Function at 0x406b20
Capabilities:
Acquire debug privileges
Check for time delay via gettickcount
Connect pipe
Create directory
Create pipe
Create process on windows
Parse credit card information
Persist via run registry key
Query environment variable
Read file on windows
Resume thread
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
lea ebp, [esp - 0x60]
sub esp, 0x37c
push ebx
push esi
mov dword [ebp + 0x50], ecx
push edi
lea ecx, [ebp - 0xe0]
call fcn.0042e1c4
xor ebx, ebx
cmp dword [ebp + 0x68], ebx
je 0x406b64
push dword [ebp + 0x68]
lea ecx, [ebp - 0xe0]
call fcn.0043a57e
mov eax, dword [ebp - 0xe0]
mov dword [ebp + 0x68], eax
lea eax, [ebp + 0x68]
push eax
call fcn.00428a5b
pop ecx
lea ecx, [ebp - 0xdc]
call fcn.0042e1c4
mov esi, dword [ebp + 0x70]
cmp esi, ebx
je 0x406b88
push esi
lea ecx, [ebp - 0xdc]
call fcn.0043a57e
mov esi, dword [ebp - 0xdc]
cmp dword [ebp + 0x78], ebx
jne 0x406b96
lea eax, [ebp - 0xcc]
mov dword [ebp + 0x78], eax
mov eax, dword [ebp + 0x68]
cmp eax, ebx
mov dword [ebp + 0x44], eax
jne 0x406ba3
mov dword [ebp + 0x68], esi
mov eax, dword [ebp + 0x74]
lea ecx, [ebp - 0xc8]
mov dword [ebp - 0x18], eax
mov byte [ebp + 0x3f], bl
mov byte [ebp + 0x73], bl
mov byte [ebp + 0x4d], bl
mov byte [ebp - 0x23], 1
mov byte [ebp - 0x24], bl
mov byte [ebp + 0x43], bl
mov byte [ebp + 0x4b], bl
mov byte [ebp - 0x25], bl
mov byte [ebp - 0x22], bl
mov byte [ebp + 0x4a], bl
mov byte [ebp + 0x4e], bl
mov byte [ebp - 0x1a], bl
mov byte [ebp - 0x21], bl
call fcn.0042e1c4
lea ecx, [ebp - 0xec]
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 0xf0], ebx
mov byte [ebp - 0x19], bl
mov byte [ebp + 0x4c], bl
mov byte [ebp + 2], bl
mov byte [ebp - 0x1b], bl
mov dword [ebp - 0x20], ebx
mov dword [ebp + 0x24], ebx
call fcn.0042e1c4
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x40], ebx
mov byte [ebp + 0x77], bl
call fcn.0042e1c4
lea ecx, [ebp - 0x80]
call fcn.0042e1c4
lea ecx, [ebp - 0x6c]
call fcn.0042e1c4
or dword [ebp - 0xac], 0xffffffff
lea ecx, [ebp - 0x100]
mov byte [ebp + 3], bl
mov dword [ebp - 0xd4], ebx
call fcn.0042e1c4
xor eax, eax
push 0xf
pop ecx
mov dword [ebp - 0x23c], 0x44
mov dword [ebp - 0x238], ebx
lea edi, [ebp - 0x234]
rep stosd dword es:[edi], eax
push 0x11
mov dword [ebp - 0x13c], ebx
pop ecx
lea edi, [ebp - 0x1f8]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x138]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
cmp esi, ebx
lea edi, [ebp - 0x12c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x58], ebx
mov dword [ebp + 0x1c], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xbc], ebx
je 0x406c9a
test byte [0x49e003], 3
je 0x406cb6
push 0x485584
lea ecx, [ebp - 0xbc]
call fcn.0043a57e
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x234], eax
cmp esi, ebx
je 0x406ccb
cmp word [esi], 0x24
jne 0x406ccb
mov dword [ebp - 0x18], 1
mov byte [ebp + 0x4b], 1
xor ecx, ecx
inc ecx
cmp esi, ebx
push 2
mov dword [ebp - 0x50], ebx
pop edi
je 0x406d4c
cmp word [esi], 0x7c
jne 0x406ce6
add dword [ebp + 0x68], edi
add esi, edi
mov dword [ebp - 0x50], ecx
cmp esi, ebx
je 0x406d4c
cmp word [esi], 0x2a
jne 0x406d4c
add dword [ebp + 0x68], edi
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x7c
mov byte [ebp + 0x73], 0x10
jne 0x406d06
add dword [ebp + 0x68], edi
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
cmp ax, 0x31
jne 0x406d18
mov byte [ebp + 0x73], 0x11
jmp 0x406d33
mov edx, eax
or edx, 0x20
cmp dx, 0x6e
jne 0x406d29
mov byte [ebp + 0x73], 0x12
jmp 0x406d33
cmp ax, 0x2d
jne 0x406d36
mov byte [ebp + 0x73], 0x14
add dword [ebp + 0x68], edi
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
call fcn.0040ac1b
test al, al
jne 0x406d4c
mov ebx, ecx
jmp 0x409dfc
lea eax, [ebp + 0x68]
push eax
call fcn.00428a5b
cmp byte [ebp + 0x73], bl
pop ecx
jne 0x406def
lea eax, [ebp + 0x68]
push eax
call fcn.00428a5b
cmp dword [ebp - 0x58], ebx
mov eax, dword [ebp + 0x68]
pop ecx
mov dword [ebp + 0x54], eax
je 0x406d7d
cmp byte [ebp + 0x73], bl
jne 0x406ec2
cmp word [eax], 0x2d
mov esi, eax
jne 0x406d91
add eax, 2
cmp word [eax], 0x2d
jne 0x406d91
mov dword [ebp + 0x54], eax
push 1
lea eax, [ebp + 0x54]
push eax
push 0x485580
call fcn.0042fc5f
add esp, 0xc
test al, al
jne 0x406ec2
mov eax, dword [ebp + 0x54]
mov ax, word [eax]
cmp ax, 0x2d
je 0x406dc2
cmp ax, 0x2f
jne 0x406ec2
add dword [ebp + 0x54], edi
push 5
lea eax, [ebp + 0x54]
push eax
push str.catch
call fcn.0042fca2
add esp, 0xc
test al, al
je 0x406e6d
mov al, byte [ebp + 0x73]
or byte [ebp + 0x73], 0x10
cmp al, bl
jne 0x407050
mov edi, dword [ebp + 0x68]
xor ecx, ecx
xor eax, eax
mov ax, word [edi]
inc ecx
cmp ax, bx
mov dword [ebp - 0x18], ecx
mov esi, edi
je 0x406d45
push 2
pop edx
cmp ax, 0x3d
je 0x406e1b
add esi, edx
mov ax, word [esi]
cmp ax, bx
jne 0x406e0b
cmp esi, edi
je 0x406d45
cmp word [esi], 0x3d
jne 0x406d45
sub esi, edx
cmp word [esi], 0x2b
jne 0x406e3c
mov al, byte [esi]
mov byte [ebp - 0x19], al
sub esi, edx
cmp esi, edi
mov ecx, esi
jbe 0x406e54
mov ax, word [ecx]
call fcn.0040ac1b
test al, al
je 0x406e54
sub ecx, edx
cmp ecx, edi
ja 0x406e42
mov ax, word [ecx]
call fcn.0040ac1b
test al, al
jne 0x4070ee
mov edx, ecx
inc ecx
inc ecx
jmp 0x40707d
push 4
push dword [ebp + 0x54]
push str.cmd:
call fcn.0042996a
add esp, 0xc
test al, al
je 0x406fce
add dword [ebp + 0x54], 8
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp + 0x54]
push eax
push dword [ebp + 0x50]
call fcn.00403923
add esp, 0x10
mov dword [ebp - 0x58], eax
jmp 0x406eb4
mov word [esi], 0x20
add esi, edi
cmp esi, dword [ebp + 0x54]
jb 0x406ead
cmp byte [ebp + 0x73], bl
je 0x407050
lea eax, [ebp + 0x68]
push eax
call fcn.00428a5b
mov eax, dword [ebp - 0x58]
cmp eax, ebx
pop ecx
je 0x406edb
cmp word [eax], bx
jne 0x406edb
mov dword [ebp - 0x58], ebx
cmp dword [ebp - 0x50], ebx
jne 0x406ee8
cmp dword [ebp + 0x7c], ebx
mov byte [ebp + 0x5b], bl
je 0x406eec
mov byte [ebp + 0x5b], 1
xor edi, edi
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp + 0x34], edi
mov dword [ebp + 0x14], ebx
call fcn.0042e1c4
lea ecx, [ebp - 0xb4]
call fcn.0042e1c4
lea ecx, [ebp - 0xd0]
call fcn.0042e1c4
cmp byte [ebp + 0x5b], bl
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0xb8], ebx
mov byte [ebp + 0x4f], bl
mov dword [ebp + 0x30], ebx
jne 0x406f5b
cmp dword [ebp + 0x44], ebx
jne 0x406f5b
mov ecx, dword [ebp + 0x50]
push 1
push ebx
lea eax, [ebp - 0xb8]
push eax
push dword [ebp + 0x68]
call fcn.00437546
mov eax, dword [ebp - 0xb8]
mov dword [ebp + 0x68], eax
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x2d
mov dword [ebp - 0x84], eax
jne 0x406f76
add eax, 2
cmp word [eax], 0x2d
jne 0x406f76
mov dword [ebp + 0x68], eax
push 1
lea eax, [ebp + 0x68]
push eax
push 0x485580
call fcn.0042fc5f
add esp, 0xc
test al, al
jne 0x4079e3
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
cmp ax, 0x2d
je 0x406fa7
cmp ax, 0x2f
jne 0x4079e3
push 2
pop esi
add dword [ebp + 0x68], esi
push 5
lea eax, [ebp + 0x68]
push eax
push str.catch
call fcn.0042fc5f
add esp, 0xc
test al, al
je 0x4070f6
mov byte [ebp + 0x73], 0x10
jmp 0x406f5b
push 3
push dword [ebp + 0x54]
push 0x48556c
call fcn.0042996a
add esp, 0xc
test al, al
je 0x406ff8
add dword [ebp + 0x54], 6
jmp 0x406fed
add dword [ebp + 0x54], edi
mov eax, dword [ebp + 0x54]
cmp word [eax], 0x2a
je 0x406fea
jmp 0x40702e
push 4
push dword [ebp + 0x54]
push 0x485564
call fcn.0042996a
add esp, 0xc
test al, al
je 0x407014
add dword [ebp + 0x54], 8
jmp 0x40702e
push 5
push dword [ebp + 0x54]
push str.logs:
call fcn.0042996a
add esp, 0xc
test al, al
je 0x407050
add dword [ebp + 0x54], 0xa
mov eax, dword [ebp + 0x54]
cmp word [eax], 0x22
jne 0x407050
add dword [ebp + 0x54], edi
jmp 0x407045
add dword [ebp + 0x54], edi
cmp ax, 0x22
je 0x407050
mov eax, dword [ebp + 0x54]
mov ax, word [eax]
cmp ax, bx
jne 0x40703c
lea eax, [ebp + 0x54]
push eax
call fcn.00404037
mov eax, dword [ebp + 0x54]
pop ecx
jmp 0x406d7d
lea eax, [edx - 2]
mov dword [ebp - 0x84], eax
mov ax, word [eax]
call fcn.0040ac1b
test al, al
jne 0x407081
mov edx, dword [ebp - 0x84]
cmp edx, edi
ja 0x407062
sub ecx, edx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.0042e2ea
mov edi, dword [ebp + 0x50]
push ebx
lea eax, [ebp - 0x2c]
push eax
mov ecx, edi
call fcn.00402bdd
cmp byte [edi + 0x92], bl
jne 0x4070ac
test byte [edi + 0xb], 0xf
je 0x4070c2
push ebx
lea eax, [ebp - 0x2c]
push eax
mov ecx, edi
call fcn.00402bdd
jmp 0x4070c2
cmp ax, 0x3d
je 0x4070d0
inc esi
inc esi
mov ax, word [esi]
cmp ax, bx
jne 0x4070ba
cmp ax, 0x3d
jne 0x4070ee
lea eax, [ebp - 0xd4]
add esi, 2
push eax
mov dword [ebp - 0xd4], esi
call fcn.00428a5b
pop ecx
push 2
pop edi
jmp 0x406d5f
xor ebx, ebx
inc ebx
jmp 0x409dfc
push 6
push dword [ebp + 0x68]
push str.clone:
call fcn.0042996a
add esp, 0xc
test al, al
je 0x40713d
add dword [ebp + 0x68], 0xc
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403ff2
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
pop ecx
je 0x40712c
mov word [eax], bx
add dword [ebp + 0x68], 2
cmp word [esi], bx
je 0x407843
mov dword [ebp + 0x1c], esi
jmp 0x407843
push 9
push dword [ebp + 0x68]
push str.runrmenu:
call fcn.0042996a
add esp, 0xc
test al, al
je 0x407186
add dword [ebp + 0x68], 0x12
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403ff2
mov eax, dword [ebp + 0x68]
pop ecx
sub eax, esi
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0xc8]
call fcn.0042e2ea
lea eax, [ebp + 0x68]
push eax
call fcn.00428a5b
jmp 0x4079dd
push 8
push dword [ebp + 0x68]
push str.poprmenu
call fcn.0042996a
add esp, 0xc
test al, al
je 0x407236
add dword [ebp + 0x68], 0x10
mov eax, dword [ebp + 0x68]
mov dword [ebp + 0x28], eax
lea eax, [ebp + 0x68]
push eax
call fcn.00403ff2
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
pop ecx
je 0x4071bf
add dword [ebp + 0x68], esi
lea eax, [ebp + 0x68]
push eax
call fcn.00428a5b
pop ecx
lea eax, [ebp - 0xf4]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp + 0x28]
mov ax, word [eax]
cmp ax, bx
mov byte [ebp - 0x1a], 1
je 0x4071f4
cmp ax, 0x30
jb 0x4071f1
cmp ax, 0x39
jbe 0x4071f4
add dword [ebp + 0x28], esi
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp + 0x28]
push eax
call fcn.00430ad7
mov eax, dword [ebp + 0x28]
mov ax, word [eax]
cmp ax, bx
pop ecx
pop ecx
je 0x407220
cmp ax, 0x30
jb 0x40721d
cmp ax, 0x39
jbe 0x407220
add dword [ebp + 0x28], esi
lea eax, [ebp - 0xf0]
push eax
lea eax, [ebp + 0x28]
push eax
call fcn.00430ad7
pop ecx
jmp 0x4079dd
push 4
pop esi
push esi
push dword [ebp + 0x68]
push str.pid:
call fcn.0042996a
add esp, 0xc
test al, al
je 0x407275
add dword [ebp + 0x68], 8
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403ff2
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x407843
lea ecx, [ebp - 0xd8]
jmp 0x407838
push esi
push dword [ebp + 0x68]
push 0x485564
call fcn.0042996a
add esp, 0xc
test al, al
je 0x407369
mov eax, dword [ebp + 0x68]
add eax, 8
mov dword [ebp + 0x68], eax
mov cx, word [eax]
xor edx, edx
cmp cx, 0x23
mov esi, eax
mov dword [ebp - 0xc], ebx
jne 0x4072ae
mov dword [ebp + 0x30], 1
cmp cx, 0x22
jne 0x407325
lea edi, [eax + 2]
mov esi, eax
mov ecx, edi
jmp 0x4072e3
cmp ax, 0x22
jne 0x4072e1
inc edx
test dl, 1
je 0x4072e1
xor eax, eax
mov ax, word [ecx + 2]
cmp ax, bx
je 0x4072ee
call fcn.0040ac1b
test al, al
jne 0x4072ee
or dword [ebp + 0x30], 2
inc ecx
inc ecx
mov dword [ebp + 0x68], ecx
mov ax, word [ecx]
cmp ax, bx
jne 0x4072bd
push 0x22
pop edx
cmp word [ecx], dx
jne 0x407332
or dword [ebp - 0xc], 0xffffffff
inc ecx
inc ecx
mov dword [ebp + 0x68], ecx
cmp word [ecx - 4], dx
mov esi, edi
mov byte [ebp + 0x4f], 2
je 0x407319
mov ax, word [esi]
cmp ax, dx
jne 0x407332
cmp word [esi + 2], dx
jne 0x40731e
mov byte [ebp + 0x4f], bl
jmp 0x407332
cmp ax, dx
jne 0x407332
jmp 0x407319
lea eax, [ebp + 0x68]
push eax
call fcn.00403ff2
pop ecx
mov ecx, dword [ebp + 0x68]
sub ecx, esi
sar ecx, 1
add dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], ebx
jle 0x407843
add esi, 0xfffffff6
push esi
lea ecx, [ebp - 0xb0]
call fcn.0043a57e
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xc]
add eax, 0xa
mov dword [ebp + 0x34], eax
mov word [eax + ecx*2], bx
jmp 0x407843
push 3
push dword [ebp + 0x68]
push 0x48556c
call fcn.0042996a
add esp, 0xc
test al, al
je 0x40744e
mov eax, dword [ebp + 0x68]
xor esi, esi
add eax, 6
jmp 0x407390
inc esi
inc eax
inc eax
mov dword [ebp + 0x68], eax
cmp word [eax], 0x2a
je 0x40738d
cmp esi, 2
mov dword [ebp - 0x110], eax
mov dword [ebp - 8], ebx
jge 0x407414
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.004149d8
add esp, 0xc
cmp dword [ebp - 8], ebx
mov dword [ebp + 0x68], eax
jle 0x4073db
push dword [ebp - 8]
lea ecx, [ebp - 0x30]
push dword [ebp - 0x110]
call fcn.0042e2ea
mov eax, dword [ebp - 0x30]
mov dword [ebp + 0x14], eax
cmp esi, 1
jne 0x407843
cmp dword [ebp - 8], ebx
jle 0x407843
mov eax, dword [ebp - 0x30]
push esi
lea ecx, [ebp - 0x30]
push ecx
push eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x30], ebx
call fcn.0043897f
add esp, 0xc
lea ecx, [ebp - 0x74]
mov dword [ebp + 0x14], eax
call fcn.00428a48
jmp 0x407843
push 0x105
lea ecx, [ebp - 0x30]
call fcn.0042e20b
push 0x104
push dword [ebp - 0x30]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push ebx
push dword [ebp - 0x30]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
je 0x407443
mov word [eax], bx
mov eax, dword [ebp - 0x30]
mov dword [ebp + 0x14], eax
jmp 0x407843
push 5
push dword [ebp + 0x68]
push str.logs:
call fcn.0042996a
add esp, 0xc
test al, al
je 0x4074c7
mov eax, dword [ebp + 0x68]
add eax, 0xa
xor ecx, ecx
mov dword [ebp + 0x68], eax
mov dword [ebp - 0x4c], eax
cmp word [eax], 0x3f
sete cl
mov esi, ecx
cmp esi, ebx
je 0x407485
add eax, 2
mov dword [ebp - 0x4c], eax
mov edi, eax
push 1
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp + 0x10], ebx
call fcn.004149d8
add esp, 0xc
cmp dword [ebp + 0x10], ebx
mov dword [ebp + 0x68], eax
jle 0x407843
cmp esi, ebx
je 0x4074b8
cmp dword [0x49adec], ebx
je 0x407843
push dword [ebp + 0x10]
lea ecx, [ebp - 0xec]
push edi
jmp 0x40783e
push 5
lea eax, [ebp + 0x68]
push eax
push str.nowin
call fcn.0042fc5f
add esp, 0xc
test al, al
je 0x4074e7
mov byte [ebp - 0x21], 1
jmp 0x406f5b
push esi
lea eax, [ebp + 0x68]
push eax
push 0x485524
call fcn.0042fc5f
add esp, 0xc
test al, al
je 0x407509
mov dword [ebp - 0x20], 0x10000000
jmp 0x406f5b
push esi
lea eax, [ebp + 0x68]
push eax
push 0x48551c
call fcn.0042fc5f
add esp, 0xc
test al, al
je 0x40752b
mov dword [ebp - 0x18], 1
jmp 0x406f5b
push 3
lea eax, [ebp + 0x68]
push eax
push 0x485518
call fcn.0042fc5f
add esp, 0xc
test al, al
je 0x40754b
or byte [ebp + 0x4d], 1
jmp 0x406f5b
push esi
lea eax, [ebp + 0x68]
push eax
push 0x485510
call fcn.0042fc5f
add esp, 0xc
test al, al
je 0x40756a
or byte [ebp + 0x4d], 3
jmp 0x406f5b
push 5
lea eax, [ebp + 0x68]
push eax
push str.limit
call fcn.0042fc5f
add esp, 0xc
test al, al
je 0x40758a
mov byte [ebp - 0x22], 1
jmp 0x406f5b
push 3
lea eax, [ebp + 0x68]
push eax
push 0x485504
call fcn.0042fc5f
add esp, 0xc
test al, al
je 0x4075aa
mov byte [ebp + 0x4a], 1
jmp 0x406f5b
push esi
lea eax, [ebp + 0x68]
push eax
push str.hook
call fcn.0042fc5f
add esp, 0xc
test al, al
je 0x4075c9
mov byte [ebp + 0x4b], 1
jmp 0x406f5b
push 3
lea eax, [ebp + 0x68]
push eax
push 0x4854f8
call fcn.0042fc5f
add esp, 0xc
test al, al
je 0x4075ec
mov dword [ebp - 0x20], 6
jmp 0x406f5b
push 3
lea eax, [ebp + 0x68]
push eax
push 0x4854f4
call fcn.0042fc5f
add esp, 0xc
test al, al
je 0x40760f
mov dword [ebp - 0x20], 3
jmp 0x406f5b
push esi
lea eax, [ebp + 0x68]
push eax
push str.show
call fcn.0042fc5f
add esp, 0xc
test al, al
je 0x407631
mov dword [ebp - 0x20], 1
jmp 0x406f5b
push esi
lea eax, [ebp + 0x68]
push eax
push 0x4854e4
call fcn.0042fc5f
add esp, 0xc
test al, al
je 0x407650
mov byte [ebp - 0x25], 1
jmp 0x406f5b
push esi
lea eax, [ebp + 0x68]
push eax
push str.no64
call fcn.0042fc5f
add esp, 0xc
test al, al
je 0x40766e
mov byte [ebp - 0x23], bl
jmp 0x406f5b
push 3
lea eax, [ebp + 0x68]
push eax
push 0x4854d8
call fcn.0042fc5f
add esp, 0xc
test al, al
je 0x40768e
mov byte [ebp - 0x24], 1
jmp 0x406f5b
push 2
lea eax, [ebp + 0x68]
push eax
push 0x4854d4
call fcn.0042fc5f
add esp, 0xc
test al, al
je 0x4076ae
mov byte [ebp + 0x43], 1
jmp 0x406f5b
push 3
push dword [ebp + 0x68]
push 0x4854d0
call fcn.0042996a
add esp, 0xc
test al, al
je 0x407700
add dword [ebp + 0x68], 6
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x3a
mov byte [ebp + 0x4e], 1
jne 0x407843
add dword [ebp + 0x68], 2
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403ff2
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x407843
lea ecx, [ebp - 0xb4]
jmp 0x407838
push 5
push dword [ebp + 0x68]
push str.code:
call fcn.0042996a
add esp, 0xc
test al, al
je 0x4077b5
add dword [ebp + 0x68], 0xa
mov eax, dword [ebp + 0x68]
mov dword [ebp + 0x20], eax
push 0xffffffffffffffff
lea eax, [ebp + 0x20]
push eax
push str.UTF8
call fcn.0042fc5f
add esp, 0xc
test al, al
je 0x40774b
mov byte [ebp + 0x77], 1
mov dword [ebp - 0x40], 0xfde9
jmp 0x4079d4
push 0xffffffffffffffff
lea eax, [ebp + 0x20]
push eax
push str.ANSI
call fcn.0042fc5f
add esp, 0xc
test al, al
je 0x40776e
mov byte [ebp + 0x77], 1
mov dword [ebp - 0x40], ebx
jmp 0x4079d4
push 0xffffffffffffffff
lea eax, [ebp + 0x20]
push eax
push 0x4854b4
call fcn.0042fc5f
add esp, 0xc
test al, al
je 0x407795
mov byte [ebp + 0x77], 2
mov dword [ebp - 0x40], 0x4b0
jmp 0x4079d4
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.00430ad7
test eax, eax
pop ecx
pop ecx
jle 0x4079d4
mov byte [ebp + 0x77], 1
jmp 0x4079d4
push 5
push dword [ebp + 0x68]
push str.user:
call fcn.0042996a
add esp, 0xc
test al, al
je 0x4077e8
add dword [ebp + 0x68], 0xa
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403ff2
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x407843
lea ecx, [ebp - 0x80]
jmp 0x407838
push 7
push dword [ebp + 0x68]
push str.passwd:
call fcn.0042996a
add esp, 0xc
test al, al
je 0x407803
mov byte [ebp + 3], bl
jmp 0x40781d
push 7
push dword [ebp + 0x68]
push str.passwd
call fcn.0042996a
add esp, 0xc
test al, al
je 0x407855
mov byte [ebp + 3], 1
add dword [ebp + 0x68], 0xe
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403ff2
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x407843
lea ecx, [ebp - 0x6c]
sub eax, esi
sar eax, 1
push eax
push esi
call fcn.0042e2ea
lea eax, [ebp + 0x68]
push eax
call fcn.00428a5b
mov edi, dword [ebp + 0x34]
pop ecx
jmp 0x406f5b
push 8
lea eax, [ebp + 0x68]
push eax
push str.REALTIME
call fcn.0042fc5f
add esp, 0xc
test al, al
je 0x407878
mov dword [ebp + 0x24], 0x100
jmp 0x406f5b
push esi
lea eax, [ebp + 0x68]
push eax
push str.HIGH
call fcn.0042fc5f
add esp, 0xc
test al, al
je 0x40789a
mov dword [ebp + 0x24], 0x80
jmp 0x406f5b
push 0xb
lea eax, [ebp + 0x68]
push eax
push str.ABOVENORMAL
call fcn.0042fc5f
add esp, 0xc
test al, al
je 0x4078bd
mov dword [ebp + 0x24], 0x8000
jmp 0x406f5b
push 6
lea eax, [ebp + 0x68]
push eax
push str.NORMAL
call fcn.0042fc5f
add esp, 0xc
test al, al
je 0x4078e0
mov dword [ebp + 0x24], 0x20
jmp 0x406f5b
push 0xb
lea eax, [ebp + 0x68]
push eax
push str.BELOWNORMAL
call fcn.0042fc5f
add esp, 0xc
test al, al
je 0x407903
mov dword [ebp + 0x24], 0x4000
jmp 0x406f5b
push 3
lea eax, [ebp + 0x68]
push eax
push 0x485464
call fcn.0042fc5f
add esp, 0xc
test al, al
jne 0x407953
mov esi, dword [ebp + 0x68]
push 4
push esi
push 0x485458
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x40795f
xor ecx, ecx
mov cx, word [esi + 8]
mov eax, ecx
call fcn.0040ac1b
test al, al
jne 0x407945
cmp cx, bx
jne 0x40795f
add dword [ebp + 0x68], 8
lea eax, [ebp + 0x68]
push eax
call fcn.00428a5b
pop ecx
mov dword [ebp + 0x24], 0x40
jmp 0x406f5b
push 3
lea eax, [ebp + 0x68]
push eax
push 0x485454
call fcn.0042fc5f
add esp, 0xc
test al, al
je 0x40797f
mov byte [ebp + 0x4c], 1
jmp 0x406f5b
push 3
lea eax, [ebp + 0x68]
push eax
push 0x485450
call fcn.0042fc5f
add esp, 0xc
test al, al
je 0x4079a5
mov byte [ebp + 2], 1
mov byte [ebp + 0x77], bl
mov dword [ebp - 0x40], ebx
jmp 0x406f5b
push 3
lea eax, [ebp + 0x68]
push eax
push 0x48544c
call fcn.0042fc5f
add esp, 0xc
test al, al
je 0x4079c5
mov byte [ebp - 0x1b], 1
jmp 0x406f5b
mov eax, dword [ebp - 0x84]
cmp word [eax], 0x2d
mov dword [ebp + 0x68], eax
jne 0x4079e3
lea eax, [ebp + 0x68]
push eax
call fcn.00404037
pop ecx
jmp 0x406f5b
cmp dword [ebp - 0x40], 0x4b0
jne 0x4079f0
mov byte [ebp + 0x77], 2
mov eax, dword [ebp - 0xd4]
cmp eax, ebx
je 0x407a23
cmp byte [ebp + 0x5b], bl
mov dword [ebp + 0x68], eax
jne 0x407a23
cmp dword [ebp + 0x44], ebx
jne 0x407a23
push 1
push ebx
lea ecx, [ebp - 0xb8]
push ecx
mov ecx, dword [ebp + 0x50]
push eax
call fcn.00437546
mov eax, dword [ebp - 0xb8]
mov dword [ebp + 0x68], eax
cmp edi, ebx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x60], ebx
je 0x407a47
cmp word [edi], bx
je 0x407a47
cmp word [ebp + 0x30], bx
je 0x407a4a
mov byte [ebp + 0x4c], bl
cmp edi, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp + 0xc], ebx
mov dword [ebp + 0x2c], ebx
mov dword [ebp - 0x108], 0x484df4
je 0x407b39
cmp word [edi], 0x2a
jne 0x407a79
inc edi
inc edi
inc dword [ebp - 0x14]
cmp word [edi], 0x2a
je 0x407a6b
mov dword [ebp + 0x34], edi
cmp word [edi], 0x3f
jne 0x407aa5
inc edi
inc edi
mov dword [ebp + 0x34], edi
mov dword [ebp - 0x108], edi
jmp 0x407a97
inc edi
inc edi
cmp ax, 0x3a
mov dword [ebp + 0x34], edi
je 0x407aa1
mov ax, word [edi]
cmp ax, bx
jne 0x407a8c
jmp 0x407aa5
mov word [edi - 2], bx
mov ax, word [edi]
push 0x20
pop ecx
or ax, cx
cmp ax, 0x63
jne 0x407ae1
mov dx, word [edi + 2]
or dx, cx
cmp dx, 0x61
jne 0x407ae1
mov dx, word [edi + 4]
or dx, cx
cmp dx, 0x62
jne 0x407ae1
cmp word [edi + 6], 0x3a
jne 0x407ae1
mov dword [ebp + 0xc], 1
add edi, 8
jmp 0x407b05
cmp ax, 0x65
jne 0x407b08
mov ax, word [edi + 2]
or ax, cx
cmp ax, 0x78
jne 0x407b08
cmp word [edi + 4], 0x3a
jne 0x407b08
mov dword [ebp + 0xc], 0x100
add edi, 6
mov dword [ebp + 0x34], edi
cmp edi, ebx
je 0x407b39
mov ax, word [edi]
or ax, cx
cmp ax, 0x75
jne 0x407b39
mov ax, word [edi + 2]
or ax, cx
cmp ax, 0x64
jne 0x407b39
cmp word [edi + 4], 0x3a
jne 0x407b39
add edi, 6
mov dword [ebp + 0x2c], 1
mov dword [ebp + 0x34], edi
cmp byte [ebp + 0x4c], bl
je 0x407b80
cmp edi, ebx
je 0x407b80
cmp word [ebp + 0xc], bx
jne 0x407b80
cmp word [ebp + 0x2c], bx
jne 0x407b80
xor eax, eax
cmp byte [ebp + 0x4f], bl
mov ecx, edi
setne al
mov esi, eax
xor eax, eax
mov ax, word [edi]
jmp 0x407b7b
cmp ax, 0x22
jne 0x407b76
inc esi
cmp esi, 2
jl 0x407b76
cmp word [ecx + 2], bx
je 0x407b76
mov byte [ebp + 0x4c], bl
inc ecx
inc ecx
mov ax, word [ecx]
cmp ax, bx
jne 0x407b61
cmp word [ebp - 0x14], bx
jne 0x407b92
cmp word [ebp + 0xc], bx
jne 0x407b92
cmp word [ebp + 0x2c], bx
je 0x407b95
mov byte [ebp + 0x4f], bl
cmp byte [ebp + 0x4c], bl
je 0x407bda
xor eax, eax
cmp word [ebp + 0x2c], bx
sete al
xor ecx, ecx
cmp word [ebp + 0xc], bx
sete cl
test ecx, eax
je 0x407bda
push 0x2a
push edi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
mov dword [ebp - 0x60], eax
je 0x407bc8
mov word [eax], bx
inc eax
inc eax
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x11c]
push eax
push edi
call fcn.0040fe69
pop ecx
pop ecx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp + 0x78]
xor ecx, ecx
inc ecx
mov dword [eax], ecx
xor eax, eax
lea edi, [ebp - 0xf8]
mov dword [ebp - 0xfc], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x15c], ebx
lea edi, [ebp - 0x158]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
cmp dword [ebp + 0x1c], ebx
mov dword [ebp - 0x44], ebx
setne al
cmp byte [ebp + 0x43], bl
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp + 0x28], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x148], 0xc
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0xe4], ebx
je 0x407c78
lea eax, [ebp - 0x23c]
or byte [eax + 0x2d], cl
mov dword [ebp - 0x10], ecx
mov ecx, dword [0x4992b4]
mov dword [eax + 0x3c], ecx
mov ecx, dword [0x4992b8]
mov dword [eax + 0x40], ecx
mov ecx, dword [0x4992b0]
mov dword [eax + 0x38], ecx
cmp byte [ebp + 0x5b], bl
je 0x408071
mov ecx, dword [ebp + 0x68]
cmp word [ecx], 0x7c
mov dword [ebp + 0x30], ebx
jne 0x407ca6
inc ecx
inc ecx
xor eax, eax
mov dword [ebp + 0x68], ecx
mov ax, word [ecx]
cmp ax, 0x7c
je 0x407c8d
call fcn.0040ac1b
test al, al
jne 0x407c8d
mov dword [ebp + 0x10], ecx
push 0x7c
push ebx
push dword [ebp + 0x68]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
mov dword [ebp + 0x5c], eax
je 0x407ce3
mov word [eax], bx
add dword [ebp + 0x5c], 2
lea eax, [ebp + 0x5c]
push eax
call fcn.00428a5b
mov eax, dword [ebp + 0x5c]
cmp word [eax], bx
pop ecx
je 0x407ca9
mov ecx, dword [ebp + 0x10]
cmp word [ecx], bx
mov dl, 1
je 0x407ce5
mov cl, dl
jmp 0x407cf1
xor dl, dl
xor cl, cl
cmp dl, bl
jne 0x407cf1
mov eax, dword [ebp + 0x10]
mov dword [ebp + 0x5c], eax
cmp cl, bl
mov dword [ebp + 0x44], eax
je 0x407daf
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
push ebx
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x54]
push eax
xor edi, edi
lea eax, [ebp - 0x5c]
inc edi
push eax
mov dword [ebp - 0xa0], 0xc
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], edi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x407d40
mov ecx, dword [ebp + 0x50]
push edi
call fcn.0040c4a3
mov edi, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 3
push ebx
push ebx
lea eax, [ebp - 0x5c]
push eax
push esi
push dword [ebp - 0x5c]
push esi
call edi
cmp dword [ebp - 0x54], ebx
mov word [ebp + 0x42], bx
je 0x407d81
push dword [ebp - 0x54]
mov ecx, dword [ebp + 0x50]
push ebx
push ebx
lea eax, [ebp + 0x42]
push eax
push ecx
push dword [ebp + 0x10]
call fcn.00406b20
cmp dword [ebp - 0x54], ebx
je 0x407d81
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 3
push 1
push ebx
lea eax, [ebp - 0x5c]
push eax
push esi
push dword [ebp - 0x5c]
mov dword [ebp - 0x54], ebx
push esi
call edi
mov ecx, dword [ebp - 0x5c]
cmp ecx, ebx
je 0x407daf
lea eax, [ebp - 0x23c]
or byte [eax + 0x2d], 1
mov dword [ebp - 0x10], 1
mov dword [eax + 0x38], ecx
mov eax, dword [ebp + 0x44]
mov dword [ebp + 0x5c], eax
xor edi, edi
inc edi
mov cx, word [eax]
cmp cx, bx
je 0x40800d
cmp cx, 0x3c
je 0x407ddd
cmp cx, 0x3e
je 0x407ddd
inc eax
inc eax
mov dword [ebp + 0x5c], eax
mov cx, word [eax]
cmp cx, bx
jne 0x407dc4
mov cx, word [eax]
cmp cx, bx
je 0x40800d
cmp cx, 0x3c
jne 0x407eb8
mov word [eax], bx
add dword [ebp + 0x5c], 2
lea eax, [ebp + 0x5c]
push eax
call fcn.00428a5b
mov eax, dword [ebp + 0x5c]
cmp word [eax], bx
pop ecx
je 0x407eb8
mov dword [ebp + 8], eax
jmp 0x407e26
cmp cx, 0x3c
je 0x407e2e
cmp cx, 0x3e
je 0x407e2e
inc eax
inc eax
mov dword [ebp + 0x5c], eax
mov cx, word [eax]
cmp cx, bx
jne 0x407e15
sub eax, dword [ebp + 8]
lea ecx, [ebp - 0x78]
sar eax, 1
push eax
push dword [ebp + 8]
call fcn.0043a4d7
lea ecx, [ebp + 0x10]
call fcn.0042e1c4
mov ecx, dword [ebp + 0x50]
push edi
push ebx
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.00437546
mov eax, dword [ebp + 0x10]
push eax
mov dword [ebp + 8], eax
call fcn.0040bf57
lea eax, [ebp + 8]
push eax
call fcn.00428a5b
cmp dword [ebp - 0x34], ebx
pop ecx
pop ecx
je 0x407e7d
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
push 3
lea eax, [ebp - 0x148]
push eax
push 7
push 0xc0000000
push dword [ebp + 8]
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x34], ebx
call fcn.00404073
cmp dword [ebp - 0x34], ebx
jne 0x407ea5
mov dword [ebp - 0x34], ebx
lea ecx, [ebp + 0x10]
call fcn.00428a48
lea ecx, [ebp - 0x78]
call fcn.00428a48
mov eax, dword [ebp + 0x5c]
cmp word [eax], 0x3e
jne 0x407db8
mov word [eax], bx
mov eax, dword [ebp + 0x5c]
xor esi, esi
cmp word [eax - 2], 0x32
mov byte [ebp + 0x5b], 1
jne 0x407edd
mov byte [ebp + 0x5b], 2
mov word [eax - 2], bx
add dword [ebp + 0x5c], 2
mov eax, dword [ebp + 0x5c]
cmp word [eax], 0x3e
jne 0x407ef0
add dword [ebp + 0x5c], 2
mov esi, edi
mov eax, dword [ebp + 0x5c]
cmp word [eax], 0x26
jne 0x407f01
add dword [ebp + 0x5c], 2
mov byte [ebp + 0x5b], 3
lea eax, [ebp + 0x5c]
push eax
call fcn.00428a5b
mov eax, dword [ebp + 0x5c]
cmp word [eax], bx
pop ecx
je 0x407db8
mov dword [ebp + 0x38], eax
jmp 0x407f2d
cmp cx, 0x3c
je 0x407f35
cmp cx, 0x3e
je 0x407f35
inc eax
inc eax
mov dword [ebp + 0x5c], eax
mov cx, word [eax]
cmp cx, bx
jne 0x407f1c
sub eax, dword [ebp + 0x38]
lea ecx, [ebp - 0x4c]
sar eax, 1
push eax
push dword [ebp + 0x38]
call fcn.0043a4d7
lea ecx, [ebp + 0x20]
call fcn.0042e1c4
mov ecx, dword [ebp + 0x50]
push edi
push ebx
lea eax, [ebp + 0x20]
push eax
push dword [ebp + 0x38]
call fcn.00437546
mov eax, dword [ebp + 0x20]
push eax
mov dword [ebp + 0x38], eax
call fcn.0040bf57
lea eax, [ebp + 0x38]
push eax
call fcn.00428a5b
test byte [ebp + 0x5b], 1
pop ecx
pop ecx
je 0x407f8d
cmp dword [ebp + 0x28], ebx
je 0x407f8a
push dword [ebp + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 0x28], ebx
test byte [ebp + 0x5b], 2
je 0x407fa7
cmp dword [ebp - 0x64], ebx
je 0x407fa1
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x64], ebx
mov dword [ebp + 0x30], ebx
push ebx
push ebx
push 4
lea eax, [ebp - 0x148]
push eax
push 7
push 0x40000000
push dword [ebp + 0x38]
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x70], ebx
call fcn.00404073
mov edi, eax
cmp edi, ebx
jne 0x407fe5
lea ecx, [ebp + 0x20]
call fcn.00428a48
lea ecx, [ebp - 0x4c]
call fcn.00428a48
mov eax, dword [ebp + 0x5c]
jmp 0x407db5
cmp esi, ebx
je 0x407ff4
push 2
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [ebp + 0x5b], 1
jne 0x407fff
mov dword [ebp + 0x28], edi
jmp 0x407fcd
cmp byte [ebp + 0x5b], 3
mov dword [ebp + 0x30], edi
je 0x407ffa
mov dword [ebp - 0x64], edi
jmp 0x407fcd
mov ecx, dword [ebp - 0x34]
cmp ecx, ebx
mov edx, 0x100
je 0x408028
lea eax, [ebp - 0x23c]
or dword [eax + 0x2c], edx
mov dword [ebp - 0x10], edi
mov dword [eax + 0x38], ecx
mov ecx, dword [ebp + 0x28]
cmp ecx, ebx
je 0x40803e
lea eax, [ebp - 0x23c]
or dword [eax + 0x2c], edx
mov dword [ebp - 0x10], edi
mov dword [eax + 0x3c], ecx
mov ecx, dword [ebp + 0x30]
cmp ecx, ebx
je 0x408054
lea eax, [ebp - 0x23c]
or dword [eax + 0x2c], edx
mov dword [ebp - 0x10], edi
mov dword [eax + 0x40], ecx
mov ecx, dword [ebp + 0x50]
push edi
push ebx
lea eax, [ebp - 0xe4]
push eax
push dword [ebp + 0x44]
call fcn.00437546
mov eax, dword [ebp - 0xe4]
mov dword [ebp + 0x68], eax
xor esi, esi
inc esi
mov edi, 0x10000000
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
cmp ax, 0x21
je 0x4080b3
cmp ax, 0x2a
je 0x4080b3
cmp ax, 0x40
jne 0x4080bc
push str.WinSta0WinLogon
lea ecx, [ebp - 0xbc]
call fcn.0043a57e
mov ecx, dword [ebp - 0xbc]
inc byte [ebp + 0x3f]
lea eax, [ebp - 0x23c]
mov dword [eax + 8], ecx
mov dword [ebp - 0x20], edi
add dword [ebp + 0x68], 2
jmp 0x408079
cmp ax, 0x3d
jne 0x4080c7
mov dword [ebp - 0x18], esi
jmp 0x4080b6
cmp ax, 0x24
jne 0x4080d3
mov byte [ebp + 0x4e], 1
jmp 0x4080b6
cmp ax, 0x26
jne 0x4080e2
mov dword [ebp - 0x20], 3
jmp 0x4080b6
cmp ax, 0x5e
jne 0x4080f1
mov dword [ebp - 0x20], 6
jmp 0x4080b6
cmp ax, 0x5f
je 0x4080e8
lea edi, [ebp - 0x23c]
cmp dword [edi + 8], ebx
je 0x408114
test byte [ebp + 0x3f], 1
je 0x408114
call fcn.004038c1
cmp eax, esi
jge 0x408114
mov dword [edi + 8], ebx
mov eax, dword [ebp + 0x7c]
cmp eax, ebx
je 0x40812b
or byte [edi + 0x2d], 1
mov dword [ebp - 0x18], ebx
mov byte [ebp + 0x73], bl
mov dword [ebp - 0x10], esi
mov dword [edi + 0x3c], eax
cmp byte [ebp + 0x4e], bl
je 0x40814b
mov eax, dword [ebp - 0xb4]
cmp word [eax], bx
jne 0x40814b
push 0x48541c
lea ecx, [ebp - 0xb4]
call fcn.0043a522
mov eax, dword [ebp - 0x20]
cmp eax, 0x10000000
je 0x40815a
cmp byte [ebp - 0x1b], bl
je 0x40815e
or byte [edi + 0x2c], 0x80
cmp eax, ebx
je 0x408169
or dword [edi + 0x2c], esi
mov word [edi + 0x30], ax
mov al, byte [ebp + 0x3f]
and al, 3
cmp al, 3
je 0x408177
cmp byte [ebp - 0x21], bl
je 0x40817b
or byte [edi + 0x2f], 8
cmp byte [ebp - 0x25], bl
je 0x4081cb
push 0x5c
push dword [ebp + 0x68]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edi, eax
cmp edi, ebx
je 0x408195
inc edi
inc edi
jmp 0x408198
mov edi, dword [ebp + 0x68]
push dword [ebp + 0x68]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push dword [ebp + 0x68]
xor eax, eax
cmp dword [ebp - 0x18], ebx
push esi
setne al
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
add eax, 0x80000001
push eax
call fcn.004297ff
add esp, 0x18
mov ebx, eax
jmp 0x409d46
lea eax, [ebp + 0x68]
push eax
call fcn.00428a5b
cmp dword [ebp + 0x1c], ebx
pop ecx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0xc0], ebx
je 0x408283
lea ecx, [ebp - 0xa8]
mov byte [ebp + 0x4e], bl
call fcn.0042e1c4
mov ecx, dword [ebp + 0x50]
push 0xffffffffffffffff
push ebx
push dword [ebp + 0x1c]
call fcn.004100d3
cmp eax, ebx
je 0x4082d4
mov ecx, dword [eax]
cmp word [ecx], bx
je 0x4082d4
push eax
lea ecx, [ebp - 0xa8]
call fcn.0043a550
push dword [ebp + 0x68]
lea ecx, [ebp - 0xc0]
call fcn.0043a57e
push dword [ebp - 0xec]
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0xc0]
push eax
push dword [ebp - 0xa8]
call fcn.004068d4
mov esi, eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp + 0x34], eax
mov eax, dword [ebp - 0xc0]
add esp, 0x14
lea ecx, [ebp - 0xa8]
mov dword [ebp + 0x68], eax
call fcn.00428a48
cmp esi, ebx
je 0x408280
mov ebx, esi
jmp 0x409d33
xor esi, esi
inc esi
mov eax, dword [ebp - 0xc8]
cmp word [eax], bx
je 0x4082e9
push dword [ebp + 0x68]
call fcn.0040dca1
pop ecx
push eax
lea ecx, [ebp + 0x70]
mov dword [ebp + 0x68], eax
call fcn.0043a4ba
push 0x4853b8
lea ecx, [ebp + 0x70]
call fcn.0042e232
push dword [ebp - 0xc8]
lea ecx, [ebp + 0x70]
call fcn.0042e232
mov ecx, dword [ebp + 0x50]
push ebx
push dword [ebp + 0x70]
call fcn.004400ab
mov ebx, eax
lea ecx, [ebp + 0x70]
jmp 0x409d2e
lea ecx, [ebp - 0xa8]
call fcn.00428a48
mov ebx, 0x80070057
jmp 0x409d33
cmp byte [ebp - 0x1a], bl
je 0x408431
lea ecx, [ebp + 0x7c]
call fcn.0042e1c4
push dword [ebp + 0x68]
mov dword [ebp + 0x70], ebx
call fcn.0040dca1
pop ecx
lea ecx, [ebp + 0x78]
mov dword [ebp + 0x68], eax
call fcn.0042e1c4
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp + 0x78]
push eax
push dword [ebp + 0x68]
mov dword [ebp + 0x18], ebx
call fcn.0043897f
mov eax, dword [ebp + 0x18]
add esp, 0xc
cmp eax, ebx
jne 0x40833b
lea ecx, [ebp + 0x78]
call fcn.00428a48
lea ecx, [ebp + 0x7c]
jmp 0x4082da
mov word [eax - 2], bx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push dword [ebp + 0x78]
lea ecx, [ebp - 8]
mov edi, eax
call fcn.0043a4ba
push dword [ebp + 0x18]
mov esi, dword [ebp - 8]
lea ecx, [ebp + 0x6c]
call fcn.0043a4ba
push edi
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp + 0x70]
push eax
push dword [ebp + 0x6c]
push esi
call fcn.00405548
add esp, 0x14
cmp dword [ebp + 0x70], ebx
jle 0x4083b5
mov eax, dword [ebp + 0x50]
mov eax, dword [eax + 0x2c]
xor esi, esi
cmp eax, ebx
je 0x408389
mov esi, dword [eax + 0x18]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebx
push esi
push ebx
push dword [ebp - 0xf0]
push dword [ebp - 0xf4]
push 0x128
push edi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
push edi
call dword [sym.imp.USER32.dll_DestroyMenu]
cmp dword [ebp + 0x70], ebx
jle 0x408411
mov esi, dword [ebp + 0x7c]
lea eax, [ebp + 0x70]
mov dword [ebp + 0x70], esi
call fcn.00404016
mov eax, dword [ebp + 0x70]
mov word [eax], bx
cmp word [esi], bx
je 0x408411
push dword [ebp + 0x68]
lea ecx, [ebp + 0x74]
call fcn.0043a4ba
push 0x4853b8
lea ecx, [ebp + 0x74]
call fcn.0042e232
push esi
lea ecx, [ebp + 0x74]
call fcn.0042e232
mov ecx, dword [ebp + 0x50]
push ebx
push dword [ebp + 0x74]
call fcn.004400ab
lea ecx, [ebp + 0x74]
mov ebx, eax
call fcn.00428a48
lea ecx, [ebp + 0x6c]
call fcn.00428a48
lea ecx, [ebp - 8]
call fcn.00428a48
lea ecx, [ebp + 0x78]
call fcn.00428a48
lea ecx, [ebp + 0x7c]
jmp 0x409d2e
push dword [ebp + 0x68]
lea ecx, [ebp - 0x104]
call fcn.0043a4ba
cmp dword [edi + 8], ebx
mov eax, dword [ebp - 0x104]
mov dword [ebp + 0x68], eax
je 0x408456
cmp byte [ebp + 0x3f], bl
jle 0x408456
mov eax, esi
jmp 0x408458
xor eax, eax
cmp eax, ebx
mov dword [ebp + 0x5c], ebx
mov dword [ebp - 0x70], ebx
je 0x40846c
mov dword [ebp - 0x70], esi
mov dword [ebp + 0x5c], 4
push eax
lea ecx, [ebp - 0x78]
call fcn.00402b36
cmp byte [0x49ad60], bl
mov edi, dword [ebp + 0x6c]
mov dword [ebp + 0x44], 0x49aed0
jne 0x4084a2
cmp edi, ebx
je 0x408490
cmp byte [edi + 0xa], bl
jne 0x4084a2
cmp byte [ebp - 0x24], bl
mov byte [ebp + 0x7f], bl
je 0x4084a6
cmp edi, ebx
je 0x4084a6
mov eax, dword [edi + 0x28]
mov dword [ebp + 0x44], eax
mov byte [ebp + 0x7f], 1
push ebx
lea ecx, [ebp + 0x10]
call fcn.0043a4ba
cmp byte [ebp + 0x7f], bl
mov dword [ebp + 0x38], ebx
je 0x408727
push 0x49b604
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
lea ecx, [ebp - 0x31c]
call fcn.0041007b
cmp edi, ebx
je 0x4084e5
push dword [ebp + 0x44]
lea ecx, [ebp - 0x31c]
push edi
call fcn.0042a90a
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edi, eax
push 0x106
lea ecx, [ebp + 0x20]
mov dword [ebp - 0x7c], edi
call fcn.0042e1e2
mov eax, dword [ebp + 0x20]
mov dword [ebp + 0x6c], eax
jmp 0x40857d
mov dword [ebp + 0x7c], edi
jmp 0x408510
cmp ax, 0x3d
je 0x40851a
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x40850a
mov esi, edi
sub esi, dword [ebp + 0x7c]
sar esi, 1
cmp word [edi], bx
je 0x40857b
cmp word [edi + 2], bx
je 0x408576
cmp esi, 0x104
jg 0x408576
push esi
push dword [ebp + 0x7c]
push dword [ebp + 0x6c]
call fcn.00403fda
mov eax, dword [ebp + 0x6c]
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x31c]
mov word [eax + esi*2], bx
call fcn.0040bce3
test eax, eax
jne 0x408576
push 0xffffffffffffffff
push esi
lea eax, [edi + 2]
push eax
push dword [ebp + 0x7c]
lea ecx, [ebp - 0x31c]
call fcn.0040bc46
jmp 0x408576
inc edi
inc edi
cmp word [edi], bx
jne 0x408574
inc edi
inc edi
cmp word [edi], bx
jne 0x408505
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, dword [ebp - 0x318]
xor esi, esi
cmp eax, ebx
mov dword [ebp + 0x6c], eax
mov dword [ebp + 0x7c], ebx
jle 0x40862f
mov eax, dword [ebp + 0x7c]
mov dword [ebp - 0x38], eax
inc eax
cmp eax, dword [ebp + 0x6c]
mov dword [ebp - 0x68], eax
mov dword [ebp + 0x1c], eax
jge 0x408620
mov eax, dword [ebp + 0x7c]
shl eax, 2
mov dword [ebp - 0x7c], eax
mov dword [ebp + 0x44], eax
mov eax, dword [ebp - 0x31c]
mov ecx, dword [ebp + 0x44]
mov ecx, dword [ecx + eax]
mov edi, dword [ebp + 0x1c]
mov ecx, dword [ecx]
shl edi, 2
mov eax, dword [eax + edi]
mov eax, dword [eax]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jge 0x4085ef
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x38], ecx
mov dword [ebp + 0x44], edi
jmp 0x4085f2
mov ecx, dword [ebp - 0x38]
inc dword [ebp + 0x1c]
mov eax, dword [ebp + 0x1c]
cmp eax, dword [ebp + 0x6c]
jl 0x4085bf
cmp ecx, dword [ebp + 0x7c]
je 0x408620
mov edx, dword [ebp - 0x31c]
mov eax, dword [ebp - 0x7c]
add eax, edx
mov edi, dword [eax]
shl ecx, 2
mov edx, dword [edx + ecx]
mov dword [eax], edx
mov eax, dword [ebp - 0x31c]
mov dword [eax + ecx], edi
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp + 0x6c]
mov dword [ebp + 0x7c], eax
jl 0x4085a1
cmp dword [ebp + 0x6c], ebx
mov dword [ebp + 0x7c], ebx
jle 0x408671
mov eax, dword [ebp - 0x31c]
mov ecx, dword [ebp + 0x7c]
mov eax, dword [eax + ecx*4]
push dword [eax]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call edi
mov ecx, dword [ebp + 0x7c]
lea esi, [esi + eax + 1]
mov eax, dword [ebp - 0x31c]
mov eax, dword [eax + ecx*4]
push dword [eax + 4]
call edi
inc dword [ebp + 0x7c]
lea esi, [esi + eax + 3]
mov eax, dword [ebp + 0x7c]
cmp eax, dword [ebp + 0x6c]
jl 0x408637
add esi, 4
push esi
lea ecx, [ebp + 0x10]
call fcn.0042e20b
mov edi, dword [ebp + 0x10]
xor esi, esi
cmp dword [ebp + 0x6c], ebx
mov dword [ebp + 0x38], edi
jle 0x4086f3
mov eax, dword [ebp - 0x31c]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
push eax
mov dword [ebp + 0x7c], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp + 0x7c]
mov dword [ebp + 0x18], eax
push edi
call fcn.00403fda
mov eax, dword [ebp + 0x18]
lea edi, [edi + eax*2]
mov word [edi], 0x3d
mov eax, dword [ebp - 0x31c]
mov eax, dword [eax + esi*4]
mov eax, dword [eax + 4]
add esp, 0xc
inc edi
push eax
inc edi
mov dword [ebp + 0x7c], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp + 0x7c]
mov dword [ebp + 0x18], eax
push edi
call fcn.00403fda
mov eax, dword [ebp + 0x18]
lea edi, [edi + eax*2]
add esp, 0xc
mov word [edi], bx
inc edi
inc edi
inc esi
cmp esi, dword [ebp + 0x6c]
jl 0x40868a
mov word [edi], bx
lea ecx, [ebp + 0x20]
mov word [edi + 2], bx
call fcn.00428a48
push ebx
lea ecx, [ebp - 0x31c]
call fcn.0041da45
lea ecx, [ebp - 0x2d8]
call fcn.00428a48
push 0x49b604
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x2c]
xor al, al
cmp word [ecx], 0x40
jne 0x408736
inc al
jmp 0x40873d
cmp dword [ebp - 0x58], ebx
je 0x40873d
mov al, 2
cmp byte [ebp + 0x73], bl
je 0x408839
or byte [ebp + 0x73], 8
neg al
mov dword [ebp - 0x18], esi
sbb eax, eax
and eax, 0xfff01000
add eax, 0x100000
mov edi, eax
call fcn.0042a64d
push eax
lea eax, [ebp - 0x17c]
push str..pipepecmd_exec__u
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebx
push esi
push edi
push edi
push 0xff
push 6
push 0x40000003
lea eax, [ebp - 0x17c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x4087db
cmp eax, 0xffffffff
je 0x4087db
push 0xffffffffffffffff
lea eax, [ebp - 0x17c]
push eax
lea ecx, [ebp + 0x7c]
call fcn.0043a4f0
push ebx
push ebx
push 3
lea ecx, [ebp - 0x148]
push ecx
push 7
push 0xc0000000
push dword [eax]
lea ecx, [ebp - 0x94]
call fcn.00404073
lea ecx, [ebp + 0x7c]
call fcn.00428a48
jmp 0x4087e2
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebp - 0x94]
push ebx
push ebx
lea eax, [ebp + 0x6c]
push eax
push edi
mov dword [ebp + 0x6c], 2
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
push ebx
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0xfc], eax
lea eax, [ebp - 0x23c]
or byte [eax + 0x2d], 1
test byte [ebp + 0x4d], 2
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x10], esi
jne 0x40882d
cmp byte [ebp + 0x4d], bl
jne 0x408830
mov dword [eax + 0x3c], edi
test byte [ebp + 0x4d], 1
je 0x40884f
mov dword [eax + 0x40], edi
cmp dword [ebp - 0x18], ebx
jne 0x40884f
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
push 0x49b604
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0x38]
neg eax
sbb eax, eax
and eax, 0x400
or eax, dword [ebp + 0x24]
mov dword [ebp + 8], ebx
or dword [ebp + 0x5c], eax
cmp byte [ebp + 0x4a], bl
mov dword [ebp + 4], ebx
mov dword [ebp + 0x1c], ebx
je 0x40887e
or dword [ebp + 0x5c], 4
cmp byte [ebp - 0x23], bl
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x68], ebx
je 0x408896
lea eax, [ebp - 0x7c]
push eax
call fcn.0040304d
pop ecx
mov dword [ebp - 0x68], eax
cmp byte [ebp + 0x4e], bl
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [ebp + 0x34]
je 0x4088ac
cmp edi, ebx
je 0x4092dc
cmp byte [ebp - 0x22], bl
je 0x40890d
cmp word [ebp + 0xc], bx
jne 0x40890d
cmp word [ebp + 0x2c], bx
jne 0x40890d
call fcn.00406843
push dword [ebp + 0x68]
mov dword [ebp - 0xe8], eax
push edi
push dword [ebp + 0x14]
lea eax, [ebp + 8]
push eax
call fcn.004037ed
add esp, 0x10
lea ecx, [ebp - 0x13c]
push ecx
lea ecx, [ebp - 0x23c]
push ecx
push eax
push dword [ebp + 0x38]
push dword [ebp + 0x5c]
push dword [ebp - 0x10]
push ebx
push ebx
push dword [ebp + 0x68]
push edi
push dword [ebp - 0xe8]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp + 0x24], eax
jmp 0x40920d
mov eax, dword [ebp - 0x80]
cmp word [eax], bx
je 0x408a63
cmp word [ebp + 0xc], bx
jne 0x408a63
cmp word [ebp + 0x2c], bx
jne 0x408a63
cmp byte [ebp + 3], bl
mov dword [ebp + 0x24], ebx
je 0x4089c7
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp + 0x6c]
call fcn.00402b04
lea ecx, [ebp + 0x7c]
call fcn.0042e04e
mov edi, dword [ebp - 0x6c]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push ebx
push edi
call fcn.00470340
lea eax, [ebp + 0x7c]
push eax
push dword [ebp + 0x6c]
call fcn.004343b4
add esp, 0x14
push 0xffffffffffffffff
mov edi, eax
neg edi
push 0xffffffffffffffff
push dword [ebp + 0x7c]
sbb edi, edi
lea ecx, [ebp - 0x6c]
neg edi
call fcn.0042e281
mov eax, dword [ebp + 0x6c]
push eax
mov dword [ebp - 0x74], eax
call esi
push eax
push ebx
push dword [ebp - 0x74]
call fcn.00470340
mov eax, dword [ebp + 0x7c]
add esp, 0xc
push eax
mov dword [ebp - 0x74], eax
call esi
push eax
push ebx
push dword [ebp - 0x74]
call fcn.00470340
add esp, 0xc
lea ecx, [ebp + 0x7c]
call fcn.00428a48
lea ecx, [ebp + 0x6c]
call fcn.00428a48
cmp edi, ebx
je 0x408a32
mov edi, dword [ebp - 0x80]
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x40
push edi
call esi
cmp eax, ebx
jne 0x4089e2
push 0x5c
push edi
call esi
cmp eax, ebx
je 0x4089ed
mov word [eax], bx
mov esi, dword [ebp - 0x80]
lea edi, [eax + 2]
jmp 0x4089f2
mov esi, 0x48539c
push dword [ebp + 0x68]
lea eax, [ebp + 8]
push dword [ebp + 0x34]
push dword [ebp + 0x14]
push eax
call fcn.004037ed
add esp, 0x10
lea ecx, [ebp - 0x13c]
push ecx
lea ecx, [ebp - 0x23c]
push ecx
push eax
push dword [ebp + 0x38]
push dword [ebp + 0x5c]
push dword [ebp + 0x68]
push dword [ebp + 0x34]
push 1
push dword [ebp - 0x6c]
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov dword [ebp + 0x24], eax
mov edi, dword [ebp - 0x6c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
call esi
shl eax, 1
push eax
push ebx
push edi
call fcn.00470340
mov edi, dword [ebp - 0x80]
add esp, 0xc
push edi
call esi
shl eax, 1
push eax
push ebx
push edi
call fcn.00470340
add esp, 0xc
jmp 0x40920d
cmp byte [ebp + 0x4c], bl
je 0x408ac7
cmp edi, ebx
je 0x408a72
cmp word [edi], 0x26
je 0x408ac7
cmp word [ebp - 0x14], bx
jne 0x408ac7
cmp word [ebp + 0xc], bx
jne 0x408ac7
cmp word [ebp + 0x2c], bx
jne 0x408ac7
push dword [ebp - 0x60]
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x23c]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x38]
push dword [ebp + 0x5c]
push dword [ebp - 0x10]
push dword [ebp + 0x68]
push dword [ebp - 0x118]
push dword [ebp - 0x11c]
call fcn.00438f42
xor ecx, ecx
add esp, 0x28
test eax, eax
setg cl
mov dword [ebp + 0x24], ecx
jmp 0x40920d
lea ecx, [ebp - 0x90]
mov dword [ebp + 0x6c], ebx
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x34], ebx
mov dword [ebp + 0x20], ebx
mov dword [ebp + 0x7c], edi
mov dword [ebp - 0x60], edi
call fcn.0042e04e
cmp word [ebp + 0x2c], bx
lea eax, [ebp + 0x30]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x40]
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 4], ebx
mov dword [ebp + 0x30], ebx
mov dword [ebp + 0x40], ebx
mov dword [ebp + 0x18], eax
je 0x408bab
push 0x22
pop esi
cmp word [edi], si
jne 0x408b1d
add edi, 2
mov dword [ebp + 0x7c], edi
push 0x3a
lea eax, [ebp + 0x7c]
mov dword [ebp - 0x48], edi
call fcn.0040404e
mov eax, dword [ebp + 0x7c]
cmp eax, edi
pop ecx
je 0x408b3c
cmp word [eax - 2], si
jne 0x408b3c
mov word [eax - 2], bx
cmp word [eax], 0x3a
jne 0x408b44
inc eax
inc eax
cmp word [eax], si
mov edi, eax
jne 0x408b5d
lea edi, [eax + 2]
inc eax
inc eax
cmp word [eax], si
jne 0x408b58
mov word [eax], bx
cmp word [eax], bx
jne 0x408b4e
cmp word [ebp + 0xc], bx
je 0x408b7b
push 0x3a
push edi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
mov dword [ebp + 0x6c], eax
je 0x408b7b
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x6c], eax
push ebx
push ebx
push 0x10000
push edi
lea eax, [ebp - 0x90]
push eax
push dword [ebp - 0x48]
call fcn.00442e0f
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x88]
add esp, 0x18
add ecx, eax
mov dword [ebp - 4], ecx
jmp 0x408d94
cmp edi, ebx
je 0x408c7e
cmp word [edi], 0x26
jne 0x408c65
mov ecx, dword [ebp + 0x50]
push 0xffffffffffffffff
push ebx
push edi
call fcn.0040bce3
mov esi, eax
cmp esi, ebx
jne 0x408c27
lea ecx, [ebp + 0x40]
call fcn.00428a48
lea ecx, [ebp - 0x90]
call fcn.00428a48
lea ecx, [ebp + 0x20]
call fcn.00428a48
lea ecx, [ebp + 0x1c]
call fcn.00428a48
lea ecx, [ebp + 4]
call fcn.00428a48
lea ecx, [ebp + 8]
call fcn.00428a48
push 0x49b604
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp + 0x10]
call fcn.00428a48
lea ecx, [ebp - 0x78]
call fcn.0040fdb8
mov ebx, 0x80070057
jmp 0x409d28
mov eax, dword [esi + 0xc]
and eax, 0x3fffffff
mov dword [ebp - 0x8c], eax
add eax, 0x10
push eax
lea ecx, [ebp - 0x90]
call fcn.0042e092
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x8c]
inc eax
push eax
push dword [esi + 4]
push dword [ebp - 0x90]
call fcn.00470580
add esp, 0xc
jmp 0x408d94
mov al, byte [ebp + 0x4f]
neg al
sbb eax, eax
and eax, 2
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.004360da
pop ecx
pop ecx
mov dword [ebp + 0x34], eax
cmp dword [ebp + 0x34], ebx
mov dword [ebp - 0x10c], ebx
jne 0x408cf3
mov eax, dword [ebp + 0x68]
cmp eax, ebx
je 0x408c99
cmp word [eax], 0x2a
jne 0x408c99
inc dword [ebp - 0x14]
cmp byte [ebp + 0x4c], bl
je 0x408ca1
mov dword [ebp - 0x14], ebx
cmp word [ebp + 0xc], bx
je 0x409243
push 0x3a
push ebx
push dword [ebp - 0x60]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
cmp esi, ebx
mov dword [ebp + 0x6c], esi
je 0x408cea
mov word [esi], bx
inc esi
inc esi
mov dword [ebp + 0x6c], esi
je 0x408cea
push dword [ebp - 0x60]
lea ecx, [ebp + 0x40]
mov dword [ebp - 0xc4], 2
mov dword [ebp - 0x38], ebx
mov dword [ebp + 0x18], ebx
call fcn.0043a522
jmp 0x408dc6
cmp dword [ebp + 0x34], ebx
je 0x409243
cmp word [ebp + 0xc], bx
mov edi, dword [ebp + 0x34]
je 0x408d15
push 0x3a
push ebx
push edi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
mov dword [ebp + 0x6c], eax
je 0x408d15
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x6c], eax
add dword [ebp + 0x34], 2
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp + 0x34]
push eax
call fcn.00436028
mov si, word [edi]
pop ecx
mov dword [ebp - 0x48], eax
mov eax, dword [0x49addc]
mov word [edi], bx
pop ecx
mov ecx, dword [ebp - 0x60]
mov dword [ebp + 0x44], 0x20
cmp word [ecx], bx
mov dword [ebp + 0x7c], ebx
je 0x408d58
push 2
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp + 0x7c], eax
cmp eax, ebx
mov word [edi], si
je 0x408d86
lea ecx, [ebp + 0x44]
push ecx
lea ecx, [ebp - 0x90]
push ecx
push dword [ebp - 0x48]
mov dword [ebp + 0x44], 0x20
push dword [ebp - 0x10c]
push eax
call fcn.004101ba
add esp, 0x14
mov dword [ebp - 4], eax
cmp dword [ebp + 0x7c], ebx
je 0x408d94
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x8c], ebx
je 0x4091f2
cmp dword [ebp - 4], ebx
je 0x4091f2
cmp word [ebp - 0x14], bx
mov dword [ebp - 0xc4], 1
ja 0x408dc3
cmp word [ebp + 0xc], bx
je 0x409135
mov esi, dword [ebp + 0x6c]
cmp dword [ebp + 0x18], ebx
mov eax, dword [ebp - 0x108]
jne 0x408dd6
mov eax, 0x484df4
push eax
push str.exedat
push dword [ebp - 0x38]
lea eax, [ebp - 0x44]
push dword [ebp + 0x18]
push eax
call fcn.0040413a
add esp, 0x14
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp + 4]
call fcn.0043a550
cmp dword [ebp + 0x30], ebx
lea eax, [ebp + 0x40]
mov dword [ebp + 0x18], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0x38], eax
je 0x408e36
push ebx
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x8c]
push dword [ebp - 4]
push dword [ebp + 0x30]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x408e43
cmp dword [ebp - 0xc4], 1
jle 0x4091f2
cmp esi, ebx
push dword [ebp - 0x44]
mov byte [ebp + 0x7f], bl
je 0x408f9d
mov eax, dword [ebp + 0x40]
lea ecx, [ebp + 0x40]
mov dword [ebp + 0x44], eax
mov dword [ebp + 0x40], ebx
call fcn.0043a57e
push str..ex
lea ecx, [ebp + 0x40]
call fcn.0042e232
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp + 4]
call fcn.0043a550
cmp word [esi], 0x5c
je 0x408e89
add esi, 0xfffffffe
mov word [esi], 0x5c
push ebx
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp word [ebp + 0xc], 1
jne 0x408ee2
push 0x48536c
lea ecx, [ebp + 0x2c]
call fcn.0043a4ba
push dword [ebp + 0x44]
lea ecx, [ebp + 0x2c]
call fcn.0042e232
push 0x485364
lea ecx, [ebp + 0x2c]
call fcn.0042e232
push dword [ebp + 0x40]
lea ecx, [ebp + 0x2c]
call fcn.0042e232
push dword [ebp + 0x2c]
mov ecx, dword [ebp + 0x50]
call fcn.00420fa6
lea ecx, [ebp + 0x2c]
call fcn.00428a48
jmp 0x408f7e
cmp word [ebp + 0xc], 0x100
jne 0x408f7e
push 0xf
pop ecx
xor eax, eax
mov dword [ebp - 0x280], 0x44
mov dword [ebp - 0x27c], ebx
lea edi, [ebp - 0x278]
rep stosd dword es:[edi], eax
mov dword [ebp - 0xa4], ebx
lea edi, [ebp - 0xa0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x280]
push eax
push dword [ebp + 4]
mov dword [ebp - 0x254], 0x80
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x48535c
push dword [ebp + 0x44]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
push dword [ebp - 0xa4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 0xa4], ebx
je 0x408f6a
push dword [ebp - 0xa4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xa0], ebx
je 0x408f7e
push dword [ebp - 0xa0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
lea ecx, [ebp + 0x40]
call fcn.0042e232
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp + 8]
call fcn.0043a550
lea ecx, [ebp + 0x44]
call fcn.00428a48
jmp 0x408fa5
lea ecx, [ebp + 4]
call fcn.0043a57e
mov edx, dword [ebp + 0x68]
mov di, word [edx]
cmp di, 0x22
mov eax, edx
jne 0x408fb6
lea eax, [edx + 2]
cmp word [eax], 0x3f
jne 0x409043
lea esi, [eax + 2]
mov cx, word [esi]
cmp cx, 0x3f
jne 0x408fd4
mov edi, dword [ebp + 0x40]
lea esi, [eax + 4]
jmp 0x409018
cmp cx, 0x5c
jne 0x409043
cmp di, 0x22
je 0x409015
mov eax, dword [ebp + 4]
mov edi, 0x104
push edi
lea ecx, [ebp + 4]
mov dword [ebp + 0x44], eax
mov dword [ebp + 4], ebx
call fcn.0042e20b
mov eax, dword [ebp + 4]
push edi
mov word [eax], bx
push dword [ebp + 4]
push dword [ebp + 0x44]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea ecx, [ebp + 0x44]
call fcn.00428a48
mov edx, dword [ebp + 0x68]
mov edi, dword [ebp + 4]
cmp word [edx], 0x22
jne 0x40902b
push 0x485294
lea ecx, [ebp + 0x1c]
call fcn.0043a57e
push edi
lea ecx, [ebp + 0x1c]
call fcn.0042e232
push esi
lea ecx, [ebp + 0x1c]
call fcn.0042e232
mov edx, dword [ebp + 0x1c]
mov dword [ebp + 0x68], edx
cmp dword [ebp + 0x6c], ebx
je 0x40909a
cmp word [ebp - 0x14], bx
ja 0x409073
lea eax, [ebp - 0x90]
push eax
push dword [ebp + 8]
mov dword [ebp + 0x6c], ebx
call fcn.0040fe69
cmp dword [ebp - 0x8c], ebx
pop ecx
pop ecx
je 0x409097
mov byte [ebp + 0x7f], 1
jmp 0x409106
cmp byte [ebp + 0x4e], bl
je 0x40909a
cmp dword [ebp + 0x14], ebx
jne 0x409083
mov eax, dword [ebp + 4]
mov dword [ebp + 0x14], eax
cmp word [ebp - 0x14], 2
mov dword [ebp + 0x6c], ebx
mov byte [ebp + 0x7f], 2
jb 0x4092c1
jmp 0x409106
mov edx, dword [ebp + 0x68]
cmp dword [ebp + 0x6c], ebx
mov esi, dword [ebp + 0x40]
je 0x4090ac
mov eax, dword [ebp + 0x6c]
cmp word [eax], bx
jne 0x4090ac
xor esi, esi
mov eax, dword [ebp + 0x14]
cmp eax, ebx
jne 0x4090b6
mov eax, dword [ebp + 4]
push edx
push dword [ebp + 0x40]
push eax
lea eax, [ebp + 8]
push eax
call fcn.004037ed
mov dword [ebp + 0x14], eax
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x23c]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x38]
push dword [ebp + 0x5c]
push dword [ebp - 0x10]
push ebx
push ebx
push dword [ebp + 0x68]
push esi
call fcn.0046ffe8
add esp, 0x38
cmp byte [ebp - 0x14], 2
mov dword [ebp + 0x24], eax
jl 0x4091f2
cmp word [ebp + 0xc], bx
jne 0x4091f2
cmp byte [ebp + 0x7f], 1
jne 0x409111
or eax, 0xffffffff
jmp 0x40911a
lea eax, [ebp - 0x13c]
mov eax, dword [eax + 8]
push eax
push dword [ebp - 0x44]
call fcn.00402c41
cmp byte [ebp + 0x7f], 1
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov word [eax], bx
jne 0x40923d
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x22
mov edi, eax
jne 0x409143
add eax, 2
cmp word [eax], 0x3f
mov dword [ebp + 0x44], ebx
jne 0x40916a
cmp word [eax + 2], 0x5c
jne 0x40916a
lea edi, [eax + 4]
cmp word [edi], 0x22
jne 0x40916a
dec edi
dec edi
mov ax, word [edi]
mov word [ebp + 0x44], ax
mov word [edi], 0x22
push ebx
lea esi, [ebp - 0x13c]
push esi
lea eax, [ebp - 0x23c]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x38]
push dword [ebp + 0x5c]
push dword [ebp - 0x10]
push edi
push dword [ebp - 0x8c]
push dword [ebp - 4]
call fcn.00438f42
add esp, 0x28
cmp word [ebp + 0x44], bx
mov dword [ebp - 0x48], eax
je 0x4091a7
mov ax, word [ebp + 0x44]
mov word [edi], ax
cmp dword [ebp - 0x48], ebx
jl 0x408dc3
mov esi, dword [esi + 8]
cmp esi, ebx
je 0x408dc3
push esi
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
je 0x408dc3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp - 0x48], ebx
setg al
mov dword [ebp + 0x24], eax
mov eax, dword [ebp - 0x44]
cmp eax, ebx
je 0x4091f2
cmp word [eax], bx
jne 0x409106
lea ecx, [ebp + 0x40]
call fcn.00428a48
lea ecx, [ebp - 0x90]
call fcn.00428a48
lea ecx, [ebp + 0x20]
call fcn.00428a48
cmp dword [ebp - 0x68], ebx
je 0x40921b
push dword [ebp - 0x7c]
call fcn.0040305e
pop ecx
lea esi, [ebp - 0x54]
mov eax, dword [esi]
cmp eax, ebx
je 0x40922b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x24], ebx
mov dword [esi], ebx
je 0x4093ad
xor eax, eax
jmp 0x4093b3
cmp byte [ebp + 0x7f], 2
jmp 0x4092bb
push dword [ebp + 0x68]
lea eax, [ebp + 8]
push edi
push dword [ebp + 0x14]
push eax
call fcn.004037ed
mov dword [ebp + 0x14], eax
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x23c]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x38]
push dword [ebp + 0x5c]
push dword [ebp - 0x10]
push ebx
push ebx
push dword [ebp + 0x68]
push edi
call fcn.0046ffe8
add esp, 0x38
cmp eax, ebx
mov dword [ebp + 0x24], eax
jne 0x4091f2
push eax
push dword [ebp + 0x68]
push str._CreateProcess__s__d_r_n
push 0x49aed0
call fcn.0040c0f5
add esp, 0x10
cmp byte [ebp + 0x4e], bl
jne 0x4091f2
cmp edi, ebx
jne 0x4091f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
jne 0x4091f2
lea ecx, [ebp + 0x40]
call fcn.00428a48
lea ecx, [ebp - 0x90]
call fcn.00428a48
lea ecx, [ebp + 0x20]
call fcn.00428a48
push 0xd
xor eax, eax
pop ecx
lea edi, [ebp - 0x190]
mov dword [ebp - 0x198], 0x3c
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x20]
cmp eax, ebx
mov dword [ebp - 0x194], 0x4540
jne 0x409307
push 5
pop eax
movzx eax, ax
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp + 0x14]
cmp eax, ebx
je 0x409322
cmp word [eax], bx
je 0x409322
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp + 0x68]
mov dword [ebp + 0x7c], ebx
mov dword [ebp + 0x6c], eax
mov dword [ebp - 0x188], eax
cmp word [eax], 0x22
jne 0x40937a
push 1
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp + 0x6c]
push eax
call fcn.004149d8
add esp, 0xc
push dword [ebp + 0x7c]
lea ecx, [ebp - 0xd0]
push dword [ebp + 0x6c]
mov esi, eax
call fcn.0042e2ea
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x184], esi
lea eax, [ebp - 0x198]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp + 0x24], eax
mov eax, dword [ebp - 0x160]
lea esi, [ebp - 0x13c]
push eax
mov dword [esi], eax
mov dword [ebp - 0x160], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [esi + 8], eax
jmp 0x40920d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x78]
mov dword [ecx], eax
lea ecx, [ebp - 0x4c]
mov dword [ebp + 0x7c], eax
call fcn.00402abc
mov eax, dword [ebp - 0xd8]
cmp word [eax], bx
je 0x4093e3
push eax
lea eax, [ebp - 0x13c]
push dword [eax + 8]
push dword [ebp + 0x50]
call fcn.004300d6
add esp, 0xc
cmp byte [ebp + 0x4a], bl
je 0x409406
lea esi, [ebp - 0x13c]
cmp dword [esi], ebx
je 0x409406
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push dword [esi]
mov dword [ebp - 0x50], eax
push eax
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
push str.__LastPID
lea edi, [ebp - 0x13c]
push dword [edi + 8]
push dword [ebp + 0x50]
call fcn.004300d6
push str.__LastTID
push dword [edi + 0xc]
push dword [ebp + 0x50]
call fcn.004300d6
add esp, 0x18
cmp dword [ebp - 0x70], ebx
je 0x409445
push dword [edi]
push 4
push str.SeDebugPrivilege
call fcn.0040e2d0
add esp, 0xc
test byte [ebp + 0x5c], 4
je 0x409459
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x409459
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea ecx, [ebp + 0x1c]
call fcn.00428a48
lea ecx, [ebp + 4]
call fcn.00428a48
lea ecx, [ebp + 8]
call fcn.00428a48
mov eax, 0x49b604
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp + 0x10]
call fcn.00428a48
lea ecx, [ebp - 0x78]
call fcn.0040fdb8
lea esi, [ebp - 0x94]
mov eax, dword [esi]
cmp eax, ebx
je 0x4094a0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
lea esi, [ebp - 0x5c]
mov eax, dword [esi]
cmp eax, ebx
je 0x4094b2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
lea esi, [ebp - 0x34]
mov eax, dword [esi]
cmp eax, ebx
je 0x4094c4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
lea esi, [ebp + 0x28]
mov eax, dword [esi]
cmp eax, ebx
je 0x4094d6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
lea esi, [ebp - 0x64]
mov eax, dword [esi]
cmp eax, ebx
je 0x4094e8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x24], ebx
mov dword [esi], ebx
je 0x409c55
mov eax, dword [edi]
cmp eax, ebx
jne 0x4094fc
mov dword [ebp - 0x18], ebx
mov ecx, dword [ebp - 0x3c]
inc dword [ebp - 0x3c]
mov dword [ebp + ecx*4 - 0xfc], eax
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x409517
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp + 0x4b], bl
mov dword [edi + 4], ebx
je 0x409534
mov ecx, dword [ebp + 0x50]
push 0x3e8
call fcn.0040c4a3
push dword [edi]
call fcn.0040cb4d
pop ecx
cmp dword [ebp - 0x18], ebx
je 0x409c55
mov al, byte [0x499280]
mov edi, 0x100000
push 0x100004
lea ecx, [ebp + 0x5c]
mov byte [ebp + 0x6f], al
mov dword [ebp + 0x38], edi
xor esi, esi
call fcn.0042e06b
mov eax, dword [ebp - 0x2c]
cmp word [eax], 0x40
lea ecx, [eax + 2]
mov dword [ebp + 0x30], eax
mov dword [ebp - 0x48], ecx
mov byte [ebp + 0x7f], bl
jne 0x409618
mov byte [ebp + 0x7f], 1
mov dword [ebp + 0x30], ecx
cmp byte [ebp - 0x19], bl
je 0x4095d7
mov ecx, dword [ebp + 0x50]
push ebx
lea eax, [ebp + 0x44]
push eax
push dword [ebp + 0x30]
mov dword [ebp + 0x44], ebx
call fcn.00436a58
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 0x44]
lea ecx, [ebp + 0x5c]
call fcn.0042e14c
push dword [ebp + 0x5c]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
lea edi, [esi + 0x3ff]
and edi, 0xfffffc00
add edi, 0x100000
lea eax, [edi + 8]
push eax
lea ecx, [ebp + 0x5c]
mov dword [ebp + 0x38], edi
call fcn.0042e092
lea ecx, [ebp + 0x44]
call fcn.00428a48
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
test byte [ebp + 0x73], 8
je 0x409919
mov eax, dword [ebp - 0x2c]
mov ax, word [eax]
cmp ax, 0x40
je 0x40962a
cmp byte [ebp + 2], bl
je 0x40962a
cmp ax, 0x26
je 0x409612
mov eax, dword [ebp + 0x50]
test byte [eax + 0xb], 0xf
je 0x40962a
mov byte [ebp + 0x4b], 1
jmp 0x40962d
cmp dword [ebp - 0x58], ebx
je 0x40957c
mov byte [ebp + 0x7f], 2
jmp 0x40957c
mov byte [ebp + 0x4b], bl
push ebx
mov dword [ebp - 0xcc], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0xc]
mov edi, dword [eax]
lea eax, [ebp - 0x15c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
cmp byte [ebp + 0x7f], bl
mov dword [ebp - 0xc4], esi
je 0x409662
mov eax, dword [ebp + 0x38]
sub eax, esi
mov dword [ebp + 0x2c], eax
jmp 0x409669
mov dword [ebp + 0x2c], 0x100000
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0xcc]
push eax
push dword [ebp + 0x2c]
mov eax, dword [ebp + 0x5c]
add eax, esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp - 0xac], ebx
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x78], ebx
mov dword [ebp + 0x18], ebx
jg 0x4096a8
mov dword [ebp - 0xac], 0x3e8
lea ecx, [ebp - 0x38]
mov byte [ebp + 0x4a], bl
call fcn.0042e1c4
mov al, byte [0x499280]
cmp al, bl
mov byte [ebp + 0x6f], al
jle 0x40990c
mov ecx, dword [ebp + 0x50]
push 0x4ff
push dword [ebp - 0xac]
lea eax, [ebp - 0xfc]
push ebx
push eax
push dword [ebp - 0x3c]
call fcn.0040dc97
cmp eax, ebx
mov dword [ebp - 0x74], eax
jne 0x409772
lea eax, [ebp - 0xc]
mov edi, dword [eax]
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x15c]
push eax
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
cmp dword [ebp - 4], ebx
jle 0x409720
mov eax, dword [ebp + 0x2c]
cmp dword [ebp - 4], eax
jle 0x409717
mov dword [ebp - 4], eax
add esi, dword [ebp - 4]
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi], bl
lea eax, [esi + 0x100000]
cmp eax, dword [ebp + 0x38]
jl 0x409741
add dword [ebp + 0x38], 0x100000
mov eax, dword [ebp + 0x38]
add eax, 4
push eax
lea ecx, [ebp + 0x5c]
call fcn.0042e092
cmp byte [ebp + 0x7f], bl
je 0x409750
mov eax, dword [ebp + 0x38]
sub eax, esi
mov dword [ebp + 0x2c], eax
jmp 0x409757
mov dword [ebp + 0x2c], 0x100000
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x2c]
mov eax, dword [ebp + 0x5c]
add eax, esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [ebp + 0x7f], bl
je 0x4097a6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x78], eax
sub eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0xac]
jge 0x40985d
cmp esi, dword [ebp + 0x18]
je 0x409903
cmp eax, 0x14
jl 0x409903
jmp 0x40985d
mov eax, dword [ebp - 0x3c]
cmp eax, 1
jle 0x4097cf
dec eax
cmp eax, dword [ebp - 0x74]
jne 0x4097cf
cmp byte [ebp + 0x7f], bl
mov byte [ebp + 0x4a], 1
je 0x40990c
cmp esi, dword [ebp + 0x18]
je 0x40990c
jmp 0x40985d
test byte [ebp + 0x73], 1
je 0x4097ef
mov eax, dword [ebp - 0xc4]
jmp 0x4097eb
mov ecx, dword [ebp + 0x5c]
cmp byte [eax + ecx], 0xa
je 0x40990c
inc eax
cmp eax, esi
jl 0x4097dd
push 5
pop edi
dec edi
js 0x4096b3
cmp byte [0x499280], bl
jle 0x4096b3
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1b4]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x4096b3
cmp dword [ebp - 0x1b0], 0x12
je 0x409844
lea eax, [ebp - 0x1b4]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1b4]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x4097f2
cmp byte [ebp + 0x7f], bl
mov byte [ebp + 0x6f], bl
mov byte [ebp + 0x4a], 1
je 0x4096b3
cmp esi, dword [ebp + 0x18]
je 0x4096b3
cmp byte [ebp + 0x4b], bl
mov ecx, dword [ebp - 0x78]
mov eax, dword [ebp + 0x5c]
mov dword [ebp + 0x18], esi
mov dword [ebp - 0x70], ecx
jne 0x409896
cmp dword [ebp - 0x40], 0x4b0
je 0x409889
push dword [ebp - 0x40]
lea ecx, [ebp - 0x38]
push esi
push eax
call fcn.0042e281
mov eax, dword [ebp - 0x38]
jmp 0x409896
mov word [eax + esi + 2], bx
mov ecx, dword [ebp + 0x5c]
mov word [ecx + esi + 2], bx
cmp byte [ebp + 0x7f], 1
jne 0x4098b3
mov ecx, dword [ebp + 0x50]
push eax
push eax
push 0x484964
push dword [ebp + 0x30]
push dword [ebp + 0x30]
call fcn.0042ad3a
jmp 0x4098dd
cmp byte [ebp + 0x4b], bl
je 0x4098d1
push ebx
lea eax, [ebp + 0x5c]
push eax
push esi
push dword [ebp + 0x5c]
push dword [ebp - 0x2c]
push dword [ebp + 0x50]
call fcn.0043f235
add esp, 0x18
jmp 0x4098dd
mov ecx, dword [ebp + 0x50]
push eax
push dword [ebp + 0x30]
call fcn.0042cbf7
cmp dword [ebp - 0x58], ebx
je 0x409903
push dword [ebp - 0x58]
lea ecx, [ebp - 0x68]
call fcn.0043a4ba
mov ecx, dword [ebp + 0x50]
push ebx
push ebx
push ebx
push dword [ebp - 0x68]
call fcn.004228ce
lea ecx, [ebp - 0x68]
call fcn.00428a48
cmp byte [ebp + 0x4a], bl
je 0x4097a6
lea ecx, [ebp - 0x38]
call fcn.00428a48
jmp 0x4099ff
cmp dword [ebp - 0x18], 0xffffff9c
je 0x4099ff
jmp 0x4099ef
mov ecx, dword [ebp + 0x50]
push 0x4ff
push 0x3e8
push ebx
lea eax, [ebp - 0xfc]
push eax
push dword [ebp - 0x3c]
call fcn.0040dc97
mov ecx, dword [ebp - 0x3c]
dec ecx
cmp ecx, eax
je 0x4099ff
cmp dword [ebp - 0x3c], 1
jle 0x4099e7
cmp eax, ebx
jne 0x4099e7
lea eax, [esi + 0x100000]
cmp eax, edi
jl 0x40997f
add edi, 0x100000
lea eax, [edi + 4]
push eax
lea ecx, [ebp + 0x5c]
call fcn.0042e092
push ebx
lea eax, [ebp + 0x7c]
push eax
mov eax, dword [ebp + 0x5c]
push 1
add eax, esi
push eax
lea eax, [ebp - 0xc]
push dword [eax]
mov dword [ebp + 0x7c], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4099e7
cmp dword [ebp + 0x7c], ebx
jbe 0x4099e7
add esi, dword [ebp + 0x7c]
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi], bl
jmp 0x4099e7
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x178]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x4099ef
cmp dword [ebp - 0x174], 0x12
je 0x4099ef
lea eax, [ebp - 0x178]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x178]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp byte [0x499280], bl
jg 0x4099ae
mov al, byte [0x499280]
cmp al, bl
mov byte [ebp + 0x6f], al
jg 0x409928
cmp dword [ebp - 0x18], 0xffffff9c
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi + 2], bl
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi + 1], bl
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi], bl
mov dword [ebp - 8], ebx
je 0x409a30
cmp byte [ebp + 0x6f], bl
jle 0x409a30
push ebx
lea eax, [ebp - 0x13c]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x13c]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp byte [ebp + 0x73], bl
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x78]
mov dword [ecx], eax
je 0x409c09
mov eax, dword [ebp - 0x2c]
mov ax, word [eax]
xor edi, edi
cmp ax, 0x40
je 0x409a7b
cmp byte [ebp + 2], bl
je 0x409a7b
cmp ax, 0x26
je 0x409a75
mov eax, dword [ebp + 0x50]
test byte [eax + 0xb], 0xf
je 0x409a7b
mov byte [ebp + 0x7b], 1
jmp 0x409a7e
mov byte [ebp + 0x7b], bl
lea ecx, [ebp - 0xa0]
call fcn.0042e04e
cmp byte [ebp + 0x7b], bl
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], ebx
jne 0x409ba5
cmp byte [ebp + 0x77], 2
jne 0x409ab0
mov eax, dword [ebp + 0x5c]
mov word [eax + esi], bx
mov edi, dword [ebp + 0x5c]
jmp 0x409b12
cmp byte [ebp + 0x77], 1
lea ecx, [ebp - 0xa0]
jne 0x409aca
push dword [ebp - 0x40]
push esi
push dword [ebp + 0x5c]
call fcn.0042e281
jmp 0x409b16
lea eax, [esi + 0x18]
push eax
call fcn.0042e20b
lea eax, [esi + 1]
push eax
push dword [ebp + 0x5c]
mov dword [ebp - 0x98], esi
push dword [ebp - 0xa0]
mov dword [ebp - 0x9c], esi
call fcn.00470580
mov eax, dword [ebp - 0xa0]
push 0x10
add eax, esi
push ebx
push eax
call fcn.00470340
lea eax, [ebp - 0xa0]
push ebx
push eax
call fcn.0044244b
add esp, 0x20
cmp edi, ebx
jne 0x409b1c
mov edi, dword [ebp - 0xa0]
test byte [ebp + 0x73], 4
je 0x409b4d
push edi
mov dword [ebp + 0x7c], edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [edi + eax*2 - 2]
jmp 0x409b46
mov ax, word [edi]
cmp ax, 0xd
je 0x409b41
cmp ax, 0xa
jne 0x409ba5
mov word [edi], bx
dec edi
dec edi
cmp edi, dword [ebp + 0x7c]
jae 0x409b32
jmp 0x409ba5
test byte [ebp + 0x73], 1
jne 0x409b6c
test byte [ebp + 0x73], 2
je 0x409ba5
jmp 0x409b9d
mov ax, word [edi]
cmp ax, 0xd
je 0x409b71
cmp ax, 0xa
je 0x409b71
inc edi
inc edi
cmp word [edi], bx
jne 0x409b5b
mov word [edi], bx
jmp 0x409ba5
cmp ax, 0xd
je 0x409b86
cmp ax, 0xa
je 0x409b86
inc edi
inc edi
jmp 0x409b9d
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
lea eax, [edi + 2]
push eax
push edi
call fcn.004708c0
add esp, 0xc
mov ax, word [edi]
cmp ax, bx
jne 0x409b76
mov eax, dword [ebp - 0x2c]
cmp word [eax], 0x40
jne 0x409bcf
push dword [ebp - 0xa0]
mov ecx, dword [ebp + 0x50]
push dword [ebp - 0xa0]
push 0x484964
push dword [ebp - 0x48]
push dword [ebp - 0x48]
call fcn.0042ad3a
jmp 0x409bfb
cmp byte [ebp + 0x7b], bl
je 0x409bec
push 1
lea ecx, [ebp + 0x5c]
push ecx
push esi
push dword [ebp + 0x5c]
push eax
push dword [ebp + 0x50]
call fcn.0043f235
add esp, 0x18
jmp 0x409bfb
push dword [ebp - 0xa0]
mov ecx, dword [ebp + 0x50]
push eax
call fcn.0042cbf7
lea ecx, [ebp - 0xa0]
call fcn.00428a48
mov eax, dword [ebp - 8]
push eax
mov dword [ebp + 0x7c], eax
lea eax, [ebp - 0x27c]
push 0x4852f4
push eax
mov word [ebp - 0x27c], bx
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp + 0x50]
add esp, 0xc
lea eax, [ebp - 0x27c]
push eax
push str.ERRORLEVEL
call fcn.0042cbf7
cmp dword [ebp - 0x50], ebx
je 0x409c4d
push 1
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
lea ecx, [ebp + 0x5c]
call fcn.00428a48
mov ecx, dword [ebp - 0x44]
cmp ecx, ebx
je 0x409c72
cmp word [ecx], bx
je 0x409c72
lea eax, [ebp - 0x13c]
push dword [eax + 8]
push ecx
call fcn.00402c41
pop ecx
pop ecx
lea edi, [ebp - 0x13c]
mov eax, dword [edi]
cmp eax, ebx
je 0x409c85
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [ebp - 0x34]
mov eax, dword [esi]
cmp eax, ebx
mov dword [edi], ebx
je 0x409c97
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
lea esi, [ebp + 0x28]
mov eax, dword [esi]
cmp eax, ebx
je 0x409ca9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
lea esi, [ebp - 0x64]
cmp dword [esi], ebx
je 0x409cb9
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
lea esi, [ebp - 0x94]
mov eax, dword [esi]
cmp eax, ebx
je 0x409cce
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
lea esi, [ebp - 0xc]
mov eax, dword [esi]
cmp eax, ebx
je 0x409ce0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
lea esi, [ebp - 0x84]
mov eax, dword [esi]
cmp eax, ebx
je 0x409cf5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14c], ebx
mov dword [esi], ebx
je 0x409d0b
push dword [ebp - 0x14c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x409d19
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x50]
push ebx
mov dword [edi + 4], ebx
call fcn.004403ab
mov ebx, dword [ebp + 0x7c]
lea ecx, [ebp - 0x104]
call fcn.00428a48
lea ecx, [ebp - 0xc0]
call fcn.00428a48
lea ecx, [ebp - 0x4c]
call fcn.00402abc
lea ecx, [ebp - 0xe4]
call fcn.00428a48
lea ecx, [ebp - 0x54]
call fcn.00402abc
lea ecx, [ebp - 0x5c]
call fcn.00402abc
lea ecx, [ebp - 0x64]
call fcn.00402abc
lea ecx, [ebp + 0x28]
call fcn.00402abc
lea ecx, [ebp - 0x34]
call fcn.00402abc
lea ecx, [ebp - 0x84]
call fcn.00402abc
lea ecx, [ebp - 0x94]
call fcn.00402abc
lea ecx, [ebp - 0xc]
call fcn.00402abc
lea ecx, [ebp - 0x44]
call fcn.00428a48
lea ecx, [ebp - 0x11c]
call fcn.00428a48
lea ecx, [ebp - 0xb8]
call fcn.00428a48
lea ecx, [ebp - 0x30]
call fcn.00428a48
lea ecx, [ebp - 0xd0]
call fcn.00428a48
lea ecx, [ebp - 0xb4]
call fcn.00428a48
lea ecx, [ebp - 0xd8]
call fcn.00428a48
lea ecx, [ebp - 0xb0]
call fcn.00428a48
lea ecx, [ebp - 0x50]
call fcn.00402abc
lea ecx, [ebp - 0xe8]
call fcn.00402abc
lea ecx, [ebp - 0xbc]
call fcn.00428a48
lea ecx, [ebp - 0x100]
call fcn.00428a48
lea ecx, [ebp - 0x6c]
call fcn.00428a48
lea ecx, [ebp - 0x80]
call fcn.00428a48
lea ecx, [ebp - 0x2c]
call fcn.00428a48
lea ecx, [ebp - 0xec]
call fcn.00428a48
lea ecx, [ebp - 0xc8]
call fcn.00428a48
lea ecx, [ebp - 0xdc]
call fcn.00428a48
lea ecx, [ebp - 0xe0]
call fcn.00428a48
pop edi
pop esi
mov eax, ebx
pop ebx
add ebp, 0x60
leave
ret 0x18