Function at 0x401000
Capabilities:
Allocate thread local storage

Disassembly:
push 0x168
push 0
push 0x441b78
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x441b7c], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x441b78], eax
call fcn.00411bd0
call fcn.0040fb00
call fcn.0040f690
call fcn.0040f5f6
call fcn.0040f350
call fcn.0040e960
call fcn.0040d3fc
call fcn.0040cca0
call fcn.0040c46e
call fcn.0040c19e
call fcn.0040b3f3
call fcn.0040ae4d
call fcn.00409ba9
call fcn.004091c4
call fcn.004082af
call fcn.0040809b
mov edx, str.Deploy_8.9.2024.__c_2022_Sergio_Artic
lea ecx, [0x441c94]
call fcn.00407008
call fcn.00409735
mov ebx, eax
cmp ebx, 0x64
jge 0x4010be
call fcn.00409735
mov ebx, eax
cmp ebx, 0x50
je 0x4010be
mov eax, 1
jmp 0x4010c0
xor eax, eax
and eax, eax
je 0x4010df
mov eax, str.je_prestar.
push eax
mov eax, str.Operativni_sistem
push eax
call fcn.00408105
push 9
jmp 0x4051ad
push 0
push 0
push 0
push 1
push 0xa
push 0x7e8
call fcn.00410a96
mov dword [0x441b9c], eax
call fcn.00410c7c
mov ebx, eax
cmp ebx, dword [0x441b9c]
jle 0x40113d
call fcn.00409735
mov ebx, eax
cmp ebx, 0x6e
jge 0x40113d
mov eax, str.je_star.
push eax
mov eax, str.Operativni_sistem
push eax
call fcn.00408105
push 9
jmp 0x4051ad
mov edx, str.https:__bios_ict.hr_dl_2023_
lea ecx, [0x441c04]
call fcn.00407008
mov edx, str.http:__bios_ict.ath.cx:6969_
lea ecx, [0x441cd0]
call fcn.00407008
mov edx, str..C:
lea ecx, [0x441ba0]
call fcn.00407008
mov dword [0x441c2c], 0
push dword [0x441ba0]
call fcn.004053e8
and eax, eax
je 0x401190
mov dword [0x441c2c], 1
mov edx, str.OpenShellSetup_4_4_191.exe
lea ecx, [0x441b90]
call fcn.00407008
mov edx, dword [0x441c04]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
mov edx, str.setups_
push edx
call fcn.00411c60
mov edx, dword [0x441b90]
push edx
call fcn.00411c60
push 0x441ca4
call fcn.00411cc0
mov edx, str.AnyDesk.exe
lea ecx, [0x441c44]
call fcn.00407008
mov edx, str.InstallDefenderUISilent.exe
lea ecx, [0x441c00]
call fcn.00407008
push edx
call fcn.00411c20
pop edx
push eax
mov edx, str.https:__defenderui.com_Download_
push edx
call fcn.00411c60
mov edx, dword [0x441c00]
push edx
call fcn.00411c60
push 0x441c8c
call fcn.00411cc0
call fcn.0040908f
and eax, eax
je 0x401229
jmp 0x401233
push 2
jmp 0x4051ad
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push 0
call fcn.004083ec
call fcn.00407152
add dword [esp], edx
call fcn.004076b0
push 0x441c38
call fcn.00411cc0
mov dword [0x441b98], 0
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push 1
push dword [0x441c38]
call fcn.004076d0
call fcn.00411d50
mov edx, 0x43f11b
call fcn.00407170
mov ecx, eax
call fcn.00407180
je 0x40130c
mov dword [0x441b98], 1
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push 0x18
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push 2
push dword [0x441c38]
call fcn.004077c0
call fcn.00407152
add dword [esp], edx
call fcn.004076d0
push 0x441c38
call fcn.00411cc0
mov edx, str.c:_setups_
lea ecx, [0x441c90]
call fcn.00407008
mov edx, str.C:Program_FilesDWAgent_nativedwagsvc.exe
lea ecx, [0x441c18]
call fcn.00407008
mov edx, str.C:Program_FilesDWAgentconfig.json
lea ecx, [0x441c6c]
call fcn.00407008
mov edx, dword [0x441c04]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
mov edx, str.setups_dwagent.exe
push edx
call fcn.00411c60
push 0x441bd4
call fcn.00411cc0
mov edx, str.c:_temp_dwagent.log
lea ecx, [0x441c70]
call fcn.00407008
mov dword [0x441bb8], 0
push 0
push 0
push 0
push 0xe
push 8
push 0x7e9
call fcn.00410a96
mov dword [0x441be4], eax
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
mov eax, str.PROCESSOR_ARCHITECTURE
push eax
mov eax, str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment_
push eax
push 0x80000002
call fcn.004052a7
call fcn.00407152
add dword [esp], edx
call fcn.004078c0
push 0x441c1c
call fcn.00411cc0
push edx
call fcn.00411c20
pop edx
push eax
mov eax, str.amd64
push eax
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push dword [0x441c1c]
call fcn.004078e0
call fcn.00407152
add dword [esp], edx
call fcn.004079a0
call fcn.004071b0
mov ebx, eax
and ebx, ebx
jne 0x401475
push edx
call fcn.00411c20
pop edx
push eax
mov eax, 0x43f968
push eax
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push dword [0x441c1c]
call fcn.004078e0
call fcn.00407152
add dword [esp], edx
call fcn.004079a0
call fcn.004071b0
mov ebx, eax
and ebx, ebx
jne 0x401475
mov eax, 1
jmp 0x401477
xor eax, eax
and eax, eax
je 0x40148d
mov edx, 0x43f01e
lea ecx, [0x441c1c]
call fcn.00407008
jmp 0x40149d
mov edx, str._64_bit
lea ecx, [0x441c1c]
call fcn.00407008
mov dword [0x441c40], 0
call fcn.00409735
mov ebx, eax
cmp ebx, 0x4b
je 0x4014d9
call fcn.00409735
mov ebx, eax
cmp ebx, 0x55
je 0x4014d9
call fcn.00409735
mov ebx, eax
cmp ebx, 0x5f
je 0x4014d9
call fcn.00409735
mov ebx, eax
cmp ebx, 0x69
je 0x4014d9
jmp 0x4014e0
mov eax, 1
jmp 0x4014e2
xor eax, eax
and eax, eax
je 0x4014f0
mov dword [0x441c40], 1
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
mov eax, str.ProductName
push eax
mov eax, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push eax
push 0x80000002
call fcn.004052a7
call fcn.00407152
add dword [esp], edx
call fcn.004078c0
push 0x441cb8
call fcn.00411cc0
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
mov eax, str.ReleaseId
push eax
mov eax, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push eax
push 0x80000002
call fcn.004052a7
call fcn.00407152
add dword [esp], edx
call fcn.004078c0
push 0x441cb0
call fcn.00411cc0
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
mov eax, str.CurrentBuild
push eax
mov eax, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push eax
push 0x80000002
call fcn.004052a7
call fcn.00407152
add dword [esp], edx
call fcn.004078c0
push 0x441c48
call fcn.00411cc0
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
mov eax, str.DisplayVersion
push eax
mov eax, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push eax
push 0x80000002
call fcn.004052a7
call fcn.00407152
add dword [esp], edx
call fcn.004078c0
push 0x441cb4
call fcn.00411cc0
push edx
call fcn.00411c20
pop edx
push eax
push 1
mov eax, str.error
push eax
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push dword [0x441cb0]
call fcn.004078e0
call fcn.00407152
add dword [esp], edx
call fcn.00407940
call fcn.004071b0
mov ebx, eax
and ebx, ebx
jle 0x40165a
mov edx, 0x43f01e
lea ecx, [0x441cb0]
call fcn.00407008
mov dword [0x441bbc], 0
mov dword [0x441b94], 0
push edx
call fcn.00411c20
pop edx
push eax
mov eax, str.embedded
push eax
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push dword [0x441cb8]
call fcn.004078e0
call fcn.00407152
add dword [esp], edx
call fcn.004079a0
call fcn.004071b0
mov ebx, eax
and ebx, ebx
jg 0x401737
push edx
call fcn.00411c20
pop edx
push eax
mov eax, str.ltsb
push eax
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push dword [0x441cb8]
call fcn.004078e0
call fcn.00407152
add dword [esp], edx
call fcn.004079a0
call fcn.004071b0
mov ebx, eax
and ebx, ebx
jg 0x401737
push edx
call fcn.00411c20
pop edx
push eax
mov eax, str.ltsc
push eax
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push dword [0x441cb8]
call fcn.004078e0
call fcn.00407152
add dword [esp], edx
call fcn.004079a0
call fcn.004071b0
mov ebx, eax
and ebx, ebx
jg 0x401737
jmp 0x40173e
mov eax, 1
jmp 0x401740
xor eax, eax
and eax, eax
je 0x40174e
mov dword [0x441bbc], 1
mov ebx, dword [0x441bbc]
and ebx, ebx
jne 0x4017a5
push edx
call fcn.00411c20
pop edx
push eax
push 1
mov eax, str.server
push eax
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push dword [0x441cb8]
call fcn.004078e0
call fcn.00407152
add dword [esp], edx
call fcn.00407940
call fcn.004071b0
mov ebx, eax
and ebx, ebx
jle 0x4017a5
mov eax, 1
jmp 0x4017a7
xor eax, eax
and eax, eax
je 0x4017b5
mov dword [0x441c40], 1
mov dword [0x441c88], 0
mov ebx, dword [0x441c40]
and ebx, ebx
jne 0x4017fa
call fcn.00409735
mov ebx, eax
cmp ebx, 0x6e
je 0x4017e6
call fcn.00409735
mov ebx, eax
cmp ebx, 0xc8
je 0x4017e6
jmp 0x4017ed
mov eax, 1
jmp 0x4017ef
xor eax, eax
and eax, eax
je 0x4017fa
mov eax, 1
jmp 0x4017fc
xor eax, eax
and eax, eax
je 0x401963
push dword [0x441c48]
call fcn.00407a00
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jl 0x401826
jg 0x401822
cmp ebx, 0x55f0
jb 0x401826
xor eax, eax
jmp 0x40182b
mov eax, 1
or eax, eax
jne 0x401963
mov dword [0x441c88], 1
push edx
call fcn.00411c20
pop edx
push eax
push 1
mov eax, str.home
push eax
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push dword [0x441cb8]
call fcn.004078e0
call fcn.00407152
add dword [esp], edx
call fcn.00407940
call fcn.004071b0
mov ebx, eax
and ebx, ebx
jle 0x401898
mov edx, str.Windows_11_Home
lea ecx, [0x441cb8]
call fcn.00407008
jmp 0x401945
push edx
call fcn.00411c20
pop edx
push eax
push 1
mov eax, str.enterprise
push eax
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push dword [0x441cb8]
call fcn.004078e0
call fcn.00407152
add dword [esp], edx
call fcn.00407940
call fcn.004071b0
mov ebx, eax
and ebx, ebx
jg 0x401926
push edx
call fcn.00411c20
pop edx
push eax
push 1
mov eax, str._iot
push eax
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push dword [0x441cb8]
call fcn.004078e0
call fcn.00407152
add dword [esp], edx
call fcn.00407940
call fcn.004071b0
mov ebx, eax
and ebx, ebx
jg 0x401926
jmp 0x40192d
mov eax, 1
jmp 0x40192f
xor eax, eax
and eax, eax
je 0x401935
jmp 0x401945
mov edx, str.Windows_11_Pro
lea ecx, [0x441cb8]
call fcn.00407008
mov edx, dword [0x441cb4]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
push 0x441cb0
call fcn.00411cc0
mov ebx, dword [0x441bbc]
and ebx, ebx
jne 0x40198a
call fcn.00409735
mov ebx, eax
cmp ebx, 0x6e
jne 0x40198a
mov ebx, dword [0x441c88]
and ebx, ebx
jne 0x40198a
mov eax, 1
jmp 0x40198c
xor eax, eax
and eax, eax
je 0x401aea
push dword [0x441cb4]
call fcn.00407b30
mov ebx, eax
cmp ebx, 4
jne 0x4019bf
push dword [0x441cb0]
call fcn.00407b30
mov ebx, eax
cmp ebx, 4
jne 0x4019bf
mov eax, 1
jmp 0x4019c1
xor eax, eax
and eax, eax
je 0x401aea
push edx
call fcn.00411c20
pop edx
push eax
push 1
mov eax, str.enterprise
push eax
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push dword [0x441cb8]
call fcn.004078e0
call fcn.00407152
add dword [esp], edx
call fcn.00407940
call fcn.004071b0
mov ebx, eax
and ebx, ebx
jle 0x401a42
mov edx, str.Windows_10_Pro
lea ecx, [0x441cb8]
call fcn.00407008
mov edx, dword [0x441cb4]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
push 0x441cb0
call fcn.00411cc0
jmp 0x401aea
push edx
call fcn.00411c20
pop edx
push eax
push 1
mov eax, str.education
push eax
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push dword [0x441cb8]
call fcn.004078e0
call fcn.00407152
add dword [esp], edx
call fcn.00407940
call fcn.004071b0
mov ebx, eax
and ebx, ebx
jle 0x401ab8
mov edx, str.Windows_10_Pro
lea ecx, [0x441cb8]
call fcn.00407008
mov edx, dword [0x441cb4]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
push 0x441cb0
call fcn.00411cc0
jmp 0x401aea
push dword [0x441cb4]
mov edx, dword [0x441cb0]
pop ecx
call fcn.00407180
jne 0x401aea
mov edx, dword [0x441cb4]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
push 0x441cb0
call fcn.00411cc0
cmp dword [0x441bbc], 0
je 0x401b10
call fcn.00409735
mov ebx, eax
cmp ebx, 0x6e
jne 0x401b10
mov ebx, dword [0x441c88]
and ebx, ebx
jne 0x401b10
mov eax, 1
jmp 0x401b12
xor eax, eax
and eax, eax
je 0x401b79
push dword [0x441cb4]
call fcn.00407b30
mov ebx, eax
cmp ebx, 4
jne 0x401b41
push dword [0x441cb0]
call fcn.00407b30
mov ebx, eax
cmp ebx, 4
jne 0x401b41
mov eax, 1
jmp 0x401b43
xor eax, eax
and eax, eax
je 0x401b79
push dword [0x441cb4]
mov edx, dword [0x441cb0]
pop ecx
call fcn.00407180
jne 0x401b79
mov edx, dword [0x441cb4]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
push 0x441cb0
call fcn.00411cc0
cmp dword [0x441bbc], 0
je 0x401bff
push edx
call fcn.00411c20
pop edx
push eax
mov eax, str._iot
push eax
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push dword [0x441cb8]
call fcn.004078e0
call fcn.00407152
add dword [esp], edx
call fcn.004079a0
call fcn.004071b0
mov ebx, eax
and ebx, ebx
jle 0x401bff
mov dword [0x441b94], 1
mov ebx, dword [0x441c88]
and ebx, ebx
jne 0x401bff
push 0
push 0
push 0
push 0xd
push 1
push 0x7f0
call fcn.00410a96
mov dword [0x441c5c], eax
mov dword [0x441c7c], 0
cmp dword [0x441c40], 0
jne 0x401c34
call fcn.00406bf5
and eax, eax
jne 0x401c34
call fcn.00405577
mov ebx, eax
and ebx, ebx
je 0x401c34
call fcn.004098eb
mov ebx, eax
cmp ebx, 4
jl 0x401c34
jmp 0x401c3b
mov eax, 1
jmp 0x401c3d
xor eax, eax
and eax, eax
je 0x401c46
jmp 0x401eb4
call fcn.00409735
mov ebx, eax
cmp ebx, 0x6e
jge 0x401c57
jmp 0x401eb4
push dword [0x441c1c]
mov edx, 0x43f01e
pop ecx
call fcn.00407180
je 0x401d0e
push 0
call fcn.004098f3
push edx
push eax
push 0
push 0x400
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.00407010
mov dword [esp], eax
mov dword [esp + 4], edx
push 0
push 0x400
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.00407010
mov dword [esp], eax
mov dword [esp + 4], edx
pop ebx
pop edi
cmp edi, 0
jl 0x401ccb
jg 0x401cc7
cmp ebx, 0xc00
jb 0x401ccb
xor eax, eax
jmp 0x401cd0
mov eax, 1
or eax, eax
jne 0x401cf9
cmp dword [0x441c2c], 0
je 0x401cf9
call fcn.00410c7c
push eax
call fcn.00410cb3
mov ebx, eax
cmp ebx, dword [0x441be4]
jge 0x401cf9
mov eax, 1
jmp 0x401cfb
xor eax, eax
and eax, eax
je 0x401d09
mov dword [0x441c7c], 1
jmp 0x401eb4
mov ebx, dword [0x441c88]
and ebx, ebx
jne 0x401e2e
push 0
call fcn.004098f3
push edx
push eax
push 0
push 0x400
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.00407010
mov dword [esp], eax
mov dword [esp + 4], edx
push 0
push 0x400
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.00407010
mov dword [esp], eax
mov dword [esp + 4], edx
pop ebx
pop edi
cmp edi, 0
jl 0x401d79
jg 0x401d75
cmp ebx, 0x1c00
jb 0x401d79
xor eax, eax
jmp 0x401d7e
mov eax, 1
or eax, eax
jne 0x401d93
mov ebx, dword [0x441c2c]
and ebx, ebx
jne 0x401d93
mov eax, 1
jmp 0x401d95
xor eax, eax
and eax, eax
je 0x401da3
mov dword [0x441c7c], 1
push 0
call fcn.004098f3
push edx
push eax
push 0
push 0x400
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.00407010
mov dword [esp], eax
mov dword [esp + 4], edx
push 0
push 0x400
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.00407010
mov dword [esp], eax
mov dword [esp + 4], edx
pop ebx
pop edi
cmp edi, 0
jl 0x401e00
jg 0x401dfc
cmp ebx, 0xc00
jb 0x401e00
xor eax, eax
jmp 0x401e05
mov eax, 1
or eax, eax
jne 0x401e19
cmp dword [0x441c2c], 0
je 0x401e19
mov eax, 1
jmp 0x401e1b
xor eax, eax
and eax, eax
je 0x401e29
mov dword [0x441c7c], 1
jmp 0x401eb4
push 0
call fcn.004098f3
push edx
push eax
push 0
push 0x400
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.00407010
mov dword [esp], eax
mov dword [esp + 4], edx
push 0
push 0x400
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.00407010
mov dword [esp], eax
mov dword [esp + 4], edx
pop ebx
pop edi
cmp edi, 0
jl 0x401e8b
jg 0x401e87
cmp ebx, 0x1c00
jb 0x401e8b
xor eax, eax
jmp 0x401e90
mov eax, 1
or eax, eax
jne 0x401ea4
cmp dword [0x441c2c], 0
je 0x401ea4
mov eax, 1
jmp 0x401ea6
xor eax, eax
and eax, eax
je 0x401eb4
mov dword [0x441c7c], 1
mov edx, 0x43f01e
lea ecx, [0x441c68]
call fcn.00407008
mov edx, str.C:Program_Files__x86_Kaspersky_Lab_
lea ecx, [0x441bfc]
call fcn.00407008
push dword [0x441bfc]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x401ef1
cmp edi, 0xffffffff
jne 0x401ef1
xor eax, eax
jmp 0x401ef6
mov eax, 1
or eax, eax
je 0x401f0a
mov edx, str.C:Program_FilesKaspersky_Lab_
lea ecx, [0x441bfc]
call fcn.00407008
push dword [0x441bfc]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x401f23
cmp edi, 0xffffffff
je 0x401f27
xor eax, eax
jmp 0x401f2c
mov eax, 1
or eax, eax
je 0x401f41
mov ebx, dword [0x441c40]
and ebx, ebx
jne 0x401f41
mov eax, 1
jmp 0x401f43
xor eax, eax
and eax, eax
je 0x402001
mov edx, str.kavremvr.exe
lea ecx, [0x441c68]
call fcn.00407008
push dword [0x441c68]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jl 0x401f7d
jg 0x401f79
cmp ebx, 0x1869f
jb 0x401f7d
xor eax, eax
jmp 0x401f82
mov eax, 1
or eax, eax
je 0x401f97
push dword [0x441c68]
mov eax, str.https:__media.kaspersky.com_utilities_ConsumerUtilities_kavremvr.exe
push eax
call fcn.00405f5b
push dword [0x441c68]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jl 0x401fb9
jg 0x401fb5
cmp ebx, 0x1869f
jb 0x401fb9
xor eax, eax
jmp 0x401fbe
mov eax, 1
or eax, eax
je 0x402001
push edx
call fcn.00411c20
pop edx
push eax
push dword [0x441c68]
mov edx, dword [0x441c04]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
mov edx, str.remover_kavremvr.exe
push edx
call fcn.00411c60
call fcn.00407152
add dword [esp], edx
call fcn.00405f5b
call fcn.004071b0
mov edx, str.C:Program_FilesFortinet_
lea ecx, [0x441c60]
call fcn.00407008
push dword [0x441c60]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x40202e
cmp edi, 0xffffffff
jne 0x40202e
xor eax, eax
jmp 0x402033
mov eax, 1
or eax, eax
je 0x402047
mov edx, str.C:Program_Files__x86_Fortinet_
lea ecx, [0x441c60]
call fcn.00407008
mov edx, str.C:Program_Files__x86_360_
lea ecx, [0x441c74]
call fcn.00407008
push dword [0x441c74]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x402074
cmp edi, 0xffffffff
jne 0x402074
xor eax, eax
jmp 0x402079
mov eax, 1
or eax, eax
je 0x40208d
mov edx, str.C:Program_Files360_
lea ecx, [0x441c74]
call fcn.00407008
mov edx, str.C:Program_FilesAVAST_Software_
lea ecx, [0x441be0]
call fcn.00407008
mov edx, str.C:Program_Files__x86_Avira_
lea ecx, [0x441bcc]
call fcn.00407008
mov edx, str.C:Program_FilesESET_
lea ecx, [0x441cbc]
call fcn.00407008
mov edx, str.C:Program_Files__x86_Comodo_
lea ecx, [0x441ccc]
call fcn.00407008
mov edx, str.C:Program_FilesAVG_
lea ecx, [0x441cc8]
call fcn.00407008
mov edx, str.C:Program_FilesSophos_
lea ecx, [0x441ba8]
call fcn.00407008
mov edx, str.C:Program_FilesMcAfee_
lea ecx, [0x441cdc]
call fcn.00407008
mov edx, str.C:Program_FilesBitdefender_
lea ecx, [0x441cd4]
call fcn.00407008
mov edx, str.C:Program_FilesMalwarebytes_
lea ecx, [0x441c9c]
call fcn.00407008
mov edx, str.C:Program_FilesEmsisoft_Anti_Malware_
lea ecx, [0x441bf0]
call fcn.00407008
push dword [0x441cc8]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x402146
cmp edi, 0xffffffff
je 0x40214a
xor eax, eax
jmp 0x40214f
mov eax, 1
or eax, eax
je 0x4021d9
mov edx, str.avgclear.exe
lea ecx, [0x441c68]
call fcn.00407008
push dword [0x441c68]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jl 0x402189
jg 0x402185
cmp ebx, 0x1869f
jb 0x402189
xor eax, eax
jmp 0x40218e
mov eax, 1
or eax, eax
je 0x4021a3
push dword [0x441c68]
mov eax, str.https:__install.avcdn.net_avg_iavs9x_avgclear.exe
push eax
call fcn.00405f5b
push dword [0x441c68]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x4021c5
jl 0x4021c1
cmp ebx, 0x1869f
ja 0x4021c5
xor eax, eax
jmp 0x4021ca
mov eax, 1
or eax, eax
je 0x4021d9
push dword [0x441c68]
call fcn.004089be
push dword [0x441be0]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x4021f2
cmp edi, 0xffffffff
je 0x4021f6
xor eax, eax
jmp 0x4021fb
mov eax, 1
or eax, eax
je 0x402285
mov edx, str.avastclear.exe
lea ecx, [0x441c68]
call fcn.00407008
push dword [0x441c68]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jl 0x402235
jg 0x402231
cmp ebx, 0x1869f
jb 0x402235
xor eax, eax
jmp 0x40223a
mov eax, 1
or eax, eax
je 0x40224f
push dword [0x441c68]
mov eax, str.http:__iavs9x.avg.u.avcdn.net_iavs9x_avastclear.exe
push eax
call fcn.00405f5b
push dword [0x441c68]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x402271
jl 0x40226d
cmp ebx, 0x1869f
ja 0x402271
xor eax, eax
jmp 0x402276
mov eax, 1
or eax, eax
je 0x402285
push dword [0x441c68]
call fcn.004089be
push dword [0x441cdc]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x40229e
cmp edi, 0xffffffff
je 0x4022a2
xor eax, eax
jmp 0x4022a7
mov eax, 1
or eax, eax
je 0x402406
mov eax, str.C:Program_Files__x86_McAfeeVirusScan_Enterprise_
push eax
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x4022c8
cmp edi, 0xffffffff
je 0x4022cc
xor eax, eax
jmp 0x4022d1
mov eax, 1
or eax, eax
jne 0x4022fd
mov eax, str.C:Program_Files__x86_McAfeeVirusScan_Enterprise_
push eax
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x4022ee
cmp edi, 0xffffffff
je 0x4022f2
xor eax, eax
jmp 0x4022f7
mov eax, 1
or eax, eax
jne 0x4022fd
jmp 0x402304
mov eax, 1
jmp 0x402306
xor eax, eax
and eax, eax
je 0x40231a
mov eax, str.appwiz.cpl
push eax
call fcn.004089be
jmp 0x402406
mov edx, str.MCPR.exe
lea ecx, [0x441c68]
call fcn.00407008
push dword [0x441c68]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jl 0x40234c
jg 0x402348
cmp ebx, 0x1869f
jb 0x40234c
xor eax, eax
jmp 0x402351
mov eax, 1
or eax, eax
je 0x402366
push dword [0x441c68]
mov eax, str.http:__download.mcafee.com_molbin_iss_loc_SupportTools_MCPR_MCPR.exe
push eax
call fcn.00405f5b
push dword [0x441c68]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jl 0x402388
jg 0x402384
cmp ebx, 0x1869f
jb 0x402388
xor eax, eax
jmp 0x40238d
mov eax, 1
or eax, eax
je 0x4023d0
push edx
call fcn.00411c20
pop edx
push eax
push dword [0x441c68]
mov edx, dword [0x441c04]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
mov edx, str.remover_MCPR.exe
push edx
call fcn.00411c60
call fcn.00407152
add dword [esp], edx
call fcn.00405f5b
call fcn.004071b0
push dword [0x441c68]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x4023f2
jl 0x4023ee
cmp ebx, 0x1869f
ja 0x4023f2
xor eax, eax
jmp 0x4023f7
mov eax, 1
or eax, eax
je 0x402406
push dword [0x441c68]
call fcn.004089be
push dword [0x441cd4]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x40241f
cmp edi, 0xffffffff
je 0x402423
xor eax, eax
jmp 0x402428
mov eax, 1
or eax, eax
je 0x402437
mov eax, str.appwiz.cpl
push eax
call fcn.004089be
push dword [0x441bcc]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x402450
cmp edi, 0xffffffff
je 0x402454
xor eax, eax
jmp 0x402459
mov eax, 1
or eax, eax
jne 0x4024ab
push dword [0x441c60]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x402476
cmp edi, 0xffffffff
je 0x40247a
xor eax, eax
jmp 0x40247f
mov eax, 1
or eax, eax
jne 0x4024ab
push dword [0x441cbc]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x40249c
cmp edi, 0xffffffff
je 0x4024a0
xor eax, eax
jmp 0x4024a5
mov eax, 1
or eax, eax
jne 0x4024ab
jmp 0x4024b2
mov eax, 1
jmp 0x4024b4
xor eax, eax
and eax, eax
je 0x4024c3
mov eax, str.appwiz.cpl
push eax
call fcn.004089be
push dword [0x441ccc]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x4024dc
cmp edi, 0xffffffff
je 0x4024e0
xor eax, eax
jmp 0x4024e5
mov eax, 1
or eax, eax
je 0x4024f4
mov eax, str.appwiz.cpl
push eax
call fcn.004089be
mov edx, str.C:Program_Files__x86_Kaspersky_LabKaspersky_Security_Cloud_19.0.0_
lea ecx, [0x441c14]
call fcn.00407008
push dword [0x441c14]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x402521
cmp edi, 0xffffffff
jne 0x402521
xor eax, eax
jmp 0x402526
mov eax, 1
or eax, eax
je 0x40253a
mov edx, str.C:Program_FilesKaspersky_LabKaspersky_Security_Cloud_19.0.0_
lea ecx, [0x441c14]
call fcn.00407008
push dword [0x441c14]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x402557
cmp edi, 0xffffffff
jne 0x402557
xor eax, eax
jmp 0x40255c
mov eax, 1
or eax, eax
je 0x402570
mov edx, str.C:Program_FilesKaspersky_Lab__x86_Kaspersky_Security_Cloud_20.0.0_
lea ecx, [0x441c14]
call fcn.00407008
push dword [0x441c14]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x40258d
cmp edi, 0xffffffff
jne 0x40258d
xor eax, eax
jmp 0x402592
mov eax, 1
or eax, eax
je 0x4025a6
mov edx, str.C:Program_FilesKaspersky_LabKaspersky_Security_Cloud_20.0.0_
lea ecx, [0x441c14]
call fcn.00407008
push dword [0x441c14]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x4025c3
cmp edi, 0xffffffff
jne 0x4025c3
xor eax, eax
jmp 0x4025c8
mov eax, 1
or eax, eax
je 0x4025dc
mov edx, str.C:Program_FilesKaspersky_Lab__x86_Kaspersky_Security_Cloud_21.0.0_
lea ecx, [0x441c14]
call fcn.00407008
push dword [0x441c14]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x4025f9
cmp edi, 0xffffffff
jne 0x4025f9
xor eax, eax
jmp 0x4025fe
mov eax, 1
or eax, eax
je 0x402612
mov edx, str.C:Program_FilesKaspersky_LabKaspersky_Security_Cloud_21.0.0_
lea ecx, [0x441c14]
call fcn.00407008
push dword [0x441c14]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x40262f
cmp edi, 0xffffffff
jne 0x40262f
xor eax, eax
jmp 0x402634
mov eax, 1
or eax, eax
je 0x402648
mov edx, str.C:Program_FilesKaspersky_Lab__x86_Kaspersky_Security_Cloud_22.0.0_
lea ecx, [0x441c14]
call fcn.00407008
push dword [0x441c14]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x402665
cmp edi, 0xffffffff
jne 0x402665
xor eax, eax
jmp 0x40266a
mov eax, 1
or eax, eax
je 0x40267e
mov edx, str.C:Program_FilesKaspersky_LabKaspersky_Security_Cloud_22.0.0_
lea ecx, [0x441c14]
call fcn.00407008
push dword [0x441c14]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x402697
cmp edi, 0xffffffff
je 0x40269b
xor eax, eax
jmp 0x4026a0
mov eax, 1
or eax, eax
je 0x402794
mov edx, str.kavremvr.exe
lea ecx, [0x441c68]
call fcn.00407008
push dword [0x441c68]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jl 0x4026da
jg 0x4026d6
cmp ebx, 0x1869f
jb 0x4026da
xor eax, eax
jmp 0x4026df
mov eax, 1
or eax, eax
je 0x4026f4
push dword [0x441c68]
mov eax, str.https:__media.kaspersky.com_utilities_ConsumerUtilities_kavremvr.exe
push eax
call fcn.00405f5b
push dword [0x441c68]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jl 0x402716
jg 0x402712
cmp ebx, 0x1869f
jb 0x402716
xor eax, eax
jmp 0x40271b
mov eax, 1
or eax, eax
je 0x40275e
push edx
call fcn.00411c20
pop edx
push eax
push dword [0x441c68]
mov edx, dword [0x441c04]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
mov edx, str.remover_kavremvr.exe
push edx
call fcn.00411c60
call fcn.00407152
add dword [esp], edx
call fcn.00405f5b
call fcn.004071b0
push dword [0x441c68]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x402780
jl 0x40277c
cmp ebx, 0x1869f
ja 0x402780
xor eax, eax
jmp 0x402785
mov eax, 1
or eax, eax
je 0x402794
push dword [0x441c68]
call fcn.004089be
push dword [0x441c90]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x4027b1
cmp edi, 0xffffffff
jne 0x4027b1
xor eax, eax
jmp 0x4027b6
mov eax, 1
or eax, eax
je 0x4027d3
push dword [0x441c90]
call fcn.0040f7c1
and eax, eax
je 0x4027d3
push 0x1f4
call fcn.00409985
push edx
call fcn.00411c20
pop edx
push eax
mov edx, dword [0x441c90]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
mov edx, str..nouac
push edx
call fcn.00411c60
call fcn.00407152
add dword [esp], edx
call fcn.0040f69c
call fcn.004071b0
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xffffffff
jne 0x40281a
cmp edi, 0xffffffff
je 0x40281e
xor eax, eax
jmp 0x402823
mov eax, 1
or eax, eax
je 0x40289e
call fcn.00409735
mov ebx, eax
cmp ebx, 0x46
jl 0x40289e
mov eax, str.useraccountcontrolsettings
push eax
call fcn.004089be
and eax, eax
je 0x40289e
push edx
call fcn.00411c20
pop edx
push eax
mov edx, dword [0x441c90]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
mov edx, str..nouac
push edx
call fcn.00411c60
call fcn.00411d50
push 1
call fcn.00407152
add dword [esp + 4], edx
call fcn.0040fd10
call fcn.004071b0
and eax, eax
je 0x40289e
push 1
call fcn.0040fea0
push 1
call fcn.0040fa30
push edx
call fcn.00411c20
pop edx
push eax
mov edx, dword [0x441c90]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
mov edx, str..nowd
push edx
call fcn.00411c60
call fcn.00407152
add dword [esp], edx
call fcn.0040f69c
call fcn.004071b0
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xffffffff
jne 0x4028e5
cmp edi, 0xffffffff
je 0x4028e9
xor eax, eax
jmp 0x4028ee
mov eax, 1
or eax, eax
je 0x402a10
call fcn.00409735
mov ebx, eax
cmp ebx, 0x6e
jl 0x402a10
mov eax, 0x43f01e
push eax
mov eax, str._windowsdefender:
push eax
mov eax, str.explorer.exe
push eax
call fcn.00408478
and eax, eax
je 0x40297d
push edx
call fcn.00411c20
pop edx
push eax
mov edx, dword [0x441c90]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
mov edx, str..nowd
push edx
call fcn.00411c60
call fcn.00411d50
push 1
call fcn.00407152
add dword [esp + 4], edx
call fcn.0040fd10
call fcn.004071b0
and eax, eax
je 0x40297d
push 1
call fcn.0040fea0
push 1
call fcn.0040fa30
cmp dword [0x441c88], 0
jne 0x402991
cmp dword [0x441c40], 0
jne 0x402991
jmp 0x402998
mov eax, 1
jmp 0x40299a
xor eax, eax
and eax, eax
je 0x402a10
mov eax, 0x43f01e
push eax
mov eax, str.__c_control
push eax
mov eax, 0x43f9e9
push eax
call fcn.00408478
mov eax, 0x43f01e
push eax
mov eax, str.__c_ncpa.cpl
push eax
mov eax, 0x43f9e9
push eax
call fcn.00408478
mov eax, 0x43f01e
push eax
mov eax, str.__c_powercfg.cpl
push eax
mov eax, 0x43f9e9
push eax
call fcn.00408478
mov eax, 0x43f01e
push eax
mov eax, str.__c_sysdm.cpl
push eax
mov eax, 0x43f9e9
push eax
call fcn.00408478
push 0x43f01e
mov eax, str._add__HKCUSoftwareClassesCLSID86ca1aa0_34aa_4e8b_a509_50c905bae2a2InprocServer32___f__ve
push eax
mov eax, 0x43f3a3
push eax
call fcn.00405204
push dword [0x441c18]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x402a32
jl 0x402a2e
cmp ebx, 0x1000
ja 0x402a32
xor eax, eax
jmp 0x402a37
mov eax, 1
or eax, eax
je 0x402ae4
push dword [0x441c6c]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x402a5e
jl 0x402a5a
cmp ebx, 0x47
ja 0x402a5e
xor eax, eax
jmp 0x402a63
mov eax, 1
or eax, eax
jne 0x402ae4
push dword [0x441c70]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x402a86
jl 0x402a82
cmp ebx, 0
ja 0x402a86
xor eax, eax
jmp 0x402a8b
mov eax, 1
or eax, eax
je 0x402ada
push edx
call fcn.00411c20
pop edx
push eax
mov eax, 0x43f01e
push eax
push edx
call fcn.00411c20
pop edx
push eax
mov edx, 0x43f0ed
push edx
call fcn.00411c60
mov edx, dword [0x441c70]
push edx
call fcn.00411c60
call fcn.00411d50
mov eax, str.notepad.exe
push eax
call fcn.00407152
add dword [esp + 4], edx
call fcn.00408478
call fcn.004071b0
mov dword [0x441bb8], 1
call fcn.00409735
mov ebx, eax
cmp ebx, 0x5a
jg 0x402b08
call fcn.00409735
mov ebx, eax
cmp ebx, 0x50
jne 0x402afe
jmp 0x402b08
mov dword [0x441bb8], 1
call fcn.004098eb
mov ebx, eax
cmp ebx, 1
je 0x402b1f
call fcn.00406bf5
and eax, eax
jne 0x402b1f
jmp 0x402b26
mov eax, 1
jmp 0x402b28
xor eax, eax
and eax, eax
je 0x402b51
mov eax, str.je_preslab.
push eax
mov eax, str.Sistem
push eax
call fcn.00408105
mov ebx, dword [0x441c2c]
and ebx, ebx
jne 0x402b51
mov dword [0x441bb8], 1
push 0
call fcn.004098f3
push edx
push eax
push 0
push 0x400
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.00407010
mov dword [esp], eax
mov dword [esp + 4], edx
push 0
push 0x400
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.00407010
mov dword [esp], eax
mov dword [esp + 4], edx
pop ebx
pop edi
cmp edi, 0
jg 0x402bae
jl 0x402baa
cmp ebx, 0xa00
ja 0x402bae
xor eax, eax
jmp 0x402bb3
mov eax, 1
or eax, eax
jne 0x402be6
mov ebx, dword [0x441bc4]
and ebx, ebx
jne 0x402bd2
mov eax, str.memorije.
push eax
mov eax, str.Premalo
push eax
call fcn.00408105
mov ebx, dword [0x441c2c]
and ebx, ebx
jne 0x402be6
mov dword [0x441bb8], 1
cmp dword [0x441bb8], 0
je 0x402c21
mov eax, str.C:Program_FilesDWAgent_nativedwaglnc.exe
push eax
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x402c11
jl 0x402c0d
cmp ebx, 0x1000
ja 0x402c11
xor eax, eax
jmp 0x402c16
mov eax, 1
or eax, eax
je 0x402c21
mov eax, 1
jmp 0x402c23
xor eax, eax
and eax, eax
je 0x402c80
push 0x43f01e
mov eax, str._uninstall
push eax
mov eax, str.C:Program_FilesDWAgent_nativedwaglnc.exe
push eax
call fcn.00405204
push edx
call fcn.00411c20
pop edx
push eax
mov edx, dword [0x441c90]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
mov edx, str.dwagent.exe
push edx
call fcn.00411c60
call fcn.00407152
add dword [esp], edx
call fcn.0040f868
call fcn.004071b0
push 1
jmp 0x4051ad
mov dword [0x441bc4], 0
mov edx, dword [0x441c38]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
push 0x441bd0
call fcn.00411cc0
push dword [0x441c38]
mov edx, 0x43f01e
pop ecx
call fcn.00407180
je 0x402d1b
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push 0x18
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
call fcn.004099a6
call fcn.00407152
add dword [esp], edx
call fcn.004078c0
call fcn.00407152
add dword [esp], edx
call fcn.004076d0
push 0x441bd0
call fcn.00411cc0
jmp 0x402d25
mov dword [0x441bc4], 1
push dword [0x441c18]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xffffffff
jne 0x402d3e
cmp edi, 0xffffffff
je 0x402d42
xor eax, eax
jmp 0x402d47
mov eax, 1
or eax, eax
je 0x403119
mov edx, str.dwagent.exe
lea ecx, [0x441c18]
call fcn.00407008
push edx
call fcn.00411c20
pop edx
push eax
mov edx, dword [0x441c90]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
mov edx, dword [0x441c18]
push edx
call fcn.00411c60
call fcn.00411d50
push dword [0x441bd4]
call fcn.00407152
add dword [esp + 4], edx
call fcn.00408c90
call fcn.004071b0
and eax, eax
je 0x403119
push dword [0x441c38]
mov edx, 0x43f01e
pop ecx
call fcn.00407180
je 0x402dfc
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
call fcn.00410c7c
push eax
mov eax, str._hh__ii__ss__yyyy__mm__dd_
push eax
call fcn.00410cfa
mov edx, dword [0x441bd0]
push edx
call fcn.00411c60
push 0x441bd0
call fcn.00411cc0
jmp 0x403119
cmp dword [0x441c2c], 0
je 0x402e07
jmp 0x402e30
push edx
call fcn.00411c20
pop edx
push eax
mov edx, str.HDD_
push edx
call fcn.00411c60
mov edx, dword [0x441bd0]
push edx
call fcn.00411c60
push 0x441bd0
call fcn.00411cc0
call fcn.00409735
mov ebx, eax
cmp ebx, 0x50
jne 0x402e6a
push edx
call fcn.00411c20
pop edx
push eax
mov edx, 0x43fbbc
push edx
call fcn.00411c60
mov edx, dword [0x441bd0]
push edx
call fcn.00411c60
push 0x441bd0
call fcn.00411cc0
jmp 0x402fe5
call fcn.00409735
mov ebx, eax
cmp ebx, 0x64
jne 0x402ea4
push edx
call fcn.00411c20
pop edx
push eax
mov edx, str.W81_
push edx
call fcn.00411c60
mov edx, dword [0x441bd0]
push edx
call fcn.00411c60
push 0x441bd0
call fcn.00411cc0
jmp 0x402fe5
call fcn.00409735
mov ebx, eax
cmp ebx, 0x5f
jne 0x402ede
push edx
call fcn.00411c20
pop edx
push eax
mov edx, str.2012_
push edx
call fcn.00411c60
mov edx, dword [0x441bd0]
push edx
call fcn.00411c60
push 0x441bd0
call fcn.00411cc0
jmp 0x402fe5
call fcn.00409735
mov ebx, eax
cmp ebx, 0x69
jne 0x402f18
push edx
call fcn.00411c20
pop edx
push eax
mov edx, str.2012R2_
push edx
call fcn.00411c60
mov edx, dword [0x441bd0]
push edx
call fcn.00411c60
push 0x441bd0
call fcn.00411cc0
jmp 0x402fe5
call fcn.00409735
mov ebx, eax
cmp ebx, 0x6e
jne 0x402f35
mov ebx, dword [0x441c40]
and ebx, ebx
jne 0x402f35
mov eax, 1
jmp 0x402f37
xor eax, eax
and eax, eax
je 0x402fe5
push dword [0x441c1c]
mov edx, 0x43f01e
pop ecx
call fcn.00407180
je 0x402fb2
mov ebx, dword [0x441c2c]
and ebx, ebx
jne 0x402f87
push edx
call fcn.00411c20
pop edx
push eax
mov edx, str.WIN10_32_HDD_
push edx
call fcn.00411c60
mov edx, dword [0x441bd0]
push edx
call fcn.00411c60
push 0x441bd0
call fcn.00411cc0
jmp 0x402fb0
push edx
call fcn.00411c20
pop edx
push eax
mov edx, str.WIN10_32_
push edx
call fcn.00411c60
mov edx, dword [0x441bd0]
push edx
call fcn.00411c60
push 0x441bd0
call fcn.00411cc0
jmp 0x402fe5
mov ebx, dword [0x441c2c]
and ebx, ebx
jne 0x402fe5
push edx
call fcn.00411c20
pop edx
push eax
mov edx, str.WIN10_HDD_
push edx
call fcn.00411c60
mov edx, dword [0x441bd0]
push edx
call fcn.00411c60
push 0x441bd0
call fcn.00411cc0
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push 0x18
push dword [0x441bd0]
call fcn.00407b60
push 0x441bd0
call fcn.00411cc0
push edx
call fcn.00411c20
pop edx
push eax
push 0x43f01e
push edx
call fcn.00411c20
pop edx
push eax
mov edx, str.__silent_user_
push edx
call fcn.00411c60
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
mov eax, str.YXJ0aWMuc2lzdGVtaUBnbWFpbC5jb20
push eax
call fcn.00406d89
call fcn.00407152
add dword [esp], edx
call fcn.004078c0
pop eax
mov edx, str.__password_
push edx
call fcn.00411c60
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
mov eax, str.TGltYSEyMDE5JCQ
push eax
call fcn.00406d89
call fcn.00407152
add dword [esp], edx
call fcn.004078c0
pop eax
mov edx, str.__name_
push edx
call fcn.00411c60
mov edx, dword [0x441bd0]
push edx
call fcn.00411c60
mov edx, str.__logpath_
push edx
call fcn.00411c60
mov edx, dword [0x441c70]
push edx
call fcn.00411c60
mov edx, 0x43f11d
push edx
call fcn.00411c60
call fcn.00411d50
mov edx, dword [0x441c90]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
mov edx, dword [0x441c18]
push edx
call fcn.00411c60
call fcn.00407152
add dword [esp], edx
call fcn.00407152
add dword [esp + 4], edx
call fcn.00405204
call fcn.004071b0
and eax, eax
je 0x403119
call fcn.00409735
mov ebx, eax
cmp ebx, 0x6e
je 0x403133
call fcn.00409735
mov ebx, eax
cmp ebx, 0x64
je 0x403133
jmp 0x40313a
mov eax, 1
jmp 0x40313c
xor eax, eax
and eax, eax
je 0x4032d9
mov ebx, dword [0x441c88]
and ebx, ebx
jne 0x4032d9
push edx
call fcn.00411c20
pop edx
push eax
mov edx, dword [0x441c90]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
mov edx, dword [0x441b90]
push edx
call fcn.00411c60
call fcn.00407152
add dword [esp], edx
call fcn.0040f69c
call fcn.004071b0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jl 0x4031a3
jg 0x40319f
cmp ebx, 0x1869f
jb 0x4031a3
xor eax, eax
jmp 0x4031a8
mov eax, 1
or eax, eax
je 0x4032d9
mov eax, str.C:Program_FilesOpen_ShellStartMenu.exe
push eax
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xffffffff
jne 0x4031c9
cmp edi, 0xffffffff
je 0x4031cd
xor eax, eax
jmp 0x4031d2
mov eax, 1
or eax, eax
je 0x403203
mov eax, str.C:Program_FilesClassic_ShellClassicStartMenu.exe
push eax
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xffffffff
jne 0x4031ef
cmp edi, 0xffffffff
je 0x4031f3
xor eax, eax
jmp 0x4031f8
mov eax, 1
or eax, eax
je 0x403203
mov eax, 1
jmp 0x403205
xor eax, eax
and eax, eax
je 0x4032d9
push edx
call fcn.00411c20
pop edx
push eax
mov edx, dword [0x441c90]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
mov edx, dword [0x441b90]
push edx
call fcn.00411c60
call fcn.00411d50
push dword [0x441ca4]
call fcn.00407152
add dword [esp + 4], edx
call fcn.00405f5b
call fcn.004071b0
push edx
push eax
pop ebx
pop edi
cmp ebx, 0
jne 0x403265
cmp edi, 0
jne 0x403265
xor eax, eax
jmp 0x40326a
mov eax, 1
or eax, eax
je 0x4032d9
cmp dword [0x441c7c], 0
je 0x403288
mov ebx, dword [0x441c40]
and ebx, ebx
jne 0x403288
mov eax, 1
jmp 0x40328a
xor eax, eax
and eax, eax
je 0x4032d9
push edx
call fcn.00411c20
pop edx
push eax
push 1
push dword [0x441c90]
mov eax, str.__PASSIVE
push eax
mov edx, dword [0x441c90]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
mov edx, dword [0x441b90]
push edx
call fcn.00411c60
call fcn.00407152
add dword [esp], edx
call fcn.00408490
call fcn.004071b0
mov dword [0x441bdc], 0
call fcn.00409735
mov ebx, eax
cmp ebx, 0x6e
jg 0x40342c
mov edx, str.C:Program_Files__x86_AnyDesk_
lea ecx, [0x441ba4]
call fcn.00407008
push dword [0x441ba4]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x403320
cmp edi, 0xffffffff
jne 0x403320
xor eax, eax
jmp 0x403325
mov eax, 1
or eax, eax
je 0x403339
mov edx, str.C:Program_FilesAnyDesk_
lea ecx, [0x441ba4]
call fcn.00407008
push edx
call fcn.00411c20
pop edx
push eax
mov edx, dword [0x441c90]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
mov edx, dword [0x441c44]
push edx
call fcn.00411c60
call fcn.00407152
add dword [esp], edx
call fcn.0040f69c
call fcn.004071b0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jl 0x40338a
jg 0x403386
cmp ebx, 0x1869f
jb 0x40338a
xor eax, eax
jmp 0x40338f
mov eax, 1
or eax, eax
je 0x40342c
push dword [0x441ba4]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x4033b0
cmp edi, 0xffffffff
je 0x4033b4
xor eax, eax
jmp 0x4033b9
mov eax, 1
or eax, eax
je 0x40342c
push 4
mov eax, str.Da___Ne__
push eax
mov eax, str.Uninstall_Anydesk_
push eax
call fcn.004080d4
mov ebx, eax
cmp ebx, 6
jne 0x403422
push edx
call fcn.00411c20
pop edx
push eax
push dword [0x441ba4]
mov eax, str.___uninstall
push eax
mov edx, dword [0x441ba4]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
mov edx, dword [0x441c44]
push edx
call fcn.00411c60
call fcn.00407152
add dword [esp], edx
call fcn.00405204
call fcn.004071b0
jmp 0x40342c
mov dword [0x441bdc], 1
mov dword [0x441c64], 0
cmp dword [0x441c7c], 0
je 0x403450
mov ebx, dword [0x441c40]
and ebx, ebx
jne 0x403450
mov eax, 1
jmp 0x403452
xor eax, eax
and eax, eax
je 0x403462
mov dword [0x441c64], 1
jmp 0x40346b
cmp dword [0x441c40], 0
je 0x40346b
mov edx, dword [0x441c90]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
mov edx, str.systeminfo.txt
push edx
call fcn.00411c60
push 0x441bf4
call fcn.00411cc0
push dword [0x441bf4]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jl 0x4034b3
jg 0x4034af
cmp ebx, 0x63
jb 0x4034b3
xor eax, eax
jmp 0x4034b8
mov eax, 1
or eax, eax
je 0x4034cc
cmp dword [0x441b98], 0
je 0x4034cc
mov eax, 1
jmp 0x4034ce
xor eax, eax
and eax, eax
je 0x4035b3
push dword [0x441c1c]
mov edx, 0x43f01e
pop ecx
call fcn.00407180
je 0x403552
push edx
call fcn.00411c20
pop edx
push eax
push 3
mov eax, 0x43f01e
push eax
push edx
call fcn.00411c20
pop edx
push eax
mov edx, str.__c_systeminfo____
push edx
call fcn.00411c60
mov edx, dword [0x441c90]
push edx
call fcn.00411c60
mov edx, dword [0x441bf4]
push edx
call fcn.00411c60
mov edx, 0x43f11d
push edx
call fcn.00411c60
call fcn.00411d50
mov eax, 0x43f9e9
push eax
call fcn.00407152
add dword [esp + 4], edx
call fcn.00408490
call fcn.004071b0
jmp 0x4035b3
push edx
call fcn.00411c20
pop edx
push eax
push 0x43f01e
push edx
call fcn.00411c20
pop edx
push eax
mov edx, str.__c_systeminfo____
push edx
call fcn.00411c60
mov edx, dword [0x441c90]
push edx
call fcn.00411c60
mov edx, dword [0x441bf4]
push edx
call fcn.00411c60
mov edx, 0x43f11d
push edx
call fcn.00411c60
call fcn.00411d50
mov eax, 0x43f9e9
push eax
call fcn.00407152
add dword [esp + 4], edx
call fcn.00405204
call fcn.004071b0
call fcn.00409735
mov ebx, eax
cmp ebx, 0x6e
jne 0x4035d9
mov ebx, dword [0x441c40]
and ebx, ebx
jne 0x4035d9
cmp dword [0x441b98], 0
je 0x4035d9
mov eax, 1
jmp 0x4035db
xor eax, eax
and eax, eax
je 0x403627
call fcn.00405e23
and eax, eax
jne 0x4035f4
mov ebx, dword [0x441c2c]
and ebx, ebx
je 0x4035f4
jmp 0x4035fb
mov eax, 1
jmp 0x4035fd
xor eax, eax
and eax, eax
je 0x403627
mov eax, str.iwr__useb_https:__christitus.com_win__iex
push eax
call fcn.00410f9a
and eax, eax
je 0x403627
mov eax, 0x43f01e
push eax
mov eax, str._iwr__useb_https:__christitus.com_win__iex
push eax
mov eax, str.powershell
push eax
call fcn.00405204
mov ebx, dword [0x441c40]
and ebx, ebx
jne 0x403644
call fcn.00409735
mov ebx, eax
cmp ebx, 0x6e
jl 0x403644
mov eax, 1
jmp 0x403646
xor eax, eax
and eax, eax
je 0x4037c1
push edx
call fcn.00411c20
pop edx
push eax
mov edx, dword [0x441c90]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
mov edx, dword [0x441c00]
push edx
call fcn.00411c60
call fcn.00407152
add dword [esp], edx
call fcn.0040f69c
call fcn.004071b0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jl 0x40369f
jg 0x40369b
cmp ebx, 0x1869f
jb 0x40369f
xor eax, eax
jmp 0x4036a4
mov eax, 1
or eax, eax
je 0x4036ee
push edx
call fcn.00411c20
pop edx
push eax
mov edx, dword [0x441c90]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
mov edx, dword [0x441c00]
push edx
call fcn.00411c60
call fcn.00411d50
push dword [0x441c8c]
call fcn.00407152
add dword [esp + 4], edx
call fcn.00408c90
call fcn.004071b0
push edx
call fcn.00411c20
pop edx
push eax
mov edx, dword [0x441c90]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
mov edx, dword [0x441c00]
push edx
call fcn.00411c60
call fcn.00407152
add dword [esp], edx
call fcn.0040f69c
call fcn.004071b0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x40373f
jl 0x40373b
cmp ebx, 0x1869f
ja 0x40373f
xor eax, eax
jmp 0x403744
mov eax, 1
or eax, eax
je 0x403758
cmp dword [0x441c64], 0
je 0x403758
mov eax, 1
jmp 0x40375a
xor eax, eax
and eax, eax
je 0x4037c1
push 4
mov eax, str.Da___Ne__
push eax
mov eax, str.Install_Anti_Virus__
push eax
call fcn.004080d4
mov ebx, eax
cmp ebx, 6
jne 0x4037c1
push edx
call fcn.00411c20
pop edx
push eax
push dword [0x441c90]
mov eax, str.__VERYSILENT
push eax
mov edx, dword [0x441c90]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
mov edx, dword [0x441c00]
push edx
call fcn.00411c60
call fcn.00407152
add dword [esp], edx
call fcn.00408478
call fcn.004071b0
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
call fcn.0040f876
mov edx, str.Radna_Povr_ina_
push edx
call fcn.00411c60
push 0x441c4c
call fcn.00411cc0
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c20
pop edx
push eax
call fcn.0040f876
mov edx, str.Desktop_
push edx
call fcn.00411c60
push 0x441c10
call fcn.00411cc0
push dword [0x441c10]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x403832
cmp edi, 0xffffffff
jne 0x403832
xor eax, eax
jmp 0x403837
mov eax, 1
or eax, eax
je 0x403859
mov edx, dword [0x441c4c]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
push 0x441c10
call fcn.00411cc0
push dword [0x441c10]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x403876
cmp edi, 0xffffffff
jne 0x403876
xor eax, eax
jmp 0x40387b
mov eax, 1
or eax, eax
je 0x40388f
mov edx, str.C:UsersPublicDesktop_
lea ecx, [0x441c10]
call fcn.00407008
push dword [0x441c10]
call fcn.0040f69c
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x4038ac
cmp edi, 0xffffffff
jne 0x4038ac
xor eax, eax
jmp 0x4038b1
mov eax, 1
or eax, eax
je 0x4038c5
mov edx, str.C:Documents_and_SettingsAll_UsersDesktop_
lea ecx, [0x441c10]
call fcn.00407008
mov edx, str.c:userspublicdesktop_
lea ecx, [0x441bc8]
call fcn.00407008
mov edx, str.C:Documents_and_SettingsAll_UsersDesktop_
lea ecx, [0x441b8c]
call fcn.00407008
mov edx, str.xplorer2_lite.lnk
lea ecx, [0x441bec]
call fcn.00407008
push edx
call fcn.00411c20
pop edx
push eax
mov edx, dword [0x441c10]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
mov edx, dword [0x441bec]
push edx
call fcn.00411c60
call fcn.00407152
add dword [esp], edx
call fcn.0040f69c
call fcn.004071b0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x403943
jl 0x40393f
cmp ebx, 0
ja 0x403943
xor eax, eax
jmp 0x403948
mov eax, 1
or eax, eax
je 0x403986
push edx
call fcn.00411c20
pop edx
push eax
mov edx, dword [0x441c10]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
mov edx, dword [0x441bec]
push edx
call fcn.00411c60
call fcn.00407152
add dword [esp], edx
call fcn.0040f868
call fcn.004071b0
push edx
call fcn.00411c20
pop edx
push eax
mov edx, dword [0x441bc8]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
mov edx, dword [0x441bec]
push edx
call fcn.00411c60
call fcn.00407152
add dword [esp], edx
call fcn.0040f69c
call fcn.004071b0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x4039d4
jl 0x4039d0
cmp ebx, 0
ja 0x4039d4
xor eax, eax
jmp 0x4039d9
mov eax, 1
or eax, eax
je 0x403a17
push edx
call fcn.00411c20
pop edx
push eax
mov edx, dword [0x441bc8]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
mov edx, dword [0x441bec]
push edx
call fcn.00411c60
call fcn.00407152
add dword [esp], edx
call fcn.0040f868
call fcn.004071b0
push edx
call fcn.00411c20
pop edx
push eax
mov edx, dword [0x441b8c]
push edx
call fcn.00411c20
pop edx
push eax
push edx
call fcn.00411c60
mov edx, dword [0x441bec]
push edx
call fcn.00411c60
call fcn.00407152
add dword [esp], edx
call fcn.0040f69c
call fcn.004071b0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x403a65
jl 0x403a61
mov eax, 1
or eax, eax
je 0x403aa8
call 0x4051c7
call fcn.00411c00
push dword [0x441b78]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.0040905f
call fcn.004091a9
call fcn.00409b86
call fcn.0040ae2f
call fcn.0040c191
call fcn.0040c462
call fcn.0040f370
call fcn.0040f684
call fcn.0040fa1c
call fcn.0040faf0
call fcn.004112e8
call fcn.0040e950
ret