Function at 0x40d6b0
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x5f0
mov edi, dword [ebp + 8]
mov eax, dword [0x530f98]
xor eax, ebp
mov dword [esp + 0x5e8], eax
mov eax, 0x4e43a6
lea esi, [esp + 0x148]
mov dword [esi], eax
push eax
call fcn.004cfa30
add esp, 4
mov dword [esi + 4], eax
lea ebx, [esp + 0x124]
mov ecx, edi
push esi
push ebx
call fcn.0042da50
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x40d709
mov eax, dword [esp + 0x128]
xor ebx, ebx
test eax, eax
jne 0x40eb03
lea ecx, [esp + 0x124]
push ebx
push 0x4e3bb0
push 0xffffffffffffffff
push ebx
call fcn.004297ba
test eax, eax
jne 0x40eb03
mov ecx, edi
push str.flash_update
call fcn.0042d9e0
xor ebx, ebx
test al, al
je 0x40eb03
lea ecx, [esp + 0x118]
call fcn.004303a0
lea ecx, [esp + 0x10c]
call fcn.004303a0
lea ecx, [esp + 0x100]
call fcn.004303a0
lea ecx, [esp + 0xf4]
call fcn.004303a0
lea eax, [esp + 0x3e0]
push 0x208
push ebx
push eax
call fcn.004b8bc0
add esp, 0xc
push 0x104
lea eax, [esp + 0x3e4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x3e0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ebx, [esp + 0xe8]
mov ecx, ebx
lea eax, [esp + 0x3e0]
push eax
call fcn.0040394a
mov ecx, ebx
push str.components
call fcn.00429ed8
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x40d7e6
mov ebx, dword [esp + 0xe8]
mov eax, dword [esp + 0xec]
lea ecx, [esp + 0xdc]
push eax
push ebx
call fcn.00430400
mov ecx, edi
push 0x4e3bd8
push esi
call fcn.0042dbb0
lea ebx, [esp + 0x118]
mov ecx, ebx
push esi
call fcn.00430500
mov ecx, esi
call fcn.004304c0
mov esi, 0x4e3bae
lea ecx, [esp + 0xd0]
push esi
call fcn.0040394a
lea ecx, [esp + 0xc4]
push esi
call fcn.0040394a
lea ecx, [esp + 0xb8]
push esi
call fcn.0040394a
call fcn.00441a60
mov dword [esp], eax
xor eax, eax
inc eax
lea edi, [esp + 0x148]
mov ecx, edi
push eax
push eax
push ebx
call fcn.00444120
lea esi, [esp + 0x10]
mov ecx, edi
push esi
call fcn.004443f0
movzx eax, byte [esi + 0xb]
test al, al
jns 0x40d877
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40de5f
lea edi, [esp + 0xa0]
lea ebx, [esp + 0xac]
mov ecx, esi
push edi
call fcn.00430e30
mov ecx, ebx
push edi
call fcn.00429824
mov ecx, edi
call fcn.004304c0
movzx eax, byte [esp + 0xb7]
mov ecx, ebx
test al, al
jns 0x40d8c0
mov ecx, dword [esp + 0xac]
mov eax, dword [esp + 0xb0]
push 1
push 4
push 0x4e3be0
push eax
push ecx
call fcn.00439210
add esp, 0x14
test al, al
je 0x40da09
movzx eax, byte [esp + 0xb7]
mov ecx, ebx
test al, al
jns 0x40d8f7
mov ecx, dword [esp + 0xac]
mov eax, dword [esp + 0xb0]
push 1
push 5
push str.npswf
push eax
push ecx
call fcn.004390e0
add esp, 0x14
test al, al
je 0x40da09
lea ecx, [esp + 0x10c]
push esi
call fcn.004304e0
lea esi, [esp + 0xd0]
mov ecx, esi
push ebx
call fcn.004299aa
movzx eax, byte [esp + 0xdb]
mov ecx, esi
test al, al
jns 0x40d94a
mov ecx, dword [esp + 0xd0]
mov eax, dword [esp + 0xd4]
xor edx, edx
dec edx
test eax, eax
lea esi, [esp + 0x10]
je 0x40d976
lea edx, [ecx + eax*2]
add edx, 0xfffffffe
add eax, eax
neg eax
cmp word [edx], 0x2e
je 0x40d972
add edx, 0xfffffffe
add eax, 2
jne 0x40d95f
xor edx, edx
dec edx
jmp 0x40d976
sub edx, ecx
sar edx, 1
mov ecx, edi
lea eax, [esp + 0xdc]
push eax
push edx
push 0
lea eax, [esp + 0xdc]
push eax
call fcn.004298c8
cmp byte [esp + 0xdb], 0
js 0x40d9ae
mov word [esp + 0xd0], 0
mov byte [esp + 0xdb], 0
jmp 0x40d9e9
mov eax, dword [esp + 0xd0]
mov word [eax], 0
mov dword [esp + 0xd4], 0
cmp byte [esp + 0xdb], 0
jns 0x40d9e9
push dword [esp + 0xd0]
call fcn.004af3c6
add esp, 4
mov dword [esp + 0xd8], 0
mov eax, dword [esp + 0xa8]
mov dword [esp + 0xd8], eax
movsd xmm0, qword [esp + 0xa0]
movsd qword [esp + 0xd0], xmm0
movzx eax, byte [esp + 0xb7]
mov ecx, ebx
test al, al
jns 0x40da25
mov ecx, dword [esp + 0xac]
mov eax, dword [esp + 0xb0]
push 1
push 4
push 0x4e3be0
push eax
push ecx
call fcn.00439210
add esp, 0x14
test al, al
je 0x40db6e
movzx eax, byte [esp + 0xb7]
mov ecx, ebx
test al, al
jns 0x40da5c
mov ecx, dword [esp + 0xac]
mov eax, dword [esp + 0xb0]
push 1
push 8
push str.pepflash
push eax
push ecx
call fcn.004390e0
add esp, 0x14
test al, al
je 0x40db6e
lea ecx, [esp + 0x100]
push esi
call fcn.004304e0
lea esi, [esp + 0xc4]
mov ecx, esi
push ebx
call fcn.004299aa
movzx eax, byte [esp + 0xcf]
mov ecx, esi
test al, al
jns 0x40daaf
mov ecx, dword [esp + 0xc4]
mov eax, dword [esp + 0xc8]
xor edx, edx
dec edx
test eax, eax
lea esi, [esp + 0x10]
je 0x40dadb
lea edx, [ecx + eax*2]
add edx, 0xfffffffe
add eax, eax
neg eax
cmp word [edx], 0x2e
je 0x40dad7
add edx, 0xfffffffe
add eax, 2
jne 0x40dac4
xor edx, edx
dec edx
jmp 0x40dadb
sub edx, ecx
sar edx, 1
mov ecx, edi
lea eax, [esp + 0xd0]
push eax
push edx
push 0
lea eax, [esp + 0xd0]
push eax
call fcn.004298c8
cmp byte [esp + 0xcf], 0
js 0x40db13
mov word [esp + 0xc4], 0
mov byte [esp + 0xcf], 0
jmp 0x40db4e
mov eax, dword [esp + 0xc4]
mov word [eax], 0
mov dword [esp + 0xc8], 0
cmp byte [esp + 0xcf], 0
jns 0x40db4e
push dword [esp + 0xc4]
call fcn.004af3c6
add esp, 4
mov dword [esp + 0xcc], 0
mov eax, dword [esp + 0xa8]
mov dword [esp + 0xcc], eax
movsd xmm0, qword [esp + 0xa0]
movsd qword [esp + 0xc4], xmm0
cmp dword [esp], 5
jl 0x40dc7d
movzx eax, byte [esp + 0xb7]
mov ecx, ebx
test al, al
jns 0x40db94
mov ecx, dword [esp + 0xac]
mov eax, dword [esp + 0xb0]
push 1
push 4
push 0x4e3be0
push eax
push ecx
call fcn.00439210
add esp, 0x14
test al, al
je 0x40dc7d
movzx eax, byte [esp + 0xb7]
mov ecx, ebx
test al, al
jns 0x40dbcb
mov ecx, dword [esp + 0xac]
mov eax, dword [esp + 0xb0]
push 1
push 0xd
push str.flash_ax_win8
push eax
push ecx
call fcn.004390e0
add esp, 0x14
test al, al
jne 0x40dc15
movzx eax, byte [esp + 0xb7]
mov ecx, ebx
test al, al
jns 0x40dbfe
mov ecx, dword [esp + 0xac]
mov eax, dword [esp + 0xb0]
push 1
push 0xe
push str.flash_ax_win10
push eax
push ecx
call fcn.004390e0
add esp, 0x14
test al, al
je 0x40dc7d
lea ecx, [esp + 0xf4]
push esi
call fcn.004304e0
lea esi, [esp + 0xb8]
mov ecx, esi
push ebx
call fcn.004299aa
movzx eax, byte [esp + 0xc3]
mov ecx, esi
test al, al
jns 0x40dc4d
mov ecx, dword [esp + 0xb8]
mov eax, dword [esp + 0xbc]
xor edx, edx
dec edx
test eax, eax
lea esi, [esp + 0x10]
je 0x40dd82
lea edx, [ecx + eax*2]
add edx, 0xfffffffe
add eax, eax
neg eax
cmp word [edx], 0x2e
je 0x40dd7e
add edx, 0xfffffffe
add eax, 2
jne 0x40dc66
jmp 0x40dd79
movzx eax, byte [esp + 0xb7]
mov ecx, ebx
test al, al
jns 0x40dc99
mov ecx, dword [esp + 0xac]
mov eax, dword [esp + 0xb0]
push 1
push 4
push 0x4e3be0
push eax
push ecx
call fcn.00439210
add esp, 0x14
test al, al
je 0x40de15
movzx eax, byte [esp + 0xb7]
mov ecx, ebx
test al, al
jns 0x40dcd0
mov ecx, dword [esp + 0xac]
mov eax, dword [esp + 0xb0]
push 1
push 0xd
push str.flash_ax_win7
push eax
push ecx
call fcn.004390e0
add esp, 0x14
test al, al
jne 0x40dd1e
movzx eax, byte [esp + 0xb7]
mov ecx, ebx
test al, al
jns 0x40dd03
mov ecx, dword [esp + 0xac]
mov eax, dword [esp + 0xb0]
push 1
push 0xb
push str.flash_ax_xp
push eax
push ecx
call fcn.004390e0
add esp, 0x14
test al, al
je 0x40de15
lea ecx, [esp + 0xf4]
push esi
call fcn.004304e0
lea esi, [esp + 0xb8]
mov ecx, esi
push ebx
call fcn.004299aa
movzx eax, byte [esp + 0xc3]
mov ecx, esi
test al, al
jns 0x40dd56
mov ecx, dword [esp + 0xb8]
mov eax, dword [esp + 0xbc]
xor edx, edx
dec edx
test eax, eax
lea esi, [esp + 0x10]
je 0x40dd82
lea edx, [ecx + eax*2]
add edx, 0xfffffffe
add eax, eax
neg eax
cmp word [edx], 0x2e
je 0x40dd7e
add edx, 0xfffffffe
add eax, 2
jne 0x40dd6b
xor edx, edx
dec edx
jmp 0x40dd82
sub edx, ecx
sar edx, 1
mov ecx, edi
lea eax, [esp + 0xc4]
push eax
push edx
push 0
lea eax, [esp + 0xc4]
push eax
call fcn.004298c8
cmp byte [esp + 0xc3], 0
js 0x40ddba
mov word [esp + 0xb8], 0
mov byte [esp + 0xc3], 0
jmp 0x40ddf5
mov eax, dword [esp + 0xb8]
mov word [eax], 0
mov dword [esp + 0xbc], 0
cmp byte [esp + 0xc3], 0
jns 0x40ddf5
push dword [esp + 0xb8]
call fcn.004af3c6
add esp, 4
mov dword [esp + 0xc0], 0
mov eax, dword [esp + 0xa8]
mov dword [esp + 0xc0], eax
movsd xmm0, qword [esp + 0xa0]
movsd qword [esp + 0xb8], xmm0
cmp byte [esp + 0xb7], 0
jns 0x40de2e
push dword [esp + 0xac]
call fcn.004af3c6
add esp, 4
lea ecx, [esp + 0x148]
push ebx
call fcn.004443f0
mov ecx, esi
push ebx
call fcn.00430500
mov ecx, ebx
call fcn.004304c0
movzx eax, byte [esp + 0x1b]
test al, al
jns 0x40de57
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x40d88d
lea ebx, [esp + 0x10]
mov ecx, ebx
call fcn.004304c0
lea ecx, [esp + 0x148]
call fcn.00444300
lea ecx, [esp + 0xac]
mov dword [esp], ecx
lea eax, [esp + 0x10c]
push eax
call fcn.00429824
xor esi, esi
mov dword [esp + 0xa4], esi
mov dword [esp + 0xa0], esi
mov dword [esp + 0xa8], esi
lea ecx, [esp + 0x94]
push 0x4e3c76
call fcn.0040394a
lea ecx, [esp + 0x88]
call fcn.004303a0
lea ecx, [esp + 0x7c]
call fcn.004303a0
lea ecx, [esp + 0x70]
call fcn.004303a0
lea eax, [esp + 0xd0]
lea edi, [esp + 0x60]
push eax
push str.seflash_npflash_
push edi
call fcn.0040eb34
add esp, 0xc
mov ecx, edi
push str..dll
call fcn.00429ed8
mov ecx, dword [eax + 8]
mov dword [ebx + 8], ecx
movsd xmm0, qword [eax]
movsd qword [ebx], xmm0
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x40df1f
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0xdc]
push eax
push ebx
lea edi, [esp + 0x150]
push edi
call fcn.00430ee0
lea ecx, [esp + 0x88]
push edi
call fcn.00430500
mov ecx, edi
call fcn.004304c0
cmp byte [esp + 0x1b], 0
jns 0x40df5c
push dword [esp + 0x10]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x6b], 0
lea esi, [esp + 0x60]
jns 0x40df73
push dword [esp + 0x60]
call fcn.004af3c6
add esp, 4
lea eax, [esp + 0xc4]
push eax
push str.seflashppflash_
push esi
call fcn.0040eb34
add esp, 0xc
mov ecx, esi
push str..dll
call fcn.00429ed8
mov ecx, dword [eax + 8]
mov dword [esp + 0x18], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x10], xmm0
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
movzx eax, byte [esp + 0x1b]
test al, al
jns 0x40dfc3
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
jmp 0x40dfc7
lea edx, [esp + 0x10]
lea ecx, [esp + 0xdc]
push eax
push edx
push edi
call fcn.00430ee0
lea ecx, [esp + 0x7c]
push edi
call fcn.00430500
mov ecx, edi
call fcn.004304c0
cmp byte [esp + 0x1b], 0
jns 0x40dffa
push dword [esp + 0x10]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x6b], 0
jns 0x40e00d
push dword [esp + 0x60]
call fcn.004af3c6
add esp, 4
lea eax, [esp + 0xb8]
push eax
push str.seflash_axflash_
push esi
call fcn.0040eb34
add esp, 0xc
mov ecx, esi
push str..ocx
call fcn.00429ed8
mov ecx, dword [eax + 8]
mov dword [esp + 0x18], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x10], xmm0
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
movzx eax, byte [esp + 0x1b]
test al, al
jns 0x40e05d
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
jmp 0x40e061
lea edx, [esp + 0x10]
lea ecx, [esp + 0xdc]
push eax
push edx
push edi
call fcn.00430ee0
lea ecx, [esp + 0x70]
push edi
call fcn.00430500
mov ecx, edi
call fcn.004304c0
cmp byte [esp + 0x1b], 0
jns 0x40e094
push dword [esp + 0x10]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x6b], 0
jns 0x40e0a7
push dword [esp + 0x60]
call fcn.004af3c6
add esp, 4
mov ebx, 0x4e3d0a
lea esi, [esp + 0x20]
lea eax, [esp + 0xac]
push eax
push ebx
push esi
call fcn.0040eb34
add esp, 0xc
mov eax, 0x4e3d04
mov ecx, esi
push eax
call fcn.00429ed8
mov edx, dword [eax + 8]
lea ecx, [esp + 0x30]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
xor esi, esi
mov dword [eax], esi
mov dword [eax + 8], esi
mov dword [eax + 4], esi
push 0x4e3d26
call fcn.00429ed8
mov edx, dword [eax + 8]
lea ecx, [esp + 0x40]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
movzx eax, byte [esp + 0x9f]
test al, al
cmovs eax, dword [esp + 0x98]
mov edx, dword [esp + 0x94]
lea edi, [esp + 0x94]
cmovns edx, edi
push eax
push edx
call fcn.00429d18
mov edx, dword [eax + 8]
lea ecx, [esp + 0x50]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [eax], esi
mov dword [eax + 8], esi
mov dword [eax + 4], esi
push str._293_np__p
call fcn.00429ed8
mov edx, dword [eax + 8]
lea ecx, [esp + 0x60]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [eax], esi
mov dword [eax + 8], esi
mov dword [eax + 4], esi
push ebx
call fcn.00429ed8
mov edx, dword [eax + 8]
lea ecx, [esp + 0x10]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
movzx eax, byte [esp + 0x93]
test al, al
cmovs eax, dword [esp + 0x8c]
lea edx, [esp + 0x88]
cmovs edx, dword [esp + 0x88]
push eax
push edx
call fcn.00429d18
mov edx, dword [eax + 8]
lea ecx, [esp + 0x148]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [eax], esi
mov dword [eax + 8], esi
mov dword [eax + 4], esi
mov eax, 0x4e3d04
push eax
call fcn.00429ed8
mov edi, dword [eax]
mov ecx, dword [eax + 4]
mov edx, dword [eax + 7]
mov dword [esp + 0x133], edx
mov dword [esp + 0x130], ecx
mov bl, byte [eax + 0xb]
mov dword [eax + 4], esi
mov dword [eax], esi
mov dword [eax + 8], esi
cmp byte [esp + 0xab], 0
js 0x40e226
mov word [esp + 0xa0], 0
mov byte [esp + 0xab], 0
jmp 0x40e261
mov eax, dword [esp + 0xa0]
mov word [eax], 0
mov dword [esp + 0xa4], 0
cmp byte [esp + 0xab], 0
jns 0x40e261
push dword [esp + 0xa0]
call fcn.004af3c6
add esp, 4
mov dword [esp + 0xa8], 0
mov dword [esp + 0xa0], edi
mov eax, dword [esp + 0x130]
mov ecx, dword [esp + 0x133]
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa7], ecx
mov byte [esp + 0xab], bl
xor eax, eax
mov dword [esp + 0x130], eax
mov dword [esp + 0x133], eax
cmp byte [esp + 0x153], 0
jns 0x40e2b4
push dword [esp + 0x148]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x1b], 0
jns 0x40e2c7
push dword [esp + 0x10]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x6b], 0
jns 0x40e2da
push dword [esp + 0x60]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x5b], 0
jns 0x40e2ed
push dword [esp + 0x50]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x4b], 0
jns 0x40e300
push dword [esp + 0x40]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x3b], 0
jns 0x40e313
push dword [esp + 0x30]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x2b], 0
jns 0x40e326
push dword [esp + 0x20]
call fcn.004af3c6
add esp, 4
xorps xmm0, xmm0
movups xmmword [esp + 0x17c], xmm0
movups xmmword [esp + 0x16c], xmm0
movups xmmword [esp + 0x15c], xmm0
movups xmmword [esp + 0x14c], xmm0
mov dword [esp + 0x148], 0x44
movaps xmmword [esp + 0x10], xmm0
cmp byte [esp + 0xab], 0
jns 0x40e36c
mov eax, dword [esp + 0xa0]
jmp 0x40e373
lea eax, [esp + 0xa0]
sub esp, 0x28
lea ecx, [esp + 0x38]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x170]
mov dword [esp + 0x20], ecx
xor esi, esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40e3d2
cmp byte [esp + 0xb7], 0
jns 0x40e3c9
mov eax, dword [esp + 0xac]
mov dword [esp], eax
push dword [esp]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ebx, [esp + 0xac]
mov ecx, ebx
lea eax, [esp + 0x100]
push eax
call fcn.004299aa
mov eax, 0x4e3d0a
lea edi, [esp + 4]
push ebx
push eax
push edi
call fcn.0040eb34
add esp, 0xc
mov ebx, 0x4e3d04
mov ecx, edi
push ebx
call fcn.00429ed8
mov edx, dword [eax + 8]
lea ecx, [esp + 0x130]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [eax], esi
mov dword [eax + 8], esi
mov dword [eax + 4], esi
push 0x4e3d26
call fcn.00429ed8
mov edx, dword [eax + 8]
lea ecx, [esp + 0x20]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
movzx eax, byte [esp + 0x9f]
test al, al
cmovs eax, dword [esp + 0x98]
mov edx, dword [esp + 0x94]
lea edi, [esp + 0x94]
cmovns edx, edi
push eax
push edx
call fcn.00429d18
mov edx, dword [eax + 8]
lea ecx, [esp + 0x30]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [eax], esi
mov dword [eax + 8], esi
mov dword [eax + 4], esi
push str._293_pp__p
call fcn.00429ed8
mov edx, dword [eax + 8]
lea ecx, [esp + 0x40]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [eax], esi
mov dword [eax + 8], esi
mov dword [eax + 4], esi
mov eax, 0x4e3d0a
push eax
call fcn.00429ed8
mov edx, dword [eax + 8]
lea ecx, [esp + 0x50]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
movzx eax, byte [esp + 0x87]
test al, al
cmovs eax, dword [esp + 0x80]
lea edx, [esp + 0x7c]
cmovs edx, dword [esp + 0x7c]
push eax
push edx
call fcn.00429d18
mov edx, dword [eax + 8]
lea ecx, [esp + 0x60]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [eax], esi
mov dword [eax + 8], esi
mov dword [eax + 4], esi
push ebx
call fcn.00429ed8
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov edx, dword [eax + 7]
mov dword [esp + 0x143], edx
mov dword [esp + 0x140], ecx
mov cl, byte [eax + 0xb]
mov byte [esp], cl
mov dword [eax + 4], esi
mov dword [eax], esi
mov dword [eax + 8], esi
lea eax, [esp + 0xa4]
cmp byte [eax + 7], 0
js 0x40e55e
mov word [esp + 0xa0], 0
mov byte [esp + 0xab], 0
jmp 0x40e599
mov eax, dword [esp + 0xa0]
mov word [eax], 0
mov dword [esp + 0xa4], 0
cmp byte [esp + 0xab], 0
jns 0x40e599
push dword [esp + 0xa0]
call fcn.004af3c6
add esp, 4
mov dword [esp + 0xa8], 0
mov dword [esp + 0xa0], ebx
mov eax, dword [esp + 0x140]
mov ecx, dword [esp + 0x143]
lea edx, [esp + 0xa4]
mov dword [edx + 3], ecx
mov dword [edx], eax
mov al, byte [esp]
mov byte [esp + 0xab], al
xor eax, eax
mov dword [esp + 0x140], eax
mov dword [esp + 0x143], eax
cmp byte [esp + 0x6b], 0
jns 0x40e5e7
push dword [esp + 0x60]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x5b], 0
jns 0x40e5fa
push dword [esp + 0x50]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x4b], 0
jns 0x40e60d
push dword [esp + 0x40]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x3b], 0
jns 0x40e620
push dword [esp + 0x30]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x2b], 0
jns 0x40e633
push dword [esp + 0x20]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x13b], 0
jns 0x40e64c
push dword [esp + 0x130]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0xf], 0
jns 0x40e65f
push dword [esp + 4]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0xab], 0
jns 0x40e672
mov eax, dword [esp + 0xa0]
jmp 0x40e679
lea eax, [esp + 0xa0]
sub esp, 0x28
lea ecx, [esp + 0x38]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x170]
mov dword [esp + 0x20], ecx
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40e6dd
cmp byte [esp + 0xb7], 0
lea eax, [esp + 0xac]
jns 0x40e6d6
mov eax, dword [esp + 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [esp + 0xac]
mov ecx, esi
lea eax, [esp + 0xf4]
push eax
call fcn.004299aa
mov edi, 0x4e3d0a
push esi
push edi
lea esi, [esp + 0xc]
push esi
call fcn.0040eb34
add esp, 0xc
mov eax, 0x4e3d04
mov ecx, esi
push eax
mov esi, 0x4e3d04
call fcn.00429ed8
mov edx, dword [eax + 8]
lea ecx, [esp + 0x130]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [eax + 4], ebx
push 0x4e3d26
call fcn.00429ed8
mov edx, dword [eax + 8]
lea ecx, [esp + 0x20]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
movzx eax, byte [esp + 0x9f]
test al, al
cmovs eax, dword [esp + 0x98]
lea edx, [esp + 0x94]
cmovs edx, dword [esp + 0x94]
push eax
push edx
call fcn.00429d18
mov edx, dword [eax + 8]
lea ecx, [esp + 0x30]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [eax + 4], ebx
push str._293_ax__p
call fcn.00429ed8
mov edx, dword [eax + 8]
lea ecx, [esp + 0x40]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [eax + 4], ebx
push edi
call fcn.00429ed8
mov edx, dword [eax + 8]
lea ecx, [esp + 0x50]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
movzx eax, byte [esp + 0x7b]
test al, al
cmovs eax, dword [esp + 0x74]
lea edx, [esp + 0x70]
cmovs edx, dword [esp + 0x70]
push eax
push edx
call fcn.00429d18
mov edx, dword [eax + 8]
lea ecx, [esp + 0x60]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [eax + 4], ebx
push esi
call fcn.00429ed8
mov edi, dword [eax]
mov ecx, dword [eax + 4]
mov edx, dword [eax + 7]
mov dword [esp + 0x143], edx
mov dword [esp + 0x140], ecx
mov cl, byte [eax + 0xb]
mov byte [esp], cl
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [eax + 8], ebx
cmp byte [esp + 0xab], 0
js 0x40e85e
mov word [esp + 0xa0], 0
mov byte [esp + 0xab], 0
jmp 0x40e899
mov eax, dword [esp + 0xa0]
mov word [eax], 0
mov dword [esp + 0xa4], 0
cmp byte [esp + 0xab], 0
jns 0x40e899
push dword [esp + 0xa0]
call fcn.004af3c6
add esp, 4
mov dword [esp + 0xa8], 0
mov dword [esp + 0xa0], edi
mov eax, dword [esp + 0x140]
mov ecx, dword [esp + 0x143]
lea edx, [esp + 0xa4]
mov dword [edx + 3], ecx
mov dword [edx], eax
mov al, byte [esp]
mov byte [esp + 0xab], al
xor eax, eax
mov dword [esp + 0x140], eax
mov dword [esp + 0x143], eax
cmp byte [esp + 0x6b], 0
jns 0x40e8e7
push dword [esp + 0x60]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x5b], 0
jns 0x40e8fa
push dword [esp + 0x50]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x4b], 0
jns 0x40e90d
push dword [esp + 0x40]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x3b], 0
jns 0x40e920
push dword [esp + 0x30]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x2b], 0
jns 0x40e933
push dword [esp + 0x20]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0x13b], 0
jns 0x40e94c
push dword [esp + 0x130]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0xf], 0
jns 0x40e95f
push dword [esp + 4]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0xab], 0
jns 0x40e972
mov eax, dword [esp + 0xa0]
jmp 0x40e979
lea eax, [esp + 0xa0]
sub esp, 0x28
lea ecx, [esp + 0x38]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x170]
mov dword [esp + 0x20], ecx
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40e9dd
cmp byte [esp + 0xb7], 0
lea eax, [esp + 0xac]
jns 0x40e9d6
mov eax, dword [esp + 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x118]
push eax
call fcn.0043ecc0
add esp, 4
lea ecx, [esp + 0x70]
call fcn.004304c0
lea ecx, [esp + 0x7c]
call fcn.004304c0
lea ecx, [esp + 0x88]
call fcn.004304c0
cmp byte [esp + 0x9f], 0
jns 0x40ea2f
push dword [esp + 0x94]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0xab], 0
jns 0x40ea48
push dword [esp + 0xa0]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0xb7], 0
jns 0x40ea61
push dword [esp + 0xac]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0xc3], 0
jns 0x40ea7a
push dword [esp + 0xb8]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0xcf], 0
jns 0x40ea93
push dword [esp + 0xc4]
call fcn.004af3c6
add esp, 4
cmp byte [esp + 0xdb], 0
jns 0x40eaac
push dword [esp + 0xd0]
call fcn.004af3c6
add esp, 4
lea ecx, [esp + 0xdc]
call fcn.004304c0
cmp byte [esp + 0xf3], 0
jns 0x40ead1
push dword [esp + 0xe8]
call fcn.004af3c6
add esp, 4
lea ecx, [esp + 0xf4]
call fcn.004304c0
lea ecx, [esp + 0x100]
call fcn.004304c0
lea ecx, [esp + 0x10c]
call fcn.004304c0
lea ecx, [esp + 0x118]
call fcn.004304c0
mov bl, 1
cmp byte [esp + 0x12f], 0
jns 0x40eb1c
push dword [esp + 0x124]
call fcn.004af3c6
add esp, 4
mov ecx, dword [esp + 0x5e8]
xor ecx, ebp
call fcn.004af401
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret