Function at 0x4014d0
Capabilities:
Encode data using xor
Parse pe header
Read file on windows

Disassembly:
push ebp
mov eax, 0x3c0c
lea ebp, [esp - 0x68]
call fcn.00403050
push ebx
push edi
jmp 0x4014f1
push section..text
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x10
xor ebx, ebx
push ebx
push 0x40fd40
mov dword [0x40fd50], eax
call fcn.00402e20
add esp, 0xc
cmp dword [0x40fd8c], ebx
jne 0x401525
push 0x29a
jmp 0x402495
mov word [ebp - 0x1ba0], bx
xor eax, eax
mov ecx, 0x3ff
lea edi, [ebp - 0x1b9e]
rep stosd dword es:[edi], eax
push esi
mov esi, 0x40aad8
push esi
stosw word es:[edi], ax
call fcn.004029d0
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
mov dword [ebp + 0x34], eax
jne 0x401586
push esi
call fcn.004029d0
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [ebp + 0x34], eax
jne 0x401586
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0x1b58
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
jmp 0x40249c
push 0x2004
lea eax, [ebp - 0x3ba4]
push ebx
push eax
call fcn.00402e20
add esp, 0xc
push 0x2002
lea eax, [ebp - 0x3ba4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x4015c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0x2710
jmp 0x40157a
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
push 0x10000000
push 3
push ebx
push 1
push 0x80000000
nop
mov eax, str.dirt2o.exe
push eax
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x401618
push ebx
push 0x10000000
push 3
push ebx
push ebx
push 0x80000000
lea eax, [ebp - 0x3ba4]
push eax
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x401618
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0x2af8
jmp 0x40157a
push 0x40
lea eax, [ebp - 0x34]
push ebx
push eax
call fcn.00402e20
add esp, 0xc
push ebx
lea eax, [ebp + 0x58]
push eax
push 0x40
lea eax, [ebp - 0x34]
push eax
push edi
mov dword [ebp + 0x58], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x401659
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x32c8
jmp 0x40157a
cmp dword [ebp + 0x58], 0x40
je 0x401670
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x2ee0
jmp 0x402495
cmp word [ebp - 0x34], 0x5a4d
je 0x401689
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x36b0
jmp 0x402495
cmp dword [ebp + 8], ebx
jne 0x40169f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3a98
jmp 0x402495
push ebx
push ebx
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, dword [ebp + 8]
je 0x4016c1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3e80
jmp 0x402495
mov esi, 0xf8
push esi
lea eax, [ebp - 0x214]
push ebx
push eax
call fcn.00402e20
add esp, 0xc
push ebx
lea eax, [ebp + 0x58]
push eax
push esi
lea eax, [ebp - 0x214]
push eax
push edi
mov dword [ebp + 0x58], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40170b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4268
jmp 0x40157a
cmp dword [ebp + 0x58], esi
je 0x401721
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4650
jmp 0x402495
cmp dword [ebp - 0x214], 0x4550
je 0x40173e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4a38
jmp 0x402495
cmp word [ebp - 0x1fc], 0x10b
je 0x40175a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4e20
jmp 0x402495
cmp word [ebp - 0x20e], bx
jne 0x401774
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x5208
jmp 0x402495
mov eax, dword [ebp + 8]
cdq
mov ecx, 0x1000
idiv ecx
push 4
push 0x101000
inc eax
shl eax, 0xc
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
cmp esi, ebx
jne 0x4017b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x59d8
jmp 0x40157a
push ebx
push ebx
push ebx
push edi
mov dword [ebp + 0x58], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp + 0x58]
push eax
push dword [ebp + 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x401802
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x8000
push ebx
push esi
mov dword [ebp + 0x78], eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x5dc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 0x78]
jmp 0x40249c
mov eax, dword [ebp + 0x58]
cmp eax, dword [ebp + 8]
push edi
je 0x401828
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x8000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x61a8
jmp 0x402495
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
movzx edi, word [esi + eax - 6]
lea ecx, [edi + esi]
mov dword [ebp + 0x5c], ecx
lea ecx, [edi + 2]
add eax, 0xfffffffa
cmp ecx, eax
mov dword [ebp + 0x60], ecx
mov dword [ebp + 0x28], eax
jae 0x401881
mov eax, dword [ebp + 0x60]
xor edx, edx
push 7
pop ecx
div ecx
mov eax, dword [ebp + 0x5c]
movzx eax, word [eax]
mov ecx, edx
mov edx, dword [ebp + 0x60]
shl ax, cl
mov ecx, dword [ebp + 0x60]
and ecx, 3
shl edx, cl
add eax, edx
mov ecx, eax
mov eax, dword [ebp + 0x60]
xor word [eax + esi], cx
inc eax
inc eax
cmp eax, dword [ebp + 0x28]
mov dword [ebp + 0x60], eax
jb 0x40184c
push 0x6c0
lea eax, [ebp - 0x8d4]
push ebx
push eax
call fcn.00402e20
push esi
push edi
push dword [ebp + 0x5c]
push 0x5652
call fcn.004012d1
mov eax, dword [eax]
push esi
push edi
push dword [ebp + 0x5c]
xor eax, 0x5fe92ae6
push 0x5043
mov dword [ebp - 0x86c], eax
call fcn.004012d1
push esi
push edi
push dword [ebp + 0x5c]
mov dword [ebp + 0x38], eax
push 0x4441
call fcn.004012d1
mov edi, eax
mov eax, 0x10008
mov dword [ebp - 0x868], eax
mov dword [ebp - 0x8d4], eax
mov eax, dword [edi + 0x28]
push 0x30
push dword [ebp + 0x38]
mov dword [ebp - 0x870], eax
lea eax, [ebp - 0x864]
push eax
call fcn.00402a50
add esp, 0x48
push edi
call fcn.00401330
push 0x64
lea eax, [ebp - 0x8d4]
push 0x40fd88
push eax
call fcn.00402a50
add esp, 0x10
push 0x20a
lea eax, [ebp - 0x62c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x8000
push ebx
push esi
call edi
push ebx
push 2
push dword [0x40fdc4]
push dword [0x40fd8c]
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, eax
cmp esi, ebx
mov dword [ebp + 0x10], esi
je 0x402490
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, ebx
mov dword [ebp + 0x40], eax
je 0x402490
add eax, eax
push eax
lea eax, [ebp - 0x420]
push esi
push eax
call fcn.00402a50
add esp, 0xc
push ebx
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x24]
push eax
push ebx
push 2
push 0x400
nop
mov eax, str.dirt2o.exe
push eax
push 1
mov dword [ebp + 0x44], ebx
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x64], ebx
mov dword [ebp + 0x30], ebx
call dword [sym.imp.CRYPT32.dll_CryptQueryObject]
test eax, eax
jne 0x4019d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0x6590
jmp 0x40157a
lea eax, [ebp + 0x3c]
push eax
push ebx
push ebx
push 6
push dword [ebp + 0x4c]
call dword [sym.imp.CRYPT32.dll_CryptMsgGetParam]
test eax, eax
jne 0x4019fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0x6978
jmp 0x40157a
mov eax, dword [ebp + 0x3c]
cmp eax, ebx
jne 0x401a0b
push 0x6d60
jmp 0x402495
shr eax, 0xc
push 4
inc eax
push 0x101000
shl eax, 0xc
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
cmp esi, ebx
jne 0x401a39
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0x7148
jmp 0x40157a
lea eax, [ebp + 0x3c]
push eax
push esi
push ebx
push 6
push dword [ebp + 0x4c]
call dword [sym.imp.CRYPT32.dll_CryptMsgGetParam]
test eax, eax
jne 0x401a67
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x8000
push ebx
push esi
call edi
push 0x7530
jmp 0x402495
mov eax, dword [esi + 4]
mov dword [ebp - 0x8c], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x88], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0xa0], eax
mov eax, dword [esi + 0x10]
push ebx
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0xa4]
push eax
push 0xb0000
push ebx
push 0x10001
push dword [ebp + 0x44]
call dword [sym.imp.CRYPT32.dll_CertFindCertificateInStore]
push 0x200
lea ecx, [ebp - 0x82c]
push ecx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.CRYPT32.dll_CertGetNameStringA]
test eax, eax
jne 0x401ade
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x8000
push ebx
push esi
mov dword [ebp + 0x78], eax
call edi
push 0x7918
jmp 0x4017f4
cmp dword [esi + 0x3c], ebx
mov dword [ebp + 0x48], ebx
jbe 0x401c32
mov dword [ebp + 0x60], ebx
mov eax, dword [esi + 0x40]
mov ecx, dword [ebp + 0x60]
push str.1.2.840.113549.1.9.6
push dword [ecx + eax]
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x401c0f
mov eax, dword [esi + 0x40]
mov ecx, dword [ebp + 0x60]
mov eax, dword [ecx + eax + 8]
lea ecx, [ebp + 0x54]
push ecx
push ebx
push ebx
push dword [eax]
push dword [eax + 4]
push 0x1f4
push 0x10001
call dword [sym.imp.CRYPT32.dll_CryptDecodeObject]
test eax, eax
je 0x401c94
mov eax, dword [ebp + 0x54]
shr eax, 0xc
push 4
inc eax
push 0x101000
shl eax, 0xc
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp eax, ebx
mov dword [ebp + 0x64], eax
je 0x401cb0
mov eax, dword [esi + 0x40]
mov ecx, dword [ebp + 0x60]
mov eax, dword [ecx + eax + 8]
lea ecx, [ebp + 0x54]
push ecx
push dword [ebp + 0x64]
push ebx
push dword [eax]
push dword [eax + 4]
push 0x1f4
push 0x10001
call dword [sym.imp.CRYPT32.dll_CryptDecodeObject]
test eax, eax
je 0x401ccc
mov eax, dword [ebp + 0x64]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x8c], ecx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x88], ecx
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xa0], ecx
mov eax, dword [eax + 0x10]
push ebx
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0xa4]
push eax
push 0xb0000
push ebx
push 0x10001
push dword [ebp + 0x44]
call dword [sym.imp.CRYPT32.dll_CertFindCertificateInStore]
test eax, eax
je 0x401cf3
mov eax, dword [ebp + 0x64]
cmp dword [eax + 0x34], ebx
mov dword [ebp + 0x5c], ebx
jbe 0x401c0f
mov dword [ebp + 0x50], ebx
mov eax, dword [ebp + 0x64]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp + 0x50]
push dword [ecx + eax]
push str.1.2.840.113549.1.9.5
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x401c4e
inc dword [ebp + 0x5c]
mov eax, dword [ebp + 0x64]
mov ecx, dword [ebp + 0x5c]
add dword [ebp + 0x50], 0xc
cmp ecx, dword [eax + 0x34]
jb 0x401be2
inc dword [ebp + 0x48]
mov eax, dword [ebp + 0x48]
add dword [ebp + 0x60], 0xc
cmp eax, dword [esi + 0x3c]
jb 0x401aed
cmp dword [ebp + 0x64], ebx
je 0x401c32
push 0x8000
push ebx
push dword [ebp + 0x64]
call edi
push 0x8000
push ebx
push esi
call edi
cmp dword [ebp + 0x30], ebx
jne 0x401d41
push 0x9088
jmp 0x402495
mov eax, dword [ebp + 0x5c]
mov ecx, dword [ebp + 0x64]
mov dword [ebp + 0x54], 8
mov ecx, dword [ecx + 0x38]
lea eax, [eax + eax*2]
mov eax, dword [ecx + eax*4 + 8]
lea ecx, [ebp + 0x54]
push ecx
lea ecx, [ebp + 0x18]
push ecx
push ebx
push dword [eax]
push dword [eax + 4]
push str.1.2.840.113549.1.9.5
push 0x10001
call dword [sym.imp.CRYPT32.dll_CryptDecodeObject]
test eax, eax
je 0x401d1a
mov dword [ebp + 0x30], 1
jmp 0x401c22
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x8000
push ebx
push esi
mov dword [ebp + 0x78], eax
call edi
push 0x7d00
jmp 0x4017f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x8000
push ebx
push esi
mov dword [ebp + 0x78], eax
call edi
push 0x80e8
jmp 0x4017f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x8000
push ebx
push dword [ebp + 0x64]
mov dword [ebp + 0x78], eax
call edi
push 0x8000
push ebx
push esi
call edi
push 0x84d0
jmp 0x4017f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x8000
push ebx
push dword [ebp + 0x64]
mov dword [ebp + 0x78], eax
call edi
push 0x8000
push ebx
push esi
call edi
push 0x88b8
jmp 0x4017f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x8000
push ebx
push dword [ebp + 0x64]
mov dword [ebp + 0x78], eax
call edi
push 0x8000
push ebx
push esi
call edi
push 0x8ca0
jmp 0x4017f4
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x834], eax
mov eax, dword [ebp + 0x1c]
push 0x40aa94
mov dword [ebp - 0x830], eax
mov dword [ebp - 0x8c8], 1
call fcn.004029d0
mov edi, dword [ebp + 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop ecx
push eax
push edi
call esi
push 0x40aa80
mov dword [ebp + 0x14], eax
call fcn.004029d0
pop ecx
push eax
push edi
call esi
push 0x40aa68
mov dword [ebp + 0x48], eax
call fcn.004029d0
pop ecx
push eax
push edi
call esi
push 0x40aa54
mov dword [ebp + 0x38], eax
call fcn.004029d0
pop ecx
push eax
push edi
call esi
push 0x40aa3c
mov dword [ebp + 0x34], eax
call fcn.004029d0
pop ecx
push eax
push edi
call esi
push 0x40aa28
mov dword [ebp + 0x28], eax
call fcn.004029d0
pop ecx
push eax
push edi
call esi
push 0x40aa18
mov dword [ebp + 0xc], eax
call fcn.004029d0
pop ecx
push eax
push edi
call esi
push 0x40aa04
mov dword [ebp + 0x50], eax
call fcn.004029d0
pop ecx
push eax
push edi
call esi
push 0x40a9e8
mov dword [ebp + 0x30], eax
call fcn.004029d0
pop ecx
push eax
push edi
call esi
cmp dword [ebp + 0x14], ebx
mov edi, eax
je 0x402489
cmp dword [ebp + 0x48], ebx
je 0x402489
cmp dword [ebp + 0x38], ebx
je 0x402489
cmp dword [ebp + 0x34], ebx
je 0x402489
cmp dword [ebp + 0x28], ebx
je 0x402489
cmp dword [ebp + 0xc], ebx
je 0x402489
cmp dword [ebp + 0x50], ebx
je 0x402489
cmp dword [ebp + 0x30], ebx
je 0x402489
cmp edi, ebx
je 0x402489
push ebx
push 1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x40fe00
push 4
push ebx
push 0x40148e
push ebx
push ebx
mov dword [0x40fe08], eax
call dword [ebp + 0x34]
cmp eax, ebx
mov dword [0x40fe04], eax
jne 0x401e94
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0x1388
jmp 0x40157a
push 1
push 0x6c0
lea eax, [ebp - 0x8d4]
push eax
push dword [ebp + 0x10]
call fcn.004024a2
add esp, 0x10
test eax, eax
jne 0x401ebd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
jmp 0x40249c
xor esi, esi
lea eax, [ebp - 0x11c]
inc esi
push eax
mov dword [0x40fdfc], esi
call dword [ebp + 0x30]
lea eax, [ebp - 0x1ba0]
push eax
push 0x7fe
call edi
mov edi, dword [ebp + 0x78]
push edi
call fcn.00402d90
pop ecx
mov ecx, dword [ebp + 0x40]
add eax, eax
shr eax, 0xc
push 4
shl eax, 0xc
push 0x101000
lea eax, [eax + ecx + 0x1006]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp eax, ebx
mov dword [ebp + 0x64], eax
mov dword [ebp + 0x5c], esi
jne 0x401f24
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp + 0x64], eax
mov dword [ebp + 0x5c], ebx
jmp 0x402245
mov eax, dword [ebp + 0x40]
mov esi, dword [ebp + 0x64]
add eax, eax
push eax
push dword [ebp + 0x10]
lea eax, [esi + 2]
push eax
mov word [esi], 0x22
call fcn.00402a50
mov ecx, dword [ebp + 0x40]
add esp, 0xc
inc ecx
lea eax, [esi + ecx*2]
inc ecx
mov word [eax], 0x22
mov word [eax + 2], 0x20
inc ecx
xor esi, esi
cmp byte [edi], 0x20
jne 0x401f6a
mov al, 0x20
cmp al, bl
je 0x401f6a
inc esi
mov al, byte [esi + edi]
cmp al, 0x20
je 0x401f5e
cmp byte [esi + edi], bl
je 0x402245
mov eax, dword [ebp + 0x64]
lea eax, [eax + ecx*2]
mov dword [ebp + 0x40], eax
cmp byte [esi + edi], 0x2f
jne 0x402206
lea eax, [esi + edi]
push eax
call fcn.00402d90
cmp eax, 0x13
pop ecx
mov dword [ebp + 0x60], eax
jbe 0x401fcd
mov al, byte [esi + edi + 0x14]
push 0x40a9cc
mov byte [ebp + 0x7b], al
mov byte [esi + edi + 0x14], bl
call fcn.004029d0
push eax
lea eax, [esi + edi]
push eax
call fcn.004095be
add esp, 0xc
test eax, eax
mov al, byte [ebp + 0x7b]
mov byte [esi + edi + 0x14], al
jne 0x401fcd
add esi, 0x14
jmp 0x402235
cmp dword [ebp + 0x60], 0x10
jbe 0x402008
mov al, byte [esi + edi + 0x11]
push 0x40a9b4
mov byte [ebp + 0x7b], al
mov byte [esi + edi + 0x11], bl
call fcn.004029d0
push eax
lea eax, [esi + edi]
push eax
call fcn.004095be
add esp, 0xc
test eax, eax
mov al, byte [ebp + 0x7b]
mov byte [esi + edi + 0x11], al
jne 0x402008
add esi, 0x11
jmp 0x402235
cmp dword [ebp + 0x60], 0xd
jbe 0x40205e
mov al, byte [esi + edi + 0xe]
push 0x40a9a0
mov byte [ebp + 0x7b], al
mov byte [esi + edi + 0xe], bl
call fcn.004029d0
push eax
lea eax, [esi + edi]
push eax
call fcn.004095be
add esp, 0xc
test eax, eax
je 0x4020e7
push 0x40a98c
call fcn.004029d0
push eax
lea eax, [esi + edi]
push eax
call fcn.004095be
add esp, 0xc
test eax, eax
je 0x4020e7
mov al, byte [ebp + 0x7b]
mov byte [esi + edi + 0xe], al
cmp dword [ebp + 0x60], 0xa
jbe 0x4020ac
mov al, byte [esi + edi + 0xb]
push 0x40a97c
mov byte [ebp + 0x7b], al
mov byte [esi + edi + 0xb], bl
call fcn.004029d0
push eax
lea eax, [esi + edi]
push eax
call fcn.004095be
add esp, 0xc
test eax, eax
je 0x4020f6
push 0x40a96c
call fcn.004029d0
push eax
lea eax, [esi + edi]
push eax
call fcn.004095be
add esp, 0xc
test eax, eax
je 0x4020f6
mov al, byte [ebp + 0x7b]
mov byte [esi + edi + 0xb], al
cmp dword [ebp + 0x60], 9
jbe 0x402105
mov al, byte [esi + edi + 0xa]
push 0x40a95c
mov byte [ebp + 0x7b], al
mov byte [esi + edi + 0xa], bl
call fcn.004029d0
push eax
lea eax, [esi + edi]
push eax
call fcn.004095be
add esp, 0xc
test eax, eax
mov al, byte [ebp + 0x7b]
mov byte [esi + edi + 0xa], al
jne 0x402105
add esi, 0xa
jmp 0x402235
mov al, byte [ebp + 0x7b]
mov byte [esi + edi + 0xe], al
add esi, 0xe
jmp 0x402235
mov al, byte [ebp + 0x7b]
mov byte [esi + edi + 0xb], al
add esi, 0xb
jmp 0x402235
cmp dword [ebp + 0x60], 7
jbe 0x40219d
mov al, byte [esi + edi + 8]
push 0x40a94c
mov byte [ebp + 0x7b], al
mov byte [esi + edi + 8], bl
call fcn.004029d0
push eax
lea eax, [esi + edi]
push eax
call fcn.004095be
add esp, 0xc
test eax, eax
je 0x402218
push 0x40a93c
call fcn.004029d0
push eax
lea eax, [esi + edi]
push eax
call fcn.004095be
add esp, 0xc
test eax, eax
je 0x402218
push 0x40a92c
call fcn.004029d0
push eax
lea eax, [esi + edi]
push eax
call fcn.004095be
add esp, 0xc
test eax, eax
je 0x402218
push 0x40a91c
call fcn.004029d0
push eax
lea eax, [esi + edi]
push eax
call fcn.004095be
add esp, 0xc
test eax, eax
je 0x402218
mov al, byte [ebp + 0x7b]
mov byte [esi + edi + 8], al
cmp dword [ebp + 0x60], 6
jbe 0x402206
mov al, byte [esi + edi + 7]
push 0x40a910
mov byte [ebp + 0x7b], al
mov byte [esi + edi + 7], bl
call fcn.004029d0
push eax
lea eax, [esi + edi]
push eax
call fcn.004095be
add esp, 0xc
test eax, eax
je 0x402224
push 0x40a904
call fcn.004029d0
push eax
lea eax, [esi + edi]
push eax
call fcn.004095be
add esp, 0xc
test eax, eax
je 0x402224
push 0x40a8f8
call fcn.004029d0
push eax
lea eax, [esi + edi]
push eax
call fcn.004095be
add esp, 0xc
test eax, eax
je 0x402224
mov al, byte [ebp + 0x7b]
mov byte [esi + edi + 8], al
movsx ax, byte [esi + edi]
mov ecx, dword [ebp + 0x40]
add dword [ebp + 0x40], 2
mov word [ecx], ax
inc esi
jmp 0x40223c
mov al, byte [ebp + 0x7b]
mov byte [esi + edi + 8], al
add esi, 8
jmp 0x402235
mov al, byte [ebp + 0x7b]
mov byte [esi + edi + 7], al
add esi, 7
jmp 0x402235
cmp al, bl
je 0x40223c
inc esi
mov al, byte [esi + edi]
cmp al, 0x20
je 0x402230
cmp byte [esi + edi], bl
jne 0x401f7c
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40227d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp + 0x5c], ebx
mov esi, eax
je 0x402273
push 0x8000
push ebx
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x7d1
jmp 0x40157a
test al, 0x10
je 0x40229f
cmp dword [ebp + 0x5c], ebx
je 0x402295
push 0x8000
push ebx
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x7d2
jmp 0x402495
push 0x40fd40
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x1ba0]
push eax
push ebx
push 0x204
xor edi, edi
inc edi
push edi
push ebx
push ebx
push dword [ebp + 0x64]
push ebx
call dword [ebp + 0xc]
test eax, eax
jne 0x4022ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp + 0x5c], ebx
mov esi, eax
je 0x4022e5
push 0x8000
push ebx
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x7d0
jmp 0x40157a
cmp dword [ebp + 0x5c], ebx
je 0x402303
push 0x8000
push ebx
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x6c0
lea eax, [ebp - 0x8d4]
push ebx
push eax
call fcn.00402e20
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
add esp, 0xc
push dword [0x40fd40]
push edi
push dword [0x40fdc4]
push dword [0x40fd8c]
call esi
cmp eax, 0x64
je 0x402348
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1f40
jmp 0x402495
mov eax, dword [0x40fd48]
xor eax, 0x19ea3fd3
push eax
push 0x40a8ec
call fcn.004029d0
pop ecx
push eax
lea eax, [ebp - 0xd8]
push eax
call fcn.004029f6
add esp, 0xc
lea eax, [ebp - 0xd8]
push eax
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push dword [0x40fd44]
mov dword [0x40fe0c], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [0x40fd48]
push 3
push dword [0x40fdc4]
push dword [0x40fd8c]
call esi
cmp eax, 0x64
je 0x4023b4
push 0x1f41
jmp 0x402495
push dword [0x40fe04]
call dword [ebp + 0x48]
cmp eax, 0xffffffff
jne 0x4023d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0xbb8
jmp 0x40157a
push dword [0x40fd44]
call dword [ebp + 0x14]
cmp eax, 0xffffffff
je 0x40242a
push 0x2cc
lea eax, [ebp - 0xba0]
push ebx
push eax
mov dword [0x40fdec], edi
call fcn.00402e20
add esp, 0xc
lea eax, [ebp - 0xba0]
push eax
push dword [0x40fd44]
mov dword [ebp - 0xba0], 0x10007
call dword [ebp + 0x28]
test eax, eax
je 0x402421
mov dword [0x40fdf0], edi
push dword [0x40fd44]
call dword [ebp + 0x48]
push 0xffffffffffffffff
push dword [0x40fd40]
call dword [ebp + 0x38]
push dword [0x40fe04]
call dword [ebp + 0x50]
push dword [0x40fd40]
call dword [ebp + 0x50]
push dword [0x40fd44]
call dword [ebp + 0x50]
mov eax, dword [0x40fe0c]
cmp eax, ebx
pop esi
je 0x402461
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0040289e
test eax, eax
jne 0x402475
mov eax, edi
pop edi
pop ebx
add ebp, 0x68
leave
ret 0x10
jmp 0x402485
xor eax, eax
jmp 0x40246c
push 0x3e8
jmp 0x402495
push 0x2328
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
call fcn.0040138b
int3