Function at 0x4017b0
Capabilities:
Create directory
Create process on windows
Create process suspended
Create thread
Delete file
Get common file path
Persist via lnk shortcut
Read file via mapping
Resume thread
Self delete
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x14fc
call fcn.00412ee0
mov eax, dword [0x41e090]
xor eax, esp
mov dword [esp + 0x14f8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea ecx, [esp + 0xab5]
push ebx
push ecx
mov dword [esp + 0x30], eax
mov byte [esp + 0xabc], bl
call fcn.004128c0
add esp, 0xc
lea edx, [esp + 0xab0]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp byte [esp + eax + 0xaaf], 0x5c
lea eax, [esp + eax + 0xaaf]
jne 0x40181d
mov byte [eax], bl
lea eax, [esp + 0xab0]
mov dword [esp + 0x22c], 0xf
mov dword [esp + 0x228], ebx
mov byte [esp + 0x218], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401840
sub eax, edx
mov edi, eax
lea eax, [esp + 0xab0]
lea esi, [esp + 0x218]
call fcn.00404cc0
push str.mircldel.bin
mov eax, esi
push eax
lea ecx, [esp + 0x7c]
push ecx
call fcn.00403fd0
add esp, 0xc
push 0x103
lea edx, [esp + 0x58d]
push ebx
push edx
mov byte [esp + 0x594], bl
call fcn.004128c0
add esp, 0xc
lea eax, [esp + 0x588]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp byte [esp + eax + 0x587], 0x5c
lea eax, [esp + eax + 0x587]
jne 0x4018b6
mov byte [eax], bl
lea eax, [esp + 0x588]
mov dword [esp + 0xa4], 0xf
mov dword [esp + 0xa0], ebx
mov byte [esp + 0x90], bl
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4018e0
sub eax, edx
mov edi, eax
lea eax, [esp + 0x588]
lea esi, [esp + 0x90]
call fcn.00404cc0
push str.Data
mov ecx, esi
push ecx
lea edx, [esp + 0xec]
push edx
call fcn.00403fd0
add esp, 0xc
push str.Map
mov eax, esi
push eax
lea ecx, [esp + 0xd0]
push ecx
call fcn.00403fd0
add esp, 0xc
push str.Wav
mov edx, esi
push edx
lea eax, [esp + 0x15c]
push eax
call fcn.00403fd0
add esp, 0xc
push str.DataChrSel.wil
mov ecx, esi
push ecx
lea edx, [esp + 0x124]
push edx
call fcn.00403fd0
add esp, 0xc
push str.DataPrguse.wil
mov eax, esi
push eax
lea ecx, [esp + 0x108]
push ecx
call fcn.00403fd0
add esp, 0xc
push str.Map0.map
mov edx, esi
push edx
lea eax, [esp + 0x140]
push eax
call fcn.00403fd0
mov edi, dword [esp + 0xf0]
add esp, 0xc
cmp dword [esp + 0xf8], 0x10
jae 0x4019a6
lea edi, [esp + 0xe4]
push 0x13c
lea ecx, [esp + 0x450]
push ebx
push ecx
xor esi, esi
mov dword [esp + 0x454], ebx
call fcn.004128c0
add esp, 0xc
lea edx, [esp + 0x448]
push edx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
call edi
cmp eax, 0xffffffff
je 0x4019ea
test byte [esp + 0x448], 0x10
je 0x4019ea
mov esi, 1
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, ebx
je 0x403700
cmp dword [esp + 0xdc], 0x10
jb 0x401a10
mov eax, dword [esp + 0xc8]
mov dword [esp + 0xc], eax
jmp 0x401a1b
lea ecx, [esp + 0xc8]
mov dword [esp + 0xc], ecx
push 0x13c
lea edx, [esp + 0x450]
push ebx
push edx
xor esi, esi
mov dword [esp + 0x454], ebx
call fcn.004128c0
mov ecx, dword [esp + 0x18]
add esp, 0xc
lea eax, [esp + 0x448]
push eax
push ecx
call edi
cmp eax, 0xffffffff
je 0x401a5d
test byte [esp + 0x448], 0x10
je 0x401a5d
mov esi, 1
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, ebx
je 0x403700
cmp dword [esp + 0x168], 0x10
mov esi, dword [esp + 0x154]
jae 0x401a84
lea esi, [esp + 0x154]
call fcn.00406290
test eax, eax
je 0x403700
cmp dword [esp + 0x130], 0x10
mov esi, dword [esp + 0x11c]
jae 0x401aa9
lea esi, [esp + 0x11c]
call fcn.00406300
test eax, eax
je 0x403700
cmp dword [esp + 0x114], 0x10
mov esi, dword [esp + 0x100]
jae 0x401ace
lea esi, [esp + 0x100]
call fcn.00406300
test eax, eax
je 0x403700
cmp dword [esp + 0x14c], 0x10
mov esi, dword [esp + 0x138]
jae 0x401af3
lea esi, [esp + 0x138]
call fcn.00406300
test eax, eax
je 0x403700
mov esi, dword [esp + 0x74]
mov edi, 0x10
cmp dword [esp + 0x88], edi
jae 0x401b16
lea esi, [esp + 0x74]
call fcn.00406300
test eax, eax
je 0x401c6e
push 0x103
lea edx, [esp + 0x9ad]
push ebx
push edx
mov byte [esp + 0x9b4], bl
call fcn.004128c0
mov eax, dword [esp + 0x80]
add esp, 0xc
cmp dword [esp + 0x88], edi
jae 0x401b54
lea eax, [esp + 0x74]
lea edi, [esp + 0x9a8]
call fcn.00406370
mov esi, edi
call fcn.00406300
test eax, eax
je 0x401bdc
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, edi
lea ecx, [esp + 0x1a8]
call fcn.00406130
mov eax, dword [esp + 0x1a8]
mov esi, 0x10
cmp dword [esp + 0x1bc], esi
jae 0x401b9e
lea eax, [esp + 0x1a8]
mov edi, dword [sym.imp.SHELL32.dll_SHChangeNotify]
push ebx
push eax
push 1
push 0x1000
call edi
mov eax, dword [esp + 0x1a8]
cmp dword [esp + 0x1bc], esi
jae 0x401bc6
lea eax, [esp + 0x1a8]
push ebx
push eax
push 1
push 4
call edi
lea esi, [esp + 0x1a8]
call fcn.00404dd0
jmp 0x401be2
mov edi, dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov eax, dword [esp + 0x74]
mov esi, 0x10
cmp dword [esp + 0x88], esi
jae 0x401bf8
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [esp + 0x74]
cmp dword [esp + 0x88], esi
jae 0x401c10
lea edx, [esp + 0x74]
lea ecx, [esp + 0xac]
call fcn.00406130
mov eax, dword [esp + 0xac]
cmp dword [esp + 0xc0], esi
jae 0x401c33
lea eax, [esp + 0xac]
push ebx
push eax
push 1
push 0x1000
call edi
mov eax, dword [esp + 0xac]
cmp dword [esp + 0xc0], esi
jae 0x401c55
lea eax, [esp + 0xac]
push ebx
push eax
push 1
push 4
call edi
lea esi, [esp + 0xac]
call fcn.00404dd0
mov edi, 0x10
push str.Skin
lea ecx, [esp + 0x94]
push ecx
lea edx, [esp + 0x194]
push edx
call fcn.00403fd0
mov esi, dword [esp + 0x198]
add esp, 0xc
cmp dword [esp + 0x1a0], edi
jae 0x401ca2
lea esi, [esp + 0x18c]
call fcn.00406290
test eax, eax
mov eax, dword [esp + 0x18c]
jne 0x401ccc
cmp dword [esp + 0x1a0], edi
jae 0x401cc2
lea eax, [esp + 0x18c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x401cea
cmp dword [esp + 0x1a0], edi
jae 0x401cdc
lea eax, [esp + 0x18c]
push eax
mov ecx, str..BMP
call fcn.00407320
add esp, 4
mov eax, 0x438044
lea ecx, [esp + 0x250]
call fcn.00404d90
mov eax, 0x41b08c
lea ecx, [esp + 0x1fc]
call fcn.00404d90
push eax
lea eax, [esp + 0x1ac]
call fcn.004040b0
add esp, 4
push eax
mov eax, str.4.16
lea ecx, [esp + 0xb0]
call fcn.00404100
add esp, 4
push eax
mov eax, 0x41b088
lea ecx, [esp + 0x1e4]
call fcn.00404100
add esp, 4
lea esi, [esp + 0xac]
call fcn.00404dd0
lea esi, [esp + 0x1a8]
call fcn.00404dd0
lea esi, [esp + 0x1fc]
call fcn.00404dd0
mov eax, 0x41b08c
lea ecx, [esp + 0x1a8]
call fcn.00404d90
push eax
lea eax, [esp + 0xb0]
call fcn.004040b0
add esp, 4
push eax
mov eax, str.4.16
lea ecx, [esp + 0x200]
call fcn.00404100
add esp, 4
push eax
mov eax, 0x41b090
lea ecx, [esp + 0x3c0]
call fcn.00404100
add esp, 4
lea esi, [esp + 0x1fc]
call fcn.00404dd0
lea esi, [esp + 0xac]
call fcn.00404dd0
lea esi, [esp + 0x1a8]
call fcn.00404dd0
push 0x103
lea eax, [esp + 0x695]
push ebx
push eax
mov byte [esp + 0x69c], bl
call fcn.004128c0
add esp, 0xc
push 0x104
lea ecx, [esp + 0x694]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x103
lea edx, [esp + 0x8a5]
push ebx
push edx
mov byte [esp + 0x8ac], bl
call fcn.004128c0
add esp, 0xc
lea eax, [esp + 0x588]
push eax
push str._smirclclient.dat
lea ecx, [esp + 0x8a8]
push 0x104
push ecx
call fcn.0040be11
add esp, 0x10
lea edx, [esp + 0x8a0]
push edx
push 0x683b68
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov byte [esp + 0x448], bl
push 0x103
lea eax, [esp + 0x44d]
push ebx
push eax
call fcn.004128c0
add esp, 0xc
lea ecx, [esp + 0x588]
push ecx
push 0x41b0ac
lea edx, [esp + 0x450]
push 0x104
push edx
call fcn.0040be11
push 0x103
lea eax, [esp + 0xcd5]
push ebx
push eax
mov byte [esp + 0xcdc], bl
call fcn.004128c0
add esp, 0x1c
lea ecx, [esp + 0x588]
push ecx
push str._smirclclient.dll
lea edx, [esp + 0xcc8]
push 0x104
push edx
call fcn.0040be11
push 0x103
lea eax, [esp + 0x1305]
push ebx
push eax
mov byte [esp + 0x130c], bl
call fcn.004128c0
add esp, 0x1c
lea ecx, [esp + 0x588]
push ecx
push str._smirlib.dll
lea edx, [esp + 0x12f8]
push 0x104
push edx
call fcn.0040be11
push 0x103
lea eax, [esp + 0xee5]
push ebx
push eax
mov byte [esp + 0xeec], bl
call fcn.004128c0
add esp, 0x1c
lea ecx, [esp + 0x588]
push ecx
push str._smiranti.dll
lea edx, [esp + 0xed8]
push 0x104
push edx
call fcn.0040be11
push 0x103
lea eax, [esp + 0xddd]
push ebx
push eax
mov byte [esp + 0xde4], bl
call fcn.004128c0
add esp, 0x1c
lea ecx, [esp + 0x588]
push ecx
push str._scltimer.dll
lea edx, [esp + 0xdd0]
push 0x104
push edx
call fcn.0040be11
push 0x103
lea eax, [esp + 0x7ad]
push ebx
push eax
mov byte [esp + 0x7b4], bl
call fcn.004128c0
add esp, 0x1c
lea ecx, [esp + 0x588]
push ecx
push str._smircl32bit.dll
push 0x104
lea edx, [esp + 0x7a4]
push edx
call fcn.0040be11
push 0x103
lea eax, [esp + 0x10f5]
push ebx
push eax
mov byte [esp + 0x10fc], bl
call fcn.004128c0
add esp, 0x1c
lea ecx, [esp + 0x588]
push ecx
push str._sGameList.ini
lea edx, [esp + 0x10e8]
push 0x104
push edx
call fcn.0040be11
push 0x103
lea eax, [esp + 0x140d]
push ebx
push eax
mov byte [esp + 0x1414], bl
call fcn.004128c0
add esp, 0x1c
lea ecx, [esp + 0x588]
push ecx
push 0x41b124
lea edx, [esp + 0x1400]
push 0x104
push edx
call fcn.0040be11
push 0x103
lea eax, [esp + 0x11fd]
push ebx
push eax
mov byte [esp + 0x1204], bl
call fcn.004128c0
add esp, 0x1c
lea ecx, [esp + 0x588]
push ecx
push str._sDatamirclup.bat
lea edx, [esp + 0x11f0]
push 0x104
push edx
call fcn.0040be11
add esp, 0x10
mov eax, str._temp.dat
lea ecx, [esp + 0xac]
call fcn.00404d90
mov esi, eax
lea eax, [esp + 0x588]
lea ecx, [esp + 0x1fc]
call fcn.00404d90
mov ecx, eax
lea eax, [esp + 0x234]
push eax
mov eax, esi
call fcn.00404150
add esp, 4
lea esi, [esp + 0x1fc]
call fcn.00404dd0
lea esi, [esp + 0xac]
call fcn.00404dd0
mov eax, str._echo_off_r_n
lea ecx, [esp + 0x2dc]
call fcn.00404d90
mov eax, str.:loop_r_n
lea ecx, [esp + 0x314]
call fcn.00404d90
mov eax, 0x41b188
lea ecx, [esp + 0x3a0]
call fcn.00404d90
mov esi, eax
lea eax, [esp + 0x690]
lea ecx, [esp + 0x1a8]
call fcn.00404d90
mov edi, eax
mov eax, str.del__
lea ecx, [esp + 0xac]
call fcn.00404d90
mov ecx, eax
lea edx, [esp + 0x1fc]
push edx
mov eax, edi
call fcn.00404150
mov ecx, eax
lea eax, [esp + 0x2a8]
add esp, 4
push eax
mov eax, esi
call fcn.00404150
add esp, 4
lea esi, [esp + 0x1fc]
call fcn.00404dd0
lea esi, [esp + 0xac]
call fcn.00404dd0
lea esi, [esp + 0x1a8]
call fcn.00404dd0
lea esi, [esp + 0x3a0]
call fcn.00404dd0
lea eax, [esp + 0x690]
lea ecx, [esp + 0xac]
call fcn.00404d90
mov esi, eax
mov eax, str.if_exist__
lea ecx, [esp + 0x1fc]
call fcn.00404d90
lea edx, [esp + 0x3a0]
mov ecx, eax
push edx
mov eax, esi
call fcn.00404150
add esp, 4
push eax
mov eax, str.__goto_loop_r_n
lea ecx, [esp + 0x2c4]
call fcn.00404100
add esp, 4
lea esi, [esp + 0x3a0]
call fcn.00404dd0
lea esi, [esp + 0x1fc]
call fcn.00404dd0
lea esi, [esp + 0xac]
call fcn.00404dd0
mov eax, str.:loop1_r_n
lea ecx, [esp + 0x34c]
call fcn.00404d90
mov eax, 0x41b188
lea ecx, [esp + 0x1a8]
call fcn.00404d90
mov esi, eax
lea eax, [esp + 0x8a0]
lea ecx, [esp + 0xac]
call fcn.00404d90
mov edi, eax
mov eax, str.del__
lea ecx, [esp + 0x1fc]
call fcn.00404d90
mov ecx, eax
lea eax, [esp + 0x3a0]
push eax
mov eax, edi
call fcn.00404150
lea edx, [esp + 0x28c]
add esp, 4
mov ecx, eax
push edx
mov eax, esi
call fcn.00404150
add esp, 4
lea esi, [esp + 0x3a0]
call fcn.00404dd0
lea esi, [esp + 0x1fc]
call fcn.00404dd0
lea esi, [esp + 0xac]
call fcn.00404dd0
lea esi, [esp + 0x1a8]
call fcn.00404dd0
lea eax, [esp + 0x8a0]
lea ecx, [esp + 0xac]
call fcn.00404d90
mov esi, eax
mov eax, str.if_exist__
lea ecx, [esp + 0x1fc]
call fcn.00404d90
mov ecx, eax
lea eax, [esp + 0x3a0]
push eax
mov eax, esi
call fcn.00404150
add esp, 4
push eax
mov eax, str.__goto_loop1_r_n
lea ecx, [esp + 0x36c]
call fcn.00404100
add esp, 4
lea esi, [esp + 0x3a0]
call fcn.00404dd0
lea esi, [esp + 0x1fc]
call fcn.00404dd0
lea esi, [esp + 0xac]
call fcn.00404dd0
mov eax, 0x41b188
lea ecx, [esp + 0x410]
call fcn.00404d90
mov esi, eax
lea eax, [esp + 0x690]
lea ecx, [esp + 0x3f4]
call fcn.00404d90
mov edi, eax
mov eax, 0x41b1cc
lea ecx, [esp + 0x42c]
call fcn.00404d90
mov dword [esp + 0xc], eax
mov eax, str.Copy__
lea ecx, [esp + 0x1a8]
call fcn.00404d90
mov ecx, eax
lea eax, [esp + 0x234]
lea ebx, [esp + 0xac]
call fcn.004041d0
lea edx, [esp + 0x1fc]
mov ecx, eax
mov eax, dword [esp + 0xc]
push edx
call fcn.00404150
mov ecx, eax
lea eax, [esp + 0x3a4]
add esp, 4
push eax
mov eax, edi
call fcn.00404150
lea edx, [esp + 0x334]
add esp, 4
mov ecx, eax
push edx
mov eax, esi
call fcn.00404150
add esp, 4
lea esi, [esp + 0x3a0]
call fcn.00404dd0
lea esi, [esp + 0x1fc]
call fcn.00404dd0
mov esi, ebx
call fcn.00404dd0
lea esi, [esp + 0x1a8]
call fcn.00404dd0
lea esi, [esp + 0x42c]
call fcn.00404dd0
lea esi, [esp + 0x3f4]
call fcn.00404dd0
lea esi, [esp + 0x410]
call fcn.00404dd0
mov eax, 0x41b188
lea ecx, [esp + 0x3a0]
call fcn.00404d90
mov esi, eax
lea eax, [esp + 0x690]
lea ecx, [esp + 0x42c]
call fcn.00404d90
mov edi, eax
mov eax, 0x41b1d8
lea ecx, [esp + 0x3f4]
call fcn.00404d90
mov ecx, eax
lea eax, [esp + 0x410]
push eax
mov eax, edi
call fcn.00404150
lea edx, [esp + 0x2fc]
add esp, 4
mov ecx, eax
push edx
mov eax, esi
call fcn.00404150
add esp, 4
lea esi, [esp + 0x410]
call fcn.00404dd0
lea esi, [esp + 0x3f4]
call fcn.00404dd0
lea esi, [esp + 0x42c]
call fcn.00404dd0
lea esi, [esp + 0x3a0]
call fcn.00404dd0
mov eax, str.del__0_r_n
lea ecx, [esp + 0x26c]
call fcn.00404d90
lea eax, [esp + 0x314]
push eax
lea ecx, [esp + 0x2e0]
push ecx
lea edx, [esp + 0x3e0]
push edx
call fcn.00404210
mov ecx, eax
add esp, 0xc
lea eax, [esp + 0x2a4]
lea ebx, [esp + 0x1a8]
call fcn.004041d0
mov ecx, eax
lea eax, [esp + 0x2c0]
lea ebx, [esp + 0xac]
call fcn.004041d0
mov ecx, eax
lea eax, [esp + 0x34c]
lea ebx, [esp + 0x1fc]
call fcn.004041d0
mov ecx, eax
lea eax, [esp + 0x288]
lea ebx, [esp + 0x3a0]
call fcn.004041d0
mov ecx, eax
lea eax, [esp + 0x368]
lea ebx, [esp + 0x42c]
call fcn.004041d0
mov ecx, eax
lea eax, [esp + 0x330]
lea ebx, [esp + 0x3f4]
call fcn.004041d0
mov ecx, eax
lea eax, [esp + 0x2f8]
lea ebx, [esp + 0x410]
call fcn.004041d0
mov ecx, eax
lea eax, [esp + 0x26c]
lea ebx, [esp + 0x1c4]
call fcn.004041d0
lea esi, [esp + 0x410]
call fcn.00404dd0
lea esi, [esp + 0x3f4]
call fcn.00404dd0
lea esi, [esp + 0x42c]
call fcn.00404dd0
lea esi, [esp + 0x3a0]
call fcn.00404dd0
lea esi, [esp + 0x1fc]
call fcn.00404dd0
lea esi, [esp + 0xac]
call fcn.00404dd0
lea esi, [esp + 0x1a8]
call fcn.00404dd0
lea esi, [esp + 0x3d8]
call fcn.00404dd0
cmp dword [esp + 0x1d8], 0x10
mov eax, dword [esp + 0x1c4]
jae 0x4025d5
mov eax, ebx
mov ecx, dword [esp + 0x1d4]
push ecx
push eax
lea eax, [esp + 0x11f0]
call fcn.004063f0
add esp, 8
lea eax, [esp + 0x690]
lea ecx, [esp + 0x384]
call fcn.00404d90
xor edi, edi
lea ecx, [esp + 0x170]
mov dword [esp + 0x184], 0xf
mov dword [esp + 0x180], edi
mov byte [esp + 0x170], 0
call fcn.00407850
test eax, eax
je 0x402734
mov eax, str..lnk
lea ecx, [esp + 0x42c]
call fcn.00404d90
mov esi, eax
mov eax, 0x41b1f0
lea ecx, [esp + 0x3f4]
call fcn.00404d90
lea edx, [esp + 0x410]
push edx
mov ecx, eax
lea ebx, [esp + 0x174]
call fcn.004042d0
mov ecx, eax
add esp, 4
lea eax, [esp + 0x250]
lea ebx, [esp + 0x3d8]
call fcn.004041d0
mov ecx, eax
lea eax, [esp + 0xac]
push eax
mov eax, esi
call fcn.00404150
add esp, 4
mov esi, ebx
call fcn.00404dd0
lea esi, [esp + 0x410]
call fcn.00404dd0
lea esi, [esp + 0x3f4]
call fcn.00404dd0
lea esi, [esp + 0x42c]
call fcn.00404dd0
lea ecx, [esp + 0xac]
push ecx
lea ecx, [esp + 0x1e4]
call fcn.00407e80
mov eax, dword [esp + 0x174]
mov edi, 0x10
add esp, 4
cmp dword [esp + 0x184], edi
jae 0x4026f4
lea eax, [esp + 0x170]
mov esi, dword [sym.imp.SHELL32.dll_SHChangeNotify]
push 0
push eax
push 1
push 0x1000
call esi
mov eax, dword [esp + 0x170]
cmp dword [esp + 0x184], edi
jae 0x40271d
lea eax, [esp + 0x170]
push 0
push eax
push 1
push 2
call esi
lea esi, [esp + 0xac]
call fcn.00404dd0
xor edi, edi
push 0x103
lea edx, [esp + 0xfdd]
push edi
push edx
mov byte [esp + 0xfe4], 0
call fcn.004128c0
add esp, 0xc
lea eax, [esp + 0x588]
push eax
push str._sSkyGuard.dll
lea ecx, [esp + 0xfe0]
push 0x104
push ecx
call fcn.0040be11
add esp, 0x10
lea esi, [esp + 0xfd8]
call fcn.00406300
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x40278f
mov edx, esi
push edx
call ebx
push 0x103
lea eax, [esp + 0xbbd]
push edi
push eax
mov byte [esp + 0xbc4], 0
call fcn.004128c0
add esp, 0xc
lea ecx, [esp + 0x588]
push ecx
push str._sMemoryGuard.dll
lea edx, [esp + 0xbc0]
push 0x104
push edx
call fcn.0040be11
add esp, 0x10
lea esi, [esp + 0xbb8]
call fcn.00406300
test eax, eax
je 0x4027e4
mov eax, esi
push eax
call ebx
lea esi, [esp + 0xed0]
call fcn.00406300
test eax, eax
je 0x4027f9
mov ecx, esi
push ecx
call ebx
lea esi, [esp + 0xdc8]
call fcn.00406300
test eax, eax
je 0x40280e
mov edx, esi
push edx
call ebx
lea eax, [esp + 0x588]
push eax
mov ecx, str..BAK
call fcn.00407320
lea ecx, [esp + 0x58c]
add esp, 4
push ecx
mov ecx, str..TMP
call fcn.00407320
lea edx, [esp + 0x58c]
add esp, 4
push edx
mov ecx, str..RAR
call fcn.00407320
lea eax, [esp + 0x58c]
add esp, 4
push eax
mov ecx, str..BAT
call fcn.00407320
add esp, 4
push edi
push 0x41afef
lea eax, [esp + 0x10e8]
call fcn.004063f0
mov eax, str.
add esp, 8
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402880
sub eax, edx
push eax
push str.
lea eax, [esp + 0x1400]
call fcn.004063f0
mov edx, dword [esp + 0x1e8]
mov ebx, 0x10
add esp, 8
cmp dword [esp + 0x1f4], ebx
jae 0x4028ba
lea edx, [esp + 0x1e0]
push 0x683f78
lea ecx, [esp + 0x8a4]
call fcn.00408440
add esp, 4
lea ecx, [esp + 0xcc0]
push ecx
push 0x684088
mov eax, 1
call fcn.00408350
lea edx, [esp + 0x12f8]
push edx
push 0x684198
mov eax, 2
call fcn.00408350
lea eax, [esp + 0x7a8]
push eax
push 0x6842a8
mov eax, 3
call fcn.00408350
add esp, 0x18
mov esi, 0x683f7c
jmp 0x402920
cmp dword [esi - 4], edi
jne 0x402ab5
mov eax, dword [esi]
cmp eax, edi
je 0x402938
push eax
call fcn.0040b5f6
add esp, 4
add esi, 0x110
cmp esi, 0x684a1c
jl 0x402920
push str.GlobalA2EC019D_CAF8_47AA_8F94_0F010DE6A3B0
push edi
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov esi, eax
cmp esi, edi
je 0x402b2e
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [esp + 0x170]
call fcn.00404dd0
lea esi, [esp + 0x384]
call fcn.00404dd0
lea esi, [esp + 0x1c4]
call fcn.00404dd0
lea esi, [esp + 0x26c]
call fcn.00404dd0
lea esi, [esp + 0x2f8]
call fcn.00404dd0
lea esi, [esp + 0x330]
call fcn.00404dd0
lea esi, [esp + 0x368]
call fcn.00404dd0
lea esi, [esp + 0x288]
call fcn.00404dd0
lea esi, [esp + 0x34c]
call fcn.00404dd0
lea esi, [esp + 0x2c0]
call fcn.00404dd0
lea esi, [esp + 0x2a4]
call fcn.00404dd0
lea esi, [esp + 0x314]
call fcn.00404dd0
lea esi, [esp + 0x2dc]
call fcn.00404dd0
lea esi, [esp + 0x234]
call fcn.00404dd0
lea esi, [esp + 0x3bc]
call fcn.00404dd0
lea esi, [esp + 0x1e0]
call fcn.00404dd0
lea esi, [esp + 0x250]
call fcn.00404dd0
lea esi, [esp + 0x18c]
call fcn.00404dd0
lea esi, [esp + 0x138]
call fcn.00404dd0
lea esi, [esp + 0x100]
call fcn.00404dd0
lea esi, [esp + 0x11c]
call fcn.00404dd0
lea esi, [esp + 0x154]
call fcn.00404dd0
lea esi, [esp + 0xc8]
call fcn.00404dd0
lea esi, [esp + 0xe4]
call fcn.00404dd0
lea esi, [esp + 0x90]
call fcn.00404dd0
lea esi, [esp + 0x74]
call fcn.00404dd0
lea esi, [esp + 0x218]
call fcn.00404dd0
jmp 0x403ac8
push str.Global342DDACD_7A00_4D8E_AE4D_C72D09A90FCC
push edi
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov esi, eax
cmp esi, edi
je 0x402ae5
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x683f84
lea ebx, [ebx]
cmp dword [esi - 0xc], edi
je 0x402b20
call fcn.00406300
test eax, eax
je 0x402b05
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esi - 4]
mov edx, dword [esi - 8]
push ecx
push edx
mov eax, esi
call fcn.004063f0
mov eax, dword [esi - 8]
push eax
call fcn.0040b5f6
add esp, 0xc
add esi, 0x110
cmp esi, 0x684a24
jl 0x402af0
push 0x44
lea ecx, [esp + 0x2c]
push edi
push ecx
call fcn.004128c0
add esp, 0xc
lea edx, [esp + 0xcc0]
push edx
lea eax, [esp + 0x8a4]
push eax
lea ecx, [esp + 0x590]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], 0x44
call fcn.004016f0
test eax, eax
je 0x403205
push str.Global4817E4F0_72F7_4D65_B5B3_25024FDF3269
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
mov dword [esp + 0x10], esi
cmp esi, edi
je 0x402d07
push str.4817E4F0_72F7_4D65_B5B3_25024FDF3269
push 0x1000
push edi
push 4
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esp + 0xc], eax
cmp eax, edi
je 0x402cdc
push edi
push edi
push edi
push 6
mov ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea ecx, [esp + 0x3dc]
mov dword [ebx + 4], eax
call fcn.00408760
add esp, 4
cmp dword [eax + 0x14], 0x10
jb 0x402bf4
mov eax, dword [eax]
push eax
lea edx, [ebx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea esi, [esp + 0x3d8]
call fcn.00404dd0
call fcn.00408880
push eax
lea ecx, [esp + 0x3dc]
mov dword [ebx + 0x10c], eax
call fcn.00408760
add esp, 4
cmp dword [eax + 0x14], 0x10
jb 0x402c2e
mov eax, dword [eax]
push eax
lea eax, [ebx + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea esi, [esp + 0x3d8]
call fcn.00404dd0
push str.Client_tmp
push 0xa00000
push edi
push 4
push edi
push 0xffffffffffffffff
mov dword [ebx], 1
mov dword [ebx + 0x214], 0x1b2840
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
cmp esi, edi
je 0x402c99
push 0x1b2840
push edi
push edi
push 6
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [0x683f68]
push 0x1b2840
push ecx
push eax
call fcn.0040c5a0
add esp, 0xc
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ebx, dword [esp + 0x10]
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, edi
je 0x402cc0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
jmp 0x402cc6
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
mov edi, dword [esp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call esi
jmp 0x40296f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x40
push 0x41aff0
push str._1000_
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40296f
mov ecx, dword [esp + 0x14]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x40
push 0x41aff0
push str._1001_
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [esp + 0x184], ebx
jb 0x402d3f
mov edx, dword [esp + 0x170]
push edx
call fcn.0040b752
add esp, 4
mov esi, 0xf
mov dword [esp + 0x184], esi
mov dword [esp + 0x180], edi
mov byte [esp + 0x170], 0
cmp dword [esp + 0x398], ebx
jb 0x402d73
mov eax, dword [esp + 0x384]
push eax
call fcn.0040b752
add esp, 4
mov dword [esp + 0x398], esi
mov dword [esp + 0x394], edi
mov byte [esp + 0x384], 0
cmp dword [esp + 0x1d8], ebx
jb 0x402da2
mov ecx, dword [esp + 0x1c4]
push ecx
call fcn.0040b752
add esp, 4
mov dword [esp + 0x1d8], esi
mov dword [esp + 0x1d4], edi
mov byte [esp + 0x1c4], 0
cmp dword [esp + 0x280], ebx
jb 0x402dd1
mov edx, dword [esp + 0x26c]
push edx
call fcn.0040b752
add esp, 4
mov dword [esp + 0x280], esi
mov dword [esp + 0x27c], edi
mov byte [esp + 0x26c], 0
cmp dword [esp + 0x30c], ebx
jb 0x402e00
mov eax, dword [esp + 0x2f8]
push eax
call fcn.0040b752
add esp, 4
mov dword [esp + 0x30c], esi
mov dword [esp + 0x308], edi
mov byte [esp + 0x2f8], 0
cmp dword [esp + 0x344], ebx
jb 0x402e2f
mov ecx, dword [esp + 0x330]
push ecx
call fcn.0040b752
add esp, 4
mov dword [esp + 0x344], esi
mov dword [esp + 0x340], edi
mov byte [esp + 0x330], 0
cmp dword [esp + 0x37c], ebx
jb 0x402e5e
mov edx, dword [esp + 0x368]
push edx
call fcn.0040b752
add esp, 4
mov dword [esp + 0x37c], esi
mov dword [esp + 0x378], edi
mov byte [esp + 0x368], 0
cmp dword [esp + 0x29c], ebx
jb 0x402e8d
mov eax, dword [esp + 0x288]
push eax
call fcn.0040b752
add esp, 4
mov dword [esp + 0x29c], esi
mov dword [esp + 0x298], edi
mov byte [esp + 0x288], 0
cmp dword [esp + 0x360], ebx
jb 0x402ebc
mov ecx, dword [esp + 0x34c]
push ecx
call fcn.0040b752
add esp, 4
mov dword [esp + 0x360], esi
mov dword [esp + 0x35c], edi
mov byte [esp + 0x34c], 0
cmp dword [esp + 0x2d4], ebx
jb 0x402eeb
mov edx, dword [esp + 0x2c0]
push edx
call fcn.0040b752
add esp, 4
mov dword [esp + 0x2d4], esi
mov dword [esp + 0x2d0], edi
mov byte [esp + 0x2c0], 0
cmp dword [esp + 0x2b8], ebx
jb 0x402f1a
mov eax, dword [esp + 0x2a4]
push eax
call fcn.0040b752
add esp, 4
mov dword [esp + 0x2b8], esi
mov dword [esp + 0x2b4], edi
mov byte [esp + 0x2a4], 0
cmp dword [esp + 0x328], ebx
jb 0x402f49
mov ecx, dword [esp + 0x314]
push ecx
call fcn.0040b752
add esp, 4
mov dword [esp + 0x328], esi
mov dword [esp + 0x324], edi
mov byte [esp + 0x314], 0
cmp dword [esp + 0x2f0], ebx
jb 0x402f78
mov edx, dword [esp + 0x2dc]
push edx
call fcn.0040b752
add esp, 4
mov dword [esp + 0x2f0], esi
mov dword [esp + 0x2ec], edi
mov byte [esp + 0x2dc], 0
cmp dword [esp + 0x248], ebx
jb 0x402fa7
mov eax, dword [esp + 0x234]
push eax
call fcn.0040b752
add esp, 4
mov dword [esp + 0x248], esi
mov dword [esp + 0x244], edi
mov byte [esp + 0x234], 0
cmp dword [esp + 0x3d0], ebx
jb 0x402fd6
mov ecx, dword [esp + 0x3bc]
push ecx
call fcn.0040b752
add esp, 4
mov dword [esp + 0x3d0], esi
mov dword [esp + 0x3cc], edi
mov byte [esp + 0x3bc], 0
cmp dword [esp + 0x1f4], ebx
jb 0x403005
mov edx, dword [esp + 0x1e0]
push edx
call fcn.0040b752
add esp, 4
mov dword [esp + 0x1f4], esi
mov dword [esp + 0x1f0], edi
mov byte [esp + 0x1e0], 0
cmp dword [esp + 0x264], ebx
jb 0x403034
mov eax, dword [esp + 0x250]
push eax
call fcn.0040b752
add esp, 4
mov dword [esp + 0x264], esi
mov dword [esp + 0x260], edi
mov byte [esp + 0x250], 0
cmp dword [esp + 0x1a0], ebx
jb 0x403063
mov ecx, dword [esp + 0x18c]
push ecx
call fcn.0040b752
add esp, 4
mov dword [esp + 0x1a0], esi
mov dword [esp + 0x19c], edi
mov byte [esp + 0x18c], 0
cmp dword [esp + 0x14c], ebx
jb 0x403092
mov edx, dword [esp + 0x138]
push edx
call fcn.0040b752
add esp, 4
mov dword [esp + 0x14c], esi
mov dword [esp + 0x148], edi
mov byte [esp + 0x138], 0
cmp dword [esp + 0x114], ebx
jb 0x4030c1
mov eax, dword [esp + 0x100]
push eax
call fcn.0040b752
add esp, 4
mov dword [esp + 0x114], esi
mov dword [esp + 0x110], edi
mov byte [esp + 0x100], 0
cmp dword [esp + 0x130], ebx
jb 0x4030f0
mov ecx, dword [esp + 0x11c]
push ecx
call fcn.0040b752
add esp, 4
mov dword [esp + 0x130], esi
mov dword [esp + 0x12c], edi
mov byte [esp + 0x11c], 0
cmp dword [esp + 0x168], ebx
jb 0x40311f
mov edx, dword [esp + 0x154]
push edx
call fcn.0040b752
add esp, 4
mov dword [esp + 0x168], esi
mov dword [esp + 0x164], edi
mov byte [esp + 0x154], 0
cmp dword [esp + 0xdc], ebx
jb 0x40314e
mov eax, dword [esp + 0xc8]
push eax
call fcn.0040b752
add esp, 4
mov dword [esp + 0xdc], esi
mov dword [esp + 0xd8], edi
mov byte [esp + 0xc8], 0
cmp dword [esp + 0xf8], ebx
jb 0x40317d
mov ecx, dword [esp + 0xe4]
push ecx
call fcn.0040b752
add esp, 4
mov dword [esp + 0xf8], esi
mov dword [esp + 0xf4], edi
mov byte [esp + 0xe4], 0
cmp dword [esp + 0xa4], ebx
jb 0x4031ac
mov edx, dword [esp + 0x90]
push edx
call fcn.0040b752
add esp, 4
mov dword [esp + 0xa4], esi
mov dword [esp + 0xa0], edi
mov byte [esp + 0x90], 0
cmp dword [esp + 0x88], ebx
jb 0x4031d8
mov eax, dword [esp + 0x74]
push eax
call fcn.0040b752
add esp, 4
mov dword [esp + 0x88], esi
mov dword [esp + 0x84], edi
mov byte [esp + 0x74], 0
cmp dword [esp + 0x22c], ebx
jb 0x403ac8
mov ecx, dword [esp + 0x218]
push ecx
jmp 0x403ac0
push 0x40
push 0x41aff0
push str._1002_
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [esp + 0x184], ebx
jb 0x403231
mov edx, dword [esp + 0x170]
push edx
call fcn.0040b752
add esp, 4
mov esi, 0xf
mov dword [esp + 0x184], esi
mov dword [esp + 0x180], edi
mov byte [esp + 0x170], 0
cmp dword [esp + 0x398], ebx
jb 0x403265
mov eax, dword [esp + 0x384]
push eax
call fcn.0040b752
add esp, 4
mov dword [esp + 0x398], esi
mov dword [esp + 0x394], edi
mov byte [esp + 0x384], 0
cmp dword [esp + 0x1d8], ebx
jb 0x403294
mov ecx, dword [esp + 0x1c4]
push ecx
call fcn.0040b752
add esp, 4
mov dword [esp + 0x1d8], esi
mov dword [esp + 0x1d4], edi
mov byte [esp + 0x1c4], 0
cmp dword [esp + 0x280], ebx
jb 0x4032c3
mov edx, dword [esp + 0x26c]
push edx
call fcn.0040b752
add esp, 4
mov dword [esp + 0x280], esi
mov dword [esp + 0x27c], edi
mov byte [esp + 0x26c], 0
cmp dword [esp + 0x30c], ebx
jb 0x4032f2
mov eax, dword [esp + 0x2f8]
push eax
call fcn.0040b752
add esp, 4
mov dword [esp + 0x30c], esi
mov dword [esp + 0x308], edi
mov byte [esp + 0x2f8], 0
cmp dword [esp + 0x344], ebx
jb 0x403321
mov ecx, dword [esp + 0x330]
push ecx
call fcn.0040b752
add esp, 4
mov dword [esp + 0x344], esi
mov dword [esp + 0x340], edi
mov byte [esp + 0x330], 0
cmp dword [esp + 0x37c], ebx
jb 0x403350
mov edx, dword [esp + 0x368]
push edx
call fcn.0040b752
add esp, 4
mov dword [esp + 0x37c], esi
mov dword [esp + 0x378], edi
mov byte [esp + 0x368], 0
cmp dword [esp + 0x29c], ebx
jb 0x40337f
mov eax, dword [esp + 0x288]
push eax
call fcn.0040b752
add esp, 4
mov dword [esp + 0x29c], esi
mov dword [esp + 0x298], edi
mov byte [esp + 0x288], 0
cmp dword [esp + 0x360], ebx
jb 0x4033ae
mov ecx, dword [esp + 0x34c]
push ecx
call fcn.0040b752
add esp, 4
mov dword [esp + 0x360], esi
mov dword [esp + 0x35c], edi
mov byte [esp + 0x34c], 0
cmp dword [esp + 0x2d4], ebx
jb 0x4033dd
mov edx, dword [esp + 0x2c0]
push edx
call fcn.0040b752
add esp, 4
mov dword [esp + 0x2d4], esi
mov dword [esp + 0x2d0], edi
mov byte [esp + 0x2c0], 0
cmp dword [esp + 0x2b8], ebx
jb 0x40340c
mov eax, dword [esp + 0x2a4]
push eax
call fcn.0040b752
add esp, 4
mov dword [esp + 0x2b8], esi
mov dword [esp + 0x2b4], edi
mov byte [esp + 0x2a4], 0
cmp dword [esp + 0x328], ebx
jb 0x40343b
mov ecx, dword [esp + 0x314]
push ecx
call fcn.0040b752
add esp, 4
mov dword [esp + 0x328], esi
mov dword [esp + 0x324], edi
mov byte [esp + 0x314], 0
cmp dword [esp + 0x2f0], ebx
jb 0x40346a
mov edx, dword [esp + 0x2dc]
push edx
call fcn.0040b752
add esp, 4
mov dword [esp + 0x2f0], esi
mov dword [esp + 0x2ec], edi
mov byte [esp + 0x2dc], 0
cmp dword [esp + 0x248], ebx
jb 0x403499
mov eax, dword [esp + 0x234]
push eax
call fcn.0040b752
add esp, 4
mov dword [esp + 0x248], esi
mov dword [esp + 0x244], edi
mov byte [esp + 0x234], 0
cmp dword [esp + 0x3d0], ebx
jb 0x4034c8
mov ecx, dword [esp + 0x3bc]
push ecx
call fcn.0040b752
add esp, 4
mov dword [esp + 0x3d0], esi
mov dword [esp + 0x3cc], edi
mov byte [esp + 0x3bc], 0
cmp dword [esp + 0x1f4], ebx
jb 0x4034f7
mov edx, dword [esp + 0x1e0]
push edx
call fcn.0040b752
add esp, 4
mov dword [esp + 0x1f4], esi
mov dword [esp + 0x1f0], edi
mov byte [esp + 0x1e0], 0
cmp dword [esp + 0x264], ebx
jb 0x403526
mov eax, dword [esp + 0x250]
push eax
call fcn.0040b752
add esp, 4
mov dword [esp + 0x264], esi
mov dword [esp + 0x260], edi
mov byte [esp + 0x250], 0
cmp dword [esp + 0x1a0], ebx
jb 0x403555
mov ecx, dword [esp + 0x18c]
push ecx
call fcn.0040b752
add esp, 4
mov dword [esp + 0x1a0], esi
mov dword [esp + 0x19c], edi
mov byte [esp + 0x18c], 0
cmp dword [esp + 0x14c], ebx
jb 0x403584
mov edx, dword [esp + 0x138]
push edx
call fcn.0040b752
add esp, 4
mov dword [esp + 0x14c], esi
mov dword [esp + 0x148], edi
mov byte [esp + 0x138], 0
cmp dword [esp + 0x114], ebx
jb 0x4035b3
mov eax, dword [esp + 0x100]
push eax
call fcn.0040b752
add esp, 4
mov dword [esp + 0x114], esi
mov dword [esp + 0x110], edi
mov byte [esp + 0x100], 0
cmp dword [esp + 0x130], ebx
jb 0x4035e2
mov ecx, dword [esp + 0x11c]
push ecx
call fcn.0040b752
add esp, 4
mov dword [esp + 0x130], esi
mov dword [esp + 0x12c], edi
mov byte [esp + 0x11c], 0
cmp dword [esp + 0x168], ebx
jb 0x403611
mov edx, dword [esp + 0x154]
push edx
call fcn.0040b752
add esp, 4
mov dword [esp + 0x168], esi
mov dword [esp + 0x164], edi
mov byte [esp + 0x154], 0
cmp dword [esp + 0xdc], ebx
jb 0x403640
mov eax, dword [esp + 0xc8]
push eax
call fcn.0040b752
add esp, 4
mov dword [esp + 0xdc], esi
mov dword [esp + 0xd8], edi
mov byte [esp + 0xc8], 0
cmp dword [esp + 0xf8], ebx
jb 0x40366f
mov ecx, dword [esp + 0xe4]
push ecx
call fcn.0040b752
add esp, 4
mov dword [esp + 0xf8], esi
mov dword [esp + 0xf4], edi
mov byte [esp + 0xe4], 0
cmp dword [esp + 0xa4], ebx
jb 0x40369e
mov edx, dword [esp + 0x90]
push edx
call fcn.0040b752
add esp, 4
mov dword [esp + 0xa4], esi
mov dword [esp + 0xa0], edi
mov byte [esp + 0x90], 0
cmp dword [esp + 0x88], ebx
jb 0x4036ca
mov eax, dword [esp + 0x74]
push eax
call fcn.0040b752
add esp, 4
mov dword [esp + 0x88], esi
mov dword [esp + 0x84], edi
mov byte [esp + 0x74], 0
cmp dword [esp + 0x22c], ebx
jb 0x403ac8
mov ecx, dword [esp + 0x218]
push ecx
jmp 0x403ac0
cmp dword [esp + 0x88], 0x10
mov edi, dword [esp + 0x74]
jae 0x403712
lea edi, [esp + 0x74]
push 0x13c
lea edx, [esp + 0x450]
push ebx
push edx
xor esi, esi
mov dword [esp + 0x454], ebx
call fcn.004128c0
add esp, 0xc
lea eax, [esp + 0x448]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x403754
test byte [esp + 0x448], 0x10
jne 0x403754
mov esi, 1
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, ebx
je 0x403785
cmp dword [esp + 0x88], 0x10
mov eax, dword [esp + 0x74]
jae 0x403771
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403700
push 0x103
lea ecx, [esp + 0x79d]
push ebx
push ecx
mov byte [esp + 0x7a4], bl
call fcn.004128c0
add esp, 0xc
push 0x104
lea edx, [esp + 0x79c]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [esp + 0x74]
mov edi, 0x10
cmp dword [esp + 0x88], edi
jae 0x4037cc
lea eax, [esp + 0x74]
push ebx
push 0x8000000
push 2
push ebx
push 3
push 0x40000000
push eax
mov dword [esp + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, ebx
jbe 0x403816
cmp esi, 0xffffffff
je 0x403816
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [esp + 0x14]
push eax
push 0x104
lea ecx, [esp + 0x7a4]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
push ebx
push 0x403bf0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [esp + 0x24]
push ebx
push 0x403b60
push ebx
push 0x67
push edx
mov dword [0x683f6c], eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov eax, dword [0x683f6c]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [0x682df0]
mov edx, dword [0x682ddc]
cmp esi, edi
jae 0x403869
mov edx, 0x682ddc
xor eax, eax
mov ecx, 0x41afef
call fcn.004047a0
cmp eax, ebx
jne 0x40388c
xor eax, eax
cmp dword [0x682dec], ebx
setne al
cmp eax, ebx
je 0x40392d
mov edx, dword [0x682df8]
cmp dword [0x682e0c], edi
jae 0x40389f
mov edx, 0x682df8
xor eax, eax
mov ecx, 0x41afef
call fcn.004047a0
cmp eax, ebx
jne 0x4038be
xor eax, eax
cmp dword [0x682e08], ebx
setne al
cmp eax, ebx
je 0x40392d
push 0x40
lea ecx, [esp + 0x30]
push ebx
push ecx
call fcn.004128c0
mov ecx, dword [0x682ddc]
add esp, 0xc
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], 0x44
cmp esi, edi
jae 0x4038f5
mov ecx, 0x682ddc
mov eax, dword [0x682df8]
cmp dword [0x682e0c], edi
jae 0x403907
mov eax, 0x682df8
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x2c]
push edx
push ecx
push ebx
push 4
push ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x403940
push 0x40
push 0x41aff0
push 0x41b000
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [esp + 0x14c], edi
jb 0x403959
mov ecx, dword [esp + 0x138]
push ecx
call fcn.0040b752
add esp, 4
mov esi, 0xf
mov byte [esp + 0x138], bl
mov dword [esp + 0x148], ebx
mov dword [esp + 0x14c], esi
cmp dword [esp + 0x114], edi
jb 0x40398c
mov edx, dword [esp + 0x100]
push edx
call fcn.0040b752
add esp, 4
mov byte [esp + 0x100], bl
mov dword [esp + 0x110], ebx
mov dword [esp + 0x114], esi
cmp dword [esp + 0x130], edi
jb 0x4039ba
mov eax, dword [esp + 0x11c]
push eax
call fcn.0040b752
add esp, 4
mov byte [esp + 0x11c], bl
mov dword [esp + 0x12c], ebx
mov dword [esp + 0x130], esi
cmp dword [esp + 0x168], edi
jb 0x4039e8
mov ecx, dword [esp + 0x154]
push ecx
call fcn.0040b752
add esp, 4
mov byte [esp + 0x154], bl
mov dword [esp + 0x164], ebx
mov dword [esp + 0x168], esi
cmp dword [esp + 0xdc], edi
jb 0x403a16
mov edx, dword [esp + 0xc8]
push edx
call fcn.0040b752
add esp, 4
mov byte [esp + 0xc8], bl
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xdc], esi
cmp dword [esp + 0xf8], edi
jb 0x403a44
mov eax, dword [esp + 0xe4]
push eax
call fcn.0040b752
add esp, 4
mov byte [esp + 0xe4], bl
mov dword [esp + 0xf4], ebx
mov dword [esp + 0xf8], esi
cmp dword [esp + 0xa4], edi
jb 0x403a72
mov ecx, dword [esp + 0x90]
push ecx
call fcn.0040b752
add esp, 4
mov byte [esp + 0x90], bl
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], esi
cmp dword [esp + 0x88], edi
jb 0x403a9d
mov edx, dword [esp + 0x74]
push edx
call fcn.0040b752
add esp, 4
mov byte [esp + 0x74], bl
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], esi
cmp dword [esp + 0x22c], edi
jb 0x403ac8
mov eax, dword [esp + 0x218]
push eax
call fcn.0040b752
add esp, 4
mov ecx, dword [esp + 0x1504]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0040b5e7
mov esp, ebp
pop ebp
ret 0x10