Function at 0x40653e
Capabilities:
Check for time delay via gettickcount
Connect pipe
Create pipe
Create process on windows
Parse credit card information
Persist via run registry key
Query environment variable
Read file on windows
Resume thread
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
lea ebp, [esp - 0x60]
sub esp, 0x308
push ebx
push esi
mov dword [ebp + 0x54], ecx
push edi
lea ecx, [ebp - 0x84]
call fcn.0042aeb8
xor ebx, ebx
cmp dword [ebp + 0x68], ebx
je 0x406582
push dword [ebp + 0x68]
lea ecx, [ebp - 0x84]
call fcn.00426075
mov eax, dword [ebp - 0x84]
mov dword [ebp + 0x68], eax
lea eax, [ebp + 0x68]
push eax
call fcn.0042609c
pop ecx
lea ecx, [ebp - 0x80]
call fcn.0042aeb8
mov esi, dword [ebp + 0x70]
cmp esi, ebx
je 0x40659d
push esi
lea ecx, [ebp - 0x80]
call fcn.00426075
mov esi, dword [ebp - 0x80]
cmp dword [ebp + 0x78], ebx
jne 0x4065a8
lea eax, [ebp - 0x18]
mov dword [ebp + 0x78], eax
mov eax, dword [ebp + 0x68]
cmp eax, ebx
mov dword [ebp + 0x24], eax
jne 0x4065b5
mov dword [ebp + 0x68], esi
mov eax, dword [ebp + 0x74]
lea ecx, [ebp - 0x68]
mov dword [ebp + 4], eax
mov byte [ebp + 0x3e], bl
mov byte [ebp + 0x73], bl
mov byte [ebp + 0x77], bl
mov byte [ebp - 9], 1
mov byte [ebp + 0x5a], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp + 0x1e], bl
mov byte [ebp + 0x4b], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], bl
call fcn.0042aeb8
lea ecx, [ebp - 0x98]
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xbc], ebx
mov byte [ebp - 5], bl
mov byte [ebp + 0x3f], bl
mov byte [ebp + 0x1f], bl
mov byte [ebp - 6], bl
mov dword [ebp + 8], ebx
mov dword [ebp + 0x40], ebx
call fcn.0042aeb8
lea ecx, [ebp - 0x14]
call fcn.0042aeb8
lea ecx, [ebp - 0x48]
call fcn.0042aeb8
lea ecx, [ebp - 0x3c]
call fcn.0042aeb8
or dword [ebp - 0x44], 0xffffffff
lea ecx, [ebp - 0x8c]
mov byte [ebp + 0x1d], bl
mov dword [ebp - 0x74], ebx
call fcn.0042aeb8
xor eax, eax
push 0xf
pop ecx
mov dword [ebp - 0x1bc], 0x44
mov dword [ebp - 0x1b8], ebx
lea edi, [ebp - 0x1b4]
rep stosd dword es:[edi], eax
push 0x11
mov dword [ebp - 0xb8], ebx
pop ecx
lea edi, [ebp - 0x178]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0xb4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
cmp esi, ebx
lea edi, [ebp - 0xa8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x60], ebx
mov dword [ebp + 0x34], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x50], ebx
je 0x406694
test byte [0x493003], 3
je 0x4066aa
push str.WinSta0Default
lea ecx, [ebp - 0x50]
call fcn.00426075
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x1b4], eax
cmp esi, ebx
je 0x4066bf
cmp word [esi], 0x24
jne 0x4066bf
mov dword [ebp + 4], 1
mov byte [ebp + 0x5a], 1
xor ecx, ecx
inc ecx
cmp esi, ebx
push 2
mov dword [ebp - 0x24], ebx
pop edi
je 0x406740
cmp word [esi], 0x7c
jne 0x4066da
add dword [ebp + 0x68], edi
add esi, edi
mov dword [ebp - 0x24], ecx
cmp esi, ebx
je 0x406740
cmp word [esi], 0x2a
jne 0x406740
add dword [ebp + 0x68], edi
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x7c
mov byte [ebp + 0x73], 0x10
jne 0x4066fa
add dword [ebp + 0x68], edi
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
cmp ax, 0x31
jne 0x40670c
mov byte [ebp + 0x73], 0x11
jmp 0x406727
mov edx, eax
or edx, 0x20
cmp dx, 0x6e
jne 0x40671d
mov byte [ebp + 0x73], 0x12
jmp 0x406727
cmp ax, 0x2d
jne 0x40672a
mov byte [ebp + 0x73], 0x14
add dword [ebp + 0x68], edi
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
call fcn.00426083
test al, al
jne 0x406740
mov ebx, ecx
jmp 0x408caf
lea eax, [ebp + 0x68]
push eax
call fcn.0042609c
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x2d
pop ecx
jne 0x40675f
add eax, 2
cmp word [eax], 0x2d
jne 0x40675f
mov dword [ebp + 0x68], eax
push 6
lea eax, [ebp + 0x68]
push eax
push str._catch
call fcn.0042c7e8
add esp, 0xc
test al, al
je 0x40677a
mov byte [ebp + 0x73], 0x10
cmp byte [ebp + 0x73], bl
je 0x406871
mov edi, dword [ebp + 0x68]
xor ecx, ecx
xor eax, eax
mov ax, word [edi]
inc ecx
cmp ax, bx
mov dword [ebp + 4], ecx
mov esi, edi
je 0x406739
push 2
pop edx
cmp ax, 0x3d
je 0x4067ab
add esi, edx
mov ax, word [esi]
cmp ax, bx
jne 0x40679b
cmp esi, edi
je 0x406739
cmp word [esi], 0x3d
jne 0x406739
sub esi, edx
cmp word [esi], 0x2b
jne 0x4067c4
mov al, byte [esi]
mov byte [ebp - 5], al
sub esi, edx
cmp esi, edi
mov ecx, esi
jbe 0x4067dc
mov ax, word [ecx]
call fcn.00426083
test al, al
je 0x4067dc
sub ecx, edx
cmp ecx, edi
ja 0x4067ca
mov ax, word [ecx]
call fcn.00426083
test al, al
je 0x4067f0
xor ebx, ebx
inc ebx
jmp 0x408caf
mov edx, ecx
inc ecx
inc ecx
jmp 0x40680b
lea eax, [edx - 2]
mov dword [ebp - 0x70], eax
mov ax, word [eax]
call fcn.00426083
test al, al
jne 0x40680f
mov edx, dword [ebp - 0x70]
cmp edx, edi
ja 0x4067f6
sub ecx, edx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x14]
call fcn.00409fd6
mov edi, dword [ebp + 0x54]
push ebx
lea eax, [ebp - 0x14]
push eax
mov ecx, edi
call fcn.00402aa0
cmp byte [edi + 0x86], bl
jne 0x40683a
test byte [edi + 0xb], 0xf
je 0x406850
push ebx
lea eax, [ebp - 0x14]
push eax
mov ecx, edi
call fcn.00402aa0
jmp 0x406850
cmp ax, 0x3d
je 0x40685e
inc esi
inc esi
mov ax, word [esi]
cmp ax, bx
jne 0x406848
cmp ax, 0x3d
jne 0x4067e8
lea eax, [ebp - 0x74]
add esi, 2
push eax
mov dword [ebp - 0x74], esi
call fcn.0042609c
pop ecx
push 2
pop edi
lea eax, [ebp + 0x68]
push eax
call fcn.0042609c
cmp dword [ebp - 0x24], ebx
pop ecx
jne 0x406888
cmp dword [ebp + 0x7c], ebx
mov byte [ebp + 0x5b], bl
je 0x40688c
mov byte [ebp + 0x5b], 1
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x10], ebx
call fcn.0042aeb8
lea ecx, [ebp - 0x5c]
call fcn.0042aeb8
lea ecx, [ebp - 0x88]
call fcn.0042aeb8
mov eax, dword [ebp + 0x68]
mov dword [ebp - 0x78], ebx
cmp word [eax], 0x2d
mov esi, eax
jne 0x4068d2
add eax, 2
cmp word [eax], 0x2d
jne 0x4068d2
mov esi, eax
push 5
push esi
push str._cmd:
call fcn.00426f79
add esp, 0xc
test al, al
je 0x4069e5
lea eax, [esi + 0xa]
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x5c], eax
cmp word [eax], 0x3a
jne 0x40699e
add eax, 2
mov dword [ebp + 0x5c], eax
cmp word [eax], 0x25
je 0x40691a
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.0042dab0
pop ecx
pop ecx
jmp 0x406992
mov dword [ebp + 0x28], eax
jmp 0x406925
cmp cx, 0x25
je 0x406932
add eax, edi
mov dword [ebp + 0x5c], eax
mov cx, word [eax]
cmp cx, bx
jne 0x40691f
cmp word [eax], 0x25
jne 0x40693d
add eax, edi
mov dword [ebp + 0x5c], eax
sub eax, dword [ebp + 0x28]
lea ecx, [ebp]
sar eax, 1
push eax
push dword [ebp + 0x28]
call fcn.00426041
mov ecx, dword [ebp + 0x54]
push 1
push ebx
lea eax, [ebp + 0x4c]
push eax
push dword [ebp]
mov dword [ebp + 0x4c], ebx
call fcn.0043b18c
mov eax, dword [ebp + 0x4c]
mov dword [ebp + 0x28], eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp + 0x28]
push eax
call fcn.0042dab0
lea eax, [ebp + 0x5c]
push eax
call fcn.0042609c
add esp, 0xc
lea ecx, [ebp + 0x4c]
call fcn.0042602e
lea ecx, [ebp]
call fcn.0042602e
mov eax, dword [ebp + 0x5c]
cmp word [eax], 0x3a
jne 0x40699e
add dword [ebp + 0x5c], edi
mov eax, dword [ebp + 0x5c]
mov dword [ebp + 0x68], eax
push 1
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x5c]
push eax
mov dword [ebp + 0x2c], ebx
call fcn.00413db8
add esp, 0xc
cmp dword [ebp + 0x5c], eax
mov dword [ebp + 0x68], eax
je 0x4069db
push dword [ebp + 0x2c]
lea ecx, [ebp - 0x8c]
push dword [ebp + 0x5c]
call fcn.00409fd6
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x60], eax
lea eax, [ebp + 0x68]
push eax
call fcn.0042609c
pop ecx
cmp byte [ebp + 0x5b], bl
mov dword [ebp - 0x58], ebx
jne 0x406a0a
cmp dword [ebp + 0x24], ebx
jne 0x406a0a
mov ecx, dword [ebp + 0x54]
push 1
push ebx
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0x68]
call fcn.0043b18c
mov eax, dword [ebp - 0x58]
mov dword [ebp + 0x68], eax
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x2d
mov esi, eax
jne 0x406a21
add eax, 2
cmp word [eax], 0x2d
jne 0x406a21
mov dword [ebp + 0x68], eax
push 1
lea eax, [ebp + 0x68]
push eax
push 0x47b404
call fcn.0042c7e8
add esp, 0xc
test al, al
jne 0x4071b3
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
cmp ax, 0x2d
je 0x406a52
cmp ax, 0x2f
jne 0x4071b3
push 2
pop edi
add dword [ebp + 0x68], edi
push 6
push dword [ebp + 0x68]
push str.clone:
call fcn.00426f79
add esp, 0xc
test al, al
je 0x406aa9
add dword [ebp + 0x68], 0xc
mov edi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403adb
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
pop ecx
je 0x406a8e
mov word [eax], bx
add dword [ebp + 0x68], 2
lea eax, [ebp + 0x68]
push eax
call fcn.0042609c
cmp word [edi], bx
pop ecx
je 0x406a0a
mov dword [ebp + 0x34], edi
jmp 0x406a0a
push 9
push dword [ebp + 0x68]
push str.runrmenu:
call fcn.00426f79
add esp, 0xc
test al, al
je 0x406aef
add dword [ebp + 0x68], 0x12
mov edi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403adb
mov eax, dword [ebp + 0x68]
pop ecx
lea ecx, [ebp - 0x68]
sub eax, edi
sar eax, 1
push eax
push edi
call fcn.00409fd6
lea eax, [ebp + 0x68]
push eax
call fcn.0042609c
jmp 0x4071ad
push 8
push dword [ebp + 0x68]
push str.poprmenu
call fcn.00426f79
add esp, 0xc
test al, al
je 0x406b9f
add dword [ebp + 0x68], 0x10
mov eax, dword [ebp + 0x68]
mov dword [ebp + 0x38], eax
lea eax, [ebp + 0x68]
push eax
call fcn.00403adb
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
pop ecx
je 0x406b28
add dword [ebp + 0x68], edi
lea eax, [ebp + 0x68]
push eax
call fcn.0042609c
pop ecx
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp + 0x38]
mov ax, word [eax]
cmp ax, bx
mov byte [ebp - 8], 1
je 0x406b5d
cmp ax, 0x30
jb 0x406b5a
cmp ax, 0x39
jbe 0x406b5d
add dword [ebp + 0x38], edi
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp + 0x38]
push eax
call fcn.0042dab0
mov eax, dword [ebp + 0x38]
mov ax, word [eax]
cmp ax, bx
pop ecx
pop ecx
je 0x406b89
cmp ax, 0x30
jb 0x406b86
cmp ax, 0x39
jbe 0x406b89
add dword [ebp + 0x38], edi
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp + 0x38]
push eax
call fcn.0042dab0
pop ecx
jmp 0x4071ad
push 4
pop edi
push edi
push dword [ebp + 0x68]
push str.pid:
call fcn.00426f79
add esp, 0xc
test al, al
je 0x406bdb
add dword [ebp + 0x68], 8
mov edi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403adb
mov eax, dword [ebp + 0x68]
cmp edi, eax
pop ecx
je 0x406ae1
lea ecx, [ebp - 0x64]
jmp 0x406ad6
push edi
push dword [ebp + 0x68]
push str.exe:
call fcn.00426f79
add esp, 0xc
test al, al
je 0x406c34
add dword [ebp + 0x68], 8
mov eax, dword [ebp + 0x68]
mov dword [ebp - 0x54], eax
push 1
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x40], ebx
call fcn.00413db8
add esp, 0xc
cmp dword [ebp - 0x40], ebx
mov dword [ebp + 0x68], eax
jle 0x406ae1
push dword [ebp - 0x40]
lea ecx, [ebp - 0x4c]
push dword [ebp - 0x54]
call fcn.00409fd6
mov eax, dword [ebp - 0x4c]
mov dword [ebp + 0x18], eax
jmp 0x406ae1
push 5
push dword [ebp + 0x68]
push str.logs:
call fcn.00426f79
add esp, 0xc
test al, al
je 0x406cad
mov eax, dword [ebp + 0x68]
add eax, 0xa
xor ecx, ecx
mov dword [ebp + 0x68], eax
mov dword [ebp], eax
cmp word [eax], 0x3f
sete cl
mov edi, ecx
cmp edi, ebx
je 0x406c6b
add eax, 2
mov dword [ebp], eax
mov esi, eax
push 1
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp]
push eax
mov dword [ebp + 0x4c], ebx
call fcn.00413db8
add esp, 0xc
cmp dword [ebp + 0x4c], ebx
mov dword [ebp + 0x68], eax
jle 0x406ae1
cmp edi, ebx
je 0x406c9e
cmp dword [0x48fdf8], ebx
je 0x406ae1
push dword [ebp + 0x4c]
lea ecx, [ebp - 0x98]
push esi
jmp 0x406adc
push 5
lea eax, [ebp + 0x68]
push eax
push str.nowin
call fcn.0042c7e8
add esp, 0xc
test al, al
je 0x406ccd
mov byte [ebp - 7], 1
jmp 0x406a0a
push edi
lea eax, [ebp + 0x68]
push eax
push str.hide
call fcn.0042c7e8
add esp, 0xc
test al, al
je 0x406cef
mov dword [ebp + 8], 0x10000000
jmp 0x406a0a
push edi
lea eax, [ebp + 0x68]
push eax
push 0x47b3b4
call fcn.0042c7e8
add esp, 0xc
test al, al
je 0x406d11
mov dword [ebp + 4], 1
jmp 0x406a0a
push 3
lea eax, [ebp + 0x68]
push eax
push 0x47b3b0
call fcn.0042c7e8
add esp, 0xc
test al, al
je 0x406d31
or byte [ebp + 0x77], 1
jmp 0x406a0a
push edi
lea eax, [ebp + 0x68]
push eax
push str.err
call fcn.0042c7e8
add esp, 0xc
test al, al
je 0x406d50
or byte [ebp + 0x77], 3
jmp 0x406a0a
push 5
lea eax, [ebp + 0x68]
push eax
push str.limit
call fcn.0042c7e8
add esp, 0xc
test al, al
je 0x406d70
mov byte [ebp - 0xa], 1
jmp 0x406a0a
push 3
lea eax, [ebp + 0x68]
push eax
push 0x47b39c
call fcn.0042c7e8
add esp, 0xc
test al, al
je 0x406d90
mov byte [ebp + 0x1e], 1
jmp 0x406a0a
push edi
lea eax, [ebp + 0x68]
push eax
push str.hook
call fcn.0042c7e8
add esp, 0xc
test al, al
je 0x406daf
mov byte [ebp + 0x5a], 1
jmp 0x406a0a
push 3
lea eax, [ebp + 0x68]
push eax
push 0x47b390
call fcn.0042c7e8
add esp, 0xc
test al, al
je 0x406dd2
mov dword [ebp + 8], 6
jmp 0x406a0a
push 3
lea eax, [ebp + 0x68]
push eax
push 0x47b38c
call fcn.0042c7e8
add esp, 0xc
test al, al
je 0x406df5
mov dword [ebp + 8], 3
jmp 0x406a0a
push edi
lea eax, [ebp + 0x68]
push eax
push str.show
call fcn.0042c7e8
add esp, 0xc
test al, al
je 0x406e17
mov dword [ebp + 8], 1
jmp 0x406a0a
push edi
lea eax, [ebp + 0x68]
push eax
push str.runs
call fcn.0042c7e8
add esp, 0xc
test al, al
je 0x406e36
mov byte [ebp - 0xb], 1
jmp 0x406a0a
push edi
lea eax, [ebp + 0x68]
push eax
push str.no64
call fcn.0042c7e8
add esp, 0xc
test al, al
je 0x406e54
mov byte [ebp - 9], bl
jmp 0x406a0a
push 3
push dword [ebp + 0x68]
push 0x47b370
call fcn.00426f79
add esp, 0xc
test al, al
je 0x406ea3
add dword [ebp + 0x68], 6
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x3a
mov byte [ebp + 0x4b], 1
jne 0x406ae1
add dword [ebp + 0x68], 2
mov edi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403adb
mov eax, dword [ebp + 0x68]
cmp edi, eax
pop ecx
je 0x406ae1
lea ecx, [ebp - 0x5c]
jmp 0x406ad6
push 3
push dword [ebp + 0x68]
push 0x47b36c
call fcn.00426f79
add esp, 0xc
test al, al
je 0x406f9e
add dword [ebp + 0x68], 6
mov edi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403adb
cmp edi, dword [ebp + 0x68]
pop ecx
je 0x406ae1
cmp word [edi], 0x2a
mov byte [ebp + 0x33], bl
jne 0x406ef5
lea eax, [edi + 2]
cmp word [eax], 0x2a
mov byte [ebp + 0x33], 1
jne 0x406ef3
mov byte [ebp + 0x33], 2
jmp 0x406ef5
mov edi, eax
cmp word [edi], 0x22
jne 0x406f24
inc edi
inc edi
mov ecx, edi
mov dword [ebp + 0x44], ecx
xor eax, eax
mov ax, word [edi]
jmp 0x406f17
cmp ax, 0x22
je 0x406f1c
inc ecx
inc ecx
mov dword [ebp + 0x44], ecx
mov ax, word [ecx]
cmp ax, bx
jne 0x406f09
mov dword [ebp + 0x68], ecx
lea eax, [ebp + 0x68]
jmp 0x406f2a
mov dword [ebp + 0x44], edi
lea eax, [ebp + 0x44]
push eax
call fcn.00403adb
pop ecx
lea ecx, [ebp + 0x50]
call fcn.0042aeb8
cmp byte [ebp + 0x33], 1
jne 0x406f76
mov eax, dword [ebp + 0x44]
sub eax, edi
sar eax, 1
push eax
push edi
lea ecx, [ebp + 0x2c]
call fcn.00426041
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x50]
push eax
push dword [ebp + 0x2c]
call fcn.004334dc
add esp, 0xc
cmp dword [ebp + 0x44], ebx
mov edi, eax
je 0x406f6e
sub dword [ebp + 0x44], 2
lea ecx, [ebp + 0x2c]
call fcn.0042602e
mov eax, dword [ebp + 0x44]
cmp eax, edi
jbe 0x406f91
sub eax, edi
sar eax, 1
push eax
push edi
lea ecx, [ebp - 0x78]
call fcn.00409fd6
mov eax, dword [ebp - 0x78]
mov dword [ebp + 0x10], eax
lea ecx, [ebp + 0x50]
call fcn.0042602e
jmp 0x406ae1
push 5
push dword [ebp + 0x68]
push str.user:
call fcn.00426f79
add esp, 0xc
test al, al
je 0x406fd8
add dword [ebp + 0x68], 0xa
mov edi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403adb
mov eax, dword [ebp + 0x68]
cmp edi, eax
pop ecx
je 0x406ae1
lea ecx, [ebp - 0x48]
jmp 0x406ad6
push 7
push dword [ebp + 0x68]
push str.passwd:
call fcn.00426f79
add esp, 0xc
test al, al
je 0x406ff3
mov byte [ebp + 0x1d], bl
jmp 0x40700d
push 7
push dword [ebp + 0x68]
push str.passwd
call fcn.00426f79
add esp, 0xc
test al, al
je 0x407031
mov byte [ebp + 0x1d], 1
add dword [ebp + 0x68], 0xe
mov edi, dword [ebp + 0x68]
lea eax, [ebp + 0x68]
push eax
call fcn.00403adb
mov eax, dword [ebp + 0x68]
cmp edi, eax
pop ecx
je 0x406ae1
lea ecx, [ebp - 0x3c]
jmp 0x406ad6
push 8
lea eax, [ebp + 0x68]
push eax
push str.REALTIME
call fcn.0042c7e8
add esp, 0xc
test al, al
je 0x407054
mov dword [ebp + 0x40], pe_nt_image_headers32
jmp 0x406a0a
push edi
lea eax, [ebp + 0x68]
push eax
push str.HIGH
call fcn.0042c7e8
add esp, 0xc
test al, al
je 0x407076
mov dword [ebp + 0x40], 0x80
jmp 0x406a0a
push 0xb
lea eax, [ebp + 0x68]
push eax
push str.ABOVENORMAL
call fcn.0042c7e8
add esp, 0xc
test al, al
je 0x407099
mov dword [ebp + 0x40], 0x8000
jmp 0x406a0a
push 6
lea eax, [ebp + 0x68]
push eax
push str.NORMAL
call fcn.0042c7e8
add esp, 0xc
test al, al
je 0x4070bc
mov dword [ebp + 0x40], 0x20
jmp 0x406a0a
push 0xb
lea eax, [ebp + 0x68]
push eax
push str.BELOWNORMAL
call fcn.0042c7e8
add esp, 0xc
test al, al
je 0x4070df
mov dword [ebp + 0x40], 0x4000
jmp 0x406a0a
push 3
lea eax, [ebp + 0x68]
push eax
push 0x47b31c
call fcn.0042c7e8
add esp, 0xc
test al, al
jne 0x40712f
mov edi, dword [ebp + 0x68]
push 5
push edi
push 0x47b310
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x40713b
xor ecx, ecx
mov cx, word [edi + 0xa]
mov eax, ecx
call fcn.00426083
test al, al
jne 0x407121
cmp cx, bx
jne 0x40713b
add dword [ebp + 0x68], 0xa
lea eax, [ebp + 0x68]
push eax
call fcn.0042609c
pop ecx
mov dword [ebp + 0x40], 0x40
jmp 0x406a0a
push 3
lea eax, [ebp + 0x68]
push eax
push 0x47b30c
call fcn.0042c7e8
add esp, 0xc
test al, al
je 0x40715b
mov byte [ebp + 0x3f], 1
jmp 0x406a0a
push 3
lea eax, [ebp + 0x68]
push eax
push 0x47b308
call fcn.0042c7e8
add esp, 0xc
test al, al
je 0x40717b
mov byte [ebp + 0x1f], 1
jmp 0x406a0a
push 3
lea eax, [ebp + 0x68]
push eax
push 0x47b304
call fcn.0042c7e8
add esp, 0xc
test al, al
je 0x40719b
mov byte [ebp - 6], 1
jmp 0x406a0a
cmp word [esi], 0x2d
mov dword [ebp + 0x68], esi
jne 0x4071b3
lea eax, [ebp + 0x68]
push eax
call fcn.00403b20
pop ecx
jmp 0x406a0a
mov eax, dword [ebp - 0x74]
cmp eax, ebx
je 0x4071dd
cmp byte [ebp + 0x5b], bl
mov dword [ebp + 0x68], eax
jne 0x4071dd
cmp dword [ebp + 0x24], ebx
jne 0x4071dd
push 1
push ebx
lea ecx, [ebp - 0x58]
push ecx
mov ecx, dword [ebp + 0x54]
push eax
call fcn.0043b18c
mov eax, dword [ebp - 0x58]
mov dword [ebp + 0x68], eax
mov esi, dword [ebp + 0x18]
cmp esi, ebx
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xd0], ebx
mov dword [ebp + 0x2c], ebx
je 0x4071fe
cmp word [esi], bx
jne 0x407201
mov byte [ebp + 0x3f], bl
cmp byte [ebp + 0x3f], bl
je 0x40722d
push 0x2a
push esi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
mov dword [ebp + 0x2c], eax
je 0x40721e
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x2c], eax
lea eax, [ebp - 0xd8]
push eax
push esi
call fcn.0040f62e
pop ecx
pop ecx
mov eax, dword [ebp + 0x78]
xor ecx, ecx
inc ecx
mov dword [eax], ecx
xor eax, eax
lea edi, [ebp - 0xc4]
mov dword [ebp - 0xc8], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xf8], ebx
lea edi, [ebp - 0xf4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
cmp dword [ebp + 0x34], ebx
mov dword [ebp - 0x7c], ebx
setne al
cmp byte [ebp + 0x5b], bl
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 4], ebx
mov dword [ebp + 0x44], ebx
mov dword [ebp + 0x38], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp + 0x14], eax
mov dword [ebp - 0xe4], 0xc
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xdc], ecx
mov dword [ebp - 0x94], ebx
je 0x407686
mov ecx, dword [ebp + 0x68]
cmp word [ecx], 0x7c
mov dword [ebp + 0x4c], ebx
jne 0x4072c7
inc ecx
inc ecx
xor eax, eax
mov dword [ebp + 0x68], ecx
mov ax, word [ecx]
cmp ax, 0x7c
je 0x4072ae
call fcn.00426083
test al, al
jne 0x4072ae
mov dword [ebp + 0x24], ecx
push 0x7c
push ebx
push dword [ebp + 0x68]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
mov dword [ebp + 0x5c], eax
je 0x407304
mov word [eax], bx
add dword [ebp + 0x5c], 2
lea eax, [ebp + 0x5c]
push eax
call fcn.0042609c
mov eax, dword [ebp + 0x5c]
cmp word [eax], bx
pop ecx
je 0x4072ca
mov ecx, dword [ebp + 0x24]
cmp word [ecx], bx
mov dl, 1
je 0x407306
mov cl, dl
jmp 0x407312
xor dl, dl
xor cl, cl
cmp dl, bl
jne 0x407312
mov eax, dword [ebp + 0x24]
mov dword [ebp + 0x5c], eax
cmp cl, bl
mov dword [ebp + 0x20], eax
je 0x4073c4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
push ebx
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x1c]
push eax
xor edi, edi
lea eax, [ebp - 0x10]
inc edi
push eax
mov dword [ebp - 0x38], 0xc
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], edi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x407355
mov ecx, dword [ebp + 0x54]
push edi
call fcn.0040b352
mov edi, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 3
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp - 0x10]
push esi
call edi
cmp dword [ebp - 0x1c], ebx
mov word [ebp + 0x32], bx
je 0x407396
push dword [ebp - 0x1c]
mov ecx, dword [ebp + 0x54]
push ebx
push ebx
lea eax, [ebp + 0x32]
push eax
push ecx
push dword [ebp + 0x24]
call fcn.0040653e
cmp dword [ebp - 0x1c], ebx
je 0x407396
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 3
push 1
push ebx
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp - 0x10]
mov dword [ebp - 0x1c], ebx
push esi
call edi
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x4073c4
or byte [ebp - 0x18f], 1
mov dword [ebp + 0x14], 1
mov dword [ebp - 0x184], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp + 0x5c], eax
xor edi, edi
inc edi
mov cx, word [eax]
cmp cx, bx
je 0x407622
cmp cx, 0x3c
je 0x4073f2
cmp cx, 0x3e
je 0x4073f2
inc eax
inc eax
mov dword [ebp + 0x5c], eax
mov cx, word [eax]
cmp cx, bx
jne 0x4073d9
mov cx, word [eax]
cmp cx, bx
je 0x407622
cmp cx, 0x3c
jne 0x4074cd
mov word [eax], bx
add dword [ebp + 0x5c], 2
lea eax, [ebp + 0x5c]
push eax
call fcn.0042609c
mov eax, dword [ebp + 0x5c]
cmp word [eax], bx
pop ecx
je 0x4074cd
mov dword [ebp + 0x30], eax
jmp 0x40743b
cmp cx, 0x3c
je 0x407443
cmp cx, 0x3e
je 0x407443
inc eax
inc eax
mov dword [ebp + 0x5c], eax
mov cx, word [eax]
cmp cx, bx
jne 0x40742a
sub eax, dword [ebp + 0x30]
lea ecx, [ebp + 0xc]
sar eax, 1
push eax
push dword [ebp + 0x30]
call fcn.00426041
lea ecx, [ebp + 0x50]
call fcn.0042aeb8
mov ecx, dword [ebp + 0x54]
push edi
push ebx
lea eax, [ebp + 0x50]
push eax
push dword [ebp + 0x30]
call fcn.0043b18c
mov eax, dword [ebp + 0x50]
push eax
mov dword [ebp + 0x30], eax
call fcn.0040aea9
lea eax, [ebp + 0x30]
push eax
call fcn.0042609c
cmp dword [ebp - 4], ebx
pop ecx
pop ecx
je 0x407492
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
push 3
lea eax, [ebp - 0xe4]
push eax
push 7
push 0xc0000000
push dword [ebp + 0x30]
lea ecx, [ebp - 4]
mov dword [ebp - 4], ebx
call fcn.00403b3c
cmp dword [ebp - 4], ebx
jne 0x4074ba
mov dword [ebp - 4], ebx
lea ecx, [ebp + 0x50]
call fcn.0042602e
lea ecx, [ebp + 0xc]
call fcn.0042602e
mov eax, dword [ebp + 0x5c]
cmp word [eax], 0x3e
jne 0x4073cd
mov word [eax], bx
mov eax, dword [ebp + 0x5c]
xor esi, esi
cmp word [eax - 2], 0x32
mov byte [ebp + 0x5b], 1
jne 0x4074f2
mov byte [ebp + 0x5b], 2
mov word [eax - 2], bx
add dword [ebp + 0x5c], 2
mov eax, dword [ebp + 0x5c]
cmp word [eax], 0x3e
jne 0x407505
add dword [ebp + 0x5c], 2
mov esi, edi
mov eax, dword [ebp + 0x5c]
cmp word [eax], 0x26
jne 0x407516
add dword [ebp + 0x5c], 2
mov byte [ebp + 0x5b], 3
lea eax, [ebp + 0x5c]
push eax
call fcn.0042609c
mov eax, dword [ebp + 0x5c]
cmp word [eax], bx
pop ecx
je 0x4073cd
mov dword [ebp + 0x28], eax
jmp 0x407542
cmp cx, 0x3c
je 0x40754a
cmp cx, 0x3e
je 0x40754a
inc eax
inc eax
mov dword [ebp + 0x5c], eax
mov cx, word [eax]
cmp cx, bx
jne 0x407531
sub eax, dword [ebp + 0x28]
lea ecx, [ebp]
sar eax, 1
push eax
push dword [ebp + 0x28]
call fcn.00426041
lea ecx, [ebp + 0x24]
call fcn.0042aeb8
mov ecx, dword [ebp + 0x54]
push edi
push ebx
lea eax, [ebp + 0x24]
push eax
push dword [ebp + 0x28]
call fcn.0043b18c
mov eax, dword [ebp + 0x24]
push eax
mov dword [ebp + 0x28], eax
call fcn.0040aea9
lea eax, [ebp + 0x28]
push eax
call fcn.0042609c
test byte [ebp + 0x5b], 1
pop ecx
pop ecx
je 0x4075a2
cmp dword [ebp + 0x44], ebx
je 0x40759f
push dword [ebp + 0x44]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 0x44], ebx
test byte [ebp + 0x5b], 2
je 0x4075bc
cmp dword [ebp + 0x38], ebx
je 0x4075b6
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 0x38], ebx
mov dword [ebp + 0x4c], ebx
push ebx
push ebx
push 4
lea eax, [ebp - 0xe4]
push eax
push 7
push 0x40000000
push dword [ebp + 0x28]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
call fcn.00403b3c
mov edi, eax
cmp edi, ebx
jne 0x4075fa
lea ecx, [ebp + 0x24]
call fcn.0042602e
lea ecx, [ebp]
call fcn.0042602e
mov eax, dword [ebp + 0x5c]
jmp 0x4073ca
cmp esi, ebx
je 0x407609
push 2
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [ebp + 0x5b], 1
jne 0x407614
mov dword [ebp + 0x44], edi
jmp 0x4075e2
cmp byte [ebp + 0x5b], 3
mov dword [ebp + 0x4c], edi
je 0x40760f
mov dword [ebp + 0x38], edi
jmp 0x4075e2
mov ecx, dword [ebp - 4]
cmp ecx, ebx
mov eax, pe_nt_image_headers32
je 0x40763d
or dword [ebp - 0x190], eax
mov dword [ebp + 0x14], edi
mov dword [ebp - 0x184], ecx
mov ecx, dword [ebp + 0x44]
cmp ecx, ebx
je 0x407653
or dword [ebp - 0x190], eax
mov dword [ebp + 0x14], edi
mov dword [ebp - 0x180], ecx
mov ecx, dword [ebp + 0x4c]
cmp ecx, ebx
je 0x407669
or dword [ebp - 0x190], eax
mov dword [ebp + 0x14], edi
mov dword [ebp - 0x17c], ecx
mov ecx, dword [ebp + 0x54]
push edi
push ebx
lea eax, [ebp - 0x94]
push eax
push dword [ebp + 0x20]
call fcn.0043b18c
mov eax, dword [ebp - 0x94]
mov dword [ebp + 0x68], eax
xor edi, edi
inc edi
mov esi, 0x10000000
mov eax, dword [ebp + 0x68]
mov ax, word [eax]
cmp ax, 0x21
je 0x4076bf
cmp ax, 0x2a
je 0x4076bf
cmp ax, 0x40
jne 0x4076c8
push str.WinSta0WinLogon
lea ecx, [ebp - 0x50]
call fcn.00426075
mov eax, dword [ebp - 0x50]
inc byte [ebp + 0x3e]
mov dword [ebp - 0x1b4], eax
mov dword [ebp + 8], esi
add dword [ebp + 0x68], 2
jmp 0x40768e
cmp ax, 0x3d
jne 0x4076d3
mov dword [ebp + 4], edi
jmp 0x4076c2
cmp ax, 0x24
jne 0x4076df
mov byte [ebp + 0x4b], 1
jmp 0x4076c2
cmp ax, 0x26
jne 0x4076ee
mov dword [ebp + 8], 3
jmp 0x4076c2
cmp ax, 0x5e
jne 0x4076fd
mov dword [ebp + 8], 6
jmp 0x4076c2
cmp ax, 0x5f
je 0x4076f4
cmp dword [ebp - 0x1b4], ebx
je 0x407720
test byte [ebp + 0x3e], 1
je 0x407720
call fcn.004036fd
cmp eax, edi
jge 0x407720
mov dword [ebp - 0x1b4], ebx
mov eax, dword [ebp + 0x7c]
cmp eax, ebx
je 0x40773d
or byte [ebp - 0x18f], 1
mov dword [ebp + 4], ebx
mov byte [ebp + 0x73], bl
mov dword [ebp + 0x14], edi
mov dword [ebp - 0x180], eax
cmp byte [ebp + 0x4b], bl
je 0x407757
mov eax, dword [ebp - 0x5c]
cmp word [eax], bx
jne 0x407757
push 0x47b2d4
lea ecx, [ebp - 0x5c]
call fcn.004346c9
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x407763
cmp byte [ebp - 6], bl
je 0x40776a
or byte [ebp - 0x190], 0x80
cmp eax, ebx
je 0x40777b
or dword [ebp - 0x190], edi
mov word [ebp - 0x18c], ax
mov al, byte [ebp + 0x3e]
and al, 3
cmp al, 3
je 0x407789
cmp byte [ebp - 7], bl
je 0x407790
or byte [ebp - 0x18d], 8
cmp byte [ebp - 0xb], bl
je 0x4077e0
push 0x5c
push dword [ebp + 0x68]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
cmp esi, ebx
je 0x4077aa
inc esi
inc esi
jmp 0x4077ad
mov esi, dword [ebp + 0x68]
push dword [ebp + 0x68]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push dword [ebp + 0x68]
xor eax, eax
cmp dword [ebp + 4], ebx
push edi
setne al
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
add eax, 0x80000001
push eax
call fcn.00426e2f
add esp, 0x18
mov ebx, eax
jmp 0x408c0b
lea eax, [ebp + 0x68]
push eax
call fcn.0042609c
cmp dword [ebp + 0x34], ebx
pop ecx
mov dword [ebp], ebx
mov dword [ebp - 0x6c], ebx
je 0x407881
lea ecx, [ebp + 0x28]
mov byte [ebp + 0x4b], bl
call fcn.0042aeb8
mov ecx, dword [ebp + 0x54]
push 0xffffffffffffffff
push ebx
push dword [ebp + 0x34]
call fcn.0040f7cf
cmp eax, ebx
je 0x40786f
mov ecx, dword [eax]
cmp word [ecx], bx
je 0x40786f
push eax
lea ecx, [ebp + 0x28]
call fcn.004346f7
push dword [ebp + 0x68]
lea ecx, [ebp - 0x6c]
call fcn.00426075
push dword [ebp - 0x98]
lea eax, [ebp]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp + 0x28]
call fcn.004062f2
mov esi, eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp + 0x18], eax
mov eax, dword [ebp - 0x6c]
add esp, 0x14
lea ecx, [ebp + 0x28]
mov dword [ebp + 0x68], eax
call fcn.0042602e
cmp esi, ebx
je 0x407881
mov ebx, esi
jmp 0x408bfb
lea ecx, [ebp + 0x28]
call fcn.0042602e
mov ebx, 0x80070057
jmp 0x408bfb
mov eax, dword [ebp - 0x68]
cmp word [eax], bx
je 0x4078d1
push dword [ebp + 0x68]
call fcn.0040ca55
pop ecx
push eax
lea ecx, [ebp + 0x78]
mov dword [ebp + 0x68], eax
call fcn.00434695
push 0x47b270
lea ecx, [ebp + 0x78]
call fcn.0042af26
push dword [ebp - 0x68]
lea ecx, [ebp + 0x78]
call fcn.0042af26
mov ecx, dword [ebp + 0x54]
push ebx
push dword [ebp + 0x78]
call fcn.00439065
mov ebx, eax
lea ecx, [ebp + 0x78]
call fcn.0042602e
jmp 0x408bfb
cmp byte [ebp - 8], bl
je 0x407a8f
lea ecx, [ebp + 0x70]
call fcn.0042aeb8
push dword [ebp + 0x68]
mov dword [ebp + 0x50], ebx
call fcn.0040ca55
pop ecx
lea ecx, [ebp + 0x7c]
mov dword [ebp + 0x68], eax
call fcn.0042aeb8
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x7c]
push eax
push dword [ebp + 0x68]
mov dword [ebp + 0x6c], ebx
call fcn.004334dc
mov eax, dword [ebp + 0x6c]
add esp, 0xc
cmp eax, ebx
jne 0x407926
lea ecx, [ebp + 0x7c]
call fcn.0042602e
lea ecx, [ebp + 0x70]
jmp 0x407872
mov word [eax - 2], bx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push dword [ebp + 0x6c]
lea ecx, [ebp + 0x20]
mov dword [ebp + 0x78], eax
call fcn.00434695
lea eax, [ebp + 0x7c]
push eax
lea ecx, [ebp + 0xc]
call fcn.004346b2
push dword [ebp + 0x78]
lea ecx, [ebp + 0x70]
push ecx
lea ecx, [ebp + 0x50]
push ecx
push dword [ebp + 0x20]
push dword [eax]
call fcn.00404f90
add esp, 0x14
lea ecx, [ebp + 0xc]
call fcn.0042602e
lea ecx, [ebp + 0x20]
call fcn.0042602e
cmp dword [ebp + 0x50], ebx
jg 0x40798e
lea ecx, [ebp + 0x7c]
call fcn.0042602e
lea ecx, [ebp + 0x70]
call fcn.0042602e
mov ebx, edi
jmp 0x408bfb
mov eax, dword [ebp + 0x54]
mov eax, dword [eax + 0x28]
xor edi, edi
cmp eax, ebx
je 0x40799d
mov edi, dword [eax + 0x18]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebx
push edi
push ebx
push dword [ebp - 0xbc]
push dword [ebp - 0xc0]
push 0x128
push dword [ebp + 0x78]
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push ebx
push ebx
push ebx
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [ebp + 0x78]
call dword [sym.imp.USER32.dll_DestroyMenu]
lea eax, [esi - 0xbb8]
cmp eax, ebx
jl 0x407a7f
cmp eax, dword [ebp + 0x50]
jge 0x407a7f
cmp eax, ebx
mov ecx, dword [ebp + 0x70]
mov dword [ebp + 0x78], ecx
jle 0x407a32
mov esi, eax
lea eax, [ebp + 0x78]
call fcn.00403aff
mov eax, dword [ebp + 0x78]
movzx eax, word [eax]
push eax
call fcn.00402a5b
add esp, 4
test al, al
je 0x407a18
add dword [ebp + 0x78], 2
mov eax, dword [ebp + 0x78]
movzx eax, word [eax]
push eax
call fcn.00402a5b
add esp, 4
test al, al
je 0x407a2f
add dword [ebp + 0x78], 2
dec esi
jne 0x4079f9
mov esi, dword [ebp + 0x78]
lea eax, [ebp + 0x78]
call fcn.00403aff
mov eax, dword [ebp + 0x78]
mov word [eax], bx
cmp word [esi], bx
je 0x407a7f
push dword [ebp + 0x68]
lea ecx, [ebp + 0x74]
call fcn.00434695
push 0x47b270
lea ecx, [ebp + 0x74]
call fcn.0042af26
push esi
lea ecx, [ebp + 0x74]
call fcn.0042af26
mov ecx, dword [ebp + 0x54]
push ebx
push dword [ebp + 0x74]
call fcn.00439065
lea ecx, [ebp + 0x74]
mov ebx, eax
call fcn.0042602e
lea ecx, [ebp + 0x7c]
call fcn.0042602e
lea ecx, [ebp + 0x70]
jmp 0x4078c7
push dword [ebp + 0x68]
lea ecx, [ebp - 0xcc]
call fcn.00434695
cmp byte [0x48fd68], bl
mov eax, dword [ebp - 0xcc]
mov esi, dword [ebp + 0x6c]
mov dword [ebp + 0x68], eax
jne 0x407abf
cmp esi, ebx
je 0x407aba
cmp byte [esi + 0xa], bl
jne 0x407abf
mov byte [ebp + 0x7f], bl
jmp 0x407ac3
mov byte [ebp + 0x7f], 1
push ebx
lea ecx, [ebp + 0x24]
call fcn.00434695
cmp byte [ebp + 0x7f], bl
mov dword [ebp + 0x5c], ebx
je 0x407d3a
push 0x49062c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
lea ecx, [ebp - 0x268]
call fcn.0040f788
cmp esi, ebx
je 0x407b00
push ebx
push esi
lea ecx, [ebp - 0x268]
call fcn.00427f16
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edi, eax
push 0x106
lea ecx, [ebp + 0x4c]
mov dword [ebp + 0xc], edi
call fcn.0042aed6
mov eax, dword [ebp + 0x4c]
mov dword [ebp + 0x6c], eax
jmp 0x407b98
mov dword [ebp + 0x7c], edi
jmp 0x407b2b
cmp ax, 0x3d
je 0x407b35
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x407b25
mov esi, edi
sub esi, dword [ebp + 0x7c]
sar esi, 1
cmp word [edi], bx
je 0x407b96
cmp word [edi + 2], bx
je 0x407b91
cmp esi, 0x104
jg 0x407b91
push esi
push dword [ebp + 0x7c]
push dword [ebp + 0x6c]
call fcn.00403ac3
mov eax, dword [ebp + 0x6c]
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x268]
mov word [eax + esi*2], bx
call fcn.0040ac3f
test eax, eax
jne 0x407b91
push 0xffffffffffffffff
push esi
lea eax, [edi + 2]
push eax
push dword [ebp + 0x7c]
lea ecx, [ebp - 0x268]
call fcn.0040aba2
jmp 0x407b91
inc edi
inc edi
cmp word [edi], bx
jne 0x407b8f
inc edi
inc edi
cmp word [edi], bx
jne 0x407b20
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov ecx, dword [ebp - 0x264]
xor eax, eax
cmp ecx, ebx
mov dword [ebp + 0x34], ebx
mov dword [ebp + 0x7c], ecx
mov dword [ebp + 0x6c], eax
jle 0x407c46
jmp 0x407bc4
mov eax, dword [ebp + 0x6c]
lea esi, [eax + 1]
cmp esi, dword [ebp + 0x7c]
mov dword [ebp + 0x50], eax
mov dword [ebp - 0x18], esi
jge 0x407c37
mov eax, dword [ebp + 0x6c]
shl eax, 2
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x20], eax
mov eax, dword [ebp - 0x268]
mov ecx, dword [ebp + 0x20]
mov ecx, dword [ecx + eax]
mov ecx, dword [ecx]
mov edi, esi
shl edi, 2
mov eax, dword [eax + edi]
mov eax, dword [eax]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jge 0x407c08
mov dword [ebp + 0x50], esi
mov dword [ebp + 0x20], edi
inc esi
cmp esi, dword [ebp + 0x7c]
jl 0x407bde
mov eax, dword [ebp + 0x50]
cmp eax, dword [ebp + 0x6c]
je 0x407c37
mov edx, dword [ebp - 0x268]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x50]
add eax, edx
mov edi, dword [eax]
shl ecx, 2
mov edx, dword [edx + ecx]
mov dword [eax], edx
mov eax, dword [ebp - 0x268]
mov dword [eax + ecx], edi
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 0x7c]
mov dword [ebp + 0x6c], eax
jl 0x407bc1
xor esi, esi
cmp dword [ebp + 0x7c], ebx
jle 0x407c84
mov eax, dword [ebp - 0x268]
mov eax, dword [eax + esi*4]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp + 0x34]
lea edi, [ecx + eax + 1]
mov eax, dword [ebp - 0x268]
mov eax, dword [eax + esi*4]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc esi
cmp esi, dword [ebp + 0x7c]
lea eax, [edi + eax + 3]
mov dword [ebp + 0x34], eax
jl 0x407c4d
mov eax, dword [ebp + 0x34]
add eax, 4
push eax
lea ecx, [ebp + 0x24]
call fcn.0042aeff
mov edi, dword [ebp + 0x24]
xor esi, esi
cmp dword [ebp + 0x7c], ebx
mov dword [ebp + 0x5c], edi
jle 0x407d09
mov eax, dword [ebp - 0x268]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
push eax
mov dword [ebp + 0x6c], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp + 0x6c]
mov dword [ebp + 0x50], eax
push edi
call fcn.00403ac3
mov eax, dword [ebp + 0x50]
lea edi, [edi + eax*2]
mov word [edi], 0x3d
mov eax, dword [ebp - 0x268]
mov eax, dword [eax + esi*4]
mov eax, dword [eax + 4]
add esp, 0xc
inc edi
push eax
inc edi
mov dword [ebp + 0x6c], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp + 0x6c]
mov dword [ebp + 0x50], eax
push edi
call fcn.00403ac3
mov eax, dword [ebp + 0x50]
lea edi, [edi + eax*2]
add esp, 0xc
mov word [edi], bx
inc edi
inc edi
inc esi
cmp esi, dword [ebp + 0x7c]
jl 0x407ca0
mov word [edi], bx
lea ecx, [ebp + 0x4c]
mov word [edi + 2], bx
call fcn.0042602e
push ebx
lea ecx, [ebp - 0x268]
call fcn.0041c5fe
lea ecx, [ebp - 0x230]
call fcn.0042602e
push 0x49062c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x14]
xor al, al
cmp word [ecx], 0x40
jne 0x407d49
inc al
jmp 0x407d50
cmp dword [ebp - 0x60], ebx
je 0x407d50
mov al, 2
cmp byte [ebp + 0x73], bl
je 0x407e4c
or byte [ebp + 0x73], 8
xor esi, esi
inc esi
neg al
mov dword [ebp + 4], esi
sbb eax, eax
and eax, 0xfff01000
add eax, 0x100000
mov edi, eax
call fcn.00427c6b
push eax
lea eax, [ebp - 0x118]
push str..pipepecmd_exec__u
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebx
push esi
push edi
push edi
push 0xff
push 6
push 0x40000003
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp eax, ebx
mov dword [ebp - 0x2c], eax
je 0x407dee
cmp eax, 0xffffffff
je 0x407dee
push 0xffffffffffffffff
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp + 0x7c]
call fcn.0042605a
push ebx
push ebx
push 3
lea ecx, [ebp - 0xe4]
push ecx
push 7
push 0xc0000000
push dword [eax]
lea ecx, [ebp - 0x28]
call fcn.00403b3c
lea ecx, [ebp + 0x7c]
call fcn.0042602e
jmp 0x407df5
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebp - 0x28]
push ebx
push ebx
lea eax, [ebp + 0x6c]
push eax
push edi
mov dword [ebp + 0x6c], 2
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
push ebx
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
or byte [ebp - 0x18f], 1
test byte [ebp + 0x77], 2
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x20], esi
mov dword [ebp + 0x14], esi
jne 0x407e3a
cmp byte [ebp + 0x77], bl
jne 0x407e40
mov dword [ebp - 0x180], edi
test byte [ebp + 0x77], 1
je 0x407e62
mov dword [ebp - 0x17c], edi
cmp dword [ebp + 4], ebx
jne 0x407e62
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
push 0x49062c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [ebp + 0x5c]
mov eax, edi
neg eax
sbb eax, eax
and eax, 0x400
or eax, dword [ebp + 0x40]
cmp byte [ebp + 0x1e], bl
mov dword [ebp + 0x30], ebx
mov dword [ebp + 0x6c], eax
je 0x407e8d
or dword [ebp + 0x6c], 4
cmp byte [ebp - 9], bl
mov dword [ebp + 0xc], ebx
mov dword [ebp - 0x18], ebx
je 0x407ea5
lea eax, [ebp + 0xc]
push eax
call fcn.00402f13
pop ecx
mov dword [ebp - 0x18], eax
cmp byte [ebp + 0x4b], bl
je 0x407f70
push 0xd
xor eax, eax
mov dword [ebp - 0x130], ebx
pop ecx
lea edi, [ebp - 0x12c]
mov dword [ebp - 0x134], 0x3c
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
or word [ebp - 0x130], 0x4540
cmp eax, ebx
jne 0x407ede
push 5
pop eax
movzx eax, ax
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp + 0x68]
mov dword [ebp + 0x7c], ebx
mov dword [ebp + 0x20], eax
mov dword [ebp - 0x124], eax
cmp word [eax], 0x22
jne 0x407f3c
push 1
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.00413db8
add esp, 0xc
push dword [ebp + 0x7c]
lea ecx, [ebp - 0x88]
push dword [ebp + 0x20]
mov esi, eax
call fcn.00409fd6
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp + 0x74], eax
mov eax, dword [ebp - 0xfc]
push eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xfc], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [ebp - 0xb0], eax
jmp 0x40833e
cmp byte [ebp - 0xa], bl
je 0x407fc7
call fcn.00406261
push dword [ebp + 0x68]
mov dword [ebp - 0x90], eax
push dword [ebp + 0x18]
lea eax, [ebp + 0x30]
push dword [ebp + 0x10]
push eax
call fcn.00403629
add esp, 0x10
lea ecx, [ebp - 0xb8]
push ecx
lea ecx, [ebp - 0x1bc]
push ecx
push eax
push edi
push dword [ebp + 0x6c]
push dword [ebp + 0x14]
push ebx
push ebx
push dword [ebp + 0x68]
push dword [ebp + 0x18]
push dword [ebp - 0x90]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp + 0x74], eax
jmp 0x40833e
mov eax, dword [ebp - 0x48]
cmp word [eax], bx
je 0x408107
cmp byte [ebp + 0x1d], bl
mov dword [ebp + 0x74], ebx
je 0x40806b
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp + 0x50]
call fcn.00402a40
lea ecx, [ebp + 0x7c]
call fcn.0042adba
mov edi, dword [ebp - 0x3c]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push ebx
push edi
call fcn.00466780
lea eax, [ebp + 0x7c]
push eax
push dword [ebp + 0x50]
call fcn.0043073b
add esp, 0x14
push 0xffffffffffffffff
mov edi, eax
neg edi
push 0xffffffffffffffff
push dword [ebp + 0x7c]
sbb edi, edi
lea ecx, [ebp - 0x3c]
neg edi
call fcn.00409f00
mov esi, dword [ebp + 0x50]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push ebx
push esi
call fcn.00466780
mov esi, dword [ebp + 0x7c]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push ebx
push esi
call fcn.00466780
add esp, 0xc
lea ecx, [ebp + 0x7c]
call fcn.0042602e
lea ecx, [ebp + 0x50]
call fcn.0042602e
cmp edi, ebx
je 0x4080d6
mov esi, dword [ebp - 0x48]
mov edi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x40
push esi
call edi
cmp eax, ebx
jne 0x408086
push 0x5c
push esi
call edi
cmp eax, ebx
je 0x408091
mov word [eax], bx
mov edi, dword [ebp - 0x48]
lea esi, [eax + 2]
jmp 0x408096
mov edi, 0x47b254
push dword [ebp + 0x68]
lea eax, [ebp + 0x30]
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push eax
call fcn.00403629
add esp, 0x10
lea ecx, [ebp - 0xb8]
push ecx
lea ecx, [ebp - 0x1bc]
push ecx
push eax
push dword [ebp + 0x5c]
push dword [ebp + 0x6c]
push dword [ebp + 0x68]
push dword [ebp + 0x18]
push 1
push dword [ebp - 0x3c]
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov dword [ebp + 0x74], eax
mov edi, dword [ebp - 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
call esi
shl eax, 1
push eax
push ebx
push edi
call fcn.00466780
mov edi, dword [ebp - 0x48]
add esp, 0xc
push edi
call esi
shl eax, 1
push eax
push ebx
push edi
call fcn.00466780
add esp, 0xc
jmp 0x40833e
cmp byte [ebp + 0x3f], bl
je 0x40814d
push dword [ebp + 0x2c]
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x1bc]
push eax
push dword [ebp + 0x10]
push edi
push dword [ebp + 0x6c]
push dword [ebp + 0x14]
push dword [ebp + 0x68]
push dword [ebp - 0xd4]
push dword [ebp - 0xd8]
call fcn.004338d1
xor ecx, ecx
add esp, 0x28
test eax, eax
setg cl
mov dword [ebp + 0x74], ecx
jmp 0x40833e
mov esi, dword [ebp + 0x18]
cmp esi, ebx
mov dword [ebp + 0x74], ebx
mov dword [ebp + 0x40], ebx
mov dword [ebp + 0x20], ebx
mov eax, esi
je 0x408266
cmp word [esi], 0x2a
jne 0x408266
mov byte [ebp + 0x7f], 1
lea eax, [esi + 2]
cmp eax, ebx
je 0x408191
cmp word [eax], 0x23
jne 0x408191
mov cx, word [eax + 2]
cmp cx, 0x30
jb 0x408191
cmp cx, 0x39
ja 0x408191
mov dword [ebp + 0x40], eax
cmp dword [ebp + 0x40], ebx
mov dword [ebp + 0x2c], ebx
je 0x4082ff
add dword [ebp + 0x40], 2
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x40]
push eax
call fcn.00431de7
pop ecx
pop ecx
push 0x20
pop edi
lea ecx, [ebp - 0x38]
mov esi, eax
mov dword [ebp + 0x34], edi
call fcn.0042adba
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
push esi
push dword [ebp + 0x2c]
mov dword [ebp - 0x34], ebx
push ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp + 0x34], edi
call fcn.0040f8b6
mov esi, eax
add esp, 0x14
cmp esi, ebx
jne 0x408213
push dword [ebp + 0x2c]
push 0x47b24c
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x408213
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
push str.INDATA
push 2
push ebx
mov dword [ebp + 0x34], edi
call fcn.0040f8b6
add esp, 0x14
mov esi, eax
cmp dword [ebp - 0x34], ebx
jle 0x4082f5
cmp esi, ebx
je 0x4082f5
cmp byte [ebp + 0x7f], bl
jne 0x40826e
push ebx
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x1bc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0x5c]
push dword [ebp + 0x6c]
push dword [ebp + 0x14]
push dword [ebp + 0x68]
push dword [ebp - 0x34]
push esi
call fcn.004338d1
add esp, 0x28
cmp eax, ebx
jl 0x40826e
xor ecx, ecx
cmp eax, ebx
setg cl
mov dword [ebp + 0x74], ecx
jmp 0x4082f5
mov byte [ebp + 0x7f], bl
jmp 0x408174
push str.exedat
lea eax, [ebp + 0x7c]
push eax
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp - 0x7c]
push eax
mov dword [ebp + 0x7c], ebx
mov dword [ebp + 0x4c], ebx
call fcn.00403c03
add esp, 0x10
cmp dword [ebp + 0x7c], ebx
je 0x4082ed
push ebx
lea eax, [ebp + 0x74]
push eax
push dword [ebp - 0x34]
mov dword [ebp + 0x74], ebx
push esi
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0x68]
lea eax, [ebp + 0x30]
push dword [ebp + 0x4c]
push dword [ebp + 0x10]
push eax
call fcn.00403629
lea ecx, [ebp - 0xb8]
push ecx
lea ecx, [ebp - 0x1bc]
push ecx
push eax
push dword [ebp + 0x5c]
push dword [ebp + 0x6c]
push dword [ebp + 0x14]
push ebx
push ebx
push dword [ebp + 0x68]
push dword [ebp + 0x4c]
call fcn.00466445
add esp, 0x38
mov dword [ebp + 0x74], eax
lea ecx, [ebp + 0x4c]
call fcn.0042602e
lea ecx, [ebp - 0x38]
call fcn.0042602e
jmp 0x408336
push dword [ebp + 0x68]
lea eax, [ebp + 0x30]
push esi
push dword [ebp + 0x10]
push eax
call fcn.00403629
lea ecx, [ebp - 0xb8]
push ecx
lea ecx, [ebp - 0x1bc]
push ecx
push eax
push edi
push dword [ebp + 0x6c]
push dword [ebp + 0x14]
push ebx
push ebx
push dword [ebp + 0x68]
push esi
call fcn.00466445
add esp, 0x38
mov dword [ebp + 0x74], eax
lea ecx, [ebp + 0x20]
call fcn.0042602e
cmp dword [ebp - 0x18], ebx
je 0x40834c
push dword [ebp + 0xc]
call fcn.00402f24
pop ecx
cmp dword [ebp - 0x1c], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x40835c
push dword [ebp - 0x1c]
call esi
cmp dword [ebp + 0x74], ebx
mov dword [ebp - 0x1c], ebx
je 0x408368
xor eax, eax
jmp 0x40836e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x78]
mov dword [ecx], eax
lea ecx, [ebp]
mov dword [ebp + 0x7c], eax
call fcn.004029f8
mov eax, dword [ebp - 0x64]
cmp word [eax], bx
je 0x4083b3
push dword [ebp - 0xb0]
lea eax, [ebp - 0x120]
push 0x47b234
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp + 0x54]
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x64]
call fcn.00429dbf
cmp byte [ebp + 0x1e], bl
je 0x4083d8
cmp dword [ebp - 0xb8], ebx
je 0x4083d8
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push dword [ebp - 0xb8]
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
push str.__LastPID
push dword [ebp - 0xb0]
push dword [ebp + 0x54]
call fcn.0042cc8f
push str.__LastTID
push dword [ebp - 0xac]
push dword [ebp + 0x54]
call fcn.0042cc8f
add esp, 0x18
test byte [ebp + 0x6c], 4
je 0x40841b
cmp dword [ebp - 0xb4], ebx
je 0x40841b
push dword [ebp - 0xb4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea ecx, [ebp + 0x30]
call fcn.0042602e
push 0x49062c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp + 0x24]
call fcn.0042602e
cmp dword [ebp - 0x28], ebx
je 0x408440
push dword [ebp - 0x28]
call esi
cmp dword [ebp - 0x10], ebx
mov dword [ebp - 0x28], ebx
je 0x40844d
push dword [ebp - 0x10]
call esi
cmp dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
je 0x40845a
push dword [ebp - 4]
call esi
cmp dword [ebp + 0x44], ebx
mov dword [ebp - 4], ebx
je 0x408467
push dword [ebp + 0x44]
call esi
cmp dword [ebp + 0x38], ebx
mov dword [ebp + 0x44], ebx
je 0x408474
push dword [ebp + 0x38]
call esi
cmp dword [ebp + 0x74], ebx
mov dword [ebp + 0x38], ebx
je 0x408b37
mov eax, dword [ebp - 0xb8]
cmp eax, ebx
jne 0x40848d
mov dword [ebp + 4], ebx
mov ecx, dword [ebp - 0x20]
inc dword [ebp - 0x20]
cmp dword [ebp - 0xb4], ebx
mov dword [ebp + ecx*4 - 0xc8], eax
je 0x4084aa
push dword [ebp - 0xb4]
call esi
cmp byte [ebp + 0x5a], bl
mov dword [ebp - 0xb4], ebx
je 0x4084ce
mov ecx, dword [ebp + 0x54]
push 0x3e8
call fcn.0040b352
push dword [ebp - 0xb8]
call fcn.0040bab6
pop ecx
cmp dword [ebp + 4], ebx
je 0x408b37
mov al, byte [0x48e2ac]
mov esi, 0x100000
push 0x100004
lea ecx, [ebp + 0x5c]
mov byte [ebp + 0x77], al
mov dword [ebp + 0x10], esi
xor edi, edi
call fcn.0042add7
mov eax, dword [ebp - 0x14]
cmp word [eax], 0x40
lea ecx, [eax + 2]
mov dword [ebp + 0x40], eax
mov dword [ebp - 0x40], ecx
mov byte [ebp + 0x7f], bl
jne 0x4085b2
mov byte [ebp + 0x7f], 1
mov dword [ebp + 0x40], ecx
cmp byte [ebp - 5], bl
je 0x408571
mov ecx, dword [ebp + 0x54]
push ebx
lea eax, [ebp + 0x2c]
push eax
push dword [ebp + 0x40]
mov dword [ebp + 0x2c], ebx
call fcn.0043a69e
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 0x2c]
lea ecx, [ebp + 0x5c]
call fcn.00409e88
push dword [ebp + 0x5c]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea esi, [edi + 0x3ff]
and esi, 0xfffffc00
add esi, 0x100000
lea eax, [esi + 8]
push eax
lea ecx, [ebp + 0x5c]
mov dword [ebp + 0x10], esi
call fcn.0042adfe
lea ecx, [ebp + 0x2c]
call fcn.0042602e
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
test byte [ebp + 0x73], 8
je 0x408855
mov eax, dword [ebp - 0x14]
mov ax, word [eax]
cmp ax, 0x40
je 0x4085c4
cmp byte [ebp + 0x1f], bl
je 0x4085c4
cmp ax, 0x26
je 0x4085ac
mov eax, dword [ebp + 0x54]
test byte [eax + 0xb], 0xf
je 0x4085c4
mov byte [ebp + 0x6f], 1
jmp 0x4085c7
cmp dword [ebp - 0x60], ebx
je 0x408516
mov byte [ebp + 0x7f], 2
jmp 0x408516
mov byte [ebp + 0x6f], bl
push ebx
mov dword [ebp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0xf8]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
cmp byte [ebp + 0x7f], bl
mov dword [ebp + 8], edi
je 0x4085ed
sub esi, edi
jmp 0x4085f2
mov esi, 0x100000
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp + 0x24]
push eax
mov eax, dword [ebp + 0x5c]
push esi
add eax, edi
push eax
push dword [ebp - 0x2c]
mov dword [ebp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp - 0x44], ebx
mov dword [ebp + 0x20], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp + 0x4c], ebx
jg 0x40862b
mov dword [ebp - 0x44], 0x3e8
lea ecx, [ebp + 0x18]
mov byte [ebp + 0x5a], bl
call fcn.0042aeb8
mov al, byte [0x48e2ac]
cmp al, bl
mov byte [ebp + 0x77], al
jle 0x408848
push 0x4ff
push dword [ebp - 0x44]
lea eax, [ebp - 0xc8]
push ebx
push eax
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, ebx
mov dword [ebp + 0x14], eax
jne 0x4086cb
lea eax, [ebp - 0x2c]
mov esi, dword [eax]
push ebx
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp - 0xf8]
push eax
push esi
mov dword [ebp + 0x34], ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
cmp dword [ebp + 0x34], ebx
jbe 0x40868f
add edi, dword [ebp + 0x34]
mov eax, dword [ebp + 0x5c]
mov byte [eax + edi], bl
lea eax, [edi + 0x100000]
cmp eax, dword [ebp + 0x10]
jl 0x4086b0
add dword [ebp + 0x10], 0x100000
mov eax, dword [ebp + 0x10]
add eax, 4
push eax
lea ecx, [ebp + 0x5c]
call fcn.0042adfe
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp + 0x34]
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 0x5c]
add eax, edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [ebp + 0x7f], bl
je 0x4086fc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x18], eax
sub eax, dword [ebp + 0x20]
cmp eax, dword [ebp - 0x44]
jge 0x4087b0
cmp edi, dword [ebp + 0x4c]
je 0x40883f
cmp eax, 0x14
jl 0x40883f
jmp 0x4087b0
mov eax, dword [ebp - 0x20]
cmp eax, 1
jle 0x408725
dec eax
cmp eax, dword [ebp + 0x14]
jne 0x408725
cmp byte [ebp + 0x7f], bl
mov byte [ebp + 0x5a], 1
je 0x408848
cmp edi, dword [ebp + 0x4c]
je 0x408848
jmp 0x4087b0
test byte [ebp + 0x73], 1
je 0x408742
mov eax, dword [ebp + 8]
jmp 0x40873e
mov ecx, dword [ebp + 0x5c]
cmp byte [eax + ecx], 0xa
je 0x408848
inc eax
cmp eax, edi
jl 0x408730
push 5
pop esi
dec esi
js 0x408636
cmp byte [0x48e2ac], bl
jle 0x408636
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1d8]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x408636
cmp dword [ebp - 0x1d4], 0x12
je 0x408797
lea eax, [ebp - 0x1d8]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1d8]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x408745
cmp byte [ebp + 0x7f], bl
mov byte [ebp + 0x77], bl
mov byte [ebp + 0x5a], 1
je 0x408636
cmp edi, dword [ebp + 0x4c]
je 0x408636
cmp byte [ebp + 0x6f], bl
mov eax, dword [ebp - 0x18]
mov dword [ebp + 0x4c], edi
mov dword [ebp + 0x20], eax
jne 0x4087cc
push 0xffffffffffffffff
push edi
push dword [ebp + 0x5c]
lea ecx, [ebp + 0x18]
call fcn.00409f00
cmp byte [ebp + 0x7f], 1
jne 0x4087ed
push dword [ebp + 0x18]
mov ecx, dword [ebp + 0x54]
push dword [ebp + 0x18]
push 0x47a8e8
push dword [ebp + 0x40]
push dword [ebp + 0x40]
call fcn.004282a3
jmp 0x408819
cmp byte [ebp + 0x6f], bl
je 0x40880b
push ebx
lea eax, [ebp + 0x5c]
push eax
push edi
push dword [ebp + 0x5c]
push dword [ebp - 0x14]
push dword [ebp + 0x54]
call fcn.0043803b
add esp, 0x18
jmp 0x408819
push dword [ebp + 0x18]
mov ecx, dword [ebp + 0x54]
push dword [ebp + 0x40]
call fcn.00429dbf
cmp dword [ebp - 0x60], ebx
je 0x40883f
push dword [ebp - 0x60]
lea ecx, [ebp - 0x54]
call fcn.00434695
mov ecx, dword [ebp + 0x54]
push ebx
push ebx
push ebx
push dword [ebp - 0x54]
call fcn.0041ff01
lea ecx, [ebp - 0x54]
call fcn.0042602e
cmp byte [ebp + 0x5a], bl
je 0x4086fc
lea ecx, [ebp + 0x18]
call fcn.0042602e
jmp 0x408937
cmp dword [ebp + 4], 0xffffff9c
je 0x408937
jmp 0x408927
push 0x4ff
push 0x3e8
push ebx
lea eax, [ebp - 0xc8]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov ecx, dword [ebp - 0x20]
dec ecx
cmp ecx, eax
je 0x408937
cmp dword [ebp - 0x20], 1
jle 0x40891f
cmp eax, ebx
jne 0x40891f
lea eax, [edi + 0x100000]
cmp eax, esi
jl 0x4088b9
add esi, 0x100000
lea eax, [esi + 4]
push eax
lea ecx, [ebp + 0x5c]
call fcn.0042adfe
push ebx
lea eax, [ebp + 0x7c]
push eax
mov eax, dword [ebp + 0x5c]
push 1
add eax, edi
push eax
push dword [ebp - 0x2c]
mov dword [ebp + 0x7c], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40891f
cmp dword [ebp + 0x7c], ebx
jbe 0x40891f
add edi, dword [ebp + 0x7c]
mov eax, dword [ebp + 0x5c]
mov byte [eax + edi], bl
jmp 0x40891f
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x408927
cmp dword [ebp - 0x110], 0x12
je 0x408927
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp byte [0x48e2ac], bl
jg 0x4088e6
mov al, byte [0x48e2ac]
cmp al, bl
mov byte [ebp + 0x77], al
jg 0x408864
cmp dword [ebp + 4], 0xffffff9c
mov eax, dword [ebp + 0x5c]
mov byte [eax + edi + 2], bl
mov eax, dword [ebp + 0x5c]
mov byte [eax + edi + 1], bl
mov eax, dword [ebp + 0x5c]
mov byte [eax + edi], bl
mov dword [ebp + 0x50], ebx
je 0x408968
cmp byte [ebp + 0x77], bl
jle 0x408968
push ebx
lea eax, [ebp - 0xb8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp - 0xb8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp byte [ebp + 0x73], bl
mov eax, dword [ebp + 0x50]
mov ecx, dword [ebp + 0x78]
mov dword [ecx], eax
je 0x408aeb
mov eax, dword [ebp - 0x14]
mov ax, word [eax]
cmp ax, 0x40
je 0x4089b1
cmp byte [ebp + 0x1f], bl
je 0x4089b1
cmp ax, 0x26
je 0x4089ab
mov eax, dword [ebp + 0x54]
test byte [eax + 0xb], 0xf
je 0x4089b1
mov byte [ebp + 0x7b], 1
jmp 0x4089b4
mov byte [ebp + 0x7b], bl
lea ecx, [ebp - 0x38]
call fcn.0042adba
cmp byte [ebp + 0x7b], bl
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
jne 0x408a93
lea eax, [edi + 0x18]
push eax
lea ecx, [ebp - 0x38]
call fcn.0042aeff
lea eax, [edi + 1]
push eax
push dword [ebp + 0x5c]
mov dword [ebp - 0x30], edi
push dword [ebp - 0x38]
mov dword [ebp - 0x34], edi
call fcn.004669c0
mov eax, dword [ebp - 0x38]
push 0x10
add eax, edi
push ebx
push eax
call fcn.00466780
lea eax, [ebp - 0x38]
push ebx
push eax
call fcn.00433b9f
mov esi, dword [ebp - 0x38]
add esp, 0x20
test byte [ebp + 0x73], 4
je 0x408a3b
push esi
mov dword [ebp + 0x7c], esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2 - 2]
jmp 0x408a34
mov cx, word [eax]
cmp cx, 0xd
je 0x408a2f
cmp cx, 0xa
jne 0x408a93
mov word [eax], bx
dec eax
dec eax
cmp eax, dword [ebp + 0x7c]
jae 0x408a20
jmp 0x408a93
test byte [ebp + 0x73], 1
jne 0x408a5a
test byte [ebp + 0x73], 2
je 0x408a93
jmp 0x408a8e
mov ax, word [esi]
cmp ax, 0xd
je 0x408a5f
cmp ax, 0xa
je 0x408a5f
inc esi
inc esi
cmp word [esi], bx
jne 0x408a49
mov word [esi], bx
jmp 0x408a93
mov ax, word [esi]
cmp ax, 0xd
je 0x408a77
cmp ax, 0xa
je 0x408a77
inc esi
inc esi
jmp 0x408a8e
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
lea eax, [esi + 2]
push eax
push esi
call fcn.00466d00
add esp, 0xc
cmp word [esi], bx
jne 0x408a64
mov eax, dword [ebp - 0x14]
cmp word [eax], 0x40
jne 0x408ab7
push dword [ebp - 0x38]
mov ecx, dword [ebp + 0x54]
push dword [ebp - 0x38]
push 0x47a8e8
push dword [ebp - 0x40]
push dword [ebp - 0x40]
call fcn.004282a3
jmp 0x408ae0
cmp byte [ebp + 0x7b], bl
je 0x408ad4
push 1
lea ecx, [ebp + 0x5c]
push ecx
push edi
push dword [ebp + 0x5c]
push eax
push dword [ebp + 0x54]
call fcn.0043803b
add esp, 0x18
jmp 0x408ae0
push dword [ebp - 0x38]
mov ecx, dword [ebp + 0x54]
push eax
call fcn.00429dbf
lea ecx, [ebp - 0x38]
call fcn.0042602e
mov eax, dword [ebp + 0x50]
push eax
mov dword [ebp + 0x7c], eax
lea eax, [ebp - 0x2a8]
push 0x47b1fc
push eax
mov word [ebp - 0x2a8], bx
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp + 0x54]
add esp, 0xc
lea eax, [ebp - 0x2a8]
push eax
push str.ERRORLEVEL
call fcn.00429dbf
cmp dword [ebp - 0x24], ebx
je 0x408b2f
push 1
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
lea ecx, [ebp + 0x5c]
call fcn.0042602e
mov ecx, dword [ebp - 0x7c]
cmp ecx, ebx
je 0x408b54
cmp word [ecx], bx
je 0x408b54
lea eax, [ebp - 0xb8]
push dword [eax + 8]
push ecx
call fcn.00402b49
pop ecx
pop ecx
lea esi, [ebp - 0xb8]
mov eax, dword [esi]
cmp eax, ebx
je 0x408b67
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [ebp - 4]
mov eax, dword [edi]
cmp eax, ebx
mov dword [esi], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x408b7b
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp + 0x44]
mov eax, dword [edi]
cmp eax, ebx
je 0x408b89
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp + 0x38]
cmp dword [edi], ebx
je 0x408b95
push ebx
call esi
mov dword [edi], ebx
lea edi, [ebp - 0x28]
mov eax, dword [edi]
cmp eax, ebx
je 0x408ba3
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0x2c]
mov eax, dword [edi]
cmp eax, ebx
je 0x408bb1
push eax
call esi
mov dword [edi], ebx
lea edi, [ebp - 0x70]
mov eax, dword [edi]
cmp eax, ebx
je 0x408bbf
push eax
call esi
cmp dword [ebp - 0xe8], ebx
mov dword [edi], ebx
je 0x408bd1
push dword [ebp - 0xe8]
call esi
lea edi, [ebp - 0xb8]
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x408be1
push eax
call esi
mov ecx, dword [ebp + 0x54]
push ebx
mov dword [edi + 4], ebx
call fcn.004488e0
lea ecx, [ebp - 0xcc]
call fcn.0042602e
mov ebx, dword [ebp + 0x7c]
lea ecx, [ebp - 0x6c]
call fcn.0042602e
lea ecx, [ebp]
call fcn.004029f8
lea ecx, [ebp - 0x94]
call fcn.0042602e
lea ecx, [ebp - 0x1c]
call fcn.004029f8
lea ecx, [ebp - 0x10]
call fcn.004029f8
lea ecx, [ebp + 0x38]
call fcn.004029f8
lea ecx, [ebp + 0x44]
call fcn.004029f8
lea ecx, [ebp - 4]
call fcn.004029f8
lea ecx, [ebp - 0x70]
call fcn.004029f8
lea ecx, [ebp - 0x28]
call fcn.004029f8
lea ecx, [ebp - 0x2c]
call fcn.004029f8
lea ecx, [ebp - 0x7c]
call fcn.0042602e
lea ecx, [ebp - 0xd8]
call fcn.0042602e
lea ecx, [ebp - 0x58]
call fcn.0042602e
lea ecx, [ebp - 0x78]
call fcn.0042602e
lea ecx, [ebp - 0x88]
call fcn.0042602e
lea ecx, [ebp - 0x5c]
call fcn.0042602e
lea ecx, [ebp - 0x64]
call fcn.0042602e
lea ecx, [ebp - 0x4c]
call fcn.0042602e
lea ecx, [ebp - 0x24]
call fcn.004029f8
lea ecx, [ebp - 0x90]
call fcn.004029f8
lea ecx, [ebp - 0x50]
call fcn.0042602e
lea ecx, [ebp - 0x8c]
call fcn.0042602e
lea ecx, [ebp - 0x3c]
call fcn.0042602e
lea ecx, [ebp - 0x48]
call fcn.0042602e
lea ecx, [ebp - 0x14]
call fcn.0042602e
lea ecx, [ebp - 0x98]
call fcn.0042602e
lea ecx, [ebp - 0x68]
call fcn.0042602e
lea ecx, [ebp - 0x80]
call fcn.0042602e
lea ecx, [ebp - 0x84]
call fcn.0042602e
pop edi
pop esi
mov eax, ebx
pop ebx
add ebp, 0x60
leave
ret 0x18