4
test dx, dx
jne 0x427b46
xor eax, eax
jmp 0x427b71
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x427c83
mov ebx, dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push str.IsWow64Process
push str.kernel32
mov dword [ebp - 0x2e4], 0
call ebx
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
call edi
mov esi, eax
test esi, esi
je 0x427bb4
lea ecx, [ebp - 0x2e4]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call esi
cmp dword [ebp - 0x2e4], 0
je 0x427c03
mov esi, dword [ebp - 0x2ec]
mov eax, dword [esi + 0xc]
mov ecx, 0x5c6830
jmp 0x427bd0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x427bf6
test dx, dx
je 0x427bf2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x427bf6
add eax, 4
add ecx, 4
test dx, dx
jne 0x427bd0
xor eax, eax
jmp 0x427bfb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x427c03
mov byte [esi + 0x20], 1
push str.IsWow64Process
push str.kernel32
mov dword [ebp - 0x2e4], 0
call ebx
push eax
call edi
mov esi, eax
test esi, esi
je 0x427c32
lea edx, [ebp - 0x2e4]
push edx
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call esi
cmp dword [ebp - 0x2e4], 0
jne 0x427c83
mov esi, dword [ebp - 0x2ec]
mov eax, dword [esi + 0xc]
mov ecx, 0x5c6838
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x427c76
test dx, dx
je 0x427c72
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x427c76
add eax, 4
add ecx, 4
test dx, dx
jne 0x427c50
xor eax, eax
jmp 0x427c7b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x427c83
mov byte [esi + 0x20], 1
mov eax, dword [ebp - 0x2ec]
mov esi, dword [eax + 8]
mov ecx, str.host_browser
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x427cb9
test dx, dx
je 0x427cb5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x427cb9
add eax, 4
add ecx, 4
test dx, dx
jne 0x427c93
xor eax, eax
jmp 0x427cbe
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x427d03
mov ecx, str.HOST_BROWSER
mov eax, esi
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x427cf6
test dx, dx
je 0x427cf2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x427cf6
add eax, 4
add ecx, 4
test dx, dx
jne 0x427cd0
xor eax, eax
jmp 0x427cfb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x428091
push 0x5c232c
lea ecx, [ebp - 0x2dc]
call fcn.00401d80
push 0x75
mov byte [ebp - 4], 0x2d
call fcn.00473506
test eax, eax
je 0x427d30
push 0x75
push eax
lea ecx, [ebp - 0x2dc]
call fcn.00401f60
lea ebx, [ebp - 0x2dc]
call fcn.004295a0
mov ebx, eax
call fcn.00429620
mov edx, dword [ebp - 0x2dc]
mov esi, dword [edx - 0xc]
test esi, esi
jns 0x427d59
push 0x80070057
call fcn.00401090
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, esi
or eax, ecx
jge 0x427d7c
push esi
lea ecx, [ebp - 0x2dc]
call fcn.00402250
mov edx, dword [ebp - 0x2dc]
lea ecx, [esi + 1]
push ecx
push edx
call fcn.00560d2d
mov eax, dword [ebp - 0x2dc]
add esp, 8
cmp esi, dword [eax - 8]
jg 0x427d4f
mov edi, dword [ebp - 0x2ec]
mov dword [eax - 0xc], esi
mov eax, dword [ebp - 0x2dc]
xor edx, edx
add edi, 0x18
mov word [eax + esi*2], dx
mov eax, dword [edi]
mov esi, dword [eax - 0xc]
test esi, esi
jns 0x427dbf
push 0x80070057
call fcn.00401090
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, esi
or eax, ecx
jge 0x427dd8
push esi
mov ecx, edi
call fcn.00402250
mov eax, dword [edi]
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00560d2d
mov eax, dword [edi]
add esp, 8
cmp esi, dword [eax - 8]
jg 0x427d4f
mov ebx, dword [ebp - 0x2ec]
mov dword [eax - 0xc], esi
mov edx, dword [edi]
xor eax, eax
mov word [edx + esi*2], ax
mov eax, dword [ebx + 0xc]
mov esi, dword [eax - 0xc]
test esi, esi
jns 0x427e17
push 0x80070057
call fcn.00401090
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, esi
or eax, ecx
jge 0x427e31
push esi
lea ecx, [ebx + 0xc]
call fcn.00402250
mov eax, dword [ebx + 0xc]
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00560d2d
mov eax, dword [ebx + 0xc]
add esp, 8
cmp esi, dword [eax - 8]
jg 0x427d4f
mov dword [eax - 0xc], esi
mov edx, dword [ebx + 0xc]
xor eax, eax
mov word [edx + esi*2], ax
mov eax, dword [ebx + 0xc]
sub eax, 0x10
push eax
call fcn.00405370
add eax, 0x10
add esp, 4
mov dword [ebp - 0x2e4], eax
lea ecx, [ebp - 0x2dc]
push ecx
lea edx, [ebp - 0x2f0]
push str._Detection_Rule_host_browser:
push edx
mov byte [ebp - 4], 0x2e
call fcn.00420ea0
add esp, 0xc
push str._rule.location:
push eax
lea eax, [ebp - 0x2f8]
push eax
mov byte [ebp - 4], 0x2f
call fcn.00420dc0
add esp, 0xc
lea ecx, [ebp - 0x2e4]
push ecx
push eax
lea edx, [ebp - 0x2e8]
push edx
mov byte [ebp - 4], 0x30
call fcn.00420d00
add esp, 0xc
push str._rule.value:
push eax
lea eax, [ebp - 0x2fc]
push eax
mov byte [ebp - 4], 0x31
call fcn.00420dc0
add esp, 0xc
push edi
push eax
lea ecx, [ebp - 0x308]
push ecx
mov byte [ebp - 4], 0x32
call fcn.00420d00
add esp, 0xc
mov esi, eax
mov byte [ebp - 4], 0x33
call fcn.0043f300
mov byte [ebp - 4], 0x32
mov eax, dword [ebp - 0x308]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x427f23
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x31
mov eax, dword [ebp - 0x2fc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427f49
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x30
mov eax, dword [ebp - 0x2e8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427f6f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x2f
mov eax, dword [ebp - 0x2f8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427f95
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x2e
mov eax, dword [ebp - 0x2f0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427fbb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x2d
mov eax, dword [ebp - 0x2e4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427fe1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x2dc]
test esi, esi
je 0x428010
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jl 0x428010
push esi
push eax
call fcn.00560268
add esp, 8
test eax, eax
je 0x42800a
sub eax, dword [edi]
sar eax, 1
cmp eax, 0xffffffff
jne 0x428061
mov esi, dword [ebp - 0x2dc]
xor eax, eax
test esi, esi
setne al
test eax, eax
jne 0x428025
push 0x80004005
call fcn.00401090
mov eax, dword [ebx + 0xc]
mov ecx, esi
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x428056
test dx, dx
je 0x428052
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x428056
add eax, 4
add ecx, 4
test dx, dx
jne 0x428030
xor eax, eax
jmp 0x42805b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x428071
jmp 0x428067
mov esi, dword [ebp - 0x2dc]
mov ecx, dword [ebp - 0x2ec]
mov byte [ecx + 0x20], 1
lea eax, [esi - 0x10]
mov byte [ebp - 4], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x428091
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.false
lea ecx, [ebp - 0x320]
call fcn.00401d80
mov ecx, dword [ebp - 0x2ec]
mov byte [ebp - 4], 0x34
cmp byte [ecx + 0x20], 1
jne 0x4280f7
push str.__________true
lea ecx, [ebp - 0x308]
call fcn.00401d80
push eax
lea ecx, [ebp - 0x320]
mov byte [ebp - 4], 0x35
call fcn.00405100
mov byte [ebp - 4], 0x34
mov eax, dword [ebp - 0x308]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4280f7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x5c232c
lea ecx, [ebp - 0x2f4]
call fcn.00401d80
mov esi, eax
push str._result:
lea ecx, [ebp - 0x2f0]
mov byte [ebp - 4], 0x36
call fcn.00401d80
mov ebx, eax
push str.____Detection_rule:
lea ecx, [ebp - 0x2f8]
mov byte [ebp - 4], 0x37
call fcn.00401d80
mov ecx, dword [ebp - 0x2ec]
push ecx
push eax
lea edx, [ebp - 0x2e4]
push edx
mov byte [ebp - 4], 0x38
call fcn.00420d00
add esp, 0xc
push ebx
push eax
lea eax, [ebp - 0x2e8]
push eax
mov byte [ebp - 4], 0x39
call fcn.00420d00
add esp, 0xc
lea ecx, [ebp - 0x320]
push ecx
push eax
lea edx, [ebp - 0x2fc]
push edx
mov byte [ebp - 4], 0x3a
call fcn.00420d00
add esp, 0xc
push esi
push eax
lea eax, [ebp - 0x308]
mov bl, 0x3b
push eax
mov byte [ebp - 4], bl
call fcn.00420d00
add esp, 0xc
mov esi, eax
mov byte [ebp - 4], 0x3c
call fcn.0043f300
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x308]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4281c4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x3a
mov eax, dword [ebp - 0x2fc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4281ea
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x39
mov eax, dword [ebp - 0x2e8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x428210
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x38
mov eax, dword [ebp - 0x2e4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x428236
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x37
mov eax, dword [ebp - 0x2f8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42825c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x36
mov eax, dword [ebp - 0x2f0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x428282
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x34
mov eax, dword [ebp - 0x2f4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4282a8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x320]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4282ce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x328]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4282f4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ebx, [ebp - 0x350]
mov dword [ebp - 4], 0x3e
call fcn.00421170
mov byte [ebp - 4], 0x3d
mov eax, dword [ebp - 0x354]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42832c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x358]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x428355
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055f89e
mov esp, ebp
pop ebp
ret