Function at 0x40d0d0
Capabilities:
Contain obfuscated stackstrings
Get session user name
Get user security identifier

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47c78e
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x3958
call fcn.00456990
mov eax, dword [0x49f0c4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xb8
lea eax, [ebp - 0x3870]
push 0
push eax
call fcn.00457f20
add esp, 8
lea ecx, [ebp - 0x3870]
call fcn.00413030
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x36d8]
push 0
mov dword [ebp - 0x36d8], 0
push 0x494ccb
mov dword [ebp - 0x36c8], 0
mov dword [ebp - 0x36c4], 0xf
mov byte [ebp - 0x36d8], 0
call fcn.004143f0
mov byte [ebp - 4], 1
mov ax, word [0x494d30]
push 0x7fe
mov word [ebp - 0x1620], ax
lea eax, [ebp - 0x161e]
push 0
push eax
call fcn.00457f20
add esp, 0xc
mov dword [ebp - 0x36a4], 0x101
mov dword [ebp - 0x36a8], 0x400
mov dword [ebp - 0x36a0], 0x400
push 0x800
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0
mov dword [ebp - 0x3878], eax
call fcn.0045d557
add esp, 4
mov dword [ebp - 0x34f8], eax
lea eax, [ebp - 0x34f8]
mov dword [ebp - 0x34f4], edx
push eax
lea eax, [ebp - 0x35c4]
push eax
call fcn.0045ae6d
lea eax, [ebp - 0x35c4]
push eax
push str._F__X
lea eax, [ebp - 0x38]
push 0x64
push eax
call fcn.0045b5aa
lea ecx, [ebp - 0x38]
add esp, 0x18
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d215
sub ecx, edx
lea eax, [ebp - 0x38]
push ecx
push eax
mov ecx, 0x49faec
call fcn.004143f0
mov ecx, dword [0x49fafc]
mov edi, accept
mov eax, edi
sub eax, ecx
cmp eax, 8
jb 0x411a52
cmp dword [0x49fb00], 0x10
mov eax, 0x49faec
push ecx
cmovae eax, dword [0x49faec]
push eax
push 8
push 0x494e24
push ecx
push dword [ebp - 0x37b8]
lea ecx, [ebp - 0x35a0]
call fcn.00415bf0
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x358c]
mov eax, edx
mov ecx, dword [ebp - 0x3590]
sub eax, ecx
mov dword [ebp - 0x3874], ecx
push 0x27
push str.__Info__Scanner_V1.5.0.16____record.log
cmp eax, 0x27
jb 0x40d2d1
cmp edx, 0x10
lea esi, [ebp - 0x35a0]
lea eax, [ecx + 0x27]
cmovae esi, dword [ebp - 0x35a0]
mov dword [ebp - 0x3590], eax
lea eax, [ecx + esi]
push eax
call fcn.004579a0
mov eax, dword [ebp - 0x3874]
add esp, 0xc
mov byte [eax + esi + 0x27], 0
lea eax, [ebp - 0x35a0]
jmp 0x40d2eb
mov byte [ebp - 0x3874], 0
lea ecx, [ebp - 0x35a0]
push dword [ebp - 0x3874]
push 0x27
call fcn.00415690
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x3724], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x3714], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x358c]
cmp edx, 0x10
jb 0x40d351
mov ecx, dword [ebp - 0x35a0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40d347
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411a57
push edx
push ecx
call fcn.0045633a
add esp, 8
lea eax, [ebp - 0x3724]
mov dword [ebp - 0x3590], 0
push eax
lea ecx, [ebp - 0x3510]
mov dword [ebp - 0x358c], 0xf
mov byte [ebp - 0x35a0], 0
call fcn.00413770
cmp dword [ebp - 0x34fc], 0x10
lea eax, [ebp - 0x3510]
cmovae eax, dword [ebp - 0x3510]
push eax
lea eax, [ebp - 0x158]
push 0x100
push eax
call fcn.0045cfd7
add esp, 0xc
lea ecx, [ebp - 0x158]
call fcn.00402330
mov edx, dword [ebp - 0x34fc]
cmp edx, 0x10
jb 0x40d3ec
mov ecx, dword [ebp - 0x3510]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40d3e2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411a5c
push edx
push ecx
call fcn.0045633a
add esp, 8
cmp byte [0x4a1225], 0
push 0
je 0x40df10
call fcn.0045d557
add esp, 4
mov dword [ebp - 0x34f8], eax
lea eax, [ebp - 0x34f8]
mov dword [ebp - 0x34f4], edx
push eax
lea eax, [ebp - 0x35c4]
push eax
call fcn.0045ae6d
lea eax, [ebp - 0x35c4]
push eax
push str._F__X
lea eax, [ebp - 0x38]
push 0x64
push eax
call fcn.0045b5aa
lea ecx, [ebp - 0x38]
add esp, 0x18
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d442
sub ecx, edx
lea eax, [ebp - 0x38]
push ecx
push eax
mov ecx, 0x49faec
call fcn.004143f0
mov ecx, dword [0x49fafc]
mov eax, edi
sub eax, ecx
cmp eax, 8
jb 0x411a61
cmp dword [0x49fb00], 0x10
mov eax, 0x49faec
push ecx
cmovae eax, dword [0x49faec]
push eax
push 8
push 0x494e24
push ecx
push dword [ebp - 0x37b8]
lea ecx, [ebp - 0x3540]
call fcn.00415bf0
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x352c]
mov eax, edx
mov ecx, dword [ebp - 0x3530]
sub eax, ecx
push 0x27
push str.__Info__DragonSoft_01_25_____record.log
cmp eax, 0x27
jb 0x40d4eb
cmp edx, 0x10
lea esi, [ebp - 0x3540]
lea eax, [ecx + 0x27]
cmovae esi, dword [ebp - 0x3540]
add esi, ecx
mov dword [ebp - 0x3530], eax
push esi
call fcn.004579a0
add esp, 0xc
mov byte [esi + 0x27], 0
lea eax, [ebp - 0x3540]
jmp 0x40d505
mov byte [ebp - 0x3874], 0
lea ecx, [ebp - 0x3540]
push dword [ebp - 0x3874]
push 0x27
call fcn.00415690
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x3528], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x3518], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x352c]
cmp edx, 0x10
jb 0x40d56b
mov ecx, dword [ebp - 0x3540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40d561
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411a66
push edx
push ecx
call fcn.0045633a
add esp, 8
mov ecx, dword [0x49fafc]
mov eax, edi
sub eax, ecx
mov dword [ebp - 0x3530], 0
mov dword [ebp - 0x352c], 0xf
mov byte [ebp - 0x3540], 0
cmp eax, 8
jb 0x411a6b
cmp dword [0x49fb00], 0x10
mov eax, 0x49faec
push ecx
cmovae eax, dword [0x49faec]
push eax
push 8
push 0x494e24
push ecx
push dword [ebp - 0x37b8]
lea ecx, [ebp - 0x3510]
call fcn.00415bf0
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x34fc]
mov eax, edx
mov ecx, dword [ebp - 0x3500]
sub eax, ecx
push 0x21
push str.__Info__Online_Mode____record.log
cmp eax, 0x21
jb 0x40d617
cmp edx, 0x10
lea esi, [ebp - 0x3510]
lea eax, [ecx + 0x21]
cmovae esi, dword [ebp - 0x3510]
add esi, ecx
mov dword [ebp - 0x3500], eax
push esi
call fcn.004579a0
add esp, 0xc
mov byte [esi + 0x21], 0
lea eax, [ebp - 0x3510]
jmp 0x40d631
mov byte [ebp - 0x3874], 0
lea ecx, [ebp - 0x3510]
push dword [ebp - 0x3874]
push 0x21
call fcn.00415690
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x36f0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x36e0], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x34fc]
cmp edx, 0x10
jb 0x40d697
mov ecx, dword [ebp - 0x3510]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40d68d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411a70
push edx
push ecx
call fcn.0045633a
add esp, 8
mov ecx, dword [0x49fafc]
mov eax, edi
sub eax, ecx
mov dword [ebp - 0x3500], 0
mov dword [ebp - 0x34fc], 0xf
mov byte [ebp - 0x3510], 0
cmp eax, 8
jb 0x411a75
cmp dword [0x49fb00], 0x10
mov eax, 0x49faec
push ecx
cmovae eax, dword [0x49faec]
push eax
push 8
push 0x494e24
push ecx
push dword [ebp - 0x37b8]
lea ecx, [ebp - 0x3540]
call fcn.00415bf0
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x352c]
mov eax, edx
mov ecx, dword [ebp - 0x3530]
sub eax, ecx
push 0x22
push str.__Info__Offline_Mode____record.log
cmp eax, 0x22
jb 0x40d743
cmp edx, 0x10
lea esi, [ebp - 0x3540]
lea eax, [ecx + 0x22]
cmovae esi, dword [ebp - 0x3540]
add esi, ecx
mov dword [ebp - 0x3530], eax
push esi
call fcn.004579a0
add esp, 0xc
mov byte [esi + 0x22], 0
lea eax, [ebp - 0x3540]
jmp 0x40d75d
mov byte [ebp - 0x3874], 0
lea ecx, [ebp - 0x3540]
push dword [ebp - 0x3874]
push 0x22
call fcn.00415690
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x3558], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x3548], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x352c]
cmp edx, 0x10
jb 0x40d7c3
mov ecx, dword [ebp - 0x3540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40d7b9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411a7a
push edx
push ecx
call fcn.0045633a
add esp, 8
mov ecx, dword [0x49fb14]
mov eax, edi
sub eax, ecx
mov dword [ebp - 0x3530], 0
mov dword [ebp - 0x352c], 0xf
mov byte [ebp - 0x3540], 0
cmp eax, 0x1f
jb 0x411a7f
cmp dword [0x49fb18], 0x10
mov eax, 0x49fb04
push ecx
cmovae eax, dword [0x49fb04]
push eax
push 0x1f
push str._c_start__min_DSWAgent.exe__ip
push ecx
push dword [ebp - 0x37b8]
lea ecx, [ebp - 0x3510]
call fcn.00415bf0
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x34fc]
mov eax, edx
mov ecx, dword [ebp - 0x3500]
sub eax, ecx
push 0x17
push str.__m_oneshot__k__nr__nsi
cmp eax, 0x17
jb 0x40d86f
cmp edx, 0x10
lea esi, [ebp - 0x3510]
lea eax, [ecx + 0x17]
cmovae esi, dword [ebp - 0x3510]
add esi, ecx
mov dword [ebp - 0x3500], eax
push esi
call fcn.004579a0
add esp, 0xc
mov byte [esi + 0x17], 0
lea eax, [ebp - 0x3510]
jmp 0x40d889
mov byte [ebp - 0x3874], 0
lea ecx, [ebp - 0x3510]
push dword [ebp - 0x3874]
push 0x17
call fcn.00415690
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x3570], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x3560], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x34fc]
cmp edx, 0x10
jb 0x40d8ef
mov ecx, dword [ebp - 0x3510]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40d8e5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411a84
push edx
push ecx
call fcn.0045633a
add esp, 8
mov ecx, dword [0x49fa54]
mov eax, edi
sub eax, ecx
mov dword [ebp - 0x3500], 0
mov dword [ebp - 0x34fc], 0xf
mov byte [ebp - 0x3510], 0
cmp eax, 0x11
jb 0x411a89
cmp dword [0x49fa58], 0x10
mov eax, 0x49fa44
push ecx
cmovae eax, dword [0x49fa44]
push eax
push 0x11
push str._c_start__min__w
push ecx
push dword [ebp - 0x37b8]
lea ecx, [ebp - 0x3540]
call fcn.00415bf0
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x352c]
mov eax, edx
mov ecx, dword [ebp - 0x3530]
sub eax, ecx
push 0x2b
push str.DSGPOAction.exe__a__act_GPOExport__report
cmp eax, 0x2b
jb 0x40d99b
cmp edx, 0x10
lea esi, [ebp - 0x3540]
lea eax, [ecx + 0x2b]
cmovae esi, dword [ebp - 0x3540]
add esi, ecx
mov dword [ebp - 0x3530], eax
push esi
call fcn.004579a0
add esp, 0xc
mov byte [esi + 0x2b], 0
lea eax, [ebp - 0x3540]
jmp 0x40d9b5
mov byte [ebp - 0x3874], 0
lea ecx, [ebp - 0x3540]
push dword [ebp - 0x3874]
push 0x2b
call fcn.00415690
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x35f4], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x35e4], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x13
mov edx, dword [ebp - 0x352c]
cmp edx, 0x10
jb 0x40da1b
mov ecx, dword [ebp - 0x3540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40da11
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411a8e
push edx
push ecx
call fcn.0045633a
add esp, 8
lea eax, [ebp - 0x3528]
mov dword [ebp - 0x3530], 0
push eax
lea ecx, [ebp - 0x3510]
mov dword [ebp - 0x352c], 0xf
mov byte [ebp - 0x3540], 0
call fcn.00413770
cmp dword [ebp - 0x34fc], 0x10
lea eax, [ebp - 0x3510]
cmovae eax, dword [ebp - 0x3510]
push eax
lea eax, [ebp - 0x158]
push 0x100
push eax
call fcn.0045cfd7
add esp, 0xc
lea ecx, [ebp - 0x158]
call fcn.00402330
mov edx, dword [ebp - 0x34fc]
cmp edx, 0x10
jb 0x40dab6
mov ecx, dword [ebp - 0x3510]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40daac
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411a93
push edx
push ecx
call fcn.0045633a
add esp, 8
cmp dword [0x49fb18], 0x10
mov edx, 7
mov esi, dword [0x49fb14]
mov ecx, 0x49fb04
cmovae ecx, dword [0x49fb04]
cmp esi, edx
cmova esi, edx
mov edx, str.X.X.X.X
sub esi, 4
jb 0x40daf4
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x40daf9
add ecx, 4
add edx, 4
sub esi, 4
jae 0x40dae3
cmp esi, 0xfffffffc
je 0x40db2d
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x40db26
cmp esi, 0xfffffffd
je 0x40db2d
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x40db26
cmp esi, 0xfffffffe
je 0x40db2d
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x40db26
cmp esi, 0xffffffff
je 0x40db2d
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x40db2d
sbb eax, eax
or eax, 1
jmp 0x40db2f
xor eax, eax
test eax, eax
jne 0x40dc4d
cmp dword [0x49fb14], 7
jb 0x40dc4d
ja 0x40dc4d
lea eax, [ebp - 0x3558]
push eax
lea ecx, [ebp - 0x3510]
call fcn.00413770
cmp dword [ebp - 0x34fc], 0x10
lea eax, [ebp - 0x3510]
cmovae eax, dword [ebp - 0x3510]
push eax
lea eax, [ebp - 0x158]
push 0x100
push eax
call fcn.0045cfd7
add esp, 0xc
lea ecx, [ebp - 0x158]
call fcn.00402330
mov edx, dword [ebp - 0x34fc]
cmp edx, 0x10
jb 0x40dbca
mov ecx, dword [ebp - 0x3510]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40dbc0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411a98
push edx
push ecx
call fcn.0045633a
add esp, 8
lea eax, [ebp - 0x35f4]
push eax
lea ecx, [ebp - 0x3510]
call fcn.00413770
cmp dword [ebp - 0x34fc], 0x10
lea eax, [ebp - 0x3510]
cmovae eax, dword [ebp - 0x3510]
push eax
lea eax, [ebp - 0x158]
push 0x100
push eax
call fcn.0045cfd7
add esp, 0xc
lea ecx, [ebp - 0x158]
call fcn.00402330
mov edx, dword [ebp - 0x34fc]
cmp edx, 0x10
jb 0x40dd4d
mov ecx, dword [ebp - 0x3510]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40dd43
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411a9d
jmp 0x40dd43
lea eax, [ebp - 0x36f0]
push eax
lea ecx, [ebp - 0x3510]
call fcn.00413770
cmp dword [ebp - 0x34fc], 0x10
lea eax, [ebp - 0x3510]
cmovae eax, dword [ebp - 0x3510]
push eax
lea eax, [ebp - 0x158]
push 0x100
push eax
call fcn.0045cfd7
add esp, 0xc
lea ecx, [ebp - 0x158]
call fcn.00402330
mov edx, dword [ebp - 0x34fc]
cmp edx, 0x10
jb 0x40dccd
mov ecx, dword [ebp - 0x3510]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40dcc3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411aa2
push edx
push ecx
call fcn.0045633a
add esp, 8
lea eax, [ebp - 0x3570]
push eax
lea ecx, [ebp - 0x3510]
call fcn.00413770
cmp dword [ebp - 0x34fc], 0x10
lea eax, [ebp - 0x3510]
cmovae eax, dword [ebp - 0x3510]
push eax
lea eax, [ebp - 0x158]
push 0x100
push eax
call fcn.0045cfd7
add esp, 0xc
lea ecx, [ebp - 0x158]
call fcn.00402330
mov edx, dword [ebp - 0x34fc]
cmp edx, 0x10
jb 0x40dd4d
mov ecx, dword [ebp - 0x3510]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40dd43
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411aa7
push edx
push ecx
call fcn.0045633a
add esp, 8
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x35e0]
cmp edx, 0x10
jb 0x40dd8b
mov ecx, dword [ebp - 0x35f4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40dd81
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411afc
push edx
push ecx
call fcn.0045633a
add esp, 8
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x355c]
cmp edx, 0x10
jb 0x40ddc9
mov ecx, dword [ebp - 0x3570]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40ddbf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411afc
push edx
push ecx
call fcn.0045633a
add esp, 8
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x3544]
cmp edx, 0x10
jb 0x40de07
mov ecx, dword [ebp - 0x3558]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40ddfd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411afc
push edx
push ecx
call fcn.0045633a
add esp, 8
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x36dc]
cmp edx, 0x10
jb 0x40de45
mov ecx, dword [ebp - 0x36f0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40de3b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411afc
push edx
push ecx
call fcn.0045633a
add esp, 8
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x3514]
cmp edx, 0x10
jb 0x40de83
mov ecx, dword [ebp - 0x3528]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40de79
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411afc
push edx
push ecx
call fcn.0045633a
add esp, 8
cmp byte [0x4a122a], 0
push 0
je 0x40e2c6
call fcn.0045d557
add esp, 4
mov dword [ebp - 0x34f8], eax
lea eax, [ebp - 0x34f8]
mov dword [ebp - 0x34f4], edx
push eax
lea eax, [ebp - 0x35c4]
push eax
call fcn.0045ae6d
lea eax, [ebp - 0x35c4]
push eax
push str._F__X
lea eax, [ebp - 0x38]
push 0x64
push eax
call fcn.0045b5aa
lea ecx, [ebp - 0x38]
add esp, 0x18
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40dee0
sub ecx, edx
lea eax, [ebp - 0x38]
push ecx
push eax
mov ecx, 0x49faec
call fcn.004143f0
mov ecx, dword [0x49fafc]
mov eax, edi
sub eax, ecx
cmp eax, 8
jb 0x411aac
jmp 0x40e11e
call fcn.0045d557
add esp, 4
mov dword [ebp - 0x34f8], eax
lea eax, [ebp - 0x34f8]
mov dword [ebp - 0x34f4], edx
push eax
lea eax, [ebp - 0x35c4]
push eax
call fcn.0045ae6d
lea eax, [ebp - 0x35c4]
push eax
push str._F__X
lea eax, [ebp - 0x38]
push 0x64
push eax
call fcn.0045b5aa
lea ecx, [ebp - 0x38]
add esp, 0x18
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40df57
sub ecx, edx
lea eax, [ebp - 0x38]
push ecx
push eax
mov ecx, 0x49faec
call fcn.004143f0
mov ecx, dword [0x49fafc]
mov eax, edi
sub eax, ecx
cmp eax, 8
jb 0x411ab1
cmp dword [0x49fb00], 0x10
mov eax, 0x49faec
push ecx
cmovae eax, dword [0x49faec]
push eax
push 8
push 0x494e24
push ecx
push dword [ebp - 0x37b8]
lea ecx, [ebp - 0x3510]
call fcn.00415bf0
mov byte [ebp - 4], 0x14
mov edx, dword [ebp - 0x34fc]
mov eax, edx
mov ecx, dword [ebp - 0x3500]
sub eax, ecx
push 0x2f
push str.__Info__DragonSoft_01_25__Disable____record.log
cmp eax, 0x2f
jb 0x40e000
cmp edx, 0x10
lea esi, [ebp - 0x3510]
lea eax, [ecx + 0x2f]
cmovae esi, dword [ebp - 0x3510]
add esi, ecx
mov dword [ebp - 0x3500], eax
push esi
call fcn.004579a0
add esp, 0xc
mov byte [esi + 0x2f], 0
lea eax, [ebp - 0x3510]
jmp 0x40e01a
mov byte [ebp - 0x3874], 0
lea ecx, [ebp - 0x3510]
push dword [ebp - 0x3874]
push 0x2f
call fcn.00415690
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x3528], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x3518], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x16
mov edx, dword [ebp - 0x34fc]
cmp edx, 0x10
jb 0x40e080
mov ecx, dword [ebp - 0x3510]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e076
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411ab6
push edx
push ecx
call fcn.0045633a
add esp, 8
lea eax, [ebp - 0x3528]
mov dword [ebp - 0x3500], 0
push eax
lea ecx, [ebp - 0x3540]
mov dword [ebp - 0x34fc], 0xf
mov byte [ebp - 0x3510], 0
call fcn.00413770
cmp dword [ebp - 0x352c], 0x10
lea eax, [ebp - 0x3540]
cmovae eax, dword [ebp - 0x3540]
push eax
lea eax, [ebp - 0x158]
push 0x100
push eax
call fcn.0045cfd7
add esp, 0xc
lea ecx, [ebp - 0x158]
call fcn.00402330
mov edx, dword [ebp - 0x352c]
cmp edx, 0x10
jb 0x40de45
mov ecx, dword [ebp - 0x3540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40de3b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411abb
jmp 0x40de3b
cmp dword [0x49fb00], 0x10
mov eax, 0x49faec
push ecx
cmovae eax, dword [0x49faec]
push eax
push 8
push 0x494e24
push ecx
push dword [ebp - 0x37b8]
lea ecx, [ebp - 0x3510]
call fcn.00415bf0
mov byte [ebp - 4], 0x17
mov edx, dword [ebp - 0x34fc]
mov eax, edx
mov ecx, dword [ebp - 0x3500]
sub eax, ecx
push 0x28
push str.__Info__ThreatSonar_02_25_____record.log
cmp eax, 0x28
jb 0x40e19c
cmp edx, 0x10
lea esi, [ebp - 0x3510]
lea eax, [ecx + 0x28]
cmovae esi, dword [ebp - 0x3510]
add esi, ecx
mov dword [ebp - 0x3500], eax
push esi
call fcn.004579a0
add esp, 0xc
mov byte [esi + 0x28], 0
lea eax, [ebp - 0x3510]
jmp 0x40e1b6
mov byte [ebp - 0x3874], 0
lea ecx, [ebp - 0x3510]
push dword [ebp - 0x3874]
push 0x28
call fcn.00415690
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x3528], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x3518], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x19
mov edx, dword [ebp - 0x34fc]
cmp edx, 0x10
jb 0x40e21c
mov ecx, dword [ebp - 0x3510]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e212
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411ac0
push edx
push ecx
call fcn.0045633a
add esp, 8
lea eax, [ebp - 0x3528]
mov dword [ebp - 0x3500], 0
push eax
lea ecx, [ebp - 0x3540]
mov dword [ebp - 0x34fc], 0xf
mov byte [ebp - 0x3510], 0
call fcn.00413770
cmp dword [ebp - 0x352c], 0x10
lea eax, [ebp - 0x3540]
cmovae eax, dword [ebp - 0x3540]
push eax
lea eax, [ebp - 0x158]
push 0x100
push eax
call fcn.0045cfd7
add esp, 0xc
lea ecx, [ebp - 0x158]
call fcn.00402330
mov edx, dword [ebp - 0x352c]
cmp edx, 0x10
jb 0x40e2b7
mov ecx, dword [ebp - 0x3540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e2ad
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411ac5
push edx
push ecx
call fcn.0045633a
add esp, 8
mov ecx, str._c_start__w_ThreatSonar.exe
call fcn.00402330
jmp 0x40e4d4
call fcn.0045d557
add esp, 4
mov dword [ebp - 0x34f8], eax
lea eax, [ebp - 0x34f8]
mov dword [ebp - 0x34f4], edx
push eax
lea eax, [ebp - 0x35c4]
push eax
call fcn.0045ae6d
lea eax, [ebp - 0x35c4]
push eax
push str._F__X
lea eax, [ebp - 0x38]
push 0x64
push eax
call fcn.0045b5aa
lea ecx, [ebp - 0x38]
add esp, 0x18
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e310
sub ecx, edx
lea eax, [ebp - 0x38]
push ecx
push eax
mov ecx, 0x49faec
call fcn.004143f0
mov ecx, dword [0x49fafc]
mov eax, edi
sub eax, ecx
cmp eax, 8
jb 0x411aca
cmp dword [0x49fb00], 0x10
mov eax, 0x49faec
push ecx
cmovae eax, dword [0x49faec]
push eax
push 8
push 0x494e24
push ecx
push dword [ebp - 0x37b8]
lea ecx, [ebp - 0x3510]
call fcn.00415bf0
mov byte [ebp - 4], 0x1a
mov edx, dword [ebp - 0x34fc]
mov eax, edx
mov ecx, dword [ebp - 0x3500]
sub eax, ecx
push 0x30
push str.__Info__ThreatSonar_02_25__Disable____record.log
cmp eax, 0x30
jb 0x40e3b9
cmp edx, 0x10
lea esi, [ebp - 0x3510]
lea eax, [ecx + 0x30]
cmovae esi, dword [ebp - 0x3510]
add esi, ecx
mov dword [ebp - 0x3500], eax
push esi
call fcn.004579a0
add esp, 0xc
mov byte [esi + 0x30], 0
lea eax, [ebp - 0x3510]
jmp 0x40e3d3
mov byte [ebp - 0x3874], 0
lea ecx, [ebp - 0x3510]
push dword [ebp - 0x3874]
push 0x30
call fcn.00415690
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x3528], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x3518], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x1c
mov edx, dword [ebp - 0x34fc]
cmp edx, 0x10
jb 0x40e439
mov ecx, dword [ebp - 0x3510]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e42f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411acf
push edx
push ecx
call fcn.0045633a
add esp, 8
lea eax, [ebp - 0x3528]
mov dword [ebp - 0x3500], 0
push eax
lea ecx, [ebp - 0x3540]
mov dword [ebp - 0x34fc], 0xf
mov byte [ebp - 0x3510], 0
call fcn.00413770
cmp dword [ebp - 0x352c], 0x10
lea eax, [ebp - 0x3540]
cmovae eax, dword [ebp - 0x3540]
push eax
lea eax, [ebp - 0x158]
push 0x100
push eax
call fcn.0045cfd7
add esp, 0xc
lea ecx, [ebp - 0x158]
call fcn.00402330
mov edx, dword [ebp - 0x352c]
cmp edx, 0x10
jb 0x40e4d4
mov ecx, dword [ebp - 0x3540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e4ca
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411ad4
push edx
push ecx
call fcn.0045633a
add esp, 8
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x3514]
cmp edx, 0x10
jb 0x40e512
mov ecx, dword [ebp - 0x3528]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e508
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411afc
push edx
push ecx
call fcn.0045633a
add esp, 8
cmp byte [0x4a1255], 0
push 0
je 0x40e7f0
call fcn.0045d557
add esp, 4
mov dword [ebp - 0x34f8], eax
lea eax, [ebp - 0x34f8]
mov dword [ebp - 0x34f4], edx
push eax
lea eax, [ebp - 0x35c4]
push eax
call fcn.0045ae6d
lea eax, [ebp - 0x35c4]
push eax
push str._F__X
lea eax, [ebp - 0x38]
push 0x64
push eax
call fcn.0045b5aa
lea ecx, [ebp - 0x38]
add esp, 0x18
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e568
sub ecx, edx
lea eax, [ebp - 0x38]
push ecx
push eax
mov ecx, 0x49faec
call fcn.004143f0
mov ecx, dword [0x49fafc]
mov eax, edi
sub eax, ecx
cmp eax, 8
jb 0x411ad9
cmp dword [0x49fb00], 0x10
mov eax, 0x49faec
push ecx
cmovae eax, dword [0x49faec]
push eax
push 8
push 0x494e24
push ecx
push dword [ebp - 0x37b8]
lea ecx, [ebp - 0x3510]
call fcn.00415bf0
mov byte [ebp - 4], 0x1d
mov edx, dword [ebp - 0x34fc]
mov eax, edx
mov ecx, dword [ebp - 0x3500]
sub eax, ecx
push 0x26
push str.__Info__Thor_scan_02_25_____record.log
cmp eax, 0x26
jb 0x40e611
cmp edx, 0x10
lea esi, [ebp - 0x3510]
lea eax, [ecx + 0x26]
cmovae esi, dword [ebp - 0x3510]
add esi, ecx
mov dword [ebp - 0x3500], eax
push esi
call fcn.004579a0
add esp, 0xc
mov byte [esi + 0x26], 0
lea eax, [ebp - 0x3510]
jmp 0x40e62b
mov byte [ebp - 0x3874], 0
lea ecx, [ebp - 0x3510]
push dword [ebp - 0x3874]
push 0x26
call fcn.00415690
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x3528], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x3518], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x1f
mov edx, dword [ebp - 0x34fc]
cmp edx, 0x10
jb 0x40e691
mov ecx, dword [ebp - 0x3510]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e687
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411ade
push edx
push ecx
call fcn.0045633a
add esp, 8
lea eax, [ebp - 0x3528]
mov dword [ebp - 0x3500], 0
push eax
lea ecx, [ebp - 0x3540]
mov dword [ebp - 0x34fc], 0xf
mov byte [ebp - 0x3510], 0
call fcn.00413770
cmp dword [ebp - 0x352c], 0x10
lea eax, [ebp - 0x3540]
cmovae eax, dword [ebp - 0x3540]
push eax
lea eax, [ebp - 0x158]
push 0x100
push eax
call fcn.0045cfd7
add esp, 0xc
lea ecx, [ebp - 0x158]
call fcn.00402330
mov edx, dword [ebp - 0x352c]
cmp edx, 0x10
jb 0x40e72c
mov ecx, dword [ebp - 0x3540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e722
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411ae3
push edx
push ecx
call fcn.0045633a
add esp, 8
mov ecx, str._c_start__w__issduthor.vbs
call fcn.00402330
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x3514]
cmp edx, 0x10
jb 0x40e774
mov ecx, dword [ebp - 0x3528]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e76a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411afc
push edx
push ecx
call fcn.0045633a
add esp, 8
push 0
call fcn.0045d557
add esp, 4
mov dword [ebp - 0x34f8], eax
lea eax, [ebp - 0x34f8]
mov dword [ebp - 0x34f4], edx
push eax
lea eax, [ebp - 0x35c4]
push eax
call fcn.0045ae6d
lea eax, [ebp - 0x35c4]
push eax
push str._F__X
lea eax, [ebp - 0x38]
push 0x64
push eax
call fcn.0045b5aa
lea ecx, [ebp - 0x38]
add esp, 0x18
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e7c0
sub ecx, edx
lea eax, [ebp - 0x38]
push ecx
push eax
mov ecx, 0x49faec
call fcn.004143f0
mov ecx, dword [0x49fafc]
mov eax, edi
sub eax, ecx
cmp eax, 8
jb 0x411ae8
jmp 0x40ea3c
call fcn.0045d557
add esp, 4
mov dword [ebp - 0x34f8], eax
lea eax, [ebp - 0x34f8]
mov dword [ebp - 0x34f4], edx
push eax
lea eax, [ebp - 0x35c4]
push eax
call fcn.0045ae6d
lea eax, [ebp - 0x35c4]
push eax
push str._F__X
lea eax, [ebp - 0x38]
push 0x64
push eax
call fcn.0045b5aa
lea ecx, [ebp - 0x38]
add esp, 0x18
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40e837
sub ecx, edx
lea eax, [ebp - 0x38]
push ecx
push eax
mov ecx, 0x49faec
call fcn.004143f0
mov ecx, dword [0x49fafc]
mov eax, edi
sub eax, ecx
cmp eax, 8
jb 0x411aed
cmp dword [0x49fb00], 0x10
mov eax, 0x49faec
push ecx
cmovae eax, dword [0x49faec]
push eax
push 8
push 0x494e24
push ecx
push dword [ebp - 0x37b8]
lea ecx, [ebp - 0x3510]
call fcn.00415bf0
mov byte [ebp - 4], 0x20
mov edx, dword [ebp - 0x34fc]
mov eax, edx
mov ecx, dword [ebp - 0x3500]
sub eax, ecx
push 0x2d
push str.__Info__Thor_scan_02_25_Disable____record.log
cmp eax, 0x2d
jb 0x40e8e0
cmp edx, 0x10
lea esi, [ebp - 0x3510]
lea eax, [ecx + 0x2d]
cmovae esi, dword [ebp - 0x3510]
add esi, ecx
mov dword [ebp - 0x3500], eax
push esi
call fcn.004579a0
add esp, 0xc
mov byte [esi + 0x2d], 0
lea eax, [ebp - 0x3510]
jmp 0x40e8fa
mov byte [ebp - 0x3874], 0
lea ecx, [ebp - 0x3510]
push dword [ebp - 0x3874]
push 0x2d
call fcn.00415690
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x3528], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x3518], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x22
mov edx, dword [ebp - 0x34fc]
cmp edx, 0x10
jb 0x40e960
mov ecx, dword [ebp - 0x3510]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e956
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411af2
push edx
push ecx
call fcn.0045633a
add esp, 8
lea eax, [ebp - 0x3528]
mov dword [ebp - 0x3500], 0
push eax
lea ecx, [ebp - 0x3540]
mov dword [ebp - 0x34fc], 0xf
mov byte [ebp - 0x3510], 0
call fcn.00413770
cmp dword [ebp - 0x352c], 0x10
lea eax, [ebp - 0x3540]
cmovae eax, dword [ebp - 0x3540]
push eax
lea eax, [ebp - 0x158]
push 0x100
push eax
call fcn.0045cfd7
add esp, 0xc
lea ecx, [ebp - 0x158]
call fcn.00402330
mov edx, dword [ebp - 0x352c]
cmp edx, 0x10
jb 0x40e9fb
mov ecx, dword [ebp - 0x3540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e9f1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411af7
push edx
push ecx
call fcn.0045633a
add esp, 8
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x3514]
cmp edx, 0x10
jb 0x40e774
mov ecx, dword [ebp - 0x3528]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e76a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411afc
jmp 0x40e76a
cmp dword [0x49fb00], 0x10
mov eax, 0x49faec
push ecx
cmovae eax, dword [0x49faec]
push eax
push 8
push 0x494e24
push ecx
push dword [ebp - 0x37b8]
lea ecx, [ebp - 0x3510]
call fcn.00415bf0
mov byte [ebp - 4], 0x23
mov edx, dword [ebp - 0x34fc]
mov eax, edx
mov ecx, dword [ebp - 0x3500]
sub eax, ecx
push 0x29
push str.__Info__Machine_Info_03_25_____record.log
cmp eax, 0x29
jb 0x40eaba
cmp edx, 0x10
lea esi, [ebp - 0x3510]
lea eax, [ecx + 0x29]
cmovae esi, dword [ebp - 0x3510]
add esi, ecx
mov dword [ebp - 0x3500], eax
push esi
call fcn.004579a0
add esp, 0xc
mov byte [esi + 0x29], 0
lea eax, [ebp - 0x3510]
jmp 0x40ead4
mov byte [ebp - 0x3874], 0
lea ecx, [ebp - 0x3510]
push dword [ebp - 0x3874]
push 0x29
call fcn.00415690
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x36f0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x36e0], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x25
mov edx, dword [ebp - 0x34fc]
cmp edx, 0x10
jb 0x40eb3a
mov ecx, dword [ebp - 0x3510]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40eb30
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411b01
push edx
push ecx
call fcn.0045633a
add esp, 8
lea eax, [ebp - 0x36f0]
mov dword [ebp - 0x3500], 0
push eax
lea ecx, [ebp - 0x3540]
mov dword [ebp - 0x34fc], 0xf
mov byte [ebp - 0x3510], 0
call fcn.00413770
cmp dword [ebp - 0x352c], 0x10
lea eax, [ebp - 0x3540]
cmovae eax, dword [ebp - 0x3540]
push eax
lea eax, [ebp - 0x158]
push 0x100
push eax
call fcn.0045cfd7
add esp, 0xc
lea ecx, [ebp - 0x158]
call fcn.00402330
mov edx, dword [ebp - 0x352c]
cmp edx, 0x10
jb 0x40ebd5
mov ecx, dword [ebp - 0x3540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40ebcb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411b06
push edx
push ecx
call fcn.0045633a
add esp, 8
mov ecx, str._a__c_chcp_65001___SystemRoot_System32ipconfig__all__findstr__i_IPv4___IP.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersion___v_ProductName___OS.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersion___v_CurrentBuildNumber____OS.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersion___v_ReleaseId____OS.log
call fcn.00402330
cmp byte [0x4a122c], 0
je 0x40ec10
mov ecx, str._a__c_chcp_65001__secedit.exe__export__cfg_GPO.log
call fcn.00402330
mov ecx, str._c_reg_query__HKLMSystemCurrentControlSetControlLsa___v_RestrictAnonymous___GPOSec.log
call fcn.00402330
mov ecx, str._c_reg_query__HKLMSystemCurrentControlSetServicesLanmanWorkstationParameters___v_EnablePlainTextPassword____GPOSec.log
call fcn.00402330
mov ecx, str._c_reg_query__HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer___v_NoDriveTypeAutoRun____GPOSec.log
call fcn.00402330
mov ecx, str._c_reg_query__HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer___v_NoAutorun____GPOSec.log
call fcn.00402330
mov ecx, str._c_reg_query__HKLMSoftwarePoliciesMicrosoftWindowsEventLogSecurity_____GPOSec.log
call fcn.00402330
mov ecx, str._c_reg_query__HKLMSoftwarePoliciesMicrosoftWindowsEventLogSetup_____GPOSec.log
call fcn.00402330
mov ecx, str._c_reg_query__HKLMSoftwarePoliciesMicrosoftWindowsEventLogSystem_____GPOSec.log
call fcn.00402330
mov ecx, str._c_reg_query__HKLMSoftwareMicrosoftWindows_NTCurrentVersionWinlogon___v_PasswordExpiryWarning____GPOSec.log
call fcn.00402330
mov ecx, str._c_reg_query__HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem___v_disablecad____GPOSec.log
call fcn.00402330
mov ecx, str._c_reg_query__HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem___v_dontdisplaylastusername____GPOSec.log
call fcn.00402330
mov ecx, str._c_systeminfo___Systeminfo.log
call fcn.00402330
push 0
call fcn.0045d557
add esp, 4
mov dword [ebp - 0x34f8], eax
lea eax, [ebp - 0x34f8]
mov dword [ebp - 0x34f4], edx
push eax
lea eax, [ebp - 0x35c4]
push eax
call fcn.0045ae6d
lea eax, [ebp - 0x35c4]
push eax
push str._F__X
lea eax, [ebp - 0x38]
push 0x64
push eax
call fcn.0045b5aa
lea ecx, [ebp - 0x38]
add esp, 0x18
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ecc7
sub ecx, edx
lea eax, [ebp - 0x38]
push ecx
push eax
mov ecx, 0x49faec
call fcn.004143f0
lea eax, [ebp - 0x36a4]
push eax
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x40ef2c
mov ecx, dword [0x49fafc]
sub edi, ecx
cmp edi, 8
jb 0x411b0b
cmp dword [0x49fb00], 0x10
mov eax, 0x49faec
push ecx
cmovae eax, dword [0x49faec]
push eax
push 8
push 0x494e24
push ecx
push dword [ebp - 0x37b8]
lea ecx, [ebp - 0x3540]
call fcn.00415bf0
mov byte [ebp - 4], 0x26
mov edx, dword [ebp - 0x352c]
mov eax, edx
mov ecx, dword [ebp - 0x3530]
sub eax, ecx
push 0x2d
push str.__Info__User_Login_Successfully____record.log
cmp eax, 0x2d
jb 0x40ed8a
cmp edx, 0x10
lea esi, [ebp - 0x3540]
lea eax, [ecx + 0x2d]
cmovae esi, dword [ebp - 0x3540]
add esi, ecx
mov dword [ebp - 0x3530], eax
push esi
call fcn.004579a0
add esp, 0xc
mov byte [esi + 0x2d], 0
lea eax, [ebp - 0x3540]
jmp 0x40eda4
mov byte [ebp - 0x3874], 0
lea ecx, [ebp - 0x3540]
push dword [ebp - 0x3874]
push 0x2d
call fcn.00415690
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x3528], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x3518], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea ecx, [ebp - 0x3540]
mov byte [ebp - 4], 0x28
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
xor eax, eax
mov dword [ebp - 0x35a0], 0
add esp, 0x18
mov dword [ebp - 0x3590], 0
mov dword [ebp - 0x358c], 7
mov word [ebp - 0x35a0], ax
lea eax, [ebp - 0x620]
mov byte [ebp - 4], 0x29
push eax
lea ecx, [ebp - 0x3654]
call fcn.00413470
mov edi, eax
lea eax, [ebp - 0x3874]
mov byte [ebp - 4], 0x2a
push eax
mov ecx, 0x49faec
call fcn.00413600
mov esi, eax
mov ecx, 0x49faec
lea eax, [ebp - 0x34f4]
push eax
call fcn.00413620
push dword [esi]
lea ecx, [ebp - 0x35a0]
push dword [eax]
call fcn.00414dc0
push eax
mov edx, str._c_echo
lea ecx, [ebp - 0x3624]
call fcn.00414f40
add esp, 4
push str.__Info__User_:
mov edx, eax
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x369c]
call fcn.00415080
add esp, 4
push edi
mov edx, eax
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x360c]
call fcn.00415140
add esp, 4
push str.____record.log
mov edx, eax
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x3558]
call fcn.00415080
add esp, 4
lea ecx, [ebp - 0x360c]
call fcn.00413410
lea ecx, [ebp - 0x369c]
call fcn.00413410
lea ecx, [ebp - 0x3624]
call fcn.00413410
lea ecx, [ebp - 0x3654]
call fcn.00413410
lea ecx, [ebp - 0x3558]
call fcn.00413400
mov edx, eax
lea ecx, [ebp - 0x418]
call fcn.00415220
lea ecx, [ebp - 0x418]
call fcn.00402430
lea ecx, [ebp - 0x3558]
call fcn.00413410
lea ecx, [ebp - 0x35a0]
call fcn.00413410
jmp 0x40ef85
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x360c]
call fcn.00414b20
add esp, 4
push str.__Info___Warn__No_User_Login____record.log
mov edx, eax
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x360c]
mov byte [ebp - 4], 0x30
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
lea ecx, [ebp - 0x3528]
mov byte [ebp - 4], 0x25
call fcn.00413640
lea edx, [ebp - 0x620]
lea ecx, [ebp - 0x218]
call fcn.00415230
call fcn.004024b0
lea eax, [ebp - 0x36f4]
push eax
lea eax, [ebp - 0x36a0]
push eax
push dword [ebp - 0x3878]
lea eax, [ebp - 0x36a8]
push eax
lea eax, [ebp - 0xe20]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x40f091
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x360c]
call fcn.00401480
push eax
lea ecx, [ebp - 0x36d8]
call fcn.00413690
lea ecx, [ebp - 0x360c]
call fcn.00413640
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x3624]
call fcn.00414b20
add esp, 4
push str.__Warn_
mov edx, eax
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x369c]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x36d8]
mov byte [ebp - 4], 0x32
push ecx
mov edx, eax
lea ecx, [ebp - 0x360c]
call fcn.00414cb0
add esp, 4
push str._No_mapping_between_account_names_and_security_IDs_was_done____record.log
mov edx, eax
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x360c]
call fcn.00413640
lea ecx, [ebp - 0x369c]
call fcn.00413640
mov byte [ebp - 4], 0x37
jmp 0x40f156
lea eax, [ebp - 0x37b8]
push eax
lea eax, [ebp - 0xe20]
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
jne 0x40f18e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x360c]
call fcn.00401480
push eax
lea ecx, [ebp - 0x36d8]
call fcn.00413690
lea ecx, [ebp - 0x360c]
call fcn.00413640
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x3624]
call fcn.00414b20
add esp, 4
push str.__Warn_
mov edx, eax
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x369c]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x36d8]
mov byte [ebp - 4], 0x39
push ecx
mov edx, eax
lea ecx, [ebp - 0x360c]
call fcn.00414cb0
add esp, 4
push str._The_security_ID_structure_is_invalid____record.log
mov edx, eax
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x360c]
call fcn.00413640
lea ecx, [ebp - 0x369c]
call fcn.00413640
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x3624]
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x3528]
call fcn.00413640
jmp 0x40f3ab
xor eax, eax
mov dword [ebp - 0x3540], 0
mov dword [ebp - 0x3530], 0
mov dword [ebp - 0x352c], 7
mov word [ebp - 0x3540], ax
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x3528]
push dword [ebp - 0x37b8]
call fcn.00413470
lea eax, [ebp - 0x34f4]
mov byte [ebp - 4], 0x40
push eax
mov ecx, 0x49faec
call fcn.00413600
mov esi, eax
mov ecx, 0x49faec
lea eax, [ebp - 0x3878]
push eax
call fcn.00413620
push dword [esi]
lea ecx, [ebp - 0x3540]
push dword [eax]
call fcn.00414dc0
push eax
mov edx, str._c_echo
lea ecx, [ebp - 0x3624]
call fcn.00414f40
add esp, 4
push str.__Info__SID_:
mov edx, eax
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x369c]
call fcn.00415080
add esp, 4
lea ecx, [ebp - 0x3528]
mov byte [ebp - 4], 0x42
push ecx
mov edx, eax
lea ecx, [ebp - 0x360c]
call fcn.00415160
add esp, 4
push str.____record.log
mov edx, eax
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x35f4]
call fcn.00415080
add esp, 4
lea ecx, [ebp - 0x360c]
call fcn.00413410
lea ecx, [ebp - 0x369c]
call fcn.00413410
lea ecx, [ebp - 0x3624]
mov byte [ebp - 4], 0x47
call fcn.00413410
lea eax, [ebp - 0x3528]
mov edx, str._c_reg_query__HKU_
push eax
lea ecx, [ebp - 0x3654]
call fcn.00414f40
add esp, 4
push str.SoftwarePoliciesMicrosoftWindowsControl_PanelDesktop_____GPOSec.log
mov edx, eax
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x3570]
call fcn.00415080
add esp, 4
lea ecx, [ebp - 0x3654]
mov byte [ebp - 4], 0x4a
call fcn.00413410
lea eax, [ebp - 0x3528]
mov edx, str._c_reg_query__HKU_
push eax
lea ecx, [ebp - 0x3588]
call fcn.00414f40
add esp, 4
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesAttachments_____GPOSec.log
mov edx, eax
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x3558]
call fcn.00415080
add esp, 4
lea ecx, [ebp - 0x3588]
call fcn.00413410
lea ecx, [ebp - 0x35f4]
call fcn.00413400
mov edx, eax
lea ecx, [ebp - 0x318]
call fcn.00415220
lea ecx, [ebp - 0x3570]
call fcn.00413400
mov edx, eax
lea ecx, [ebp - 0x3220]
call fcn.00415240
lea ecx, [ebp - 0x3558]
call fcn.00413400
mov edx, eax
lea ecx, [ebp - 0x2e20]
call fcn.00415240
lea ecx, [ebp - 0x318]
call fcn.00402430
lea ecx, [ebp - 0x3220]
call fcn.00402430
lea ecx, [ebp - 0x2e20]
call fcn.00402430
lea ecx, [ebp - 0x3558]
call fcn.00413410
lea ecx, [ebp - 0x3570]
call fcn.00413410
lea ecx, [ebp - 0x35f4]
call fcn.00413410
lea ecx, [ebp - 0x3528]
call fcn.00413410
lea ecx, [ebp - 0x3540]
mov byte [ebp - 4], 0x25
call fcn.00413410
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x369c]
call fcn.00414b20
add esp, 4
push str.__Info__Virus_log_04_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0x360c]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x369c]
mov byte [ebp - 4], 0x4e
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x360c]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWARESymantecSymantec_Endpoint_ProtectionCurrentVersion___v_PRODUCTNAME___Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWARESymantecSymantec_Endpoint_ProtectionCurrentVersion___v_PRODUCTVERSION____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWARESymantecSymantec_Endpoint_ProtectionCurrentVersionpublic_opstate___v_LatestVirusDefsDate____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWARESymantecSymantec_Endpoint_ProtectionCurrentVersionpublic_opstate___v_LatestVirusDefsRevision____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWARESymantecSymantec_Endpoint_ProtectionCurrentVersionpublic_opstate___v_LastSuccessfulScanDateTime____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeTrendMicroPC_cillinNTCorpCurrentVersionMisc.___v_ProductName____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeTrendMicroPC_cillinNTCorpCurrentVersionMisc.___v_InternalPatternVer____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeTrendMicroPC_cillinNTCorpCurrentVersionMisc.___v_LastUpdateTime____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeTrendMicroPC_cillinNTCorpCurrentVersionMisc.___v_LastScanTime____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeKasperskyLabprotectedKESenvironment___v_ProductName____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeKasperskyLabprotectedKESenvironment___v_ProductVersion____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeKasperskyLabprotectedKESData__v_LastSuccessfulUpdate_____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeKasperskyLabprotectedKESData__v_LastUpdate_____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeKasperskyLabprotectedKESData__v_LastSuccessfulFullScan_____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREESETESET_SecurityCurrentVersionInfo___v_ProductName____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREESETESET_SecurityCurrentVersionInfo___v_ProductVersion____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREESETESET_SecurityCurrentVersionPlugins01000400Settings___v_LastSuccessfulUpdate____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREESETESET_SecurityCurrentVersionInfo___v_LastUefiScanTime____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREF_SecureUltralightSettingswsc.anti_virus.name___v_value____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREF_SecureUltralight___v_ProductVersion____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREF_SecureUltralightupdates___v_LastUpdateStatus____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001_reg_query__HKLMSOFTWAREF_SecureUltralightSettingsproduct.name___v_value____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREF_SecureUltralightSettingsproduct.oneclient_version___v_value____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREF_SecureUltralightStatisticsengine___s____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREF_SecureUltralightupdates___s____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREMcAfeeAgent___s____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREMcAfeeMSCShortcuts___v_ShortcutName____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREMcAfeeMSC___v_MarketReleaseVer____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeMcAfeeMSCAppInfoSubstitute___v_date____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeMcAfeeAVSolutionDatReputation___v_dwLastDATUpdateStatus____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeMcAfeeAVEngine___s____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeMcAfeeDesktopProtection___s____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeAviraLauncher___v_ProductName____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeAviraAntivirus___v_CurrentVersion____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREWOW6432NodeAviraAntivirus___v_LastUpdate____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREMicrosoftWindowsCurrentVersionUninstallSophos_Endpoint_Defense___v_DisplayName____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__reg_query__HKLMSOFTWAREMicrosoftWindowsCurrentVersionUninstallSophos_Endpoint_Defense___v_DisplayVersion____Antivirus.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__antivirus.exe__stab_AntivirusAll.log
call fcn.00402330
inc dword [0x49fa10]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call edi
cmp byte [0x4a122f], 0
je 0x40f618
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x3624]
call fcn.00414b20
add esp, 4
push str.__Info__Gathering_VANS_05_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x3624]
mov byte [ebp - 4], 0x51
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
mov ecx, str._c_vans.bat
call fcn.00402330
inc dword [0x49fa10]
push 0x3e8
call edi
jmp 0x40f676
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x3624]
call fcn.00414b20
add esp, 4
push str.__Info__Gathering_VANS_05_25__Disable____record.log
mov edx, eax
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x3624]
mov byte [ebp - 4], 0x54
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
lea ecx, [ebp - 0x3528]
mov byte [ebp - 4], 0x4e
call fcn.00413640
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x3624]
call fcn.00414b20
add esp, 4
push str.__Info__ProductPath_06_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0x55
lea ecx, [ebp - 0x369c]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x3624]
mov byte [ebp - 4], 0x57
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x369c]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files__x86____findstr__i_java.exe___ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files___findstr__i_java.exe____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files__x86____findstr__i_WINWORD.EXE____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files___findstr__i_WINWORD.EXE____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files__x86____findstr__i_AcroRd32.exe____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files___findstr__i_AcroRd32.exe____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files__x86____findstr__i_Acrobat.exe____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files___findstr__i_Acrobat.exe____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__SystemRoot_System32MacromedFlash__findstr__i_flash____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__SystemRoot_SysWow64MacromedFlash__findstr__i_flash____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files__x86____findstr__i_WinRAR.exe____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files___findstr__i_WinRAR.exe____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files__x86____findstr__i_brave.exe____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files___findstr__i_brave.exe____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files__x86_googlechrome_application___findstr__i_chrome.exe____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Filesgooglechrome_application___findstr__i_chrome.exe____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files__x86_Mozilla_Firefox___findstr__i_firefox.exe____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_FilesMozilla_Firefox___findstr__i_firefox.exe____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Files__x86_microsoftedge_application___findstr__i__msedge.exe_____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Program_Filesmicrosoftedge_application___findstr__i__msedge.exe_____ProductPath.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__s__b__C:Users___findstr__i_vivaldi.exe____ProductPath.log
call fcn.00402330
push 0xbb8
call edi
sub esp, 8
lea ecx, [ebp - 0x3870]
push str.ProductPath.log
call fcn.00412f40
cmp dword [ebp - 0x3814], 0
jne 0x40f84a
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x3654]
call fcn.00414b20
add esp, 4
push str.__Error__Open_ProductPath.log_Fail____record.log
mov edx, eax
mov byte [ebp - 4], 0x58
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x3654]
mov byte [ebp - 4], 0x5a
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
mov byte [ebp - 4], 0x57
lea ecx, [ebp - 0x3528]
call fcn.00413640
jmp 0x40f9df
mov ecx, str._c_del__f__q_ProductVer.log
call fcn.00402330
mov eax, dword [ebp - 0x3870]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x3864], 1
jne 0x40f9df
nop dword [eax + eax]
push 0
push 0x400
lea eax, [ebp - 0xa20]
push eax
lea ecx, [ebp - 0x3870]
call fcn.004132c0
lea eax, [ebp - 0xa20]
push eax
lea ecx, [ebp - 0x3654]
call fcn.00413710
lea ecx, [ebp - 0x3654]
mov esi, dword [eax + 0x10]
call fcn.00413640
test esi, esi
je 0x40f9df
lea edx, [ebp - 0xa20]
lea ecx, [ebp - 0x1620]
call fcn.00405290
push 0
push 0
push 0x400
lea eax, [ebp - 0x2a20]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x1620]
push eax
push 0
push 0x3b6
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x2a20]
push eax
lea ecx, [ebp - 0x3588]
call fcn.00413710
push eax
lea ecx, [ebp - 0x3654]
mov byte [ebp - 4], 0x5b
call fcn.00414a20
add esp, 4
push str._____ProductVer.log
mov edx, eax
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x3654]
call fcn.00413640
lea ecx, [ebp - 0x3588]
mov byte [ebp - 4], 0x5f
call fcn.00413640
lea eax, [ebp - 0x3528]
mov edx, str._a__c_chcp_65001__echo__
push eax
lea ecx, [ebp - 0x36c0]
call fcn.00414b20
add esp, 4
push str._____ProductVer_log.log
mov edx, eax
mov byte [ebp - 4], 0x60
lea ecx, [ebp - 0x3558]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x36c0]
mov byte [ebp - 4], 0x62
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
lea eax, [ebp - 0x3558]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
lea ecx, [ebp - 0x3558]
call fcn.00413640
lea ecx, [ebp - 0x3528]
mov byte [ebp - 4], 0x57
call fcn.00413640
mov eax, dword [ebp - 0x3870]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x3864], 1
je 0x40f870
lea ecx, [ebp - 0x3870]
call fcn.00412f00
inc dword [0x49fa10]
push 0x3e8
call edi
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x3654]
call fcn.00414b20
add esp, 4
push str.__Info__wmic_Product_07_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0x63
lea ecx, [ebp - 0x3624]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x3654]
mov byte [ebp - 4], 0x65
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3624]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
mov ecx, str._a__c_chcp_65001__wmic__output:Hotfix.log_qfe
call fcn.00402330
mov ecx, str._a__c_chcp_65001__wmic_product_get_Name_Version_InstallLocation_InstallDate___Product.log
call fcn.00402330
inc dword [0x49fa10]
push 0x3e8
call edi
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x3588]
call fcn.00414b20
add esp, 4
push str.__Info__reg_Product_08_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0x3654]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x3588]
mov byte [ebp - 4], 0x68
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3654]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
lea ecx, [ebp - 0x37b4]
push str._a__c_chcp_65001__reg_query___HKLMSoftwareWow6432NodeMicrosoftWindowsCurrentVersionUninstall___s__reg:64___x64Product.log
call fcn.00413470
push str._a__c_chcp_65001__reg_query___HKLMSoftwareMicrosoftWindowsCurrentVersionUninstall___s__reg:64____x64Product.log
lea ecx, [ebp - 0x373c]
mov byte [ebp - 4], 0x69
call fcn.00413470
push str._a__c_chcp_65001__reg_query___HKLMSoftwareWow6432NodeMicrosoftWindowsCurrentVersionUninstall___s__reg:32___x86Product.log
lea ecx, [ebp - 0x3754]
mov byte [ebp - 4], 0x6a
call fcn.00413470
push str._a__c_chcp_65001__reg_query___HKLMSoftwareMicrosoftWindowsCurrentVersionUninstall___s__reg:32____x86Product.log
lea ecx, [ebp - 0x376c]
mov byte [ebp - 4], 0x6b
call fcn.00413470
lea ecx, [ebp - 0x37b4]
mov byte [ebp - 4], 0x6c
call fcn.00413400
mov edx, eax
lea ecx, [ebp - 0x2620]
call fcn.00415240
lea ecx, [ebp - 0x373c]
call fcn.00413400
mov edx, eax
lea ecx, [ebp - 0x2220]
call fcn.00415240
lea ecx, [ebp - 0x2620]
call fcn.00402430
lea ecx, [ebp - 0x2220]
call fcn.00402430
lea ecx, [ebp - 0x3754]
call fcn.00413400
mov edx, eax
lea ecx, [ebp - 0x1e20]
call fcn.00415240
lea ecx, [ebp - 0x376c]
call fcn.00413400
mov edx, eax
lea ecx, [ebp - 0x1a20]
call fcn.00415240
lea ecx, [ebp - 0x1e20]
call fcn.00402430
lea ecx, [ebp - 0x1a20]
call fcn.00402430
inc dword [0x49fa10]
push 0x3e8
call edi
cmp byte [0x4a1252], 0
je 0x40fe48
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x3588]
call fcn.00414b20
add esp, 4
push str.__Info__Sec_Sys_event_09_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x3510]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x3588]
mov byte [ebp - 4], 0x6f
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3510]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
push 0x49fa44
mov edx, str._c_wevtutil_epl_Security
lea ecx, [ebp - 0x35dc]
call fcn.00414b20
add esp, 0x1c
push str.Secevent.evtx
mov edx, eax
mov byte [ebp - 4], 0x70
lea ecx, [ebp - 0x36c0]
call fcn.00414b80
add esp, 4
push str.__ow:true__q:__System_TimeCreated_timediff__SystemTime____1209600000____
mov edx, eax
mov byte [ebp - 4], 0x71
lea ecx, [ebp - 0x35f4]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x36c0]
call fcn.00413640
lea ecx, [ebp - 0x35dc]
mov byte [ebp - 4], 0x74
call fcn.00413640
push 0x49fa44
mov edx, str._c_wevtutil_epl_System
lea ecx, [ebp - 0x363c]
call fcn.00414b20
add esp, 4
push str.Sysevent.evtx
mov edx, eax
mov byte [ebp - 4], 0x75
lea ecx, [ebp - 0x3588]
call fcn.00414b80
add esp, 4
push str.__ow:true__q:__System_TimeCreated_timediff__SystemTime____1209600000____
mov edx, eax
mov byte [ebp - 4], 0x76
lea ecx, [ebp - 0x3570]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x3588]
call fcn.00413640
lea ecx, [ebp - 0x363c]
mov byte [ebp - 4], 0x79
call fcn.00413640
push 0x49fa44
mov edx, str._c_echo_wevtutil_epl_Security
lea ecx, [ebp - 0x3684]
call fcn.00414b20
add esp, 4
push str.Secevent.evtx
mov edx, eax
mov byte [ebp - 4], 0x7a
lea ecx, [ebp - 0x36c0]
call fcn.00414b80
add esp, 4
push str.__ow:true__q:__System_TimeCreated_timediff__SystemTime____1209600000_______record.log
mov edx, eax
mov byte [ebp - 4], 0x7b
lea ecx, [ebp - 0x3558]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x36c0]
call fcn.00413640
lea ecx, [ebp - 0x3684]
mov byte [ebp - 4], 0x7e
call fcn.00413640
push 0x49fa44
mov edx, str._c_ehco_wevtutil_epl_System
lea ecx, [ebp - 0x366c]
call fcn.00414b20
add esp, 4
push str.Sysevent.evtx
mov edx, eax
mov byte [ebp - 4], 0x7f
lea ecx, [ebp - 0x3588]
call fcn.00414b80
add esp, 4
push str.__ow:true__q:__System_TimeCreated_timediff__SystemTime____1209600000_______record.log
mov edx, eax
mov byte [ebp - 4], 0x80
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x3588]
call fcn.00413640
lea ecx, [ebp - 0x366c]
mov byte [ebp - 4], 0x83
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x35f4]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
lea eax, [ebp - 0x3570]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
lea eax, [ebp - 0x3558]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
inc dword [0x49fa10]
add esp, 0x18
push 0x3e8
call edi
lea ecx, [ebp - 0x3528]
call fcn.00413640
lea ecx, [ebp - 0x3558]
call fcn.00413640
lea ecx, [ebp - 0x3570]
call fcn.00413640
lea ecx, [ebp - 0x35f4]
call fcn.00413640
lea ecx, [ebp - 0x3510]
jmp 0x40feac
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x3588]
call fcn.00414b20
add esp, 4
push str.__Info__Sec_Sys_event_09_25__Disable____record.log
mov edx, eax
mov byte [ebp - 4], 0x84
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x3588]
mov byte [ebp - 4], 0x86
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
lea ecx, [ebp - 0x3528]
mov byte [ebp - 4], 0x6c
call fcn.00413640
cmp byte [0x4a1259], 0
je 0x40ff2d
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x3588]
call fcn.00414b20
add esp, 4
push str.__Info__oldAutoruns_10_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0x87
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x3588]
mov byte [ebp - 4], 0x89
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
mov ecx, str._c_reg_ADD_HKCUSoftwareSysinternalsAutoRuns__v_EulaAccepted__t_REG_DWORD__d_1__f
call fcn.00402330
mov ecx, str._c_oldautorunsc.exe__a___s__c__h__t___autoruns_csv.log
jmp 0x40ff9a
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x3588]
call fcn.00414b20
add esp, 4
push str.__Info__Autoruns_10_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0x8a
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x3588]
mov byte [ebp - 4], 0x8c
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
mov ecx, str._c_reg_ADD_HKCUSoftwareSysinternalsAutoRuns__v_EulaAccepted__t_REG_DWORD__d_1__f
call fcn.00402330
mov ecx, str._c_autorunsc.exe__a___s__c__h__t___autoruns_csv.log
call fcn.00402330
inc dword [0x49fa10]
push 0x3e8
call edi
lea ecx, [ebp - 0x3528]
mov byte [ebp - 4], 0x6c
call fcn.00413640
cmp byte [0x4a1253], 0
je 0x4100a3
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x3588]
call fcn.00414b20
add esp, 4
push str.__Info__SignCheck_11_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0x8d
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x3588]
mov byte [ebp - 4], 0x8f
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
mov ecx, str._a__c_chcp_65001__reg_ADD_HKCUSoftwareSysinternalsSigcheck__v_EulaAccepted__t_REG_DWORD__d_1__f
call fcn.00402330
mov ecx, str._a__c_chcp_65001__sigcheck.exe__e__h__c___TEMP___2_nul___file_windows.csv.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__sigcheck.exe__e__h__c___USERPROFILE___2_nul____file_windows.csv.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__sigcheck.exe__e__h__c___USERPROFILE_Local_Settings__2_nul____file_windows.csv.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__sigcheck.exe__e__h__c___SystemRoot___2_nul____file_windows.csv.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__sigcheck.exe__e__h__c___SystemRoot__system32__2_nul____file_windows.csv.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__sigcheck.exe__e__h__c___SystemRoot__system32drivers__2_nul____file_windows.csv.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__sigcheck.exe__e__s__h__c___Appdata_..LocalTemp__2_nul____file_windows.csv.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__sigcheck.exe__e__s__h__c___USERPROFILE_Downloads__2_nul____file_windows.csv.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__sigcheck.exe__e__s__h__c___USERPROFILE_Desktop__2_nul____file_windows.csv.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__sigcheck.exe__e__s__h__c___USERPROFILE_Documents__2_nul____file_windows.csv.log
call fcn.00402330
inc dword [0x49fa10]
push 0x3e8
call edi
jmp 0x410101
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x3588]
call fcn.00414b20
add esp, 4
push str.__Info__SignCheck_11_25__Disable____record.log
mov edx, eax
mov byte [ebp - 4], 0x90
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x3588]
mov byte [ebp - 4], 0x92
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
lea ecx, [ebp - 0x3528]
mov byte [ebp - 4], 0x6c
call fcn.00413640
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x36c0]
call fcn.00414b20
add esp, 4
push str.__Info__MBSA_12_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0x93
lea ecx, [ebp - 0x3588]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x36c0]
mov byte [ebp - 4], 0x95
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3588]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
cmp byte [0x4a125a], 0
je 0x41040d
cmp byte [0x4a1256], 0
lea ecx, [ebp - 0x3684]
push 0x49fbac
je 0x410292
mov edx, str._c_mbsa.exe__xmlout__wa__
call fcn.00414b20
add esp, 4
push 0x4950e0
mov edx, eax
mov byte [ebp - 4], 0x96
lea ecx, [ebp - 0x363c]
call fcn.00414b80
add esp, 4
push 0x4a1230
mov edx, eax
mov byte [ebp - 4], 0x97
lea ecx, [ebp - 0x35dc]
call fcn.00414b80
add esp, 4
push str..xml.log
mov edx, eax
mov byte [ebp - 4], 0x98
lea ecx, [ebp - 0x3558]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x35dc]
call fcn.00413640
lea ecx, [ebp - 0x363c]
call fcn.00413640
lea ecx, [ebp - 0x3684]
mov byte [ebp - 4], 0x9c
call fcn.00413640
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x366c]
call fcn.00414b20
add esp, 4
push str.__Info__Windows_Update_from_WSUS____record.log
mov edx, eax
mov byte [ebp - 4], 0x9d
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
mov byte [ebp - 4], 0x9f
lea ecx, [ebp - 0x366c]
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3558]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
lea ecx, [ebp - 0x3528]
call fcn.00413640
lea ecx, [ebp - 0x3558]
jmp 0x41046c
cmp byte [0x4a122b], 0
je 0x410356
mov edx, str._c_mbsa.exe__xmlout__wi__
call fcn.00414b20
add esp, 4
push 0x4950e0
mov edx, eax
mov byte [ebp - 4], 0xa0
lea ecx, [ebp - 0x363c]
call fcn.00414b80
add esp, 4
push 0x4a1230
mov edx, eax
mov byte [ebp - 4], 0xa1
lea ecx, [ebp - 0x35dc]
call fcn.00414b80
add esp, 4
push str..xml.log
mov edx, eax
mov byte [ebp - 4], 0xa2
lea ecx, [ebp - 0x3558]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x35dc]
call fcn.00413640
lea ecx, [ebp - 0x363c]
call fcn.00413640
lea ecx, [ebp - 0x3684]
mov byte [ebp - 4], 0xa6
call fcn.00413640
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x366c]
call fcn.00414b20
add esp, 4
push str.__Info__Windows_Update_from_MS____record.log
mov edx, eax
mov byte [ebp - 4], 0xa7
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
mov byte [ebp - 4], 0xa9
jmp 0x410245
mov edx, str._c_mbsa.exe__xmlout__nvc__catalog_wsusscn2.cab__
call fcn.00414b20
add esp, 4
push 0x4950e0
mov edx, eax
mov byte [ebp - 4], 0xaa
lea ecx, [ebp - 0x363c]
call fcn.00414b80
add esp, 4
push 0x4a1230
mov edx, eax
mov byte [ebp - 4], 0xab
lea ecx, [ebp - 0x35dc]
call fcn.00414b80
add esp, 4
push str..xml.log
mov edx, eax
mov byte [ebp - 4], 0xac
lea ecx, [ebp - 0x3558]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x35dc]
call fcn.00413640
lea ecx, [ebp - 0x363c]
call fcn.00413640
lea ecx, [ebp - 0x3684]
mov byte [ebp - 4], 0xb0
call fcn.00413640
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x366c]
call fcn.00414b20
add esp, 4
push str.__Info__Windows_Update_from_CAB____record.log
mov edx, eax
mov byte [ebp - 4], 0xb1
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
mov byte [ebp - 4], 0xb3
jmp 0x410245
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x35dc]
call fcn.00414b20
add esp, 4
push str.__Warn__Bypass_Windows_Update____record.log
mov edx, eax
mov byte [ebp - 4], 0xb4
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x35dc]
mov byte [ebp - 4], 0xb6
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
lea ecx, [ebp - 0x3528]
mov byte [ebp - 4], 0x95
call fcn.00413640
inc dword [0x49fa10]
push 0x3e8
call edi
cmp byte [0x4a1258], 0
je 0x4104ff
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x35dc]
call fcn.00414b20
add esp, 4
push str.__Info__Listdlls_13_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0xb7
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x35dc]
mov byte [ebp - 4], 0xb9
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
mov ecx, str._c_reg_ADD_HKCUSoftwareSysinternalsListDLLs__v_EulaAccepted__t_REG_DWORD__d_1__f
call fcn.00402330
mov ecx, str._a__c_chcp_65001__Listdlls.exe__u____listdlls.log
call fcn.00402330
jmp 0x41055d
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x35dc]
call fcn.00414b20
add esp, 4
push str.__Info__Listdlls_13_25__Disable____record.log
mov edx, eax
mov byte [ebp - 4], 0xba
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x35dc]
mov byte [ebp - 4], 0xbc
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
inc dword [0x49fa10]
push 0x3e8
call edi
lea ecx, [ebp - 0x3528]
mov byte [ebp - 4], 0x95
call fcn.00413640
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x35dc]
call fcn.00414b20
add esp, 4
push str.__Info__pslist_14_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0xbd
lea ecx, [ebp - 0x36c0]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x35dc]
mov byte [ebp - 4], 0xbf
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x36c0]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
mov ecx, str._c_reg_ADD_HKCUSoftwareSysinternalsPsList__v_EulaAccepted__t_REG_DWORD__d_1__f
call fcn.00402330
mov ecx, str._a__c_chcp_65001__pslist.exe__t____pslist.log
call fcn.00402330
inc dword [0x49fa10]
push 0x3e8
call edi
cmp byte [0x4a1259], 0
je 0x410670
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x363c]
call fcn.00414b20
add esp, 4
push str.__Info__old_handle_15_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0xc0
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x363c]
mov byte [ebp - 4], 0xc2
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
mov ecx, str._c_reg_ADD_HKCUSoftwareSysinternalshandle__v_EulaAccepted__t_REG_DWORD__d_1__f
call fcn.00402330
mov ecx, str._a__c_chcp_65001__oldhandle.exe__v___handle.log
jmp 0x4106dd
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x363c]
call fcn.00414b20
add esp, 4
push str.__Info__handle_15_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0xc3
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x363c]
mov byte [ebp - 4], 0xc5
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
mov ecx, str._c_reg_ADD_HKCUSoftwareSysinternalshandle__v_EulaAccepted__t_REG_DWORD__d_1__f
call fcn.00402330
mov ecx, str._a__c_chcp_65001__handle.exe__v___handle.log
call fcn.00402330
inc dword [0x49fa10]
push 0x3e8
call edi
lea ecx, [ebp - 0x3528]
mov byte [ebp - 4], 0xbf
call fcn.00413640
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x363c]
call fcn.00414b20
add esp, 4
push str.__Info__DnsCache_16_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0xc6
lea ecx, [ebp - 0x35dc]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x363c]
mov byte [ebp - 4], 0xc8
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x35dc]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
mov ecx, str._a__c_chcp_65001__ipconfig__displaydns___dnsCache.log
call fcn.00402330
inc dword [0x49fa10]
push 0x3e8
call edi
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x3684]
call fcn.00414b20
add esp, 4
push str.__Info__netstat_17_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0xc9
lea ecx, [ebp - 0x363c]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x3684]
mov byte [ebp - 4], 0xcb
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x363c]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
mov ecx, str._a__c_chcp_65001___SystemRoot_System32_netstat__anob___netstat.log
call fcn.00402330
inc dword [0x49fa10]
push 0x3e8
call edi
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x366c]
call fcn.00414b20
add esp, 4
push str.__Info__whoami_18_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0xcc
lea ecx, [ebp - 0x3684]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x366c]
mov byte [ebp - 4], 0xce
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3684]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
mov ecx, str._a__c_chcp_65001__WHOAMI__ALL___whoami.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__net_user____whoami.log
call fcn.00402330
inc dword [0x49fa10]
push 0x3e8
call edi
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x370c]
call fcn.00414b20
add esp, 4
push str.__Info__hosts_19_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0xcf
lea ecx, [ebp - 0x366c]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x370c]
mov byte [ebp - 4], 0xd1
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x366c]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
mov ecx, str._c_copy__SystemRoot__system32driversetchosts_hosts.log
call fcn.00402330
inc dword [0x49fa10]
push 0x3e8
call edi
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x3528]
call fcn.00414b20
add esp, 4
push str.__Info__arpCache_20_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0xd2
lea ecx, [ebp - 0x370c]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x3528]
mov byte [ebp - 4], 0xd4
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x370c]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
mov ecx, str._a__c_chcp_65001__arp__a__v___arpCache.log
call fcn.00402330
inc dword [0x49fa10]
push 0x3e8
call edi
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x3558]
call fcn.00414b20
add esp, 4
push str.__Info__cmdHistory_21_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0xd5
lea ecx, [ebp - 0x35a0]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x3558]
mov byte [ebp - 4], 0xd7
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x35a0]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
mov ecx, str._c_doskey__history___cmdHistory.log
call fcn.00402330
inc dword [0x49fa10]
push 0x3e8
call edi
cmp byte [0x4a1229], 0
je 0x410a57
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x3570]
call fcn.00414b20
add esp, 4
push str.__Info__schtasks_22_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0xd8
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x3570]
mov byte [ebp - 4], 0xda
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
mov ecx, str._a__c_chcp_65001__schtasks__query___schtasks.log
call fcn.00402330
inc dword [0x49fa10]
push 0x3e8
call edi
lea ecx, [ebp - 0x3528]
mov byte [ebp - 4], 0xd7
call fcn.00413640
cmp byte [0x4a122d], 0
je 0x410b3f
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x3570]
call fcn.00414b20
add esp, 4
push str.__Info__ctc_23_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0xdb
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x3570]
mov byte [ebp - 4], 0xdd
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
mov ecx, str._a__c_chcp_65001__dir__a__r__q__ong__tc___SystemRoot_.__2_nul___ctc.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__a__r__s__q__ong__tc___SystemRoot_Prefetch.__2_nul____ctc.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__a__r__s__q__ong__tc___SystemRoot_Temp.__2_nul____ctc.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__a__r__s__q__ong__tc___SystemRoot_System32.__2_nul____ctc.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__a__r__s__q__ong__tc___SystemRoot_System.__2_nul____ctc.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__a__r__s__q__ong__tc___SystemRoot_SoftwareDistribution.__2_nul____ctc.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__a__r__s__q__ong__tc___SystemRoot_SystemTemp.__2_nul____ctc.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__a__r__s__q__ong__tc___Appdata_..LocalTemp.__2_nul____ctc.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__a__r__s__q__ong__tc___USERPROFILE_Downloads.__2_nul____ctc.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__a__r__q__ong__tc___USERPROFILE_Desktop.__2_nul____ctc.log
call fcn.00402330
mov ecx, str._a__c_chcp_65001__dir__a__r__q__ong__tc___USERPROFILE_Documents.__2_nul____ctc.log
call fcn.00402330
inc dword [0x49fa10]
push 0x3e8
call edi
jmp 0x410b9d
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x3570]
call fcn.00414b20
add esp, 4
push str.__Info__ctc_23_25__Disable____record.log
mov edx, eax
mov byte [ebp - 4], 0xde
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x3570]
mov byte [ebp - 4], 0xe0
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
lea ecx, [ebp - 0x3528]
mov byte [ebp - 4], 0xd7
call fcn.00413640
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x3570]
call fcn.00414b20
add esp, 4
push str.__Info__team5_log_copy_24_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0xe1
lea ecx, [ebp - 0x3540]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x3570]
mov byte [ebp - 4], 0xe3
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3540]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
mov ecx, str._c_copy__ProgramData_Task_sonarError.log_sonarError.log
call fcn.00402330
mov ecx, str._c_copy__ProgramData_Task_sonar.log_sonar.log
call fcn.00402330
inc dword [0x49fa10]
push 0x3e8
call edi
cmp byte [0x4a1227], 0
je 0x410d17
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x3528]
call fcn.00414b20
add esp, 4
push str.__Info__ok.txt____record.log
mov edx, eax
mov byte [ebp - 4], 0xe4
lea ecx, [ebp - 0x3558]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x3528]
mov byte [ebp - 4], 0xe6
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3558]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x35f4]
call fcn.00414b20
add esp, 0x1c
push str.__Info__ok.txt____OK.txt
mov edx, eax
mov byte [ebp - 4], 0xe7
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x35f4]
mov byte [ebp - 4], 0xe9
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
mov ecx, str._c_copy_OK.txt_C:TempissduOK.txt
call fcn.00402330
push 0x3e8
call edi
lea ecx, [ebp - 0x3528]
call fcn.00413640
lea ecx, [ebp - 0x3558]
mov byte [ebp - 4], 0xe3
call fcn.00413640
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x38f0]
call fcn.00414b20
add esp, 4
push str.__Info__Checking_25_25_____record.log
mov edx, eax
mov byte [ebp - 4], 0xea
lea ecx, [ebp - 0x3510]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x38f0]
mov byte [ebp - 4], 0xec
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3510]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
lea ecx, [ebp - 0x34f0]
push str.OS.log
call fcn.00413710
push str.file_windows.csv.log
lea ecx, [ebp - 0x34d8]
mov byte [ebp - 4], 0xed
call fcn.00413710
push str.GPO.log
lea ecx, [ebp - 0x34c0]
mov byte [ebp - 4], 0xee
call fcn.00413710
push str.GPOSec.log
lea ecx, [ebp - 0x34a8]
mov byte [ebp - 4], 0xef
call fcn.00413710
push str.IP.log
lea ecx, [ebp - 0x3490]
mov byte [ebp - 4], 0xf0
call fcn.00413710
push str.Antivirus.log
lea ecx, [ebp - 0x3478]
mov byte [ebp - 4], 0xf1
call fcn.00413710
push str.AntivirusAll.log
lea ecx, [ebp - 0x3460]
mov byte [ebp - 4], 0xf2
call fcn.00413710
push str.autoruns_csv.log
lea ecx, [ebp - 0x3448]
mov byte [ebp - 4], 0xf3
call fcn.00413710
push str.ProductVer.log
lea ecx, [ebp - 0x3430]
mov byte [ebp - 4], 0xf4
call fcn.00413710
push str.Product.log
lea ecx, [ebp - 0x3418]
mov byte [ebp - 4], 0xf5
call fcn.00413710
push str.ProductVer_log.log
lea ecx, [ebp - 0x3400]
mov byte [ebp - 4], 0xf6
call fcn.00413710
mov byte [ebp - 4], 0xf7
push str.HotFix.log
lea ecx, [ebp - 0x33e8]
call fcn.00413710
push str.listdlls.log
lea ecx, [ebp - 0x33d0]
mov byte [ebp - 4], 0xf8
call fcn.00413710
push str.pslist.log
lea ecx, [ebp - 0x33b8]
mov byte [ebp - 4], 0xf9
call fcn.00413710
push str.handle.log
lea ecx, [ebp - 0x33a0]
mov byte [ebp - 4], 0xfa
call fcn.00413710
push 0x4950e0
mov edx, 0x49fbac
mov byte [ebp - 4], 0xfb
lea ecx, [ebp - 0x3558]
call fcn.00414c30
add esp, 4
push 0x4a1230
mov edx, eax
mov byte [ebp - 4], 0xfc
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
push str..xml.log
mov edx, eax
mov byte [ebp - 4], 0xfd
lea ecx, [ebp - 0x3388]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x3528]
call fcn.00413640
lea ecx, [ebp - 0x3558]
mov dword [ebp - 4], 0x100
call fcn.00413640
push str.dnsCache.log
lea ecx, [ebp - 0x3370]
call fcn.00413710
push str.netstat.log
lea ecx, [ebp - 0x3358]
mov byte [ebp - 4], 1
call fcn.00413710
push str.whoami.log
lea ecx, [ebp - 0x3340]
mov byte [ebp - 4], 2
call fcn.00413710
push str.hosts.log
lea ecx, [ebp - 0x3328]
mov byte [ebp - 4], 3
call fcn.00413710
push str.cmdHistory.log
lea ecx, [ebp - 0x3310]
mov byte [ebp - 4], 4
call fcn.00413710
push str.arpCache.log
lea ecx, [ebp - 0x32f8]
mov byte [ebp - 4], 5
call fcn.00413710
push str.schtasks.log
lea ecx, [ebp - 0x32e0]
mov byte [ebp - 4], 6
call fcn.00413710
mov byte [ebp - 4], 7
push str.ctc.log
lea ecx, [ebp - 0x32c8]
call fcn.00413710
push str.sonarError.log
lea ecx, [ebp - 0x32b0]
mov byte [ebp - 4], 8
call fcn.00413710
push str.sonar.log
lea ecx, [ebp - 0x3298]
mov byte [ebp - 4], 9
call fcn.00413710
push str.x86Product.log
lea ecx, [ebp - 0x3280]
mov byte [ebp - 4], 0xa
call fcn.00413710
push str.x64Product.log
lea ecx, [ebp - 0x3268]
mov byte [ebp - 4], 0xb
call fcn.00413710
push str.Secevent.evtx
lea ecx, [ebp - 0x3250]
mov byte [ebp - 4], 0xc
call fcn.00413710
push str.Sysevent.evtx
lea ecx, [ebp - 0x3238]
mov byte [ebp - 4], 0xd
call fcn.00413710
mov ecx, str._c_del__f__q_ProductPath.log
mov dword [ebp - 4], 0x10e
call fcn.00402330
lea esi, [ebp - 0x34f0]
mov edi, 0x1e
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x35f4]
call fcn.00414b20
add esp, 4
push str.__Warn__Not_Found
mov edx, eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x3570]
call fcn.00414b80
add esp, 4
push esi
mov edx, eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x3558]
call fcn.00414cb0
add esp, 4
push 0x495054
mov edx, eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x3558]
call fcn.00413640
lea ecx, [ebp - 0x3570]
call fcn.00413640
lea ecx, [ebp - 0x35f4]
mov byte [ebp - 4], 0x15
call fcn.00413640
mov ecx, esi
call fcn.004135d0
mov edx, eax
lea ecx, [ebp - 0x58]
call fcn.00415250
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.0045be4a
add esp, 8
cmp eax, 0xffffffff
jne 0x4110fe
sub esp, 0x18
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
lea ecx, [ebp - 0x3528]
mov byte [ebp - 4], 0xe
call fcn.00413640
add esi, 0x18
sub edi, 1
jne 0x411038
inc dword [0x49fa10]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call edi
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x3528]
call fcn.00414b20
add esp, 4
push str.__Info__Archive____record.log
mov edx, eax
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x35f4]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x3528]
mov byte [ebp - 4], 0x18
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x35f4]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
call fcn.004043a0
push 0xbb8
call edi
push 0x49fbac
mov edx, str.C:Tempissdu_
lea ecx, [ebp - 0x38c0]
call fcn.00414b20
add esp, 4
push 0x4950e0
mov edx, eax
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x38a8]
call fcn.00414b80
add esp, 4
push 0x4a1230
mov edx, eax
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x3890]
call fcn.00414b80
add esp, 4
push 0x4950e0
mov edx, eax
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x3570]
call fcn.00414b80
add esp, 4
push 0x4a1240
mov edx, eax
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x3558]
call fcn.00414b80
add esp, 4
push str..zip
mov edx, eax
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x3784]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x3558]
call fcn.00413640
lea ecx, [ebp - 0x3570]
call fcn.00413640
lea ecx, [ebp - 0x3890]
call fcn.00413640
lea ecx, [ebp - 0x38a8]
call fcn.00413640
lea ecx, [ebp - 0x38c0]
mov byte [ebp - 4], 0x23
call fcn.00413640
push ecx
mov edx, 0x49fa44
lea ecx, [ebp - 0x3920]
call fcn.00414d60
add esp, 4
push 0x4950e0
mov edx, eax
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x3938]
call fcn.00414b80
add esp, 4
push 0x4a1230
mov edx, eax
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x3950]
call fcn.00414b80
add esp, 4
push 0x4950e0
mov edx, eax
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x3968]
call fcn.00414b80
add esp, 4
push 0x4a1240
mov edx, eax
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x3908]
call fcn.00414b80
add esp, 4
push str..zip
mov edx, eax
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x379c]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x3908]
call fcn.00413640
lea ecx, [ebp - 0x3968]
call fcn.00413640
lea ecx, [ebp - 0x3950]
call fcn.00413640
lea ecx, [ebp - 0x3938]
call fcn.00413640
lea ecx, [ebp - 0x3920]
mov byte [ebp - 4], 0x2e
call fcn.00413640
lea ecx, [ebp - 0x3784]
call fcn.004135d0
mov edx, eax
lea ecx, [ebp - 0x1d8]
call fcn.00415260
push 0xbb8
call edi
mov ecx, str._a__c_chcp_65001__dir__b_.zip___ziplog.txt
call fcn.00402330
call fcn.004024b0
lea eax, [ebp - 0x1d8]
push 0
push eax
call fcn.0045be4a
add esp, 8
push 0x49faec
lea ecx, [ebp - 0x35b8]
mov edx, 0x494e24
cmp eax, 0xffffffff
je 0x411489
call fcn.00414b20
add esp, 4
push str.__Info__Zip_exist_in_C:Tempissdu_
mov edx, eax
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x38d8]
call fcn.00414b80
add esp, 4
push 0x49fbac
mov edx, eax
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x3570]
call fcn.00414cb0
add esp, 4
push 0x4950e0
mov edx, eax
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x3558]
call fcn.00414b80
add esp, 4
push 0x4a1230
mov edx, eax
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x3890]
call fcn.00414b80
add esp, 4
push 0x4950e0
mov edx, eax
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x38a8]
call fcn.00414b80
add esp, 4
push 0x4a1240
mov edx, eax
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x38c0]
call fcn.00414b80
add esp, 4
push str..zip____record.log
mov edx, eax
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x38c0]
call fcn.00413640
lea ecx, [ebp - 0x38a8]
call fcn.00413640
lea ecx, [ebp - 0x3890]
call fcn.00413640
lea ecx, [ebp - 0x3558]
call fcn.00413640
lea ecx, [ebp - 0x3570]
call fcn.00413640
lea ecx, [ebp - 0x38d8]
call fcn.00413640
mov byte [ebp - 4], 0x3d
jmp 0x4114ae
call fcn.00414b20
add esp, 4
push str.__Warn__Zip_not_exist_in_C:Tempissdu____record.log
mov edx, eax
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x35b8]
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x3528]
call fcn.00413640
lea ecx, [ebp - 0x379c]
call fcn.004135d0
mov edx, eax
lea ecx, [ebp - 0x1d8]
call fcn.00415260
call fcn.004024b0
lea eax, [ebp - 0x1d8]
push 0
push eax
call fcn.0045be4a
add esp, 8
mov edx, 0x494e24
push 0x49faec
cmp eax, 0xffffffff
je 0x41164b
lea ecx, [ebp - 0x30]
call fcn.00414b20
add esp, 4
push str.__Info__Zip_exist_in
mov edx, eax
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x3570]
call fcn.00414b80
add esp, 4
push 0x49fa44
mov edx, eax
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x3558]
call fcn.00414cb0
add esp, 4
push 0x49fbac
mov edx, eax
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x3890]
call fcn.00414cb0
add esp, 4
push 0x4950e0
mov edx, eax
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x38a8]
call fcn.00414b80
add esp, 4
push 0x4a1230
mov edx, eax
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x38c0]
call fcn.00414b80
add esp, 4
push 0x4950e0
mov edx, eax
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0x38d8]
call fcn.00414b80
add esp, 4
push 0x4a1240
mov edx, eax
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x35b8]
call fcn.00414b80
add esp, 4
push str..zip____record.log
mov edx, eax
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x35b8]
call fcn.00413640
lea ecx, [ebp - 0x38d8]
call fcn.00413640
lea ecx, [ebp - 0x38c0]
call fcn.00413640
lea ecx, [ebp - 0x38a8]
call fcn.00413640
lea ecx, [ebp - 0x3890]
call fcn.00413640
lea ecx, [ebp - 0x3558]
call fcn.00413640
lea ecx, [ebp - 0x3570]
call fcn.00413640
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x30]
jmp 0x4116be
lea ecx, [ebp - 0x38d8]
call fcn.00414b20
add esp, 4
push str.__Warn__Zip_not_exist_in
mov edx, eax
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0x35b8]
call fcn.00414b80
add esp, 4
push 0x49fa44
mov edx, eax
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0x30]
call fcn.00414cb0
add esp, 4
push 0x495054
mov edx, eax
mov byte [ebp - 4], 0x54
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x30]
call fcn.00413640
lea ecx, [ebp - 0x35b8]
call fcn.00413640
mov byte [ebp - 4], 0x58
lea ecx, [ebp - 0x38d8]
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x3528]
call fcn.00413640
inc dword [0x49fa10]
push 0x3e8
call edi
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x30]
call fcn.00414b20
add esp, 4
push str.__Info__Upload____record.log
mov edx, eax
mov byte [ebp - 4], 0x59
lea ecx, [ebp - 0x3570]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x5b
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3570]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
cmp byte [0x4a1254], 0
jne 0x4117c8
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x35b8]
call fcn.00414b20
add esp, 4
push str.__Warn__Upload_to_Localhost____record.log
mov edx, eax
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x35b8]
mov byte [ebp - 4], 0x5e
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
add esp, 0x18
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0x3528]
call fcn.00413640
jmp 0x411805
cmp byte [0x4a125b], 0
je 0x4117db
call fcn.00407310
call fcn.004043a0
cmp byte [0x4a1251], 0
je 0x4117e9
call fcn.00408c80
cmp byte [0x4a1226], 0
je 0x4117f7
call fcn.0040a440
cmp byte [0x4a125d], 0
je 0x411805
call fcn.0040c3d0
inc dword [0x49fa10]
push 0x3e8
call edi
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x35b8]
call fcn.00414b20
add esp, 4
push str.__Info__Cleanup____record.log
mov edx, eax
mov byte [ebp - 4], 0x5f
lea ecx, [ebp - 0x3558]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x35b8]
mov byte [ebp - 4], 0x61
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3558]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
mov ecx, str._c_taskkill__f__im_DSWAgent.exe
call fcn.00402330
mov ecx, str._c_reg_DELETE_HKCUSoftwareSysinternals__f
call fcn.00402330
call fcn.004052c0
call fcn.004024b0
push 0x49faec
mov edx, 0x494e24
lea ecx, [ebp - 0x30]
call fcn.00414b20
add esp, 0x1c
push str.__Info__Finish____record.log
mov edx, eax
mov byte [ebp - 4], 0x62
lea ecx, [ebp - 0x3528]
call fcn.00414b80
add esp, 4
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x64
call fcn.00413640
sub esp, 0x18
lea eax, [ebp - 0x3528]
mov ecx, esp
push eax
call fcn.00413770
call fcn.00402520
inc dword [0x49fa10]
lea ecx, [ebp - 0x3528]
add esp, 0x18
call fcn.00413640
lea ecx, [ebp - 0x3558]
call fcn.00413640
lea ecx, [ebp - 0x3570]
call fcn.00413640
lea ecx, [ebp - 0x379c]
call fcn.00413640
lea ecx, [ebp - 0x3784]
call fcn.00413640
lea ecx, [ebp - 0x35f4]
call fcn.00413640
push fcn.00413640
push 0x1e
push 0x18
lea eax, [ebp - 0x34f0]
mov dword [ebp - 4], 0xec
push eax
call fcn.00455fd4
lea ecx, [ebp - 0x3510]
call fcn.00413640
lea ecx, [ebp - 0x3540]
call fcn.00413640
lea ecx, [ebp - 0x35a0]
call fcn.00413640
lea ecx, [ebp - 0x370c]
call fcn.00413640
lea ecx, [ebp - 0x366c]
call fcn.00413640
lea ecx, [ebp - 0x3684]
call fcn.00413640
lea ecx, [ebp - 0x363c]
call fcn.00413640
lea ecx, [ebp - 0x35dc]
call fcn.00413640
lea ecx, [ebp - 0x36c0]
call fcn.00413640
lea ecx, [ebp - 0x3588]
call fcn.00413640
lea ecx, [ebp - 0x376c]
call fcn.00413410
lea ecx, [ebp - 0x3754]
call fcn.00413410
lea ecx, [ebp - 0x373c]
call fcn.00413410
lea ecx, [ebp - 0x37b4]
call fcn.00413410
lea ecx, [ebp - 0x3654]
call fcn.00413640
lea ecx, [ebp - 0x3624]
call fcn.00413640
lea ecx, [ebp - 0x369c]
call fcn.00413640
lea ecx, [ebp - 0x360c]
call fcn.00413640
lea ecx, [ebp - 0x36f0]
call fcn.00413640
lea ecx, [ebp - 0x3724]
call fcn.00413640
lea ecx, [ebp - 0x36d8]
call fcn.00413640
lea ecx, [ebp - 0x3870]
call fcn.004038f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00455ecc
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00401470
call fcn.0045dfa8
call fcn.0045dfa8
call fcn.00401470
call fcn.0045dfa8
call fcn.00401470
call fcn.0045dfa8
call fcn.00401470
call fcn.0045dfa8
call fcn.00401470
call fcn.0045dfa8
call fcn.00401470
call fcn.0045dfa8
call fcn.0045dfa8
call fcn.0045dfa8
call fcn.0045dfa8
call fcn.0045dfa8
call fcn.0045dfa8
call fcn.00401470
call fcn.00401470
call fcn.0045dfa8
call fcn.0045dfa8
call fcn.0045dfa8
call fcn.0045dfa8
call fcn.00401470
call fcn.0045dfa8
call fcn.0045dfa8
call fcn.00401470
call fcn.0045dfa8
call fcn.0045dfa8
call fcn.00401470
call fcn.00401470
call fcn.0045dfa8
call fcn.0045dfa8
call fcn.0045dfa8
call fcn.0045dfa8
call fcn.0045dfa8
call fcn.00401470
int3