Function at 0x401015
Capabilities:
Create directory
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x377d0
call fcn.00405e20
push edi
mov al, byte [0xf0d6ac]
mov byte [ebp - 0x66a8], al
xor ecx, ecx
mov dword [ebp - 0x66a7], ecx
mov dword [ebp - 0x66a3], ecx
mov dword [ebp - 0x669f], ecx
mov byte [ebp - 0x669b], cl
mov dl, byte [0xf0d6b0]
mov byte [ebp - 0x37668], dl
mov ecx, 0xc34f
xor eax, eax
lea edi, [ebp - 0x37667]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0xf0d6b4]
mov byte [ebp - 0x6698], al
mov ecx, 0x1869
xor eax, eax
lea edi, [ebp - 0x6697]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0xf0d6b8]
mov byte [ebp - 0x114], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0xf0d6bc]
mov byte [ebp - 0x377d0], dl
mov ecx, 0x59
xor eax, eax
lea edi, [ebp - 0x377cf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x67b4], 0
mov dword [ebp - 0x68bc], 0
mov dword [ebp - 0x68d4], 0
mov dword [ebp - 0x67b0], 0
mov al, byte [0xf0d6c0]
mov byte [ebp - 0x4b0], al
mov ecx, 0x59
xor eax, eax
lea edi, [ebp - 0x4af]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0xf0d6c4]
mov byte [ebp - 0x218], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x217]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0xf0d6c8]
mov byte [ebp - 0x68b8], dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x68b7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0xf0d6cc]
mov byte [ebp - 0x67ac], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x67ab]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0xf0d6d0]
mov byte [ebp - 0x334], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0xf0d6d4]
mov byte [ebp - 0x6904], dl
mov ecx, 9
xor eax, eax
lea edi, [ebp - 0x6903]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0xf0d6d8]
mov byte [ebp - 0x68d0], al
xor ecx, ecx
mov dword [ebp - 0x68cf], ecx
mov dword [ebp - 0x68cb], ecx
mov dword [ebp - 0x68c7], ecx
mov dword [ebp - 0x68c3], ecx
mov word [ebp - 0x68bf], cx
mov byte [ebp - 0x68bd], cl
mov dl, byte [0xf0d6dc]
mov byte [ebp - 0x6918], dl
xor eax, eax
mov dword [ebp - 0x6917], eax
mov dword [ebp - 0x6913], eax
mov dword [ebp - 0x690f], eax
mov word [ebp - 0x690b], ax
mov cl, byte [0xf0d6e0]
mov byte [ebp - 0x10], cl
xor edx, edx
mov dword [ebp - 0xf], edx
mov dword [ebp - 0xb], edx
mov dword [ebp - 7], edx
mov word [ebp - 3], dx
mov al, byte [0xf0d6e4]
mov byte [ebp - 0x230], al
xor ecx, ecx
mov dword [ebp - 0x22f], ecx
mov dword [ebp - 0x22b], ecx
mov dword [ebp - 0x227], ecx
mov word [ebp - 0x223], cx
mov dl, byte [0xf0d6e8]
mov byte [ebp - 0x6928], dl
xor eax, eax
mov dword [ebp - 0x6927], eax
mov dword [ebp - 0x6923], eax
mov dword [ebp - 0x691f], eax
mov word [ebp - 0x691b], ax
mov dword [ebp - 0x348], 0
mov dword [ebp - 0x340], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x33c], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x344], 0
mov dword [ebp - 0x68dc], 0
mov dword [ebp - 0x6908], 0
mov dword [ebp - 0x68d8], 0
mov dword [0xf0d284], 0x93b
mov dword [ebp - 0x4b4], 0
push 0x104
push 0xf0a738
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x67b4], eax
mov ecx, dword [ebp + 8]
push ecx
push 0xf07e20
call fcn.00405c00
add esp, 8
push 0xf0a738
call fcn.00405d50
add esp, 4
mov dword [ebp - 0x67b4], eax
jmp 0x40131c
mov edx, dword [ebp - 0x67b4]
sub edx, 1
mov dword [ebp - 0x67b4], edx
cmp dword [ebp - 0x67b4], 1
jle 0x40136f
push 1
mov eax, dword [ebp - 0x67b4]
push eax
push 0xf0a738
call fcn.00404f05
add esp, 0xc
push eax
call fcn.00404ea1
add esp, 4
cmp eax, 0x5c
jne 0x40136d
mov ecx, dword [ebp - 0x67b4]
push ecx
push 0xf0a738
call fcn.00405041
add esp, 8
push eax
push 0xf0bac0
call fcn.00405c00
add esp, 8
jmp 0x40136f
jmp 0x40130d
push str._____67097
push 0xf0d244
call fcn.00405c00
add esp, 8
push str.aRCheliFUN
push 0xf0d238
call fcn.00405c00
add esp, 8
mov dword [ebp - 0x67b4], 1
jmp 0x4013ae
mov edx, dword [ebp - 0x67b4]
add edx, 1
mov dword [ebp - 0x67b4], edx
cmp dword [ebp - 0x67b4], 0xb
jge 0x4013e5
push 1
mov eax, dword [ebp - 0x67b4]
push eax
push 0xf0d238
call fcn.00404f05
add esp, 0xc
push eax
call fcn.00404ea1
add esp, 4
mov ecx, dword [ebp - 0x67b4]
mov dword [ecx*4 + 0x40ed64], eax
jmp 0x40139f
push 1
call fcn.004052ec
add esp, 4
mov dword [ebp - 0x67b4], eax
mov edx, dword [ebp - 0x67b4]
push edx
push 0x40e048
push 0xf0d1bc
call fcn.00405cf0
add esp, 0xc
push 5
push 0xf0d1bc
call fcn.00405097
add esp, 8
push eax
push 0xf0d1e4
call fcn.00405c00
add esp, 8
fild dword [ebp - 0x67b4]
sub esp, 8
fstp qword [esp]
call fcn.00404ebe
add esp, 8
push eax
push 0xf0d1bc
call fcn.00405c00
add esp, 8
push 5
push 0xf0d1bc
call fcn.00405097
add esp, 8
push eax
push 0xf0d20c
call fcn.00405c00
add esp, 8
mov dword [ebp - 0x67b4], 0
mov dword [0xf0d284], 0x1276
push 0xf0d6ec
push 0xf0677c
call fcn.00405c00
add esp, 8
push 0xf0d6f0
lea eax, [ebp - 0x218]
push eax
call fcn.00405c00
add esp, 8
push 0xf0677c
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x4b4], eax
mov ecx, dword [ebp - 0x4b4]
push ecx
push 0xf0677c
call fcn.00405041
add esp, 8
push eax
push 0xf0677c
call fcn.00405c00
add esp, 8
push 0x72
call fcn.00404e45
add esp, 4
push eax
push 0x65
call fcn.00404e45
add esp, 4
push eax
push 0x64
call fcn.00404e45
add esp, 4
push eax
push 0x6c
call fcn.00404e45
add esp, 4
push eax
push 0x6f
call fcn.00404e45
add esp, 4
push eax
push 0x66
call fcn.00404e45
add esp, 4
push eax
push 0x61
call fcn.00404e45
add esp, 4
push eax
push 0xf0677c
push 0x40e04c
push 0xf06984
call fcn.00405cf0
add esp, 0x28
push 0
push 0xf06984
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x67b4], eax
push 0x70
call fcn.00404e45
add esp, 4
push eax
push 0x6d
call fcn.00404e45
add esp, 4
push eax
push 0x74
call fcn.00404e45
add esp, 4
push eax
push 0x79
call fcn.00404e45
add esp, 4
push eax
push 0xf0677c
push 0x40e060
push 0xf06880
call fcn.00405cf0
add esp, 0x1c
push 0
push 0xf06880
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x67b4], eax
mov dword [ebp - 0x67b4], 0
push 0x2e
call fcn.00404e45
add esp, 4
push eax
lea edx, [ebp - 0x6918]
push edx
call fcn.00405c00
add esp, 8
push 0x62
call fcn.00404e45
add esp, 4
push eax
lea eax, [ebp - 0x6918]
push eax
call fcn.00405c10
add esp, 8
push 0x61
call fcn.00404e45
add esp, 4
push eax
lea ecx, [ebp - 0x6918]
push ecx
call fcn.00405c10
add esp, 8
push 0x74
call fcn.00404e45
add esp, 4
push eax
lea edx, [ebp - 0x6918]
push edx
call fcn.00405c10
add esp, 8
push 0x2e
call fcn.00404e45
add esp, 4
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00405c00
add esp, 8
push 0x65
call fcn.00404e45
add esp, 4
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.00405c10
add esp, 8
push 0x78
call fcn.00404e45
add esp, 4
push eax
lea edx, [ebp - 0x10]
push edx
call fcn.00405c10
add esp, 8
push 0x65
call fcn.00404e45
add esp, 4
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00405c10
add esp, 8
lea ecx, [ebp - 0x6918]
push ecx
push 4
call fcn.00404ae7
add esp, 4
push eax
push 0x40e06c
push 0xf06880
push 0x40e070
push 0xf0cfb4
call fcn.00405cf0
add esp, 0x18
lea edx, [ebp - 0x6918]
push edx
push 5
call fcn.00404ae7
add esp, 4
push eax
push 0x40e07c
push 0xf06880
push 0x40e080
push 0xf0d0b8
call fcn.00405cf0
add esp, 0x18
lea eax, [ebp - 0x6918]
push eax
push 1
call fcn.00404ae7
add esp, 4
push eax
push 0x40e08c
push 0xf06880
push str._s_s_s_s
push 0xf06a98
call fcn.00405cf0
add esp, 0x18
push 0xf06a98
push 0xf091a8
call fcn.00405c00
add esp, 8
push 0xf0d6f4
lea ecx, [ebp - 0x114]
push ecx
call fcn.00405c00
add esp, 8
lea edx, [ebp - 0x10]
push edx
push 2
call fcn.00404ae7
add esp, 4
push eax
push 0x40e09c
lea eax, [ebp - 0x114]
push eax
call fcn.00405cf0
add esp, 0x10
lea ecx, [ebp - 0x114]
push ecx
push 0x40e0a4
push 0xf06880
push str._s_s_s
push 0xf092ac
call fcn.00405cf0
add esp, 0x14
push 0x73
call fcn.00404e45
add esp, 4
push eax
lea edx, [ebp - 0x67ac]
push edx
call fcn.00405c00
add esp, 8
push 0x65
call fcn.00404e45
add esp, 4
push eax
lea eax, [ebp - 0x67ac]
push eax
call fcn.00405c10
add esp, 8
push 0x74
call fcn.00404e45
add esp, 4
push eax
lea ecx, [ebp - 0x67ac]
push ecx
call fcn.00405c10
add esp, 8
push 0x20
call fcn.00404e45
add esp, 4
push eax
lea edx, [ebp - 0x67ac]
push edx
call fcn.00405c10
add esp, 8
push 0x7a
call fcn.00404e45
add esp, 4
push eax
lea eax, [ebp - 0x67ac]
push eax
call fcn.00405c10
add esp, 8
push 0x74
call fcn.00404e45
add esp, 4
push eax
lea ecx, [ebp - 0x67ac]
push ecx
call fcn.00405c10
add esp, 8
push 0x6d
call fcn.00404e45
add esp, 4
push eax
lea edx, [ebp - 0x67ac]
push edx
call fcn.00405c10
add esp, 8
push 0x70
call fcn.00404e45
add esp, 4
push eax
lea eax, [ebp - 0x67ac]
push eax
call fcn.00405c10
add esp, 8
push 0x3d
call fcn.00404e45
add esp, 4
push eax
lea ecx, [ebp - 0x67ac]
push ecx
call fcn.00405c10
add esp, 8
push 0x73
call fcn.00404e45
add esp, 4
push eax
lea edx, [ebp - 0x334]
push edx
call fcn.00405c00
add esp, 8
push 0x65
call fcn.00404e45
add esp, 4
push eax
lea eax, [ebp - 0x334]
push eax
call fcn.00405c10
add esp, 8
push 0x74
call fcn.00404e45
add esp, 4
push eax
lea ecx, [ebp - 0x334]
push ecx
call fcn.00405c10
add esp, 8
push 0x20
call fcn.00404e45
add esp, 4
push eax
lea edx, [ebp - 0x334]
push edx
call fcn.00405c10
add esp, 8
push 0x4d
call fcn.00404e45
add esp, 4
push eax
lea eax, [ebp - 0x334]
push eax
call fcn.00405c10
add esp, 8
push 0x59
call fcn.00404e45
add esp, 4
push eax
lea ecx, [ebp - 0x334]
push ecx
call fcn.00405c10
add esp, 8
push 0x46
call fcn.00404e45
add esp, 4
push eax
lea edx, [ebp - 0x334]
push edx
call fcn.00405c10
add esp, 8
push 0x49
call fcn.00404e45
add esp, 4
push eax
lea eax, [ebp - 0x334]
push eax
call fcn.00405c10
add esp, 8
push 0x4c
call fcn.00404e45
add esp, 4
push eax
lea ecx, [ebp - 0x334]
push ecx
call fcn.00405c10
add esp, 8
push 0x45
call fcn.00404e45
add esp, 4
push eax
lea edx, [ebp - 0x334]
push edx
call fcn.00405c10
add esp, 8
push 0x53
call fcn.00404e45
add esp, 4
push eax
lea eax, [ebp - 0x334]
push eax
call fcn.00405c10
add esp, 8
push 0x3d
call fcn.00404e45
add esp, 4
push eax
lea ecx, [ebp - 0x334]
push ecx
call fcn.00405c10
add esp, 8
push 0xf06880
lea edx, [ebp - 0x67ac]
push edx
push 0x40e0b0
lea eax, [ebp - 0x218]
push eax
call fcn.00405cf0
add esp, 0x10
push 0xf06984
lea ecx, [ebp - 0x334]
push ecx
push 0x40e0b8
lea edx, [ebp - 0x68b8]
push edx
call fcn.00405cf0
add esp, 0x10
mov dword [0xf0d284], 0x8aeb
mov eax, dword [0xf0d284]
imul eax, eax, 3
mov dword [0xf0d284], eax
push 0x73
call fcn.00404e45
add esp, 4
push eax
lea ecx, [ebp - 0x67ac]
push ecx
call fcn.00405c00
add esp, 8
push 0x65
call fcn.00404e45
add esp, 4
push eax
lea edx, [ebp - 0x67ac]
push edx
call fcn.00405c10
add esp, 8
push 0x74
call fcn.00404e45
add esp, 4
push eax
lea eax, [ebp - 0x67ac]
push eax
call fcn.00405c10
add esp, 8
push 0x20
call fcn.00404e45
add esp, 4
push eax
lea ecx, [ebp - 0x67ac]
push ecx
call fcn.00405c10
add esp, 8
push 0x62
call fcn.00404e45
add esp, 4
push eax
lea edx, [ebp - 0x67ac]
push edx
call fcn.00405c10
add esp, 8
push 0x66
call fcn.00404e45
add esp, 4
push eax
lea eax, [ebp - 0x67ac]
push eax
call fcn.00405c10
add esp, 8
push 0x63
call fcn.00404e45
add esp, 4
push eax
lea ecx, [ebp - 0x67ac]
push ecx
call fcn.00405c10
add esp, 8
push 0x65
call fcn.00404e45
add esp, 4
push eax
lea edx, [ebp - 0x67ac]
push edx
call fcn.00405c10
add esp, 8
push 0x63
call fcn.00404e45
add esp, 4
push eax
lea eax, [ebp - 0x67ac]
push eax
call fcn.00405c10
add esp, 8
push 0x3d
call fcn.00404e45
add esp, 4
push eax
lea ecx, [ebp - 0x67ac]
push ecx
call fcn.00405c10
add esp, 8
push 0x61
call fcn.00404e45
add esp, 4
push eax
lea edx, [ebp - 0x6904]
push edx
call fcn.00405c00
add esp, 8
push 0x74
call fcn.00404e45
add esp, 4
push eax
lea eax, [ebp - 0x6904]
push eax
call fcn.00405c10
add esp, 8
push 0x74
call fcn.00404e45
add esp, 4
push eax
lea ecx, [ebp - 0x6904]
push ecx
call fcn.00405c10
add esp, 8
push 0x72
call fcn.00404e45
add esp, 4
push eax
lea edx, [ebp - 0x6904]
push edx
call fcn.00405c10
add esp, 8
push 0x69
call fcn.00404e45
add esp, 4
push eax
lea eax, [ebp - 0x6904]
push eax
call fcn.00405c10
add esp, 8
push 0x62
call fcn.00404e45
add esp, 4
push eax
lea ecx, [ebp - 0x6904]
push ecx
call fcn.00405c10
add esp, 8
push 0x20
call fcn.00404e45
add esp, 4
push eax
lea edx, [ebp - 0x6904]
push edx
call fcn.00405c10
add esp, 8
push 0x2b
call fcn.00404e45
add esp, 4
push eax
lea eax, [ebp - 0x6904]
push eax
call fcn.00405c10
add esp, 8
push 0x68
call fcn.00404e45
add esp, 4
push eax
lea ecx, [ebp - 0x6904]
push ecx
call fcn.00405c10
add esp, 8
push 0x20
call fcn.00404e45
add esp, 4
push eax
lea edx, [ebp - 0x6904]
push edx
call fcn.00405c10
add esp, 8
push 0xf06880
lea eax, [ebp - 0x6904]
push eax
push 0x40e0c0
lea ecx, [ebp - 0x377d0]
push ecx
call fcn.00405cf0
add esp, 0x10
push 0xd
call fcn.00404e45
add esp, 4
push eax
push 0xf0ce4c
call fcn.00405c00
add esp, 8
push 0xa
call fcn.00404e45
add esp, 4
push eax
push 0xf0ce4c
call fcn.00405c10
add esp, 8
lea edx, [ebp - 0x377d0]
push edx
push 0xf0ce4c
call fcn.00405c10
add esp, 8
push 0xd
call fcn.00404e45
add esp, 4
push eax
push 0xf0ce4c
call fcn.00405c10
add esp, 8
push 0xa
call fcn.00404e45
add esp, 4
push eax
push 0xf0ce4c
call fcn.00405c10
add esp, 8
push 0xf0d6f8
push 0xf093b0
call fcn.00405c00
add esp, 8
push 0x30
call fcn.00404e45
add esp, 4
push eax
push 0x2f
call fcn.00404e45
add esp, 4
push eax
push 0x20
call fcn.00404e45
add esp, 4
push eax
push 0x54
call fcn.00404e45
add esp, 4
push eax
push 0x46
call fcn.00404e45
add esp, 4
push eax
push 0x49
call fcn.00404e45
add esp, 4
push eax
push 0x48
call fcn.00404e45
add esp, 4
push eax
push 0x53
call fcn.00404e45
add esp, 4
push eax
push str._s_s_s_s_s_s_s_s
lea eax, [ebp - 0x68d0]
push eax
call fcn.00405cf0
add esp, 0x28
push 0x40
call fcn.00404e45
add esp, 4
push eax
lea ecx, [ebp - 0x230]
push ecx
call fcn.00405c00
add esp, 8
push 0x65
call fcn.00404e45
add esp, 4
push eax
lea edx, [ebp - 0x230]
push edx
call fcn.00405c10
add esp, 8
push 0x63
call fcn.00404e45
add esp, 4
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.00405c10
add esp, 8
push 0x68
call fcn.00404e45
add esp, 4
push eax
lea ecx, [ebp - 0x230]
push ecx
call fcn.00405c10
add esp, 8
push 0x6f
call fcn.00404e45
add esp, 4
push eax
lea edx, [ebp - 0x230]
push edx
call fcn.00405c10
add esp, 8
push 0x20
call fcn.00404e45
add esp, 4
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.00405c10
add esp, 8
push 0x6f
call fcn.00404e45
add esp, 4
push eax
lea ecx, [ebp - 0x230]
push ecx
call fcn.00405c10
add esp, 8
push 0x66
call fcn.00404e45
add esp, 4
push eax
lea edx, [ebp - 0x230]
push edx
call fcn.00405c10
add esp, 8
push 0x66
call fcn.00404e45
add esp, 4
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.00405c10
add esp, 8
push 0x73
call fcn.00404e45
add esp, 4
push eax
lea ecx, [ebp - 0x6928]
push ecx
call fcn.00405c00
add esp, 8
push 0x65
call fcn.00404e45
add esp, 4
push eax
lea edx, [ebp - 0x6928]
push edx
call fcn.00405c10
add esp, 8
push 0x74
call fcn.00404e45
add esp, 4
push eax
lea eax, [ebp - 0x6928]
push eax
call fcn.00405c10
add esp, 8
push 0x20
call fcn.00404e45
add esp, 4
push eax
lea ecx, [ebp - 0x6928]
push ecx
call fcn.00405c10
add esp, 8
push 0x63
call fcn.00404e45
add esp, 4
push eax
lea edx, [ebp - 0x6928]
push edx
call fcn.00405c10
add esp, 8
push 0x6d
call fcn.00404e45
add esp, 4
push eax
lea eax, [ebp - 0x6928]
push eax
call fcn.00405c10
add esp, 8
push 0x64
call fcn.00404e45
add esp, 4
push eax
lea ecx, [ebp - 0x6928]
push ecx
call fcn.00405c10
add esp, 8
push 0x6c
call fcn.00404e45
add esp, 4
push eax
lea edx, [ebp - 0x6928]
push edx
call fcn.00405c10
add esp, 8
push 0x69
call fcn.00404e45
add esp, 4
push eax
lea eax, [ebp - 0x6928]
push eax
call fcn.00405c10
add esp, 8
push 0x6e
call fcn.00404e45
add esp, 4
push eax
lea ecx, [ebp - 0x6928]
push ecx
call fcn.00405c10
add esp, 8
push 0x65
call fcn.00404e45
add esp, 4
push eax
lea edx, [ebp - 0x6928]
push edx
call fcn.00405c10
add esp, 8
push 0x3d
call fcn.00404e45
add esp, 4
push eax
lea eax, [ebp - 0x6928]
push eax
call fcn.00405c10
add esp, 8
push 0xa
call fcn.00404e45
add esp, 4
push eax
push 0xd
call fcn.00404e45
add esp, 4
push eax
lea ecx, [ebp - 0x68d0]
push ecx
push 0xa
call fcn.00404e45
add esp, 4
push eax
push 0xd
call fcn.00404e45
add esp, 4
push eax
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x6928]
push eax
push 0xa
call fcn.00404e45
add esp, 4
push eax
push 0xd
call fcn.00404e45
add esp, 4
push eax
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x67ac]
push edx
push 0xa
call fcn.00404e45
add esp, 4
push eax
push 0xd
call fcn.00404e45
add esp, 4
push eax
lea eax, [ebp - 0x68b8]
push eax
push 0xa
call fcn.00404e45
add esp, 4
push eax
push 0xd
call fcn.00404e45
add esp, 4
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0xa
call fcn.00404e45
add esp, 4
push eax
push 0xd
call fcn.00404e45
add esp, 4
push eax
lea edx, [ebp - 0x230]
push edx
push str._s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s
push 0xf093b0
call fcn.00405cf0
add esp, 0x58
mov eax, dword [ebp + 8]
push eax
push 0x20
call fcn.00404e45
add esp, 4
push eax
push 0x22
call fcn.00404e45
add esp, 4
push eax
push 0xf0a738
push 0x22
call fcn.00404e45
add esp, 4
push eax
push 0x40e108
push 0xf06a98
call fcn.00405cf0
add esp, 0x1c
mov dword [0xf0d284], 0x368b23
mov ecx, dword [0xf0d284]
sub ecx, 0xeb
mov dword [0xf0d284], ecx
push 0xf091a8
push 0x20
call fcn.00404e45
add esp, 4
push eax
push 0x6c
call fcn.00404e45
add esp, 4
push eax
push 0x65
call fcn.00404e45
add esp, 4
push eax
push 0x64
call fcn.00404e45
add esp, 4
push eax
push str._s_s_s_s_s
lea edx, [ebp - 0x4b0]
push edx
call fcn.00405cf0
add esp, 0x1c
call fcn.0040227d
cmp dword [0xf0d288], 0
jne 0x402130
mov dword [ebp - 0x4f0], 0x3c
mov dword [ebp - 0x4e0], 0xf091a8
mov dword [ebp - 0x4ec], 0x40
mov dword [ebp - 0x4e8], 0
mov dword [ebp - 0x4e4], 0x40e120
mov dword [ebp - 0x4dc], 0xf06a98
mov dword [ebp - 0x4d8], 0
mov dword [ebp - 0x4d4], 0
mov dword [ebp - 0x4d0], 0x1d
lea eax, [ebp - 0x4f0]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp dword [ebp - 0x4b8], 0
je 0x402130
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x4b8]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x4b8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0xf0d284], 0x379
cmp dword [0xf0d288], 6
jne 0x4021db
mov dword [ebp - 0x4f0], 0x3c
mov dword [ebp - 0x4e0], 0xf091a8
mov dword [ebp - 0x4ec], 0x40
mov dword [ebp - 0x4e8], 0
mov dword [ebp - 0x4e4], str.open
mov dword [ebp - 0x4dc], 0xf06a98
mov dword [ebp - 0x4d8], 0
mov dword [ebp - 0x4d4], 1
mov dword [ebp - 0x4d0], 0x1d
lea eax, [ebp - 0x4f0]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp dword [ebp - 0x4b8], 0
je 0x4021db
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x4b8]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x4b8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0xf06a90], 1
jne 0x40222d
mov dword [ebp - 0x67b4], 0
jmp 0x4021ff
mov eax, dword [ebp - 0x67b4]
add eax, 1
mov dword [ebp - 0x67b4], eax
mov ecx, dword [0xf06a94]
sub ecx, 2
cmp dword [ebp - 0x67b4], ecx
jge 0x40222d
mov edx, dword [ebp - 0x67b4]
imul edx, edx, 0x3e8
add edx, 0x40ed94
push edx
call fcn.00405bd6
add esp, 4
jmp 0x4021f0
mov eax, dword [0xf06a94]
sub eax, 2
mov dword [ebp - 0x67b4], eax
jmp 0x40224c
mov ecx, dword [ebp - 0x67b4]
add ecx, 1
mov dword [ebp - 0x67b4], ecx
mov edx, dword [ebp - 0x67b4]
cmp edx, dword [0xf06a94]
jge 0x402276
mov eax, dword [ebp - 0x67b4]
imul eax, eax, 0x3e8
add eax, 0x40ed94
push eax
call fcn.00405bd6
add esp, 4
jmp 0x40223d
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret