Function at 0x50012d2
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Create thread
Generate random numbers via winapi
Get common file path
Get disk information
Get disk size
Get file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x634
mov eax, dword [0x500117c]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
xor ebx, ebx
lea eax, [ebp - 0x9c]
push 0xffffffffffffffff
push 0x50174c0
mov byte [ebp - 0x16], 0x63
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x68], 0xc
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x38], ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov dword [0x500701c], 1
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x5017384], eax
call fcn.05002889
mov esi, 0x50173a0
push 0x104
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, esi
cmp ecx, esi
jbe 0x500136c
cmp byte [ecx - 1], 0x5c
lea eax, [ecx - 1]
je 0x500136c
mov ecx, eax
jmp 0x500135b
push ecx
call fcn.05002281
push esi
mov dword [ebp - 0xc], eax
call fcn.050028e7
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x24], eax
xor edx, edx
mov cl, byte [eax]
cmp cl, 0x20
je 0x5001397
cmp cl, 9
je 0x5001397
cmp cl, 0x22
jne 0x50013a2
cmp cl, 0x22
jne 0x500139f
push 1
pop edx
inc eax
jmp 0x5001386
cmp edx, ebx
mov dword [ebp - 0x24], eax
je 0x50013be
mov ecx, eax
mov al, byte [eax]
cmp al, bl
je 0x50013be
cmp al, 0x22
je 0x50013bb
mov al, byte [ecx + 1]
inc ecx
jmp 0x50013ad
mov byte [ecx], 0x20
mov edx, dword [ebp - 0x24]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + edx - 1]
cmp eax, edx
jb 0x50013e6
mov cl, byte [eax]
cmp cl, 0x20
je 0x50013e1
cmp cl, 9
jne 0x50013e6
mov byte [eax], bl
dec eax
jmp 0x50013d1
mov edx, dword [ebp - 0xc]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
mov byte [0x5007020], bl
mov dword [ebp - 0x2c], ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx + edx - 1]
cmp edx, dword [ebp - 0xc]
jbe 0x500143b
cmp byte [edx], 0x2e
je 0x500140f
dec edx
jmp 0x5001402
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
mov esi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x5007020
mov dword [ebp - 0x2c], ecx
inc ecx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [edx], bl
mov esi, 0x50173a0
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x3c], 0x5001178
mov dword [ebp - 8], edi
cmp byte [edi], bl
je 0x5001561
mov esi, dword [ebp - 0xc]
mov al, byte [edi]
or al, 0x20
mov cl, byte [esi]
or cl, 0x20
cmp al, cl
jne 0x5001545
mov al, byte [esi + 1]
mov cl, byte [edi + 1]
inc edi
inc esi
mov dl, al
or cl, 0x20
or dl, 0x20
mov dword [ebp - 0x1c], edi
cmp dl, cl
jne 0x500147f
cmp al, bl
jne 0x5001464
cmp byte [esi], bl
jne 0x5001545
cmp byte [edi], 0x2e
mov dword [ebp - 0x10], ebx
jne 0x50014d7
cmp dword [ebp - 0x2c], ebx
jbe 0x50014d7
cmp dword [ebp - 0x2c], ebx
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], ebx
jbe 0x50014cc
mov eax, 0x5007020
mov esi, edi
sub eax, edi
mov cl, byte [eax + esi]
mov dl, byte [esi]
or cl, 0x20
or dl, 0x20
cmp dl, cl
jne 0x50014c9
inc dword [ebp - 4]
inc esi
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x2c]
jb 0x50014ac
jmp 0x50014cc
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], ebx
je 0x50014d7
add edi, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], edi
mov al, byte [edi]
cmp al, 0x20
je 0x50014e5
cmp al, 9
je 0x50014e5
cmp al, bl
jne 0x5001545
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
mov ecx, eax
mov edi, 0x5007140
sub ecx, esi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [eax + 0x5007140]
sub edi, dword [ebp - 0x24]
cmp dword [ebp - 0x10], ebx
mov byte [edi], bl
jne 0x5001536
mov ecx, dword [ebp - 0x2c]
mov esi, 0x5007020
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
lea eax, [ecx + eax + 0x5007140]
sub eax, dword [ebp - 0x24]
mov byte [eax], bl
push 0x5007140
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
je 0x5001556
mov edi, dword [ebp - 8]
inc edi
mov dword [ebp - 8], edi
cmp byte [edi], bl
jne 0x5001450
jmp 0x500155c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
mov esi, 0x50173a0
mov edx, dword [ebp - 0x3c]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jb 0x500161e
lea eax, [ecx - 2]
mov dword [ebp - 8], edx
cmp eax, ebx
jbe 0x500161e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov edi, dword [eax]
and edi, 0xffdffdff
or edi, 0x20000000
cmp edi, 0x20582d20
jne 0x50015ad
mov dword [0x50174a4], 1
cmp edi, 0x3a582d20
jne 0x50015d6
mov eax, dword [ebp - 8]
mov dword [0x50174a4], 1
add eax, 4
push eax
call fcn.05002827
test eax, eax
jne 0x50015d6
push 0x52
call fcn.05002484
push 1
cmp edi, 0x20552d20
pop eax
jne 0x50015e6
mov dword [0x5007244], eax
cmp edi, 0x20512d20
jne 0x50015f8
mov dword [0x5017388], eax
mov dword [0x5007244], eax
cmp edi, 0x20532d20
jne 0x5001605
mov dword [0x501738c], eax
cmp edi, 0x3a532d20
jne 0x5001612
mov dword [0x501738c], eax
inc dword [ebp - 8]
dec dword [ebp - 4]
jne 0x500158a
mov eax, dword [0x5007014]
and ax, 0
cmp eax, 0xcab00000
jne 0x5001638
push 0x20000001
call fcn.05002484
test byte [0x5007017], 0x80
jne 0x500164b
mov dword [0x50174a4], 1
and byte [0x5007017], 0x7f
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x5017390], eax
lea eax, [ebp - 0x88]
push eax
push ebx
push ebx
push 0x5002695
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
jne 0x5001682
push 8
call fcn.05002484
push 0xffffffffffffffff
push dword [0x5017390]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x50174a8], ebx
jne 0x50016a2
push 0x4c7
call fcn.05002484
cmp dword [0x5017388], ebx
je 0x50016da
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push dword [0x50174a8]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x50178e0]
push dword [0x50174a8]
call dword [sym.imp.USER32.dll_SetParent]
cmp dword [0x5017388], ebx
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
jne 0x5001725
push dword [ebp - 0xc]
push ebx
push 0xc
push 0x68
push dword [0x50174a8]
call edi
mov eax, dword [0x5007010]
add eax, 0xffff
shr eax, 0x10
shl eax, 0x10
push eax
push ebx
push 0x401
push 0x6a
push dword [0x50174a8]
call edi
push ebx
push 1
push 0x404
push 0x6a
push dword [0x50174a8]
call edi
push ebx
push ebx
push esi
call fcn.050022ed
or dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], eax
mov eax, dword [0x5007010]
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x5001799
mov esi, 0x5007380
mov ecx, 0x10000
mov dword [ebp - 0x1c], eax
cmp eax, ecx
jbe 0x5001757
mov dword [ebp - 0x1c], ecx
push dword [ebp - 0x1c]
push esi
push dword [ebp - 0xc]
call fcn.0500234b
add esp, 0xc
push dword [ebp - 0x1c]
push esi
push dword [ebp - 0x10]
call fcn.050028b8
cmp dword [0x5017388], ebx
mov dword [ebp - 0x10], eax
jne 0x500178e
push ebx
push ebx
push 0x405
push 0x6a
push dword [0x50174a8]
call edi
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
jne 0x5001748
cmp dword [ebp - 0x10], ebx
je 0x50017a8
push 0x20000001
call fcn.05002484
lea eax, [ebp - 0xd0]
push eax
push ebx
push fcn.0500239b
push 0x500232c
push 0x5002373
push fcn.0500234b
push fcn.050022ed
push 0x50022da
push fcn.050022b6
call fcn.05002d22
add esp, 0x24
mov dword [ebp - 0x24], eax
push ebx
push ebx
push dword [ebp - 0xc]
call fcn.0500239b
add esp, 0xc
lea eax, [ebp - 0xc4]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x24]
call fcn.05002db2
add esp, 0xc
test eax, eax
jne 0x500180e
push 0x20000001
call fcn.05002484
cmp dword [0x5017388], ebx
jne 0x5001823
push ebx
push dword [0x50174a8]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.05002c03
test eax, eax
jne 0x500183f
push 0xffffffffffffffff
call fcn.05002484
lea eax, [ebp - 0x9c]
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x50018da
push 2
lea eax, [ebp - 0x234]
push 0x100
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x50018da
push dword [ebp - 0x50]
mov esi, dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
lea eax, [ebp - 0x234]
push 0x10000000
push 2
push eax
call esi
test eax, eax
je 0x50018da
push dword [ebp - 0x5c]
lea eax, [ebp - 0x234]
push 0x10000000
push 2
push eax
call esi
test eax, eax
je 0x50018da
push dword [ebp - 0x48]
lea eax, [ebp - 0x234]
push 0x10000000
push 2
push eax
call esi
test eax, eax
je 0x50018da
lea eax, [ebp - 0x234]
push ebx
push eax
lea eax, [ebp - 0x9c]
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x50018da
lea eax, [ebp - 0x68]
mov dword [ebp - 0x38], eax
cmp byte [0x5007260], bl
mov esi, 0x5007260
je 0x5001910
push ebx
push dword [ebp - 0x38]
push esi
call fcn.050021a8
test eax, eax
jne 0x50018fd
mov byte [0x5007260], bl
jmp 0x5001904
mov dword [ebp - 0x28], 1
cmp byte [0x5007260], bl
jne 0x5001b8c
cmp dword [0x5007244], ebx
jne 0x5001924
cmp dword [0x50174a4], ebx
jne 0x5001b77
push 0xffff
push 0x5007380
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov al, byte [0x5007380]
mov dword [ebp - 0x20], ebx
or al, 0x20
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x15], al
mov byte [ebp - 0x14], 0x61
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push 2
push eax
lea eax, [ebp - 8]
push eax
call sub.ntdll.dll_strncpy
add esp, 0xc
lea eax, [ebp - 0x634]
mov byte [ebp - 6], bl
push 0x400
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
cmp dword [ebp - 4], 3
je 0x500198c
cmp dword [ebp - 4], 6
jne 0x50019fb
cmp eax, ebx
je 0x50019fb
lea eax, [ebp - 0x634]
push 0x5001164
push eax
call sub.ntdll.dll__strlwr
pop ecx
push eax
call sub.ntdll.dll_strstr
pop ecx
test eax, eax
pop ecx
jne 0x50019fb
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x50019fb
mov eax, dword [ebp - 0x58]
mov cl, byte [ebp - 0x14]
imul eax, dword [ebp - 0x4c]
mul dword [ebp - 0x54]
cmp cl, byte [ebp - 0x15]
jne 0x50019e6
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
jmp 0x50019fb
cmp edx, dword [ebp - 0x30]
jb 0x50019fb
ja 0x50019f2
cmp eax, dword [ebp - 0x34]
jbe 0x50019fb
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
mov byte [ebp - 0x16], cl
inc byte [ebp - 0x14]
cmp byte [ebp - 0x14], 0x7a
jle 0x5001948
mov eax, dword [0x5007018]
cmp eax, 0xcab00eee
je 0x5001a20
cmp dword [ebp - 0x30], ebx
ja 0x5001a40
jb 0x5001a20
cmp dword [ebp - 0x34], eax
jae 0x5001a40
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x30], eax
ja 0x5001a40
jb 0x5001a32
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [ebp - 0x20]
jae 0x5001a40
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov al, byte [ebp - 0x15]
mov dword [ebp - 0x34], ecx
jmp 0x5001a43
mov al, byte [ebp - 0x16]
push 0xf0000000
mov byte [ebp - 0x14], al
push 1
push ebx
lea eax, [ebp - 0x44]
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x5001b0f
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x134]
push eax
push 0x10
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x5001ac4
lea eax, [ebp - 0x14]
push eax
push 0x5001160
push esi
call sub.ntdll.dll_sprintf
lea eax, [eax + 0x5007260]
add esp, 0xc
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x134]
push eax
push 0x500115c
push dword [ebp - 4]
call sub.ntdll.dll_sprintf
add dword [ebp - 4], 2
add esp, 0xc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x10
jb 0x5001a9b
cmp byte [0x5007260], bl
je 0x5001ae4
push 1
push dword [ebp - 0x38]
push esi
call fcn.050021a8
test eax, eax
je 0x5001aeb
mov dword [ebp - 0x28], 1
jmp 0x5001aeb
mov dword [ebp - 0xc], 1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x28], ebx
jne 0x5001b05
cmp dword [ebp - 0xc], ebx
jne 0x5001b05
cmp dword [ebp - 0x10], 0x2710
jb 0x5001a67
push ebx
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp dword [ebp - 0x28], ebx
jne 0x5001b8c
push esi
lea eax, [ebp - 0x14]
push 0x5001150
push eax
call fcn.050020f5
mov dword [ebp - 8], eax
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [ebp - 0x84]
push dword [ebp - 8]
imul eax, dword [0x5007010]
and eax, 0xffff
push eax
call fcn.050023c6
push 1
push dword [ebp - 0x38]
push esi
call fcn.050021a8
test eax, eax
jne 0x5001b85
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x5001b8c
mov dword [ebp - 0x28], 1
cmp dword [0x5007244], ebx
jne 0x5001c56
cmp dword [0x50174a4], ebx
jne 0x5001bc3
push ebx
push 3
push ebx
push dword [0x5007010]
call sub.ntdll.dll__allmul
cmp dword [ebp - 0x30], edx
ja 0x5001c56
jb 0x5001bc3
cmp dword [ebp - 0x34], eax
jae 0x5001c56
push ebx
push 0x50026bd
push dword [0x50174a8]
push 0x6b
push ebx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5001be2
push eax
jmp 0x5001bef
cmp esi, ebx
je 0x5001bea
cmp byte [esi], bl
jne 0x5001bf4
push 0x4c7
call fcn.05002484
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x104
jb 0x5001c0e
push 0x52
call fcn.05002484
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, 0x5007260
mov edx, ecx
mov esi, edi
mov edi, eax
push dword [ebp - 0x38]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.050021a8
test eax, eax
je 0x5001c47
mov dword [ebp - 0x28], 1
cmp dword [ebp - 0x28], ebx
je 0x5001bc3
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
cmp dword [ebp - 0x28], ebx
jne 0x5001c75
push 1
push dword [ebp - 0x38]
push 0x5007260
call fcn.050021a8
test eax, eax
jne 0x5001c75
push 0x52
call fcn.05002484
cmp dword [0x5017388], ebx
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
jne 0x5001d1b
push 0x104
push 0x5007020
push 0x20000004
push ebx
call esi
push 0x104
push 0x5007140
push 0x20000006
push ebx
call esi
push 0x5007020
push ebx
push 0xc
push 0x65
push dword [0x50174a8]
call edi
push 0x5007140
push ebx
push 0xc
push 0x66
push dword [0x50174a8]
call edi
push 0x5007260
push ebx
push 0xc
push 0x69
push dword [0x50174a8]
call edi
push ebx
push ebx
push 0x402
push 0x6a
push dword [0x50174a8]
call edi
movzx eax, word [ebp - 0xbe]
shl eax, 0x10
push eax
push ebx
push 0x401
push 0x6a
push dword [0x50174a8]
call edi
push 5
push dword [0x50174a8]
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push ebx
push 0x5001efc
push ebx
push 0x5001178
push 0x50173a0
push dword [ebp - 0x24]
call fcn.05002e3e
add esp, 0x1c
cmp eax, ebx
jne 0x5001d46
push 0x20000001
call fcn.05002484
cmp dword [0x5007244], ebx
jne 0x5001d60
cmp dword [0x50174a8], ebx
jne 0x5001d60
push 0x4c7
call fcn.05002484
cmp dword [0x50174ac], ebx
je 0x5001e9a
cmp dword [0x50174a4], ebx
jne 0x5001e9a
cmp dword [0x5017388], ebx
jne 0x5001d93
push dword [0x5017380]
push ebx
push 0xc
push 0x68
push dword [0x50174a8]
call edi
mov edi, dword [0x50174ac]
or ecx, 0xffffffff
xor eax, eax
mov edx, 0x5007020
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x11
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x3c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov dword [ebp - 0x3c], eax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x3c]
dec edi
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop ecx
lea edi, [ebp - 0x114]
push 1
rep stosd dword es:[edi], eax
pop eax
mov dword [ebp - 0x114], 0x44
mov dword [ebp - 0xe8], eax
mov word [ebp - 0xe4], ax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x114]
push eax
push dword [0x500724c]
push ebx
push 0x20
push ebx
push ebx
push ebx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, ebx
jne 0x5001e3c
push 0xffffffffffffffff
call fcn.05002484
cmp dword [0x5017388], ebx
jne 0x5001e51
push ebx
push dword [0x50174a8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x78]
push 0xffffffffffffffff
push eax
mov dword [0x5007364], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x40]
mov dword [0x5007364], ebx
push eax
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x78]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x74]
call esi
cmp dword [ebp - 0x40], 0xcabf00d1
jne 0x5001e93
mov dword [ebp - 0x40], ebx
jmp 0x5001ed5
call fcn.05002521
jmp 0x5001ed5
cmp dword [0x5007244], ebx
jne 0x5001ed5
push ebx
push dword [0x50174a8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, 0x5007020
push 0x104
push edi
push 0x20000002
push ebx
call esi
push 0x10030
push edi
push edi
push dword [0x50174a8]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [0x500701c], ebx
je 0x5001eee
push 0x50174c0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [0x500701c], ebx
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_ExitProcess]