Function at 0x4074ae
Capabilities:
Acquire debug privileges
Check for time delay via gettickcount
Connect pipe
Create directory
Create pipe
Create process on windows
Encode data using base64
Get common file path
Parse credit card information
Persist via run registry key
Query environment variable
Read file on windows
Resume thread
Self delete
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
lea ebp, [esp - 0x60]
sub esp, 0x5c4
mov eax, dword [ebp + 0x70]
push ebx
push esi
push edi
push 0x20
xor ebx, ebx
cmp eax, ebx
pop esi
push 0x65
mov dword [ebp + 0x50], ecx
mov dword [ebp - 0x80], eax
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xd0], ebx
pop edi
je 0x40765f
lea eax, [ebp + 0x70]
push eax
call fcn.00431c97
pop ecx
mov ecx, dword [ebp + 0x70]
cmp ecx, ebx
je 0x40765f
cmp word [ecx], 0x2f
jne 0x40765f
mov dx, word [ecx + 2]
or dx, si
cmp dx, 0x69
jne 0x4075d0
mov ax, word [ecx + 4]
or ax, si
cmp ax, 0x6e
jne 0x4075d0
mov ax, word [ecx + 6]
or ax, si
cmp ax, 0x73
jne 0x4075d0
mov ax, word [ecx + 8]
or ax, si
cmp ax, 0x74
jne 0x4075d0
mov ax, word [ecx + 0xa]
or ax, si
cmp ax, 0x61
jne 0x4075d0
mov ax, word [ecx + 0xc]
or ax, si
cmp ax, 0x6c
jne 0x4075d0
mov ax, word [ecx + 0xe]
or ax, si
cmp ax, 0x6c
jne 0x4075d0
mov ax, word [ecx + 0x10]
or ax, si
cmp ax, 0x73
jne 0x4075d0
mov ax, word [ecx + 0x12]
or ax, si
cmp ax, di
jne 0x4075d0
mov ax, word [ecx + 0x14]
or ax, si
cmp ax, 0x72
jne 0x4075d0
mov ax, word [ecx + 0x16]
or ax, si
cmp ax, 0x76
jne 0x4075d0
mov ax, word [ecx + 0x18]
or ax, si
cmp ax, dx
jne 0x4075d0
mov ax, word [ecx + 0x1a]
or ax, si
cmp ax, 0x63
jne 0x4075d0
mov ax, word [ecx + 0x1c]
or ax, si
cmp ax, di
jne 0x4075d0
mov ax, word [ecx + 0x1e]
call fcn.00431c5f
test al, al
jne 0x407633
cmp dx, 0x73
jne 0x40765f
mov ax, word [ecx + 4]
or ax, si
cmp ax, di
jne 0x40765f
mov ax, word [ecx + 6]
or ax, si
cmp ax, 0x72
jne 0x40765f
mov ax, word [ecx + 8]
or ax, si
cmp ax, 0x76
jne 0x40765f
mov ax, word [ecx + 0xa]
or ax, si
cmp ax, 0x69
jne 0x40765f
mov ax, word [ecx + 0xc]
or ax, si
cmp ax, 0x63
jne 0x40765f
mov ax, word [ecx + 0xe]
or ax, si
cmp ax, di
jne 0x40765f
mov ax, word [ecx + 0x10]
call fcn.00431c5f
test al, al
je 0x40765f
mov esi, 0x4afbcc
push str.PECMD_EXEC
mov ecx, esi
call fcn.00441a80
push dword [ebp + 0x70]
mov ecx, esi
call fcn.004371ec
mov eax, dword [ebp + 0x50]
mov word [eax + 0x88], 2
jmp 0x40b297
mov eax, dword [ebp + 0x74]
xor edi, edi
inc edi
and eax, edi
mov dword [ebp + 0x24], eax
mov eax, dword [ebp + 0x74]
shr eax, 1
and eax, edi
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0x74]
shr eax, 2
and al, 1
lea ecx, [ebp - 0xf0]
mov byte [ebp + 0x33], bl
mov byte [ebp + 0x3b], bl
mov byte [ebp + 0x4f], al
call fcn.0043717e
cmp dword [ebp + 0x68], ebx
je 0x4076b6
push dword [ebp + 0x68]
lea ecx, [ebp - 0xf0]
call fcn.00441a80
mov eax, dword [ebp - 0xf0]
mov dword [ebp + 0x68], eax
lea eax, [ebp + 0x68]
push eax
call fcn.00431c97
pop ecx
lea ecx, [ebp - 0xf4]
call fcn.0043717e
mov eax, dword [ebp + 0x70]
cmp eax, ebx
je 0x4076dd
push eax
lea ecx, [ebp - 0xf4]
call fcn.00441a80
mov eax, dword [ebp - 0xf4]
mov dword [ebp + 0x70], eax
cmp dword [ebp + 0x78], ebx
jne 0x4076eb
lea ecx, [ebp - 0xc0]
mov dword [ebp + 0x78], ecx
mov ecx, dword [ebp + 0x68]
cmp ecx, ebx
push 0x5e
pop esi
mov dword [ebp + 0x10], ecx
mov dword [ebp - 0x150], esi
jne 0x40772c
cmp eax, ebx
mov dword [ebp + 0x68], eax
je 0x40772c
push 5
push eax
push str._shel
call fcn.00432c59
add esp, 0xc
test al, al
je 0x40772c
lea eax, [ebp - 0x150]
mov dword [ebp + 0x70], eax
mov dword [ebp + 0x24], edi
mov dword [ebp + 0x14], edi
mov byte [ebp + 0x4f], 1
lea ecx, [ebp - 0xdc]
mov byte [ebp + 0x77], bl
mov byte [ebp + 0x43], bl
mov byte [ebp - 9], 1
mov byte [ebp - 0x44], bl
mov byte [ebp + 0x1b], bl
mov byte [ebp - 0x47], bl
mov byte [ebp - 0x46], bl
mov byte [ebp + 0x40], bl
mov byte [ebp + 0x46], bl
mov byte [ebp - 0x45], bl
mov byte [ebp - 0x42], bl
call fcn.0043717e
lea ecx, [ebp - 0x100]
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x104], ebx
mov byte [ebp - 0x43], bl
mov byte [ebp + 0x44], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0x41], bl
mov byte [ebp - 0xa], 1
mov byte [ebp - 0x48], bl
mov dword [ebp - 0x10], ebx
mov dword [ebp + 4], ebx
call fcn.0043717e
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x5c], ebx
mov byte [ebp + 0x47], bl
call fcn.0043717e
lea ecx, [ebp - 0x9c]
call fcn.0043717e
lea ecx, [ebp - 0x60]
call fcn.0043717e
or dword [ebp - 0xb8], 0xffffffff
lea ecx, [ebp - 0x10c]
mov byte [ebp + 0x45], bl
mov byte [ebp + 0x41], bl
mov dword [ebp - 0xf8], ebx
call fcn.0043717e
xor eax, eax
push 0xf
pop ecx
mov dword [ebp - 0x234], 0x44
mov dword [ebp - 0x230], ebx
lea edi, [ebp - 0x22c]
rep stosd dword es:[edi], eax
push 0x11
mov dword [ebp - 0x140], ebx
pop ecx
lea edi, [ebp - 0x1f0]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x13c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x130]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x70]
cmp eax, ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp + 0x20], ebx
jne 0x40781e
mov byte [ebp + 0x41], 1
jmp 0x407878
cmp word [eax], 0x23
jne 0x407834
cmp eax, dword [ebp + 0x68]
jne 0x40782d
add dword [ebp + 0x68], 2
inc eax
inc eax
mov dword [ebp + 0x70], eax
jmp 0x407841
test byte [0x4b3003], 3
je 0x407841
mov byte [ebp + 0x41], 3
cmp eax, ebx
je 0x407878
cmp word [eax], si
jne 0x40785c
cmp eax, dword [ebp + 0x68]
jne 0x407853
add dword [ebp + 0x68], 2
inc eax
inc eax
mov dword [ebp + 0x70], eax
mov byte [ebp + 0x4f], 1
cmp eax, ebx
je 0x407878
cmp word [eax], 0x24
jne 0x407878
cmp eax, dword [ebp + 0x68]
jne 0x40786f
add dword [ebp + 0x68], 2
inc eax
inc eax
mov dword [ebp + 0x70], eax
mov byte [ebp + 0x46], 1
cmp eax, ebx
mov dword [ebp - 0x7c], ebx
je 0x40789b
cmp word [eax], 0x7c
jne 0x40789b
cmp eax, dword [ebp + 0x68]
jne 0x40788e
add dword [ebp + 0x68], 2
inc eax
inc eax
xor ecx, ecx
inc ecx
mov dword [ebp + 0x70], eax
mov dword [ebp - 0x7c], ecx
jmp 0x40789e
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x80]
cmp eax, ebx
je 0x40790a
cmp word [eax], 0x2a
jne 0x40790a
push 2
pop edx
add dword [ebp + 0x68], edx
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x7c
mov byte [ebp + 0x77], 0x10
jne 0x4078c4
add dword [ebp + 0x68], edx
mov dword [ebp - 0x7c], ecx
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
cmp ax, 0x31
jne 0x4078d6
mov byte [ebp + 0x77], 0x11
jmp 0x4078f1
mov esi, eax
or esi, 0x20
cmp si, 0x6e
jne 0x4078e7
mov byte [ebp + 0x77], 0x12
jmp 0x4078f1
cmp ax, 0x2d
jne 0x4078f4
mov byte [ebp + 0x77], 0x14
add dword [ebp + 0x68], edx
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
call fcn.00431c5f
test al, al
jne 0x40790a
mov ebx, ecx
jmp 0x40b245
lea eax, [ebp + 0x68]
push eax
call fcn.00431c97
cmp byte [ebp + 0x77], bl
pop ecx
jne 0x4079b0
lea eax, [ebp + 0x68]
push eax
call fcn.00431c97
cmp dword [ebp - 0x70], ebx
mov eax, dword [ebp + 0x68]
pop ecx
mov dword [ebp + 0x48], eax
je 0x40793b
cmp byte [ebp + 0x77], bl
jne 0x407a83
push 2
pop esi
cmp word [eax], 0x2d
mov edi, eax
jne 0x407952
add eax, 2
cmp word [eax], 0x2d
jne 0x407952
mov dword [ebp + 0x48], eax
push 1
lea eax, [ebp + 0x48]
push eax
push 0x498920
call fcn.00438eee
add esp, 0xc
test al, al
jne 0x407a83
mov eax, dword [ebp + 0x48]
mov ax, word [eax]
cmp ax, 0x2d
je 0x407983
cmp ax, 0x2f
jne 0x407a83
add dword [ebp + 0x48], esi
push 5
lea eax, [ebp + 0x48]
push eax
push str.catch
call fcn.00438f31
add esp, 0xc
test al, al
je 0x407a2e
mov al, byte [ebp + 0x77]
or byte [ebp + 0x77], 0x10
cmp al, bl
jne 0x407c1c
mov esi, dword [ebp + 0x68]
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
inc ecx
cmp ax, bx
mov dword [ebp + 0x24], ecx
mov edi, esi
je 0x407903
push 2
pop edx
cmp ax, 0x3d
je 0x4079dc
add edi, edx
mov ax, word [edi]
cmp ax, bx
jne 0x4079cc
cmp edi, esi
je 0x407903
cmp word [edi], 0x3d
jne 0x407903
sub edi, edx
cmp word [edi], 0x2b
jne 0x4079fd
mov al, byte [edi]
mov byte [ebp - 0x43], al
sub edi, edx
cmp edi, esi
mov ecx, edi
jbe 0x407a15
mov ax, word [ecx]
call fcn.00431c5f
test al, al
je 0x407a15
sub ecx, edx
cmp ecx, esi
ja 0x407a03
mov ax, word [ecx]
call fcn.00431c5f
test al, al
jne 0x407cb1
mov edx, ecx
inc ecx
inc ecx
jmp 0x407c43
push 4
push dword [ebp + 0x48]
push str.cmd:
call fcn.00432c59
add esp, 0xc
test al, al
je 0x407b8c
add dword [ebp + 0x48], 8
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp + 0x48]
push eax
push dword [ebp + 0x50]
call fcn.00403c12
add esp, 0x10
mov dword [ebp - 0x70], eax
jmp 0x407a75
mov word [edi], 0x20
add edi, esi
cmp edi, dword [ebp + 0x48]
jb 0x407a6e
cmp byte [ebp + 0x77], bl
je 0x407c1c
lea eax, [ebp + 0x68]
push eax
call fcn.00431c97
mov eax, dword [ebp - 0x70]
cmp eax, ebx
pop ecx
je 0x407a9c
cmp word [eax], bx
jne 0x407a9c
mov dword [ebp - 0x70], ebx
cmp dword [ebp - 0x7c], ebx
jne 0x407aa9
cmp dword [ebp + 0x7c], ebx
mov byte [ebp + 0x57], bl
je 0x407aad
mov byte [ebp + 0x57], 1
xor esi, esi
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp + 0x5c], esi
mov dword [ebp + 0x2c], ebx
call fcn.0043717e
lea ecx, [ebp - 0xcc]
call fcn.0043717e
lea ecx, [ebp - 0xfc]
call fcn.0043717e
cmp byte [ebp + 0x57], bl
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0xc4], ebx
mov byte [ebp + 0x42], bl
mov dword [ebp - 0x3c], ebx
jne 0x407b1c
cmp dword [ebp + 0x10], ebx
jne 0x407b1c
mov ecx, dword [ebp + 0x50]
push 1
push ebx
lea eax, [ebp - 0xc4]
push eax
push dword [ebp + 0x68]
call fcn.0043fdd2
mov eax, dword [ebp - 0xc4]
mov dword [ebp + 0x68], eax
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x2d
mov dword [ebp - 0x80], eax
jne 0x407b34
add eax, 2
cmp word [eax], 0x2d
jne 0x407b34
mov dword [ebp + 0x68], eax
xor edi, edi
inc edi
push edi
lea eax, [ebp + 0x68]
push eax
push 0x498920
call fcn.00438eee
add esp, 0xc
test al, al
jne 0x4086c2
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
cmp ax, 0x2d
je 0x407b67
cmp ax, 0x2f
jne 0x4086c2
add dword [ebp + 0x68], 2
push 5
lea eax, [ebp + 0x68]
push eax
push str.catch
call fcn.00438eee
add esp, 0xc
test al, al
je 0x407cb9
mov byte [ebp + 0x77], 0x10
jmp 0x407b1c
push 3
push dword [ebp + 0x48]
push 0x49890c
call fcn.00432c59
add esp, 0xc
test al, al
je 0x407bb6
add dword [ebp + 0x48], 6
jmp 0x407bab
add dword [ebp + 0x48], esi
mov eax, dword [ebp + 0x48]
cmp word [eax], 0x2a
je 0x407ba8
jmp 0x407bfa
push 4
push dword [ebp + 0x48]
push 0x498904
call fcn.00432c59
add esp, 0xc
test al, al
je 0x407be0
add dword [ebp + 0x48], 8
jmp 0x407bd5
add dword [ebp + 0x48], esi
mov eax, dword [ebp + 0x48]
cmp word [eax], 0x2a
je 0x407bd2
jmp 0x407bfa
push 5
push dword [ebp + 0x48]
push str.logs:
call fcn.00432c59
add esp, 0xc
test al, al
je 0x407c1c
add dword [ebp + 0x48], 0xa
mov eax, dword [ebp + 0x48]
cmp word [eax], 0x22
jne 0x407c1c
add dword [ebp + 0x48], esi
jmp 0x407c11
add dword [ebp + 0x48], esi
cmp ax, 0x22
je 0x407c1c
mov eax, dword [ebp + 0x48]
mov ax, word [eax]
cmp ax, bx
jne 0x407c08
lea eax, [ebp + 0x48]
push eax
call fcn.00404807
mov eax, dword [ebp + 0x48]
pop ecx
jmp 0x40793e
lea eax, [edx - 2]
mov dword [ebp - 0x80], eax
mov ax, word [eax]
call fcn.00431c5f
test al, al
jne 0x407c47
mov edx, dword [ebp - 0x80]
cmp edx, esi
ja 0x407c2e
sub ecx, edx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x40]
call fcn.004372a4
mov esi, dword [ebp + 0x50]
push ebx
lea eax, [ebp - 0x40]
push eax
mov ecx, esi
call fcn.00402c95
cmp byte [esi + 0x92], bl
jne 0x407c72
test byte [esi + 9], 0xf
je 0x407c88
push ebx
lea eax, [ebp - 0x40]
push eax
mov ecx, esi
call fcn.00402c95
jmp 0x407c88
cmp ax, 0x3d
je 0x407c96
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x407c80
cmp ax, 0x3d
jne 0x407cb1
lea eax, [ebp - 0xf8]
add edi, 2
push eax
mov dword [ebp - 0xf8], edi
call fcn.00431c97
pop ecx
jmp 0x40791d
xor ebx, ebx
inc ebx
jmp 0x40b245
push 6
push dword [ebp + 0x68]
push str.clone:
call fcn.00432c59
add esp, 0xc
test al, al
lea eax, [ebp + 0x68]
je 0x407d00
add dword [ebp + 0x68], 0xc
mov edi, dword [ebp + 0x68]
push eax
call fcn.004047e3
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
pop ecx
je 0x407cef
mov word [eax], bx
add dword [ebp + 0x68], 2
cmp word [edi], bx
je 0x40853d
mov dword [ebp + 0x20], edi
jmp 0x40853d
push 4
push eax
push str.shel
call fcn.00438eee
add esp, 0xc
test al, al
je 0x407d27
or byte [ebp + 0x4f], 2
and byte [ebp + 0x41], 0xfe
mov dword [ebp + 0x14], edi
mov dword [ebp + 0x24], edi
jmp 0x407b1c
push 5
push dword [ebp + 0x68]
push str.shel:
call fcn.00432c59
add esp, 0xc
test al, al
je 0x407d8c
add dword [ebp + 0x68], 0xa
mov eax, dword [ebp + 0x68]
or byte [ebp + 0x4f], 2
and byte [ebp + 0x41], 0xfe
mov dword [ebp - 0x2c], eax
push 5
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp + 0x14], edi
mov dword [ebp + 0x24], edi
mov dword [ebp + 0x1c], ebx
call fcn.00417571
add esp, 0xc
cmp dword [ebp + 0x1c], ebx
mov dword [ebp + 0x68], eax
jle 0x407b1c
push dword [ebp + 0x1c]
lea ecx, [ebp - 0xd0]
push dword [ebp - 0x2c]
call fcn.004372a4
jmp 0x407b1c
push 9
push dword [ebp + 0x68]
push str.runrmenu:
call fcn.00432c59
add esp, 0xc
test al, al
je 0x407dd5
add dword [ebp + 0x68], 0x12
mov edi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.004047e3
mov eax, dword [ebp + 0x68]
pop ecx
sub eax, edi
sar eax, 1
push eax
push edi
lea ecx, [ebp - 0xdc]
call fcn.004372a4
lea eax, [ebp + 0x68]
push eax
call fcn.00431c97
jmp 0x4086bc
push 8
push dword [ebp + 0x68]
push str.poprmenu
call fcn.00432c59
add esp, 0xc
test al, al
je 0x407e88
add dword [ebp + 0x68], 0x10
mov eax, dword [ebp + 0x68]
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0x68]
push eax
call fcn.004047e3
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
pop ecx
je 0x407e0f
add dword [ebp + 0x68], 2
lea eax, [ebp + 0x68]
push eax
call fcn.00431c97
pop ecx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp + 0xc]
mov ax, word [eax]
cmp ax, bx
mov byte [ebp - 0x45], 1
je 0x407e45
cmp ax, 0x30
jb 0x407e41
cmp ax, 0x39
jbe 0x407e45
add dword [ebp + 0xc], 2
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00439fac
mov eax, dword [ebp + 0xc]
mov ax, word [eax]
cmp ax, bx
pop ecx
pop ecx
je 0x407e72
cmp ax, 0x30
jb 0x407e6e
cmp ax, 0x39
jbe 0x407e72
add dword [ebp + 0xc], 2
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00439fac
pop ecx
jmp 0x4086bc
push 4
push dword [ebp + 0x68]
push str.pid:
call fcn.00432c59
add esp, 0xc
test al, al
je 0x407ec5
add dword [ebp + 0x68], 8
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.004047e3
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x40853d
lea ecx, [ebp - 0xe8]
jmp 0x408532
push 4
push dword [ebp + 0x68]
push 0x498904
call fcn.00432c59
add esp, 0xc
test al, al
je 0x407fde
mov eax, dword [ebp + 0x68]
add eax, 8
mov dword [ebp + 0x68], eax
mov cx, word [eax]
xor edx, edx
cmp cx, 0x23
mov edi, eax
mov dword [ebp - 0x1c], ebx
jne 0x407eff
mov dword [ebp - 0x3c], 1
cmp cx, 0x22
jne 0x407f76
lea esi, [eax + 2]
mov edi, eax
mov ecx, esi
jmp 0x407f34
cmp ax, 0x22
jne 0x407f32
inc edx
test dl, 1
je 0x407f32
xor eax, eax
mov ax, word [ecx + 2]
cmp ax, bx
je 0x407f3f
call fcn.00431c5f
test al, al
jne 0x407f3f
or dword [ebp - 0x3c], 2
inc ecx
inc ecx
mov dword [ebp + 0x68], ecx
mov ax, word [ecx]
cmp ax, bx
jne 0x407f0e
push 0x22
pop edx
cmp word [ecx], dx
jne 0x407f83
or dword [ebp - 0x1c], 0xffffffff
inc ecx
inc ecx
mov dword [ebp + 0x68], ecx
cmp word [ecx - 4], dx
mov edi, esi
mov byte [ebp + 0x42], 2
je 0x407f6a
mov ax, word [edi]
cmp ax, dx
jne 0x407f83
cmp word [edi + 2], dx
jne 0x407f6f
mov byte [ebp + 0x42], bl
jmp 0x407f83
cmp ax, dx
jne 0x407f83
jmp 0x407f6a
lea eax, [ebp + 0x68]
push eax
call fcn.004047e3
pop ecx
mov ecx, dword [ebp + 0x68]
sub ecx, edi
sar ecx, 1
add dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], ebx
jle 0x40853d
add edi, 0xfffffff6
push edi
lea ecx, [ebp - 0x94]
call fcn.00441a80
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x1c]
add eax, 0xa
mov word [eax + ecx*2], bx
cmp word [eax], 0x2a
mov dword [ebp + 0x5c], eax
jne 0x40853d
cmp word [eax + 2], bx
jne 0x40853d
lea eax, [ebp - 0x94]
push eax
call fcn.00403d0b
pop ecx
mov dword [ebp + 0x5c], eax
jmp 0x40853d
push 3
push dword [ebp + 0x68]
push 0x49890c
call fcn.00432c59
add esp, 0xc
test al, al
je 0x4080c9
mov eax, dword [ebp + 0x68]
xor edi, edi
add eax, 6
jmp 0x408005
inc edi
inc eax
inc eax
mov dword [ebp + 0x68], eax
cmp word [eax], 0x2a
je 0x408002
cmp edi, 2
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x18], ebx
jge 0x40808f
push 1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.00417571
add esp, 0xc
cmp dword [ebp - 0x18], ebx
mov dword [ebp + 0x68], eax
jle 0x408050
push dword [ebp - 0x18]
lea ecx, [ebp - 0x50]
push dword [ebp - 0x118]
call fcn.004372a4
mov eax, dword [ebp - 0x50]
mov dword [ebp + 0x2c], eax
cmp edi, 1
jne 0x40853d
cmp dword [ebp - 0x18], ebx
jle 0x40853d
mov eax, dword [ebp - 0x50]
push edi
lea ecx, [ebp - 0x50]
push ecx
push eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0x50], ebx
call fcn.0047675f
add esp, 0xc
lea ecx, [ebp - 0xec]
mov dword [ebp + 0x2c], eax
call fcn.00431c4c
jmp 0x40853d
push 0x105
lea ecx, [ebp - 0x50]
call fcn.004371c5
push 0x104
push dword [ebp - 0x50]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push ebx
push dword [ebp - 0x50]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
je 0x4080be
mov word [eax], bx
mov eax, dword [ebp - 0x50]
mov dword [ebp + 0x2c], eax
jmp 0x40853d
push 5
push dword [ebp + 0x68]
push str.logs:
call fcn.00432c59
add esp, 0xc
test al, al
je 0x408141
mov eax, dword [ebp + 0x68]
add eax, 0xa
xor ecx, ecx
mov dword [ebp + 0x68], eax
mov dword [ebp - 0x2c], eax
cmp word [eax], 0x3f
sete cl
mov edi, ecx
cmp edi, ebx
je 0x408100
add eax, 2
mov dword [ebp - 0x2c], eax
mov esi, eax
push 1
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp + 0x28], ebx
call fcn.00417571
add esp, 0xc
cmp dword [ebp + 0x28], ebx
mov dword [ebp + 0x68], eax
jle 0x40853d
cmp edi, ebx
je 0x408133
cmp dword [0x4afe20], ebx
je 0x40853d
push dword [ebp + 0x28]
lea ecx, [ebp - 0x100]
jmp 0x408537
push 5
lea eax, [ebp + 0x68]
push eax
push str.nowin
call fcn.00438eee
add esp, 0xc
test al, al
je 0x408161
mov byte [ebp - 0x42], 1
jmp 0x407b1c
push 4
lea eax, [ebp + 0x68]
push eax
push str.hide
call fcn.00438eee
add esp, 0xc
test al, al
je 0x408184
mov dword [ebp - 0x10], 0x10000000
jmp 0x407b1c
push 4
lea eax, [ebp + 0x68]
push eax
push 0x4988ac
call fcn.00438eee
add esp, 0xc
test al, al
je 0x4081a3
mov dword [ebp + 0x24], edi
jmp 0x407b1c
push 3
lea eax, [ebp + 0x68]
push eax
push 0x4988a8
call fcn.00438eee
add esp, 0xc
test al, al
je 0x4081c3
or byte [ebp + 0x43], 1
jmp 0x407b1c
push 4
lea eax, [ebp + 0x68]
push eax
push str.err
call fcn.00438eee
add esp, 0xc
test al, al
je 0x4081e3
or byte [ebp + 0x43], 3
jmp 0x407b1c
push 5
lea eax, [ebp + 0x68]
push eax
push str.limit
call fcn.00438eee
add esp, 0xc
test al, al
je 0x408203
mov byte [ebp - 0x46], 1
jmp 0x407b1c
push 3
lea eax, [ebp + 0x68]
push eax
push 0x498894
call fcn.00438eee
add esp, 0xc
test al, al
je 0x408223
mov byte [ebp + 0x40], 1
jmp 0x407b1c
push 4
lea eax, [ebp + 0x68]
push eax
push str.hook
call fcn.00438eee
add esp, 0xc
test al, al
je 0x408242
mov dword [ebp + 0x14], edi
jmp 0x407b1c
push 3
lea eax, [ebp + 0x68]
push eax
push 0x498888
call fcn.00438eee
add esp, 0xc
test al, al
je 0x408265
mov dword [ebp - 0x10], 6
jmp 0x407b1c
push 3
lea eax, [ebp + 0x68]
push eax
push 0x498884
call fcn.00438eee
add esp, 0xc
test al, al
je 0x408288
mov dword [ebp - 0x10], 3
jmp 0x407b1c
push 4
lea eax, [ebp + 0x68]
push eax
push str.show
call fcn.00438eee
add esp, 0xc
test al, al
je 0x4082a7
mov dword [ebp - 0x10], edi
jmp 0x407b1c
push 4
lea eax, [ebp + 0x68]
push eax
push 0x498874
call fcn.00438eee
add esp, 0xc
test al, al
je 0x4082c7
mov byte [ebp - 0x47], 1
jmp 0x407b1c
push 2
lea eax, [ebp + 0x68]
push eax
push 0x498870
call fcn.00438eee
add esp, 0xc
test al, al
je 0x4082e7
mov byte [ebp - 9], 1
jmp 0x407b1c
push 4
lea eax, [ebp + 0x68]
push eax
push str.no64
call fcn.00438eee
add esp, 0xc
test al, al
je 0x408306
mov byte [ebp - 9], bl
jmp 0x407b1c
push 3
lea eax, [ebp + 0x68]
push eax
push 0x498864
call fcn.00438eee
add esp, 0xc
test al, al
je 0x408326
mov byte [ebp - 0x44], 1
jmp 0x407b1c
push 2
lea eax, [ebp + 0x68]
push eax
push 0x498860
call fcn.00438eee
add esp, 0xc
test al, al
je 0x408346
mov byte [ebp + 0x1b], 1
jmp 0x407b1c
push 5
lea eax, [ebp + 0x68]
push eax
push str.incmd
call fcn.00438eee
add esp, 0xc
test al, al
je 0x408366
mov byte [ebp - 0x41], 1
jmp 0x407b1c
push 7
lea eax, [ebp + 0x68]
push eax
push str.hidecmd
call fcn.00438eee
add esp, 0xc
test al, al
je 0x408386
mov byte [ebp - 0xa], 1
jmp 0x407b1c
push 8
lea eax, [ebp + 0x68]
push eax
push str.hidecmd_
call fcn.00438eee
add esp, 0xc
test al, al
je 0x4083a5
mov byte [ebp - 0xa], bl
jmp 0x407b1c
push 3
push dword [ebp + 0x68]
push 0x498840
call fcn.00432c59
add esp, 0xc
test al, al
je 0x4083f7
add dword [ebp + 0x68], 6
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x3a
mov byte [ebp + 0x46], 1
jne 0x40853d
add dword [ebp + 0x68], 2
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.004047e3
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x40853d
lea ecx, [ebp - 0xcc]
jmp 0x408532
push 5
push dword [ebp + 0x68]
push str.code:
call fcn.00432c59
add esp, 0xc
test al, al
je 0x4084ac
add dword [ebp + 0x68], 0xa
mov eax, dword [ebp + 0x68]
mov dword [ebp - 8], eax
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
push str.UTF8
call fcn.00438eee
add esp, 0xc
test al, al
je 0x408442
mov byte [ebp + 0x47], 1
mov dword [ebp - 0x5c], 0xfde9
jmp 0x4086b3
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
push 0x498828
call fcn.00438eee
add esp, 0xc
test al, al
je 0x408465
mov byte [ebp + 0x47], 1
mov dword [ebp - 0x5c], ebx
jmp 0x4086b3
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
push 0x498824
call fcn.00438eee
add esp, 0xc
test al, al
je 0x40848c
mov byte [ebp + 0x47], 2
mov dword [ebp - 0x5c], 0x4b0
jmp 0x4086b3
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00439fac
test eax, eax
pop ecx
pop ecx
jle 0x4086b3
mov byte [ebp + 0x47], 1
jmp 0x4086b3
push 5
push dword [ebp + 0x68]
push str.user:
call fcn.00432c59
add esp, 0xc
test al, al
je 0x4084e2
add dword [ebp + 0x68], 0xa
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.004047e3
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x40853d
lea ecx, [ebp - 0x9c]
jmp 0x408532
push 7
push dword [ebp + 0x68]
push str.passwd:
call fcn.00432c59
add esp, 0xc
test al, al
je 0x4084fd
mov byte [ebp + 0x45], bl
jmp 0x408517
push 7
push dword [ebp + 0x68]
push str.passwd
call fcn.00432c59
add esp, 0xc
test al, al
je 0x40854c
mov byte [ebp + 0x45], 1
add dword [ebp + 0x68], 0xe
mov esi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.004047e3
mov eax, dword [ebp + 0x68]
cmp esi, eax
pop ecx
je 0x40853d
lea ecx, [ebp - 0x60]
sub eax, esi
sar eax, 1
push eax
push esi
call fcn.004372a4
lea eax, [ebp + 0x68]
push eax
call fcn.00431c97
pop ecx
jmp 0x40869c
push 8
lea eax, [ebp + 0x68]
push eax
push str.REALTIME
call fcn.00438eee
add esp, 0xc
test al, al
je 0x40856f
mov dword [ebp + 4], 0x100
jmp 0x407b1c
push 4
lea eax, [ebp + 0x68]
push eax
push str.HIGH
call fcn.00438eee
add esp, 0xc
test al, al
je 0x408592
mov dword [ebp + 4], 0x80
jmp 0x407b1c
push 0xb
lea eax, [ebp + 0x68]
push eax
push str.ABOVENORMAL
call fcn.00438eee
add esp, 0xc
test al, al
je 0x4085b5
mov dword [ebp + 4], 0x8000
jmp 0x407b1c
push 6
lea eax, [ebp + 0x68]
push eax
push str.NORMAL
call fcn.00438eee
add esp, 0xc
test al, al
je 0x4085d8
mov dword [ebp + 4], 0x20
jmp 0x407b1c
push 0xb
lea eax, [ebp + 0x68]
push eax
push str.BELOWNORMAL
call fcn.00438eee
add esp, 0xc
test al, al
je 0x4085fb
mov dword [ebp + 4], 0x4000
jmp 0x407b1c
push 3
lea eax, [ebp + 0x68]
push eax
push 0x4987d4
call fcn.00438eee
add esp, 0xc
test al, al
jne 0x408638
mov edi, dword [ebp + 0x68]
push 0x4987c8
push 4
pop esi
call fcn.00402bf3
cmp al, bl
pop ecx
lea eax, [ebp + 0x68]
je 0x408644
add dword [ebp + 0x68], 8
push eax
call fcn.00431c97
mov esi, dword [ebp + 0x5c]
pop ecx
mov dword [ebp + 4], 0x40
jmp 0x407b1c
push 3
push eax
push 0x4987c4
call fcn.00438eee
add esp, 0xc
test al, al
je 0x40865e
mov byte [ebp + 0x44], 1
jmp 0x40869c
push 3
lea eax, [ebp + 0x68]
push eax
push 0x4987c0
call fcn.00438eee
add esp, 0xc
test al, al
je 0x408681
mov byte [ebp - 0xb], 1
mov byte [ebp + 0x47], bl
mov dword [ebp - 0x5c], ebx
jmp 0x40869c
push 3
lea eax, [ebp + 0x68]
push eax
push 0x4987bc
call fcn.00438eee
add esp, 0xc
test al, al
je 0x4086a4
mov byte [ebp - 0x48], 1
mov esi, dword [ebp + 0x5c]
jmp 0x407b1c
mov eax, dword [ebp - 0x80]
cmp word [eax], 0x2d
mov esi, dword [ebp + 0x5c]
mov dword [ebp + 0x68], eax
jne 0x4086c2
lea eax, [ebp + 0x68]
push eax
call fcn.00404807
pop ecx
jmp 0x407b1c
cmp dword [ebp - 0x5c], 0x4b0
jne 0x4086cf
mov byte [ebp + 0x47], 2
mov eax, dword [ebp - 0xf8]
cmp eax, ebx
je 0x408702
cmp byte [ebp + 0x57], bl
mov dword [ebp + 0x68], eax
jne 0x408702
cmp dword [ebp + 0x10], ebx
jne 0x408702
push 1
push ebx
lea ecx, [ebp - 0xc4]
push ecx
mov ecx, dword [ebp + 0x50]
push eax
call fcn.0043fdd2
mov eax, dword [ebp - 0xc4]
mov dword [ebp + 0x68], eax
cmp esi, ebx
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x30], ebx
je 0x408726
cmp word [esi], bx
je 0x408726
cmp word [ebp - 0x3c], bx
je 0x408729
mov byte [ebp + 0x44], bl
cmp esi, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov dword [ebp + 0x34], ebx
mov dword [ebp - 0x11c], 0x497f30
je 0x408818
cmp word [esi], 0x2a
jne 0x408758
inc esi
inc esi
inc dword [ebp - 0x20]
cmp word [esi], 0x2a
je 0x40874a
mov dword [ebp + 0x5c], esi
cmp word [esi], 0x3f
jne 0x408784
inc esi
inc esi
mov dword [ebp + 0x5c], esi
mov dword [ebp - 0x11c], esi
jmp 0x408776
inc esi
inc esi
cmp ax, 0x3a
mov dword [ebp + 0x5c], esi
je 0x408780
mov ax, word [esi]
cmp ax, bx
jne 0x40876b
jmp 0x408784
mov word [esi - 2], bx
mov ax, word [esi]
push 0x20
pop ecx
or ax, cx
cmp ax, 0x63
jne 0x4087c0
mov dx, word [esi + 2]
or dx, cx
cmp dx, 0x61
jne 0x4087c0
mov dx, word [esi + 4]
or dx, cx
cmp dx, 0x62
jne 0x4087c0
cmp word [esi + 6], 0x3a
jne 0x4087c0
mov dword [ebp - 4], 1
add esi, 8
jmp 0x4087e4
cmp ax, 0x65
jne 0x4087e7
mov ax, word [esi + 2]
or ax, cx
cmp ax, 0x78
jne 0x4087e7
cmp word [esi + 4], 0x3a
jne 0x4087e7
mov dword [ebp - 4], 0x100
add esi, 6
mov dword [ebp + 0x5c], esi
cmp esi, ebx
je 0x408818
mov ax, word [esi]
or ax, cx
cmp ax, 0x75
jne 0x408818
mov ax, word [esi + 2]
or ax, cx
cmp ax, 0x64
jne 0x408818
cmp word [esi + 4], 0x3a
jne 0x408818
add esi, 6
mov dword [ebp + 0x34], 1
mov dword [ebp + 0x5c], esi
cmp byte [ebp + 0x44], bl
je 0x40885f
cmp esi, ebx
je 0x40885f
cmp word [ebp - 4], bx
jne 0x40885f
cmp word [ebp + 0x34], bx
jne 0x40885f
xor eax, eax
cmp byte [ebp + 0x42], bl
mov ecx, esi
setne al
mov edi, eax
xor eax, eax
mov ax, word [esi]
jmp 0x40885a
cmp ax, 0x22
jne 0x408855
inc edi
cmp edi, 2
jl 0x408855
cmp word [ecx + 2], bx
je 0x408855
mov byte [ebp + 0x44], bl
inc ecx
inc ecx
mov ax, word [ecx]
cmp ax, bx
jne 0x408840
cmp word [ebp - 0x20], bx
jne 0x408871
cmp word [ebp - 4], bx
jne 0x408871
cmp word [ebp + 0x34], bx
je 0x408874
mov byte [ebp + 0x42], bl
cmp byte [ebp + 0x44], bl
je 0x4088b9
xor eax, eax
cmp word [ebp + 0x34], bx
sete al
xor ecx, ecx
cmp word [ebp - 4], bx
sete cl
test ecx, eax
je 0x4088b9
push 0x2a
push esi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
mov dword [ebp - 0x30], eax
je 0x4088a7
mov word [eax], bx
inc eax
inc eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x14c]
push eax
push esi
call fcn.00410e8d
pop ecx
pop ecx
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp + 0x78]
xor ecx, ecx
inc ecx
mov dword [eax], ecx
xor eax, eax
lea edi, [ebp - 0x110]
mov dword [ebp - 0x114], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x170], ebx
lea edi, [ebp - 0x16c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
cmp dword [ebp + 0x20], ebx
mov dword [ebp - 0x58], ebx
setne al
cmp byte [ebp + 0x1b], bl
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp + 0xc], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x15c], 0xc
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0xe4], ebx
je 0x408957
lea eax, [ebp - 0x234]
or byte [eax + 0x2d], cl
mov dword [ebp - 0x28], ecx
mov ecx, dword [0x4ae2e4]
mov dword [eax + 0x3c], ecx
mov ecx, dword [0x4ae2e8]
mov dword [eax + 0x40], ecx
mov ecx, dword [0x4ae2e0]
mov dword [eax + 0x38], ecx
cmp byte [ebp + 0x57], bl
je 0x408dda
mov ecx, dword [ebp + 0x68]
cmp word [ecx], 0x7c
mov dword [ebp + 8], ebx
jne 0x408985
inc ecx
inc ecx
xor eax, eax
mov dword [ebp + 0x68], ecx
mov ax, word [ecx]
cmp ax, 0x7c
je 0x40896c
call fcn.00431c5f
test al, al
jne 0x40896c
mov dword [ebp + 0x1c], ecx
mov eax, dword [ebp + 0x68]
xor edx, edx
mov dword [ebp + 0x58], edx
cmp word [eax], bx
je 0x408a30
cmp word [eax], 0x7c
jne 0x4089b5
cmp word [eax + 2], 0x7c
je 0x4089ad
mov edx, eax
mov dword [ebp + 0x58], edx
jmp 0x4089b5
inc eax
inc eax
cmp word [eax], 0x7c
je 0x4089ad
inc eax
inc eax
cmp word [eax], bx
jne 0x408999
cmp edx, ebx
je 0x408a30
lea eax, [ebp + 0x58]
mov word [edx], bx
add dword [ebp + 0x58], 2
push eax
call fcn.00431c97
mov edx, dword [ebp + 0x58]
xor eax, eax
mov ax, word [edx]
cmp ax, bx
pop ecx
mov esi, edx
je 0x408988
cmp ax, 0x7c
jne 0x408a0f
lea edi, [esi + 2]
cmp word [edi], ax
jne 0x408a0f
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push edi
push esi
call fcn.00410b0e
add esp, 0xc
cmp word [esi], 0x7c
jne 0x408a0c
inc esi
inc esi
jmp 0x408a02
mov edx, dword [ebp + 0x58]
inc esi
inc esi
mov ax, word [esi]
cmp ax, bx
jne 0x4089e0
cmp word [edx], bx
je 0x408988
mov eax, dword [ebp + 0x1c]
cmp word [eax], bx
mov cl, 1
je 0x408a32
mov al, cl
jmp 0x408a3e
xor cl, cl
xor al, al
cmp cl, bl
jne 0x408a3e
mov edx, dword [ebp + 0x1c]
mov dword [ebp + 0x58], edx
cmp al, bl
mov dword [ebp - 0x14], edx
je 0x408b03
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
push ebx
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x74]
push eax
xor esi, esi
lea eax, [ebp - 0x78]
inc esi
push eax
mov dword [ebp - 0xb0], 0xc
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], esi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x408a8e
mov ecx, dword [ebp + 0x50]
push ebx
push esi
call fcn.0040da4e
mov esi, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 3
push ebx
push ebx
lea eax, [ebp - 0x78]
push eax
push edi
push dword [ebp - 0x78]
push edi
call esi
cmp dword [ebp - 0x74], ebx
mov word [ebp + 0x1a], bx
je 0x408acf
push dword [ebp - 0x74]
mov ecx, dword [ebp + 0x50]
push ebx
push ebx
lea eax, [ebp + 0x1a]
push eax
push ecx
push dword [ebp + 0x1c]
call fcn.004074ae
cmp dword [ebp - 0x74], ebx
je 0x408acf
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 3
push 1
push ebx
lea eax, [ebp - 0x78]
push eax
push edi
push dword [ebp - 0x78]
mov dword [ebp - 0x74], ebx
push edi
call esi
mov ecx, dword [ebp - 0x78]
cmp ecx, ebx
mov edi, 0x100
je 0x408b08
lea eax, [ebp - 0x234]
or dword [eax + 0x2c], edi
mov dword [ebp - 0x28], 1
mov dword [eax + 0x38], ecx
jmp 0x408b08
mov edi, 0x100
mov eax, dword [ebp - 0x14]
mov dword [ebp + 0x58], eax
xor esi, esi
inc esi
mov cx, word [eax]
cmp cx, bx
je 0x408d7b
cmp cx, 0x3c
je 0x408b36
cmp cx, 0x3e
je 0x408b36
inc eax
inc eax
mov dword [ebp + 0x58], eax
mov cx, word [eax]
cmp cx, bx
jne 0x408b1d
mov cx, word [eax]
cmp cx, bx
je 0x408d7b
cmp cx, 0x3c
jne 0x408c11
mov word [eax], bx
add dword [ebp + 0x58], 2
lea eax, [ebp + 0x58]
push eax
call fcn.00431c97
mov eax, dword [ebp + 0x58]
cmp word [eax], bx
pop ecx
je 0x408c11
mov dword [ebp + 0x3c], eax
jmp 0x408b7f
cmp cx, 0x3c
je 0x408b87
cmp cx, 0x3e
je 0x408b87
inc eax
inc eax
mov dword [ebp + 0x58], eax
mov cx, word [eax]
cmp cx, bx
jne 0x408b6e
sub eax, dword [ebp + 0x3c]
lea ecx, [ebp - 0x54]
sar eax, 1
push eax
push dword [ebp + 0x3c]
call fcn.004419d9
lea ecx, [ebp + 0x1c]
call fcn.0043717e
mov ecx, dword [ebp + 0x50]
push esi
push ebx
lea eax, [ebp + 0x1c]
push eax
push dword [ebp + 0x3c]
call fcn.0043fdd2
mov eax, dword [ebp + 0x1c]
push eax
mov dword [ebp + 0x3c], eax
call fcn.0040d1db
lea eax, [ebp + 0x3c]
push eax
call fcn.00431c97
cmp dword [ebp - 0x4c], ebx
pop ecx
pop ecx
je 0x408bd6
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
push 3
lea eax, [ebp - 0x15c]
push eax
push 7
push 0xc0000000
push dword [ebp + 0x3c]
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x4c], ebx
call fcn.00404863
cmp dword [ebp - 0x4c], ebx
jne 0x408bfe
mov dword [ebp - 0x4c], ebx
lea ecx, [ebp + 0x1c]
call fcn.00431c4c
lea ecx, [ebp - 0x54]
call fcn.00431c4c
mov eax, dword [ebp + 0x58]
cmp word [eax], 0x3e
jne 0x408b11
mov word [eax], bx
mov eax, dword [ebp + 0x58]
cmp word [eax - 2], 0x32
mov dword [ebp - 0x2c], ebx
mov byte [ebp + 0x57], 1
jne 0x408c37
mov byte [ebp + 0x57], 2
mov word [eax - 2], bx
add dword [ebp + 0x58], 2
mov eax, dword [ebp + 0x58]
cmp word [eax], 0x3e
jne 0x408c4b
add dword [ebp + 0x58], 2
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp + 0x58]
cmp word [eax], 0x26
jne 0x408c5c
add dword [ebp + 0x58], 2
mov byte [ebp + 0x57], 3
lea eax, [ebp + 0x58]
push eax
call fcn.00431c97
mov eax, dword [ebp + 0x58]
cmp word [eax], bx
pop ecx
je 0x408b11
mov dword [ebp], eax
jmp 0x408c88
cmp cx, 0x3c
je 0x408c90
cmp cx, 0x3e
je 0x408c90
inc eax
inc eax
mov dword [ebp + 0x58], eax
mov cx, word [eax]
cmp cx, bx
jne 0x408c77
sub eax, dword [ebp]
lea ecx, [ebp + 0x10]
sar eax, 1
push eax
push dword [ebp]
call fcn.004419d9
lea ecx, [ebp - 8]
call fcn.0043717e
mov ecx, dword [ebp + 0x50]
push esi
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp]
call fcn.0043fdd2
mov eax, dword [ebp - 8]
push eax
mov dword [ebp], eax
call fcn.0040d1db
lea eax, [ebp]
push eax
call fcn.00431c97
test byte [ebp + 0x57], 1
pop ecx
pop ecx
je 0x408ce8
cmp dword [ebp + 0xc], ebx
je 0x408ce5
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 0xc], ebx
test byte [ebp + 0x57], 2
je 0x408d0b
cmp dword [ebp - 0x90], ebx
je 0x408d02
push dword [ebp - 0x90]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x90], ebx
mov dword [ebp + 8], ebx
push ebx
push ebx
push 4
lea eax, [ebp - 0x15c]
push eax
push 7
push 0x40000000
push dword [ebp]
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0xa0], ebx
call fcn.00404863
mov esi, eax
cmp esi, ebx
jne 0x408d4f
lea ecx, [ebp - 8]
call fcn.00431c4c
lea ecx, [ebp + 0x10]
call fcn.00431c4c
mov eax, dword [ebp + 0x58]
jmp 0x408b0e
cmp dword [ebp - 0x2c], ebx
je 0x408d5f
push 2
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [ebp + 0x57], 1
jne 0x408d6a
mov dword [ebp + 0xc], esi
jmp 0x408d37
cmp byte [ebp + 0x57], 3
mov dword [ebp + 8], esi
je 0x408d65
mov dword [ebp - 0x90], esi
jmp 0x408d37
mov ecx, dword [ebp - 0x4c]
cmp ecx, ebx
je 0x408d91
lea eax, [ebp - 0x234]
or dword [eax + 0x2c], edi
mov dword [ebp - 0x28], esi
mov dword [eax + 0x38], ecx
mov ecx, dword [ebp + 0xc]
cmp ecx, ebx
je 0x408da7
lea eax, [ebp - 0x234]
or dword [eax + 0x2c], edi
mov dword [ebp - 0x28], esi
mov dword [eax + 0x3c], ecx
mov ecx, dword [ebp + 8]
cmp ecx, ebx
je 0x408dbd
lea eax, [ebp - 0x234]
or dword [eax + 0x2c], edi
mov dword [ebp - 0x28], esi
mov dword [eax + 0x40], ecx
mov ecx, dword [ebp + 0x50]
push esi
push ebx
lea eax, [ebp - 0xe4]
push eax
push dword [ebp - 0x14]
call fcn.0043fdd2
mov eax, dword [ebp - 0xe4]
mov dword [ebp + 0x68], eax
push 6
pop edi
mov esi, 0x10000000
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
cmp ax, 0x21
je 0x408e1c
cmp ax, 0x2a
je 0x408e1c
cmp ax, 0x40
jne 0x408e25
push str.WinSta0WinLogon
lea ecx, [ebp - 0xc8]
call fcn.00441a80
mov ecx, dword [ebp - 0xc8]
inc byte [ebp + 0x33]
lea eax, [ebp - 0x234]
mov dword [eax + 8], ecx
mov dword [ebp - 0x10], esi
add dword [ebp + 0x68], 2
jmp 0x408de2
cmp ax, 0x3d
jne 0x408e34
mov dword [ebp + 0x24], 1
jmp 0x408e1f
cmp ax, 0x24
jne 0x408e40
mov byte [ebp + 0x46], 1
jmp 0x408e1f
cmp ax, 0x26
jne 0x408e4f
mov dword [ebp - 0x10], 3
jmp 0x408e1f
cmp ax, 0x5e
jne 0x408e5a
mov dword [ebp - 0x10], edi
jmp 0x408e1f
cmp ax, 0x5f
je 0x408e55
cmp dword [ebp - 0x10], esi
je 0x408e89
cmp byte [ebp + 0x41], bl
je 0x408e89
push str.WinSta0Default
lea ecx, [ebp - 0xc8]
call fcn.00441a80
mov ecx, dword [ebp - 0xc8]
lea eax, [ebp - 0x234]
mov dword [eax + 8], ecx
lea edi, [ebp - 0x234]
cmp dword [edi + 8], ebx
je 0x408ea7
test byte [ebp + 0x33], 1
je 0x408ea7
call fcn.00403b79
cmp eax, 1
jge 0x408ea7
mov dword [edi + 8], ebx
mov eax, dword [ebp + 0x7c]
cmp eax, ebx
je 0x408ec2
or byte [edi + 0x2d], 1
mov dword [ebp + 0x24], ebx
mov byte [ebp + 0x77], bl
mov dword [ebp - 0x28], 1
mov dword [edi + 0x3c], eax
cmp byte [ebp + 0x46], bl
je 0x408ee2
mov eax, dword [ebp - 0xcc]
cmp word [eax], bx
jne 0x408ee2
push str.open
lea ecx, [ebp - 0xcc]
call fcn.00441a24
cmp byte [ebp - 0x47], bl
je 0x408f33
push 0x5c
push dword [ebp + 0x68]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edi, eax
cmp edi, ebx
je 0x408efc
inc edi
inc edi
jmp 0x408eff
mov edi, dword [ebp + 0x68]
push dword [ebp + 0x68]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push dword [ebp + 0x68]
xor eax, eax
cmp dword [ebp + 0x24], ebx
push 1
setne al
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
add eax, 0x80000001
push eax
call fcn.00432b38
add esp, 0x18
mov ebx, eax
jmp 0x40b192
lea eax, [ebp + 0x68]
push eax
call fcn.00431c97
cmp dword [ebp + 0x20], ebx
pop ecx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0xd8], ebx
je 0x408fe6
lea ecx, [ebp - 8]
mov byte [ebp + 0x46], bl
call fcn.0043717e
mov ecx, dword [ebp + 0x50]
push 0xffffffffffffffff
push ebx
push dword [ebp + 0x20]
call fcn.00411179
cmp eax, ebx
je 0x408fd4
mov ecx, dword [eax]
cmp word [ecx], bx
je 0x408fd4
push eax
lea ecx, [ebp - 8]
call fcn.00441a52
push dword [ebp + 0x68]
lea ecx, [ebp - 0xd8]
call fcn.00441a80
push dword [ebp - 0x100]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0xd8]
push eax
push dword [ebp - 8]
call fcn.00407262
mov edi, eax
mov eax, dword [ebp - 0x94]
mov dword [ebp + 0x5c], eax
mov eax, dword [ebp - 0xd8]
add esp, 0x14
lea ecx, [ebp - 8]
mov dword [ebp + 0x68], eax
call fcn.00431c4c
cmp edi, ebx
je 0x408fe6
mov ebx, edi
jmp 0x40b17f
lea ecx, [ebp - 8]
call fcn.00431c4c
mov ebx, 0x80070057
jmp 0x40b17f
mov eax, dword [ebp - 0xdc]
cmp word [eax], bx
je 0x409037
push dword [ebp + 0x68]
call fcn.0040f738
pop ecx
push eax
lea ecx, [ebp + 0x7c]
mov dword [ebp + 0x68], eax
call fcn.004419bc
push 0x498708
lea ecx, [ebp + 0x7c]
call fcn.004371ec
push dword [ebp - 0xdc]
lea ecx, [ebp + 0x7c]
call fcn.004371ec
mov ecx, dword [ebp + 0x50]
push ebx
push dword [ebp + 0x7c]
call fcn.004492b5
mov ebx, eax
lea ecx, [ebp + 0x7c]
jmp 0x40b17a
cmp byte [ebp - 0x45], bl
je 0x409182
lea ecx, [ebp + 0x74]
call fcn.0043717e
push dword [ebp + 0x68]
mov dword [ebp + 0x7c], ebx
call fcn.0040f738
pop ecx
lea ecx, [ebp + 0x78]
mov dword [ebp + 0x68], eax
call fcn.0043717e
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x78]
push eax
push dword [ebp + 0x68]
mov dword [ebp + 0x28], ebx
call fcn.0047675f
mov eax, dword [ebp + 0x28]
add esp, 0xc
cmp eax, ebx
jne 0x40908c
lea ecx, [ebp + 0x78]
call fcn.00431c4c
lea ecx, [ebp + 0x74]
jmp 0x408fd7
mov word [eax - 2], bx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push dword [ebp + 0x78]
lea ecx, [ebp + 0x14]
mov edi, eax
call fcn.004419bc
push dword [ebp + 0x28]
mov esi, dword [ebp + 0x14]
lea ecx, [ebp - 0x18]
call fcn.004419bc
push edi
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x7c]
push eax
push dword [ebp - 0x18]
push esi
call fcn.00405de1
add esp, 0x14
cmp dword [ebp + 0x7c], ebx
jle 0x409106
mov eax, dword [ebp + 0x50]
mov eax, dword [eax + 0x28]
xor esi, esi
cmp eax, ebx
je 0x4090da
mov esi, dword [eax + 0x18]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebx
push esi
push ebx
push dword [ebp - 0x104]
push dword [ebp - 0x108]
push 0x128
push edi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
push edi
call dword [sym.imp.USER32.dll_DestroyMenu]
cmp dword [ebp + 0x7c], ebx
jle 0x409162
mov esi, dword [ebp + 0x74]
lea eax, [ebp + 0x7c]
mov dword [ebp + 0x7c], esi
call fcn.00410bc4
mov eax, dword [ebp + 0x7c]
mov word [eax], bx
cmp word [esi], bx
je 0x409162
push dword [ebp + 0x68]
lea ecx, [ebp + 0x6c]
call fcn.004419bc
push 0x498708
lea ecx, [ebp + 0x6c]
call fcn.004371ec
push esi
lea ecx, [ebp + 0x6c]
call fcn.004371ec
mov ecx, dword [ebp + 0x50]
push ebx
push dword [ebp + 0x6c]
call fcn.004492b5
lea ecx, [ebp + 0x6c]
mov ebx, eax
call fcn.00431c4c
lea ecx, [ebp - 0x18]
call fcn.00431c4c
lea ecx, [ebp + 0x14]
call fcn.00431c4c
lea ecx, [ebp + 0x78]
call fcn.00431c4c
lea ecx, [ebp + 0x74]
jmp 0x40b17a
push dword [ebp + 0x68]
lea ecx, [ebp - 0xbc]
call fcn.004419bc
cmp byte [ebp - 0x41], bl
je 0x409244
push 0x498078
lea ecx, [ebp - 0xbc]
call fcn.00441a80
push 1
lea eax, [ebp + 0x68]
push ebx
push eax
call fcn.00417571
add esp, 0xc
push eax
lea ecx, [ebp - 0xbc]
mov dword [ebp + 0x68], eax
call fcn.004371ec
lea eax, [ebp - 0x94]
push eax
call fcn.00403d0b
pop ecx
mov dword [ebp + 0x5c], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, 0x10000000
mov eax, dword [ebp - 0xbc]
mov dword [ebp + 0x68], eax
je 0x4091f0
cmp byte [ebp - 0x48], bl
je 0x4091fa
lea eax, [ebp - 0x234]
or byte [eax + 0x2c], 0x80
cmp ecx, ebx
je 0x40920c
lea eax, [ebp - 0x234]
or dword [eax + 0x2c], 1
mov word [eax + 0x30], cx
mov al, byte [ebp + 0x33]
and al, 3
cmp al, 3
je 0x40921a
cmp byte [ebp - 0x42], bl
je 0x409224
lea eax, [ebp - 0x234]
or byte [eax + 0x2f], 8
lea eax, [ebp - 0x234]
cmp dword [eax + 8], ebx
je 0x4094f4
cmp byte [ebp + 0x33], bl
jle 0x4094f4
xor eax, eax
inc eax
jmp 0x4094f6
cmp byte [ebp - 0xa], bl
je 0x4091d7
cmp dword [ebp - 0x10], esi
je 0x4091d7
mov eax, dword [ebp - 0xbc]
push ebx
mov dword [ebp + 0x68], eax
lea eax, [ebp + 0x68]
push ebx
push eax
mov dword [ebp - 0x34], ebx
call fcn.00417571
mov esi, eax
mov eax, dword [ebp + 0x68]
mov dword [ebp - 0x34], eax
push 3
lea eax, [ebp - 0x34]
push eax
push 0x498704
call fcn.00438eee
add esp, 0x18
test al, al
jne 0x40934a
push 7
lea eax, [ebp - 0x34]
push eax
push str.cmd.exe
call fcn.00438eee
add esp, 0xc
test al, al
jne 0x40934a
cmp dword [0x4afbd0], ebx
jne 0x4092f4
push ebx
push 0x24
lea eax, [ebp - 0x564]
push eax
push ebx
mov word [ebp - 0x564], bx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x564]
mov edi, 0x4afbd0
push eax
mov ecx, edi
call fcn.00441a80
push str.System32cmd.exe
mov ecx, edi
call fcn.004371ec
push dword [0x4afbd0]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov word [0x4afbb4], ax
movsx eax, word [0x4afbb4]
push eax
push dword [ebp - 0x34]
mov dword [ebp + 0x10], ebx
push dword [0x4afbd0]
call fcn.0040bf3e
add esp, 0xc
test al, al
je 0x4093bf
movsx eax, word [0x4afbb4]
mov ecx, dword [ebp - 0x34]
lea ecx, [ecx + eax*2]
xor eax, eax
mov ax, word [ecx]
cmp ax, 0x22
je 0x40933d
call fcn.00431c5f
test al, al
je 0x4093bf
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x34], ecx
call fcn.00404807
pop ecx
push 2
lea eax, [ebp - 0x34]
push eax
push 0x4986d4
call fcn.00438eee
add esp, 0xc
test al, al
je 0x4093bf
mov eax, dword [ebp - 0x34]
cmp word [eax], 0x22
jne 0x4093a5
add eax, 2
mov dword [ebp + 0x7c], eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00431c97
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x22
pop ecx
je 0x40939a
push 4
lea eax, [ebp + 0x7c]
push eax
push str.call
call fcn.00438eee
add esp, 0xc
test al, al
je 0x4093a2
mov eax, dword [ebp + 0x7c]
mov dword [ebp - 0x34], eax
jmp 0x4093a5
mov eax, dword [ebp - 0x34]
push ebx
mov dword [ebp + 0x68], eax
lea eax, [ebp + 0x68]
push ebx
push eax
call fcn.00417571
add esp, 0xc
mov esi, eax
mov dword [ebp + 0x10], 1
mov eax, esi
sub eax, dword [ebp + 0x68]
and eax, 0xfffffffe
cmp eax, 8
jle 0x4091d7
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
push 4
lea eax, [esi - 8]
push str..cmd
push eax
call edi
test eax, eax
je 0x4093fc
push 4
push str..bat
lea eax, [esi - 8]
push eax
call edi
test eax, eax
jne 0x4091d7
mov ax, word [esi]
push 0x64
pop ecx
push ebx
push 0x80
push 3
mov word [ebp - 0x54], ax
xor eax, eax
push ebx
lea edi, [ebp - 0x4f0]
rep stosd dword es:[edi], eax
push 7
push 0xc0000000
mov word [esi], bx
push dword [ebp + 0x68]
stosb byte es:[edi], al
lea ecx, [ebp + 0x1c]
lea edi, [ebp - 0x4f0]
mov byte [ebp + 0x7f], bl
mov dword [ebp + 0x1c], ebx
call fcn.00404863
push ebx
lea eax, [ebp - 0xc0]
push eax
push 0x190
mov eax, edi
push eax
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0xb
mov eax, edi
push eax
push str.::hidecmd::
call dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
jne 0x40949a
mov al, byte [ebp - 0x4f0]
mov dword [ebp - 0x10], 0x10000000
jmp 0x409482
cmp al, 0xd
je 0x409489
cmp al, 0xa
je 0x409489
inc edi
mov al, byte [edi]
cmp al, bl
jne 0x409477
jmp 0x409489
inc edi
movsx ax, byte [edi]
push eax
call fcn.0040c01b
add esp, 4
test al, al
jne 0x409488
cmp dword [ebp + 0x10], ebx
jne 0x4094ca
cmp byte [edi], 0x3a
jne 0x4094af
cmp byte [edi + 1], 0x3a
jne 0x4094af
inc edi
inc edi
jmp 0x4094af
inc edi
cmp byte [edi], 0x40
je 0x4094ae
push 7
push edi
push str._pecmd
call dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
jne 0x4094ca
mov byte [ebp + 0x7f], 1
lea ecx, [ebp + 0x1c]
call fcn.00402b75
cmp byte [ebp + 0x7f], bl
mov ax, word [ebp - 0x54]
mov word [esi], ax
je 0x4091d7
push dword [ebp + 0x68]
mov ecx, dword [ebp + 0x50]
call fcn.004296fc
mov ebx, eax
jmp 0x40b174
xor eax, eax
cmp eax, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xa0], ebx
je 0x409514
mov dword [ebp - 0xa0], 1
mov dword [ebp - 0x24], 4
push eax
lea ecx, [ebp - 0x54]
call fcn.00410da8
cmp byte [0x4afd6c], bl
mov esi, dword [ebp + 0x6c]
mov edi, 0x4aff28
jne 0x409545
cmp esi, ebx
je 0x409536
cmp byte [esi + 8], bl
jne 0x409545
cmp byte [ebp - 0x44], bl
mov byte [ebp + 0x7f], bl
je 0x409549
cmp esi, ebx
je 0x409549
mov edi, dword [esi + 0x24]
mov byte [ebp + 0x7f], 1
push ebx
lea ecx, [ebp + 0x1c]
call fcn.004419bc
cmp byte [ebp + 0x7f], bl
mov dword [ebp + 0x20], ebx
je 0x4097d7
push 0x4b069c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
lea ecx, [ebp - 0x330]
call fcn.00411068
cmp esi, ebx
je 0x409586
push edi
push esi
lea ecx, [ebp - 0x330]
call fcn.0043408e
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edi, eax
push 0x106
lea ecx, [ebp + 0x3c]
mov dword [ebp - 0xa4], edi
call fcn.0043719c
mov eax, dword [ebp + 0x3c]
mov dword [ebp + 0x6c], eax
jmp 0x409621
mov dword [ebp + 0x7c], edi
jmp 0x4095b4
cmp ax, 0x3d
je 0x4095be
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x4095ae
mov esi, edi
sub esi, dword [ebp + 0x7c]
sar esi, 1
cmp word [edi], bx
je 0x40961f
cmp word [edi + 2], bx
je 0x40961a
cmp esi, 0x104
jg 0x40961a
push esi
push dword [ebp + 0x7c]
push dword [ebp + 0x6c]
call fcn.004047cb
mov eax, dword [ebp + 0x6c]
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x330]
mov word [eax + esi*2], bx
call fcn.0040d05d
test eax, eax
jne 0x40961a
push 0xffffffffffffffff
push esi
lea eax, [edi + 2]
push eax
push dword [ebp + 0x7c]
lea ecx, [ebp - 0x330]
call fcn.004110dc
jmp 0x40961a
inc edi
inc edi
cmp word [edi], bx
jne 0x409618
inc edi
inc edi
cmp word [edi], bx
jne 0x4095a9
push dword [ebp - 0xa4]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, dword [ebp - 0x32c]
xor esi, esi
cmp eax, ebx
mov dword [ebp + 0x6c], eax
mov dword [ebp + 0x7c], ebx
jle 0x4096e2
mov eax, dword [ebp + 0x7c]
mov dword [ebp - 0x14], eax
inc eax
cmp eax, dword [ebp + 0x6c]
mov dword [ebp - 0x98], eax
mov dword [ebp + 8], eax
jge 0x4096d0
mov eax, dword [ebp + 0x7c]
shl eax, 2
mov dword [ebp - 0xa4], eax
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x330]
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx + eax]
mov edi, dword [ebp + 8]
mov ecx, dword [ecx]
shl edi, 2
mov eax, dword [edi + eax]
mov eax, dword [eax]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jge 0x40969c
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov dword [ebp + 0x10], edi
jmp 0x40969f
mov ecx, dword [ebp - 0x14]
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x6c]
jl 0x40966c
cmp ecx, dword [ebp + 0x7c]
je 0x4096d0
mov edx, dword [ebp - 0x330]
mov eax, dword [ebp - 0xa4]
add eax, edx
mov edi, dword [eax]
shl ecx, 2
mov edx, dword [ecx + edx]
mov dword [eax], edx
mov eax, dword [ebp - 0x330]
mov dword [ecx + eax], edi
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp + 0x6c]
mov dword [ebp + 0x7c], eax
jl 0x409648
cmp dword [ebp + 0x6c], ebx
mov dword [ebp + 0x7c], ebx
jle 0x409724
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov eax, dword [ebp - 0x330]
mov ecx, dword [ebp + 0x7c]
mov eax, dword [eax + ecx*4]
push dword [eax]
call edi
mov ecx, dword [ebp + 0x7c]
lea esi, [esi + eax + 1]
mov eax, dword [ebp - 0x330]
mov eax, dword [eax + ecx*4]
push dword [eax + 4]
call edi
inc dword [ebp + 0x7c]
lea esi, [esi + eax + 3]
mov eax, dword [ebp + 0x7c]
cmp eax, dword [ebp + 0x6c]
jl 0x4096f0
add esi, 4
push esi
lea ecx, [ebp + 0x1c]
call fcn.004371c5
mov edi, dword [ebp + 0x1c]
xor esi, esi
cmp dword [ebp + 0x6c], ebx
mov dword [ebp + 0x20], edi
jle 0x4097a6
mov eax, dword [ebp - 0x330]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
push eax
mov dword [ebp + 0x7c], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp + 0x7c]
mov dword [ebp + 0x28], eax
push edi
call fcn.004047cb
mov eax, dword [ebp + 0x28]
lea edi, [edi + eax*2]
mov word [edi], 0x3d
mov eax, dword [ebp - 0x330]
mov eax, dword [eax + esi*4]
mov eax, dword [eax + 4]
add esp, 0xc
inc edi
push eax
inc edi
mov dword [ebp + 0x7c], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp + 0x7c]
mov dword [ebp + 0x28], eax
push edi
call fcn.004047cb
mov eax, dword [ebp + 0x28]
lea edi, [edi + eax*2]
add esp, 0xc
mov word [edi], bx
inc edi
inc edi
inc esi
cmp esi, dword [ebp + 0x6c]
jl 0x40973d
mov word [edi], bx
lea ecx, [ebp + 0x3c]
mov word [edi + 2], bx
call fcn.00431c4c
push ebx
lea ecx, [ebp - 0x330]
call fcn.00429312
lea ecx, [ebp - 0x2f0]
call fcn.00431c4c
push 0x4b069c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x40]
xor al, al
cmp word [ecx], 0x40
jne 0x4097e6
inc al
jmp 0x4097ed
cmp dword [ebp - 0x70], ebx
je 0x4097ed
mov al, 2
cmp byte [ebp + 0x77], bl
je 0x4098e6
or byte [ebp + 0x77], 8
xor edi, edi
inc edi
neg al
mov dword [ebp + 0x24], edi
sbb eax, eax
and eax, 0xfff01000
add eax, 0x100000
mov esi, eax
call fcn.00433dc1
push eax
lea eax, [ebp - 0x190]
push str..pipepecmd_exec__u
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebx
push edi
push esi
push esi
push 0xff
push 6
push 0x40000003
lea eax, [ebp - 0x190]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp eax, ebx
mov dword [ebp - 0x1c], eax
je 0x40988b
cmp eax, 0xffffffff
je 0x40988b
push 0xffffffffffffffff
lea eax, [ebp - 0x190]
push eax
lea ecx, [ebp + 0x7c]
call fcn.004419f2
push ebx
push ebx
push 3
lea ecx, [ebp - 0x15c]
push ecx
push 7
push 0xc0000000
push dword [eax]
lea ecx, [ebp - 0x3c]
call fcn.00404863
lea ecx, [ebp + 0x7c]
call fcn.00431c4c
jmp 0x409892
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0x3c]
push ebx
push ebx
lea eax, [ebp + 0x6c]
push eax
push esi
mov dword [ebp + 0x6c], 2
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
push ebx
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x234]
or byte [eax + 0x2d], 1
test byte [ebp + 0x43], 2
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x28], edi
jne 0x4098da
cmp byte [ebp + 0x43], bl
jne 0x4098dd
mov dword [eax + 0x3c], esi
test byte [ebp + 0x43], 1
je 0x4098fc
mov dword [eax + 0x40], esi
cmp dword [ebp + 0x24], ebx
jne 0x4098fc
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
push 0x4b069c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0x20]
neg eax
sbb eax, eax
and eax, 0x400
or eax, dword [ebp + 4]
mov dword [ebp], ebx
or dword [ebp - 0x24], eax
cmp byte [ebp + 0x40], bl
mov dword [ebp + 0x18], ebx
mov dword [ebp + 8], ebx
je 0x40992b
or dword [ebp - 0x24], 4
cmp byte [ebp - 9], bl
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0x98], ebx
je 0x40994f
lea eax, [ebp - 0xa4]
push eax
call fcn.00403276
pop ecx
mov dword [ebp - 0x98], eax
cmp byte [ebp + 0x46], bl
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [ebp + 0x5c]
je 0x409965
cmp edi, ebx
je 0x40a556
cmp byte [ebp - 0x46], bl
je 0x4099d6
cmp word [ebp - 4], bx
jne 0x4099d6
cmp word [ebp + 0x34], bx
jne 0x4099d6
call fcn.004071d1
push dword [ebp + 0x68]
mov dword [ebp - 0xe0], eax
push edi
push dword [ebp + 0x2c]
lea eax, [ebp]
push eax
call fcn.00403aa5
mov esi, eax
push esi
call fcn.00403d2f
add esp, 0x14
test eax, eax
jne 0x409b7b
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x234]
push eax
push esi
push dword [ebp + 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push ebx
push ebx
push dword [ebp + 0x68]
push edi
push dword [ebp - 0xe0]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x38], eax
jmp 0x40a382
mov eax, dword [ebp - 0x9c]
cmp word [eax], bx
je 0x409b4d
cmp word [ebp - 4], bx
jne 0x409b4d
cmp word [ebp + 0x34], bx
jne 0x409b4d
cmp byte [ebp + 0x45], bl
mov dword [ebp - 0x38], ebx
je 0x409a90
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp + 0x6c]
call fcn.00402bd8
lea ecx, [ebp + 0x7c]
call fcn.00437055
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push ebx
push dword [ebp - 0x60]
call fcn.004832e0
lea eax, [ebp + 0x7c]
push eax
push dword [ebp + 0x6c]
call fcn.0043c89f
add esp, 0x14
push 0xffffffffffffffff
mov edi, eax
neg edi
push 0xffffffffffffffff
push dword [ebp + 0x7c]
sbb edi, edi
lea ecx, [ebp - 0x60]
neg edi
call fcn.0043723b
push dword [ebp + 0x6c]
call esi
push eax
push ebx
push dword [ebp + 0x6c]
call fcn.004832e0
add esp, 0xc
push dword [ebp + 0x7c]
call esi
push eax
push ebx
push dword [ebp + 0x7c]
call fcn.004832e0
add esp, 0xc
lea ecx, [ebp + 0x7c]
call fcn.00431c4c
lea ecx, [ebp + 0x6c]
call fcn.00431c4c
cmp edi, ebx
je 0x409b14
mov edi, dword [ebp - 0x9c]
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x40
push edi
call esi
cmp eax, ebx
jne 0x409aae
push 0x5c
push edi
call esi
cmp eax, ebx
je 0x409abc
mov word [eax], bx
mov esi, dword [ebp - 0x9c]
lea edi, [eax + 2]
jmp 0x409ac1
mov esi, 0x498684
push dword [ebp + 0x68]
lea eax, [ebp]
push dword [ebp + 0x5c]
push dword [ebp + 0x2c]
push eax
call fcn.00403aa5
push eax
mov dword [ebp + 0x2c], eax
call fcn.00403d2f
add esp, 0x14
test eax, eax
jne 0x409b7b
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x234]
push eax
push dword [ebp + 0x2c]
push dword [ebp + 0x20]
push dword [ebp - 0x24]
push dword [ebp + 0x68]
push dword [ebp + 0x5c]
push 1
push dword [ebp - 0x60]
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov dword [ebp - 0x38], eax
push dword [ebp - 0x60]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
add eax, eax
push eax
push ebx
push dword [ebp - 0x60]
call fcn.004832e0
add esp, 0xc
push dword [ebp - 0x9c]
call esi
add eax, eax
push eax
push ebx
push dword [ebp - 0x9c]
call fcn.004832e0
add esp, 0xc
jmp 0x40a382
cmp byte [ebp + 0x44], bl
je 0x409bca
cmp edi, ebx
je 0x409b5c
cmp word [edi], 0x26
je 0x409bca
cmp word [ebp - 0x20], bx
jne 0x409bca
cmp word [ebp - 4], bx
jne 0x409bca
cmp word [ebp + 0x34], bx
jne 0x409bca
push dword [ebp + 0x2c]
call fcn.00403d2f
test eax, eax
pop ecx
je 0x409b87
mov dword [ebp + 0x7c], 3
jmp 0x40a635
push dword [ebp - 0x30]
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x234]
push eax
push dword [ebp + 0x2c]
push dword [ebp + 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp + 0x68]
push dword [ebp - 0x148]
push dword [ebp - 0x14c]
call fcn.00479d49
xor ecx, ecx
add esp, 0x28
test eax, eax
setg cl
mov dword [ebp - 0x38], ecx
jmp 0x40a382
lea ecx, [ebp - 0x8c]
mov dword [ebp + 0x6c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp + 4], ebx
mov dword [ebp + 0x7c], edi
mov dword [ebp - 0x30], edi
call fcn.00437055
cmp word [ebp + 0x34], bx
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x58]
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp + 0x3c], ebx
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x28], eax
je 0x409cb7
mov eax, dword [ebp + 0x5c]
push 0x22
pop edi
cmp word [eax], di
jne 0x409c23
add eax, 2
mov dword [ebp + 0x7c], eax
mov esi, dword [ebp + 0x7c]
push 0x3a
lea eax, [ebp + 0x7c]
mov dword [ebp - 0x68], esi
call fcn.00410b80
mov eax, dword [ebp + 0x7c]
cmp eax, esi
pop ecx
je 0x409c45
cmp word [eax - 2], di
jne 0x409c45
mov word [eax - 2], bx
cmp word [eax], 0x3a
jne 0x409c50
mov word [eax], bx
inc eax
inc eax
cmp word [eax], di
mov esi, eax
jne 0x409c69
lea esi, [eax + 2]
inc eax
inc eax
cmp word [eax], di
jne 0x409c64
mov word [eax], bx
cmp word [eax], bx
jne 0x409c5a
cmp word [ebp - 4], bx
je 0x409c87
push 0x3a
push esi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
mov dword [ebp + 0x6c], eax
je 0x409c87
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x6c], eax
push ebx
push ebx
push 0x10000
push esi
lea eax, [ebp - 0x8c]
push eax
push dword [ebp - 0x68]
call fcn.0042ff9f
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x84]
add esp, 0x18
add ecx, eax
mov dword [ebp + 0x3c], ecx
jmp 0x409ecf
cmp edi, ebx
je 0x409d8e
cmp word [edi], 0x26
jne 0x409d71
mov ecx, dword [ebp + 0x50]
push 0xffffffffffffffff
push ebx
push edi
call fcn.0040d05d
mov esi, eax
cmp esi, ebx
jne 0x409d33
lea ecx, [ebp + 0x58]
call fcn.00431c4c
lea ecx, [ebp - 0x8c]
call fcn.00431c4c
lea ecx, [ebp + 4]
call fcn.00431c4c
lea ecx, [ebp + 8]
call fcn.00431c4c
lea ecx, [ebp + 0x18]
call fcn.00431c4c
lea ecx, [ebp]
call fcn.00431c4c
push 0x4b069c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp + 0x1c]
call fcn.00431c4c
lea ecx, [ebp - 0x54]
call fcn.00410ddc
mov ebx, 0x80070057
jmp 0x40b174
mov eax, dword [esi + 0xc]
and eax, 0x3fffffff
mov dword [ebp - 0x88], eax
add eax, 0x10
push eax
lea ecx, [ebp - 0x8c]
call fcn.00437099
mov dword [ebp + 0x3c], eax
mov eax, dword [ebp - 0x88]
inc eax
push eax
push dword [esi + 4]
push dword [ebp - 0x8c]
call fcn.00410b58
add esp, 0xc
jmp 0x409ecf
mov al, byte [ebp + 0x42]
neg al
push 2
pop edi
sbb eax, eax
and eax, edi
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0043e955
pop ecx
pop ecx
mov dword [ebp - 0x6c], eax
jmp 0x409d91
push 2
pop edi
cmp dword [ebp - 0x6c], ebx
mov dword [ebp - 0x120], ebx
jne 0x409e2e
mov eax, dword [ebp + 0x68]
cmp eax, ebx
je 0x409db0
cmp word [eax], 0x2a
jne 0x409db0
inc dword [ebp - 0x20]
cmp byte [ebp + 0x44], bl
je 0x409db8
mov dword [ebp - 0x20], ebx
cmp word [ebp - 4], bx
je 0x40a39b
push 0x3a
push ebx
push dword [ebp - 0x30]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
cmp esi, ebx
mov dword [ebp + 0x6c], esi
je 0x409e25
mov word [esi], bx
add esi, edi
mov dword [ebp + 0x6c], esi
je 0x409e25
mov eax, dword [ebp - 0x30]
cmp word [eax], 0x22
mov dword [ebp - 0xd4], edi
mov dword [ebp - 0x14], ebx
mov dword [ebp + 0x28], ebx
jne 0x409e15
add dword [ebp - 0x30], edi
mov eax, dword [ebp - 0x30]
mov dword [ebp + 0x7c], eax
push 0x22
lea eax, [ebp + 0x7c]
call fcn.00410b80
mov eax, dword [ebp + 0x7c]
cmp word [eax], bx
pop ecx
je 0x409e15
mov word [eax], bx
push dword [ebp - 0x30]
lea ecx, [ebp + 0x58]
call fcn.00441a24
jmp 0x409f01
cmp dword [ebp - 0x6c], ebx
je 0x40a39b
cmp word [ebp - 4], bx
mov edi, dword [ebp - 0x6c]
je 0x409e50
push 0x3a
push ebx
push edi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
mov dword [ebp + 0x6c], eax
je 0x409e50
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x6c], eax
add dword [ebp - 0x6c], 2
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.0043e8a3
mov si, word [edi]
pop ecx
mov dword [ebp - 0x68], eax
mov eax, dword [0x4afe10]
mov word [edi], bx
pop ecx
mov ecx, dword [ebp - 0x30]
mov dword [ebp + 0x34], 0x20
cmp word [ecx], bx
mov dword [ebp + 0x7c], ebx
je 0x409e93
push 2
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp + 0x7c], eax
cmp eax, ebx
mov word [edi], si
je 0x409ec1
lea ecx, [ebp + 0x34]
push ecx
lea ecx, [ebp - 0x8c]
push ecx
push dword [ebp - 0x68]
mov dword [ebp + 0x34], 0x20
push dword [ebp - 0x120]
push eax
call fcn.00411356
add esp, 0x14
mov dword [ebp + 0x3c], eax
cmp dword [ebp + 0x7c], ebx
je 0x409ecf
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x88], ebx
je 0x40a367
cmp dword [ebp + 0x3c], ebx
je 0x40a367
cmp word [ebp - 0x20], bx
mov dword [ebp - 0xd4], 1
ja 0x409efe
cmp word [ebp - 4], bx
je 0x40a299
mov esi, dword [ebp + 0x6c]
cmp dword [ebp + 0x28], ebx
mov eax, dword [ebp - 0x11c]
jne 0x409f11
mov eax, 0x497f30
push eax
push str.exedat
push dword [ebp - 0x14]
lea eax, [ebp - 0x58]
push dword [ebp + 0x28]
push eax
call fcn.0040492a
add esp, 0x14
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp + 0x18]
call fcn.00441a52
mov edi, dword [ebp + 0x10]
lea eax, [ebp + 0x58]
mov dword [ebp + 0x28], eax
lea eax, [ebp + 0x10]
cmp edi, ebx
mov dword [ebp - 0x14], eax
setne al
cmp al, bl
mov dword [ebp - 0xc0], ebx
je 0x409f7b
push ebx
lea eax, [ebp - 0xc0]
push eax
push dword [ebp - 0x88]
push dword [ebp + 0x3c]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call fcn.004353db
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x409f88
cmp dword [ebp - 0xd4], 1
jle 0x40a367
cmp esi, ebx
push dword [ebp - 0x58]
mov byte [ebp + 0x7f], bl
je 0x40a0e2
mov eax, dword [ebp + 0x58]
lea ecx, [ebp + 0x58]
mov dword [ebp + 0x5c], eax
mov dword [ebp + 0x58], ebx
call fcn.00441a80
push str..ex
lea ecx, [ebp + 0x58]
call fcn.004371ec
lea eax, [ebp + 0x58]
push eax
lea ecx, [ebp + 0x18]
call fcn.00441a52
cmp word [esi], 0x5c
je 0x409fce
add esi, 0xfffffffe
mov word [esi], 0x5c
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp word [ebp - 4], 1
jne 0x40a027
push 0x498654
lea ecx, [ebp + 0x34]
call fcn.004419bc
push dword [ebp + 0x5c]
lea ecx, [ebp + 0x34]
call fcn.004371ec
push 0x49864c
lea ecx, [ebp + 0x34]
call fcn.004371ec
push dword [ebp + 0x58]
lea ecx, [ebp + 0x34]
call fcn.004371ec
push dword [ebp + 0x34]
mov ecx, dword [ebp + 0x50]
call fcn.004248c9
lea ecx, [ebp + 0x34]
call fcn.00431c4c
jmp 0x40a0c3
cmp word [ebp - 4], 0x100
jne 0x40a0c3
push 0xf
pop ecx
xor eax, eax
mov dword [ebp - 0x294], 0x44
mov dword [ebp - 0x290], ebx
lea edi, [ebp - 0x28c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0xb4], ebx
lea edi, [ebp - 0xb0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0x294]
push eax
push dword [ebp + 0x18]
mov dword [ebp - 0x268], 0x80
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x498644
push dword [ebp + 0x5c]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
push dword [ebp - 0xb4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 0xb4], ebx
je 0x40a0af
push dword [ebp - 0xb4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xb0], ebx
je 0x40a0c3
push dword [ebp - 0xb0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
lea ecx, [ebp + 0x58]
call fcn.004371ec
lea eax, [ebp + 0x58]
push eax
lea ecx, [ebp]
call fcn.00441a52
lea ecx, [ebp + 0x5c]
call fcn.00431c4c
jmp 0x40a0ea
lea ecx, [ebp + 0x18]
call fcn.00441a80
mov edx, dword [ebp + 0x68]
mov di, word [edx]
cmp di, 0x22
mov eax, edx
jne 0x40a0fb
lea eax, [edx + 2]
cmp word [eax], 0x3f
jne 0x40a188
lea esi, [eax + 2]
mov cx, word [esi]
cmp cx, 0x3f
jne 0x40a119
mov edi, dword [ebp + 0x58]
lea esi, [eax + 4]
jmp 0x40a15d
cmp cx, 0x5c
jne 0x40a188
cmp di, 0x22
je 0x40a15a
mov eax, dword [ebp + 0x18]
mov edi, 0x104
push edi
lea ecx, [ebp + 0x18]
mov dword [ebp + 0x5c], eax
mov dword [ebp + 0x18], ebx
call fcn.004371c5
mov eax, dword [ebp + 0x18]
push edi
mov word [eax], bx
push dword [ebp + 0x18]
push dword [ebp + 0x5c]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea ecx, [ebp + 0x5c]
call fcn.00431c4c
mov edx, dword [ebp + 0x68]
mov edi, dword [ebp + 0x18]
cmp word [edx], 0x22
jne 0x40a170
push 0x498424
lea ecx, [ebp + 8]
call fcn.00441a80
push edi
lea ecx, [ebp + 8]
call fcn.004371ec
push esi
lea ecx, [ebp + 8]
call fcn.004371ec
mov edx, dword [ebp + 8]
mov dword [ebp + 0x68], edx
cmp dword [ebp + 0x6c], ebx
je 0x40a1eb
cmp word [ebp - 0x20], bx
ja 0x40a1c1
lea eax, [ebp - 0x8c]
push eax
push dword [ebp]
mov dword [ebp + 0x6c], ebx
call fcn.00410e8d
cmp dword [ebp - 0x88], ebx
pop ecx
pop ecx
je 0x40a1e8
mov eax, dword [ebp - 0x8c]
mov byte [ebp + 0x7f], 1
mov dword [ebp + 0x3c], eax
jmp 0x40a26a
cmp byte [ebp + 0x46], bl
je 0x40a1eb
cmp dword [ebp + 0x2c], ebx
jne 0x40a1d1
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0x2c], eax
cmp word [ebp - 0x20], 2
mov dword [ebp + 0x6c], ebx
mov byte [ebp + 0x7f], 2
jb 0x40a53b
jmp 0x40a26a
mov edx, dword [ebp + 0x68]
mov eax, dword [ebp + 0x6c]
cmp eax, ebx
mov esi, dword [ebp + 0x58]
je 0x40a1fc
cmp word [eax], bx
jne 0x40a1fc
xor esi, esi
cmp dword [ebp + 0x2c], ebx
jne 0x40a207
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0x2c], eax
push edx
push dword [ebp + 0x58]
lea eax, [ebp]
push dword [ebp + 0x2c]
push eax
call fcn.00403aa5
push eax
mov dword [ebp + 0x2c], eax
call fcn.00403d2f
add esp, 0x14
test eax, eax
jne 0x40a3bd
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x234]
push eax
push dword [ebp + 0x2c]
push dword [ebp + 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push ebx
push ebx
push dword [ebp + 0x68]
push esi
call fcn.00482cb5
add esp, 0x28
cmp byte [ebp - 0x20], 2
mov dword [ebp - 0x38], eax
jl 0x40a367
cmp word [ebp - 4], bx
jne 0x40a367
cmp byte [ebp + 0x7f], 1
jne 0x40a275
or eax, 0xffffffff
jmp 0x40a27e
lea eax, [ebp - 0x140]
mov eax, dword [eax + 8]
push eax
push dword [ebp - 0x58]
call fcn.00402cf9
cmp byte [ebp + 0x7f], 1
mov eax, dword [ebp - 0x58]
pop ecx
pop ecx
mov word [eax], bx
jne 0x40a392
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x22
mov edi, eax
jne 0x40a2a7
add eax, 2
cmp word [eax], 0x3f
mov dword [ebp + 0x5c], ebx
jne 0x40a2ce
cmp word [eax + 2], 0x5c
jne 0x40a2ce
lea edi, [eax + 4]
cmp word [edi], 0x22
jne 0x40a2ce
dec edi
dec edi
mov ax, word [edi]
mov word [ebp + 0x5c], ax
mov word [edi], 0x22
push dword [ebp + 0x2c]
call fcn.00403d2f
test eax, eax
pop ecx
jne 0x40a3bd
push ebx
lea esi, [ebp - 0x140]
push esi
lea eax, [ebp - 0x234]
push eax
push dword [ebp + 0x2c]
push dword [ebp + 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push edi
push dword [ebp - 0x88]
push dword [ebp + 0x3c]
call fcn.00479d49
add esp, 0x28
cmp word [ebp + 0x5c], bx
mov dword [ebp - 0x68], eax
je 0x40a31c
mov ax, word [ebp + 0x5c]
mov word [edi], ax
cmp dword [ebp - 0x68], ebx
jl 0x409efe
mov esi, dword [esi + 8]
cmp esi, ebx
je 0x409efe
push esi
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
je 0x409efe
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp - 0x68], ebx
setg al
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x58]
cmp eax, ebx
je 0x40a367
cmp word [eax], bx
jne 0x40a26a
lea ecx, [ebp + 0x58]
call fcn.00431c4c
lea ecx, [ebp - 0x8c]
call fcn.00431c4c
lea ecx, [ebp + 4]
call fcn.00431c4c
cmp dword [ebp - 0x38], ebx
je 0x40a627
xor eax, eax
jmp 0x40a62d
cmp byte [ebp + 0x7f], 2
jmp 0x40a535
push dword [ebp + 0x68]
lea eax, [ebp]
push dword [ebp + 0x5c]
push dword [ebp + 0x2c]
push eax
call fcn.00403aa5
push eax
mov dword [ebp + 0x2c], eax
call fcn.00403d2f
add esp, 0x14
test eax, eax
je 0x40a3e4
lea ecx, [ebp + 0x58]
mov dword [ebp + 0x7c], 3
call fcn.00431c4c
lea ecx, [ebp - 0x8c]
call fcn.00431c4c
lea ecx, [ebp + 4]
call fcn.00431c4c
jmp 0x40a635
cmp byte [ebp + 0x77], bl
jne 0x40a466
push 0x5c
push ebx
push dword [ebp + 0x68]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
cmp esi, ebx
je 0x40a3ff
add esi, edi
jmp 0x40a402
mov esi, dword [ebp + 0x68]
push 8
push esi
push str.winpeshl
call fcn.00432c59
add esp, 0xc
test al, al
je 0x40a434
xor eax, eax
mov ax, word [esi + 0x10]
cmp ax, bx
je 0x40a430
cmp ax, 0x2e
je 0x40a430
call fcn.00431c5f
test al, al
je 0x40a434
mov byte [ebp + 0x3b], 1
push 8
push esi
push str.wpeinit
call fcn.00432c59
add esp, 0xc
test al, al
je 0x40a466
movzx esi, word [esi + 0xe]
cmp si, bx
je 0x40a462
cmp si, 0x2e
je 0x40a462
mov eax, esi
call fcn.00431c5f
test al, al
je 0x40a466
mov byte [ebp + 0x3b], 1
test byte [ebp + 0x4f], 1
jne 0x40a471
cmp dword [ebp + 0x14], ebx
je 0x40a499
push dword [ebp + 0x68]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push dword [ebp + 0x68]
push 1
push str.Shell.x
push str.SOFTWAREPELOGON
push 0x80000002
call fcn.00432b38
add esp, 0x18
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x234]
push eax
push dword [ebp + 0x2c]
push dword [ebp + 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push ebx
push ebx
push dword [ebp + 0x68]
push dword [ebp + 0x5c]
call fcn.00482cb5
mov esi, eax
add esp, 0x28
cmp esi, ebx
mov dword [ebp - 0x38], esi
jne 0x40a4cf
mov byte [ebp + 0x3b], bl
cmp byte [ebp + 0x3b], bl
je 0x40a4f7
call fcn.004768e1
test eax, eax
jg 0x40a4e4
mov dword [ebp + 0x24], 1
cmp dword [ebp + 0x24], ebx
jne 0x40a4f7
push str.waitpeinit.pecmd
call fcn.00482cde
pop ecx
mov dword [ebp + 0x24], eax
cmp esi, ebx
jne 0x40a367
push dword [ebp + 0x14]
push esi
push dword [ebp + 0x68]
push str._CreateProcess__s__d___d__r_n
push 0x4aff28
call fcn.0040d391
add esp, 0x14
cmp byte [ebp + 0x46], bl
jne 0x40a367
cmp dword [ebp + 0x5c], ebx
jne 0x40a367
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
jne 0x40a367
lea ecx, [ebp + 0x58]
call fcn.00431c4c
lea ecx, [ebp - 0x8c]
call fcn.00431c4c
lea ecx, [ebp + 4]
call fcn.00431c4c
push 0xd
xor eax, eax
pop ecx
lea edi, [ebp - 0x1a4]
mov dword [ebp - 0x1ac], 0x3c
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x10]
cmp eax, ebx
mov dword [ebp - 0x1a8], 0x4540
jne 0x40a581
push 5
pop eax
movzx eax, ax
mov dword [ebp - 0x190], eax
mov eax, dword [ebp + 0x2c]
cmp eax, ebx
je 0x40a59c
cmp word [eax], bx
je 0x40a59c
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp + 0x68]
mov dword [ebp + 0x7c], ebx
mov dword [ebp + 0x6c], eax
mov dword [ebp - 0x19c], eax
cmp word [eax], 0x22
jne 0x40a5f4
push 1
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp + 0x6c]
push eax
call fcn.00417571
add esp, 0xc
push dword [ebp + 0x7c]
lea ecx, [ebp - 0xfc]
push dword [ebp + 0x6c]
mov esi, eax
call fcn.004372a4
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x198], esi
lea eax, [ebp - 0x1ac]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x174]
lea esi, [ebp - 0x140]
push eax
mov dword [esi], eax
mov dword [ebp - 0x174], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [esi + 8], eax
jmp 0x40a382
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x78]
mov dword [ecx], eax
mov dword [ebp + 0x7c], eax
lea ecx, [ebp - 0x2c]
call fcn.00402b75
cmp dword [ebp - 0x98], ebx
je 0x40a651
push dword [ebp - 0xa4]
call fcn.00403287
pop ecx
lea esi, [ebp - 0x74]
mov eax, dword [esi]
cmp eax, ebx
je 0x40a661
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xe8]
mov dword [esi], ebx
cmp word [eax], bx
je 0x40a683
push eax
lea eax, [ebp - 0x140]
push dword [eax + 8]
push dword [ebp + 0x50]
call fcn.004394c3
add esp, 0xc
cmp byte [ebp + 0x40], bl
je 0x40a6a6
lea esi, [ebp - 0x140]
cmp dword [esi], ebx
je 0x40a6a6
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push dword [esi]
mov dword [ebp - 0x7c], eax
push eax
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
push str.__LastPID
lea edi, [ebp - 0x140]
push dword [edi + 8]
push dword [ebp + 0x50]
call fcn.004394c3
push str.__LastTID
push dword [edi + 0xc]
push dword [ebp + 0x50]
call fcn.004394c3
add esp, 0x18
cmp dword [ebp - 0xa0], ebx
je 0x40a6e8
push dword [edi]
push 4
push str.SeDebugPrivilege
call fcn.0040fb17
add esp, 0xc
test byte [ebp - 0x24], 4
je 0x40a6fc
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x40a6fc
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea ecx, [ebp + 8]
call fcn.00431c4c
lea ecx, [ebp + 0x18]
call fcn.00431c4c
lea ecx, [ebp]
call fcn.00431c4c
mov eax, 0x4b069c
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp + 0x1c]
call fcn.00431c4c
lea ecx, [ebp - 0x54]
call fcn.00410ddc
lea esi, [ebp - 0x3c]
mov eax, dword [esi]
cmp eax, ebx
je 0x40a740
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
lea esi, [ebp - 0x78]
mov eax, dword [esi]
cmp eax, ebx
je 0x40a752
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
lea esi, [ebp - 0x4c]
mov eax, dword [esi]
cmp eax, ebx
je 0x40a764
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
lea esi, [ebp + 0xc]
mov eax, dword [esi]
cmp eax, ebx
je 0x40a776
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
lea esi, [ebp - 0x90]
mov eax, dword [esi]
cmp eax, ebx
je 0x40a78b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp + 0x4f], bl
mov dword [esi], ebx
je 0x40a7da
mov eax, dword [edi]
cmp eax, ebx
je 0x40a7a4
push 0x1388
push eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
test byte [ebp + 0x4f], 1
je 0x40a7c1
mov eax, dword [edi]
push dword [edi + 8]
neg eax
sbb eax, eax
and eax, 2
or eax, 1
push eax
call fcn.0040eb20
pop ecx
pop ecx
cmp dword [ebp - 0xd0], ebx
je 0x40a7da
mov ecx, dword [ebp + 0x50]
push ebx
push ebx
push ebx
push dword [ebp - 0xd0]
call fcn.00427548
cmp dword [ebp - 0x38], ebx
je 0x40af61
mov eax, dword [edi]
cmp eax, ebx
jne 0x40a7ec
mov dword [ebp + 0x24], ebx
mov ecx, dword [ebp - 0x64]
inc dword [ebp - 0x64]
mov dword [ebp + ecx*4 - 0x114], eax
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x40a807
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x14], ebx
mov dword [edi + 4], ebx
je 0x40a825
mov ecx, dword [ebp + 0x50]
push ebx
push 0x3e8
call fcn.0040da4e
push dword [edi]
call fcn.0040e89c
pop ecx
cmp dword [ebp + 0x24], ebx
je 0x40af77
mov al, byte [0x4ae290]
mov esi, 0x100000
push 0x100004
lea ecx, [ebp + 0x5c]
mov byte [ebp + 0x6f], al
mov dword [ebp + 0x14], esi
xor edi, edi
call fcn.00437072
mov eax, dword [ebp - 0x40]
cmp word [eax], 0x40
lea ecx, [eax + 2]
mov dword [ebp + 0x34], eax
mov dword [ebp - 0x68], ecx
mov byte [ebp + 0x7f], bl
jne 0x40a909
mov byte [ebp + 0x7f], 1
mov dword [ebp + 0x34], ecx
cmp byte [ebp - 0x43], bl
je 0x40a8c8
mov ecx, dword [ebp + 0x50]
push ebx
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x34]
mov dword [ebp + 0x10], ebx
call fcn.0043f2e0
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 0x10]
lea ecx, [ebp + 0x5c]
call fcn.00437106
push dword [ebp + 0x5c]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea esi, [edi + 0x3ff]
and esi, 0xfffffc00
add esi, 0x100000
lea eax, [esi + 8]
push eax
lea ecx, [ebp + 0x5c]
mov dword [ebp + 0x14], esi
call fcn.00437099
lea ecx, [ebp + 0x10]
call fcn.00431c4c
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
test byte [ebp + 0x77], 8
je 0x40ac22
mov eax, dword [ebp - 0x40]
mov ax, word [eax]
cmp ax, 0x40
je 0x40a91b
cmp byte [ebp - 0xb], bl
je 0x40a91b
cmp ax, 0x26
je 0x40a903
mov eax, dword [ebp + 0x50]
test byte [eax + 9], 0xf
je 0x40a91b
mov byte [ebp + 0x40], 1
jmp 0x40a91e
cmp dword [ebp - 0x70], ebx
je 0x40a86d
mov byte [ebp + 0x7f], 2
jmp 0x40a86d
mov byte [ebp + 0x40], bl
push ebx
mov dword [ebp - 0xc0], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x1c]
mov esi, dword [eax]
lea eax, [ebp - 0x170]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
cmp byte [ebp + 0x7f], bl
mov dword [ebp - 0xd4], edi
je 0x40a953
mov eax, dword [ebp + 0x14]
sub eax, edi
mov dword [ebp + 0x20], eax
jmp 0x40a95a
mov dword [ebp + 0x20], 0x100000
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0xc0]
push eax
push dword [ebp + 0x20]
mov eax, dword [ebp + 0x5c]
add eax, edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp - 0xb8], ebx
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x54], ebx
mov dword [ebp + 0x28], ebx
jg 0x40a99c
mov dword [ebp - 0xb8], 0x3e8
lea ecx, [ebp - 0x14]
mov byte [ebp + 0x45], bl
call fcn.0043717e
mov al, byte [0x4ae290]
cmp al, bl
mov byte [ebp + 0x6f], al
jle 0x40ac15
mov ecx, dword [ebp + 0x50]
push 0x4ff
push dword [ebp - 0xb8]
lea eax, [ebp - 0x114]
push ebx
push eax
push dword [ebp - 0x64]
call fcn.0040f69d
cmp eax, ebx
mov dword [ebp - 0xec], eax
jne 0x40aa69
lea eax, [ebp - 0x1c]
mov esi, dword [eax]
push ebx
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp - 0x170]
push eax
push esi
mov dword [ebp + 0x3c], ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
cmp dword [ebp + 0x3c], ebx
jle 0x40aa17
mov eax, dword [ebp + 0x20]
cmp dword [ebp + 0x3c], eax
jle 0x40aa0e
mov dword [ebp + 0x3c], eax
add edi, dword [ebp + 0x3c]
mov eax, dword [ebp + 0x5c]
mov byte [eax + edi], bl
lea eax, [edi + 0x100000]
cmp eax, dword [ebp + 0x14]
jl 0x40aa38
add dword [ebp + 0x14], 0x100000
mov eax, dword [ebp + 0x14]
add eax, 4
push eax
lea ecx, [ebp + 0x5c]
call fcn.00437099
cmp byte [ebp + 0x7f], bl
je 0x40aa47
mov eax, dword [ebp + 0x14]
sub eax, edi
mov dword [ebp + 0x20], eax
jmp 0x40aa4e
mov dword [ebp + 0x20], 0x100000
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp + 0x3c]
push eax
push dword [ebp + 0x20]
mov eax, dword [ebp + 0x5c]
add eax, edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [ebp + 0x7f], bl
je 0x40aaa0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x54], eax
sub eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0xb8]
jge 0x40ab5a
cmp edi, dword [ebp + 0x28]
je 0x40ac0c
cmp eax, 0x14
jl 0x40ac0c
jmp 0x40ab5a
mov eax, dword [ebp - 0x64]
cmp eax, 1
jle 0x40aacc
dec eax
cmp eax, dword [ebp - 0xec]
jne 0x40aacc
cmp byte [ebp + 0x7f], bl
mov byte [ebp + 0x45], 1
je 0x40ac15
cmp edi, dword [ebp + 0x28]
je 0x40ac15
jmp 0x40ab5a
test byte [ebp + 0x77], 1
je 0x40aaec
mov eax, dword [ebp - 0xd4]
jmp 0x40aae8
mov ecx, dword [ebp + 0x5c]
cmp byte [eax + ecx], 0xa
je 0x40ac15
inc eax
cmp eax, edi
jl 0x40aada
push 5
pop esi
dec esi
js 0x40a9a7
cmp byte [0x4ae290], bl
jle 0x40a9a7
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x40a9a7
cmp dword [ebp - 0x24c], 0x12
je 0x40ab41
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x40aaef
cmp byte [ebp + 0x7f], bl
mov byte [ebp + 0x6f], bl
mov byte [ebp + 0x45], 1
je 0x40a9a7
cmp edi, dword [ebp + 0x28]
je 0x40a9a7
cmp byte [ebp + 0x40], bl
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp + 0x5c]
mov dword [ebp + 0x28], edi
mov dword [ebp - 0xa0], ecx
jne 0x40ab96
cmp dword [ebp - 0x5c], 0x4b0
je 0x40ab89
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x14]
push edi
push eax
call fcn.0043723b
mov eax, dword [ebp - 0x14]
jmp 0x40ab96
mov word [eax + edi + 2], bx
mov ecx, dword [ebp + 0x5c]
mov word [ecx + edi + 2], bx
cmp byte [ebp + 0x7f], 1
jne 0x40abb3
mov ecx, dword [ebp + 0x50]
push eax
push eax
push 0x497994
push dword [ebp + 0x34]
push dword [ebp + 0x34]
call fcn.00434577
jmp 0x40abdd
cmp byte [ebp + 0x40], bl
je 0x40abd1
push ebx
lea eax, [ebp + 0x5c]
push eax
push edi
push dword [ebp + 0x5c]
push dword [ebp - 0x40]
push dword [ebp + 0x50]
call fcn.00446c1d
add esp, 0x18
jmp 0x40abdd
mov ecx, dword [ebp + 0x50]
push eax
push dword [ebp + 0x34]
call fcn.00436b54
cmp dword [ebp - 0x70], ebx
je 0x40ac0c
push dword [ebp - 0x70]
lea ecx, [ebp - 0x98]
call fcn.004419bc
mov ecx, dword [ebp + 0x50]
push ebx
push ebx
push ebx
push dword [ebp - 0x98]
call fcn.00427548
lea ecx, [ebp - 0x98]
call fcn.00431c4c
cmp byte [ebp + 0x45], bl
je 0x40aaa0
lea ecx, [ebp - 0x14]
call fcn.00431c4c
jmp 0x40ad08
cmp dword [ebp + 0x24], 0xffffff9c
je 0x40ad08
jmp 0x40acf8
mov ecx, dword [ebp + 0x50]
push 0x4ff
push 0x3e8
push ebx
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x64]
call fcn.0040f69d
mov ecx, dword [ebp - 0x64]
dec ecx
cmp ecx, eax
je 0x40ad08
cmp dword [ebp - 0x64], 1
jle 0x40acf0
cmp eax, ebx
jne 0x40acf0
lea eax, [edi + 0x100000]
cmp eax, esi
jl 0x40ac88
add esi, 0x100000
lea eax, [esi + 4]
push eax
lea ecx, [ebp + 0x5c]
call fcn.00437099
mov eax, dword [ebp + 0x5c]
push ebx
lea ecx, [ebp + 0x7c]
push ecx
add eax, edi
push 1
push eax
lea eax, [ebp - 0x1c]
push dword [eax]
mov dword [ebp + 0x7c], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40acf0
cmp dword [ebp + 0x7c], ebx
jbe 0x40acf0
add edi, dword [ebp + 0x7c]
mov eax, dword [ebp + 0x5c]
mov byte [eax + edi], bl
jmp 0x40acf0
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x40acf8
cmp dword [ebp - 0x188], 0x12
je 0x40acf8
lea eax, [ebp - 0x18c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x18c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp byte [0x4ae290], bl
jg 0x40acb7
mov al, byte [0x4ae290]
cmp al, bl
mov byte [ebp + 0x6f], al
jg 0x40ac31
cmp dword [ebp + 0x24], 0xffffff9c
mov eax, dword [ebp + 0x5c]
mov byte [eax + edi + 2], bl
mov eax, dword [ebp + 0x5c]
mov byte [eax + edi + 1], bl
mov eax, dword [ebp + 0x5c]
mov byte [eax + edi], bl
mov dword [ebp - 0x18], ebx
je 0x40ad39
cmp byte [ebp + 0x6f], bl
jle 0x40ad39
push ebx
lea eax, [ebp - 0x140]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x140]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp byte [ebp + 0x77], bl
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 0x78]
mov dword [ecx], eax
je 0x40af13
mov eax, dword [ebp - 0x40]
mov ax, word [eax]
xor esi, esi
cmp ax, 0x40
je 0x40ad84
cmp byte [ebp - 0xb], bl
je 0x40ad84
cmp ax, 0x26
je 0x40ad7e
mov eax, dword [ebp + 0x50]
test byte [eax + 9], 0xf
je 0x40ad84
mov byte [ebp + 0x7b], 1
jmp 0x40ad87
mov byte [ebp + 0x7b], bl
lea ecx, [ebp - 0xb0]
call fcn.00437055
cmp byte [ebp + 0x7b], bl
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
jne 0x40aeaf
cmp byte [ebp + 0x47], 2
jne 0x40adb9
mov eax, dword [ebp + 0x5c]
mov word [eax + edi], bx
mov esi, dword [ebp + 0x5c]
jmp 0x40ae1c
cmp byte [ebp + 0x47], 1
lea ecx, [ebp - 0xb0]
jne 0x40add3
push dword [ebp - 0x5c]
push edi
push dword [ebp + 0x5c]
call fcn.0043723b
jmp 0x40ae20
lea eax, [edi + 0x18]
push eax
call fcn.004371c5
lea eax, [edi + 1]
push eax
push dword [ebp + 0x5c]
mov dword [ebp - 0xa8], edi
push dword [ebp - 0xb0]
mov dword [ebp - 0xac], edi
call fcn.00410b58
mov eax, dword [ebp - 0xb0]
push 0x10
add eax, edi
push ebx
push eax
call fcn.004832e0
lea eax, [ebp - 0xb0]
push 4
push eax
call fcn.0047a39a
add esp, 0x20
cmp esi, ebx
jne 0x40ae26
mov esi, dword [ebp - 0xb0]
test byte [ebp + 0x77], 4
je 0x40ae57
push esi
mov dword [ebp + 0x74], esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 - 2]
jmp 0x40ae50
mov ax, word [esi]
cmp ax, 0xd
je 0x40ae4b
cmp ax, 0xa
jne 0x40aeaf
mov word [esi], bx
dec esi
dec esi
cmp esi, dword [ebp + 0x74]
jae 0x40ae3c
jmp 0x40aeaf
test byte [ebp + 0x77], 1
jne 0x40ae76
test byte [ebp + 0x77], 2
je 0x40aeaf
jmp 0x40aea7
mov ax, word [esi]
cmp ax, 0xd
je 0x40ae7b
cmp ax, 0xa
je 0x40ae7b
inc esi
inc esi
cmp word [esi], bx
jne 0x40ae65
mov word [esi], bx
jmp 0x40aeaf
cmp ax, 0xd
je 0x40ae90
cmp ax, 0xa
je 0x40ae90
inc esi
inc esi
jmp 0x40aea7
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
lea eax, [esi + 2]
push eax
push esi
call fcn.00410b0e
add esp, 0xc
mov ax, word [esi]
cmp ax, bx
jne 0x40ae80
mov eax, dword [ebp - 0x40]
cmp word [eax], 0x40
jne 0x40aed9
push dword [ebp - 0xb0]
mov ecx, dword [ebp + 0x50]
push dword [ebp - 0xb0]
push 0x497994
push dword [ebp - 0x68]
push dword [ebp - 0x68]
call fcn.00434577
jmp 0x40af05
cmp byte [ebp + 0x7b], bl
je 0x40aef6
push 1
lea ecx, [ebp + 0x5c]
push ecx
push edi
push dword [ebp + 0x5c]
push eax
push dword [ebp + 0x50]
call fcn.00446c1d
add esp, 0x18
jmp 0x40af05
push dword [ebp - 0xb0]
mov ecx, dword [ebp + 0x50]
push eax
call fcn.00436b54
lea ecx, [ebp - 0xb0]
call fcn.00431c4c
mov eax, dword [ebp - 0x18]
push eax
mov dword [ebp + 0x7c], eax
lea eax, [ebp - 0x290]
push 0x498564
push eax
mov word [ebp - 0x290], bx
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp + 0x50]
add esp, 0xc
lea eax, [ebp - 0x290]
push eax
push str.ERRORLEVEL
call fcn.00436b54
cmp dword [ebp - 0x7c], ebx
je 0x40af57
push 1
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
lea ecx, [ebp + 0x5c]
call fcn.00431c4c
jmp 0x40af77
mov eax, dword [ebp - 0x40]
cmp word [eax], bx
je 0x40af77
mov ecx, dword [ebp + 0x50]
push 0x497994
push eax
call fcn.00436b54
lea esi, [ebp - 0x140]
mov eax, dword [esi]
cmp eax, ebx
je 0x40af8a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp + 0x3b], bl
mov dword [esi], ebx
je 0x40b0cd
cmp dword [esi + 8], ebx
je 0x40b0cd
cmp byte [0x4afc09], bl
jne 0x40b0cd
cmp dword [ebp + 0x24], ebx
mov byte [0x4afc09], 1
jne 0x40b053
push 0x1000
lea ecx, [ebp + 0x74]
call fcn.0043719c
mov eax, dword [ebp + 0x74]
push ebx
mov dword [ebp + 0x6c], ebx
mov word [eax], bx
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x74]
push eax
push str.SystemStartOptions
push str.SYSTEMCurrentControlSetControl
push 0x80000002
call fcn.0043b309
mov eax, dword [ebp + 0x74]
mov dword [ebp + 0x78], eax
lea eax, [ebp + 0x78]
push eax
call fcn.00431c97
mov eax, dword [ebp + 0x78]
add esp, 0x1c
cmp word [eax], bx
je 0x40b046
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
push 8
push eax
push str.PECMDHB
call esi
test eax, eax
je 0x40b03f
push 6
push dword [ebp + 0x78]
push str.WIMHB
call esi
test eax, eax
je 0x40b03f
lea eax, [ebp + 0x78]
push eax
call fcn.00404807
mov eax, dword [ebp + 0x78]
cmp word [eax], bx
pop ecx
jne 0x40b00d
jmp 0x40b046
mov dword [ebp + 0x24], 1
lea ecx, [ebp + 0x74]
call fcn.00431c4c
cmp dword [ebp + 0x24], ebx
je 0x40b07a
push str.SysStartuped
call fcn.0040f2cf
test eax, eax
pop ecx
jne 0x40b071
push str.exec
push dword [ebp + 0x50]
call fcn.0040f3c3
pop ecx
pop ecx
push ebx
call fcn.0040dc96
pop ecx
jmp 0x40b0cd
lea eax, [ebp - 0x140]
push dword [eax + 8]
lea eax, [ebp - 0x35c]
push str.__nfb__incmd_pecmd_TEAM_WAIT__InitSys__ncd__lu
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x35c]
push eax
push str.DELAY_bwinpeshl____s__r_n
push dword [ebp + 0x50]
call fcn.0040d391
mov ecx, dword [ebp + 0x50]
add esp, 0x18
push 0x4afb60
push ebx
push ebx
lea eax, [ebp + 0x7a]
push eax
push dword [ebp + 0x50]
lea eax, [ebp - 0x35c]
push eax
mov word [ebp + 0x7a], bx
call fcn.004074ae
mov ecx, dword [ebp - 0x58]
cmp ecx, ebx
je 0x40b0ea
cmp word [ecx], bx
je 0x40b0ea
lea eax, [ebp - 0x140]
push dword [eax + 8]
push ecx
call fcn.00402cf9
pop ecx
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [ebp - 0x4c]
mov eax, dword [edi]
cmp eax, ebx
je 0x40b0fc
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp + 0xc]
mov eax, dword [edi]
cmp eax, ebx
je 0x40b10a
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0x90]
cmp dword [edi], ebx
je 0x40b119
push ebx
call esi
mov dword [edi], ebx
lea edi, [ebp - 0x3c]
mov eax, dword [edi]
cmp eax, ebx
je 0x40b127
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0x1c]
mov eax, dword [edi]
cmp eax, ebx
je 0x40b135
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0x80]
mov eax, dword [edi]
cmp eax, ebx
je 0x40b143
push eax
call esi
cmp dword [ebp - 0x160], ebx
mov dword [edi], ebx
je 0x40b155
push dword [ebp - 0x160]
call esi
lea edi, [ebp - 0x140]
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x40b165
push eax
call esi
mov ecx, dword [ebp + 0x50]
push ebx
mov dword [edi + 4], ebx
call fcn.00449aab
mov ebx, dword [ebp + 0x7c]
lea ecx, [ebp - 0xbc]
call fcn.00431c4c
lea ecx, [ebp - 0xd8]
call fcn.00431c4c
lea ecx, [ebp - 0x2c]
call fcn.00402b75
lea ecx, [ebp - 0xe4]
call fcn.00431c4c
lea ecx, [ebp - 0x74]
call fcn.00402b75
lea ecx, [ebp - 0x78]
call fcn.00402b75
lea ecx, [ebp - 0x90]
call fcn.00402b75
lea ecx, [ebp + 0xc]
call fcn.00402b75
lea ecx, [ebp - 0x4c]
call fcn.00402b75
lea ecx, [ebp - 0x80]
call fcn.00402b75
lea ecx, [ebp - 0x3c]
call fcn.00402b75
lea ecx, [ebp - 0x1c]
call fcn.00402b75
lea ecx, [ebp - 0x58]
call fcn.00431c4c
lea ecx, [ebp - 0x14c]
call fcn.00431c4c
lea ecx, [ebp - 0xc4]
call fcn.00431c4c
lea ecx, [ebp - 0x50]
call fcn.00431c4c
lea ecx, [ebp - 0xfc]
call fcn.00431c4c
lea ecx, [ebp - 0xcc]
call fcn.00431c4c
lea ecx, [ebp - 0xe8]
call fcn.00431c4c
lea ecx, [ebp - 0x94]
call fcn.00431c4c
lea ecx, [ebp - 0x7c]
call fcn.00402b75
lea ecx, [ebp - 0xe0]
call fcn.00402b75
lea ecx, [ebp - 0x10c]
call fcn.00431c4c
lea ecx, [ebp - 0x60]
call fcn.00431c4c
lea ecx, [ebp - 0x9c]
call fcn.00431c4c
lea ecx, [ebp - 0x40]
call fcn.00431c4c
lea ecx, [ebp - 0x100]
call fcn.00431c4c
lea ecx, [ebp - 0xdc]
call fcn.00431c4c
lea ecx, [ebp - 0xf4]
call fcn.00431c4c
lea ecx, [ebp - 0xf0]
call fcn.00431c4c
lea ecx, [ebp - 0xd0]
call fcn.00431c4c
lea ecx, [ebp - 0xc8]
call fcn.00431c4c
pop edi
pop esi
mov eax, ebx
pop ebx
add ebp, 0x60
leave
ret 0x18