Function at 0x48aca4
Capabilities:
Copy file
Create process on windows
Delete file
Move file
Self delete
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x3b
push 0
push 0
dec ecx
jne 0x48acac
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x51]
mov edx, dword [0x470704]
call fcn.0040447c
xor eax, eax
push ebp
push 0x48c3e3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov al, byte [ebx + 0xc]
add eax, 0xffffff91
cmp eax, 0x3c
ja case.0x48ace9.112
jmp dword [eax*4 + 0x48acf0]
cmp byte [0x498b30], 0
je 0x48ae22
test esi, esi
jne 0x48ae22
push 0x48c3fc
lea edx, [ebp - 0x1a4]
mov eax, dword [0x49904c]
mov eax, dword [eax]
call fcn.0042eeb8
push dword [ebp - 0x1a4]
push 0x48c408
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403ed0
jmp 0x48ae51
push 0x48c3fc
lea edx, [ebp - 0x1a8]
mov eax, dword [0x49904c]
mov eax, dword [eax]
call fcn.0042eeb8
push dword [ebp - 0x1a8]
push 0x48c418
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403ed0
mov esi, dword [ebx + 0x10]
test esi, esi
jne 0x48ae7e
mov ecx, dword [ebp - 0x1c]
mov edx, 0x48c428
mov eax, 0x48c43c
call fcn.004710a0
mov edx, 0x48c428
mov eax, 0x48c488
call fcn.0047191c
jmp case.0x48ace9.112
cmp esi, 1
jne 0x48aea9
mov eax, 0x48c488
mov edx, 0x48c428
mov ecx, dword [ebp - 0x1c]
call fcn.004710a0
mov eax, 0x48c43c
mov edx, 0x48c428
call fcn.0047191c
jmp case.0x48ace9.112
cmp esi, 2
jne case.0x48ace9.112
mov eax, 0x48c43c
mov edx, 0x48c428
call fcn.0047191c
mov eax, 0x48c488
mov edx, 0x48c428
call fcn.0047191c
jmp case.0x48ace9.112
mov edx, dword [ebx + 0x10]
mov eax, dword [0x49d0bd]
cmp edx, eax
jne case.0x48ace9.112
mov edx, dword [0x498ad0]
mov dword [0x498c38], edx
mov edx, dword [0x498ad4]
mov dword [0x498c3c], edx
cmp byte [0x498c64], 0
jne case.0x48ace9.112
xor edx, edx
push ebp
push 0x48af6d
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [0x498c64], 1
cmp byte [0x49d0b0], 0
je 0x48af43
mov byte [0x49d0c9], 0
mov eax, dword [ebx + 0x14]
mov dword [0x49d1a4], eax
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0048a98c
jmp 0x48af58
push 0
push 0
push 0
mov ecx, eax
mov edx, 0x76
mov eax, dword [ebp - 4]
call fcn.00489fc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x48ace9.112
mov byte [0x498c64], 0
ret
test byte [ebx + 0x10], 0xff
jne 0x48af97
push 0x22b8
mov eax, dword [0x498f6c]
mov eax, dword [eax]
mov ecx, 0x48c4d8
mov edx, 0x634
call fcn.00487770
jmp 0x48afb6
push 0x501
mov ecx, dword [0x4990f0]
mov ecx, dword [ecx]
mov edx, dword [0x498e6c]
mov eax, dword [0x498e50]
mov eax, dword [eax]
call fcn.00487068
mov eax, dword [ebx + 0x10]
shr eax, 8
mov byte [0x49d188], al
mov eax, 0x49d0cf
call fcn.00403b90
mov eax, dword [ebx + 0x18]
shr eax, 0x10
mov dword [0x49d038], eax
mov eax, dword [ebx + 0x18]
and eax, 0xffff
mov dword [0x49d03c], eax
jmp case.0x48ace9.112
mov eax, dword [0x498f6c]
mov eax, dword [eax]
call fcn.004878f4
mov edx, dword [0x498e6c]
mov eax, dword [0x498e50]
mov eax, dword [eax]
call fcn.00487164
cmp dword [0x49d0a8], 0
je case.0x48ace9.112
mov al, byte [0x49d0a4]
call fcn.00484558
jmp case.0x48ace9.112
mov eax, dword [0x498ad0]
mov dword [0x498c38], eax
mov eax, dword [0x498ad4]
mov dword [0x498c3c], eax
mov eax, dword [ebx + 0x10]
mov dword [0x49d134], eax
mov eax, dword [ebx + 0x14]
mov dword [0x49d138], eax
push 0
push 0
push 0x502
mov eax, dword [ebp - 4]
call fcn.004431bc
push eax
call sub.user32.dll_PostMessageA
jmp case.0x48ace9.112
mov eax, dword [0x498ad0]
mov dword [0x498c38], eax
mov eax, dword [0x498ad4]
mov dword [0x498c3c], eax
push 0
push 0
push 0x505
mov eax, dword [ebp - 4]
call fcn.004431bc
push eax
call sub.user32.dll_PostMessageA
jmp case.0x48ace9.112
mov eax, dword [0x498ad0]
mov dword [0x498c38], eax
mov eax, dword [0x498ad4]
mov dword [0x498c3c], eax
push 0
push 0
push 0x503
mov eax, dword [ebp - 4]
call fcn.004431bc
push eax
call sub.user32.dll_PostMessageA
jmp case.0x48ace9.112
mov eax, dword [0x498ad0]
mov dword [0x498c38], eax
mov eax, dword [0x498ad4]
mov dword [0x498c3c], eax
lea eax, [ebp - 0x20]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dc0
mov eax, dword [ebp - 0x20]
call fcn.0048e3f0
jmp case.0x48ace9.112
mov eax, dword [0x498ad0]
mov dword [0x498c38], eax
mov eax, dword [0x498ad4]
mov dword [0x498c3c], eax
call fcn.0048ac74
jmp case.0x48ace9.112
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
call fcn.0046e704
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0048f4ec
jmp case.0x48ace9.112
mov eax, dword [0x498f60]
mov byte [eax], 1
mov eax, dword [0x4991e0]
mov dl, byte [0x48c4e4]
cmp dl, byte [eax]
je 0x48b16a
xor ecx, ecx
mov dl, byte [0x48c4e8]
xor eax, eax
call fcn.00486a88
cmp dword [0x49bee8], 0x92e04
jg case.0x48ace9.112
mov eax, dword [0x4990fc]
mov eax, dword [eax]
call fcn.0042b818
jmp case.0x48ace9.112
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
call fcn.0046e704
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0048f4ec
mov edx, dword [ebx + 0x10]
xor eax, eax
call fcn.00488a78
jmp case.0x48ace9.112
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
call fcn.0046e704
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0048f4ec
mov edx, dword [ebx + 0x10]
mov ax, 2
call fcn.00488a78
jmp case.0x48ace9.112
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
call fcn.0046e704
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0048f4ec
mov eax, dword [0x499238]
cmp dword [eax], 2
jne 0x48b214
mov edx, dword [ebx + 0x10]
mov ax, 8
call fcn.00488a78
jmp case.0x48ace9.112
mov edx, dword [ebx + 0x10]
mov ax, 1
call fcn.00488a78
jmp case.0x48ace9.112
cmp byte [0x498b28], 2
je case.0x48ace9.112
cmp byte [0x49d0ce], 3
jne case.0x48ace9.112
cmp byte [0x49d0b0], 0
jne case.0x48ace9.112
xor edx, edx
mov eax, dword [0x49d0b1]
call fcn.00410a50
mov dword [ebp - 0x49], 0
mov dword [ebp - 0x45], 0
lea edx, [ebp - 0x4d]
mov ecx, 4
mov eax, dword [0x49d0b1]
mov ebx, dword [eax]
call dword [ebx + 4]
lea edx, [ebp - 0x49]
mov ecx, 4
mov eax, dword [0x49d0b1]
mov ebx, dword [eax]
call dword [ebx + 4]
lea edx, [ebp - 0x41]
mov ecx, 4
mov eax, dword [0x49d0b1]
mov ebx, dword [eax]
call dword [ebx + 4]
lea edx, [ebp - 0x1b0]
mov eax, dword [0x49904c]
mov eax, dword [eax]
call fcn.0042eeb8
mov eax, dword [ebp - 0x1b0]
lea edx, [ebp - 0x1ac]
call fcn.004709d8
mov edx, dword [ebp - 0x1ac]
lea eax, [ebp - 8]
mov ecx, 0x48c4f4
call fcn.00403e5c
mov edx, 0x20
mov eax, dword [ebp - 8]
call fcn.00408d00
mov dx, 0xffff
mov eax, dword [ebp - 8]
call fcn.00470fd8
mov ebx, eax
test ebx, ebx
je case.0x48ace9.112
mov ecx, dword [ebp - 0x49]
mov edx, dword [0x49d0b1]
mov eax, ebx
call fcn.00410b04
mov eax, ebx
call fcn.00402e84
mov edx, dword [ebp - 0x41]
mov eax, dword [ebp - 8]
call fcn.00470b98
mov eax, dword [0x49d0bd]
and eax, 0xff000000
cmp eax, 0x70000000
jb 0x48b335
mov edx, dword [ebp - 0x4d]
mov eax, dword [ebp - 8]
call fcn.00408d00
jmp 0x48b342
mov edx, 0x20
mov eax, dword [ebp - 8]
call fcn.00408d00
lea edx, [ebp - 0x4d]
mov ecx, 4
mov eax, dword [0x49d0b1]
mov ebx, dword [eax]
call dword [ebx + 4]
lea edx, [ebp - 0x49]
mov ecx, 4
mov eax, dword [0x49d0b1]
mov ebx, dword [eax]
call dword [ebx + 4]
lea edx, [ebp - 0x41]
mov ecx, 4
mov eax, dword [0x49d0b1]
mov ebx, dword [eax]
call dword [ebx + 4]
mov edx, 0x20
mov eax, dword [0x49d058]
call fcn.00408d00
mov dx, 0xffff
mov eax, dword [0x49d058]
call fcn.00470fd8
mov ebx, eax
test ebx, ebx
je case.0x48ace9.112
mov ecx, dword [ebp - 0x49]
mov edx, dword [0x49d0b1]
mov eax, ebx
call fcn.00410b04
mov eax, ebx
call fcn.00402e84
mov edx, dword [ebp - 0x41]
mov eax, dword [0x49d058]
call fcn.00470b98
cmp byte [0x498ab4], 0
je 0x48b3d9
cmp byte [0x498ab8], 0
jne 0x48b592
lea edx, [ebp - 0x4d]
mov ecx, 4
mov eax, dword [0x49d0b1]
mov ebx, dword [eax]
call dword [ebx + 4]
cmp eax, 4
jne 0x48b592
lea edx, [ebp - 0x49]
mov ecx, 4
mov eax, dword [0x49d0b1]
mov ebx, dword [eax]
call dword [ebx + 4]
lea edx, [ebp - 0x41]
mov ecx, 4
mov eax, dword [0x49d0b1]
mov ebx, dword [eax]
call dword [ebx + 4]
cmp dword [0x498b34], 0
je 0x48b42b
mov eax, dword [0x498b34]
call fcn.00402e84
xor eax, eax
mov dword [0x498b34], eax
mov edx, 0x20
mov eax, dword [0x49d048]
call fcn.00408d00
mov dx, 0xffff
mov eax, dword [0x49d048]
call fcn.00470fd8
mov ebx, eax
test ebx, ebx
je 0x48b4aa
mov ecx, dword [ebp - 0x49]
mov edx, dword [0x49d0b1]
mov eax, ebx
call fcn.00410b04
mov eax, ebx
call fcn.00402e84
mov edx, dword [ebp - 0x41]
mov eax, dword [0x49d048]
call fcn.00470b98
mov eax, dword [0x49d0bd]
and eax, 0xff000000
cmp eax, 0x70000000
jb 0x48b499
mov edx, dword [ebp - 0x4d]
mov eax, dword [0x49d048]
call fcn.00408d00
jmp 0x48b4c3
mov edx, 0x20
mov eax, dword [0x49d048]
call fcn.00408d00
jmp 0x48b4c3
mov ebx, dword [0x49d0b1]
mov eax, ebx
call fcn.00410a40
mov edx, eax
add edx, dword [ebp - 0x49]
mov eax, ebx
call fcn.00410a50
lea edx, [ebp - 0x4d]
mov ecx, 4
mov eax, dword [0x49d0b1]
mov ebx, dword [eax]
call dword [ebx + 4]
cmp eax, 4
jne 0x48b592
lea edx, [ebp - 0x49]
mov ecx, 4
mov eax, dword [0x49d0b1]
mov ebx, dword [eax]
call dword [ebx + 4]
lea edx, [ebp - 0x41]
mov ecx, 4
mov eax, dword [0x49d0b1]
mov ebx, dword [eax]
call dword [ebx + 4]
cmp dword [0x498b38], 0
je 0x48b515
mov eax, dword [0x498b38]
call fcn.00402e84
xor eax, eax
mov dword [0x498b38], eax
mov edx, 0x20
mov eax, dword [0x49d04c]
call fcn.00408d00
mov dx, 0xffff
mov eax, dword [0x49d04c]
call fcn.00470fd8
mov ebx, eax
test ebx, ebx
je 0x48b592
mov ecx, dword [ebp - 0x49]
mov edx, dword [0x49d0b1]
mov eax, ebx
call fcn.00410b04
mov eax, ebx
call fcn.00402e84
mov edx, dword [ebp - 0x41]
mov eax, dword [0x49d04c]
call fcn.00470b98
mov eax, dword [0x49d0bd]
and eax, 0xff000000
cmp eax, 0x70000000
jb 0x48b583
mov edx, dword [ebp - 0x4d]
mov eax, dword [0x49d04c]
call fcn.00408d00
jmp 0x48b592
mov edx, 0x20
mov eax, dword [0x49d04c]
call fcn.00408d00
mov eax, dword [0x498f60]
mov byte [eax], 1
mov eax, dword [0x4991e0]
mov dl, byte [0x48c4e4]
cmp dl, byte [eax]
je 0x48b5b8
mov dl, byte [0x48c4e8]
xor ecx, ecx
xor eax, eax
call fcn.00486a88
push 1
mov eax, dword [0x49d058]
call fcn.00403fd4
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [0x4990fc]
mov eax, dword [eax]
call fcn.0042b818
jmp case.0x48ace9.112
lea eax, [ebp - 8]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dc0
mov eax, dword [ebp - 8]
call fcn.00403e10
mov esi, eax
inc esi
lea eax, [ebx + esi + 0x20]
lea edx, [ebp - 0xc]
call fcn.00409384
mov eax, dword [ebp - 0xc]
call fcn.00403e10
inc eax
add esi, eax
lea eax, [ebx + esi + 0x20]
lea edx, [ebp - 0x10]
call fcn.00409384
mov eax, dword [ebp - 8]
mov edx, 0x48c50c
call fcn.00403f20
jne 0x48b663
lea eax, [ebp - 0xc]
call fcn.00472660
lea eax, [ebp - 0x10]
call fcn.00472660
mov edx, 0x20
mov eax, dword [ebp - 0x10]
call fcn.00408d00
push 0
mov eax, dword [ebp - 0x10]
call fcn.00403fd4
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403fd4
push eax
call sub.kernel32.dll_CopyFileA
jmp case.0x48ace9.112
mov eax, dword [ebp - 8]
mov edx, 0x48c520
call fcn.00403f20
jne 0x48b73c
lea eax, [ebp - 0xc]
call fcn.00472660
lea eax, [ebp - 0x10]
call fcn.00472660
mov eax, dword [ebp - 0xc]
call fcn.00408c98
test al, al
je 0x48b6b2
mov edx, 0x20
mov eax, dword [ebp - 0xc]
call fcn.00408d00
mov eax, dword [ebp - 0xc]
call fcn.00403fd4
push eax
call sub.kernel32.dll_DeleteFileA
jmp case.0x48ace9.112
mov eax, dword [ebp - 0xc]
call fcn.004494c4
test al, al
je case.0x48ace9.112
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
add eax, 0x30
mov edx, dword [ebp - 0xc]
call fcn.00403be4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
mov byte [eax + 0x61], 1
mov byte [0x498c60], 1
xor eax, eax
push ebp
push 0x48b71b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
call fcn.00450cf8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b722
mov byte [0x498c60], 0
ret
mov eax, dword [ebp - 8]
mov edx, 0x48c534
call fcn.00403f20
jne 0x48b786
lea eax, [ebp - 0xc]
call fcn.00472660
lea eax, [ebp - 0x10]
call fcn.00472660
mov edx, 0x20
mov eax, dword [ebp - 0x10]
call fcn.00408d00
push 3
mov eax, dword [ebp - 0x10]
call fcn.00403fd4
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403fd4
push eax
call sub.kernel32.dll_MoveFileExA
jmp case.0x48ace9.112
mov eax, dword [ebp - 8]
mov edx, 0x48c548
call fcn.00403f20
jne 0x48b7ce
mov eax, dword [0x49d040]
call fcn.00408c98
test al, al
je case.0x48ace9.112
mov cl, 1
mov dl, 1
mov eax, dword [0x482248]
call fcn.00482460
mov ebx, eax
lea eax, [ebx + 0x30]
mov edx, dword [ebp - 0xc]
call fcn.00403be4
mov eax, ebx
call fcn.00413dfc
jmp case.0x48ace9.112
lea eax, [ebp - 0x10]
call fcn.00472660
lea eax, [ebp - 8]
call fcn.00472660
push 1
mov eax, dword [ebp - 0x10]
call fcn.00403fd4
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403fd4
push eax
mov eax, dword [ebp - 8]
call fcn.00403fd4
push eax
push 0x48c554
mov eax, dword [ebp - 4]
call fcn.004431bc
push eax
call sub.shell32.dll_ShellExecuteA
jmp case.0x48ace9.112
xor eax, eax
mov al, byte [0x498b24]
cmp eax, dword [ebx + 0x10]
je case.0x48ace9.112
mov al, byte [ebx + 0x10]
mov byte [0x498b24], al
xor ecx, ecx
mov cl, byte [0x498b24]
mov edx, 0x48c564
mov eax, 0x48c578
call fcn.004714dc
call fcn.0048f0c0
jmp case.0x48ace9.112
cmp dword [0x49bee8], 0x92e04
jg case.0x48ace9.112
xor esi, esi
mov eax, dword [ebx + 0x14]
test ah, 1
je 0x48b86b
mov esi, 1
test eax, 0x80000000
je 0x48b875
or esi, 2
push 0
push esi
shr eax, 8
push eax
mov al, byte [ebx + 0x10]
push eax
call sub.user32.dll_keybd_event
jmp case.0x48ace9.112
mov esi, 0x8000
lea eax, [ebx + 0x20]
mov dword [0x49d1a8], eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x200
jg 0x48b8f3
je 0x48b94e
cmp eax, 0xa4
jg 0x48b8db
je 0x48b96c
sub eax, 0x84
je 0x48b953
sub eax, 0x1c
je 0x48b976
dec eax
je 0x48b958
dec eax
je 0x48b95d
jmp case.0x48b901.515
sub eax, 0xa5
je 0x48b971
sub eax, 2
je 0x48b962
dec eax
je 0x48b967
jmp case.0x48b901.515
add eax, 0xfffffdff
cmp eax, 9
ja case.0x48b901.515
jmp dword [eax*4 + 0x48b908]
or esi, 2
jmp case.0x48b901.515
or esi, 4
jmp case.0x48b901.515
or esi, 0x20
jmp case.0x48b901.515
or esi, 0x40
jmp case.0x48b901.515
or esi, 8
jmp case.0x48b901.515
or esi, 0x10
jmp case.0x48b901.515
or esi, 1
jmp case.0x48b901.515
or esi, 1
jmp case.0x48b901.515
or esi, 2
jmp case.0x48b901.515
or esi, 4
jmp case.0x48b901.515
or esi, 0x20
jmp case.0x48b901.515
or esi, 0x40
jmp case.0x48b901.515
or esi, 8
jmp case.0x48b901.515
or esi, 0x10
jmp case.0x48b901.515
or esi, 1
jmp case.0x48b901.515
or esi, 0x800
mov eax, dword [0x499218]
mov eax, dword [eax]
call fcn.0042c880
dec eax
push eax
mov eax, dword [0x49d1a8]
mov eax, dword [eax]
mov edx, eax
shl eax, 0x10
sub eax, edx
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, eax
mov eax, dword [0x499218]
mov eax, dword [eax]
call fcn.0042c874
dec eax
push eax
mov eax, dword [0x49d1a8]
mov eax, dword [eax + 4]
mov edx, eax
shl eax, 0x10
sub eax, edx
pop edx
mov ecx, edx
cdq
idiv ecx
mov dword [ebp - 0x18], eax
cmp edi, 0x10000
jge case.0x48ace9.112
cmp dword [ebp - 0x18], 0x10000
jge case.0x48ace9.112
mov eax, dword [ebx + 0x10]
cmp eax, 0x20a
jne 0x48b9fc
mov edx, dword [0x49d1a8]
mov edx, dword [edx + 0x10]
mov dword [ebp - 0x14], edx
jmp 0x48ba01
xor edx, edx
mov dword [ebp - 0x14], edx
cmp eax, 0x200
je 0x48ba1f
push 0
push 0
mov eax, dword [ebp - 0x18]
inc eax
push eax
lea eax, [edi + 1]
push eax
push 0x8001
call sub.user32.dll_mouse_event
push 0
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
inc eax
push eax
inc edi
push edi
push esi
call sub.user32.dll_mouse_event
jmp case.0x48ace9.112
lea eax, [ebp - 0xed]
push eax
push 0
push 0
call sub.user32.dll_EnumDisplaySettingsA
mov dword [ebp - 0xc5], 0x1c0000
mov eax, dword [ebx + 0x10]
mov edx, eax
shr edx, 0x10
mov dword [ebp - 0x81], edx
and eax, 0xffff
mov dword [ebp - 0x7d], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x85], eax
push 0
lea eax, [ebp - 0xed]
push eax
call sub.user32.dll_ChangeDisplaySettingsA
jmp case.0x48ace9.112
cmp dword [0x498b08], 0x301032b
jb case.0x48ace9.112
mov dl, 1
mov eax, dword [0x4163cc]
call fcn.0041c7dc
mov dword [0x49d118], eax
mov byte [0x498b9c], 0xff
mov eax, dword [ebx + 0x10]
neg al
sbb eax, eax
mov byte [0x498ba0], al
mov dl, byte [ebx + 0x14]
and dl, 0xff
mov eax, dword [0x49d118]
call fcn.0041dc08
xor eax, eax
mov dword [0x498ba4], eax
mov dl, 1
mov eax, dword [0x40df84]
call fcn.00402e54
mov dword [0x49d11c], eax
mov dword [0x49d120], 0
mov dword [0x49d124], 0
jmp case.0x48ace9.112
cmp byte [0x498b9c], 0
je case.0x48ace9.112
mov byte [0x498b9c], 0
mov eax, dword [0x49d118]
call fcn.00402e84
jmp case.0x48ace9.112
cmp dword [ebx + 0x10], 0
je 0x48bb4c
lea eax, [ebp - 0x1b4]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dc0
mov ecx, dword [ebp - 0x1b4]
mov dl, byte [0x48c5a8]
mov al, 1
call fcn.00486a88
jmp case.0x48ace9.112
mov eax, dword [0x4991e0]
test byte [eax], 0x20
je 0x48bb5d
mov byte [0x498b84], 1
mov dl, byte [0x48c4e8]
xor ecx, ecx
xor eax, eax
call fcn.00486a88
jmp case.0x48ace9.112
mov edx, dword [ebx + 0x10]
xor dl, 1
mov eax, dword [0x4990fc]
mov eax, dword [eax]
mov eax, dword [eax + 0x2e8]
call fcn.00435580
jmp case.0x48ace9.112
push 0
push 0
push 0x913
mov eax, dword [ebp - 4]
call fcn.004431bc
push eax
call sub.user32.dll_PostMessageA
jmp case.0x48ace9.112
lea eax, [ebp - 0x1bc]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dc0
mov eax, dword [ebp - 0x1bc]
lea edx, [ebp - 0x1b8]
call fcn.004086dc
mov edx, dword [ebp - 0x1b8]
mov eax, 0x49d1ac
call fcn.00403be4
push 0
xor eax, eax
mov al, byte [ebx + 0xc]
push eax
push 0x916
mov eax, dword [ebp - 4]
call fcn.004431bc
push eax
call sub.user32.dll_PostMessageA
jmp case.0x48ace9.112
lea eax, [ebp - 0x28]
call fcn.00403b90
cmp byte [ebx + 0xc], 0x9f
jne 0x48bc22
cmp dword [ebx + 4], 0x20
jle 0x48bc22
lea eax, [ebp - 0x28]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dc0
mov eax, dword [ebx + 0x10]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
test eax, eax
je 0x48bc46
cmp eax, 0xffffffff
je 0x48bc46
push 0x1111
push eax
call sub.kernel32.dll_TerminateProcess
push 0x258
call sub.kernel32.dll_Sleep
cmp dword [ebp - 0x28], 0
je 0x48bc74
push 0x20
lea eax, [ebp - 0x28]
call fcn.00403fe0
push eax
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x28]
call fcn.00403fe0
push eax
call sub.kernel32.dll_DeleteFileA
push 0
push 0
push 0x913
mov eax, dword [ebp - 4]
call fcn.004431bc
push eax
call sub.user32.dll_PostMessageA
jmp case.0x48ace9.112
mov eax, dword [ebp - 4]
call fcn.0048a0ec
jmp case.0x48ace9.112
lea edx, [ebp - 0x1c0]
lea eax, [ebx + 0x20]
call fcn.00409384
mov edx, dword [ebp - 0x1c0]
mov eax, dword [0x498e14]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
cmp byte [0x498b28], 2
je case.0x48ace9.112
mov eax, dword [0x49d07c]
call fcn.00408c98
test al, al
je 0x48bcef
mov edx, 0x20
mov eax, dword [0x49d07c]
call fcn.00408d00
test eax, eax
jne case.0x48ace9.112
mov eax, dword [0x498e14]
mov eax, dword [eax]
mov edx, dword [0x49d07c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov edx, 0x22
mov eax, dword [0x49d07c]
call fcn.00408d00
jmp case.0x48ace9.112
lea edx, [ebp - 0x24]
lea eax, [ebx + 0x20]
call fcn.00409384
lea eax, [ebp - 0x24]
call fcn.00403fe0
push eax
call fcn.0042398c
pop edx
call fcn.00423634
push 0
push 0
push 0
push 0x11
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x11
call sub.user32.dll_keybd_event
jmp case.0x48ace9.112
mov byte [0x498b3c], 2
mov eax, 0x48c578
mov ecx, 0x400
mov edx, 0x48c5b4
call fcn.004714dc
call fcn.00488ca8
call fcn.00488bd8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
call fcn.0046e704
jmp case.0x48ace9.112
mov ecx, 0x48c5c8
mov dl, byte [0x48c5cc]
mov al, 1
call fcn.00486a88
jmp case.0x48ace9.112
cmp byte [0x498c44], 0
jne case.0x48ace9.112
mov eax, dword [ebx + 0x10]
cmp eax, dword [0x49d020]
je case.0x48ace9.112
mov eax, dword [0x49d190]
call fcn.004930e4
jmp case.0x48ace9.112
mov eax, dword [ebx + 0x10]
push eax
push 0xf170
push 0x112
mov eax, dword [ebp - 4]
call fcn.004431bc
push eax
call sub.user32.dll_SendMessageA
jmp case.0x48ace9.112
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
test ebx, ebx
je case.0x48ace9.112
push 0
lea eax, [ebp - 0x120]
push eax
push 0
push 0x30
call sub.user32.dll_SystemParametersInfoA
lea eax, [ebp - 0x100]
push eax
push ebx
call sub.user32.dll_GetWindowRect
mov eax, dword [ebp - 0x118]
mov esi, dword [ebp - 0x120]
sub eax, esi
mov edx, dword [ebp - 0xf8]
sub edx, dword [ebp - 0x100]
cmp eax, edx
jle case.0x48ace9.112
sub eax, edx
sar eax, 1
jns 0x48be61
adc eax, 0
add eax, esi
mov dword [ebp - 0x110], eax
mov edx, dword [ebp - 0x114]
mov eax, dword [ebp - 0x11c]
sub edx, eax
mov ecx, dword [ebp - 0xf4]
sub ecx, dword [ebp - 0xfc]
sub edx, ecx
sar edx, 1
jns 0x48be8c
adc edx, 0
add edx, eax
mov dword [ebp - 0x10c], edx
push 1
push 0
push 0
push edx
mov eax, dword [ebp - 0x110]
push eax
push 0
push ebx
call sub.user32.dll_SetWindowPos
jmp case.0x48ace9.112
call fcn.00484248
test eax, eax
je case.0x48ace9.112
lea eax, [ebp - 0x1c4]
call fcn.004729a4
mov eax, dword [ebp - 0x1c4]
call fcn.00403fd4
push eax
lea eax, [ebx + 0x20]
push eax
call sub.SEBarVD.DLL_Install4DosChar
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x48bf4f
lea eax, [ebp - 0x1c8]
mov ecx, 0x48c5d8
mov edx, dword [0x49d01c]
call fcn.00403e5c
mov eax, dword [ebp - 0x1c8]
call fcn.00408c98
test al, al
je 0x48bf4f
lea eax, [ebp - 0x1cc]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dc0
mov ecx, dword [ebp - 0x1cc]
mov eax, 0x48c578
mov edx, 0x48c600
call fcn.004710a0
push 0
push 1
push 0
mov ecx, 0x3ab9
mov edx, 0xa6
mov eax, dword [ebp - 4]
call fcn.00489fc8
jmp case.0x48ace9.112
push 0
push 1
push 0
mov ecx, 0x3aba
mov edx, 0xa6
mov eax, dword [ebp - 4]
call fcn.00489fc8
jmp case.0x48ace9.112
cmp byte [0x498c68], 0
jne case.0x48ace9.112
call fcn.00484368
test eax, eax
jne case.0x48ace9.112
call sub.SEBarVD.DLL_UnInstallDriver
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x48bfed
mov eax, dword [0x498f30]
cmp byte [eax], 0
je 0x48bfc1
mov eax, dword [0x498f30]
mov al, byte [eax]
call fcn.00484264
test eax, eax
jne 0x48bfc1
mov eax, dword [0x498f30]
mov al, byte [eax]
xor ecx, ecx
mov edx, 2
call fcn.0048471c
mov eax, 0x48c578
mov edx, 0x48c600
call fcn.0047191c
push 0
push 1
push 0
mov ecx, 0x3abb
mov edx, 0xa6
mov eax, dword [ebp - 4]
call fcn.00489fc8
jmp case.0x48ace9.112
push 0
push 1
push 0
mov ecx, 0x3abc
mov edx, 0xa6
mov eax, dword [ebp - 4]
call fcn.00489fc8
jmp case.0x48ace9.112
call fcn.00484248
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x48c0d8
cmp byte [0x498c68], 0
jne 0x48c0d8
xor eax, eax
push ebp
push 0x48c0d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x498c68], 1
call fcn.00484368
test eax, eax
jne 0x48c0bc
push 0x7f
lea eax, [ebp - 0x1a0]
push eax
call sub.SEBarVD.DLL_GetProtectedDrives
test eax, eax
jne 0x48c093
lea eax, [ebp - 0x30]
lea edx, [ebp - 0x1a0]
mov ecx, 0x80
call fcn.00403dc0
mov ebx, 2
jmp 0x48c085
lea edx, [ebp - 0x30]
mov ecx, ebx
mov eax, 0x48c5c8
call fcn.004040a0
add ebx, 2
mov eax, dword [ebp - 0x30]
call fcn.00403e10
cmp ebx, eax
jle 0x48c073
jmp 0x48c0a0
lea eax, [ebp - 0x30]
mov edx, 0x48c610
call fcn.00403c28
mov eax, dword [0x498df0]
push dword [eax]
push 0x48c61c
push dword [ebp - 0x30]
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.00403ed0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c0d8
mov byte [0x498c68], 0
ret
push 0
push 0
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, 0xa6
mov eax, dword [ebp - 4]
call fcn.00489fc8
jmp case.0x48ace9.112
cmp byte [0x498c68], 0
jne case.0x48ace9.112
call fcn.00484368
test eax, eax
jne case.0x48ace9.112
mov dword [ebp - 0x34], 1
lea eax, [ebp - 0x30]
lea edx, [ebx + 0x20]
mov ecx, 0x400
call fcn.00403dc0
mov eax, dword [ebp - 0x30]
call fcn.00403e10
dec eax
jne 0x48c1c0
mov eax, dword [ebp - 0x30]
mov bl, byte [eax]
mov eax, dword [0x49903c]
cmp bl, byte [eax]
je 0x48c1c0
mov eax, dword [0x498f30]
cmp bl, byte [eax]
je 0x48c1c0
mov eax, ebx
call fcn.0048ab64
test al, al
jne 0x48c1c0
cmp byte [0x498c68], 0
jne 0x48c1c0
xor eax, eax
push ebp
push 0x48c1b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x498c68], 1
mov eax, dword [ebp - 0x30]
mov al, byte [eax]
call fcn.004029f4
call fcn.00484264
test eax, eax
jne 0x48c1a4
mov eax, dword [ebp - 0x30]
mov al, byte [eax]
call fcn.004029f4
mov ecx, 1
mov edx, 1
call fcn.0048471c
mov dword [ebp - 0x34], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c1c0
mov byte [0x498c68], 0
ret
push 0
push 0
push 0
mov ecx, dword [ebp - 0x34]
mov edx, 0xb1
mov eax, dword [ebp - 4]
call fcn.0048a07c
jmp case.0x48ace9.112
mov eax, 0x48c578
lea ecx, [ebp - 0x30]
mov edx, 0x48c600
call fcn.004712c4
cmp dword [ebp - 0x30], 0
je 0x48c29a
mov dword [ebp - 0x34], 1
lea eax, [ebp - 0x1d0]
mov dl, byte [ebx + 0x20]
call fcn.00403d38
mov eax, dword [ebp - 0x1d0]
mov edx, dword [ebp - 0x30]
call fcn.004040fc
test eax, eax
jle 0x48c290
cmp byte [ebx + 0x21], 0
jne 0x48c290
cmp byte [0x498c68], 0
jne 0x48c290
xor eax, eax
push ebp
push 0x48c289
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x498c68], 1
call fcn.00484368
test eax, eax
jne 0x48c274
push 1
lea eax, [ebp - 0x1d4]
call fcn.004729a4
mov eax, dword [ebp - 0x1d4]
call fcn.00403fd4
push eax
push 0
push 1
lea eax, [ebx + 0x20]
push eax
call sub.SEBarVD.DLL_SetProtectAreaForDosChar
mov dword [ebp - 0x34], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c290
mov byte [0x498c68], 0
ret
cmp dword [ebp - 0x34], 0
je 0x48c029
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xb2
mov eax, dword [ebp - 4]
call fcn.0048a07c
jmp case.0x48ace9.112
mov eax, 0x48c578
lea ecx, [ebp - 0x30]
mov edx, 0x48c600
call fcn.004712c4
lea eax, [ebp - 0x30]
call fcn.0048ac20
cmp dword [ebp - 0x30], 0
je 0x48c380
mov dword [ebp - 0x34], 1
lea eax, [ebp - 0x1d8]
mov dl, byte [ebx + 0x20]
call fcn.00403d38
mov eax, dword [ebp - 0x1d8]
mov edx, dword [ebp - 0x30]
call fcn.004040fc
test eax, eax
jle 0x48c376
cmp byte [ebx + 0x21], 0
jne 0x48c376
cmp byte [0x498c68], 0
jne 0x48c376
xor eax, eax
push ebp
push 0x48c36f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x498c68], 1
call fcn.00484368
test eax, eax
jne 0x48c35a
push 1
lea eax, [ebp - 0x1dc]
call fcn.004729a4
mov eax, dword [ebp - 0x1dc]
call fcn.00403fd4
push eax
push 0
push 3
lea eax, [ebp - 0x30]
call fcn.00403fe0
push eax
call sub.SEBarVD.DLL_SetProtectAreaForDosChar
mov dword [ebp - 0x34], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c376
mov byte [0x498c68], 0
ret
cmp dword [ebp - 0x34], 0
je 0x48c029
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0xb2
mov eax, dword [ebp - 4]
call fcn.0048a07c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c3ea
lea eax, [ebp - 0x1dc]
mov edx, 0xf
call fcn.00403bb4
lea eax, [ebp - 0x51]
mov edx, dword [0x470704]
call fcn.00404548
lea eax, [ebp - 0x30]
call fcn.00403b90
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.00403bb4
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403bb4
ret