Function at 0x4ac1a0
Capabilities:
Create process on windows
Create process suspended
Delete file
Get common file path
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push edi
lea edi, [esp + 8]
and esp, 0xfffffff8
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x9cc
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_SetErrorMode]
lea eax, [ebp - 0x698]
sub esp, 4
mov dword [esp + 4], eax
mov dword [esp], 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
mov dword [ebp - 0x9a0], 0x5d71a0
mov eax, dword fs:[0x18]
mov dword [ebp - 0x990], 0
sub esp, 8
mov dword [ebp - 0x9b0], eax
lea esi, [esi]
lea eax, [ebp - 0x594]
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x698]
mov dword [esp + 4], 0x5d3758
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
lea eax, [ebp - 0x594]
sub esp, 0x10
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileA]
sub esp, 0x1c
mov esi, eax
cmp eax, 0xffffffff
je 0x4adbb1
lea eax, [ebp - 0x96c]
mov ebx, dword fs:[0x18]
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.kernel32.dll_WriteFile]
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x40
mov dword [esp + 4], 0x79e760
mov dword [ebp - 0x998], eax
call eax
sub esp, 0x14
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x790
mov eax, dword [ebx + 0x34]
mov dword [esp], edi
lea edi, [ebp - 0x888]
mov dword [esp + 8], eax
mov dword [esp + 4], str.WriteFile_error__ld_n
call fcn.0049fda0
xor eax, eax
mov ecx, 0x3c
mov dword [ebp - 0x890], 0x4550
rep stosd dword es:[edi], eax
mov eax, 4
mov ecx, dword [ebp - 0x9a0]
mov edi, 0x10b
mov word [ebp - 0x850], ax
mov eax, 1
mov word [ebp - 0x84c], ax
mov eax, 4
mov word [ebp - 0x848], ax
mov eax, dword [0x79ea48]
mov word [ebp - 0x878], di
mov dword [ebp - 0x858], eax
lea edx, [eax + 0x160]
mov dword [0x57f2cc], eax
mov eax, dword [ecx]
mov dword [ebp - 0x840], edx
lea edx, [ebp - 0x96c]
mov dword [ebp - 0x85c], 0x10000000
mov dword [ebp - 0x834], 0x1400003
mov dword [ebp - 0x830], 0x100000
mov dword [ebp - 0x82c], 0x1000
mov dword [ebp - 0x828], 0x100000
mov dword [ebp - 0x824], 0x1000
mov dword [ebp - 0x81c], 0x10
mov dword [ebp - 0x854], 0x200
mov dword [ebp - 0x83c], 0x160
mov dword [0x57f2e4], eax
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [ebp - 0x88c], 0x1014c
mov dword [ebp - 0x87c], 0x200200e0
mov byte [ebp - 0x876], 1
mov dword [ebp - 0x864], 0x10
mov dword [0x57f2d0], 0x10
mov dword [0x57f2d4], 0x200
mov dword [0x57f2c8], 0x10
mov dword [esp + 0xc], edx
lea edx, [ebp - 0x890]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0xf8
mov dword [esp + 4], edx
mov dword [esp], esi
mov eax, dword [ebp - 0x998]
call eax
sub esp, 0x14
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x7a1
mov eax, dword [ebx + 0x34]
mov dword [esp], edi
mov dword [esp + 8], eax
mov dword [esp + 4], str.WriteFile_error__ld_n
call fcn.0049fda0
lea edx, [ebp - 0x96c]
mov dword [esp], esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x28
mov dword [esp + 4], 0x57f2c0
mov eax, dword [ebp - 0x998]
call eax
sub esp, 0x14
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x7a4
mov eax, dword [ebx + 0x34]
mov dword [esp], edi
mov dword [esp + 8], eax
mov dword [esp + 4], str.WriteFile_error__ld_n
call fcn.0049fda0
mov dword [esp + 0xc], 0
mov edi, dword [sym.imp.kernel32.dll_SetFilePointer]
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x854]
mov dword [esp], esi
mov dword [esp + 4], eax
call edi
lea edx, [ebp - 0x96c]
mov dword [ebx + 0x34], 0xdeadbeef
sub esp, 0x10
mov dword [esp + 0xc], edx
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x10
mov dword [esp + 4], str.section_data
mov eax, dword [ebp - 0x998]
call eax
sub esp, 0x14
mov dword [ebp - 0x970], eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x7aa
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.WriteFile_error__ld_n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x970]
mov dword [esp], edx
call fcn.0049fda0
mov eax, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp], esi
mov dword [ebp - 0x9a4], eax
call eax
lea eax, [ebp - 0x594]
mov dword [ebx + 0x34], 0xdeadbeef
sub esp, 4
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
sub esp, 0xc
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x7af
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.LoadLibrary_error__ld_n
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
setne al
mov dword [esp], eax
call fcn.0049fda0
lea eax, [ebp - 0x93c]
mov dword [ebx + 0x34], 0xdeadbeef
mov edx, dword [sym.imp.kernel32.dll_VirtualQuery]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x57f2cc]
mov dword [ebp - 0x978], esi
add eax, esi
mov dword [esp], eax
mov dword [ebp - 0x980], edx
call edx
sub esp, 0xc
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x7b3
mov eax, dword [ebx + 0x34]
mov dword [esp + 0xc], eax
xor eax, eax
mov ebx, dword [ebp - 0x990]
cmp esi, 0x1c
sete al
mov dword [esp + 4], str._d:_VirtualQuery_error__ld_n
mov dword [esp], eax
mov dword [esp + 8], ebx
call fcn.0049fda0
call fcn.0057d110
mov esi, dword [ebp - 0x978]
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x7b5
mov edx, dword [0x57f2cc]
mov eax, dword [ebp - 0x93c]
mov dword [esp + 8], ebx
add edx, esi
mov dword [esp + 4], str._d:_got__p___expected__p_n
cmp edx, eax
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 0x10], edx
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov edx, dword [0x79ea48]
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x7b6
mov eax, dword [ebp - 0x930]
mov dword [esp + 0x10], edx
cmp edx, eax
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 8], ebx
movzx eax, al
mov dword [esp + 4], str._d:_got__Ix___expected__lx_n
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov ecx, dword [ebp - 0x9a0]
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x7b7
mov ecx, dword [ecx + 4]
mov eax, dword [ebp - 0x928]
mov dword [ebp - 0x99c], ecx
cmp ecx, eax
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 0x10], ecx
movzx eax, al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str._d:_got__lx___expected__lx_n
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x7b8
mov eax, dword [ebp - 0x938]
mov dword [esp + 0x10], esi
cmp eax, esi
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 8], ebx
movzx eax, al
mov dword [esp + 4], str._d:__p____p_n
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x7b9
mov eax, dword [ebp - 0x934]
mov dword [esp + 8], ebx
cmp eax, 0x80
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 4], str._d:__lx___PAGE_EXECUTE_WRITECOPY_n
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x7ba
mov eax, dword [ebp - 0x92c]
mov dword [esp + 8], ebx
cmp eax, 0x1000
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 4], str._d:__lx___MEM_COMMIT_n
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x7bb
mov eax, dword [ebp - 0x924]
mov dword [esp + 8], ebx
cmp eax, 0x1000000
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 4], str._d:__lx___SEC_IMAGE_n
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
cmp dword [ebp - 0x928], 1
je 0x4ac84c
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x7bd
mov eax, dword [0x57f2d0]
mov dword [esp + 4], str.section_data
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x93c]
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
mov dword [esp + 4], str.wrong_section_data_n
test eax, eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov ecx, dword [ebp - 0x978]
lea eax, [ebp - 0x968]
add ecx, dword [0x57f2cc]
mov dword [ebp - 0x970], ecx
mov esi, dword fs:[0x18]
mov dword [esi + 0x34], 0xdeadbeef
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov eax, dword [0x79ea48]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.kernel32.dll_VirtualProtect]
mov dword [ebp - 0x974], eax
call eax
sub esp, 0x10
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x6f5
mov eax, dword [esi + 0x34]
mov dword [esp], ebx
xor ebx, ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5d5d43
call fcn.0049fda0
mov eax, dword [ebp - 0x968]
mov dword [ebp - 0x988], edi
mov dword [ebp - 0x9a8], eax
jmp 0x4acc1e
mov dword [ebp - 0x984], eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x70b
mov dword [esp + 0x10], edi
mov eax, dword [esi + 0x34]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], str._ld:_VirtualProtect_error__ld__requested_prot__lx_n
mov edx, dword [ebp - 0x984]
mov dword [esp], edx
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x70c
mov eax, dword [ebp - 0x968]
mov dword [esp + 8], ebx
cmp eax, 1
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 4], 0x5d5db4
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
lea ecx, [ebp - 0x920]
mov dword [esi + 0x34], 0xdeadbeef
mov dword [esp + 8], 0x1c
mov dword [esp + 4], ecx
mov edi, dword [ebp - 0x970]
mov dword [esp], edi
mov ecx, dword [ebp - 0x980]
call ecx
sub esp, 0xc
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x710
mov eax, dword [esi + 0x34]
mov dword [esp], edi
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5d5d5d
call fcn.0049fda0
call fcn.0057d110
mov edi, dword [ebp - 0x970]
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x711
mov eax, dword [ebp - 0x920]
mov dword [esp + 0x10], edi
cmp edi, eax
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 8], ebx
movzx eax, al
mov dword [esp + 4], 0x5d5d76
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov edx, dword [0x79ea48]
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x712
mov eax, dword [ebp - 0x914]
mov dword [esp + 0x10], edx
cmp edx, eax
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 8], ebx
movzx eax, al
mov dword [esp + 4], 0x5d5d94
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov ecx, dword [ebp - 0x97c]
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x713
mov eax, dword [ebp - 0x90c]
mov dword [esp + 0x10], ecx
cmp ecx, eax
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 8], ebx
movzx eax, al
mov dword [esp + 4], 0x5d5e78
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov edx, dword [ebp - 0x978]
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x714
mov eax, dword [ebp - 0x91c]
mov dword [esp + 0x10], edx
cmp edx, eax
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 8], ebx
movzx eax, al
mov dword [esp + 4], 0x5d5ddd
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x715
mov eax, dword [ebp - 0x918]
mov dword [esp + 8], ebx
cmp eax, 0x80
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 4], str._ld:__lx___PAGE_EXECUTE_WRITECOPY_n
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x716
mov eax, dword [ebp - 0x910]
mov dword [esp + 8], ebx
cmp eax, 0x1000
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 4], 0x5d5e11
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x717
mov eax, dword [ebp - 0x908]
mov dword [esp + 8], ebx
cmp eax, 0x1000000
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 4], str._ld:__lx___SEC_IMAGE_n
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
lea ecx, [ebp - 0x968]
mov dword [ebp - 0x968], 0xdeadbeef
mov dword [esi + 0x34], 0xdeadbeef
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 1
mov eax, dword [0x79ea48]
mov dword [esp], edi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x974]
call eax
sub esp, 0x10
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x722
mov eax, dword [esi + 0x34]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x5d5e98
mov dword [esp], edi
call fcn.0049fda0
call fcn.0057d110
mov ecx, dword [ebp - 0x97c]
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x724
mov eax, dword [ebp - 0x968]
mov dword [esp + 8], ebx
cmp ecx, eax
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 0x10], ecx
add ebx, 1
movzx eax, al
mov dword [esp + 4], 0x5d5e78
mov dword [esp], eax
call fcn.0049fda0
cmp ebx, 0x1f
je 0x4acfa1
lea eax, [ebp - 0x920]
mov dword [esi + 0x34], 0xdeadbeef
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x970]
mov dword [esp], eax
mov ecx, dword [ebp - 0x980]
call ecx
sub esp, 0xc
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x6fd
mov eax, dword [esi + 0x34]
mov dword [esp], edi
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5d5d5d
call fcn.0049fda0
call fcn.0057d110
mov edi, dword [ebp - 0x970]
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x6fe
mov eax, dword [ebp - 0x920]
mov dword [esp + 0x10], edi
cmp edi, eax
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 8], ebx
movzx eax, al
mov dword [esp + 4], 0x5d5d76
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov edx, dword [0x79ea48]
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x6ff
mov eax, dword [ebp - 0x914]
mov dword [esp + 0x10], edx
cmp edx, eax
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 8], ebx
movzx eax, al
mov dword [esp + 4], 0x5d5d94
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x700
mov eax, dword [ebp - 0x90c]
mov dword [esp + 8], ebx
cmp eax, 1
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 4], 0x5d5db4
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov edx, dword [ebp - 0x978]
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x701
mov eax, dword [ebp - 0x91c]
mov dword [esp + 0x10], edx
cmp edx, eax
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 8], ebx
movzx eax, al
mov dword [esp + 4], 0x5d5ddd
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x702
mov eax, dword [ebp - 0x918]
mov dword [esp + 8], ebx
cmp eax, 0x80
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 4], str._ld:__lx___PAGE_EXECUTE_WRITECOPY_n
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x703
mov eax, dword [ebp - 0x910]
mov dword [esp + 8], ebx
cmp eax, 0x1000
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 4], 0x5d5e11
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x704
mov eax, dword [ebp - 0x908]
mov dword [esp + 8], ebx
cmp eax, 0x1000000
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 4], str._ld:__lx___SEC_IMAGE_n
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
mov edi, dword [ebx*8 + 0x5d70a0]
lea eax, [ebp - 0x968]
mov dword [ebp - 0x968], 0xdeadbeef
mov dword [esi + 0x34], 0xdeadbeef
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov eax, dword [0x79ea48]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x970]
mov dword [esp], eax
mov eax, dword [ebp - 0x974]
call eax
mov ecx, dword [ebx*8 + 0x5d70a4]
sub esp, 0x10
test ecx, ecx
mov dword [ebp - 0x97c], ecx
jne 0x4ac8e0
mov dword [ebp - 0x97c], eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x71b
xor eax, eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x5d5eb8
mov edx, dword [ebp - 0x97c]
test edx, edx
sete al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x71c
mov eax, dword [esi + 0x34]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 4], 0x5d5edc
cmp dword [esi + 0x34], 0x57
sete al
mov dword [esp], eax
call fcn.0049fda0
lea eax, [ebp - 0x968]
mov dword [ebp - 0x968], 0xdeadbeef
mov dword [esi + 0x34], 0xdeadbeef
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov eax, dword [0x79ea48]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x970]
mov dword [esp], eax
mov eax, dword [ebp - 0x974]
call eax
sub esp, 0x10
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x722
mov eax, dword [esi + 0x34]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x5d5e98
mov dword [esp], edi
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x726
mov eax, dword [ebp - 0x968]
mov dword [esp + 8], ebx
cmp eax, 1
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 4], 0x5d5db4
add ebx, 1
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
cmp ebx, 0x1f
jne 0x4acc1e
mov edi, dword [ebp - 0x988]
mov esi, 4
xor edx, edx
mov dword [ebp - 0x9ac], edi
mov edi, dword [ebp - 0x9b0]
lea esi, [esi]
test edx, edx
mov dword [ebp - 0x994], esi
setne byte [ebp - 0x988]
xor ebx, ebx
xor ecx, ecx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x98c], edx
mov dword [ebp - 0x984], eax
jmp 0x4ad06e
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x737
xor eax, eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0x5d5f0c
mov edx, dword [ebp - 0x97c]
test edx, edx
sete al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x738
mov eax, dword [edi + 0x34]
mov dword [esp + 4], 0x5d4cd4
mov dword [esp + 8], eax
xor eax, eax
cmp dword [edi + 0x34], 0x57
sete al
mov dword [esp], eax
call fcn.0049fda0
mov eax, 1
mov ecx, ebx
add ebx, 1
mov esi, eax
shl esi, cl
mov ecx, esi
cmp ebx, 5
je 0x4ad120
mov eax, dword [ebp - 0x984]
mov esi, dword [ebp - 0x98c]
mov dword [ebp - 0x97c], ecx
mov dword [eax + 0x34], 0xdeadbeef
or esi, ecx
lea eax, [ebp - 0x968]
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov eax, dword [0x79ea48]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x970]
mov dword [esp], eax
mov eax, dword [ebp - 0x974]
call eax
mov ecx, dword [ebp - 0x97c]
sub esp, 0x10
mov edx, eax
test ecx, ecx
mov dword [ebp - 0x97c], edx
setne al
test byte [ebp - 0x988], al
jne 0x4acff0
test esi, esi
je 0x4acff0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x73b
mov eax, dword [ebp - 0x984]
mov eax, dword [eax + 0x34]
mov dword [esp + 8], esi
mov dword [esp + 4], 0x5d5f30
mov dword [esp + 0xc], eax
mov edx, dword [ebp - 0x97c]
mov dword [esp], edx
call fcn.0049fda0
jmp 0x4ad055
mov esi, dword [ebp - 0x994]
mov ecx, esi
add esi, 1
shl eax, cl
mov edx, eax
cmp esi, 9
jne 0x4acfc0
lea eax, [ebp - 0x968]
mov edi, dword [ebp - 0x9ac]
mov esi, dword fs:[0x18]
mov dword [esi + 0x34], 0xdeadbeef
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x9a8]
mov dword [esp + 8], eax
mov eax, dword [0x79ea48]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x970]
mov dword [esp], eax
mov eax, dword [ebp - 0x974]
call eax
sub esp, 0x10
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x745
mov eax, dword [esi + 0x34]
mov dword [esp + 4], 0x5d5d43
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.0049fda0
movzx eax, byte [ebp - 0x928]
cmp eax, 0x40
je 0x4ada7b
ja 0x4ada70
sub eax, 4
and eax, 0xfffffffb
je 0x4ada7b
mov eax, dword [ebp - 0x978]
mov esi, dword fs:[0x18]
mov dword [esi + 0x34], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
sub esp, 4
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x7d0
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.FreeLibrary_error__ld_n
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.0049fda0
mov ecx, dword [0x79e80c]
test ecx, ecx
je 0x4ad235
mov edx, dword [ebp - 0x99c]
mov ecx, 1
lea eax, [ebp - 0x594]
call fcn.004ab6e0
mov edx, 2
lea eax, [ebp - 0x594]
mov word [ebp - 0x87a], dx
mov ebx, dword fs:[0x18]
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileA]
sub esp, 0x1c
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x7de
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.CreateFile_error__ld_n
mov dword [esp + 8], eax
xor eax, eax
cmp esi, 0xffffffff
setne al
mov dword [esp], eax
call fcn.0049fda0
mov dword [esp], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40
call edi
lea eax, [ebp - 0x96c]
mov dword [ebx + 0x34], 0xdeadbeef
sub esp, 0x10
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x890]
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x18
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x998]
call eax
sub esp, 0x14
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x7e2
mov eax, dword [ebx + 0x34]
mov dword [esp], edi
mov dword [esp + 8], eax
mov dword [esp + 4], str.WriteFile_error__ld_n
call fcn.0049fda0
mov dword [esp], esi
mov eax, dword [ebp - 0x9a4]
lea esi, [ebp - 0x8d4]
call eax
lea edx, [ebp - 0x8d0]
xor eax, eax
mov ecx, 0x10
mov dword [ebp - 0x8d4], 0x44
mov edi, edx
sub esp, 4
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x964]
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x594]
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateProcessA]
sub esp, 0x28
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x7e9
mov eax, dword [ebx + 0x34]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str.CreateProcess___error__ld_n
call fcn.0049fda0
lea eax, [ebp - 0x954]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x18
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x964]
mov dword [esp], eax
call dword [0x79e804]
sub esp, 0x14
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x7ec
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.ProcessBasicInformation_got__lx_n
call fcn.0049fda0
lea eax, [ebp - 0x490]
mov dword [esp + 0x10], 0
mov edi, dword [sym.imp.kernel32.dll_ReadProcessMemory]
mov dword [esp + 0xc], 0x480
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x950]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x964]
mov dword [esp], eax
call edi
sub esp, 0x14
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x7ee
mov eax, dword [ebx + 0x34]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str.ReadProcessMemory_failed_err__lu_n
call fcn.0049fda0
lea eax, [ebp - 0x93c]
mov esi, dword [ebp - 0x488]
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp + 0xc], 0x1c
mov dword [esp + 8], eax
mov eax, dword [0x57f2cc]
add eax, esi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x964]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_VirtualQueryEx]
sub esp, 0x10
mov dword [ebp - 0x970], eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x7f3
mov eax, dword [ebx + 0x34]
mov dword [esp + 0xc], eax
mov ecx, dword [ebp - 0x990]
xor eax, eax
mov dword [esp + 4], str._d:_VirtualQuery_error__ld_n
mov dword [esp + 8], ecx
cmp dword [ebp - 0x970], 0x1c
sete al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x7f5
mov eax, dword [0x57f2cc]
add eax, esi
mov ecx, eax
mov eax, dword [ebp - 0x93c]
mov dword [esp + 0x10], ecx
cmp ecx, eax
mov dword [esp + 0xc], eax
mov edx, dword [ebp - 0x990]
sete al
mov dword [esp + 4], str._d:_got__p___expected__p_n
movzx eax, al
mov dword [esp + 8], edx
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov ecx, dword [0x79ea48]
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x7f6
mov eax, dword [ebp - 0x930]
mov dword [esp + 0x10], ecx
cmp ecx, eax
mov dword [esp + 0xc], eax
mov edx, dword [ebp - 0x990]
sete al
mov dword [esp + 4], str._d:_got__Ix___expected__lx_n
movzx eax, al
mov dword [esp + 8], edx
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov ecx, dword [ebp - 0x99c]
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x7f7
mov eax, dword [ebp - 0x928]
mov dword [esp + 0x10], ecx
cmp ecx, eax
mov dword [esp + 0xc], eax
mov edx, dword [ebp - 0x990]
sete al
mov dword [esp + 4], str._d:_got__lx___expected__lx_n
movzx eax, al
mov dword [esp + 8], edx
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x7f8
mov eax, dword [ebp - 0x938]
mov dword [esp + 0x10], esi
cmp eax, esi
mov dword [esp + 0xc], eax
mov edx, dword [ebp - 0x990]
sete al
mov dword [esp + 4], str._d:__p____p_n
movzx eax, al
mov dword [esp + 8], edx
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x7f9
mov eax, dword [ebp - 0x934]
cmp eax, 0x80
mov dword [esp + 0xc], eax
mov esi, dword [ebp - 0x990]
sete al
mov dword [esp + 4], str._d:__lx___PAGE_EXECUTE_WRITECOPY_n
movzx eax, al
mov dword [esp + 8], esi
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x7fa
mov eax, dword [ebp - 0x92c]
mov dword [esp + 8], esi
cmp eax, 0x1000
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 4], str._d:__lx___MEM_COMMIT_n
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x7fb
mov eax, dword [ebp - 0x924]
mov dword [esp + 8], esi
cmp eax, 0x1000000
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 4], str._d:__lx___SEC_IMAGE_n
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
cmp dword [ebp - 0x928], 1
je 0x4ad7d1
mov dword [ebx + 0x34], 0xdeadbeef
lea esi, [ebp - 0x798]
mov dword [esp + 0x10], 0
mov eax, dword [0x57f2d0]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x93c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x964]
mov dword [esp], eax
call edi
sub esp, 0x14
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x800
mov eax, dword [ebx + 0x34]
mov dword [esp + 4], str.ReadProcessMemory___error__ld_n
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x801
mov eax, dword [0x57f2d0]
mov dword [esp + 4], str.section_data
mov dword [esp + 8], eax
mov dword [esp], esi
call sub.msvcrt.dll_memcmp
mov dword [esp + 4], str.wrong_section_data_n
test eax, eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
lea esi, [ebp - 0x904]
mov dword [esp + 0x10], 0
mov ebx, dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov dword [esp + 8], esi
mov dword [esp + 0xc], 0x30
mov dword [esp + 4], 0x25
mov eax, dword [ebp - 0x964]
mov dword [esp], eax
call ebx
sub esp, 0x14
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x806
xor eax, eax
test edi, edi
sete al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], 0x5d5fd3
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x807
movzx eax, word [ebp - 0x87a]
mov dword [esp + 4], str.Got_unexpected_characteristics__x._n
mov dword [esp + 8], eax
movzx eax, word [ebp - 0x8e8]
shr ax, 0xd
xor eax, 1
and eax, 1
mov dword [esp], eax
call fcn.0049fda0
mov eax, dword [ebp - 0x93c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x964]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
sub esp, 8
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x80a
xor eax, eax
test edi, edi
sete al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], 0x5d5fd3
call fcn.0049fda0
mov dword [esp + 8], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x30
mov dword [esp + 4], 0x25
mov eax, dword [ebp - 0x964]
mov dword [esp], eax
call ebx
sub esp, 0x14
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x80d
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], 0x5d5fd3
mov esi, dword fs:[0x18]
call fcn.0049fda0
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x80e
movzx eax, word [ebp - 0x87a]
mov dword [esp + 4], str.Got_unexpected_characteristics__x._n
mov dword [esp + 8], eax
movzx eax, word [ebp - 0x8e8]
shr ax, 0xd
xor eax, 1
and eax, 1
mov dword [esp], eax
call fcn.0049fda0
mov dword [esi + 0x34], 0xdeadbeef
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x964]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
sub esp, 8
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x813
mov eax, dword [esi + 0x34]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], str.TerminateProcess___error__ld_n
call fcn.0049fda0
mov dword [esp + 4], 0xbb8
mov eax, dword [ebp - 0x964]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
sub esp, 8
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x815
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.WaitForSingleObject_failed:__lx_n
call fcn.0049fda0
mov eax, dword [ebp - 0x960]
mov dword [esp], eax
mov esi, dword [ebp - 0x9a4]
call esi
mov eax, dword [ebp - 0x964]
sub esp, 4
mov dword [esp], eax
call esi
mov eax, dword [0x79e80c]
sub esp, 4
test eax, eax
je 0x4ada30
mov edx, dword [ebp - 0x99c]
xor ecx, ecx
lea eax, [ebp - 0x594]
call fcn.004ab6e0
lea eax, [ebp - 0x594]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
add dword [ebp - 0x990], 1
mov eax, dword [ebp - 0x990]
add dword [ebp - 0x9a0], 0xc
sub esp, 4
cmp eax, 0x18
jne 0x4ac208
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
cmp eax, 0x80
jne 0x4ad1ca
mov eax, dword [ebp - 0x93c]
mov esi, dword fs:[0x18]
mov byte [eax], 0xfe
lea eax, [ebp - 0x93c]
mov dword [esi + 0x34], 0xdeadbeef
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x978]
add eax, dword [0x57f2cc]
mov dword [esp], eax
mov eax, dword [ebp - 0x980]
call eax
sub esp, 0xc
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x7c8
mov eax, dword [esi + 0x34]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x990]
mov dword [esp + 4], str._d:_VirtualQuery_error__ld_n
mov dword [esp + 8], eax
xor eax, eax
cmp ebx, 0x1c
sete al
mov dword [esp], eax
call fcn.0049fda0
mov eax, dword [ebp - 0x928]
cmp eax, 8
je 0x4adb9f
xor ebx, ebx
cmp eax, 0x80
je 0x4adb9f
call fcn.0057d110
mov esi, dword [eax + 0x10]
mov dword [eax + 0x14], 1
lea edx, [esi + esi]
mov esi, dword [ebp - 0x990]
or edx, ebx
mov ebx, dword [ebp - 0x9a0]
mov dword [eax + 0x10], edx
jmp 0x4adb87
call fcn.0057d110
mov dword [eax], 0x5d3477
mov dword [eax + 4], 0x7cb
mov edx, dword [ebx + 8]
mov eax, dword [ebp - 0x928]
mov dword [esp + 8], esi
mov dword [esp + 0x10], edx
cmp edx, eax
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 4], str._d:_got__lx___expected__lx_n
movzx eax, al
mov dword [esp], eax
call fcn.0049fda0
call fcn.0057d110
shr dword [eax + 0x10], 1
call fcn.0057d110
mov edx, dword [eax + 0x14]
mov dword [eax + 0x14], 0
test edx, edx
jne 0x4adb40
jmp 0x4ad1ca
mov esi, dword [0x8f0770]
xor ebx, ebx
test esi, esi
setne bl
jmp 0x4adb17
mov eax, 0x78a
call fcn.0049f440
lea eax, [ebp - 0x594]
mov dword [esp + 4], 0x5d3769
mov dword [esp + 8], eax
mov dword [esp], 0
call fcn.0049fda0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret