Function at 0x439a00
Capabilities:
Copy file
Create process on windows
Delete file
Download url
Enumerate gui resources
Get disk information
Receive data
Self delete
Set console window title
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x477cf7
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x460
mov eax, dword [0x497080]
xor eax, ebp
mov dword [ebp - 0x24], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add esp, 4
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
add esp, 4
lea eax, [ebp - 0x2d0]
push 0xb8
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push str.firstrun.txt
lea ecx, [ebp - 0x2d0]
call fcn.0043bab0
mov eax, dword [ebp - 0x2d0]
lea ecx, [ebp - 0x2d0]
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::good_void_const]
lea ecx, [ebp - 0x2d0]
mov byte [ebp - 0x2d1], al
call fcn.00439500
cmp byte [ebp - 0x2d1], 0
jne 0x439ba9
lea ecx, [ebp - 0x1d8]
call fcn.004395c0
push 0x104
lea eax, [ebp - 0x160]
mov dword [ebp - 4], 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
lea ecx, [ebp - 0x1d8]
call fcn.0043c450
push eax
lea eax, [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
call fcn.00439850
push ecx
lea ecx, [ebp - 0x2c8]
call fcn.004399e0
sub esp, 0xc
lea ecx, [ebp - 0x2c8]
push str.delete_old.bat
call fcn.0043aec0
lea eax, [ebp - 0x2c8]
mov byte [ebp - 4], 1
push str.timeout__t_5_n
push eax
call fcn.0043d1e0
add esp, 8
lea eax, [ebp - 0x160]
push 0x488ee0
push ecx
push eax
push ecx
lea eax, [ebp - 0x2c8]
push str.del__
push eax
call fcn.0043d1e0
add esp, 0xc
push eax
call fcn.0043d1e0
add esp, 0xc
push eax
call fcn.0043d1e0
add esp, 8
lea ecx, [ebp - 0x2c8]
call fcn.0043ae90
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
push 0
push 0
push str.delete_old.bat
push str.open
push 0
call esi
push 5
push 0
push 0
lea ecx, [ebp - 0x1d8]
call fcn.0043c450
push eax
push str.open
push 0
call esi
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push 0x19
xorps xmm0, xmm0
mov dword [ebp - 0x198], 0
push str.clqtomt4j002smx01m0k95xs2
lea ecx, [ebp - 0x1a8]
mov dword [ebp - 0x194], 0
movups xmmword [ebp - 0x1a8], xmm0
call fcn.0043e360
lea eax, [ebp - 0x1a8]
mov dword [ebp - 4], 2
push eax
call fcn.004582aa
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov ecx, dword [ebp - 0x194]
cmp ecx, 0xf
jbe 0x439c32
mov edx, dword [ebp - 0x1a8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x439c28
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x439c28
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00475d32
add esp, 8
push 0x488f08
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
xorps xmm0, xmm0
mov dword [ebp - 0x180], 0
movups xmmword [ebp - 0x190], xmm0
mov dword [ebp - 0x17c], 0xf
mov byte [ebp - 0x190], 0
push 0xfffffffffffffff5
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edi, eax
push 2
push edi
call esi
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x1fc]
movzx eax, word [ebp - 0x1fe]
push ecx
push eax
movzx eax, word [ebp - 0x200]
push eax
movzx eax, word [ebp - 0x208]
push eax
movzx eax, word [ebp - 0x206]
push eax
movzx eax, word [ebp - 0x202]
push eax
push str._n_02d__02d__04d__02d:_02d:_02d_n_n
call fcn.0042e420
add esp, 0x1c
push 7
push edi
call esi
push 0xe
xorps xmm0, xmm0
mov dword [ebp - 0x168], 0
push str.C:license.txt
lea ecx, [ebp - 0x178]
mov dword [ebp - 0x164], 0
movups xmmword [ebp - 0x178], xmm0
call fcn.0043e360
push 0xa
push ecx
mov byte [ebp - 4], 4
push str._n__________________________________________________________n______________________________________________________n_____________________________________________________n_________________________________________n_________________________________________n___________________________________________n_________________________________________________________n_______________________________n______________________________________________________n____________________________________________________________________________________________________________________n____________________________________________________________________________________________________________________n
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.0043d1e0
add esp, 0xc
push eax
call fcn.0043d3c0
add esp, 8
push 0x3e8
push 0x12c
call dword [sym.imp.KERNEL32.dll_Beep]
push 0xb8
lea eax, [ebp - 0x2d0]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
cmp dword [ebp - 0x164], 0xf
lea eax, [ebp - 0x178]
lea ecx, [ebp - 0x2d0]
cmova eax, dword [ebp - 0x178]
push eax
call fcn.0043bab0
mov eax, dword [ebp - 0x2d0]
lea ecx, [ebp - 0x2d0]
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::good_void_const]
lea ecx, [ebp - 0x2d0]
mov byte [ebp - 0x2d1], al
call fcn.00439500
cmp byte [ebp - 0x2d1], 0
je 0x439e9e
push 0xb8
lea eax, [ebp - 0x2d0]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
cmp dword [ebp - 0x164], 0xf
lea eax, [ebp - 0x178]
lea ecx, [ebp - 0x2d0]
cmova eax, dword [ebp - 0x178]
push eax
call fcn.0043bab0
mov eax, dword [ebp - 0x2d0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x2d0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x2d4], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2d0]
mov eax, dword [ebp - 0x2d0]
push 0xa
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_char___thiscall_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const]
movzx eax, al
push eax
lea eax, [ebp - 0x190]
push eax
lea eax, [ebp - 0x2d0]
push eax
call fcn.0043eef0
add esp, 0xc
lea ecx, [ebp - 0x2c0]
call fcn.0043cbd0
test eax, eax
jne 0x439e4d
mov eax, dword [ebp - 0x2d0]
lea ecx, [ebp - 0x2d0]
push 0
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push str.License_loaded_from_file:
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.0043d1e0
cmp dword [ebp - 0x17c], 0xf
lea ecx, [ebp - 0x190]
push dword [ebp - 0x180]
cmova ecx, dword [ebp - 0x190]
push ecx
push eax
call fcn.0043ed50
add esp, 0x14
mov ecx, eax
push 0x43d580
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
lea ecx, [ebp - 0x2d0]
call fcn.00439500
jmp 0x439f7d
push str.Enter_your_license:
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.0043d1e0
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea edx, [ebp - 0x190]
call fcn.0043d8d0
push 0xb0
lea eax, [ebp - 0x2c8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
cmp dword [ebp - 0x164], 0xf
lea eax, [ebp - 0x178]
lea ecx, [ebp - 0x2c8]
cmova eax, dword [ebp - 0x178]
add esp, 8
push eax
call fcn.0043aec0
mov eax, dword [ebp - 0x2c8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x2c8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x2cc], eax
mov byte [ebp - 4], 6
lea eax, [ebp - 0x190]
cmp dword [ebp - 0x17c], 0xf
push dword [ebp - 0x180]
cmova eax, dword [ebp - 0x190]
push eax
lea eax, [ebp - 0x2c8]
push eax
call fcn.0043ed50
add esp, 0xc
lea ecx, [ebp - 0x2c4]
call fcn.0043cbd0
test eax, eax
jne 0x439f72
mov eax, dword [ebp - 0x2c8]
lea ecx, [ebp - 0x2c8]
push 0
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x2c8]
call fcn.00439920
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
mov byte [ebp - 4], 7
push eax
push 0
push 0
push 0x4889b0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x43ae68
mov ecx, dword [ebp - 0x20c]
lea esi, [ebp - 0x3f]
mov dword [ebp - 0x2d8], ecx
mov eax, 0xcccccccd
dec esi
mul ecx
shr edx, 3
mov al, dl
mov cl, dl
shl al, 2
add cl, al
mov eax, dword [ebp - 0x2d8]
add cl, cl
sub al, cl
mov ecx, edx
add al, 0x30
mov byte [esi], al
mov eax, edx
mov dword [ebp - 0x2d8], eax
test eax, eax
jne 0x439fb6
lea eax, [ebp - 0x2d1]
push eax
lea eax, [ebp - 0x3f]
push eax
push esi
lea ecx, [ebp - 0x328]
call fcn.0043ec30
lea eax, [ebp - 0x328]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x190]
push eax
call fcn.004519c8
mov byte [ebp - 4], 7
add esp, 8
mov ecx, dword [ebp - 0x314]
cmp ecx, 0xf
jbe 0x43a057
mov edx, dword [ebp - 0x328]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43a04d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x43a04d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00475d32
add esp, 8
push str.Authenticated_successfully
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.0043d1e0
add esp, 8
mov ecx, eax
push 0x43d580
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 9
xorps xmm0, xmm0
mov dword [ebp - 0x2e0], 0
push str.expiresAt
lea ecx, [ebp - 0x2f0]
mov dword [ebp - 0x2dc], 0
movups xmmword [ebp - 0x2f0], xmm0
call fcn.0043e360
lea eax, [ebp - 0x2f0]
mov byte [ebp - 4], 9
push eax
call fcn.004449e2
mov byte [ebp - 4], 7
add esp, 4
mov ecx, dword [ebp - 0x2dc]
mov edi, eax
cmp ecx, 0xf
jbe 0x43a102
mov edx, dword [ebp - 0x2f0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43a0f8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x43a0f8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00475d32
add esp, 8
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
sub edi, eax
mov dword [ebp - 0x20c], edx
mov eax, 0xc22e4507
mov dword [ebp - 0x20c], edi
imul edi
mov ecx, edi
add esp, 4
add edx, edi
sar edx, 0x10
mov esi, edx
shr esi, 0x1f
add esi, edx
imul eax, esi, 0x15180
sub ecx, eax
mov eax, 0x91a2b3c5
imul ecx
mov eax, 0x91a2b3c5
add edx, ecx
mov ecx, dword [ebp - 0x20c]
sar edx, 0xb
mov edi, edx
shr edi, 0x1f
add edi, edx
imul ecx
add edx, ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0xe10
sub ecx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
jns 0x43a197
neg eax
push eax
lea eax, [ebp - 0x27]
push eax
call fcn.0043ebf0
add esp, 8
mov byte [eax - 1], 0x2d
dec eax
jmp 0x43a1a4
push eax
lea eax, [ebp - 0x27]
push eax
call fcn.0043ebf0
add esp, 8
lea ecx, [ebp - 0x2d1]
push ecx
lea ecx, [ebp - 0x27]
push ecx
push eax
lea ecx, [ebp - 0x1d8]
call fcn.0043ec30
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x3f]
test edi, edi
jns 0x43a1d9
neg edi
push edi
push eax
call fcn.0043ebf0
add esp, 8
mov byte [eax - 1], 0x2d
dec eax
jmp 0x43a1e3
push edi
push eax
call fcn.0043ebf0
add esp, 8
lea ecx, [ebp - 0x2d1]
push ecx
lea ecx, [ebp - 0x3f]
push ecx
push eax
lea ecx, [ebp - 0x348]
call fcn.0043ec30
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x27]
test esi, esi
jns 0x43a218
neg esi
push esi
push eax
call fcn.0043ebf0
add esp, 8
mov byte [eax - 1], 0x2d
dec eax
jmp 0x43a222
push esi
push eax
call fcn.0043ebf0
add esp, 8
lea ecx, [ebp - 0x2d1]
push ecx
lea ecx, [ebp - 0x27]
push ecx
push eax
lea ecx, [ebp - 0x308]
call fcn.0043ec30
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x2f4]
mov eax, ecx
mov edx, dword [ebp - 0x2f8]
sub eax, edx
cmp eax, 0x14
jb 0x43a2df
cmp ecx, 0xf
lea esi, [ebp - 0x308]
lea eax, [edx + 0x14]
cmova esi, dword [ebp - 0x308]
mov dword [ebp - 0x2f8], eax
cmp esi, 0x4892a8
jae 0x43a297
lea eax, [esi + edx]
cmp eax, 0x489294
jb 0x43a297
cmp esi, 0x489294
ja 0x43a28d
xor edi, edi
jmp 0x43a29c
mov edi, esi
sub edi, 0x489294
jmp 0x43a29c
mov edi, 0x14
lea eax, [edx + 1]
push eax
lea ecx, [esi + 0x14]
push esi
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
push edi
push 0x489294
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea ecx, [esi + edi]
mov eax, 0x14
sub eax, edi
push eax
lea eax, [edi + 0x4892a8]
push eax
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x308]
jmp 0x43a302
push 0x14
push 0x489294
push 0
mov byte [ebp - 0x20c], 0
lea ecx, [ebp - 0x308]
push dword [ebp - 0x20c]
push 0x14
call fcn.0043f2a0
mov dword [ebp - 0x2e0], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2f0], xmm0
mov dword [ebp - 0x2dc], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2f0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x2e0], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
push str._Day
lea eax, [ebp - 0x2f0]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x328]
push eax
call fcn.0043d700
add esp, 0xc
lea ecx, [ebp - 0x348]
mov byte [ebp - 4], 0xe
push ecx
push eax
push dword [ebp - 0x20c]
lea ecx, [ebp - 0x440]
call fcn.0043e7d0
push str._Hour
lea eax, [ebp - 0x440]
mov byte [ebp - 4], 0xf
push eax
lea eax, [ebp - 0x45c]
push eax
call fcn.0043d700
add esp, 0xc
lea ecx, [ebp - 0x1d8]
mov byte [ebp - 4], 0x10
push ecx
push eax
push dword [ebp - 0x20c]
lea ecx, [ebp - 0x428]
call fcn.0043e7d0
push str._Minute
lea eax, [ebp - 0x428]
mov byte [ebp - 4], 0x11
push eax
lea eax, [ebp - 0x1a8]
push eax
call fcn.0043d700
add esp, 0xc
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x414]
cmp ecx, 0xf
jbe 0x43a41d
mov edx, dword [ebp - 0x428]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43a413
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43a65f
push ecx
push edx
call fcn.00475d32
add esp, 8
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x414], 0xf
mov byte [ebp - 0x428], 0
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x448]
cmp ecx, 0xf
jbe 0x43a476
mov edx, dword [ebp - 0x45c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43a46c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43a65f
push ecx
push edx
call fcn.00475d32
add esp, 8
mov dword [ebp - 0x44c], 0
mov dword [ebp - 0x448], 0xf
mov byte [ebp - 0x45c], 0
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x42c]
cmp ecx, 0xf
jbe 0x43a4cf
mov edx, dword [ebp - 0x440]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43a4c5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43a65f
push ecx
push edx
call fcn.00475d32
add esp, 8
mov dword [ebp - 0x430], 0
mov dword [ebp - 0x42c], 0xf
mov byte [ebp - 0x440], 0
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x314]
cmp ecx, 0xf
jbe 0x43a528
mov edx, dword [ebp - 0x328]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43a51e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43a65f
push ecx
push edx
call fcn.00475d32
add esp, 8
mov dword [ebp - 0x318], 0
mov dword [ebp - 0x314], 0xf
mov byte [ebp - 0x328], 0
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x2dc]
cmp ecx, 0xf
jbe 0x43a581
mov edx, dword [ebp - 0x2f0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43a577
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43a65f
push ecx
push edx
call fcn.00475d32
add esp, 8
mov dword [ebp - 0x2e0], 0
mov dword [ebp - 0x2dc], 0xf
mov byte [ebp - 0x2f0], 0
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x2f4]
cmp ecx, 0xf
jbe 0x43a5da
mov edx, dword [ebp - 0x308]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43a5d0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43a65f
push ecx
push edx
call fcn.00475d32
add esp, 8
mov dword [ebp - 0x2f8], 0
mov dword [ebp - 0x2f4], 0xf
mov byte [ebp - 0x308], 0
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x334]
cmp ecx, 0xf
jbe 0x43a62f
mov edx, dword [ebp - 0x348]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43a625
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43a65f
push ecx
push edx
call fcn.00475d32
add esp, 8
mov byte [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x1c4]
cmp ecx, 0xf
jbe 0x43a66f
mov edx, dword [ebp - 0x1d8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43a665
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x43a665
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00475d32
add esp, 8
cmp dword [ebp - 0x194], 0xf
lea eax, [ebp - 0x1a8]
push 0x40
cmova eax, dword [ebp - 0x1a8]
push str.Jerry_Store
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.004390c0
push dword [0x4a8808]
push 0x4329c0
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [ebp - 0x3b0], 0x9376d81f
xorps xmm0, xmm0
mov dword [ebp - 0x3ac], 0x6c89983
mov dword [ebp - 0x3a8], 0x99689ac7
mov dword [ebp - 0x3a4], 0xa2f17a95
movups xmm1, xmmword [ebp - 0x3b0]
mov dword [ebp - 0x3a0], 0xffb15546
mov dword [ebp - 0x39c], 0xdd515b9e
mov dword [ebp - 0x398], 0x4b022719
mov dword [ebp - 0x394], 0x76b8f7cb
movups xmm2, xmmword [ebp - 0x3a0]
mov dword [ebp - 0x390], 0xd342c3e3
mov dword [ebp - 0x38c], 0x56f2298
mov dword [ebp - 0x388], 0x224da02c
mov dword [ebp - 0x384], 0xf773669
movups xmm3, xmmword [ebp - 0x390]
mov dword [ebp - 0x380], 0x13aac654
mov dword [ebp - 0x37c], 0xfa2c594e
mov dword [ebp - 0x378], 0x987c72d
mov dword [ebp - 0x374], 0xa979d593
movups xmm4, xmmword [ebp - 0x380]
mov dword [ebp - 0x370], 0x981681ae
mov dword [ebp - 0x36c], 0x25ba0d5f
mov dword [ebp - 0x368], 0xe689125b
mov dword [ebp - 0x364], 0xbc500266
movups xmm5, xmmword [ebp - 0x370]
mov dword [ebp - 0x360], 0x78c29f7e
mov dword [ebp - 0x35c], 0xc2dd2615
mov dword [ebp - 0x358], 0x9e1b2d32
mov dword [ebp - 0x354], 0x9d169497
movups xmm6, xmmword [ebp - 0x360]
mov dword [ebp - 0x410], 0xe302ac77
mov dword [ebp - 0x40c], 0x29e7a3f0
mov dword [ebp - 0x408], 0xb706fea4
mov dword [ebp - 0x404], 0xc18213f1
mov dword [ebp - 0x400], 0x9ed52729
mov dword [ebp - 0x3fc], 0xbe7f2bee
mov dword [ebp - 0x3f8], 0x2a2d4a76
mov dword [ebp - 0x3f4], 0x15d983bf
xorps xmm2, xmmword [ebp - 0x400]
mov dword [ebp - 0x3f0], 0xbd27ae8b
mov dword [ebp - 0x3ec], 0x3c4051ec
mov dword [ebp - 0x3e8], 0x157c9518
mov dword [ebp - 0x3e4], 0x3d42035d
xorps xmm3, xmmword [ebp - 0x3f0]
mov dword [ebp - 0x3e0], 0x259cfe6d
mov dword [ebp - 0x3dc], 0xca1a617a
mov dword [ebp - 0x3d8], 0x3cbee81a
mov dword [ebp - 0x3d4], 0x9a40edab
xorps xmm4, xmmword [ebp - 0x3e0]
mov dword [ebp - 0x3d0], 0xad20b19f
mov dword [ebp - 0x3cc], 0x158e3c68
mov dword [ebp - 0x3c8], 0xd6b0216c
mov dword [ebp - 0x3c4], 0xcc357049
xorps xmm5, xmmword [ebp - 0x3d0]
mov dword [ebp - 0x3c0], 0x20b6ed11
mov dword [ebp - 0x3bc], 0xa6f31426
mov dword [ebp - 0x3b8], 0x9e1b415e
mov dword [ebp - 0x3b4], 0x9d169497
xorps xmm6, xmmword [ebp - 0x3c0]
movups xmmword [ebp - 0x280], xmm1
xorps xmm1, xmmword [ebp - 0x410]
movaps xmmword [ebp - 0x280], xmm1
movaps xmmword [ebp - 0x270], xmm2
movaps xmmword [ebp - 0x260], xmm3
movaps xmmword [ebp - 0x250], xmm4
movaps xmmword [ebp - 0x240], xmm5
movaps xmmword [ebp - 0x230], xmm6
movups xmmword [ebp - 0x1f8], xmm0
lea ecx, [ebp - 0x280]
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43a935
sub ecx, edx
lea eax, [ebp - 0x280]
push ecx
push eax
lea ecx, [ebp - 0x1f8]
call fcn.0043e360
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x330]
mov dword [ebp - 0x1e0], 0xb45e9634
lea edx, [ecx + 1]
mov dword [ebp - 0x1dc], 0x4683cd99
xorps xmm0, xmm0
mov dword [ebp - 0x1d8], 0xe45a8dd3
mov dword [ebp - 0x1d4], 0xa4f66088
movups xmm1, xmmword [ebp - 0x1e0]
mov dword [ebp - 0x1d0], 0xc2e71444
mov dword [ebp - 0x1cc], 0x900c529d
mov dword [ebp - 0x1c8], 0x2a44241f
mov dword [ebp - 0x1c4], 0x15d983bf
movups xmm2, xmmword [ebp - 0x1d0]
mov dword [ebp - 0x350], 0xe302ac77
movups xmmword [ebp - 0x330], xmm1
mov dword [ebp - 0x34c], 0x29e7a3f0
mov dword [ebp - 0x348], 0xb706fea4
mov dword [ebp - 0x344], 0xc18213f1
xorps xmm1, xmmword [ebp - 0x350]
mov dword [ebp - 0x340], 0x9ed52729
mov dword [ebp - 0x33c], 0xbe7f2bee
mov dword [ebp - 0x338], 0x2a2d4a76
mov dword [ebp - 0x334], 0x15d983bf
xorps xmm2, xmmword [ebp - 0x340]
movaps xmmword [ebp - 0x330], xmm1
movaps xmmword [ebp - 0x320], xmm2
movups xmmword [ebp - 0x1c0], xmm0
mov dword [ebp - 0x1b0], 0
mov dword [ebp - 0x1ac], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43aa50
sub ecx, edx
lea eax, [ebp - 0x330]
push ecx
push eax
lea ecx, [ebp - 0x1c0]
call fcn.0043e360
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x1c0]
cmp dword [ebp - 0x1ac], 0xf
lea eax, [ebp - 0x1f8]
push 0
cmova ecx, dword [ebp - 0x1c0]
cmp dword [ebp - 0x1e4], 0xf
push 0
cmova eax, dword [ebp - 0x1f8]
push ecx
push eax
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
call fcn.00438ab0
call fcn.004386e0
push 0x432a20
lea ecx, [ebp - 0x210]
call fcn.0043dbe0
mov esi, eax
mov byte [ebp - 4], 0x1d
cmp dword [esi + 4], 0
jne 0x43aad4
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push dword [esi + 4]
mov edi, dword [sym.imp.MSVCP140.dll__Thrd_detach]
push dword [esi]
call edi
add esp, 8
test eax, eax
je 0x43aaf0
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
mov dword [esi], 0
mov dword [esi + 4], 0
mov byte [ebp - 4], 0x1c
cmp dword [ebp - 0x20c], 0
je 0x43ab10
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
push 0x432830
lea ecx, [ebp - 0x210]
call fcn.0043dbe0
mov esi, eax
mov byte [ebp - 4], 0x1e
cmp dword [esi + 4], 0
jne 0x43ab34
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push dword [esi + 4]
push dword [esi]
call edi
add esp, 8
test eax, eax
je 0x43ab4a
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
mov dword [esi], 0
mov dword [esi + 4], 0
mov byte [ebp - 4], 0x1c
cmp dword [ebp - 0x20c], 0
je 0x43ab6a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea edx, [ebp - 0x1c0]
mov dword [ebp - 0x20c], eax
lea ecx, [ebp - 0x20c]
call fcn.004392d0
call fcn.00438e20
push 0x3e8
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Beep]
mov esi, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
push str.delete_old.bat
call esi
add esp, 4
push str.firstrun.txt
call esi
add esp, 4
push str.prev_version.txt
call esi
mov ecx, dword [ebp - 0x1ac]
add esp, 4
cmp ecx, 0xf
jbe 0x43abfa
mov edx, dword [ebp - 0x1c0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43abf0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43ad3c
push ecx
push edx
call fcn.00475d32
add esp, 8
mov ecx, dword [ebp - 0x1e4]
mov dword [ebp - 0x1b0], 0
mov dword [ebp - 0x1ac], 0xf
mov byte [ebp - 0x1c0], 0
cmp ecx, 0xf
jbe 0x43ac4f
mov edx, dword [ebp - 0x1f8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43ac45
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43ad3c
push ecx
push edx
call fcn.00475d32
add esp, 8
mov ecx, dword [ebp - 0x194]
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 0xf
mov byte [ebp - 0x1f8], 0
cmp ecx, 0xf
jbe 0x43aca4
mov edx, dword [ebp - 0x1a8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43ac9a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43ad3c
push ecx
push edx
call fcn.00475d32
add esp, 8
mov ecx, dword [ebp - 0x164]
mov dword [ebp - 0x198], 0
mov dword [ebp - 0x194], 0xf
mov byte [ebp - 0x1a8], 0
cmp ecx, 0xf
jbe 0x43acf5
mov edx, dword [ebp - 0x178]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43aceb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43ad3c
push ecx
push edx
call fcn.00475d32
add esp, 8
mov ecx, dword [ebp - 0x17c]
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x164], 0xf
mov byte [ebp - 0x178], 0
cmp ecx, 0xf
jbe 0x43ad4c
mov edx, dword [ebp - 0x190]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43ad42
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x43ad42
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00475d32
add esp, 8
or eax, 0xffffffff
jmp 0x43ae4a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.004758de
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push str.failed_to_get_hwid
lea ecx, [ebp - 0x468]
call fcn.0042e650
push 0x493878
lea eax, [ebp - 0x468]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3