Function at 0x40f090
Capabilities:
Create process on windows
Get common file path
Self delete

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c72cd
mov eax, dword fs:[0]
push eax
sub esp, 0xff0
mov eax, dword [0x524ee0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [0x526340]
mov dword [ebp - 0xfb0], eax
mov eax, esi
imul eax, esi
imul eax, esi
cdq
mov ecx, 0x15
idiv ecx
cmp edx, 0xc
jne 0x40f144
test esi, esi
je 0x40f144
mov ecx, esi
and ecx, 0x80000001
jns 0x40f0f5
dec ecx
or ecx, 0xfffffffe
inc ecx
jne 0x40f102
mov eax, esi
cdq
sub eax, edx
mov esi, eax
sar esi, 1
jmp 0x40f109
lea esi, [esi*2 + 1]
mov eax, 0x55555556
imul esi
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, esi
lea eax, [eax + eax*2]
sub ecx, eax
mov dword [0x526340], esi
sub ecx, 0
je 0x40f133
sub ecx, 2
je 0x40f136
dec ecx
je 0x40f137
jmp 0x40f140
add esi, 2
inc esi
add esi, 2
mov dword [0x526340], esi
test esi, esi
jne 0x40f0e6
push 0
lea ecx, [ebp - 0xfc0]
call fcn.00444480
push str.success
lea ecx, [ebp - 0xfac]
mov dword [ebp - 4], 0
call fcn.00444440
lea eax, [ebp - 0xfac]
push eax
push 0x4dfc64
lea ecx, [ebp - 0xfc0]
mov byte [ebp - 4], 1
call fcn.00444920
mov ecx, eax
call fcn.00444730
lea ecx, [ebp - 0xfac]
mov byte [ebp - 4], 0
call fcn.00444690
call fcn.004187d0
test al, al
jne 0x40f1c4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x526340]
mov edx, 7
test eax, eax
cmove ecx, edx
mov dword [0x526340], ecx
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.004a9c90
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [0x524ab0]
mov ecx, 0x524ab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xf9c], eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xf9c]
push str.__s_
push eax
mov byte [ebp - 4], 2
call fcn.00406040
add esp, 0xc
call fcn.00450de0
test al, al
jne 0x40f241
lea eax, [ebp - 0xf7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov eax, dword [0x524ab0]
mov ecx, 0x524ab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xf88], eax
push 0xb
push str._echo_off_r_n
lea ecx, [ebp - 0xf88]
mov byte [ebp - 4], 3
call fcn.0040b920
mov eax, dword [0x524ab0]
mov ecx, 0x524ab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xf80], eax
mov ebx, str._GOTO_END_r_n
shr ebx, 0x10
mov byte [ebp - 4], 4
mov eax, str._GOTO_END_r_n
test ebx, ebx
jne 0x40f2b8
movzx esi, ax
push ebx
push esi
call fcn.00403b10
add esp, 8
test eax, eax
je 0x40f2ca
push esi
push eax
lea ecx, [ebp - 0xf80]
call fcn.004074c0
jmp 0x40f2ca
push 0xb
push str._GOTO_END_r_n
lea ecx, [ebp - 0xf80]
call fcn.00409670
mov eax, dword [0x524ab0]
mov ecx, 0x524ab0
mov byte [ebp - 4], 5
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xf84], eax
mov edi, str.IF_NOT_EXIST
shr edi, 0x10
mov byte [ebp - 4], 6
mov eax, str.IF_NOT_EXIST
test edi, edi
jne 0x40f319
movzx esi, ax
push edi
push esi
call fcn.00403b10
add esp, 8
test eax, eax
je 0x40f32b
push esi
push eax
lea ecx, [ebp - 0xf84]
call fcn.004074c0
jmp 0x40f32b
push 0xd
push str.IF_NOT_EXIST
lea ecx, [ebp - 0xf84]
call fcn.00409670
lea eax, [ebp - 0xf9c]
push eax
lea eax, [ebp - 0xf84]
push eax
lea eax, [ebp - 0xf90]
push eax
mov byte [ebp - 4], 7
call fcn.0040b600
lea ecx, [ebp - 0xf80]
push ecx
push eax
lea eax, [ebp - 0xf94]
push eax
mov byte [ebp - 4], 8
call fcn.0040b600
add esp, 0x18
mov eax, dword [eax]
lea ecx, [ebp - 0xf88]
push dword [eax - 0xc]
mov byte [ebp - 4], 9
push eax
call fcn.0040b920
mov edx, dword [ebp - 0xf94]
add edx, 0xfffffff0
or esi, 0xffffffff
mov byte [ebp - 4], 8
lea ecx, [edx + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x40f39f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xf90]
add edx, 0xfffffff0
mov byte [ebp - 4], 7
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f3c2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xf84]
add edx, 0xfffffff0
mov byte [ebp - 4], 5
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f3e5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xf80]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f408
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0xc
push str.SET__a_i0_r_n
lea ecx, [ebp - 0xf88]
call fcn.0040b920
push 9
push str.:REPEAT_r_n
lea ecx, [ebp - 0xf88]
call fcn.0040b920
push 0x16
push str.IF__i_100_GOTO_END_r_n
lea ecx, [ebp - 0xf88]
call fcn.0040b920
mov ecx, dword [0x526340]
lea eax, [ecx + 1]
imul eax, ecx
cdq
mov ecx, 0xf
idiv ecx
cmp edx, 3
jne 0x40f45d
dec dword [0x5266b8]
mov eax, dword [0x524ab0]
mov ecx, 0x524ab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xf84], eax
mov eax, 0x4e14dc
mov byte [ebp - 4], 0xa
test eax, 0xffff0000
jne 0x40f4a4
movzx esi, ax
push 0
push esi
call fcn.00403b10
add esp, 8
test eax, eax
je 0x40f4b6
push esi
push eax
lea ecx, [ebp - 0xf84]
call fcn.004074c0
jmp 0x40f4b6
push 2
push 0x4e14dc
lea ecx, [ebp - 0xf84]
call fcn.00409670
mov eax, dword [0x524ab0]
mov ecx, 0x524ab0
mov byte [ebp - 4], 0xb
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xf80], eax
mov eax, str.DEL
mov byte [ebp - 4], 0xc
test eax, 0xffff0000
jne 0x40f501
movzx esi, ax
push 0
push esi
call fcn.00403b10
add esp, 8
test eax, eax
je 0x40f513
push esi
push eax
lea ecx, [ebp - 0xf80]
call fcn.004074c0
jmp 0x40f513
push 4
push str.DEL
lea ecx, [ebp - 0xf80]
call fcn.00409670
lea eax, [ebp - 0xf9c]
push eax
lea eax, [ebp - 0xf80]
push eax
lea eax, [ebp - 0xf94]
push eax
mov byte [ebp - 4], 0xd
call fcn.0040b600
lea ecx, [ebp - 0xf84]
push ecx
push eax
lea eax, [ebp - 0xf90]
push eax
mov byte [ebp - 4], 0xe
call fcn.0040b600
add esp, 0x18
mov eax, dword [eax]
lea ecx, [ebp - 0xf88]
push dword [eax - 0xc]
mov byte [ebp - 4], 0xf
push eax
call fcn.0040b920
mov edx, dword [ebp - 0xf90]
add edx, 0xfffffff0
or esi, 0xffffffff
mov byte [ebp - 4], 0xe
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f587
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xf94]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xd
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f5aa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xf80]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xb
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f5cd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xf84]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f5f0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x524ab0]
mov ecx, 0x524ab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xf84], eax
mov byte [ebp - 4], 0x10
test ebx, ebx
jne 0x40f633
mov eax, str._GOTO_END_r_n
movzx esi, ax
push ebx
push esi
call fcn.00403b10
add esp, 8
test eax, eax
je 0x40f645
push esi
push eax
lea ecx, [ebp - 0xf84]
call fcn.004074c0
jmp 0x40f645
push 0xb
push str._GOTO_END_r_n
lea ecx, [ebp - 0xf84]
call fcn.00409670
mov eax, dword [0x524ab0]
mov ecx, 0x524ab0
mov byte [ebp - 4], 0x11
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xf80], eax
mov byte [ebp - 4], 0x12
test edi, edi
jne 0x40f68c
mov eax, str.IF_NOT_EXIST
movzx esi, ax
push edi
push esi
call fcn.00403b10
add esp, 8
test eax, eax
je 0x40f69e
push esi
push eax
lea ecx, [ebp - 0xf80]
call fcn.004074c0
jmp 0x40f69e
push 0xd
push str.IF_NOT_EXIST
lea ecx, [ebp - 0xf80]
call fcn.00409670
lea eax, [ebp - 0xf9c]
push eax
lea eax, [ebp - 0xf80]
push eax
lea eax, [ebp - 0xf94]
push eax
mov byte [ebp - 4], 0x13
call fcn.0040b600
lea ecx, [ebp - 0xf84]
push ecx
push eax
lea eax, [ebp - 0xf90]
push eax
mov byte [ebp - 4], 0x14
call fcn.0040b600
add esp, 0x18
mov eax, dword [eax]
lea ecx, [ebp - 0xf88]
push dword [eax - 0xc]
mov byte [ebp - 4], 0x15
push eax
call fcn.0040b920
mov edx, dword [ebp - 0xf90]
add edx, 0xfffffff0
or edi, 0xffffffff
mov byte [ebp - 4], 0x14
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f712
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xf94]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x13
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f735
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xf80]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x11
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f758
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xf84]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f77b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x21
push str.ping_1.1.1.1__n_1__w_1000___nul_r_n
lea ecx, [ebp - 0xf88]
call fcn.0040b920
push 0x10
push str.SET__a_i_i_1_r_n
lea ecx, [ebp - 0xf88]
call fcn.0040b920
push 0xd
push str.GOTO_REPEAT_r_n
lea ecx, [ebp - 0xf88]
call fcn.0040b920
push 6
push str.:END_r_n
lea ecx, [ebp - 0xf88]
call fcn.0040b920
push 8
push str.DEL__0_r_n
lea ecx, [ebp - 0xf88]
call fcn.0040b920
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004a9c90
add esp, 0xc
call fcn.004188e0
test al, al
jne 0x40f854
mov eax, dword [0x526340]
xor edx, edx
mov dword [ebp - 0xf80], edx
lea edi, [ebp - 0xe98]
xor ebx, ebx
lea esp, [esp]
inc ebx
cdq
xor esi, esi
idiv ebx
mov dword [ebp - 0xf94], ebx
mov dword [ebp - 0xf90], edx
lea ecx, [esi + 1]
mov esi, ecx
cmp esi, 0x10
jl 0x40f822
mov ebx, dword [ebp - 0xf94]
mov eax, dword [0x526340]
add edi, 0x10
cmp ebx, 0xe
jl 0x40f810
mov edx, dword [ebp - 0xf80]
inc edx
mov dword [ebp - 0xf80], edx
cmp edx, 0xc
jl 0x40f807
or edi, 0xffffffff
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
mov eax, dword [0x524ab0]
mov ecx, 0x524ab0
jne 0x40f913
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xf80], eax
push 0x2b
push str.createDeleteSelfBatchFile_error_GetTempPath
lea ecx, [ebp - 0xf80]
mov byte [ebp - 4], 0x16
call fcn.00409670
lea eax, [ebp - 0xf80]
push eax
lea eax, [ebp - 0xeb0]
push eax
call fcn.00451390
add esp, 8
push eax
lea ecx, [ebp - 0xfac]
mov byte [ebp - 4], 0x17
call fcn.004443a0
lea eax, [ebp - 0xfac]
push eax
push 0x4dfc64
lea ecx, [ebp - 0xfc0]
mov byte [ebp - 4], 0x18
call fcn.00444920
mov ecx, eax
call fcn.00444730
lea ecx, [ebp - 0xfac]
mov byte [ebp - 4], 0x17
call fcn.00444690
cmp dword [ebp - 0xe9c], 0x10
jb 0x40f908
push dword [ebp - 0xeb0]
call fcn.004a831e
add esp, 4
mov edx, dword [ebp - 0xf80]
jmp 0x40fdfe
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xf98], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 0x19
test eax, 0xffff0000
jne 0x40f951
movzx esi, ax
push 0
push esi
call fcn.00403b10
add esp, 8
test eax, eax
je 0x40f982
push esi
push eax
lea ecx, [ebp - 0xf98]
call fcn.004074c0
jmp 0x40f982
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f960
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0xf98]
call fcn.00409670
mov byte [ebp - 4], 0x1a
call fcn.00418910
test al, al
jne 0x40fa06
mov eax, dword [0x526340]
xor edx, edx
mov dword [ebp - 0xf80], edx
lea edi, [ebp - 0x3ec]
mov cl, al
xor ebx, ebx
sub cl, dl
mov byte [ebp - 0xf89], cl
mov edi, edi
inc ebx
cdq
xor esi, esi
idiv ebx
mov dword [ebp - 0xf94], ebx
mov dword [ebp - 0xf90], edx
mov ebx, edx
mov eax, dword [0x526340]
cdq
lea ecx, [esi + 1]
idiv ecx
imul bl
imul byte [ebp - 0xf89]
mov byte [edi + esi], al
mov esi, ecx
cmp esi, 0xd
jl 0x40f9c4
mov ebx, dword [ebp - 0xf94]
mov eax, dword [0x526340]
add edi, 0xd
cmp ebx, 0xc
jl 0x40f9b0
mov edx, dword [ebp - 0xf80]
inc edx
mov dword [ebp - 0xf80], edx
cmp edx, 3
jl 0x40f9a2
mov eax, dword [ebp - 0xf98]
mov edx, dword [eax - 0xc]
lea ecx, [edx - 1]
test ecx, ecx
js 0x410136
cmp ecx, edx
jg 0x410136
cmp word [eax + ecx*2], 0x5c
je 0x40fa3b
push 1
push 0x4dfbc0
lea ecx, [ebp - 0xf98]
call fcn.0040b920
lea eax, [ebp - 0xf94]
push eax
call fcn.004514f0
push str..bat
push eax
lea eax, [ebp - 0xf90]
push eax
mov byte [ebp - 4], 0x1b
call fcn.0040b6c0
add esp, 0x10
mov eax, dword [eax]
lea ecx, [ebp - 0xf98]
push dword [eax - 0xc]
mov byte [ebp - 4], 0x1c
push eax
call fcn.0040b920
mov edx, dword [ebp - 0xf90]
add edx, 0xfffffff0
or edi, 0xffffffff
mov byte [ebp - 4], 0x1b
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40fa9b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xf94]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x1a
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40fabe
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.004188e0
test al, al
jne 0x40facd
dec dword [0x5266c4]
lea eax, [ebp - 0xf88]
push eax
lea eax, [ebp - 0xeb0]
push eax
call fcn.00451390
add esp, 8
mov esi, eax
cmp dword [esi + 0x14], 0x10
mov byte [ebp - 4], 0x1d
jb 0x40faf1
mov esi, dword [esi]
mov eax, dword [0x524ab0]
mov ecx, 0x524ab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xf80], eax
mov byte [ebp - 4], 0x1e
test esi, esi
je 0x40fb4b
test esi, 0xffff0000
jne 0x40fb38
movzx esi, si
push 0
push esi
call fcn.00403b10
add esp, 8
test eax, eax
je 0x40fb5a
push esi
push eax
lea ecx, [ebp - 0xf80]
call fcn.0040bde0
jmp 0x40fb5a
mov ecx, esi
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40fb40
sub ecx, edx
jmp 0x40fb4d
xor ecx, ecx
push ecx
push esi
lea ecx, [ebp - 0xf80]
call fcn.0040c230
lea eax, [ebp - 0xf80]
push eax
lea eax, [ebp - 0xf98]
push eax
mov byte [ebp - 4], 0x1f
call fcn.00435b90
mov edx, dword [ebp - 0xf80]
add esp, 8
test al, al
sete bl
add edx, 0xfffffff0
mov byte [ebp - 4], 0x1d
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40fb9c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0xe9c], 0x10
mov byte [ebp - 4], 0x1a
jb 0x40fbb7
push dword [ebp - 0xeb0]
call fcn.004a831e
add esp, 4
test bl, bl
je 0x40fc8b
mov eax, dword [0x524ab0]
mov ecx, 0x524ab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xf80], eax
mov byte [ebp - 4], 0x20
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xf80]
push str.createDeleteSelfBatchFile_error_WriteToFile__d
push eax
call fcn.00406040
lea eax, [ebp - 0xf80]
push eax
lea eax, [ebp - 0xeb0]
push eax
call fcn.00451390
add esp, 0x14
push eax
lea ecx, [ebp - 0xfac]
mov byte [ebp - 4], 0x21
call fcn.004443a0
lea eax, [ebp - 0xfac]
push eax
push 0x4dfc64
lea ecx, [ebp - 0xfc0]
mov byte [ebp - 4], 0x22
call fcn.00444920
mov ecx, eax
call fcn.00444730
lea ecx, [ebp - 0xfac]
mov byte [ebp - 4], 0x21
call fcn.00444690
cmp dword [ebp - 0xe9c], 0x10
jb 0x40fc5f
push dword [ebp - 0xeb0]
call fcn.004a831e
add esp, 4
mov edx, dword [ebp - 0xf80]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x1a
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40fdf8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x40fdf8
push 0x3c
lea eax, [ebp - 0xffc]
push 0
push eax
call fcn.004a9c90
mov eax, dword [ebp - 0xf98]
mov ebx, dword [0x526340]
mov dword [ebp - 0xfec], eax
mov eax, ebx
imul eax, ebx
cdq
mov ecx, 0x12
idiv ecx
add esp, 0xc
mov dword [ebp - 0xffc], 0x3c
mov dword [ebp - 0xff0], str.open
cmp edx, 0xe
jne 0x40fce4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov dword [0x526340], ebx
lea eax, [ebx + 1]
imul eax, ebx
cdq
mov ecx, 6
idiv ecx
mov dword [ebp - 0xfe0], 0
cmp edx, 4
jne 0x40fd6b
mov eax, ebx
cdq
lea esi, [ecx + 0x28]
xor ecx, ecx
sub eax, edx
sar eax, 1
mov dword [ebp - 0xf84], ecx
mov dword [ebp - 0xf80], eax
lea esp, [esp]
test eax, eax
jle 0x40fd5d
mov eax, ebx
mov ebx, dword [ebp - 0xf80]
cdq
and edx, 3
lea edi, [edx + eax]
sar edi, 2
xor edx, edx
test edi, edi
jle 0x40fd4c
mov eax, edx
mov ecx, edi
add esi, eax
dec eax
dec ecx
jne 0x40fd40
mov ecx, dword [ebp - 0xf84]
add edx, ecx
dec ebx
jne 0x40fd38
mov ebx, dword [0x526340]
mov eax, dword [ebp - 0xf80]
inc ecx
mov dword [ebp - 0xf84], ecx
cmp ecx, esi
jl 0x40fd20
or edi, 0xffffffff
mov dword [ebp - 0xff8], 0x440
call fcn.004187d0
test al, al
jne 0x40fdeb
xor eax, eax
push 0x1fe
push eax
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push eax
call fcn.004a9c90
add esp, 0xc
xor edi, edi
xor esi, esi
xor edx, edx
test edi, edi
je 0x40fdca
test edx, edx
je 0x40fdca
lea eax, [edx + esi]
lea ecx, [ebp - 0x418]
lea ecx, [ecx + eax*2]
lea eax, [edx + esi]
mov ax, word [ebp + eax*2 - 0x438]
inc ax
add ax, word [ecx - 2]
mov word [ecx], ax
inc edx
cmp edx, 0x10
jl 0x40fda2
add esi, 0x10
inc edi
cmp esi, 0x100
jl 0x40fda0
movsx eax, word [ebp - 0x21a]
mov dword [0x526340], eax
or edi, 0xffffffff
lea eax, [ebp - 0xffc]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edx, dword [ebp - 0xf98]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40fe1b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xf88]
add edx, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40fe3e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xf9c]
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40fe61
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [0x526340]
mov eax, esi
imul eax, esi
cdq
mov ecx, 0x17
idiv ecx
cmp edx, 0xf
jne 0x40feb1
mov eax, 0x51eb851f
imul esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x64
sub esi, ecx
xor ecx, ecx
lea eax, [esi + 0x63]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a7aa0
push eax
call fcn.004a98f0
add esp, 8
lea ecx, [ebp - 0xed0]
call fcn.004465d0
mov eax, dword [0x524ab0]
mov ecx, 0x524ab0
mov byte [ebp - 4], 0x23
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0xf80], esi
lea eax, [ebp - 0xfc0]
push eax
lea eax, [ebp - 0xeb0]
push eax
lea ecx, [ebp - 0xed0]
mov byte [ebp - 4], 0x24
call fcn.00449500
mov edx, eax
cmp dword [edx + 0x14], 0x10
mov byte [ebp - 4], 0x25
jb 0x40ff01
mov edx, dword [edx]
sub esp, 0x18
mov edi, esp
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
cmp byte [edx], 0
jne 0x40ff20
xor ecx, ecx
jmp 0x40ff2e
mov ecx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ff25
sub ecx, ebx
push ecx
push edx
mov ecx, edi
call fcn.00401460
lea eax, [ebp - 0xf90]
push eax
call fcn.004512c0
add esp, 0x1c
mov eax, dword [eax]
lea ebx, [esi - 0x10]
lea edi, [eax - 0x10]
mov byte [ebp - 4], 0x26
cmp edi, ebx
je 0x410003
cmp dword [ebx + 0xc], 0
jl 0x40ffee
mov ecx, dword [edi]
cmp ecx, dword [ebx]
jne 0x40ffee
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
mov ecx, eax
jl 0x40ff8f
cmp ecx, dword [edi]
jne 0x40ff8f
mov esi, edi
mov eax, 1
lock xadd dword [edx], eax
jmp 0x40ffcc
mov eax, dword [ecx]
push 2
push dword [edi + 4]
call dword [eax]
mov esi, eax
test esi, esi
jne 0x40ffa3
call fcn.00409970
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [edi + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [esi + 0x10]
push eax
call fcn.004a98f5
add esp, 0x10
or eax, 0xffffffff
lea ecx, [ebx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x40ffe3
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0x10
mov dword [ebp - 0xf80], esi
jmp 0x410003
push dword [eax - 0xc]
lea ecx, [ebp - 0xf80]
push eax
call fcn.00409670
mov esi, dword [ebp - 0xf80]
mov edx, dword [ebp - 0xf90]
add edx, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 4], 0x25
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x410029
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0xe9c], 0x10
mov byte [ebp - 4], 0x24
jb 0x410044
push dword [ebp - 0xeb0]
call fcn.004a831e
add esp, 4
mov edi, dword [ebp - 0xfb0]
mov eax, 8
mov word [edi], ax
push dword [esi - 0xc]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
test eax, eax
jne 0x410065
call fcn.00409970
mov dword [edi + 8], eax
mov ecx, dword [0x526340]
lea edx, [ecx + 2]
lea eax, [ecx + 1]
imul edx, eax
imul edx, ecx
and edx, 0x8000000f
jns 0x410087
dec edx
or edx, 0xfffffff0
inc edx
cmp edx, 1
jne 0x4100a2
call fcn.004a96f9
mov ecx, dword [0x526340]
cmp ecx, eax
jne 0x4100a2
dec ecx
mov dword [0x526340], ecx
add esi, 0xfffffff0
mov byte [ebp - 4], 0x23
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x4100bd
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0xeb8], 0x10
mov byte [ebp - 4], 0
mov dword [ebp - 0xed0], 0x4dfc5c
jb 0x4100e2
push dword [ebp - 0xecc]
call fcn.004a831e
add esp, 4
lea ecx, [ebp - 0xed0]
mov dword [ebp - 0xeb8], 0xf
mov dword [ebp - 0xebc], 0
mov byte [ebp - 0xecc], 0
call fcn.004466d0
lea ecx, [ebp - 0xfc0]
mov dword [ebp - 4], 0xffffffff
call fcn.00444690
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a8b24
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00404410
int3