Function at 0x496640
Capabilities:
Check for time delay via gettickcount
Contain obfuscated stackstrings
Create directory
Create process on windows
Create process suspended
Encode data using xor
Encrypt or decrypt via wincrypt
Get file size
Read file on windows
Resolve function by parsing pe exports
Resume thread
Write and execute a file
Write file on windows

Disassembly:
mov eax, 0x1138
call fcn.004c0110
push ebx
push ebp
mov ebp, ecx
xor ebx, ebx
push esi
push edi
mov al, byte [ebp]
mov dword [esp + 0x24], ebp
cmp al, bl
jne 0x4985f9
call fcn.00498e40
mov byte [ebp + 0x1671], al
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
mov dword [ebp + 0x1604], eax
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov ecx, dword [esp + 0x114c]
mov dword [0x5138f4], eax
lea eax, [ebp + 0x1608]
push 0x20
push ecx
push eax
call dword [sym.imp.msvcr71.dll__mbsnbcpy]
add esp, 0xc
mov ecx, ebp
mov byte [ebp + 0x1627], bl
push 0x104
push 0x5135cc
call fcn.00498f10
push ebx
push 0x5135cc
call dword [sym.imp.msvcr71.dll__access]
add esp, 8
cmp eax, 0xffffffff
jne 0x49670f
push ebx
push 0x5135cc
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x49670f
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
call esi
push eax
push 0x4fcc68
call fcn.0049e730
add esp, 4
add ebp, 0x20
push eax
push ebp
call fcn.00498790
add esp, 0xc
mov eax, 0x6f
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1138
ret 4
mov esi, dword [sym.imp.kernel32.dll_lstrcatA]
push 0x4fcc64
push 0x5135cc
call esi
push 0x4fcc54
call fcn.0049e730
add esp, 4
push eax
push 0x5135cc
call esi
add ebp, 0x20
mov byte [esp + 0x28], 6
mov byte [esp + 0x29], 2
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], bl
mov byte [esp + 0x2d], 0xa4
mov byte [esp + 0x2e], bl
mov byte [esp + 0x2f], bl
mov byte [esp + 0x30], 0x52
mov byte [esp + 0x31], 0x53
mov byte [esp + 0x32], 0x41
mov byte [esp + 0x33], 0x31
mov byte [esp + 0x34], bl
mov byte [esp + 0x35], 2
mov byte [esp + 0x36], bl
mov byte [esp + 0x37], bl
mov byte [esp + 0x38], 1
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], 1
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], 0x69
mov byte [esp + 0x3d], 0xb3
mov byte [esp + 0x3e], 0xdd
mov byte [esp + 0x3f], 0xe8
mov byte [esp + 0x40], 0x3d
mov byte [esp + 0x41], 0x70
mov byte [esp + 0x42], 0xa5
mov byte [esp + 0x43], 0xfb
mov byte [esp + 0x44], 0xd7
mov byte [esp + 0x45], 0xb8
mov byte [esp + 0x46], 0xfb
mov byte [esp + 0x47], 0x60
mov byte [esp + 0x48], 0x68
mov byte [esp + 0x49], 0xf
mov byte [esp + 0x4a], 0x99
mov byte [esp + 0x4b], 0xc2
mov byte [esp + 0x4c], 0xb9
mov byte [esp + 0x4d], 0xe4
mov byte [esp + 0x4e], 0x20
mov byte [esp + 0x4f], 0x83
mov byte [esp + 0x50], 0xb5
mov byte [esp + 0x51], 0xe6
mov byte [esp + 0x52], 0x5d
mov byte [esp + 0x53], 0xbf
mov byte [esp + 0x54], 0x69
mov byte [esp + 0x55], 0x62
mov byte [esp + 0x56], 0x23
mov byte [esp + 0x57], 0x29
mov byte [esp + 0x58], 0x6e
mov byte [esp + 0x59], 0xe6
mov byte [esp + 0x5a], 0x68
mov byte [esp + 0x5b], 0xb
mov byte [esp + 0x5c], 0xea
mov byte [esp + 0x5d], 0xea
mov byte [esp + 0x5e], 0x60
mov byte [esp + 0x5f], 0xde
mov byte [esp + 0x60], 0xba
mov byte [esp + 0x61], 0x87
mov byte [esp + 0x62], 0x7e
mov byte [esp + 0x63], 0x39
mov byte [esp + 0x64], 0x37
mov byte [esp + 0x65], 0x26
mov byte [esp + 0x66], 0x45
mov byte [esp + 0x67], 0xd7
mov byte [esp + 0x68], 0x3b
mov byte [esp + 0x69], 0x2a
mov byte [esp + 0x6a], 0xac
mov byte [esp + 0x6b], 0x79
mov byte [esp + 0x6c], 0xb0
mov byte [esp + 0x6d], 0x40
mov eax, dword [ebp]
mov byte [esp + 0x6e], 0xb2
cmp eax, 0xffffffff
mov byte [esp + 0x6f], 0x26
mov byte [esp + 0x70], 0xcb
mov byte [esp + 0x71], 0xdb
mov byte [esp + 0x72], 0xb8
mov byte [esp + 0x73], 0x4d
mov byte [esp + 0x74], 0x55
mov byte [esp + 0x75], 0x12
mov byte [esp + 0x76], 0x17
mov byte [esp + 0x77], 0x65
mov byte [esp + 0x78], 0x17
mov byte [esp + 0x79], 0xc9
mov byte [esp + 0x7a], 0x85
mov byte [esp + 0x7b], 0xba
jne 0x496cba
mov edi, 0x5135cc
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp + 0x1438], ebx
mov dword [ebp + 0x143c], 0x3e8
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jbe 0x49693a
cmp byte [0x5135cd], 0x3a
je 0x49693a
lea edx, [esp + 0x23c]
push 0x104
push edx
push ebx
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
lea eax, [esp + 0x23c]
push 0x5c
push eax
call dword [sym.imp.msvcr71.dll__mbsrchr]
add esp, 8
cmp eax, ebx
lea edx, [eax + 1]
jne 0x496941
lea edx, [esp + 0x23c]
mov edi, 0x5135cc
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x80000080
mov eax, ecx
mov esi, edi
mov edi, edx
push 2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
push 1
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x250]
push 0xc0000000
push ecx
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp], eax
je 0x496cba
lea esi, [ebp + 0x101c]
push esi
call dword [sym.imp.kernel32.dll_GetLocalTime]
xor edx, edx
xor eax, eax
mov dx, word [ebp + 0x102a]
mov ax, word [ebp + 0x1028]
push edx
xor ecx, ecx
mov cx, word [ebp + 0x1026]
xor edx, edx
mov dx, word [ebp + 0x1024]
push eax
push ecx
xor eax, eax
mov ax, word [ebp + 0x1022]
push edx
xor ecx, ecx
xor edx, edx
mov cx, word [ebp + 0x101e]
mov dx, word [esi]
push eax
push ecx
push edx
push 0x4fcc04
lea edi, [ebp + 0x1c]
call fcn.0049e6c0
add esp, 4
push eax
push edi
call dword [sym.imp.msvcr71.dll_sprintf]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x24
repne scasb al, byte es:[edi]
mov eax, dword [ebp + 0x143c]
not ecx
dec ecx
cmp eax, 0x3e7
mov dword [esp + 0x1c], ecx
jne 0x496a1a
xor edi, edi
mov dword [esp + 0x1c], edi
jmp 0x496a1e
mov edi, dword [esp + 0x1c]
cmp dword [ebp + 0x1438], ebx
je 0x496a65
cmp edi, ebx
jle 0x496cad
mov esi, 0xffffffe4
lea eax, [ebp + 0x1c]
sub esi, ebp
mov ecx, 2
mov edx, dword [ebp + 0x1438]
add edx, ecx
mov dword [ebp + 0x1438], edx
add dl, 0x43
xor byte [eax], dl
inc eax
lea edx, [esi + eax]
cmp edx, edi
jl 0x496a3d
push ebx
lea edx, [esp + 0x9c]
jmp 0x497285
xor edi, edi
mov di, word [ebp + 0x102a]
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dx, word [ebp + 0x1028]
mov cx, word [ebp + 0x1026]
add eax, edi
add eax, edx
mov dx, word [ebp + 0x101e]
add ecx, eax
mov ax, word [ebp + 0x1022]
imul eax, edx
mov dx, word [esi]
mov esi, 0xa
imul eax, edx
imul eax, edi
inc eax
xor edx, edx
imul ecx, eax
and ecx, 0xffff
or ecx, 0xdc000000
mov eax, ecx
div esi
xor edx, 0x55
shl edx, 0x10
or edx, ecx
mov dword [ebp + 0x102c], edx
call dword [sym.imp.kernel32.dll_GetTickCount]
push eax
call dword [sym.imp.msvcr71.dll_srand]
mov esi, dword [sym.imp.msvcr71.dll_rand]
add esp, 4
xor edi, edi
call esi
and eax, 0x800000ff
jns 0x496af3
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + edi + 0xa0], al
inc edi
cmp edi, 0x10
jl 0x496ae3
lea ecx, [esp + 0xa0]
lea eax, [ebp + 0x1030]
push ecx
push 0x10
push eax
call fcn.0049df80
add esp, 0xc
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
push 0xf0000000
push 1
push 0x4fcbd8
push ebx
push edx
call dword [sym.imp.advapi32.dll_CryptAcquireContextA]
test eax, eax
je 0x496c90
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push ebx
push ebx
lea ecx, [esp + 0x34]
push 0x54
push ecx
push edx
call dword [sym.imp.advapi32.dll_CryptImportKey]
test eax, eax
je 0x496c84
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push ebx
push 1
push ebx
push ecx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.advapi32.dll_CryptEncrypt]
mov esi, dword [esp + 0x10]
cmp esi, ebx
je 0x496c20
push esi
call fcn.004bf8c2
mov edi, eax
mov eax, dword [esp + 0xa4]
mov edx, edi
mov dword [esp + 0x14], 0x10
add esp, 4
mov dword [edx], eax
mov ecx, dword [esp + 0xa4]
push esi
mov dword [edx + 4], ecx
mov eax, dword [esp + 0xac]
mov dword [edx + 8], eax
mov ecx, dword [esp + 0xb0]
mov dword [edx + 0xc], ecx
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x14]
push edx
push edi
push ebx
push 1
push ebx
push eax
call dword [sym.imp.advapi32.dll_CryptEncrypt]
test eax, eax
je 0x496c15
mov eax, dword [ebp]
lea ecx, [esp + 0x10]
push ebx
push ecx
lea edx, [esp + 0x88]
push 4
push edx
push eax
mov dword [esp + 0x94], 0xccdc00
call dword [sym.imp.kernel32.dll_WriteFile]
mov edx, dword [ebp]
lea ecx, [esp + 0x10]
push ebx
push ecx
push esi
push edi
push edx
call dword [sym.imp.kernel32.dll_WriteFile]
push edi
call sub.msvcr71.dll_void___cdecl_operator_delete_void__
add esp, 4
jmp 0x496c79
mov edx, dword [ebp]
mov esi, dword [sym.imp.kernel32.dll_WriteFile]
lea eax, [esp + 0x10]
push ebx
push eax
lea ecx, [esp + 0x84]
push 4
push ecx
push edx
mov dword [esp + 0x90], 0xccdd00
call esi
xor eax, eax
mov cl, byte [esp + eax + 0xa0]
mov dl, byte [esp + eax + 0x3c]
xor cl, dl
mov byte [esp + eax + 0xc4], cl
inc eax
cmp eax, 0x10
jl 0x496c49
mov ecx, dword [ebp]
lea edx, [esp + 0x10]
push ebx
push edx
lea eax, [esp + 0xcc]
push 0x10
push eax
push ecx
call esi
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.advapi32.dll_CryptDestroyKey]
mov eax, dword [esp + 0x14]
push ebx
push eax
call dword [sym.imp.advapi32.dll_CryptReleaseContext]
mov ecx, dword [esp + 0x1c]
lea eax, [ebp + 0x1c]
push eax
push eax
lea eax, [ebp + 0x1030]
push ecx
push eax
call fcn.0049e070
mov edi, dword [esp + 0x2c]
add esp, 0x10
push ebx
lea edx, [esp + 0x9c]
jmp 0x497285
push 0x2e
push 0x5135cc
call dword [sym.imp.msvcr71.dll__mbsrchr]
mov esi, eax
add esp, 8
cmp esi, ebx
mov dword [esp + 0x7c], esi
je 0x497295
mov eax, 1
mov dword [esp + 0x14], eax
push eax
push 0x4fcbcc
call fcn.0049e730
add esp, 4
push eax
push esi
call dword [sym.imp.msvcr71.dll_sprintf]
add esp, 0xc
mov byte [esp + 0x28], 6
mov byte [esp + 0x29], 2
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], bl
mov byte [esp + 0x2d], 0xa4
mov byte [esp + 0x2e], bl
mov byte [esp + 0x2f], bl
mov byte [esp + 0x30], 0x52
mov byte [esp + 0x31], 0x53
mov byte [esp + 0x32], 0x41
mov byte [esp + 0x33], 0x31
mov byte [esp + 0x34], bl
mov byte [esp + 0x35], 2
mov byte [esp + 0x36], bl
mov byte [esp + 0x37], bl
mov byte [esp + 0x38], 1
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], 1
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], 0x69
mov byte [esp + 0x3d], 0xb3
mov byte [esp + 0x3e], 0xdd
mov byte [esp + 0x3f], 0xe8
mov byte [esp + 0x40], 0x3d
mov byte [esp + 0x41], 0x70
mov byte [esp + 0x42], 0xa5
mov byte [esp + 0x43], 0xfb
mov byte [esp + 0x44], 0xd7
mov byte [esp + 0x45], 0xb8
mov byte [esp + 0x46], 0xfb
mov byte [esp + 0x47], 0x60
mov byte [esp + 0x48], 0x68
mov byte [esp + 0x49], 0xf
mov byte [esp + 0x4a], 0x99
mov byte [esp + 0x4b], 0xc2
mov byte [esp + 0x4c], 0xb9
mov byte [esp + 0x4d], 0xe4
mov byte [esp + 0x4e], 0x20
mov byte [esp + 0x4f], 0x83
mov byte [esp + 0x50], 0xb5
mov byte [esp + 0x51], 0xe6
mov byte [esp + 0x52], 0x5d
mov byte [esp + 0x53], 0xbf
mov byte [esp + 0x54], 0x69
mov byte [esp + 0x55], 0x62
mov byte [esp + 0x56], 0x23
mov byte [esp + 0x57], 0x29
mov byte [esp + 0x58], 0x6e
mov byte [esp + 0x59], 0xe6
mov byte [esp + 0x5a], 0x68
mov byte [esp + 0x5b], 0xb
mov byte [esp + 0x5c], 0xea
mov byte [esp + 0x5d], 0xea
mov byte [esp + 0x5e], 0x60
mov byte [esp + 0x5f], 0xde
mov byte [esp + 0x60], 0xba
mov byte [esp + 0x61], 0x87
mov byte [esp + 0x62], 0x7e
mov byte [esp + 0x63], 0x39
mov byte [esp + 0x64], 0x37
mov byte [esp + 0x65], 0x26
mov byte [esp + 0x66], 0x45
mov byte [esp + 0x67], 0xd7
mov byte [esp + 0x68], 0x3b
mov byte [esp + 0x69], 0x2a
mov byte [esp + 0x6a], 0xac
mov byte [esp + 0x6b], 0x79
mov byte [esp + 0x6c], 0xb0
mov byte [esp + 0x6d], 0x40
mov byte [esp + 0x6e], 0xb2
mov byte [esp + 0x6f], 0x26
mov byte [esp + 0x70], 0xcb
mov eax, dword [ebp]
mov byte [esp + 0x71], 0xdb
cmp eax, 0xffffffff
mov byte [esp + 0x72], 0xb8
mov byte [esp + 0x73], 0x4d
mov byte [esp + 0x74], 0x55
mov byte [esp + 0x75], 0x12
mov byte [esp + 0x76], 0x17
mov byte [esp + 0x77], 0x65
mov byte [esp + 0x78], 0x17
mov byte [esp + 0x79], 0xc9
mov byte [esp + 0x7a], 0x85
mov byte [esp + 0x7b], 0xba
jne 0x496f4a
mov edi, 0x5135cc
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp + 0x1438], ebx
mov dword [ebp + 0x143c], 0x3e8
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jbe 0x496efb
cmp byte [0x5135cd], 0x3a
je 0x496efb
lea ecx, [esp + 0x23c]
push 0x104
push ecx
push ebx
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
lea edx, [esp + 0x23c]
push 0x5c
push edx
call dword [sym.imp.msvcr71.dll__mbsrchr]
add esp, 8
cmp eax, ebx
lea edx, [eax + 1]
jne 0x496f02
lea edx, [esp + 0x23c]
mov edi, 0x5135cc
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x80000080
mov eax, ecx
mov esi, edi
mov edi, edx
push 2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
push 1
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x250]
push 0xc0000000
push ecx
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp], eax
jne 0x496f65
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 0xa
mov dword [esp + 0x14], eax
jge 0x497295
mov esi, dword [esp + 0x7c]
jmp 0x496ce1
lea esi, [ebp + 0x101c]
push esi
call dword [sym.imp.kernel32.dll_GetLocalTime]
xor edx, edx
xor eax, eax
mov dx, word [ebp + 0x102a]
mov ax, word [ebp + 0x1028]
push edx
xor ecx, ecx
mov cx, word [ebp + 0x1026]
xor edx, edx
mov dx, word [ebp + 0x1024]
push eax
push ecx
xor eax, eax
mov ax, word [ebp + 0x1022]
push edx
xor ecx, ecx
xor edx, edx
mov cx, word [ebp + 0x101e]
mov dx, word [esi]
push eax
push ecx
push edx
push 0x4fcc04
lea edi, [ebp + 0x1c]
call fcn.0049e6c0
add esp, 4
push eax
push edi
call dword [sym.imp.msvcr71.dll_sprintf]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x24
repne scasb al, byte es:[edi]
mov eax, dword [ebp + 0x143c]
not ecx
dec ecx
cmp eax, 0x3e7
mov dword [esp + 0x18], ecx
jne 0x496ff2
xor edi, edi
mov dword [esp + 0x18], edi
jmp 0x496ff6
mov edi, dword [esp + 0x18]
cmp dword [ebp + 0x1438], ebx
je 0x497035
cmp edi, ebx
jle 0x49727d
mov esi, 0xffffffe4
lea eax, [ebp + 0x1c]
sub esi, ebp
mov ecx, 2
mov edx, dword [ebp + 0x1438]
add edx, ecx
mov dword [ebp + 0x1438], edx
add dl, 0x43
xor byte [eax], dl
inc eax
lea edx, [esi + eax]
cmp edx, edi
jl 0x497015
jmp 0x49727d
xor edi, edi
mov di, word [ebp + 0x102a]
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dx, word [ebp + 0x1028]
mov cx, word [ebp + 0x1026]
add eax, edi
add eax, edx
mov dx, word [ebp + 0x1022]
add ecx, eax
mov ax, word [esi]
imul eax, edx
mov dx, word [ebp + 0x101e]
mov esi, 0xa
imul eax, edx
imul eax, edi
inc eax
xor edx, edx
imul ecx, eax
and ecx, 0xffff
or ecx, 0xdc000000
mov eax, ecx
div esi
xor edx, 0x55
shl edx, 0x10
or edx, ecx
mov dword [ebp + 0x102c], edx
call dword [sym.imp.kernel32.dll_GetTickCount]
push eax
call dword [sym.imp.msvcr71.dll_srand]
mov esi, dword [sym.imp.msvcr71.dll_rand]
add esp, 4
xor edi, edi
call esi
and eax, 0x800000ff
jns 0x4970c3
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + edi + 0xa0], al
inc edi
cmp edi, 0x10
jl 0x4970b3
lea ecx, [esp + 0xa0]
lea eax, [ebp + 0x1030]
push ecx
push 0x10
push eax
call fcn.0049df80
add esp, 0xc
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
push 0xf0000000
push 1
push 0x4fcbd8
push ebx
push edx
call dword [sym.imp.advapi32.dll_CryptAcquireContextA]
test eax, eax
je 0x497260
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
lea ecx, [esp + 0x34]
push 0x54
push ecx
push edx
call dword [sym.imp.advapi32.dll_CryptImportKey]
test eax, eax
je 0x497254
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push ebx
push 1
push ebx
push ecx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.advapi32.dll_CryptEncrypt]
mov esi, dword [esp + 0x10]
cmp esi, ebx
je 0x4971f0
push esi
call fcn.004bf8c2
mov edi, eax
mov eax, dword [esp + 0xa4]
mov edx, edi
mov dword [esp + 0x14], 0x10
add esp, 4
mov dword [edx], eax
mov ecx, dword [esp + 0xa4]
push esi
mov dword [edx + 4], ecx
mov eax, dword [esp + 0xac]
mov dword [edx + 8], eax
mov ecx, dword [esp + 0xb0]
mov dword [edx + 0xc], ecx
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x14]
push edx
push edi
push ebx
push 1
push ebx
push eax
call dword [sym.imp.advapi32.dll_CryptEncrypt]
test eax, eax
je 0x4971e5
mov eax, dword [ebp]
lea ecx, [esp + 0x10]
push ebx
push ecx
lea edx, [esp + 0x84]
push 4
push edx
push eax
mov dword [esp + 0x90], 0xccdc00
call dword [sym.imp.kernel32.dll_WriteFile]
mov edx, dword [ebp]
lea ecx, [esp + 0x10]
push ebx
push ecx
push esi
push edi
push edx
call dword [sym.imp.kernel32.dll_WriteFile]
push edi
call sub.msvcr71.dll_void___cdecl_operator_delete_void__
add esp, 4
jmp 0x497249
mov edx, dword [ebp]
mov esi, dword [sym.imp.kernel32.dll_WriteFile]
lea eax, [esp + 0x10]
push ebx
push eax
lea ecx, [esp + 0x88]
push 4
push ecx
push edx
mov dword [esp + 0x94], 0xccdd00
call esi
xor eax, eax
mov cl, byte [esp + eax + 0xa0]
mov dl, byte [esp + eax + 0x3c]
xor cl, dl
mov byte [esp + eax + 0xc4], cl
inc eax
cmp eax, 0x10
jl 0x497219
mov ecx, dword [ebp]
lea edx, [esp + 0x10]
push ebx
push edx
lea eax, [esp + 0xcc]
push 0x10
push eax
push ecx
call esi
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.advapi32.dll_CryptDestroyKey]
mov eax, dword [esp + 0x14]
push ebx
push eax
call dword [sym.imp.advapi32.dll_CryptReleaseContext]
mov ecx, dword [esp + 0x18]
lea eax, [ebp + 0x1c]
push eax
push eax
lea eax, [ebp + 0x1030]
push ecx
push eax
call fcn.0049e070
mov edi, dword [esp + 0x28]
add esp, 0x10
push ebx
lea edx, [esp + 0x9c]
push edx
lea eax, [ebp + 0x1c]
push edi
push eax
mov eax, dword [ebp]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
push 0x4fcbb0
push 0x2f
push 0x4fcb84
call fcn.0049e6c0
add esp, 4
push eax
push ebp
call fcn.00498790
mov esi, dword [esp + 0x34]
mov ecx, dword [esp + 0x115c]
add esp, 0x10
mov edx, dword [esi + 0x1604]
push fcn.004960b0
push ecx
push edx
push 0x4fcb44
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
add esp, 0x14
call fcn.0049a470
call fcn.0049a550
cmp byte [esi + 0x1684], bl
je 0x4972fe
push 1
call fcn.0049c150
add esp, 4
push 0x251c
mov ecx, esi
call fcn.004997e0
test eax, eax
jne 0x497337
push 0x4fcb28
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
add esp, 8
mov eax, 0x73
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1138
ret 4
push ebx
mov ecx, esi
call fcn.004998f0
test eax, eax
jne 0x4973cf
push 0x4fcb14
call fcn.0049e730
add esp, 4
push eax
push ebx
push 0x100002
call dword [sym.imp.kernel32.dll_OpenEventA]
mov edi, eax
cmp edi, ebx
jne 0x497379
pop edi
pop esi
pop ebp
mov eax, 0x6e
pop ebx
add esp, 0x1138
ret 4
push ebx
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x497396
push edi
call dword [sym.imp.kernel32.dll_SetEvent]
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
push 0x251c
mov ecx, esi
call fcn.004998f0
test eax, eax
jne 0x4973b8
pop edi
pop esi
pop ebp
mov eax, 0x6e
pop ebx
add esp, 0x1138
ret 4
push 0x4fcaf4
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
add esp, 8
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edi, dword [sym.imp.kernel32.dll_CreateEventA]
and eax, 0xfff00000
mov dword [esp + 0x14], eax
push ebx
push ebx
lea eax, [esp + 0xb8]
push ebx
push eax
mov dword [esp + 0xc0], 0xc
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xc8], 1
call edi
cmp eax, ebx
mov dword [esi + 0x1680], eax
jne 0x49742a
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
call esi
push eax
push 0x4fcad0
jmp 0x497478
push ebx
push ebx
lea ecx, [esp + 0xb8]
push 1
push ecx
call edi
cmp eax, ebx
mov dword [esi + 0x18], eax
jne 0x497451
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
call esi
push eax
push 0x4fcaac
jmp 0x497478
push ebx
push ebx
lea edx, [esp + 0xb8]
push ebx
push edx
call edi
cmp eax, ebx
mov dword [esi + 0x167c], eax
jne 0x49749c
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
call esi
push eax
push 0x4fca88
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
add esp, 0xc
mov eax, 0xab
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1138
ret 4
push 0x4fca80
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
mov ecx, dword [esp + 0x2c]
add esp, 8
lea eax, [esp + 0x138]
push 0x104
push eax
call fcn.00498f60
mov edi, 0x4fcc64
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x138]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x4fca6c
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0049e730
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x13c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x140]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.msvcr71.dll__access]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x49757a
lea ecx, [esp + 0x138]
push ecx
push 0x4fca58
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
add esp, 0xc
mov eax, 0x99
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1138
ret 4
mov esi, dword [esp + 0x24]
lea edx, [esp + 0x138]
push 1
push edx
lea ecx, [esi + 0x15bc]
mov byte [esp + 0x2b], bl
call fcn.0049cbd0
test al, al
jne 0x49774f
mov eax, dword [esi + 0x1600]
mov byte [esp + 0x22], bl
cmp eax, 8
jne 0x4975c0
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x80090006
jne 0x4975c0
mov byte [esp + 0x22], 1
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, dword [esi + 0x1600]
lea eax, [esp + 0x138]
push eax
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push edi
push 0x4fca3c
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
add esp, 0x14
lea ecx, [esp + 0x138]
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push ecx
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x497640
lea edx, [esp + 0x138]
push edx
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push 0x4fca24
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
add esp, 0x10
jmp 0x4976aa
push ebx
push edi
call dword [sym.imp.kernel32.dll_GetFileSize]
push eax
push 0x4fca14
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
add esp, 0xc
push 2
push ebx
push 0xfffffffffffffffc
push edi
call dword [sym.imp.kernel32.dll_SetFilePointer]
lea eax, [esp + 0x98]
push ebx
push eax
lea ecx, [esp + 0x24]
push 4
push ecx
push edi
mov dword [esp + 0x30], ebx
call dword [sym.imp.kernel32.dll_ReadFile]
mov edx, dword [esp + 0x1c]
push edx
push 0x4fca04
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
add esp, 0xc
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp byte [esp + 0x22], bl
je 0x497726
cmp byte [esi + 0x1671], bl
jne 0x4976f0
call fcn.0049b4c0
test al, al
je 0x4976f0
lea eax, [esp + 0x138]
push 1
push eax
lea ecx, [esi + 0x15bc]
call fcn.0049cbd0
test al, al
jne 0x497707
cmp dword [esi + 0x1600], 8
jne 0x497702
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x80090006
jne 0x497702
pop edi
pop esi
pop ebp
mov eax, 0x9b
pop ebx
add esp, 0x1138
ret 4
mov byte [esp + 0x23], 1
push 0x4fc9ec
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
mov al, byte [esp + 0x2b]
add esp, 8
cmp al, bl
je 0x49774f
push 0x4fc9c8
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
add esp, 8
mov eax, 0x7c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1138
ret 4
push 0x4fc9c0
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0xdc]
mov edx, dword [0x513910]
rep stosd dword es:[edi], eax
xor ecx, ecx
mov eax, dword [esi + 0x1604]
mov dword [esp + 0x8c], ecx
add esp, 8
mov dword [esp + 0x88], ecx
mov dword [esp + 0xd4], 0x44
mov dword [esp + 0x8c], ecx
push edx
mov edx, dword [esi + 0x1680]
mov dword [esp + 0x94], ecx
mov ecx, dword [esi + 0x18]
push eax
push ecx
lea eax, [esi + 0x1608]
push edx
push eax
mov eax, dword [esp + 0x28]
push eax
push 0x4fc9a8
call fcn.0049e730
add esp, 4
lea ecx, [esp + 0x35c]
push eax
push ecx
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0x20
lea edx, [esp + 0x344]
push edx
push 0x4fc9a0
push ebp
call fcn.00498790
lea eax, [esp + 0x350]
push eax
call fcn.0049e620
lea ecx, [esp + 0xd58]
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], ecx
lea edi, [esp + 0x354]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
push edi
push 0x4fc998
push ebp
call fcn.00498790
lea eax, [edi + 4]
add esp, 0xc
cmp eax, ebx
jle 0x497872
mov edi, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x10]
xor eax, eax
mov al, byte [ecx]
inc ecx
push eax
push 0x4fc990
push edi
mov dword [esp + 0x1c], ecx
call dword [sym.imp.user32.dll_wsprintfA]
add edi, eax
mov eax, dword [esp + 0x20]
add esp, 0xc
dec eax
mov dword [esp + 0x14], eax
jne 0x497846
jmp 0x497876
mov edi, dword [esp + 0x18]
lea edx, [esp + 0xd48]
mov byte [edi], bl
push edx
push 0x4fc988
push ebp
call fcn.00498790
add esp, 0xc
lea eax, [esp + 0x84]
lea ecx, [esp + 0xd4]
lea edx, [esp + 0xd48]
push eax
push ecx
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [esp + 0x158]
push edx
push eax
call dword [sym.imp.kernel32.dll_CreateProcessA]
test eax, eax
jne 0x497903
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
lea ecx, [esp + 0x344]
push ecx
call esi
lea edx, [esp + 0x13c]
push eax
push edx
push 0x4fc960
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
add esp, 0x14
mov eax, 0xaa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1138
ret 4
push 0x4fc958
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
mov eax, dword [esi + 0x1680]
mov ecx, dword [esp + 0x8c]
add esp, 8
lea edx, [esp + 0xbc]
mov dword [esp + 0x94], ebx
mov dword [esp + 0xbc], eax
push 0xffffffffffffffff
push ebx
push edx
push 2
mov dword [esp + 0xd0], ecx
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
test eax, eax
je 0x4979dc
mov ecx, dword [esp + 0x84]
lea eax, [esp + 0x94]
push eax
push ecx
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
test eax, eax
jne 0x49798f
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push 0x4fc934
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
add esp, 0xc
mov edx, dword [esp + 0x94]
push edx
push 0x4fc910
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
mov eax, dword [esp + 0x90]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
add esp, 0xc
push eax
call esi
mov ecx, dword [esp + 0x88]
push ecx
call esi
mov eax, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1138
ret 4
push 0x4fc908
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
lea edx, [esp + 0x8c]
push edx
call fcn.0049af20
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
add esp, 0xc
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x84]
push eax
call esi
mov ecx, dword [esp + 0x88]
push ecx
call esi
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x444]
push 0x104
push edx
call fcn.00498f10
mov edi, 0x4fcc64
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x444]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x4fc8fc
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, dword [esp + 0x28]
and ecx, 3
lea edx, [esp + 0x448]
rep movsb byte es:[edi], byte [esi]
lea edi, [eax + 0x1608]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0049e730
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x444]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x444]
and ecx, 3
push 1
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x28]
push eax
add ecx, 0x15bc
call fcn.0049cbd0
test al, al
jne 0x497b13
mov edi, dword [sym.imp.kernel32.dll_GetLastError]
call edi
mov edx, dword [esp + 0x24]
mov esi, dword [edx + 0x1600]
call edi
push eax
push esi
push 0x4fc8e4
jmp 0x498075
mov eax, dword [0x4fc4d0]
push eax
call fcn.0049e730
mov esi, dword [esp + 0x28]
add esp, 4
add eax, 5
lea ecx, [esp + 0x548]
push eax
push 0x7ff
lea edx, [esp + 0x44c]
push ecx
push edx
lea ecx, [esi + 0x15bc]
call fcn.0049cff0
test al, al
jne 0x497b88
mov edi, dword [sym.imp.kernel32.dll_GetLastError]
call edi
mov esi, dword [esi + 0x1600]
call edi
push eax
push esi
push 0x4fc8c4
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
add esp, 0x10
mov eax, 0x82
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1138
ret 4
push 0x4fc8b8
call fcn.0049e6c0
add esp, 4
mov edi, eax
lea eax, [esp + 0x548]
lea ecx, [esp + 0x118]
push eax
push 0x20
push ecx
push 0x4fc8ac
call fcn.0049e6c0
add esp, 4
push eax
push 0x4fc89c
call fcn.0049e730
add esp, 4
push eax
push edi
call fcn.0049ee10
lea eax, [esi + 0x1608]
lea edx, [esp + 0x130]
push eax
push edx
call dword [sym.imp.msvcr71.dll__mbsicmp]
add esp, 0x20
test eax, eax
je 0x497c10
push 0x4fc884
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
add esp, 8
mov eax, 0x8e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1138
ret 4
lea eax, [esp + 0x548]
push eax
push 1
push 0x4fc878
call fcn.0049e730
add esp, 4
push eax
push edi
call fcn.0049ed90
add esp, 0x10
lea ecx, [esp + 0x548]
mov dword [0x4fc4d4], eax
push ecx
push 0x186a0
push 0x4fc868
call fcn.0049e730
add esp, 4
push eax
push edi
call fcn.0049ed90
add esp, 0x10
lea edx, [esp + 0x548]
mov dword [0x5138f8], eax
push edx
push ebx
push 0x4fc858
call fcn.0049e730
add esp, 4
push eax
push edi
call fcn.0049ed90
add esp, 0x10
mov dword [0x5138fc], eax
lea eax, [esp + 0x548]
push eax
push ebx
push 0x4fc848
call fcn.0049e730
add esp, 4
push eax
push edi
call fcn.0049ed90
add esp, 0x10
lea ecx, [esp + 0x548]
mov dword [esp + 0x7c], eax
push ecx
push ebx
push 0x4fc83c
call fcn.0049e730
add esp, 4
push eax
push edi
call fcn.0049ed90
add esp, 0x10
lea edx, [esp + 0x548]
mov dword [esp + 0x80], eax
push edx
push ebx
push 0x4fc82c
call fcn.0049e730
add esp, 4
push eax
push edi
call fcn.0049ed90
add esp, 0x10
mov dword [esp + 0x98], eax
lea eax, [esp + 0x548]
push eax
push ebx
push 0x4fc818
call fcn.0049e730
add esp, 4
push eax
push edi
call fcn.0049ed90
mov esi, dword [esp + 0x34]
add esp, 0x10
shr eax, 1
not al
and al, 1
mov byte [esi + 0x1e], al
lea ecx, [esp + 0x548]
push ecx
push 0x3e8
push 0x4fc800
call fcn.0049e730
add esp, 4
push eax
push edi
call fcn.0049ed90
add esp, 0x10
lea edx, [esp + 0x548]
mov dword [esi + 0x1674], eax
push edx
push ebx
push 0x4fc7ec
call fcn.0049e730
add esp, 4
push eax
push edi
call fcn.0049ed90
mov dword [esi + 0x1678], eax
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x558]
rep stosd dword es:[edi], eax
push 0x4fc7e4
call fcn.0049e730
add esp, 0x14
push eax
push ebp
call fcn.00498790
add esp, 8
mov ecx, esi
push 0x104
push 0x5137e0
call fcn.00498f10
mov edi, 0x4fcc64
or ecx, 0xffffffff
xor eax, eax
push 0x4fc7d4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x5137e0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0049e730
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x5137e0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x513924]
mov ecx, edx
and ecx, 3
cmp eax, ebx
rep movsb byte es:[edi], byte [esi]
je 0x497ea6
mov eax, dword [sym.imp.kernel32.dll_GetProcAddress]
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 4]
mov dl, byte [eax + 3]
push ecx
xor ecx, ecx
mov cl, byte [eax + 2]
push edx
push ecx
xor edx, edx
mov dl, byte [eax + 1]
xor ecx, ecx
mov cl, byte [eax]
push edx
push ecx
push 0x4fc7b0
call fcn.0049e730
mov edx, dword [0x513924]
add esp, 4
add edx, 0x20
push eax
push edx
call fcn.00498790
mov eax, dword [0x513924]
add esp, 0x1c
cmp eax, ebx
je 0x497ea6
mov eax, dword [sym.imp.kernel32.dll_GetModuleHandleA]
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 4]
mov dl, byte [eax + 3]
push ecx
xor ecx, ecx
mov cl, byte [eax + 2]
push edx
push ecx
xor edx, edx
mov dl, byte [eax + 1]
xor ecx, ecx
mov cl, byte [eax]
push edx
push ecx
push 0x4fc78c
call fcn.0049e730
mov edx, dword [0x513924]
add esp, 4
add edx, 0x20
push eax
push edx
call fcn.00498790
add esp, 0x1c
push 0x4fc784
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
push ebx
push 0x5137e0
call dword [sym.imp.msvcr71.dll__access]
add esp, 0x10
cmp eax, 0xffffffff
jne 0x497f88
mov ecx, dword [esp + 0x24]
push 0x104
push 0x5137e0
call fcn.00498f10
mov edi, 0x4fcc64
or ecx, 0xffffffff
xor eax, eax
push 0x4fc774
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x5137e0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0049e730
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5137e0
mov esi, edi
mov edx, ecx
mov edi, 0x5137e0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.msvcr71.dll__access]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x497f88
push 0x5137e0
push 0x4fc758
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
add esp, 0xc
mov eax, 0x9a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1138
ret 4
mov esi, dword [esp + 0x24]
push 1
push 0x5137e0
lea ecx, [esi + 0x15bc]
call fcn.0049cbd0
test al, al
jne 0x497fe2
mov edi, dword [sym.imp.kernel32.dll_GetLastError]
call edi
mov esi, dword [esi + 0x1600]
push 0x5137e0
call edi
push eax
push esi
push 0x4fca3c
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
add esp, 0x14
mov eax, 0x7a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1138
ret 4
push 0x4fc750
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
lea edi, [esi + 0x1464]
add esp, 8
mov ecx, edi
call fcn.0049d8c0
test al, al
jne 0x498033
push 0x4fc73c
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
add esp, 8
mov eax, 0xa0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1138
ret 4
mov eax, dword [edi]
push 2
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
push 0x4fc734
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
add esp, 8
call dword [sym.imp.kernel32.dll_GetTickCount]
and eax, 0xfff00000
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x7c]
cmp eax, 0x2f
jae 0x498099
push 0x2f
push eax
push 0x4fc714
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
add esp, 0x10
mov eax, 0x78
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1138
ret 4
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0xd4]
mov edx, dword [esi + 0x1680]
rep stosd dword es:[edi], eax
xor ecx, ecx
push edx
mov dword [esp + 0x88], ecx
mov dword [esp + 0xd8], 0x44
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], ecx
mov dword [esp + 0x94], ecx
call dword [sym.imp.kernel32.dll_ResetEvent]
mov eax, dword [esp + 0x80]
mov ecx, dword [esi + 0x1680]
mov edx, dword [esi + 0x167c]
push eax
push ecx
lea eax, [esi + 0x1608]
lea edi, [esi + 0x1464]
push edx
push eax
mov ecx, edi
call fcn.0049d640
push eax
mov ecx, edi
call fcn.0049d630
mov ecx, dword [esi + 0x1604]
mov edx, dword [esp + 0x28]
push eax
xor eax, eax
mov al, byte [esi + 0x1671]
push eax
push ecx
push edx
push 0x4fc6ec
call fcn.0049e730
add esp, 4
push eax
lea eax, [esp + 0x36c]
push eax
call dword [sym.imp.user32.dll_wsprintfA]
lea ecx, [esp + 0x370]
push ecx
call fcn.0049e620
mov dword [esp + 0x40], eax
lea edi, [esp + 0x374]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x30
lea edx, [esp + 0xd48]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x18], edx
lea eax, [ecx + 4]
cmp eax, ebx
jle 0x4981ac
mov dword [esp + 0x14], eax
mov edi, edx
mov ecx, dword [esp + 0x10]
xor eax, eax
mov al, byte [ecx]
inc ecx
push eax
push 0x4fc990
push edi
mov dword [esp + 0x1c], ecx
call dword [sym.imp.user32.dll_wsprintfA]
add edi, eax
mov eax, dword [esp + 0x20]
add esp, 0xc
dec eax
mov dword [esp + 0x14], eax
jne 0x498180
jmp 0x4981b0
mov edi, dword [esp + 0x18]
push 0x4fc6e4
mov byte [edi], bl
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
mov eax, dword [0x513910]
add esp, 8
cmp eax, ebx
jne 0x498270
cmp dword [0x513914], ebx
jne 0x498270
lea eax, [esp + 0x84]
lea ecx, [esp + 0xd4]
push eax
push ecx
push ebx
push ebx
push 4
push ebx
push ebx
lea edx, [esp + 0xd64]
push ebx
push edx
push 0x5137e0
call dword [sym.imp.kernel32.dll_CreateProcessA]
test eax, eax
jne 0x498251
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
lea eax, [esp + 0x344]
push eax
call esi
push eax
push 0x5137e0
push 0x4fc960
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
add esp, 0x14
mov eax, 0xaa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1138
ret 4
mov ecx, dword [esp + 0x8c]
push ecx
push 0x4fc6d8
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
add esp, 0xc
mov eax, dword [0x5138fc]
cmp eax, ebx
mov dword [0x51390c], eax
jne 0x4982af
mov eax, dword [esp + 0x98]
cmp eax, ebx
mov dword [0x51390c], eax
jne 0x4982af
mov edx, dword [esp + 0x1c]
push edx
push 0x4fc6c4
push 0x5137e0
call fcn.0049ad10
add esp, 0xc
and eax, 0xff
mov dword [0x51390c], eax
push 0x4fc6bc
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
add esp, 8
lea ecx, [esi + 0x1464]
call fcn.0049dad0
cmp eax, ebx
jne 0x498309
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
call esi
push eax
push 0x4fc6a8
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
add esp, 0xc
mov eax, 0xa0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1138
ret 4
push eax
push 0x4fc678
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
mov eax, dword [0x513910]
add esp, 0xc
cmp eax, ebx
jne 0x4983c1
mov eax, dword [esp + 0x88]
push eax
call dword [sym.imp.kernel32.dll_ResumeThread]
mov ecx, dword [esi + 0x167c]
mov eax, dword [0x5138f8]
mov edx, dword [esp + 0x84]
mov dword [esp + 0x98], ecx
push eax
lea ecx, [esp + 0x9c]
push ebx
push ecx
push 2
mov dword [esp + 0xac], edx
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
test eax, eax
je 0x498408
push 0x4fc664
call fcn.0049e730
add esp, 4
push eax
push ebx
push 0x100000
call dword [sym.imp.kernel32.dll_OpenEventA]
cmp eax, ebx
je 0x4983d8
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov edx, dword [0x5138f8]
mov eax, dword [esi + 0x167c]
push edx
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
je 0x498408
mov ecx, dword [0x5138f8]
push ecx
push 0x4fc648
jmp 0x4983e4
mov eax, dword [0x5138f8]
mov ecx, dword [esi + 0x167c]
push eax
push ecx
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
je 0x498408
mov edx, dword [0x5138f8]
push edx
push 0x4fc630
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
add esp, 0xc
mov eax, 0x72
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1138
ret 4
push 0x4fc620
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
mov eax, dword [esi + 0x1680]
add esp, 8
push ebx
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
je 0x49845a
push 0x4fc608
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
add esp, 8
mov eax, 0x72
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1138
ret 4
push 0x4fc664
call fcn.0049e730
add esp, 4
push eax
push ebx
push 0x100000
call dword [sym.imp.kernel32.dll_OpenEventA]
cmp eax, ebx
je 0x498498
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push 0x4fc5fc
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
add esp, 8
jmp 0x4984b2
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x84]
mov dword [0x513918], ecx
mov dword [0x51391c], edx
push 0x4fc5f4
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
mov eax, dword [0x51390c]
add esp, 8
cmp eax, ebx
jne 0x4984e4
pop edi
pop esi
pop ebp
mov eax, 0x7a
pop ebx
add esp, 0x1138
ret 4
call fcn.0049c1c0
call fcn.0049a760
mov edi, eax
cmp edi, ebx
jne 0x498507
push 0xb
lea eax, [esi + 0x1464]
push 0x62d
push eax
call fcn.00499a60
push edi
push 0x4fc5dc
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
add esp, 0xc
call fcn.0049aaa0
mov edi, eax
cmp edi, ebx
jne 0x498541
push 0xd
push 0x630
push 0x8b1
lea ecx, [esi + 0x1464]
call fcn.0049d7d0
push edi
push 0x4fc5c4
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
mov al, byte [esi + 0x1e]
add esp, 0xc
cmp al, bl
je 0x498594
mov ecx, esi
call fcn.004993a0
test al, al
jne 0x498594
push 0x4fc5a8
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
add esp, 8
mov eax, 0xdc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1138
ret 4
push 0x4fc5a0
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
mov eax, dword [esi + 0x1604]
add esp, 8
lea edi, [esi + 0x1464]
push eax
push 0x611
push 0x8b1
mov ecx, edi
call fcn.0049d7d0
mov ecx, dword [esp + 0x1c]
push ecx
push 0x617
push 0x8b1
mov ecx, edi
call fcn.0049d7d0
push 0x4fc580
call fcn.0049e730
add esp, 4
push eax
push ebp
call fcn.00498790
add esp, 8
mov byte [esi], 1
pop edi
pop esi
pop ebp
mov eax, 0x755
pop ebx
add esp, 0x1138
ret 4