Function at 0x40bbe0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483730
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x3fe0
call fcn.0047bda0
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
push 0x549234
push 9
mov dword [ebp - 4], ebx
push eax
mov dword [ebp - 0x14], ecx
mov dword [0x57cd58], ebx
mov dword [0x57cd5c], ebx
mov byte [ebp - 4], 1
mov byte [0x563924], bl
call fcn.0041b4a0
cmp eax, ebx
mov dword [0x57cd58], eax
je 0x40c11c
cmp eax, 1
jle 0x40bc92
mov eax, dword [0x549238]
cmp byte [eax], 0
je 0x40bc92
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
xor esi, esi
cmp esi, 2
jge 0x40bc86
mov ecx, esi
shl ecx, 6
add ecx, str.SetValue
push ecx
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40bc92
inc esi
jmp 0x40bc61
cmp dword [0x57cd5c], ebx
je 0x40c11c
mov edx, dword [0x549234]
push 0x563924
push edx
mov dword [0x54d928], ebx
mov dword [0x4df5e4], ebx
mov dword [0x540f64], ebx
mov dword [0x4ca378], ebx
mov dword [0x54bf5c], ebx
mov dword [0x52d51c], ebx
mov dword [0x50be18], ebx
mov dword [0x4e02a8], ebx
mov dword [0x5193a0], ebx
mov dword [0x5490b0], ebx
mov dword [0x54d92c], ebx
mov dword [0x50c364], ebx
mov dword [0x54d9b0], ebx
mov dword [0x54ea80], ebx
mov dword [0x50d82c], ebx
mov dword [0x50c220], ebx
mov dword [0x519f10], ebx
mov dword [0x52f520], ebx
mov dword [0x54e178], ebx
mov dword [0x510e4c], ebx
mov dword [0x517418], ebx
mov dword [0x54ab84], ebx
mov dword [0x57cc28], ebx
mov dword [0x4df450], ebx
mov dword [0x4a2fe0], ebx
mov dword [0x54fe58], ebx
mov dword [0x4cd884], ebx
mov dword [0x54ed08], ebx
mov dword [0x4ca22c], ebx
mov dword [0x5195a4], ebx
mov dword [0x50fa48], ebx
mov dword [0x54bf60], ebx
mov dword [0x54f98c], ebx
mov dword [0x50d828], ebx
mov dword [0x5615e0], ebx
mov dword [0x54e7fc], ebx
mov dword [0x52d1d8], ebx
mov dword [0x54fe5c], ebx
mov dword [0x4a2fe4], ebx
mov dword [0x513010], ebx
mov dword [0x51acd4], ebx
mov dword [0x54ab88], ebx
mov dword [0x57ce10], ebx
mov dword [0x4f1e14], ebx
mov dword [0x563f24], ebx
mov dword [0x4dec88], ebx
mov dword [0x4e192c], ebx
mov dword [0x4a3b68], ebx
mov dword [0x4ca230], ebx
mov dword [0x54b7d0], ebx
mov dword [0x50be1c], ebx
mov dword [0x545c68], ebx
mov dword [0x51931c], ebx
mov dword [0x54a080], ebx
mov dword [0x54fc50], ebx
mov dword [0x54be58], ebx
mov dword [0x4df40c], ebx
mov dword [0x57cd84], ebx
mov dword [0x57cd88], ebx
mov dword [0x54d9b4], ebx
mov dword [0x5468ac], ebx
mov dword [0x4e1930], ebx
mov dword [0x57cd6c], ebx
mov dword [0x57cd68], ebx
mov dword [0x57ce34], ebx
mov dword [0x57cfcc], ebx
mov dword [0x57ce74], ebx
mov dword [0x57ce78], ebx
mov dword [0x57ce7c], ebx
mov dword [0x57cd5c], ebx
mov byte [0x563924], 0
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jl 0x40c11c
push str.sigcheck.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regservice.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push 0x494880
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.procCheck.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.procservice.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push 0x561be4
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40bf25
mov dword [0x57cd64], 1
jmp 0x40bf56
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
mov dword [0x57cd64], ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [0x57cd60], ebx
mov eax, ecx
mov esi, edi
mov edi, 0x561be4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x54923c]
push 0x563924
push ecx
mov byte [0x563924], 0
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x51b1d8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x563924
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jl 0x40c11c
cmp dword [0x57cc40], 1
jne 0x40c0c3
mov eax, dword [0x549244]
push 0x563924
push eax
mov byte [0x512290], 0
mov byte [0x563924], 0
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
push 0x491638
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x512290
mov edx, ecx
mov esi, edi
mov edi, 0x512290
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x40c11c
push 0x49484c
push 0x512290
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x40c11c
push 0x494848
push 0x512290
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x40c11c
push 0x491638
push 0x512290
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x40c11c
push str.mysql
push 0x512290
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x40c11c
push str.mysqld
push 0x512290
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x40c11c
push str.MySQL
push 0x512290
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x40c11c
push 0x494828
push 0x512290
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x40c11c
push 0x54abcc
push 0x51b1d8
mov dword [0x54ea84], ebx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c131
mov eax, dword [0x57cca0]
inc eax
cmp eax, 0x2bc
mov dword [0x57cca0], eax
jne 0x40c11c
mov edi, str.NULL
or ecx, 0xffffffff
xor eax, eax
mov dword [0x57cca0], ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x54abcc
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, 0x51b1d8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x54abcc
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x51b1d8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x50a818
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x14]
lea ebx, [ecx + 0x20204]
mov byte [ebx], 0
mov esi, dword [0x57cca4]
cmp esi, dword [0x48bb7c]
jle 0x40c36d
mov edi, 0x51b3d8
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jle 0x40c365
mov eax, dword [0x48bb7c]
mov edi, dword [0x57cd80]
add eax, 2
add edi, esi
push 0x51b3d8
mov dword [0x48bb7c], eax
mov dword [0x57cd80], edi
call fcn.00432070
add esp, 4
mov edi, eax
mov dword [0x57cca4], 0
push 0x54a104
push 0x54bf64
push 0x49480c
push ebx
call fcn.0047a8f8
add esp, 0x10
mov esi, 1
cmp edi, esi
push 0x51b3d8
jne 0x40c23a
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4947b0
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
add esp, 0xc
mov dword [0x57ccd0], 0
jmp 0x40c264
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x494754
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
add esp, 0xc
mov dword [0x57ccd0], esi
push 0x48ba7c
push 0x51b3d8
mov dword [0x54ea84], esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c286
mov dword [0x57cc60], esi
push str.ctfmon.exe
push 0x51b3d8
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c2a2
mov dword [0x57cc70], esi
push str.rundll32.exe
push 0x51b3d8
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c2be
mov dword [0x57cc74], esi
push str.winlogon.exe
push 0x51b3d8
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c2da
mov dword [0x57cc64], esi
push str.services.exe
push 0x51b3d8
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c2f6
mov dword [0x57cc6c], esi
push str.svchost.exe
push 0x51b3d8
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c312
mov dword [0x57cc78], esi
mov eax, dword [0x57cc60]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc70]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc74]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc64]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc6c]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc78]
test eax, eax
jne 0x41650d
jmp 0x40c544
mov dword [0x57cca4], edx
jmp 0x40c36f
xor edx, edx
mov esi, dword [0x57ccb4]
mov eax, dword [0x48bb88]
cmp esi, eax
jle 0x40c600
mov edi, 0x54bdd8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jle 0x40c5fa
mov ecx, dword [0x48bb88]
mov eax, dword [0x57cd80]
push 0x54a104
push 0x54bf64
add ecx, 2
add eax, esi
push 0x49480c
push ebx
mov dword [0x48bb88], ecx
mov dword [0x57cd80], eax
mov dword [0x57ccb4], 0
call fcn.0047a8f8
push 0x48ba7c
push 0x54bdd8
call fcn.0047fde0
add esp, 0x18
mov esi, 1
test eax, eax
jne 0x40c3f4
mov dword [0x57cc60], esi
push str.ctfmon.exe
push 0x54bdd8
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c410
mov dword [0x57cc70], esi
push str.rundll32.exe
push 0x54bdd8
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c42c
mov dword [0x57cc74], esi
push str.winlogon.exe
push 0x54bdd8
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c448
mov dword [0x57cc64], esi
push str.services.exe
push 0x54bdd8
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c464
mov dword [0x57cc6c], esi
push str.svchost.exe
push 0x54bdd8
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c480
mov dword [0x57cc78], esi
mov eax, dword [0x57cc60]
mov dword [0x54ea84], esi
test eax, eax
jne 0x40c5b3
mov eax, dword [0x57cc70]
test eax, eax
jne 0x40c5b3
mov eax, dword [0x57cc74]
test eax, eax
jne 0x40c5b3
mov eax, dword [0x57cc64]
test eax, eax
jne 0x40c5b3
mov eax, dword [0x57cc6c]
test eax, eax
jne 0x40c5b3
mov eax, dword [0x57cc78]
test eax, eax
jne 0x40c5b3
push 0x54bdd8
call fcn.00432070
add esp, 4
cmp eax, esi
push 0x54bdd8
jne 0x40c51a
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4946ec
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
add esp, 0xc
mov dword [0x57cce0], 0
jmp 0x40c544
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x494690
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
add esp, 0xc
mov dword [0x57cce0], esi
mov edx, dword [0x57cfec]
mov edi, 0x51a194
mov ebx, edx
or ecx, 0xffffffff
shl ebx, 6
xor eax, eax
add ebx, 0x54e57c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [0x57cfe8], 1
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0xa
mov dword [0x57cfec], edx
rep movsb byte es:[edi], byte [esi]
jne 0x41650d
mov dword [0x57cfec], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x54bdd8
push 0x494640
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
add esp, 0xc
mov dword [0x57cce0], esi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [0x57ccb4], edx
mov esi, dword [0x57cca8]
cmp esi, 0xf
jle 0x40c827
mov edi, 0x54fd54
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jle 0x40c821
mov edi, dword [0x57cd80]
push 0x54fd54
add edi, esi
mov dword [0x57cd80], edi
call fcn.00432070
add esp, 4
mov edi, eax
mov dword [0x57cca8], 0
push 0x54a104
push 0x54bf64
push 0x49480c
push ebx
call fcn.0047a8f8
add esp, 0x10
mov esi, 1
cmp edi, esi
push 0x54fd54
jne 0x40c6a3
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4945ec
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
add esp, 0xc
mov dword [0x57ccd4], 0
jmp 0x40c6cd
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x494594
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
add esp, 0xc
mov dword [0x57ccd4], esi
push str.ctfmon.exe
push 0x54fd54
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c6e9
mov dword [0x57cc70], esi
push str.rundll32.exe
push 0x54fd54
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c705
mov dword [0x57cc74], esi
push str.svchost.exe
push 0x54fd54
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c721
mov dword [0x57cc78], esi
push str.winlogon.exe
push 0x54fd54
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c73d
mov dword [0x57cc64], esi
push str.services.exe
push 0x54fd54
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c759
mov dword [0x57cc6c], esi
push str.svchost.exe
push 0x54fd54
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c775
mov dword [0x57cc78], esi
mov eax, dword [0x57cc60]
mov dword [0x54ea84], esi
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc70]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc74]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc64]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc6c]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc78]
test eax, eax
jne 0x41650d
mov edx, dword [0x57cf38]
mov edi, 0x54fd54
mov ebx, edx
or ecx, 0xffffffff
shl ebx, 6
xor eax, eax
add ebx, 0x4df18c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
mov ebx, 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [0x57cf34], ebx
and ecx, 3
inc edx
cmp edx, 0xa
mov dword [0x57cf38], edx
rep movsb byte es:[edi], byte [esi]
jne 0x41650d
mov edi, 0x54fd54
jmp 0x40eba9
mov dword [0x57cca8], edx
mov esi, dword [0x57ccb0]
mov eax, dword [0x48bb84]
cmp esi, eax
jle 0x40ca64
mov edi, 0x540f68
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jle 0x40ca5e
mov eax, dword [0x48bb84]
mov edi, dword [0x57cd80]
add eax, 2
add edi, esi
push 0x540f68
mov dword [0x48bb84], eax
mov dword [0x57cd80], edi
call fcn.00432070
add esp, 4
mov edi, eax
mov dword [0x57ccb0], 0
push 0x54a104
push 0x54bf64
push 0x49480c
push ebx
call fcn.0047a8f8
add esp, 0x10
mov esi, 1
cmp edi, esi
push 0x540f68
push 0x540f68
jne 0x40c8e0
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x494524
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x14]
not ecx
dec ecx
lea ecx, [ecx + eax + 0x20204]
push ecx
call fcn.0047a8f8
add esp, 0x10
mov dword [0x57ccdc], 0
jmp 0x40c90a
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4944b0
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
add esp, 0x10
mov dword [0x57ccdc], esi
push 0x48ba7c
push 0x540f68
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c926
mov dword [0x57cc60], esi
push str.ctfmon.exe
push 0x540f68
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c942
mov dword [0x57cc70], esi
push str.rundll32.exe
push 0x540f68
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c95e
mov dword [0x57cc74], esi
push str.winlogon.exe
push 0x540f68
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c97a
mov dword [0x57cc64], esi
push str.services.exe
push 0x540f68
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c996
mov dword [0x57cc6c], esi
push str.svchost.exe
push 0x540f68
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c9b2
mov dword [0x57cc78], esi
mov eax, dword [0x57cc60]
mov dword [0x54ea84], esi
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc70]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc74]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc64]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc6c]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc78]
test eax, eax
jne 0x41650d
mov edx, dword [0x57cf38]
mov edi, 0x540f68
mov ebx, edx
or ecx, 0xffffffff
shl ebx, 6
xor eax, eax
add ebx, 0x4df18c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
mov ebx, 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [0x57cf34], ebx
and ecx, 3
inc edx
cmp edx, 0xa
mov dword [0x57cf38], edx
rep movsb byte es:[edi], byte [esi]
jne 0x41650d
mov edi, 0x540f68
jmp 0x40eba9
mov dword [0x57ccb0], edx
mov eax, dword [0x57ccac]
mov ecx, dword [0x48bb80]
cmp eax, ecx
jle 0x40cc65
mov edi, 0x4dec8c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jle 0x40cc5f
mov edi, dword [0x48bb80]
mov ecx, dword [0x57ccac]
mov esi, dword [0x57cd80]
add edi, 2
add esi, ecx
push 0x4dec8c
mov dword [0x48bb80], edi
mov dword [0x57cd80], esi
call fcn.00432070
add esp, 4
mov edi, eax
mov dword [0x57ccac], 0
push 0x54a104
push 0x54bf64
push 0x49480c
push ebx
call fcn.0047a8f8
add esp, 0x10
mov esi, 1
cmp edi, esi
push 0x4dec8c
jne 0x40caf7
push 0x494450
jmp 0x40cafc
push 0x4943f0
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
add esp, 0xc
mov dword [0x57ccd8], esi
mov dword [0x57cc60], esi
push str.ctfmon.exe
push 0x4dec8c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40cb43
mov dword [0x57cc70], esi
push str.rundll32.exe
push 0x4dec8c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40cb5f
mov dword [0x57cc74], esi
push str.winlogon.exe
push 0x4dec8c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40cb7b
mov dword [0x57cc64], esi
push str.services.exe
push 0x4dec8c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40cb97
mov dword [0x57cc6c], esi
push str.svchost.exe
push 0x4dec8c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40cbb3
mov dword [0x57cc78], esi
mov eax, dword [0x57cc60]
mov dword [0x54ea84], esi
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc70]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc74]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc64]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc6c]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc78]
test eax, eax
jne 0x41650d
mov edx, dword [0x57cf38]
mov edi, 0x4dec8c
mov ebx, edx
or ecx, 0xffffffff
shl ebx, 6
xor eax, eax
add ebx, 0x4df18c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
mov ebx, 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [0x57cf34], ebx
and ecx, 3
inc edx
cmp edx, 0xa
mov dword [0x57cf38], edx
rep movsb byte es:[edi], byte [esi]
jne 0x41650d
mov edi, 0x4dec8c
jmp 0x40eba9
mov dword [0x57ccac], edx
mov esi, dword [0x57ccb8]
mov eax, dword [0x48bb8c]
cmp esi, eax
jle 0x40cf97
mov edi, 0x4a2e60
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jle 0x40cf91
mov ecx, dword [0x57cd80]
mov edx, dword [0x48bb8c]
add ecx, esi
mov edi, 0x4a2e60
mov dword [0x57cd80], ecx
or ecx, 0xffffffff
add edx, 2
push str.svchost.exe
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [0x48bb8c], edx
lea edx, [ebp - 0x330]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x4a2e60
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40cd55
lea ecx, [ebp - 0x50]
xor esi, esi
push ecx
mov dword [ebp - 0x50], esi
call fcn.00469510
add esp, 4
push 0x54a104
push 0x54bf64
push 0x49480c
push ebx
call fcn.0047a8f8
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x50]
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x14]
push edx
not ecx
dec ecx
push str.svchost.exe
push 0x494390
lea ecx, [ecx + eax + 0x20204]
push ecx
call fcn.0047a8f8
mov dword [0x57ccb8], esi
add esp, 0x20
mov dword [0x57cce4], 1
mov esi, 1
jmp 0x40cdd5
lea edx, [ebp - 0x330]
push edx
push 0x4a2e60
call fcn.00432730
add esp, 8
mov edi, eax
mov dword [0x57ccb8], 0
push 0x54a104
push 0x54bf64
push 0x49480c
push ebx
call fcn.0047a8f8
mov esi, 1
add esp, 0x10
cmp edi, esi
jne 0x40cda4
lea eax, [ebp - 0x330]
push eax
push 0x494338
jmp 0x40cdb0
lea ecx, [ebp - 0x330]
push ecx
push 0x4942e0
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
add esp, 0xc
mov dword [0x57cce4], esi
lea ecx, [ebp - 0x330]
push 0x48ba7c
push ecx
mov dword [0x54ea84], esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40cdf9
mov dword [0x57cc60], esi
lea edx, [ebp - 0x330]
push str.ctfmon.exe
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40ce17
mov dword [0x57cc70], esi
lea eax, [ebp - 0x330]
push str.conime.exe
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40ce35
mov dword [0x57cc7c], esi
lea ecx, [ebp - 0x330]
push str.rundll32.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40ce53
mov dword [0x57cc74], esi
lea edx, [ebp - 0x330]
push str.winlogon.exe
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40ce71
mov dword [0x57cc64], esi
lea eax, [ebp - 0x330]
push str.csrss.exe
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40ce8f
mov dword [0x57cc80], esi
lea ecx, [ebp - 0x330]
push str.lsass.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40cead
mov dword [0x57cc84], esi
lea edx, [ebp - 0x330]
push str.services.exe
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40cecb
mov dword [0x57cc6c], esi
lea eax, [ebp - 0x330]
push str.svchost.exe
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40cee9
mov dword [0x57cc78], esi
mov eax, dword [0x57cc60]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc70]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc74]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc64]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc6c]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc78]
test eax, eax
jne 0x41650d
mov edx, dword [0x57cf38]
lea edi, [ebp - 0x330]
mov ebx, edx
or ecx, 0xffffffff
shl ebx, 6
xor eax, eax
add ebx, 0x4df18c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
mov ebx, 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [0x57cf34], ebx
and ecx, 3
inc edx
cmp edx, 0xa
mov dword [0x57cf38], edx
rep movsb byte es:[edi], byte [esi]
jne 0x41650d
lea edi, [ebp - 0x330]
jmp 0x40eba9
mov dword [0x57ccb8], edx
mov eax, dword [0x57ccbc]
mov ecx, dword [0x48bb90]
cmp eax, ecx
jle 0x40d1e7
mov edi, 0x50eeb0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jle 0x40d1e1
mov edx, dword [0x48bb90]
push 0x54a104
push 0x54bf64
add edx, 2
xor esi, esi
push 0x49480c
push ebx
mov dword [0x48bb90], edx
mov dword [0x57ccbc], esi
call fcn.0047a8f8
push str.flashget.exe
push 0x50eeb0
call fcn.0047fde0
add esp, 0x18
test eax, eax
push 0x50eeb0
jne 0x40d033
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x494298
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
add esp, 0xc
mov esi, 1
jmp 0x40d0a3
call fcn.00432070
mov dword [0x57ccbc], esi
add esp, 4
mov esi, 1
cmp eax, esi
push 0x50eeb0
jne 0x40d07f
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x494244
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
add esp, 0xc
mov dword [0x57cce8], 0
jmp 0x40d0a9
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4941f0
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
add esp, 0xc
mov dword [0x57cce8], esi
push 0x48ba7c
push 0x50eeb0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40d0c5
mov dword [0x57cc60], esi
push str.ctfmon.exe
push 0x50eeb0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40d0e1
mov dword [0x57cc70], esi
push str.winlogon.exe
push 0x50eeb0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40d0fd
mov dword [0x57cc64], esi
push str.services.exe
push 0x50eeb0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40d119
mov dword [0x57cc6c], esi
push str.svchost.exe
push 0x50eeb0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40d135
mov dword [0x57cc78], esi
mov eax, dword [0x57cc60]
mov dword [0x54ea84], esi
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc70]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc74]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc64]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc6c]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc78]
test eax, eax
jne 0x41650d
mov edx, dword [0x57cf38]
mov edi, 0x50eeb0
mov ebx, edx
or ecx, 0xffffffff
shl ebx, 6
xor eax, eax
add ebx, 0x4df18c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
mov ebx, 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [0x57cf34], ebx
and ecx, 3
inc edx
cmp edx, 0xa
mov dword [0x57cf38], edx
rep movsb byte es:[edi], byte [esi]
jne 0x41650d
mov edi, 0x50eeb0
jmp 0x40eba9
mov dword [0x57ccbc], edx
mov eax, dword [0x57ce58]
mov ecx, dword [0x491408]
cmp eax, ecx
jle 0x40d3e8
mov edi, 0x4a4b6c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jle 0x40d3e2
mov edi, dword [0x491408]
mov ecx, dword [0x57ce50]
mov esi, dword [0x57cd80]
add edi, 2
add esi, ecx
push 0x4a4b6c
mov dword [0x491408], edi
mov dword [0x57cd80], esi
call fcn.00432070
add esp, 4
mov edi, eax
mov dword [0x57ce58], 0
push 0x54a104
push 0x54bf64
push 0x49480c
push ebx
call fcn.0047a8f8
add esp, 0x10
mov esi, 1
cmp edi, esi
push 0x4a4b6c
jne 0x40d27a
push 0x494190
jmp 0x40d27f
push 0x494130
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
add esp, 0xc
mov dword [0x57ce5c], esi
mov dword [0x57cc60], esi
push str.ctfmon.exe
push 0x4a4b6c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40d2c6
mov dword [0x57cc70], esi
push str.rundll32.exe
push 0x4a4b6c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40d2e2
mov dword [0x57cc74], esi
push str.svchost.exe
push 0x4a4b6c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40d2fe
mov dword [0x57cc78], esi
push str.winlogon.exe
push 0x4a4b6c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40d31a
mov dword [0x57cc64], esi
push str.services.exe
push 0x4a4b6c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40d336
mov dword [0x57cc6c], esi
mov eax, dword [0x57cc60]
mov dword [0x54ea84], esi
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc70]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc74]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc64]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc6c]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc78]
test eax, eax
jne 0x41650d
mov edx, dword [0x57cf38]
mov edi, 0x4a4b6c
mov ebx, edx
or ecx, 0xffffffff
shl ebx, 6
xor eax, eax
add ebx, 0x4df18c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
mov ebx, 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [0x57cf34], ebx
and ecx, 3
inc edx
cmp edx, 0xa
mov dword [0x57cf38], edx
rep movsb byte es:[edi], byte [esi]
jne 0x41650d
mov edi, 0x4a4b6c
jmp 0x40eba9
mov dword [0x57ce58], edx
mov esi, dword [0x57ce50]
mov eax, dword [0x491404]
cmp esi, eax
jle 0x40d604
mov edi, 0x50bf20
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jle 0x40d604
mov eax, dword [0x491404]
mov edi, dword [0x57cd80]
add eax, 2
add edi, esi
push 0x50bf20
mov dword [0x491404], eax
mov dword [0x57cd80], edi
call fcn.00432070
add esp, 4
mov edi, eax
mov dword [0x57ce50], 0
push 0x54a104
push 0x54bf64
push 0x49480c
push ebx
call fcn.0047a8f8
add esp, 0x10
mov esi, 1
cmp edi, esi
push 0x50bf20
jne 0x40d49c
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x4940d8
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x14]
not ecx
dec ecx
lea ecx, [ecx + eax + 0x20204]
push ecx
call fcn.0047a8f8
add esp, 0xc
mov dword [0x57ce54], 0
jmp 0x40d4c6
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x49407c
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
add esp, 0xc
mov dword [0x57ce54], esi
push str.ctfmon.exe
push 0x50bf20
mov dword [0x57cc60], esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40d4e8
mov dword [0x57cc70], esi
push str.rundll32.exe
push 0x50bf20
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40d504
mov dword [0x57cc74], esi
push str.winlogon.exe
push 0x50bf20
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40d520
mov dword [0x57cc64], esi
push str.services.exe
push 0x50bf20
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40d53c
mov dword [0x57cc6c], esi
push str.svchost.exe
push 0x50bf20
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40d558
mov dword [0x57cc78], esi
mov eax, dword [0x57cc60]
mov dword [0x54ea84], esi
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc70]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc74]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc64]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc6c]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc78]
test eax, eax
jne 0x41650d
mov edx, dword [0x57cf38]
mov edi, 0x50bf20
mov ebx, edx
or ecx, 0xffffffff
shl ebx, 6
xor eax, eax
add ebx, 0x4df18c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
mov ebx, 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [0x57cf34], ebx
and ecx, 3
inc edx
cmp edx, 0xa
mov dword [0x57cf38], edx
rep movsb byte es:[edi], byte [esi]
jne 0x41650d
mov edi, 0x50bf20
jmp 0x40eba9
mov esi, dword [0x57ccc0]
cmp esi, 0xf
jle 0x40d825
mov edi, 0x52d35c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jle 0x40d825
mov edi, dword [0x57cd80]
push 0x52d35c
add edi, esi
mov dword [0x57cd80], edi
call fcn.00432070
add esp, 4
mov edi, eax
mov dword [0x57ccc0], 0
push 0x54a104
push 0x54bf64
push 0x49480c
push ebx
call fcn.0047a8f8
add esp, 0x10
mov esi, 1
cmp edi, esi
push 0x52d35c
jne 0x40d6a7
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x49401c
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x14]
not ecx
dec ecx
lea ecx, [ecx + eax + 0x20204]
push ecx
call fcn.0047a8f8
add esp, 0xc
mov dword [0x57ccec], 0
jmp 0x40d6d1
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x493fbc
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
add esp, 0xc
mov dword [0x57ccec], esi
push 0x48ba7c
push 0x52d35c
mov dword [0x54ea84], esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40d6f3
mov dword [0x57cc60], esi
push str.ctfmon.exe
push 0x52d35c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40d70f
mov dword [0x57cc70], esi
push str.rundll32.exe
push 0x52d35c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40d72b
mov dword [0x57cc74], esi
push str.winlogon.exe
push 0x52d35c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40d747
mov dword [0x57cc64], esi
push str.services.exe
push 0x52d35c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40d763
mov dword [0x57cc6c], esi
push str.svchost.exe
push 0x52d35c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40d77f
mov dword [0x57cc78], esi
mov eax, dword [0x57cc60]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc70]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc74]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc64]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc6c]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc78]
test eax, eax
jne 0x41650d
mov edx, dword [0x57cf38]
mov edi, 0x52d35c
mov ebx, edx
or ecx, 0xffffffff
shl ebx, 6
xor eax, eax
add ebx, 0x4df18c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
mov ebx, 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [0x57cf34], ebx
and ecx, 3
inc edx
cmp edx, 0xa
mov dword [0x57cf38], edx
rep movsb byte es:[edi], byte [esi]
jne 0x41650d
mov edi, 0x52d35c
jmp 0x40eba9
mov esi, dword [0x57ccc8]
cmp esi, 0x2d
jle 0x40da46
mov edi, 0x54f90c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jle 0x40da46
mov edi, dword [0x57cd80]
push 0x54f90c
add edi, esi
mov dword [0x57cd80], edi
call fcn.00432070
add esp, 4
mov edi, eax
mov dword [0x57ccc8], 0
push 0x54a104
push 0x54bf64
push 0x49480c
push ebx
call fcn.0047a8f8
add esp, 0x10
mov esi, 1
cmp edi, esi
push 0x54f90c
jne 0x40d8c8
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x493f6c
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x14]
not ecx
dec ecx
lea ecx, [ecx + eax + 0x20204]
push ecx
call fcn.0047a8f8
add esp, 0xc
mov dword [0x57ccf0], 0
jmp 0x40d8f2
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x493f18
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
add esp, 0xc
mov dword [0x57ccf0], esi
push 0x48ba7c
push 0x54f90c
mov dword [0x54ea84], esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40d914
mov dword [0x57cc60], esi
push str.ctfmon.exe
push 0x54f90c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40d930
mov dword [0x57cc70], esi
push str.rundll32.exe
push 0x54f90c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40d94c
mov dword [0x57cc74], esi
push str.winlogon.exe
push 0x54f90c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40d968
mov dword [0x57cc64], esi
push str.services.exe
push 0x54f90c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40d984
mov dword [0x57cc6c], esi
push str.svchost.exe
push 0x54f90c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40d9a0
mov dword [0x57cc78], esi
mov eax, dword [0x57cc60]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc70]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc74]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc64]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc6c]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc78]
test eax, eax
jne 0x41650d
mov edx, dword [0x57cf38]
mov edi, 0x54f90c
mov ebx, edx
or ecx, 0xffffffff
shl ebx, 6
xor eax, eax
add ebx, 0x4df18c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
mov ebx, 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [0x57cf34], ebx
and ecx, 3
inc edx
cmp edx, 0xa
mov dword [0x57cf38], edx
rep movsb byte es:[edi], byte [esi]
jne 0x41650d
mov edi, 0x54f90c
jmp 0x40eba9
mov esi, dword [0x57cccc]
cmp esi, 0x28
jle 0x40dc19
mov edi, 0x54ed0c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jle 0x40dc19
mov edx, dword [0x57cd80]
push 0x54a104
push 0x54bf64
add edx, esi
push 0x49480c
push ebx
mov dword [0x57cd80], edx
mov dword [0x57cccc], eax
call fcn.0047a8f8
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x54ed0c
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x14]
push 0x493ebc
not ecx
dec ecx
lea ecx, [ecx + eax + 0x20204]
push ecx
call fcn.0047a8f8
mov esi, 1
push 0x48ba7c
push 0x54ed0c
mov dword [0x57ccf8], esi
mov dword [0x54ea84], esi
call fcn.0047fde0
add esp, 0x24
test eax, eax
jne 0x40dae7
mov dword [0x57cc60], esi
push str.ctfmon.exe
push 0x54ed0c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40db03
mov dword [0x57cc70], esi
push str.rundll32.exe
push 0x54ed0c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40db1f
mov dword [0x57cc74], esi
push str.winlogon.exe
push 0x54ed0c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40db3b
mov dword [0x57cc64], esi
push str.services.exe
push 0x54ed0c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40db57
mov dword [0x57cc6c], esi
push str.svchost.exe
push 0x54ed0c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40db73
mov dword [0x57cc78], esi
mov eax, dword [0x57cc60]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc70]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc74]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc64]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc6c]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc78]
test eax, eax
jne 0x41650d
mov edx, dword [0x57cf38]
mov edi, 0x54ed0c
mov ebx, edx
or ecx, 0xffffffff
shl ebx, 6
xor eax, eax
add ebx, 0x4df18c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
mov ebx, 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [0x57cf34], ebx
and ecx, 3
inc edx
cmp edx, 0xa
mov dword [0x57cf38], edx
rep movsb byte es:[edi], byte [esi]
jne 0x41650d
mov edi, 0x54ed0c
jmp 0x40eba9
mov eax, dword [0x57ccc4]
mov ecx, dword [0x48bb94]
cmp eax, ecx
jle 0x40df69
mov edi, 0x4a4bec
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jle 0x40df63
mov eax, dword [0x48bb94]
push 0x54f88c
add eax, 2
push 0x5649a8
mov dword [0x48bb94], eax
call fcn.0047fde0
mov ecx, dword [0x57ccc4]
mov edx, dword [0x57cd80]
add esp, 8
test eax, eax
jne 0x40dce9
push 0x54a104
push 0x54bf64
add edx, ecx
push 0x49480c
push ebx
mov dword [0x57cd80], edx
mov dword [0x57ccc4], 0
call fcn.0047a8f8
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x5649a8
push 0x4a4bec
push 0x493e8c
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
mov eax, 1
add esp, 0x20
mov dword [0x57ccf4], eax
mov dword [0x54ea84], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
add edx, ecx
push 0x5649a8
mov dword [0x57cd80], edx
call fcn.00435510
add esp, 4
xor esi, esi
mov dword [0x57ccc4], esi
push 0x54a104
push 0x54bf64
push 0x49480c
push ebx
call fcn.0047a8f8
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x5649a8
push 0x4a4bec
push 0x493e20
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
push str.SCardSvr
push 0x5649a8
call fcn.0047fde0
add esp, 0x28
test eax, eax
je 0x40c11c
push str.SENS
push 0x5649a8
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
cmp esi, dword [0x57ce98]
jge 0x40dda6
mov ecx, esi
push 0x5649a8
shl ecx, 6
add ecx, 0x52d520
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
inc esi
jmp 0x40dd7a
mov eax, 1
push 0x493e04
push 0x4a4bec
mov dword [0x57ccf4], eax
mov dword [0x54ea84], eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40deb7
mov eax, dword [0x57cd98]
test eax, eax
jne 0x40deb7
push str..sys
push 0x5649a8
mov dword [0x57cd98], 1
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x40de49
push str..Sys
push 0x5649a8
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x40de49
push str..SYS
push 0x5649a8
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x40de49
mov edx, dword [0x57cda0]
push 0x5649a8
shl edx, 8
push 0x519320
add edx, 0x50aa18
push str._sdrivers_s.sys
push edx
jmp 0x40de66
mov eax, dword [0x57cda0]
push 0x5649a8
shl eax, 8
push 0x519320
add eax, 0x50aa18
push str._sdrivers_s
push eax
call fcn.0047a8f8
mov edx, dword [0x57cda0]
mov edi, 0x5649a8
mov ebx, edx
or ecx, 0xffffffff
shl ebx, 8
xor eax, eax
add esp, 0x10
add ebx, 0x4e02ac
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x14
mov dword [0x57cda0], edx
rep movsb byte es:[edi], byte [esi]
jne 0x40deb7
mov dword [0x57cda0], 0
push 0x5649a8
call fcn.00459fc0
add esp, 4
push str.winlogon.exe
push 0x4a4bec
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40dee4
mov dword [0x57cc64], 1
push str.services.exe
push 0x4a4bec
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40df04
mov dword [0x57cc6c], 1
push str.svchost.exe
push 0x4a4bec
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40df24
mov dword [0x57cc78], 1
mov eax, dword [0x57cc64]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc6c]
test eax, eax
jne 0x41650d
push 0x4a4bec
call fcn.00432e00
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [0x57ccc4], edx
mov ecx, dword [0x57ce40]
mov eax, dword [0x491400]
cmp ecx, eax
jle 0x40e39b
mov edi, 0x4a4bec
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jle 0x40e39b
mov eax, dword [0x491400]
push 0x54f88c
add eax, 2
push 0x5649a8
mov dword [0x491400], eax
call fcn.0047fde0
mov edx, dword [0x57ce40]
add esp, 8
test eax, eax
jne 0x40e039
mov esi, dword [0x57cd80]
push 0x54a104
push 0x54bf64
add esi, edx
push 0x49480c
push ebx
mov dword [0x57cd80], esi
mov dword [0x57ce40], 0
call fcn.0047a8f8
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x5649a8
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x14]
push 0x4a4bec
not ecx
dec ecx
push 0x493db0
lea ecx, [ecx + eax + 0x20204]
push ecx
call fcn.0047a8f8
add esp, 0x20
mov dword [0x54ea84], 1
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x57cd80]
push str.clr_optimization_
add eax, edx
push 0x5649a8
mov dword [0x57cd80], eax
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x40e379
push 0x5649a8
call fcn.00435510
add esp, 4
mov dword [0x57ce40], 0
push 0x54a104
push 0x54bf64
push 0x49480c
push ebx
call fcn.0047a8f8
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x5649a8
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x14]
push 0x4a4bec
not ecx
dec ecx
push 0x493d30
lea ecx, [ecx + eax + 0x20204]
push ecx
call fcn.0047a8f8
push str.SCardSvr
push 0x5649a8
call fcn.0047fde0
add esp, 0x28
test eax, eax
je 0x40c11c
push str.SENS
push 0x5649a8
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
xor esi, esi
cmp esi, dword [0x57ce98]
jge 0x40e118
mov edx, esi
push 0x5649a8
shl edx, 6
add edx, 0x52d520
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
inc esi
jmp 0x40e0ec
push 0x493e04
push 0x4a4bec
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40e21a
mov eax, dword [0x57cd98]
test eax, eax
jne 0x40e21a
push str..sys
push 0x5649a8
mov dword [0x57cd98], 1
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x40e1aa
push str..Sys
push 0x5649a8
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x40e1aa
push str..SYS
push 0x5649a8
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x40e1aa
mov eax, dword [0x57cda0]
push 0x5649a8
shl eax, 8
push 0x519320
add eax, 0x50aa18
push str._sdrivers_s.sys
push eax
jmp 0x40e1c9
mov ecx, dword [0x57cda0]
push 0x5649a8
shl ecx, 8
push 0x519320
add ecx, 0x50aa18
push str._sdrivers_s
push ecx
call fcn.0047a8f8
mov edx, dword [0x57cda0]
mov edi, 0x5649a8
mov ebx, edx
or ecx, 0xffffffff
shl ebx, 8
xor eax, eax
add esp, 0x10
add ebx, 0x4e02ac
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x14
mov dword [0x57cda0], edx
rep movsb byte es:[edi], byte [esi]
jne 0x40e21a
mov dword [0x57cda0], 0
push 0x5649a8
call fcn.00459fc0
add esp, 4
push str.winlogon.exe
push 0x4a4bec
call fcn.0047fde0
add esp, 8
mov esi, 1
test eax, eax
jne 0x40e248
mov dword [0x57cc64], esi
push str.services.exe
push 0x4a4bec
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40e264
mov dword [0x57cc6c], esi
push str.svchost.exe
push 0x4a4bec
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40e280
mov dword [0x57cc78], esi
mov eax, dword [0x57cc64]
test eax, eax
jne 0x40e29f
mov eax, dword [0x57cc6c]
test eax, eax
jne 0x40e29f
push 0x4a4bec
call fcn.00432e00
add esp, 4
mov eax, dword [0x57ce44]
test eax, eax
jne 0x40e357
push 0x493d2c
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x40e2d8
push 0x493d28
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x40e357
mov ebx, dword [0x57cda0]
mov edi, 0x57cb28
mov edx, ebx
or ecx, 0xffffffff
xor eax, eax
mov dword [0x57cd98], 1
shl edx, 8
repne scasb al, byte es:[edi]
not ecx
lea esi, [edx + 0x50aa18]
sub edi, ecx
mov eax, ecx
mov dword [ebp + 8], esi
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
lea edx, [edx + 0x4e02ac]
rep movsb byte es:[edi], byte [esi]
mov edi, 0x50ed70
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc ebx
cmp ebx, 0x14
mov dword [0x57cda0], ebx
rep movsb byte es:[edi], byte [esi]
jne 0x40e357
mov dword [0x57cda0], 0
mov eax, 1
mov dword [0x57ce44], eax
mov dword [0x54ea84], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [0x57ce40], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [0x57ce38]
cmp esi, 0x2d
jle 0x40e574
mov edi, 0x549134
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jle 0x40e56e
mov ecx, dword [0x57cd80]
mov eax, dword [0x4913fc]
push 0x54a104
push 0x54bf64
add ecx, esi
add eax, 2
push 0x49480c
push ebx
mov dword [0x57cd80], ecx
mov dword [0x4913fc], eax
mov dword [0x57ce38], 0
call fcn.0047a8f8
push 0x493e04
push 0x549134
call fcn.0047fde0
add esp, 0x18
test eax, eax
je 0x40e47a
push str.winlogon.exe
push 0x549134
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40e47a
push str.csrss.exe
push 0x549134
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40e47a
push 0x549134
call fcn.00432070
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
mov edx, dword [ebp - 0x14]
push 0x5649a8
not ecx
dec ecx
push 0x549134
push 0x493cd4
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8c7
jmp 0x40e53c
push 0x493e04
push 0x549134
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40e4be
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov esi, dword [ebp - 0x14]
push 0x5649a8
not ecx
dec ecx
push 0x549134
push 0x493c68
lea ecx, [ecx + esi + 0x20204]
push ecx
call fcn.0047a8f8
add esp, 0x10
jmp 0x40e4c1
mov esi, dword [ebp - 0x14]
push str.winlogon.exe
push 0x549134
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40e500
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x5649a8
push 0x549134
push 0x493bf8
lea edx, [ecx + esi + 0x20204]
push edx
call fcn.0047a8f8
add esp, 0x10
push str.csrss.exe
push 0x549134
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40e53f
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x5649a8
push 0x549134
push 0x493b88
lea eax, [ecx + esi + 0x20204]
push eax
call fcn.0047a8f8
add esp, 0x10
push 0x5649a8
call fcn.00435510
mov eax, 1
add esp, 4
mov dword [0x54ea84], eax
mov dword [0x57ce3c], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [0x57ce38], edx
mov esi, dword [0x57ce28]
mov eax, dword [0x4913f8]
cmp esi, eax
jle 0x40e74c
mov edi, 0x511a50
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jle 0x40e746
mov edi, dword [0x4913f8]
mov ecx, dword [0x57cd80]
mov eax, dword [0x57cc5c]
add edi, 2
add ecx, esi
cmp eax, 1
mov dword [0x4913f8], edi
mov dword [0x57cd80], ecx
mov dword [0x57ce28], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x4c], edx
jne 0x40e5e1
lea ecx, [ebp - 0x4c]
lea edx, [ebp - 0x48]
push ecx
push edx
call fcn.004604f0
add esp, 8
push 0x54a104
push 0x54bf64
push 0x49480c
push ebx
call fcn.0047a8f8
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x48]
push eax
push ecx
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x511a50
push 0x4a3a28
push 0x511a50
lea eax, [ecx + edx + 0x20204]
push 0x493b00
push eax
call fcn.0047a8f8
mov esi, 1
push 0x511a50
mov dword [0x57ce2c], esi
call fcn.00432070
add esp, 0x30
push str.winlogon.exe
push 0x511a50
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40e662
mov dword [0x57cc64], esi
push str.services.exe
push 0x511a50
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40e67e
mov dword [0x57cc6c], esi
push str.svchost.exe
push 0x511a50
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40e69a
mov dword [0x57cc78], esi
mov eax, dword [0x57cc60]
mov dword [0x54ea84], esi
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc70]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc74]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc64]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc6c]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc78]
test eax, eax
jne 0x41650d
mov edx, dword [0x57cf38]
mov edi, 0x511a50
mov ebx, edx
or ecx, 0xffffffff
shl ebx, 6
xor eax, eax
add ebx, 0x4df18c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
mov ebx, 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [0x57cf34], ebx
and ecx, 3
inc edx
cmp edx, 0xa
mov dword [0x57cf38], edx
rep movsb byte es:[edi], byte [esi]
jne 0x41650d
mov edi, 0x511a50
jmp 0x40eba9
mov dword [0x57ce28], edx
mov esi, dword [0x57ce20]
mov eax, dword [0x4913f4]
cmp esi, eax
jle 0x40e8a2
mov edi, 0x519524
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jle 0x40e89c
mov eax, dword [0x4913f4]
mov edi, dword [0x57cd80]
push 0x54a104
push 0x54bf64
add eax, 2
add edi, esi
push 0x49480c
push ebx
mov dword [0x4913f4], eax
mov dword [0x57cd80], edi
mov dword [0x57ce20], 0
call fcn.0047a8f8
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x519524
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x14]
push 0x547cb0
not ecx
dec ecx
push 0x519524
push 0x493a8c
lea ecx, [ecx + eax + 0x20204]
push ecx
call fcn.0047a8f8
mov esi, 1
push 0x519524
mov dword [0x57ce24], esi
call fcn.00432070
add esp, 0x28
mov dword [0x57cc60], esi
push str.ctfmon.exe
push 0x519524
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40e81a
mov dword [0x57cc70], esi
push str.rundll32.exe
push 0x519524
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40e836
mov dword [0x57cc74], esi
push str.winlogon.exe
push 0x519524
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40e852
mov dword [0x57cc64], esi
push str.services.exe
push 0x519524
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40e86e
mov dword [0x57cc6c], esi
push str.svchost.exe
push 0x519524
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40e88a
mov dword [0x57cc78], esi
mov eax, dword [0x57cc60]
mov dword [0x54ea84], esi
test eax, eax
jmp 0x40eb0f
mov dword [0x57ce20], edx
mov eax, dword [0x57cd94]
mov ecx, dword [0x4913ec]
cmp eax, ecx
jle 0x40ebe7
mov eax, dword [0x57cd90]
mov esi, 1
cmp eax, esi
jle 0x40e9e1
mov edi, 0x519524
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jle 0x40e9e1
push 0x54a104
push 0x54bf64
push 0x49480c
push ebx
call fcn.0047a8f8
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x519524
push 0x519524
push 0x493a0c
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
push 0x519524
call fcn.00432e00
mov ecx, dword [0x4913ec]
add esp, 0x24
xor edi, edi
inc ecx
push str.ctfmon.exe
push 0x519524
mov dword [0x57cd94], edi
mov dword [0x57cd90], edi
mov dword [0x4913ec], ecx
mov dword [0x54ea84], esi
mov dword [0x57cc60], esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40e96e
mov dword [0x57cc70], esi
push str.rundll32.exe
push 0x519524
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40e98a
mov dword [0x57cc74], esi
push str.winlogon.exe
push 0x519524
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40e9a6
mov dword [0x57cc64], esi
push str.services.exe
push 0x519524
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40e9c2
mov dword [0x57cc6c], esi
push str.svchost.exe
push 0x519524
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40eb09
jmp 0x40eb03
cmp dword [0x57ccac], esi
jle 0x40ebe7
mov edi, 0x519524
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jle 0x40ebe7
push 0x54a104
push 0x54bf64
push 0x49480c
push ebx
call fcn.0047a8f8
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x519524
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x14]
push 0x519524
not ecx
dec ecx
push 0x493990
lea ecx, [ecx + eax + 0x20204]
push ecx
call fcn.0047a8f8
push 0x519524
call fcn.00432e00
mov ecx, dword [0x4913ec]
add esp, 0x24
xor edi, edi
inc ecx
mov esi, 1
push str.ctfmon.exe
push 0x519524
mov dword [0x57cd94], edi
mov dword [0x57ccac], edi
mov dword [0x4913ec], ecx
mov dword [0x54ea84], esi
mov dword [0x57cc60], esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40ea99
mov dword [0x57cc70], esi
push str.rundll32.exe
push 0x519524
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40eab5
mov dword [0x57cc74], esi
push str.winlogon.exe
push 0x519524
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40ead1
mov dword [0x57cc64], esi
push str.services.exe
push 0x519524
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40eaed
mov dword [0x57cc6c], esi
push str.svchost.exe
push 0x519524
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40eb09
mov dword [0x57cc78], esi
cmp dword [0x57cc60], edi
jne 0x41650d
mov eax, dword [0x57cc70]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc74]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc64]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc6c]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc78]
test eax, eax
jne 0x41650d
mov edx, dword [0x57cf38]
mov edi, 0x519524
mov ebx, edx
or ecx, 0xffffffff
shl ebx, 6
xor eax, eax
add ebx, 0x4df18c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
mov ebx, 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [0x57cf34], ebx
and ecx, 3
inc edx
cmp edx, 0xa
mov dword [0x57cf38], edx
rep movsb byte es:[edi], byte [esi]
jne 0x41650d
mov edi, 0x519524
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [0x57cf38], ebx
mov edx, ecx
mov esi, edi
mov edi, 0x4df18c
mov eax, 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [0x57ce18]
mov eax, dword [str.__n_n__]
cmp esi, eax
jle 0x40ee44
mov edi, 0x54c124
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jle 0x40ee3e
mov ecx, dword [str.__n_n__]
mov eax, dword [0x57cd80]
push 0x54a104
push 0x54bf64
add ecx, 2
add eax, esi
push 0x49480c
push ebx
mov dword [str.__n_n__], ecx
mov dword [0x57cd80], eax
mov dword [0x57ce18], 0
call fcn.0047a8f8
push str.vrvedp_m.exe
push 0x54c124
call fcn.0047fde0
add esp, 0x18
test eax, eax
je 0x40ec77
push str.LssSvc.exe
push 0x54c124
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40ecc2
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x54c124
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x14]
push 0x49393c
not ecx
dec ecx
lea ecx, [ecx + eax + 0x20204]
push ecx
call fcn.0047a8f8
mov eax, 1
add esp, 0xc
mov dword [0x57ce1c], eax
mov dword [0x54ea84], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x54c124
call fcn.00432070
add esp, 4
mov esi, 1
cmp eax, esi
push 0x54c124
push 0x54c124
jne 0x40ece9
push 0x4938cc
jmp 0x40ecee
push 0x493868
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
add esp, 0x10
push 0x48ba7c
push 0x54c124
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40ed29
mov dword [0x57cc60], esi
push str.ctfmon.exe
push 0x54c124
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40ed45
mov dword [0x57cc70], esi
push str.rundll32.exe
push 0x54c124
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40ed61
mov dword [0x57cc74], esi
mov eax, dword [0x57cc60]
test eax, eax
jne 0x40ee1c
mov eax, dword [0x57cc70]
test eax, eax
jne 0x40ee1c
mov eax, dword [0x57cc74]
test eax, eax
jne 0x40ee1c
mov eax, dword [0x57cc64]
test eax, eax
jne 0x40ee1c
mov eax, dword [0x57cc6c]
test eax, eax
jne 0x40ee1c
mov eax, dword [0x57cc78]
test eax, eax
jne 0x40ee1c
mov edx, dword [0x57cf38]
mov edi, 0x54c124
mov ebx, edx
or ecx, 0xffffffff
shl ebx, 6
xor eax, eax
add ebx, 0x4df18c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
mov ebx, 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [0x57cf34], ebx
and ecx, 3
inc edx
cmp edx, 0xa
mov dword [0x57cf38], edx
rep movsb byte es:[edi], byte [esi]
jne 0x40ee1c
mov edi, 0x54c124
or ecx, 0xffffffff
xor eax, eax
mov dword [0x57cf38], ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x4df18c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, 1
mov dword [0x57ce1c], eax
mov dword [0x54ea84], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [0x57ce18], edx
mov esi, dword [0x57ce60]
mov eax, dword [0x49140c]
cmp esi, eax
jle 0x40f0a0
mov edi, 0x54d930
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jle 0x40f09a
mov eax, dword [0x49140c]
mov edi, dword [0x57cd80]
add eax, 3
add edi, esi
push 0x54d930
mov dword [0x49140c], eax
mov dword [0x57cd80], edi
call fcn.00432070
add esp, 4
mov edi, eax
mov dword [0x57ce60], 0
push 0x54a104
push 0x54bf64
push 0x49480c
push ebx
call fcn.0047a8f8
add esp, 0x10
mov esi, 1
cmp edi, esi
push 0x54d930
jne 0x40eee6
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x49380c
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x14]
not ecx
dec ecx
lea ecx, [ecx + eax + 0x20204]
push ecx
jmp 0x40ef02
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4937b0
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
add esp, 0xc
mov dword [0x57ce64], esi
push str.ctfmon.exe
push 0x54d930
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40ef2c
mov dword [0x57cc70], esi
push str.rundll32.exe
push 0x54d930
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40ef48
mov dword [0x57cc74], esi
push str.svchost.exe
push 0x54d930
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40ef64
mov dword [0x57cc78], esi
push str.winlogon.exe
push 0x54d930
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40ef80
mov dword [0x57cc64], esi
push str.services.exe
push 0x54d930
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40ef9c
mov dword [0x57cc6c], esi
push 0x48ba7c
push 0x54d930
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40efb8
mov dword [0x57cc60], esi
mov eax, dword [0x57cc60]
mov dword [0x54ea84], esi
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc70]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc74]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc64]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc6c]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc78]
test eax, eax
jne 0x41650d
mov edx, dword [0x57cf38]
mov edi, 0x54d930
mov ebx, edx
or ecx, 0xffffffff
shl ebx, 6
xor eax, eax
add ebx, 0x4df18c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
mov ebx, 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [0x57cf34], ebx
and ecx, 3
inc edx
cmp edx, 0xa
mov dword [0x57cf38], edx
rep movsb byte es:[edi], byte [esi]
jne 0x41650d
mov edi, 0x54d930
or ecx, 0xffffffff
xor eax, eax
mov dword [0x57cf38], ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ebx
mov edx, ecx
mov esi, edi
mov edi, 0x4df18c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [0x57ce60], edx
mov esi, dword [0x57ce68]
mov eax, dword [0x491410]
cmp esi, eax
jle 0x40f2f6
mov edi, 0x561460
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jle 0x40f2f6
mov eax, dword [0x491410]
mov edi, dword [0x57cd80]
add eax, 3
add edi, esi
push 0x561460
mov dword [0x491410], eax
mov dword [0x57cd80], edi
call fcn.00432070
add esp, 4
mov edi, eax
mov dword [0x57ce68], 0
push 0x54a104
push 0x54bf64
push 0x49480c
push ebx
call fcn.0047a8f8
add esp, 0x10
mov esi, 1
cmp edi, esi
push 0x54d930
jne 0x40f142
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x493760
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x14]
not ecx
dec ecx
lea ecx, [ecx + eax + 0x20204]
push ecx
jmp 0x40f15e
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x49370c
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
add esp, 0xc
mov dword [0x57ce6c], esi
push str.ctfmon.exe
push 0x561460
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40f188
mov dword [0x57cc70], esi
push str.rundll32.exe
push 0x561460
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40f1a4
mov dword [0x57cc74], esi
push str.svchost.exe
push 0x561460
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40f1c0
mov dword [0x57cc78], esi
push str.winlogon.exe
push 0x561460
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40f1dc
mov dword [0x57cc64], esi
push str.services.exe
push 0x561460
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40f1f8
mov dword [0x57cc6c], esi
push 0x48ba7c
push 0x561460
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40f214
mov dword [0x57cc60], esi
mov eax, dword [0x57cc60]
mov dword [0x54ea84], esi
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc70]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc74]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc64]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc6c]
test eax, eax
jne 0x41650d
mov eax, dword [0x57cc78]
test eax, eax
jne 0x41650d
mov edx, dword [0x57cf38]
mov edi, 0x561460
mov ebx, edx
or ecx, 0xffffffff
shl ebx, 6
xor eax, eax
add ebx, 0x4df18c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
mov ebx, 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [0x57cf34], ebx
and ecx, 3
inc edx
cmp edx, 0xa
mov dword [0x57cf38], edx
rep movsb byte es:[edi], byte [esi]
jne 0x41650d
mov edi, 0x561460
or ecx, 0xffffffff
xor eax, eax
mov dword [0x57cf38], ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ebx
mov edx, ecx
mov esi, edi
mov edi, 0x4df18c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [0x57cd70], edx
jle 0x40f376
cmp dword [0x57cd74], edx
jle 0x40f376
cmp dword [0x57cd78], edx
jle 0x40f376
cmp dword [0x57cd7c], edx
jle 0x40f376
push 0x54a104
push 0x54bf64
xor eax, eax
push 0x49480c
push ebx
mov dword [0x57cd70], eax
mov dword [0x57cd74], eax
mov dword [0x57cd78], eax
mov dword [0x57cd7c], eax
mov dword [0x57cd60], eax
call fcn.0047a8f8
push 0x561be4
call fcn.00432070
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x14]
push 0x561be4
not ecx
dec ecx
push 0x4936c0
lea ecx, [ecx + eax + 0x20204]
push ecx
jmp 0x40f3cc
cmp dword [0x57cd60], 0xa
jle 0x40f3f1
push 0x54a104
push 0x54bf64
push 0x49480c
push ebx
mov dword [0x57cd60], 0
call fcn.0047a8f8
push 0x561be4
call fcn.00432070
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
mov edx, dword [ebp - 0x14]
push 0x561be4
not ecx
dec ecx
push 0x493668
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8c7
mov eax, 1
add esp, 0xc
mov dword [0x54ea84], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, 0x51b1d8
or ecx, 0xffffffff
xor eax, eax
mov dword [0x54ea84], edx
repne scasb al, byte es:[edi]
not ecx
mov byte [0x50ed70], 0
dec ecx
cmp eax, ecx
jge 0x40f42d
mov esi, ecx
sub esi, eax
mov bl, byte [esi + 0x51b1d8]
cmp bl, 0x5c
mov byte [eax + 0x513014], bl
jne 0x40f42a
mov edx, esi
jmp 0x40f434
inc eax
jmp 0x40f40d
xor eax, eax
cmp eax, 1
jne 0x40f457
lea esi, [edx + 1]
cmp esi, ecx
jge 0x40f44e
mov bl, byte [esi + 0x51b1d8]
mov eax, esi
sub eax, edx
inc esi
mov byte [eax + 0x513013], bl
jmp 0x40f437
sub ecx, edx
mov byte [ecx + 0x513013], 0
mov edi, 0x51b1d8
or ecx, 0xffffffff
xor eax, eax
mov byte [edx + 0x51b1d8], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x51aed8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x513014
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x513194
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x51b1d8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp eax, ecx
jge 0x40f4d7
mov esi, ecx
sub esi, eax
mov bl, byte [esi + 0x51b1d8]
cmp bl, 0x5c
mov byte [eax + 0x513014], bl
jne 0x40f4d4
mov edx, esi
jmp 0x40f4de
inc eax
jmp 0x40f4b7
xor eax, eax
cmp eax, 1
jne 0x40f501
lea esi, [edx + 1]
cmp esi, ecx
jge 0x40f4f8
mov bl, byte [esi + 0x51b1d8]
mov eax, esi
sub eax, edx
inc esi
mov byte [eax + 0x513013], bl
jmp 0x40f4e1
sub ecx, edx
mov byte [ecx + 0x513013], 0
mov edi, 0x51b1d8
or ecx, 0xffffffff
xor eax, eax
mov byte [edx + 0x51b1d8], 0
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp eax, ecx
jge 0x40f539
mov edx, ecx
sub edx, eax
mov bl, byte [edx + 0x51b1d8]
cmp bl, 0x5c
mov byte [eax + 0x513114], bl
jne 0x40f536
mov esi, edx
jmp 0x40f540
inc eax
jmp 0x40f519
xor eax, eax
cmp eax, 1
jne 0x40f563
lea eax, [esi + 1]
cmp eax, ecx
jge 0x40f55a
mov bl, byte [eax + 0x51b1d8]
mov edx, eax
sub edx, esi
inc eax
mov byte [edx + 0x513113], bl
jmp 0x40f543
sub ecx, esi
mov byte [ecx + 0x513113], 0
push str.regM
push 0x513014
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.userM
push 0x513014
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.fileM
push 0x513014
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.procM
push 0x513014
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.cardM
push 0x513014
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.WS2IFSL
push 0x513014
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push 0x513014
push 0x48f62c
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x41a6ae
push 0x513014
push str.runservices
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x41a6ae
push 0x513014
push str.runservicesonce
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x41a6ae
push 0x513014
push 0x48f9ec
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40f903
push 0x513194
push 0x48fa2c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40f903
push str.REGISTRYMACHINESoftwareMicrosoft
push 0x50a818
mov byte [0x50a83c], al
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40f6bd
push str.REGISTRYUSER
push 0x50a818
mov byte [0x50a826], 0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c11c
mov ebx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea esi, [ebx + 0x20204]
push esi
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x40f84f
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x40f84f
push 0x563924
push eax
mov dword [0x4e02a8], 0
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935e4
lea eax, [ecx + ebx + 0x20204]
push eax
call fcn.0047a8f8
push str.regService_b.ex
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.procCheck.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.mshta.exe
push 0x563924
xor edi, edi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40f7ad
mov eax, dword [0x57ce48]
mov dword [0x54f98c], 1
inc eax
mov dword [0x57ce48], eax
push str.rundll32.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40f7d9
mov eax, dword [0x57ce48]
mov edi, 1
inc eax
mov dword [0x52d1d8], edi
mov dword [0x57ce48], eax
push 0x48ba7c
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40f7f9
mov dword [0x5615e0], 1
push str.iexplore.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40f821
mov eax, dword [0x57ce4c]
mov dword [0x54e7fc], 1
inc eax
jmp 0x40f82c
test edi, edi
jne 0x40f831
xor eax, eax
mov dword [0x57ce48], eax
mov dword [0x57ce4c], eax
push 0x563924
push 0x48b2f4
push 0x519424
mov byte [0x519424], 0
call fcn.0047a8f8
add esp, 0xc
cmp dword [0x57cd58], 2
jle 0x40f8b9
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x40f8b9
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x48b2f4
lea ecx, [ecx + ebx + 0x20204]
push ecx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x4cc184
mov byte [0x4cc184], 0
call fcn.0047a8f8
add esp, 0x18
mov dword [0x5193a0], 1
cmp dword [0x57cd58], 4
jle 0x41650d
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x41650d
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea edx, [ecx + ebx + 0x20204]
push edx
jmp 0x4164ea
push 0x513114
push str.OpenHomePage
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40fb7e
push 0x513014
push 0x48f76c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40fb7e
mov esi, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea ebx, [esi + 0x20204]
push ebx
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x40fa8c
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x40fa8c
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935b0
lea eax, [ecx + esi + 0x20204]
push eax
call fcn.0047a8f8
push str.regService_b.ex
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.procCheck.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
mov byte [0x561460], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x561460
mov edx, ecx
mov esi, edi
mov edi, 0x561460
push 0x5490b4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40fa5a
mov ecx, dword [0x57ce68]
mov eax, dword [0x57ce6c]
inc ecx
cmp eax, 1
mov dword [0x57ce68], ecx
jne 0x40fa64
mov eax, ecx
mov ecx, dword [0x491410]
cmp eax, ecx
jge 0x40fa64
jmp 0x40c11c
mov dword [0x57ce6c], 0
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x5490b4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x14]
cmp dword [0x57cd58], 2
jle 0x40fadb
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x40fadb
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x48b2f4
lea eax, [ecx + esi + 0x20204]
push eax
call fcn.0047a8f8
add esp, 0xc
mov dword [0x54d928], 1
cmp dword [0x57cd58], 4
jle 0x40fb3b
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x40fb3b
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea ecx, [ecx + esi + 0x20204]
push ecx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
add esp, 0x18
lea edx, [ebp - 0xb70]
push edx
call fcn.00403990
add esp, 4
lea eax, [ebp - 0xb70]
lea ecx, [ebp - 0x30f0]
push eax
push ebx
push 0x491924
push ecx
call fcn.0047a8f8
add esp, 0x10
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x513014
push 0x48f76c
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40fbc4
push 0x513014
push 0x48fc2c
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40fbc4
push 0x513014
push 0x48fc6c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4103bf
push 0x513014
push 0x48f76c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40fbf9
push str.REGISTRYMACHINESOFTWAREClassesDrive_shellexplore
push 0x50a818
mov byte [0x50a84e], al
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4103bf
mov edx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
add edx, 0x20204
push 0x49480c
push edx
call fcn.0047a8f8
push 0x513014
push 0x48fc6c
mov byte [0x50a83a], 0
call fcn.0047fde0
add esp, 0x18
test eax, eax
jne 0x40fc6e
push str.REGISTRYMACHINESoftwareClasses
push 0x50a818
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40fc6e
push str.StartMenuInternet
push 0x50a818
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
mov dword [0x4ca22c], 1
push str.OpenWithProgids
push 0x513194
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.powerpointhtmlfile
push 0x54abcc
xor edi, edi
call fcn.0047bec0
add esp, 8
push str.fphtmlfile
push 0x54abcc
call fcn.0047bec0
add esp, 8
push str.wordhtmlfile
push 0x54abcc
call fcn.0047bec0
add esp, 8
push str.Excelhtmlfile
push 0x54abcc
call fcn.0047bec0
add esp, 8
push str.OpenWithProgids
push 0x54abcc
call fcn.0047bec0
add esp, 8
push str.OpenWithList
push 0x54abcc
call fcn.0047bec0
add esp, 8
push str..exe_
push 0x54abcc
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x40fd1e
push 0x513014
push 0x48f76c
call fcn.0047fde0
add esp, 8
push str.RecentDocs.txt
push 0x54abcc
call fcn.0047bec0
add esp, 8
xor esi, esi
cmp esi, 0x23
jge 0x40fd67
mov eax, esi
shl eax, 6
add eax, 0x490b2c
push eax
push 0x54abcc
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x40fd64
cmp esi, 2
jge 0x40fd6f
mov dword [0x54ed08], 1
jmp 0x40fd6f
inc esi
jmp 0x40fd32
cmp edi, edi
je 0x40c11c
push str.MountPoints2
push 0x51b1d8
call fcn.0047bec0
push str.Explorer
push 0x51b1d8
mov esi, eax
call fcn.0047bec0
add esp, 0x10
cmp esi, edi
jne 0x40fd9a
cmp eax, edi
je 0x40fda4
mov dword [0x5195a4], 1
mov eax, dword [0x57cd58]
mov dword [ebp + 8], edi
cmp eax, edi
jle 0x410046
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x410046
mov ebx, dword [sym.imp.USER32.dll_OemToCharA]
push 0x563924
push eax
call ebx
mov eax, dword [0x5195a4]
mov esi, 1
cmp eax, esi
push 0x563924
jne 0x40fe10
mov edx, dword [ebp - 0x14]
or ecx, 0xffffffff
xor eax, eax
push 0x49348c
lea edi, [edx + 0x20204]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ecx, [ecx + edx + 0x20204]
push ecx
call fcn.0047a8f8
add esp, 0xc
mov dword [ebp + 8], esi
jmp 0x40fe38
mov edx, dword [ebp - 0x14]
or ecx, 0xffffffff
xor eax, eax
push 0x49346c
lea edi, [edx + 0x20204]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx + edx + 0x20204]
push edx
call fcn.0047a8f8
add esp, 0xc
push str.regService_b.ex
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.procCheck.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.procService.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.winlogon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40febc
mov dword [0x57cc64], esi
push str.services.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40fed8
mov dword [0x57cc6c], esi
push str.svchost.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40fef4
mov dword [0x57cc78], esi
push str.rundll32.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40ff10
mov dword [0x57cc74], esi
push str.csrss.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40ff2c
mov dword [0x57cc80], esi
push str.ctfmon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40ff48
mov dword [0x57cc70], esi
push 0x48ba7c
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40ff64
mov dword [0x57cc60], esi
mov eax, dword [0x57cc64]
test eax, eax
jne 0x40ffb7
mov eax, dword [0x57cc6c]
test eax, eax
jne 0x40ffb7
mov eax, dword [0x57cc78]
test eax, eax
jne 0x40ffb7
mov eax, dword [0x57cc70]
test eax, eax
jne 0x40ffb7
mov eax, dword [0x57cc60]
test eax, eax
jne 0x40ffb7
mov eax, dword [0x57cc74]
test eax, eax
jne 0x40ffb7
push 0x563924
push 0x48b2f4
push 0x52d4dc
call fcn.0047a8f8
add esp, 0xc
mov dword [0x57cf60], esi
push 0x540e64
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x410015
mov ecx, dword [0x57ccc8]
mov edi, 0x563924
inc ecx
mov dword [0x57ccc8], ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x54f90c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x57ccf0]
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
jne 0x41001f
cmp dword [0x57ccc8], 0x2e
jge 0x41001f
jmp 0x40c11c
mov dword [0x57ccf0], 0
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x540e64
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x41004c
mov ebx, dword [sym.imp.USER32.dll_OemToCharA]
cmp dword [0x57cd58], 2
jle 0x4100dc
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x4100dc
push 0x563924
push eax
call ebx
mov esi, dword [ebp - 0x14]
or ecx, 0xffffffff
xor eax, eax
push 0x563924
lea edi, [esi + 0x20204]
push 0x48b2f4
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + esi + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x545ae8
mov byte [0x545ae8], 0
call fcn.0047a8f8
mov ecx, dword [0x5195a4]
mov eax, 1
add esp, 0x18
cmp ecx, eax
mov dword [0x4cd884], eax
jne 0x4100df
mov eax, dword [0x4ca22c]
test eax, eax
jne 0x4100df
mov dword [0x4cd884], 0
jmp 0x4100df
mov esi, dword [ebp - 0x14]
cmp dword [0x57cd58], 4
jle 0x41650d
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x41650d
push 0x563924
push eax
call ebx
lea edi, [esi + 0x20204]
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea ecx, [ecx + esi + 0x20204]
push ecx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
mov eax, dword [ebp + 8]
add esp, 0x18
cmp eax, 1
jne 0x410169
push 0x492024
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x40c11c
push str.HTTP
push 0x545ae8
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x4101ed
push str.http
push 0x545ae8
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x4101ed
push str.HTTPS
push 0x545ae8
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x4101ed
push str.https
push 0x545ae8
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x4101ed
push str.htmlfile
push 0x545ae8
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x4101ed
push str.mhtmlfile
push 0x545ae8
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41021a
push 0x563924
push 0x48b2f4
push 0x4ca380
mov byte [0x4ca380], 0
call fcn.0047a8f8
add esp, 0xc
mov dword [0x57ce0c], 1
jmp 0x40c11c
push str.Firefox_PlusFirefox_Plus.exe
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41027e
push str.HTTP
push 0x545ae8
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x40c11c
push str.http
push 0x545ae8
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x40c11c
push str.StartMenuInternet
push 0x545ae8
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x40c11c
mov eax, dword [0x5195a4]
test eax, eax
jne 0x4102d4
lea edx, [ebp - 0x670]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x670]
lea ecx, [ebp - 0x1ff0]
push eax
push str._sProgram_FilesInternet_Exploreriexplore.exe
push ecx
mov byte [ebp - 0x66e], 0
call fcn.0047a8f8
lea edx, [ebp - 0x1ff0]
push edx
push 0x57cb28
call fcn.0047bec0
add esp, 0x14
test eax, eax
jne 0x40c11c
push 0x48b7ec
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41650d
push str.NOTEPAD.EXE
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x41650d
push str.notepad.exe
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x41650d
push str.regedit.exe
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x41650d
push str.Firefox_PlusFirefox_Plus.exe
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x41650d
mov edx, dword [0x57cdb8]
mov edi, 0x57cb28
mov ebx, edx
or ecx, 0xffffffff
shl ebx, 8
add ebx, 0x561de4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0xf
mov dword [0x57cdb8], edx
rep movsb byte es:[edi], byte [esi]
jne 0x41039d
mov dword [0x57cdb8], 0
mov dword [0x57cdb4], 1
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x513194
push str.load
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x41a042
push 0x513194
push 0x48f62c
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x41a042
push 0x513194
push str.setup
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x41a042
push 0x513194
push str.userinit
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x41a042
push 0x513014
push 0x48f7ac
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x410758
push 0x513194
push 0x49022c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x410758
mov ebx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea esi, [ebx + 0x20204]
push esi
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x410510
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x410510
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x493390
lea ecx, [ecx + ebx + 0x20204]
push ecx
call fcn.0047a8f8
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.procCheck.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService_b.ex
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
cmp dword [0x57cd58], 2
jle 0x41057f
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x41057f
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x49338c
lea edx, [ecx + ebx + 0x20204]
push edx
call fcn.0047a8f8
push 0x563924
mov eax, 1
push 0x48b2f4
push 0x519728
mov dword [0x519f10], eax
mov dword [0x57cdfc], eax
mov byte [0x519728], 0
call fcn.0047a8f8
add esp, 0x18
cmp dword [0x57cd58], 4
jle 0x41650d
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x41650d
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea eax, [ecx + ebx + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x511850
call fcn.0047a8f8
push str.explorer.
push 0x511850
call fcn.0047bec0
add esp, 0x2c
test eax, eax
jne 0x41063e
push str.Explorer.
push 0x511850
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x41063e
push str.EXPLORER.
push 0x511850
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41650d
mov edi, 0x511850
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x493364
push 0x511850
mov edi, ecx
mov dword [ebp - 0x20], esi
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x41069a
cmp eax, edi
jge 0x4106c5
mov cl, byte [eax + 0x511850]
cmp cl, 0x65
jne 0x410682
cmp byte [eax + 0x511851], 0x20
je 0x4106c5
cmp cl, 0x45
jne 0x410690
cmp byte [eax + 0x511851], 0x20
je 0x4106c5
mov dword [ebp - 0x20], 1
inc eax
jmp 0x41066a
xor eax, eax
cmp eax, edi
jge 0x4106c5
mov cl, byte [eax + 0x511850]
cmp cl, 0x65
jne 0x4106b4
cmp byte [eax + 0x511851], 0x2c
je 0x4106c5
cmp cl, 0x45
jne 0x4106c2
cmp byte [eax + 0x511851], 0x2c
je 0x4106c5
inc eax
jmp 0x41069c
inc eax
mov dword [ebp + 8], esi
xor edx, edx
mov ecx, edi
sub ecx, eax
cmp edx, ecx
jge 0x41071b
mov ecx, dword [ebp - 0x20]
cmp ecx, 1
mov cl, byte [edx + eax + 0x57cb28]
jne 0x4106f5
cmp cl, 0x20
jne 0x410708
test esi, esi
jne 0x410708
mov ecx, dword [ebp + 8]
inc ecx
inc edx
mov dword [ebp + 8], ecx
jmp 0x4106cb
cmp cl, 0x2c
jne 0x410708
test esi, esi
jne 0x410708
mov ecx, dword [ebp + 8]
inc ecx
inc edx
mov dword [ebp + 8], ecx
jmp 0x4106cb
mov ebx, edx
mov esi, 1
sub ebx, dword [ebp + 8]
inc edx
mov byte [ebx + 0x511850], cl
jmp 0x4106cb
mov ecx, dword [ebp + 8]
push 0x511850
sub edi, ecx
push 0x48b2f4
sub edi, eax
push 0x57cb28
mov byte [edi + 0x511850], 0
call fcn.0047a8f8
add esp, 0xc
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x513014
push 0x48f7ac
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x410965
push 0x513194
push 0x49062c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x410965
mov ebx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea esi, [ebx + 0x20204]
push esi
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x410879
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x410879
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x493348
lea edx, [ecx + ebx + 0x20204]
push edx
call fcn.0047a8f8
push str.processManager.
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.downAutohc.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService_b.ex
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.procCheck.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
cmp dword [0x57cd58], 2
jle 0x41091b
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x41091b
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x49338c
lea eax, [ecx + ebx + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x50c120
mov dword [0x4df450], 1
mov byte [0x50c120], 0
call fcn.0047a8f8
add esp, 0x18
mov ecx, 0x65cd80
push str.gloabl_winlogonsystem_value::
call fcn.00479641
push 0x50c120
mov ecx, eax
call fcn.00479641
push 0xa
mov ecx, eax
call fcn.00479456
push 0x401430
mov ecx, eax
call fcn.00401410
cmp dword [0x57cd58], 4
jle 0x41650d
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x41650d
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea ecx, [ecx + ebx + 0x20204]
push ecx
jmp 0x4164ea
push 0x513114
push 0x49036c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x410b98
push 0x513194
push 0x4903ac
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x410b98
mov ebx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea esi, [ebx + 0x20204]
push esi
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x410b1c
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x410b1c
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4932e8
lea edx, [ecx + ebx + 0x20204]
push edx
call fcn.0047a8f8
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.regService_b.ex
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.winlogon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
mov edi, 1
test eax, eax
jne 0x410a59
mov dword [0x57cc64], edi
push str.services.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x410a75
mov dword [0x57cc6c], edi
push str.svchost.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x410a91
mov dword [0x57cc78], edi
push str.ctfmon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x410aad
mov dword [0x57cc70], edi
push str.rundll32.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x410ac9
mov dword [0x57cc74], edi
mov eax, dword [0x57cc64]
test eax, eax
jne 0x410b1c
mov eax, dword [0x57cc6c]
test eax, eax
jne 0x410b1c
mov eax, dword [0x57cc78]
test eax, eax
jne 0x410b1c
mov eax, dword [0x57cc70]
test eax, eax
jne 0x410b1c
mov eax, dword [0x57cc60]
test eax, eax
jne 0x410b1c
mov eax, dword [0x57cc74]
test eax, eax
jne 0x410b1c
push 0x563924
push 0x48b2f4
push 0x50ee70
mov dword [0x57cfc0], edi
call fcn.0047a8f8
add esp, 0xc
cmp dword [0x57cd58], 2
jle 0x41091b
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x41091b
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x49338c
lea eax, [ecx + ebx + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
mov eax, 1
push 0x48b2f4
push 0x54ba54
mov dword [0x57cc28], eax
mov dword [0x57cc68], eax
mov byte [0x54ba54], 0
call fcn.0047a8f8
add esp, 0x18
jmp 0x41091b
push 0x513114
push str.GPExtensions
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x410d44
push 0x513194
push 0x4903ac
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x410d44
mov ebx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea esi, [ebx + 0x20204]
push esi
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x410cb9
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x410cb9
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4932c8
lea edx, [ecx + ebx + 0x20204]
push edx
call fcn.0047a8f8
push str.processManager.
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.downAutohc.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService_b.ex
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.procCheck.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
cmp dword [0x57cd58], 2
jle 0x41091b
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x41091b
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x49338c
lea eax, [ecx + ebx + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x54ba54
mov dword [0x57cc28], 1
mov byte [0x54ba54], 0
call fcn.0047a8f8
add esp, 0x18
mov ecx, 0x65cd80
push str.gloabl_winlogon_value::
call fcn.00479641
push 0x54ba54
jmp 0x4108ff
push 0x513194
push 0x4901ec
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x419f16
push 0x513194
push 0x4902ec
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x419f16
push 0x513194
push 0x49032c
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x419f16
push 0x513194
push str.Start_Page
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x419b60
push 0x513194
push str.Search_Page
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x419b60
push 0x513194
push str.Window_Title
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x419b60
push 0x513194
push str.SearchURL
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x419b60
push 0x513194
push str.First_Home_Page
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x419b60
push 0x513194
push str.Search_Bar
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x419b60
push 0x513194
push str.Local_Page
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x419b60
push 0x513194
push str.Default_Page_URL
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x419b60
push 0x513194
push str.Default_Search_URL
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x419b60
push 0x513194
push str.Second_Home_Page
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x419b60
push 0x513194
push str.CustomizeSearch
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x419b60
push 0x513194
push str.SearchAssistant
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x419b60
push 0x513194
push 0x49006c
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x41825f
push 0x513194
push 0x4900ac
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x41825f
push 0x513194
push str.start
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x41825f
push 0x513014
push str.00000220
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4180c8
push 0x513114
push str.00000220
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4180c8
push 0x513014
push str.Names
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x417f16
push 0x513114
push str.Names
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x417f16
push 0x513194
push 0x4901ac
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4110d8
push str.REGISTRYMACHINESAM
push 0x50a818
mov byte [0x50a82d], al
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c11c
mov ebx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea esi, [ebx + 0x20204]
push esi
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x411050
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x411050
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x49327c
lea edx, [ecx + ebx + 0x20204]
push edx
call fcn.0047a8f8
push str.accountManager.
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
cmp dword [0x57cd58], 2
jle 0x411095
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x411095
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x48b2f4
lea eax, [ecx + ebx + 0x20204]
push eax
call fcn.0047a8f8
add esp, 0xc
lea ecx, [ebp - 0x10f0]
push ecx
call fcn.00403990
add esp, 4
lea edx, [ebp - 0x10f0]
lea eax, [ebp - 0x3cf0]
push edx
push esi
push 0x491924
push eax
call fcn.0047a8f8
add esp, 0x10
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x513014
push str.Browser_Helper_Objects
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x417c86
push 0x513114
push str.Browser_Helper_Objects
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x417c86
push 0x513014
push str.ShellExecuteHooks
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4178db
push 0x513114
push str.ShellExecuteHooks
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4178db
push 0x513014
push str.Extensions
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4177fd
push 0x513114
push str.Extensions
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4177fd
push 0x513014
push str.ActiveX_Compatibility
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x41761d
push 0x513014
push str.ActiveX_Compatibility
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x41761d
push 0x513194
push 0x49026c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41145e
mov ebx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea esi, [ebx + 0x20204]
push esi
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x4112c9
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x4112c9
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x493250
lea ecx, [ecx + ebx + 0x20204]
push ecx
call fcn.0047a8f8
push str.accountManager.
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.processManager.
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.downAutohc.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService_b.ex
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.procCheck.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
cmp dword [0x57cd58], 2
jle 0x411333
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x411333
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x48b2f4
lea edx, [ecx + ebx + 0x20204]
push edx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x4a3068
mov dword [0x4a2fe0], 1
mov byte [0x4a3068], 0
call fcn.0047a8f8
add esp, 0x18
cmp dword [0x57cd58], 4
jle 0x41141b
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x41141b
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea eax, [ecx + ebx + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
mov eax, dword [0x57cde4]
add esp, 0x18
cmp eax, 1
jne 0x41141b
lea ecx, [ebp - 0x68]
lea edx, [ebp - 0x68]
push ecx
push 0x5467ac
push edx
lea eax, [ebp - 0x23f0]
push 0x493248
push eax
mov byte [ebp - 0x68], 0x22
mov byte [ebp - 0x67], 0x30
call fcn.0047a8f8
lea ecx, [ebp - 0x23f0]
push ecx
push 0x57cb28
call fcn.0047fde0
add esp, 0x1c
test eax, eax
je 0x40c11c
push 0x5467ac
push 0x57cb28
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push 0x5467ac
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x40c11c
lea edx, [ebp - 0x11f0]
push edx
call fcn.00403990
add esp, 4
lea eax, [ebp - 0x11f0]
lea ecx, [ebp - 0x28f0]
push eax
push esi
push 0x491924
push ecx
call fcn.0047a8f8
add esp, 0x10
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x513194
push 0x4902ac
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x411a45
mov edx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea ebx, [edx + 0x20204]
push ebx
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x4117c2
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x4117c2
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov eax, dword [0x57ccac]
test eax, eax
jle 0x411504
push 0x563924
push 0x4dec8c
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x411504
mov edi, 0x4dec8c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x563924
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x57cd90]
test eax, eax
jle 0x411548
push 0x563924
push 0x54c124
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x411548
mov edi, 0x54c124
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x563924
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x14]
push 0x493224
not ecx
dec ecx
lea ecx, [ecx + eax + 0x20204]
push ecx
call fcn.0047a8f8
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.regService_b.ex
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push 0x563924
lea edx, [ebp - 0x5f0]
push 0x48b2f4
push edx
call fcn.0047a8f8
mov ebx, 1
push str.ctfmon.exe
push 0x563924
mov dword [0x57cc60], ebx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x4115df
mov dword [0x57cc70], ebx
push str.winlogon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4115fb
mov dword [0x57cc64], ebx
push str.services.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x411617
mov dword [0x57cc6c], ebx
push str.svchost.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x411633
mov dword [0x57cc78], ebx
mov eax, dword [0x57cd94]
push 0x563924
inc eax
push 0x519524
mov dword [0x57cd94], eax
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4116bb
push 0x563924
push 0x48ba7c
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4116bb
push 0x563924
push str.cmd.exe
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4116bb
push 0x563924
push 0x493218
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4116bb
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x519524
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x563924
push 0x519524
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x411712
mov edx, dword [0x57ce20]
mov eax, dword [0x57cebc]
inc edx
test eax, eax
mov dword [0x57ce20], edx
jle 0x4116ee
inc dword [eax*4 + 0x57cec0]
cmp dword [0x57ce24], ebx
jne 0x4117c7
mov eax, dword [0x57ce20]
mov ecx, dword [0x4913f4]
cmp eax, ecx
jge 0x4117c7
jmp 0x40c11c
push 0x48ba7c
push 0x519524
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x411793
mov edx, dword [0x57cebc]
mov edi, 0x563924
mov ecx, edx
xor eax, eax
shl ecx, 6
shl edx, 8
lea ebx, [ecx + 0x4f1b94]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
add edx, 0x54ff60
mov eax, ecx
mov esi, edi
mov edi, ebx
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0046d850
mov eax, dword [0x57cebc]
add esp, 8
inc eax
test eax, eax
mov dword [0x57cebc], eax
jle 0x411784
inc dword [eax*4 + 0x57cec0]
cmp eax, 0xa
jne 0x411793
mov dword [0x57cebc], 0
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [0x57ce20], eax
mov edx, ecx
mov esi, edi
mov edi, 0x519524
mov dword [0x57ce24], eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebx, 1
cmp dword [0x57cd58], 2
jle 0x411834
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x411834
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edx, dword [ebp - 0x14]
or ecx, 0xffffffff
xor eax, eax
push 0x563924
lea edi, [edx + 0x20204]
push 0x48b2f4
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ecx, [ecx + edx + 0x20204]
push ecx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x4def8c
mov dword [0x50c220], ebx
mov byte [0x4def8c], 0
call fcn.0047a8f8
add esp, 0x18
cmp dword [0x57cd58], 4
jle 0x4119fc
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x4119fc
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edx, dword [ebp - 0x14]
or ecx, 0xffffffff
xor eax, eax
mov byte [0x5639ec], 0
lea edi, [edx + 0x20204]
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea edx, [ecx + edx + 0x20204]
push edx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
lea eax, [ebp - 0x5f0]
push str.system
push eax
call fcn.0047fde0
add esp, 0x20
test eax, eax
jne 0x411937
mov edx, dword [0x57d028]
mov edi, 0x57cb28
mov esi, edx
or ecx, 0xffffffff
shl esi, 6
add esi, 0x54ea88
mov dword [0x57d020], ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
mov dword [0x57d024], ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0xa
mov dword [0x57d028], edx
rep movsb byte es:[edi], byte [esi]
jne 0x411937
mov edi, 0x57cb28
or ecx, 0xffffffff
xor eax, eax
mov dword [0x57d028], ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x54ea88
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x57cdf0]
push 0x563924
shl eax, 9
add eax, 0x547cb0
mov dword [0x57cdf4], ebx
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x411998
mov ecx, dword [0x57cdf0]
push 0x100
shl ecx, 9
add ecx, 0x547cb0
push 0x563924
push ecx
call fcn.0047b120
mov eax, dword [0x57cdf0]
add esp, 0xc
inc eax
cmp eax, 0xa
mov dword [0x57cdf0], eax
jne 0x41199e
xor ebx, ebx
mov dword [0x57cdf0], ebx
jmp 0x4119a0
inc dword [0x57ce20]
xor ebx, ebx
cmp dword [0x57cc34], 1
jne 0x4119f7
cmp dword [0x57cc44], 1
jne 0x4119f7
xor edi, edi
cmp edi, 1
jge 0x4119f7
mov edx, edi
shl edx, 7
lea esi, [edx + str.WBWPM.dll_WBWMD.dll]
push esi
push 0x57cb28
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4119dc
mov dword [0x57cdf4], ebx
push esi
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4119f4
mov dword [0x57cdf4], ebx
inc edi
jmp 0x4119b4
mov ebx, 1
lea eax, [ebp - 0x12f0]
push eax
call fcn.00403990
mov edx, dword [ebp - 0x14]
add esp, 4
lea ecx, [ebp - 0x12f0]
add edx, 0x20204
push ecx
push edx
lea eax, [ebp - 0x34f0]
push 0x491924
push eax
call fcn.0047a8f8
add esp, 0x10
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x513014
push str.SharedTaskScheduler
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x411cd5
mov ebx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea esi, [ebx + 0x20204]
push esi
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x411b66
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x411b66
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4931ec
lea ecx, [ecx + ebx + 0x20204]
push ecx
call fcn.0047a8f8
push str.accountManager.
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.processManager.
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.downAutohc.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService_b.ex
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.procCheck.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
cmp dword [0x57cd58], 2
jle 0x411bd0
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x411bd0
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x48b2f4
lea edx, [ecx + ebx + 0x20204]
push edx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x54fe60
mov dword [0x50be18], 1
mov byte [0x54fe60], 0
call fcn.0047a8f8
add esp, 0x18
cmp dword [0x57cd58], 4
jle 0x411c92
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x411c92
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea eax, [ecx + ebx + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
mov ecx, dword [0x57cdf0]
push 0x563924
shl ecx, 9
add ecx, 0x547cb0
push ecx
call fcn.0047fde0
add esp, 0x20
test eax, eax
je 0x411c92
mov edx, dword [0x57cdf0]
push 0x100
shl edx, 9
add edx, 0x547cb0
push 0x563924
push edx
call fcn.0047b120
mov eax, dword [0x57cdf0]
add esp, 0xc
inc eax
cmp eax, 0xa
mov dword [0x57cdf0], eax
jne 0x411c92
mov dword [0x57cdf0], 0
lea eax, [ebp - 0x13f0]
push eax
call fcn.00403990
add esp, 4
lea ecx, [ebp - 0x13f0]
lea edx, [ebp - 0x2af0]
push ecx
push esi
push 0x491924
push edx
call fcn.0047a8f8
add esp, 0x10
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x513114
push str.Handler
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x411ee9
mov ebx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea esi, [ebx + 0x20204]
push esi
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x411ddc
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x411ddc
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4931c8
lea eax, [ecx + ebx + 0x20204]
push eax
call fcn.0047a8f8
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.regService_b.ex
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.procCheck.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regsvr32.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.procservice.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
cmp dword [0x57cd58], 2
jle 0x411e46
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x411e46
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x48b2f4
lea ecx, [ecx + ebx + 0x20204]
push ecx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x52d3dc
mov dword [0x52d51c], 1
mov byte [0x52d3dc], 0
call fcn.0047a8f8
add esp, 0x18
cmp dword [0x57cd58], 4
jle 0x411ea6
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x411ea6
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea edx, [ecx + ebx + 0x20204]
push edx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
add esp, 0x18
lea eax, [ebp - 0x14f0]
push eax
call fcn.00403990
add esp, 4
lea ecx, [ebp - 0x14f0]
lea edx, [ebp - 0x3af0]
push ecx
push esi
push 0x491924
push edx
call fcn.0047a8f8
add esp, 0x10
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x513194
push 0x49092c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x412167
mov esi, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea ebx, [esi + 0x20204]
push ebx
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x41207f
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x41207f
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x493198
lea eax, [ecx + esi + 0x20204]
push eax
call fcn.0047a8f8
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push 0x494880
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService_b.ex
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.MedusaNo1.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.CCAnti_Virus.ex
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push 0x563924
push 0x563b24
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x412070
push 0x563924
push 0x48ba7c
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x412070
push 0x563924
push str.cmd.exe
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x412070
push 0x563924
push 0x493218
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x412070
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x563b24
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x14]
cmp dword [0x57cd64], 1
jne 0x41207f
inc dword [0x57cd70]
cmp dword [0x57cd58], 2
jle 0x4120c4
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x4120c4
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x48b2f4
lea eax, [ecx + esi + 0x20204]
push eax
call fcn.0047a8f8
add esp, 0xc
cmp dword [0x57cd58], 4
jle 0x412124
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x412124
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea ecx, [ecx + esi + 0x20204]
push ecx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
add esp, 0x18
lea edx, [ebp - 0x15f0]
push edx
call fcn.00403990
add esp, 4
lea eax, [ebp - 0x15f0]
lea ecx, [ebp - 0x2cf0]
push eax
push ebx
push 0x491924
push ecx
call fcn.0047a8f8
add esp, 0x10
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x513014
push 0x48fcac
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41249f
mov ebx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea esi, [ebx + 0x20204]
push esi
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x412336
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x412336
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x49315c
lea edx, [ecx + ebx + 0x20204]
push edx
call fcn.0047a8f8
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.regService_b.ex
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.procCheck.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push 0x48ba7c
push 0x563924
call fcn.0047fde0
add esp, 8
mov edi, 1
test eax, eax
jne 0x41225b
mov dword [0x57cc60], edi
push str.ctfmon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x412277
mov dword [0x57cc70], edi
push str.conime.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x412293
mov dword [0x57cc7c], edi
push str.rundll32.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4122af
mov dword [0x57cc74], edi
push str.svchost.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4122cb
mov dword [0x57cc78], edi
push str.winlogon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4122e7
mov dword [0x57cc64], edi
push str.csrss.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x412303
mov dword [0x57cc80], edi
push str.services.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41231f
mov dword [0x57cc6c], edi
push 0x563924
push 0x48b2f4
push 0x4f1b54
call fcn.0047a8f8
add esp, 0xc
cmp dword [0x57cd58], 2
jle 0x4123a0
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x4123a0
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x48b2f4
lea eax, [ecx + ebx + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x5614e0
mov dword [0x4df5e4], 1
mov byte [0x5614e0], 0
call fcn.0047a8f8
add esp, 0x18
cmp dword [0x57cd58], 4
jle 0x41245c
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x41245c
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea ecx, [ecx + ebx + 0x20204]
push ecx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
lea edx, [ebp - 0x70]
lea eax, [ebp - 0x70]
push edx
push str.iexplore.exe
push eax
lea ecx, [ebp - 0x21f0]
push 0x493248
push ecx
mov dword [0x4f1e14], 1
mov byte [ebp - 0x70], 0x22
mov byte [ebp - 0x6f], 0
call fcn.0047a8f8
lea edx, [ebp - 0x21f0]
push 0x57cb28
push edx
call fcn.0047fde0
add esp, 0x34
test eax, eax
jne 0x41245c
mov dword [0x4df5e4], eax
mov dword [0x4f1e14], eax
jmp 0x40c11c
lea eax, [ebp - 0x16f0]
push eax
call fcn.00403990
add esp, 4
lea ecx, [ebp - 0x16f0]
lea edx, [ebp - 0x36f0]
push ecx
push esi
push 0x491924
push edx
call fcn.0047a8f8
add esp, 0x10
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x513194
push str.PackedCatalogItem
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41287c
mov esi, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea ebx, [esi + 0x20204]
push ebx
call fcn.0047a8f8
push str.REGISTRYMACHINESYSTEM
push 0x50a818
mov byte [0x50a830], 0
call fcn.0047fde0
add esp, 0x18
test eax, eax
jne 0x40c11c
mov eax, dword [0x57cd58]
test eax, eax
jle 0x41276f
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x41276f
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
push 0x563924
push 0x48ba7c
call fcn.0047fde0
add esp, 8
test eax, eax
push 0x563924
jne 0x412555
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x493120
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + esi + 0x20204]
push eax
jmp 0x41256e
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x493100
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ecx, [ecx + esi + 0x20204]
push ecx
call fcn.0047a8f8
add esp, 0xc
mov dword [0x57cc94], 1
push str.regService_b.ex
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.procCheck.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.instlsp.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.instlxp.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.cardMonitor.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.cardMonitorXP.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push 0x563924
push 0x4c552c
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x41276f
push 0x563924
push 0x48ba7c
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x41276f
push 0x563924
push str.cmd.exe
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x41276f
push 0x563924
push 0x493218
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x41276f
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x4c552c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x563924
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 4
jle 0x41276c
push 0x563924
push 0x48b2f4
push 0x519dd0
call fcn.0047a8f8
mov edx, dword [0x57cf5c]
mov edi, 0x519dd0
mov esi, edx
or ecx, 0xffffffff
shl esi, 6
xor eax, eax
add esp, 0xc
add esi, 0x563ca4
mov dword [0x57cf58], 1
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0xa
mov dword [0x57cf5c], edx
rep movsb byte es:[edi], byte [esi]
jne 0x41276c
mov edi, 0x519dd0
or ecx, 0xffffffff
xor eax, eax
mov dword [0x57cf5c], 1
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x563ca4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x14]
cmp dword [0x57cd58], 2
jle 0x4127d9
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x4127d9
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x48b2f4
lea eax, [ecx + esi + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x54be5c
mov dword [0x540f64], 1
mov byte [0x54be5c], 0
call fcn.0047a8f8
add esp, 0x18
cmp dword [0x57cd58], 4
jle 0x412839
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x412839
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea ecx, [ecx + esi + 0x20204]
push ecx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
add esp, 0x18
lea edx, [ebp - 0xc70]
push edx
call fcn.00403990
add esp, 4
lea eax, [ebp - 0xc70]
lea ecx, [ebp - 0x2ef0]
push eax
push ebx
push 0x491924
push ecx
call fcn.0047a8f8
add esp, 0x10
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x513014
push str.ShellServiceObjectDelayLoad
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x412d12
mov edx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea ebx, [edx + 0x20204]
push ebx
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x412adb
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x412adb
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x14]
push 0x4930a0
not ecx
dec ecx
lea ecx, [ecx + eax + 0x20204]
push ecx
call fcn.0047a8f8
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
mov byte [0x50bf20], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x4a4b6c
mov edx, ecx
mov esi, edi
mov edi, 0x50bf20
push 0x54a084
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x563924
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x4a4b6c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x4129a5
mov eax, dword [0x57cebc]
test eax, eax
jle 0x412979
inc dword [eax*4 + 0x57cec0]
mov ecx, dword [0x57ce58]
mov eax, dword [0x57ce5c]
inc ecx
cmp eax, 1
mov dword [0x57ce58], ecx
jne 0x412a37
cmp ecx, dword [0x491408]
jge 0x412a37
jmp 0x40c11c
push 0x48ba7c
push 0x50bf20
mov dword [0x57ce5c], 0
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x412a37
mov edx, dword [0x57cebc]
mov edi, 0x563924
mov eax, edx
shl eax, 6
shl edx, 8
lea ecx, [eax + 0x4f1b94]
xor eax, eax
mov dword [ebp + 8], ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
add edx, 0x54ff60
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
push ecx
call fcn.0046d850
mov eax, dword [0x57cebc]
add esp, 8
inc eax
test eax, eax
mov dword [0x57cebc], eax
jle 0x412a28
inc dword [eax*4 + 0x57cec0]
cmp eax, 0xa
jne 0x412a37
mov dword [0x57cebc], 0
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
push str.ctfmon.exe
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x50bf20
mov edx, ecx
mov esi, edi
mov edi, 0x54a084
mov dword [0x57cc60], 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0047fde0
add esp, 8
mov esi, 1
test eax, eax
jne 0x412a87
mov dword [0x57cc70], esi
push str.winlogon.exe
push 0x50bf20
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x412aa3
mov dword [0x57cc64], esi
push str.services.exe
push 0x50bf20
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x412abf
mov dword [0x57cc6c], esi
push str.svchost.exe
push 0x50bf20
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x412adb
mov dword [0x57cc78], esi
cmp dword [0x57cd58], 2
jle 0x412b48
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x412b48
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x14]
push 0x48b2f4
not ecx
dec ecx
lea ecx, [ecx + eax + 0x20204]
push ecx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x4a51ac
mov dword [0x54bf5c], 1
mov byte [0x4a51ac], 0
call fcn.0047a8f8
add esp, 0x18
cmp dword [0x57cd58], 4
jle 0x412ccf
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x412ccf
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
mov edi, 0x57cb28
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 1
jle 0x412c1f
cmp byte [ecx + 0x57cb28], 0x22
jne 0x412bb1
mov byte [ecx + 0x57cb28], 0
cmp byte [ecx + 0x57cb27], 0x22
jne 0x412bc1
mov byte [ecx + 0x57cb27], 0
cmp byte [0x57cb28], 0x22
jne 0x412c1f
mov edi, 0x57cb28
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x1df0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x57cb28
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 1]
cmp eax, edx
jge 0x412c18
mov dl, byte [ebp + eax - 0x1def]
mov byte [eax + 0x57cb28], dl
inc eax
jmp 0x412c01
mov byte [eax + 0x57cb28], 0
mov edx, dword [ebp - 0x14]
or ecx, 0xffffffff
xor eax, eax
push 0x57cb28
lea ebx, [edx + 0x20204]
push 0x4935cc
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
push 0x57cb28
push 0x48b2f4
push 0x51abd4
mov byte [0x51abd4], 0
call fcn.0047a8f8
push 0x57cb28
push 0x4a2ee0
call fcn.0047fde0
add esp, 0x20
test eax, eax
jne 0x412ca0
mov ecx, dword [0x57ce50]
mov eax, dword [0x57ce54]
inc ecx
cmp eax, 1
mov dword [0x57ce50], ecx
jne 0x412caa
cmp ecx, dword [0x491404]
jge 0x412caa
jmp 0x40c11c
mov dword [0x57ce54], 0
mov edi, 0x57cb28
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x4a2ee0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0xbf0]
push eax
call fcn.00403990
add esp, 4
lea ecx, [ebp - 0xbf0]
lea edx, [ebp - 0x3ef0]
push ecx
push ebx
push 0x491924
push edx
call fcn.0047a8f8
add esp, 0x10
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x513194
push str.CheckedValue
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x41725e
push 0x513194
push str.HideFileExt
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x41725e
push str.List
push 0x51b1d8
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x413208
push str.AuthorizedApplications
push 0x51b1d8
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x413208
push str.SharedAccess
push 0x51b1d8
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x413208
mov eax, dword [ebp - 0x14]
push 0x54a104
add eax, 0x20204
push 0x54bf64
push 0x49480c
push eax
mov dword [ebp + 8], eax
call fcn.0047a8f8
push str.REGISTRYMACHINESYSTEM
push 0x50a818
mov byte [0x50a830], 0
call fcn.0047fde0
add esp, 0x18
test eax, eax
jne 0x40c11c
mov byte [ebp - 0x230], al
mov eax, dword [0x57cd58]
test eax, eax
jle 0x413001
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x413001
mov ebx, dword [sym.imp.USER32.dll_OemToCharA]
push 0x563924
push eax
call ebx
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x230]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x563924
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [ebp - 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push 0x493074
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
push str.regService_b.ex
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.svchost.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push 0x48ba7c
push 0x563924
call fcn.0047fde0
add esp, 8
mov esi, 1
test eax, eax
jne 0x412ec2
mov dword [0x57cc60], esi
push str.ctfmon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x412ede
mov dword [0x57cc70], esi
push str.conime.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x412efa
mov dword [0x57cc7c], esi
push str.winlogon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x412f16
mov dword [0x57cc64], esi
push str.services.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x412f32
mov dword [0x57cc6c], esi
push str.csrss.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x412f4e
mov dword [0x57cc80], esi
mov eax, dword [0x57cd90]
push 0x563924
inc eax
push 0x54c124
mov dword [0x57cd90], eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x412f77
inc dword [0x57ce18]
jmp 0x412fe4
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x48ba7c
mov edx, ecx
mov esi, edi
mov edi, 0x54c124
mov dword [0x57ce18], eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov dword [0x57ce1c], eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x412fe4
push 0x563924
push str.cmd.exe
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x412fe4
push 0x563924
push 0x493218
call fcn.0047fde0
add esp, 8
cmp dword [0x57ce1c], 1
jne 0x413007
mov eax, dword [0x57ce18]
mov ecx, dword [str.__n_n__]
cmp eax, ecx
jge 0x413007
jmp 0x40c11c
mov ebx, dword [sym.imp.USER32.dll_OemToCharA]
cmp dword [0x57cd58], 2
jle 0x41304a
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x41304a
push 0x563924
push eax
call ebx
push 0x563924
push 0x48b2f4
push 0x51add8
mov dword [0x563f24], 1
mov byte [0x51add8], 0
call fcn.0047a8f8
add esp, 0xc
cmp dword [0x57cd58], 4
jle 0x4131c2
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x4131c2
push 0x563924
push eax
call ebx
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x563924
push 0x4935cc
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
mov edi, 0x57cb28
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 1
jle 0x4131c2
push 0x48b7ec
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x40c11c
lea ecx, [ebp - 0x1870]
push ecx
push 0x57cb28
call fcn.0046dd70
mov edx, dword [0x57ceb8]
add esp, 8
test edx, edx
jle 0x413151
shl edx, 8
lea eax, [ebp - 0x1870]
lea ecx, [edx + 0x50ee48]
push eax
push ecx
call fcn.0047fde0
mov edx, dword [0x57ceb8]
add esp, 8
test eax, eax
je 0x4131b3
mov ebx, edx
lea edi, [ebp - 0x1870]
or ecx, 0xffffffff
xor eax, eax
shl ebx, 8
repne scasb al, byte es:[edi]
not ecx
lea esi, [ebx + 0x50ef48]
sub edi, ecx
mov dword [ebp - 0x18], esi
mov esi, edi
mov edi, dword [ebp - 0x18]
mov eax, ecx
jmp 0x413177
mov ebx, edx
lea edi, [ebp - 0x1870]
or ecx, 0xffffffff
xor eax, eax
shl ebx, 8
repne scasb al, byte es:[edi]
not ecx
lea esi, [ebx + 0x50ef48]
sub edi, ecx
mov dword [ebp - 0x18], esi
mov esi, edi
mov edi, dword [ebp - 0x18]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
lea ebx, [ebx + 0x51a1d4]
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x230]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
mov dword [0x57ceb8], edx
cmp edx, 0xa
jne 0x4131c2
mov dword [0x57ceb8], 0
lea ecx, [ebp - 0x1770]
push ecx
call fcn.00403990
mov eax, dword [ebp + 8]
add esp, 4
lea edx, [ebp - 0x1770]
lea ecx, [ebp - 0x25f0]
push edx
push eax
push 0x491924
push ecx
call fcn.0047a8f8
add esp, 0x10
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x513194
push str.DisableTaskmgr
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4136fb
mov esi, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea ebx, [esi + 0x20204]
push ebx
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x413577
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x413577
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x493040
lea edx, [ecx + esi + 0x20204]
push edx
call fcn.0047a8f8
push str.regsecurity.exe
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.procService.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService_b.ex
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.procCheck.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push 0x48ba7c
push 0x563924
call fcn.0047fde0
add esp, 8
mov esi, 1
test eax, eax
jne 0x413330
mov dword [0x57cc60], esi
push str.ctfmon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41334c
mov dword [0x57cc70], esi
push str.conime.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x413368
mov dword [0x57cc7c], esi
push str.rundll32.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x413384
mov dword [0x57cc74], esi
push str.svchost.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4133a0
mov dword [0x57cc78], esi
push str.winlogon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4133bc
mov dword [0x57cc64], esi
push str.csrss.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4133d8
mov dword [0x57cc80], esi
push str.services.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4133f4
mov dword [0x57cc6c], esi
cmp dword [0x57cd64], esi
jne 0x413402
inc dword [0x57cd78]
push 0x563924
push 0x52d35c
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x413577
push 0x563924
push str.regedit.exe
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x413577
push 0x563924
push str.winlogon.exe
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x413577
push 0x563924
push 0x48ba7c
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x413577
push 0x563924
push str.cmd.exe
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x413577
push 0x563924
push str.mmc.exe
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x413577
cmp dword [0x57cd58], 2
jle 0x41360a
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x41360a
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x563924
push 0x48b2f4
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
mov esi, 1
push 0x48b2f4
push 0x54e078
mov dword [0x4e192c], esi
mov byte [0x54e078], 0
call fcn.0047a8f8
mov ecx, dword [0x57ccc0]
mov eax, dword [0x57ccec]
add esp, 0x18
inc ecx
cmp eax, esi
mov dword [0x57ccc0], ecx
jne 0x41360a
mov eax, ecx
cmp eax, 0x10
jl 0x40c11c
cmp dword [0x57cd58], 4
jle 0x4136b8
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x4136b8
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x563924
push 0x4935cc
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
push 0x493024
push 0x57cb28
call fcn.0047fde0
add esp, 0x20
test eax, eax
je 0x4136b8
push 0x493024
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x4136b8
push 0x493020
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x40c11c
lea ecx, [ebp - 0xd70]
push ecx
call fcn.00403990
add esp, 4
lea edx, [ebp - 0xd70]
lea eax, [ebp - 0x38f0]
push edx
push ebx
push 0x491924
push eax
call fcn.0047a8f8
add esp, 0x10
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x513014
push str.ServiceGroupOrder
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4139c9
push 0x513194
push str.List
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4139c9
mov ebx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea esi, [ebx + 0x20204]
push esi
call fcn.0047a8f8
push str.REGISTRYMACHINESYSTEM
push 0x50a818
mov byte [0x50a830], 0
call fcn.0047fde0
add esp, 0x18
test eax, eax
jne 0x40c11c
mov eax, dword [0x57cd58]
test eax, eax
jle 0x4138bc
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x4138bc
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x493004
lea ecx, [ecx + ebx + 0x20204]
push ecx
call fcn.0047a8f8
push str.accountManager.
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.processManager.
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.downAutohc.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.procCheck.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService_b.ex
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.instlsp.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.instlxp.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.cardMonitor.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.cardMonitorXP.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
cmp dword [0x57cd58], 2
jle 0x413926
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x413926
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x48b2f4
lea edx, [ecx + ebx + 0x20204]
push edx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x519e10
mov dword [0x4dec88], 1
mov byte [0x519e10], 0
call fcn.0047a8f8
add esp, 0x18
cmp dword [0x57cd58], 4
jle 0x413986
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x413986
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea eax, [ecx + ebx + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
add esp, 0x18
lea ecx, [ebp - 0x1470]
push ecx
call fcn.00403990
add esp, 4
lea edx, [ebp - 0x1470]
lea eax, [ebp - 0x32f0]
push edx
push esi
push 0x491924
push eax
call fcn.0047a8f8
add esp, 0x10
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x513194
push str.SCRNSAVE.EXE
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x413c84
mov ebx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea esi, [ebx + 0x20204]
push esi
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x413b77
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x413b77
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x492fe0
lea ecx, [ecx + ebx + 0x20204]
push ecx
call fcn.0047a8f8
push str.regService_b.ex
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.procCheck.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.winlogon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
mov edi, 1
test eax, eax
jne 0x413abd
mov dword [0x57cc64], edi
push str.csrss.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x413ad9
mov dword [0x57cc80], edi
push str.services.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x413af5
mov dword [0x57cc6c], edi
push str.svchost.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x413b11
mov dword [0x57cc78], edi
push str.ctfmon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x413b2d
mov dword [0x57cc70], edi
mov eax, dword [0x57cc64]
test eax, eax
jne 0x413b77
mov eax, dword [0x57cc6c]
test eax, eax
jne 0x413b77
mov eax, dword [0x57cc78]
test eax, eax
jne 0x413b77
mov eax, dword [0x57cc70]
test eax, eax
jne 0x413b77
mov eax, dword [0x57cc80]
test eax, eax
jne 0x413b77
push 0x563924
push 0x48b2f4
push 0x4a4d6c
call fcn.0047a8f8
add esp, 0xc
mov dword [0x57cf78], edi
cmp dword [0x57cd58], 2
jle 0x413be1
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x413be1
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x48b2f4
lea edx, [ecx + ebx + 0x20204]
push edx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x561864
mov dword [0x54b7d0], 1
mov byte [0x561864], 0
call fcn.0047a8f8
add esp, 0x18
cmp dword [0x57cd58], 4
jle 0x413c41
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x413c41
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea eax, [ecx + ebx + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
add esp, 0x18
lea ecx, [ebp - 0xe70]
push ecx
call fcn.00403990
add esp, 4
lea edx, [ebp - 0xe70]
lea eax, [ebp - 0x26f0]
push edx
push esi
push 0x491924
push eax
call fcn.0047a8f8
add esp, 0x10
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x513194
push 0x4907ec
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x414076
mov esi, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea ebx, [esi + 0x20204]
push ebx
call fcn.0047a8f8
push str.REGISTRYMACHINESOFTWAREMicrosoft
push 0x50a818
mov byte [0x50a83c], 0
call fcn.0047fde0
add esp, 0x18
test eax, eax
jne 0x40c11c
mov eax, dword [0x57cd58]
test eax, eax
jle 0x413f3f
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x413f3f
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x492f94
lea ecx, [ecx + esi + 0x20204]
push ecx
call fcn.0047a8f8
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.ctfmon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
mov esi, 1
test eax, eax
jne 0x413d62
mov dword [0x57cc70], esi
push str.conime.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x413d7e
mov dword [0x57cc7c], esi
push str.rundll32.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x413d9a
mov dword [0x57cc74], esi
push str.csrss.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x413db6
mov dword [0x57cc80], esi
push str.winlogon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x413dd2
mov dword [0x57cc64], esi
push str.services.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x413dee
mov dword [0x57cc6c], esi
push str.svchost.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x413e0a
mov dword [0x57cc78], esi
push 0x563924
push 0x4a2e60
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x413f01
push 0x563924
push 0x48ba7c
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x413f01
push 0x563924
push str.cmd.exe
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x413f01
push 0x563924
push 0x493218
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x413f01
push 0x48ba7c
push 0x4a2e60
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x413ef1
mov edx, dword [0x57ceec]
mov edi, 0x563924
mov esi, edx
or ecx, 0xffffffff
shl esi, 6
xor eax, eax
add esi, 0x549f40
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
test edx, edx
rep movsb byte es:[edi], byte [esi]
mov dword [0x57ceec], edx
jle 0x413ed1
inc dword [edx*4 + 0x57cef0]
cmp edx, 5
jne 0x413ee0
mov dword [0x57ceec], 0
mov dword [0x57cef0], 1
mov esi, 1
jmp 0x413f01
mov eax, dword [0x57ceec]
test eax, eax
jle 0x413f01
inc dword [eax*4 + 0x57cef0]
mov eax, dword [0x57cde8]
inc eax
cmp eax, 5
mov dword [0x57cde8], eax
jle 0x413f17
mov dword [0x57cdec], esi
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x4a2e60
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x14]
cmp dword [0x57cd58], 2
jle 0x413fd3
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x413fd3
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x48b2f4
lea eax, [ecx + esi + 0x20204]
push eax
call fcn.0047a8f8
mov ecx, dword [0x57ccb8]
mov eax, dword [0x57cce4]
add esp, 0xc
inc ecx
cmp eax, 1
mov dword [0x57ccb8], ecx
jne 0x413fab
cmp ecx, dword [0x48bb8c]
jl 0x40c11c
push 0x563924
push 0x48b2f4
push 0x51b458
mov dword [0x50be1c], 1
mov byte [0x51b458], 0
call fcn.0047a8f8
add esp, 0xc
cmp dword [0x57cd58], 4
jle 0x414033
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x414033
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea edx, [ecx + esi + 0x20204]
push edx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
add esp, 0x18
lea eax, [ebp - 0x1a70]
push eax
call fcn.00403990
add esp, 4
lea ecx, [ebp - 0x1a70]
lea edx, [ebp - 0x27f0]
push ecx
push ebx
push 0x491924
push edx
call fcn.0047a8f8
add esp, 0x10
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x513114
push str.Minimal
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x416f6d
push 0x513114
push str.Network
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x416f6d
push 0x513114
push str.Zones
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x414424
mov esi, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea ebx, [esi + 0x20204]
push ebx
call fcn.0047a8f8
push str.Internet_Settings
push 0x50a818
call fcn.0047bec0
add esp, 0x18
test eax, eax
je 0x40c11c
mov eax, dword [0x57cd58]
test eax, eax
jle 0x414317
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x414317
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x492f5c
lea eax, [ecx + esi + 0x20204]
push eax
call fcn.0047a8f8
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
push 0x48ba7c
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x563924
mov edi, ecx
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x414177
mov dword [0x57cc60], 1
push str.ctfmon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x414197
mov dword [0x57cc70], 1
push str.conime.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4141b7
mov dword [0x57cc7c], 1
push str.rundll32.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4141d7
mov dword [0x57cc74], 1
push str.svchost.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4141f7
mov dword [0x57cc78], 1
push str.winlogon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x414217
mov dword [0x57cc64], 1
push str.csrss.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x414237
mov dword [0x57cc80], 1
push str.services.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x414257
mov dword [0x57cc6c], 1
cmp edi, 4
jle 0x414317
mov eax, dword [0x57cc64]
test eax, eax
jne 0x414317
mov eax, dword [0x57cc6c]
test eax, eax
jne 0x414317
mov eax, dword [0x57cc78]
test eax, eax
jne 0x414317
mov eax, dword [0x57cc70]
test eax, eax
jne 0x414317
cmp dword [0x57cd58], 2
jle 0x414381
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x414381
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x48b2f4
lea ecx, [ecx + esi + 0x20204]
push ecx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x4a406c
mov dword [0x54be58], 1
mov byte [0x4a406c], 0
call fcn.0047a8f8
add esp, 0x18
cmp dword [0x57cd58], 4
jle 0x4143e1
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x4143e1
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea edx, [ecx + esi + 0x20204]
push edx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
add esp, 0x18
lea eax, [ebp - 0xf70]
push eax
call fcn.00403990
add esp, 4
lea ecx, [ebp - 0xf70]
lea edx, [ebp - 0x29f0]
push ecx
push ebx
push 0x491924
push edx
call fcn.0047a8f8
add esp, 0x10
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x513194
push 0x49082c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x414758
mov esi, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea ebx, [esi + 0x20204]
push ebx
call fcn.0047a8f8
push str.REGISTRYUSER
push 0x50a818
mov byte [0x50a826], 0
call fcn.0047fde0
add esp, 0x18
test eax, eax
jne 0x40c11c
mov eax, dword [0x57cd58]
test eax, eax
jle 0x41464b
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x41464b
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x492f30
lea eax, [ecx + esi + 0x20204]
push eax
call fcn.0047a8f8
push str.accountManager.
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.processManager.
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.downAutohc.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService_b.ex
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.procCheck.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.instlsp.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.instlxp.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.cardMonitor.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.cardMonitorXP.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push 0x563924
push 0x4a2fe8
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x41464b
push 0x563924
push 0x48ba7c
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x41464b
cmp dword [0x57cd58], 2
jle 0x4146b5
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x4146b5
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x48b2f4
lea eax, [ecx + esi + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x50bfa0
mov dword [0x545c68], 1
mov byte [0x50bfa0], 0
call fcn.0047a8f8
add esp, 0x18
cmp dword [0x57cd58], 4
jle 0x414715
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x414715
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea ecx, [ecx + esi + 0x20204]
push ecx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
add esp, 0x18
lea edx, [ebp - 0x1570]
push edx
call fcn.00403990
add esp, 4
lea eax, [ebp - 0x1570]
lea ecx, [ebp - 0x2bf0]
push eax
push ebx
push 0x491924
push ecx
call fcn.0047a8f8
add esp, 0x10
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x513014
push str.runonce
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x416819
push 0x513014
push str.runonceEx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x416819
push 0x513194
push 0x4908ac
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x414a39
mov ebx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea esi, [ebx + 0x20204]
push esi
call fcn.0047a8f8
push str.MicrosoftRAS
push 0x50a818
call fcn.0047bec0
add esp, 0x18
test eax, eax
je 0x40c11c
mov eax, dword [0x57cd58]
test eax, eax
jle 0x41492c
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x41492c
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x492ef8
lea edx, [ecx + ebx + 0x20204]
push edx
call fcn.0047a8f8
push str.accountManager.
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.processManager.
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.downAutohc.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService_b.ex
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.procCheck.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.instlsp.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.instlxp.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.cardMonitor.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
cmp dword [0x57cd58], 2
jle 0x414996
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x414996
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x48b2f4
lea eax, [ecx + ebx + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x50f948
mov dword [0x51931c], 1
mov byte [0x50f948], 0
call fcn.0047a8f8
add esp, 0x18
cmp dword [0x57cd58], 4
jle 0x4149f6
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x4149f6
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea ecx, [ecx + ebx + 0x20204]
push ecx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
add esp, 0x18
lea edx, [ebp - 0x1070]
push edx
call fcn.00403990
add esp, 4
lea eax, [ebp - 0x1070]
lea ecx, [ebp - 0x2df0]
push eax
push esi
push 0x491924
push ecx
call fcn.0047a8f8
add esp, 0x10
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x513194
push 0x4908ec
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x414ea6
mov ebx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea esi, [ebx + 0x20204]
push esi
mov dword [ebp + 8], esi
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x414bb8
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x414bb8
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x492ecc
lea edx, [ecx + ebx + 0x20204]
push edx
call fcn.0047a8f8
push str.procservice.exe
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.regService_b.ex
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.procCheck.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push 0x563924
lea eax, [ebp - 0xf0]
push 0x48b2f4
push eax
call fcn.0047a8f8
push 0x563924
push 0x52d35c
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x414ba9
push 0x563924
push str.cmd.exe
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x414ba9
push 0x563924
push 0x493218
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x414ba9
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x52d35c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 8]
cmp dword [0x57cd64], 1
jne 0x414bb8
inc dword [0x57cd7c]
cmp dword [0x57cd58], 2
jle 0x414c22
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x414c22
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x48b2f4
lea eax, [ecx + ebx + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x4df454
mov dword [0x4ca230], 1
mov byte [0x4df454], 0
call fcn.0047a8f8
add esp, 0x18
cmp dword [0x57cd58], 4
jle 0x414e60
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x414e60
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea ecx, [ecx + ebx + 0x20204]
push ecx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
push 0x493024
push 0x57cb28
call fcn.0047bec0
add esp, 0x20
test eax, eax
je 0x414e60
lea edi, [ebp - 0xf0]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xf0]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x48ba7c
push edx
mov edi, ecx
call fcn.0047fde0
add esp, 8
mov esi, 1
test eax, eax
jne 0x414cd7
mov dword [0x57cc60], esi
lea eax, [ebp - 0xf0]
push str.ctfmon.exe
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x414cf5
mov dword [0x57cc70], esi
lea ecx, [ebp - 0xf0]
push str.conime.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x414d13
mov dword [0x57cc7c], esi
lea edx, [ebp - 0xf0]
push str.rundll32.exe
push edx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x414d31
mov dword [0x57cc74], esi
lea eax, [ebp - 0xf0]
push str.svchost.exe
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x414d4f
mov dword [0x57cc78], esi
lea ecx, [ebp - 0xf0]
push str.winlogon.exe
push ecx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x414d6d
lea ecx, [ebp - 0x18f0]
push ecx
call fcn.00403990
mov eax, dword [ebp + 8]
add esp, 4
lea edx, [ebp - 0x18f0]
lea ecx, [ebp - 0x2ff0]
push edx
push eax
push 0x491924
push ecx
call fcn.0047a8f8
add esp, 0x10
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x513114
push str.App_Paths
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x415207
mov esi, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea eax, [esi + 0x20204]
push eax
mov dword [ebp + 8], eax
call fcn.0047a8f8
push str.REGISTRYMACHINESoftwareMicrosoft
push 0x50a818
mov byte [0x50a83c], 0
call fcn.0047fde0
add esp, 0x18
test eax, eax
jne 0x40c11c
mov eax, dword [0x57cd58]
test eax, eax
jle 0x414fec
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x414fec
mov ebx, dword [sym.imp.USER32.dll_OemToCharA]
push 0x563924
push eax
call ebx
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x492ea8
lea edx, [ecx + esi + 0x20204]
push edx
call fcn.0047a8f8
push str.accountManager.
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.processManager.
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.downAutohc.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService_b.ex
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.procCheck.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x414ff2
jmp 0x40c11c
mov ebx, dword [sym.imp.USER32.dll_OemToCharA]
cmp dword [0x57cd58], 2
jle 0x41504f
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x41504f
push 0x563924
push eax
call ebx
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x48b2f4
lea eax, [ecx + esi + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x561ce4
mov byte [0x561ce4], 0
call fcn.0047a8f8
add esp, 0x18
cmp dword [0x57cd58], 4
jle 0x4151b4
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x4151b4
push 0x563924
push eax
call ebx
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea ecx, [ecx + esi + 0x20204]
push ecx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
push str.cmd.exe
push 0x57cb28
call fcn.0047bec0
add esp, 0x20
mov esi, 1
test eax, eax
je 0x4150d2
mov dword [0x54d9b4], esi
push str.cmd.exe
push 0x513014
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4150ee
mov dword [0x54d9b4], esi
push str.regedit.exe
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41510a
mov dword [0x54d9b4], esi
push str.regedit.exe
push 0x513014
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x415126
mov dword [0x54d9b4], esi
push str.notepad.exe
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x415142
mov esi, 1
lea edx, [ebp - 0x1170]
push edx
call fcn.00403990
mov ecx, dword [ebp + 8]
add esp, 4
lea eax, [ebp - 0x1170]
lea edx, [ebp - 0x31f0]
push eax
push ecx
push 0x491924
push edx
call fcn.0047a8f8
mov ecx, dword [0x54d9b4]
add esp, 0x10
xor eax, eax
cmp ecx, esi
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x513014
push str.0000
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4165fa
push 0x513194
push str.0000
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4165fa
push 0x513014
push str.RestrictRun
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x415483
push 0x513114
push 0x492e80
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x415483
mov ebx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea esi, [ebx + 0x20204]
push esi
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x415376
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x415376
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x492e5c
lea eax, [ecx + ebx + 0x20204]
push eax
call fcn.0047a8f8
push str.accountManager.
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.processManager.
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.downAutohc.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService_b.ex
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
cmp dword [0x57cd58], 2
jle 0x4153d6
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x4153d6
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x48b2f4
lea ecx, [ecx + ebx + 0x20204]
push ecx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x564a28
mov byte [0x564a28], 0
call fcn.0047a8f8
add esp, 0x18
cmp dword [0x57cd58], 4
jle 0x415440
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x415440
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea edx, [ecx + ebx + 0x20204]
push edx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
add esp, 0x18
mov dword [0x4e1930], 1
lea eax, [ebp - 0x1670]
push eax
call fcn.00403990
add esp, 4
lea ecx, [ebp - 0x1670]
lea edx, [ebp - 0x33f0]
push ecx
push esi
push 0x491924
push edx
call fcn.0047a8f8
add esp, 0x10
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x513194
push 0x49096c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41564a
push str.REGISTRYMACHINESOFTWAREMicrosoftCommand_Processor
push 0x50a818
mov byte [0x50a84e], al
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c11c
mov ebx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea esi, [ebx + 0x20204]
push esi
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x4155ce
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x4155ce
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x492e00
lea eax, [ecx + ebx + 0x20204]
push eax
call fcn.0047a8f8
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.procCheck.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService_b.ex
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
cmp dword [0x57cd58], 2
jle 0x40f8b9
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x40f8b9
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x49338c
lea ecx, [ecx + ebx + 0x20204]
push ecx
call fcn.0047a8f8
push 0x563924
mov eax, 1
push 0x48b2f4
push 0x519728
mov dword [0x519f10], eax
mov dword [0x52f520], eax
mov byte [0x519728], 0
call fcn.0047a8f8
add esp, 0x18
jmp 0x40f8b9
push 0x513194
push str.PendingFileRenameOperations
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x415aaf
mov ebx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea esi, [ebx + 0x20204]
push esi
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
mov dword [ebp + 8], 0
jle 0x415817
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x415817
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x492ddc
lea eax, [ecx + ebx + 0x20204]
push eax
call fcn.0047a8f8
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x48b2f4
mov dword [ebp + 8], ecx
lea ecx, [ebp - 0x5b0]
push ecx
call fcn.0047a8f8
push str.UNWISE.EXE
push 0x563924
call fcn.0047fde0
add esp, 0x20
test eax, eax
je 0x40c11c
push str.unwise.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push 0x48ba7c
push 0x563924
call fcn.0047fde0
add esp, 8
mov edi, 1
test eax, eax
jne 0x415753
cmp dword [0x57cd58], 2
jle 0x415881
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x415881
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x49338c
lea edx, [ecx + ebx + 0x20204]
push edx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x519a28
mov dword [0x54e178], 1
mov byte [0x519a28], 0
call fcn.0047a8f8
add esp, 0x18
cmp dword [0x57cd58], 4
jle 0x41650d
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x41650d
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea eax, [ecx + ebx + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
push str.ProgramsDatapanose.dat
push 0x57cb28
call fcn.0047bec0
add esp, 0x20
test eax, eax
jne 0x40c11c
push 0x513194
push 0x4909ec
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x416525
push 0x513194
push 0x490a2c
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x416525
push 0x513194
push 0x490a6c
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x416525
push 0x513194
push str.DisableCMD
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x415d8f
mov esi, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea ebx, [esi + 0x20204]
push ebx
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x415cb5
push 0x513014
push 0x48ff2c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4161a9
cmp dword [0x57cd58], 4
jle 0x41650d
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x41650d
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea eax, [ecx + ebx + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
add esp, 0x18
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea esi, [ebx + 0x20204]
push esi
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x41658b
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x41658b
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x492c7c
lea ecx, [ecx + ebx + 0x20204]
push ecx
call fcn.0047a8f8
add esp, 0xc
cmp dword [0x57cd58], 2
jle 0x4164ad
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x4164ad
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x49338c
lea edx, [ecx + ebx + 0x20204]
push edx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
mov dword [0x510e4c], 1
mov byte [0x561360], 0
push 0x561360
jmp 0x4164a5
mov ebx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea esi, [ebx + 0x20204]
push esi
call fcn.0047a8f8
push str.REGISTRYMACHINESYSTEMCurrentControlSetEnumRoot
push 0x50a818
mov byte [0x50a84c], 0
call fcn.0047fde0
add esp, 0x18
test eax, eax
jne 0x40c11c
mov eax, dword [0x57cd58]
test eax, eax
jle 0x41671f
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x41671f
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x492c28
lea ecx, [ecx + ebx + 0x20204]
push ecx
call fcn.0047a8f8
push str.accountManager.
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.processManager.
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.downAutohc.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService_b.ex
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.procCheck.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
cmp dword [0x57cd58], 2
jle 0x41677f
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x41677f
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x48b2f4
lea edx, [ecx + ebx + 0x20204]
push edx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x4df08c
mov byte [0x4df08c], 0
call fcn.0047a8f8
add esp, 0x18
cmp dword [0x57cd58], 4
jle 0x4167e9
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x4167e9
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea eax, [ecx + ebx + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
add esp, 0x18
mov dword [0x5468ac], 1
lea ecx, [ebp - 0x1270]
push ecx
call fcn.00403990
add esp, 4
lea edx, [ebp - 0x1270]
lea eax, [ebp - 0x35f0]
push edx
push esi
push 0x491924
push eax
call fcn.0047a8f8
add esp, 0x10
jmp 0x41650d
push str.REGISTRYMACHINESoftwareMicrosoft
push 0x50a818
mov byte [0x50a83c], 0
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x416857
push str.REGISTRYUSER
push 0x50a818
mov byte [0x50a826], 0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c11c
mov ebx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea esi, [ebx + 0x20204]
push esi
call fcn.0047a8f8
add esp, 0x10
lea ecx, [ebp - 0x1bf0]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, dword [0x57cd58]
mov dword [ebp + 8], 0
test eax, eax
jle 0x416a8b
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x416a8b
push 0x563924
push eax
mov dword [0x4e02a8], 0
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x492c00
lea edx, [ecx + ebx + 0x20204]
push edx
call fcn.0047a8f8
push 0x48ba7c
push 0x563924
mov dword [0x54a080], 1
call fcn.0047fde0
add esp, 0x14
mov edi, 1
test eax, eax
jne 0x416910
mov dword [0x4df40c], edi
push str.iexplore.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41692c
mov dword [0x4df40c], edi
push str.winlogon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x416948
mov dword [0x4df40c], edi
push str.smss.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x416964
mov dword [0x4df40c], edi
push str.csrss.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x416980
mov dword [0x4df40c], edi
push str.services.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41699c
mov dword [0x4df40c], edi
push 0x48ba7c
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4169b8
mov dword [0x57cc60], edi
push str.ctfmon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4169d4
mov dword [0x57cc70], edi
push str.rundll32.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4169f0
mov dword [0x57cc74], edi
push str.winlogon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x416a0c
mov dword [0x57cc64], edi
push str.services.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x416a28
cmp dword [0x57cd58], 2
jle 0x416aeb
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x416aeb
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x48b2f4
lea ecx, [ecx + ebx + 0x20204]
push ecx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x54e800
mov byte [0x54e800], 0
call fcn.0047a8f8
add esp, 0x18
cmp dword [0x57cd58], 4
jle 0x41650d
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x41650d
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea edx, [ecx + ebx + 0x20204]
push edx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x4a3b6c
call fcn.0047a8f8
push str.RisingRavUpdate_setup.exe
push 0x57cb28
call fcn.0047bec0
add esp, 0x2c
test eax, eax
jne 0x40c11c
push 0x492024
push 0x57cb28
call fcn.0047bec0
add esp, 8
mov ebx, 1
test eax, eax
jne 0x416b9f
mov dword [0x52d1d8], ebx
lea eax, [ebp - 0x1bf0]
push eax
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x416bbd
mov dword [0x52d1d8], ebx
push str.windows
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x416bd9
mov dword [0x52d1d8], ebx
push 0x492bb4
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x416bf5
mov dword [0x52d1d8], ebx
push str.WINNT
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x416c11
mov dword [0x52d1d8], ebx
push str.winnt
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x416c2d
mov dword [0x52d1d8], ebx
push str.drivers
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x416c49
mov dword [0x52d1d8], ebx
push str.System_
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x416c65
mov esi, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea ebx, [esi + 0x20204]
push ebx
mov dword [ebp + 8], ebx
call fcn.0047a8f8
push str.SafeBoot
push 0x50a818
call fcn.0047bec0
add esp, 0x18
test eax, eax
jne 0x416fbe
push str.safeboot
push 0x50a818
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x40c11c
push str.REGISTRYMACHINESYSTEM
push 0x50a818
mov byte [0x50a830], 0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c11c
mov eax, dword [0x57cd58]
test eax, eax
jle 0x4170d6
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x4170d6
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x492abc
lea ecx, [ecx + esi + 0x20204]
push ecx
call fcn.0047a8f8
push 0x563924
push 0x519b28
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x4170d6
push 0x563924
push str.regedit.exe
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4170d6
push 0x563924
push str.dit.exe
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4170d6
push 0x563924
push 0x48ba7c
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4170d6
push 0x563924
push str.cmd.exe
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4170d6
push 0x563924
push 0x493218
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4170d6
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x519b28
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x57cd58], 2
jle 0x4171cb
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x4171cb
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x14]
push 0x48b2f4
not ecx
dec ecx
lea ecx, [ecx + eax + 0x20204]
push ecx
call fcn.0047a8f8
push 0x563924
mov esi, 1
push 0x48b2f4
push 0x4cbf80
mov dword [0x54fc50], esi
mov byte [0x4cbf80], 0
call fcn.0047a8f8
mov ebx, dword [0x57cda0]
mov edi, 0x513014
mov edx, ebx
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
shl edx, 8
repne scasb al, byte es:[edi]
not ecx
mov dword [0x57cd98], esi
lea esi, [edx + 0x50aa18]
sub edi, ecx
mov dword [ebp - 0x18], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x18]
lea edx, [edx + 0x4e02ac]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4cbf80
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc ebx
cmp ebx, 0x14
mov dword [0x57cda0], ebx
rep movsb byte es:[edi], byte [esi]
jne 0x4171c8
mov dword [0x57cda0], 0
mov ebx, dword [ebp + 8]
cmp dword [0x57cd58], 4
jle 0x41722e
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x41722e
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x563924
push 0x4935cc
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
add esp, 0x18
lea ecx, [ebp - 0x1370]
push ecx
call fcn.00403990
add esp, 4
lea edx, [ebp - 0x1370]
lea eax, [ebp - 0x37f0]
push edx
push ebx
push 0x491924
push eax
call fcn.0047a8f8
add esp, 0x10
jmp 0x41650d
mov ecx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea ebx, [ecx + 0x20204]
push ebx
call fcn.0047a8f8
push str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push 0x50a818
mov byte [0x50a865], 0
xor esi, esi
call fcn.0047fde0
add esp, 0x18
test eax, eax
jne 0x4172a0
mov esi, 1
push str.Advanced
push 0x513014
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4172be
test esi, esi
je 0x40c11c
mov eax, dword [0x57cd58]
test eax, eax
jle 0x41751d
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x41751d
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x563924
push 0x492a38
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
push str.regService_b.ex
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.ctfmon.exe
push 0x50bf20
call fcn.0047fde0
add esp, 8
mov esi, 1
test eax, eax
jne 0x417360
mov dword [0x57cc70], esi
push str.winlogon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41737c
mov dword [0x57cc64], esi
push str.svchost.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x417398
mov dword [0x57cc78], esi
push str.services.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4173b4
mov dword [0x57cc6c], esi
push 0x48ba7c
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x417442
push 0x563924
push 0x48b2f4
push 0x50e230
mov dword [0x57cc88], 1
call fcn.0047a8f8
mov edx, dword [0x57cfe4]
mov edi, 0x50e230
mov esi, edx
or ecx, 0xffffffff
shl esi, 6
xor eax, eax
add esp, 0xc
add esi, 0x4a3168
mov dword [0x57cfe0], 1
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0xa
mov dword [0x57cfe4], edx
rep movsb byte es:[edi], byte [esi]
jne 0x417442
mov dword [0x57cfe4], 0
push 0x54acd0
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4174a0
mov edi, dword [0x57cca8]
or ecx, 0xffffffff
inc edi
mov dword [0x57cca8], edi
mov edi, 0x563924
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, dword [0x57ccd4]
mov edx, ecx
mov esi, edi
mov edi, 0x54fd54
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
jne 0x4174e8
cmp dword [0x57cca8], 0x10
jge 0x4174e8
jmp 0x40c11c
push 0x563924
push 0x48ba7c
mov dword [0x57ccd4], 0
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4174e8
push 0x563924
push str.cmd.exe
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4174e8
push 0x563924
push 0x493218
call fcn.0047fde0
add esp, 8
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x54acd0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x57cd64]
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
jne 0x41751d
inc dword [0x57cd74]
cmp dword [0x57cd58], 2
jle 0x41758a
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x41758a
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x563924
push 0x48b2f4
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x54be5c
mov dword [0x540f64], 1
mov byte [0x54be5c], 0
call fcn.0047a8f8
add esp, 0x18
cmp dword [0x57cd58], 4
jle 0x4175ed
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x4175ed
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x563924
push 0x4935cc
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
add esp, 0x18
lea ecx, [ebp - 0xaf0]
push ecx
call fcn.00403990
add esp, 4
lea edx, [ebp - 0xaf0]
lea eax, [ebp - 0x39f0]
push edx
push ebx
push 0x491924
push eax
call fcn.0047a8f8
add esp, 0x10
jmp 0x41650d
push str.REGISTRYMACHINESOFTWAREMicrosoftInternet_Explorer
push 0x50a818
mov byte [0x50a84e], 0
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x41765b
push str.REGISTRYUSER
push 0x50a818
mov byte [0x50a826], 0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c11c
mov ebx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea esi, [ebx + 0x20204]
push esi
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x417710
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x417710
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4929e4
lea ecx, [ecx + ebx + 0x20204]
push ecx
call fcn.0047a8f8
push str.processManager.
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.procCheck.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
cmp dword [0x57cd58], 2
jle 0x417755
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x417755
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x48b2f4
lea edx, [ecx + ebx + 0x20204]
push edx
call fcn.0047a8f8
add esp, 0xc
cmp dword [0x57cd58], 4
jle 0x41650d
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x41650d
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea eax, [ecx + ebx + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov dword [0x54fe5c], 1
mov byte [0x57cb28], 0
call fcn.0047a8f8
push str..ico
push 0x57cb28
call fcn.0047bec0
add esp, 0x20
test eax, eax
jne 0x40c11c
push str..ICO
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x40c11c
jmp 0x41650d
push str.REGISTRYMACHINESOFTWAREMicrosoftInternet_Explorer
push 0x50a818
mov byte [0x50a84e], 0
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x41783b
push str.REGISTRYUSER
push 0x50a818
mov byte [0x50a826], 0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c11c
push str.CmdMapping
push 0x513194
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
mov ebx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea esi, [ebx + 0x20204]
push esi
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x4178bb
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x4178bb
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4929e4
lea ecx, [ecx + ebx + 0x20204]
push ecx
call fcn.0047a8f8
add esp, 0xc
cmp dword [0x57cd58], 2
jle 0x417755
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x417755
jmp 0x417723
push str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorer
push 0x50a818
mov byte [0x50a85c], 0
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x417919
push str.REGISTRYUSER
push 0x50a818
mov byte [0x50a826], 0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c11c
mov esi, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea edi, [esi + 0x20204]
push edi
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x417b84
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x417b84
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x563924
push 0x492958
lea ecx, [ecx + esi + 0x20204]
push ecx
call fcn.0047a8f8
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push 0x494880
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.procCheck.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
mov esi, 1
push str.ctfmon.exe
push 0x563924
mov dword [0x57cc60], esi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4179f7
mov dword [0x57cc70], esi
push str.winlogon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x417a13
mov dword [0x57cc64], esi
push str.services.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x417a2f
mov dword [0x57cc6c], esi
push str.svchost.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x417a4b
mov dword [0x57cc78], esi
mov ebx, dword [0x57ccac]
push 0x563924
inc ebx
push 0x4dec8c
mov dword [0x57ccac], ebx
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x417b29
push 0x563924
push 0x48ba7c
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x417b29
push 0x563924
push str.cmd.exe
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x417b29
push 0x563924
push 0x493218
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x417b29
mov edx, dword [0x57cebc]
mov edi, 0x563924
mov eax, edx
or ecx, 0xffffffff
shl eax, 6
shl edx, 8
lea ebx, [eax + 0x4f1b94]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
add edx, 0x54ff60
mov eax, ecx
mov esi, edi
mov edi, ebx
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0046d850
mov eax, dword [0x57cebc]
add esp, 8
inc eax
test eax, eax
mov dword [0x57cebc], eax
jle 0x417b18
inc dword [eax*4 + 0x57cec0]
cmp eax, 0xa
jne 0x417b39
mov dword [0x57cebc], 0
jmp 0x417b39
mov eax, dword [0x57cebc]
test eax, eax
jle 0x417b39
inc dword [eax*4 + 0x57cec0]
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
mov ebx, 1
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, dword [0x57ccd8]
mov edx, ecx
mov esi, edi
mov edi, 0x4dec8c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
cmp eax, ebx
rep movsb byte es:[edi], byte [esi]
jne 0x417b7f
mov eax, dword [0x57ccac]
mov ecx, dword [0x48bb80]
cmp eax, ecx
jl 0x40c11c
mov esi, dword [ebp - 0x14]
jmp 0x417b89
mov ebx, 1
cmp dword [0x57cd58], 2
jle 0x417bec
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x417bec
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
lea edi, [esi + 0x20204]
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x48b2f4
lea ecx, [ecx + esi + 0x20204]
push ecx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x4a51ac
mov dword [0x4a2fe4], ebx
call fcn.0047a8f8
add esp, 0x18
cmp dword [0x57cd58], 4
jle 0x417c71
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x417c71
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
lea edi, [esi + 0x20204]
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea edx, [ecx + esi + 0x20204]
push edx
call fcn.0047a8f8
push 0x513194
push str.CLSID_sInprocServer32
push 0x51acd8
mov dword [0x4a2fe4], ebx
mov byte [0x51acd8], 0
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
add esp, 0x24
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea ebx, [esi + 0x20204]
push ebx
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x417dc2
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x417dc2
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x492920
lea eax, [ecx + esi + 0x20204]
push eax
call fcn.0047a8f8
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push 0x494880
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push 0x48ba7c
push 0x563924
call fcn.0047fde0
add esp, 8
mov esi, 1
test eax, eax
jne 0x417d46
mov dword [0x57cc60], esi
push str.ctfmon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x417d62
mov dword [0x57cc70], esi
push 0x563924
push 0x50eeb0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x417d9a
mov ecx, dword [0x57ccbc]
mov eax, dword [0x57cce8]
inc ecx
cmp eax, esi
mov dword [0x57ccbc], ecx
jne 0x417d9a
cmp ecx, dword [0x48bb90]
jl 0x40c11c
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x50eeb0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x14]
cmp dword [0x57cd58], 2
jle 0x417e1b
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x417e1b
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x48b2f4
lea eax, [ecx + esi + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x4a51ac
call fcn.0047a8f8
add esp, 0x18
cmp dword [0x57cd58], 4
jle 0x41650d
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x41650d
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea ecx, [ecx + esi + 0x20204]
push ecx
call fcn.0047a8f8
push 0x513014
push str.CLSID_sInprocServer32
push 0x54c1a4
mov dword [0x513010], 1
mov byte [0x54c1a4], 0
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
push 0x57cb28
push 0x5195a8
call fcn.0047fde0
add esp, 0x2c
test eax, eax
jne 0x417ee2
mov ecx, dword [0x57ccbc]
mov eax, dword [0x57cce8]
inc ecx
cmp eax, 1
mov dword [0x57ccbc], ecx
jne 0x417eec
mov eax, dword [0x48bb90]
mov edx, ecx
cmp edx, eax
jge 0x417eec
jmp 0x40c11c
mov dword [0x57cce8], 0
mov edi, 0x57cb28
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x5195a8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x41650d
push str.REGISTRYMACHINESAM
push 0x50a818
mov byte [0x50a82d], 0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c11c
mov ebx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea esi, [ebx + 0x20204]
push esi
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x417fce
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x417fce
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x492908
lea ecx, [ecx + ebx + 0x20204]
push ecx
call fcn.0047a8f8
push str.accountManager.
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
cmp dword [0x57cd58], 2
jle 0x418038
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x418038
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x48b2f4
lea edx, [ecx + ebx + 0x20204]
push edx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x54fc54
mov dword [0x51acd4], 1
mov byte [0x54fc54], 0
call fcn.0047a8f8
add esp, 0x18
cmp dword [0x57cd58], 4
jle 0x418098
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x418098
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea eax, [ecx + ebx + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
add esp, 0x18
lea ecx, [ebp - 0xcf0]
push ecx
call fcn.00403990
add esp, 4
lea edx, [ebp - 0xcf0]
lea eax, [ebp - 0x3bf0]
push edx
push esi
push 0x491924
push eax
call fcn.0047a8f8
add esp, 0x10
jmp 0x41650d
push str.REGISTRYMACHINESAM
push 0x50a818
mov byte [0x50a82d], 0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c11c
mov ebx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea esi, [ebx + 0x20204]
push esi
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x418180
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x418180
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4928e8
lea ecx, [ecx + ebx + 0x20204]
push ecx
call fcn.0047a8f8
push str.accountManager.
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
cmp dword [0x57cd58], 2
jle 0x4181c5
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x4181c5
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x48b2f4
lea edx, [ecx + ebx + 0x20204]
push edx
call fcn.0047a8f8
add esp, 0xc
cmp dword [0x57cd58], 4
jle 0x41822f
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x41822f
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea eax, [ecx + ebx + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov dword [0x50d828], 1
mov byte [0x57cb28], 0
call fcn.0047a8f8
add esp, 0x18
lea ecx, [ebp - 0xdf0]
push ecx
call fcn.00403990
add esp, 4
lea edx, [ebp - 0xdf0]
lea eax, [ebp - 0x3df0]
push edx
push esi
push 0x491924
push eax
call fcn.0047a8f8
add esp, 0x10
jmp 0x41650d
push str.REGISTRYMACHINESYSTEMC
push 0x50a818
mov byte [0x50a832], 0
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x41829d
push str.REGISTRYUSER
push 0x50a818
mov byte [0x50a826], 0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c11c
push 0x513014
push str.FILEMON
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
xor edi, edi
push 0x513014
push str.usbstore
mov dword [0x57cd84], edi
mov dword [0x57cd88], edi
call fcn.0047fde0
add esp, 8
mov ebx, 1
test eax, eax
jne 0x4182e6
mov dword [0x57cd88], ebx
push 0x513194
push str.start
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41831e
push 0x513114
push 0x4928ac
mov dword [0x54d9b0], ebx
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41831e
mov dword [0x54d92c], ebx
xor esi, esi
push 0x513194
push 0x49006c
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], edi
mov dword [ebp + 8], edi
mov dword [ebp - 0x44], edi
mov dword [0x57ce04], edi
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41834d
mov esi, ebx
mov dword [ebp - 0x18], esi
push 0x513194
push 0x4900ac
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x418378
mov dword [ebp - 0x20], ebx
mov dword [0x57cc98], ebx
mov dword [0x54ab88], ebx
mov dword [0x54d92c], ebx
push 0x513194
push str.start
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x418391
mov dword [ebp + 8], ebx
mov eax, dword [0x57cd58]
mov dword [0x57cd68], edi
cmp eax, 4
jle 0x418509
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x418509
push 0x4cc284
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
cmp esi, ebx
jne 0x4184cc
push str..sys
push 0x4cc284
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4183e3
mov dword [0x57cd68], ebx
push str..SYS
push 0x4cc284
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4183ff
mov dword [0x57cd68], ebx
push str..Sys
push 0x4cc284
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41841b
mov dword [0x57cd68], ebx
push str..SYs
push 0x4cc284
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x418437
mov dword [0x57cd68], ebx
push str..syS
push 0x4cc284
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x418453
mov dword [0x57cd68], ebx
push str..sYS
push 0x4cc284
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41846f
mov dword [0x57cd68], ebx
mov edi, 0x513014
or ecx, 0xffffffff
xor eax, eax
mov dword [0x57ce04], ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x52d2dc
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
cmp esi, dword [0x57ce98]
jge 0x4184ca
mov eax, esi
push 0x5649a8
shl eax, 6
add eax, 0x52d520
push eax
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4187f7
mov dword [0x57ce74], ebx
xor edi, edi
cmp dword [ebp + 8], ebx
jne 0x418509
push 0x492890
push 0x4cc284
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4184ed
mov dword [0x57cd68], ebx
push 0x493024
push 0x4cc284
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x418509
mov dword [0x57cd68], ebx
mov ecx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea eax, [ecx + 0x20204]
push eax
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
cmp eax, edi
jle 0x418e59
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x418e59
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
push str.regService.exe
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x563924
mov edx, ecx
mov esi, edi
mov edi, 0x4a4bec
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.spoolsu.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService_b.ex
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.procService.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.procCheck.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
mov edi, 0x513014
or ecx, 0xffffffff
xor eax, eax
push 0x48ba7c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x563924
mov eax, ecx
mov esi, edi
mov edi, 0x50ed70
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x418639
mov dword [0x57cc60], ebx
push str.ctfmon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x418655
mov dword [0x57cc70], ebx
push str.winlogon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x418671
mov dword [0x57cc64], ebx
push str.rundll32.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41868d
mov dword [0x52d1d8], ebx
push str.svchost.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4186a9
mov dword [0x57cc78], ebx
push str.lsass.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4186c5
mov dword [0x57cc84], ebx
push str.csrss.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4186e1
mov dword [0x57cc80], ebx
push str.conime.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4186fd
mov dword [0x57cc7c], ebx
push str.services.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x41872c
push str.regedit.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x41872c
mov dword [ebp - 0x44], ebx
push str.system
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4187ba
mov edx, dword [0x57d01c]
mov edi, 0x513014
mov esi, edx
or ecx, 0xffffffff
shl esi, 6
add esi, 0x4a52ac
mov dword [0x57d014], ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x1c], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x1c]
mov dword [0x57d018], ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0xa
mov dword [0x57d01c], edx
rep movsb byte es:[edi], byte [esi]
jne 0x4187ba
mov edi, 0x513014
or ecx, 0xffffffff
xor eax, eax
mov dword [0x57d01c], ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x4a52ac
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x513014
push 0x5649a8
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4187fd
mov ecx, dword [0x57ce40]
mov eax, dword [0x57ce44]
inc ecx
cmp eax, ebx
mov dword [0x57ce40], ecx
jne 0x41882c
mov eax, ecx
mov ecx, dword [0x491400]
cmp eax, ecx
jge 0x41882c
jmp 0x40c11c
inc esi
jmp 0x41849c
mov edi, 0x513014
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [0x57ce40], eax
mov edx, ecx
mov esi, edi
mov edi, 0x5649a8
mov dword [0x57ce44], eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x563924
push 0x549134
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4188e5
push str.csrss.exe
push 0x549134
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x418890
push str.RscSession
push 0x5649a8
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.WdrSession
push 0x5649a8
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
mov eax, dword [0x57ce38]
inc eax
mov dword [0x57ce38], eax
mov eax, dword [0x57ce3c]
cmp eax, ebx
jne 0x4188b7
mov ecx, dword [0x57ce38]
mov eax, dword [0x4913fc]
cmp ecx, eax
jl 0x40c11c
push 0x513194
push 0x49006c
mov dword [0x54fdd4], 0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x418965
push 0x513014
jmp 0x41896a
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
push str.csrss.exe
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x549134
mov eax, ecx
mov esi, edi
mov edi, 0x549134
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x418954
push str.RscSession
push 0x5649a8
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.WdrSession
push 0x5649a8
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
xor eax, eax
mov dword [0x57ce38], eax
mov dword [0x57ce3c], eax
jmp 0x4188b7
push 0x513114
call fcn.0042d160
mov ecx, dword [ebp + 8]
mov dword [0x54fdd4], eax
mov eax, 1
add esp, 4
xor ebx, ebx
cmp ecx, eax
jne 0x418b90
mov ecx, dword [0x57cd68]
mov dword [0x57cff0], ebx
cmp ecx, eax
push 0x563924
jne 0x418abc
mov esi, dword [ebp - 0x14]
or ecx, 0xffffffff
xor eax, eax
push 0x49284c
lea edi, [esi + 0x20204]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx + esi + 0x20204]
push edx
call fcn.0047a8f8
mov eax, dword [ebp - 0x44]
add esp, 0xc
cmp eax, 1
jne 0x418b0a
push 0x513014
push 0x519320
lea eax, [ebp - 0x19f0]
push str._sdrivers_s.sys
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x19f0]
push ecx
call fcn.004246a0
add esp, 0x14
cmp eax, 0x400
jle 0x418b0a
cmp eax, 0x32000
jge 0x418b0a
mov edx, dword [0x57cff8]
mov eax, 1
mov esi, edx
mov dword [0x57cff0], eax
mov dword [0x57cff4], eax
lea edi, [ebp - 0x19f0]
shl esi, 6
or ecx, 0xffffffff
xor eax, eax
add esi, 0x54b7d4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x1c], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0xa
mov dword [0x57cff8], edx
rep movsb byte es:[edi], byte [esi]
jne 0x418aa8
lea edi, [ebp - 0x19f0]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, 1
mov edx, ecx
mov esi, edi
mov edi, 0x54b7d4
mov dword [0x57cff8], eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov dword [0x54d92c], eax
and ecx, 3
mov dword [0x54ab88], eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x14]
jmp 0x418b0a
mov esi, dword [ebp - 0x14]
mov eax, 1
mov dword [0x54d92c], eax
mov dword [0x54ab88], eax
jmp 0x418b0a
mov esi, dword [ebp - 0x14]
or ecx, 0xffffffff
xor eax, eax
push 0x49282c
lea edi, [esi + 0x20204]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + esi + 0x20204]
push eax
call fcn.0047a8f8
mov eax, dword [0x57cc64]
add esp, 0xc
cmp eax, 1
jne 0x418b0a
push str.SCardSvr
push 0x513014
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x418b0a
mov dword [0x57cc64], ebx
push 0x513014
push 0x48f8ec
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x418b4d
lea edi, [esi + 0x20204]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x563924
push 0x492804
lea ecx, [ecx + esi + 0x20204]
push ecx
call fcn.0047a8f8
add esp, 0xc
mov ebx, 1
push 0x513014
push 0x48f92c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x418b90
lea edi, [esi + 0x20204]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x563924
push 0x4927dc
lea edx, [ecx + esi + 0x20204]
push edx
call fcn.0047a8f8
add esp, 0xc
mov ebx, 1
cmp dword [ebp - 0x20], 1
jne 0x418cee
mov edi, 0x513114
or ecx, 0xffffffff
xor eax, eax
push 0x513114
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x5649a8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041b4f0
movsx eax, ax
add esp, 4
mov esi, 1
cmp eax, esi
push 0x563924
jne 0x418c07
mov edx, dword [ebp - 0x14]
or ecx, 0xffffffff
xor eax, eax
push 0x4927b8
lea edi, [edx + 0x20204]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ecx, [ecx + edx + 0x20204]
push ecx
call fcn.0047a8f8
add esp, 0xc
jmp 0x418c70
mov edx, dword [ebp - 0x14]
or ecx, 0xffffffff
xor eax, eax
push 0x492794
lea edi, [edx + 0x20204]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx + edx + 0x20204]
push edx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x519424
mov dword [0x54ab88], esi
mov dword [0x54d92c], esi
mov dword [0x50c364], esi
mov byte [0x519424], 0
call fcn.0047a8f8
push 0x513114
push 0x48b2f4
push 0x50c0a0
call fcn.0047a8f8
add esp, 0x24
push str.services.exe
push 0x563924
mov ebx, 1
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x418cee
push str.regedit.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x418cee
mov edx, dword [0x57ceb4]
mov edi, 0x563924
mov esi, edx
or ecx, 0xffffffff
shl esi, 6
xor eax, eax
add esi, 0x4ded0c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x1c], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0xa
mov dword [0x57ceb4], edx
rep movsb byte es:[edi], byte [esi]
jne 0x418cee
mov dword [0x57ceb4], 0
mov eax, dword [ebp - 0x18]
mov esi, 1
cmp eax, esi
jne 0x418e54
cmp ebx, esi
je 0x418e4e
push 0x513014
call fcn.0041b4f0
movsx eax, ax
add esp, 4
cmp eax, esi
mov eax, dword [0x57cd68]
jne 0x418d97
cmp eax, esi
push 0x563924
jne 0x418d4a
mov edx, dword [ebp - 0x14]
or ecx, 0xffffffff
xor eax, eax
push 0x492774
lea edi, [edx + 0x20204]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ecx, [ecx + edx + 0x20204]
push ecx
jmp 0x418d6a
mov edx, dword [ebp - 0x14]
or ecx, 0xffffffff
xor eax, eax
push 0x492754
lea edi, [edx + 0x20204]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx + edx + 0x20204]
push edx
call fcn.0047a8f8
add esp, 0xc
push 0x513194
push 0x49006c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x418e24
mov dword [0x54ab88], esi
jmp 0x418e24
cmp eax, esi
push 0x563924
jne 0x418dc2
mov edx, dword [ebp - 0x14]
or ecx, 0xffffffff
xor eax, eax
push 0x492734
lea edi, [edx + 0x20204]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + edx + 0x20204]
push eax
jmp 0x418de2
mov edx, dword [ebp - 0x14]
or ecx, 0xffffffff
xor eax, eax
push 0x492714
lea edi, [edx + 0x20204]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ecx, [ecx + edx + 0x20204]
push ecx
call fcn.0047a8f8
add esp, 0xc
push 0x513194
push 0x49006c
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x418e06
mov dword [0x54ab88], esi
push 0x563924
push 0x48b2f4
push 0x519424
mov byte [0x519424], 0
call fcn.0047a8f8
add esp, 0xc
mov edi, 0x513014
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x50ed70
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
mov dword [0x54d92c], esi
mov ebx, 1
mov al, byte [0x513014]
cmp al, 0x30
je 0x418e86
cmp al, 0x31
je 0x418e86
cmp al, 0x32
je 0x418e86
cmp al, 0x33
je 0x418e86
cmp al, 0x34
je 0x418e86
cmp al, 0x35
je 0x418e86
cmp al, 0x36
je 0x418e86
cmp al, 0x37
je 0x418e86
cmp al, 0x38
je 0x418e86
cmp al, 0x39
jne 0x418ebf
lea eax, [ebp - 0x6f0]
mov byte [ebp - 0x6f0], 0
push eax
push 0x563924
call fcn.00445210
add esp, 8
lea ecx, [ebp - 0x6f0]
push 0x491b90
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x418ebf
mov dword [0x57cd84], ebx
cmp dword [0x57cd58], 2
jle 0x418f89
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x418f89
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x430]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x563924
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x1c], ecx
je 0x40c11c
lea ecx, [ebp - 0x430]
push str.AnyFileDel
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x40c11c
lea edx, [ebp - 0x430]
push str.ccProcMon
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x40c11c
mov edx, dword [ebp - 0x14]
or ecx, 0xffffffff
push 0x563924
push 0x49338c
lea edi, [edx + 0x20204]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
add esp, 0xc
cmp dword [0x57cd58], 4
jle 0x419b17
mov ecx, dword [0x549244]
cmp byte [ecx], 0
je 0x419b17
cmp dword [ebp + 8], ebx
jne 0x419570
push 0x492890
push 0x4cc284
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x419064
mov edi, 0x4926e4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x530]
mov eax, ecx
mov esi, edi
mov edi, edx
mov dword [0x57cd68], ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x430]
push ecx
push 0x563ba4
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x419034
mov ecx, dword [0x57ccc4]
mov eax, dword [0x57ccf4]
inc ecx
cmp eax, ebx
mov dword [0x57ccc4], ecx
jne 0x41903e
mov edx, dword [0x48bb94]
mov eax, ecx
dec edx
cmp eax, edx
jge 0x41903e
jmp 0x40c11c
mov dword [0x57ccf4], 0
lea edi, [ebp - 0x430]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x563ba4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x493024
push 0x4cc284
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41911a
mov edi, 0x4926c8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x530]
mov eax, ecx
mov esi, edi
mov edi, edx
mov dword [0x57cd68], ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x430]
push ecx
push 0x563ba4
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4190ea
mov ecx, dword [0x57ccc4]
mov eax, dword [0x57ccf4]
inc ecx
cmp eax, ebx
mov dword [0x57ccc4], ecx
jne 0x4190f4
mov edx, dword [0x48bb94]
mov eax, ecx
dec edx
cmp eax, edx
jge 0x4190f4
jmp 0x40c11c
mov dword [0x57ccf4], 0
lea edi, [ebp - 0x430]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x563ba4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x4926c4
push 0x4cc284
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4192ad
mov edi, 0x4926b8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x530]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x430]
push ecx
push 0x563ba4
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41919a
mov ecx, dword [0x57ccc4]
mov eax, dword [0x57ccf4]
inc ecx
cmp eax, ebx
mov dword [0x57ccc4], ecx
jne 0x4191a4
mov edx, dword [0x48bb94]
mov eax, ecx
dec edx
cmp eax, edx
jge 0x4191a4
jmp 0x40c11c
mov dword [0x57ccf4], 0
lea edi, [ebp - 0x430]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x563ba4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x57cc78]
and ecx, 3
cmp eax, ebx
rep movsb byte es:[edi], byte [esi]
jne 0x4192ad
lea ecx, [ebp - 0x870]
mov byte [ebp - 0x870], 0
push ecx
push 0x513014
call fcn.004784c0
lea edi, [ebp - 0x870]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jle 0x4192ad
lea edx, [ebp - 0x870]
push edx
call fcn.004246a0
add esp, 4
cmp eax, 0x400
jle 0x4192ad
mov edx, dword [0x57d004]
lea edi, [ebp - 0x870]
mov esi, edx
or ecx, 0xffffffff
shl esi, 6
xor eax, eax
add esi, 0x519f14
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
mov dword [0x57cffc], ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [0x57d000], ebx
and ecx, 3
inc edx
cmp edx, 0xa
mov dword [0x57d004], edx
rep movsb byte es:[edi], byte [esi]
jne 0x4192a1
lea edi, [ebp - 0x870]
or ecx, 0xffffffff
xor eax, eax
mov dword [0x57d004], ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x519f14
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [0x54d92c], ebx
mov dword [0x54ab88], ebx
push 0x4926b4
push 0x4cc284
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41935d
mov edi, 0x492698
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x530]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x430]
push ecx
push 0x563ba4
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41932d
mov ecx, dword [0x57ccc4]
mov eax, dword [0x57ccf4]
inc ecx
cmp eax, ebx
mov dword [0x57ccc4], ecx
jne 0x419337
mov edx, dword [0x48bb94]
mov eax, ecx
dec edx
cmp eax, edx
jge 0x419337
jmp 0x40c11c
mov dword [0x57ccf4], 0
lea edi, [ebp - 0x430]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x563ba4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x492694
push 0x4cc284
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4195f3
mov edi, 0x492688
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x530]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x430]
push ecx
push 0x563ba4
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x419467
push str.services.exe
push 0x4a4bec
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x419437
push str.regedit.exe
push 0x4a4bec
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x419437
push str.wuauserv
push 0x513014
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x419427
push str.wscsvc
push 0x513014
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x419427
push str.SharedAccess
push 0x513014
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x419437
mov eax, dword [0x57cf08]
test eax, eax
jle 0x419437
inc dword [eax*4 + 0x57cf0c]
mov ecx, dword [0x57ccc4]
mov eax, dword [0x57ccf4]
inc ecx
cmp eax, ebx
mov dword [0x57ccc4], ecx
jne 0x419545
mov edx, dword [0x48bb94]
mov eax, ecx
dec edx
cmp eax, edx
jge 0x419545
jmp 0x40c11c
push str.services.exe
push 0x4a4bec
mov dword [0x57ccf4], 0
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x419545
push str.regedit.exe
push 0x4a4bec
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x419545
push str.wuauserv
push 0x513014
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4194e7
push str.wscsvc
push 0x513014
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x4194e7
push str.SharedAccess
push 0x513014
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x419545
mov edx, dword [0x57cf08]
mov edi, 0x563924
mov esi, edx
or ecx, 0xffffffff
shl esi, 6
xor eax, eax
add esi, 0x4a38e8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
test edx, edx
rep movsb byte es:[edi], byte [esi]
mov dword [0x57cf08], edx
jle 0x419530
inc dword [edx*4 + 0x57cf0c]
cmp edx, 5
jne 0x41953f
mov dword [0x57cf08], 0
mov dword [0x57cf0c], ebx
lea edi, [ebp - 0x430]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x563ba4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4195f3
mov edi, 0x4cc284
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x530]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x20]
and ecx, 3
cmp eax, ebx
rep movsb byte es:[edi], byte [esi]
jne 0x4195f3
mov edx, dword [0x57cdd0]
lea edi, [ebp - 0x530]
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0x53f524
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x19
mov dword [0x57cdd0], edx
rep movsb byte es:[edi], byte [esi]
jne 0x4195ed
mov dword [0x57cdd0], 0
mov dword [0x57cdcc], ebx
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x530]
push ecx
or ecx, 0xffffffff
lea edi, [edx + 0x20204]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4935cc
lea edx, [ecx + edx + 0x20204]
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x530]
mov byte [0x57cb28], 0
push eax
push 0x48b2f4
push 0x57cb28
call fcn.0047a8f8
mov edi, 0x57cb28
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, ebx
jl 0x40c11c
cmp ecx, 4
jle 0x41972d
cmp byte [0x57cb28], 0x22
jne 0x4196b8
cmp byte [0x57cb29], 0x22
jne 0x4196b8
xor eax, eax
lea edx, [ecx - 1]
cmp eax, edx
jge 0x41968a
mov dl, byte [eax + 0x57cb29]
mov byte [ebp + eax - 0x1ef0], dl
inc eax
jmp 0x419673
mov byte [ebp + eax - 0x1ef0], 0
lea edi, [ebp - 0x1ef0]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x57cb28
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x54ab88], ebx
jne 0x41972d
push 0x492670
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41972d
push str..ini
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41972d
mov edi, 0x57cb28
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 4]
cmp eax, edx
jge 0x419726
mov dl, byte [eax + 0x57cb28]
cmp dl, 0x2e
jne 0x419723
cmp byte [eax + 0x57cb29], 0x65
je 0x419726
cmp dl, dl
jne 0x419723
cmp byte [eax + 0x57cb29], 0x45
je 0x419726
inc eax
jmp 0x4196fb
mov byte [eax + 0x57cb2c], 0
push str.32_svchost.
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x419759
push str.32SVCHOST.
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x4197ac
mov edx, dword [0x57cdd8]
mov edi, 0x513014
mov esi, edx
or ecx, 0xffffffff
shl esi, 8
xor eax, eax
add esi, 0x4ca480
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
mov dword [0x57cdd4], ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0x19
mov dword [0x57cdd8], edx
rep movsb byte es:[edi], byte [esi]
jne 0x4197ac
mov dword [0x57cdd8], 0
cmp dword [0x54ab88], ebx
jne 0x419b17
mov eax, dword [0x57cd68]
test eax, eax
jne 0x419a3a
mov eax, dword [0x57cffc]
test eax, eax
jne 0x419b17
push 0x48b7ec
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x41981a
push str.svchost__k_rpcss
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x41981a
push str.Svchost__k_rpcss
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x41981a
mov dword [0x57ce10], ebx
push str.wltrysvc
push 0x513014
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x419868
push str._SystemRoot_System32wltrysvc.exe__SystemRoot_System32_bcmwltry.exe
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41984c
mov dword [0x57cc3c], ebx
push str._SystemRoot_System32WLTRYSVC.EXE__SystemRoot_System32_bcmwltry.exe
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x419868
mov dword [0x57cc3c], ebx
push str.Adobe_LM_Service
push 0x513014
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x4198e3
push str.Program_FilesCommon_FilesAdobe_Systems_SharedServiceAdobelmsvc.exe
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41989a
mov dword [0x57cc48], ebx
lea ecx, [ebp - 0x60]
lea edx, [ebp - 0x60]
push ecx
push 0x4924e8
push 0x50d768
push edx
lea eax, [ebp - 0x20f0]
push str._s_s_s_s
push eax
mov byte [ebp - 0x60], 0x22
mov byte [ebp - 0x5f], 0
call fcn.0047a8f8
lea ecx, [ebp - 0x20f0]
push 0x57cb28
push ecx
call fcn.0047fde0
add esp, 0x20
test eax, eax
jne 0x4198e3
mov dword [0x57cc48], ebx
push str.Macromedia_Licensing_Service
push 0x513014
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41995e
push str.Program_FilesCommon_FilesMacromedia_SharedServiceMacromedia_Licensing.exe
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x419915
mov dword [0x57cc4c], ebx
lea edx, [ebp - 0x58]
lea eax, [ebp - 0x58]
push edx
push 0x49241c
push 0x50d768
push eax
lea ecx, [ebp - 0x22f0]
push str._s_s_s_s
push ecx
mov byte [ebp - 0x58], 0x22
mov byte [ebp - 0x57], 0
call fcn.0047a8f8
lea edx, [ebp - 0x22f0]
push 0x57cb28
push edx
call fcn.0047fde0
add esp, 0x20
test eax, eax
jne 0x41995e
mov dword [0x57cc4c], ebx
xor edi, edi
cmp edi, 6
jge 0x419a2e
mov eax, edi
shl eax, 7
add eax, str.UFNet
push eax
push 0x513014
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x419a1b
mov ecx, edi
lea edx, [ebp - 0x40]
shl ecx, 8
mov byte [ebp - 0x3f], al
push edx
lea esi, [ecx + 0x48da98]
lea eax, [ebp - 0x40]
push esi
push 0x563f28
push eax
lea ecx, [ebp - 0x1b70]
push str._s_s_system32_s_s
push ecx
mov byte [ebp - 0x40], 0x22
call fcn.0047a8f8
lea edx, [ebp - 0x1b70]
push 0x57cb28
push edx
call fcn.0047fde0
add esp, 0x20
test eax, eax
je 0x419a21
lea eax, [ebp - 0x40]
lea ecx, [ebp - 0x40]
push eax
push esi
push 0x563f28
push ecx
lea edx, [ebp - 0x1b70]
push str._s___s_system32_s_s
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x1b70]
push 0x57cb28
push eax
call fcn.0047fde0
add esp, 0x20
test eax, eax
je 0x419a21
push esi
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x419a21
inc edi
jmp 0x419960
mov dword [0x57cc50], ebx
mov dword [edi*4 + 0x57cd28], ebx
cmp dword [0x54ab88], ebx
jne 0x419b17
cmp dword [0x57cd68], ebx
jne 0x419b17
xor edi, edi
cmp edi, 6
jge 0x419b17
mov ecx, edi
shl ecx, 7
add ecx, str.ProtectorA
push ecx
push 0x513014
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x419b04
mov edx, edi
mov byte [ebp - 0x37], al
shl edx, 8
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x38]
lea esi, [edx + str.driversProtectorA.sys]
push eax
push esi
push 0x563f28
push ecx
lea edx, [ebp - 0x1cf0]
push str._s_s_system32_s_s
push edx
mov byte [ebp - 0x38], 0x22
call fcn.0047a8f8
lea eax, [ebp - 0x1cf0]
push 0x57cb28
push eax
call fcn.0047fde0
add esp, 0x20
test eax, eax
je 0x419b0a
lea ecx, [ebp - 0x38]
lea edx, [ebp - 0x38]
push ecx
push esi
push 0x563f28
push edx
lea eax, [ebp - 0x1cf0]
push str._s___s_system32_s_s
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0x1cf0]
push 0x57cb28
push ecx
call fcn.0047fde0
add esp, 0x20
test eax, eax
je 0x419b0a
push esi
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x419b0a
inc edi
jmp 0x419a48
mov dword [0x57cc54], ebx
mov dword [edi*4 + 0x57cd40], ebx
lea edx, [ebp - 0xef0]
push edx
call fcn.00403990
mov ecx, dword [ebp - 0x14]
add esp, 4
lea eax, [ebp - 0xef0]
add ecx, 0x20204
push eax
push ecx
lea edx, [ebp - 0x3ff0]
push 0x491924
push edx
call fcn.0047a8f8
mov ecx, dword [ebp - 0xc]
add esp, 0x10
mov eax, ebx
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea ebx, [esi + 0x20204]
push ebx
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x419e5d
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x419e5d
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4923d0
lea eax, [ecx + esi + 0x20204]
push eax
call fcn.0047a8f8
push str.processManager.
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.regService_b.ex
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.procCheck.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.mshta.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x419c53
mov dword [0x54f98c], 1
push 0x561764
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x419cb1
mov edi, dword [0x57cccc]
or ecx, 0xffffffff
inc edi
mov dword [0x57cccc], edi
mov edi, 0x563924
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, dword [0x57ccf8]
mov edx, ecx
mov esi, edi
mov edi, 0x54ed0c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
jne 0x419cbb
cmp dword [0x57cccc], 0x29
jge 0x419cbb
jmp 0x40c11c
mov dword [0x57ccf8], 0
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
push 0x48ba7c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x563924
mov eax, ecx
mov esi, edi
mov edi, 0x561764
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0047fde0
add esp, 8
mov esi, 1
test eax, eax
jne 0x419d01
mov dword [0x57cc60], esi
push str.ctfmon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x419d1d
mov dword [0x57cc70], esi
push str.conime.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x419d39
mov dword [0x57cc7c], esi
push str.rundll32.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x419d55
mov dword [0x57cc74], esi
push str.winlogon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x419d71
mov dword [0x57cc64], esi
push str.csrss.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x419d8d
mov dword [0x57cc80], esi
push str.services.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x419da9
mov dword [0x57cc6c], esi
mov eax, dword [0x57cc64]
test eax, eax
jne 0x419e5d
mov eax, dword [0x57cc6c]
test eax, eax
jne 0x419e5d
mov eax, dword [0x57cc78]
test eax, eax
jne 0x419e5d
mov eax, dword [0x57cc70]
test eax, eax
jne 0x419e5d
mov eax, dword [0x57cc60]
test eax, eax
jne 0x419e5d
mov eax, dword [0x57cc74]
test eax, eax
jne 0x419e5d
push 0x563924
push 0x48b2f4
push 0x540e24
call fcn.0047a8f8
mov edx, dword [0x57cfb0]
mov edi, 0x540e24
mov esi, edx
or ecx, 0xffffffff
shl esi, 6
xor eax, eax
add esp, 0xc
add esi, 0x54d6a8
mov dword [0x57cfac], 1
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0xa
mov dword [0x57cfb0], edx
rep movsb byte es:[edi], byte [esi]
jne 0x419e5d
mov dword [0x57cfb0], 0
cmp dword [0x57cd58], 2
jle 0x419eca
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x419eca
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x563924
push 0x49338c
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x54c024
mov byte [0x54c024], 0
call fcn.0047a8f8
add esp, 0x18
mov dword [0x54bf60], 1
cmp dword [0x57cd58], 4
jle 0x41650d
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x41650d
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x563924
push 0x4935cc
lea eax, [ecx + edx + 0x20204]
jmp 0x4164e9
mov ebx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea esi, [ebx + 0x20204]
push esi
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x419fcb
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x419fcb
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4923b0
lea ecx, [ecx + ebx + 0x20204]
push ecx
call fcn.0047a8f8
push str.processMonitor2
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.downAuto_hc.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
cmp dword [0x57cd58], 2
jle 0x4164ad
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x4164ad
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x49338c
lea edx, [ecx + ebx + 0x20204]
push edx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x54ed8c
mov byte [0x54ed8c], 0
call fcn.0047a8f8
add esp, 0x18
mov dword [0x54fe58], 1
jmp 0x4164ad
push str.REGISTRYMACHINESoftwareMicrosoft
push 0x50a818
mov byte [0x50a83c], 0
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x41a080
push str.REGISTRYUSER
push 0x50a818
mov byte [0x50a826], 0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c11c
mov ecx, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea ebx, [ecx + 0x20204]
push ebx
call fcn.0047a8f8
mov eax, dword [0x57cd58]
add esp, 0x10
test eax, eax
jle 0x41a3ad
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x41a3ad
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x563924
push 0x49236c
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
push str.regService.exe
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
je 0x40c11c
push str.regService_b.ex
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
push 0x48ba7c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x563924
mov edx, ecx
mov esi, edi
mov edi, 0x540f68
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41a167
mov dword [0x57cc60], 1
push str.csrss.exe
push 0x563924
mov esi, 1
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41a188
mov dword [0x57cc80], esi
push str.winlogon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41a1a4
mov dword [0x57cc64], esi
push str.services.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41a1c0
mov dword [0x57cc6c], esi
push str.svchost.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41a1dc
mov dword [0x57cc78], esi
push 0x48ba7c
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41a1f8
mov dword [0x57cc60], esi
push str.ctfmon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41a214
mov dword [0x57cc70], esi
push str.conime.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41a230
mov dword [0x57cc7c], esi
push str.rundll32.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41a24c
mov dword [0x57cc74], esi
mov eax, dword [0x57cc64]
test eax, eax
jne 0x41a2f8
mov eax, dword [0x57cc6c]
test eax, eax
jne 0x41a2f8
mov eax, dword [0x57cc78]
test eax, eax
jne 0x41a2f8
mov eax, dword [0x57cc74]
test eax, eax
jne 0x41a2f8
mov eax, dword [0x57cc60]
test eax, eax
jne 0x41a2f8
push 0x563924
push 0x48b2f4
push 0x54e940
call fcn.0047a8f8
mov edx, dword [0x57cfdc]
mov edi, 0x54e940
mov esi, edx
or ecx, 0xffffffff
shl esi, 6
xor eax, eax
add esp, 0xc
add esi, 0x545868
mov dword [0x57cfd8], 1
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
cmp edx, 0xa
mov dword [0x57cfdc], edx
rep movsb byte es:[edi], byte [esi]
jne 0x41a2f3
mov dword [0x57cfdc], 0
mov esi, 1
push 0x513194
push str.userinit
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41a314
mov dword [0x57cdf8], esi
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
mov byte [0x54d930], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x54d930
mov edx, ecx
mov esi, edi
mov edi, 0x54d930
push 0x54fdd8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41a37e
mov ecx, dword [0x57ce60]
mov eax, dword [0x57ce64]
inc ecx
cmp eax, 1
mov dword [0x57ce60], ecx
jne 0x41a388
mov eax, ecx
mov ecx, dword [0x49140c]
cmp eax, ecx
jge 0x41a388
jmp 0x40c11c
mov dword [0x57ce64], 0
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x54fdd8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x57cd58], 2
jle 0x41a4a0
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x41a4a0
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x14]
push 0x49338c
not ecx
dec ecx
lea ecx, [ecx + eax + 0x20204]
push ecx
call fcn.0047a8f8
push 0x513194
push str.userinit
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x41a436
push 0x563924
push 0x48b2f4
push 0x54dc78
mov dword [0x54ea80], 1
mov byte [0x54dc78], al
call fcn.0047a8f8
add esp, 0xc
push 0x513194
push 0x48f62c
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x41a478
push 0x513194
push str.load
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x41a478
push 0x513194
push str.setup
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41a4a0
push 0x563924
push 0x48b2f4
push 0x54e980
mov dword [0x50d82c], 1
mov byte [0x54e980], 0
call fcn.0047a8f8
add esp, 0xc
cmp dword [0x57cd58], 4
jle 0x41650d
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x41650d
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x563924
push 0x4935cc
lea eax, [ecx + edx + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
lea ecx, [ebp - 0x1f0]
push 0x48b2f4
push ecx
mov byte [0x57cb28], 0
call fcn.0047a8f8
mov eax, dword [0x54ea80]
add esp, 0x18
cmp eax, 1
jne 0x41a669
lea edx, [ebp - 0x1f0]
push str.nit.exe
push edx
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41a669
lea eax, [ebp - 0x1f0]
push str._use
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x41a63f
lea ecx, [ebp - 0x1f0]
push str._Use
push ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x41a63f
lea edi, [ebp - 0x1f0]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea edx, [ebp - 0x1f0]
dec ecx
push str.32userinit
push edx
mov esi, ecx
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x41a5e0
lea eax, [ebp - 0x1f0]
push str.32Userinit
push eax
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x41a5e0
mov bl, 0x6e
mov dl, 0x69
mov cl, 0x74
cmp eax, esi
jge 0x41a669
cmp byte [ebp + eax - 0x1f0], bl
jne 0x41a5dd
cmp byte [ebp + eax - 0x1ef], dl
jne 0x41a5dd
cmp byte [ebp + eax - 0x1ee], cl
jne 0x41a5dd
cmp eax, 8
jl 0x41a60a
inc eax
jmp 0x41a5b5
xor eax, eax
mov bl, 0x6e
mov dl, 0x69
mov cl, 0x74
cmp eax, esi
jge 0x41a669
cmp byte [ebp + eax - 0x1f0], bl
jne 0x41a607
cmp byte [ebp + eax - 0x1ef], dl
jne 0x41a607
cmp byte [ebp + eax - 0x1ee], cl
je 0x41a60a
inc eax
jmp 0x41a5e8
cmp eax, esi
jge 0x41a669
mov byte [ebp - 0x1f0], 0
xor ecx, ecx
mov edx, esi
sub edx, eax
sub edx, 7
cmp ecx, edx
jge 0x41a633
mov dl, byte [ecx + eax + 0x56392c]
mov byte [ebp + ecx - 0x1f0], dl
inc ecx
jmp 0x41a617
sub esi, eax
mov byte [ebp + esi - 0x1f7], 0
jmp 0x41a669
lea edi, [ebp - 0x1f0]
or ecx, 0xffffffff
xor eax, eax
mov dl, 0x2c
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp eax, ecx
jge 0x41a661
cmp byte [ebp + eax - 0x1f0], dl
je 0x41a661
inc eax
jmp 0x41a651
mov byte [ebp + eax - 0x1f0], 0
lea eax, [ebp - 0x1f0]
push eax
push 0x48b2f4
push 0x57cb28
call fcn.0047a8f8
mov ecx, dword [0x57ccb0]
mov eax, dword [0x57ccdc]
add esp, 0xc
inc ecx
cmp eax, 1
mov dword [0x57ccb0], ecx
jne 0x41650d
cmp ecx, dword [0x48bb84]
jl 0x40c11c
jmp 0x41650d
push str.REGISTRYMACHINESoftwareMicrosoft
push 0x50a818
mov byte [0x50a83c], 0
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x41a6ec
push str.REGISTRYUSER
push 0x50a818
mov byte [0x50a826], 0
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x40c11c
mov esi, dword [ebp - 0x14]
push 0x54a104
push 0x54bf64
push 0x49480c
lea ebx, [esi + 0x20204]
push ebx
call fcn.0047a8f8
add esp, 0x10
lea edx, [ebp - 0xff0]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, dword [0x57cd58]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0x18], ecx
jle 0x41ab88
mov eax, dword [0x549234]
cmp byte [eax], 0
je 0x41ab88
push 0x563924
push eax
mov dword [0x4e02a8], ecx
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x49231c
lea eax, [ecx + esi + 0x20204]
push eax
call fcn.0047a8f8
push 0x563924
lea ecx, [ebp - 0x770]
push 0x48b2f4
push ecx
call fcn.0047a8f8
push str..tmp
push 0x563924
call fcn.0047bec0
add esp, 0x20
test eax, eax
jne 0x41a7b6
push str..Tmp
push 0x563924
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41a7c0
mov esi, 1
mov dword [ebp - 0x18], esi
jmp 0x41a7c5
mov esi, 1
push str.downAutohc.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push str.procCheck.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
je 0x40c11c
push 0x563924
push 0x48b2f4
push 0x51a194
call fcn.0047a8f8
push 0x48ba7c
push 0x563924
call fcn.0047fde0
add esp, 0x14
test eax, eax
jne 0x41a82f
mov dword [0x4df40c], esi
mov dword [0x57cc60], esi
push str.iexplore.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41a84b
mov dword [0x4df40c], esi
push str.winlogon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41a86d
mov dword [0x4df40c], esi
mov dword [0x57cc64], esi
push str.smss.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41a889
mov dword [0x4df40c], esi
push str.csrss.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41a8a5
mov dword [0x4df40c], esi
push str.services.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41a8c7
mov dword [0x4df40c], esi
mov dword [0x57cc6c], esi
push str.csrss.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41a8e3
mov dword [0x57cc80], esi
push str.winlogon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41a8ff
mov dword [0x57cc64], esi
push str.services.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41a91b
mov dword [0x57cc6c], esi
push str.svchost.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41a937
mov dword [0x57cc78], esi
push 0x48ba7c
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41a953
mov dword [0x57cc60], esi
push str.ctfmon.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41a96f
mov dword [0x57cc70], esi
push str.conime.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41a98b
mov dword [0x57cc7c], esi
push str.rundll32.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41a9a7
mov dword [0x57cc74], esi
push 0x4a4c6c
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41aa36
mov edi, dword [0x57cca4]
or ecx, 0xffffffff
inc edi
mov dword [0x57cca4], edi
mov edi, 0x563924
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x4a4c6c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x563924
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x51b3d8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x57ccd0]
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
jne 0x41aabe
mov ecx, dword [0x57cca4]
mov eax, dword [0x48bb7c]
cmp ecx, eax
jge 0x41aabe
jmp 0x40c11c
mov edi, 0x563924
or ecx, 0xffffffff
xor eax, eax
push 0x52d1dc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x563924
mov edx, ecx
mov esi, edi
mov edi, 0x52d1dc
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41aabe
mov ecx, dword [0x57ccb4]
mov edi, 0x563924
inc ecx
mov dword [0x57ccb4], ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x54bdd8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x57cce0]
and ecx, 3
cmp eax, 1
rep movsb byte es:[edi], byte [esi]
jne 0x41aabe
mov ecx, dword [0x57ccb4]
mov eax, dword [0x48bb88]
cmp ecx, eax
jl 0x40c11c
push str.mshta.exe
push 0x563924
xor esi, esi
call fcn.0047fde0
add esp, 8
mov edi, 1
test eax, eax
jne 0x41aaee
mov eax, dword [0x57ce48]
mov dword [0x54f98c], edi
inc eax
mov esi, edi
mov dword [0x57ce48], eax
push str.rundll32.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41ab17
mov eax, dword [0x57ce48]
mov dword [0x52d1d8], edi
inc eax
mov esi, edi
mov dword [0x57ce48], eax
push 0x48ba7c
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41ab33
mov dword [0x5615e0], edi
push str.iexplore.exe
push 0x563924
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41ab57
mov eax, dword [0x57ce4c]
mov dword [0x54e7fc], edi
inc eax
jmp 0x41ab62
xor eax, eax
cmp esi, eax
jne 0x41ab67
mov dword [0x57ce48], eax
mov dword [0x57ce4c], eax
push 0x563924
push 0x48b2f4
push 0x519424
mov byte [0x519424], 0
call fcn.0047a8f8
mov esi, dword [ebp - 0x14]
add esp, 0xc
cmp dword [0x57cd58], 2
jle 0x41abf2
mov eax, dword [0x54923c]
cmp byte [eax], 0
je 0x41abf2
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x48b2f4
lea edx, [ecx + esi + 0x20204]
push edx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x4cc184
mov byte [0x4cc184], 0
call fcn.0047a8f8
add esp, 0x18
mov dword [0x4e02a8], 1
cmp dword [0x57cd58], 4
jle 0x41650d
mov eax, dword [0x549244]
cmp byte [eax], 0
je 0x41650d
push 0x563924
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 0x563924
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x14]
push 0x4935cc
not ecx
dec ecx
lea ecx, [ecx + eax + 0x20204]
push ecx
call fcn.0047a8f8
push 0x563924
push 0x48b2f4
push 0x57cb28
mov byte [0x57cb28], 0
call fcn.0047a8f8
push str.Program_FilesCommon_FilesRealUpdate_OB_realsched.exe
push 0x57cb28
call fcn.0047bec0
add esp, 0x20
test eax, eax
jne 0x40c11c
push str._systemroot__system32dumprep
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x40c11c
push str.32A6Wizard_
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x40c11c
push str.ystem32ctfmon.exe
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x40c11c
push str.ctfmon.exe
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41acf2
push 0x49228c
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x40c11c
mov edi, 0x57cb28
or ecx, 0xffffffff
xor eax, eax
mov esi, 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor edi, edi
xor ebx, ebx
mov dword [0x52d1d8], esi
mov dword [ebp + 8], ebx
cmp eax, ecx
jge 0x41ad34
mov dl, byte [eax + 0x57cb28]
cmp dl, 0x3a
jne 0x41ad28
mov dword [0x52d1d8], edi
cmp dl, 0x5c
jne 0x41ad31
inc ebx
mov dword [ebp + 8], ebx
inc eax
jmp 0x41ad13
push 0x492024
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41ad50
mov dword [0x52d1d8], edi
cmp ebx, esi
jne 0x41ad60
mov dword [0x52d1d8], esi
mov dword [0x57cd6c], esi
push 0x492024
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x41ad7c
mov dword [0x52d1d8], esi
push 0x492288
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41ad98
mov dword [0x52d1d8], esi
lea edx, [ebp - 0xff0]
push edx
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41adb6
mov dword [0x52d1d8], esi
push str.windows
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41add2
mov dword [0x52d1d8], esi
push 0x492bb4
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41adee
mov dword [0x52d1d8], esi
push str.WINNT
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41ae0a
mov dword [0x52d1d8], esi
push str.winnt
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41ae26
mov dword [0x52d1d8], esi
push str.drivers_
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41ae48
mov dword [0x52d1d8], esi
mov dword [0x57cd6c], esi
push str.System_
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41ae64
mov dword [0x52d1d8], esi
push str._system_
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41ae80
mov dword [0x52d1d8], esi
push str.System32_
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41aea2
mov dword [0x52d1d8], esi
mov dword [0x57cd6c], esi
push str._system32_
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41aec4
mov dword [0x52d1d8], esi
mov dword [0x57cd6c], esi
push 0x492b54
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41aee6
mov dword [0x52d1d8], esi
mov dword [0x57cd6c], esi
push str.Internet_Explorer
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41af08
mov dword [0x52d1d8], esi
mov dword [0x57cd6c], esi
push str.iexplore
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41af24
mov dword [0x52d1d8], esi
push str.IEXPLORE
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41af40
mov dword [0x52d1d8], esi
push str.Temp
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41af62
mov dword [0x52d1d8], esi
mov dword [0x57cd6c], esi
push 0x492254
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41af84
mov dword [0x52d1d8], esi
mov dword [0x57cd6c], esi
push str.RECYCLE
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x41afb0
push str.Recycled
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41afbc
mov dword [0x52d1d8], esi
mov dword [0x57cd6c], esi
push 0x49223c
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41afd8
mov dword [0x52d1d8], esi
push str..bat
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41aff4
mov dword [0x52d1d8], esi
push str..reg
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41b010
mov dword [0x52d1d8], esi
push str..com
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41b042
push str..com_
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x41b042
mov dword [0x52d1d8], esi
push str..pif
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41b05e
mov dword [0x52d1d8], esi
push str..scr
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41b07a
mov dword [0x52d1d8], esi
push str..hta
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41b096
mov dword [0x52d1d8], esi
push str..vbs
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41b0b2
mov dword [0x52d1d8], esi
push 0x492afc
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41b0ce
mov dword [0x52d1d8], esi
push str.regedit
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41b0ea
mov dword [0x52d1d8], esi
push str.http
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41b106
mov dword [0x52d1d8], esi
push str.HTTP
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41b122
mov dword [0x52d1d8], esi
push str.regsvr32
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41b13e
mov dword [0x52d1d8], esi
push 0x49222c
push 0x513194
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41b15a
mov dword [0x52d1d8], esi
push str.Program_Files_
push 0x57cb28
xor esi, esi
call fcn.0047bec0
add esp, 8
mov ebx, 1
test eax, eax
je 0x41b179
mov esi, ebx
push str.program_files_
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
jne 0x41b193
cmp esi, ebx
jne 0x41b1a5
cmp dword [ebp + 8], 2
jne 0x41b1a5
mov dword [0x52d1d8], ebx
mov dword [0x57cd6c], ebx
push 0x57cb28
call fcn.00448f90
add esp, 4
cmp eax, 2
jne 0x41b1bf
mov dword [0x52d1d8], ebx
jmp 0x41b1c7
cmp dword [0x52d1d8], ebx
jne 0x41b1d6
cmp dword [ebp - 0x18], ebx
jne 0x41b1d6
mov dword [0x57cca4], 0x14
xor esi, esi
cmp esi, 7
jge 0x41b2ed
mov eax, esi
shl eax, 7
add eax, str.RegNetPass
push eax
push 0x513194
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41b2da
cmp esi, 6
mov byte [ebp - 0x28], 0x22
mov byte [ebp - 0x27], al
jne 0x41b234
push str.MRICUMRUpdateAutoClient.exe
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41b234
mov dword [0x57cc58], ebx
mov dword [0x57cd24], ebx
jmp 0x41b2ed
mov ecx, esi
lea edx, [ebp - 0x28]
shl ecx, 8
push edx
lea eax, [ebp - 0x28]
lea edi, [ecx + str.regcsp.exe]
lea ecx, [ebp - 0xa70]
push edi
push eax
push 0x493248
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0xa70]
push 0x57cb28
push edx
call fcn.0047fde0
add esp, 0x1c
test eax, eax
je 0x41b2e0
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x28]
push eax
push edi
push 0x563f28
push ecx
lea edx, [ebp - 0xa70]
push str._s_s_system32_s_s
push edx
call fcn.0047a8f8
lea eax, [ebp - 0xa70]
push 0x57cb28
push eax
call fcn.0047fde0
add esp, 0x20
test eax, eax
je 0x41b2e0
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x28]
push ecx
push edi
push edx
lea eax, [ebp - 0xa70]
push 0x493248
push eax
call fcn.0047a8f8
lea ecx, [ebp - 0xa70]
push 0x57cb28
push ecx
call fcn.0047fde0
add esp, 0x1c
test eax, eax
je 0x41b2e0
inc esi
jmp 0x41b1d8
mov dword [0x57cc58], ebx
mov dword [esi*4 + 0x57cd0c], ebx
cmp dword [0x57cc34], ebx
jne 0x41b3e5
xor edi, edi
cmp edi, 2
jge 0x41b3e5
mov edx, edi
shl edx, 7
add edx, str.nt_service
push edx
push 0x513194
call fcn.0047fde0
add esp, 8
test eax, eax
jne 0x41b3d2
mov byte [ebp - 0x2f], al
mov eax, edi
shl eax, 8
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x30]
lea esi, [eax + str.cnamsclt.exe_rWBLogon.exe]
push ecx
push esi
push edx
lea eax, [ebp - 0x970]
push 0x493248
push eax
mov byte [ebp - 0x30], 0x22
call fcn.0047a8f8
lea ecx, [ebp - 0x970]
push 0x57cb28
push ecx
call fcn.0047fde0
add esp, 0x1c
test eax, eax
je 0x41b3d8
lea edx, [ebp - 0x30]
lea eax, [ebp - 0x30]
push edx
push esi
push 0x563f28
push eax
lea ecx, [ebp - 0x970]
push str._s_s_system32_s_s
push ecx
call fcn.0047a8f8
lea edx, [ebp - 0x970]
push 0x57cb28
push edx
call fcn.0047fde0
add esp, 0x20
test eax, eax
je 0x41b3d8
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x30]
push eax
push esi
push ecx
lea edx, [ebp - 0x970]
push 0x493248
push edx
call fcn.0047a8f8
lea eax, [ebp - 0x970]
push 0x57cb28
push eax
call fcn.0047fde0
add esp, 0x1c
test eax, eax
je 0x41b3d8
inc edi
jmp 0x41b2fb
mov dword [0x57cc58], ebx
mov dword [edi*4 + 0x57cd04], ebx
lea edi, [ebp - 0x770]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jle 0x41650d
lea ecx, [ebp - 0x770]
push ecx
push 0x57cb28
call fcn.0047bec0
add esp, 8
test eax, eax
je 0x41650d
mov dword [0x57ce70], ebx
jmp 0x41650d