Function at 0x406707
Capabilities:
Check for time delay via gettickcount
Connect pipe
Create pipe
Create process on windows
Parse credit card information
Persist via run registry key
Query environment variable
Read file on windows
Resume thread
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
lea ebp, [esp - 0x60]
sub esp, 0x320
push ebx
push esi
mov dword [ebp + 0x54], ecx
push edi
lea ecx, [ebp - 0x98]
call fcn.0042c3f7
xor ebx, ebx
cmp dword [ebp + 0x68], ebx
je 0x40674b
push dword [ebp + 0x68]
lea ecx, [ebp - 0x98]
call fcn.004362a2
mov eax, dword [ebp - 0x98]
mov dword [ebp + 0x68], eax
lea eax, [ebp + 0x68]
push eax
call fcn.00426ff7
pop ecx
lea ecx, [ebp - 0xa0]
call fcn.0042c3f7
mov esi, dword [ebp + 0x70]
cmp esi, ebx
je 0x40676f
push esi
lea ecx, [ebp - 0xa0]
call fcn.004362a2
mov esi, dword [ebp - 0xa0]
cmp dword [ebp + 0x78], ebx
jne 0x40677a
lea eax, [ebp + 0xc]
mov dword [ebp + 0x78], eax
mov eax, dword [ebp + 0x68]
cmp eax, ebx
mov dword [ebp + 8], eax
jne 0x406787
mov dword [ebp + 0x68], esi
mov eax, dword [ebp + 0x74]
lea ecx, [ebp - 0x88]
mov dword [ebp + 4], eax
mov byte [ebp + 0x3a], bl
mov byte [ebp + 0x73], bl
mov byte [ebp + 0x51], bl
mov byte [ebp - 5], 1
mov byte [ebp - 0x16], bl
mov byte [ebp + 0x53], bl
mov byte [ebp - 0x18], bl
mov byte [ebp - 0xe], bl
mov byte [ebp + 0x52], bl
mov byte [ebp + 0x3b], bl
mov byte [ebp - 0xd], bl
mov byte [ebp - 0x19], bl
call fcn.0042c3f7
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
mov byte [ebp - 0x15], bl
mov byte [ebp + 0x2f], bl
mov byte [ebp + 0x1f], bl
mov byte [ebp - 0x17], bl
mov dword [ebp - 0x14], ebx
mov dword [ebp + 0x18], ebx
call fcn.0042c3f7
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x38], ebx
mov byte [ebp + 0x77], bl
call fcn.0042c3f7
lea ecx, [ebp - 0x64]
call fcn.0042c3f7
lea ecx, [ebp - 0x5c]
call fcn.0042c3f7
or dword [ebp - 0x6c], 0xffffffff
lea ecx, [ebp - 0xb8]
mov byte [ebp + 0x1e], bl
mov dword [ebp - 0xa4], ebx
call fcn.0042c3f7
xor eax, eax
push 0xf
pop ecx
mov dword [ebp - 0x1ec], 0x44
mov dword [ebp - 0x1e8], ebx
lea edi, [ebp - 0x1e4]
rep stosd dword es:[edi], eax
push 0x11
mov dword [ebp - 0xec], ebx
pop ecx
lea edi, [ebp - 0x1a8]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0xe8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
cmp esi, ebx
lea edi, [ebp - 0xdc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x4c], ebx
mov dword [ebp + 0x48], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x7c], ebx
je 0x406875
test byte [0x49a003], 3
je 0x40688b
push 0x4814e0
lea ecx, [ebp - 0x7c]
call fcn.004362a2
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x1e4], eax
cmp esi, ebx
je 0x4068a0
cmp word [esi], 0x24
jne 0x4068a0
mov dword [ebp + 4], 1
mov byte [ebp + 0x53], 1
xor ecx, ecx
inc ecx
cmp esi, ebx
push 2
mov dword [ebp - 0x50], ebx
pop edi
je 0x406921
cmp word [esi], 0x7c
jne 0x4068bb
add dword [ebp + 0x68], edi
add esi, edi
mov dword [ebp - 0x50], ecx
cmp esi, ebx
je 0x406921
cmp word [esi], 0x2a
jne 0x406921
add dword [ebp + 0x68], edi
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x7c
mov byte [ebp + 0x73], 0x10
jne 0x4068db
add dword [ebp + 0x68], edi
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
cmp ax, 0x31
jne 0x4068ed
mov byte [ebp + 0x73], 0x11
jmp 0x406908
mov edx, eax
or edx, 0x20
cmp dx, 0x6e
jne 0x4068fe
mov byte [ebp + 0x73], 0x12
jmp 0x406908
cmp ax, 0x2d
jne 0x40690b
mov byte [ebp + 0x73], 0x14
add dword [ebp + 0x68], edi
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
call fcn.00426fde
test al, al
jne 0x406921
mov ebx, ecx
jmp 0x408ff6
lea eax, [ebp + 0x68]
push eax
call fcn.00426ff7
cmp byte [ebp + 0x73], bl
pop ecx
jne 0x4069c4
lea eax, [ebp + 0x68]
push eax
call fcn.00426ff7
cmp dword [ebp - 0x4c], ebx
mov eax, dword [ebp + 0x68]
pop ecx
mov dword [ebp + 0x58], eax
je 0x406952
cmp byte [ebp + 0x73], bl
jne 0x406a94
cmp word [eax], 0x2d
mov esi, eax
jne 0x406966
add eax, 2
cmp word [eax], 0x2d
jne 0x406966
mov dword [ebp + 0x58], eax
push 1
lea eax, [ebp + 0x58]
push eax
push 0x4814dc
call fcn.0042df66
add esp, 0xc
test al, al
jne 0x406a94
mov eax, dword [ebp + 0x58]
mov ax, word [eax]
cmp ax, 0x2d
je 0x406997
cmp ax, 0x2f
jne 0x406a94
add dword [ebp + 0x58], edi
push 5
lea eax, [ebp + 0x58]
push eax
push str.catch
call fcn.0042dfa9
add esp, 0xc
test al, al
je 0x406a42
mov al, byte [ebp + 0x73]
or byte [ebp + 0x73], 0x10
cmp al, bl
jne 0x406c07
mov edi, dword [ebp + 0x68]
xor ecx, ecx
xor eax, eax
mov ax, word [edi]
inc ecx
cmp ax, bx
mov dword [ebp + 4], ecx
mov esi, edi
je 0x40691a
push 2
pop edx
cmp ax, 0x3d
je 0x4069f0
add esi, edx
mov ax, word [esi]
cmp ax, bx
jne 0x4069e0
cmp esi, edi
je 0x40691a
cmp word [esi], 0x3d
jne 0x40691a
sub esi, edx
cmp word [esi], 0x2b
jne 0x406a11
mov al, byte [esi]
mov byte [ebp - 0x15], al
sub esi, edx
cmp esi, edi
mov ecx, esi
jbe 0x406a29
mov ax, word [ecx]
call fcn.00426fde
test al, al
je 0x406a29
sub ecx, edx
cmp ecx, edi
ja 0x406a17
mov ax, word [ecx]
call fcn.00426fde
test al, al
jne 0x406c9f
mov edx, ecx
inc ecx
inc ecx
jmp 0x406c2e
push 4
push dword [ebp + 0x58]
push str.cmd:
call fcn.00427f14
add esp, 0xc
test al, al
je 0x406b85
add dword [ebp + 0x58], 8
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp + 0x58]
push eax
push dword [ebp + 0x54]
call fcn.004037a0
add esp, 0x10
mov dword [ebp - 0x4c], eax
jmp 0x406a86
mov word [esi], 0x20
add esi, edi
cmp esi, dword [ebp + 0x58]
jb 0x406a7f
cmp byte [ebp + 0x73], bl
je 0x406c07
lea eax, [ebp + 0x68]
push eax
call fcn.00426ff7
mov eax, dword [ebp - 0x4c]
cmp eax, ebx
pop ecx
je 0x406aad
cmp word [eax], bx
jne 0x406aad
mov dword [ebp - 0x4c], ebx
cmp dword [ebp - 0x50], ebx
jne 0x406aba
cmp dword [ebp + 0x7c], ebx
mov byte [ebp + 0x37], bl
je 0x406abe
mov byte [ebp + 0x37], 1
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp + 0x10], ebx
call fcn.0042c3f7
lea ecx, [ebp - 0x80]
call fcn.0042c3f7
lea ecx, [ebp - 0xa8]
call fcn.0042c3f7
cmp byte [ebp + 0x37], bl
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x74], ebx
jne 0x406b16
cmp dword [ebp + 8], ebx
jne 0x406b16
mov ecx, dword [ebp + 0x54]
push 1
push ebx
lea eax, [ebp - 0x74]
push eax
push dword [ebp + 0x68]
call fcn.0043d4de
mov eax, dword [ebp - 0x74]
mov dword [ebp + 0x68], eax
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x2d
mov edi, eax
jne 0x406b2d
add eax, 2
cmp word [eax], 0x2d
jne 0x406b2d
mov dword [ebp + 0x68], eax
push 1
lea eax, [ebp + 0x68]
push eax
push 0x4814dc
call fcn.0042df66
add esp, 0xc
test al, al
jne 0x4074af
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
cmp ax, 0x2d
je 0x406b5e
cmp ax, 0x2f
jne 0x4074af
push 2
pop esi
add dword [ebp + 0x68], esi
push 5
lea eax, [ebp + 0x68]
push eax
push str.catch
call fcn.0042df66
add esp, 0xc
test al, al
je 0x406ca7
mov byte [ebp + 0x73], 0x10
jmp 0x406b16
push 3
push dword [ebp + 0x58]
push 0x4814c8
call fcn.00427f14
add esp, 0xc
test al, al
je 0x406baf
add dword [ebp + 0x58], 6
jmp 0x406ba4
add dword [ebp + 0x58], edi
mov eax, dword [ebp + 0x58]
cmp word [eax], 0x2a
je 0x406ba1
jmp 0x406be5
push 4
push dword [ebp + 0x58]
push str.exe:
call fcn.00427f14
add esp, 0xc
test al, al
je 0x406bcb
add dword [ebp + 0x58], 8
jmp 0x406be5
push 5
push dword [ebp + 0x58]
push str.logs:
call fcn.00427f14
add esp, 0xc
test al, al
je 0x406c07
add dword [ebp + 0x58], 0xa
mov eax, dword [ebp + 0x58]
cmp word [eax], 0x22
jne 0x406c07
add dword [ebp + 0x58], edi
jmp 0x406bfc
add dword [ebp + 0x58], edi
cmp ax, 0x22
je 0x406c07
mov eax, dword [ebp + 0x58]
mov ax, word [eax]
cmp ax, bx
jne 0x406bf3
lea eax, [ebp + 0x58]
push eax
call fcn.00403c51
mov eax, dword [ebp + 0x58]
pop ecx
jmp 0x406952
lea eax, [edx - 2]
mov dword [ebp - 0x68], eax
mov ax, word [eax]
call fcn.00426fde
test al, al
jne 0x406c32
mov edx, dword [ebp - 0x68]
cmp edx, edi
ja 0x406c19
sub ecx, edx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.0042c51d
mov edi, dword [ebp + 0x54]
push ebx
lea eax, [ebp - 0x2c]
push eax
mov ecx, edi
call fcn.00402a5b
cmp byte [edi + 0x8a], bl
jne 0x406c5d
test byte [edi + 0xb], 0xf
je 0x406c73
push ebx
lea eax, [ebp - 0x2c]
push eax
mov ecx, edi
call fcn.00402a5b
jmp 0x406c73
cmp ax, 0x3d
je 0x406c81
inc esi
inc esi
mov ax, word [esi]
cmp ax, bx
jne 0x406c6b
cmp ax, 0x3d
jne 0x406c9f
lea eax, [ebp - 0xa4]
add esi, 2
push eax
mov dword [ebp - 0xa4], esi
call fcn.00426ff7
pop ecx
push 2
pop edi
jmp 0x406934
xor ebx, ebx
inc ebx
jmp 0x408ff6
push 6
push dword [ebp + 0x68]
push str.clone:
call fcn.00427f14
add esp, 0xc
test al, al
je 0x406ce7
add dword [ebp + 0x68], 0xc
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403c2d
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
pop ecx
je 0x406cdd
mov word [eax], bx
add dword [ebp + 0x68], 2
cmp word [esi], bx
je 0x406d22
mov dword [ebp + 0x48], esi
jmp 0x406d22
push 9
push dword [ebp + 0x68]
push str.runrmenu:
call fcn.00427f14
add esp, 0xc
test al, al
je 0x406d30
add dword [ebp + 0x68], 0x12
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403c2d
mov eax, dword [ebp + 0x68]
pop ecx
lea ecx, [ebp - 0x88]
sub eax, esi
sar eax, 1
push eax
push esi
call fcn.0042c51d
lea eax, [ebp + 0x68]
push eax
call fcn.00426ff7
jmp 0x4074a9
push 8
push dword [ebp + 0x68]
push str.poprmenu
call fcn.00427f14
add esp, 0xc
test al, al
je 0x406de0
add dword [ebp + 0x68], 0x10
mov eax, dword [ebp + 0x68]
mov dword [ebp + 0x28], eax
lea eax, [ebp + 0x68]
push eax
call fcn.00403c2d
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
pop ecx
je 0x406d69
add dword [ebp + 0x68], esi
lea eax, [ebp + 0x68]
push eax
call fcn.00426ff7
pop ecx
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp + 0x28]
mov ax, word [eax]
cmp ax, bx
mov byte [ebp - 0xd], 1
je 0x406d9e
cmp ax, 0x30
jb 0x406d9b
cmp ax, 0x39
jbe 0x406d9e
add dword [ebp + 0x28], esi
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp + 0x28]
push eax
call fcn.0042ed5c
mov eax, dword [ebp + 0x28]
mov ax, word [eax]
cmp ax, bx
pop ecx
pop ecx
je 0x406dca
cmp ax, 0x30
jb 0x406dc7
cmp ax, 0x39
jbe 0x406dca
add dword [ebp + 0x28], esi
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp + 0x28]
push eax
call fcn.0042ed5c
pop ecx
jmp 0x4074a9
push 4
push dword [ebp + 0x68]
push str.pid:
call fcn.00427f14
add esp, 0xc
test al, al
je 0x406e1d
add dword [ebp + 0x68], 8
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403c2d
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x406d22
lea ecx, [ebp - 0x90]
jmp 0x406d17
push 4
push dword [ebp + 0x68]
push str.exe:
call fcn.00427f14
add esp, 0xc
test al, al
je 0x406e77
add dword [ebp + 0x68], 8
mov eax, dword [ebp + 0x68]
mov dword [ebp + 0x20], eax
push 1
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp + 0x20]
push eax
mov dword [ebp - 0x60], ebx
call fcn.00413513
add esp, 0xc
cmp dword [ebp - 0x60], ebx
mov dword [ebp + 0x68], eax
jle 0x406d22
push dword [ebp - 0x60]
lea ecx, [ebp - 0x78]
push dword [ebp + 0x20]
call fcn.0042c51d
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x24], eax
jmp 0x406d22
push 3
pop esi
push esi
push dword [ebp + 0x68]
push 0x4814c8
call fcn.00427f14
add esp, 0xc
test al, al
je 0x406f53
mov eax, dword [ebp + 0x68]
xor esi, esi
add eax, 6
jmp 0x406ea0
inc esi
inc eax
inc eax
mov dword [ebp + 0x68], eax
cmp word [eax], 0x2a
je 0x406e9d
cmp esi, 2
mov dword [ebp + 0x24], eax
mov dword [ebp + 0x4c], ebx
jge 0x406f1b
push 1
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x24]
push eax
call fcn.00413513
add esp, 0xc
cmp dword [ebp + 0x4c], ebx
mov dword [ebp + 0x68], eax
jle 0x406ee2
push dword [ebp + 0x4c]
lea ecx, [ebp - 0x34]
push dword [ebp + 0x24]
call fcn.0042c51d
mov eax, dword [ebp - 0x34]
mov dword [ebp + 0x10], eax
cmp esi, 1
jne 0x406d22
cmp dword [ebp + 0x4c], ebx
jle 0x406d22
mov eax, dword [ebp - 0x34]
push esi
lea ecx, [ebp - 0x34]
push ecx
push eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x34], ebx
call fcn.00434c96
add esp, 0xc
lea ecx, [ebp - 0x68]
mov dword [ebp + 0x24], eax
call fcn.0042704a
jmp 0x406d22
push 0x105
lea ecx, [ebp - 0x34]
call fcn.0042c43e
push 0x104
push dword [ebp - 0x34]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push ebx
push dword [ebp - 0x34]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
je 0x406d22
mov word [eax], bx
jmp 0x406d22
push 5
push dword [ebp + 0x68]
push str.logs:
call fcn.00427f14
add esp, 0xc
test al, al
je 0x406fcc
mov eax, dword [ebp + 0x68]
add eax, 0xa
xor ecx, ecx
mov dword [ebp + 0x68], eax
mov dword [ebp - 0x3c], eax
cmp word [eax], 0x3f
sete cl
mov esi, ecx
cmp esi, ebx
je 0x406f8a
add eax, 2
mov dword [ebp - 0x3c], eax
mov edi, eax
push 1
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp + 0x30], ebx
call fcn.00413513
add esp, 0xc
cmp dword [ebp + 0x30], ebx
mov dword [ebp + 0x68], eax
jle 0x406d22
cmp esi, ebx
je 0x406fbd
cmp dword [0x496de4], ebx
je 0x406d22
push dword [ebp + 0x30]
lea ecx, [ebp - 0x8c]
push edi
jmp 0x406d1d
push 5
lea eax, [ebp + 0x68]
push eax
push str.nowin
call fcn.0042df66
add esp, 0xc
test al, al
je 0x406fec
mov byte [ebp - 0x19], 1
jmp 0x406b16
push 4
lea eax, [ebp + 0x68]
push eax
push str.hide
call fcn.0042df66
add esp, 0xc
test al, al
je 0x40700f
mov dword [ebp - 0x14], 0x10000000
jmp 0x406b16
push 4
lea eax, [ebp + 0x68]
push eax
push 0x481478
call fcn.0042df66
add esp, 0xc
test al, al
je 0x407032
mov dword [ebp + 4], 1
jmp 0x406b16
push esi
lea eax, [ebp + 0x68]
push eax
push 0x481474
call fcn.0042df66
add esp, 0xc
test al, al
je 0x407051
or byte [ebp + 0x51], 1
jmp 0x406b16
push 4
lea eax, [ebp + 0x68]
push eax
push str.err
call fcn.0042df66
add esp, 0xc
test al, al
je 0x407071
or byte [ebp + 0x51], 3
jmp 0x406b16
push 5
lea eax, [ebp + 0x68]
push eax
push str.limit
call fcn.0042df66
add esp, 0xc
test al, al
je 0x407091
mov byte [ebp - 0xe], 1
jmp 0x406b16
push esi
lea eax, [ebp + 0x68]
push eax
push 0x481460
call fcn.0042df66
add esp, 0xc
test al, al
je 0x4070b0
mov byte [ebp + 0x52], 1
jmp 0x406b16
push 4
lea eax, [ebp + 0x68]
push eax
push str.hook
call fcn.0042df66
add esp, 0xc
test al, al
je 0x4070d0
mov byte [ebp + 0x53], 1
jmp 0x406b16
push esi
lea eax, [ebp + 0x68]
push eax
push 0x481454
call fcn.0042df66
add esp, 0xc
test al, al
je 0x4070f2
mov dword [ebp - 0x14], 6
jmp 0x406b16
push esi
lea eax, [ebp + 0x68]
push eax
push 0x481450
call fcn.0042df66
add esp, 0xc
test al, al
je 0x407110
mov dword [ebp - 0x14], esi
jmp 0x406b16
push 4
lea eax, [ebp + 0x68]
push eax
push str.show
call fcn.0042df66
add esp, 0xc
test al, al
je 0x407133
mov dword [ebp - 0x14], 1
jmp 0x406b16
push 4
lea eax, [ebp + 0x68]
push eax
push str.runs
call fcn.0042df66
add esp, 0xc
test al, al
je 0x407153
mov byte [ebp - 0x18], 1
jmp 0x406b16
push 4
lea eax, [ebp + 0x68]
push eax
push str.no64
call fcn.0042df66
add esp, 0xc
test al, al
je 0x407172
mov byte [ebp - 5], bl
jmp 0x406b16
push esi
lea eax, [ebp + 0x68]
push eax
push 0x481434
call fcn.0042df66
add esp, 0xc
test al, al
je 0x407191
mov byte [ebp - 0x16], 1
jmp 0x406b16
push esi
push dword [ebp + 0x68]
push 0x481430
call fcn.00427f14
add esp, 0xc
test al, al
je 0x4071df
add dword [ebp + 0x68], 6
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x3a
mov byte [ebp + 0x3b], 1
jne 0x406d22
add dword [ebp + 0x68], 2
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403c2d
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x406d22
lea ecx, [ebp - 0x80]
jmp 0x406d17
push 5
push dword [ebp + 0x68]
push str.code:
call fcn.00427f14
add esp, 0xc
test al, al
je 0x407294
add dword [ebp + 0x68], 0xa
mov eax, dword [ebp + 0x68]
mov dword [ebp + 0x44], eax
push 0xffffffffffffffff
lea eax, [ebp + 0x44]
push eax
push str.UTF8
call fcn.0042df66
add esp, 0xc
test al, al
je 0x40722a
mov byte [ebp + 0x77], 1
mov dword [ebp - 0x38], 0xfde9
jmp 0x4074a0
push 0xffffffffffffffff
lea eax, [ebp + 0x44]
push eax
push str.ANSI
call fcn.0042df66
add esp, 0xc
test al, al
je 0x40724d
mov byte [ebp + 0x77], 1
mov dword [ebp - 0x38], ebx
jmp 0x4074a0
push 0xffffffffffffffff
lea eax, [ebp + 0x44]
push eax
push 0x481414
call fcn.0042df66
add esp, 0xc
test al, al
je 0x407274
mov byte [ebp + 0x77], 2
mov dword [ebp - 0x38], 0x4b0
jmp 0x4074a0
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp + 0x44]
push eax
call fcn.0042ed5c
test eax, eax
pop ecx
pop ecx
jle 0x4074a0
mov byte [ebp + 0x77], 1
jmp 0x4074a0
push 5
push dword [ebp + 0x68]
push str.user:
call fcn.00427f14
add esp, 0xc
test al, al
je 0x4072ce
add dword [ebp + 0x68], 0xa
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403c2d
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x406d22
lea ecx, [ebp - 0x64]
jmp 0x406d17
push 7
push dword [ebp + 0x68]
push str.passwd:
call fcn.00427f14
add esp, 0xc
test al, al
je 0x4072e9
mov byte [ebp + 0x1e], bl
jmp 0x407303
push 7
push dword [ebp + 0x68]
push str.passwd
call fcn.00427f14
add esp, 0xc
test al, al
je 0x407327
mov byte [ebp + 0x1e], 1
add dword [ebp + 0x68], 0xe
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403c2d
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x406d22
lea ecx, [ebp - 0x5c]
jmp 0x406d17
push 8
lea eax, [ebp + 0x68]
push eax
push str.REALTIME
call fcn.0042df66
add esp, 0xc
test al, al
je 0x40734a
mov dword [ebp + 0x18], 0x100
jmp 0x406b16
push 4
lea eax, [ebp + 0x68]
push eax
push str.HIGH
call fcn.0042df66
add esp, 0xc
test al, al
je 0x40736d
mov dword [ebp + 0x18], 0x80
jmp 0x406b16
push 0xb
lea eax, [ebp + 0x68]
push eax
push str.ABOVENORMAL
call fcn.0042df66
add esp, 0xc
test al, al
je 0x407390
mov dword [ebp + 0x18], 0x8000
jmp 0x406b16
push 6
lea eax, [ebp + 0x68]
push eax
push str.NORMAL
call fcn.0042df66
add esp, 0xc
test al, al
je 0x4073b3
mov dword [ebp + 0x18], 0x20
jmp 0x406b16
push 0xb
lea eax, [ebp + 0x68]
push eax
push str.BELOWNORMAL
call fcn.0042df66
add esp, 0xc
test al, al
je 0x4073d6
mov dword [ebp + 0x18], 0x4000
jmp 0x406b16
push esi
lea eax, [ebp + 0x68]
push eax
push 0x4813c4
call fcn.0042df66
add esp, 0xc
test al, al
jne 0x407425
mov esi, dword [ebp + 0x68]
push 4
push esi
push 0x4813b8
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x407431
xor ecx, ecx
mov cx, word [esi + 8]
mov eax, ecx
call fcn.00426fde
test al, al
jne 0x407417
cmp cx, bx
jne 0x407431
add dword [ebp + 0x68], 8
lea eax, [ebp + 0x68]
push eax
call fcn.00426ff7
pop ecx
mov dword [ebp + 0x18], 0x40
jmp 0x406b16
push 3
lea eax, [ebp + 0x68]
push eax
push 0x4813b4
call fcn.0042df66
add esp, 0xc
test al, al
je 0x407451
mov byte [ebp + 0x2f], 1
jmp 0x406b16
push 3
lea eax, [ebp + 0x68]
push eax
push 0x4813b0
call fcn.0042df66
add esp, 0xc
test al, al
je 0x407477
mov byte [ebp + 0x1f], 1
mov byte [ebp + 0x77], bl
mov dword [ebp - 0x38], ebx
jmp 0x406b16
push 3
lea eax, [ebp + 0x68]
push eax
push 0x4813ac
call fcn.0042df66
add esp, 0xc
test al, al
je 0x407497
mov byte [ebp - 0x17], 1
jmp 0x406b16
cmp word [edi], 0x2d
mov dword [ebp + 0x68], edi
jne 0x4074af
lea eax, [ebp + 0x68]
push eax
call fcn.00403c51
pop ecx
jmp 0x406b16
cmp dword [ebp - 0x38], 0x4b0
jne 0x4074bc
mov byte [ebp + 0x77], 2
mov eax, dword [ebp - 0xa4]
cmp eax, ebx
je 0x4074e9
cmp byte [ebp + 0x37], bl
mov dword [ebp + 0x68], eax
jne 0x4074e9
cmp dword [ebp + 8], ebx
jne 0x4074e9
push 1
push ebx
lea ecx, [ebp - 0x74]
push ecx
mov ecx, dword [ebp + 0x54]
push eax
call fcn.0043d4de
mov eax, dword [ebp - 0x74]
mov dword [ebp + 0x68], eax
mov esi, dword [ebp - 0x24]
cmp esi, ebx
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xc4], ebx
mov dword [ebp + 0x14], ebx
je 0x40750a
cmp word [esi], bx
jne 0x40750d
mov byte [ebp + 0x2f], bl
cmp byte [ebp + 0x2f], bl
je 0x407539
push 0x2a
push esi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
mov dword [ebp + 0x14], eax
je 0x40752a
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x14], eax
lea eax, [ebp - 0xcc]
push eax
push esi
call fcn.0040ef89
pop ecx
pop ecx
mov eax, dword [ebp + 0x78]
xor ecx, ecx
inc ecx
mov dword [eax], ecx
xor eax, eax
lea edi, [ebp - 0xbc]
mov dword [ebp - 0xc0], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x10c], ebx
lea edi, [ebp - 0x108]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
cmp dword [ebp + 0x48], ebx
mov dword [ebp - 0x70], ebx
setne al
cmp byte [ebp + 0x37], bl
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp + 0x28], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp + 0x3c], eax
mov dword [ebp - 0xf8], 0xc
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 0xf0], ecx
mov dword [ebp - 0x9c], ebx
je 0x407992
mov ecx, dword [ebp + 0x68]
cmp word [ecx], 0x7c
mov dword [ebp + 0x24], ebx
jne 0x4075d3
inc ecx
inc ecx
xor eax, eax
mov dword [ebp + 0x68], ecx
mov ax, word [ecx]
cmp ax, 0x7c
je 0x4075ba
call fcn.00426fde
test al, al
jne 0x4075ba
mov dword [ebp + 0x30], ecx
push 0x7c
push ebx
push dword [ebp + 0x68]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
mov dword [ebp + 0x5c], eax
je 0x407610
mov word [eax], bx
add dword [ebp + 0x5c], 2
lea eax, [ebp + 0x5c]
push eax
call fcn.00426ff7
mov eax, dword [ebp + 0x5c]
cmp word [eax], bx
pop ecx
je 0x4075d6
mov ecx, dword [ebp + 0x30]
cmp word [ecx], bx
mov dl, 1
je 0x407612
mov cl, dl
jmp 0x40761e
xor dl, dl
xor cl, cl
cmp dl, bl
jne 0x40761e
mov eax, dword [ebp + 0x30]
mov dword [ebp + 0x5c], eax
cmp cl, bl
mov dword [ebp + 8], eax
je 0x4076d0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
push ebx
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x28]
push eax
xor edi, edi
lea eax, [ebp - 0x20]
inc edi
push eax
mov dword [ebp - 0x48], 0xc
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], edi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x407661
mov ecx, dword [ebp + 0x54]
push edi
call fcn.0040b65c
mov edi, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 3
push ebx
push ebx
lea eax, [ebp - 0x20]
push eax
push esi
push dword [ebp - 0x20]
push esi
call edi
cmp dword [ebp - 0x28], ebx
mov word [ebp + 0x36], bx
je 0x4076a2
push dword [ebp - 0x28]
mov ecx, dword [ebp + 0x54]
push ebx
push ebx
lea eax, [ebp + 0x36]
push eax
push ecx
push dword [ebp + 0x30]
call fcn.00406707
cmp dword [ebp - 0x28], ebx
je 0x4076a2
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 3
push 1
push ebx
lea eax, [ebp - 0x20]
push eax
push esi
push dword [ebp - 0x20]
mov dword [ebp - 0x28], ebx
push esi
call edi
mov ecx, dword [ebp - 0x20]
cmp ecx, ebx
je 0x4076d0
lea eax, [ebp - 0x1ec]
or byte [eax + 0x2d], 1
mov dword [ebp + 0x3c], 1
mov dword [eax + 0x38], ecx
mov eax, dword [ebp + 8]
mov dword [ebp + 0x5c], eax
xor edi, edi
inc edi
mov cx, word [eax]
cmp cx, bx
je 0x40792e
cmp cx, 0x3c
je 0x4076fe
cmp cx, 0x3e
je 0x4076fe
inc eax
inc eax
mov dword [ebp + 0x5c], eax
mov cx, word [eax]
cmp cx, bx
jne 0x4076e5
mov cx, word [eax]
cmp cx, bx
je 0x40792e
cmp cx, 0x3c
jne 0x4077d9
mov word [eax], bx
add dword [ebp + 0x5c], 2
lea eax, [ebp + 0x5c]
push eax
call fcn.00426ff7
mov eax, dword [ebp + 0x5c]
cmp word [eax], bx
pop ecx
je 0x4077d9
mov dword [ebp + 0x44], eax
jmp 0x407747
cmp cx, 0x3c
je 0x40774f
cmp cx, 0x3e
je 0x40774f
inc eax
inc eax
mov dword [ebp + 0x5c], eax
mov cx, word [eax]
cmp cx, bx
jne 0x407736
sub eax, dword [ebp + 0x44]
lea ecx, [ebp - 4]
sar eax, 1
push eax
push dword [ebp + 0x44]
call fcn.004361fb
lea ecx, [ebp + 0x40]
call fcn.0042c3f7
mov ecx, dword [ebp + 0x54]
push edi
push ebx
lea eax, [ebp + 0x40]
push eax
push dword [ebp + 0x44]
call fcn.0043d4de
mov eax, dword [ebp + 0x40]
push eax
mov dword [ebp + 0x44], eax
call fcn.0040b1aa
lea eax, [ebp + 0x44]
push eax
call fcn.00426ff7
cmp dword [ebp], ebx
pop ecx
pop ecx
je 0x40779e
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
push 3
lea eax, [ebp - 0xf8]
push eax
push 7
push 0xc0000000
push dword [ebp + 0x44]
lea ecx, [ebp]
mov dword [ebp], ebx
call fcn.00403c6d
cmp dword [ebp], ebx
jne 0x4077c6
mov dword [ebp], ebx
lea ecx, [ebp + 0x40]
call fcn.0042704a
lea ecx, [ebp - 4]
call fcn.0042704a
mov eax, dword [ebp + 0x5c]
cmp word [eax], 0x3e
jne 0x4076d9
mov word [eax], bx
mov eax, dword [ebp + 0x5c]
xor esi, esi
cmp word [eax - 2], 0x32
mov byte [ebp + 0x37], 1
jne 0x4077fe
mov byte [ebp + 0x37], 2
mov word [eax - 2], bx
add dword [ebp + 0x5c], 2
mov eax, dword [ebp + 0x5c]
cmp word [eax], 0x3e
jne 0x407811
add dword [ebp + 0x5c], 2
mov esi, edi
mov eax, dword [ebp + 0x5c]
cmp word [eax], 0x26
jne 0x407822
add dword [ebp + 0x5c], 2
mov byte [ebp + 0x37], 3
lea eax, [ebp + 0x5c]
push eax
call fcn.00426ff7
mov eax, dword [ebp + 0x5c]
cmp word [eax], bx
pop ecx
je 0x4076d9
mov dword [ebp + 0x4c], eax
jmp 0x40784e
cmp cx, 0x3c
je 0x407856
cmp cx, 0x3e
je 0x407856
inc eax
inc eax
mov dword [ebp + 0x5c], eax
mov cx, word [eax]
cmp cx, bx
jne 0x40783d
sub eax, dword [ebp + 0x4c]
lea ecx, [ebp - 0x3c]
sar eax, 1
push eax
push dword [ebp + 0x4c]
call fcn.004361fb
lea ecx, [ebp + 0x30]
call fcn.0042c3f7
mov ecx, dword [ebp + 0x54]
push edi
push ebx
lea eax, [ebp + 0x30]
push eax
push dword [ebp + 0x4c]
call fcn.0043d4de
mov eax, dword [ebp + 0x30]
push eax
mov dword [ebp + 0x4c], eax
call fcn.0040b1aa
lea eax, [ebp + 0x4c]
push eax
call fcn.00426ff7
test byte [ebp + 0x37], 1
pop ecx
pop ecx
je 0x4078ae
cmp dword [ebp - 0xc], ebx
je 0x4078ab
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xc], ebx
test byte [ebp + 0x37], 2
je 0x4078c8
cmp dword [ebp + 0x28], ebx
je 0x4078c2
push dword [ebp + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x24], ebx
push ebx
push ebx
push 4
lea eax, [ebp - 0xf8]
push eax
push 7
push 0x40000000
push dword [ebp + 0x4c]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
call fcn.00403c6d
mov edi, eax
cmp edi, ebx
jne 0x407906
lea ecx, [ebp + 0x30]
call fcn.0042704a
lea ecx, [ebp - 0x3c]
call fcn.0042704a
mov eax, dword [ebp + 0x5c]
jmp 0x4076d6
cmp esi, ebx
je 0x407915
push 2
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [ebp + 0x37], 1
jne 0x407920
mov dword [ebp - 0xc], edi
jmp 0x4078ee
cmp byte [ebp + 0x37], 3
mov dword [ebp + 0x24], edi
je 0x40791b
mov dword [ebp + 0x28], edi
jmp 0x4078ee
mov ecx, dword [ebp]
cmp ecx, ebx
mov edx, 0x100
je 0x407949
lea eax, [ebp - 0x1ec]
or dword [eax + 0x2c], edx
mov dword [ebp + 0x3c], edi
mov dword [eax + 0x38], ecx
mov ecx, dword [ebp - 0xc]
cmp ecx, ebx
je 0x40795f
lea eax, [ebp - 0x1ec]
or dword [eax + 0x2c], edx
mov dword [ebp + 0x3c], edi
mov dword [eax + 0x3c], ecx
mov ecx, dword [ebp + 0x24]
cmp ecx, ebx
je 0x407975
lea eax, [ebp - 0x1ec]
or dword [eax + 0x2c], edx
mov dword [ebp + 0x3c], edi
mov dword [eax + 0x40], ecx
mov ecx, dword [ebp + 0x54]
push edi
push ebx
lea eax, [ebp - 0x9c]
push eax
push dword [ebp + 8]
call fcn.0043d4de
mov eax, dword [ebp - 0x9c]
mov dword [ebp + 0x68], eax
push 6
pop edi
mov esi, 0x10000000
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
cmp ax, 0x21
je 0x4079ce
cmp ax, 0x2a
je 0x4079ce
cmp ax, 0x40
jne 0x4079d7
push str.WinSta0WinLogon
lea ecx, [ebp - 0x7c]
call fcn.004362a2
mov ecx, dword [ebp - 0x7c]
inc byte [ebp + 0x3a]
lea eax, [ebp - 0x1ec]
mov dword [eax + 8], ecx
mov dword [ebp - 0x14], esi
add dword [ebp + 0x68], 2
jmp 0x40799a
cmp ax, 0x3d
jne 0x4079e6
mov dword [ebp + 4], 1
jmp 0x4079d1
cmp ax, 0x24
jne 0x4079f2
mov byte [ebp + 0x3b], 1
jmp 0x4079d1
cmp ax, 0x26
jne 0x407a01
mov dword [ebp - 0x14], 3
jmp 0x4079d1
cmp ax, 0x5e
jne 0x407a0c
mov dword [ebp - 0x14], edi
jmp 0x4079d1
cmp ax, 0x5f
je 0x407a07
lea edi, [ebp - 0x1ec]
cmp dword [edi + 8], ebx
je 0x407a30
test byte [ebp + 0x3a], 1
je 0x407a30
call fcn.0040373e
cmp eax, 1
jge 0x407a30
mov dword [edi + 8], ebx
mov eax, dword [ebp + 0x7c]
cmp eax, ebx
je 0x407a4b
or byte [edi + 0x2d], 1
mov dword [ebp + 4], ebx
mov byte [ebp + 0x73], bl
mov dword [ebp + 0x3c], 1
mov dword [edi + 0x3c], eax
cmp byte [ebp + 0x3b], bl
je 0x407a65
mov eax, dword [ebp - 0x80]
cmp word [eax], bx
jne 0x407a65
push str.open
lea ecx, [ebp - 0x80]
call fcn.00436246
mov eax, dword [ebp - 0x14]
cmp eax, esi
je 0x407a71
cmp byte [ebp - 0x17], bl
je 0x407a75
or byte [edi + 0x2c], 0x80
cmp eax, ebx
je 0x407a81
or dword [edi + 0x2c], 1
mov word [edi + 0x30], ax
mov al, byte [ebp + 0x3a]
and al, 3
cmp al, 3
je 0x407a8f
cmp byte [ebp - 0x19], bl
je 0x407a93
or byte [edi + 0x2f], 8
cmp byte [ebp - 0x18], bl
je 0x407ae4
push 0x5c
push dword [ebp + 0x68]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edi, eax
cmp edi, ebx
je 0x407aad
inc edi
inc edi
jmp 0x407ab0
mov edi, dword [ebp + 0x68]
push dword [ebp + 0x68]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push dword [ebp + 0x68]
xor eax, eax
cmp dword [ebp + 4], ebx
push 1
setne al
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
add eax, 0x80000001
push eax
call fcn.00427da9
add esp, 0x18
mov ebx, eax
jmp 0x408f4f
lea eax, [ebp + 0x68]
push eax
call fcn.00426ff7
cmp dword [ebp + 0x48], ebx
pop ecx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x84], ebx
je 0x407b91
lea ecx, [ebp + 0x34]
mov byte [ebp + 0x3b], bl
call fcn.0042c3f7
mov ecx, dword [ebp + 0x54]
push 0xffffffffffffffff
push ebx
push dword [ebp + 0x48]
call fcn.0040f12a
cmp eax, ebx
je 0x407b7f
mov ecx, dword [eax]
cmp word [ecx], bx
je 0x407b7f
push eax
lea ecx, [ebp + 0x34]
call fcn.00436274
push dword [ebp + 0x68]
lea ecx, [ebp - 0x84]
call fcn.004362a2
push dword [ebp - 0x8c]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 0x34]
call fcn.004064bb
mov edi, eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x84]
add esp, 0x14
lea ecx, [ebp + 0x34]
mov dword [ebp + 0x68], eax
call fcn.0042704a
cmp edi, ebx
je 0x407b91
mov ebx, edi
jmp 0x408f3c
lea ecx, [ebp + 0x34]
call fcn.0042704a
mov ebx, 0x80070057
jmp 0x408f3c
mov eax, dword [ebp - 0x88]
cmp word [eax], bx
je 0x407be7
push dword [ebp + 0x68]
call fcn.0040ce49
pop ecx
push eax
lea ecx, [ebp + 0x70]
mov dword [ebp + 0x68], eax
call fcn.004361de
push 0x481318
lea ecx, [ebp + 0x70]
call fcn.0042c465
push dword [ebp - 0x88]
lea ecx, [ebp + 0x70]
call fcn.0042c465
mov ecx, dword [ebp + 0x54]
push ebx
push dword [ebp + 0x70]
call fcn.0043ba4c
mov ebx, eax
lea ecx, [ebp + 0x70]
call fcn.0042704a
jmp 0x408f3c
cmp byte [ebp - 0xd], bl
je 0x407d32
lea ecx, [ebp + 0x7c]
call fcn.0042c3f7
push dword [ebp + 0x68]
mov dword [ebp + 0x70], ebx
call fcn.0040ce49
pop ecx
lea ecx, [ebp + 0x78]
mov dword [ebp + 0x68], eax
call fcn.0042c3f7
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp + 0x78]
push eax
push dword [ebp + 0x68]
mov dword [ebp + 0x40], ebx
call fcn.00434c96
mov eax, dword [ebp + 0x40]
add esp, 0xc
cmp eax, ebx
jne 0x407c3c
lea ecx, [ebp + 0x78]
call fcn.0042704a
lea ecx, [ebp + 0x7c]
jmp 0x407b82
mov word [eax - 2], bx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push dword [ebp + 0x78]
lea ecx, [ebp + 0x48]
mov edi, eax
call fcn.004361de
push dword [ebp + 0x40]
mov esi, dword [ebp + 0x48]
lea ecx, [ebp + 0x6c]
call fcn.004361de
push edi
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp + 0x70]
push eax
push dword [ebp + 0x6c]
push esi
call fcn.00405114
add esp, 0x14
cmp dword [ebp + 0x70], ebx
jle 0x407cb6
mov eax, dword [ebp + 0x54]
mov eax, dword [eax + 0x2c]
xor esi, esi
cmp eax, ebx
je 0x407c8a
mov esi, dword [eax + 0x18]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebx
push esi
push ebx
push dword [ebp - 0xac]
push dword [ebp - 0xb0]
push 0x128
push edi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
push edi
call dword [sym.imp.USER32.dll_DestroyMenu]
cmp dword [ebp + 0x70], ebx
jle 0x407d12
mov esi, dword [ebp + 0x7c]
lea eax, [ebp + 0x70]
mov dword [ebp + 0x70], esi
call fcn.0040edc9
mov eax, dword [ebp + 0x70]
mov word [eax], bx
cmp word [esi], bx
je 0x407d12
push dword [ebp + 0x68]
lea ecx, [ebp + 0x74]
call fcn.004361de
push 0x481318
lea ecx, [ebp + 0x74]
call fcn.0042c465
push esi
lea ecx, [ebp + 0x74]
call fcn.0042c465
mov ecx, dword [ebp + 0x54]
push ebx
push dword [ebp + 0x74]
call fcn.0043ba4c
lea ecx, [ebp + 0x74]
mov ebx, eax
call fcn.0042704a
lea ecx, [ebp + 0x6c]
call fcn.0042704a
lea ecx, [ebp + 0x48]
call fcn.0042704a
lea ecx, [ebp + 0x78]
call fcn.0042704a
lea ecx, [ebp + 0x7c]
jmp 0x407bdd
push dword [ebp + 0x68]
lea ecx, [ebp - 0xb4]
call fcn.004361de
cmp byte [0x496d58], bl
mov eax, dword [ebp - 0xb4]
mov edi, dword [ebp + 0x6c]
mov dword [ebp + 0x68], eax
mov esi, 0x496eb8
jne 0x407d71
cmp edi, ebx
je 0x407d62
cmp byte [edi + 0xa], bl
jne 0x407d71
cmp byte [ebp - 0x16], bl
mov byte [ebp + 0x7f], bl
je 0x407d75
cmp edi, ebx
je 0x407d75
mov esi, dword [edi + 0x28]
mov byte [ebp + 0x7f], 1
push ebx
lea ecx, [ebp + 8]
call fcn.004361de
cmp byte [ebp + 0x7f], bl
mov dword [ebp + 0x5c], ebx
je 0x407ff1
push 0x4975e4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
lea ecx, [ebp - 0x280]
call fcn.0040f0e3
cmp edi, ebx
je 0x407db2
push esi
push edi
lea ecx, [ebp - 0x280]
call fcn.00428e95
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edi, eax
push 0x106
lea ecx, [ebp + 0x24]
mov dword [ebp - 4], edi
call fcn.0042c415
mov eax, dword [ebp + 0x24]
mov dword [ebp + 0x6c], eax
jmp 0x407e4a
mov dword [ebp + 0x7c], edi
jmp 0x407ddd
cmp ax, 0x3d
je 0x407de7
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x407dd7
mov esi, edi
sub esi, dword [ebp + 0x7c]
sar esi, 1
cmp word [edi], bx
je 0x407e48
cmp word [edi + 2], bx
je 0x407e43
cmp esi, 0x104
jg 0x407e43
push esi
push dword [ebp + 0x7c]
push dword [ebp + 0x6c]
call fcn.00403c15
mov eax, dword [ebp + 0x6c]
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x280]
mov word [eax + esi*2], bx
call fcn.0040af39
test eax, eax
jne 0x407e43
push 0xffffffffffffffff
push esi
lea eax, [edi + 2]
push eax
push dword [ebp + 0x7c]
lea ecx, [ebp - 0x280]
call fcn.0040ae9c
jmp 0x407e43
inc edi
inc edi
cmp word [edi], bx
jne 0x407e41
inc edi
inc edi
cmp word [edi], bx
jne 0x407dd2
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, dword [ebp - 0x27c]
xor esi, esi
cmp eax, ebx
mov dword [ebp + 0x6c], eax
mov dword [ebp + 0x7c], ebx
jle 0x407efc
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x48], eax
inc eax
cmp eax, dword [ebp + 0x6c]
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x4c], eax
jge 0x407eed
mov eax, dword [ebp + 0x7c]
shl eax, 2
mov dword [ebp - 4], eax
mov dword [ebp + 0x40], eax
mov eax, dword [ebp - 0x280]
mov ecx, dword [ebp + 0x40]
mov ecx, dword [ecx + eax]
mov edi, dword [ebp + 0x4c]
mov ecx, dword [ecx]
shl edi, 2
mov eax, dword [eax + edi]
mov eax, dword [eax]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jge 0x407ebc
mov ecx, dword [ebp + 0x4c]
mov dword [ebp + 0x48], ecx
mov dword [ebp + 0x40], edi
jmp 0x407ebf
mov ecx, dword [ebp + 0x48]
inc dword [ebp + 0x4c]
mov eax, dword [ebp + 0x4c]
cmp eax, dword [ebp + 0x6c]
jl 0x407e8c
cmp ecx, dword [ebp + 0x7c]
je 0x407eed
mov edx, dword [ebp - 0x280]
mov eax, dword [ebp - 4]
add eax, edx
mov edi, dword [eax]
shl ecx, 2
mov edx, dword [edx + ecx]
mov dword [eax], edx
mov eax, dword [ebp - 0x280]
mov dword [eax + ecx], edi
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x6c]
mov dword [ebp + 0x7c], eax
jl 0x407e6e
cmp dword [ebp + 0x6c], ebx
mov dword [ebp + 0x7c], ebx
jle 0x407f3e
mov eax, dword [ebp - 0x280]
mov ecx, dword [ebp + 0x7c]
mov eax, dword [eax + ecx*4]
push dword [eax]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call edi
mov ecx, dword [ebp + 0x7c]
lea esi, [esi + eax + 1]
mov eax, dword [ebp - 0x280]
mov eax, dword [eax + ecx*4]
push dword [eax + 4]
call edi
inc dword [ebp + 0x7c]
lea esi, [esi + eax + 3]
mov eax, dword [ebp + 0x7c]
cmp eax, dword [ebp + 0x6c]
jl 0x407f04
add esi, 4
push esi
lea ecx, [ebp + 8]
call fcn.0042c43e
mov edi, dword [ebp + 8]
xor esi, esi
cmp dword [ebp + 0x6c], ebx
mov dword [ebp + 0x5c], edi
jle 0x407fc0
mov eax, dword [ebp - 0x280]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
push eax
mov dword [ebp + 0x7c], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp + 0x7c]
mov dword [ebp + 0x40], eax
push edi
call fcn.00403c15
mov eax, dword [ebp + 0x40]
lea edi, [edi + eax*2]
mov word [edi], 0x3d
mov eax, dword [ebp - 0x280]
mov eax, dword [eax + esi*4]
mov eax, dword [eax + 4]
add esp, 0xc
inc edi
push eax
inc edi
mov dword [ebp + 0x7c], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp + 0x7c]
mov dword [ebp + 0x40], eax
push edi
call fcn.00403c15
mov eax, dword [ebp + 0x40]
lea edi, [edi + eax*2]
add esp, 0xc
mov word [edi], bx
inc edi
inc edi
inc esi
cmp esi, dword [ebp + 0x6c]
jl 0x407f57
mov word [edi], bx
lea ecx, [ebp + 0x24]
mov word [edi + 2], bx
call fcn.0042704a
push ebx
lea ecx, [ebp - 0x280]
call fcn.0041c401
lea ecx, [ebp - 0x244]
call fcn.0042704a
push 0x4975e4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x2c]
xor esi, esi
inc esi
xor al, al
cmp word [ecx], 0x40
jne 0x408003
inc al
jmp 0x40800a
cmp dword [ebp - 0x4c], ebx
je 0x40800a
mov al, 2
cmp byte [ebp + 0x73], bl
je 0x408100
or byte [ebp + 0x73], 8
neg al
mov dword [ebp + 4], esi
sbb eax, eax
and eax, 0xfff01000
add eax, 0x100000
mov edi, eax
call fcn.00428bd8
push eax
lea eax, [ebp - 0x12c]
push str..pipepecmd_exec__u
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebx
push esi
push edi
push edi
push 0xff
push 6
push 0x40000003
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp eax, ebx
mov dword [ebp - 0x58], eax
je 0x4080a5
cmp eax, 0xffffffff
je 0x4080a5
push 0xffffffffffffffff
lea eax, [ebp - 0x12c]
push eax
lea ecx, [ebp + 0x7c]
call fcn.00436214
push ebx
push ebx
push 3
lea ecx, [ebp - 0xf8]
push ecx
push 7
push 0xc0000000
push dword [eax]
lea ecx, [ebp - 0x54]
call fcn.00403c6d
lea ecx, [ebp + 0x7c]
call fcn.0042704a
jmp 0x4080ac
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebp - 0x54]
push ebx
push ebx
lea eax, [ebp + 0x6c]
push eax
push edi
mov dword [ebp + 0x6c], 2
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
push ebx
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xc0], eax
lea eax, [ebp - 0x1ec]
or byte [eax + 0x2d], 1
test byte [ebp + 0x51], 2
mov dword [ebp - 0x30], esi
mov dword [ebp + 0x3c], esi
jne 0x4080f4
cmp byte [ebp + 0x51], bl
jne 0x4080f7
mov dword [eax + 0x3c], edi
test byte [ebp + 0x51], 1
je 0x408116
mov dword [eax + 0x40], edi
cmp dword [ebp + 4], ebx
jne 0x408116
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
push 0x4975e4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0x5c]
neg eax
sbb eax, eax
and eax, 0x400
or eax, dword [ebp + 0x18]
cmp byte [ebp + 0x52], bl
mov dword [ebp + 0x44], ebx
mov dword [ebp + 0x6c], eax
je 0x40813f
or dword [ebp + 0x6c], 4
cmp byte [ebp - 5], bl
mov dword [ebp - 4], ebx
mov dword [ebp + 0xc], ebx
je 0x408157
lea eax, [ebp - 4]
push eax
call fcn.00402f00
pop ecx
mov dword [ebp + 0xc], eax
cmp byte [ebp + 0x3b], bl
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
je 0x40822d
push 0xd
xor eax, eax
mov dword [ebp - 0x144], ebx
pop ecx
lea edi, [ebp - 0x140]
mov dword [ebp - 0x148], 0x3c
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x14]
or word [ebp - 0x144], 0x4540
cmp eax, ebx
jne 0x408196
push 5
pop eax
movzx eax, ax
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp + 0x68]
mov dword [ebp + 0x20], ebx
mov dword [ebp + 0x14], eax
mov dword [ebp - 0x138], eax
cmp word [eax], 0x22
jne 0x4081f4
push 1
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x14]
push eax
call fcn.00413513
add esp, 0xc
push dword [ebp + 0x20]
lea ecx, [ebp - 0xa8]
push dword [ebp + 0x14]
mov esi, eax
call fcn.0042c51d
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], esi
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp + 0x7c], eax
mov eax, dword [ebp - 0x110]
lea esi, [ebp - 0xec]
push eax
mov dword [esi], eax
mov dword [ebp - 0x110], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [esi + 8], eax
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40864c
cmp byte [ebp - 0xe], bl
je 0x408283
call fcn.0040642a
push dword [ebp + 0x68]
mov dword [ebp - 0x94], eax
push dword [ebp - 0x24]
lea eax, [ebp + 0x44]
push dword [ebp + 0x10]
push eax
call fcn.0040366a
add esp, 0x10
lea ecx, [ebp - 0xec]
push ecx
lea ecx, [ebp - 0x1ec]
push ecx
push eax
push dword [ebp + 0x5c]
push dword [ebp + 0x6c]
push dword [ebp + 0x3c]
push ebx
push ebx
push dword [ebp + 0x68]
push dword [ebp - 0x24]
push dword [ebp - 0x94]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp + 0x7c], eax
jmp 0x408222
mov eax, dword [ebp - 0x64]
cmp word [eax], bx
je 0x4083c5
cmp byte [ebp + 0x1e], bl
mov dword [ebp + 0x7c], ebx
je 0x408329
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp + 0x40]
call fcn.004029b6
lea ecx, [ebp + 0x48]
call fcn.0042c281
mov edi, dword [ebp - 0x5c]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push ebx
push edi
call fcn.0046c4e0
lea eax, [ebp + 0x48]
push eax
push dword [ebp + 0x40]
call fcn.00431ad1
add esp, 0x14
push 0xffffffffffffffff
mov edi, eax
neg edi
push 0xffffffffffffffff
push dword [ebp + 0x48]
sbb edi, edi
lea ecx, [ebp - 0x5c]
neg edi
call fcn.0042c4b4
mov eax, dword [ebp + 0x40]
push eax
mov dword [ebp + 0x20], eax
call esi
push eax
push ebx
push dword [ebp + 0x20]
call fcn.0046c4e0
mov eax, dword [ebp + 0x48]
add esp, 0xc
push eax
mov dword [ebp + 0x20], eax
call esi
push eax
push ebx
push dword [ebp + 0x20]
call fcn.0046c4e0
add esp, 0xc
lea ecx, [ebp + 0x48]
call fcn.0042704a
lea ecx, [ebp + 0x40]
call fcn.0042704a
cmp edi, ebx
je 0x408394
mov edi, dword [ebp - 0x64]
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x40
push edi
call esi
cmp eax, ebx
jne 0x408344
push 0x5c
push edi
call esi
cmp eax, ebx
je 0x40834f
mov word [eax], bx
mov esi, dword [ebp - 0x64]
lea edi, [eax + 2]
jmp 0x408354
mov esi, 0x4812fc
push dword [ebp + 0x68]
lea eax, [ebp + 0x44]
push dword [ebp - 0x24]
push dword [ebp + 0x10]
push eax
call fcn.0040366a
add esp, 0x10
lea ecx, [ebp - 0xec]
push ecx
lea ecx, [ebp - 0x1ec]
push ecx
push eax
push dword [ebp + 0x5c]
push dword [ebp + 0x6c]
push dword [ebp + 0x68]
push dword [ebp - 0x24]
push 1
push dword [ebp - 0x5c]
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov dword [ebp + 0x7c], eax
mov edi, dword [ebp - 0x5c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
call esi
shl eax, 1
push eax
push ebx
push edi
call fcn.0046c4e0
mov edi, dword [ebp - 0x64]
add esp, 0xc
push edi
call esi
shl eax, 1
push eax
push ebx
push edi
call fcn.0046c4e0
add esp, 0xc
jmp 0x408222
cmp byte [ebp + 0x2f], bl
je 0x40840d
push dword [ebp + 0x14]
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp - 0x1ec]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0x5c]
push dword [ebp + 0x6c]
push dword [ebp + 0x3c]
push dword [ebp + 0x68]
push dword [ebp - 0xc8]
push dword [ebp - 0xcc]
call fcn.0043529e
xor ecx, ecx
add esp, 0x28
test eax, eax
setg cl
mov dword [ebp + 0x7c], ecx
jmp 0x408222
mov eax, dword [ebp - 0x24]
cmp eax, ebx
mov dword [ebp + 0x7c], ebx
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x40], ebx
mov dword [ebp + 0x30], ebx
je 0x408446
jmp 0x408427
inc eax
inc eax
inc dword [ebp + 0x30]
cmp word [eax], 0x2a
je 0x408422
cmp word [eax], 0x23
jne 0x408446
mov cx, word [eax + 2]
cmp cx, 0x30
jb 0x408446
cmp cx, 0x39
ja 0x408446
mov dword [ebp + 0x4c], eax
cmp dword [ebp + 0x4c], ebx
mov dword [ebp + 0x14], ebx
je 0x408601
add dword [ebp + 0x4c], 2
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 0x4c]
push eax
call fcn.00433730
pop ecx
pop ecx
push 0x20
pop esi
lea ecx, [ebp - 0x48]
mov edi, eax
mov dword [ebp + 0x48], esi
call fcn.0042c281
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp - 0x48]
push eax
push edi
push dword [ebp + 0x14]
mov dword [ebp - 0x44], ebx
push ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp + 0x48], esi
call fcn.0040f211
mov edi, eax
add esp, 0x14
cmp edi, ebx
jne 0x4084c8
push dword [ebp + 0x14]
push 0x4812f4
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4084c8
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp - 0x48]
push eax
push str.INDATA
push 2
push ebx
mov dword [ebp + 0x48], esi
call fcn.0040f211
add esp, 0x14
mov edi, eax
cmp dword [ebp - 0x44], ebx
jle 0x4085f1
cmp edi, ebx
je 0x4085f1
cmp dword [ebp + 0x30], ebx
jg 0x408540
push ebx
lea esi, [ebp - 0xec]
push esi
lea eax, [ebp - 0x1ec]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0x5c]
push dword [ebp + 0x6c]
push dword [ebp + 0x3c]
push dword [ebp + 0x68]
push dword [ebp - 0x44]
push edi
call fcn.0043529e
add esp, 0x28
cmp eax, ebx
mov dword [ebp + 0x20], eax
jl 0x408540
mov esi, dword [esi + 8]
cmp esi, ebx
je 0x408540
push esi
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
je 0x408540
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
xor eax, eax
cmp dword [ebp + 0x20], ebx
setg al
mov dword [ebp + 0x7c], eax
jmp 0x4085f7
push 0x480d9c
push str.exedat
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp - 0x70]
push eax
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x18], ebx
call fcn.00403d34
add esp, 0x14
cmp dword [ebp + 0x24], ebx
je 0x4085e1
push ebx
lea eax, [ebp + 0x20]
push eax
push dword [ebp - 0x44]
mov dword [ebp + 0x20], ebx
push edi
push dword [ebp + 0x24]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp + 0x68]
lea eax, [ebp + 0x44]
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push eax
call fcn.0040366a
lea esi, [ebp - 0xec]
push esi
lea ecx, [ebp - 0x1ec]
push ecx
push eax
push dword [ebp + 0x5c]
push dword [ebp + 0x6c]
push dword [ebp + 0x3c]
push ebx
push ebx
push dword [ebp + 0x68]
push dword [ebp + 0x18]
call fcn.0046c18a
add esp, 0x38
cmp dword [ebp + 0x30], 2
mov dword [ebp + 0x7c], eax
jl 0x4085e7
push dword [esi + 8]
push dword [ebp - 0x70]
call fcn.00402abf
mov eax, dword [ebp - 0x70]
pop ecx
pop ecx
mov word [eax], bx
jmp 0x4085e7
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp + 0x18]
call fcn.0042704a
jmp 0x4085f7
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x48]
call fcn.0042704a
jmp 0x408644
push dword [ebp + 0x68]
lea eax, [ebp + 0x44]
push dword [ebp - 0x24]
push dword [ebp + 0x10]
push eax
call fcn.0040366a
lea ecx, [ebp - 0xec]
push ecx
lea ecx, [ebp - 0x1ec]
push ecx
push eax
push dword [ebp + 0x5c]
push dword [ebp + 0x6c]
push dword [ebp + 0x3c]
push ebx
push ebx
push dword [ebp + 0x68]
push dword [ebp - 0x24]
call fcn.0046c18a
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x38
mov dword [ebp + 0x7c], eax
lea ecx, [ebp + 0x40]
call fcn.0042704a
cmp dword [ebp + 0xc], ebx
je 0x40865a
push dword [ebp - 4]
call fcn.00402f11
pop ecx
cmp dword [ebp - 0x28], ebx
je 0x408664
push dword [ebp - 0x28]
call edi
cmp dword [ebp + 0x7c], ebx
mov dword [ebp - 0x28], ebx
je 0x408670
xor eax, eax
jmp 0x408676
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x78]
mov dword [ecx], eax
lea ecx, [ebp - 0x3c]
mov dword [ebp + 0xc], eax
call fcn.0040296e
mov eax, dword [ebp - 0x90]
cmp word [eax], bx
je 0x4086a6
push eax
lea eax, [ebp - 0xec]
push dword [eax + 8]
push dword [ebp + 0x54]
call fcn.0042e3ae
add esp, 0xc
cmp byte [ebp + 0x52], bl
je 0x4086c9
lea esi, [ebp - 0xec]
cmp dword [esi], ebx
je 0x4086c9
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push dword [esi]
mov dword [ebp - 0x50], eax
push eax
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
push str.__LastPID
lea esi, [ebp - 0xec]
push dword [esi + 8]
push dword [ebp + 0x54]
call fcn.0042e3ae
push str.__LastTID
push dword [esi + 0xc]
push dword [ebp + 0x54]
call fcn.0042e3ae
add esp, 0x18
test byte [ebp + 0x6c], 4
je 0x408706
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x408706
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea ecx, [ebp + 0x44]
call fcn.0042704a
push 0x4975e4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp + 8]
call fcn.0042704a
cmp dword [ebp - 0x54], ebx
je 0x40872b
push dword [ebp - 0x54]
call edi
cmp dword [ebp - 0x20], ebx
mov dword [ebp - 0x54], ebx
je 0x408738
push dword [ebp - 0x20]
call edi
cmp dword [ebp], ebx
mov dword [ebp - 0x20], ebx
je 0x408745
push dword [ebp]
call edi
cmp dword [ebp - 0xc], ebx
mov dword [ebp], ebx
je 0x408752
push dword [ebp - 0xc]
call edi
cmp dword [ebp + 0x28], ebx
mov dword [ebp - 0xc], ebx
je 0x40875f
push dword [ebp + 0x28]
call edi
cmp dword [ebp + 0x7c], ebx
mov dword [ebp + 0x28], ebx
je 0x408e82
mov eax, dword [esi]
cmp eax, ebx
jne 0x408774
mov dword [ebp + 4], ebx
mov ecx, dword [ebp - 0x30]
inc dword [ebp - 0x30]
mov dword [ebp + ecx*4 - 0xc0], eax
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x40878b
push eax
call edi
cmp byte [ebp + 0x53], bl
mov dword [esi + 4], ebx
je 0x4087a8
mov ecx, dword [ebp + 0x54]
push 0x3e8
call fcn.0040b65c
push dword [esi]
call fcn.0040bd7d
pop ecx
cmp dword [ebp + 4], ebx
je 0x408e82
mov al, byte [0x495280]
mov edi, 0x100000
push 0x100004
lea ecx, [ebp + 0x5c]
mov byte [ebp + 0x6f], al
mov dword [ebp + 0x3c], edi
xor esi, esi
call fcn.0042c29e
mov eax, dword [ebp - 0x2c]
cmp word [eax], 0x40
lea ecx, [eax + 2]
mov dword [ebp + 0x10], eax
mov dword [ebp - 0x60], ecx
mov byte [ebp + 0x7f], bl
jne 0x408887
mov byte [ebp + 0x7f], 1
mov dword [ebp + 0x10], ecx
cmp byte [ebp - 0x15], bl
je 0x408846
mov ecx, dword [ebp + 0x54]
push ebx
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
mov dword [ebp + 8], ebx
call fcn.0043c875
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
lea ecx, [ebp + 0x5c]
call fcn.0042c37f
push dword [ebp + 0x5c]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
lea eax, [esi + 0x3ff]
and eax, 0xfffffc00
add eax, edi
mov dword [ebp + 0x3c], eax
add eax, 8
push eax
lea ecx, [ebp + 0x5c]
call fcn.0042c2c5
lea ecx, [ebp + 8]
call fcn.0042704a
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
test byte [ebp + 0x73], 8
je 0x408b6b
mov eax, dword [ebp - 0x2c]
mov ax, word [eax]
cmp ax, 0x40
je 0x408899
cmp byte [ebp + 0x1f], bl
je 0x408899
cmp ax, 0x26
je 0x408881
mov eax, dword [ebp + 0x54]
test byte [eax + 0xb], 0xf
je 0x408899
mov byte [ebp + 0x53], 1
jmp 0x40889c
cmp dword [ebp - 0x4c], ebx
je 0x4087f0
mov byte [ebp + 0x7f], 2
jmp 0x4087f0
mov byte [ebp + 0x53], bl
push ebx
mov dword [ebp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
cmp byte [ebp + 0x7f], bl
mov dword [ebp + 0x18], esi
je 0x4088c8
mov eax, dword [ebp + 0x3c]
sub eax, esi
mov dword [ebp + 0x44], eax
jmp 0x4088cd
mov dword [ebp + 0x44], edi
mov eax, edi
lea ecx, [ebp - 0x10c]
push ecx
lea ecx, [ebp + 0x24]
push ecx
push eax
mov eax, dword [ebp + 0x5c]
add eax, esi
push eax
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp - 0x6c], ebx
mov dword [ebp + 0xc], eax
mov dword [ebp - 4], ebx
mov dword [ebp + 0x48], ebx
jg 0x408903
mov dword [ebp - 0x6c], 0x3e8
lea ecx, [ebp + 0x14]
mov byte [ebp + 0x52], bl
call fcn.0042c3f7
mov al, byte [0x495280]
cmp al, bl
mov byte [ebp + 0x6f], al
jle 0x408b5e
mov ecx, dword [ebp + 0x54]
push 0x4ff
push dword [ebp - 0x6c]
lea eax, [ebp - 0xc0]
push ebx
push eax
push dword [ebp - 0x30]
call fcn.0040ce3f
cmp eax, ebx
mov dword [ebp + 0x30], eax
jne 0x4089ca
lea eax, [ebp - 0x58]
mov edi, dword [eax]
push ebx
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp - 0x10c]
push eax
push edi
mov dword [ebp + 0x4c], ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
cmp dword [ebp + 0x4c], ebx
jle 0x408978
mov eax, dword [ebp + 0x44]
cmp dword [ebp + 0x4c], eax
jle 0x40896f
mov dword [ebp + 0x4c], eax
add esi, dword [ebp + 0x4c]
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi], bl
lea eax, [esi + 0x100000]
cmp eax, dword [ebp + 0x3c]
jl 0x408999
add dword [ebp + 0x3c], 0x100000
mov eax, dword [ebp + 0x3c]
add eax, 4
push eax
lea ecx, [ebp + 0x5c]
call fcn.0042c2c5
cmp byte [ebp + 0x7f], bl
je 0x4089a8
mov eax, dword [ebp + 0x3c]
sub eax, esi
mov dword [ebp + 0x44], eax
jmp 0x4089af
mov dword [ebp + 0x44], 0x100000
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp + 0x4c]
push eax
push dword [ebp + 0x44]
mov eax, dword [ebp + 0x5c]
add eax, esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [ebp + 0x7f], bl
je 0x4089fb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
sub eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x6c]
jge 0x408aaf
cmp esi, dword [ebp + 0x48]
je 0x408b55
cmp eax, 0x14
jl 0x408b55
jmp 0x408aaf
mov eax, dword [ebp - 0x30]
cmp eax, 1
jle 0x408a24
dec eax
cmp eax, dword [ebp + 0x30]
jne 0x408a24
cmp byte [ebp + 0x7f], bl
mov byte [ebp + 0x52], 1
je 0x408b5e
cmp esi, dword [ebp + 0x48]
je 0x408b5e
jmp 0x408aaf
test byte [ebp + 0x73], 1
je 0x408a41
mov eax, dword [ebp + 0x18]
jmp 0x408a3d
mov ecx, dword [ebp + 0x5c]
cmp byte [eax + ecx], 0xa
je 0x408b5e
inc eax
cmp eax, esi
jl 0x408a2f
push 5
pop edi
dec edi
js 0x40890e
cmp byte [0x495280], bl
jle 0x40890e
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x40890e
cmp dword [ebp - 0x160], 0x12
je 0x408a96
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x408a44
cmp byte [ebp + 0x7f], bl
mov byte [ebp + 0x6f], bl
mov byte [ebp + 0x52], 1
je 0x40890e
cmp esi, dword [ebp + 0x48]
je 0x40890e
cmp byte [ebp + 0x53], bl
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0x5c]
mov dword [ebp + 0x48], esi
mov dword [ebp + 0xc], ecx
jne 0x408ae8
cmp dword [ebp - 0x38], 0x4b0
je 0x408adb
push dword [ebp - 0x38]
lea ecx, [ebp + 0x14]
push esi
push eax
call fcn.0042c4b4
mov eax, dword [ebp + 0x14]
jmp 0x408ae8
mov word [eax + esi + 2], bx
mov ecx, dword [ebp + 0x5c]
mov word [ecx + esi + 2], bx
cmp byte [ebp + 0x7f], 1
jne 0x408b05
mov ecx, dword [ebp + 0x54]
push eax
push eax
push 0x480934
push dword [ebp + 0x10]
push dword [ebp + 0x10]
call fcn.004292c5
jmp 0x408b2f
cmp byte [ebp + 0x53], bl
je 0x408b23
push ebx
lea eax, [ebp + 0x5c]
push eax
push esi
push dword [ebp + 0x5c]
push dword [ebp - 0x2c]
push dword [ebp + 0x54]
call fcn.0043a84b
add esp, 0x18
jmp 0x408b2f
mov ecx, dword [ebp + 0x54]
push eax
push dword [ebp + 0x10]
call fcn.0042af0d
cmp dword [ebp - 0x4c], ebx
je 0x408b55
push dword [ebp - 0x4c]
lea ecx, [ebp + 0x20]
call fcn.004361de
mov ecx, dword [ebp + 0x54]
push ebx
push ebx
push ebx
push dword [ebp + 0x20]
call fcn.00420c52
lea ecx, [ebp + 0x20]
call fcn.0042704a
cmp byte [ebp + 0x52], bl
je 0x4089fb
lea ecx, [ebp + 0x14]
call fcn.0042704a
jmp 0x408c50
cmp dword [ebp + 4], 0xffffff9c
je 0x408c50
jmp 0x408c40
mov ecx, dword [ebp + 0x54]
push 0x4ff
push 0x3e8
push ebx
lea eax, [ebp - 0xc0]
push eax
push dword [ebp - 0x30]
call fcn.0040ce3f
mov ecx, dword [ebp - 0x30]
dec ecx
cmp ecx, eax
je 0x408c50
cmp dword [ebp - 0x30], 1
jle 0x408c38
cmp eax, ebx
jne 0x408c38
lea eax, [esi + 0x100000]
cmp eax, dword [ebp + 0x3c]
jl 0x408bd2
add dword [ebp + 0x3c], edi
mov eax, dword [ebp + 0x3c]
add eax, 4
push eax
lea ecx, [ebp + 0x5c]
call fcn.0042c2c5
push ebx
lea eax, [ebp + 0x7c]
push eax
mov eax, dword [ebp + 0x5c]
push 1
add eax, esi
push eax
push dword [ebp - 0x58]
mov dword [ebp + 0x7c], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x408c38
cmp dword [ebp + 0x7c], ebx
jbe 0x408c38
add esi, dword [ebp + 0x7c]
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi], bl
jmp 0x408c38
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x408c40
cmp dword [ebp - 0x124], 0x12
je 0x408c40
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp byte [0x495280], bl
jg 0x408bff
mov al, byte [0x495280]
cmp al, bl
mov byte [ebp + 0x6f], al
jg 0x408b7a
cmp dword [ebp + 4], 0xffffff9c
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi + 2], bl
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi + 1], bl
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi], bl
mov dword [ebp + 0x40], ebx
je 0x408c81
cmp byte [ebp + 0x6f], bl
jle 0x408c81
push ebx
lea eax, [ebp - 0xec]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp - 0xec]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp byte [ebp + 0x73], bl
mov eax, dword [ebp + 0x40]
mov ecx, dword [ebp + 0x78]
mov dword [ecx], eax
je 0x408e30
mov eax, dword [ebp - 0x2c]
mov ax, word [eax]
xor edi, edi
cmp ax, 0x40
je 0x408ccc
cmp byte [ebp + 0x1f], bl
je 0x408ccc
cmp ax, 0x26
je 0x408cc6
mov eax, dword [ebp + 0x54]
test byte [eax + 0xb], 0xf
je 0x408ccc
mov byte [ebp + 0x7b], 1
jmp 0x408ccf
mov byte [ebp + 0x7b], bl
lea ecx, [ebp - 0x48]
call fcn.0042c281
cmp byte [ebp + 0x7b], bl
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
jne 0x408dd8
cmp byte [ebp + 0x77], 2
jne 0x408cf8
mov eax, dword [ebp + 0x5c]
mov word [eax + esi], bx
mov edi, dword [ebp + 0x5c]
jmp 0x408d48
cmp byte [ebp + 0x77], 1
lea ecx, [ebp - 0x48]
jne 0x408d0f
push dword [ebp - 0x38]
push esi
push dword [ebp + 0x5c]
call fcn.0042c4b4
jmp 0x408d4c
lea eax, [esi + 0x18]
push eax
call fcn.0042c43e
lea eax, [esi + 1]
push eax
push dword [ebp + 0x5c]
mov dword [ebp - 0x40], esi
push dword [ebp - 0x48]
mov dword [ebp - 0x44], esi
call fcn.0046c720
mov eax, dword [ebp - 0x48]
push 0x10
add eax, esi
push ebx
push eax
call fcn.0046c4e0
lea eax, [ebp - 0x48]
push ebx
push eax
call fcn.0043edf7
add esp, 0x20
cmp edi, ebx
jne 0x408d4f
mov edi, dword [ebp - 0x48]
test byte [ebp + 0x73], 4
je 0x408d80
push edi
mov dword [ebp + 0x7c], edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [edi + eax*2 - 2]
jmp 0x408d79
mov ax, word [edi]
cmp ax, 0xd
je 0x408d74
cmp ax, 0xa
jne 0x408dd8
mov word [edi], bx
dec edi
dec edi
cmp edi, dword [ebp + 0x7c]
jae 0x408d65
jmp 0x408dd8
test byte [ebp + 0x73], 1
jne 0x408d9f
test byte [ebp + 0x73], 2
je 0x408dd8
jmp 0x408dd0
mov ax, word [edi]
cmp ax, 0xd
je 0x408da4
cmp ax, 0xa
je 0x408da4
inc edi
inc edi
cmp word [edi], bx
jne 0x408d8e
mov word [edi], bx
jmp 0x408dd8
cmp ax, 0xd
je 0x408db9
cmp ax, 0xa
je 0x408db9
inc edi
inc edi
jmp 0x408dd0
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
lea eax, [edi + 2]
push eax
push edi
call fcn.0046ca60
add esp, 0xc
mov ax, word [edi]
cmp ax, bx
jne 0x408da9
mov eax, dword [ebp - 0x2c]
cmp word [eax], 0x40
jne 0x408dfc
push dword [ebp - 0x48]
mov ecx, dword [ebp + 0x54]
push dword [ebp - 0x48]
push 0x480934
push dword [ebp - 0x60]
push dword [ebp - 0x60]
call fcn.004292c5
jmp 0x408e25
cmp byte [ebp + 0x7b], bl
je 0x408e19
push 1
lea ecx, [ebp + 0x5c]
push ecx
push esi
push dword [ebp + 0x5c]
push eax
push dword [ebp + 0x54]
call fcn.0043a84b
add esp, 0x18
jmp 0x408e25
push dword [ebp - 0x48]
mov ecx, dword [ebp + 0x54]
push eax
call fcn.0042af0d
lea ecx, [ebp - 0x48]
call fcn.0042704a
mov eax, dword [ebp + 0x40]
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x2c0]
push 0x4812ac
push eax
mov word [ebp - 0x2c0], bx
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp + 0x54]
add esp, 0xc
lea eax, [ebp - 0x2c0]
push eax
push str.ERRORLEVEL
call fcn.0042af0d
cmp dword [ebp - 0x50], ebx
je 0x408e74
push 1
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
lea ecx, [ebp + 0x5c]
call fcn.0042704a
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x70]
cmp ecx, ebx
je 0x408e9f
cmp word [ecx], bx
je 0x408e9f
lea eax, [ebp - 0xec]
push dword [eax + 8]
push ecx
call fcn.00402abf
pop ecx
pop ecx
lea esi, [ebp - 0xec]
mov eax, dword [esi]
cmp eax, ebx
je 0x408eae
push eax
call edi
mov dword [esi], ebx
lea esi, [ebp]
mov eax, dword [esi]
cmp eax, ebx
je 0x408ebc
push eax
call edi
mov dword [esi], ebx
lea esi, [ebp - 0xc]
mov eax, dword [esi]
cmp eax, ebx
je 0x408eca
push eax
call edi
mov dword [esi], ebx
lea esi, [ebp + 0x28]
cmp dword [esi], ebx
je 0x408ed6
push ebx
call edi
mov dword [esi], ebx
lea esi, [ebp - 0x54]
mov eax, dword [esi]
cmp eax, ebx
je 0x408ee4
push eax
call edi
mov dword [esi], ebx
lea esi, [ebp - 0x58]
mov eax, dword [esi]
cmp eax, ebx
je 0x408ef2
push eax
call edi
mov dword [esi], ebx
lea esi, [ebp - 0x68]
mov eax, dword [esi]
cmp eax, ebx
je 0x408f00
push eax
call edi
cmp dword [ebp - 0xfc], ebx
mov dword [esi], ebx
je 0x408f12
push dword [ebp - 0xfc]
call edi
lea esi, [ebp - 0xec]
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x408f22
push eax
call edi
mov ecx, dword [ebp + 0x54]
push ebx
mov dword [esi + 4], ebx
call fcn.0044b61d
lea ecx, [ebp - 0xb4]
call fcn.0042704a
mov ebx, dword [ebp + 0xc]
lea ecx, [ebp - 0x84]
call fcn.0042704a
lea ecx, [ebp - 0x3c]
call fcn.0040296e
lea ecx, [ebp - 0x9c]
call fcn.0042704a
lea ecx, [ebp - 0x28]
call fcn.0040296e
lea ecx, [ebp - 0x20]
call fcn.0040296e
lea ecx, [ebp + 0x28]
call fcn.0040296e
lea ecx, [ebp - 0xc]
call fcn.0040296e
lea ecx, [ebp]
call fcn.0040296e
lea ecx, [ebp - 0x68]
call fcn.0040296e
lea ecx, [ebp - 0x54]
call fcn.0040296e
lea ecx, [ebp - 0x58]
call fcn.0040296e
lea ecx, [ebp - 0x70]
call fcn.0042704a
lea ecx, [ebp - 0xcc]
call fcn.0042704a
lea ecx, [ebp - 0x74]
call fcn.0042704a
lea ecx, [ebp - 0x34]
call fcn.0042704a
lea ecx, [ebp - 0xa8]
call fcn.0042704a
lea ecx, [ebp - 0x80]
call fcn.0042704a
lea ecx, [ebp - 0x90]
call fcn.0042704a
lea ecx, [ebp - 0x78]
call fcn.0042704a
lea ecx, [ebp - 0x50]
call fcn.0040296e
lea ecx, [ebp - 0x94]
call fcn.0040296e
lea ecx, [ebp - 0x7c]
call fcn.0042704a
lea ecx, [ebp - 0xb8]
call fcn.0042704a
lea ecx, [ebp - 0x5c]
call fcn.0042704a
lea ecx, [ebp - 0x64]
call fcn.0042704a
lea ecx, [ebp - 0x2c]
call fcn.0042704a
lea ecx, [ebp - 0x8c]
call fcn.0042704a
lea ecx, [ebp - 0x88]
call fcn.0042704a
lea ecx, [ebp - 0xa0]
call fcn.0042704a
lea ecx, [ebp - 0x98]
call fcn.0042704a
pop edi
pop esi
mov eax, ebx
pop ebx
add ebp, 0x60
leave
ret 0x18