Function at 0x4067ac
Capabilities:
Check for time delay via gettickcount
Connect pipe
Create pipe
Create process on windows
Parse credit card information
Persist via run registry key
Query environment variable
Read file on windows
Resume thread
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
lea ebp, [esp - 0x60]
sub esp, 0x344
push ebx
push esi
mov dword [ebp + 0x50], ecx
push edi
lea ecx, [ebp - 0xa0]
call fcn.0042c809
xor ebx, ebx
cmp dword [ebp + 0x68], ebx
je 0x4067f0
push dword [ebp + 0x68]
lea ecx, [ebp - 0xa0]
call fcn.0043667e
mov eax, dword [ebp - 0xa0]
mov dword [ebp + 0x68], eax
lea eax, [ebp + 0x68]
push eax
call fcn.00427312
pop ecx
lea ecx, [ebp - 0xa8]
call fcn.0042c809
mov esi, dword [ebp + 0x70]
cmp esi, ebx
je 0x406814
push esi
lea ecx, [ebp - 0xa8]
call fcn.0043667e
mov esi, dword [ebp - 0xa8]
cmp dword [ebp + 0x78], ebx
jne 0x406822
lea eax, [ebp - 0xd0]
mov dword [ebp + 0x78], eax
mov eax, dword [ebp + 0x68]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x40682f
mov dword [ebp + 0x68], esi
mov eax, dword [ebp + 0x74]
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x10], eax
mov byte [ebp + 0x2b], bl
mov byte [ebp + 0x73], bl
mov byte [ebp + 0x4d], bl
mov byte [ebp - 0x16], 1
mov byte [ebp - 0x1a], bl
mov byte [ebp + 0x4e], bl
mov byte [ebp - 0x1b], bl
mov byte [ebp - 0x18], bl
mov byte [ebp + 0x4f], bl
mov byte [ebp + 0x3f], bl
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x19], bl
call fcn.0042c809
lea ecx, [ebp - 0xac]
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xb4], ebx
mov byte [ebp - 0x17], bl
mov byte [ebp + 0x33], bl
mov byte [ebp + 7], bl
mov byte [ebp - 0x1c], bl
mov dword [ebp + 0x20], ebx
mov dword [ebp + 0x18], ebx
call fcn.0042c809
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x30], ebx
mov byte [ebp + 0x77], bl
call fcn.0042c809
lea ecx, [ebp - 0x50]
call fcn.0042c809
lea ecx, [ebp - 0x4c]
call fcn.0042c809
or dword [ebp - 0x68], 0xffffffff
lea ecx, [ebp - 0xd8]
mov byte [ebp + 0xf], bl
mov dword [ebp - 0x9c], ebx
call fcn.0042c809
xor eax, eax
push 0xf
pop ecx
mov dword [ebp - 0x210], 0x44
mov dword [ebp - 0x20c], ebx
lea edi, [ebp - 0x208]
rep stosd dword es:[edi], eax
push 0x11
mov dword [ebp - 0x108], ebx
pop ecx
lea edi, [ebp - 0x1cc]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x104]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
cmp esi, ebx
lea edi, [ebp - 0xf8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp + 0x54], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x6c], ebx
je 0x40691a
test byte [0x49a003], 3
je 0x406930
push 0x4814d8
lea ecx, [ebp - 0x6c]
call fcn.0043667e
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x208], eax
cmp esi, ebx
je 0x406945
cmp word [esi], 0x24
jne 0x406945
mov dword [ebp - 0x10], 1
mov byte [ebp + 0x4e], 1
xor ecx, ecx
inc ecx
cmp esi, ebx
push 2
mov dword [ebp - 0x40], ebx
pop edi
je 0x4069c6
cmp word [esi], 0x7c
jne 0x406960
add dword [ebp + 0x68], edi
add esi, edi
mov dword [ebp - 0x40], ecx
cmp esi, ebx
je 0x4069c6
cmp word [esi], 0x2a
jne 0x4069c6
add dword [ebp + 0x68], edi
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x7c
mov byte [ebp + 0x73], 0x10
jne 0x406980
add dword [ebp + 0x68], edi
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
cmp ax, 0x31
jne 0x406992
mov byte [ebp + 0x73], 0x11
jmp 0x4069ad
mov edx, eax
or edx, 0x20
cmp dx, 0x6e
jne 0x4069a3
mov byte [ebp + 0x73], 0x12
jmp 0x4069ad
cmp ax, 0x2d
jne 0x4069b0
mov byte [ebp + 0x73], 0x14
add dword [ebp + 0x68], edi
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
call fcn.00402a89
test al, al
jne 0x4069c6
mov ebx, ecx
jmp 0x409145
lea eax, [ebp + 0x68]
push eax
call fcn.00427312
cmp byte [ebp + 0x73], bl
pop ecx
jne 0x406a69
lea eax, [ebp + 0x68]
push eax
call fcn.00427312
cmp dword [ebp - 0x3c], ebx
mov eax, dword [ebp + 0x68]
pop ecx
mov dword [ebp + 0x58], eax
je 0x4069f7
cmp byte [ebp + 0x73], bl
jne 0x406b39
cmp word [eax], 0x2d
mov esi, eax
jne 0x406a0b
add eax, 2
cmp word [eax], 0x2d
jne 0x406a0b
mov dword [ebp + 0x58], eax
push 1
lea eax, [ebp + 0x58]
push eax
push 0x4814d4
call fcn.0042e2da
add esp, 0xc
test al, al
jne 0x406b39
mov eax, dword [ebp + 0x58]
mov ax, word [eax]
cmp ax, 0x2d
je 0x406a3c
cmp ax, 0x2f
jne 0x406b39
add dword [ebp + 0x58], edi
push 5
lea eax, [ebp + 0x58]
push eax
push str.catch
call fcn.0042e31d
add esp, 0xc
test al, al
je 0x406ae7
mov al, byte [ebp + 0x73]
or byte [ebp + 0x73], 0x10
cmp al, bl
jne 0x406cac
mov edi, dword [ebp + 0x68]
xor ecx, ecx
xor eax, eax
mov ax, word [edi]
inc ecx
cmp ax, bx
mov dword [ebp - 0x10], ecx
mov esi, edi
je 0x4069bf
push 2
pop edx
cmp ax, 0x3d
je 0x406a95
add esi, edx
mov ax, word [esi]
cmp ax, bx
jne 0x406a85
cmp esi, edi
je 0x4069bf
cmp word [esi], 0x3d
jne 0x4069bf
sub esi, edx
cmp word [esi], 0x2b
jne 0x406ab6
mov al, byte [esi]
mov byte [ebp - 0x17], al
sub esi, edx
cmp esi, edi
mov ecx, esi
jbe 0x406ace
mov ax, word [ecx]
call fcn.00402a89
test al, al
je 0x406ace
sub ecx, edx
cmp ecx, edi
ja 0x406abc
mov ax, word [ecx]
call fcn.00402a89
test al, al
jne 0x406d44
mov edx, ecx
inc ecx
inc ecx
jmp 0x406cd3
push 4
push dword [ebp + 0x58]
push str.cmd:
call fcn.00428263
add esp, 0xc
test al, al
je 0x406c2a
add dword [ebp + 0x58], 8
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp + 0x58]
push eax
push dword [ebp + 0x50]
call fcn.004037f6
add esp, 0x10
mov dword [ebp - 0x3c], eax
jmp 0x406b2b
mov word [esi], 0x20
add esi, edi
cmp esi, dword [ebp + 0x58]
jb 0x406b24
cmp byte [ebp + 0x73], bl
je 0x406cac
lea eax, [ebp + 0x68]
push eax
call fcn.00427312
mov eax, dword [ebp - 0x3c]
cmp eax, ebx
pop ecx
je 0x406b52
cmp word [eax], bx
jne 0x406b52
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x40], ebx
jne 0x406b5f
cmp dword [ebp + 0x7c], ebx
mov byte [ebp + 0x2f], bl
je 0x406b63
mov byte [ebp + 0x2f], 1
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp + 0x14], ebx
mov dword [ebp], ebx
call fcn.0042c809
lea ecx, [ebp - 0x5c]
call fcn.0042c809
lea ecx, [ebp - 0xb0]
call fcn.0042c809
cmp byte [ebp + 0x2f], bl
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x64], ebx
jne 0x406bbb
cmp dword [ebp - 8], ebx
jne 0x406bbb
mov ecx, dword [ebp + 0x50]
push 1
push ebx
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0x68]
call fcn.0043d8d6
mov eax, dword [ebp - 0x64]
mov dword [ebp + 0x68], eax
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x2d
mov edi, eax
jne 0x406bd2
add eax, 2
cmp word [eax], 0x2d
jne 0x406bd2
mov dword [ebp + 0x68], eax
push 1
lea eax, [ebp + 0x68]
push eax
push 0x4814d4
call fcn.0042e2da
add esp, 0xc
test al, al
jne 0x407555
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
cmp ax, 0x2d
je 0x406c03
cmp ax, 0x2f
jne 0x407555
push 2
pop esi
add dword [ebp + 0x68], esi
push 5
lea eax, [ebp + 0x68]
push eax
push str.catch
call fcn.0042e2da
add esp, 0xc
test al, al
je 0x406d4c
mov byte [ebp + 0x73], 0x10
jmp 0x406bbb
push 3
push dword [ebp + 0x58]
push 0x4814c0
call fcn.00428263
add esp, 0xc
test al, al
je 0x406c54
add dword [ebp + 0x58], 6
jmp 0x406c49
add dword [ebp + 0x58], edi
mov eax, dword [ebp + 0x58]
cmp word [eax], 0x2a
je 0x406c46
jmp 0x406c8a
push 4
push dword [ebp + 0x58]
push str.exe:
call fcn.00428263
add esp, 0xc
test al, al
je 0x406c70
add dword [ebp + 0x58], 8
jmp 0x406c8a
push 5
push dword [ebp + 0x58]
push str.logs:
call fcn.00428263
add esp, 0xc
test al, al
je 0x406cac
add dword [ebp + 0x58], 0xa
mov eax, dword [ebp + 0x58]
cmp word [eax], 0x22
jne 0x406cac
add dword [ebp + 0x58], edi
jmp 0x406ca1
add dword [ebp + 0x58], edi
cmp ax, 0x22
je 0x406cac
mov eax, dword [ebp + 0x58]
mov ax, word [eax]
cmp ax, bx
jne 0x406c98
lea eax, [ebp + 0x58]
push eax
call fcn.00403cc8
mov eax, dword [ebp + 0x58]
pop ecx
jmp 0x4069f7
lea eax, [edx - 2]
mov dword [ebp - 0x58], eax
mov ax, word [eax]
call fcn.00402a89
test al, al
jne 0x406cd7
mov edx, dword [ebp - 0x58]
cmp edx, edi
ja 0x406cbe
sub ecx, edx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x24]
call fcn.0042c92f
mov edi, dword [ebp + 0x50]
push ebx
lea eax, [ebp - 0x24]
push eax
mov ecx, edi
call fcn.00402b15
cmp byte [edi + 0x8a], bl
jne 0x406d02
test byte [edi + 0xb], 0xf
je 0x406d18
push ebx
lea eax, [ebp - 0x24]
push eax
mov ecx, edi
call fcn.00402b15
jmp 0x406d18
cmp ax, 0x3d
je 0x406d26
inc esi
inc esi
mov ax, word [esi]
cmp ax, bx
jne 0x406d10
cmp ax, 0x3d
jne 0x406d44
lea eax, [ebp - 0x9c]
add esi, 2
push eax
mov dword [ebp - 0x9c], esi
call fcn.00427312
pop ecx
push 2
pop edi
jmp 0x4069d9
xor ebx, ebx
inc ebx
jmp 0x409145
push 6
push dword [ebp + 0x68]
push str.clone:
call fcn.00428263
add esp, 0xc
test al, al
je 0x406d8c
add dword [ebp + 0x68], 0xc
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403c83
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
pop ecx
je 0x406d82
mov word [eax], bx
add dword [ebp + 0x68], 2
cmp word [esi], bx
je 0x406dc4
mov dword [ebp + 0x54], esi
jmp 0x406dc4
push 9
push dword [ebp + 0x68]
push str.runrmenu:
call fcn.00428263
add esp, 0xc
test al, al
je 0x406dd2
add dword [ebp + 0x68], 0x12
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403c83
mov eax, dword [ebp + 0x68]
pop ecx
lea ecx, [ebp - 0x80]
sub eax, esi
sar eax, 1
push eax
push esi
call fcn.0042c92f
lea eax, [ebp + 0x68]
push eax
call fcn.00427312
jmp 0x40754f
push 8
push dword [ebp + 0x68]
push str.poprmenu
call fcn.00428263
add esp, 0xc
test al, al
je 0x406e82
add dword [ebp + 0x68], 0x10
mov eax, dword [ebp + 0x68]
mov dword [ebp + 0x24], eax
lea eax, [ebp + 0x68]
push eax
call fcn.00403c83
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
pop ecx
je 0x406e0b
add dword [ebp + 0x68], esi
lea eax, [ebp + 0x68]
push eax
call fcn.00427312
pop ecx
lea eax, [ebp - 0xb8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp + 0x24]
mov ax, word [eax]
cmp ax, bx
mov byte [ebp - 0x15], 1
je 0x406e40
cmp ax, 0x30
jb 0x406e3d
cmp ax, 0x39
jbe 0x406e40
add dword [ebp + 0x24], esi
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp + 0x24]
push eax
call fcn.0042f0d0
mov eax, dword [ebp + 0x24]
mov ax, word [eax]
cmp ax, bx
pop ecx
pop ecx
je 0x406e6c
cmp ax, 0x30
jb 0x406e69
cmp ax, 0x39
jbe 0x406e6c
add dword [ebp + 0x24], esi
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp + 0x24]
push eax
call fcn.0042f0d0
pop ecx
jmp 0x40754f
push 4
pop esi
push esi
push dword [ebp + 0x68]
push str.pid:
call fcn.00428263
add esp, 0xc
test al, al
je 0x406ec1
add dword [ebp + 0x68], 8
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403c83
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x406dc4
lea ecx, [ebp - 0x98]
jmp 0x406db9
push esi
push dword [ebp + 0x68]
push str.exe:
call fcn.00428263
add esp, 0xc
test al, al
je 0x406f1a
add dword [ebp + 0x68], 8
mov eax, dword [ebp + 0x68]
mov dword [ebp - 4], eax
push 1
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 4]
push eax
mov dword [ebp + 0x10], ebx
call fcn.00413796
add esp, 0xc
cmp dword [ebp + 0x10], ebx
mov dword [ebp + 0x68], eax
jle 0x406dc4
push dword [ebp + 0x10]
lea ecx, [ebp - 0x60]
push dword [ebp - 4]
call fcn.0042c92f
mov eax, dword [ebp - 0x60]
mov dword [ebp + 0x14], eax
jmp 0x406dc4
push 3
push dword [ebp + 0x68]
push 0x4814c0
call fcn.00428263
add esp, 0xc
test al, al
je 0x406ff6
mov eax, dword [ebp + 0x68]
xor esi, esi
add eax, 6
jmp 0x406f41
inc esi
inc eax
inc eax
mov dword [ebp + 0x68], eax
cmp word [eax], 0x2a
je 0x406f3e
cmp esi, 2
mov dword [ebp + 8], eax
mov dword [ebp + 0x48], ebx
jge 0x406fbc
push 1
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp + 8]
push eax
call fcn.00413796
add esp, 0xc
cmp dword [ebp + 0x48], ebx
mov dword [ebp + 0x68], eax
jle 0x406f83
push dword [ebp + 0x48]
lea ecx, [ebp - 0x28]
push dword [ebp + 8]
call fcn.0042c92f
mov eax, dword [ebp - 0x28]
mov dword [ebp], eax
cmp esi, 1
jne 0x406dc4
cmp dword [ebp + 0x48], ebx
jle 0x406dc4
mov eax, dword [ebp - 0x28]
push esi
lea ecx, [ebp - 0x28]
push ecx
push eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x28], ebx
call fcn.004350b7
add esp, 0xc
lea ecx, [ebp - 0x58]
mov dword [ebp], eax
call fcn.00427365
jmp 0x406dc4
push 0x105
lea ecx, [ebp - 0x28]
call fcn.0042c850
push 0x104
push dword [ebp - 0x28]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push ebx
push dword [ebp - 0x28]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
je 0x406feb
mov word [eax], bx
mov eax, dword [ebp - 0x28]
mov dword [ebp], eax
jmp 0x406dc4
push 5
push dword [ebp + 0x68]
push str.logs:
call fcn.00428263
add esp, 0xc
test al, al
je 0x40706f
mov eax, dword [ebp + 0x68]
add eax, 0xa
xor ecx, ecx
mov dword [ebp + 0x68], eax
mov dword [ebp - 4], eax
cmp word [eax], 0x3f
sete cl
mov esi, ecx
cmp esi, ebx
je 0x40702d
add eax, 2
mov dword [ebp - 4], eax
mov edi, eax
push 1
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp - 4]
push eax
mov dword [ebp + 0x38], ebx
call fcn.00413796
add esp, 0xc
cmp dword [ebp + 0x38], ebx
mov dword [ebp + 0x68], eax
jle 0x406dc4
cmp esi, ebx
je 0x407060
cmp dword [0x496de4], ebx
je 0x406dc4
push dword [ebp + 0x38]
lea ecx, [ebp - 0xac]
push edi
jmp 0x406dbf
push 5
lea eax, [ebp + 0x68]
push eax
push str.nowin
call fcn.0042e2da
add esp, 0xc
test al, al
je 0x40708f
mov byte [ebp - 0x19], 1
jmp 0x406bbb
push esi
lea eax, [ebp + 0x68]
push eax
push 0x481478
call fcn.0042e2da
add esp, 0xc
test al, al
je 0x4070b1
mov dword [ebp + 0x20], 0x10000000
jmp 0x406bbb
push esi
lea eax, [ebp + 0x68]
push eax
push 0x481470
call fcn.0042e2da
add esp, 0xc
test al, al
je 0x4070d3
mov dword [ebp - 0x10], 1
jmp 0x406bbb
push 3
lea eax, [ebp + 0x68]
push eax
push 0x48146c
call fcn.0042e2da
add esp, 0xc
test al, al
je 0x4070f3
or byte [ebp + 0x4d], 1
jmp 0x406bbb
push esi
lea eax, [ebp + 0x68]
push eax
push str.err
call fcn.0042e2da
add esp, 0xc
test al, al
je 0x407112
or byte [ebp + 0x4d], 3
jmp 0x406bbb
push 5
lea eax, [ebp + 0x68]
push eax
push str.limit
call fcn.0042e2da
add esp, 0xc
test al, al
je 0x407132
mov byte [ebp - 0x18], 1
jmp 0x406bbb
push 3
lea eax, [ebp + 0x68]
push eax
push 0x481458
call fcn.0042e2da
add esp, 0xc
test al, al
je 0x407152
mov byte [ebp + 0x4f], 1
jmp 0x406bbb
push esi
lea eax, [ebp + 0x68]
push eax
push str.hook
call fcn.0042e2da
add esp, 0xc
test al, al
je 0x407171
mov byte [ebp + 0x4e], 1
jmp 0x406bbb
push 3
lea eax, [ebp + 0x68]
push eax
push 0x48144c
call fcn.0042e2da
add esp, 0xc
test al, al
je 0x407194
mov dword [ebp + 0x20], 6
jmp 0x406bbb
push 3
lea eax, [ebp + 0x68]
push eax
push 0x481448
call fcn.0042e2da
add esp, 0xc
test al, al
je 0x4071b7
mov dword [ebp + 0x20], 3
jmp 0x406bbb
push esi
lea eax, [ebp + 0x68]
push eax
push str.show
call fcn.0042e2da
add esp, 0xc
test al, al
je 0x4071d9
mov dword [ebp + 0x20], 1
jmp 0x406bbb
push esi
lea eax, [ebp + 0x68]
push eax
push 0x481438
call fcn.0042e2da
add esp, 0xc
test al, al
je 0x4071f8
mov byte [ebp - 0x1b], 1
jmp 0x406bbb
push esi
lea eax, [ebp + 0x68]
push eax
push str.no64
call fcn.0042e2da
add esp, 0xc
test al, al
je 0x407216
mov byte [ebp - 0x16], bl
jmp 0x406bbb
push 3
lea eax, [ebp + 0x68]
push eax
push 0x48142c
call fcn.0042e2da
add esp, 0xc
test al, al
je 0x407236
mov byte [ebp - 0x1a], 1
jmp 0x406bbb
push 3
push dword [ebp + 0x68]
push 0x481428
call fcn.00428263
add esp, 0xc
test al, al
je 0x407285
add dword [ebp + 0x68], 6
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x3a
mov byte [ebp + 0x3f], 1
jne 0x406dc4
add dword [ebp + 0x68], 2
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403c83
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x406dc4
lea ecx, [ebp - 0x5c]
jmp 0x406db9
push 5
push dword [ebp + 0x68]
push str.code:
call fcn.00428263
add esp, 0xc
test al, al
je 0x40733a
add dword [ebp + 0x68], 0xa
mov eax, dword [ebp + 0x68]
mov dword [ebp + 0x40], eax
push 0xffffffffffffffff
lea eax, [ebp + 0x40]
push eax
push str.UTF8
call fcn.0042e2da
add esp, 0xc
test al, al
je 0x4072d0
mov byte [ebp + 0x77], 1
mov dword [ebp - 0x30], 0xfde9
jmp 0x407546
push 0xffffffffffffffff
lea eax, [ebp + 0x40]
push eax
push str.ANSI
call fcn.0042e2da
add esp, 0xc
test al, al
je 0x4072f3
mov byte [ebp + 0x77], 1
mov dword [ebp - 0x30], ebx
jmp 0x407546
push 0xffffffffffffffff
lea eax, [ebp + 0x40]
push eax
push 0x48140c
call fcn.0042e2da
add esp, 0xc
test al, al
je 0x40731a
mov byte [ebp + 0x77], 2
mov dword [ebp - 0x30], 0x4b0
jmp 0x407546
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp + 0x40]
push eax
call fcn.0042f0d0
test eax, eax
pop ecx
pop ecx
jle 0x407546
mov byte [ebp + 0x77], 1
jmp 0x407546
push 5
push dword [ebp + 0x68]
push str.user:
call fcn.00428263
add esp, 0xc
test al, al
je 0x407374
add dword [ebp + 0x68], 0xa
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403c83
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x406dc4
lea ecx, [ebp - 0x50]
jmp 0x406db9
push 7
push dword [ebp + 0x68]
push str.passwd:
call fcn.00428263
add esp, 0xc
test al, al
je 0x40738f
mov byte [ebp + 0xf], bl
jmp 0x4073a9
push 7
push dword [ebp + 0x68]
push str.passwd
call fcn.00428263
add esp, 0xc
test al, al
je 0x4073cd
mov byte [ebp + 0xf], 1
add dword [ebp + 0x68], 0xe
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403c83
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x406dc4
lea ecx, [ebp - 0x4c]
jmp 0x406db9
push 8
lea eax, [ebp + 0x68]
push eax
push str.REALTIME
call fcn.0042e2da
add esp, 0xc
test al, al
je 0x4073f0
mov dword [ebp + 0x18], 0x100
jmp 0x406bbb
push esi
lea eax, [ebp + 0x68]
push eax
push str.HIGH
call fcn.0042e2da
add esp, 0xc
test al, al
je 0x407412
mov dword [ebp + 0x18], 0x80
jmp 0x406bbb
push 0xb
lea eax, [ebp + 0x68]
push eax
push str.ABOVENORMAL
call fcn.0042e2da
add esp, 0xc
test al, al
je 0x407435
mov dword [ebp + 0x18], 0x8000
jmp 0x406bbb
push 6
lea eax, [ebp + 0x68]
push eax
push str.NORMAL
call fcn.0042e2da
add esp, 0xc
test al, al
je 0x407458
mov dword [ebp + 0x18], 0x20
jmp 0x406bbb
push 0xb
lea eax, [ebp + 0x68]
push eax
push str.BELOWNORMAL
call fcn.0042e2da
add esp, 0xc
test al, al
je 0x40747b
mov dword [ebp + 0x18], 0x4000
jmp 0x406bbb
push 3
lea eax, [ebp + 0x68]
push eax
push 0x4813bc
call fcn.0042e2da
add esp, 0xc
test al, al
jne 0x4074cb
mov esi, dword [ebp + 0x68]
push 4
push esi
push 0x4813b0
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x4074d7
xor ecx, ecx
mov cx, word [esi + 8]
mov eax, ecx
call fcn.00402a89
test al, al
jne 0x4074bd
cmp cx, bx
jne 0x4074d7
add dword [ebp + 0x68], 8
lea eax, [ebp + 0x68]
push eax
call fcn.00427312
pop ecx
mov dword [ebp + 0x18], 0x40
jmp 0x406bbb
push 3
lea eax, [ebp + 0x68]
push eax
push 0x4813ac
call fcn.0042e2da
add esp, 0xc
test al, al
je 0x4074f7
mov byte [ebp + 0x33], 1
jmp 0x406bbb
push 3
lea eax, [ebp + 0x68]
push eax
push 0x4813a8
call fcn.0042e2da
add esp, 0xc
test al, al
je 0x40751d
mov byte [ebp + 7], 1
mov byte [ebp + 0x77], bl
mov dword [ebp - 0x30], ebx
jmp 0x406bbb
push 3
lea eax, [ebp + 0x68]
push eax
push 0x4813a4
call fcn.0042e2da
add esp, 0xc
test al, al
je 0x40753d
mov byte [ebp - 0x1c], 1
jmp 0x406bbb
cmp word [edi], 0x2d
mov dword [ebp + 0x68], edi
jne 0x407555
lea eax, [ebp + 0x68]
push eax
call fcn.00403cc8
pop ecx
jmp 0x406bbb
cmp dword [ebp - 0x30], 0x4b0
jne 0x407562
mov byte [ebp + 0x77], 2
mov eax, dword [ebp - 0x9c]
cmp eax, ebx
je 0x40758f
cmp byte [ebp + 0x2f], bl
mov dword [ebp + 0x68], eax
jne 0x40758f
cmp dword [ebp - 8], ebx
jne 0x40758f
push 1
push ebx
lea ecx, [ebp - 0x64]
push ecx
mov ecx, dword [ebp + 0x50]
push eax
call fcn.0043d8d6
mov eax, dword [ebp - 0x64]
mov dword [ebp + 0x68], eax
mov eax, dword [ebp + 0x14]
cmp eax, ebx
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0x44], ebx
je 0x4075b0
cmp word [eax], bx
jne 0x4075b3
mov byte [ebp + 0x33], bl
cmp byte [ebp + 0x33], bl
je 0x4075e1
push 0x2a
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
mov dword [ebp - 0x44], eax
je 0x4075d0
mov word [eax], bx
inc eax
inc eax
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0xe8]
push eax
push dword [ebp + 0x14]
call fcn.0040f0ce
pop ecx
pop ecx
mov eax, dword [ebp + 0x78]
xor ecx, ecx
inc ecx
mov dword [eax], ecx
xor eax, eax
lea edi, [ebp - 0xc8]
mov dword [ebp - 0xcc], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x130], ebx
lea edi, [ebp - 0x12c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
cmp dword [ebp + 0x54], ebx
mov dword [ebp - 0x70], ebx
setne al
cmp byte [ebp + 0x2f], bl
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp + 0x24], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp + 0x44], eax
mov dword [ebp - 0x114], 0xc
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0xa4], ebx
je 0x407a46
mov ecx, dword [ebp + 0x68]
cmp word [ecx], 0x7c
mov dword [ebp + 0x38], ebx
jne 0x40767b
inc ecx
inc ecx
xor eax, eax
mov dword [ebp + 0x68], ecx
mov ax, word [ecx]
cmp ax, 0x7c
je 0x407662
call fcn.00402a89
test al, al
jne 0x407662
mov dword [ebp + 0x10], ecx
push 0x7c
push ebx
push dword [ebp + 0x68]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
mov dword [ebp + 0x5c], eax
je 0x4076b8
mov word [eax], bx
add dword [ebp + 0x5c], 2
lea eax, [ebp + 0x5c]
push eax
call fcn.00427312
mov eax, dword [ebp + 0x5c]
cmp word [eax], bx
pop ecx
je 0x40767e
mov ecx, dword [ebp + 0x10]
cmp word [ecx], bx
mov dl, 1
je 0x4076ba
mov cl, dl
jmp 0x4076c6
xor dl, dl
xor cl, cl
cmp dl, bl
jne 0x4076c6
mov eax, dword [ebp + 0x10]
mov dword [ebp + 0x5c], eax
cmp cl, bl
mov dword [ebp + 8], eax
je 0x407784
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
push ebx
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x20]
push eax
xor edi, edi
lea eax, [ebp - 0x2c]
inc edi
push eax
mov dword [ebp - 0x90], 0xc
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x88], edi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x407715
mov ecx, dword [ebp + 0x50]
push edi
call fcn.0040b816
mov edi, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 3
push ebx
push ebx
lea eax, [ebp - 0x2c]
push eax
push esi
push dword [ebp - 0x2c]
push esi
call edi
cmp dword [ebp - 0x20], ebx
mov word [ebp + 0x2e], bx
je 0x407756
push dword [ebp - 0x20]
mov ecx, dword [ebp + 0x50]
push ebx
push ebx
lea eax, [ebp + 0x2e]
push eax
push ecx
push dword [ebp + 0x10]
call fcn.004067ac
cmp dword [ebp - 0x20], ebx
je 0x407756
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 3
push 1
push ebx
lea eax, [ebp - 0x2c]
push eax
push esi
push dword [ebp - 0x2c]
mov dword [ebp - 0x20], ebx
push esi
call edi
mov ecx, dword [ebp - 0x2c]
cmp ecx, ebx
je 0x407784
lea eax, [ebp - 0x210]
or byte [eax + 0x2d], 1
mov dword [ebp + 0x44], 1
mov dword [eax + 0x38], ecx
mov eax, dword [ebp + 8]
mov dword [ebp + 0x5c], eax
xor edi, edi
inc edi
mov cx, word [eax]
cmp cx, bx
je 0x4079e2
cmp cx, 0x3c
je 0x4077b2
cmp cx, 0x3e
je 0x4077b2
inc eax
inc eax
mov dword [ebp + 0x5c], eax
mov cx, word [eax]
cmp cx, bx
jne 0x407799
mov cx, word [eax]
cmp cx, bx
je 0x4079e2
cmp cx, 0x3c
jne 0x40788d
mov word [eax], bx
add dword [ebp + 0x5c], 2
lea eax, [ebp + 0x5c]
push eax
call fcn.00427312
mov eax, dword [ebp + 0x5c]
cmp word [eax], bx
pop ecx
je 0x40788d
mov dword [ebp + 0x40], eax
jmp 0x4077fb
cmp cx, 0x3c
je 0x407803
cmp cx, 0x3e
je 0x407803
inc eax
inc eax
mov dword [ebp + 0x5c], eax
mov cx, word [eax]
cmp cx, bx
jne 0x4077ea
sub eax, dword [ebp + 0x40]
lea ecx, [ebp + 0x34]
sar eax, 1
push eax
push dword [ebp + 0x40]
call fcn.004365d7
lea ecx, [ebp + 0x10]
call fcn.0042c809
mov ecx, dword [ebp + 0x50]
push edi
push ebx
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x40]
call fcn.0043d8d6
mov eax, dword [ebp + 0x10]
push eax
mov dword [ebp + 0x40], eax
call fcn.0040b35a
lea eax, [ebp + 0x40]
push eax
call fcn.00427312
cmp dword [ebp - 0xc], ebx
pop ecx
pop ecx
je 0x407852
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
push 3
lea eax, [ebp - 0x114]
push eax
push 7
push 0xc0000000
push dword [ebp + 0x40]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
call fcn.00403ce4
cmp dword [ebp - 0xc], ebx
jne 0x40787a
mov dword [ebp - 0xc], ebx
lea ecx, [ebp + 0x10]
call fcn.00427365
lea ecx, [ebp + 0x34]
call fcn.00427365
mov eax, dword [ebp + 0x5c]
cmp word [eax], 0x3e
jne 0x40778d
mov word [eax], bx
mov eax, dword [ebp + 0x5c]
xor esi, esi
cmp word [eax - 2], 0x32
mov byte [ebp + 0x2f], 1
jne 0x4078b2
mov byte [ebp + 0x2f], 2
mov word [eax - 2], bx
add dword [ebp + 0x5c], 2
mov eax, dword [ebp + 0x5c]
cmp word [eax], 0x3e
jne 0x4078c5
add dword [ebp + 0x5c], 2
mov esi, edi
mov eax, dword [ebp + 0x5c]
cmp word [eax], 0x26
jne 0x4078d6
add dword [ebp + 0x5c], 2
mov byte [ebp + 0x2f], 3
lea eax, [ebp + 0x5c]
push eax
call fcn.00427312
mov eax, dword [ebp + 0x5c]
cmp word [eax], bx
pop ecx
je 0x40778d
mov dword [ebp + 0x48], eax
jmp 0x407902
cmp cx, 0x3c
je 0x40790a
cmp cx, 0x3e
je 0x40790a
inc eax
inc eax
mov dword [ebp + 0x5c], eax
mov cx, word [eax]
cmp cx, bx
jne 0x4078f1
sub eax, dword [ebp + 0x48]
lea ecx, [ebp - 4]
sar eax, 1
push eax
push dword [ebp + 0x48]
call fcn.004365d7
lea ecx, [ebp + 0x1c]
call fcn.0042c809
mov ecx, dword [ebp + 0x50]
push edi
push ebx
lea eax, [ebp + 0x1c]
push eax
push dword [ebp + 0x48]
call fcn.0043d8d6
mov eax, dword [ebp + 0x1c]
push eax
mov dword [ebp + 0x48], eax
call fcn.0040b35a
lea eax, [ebp + 0x48]
push eax
call fcn.00427312
test byte [ebp + 0x2f], 1
pop ecx
pop ecx
je 0x407962
cmp dword [ebp - 0x14], ebx
je 0x40795f
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x14], ebx
test byte [ebp + 0x2f], 2
je 0x40797c
cmp dword [ebp + 0x24], ebx
je 0x407976
push dword [ebp + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x38], ebx
push ebx
push ebx
push 4
lea eax, [ebp - 0x114]
push eax
push 7
push 0x40000000
push dword [ebp + 0x48]
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x54], ebx
call fcn.00403ce4
mov edi, eax
cmp edi, ebx
jne 0x4079ba
lea ecx, [ebp + 0x1c]
call fcn.00427365
lea ecx, [ebp - 4]
call fcn.00427365
mov eax, dword [ebp + 0x5c]
jmp 0x40778a
cmp esi, ebx
je 0x4079c9
push 2
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [ebp + 0x2f], 1
jne 0x4079d4
mov dword [ebp - 0x14], edi
jmp 0x4079a2
cmp byte [ebp + 0x2f], 3
mov dword [ebp + 0x38], edi
je 0x4079cf
mov dword [ebp + 0x24], edi
jmp 0x4079a2
mov ecx, dword [ebp - 0xc]
cmp ecx, ebx
mov edx, 0x100
je 0x4079fd
lea eax, [ebp - 0x210]
or dword [eax + 0x2c], edx
mov dword [ebp + 0x44], edi
mov dword [eax + 0x38], ecx
mov ecx, dword [ebp - 0x14]
cmp ecx, ebx
je 0x407a13
lea eax, [ebp - 0x210]
or dword [eax + 0x2c], edx
mov dword [ebp + 0x44], edi
mov dword [eax + 0x3c], ecx
mov ecx, dword [ebp + 0x38]
cmp ecx, ebx
je 0x407a29
lea eax, [ebp - 0x210]
or dword [eax + 0x2c], edx
mov dword [ebp + 0x44], edi
mov dword [eax + 0x40], ecx
mov ecx, dword [ebp + 0x50]
push edi
push ebx
lea eax, [ebp - 0xa4]
push eax
push dword [ebp + 8]
call fcn.0043d8d6
mov eax, dword [ebp - 0xa4]
mov dword [ebp + 0x68], eax
push 6
pop edi
mov esi, 0x10000000
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
cmp ax, 0x21
je 0x407a82
cmp ax, 0x2a
je 0x407a82
cmp ax, 0x40
jne 0x407a8b
push str.WinSta0WinLogon
lea ecx, [ebp - 0x6c]
call fcn.0043667e
mov ecx, dword [ebp - 0x6c]
inc byte [ebp + 0x2b]
lea eax, [ebp - 0x210]
mov dword [eax + 8], ecx
mov dword [ebp + 0x20], esi
add dword [ebp + 0x68], 2
jmp 0x407a4e
cmp ax, 0x3d
jne 0x407a9a
mov dword [ebp - 0x10], 1
jmp 0x407a85
cmp ax, 0x24
jne 0x407aa6
mov byte [ebp + 0x3f], 1
jmp 0x407a85
cmp ax, 0x26
jne 0x407ab5
mov dword [ebp + 0x20], 3
jmp 0x407a85
cmp ax, 0x5e
jne 0x407ac0
mov dword [ebp + 0x20], edi
jmp 0x407a85
cmp ax, 0x5f
je 0x407abb
lea edi, [ebp - 0x210]
cmp dword [edi + 8], ebx
je 0x407ae4
test byte [ebp + 0x2b], 1
je 0x407ae4
call fcn.00403794
cmp eax, 1
jge 0x407ae4
mov dword [edi + 8], ebx
mov eax, dword [ebp + 0x7c]
cmp eax, ebx
je 0x407aff
or byte [edi + 0x2d], 1
mov dword [ebp - 0x10], ebx
mov byte [ebp + 0x73], bl
mov dword [ebp + 0x44], 1
mov dword [edi + 0x3c], eax
cmp byte [ebp + 0x3f], bl
je 0x407b19
mov eax, dword [ebp - 0x5c]
cmp word [eax], bx
jne 0x407b19
push 0x481374
lea ecx, [ebp - 0x5c]
call fcn.00436622
mov eax, dword [ebp + 0x20]
cmp eax, esi
je 0x407b25
cmp byte [ebp - 0x1c], bl
je 0x407b29
or byte [edi + 0x2c], 0x80
cmp eax, ebx
je 0x407b35
or dword [edi + 0x2c], 1
mov word [edi + 0x30], ax
mov al, byte [ebp + 0x2b]
and al, 3
cmp al, 3
je 0x407b43
cmp byte [ebp - 0x19], bl
je 0x407b47
or byte [edi + 0x2f], 8
cmp byte [ebp - 0x1b], bl
je 0x407b98
push 0x5c
push dword [ebp + 0x68]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edi, eax
cmp edi, ebx
je 0x407b61
inc edi
inc edi
jmp 0x407b64
mov edi, dword [ebp + 0x68]
push dword [ebp + 0x68]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push dword [ebp + 0x68]
xor eax, eax
cmp dword [ebp - 0x10], ebx
push 1
setne al
push edi
push 0x481318
add eax, 0x80000001
push eax
call fcn.004280f8
add esp, 0x18
mov ebx, eax
jmp 0x40909e
lea eax, [ebp + 0x68]
push eax
call fcn.00427312
cmp dword [ebp + 0x54], ebx
pop ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x84], ebx
je 0x407c45
lea ecx, [ebp + 0x2c]
mov byte [ebp + 0x3f], bl
call fcn.0042c809
mov ecx, dword [ebp + 0x50]
push 0xffffffffffffffff
push ebx
push dword [ebp + 0x54]
call fcn.0040f2f5
cmp eax, ebx
je 0x407c33
mov ecx, dword [eax]
cmp word [ecx], bx
je 0x407c33
push eax
lea ecx, [ebp + 0x2c]
call fcn.00436650
push dword [ebp + 0x68]
lea ecx, [ebp - 0x84]
call fcn.0043667e
push dword [ebp - 0xac]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 0x2c]
call fcn.00406560
mov edi, eax
mov eax, dword [ebp - 0x60]
mov dword [ebp + 0x14], eax
mov eax, dword [ebp - 0x84]
add esp, 0x14
lea ecx, [ebp + 0x2c]
mov dword [ebp + 0x68], eax
call fcn.00427365
cmp edi, ebx
je 0x407c45
mov ebx, edi
jmp 0x40908b
lea ecx, [ebp + 0x2c]
call fcn.00427365
mov ebx, 0x80070057
jmp 0x40908b
mov eax, dword [ebp - 0x80]
cmp word [eax], bx
je 0x407c90
push dword [ebp + 0x68]
call fcn.0040d003
pop ecx
push eax
lea ecx, [ebp + 0x70]
mov dword [ebp + 0x68], eax
call fcn.004365ba
push 0x481314
lea ecx, [ebp + 0x70]
call fcn.0042c877
push dword [ebp - 0x80]
lea ecx, [ebp + 0x70]
call fcn.0042c877
mov ecx, dword [ebp + 0x50]
push ebx
push dword [ebp + 0x70]
call fcn.0043be44
mov ebx, eax
lea ecx, [ebp + 0x70]
jmp 0x409086
cmp byte [ebp - 0x15], bl
je 0x407ddb
lea ecx, [ebp + 0x7c]
call fcn.0042c809
push dword [ebp + 0x68]
mov dword [ebp + 0x70], ebx
call fcn.0040d003
pop ecx
lea ecx, [ebp + 0x78]
mov dword [ebp + 0x68], eax
call fcn.0042c809
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x78]
push eax
push dword [ebp + 0x68]
mov dword [ebp + 0x1c], ebx
call fcn.004350b7
mov eax, dword [ebp + 0x1c]
add esp, 0xc
cmp eax, ebx
jne 0x407ce5
lea ecx, [ebp + 0x78]
call fcn.00427365
lea ecx, [ebp + 0x7c]
jmp 0x407c36
mov word [eax - 2], bx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push dword [ebp + 0x78]
lea ecx, [ebp + 0x54]
mov edi, eax
call fcn.004365ba
push dword [ebp + 0x1c]
mov esi, dword [ebp + 0x54]
lea ecx, [ebp + 0x6c]
call fcn.004365ba
push edi
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp + 0x70]
push eax
push dword [ebp + 0x6c]
push esi
call fcn.004051b9
add esp, 0x14
cmp dword [ebp + 0x70], ebx
jle 0x407d5f
mov eax, dword [ebp + 0x50]
mov eax, dword [eax + 0x2c]
xor esi, esi
cmp eax, ebx
je 0x407d33
mov esi, dword [eax + 0x18]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebx
push esi
push ebx
push dword [ebp - 0xb4]
push dword [ebp - 0xb8]
push 0x128
push edi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
push edi
call dword [sym.imp.USER32.dll_DestroyMenu]
cmp dword [ebp + 0x70], ebx
jle 0x407dbb
mov esi, dword [ebp + 0x7c]
lea eax, [ebp + 0x70]
mov dword [ebp + 0x70], esi
call fcn.00403ca7
mov eax, dword [ebp + 0x70]
mov word [eax], bx
cmp word [esi], bx
je 0x407dbb
push dword [ebp + 0x68]
lea ecx, [ebp + 0x74]
call fcn.004365ba
push 0x481314
lea ecx, [ebp + 0x74]
call fcn.0042c877
push esi
lea ecx, [ebp + 0x74]
call fcn.0042c877
mov ecx, dword [ebp + 0x50]
push ebx
push dword [ebp + 0x74]
call fcn.0043be44
lea ecx, [ebp + 0x74]
mov ebx, eax
call fcn.00427365
lea ecx, [ebp + 0x6c]
call fcn.00427365
lea ecx, [ebp + 0x54]
call fcn.00427365
lea ecx, [ebp + 0x78]
call fcn.00427365
lea ecx, [ebp + 0x7c]
jmp 0x409086
push dword [ebp + 0x68]
lea ecx, [ebp - 0xbc]
call fcn.004365ba
cmp byte [0x496d58], bl
mov eax, dword [ebp - 0xbc]
mov edi, dword [ebp + 0x6c]
mov dword [ebp + 0x68], eax
mov esi, 0x496eb8
jne 0x407e1a
cmp edi, ebx
je 0x407e0b
cmp byte [edi + 0xa], bl
jne 0x407e1a
cmp byte [ebp - 0x1a], bl
mov byte [ebp + 0x7f], bl
je 0x407e1e
cmp edi, ebx
je 0x407e1e
mov esi, dword [edi + 0x28]
mov byte [ebp + 0x7f], 1
push ebx
lea ecx, [ebp + 0x10]
call fcn.004365ba
cmp byte [ebp + 0x7f], bl
mov dword [ebp + 0x5c], ebx
je 0x40809a
push 0x4975e4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
lea ecx, [ebp - 0x2a4]
call fcn.0040f2ae
cmp edi, ebx
je 0x407e5b
push esi
push edi
lea ecx, [ebp - 0x2a4]
call fcn.004291e4
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edi, eax
push 0x106
lea ecx, [ebp + 0x38]
mov dword [ebp + 0x34], edi
call fcn.0042c827
mov eax, dword [ebp + 0x38]
mov dword [ebp + 0x6c], eax
jmp 0x407ef3
mov dword [ebp + 0x7c], edi
jmp 0x407e86
cmp ax, 0x3d
je 0x407e90
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x407e80
mov esi, edi
sub esi, dword [ebp + 0x7c]
sar esi, 1
cmp word [edi], bx
je 0x407ef1
cmp word [edi + 2], bx
je 0x407eec
cmp esi, 0x104
jg 0x407eec
push esi
push dword [ebp + 0x7c]
push dword [ebp + 0x6c]
call fcn.00403c6b
mov eax, dword [ebp + 0x6c]
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x2a4]
mov word [eax + esi*2], bx
call fcn.0040b0e9
test eax, eax
jne 0x407eec
push 0xffffffffffffffff
push esi
lea eax, [edi + 2]
push eax
push dword [ebp + 0x7c]
lea ecx, [ebp - 0x2a4]
call fcn.0040b04c
jmp 0x407eec
inc edi
inc edi
cmp word [edi], bx
jne 0x407eea
inc edi
inc edi
cmp word [edi], bx
jne 0x407e7b
push dword [ebp + 0x34]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, dword [ebp - 0x2a0]
xor esi, esi
cmp eax, ebx
mov dword [ebp + 0x6c], eax
mov dword [ebp + 0x7c], ebx
jle 0x407fa5
mov eax, dword [ebp + 0x7c]
mov dword [ebp - 8], eax
inc eax
cmp eax, dword [ebp + 0x6c]
mov dword [ebp - 0x54], eax
mov dword [ebp + 0x48], eax
jge 0x407f96
mov eax, dword [ebp + 0x7c]
shl eax, 2
mov dword [ebp + 0x34], eax
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x2a4]
mov ecx, dword [ebp + 8]
mov ecx, dword [eax + ecx]
mov edi, dword [ebp + 0x48]
mov ecx, dword [ecx]
shl edi, 2
mov eax, dword [edi + eax]
mov eax, dword [eax]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jge 0x407f65
mov ecx, dword [ebp + 0x48]
mov dword [ebp - 8], ecx
mov dword [ebp + 8], edi
jmp 0x407f68
mov ecx, dword [ebp - 8]
inc dword [ebp + 0x48]
mov eax, dword [ebp + 0x48]
cmp eax, dword [ebp + 0x6c]
jl 0x407f35
cmp ecx, dword [ebp + 0x7c]
je 0x407f96
mov edx, dword [ebp - 0x2a4]
mov eax, dword [ebp + 0x34]
add eax, edx
mov edi, dword [eax]
shl ecx, 2
mov edx, dword [ecx + edx]
mov dword [eax], edx
mov eax, dword [ebp - 0x2a4]
mov dword [ecx + eax], edi
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp + 0x6c]
mov dword [ebp + 0x7c], eax
jl 0x407f17
cmp dword [ebp + 0x6c], ebx
mov dword [ebp + 0x7c], ebx
jle 0x407fe7
mov eax, dword [ebp - 0x2a4]
mov ecx, dword [ebp + 0x7c]
mov eax, dword [eax + ecx*4]
push dword [eax]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call edi
mov ecx, dword [ebp + 0x7c]
lea esi, [esi + eax + 1]
mov eax, dword [ebp - 0x2a4]
mov eax, dword [eax + ecx*4]
push dword [eax + 4]
call edi
inc dword [ebp + 0x7c]
lea esi, [esi + eax + 3]
mov eax, dword [ebp + 0x7c]
cmp eax, dword [ebp + 0x6c]
jl 0x407fad
add esi, 4
push esi
lea ecx, [ebp + 0x10]
call fcn.0042c850
mov edi, dword [ebp + 0x10]
xor esi, esi
cmp dword [ebp + 0x6c], ebx
mov dword [ebp + 0x5c], edi
jle 0x408069
mov eax, dword [ebp - 0x2a4]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
push eax
mov dword [ebp + 0x7c], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp + 0x7c]
mov dword [ebp + 0x54], eax
push edi
call fcn.00403c6b
mov eax, dword [ebp + 0x54]
lea edi, [edi + eax*2]
mov word [edi], 0x3d
mov eax, dword [ebp - 0x2a4]
mov eax, dword [eax + esi*4]
mov eax, dword [eax + 4]
add esp, 0xc
inc edi
push eax
inc edi
mov dword [ebp + 0x7c], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp + 0x7c]
mov dword [ebp + 0x54], eax
push edi
call fcn.00403c6b
mov eax, dword [ebp + 0x54]
lea edi, [edi + eax*2]
add esp, 0xc
mov word [edi], bx
inc edi
inc edi
inc esi
cmp esi, dword [ebp + 0x6c]
jl 0x408000
mov word [edi], bx
lea ecx, [ebp + 0x38]
mov word [edi + 2], bx
call fcn.00427365
push ebx
lea ecx, [ebp - 0x2a4]
call fcn.0041c72f
lea ecx, [ebp - 0x268]
call fcn.00427365
push 0x4975e4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x24]
xor esi, esi
inc esi
xor al, al
cmp word [ecx], 0x40
jne 0x4080ac
inc al
jmp 0x4080b3
cmp dword [ebp - 0x3c], ebx
je 0x4080b3
mov al, 2
cmp byte [ebp + 0x73], bl
je 0x4081a9
or byte [ebp + 0x73], 8
neg al
mov dword [ebp - 0x10], esi
sbb eax, eax
and eax, 0xfff01000
add eax, 0x100000
mov edi, eax
call fcn.00428f27
push eax
lea eax, [ebp - 0x150]
push str..pipepecmd_exec__u
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebx
push esi
push edi
push edi
push 0xff
push 6
push 0x40000003
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp eax, ebx
mov dword [ebp - 0x48], eax
je 0x40814e
cmp eax, 0xffffffff
je 0x40814e
push 0xffffffffffffffff
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp + 0x7c]
call fcn.004365f0
push ebx
push ebx
push 3
lea ecx, [ebp - 0x114]
push ecx
push 7
push 0xc0000000
push dword [eax]
lea ecx, [ebp - 0x38]
call fcn.00403ce4
lea ecx, [ebp + 0x7c]
call fcn.00427365
jmp 0x408155
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebp - 0x38]
push ebx
push ebx
lea eax, [ebp + 0x6c]
push eax
push edi
mov dword [ebp + 0x6c], 2
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
push ebx
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x120], eax
mov dword [ebp - 0xcc], eax
lea eax, [ebp - 0x210]
or byte [eax + 0x2d], 1
test byte [ebp + 0x4d], 2
mov dword [ebp - 0x34], esi
mov dword [ebp + 0x44], esi
jne 0x40819d
cmp byte [ebp + 0x4d], bl
jne 0x4081a0
mov dword [eax + 0x3c], edi
test byte [ebp + 0x4d], 1
je 0x4081bf
mov dword [eax + 0x40], edi
cmp dword [ebp - 0x10], ebx
jne 0x4081bf
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
push 0x4975e4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0x5c]
neg eax
sbb eax, eax
and eax, 0x400
or eax, dword [ebp + 0x18]
cmp byte [ebp + 0x4f], bl
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x6c], eax
je 0x4081e8
or dword [ebp + 0x6c], 4
cmp byte [ebp - 0x16], bl
mov dword [ebp - 0xd4], ebx
mov dword [ebp + 0x18], ebx
je 0x408206
lea eax, [ebp - 0xd4]
push eax
call fcn.00402f56
pop ecx
mov dword [ebp + 0x18], eax
cmp byte [ebp + 0x3f], bl
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
je 0x4082dc
push 0xd
xor eax, eax
mov dword [ebp - 0x168], ebx
pop ecx
lea edi, [ebp - 0x164]
mov dword [ebp - 0x16c], 0x3c
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x20]
or word [ebp - 0x168], 0x4540
cmp eax, ebx
jne 0x408245
push 5
pop eax
movzx eax, ax
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x160], eax
mov eax, dword [ebp + 0x68]
mov dword [ebp + 8], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 0x15c], eax
cmp word [eax], 0x22
jne 0x4082a3
push 1
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00413796
add esp, 0xc
push dword [ebp + 8]
lea ecx, [ebp - 0xb0]
push dword [ebp - 8]
mov esi, eax
call fcn.0042c92f
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x158], esi
lea eax, [ebp - 0x16c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp + 0x7c], eax
mov eax, dword [ebp - 0x134]
lea esi, [ebp - 0x108]
push eax
mov dword [esi], eax
mov dword [ebp - 0x134], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [esi + 8], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x408759
cmp byte [ebp - 0x18], bl
je 0x408332
call fcn.004064cf
push dword [ebp + 0x68]
mov dword [ebp - 0x94], eax
push dword [ebp + 0x14]
lea eax, [ebp + 0x48]
push dword [ebp]
push eax
call fcn.004036c0
add esp, 0x10
lea ecx, [ebp - 0x108]
push ecx
lea ecx, [ebp - 0x210]
push ecx
push eax
push dword [ebp + 0x5c]
push dword [ebp + 0x6c]
push dword [ebp + 0x44]
push ebx
push ebx
push dword [ebp + 0x68]
push dword [ebp + 0x14]
push dword [ebp - 0x94]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp + 0x7c], eax
jmp 0x4082d1
mov eax, dword [ebp - 0x50]
cmp word [eax], bx
je 0x408474
cmp byte [ebp + 0xf], bl
mov dword [ebp + 0x7c], ebx
je 0x4083d8
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp + 0x38]
call fcn.00402a6e
lea ecx, [ebp + 0x54]
call fcn.0042c693
mov edi, dword [ebp - 0x4c]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push ebx
push edi
call fcn.0046c9b0
lea eax, [ebp + 0x54]
push eax
push dword [ebp + 0x38]
call fcn.00431e45
add esp, 0x14
push 0xffffffffffffffff
mov edi, eax
neg edi
push 0xffffffffffffffff
push dword [ebp + 0x54]
sbb edi, edi
lea ecx, [ebp - 0x4c]
neg edi
call fcn.0042c8c6
mov eax, dword [ebp + 0x38]
push eax
mov dword [ebp + 0x34], eax
call esi
push eax
push ebx
push dword [ebp + 0x34]
call fcn.0046c9b0
mov eax, dword [ebp + 0x54]
add esp, 0xc
push eax
mov dword [ebp + 0x34], eax
call esi
push eax
push ebx
push dword [ebp + 0x34]
call fcn.0046c9b0
add esp, 0xc
lea ecx, [ebp + 0x54]
call fcn.00427365
lea ecx, [ebp + 0x38]
call fcn.00427365
cmp edi, ebx
je 0x408443
mov edi, dword [ebp - 0x50]
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x40
push edi
call esi
cmp eax, ebx
jne 0x4083f3
push 0x5c
push edi
call esi
cmp eax, ebx
je 0x4083fe
mov word [eax], bx
mov esi, dword [ebp - 0x50]
lea edi, [eax + 2]
jmp 0x408403
mov esi, 0x4812f8
push dword [ebp + 0x68]
lea eax, [ebp + 0x48]
push dword [ebp + 0x14]
push dword [ebp]
push eax
call fcn.004036c0
add esp, 0x10
lea ecx, [ebp - 0x108]
push ecx
lea ecx, [ebp - 0x210]
push ecx
push eax
push dword [ebp + 0x5c]
push dword [ebp + 0x6c]
push dword [ebp + 0x68]
push dword [ebp + 0x14]
push 1
push dword [ebp - 0x4c]
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov dword [ebp + 0x7c], eax
mov edi, dword [ebp - 0x4c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
call esi
shl eax, 1
push eax
push ebx
push edi
call fcn.0046c9b0
mov edi, dword [ebp - 0x50]
add esp, 0xc
push edi
call esi
shl eax, 1
push eax
push ebx
push edi
call fcn.0046c9b0
add esp, 0xc
jmp 0x4082d1
cmp byte [ebp + 0x33], bl
je 0x4084bc
push dword [ebp - 0x44]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp]
push dword [ebp + 0x5c]
push dword [ebp + 0x6c]
push dword [ebp + 0x44]
push dword [ebp + 0x68]
push dword [ebp - 0xe4]
push dword [ebp - 0xe8]
call fcn.0043567a
xor ecx, ecx
add esp, 0x28
test eax, eax
setg cl
mov dword [ebp + 0x7c], ecx
jmp 0x4082d1
mov eax, dword [ebp + 0x14]
cmp eax, ebx
mov dword [ebp + 0x7c], ebx
mov dword [ebp + 0x20], ebx
mov dword [ebp - 0xc4], ebx
mov dword [ebp + 0x1c], ebx
je 0x4084fc
jmp 0x4084dc
inc eax
inc eax
inc dword [ebp + 0x1c]
mov dword [ebp + 0x14], eax
cmp word [eax], 0x2a
je 0x4084d4
lea eax, [ebp + 0x14]
push eax
call fcn.0042a7cd
mov dword [ebp + 0x20], eax
mov eax, dword [ebp + 0x14]
cmp word [eax], bx
pop ecx
jne 0x4084fc
xor eax, eax
mov dword [ebp + 0x14], eax
cmp dword [ebp + 0x20], ebx
mov dword [ebp - 0x44], ebx
je 0x40870d
add dword [ebp + 0x20], 2
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.00433aa7
cmp dword [ebp + 0x14], ebx
mov edi, dword [0x496dd4]
pop ecx
pop ecx
push 0x20
pop esi
mov dword [ebp + 0x34], eax
mov dword [ebp + 0x38], esi
mov dword [ebp + 0x54], ebx
je 0x408543
push 2
push ebx
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp + 0x54], edi
cmp edi, ebx
jne 0x408575
lea ecx, [ebp - 0xc4]
call fcn.00427365
lea ecx, [ebp + 0x48]
call fcn.00427365
push 0x4975e4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp + 0x10]
call fcn.00427365
xor ebx, ebx
inc ebx
jmp 0x409080
lea ecx, [ebp - 0x90]
call fcn.0042c693
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp - 0x90]
push eax
push dword [ebp + 0x34]
mov dword [ebp - 0x8c], ebx
push dword [ebp - 0x44]
mov dword [ebp - 0x88], ebx
push edi
mov dword [ebp + 0x38], esi
call fcn.0040f3dc
mov edi, eax
add esp, 0x14
cmp edi, ebx
jne 0x4085e1
push dword [ebp - 0x44]
push 0x4812f0
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4085e1
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp - 0x90]
push eax
push str.INDATA
push 2
push ebx
mov dword [ebp + 0x38], esi
call fcn.0040f3dc
add esp, 0x14
mov edi, eax
cmp dword [ebp + 0x54], ebx
je 0x4085ef
push dword [ebp + 0x54]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x8c], ebx
jle 0x408640
cmp edi, ebx
je 0x408640
cmp dword [ebp + 0x1c], ebx
jg 0x408656
push ebx
lea esi, [ebp - 0x108]
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp]
push dword [ebp + 0x5c]
push dword [ebp + 0x6c]
push dword [ebp + 0x44]
push dword [ebp + 0x68]
push dword [ebp - 0x8c]
push edi
call fcn.0043567a
add esp, 0x28
cmp eax, ebx
jl 0x408656
cmp dword [esi + 8], ebx
je 0x408656
xor ecx, ecx
cmp eax, ebx
setg cl
mov dword [ebp + 0x7c], ecx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x90]
call fcn.00427365
jmp 0x40874e
push 0x480d84
push str.exedat
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp - 0x70]
push eax
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x40], ebx
call fcn.00403dab
add esp, 0x14
cmp dword [ebp + 0x54], ebx
je 0x4086fa
push ebx
lea eax, [ebp + 0x34]
push eax
push dword [ebp - 0x8c]
mov dword [ebp + 0x34], ebx
push edi
push dword [ebp + 0x54]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 0x54]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp + 0x68]
lea eax, [ebp + 0x48]
push dword [ebp + 0x40]
push dword [ebp]
push eax
call fcn.004036c0
lea edi, [ebp - 0x108]
push edi
lea ecx, [ebp - 0x210]
push ecx
push eax
push dword [ebp + 0x5c]
push dword [ebp + 0x6c]
push dword [ebp + 0x44]
push ebx
push ebx
push dword [ebp + 0x68]
push dword [ebp + 0x40]
call fcn.0046c659
add esp, 0x38
cmp dword [ebp + 0x1c], 2
mov dword [ebp + 0x7c], eax
jl 0x408700
push dword [edi + 8]
push dword [ebp - 0x70]
call fcn.00402b79
mov eax, dword [ebp - 0x70]
pop ecx
pop ecx
mov word [eax], bx
jmp 0x408700
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp + 0x40]
call fcn.00427365
jmp 0x408646
push dword [ebp + 0x68]
push eax
push dword [ebp]
lea eax, [ebp + 0x48]
push eax
call fcn.004036c0
lea ecx, [ebp - 0x108]
push ecx
lea ecx, [ebp - 0x210]
push ecx
push eax
push dword [ebp + 0x5c]
push dword [ebp + 0x6c]
push dword [ebp + 0x44]
push ebx
push ebx
push dword [ebp + 0x68]
push dword [ebp + 0x14]
call fcn.0046c659
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x38
mov dword [ebp + 0x7c], eax
lea ecx, [ebp - 0xc4]
call fcn.00427365
cmp dword [ebp + 0x18], ebx
je 0x40876a
push dword [ebp - 0xd4]
call fcn.00402f67
pop ecx
cmp dword [ebp - 0x20], ebx
je 0x408774
push dword [ebp - 0x20]
call esi
cmp dword [ebp + 0x7c], ebx
mov dword [ebp - 0x20], ebx
je 0x408780
xor eax, eax
jmp 0x408786
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x78]
mov dword [ecx], eax
lea ecx, [ebp - 4]
mov dword [ebp + 0x34], eax
call fcn.00402a26
mov eax, dword [ebp - 0x98]
cmp word [eax], bx
je 0x4087b6
push eax
lea eax, [ebp - 0x108]
push dword [eax + 8]
push dword [ebp + 0x50]
call fcn.0042e722
add esp, 0xc
cmp byte [ebp + 0x4f], bl
je 0x4087d9
lea edi, [ebp - 0x108]
cmp dword [edi], ebx
je 0x4087d9
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push dword [edi]
mov dword [ebp - 0x40], eax
push eax
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
push str.__LastPID
lea edi, [ebp - 0x108]
push dword [edi + 8]
push dword [ebp + 0x50]
call fcn.0042e722
push str.__LastTID
push dword [edi + 0xc]
push dword [ebp + 0x50]
call fcn.0042e722
add esp, 0x18
test byte [ebp + 0x6c], 4
je 0x408816
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x408816
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea ecx, [ebp + 0x48]
call fcn.00427365
push 0x4975e4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp + 0x10]
call fcn.00427365
cmp dword [ebp - 0x38], ebx
je 0x40883b
push dword [ebp - 0x38]
call esi
cmp dword [ebp - 0x2c], ebx
mov dword [ebp - 0x38], ebx
je 0x408848
push dword [ebp - 0x2c]
call esi
cmp dword [ebp - 0xc], ebx
mov dword [ebp - 0x2c], ebx
je 0x408855
push dword [ebp - 0xc]
call esi
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
je 0x408862
push dword [ebp - 0x14]
call esi
cmp dword [ebp + 0x24], ebx
mov dword [ebp - 0x14], ebx
je 0x40886f
push dword [ebp + 0x24]
call esi
cmp dword [ebp + 0x7c], ebx
mov dword [ebp + 0x24], ebx
je 0x408fd1
mov eax, dword [edi]
cmp eax, ebx
jne 0x408884
mov dword [ebp - 0x10], ebx
mov ecx, dword [ebp - 0x34]
inc dword [ebp - 0x34]
mov dword [ebp + ecx*4 - 0xcc], eax
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x40889b
push eax
call esi
cmp byte [ebp + 0x4e], bl
mov dword [edi + 4], ebx
je 0x4088b8
mov ecx, dword [ebp + 0x50]
push 0x3e8
call fcn.0040b816
push dword [edi]
call fcn.0040bf37
pop ecx
cmp dword [ebp - 0x10], ebx
je 0x408fd1
mov al, byte [0x495280]
mov edi, 0x100000
push 0x100004
lea ecx, [ebp + 0x5c]
mov byte [ebp + 0x6f], al
mov dword [ebp + 0x44], edi
xor esi, esi
call fcn.0042c6b0
mov eax, dword [ebp - 0x24]
cmp word [eax], 0x40
lea ecx, [eax + 2]
mov dword [ebp], eax
mov dword [ebp + 0x34], ecx
mov byte [ebp + 0x7f], bl
jne 0x408997
mov byte [ebp + 0x7f], 1
mov dword [ebp], ecx
cmp byte [ebp - 0x17], bl
je 0x408956
mov ecx, dword [ebp + 0x50]
push ebx
lea eax, [ebp + 0x1c]
push eax
push dword [ebp]
mov dword [ebp + 0x1c], ebx
call fcn.0043cc6d
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 0x1c]
lea ecx, [ebp + 0x5c]
call fcn.0042c791
push dword [ebp + 0x5c]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
lea eax, [esi + 0x3ff]
and eax, 0xfffffc00
add eax, edi
mov dword [ebp + 0x44], eax
add eax, 8
push eax
lea ecx, [ebp + 0x5c]
call fcn.0042c6d7
lea ecx, [ebp + 0x1c]
call fcn.00427365
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
test byte [ebp + 0x73], 8
je 0x408c9f
mov eax, dword [ebp - 0x24]
mov ax, word [eax]
cmp ax, 0x40
je 0x4089a9
cmp byte [ebp + 7], bl
je 0x4089a9
cmp ax, 0x26
je 0x408991
mov eax, dword [ebp + 0x50]
test byte [eax + 0xb], 0xf
je 0x4089a9
mov byte [ebp + 0x4e], 1
jmp 0x4089ac
cmp dword [ebp - 0x3c], ebx
je 0x408900
mov byte [ebp + 0x7f], 2
jmp 0x408900
mov byte [ebp + 0x4e], bl
push ebx
mov dword [ebp - 0x118], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
cmp byte [ebp + 0x7f], bl
mov dword [ebp - 0xd0], esi
je 0x4089de
mov eax, dword [ebp + 0x44]
sub eax, esi
mov dword [ebp + 0x18], eax
jmp 0x4089e3
mov dword [ebp + 0x18], edi
mov eax, edi
lea ecx, [ebp - 0x130]
push ecx
lea ecx, [ebp - 0x118]
push ecx
push eax
mov eax, dword [ebp + 0x5c]
add eax, esi
push eax
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp - 0x68], ebx
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xc0], ebx
mov dword [ebp + 0x54], ebx
jg 0x408a22
mov dword [ebp - 0x68], 0x3e8
lea ecx, [ebp - 8]
mov byte [ebp + 0x4f], bl
call fcn.0042c809
mov al, byte [0x495280]
cmp al, bl
mov byte [ebp + 0x6f], al
jle 0x408c92
mov ecx, dword [ebp + 0x50]
push 0x4ff
push dword [ebp - 0x68]
lea eax, [ebp - 0xcc]
push ebx
push eax
push dword [ebp - 0x34]
call fcn.0040cff9
cmp eax, ebx
mov dword [ebp - 0x11c], eax
jne 0x408aec
lea eax, [ebp - 0x48]
mov edi, dword [eax]
push ebx
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp - 0x130]
push eax
push edi
mov dword [ebp + 0x40], ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
cmp dword [ebp + 0x40], ebx
jle 0x408a9a
mov eax, dword [ebp + 0x18]
cmp dword [ebp + 0x40], eax
jle 0x408a91
mov dword [ebp + 0x40], eax
add esi, dword [ebp + 0x40]
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi], bl
lea eax, [esi + 0x100000]
cmp eax, dword [ebp + 0x44]
jl 0x408abb
add dword [ebp + 0x44], 0x100000
mov eax, dword [ebp + 0x44]
add eax, 4
push eax
lea ecx, [ebp + 0x5c]
call fcn.0042c6d7
cmp byte [ebp + 0x7f], bl
je 0x408aca
mov eax, dword [ebp + 0x44]
sub eax, esi
mov dword [ebp + 0x18], eax
jmp 0x408ad1
mov dword [ebp + 0x18], 0x100000
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp + 0x40]
push eax
push dword [ebp + 0x18]
mov eax, dword [ebp + 0x5c]
add eax, esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [ebp + 0x7f], bl
je 0x408b23
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc0], eax
sub eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0x68]
jge 0x408bdd
cmp esi, dword [ebp + 0x54]
je 0x408c89
cmp eax, 0x14
jl 0x408c89
jmp 0x408bdd
mov eax, dword [ebp - 0x34]
cmp eax, 1
jle 0x408b4f
dec eax
cmp eax, dword [ebp - 0x11c]
jne 0x408b4f
cmp byte [ebp + 0x7f], bl
mov byte [ebp + 0x4f], 1
je 0x408c92
cmp esi, dword [ebp + 0x54]
je 0x408c92
jmp 0x408bdd
test byte [ebp + 0x73], 1
je 0x408b6f
mov eax, dword [ebp - 0xd0]
jmp 0x408b6b
mov ecx, dword [ebp + 0x5c]
cmp byte [eax + ecx], 0xa
je 0x408c92
inc eax
cmp eax, esi
jl 0x408b5d
push 5
pop edi
dec edi
js 0x408a2d
cmp byte [0x495280], bl
jle 0x408a2d
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x188]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x408a2d
cmp dword [ebp - 0x184], 0x12
je 0x408bc4
lea eax, [ebp - 0x188]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x188]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x408b72
cmp byte [ebp + 0x7f], bl
mov byte [ebp + 0x6f], bl
mov byte [ebp + 0x4f], 1
je 0x408a2d
cmp esi, dword [ebp + 0x54]
je 0x408a2d
cmp byte [ebp + 0x4e], bl
mov ecx, dword [ebp - 0xc0]
mov eax, dword [ebp + 0x5c]
mov dword [ebp + 0x54], esi
mov dword [ebp - 0xdc], ecx
jne 0x408c1c
cmp dword [ebp - 0x30], 0x4b0
je 0x408c0f
push dword [ebp - 0x30]
lea ecx, [ebp - 8]
push esi
push eax
call fcn.0042c8c6
mov eax, dword [ebp - 8]
jmp 0x408c1c
mov word [eax + esi + 2], bx
mov ecx, dword [ebp + 0x5c]
mov word [ecx + esi + 2], bx
cmp byte [ebp + 0x7f], 1
jne 0x408c39
mov ecx, dword [ebp + 0x50]
push eax
push eax
push 0x480934
push dword [ebp]
push dword [ebp]
call fcn.00429614
jmp 0x408c63
cmp byte [ebp + 0x4e], bl
je 0x408c57
push ebx
lea eax, [ebp + 0x5c]
push eax
push esi
push dword [ebp + 0x5c]
push dword [ebp - 0x24]
push dword [ebp + 0x50]
call fcn.0043ac43
add esp, 0x18
jmp 0x408c63
mov ecx, dword [ebp + 0x50]
push eax
push dword [ebp]
call fcn.0042b2cd
cmp dword [ebp - 0x3c], ebx
je 0x408c89
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x54]
call fcn.004365ba
mov ecx, dword [ebp + 0x50]
push ebx
push ebx
push ebx
push dword [ebp - 0x54]
call fcn.00420f64
lea ecx, [ebp - 0x54]
call fcn.00427365
cmp byte [ebp + 0x4f], bl
je 0x408b23
lea ecx, [ebp - 8]
call fcn.00427365
jmp 0x408d84
cmp dword [ebp - 0x10], 0xffffff9c
je 0x408d84
jmp 0x408d74
mov ecx, dword [ebp + 0x50]
push 0x4ff
push 0x3e8
push ebx
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x34]
call fcn.0040cff9
mov ecx, dword [ebp - 0x34]
dec ecx
cmp ecx, eax
je 0x408d84
cmp dword [ebp - 0x34], 1
jle 0x408d6c
cmp eax, ebx
jne 0x408d6c
lea eax, [esi + 0x100000]
cmp eax, dword [ebp + 0x44]
jl 0x408d06
add dword [ebp + 0x44], edi
mov eax, dword [ebp + 0x44]
add eax, 4
push eax
lea ecx, [ebp + 0x5c]
call fcn.0042c6d7
push ebx
lea eax, [ebp + 0x7c]
push eax
mov eax, dword [ebp + 0x5c]
push 1
add eax, esi
push eax
push dword [ebp - 0x48]
mov dword [ebp + 0x7c], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x408d6c
cmp dword [ebp + 0x7c], ebx
jbe 0x408d6c
add esi, dword [ebp + 0x7c]
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi], bl
jmp 0x408d6c
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x408d74
cmp dword [ebp - 0x148], 0x12
je 0x408d74
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp byte [0x495280], bl
jg 0x408d33
mov al, byte [0x495280]
cmp al, bl
mov byte [ebp + 0x6f], al
jg 0x408cae
cmp dword [ebp - 0x10], 0xffffff9c
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi + 2], bl
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi + 1], bl
mov eax, dword [ebp + 0x5c]
mov byte [eax + esi], bl
mov dword [ebp + 8], ebx
je 0x408db5
cmp byte [ebp + 0x6f], bl
jle 0x408db5
push ebx
lea eax, [ebp - 0x108]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x108]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp byte [ebp + 0x73], bl
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x78]
mov dword [ecx], eax
je 0x408f64
mov eax, dword [ebp - 0x24]
mov ax, word [eax]
xor edi, edi
cmp ax, 0x40
je 0x408e00
cmp byte [ebp + 7], bl
je 0x408e00
cmp ax, 0x26
je 0x408dfa
mov eax, dword [ebp + 0x50]
test byte [eax + 0xb], 0xf
je 0x408e00
mov byte [ebp + 0x7b], 1
jmp 0x408e03
mov byte [ebp + 0x7b], bl
lea ecx, [ebp - 0x7c]
call fcn.0042c693
cmp byte [ebp + 0x7b], bl
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
jne 0x408f0c
cmp byte [ebp + 0x77], 2
jne 0x408e2c
mov eax, dword [ebp + 0x5c]
mov word [eax + esi], bx
mov edi, dword [ebp + 0x5c]
jmp 0x408e7c
cmp byte [ebp + 0x77], 1
lea ecx, [ebp - 0x7c]
jne 0x408e43
push dword [ebp - 0x30]
push esi
push dword [ebp + 0x5c]
call fcn.0042c8c6
jmp 0x408e80
lea eax, [esi + 0x18]
push eax
call fcn.0042c850
lea eax, [esi + 1]
push eax
push dword [ebp + 0x5c]
mov dword [ebp - 0x74], esi
push dword [ebp - 0x7c]
mov dword [ebp - 0x78], esi
call fcn.0046cbf0
mov eax, dword [ebp - 0x7c]
push 0x10
add eax, esi
push ebx
push eax
call fcn.0046c9b0
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.0043f1ef
add esp, 0x20
cmp edi, ebx
jne 0x408e83
mov edi, dword [ebp - 0x7c]
test byte [ebp + 0x73], 4
je 0x408eb4
push edi
mov dword [ebp + 0x7c], edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [edi + eax*2 - 2]
jmp 0x408ead
mov ax, word [edi]
cmp ax, 0xd
je 0x408ea8
cmp ax, 0xa
jne 0x408f0c
mov word [edi], bx
dec edi
dec edi
cmp edi, dword [ebp + 0x7c]
jae 0x408e99
jmp 0x408f0c
test byte [ebp + 0x73], 1
jne 0x408ed3
test byte [ebp + 0x73], 2
je 0x408f0c
jmp 0x408f04
mov ax, word [edi]
cmp ax, 0xd
je 0x408ed8
cmp ax, 0xa
je 0x408ed8
inc edi
inc edi
cmp word [edi], bx
jne 0x408ec2
mov word [edi], bx
jmp 0x408f0c
cmp ax, 0xd
je 0x408eed
cmp ax, 0xa
je 0x408eed
inc edi
inc edi
jmp 0x408f04
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
lea eax, [edi + 2]
push eax
push edi
call fcn.0046cf30
add esp, 0xc
mov ax, word [edi]
cmp ax, bx
jne 0x408edd
mov eax, dword [ebp - 0x24]
cmp word [eax], 0x40
jne 0x408f30
push dword [ebp - 0x7c]
mov ecx, dword [ebp + 0x50]
push dword [ebp - 0x7c]
push 0x480934
push dword [ebp + 0x34]
push dword [ebp + 0x34]
call fcn.00429614
jmp 0x408f59
cmp byte [ebp + 0x7b], bl
je 0x408f4d
push 1
lea ecx, [ebp + 0x5c]
push ecx
push esi
push dword [ebp + 0x5c]
push eax
push dword [ebp + 0x50]
call fcn.0043ac43
add esp, 0x18
jmp 0x408f59
push dword [ebp - 0x7c]
mov ecx, dword [ebp + 0x50]
push eax
call fcn.0042b2cd
lea ecx, [ebp - 0x7c]
call fcn.00427365
mov eax, dword [ebp + 8]
push eax
mov dword [ebp + 0x34], eax
lea eax, [ebp - 0x2e4]
push 0x4812a8
push eax
mov word [ebp - 0x2e4], bx
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [ebp + 0x50]
add esp, 0xc
test byte [esi + 0xb], 0xf
jne 0x408fa0
lea eax, [ebp - 0x2e4]
push eax
push 0x481290
mov ecx, esi
call fcn.0042b2cd
lea eax, [ebp - 0x2e4]
push eax
push str.ERRORLEVEL
mov ecx, esi
call fcn.0042b2cd
cmp dword [ebp - 0x40], ebx
je 0x408fc3
push 1
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
lea ecx, [ebp + 0x5c]
call fcn.00427365
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x70]
cmp ecx, ebx
je 0x408fee
cmp word [ecx], bx
je 0x408fee
lea eax, [ebp - 0x108]
push dword [eax + 8]
push ecx
call fcn.00402b79
pop ecx
pop ecx
lea edi, [ebp - 0x108]
mov eax, dword [edi]
cmp eax, ebx
je 0x408ffd
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0xc]
mov eax, dword [edi]
cmp eax, ebx
je 0x40900b
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0x14]
mov eax, dword [edi]
cmp eax, ebx
je 0x409019
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp + 0x24]
cmp dword [edi], ebx
je 0x409025
push ebx
call esi
mov dword [edi], ebx
lea edi, [ebp - 0x38]
mov eax, dword [edi]
cmp eax, ebx
je 0x409033
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0x48]
mov eax, dword [edi]
cmp eax, ebx
je 0x409041
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0x58]
mov eax, dword [edi]
cmp eax, ebx
je 0x40904f
push eax
call esi
cmp dword [ebp - 0x120], ebx
mov dword [edi], ebx
je 0x409061
push dword [ebp - 0x120]
call esi
lea edi, [ebp - 0x108]
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x409071
push eax
call esi
mov ecx, dword [ebp + 0x50]
push ebx
mov dword [edi + 4], ebx
call fcn.0044ba23
mov ebx, dword [ebp + 0x34]
lea ecx, [ebp - 0xbc]
call fcn.00427365
lea ecx, [ebp - 0x84]
call fcn.00427365
lea ecx, [ebp - 4]
call fcn.00402a26
lea ecx, [ebp - 0xa4]
call fcn.00427365
lea ecx, [ebp - 0x20]
call fcn.00402a26
lea ecx, [ebp - 0x2c]
call fcn.00402a26
lea ecx, [ebp + 0x24]
call fcn.00402a26
lea ecx, [ebp - 0x14]
call fcn.00402a26
lea ecx, [ebp - 0xc]
call fcn.00402a26
lea ecx, [ebp - 0x58]
call fcn.00402a26
lea ecx, [ebp - 0x38]
call fcn.00402a26
lea ecx, [ebp - 0x48]
call fcn.00402a26
lea ecx, [ebp - 0x70]
call fcn.00427365
lea ecx, [ebp - 0xe8]
call fcn.00427365
lea ecx, [ebp - 0x64]
call fcn.00427365
lea ecx, [ebp - 0x28]
call fcn.00427365
lea ecx, [ebp - 0xb0]
call fcn.00427365
lea ecx, [ebp - 0x5c]
call fcn.00427365
lea ecx, [ebp - 0x98]
call fcn.00427365
lea ecx, [ebp - 0x60]
call fcn.00427365
lea ecx, [ebp - 0x40]
call fcn.00402a26
lea ecx, [ebp - 0x94]
call fcn.00402a26
lea ecx, [ebp - 0x6c]
call fcn.00427365
lea ecx, [ebp - 0xd8]
call fcn.00427365
lea ecx, [ebp - 0x4c]
call fcn.00427365
lea ecx, [ebp - 0x50]
call fcn.00427365
lea ecx, [ebp - 0x24]
call fcn.00427365
lea ecx, [ebp - 0xac]
call fcn.00427365
lea ecx, [ebp - 0x80]
call fcn.00427365
lea ecx, [ebp - 0xa8]
call fcn.00427365
lea ecx, [ebp - 0xa0]
call fcn.00427365
pop edi
pop esi
mov eax, ebx
pop ebx
add ebp, 0x60
leave
ret 0x18