Function at 0x4fd3c0
Capabilities:
Check for time delay via gettickcount
Copy file
Create process on windows
Get common file path
Move file
Persist via lnk shortcut
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x33
push 0
push 0
dec ecx
jne 0x4fd3c8
push ecx
push ebx
push esi
push edi
mov eax, 0x4fcc18
call fcn.00406dd8
mov ebx, dword [0x540c9c]
xor eax, eax
push ebp
push 0x4fe7fb
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [0x540f14]
mov eax, dword [eax]
call fcn.00409b0c
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00408e1c
mov eax, dword [ebp - 0x14]
push eax
lea edx, [ebp - 0x1c]
mov eax, 2
call fcn.004ab8a8
mov edx, dword [ebp - 0x1c]
pop eax
call fcn.004049d0
jne 0x4fd431
mov eax, dword [0x5408f8]
mov byte [eax], 0
jmp 0x4fd439
mov eax, dword [0x5408f8]
mov byte [eax], 1
lea edx, [ebp - 0x24]
mov eax, 1
call fcn.00402aa0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408e58
mov edx, dword [ebp - 0x20]
mov eax, dword [0x540af4]
call fcn.0040460c
lea edx, [ebp - 0x2c]
mov eax, 2
call fcn.00402aa0
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00408e58
mov edx, dword [ebp - 0x28]
mov eax, dword [0x540b68]
call fcn.0040460c
mov eax, dword [0x5408f8]
cmp byte [eax], 0
jne 0x4fd4a9
lea edx, [ebp - 0x30]
mov eax, 0x11c
call fcn.004ab8a8
mov edx, dword [ebp - 0x30]
mov eax, dword [0x54092c]
call fcn.0040460c
jmp 0x4fd4d2
lea edx, [ebp - 0x38]
mov eax, dword [0x540f14]
mov eax, dword [eax]
call fcn.00409b0c
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x34]
xor edx, edx
call fcn.00409a44
mov edx, dword [ebp - 0x34]
mov eax, dword [0x54092c]
call fcn.0040460c
push 0x4fe814
mov eax, dword [0x540f14]
push dword [eax]
push 0x4fe820
mov eax, dword [0x540bf0]
mov edx, 3
call fcn.0040494c
mov eax, dword [0x540af4]
mov eax, dword [eax]
mov edx, 0x4fe830
call fcn.004049d0
jne 0x4fd5a5
fld xword [0x4fe834]
mov eax, dword [0x5409dc]
fcomp qword [eax]
fnstsw ax
sahf
jae 0x4fd5a5
call fcn.0046aee0
test al, al
jne 0x4fd5a5
call fcn.0040b0dc
call fcn.00402b8c
push edx
push eax
lea eax, [ebp - 0x3c]
call fcn.00409420
mov edx, dword [ebp - 0x3c]
mov eax, dword [0x540b68]
call fcn.0040460c
lea edx, [ebp - 0x40]
mov eax, dword [0x540f14]
mov eax, dword [eax]
call fcn.0046dcbc
mov eax, dword [ebp - 0x40]
call fcn.00404a84
push eax
mov eax, dword [0x540af4]
push dword [eax]
push 0x4fe848
mov eax, dword [0x540b68]
push dword [eax]
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.0040494c
mov eax, dword [ebp - 0x44]
call fcn.00404a84
push eax
mov eax, dword [0x540f14]
mov eax, dword [eax]
call fcn.00404a84
mov edx, eax
xor eax, eax
pop ecx
call fcn.0046af5c
jmp 0x4fe7a7
lea edx, [ebp - 0x48]
mov eax, dword [ebx]
call fcn.00408e1c
mov edx, dword [ebp - 0x48]
mov eax, 0x549ba4
call fcn.0040460c
mov eax, dword [0x549ba4]
call fcn.00463080
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x4c]
call fcn.00409420
mov eax, dword [ebp - 0x4c]
push eax
lea edx, [ebp - 0x50]
mov eax, 0x33
call fcn.004ab8a8
mov edx, dword [ebp - 0x50]
mov eax, 0x549ba0
pop ecx
call fcn.004048d8
mov dl, 1
mov eax, dword [0x462e88]
call fcn.0040377c
mov dword [0x5403f0], eax
mov edx, dword [0x549ba0]
mov eax, dword [0x5403f0]
call fcn.00462f2c
test eax, eax
jne 0x4fd7b4
mov eax, 0x4fe84c
xor edx, edx
call fcn.00471190
mov ebx, eax
test ebx, ebx
je 0x4fe748
mov eax, dword [0x540af4]
mov eax, dword [eax]
mov edx, 0x4fe860
call fcn.004049d0
jne 0x4fd657
push 0
push 0
push 0x702
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4fe748
mov eax, dword [0x540af4]
mov eax, dword [eax]
mov edx, 0x4fe86c
call fcn.004049d0
jne 0x4fd67e
push 0
push 3
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4fe748
mov eax, dword [0x540af4]
mov eax, dword [eax]
mov edx, 0x4fe87c
call fcn.004049d0
jne 0x4fd6a5
push 0
push 4
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4fe748
mov eax, dword [0x540af4]
mov eax, dword [eax]
mov edx, 0x4fe88c
call fcn.004049d0
jne 0x4fd6cc
push 0
push 0
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4fe748
mov eax, dword [0x540af4]
mov eax, dword [eax]
mov edx, 0x4fe898
call fcn.004049d0
jne 0x4fd793
mov edx, dword [0x540b68]
mov eax, 2
call fcn.00402aa0
mov eax, dword [0x540b68]
cmp dword [eax], 0
jne 0x4fd70c
mov eax, dword [0x540b68]
mov edx, 0x4fe848
call fcn.0040460c
push 0
push 2
push 0x604
push ebx
call sub.user32.dll_PostMessageA
mov eax, dword [0x540b68]
mov eax, dword [eax]
call fcn.0040488c
mov esi, eax
lea eax, [esi + 3]
push eax
mov eax, 0x549b9c
mov ecx, 1
mov edx, dword [0x4fcbcc]
call fcn.00405f1c
add esp, 4
mov eax, dword [0x540b68]
call fcn.00404adc
mov edx, eax
mov eax, dword [0x549b9c]
call fcn.00409d74
mov edi, dword [0x549b9c]
test esi, esi
jle 0x4fd77f
mov eax, dword [edi]
push eax
push 2
push 0x604
push ebx
call sub.user32.dll_PostMessageA
add edi, 4
sub esi, 4
test esi, esi
jg 0x4fd765
push 0
push 1
push 0x604
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4fe748
mov eax, dword [0x5407e8]
mov eax, dword [eax]
push eax
mov eax, dword [0x540910]
movzx eax, byte [eax]
push eax
push 0x600
push ebx
call sub.user32.dll_PostMessageA
jmp 0x4fe748
lea edx, [ebp - 0x58]
mov eax, dword [0x540f14]
mov eax, dword [eax]
call fcn.00409b0c
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x54]
xor edx, edx
call fcn.00409a44
mov edx, dword [ebp - 0x54]
mov eax, dword [0x540e54]
call fcn.0040460c
mov eax, dword [0x540e14]
mov dword [eax], 0x6562
lea edx, [ebp - 0x5c]
xor eax, eax
call fcn.00471edc
mov edx, dword [ebp - 0x5c]
mov eax, dword [0x540df4]
call fcn.0040460c
lea edx, [ebp - 0x60]
xor eax, eax
call fcn.00471edc
mov edx, dword [ebp - 0x60]
mov eax, dword [0x540ae8]
call fcn.0040460c
mov eax, dword [0x549ba4]
call fcn.0040488c
push eax
mov eax, 0x549ba4
call fcn.00404adc
pop edx
call fcn.00471430
mov edx, dword [0x540e14]
add dword [edx], eax
call fcn.00402b00
lea edx, [ebp - 0x64]
mov eax, 0x3e
call fcn.004ab8a8
mov ecx, dword [ebp - 0x64]
mov edx, dword [ebx]
mov eax, dword [0x5404e8]
call fcn.004048d8
lea edx, [ebp - 0x68]
mov eax, 0x3c
call fcn.004ab8a8
mov ecx, dword [ebp - 0x68]
mov edx, dword [ebx]
mov eax, dword [0x540efc]
call fcn.004048d8
lea edx, [ebp - 0x6c]
mov eax, 0x3d
call fcn.004ab8a8
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ebx]
mov eax, dword [0x540bac]
call fcn.004048d8
lea edx, [ebp - 0x70]
mov eax, 0x34
call fcn.004ab8a8
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebx]
mov eax, dword [0x540a14]
call fcn.004048d8
lea edx, [ebp - 0x74]
mov eax, 0x36
call fcn.004ab8a8
mov ecx, dword [ebp - 0x74]
mov edx, dword [ebx]
mov eax, dword [0x5406f8]
call fcn.004048d8
lea edx, [ebp - 0x78]
mov eax, 0x3b
call fcn.004ab8a8
mov ecx, dword [ebp - 0x78]
mov edx, dword [ebx]
mov eax, dword [0x540e84]
call fcn.004048d8
lea edx, [ebp - 0x7c]
mov eax, 4
call fcn.004ab8a8
mov ecx, dword [ebp - 0x7c]
mov edx, dword [ebx]
mov eax, dword [0x540820]
call fcn.004048d8
lea edx, [ebp - 0x80]
mov eax, 0x7b
call fcn.004ab8a8
mov ecx, dword [ebp - 0x80]
mov edx, dword [ebx]
mov eax, dword [0x540e60]
call fcn.004048d8
lea edx, [ebp - 0x84]
mov eax, 3
call fcn.004ab8a8
mov ecx, dword [ebp - 0x84]
mov edx, dword [ebx]
mov eax, dword [0x540ce4]
call fcn.004048d8
lea edx, [ebp - 0x88]
mov eax, dword [0x540f14]
mov eax, dword [eax]
call fcn.00408e1c
mov edx, dword [ebp - 0x88]
mov eax, 0x549b74
call fcn.0040460c
push 0x104
mov eax, dword [0x540904]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
cmp eax, 2
jb 0x4fda0d
lea edx, [ebp - 0x8c]
mov eax, dword [0x540904]
call fcn.00409f74
mov edx, dword [ebp - 0x8c]
mov eax, dword [0x54061c]
call fcn.0040460c
mov eax, dword [0x54061c]
mov eax, dword [eax]
call fcn.0040488c
cmp eax, 3
jle 0x4fd9c0
mov eax, dword [0x54061c]
mov edx, 0x4fe8a4
call fcn.00404894
mov eax, dword [0x54061c]
lea edx, [ebp - 0x90]
mov eax, 0x70
call fcn.004ab8a8
mov ecx, dword [ebp - 0x90]
mov edx, dword [0x54061c]
mov edx, dword [edx]
mov eax, dword [0x5406e0]
call fcn.004048d8
mov eax, dword [0x54061c]
mov eax, dword [eax]
cmp byte [eax + 1], 0x3a
jne 0x4fda15
mov eax, dword [0x54061c]
mov eax, dword [eax]
mov al, byte [eax]
call fcn.00402b3c
mov edx, dword [0x5408f4]
mov byte [edx], al
jmp 0x4fda15
mov eax, dword [0x5408f4]
mov byte [eax], 0x43
push 0x104
mov eax, dword [0x540904]
push eax
lea edx, [ebp - 0x94]
mov eax, 0x2e
call fcn.004ab8a8
mov eax, dword [ebp - 0x94]
call fcn.00404a84
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov eax, dword [0x540904]
call fcn.00409f58
mov edx, eax
mov eax, 0x549b80
call fcn.004047a8
mov eax, 0x549b80
call fcn.0046a994
mov eax, dword [0x549b74]
cmp byte [eax], 0x5c
jne 0x4fda75
mov eax, dword [0x540ce0]
mov byte [eax], 2
jmp 0x4fda90
mov edx, dword [0x549b74]
mov eax, dword [0x549b80]
call fcn.00404bc8
dec eax
jne 0x4fda90
mov eax, dword [0x540ce0]
mov byte [eax], 1
lea eax, [ebp - 0x98]
call fcn.004713b8
mov edx, dword [ebp - 0x98]
mov eax, dword [0x540520]
call fcn.0040460c
mov eax, dword [0x540af4]
mov eax, dword [eax]
mov edx, 0x4fe830
call fcn.004049d0
jne 0x4fdaf1
lea edx, [ebp - 0x9c]
mov eax, 0x31
call fcn.004ab8a8
mov eax, dword [ebp - 0x9c]
push eax
lea edx, [ebp - 0xa0]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0xa0]
pop edx
call fcn.0046d0fc
mov eax, dword [0x540af4]
mov eax, dword [eax]
mov edx, 0x4fe8b0
call fcn.004049d0
jne 0x4fdb0c
mov eax, dword [0x540910]
mov byte [eax], 1
mov eax, dword [0x540af4]
mov eax, dword [eax]
mov edx, 0x4fe8bc
call fcn.004049d0
je 0x4fdb36
mov eax, dword [0x540b68]
mov eax, dword [eax]
mov edx, 0x4fe8bc
call fcn.004049d0
je 0x4fdb36
xor eax, eax
jmp 0x4fdb38
mov al, 1
test al, al
je 0x4fdb64
mov eax, 0x7d0
call fcn.004d91e4
mov eax, dword [0x540820]
mov eax, dword [eax]
call fcn.0046dd44
test al, al
je 0x4fdb78
mov eax, dword [0x540820]
mov eax, dword [eax]
call fcn.00409988
jmp 0x4fdb78
mov eax, dword [0x540910]
cmp byte [eax], 1
jne 0x4fdb78
mov eax, 0x7d0
call fcn.004d91e4
lea edx, [ebp - 0xa4]
mov eax, 0x32
call fcn.004ab8a8
mov eax, dword [ebp - 0xa4]
push eax
lea edx, [ebp - 0xa8]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0xa8]
pop edx
call fcn.0046ce80
sub eax, 0x7d0
mov dword [0x5403f4], eax
lea edx, [ebp - 0xac]
mov eax, 0x76
call fcn.004ab8a8
mov eax, dword [ebp - 0xac]
push eax
lea edx, [ebp - 0xb0]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0xb0]
pop edx
call fcn.0046d328
test al, al
je 0x4fdc29
lea edx, [ebp - 0xb4]
mov eax, 0x76
call fcn.004ab8a8
mov eax, dword [ebp - 0xb4]
push eax
lea edx, [ebp - 0xb8]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0xb8]
pop edx
call fcn.0046ce80
mov edx, dword [0x5407e8]
mov dword [edx], eax
jmp 0x4fdc34
mov eax, dword [0x5407e8]
mov dword [eax], 0x1f40
mov eax, dword [0x540ce0]
cmp byte [eax], 1
je 0x4fde7a
lea edx, [ebp - 0xc0]
mov eax, 0x31
call fcn.004ab8a8
mov eax, dword [ebp - 0xc0]
push eax
lea edx, [ebp - 0xc4]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xbc]
pop edx
call fcn.0046c538
mov edx, dword [ebp - 0xbc]
mov eax, 0x549b70
call fcn.0040460c
lea edx, [ebp - 0xcc]
mov eax, 0x11b
call fcn.004ab8a8
mov eax, dword [ebp - 0xcc]
push eax
lea edx, [ebp - 0xd0]
mov eax, 0x13
call fcn.004ab8a8
mov eax, dword [ebp - 0xd0]
lea ecx, [ebp - 0xc8]
pop edx
call fcn.0046c538
mov edx, dword [ebp - 0xc8]
mov eax, 0x549b6c
call fcn.0040460c
cmp dword [0x549b6c], 0
je 0x4fdd1c
mov eax, 0x549b70
call fcn.004045b8
lea edx, [ebp - 0xd4]
mov eax, 0x11b
call fcn.004ab8a8
mov eax, dword [ebp - 0xd4]
push eax
lea edx, [ebp - 0xd8]
mov eax, 0x13
call fcn.004ab8a8
mov eax, dword [ebp - 0xd8]
pop edx
call fcn.0046d0fc
jmp 0x4fdd55
lea edx, [ebp - 0xe0]
mov eax, 0x13
call fcn.004ab8a8
mov eax, dword [ebp - 0xe0]
lea ecx, [ebp - 0xdc]
mov edx, dword [0x54092c]
mov edx, dword [edx]
call fcn.0046c538
mov edx, dword [ebp - 0xdc]
mov eax, 0x549b6c
call fcn.0040460c
mov eax, dword [0x549b70]
mov edx, 0x4fe8c8
call fcn.004049d0
jne 0x4fdd8b
cmp dword [0x549b6c], 0
je 0x4fde7a
mov eax, dword [0x549b6c]
mov edx, dword [0x540bf0]
mov edx, dword [edx]
call fcn.004049d0
je 0x4fde7a
lea edx, [ebp - 0xe4]
mov eax, 0x31
call fcn.004ab8a8
mov eax, dword [ebp - 0xe4]
push eax
lea edx, [ebp - 0xe8]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0xe8]
mov ecx, 0x4fe8c8
pop edx
call fcn.0046c30c
lea edx, [ebp - 0xec]
mov eax, 0x124
call fcn.004ab8a8
push dword [ebp - 0xec]
push 0x4fe8a4
mov eax, dword [0x54092c]
push dword [eax]
push 0x4fe8d4
mov eax, 0x549b98
mov edx, 4
call fcn.0040494c
mov eax, 0x549b98
call fcn.004db5b4
lea edx, [ebp - 0xf0]
mov eax, 0x13
call fcn.004ab8a8
mov eax, dword [ebp - 0xf0]
mov ecx, dword [0x540bf0]
mov ecx, dword [ecx]
mov edx, dword [0x54092c]
mov edx, dword [edx]
call fcn.0046c30c
test al, al
je 0x4fde3e
mov eax, dword [0x549b98]
call fcn.00409988
jmp 0x4fde7a
lea edx, [ebp - 0xf4]
mov eax, 0x13
call fcn.004ab8a8
mov eax, dword [ebp - 0xf4]
mov edx, dword [0x54092c]
mov edx, dword [edx]
call fcn.0046d0fc
push 0
mov eax, dword [0x540f14]
mov eax, dword [eax]
mov ecx, dword [0x549b98]
mov edx, 0x4fe8b0
call fcn.004d92e4
lea edx, [ebp - 0xf8]
mov eax, 0x11b
call fcn.004ab8a8
mov eax, dword [ebp - 0xf8]
push eax
lea edx, [ebp - 0xfc]
mov eax, 0x13
call fcn.004ab8a8
mov eax, dword [ebp - 0xfc]
pop edx
call fcn.0046d0fc
lea edx, [ebp - 0x100]
mov eax, 0x25
call fcn.004ab8a8
mov eax, dword [ebp - 0x100]
push eax
lea edx, [ebp - 0x104]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0x104]
pop edx
call fcn.0046d0fc
lea edx, [ebp - 0x108]
mov eax, 0x26
call fcn.004ab8a8
mov eax, dword [ebp - 0x108]
push eax
lea edx, [ebp - 0x10c]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0x10c]
pop edx
call fcn.0046d0fc
mov edx, dword [ebx]
mov eax, dword [0x540b9c]
mov ecx, 0x4fe8e4
call fcn.004048d8
lea edx, [ebp - 0x110]
mov eax, 0x77
call fcn.004ab8a8
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebx]
mov eax, dword [0x540a64]
call fcn.004048d8
lea edx, [ebp - 0x114]
mov eax, 0x78
call fcn.004ab8a8
mov ecx, dword [ebp - 0x114]
mov edx, dword [ebx]
mov eax, dword [0x5405d0]
call fcn.004048d8
mov eax, dword [0x540ce0]
cmp byte [eax], 2
jne 0x4fe1e3
lea edx, [ebp - 0x118]
mov eax, 0x1a
call fcn.004ab8a8
mov ecx, dword [ebp - 0x118]
mov eax, 0x549b7c
mov edx, dword [0x549b80]
call fcn.004048d8
lea edx, [ebp - 0x120]
mov eax, 0x1a
call fcn.004ab8a8
mov ecx, dword [ebp - 0x120]
mov edx, dword [ebx]
lea eax, [ebp - 0x11c]
call fcn.004048d8
mov edx, dword [ebp - 0x11c]
mov eax, dword [0x549b7c]
call fcn.004fc810
mov eax, 0x549b7c
mov ecx, 0x4fe8e4
mov edx, dword [0x549b80]
call fcn.004048d8
mov edx, dword [0x540b9c]
mov edx, dword [edx]
mov eax, dword [0x549b7c]
call fcn.004fc810
lea edx, [ebp - 0x124]
mov eax, 0x77
call fcn.004ab8a8
mov ecx, dword [ebp - 0x124]
mov eax, 0x549b7c
mov edx, dword [0x549b80]
call fcn.004048d8
mov edx, dword [0x540a64]
mov edx, dword [edx]
mov eax, dword [0x549b7c]
call fcn.004fc810
lea edx, [ebp - 0x128]
mov eax, 0x78
call fcn.004ab8a8
mov ecx, dword [ebp - 0x128]
mov eax, 0x549b7c
mov edx, dword [0x549b80]
call fcn.004048d8
mov edx, dword [0x5405d0]
mov edx, dword [edx]
mov eax, dword [0x549b7c]
call fcn.004fc810
lea edx, [ebp - 0x12c]
mov eax, 0x3e
call fcn.004ab8a8
mov ecx, dword [ebp - 0x12c]
mov edx, dword [ebx]
mov eax, 0x549b84
call fcn.004048d8
lea edx, [ebp - 0x130]
mov eax, 0x3e
call fcn.004ab8a8
mov ecx, dword [ebp - 0x130]
mov eax, 0x549b88
mov edx, dword [0x549b80]
call fcn.004048d8
mov edx, dword [0x549b84]
mov eax, dword [0x549b88]
call fcn.004fc810
lea edx, [ebp - 0x134]
mov eax, 0x34
call fcn.004ab8a8
mov ecx, dword [ebp - 0x134]
mov edx, dword [ebx]
mov eax, 0x549b84
call fcn.004048d8
lea edx, [ebp - 0x138]
mov eax, 0x34
call fcn.004ab8a8
mov ecx, dword [ebp - 0x138]
mov eax, 0x549b88
mov edx, dword [0x549b80]
call fcn.004048d8
mov edx, dword [0x549b84]
mov eax, dword [0x549b88]
call fcn.004fc810
lea edx, [ebp - 0x13c]
mov eax, 0x3c
call fcn.004ab8a8
mov ecx, dword [ebp - 0x13c]
mov edx, dword [ebx]
mov eax, 0x549b84
call fcn.004048d8
lea edx, [ebp - 0x140]
mov eax, 0x3c
call fcn.004ab8a8
mov ecx, dword [ebp - 0x140]
mov eax, 0x549b88
mov edx, dword [0x549b80]
call fcn.004048d8
mov edx, dword [0x549b84]
mov eax, dword [0x549b88]
call fcn.004fc810
lea edx, [ebp - 0x144]
mov eax, 1
call fcn.004ab8a8
mov ecx, dword [ebp - 0x144]
mov eax, 0x549b78
mov edx, dword [0x549b80]
call fcn.004048d8
push 0
mov eax, dword [0x549b78]
call fcn.00404a84
mov esi, eax
push esi
mov eax, dword [0x549b74]
call fcn.00404a84
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x4fe1e3
push 1
mov eax, 0x549b80
call fcn.00404adc
push eax
mov eax, dword [0x540af4]
mov eax, dword [eax]
call fcn.00404a84
push eax
push esi
push 0x4fe8f0
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x4fe748
lea edx, [ebp - 0x148]
mov eax, 0x79
call fcn.004ab8a8
mov edx, dword [ebp - 0x148]
mov ecx, dword [0x540b34]
mov ecx, dword [ecx]
mov eax, dword [0x540de4]
call fcn.004048d8
lea edx, [ebp - 0x14c]
mov eax, 0x7a
call fcn.004ab8a8
mov eax, dword [ebp - 0x14c]
push eax
lea edx, [ebp - 0x150]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0x150]
pop edx
call fcn.0046ce80
mov edx, dword [0x5406c0]
mov dword [edx], eax
call fcn.004f75dc
mov eax, dword [0x5406c0]
cmp dword [eax], 0
jne 0x4fe4ff
mov eax, dword [0x540910]
cmp byte [eax], 1
jne 0x4fe4ff
mov eax, dword [0x540ce0]
cmp byte [eax], 0
jne 0x4fe4ff
mov eax, dword [0x540554]
cmp dword [eax], 0
je 0x4fe38d
mov eax, dword [0x540554]
mov eax, dword [eax]
call fcn.00462e40
test al, al
jne 0x4fe2cb
lea edx, [ebp - 0x154]
mov eax, 0x7c
call fcn.004ab8a8
mov eax, dword [ebp - 0x154]
push eax
lea edx, [ebp - 0x158]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0x158]
pop edx
call fcn.0046ce80
call fcn.004d91e4
mov eax, dword [0x540554]
mov eax, dword [eax]
call fcn.00462e40
test al, al
je 0x4fe38d
call fcn.004fc964
test al, al
je 0x4fe38d
lea edx, [ebp - 0x15c]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0x15c]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4fe900
pop eax
call fcn.0046cc5c
lea edx, [ebp - 0x160]
mov eax, 0x11a
call fcn.004ab8a8
mov eax, dword [ebp - 0x160]
push eax
call sub.kernel32.dll_GetTickCount
mov ecx, eax
mov edx, 0x4fe914
pop eax
call fcn.0046cc5c
call sub.kernel32.dll_GetTickCount
mov ebx, eax
add ebx, 0x7d0
jmp 0x4fe354
push 0x64
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount
cmp ebx, eax
ja 0x4fe34d
push 1
mov edx, dword [0x540820]
mov edx, dword [edx]
lea eax, [ebp - 0x164]
mov ecx, 0x4fe92c
call fcn.004048d8
mov eax, dword [ebp - 0x164]
call fcn.00404a84
push eax
call sub.kernel32.dll_WinExec
jmp 0x4fe748
lea edx, [ebp - 0x16c]
mov eax, 0xb
call fcn.004ab8a8
mov ecx, dword [ebp - 0x16c]
mov edx, dword [ebx]
lea eax, [ebp - 0x168]
call fcn.004048d8
mov eax, dword [ebp - 0x168]
call fcn.0046dd44
test al, al
je 0x4fe4ff
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
mov dword [0x549b8c], eax
lea edx, [ebp - 0x178]
mov eax, 0xb
call fcn.004ab8a8
mov ecx, dword [ebp - 0x178]
mov edx, dword [ebx]
lea eax, [ebp - 0x174]
call fcn.004048d8
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 0x170]
call fcn.00404e90
mov eax, dword [ebp - 0x170]
push eax
mov eax, dword [0x549b8c]
push eax
call fcn.0046e05c
mov eax, dword [0x549b8c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4fe4f5
mov eax, dword [0x549b8c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
cmp esi, 0
jl 0x4fe4b9
lea ecx, [ebp - 0x17c]
mov edx, esi
mov eax, dword [0x549b8c]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x17c]
mov eax, 0x549b94
call fcn.0040460c
lea edx, [ebp - 0x180]
mov eax, 0xa
call fcn.004ab8a8
mov ecx, dword [ebp - 0x180]
mov eax, 0x549b90
mov edx, dword [0x549b94]
call fcn.004048d8
push 1
mov eax, 0x549b94
call fcn.00404adc
push eax
mov eax, 0x549b90
call fcn.00404adc
push eax
call sub.kernel32.dll_MoveFileExA
test eax, eax
je 0x4fe4b3
mov edx, esi
mov eax, dword [0x549b8c]
mov ecx, dword [eax]
call dword [ecx + 0x48]
dec esi
cmp esi, 0xffffffff
jne 0x4fe43e
mov eax, dword [0x549b8c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x4fe4f5
lea edx, [ebp - 0x188]
mov eax, 0xb
call fcn.004ab8a8
mov ecx, dword [ebp - 0x188]
mov edx, dword [ebx]
lea eax, [ebp - 0x184]
call fcn.004048d8
mov eax, dword [ebp - 0x184]
call fcn.00409988
mov eax, dword [0x549b8c]
call fcn.004037ac
call fcn.004b104c
mov eax, dword [0x540910]
cmp byte [eax], 1
je 0x4fe517
mov eax, dword [0x5407e8]
xor edx, edx
mov dword [eax], edx
cmp dword [0x5403f4], 0
jle 0x4fe563
mov eax, dword [0x540910]
cmp byte [eax], 1
jne 0x4fe563
mov eax, dword [0x5403f4]
call fcn.004d91e4
mov eax, dword [0x5407e8]
cmp dword [eax], 0
jle 0x4fe563
mov eax, dword [0x5407e8]
mov edx, dword [0x5403f4]
sub dword [eax], edx
mov eax, dword [0x5407e8]
cmp dword [eax], 0x7d0
jge 0x4fe563
mov eax, dword [0x5407e8]
mov dword [eax], 0x7d0
mov eax, dword [0x540a50]
mov dword [eax], 0x20
lea eax, [ebp - 0x18c]
mov edx, dword [0x540f14]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x18c]
mov edx, dword [0x540a50]
mov dx, word [edx]
call fcn.0046e0d4
mov edx, dword [0x540844]
mov dword [edx], eax
mov eax, dword [0x540844]
cmp dword [eax], 0
jne 0x4fe5e0
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x190]
mov edx, dword [0x540f14]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x190]
mov edx, dword [0x540a50]
mov dx, word [edx]
call fcn.0046e0d4
mov edx, dword [0x540844]
mov dword [edx], eax
mov eax, dword [0x540844]
cmp dword [eax], 0
jne 0x4fe623
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x194]
mov edx, dword [0x540f14]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x194]
mov edx, dword [0x540a50]
mov dx, word [edx]
call fcn.0046e0d4
mov edx, dword [0x540844]
mov dword [edx], eax
mov eax, dword [0x540844]
cmp dword [eax], 0
jne 0x4fe666
push 0x3e8
call sub.kernel32.dll_Sleep_1
lea eax, [ebp - 0x198]
mov edx, dword [0x540f14]
mov edx, dword [edx]
call fcn.00404e90
mov eax, dword [ebp - 0x198]
mov edx, dword [0x540a50]
mov dx, word [edx]
call fcn.0046e0d4
mov edx, dword [0x540844]
mov dword [edx], eax
call sub.kernel32.dll_GetCurrentProcessId
mov edx, dword [0x5404ac]
mov dword [edx], eax
mov eax, dword [0x540b3c]
mov eax, dword [eax]
call fcn.00449414
call fcn.004ac11c
mov ecx, dword [0x540cc4]
mov eax, dword [0x540b3c]
mov eax, dword [eax]
mov edx, dword [0x4b6cbc]
call fcn.0044942c
mov ecx, dword [0x540a80]
mov eax, dword [0x540b3c]
mov eax, dword [eax]
mov edx, dword [0x4b5c2c]
call fcn.0044942c
mov edx, dword [0x540df4]
mov edx, dword [edx]
mov eax, dword [0x540cc4]
mov eax, dword [eax]
call fcn.004577bc
mov ecx, dword [0x5405a0]
mov eax, dword [0x540b3c]
mov eax, dword [eax]
mov edx, dword [0x4d5ffc]
call fcn.0044942c
mov edx, dword [0x540ae8]
mov edx, dword [edx]
mov eax, dword [0x5405a0]
mov eax, dword [eax]
call fcn.004577bc
mov ecx, dword [0x540720]
mov eax, dword [0x540b3c]
mov eax, dword [eax]
mov edx, dword [0x4aecb0]
call fcn.0044942c
mov eax, dword [0x5405a0]
mov eax, dword [eax]
mov edx, dword [0x540cc4]
mov edx, dword [edx]
mov dword [edx + 0x314], eax
mov dl, 1
mov eax, dword [0x414bcc]
call fcn.0040377c
call fcn.004037ac
mov eax, dword [0x540b3c]
mov eax, dword [eax]
call fcn.004494ac
mov eax, dword [0x540844]
call fcn.0040e2f4
mov eax, 0x5403f0
call fcn.0040e2f4
mov eax, dword [0x54064c]
cmp byte [eax], 0
je 0x4fe792
push 1
push 0x4fe930
push 0x4fe930
lea edx, [ebp - 0x19c]
mov eax, dword [0x540b3c]
mov eax, dword [eax]
call fcn.00449a98
mov eax, dword [ebp - 0x19c]
call fcn.00404a84
push eax
push 0x4fe934
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.004b1278
push 0x1341606
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fe802
lea eax, [ebp - 0x19c]
call fcn.004045b8
lea eax, [ebp - 0x198]
mov edx, 4
call fcn.00404d08
lea eax, [ebp - 0x188]
mov edx, 6
call fcn.004045dc
lea eax, [ebp - 0x170]
call fcn.00404cf0
lea eax, [ebp - 0x16c]
mov edx, 0x57
call fcn.004045dc
ret