Function at 0x4fdc94
Capabilities:
Check for time delay via gettickcount
Copy file
Create process on windows
Get common file path
Move file
Persist via lnk shortcut
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x33
push 0
push 0
dec ecx
jne 0x4fdc9c
push ecx
push ebx
push esi
push edi
mov eax, 0x4fd4ec
call fcn.00406dd8
mov ebx, dword [0x541c9c]
xor eax, eax
push ebp
push 0x4ff0cf
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [0x541f14]
mov eax, dword [eax]
call fcn.00409b80
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00408e1c
mov eax, dword [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov eax, 2
call fcn.004ab980
mov edx, dword [ebp - 0x1c]
pop eax
call fcn.004049d0
jne 0x4fdd05
mov eax, dword [0x5418f8]
mov byte [eax], 0
jmp 0x4fdd0d
mov eax, dword [0x5418f8]
mov byte [eax], 1
lea edx, [ebp - 0x24]
mov eax, 1
call fcn.00402aa0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408e58
mov edx, dword [ebp - 0x20]
mov eax, dword [0x541af4]
call fcn.0040460c
lea edx, [ebp - 0x2c]
mov eax, 2
call fcn.00402aa0
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00408e58
mov edx, dword [ebp - 0x28]
mov eax, dword [0x541b68]
call fcn.0040460c
mov eax, dword [0x5418f8]
cmp byte [eax], 0
jne 0x4fdd7d
lea edx, [ebp - 0x30]
mov eax, 0x11c
call fcn.004ab980
mov edx, dword [ebp - 0x30]
mov eax, dword [0x54192c]
call fcn.0040460c
jmp 0x4fdda6
lea edx, [ebp - 0x38]
mov eax, dword [0x541f14]
mov eax, dword [eax]
call fcn.00409b80
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x34]
xor edx, edx
call fcn.00409a44
mov edx, dword [ebp - 0x34]
mov eax, dword [0x54192c]
call fcn.0040460c
push 0x4ff0e8
mov eax, dword [0x541f14]
push dword [eax]
push 0x4ff0f4
mov eax, dword [0x541bf0]
mov edx, 3
call fcn.0040494c
mov eax, dword [0x541af4]
mov eax, dword [eax]
mov edx, 0x4ff104
call fcn.004049d0
jne 0x4fde79
fld xword [0x4ff108]
mov eax, dword [0x5419dc]
fcomp qword [eax]
fnstsw ax
sahf
jae 0x4fde79
call fcn.0046af78
test al, al
jne 0x4fde79
call fcn.0040b150
call fcn.00402b8c
push edx
push eax
lea eax, [ebp - 0x3c]
call fcn.00409420
mov edx, dword [ebp - 0x3c]
mov eax, dword [0x541b68]
call fcn.0040460c
lea edx, [ebp - 0x40]
mov eax, dword [0x541f14]
mov eax, dword [eax]
call fcn.0046dd54
mov eax, dword [ebp - 0x40]
call fcn.00404a84
push eax
mov eax, dword [0x541af4]
push dword [eax]
push 0x4ff11c
mov eax, dword [0x541b68]
push dword [eax]
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.0040494c
mov eax, dword [ebp - 0x44]
call fcn.00404a84
push eax
mov eax, dword [0x541f14]
mov eax, dword [eax]
call fcn.00404a84
mov edx, eax
xor eax, eax
pop ecx
call fcn.0046aff4
jmp 0x4ff07b
lea edx, [ebp - 0x48]
mov eax, dword [ebx]
call fcn.00408e1c
mov edx, dword [ebp - 0x48]
mov eax, 0x54aba8
call fcn.0040460c
mov eax, dword [0x54aba8]
call fcn.004630f4
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x4c]
call fcn.00409420
mov eax, dword [ebp - 0x4c]
push eax
lea edx, [ebp - 0x50]
mov eax, 0x33
call fcn.004ab980
mov edx, dword [ebp - 0x50]
mov eax, 0x54aba4
pop ecx
call fcn.004048d8
mov dl, 1
mov eax, dword [0x462efc]
call fcn.0040377c
mov dword [0x5413f0], eax
mov edx, dword [0x54aba4]
mov eax, dword [0x5413f0]
call fcn.00462fa0
test eax, eax
jne 0x4fe088
mov eax, 0x4ff120
xor edx, edx
call fcn.00471228
mov ebx, eax
test ebx, ebx
je 0x4ff01c
mov eax, dword [0x541af4]
mov eax, dword [eax]
mov edx, 0x4ff134
call fcn.004049d0
jne 0x4fdf2b
push 0
push 0
push 0x702
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4ff01c
mov eax, dword [0x541af4]
mov eax, dword [eax]
mov edx, 0x4ff140
call fcn.004049d0
jne 0x4fdf52
push 0
push 3
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4ff01c
mov eax, dword [0x541af4]
mov eax, dword [eax]
mov edx, 0x4ff150
call fcn.004049d0
jne 0x4fdf79
push 0
push 4
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4ff01c
mov eax, dword [0x541af4]
mov eax, dword [eax]
mov edx, 0x4ff160
call fcn.004049d0
jne 0x4fdfa0
push 0
push 0
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4ff01c
mov eax, dword [0x541af4]
mov eax, dword [eax]
mov edx, 0x4ff16c
call fcn.004049d0
jne 0x4fe067
mov edx, dword [0x541b68]
mov eax, 2
call fcn.00402aa0
mov eax, dword [0x541b68]
cmp dword [eax], 0
jne 0x4fdfe0
mov eax, dword [0x541b68]
mov edx, 0x4ff11c
call fcn.0040460c
push 0
push 2
push 0x604
push ebx
call sub.user32.dll_PostMessageA
mov eax, dword [0x541b68]
mov eax, dword [eax]
call fcn.0040488c
mov esi, eax
lea eax, [esi + 3]
push eax
mov eax, 0x54aba0
mov ecx, 1
mov edx, dword [0x4fd4a0]
call fcn.00405f1c
add esp, 4
mov eax, dword [0x541b68]
call fcn.00404adc
mov edx, eax
mov eax, dword [0x54aba0]
call fcn.00409de8
mov edi, dword [0x54aba0]
test esi, esi
jle 0x4fe053
mov eax, dword [edi]
push eax
push 2
push 0x604
push ebx
call sub.user32.dll_PostMessageA
add edi, 4
sub esi, 4
test esi, esi
jg 0x4fe039
push 0
push 1
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4ff01c
mov eax, dword [0x5417e8]
mov eax, dword [eax]
push eax
mov eax, dword [0x541910]
movzx eax, byte [eax]
push eax
push 0x600
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4ff01c
lea edx, [ebp - 0x58]
mov eax, dword [0x541f14]
mov eax, dword [eax]
call fcn.00409b80
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x54]
xor edx, edx
call fcn.00409a44
mov edx, dword [ebp - 0x54]
mov eax, dword [0x541e54]
call fcn.0040460c
mov eax, dword [0x541e14]
mov dword [eax], 0x6562
lea edx, [ebp - 0x5c]
xor eax, eax
call fcn.00471f74
mov edx, dword [ebp - 0x5c]
mov eax, dword [0x541df4]
call fcn.0040460c
lea edx, [ebp - 0x60]
xor eax, eax
call fcn.00471f74
mov edx, dword [ebp - 0x60]
mov eax, dword [0x541ae8]
call fcn.0040460c
mov eax, dword [0x54aba8]
call fcn.0040488c
push eax
mov eax, 0x54aba8
call fcn.00404adc
pop edx
call fcn.004714c8
mov edx, dword [0x541e14]
add dword [edx], eax
call fcn.00402b00
lea edx, [ebp - 0x64]
mov eax, 0x3e
call fcn.004ab980
mov ecx, dword [ebp - 0x64]
mov edx, dword [ebx]
mov eax, dword [0x5414e8]
call fcn.004048d8
lea edx, [ebp - 0x68]
mov eax, 0x3c
call fcn.004ab980
mov ecx, dword [ebp - 0x68]
mov edx, dword [ebx]
mov eax, dword [0x541efc]
call fcn.004048d8
lea edx, [ebp - 0x6c]
mov eax, 0x3d
call fcn.004ab980
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ebx]
mov eax, dword [0x541bac]
call fcn.004048d8
lea edx, [ebp - 0x70]
mov eax, 0x34
call fcn.004ab980
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebx]
mov eax, dword [0x541a14]
call fcn.004048d8
lea edx, [ebp - 0x74]
mov eax, 0x36
call fcn.004ab980
mov ecx, dword [ebp - 0x74]
mov edx, dword [ebx]
mov eax, dword [0x5416f8]
call fcn.004048d8
lea edx, [ebp - 0x78]
mov eax, 0x3b
call fcn.004ab980
mov ecx, dword [ebp - 0x78]
mov edx, dword [ebx]
mov eax, dword [0x541e84]
call fcn.004048d8
lea edx, [ebp - 0x7c]
mov eax, 4
call fcn.004ab980
mov ecx, dword [ebp - 0x7c]
mov edx, dword [ebx]
mov eax, dword [0x541820]
call fcn.004048d8
lea edx, [ebp - 0x80]
mov eax, 0x7b
call fcn.004ab980
mov ecx, dword [ebp - 0x80]
mov edx, dword [ebx]
mov eax, dword [0x541e60]
call fcn.004048d8
lea edx, [ebp - 0x84]
mov eax, 3
call fcn.004ab980
mov ecx, dword [ebp - 0x84]
mov edx, dword [ebx]
mov eax, dword [0x541ce4]
call fcn.004048d8
lea edx, [ebp - 0x88]
mov eax, dword [0x541f14]
mov eax, dword [eax]
call fcn.00408e1c
mov edx, dword [ebp - 0x88]
mov eax, 0x54ab78
call fcn.0040460c
push 0x104
mov eax, dword [0x541904]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
cmp eax, 2
jb 0x4fe2e1
lea edx, [ebp - 0x8c]
mov eax, dword [0x541904]
call fcn.00409fe8
mov edx, dword [ebp - 0x8c]
mov eax, dword [0x54161c]
call fcn.0040460c
mov eax, dword [0x54161c]
mov eax, dword [eax]
call fcn.0040488c
cmp eax, 3
jle 0x4fe294
mov eax, dword [0x54161c]
mov edx, 0x4ff178
call fcn.00404894
mov eax, dword [0x54161c]
lea edx, [ebp - 0x90]
mov eax, 0x70
call fcn.004ab980
mov ecx, dword [ebp - 0x90]
mov edx, dword [0x54161c]
mov edx, dword [edx]
mov eax, dword [0x5416e0]
call fcn.004048d8
mov eax, dword [0x54161c]
mov eax, dword [eax]
cmp byte [eax + 1], 0x3a
jne 0x4fe2e9
mov eax, dword [0x54161c]
mov eax, dword [eax]
mov al, byte [eax]
call fcn.00402b3c
mov edx, dword [0x5418f4]
mov byte [edx], al
jmp 0x4fe2e9
mov eax, dword [0x5418f4]
mov byte [eax], 0x43
push 0x104
mov eax, dword [0x541904]
push eax
lea edx, [ebp - 0x94]
mov eax, 0x2e
call fcn.004ab980
mov eax, dword [ebp - 0x94]
call fcn.00404a84
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov eax, dword [0x541904]
call fcn.00409fcc
mov edx, eax
mov eax, 0x54ab84
call fcn.004047a8
mov eax, 0x54ab84
call fcn.0046aa2c
mov eax, dword [0x54ab78]
cmp byte [eax], 0x5c
jne 0x4fe349
mov eax, dword [0x541ce0]
mov byte [eax], 2
jmp 0x4fe364
mov edx, dword [0x54ab78]
mov eax, dword [0x54ab84]
call fcn.00404bc8
dec eax
jne 0x4fe364
mov eax, dword [0x541ce0]
mov byte [eax], 1
lea eax, [ebp - 0x98]
call fcn.00471450
mov edx, dword [ebp - 0x98]
mov eax, dword [0x541520]
call fcn.0040460c
mov eax, dword [0x541af4]
mov eax, dword [eax]
mov edx, 0x4ff104
call fcn.004049d0
jne 0x4fe3c5
lea edx, [ebp - 0x9c]
mov eax, 0x31
call fcn.004ab980
mov eax, dword [ebp - 0x9c]
push eax
lea edx, [ebp - 0xa0]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0xa0]
pop edx
call fcn.0046d194
mov eax, dword [0x541af4]
mov eax, dword [eax]
mov edx, 0x4ff184
call fcn.004049d0
jne 0x4fe3e0
mov eax, dword [0x541910]
mov byte [eax], 1
mov eax, dword [0x541af4]
mov eax, dword [eax]
mov edx, 0x4ff190
call fcn.004049d0
je 0x4fe40a
mov eax, dword [0x541b68]
mov eax, dword [eax]
mov edx, 0x4ff190
call fcn.004049d0
je 0x4fe40a
xor eax, eax
jmp 0x4fe40c
mov al, 1
test al, al
je 0x4fe438
mov eax, 0x7d0
call fcn.004d938c
mov eax, dword [0x541820]
mov eax, dword [eax]
call fcn.0046dddc
test al, al
je 0x4fe44c
mov eax, dword [0x541820]
mov eax, dword [eax]
call fcn.00409988
jmp 0x4fe44c
mov eax, dword [0x541910]
cmp byte [eax], 1
jne 0x4fe44c
mov eax, 0x7d0
call fcn.004d938c
lea edx, [ebp - 0xa4]
mov eax, 0x32
call fcn.004ab980
mov eax, dword [ebp - 0xa4]
push eax
lea edx, [ebp - 0xa8]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0xa8]
pop edx
call fcn.0046cf18
sub eax, 0x7d0
mov dword [0x5413f4], eax
lea edx, [ebp - 0xac]
mov eax, 0x76
call fcn.004ab980
mov eax, dword [ebp - 0xac]
push eax
lea edx, [ebp - 0xb0]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0xb0]
pop edx
call fcn.0046d3c0
test al, al
je 0x4fe4fd
lea edx, [ebp - 0xb4]
mov eax, 0x76
call fcn.004ab980
mov eax, dword [ebp - 0xb4]
push eax
lea edx, [ebp - 0xb8]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0xb8]
pop edx
call fcn.0046cf18
mov edx, dword [0x5417e8]
mov dword [edx], eax
jmp 0x4fe508
mov eax, dword [0x5417e8]
mov dword [eax], 0x1f40
mov eax, dword [0x541ce0]
cmp byte [eax], 1
je 0x4fe74e
lea edx, [ebp - 0xc0]
mov eax, 0x31
call fcn.004ab980
mov eax, dword [ebp - 0xc0]
push eax
lea edx, [ebp - 0xc4]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xbc]
pop edx
call fcn.0046c5d0
mov edx, dword [ebp - 0xbc]
mov eax, 0x54ab74
call fcn.0040460c
lea edx, [ebp - 0xcc]
mov eax, 0x11b
call fcn.004ab980
mov eax, dword [ebp - 0xcc]
push eax
lea edx, [ebp - 0xd0]
mov eax, 0x13
call fcn.004ab980
mov eax, dword [ebp - 0xd0]
lea ecx, [ebp - 0xc8]
pop edx
call fcn.0046c5d0
mov edx, dword [ebp - 0xc8]
mov eax, 0x54ab70
call fcn.0040460c
cmp dword [0x54ab70], 0
je 0x4fe5f0
mov eax, 0x54ab74
call fcn.004045b8
lea edx, [ebp - 0xd4]
mov eax, 0x11b
call fcn.004ab980
mov eax, dword [ebp - 0xd4]
push eax
lea edx, [ebp - 0xd8]
mov eax, 0x13
call fcn.004ab980
mov eax, dword [ebp - 0xd8]
pop edx
call fcn.0046d194
jmp 0x4fe629
lea edx, [ebp - 0xe0]
mov eax, 0x13
call fcn.004ab980
mov eax, dword [ebp - 0xe0]
lea ecx, [ebp - 0xdc]
mov edx, dword [0x54192c]
mov edx, dword [edx]
call fcn.0046c5d0
mov edx, dword [ebp - 0xdc]
mov eax, 0x54ab70
call fcn.0040460c
mov eax, dword [0x54ab74]
mov edx, 0x4ff19c
call fcn.004049d0
jne 0x4fe65f
cmp dword [0x54ab70], 0
je 0x4fe74e
mov eax, dword [0x54ab70]
mov edx, dword [0x541bf0]
mov edx, dword [edx]
call fcn.004049d0
je 0x4fe74e
lea edx, [ebp - 0xe4]
mov eax, 0x31
call fcn.004ab980
mov eax, dword [ebp - 0xe4]
push eax
lea edx, [ebp - 0xe8]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0xe8]
mov ecx, 0x4ff19c
pop edx
call fcn.0046c3a4
lea edx, [ebp - 0xec]
mov eax, 0x124
call fcn.004ab980
push dword [ebp - 0xec]
push 0x4ff178
mov eax, dword [0x54192c]
push dword [eax]
push 0x4ff1a8
mov eax, 0x54ab9c
mov edx, 4
call fcn.0040494c
mov eax, 0x54ab9c
call fcn.004db6bc
lea edx, [ebp - 0xf0]
mov eax, 0x13
call fcn.004ab980
mov eax, dword [ebp - 0xf0]
mov ecx, dword [0x541bf0]
mov ecx, dword [ecx]
mov edx, dword [0x54192c]
mov edx, dword [edx]
call fcn.0046c3a4
test al, al
je 0x4fe712
mov eax, dword [0x54ab9c]
call fcn.00409988
jmp 0x4fe74e
lea edx, [ebp - 0xf4]
mov eax, 0x13
call fcn.004ab980
mov eax, dword [ebp - 0xf4]
mov edx, dword [0x54192c]
mov edx, dword [edx]
call fcn.0046d194
push 0
mov eax, dword [0x541f14]
mov eax, dword [eax]
mov ecx, dword [0x54ab9c]
mov edx, 0x4ff184
call fcn.004d948c
lea edx, [ebp - 0xf8]
mov eax, 0x11b
call fcn.004ab980
mov eax, dword [ebp - 0xf8]
push eax
lea edx, [ebp - 0xfc]
mov eax, 0x13
call fcn.004ab980
mov eax, dword [ebp - 0xfc]
pop edx
call fcn.0046d194
lea edx, [ebp - 0x100]
mov eax, 0x25
call fcn.004ab980
mov eax, dword [ebp - 0x100]
push eax
lea edx, [ebp - 0x104]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0x104]
pop edx
call fcn.0046d194
lea edx, [ebp - 0x108]
mov eax, 0x26
call fcn.004ab980
mov eax, dword [ebp - 0x108]
push eax
lea edx, [ebp - 0x10c]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0x10c]
pop edx
call fcn.0046d194
mov edx, dword [ebx]
mov eax, dword [0x541b9c]
mov ecx, 0x4ff1b8
call fcn.004048d8
lea edx, [ebp - 0x110]
mov eax, 0x77
call fcn.004ab980
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebx]
mov eax, dword [0x541a64]
call fcn.004048d8
lea edx, [ebp - 0x114]
mov eax, 0x78
call fcn.004ab980
mov ecx, dword [ebp - 0x114]
mov edx, dword [ebx]
mov eax, dword [0x5415d0]
call fcn.004048d8
mov eax, dword [0x541ce0]
cmp byte [eax], 2
jne 0x4feab7
lea edx, [ebp - 0x118]
mov eax, 0x1a
call fcn.004ab980
mov ecx, dword [ebp - 0x118]
mov eax, 0x54ab80
mov edx, dword [0x54ab84]
call fcn.004048d8
lea edx, [ebp - 0x120]
mov eax, 0x1a
call fcn.004ab980
mov ecx, dword [ebp - 0x120]
mov edx, dword [ebx]
lea eax, [ebp - 0x11c]
call fcn.004048d8
mov edx, dword [ebp - 0x11c]
mov eax, dword [0x54ab80]
call fcn.004fd0e4
mov eax, 0x54ab80
mov ecx, 0x4ff1b8
mov edx, dword [0x54ab84]
call fcn.004048d8
mov edx, dword [0x541b9c]
mov edx, dword [edx]
mov eax, dword [0x54ab80]
call fcn.004fd0e4
lea edx, [ebp - 0x124]
mov eax, 0x77
call fcn.004ab980
mov ecx, dword [ebp - 0x124]
mov eax, 0x54ab80
mov edx, dword [0x54ab84]
call fcn.004048d8
mov edx, dword [0x541a64]
mov edx, dword [edx]
mov eax, dword [0x54ab80]
call fcn.004fd0e4
lea edx, [ebp - 0x128]
mov eax, 0x78
call fcn.004ab980
mov ecx, dword [ebp - 0x128]
mov eax, 0x54ab80
mov edx, dword [0x54ab84]
call fcn.004048d8
mov edx, dword [0x5415d0]
mov edx, dword [edx]
mov eax, dword [0x54ab80]
call fcn.004fd0e4
lea edx, [ebp - 0x12c]
mov eax, 0x3e
call fcn.004ab980
mov ecx, dword [ebp - 0x12c]
mov edx, dword [ebx]
mov eax, 0x54ab88
call fcn.004048d8
lea edx, [ebp - 0x130]
mov eax, 0x3e
call fcn.004ab980
mov ecx, dword [ebp - 0x130]
mov eax, 0x54ab8c
mov edx, dword [0x54ab84]
call fcn.004048d8
mov edx, dword [0x54ab88]
mov eax, dword [0x54ab8c]
call fcn.004fd0e4
lea edx, [ebp - 0x134]
mov eax, 0x34
call fcn.004ab980
mov ecx, dword [ebp - 0x134]
mov edx, dword [ebx]
mov eax, 0x54ab88
call fcn.004048d8
lea edx, [ebp - 0x138]
mov eax, 0x34
call fcn.004ab980
mov ecx, dword [ebp - 0x138]
mov eax, 0x54ab8c
mov edx, dword [0x54ab84]
call fcn.004048d8
mov edx, dword [0x54ab88]
mov eax, dword [0x54ab8c]
call fcn.004fd0e4
lea edx, [ebp - 0x13c]
mov eax, 0x3c
call fcn.004ab980
mov ecx, dword [ebp - 0x13c]
mov edx, dword [ebx]
mov eax, 0x54ab88
call fcn.004048d8
lea edx, [ebp - 0x140]
mov eax, 0x3c
call fcn.004ab980
mov ecx, dword [ebp - 0x140]
mov eax, 0x54ab8c
mov edx, dword [0x54ab84]
call fcn.004048d8
mov edx, dword [0x54ab88]
mov eax, dword [0x54ab8c]
call fcn.004fd0e4
lea edx, [ebp - 0x144]
mov eax, 1
call fcn.004ab980
mov ecx, dword [ebp - 0x144]
mov eax, 0x54ab7c
mov edx, dword [0x54ab84]
call fcn.004048d8
push 0
mov eax, dword [0x54ab7c]
call fcn.00404a84
mov esi, eax
push esi
mov eax, dword [0x54ab78]
call fcn.00404a84
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x4feab7
push 1
mov eax, 0x54ab84
call fcn.00404adc
push eax
mov eax, dword [0x541af4]
mov eax, dword [eax]
call fcn.00404a84
push eax
push esi
push 0x4ff1c4
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x4ff01c
lea edx, [ebp - 0x148]
mov eax, 0x79
call fcn.004ab980
mov edx, dword [ebp - 0x148]
mov ecx, dword [0x541b34]
mov ecx, dword [ecx]
mov eax, dword [0x541de4]
call fcn.004048d8
lea edx, [ebp - 0x14c]
mov eax, 0x7a
call fcn.004ab980
mov eax, dword [ebp - 0x14c]
push eax
lea edx, [ebp - 0x150]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0x150]
pop edx
call fcn.0046cf18
mov edx, dword [0x5416c0]
mov dword [edx], eax
call fcn.004f7eac
mov eax, dword [0x5416c0]
cmp dword [eax], 0
jne 0x4fedd3
mov eax, dword [0x541910]
cmp byte [eax], 1
jne 0x4fedd3
mov eax, dword [0x541ce0]
cmp byte [eax], 0
jne 0x4fedd3
mov eax, dword [0x541554]
cmp dword [eax], 0
je 0x4fec61
mov eax, dword [0x541554]
mov eax, dword [eax]
call fcn.00462eb4
test al, al
jne 0x4feb9f
lea edx, [ebp - 0x154]
mov eax, 0x7c
call fcn.004ab980
mov eax, dword [ebp - 0x154]
push eax
lea edx, [ebp - 0x158]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0x158]
pop edx
call fcn.0046cf18
call fcn.004d938c
mov eax, dword [0x541554]
mov eax, dword [eax]
call fcn.00462eb4
test al, al
je 0x4fec61
call fcn.004fd238
test al, al
je 0x4fec61
lea edx, [ebp - 0x15c]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0x15c]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4ff1d4
pop eax
call fcn.0046ccf4
lea edx, [ebp - 0x160]
mov eax, 0x11a
call fcn.004ab980
mov eax, dword [ebp - 0x160]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4ff1e8
pop eax
call fcn.0046ccf4
call sub.kernel32.dll_GetTickCount
mov ebx, eax
add ebx, 0x7d0
jmp 0x4fec28
push 0x64
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount
cmp ebx, eax
ja 0x4fec21
push 1
mov edx, dword [0x541820]
mov edx, dword [edx]
lea eax, [ebp - 0x164]
mov ecx, 0x4ff200
call fcn.004048d8
mov eax, dword [ebp - 0x164]
call fcn.00404a84
push eax
call sub.kernel32.dll_WinExec
jmp 0x4ff01c
lea edx, [ebp - 0x16c]
mov eax, 0xb
call fcn.004ab980
mov ecx, dword [ebp - 0x16c]
mov edx, dword [ebx]
lea eax, [ebp - 0x168]
call fcn.004048d8
mov eax, dword [ebp - 0x168]
call fcn.0046dddc
test al, al
je 0x4fedd3
mov dl, 1
mov eax, dword [0x414c40]
call fcn.0040377c
mov dword [0x54ab90], eax
lea edx, [ebp - 0x178]
mov eax, 0xb
call fcn.004ab980
mov ecx, dword [ebp - 0x178]
mov edx, dword [ebx]
lea eax, [ebp - 0x174]
call fcn.004048d8
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 0x170]
call fcn.00404e90
mov eax, dword [ebp - 0x170]
push eax
mov eax, dword [0x54ab90]
push eax
call fcn.0046e0f4
mov eax, dword [0x54ab90]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4fedc9
mov eax, dword [0x54ab90]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
cmp esi, 0
jl 0x4fed8d
lea ecx, [ebp - 0x17c]
mov edx, esi
mov eax, dword [0x54ab90]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x17c]
mov eax, 0x54ab98
call fcn.0040460c
lea edx, [ebp - 0x180]
mov eax, 0xa
call fcn.004ab980
mov ecx, dword [ebp - 0x180]
mov eax, 0x54ab94
mov edx, dword [0x54ab98]
call fcn.004048d8
push 1
mov eax, 0x54ab98
call fcn.00404adc
push eax
mov eax, 0x54ab94
call fcn.00404adc
push eax
call sub.kernel32.dll_MoveFileExA
test eax, eax
je 0x4fed87
mov edx, esi
mov eax, dword [0x54ab90]
mov ecx, dword [eax]
call dword [ecx + 0x48]
dec esi
cmp esi, 0xffffffff
jne 0x4fed12
mov eax, dword [0x54ab90]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x4fedc9
lea edx, [ebp - 0x188]
mov eax, 0xb
call fcn.004ab980
mov ecx, dword [ebp - 0x188]
mov edx, dword [ebx]
lea eax, [ebp - 0x184]
call fcn.004048d8
mov eax, dword [ebp - 0x184]
call fcn.00409988
mov eax, dword [0x54ab90]
call fcn.004037ac
call fcn.004b1124
mov eax, dword [0x541910]
cmp byte [eax], 1
je 0x4fedeb
mov eax, dword [0x5417e8]
xor edx, edx
mov dword [eax], edx
cmp dword [0x5413f4], 0
jle 0x4fee37
mov eax, dword [0x541910]
cmp byte [eax], 1
jne 0x4fee37
mov eax, dword [0x5413f4]
call fcn.004d938c
mov eax, dword [0x5417e8]
cmp dword [eax], 0
jle 0x4fee37
mov eax, dword [0x5417e8]
mov edx, dword [0x5413f4]
sub dword [eax], edx
mov eax, dword [0x5417e8]
cmp dword [eax], 0x7d0
jge 0x4fee37
mov eax, dword [0x5417e8]
mov dword [eax], 0x7d0
mov eax, dword [0x541a50]
mov dword [eax], 0x20
lea eax, [ebp - 0x18c]
mov edx, dword [0x541f14]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x18c]
mov edx, dword [0x541a50]
mov dx, word [edx]
call fcn.0046e16c
mov edx, dword [0x541844]
mov dword [edx], eax
mov eax, dword [0x541844]
cmp dword [eax], 0
jne 0x4feeb4
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x190]
mov edx, dword [0x541f14]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x190]
mov edx, dword [0x541a50]
mov dx, word [edx]
call fcn.0046e16c
mov edx, dword [0x541844]
mov dword [edx], eax
mov eax, dword [0x541844]
cmp dword [eax], 0
jne 0x4feef7
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x194]
mov edx, dword [0x541f14]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x194]
mov edx, dword [0x541a50]
mov dx, word [edx]
call fcn.0046e16c
mov edx, dword [0x541844]
mov dword [edx], eax
mov eax, dword [0x541844]
cmp dword [eax], 0
jne 0x4fef3a
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x198]
mov edx, dword [0x541f14]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x198]
mov edx, dword [0x541a50]
mov dx, word [edx]
call fcn.0046e16c
mov edx, dword [0x541844]
mov dword [edx], eax
mov dl, 1
mov eax, dword [0x414c40]
call fcn.0040377c
call fcn.004037ac
call sub.kernel32.dll_GetCurrentProcessId
mov edx, dword [0x5414ac]
mov dword [edx], eax
mov eax, dword [0x541b3c]
mov eax, dword [eax]
call fcn.00449488
call fcn.004ac1f4
mov ecx, dword [0x541cc4]
mov eax, dword [0x541b3c]
mov eax, dword [eax]
mov edx, dword [0x4b6d94]
call fcn.004494a0
mov ecx, dword [0x541a80]
mov eax, dword [0x541b3c]
mov eax, dword [eax]
mov edx, dword [0x4b5d04]
call fcn.004494a0
mov edx, dword [0x541df4]
mov edx, dword [edx]
mov eax, dword [0x541cc4]
mov eax, dword [eax]
call fcn.00457830
mov ecx, dword [0x5415a0]
mov eax, dword [0x541b3c]
mov eax, dword [eax]
mov edx, dword [0x4d6194]
call fcn.004494a0
mov edx, dword [0x541ae8]
mov edx, dword [edx]
mov eax, dword [0x5415a0]
mov eax, dword [eax]
call fcn.00457830
mov ecx, dword [0x541720]
mov eax, dword [0x541b3c]
mov eax, dword [eax]
mov edx, dword [0x4aed88]
call fcn.004494a0
mov eax, dword [0x5415a0]
mov eax, dword [eax]
mov edx, dword [0x541cc4]
mov edx, dword [edx]
mov dword [edx + 0x314], eax
mov eax, dword [0x541b3c]
mov eax, dword [eax]
call fcn.00449520
mov eax, dword [0x541844]
call fcn.0040e368
mov eax, 0x5413f0
call fcn.0040e368
mov eax, dword [0x54164c]
cmp byte [eax], 0
je 0x4ff066
push 1
push 0x4ff204
push 0x4ff204
lea edx, [ebp - 0x19c]
mov eax, dword [0x541b3c]
mov eax, dword [eax]
call fcn.00449b0c
mov eax, dword [ebp - 0x19c]
call fcn.00404a84
push eax
push 0x4ff208
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.004b1350
push 0x1341606
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ff0d6
lea eax, [ebp - 0x19c]
call fcn.004045b8
lea eax, [ebp - 0x198]
mov edx, 4
call fcn.00404d08
lea eax, [ebp - 0x188]
mov edx, 6
call fcn.004045dc
lea eax, [ebp - 0x170]
call fcn.00404cf0
lea eax, [ebp - 0x16c]
mov edx, 0x57
call fcn.004045dc
ret