Function at 0x404700
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Delete file
Schedule task via itaskservice

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4344b0
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x2b8
mov eax, dword [0x446018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x1e0], edi
mov dword [ebp - 0x1f8], ecx
push 0
push 0
mov dword [ebp - 0x1f4], 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0
push 0
push 0
push 3
push 6
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [ebp - 0x1e4]
mov dword [ebp - 0x1e4], 0
push eax
push 0x436168
push 1
push 0
push 0x436178
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
je 0x4047bf
mov ecx, dword [ebp - 0x1e4]
test ecx, ecx
je 0x4048d8
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
xor al, al
jmp 0x405864
mov eax, dword [ebp - 0x1e4]
mov eax, dword [eax]
mov esi, dword [eax + 0x28]
lea eax, [ebp - 0xf0]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x108]
movups xmm0, xmmword [ebp - 0xf0]
push eax
movups xmmword [ebp - 0x30], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [ebp - 0x108]
lea eax, [ebp - 0x218]
push eax
movups xmmword [ebp - 0xd8], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [ebp - 0x218]
lea eax, [ebp - 0x208]
push eax
movups xmmword [ebp - 0x60], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 3
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x30]
mov eax, esp
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xd8]
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0x60]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0x208]
push dword [ebp - 0x1e4]
movups xmmword [eax], xmm0
call esi
mov esi, eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0xf0]
mov dword [ebp - 4], 0xffffffff
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 0x1e4]
test esi, esi
jne 0x4047aa
lea edx, [ebp - 0x1e8]
mov dword [ebp - 0x1e8], esi
mov eax, dword [ecx]
push edx
push 0x440484
push ecx
call dword [eax + 0x1c]
mov ecx, dword [ebp - 0x1e8]
test ecx, ecx
jne 0x4048df
xor al, al
jmp 0x405864
cmp byte [ebx + 0x10], 0
jne 0x405844
mov ecx, dword [ebp - 0x1e4]
lea edx, [ebp - 0x1ec]
push edx
mov dword [ebp - 0x1ec], 0
push 0
mov eax, dword [ecx]
push ecx
call dword [eax + 0x24]
lea ecx, [ebp - 0x1d8]
call fcn.004151e0
lea ecx, [ebp - 0x68]
mov dword [ebp - 4], 4
call fcn.00404670
mov edi, eax
mov byte [ebp - 4], 5
cmp dword [edi + 0x14], 8
jb 0x404930
mov edi, dword [edi]
mov esi, edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x404935
sub esi, ecx
lea ecx, [ebp - 0x1d8]
sar esi, 1
call fcn.0040a630
lea ecx, [ebp - 0x1d8]
call fcn.0040a5b0
mov edx, dword [ebp - 0x1d8]
lea eax, [ebp - 0x1d4]
push eax
sub esp, 0x10
lea eax, [esi + esi]
lea ecx, [ebp - 0x204]
push eax
push edi
push edx
call fcn.0040a0d0
add esp, 0x20
cmp dword [ebp - 0x1d8], 0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x54]
sete al
mov byte [ebp - 0x1d9], al
cmp ecx, 8
jb 0x4049d2
mov edx, dword [ebp - 0x68]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4049c2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405882
push ecx
push edx
call fcn.00416977
mov al, byte [ebp - 0x1d9]
add esp, 8
test al, al
je 0x4049e2
mov byte [ebp - 0x1d9], 0
jmp 0x405810
push dword [ebp - 0x1f8]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x50], 0x610054
sub esp, 0xc
mov dword [ebp - 0x4c], 0x6b0073
mov ecx, esp
mov dword [ebp - 0x48], 0x41002f
lea edx, [ebp - 0x50]
mov dword [ebp - 0x44], 0x740063
mov dword [ebp - 0x40], 0x6f0069
push ecx
push eax
push edx
mov dword [ebp - 0x3c], 0x73006e
mov dword [ebp - 0x38], 0x45002f
mov dword [ebp - 0x34], 0x650078
mov dword [ebp - 0x30], 0x2f0063
mov dword [ebp - 0x2c], 0x6f0043
mov dword [ebp - 0x28], 0x6d006d
mov dword [ebp - 0x24], 0x6e0061
mov dword [ebp - 0x20], 0x64
call fcn.00406590
lea ecx, [ebp - 0x68]
call fcn.004042a0
add esp, 0xc
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 8
jb 0x404a6d
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x1d8]
call fcn.00415590
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x54]
cmp ecx, 8
jb 0x404ab7
mov edx, dword [ebp - 0x68]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x404aad
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405887
push ecx
push edx
call fcn.00416977
add esp, 8
push 0x440838
push str.Task_Settings_StopIfGoingOnBatteries
lea ecx, [ebp - 0x1d8]
call fcn.00415590
push 1
xorps xmm0, xmm0
mov dword [ebp - 0xb8], 0
push 0x440484
lea ecx, [ebp - 0xc8]
mov dword [ebp - 0xb4], 0
movups xmmword [ebp - 0xc8], xmm0
call fcn.00406fc0
mov edi, dword [ebp - 0x1e0]
mov ecx, edi
mov byte [ebp - 4], 7
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404b10
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0xc8]
call fcn.00403050
cmp dword [ebp - 0xb4], 8
lea esi, [ebp - 0xc8]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x50], 0x610054
cmovae esi, dword [ebp - 0xc8]
lea edx, [ebp - 0x50]
sub esp, 0xc
mov dword [ebp - 0x4c], 0x6b0073
mov ecx, esp
mov dword [ebp - 0x48], 0x52002f
mov dword [ebp - 0x44], 0x670065
mov dword [ebp - 0x40], 0x730069
push ecx
push eax
push edx
mov dword [ebp - 0x3c], 0x720074
mov dword [ebp - 0x38], 0x740061
mov dword [ebp - 0x34], 0x6f0069
mov dword [ebp - 0x30], 0x49006e
mov dword [ebp - 0x2c], 0x66006e
mov dword [ebp - 0x28], 0x2f006f
mov dword [ebp - 0x24], 0x520055
mov dword [ebp - 0x20], 0x49
call fcn.00406590
lea ecx, [ebp - 0x68]
call fcn.004042a0
add esp, 0xc
mov byte [ebp - 4], 8
cmp dword [eax + 0x14], 8
jb 0x404bc5
mov eax, dword [eax]
push esi
push eax
lea ecx, [ebp - 0x1d8]
call fcn.00415590
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x54]
cmp ecx, 8
jb 0x404c10
mov edx, dword [ebp - 0x68]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x404c06
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40588c
push ecx
push edx
call fcn.00416977
add esp, 8
cmp dword [ebp - 0xb4], 8
lea eax, [ebp - 0xc8]
mov dword [ebp - 0xb8], 0
cmovae eax, dword [ebp - 0xc8]
xor ecx, ecx
mov word [eax], cx
cmp byte [ebx + 0xc], cl
jne 0x404c44
push ecx
lea ecx, [ebp - 0x1d8]
call fcn.00415520
sub esp, 0xc
mov dword [ebp - 0x40], 0x6e0049
mov ecx, esp
mov dword [ebp - 0x3c], 0x650074
lea eax, [ebp - 0x1e]
mov dword [ebp - 0x38], 0x610072
lea edx, [ebp - 0x40]
mov dword [ebp - 0x34], 0x740063
push ecx
push eax
push edx
mov dword [ebp - 0x30], 0x760069
mov dword [ebp - 0x2c], 0x540065
mov dword [ebp - 0x28], 0x6b006f
mov dword [ebp - 0x24], 0x6e0065
mov word [ebp - 0x20], 0
call fcn.00406590
lea ecx, [ebp - 0xe0]
call fcn.004042a0
add esp, 0xc
mov esi, eax
mov byte [ebp - 4], 9
cmp dword [esi + 0x14], 8
jb 0x404cb1
mov esi, dword [esi]
sub esp, 0xc
mov dword [ebp - 0xb0], 0x610054
mov ecx, esp
mov dword [ebp - 0xac], 0x6b0073
lea eax, [ebp - 0x68]
mov dword [ebp - 0xa8], 0x50002f
lea edx, [ebp - 0xb0]
mov dword [ebp - 0xa4], 0x690072
push ecx
push eax
push edx
mov dword [ebp - 0xa0], 0x63006e
mov dword [ebp - 0x9c], 0x700069
mov dword [ebp - 0x98], 0x6c0061
mov dword [ebp - 0x94], 0x2f0073
mov dword [ebp - 0x90], 0x720050
mov dword [ebp - 0x8c], 0x6e0069
mov dword [ebp - 0x88], 0x690063
mov dword [ebp - 0x84], 0x610070
mov dword [ebp - 0x80], 0x2f006c
mov dword [ebp - 0x7c], 0x6f004c
mov dword [ebp - 0x78], 0x6f0067
mov dword [ebp - 0x74], 0x54006e
mov dword [ebp - 0x70], 0x700079
mov dword [ebp - 0x6c], 0x65
call fcn.00406590
lea ecx, [ebp - 0x68]
call fcn.004042a0
add esp, 0xc
mov byte [ebp - 4], 0xa
cmp dword [eax + 0x14], 8
jb 0x404d80
mov eax, dword [eax]
push esi
push eax
lea ecx, [ebp - 0x1d8]
call fcn.00415590
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x54]
cmp ecx, 8
jb 0x404dcb
mov edx, dword [ebp - 0x68]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x404dc1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405891
push ecx
push edx
call fcn.00416977
add esp, 8
xor eax, eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0xcc]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
cmp ecx, 8
jb 0x404e23
mov edx, dword [ebp - 0xe0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x404e19
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405891
push ecx
push edx
call fcn.00416977
add esp, 8
cmp byte [ebx + 8], 0
je 0x40500b
sub esp, 0xc
mov dword [ebp - 0x40], 0x690048
mov ecx, esp
mov dword [ebp - 0x3c], 0x680067
lea eax, [ebp - 0x1e]
mov dword [ebp - 0x38], 0x730065
lea edx, [ebp - 0x40]
mov dword [ebp - 0x34], 0x410074
push ecx
push eax
push edx
mov dword [ebp - 0x30], 0x610076
mov dword [ebp - 0x2c], 0x6c0069
mov dword [ebp - 0x28], 0x620061
mov dword [ebp - 0x24], 0x65006c
mov word [ebp - 0x20], 0
call fcn.00406590
lea ecx, [ebp - 0xe0]
call fcn.004042a0
add esp, 0xc
mov esi, eax
mov byte [ebp - 4], 0xb
cmp dword [esi + 0x14], 8
jb 0x404e9a
mov esi, dword [esi]
sub esp, 0xc
mov dword [ebp - 0xb0], 0x610054
mov ecx, esp
mov dword [ebp - 0xac], 0x6b0073
lea eax, [ebp - 0x6a]
mov dword [ebp - 0xa8], 0x50002f
lea edx, [ebp - 0xb0]
mov dword [ebp - 0xa4], 0x690072
push ecx
push eax
push edx
mov dword [ebp - 0xa0], 0x63006e
mov dword [ebp - 0x9c], 0x700069
mov dword [ebp - 0x98], 0x6c0061
mov dword [ebp - 0x94], 0x2f0073
mov dword [ebp - 0x90], 0x720050
mov dword [ebp - 0x8c], 0x6e0069
mov dword [ebp - 0x88], 0x690063
mov dword [ebp - 0x84], 0x610070
mov dword [ebp - 0x80], 0x2f006c
mov dword [ebp - 0x7c], 0x750052
mov dword [ebp - 0x78], 0x4c006e
mov dword [ebp - 0x74], 0x760065
mov dword [ebp - 0x70], 0x6c0065
mov word [ebp - 0x6c], 0
call fcn.00406590
lea ecx, [ebp - 0x68]
call fcn.004042a0
add esp, 0xc
mov byte [ebp - 4], 0xc
cmp dword [eax + 0x14], 8
jb 0x404f68
mov eax, dword [eax]
push esi
push eax
lea ecx, [ebp - 0x1d8]
call fcn.00415590
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x54]
cmp ecx, 8
jb 0x404fb3
mov edx, dword [ebp - 0x68]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x404fa9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405896
push ecx
push edx
call fcn.00416977
add esp, 8
xor eax, eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0xcc]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
cmp ecx, 8
jb 0x40500b
mov edx, dword [ebp - 0xe0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x405001
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405896
push ecx
push edx
call fcn.00416977
add esp, 8
cmp dword [ebp - 0xb4], 8
lea eax, [ebp - 0xc8]
mov dword [ebp - 0xb8], 0
cmovae eax, dword [ebp - 0xc8]
xor ecx, ecx
mov word [eax], cx
push ecx
lea ecx, [ebp - 0x2c8]
mov byte [ebp - 4], 0xd
call fcn.004061e0
lea eax, [ebp - 0x2b8]
mov dword [ebp - 0x214], 0x4411c4
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x20c], eax
push 8
push ecx
push 0x4413d8
lea eax, [ebp - 0x214]
mov byte [ebp - 4], 0xf
push eax
lea ecx, [ebp - 0x1d8]
call fcn.0040a6a0
mov dword [ebp - method.pugi::xml_writer.virtual_0], vtable.pugi::xml_writer.0
mov byte [ebp - 4], 0x10
xor eax, eax
mov edx, dword [ebp - 0x274]
xorps xmm0, xmm0
movups xmmword [ebp - 0x68], xmm0
mov word [ebp - 0x68], ax
mov dword [ebp - 0x1fc], eax
mov eax, edx
and al, 0x22
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 7
mov dword [ebp - 0x1f4], 4
movq qword [ebp - 0x204], xmm0
cmp al, 2
je 0x4050f2
mov eax, dword [ebp - 0x290]
mov ecx, dword [eax]
test ecx, ecx
je 0x4050f2
cmp ecx, dword [ebp - 0x278]
mov eax, dword [ebp - 0x2a0]
cmovb ecx, dword [ebp - 0x278]
mov edx, dword [eax]
sub ecx, edx
sar ecx, 1
jmp 0x405129
test dl, 4
jne 0x40511d
mov eax, dword [ebp - 0x294]
mov esi, dword [eax]
test esi, esi
je 0x40511d
mov eax, dword [ebp - 0x2a4]
mov edx, dword [eax]
mov eax, dword [ebp - 0x284]
mov ecx, dword [eax]
add ecx, ecx
sub ecx, edx
add ecx, esi
sar ecx, 1
jmp 0x405129
mov ecx, dword [ebp - 0x200]
mov edx, dword [ebp - 0x204]
test edx, edx
je 0x405137
push ecx
push edx
lea ecx, [ebp - 0x68]
call fcn.00402f00
mov dword [ebp - 4], 0xe
lea ecx, [ebp - 0x2c8]
mov eax, dword [ebp - 0x2c8]
xor edx, edx
push 0
mov dword [ebp - 0x1f4], 3
add ecx, dword [eax + 4]
mov eax, 4
cmp dword [ecx + 0x38], edx
cmovne eax, edx
push eax
call fcn.00404150
lea ecx, [ebp - 0x2c8]
mov byte [ebp - 4], 0xd
call fcn.004043d0
mov ecx, dword [ebp - 0xb4]
cmp ecx, 8
jb 0x4051bb
mov edx, dword [ebp - 0xc8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4051b1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40589b
push ecx
push edx
call fcn.00416977
add esp, 8
movups xmm1, xmmword [ebp - 0x68]
lea ecx, [ebp - 0xc8]
movq xmm0, qword [ebp - 0x58]
mov byte [ebp - 4], 7
mov esi, dword [ebp - 0x1ec]
movq qword [ebp - 0xb8], xmm0
cmp dword [ebp - 0xb4], 8
movups xmmword [ebp - 0xc8], xmm1
mov eax, dword [esi]
mov edx, dword [eax + 0x50]
movd eax, xmm1
cmovae ecx, eax
push ecx
push esi
call edx
cmp dword [ebp - 0xb4], 8
lea eax, [ebp - 0xc8]
mov dword [ebp - 0xb8], 0
cmovae eax, dword [ebp - 0xc8]
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x1f0], ecx
mov eax, dword [eax]
mov esi, dword [eax + 0x44]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [ebp - 0x208]
lea eax, [ebp - 0x108]
push eax
movups xmmword [ebp - 0x60], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [ebp - 0x108]
lea eax, [ebp - 0xf0]
push eax
movups xmmword [ebp - 0xd8], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x1f0]
movups xmm0, xmmword [ebp - 0x60]
push eax
sub esp, 0x10
mov eax, esp
push 0
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xd8]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0xf0]
push 6
push dword [ebp - 0x1ec]
movups xmmword [eax], xmm0
push 0
push dword [ebp - 0x1e8]
call esi
mov esi, eax
lea eax, [ebp - 0xf0]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x208]
mov byte [ebp - 4], 7
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 0x1f0]
test ecx, ecx
je 0x4052fe
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x1f0], 0
mov ecx, dword [ebp - 0x1ec]
test ecx, ecx
je 0x405318
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x1ec], 0
mov ecx, dword [ebp - 0x1e8]
test ecx, ecx
je 0x405332
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x1e8], 0
test esi, esi
js 0x405342
mov byte [ebp - 0x1d9], 1
jmp 0x4057af
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405347
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0xc8]
call fcn.00402f00
push 4
push str..xml
lea ecx, [ebp - 0xc8]
call fcn.00403050
cmp dword [ebp - 0xb4], 8
lea eax, [ebp - 0xc8]
lea ecx, [ebp - 0x1d8]
cmovae eax, dword [ebp - 0xc8]
push eax
call fcn.00415370
push 0x10
xorps xmm0, xmm0
mov dword [ebp - 0xd0], 0
push str._create__F__TN__
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0xcc], 0
movups xmmword [ebp - 0xe0], xmm0
call fcn.00406fc0
mov ecx, edi
mov byte [ebp - 4], 0x14
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4053d0
sub ecx, edx
mov eax, 0x7ffffffe
mov edx, dword [ebp - 0xd0]
sub eax, edx
sar ecx, 1
cmp eax, ecx
jb 0x4058a0
cmp dword [ebp - 0xcc], 8
lea eax, [ebp - 0xe0]
push ecx
cmovae eax, dword [ebp - 0xe0]
push edi
push edx
push eax
push ecx
push dword [ebp - 0x1e0]
lea ecx, [ebp - 0x110]
call fcn.004073b0
push 9
push 0x4408e4
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 0x15
call fcn.00403050
mov dword [ebp - 0x24], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x20], 0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x34], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x24], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0xc8]
cmp dword [ebp - 0xb4], 8
lea ecx, [ebp - 0x34]
push dword [ebp - 0xb8]
cmovae eax, dword [ebp - 0xc8]
push eax
call fcn.00403050
mov dword [ebp - 0x58], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x68], xmm0
mov dword [ebp - 0x54], 0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x68], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x58], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 1
push 0x4408e0
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x17
call fcn.00403050
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xf8], xmm0
movq xmm0, qword [eax + 0x10]
mov word [eax], cx
lea ecx, [ebp - 0xe0]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
lea eax, [ebp - 0xf8]
push eax
movq qword [ebp - 0xe8], xmm0
call fcn.00406660
mov ecx, dword [ebp - 0xe4]
cmp ecx, 8
jb 0x40555c
mov edx, dword [ebp - 0xf8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x405552
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4058a5
push ecx
push edx
call fcn.00416977
add esp, 8
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x54]
cmp ecx, 8
jb 0x40559a
mov edx, dword [ebp - 0x68]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x405590
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4058a5
push ecx
push edx
call fcn.00416977
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
cmp ecx, 8
jb 0x4055ec
mov edx, dword [ebp - 0x34]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4055e2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4058a5
push ecx
push edx
call fcn.00416977
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0xfc]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
cmp ecx, 8
jb 0x405644
mov edx, dword [ebp - 0x110]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40563a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4058a5
push ecx
push edx
call fcn.00416977
add esp, 8
cmp dword [ebp - 0xcc], 8
lea esi, [ebp - 0xe0]
lea eax, [ebp - 0x52]
mov dword [ebp - 0x64], 0x630073
cmovae esi, dword [ebp - 0xe0]
lea edx, [ebp - 0x64]
sub esp, 0xc
mov dword [ebp - 0x60], 0x740068
mov ecx, esp
mov dword [ebp - 0x5c], 0x730061
mov dword [ebp - 0x58], 0x73006b
mov word [ebp - 0x54], 0
push ecx
push eax
push edx
call fcn.00406590
lea ecx, [ebp - 0x34]
call fcn.004042a0
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x4056a0
mov eax, dword [eax]
push 0
push 0
push esi
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x20]
cmp ecx, 8
jb 0x4056ed
mov edx, dword [ebp - 0x34]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4056e3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4058aa
push ecx
push edx
call fcn.00416977
add esp, 8
cmp dword [ebp - 0xb4], 8
lea eax, [ebp - 0xc8]
cmovae eax, dword [ebp - 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0xcc], 8
lea eax, [ebp - 0xe0]
mov dword [ebp - 0xd0], 0
cmovae eax, dword [ebp - 0xe0]
xor ecx, ecx
mov byte [ebp - 0x1d9], cl
mov word [eax], cx
lea eax, [ebp - 0xc8]
cmp dword [ebp - 0xb4], 8
mov dword [ebp - 0xb8], ecx
cmovae eax, dword [ebp - 0xc8]
mov byte [ebp - 4], 7
mov word [eax], cx
mov ecx, dword [ebp - 0xcc]
cmp ecx, 8
jb 0x405792
mov edx, dword [ebp - 0xe0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x405788
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4058af
push ecx
push edx
call fcn.00416977
add esp, 8
xor eax, eax
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0xcc], 7
mov word [ebp - 0xe0], ax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0xb4]
cmp ecx, 8
jb 0x4057f3
mov edx, dword [ebp - 0xc8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4057e9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4058af
push ecx
push edx
call fcn.00416977
add esp, 8
xor eax, eax
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 7
mov word [ebp - 0xc8], ax
lea ecx, [ebp - 0x1d8]
mov dword [ebp - 4], 0x18
call fcn.0040a630
lea ecx, [ebp - 0x1d8]
call fcn.0040a5b0
lea ecx, [ebp - 0x1d8]
mov byte [ebp - 4], 0x19
call fcn.0040a630
mov al, byte [ebp - 0x1d9]
jmp 0x405864
mov eax, dword [ecx]
push 0
push edi
push ecx
call dword [eax + 0x3c]
mov edx, dword [ebp - 0x1e8]
mov esi, eax
test edx, edx
je 0x40585f
mov ecx, dword [edx]
push edx
call dword [ecx + 8]
test esi, esi
setns al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004166e8
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0041b8b8
call fcn.0041b8b8
call fcn.0041b8b8
call fcn.0041b8b8
call fcn.0041b8b8
call fcn.0041b8b8
call fcn.004011c0
call fcn.0041b8b8
call fcn.0041b8b8
call fcn.0041b8b8
int3