Function at 0x406e39
Capabilities:
Acquire debug privileges
Check for time delay via gettickcount
Connect pipe
Create directory
Create pipe
Create process on windows
Get common file path
Parse credit card information
Persist via run registry key
Query environment variable
Read file on windows
Resume thread
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
lea ebp, [esp - 0x60]
sub esp, 0x59c
push ebx
push esi
mov dword [ebp + 0x54], ecx
push edi
lea ecx, [ebp - 0x100]
call fcn.00432cb7
xor ebx, ebx
cmp dword [ebp + 0x68], ebx
je 0x406e7d
push dword [ebp + 0x68]
lea ecx, [ebp - 0x100]
call fcn.0043cdc0
mov eax, dword [ebp - 0x100]
mov dword [ebp + 0x68], eax
lea eax, [ebp + 0x68]
push eax
call fcn.0042dd40
pop ecx
lea ecx, [ebp - 0x104]
call fcn.00432cb7
mov esi, dword [ebp + 0x70]
cmp esi, ebx
je 0x406ea1
push esi
lea ecx, [ebp - 0x104]
call fcn.0043cdc0
mov esi, dword [ebp - 0x104]
cmp dword [ebp + 0x78], ebx
jne 0x406eaf
lea eax, [ebp - 0xd0]
mov dword [ebp + 0x78], eax
mov eax, dword [ebp + 0x68]
cmp eax, ebx
mov dword [ebp + 0x4c], eax
jne 0x406ebc
mov dword [ebp + 0x68], esi
mov eax, dword [ebp + 0x74]
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0x20], eax
mov byte [ebp + 0x3b], bl
mov byte [ebp + 0x73], bl
mov byte [ebp + 0x4a], bl
mov byte [ebp + 7], 1
mov byte [ebp - 0x21], bl
mov byte [ebp + 0x43], bl
mov byte [ebp + 0x49], bl
mov byte [ebp - 0x41], bl
mov byte [ebp - 0x2d], bl
mov byte [ebp + 0x47], bl
mov byte [ebp + 0x46], bl
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3e], bl
call fcn.00432cb7
lea ecx, [ebp - 0xfc]
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 0x108], ebx
mov byte [ebp - 0x3f], bl
mov byte [ebp + 0x4b], bl
mov byte [ebp + 0xe], bl
mov byte [ebp - 0x3d], bl
mov byte [ebp + 0xf], 1
mov byte [ebp - 0x35], bl
mov dword [ebp - 0x10], ebx
mov dword [ebp + 0x10], ebx
call fcn.00432cb7
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x54], ebx
mov byte [ebp + 0x77], bl
call fcn.00432cb7
lea ecx, [ebp - 0xb0]
call fcn.00432cb7
lea ecx, [ebp - 0x94]
call fcn.00432cb7
or dword [ebp - 0xd8], 0xffffffff
lea ecx, [ebp - 0x124]
mov byte [ebp - 1], bl
mov dword [ebp - 0xf0], ebx
call fcn.00432cb7
xor eax, eax
push 0xf
pop ecx
mov dword [ebp - 0x234], 0x44
mov dword [ebp - 0x230], ebx
lea edi, [ebp - 0x22c]
rep stosd dword es:[edi], eax
push 0x11
mov dword [ebp - 0x144], ebx
pop ecx
lea edi, [ebp - 0x1f0]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x140]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
cmp esi, ebx
lea edi, [ebp - 0x134]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x74], ebx
mov dword [ebp + 0x20], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xd4], ebx
je 0x406fc0
test byte [0x4a9003], 3
je 0x406fdc
push 0x48f684
lea ecx, [ebp - 0xd4]
call fcn.0043cdc0
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x22c], eax
cmp esi, ebx
je 0x406ff1
cmp word [esi], 0x24
jne 0x406ff1
mov dword [ebp - 0x20], 1
mov byte [ebp + 0x49], 1
cmp esi, ebx
push 2
mov dword [ebp - 0x70], ebx
pop edi
je 0x407075
xor ecx, ecx
cmp word [esi], 0x7c
jne 0x40700e
add dword [ebp + 0x68], edi
add esi, edi
inc ecx
mov dword [ebp - 0x70], ecx
jmp 0x40700f
inc ecx
cmp esi, ebx
je 0x407075
cmp word [esi], 0x2a
jne 0x407075
add dword [ebp + 0x68], edi
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x7c
mov byte [ebp + 0x73], 0x10
jne 0x40702f
add dword [ebp + 0x68], edi
mov dword [ebp - 0x70], ecx
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
cmp ax, 0x31
jne 0x407041
mov byte [ebp + 0x73], 0x11
jmp 0x40705c
mov edx, eax
or edx, 0x20
cmp dx, 0x6e
jne 0x407052
mov byte [ebp + 0x73], 0x12
jmp 0x40705c
cmp ax, 0x2d
jne 0x40705f
mov byte [ebp + 0x73], 0x14
add dword [ebp + 0x68], edi
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
call fcn.00402b57
test al, al
jne 0x407075
mov ebx, ecx
jmp 0x40a5f0
lea eax, [ebp + 0x68]
push eax
call fcn.0042dd40
cmp byte [ebp + 0x73], bl
pop ecx
jne 0x407118
lea eax, [ebp + 0x68]
push eax
call fcn.0042dd40
cmp dword [ebp - 0x74], ebx
mov eax, dword [ebp + 0x68]
pop ecx
mov dword [ebp + 0x50], eax
je 0x4070a6
cmp byte [ebp + 0x73], bl
jne 0x4071eb
cmp word [eax], 0x2d
mov esi, eax
jne 0x4070ba
add eax, 2
cmp word [eax], 0x2d
jne 0x4070ba
mov dword [ebp + 0x50], eax
push 1
lea eax, [ebp + 0x50]
push eax
push 0x48f680
call fcn.004349fd
add esp, 0xc
test al, al
jne 0x4071eb
mov eax, dword [ebp + 0x50]
mov ax, word [eax]
cmp ax, 0x2d
je 0x4070eb
cmp ax, 0x2f
jne 0x4071eb
add dword [ebp + 0x50], edi
push 5
lea eax, [ebp + 0x50]
push eax
push str.catch
call fcn.00434a40
add esp, 0xc
test al, al
je 0x407196
mov al, byte [ebp + 0x73]
or byte [ebp + 0x73], 0x10
cmp al, bl
jne 0x407379
mov edi, dword [ebp + 0x68]
xor ecx, ecx
xor eax, eax
mov ax, word [edi]
inc ecx
cmp ax, bx
mov dword [ebp - 0x20], ecx
mov esi, edi
je 0x40706e
push 2
pop edx
cmp ax, 0x3d
je 0x407144
add esi, edx
mov ax, word [esi]
cmp ax, bx
jne 0x407134
cmp esi, edi
je 0x40706e
cmp word [esi], 0x3d
jne 0x40706e
sub esi, edx
cmp word [esi], 0x2b
jne 0x407165
mov al, byte [esi]
mov byte [ebp - 0x3f], al
sub esi, edx
cmp esi, edi
mov ecx, esi
jbe 0x40717d
mov ax, word [ecx]
call fcn.00402b57
test al, al
je 0x40717d
sub ecx, edx
cmp ecx, edi
ja 0x40716b
mov ax, word [ecx]
call fcn.00402b57
test al, al
jne 0x407417
mov edx, ecx
inc ecx
inc ecx
jmp 0x4073a6
push 4
push dword [ebp + 0x50]
push str.cmd:
call fcn.0042ecb0
add esp, 0xc
test al, al
je 0x4072f7
add dword [ebp + 0x50], 8
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp + 0x50]
push eax
push dword [ebp + 0x54]
call fcn.00403987
add esp, 0x10
mov dword [ebp - 0x74], eax
jmp 0x4071dd
mov word [esi], 0x20
add esi, edi
cmp esi, dword [ebp + 0x50]
jb 0x4071d6
cmp byte [ebp + 0x73], bl
je 0x407379
lea eax, [ebp + 0x68]
push eax
call fcn.0042dd40
mov eax, dword [ebp - 0x74]
cmp eax, ebx
pop ecx
je 0x407204
cmp word [eax], bx
jne 0x407204
mov dword [ebp - 0x74], ebx
cmp dword [ebp - 0x70], ebx
jne 0x407211
cmp dword [ebp + 0x7c], ebx
mov byte [ebp + 0x5b], bl
je 0x407215
mov byte [ebp + 0x5b], 1
xor edi, edi
lea ecx, [ebp - 0xec]
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp + 0x3c], edi
mov dword [ebp + 0x28], ebx
call fcn.00432cb7
lea ecx, [ebp - 0xcc]
call fcn.00432cb7
lea ecx, [ebp - 0xf8]
call fcn.00432cb7
cmp byte [ebp + 0x5b], bl
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0xc4], ebx
mov byte [ebp + 0x48], bl
mov dword [ebp + 0x14], ebx
jne 0x407284
cmp dword [ebp + 0x4c], ebx
jne 0x407284
mov ecx, dword [ebp + 0x54]
push 1
push ebx
lea eax, [ebp - 0xc4]
push eax
push dword [ebp + 0x68]
call fcn.0043b168
mov eax, dword [ebp - 0xc4]
mov dword [ebp + 0x68], eax
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x2d
mov dword [ebp - 0xac], eax
jne 0x40729f
add eax, 2
cmp word [eax], 0x2d
jne 0x40729f
mov dword [ebp + 0x68], eax
push 1
lea eax, [ebp + 0x68]
push eax
push 0x48f680
call fcn.004349fd
add esp, 0xc
test al, al
jne 0x407dbb
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
cmp ax, 0x2d
je 0x4072d0
cmp ax, 0x2f
jne 0x407dbb
push 2
pop esi
add dword [ebp + 0x68], esi
push 5
lea eax, [ebp + 0x68]
push eax
push str.catch
call fcn.004349fd
add esp, 0xc
test al, al
je 0x40741f
mov byte [ebp + 0x73], 0x10
jmp 0x407284
push 3
push dword [ebp + 0x50]
push 0x48f66c
call fcn.0042ecb0
add esp, 0xc
test al, al
je 0x407321
add dword [ebp + 0x50], 6
jmp 0x407316
add dword [ebp + 0x50], edi
mov eax, dword [ebp + 0x50]
cmp word [eax], 0x2a
je 0x407313
jmp 0x407357
push 4
push dword [ebp + 0x50]
push str.exe:
call fcn.0042ecb0
add esp, 0xc
test al, al
je 0x40733d
add dword [ebp + 0x50], 8
jmp 0x407357
push 5
push dword [ebp + 0x50]
push str.logs:
call fcn.0042ecb0
add esp, 0xc
test al, al
je 0x407379
add dword [ebp + 0x50], 0xa
mov eax, dword [ebp + 0x50]
cmp word [eax], 0x22
jne 0x407379
add dword [ebp + 0x50], edi
jmp 0x40736e
add dword [ebp + 0x50], edi
cmp ax, 0x22
je 0x407379
mov eax, dword [ebp + 0x50]
mov ax, word [eax]
cmp ax, bx
jne 0x407365
lea eax, [ebp + 0x50]
push eax
call fcn.0040417e
mov eax, dword [ebp + 0x50]
pop ecx
jmp 0x4070a6
lea eax, [edx - 2]
mov dword [ebp - 0xac], eax
mov ax, word [eax]
call fcn.00402b57
test al, al
jne 0x4073aa
mov edx, dword [ebp - 0xac]
cmp edx, edi
ja 0x40738b
sub ecx, edx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00432ddd
mov edi, dword [ebp + 0x54]
push ebx
lea eax, [ebp - 0x28]
push eax
mov ecx, edi
call fcn.00402bfa
cmp byte [edi + 0x96], bl
jne 0x4073d5
test byte [edi + 0xb], 0xf
je 0x4073eb
push ebx
lea eax, [ebp - 0x28]
push eax
mov ecx, edi
call fcn.00402bfa
jmp 0x4073eb
cmp ax, 0x3d
je 0x4073f9
inc esi
inc esi
mov ax, word [esi]
cmp ax, bx
jne 0x4073e3
cmp ax, 0x3d
jne 0x407417
lea eax, [ebp - 0xf0]
add esi, 2
push eax
mov dword [ebp - 0xf0], esi
call fcn.0042dd40
pop ecx
push 2
pop edi
jmp 0x407088
xor ebx, ebx
inc ebx
jmp 0x40a5f0
push 6
push dword [ebp + 0x68]
push str.clone:
call fcn.0042ecb0
add esp, 0xc
test al, al
je 0x407466
add dword [ebp + 0x68], 0xc
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.0040415a
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
pop ecx
je 0x407455
mov word [eax], bx
add dword [ebp + 0x68], 2
cmp word [esi], bx
je 0x407c1b
mov dword [ebp + 0x20], esi
jmp 0x407c1b
push 9
push dword [ebp + 0x68]
push str.runrmenu:
call fcn.0042ecb0
add esp, 0xc
test al, al
je 0x4074af
add dword [ebp + 0x68], 0x12
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.0040415a
mov eax, dword [ebp + 0x68]
pop ecx
sub eax, esi
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0xe0]
call fcn.00432ddd
lea eax, [ebp + 0x68]
push eax
call fcn.0042dd40
jmp 0x407db5
push 8
push dword [ebp + 0x68]
push str.poprmenu
call fcn.0042ecb0
add esp, 0xc
test al, al
je 0x40755f
add dword [ebp + 0x68], 0x10
mov eax, dword [ebp + 0x68]
mov dword [ebp + 0x1c], eax
lea eax, [ebp + 0x68]
push eax
call fcn.0040415a
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
pop ecx
je 0x4074e8
add dword [ebp + 0x68], esi
lea eax, [ebp + 0x68]
push eax
call fcn.0042dd40
pop ecx
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp + 0x1c]
mov ax, word [eax]
cmp ax, bx
mov byte [ebp - 0x40], 1
je 0x40751d
cmp ax, 0x30
jb 0x40751a
cmp ax, 0x39
jbe 0x40751d
add dword [ebp + 0x1c], esi
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.004358e8
mov eax, dword [ebp + 0x1c]
mov ax, word [eax]
cmp ax, bx
pop ecx
pop ecx
je 0x407549
cmp ax, 0x30
jb 0x407546
cmp ax, 0x39
jbe 0x407549
add dword [ebp + 0x1c], esi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.004358e8
pop ecx
jmp 0x407db5
push 4
pop esi
push esi
push dword [ebp + 0x68]
push str.pid:
call fcn.0042ecb0
add esp, 0xc
test al, al
je 0x40759e
add dword [ebp + 0x68], 8
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.0040415a
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x407c1b
lea ecx, [ebp - 0xec]
jmp 0x407c10
push esi
push dword [ebp + 0x68]
push str.exe:
call fcn.0042ecb0
add esp, 0xc
test al, al
je 0x4076b6
mov eax, dword [ebp + 0x68]
add eax, 8
mov dword [ebp + 0x68], eax
mov cx, word [eax]
xor edx, edx
cmp cx, 0x23
mov esi, eax
mov dword [ebp - 0x1c], ebx
jne 0x4075d7
mov dword [ebp + 0x14], 1
cmp cx, 0x22
jne 0x40764e
lea edi, [eax + 2]
mov esi, eax
mov ecx, edi
jmp 0x40760c
cmp ax, 0x22
jne 0x40760a
inc edx
test dl, 1
je 0x40760a
xor eax, eax
mov ax, word [ecx + 2]
cmp ax, bx
je 0x407617
call fcn.00402b57
test al, al
jne 0x407617
or dword [ebp + 0x14], 2
inc ecx
inc ecx
mov dword [ebp + 0x68], ecx
mov ax, word [ecx]
cmp ax, bx
jne 0x4075e6
push 0x22
pop edx
cmp word [ecx], dx
jne 0x40765b
or dword [ebp - 0x1c], 0xffffffff
inc ecx
inc ecx
mov dword [ebp + 0x68], ecx
cmp word [ecx - 4], dx
mov esi, edi
mov byte [ebp + 0x48], 2
je 0x407642
mov ax, word [esi]
cmp ax, dx
jne 0x40765b
cmp word [esi + 2], dx
jne 0x407647
mov byte [ebp + 0x48], bl
jmp 0x40765b
cmp ax, dx
jne 0x40765b
jmp 0x407642
lea eax, [ebp + 0x68]
push eax
call fcn.0040415a
pop ecx
mov ecx, dword [ebp + 0x68]
sub ecx, esi
sar ecx, 1
add dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], ebx
jle 0x407c1b
add esi, 0xfffffff6
push esi
lea ecx, [ebp - 0xa4]
call fcn.0043cdc0
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x1c]
add eax, 0xa
mov word [eax + ecx*2], bx
cmp word [eax], 0x2a
mov dword [ebp + 0x3c], eax
jne 0x407c1b
cmp word [eax + 2], bx
jne 0x407c1b
lea eax, [ebp - 0xa4]
push eax
call fcn.00403a80
pop ecx
mov dword [ebp + 0x3c], eax
jmp 0x407c1b
push 3
push dword [ebp + 0x68]
push 0x48f66c
call fcn.0042ecb0
add esp, 0xc
test al, al
je 0x4077a1
mov eax, dword [ebp + 0x68]
xor esi, esi
add eax, 6
jmp 0x4076dd
inc esi
inc eax
inc eax
mov dword [ebp + 0x68], eax
cmp word [eax], 0x2a
je 0x4076da
cmp esi, 2
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x58], ebx
jge 0x407767
push 1
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.00414db6
add esp, 0xc
cmp dword [ebp - 0x58], ebx
mov dword [ebp + 0x68], eax
jle 0x407728
push dword [ebp - 0x58]
lea ecx, [ebp - 0x48]
push dword [ebp - 0x114]
call fcn.00432ddd
mov eax, dword [ebp - 0x48]
mov dword [ebp + 0x28], eax
cmp esi, 1
jne 0x407c1b
cmp dword [ebp - 0x58], ebx
jle 0x407c1b
mov eax, dword [ebp - 0x48]
push esi
lea ecx, [ebp - 0x48]
push ecx
push eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x48], ebx
call fcn.0046de50
add esp, 0xc
lea ecx, [ebp - 0x98]
mov dword [ebp + 0x28], eax
call fcn.0042dd2d
jmp 0x407c1b
push 0x105
lea ecx, [ebp - 0x48]
call fcn.00432cfe
push 0x104
push dword [ebp - 0x48]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push ebx
push dword [ebp - 0x48]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
je 0x407796
mov word [eax], bx
mov eax, dword [ebp - 0x48]
mov dword [ebp + 0x28], eax
jmp 0x407c1b
push 5
push dword [ebp + 0x68]
push str.logs:
call fcn.0042ecb0
add esp, 0xc
test al, al
je 0x40781a
mov eax, dword [ebp + 0x68]
add eax, 0xa
xor ecx, ecx
mov dword [ebp + 0x68], eax
mov dword [ebp - 0x6c], eax
cmp word [eax], 0x3f
sete cl
mov esi, ecx
cmp esi, ebx
je 0x4077d8
add eax, 2
mov dword [ebp - 0x6c], eax
mov edi, eax
push 1
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp - 0x6c]
push eax
mov dword [ebp + 0x24], ebx
call fcn.00414db6
add esp, 0xc
cmp dword [ebp + 0x24], ebx
mov dword [ebp + 0x68], eax
jle 0x407c1b
cmp esi, ebx
je 0x40780b
cmp dword [0x4a5e10], ebx
je 0x407c1b
push dword [ebp + 0x24]
lea ecx, [ebp - 0xfc]
push edi
jmp 0x407c16
push 5
lea eax, [ebp + 0x68]
push eax
push str.nowin
call fcn.004349fd
add esp, 0xc
test al, al
je 0x40783a
mov byte [ebp - 0x3e], 1
jmp 0x407284
push esi
lea eax, [ebp + 0x68]
push eax
push str.hide
call fcn.004349fd
add esp, 0xc
test al, al
je 0x40785c
mov dword [ebp - 0x10], 0x10000000
jmp 0x407284
push esi
lea eax, [ebp + 0x68]
push eax
push 0x48f61c
call fcn.004349fd
add esp, 0xc
test al, al
je 0x40787e
mov dword [ebp - 0x20], 1
jmp 0x407284
push 3
lea eax, [ebp + 0x68]
push eax
push 0x48f618
call fcn.004349fd
add esp, 0xc
test al, al
je 0x40789e
or byte [ebp + 0x4a], 1
jmp 0x407284
push esi
lea eax, [ebp + 0x68]
push eax
push str.err
call fcn.004349fd
add esp, 0xc
test al, al
je 0x4078bd
or byte [ebp + 0x4a], 3
jmp 0x407284
push 5
lea eax, [ebp + 0x68]
push eax
push str.limit
call fcn.004349fd
add esp, 0xc
test al, al
je 0x4078dd
mov byte [ebp - 0x2d], 1
jmp 0x407284
push 3
lea eax, [ebp + 0x68]
push eax
push 0x48f604
call fcn.004349fd
add esp, 0xc
test al, al
je 0x4078fd
mov byte [ebp + 0x47], 1
jmp 0x407284
push esi
lea eax, [ebp + 0x68]
push eax
push str.hook
call fcn.004349fd
add esp, 0xc
test al, al
je 0x40791c
mov byte [ebp + 0x49], 1
jmp 0x407284
push 3
lea eax, [ebp + 0x68]
push eax
push 0x48f5f8
call fcn.004349fd
add esp, 0xc
test al, al
je 0x40793f
mov dword [ebp - 0x10], 6
jmp 0x407284
push 3
lea eax, [ebp + 0x68]
push eax
push 0x48f5f4
call fcn.004349fd
add esp, 0xc
test al, al
je 0x407962
mov dword [ebp - 0x10], 3
jmp 0x407284
push esi
lea eax, [ebp + 0x68]
push eax
push str.show
call fcn.004349fd
add esp, 0xc
test al, al
je 0x407984
mov dword [ebp - 0x10], 1
jmp 0x407284
push esi
lea eax, [ebp + 0x68]
push eax
push 0x48f5e4
call fcn.004349fd
add esp, 0xc
test al, al
je 0x4079a3
mov byte [ebp - 0x41], 1
jmp 0x407284
push 2
lea eax, [ebp + 0x68]
push eax
push 0x48f5e0
call fcn.004349fd
add esp, 0xc
test al, al
je 0x4079c3
mov byte [ebp + 7], 1
jmp 0x407284
push esi
lea eax, [ebp + 0x68]
push eax
push str.no64
call fcn.004349fd
add esp, 0xc
test al, al
je 0x4079e1
mov byte [ebp + 7], bl
jmp 0x407284
push 3
lea eax, [ebp + 0x68]
push eax
push 0x48f5d4
call fcn.004349fd
add esp, 0xc
test al, al
je 0x407a01
mov byte [ebp - 0x21], 1
jmp 0x407284
push 2
lea eax, [ebp + 0x68]
push eax
push 0x48f5d0
call fcn.004349fd
add esp, 0xc
test al, al
je 0x407a21
mov byte [ebp + 0x43], 1
jmp 0x407284
push 5
lea eax, [ebp + 0x68]
push eax
push str.incmd
call fcn.004349fd
add esp, 0xc
test al, al
je 0x407a41
mov byte [ebp - 0x3d], 1
jmp 0x407284
push 7
lea eax, [ebp + 0x68]
push eax
push str.hidecmd
call fcn.004349fd
add esp, 0xc
test al, al
je 0x407a61
mov byte [ebp + 0xf], 1
jmp 0x407284
push 8
lea eax, [ebp + 0x68]
push eax
push str.hidecmd_
call fcn.004349fd
add esp, 0xc
test al, al
je 0x407a80
mov byte [ebp + 0xf], bl
jmp 0x407284
push 3
push dword [ebp + 0x68]
push 0x48f5b0
call fcn.0042ecb0
add esp, 0xc
test al, al
je 0x407ad2
add dword [ebp + 0x68], 6
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x3a
mov byte [ebp + 0x46], 1
jne 0x407c1b
add dword [ebp + 0x68], 2
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.0040415a
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x407c1b
lea ecx, [ebp - 0xcc]
jmp 0x407c10
push 5
push dword [ebp + 0x68]
push str.code:
call fcn.0042ecb0
add esp, 0xc
test al, al
je 0x407b87
add dword [ebp + 0x68], 0xa
mov eax, dword [ebp + 0x68]
mov dword [ebp + 8], eax
push 0xffffffffffffffff
lea eax, [ebp + 8]
push eax
push str.UTF8
call fcn.004349fd
add esp, 0xc
test al, al
je 0x407b1d
mov byte [ebp + 0x77], 1
mov dword [ebp - 0x54], 0xfde9
jmp 0x407dac
push 0xffffffffffffffff
lea eax, [ebp + 8]
push eax
push str.ANSI
call fcn.004349fd
add esp, 0xc
test al, al
je 0x407b40
mov byte [ebp + 0x77], 1
mov dword [ebp - 0x54], ebx
jmp 0x407dac
push 0xffffffffffffffff
lea eax, [ebp + 8]
push eax
push 0x48f594
call fcn.004349fd
add esp, 0xc
test al, al
je 0x407b67
mov byte [ebp + 0x77], 2
mov dword [ebp - 0x54], 0x4b0
jmp 0x407dac
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp + 8]
push eax
call fcn.004358e8
test eax, eax
pop ecx
pop ecx
jle 0x407dac
mov byte [ebp + 0x77], 1
jmp 0x407dac
push 5
push dword [ebp + 0x68]
push str.user:
call fcn.0042ecb0
add esp, 0xc
test al, al
je 0x407bbd
add dword [ebp + 0x68], 0xa
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.0040415a
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x407c1b
lea ecx, [ebp - 0xb0]
jmp 0x407c10
push 7
push dword [ebp + 0x68]
push str.passwd:
call fcn.0042ecb0
add esp, 0xc
test al, al
je 0x407bd8
mov byte [ebp - 1], bl
jmp 0x407bf2
push 7
push dword [ebp + 0x68]
push str.passwd
call fcn.0042ecb0
add esp, 0xc
test al, al
je 0x407c2d
mov byte [ebp - 1], 1
add dword [ebp + 0x68], 0xe
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.0040415a
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x407c1b
lea ecx, [ebp - 0x94]
sub eax, esi
sar eax, 1
push eax
push esi
call fcn.00432ddd
lea eax, [ebp + 0x68]
push eax
call fcn.0042dd40
mov edi, dword [ebp + 0x3c]
pop ecx
jmp 0x407284
push 8
lea eax, [ebp + 0x68]
push eax
push str.REALTIME
call fcn.004349fd
add esp, 0xc
test al, al
je 0x407c50
mov dword [ebp + 0x10], 0x100
jmp 0x407284
push esi
lea eax, [ebp + 0x68]
push eax
push str.HIGH
call fcn.004349fd
add esp, 0xc
test al, al
je 0x407c72
mov dword [ebp + 0x10], 0x80
jmp 0x407284
push 0xb
lea eax, [ebp + 0x68]
push eax
push str.ABOVENORMAL
call fcn.004349fd
add esp, 0xc
test al, al
je 0x407c95
mov dword [ebp + 0x10], 0x8000
jmp 0x407284
push 6
lea eax, [ebp + 0x68]
push eax
push str.NORMAL
call fcn.004349fd
add esp, 0xc
test al, al
je 0x407cb8
mov dword [ebp + 0x10], 0x20
jmp 0x407284
push 0xb
lea eax, [ebp + 0x68]
push eax
push str.BELOWNORMAL
call fcn.004349fd
add esp, 0xc
test al, al
je 0x407cdb
mov dword [ebp + 0x10], 0x4000
jmp 0x407284
push 3
lea eax, [ebp + 0x68]
push eax
push 0x48f544
call fcn.004349fd
add esp, 0xc
test al, al
jne 0x407d2b
mov esi, dword [ebp + 0x68]
push 4
push esi
push 0x48f538
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x407d37
xor ecx, ecx
mov cx, word [esi + 8]
mov eax, ecx
call fcn.00402b57
test al, al
jne 0x407d1d
cmp cx, bx
jne 0x407d37
add dword [ebp + 0x68], 8
lea eax, [ebp + 0x68]
push eax
call fcn.0042dd40
pop ecx
mov dword [ebp + 0x10], 0x40
jmp 0x407284
push 3
lea eax, [ebp + 0x68]
push eax
push 0x48f534
call fcn.004349fd
add esp, 0xc
test al, al
je 0x407d57
mov byte [ebp + 0x4b], 1
jmp 0x407284
push 3
lea eax, [ebp + 0x68]
push eax
push 0x48f530
call fcn.004349fd
add esp, 0xc
test al, al
je 0x407d7d
mov byte [ebp + 0xe], 1
mov byte [ebp + 0x77], bl
mov dword [ebp - 0x54], ebx
jmp 0x407284
push 3
lea eax, [ebp + 0x68]
push eax
push 0x48f52c
call fcn.004349fd
add esp, 0xc
test al, al
je 0x407d9d
mov byte [ebp - 0x35], 1
jmp 0x407284
mov eax, dword [ebp - 0xac]
cmp word [eax], 0x2d
mov dword [ebp + 0x68], eax
jne 0x407dbb
lea eax, [ebp + 0x68]
push eax
call fcn.0040417e
pop ecx
jmp 0x407284
cmp dword [ebp - 0x54], 0x4b0
jne 0x407dc8
mov byte [ebp + 0x77], 2
mov eax, dword [ebp - 0xf0]
cmp eax, ebx
je 0x407dfb
cmp byte [ebp + 0x5b], bl
mov dword [ebp + 0x68], eax
jne 0x407dfb
cmp dword [ebp + 0x4c], ebx
jne 0x407dfb
push 1
push ebx
lea ecx, [ebp - 0xc4]
push ecx
mov ecx, dword [ebp + 0x54]
push eax
call fcn.0043b168
mov eax, dword [ebp - 0xc4]
mov dword [ebp + 0x68], eax
cmp edi, ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x34], ebx
je 0x407e1f
cmp word [edi], bx
je 0x407e1f
cmp word [ebp + 0x14], bx
je 0x407e22
mov byte [ebp + 0x4b], bl
cmp edi, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ebx
mov dword [ebp + 0x2c], ebx
mov dword [ebp - 0x110], 0x48ee14
je 0x407f11
cmp word [edi], 0x2a
jne 0x407e51
inc edi
inc edi
inc dword [ebp - 0x18]
cmp word [edi], 0x2a
je 0x407e43
mov dword [ebp + 0x3c], edi
cmp word [edi], 0x3f
jne 0x407e7d
inc edi
inc edi
mov dword [ebp + 0x3c], edi
mov dword [ebp - 0x110], edi
jmp 0x407e6f
inc edi
inc edi
cmp ax, 0x3a
mov dword [ebp + 0x3c], edi
je 0x407e79
mov ax, word [edi]
cmp ax, bx
jne 0x407e64
jmp 0x407e7d
mov word [edi - 2], bx
mov ax, word [edi]
push 0x20
pop ecx
or ax, cx
cmp ax, 0x63
jne 0x407eb9
mov dx, word [edi + 2]
or dx, cx
cmp dx, 0x61
jne 0x407eb9
mov dx, word [edi + 4]
or dx, cx
cmp dx, 0x62
jne 0x407eb9
cmp word [edi + 6], 0x3a
jne 0x407eb9
mov dword [ebp - 8], 1
add edi, 8
jmp 0x407edd
cmp ax, 0x65
jne 0x407ee0
mov ax, word [edi + 2]
or ax, cx
cmp ax, 0x78
jne 0x407ee0
cmp word [edi + 4], 0x3a
jne 0x407ee0
mov dword [ebp - 8], 0x100
add edi, 6
mov dword [ebp + 0x3c], edi
cmp edi, ebx
je 0x407f11
mov ax, word [edi]
or ax, cx
cmp ax, 0x75
jne 0x407f11
mov ax, word [edi + 2]
or ax, cx
cmp ax, 0x64
jne 0x407f11
cmp word [edi + 4], 0x3a
jne 0x407f11
add edi, 6
mov dword [ebp + 0x2c], 1
mov dword [ebp + 0x3c], edi
cmp byte [ebp + 0x4b], bl
je 0x407f58
cmp edi, ebx
je 0x407f58
cmp word [ebp - 8], bx
jne 0x407f58
cmp word [ebp + 0x2c], bx
jne 0x407f58
xor eax, eax
cmp byte [ebp + 0x48], bl
mov ecx, edi
setne al
mov esi, eax
xor eax, eax
mov ax, word [edi]
jmp 0x407f53
cmp ax, 0x22
jne 0x407f4e
inc esi
cmp esi, 2
jl 0x407f4e
cmp word [ecx + 2], bx
je 0x407f4e
mov byte [ebp + 0x4b], bl
inc ecx
inc ecx
mov ax, word [ecx]
cmp ax, bx
jne 0x407f39
cmp word [ebp - 0x18], bx
jne 0x407f6a
cmp word [ebp - 8], bx
jne 0x407f6a
cmp word [ebp + 0x2c], bx
je 0x407f6d
mov byte [ebp + 0x48], bl
cmp byte [ebp + 0x4b], bl
je 0x407fb2
xor eax, eax
cmp word [ebp + 0x2c], bx
sete al
xor ecx, ecx
cmp word [ebp - 8], bx
sete cl
test ecx, eax
je 0x407fb2
push 0x2a
push edi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
mov dword [ebp - 0x34], eax
je 0x407fa0
mov word [eax], bx
inc eax
inc eax
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x150]
push eax
push edi
call fcn.004103ea
pop ecx
pop ecx
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp + 0x78]
xor ecx, ecx
inc ecx
mov dword [eax], ecx
xor eax, eax
lea edi, [ebp - 0x11c]
mov dword [ebp - 0x120], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x170], ebx
lea edi, [ebp - 0x16c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
cmp dword [ebp + 0x20], ebx
mov dword [ebp - 0x5c], ebx
setne al
cmp byte [ebp + 0x43], bl
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x1c], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x15c], 0xc
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0xe8], ebx
je 0x408053
lea eax, [ebp - 0x234]
or byte [eax + 0x2d], cl
mov dword [ebp - 0x14], ecx
mov ecx, dword [0x4a42e4]
mov dword [eax + 0x3c], ecx
mov ecx, dword [0x4a42e8]
mov dword [eax + 0x40], ecx
mov ecx, dword [0x4a42e0]
mov dword [eax + 0x38], ecx
cmp byte [ebp + 0x5b], bl
je 0x408452
mov ecx, dword [ebp + 0x68]
cmp word [ecx], 0x7c
mov dword [ebp + 0x14], ebx
jne 0x408081
inc ecx
inc ecx
xor eax, eax
mov dword [ebp + 0x68], ecx
mov ax, word [ecx]
cmp ax, 0x7c
je 0x408068
call fcn.00402b57
test al, al
jne 0x408068
mov dword [ebp + 0x24], ecx
push 0x7c
push ebx
push dword [ebp + 0x68]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
mov dword [ebp + 0x5c], eax
je 0x4080be
mov word [eax], bx
add dword [ebp + 0x5c], 2
lea eax, [ebp + 0x5c]
push eax
call fcn.0042dd40
mov eax, dword [ebp + 0x5c]
cmp word [eax], bx
pop ecx
je 0x408084
mov ecx, dword [ebp + 0x24]
cmp word [ecx], bx
mov dl, 1
je 0x4080c0
mov cl, dl
jmp 0x4080cc
xor dl, dl
xor cl, cl
cmp dl, bl
jne 0x4080cc
mov eax, dword [ebp + 0x24]
mov dword [ebp + 0x5c], eax
cmp cl, bl
mov dword [ebp + 0x4c], eax
je 0x40818a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
push ebx
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0x78]
push eax
xor edi, edi
lea eax, [ebp - 0x60]
inc edi
push eax
mov dword [ebp - 0xbc], 0xc
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xb4], edi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x40811b
mov ecx, dword [ebp + 0x54]
push edi
call fcn.0040ce62
mov edi, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 3
push ebx
push ebx
lea eax, [ebp - 0x60]
push eax
push esi
push dword [ebp - 0x60]
push esi
call edi
cmp dword [ebp - 0x78], ebx
mov word [ebp + 0x42], bx
je 0x40815c
push dword [ebp - 0x78]
mov ecx, dword [ebp + 0x54]
push ebx
push ebx
lea eax, [ebp + 0x42]
push eax
push ecx
push dword [ebp + 0x24]
call fcn.00406e39
cmp dword [ebp - 0x78], ebx
je 0x40815c
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 3
push 1
push ebx
lea eax, [ebp - 0x60]
push eax
push esi
push dword [ebp - 0x60]
mov dword [ebp - 0x78], ebx
push esi
call edi
mov ecx, dword [ebp - 0x60]
cmp ecx, ebx
je 0x40818a
lea eax, [ebp - 0x234]
or byte [eax + 0x2d], 1
mov dword [ebp - 0x14], 1
mov dword [eax + 0x38], ecx
mov eax, dword [ebp + 0x4c]
mov dword [ebp + 0x5c], eax
xor edi, edi
inc edi
mov cx, word [eax]
cmp cx, bx
je 0x4083ee
cmp cx, 0x3c
je 0x4081b8
cmp cx, 0x3e
je 0x4081b8
inc eax
inc eax
mov dword [ebp + 0x5c], eax
mov cx, word [eax]
cmp cx, bx
jne 0x40819f
mov cx, word [eax]
cmp cx, bx
je 0x4083ee
cmp cx, 0x3c
jne 0x408293
mov word [eax], bx
add dword [ebp + 0x5c], 2
lea eax, [ebp + 0x5c]
push eax
call fcn.0042dd40
mov eax, dword [ebp + 0x5c]
cmp word [eax], bx
pop ecx
je 0x408293
mov dword [ebp - 0xc], eax
jmp 0x408201
cmp cx, 0x3c
je 0x408209
cmp cx, 0x3e
je 0x408209
inc eax
inc eax
mov dword [ebp + 0x5c], eax
mov cx, word [eax]
cmp cx, bx
jne 0x4081f0
sub eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x64]
sar eax, 1
push eax
push dword [ebp - 0xc]
call fcn.0043cd19
lea ecx, [ebp + 0x24]
call fcn.00432cb7
mov ecx, dword [ebp + 0x54]
push edi
push ebx
lea eax, [ebp + 0x24]
push eax
push dword [ebp - 0xc]
call fcn.0043b168
mov eax, dword [ebp + 0x24]
push eax
mov dword [ebp - 0xc], eax
call fcn.0040c79a
lea eax, [ebp - 0xc]
push eax
call fcn.0042dd40
cmp dword [ebp - 0x2c], ebx
pop ecx
pop ecx
je 0x408258
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
push 3
lea eax, [ebp - 0x15c]
push eax
push 7
push 0xc0000000
push dword [ebp - 0xc]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
call fcn.004041da
cmp dword [ebp - 0x2c], ebx
jne 0x408280
mov dword [ebp - 0x2c], ebx
lea ecx, [ebp + 0x24]
call fcn.0042dd2d
lea ecx, [ebp - 0x64]
call fcn.0042dd2d
mov eax, dword [ebp + 0x5c]
cmp word [eax], 0x3e
jne 0x408193
mov word [eax], bx
mov eax, dword [ebp + 0x5c]
xor esi, esi
cmp word [eax - 2], 0x32
mov byte [ebp + 0x5b], 1
jne 0x4082b8
mov byte [ebp + 0x5b], 2
mov word [eax - 2], bx
add dword [ebp + 0x5c], 2
mov eax, dword [ebp + 0x5c]
cmp word [eax], 0x3e
jne 0x4082cb
add dword [ebp + 0x5c], 2
mov esi, edi
mov eax, dword [ebp + 0x5c]
cmp word [eax], 0x26
jne 0x4082dc
add dword [ebp + 0x5c], 2
mov byte [ebp + 0x5b], 3
lea eax, [ebp + 0x5c]
push eax
call fcn.0042dd40
mov eax, dword [ebp + 0x5c]
cmp word [eax], bx
pop ecx
je 0x408193
mov dword [ebp + 0x34], eax
jmp 0x408308
cmp cx, 0x3c
je 0x408310
cmp cx, 0x3e
je 0x408310
inc eax
inc eax
mov dword [ebp + 0x5c], eax
mov cx, word [eax]
cmp cx, bx
jne 0x4082f7
sub eax, dword [ebp + 0x34]
lea ecx, [ebp - 0x6c]
sar eax, 1
push eax
push dword [ebp + 0x34]
call fcn.0043cd19
lea ecx, [ebp + 8]
call fcn.00432cb7
mov ecx, dword [ebp + 0x54]
push edi
push ebx
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x34]
call fcn.0043b168
mov eax, dword [ebp + 8]
push eax
mov dword [ebp + 0x34], eax
call fcn.0040c79a
lea eax, [ebp + 0x34]
push eax
call fcn.0042dd40
test byte [ebp + 0x5b], 1
pop ecx
pop ecx
je 0x408368
cmp dword [ebp - 0x4c], ebx
je 0x408365
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x4c], ebx
test byte [ebp + 0x5b], 2
je 0x408382
cmp dword [ebp - 0x80], ebx
je 0x40837c
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x80], ebx
mov dword [ebp + 0x14], ebx
push ebx
push ebx
push 4
lea eax, [ebp - 0x15c]
push eax
push 7
push 0x40000000
push dword [ebp + 0x34]
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x9c], ebx
call fcn.004041da
mov edi, eax
cmp edi, ebx
jne 0x4083c6
lea ecx, [ebp + 8]
call fcn.0042dd2d
lea ecx, [ebp - 0x6c]
call fcn.0042dd2d
mov eax, dword [ebp + 0x5c]
jmp 0x408190
cmp esi, ebx
je 0x4083d5
push 2
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [ebp + 0x5b], 1
jne 0x4083e0
mov dword [ebp - 0x4c], edi
jmp 0x4083ae
cmp byte [ebp + 0x5b], 3
mov dword [ebp + 0x14], edi
je 0x4083db
mov dword [ebp - 0x80], edi
jmp 0x4083ae
mov ecx, dword [ebp - 0x2c]
cmp ecx, ebx
mov edx, 0x100
je 0x408409
lea eax, [ebp - 0x234]
or dword [eax + 0x2c], edx
mov dword [ebp - 0x14], edi
mov dword [eax + 0x38], ecx
mov ecx, dword [ebp - 0x4c]
cmp ecx, ebx
je 0x40841f
lea eax, [ebp - 0x234]
or dword [eax + 0x2c], edx
mov dword [ebp - 0x14], edi
mov dword [eax + 0x3c], ecx
mov ecx, dword [ebp + 0x14]
cmp ecx, ebx
je 0x408435
lea eax, [ebp - 0x234]
or dword [eax + 0x2c], edx
mov dword [ebp - 0x14], edi
mov dword [eax + 0x40], ecx
mov ecx, dword [ebp + 0x54]
push edi
push ebx
lea eax, [ebp - 0xe8]
push eax
push dword [ebp + 0x4c]
call fcn.0043b168
mov eax, dword [ebp - 0xe8]
mov dword [ebp + 0x68], eax
push 6
pop edi
mov esi, 0x10000000
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
cmp ax, 0x21
je 0x408494
cmp ax, 0x2a
je 0x408494
cmp ax, 0x40
jne 0x40849d
push str.WinSta0WinLogon
lea ecx, [ebp - 0xd4]
call fcn.0043cdc0
mov ecx, dword [ebp - 0xd4]
inc byte [ebp + 0x3b]
lea eax, [ebp - 0x234]
mov dword [eax + 8], ecx
mov dword [ebp - 0x10], esi
add dword [ebp + 0x68], 2
jmp 0x40845a
cmp ax, 0x3d
jne 0x4084ac
mov dword [ebp - 0x20], 1
jmp 0x408497
cmp ax, 0x24
jne 0x4084b8
mov byte [ebp + 0x46], 1
jmp 0x408497
cmp ax, 0x26
jne 0x4084c7
mov dword [ebp - 0x10], 3
jmp 0x408497
cmp ax, 0x5e
jne 0x4084d2
mov dword [ebp - 0x10], edi
jmp 0x408497
cmp ax, 0x5f
je 0x4084cd
lea edi, [ebp - 0x234]
cmp dword [edi + 8], ebx
je 0x4084f6
test byte [ebp + 0x3b], 1
je 0x4084f6
call fcn.00403925
cmp eax, 1
jge 0x4084f6
mov dword [edi + 8], ebx
mov eax, dword [ebp + 0x7c]
cmp eax, ebx
je 0x408511
or byte [edi + 0x2d], 1
mov dword [ebp - 0x20], ebx
mov byte [ebp + 0x73], bl
mov dword [ebp - 0x14], 1
mov dword [edi + 0x3c], eax
cmp byte [ebp + 0x46], bl
je 0x408531
mov eax, dword [ebp - 0xcc]
cmp word [eax], bx
jne 0x408531
push str.open
lea ecx, [ebp - 0xcc]
call fcn.0043cd64
cmp byte [ebp - 0x41], bl
je 0x408582
push 0x5c
push dword [ebp + 0x68]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edi, eax
cmp edi, ebx
je 0x40854b
inc edi
inc edi
jmp 0x40854e
mov edi, dword [ebp + 0x68]
push dword [ebp + 0x68]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push dword [ebp + 0x68]
xor eax, eax
cmp dword [ebp - 0x20], ebx
push 1
setne al
push edi
push 0x48f4a0
add eax, 0x80000001
push eax
call fcn.0042eb45
add esp, 0x18
mov ebx, eax
jmp 0x40a53a
lea eax, [ebp + 0x68]
push eax
call fcn.0042dd40
cmp dword [ebp + 0x20], ebx
pop ecx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0xdc], ebx
je 0x408635
lea ecx, [ebp + 8]
mov byte [ebp + 0x46], bl
call fcn.00432cb7
mov ecx, dword [ebp + 0x54]
push 0xffffffffffffffff
push ebx
push dword [ebp + 0x20]
call fcn.0041065a
cmp eax, ebx
je 0x408623
mov ecx, dword [eax]
cmp word [ecx], bx
je 0x408623
push eax
lea ecx, [ebp + 8]
call fcn.0043cd92
push dword [ebp + 0x68]
lea ecx, [ebp - 0xdc]
call fcn.0043cdc0
push dword [ebp - 0xfc]
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0xdc]
push eax
push dword [ebp + 8]
call fcn.00406bed
mov edi, eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp + 0x3c], eax
mov eax, dword [ebp - 0xdc]
add esp, 0x14
lea ecx, [ebp + 8]
mov dword [ebp + 0x68], eax
call fcn.0042dd2d
cmp edi, ebx
je 0x408635
mov ebx, edi
jmp 0x40a527
lea ecx, [ebp + 8]
call fcn.0042dd2d
mov ebx, 0x80070057
jmp 0x40a527
mov eax, dword [ebp - 0xe0]
cmp word [eax], bx
je 0x408686
push dword [ebp + 0x68]
call fcn.0040e84c
pop ecx
push eax
lea ecx, [ebp + 0x70]
mov dword [ebp + 0x68], eax
call fcn.0043ccfc
push 0x48f49c
lea ecx, [ebp + 0x70]
call fcn.00432d25
push dword [ebp - 0xe0]
lea ecx, [ebp + 0x70]
call fcn.00432d25
mov ecx, dword [ebp + 0x54]
push ebx
push dword [ebp + 0x70]
call fcn.00443ad0
mov ebx, eax
lea ecx, [ebp + 0x70]
jmp 0x40a522
cmp byte [ebp - 0x40], bl
je 0x4087d1
lea ecx, [ebp + 0x7c]
call fcn.00432cb7
push dword [ebp + 0x68]
mov dword [ebp + 0x70], ebx
call fcn.0040e84c
pop ecx
lea ecx, [ebp + 0x78]
mov dword [ebp + 0x68], eax
call fcn.00432cb7
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x78]
push eax
push dword [ebp + 0x68]
mov dword [ebp + 0x30], ebx
call fcn.0046de50
mov eax, dword [ebp + 0x30]
add esp, 0xc
cmp eax, ebx
jne 0x4086db
lea ecx, [ebp + 0x78]
call fcn.0042dd2d
lea ecx, [ebp + 0x7c]
jmp 0x408626
mov word [eax - 2], bx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push dword [ebp + 0x78]
lea ecx, [ebp - 0x58]
mov edi, eax
call fcn.0043ccfc
push dword [ebp + 0x30]
mov esi, dword [ebp - 0x58]
lea ecx, [ebp + 0x6c]
call fcn.0043ccfc
push edi
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp + 0x70]
push eax
push dword [ebp + 0x6c]
push esi
call fcn.0040576c
add esp, 0x14
cmp dword [ebp + 0x70], ebx
jle 0x408755
mov eax, dword [ebp + 0x54]
mov eax, dword [eax + 0x2c]
xor esi, esi
cmp eax, ebx
je 0x408729
mov esi, dword [eax + 0x18]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebx
push esi
push ebx
push dword [ebp - 0x108]
push dword [ebp - 0x10c]
push 0x128
push edi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
push edi
call dword [sym.imp.USER32.dll_DestroyMenu]
cmp dword [ebp + 0x70], ebx
jle 0x4087b1
mov esi, dword [ebp + 0x7c]
lea eax, [ebp + 0x70]
mov dword [ebp + 0x70], esi
call fcn.0041025e
mov eax, dword [ebp + 0x70]
mov word [eax], bx
cmp word [esi], bx
je 0x4087b1
push dword [ebp + 0x68]
lea ecx, [ebp + 0x74]
call fcn.0043ccfc
push 0x48f49c
lea ecx, [ebp + 0x74]
call fcn.00432d25
push esi
lea ecx, [ebp + 0x74]
call fcn.00432d25
mov ecx, dword [ebp + 0x54]
push ebx
push dword [ebp + 0x74]
call fcn.00443ad0
lea ecx, [ebp + 0x74]
mov ebx, eax
call fcn.0042dd2d
lea ecx, [ebp + 0x6c]
call fcn.0042dd2d
lea ecx, [ebp - 0x58]
call fcn.0042dd2d
lea ecx, [ebp + 0x78]
call fcn.0042dd2d
lea ecx, [ebp + 0x7c]
jmp 0x40a522
push dword [ebp + 0x68]
lea ecx, [ebp - 0xc8]
call fcn.0043ccfc
cmp byte [ebp - 0x3d], bl
je 0x408894
push 0x48f474
lea ecx, [ebp - 0xc8]
call fcn.0043cdc0
push 1
lea eax, [ebp + 0x68]
push ebx
push eax
call fcn.00414db6
add esp, 0xc
push eax
lea ecx, [ebp - 0xc8]
mov dword [ebp + 0x68], eax
call fcn.00432d25
lea eax, [ebp - 0xa4]
push eax
call fcn.00403a80
pop ecx
mov dword [ebp + 0x3c], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, 0x10000000
mov eax, dword [ebp - 0xc8]
mov dword [ebp + 0x68], eax
je 0x40883f
cmp byte [ebp - 0x35], bl
je 0x408849
lea eax, [ebp - 0x234]
or byte [eax + 0x2c], 0x80
xor edi, edi
inc edi
cmp ecx, ebx
je 0x40885d
lea eax, [ebp - 0x234]
or dword [eax + 0x2c], edi
mov word [eax + 0x30], cx
mov al, byte [ebp + 0x3b]
and al, 3
cmp al, 3
je 0x40886b
cmp byte [ebp - 0x3e], bl
je 0x408875
lea eax, [ebp - 0x234]
or byte [eax + 0x2f], 8
lea eax, [ebp - 0x234]
cmp dword [eax + 8], ebx
je 0x408b41
cmp byte [ebp + 0x3b], bl
jle 0x408b41
mov eax, edi
jmp 0x408b43
cmp byte [ebp + 0xf], bl
je 0x408826
cmp dword [ebp - 0x10], esi
je 0x408826
mov eax, dword [ebp - 0xc8]
push ebx
mov dword [ebp + 0x68], eax
lea eax, [ebp + 0x68]
push ebx
push eax
mov dword [ebp - 0x3c], ebx
call fcn.00414db6
mov esi, eax
mov eax, dword [ebp + 0x68]
mov dword [ebp - 0x3c], eax
push 3
lea eax, [ebp - 0x3c]
push eax
push 0x48f470
call fcn.004349fd
add esp, 0x18
test al, al
jne 0x408998
push 7
lea eax, [ebp - 0x3c]
push eax
push str.cmd.exe
call fcn.004349fd
add esp, 0xc
test al, al
jne 0x408998
cmp dword [0x4a5bc4], ebx
jne 0x408944
push ebx
push 0x24
lea eax, [ebp - 0x53c]
push eax
push ebx
mov word [ebp - 0x53c], bx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x53c]
mov edi, 0x4a5bc4
push eax
mov ecx, edi
call fcn.0043cdc0
push str.System32cmd.exe
mov ecx, edi
call fcn.00432d25
push dword [0x4a5bc4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov word [0x4a5ba8], ax
movsx eax, word [0x4a5ba8]
push eax
push dword [ebp - 0x3c]
mov dword [ebp + 0x4c], ebx
push dword [0x4a5bc4]
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x408a0d
movsx eax, word [0x4a5ba8]
mov ecx, dword [ebp - 0x3c]
lea ecx, [ecx + eax*2]
xor eax, eax
mov ax, word [ecx]
cmp ax, 0x22
je 0x40898b
call fcn.00402b57
test al, al
je 0x408a0d
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], ecx
call fcn.0040417e
pop ecx
push 2
lea eax, [ebp - 0x3c]
push eax
push 0x48f440
call fcn.004349fd
add esp, 0xc
test al, al
je 0x408a0d
mov eax, dword [ebp - 0x3c]
cmp word [eax], 0x22
jne 0x4089f3
add eax, 2
mov dword [ebp + 0x7c], eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0042dd40
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x22
pop ecx
je 0x4089e8
push 4
lea eax, [ebp + 0x7c]
push eax
push str.call
call fcn.004349fd
add esp, 0xc
test al, al
je 0x4089f0
mov eax, dword [ebp + 0x7c]
mov dword [ebp - 0x3c], eax
jmp 0x4089f3
mov eax, dword [ebp - 0x3c]
push ebx
mov dword [ebp + 0x68], eax
lea eax, [ebp + 0x68]
push ebx
push eax
call fcn.00414db6
add esp, 0xc
mov esi, eax
mov dword [ebp + 0x4c], 1
mov eax, esi
sub eax, dword [ebp + 0x68]
and eax, 0xfffffffe
cmp eax, 8
jle 0x408826
push 4
push str..cmd
lea edi, [esi - 8]
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x408a49
push 4
push str..bat
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x408826
mov ax, word [esi]
push 0x64
pop ecx
push ebx
push 0x80
push 3
mov word [ebp - 0x64], ax
xor eax, eax
push ebx
lea edi, [ebp - 0x4c8]
rep stosd dword es:[edi], eax
push 7
push 0xc0000000
mov word [esi], bx
push dword [ebp + 0x68]
stosb byte es:[edi], al
lea ecx, [ebp + 0x24]
lea edi, [ebp - 0x4c8]
mov byte [ebp + 0x7f], bl
mov dword [ebp + 0x24], ebx
call fcn.004041da
push ebx
lea eax, [ebp - 0xd0]
push eax
push 0x190
mov eax, edi
push eax
push dword [ebp + 0x24]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0xb
mov eax, edi
push eax
push str.::hidecmd::
call dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
jne 0x408ae7
mov al, byte [ebp - 0x4c8]
mov dword [ebp - 0x10], 0x10000000
jmp 0x408acf
cmp al, 0xd
je 0x408ad6
cmp al, 0xa
je 0x408ad6
inc edi
mov al, byte [edi]
cmp al, bl
jne 0x408ac4
jmp 0x408ad6
inc edi
movsx ax, byte [edi]
push eax
call fcn.00402b70
add esp, 4
test al, al
jne 0x408ad5
cmp dword [ebp + 0x4c], ebx
jne 0x408b17
cmp byte [edi], 0x3a
jne 0x408afc
cmp byte [edi + 1], 0x3a
jne 0x408afc
inc edi
inc edi
jmp 0x408afc
inc edi
cmp byte [edi], 0x40
je 0x408afb
push 7
push edi
push str._pecmd
call dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
jne 0x408b17
mov byte [ebp + 0x7f], 1
lea ecx, [ebp + 0x24]
call fcn.00402ad9
cmp byte [ebp + 0x7f], bl
mov ax, word [ebp - 0x64]
mov word [esi], ax
je 0x408826
push dword [ebp + 0x68]
mov ecx, dword [ebp + 0x54]
call fcn.0041fd16
mov ebx, eax
jmp 0x40a51c
xor eax, eax
cmp eax, ebx
mov dword [ebp + 0x5c], ebx
mov dword [ebp - 0x9c], ebx
je 0x408b5d
mov dword [ebp - 0x9c], edi
mov dword [ebp + 0x5c], 4
push eax
lea ecx, [ebp - 0x64]
call fcn.0042dd93
cmp byte [0x4a5d64], bl
mov esi, dword [ebp + 0x6c]
mov dword [ebp + 0x4c], 0x4a5f08
jne 0x408b93
cmp esi, ebx
je 0x408b81
cmp byte [esi + 0xa], bl
jne 0x408b93
cmp byte [ebp - 0x21], bl
mov byte [ebp + 0x7f], bl
je 0x408b97
cmp esi, ebx
je 0x408b97
mov eax, dword [esi + 0x28]
mov dword [ebp + 0x4c], eax
mov byte [ebp + 0x7f], 1
push ebx
lea ecx, [ebp + 0x24]
call fcn.0043ccfc
cmp byte [ebp + 0x7f], bl
mov dword [ebp + 0x34], ebx
je 0x408e25
push 0x4a6658
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
lea ecx, [ebp - 0x334]
call fcn.004105fc
cmp esi, ebx
je 0x408bd6
push dword [ebp + 0x4c]
lea ecx, [ebp - 0x334]
push esi
call fcn.0042fd11
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edi, eax
push 0x106
lea ecx, [ebp - 0x50]
mov dword [ebp - 0xa8], edi
call fcn.00432cd5
mov eax, dword [ebp - 0x50]
mov dword [ebp + 0x6c], eax
jmp 0x408c71
mov dword [ebp + 0x7c], edi
jmp 0x408c04
cmp ax, 0x3d
je 0x408c0e
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x408bfe
mov esi, edi
sub esi, dword [ebp + 0x7c]
sar esi, 1
cmp word [edi], bx
je 0x408c6f
cmp word [edi + 2], bx
je 0x408c6a
cmp esi, 0x104
jg 0x408c6a
push esi
push dword [ebp + 0x7c]
push dword [ebp + 0x6c]
call fcn.00404142
mov eax, dword [ebp + 0x6c]
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x334]
mov word [eax + esi*2], bx
call fcn.0040c526
test eax, eax
jne 0x408c6a
push 0xffffffffffffffff
push esi
lea eax, [edi + 2]
push eax
push dword [ebp + 0x7c]
lea ecx, [ebp - 0x334]
call fcn.0040c489
jmp 0x408c6a
inc edi
inc edi
cmp word [edi], bx
jne 0x408c68
inc edi
inc edi
cmp word [edi], bx
jne 0x408bf9
push dword [ebp - 0xa8]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov ecx, dword [ebp - 0x330]
xor eax, eax
cmp ecx, ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp + 0x7c], ecx
mov dword [ebp + 0x6c], eax
jle 0x408d2e
jmp 0x408ca0
mov eax, dword [ebp + 0x6c]
lea edi, [eax + 1]
cmp edi, dword [ebp + 0x7c]
mov dword [ebp + 0x30], eax
mov dword [ebp - 0x90], edi
jge 0x408d1c
mov eax, dword [ebp + 0x6c]
shl eax, 2
mov dword [ebp - 0xa8], eax
mov dword [ebp + 0x4c], eax
mov eax, dword [ebp - 0x334]
mov ecx, dword [ebp + 0x4c]
mov ecx, dword [eax + ecx]
mov ecx, dword [ecx]
mov esi, edi
shl esi, 2
mov eax, dword [eax + esi]
mov eax, dword [eax]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jge 0x408cea
mov dword [ebp + 0x30], edi
mov dword [ebp + 0x4c], esi
inc edi
cmp edi, dword [ebp + 0x7c]
jl 0x408cc0
mov eax, dword [ebp + 0x30]
cmp eax, dword [ebp + 0x6c]
je 0x408d1c
mov edx, dword [ebp - 0x334]
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp + 0x30]
add eax, edx
mov esi, dword [eax]
shl ecx, 2
mov edx, dword [edx + ecx]
mov dword [eax], edx
mov eax, dword [ebp - 0x334]
mov dword [eax + ecx], esi
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp + 0x7c]
mov dword [ebp + 0x6c], eax
jl 0x408c9d
xor edi, edi
cmp dword [ebp + 0x7c], ebx
jle 0x408d6c
mov eax, dword [ebp - 0x334]
mov eax, dword [eax + edi*4]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x7c]
lea esi, [ecx + eax + 1]
mov eax, dword [ebp - 0x334]
mov eax, dword [eax + edi*4]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc edi
cmp edi, dword [ebp + 0x7c]
lea eax, [esi + eax + 3]
mov dword [ebp - 0x7c], eax
jl 0x408d35
mov eax, dword [ebp - 0x7c]
add eax, 4
push eax
lea ecx, [ebp + 0x24]
call fcn.00432cfe
mov edi, dword [ebp + 0x24]
xor esi, esi
cmp dword [ebp + 0x7c], ebx
mov dword [ebp + 0x34], edi
jle 0x408df1
mov eax, dword [ebp - 0x334]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
push eax
mov dword [ebp + 0x6c], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp + 0x6c]
mov dword [ebp + 0x30], eax
push edi
call fcn.00404142
mov eax, dword [ebp + 0x30]
lea edi, [edi + eax*2]
mov word [edi], 0x3d
mov eax, dword [ebp - 0x334]
mov eax, dword [eax + esi*4]
mov eax, dword [eax + 4]
add esp, 0xc
inc edi
push eax
inc edi
mov dword [ebp + 0x6c], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp + 0x6c]
mov dword [ebp + 0x30], eax
push edi
call fcn.00404142
mov eax, dword [ebp + 0x30]
lea edi, [edi + eax*2]
add esp, 0xc
mov word [edi], bx
inc edi
inc edi
inc esi
cmp esi, dword [ebp + 0x7c]
jl 0x408d88
mov word [edi], bx
lea ecx, [ebp - 0x50]
mov word [edi + 2], bx
call fcn.0042dd2d
push ebx
lea ecx, [ebp - 0x334]
call fcn.0041f0e9
lea ecx, [ebp - 0x2f0]
call fcn.0042dd2d
push 0x4a6658
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x28]
xor al, al
cmp word [ecx], 0x40
jne 0x408e34
inc al
jmp 0x408e3b
cmp dword [ebp - 0x74], ebx
je 0x408e3b
mov al, 2
cmp byte [ebp + 0x73], bl
je 0x408f37
or byte [ebp + 0x73], 8
neg al
mov dword [ebp - 0x20], edi
sbb eax, eax
and eax, 0xfff01000
add eax, 0x100000
mov esi, eax
call fcn.0042fa40
push eax
lea eax, [ebp - 0x190]
push str..pipepecmd_exec__u
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebx
push edi
push esi
push esi
push 0xff
push 6
push 0x40000003
lea eax, [ebp - 0x190]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp eax, ebx
mov dword [ebp - 0x1c], eax
je 0x408ed9
cmp eax, 0xffffffff
je 0x408ed9
push 0xffffffffffffffff
lea eax, [ebp - 0x190]
push eax
lea ecx, [ebp + 0x7c]
call fcn.0043cd32
push ebx
push ebx
push 3
lea ecx, [ebp - 0x15c]
push ecx
push 7
push 0xc0000000
push dword [eax]
lea ecx, [ebp - 0xa0]
call fcn.004041da
lea ecx, [ebp + 0x7c]
call fcn.0042dd2d
jmp 0x408ee0
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0xa0]
push ebx
push ebx
lea eax, [ebp + 0x6c]
push eax
push esi
mov dword [ebp + 0x6c], 2
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
push ebx
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x234]
or byte [eax + 0x2d], 1
test byte [ebp + 0x4a], 2
mov dword [ebp + 0x1c], edi
mov dword [ebp - 0x14], edi
jne 0x408f2b
cmp byte [ebp + 0x4a], bl
jne 0x408f2e
mov dword [eax + 0x3c], esi
test byte [ebp + 0x4a], 1
je 0x408f4d
mov dword [eax + 0x40], esi
cmp dword [ebp - 0x20], ebx
jne 0x408f4d
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
push 0x4a6658
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0x34]
neg eax
sbb eax, eax
and eax, 0x400
or eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], ebx
or dword [ebp + 0x5c], eax
cmp byte [ebp + 0x47], bl
mov dword [ebp], ebx
mov dword [ebp + 0x14], ebx
je 0x408f7c
or dword [ebp + 0x5c], 4
cmp byte [ebp + 7], bl
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0x90], ebx
je 0x408fa0
lea eax, [ebp - 0xa8]
push eax
call fcn.0040306a
pop ecx
mov dword [ebp - 0x90], eax
cmp byte [ebp + 0x46], bl
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [ebp + 0x3c]
je 0x408fb6
cmp edi, ebx
je 0x409a8f
cmp byte [ebp - 0x2d], bl
je 0x409027
cmp word [ebp - 8], bx
jne 0x409027
cmp word [ebp + 0x2c], bx
jne 0x409027
call fcn.00406b5c
push dword [ebp + 0x68]
mov dword [ebp - 0xf4], eax
push edi
push dword [ebp + 0x28]
lea eax, [ebp - 0xc]
push eax
call fcn.00403851
mov esi, eax
push esi
call fcn.00403aa4
add esp, 0x14
test eax, eax
jne 0x4091e9
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x234]
push eax
push esi
push dword [ebp + 0x34]
push dword [ebp + 0x5c]
push dword [ebp - 0x14]
push ebx
push ebx
push dword [ebp + 0x68]
push edi
push dword [ebp - 0xf4]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp + 0x18], eax
jmp 0x4099a9
mov eax, dword [ebp - 0xb0]
cmp word [eax], bx
je 0x4091bb
cmp word [ebp - 8], bx
jne 0x4091bb
cmp word [ebp + 0x2c], bx
jne 0x4091bb
cmp byte [ebp - 1], bl
mov dword [ebp + 0x18], ebx
je 0x4090fd
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp + 0x6c]
call fcn.00402b3c
lea ecx, [ebp + 0x7c]
call fcn.00432b41
mov edi, dword [ebp - 0x94]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push ebx
push edi
call fcn.00479cf0
lea eax, [ebp + 0x7c]
push eax
push dword [ebp + 0x6c]
call fcn.00437df0
add esp, 0x14
push 0xffffffffffffffff
mov edi, eax
neg edi
push 0xffffffffffffffff
push dword [ebp + 0x7c]
sbb edi, edi
lea ecx, [ebp - 0x94]
neg edi
call fcn.00432d74
mov eax, dword [ebp + 0x6c]
push eax
mov dword [ebp - 0x98], eax
call esi
push eax
push ebx
push dword [ebp - 0x98]
call fcn.00479cf0
mov eax, dword [ebp + 0x7c]
add esp, 0xc
push eax
mov dword [ebp - 0x98], eax
call esi
push eax
push ebx
push dword [ebp - 0x98]
call fcn.00479cf0
add esp, 0xc
lea ecx, [ebp + 0x7c]
call fcn.0042dd2d
lea ecx, [ebp + 0x6c]
call fcn.0042dd2d
cmp edi, ebx
je 0x409184
mov edi, dword [ebp - 0xb0]
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x40
push edi
call esi
cmp eax, ebx
jne 0x40911b
push 0x5c
push edi
call esi
cmp eax, ebx
je 0x409129
mov word [eax], bx
mov esi, dword [ebp - 0xb0]
lea edi, [eax + 2]
jmp 0x40912e
mov esi, 0x48f3f0
push dword [ebp + 0x68]
lea eax, [ebp - 0xc]
push dword [ebp + 0x3c]
push dword [ebp + 0x28]
push eax
call fcn.00403851
push eax
mov dword [ebp + 0x28], eax
call fcn.00403aa4
add esp, 0x14
test eax, eax
jne 0x4091e9
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x234]
push eax
push dword [ebp + 0x28]
push dword [ebp + 0x34]
push dword [ebp + 0x5c]
push dword [ebp + 0x68]
push dword [ebp + 0x3c]
push 1
push dword [ebp - 0x94]
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov dword [ebp + 0x18], eax
mov edi, dword [ebp - 0x94]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
call esi
shl eax, 1
push eax
push ebx
push edi
call fcn.00479cf0
mov edi, dword [ebp - 0xb0]
add esp, 0xc
push edi
call esi
shl eax, 1
push eax
push ebx
push edi
call fcn.00479cf0
add esp, 0xc
jmp 0x4099a9
cmp byte [ebp + 0x4b], bl
je 0x409238
cmp edi, ebx
je 0x4091ca
cmp word [edi], 0x26
je 0x409238
cmp word [ebp - 0x18], bx
jne 0x409238
cmp word [ebp - 8], bx
jne 0x409238
cmp word [ebp + 0x2c], bx
jne 0x409238
push dword [ebp + 0x28]
call fcn.00403aa4
test eax, eax
pop ecx
je 0x4091f5
mov dword [ebp + 0x7c], 3
jmp 0x409b6e
push dword [ebp - 0x34]
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x234]
push eax
push dword [ebp + 0x28]
push dword [ebp + 0x34]
push dword [ebp + 0x5c]
push dword [ebp - 0x14]
push dword [ebp + 0x68]
push dword [ebp - 0x14c]
push dword [ebp - 0x150]
call fcn.0047119c
xor ecx, ecx
add esp, 0x28
test eax, eax
setg cl
mov dword [ebp + 0x18], ecx
jmp 0x4099a9
lea ecx, [ebp - 0x8c]
mov dword [ebp + 0x6c], ebx
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x3c], ebx
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x7c], edi
mov dword [ebp - 0x7c], edi
call fcn.00432b41
cmp word [ebp + 0x2c], bx
lea eax, [ebp - 0x50]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x40]
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp + 0x20], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp + 0x40], ebx
mov dword [ebp + 0x30], eax
je 0x40931c
push 0x22
pop esi
cmp word [edi], si
jne 0x40928e
add edi, 2
mov dword [ebp + 0x7c], edi
push 0x3a
lea eax, [ebp + 0x7c]
mov dword [ebp - 0x68], edi
call fcn.0043291a
mov eax, dword [ebp + 0x7c]
cmp eax, edi
pop ecx
je 0x4092ad
cmp word [eax - 2], si
jne 0x4092ad
mov word [eax - 2], bx
cmp word [eax], 0x3a
jne 0x4092b5
inc eax
inc eax
cmp word [eax], si
mov edi, eax
jne 0x4092ce
lea edi, [eax + 2]
inc eax
inc eax
cmp word [eax], si
jne 0x4092c9
mov word [eax], bx
cmp word [eax], bx
jne 0x4092bf
cmp word [ebp - 8], bx
je 0x4092ec
push 0x3a
push edi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
mov dword [ebp + 0x6c], eax
je 0x4092ec
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x6c], eax
push ebx
push ebx
push 0x10000
push edi
lea eax, [ebp - 0x8c]
push eax
push dword [ebp - 0x68]
call fcn.0042c116
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x84]
add esp, 0x18
add ecx, eax
mov dword [ebp + 0x20], ecx
jmp 0x409505
cmp edi, ebx
je 0x4093ef
cmp word [edi], 0x26
jne 0x4093d6
mov ecx, dword [ebp + 0x54]
push 0xffffffffffffffff
push ebx
push edi
call fcn.0040c526
mov esi, eax
cmp esi, ebx
jne 0x409398
lea ecx, [ebp + 0x40]
call fcn.0042dd2d
lea ecx, [ebp - 0x8c]
call fcn.0042dd2d
lea ecx, [ebp + 0x10]
call fcn.0042dd2d
lea ecx, [ebp + 0x14]
call fcn.0042dd2d
lea ecx, [ebp]
call fcn.0042dd2d
lea ecx, [ebp - 0xc]
call fcn.0042dd2d
push 0x4a6658
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp + 0x24]
call fcn.0042dd2d
lea ecx, [ebp - 0x64]
call fcn.00410339
mov ebx, 0x80070057
jmp 0x40a51c
mov eax, dword [esi + 0xc]
and eax, 0x3fffffff
mov dword [ebp - 0x88], eax
add eax, 0x10
push eax
lea ecx, [ebp - 0x8c]
call fcn.00432b85
mov dword [ebp + 0x20], eax
mov eax, dword [ebp - 0x88]
inc eax
push eax
push dword [esi + 4]
push dword [ebp - 0x8c]
call fcn.0047a010
add esp, 0xc
jmp 0x409505
mov al, byte [ebp + 0x48]
neg al
sbb eax, eax
and eax, 2
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.00439cfc
pop ecx
pop ecx
mov dword [ebp + 0x3c], eax
cmp dword [ebp + 0x3c], ebx
mov dword [ebp - 0x118], ebx
jne 0x409464
mov eax, dword [ebp + 0x68]
cmp eax, ebx
je 0x40940a
cmp word [eax], 0x2a
jne 0x40940a
inc dword [ebp - 0x18]
cmp byte [ebp + 0x4b], bl
je 0x409412
mov dword [ebp - 0x18], ebx
cmp word [ebp - 8], bx
je 0x4099c2
push 0x3a
push ebx
push dword [ebp - 0x7c]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
cmp esi, ebx
mov dword [ebp + 0x6c], esi
je 0x40945b
mov word [esi], bx
inc esi
inc esi
mov dword [ebp + 0x6c], esi
je 0x40945b
push dword [ebp - 0x7c]
lea ecx, [ebp + 0x40]
mov dword [ebp - 0xe4], 2
mov dword [ebp - 0x34], ebx
mov dword [ebp + 0x30], ebx
call fcn.0043cd64
jmp 0x409537
cmp dword [ebp + 0x3c], ebx
je 0x4099c2
cmp word [ebp - 8], bx
mov edi, dword [ebp + 0x3c]
je 0x409486
push 0x3a
push ebx
push edi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
mov dword [ebp + 0x6c], eax
je 0x409486
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x6c], eax
add dword [ebp + 0x3c], 2
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.00439c4a
mov si, word [edi]
pop ecx
mov dword [ebp - 0x68], eax
mov eax, dword [0x4a5e00]
mov word [edi], bx
pop ecx
mov ecx, dword [ebp - 0x7c]
mov dword [ebp + 0x4c], 0x20
cmp word [ecx], bx
mov dword [ebp + 0x7c], ebx
je 0x4094c9
push 2
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp + 0x7c], eax
cmp eax, ebx
mov word [edi], si
je 0x4094f7
lea ecx, [ebp + 0x4c]
push ecx
lea ecx, [ebp - 0x8c]
push ecx
push dword [ebp - 0x68]
mov dword [ebp + 0x4c], 0x20
push dword [ebp - 0x118]
push eax
call fcn.00410741
add esp, 0x14
mov dword [ebp + 0x20], eax
cmp dword [ebp + 0x7c], ebx
je 0x409505
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x88], ebx
je 0x40998e
cmp dword [ebp + 0x20], ebx
je 0x40998e
cmp word [ebp - 0x18], bx
mov dword [ebp - 0xe4], 1
ja 0x409534
cmp word [ebp - 8], bx
je 0x4098c0
mov esi, dword [ebp + 0x6c]
cmp dword [ebp + 0x30], ebx
mov eax, dword [ebp - 0x110]
jne 0x409547
mov eax, 0x48ee14
push eax
push str.exedat
push dword [ebp - 0x34]
lea eax, [ebp - 0x5c]
push dword [ebp + 0x30]
push eax
call fcn.004042a1
add esp, 0x14
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp]
call fcn.0043cd92
mov edi, dword [ebp - 0x50]
lea eax, [ebp + 0x40]
mov dword [ebp + 0x30], eax
lea eax, [ebp - 0x50]
cmp edi, ebx
mov dword [ebp - 0x34], eax
setne al
cmp al, bl
mov dword [ebp - 0xd0], ebx
je 0x4095b1
push ebx
lea eax, [ebp - 0xd0]
push eax
push dword [ebp - 0x88]
push dword [ebp + 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call fcn.00430f8b
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4095be
cmp dword [ebp - 0xe4], 1
jle 0x40998e
cmp esi, ebx
push dword [ebp - 0x5c]
mov byte [ebp + 0x7f], bl
je 0x409718
mov eax, dword [ebp + 0x40]
lea ecx, [ebp + 0x40]
mov dword [ebp + 0x4c], eax
mov dword [ebp + 0x40], ebx
call fcn.0043cdc0
push str..ex
lea ecx, [ebp + 0x40]
call fcn.00432d25
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp]
call fcn.0043cd92
cmp word [esi], 0x5c
je 0x409604
add esi, 0xfffffffe
mov word [esi], 0x5c
push ebx
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp word [ebp - 8], 1
jne 0x40965d
push 0x48f3c0
lea ecx, [ebp + 0x2c]
call fcn.0043ccfc
push dword [ebp + 0x4c]
lea ecx, [ebp + 0x2c]
call fcn.00432d25
push 0x48f3b8
lea ecx, [ebp + 0x2c]
call fcn.00432d25
push dword [ebp + 0x40]
lea ecx, [ebp + 0x2c]
call fcn.00432d25
push dword [ebp + 0x2c]
mov ecx, dword [ebp + 0x54]
call fcn.00422a01
lea ecx, [ebp + 0x2c]
call fcn.0042dd2d
jmp 0x4096f9
cmp word [ebp - 8], 0x100
jne 0x4096f9
push 0xf
pop ecx
xor eax, eax
mov dword [ebp - 0x294], 0x44
mov dword [ebp - 0x290], ebx
lea edi, [ebp - 0x28c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc0], ebx
lea edi, [ebp - 0xbc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0x294]
push eax
push dword [ebp]
mov dword [ebp - 0x268], 0x80
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x48f3b0
push dword [ebp + 0x4c]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 0xc0], ebx
je 0x4096e5
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xbc], ebx
je 0x4096f9
push dword [ebp - 0xbc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
lea ecx, [ebp + 0x40]
call fcn.00432d25
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xc]
call fcn.0043cd92
lea ecx, [ebp + 0x4c]
call fcn.0042dd2d
jmp 0x409720
lea ecx, [ebp]
call fcn.0043cdc0
mov edx, dword [ebp + 0x68]
mov di, word [edx]
cmp di, 0x22
mov eax, edx
jne 0x409731
lea eax, [edx + 2]
cmp word [eax], 0x3f
jne 0x4097be
lea esi, [eax + 2]
mov cx, word [esi]
cmp cx, 0x3f
jne 0x40974f
mov edi, dword [ebp + 0x40]
lea esi, [eax + 4]
jmp 0x409793
cmp cx, 0x5c
jne 0x4097be
cmp di, 0x22
je 0x409790
mov eax, dword [ebp]
mov edi, 0x104
push edi
lea ecx, [ebp]
mov dword [ebp + 0x4c], eax
mov dword [ebp], ebx
call fcn.00432cfe
mov eax, dword [ebp]
push edi
mov word [eax], bx
push dword [ebp]
push dword [ebp + 0x4c]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea ecx, [ebp + 0x4c]
call fcn.0042dd2d
mov edx, dword [ebp + 0x68]
mov edi, dword [ebp]
cmp word [edx], 0x22
jne 0x4097a6
push 0x48f2e8
lea ecx, [ebp + 0x14]
call fcn.0043cdc0
push edi
lea ecx, [ebp + 0x14]
call fcn.00432d25
push esi
lea ecx, [ebp + 0x14]
call fcn.00432d25
mov edx, dword [ebp + 0x14]
mov dword [ebp + 0x68], edx
cmp dword [ebp + 0x6c], ebx
je 0x409815
cmp word [ebp - 0x18], bx
ja 0x4097ee
lea eax, [ebp - 0x8c]
push eax
push dword [ebp - 0xc]
mov dword [ebp + 0x6c], ebx
call fcn.004103ea
cmp dword [ebp - 0x88], ebx
pop ecx
pop ecx
je 0x409812
mov byte [ebp + 0x7f], 1
jmp 0x409891
cmp byte [ebp + 0x46], bl
je 0x409815
cmp dword [ebp + 0x28], ebx
jne 0x4097fe
mov eax, dword [ebp]
mov dword [ebp + 0x28], eax
cmp word [ebp - 0x18], 2
mov dword [ebp + 0x6c], ebx
mov byte [ebp + 0x7f], 2
jb 0x409a74
jmp 0x409891
mov edx, dword [ebp + 0x68]
mov eax, dword [ebp + 0x6c]
cmp eax, ebx
mov esi, dword [ebp + 0x40]
je 0x409826
cmp word [eax], bx
jne 0x409826
xor esi, esi
mov eax, dword [ebp + 0x28]
cmp eax, ebx
jne 0x409830
mov eax, dword [ebp]
push edx
push dword [ebp + 0x40]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00403851
push eax
mov dword [ebp + 0x28], eax
call fcn.00403aa4
add esp, 0x14
test eax, eax
jne 0x4099e2
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x234]
push eax
push dword [ebp + 0x28]
push dword [ebp + 0x34]
push dword [ebp + 0x5c]
push dword [ebp - 0x14]
push ebx
push ebx
push dword [ebp + 0x68]
push esi
call fcn.00479768
add esp, 0x28
cmp byte [ebp - 0x18], 2
mov dword [ebp + 0x18], eax
jl 0x40998e
cmp word [ebp - 8], bx
jne 0x40998e
cmp byte [ebp + 0x7f], 1
jne 0x40989c
or eax, 0xffffffff
jmp 0x4098a5
lea eax, [ebp - 0x144]
mov eax, dword [eax + 8]
push eax
push dword [ebp - 0x5c]
call fcn.00402c5e
cmp byte [ebp + 0x7f], 1
mov eax, dword [ebp - 0x5c]
pop ecx
pop ecx
mov word [eax], bx
jne 0x4099b9
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x22
mov edi, eax
jne 0x4098ce
add eax, 2
cmp word [eax], 0x3f
mov dword [ebp + 0x4c], ebx
jne 0x4098f5
cmp word [eax + 2], 0x5c
jne 0x4098f5
lea edi, [eax + 4]
cmp word [edi], 0x22
jne 0x4098f5
dec edi
dec edi
mov ax, word [edi]
mov word [ebp + 0x4c], ax
mov word [edi], 0x22
push dword [ebp + 0x28]
call fcn.00403aa4
test eax, eax
pop ecx
jne 0x4099e2
push ebx
lea esi, [ebp - 0x144]
push esi
lea eax, [ebp - 0x234]
push eax
push dword [ebp + 0x28]
push dword [ebp + 0x34]
push dword [ebp + 0x5c]
push dword [ebp - 0x14]
push edi
push dword [ebp - 0x88]
push dword [ebp + 0x20]
call fcn.0047119c
add esp, 0x28
cmp word [ebp + 0x4c], bx
mov dword [ebp - 0x68], eax
je 0x409943
mov ax, word [ebp + 0x4c]
mov word [edi], ax
cmp dword [ebp - 0x68], ebx
jl 0x409534
mov esi, dword [esi + 8]
cmp esi, ebx
je 0x409534
push esi
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
je 0x409534
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp - 0x68], ebx
setg al
mov dword [ebp + 0x18], eax
mov eax, dword [ebp - 0x5c]
cmp eax, ebx
je 0x40998e
cmp word [eax], bx
jne 0x409891
lea ecx, [ebp + 0x40]
call fcn.0042dd2d
lea ecx, [ebp - 0x8c]
call fcn.0042dd2d
lea ecx, [ebp + 0x10]
call fcn.0042dd2d
cmp dword [ebp + 0x18], ebx
je 0x409b60
xor eax, eax
jmp 0x409b66
cmp byte [ebp + 0x7f], 2
jmp 0x409a6e
push dword [ebp + 0x68]
lea eax, [ebp - 0xc]
push edi
push dword [ebp + 0x28]
push eax
call fcn.00403851
push eax
mov dword [ebp + 0x28], eax
call fcn.00403aa4
add esp, 0x14
test eax, eax
je 0x409a09
lea ecx, [ebp + 0x40]
mov dword [ebp + 0x7c], 3
call fcn.0042dd2d
lea ecx, [ebp - 0x8c]
call fcn.0042dd2d
lea ecx, [ebp + 0x10]
call fcn.0042dd2d
jmp 0x409b6e
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x234]
push eax
push dword [ebp + 0x28]
push dword [ebp + 0x34]
push dword [ebp + 0x5c]
push dword [ebp - 0x14]
push ebx
push ebx
push dword [ebp + 0x68]
push edi
call fcn.00479768
add esp, 0x28
cmp eax, ebx
mov dword [ebp + 0x18], eax
jne 0x40998e
push eax
push dword [ebp + 0x68]
push str._CreateProcess__s__d_r_n
push 0x4a5f08
call fcn.0040c938
add esp, 0x10
cmp byte [ebp + 0x46], bl
jne 0x40998e
cmp edi, ebx
jne 0x40998e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
jne 0x40998e
lea ecx, [ebp + 0x40]
call fcn.0042dd2d
lea ecx, [ebp - 0x8c]
call fcn.0042dd2d
lea ecx, [ebp + 0x10]
call fcn.0042dd2d
push 0xd
xor eax, eax
pop ecx
lea edi, [ebp - 0x1a4]
mov dword [ebp - 0x1ac], 0x3c
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x10]
cmp eax, ebx
mov dword [ebp - 0x1a8], 0x4540
jne 0x409aba
push 5
pop eax
movzx eax, ax
mov dword [ebp - 0x190], eax
mov eax, dword [ebp + 0x28]
cmp eax, ebx
je 0x409ad5
cmp word [eax], bx
je 0x409ad5
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp + 0x68]
mov dword [ebp + 0x7c], ebx
mov dword [ebp + 0x6c], eax
mov dword [ebp - 0x19c], eax
cmp word [eax], 0x22
jne 0x409b2d
push 1
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp + 0x6c]
push eax
call fcn.00414db6
add esp, 0xc
push dword [ebp + 0x7c]
lea ecx, [ebp - 0xf8]
push dword [ebp + 0x6c]
mov esi, eax
call fcn.00432ddd
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x198], esi
lea eax, [ebp - 0x1ac]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp + 0x18], eax
mov eax, dword [ebp - 0x174]
lea esi, [ebp - 0x144]
push eax
mov dword [esi], eax
mov dword [ebp - 0x174], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [esi + 8], eax
jmp 0x4099a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x78]
mov dword [ecx], eax
mov dword [ebp + 0x7c], eax
lea ecx, [ebp - 0x6c]
call fcn.00402ad9
cmp dword [ebp - 0x90], ebx
je 0x409b8a
push dword [ebp - 0xa8]
call fcn.0040307b
pop ecx
lea esi, [ebp - 0x78]
mov eax, dword [esi]
cmp eax, ebx
je 0x409b9a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xec]
mov dword [esi], ebx
cmp word [eax], bx
je 0x409bbc
push eax
lea eax, [ebp - 0x144]
push dword [eax + 8]
push dword [ebp + 0x54]
call fcn.00434e74
add esp, 0xc
cmp byte [ebp + 0x47], bl
je 0x409bdf
lea esi, [ebp - 0x144]
cmp dword [esi], ebx
je 0x409bdf
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push dword [esi]
mov dword [ebp - 0x70], eax
push eax
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
push str.__LastPID
lea esi, [ebp - 0x144]
push dword [esi + 8]
push dword [ebp + 0x54]
call fcn.00434e74
push str.__LastTID
push dword [esi + 0xc]
push dword [ebp + 0x54]
call fcn.00434e74
add esp, 0x18
cmp dword [ebp - 0x9c], ebx
je 0x409c21
push dword [esi]
push 4
push str.SeDebugPrivilege
call fcn.0040ee7b
add esp, 0xc
test byte [ebp + 0x5c], 4
je 0x409c35
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x409c35
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea ecx, [ebp + 0x14]
call fcn.0042dd2d
lea ecx, [ebp]
call fcn.0042dd2d
lea ecx, [ebp - 0xc]
call fcn.0042dd2d
mov eax, 0x4a6658
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp + 0x24]
call fcn.0042dd2d
lea ecx, [ebp - 0x64]
call fcn.00410339
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xa0]
mov eax, dword [eax]
cmp eax, ebx
je 0x409c7e
push eax
call edi
lea eax, [ebp - 0xa0]
mov dword [eax], ebx
lea eax, [ebp - 0x60]
mov eax, dword [eax]
cmp eax, ebx
je 0x409c92
push eax
call edi
lea eax, [ebp - 0x60]
mov dword [eax], ebx
lea eax, [ebp - 0x2c]
mov eax, dword [eax]
cmp eax, ebx
je 0x409ca3
push eax
call edi
lea eax, [ebp - 0x2c]
mov dword [eax], ebx
lea eax, [ebp - 0x4c]
mov eax, dword [eax]
cmp eax, ebx
je 0x409cb4
push eax
call edi
lea eax, [ebp - 0x4c]
mov dword [eax], ebx
lea eax, [ebp - 0x80]
mov eax, dword [eax]
cmp eax, ebx
je 0x409cc5
push eax
call edi
cmp dword [ebp + 0x18], ebx
lea eax, [ebp - 0x80]
mov dword [eax], ebx
je 0x40a451
mov eax, dword [esi]
cmp eax, ebx
jne 0x409cdc
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebp + 0x1c]
inc dword [ebp + 0x1c]
mov dword [ebp + ecx*4 - 0x120], eax
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x409cf3
push eax
call edi
cmp byte [ebp + 0x49], bl
mov dword [esi + 4], ebx
je 0x409d10
mov ecx, dword [ebp + 0x54]
push 0x3e8
call fcn.0040ce62
push dword [esi]
call fcn.0040d660
pop ecx
cmp dword [ebp - 0x20], ebx
je 0x40a467
mov al, byte [0x4a4290]
mov edi, 0x100000
push 0x100004
lea ecx, [ebp + 0x5c]
mov byte [ebp + 0x6f], al
mov dword [ebp + 0x34], edi
xor esi, esi
call fcn.00432b5e
mov eax, dword [ebp - 0x28]
cmp word [eax], 0x40
lea ecx, [eax + 2]
mov dword [ebp + 0x18], eax
mov dword [ebp - 0x68], ecx
mov byte [ebp + 0x7f], bl
jne 0x409df4
mov byte [ebp + 0x7f], 1
mov dword [ebp + 0x18], ecx
cmp byte [ebp - 0x3f], bl
je 0x409db3
mov ecx, dword [ebp + 0x54]
push ebx
lea eax, [ebp + 0x4c]
push eax
push dword [ebp + 0x18]
mov dword [ebp + 0x4c], ebx
call fcn.0043a67a
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 0x4c]
lea ecx, [ebp + 0x5c]
call fcn.00432c3f
push dword [ebp + 0x5c]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
lea edi, [esi + 0x3ff]
and edi, 0xfffffc00
add edi, 0x100000
lea eax, [edi + 8]
push eax
lea ecx, [ebp + 0x5c]
mov dword [ebp + 0x34], edi
call fcn.00432b85
lea ecx, [ebp + 0x4c]
call fcn.0042dd2d
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
test byte [ebp + 0x73], 8
je 0x40a10d
mov eax, dword [ebp - 0x28]
mov ax, word [eax]
cmp ax, 0x40
je 0x409e06
cmp byte [ebp + 0xe], bl
je 0x409e06
cmp ax, 0x26
je 0x409dee
mov eax, dword [ebp + 0x54]
test byte [eax + 0xb], 0xf
je 0x409e06
mov byte [ebp + 0x49], 1
jmp 0x409e09
cmp dword [ebp - 0x74], ebx
je 0x409d58
mov byte [ebp + 0x7f], 2
jmp 0x409d58
mov byte [ebp + 0x49], bl
push ebx
mov dword [ebp - 0xd0], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x1c]
mov edi, dword [eax]
lea eax, [ebp - 0x170]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
cmp byte [ebp + 0x7f], bl
mov dword [ebp - 0xe4], esi
je 0x409e3e
mov eax, dword [ebp + 0x34]
sub eax, esi
mov dword [ebp + 0x2c], eax
jmp 0x409e45
mov dword [ebp + 0x2c], 0x100000
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0xd0]
push eax
push dword [ebp + 0x2c]
mov eax, dword [ebp + 0x5c]
add eax, esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp - 0xd8], ebx
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x64], ebx
mov dword [ebp + 0x30], ebx
jg 0x409e87
mov dword [ebp - 0xd8], 0x3e8
lea ecx, [ebp - 0x50]
mov byte [ebp + 0x47], bl
call fcn.00432cb7
mov al, byte [0x4a4290]
cmp al, bl
mov byte [ebp + 0x6f], al
jle 0x40a100
mov ecx, dword [ebp + 0x54]
push 0x4ff
push dword [ebp - 0xd8]
lea eax, [ebp - 0x120]
push ebx
push eax
push dword [ebp + 0x1c]
call fcn.0040e7ba
cmp eax, ebx
mov dword [ebp - 0x98], eax
jne 0x409f54
lea eax, [ebp - 0x1c]
mov edi, dword [eax]
push ebx
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp - 0x170]
push eax
push edi
mov dword [ebp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
cmp dword [ebp + 0x20], ebx
jle 0x409f02
mov eax, dword [ebp + 0x2c]
cmp dword [ebp + 0x20], eax
jle 0x409ef9
mov dword [ebp + 0x20], eax
add esi, dword [ebp + 0x20]
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi], bl
lea eax, [esi + 0x100000]
cmp eax, dword [ebp + 0x34]
jl 0x409f23
add dword [ebp + 0x34], 0x100000
mov eax, dword [ebp + 0x34]
add eax, 4
push eax
lea ecx, [ebp + 0x5c]
call fcn.00432b85
cmp byte [ebp + 0x7f], bl
je 0x409f32
mov eax, dword [ebp + 0x34]
sub eax, esi
mov dword [ebp + 0x2c], eax
jmp 0x409f39
mov dword [ebp + 0x2c], 0x100000
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp + 0x20]
push eax
push dword [ebp + 0x2c]
mov eax, dword [ebp + 0x5c]
add eax, esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [ebp + 0x7f], bl
je 0x409f8b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x64], eax
sub eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0xd8]
jge 0x40a045
cmp esi, dword [ebp + 0x30]
je 0x40a0f7
cmp eax, 0x14
jl 0x40a0f7
jmp 0x40a045
mov eax, dword [ebp + 0x1c]
cmp eax, 1
jle 0x409fb7
dec eax
cmp eax, dword [ebp - 0x98]
jne 0x409fb7
cmp byte [ebp + 0x7f], bl
mov byte [ebp + 0x47], 1
je 0x40a100
cmp esi, dword [ebp + 0x30]
je 0x40a100
jmp 0x40a045
test byte [ebp + 0x73], 1
je 0x409fd7
mov eax, dword [ebp - 0xe4]
jmp 0x409fd3
mov ecx, dword [ebp + 0x5c]
cmp byte [eax + ecx], 0xa
je 0x40a100
inc eax
cmp eax, esi
jl 0x409fc5
push 5
pop edi
dec edi
js 0x409e92
cmp byte [0x4a4290], bl
jle 0x409e92
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x409e92
cmp dword [ebp - 0x24c], 0x12
je 0x40a02c
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x409fda
cmp byte [ebp + 0x7f], bl
mov byte [ebp + 0x6f], bl
mov byte [ebp + 0x47], 1
je 0x409e92
cmp esi, dword [ebp + 0x30]
je 0x409e92
cmp byte [ebp + 0x49], bl
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp + 0x5c]
mov dword [ebp + 0x30], esi
mov dword [ebp - 0x9c], ecx
jne 0x40a081
cmp dword [ebp - 0x54], 0x4b0
je 0x40a074
push dword [ebp - 0x54]
lea ecx, [ebp - 0x50]
push esi
push eax
call fcn.00432d74
mov eax, dword [ebp - 0x50]
jmp 0x40a081
mov word [eax + esi + 2], bx
mov ecx, dword [ebp + 0x5c]
mov word [ecx + esi + 2], bx
cmp byte [ebp + 0x7f], 1
jne 0x40a09e
mov ecx, dword [ebp + 0x54]
push eax
push eax
push 0x48e984
push dword [ebp + 0x18]
push dword [ebp + 0x18]
call fcn.0043014f
jmp 0x40a0c8
cmp byte [ebp + 0x49], bl
je 0x40a0bc
push ebx
lea eax, [ebp + 0x5c]
push eax
push esi
push dword [ebp + 0x5c]
push dword [ebp - 0x28]
push dword [ebp + 0x54]
call fcn.00441ec3
add esp, 0x18
jmp 0x40a0c8
mov ecx, dword [ebp + 0x54]
push eax
push dword [ebp + 0x18]
call fcn.00432698
cmp dword [ebp - 0x74], ebx
je 0x40a0f7
push dword [ebp - 0x74]
lea ecx, [ebp - 0x90]
call fcn.0043ccfc
mov ecx, dword [ebp + 0x54]
push ebx
push ebx
push ebx
push dword [ebp - 0x90]
call fcn.0042442a
lea ecx, [ebp - 0x90]
call fcn.0042dd2d
cmp byte [ebp + 0x47], bl
je 0x409f8b
lea ecx, [ebp - 0x50]
call fcn.0042dd2d
jmp 0x40a1f3
cmp dword [ebp - 0x20], 0xffffff9c
je 0x40a1f3
jmp 0x40a1e3
mov ecx, dword [ebp + 0x54]
push 0x4ff
push 0x3e8
push ebx
lea eax, [ebp - 0x120]
push eax
push dword [ebp + 0x1c]
call fcn.0040e7ba
mov ecx, dword [ebp + 0x1c]
dec ecx
cmp ecx, eax
je 0x40a1f3
cmp dword [ebp + 0x1c], 1
jle 0x40a1db
cmp eax, ebx
jne 0x40a1db
lea eax, [esi + 0x100000]
cmp eax, edi
jl 0x40a173
add edi, 0x100000
lea eax, [edi + 4]
push eax
lea ecx, [ebp + 0x5c]
call fcn.00432b85
push ebx
lea eax, [ebp + 0x7c]
push eax
mov eax, dword [ebp + 0x5c]
push 1
add eax, esi
push eax
lea eax, [ebp - 0x1c]
push dword [eax]
mov dword [ebp + 0x7c], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40a1db
cmp dword [ebp + 0x7c], ebx
jbe 0x40a1db
add esi, dword [ebp + 0x7c]
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi], bl
jmp 0x40a1db
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x40a1e3
cmp dword [ebp - 0x188], 0x12
je 0x40a1e3
lea eax, [ebp - 0x18c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x18c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp byte [0x4a4290], bl
jg 0x40a1a2
mov al, byte [0x4a4290]
cmp al, bl
mov byte [ebp + 0x6f], al
jg 0x40a11c
cmp dword [ebp - 0x20], 0xffffff9c
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi + 2], bl
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi + 1], bl
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi], bl
mov dword [ebp - 0x34], ebx
je 0x40a224
cmp byte [ebp + 0x6f], bl
jle 0x40a224
push ebx
lea eax, [ebp - 0x144]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x144]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp byte [ebp + 0x73], bl
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp + 0x78]
mov dword [ecx], eax
je 0x40a3fd
mov eax, dword [ebp - 0x28]
mov ax, word [eax]
xor edi, edi
cmp ax, 0x40
je 0x40a26f
cmp byte [ebp + 0xe], bl
je 0x40a26f
cmp ax, 0x26
je 0x40a269
mov eax, dword [ebp + 0x54]
test byte [eax + 0xb], 0xf
je 0x40a26f
mov byte [ebp + 0x7b], 1
jmp 0x40a272
mov byte [ebp + 0x7b], bl
lea ecx, [ebp - 0xbc]
call fcn.00432b41
cmp byte [ebp + 0x7b], bl
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xb4], ebx
jne 0x40a399
cmp byte [ebp + 0x77], 2
jne 0x40a2a4
mov eax, dword [ebp + 0x5c]
mov word [eax + esi], bx
mov edi, dword [ebp + 0x5c]
jmp 0x40a306
cmp byte [ebp + 0x77], 1
lea ecx, [ebp - 0xbc]
jne 0x40a2be
push dword [ebp - 0x54]
push esi
push dword [ebp + 0x5c]
call fcn.00432d74
jmp 0x40a30a
lea eax, [esi + 0x18]
push eax
call fcn.00432cfe
lea eax, [esi + 1]
push eax
push dword [ebp + 0x5c]
mov dword [ebp - 0xb4], esi
push dword [ebp - 0xbc]
mov dword [ebp - 0xb8], esi
call fcn.0047a010
mov eax, dword [ebp - 0xbc]
push 0x10
add eax, esi
push ebx
push eax
call fcn.00479cf0
lea eax, [ebp - 0xbc]
push ebx
push eax
call fcn.00471542
add esp, 0x20
cmp edi, ebx
jne 0x40a310
mov edi, dword [ebp - 0xbc]
test byte [ebp + 0x73], 4
je 0x40a341
push edi
mov dword [ebp + 0x7c], edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [edi + eax*2 - 2]
jmp 0x40a33a
mov ax, word [edi]
cmp ax, 0xd
je 0x40a335
cmp ax, 0xa
jne 0x40a399
mov word [edi], bx
dec edi
dec edi
cmp edi, dword [ebp + 0x7c]
jae 0x40a326
jmp 0x40a399
test byte [ebp + 0x73], 1
jne 0x40a360
test byte [ebp + 0x73], 2
je 0x40a399
jmp 0x40a391
mov ax, word [edi]
cmp ax, 0xd
je 0x40a365
cmp ax, 0xa
je 0x40a365
inc edi
inc edi
cmp word [edi], bx
jne 0x40a34f
mov word [edi], bx
jmp 0x40a399
cmp ax, 0xd
je 0x40a37a
cmp ax, 0xa
je 0x40a37a
inc edi
inc edi
jmp 0x40a391
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
lea eax, [edi + 2]
push eax
push edi
call fcn.0047a350
add esp, 0xc
mov ax, word [edi]
cmp ax, bx
jne 0x40a36a
mov eax, dword [ebp - 0x28]
cmp word [eax], 0x40
jne 0x40a3c3
push dword [ebp - 0xbc]
mov ecx, dword [ebp + 0x54]
push dword [ebp - 0xbc]
push 0x48e984
push dword [ebp - 0x68]
push dword [ebp - 0x68]
call fcn.0043014f
jmp 0x40a3ef
cmp byte [ebp + 0x7b], bl
je 0x40a3e0
push 1
lea ecx, [ebp + 0x5c]
push ecx
push esi
push dword [ebp + 0x5c]
push eax
push dword [ebp + 0x54]
call fcn.00441ec3
add esp, 0x18
jmp 0x40a3ef
push dword [ebp - 0xbc]
mov ecx, dword [ebp + 0x54]
push eax
call fcn.00432698
lea ecx, [ebp - 0xbc]
call fcn.0042dd2d
mov eax, dword [ebp - 0x34]
push eax
mov dword [ebp + 0x7c], eax
lea eax, [ebp - 0x290]
push 0x48f348
push eax
mov word [ebp - 0x290], bx
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp + 0x54]
add esp, 0xc
lea eax, [ebp - 0x290]
push eax
push str.ERRORLEVEL
call fcn.00432698
cmp dword [ebp - 0x70], ebx
je 0x40a441
push 1
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
lea ecx, [ebp + 0x5c]
call fcn.0042dd2d
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40a467
mov eax, dword [ebp - 0x28]
cmp word [eax], bx
je 0x40a467
mov ecx, dword [ebp + 0x54]
push 0x48e984
push eax
call fcn.00432698
mov ecx, dword [ebp - 0x5c]
cmp ecx, ebx
je 0x40a484
cmp word [ecx], bx
je 0x40a484
lea eax, [ebp - 0x144]
push dword [eax + 8]
push ecx
call fcn.00402c5e
pop ecx
pop ecx
lea esi, [ebp - 0x144]
mov eax, dword [esi]
cmp eax, ebx
je 0x40a493
push eax
call edi
mov dword [esi], ebx
lea esi, [ebp - 0x2c]
mov eax, dword [esi]
cmp eax, ebx
je 0x40a4a1
push eax
call edi
mov dword [esi], ebx
lea esi, [ebp - 0x4c]
mov eax, dword [esi]
cmp eax, ebx
je 0x40a4af
push eax
call edi
mov dword [esi], ebx
lea esi, [ebp - 0x80]
cmp dword [esi], ebx
je 0x40a4bb
push ebx
call edi
mov dword [esi], ebx
lea esi, [ebp - 0xa0]
mov eax, dword [esi]
cmp eax, ebx
je 0x40a4cc
push eax
call edi
mov dword [esi], ebx
lea esi, [ebp - 0x1c]
mov eax, dword [esi]
cmp eax, ebx
je 0x40a4da
push eax
call edi
mov dword [esi], ebx
lea esi, [ebp - 0xac]
mov eax, dword [esi]
cmp eax, ebx
je 0x40a4eb
push eax
call edi
cmp dword [ebp - 0x160], ebx
mov dword [esi], ebx
je 0x40a4fd
push dword [ebp - 0x160]
call edi
lea esi, [ebp - 0x144]
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x40a50d
push eax
call edi
mov ecx, dword [ebp + 0x54]
push ebx
mov dword [esi + 4], ebx
call fcn.00443dd2
mov ebx, dword [ebp + 0x7c]
lea ecx, [ebp - 0xc8]
call fcn.0042dd2d
lea ecx, [ebp - 0xdc]
call fcn.0042dd2d
lea ecx, [ebp - 0x6c]
call fcn.00402ad9
lea ecx, [ebp - 0xe8]
call fcn.0042dd2d
lea ecx, [ebp - 0x78]
call fcn.00402ad9
lea ecx, [ebp - 0x60]
call fcn.00402ad9
lea ecx, [ebp - 0x80]
call fcn.00402ad9
lea ecx, [ebp - 0x4c]
call fcn.00402ad9
lea ecx, [ebp - 0x2c]
call fcn.00402ad9
lea ecx, [ebp - 0xac]
call fcn.00402ad9
lea ecx, [ebp - 0xa0]
call fcn.00402ad9
lea ecx, [ebp - 0x1c]
call fcn.00402ad9
lea ecx, [ebp - 0x5c]
call fcn.0042dd2d
lea ecx, [ebp - 0x150]
call fcn.0042dd2d
lea ecx, [ebp - 0xc4]
call fcn.0042dd2d
lea ecx, [ebp - 0x48]
call fcn.0042dd2d
lea ecx, [ebp - 0xf8]
call fcn.0042dd2d
lea ecx, [ebp - 0xcc]
call fcn.0042dd2d
lea ecx, [ebp - 0xec]
call fcn.0042dd2d
lea ecx, [ebp - 0xa4]
call fcn.0042dd2d
lea ecx, [ebp - 0x70]
call fcn.00402ad9
lea ecx, [ebp - 0xf4]
call fcn.00402ad9
lea ecx, [ebp - 0xd4]
call fcn.0042dd2d
lea ecx, [ebp - 0x124]
call fcn.0042dd2d
lea ecx, [ebp - 0x94]
call fcn.0042dd2d
lea ecx, [ebp - 0xb0]
call fcn.0042dd2d
lea ecx, [ebp - 0x28]
call fcn.0042dd2d
lea ecx, [ebp - 0xfc]
call fcn.0042dd2d
lea ecx, [ebp - 0xe0]
call fcn.0042dd2d
lea ecx, [ebp - 0x104]
call fcn.0042dd2d
lea ecx, [ebp - 0x100]
call fcn.0042dd2d
pop edi
pop esi
mov eax, ebx
pop ebx
add ebp, 0x60
leave
ret 0x18