Function at 0x41da40
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x24e4
call fcn.00437090
mov eax, dword [0x4770bf0]
push ebx
xor ebx, ebx
push ebp
push esi
cmp eax, ebx
push edi
mov ebp, 0xa
je 0x41dad9
mov eax, dword [0x32f9204]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0xc8c8
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [0x476ad4c]
mov ecx, dword [0x476ad44]
mov edx, eax
sub edx, ecx
push edx
mov edx, dword [0x476ad48]
push edx
push ecx
mov ecx, dword [0x476ad50]
lea edx, [esp + 0x4c]
push ecx
push eax
push str.___d_______d_____d_____d_____d
push edx
call fcn.00436cce
lea edi, [esp + 0x5c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x1c
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x40]
push ecx
push eax
push 0xb4
push ebp
push esi
call dword [sym.imp.GDI32.dll_TextOutA]
mov ecx, dword [0x32f9204]
push esi
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [0x4769750]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp eax, ebx
je 0x41db1c
mov eax, dword [0x4770bf4]
inc eax
cmp eax, 0x190
mov dword [0x4770bf4], eax
jle 0x41db1c
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push ebx
push 1
push 0x45
push 0x7e
call esi
push 0x32
call edi
push ebx
push 3
push 0x45
push 0x7e
call esi
mov dword [0x4770bf4], ebx
mov eax, dword [0x476ad68]
cmp eax, ebx
je 0x41db3c
inc eax
cmp eax, 0x14
mov dword [0x476ad68], eax
jle 0x41db3c
mov dword [0x476ad68], ebx
mov dword [0x476ad64], ebx
cmp dword [0x476aed4], ebx
je 0x41db65
xor esi, esi
cmp dword [0x476aea4], ebx
je 0x41db5a
push 0x64
call edi
inc esi
cmp esi, 0x32
jl 0x41db46
jmp 0x41db5f
call fcn.00406b60
mov dword [0x476aed4], ebx
cmp dword [0x476aed8], ebx
je 0x41db8e
xor esi, esi
cmp dword [0x476aea8], ebx
je 0x41db83
push 0x64
call edi
inc esi
cmp esi, 0x32
jl 0x41db6f
jmp 0x41db88
call fcn.00406c00
mov dword [0x476aed8], ebx
mov eax, dword [0x476bbd4]
mov esi, 2
cmp eax, 1
jne 0x41dba8
mov dword [0x476bbd4], esi
call fcn.0040c2f0
mov ecx, dword [0x476bbd0]
mov eax, 1
cmp ecx, eax
mov edi, 4
jne 0x41dffd
mov ecx, dword [0x47bd84]
mov dword [0x476bbd0], esi
cmp ecx, ebx
je 0x41dcd7
cmp dword [0x476bbd8], ebx
jne 0x41dcd7
cmp dword [0x476aeb8], ebx
je 0x41dcd7
mov dword [0x476bbd8], eax
mov dword [0x1f821c0], eax
mov eax, dword [0x47bd7c]
mov dword [0x476bbdc], ebx
cmp eax, ebx
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov word [esp + 0x72], bx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x50], ebp
mov dword [esp + 0x54], 0x173
mov dword [esp + 0x6c], edi
mov word [esp + 0x70], bp
jl 0x41dc5d
mov ecx, dword [0x47bd80]
cmp ecx, ebx
jl 0x41dc5d
mov edx, dword [0x19cda54]
add edx, 0xffffff60
cmp eax, edx
jg 0x41dc5d
mov eax, dword [0x19cda58]
add eax, 0xffffff88
cmp ecx, eax
jle 0x41dc69
mov dword [0x47bd7c], ebx
mov dword [0x47bd80], ebx
push 0x483bdc
push 0x495568
lea ecx, [esp + 0x574]
push 0x48299c
push ecx
call fcn.00436cce
mov edx, dword [0x47bd80]
mov eax, dword [0x47bd7c]
push edx
push eax
push 0x483bdc
push 0x495568
lea ecx, [esp + 0x18c]
push str.__s_s___d__d_TIMER
push ecx
call fcn.00436cce
add esp, 0x28
lea edx, [esp + 0x10]
lea eax, [esp + 0x40]
lea ecx, [esp + 0x16c]
push edx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x58c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [0x476bbdc]
cmp eax, 1
je 0x41dce5
cmp eax, esi
jne 0x41dcfb
cmp dword [0x476bbd8], ebx
jne 0x41dcfb
cmp dword [0x476aeb8], ebx
je 0x41dcfb
mov dword [0x476bbd8], edi
mov al, byte [0x47bd99]
test al, al
je 0x41dd11
cmp dword [0x476aea4], ebx
jne 0x41dd11
call fcn.00406b60
mov al, byte [0x47bda1]
test al, al
je 0x41dd27
cmp dword [0x476aea8], ebx
jne 0x41dd27
call fcn.00406c00
mov eax, dword [0x47bd88]
mov esi, dword [sym.imp.USER32.dll_CreateDialogParamA]
mov edi, dword [sym.imp.USER32.dll_GetWindowRect]
mov ebp, dword [sym.imp.USER32.dll_MoveWindow]
cmp eax, ebx
je 0x41de21
cmp dword [0x47697b8], ebx
jne 0x41de21
mov eax, dword [0x4769704]
push ebx
cmp eax, ebx
push fcn.00423460
jne 0x41dd75
mov eax, dword [0x32f9204]
mov ecx, dword [0x3ee1684]
push eax
push 0x483bb8
push ecx
jmp 0x41dd87
mov edx, dword [0x32f9204]
mov eax, dword [0x3ee1684]
push edx
push 0x483ba4
push eax
call esi
mov ecx, dword [0x32f9204]
push 8
push pe_nt_image_headers32
push ecx
mov dword [0x47697b8], eax
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov eax, dword [0x47697b8]
lea edx, [esp + 0x10]
push edx
push eax
call edi
mov eax, dword [0x47bd6c]
cmp eax, ebx
jl 0x41dde3
mov ecx, dword [0x47bd70]
cmp ecx, ebx
jl 0x41dde3
mov edx, dword [0x19cda54]
add edx, 0xffffffe2
cmp eax, edx
jg 0x41dde3
mov edx, dword [0x19cda58]
add edx, 0xffffffe2
cmp ecx, edx
jle 0x41ddf5
mov eax, 0xa
mov ecx, eax
mov dword [0x47bd6c], eax
mov dword [0x47bd70], ecx
mov edx, dword [esp + 0x1c]
push ebx
sub edx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x20]
sub edx, dword [esp + 0x18]
push edx
push ecx
push eax
mov eax, dword [0x47697b8]
push eax
call ebp
mov ecx, dword [0x47697b8]
push ebx
push ebx
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
cmp dword [0x47bd8c], ebx
je 0x41dfef
cmp dword [0x476bb40], ebx
jne 0x41dfef
mov eax, dword [0x4769770]
cmp eax, ebx
mov eax, dword [0x47697e4]
je 0x41de8c
cmp eax, 0x100
jne 0x41de8c
mov eax, dword [0x4769704]
push ebx
cmp eax, ebx
push fcn.00420370
jne 0x41de74
mov edx, dword [0x32f9204]
mov eax, dword [0x3ee1684]
push edx
push str.IDD_DIALOG111
push eax
jmp 0x41df71
mov ecx, dword [0x32f9204]
mov edx, dword [0x3ee1684]
push ecx
push 0x483b80
push edx
jmp 0x41df71
cmp dword [0x47697e0], ebx
jne 0x41df3b
cmp eax, 1
je 0x41df3b
cmp eax, ebx
jne 0x41dead
cmp dword [0x47697e8], ebx
je 0x41df0b
cmp dword [0x47697f4], ebx
je 0x41df0b
mov eax, dword [0x47c360]
lea ecx, [eax + eax*4]
lea edx, [eax + ecx*8]
xor ecx, ecx
mov cx, word [eax + edx*2 + 0x4ef8f1]
mov eax, dword [0x47c340]
cmp ecx, eax
jne 0x41df0b
mov eax, dword [0x4769704]
push ebx
cmp eax, ebx
push fcn.00420370
jne 0x41def6
mov edx, dword [0x32f9204]
mov eax, dword [0x3ee1684]
push edx
push str.IDD_DIALOG1111
push eax
jmp 0x41df71
mov ecx, dword [0x32f9204]
mov edx, dword [0x3ee1684]
push ecx
push 0x483b5c
push edx
jmp 0x41df71
mov eax, dword [0x4769704]
push ebx
cmp eax, ebx
push fcn.00420370
jne 0x41df27
mov eax, dword [0x32f9204]
push eax
push str.IDD_DIALOG1
jmp 0x41df6a
mov edx, dword [0x32f9204]
mov eax, dword [0x3ee1684]
push edx
push 0x483b40
push eax
jmp 0x41df71
mov eax, dword [0x4769704]
push ebx
cmp eax, ebx
push fcn.00420370
jne 0x41df5f
mov ecx, dword [0x32f9204]
mov edx, dword [0x3ee1684]
push ecx
push str.IDD_DIALOG11
push edx
jmp 0x41df71
mov eax, dword [0x32f9204]
push eax
push 0x483b1c
mov ecx, dword [0x3ee1684]
push ecx
call esi
lea edx, [esp + 0x10]
mov dword [0x476bb40], eax
push edx
push eax
call edi
mov eax, dword [0x47bd74]
cmp eax, ebx
jl 0x41dfad
mov ecx, dword [0x47bd78]
cmp ecx, ebx
jl 0x41dfad
mov edx, dword [0x19cda54]
add edx, 0xffffffe2
cmp eax, edx
jg 0x41dfad
mov edx, dword [0x19cda58]
add edx, 0xffffffe2
cmp ecx, edx
jle 0x41dfbf
mov eax, 0xa
mov ecx, eax
mov dword [0x47bd74], eax
mov dword [0x47bd78], ecx
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
sub edx, edi
mov edi, dword [esp + 0x10]
push ebx
push edx
mov edx, dword [esp + 0x20]
sub edx, edi
push edx
push ecx
push eax
mov eax, dword [0x476bb40]
push eax
call ebp
mov ecx, dword [0x476bb40]
push ebx
push ebx
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_InvalidateRect]
call fcn.00415e40
mov eax, dword [0x4770bf8]
inc eax
cmp eax, 4
mov dword [0x4770bf8], eax
jle 0x41e0e4
mov edx, dword [0x32f9204]
push ebx
push ebx
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [0x4770be8]
mov edx, dword [0x4770c04]
mov ecx, dword [0x4770c00]
cmp eax, ebx
mov dword [0x4770c08], edx
mov dword [0x4770c04], ecx
mov dword [0x4770c00], eax
je 0x41e088
cmp ecx, ebx
je 0x41e088
cmp edx, ebx
je 0x41e076
cmp eax, ecx
jne 0x41e076
cmp eax, edx
jne 0x41e076
mov dword [0x4770bec], ebx
mov dword [0x4770c08], ebx
mov dword [0x4770c04], ebx
mov dword [0x4770c00], ebx
mov dword [0x4770be8], ebx
jmp 0x41e088
cmp ecx, ebx
je 0x41e088
cmp edx, ebx
je 0x41e088
mov dword [0x4770bec], 1
mov ebp, dword [0x47c360]
mov edi, dword [0x47c340]
mov dword [0x4770bfc], ebx
xor esi, esi
mov eax, 0x1f8fb70
mov cl, byte [eax]
test cl, cl
je 0x41e0d3
xor edx, edx
mov dl, byte [eax + 7]
cmp edx, ebp
jne 0x41e0c7
cmp dword [0x476aedc], ebx
je 0x41e0bc
cmp edi, esi
je 0x41e0c0
inc cl
mov byte [eax], cl
cmp byte [eax], 4
jle 0x41e0d3
jmp 0x41e0d0
inc cl
cmp cl, 0xe
mov byte [eax], cl
jle 0x41e0d3
mov byte [eax], 0
add eax, 0x5a
inc esi
cmp eax, 0x1fa5b00
jl 0x41e0a1
mov dword [0x4770bf8], ebx
cmp dword [0x4770aac], ebx
je 0x41e116
cmp dword [0x476aedc], ebx
je 0x41e0fd
cmp dword [0x47c450], 0xffffffff
je 0x41e116
mov eax, dword [0x47c454]
push eax
push 0x4cf344
call fcn.0041c6b0
add esp, 8
mov dword [0x4770aac], ebx
mov ecx, dword [0x47697cc]
cmp ecx, ebx
je 0x41e194
cmp dword [0x476aedc], ebx
jne 0x41e194
mov eax, dword [0x47c360]
cmp ecx, ebx
jle 0x41e161
inc ecx
cmp ecx, 8
mov dword [0x47697cc], ecx
jle 0x41e194
cmp eax, 0xc8
jge 0x41e18e
inc eax
cmp eax, 0xc9
jge 0x41e155
push eax
call fcn.0041b030
add esp, 4
mov dword [0x47697cc], 7
jmp 0x41e194
dec ecx
cmp ecx, 0xfffffff8
mov dword [0x47697cc], ecx
jge 0x41e194
cmp eax, ebx
je 0x41e18e
dec eax
cmp eax, 0xc9
jge 0x41e182
push eax
call fcn.0041b030
add esp, 4
mov dword [0x47697cc], 0xfffffff9
jmp 0x41e194
mov dword [0x47697cc], ebx
cmp dword [0x679e88], ebx
jne 0x41e1a4
cmp dword [0x476ad64], ebx
je 0x41e1a9
mov ebx, 1
mov eax, dword [0x476fa0]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebp, dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
je 0x41e634
cmp dword [0x4770c0c], ebx
je 0x41e1e6
test ebx, ebx
jne 0x41e1e0
push 0x476ff8
call fcn.004371fb
add esp, 4
mov dword [0x4769754], eax
mov dword [0x4770c0c], ebx
mov eax, dword [0x47711c]
test eax, eax
je 0x41e3d3
test ebx, ebx
je 0x41e3d3
push 0x477120
call fcn.004371fb
lea eax, [eax + eax*4]
mov ecx, dword [0x4769758]
add esp, 4
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cmp ecx, eax
jle 0x41e3d3
xor ebx, ebx
push 0x476ff8
mov dword [0x4769758], ebx
call fcn.004371fb
push 0x477140
mov dword [0x4769754], eax
call fcn.004371fb
mov edx, dword [0x3314b28]
lea eax, [eax + eax*4]
add esp, 8
lea eax, [eax + eax*4]
push 0x1388
push edx
lea ecx, [eax + eax*4]
shl ecx, 3
mov dword [0x476975c], ecx
call esi
mov eax, dword [0x476bb34]
mov edx, dword [0x486ffc]
mov ecx, dword [eax*4 + 0x47ba2c]
push ecx
push edx
push 0x46a990c
call fcn.0042ec60
mov eax, dword [0x3314b28]
add esp, 0xc
push ebx
push 1
push eax
call ebp
call fcn.00437330
and eax, 0x800000ff
jns 0x41e2a5
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x10], al
call fcn.00437330
and eax, 0x800000ff
jns 0x41e2bc
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x11], al
call fcn.00437330
and eax, 0x800000ff
jns 0x41e2d3
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x12], al
call fcn.00437330
and eax, 0x800000ff
jns 0x41e2ea
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x13], al
call fcn.00437330
and eax, 0x800000ff
jns 0x41e301
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x14], al
call fcn.00437330
and eax, 0x800000ff
jns 0x41e318
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x15], al
call fcn.00437330
and eax, 0x800000ff
jns 0x41e32f
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x16], al
call fcn.00437330
and eax, 0x800000ff
jns 0x41e346
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x17], al
call fcn.00437330
and eax, 0x800000ff
jns 0x41e35d
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x18], al
call fcn.00437330
and eax, 0x800000ff
jns 0x41e374
dec eax
or eax, 0xffffff00
inc eax
mov cx, word [0x47c340]
lea edx, [esp + 0x20]
mov byte [esp + 0x19], al
push edx
lea eax, [esp + 0x14]
push 0xa
push eax
push 0x4e
mov word [esp + 0x24], cx
call fcn.0042fc20
mov ecx, dword [0x3314b28]
add esp, 0x10
mov edi, eax
push 0x1388
push ecx
call esi
mov edx, dword [0x476bb34]
lea ecx, [esp + 0x20]
mov eax, dword [edx*4 + 0x47ba2c]
push eax
push edi
push ecx
call fcn.0042ec60
mov edx, dword [0x3314b28]
add esp, 0xc
push 0
push 1
push edx
call ebp
cmp dword [0x4770b24], ebx
je 0x41e634
xor edi, edi
cmp ebx, edi
je 0x41e52b
cmp dword [0x476975c], edi
jne 0x41e634
mov eax, dword [0x476fcc]
cmp eax, 1
jle 0x41e4fd
cmp eax, 2
jne 0x41e432
mov eax, dword [0x1f821c8]
mov edi, dword [sym.imp.KERNEL32.dll_EscapeCommFunction]
push 3
push eax
call edi
mov ecx, dword [0x1f821c8]
push 5
push ecx
call edi
mov eax, dword [0x476fcc]
mov dword [0x4769758], 0
cmp eax, 3
jne 0x41e494
mov edx, dword [0x1f603ac]
push 0x1388
push edx
call esi
lea eax, [esp + 0x10]
push 5
push eax
mov byte [esp + 0x18], 1
mov byte [esp + 0x19], 1
mov byte [esp + 0x1a], 1
mov byte [esp + 0x1b], 1
mov byte [esp + 0x1c], 8
call fcn.0042f7d0
add esp, 8
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x1f603ac]
push 0
push 1
push ecx
call ebp
mov eax, dword [0x476fcc]
mov dword [0x4769758], 0
cmp eax, 4
jne 0x41e520
mov edx, dword [0x1f603ac]
push 0x1388
push edx
call esi
push 0x477018
lea eax, [esp + 0x44]
push str._s_r_n
push eax
call fcn.00436cce
lea edi, [esp + 0x4c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x50]
push ecx
call fcn.0042f7d0
mov edx, dword [0x1f603ac]
add esp, 0x14
push 0
push 1
push edx
call ebp
mov dword [0x4769758], 0
mov dword [0x4770b24], ebx
jmp 0x41e634
cmp eax, edi
je 0x41e50b
mov eax, dword [0x1f821c8]
push 3
push eax
jmp 0x41e514
mov ecx, dword [0x1f821c8]
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov dword [0x4769758], edi
mov dword [0x4770b24], ebx
jmp 0x41e634
mov eax, dword [0x476fcc]
mov dword [0x4769758], edi
cmp eax, 1
jle 0x41e60d
cmp eax, 3
jne 0x41e596
mov edx, dword [0x1f603ac]
push 0x1388
push edx
call esi
lea eax, [esp + 0x10]
push 5
push eax
mov byte [esp + 0x18], 0
mov byte [esp + 0x19], 0
mov byte [esp + 0x1a], 0
mov byte [esp + 0x1b], 0
mov byte [esp + 0x1c], 0x88
call fcn.0042f7d0
add esp, 8
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x1f603ac]
push edi
push 1
push ecx
call ebp
mov eax, dword [0x476fcc]
cmp eax, 4
jne 0x41e5eb
mov edx, dword [0x1f603ac]
push 0x1388
push edx
call esi
push 0x477098
lea eax, [esp + 0x44]
push str._s_r_n
push eax
call fcn.00436cce
lea edi, [esp + 0x4c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x50]
push ecx
call fcn.0042f7d0
mov edx, dword [0x1f603ac]
add esp, 0x14
push 0
push 1
push edx
call ebp
mov eax, dword [0x476fcc]
cmp eax, 2
jne 0x41e62a
mov eax, dword [0x1f821c8]
mov edi, dword [sym.imp.KERNEL32.dll_EscapeCommFunction]
push 4
push eax
call edi
mov ecx, dword [0x1f821c8]
push 6
push ecx
call edi
jmp 0x41e62a
cmp eax, edi
je 0x41e61c
mov edx, dword [0x1f821c8]
push 4
push edx
jmp 0x41e624
mov eax, dword [0x1f821c8]
push 6
push eax
call dword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov dword [0x4770b24], 0
mov eax, dword [0x476af74]
test eax, eax
je 0x41e9f4
cmp eax, 1
mov dword [0x476af74], 0
jne 0x41e669
push 0
push str.mail
push 0x476af78
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x41e9e6
cmp eax, 2
jne 0x41e690
mov ecx, dword [0x32f9204]
push 1
push 0
push 0
push 0x476af78
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x41e9e6
cmp eax, 0x15
jne 0x41e6ae
push 0
push str.Error
push 0x476af78
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x41e9e6
cmp eax, 0x17
jne 0x41e80c
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x476af78
push 0x495568
lea edx, [esp + 0x174]
push 0x48299c
push edx
call fcn.00436cce
lea eax, [esp + 0x17c]
push str.send.txt
push eax
call fcn.004370f0
add esp, 0x18
test eax, eax
jne 0x41e715
lea ecx, [esp + 0x16c]
push ecx
call fcn.004013b0
push eax
lea edx, [esp + 0x174]
push 0x482aa0
push edx
call fcn.00436cce
add esp, 0x10
mov al, byte [esp + 0x16c]
test al, al
je 0x41e9e6
lea eax, [esp + 0x16c]
push 0x4829ac
push eax
call fcn.00436ea0
add esp, 8
test eax, eax
je 0x41e785
push eax
call fcn.00436d20
lea ecx, [esp + 0x170]
push str.send.txt
push ecx
call fcn.004370f0
add esp, 0xc
test eax, eax
jne 0x41e785
push 3
push 0x482f2c
push 0x483ad8
push eax
call esi
sub eax, 2
je 0x41e9e6
sub eax, 4
je 0x41e785
dec eax
je 0x41e6bd
jmp 0x41e9e6
lea edx, [esp + 0x16c]
push 0x482998
push edx
call fcn.00436ea0
mov esi, eax
add esp, 8
test esi, esi
je 0x41e9e6
mov eax, dword [0x4770ac0]
push esi
push 1
push eax
push 0x1f8c078
call fcn.00436d76
push esi
call fcn.00436d20
lea ecx, [esp + 0x180]
push str.send.txt
push ecx
call fcn.004370f0
add esp, 0x1c
test eax, eax
je 0x41e9e6
lea edx, [esp + 0x16c]
lea eax, [esp + 0x56c]
push edx
push str.notepad.exe___s_
push eax
call fcn.00436cce
add esp, 0xc
lea ecx, [esp + 0x56c]
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x41e9e6
cmp eax, 0x16
jne 0x41e88d
cmp dword [0x47c458], 0x100
jb 0x41e83a
push 4
push 0x47715a0
push 0x476af78
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
je 0x41e9e6
lea edx, [esp + 0x20]
push edx
push 0xa
push 0x1e3329c
push 0x68
call fcn.0042fc20
add esp, 0x10
mov edi, eax
mov eax, dword [0x3314b28]
push 0x1388
push eax
call esi
mov ecx, dword [0x476bb34]
lea eax, [esp + 0x20]
mov edx, dword [ecx*4 + 0x47ba2c]
push edx
push edi
push eax
call fcn.0042ec60
mov ecx, dword [0x3314b28]
add esp, 0xc
push 0
push 1
push ecx
call ebp
jmp 0x41e9e6
cmp eax, 0x2b
jne 0x41e8ae
push 0xc15c
push 0x499464
push 0x4cf244
call fcn.0041d620
add esp, 0xc
jmp 0x41e9e6
cmp eax, 0x2a
jne 0x41e94a
cmp dword [0x47c458], 0x100
jb 0x41e8e0
push 4
push 0x47715a0
push 0x476af78
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
je 0x41e9e6
push 0xc544
push 0x4cf244
push 0x487410
call fcn.0041d620
lea edx, [esp + 0x4c]
push edx
push 0x10a
push 0x1e3329c
push 0x6f
call fcn.0042fc20
add esp, 0x1c
mov edi, eax
mov eax, dword [0x3314b28]
push 0x1388
push eax
call esi
mov ecx, dword [0x476bb34]
lea eax, [esp + 0x40]
mov edx, dword [ecx*4 + 0x47ba2c]
push edx
push edi
push eax
call fcn.0042ec60
mov ecx, dword [0x3314b28]
add esp, 0xc
push 0
push 1
push ecx
call ebp
jmp 0x41e9e6
cmp eax, 0xd
jne 0x41e9f4
push str.i.vbs
push 0x495568
lea edx, [esp + 0x174]
push 0x48299c
push edx
call fcn.00436cce
lea eax, [esp + 0x17c]
push 0x482998
push eax
call fcn.00436ea0
mov esi, eax
add esp, 0x18
test esi, esi
je 0x41e9e6
mov edi, 0x476af78
or ecx, 0xffffffff
xor eax, eax
push esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
push ecx
push 0x476af78
call fcn.00436d76
push esi
call fcn.00436d20
push str.i.vbs
push 0x495568
lea ecx, [esp + 0x188]
push str.wscript.exe___s_s_
push ecx
call fcn.00436cce
add esp, 0x24
lea edx, [esp + 0x16c]
push 1
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [0x4769778], 1
mov ecx, 0x2ee
xor eax, eax
mov edi, 0x476af78
rep stosd dword es:[edi], eax
mov eax, dword [0x4769778]
test eax, eax
je 0x41ec31
inc eax
cmp eax, 0xa
mov dword [0x4769778], eax
jle 0x41ebc6
push 0x482fd0
push 0x495568
lea eax, [esp + 0x174]
push 0x48299c
push eax
call fcn.00436cce
lea ecx, [esp + 0x17c]
push 0x482ab8
push ecx
call fcn.00436ea0
mov esi, eax
add esp, 0x18
test esi, esi
je 0x41ebc6
push esi
call fcn.00412660
push esi
mov edi, eax
call fcn.00436d20
add esp, 8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
test edi, edi
je 0x41ebc6
lea edx, [esp + 0x16c]
push 0x4829ac
push edx
call fcn.00436ea0
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x41ebc6
push ebp
call fcn.00412660
mov ebx, eax
lea edi, [ebx + 1]
push edi
call fcn.00437317
mov esi, eax
add esp, 8
test esi, esi
je 0x41eb88
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebp
and ecx, 3
push 1
push ebx
push esi
rep stosb byte es:[edi], al
call fcn.00436eb3
push esi
lea eax, [esp + 0x980]
push 0x482aa0
push eax
call fcn.00436cce
lea ecx, [esp + 0x1540]
lea edi, [esp + 0x988]
push ecx
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x98c]
repne scasb al, byte es:[edi]
not ecx
inc ecx
push ecx
push edx
push 0x55
call fcn.0042fc20
add esp, 0x2c
mov edi, eax
mov eax, dword [0x3314b28]
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [0x476bb34]
lea eax, [esp + 0x1524]
mov edx, dword [ecx*4 + 0x47ba2c]
push edx
push edi
push eax
call fcn.0042ec60
mov ecx, dword [0x3314b28]
add esp, 0xc
push 0
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push esi
call fcn.00437325
push str.i.vbs
push 0x495568
lea edx, [esp + 0x578]
push 0x48299c
push edx
mov dword [0x4769778], 0
call fcn.00436cce
lea eax, [esp + 0x580]
push eax
call fcn.0043737c
add esp, 0x18
push ebp
call fcn.00436d20
mov eax, dword [0x4769778]
add esp, 4
test eax, eax
jne 0x41ebc6
push 0x482fd0
push 0x495568
lea ecx, [esp + 0x574]
push 0x48299c
push ecx
call fcn.00436cce
lea edx, [esp + 0x57c]
push edx
call fcn.0043737c
add esp, 0x14
cmp dword [0x4769778], 0xc8
jle 0x41ec31
push str.i.vbs
push 0x495568
lea eax, [esp + 0x174]
push 0x48299c
push eax
mov dword [0x4769778], 0
call fcn.00436cce
lea ecx, [esp + 0x17c]
push ecx
call fcn.0043737c
push 0x482fd0
push 0x495568
lea edx, [esp + 0x188]
push 0x48299c
push edx
call fcn.00436cce
lea eax, [esp + 0x190]
push eax
call fcn.0043737c
add esp, 0x28
mov eax, dword [0x476af10]
pop edi
pop esi
pop ebp
test eax, eax
pop ebx
je 0x41ec76
fld qword [0x47c338]
fcomp qword [0x43f408]
fnstsw ax
test ah, 0x41
jne 0x41ec76
fld qword [0x3e9dda8]
fcomp qword [0x47c338]
fnstsw ax
test ah, 1
je 0x41ec76
fld qword [0x3e9dda8]
fadd qword [0x43f438]
fstp qword [0x3e9dda8]
mov eax, dword [0x47c30c]
test eax, eax
je 0x41ecb7
fld qword [0x47c310]
fcomp qword [0x43f408]
fnstsw ax
test ah, 0x41
jne 0x41ecb7
fld qword [0x47c318]
fcomp qword [0x47c310]
fnstsw ax
test ah, 1
je 0x41ecb7
fld qword [0x47c318]
fadd qword [0x43f438]
fstp qword [0x47c318]
mov eax, dword [0x47c320]
test eax, eax
je 0x41ecf8
fld qword [0x47c328]
fcomp qword [0x43f408]
fnstsw ax
test ah, 0x41
jne 0x41ecf8
fld qword [0x47c330]
fcomp qword [0x47c328]
fnstsw ax
test ah, 1
je 0x41ecf8
fld qword [0x47c330]
fadd qword [0x43f438]
fstp qword [0x47c330]
mov eax, dword [0x476aedc]
test eax, eax
mov eax, dword [0x47c45c]
je 0x41ed0a
test eax, eax
jne 0x41ed18
mov ecx, dword [0x4770ad0]
test ecx, ecx
je 0x41ed42
test eax, eax
je 0x41ed42
mov ecx, dword [0x3314b84]
mov edx, dword [0x3314b80]
mov eax, dword [0x47bd1c]
push ecx
mov ecx, dword [0x47bd18]
push edx
mov edx, dword [0x495564]
push eax
push ecx
push edx
call fcn.004129f0
add esp, 0x14
mov eax, dword [0x476aedc]
test eax, eax
jne 0x41ed7d
cmp dword [0x476bb4c], 6
jge 0x41ed7d
mov eax, dword [0x679e84]
mov ecx, dword [0x679e80]
mov edx, dword [0x47bd1c]
push eax
mov eax, dword [0x47bd18]
push ecx
mov ecx, dword [0x495564]
push edx
push eax
push ecx
call fcn.004129f0
add esp, 0x14
mov edx, dword [0x47bcec]
mov eax, dword [0x47bce8]
mov ecx, dword [0x495564]
push edx
push eax
push ecx
call fcn.0041b5e0
add esp, 0x24f0
ret