Function at 0x4f1908
Capabilities:
Create process on windows
Get common file path
Move file
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x24
push 0
push 0
dec ecx
jne 0x4f1910
push ebx
push esi
push edi
mov eax, 0x4f1168
call fcn.00406d80
mov esi, 0x5340cc
xor eax, eax
push ebp
push 0x4f293b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [0x534a7c]
mov eax, dword [eax]
call fcn.00409a74
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00408d84
mov eax, dword [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov eax, 2
call fcn.004a94e4
mov edx, dword [ebp - 0x1c]
pop eax
call fcn.00404978
jne 0x4f1977
mov eax, dword [0x53452c]
mov byte [eax], 0
jmp 0x4f197f
mov eax, dword [0x53452c]
mov byte [eax], 1
lea edx, [ebp - 0x24]
mov eax, 1
call fcn.00402aa0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408dc0
mov edx, dword [ebp - 0x20]
mov eax, dword [0x5346e4]
call fcn.004045d0
lea edx, [ebp - 0x2c]
mov eax, 2
call fcn.00402aa0
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00408dc0
mov edx, dword [ebp - 0x28]
mov eax, dword [0x534748]
call fcn.004045d0
mov eax, dword [0x53452c]
cmp byte [eax], 0
jne 0x4f19ef
lea edx, [ebp - 0x30]
mov eax, 0x11c
call fcn.004a94e4
mov edx, dword [ebp - 0x30]
mov eax, dword [0x53455c]
call fcn.004045d0
jmp 0x4f1a18
lea edx, [ebp - 0x38]
mov eax, dword [0x534a7c]
mov eax, dword [eax]
call fcn.00409a74
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x34]
xor edx, edx
call fcn.004099ac
mov edx, dword [ebp - 0x34]
mov eax, dword [0x53455c]
call fcn.004045d0
push 0x4f2958
mov eax, dword [0x534a7c]
push dword [eax]
push 0x4f2958
mov eax, dword [0x5347b4]
mov edx, 3
call fcn.004048f4
mov eax, dword [0x5346e4]
mov eax, dword [eax]
mov edx, 0x4f2964
call fcn.00404978
jne 0x4f1aeb
fld xword [0x4f2968]
mov eax, dword [0x5345ec]
fcomp qword [eax]
fnstsw ax
sahf
jae 0x4f1aeb
call fcn.0046adfc
test al, al
jne 0x4f1aeb
call fcn.0040b010
call fcn.00402b8c
push edx
push eax
lea eax, [ebp - 0x3c]
call fcn.00409388
mov edx, dword [ebp - 0x3c]
mov eax, dword [0x534748]
call fcn.004045d0
lea edx, [ebp - 0x40]
mov eax, dword [0x534a7c]
mov eax, dword [eax]
call fcn.0046d634
mov eax, dword [ebp - 0x40]
call fcn.00404a2c
push eax
mov eax, dword [0x5346e4]
push dword [eax]
push 0x4f297c
mov eax, dword [0x534748]
push dword [eax]
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.004048f4
mov eax, dword [ebp - 0x44]
call fcn.00404a2c
push eax
mov eax, dword [0x534a7c]
mov eax, dword [eax]
call fcn.00404a2c
mov edx, eax
xor eax, eax
pop ecx
call fcn.0046ae78
jmp 0x4f2891
lea edx, [ebp - 0x48]
mov eax, dword [0x534848]
mov eax, dword [eax]
call fcn.00408d84
mov edx, dword [ebp - 0x48]
mov eax, 0x53b7d4
call fcn.004045d0
mov eax, dword [0x53b7d4]
call fcn.00462f9c
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x4c]
call fcn.00409388
mov eax, dword [ebp - 0x4c]
push eax
lea edx, [ebp - 0x50]
mov eax, 0x33
call fcn.004a94e4
mov edx, dword [ebp - 0x50]
mov eax, 0x53b7d0
pop ecx
call fcn.00404880
mov dl, 1
mov eax, dword [0x462da4]
call fcn.00403740
mov dword [0x5340c8], eax
mov edx, dword [0x53b7d0]
mov eax, dword [0x5340c8]
call fcn.00462e48
test eax, eax
jne 0x4f1cb7
mov eax, 0x4f2980
xor edx, edx
call fcn.004ef6f8
mov ebx, eax
test ebx, ebx
je 0x4f26ef
mov eax, dword [0x5346e4]
mov eax, dword [eax]
mov edx, 0x4f2994
call fcn.00404978
jne 0x4f1ba2
push 0
push 3
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4f26ef
mov eax, dword [0x5346e4]
mov eax, dword [eax]
mov edx, 0x4f29a4
call fcn.00404978
jne 0x4f1bc9
push 0
push 4
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4f26ef
mov eax, dword [0x5346e4]
mov eax, dword [eax]
mov edx, 0x4f29b4
call fcn.00404978
jne 0x4f1bf0
push 0
push 0
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4f26ef
mov eax, dword [0x5346e4]
mov eax, dword [eax]
mov edx, 0x4f29c0
call fcn.00404978
jne 0x4f26ef
mov edx, dword [0x534748]
mov eax, 2
call fcn.00402aa0
mov eax, dword [0x534748]
cmp dword [eax], 0
jne 0x4f1c30
mov eax, dword [0x534748]
mov edx, 0x4f297c
call fcn.004045d0
push 0
push 2
push 0x604
push ebx
call sub.user32.dll_PostMessageA
mov eax, dword [0x534748]
mov eax, dword [eax]
call fcn.00404834
mov esi, eax
lea eax, [esi + 3]
push eax
mov eax, 0x53b7cc
mov ecx, 1
mov edx, dword [0x4f111c]
call fcn.00405ec4
add esp, 4
mov eax, dword [0x534748]
call fcn.00404a84
mov edx, eax
mov eax, dword [0x53b7cc]
call fcn.00409ca8
mov edi, dword [0x53b7cc]
test esi, esi
jle 0x4f1ca3
mov eax, dword [edi]
push eax
push 2
push 0x604
push ebx
call sub.user32.dll_PostMessageA
add edi, 4
sub esi, 4
test esi, esi
jg 0x4f1c89
push 0
push 1
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4f26ef
lea edx, [ebp - 0x58]
mov eax, dword [0x534a7c]
mov eax, dword [eax]
call fcn.00409a74
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x54]
xor edx, edx
call fcn.004099ac
mov edx, dword [ebp - 0x54]
mov eax, dword [0x5349d8]
call fcn.004045d0
mov eax, dword [0x534994]
mov dword [eax], 0x20b9
lea edx, [ebp - 0x5c]
xor eax, eax
call fcn.004efe1c
mov edx, dword [ebp - 0x5c]
mov eax, dword [0x534974]
call fcn.004045d0
lea edx, [ebp - 0x60]
xor eax, eax
call fcn.004efe1c
mov edx, dword [ebp - 0x60]
mov eax, dword [0x5346d8]
call fcn.004045d0
mov eax, dword [0x53b7d4]
call fcn.00404834
push eax
mov eax, 0x53b7d4
call fcn.00404a84
pop edx
call fcn.004ef920
mov edx, dword [0x534994]
add dword [edx], eax
mov eax, 0x7fffffff
call fcn.0040307c
mov dword [0x53b7d8], eax
mov eax, 0x400
call fcn.0040307c
add eax, 0x400
mov dword [0x53b7dc], eax
mov eax, 0x2800
call fcn.0040307c
add eax, 0x2800
mov dword [0x53b7e0], eax
mov eax, 0x7fffffff
call fcn.0040307c
mov dword [0x53b7e4], eax
mov eax, 0x7d000
call fcn.0040307c
lea edx, [ebp - 0x64]
xor eax, eax
call fcn.004efe1c
mov edx, dword [ebp - 0x64]
mov eax, 0x53b7e8
mov ecx, 0x4f29cc
call fcn.00404880
call fcn.00402b00
lea edx, [ebp - 0x68]
mov eax, 4
call fcn.004a94e4
mov ecx, dword [ebp - 0x68]
mov edx, dword [0x534848]
mov edx, dword [edx]
mov eax, dword [0x534470]
call fcn.00404880
lea edx, [ebp - 0x6c]
mov eax, 3
call fcn.004a94e4
mov ecx, dword [ebp - 0x6c]
mov edx, dword [0x534848]
mov edx, dword [edx]
mov eax, dword [0x534880]
call fcn.00404880
lea edx, [ebp - 0x70]
mov eax, dword [0x534a7c]
mov eax, dword [eax]
call fcn.00408d84
mov edx, dword [ebp - 0x70]
mov eax, 0x53b7b4
call fcn.004045d0
push 0x104
mov eax, dword [0x534538]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
cmp eax, 2
jb 0x4f1e86
lea edx, [ebp - 0x74]
mov eax, dword [0x534538]
call fcn.00409ea8
mov edx, dword [ebp - 0x74]
mov eax, dword [0x5342b8]
call fcn.004045d0
mov eax, dword [0x5342b8]
mov eax, dword [eax]
call fcn.00404834
cmp eax, 3
jle 0x4f1e61
mov eax, dword [0x5342b8]
mov edx, 0x4f29dc
call fcn.0040483c
mov eax, dword [0x5342b8]
mov eax, dword [0x5342b8]
mov eax, dword [eax]
cmp byte [eax + 1], 0x3a
jne 0x4f1e8e
mov eax, dword [0x5342b8]
mov eax, dword [eax]
mov al, byte [eax]
call fcn.00402b3c
mov edx, dword [0x534528]
mov byte [edx], al
jmp 0x4f1e8e
mov eax, dword [0x534528]
mov byte [eax], 0x43
push 0x104
mov eax, dword [0x534538]
push eax
lea edx, [ebp - 0x78]
mov eax, 0x2e
call fcn.004a94e4
mov eax, dword [ebp - 0x78]
call fcn.00404a2c
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov eax, dword [0x534538]
call fcn.00409e8c
mov edx, eax
mov eax, 0x53b7b8
call fcn.0040476c
mov eax, 0x53b7b8
call fcn.0046a8b0
mov eax, dword [0x53b7b4]
cmp byte [eax], 0x5c
jne 0x4f1ee8
mov eax, dword [0x53487c]
mov byte [eax], 2
jmp 0x4f1f03
mov edx, dword [0x53b7b4]
mov eax, dword [0x53b7b8]
call fcn.00404b70
dec eax
jne 0x4f1f03
mov eax, dword [0x53487c]
mov byte [eax], 1
mov eax, dword [0x5346e4]
mov eax, dword [eax]
mov edx, 0x4f29e8
call fcn.00404978
jne 0x4f1f1e
mov eax, dword [0x534544]
mov byte [eax], 1
mov eax, dword [0x5346e4]
mov eax, dword [eax]
mov edx, 0x4f29f4
call fcn.00404978
je 0x4f1f48
mov eax, dword [0x534748]
mov eax, dword [eax]
mov edx, 0x4f29f4
call fcn.00404978
je 0x4f1f48
xor eax, eax
jmp 0x4f1f4a
mov al, 1
test al, al
je 0x4f1f76
mov eax, 0x7d0
call fcn.004d25dc
mov eax, dword [0x534470]
mov eax, dword [eax]
call fcn.0046d6bc
test al, al
je 0x4f1f8a
mov eax, dword [0x534470]
mov eax, dword [eax]
call fcn.004098f0
jmp 0x4f1f8a
mov eax, dword [0x534544]
cmp byte [eax], 1
jne 0x4f1f8a
mov eax, 0x7d0
call fcn.004d25dc
lea edx, [ebp - 0x7c]
mov eax, 0x11b
call fcn.004a94e4
mov eax, dword [ebp - 0x7c]
push eax
lea edx, [ebp - 0x80]
mov eax, 0x13
call fcn.004a94e4
mov eax, dword [ebp - 0x80]
pop edx
call fcn.0046cc88
mov eax, dword [0x534544]
cmp byte [eax], 1
jne 0x4f2151
mov eax, dword [0x53487c]
cmp byte [eax], 0
jne 0x4f2151
lea edx, [ebp - 0x88]
mov eax, 0xb
call fcn.004a94e4
mov ecx, dword [ebp - 0x88]
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0x84]
call fcn.00404880
mov eax, dword [ebp - 0x84]
call fcn.0046d6bc
test al, al
je 0x4f2151
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov dword [0x53b7c0], eax
lea edx, [ebp - 0x94]
mov eax, 0xb
call fcn.004a94e4
mov ecx, dword [ebp - 0x94]
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0x90]
call fcn.00404880
mov edx, dword [ebp - 0x90]
lea eax, [ebp - 0x8c]
call fcn.00404e38
mov eax, dword [ebp - 0x8c]
push eax
mov eax, dword [0x53b7c0]
push eax
call fcn.0046d9d4
mov eax, dword [0x53b7c0]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4f2147
mov eax, dword [0x53b7c0]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x4f2105
lea ecx, [ebp - 0x98]
mov edx, ebx
mov eax, dword [0x53b7c0]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x98]
mov eax, 0x53b7c8
call fcn.004045d0
lea edx, [ebp - 0x9c]
mov eax, 0xa
call fcn.004a94e4
mov ecx, dword [ebp - 0x9c]
mov eax, 0x53b7c4
mov edx, dword [0x53b7c8]
call fcn.00404880
push 1
mov eax, 0x53b7c8
call fcn.00404a84
push eax
mov eax, 0x53b7c4
call fcn.00404a84
push eax
call sub.kernel32.dll_MoveFileExA
test eax, eax
je 0x4f20ff
mov edx, ebx
mov eax, dword [0x53b7c0]
mov ecx, dword [eax]
call dword [ecx + 0x48]
dec ebx
cmp ebx, 0xffffffff
jne 0x4f208a
mov eax, dword [0x53b7c0]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x4f2147
lea edx, [ebp - 0xa4]
mov eax, 0xb
call fcn.004a94e4
mov ecx, dword [ebp - 0xa4]
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0xa0]
call fcn.00404880
mov eax, dword [ebp - 0xa0]
call fcn.004098f0
mov eax, dword [0x53b7c0]
call fcn.00403770
mov eax, dword [0x534654]
mov dword [eax], 0x20
lea eax, [ebp - 0xa8]
mov edx, dword [0x534a7c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0xa8]
mov edx, dword [0x534654]
mov dx, word [edx]
call fcn.0046da4c
mov edx, dword [0x534494]
mov dword [edx], eax
mov eax, dword [0x534494]
cmp dword [eax], 0
jne 0x4f21ce
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0xac]
mov edx, dword [0x534a7c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0xac]
mov edx, dword [0x534654]
mov dx, word [edx]
call fcn.0046da4c
mov edx, dword [0x534494]
mov dword [edx], eax
mov eax, dword [0x534494]
cmp dword [eax], 0
jne 0x4f2211
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0xb0]
mov edx, dword [0x534a7c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0xb0]
mov edx, dword [0x534654]
mov dx, word [edx]
call fcn.0046da4c
mov edx, dword [0x534494]
mov dword [edx], eax
mov eax, dword [0x534494]
cmp dword [eax], 0
jne 0x4f2254
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0xb4]
mov edx, dword [0x534a7c]
mov edx, dword [edx]
call fcn.00404e38
mov eax, dword [ebp - 0xb4]
mov edx, dword [0x534654]
mov dx, word [edx]
call fcn.0046da4c
mov edx, dword [0x534494]
mov dword [edx], eax
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov ebx, eax
call sub.kernel32.dll_GetCurrentProcessId
mov edx, dword [0x534180]
mov dword [edx], eax
mov eax, dword [0x534724]
mov eax, dword [eax]
call fcn.004480b4
call fcn.004a9d58
mov ecx, dword [0x534868]
mov eax, dword [0x534724]
mov eax, dword [eax]
mov edx, dword [0x4b0818]
call fcn.004480cc
mov ecx, dword [0x53467c]
mov eax, dword [0x534724]
mov eax, dword [eax]
mov edx, dword [0x4ae984]
call fcn.004480cc
mov edx, dword [0x534974]
mov edx, dword [edx]
mov eax, dword [0x534868]
mov eax, dword [eax]
call fcn.004576d8
mov ecx, dword [0x534250]
mov eax, dword [0x534724]
mov eax, dword [eax]
mov edx, dword [0x4cf8f8]
call fcn.004480cc
mov edx, dword [0x5346d8]
mov edx, dword [edx]
mov eax, dword [0x534250]
mov eax, dword [eax]
call fcn.004576d8
mov ecx, dword [0x534384]
mov eax, dword [0x534724]
mov eax, dword [eax]
mov edx, dword [0x4ac880]
call fcn.004480cc
mov eax, dword [0x534250]
mov eax, dword [eax]
mov edx, dword [0x534868]
mov edx, dword [edx]
mov dword [edx + 0x31c], eax
lea edx, [ebp - 0xbc]
mov eax, 1
call fcn.00402aa0
mov eax, dword [ebp - 0xbc]
lea edx, [ebp - 0xb8]
call fcn.00408dc0
mov eax, dword [ebp - 0xb8]
mov edx, 0x4f2964
call fcn.00404978
jne 0x4f23f3
lea edx, [ebp - 0xc0]
mov eax, 0x11a
call fcn.004a94e4
mov eax, dword [ebp - 0xc0]
mov ecx, 0x1a803549
mov edx, 0x4f2a00
call fcn.0046c7e8
lea edx, [ebp - 0xc8]
mov eax, 2
call fcn.00402aa0
mov eax, dword [ebp - 0xc8]
lea edx, [ebp - 0xc4]
call fcn.00408dc0
mov eax, dword [ebp - 0xc4]
mov edx, 0x4f2a10
call fcn.00404978
jne 0x4f23d3
lea edx, [ebp - 0xcc]
mov eax, 0x11a
call fcn.004a94e4
mov eax, dword [ebp - 0xcc]
mov ecx, 0x1a803549
mov edx, 0x4f2a1c
call fcn.0046c7e8
jmp 0x4f23f3
lea edx, [ebp - 0xd0]
mov eax, 0x11a
call fcn.004a94e4
mov eax, dword [ebp - 0xd0]
mov edx, 0x4f2a1c
call fcn.0046cc88
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov edx, dword [0x534708]
mov dword [edx], eax
mov dl, 1
mov eax, dword [0x41448c]
call fcn.00403740
mov edx, dword [0x534704]
mov dword [edx], eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0xdc]
mov eax, 5
call fcn.004a94e4
mov ecx, dword [ebp - 0xdc]
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0xd8]
call fcn.00404880
mov edx, dword [ebp - 0xd8]
lea eax, [ebp - 0xd4]
call fcn.00404e38
mov eax, dword [ebp - 0xd4]
push eax
push ebx
call fcn.0046d9d4
test al, al
je 0x4f2474
mov byte [0x53b7ec], 1
cmp byte [0x53b7ec], 0
je 0x4f25da
jmp 0x4f25c6
lea ecx, [ebp - 0xe4]
xor edx, edx
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xe4]
lea edx, [ebp - 0xe0]
call fcn.00408fd4
mov edx, dword [ebp - 0xe0]
mov eax, 0x53b7bc
call fcn.004045d0
xor edx, edx
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x48]
cmp dword [0x53b7bc], 0
je 0x4f266d
mov edx, dword [0x53b7bc]
mov eax, 0x4f2a2c
call fcn.00404b70
mov dword [esi], eax
cmp dword [esi], 0
jne 0x4f24f5
mov edx, dword [0x53b7bc]
mov eax, 0x4f2a38
call fcn.00404b70
mov dword [esi], eax
cmp dword [esi], 0
je 0x4f266d
lea eax, [ebp - 0xec]
push eax
mov ecx, dword [esi]
dec ecx
mov edx, 1
mov eax, dword [0x53b7bc]
call fcn.00404a8c
mov eax, dword [ebp - 0xec]
lea edx, [ebp - 0xe8]
call fcn.00408fd4
mov edx, dword [ebp - 0xe8]
mov eax, dword [0x534708]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0xf4]
push eax
mov edx, dword [esi]
inc edx
mov ecx, 0x400
mov eax, dword [0x53b7bc]
call fcn.00404a8c
mov eax, dword [ebp - 0xf4]
lea edx, [ebp - 0xf0]
call fcn.00408fd4
mov edx, dword [ebp - 0xf0]
mov eax, 0x53b7bc
call fcn.004045d0
mov eax, dword [0x53b7bc]
cmp byte [eax], 0x7c
jne 0x4f25ae
mov eax, 0x53b7bc
mov ecx, 1
mov edx, 1
call fcn.00404acc
mov eax, dword [0x53b7bc]
call fcn.004093f8
mov edx, eax
neg edx
mov eax, dword [0x534704]
mov eax, dword [eax]
call fcn.00416c4c
jmp 0x4f25c6
mov eax, dword [0x53b7bc]
call fcn.004093f8
mov edx, eax
mov eax, dword [0x534704]
mov eax, dword [eax]
call fcn.00416c4c
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jg 0x4f2486
jmp 0x4f266d
mov eax, dword [0x53b7e0]
push eax
mov eax, dword [0x53b7e4]
push eax
mov eax, dword [0x5342b8]
push dword [eax]
push 0x4f2a44
push dword [0x53b7e8]
lea eax, [ebp - 0xf8]
mov edx, 3
call fcn.004048f4
mov eax, dword [ebp - 0xf8]
push eax
mov ecx, dword [0x53b7dc]
mov edx, dword [0x53b7d8]
mov eax, ebx
call fcn.004f1038
test al, al
jne 0x4f25c6
mov eax, dword [0x53b7e0]
push eax
mov eax, dword [0x53b7e4]
push eax
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0xfc]
mov ecx, dword [0x53b7e8]
call fcn.00404880
mov eax, dword [ebp - 0xfc]
push eax
mov ecx, dword [0x53b7dc]
mov edx, dword [0x53b7d8]
mov eax, ebx
call fcn.004f1038
test al, al
jne 0x4f25c6
mov eax, ebx
call fcn.00403770
mov eax, dword [0x534708]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x4f26a6
mov eax, dword [0x534708]
mov eax, dword [eax]
mov edx, 0x4f2a58
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x534704]
mov eax, dword [eax]
mov edx, 0x20b9
call fcn.00416c4c
mov eax, dword [0x534708]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jle 0x4f26d0
mov eax, dword [0x534708]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
call fcn.0040307c
mov edx, dword [0x5342ec]
mov dword [edx], eax
jmp 0x4f26d9
mov eax, dword [0x5342ec]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x534724]
mov eax, dword [eax]
call fcn.0044814c
mov eax, dword [0x534494]
call fcn.0040e218
mov eax, 0x5340c8
call fcn.0040e218
mov eax, dword [0x5342d8]
cmp byte [eax], 0
je 0x4f2739
push 1
push 0x4f2a6c
push 0x4f2a6c
lea edx, [ebp - 0x100]
mov eax, dword [0x534724]
mov eax, dword [eax]
call fcn.00448738
mov eax, dword [ebp - 0x100]
call fcn.00404a2c
push eax
push 0x4f2a70
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x5341f4]
cmp byte [eax], 0
je 0x4f2881
mov dl, 1
mov eax, dword [0x414af0]
call fcn.00403740
mov ebx, eax
lea edx, [ebp - 0x10c]
mov eax, 5
call fcn.004a94e4
mov ecx, dword [ebp - 0x10c]
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0x108]
call fcn.00404880
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x104]
call fcn.00404e38
mov eax, dword [ebp - 0x104]
push eax
push ebx
call fcn.0046d9d4
test al, al
jne 0x4f287a
mov eax, dword [0x53b7e0]
push eax
mov eax, dword [0x53b7e4]
push eax
mov eax, dword [0x5342b8]
push dword [eax]
push 0x4f2a44
push dword [0x53b7e8]
lea eax, [ebp - 0x110]
mov edx, 3
call fcn.004048f4
mov eax, dword [ebp - 0x110]
push eax
mov ecx, dword [0x53b7dc]
mov edx, dword [0x53b7d8]
mov eax, ebx
call fcn.004f1038
test al, al
jne 0x4f2833
mov eax, dword [0x53b7e0]
push eax
mov eax, dword [0x53b7e4]
push eax
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0x114]
mov ecx, dword [0x53b7e8]
call fcn.00404880
mov eax, dword [ebp - 0x114]
push eax
mov ecx, dword [0x53b7dc]
mov edx, dword [0x53b7d8]
mov eax, ebx
call fcn.004f1038
test al, al
je 0x4f287a
lea edx, [ebp - 0x120]
mov eax, 5
call fcn.004a94e4
mov ecx, dword [ebp - 0x120]
mov edx, dword [0x534848]
mov edx, dword [edx]
lea eax, [ebp - 0x11c]
call fcn.00404880
mov edx, dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
call fcn.00404e38
mov eax, dword [ebp - 0x118]
push eax
push ebx
call fcn.0046d968
mov eax, ebx
call fcn.00403770
push 0x1341606
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f2945
lea eax, [ebp - 0x120]
mov edx, 2
call fcn.004045a0
lea eax, [ebp - 0x118]
call fcn.00404c98
lea eax, [ebp - 0x114]
mov edx, 4
call fcn.004045a0
lea eax, [ebp - 0x104]
call fcn.00404c98
lea eax, [ebp - 0x100]
mov edx, 0xb
call fcn.004045a0
lea eax, [ebp - 0xd4]
call fcn.00404c98
lea eax, [ebp - 0xd0]
mov edx, 7
call fcn.004045a0
lea eax, [ebp - 0xb4]
mov edx, 4
call fcn.00404cb0
lea eax, [ebp - 0xa4]
mov edx, 6
call fcn.004045a0
lea eax, [ebp - 0x8c]
call fcn.00404c98
lea eax, [ebp - 0x88]
mov edx, 0x1e
call fcn.004045a0
ret