Function at 0x4ee74c
Capabilities:
Create process on windows
Get common file path
Move file
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x24
push 0
push 0
dec ecx
jne 0x4ee754
push ebx
push esi
push edi
mov eax, 0x4edfbc
call fcn.00406d60
mov esi, 0x5310a4
xor eax, eax
push ebp
push 0x4ef72f
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [0x531a5c]
mov eax, dword [eax]
call fcn.00409a28
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00408d5c
mov eax, dword [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov eax, 2
call fcn.004a8230
mov edx, dword [ebp - 0x1c]
pop eax
call fcn.00404958
jne 0x4ee7bb
mov eax, dword [0x53150c]
mov byte [eax], 0
jmp 0x4ee7c3
mov eax, dword [0x53150c]
mov byte [eax], 1
lea edx, [ebp - 0x24]
mov eax, 1
call fcn.00402aa0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408d98
mov edx, dword [ebp - 0x20]
mov eax, dword [0x5316c4]
call fcn.004045b0
lea edx, [ebp - 0x2c]
mov eax, 2
call fcn.00402aa0
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00408d98
mov edx, dword [ebp - 0x28]
mov eax, dword [0x531728]
call fcn.004045b0
mov eax, dword [0x53150c]
cmp byte [eax], 0
jne 0x4ee833
lea edx, [ebp - 0x30]
mov eax, 0x11c
call fcn.004a8230
mov edx, dword [ebp - 0x30]
mov eax, dword [0x53153c]
call fcn.004045b0
jmp 0x4ee85c
lea edx, [ebp - 0x38]
mov eax, dword [0x531a5c]
mov eax, dword [eax]
call fcn.00409a28
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x34]
xor edx, edx
call fcn.00409960
mov edx, dword [ebp - 0x34]
mov eax, dword [0x53153c]
call fcn.004045b0
push 0x4ef74c
mov eax, dword [0x531a5c]
push dword [eax]
push 0x4ef74c
mov eax, dword [0x531794]
mov edx, 3
call fcn.004048d4
mov eax, dword [0x5316c4]
mov eax, dword [eax]
mov edx, 0x4ef758
call fcn.00404958
jne 0x4ee92f
fld xword [0x4ef75c]
mov eax, dword [0x5315c8]
fcomp qword [eax]
fnstsw ax
sahf
jae 0x4ee92f
call fcn.00469b48
test al, al
jne 0x4ee92f
call fcn.0040afc4
call fcn.00402b6c
push edx
push eax
lea eax, [ebp - 0x3c]
call fcn.00409360
mov edx, dword [ebp - 0x3c]
mov eax, dword [0x531728]
call fcn.004045b0
lea edx, [ebp - 0x40]
mov eax, dword [0x531a5c]
mov eax, dword [eax]
call fcn.0046c380
mov eax, dword [ebp - 0x40]
call fcn.00404a0c
push eax
mov eax, dword [0x5316c4]
push dword [eax]
push 0x4ef770
mov eax, dword [0x531728]
push dword [eax]
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.004048d4
mov eax, dword [ebp - 0x44]
call fcn.00404a0c
push eax
mov eax, dword [0x531a5c]
mov eax, dword [eax]
call fcn.00404a0c
mov edx, eax
xor eax, eax
pop ecx
call fcn.00469bc4
jmp 0x4ef685
lea edx, [ebp - 0x48]
mov eax, dword [0x531828]
mov eax, dword [eax]
call fcn.00408d5c
mov edx, dword [ebp - 0x48]
mov eax, 0x538774
call fcn.004045b0
mov eax, dword [0x538774]
call fcn.00461cc4
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x4c]
call fcn.00409360
mov eax, dword [ebp - 0x4c]
push eax
lea edx, [ebp - 0x50]
mov eax, 0x33
call fcn.004a8230
mov edx, dword [ebp - 0x50]
mov eax, 0x538770
pop ecx
call fcn.00404860
mov dl, 1
mov eax, dword [0x461acc]
call fcn.00403720
mov dword [0x5310a0], eax
mov edx, dword [0x538770]
mov eax, dword [0x5310a0]
call fcn.00461b70
test eax, eax
jne 0x4eeafb
mov eax, 0x4ef774
xor edx, edx
call fcn.004e9a64
mov ebx, eax
test ebx, ebx
je 0x4ef4e3
mov eax, dword [0x5316c4]
mov eax, dword [eax]
mov edx, 0x4ef788
call fcn.00404958
jne 0x4ee9e6
push 0
push 3
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4ef4e3
mov eax, dword [0x5316c4]
mov eax, dword [eax]
mov edx, 0x4ef798
call fcn.00404958
jne 0x4eea0d
push 0
push 4
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4ef4e3
mov eax, dword [0x5316c4]
mov eax, dword [eax]
mov edx, 0x4ef7a8
call fcn.00404958
jne 0x4eea34
push 0
push 0
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4ef4e3
mov eax, dword [0x5316c4]
mov eax, dword [eax]
mov edx, 0x4ef7b4
call fcn.00404958
jne 0x4ef4e3
mov edx, dword [0x531728]
mov eax, 2
call fcn.00402aa0
mov eax, dword [0x531728]
cmp dword [eax], 0
jne 0x4eea74
mov eax, dword [0x531728]
mov edx, 0x4ef770
call fcn.004045b0
push 0
push 2
push 0x604
push ebx
call sub.user32.dll_PostMessageA
mov eax, dword [0x531728]
mov eax, dword [eax]
call fcn.00404814
mov esi, eax
lea eax, [esi + 3]
push eax
mov eax, 0x53876c
mov ecx, 1
mov edx, dword [0x4edf70]
call fcn.00405ea4
add esp, 4
mov eax, dword [0x531728]
call fcn.00404a64
mov edx, eax
mov eax, dword [0x53876c]
call fcn.00409c5c
mov edi, dword [0x53876c]
test esi, esi
jle 0x4eeae7
mov eax, dword [edi]
push eax
push 2
push 0x604
push ebx
call sub.user32.dll_PostMessageA
add edi, 4
sub esi, 4
test esi, esi
jg 0x4eeacd
push 0
push 1
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4ef4e3
lea edx, [ebp - 0x58]
mov eax, dword [0x531a5c]
mov eax, dword [eax]
call fcn.00409a28
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x54]
xor edx, edx
call fcn.00409960
mov edx, dword [ebp - 0x54]
mov eax, dword [0x5319b4]
call fcn.004045b0
mov eax, dword [0x531970]
mov dword [eax], 0x20b9
lea edx, [ebp - 0x5c]
xor eax, eax
call fcn.004e9f04
mov edx, dword [ebp - 0x5c]
mov eax, dword [0x531950]
call fcn.004045b0
lea edx, [ebp - 0x60]
xor eax, eax
call fcn.004e9f04
mov edx, dword [ebp - 0x60]
mov eax, dword [0x5316b8]
call fcn.004045b0
mov eax, dword [0x538774]
call fcn.00404814
push eax
mov eax, 0x538774
call fcn.00404a64
pop edx
call fcn.004e9bf4
mov edx, dword [0x531970]
add dword [edx], eax
mov eax, 0x7fffffff
call fcn.0040305c
mov dword [0x538778], eax
mov eax, 0x400
call fcn.0040305c
add eax, 0x400
mov dword [0x53877c], eax
mov eax, 0x2800
call fcn.0040305c
add eax, 0x2800
mov dword [0x538780], eax
mov eax, 0x7fffffff
call fcn.0040305c
mov dword [0x538784], eax
mov eax, 0x7d000
call fcn.0040305c
lea edx, [ebp - 0x64]
xor eax, eax
call fcn.004e9f04
mov edx, dword [ebp - 0x64]
mov eax, 0x538788
mov ecx, 0x4ef7c0
call fcn.00404860
call fcn.00402b00
lea edx, [ebp - 0x68]
mov eax, 4
call fcn.004a8230
mov ecx, dword [ebp - 0x68]
mov edx, dword [0x531828]
mov edx, dword [edx]
mov eax, dword [0x531450]
call fcn.00404860
lea edx, [ebp - 0x6c]
mov eax, 3
call fcn.004a8230
mov ecx, dword [ebp - 0x6c]
mov edx, dword [0x531828]
mov edx, dword [edx]
mov eax, dword [0x531860]
call fcn.00404860
lea edx, [ebp - 0x70]
mov eax, dword [0x531a5c]
mov eax, dword [eax]
call fcn.00408d5c
mov edx, dword [ebp - 0x70]
mov eax, 0x538754
call fcn.004045b0
push 0x104
mov eax, dword [0x531518]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
cmp eax, 2
jb 0x4eecca
lea edx, [ebp - 0x74]
mov eax, dword [0x531518]
call fcn.00409e5c
mov edx, dword [ebp - 0x74]
mov eax, dword [0x531290]
call fcn.004045b0
mov eax, dword [0x531290]
mov eax, dword [eax]
call fcn.00404814
cmp eax, 3
jle 0x4eeca5
mov eax, dword [0x531290]
mov edx, 0x4ef7d0
call fcn.0040481c
mov eax, dword [0x531290]
mov eax, dword [0x531290]
mov eax, dword [eax]
cmp byte [eax + 1], 0x3a
jne 0x4eecd2
mov eax, dword [0x531290]
mov eax, dword [eax]
mov al, byte [eax]
call fcn.00402b3c
mov edx, dword [0x531508]
mov byte [edx], al
jmp 0x4eecd2
mov eax, dword [0x531508]
mov byte [eax], 0x43
push 0x104
mov eax, dword [0x531518]
push eax
lea edx, [ebp - 0x78]
mov eax, 0x2e
call fcn.004a8230
mov eax, dword [ebp - 0x78]
call fcn.00404a0c
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov eax, dword [0x531518]
call fcn.00409e40
mov edx, eax
mov eax, 0x538758
call fcn.0040474c
mov eax, 0x538758
call fcn.004695fc
mov eax, dword [0x538754]
cmp byte [eax], 0x5c
jne 0x4eed2c
mov eax, dword [0x53185c]
mov byte [eax], 2
jmp 0x4eed47
mov edx, dword [0x538754]
mov eax, dword [0x538758]
call fcn.00404b50
dec eax
jne 0x4eed47
mov eax, dword [0x53185c]
mov byte [eax], 1
mov eax, dword [0x5316c4]
mov eax, dword [eax]
mov edx, 0x4ef7dc
call fcn.00404958
jne 0x4eed62
mov eax, dword [0x531524]
mov byte [eax], 1
mov eax, dword [0x5316c4]
mov eax, dword [eax]
mov edx, 0x4ef7e8
call fcn.00404958
je 0x4eed8c
mov eax, dword [0x531728]
mov eax, dword [eax]
mov edx, 0x4ef7e8
call fcn.00404958
je 0x4eed8c
xor eax, eax
jmp 0x4eed8e
mov al, 1
test al, al
je 0x4eedba
mov eax, 0x7d0
call fcn.004d0e6c
mov eax, dword [0x531450]
mov eax, dword [eax]
call fcn.0046c408
test al, al
je 0x4eedce
mov eax, dword [0x531450]
mov eax, dword [eax]
call fcn.004098c8
jmp 0x4eedce
mov eax, dword [0x531524]
cmp byte [eax], 1
jne 0x4eedce
mov eax, 0x7d0
call fcn.004d0e6c
lea edx, [ebp - 0x7c]
mov eax, 0x11b
call fcn.004a8230
mov eax, dword [ebp - 0x7c]
push eax
lea edx, [ebp - 0x80]
mov eax, 0x13
call fcn.004a8230
mov eax, dword [ebp - 0x80]
pop edx
call fcn.0046b9d4
mov eax, dword [0x531524]
cmp byte [eax], 1
jne 0x4eef95
mov eax, dword [0x53185c]
cmp byte [eax], 0
jne 0x4eef95
lea edx, [ebp - 0x88]
mov eax, 0xb
call fcn.004a8230
mov ecx, dword [ebp - 0x88]
mov edx, dword [0x531828]
mov edx, dword [edx]
lea eax, [ebp - 0x84]
call fcn.00404860
mov eax, dword [ebp - 0x84]
call fcn.0046c408
test al, al
je 0x4eef95
mov dl, 1
mov eax, dword [0x414aa4]
call fcn.00403720
mov dword [0x538760], eax
lea edx, [ebp - 0x94]
mov eax, 0xb
call fcn.004a8230
mov ecx, dword [ebp - 0x94]
mov edx, dword [0x531828]
mov edx, dword [edx]
lea eax, [ebp - 0x90]
call fcn.00404860
mov edx, dword [ebp - 0x90]
lea eax, [ebp - 0x8c]
call fcn.00404e18
mov eax, dword [ebp - 0x8c]
push eax
mov eax, dword [0x538760]
push eax
call fcn.0046c720
mov eax, dword [0x538760]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4eef8b
mov eax, dword [0x538760]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x4eef49
lea ecx, [ebp - 0x98]
mov edx, ebx
mov eax, dword [0x538760]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x98]
mov eax, 0x538768
call fcn.004045b0
lea edx, [ebp - 0x9c]
mov eax, 0xa
call fcn.004a8230
mov ecx, dword [ebp - 0x9c]
mov eax, 0x538764
mov edx, dword [0x538768]
call fcn.00404860
push 1
mov eax, 0x538768
call fcn.00404a64
push eax
mov eax, 0x538764
call fcn.00404a64
push eax
call sub.kernel32.dll_MoveFileExA
test eax, eax
je 0x4eef43
mov edx, ebx
mov eax, dword [0x538760]
mov ecx, dword [eax]
call dword [ecx + 0x48]
dec ebx
cmp ebx, 0xffffffff
jne 0x4eeece
mov eax, dword [0x538760]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x4eef8b
lea edx, [ebp - 0xa4]
mov eax, 0xb
call fcn.004a8230
mov ecx, dword [ebp - 0xa4]
mov edx, dword [0x531828]
mov edx, dword [edx]
lea eax, [ebp - 0xa0]
call fcn.00404860
mov eax, dword [ebp - 0xa0]
call fcn.004098c8
mov eax, dword [0x538760]
call fcn.00403750
mov eax, dword [0x531630]
mov dword [eax], 0x20
lea eax, [ebp - 0xa8]
mov edx, dword [0x531a5c]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0xa8]
mov edx, dword [0x531630]
mov dx, word [edx]
call fcn.0046c798
mov edx, dword [0x531474]
mov dword [edx], eax
mov eax, dword [0x531474]
cmp dword [eax], 0
jne 0x4ef012
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0xac]
mov edx, dword [0x531a5c]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0xac]
mov edx, dword [0x531630]
mov dx, word [edx]
call fcn.0046c798
mov edx, dword [0x531474]
mov dword [edx], eax
mov eax, dword [0x531474]
cmp dword [eax], 0
jne 0x4ef055
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0xb0]
mov edx, dword [0x531a5c]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0xb0]
mov edx, dword [0x531630]
mov dx, word [edx]
call fcn.0046c798
mov edx, dword [0x531474]
mov dword [edx], eax
mov eax, dword [0x531474]
cmp dword [eax], 0
jne 0x4ef098
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0xb4]
mov edx, dword [0x531a5c]
mov edx, dword [edx]
call fcn.00404e18
mov eax, dword [ebp - 0xb4]
mov edx, dword [0x531630]
mov dx, word [edx]
call fcn.0046c798
mov edx, dword [0x531474]
mov dword [edx], eax
call sub.kernel32.dll_GetCurrentProcessId
mov edx, dword [0x531158]
mov dword [edx], eax
mov eax, dword [0x531704]
mov eax, dword [eax]
call fcn.00446ddc
call fcn.004a8aa4
mov ecx, dword [0x531848]
mov eax, dword [0x531704]
mov eax, dword [eax]
mov edx, dword [0x4af0f0]
call fcn.00446df4
mov ecx, dword [0x531658]
mov eax, dword [0x531704]
mov eax, dword [eax]
mov edx, dword [0x4ae050]
call fcn.00446df4
mov edx, dword [0x531950]
mov edx, dword [edx]
mov eax, dword [0x531848]
mov eax, dword [eax]
call fcn.00456400
mov ecx, dword [0x531228]
mov eax, dword [0x531704]
mov eax, dword [eax]
mov edx, dword [0x4ce310]
call fcn.00446df4
mov edx, dword [0x5316b8]
mov edx, dword [edx]
mov eax, dword [0x531228]
mov eax, dword [eax]
call fcn.00456400
mov ecx, dword [0x531360]
mov eax, dword [0x531704]
mov eax, dword [eax]
mov edx, dword [0x4ab5cc]
call fcn.00446df4
mov eax, dword [0x531228]
mov eax, dword [eax]
mov edx, dword [0x531848]
mov edx, dword [edx]
mov dword [edx + 0x31c], eax
lea edx, [ebp - 0xbc]
mov eax, 1
call fcn.00402aa0
mov eax, dword [ebp - 0xbc]
lea edx, [ebp - 0xb8]
call fcn.00408d98
mov eax, dword [ebp - 0xb8]
mov edx, 0x4ef758
call fcn.00404958
jne 0x4ef229
lea edx, [ebp - 0xc0]
mov eax, 0x11a
call fcn.004a8230
mov eax, dword [ebp - 0xc0]
mov ecx, 0x1a803549
mov edx, 0x4ef7f4
call fcn.0046b534
lea edx, [ebp - 0xc8]
mov eax, 2
call fcn.00402aa0
mov eax, dword [ebp - 0xc8]
lea edx, [ebp - 0xc4]
call fcn.00408d98
mov eax, dword [ebp - 0xc4]
mov edx, 0x4ef804
call fcn.00404958
jne 0x4ef209
lea edx, [ebp - 0xcc]
mov eax, 0x11a
call fcn.004a8230
mov eax, dword [ebp - 0xcc]
mov ecx, 0x1a803549
mov edx, 0x4ef810
call fcn.0046b534
jmp 0x4ef229
lea edx, [ebp - 0xd0]
mov eax, 0x11a
call fcn.004a8230
mov eax, dword [ebp - 0xd0]
mov edx, 0x4ef810
call fcn.0046b9d4
mov dl, 1
mov eax, dword [0x414aa4]
call fcn.00403720
mov edx, dword [0x5316e8]
mov dword [edx], eax
mov dl, 1
mov eax, dword [0x414440]
call fcn.00403720
mov edx, dword [0x5316e4]
mov dword [edx], eax
mov dl, 1
mov eax, dword [0x414aa4]
call fcn.00403720
mov ebx, eax
lea edx, [ebp - 0xdc]
mov eax, 5
call fcn.004a8230
mov ecx, dword [ebp - 0xdc]
mov edx, dword [0x531828]
mov edx, dword [edx]
lea eax, [ebp - 0xd8]
call fcn.00404860
mov edx, dword [ebp - 0xd8]
lea eax, [ebp - 0xd4]
call fcn.00404e18
mov eax, dword [ebp - 0xd4]
push eax
push ebx
call fcn.0046c720
test al, al
je 0x4ef2b1
mov byte [0x53878c], 1
cmp byte [0x53878c], 0
je 0x4ef3ce
jmp 0x4ef3ba
lea ecx, [ebp - 0xe4]
xor edx, edx
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xe4]
lea edx, [ebp - 0xe0]
call fcn.00408fac
mov edx, dword [ebp - 0xe0]
mov eax, 0x53875c
call fcn.004045b0
xor edx, edx
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x48]
cmp dword [0x53875c], 0
je 0x4ef461
mov edx, dword [0x53875c]
mov eax, 0x4ef820
call fcn.00404b50
mov dword [esi], eax
cmp dword [esi], 0
jne 0x4ef332
mov edx, dword [0x53875c]
mov eax, 0x4ef82c
call fcn.00404b50
mov dword [esi], eax
cmp dword [esi], 0
je 0x4ef461
lea eax, [ebp - 0xec]
push eax
mov ecx, dword [esi]
dec ecx
mov edx, 1
mov eax, dword [0x53875c]
call fcn.00404a6c
mov eax, dword [ebp - 0xec]
lea edx, [ebp - 0xe8]
call fcn.00408fac
mov edx, dword [ebp - 0xe8]
mov eax, dword [0x5316e8]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0xf4]
push eax
mov edx, dword [esi]
inc edx
mov ecx, 0x400
mov eax, dword [0x53875c]
call fcn.00404a6c
mov eax, dword [ebp - 0xf4]
lea edx, [ebp - 0xf0]
call fcn.00408fac
mov eax, dword [ebp - 0xf0]
call fcn.004093d0
mov edx, eax
mov eax, dword [0x5316e4]
mov eax, dword [eax]
call fcn.00416c00
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jg 0x4ef2c3
jmp 0x4ef461
mov eax, dword [0x538780]
push eax
mov eax, dword [0x538784]
push eax
mov eax, dword [0x531290]
push dword [eax]
push 0x4ef838
push dword [0x538788]
lea eax, [ebp - 0xf8]
mov edx, 3
call fcn.004048d4
mov eax, dword [ebp - 0xf8]
push eax
mov ecx, dword [0x53877c]
mov edx, dword [0x538778]
mov eax, ebx
call fcn.004ede8c
test al, al
jne 0x4ef3ba
mov eax, dword [0x538780]
push eax
mov eax, dword [0x538784]
push eax
mov edx, dword [0x531828]
mov edx, dword [edx]
lea eax, [ebp - 0xfc]
mov ecx, dword [0x538788]
call fcn.00404860
mov eax, dword [ebp - 0xfc]
push eax
mov ecx, dword [0x53877c]
mov edx, dword [0x538778]
mov eax, ebx
call fcn.004ede8c
test al, al
jne 0x4ef3ba
mov eax, ebx
call fcn.00403750
mov eax, dword [0x5316e8]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x4ef49a
mov eax, dword [0x5316e8]
mov eax, dword [eax]
mov edx, 0x4ef84c
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x5316e4]
mov eax, dword [eax]
mov edx, 0x20b9
call fcn.00416c00
mov eax, dword [0x5316e8]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jle 0x4ef4c4
mov eax, dword [0x5316e8]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
call fcn.0040305c
mov edx, dword [0x5312c4]
mov dword [edx], eax
jmp 0x4ef4cd
mov eax, dword [0x5312c4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x531704]
mov eax, dword [eax]
call fcn.00446e74
mov eax, dword [0x531474]
call fcn.0040e1cc
mov eax, 0x5310a0
call fcn.0040e1cc
mov eax, dword [0x5312b0]
cmp byte [eax], 0
je 0x4ef52d
push 1
push 0x4ef860
push 0x4ef860
lea edx, [ebp - 0x100]
mov eax, dword [0x531704]
mov eax, dword [eax]
call fcn.00447460
mov eax, dword [ebp - 0x100]
call fcn.00404a0c
push eax
push 0x4ef864
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x5311cc]
cmp byte [eax], 0
je 0x4ef675
mov dl, 1
mov eax, dword [0x414aa4]
call fcn.00403720
mov ebx, eax
lea edx, [ebp - 0x10c]
mov eax, 5
call fcn.004a8230
mov ecx, dword [ebp - 0x10c]
mov edx, dword [0x531828]
mov edx, dword [edx]
lea eax, [ebp - 0x108]
call fcn.00404860
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x104]
call fcn.00404e18
mov eax, dword [ebp - 0x104]
push eax
push ebx
call fcn.0046c720
test al, al
jne 0x4ef66e
mov eax, dword [0x538780]
push eax
mov eax, dword [0x538784]
push eax
mov eax, dword [0x531290]
push dword [eax]
push 0x4ef838
push dword [0x538788]
lea eax, [ebp - 0x110]
mov edx, 3
call fcn.004048d4
mov eax, dword [ebp - 0x110]
push eax
mov ecx, dword [0x53877c]
mov edx, dword [0x538778]
mov eax, ebx
call fcn.004ede8c
test al, al
jne 0x4ef627
mov eax, dword [0x538780]
push eax
mov eax, dword [0x538784]
push eax
mov edx, dword [0x531828]
mov edx, dword [edx]
lea eax, [ebp - 0x114]
mov ecx, dword [0x538788]
call fcn.00404860
mov eax, dword [ebp - 0x114]
push eax
mov ecx, dword [0x53877c]
mov edx, dword [0x538778]
mov eax, ebx
call fcn.004ede8c
test al, al
je 0x4ef66e
lea edx, [ebp - 0x120]
mov eax, 5
call fcn.004a8230
mov ecx, dword [ebp - 0x120]
mov edx, dword [0x531828]
mov edx, dword [edx]
lea eax, [ebp - 0x11c]
call fcn.00404860
mov edx, dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
call fcn.00404e18
mov eax, dword [ebp - 0x118]
push eax
push ebx
call fcn.0046c6b4
mov eax, ebx
call fcn.00403750
push 0x1341606
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ef739
lea eax, [ebp - 0x120]
mov edx, 2
call fcn.00404580
lea eax, [ebp - 0x118]
call fcn.00404c78
lea eax, [ebp - 0x114]
mov edx, 4
call fcn.00404580
lea eax, [ebp - 0x104]
call fcn.00404c78
lea eax, [ebp - 0x100]
mov edx, 0xb
call fcn.00404580
lea eax, [ebp - 0xd4]
call fcn.00404c78
lea eax, [ebp - 0xd0]
mov edx, 7
call fcn.00404580
lea eax, [ebp - 0xb4]
mov edx, 4
call fcn.00404c90
lea eax, [ebp - 0xa4]
mov edx, 6
call fcn.00404580
lea eax, [ebp - 0x8c]
call fcn.00404c78
lea eax, [ebp - 0x88]
mov edx, 0x1e
call fcn.00404580
ret