Function at 0x40a660
Capabilities:
Acquire debug privileges
Check for time delay via gettickcount
Connect pipe
Create a process with modified i/o handles and window
Create directory
Create pipe
Create process on windows
Encode data using base64
Execute shell command and capture output
Get common file path
Parse credit card information
Persist via run registry key
Query environment variable
Read file on windows
Resume thread
Self delete
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
lea ebp, [esp - 0x5c]
sub esp, 0x5fc
mov eax, dword [ebp + 0x6c]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
push edi
push 0x20
mov dword [ebp + 0x4c], ecx
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0x128], ebx
mov byte [ebp + 0x12], bl
mov byte [ebp - 0x25], bl
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x134], ebx
pop edi
je 0x40a8f8
lea eax, [ebp + 0x6c]
push eax
call fcn.0043e425
pop ecx
mov ecx, dword [ebp + 0x6c]
cmp ecx, ebx
je 0x40a8f8
cmp word [ecx], 0x2f
jne 0x40a8f8
mov dx, word [ecx + 2]
or dx, di
cmp dx, 0x69
push 0x73
pop esi
jne 0x40a79f
mov ax, word [ecx + 4]
or ax, di
cmp ax, 0x6e
jne 0x40a79f
mov ax, word [ecx + 6]
or ax, di
cmp ax, si
jne 0x40a79f
mov ax, word [ecx + 8]
or ax, di
cmp ax, 0x74
jne 0x40a79f
mov ax, word [ecx + 0xa]
or ax, di
cmp ax, 0x61
jne 0x40a79f
mov ax, word [ecx + 0xc]
or ax, di
cmp ax, 0x6c
jne 0x40a79f
mov ax, word [ecx + 0xe]
or ax, di
cmp ax, 0x6c
jne 0x40a79f
mov ax, word [ecx + 0x10]
or ax, di
cmp ax, si
jne 0x40a79f
mov ax, word [ecx + 0x12]
or ax, di
cmp ax, 0x65
jne 0x40a79f
mov ax, word [ecx + 0x14]
or ax, di
cmp ax, 0x72
jne 0x40a79f
mov ax, word [ecx + 0x16]
or ax, di
cmp ax, 0x76
jne 0x40a79f
mov ax, word [ecx + 0x18]
or ax, di
cmp ax, dx
jne 0x40a79f
mov ax, word [ecx + 0x1a]
or ax, di
cmp ax, 0x63
jne 0x40a79f
mov ax, word [ecx + 0x1c]
or ax, di
cmp ax, 0x65
jne 0x40a79f
mov ax, word [ecx + 0x1e]
call fcn.00402d55
test al, al
jne 0x40a8cc
cmp dx, si
jne 0x40a803
mov ax, word [ecx + 4]
or ax, di
cmp ax, 0x65
jne 0x40a803
mov ax, word [ecx + 6]
or ax, di
cmp ax, 0x72
jne 0x40a803
mov ax, word [ecx + 8]
or ax, di
cmp ax, 0x76
jne 0x40a803
mov ax, word [ecx + 0xa]
or ax, di
cmp ax, 0x69
jne 0x40a803
mov ax, word [ecx + 0xc]
or ax, di
cmp ax, 0x63
jne 0x40a803
mov ax, word [ecx + 0xe]
or ax, di
cmp ax, 0x65
jne 0x40a803
mov ax, word [ecx + 0x10]
call fcn.00402d55
test al, al
jne 0x40a8cc
cmp dx, 0x72
jne 0x40a8f8
mov dx, word [ecx + 4]
push 0x65
or dx, di
pop eax
cmp dx, ax
jne 0x40a8f8
mov dx, word [ecx + 6]
or dx, di
cmp dx, 0x6d
jne 0x40a8f8
mov dx, word [ecx + 8]
or dx, di
cmp dx, 0x6f
jne 0x40a8f8
mov dx, word [ecx + 0xa]
or dx, di
cmp dx, 0x76
jne 0x40a8f8
mov dx, word [ecx + 0xc]
or dx, di
cmp dx, ax
jne 0x40a8f8
mov dx, word [ecx + 0xe]
or dx, di
cmp dx, si
jne 0x40a8f8
mov dx, word [ecx + 0x10]
or dx, di
cmp dx, ax
jne 0x40a8f8
mov dx, word [ecx + 0x12]
or dx, di
cmp dx, 0x72
jne 0x40a8f8
mov dx, word [ecx + 0x14]
or dx, di
cmp dx, 0x76
jne 0x40a8f8
mov dx, word [ecx + 0x16]
or dx, di
cmp dx, 0x69
jne 0x40a8f8
mov dx, word [ecx + 0x18]
or dx, di
cmp dx, 0x63
jne 0x40a8f8
mov dx, word [ecx + 0x1a]
or dx, di
cmp dx, ax
jne 0x40a8f8
mov ax, word [ecx + 0x1c]
call fcn.00402d55
test al, al
je 0x40a8f8
mov edi, 0x4dac80
push str.PECMD_EXEC
mov ecx, edi
call fcn.0044e03e
push dword [ebp + 0x6c]
mov ecx, edi
call fcn.00444a7c
mov eax, dword [ebp + 0x4c]
mov word [eax + 0x88], 2
jmp 0x40f2ab
mov eax, dword [ebp + 0x70]
and eax, 1
mov dword [ebp + 0x20], eax
mov eax, dword [ebp + 0x70]
shr eax, 1
and eax, 1
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x70]
shr eax, 2
and al, 1
lea ecx, [ebp - 0x15c]
mov dword [ebp - 0x100], ebx
mov byte [ebp + 0x1b], bl
mov byte [ebp + 0x13], bl
mov byte [ebp + 0x73], al
mov byte [ebp + 0x30], bl
call fcn.00444a10
cmp dword [ebp + 0x64], ebx
je 0x40a957
push dword [ebp + 0x64]
lea ecx, [ebp - 0x15c]
call fcn.0044e03e
mov eax, dword [ebp - 0x15c]
mov dword [ebp + 0x64], eax
lea eax, [ebp + 0x64]
push eax
call fcn.0043e425
pop ecx
lea ecx, [ebp - 0x154]
call fcn.00444a10
mov eax, dword [ebp + 0x6c]
cmp eax, ebx
je 0x40a97e
push eax
lea ecx, [ebp - 0x154]
call fcn.0044e03e
mov eax, dword [ebp - 0x154]
mov dword [ebp + 0x6c], eax
cmp dword [ebp + 0x74], ebx
jne 0x40a98c
lea ecx, [ebp - 0x144]
mov dword [ebp + 0x74], ecx
mov ecx, dword [ebp + 0x64]
cmp ecx, ebx
push 0x5e
pop esi
mov dword [ebp + 0x38], ecx
mov dword [ebp - 0x1c0], esi
jne 0x40a9cf
cmp eax, ebx
mov dword [ebp + 0x64], eax
je 0x40a9cf
push 5
push eax
push str._shel
call fcn.0043f884
add esp, 0xc
test al, al
je 0x40a9cf
lea eax, [ebp - 0x1c0]
mov dword [ebp + 0x6c], eax
xor eax, eax
inc eax
mov dword [ebp + 0x20], eax
mov dword [ebp - 0x4c], eax
mov byte [ebp + 0x73], al
lea ecx, [ebp - 0x140]
mov dword [ebp + 0x34], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x138], ebx
mov byte [ebp + 0x32], bl
mov byte [ebp - 0x39], 1
mov byte [ebp - 0x51], bl
mov byte [ebp + 0x1f], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], bl
mov byte [ebp - 0x2e], bl
mov byte [ebp + 0x47], bl
mov byte [ebp - 0x71], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x61], bl
call fcn.00444a10
mov al, byte [0x4dabe0]
neg al
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x194], ebx
mov dword [ebp - 0x190], ebx
mov byte [ebp - 0x69], bl
mov byte [ebp + 0x33], bl
mov byte [ebp - 0x26], bl
sbb eax, eax
and eax, 0x10000
mov byte [ebp - 0x2d], bl
mov byte [ebp - 0x41], 1
mov byte [ebp - 0x59], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp + 0x24], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x24], ebx
call fcn.00444a10
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x94], ebx
mov byte [ebp + 0x46], bl
call fcn.00444a10
lea ecx, [ebp - 0xbc]
call fcn.00444a10
lea ecx, [ebp - 0xb8]
call fcn.00444a10
or dword [ebp - 0x9c], 0xffffffff
lea ecx, [ebp - 0x198]
mov byte [ebp - 9], bl
mov byte [ebp - 0x2f], bl
mov byte [ebp + 0x2f], bl
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x108], ebx
call fcn.00444a10
xor eax, eax
push 0x10
pop ecx
mov dword [ebp - 0x270], 0x44
mov dword [ebp - 0x26c], ebx
lea edi, [ebp - 0x268]
rep stosd dword es:[edi], eax
push 0x12
mov dword [ebp - 0x18c], ebx
pop ecx
lea edi, [ebp - 0x228]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x188]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x17c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x6c]
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x1cc], ebx
mov dword [ebp - 0x1c8], ebx
mov dword [ebp - 0x1c4], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x78], ebx
cmp eax, ebx
jne 0x40ab11
mov byte [ebp + 0x2f], 1
jmp 0x40ab6b
cmp word [eax], 0x23
jne 0x40ab27
cmp eax, dword [ebp + 0x64]
jne 0x40ab20
add dword [ebp + 0x64], 2
inc eax
inc eax
mov dword [ebp + 0x6c], eax
jmp 0x40ab34
test byte [0x4de003], 3
je 0x40ab34
mov byte [ebp + 0x2f], 3
cmp eax, ebx
je 0x40ab6b
cmp word [eax], si
jne 0x40ab4f
cmp eax, dword [ebp + 0x64]
jne 0x40ab46
add dword [ebp + 0x64], 2
inc eax
inc eax
mov dword [ebp + 0x6c], eax
mov byte [ebp + 0x73], 1
cmp eax, ebx
je 0x40ab6b
cmp word [eax], 0x24
jne 0x40ab6b
cmp eax, dword [ebp + 0x64]
jne 0x40ab62
add dword [ebp + 0x64], 2
inc eax
inc eax
mov dword [ebp + 0x6c], eax
mov byte [ebp + 0x47], 1
cmp eax, ebx
mov dword [ebp + 0x40], ebx
je 0x40ab8d
cmp word [eax], 0x7c
jne 0x40ab8d
cmp eax, dword [ebp + 0x64]
jne 0x40ab81
add dword [ebp + 0x64], 2
inc eax
inc eax
mov dword [ebp + 0x6c], eax
mov dword [ebp + 0x40], 1
mov eax, dword [ebp - 0x8c]
cmp eax, ebx
je 0x40ac78
cmp word [eax], 0x2a
jne 0x40ac78
add dword [ebp + 0x64], 2
mov eax, dword [ebp + 0x64]
mov ax, word [eax]
cmp ax, bx
mov dword [ebp + 0x34], 0x10
je 0x40ac6e
push 2
xor esi, esi
pop edi
inc esi
cmp ax, 0x7c
jne 0x40abd3
mov dword [ebp + 0x40], esi
jmp 0x40ac5c
cmp ax, 0x30
jb 0x40ac30
cmp ax, 0x39
ja 0x40ac30
or dword [ebp + 0x34], esi
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp + 0x64]
push eax
call fcn.00447c48
cmp dword [ebp - 0x138], ebx
pop ecx
pop ecx
jg 0x40ac12
jl 0x40ac06
cmp dword [ebp - 0x13c], ebx
ja 0x40ac12
mov dword [ebp - 0x13c], esi
mov dword [ebp - 0x138], ebx
mov eax, dword [ebp + 0x64]
mov ax, word [eax]
cmp ax, 0x24
jne 0x40ac24
or byte [ebp + 0x35], 1
jmp 0x40ac5c
cmp ax, 0x5e
jne 0x40ac5f
or byte [ebp + 0x35], 2
jmp 0x40ac5c
mov ecx, eax
or ecx, 0x20
cmp cx, 0x6e
jne 0x40ac43
add dword [ebp + 0x64], edi
or dword [ebp + 0x34], edi
jmp 0x40ac5f
cmp ax, 0x2d
jne 0x40ac52
add dword [ebp + 0x64], edi
or dword [ebp + 0x34], 4
jmp 0x40ac5f
cmp ax, 0x23
jne 0x40ac6e
mov byte [ebp + 0x12], 1
add dword [ebp + 0x64], edi
mov eax, dword [ebp + 0x64]
mov ax, word [eax]
cmp ax, bx
jne 0x40abc5
lea eax, [ebp + 0x64]
push eax
call fcn.00405a01
pop ecx
lea eax, [ebp + 0x64]
push eax
call fcn.0043e425
cmp word [ebp + 0x34], bx
pop ecx
jne 0x40ad23
lea eax, [ebp + 0x64]
push eax
call fcn.0043e425
cmp dword [ebp - 0xcc], ebx
mov eax, dword [ebp + 0x64]
pop ecx
mov dword [ebp + 0x48], eax
je 0x40acae
cmp word [ebp + 0x34], bx
jne 0x40ae01
push 2
pop esi
cmp word [eax], 0x2d
mov edi, eax
jne 0x40acc5
add eax, 2
cmp word [eax], 0x2d
jne 0x40acc5
mov dword [ebp + 0x48], eax
push 1
lea eax, [ebp + 0x48]
push eax
push 0x4c0f5c
call fcn.00446a34
add esp, 0xc
test al, al
jne 0x40ae01
mov eax, dword [ebp + 0x48]
mov ax, word [eax]
cmp ax, 0x2d
je 0x40acf6
cmp ax, 0x2f
jne 0x40ae01
add dword [ebp + 0x48], esi
push 5
lea eax, [ebp + 0x48]
push eax
push str.catch
call fcn.00446aa9
add esp, 0xc
test al, al
je 0x40ada1
mov al, byte [ebp + 0x34]
or dword [ebp + 0x34], 0x10
cmp al, bl
jne 0x40afd4
mov esi, dword [ebp + 0x64]
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
inc ecx
cmp ax, bx
mov dword [ebp + 0x20], ecx
mov edi, esi
je 0x40b077
push 2
pop edx
cmp ax, 0x3d
je 0x40ad4f
add edi, edx
mov ax, word [edi]
cmp ax, bx
jne 0x40ad3f
cmp edi, esi
je 0x40b077
cmp word [edi], 0x3d
jne 0x40b077
sub edi, edx
cmp word [edi], 0x2b
jne 0x40ad70
mov al, byte [edi]
mov byte [ebp - 0x69], al
sub edi, edx
cmp edi, esi
mov ecx, edi
jbe 0x40ad88
mov ax, word [ecx]
call fcn.00402d55
test al, al
je 0x40ad88
sub ecx, edx
cmp ecx, esi
ja 0x40ad76
mov ax, word [ecx]
call fcn.00402d55
test al, al
jne 0x40b06f
mov edx, ecx
inc ecx
inc ecx
jmp 0x40b001
push 4
push dword [ebp + 0x48]
push str.cmd:
call fcn.0043f884
add esp, 0xc
test al, al
je 0x40af44
add dword [ebp + 0x48], 8
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp + 0x48]
push eax
push dword [ebp + 0x4c]
call fcn.004085e9
add esp, 0x14
mov dword [ebp - 0xcc], eax
jmp 0x40adf2
mov word [edi], 0x20
add edi, esi
cmp edi, dword [ebp + 0x48]
jb 0x40adeb
cmp word [ebp + 0x34], bx
je 0x40afd4
lea eax, [ebp + 0x64]
push eax
call fcn.0043e425
mov eax, dword [ebp - 0xcc]
cmp eax, ebx
pop ecx
je 0x40ae20
cmp word [eax], bx
jne 0x40ae20
mov dword [ebp - 0xcc], ebx
cmp dword [ebp + 0x40], ebx
jne 0x40ae2d
cmp dword [ebp + 0x78], ebx
mov byte [ebp + 0x57], bl
je 0x40ae31
mov byte [ebp + 0x57], 1
or dword [ebp - 0x114], 0xffffffff
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x104], ebx
mov dword [ebp - 0xe8], ebx
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x50], ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x130], ebx
call fcn.00444a10
lea ecx, [ebp - 0x16c]
call fcn.00444a10
cmp byte [ebp + 0x57], bl
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x10c], ebx
mov byte [ebp + 0x31], bl
mov dword [ebp - 0x68], ebx
jne 0x40aeac
cmp dword [ebp + 0x38], ebx
jne 0x40aeac
mov ecx, dword [ebp + 0x4c]
push 1
push ebx
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 0x64]
call fcn.00455dfb
mov eax, dword [ebp - 0x10c]
mov dword [ebp + 0x64], eax
mov eax, dword [ebp + 0x64]
cmp word [eax], 0x2d
mov dword [ebp - 0x8c], eax
jne 0x40aec7
add eax, 2
cmp word [eax], 0x2d
jne 0x40aec7
mov dword [ebp + 0x64], eax
xor esi, esi
inc esi
push esi
lea eax, [ebp + 0x64]
push eax
push 0x4c0f5c
call fcn.00446a34
add esp, 0xc
test al, al
jne 0x40bea2
mov eax, dword [ebp + 0x64]
mov ax, word [eax]
cmp ax, 0x2d
je 0x40aefa
cmp ax, 0x2f
jne 0x40bea2
push 2
pop edi
add dword [ebp + 0x64], edi
push 5
lea eax, [ebp + 0x64]
push eax
push str.catch
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b07e
mov dword [ebp + 0x34], 0x10
push edi
lea eax, [ebp + 0x64]
push eax
push 0x4c0f48
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b0c8
mov dword [ebp - 4], esi
jmp 0x40aeac
push 3
push dword [ebp + 0x48]
push 0x4c0f44
call fcn.0043f884
add esp, 0xc
test al, al
je 0x40af6e
add dword [ebp + 0x48], 6
jmp 0x40af63
add dword [ebp + 0x48], esi
mov eax, dword [ebp + 0x48]
cmp word [eax], 0x2a
je 0x40af60
jmp 0x40afb2
push 4
push dword [ebp + 0x48]
push str.exe:
call fcn.0043f884
add esp, 0xc
test al, al
je 0x40af98
add dword [ebp + 0x48], 8
jmp 0x40af8d
add dword [ebp + 0x48], esi
mov eax, dword [ebp + 0x48]
cmp word [eax], 0x2a
je 0x40af8a
jmp 0x40afb2
push 5
push dword [ebp + 0x48]
push str.logs:
call fcn.0043f884
add esp, 0xc
test al, al
je 0x40afd4
add dword [ebp + 0x48], 0xa
mov eax, dword [ebp + 0x48]
cmp word [eax], 0x22
jne 0x40afd4
add dword [ebp + 0x48], esi
jmp 0x40afc9
add dword [ebp + 0x48], esi
cmp ax, 0x22
je 0x40afd4
mov eax, dword [ebp + 0x48]
mov ax, word [eax]
cmp ax, bx
jne 0x40afc0
lea eax, [ebp + 0x48]
push eax
call fcn.00409168
mov eax, dword [ebp + 0x48]
pop ecx
jmp 0x40acb1
lea eax, [edx - 2]
mov dword [ebp - 0x8c], eax
mov ax, word [eax]
call fcn.00402d55
test al, al
jne 0x40b005
mov edx, dword [ebp - 0x8c]
cmp edx, esi
ja 0x40afe6
sub ecx, edx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x60]
call fcn.00444b34
mov esi, dword [ebp + 0x4c]
push ebx
lea eax, [ebp - 0x60]
push eax
mov ecx, esi
call fcn.00402ee8
cmp byte [esi + 0x92], bl
jne 0x40b030
test byte [esi + 9], 0xf
je 0x40b046
push ebx
lea eax, [ebp - 0x60]
push eax
mov ecx, esi
call fcn.00402ee8
jmp 0x40b046
cmp ax, 0x3d
je 0x40b054
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x40b03e
cmp ax, 0x3d
jne 0x40b06f
lea eax, [ebp - 0x14c]
add edi, 2
push eax
mov dword [ebp - 0x14c], edi
call fcn.0043e425
pop ecx
jmp 0x40ac8c
xor ebx, ebx
inc ebx
jmp 0x40f24b
mov ebx, ecx
jmp 0x40f24b
push 6
push dword [ebp + 0x64]
push str.clone:
call fcn.0043f884
add esp, 0xc
test al, al
je 0x40af22
add dword [ebp + 0x64], 0xc
mov esi, dword [ebp + 0x64]
lea eax, [ebp + 0x64]
push eax
call fcn.00405a01
mov eax, dword [ebp + 0x64]
cmp word [eax], bx
pop ecx
je 0x40b0b7
mov word [eax], bx
add dword [ebp + 0x64], edi
cmp word [esi], bx
je 0x40b19b
mov dword [ebp - 0x70], esi
jmp 0x40b19b
push 4
lea eax, [ebp + 0x64]
push eax
push str.shel
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b0f2
or byte [ebp + 0x73], 2
and byte [ebp + 0x2f], 0xfe
mov dword [ebp - 0x4c], esi
mov dword [ebp + 0x20], esi
jmp 0x40aeac
push 5
push dword [ebp + 0x64]
push str.shel:
call fcn.0043f884
add esp, 0xc
test al, al
je 0x40b160
add dword [ebp + 0x64], 0xa
mov eax, dword [ebp + 0x64]
or byte [ebp + 0x73], 2
and byte [ebp + 0x2f], 0xfe
mov dword [ebp - 0x98], eax
push 5
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x4c], esi
mov dword [ebp + 0x20], esi
mov dword [ebp + 0x40], ebx
call fcn.0041a299
add esp, 0xc
cmp dword [ebp + 0x40], ebx
mov dword [ebp + 0x64], eax
jle 0x40aeac
push dword [ebp + 0x40]
lea ecx, [ebp - 0x134]
push dword [ebp - 0x98]
call fcn.00444b34
jmp 0x40aeac
push 9
push dword [ebp + 0x64]
push str.runrmenu:
call fcn.0043f884
add esp, 0xc
test al, al
je 0x40b1a9
add dword [ebp + 0x64], 0x12
mov edi, dword [ebp + 0x64]
lea eax, [ebp + 0x64]
push eax
call fcn.00405a01
mov eax, dword [ebp + 0x64]
pop ecx
lea ecx, [ebp - 0x140]
sub eax, edi
sar eax, 1
push eax
push edi
call fcn.00444b34
lea eax, [ebp + 0x64]
push eax
call fcn.0043e425
jmp 0x40be99
push 8
push dword [ebp + 0x64]
push str.poprmenu
call fcn.0043f884
add esp, 0xc
test al, al
je 0x40b259
add dword [ebp + 0x64], 0x10
mov eax, dword [ebp + 0x64]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x64]
push eax
call fcn.00405a01
mov eax, dword [ebp + 0x64]
cmp word [eax], bx
pop ecx
je 0x40b1e2
add dword [ebp + 0x64], edi
lea eax, [ebp + 0x64]
push eax
call fcn.0043e425
pop ecx
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.user32.dll_GetCursorPos]
mov eax, dword [ebp - 0x18]
mov ax, word [eax]
cmp ax, bx
mov byte [ebp - 0x71], 1
je 0x40b217
cmp ax, 0x30
jb 0x40b214
cmp ax, 0x39
jbe 0x40b217
add dword [ebp - 0x18], edi
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004515da
mov eax, dword [ebp - 0x18]
mov ax, word [eax]
cmp ax, bx
pop ecx
pop ecx
je 0x40b243
cmp ax, 0x30
jb 0x40b240
cmp ax, 0x39
jbe 0x40b243
add dword [ebp - 0x18], edi
lea eax, [ebp - 0x190]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004515da
pop ecx
jmp 0x40be99
push 4
push dword [ebp + 0x64]
push str.pid:
call fcn.0043f884
add esp, 0xc
test al, al
je 0x40b2d3
add dword [ebp + 0x64], 8
mov edi, dword [ebp + 0x64]
lea eax, [ebp + 0x64]
push eax
mov dword [ebp - 0x8c], edi
call fcn.00405a01
mov ax, word [edi]
cmp ax, 0x28
pop ecx
je 0x40b2b9
cmp ax, 0x30
jne 0x40b2a3
mov ax, word [edi + 2]
or ax, 0x20
cmp ax, 0x78
je 0x40b2b9
mov eax, dword [ebp + 0x64]
cmp edi, eax
je 0x40b19b
lea ecx, [ebp - 0x130]
jmp 0x40b190
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x8c]
push eax
call fcn.00440edc
pop ecx
pop ecx
jmp 0x40b19b
push 5
push dword [ebp + 0x64]
push str.hpid:
call fcn.0043f884
add esp, 0xc
test al, al
je 0x40b310
add dword [ebp + 0x64], 0xa
mov esi, dword [ebp + 0x64]
lea eax, [ebp + 0x64]
push eax
call fcn.00405a01
mov eax, dword [ebp + 0x64]
cmp esi, eax
pop ecx
je 0x40b19b
lea ecx, [ebp - 0x164]
jmp 0x40bd1b
push 5
push dword [ebp + 0x64]
push str.ppid:
call fcn.0043f884
add esp, 0xc
test al, al
je 0x40b387
add dword [ebp + 0x64], 0xa
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp + 0x64]
push eax
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
call fcn.00447dd3
cmp dword [ebp - 0xac], ebx
pop ecx
pop ecx
jg 0x40b379
jl 0x40b35a
cmp dword [ebp - 0xb0], ebx
jae 0x40b379
push dword [ebp - 0xac]
push dword [ebp - 0xb0]
call fcn.0040871d
pop ecx
pop ecx
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], edx
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x78], eax
jmp 0x40aeac
push 4
push dword [ebp + 0x64]
push str.exe:
call fcn.0043f884
add esp, 0xc
test al, al
je 0x40b49c
mov eax, dword [ebp + 0x64]
add eax, 8
mov dword [ebp + 0x64], eax
mov cx, word [eax]
xor edx, edx
cmp cx, 0x23
mov edi, eax
mov dword [ebp], ebx
jne 0x40b3bd
mov dword [ebp - 0x68], esi
cmp cx, 0x22
jne 0x40b434
lea esi, [eax + 2]
mov edi, eax
mov ecx, esi
jmp 0x40b3f2
cmp ax, 0x22
jne 0x40b3f0
inc edx
test dl, 1
je 0x40b3f0
xor eax, eax
mov ax, word [ecx + 2]
cmp ax, bx
je 0x40b3fd
call fcn.00402d55
test al, al
jne 0x40b3fd
or dword [ebp - 0x68], 2
inc ecx
inc ecx
mov dword [ebp + 0x64], ecx
mov ax, word [ecx]
cmp ax, bx
jne 0x40b3cc
push 0x22
pop edx
cmp word [ecx], dx
jne 0x40b441
or dword [ebp], 0xffffffff
inc ecx
inc ecx
mov dword [ebp + 0x64], ecx
cmp word [ecx - 4], dx
mov edi, esi
mov byte [ebp + 0x31], 2
je 0x40b428
mov ax, word [edi]
cmp ax, dx
jne 0x40b441
cmp word [edi + 2], dx
jne 0x40b42d
mov byte [ebp + 0x31], bl
jmp 0x40b441
cmp ax, dx
jne 0x40b441
jmp 0x40b428
lea eax, [ebp + 0x64]
push eax
call fcn.00405a01
pop ecx
mov ecx, dword [ebp + 0x64]
sub ecx, edi
sar ecx, 1
add dword [ebp], ecx
cmp dword [ebp], ebx
jle 0x40b19b
add edi, 0xfffffff6
push edi
lea ecx, [ebp - 0xe8]
call fcn.0044e03e
mov eax, dword [ebp - 0xe8]
mov ecx, dword [ebp]
add eax, 0xa
mov word [eax + ecx*2], bx
cmp word [eax], 0x2a
mov dword [ebp + 0x28], eax
jne 0x40b19b
cmp word [eax + 2], bx
jne 0x40b19b
lea eax, [ebp - 0xe8]
push eax
call fcn.00404809
pop ecx
mov dword [ebp + 0x28], eax
jmp 0x40b19b
push 3
push dword [ebp + 0x64]
push 0x4c0f44
call fcn.0043f884
add esp, 0xc
test al, al
je 0x40b5c9
mov eax, dword [ebp + 0x64]
xor edi, edi
add eax, 6
jmp 0x40b4c3
inc edi
inc eax
inc eax
mov dword [ebp + 0x64], eax
cmp word [eax], 0x2a
je 0x40b4c0
cmp edi, 2
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x48], ebx
jge 0x40b56f
movzx eax, word [eax]
cmp ax, bx
je 0x40b528
call fcn.00402d55
test al, al
jne 0x40b528
push esi
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.0041a299
add esp, 0xc
cmp dword [ebp - 0x48], ebx
mov dword [ebp + 0x64], eax
jle 0x40b528
push dword [ebp - 0x48]
lea ecx, [ebp - 0x88]
push dword [ebp - 0x84]
call fcn.00444b34
mov eax, dword [ebp - 0x88]
mov dword [ebp + 0x50], eax
cmp edi, esi
jne 0x40b5b5
cmp dword [ebp - 0x48], ebx
jle 0x40b5bd
mov eax, dword [ebp - 0x88]
push esi
lea ecx, [ebp - 0x88]
push ecx
push eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x88], ebx
call fcn.00498498
add esp, 0xc
lea ecx, [ebp - 0x150]
mov dword [ebp + 0x50], eax
call fcn.0043e48d
jmp 0x40b19b
push 0x105
lea ecx, [ebp - 0x88]
call fcn.00444a55
push 0x104
push dword [ebp - 0x88]
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push 0x5c
push ebx
push dword [ebp - 0x88]
call dword [sym.imp.shlwapi.dll_StrRChrW]
cmp eax, ebx
je 0x40b5a7
mov word [eax], bx
mov eax, dword [ebp - 0x88]
mov dword [ebp + 0x50], eax
jmp 0x40b19b
cmp edi, ebx
jle 0x40b19b
mov dword [ebp + 0x50], 0x4c0ee8
jmp 0x40b19b
push 5
push dword [ebp + 0x64]
push str.logs:
call fcn.0043f884
add esp, 0xc
test al, al
je 0x40b642
mov eax, dword [ebp + 0x64]
add eax, 0xa
xor ecx, ecx
mov dword [ebp + 0x64], eax
mov dword [ebp + 0x40], eax
cmp word [eax], 0x3f
sete cl
mov edi, ecx
cmp edi, ebx
je 0x40b600
add eax, 2
mov dword [ebp + 0x40], eax
mov esi, dword [ebp + 0x40]
push 1
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x40]
push eax
mov dword [ebp + 8], ebx
call fcn.0041a299
add esp, 0xc
cmp dword [ebp + 8], ebx
mov dword [ebp + 0x64], eax
jle 0x40b19b
cmp edi, ebx
je 0x40b634
cmp dword [0x4dacf0], ebx
je 0x40b19b
push dword [ebp + 8]
lea ecx, [ebp - 0x158]
jmp 0x40bd20
push edi
lea eax, [ebp + 0x64]
push eax
push 0x4c0ee4
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b661
mov byte [ebp - 0x61], 1
jmp 0x40aeac
push 5
lea eax, [ebp + 0x64]
push eax
push str.nowin
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b681
mov byte [ebp - 0x31], 1
jmp 0x40aeac
push 4
pop edi
push edi
lea eax, [ebp + 0x64]
push eax
push str.hide
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b6a6
mov dword [ebp - 0x14], 0x10000000
jmp 0x40aeac
push edi
lea eax, [ebp + 0x64]
push eax
push 0x4c0ecc
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b6ca
inc dword [ebp - 0x100]
mov dword [ebp + 0x20], esi
jmp 0x40aeac
push 5
lea eax, [ebp + 0x64]
push eax
push str.waiti
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b6ea
mov byte [ebp + 0x30], 1
jmp 0x40aeac
push 3
pop esi
push esi
lea eax, [ebp + 0x64]
push eax
push 0x4c0ec0
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b70c
or byte [ebp + 0x32], 1
jmp 0x40aeac
push esi
lea eax, [ebp + 0x64]
push eax
push 0x4c0ebc
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b72b
mov byte [ebp - 0x25], 1
jmp 0x40aeac
push esi
lea eax, [ebp + 0x64]
push eax
push 0x4c0eb8
call fcn.00446a34
add esp, 0xc
test al, al
jne 0x40aeac
push edi
lea eax, [ebp + 0x64]
push eax
push str.err
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b764
or byte [ebp + 0x32], 3
jmp 0x40aeac
push 5
lea eax, [ebp + 0x64]
push eax
push str.limit
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b784
mov byte [ebp - 0x6a], 1
jmp 0x40aeac
push esi
lea eax, [ebp + 0x64]
push eax
push 0x4c0ea4
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b7a3
mov byte [ebp - 0x2e], 1
jmp 0x40aeac
push edi
lea eax, [ebp + 0x64]
push eax
push str.hook
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b7c5
mov dword [ebp - 0x4c], 1
jmp 0x40aeac
push esi
lea eax, [ebp + 0x64]
push eax
push 0x4c0e98
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b7e7
mov dword [ebp - 0x14], 6
jmp 0x40aeac
push esi
lea eax, [ebp + 0x64]
push eax
push 0x4c0e94
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b805
mov dword [ebp - 0x14], esi
jmp 0x40aeac
push edi
lea eax, [ebp + 0x64]
push eax
push str.show
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b827
mov dword [ebp - 0x14], 1
jmp 0x40aeac
push edi
lea eax, [ebp + 0x64]
push eax
push str.runs
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b846
mov byte [ebp - 0x6b], 1
jmp 0x40aeac
push 2
pop edi
push edi
lea eax, [ebp + 0x64]
push eax
push 0x4c0e80
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b868
mov byte [ebp - 0x39], 1
jmp 0x40aeac
push 4
lea eax, [ebp + 0x64]
push eax
push str.no64
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b887
mov byte [ebp - 0x39], bl
jmp 0x40aeac
push 3
lea eax, [ebp + 0x64]
push eax
push 0x4c0e74
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b8a7
mov byte [ebp - 0x51], 1
jmp 0x40aeac
push edi
lea eax, [ebp + 0x64]
push eax
push 0x4c0e70
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b8c6
mov byte [ebp + 0x1f], 1
jmp 0x40aeac
push 5
lea eax, [ebp + 0x64]
push eax
push str.incmd
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b8e6
mov byte [ebp - 0x2d], 1
jmp 0x40aeac
push 3
lea eax, [ebp + 0x64]
push eax
push str.svr_
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b905
mov dword [ebp - 0x10], ebx
jmp 0x40aeac
push 6
lea eax, [ebp + 0x64]
push eax
push str.svrsys
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b928
mov dword [ebp - 0x10], 0x20000
jmp 0x40aeac
push 7
pop esi
push esi
lea eax, [ebp + 0x64]
push eax
push str.svrsys_
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b951
mov al, byte [0x4dabe0]
neg al
sbb eax, eax
and eax, 0x20000
jmp 0x40b992
push 6
lea eax, [ebp + 0x64]
push eax
push str.svrusr
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b971
or dword [ebp - 0x10], 1
jmp 0x40aeac
push esi
lea eax, [ebp + 0x64]
push eax
push str.svrusr_
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b99a
xor eax, eax
cmp byte [0x4dabe0], bl
setne al
mov dword [ebp - 0x10], eax
jmp 0x40aeac
push esi
lea eax, [ebp + 0x64]
push eax
push str.hidecmd
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b9b9
mov byte [ebp - 0x41], 1
jmp 0x40aeac
push 8
lea eax, [ebp + 0x64]
push eax
push str.hidecmd_
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b9d8
mov byte [ebp - 0x41], bl
jmp 0x40aeac
push 3
lea eax, [ebp + 0x64]
push eax
push 0x4c0e28
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40b9fb
mov dword [ebp + 0x24], 1
jmp 0x40aeac
push 3
push dword [ebp + 0x64]
push 0x4c0e24
call fcn.0043f884
add esp, 0xc
test al, al
je 0x40ba1e
add dword [ebp + 0x64], 6
mov dword [ebp + 0x24], pe_nt_image_headers32
jmp 0x40ba3e
push edi
push dword [ebp + 0x64]
push 0x4c0e20
call fcn.0043f884
add esp, 0xc
test al, al
je 0x40ba95
add dword [ebp + 0x64], 4
mov dword [ebp + 0x24], 8
xor ecx, ecx
jmp 0x40ba85
mov eax, ecx
call fcn.00402d55
test al, al
jne 0x40be90
or ecx, 0x20
cmp cx, 0x61
jne 0x40ba60
or dword [ebp + 0x24], 0x40
jmp 0x40ba82
cmp cx, 0x65
jne 0x40ba6c
or byte [ebp + 0x24], 0x80
jmp 0x40ba82
cmp cx, 0x63
jne 0x40ba78
or byte [ebp + 0x25], 1
jmp 0x40ba82
cmp cx, 0x64
jne 0x40ba82
or byte [ebp + 0x25], 2
add dword [ebp + 0x64], edi
mov eax, dword [ebp + 0x64]
mov cx, word [eax]
cmp cx, bx
jne 0x40ba42
jmp 0x40be90
push 3
push dword [ebp + 0x64]
push 0x4c0e1c
call fcn.0043f884
add esp, 0xc
test al, al
je 0x40bae6
add dword [ebp + 0x64], 6
mov eax, dword [ebp + 0x64]
cmp word [eax], 0x3a
mov byte [ebp + 0x47], 1
jne 0x40b19b
add dword [ebp + 0x64], edi
mov esi, dword [ebp + 0x64]
lea eax, [ebp + 0x64]
push eax
call fcn.00405a01
mov eax, dword [ebp + 0x64]
cmp esi, eax
pop ecx
je 0x40b19b
lea ecx, [ebp - 0x110]
jmp 0x40bd1b
push 5
push dword [ebp + 0x64]
push str.code:
call fcn.0043f884
add esp, 0xc
test al, al
je 0x40bba7
add dword [ebp + 0x64], 0xa
mov eax, dword [ebp + 0x64]
mov dword [ebp - 0x40], eax
push 0xffffffffffffffff
lea eax, [ebp - 0x40]
push eax
push str.UTF8
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40bb34
mov byte [ebp + 0x46], 1
mov dword [ebp - 0x94], 0xfde9
jmp 0x40be90
push 0xffffffffffffffff
lea eax, [ebp - 0x40]
push eax
push str.ANSI
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40bb5a
mov byte [ebp + 0x46], 1
mov dword [ebp - 0x94], ebx
jmp 0x40be90
push 0xffffffffffffffff
lea eax, [ebp - 0x40]
push eax
push 0x4c0e00
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40bb84
mov byte [ebp + 0x46], 2
mov dword [ebp - 0x94], 0x4b0
jmp 0x40be90
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00440edc
test eax, eax
pop ecx
pop ecx
jle 0x40be90
mov byte [ebp + 0x46], 1
jmp 0x40be90
push esi
lea eax, [ebp + 0x64]
push eax
push str.timeout:
call fcn.00446ae7
add esp, 0xc
test al, al
je 0x40bc54
mov eax, dword [ebp + 0x64]
mov dword [ebp + 0x3c], eax
mov cx, word [eax]
cmp cx, 0x23
mov byte [ebp - 0x30], bl
jne 0x40bbd9
mov byte [ebp - 0x30], 1
jmp 0x40bbe3
cmp cx, 0x2a
jne 0x40bbe9
mov byte [ebp - 0x30], 2
add eax, 2
mov dword [ebp + 0x3c], eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp + 0x3c]
push eax
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x144], ebx
call fcn.0048d947
test eax, eax
pop ecx
pop ecx
jle 0x40be90
mov eax, dword [ebp - 0x148]
cmp eax, ebx
jle 0x40be90
or dword [ebp + 0x20], 0x10
mov dword [ebp - 0xec], eax
mov al, byte [ebp - 0x30]
mov byte [ebp + 0x12], al
mov eax, dword [ebp + 0x3c]
cmp word [eax], 0x3a
jne 0x40be90
add dword [ebp + 0x3c], edi
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.00440edc
pop ecx
pop ecx
jmp 0x40be90
push 5
push dword [ebp + 0x64]
push str.user:
call fcn.0043f884
add esp, 0xc
test al, al
je 0x40bcb5
add dword [ebp + 0x64], 0xa
mov edi, dword [ebp + 0x64]
lea eax, [ebp + 0x64]
push eax
call fcn.00405a01
mov eax, dword [ebp + 0x64]
cmp edi, eax
pop ecx
je 0x40b19b
sub eax, edi
sar eax, 1
push eax
push edi
lea ecx, [ebp - 0xbc]
call fcn.00444b34
cmp word [edi], 0x23
jne 0x40bcad
cmp word [edi + 2], 0x23
jne 0x40bcad
mov byte [ebp - 0x2f], 1
jmp 0x40b19b
mov byte [ebp - 0x2f], bl
jmp 0x40b19b
push esi
push dword [ebp + 0x64]
push str.passwd:
call fcn.0043f884
add esp, 0xc
test al, al
je 0x40bce0
mov eax, dword [ebp + 0x64]
cmp word [eax + 0xe], 0x23
jne 0x40bcdb
cmp word [eax + 0x10], 0x23
je 0x40bcf5
mov byte [ebp - 9], bl
jmp 0x40bcf9
push esi
push dword [ebp + 0x64]
push str.passwd
call fcn.0043f884
add esp, 0xc
test al, al
je 0x40bd26
mov byte [ebp - 9], 1
add dword [ebp + 0x64], 0xe
mov esi, dword [ebp + 0x64]
lea eax, [ebp + 0x64]
push eax
call fcn.00405a01
mov eax, dword [ebp + 0x64]
cmp esi, eax
pop ecx
je 0x40b19b
lea ecx, [ebp - 0xb8]
sub eax, esi
sar eax, 1
push eax
push esi
jmp 0x40b196
push 8
lea eax, [ebp + 0x64]
push eax
push str.REALTIME
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40bd49
mov dword [ebp - 0x24], 0x100
jmp 0x40aeac
push 4
lea eax, [ebp + 0x64]
push eax
push str.HIGH
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40bd6c
mov dword [ebp - 0x24], 0x80
jmp 0x40aeac
push 0xb
lea eax, [ebp + 0x64]
push eax
push str.ABOVENORMAL
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40bd8f
mov dword [ebp - 0x24], 0x8000
jmp 0x40aeac
push 6
lea eax, [ebp + 0x64]
push eax
push str.NORMAL
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40bdb2
mov dword [ebp - 0x24], 0x20
jmp 0x40aeac
push 0xb
lea eax, [ebp + 0x64]
push eax
push str.BELOWNORMAL
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40bdd5
mov dword [ebp - 0x24], 0x4000
jmp 0x40aeac
push 3
lea eax, [ebp + 0x64]
push eax
push 0x4c0da4
call fcn.00446a34
add esp, 0xc
test al, al
jne 0x40be0f
mov edi, dword [ebp + 0x64]
push 0x4c0d98
push 4
pop esi
call fcn.00402d6e
cmp al, bl
pop ecx
lea eax, [ebp + 0x64]
je 0x40be1b
add dword [ebp + 0x64], 8
push eax
call fcn.0043e425
pop ecx
mov dword [ebp - 0x24], 0x40
jmp 0x40aeac
push 3
push eax
push 0x4c0d94
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40be38
mov byte [ebp + 0x33], 1
jmp 0x40aeac
push 3
lea eax, [ebp + 0x64]
push eax
push 0x4c0d90
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40be61
mov byte [ebp - 0x26], 1
mov byte [ebp + 0x46], bl
mov dword [ebp - 0x94], ebx
jmp 0x40aeac
push 3
lea eax, [ebp + 0x64]
push eax
push 0x4c0d8c
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40be81
mov byte [ebp - 0x59], 1
jmp 0x40aeac
mov eax, dword [ebp - 0x8c]
cmp word [eax], 0x2d
mov dword [ebp + 0x64], eax
jne 0x40be9f
lea eax, [ebp + 0x64]
push eax
call fcn.00409168
pop ecx
jmp 0x40aeac
xor esi, esi
inc esi
cmp dword [ebp + 0x24], ebx
je 0x40becc
cmp byte [ebp - 0x31], bl
je 0x40beb0
or dword [ebp + 0x24], 4
cmp dword [ebp + 0x24], ebx
je 0x40becc
cmp byte [ebp + 0x30], bl
je 0x40bebe
or dword [ebp + 0x24], 0x20
cmp dword [ebp + 0x24], ebx
je 0x40becc
cmp byte [ebp - 0x2d], bl
je 0x40becc
or byte [ebp + 0x25], 4
cmp dword [ebp - 0x78], ebx
je 0x40befe
lea eax, [ebp - 0x270]
push eax
push dword [ebp - 0x78]
lea ecx, [ebp - 0x1cc]
mov dword [eax], 0x48
call fcn.004048bb
mov eax, dword [ebp - 0x1c8]
neg eax
sbb eax, eax
and eax, 0x80000
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x94], 0x4b0
jne 0x40bf0e
mov byte [ebp + 0x46], 2
mov eax, dword [ebp - 0x14c]
cmp eax, ebx
je 0x40bf40
cmp byte [ebp + 0x57], bl
mov dword [ebp + 0x64], eax
jne 0x40bf40
cmp dword [ebp + 0x38], ebx
jne 0x40bf40
push esi
push ebx
lea ecx, [ebp - 0x10c]
push ecx
mov ecx, dword [ebp + 0x4c]
push eax
call fcn.00455dfb
mov eax, dword [ebp - 0x10c]
mov dword [ebp + 0x64], eax
mov edi, dword [ebp + 0x28]
cmp edi, ebx
mov dword [ebp - 0x1bc], ebx
mov dword [ebp - 0x1b8], ebx
mov dword [ebp - 0x1b4], ebx
mov dword [ebp - 0x7c], ebx
je 0x40bf67
cmp word [edi], bx
je 0x40bf67
cmp word [ebp - 0x68], bx
je 0x40bf6a
mov byte [ebp + 0x33], bl
cmp edi, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp + 0xc], ebx
mov dword [ebp - 0x124], 0x4c02cc
je 0x40c051
cmp word [edi], 0x2a
jne 0x40bf99
inc edi
inc edi
inc dword [ebp - 0x20]
cmp word [edi], 0x2a
je 0x40bf8b
mov dword [ebp + 0x28], edi
cmp word [edi], 0x3f
jne 0x40bfc5
inc edi
inc edi
mov dword [ebp + 0x28], edi
mov dword [ebp - 0x124], edi
jmp 0x40bfb7
inc edi
inc edi
cmp ax, 0x3a
mov dword [ebp + 0x28], edi
je 0x40bfc1
mov ax, word [edi]
cmp ax, bx
jne 0x40bfac
jmp 0x40bfc5
mov word [edi - 2], bx
mov ax, word [edi]
push 0x20
pop ecx
or ax, cx
cmp ax, 0x63
jne 0x40bffd
mov dx, word [edi + 2]
or dx, cx
cmp dx, 0x61
jne 0x40bffd
mov dx, word [edi + 4]
or dx, cx
cmp dx, 0x62
jne 0x40bffd
cmp word [edi + 6], 0x3a
jne 0x40bffd
mov dword [ebp - 0x2c], esi
add edi, 8
jmp 0x40c021
cmp ax, 0x65
jne 0x40c024
mov ax, word [edi + 2]
or ax, cx
cmp ax, 0x78
jne 0x40c024
cmp word [edi + 4], 0x3a
jne 0x40c024
mov dword [ebp - 0x2c], 0x100
add edi, 6
mov dword [ebp + 0x28], edi
cmp edi, ebx
je 0x40c051
mov ax, word [edi]
or ax, cx
cmp ax, 0x75
jne 0x40c051
mov ax, word [edi + 2]
or ax, cx
cmp ax, 0x64
jne 0x40c051
cmp word [edi + 4], 0x3a
jne 0x40c051
add edi, 6
mov dword [ebp + 0xc], esi
mov dword [ebp + 0x28], edi
cmp byte [ebp + 0x33], bl
je 0x40c096
cmp edi, ebx
je 0x40c096
cmp word [ebp - 0x2c], bx
jne 0x40c096
cmp word [ebp + 0xc], bx
jne 0x40c096
xor edx, edx
cmp byte [ebp + 0x31], bl
mov ecx, edi
setne dl
xor eax, eax
mov ax, word [edi]
jmp 0x40c091
cmp ax, 0x22
jne 0x40c08c
inc edx
cmp edx, 2
jl 0x40c08c
cmp word [ecx + 2], bx
je 0x40c08c
mov byte [ebp + 0x33], bl
inc ecx
inc ecx
mov ax, word [ecx]
cmp ax, bx
jne 0x40c077
cmp word [ebp - 0x20], bx
jne 0x40c0a8
cmp word [ebp - 0x2c], bx
jne 0x40c0a8
cmp word [ebp + 0xc], bx
je 0x40c0ab
mov byte [ebp + 0x31], bl
cmp edi, ebx
je 0x40c0c7
push 0x2a
push edi
call dword [sym.imp.shlwapi.dll_StrChrW]
cmp eax, ebx
mov dword [ebp - 0x7c], eax
je 0x40c0c7
mov word [eax], bx
inc eax
inc eax
mov dword [ebp - 0x7c], eax
cmp byte [ebp + 0x33], bl
je 0x40c0f4
xor eax, eax
cmp word [ebp + 0xc], bx
sete al
xor ecx, ecx
cmp word [ebp - 0x2c], bx
sete cl
test ecx, eax
je 0x40c0f4
lea eax, [ebp - 0x1bc]
push eax
push edi
call fcn.00414d19
pop ecx
pop ecx
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp + 0x74]
mov dword [eax], esi
xor eax, eax
cmp dword [ebp - 0x70], ebx
lea edi, [ebp - 0x1ac]
mov dword [ebp - 0x1b0], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x1e0], ebx
lea edi, [ebp - 0x1dc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x58], ebx
mov dword [ebp - 8], ebx
mov dword [ebp + 0x14], esi
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xc8], ebx
stosd dword es:[edi], eax
je 0x40c156
mov dword [ebp - 4], esi
cmp byte [ebp + 0x1f], bl
mov dword [ebp - 0x1a8], 0xc
mov dword [ebp - 0x1a4], ebx
mov dword [ebp - 0x1a0], esi
mov dword [ebp - 0x168], ebx
je 0x40c19f
mov ecx, dword [0x4d933c]
lea eax, [ebp - 0x270]
or byte [eax + 0x2d], 1
mov dword [eax + 0x3c], ecx
mov ecx, dword [0x4d9340]
mov dword [eax + 0x40], ecx
mov ecx, dword [0x4d9338]
mov dword [ebp - 4], esi
mov dword [eax + 0x38], ecx
cmp byte [ebp + 0x57], bl
je 0x40c6bc
mov ecx, dword [ebp + 0x64]
cmp word [ecx], 0x7c
mov dword [ebp], ebx
jne 0x40c1cd
inc ecx
inc ecx
xor eax, eax
mov dword [ebp + 0x64], ecx
mov ax, word [ecx]
cmp ax, 0x7c
je 0x40c1b4
call fcn.00402d55
test al, al
jne 0x40c1b4
mov dword [ebp + 0x40], ecx
mov eax, dword [ebp + 0x64]
xor edx, edx
mov dword [ebp + 0x58], edx
cmp word [eax], bx
je 0x40c278
cmp word [eax], 0x7c
jne 0x40c1fd
cmp word [eax + 2], 0x7c
je 0x40c1f5
mov edx, eax
mov dword [ebp + 0x58], edx
jmp 0x40c1fd
inc eax
inc eax
cmp word [eax], 0x7c
je 0x40c1f5
inc eax
inc eax
cmp word [eax], bx
jne 0x40c1e1
cmp edx, ebx
je 0x40c278
lea eax, [ebp + 0x58]
mov word [edx], bx
add dword [ebp + 0x58], 2
push eax
call fcn.0043e425
mov edx, dword [ebp + 0x58]
xor eax, eax
mov ax, word [edx]
cmp ax, bx
pop ecx
mov edi, edx
je 0x40c1d0
cmp ax, 0x7c
jne 0x40c257
lea esi, [edi + 2]
cmp word [esi], ax
jne 0x40c257
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
shl eax, 1
push eax
push esi
push edi
call fcn.00414356
add esp, 0xc
cmp word [edi], 0x7c
jne 0x40c254
inc edi
inc edi
jmp 0x40c24a
mov edx, dword [ebp + 0x58]
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x40c228
cmp word [edx], bx
je 0x40c1d0
mov eax, dword [ebp + 0x40]
cmp word [eax], bx
mov cl, 1
je 0x40c27a
mov al, cl
jmp 0x40c286
xor cl, cl
xor al, al
cmp cl, bl
jne 0x40c286
mov edx, dword [ebp + 0x40]
mov dword [ebp + 0x58], edx
cmp al, bl
mov dword [ebp + 0x38], edx
je 0x40c36b
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov esi, eax
push ebx
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0xc8]
push eax
xor edi, edi
lea eax, [ebp - 0xc0]
inc edi
push eax
mov dword [ebp - 0xf8], 0xc
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 0xf0], edi
call dword [sym.imp.KERNEL32.DLL_CreatePipe]
test eax, eax
jne 0x40c2dd
mov ecx, dword [ebp + 0x4c]
push ebx
push ebx
push edi
call fcn.00415f6a
mov edi, dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
push 3
push ebx
push ebx
lea eax, [ebp - 0xc0]
push eax
push esi
push dword [ebp - 0xc0]
push esi
call edi
cmp dword [ebp - 0xc8], ebx
mov word [ebp + 0x1e], bx
je 0x40c331
mov ecx, dword [ebp + 0x4c]
push ebx
push dword [ebp - 0xc8]
lea eax, [ebp + 0x1e]
push ebx
push ebx
push eax
push ecx
push dword [ebp + 0x40]
call fcn.0040a660
cmp dword [ebp - 0xc8], ebx
je 0x40c331
push dword [ebp - 0xc8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 3
push 1
push ebx
lea eax, [ebp - 0xc0]
push eax
push esi
push dword [ebp - 0xc0]
mov dword [ebp - 0xc8], ebx
push esi
call edi
mov ecx, dword [ebp - 0xc0]
cmp ecx, ebx
je 0x40c36b
lea eax, [ebp - 0x270]
or byte [eax + 0x2d], 1
mov dword [ebp - 4], 1
mov dword [eax + 0x38], ecx
mov eax, dword [ebp + 0x38]
mov dword [ebp + 0x58], eax
xor edi, edi
inc edi
mov cx, word [eax]
cmp cx, bx
je 0x40c658
cmp cx, 0x3c
je 0x40c399
cmp cx, 0x3e
je 0x40c399
inc eax
inc eax
mov dword [ebp + 0x58], eax
mov cx, word [eax]
cmp cx, bx
jne 0x40c380
mov cx, word [eax]
cmp cx, bx
je 0x40c658
cmp cx, 0x3c
jne 0x40c49d
mov word [eax], bx
add dword [ebp + 0x58], 2
lea eax, [ebp + 0x58]
push eax
call fcn.0043e425
mov eax, dword [ebp + 0x58]
cmp word [eax], bx
pop ecx
je 0x40c49d
mov dword [ebp + 0x3c], eax
jmp 0x40c3e2
cmp cx, 0x3c
je 0x40c3ea
cmp cx, 0x3e
je 0x40c3ea
inc eax
inc eax
mov dword [ebp + 0x58], eax
mov cx, word [eax]
cmp cx, bx
jne 0x40c3d1
sub eax, dword [ebp + 0x3c]
lea ecx, [ebp - 0xa8]
sar eax, 1
push eax
push dword [ebp + 0x3c]
call fcn.0044df97
lea ecx, [ebp + 0x40]
call fcn.00444a10
mov ecx, dword [ebp + 0x4c]
push edi
push ebx
lea eax, [ebp + 0x40]
push eax
push dword [ebp + 0x3c]
call fcn.00455dfb
mov eax, dword [ebp + 0x40]
push eax
mov dword [ebp + 0x3c], eax
call fcn.00410df6
lea eax, [ebp + 0x3c]
push eax
call fcn.0043e425
cmp dword [ebp - 0x50], ebx
pop ecx
pop ecx
je 0x40c43c
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebx
push ebx
push 3
lea eax, [ebp - 0x1a8]
push eax
push 7
mov esi, 0xc0000000
push esi
push dword [ebp + 0x3c]
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x50], ebx
call fcn.00405a2a
cmp dword [ebp - 0x50], ebx
jne 0x40c487
push ebx
push 0x2000000
push 3
lea eax, [ebp - 0x1a8]
push eax
push 7
push esi
push dword [ebp + 0x3c]
lea ecx, [ebp - 0x50]
call fcn.00405a2a
cmp dword [ebp - 0x50], ebx
jne 0x40c487
mov dword [ebp - 0x50], ebx
lea ecx, [ebp + 0x40]
call fcn.0043e48d
lea ecx, [ebp - 0xa8]
call fcn.0043e48d
mov eax, dword [ebp + 0x58]
cmp word [eax], 0x3e
jne 0x40c374
mov word [eax], bx
mov eax, dword [ebp + 0x58]
xor esi, esi
cmp word [eax - 2], 0x32
mov byte [ebp + 0x57], 1
jne 0x40c4c2
mov byte [ebp + 0x57], 2
mov word [eax - 2], bx
add dword [ebp + 0x58], 2
mov eax, dword [ebp + 0x58]
cmp word [eax], 0x3e
jne 0x40c4d5
add dword [ebp + 0x58], 2
mov esi, edi
mov eax, dword [ebp + 0x58]
cmp word [eax], 0x26
jne 0x40c4e6
add dword [ebp + 0x58], 2
mov byte [ebp + 0x57], 3
lea eax, [ebp + 0x58]
push eax
call fcn.0043e425
mov eax, dword [ebp + 0x58]
cmp word [eax], bx
pop ecx
je 0x40c374
mov dword [ebp + 4], eax
jmp 0x40c512
cmp cx, 0x3c
je 0x40c51a
cmp cx, 0x3e
je 0x40c51a
inc eax
inc eax
mov dword [ebp + 0x58], eax
mov cx, word [eax]
cmp cx, bx
jne 0x40c501
sub eax, dword [ebp + 4]
lea ecx, [ebp - 0x98]
sar eax, 1
push eax
push dword [ebp + 4]
call fcn.0044df97
lea ecx, [ebp - 0x40]
call fcn.00444a10
mov ecx, dword [ebp + 0x4c]
push edi
push ebx
lea eax, [ebp - 0x40]
push eax
push dword [ebp + 4]
call fcn.00455dfb
mov eax, dword [ebp - 0x40]
push eax
mov dword [ebp + 4], eax
call fcn.00410df6
lea eax, [ebp + 4]
push eax
call fcn.0043e425
test byte [ebp + 0x57], 1
pop ecx
pop ecx
je 0x40c575
cmp dword [ebp - 0x18], ebx
je 0x40c572
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebp - 0x18], ebx
test byte [ebp + 0x57], 2
je 0x40c598
cmp dword [ebp - 0xe0], ebx
je 0x40c58f
push dword [ebp - 0xe0]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebp - 0xe0], ebx
mov dword [ebp], ebx
push ebx
push ebx
push 4
lea eax, [ebp - 0x1a8]
push eax
push 7
push 0x40000000
push dword [ebp + 4]
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x80], ebx
call fcn.00405a2a
mov edi, eax
cmp edi, ebx
jne 0x40c62d
push ebx
push 0x2000000
push 4
lea eax, [ebp - 0x1a8]
push eax
push 7
push 0x40000000
push dword [ebp + 4]
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x80], ebx
call fcn.00405a2a
mov edi, eax
cmp edi, ebx
jne 0x40c62d
push ebx
push 0x2000000
push 3
lea eax, [ebp - 0x1a8]
push eax
push 7
push 0x40000000
push dword [ebp + 4]
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x80], ebx
call fcn.00405a2a
mov edi, eax
cmp edi, ebx
jne 0x40c62d
lea ecx, [ebp - 0x40]
call fcn.0043e48d
lea ecx, [ebp - 0x98]
call fcn.0043e48d
mov eax, dword [ebp + 0x58]
jmp 0x40c371
cmp esi, ebx
je 0x40c63c
push 2
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp byte [ebp + 0x57], 1
jne 0x40c647
mov dword [ebp - 0x18], edi
jmp 0x40c612
cmp byte [ebp + 0x57], 3
mov dword [ebp], edi
je 0x40c642
mov dword [ebp - 0xe0], edi
jmp 0x40c612
mov ecx, dword [ebp - 0x50]
cmp ecx, ebx
mov edx, 0x100
je 0x40c673
lea eax, [ebp - 0x270]
or dword [eax + 0x2c], edx
mov dword [ebp - 4], edi
mov dword [eax + 0x38], ecx
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
je 0x40c689
lea eax, [ebp - 0x270]
or dword [eax + 0x2c], edx
mov dword [ebp - 4], edi
mov dword [eax + 0x3c], ecx
mov ecx, dword [ebp]
cmp ecx, ebx
je 0x40c69f
lea eax, [ebp - 0x270]
or dword [eax + 0x2c], edx
mov dword [ebp - 4], edi
mov dword [eax + 0x40], ecx
mov ecx, dword [ebp + 0x4c]
push edi
push ebx
lea eax, [ebp - 0x168]
push eax
push dword [ebp + 0x38]
call fcn.00455dfb
mov eax, dword [ebp - 0x168]
mov dword [ebp + 0x64], eax
push 6
pop edi
mov esi, 0x10000000
mov eax, dword [ebp + 0x64]
mov ax, word [eax]
cmp ax, 0x21
je 0x40c6fe
cmp ax, 0x2a
je 0x40c6fe
cmp ax, 0x40
jne 0x40c707
push str.WinSta0WinLogon
lea ecx, [ebp - 0x11c]
call fcn.0044e03e
mov ecx, dword [ebp - 0x11c]
inc byte [ebp + 0x1b]
lea eax, [ebp - 0x270]
mov dword [eax + 8], ecx
mov dword [ebp - 0x14], esi
add dword [ebp + 0x64], 2
jmp 0x40c6c4
cmp ax, 0x3d
jne 0x40c719
or dword [ebp + 0x20], 1
inc dword [ebp - 0x100]
jmp 0x40c701
cmp ax, 0x24
jne 0x40c725
mov byte [ebp + 0x47], 1
jmp 0x40c701
cmp ax, 0x26
jne 0x40c734
mov dword [ebp - 0x14], 3
jmp 0x40c701
cmp ax, 0x5e
jne 0x40c73f
mov dword [ebp - 0x14], edi
jmp 0x40c701
cmp ax, 0x5f
je 0x40c73a
cmp dword [ebp - 0x14], esi
je 0x40c76e
cmp byte [ebp + 0x2f], bl
je 0x40c76e
push str.WinSta0Default
lea ecx, [ebp - 0x11c]
call fcn.0044e03e
mov ecx, dword [ebp - 0x11c]
lea eax, [ebp - 0x270]
mov dword [eax + 8], ecx
lea edi, [ebp - 0x270]
cmp dword [edi + 8], ebx
je 0x40c78c
test byte [ebp + 0x1b], 1
je 0x40c78c
call fcn.0040a541
cmp eax, 1
jge 0x40c78c
mov dword [edi + 8], ebx
mov eax, dword [ebp + 0x78]
cmp eax, ebx
je 0x40c7a7
or byte [edi + 0x2d], 1
mov dword [ebp + 0x20], ebx
mov dword [ebp + 0x34], ebx
mov dword [ebp - 4], 1
mov dword [edi + 0x3c], eax
cmp dword [ebp + 0x24], ebx
je 0x40c7b5
cmp dword [ebp + 0x20], ebx
je 0x40c7b5
or dword [ebp + 0x24], 0x10
cmp byte [ebp + 0x47], bl
je 0x40c7d5
mov eax, dword [ebp - 0x110]
cmp word [eax], bx
jne 0x40c7d5
push str.open
lea ecx, [ebp - 0x110]
call fcn.0044dfe2
cmp byte [ebp - 0x6b], bl
je 0x40c826
push 0x5c
push dword [ebp + 0x64]
call dword [sym.imp.shlwapi.dll_StrChrW]
mov edi, eax
cmp edi, ebx
je 0x40c7ef
inc edi
inc edi
jmp 0x40c7f2
mov edi, dword [ebp + 0x64]
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
add eax, eax
push eax
push dword [ebp + 0x64]
xor eax, eax
cmp dword [ebp + 0x20], ebx
push 1
setne al
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
add eax, 0x80000001
push eax
call fcn.0043f6e8
add esp, 0x18
mov ebx, eax
jmp 0x40f17b
lea eax, [ebp + 0x64]
push eax
call fcn.0043e425
cmp dword [ebp - 0x70], ebx
pop ecx
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x12c], ebx
je 0x40c8df
lea ecx, [ebp - 0x40]
mov byte [ebp + 0x47], bl
call fcn.00444a10
mov ecx, dword [ebp + 0x4c]
push 0xffffffffffffffff
push ebx
push dword [ebp - 0x70]
call fcn.0041503d
cmp eax, ebx
je 0x40c8cd
mov ecx, dword [eax]
cmp word [ecx], bx
je 0x40c8cd
push eax
lea ecx, [ebp - 0x40]
call fcn.0044e010
push dword [ebp + 0x64]
lea ecx, [ebp - 0x12c]
call fcn.0044e03e
push dword [ebp - 0x158]
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x12c]
push eax
push dword [ebp - 0x40]
call fcn.00408397
mov edi, eax
mov eax, dword [ebp - 0xe8]
mov dword [ebp + 0x28], eax
mov eax, dword [ebp - 0x12c]
add esp, 0x14
lea ecx, [ebp - 0x40]
mov dword [ebp + 0x64], eax
call fcn.0043e48d
cmp edi, ebx
je 0x40c8df
mov ebx, edi
jmp 0x40f165
lea ecx, [ebp - 0x40]
call fcn.0043e48d
mov ebx, 0x80070057
jmp 0x40f165
mov eax, dword [ebp - 0x140]
cmp word [eax], bx
je 0x40c941
push dword [ebp + 0x64]
call fcn.004130a1
pop ecx
push 0xffffffffffffffff
push str.__k:0
lea ecx, [ebp + 0x74]
mov dword [ebp + 0x64], eax
call fcn.0044dfb0
push dword [ebp + 0x64]
lea ecx, [ebp + 0x74]
call fcn.00444a7c
push 0x4c0cd0
lea ecx, [ebp + 0x74]
call fcn.00444a7c
push dword [ebp - 0x140]
lea ecx, [ebp + 0x74]
call fcn.00444a7c
mov ecx, dword [ebp + 0x4c]
push ebx
push dword [ebp + 0x74]
call fcn.0046b51c
mov ebx, eax
lea ecx, [ebp + 0x74]
jmp 0x40f160
cmp byte [ebp - 0x71], bl
je 0x40cb0e
lea ecx, [ebp + 0x78]
call fcn.00444a10
push dword [ebp + 0x64]
mov dword [ebp + 0x40], ebx
call fcn.004130a1
pop ecx
lea ecx, [ebp + 0x70]
mov dword [ebp + 0x64], eax
call fcn.00444a10
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x70]
push eax
push dword [ebp + 0x64]
mov dword [ebp + 8], ebx
call fcn.00498498
mov eax, dword [ebp + 8]
add esp, 0xc
cmp eax, ebx
jne 0x40c996
lea ecx, [ebp + 0x70]
call fcn.0043e48d
lea ecx, [ebp + 0x78]
jmp 0x40c8d0
mov word [eax - 2], bx
call dword [sym.imp.user32.dll_CreatePopupMenu]
push dword [ebp + 0x70]
lea ecx, [ebp - 0x48]
mov dword [ebp + 0x74], eax
call fcn.0044df7a
push dword [ebp + 8]
mov edi, dword [ebp - 0x48]
lea ecx, [ebp + 0x7c]
call fcn.0044df7a
push dword [ebp + 0x74]
lea eax, [ebp + 0x78]
push eax
lea eax, [ebp + 0x40]
push eax
push dword [ebp + 0x7c]
push edi
call fcn.00406abb
add esp, 0x14
cmp dword [ebp + 0x40], ebx
mov edi, 0x100
jle 0x40ca2d
mov eax, dword [ebp + 0x4c]
cmp dword [eax + 0x28], ebx
jne 0x40c9ee
push ebx
push eax
call fcn.0041292d
pop ecx
pop ecx
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax + 0x28]
xor esi, esi
cmp eax, ebx
je 0x40c9fd
mov esi, dword [eax + 0x18]
push esi
call dword [sym.imp.user32.dll_SetForegroundWindow]
push ebx
push esi
push ebx
push dword [ebp - 0x190]
push dword [ebp - 0x194]
push 0x128
push dword [ebp + 0x74]
call dword [sym.imp.user32.dll_TrackPopupMenu]
push ebx
push ebx
push ebx
push esi
mov edi, eax
call dword [sym.imp.user32.dll_PostMessageW]
push dword [ebp + 0x74]
call dword [sym.imp.user32.dll_DestroyMenu]
lea eax, [edi - 0x100]
cmp eax, ebx
jl 0x40caee
cmp eax, dword [ebp + 0x40]
jge 0x40caee
cmp eax, ebx
mov ecx, dword [ebp + 0x78]
mov dword [ebp + 0x74], ecx
jle 0x40ca92
mov esi, eax
lea eax, [ebp + 0x74]
call fcn.004059a0
mov eax, dword [ebp + 0x74]
movzx eax, word [eax]
push eax
call fcn.0043e40e
add esp, 4
test al, al
je 0x40ca78
add dword [ebp + 0x74], 2
mov eax, dword [ebp + 0x74]
movzx eax, word [eax]
push eax
call fcn.0043e40e
add esp, 4
test al, al
je 0x40ca8f
add dword [ebp + 0x74], 2
dec esi
jne 0x40ca59
mov esi, dword [ebp + 0x74]
lea eax, [ebp + 0x74]
call fcn.004059a0
mov eax, dword [ebp + 0x74]
mov word [eax], bx
cmp word [esi], bx
je 0x40caee
push 0xffffffffffffffff
push str.__k:0
lea ecx, [ebp + 0x68]
call fcn.0044dfb0
push dword [ebp + 0x64]
lea ecx, [ebp + 0x68]
call fcn.00444a7c
push 0x4c0cd0
lea ecx, [ebp + 0x68]
call fcn.00444a7c
push esi
lea ecx, [ebp + 0x68]
call fcn.00444a7c
mov ecx, dword [ebp + 0x4c]
push ebx
push dword [ebp + 0x68]
call fcn.0046b51c
lea ecx, [ebp + 0x68]
mov ebx, eax
call fcn.0043e48d
lea ecx, [ebp + 0x7c]
call fcn.0043e48d
lea ecx, [ebp - 0x48]
call fcn.0043e48d
lea ecx, [ebp + 0x70]
call fcn.0043e48d
lea ecx, [ebp + 0x78]
jmp 0x40f160
push dword [ebp + 0x64]
lea ecx, [ebp - 0x120]
call fcn.0044df7a
cmp byte [ebp - 0x2d], bl
je 0x40cbde
push str.PECMDpecmd_cmd
lea ecx, [ebp - 0x120]
call fcn.0044e03e
push 1
lea eax, [ebp + 0x64]
push ebx
push eax
call fcn.0041a299
add esp, 0xc
push eax
lea ecx, [ebp - 0x120]
mov dword [ebp + 0x64], eax
call fcn.00444a7c
lea eax, [ebp - 0xe8]
push eax
call fcn.00404809
pop ecx
mov dword [ebp + 0x28], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10000000
mov eax, dword [ebp - 0x120]
mov dword [ebp + 0x64], eax
je 0x40cb7c
cmp byte [ebp - 0x59], bl
je 0x40cb86
lea eax, [ebp - 0x270]
or byte [eax + 0x2c], 0x80
xor edi, edi
cmp ecx, ebx
je 0x40cb9a
lea eax, [ebp - 0x270]
or dword [eax + 0x2c], 1
mov word [eax + 0x30], cx
mov al, byte [ebp + 0x1b]
and al, 3
inc edi
cmp al, 3
je 0x40cba9
cmp byte [ebp - 0x31], bl
je 0x40cbb3
lea eax, [ebp - 0x270]
or byte [eax + 0x2f], 8
cmp dword [ebp - 0x114], ebx
jg 0x40e352
lea eax, [ebp - 0x270]
cmp dword [eax + 8], ebx
je 0x40ce98
cmp byte [ebp + 0x1b], bl
jle 0x40ce98
mov eax, edi
jmp 0x40ce9a
cmp byte [ebp - 0x41], bl
je 0x40cb63
cmp dword [ebp - 0x14], esi
je 0x40cb63
mov eax, dword [ebp - 0x120]
push ebx
mov dword [ebp + 0x64], eax
lea eax, [ebp + 0x64]
push ebx
push eax
mov dword [ebp + 4], ebx
call fcn.0041a299
mov esi, eax
mov eax, dword [ebp + 0x64]
mov dword [ebp + 4], eax
push 3
lea eax, [ebp + 4]
push eax
push 0x4c0ccc
call fcn.00446a34
add esp, 0x18
test al, al
jne 0x40cce8
push 7
lea eax, [ebp + 4]
push eax
push str.cmd.exe
call fcn.00446a34
add esp, 0xc
test al, al
jne 0x40cce8
cmp dword [0x4dacb8], ebx
jne 0x40cc92
push ebx
push 0x24
lea eax, [ebp - 0x5a0]
push eax
push ebx
mov word [ebp - 0x5a0], bx
call dword [sym.imp.shell32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x5a0]
mov edi, 0x4dacb8
push eax
mov ecx, edi
call fcn.0044e03e
push str.System32cmd.exe
mov ecx, edi
call fcn.00444a7c
push dword [0x4dacb8]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov word [0x4dac68], ax
movsx eax, word [0x4dac68]
push eax
push dword [ebp + 4]
mov dword [ebp + 0x38], ebx
push dword [0x4dacb8]
call fcn.0040f74f
add esp, 0xc
test al, al
je 0x40cd5d
movsx eax, word [0x4dac68]
mov ecx, dword [ebp + 4]
lea ecx, [ecx + eax*2]
xor eax, eax
mov ax, word [ecx]
cmp ax, 0x22
je 0x40ccdb
call fcn.00402d55
test al, al
je 0x40cd5d
lea eax, [ebp + 4]
push eax
mov dword [ebp + 4], ecx
call fcn.00409168
pop ecx
push 2
lea eax, [ebp + 4]
push eax
push 0x4c0c9c
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40cd5d
mov eax, dword [ebp + 4]
cmp word [eax], 0x22
jne 0x40cd43
add eax, 2
mov dword [ebp + 0x78], eax
lea eax, [ebp + 0x78]
push eax
call fcn.0043e425
mov eax, dword [ebp + 0x78]
cmp word [eax], 0x22
pop ecx
je 0x40cd38
push 4
lea eax, [ebp + 0x78]
push eax
push str.call
call fcn.00446a34
add esp, 0xc
test al, al
je 0x40cd40
mov eax, dword [ebp + 0x78]
mov dword [ebp + 4], eax
jmp 0x40cd43
mov eax, dword [ebp + 4]
push ebx
mov dword [ebp + 0x64], eax
lea eax, [ebp + 0x64]
push ebx
push eax
call fcn.0041a299
add esp, 0xc
mov esi, eax
mov dword [ebp + 0x38], 1
mov eax, esi
sub eax, dword [ebp + 0x64]
and eax, 0xfffffffe
cmp eax, 8
jle 0x40cb63
mov edi, dword [sym.imp.shlwapi.dll_StrCmpNIW]
push 4
lea eax, [esi - 8]
push str..cmd
push eax
call edi
test eax, eax
je 0x40cd9a
push 4
push str..bat
lea eax, [esi - 8]
push eax
call edi
test eax, eax
jne 0x40cb63
mov ax, word [esi]
push 0x64
pop ecx
push ebx
push 0x80
push 3
mov word [ebp - 0xa8], ax
xor eax, eax
push ebx
lea edi, [ebp - 0x52c]
rep stosd dword es:[edi], eax
push 7
push 0xc0000000
mov word [esi], bx
push dword [ebp + 0x64]
stosb byte es:[edi], al
lea ecx, [ebp + 0x40]
lea edi, [ebp - 0x52c]
mov byte [ebp + 0x7b], bl
mov dword [ebp + 0x40], ebx
call fcn.00405a2a
push ebx
lea eax, [ebp - 0xac]
push eax
push 0x190
mov eax, edi
push eax
push dword [ebp + 0x40]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push 0xb
mov eax, edi
push eax
push str.::hidecmd::
call dword [sym.imp.shlwapi.dll_StrCmpNIA]
test eax, eax
jne 0x40ce3b
mov al, byte [ebp - 0x52c]
mov dword [ebp - 0x14], 0x10000000
jmp 0x40ce23
cmp al, 0xd
je 0x40ce2a
cmp al, 0xa
je 0x40ce2a
inc edi
mov al, byte [edi]
cmp al, bl
jne 0x40ce18
jmp 0x40ce2a
inc edi
movsx ax, byte [edi]
push eax
call fcn.0043e40e
add esp, 4
test al, al
jne 0x40ce29
cmp dword [ebp + 0x38], ebx
jne 0x40ce6b
cmp byte [edi], 0x3a
jne 0x40ce50
cmp byte [edi + 1], 0x3a
jne 0x40ce50
inc edi
inc edi
jmp 0x40ce50
inc edi
cmp byte [edi], 0x40
je 0x40ce4f
push 7
push edi
push 0x4c0c68
call dword [sym.imp.shlwapi.dll_StrCmpNIA]
test eax, eax
jne 0x40ce6b
mov byte [ebp + 0x7b], 1
lea ecx, [ebp + 0x40]
call fcn.00402cb5
cmp byte [ebp + 0x7b], bl
mov ax, word [ebp - 0xa8]
mov word [esi], ax
je 0x40cb63
push dword [ebp + 0x64]
mov ecx, dword [ebp + 0x4c]
call fcn.00422182
mov ebx, eax
jmp 0x40f15a
xor eax, eax
cmp eax, ebx
mov dword [ebp + 0x1c], ebx
mov dword [ebp - 0x80], ebx
je 0x40ceae
mov dword [ebp - 0x80], edi
mov dword [ebp + 0x1c], 4
cmp byte [ebp - 0x61], bl
je 0x40ceb7
or dword [ebp + 0x1c], 0x10
push eax
lea ecx, [ebp - 0xa8]
call fcn.00402d9d
cmp byte [0x4dae7c], bl
mov esi, dword [ebp + 0x68]
mov dword [ebp + 0x38], 0x4db0e0
jne 0x40cef0
cmp esi, ebx
je 0x40cede
cmp byte [esi + 8], bl
jne 0x40cef0
cmp byte [ebp - 0x51], bl
mov byte [ebp + 0x7b], bl
je 0x40cef4
cmp esi, ebx
je 0x40cef4
mov eax, dword [esi + 0x24]
mov dword [ebp + 0x38], eax
mov byte [ebp + 0x7b], 1
push ebx
lea ecx, [ebp + 0x40]
call fcn.0044df7a
cmp byte [ebp + 0x7b], bl
mov dword [ebp + 0x68], ebx
je 0x40d191
push 0x4dbd30
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
push ebx
lea ecx, [ebp - 0x30c]
call fcn.00414ef5
cmp esi, ebx
je 0x40cf33
push dword [ebp + 0x38]
lea ecx, [ebp - 0x30c]
push esi
call fcn.00440cb4
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsW]
mov edi, eax
push 0x106
lea ecx, [ebp]
mov dword [ebp - 0xc4], edi
call fcn.00444a2e
mov eax, dword [ebp]
mov dword [ebp + 0x68], eax
jmp 0x40cfcf
mov dword [ebp + 0x78], edi
jmp 0x40cf61
cmp ax, 0x3d
je 0x40cf6b
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x40cf5b
mov esi, edi
sub esi, dword [ebp + 0x78]
sar esi, 1
cmp word [edi], bx
je 0x40cfcd
cmp word [edi + 2], bx
je 0x40cfc8
cmp esi, 0x104
jg 0x40cfc8
push esi
push dword [ebp + 0x78]
push dword [ebp + 0x68]
call fcn.00405988
mov eax, dword [ebp + 0x68]
add esp, 0xc
push ebx
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x30c]
mov word [eax + esi*2], bx
call fcn.00410c6f
test eax, eax
jne 0x40cfc8
push 0xffffffffffffffff
push esi
lea eax, [edi + 2]
push eax
push dword [ebp + 0x78]
lea ecx, [ebp - 0x30c]
call fcn.00414f99
jmp 0x40cfc8
inc edi
inc edi
cmp word [edi], bx
jne 0x40cfc6
inc edi
inc edi
cmp word [edi], bx
jne 0x40cf56
push dword [ebp - 0xc4]
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
mov eax, dword [ebp - 0x308]
xor esi, esi
cmp eax, ebx
mov dword [ebp + 0x3c], eax
mov dword [ebp + 0x78], ebx
jle 0x40d099
mov eax, dword [ebp + 0x78]
mov dword [ebp - 0x90], eax
inc eax
cmp eax, dword [ebp + 0x3c]
mov dword [ebp - 0xe4], eax
mov dword [ebp + 0x68], eax
jge 0x40d087
mov eax, dword [ebp + 0x78]
shl eax, 2
mov dword [ebp - 0xc4], eax
mov dword [ebp + 0x38], eax
mov eax, dword [ebp - 0x30c]
mov ecx, dword [ebp + 0x38]
mov ecx, dword [ecx + eax]
mov edi, dword [ebp + 0x68]
mov ecx, dword [ecx]
shl edi, 2
mov eax, dword [edi + eax]
mov eax, dword [eax]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpW]
test eax, eax
jge 0x40d050
mov ecx, dword [ebp + 0x68]
mov dword [ebp - 0x90], ecx
mov dword [ebp + 0x38], edi
jmp 0x40d056
mov ecx, dword [ebp - 0x90]
inc dword [ebp + 0x68]
mov eax, dword [ebp + 0x68]
cmp eax, dword [ebp + 0x3c]
jl 0x40d01d
cmp ecx, dword [ebp + 0x78]
je 0x40d087
mov edx, dword [ebp - 0x30c]
mov eax, dword [ebp - 0xc4]
add eax, edx
mov edi, dword [eax]
shl ecx, 2
mov edx, dword [ecx + edx]
mov dword [eax], edx
mov eax, dword [ebp - 0x30c]
mov dword [ecx + eax], edi
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp + 0x3c]
mov dword [ebp + 0x78], eax
jl 0x40cff6
cmp dword [ebp + 0x3c], ebx
mov dword [ebp + 0x78], ebx
jle 0x40d0db
mov edi, dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov eax, dword [ebp - 0x30c]
mov ecx, dword [ebp + 0x78]
mov eax, dword [eax + ecx*4]
push dword [eax]
call edi
mov ecx, dword [ebp + 0x78]
lea esi, [esi + eax + 1]
mov eax, dword [ebp - 0x30c]
mov eax, dword [eax + ecx*4]
push dword [eax + 4]
call edi
inc dword [ebp + 0x78]
lea esi, [esi + eax + 3]
mov eax, dword [ebp + 0x78]
cmp eax, dword [ebp + 0x3c]
jl 0x40d0a7
add esi, 4
push esi
lea ecx, [ebp + 0x40]
call fcn.00444a55
mov edi, dword [ebp + 0x40]
xor esi, esi
cmp dword [ebp + 0x3c], ebx
mov dword [ebp + 0x68], edi
jle 0x40d15d
mov eax, dword [ebp - 0x30c]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
push eax
mov dword [ebp + 0x78], eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push eax
push dword [ebp + 0x78]
mov dword [ebp + 8], eax
push edi
call fcn.00405988
mov eax, dword [ebp + 8]
lea edi, [edi + eax*2]
mov word [edi], 0x3d
mov eax, dword [ebp - 0x30c]
mov eax, dword [eax + esi*4]
mov eax, dword [eax + 4]
add esp, 0xc
inc edi
push eax
inc edi
mov dword [ebp + 0x78], eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push eax
push dword [ebp + 0x78]
mov dword [ebp + 8], eax
push edi
call fcn.00405988
mov eax, dword [ebp + 8]
lea edi, [edi + eax*2]
add esp, 0xc
mov word [edi], bx
inc edi
inc edi
inc esi
cmp esi, dword [ebp + 0x3c]
jl 0x40d0f4
mov word [edi], bx
lea ecx, [ebp]
mov word [edi + 2], bx
call fcn.0043e48d
push ebx
lea ecx, [ebp - 0x30c]
call fcn.00435d0b
lea ecx, [ebp - 0x2cc]
call fcn.0043e48d
push 0x4dbd30
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x60]
xor al, al
cmp word [ecx], 0x40
jne 0x40d1a0
inc al
jmp 0x40d1aa
cmp dword [ebp - 0xcc], ebx
je 0x40d1aa
mov al, 2
cmp word [ebp + 0x34], bx
je 0x40d2b0
or dword [ebp + 0x20], edi
or dword [ebp + 0x34], 8
neg al
sbb eax, eax
and eax, 0xfff01000
add eax, 0x100000
mov esi, eax
call fcn.00440b02
push eax
lea eax, [ebp - 0x290]
push str..pipepecmd_exec__u
push eax
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0xc
push ebx
push edi
push esi
push esi
push 0xff
push 6
push 0x40000003
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateNamedPipeA]
cmp eax, ebx
mov dword [ebp - 0x78], eax
je 0x40d249
cmp eax, 0xffffffff
je 0x40d249
push 0xffffffffffffffff
lea eax, [ebp - 0x290]
push eax
lea ecx, [ebp + 0x78]
call fcn.0044dfb0
push ebx
push ebx
push 3
lea ecx, [ebp - 0x1a8]
push ecx
push 7
push 0xc0000000
push dword [eax]
lea ecx, [ebp - 0xdc]
call fcn.00405a2a
lea ecx, [ebp + 0x78]
call fcn.0043e48d
jmp 0x40d250
push edi
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov esi, dword [ebp - 0xdc]
push ebx
push ebx
lea eax, [ebp - 0xc4]
push eax
push esi
mov dword [ebp - 0xc4], 2
call dword [sym.imp.KERNEL32.DLL_SetNamedPipeHandleState]
push ebx
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
mov dword [ebp - 0x1d0], eax
mov dword [ebp - 0x1b0], eax
lea eax, [ebp - 0x270]
or byte [eax + 0x2d], 1
test byte [ebp + 0x32], 2
mov dword [ebp - 0xa0], edi
mov dword [ebp - 4], edi
jne 0x40d2a4
cmp byte [ebp + 0x32], bl
jne 0x40d2a7
mov dword [eax + 0x3c], esi
test byte [ebp + 0x32], 1
je 0x40d2b0
mov dword [eax + 0x40], esi
mov eax, 0x4dbd30
push eax
mov dword [ebp - 0xac], eax
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov eax, dword [ebp + 0x68]
neg eax
sbb eax, eax
and eax, 0x400
or eax, dword [ebp - 0x24]
mov dword [ebp + 0x3c], ebx
or dword [ebp + 0x1c], eax
cmp byte [ebp - 0x2e], bl
mov dword [ebp - 0x38], ebx
mov dword [ebp], ebx
je 0x40d2e9
or dword [ebp + 0x1c], 0x1000004
cmp byte [ebp - 0x39], bl
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0xe4], ebx
je 0x40d30d
lea eax, [ebp - 0xc4]
push eax
call fcn.00403ee2
pop ecx
mov dword [ebp - 0xe4], eax
cmp byte [ebp + 0x47], bl
mov esi, dword [ebp + 0x28]
je 0x40d31d
cmp esi, ebx
je 0x40e0df
cmp byte [ebp - 0x6a], bl
je 0x40d3df
cmp word [ebp - 0x2c], bx
jne 0x40d3df
cmp word [ebp + 0xc], bx
jne 0x40d3df
push dword [ebp + 0x64]
lea eax, [ebp + 0x3c]
push esi
push dword [ebp + 0x50]
push eax
call fcn.00404735
mov edi, eax
push edi
call fcn.0040482d
add esp, 0x14
test eax, eax
jne 0x40d5f9
cmp dword [ebp - 0x10], ebx
push ebx
je 0x40d3a3
movzx eax, word [ebp - 0x10]
push 0x4c0450
push ebx
or eax, 2
push eax
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x270]
push eax
mov eax, dword [ebp - 0x1c]
or eax, dword [ebp + 0x1c]
push edi
push dword [ebp + 0x68]
push eax
push dword [ebp - 4]
push ebx
push ebx
push dword [ebp + 0x64]
push esi
call fcn.00405af1
add esp, 0x38
mov dword [ebp - 8], eax
jmp 0x40dead
call fcn.0040469a
pop ecx
mov dword [ebp - 0x160], eax
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x270]
push eax
mov eax, dword [ebp - 0x1c]
or eax, dword [ebp + 0x1c]
push edi
push dword [ebp + 0x68]
push eax
push dword [ebp - 4]
push ebx
push ebx
push dword [ebp + 0x64]
push esi
push dword [ebp - 0x160]
call dword [sym.imp.advapi32.dll_CreateProcessAsUserW]
jmp 0x40d39b
mov eax, dword [ebp - 0xbc]
cmp word [eax], bx
je 0x40d5cb
cmp word [ebp - 0x2c], bx
jne 0x40d5cb
cmp word [ebp + 0xc], bx
jne 0x40d5cb
xor edi, edi
inc edi
cmp byte [ebp - 0x2f], bl
mov dword [ebp - 8], ebx
je 0x40d46b
push eax
lea ecx, [ebp - 0x84]
call fcn.00402d16
lea ecx, [ebp + 0x78]
call fcn.0044489c
push dword [ebp - 0xbc]
call fcn.0043e39b
lea eax, [ebp + 0x78]
push eax
push dword [ebp - 0x84]
call fcn.0044a669
add esp, 0xc
push 0xffffffffffffffff
mov edi, eax
neg edi
push 0xffffffffffffffff
push dword [ebp + 0x78]
sbb edi, edi
lea ecx, [ebp - 0xbc]
neg edi
call fcn.00444acb
lea ecx, [ebp + 0x78]
call fcn.0043e3dc
lea ecx, [ebp - 0x84]
call fcn.0043e3dc
cmp byte [ebp - 9], bl
je 0x40d4da
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x84]
call fcn.00402d16
lea ecx, [ebp + 0x78]
call fcn.0044489c
push dword [ebp - 0xb8]
call fcn.0043e39b
cmp edi, ebx
pop ecx
je 0x40d4b3
lea eax, [ebp + 0x78]
push eax
push dword [ebp - 0x84]
call fcn.0044a669
test eax, eax
pop ecx
pop ecx
je 0x40d4b3
xor edi, edi
inc edi
jmp 0x40d4b5
xor edi, edi
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 0x78]
lea ecx, [ebp - 0xb8]
call fcn.00444acb
lea ecx, [ebp + 0x78]
call fcn.0043e3dc
lea ecx, [ebp - 0x84]
call fcn.0043e3dc
cmp edi, ebx
je 0x40d5ae
mov edi, dword [ebp - 0xbc]
mov esi, dword [sym.imp.shlwapi.dll_StrChrW]
push 0x40
push edi
call esi
cmp eax, ebx
jne 0x40d500
push 0x5c
push edi
call esi
cmp eax, ebx
je 0x40d50e
mov word [eax], bx
mov esi, dword [ebp - 0xbc]
lea edi, [eax + 2]
jmp 0x40d513
mov esi, 0x4c0450
push dword [ebp + 0x64]
lea eax, [ebp + 0x3c]
push dword [ebp + 0x28]
push dword [ebp + 0x50]
push eax
call fcn.00404735
push eax
mov dword [ebp + 0x50], eax
call fcn.0040482d
add esp, 0x14
test eax, eax
jne 0x40d5f9
cmp dword [ebp - 0x10], ebx
je 0x40d579
push dword [ebp - 0xb8]
movzx eax, word [ebp - 0x10]
push esi
push edi
push eax
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x270]
push eax
push dword [ebp + 0x50]
mov eax, dword [ebp - 0x1c]
push dword [ebp + 0x68]
or eax, 1
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0x64]
push dword [ebp + 0x28]
call fcn.00405af1
add esp, 0x38
jmp 0x40d5ab
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x270]
push eax
push dword [ebp + 0x50]
mov eax, dword [ebp - 0x1c]
push dword [ebp + 0x68]
or eax, 1
push dword [ebp + 0x1c]
push dword [ebp + 0x64]
push dword [ebp + 0x28]
push eax
push dword [ebp - 0xb8]
push esi
push edi
call dword [sym.imp.advapi32.dll_CreateProcessWithLogonW]
mov dword [ebp - 8], eax
push dword [ebp - 0xb8]
call fcn.0043e39b
push dword [ebp - 0xbc]
call fcn.0043e39b
pop ecx
pop ecx
jmp 0x40dead
cmp byte [ebp + 0x33], bl
je 0x40d64c
cmp esi, ebx
je 0x40d5da
cmp word [esi], 0x26
je 0x40d64c
cmp word [ebp - 0x20], bx
jne 0x40d64c
cmp word [ebp - 0x2c], bx
jne 0x40d64c
cmp word [ebp + 0xc], bx
jne 0x40d64c
push dword [ebp + 0x50]
call fcn.0040482d
test eax, eax
pop ecx
je 0x40d605
mov dword [ebp + 0x14], 3
jmp 0x40e1ea
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x7c]
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x270]
push eax
push dword [ebp + 0x50]
push dword [ebp + 0x68]
push dword [ebp + 0x1c]
push dword [ebp - 4]
push dword [ebp + 0x64]
push dword [ebp - 0x1b8]
push dword [ebp - 0x1bc]
call fcn.0049c550
xor ecx, ecx
add esp, 0x2c
test eax, eax
setg cl
mov dword [ebp - 8], ecx
jmp 0x40dead
lea ecx, [ebp - 0xd8]
mov dword [ebp + 0x28], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp + 0x78], esi
mov dword [ebp - 0x68], esi
call fcn.0044489c
cmp word [ebp + 0xc], bx
lea eax, [ebp - 0x90]
mov dword [ebp - 0x7c], eax
lea eax, [ebp + 0x58]
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xd0], ebx
mov dword [ebp + 0x14], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp + 0x58], ebx
mov dword [ebp + 8], eax
je 0x40d73f
push 0x22
pop edi
cmp word [esi], di
jne 0x40d6a8
add esi, 2
mov dword [ebp + 0x78], esi
push 0x3a
lea eax, [ebp + 0x78]
mov dword [ebp - 0xa4], esi
call fcn.004a3a6c
mov eax, dword [ebp + 0x78]
cmp eax, esi
pop ecx
je 0x40d6ca
cmp word [eax - 2], di
jne 0x40d6ca
mov word [eax - 2], bx
cmp word [eax], 0x3a
jne 0x40d6d5
mov word [eax], bx
inc eax
inc eax
cmp word [eax], di
mov esi, eax
jne 0x40d6ee
lea esi, [eax + 2]
inc eax
inc eax
cmp word [eax], di
jne 0x40d6e9
mov word [eax], bx
cmp word [eax], bx
jne 0x40d6df
cmp word [ebp - 0x2c], bx
je 0x40d70c
push 0x3a
push esi
call dword [sym.imp.shlwapi.dll_StrChrW]
cmp eax, ebx
mov dword [ebp + 0x28], eax
je 0x40d70c
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x28], eax
push ebx
push ebx
push 0x10000
push esi
lea eax, [ebp - 0xd8]
push eax
push dword [ebp - 0xa4]
call fcn.0043bfe1
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xd0]
add esp, 0x18
add ecx, eax
mov dword [ebp + 0x14], ecx
jmp 0x40d970
cmp esi, ebx
je 0x40d811
cmp word [esi], 0x26
jne 0x40d7f8
mov ecx, dword [ebp + 0x4c]
push ebx
push 0xffffffffffffffff
push ebx
push esi
call fcn.00410c6f
mov esi, eax
cmp esi, ebx
jne 0x40d7bf
lea ecx, [ebp + 0x58]
call fcn.0043e48d
lea ecx, [ebp - 0xd8]
call fcn.0043e48d
lea ecx, [ebp - 0x24]
call fcn.0043e48d
lea ecx, [ebp]
call fcn.0043e48d
lea ecx, [ebp - 0x38]
call fcn.0043e48d
lea ecx, [ebp + 0x3c]
call fcn.0043e48d
push 0x4dbd30
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
lea ecx, [ebp + 0x40]
call fcn.0043e48d
lea ecx, [ebp - 0xa8]
call fcn.004149f9
mov ebx, 0x80070057
jmp 0x40f15a
mov eax, dword [esi + 0x10]
mov dword [ebp - 0xd4], eax
add eax, 0x10
push eax
lea ecx, [ebp - 0xd8]
call fcn.004448de
mov dword [ebp + 0x14], eax
mov eax, dword [ebp - 0xd4]
inc eax
push eax
push dword [esi + 4]
push dword [ebp - 0xd8]
call fcn.004143a0
add esp, 0xc
jmp 0x40d970
mov al, byte [ebp + 0x31]
neg al
sbb eax, eax
and eax, 2
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.0044c85c
pop ecx
pop ecx
mov dword [ebp - 0x70], eax
mov edi, dword [ebp - 0x70]
cmp edi, ebx
mov dword [ebp - 0x19c], ebx
jne 0x40d8b4
mov eax, dword [ebp + 0x64]
cmp eax, ebx
je 0x40d832
cmp word [eax], 0x2a
jne 0x40d832
inc dword [ebp - 0x20]
cmp byte [ebp + 0x33], bl
je 0x40d83a
mov dword [ebp - 0x20], ebx
cmp word [ebp - 0x2c], bx
je 0x40dec6
push 0x3a
push ebx
push dword [ebp - 0x68]
call dword [sym.imp.shlwapi.dll_StrRChrW]
mov edi, eax
cmp edi, ebx
mov dword [ebp + 0x28], edi
je 0x40d8a9
push 2
pop eax
mov word [edi], bx
add edi, eax
mov dword [ebp + 0x28], edi
je 0x40d8a9
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x68]
cmp word [eax], 0x22
mov dword [ebp - 0x7c], ebx
mov dword [ebp + 8], ebx
jne 0x40d899
inc eax
inc eax
mov dword [ebp - 0x68], eax
mov dword [ebp + 0x78], eax
push 0x22
lea eax, [ebp + 0x78]
call fcn.004a3a6c
mov eax, dword [ebp + 0x78]
cmp word [eax], bx
pop ecx
je 0x40d899
mov word [eax], bx
push dword [ebp - 0x68]
lea ecx, [ebp + 0x58]
call fcn.0044dfe2
jmp 0x40d9a2
mov edi, dword [ebp - 0x70]
cmp edi, ebx
je 0x40dec6
cmp word [ebp - 0x2c], bx
je 0x40d8d3
push 0x3a
push ebx
push edi
call dword [sym.imp.shlwapi.dll_StrRChrW]
cmp eax, ebx
mov dword [ebp + 0x28], eax
je 0x40d8d3
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x28], eax
add dword [ebp - 0x70], 2
push str.EXEDATA
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.0045477d
mov ecx, dword [0x4daf98]
mov si, word [edi]
mov word [edi], bx
mov edx, dword [ebp - 0x68]
mov dword [ebp - 0xa4], eax
mov dword [ebp + 0x38], 0x20
mov ax, word [edx]
add esp, 0xc
cmp ax, 0x2e
mov dword [ebp + 0x78], ebx
jne 0x40d91d
cmp word [edx + 2], bx
je 0x40d931
cmp ax, bx
je 0x40d931
push 2
push ebx
push edx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
mov ecx, eax
mov dword [ebp + 0x78], ecx
cmp ecx, ebx
mov word [edi], si
je 0x40d962
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp - 0xd8]
push eax
push dword [ebp - 0xa4]
mov dword [ebp + 0x38], 0x20
push dword [ebp - 0x19c]
push ecx
call fcn.00415338
add esp, 0x14
mov dword [ebp + 0x14], eax
cmp dword [ebp + 0x78], ebx
je 0x40d970
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
cmp dword [ebp - 0xd4], ebx
je 0x40de92
cmp dword [ebp + 0x14], ebx
je 0x40de92
cmp word [ebp - 0x20], bx
mov dword [ebp - 0x118], 1
ja 0x40d99f
cmp word [ebp - 0x2c], bx
je 0x40ddb7
mov edi, dword [ebp + 0x28]
cmp dword [ebp + 8], ebx
mov eax, dword [ebp - 0x124]
jne 0x40d9b2
mov eax, 0x4c02cc
push eax
push str.exedat
push dword [ebp - 0x7c]
lea eax, [ebp - 0x58]
push dword [ebp + 8]
push eax
call fcn.00405deb
add esp, 0x14
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x38]
call fcn.0044e010
mov esi, dword [ebp - 0x90]
lea eax, [ebp + 0x58]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x90]
cmp esi, ebx
mov dword [ebp - 0x7c], eax
setne al
cmp al, bl
mov dword [ebp - 0x144], ebx
je 0x40da22
push ebx
lea eax, [ebp - 0x144]
push eax
push dword [ebp - 0xd4]
push dword [ebp + 0x14]
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
call fcn.004423f5
pop ecx
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x40da2f
cmp dword [ebp - 0x118], 1
jle 0x40de92
cmp edi, ebx
push dword [ebp - 0x58]
mov byte [ebp + 0x7b], bl
je 0x40db8d
mov eax, dword [ebp + 0x58]
lea ecx, [ebp + 0x58]
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x58], ebx
call fcn.0044e03e
push str..ex
lea ecx, [ebp + 0x58]
call fcn.00444a7c
lea eax, [ebp + 0x58]
push eax
lea ecx, [ebp - 0x38]
call fcn.0044e010
cmp word [edi], 0x5c
mov esi, edi
je 0x40da77
lea esi, [edi - 2]
mov word [esi], 0x5c
push ebx
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
cmp word [ebp - 0x2c], 1
jne 0x40dad0
push 0x4c0c10
lea ecx, [ebp + 0xc]
call fcn.00401000
push dword [ebp + 0x38]
lea ecx, [ebp + 0xc]
call fcn.00444a7c
push 0x4c0c08
lea ecx, [ebp + 0xc]
call fcn.00444a7c
push dword [ebp + 0x58]
lea ecx, [ebp + 0xc]
call fcn.00444a7c
push dword [ebp + 0xc]
mov ecx, dword [ebp + 0x4c]
call fcn.00430962
lea ecx, [ebp + 0xc]
call fcn.0043e48d
jmp 0x40db6e
cmp word [ebp - 0x2c], 0x100
jne 0x40db6e
push 0xf
pop ecx
xor eax, eax
mov dword [ebp - 0x398], 0x44
mov dword [ebp - 0x394], ebx
lea edi, [ebp - 0x390]
rep stosd dword es:[edi], eax
mov dword [ebp - 0xfc], ebx
lea edi, [ebp - 0xf8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0x398]
push eax
push dword [ebp - 0x38]
mov dword [ebp - 0x36c], 0x80
push ebx
push dword [ebp - 0x1c]
push ebx
push ebx
push ebx
push 0x4c0c00
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
push 0xffffffffffffffff
push dword [ebp - 0xfc]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp dword [ebp - 0xfc], ebx
je 0x40db5a
push dword [ebp - 0xfc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 0xf8], ebx
je 0x40db6e
push dword [ebp - 0xf8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push esi
lea ecx, [ebp + 0x58]
call fcn.00444a7c
lea eax, [ebp + 0x58]
push eax
lea ecx, [ebp + 0x3c]
call fcn.0044e010
lea ecx, [ebp + 0x38]
call fcn.0043e48d
jmp 0x40db95
lea ecx, [ebp - 0x38]
call fcn.0044e03e
mov edx, dword [ebp + 0x64]
mov si, word [edx]
cmp si, 0x22
mov eax, edx
jne 0x40dba6
lea eax, [edx + 2]
cmp word [eax], 0x3f
jne 0x40dc33
lea edi, [eax + 2]
mov cx, word [edi]
cmp cx, 0x3f
jne 0x40dbc4
mov esi, dword [ebp + 0x58]
lea edi, [eax + 4]
jmp 0x40dc08
cmp cx, 0x5c
jne 0x40dc33
cmp si, 0x22
je 0x40dc05
mov eax, dword [ebp - 0x38]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x38]
mov dword [ebp + 0x38], eax
mov dword [ebp - 0x38], ebx
call fcn.00444a55
mov eax, dword [ebp - 0x38]
push esi
mov word [eax], bx
push dword [ebp - 0x38]
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.DLL_GetShortPathNameW]
lea ecx, [ebp + 0x38]
call fcn.0043e48d
mov edx, dword [ebp + 0x64]
mov esi, dword [ebp - 0x38]
cmp word [edx], 0x22
jne 0x40dc1b
push 0x4bfca8
lea ecx, [ebp]
call fcn.0044e03e
push esi
lea ecx, [ebp]
call fcn.00444a7c
push edi
lea ecx, [ebp]
call fcn.00444a7c
mov edx, dword [ebp]
mov dword [ebp + 0x64], edx
cmp dword [ebp + 0x28], ebx
je 0x40dc96
cmp word [ebp - 0x20], bx
ja 0x40dc6c
lea eax, [ebp - 0xd8]
push eax
push dword [ebp + 0x3c]
mov dword [ebp + 0x28], ebx
call fcn.00414d19
cmp dword [ebp - 0xd4], ebx
pop ecx
pop ecx
je 0x40dc93
mov eax, dword [ebp - 0xd8]
mov byte [ebp + 0x7b], 1
mov dword [ebp + 0x14], eax
jmp 0x40dd88
cmp byte [ebp + 0x47], bl
je 0x40dc96
cmp dword [ebp + 0x50], ebx
jne 0x40dc7c
mov eax, dword [ebp - 0x38]
mov dword [ebp + 0x50], eax
cmp word [ebp - 0x20], 2
mov dword [ebp + 0x28], ebx
mov byte [ebp + 0x7b], 2
jb 0x40e0c4
jmp 0x40dd88
mov edx, dword [ebp + 0x64]
cmp dword [ebp + 0x28], ebx
mov edi, dword [ebp + 0x58]
je 0x40dca8
mov eax, dword [ebp + 0x28]
cmp word [eax], bx
jne 0x40dca8
xor edi, edi
mov eax, dword [ebp + 0x50]
cmp eax, ebx
jne 0x40dcb2
mov eax, dword [ebp - 0x38]
push edx
push dword [ebp + 0x58]
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.00404735
mov esi, eax
push esi
mov dword [ebp + 0x50], esi
call fcn.0040482d
add esp, 0x14
test eax, eax
jne 0x40dee6
cmp dword [ebp + 0x24], ebx
je 0x40dd0a
push dword [ebp + 0x24]
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x270]
push eax
mov eax, dword [ebp - 0x1c]
or eax, dword [ebp + 0x1c]
push esi
push dword [ebp + 0x68]
push eax
push dword [ebp - 4]
push ebx
push ebx
push dword [ebp + 0x64]
push edi
call fcn.00403072
add esp, 0x2c
jmp 0x40dd71
cmp dword [ebp - 0x10], ebx
je 0x40dd47
movzx eax, word [ebp - 0x10]
push ebx
push 0x4c0450
push ebx
push eax
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x270]
push eax
mov eax, dword [ebp - 0x1c]
or eax, dword [ebp + 0x1c]
push esi
push dword [ebp + 0x68]
push eax
push dword [ebp - 4]
push ebx
push ebx
push dword [ebp + 0x64]
push edi
call fcn.00405af1
add esp, 0x38
jmp 0x40dd71
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x270]
push eax
mov eax, dword [ebp - 0x1c]
or eax, dword [ebp + 0x1c]
push esi
push dword [ebp + 0x68]
push eax
push dword [ebp - 4]
push ebx
push ebx
push dword [ebp + 0x64]
push edi
call fcn.004ac728
add esp, 0x28
cmp byte [ebp - 0x20], 2
mov dword [ebp - 8], eax
jl 0x40de92
cmp word [ebp - 0x2c], bx
jne 0x40de92
cmp byte [ebp + 0x7b], 1
jne 0x40dd93
or eax, 0xffffffff
jmp 0x40dd9c
lea eax, [ebp - 0x18c]
mov eax, dword [eax + 8]
push eax
push dword [ebp - 0x58]
call fcn.00403916
cmp byte [ebp + 0x7b], 1
mov eax, dword [ebp - 0x58]
pop ecx
pop ecx
mov word [eax], bx
jne 0x40debd
mov eax, dword [ebp + 0x64]
cmp word [eax], 0x22
mov edi, eax
jne 0x40ddc5
add eax, 2
cmp word [eax], 0x3f
mov dword [ebp + 0x38], ebx
jne 0x40ddec
cmp word [eax + 2], 0x5c
jne 0x40ddec
lea edi, [eax + 4]
cmp word [edi], 0x22
jne 0x40ddec
dec edi
dec edi
mov ax, word [edi]
mov word [ebp + 0x38], ax
mov word [edi], 0x22
push dword [ebp + 0x50]
call fcn.0040482d
test eax, eax
pop ecx
jne 0x40dee6
lea eax, [ebp - 0x58]
push eax
push ebx
lea esi, [ebp - 0x18c]
push esi
lea eax, [ebp - 0x270]
push eax
push dword [ebp + 0x50]
push dword [ebp + 0x68]
push dword [ebp + 0x1c]
push dword [ebp - 4]
push edi
push dword [ebp - 0xd4]
push dword [ebp + 0x14]
call fcn.0049c550
add esp, 0x2c
cmp word [ebp + 0x38], bx
mov dword [ebp - 0xa4], eax
je 0x40de41
mov ax, word [ebp + 0x38]
mov word [edi], ax
cmp dword [ebp - 0xa4], ebx
jl 0x40d99f
mov esi, dword [esi + 8]
cmp esi, ebx
je 0x40d99f
push esi
push ebx
push 0x400
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
cmp eax, ebx
je 0x40d99f
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
cmp dword [ebp - 0xa4], ebx
setg al
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x58]
cmp eax, ebx
je 0x40de92
cmp word [eax], bx
jne 0x40dd88
lea ecx, [ebp + 0x58]
call fcn.0043e48d
lea ecx, [ebp - 0xd8]
call fcn.0043e48d
lea ecx, [ebp - 0x24]
call fcn.0043e48d
cmp dword [ebp - 8], ebx
je 0x40e1dc
xor eax, eax
jmp 0x40e1e2
cmp byte [ebp + 0x7b], 2
jmp 0x40e0be
push dword [ebp + 0x64]
lea eax, [ebp + 0x3c]
push esi
push dword [ebp + 0x50]
push eax
call fcn.00404735
push eax
mov dword [ebp + 0x50], eax
call fcn.0040482d
add esp, 0x14
test eax, eax
je 0x40df0d
lea ecx, [ebp + 0x58]
mov dword [ebp + 0x14], 3
call fcn.0043e48d
lea ecx, [ebp - 0xd8]
call fcn.0043e48d
lea ecx, [ebp - 0x24]
call fcn.0043e48d
jmp 0x40e1ea
cmp word [ebp + 0x34], bx
jne 0x40df90
push 0x5c
push ebx
push dword [ebp + 0x64]
call dword [sym.imp.shlwapi.dll_StrRChrW]
mov edi, eax
cmp edi, ebx
je 0x40df29
inc edi
inc edi
jmp 0x40df2c
mov edi, dword [ebp + 0x64]
push 8
push edi
push str.winpeshl
call fcn.0043f884
add esp, 0xc
test al, al
je 0x40df5e
xor eax, eax
mov ax, word [edi + 0x10]
cmp ax, bx
je 0x40df5a
cmp ax, 0x2e
je 0x40df5a
call fcn.00402d55
test al, al
je 0x40df5e
mov byte [ebp + 0x13], 1
push 8
push edi
push str.wpeinit
call fcn.0043f884
add esp, 0xc
test al, al
je 0x40df90
xor eax, eax
mov ax, word [edi + 0xe]
cmp ax, bx
je 0x40df8c
cmp ax, 0x2e
je 0x40df8c
call fcn.00402d55
test al, al
je 0x40df90
mov byte [ebp + 0x13], 1
test byte [ebp + 0x73], 1
jne 0x40df9b
cmp dword [ebp - 0x4c], ebx
je 0x40dfc3
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
add eax, eax
push eax
push dword [ebp + 0x64]
push 1
push str.Shell.x
push str.SOFTWAREPELOGON
push 0x80000002
call fcn.0043f6e8
add esp, 0x18
cmp dword [ebp + 0x24], ebx
je 0x40dff9
push dword [ebp + 0x24]
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x270]
push eax
push dword [ebp + 0x50]
mov eax, dword [ebp - 0x1c]
push dword [ebp + 0x68]
or eax, dword [ebp + 0x1c]
push eax
push dword [ebp - 4]
push ebx
push ebx
push dword [ebp + 0x64]
push esi
call fcn.00403072
add esp, 0x2c
jmp 0x40e064
cmp dword [ebp - 0x10], ebx
je 0x40e038
movzx eax, word [ebp - 0x10]
push ebx
push 0x4c0450
push ebx
push eax
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x270]
push eax
push dword [ebp + 0x50]
mov eax, dword [ebp - 0x1c]
push dword [ebp + 0x68]
or eax, dword [ebp + 0x1c]
push eax
push dword [ebp - 4]
push ebx
push ebx
push dword [ebp + 0x64]
push esi
call fcn.00405af1
add esp, 0x38
jmp 0x40e064
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x270]
push eax
push dword [ebp + 0x50]
mov eax, dword [ebp - 0x1c]
push dword [ebp + 0x68]
or eax, dword [ebp + 0x1c]
push eax
push dword [ebp - 4]
push ebx
push ebx
push dword [ebp + 0x64]
push esi
call fcn.004ac728
add esp, 0x28
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x40e06e
mov byte [ebp + 0x13], bl
cmp byte [ebp + 0x13], bl
je 0x40e099
call fcn.0041a5a1
test eax, eax
je 0x40e080
or dword [ebp + 0x20], 1
cmp dword [ebp + 0x20], ebx
jne 0x40e099
push str.waitpeinit.pecmd
call fcn.004ac751
neg eax
sbb eax, eax
neg eax
pop ecx
mov dword [ebp + 0x20], eax
cmp dword [ebp - 8], ebx
jne 0x40de92
cmp byte [ebp + 0x47], bl
jne 0x40de92
cmp esi, ebx
jne 0x40de92
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xc1
jne 0x40de92
lea ecx, [ebp + 0x58]
call fcn.0043e48d
lea ecx, [ebp - 0xd8]
call fcn.0043e48d
lea ecx, [ebp - 0x24]
call fcn.0043e48d
push 0xd
xor eax, eax
pop ecx
lea edi, [ebp - 0x2a4]
mov dword [ebp - 0x2ac], 0x3c
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x14]
cmp eax, ebx
mov dword [ebp - 0x2a8], 0x4540
jne 0x40e10a
push 5
pop eax
movzx eax, ax
mov dword [ebp - 0x290], eax
mov eax, dword [ebp + 0x50]
cmp eax, ebx
je 0x40e125
cmp word [eax], bx
je 0x40e125
mov dword [ebp - 0x294], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp + 0x64]
mov dword [ebp + 0x78], eax
mov dword [ebp - 0x29c], eax
push 1
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x78]
push eax
mov dword [ebp + 0x68], ebx
call fcn.0041a299
mov esi, eax
mov eax, dword [ebp + 0x78]
add esp, 0xc
cmp word [esi], bx
jne 0x40e161
cmp eax, dword [ebp + 0x64]
je 0x40e17c
push dword [ebp + 0x68]
lea ecx, [ebp - 0x16c]
push eax
call fcn.00444b34
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x29c], eax
cmp word [esi], bx
je 0x40e187
mov dword [ebp - 0x298], esi
push ebx
push 0x4dabd8
push str.Kernel32.DLL
push str.GetProcessID
call fcn.0043f92c
mov edi, dword [0x4dabd8]
add esp, 0x10
lea eax, [ebp - 0x2ac]
push eax
call dword [sym.imp.shell32.dll_ShellExecuteExW]
cmp edi, ebx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x274]
lea esi, [ebp - 0x18c]
mov dword [esi], eax
mov dword [ebp - 0x274], ebx
je 0x40dead
push eax
call edi
mov dword [esi + 8], eax
jmp 0x40dead
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [ebp + 0x74]
mov dword [ecx], eax
mov dword [ebp + 0x14], eax
lea ecx, [ebp - 0x98]
call fcn.00402cb5
cmp dword [ebp - 0xe4], ebx
je 0x40e209
push dword [ebp - 0xc4]
call fcn.00403ef3
pop ecx
lea esi, [ebp - 0xc8]
mov eax, dword [esi]
cmp eax, ebx
je 0x40e21c
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 0x130], ebx
mov dword [esi], ebx
je 0x40e240
push dword [ebp - 0x130]
lea eax, [ebp - 0x18c]
push dword [eax + 8]
push dword [ebp + 0x4c]
call fcn.00447086
add esp, 0xc
mov edx, dword [ebp - 0x164]
cmp edx, ebx
je 0x40e290
push 0x26
pop esi
cmp word [edx], si
mov ecx, edx
jne 0x40e263
lea eax, [edx + 2]
jmp 0x40e25e
mov ecx, eax
lea eax, [ecx + 2]
cmp word [eax], si
je 0x40e259
cmp word [ecx], si
mov eax, ecx
jne 0x40e271
lea eax, [ecx + 2]
jmp 0x40e271
inc eax
inc eax
cmp word [eax], 0x3a
je 0x40e26f
cmp word [eax], bx
je 0x40e290
push edx
lea eax, [ebp - 0x18c]
push dword [eax]
push dword [ebp + 0x4c]
call fcn.0042c35a
add esp, 0xc
cmp byte [ebp - 0x2e], bl
je 0x40e2b6
lea esi, [ebp - 0x18c]
cmp dword [esi], ebx
je 0x40e2b6
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateJobObjectW]
push dword [esi]
mov dword [ebp - 0x104], eax
push eax
call dword [sym.imp.KERNEL32.DLL_AssignProcessToJobObject]
push str.__LastPID
lea edi, [ebp - 0x18c]
push dword [edi + 8]
push dword [ebp + 0x4c]
call fcn.00447086
push str.__LastTID
push dword [edi + 0xc]
push dword [ebp + 0x4c]
call fcn.00447086
add esp, 0x18
cmp dword [ebp - 0x80], ebx
je 0x40e2f5
push dword [edi]
push 4
push str.SeDebugPrivilege
call fcn.00413506
add esp, 0xc
test byte [ebp + 0x1c], 4
je 0x40e309
mov edi, dword [edi + 4]
cmp edi, ebx
je 0x40e309
push edi
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
lea ecx, [ebp]
call fcn.0043e48d
lea ecx, [ebp - 0x38]
call fcn.0043e48d
lea ecx, [ebp + 0x3c]
call fcn.0043e48d
lea ecx, [ebp - 0xac]
call fcn.00402ca4
lea ecx, [ebp + 0x40]
call fcn.0043e48d
lea ecx, [ebp - 0xa8]
call fcn.004149f9
lea eax, [ebp - 0xdc]
mov eax, dword [eax]
cmp eax, ebx
je 0x40e352
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [ebp - 0xdc]
lea edi, [ebp - 0xc0]
mov dword [eax], ebx
mov eax, dword [edi]
cmp eax, ebx
je 0x40e36f
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0x50]
mov eax, dword [edi]
cmp eax, ebx
je 0x40e37d
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0x18]
mov eax, dword [edi]
cmp eax, ebx
je 0x40e38b
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0xe0]
mov eax, dword [edi]
cmp eax, ebx
je 0x40e39c
push eax
call esi
cmp byte [ebp + 0x73], bl
mov dword [edi], ebx
jne 0x40e3a8
cmp byte [ebp + 0x30], bl
je 0x40e3fb
lea edi, [ebp - 0x18c]
mov eax, dword [edi]
cmp eax, ebx
je 0x40e3c0
push 0x1388
push eax
call dword [sym.imp.user32.dll_WaitForInputIdle]
cmp byte [ebp + 0x73], bl
je 0x40e3fb
test byte [ebp + 0x73], 1
je 0x40e3e2
mov eax, dword [edi]
push dword [edi + 8]
neg eax
sbb eax, eax
and eax, 2
or eax, 1
push eax
call fcn.0042af6d
pop ecx
pop ecx
cmp dword [ebp - 0x134], ebx
je 0x40e3fb
mov ecx, dword [ebp + 0x4c]
push ebx
push ebx
push ebx
push dword [ebp - 0x134]
call fcn.00433da9
cmp dword [ebp - 8], ebx
jne 0x40e427
cmp dword [ebp - 0x114], ebx
jg 0x40e427
mov eax, dword [ebp - 0x60]
cmp word [eax], bx
je 0x40ef58
mov ecx, dword [ebp + 0x4c]
push 0x4bfa2c
push eax
call fcn.0044414b
jmp 0x40ef58
lea edi, [ebp - 0x18c]
mov eax, dword [edi]
cmp eax, ebx
jne 0x40e436
mov dword [ebp + 0x20], ebx
mov ecx, dword [ebp - 0xa0]
inc dword [ebp - 0xa0]
mov dword [ebp + ecx*4 - 0x1b0], eax
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x40e453
push eax
call esi
cmp dword [ebp - 0x4c], ebx
mov dword [edi + 4], ebx
je 0x40e4a9
mov ecx, dword [ebp + 0x4c]
push ebx
push ebx
push 0x3e8
call fcn.00415f6a
mov esi, dword [edi]
cmp esi, ebx
jne 0x40e497
cmp dword [ebp - 0x114], ebx
jle 0x40e4a9
push dword [ebp - 0x114]
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
cmp esi, ebx
mov dword [ebp + 0x20], ebx
je 0x40ef58
push esi
call fcn.00412090
cmp dword [edi], ebx
pop ecx
jne 0x40e4a9
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp + 0x20], ebx
je 0x40ef58
mov al, byte [0x4d92d4]
mov esi, 0x100000
push 0x100004
lea ecx, [ebp + 0x50]
mov byte [ebp + 0x7b], al
mov dword [ebp + 0xc], esi
xor edi, edi
call fcn.00402d04
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xf8], ebx
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 0xf0], ebx
cmp word [eax], 0x40
lea ecx, [eax + 2]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x84], ecx
mov byte [ebp + 0x73], bl
jne 0x40e5e6
mov byte [ebp + 0x73], 1
mov dword [ebp - 0x1c], ecx
cmp byte [ebp - 0x69], bl
je 0x40e561
mov ecx, dword [ebp + 0x4c]
push ebx
lea eax, [ebp + 0x38]
push eax
push dword [ebp - 0x1c]
mov dword [ebp + 0x38], ebx
call fcn.0044cd0b
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 0x38]
lea ecx, [ebp + 0x50]
call fcn.00444998
push dword [ebp + 0x50]
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov edi, eax
lea esi, [edi + 0x3ff]
and esi, 0xfffffc00
add esi, 0x100000
lea eax, [esi + 8]
push eax
lea ecx, [ebp + 0x50]
mov dword [ebp + 0xc], esi
call fcn.004448de
lea ecx, [ebp + 0x38]
call fcn.0043e48d
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_SetProcessWorkingSetSize]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp dword [ebp - 0x9c], ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x90], eax
jg 0x40e593
mov dword [ebp - 0x9c], 0x3e8
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp + 0x34]
and ax, 0x101
sub ax, 0x101
neg ax
sbb eax, eax
inc eax
test byte [ebp + 0x34], 8
mov dword [ebp - 0xa8], eax
je 0x40eb26
mov eax, dword [ebp - 0x60]
mov ax, word [eax]
cmp ax, 0x40
je 0x40e5fb
cmp byte [ebp - 0x26], bl
je 0x40e5fb
cmp ax, 0x26
je 0x40e5e0
mov eax, dword [ebp + 0x4c]
test byte [eax + 9], 0xf
je 0x40e5fb
mov byte [ebp + 0x6b], 1
jmp 0x40e5fe
cmp dword [ebp - 0xcc], ebx
je 0x40e506
mov byte [ebp + 0x73], 2
jmp 0x40e506
mov byte [ebp + 0x6b], bl
push ebx
mov dword [ebp - 0xa4], ebx
call dword [sym.imp.KERNEL32.DLL_SetLastError]
lea eax, [ebp - 0x78]
mov esi, dword [eax]
lea eax, [ebp - 0x1e0]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_ConnectNamedPipe]
cmp byte [ebp + 0x73], bl
mov dword [ebp + 8], edi
mov dword [ebp - 0x80], 1
je 0x40e634
mov eax, dword [ebp + 0xc]
sub eax, edi
jmp 0x40e639
mov eax, 0x100000
lea ecx, [ebp - 0x1e0]
push ecx
lea ecx, [ebp - 0xa4]
push ecx
push eax
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0x50]
add eax, edi
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x48], ebx
mov byte [ebp + 0x30], bl
call fcn.00444a10
mov dword [ebp - 0x20], 1
mov al, byte [0x4d92d4]
cmp al, bl
mov byte [ebp + 0x7b], al
jg 0x40e68f
cmp dword [ebp - 0x100], 2
jl 0x40eaa8
cmp dword [ebp - 0xec], ebx
jle 0x40e6c2
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xec]
jae 0x40eaa8
mov ecx, dword [ebp - 0xec]
sub ecx, eax
cmp dword [ebp - 0x9c], ecx
jbe 0x40e6c2
mov dword [ebp - 0x9c], ecx
mov ecx, dword [ebp + 0x4c]
push 0x4ff
push dword [ebp - 0x9c]
lea eax, [ebp - 0x1b0]
push ebx
push eax
push dword [ebp - 0xa0]
call fcn.00412ee2
cmp eax, ebx
mov dword [ebp - 0x144], eax
mov dword [ebp - 0xe4], ebx
jne 0x40e792
lea eax, [ebp - 0x78]
mov esi, dword [eax]
push ebx
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x1e0]
push eax
push esi
mov dword [ebp - 0x4c], ebx
call dword [sym.imp.KERNEL32.DLL_GetOverlappedResult]
cmp dword [ebp - 0x4c], ebx
jle 0x40e730
mov eax, dword [ebp + 0x14]
cmp dword [ebp - 0x4c], eax
jle 0x40e722
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x80], ebx
je 0x40e730
add edi, dword [ebp - 0x4c]
mov eax, dword [ebp + 0x50]
mov byte [eax + edi], bl
lea eax, [edi + 0x100000]
cmp eax, dword [ebp + 0xc]
jl 0x40e751
add dword [ebp + 0xc], 0x100000
mov eax, dword [ebp + 0xc]
add eax, 4
push eax
lea ecx, [ebp + 0x50]
call fcn.004448de
cmp byte [ebp + 0x73], bl
je 0x40e75d
mov eax, dword [ebp + 0xc]
sub eax, edi
jmp 0x40e762
mov eax, 0x100000
cmp dword [ebp - 0xa8], ebx
mov dword [ebp + 0x14], eax
je 0x40e779
mov dword [ebp - 0xe4], 1
jmp 0x40e792
lea ecx, [ebp - 0x1e0]
push ecx
lea ecx, [ebp - 0x4c]
push ecx
push eax
mov eax, dword [ebp + 0x50]
add eax, edi
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [ebp - 0x108]
cmp ecx, ebx
mov dword [ebp - 0x150], eax
je 0x40e7e0
mov edx, dword [ebp - 0xac]
mov ecx, edx
sub ecx, eax
add ecx, dword [ebp - 0x90]
cmp ecx, ebx
mov dword [ebp - 0x108], ecx
jle 0x40e7c7
mov dword [ebp - 0x20], ebx
jmp 0x40e7e0
mov dword [ebp - 0x20], 1
add dword [ebp - 0x90], edx
add ecx, edx
cmp ecx, ebx
jle 0x40e7ce
mov dword [ebp - 0x108], ecx
cmp byte [ebp + 0x73], bl
je 0x40e80e
sub eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x9c]
jge 0x40e9a6
cmp edi, dword [ebp - 0x48]
je 0x40ea9f
cmp eax, 0x14
jl 0x40ea9f
jmp 0x40e9a6
cmp ecx, ebx
je 0x40e818
mov dword [ebp - 0x9c], ecx
mov eax, dword [ebp - 0xa0]
xor ecx, ecx
inc ecx
cmp eax, ecx
jle 0x40e84b
dec eax
cmp eax, dword [ebp - 0x144]
jne 0x40e84b
cmp byte [ebp + 0x73], bl
mov byte [ebp + 0x30], cl
je 0x40eaa8
cmp edi, dword [ebp - 0x48]
je 0x40eaa8
mov dword [ebp - 0x20], ecx
jmp 0x40e9a6
test byte [ebp + 0x34], 1
je 0x40e938
cmp edi, dword [ebp + 8]
jle 0x40e938
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x50]
mov edx, dword [ebp - 0x13c]
lea esi, [ecx + eax]
mov eax, edi
sub eax, ecx
cmp dword [ebp - 0xa8], ebx
je 0x40e8be
lea ecx, [eax - 1]
cmp ecx, ebx
mov dword [ebp + 0x78], ecx
jl 0x40e90e
cmp byte [ecx + esi], 0xa
jne 0x40e892
dec edx
cmp edx, ebx
jle 0x40e89a
dec ecx
mov dword [ebp + 0x78], ecx
jns 0x40e887
jmp 0x40e90e
inc dword [ebp + 0x78]
sub eax, dword [ebp + 0x78]
inc eax
push eax
mov eax, dword [ebp + 0x78]
add eax, esi
push eax
push esi
call fcn.00414356
sub edi, dword [ebp + 0x78]
add esp, 0xc
mov eax, edi
sub eax, dword [ebp + 8]
mov byte [eax + esi], bl
jmp 0x40e90e
xor ecx, ecx
test byte [ebp + 0x35], 2
je 0x40e8f6
cmp eax, ebx
jle 0x40e90e
cmp byte [ecx + esi], 0xa
jne 0x40e8d5
dec edx
cmp edx, ebx
jle 0x40e8dc
inc ecx
cmp ecx, eax
jl 0x40e8ca
jmp 0x40e90e
dec ecx
cmp ecx, ebx
jle 0x40e8e8
cmp byte [ecx + esi], 0xd
jne 0x40e8e8
dec ecx
mov eax, dword [ebp + 8]
mov byte [ecx + esi], bl
lea edi, [eax + ecx]
mov dword [ebp - 0x80], ebx
jmp 0x40e90e
cmp eax, ebx
jle 0x40e90e
cmp byte [ecx + esi], 0xa
jne 0x40e909
dec edx
cmp edx, ebx
jle 0x40eaa8
inc ecx
cmp ecx, eax
jl 0x40e8fa
cmp dword [ebp - 0xe4], ebx
je 0x40e938
lea eax, [ebp - 0x1e0]
push eax
lea eax, [ebp - 0xa4]
push eax
push dword [ebp + 0x14]
mov eax, dword [ebp + 0x50]
add eax, edi
push eax
lea eax, [ebp - 0x78]
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push 5
pop esi
dec esi
js 0x40e676
cmp byte [0x4d92d4], bl
jle 0x40e676
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x354]
push eax
call dword [sym.imp.user32.dll_PeekMessageW]
test eax, eax
je 0x40e676
cmp dword [ebp - 0x350], 0x12
je 0x40e98d
lea eax, [ebp - 0x354]
push eax
call dword [sym.imp.user32.dll_TranslateMessage]
lea eax, [ebp - 0x354]
push eax
call dword [sym.imp.user32.dll_DispatchMessageW]
jmp 0x40e93b
cmp byte [ebp + 0x73], bl
mov byte [ebp + 0x7b], bl
mov byte [ebp + 0x30], 1
je 0x40e676
cmp edi, dword [ebp - 0x48]
je 0x40e676
cmp byte [ebp + 0x6b], bl
mov eax, dword [ebp - 0x150]
mov esi, dword [ebp + 0x50]
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x118], eax
mov dword [ebp - 0xf4], edi
jne 0x40ea00
cmp dword [ebp - 0x94], 0x4b0
je 0x40e9f3
push dword [ebp - 0x94]
lea ecx, [ebp - 0x7c]
push edi
push esi
call fcn.00444acb
mov esi, dword [ebp - 0x7c]
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
shl eax, 1
mov dword [ebp - 0xf4], eax
jmp 0x40ea00
mov word [esi + edi + 2], bx
mov eax, dword [ebp + 0x50]
mov word [eax + edi + 2], bx
cmp byte [ebp - 0x25], bl
je 0x40ea16
lea eax, [ebp - 0xf8]
push eax
push esi
call fcn.0040877a
pop ecx
pop ecx
mov esi, eax
cmp byte [ebp + 0x73], 1
jne 0x40ea33
mov ecx, dword [ebp + 0x4c]
push esi
push esi
push 0x4bfa2c
push dword [ebp - 0x1c]
push dword [ebp - 0x1c]
call fcn.0044136c
jmp 0x40ea5f
cmp byte [ebp + 0x6b], bl
je 0x40ea53
push ebx
push ebx
push dword [ebp - 0xf4]
push dword [ebp + 0x50]
push dword [ebp - 0x60]
push dword [ebp + 0x4c]
call fcn.00451899
add esp, 0x18
jmp 0x40ea5f
mov ecx, dword [ebp + 0x4c]
push esi
push dword [ebp - 0x1c]
call fcn.0044414b
cmp dword [ebp - 0xcc], ebx
je 0x40ea99
cmp dword [ebp - 0x20], ebx
je 0x40ea99
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x124]
call fcn.00401000
mov ecx, dword [ebp + 0x4c]
push ebx
push ebx
push ebx
push dword [ebp - 0x124]
call fcn.00433da9
lea ecx, [ebp - 0x124]
call fcn.0043e48d
mov ecx, dword [ebp - 0x108]
cmp byte [ebp + 0x30], bl
je 0x40e80e
lea ecx, [ebp - 0x7c]
call fcn.0043e48d
cmp dword [ebp + 0x20], 0xffffff9c
mov eax, dword [ebp + 0x50]
mov byte [eax + edi + 2], bl
mov eax, dword [ebp + 0x50]
mov byte [eax + edi + 1], bl
mov eax, dword [ebp + 0x50]
mov byte [eax + edi], bl
mov dword [ebp - 0x10], ebx
je 0x40ec85
cmp byte [ebp + 0x7b], bl
jle 0x40ec85
cmp byte [ebp + 0x12], 1
je 0x40ec85
cmp byte [ebp + 0x12], 2
jne 0x40ec57
lea eax, [ebp - 0x18c]
push dword [eax + 8]
lea eax, [ebp - 0x2d4]
push dword [ebp - 0x128]
push str._force__exitcode_d__tree__d
push eax
call dword [sym.imp.user32.dll_wsprintfW]
mov ecx, dword [ebp + 0x4c]
add esp, 0x10
lea eax, [ebp - 0x2d4]
push eax
call fcn.00429d67
jmp 0x40ec85
cmp dword [ebp + 0x20], 0xffffff9c
je 0x40eab0
mov al, byte [0x4d92d4]
cmp al, bl
mov byte [ebp + 0x7b], al
jg 0x40eb45
cmp dword [ebp - 0x100], 2
jl 0x40eab0
cmp dword [ebp - 0xec], ebx
mov dword [ebp + 0x70], 0x3e8
jle 0x40eb7c
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xec]
jae 0x40eab0
mov ecx, dword [ebp - 0xec]
sub ecx, eax
cmp ecx, 0x3e8
jae 0x40eb7c
mov dword [ebp + 0x70], ecx
mov ecx, dword [ebp + 0x4c]
push 0x4ff
push dword [ebp + 0x70]
lea eax, [ebp - 0x1b0]
push ebx
push eax
push dword [ebp - 0xa0]
call fcn.00412ee2
mov ecx, dword [ebp - 0xa0]
dec ecx
cmp ecx, eax
je 0x40eab0
cmp dword [ebp - 0xa0], 1
jle 0x40ec4a
cmp eax, ebx
jne 0x40ec4a
lea eax, [edi + 0x100000]
cmp eax, esi
jl 0x40ebda
add esi, 0x100000
lea eax, [esi + 4]
push eax
lea ecx, [ebp + 0x50]
call fcn.004448de
mov eax, dword [ebp + 0x50]
push ebx
lea ecx, [ebp + 0x68]
push ecx
add eax, edi
push 1
push eax
lea eax, [ebp - 0x78]
push dword [eax]
mov dword [ebp + 0x68], ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x40ec4a
cmp dword [ebp + 0x68], ebx
jbe 0x40ec4a
add edi, dword [ebp + 0x68]
mov eax, dword [ebp + 0x50]
mov byte [eax + edi], bl
jmp 0x40ec4a
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.user32.dll_PeekMessageW]
test eax, eax
je 0x40eb2c
cmp dword [ebp - 0x288], 0x12
je 0x40eb2c
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.user32.dll_TranslateMessage]
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.user32.dll_DispatchMessageW]
cmp byte [0x4d92d4], bl
jg 0x40ec09
jmp 0x40eb2c
cmp dword [ebp - 0x104], ebx
je 0x40ec71
push dword [ebp - 0x128]
push dword [ebp - 0x104]
call dword [sym.imp.KERNEL32.DLL_TerminateJobObject]
push dword [ebp - 0x128]
lea eax, [ebp - 0x18c]
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18c]
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
cmp word [ebp + 0x34], bx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x74]
mov dword [ecx], eax
je 0x40eef1
mov eax, dword [ebp - 0x60]
mov ax, word [eax]
xor esi, esi
cmp ax, 0x40
je 0x40ecd1
cmp byte [ebp - 0x26], bl
je 0x40ecd1
cmp ax, 0x26
je 0x40eccb
mov eax, dword [ebp + 0x4c]
test byte [eax + 9], 0xf
je 0x40ecd1
mov byte [ebp + 0x77], 1
jmp 0x40ecd4
mov byte [ebp + 0x77], bl
lea ecx, [ebp - 0xb4]
call fcn.00402d41
cmp byte [ebp + 0x77], bl
mov eax, dword [ebp + 0x50]
mov dword [ebp + 0x70], eax
mov dword [ebp - 0xf4], edi
jne 0x40ee77
cmp byte [ebp + 0x46], 2
jne 0x40ed0c
mov dword [ebp - 0xf4], edi
mov word [eax + edi], bx
mov esi, dword [ebp + 0x50]
jmp 0x40eda0
cmp byte [ebp + 0x46], 1
lea ecx, [ebp - 0xb4]
jne 0x40ed3f
push dword [ebp - 0x94]
push edi
push eax
call fcn.00444acb
mov eax, dword [ebp - 0xb4]
push eax
mov dword [ebp + 0x70], eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
shl eax, 1
mov dword [ebp - 0xf4], eax
jmp 0x40eda4
lea eax, [edi + 0x18]
push eax
call fcn.00444a55
lea eax, [edi + 1]
push eax
push dword [ebp + 0x50]
mov dword [ebp - 0xac], edi
push dword [ebp - 0xb4]
mov dword [ebp - 0xb0], edi
call fcn.004143a0
mov eax, dword [ebp - 0xb4]
push 0x10
add edi, eax
push ebx
push edi
call fcn.004acf60
lea eax, [ebp - 0xb4]
push 0x2004
push eax
call fcn.0049cbe2
mov eax, dword [ebp - 0xb4]
mov dword [ebp + 0x70], eax
mov eax, dword [ebp - 0xb0]
add esp, 0x20
mov dword [ebp - 0xf4], eax
cmp esi, ebx
jne 0x40edaa
mov esi, dword [ebp - 0xb4]
test byte [ebp + 0x34], 4
je 0x40ede2
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea eax, [esi + eax*2 - 2]
jmp 0x40edd1
mov cx, word [eax]
cmp cx, 0xd
je 0x40edcc
cmp cx, 0xa
jne 0x40edd5
mov word [eax], bx
dec eax
dec eax
cmp eax, esi
jae 0x40edbd
sub eax, esi
mov dword [ebp - 0xf4], eax
jmp 0x40ee77
test byte [ebp + 0x34], 1
je 0x40ee37
mov edx, dword [ebp - 0x13c]
mov edi, dword [ebp - 0x138]
jmp 0x40ee2a
cmp ax, 0xd
jne 0x40ee14
lea ecx, [esi + 2]
cmp word [ecx], 0xa
jne 0x40ee14
cmp edi, ebx
jl 0x40ee1a
jg 0x40ee10
cmp edx, 1
jbe 0x40ee1a
mov esi, ecx
jmp 0x40ee1a
cmp ax, 0xa
jne 0x40ee28
add edx, 0xffffffff
adc edi, 0xffffffff
js 0x40ee32
jg 0x40ee28
cmp edx, ebx
jbe 0x40ee32
inc esi
inc esi
mov ax, word [esi]
cmp ax, bx
jne 0x40edf6
mov word [esi], bx
jmp 0x40ee6e
test byte [ebp + 0x34], 2
je 0x40ee77
jmp 0x40ee66
cmp ax, 0xd
je 0x40ee4f
cmp ax, 0xa
je 0x40ee4f
inc esi
inc esi
jmp 0x40ee66
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
shl eax, 1
push eax
lea eax, [esi + 2]
push eax
push esi
call fcn.00414356
add esp, 0xc
mov ax, word [esi]
cmp ax, bx
jne 0x40ee3f
sub esi, dword [ebp + 0x70]
mov dword [ebp - 0xf4], esi
cmp byte [ebp - 0x25], bl
je 0x40ee8f
lea eax, [ebp - 0xf8]
push eax
push dword [ebp + 0x70]
call fcn.0040877a
pop ecx
pop ecx
jmp 0x40ee92
mov eax, dword [ebp + 0x70]
mov ecx, dword [ebp - 0x60]
cmp word [ecx], 0x40
jne 0x40eeb8
mov ecx, dword [ebp + 0x4c]
push eax
push eax
push 0x4bfa2c
push dword [ebp - 0x84]
push dword [ebp - 0x84]
call fcn.0044136c
jmp 0x40eee3
cmp byte [ebp + 0x77], bl
je 0x40eed4
push ebx
push ebx
push dword [ebp - 0xf4]
push eax
push ecx
push dword [ebp + 0x4c]
call fcn.00451899
add esp, 0x18
jmp 0x40eee3
push dword [ebp - 0xb4]
push ecx
mov ecx, dword [ebp + 0x4c]
call fcn.0044414b
lea ecx, [ebp - 0xb4]
call fcn.0043e48d
mov eax, dword [ebp - 0x10]
push eax
mov dword [ebp + 0x14], eax
lea eax, [ebp - 0x394]
push 0x4c0b10
push eax
mov word [ebp - 0x394], bx
call dword [sym.imp.user32.dll_wsprintfW]
mov ecx, dword [ebp + 0x4c]
add esp, 0xc
lea eax, [ebp - 0x394]
push eax
push str.ERRORLEVEL
call fcn.0044414b
cmp dword [ebp - 0x104], ebx
je 0x40ef45
cmp byte [ebp + 0x12], 1
je 0x40ef45
push dword [ebp - 0x128]
push dword [ebp - 0x104]
call dword [sym.imp.KERNEL32.DLL_TerminateJobObject]
lea ecx, [ebp - 0xf8]
call fcn.0043e48d
lea ecx, [ebp + 0x50]
call fcn.0043e48d
mov ecx, dword [ebp + 0x7c]
cmp ecx, ebx
je 0x40ef69
lea eax, [ebp - 0x18c]
mov eax, dword [eax]
mov dword [ecx], eax
cmp byte [ebp + 0x13], bl
lea eax, [ebp - 0x18c]
mov dword [eax], ebx
je 0x40f0ad
cmp dword [eax + 8], ebx
je 0x40f0ad
cmp byte [0x4dace4], bl
jne 0x40f0ad
cmp dword [ebp + 0x20], ebx
mov byte [0x4dace4], 1
jne 0x40f038
push 0x1000
lea ecx, [ebp + 0x70]
call fcn.00402d2f
mov eax, dword [ebp + 0x70]
push ebx
mov dword [ebp + 0x78], ebx
mov word [eax], bx
lea eax, [ebp + 0x78]
push eax
lea eax, [ebp + 0x70]
push eax
push str.SystemStartOptions
push str.SYSTEMCurrentControlSetControl
push 0x80000002
call fcn.00449089
mov eax, dword [ebp + 0x70]
mov dword [ebp + 0x74], eax
lea eax, [ebp + 0x74]
push eax
call fcn.0043e425
add esp, 0x1c
jmp 0x40f01a
push 8
push eax
push str.PECMDHB
call fcn.0040f74f
add esp, 0xc
test al, al
jne 0x40f024
push 6
push dword [ebp + 0x74]
push str.WIMHB
call fcn.0040f74f
add esp, 0xc
test al, al
jne 0x40f024
lea eax, [ebp + 0x74]
push eax
call fcn.00409168
pop ecx
mov eax, dword [ebp + 0x74]
cmp word [eax], bx
jne 0x40efe6
jmp 0x40f02b
mov dword [ebp + 0x20], 1
lea ecx, [ebp + 0x70]
call fcn.0043e48d
cmp dword [ebp + 0x20], ebx
je 0x40f059
call fcn.0041a5a1
test eax, eax
je 0x40f050
push str.exec
push dword [ebp + 0x4c]
call fcn.0041a642
pop ecx
pop ecx
push ebx
call fcn.00416b9b
pop ecx
jmp 0x40f0ad
lea eax, [ebp - 0x18c]
push dword [eax + 8]
lea eax, [ebp - 0x338]
push str.__nfb__incmd_pecmd_TEAM_WAIT__InitSys__ncd__lu
push eax
call dword [sym.imp.user32.dll_wsprintfW]
lea eax, [ebp - 0x338]
push eax
push str.DELAY_bwinpeshl____s__r_n
push dword [ebp + 0x4c]
call fcn.00410fbb
mov ecx, dword [ebp + 0x4c]
add esp, 0x18
push 0x4dac04
push ebx
push ebx
push ebx
lea eax, [ebp + 0x76]
push eax
push dword [ebp + 0x4c]
lea eax, [ebp - 0x338]
push eax
mov word [ebp + 0x76], bx
call fcn.0040a660
mov ecx, dword [ebp - 0x58]
cmp ecx, ebx
je 0x40f0ca
cmp word [ecx], bx
je 0x40f0ca
lea eax, [ebp - 0x18c]
push dword [eax + 8]
push ecx
call fcn.00403916
pop ecx
pop ecx
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea esi, [ebp - 0x50]
mov eax, dword [esi]
cmp eax, ebx
je 0x40f0dc
push eax
call edi
mov dword [esi], ebx
lea esi, [ebp - 0x18]
mov eax, dword [esi]
cmp eax, ebx
je 0x40f0ea
push eax
call edi
mov dword [esi], ebx
lea esi, [ebp - 0xe0]
cmp dword [esi], ebx
je 0x40f0f9
push ebx
call edi
mov dword [esi], ebx
lea esi, [ebp - 0xdc]
mov eax, dword [esi]
cmp eax, ebx
je 0x40f10a
push eax
call edi
mov dword [esi], ebx
lea esi, [ebp - 0x78]
mov eax, dword [esi]
cmp eax, ebx
je 0x40f118
push eax
call edi
mov dword [esi], ebx
lea esi, [ebp - 0x8c]
mov eax, dword [esi]
cmp eax, ebx
je 0x40f129
push eax
call edi
cmp dword [ebp - 0x1d0], ebx
mov dword [esi], ebx
je 0x40f13b
push dword [ebp - 0x1d0]
call edi
lea esi, [ebp - 0x18c]
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x40f14b
push eax
call edi
mov ecx, dword [ebp + 0x4c]
push ebx
mov dword [esi + 4], ebx
call fcn.0046d51e
mov ebx, dword [ebp + 0x14]
lea ecx, [ebp - 0x120]
call fcn.0043e48d
lea ecx, [ebp - 0x12c]
call fcn.0043e48d
lea ecx, [ebp - 0x98]
call fcn.00402cb5
lea ecx, [ebp - 0x168]
call fcn.0043e48d
lea ecx, [ebp - 0xc8]
call fcn.00402cb5
lea ecx, [ebp - 0xc0]
call fcn.00402cb5
lea ecx, [ebp - 0xe0]
call fcn.00402cb5
lea ecx, [ebp - 0x18]
call fcn.00402cb5
lea ecx, [ebp - 0x50]
call fcn.00402cb5
lea ecx, [ebp - 0x8c]
call fcn.00402cb5
lea ecx, [ebp - 0xdc]
call fcn.00402cb5
lea ecx, [ebp - 0x78]
call fcn.00402cb5
lea ecx, [ebp - 0x58]
call fcn.0043e48d
lea ecx, [ebp - 0x1bc]
call fcn.0043e48d
lea ecx, [ebp - 0x10c]
call fcn.0043e48d
lea ecx, [ebp - 0x88]
call fcn.0043e48d
lea ecx, [ebp - 0x16c]
call fcn.0043e48d
lea ecx, [ebp - 0x110]
call fcn.0043e48d
lea ecx, [ebp - 0x130]
call fcn.0043e48d
lea ecx, [ebp - 0x164]
call fcn.0043e48d
lea ecx, [ebp - 0xe8]
call fcn.0043e48d
lea ecx, [ebp - 0x104]
call fcn.00402cb5
lea ecx, [ebp - 0x160]
call fcn.00402cb5
lea ecx, [ebp - 0x1cc]
call fcn.0040497e
lea ecx, [ebp - 0x198]
call fcn.0043e48d
lea ecx, [ebp - 0xb8]
call fcn.0043e48d
lea ecx, [ebp - 0xbc]
call fcn.0043e48d
lea ecx, [ebp - 0x60]
call fcn.0043e48d
lea ecx, [ebp - 0x158]
call fcn.0043e48d
lea ecx, [ebp - 0x140]
call fcn.0043e48d
lea ecx, [ebp - 0x154]
call fcn.0043e48d
lea ecx, [ebp - 0x15c]
call fcn.0043e48d
lea ecx, [ebp - 0x134]
call fcn.0043e48d
lea ecx, [ebp - 0x11c]
call fcn.0043e48d
pop edi
pop esi
mov eax, ebx
pop ebx
add ebp, 0x5c
leave
ret 0x1c