Function at 0x4fab88
Capabilities:
Check for time delay via gettickcount
Copy file
Create process on windows
Get common file path
Move file
Persist via lnk shortcut
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x33
push 0
push 0
dec ecx
jne 0x4fab90
push ecx
push ebx
push esi
push edi
mov eax, 0x4fa3f0
call fcn.00406dd8
mov ebx, dword [0x53ec70]
xor eax, eax
push ebp
push 0x4fbf8f
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [0x53eee8]
mov eax, dword [eax]
call fcn.00409ae8
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00408e1c
mov eax, dword [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov eax, 2
call fcn.004ab720
mov edx, dword [ebp - 0x1c]
pop eax
call fcn.004049d0
jne 0x4fabf9
mov eax, dword [0x53e8d0]
mov byte [eax], 0
jmp 0x4fac01
mov eax, dword [0x53e8d0]
mov byte [eax], 1
lea edx, [ebp - 0x24]
mov eax, 1
call fcn.00402aa0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408e58
mov edx, dword [ebp - 0x20]
mov eax, dword [0x53eac8]
call fcn.0040460c
lea edx, [ebp - 0x2c]
mov eax, 2
call fcn.00402aa0
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00408e58
mov edx, dword [ebp - 0x28]
mov eax, dword [0x53eb3c]
call fcn.0040460c
mov eax, dword [0x53e8d0]
cmp byte [eax], 0
jne 0x4fac71
lea edx, [ebp - 0x30]
mov eax, 0x11c
call fcn.004ab720
mov edx, dword [ebp - 0x30]
mov eax, dword [0x53e904]
call fcn.0040460c
jmp 0x4fac9a
lea edx, [ebp - 0x38]
mov eax, dword [0x53eee8]
mov eax, dword [eax]
call fcn.00409ae8
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x34]
xor edx, edx
call fcn.00409a20
mov edx, dword [ebp - 0x34]
mov eax, dword [0x53e904]
call fcn.0040460c
push 0x4fbfa8
mov eax, dword [0x53eee8]
push dword [eax]
push 0x4fbfb4
mov eax, dword [0x53ebc4]
mov edx, 3
call fcn.0040494c
mov eax, dword [0x53eac8]
mov eax, dword [eax]
mov edx, 0x4fbfc4
call fcn.004049d0
jne 0x4fad6d
fld xword [0x4fbfc8]
mov eax, dword [0x53e9b0]
fcomp qword [eax]
fnstsw ax
sahf
jae 0x4fad6d
call fcn.0046aebc
test al, al
jne 0x4fad6d
call fcn.0040b0b8
call fcn.00402b8c
push edx
push eax
lea eax, [ebp - 0x3c]
call fcn.00409420
mov edx, dword [ebp - 0x3c]
mov eax, dword [0x53eb3c]
call fcn.0040460c
lea edx, [ebp - 0x40]
mov eax, dword [0x53eee8]
mov eax, dword [eax]
call fcn.0046dc98
mov eax, dword [ebp - 0x40]
call fcn.00404a84
push eax
mov eax, dword [0x53eac8]
push dword [eax]
push 0x4fbfdc
mov eax, dword [0x53eb3c]
push dword [eax]
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.0040494c
mov eax, dword [ebp - 0x44]
call fcn.00404a84
push eax
mov eax, dword [0x53eee8]
mov eax, dword [eax]
call fcn.00404a84
mov edx, eax
xor eax, eax
pop ecx
call fcn.0046af38
jmp 0x4fbf3b
lea edx, [ebp - 0x48]
mov eax, dword [ebx]
call fcn.00408e1c
mov edx, dword [ebp - 0x48]
mov eax, 0x547b30
call fcn.0040460c
mov eax, dword [0x547b30]
call fcn.0046305c
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x4c]
call fcn.00409420
mov eax, dword [ebp - 0x4c]
push eax
lea edx, [ebp - 0x50]
mov eax, 0x33
call fcn.004ab720
mov edx, dword [ebp - 0x50]
mov eax, 0x547b2c
pop ecx
call fcn.004048d8
mov dl, 1
mov eax, dword [0x462e64]
call fcn.0040377c
mov dword [0x53e3c8], eax
mov edx, dword [0x547b2c]
mov eax, dword [0x53e3c8]
call fcn.00462f08
test eax, eax
jne 0x4faf7c
mov eax, 0x4fbfe0
xor edx, edx
call fcn.0047116c
mov ebx, eax
test ebx, ebx
je 0x4fbedc
mov eax, dword [0x53eac8]
mov eax, dword [eax]
mov edx, 0x4fbff4
call fcn.004049d0
jne 0x4fae1f
push 0
push 0
push 0x702
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4fbedc
mov eax, dword [0x53eac8]
mov eax, dword [eax]
mov edx, 0x4fc000
call fcn.004049d0
jne 0x4fae46
push 0
push 3
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4fbedc
mov eax, dword [0x53eac8]
mov eax, dword [eax]
mov edx, 0x4fc010
call fcn.004049d0
jne 0x4fae6d
push 0
push 4
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4fbedc
mov eax, dword [0x53eac8]
mov eax, dword [eax]
mov edx, 0x4fc020
call fcn.004049d0
jne 0x4fae94
push 0
push 0
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4fbedc
mov eax, dword [0x53eac8]
mov eax, dword [eax]
mov edx, 0x4fc02c
call fcn.004049d0
jne 0x4faf5b
mov edx, dword [0x53eb3c]
mov eax, 2
call fcn.00402aa0
mov eax, dword [0x53eb3c]
cmp dword [eax], 0
jne 0x4faed4
mov eax, dword [0x53eb3c]
mov edx, 0x4fbfdc
call fcn.0040460c
push 0
push 2
push 0x604
push ebx
call sub.user32.dll_PostMessageA
mov eax, dword [0x53eb3c]
mov eax, dword [eax]
call fcn.0040488c
mov esi, eax
lea eax, [esi + 3]
push eax
mov eax, 0x547b28
mov ecx, 1
mov edx, dword [0x4fa3a4]
call fcn.00405f1c
add esp, 4
mov eax, dword [0x53eb3c]
call fcn.00404adc
mov edx, eax
mov eax, dword [0x547b28]
call fcn.00409d50
mov edi, dword [0x547b28]
test esi, esi
jle 0x4faf47
mov eax, dword [edi]
push eax
push 2
push 0x604
push ebx
call sub.user32.dll_PostMessageA
add edi, 4
sub esi, 4
test esi, esi
jg 0x4faf2d
push 0
push 1
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4fbedc
mov eax, dword [0x53e7c0]
mov eax, dword [eax]
push eax
mov eax, dword [0x53e8e8]
movzx eax, byte [eax]
push eax
push 0x600
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4fbedc
lea edx, [ebp - 0x58]
mov eax, dword [0x53eee8]
mov eax, dword [eax]
call fcn.00409ae8
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x54]
xor edx, edx
call fcn.00409a20
mov edx, dword [ebp - 0x54]
mov eax, dword [0x53ee28]
call fcn.0040460c
mov eax, dword [0x53ede8]
mov dword [eax], 0x6562
lea edx, [ebp - 0x5c]
xor eax, eax
call fcn.00471e08
mov edx, dword [ebp - 0x5c]
mov eax, dword [0x53edc8]
call fcn.0040460c
lea edx, [ebp - 0x60]
xor eax, eax
call fcn.00471e08
mov edx, dword [ebp - 0x60]
mov eax, dword [0x53eabc]
call fcn.0040460c
call fcn.00402b00
lea edx, [ebp - 0x64]
mov eax, 0x3e
call fcn.004ab720
mov ecx, dword [ebp - 0x64]
mov edx, dword [ebx]
mov eax, dword [0x53e4c0]
call fcn.004048d8
lea edx, [ebp - 0x68]
mov eax, 0x3c
call fcn.004ab720
mov ecx, dword [ebp - 0x68]
mov edx, dword [ebx]
mov eax, dword [0x53eed0]
call fcn.004048d8
lea edx, [ebp - 0x6c]
mov eax, 0x3d
call fcn.004ab720
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ebx]
mov eax, dword [0x53eb80]
call fcn.004048d8
lea edx, [ebp - 0x70]
mov eax, 0x34
call fcn.004ab720
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebx]
mov eax, dword [0x53e9e8]
call fcn.004048d8
lea edx, [ebp - 0x74]
mov eax, 0x36
call fcn.004ab720
mov ecx, dword [ebp - 0x74]
mov edx, dword [ebx]
mov eax, dword [0x53e6d0]
call fcn.004048d8
lea edx, [ebp - 0x78]
mov eax, 0x3b
call fcn.004ab720
mov ecx, dword [ebp - 0x78]
mov edx, dword [ebx]
mov eax, dword [0x53ee58]
call fcn.004048d8
lea edx, [ebp - 0x7c]
mov eax, 4
call fcn.004ab720
mov ecx, dword [ebp - 0x7c]
mov edx, dword [ebx]
mov eax, dword [0x53e7f8]
call fcn.004048d8
lea edx, [ebp - 0x80]
mov eax, 0x7b
call fcn.004ab720
mov ecx, dword [ebp - 0x80]
mov edx, dword [ebx]
mov eax, dword [0x53ee34]
call fcn.004048d8
lea edx, [ebp - 0x84]
mov eax, 3
call fcn.004ab720
mov ecx, dword [ebp - 0x84]
mov edx, dword [ebx]
mov eax, dword [0x53ecb8]
call fcn.004048d8
lea edx, [ebp - 0x88]
mov eax, dword [0x53eee8]
mov eax, dword [eax]
call fcn.00408e1c
mov edx, dword [ebp - 0x88]
mov eax, 0x547b00
call fcn.0040460c
push 0x104
mov eax, dword [0x53e8dc]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
cmp eax, 2
jb 0x4fb1b2
lea edx, [ebp - 0x8c]
mov eax, dword [0x53e8dc]
call fcn.00409f50
mov edx, dword [ebp - 0x8c]
mov eax, dword [0x53e5f4]
call fcn.0040460c
mov eax, dword [0x53e5f4]
mov eax, dword [eax]
call fcn.0040488c
cmp eax, 3
jle 0x4fb165
mov eax, dword [0x53e5f4]
mov edx, 0x4fc038
call fcn.00404894
mov eax, dword [0x53e5f4]
lea edx, [ebp - 0x90]
mov eax, 0x70
call fcn.004ab720
mov ecx, dword [ebp - 0x90]
mov edx, dword [0x53e5f4]
mov edx, dword [edx]
mov eax, dword [0x53e6b8]
call fcn.004048d8
mov eax, dword [0x53e5f4]
mov eax, dword [eax]
cmp byte [eax + 1], 0x3a
jne 0x4fb1ba
mov eax, dword [0x53e5f4]
mov eax, dword [eax]
mov al, byte [eax]
call fcn.00402b3c
mov edx, dword [0x53e8cc]
mov byte [edx], al
jmp 0x4fb1ba
mov eax, dword [0x53e8cc]
mov byte [eax], 0x43
push 0x104
mov eax, dword [0x53e8dc]
push eax
lea edx, [ebp - 0x94]
mov eax, 0x2e
call fcn.004ab720
mov eax, dword [ebp - 0x94]
call fcn.00404a84
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov eax, dword [0x53e8dc]
call fcn.00409f34
mov edx, eax
mov eax, 0x547b0c
call fcn.004047a8
mov eax, 0x547b0c
call fcn.0046a970
mov eax, dword [0x547b00]
cmp byte [eax], 0x5c
jne 0x4fb21a
mov eax, dword [0x53ecb4]
mov byte [eax], 2
jmp 0x4fb235
mov edx, dword [0x547b00]
mov eax, dword [0x547b0c]
call fcn.00404bc8
dec eax
jne 0x4fb235
mov eax, dword [0x53ecb4]
mov byte [eax], 1
lea eax, [ebp - 0x98]
call fcn.004712fc
mov edx, dword [ebp - 0x98]
mov eax, dword [0x53e4f8]
call fcn.0040460c
mov eax, dword [0x53eac8]
mov eax, dword [eax]
mov edx, 0x4fbfc4
call fcn.004049d0
jne 0x4fb296
lea edx, [ebp - 0x9c]
mov eax, 0x31
call fcn.004ab720
mov eax, dword [ebp - 0x9c]
push eax
lea edx, [ebp - 0xa0]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0xa0]
pop edx
call fcn.0046d0d8
mov eax, dword [0x53eac8]
mov eax, dword [eax]
mov edx, 0x4fc044
call fcn.004049d0
jne 0x4fb2b1
mov eax, dword [0x53e8e8]
mov byte [eax], 1
mov eax, dword [0x53eac8]
mov eax, dword [eax]
mov edx, 0x4fc050
call fcn.004049d0
je 0x4fb2db
mov eax, dword [0x53eb3c]
mov eax, dword [eax]
mov edx, 0x4fc050
call fcn.004049d0
je 0x4fb2db
xor eax, eax
jmp 0x4fb2dd
mov al, 1
test al, al
je 0x4fb309
mov eax, 0x7d0
call fcn.004d8720
mov eax, dword [0x53e7f8]
mov eax, dword [eax]
call fcn.0046dd20
test al, al
je 0x4fb31d
mov eax, dword [0x53e7f8]
mov eax, dword [eax]
call fcn.00409988
jmp 0x4fb31d
mov eax, dword [0x53e8e8]
cmp byte [eax], 1
jne 0x4fb31d
mov eax, 0x7d0
call fcn.004d8720
lea edx, [ebp - 0xa4]
mov eax, 0x32
call fcn.004ab720
mov eax, dword [ebp - 0xa4]
push eax
lea edx, [ebp - 0xa8]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0xa8]
pop edx
call fcn.0046ce5c
sub eax, 0x7d0
mov dword [0x53e3cc], eax
lea edx, [ebp - 0xac]
mov eax, 0x76
call fcn.004ab720
mov eax, dword [ebp - 0xac]
push eax
lea edx, [ebp - 0xb0]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0xb0]
pop edx
call fcn.0046d304
test al, al
je 0x4fb3ce
lea edx, [ebp - 0xb4]
mov eax, 0x76
call fcn.004ab720
mov eax, dword [ebp - 0xb4]
push eax
lea edx, [ebp - 0xb8]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0xb8]
pop edx
call fcn.0046ce5c
mov edx, dword [0x53e7c0]
mov dword [edx], eax
jmp 0x4fb3d9
mov eax, dword [0x53e7c0]
mov dword [eax], 0x1f40
mov eax, dword [0x53ecb4]
cmp byte [eax], 1
je 0x4fb61f
lea edx, [ebp - 0xc0]
mov eax, 0x31
call fcn.004ab720
mov eax, dword [ebp - 0xc0]
push eax
lea edx, [ebp - 0xc4]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xbc]
pop edx
call fcn.0046c514
mov edx, dword [ebp - 0xbc]
mov eax, 0x547afc
call fcn.0040460c
lea edx, [ebp - 0xcc]
mov eax, 0x11b
call fcn.004ab720
mov eax, dword [ebp - 0xcc]
push eax
lea edx, [ebp - 0xd0]
mov eax, 0x13
call fcn.004ab720
mov eax, dword [ebp - 0xd0]
lea ecx, [ebp - 0xc8]
pop edx
call fcn.0046c514
mov edx, dword [ebp - 0xc8]
mov eax, 0x547af8
call fcn.0040460c
cmp dword [0x547af8], 0
je 0x4fb4c1
mov eax, 0x547afc
call fcn.004045b8
lea edx, [ebp - 0xd4]
mov eax, 0x11b
call fcn.004ab720
mov eax, dword [ebp - 0xd4]
push eax
lea edx, [ebp - 0xd8]
mov eax, 0x13
call fcn.004ab720
mov eax, dword [ebp - 0xd8]
pop edx
call fcn.0046d0d8
jmp 0x4fb4fa
lea edx, [ebp - 0xe0]
mov eax, 0x13
call fcn.004ab720
mov eax, dword [ebp - 0xe0]
lea ecx, [ebp - 0xdc]
mov edx, dword [0x53e904]
mov edx, dword [edx]
call fcn.0046c514
mov edx, dword [ebp - 0xdc]
mov eax, 0x547af8
call fcn.0040460c
mov eax, dword [0x547afc]
mov edx, 0x4fc05c
call fcn.004049d0
jne 0x4fb530
cmp dword [0x547af8], 0
je 0x4fb61f
mov eax, dword [0x547af8]
mov edx, dword [0x53ebc4]
mov edx, dword [edx]
call fcn.004049d0
je 0x4fb61f
lea edx, [ebp - 0xe4]
mov eax, 0x31
call fcn.004ab720
mov eax, dword [ebp - 0xe4]
push eax
lea edx, [ebp - 0xe8]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0xe8]
mov ecx, 0x4fc05c
pop edx
call fcn.0046c2e8
lea edx, [ebp - 0xec]
mov eax, 0x124
call fcn.004ab720
push dword [ebp - 0xec]
push 0x4fc038
mov eax, dword [0x53e904]
push dword [eax]
push 0x4fc068
mov eax, 0x547b24
mov edx, 4
call fcn.0040494c
mov eax, 0x547b24
call fcn.004da9c4
lea edx, [ebp - 0xf0]
mov eax, 0x13
call fcn.004ab720
mov eax, dword [ebp - 0xf0]
mov ecx, dword [0x53ebc4]
mov ecx, dword [ecx]
mov edx, dword [0x53e904]
mov edx, dword [edx]
call fcn.0046c2e8
test al, al
je 0x4fb5e3
mov eax, dword [0x547b24]
call fcn.00409988
jmp 0x4fb61f
lea edx, [ebp - 0xf4]
mov eax, 0x13
call fcn.004ab720
mov eax, dword [ebp - 0xf4]
mov edx, dword [0x53e904]
mov edx, dword [edx]
call fcn.0046d0d8
push 0
mov eax, dword [0x53eee8]
mov eax, dword [eax]
mov ecx, dword [0x547b24]
mov edx, 0x4fc044
call fcn.004d8820
lea edx, [ebp - 0xf8]
mov eax, 0x11b
call fcn.004ab720
mov eax, dword [ebp - 0xf8]
push eax
lea edx, [ebp - 0xfc]
mov eax, 0x13
call fcn.004ab720
mov eax, dword [ebp - 0xfc]
pop edx
call fcn.0046d0d8
lea edx, [ebp - 0x100]
mov eax, 0x25
call fcn.004ab720
mov eax, dword [ebp - 0x100]
push eax
lea edx, [ebp - 0x104]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0x104]
pop edx
call fcn.0046d0d8
lea edx, [ebp - 0x108]
mov eax, 0x26
call fcn.004ab720
mov eax, dword [ebp - 0x108]
push eax
lea edx, [ebp - 0x10c]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0x10c]
pop edx
call fcn.0046d0d8
mov edx, dword [ebx]
mov eax, dword [0x53eb70]
mov ecx, 0x4fc078
call fcn.004048d8
lea edx, [ebp - 0x110]
mov eax, 0x77
call fcn.004ab720
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebx]
mov eax, dword [0x53ea38]
call fcn.004048d8
lea edx, [ebp - 0x114]
mov eax, 0x78
call fcn.004ab720
mov ecx, dword [ebp - 0x114]
mov edx, dword [ebx]
mov eax, dword [0x53e5a8]
call fcn.004048d8
mov eax, dword [0x53ecb4]
cmp byte [eax], 2
jne 0x4fb988
lea edx, [ebp - 0x118]
mov eax, 0x1a
call fcn.004ab720
mov ecx, dword [ebp - 0x118]
mov eax, 0x547b08
mov edx, dword [0x547b0c]
call fcn.004048d8
lea edx, [ebp - 0x120]
mov eax, 0x1a
call fcn.004ab720
mov ecx, dword [ebp - 0x120]
mov edx, dword [ebx]
lea eax, [ebp - 0x11c]
call fcn.004048d8
mov edx, dword [ebp - 0x11c]
mov eax, dword [0x547b08]
call fcn.004f9fe8
mov eax, 0x547b08
mov ecx, 0x4fc078
mov edx, dword [0x547b0c]
call fcn.004048d8
mov edx, dword [0x53eb70]
mov edx, dword [edx]
mov eax, dword [0x547b08]
call fcn.004f9fe8
lea edx, [ebp - 0x124]
mov eax, 0x77
call fcn.004ab720
mov ecx, dword [ebp - 0x124]
mov eax, 0x547b08
mov edx, dword [0x547b0c]
call fcn.004048d8
mov edx, dword [0x53ea38]
mov edx, dword [edx]
mov eax, dword [0x547b08]
call fcn.004f9fe8
lea edx, [ebp - 0x128]
mov eax, 0x78
call fcn.004ab720
mov ecx, dword [ebp - 0x128]
mov eax, 0x547b08
mov edx, dword [0x547b0c]
call fcn.004048d8
mov edx, dword [0x53e5a8]
mov edx, dword [edx]
mov eax, dword [0x547b08]
call fcn.004f9fe8
lea edx, [ebp - 0x12c]
mov eax, 0x3e
call fcn.004ab720
mov ecx, dword [ebp - 0x12c]
mov edx, dword [ebx]
mov eax, 0x547b10
call fcn.004048d8
lea edx, [ebp - 0x130]
mov eax, 0x3e
call fcn.004ab720
mov ecx, dword [ebp - 0x130]
mov eax, 0x547b14
mov edx, dword [0x547b0c]
call fcn.004048d8
mov edx, dword [0x547b10]
mov eax, dword [0x547b14]
call fcn.004f9fe8
lea edx, [ebp - 0x134]
mov eax, 0x34
call fcn.004ab720
mov ecx, dword [ebp - 0x134]
mov edx, dword [ebx]
mov eax, 0x547b10
call fcn.004048d8
lea edx, [ebp - 0x138]
mov eax, 0x34
call fcn.004ab720
mov ecx, dword [ebp - 0x138]
mov eax, 0x547b14
mov edx, dword [0x547b0c]
call fcn.004048d8
mov edx, dword [0x547b10]
mov eax, dword [0x547b14]
call fcn.004f9fe8
lea edx, [ebp - 0x13c]
mov eax, 0x3c
call fcn.004ab720
mov ecx, dword [ebp - 0x13c]
mov edx, dword [ebx]
mov eax, 0x547b10
call fcn.004048d8
lea edx, [ebp - 0x140]
mov eax, 0x3c
call fcn.004ab720
mov ecx, dword [ebp - 0x140]
mov eax, 0x547b14
mov edx, dword [0x547b0c]
call fcn.004048d8
mov edx, dword [0x547b10]
mov eax, dword [0x547b14]
call fcn.004f9fe8
lea edx, [ebp - 0x144]
mov eax, 1
call fcn.004ab720
mov ecx, dword [ebp - 0x144]
mov eax, 0x547b04
mov edx, dword [0x547b0c]
call fcn.004048d8
push 0
mov eax, dword [0x547b04]
call fcn.00404a84
mov esi, eax
push esi
mov eax, dword [0x547b00]
call fcn.00404a84
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x4fb988
push 1
mov eax, 0x547b0c
call fcn.00404adc
push eax
mov eax, dword [0x53eac8]
mov eax, dword [eax]
call fcn.00404a84
push eax
push esi
push 0x4fc084
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x4fbedc
lea edx, [ebp - 0x148]
mov eax, 0x79
call fcn.004ab720
mov edx, dword [ebp - 0x148]
mov ecx, dword [0x53eb08]
mov ecx, dword [ecx]
mov eax, dword [0x53edb8]
call fcn.004048d8
lea edx, [ebp - 0x14c]
mov eax, 0x7a
call fcn.004ab720
mov eax, dword [ebp - 0x14c]
push eax
lea edx, [ebp - 0x150]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0x150]
pop edx
call fcn.0046ce5c
mov edx, dword [0x53e698]
mov dword [edx], eax
call fcn.004f4ee4
mov eax, dword [0x53e698]
cmp dword [eax], 0
jne 0x4fbca4
mov eax, dword [0x53e8e8]
cmp byte [eax], 1
jne 0x4fbca4
mov eax, dword [0x53ecb4]
cmp byte [eax], 0
jne 0x4fbca4
mov eax, dword [0x53e52c]
cmp dword [eax], 0
je 0x4fbb32
mov eax, dword [0x53e52c]
mov eax, dword [eax]
call fcn.00462e1c
test al, al
jne 0x4fba70
lea edx, [ebp - 0x154]
mov eax, 0x7c
call fcn.004ab720
mov eax, dword [ebp - 0x154]
push eax
lea edx, [ebp - 0x158]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0x158]
pop edx
call fcn.0046ce5c
call fcn.004d8720
mov eax, dword [0x53e52c]
mov eax, dword [eax]
call fcn.00462e1c
test al, al
je 0x4fbb32
call fcn.004fa13c
test al, al
je 0x4fbb32
lea edx, [ebp - 0x15c]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0x15c]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4fc094
pop eax
call fcn.0046cc38
lea edx, [ebp - 0x160]
mov eax, 0x11a
call fcn.004ab720
mov eax, dword [ebp - 0x160]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4fc0a8
pop eax
call fcn.0046cc38
call sub.kernel32.dll_GetTickCount
mov ebx, eax
add ebx, 0x7d0
jmp 0x4fbaf9
push 0x64
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount
cmp ebx, eax
ja 0x4fbaf2
push 1
mov edx, dword [0x53e7f8]
mov edx, dword [edx]
lea eax, [ebp - 0x164]
mov ecx, 0x4fc0c0
call fcn.004048d8
mov eax, dword [ebp - 0x164]
call fcn.00404a84
push eax
call sub.kernel32.dll_WinExec
jmp 0x4fbedc
lea edx, [ebp - 0x16c]
mov eax, 0xb
call fcn.004ab720
mov ecx, dword [ebp - 0x16c]
mov edx, dword [ebx]
lea eax, [ebp - 0x168]
call fcn.004048d8
mov eax, dword [ebp - 0x168]
call fcn.0046dd20
test al, al
je 0x4fbca4
mov dl, 1
mov eax, dword [0x414ba8]
call fcn.0040377c
mov dword [0x547b18], eax
lea edx, [ebp - 0x178]
mov eax, 0xb
call fcn.004ab720
mov ecx, dword [ebp - 0x178]
mov edx, dword [ebx]
lea eax, [ebp - 0x174]
call fcn.004048d8
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 0x170]
call fcn.00404e90
mov eax, dword [ebp - 0x170]
push eax
mov eax, dword [0x547b18]
push eax
call fcn.0046e038
mov eax, dword [0x547b18]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4fbc9a
mov eax, dword [0x547b18]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
cmp esi, 0
jl 0x4fbc5e
lea ecx, [ebp - 0x17c]
mov edx, esi
mov eax, dword [0x547b18]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x17c]
mov eax, 0x547b20
call fcn.0040460c
lea edx, [ebp - 0x180]
mov eax, 0xa
call fcn.004ab720
mov ecx, dword [ebp - 0x180]
mov eax, 0x547b1c
mov edx, dword [0x547b20]
call fcn.004048d8
push 1
mov eax, 0x547b20
call fcn.00404adc
push eax
mov eax, 0x547b1c
call fcn.00404adc
push eax
call sub.kernel32.dll_MoveFileExA
test eax, eax
je 0x4fbc58
mov edx, esi
mov eax, dword [0x547b18]
mov ecx, dword [eax]
call dword [ecx + 0x48]
dec esi
cmp esi, 0xffffffff
jne 0x4fbbe3
mov eax, dword [0x547b18]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x4fbc9a
lea edx, [ebp - 0x188]
mov eax, 0xb
call fcn.004ab720
mov ecx, dword [ebp - 0x188]
mov edx, dword [ebx]
lea eax, [ebp - 0x184]
call fcn.004048d8
mov eax, dword [ebp - 0x184]
call fcn.00409988
mov eax, dword [0x547b18]
call fcn.004037ac
call fcn.004b0ec4
mov eax, dword [0x53e8e8]
cmp byte [eax], 1
je 0x4fbcbc
mov eax, dword [0x53e7c0]
xor edx, edx
mov dword [eax], edx
cmp dword [0x53e3cc], 0
jle 0x4fbd08
mov eax, dword [0x53e8e8]
cmp byte [eax], 1
jne 0x4fbd08
mov eax, dword [0x53e3cc]
call fcn.004d8720
mov eax, dword [0x53e7c0]
cmp dword [eax], 0
jle 0x4fbd08
mov eax, dword [0x53e7c0]
mov edx, dword [0x53e3cc]
sub dword [eax], edx
mov eax, dword [0x53e7c0]
cmp dword [eax], 0x7d0
jge 0x4fbd08
mov eax, dword [0x53e7c0]
mov dword [eax], 0x7d0
mov eax, dword [0x53ea24]
mov dword [eax], 0x20
lea eax, [ebp - 0x18c]
mov edx, dword [0x53eee8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x18c]
mov edx, dword [0x53ea24]
mov dx, word [edx]
call fcn.0046e0b0
mov edx, dword [0x53e81c]
mov dword [edx], eax
mov eax, dword [0x53e81c]
cmp dword [eax], 0
jne 0x4fbd85
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x190]
mov edx, dword [0x53eee8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x190]
mov edx, dword [0x53ea24]
mov dx, word [edx]
call fcn.0046e0b0
mov edx, dword [0x53e81c]
mov dword [edx], eax
mov eax, dword [0x53e81c]
cmp dword [eax], 0
jne 0x4fbdc8
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x194]
mov edx, dword [0x53eee8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x194]
mov edx, dword [0x53ea24]
mov dx, word [edx]
call fcn.0046e0b0
mov edx, dword [0x53e81c]
mov dword [edx], eax
mov eax, dword [0x53e81c]
cmp dword [eax], 0
jne 0x4fbe0b
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x198]
mov edx, dword [0x53eee8]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x198]
mov edx, dword [0x53ea24]
mov dx, word [edx]
call fcn.0046e0b0
mov edx, dword [0x53e81c]
mov dword [edx], eax
call sub.kernel32.dll_GetCurrentProcessId
mov edx, dword [0x53e484]
mov dword [edx], eax
mov eax, dword [0x53eb10]
mov eax, dword [eax]
call fcn.00448174
call fcn.004abf94
mov ecx, dword [0x53ec98]
mov eax, dword [0x53eb10]
mov eax, dword [eax]
mov edx, dword [0x4b6828]
call fcn.0044818c
mov ecx, dword [0x53ea54]
mov eax, dword [0x53eb10]
mov eax, dword [eax]
mov edx, dword [0x4b5748]
call fcn.0044818c
mov edx, dword [0x53edc8]
mov edx, dword [edx]
mov eax, dword [0x53ec98]
mov eax, dword [eax]
call fcn.00457798
mov ecx, dword [0x53e578]
mov eax, dword [0x53eb10]
mov eax, dword [eax]
mov edx, dword [0x4d59c0]
call fcn.0044818c
mov edx, dword [0x53eabc]
mov edx, dword [edx]
mov eax, dword [0x53e578]
mov eax, dword [eax]
call fcn.00457798
mov ecx, dword [0x53e6f8]
mov eax, dword [0x53eb10]
mov eax, dword [eax]
mov edx, dword [0x4aeb28]
call fcn.0044818c
mov eax, dword [0x53e578]
mov eax, dword [eax]
mov edx, dword [0x53ec98]
mov edx, dword [edx]
mov dword [edx + 0x314], eax
mov eax, dword [0x53eb10]
mov eax, dword [eax]
call fcn.0044820c
mov eax, dword [0x53e81c]
call fcn.0040e2d0
mov eax, 0x53e3c8
call fcn.0040e2d0
mov eax, dword [0x53e624]
cmp byte [eax], 0
je 0x4fbf26
push 1
push 0x4fc0c4
push 0x4fc0c4
lea edx, [ebp - 0x19c]
mov eax, dword [0x53eb10]
mov eax, dword [eax]
call fcn.004487f8
mov eax, dword [ebp - 0x19c]
call fcn.00404a84
push eax
push 0x4fc0c8
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.004b10f0
push 0x1341606
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fbf96
lea eax, [ebp - 0x19c]
call fcn.004045b8
lea eax, [ebp - 0x198]
mov edx, 4
call fcn.00404d08
lea eax, [ebp - 0x188]
mov edx, 6
call fcn.004045dc
lea eax, [ebp - 0x170]
call fcn.00404cf0
lea eax, [ebp - 0x16c]
mov edx, 0x57
call fcn.004045dc
ret