Function at 0x4ee00c
Capabilities:
Create process on windows
Get common file path
Move file
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x24
push 0
push 0
dec ecx
jne 0x4ee014
push ebx
push esi
push edi
mov eax, 0x4ed87c
call fcn.00406d60
mov esi, 0x5310a0
xor eax, eax
push ebp
push 0x4eefef
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [0x531a4c]
mov eax, dword [eax]
call fcn.00409a28
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00408d5c
mov eax, dword [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov eax, 2
call fcn.004a829c
mov edx, dword [ebp - 0x1c]
pop eax
call fcn.00404958
jne 0x4ee07b
mov eax, dword [0x531500]
mov byte [eax], 0
jmp 0x4ee083
mov eax, dword [0x531500]
mov byte [eax], 1
lea edx, [ebp - 0x24]
mov eax, 1
call fcn.00402aa0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408d98
mov edx, dword [ebp - 0x20]
mov eax, dword [0x5316b4]
call fcn.004045b0
lea edx, [ebp - 0x2c]
mov eax, 2
call fcn.00402aa0
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00408d98
mov edx, dword [ebp - 0x28]
mov eax, dword [0x531718]
call fcn.004045b0
mov eax, dword [0x531500]
cmp byte [eax], 0
jne 0x4ee0f3
lea edx, [ebp - 0x30]
mov eax, 0x11c
call fcn.004a829c
mov edx, dword [ebp - 0x30]
mov eax, dword [0x531530]
call fcn.004045b0
jmp 0x4ee11c
lea edx, [ebp - 0x38]
mov eax, dword [0x531a4c]
mov eax, dword [eax]
call fcn.00409a28
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x34]
xor edx, edx
call fcn.00409960
mov edx, dword [ebp - 0x34]
mov eax, dword [0x531530]
call fcn.004045b0
push 0x4ef00c
mov eax, dword [0x531a4c]
push dword [eax]
push 0x4ef00c
mov eax, dword [0x531784]
mov edx, 3
call fcn.004048d4
mov eax, dword [0x5316b4]
mov eax, dword [eax]
mov edx, 0x4ef018
call fcn.00404958
jne 0x4ee1ef
fld xword [0x4ef01c]
mov eax, dword [0x5315bc]
fcomp qword [eax]
fnstsw ax
sahf
jae 0x4ee1ef
call fcn.00469bb4
test al, al
jne 0x4ee1ef
call fcn.0040afc4
call fcn.00402b6c
push edx
push eax
lea eax, [ebp - 0x3c]
call fcn.00409360
mov edx, dword [ebp - 0x3c]
mov eax, dword [0x531718]
call fcn.004045b0
lea edx, [ebp - 0x40]
mov eax, dword [0x531a4c]
mov eax, dword [eax]
call fcn.0046c3ec
mov eax, dword [ebp - 0x40]
call fcn.00404a0c
push eax
mov eax, dword [0x5316b4]
push dword [eax]
push 0x4ef030
mov eax, dword [0x531718]
push dword [eax]
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.004048d4
mov eax, dword [ebp - 0x44]
call fcn.00404a0c
push eax
mov eax, dword [0x531a4c]
mov eax, dword [eax]
call fcn.00404a0c
mov edx, eax
xor eax, eax
pop ecx
call fcn.00469c30
jmp 0x4eef45
lea edx, [ebp - 0x48]
mov eax, dword [0x531818]
mov eax, dword [eax]
call fcn.00408d5c
mov edx, dword [ebp - 0x48]
mov eax, 0x53876c
call fcn.004045b0
mov eax, dword [0x53876c]
call fcn.00461d54
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x4c]
call fcn.00409360
mov eax, dword [ebp - 0x4c]
push eax
lea edx, [ebp - 0x50]
mov eax, 0x33
call fcn.004a829c
mov edx, dword [ebp - 0x50]
mov eax, 0x538768
pop ecx
call fcn.00404860
mov dl, 1
mov eax, dword [0x461b5c]
call fcn.00403720
mov dword [0x53109c], eax
mov edx, dword [0x538768]
mov eax, dword [0x53109c]
call fcn.00461c00
test eax, eax
jne 0x4ee3bb
mov eax, 0x4ef034
xor edx, edx
call fcn.004ec144
mov ebx, eax
test ebx, ebx
je 0x4eeda3
mov eax, dword [0x5316b4]
mov eax, dword [eax]
mov edx, 0x4ef048
call fcn.00404958
jne 0x4ee2a6
push 0
push 3
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4eeda3
mov eax, dword [0x5316b4]
mov eax, dword [eax]
mov edx, 0x4ef058
call fcn.00404958
jne 0x4ee2cd
push 0
push 4
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4eeda3
mov eax, dword [0x5316b4]
mov eax, dword [eax]
mov edx, 0x4ef068
call fcn.00404958
jne 0x4ee2f4
push 0
push 0
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4eeda3
mov eax, dword [0x5316b4]
mov eax, dword [eax]
mov edx, 0x4ef074
call fcn.00404958
jne 0x4eeda3
mov edx, dword [0x531718]
mov eax, 2
call fcn.00402aa0
mov eax, dword [0x531718]
cmp dword [eax], 0
jne 0x4ee334
mov eax, dword [0x531718]
mov edx, 0x4ef030
call fcn.004045b0
push 0
push 2
push 0x604
push ebx
call sub.user32.dll_PostMessageA
mov eax, dword [0x531718]
mov eax, dword [eax]
call fcn.00404814
mov esi, eax
lea eax, [esi + 3]
push eax
mov eax, 0x538764
mov ecx, 1
mov edx, dword [0x4ed830]
call fcn.00405ea4
add esp, 4
mov eax, dword [0x531718]
call fcn.00404a64
mov edx, eax
mov eax, dword [0x538764]
call fcn.00409c5c
mov edi, dword [0x538764]
test esi, esi
jle 0x4ee3a7
mov eax, dword [edi]
push eax
push 2
push 0x604
push ebx
call sub.user32.dll_PostMessageA
add edi, 4
sub esi, 4
test esi, esi
jg 0x4ee38d
push 0
push 1
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4eeda3
lea edx, [ebp - 0x58]
mov eax, dword [0x531a4c]
mov eax, dword [eax]
call fcn.00409a28
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x54]
xor edx, edx
call fcn.00409960
mov edx, dword [ebp - 0x54]
mov eax, dword [0x5319a8]
call fcn.004045b0
mov eax, dword [0x531964]
mov dword [eax], 0x20b9
lea edx, [ebp - 0x5c]
xor eax, eax
call fcn.004ec5e4
mov edx, dword [ebp - 0x5c]
mov eax, dword [0x531944]
call fcn.004045b0
lea edx, [ebp - 0x60]
xor eax, eax
call fcn.004ec5e4
mov edx, dword [ebp - 0x60]
mov eax, dword [0x5316a8]
call fcn.004045b0
mov eax, dword [0x53876c]
call fcn.00404814
push eax
mov eax, 0x53876c
call fcn.00404a64
pop edx
call fcn.004ec2d4
mov edx, dword [0x531964]
add dword [edx], eax
mov eax, 0x7fffffff
call fcn.0040305c
mov dword [0x538770], eax
mov eax, 0x400
call fcn.0040305c
add eax, 0x400
mov dword [0x538774], eax
mov eax, 0x2800
call fcn.0040305c
add eax, 0x2800
mov dword [0x538778], eax
mov eax, 0x7fffffff
call fcn.0040305c
mov dword [0x53877c], eax
mov eax, 0x7d000
call fcn.0040305c
lea edx, [ebp - 0x64]
xor eax, eax
call fcn.004ec5e4
mov edx, dword [ebp - 0x64]
mov eax, 0x538780
mov ecx, 0x4ef080
call fcn.00404860
call fcn.00402b00
lea edx, [ebp - 0x68]
mov eax, 4
call fcn.004a829c
mov ecx, dword [ebp - 0x68]
mov edx, dword [0x531818]
mov edx, dword [edx]
mov eax, dword [0x531444]
call fcn.00404860
lea edx, [ebp - 0x6c]
mov eax, 3
call fcn.004a829c
mov ecx, dword [ebp - 0x6c]
mov edx, dword [0x531818]
mov edx, dword [edx]
mov eax, dword [0x531850]
call fcn.00404860
lea edx, [ebp - 0x70]
mov eax, dword [0x531a4c]
mov eax, dword [eax]
call fcn.00408d5c
mov edx, dword [ebp - 0x70]
mov eax, 0x53874c
call fcn.004045b0
push 0x104
mov eax, dword [0x53150c]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
cmp eax, 2
jb 0x4ee58a
lea edx, [ebp - 0x74]
mov eax, dword [0x53150c]
call fcn.00409e5c
mov edx, dword [ebp - 0x74]
mov eax, dword [0x53128c]
call fcn.004045b0
mov eax, dword [0x53128c]
mov eax, dword [eax]
call fcn.00404814
cmp eax, 3
jle 0x4ee565
mov eax, dword [0x53128c]
mov edx, 0x4ef090
call fcn.0040481c
mov eax, dword [0x53128c]
mov eax, dword [0x53128c]
mov eax, dword [eax]
cmp byte [eax + 1], 0x3a
jne 0x4ee592
mov eax, dword [0x53128c]
mov eax, dword [eax]
mov al, byte [eax]
call fcn.00402b3c
mov edx, dword [0x5314fc]
mov byte [edx], al
jmp 0x4ee592
mov eax, dword [0x5314fc]
mov byte [eax], 0x43
push 0x104
mov eax, dword [0x53150c]
push eax
lea edx, [ebp - 0x78]
mov eax, 0x2e
call fcn.004a829c
mov eax, dword [ebp - 0x78]
call fcn.00404a0c
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov eax, dword [0x53150c]
call fcn.00409e40
mov edx, eax
mov eax, 0x538750
call fcn.0040474c
mov eax, 0x538750
call fcn.00469668
mov eax, dword [0x53874c]
cmp byte [eax], 0x5c
jne 0x4ee5ec
mov eax, dword [0x53184c]
mov byte [eax], 2
jmp 0x4ee607
mov edx, dword [0x53874c]
mov eax, dword [0x538750]
call fcn.00404b50
dec eax
jne 0x4ee607
mov eax, dword [0x53184c]
mov byte [eax], 1
mov eax, dword [0x5316b4]
mov eax, dword [eax]
mov edx, 0x4ef09c
call fcn.00404958
jne 0x4ee622
mov eax, dword [0x531518]
mov byte [eax], 1
mov eax, dword [0x5316b4]
mov eax, dword [eax]
mov edx, 0x4ef0a8
call fcn.00404958
je 0x4ee64c
mov eax, dword [0x531718]
mov eax, dword [eax]
mov edx, 0x4ef0a8
call fcn.00404958
je 0x4ee64c
xor eax, eax
jmp 0x4ee64e
mov al, 1
test al, al
je 0x4ee67a
mov eax, 0x7d0
call fcn.004d0bb8
mov eax, dword [0x531444]
mov eax, dword [eax]
call fcn.0046c474
test al, al
je 0x4ee68e
mov eax, dword [0x531444]
mov eax, dword [eax]
call fcn.004098c8
jmp 0x4ee68e
mov eax, dword [0x531518]
cmp byte [eax], 1
jne 0x4ee68e
mov eax, 0x7d0
call fcn.004d0bb8
lea edx, [ebp - 0x7c]
mov eax, 0x11b
call fcn.004a829c
mov eax, dword [ebp - 0x7c]
push eax
lea edx, [ebp - 0x80]
mov eax, 0x13
call fcn.004a829c
mov eax, dword [ebp - 0x80]
pop edx
call fcn.0046ba40
mov eax, dword [0x531518]
cmp byte [eax], 1
jne 0x4ee855
mov eax, dword [0x53184c]
cmp byte [eax], 0
jne 0x4ee855
lea edx, [ebp - 0x88]
mov eax, 0xb
call fcn.004a829c
mov ecx, dword [ebp - 0x88]
mov edx, dword [0x531818]
mov edx, dword [edx]
lea eax, [ebp - 0x84]
call fcn.00404860
mov eax, dword [ebp - 0x84]
call fcn.0046c474
test al, al
je 0x4ee855
mov dl, 1
mov eax, dword [0x414aa4]
call fcn.00403720
mov dword [0x538758], eax
lea edx, [ebp - 0x94]
mov eax, 0xb
call fcn.004a829c
mov ecx, dword [ebp - 0x94]
mov edx, dword [0x531818]
mov edx, dword [edx]
lea eax, [ebp - 0x90]
call fcn.00404860
mov edx, dword [ebp - 0x90]
lea eax, [ebp - 0x8c]
call fcn.00404e18
mov eax, dword [ebp - 0x8c]
push eax
mov eax, dword [0x538758]
push eax
call fcn.0046c78c
mov eax, dword [0x538758]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4ee84b
mov eax, dword [0x538758]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x4ee809
lea ecx, [ebp - 0x98]
mov edx, ebx
mov eax, dword [0x538758]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x98]
mov eax, 0x538760
call fcn.004045b0
lea edx, [ebp - 0x9c]
mov eax, 0xa
call fcn.004a829c
mov ecx, dword [ebp - 0x9c]
mov eax, 0x53875c
mov edx, dword [0x538760]
call fcn.00404860
push 1
mov eax, 0x538760
call fcn.00404a64
push eax
mov eax, 0x53875c
call fcn.00404a64
push eax
call sub.kernel32.dll_MoveFileExA
test eax, eax
je 0x4ee803
mov edx, ebx
mov eax, dword [0x538758]
mov ecx, dword [eax]
call dword [ecx + 0x48]
dec ebx
cmp ebx, 0xffffffff
jne 0x4ee78e
mov eax, dword [0x538758]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x4ee84b
lea edx, [ebp - 0xa4]
mov eax, 0xb
call fcn.004a829c
mov ecx, dword [ebp - 0xa4]
mov edx, dword [0x531818]
mov edx, dword [edx]
lea eax, [ebp - 0xa0]
call fcn.00404860
mov eax, dword [ebp - 0xa0]
call fcn.004098c8
mov eax, dword [0x538758]
call fcn.00403750
mov eax, dword [0x531624]
mov dword [eax], 0x20
lea eax, [ebp - 0xa8]
mov edx, dword [0x531a4c]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0xa8]
mov edx, dword [0x531624]
mov dx, word [edx]
call fcn.0046c804
mov edx, dword [0x531468]
mov dword [edx], eax
mov eax, dword [0x531468]
cmp dword [eax], 0
jne 0x4ee8d2
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0xac]
mov edx, dword [0x531a4c]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0xac]
mov edx, dword [0x531624]
mov dx, word [edx]
call fcn.0046c804
mov edx, dword [0x531468]
mov dword [edx], eax
mov eax, dword [0x531468]
cmp dword [eax], 0
jne 0x4ee915
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0xb0]
mov edx, dword [0x531a4c]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0xb0]
mov edx, dword [0x531624]
mov dx, word [edx]
call fcn.0046c804
mov edx, dword [0x531468]
mov dword [edx], eax
mov eax, dword [0x531468]
cmp dword [eax], 0
jne 0x4ee958
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0xb4]
mov edx, dword [0x531a4c]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0xb4]
mov edx, dword [0x531624]
mov dx, word [edx]
call fcn.0046c804
mov edx, dword [0x531468]
mov dword [edx], eax
call sub.kernel32.dll_GetCurrentProcessId
mov edx, dword [0x531154]
mov dword [edx], eax
mov eax, dword [0x5316f4]
mov eax, dword [eax]
call fcn.00446e6c
call fcn.004a8b10
mov ecx, dword [0x531838]
mov eax, dword [0x5316f4]
mov eax, dword [eax]
mov edx, dword [0x4af15c]
call fcn.00446e84
mov ecx, dword [0x53164c]
mov eax, dword [0x5316f4]
mov eax, dword [eax]
mov edx, dword [0x4ad6fc]
call fcn.00446e84
mov edx, dword [0x531944]
mov edx, dword [edx]
mov eax, dword [0x531838]
mov eax, dword [eax]
call fcn.00456490
mov ecx, dword [0x531224]
mov eax, dword [0x5316f4]
mov eax, dword [eax]
mov edx, dword [0x4ce05c]
call fcn.00446e84
mov edx, dword [0x5316a8]
mov edx, dword [edx]
mov eax, dword [0x531224]
mov eax, dword [eax]
call fcn.00456490
mov ecx, dword [0x531358]
mov eax, dword [0x5316f4]
mov eax, dword [eax]
mov edx, dword [0x4ab638]
call fcn.00446e84
mov eax, dword [0x531224]
mov eax, dword [eax]
mov edx, dword [0x531838]
mov edx, dword [edx]
mov dword [edx + 0x31c], eax
lea edx, [ebp - 0xbc]
mov eax, 1
call fcn.00402aa0
mov eax, dword [ebp - 0xbc]
lea edx, [ebp - 0xb8]
call fcn.00408d98
mov eax, dword [ebp - 0xb8]
mov edx, 0x4ef018
call fcn.00404958
jne 0x4eeae9
lea edx, [ebp - 0xc0]
mov eax, 0x11a
call fcn.004a829c
mov eax, dword [ebp - 0xc0]
mov ecx, 0x1a803549
mov edx, 0x4ef0b4
call fcn.0046b5a0
lea edx, [ebp - 0xc8]
mov eax, 2
call fcn.00402aa0
mov eax, dword [ebp - 0xc8]
lea edx, [ebp - 0xc4]
call fcn.00408d98
mov eax, dword [ebp - 0xc4]
mov edx, 0x4ef0c4
call fcn.00404958
jne 0x4eeac9
lea edx, [ebp - 0xcc]
mov eax, 0x11a
call fcn.004a829c
mov eax, dword [ebp - 0xcc]
mov ecx, 0x1a803549
mov edx, 0x4ef0d0
call fcn.0046b5a0
jmp 0x4eeae9
lea edx, [ebp - 0xd0]
mov eax, 0x11a
call fcn.004a829c
mov eax, dword [ebp - 0xd0]
mov edx, 0x4ef0d0
call fcn.0046ba40
mov dl, 1
mov eax, dword [0x414aa4]
call fcn.00403720
mov edx, dword [0x5316d8]
mov dword [edx], eax
mov dl, 1
mov eax, dword [0x414440]
call fcn.00403720
mov edx, dword [0x5316d4]
mov dword [edx], eax
mov dl, 1
mov eax, dword [0x414aa4]
call fcn.00403720
mov ebx, eax
lea edx, [ebp - 0xdc]
mov eax, 5
call fcn.004a829c
mov ecx, dword [ebp - 0xdc]
mov edx, dword [0x531818]
mov edx, dword [edx]
lea eax, [ebp - 0xd8]
call fcn.00404860
mov edx, dword [ebp - 0xd8]
lea eax, [ebp - 0xd4]
call fcn.00404e18
mov eax, dword [ebp - 0xd4]
push eax
push ebx
call fcn.0046c78c
test al, al
je 0x4eeb71
mov byte [0x538784], 1
cmp byte [0x538784], 0
je 0x4eec8e
jmp 0x4eec7a
lea ecx, [ebp - 0xe4]
xor edx, edx
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xe4]
lea edx, [ebp - 0xe0]
call fcn.00408fac
mov edx, dword [ebp - 0xe0]
mov eax, 0x538754
call fcn.004045b0
xor edx, edx
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x48]
cmp dword [0x538754], 0
je 0x4eed21
mov edx, dword [0x538754]
mov eax, 0x4ef0e0
call fcn.00404b50
mov dword [esi], eax
cmp dword [esi], 0
jne 0x4eebf2
mov edx, dword [0x538754]
mov eax, 0x4ef0ec
call fcn.00404b50
mov dword [esi], eax
cmp dword [esi], 0
je 0x4eed21
lea eax, [ebp - 0xec]
push eax
mov ecx, dword [esi]
dec ecx
mov edx, 1
mov eax, dword [0x538754]
call fcn.00404a6c
mov eax, dword [ebp - 0xec]
lea edx, [ebp - 0xe8]
call fcn.00408fac
mov edx, dword [ebp - 0xe8]
mov eax, dword [0x5316d8]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0xf4]
push eax
mov edx, dword [esi]
inc edx
mov ecx, 0x400
mov eax, dword [0x538754]
call fcn.00404a6c
mov eax, dword [ebp - 0xf4]
lea edx, [ebp - 0xf0]
call fcn.00408fac
mov eax, dword [ebp - 0xf0]
call fcn.004093d0
mov edx, eax
mov eax, dword [0x5316d4]
mov eax, dword [eax]
call fcn.00416c00
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jg 0x4eeb83
jmp 0x4eed21
mov eax, dword [0x538778]
push eax
mov eax, dword [0x53877c]
push eax
mov eax, dword [0x53128c]
push dword [eax]
push 0x4ef0f8
push dword [0x538780]
lea eax, [ebp - 0xf8]
mov edx, 3
call fcn.004048d4
mov eax, dword [ebp - 0xf8]
push eax
mov ecx, dword [0x538774]
mov edx, dword [0x538770]
mov eax, ebx
call fcn.004ed74c
test al, al
jne 0x4eec7a
mov eax, dword [0x538778]
push eax
mov eax, dword [0x53877c]
push eax
mov edx, dword [0x531818]
mov edx, dword [edx]
lea eax, [ebp - 0xfc]
mov ecx, dword [0x538780]
call fcn.00404860
mov eax, dword [ebp - 0xfc]
push eax
mov ecx, dword [0x538774]
mov edx, dword [0x538770]
mov eax, ebx
call fcn.004ed74c
test al, al
jne 0x4eec7a
mov eax, ebx
call fcn.00403750
mov eax, dword [0x5316d8]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x4eed5a
mov eax, dword [0x5316d8]
mov eax, dword [eax]
mov edx, 0x4ef10c
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x5316d4]
mov eax, dword [eax]
mov edx, 0x20b9
call fcn.00416c00
mov eax, dword [0x5316d8]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jle 0x4eed84
mov eax, dword [0x5316d8]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
call fcn.0040305c
mov edx, dword [0x5312c0]
mov dword [edx], eax
jmp 0x4eed8d
mov eax, dword [0x5312c0]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5316f4]
mov eax, dword [eax]
call fcn.00446f04
mov eax, dword [0x531468]
call fcn.0040e1cc
mov eax, 0x53109c
call fcn.0040e1cc
mov eax, dword [0x5312ac]
cmp byte [eax], 0
je 0x4eeded
push 1
push 0x4ef120
push 0x4ef120
lea edx, [ebp - 0x100]
mov eax, dword [0x5316f4]
mov eax, dword [eax]
call fcn.004474f0
mov eax, dword [ebp - 0x100]
call fcn.00404a0c
push eax
push 0x4ef124
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x5311c8]
cmp byte [eax], 0
je 0x4eef35
mov dl, 1
mov eax, dword [0x414aa4]
call fcn.00403720
mov ebx, eax
lea edx, [ebp - 0x10c]
mov eax, 5
call fcn.004a829c
mov ecx, dword [ebp - 0x10c]
mov edx, dword [0x531818]
mov edx, dword [edx]
lea eax, [ebp - 0x108]
call fcn.00404860
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x104]
call fcn.00404e18
mov eax, dword [ebp - 0x104]
push eax
push ebx
call fcn.0046c78c
test al, al
jne 0x4eef2e
mov eax, dword [0x538778]
push eax
mov eax, dword [0x53877c]
push eax
mov eax, dword [0x53128c]
push dword [eax]
push 0x4ef0f8
push dword [0x538780]
lea eax, [ebp - 0x110]
mov edx, 3
call fcn.004048d4
mov eax, dword [ebp - 0x110]
push eax
mov ecx, dword [0x538774]
mov edx, dword [0x538770]
mov eax, ebx
call fcn.004ed74c
test al, al
jne 0x4eeee7
mov eax, dword [0x538778]
push eax
mov eax, dword [0x53877c]
push eax
mov edx, dword [0x531818]
mov edx, dword [edx]
lea eax, [ebp - 0x114]
mov ecx, dword [0x538780]
call fcn.00404860
mov eax, dword [ebp - 0x114]
push eax
mov ecx, dword [0x538774]
mov edx, dword [0x538770]
mov eax, ebx
call fcn.004ed74c
test al, al
je 0x4eef2e
lea edx, [ebp - 0x120]
mov eax, 5
call fcn.004a829c
mov ecx, dword [ebp - 0x120]
mov edx, dword [0x531818]
mov edx, dword [edx]
lea eax, [ebp - 0x11c]
call fcn.00404860
mov edx, dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
call fcn.00404e18
mov eax, dword [ebp - 0x118]
push eax
push ebx
call fcn.0046c720
mov eax, ebx
call fcn.00403750
push 0x1341606
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eeff9
lea eax, [ebp - 0x120]
mov edx, 2
call fcn.00404580
lea eax, [ebp - 0x118]
call fcn.00404c78
lea eax, [ebp - 0x114]
mov edx, 4
call fcn.00404580
lea eax, [ebp - 0x104]
call fcn.00404c78
lea eax, [ebp - 0x100]
mov edx, 0xb
call fcn.00404580
lea eax, [ebp - 0xd4]
call fcn.00404c78
lea eax, [ebp - 0xd0]
mov edx, 7
call fcn.00404580
lea eax, [ebp - 0xb4]
mov edx, 4
call fcn.00404c90
lea eax, [ebp - 0xa4]
mov edx, 6
call fcn.00404580
lea eax, [ebp - 0x8c]
call fcn.00404c78
lea eax, [ebp - 0x88]
mov edx, 0x1e
call fcn.00404580
ret