Function at 0x408c24
Capabilities:
Create process on windows
Create thread
Get common file path
Send data
Send data on socket
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x408c2d
mov eax, dword [ebp - 4]
add esp, 0xfffffbf0
push esi
push edi
mov esi, 0x4be6c8
lea edi, [ebp - 0xaf0]
mov ecx, 0x28a
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx + 4]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x18]
add eax, 8
mov dword [ebp - 0x14], eax
push 0x104
call fcn.0049cfe8
pop ecx
mov dword [ebp - 0x1c], eax
xor edx, edx
mov dword [ebp - 0x20], edx
push 0x4c24ae
imul ecx, dword [ebp - 0x20], 0x104
lea eax, [ebp - 0xaf0]
add ecx, eax
push ecx
call fcn.0049dac8
add esp, 8
inc dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
cmp edx, 0xa
jl 0x408c7f
push 0x4c24b0
push dword [ebp - 0x1c]
call fcn.0049dac8
add esp, 8
mov ecx, dword [ebp - 0x18]
add ecx, 8
push ecx
call fcn.0049daf8
pop ecx
mov dword [ebp - 0xc], eax
push 0x4c24b2
mov eax, dword [ebp - 0x18]
add eax, 8
push eax
call fcn.0049dc09
add esp, 8
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x408cfa
mov ecx, dword [ebp - 0x18]
add ecx, 8
mov eax, dword [ebp - 0x10]
sub eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x10]
inc edx
mov dword [ebp - 0x14], edx
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
add ecx, 8
push ecx
push dword [ebp - 0x1c]
call fcn.0049dcf8
add esp, 0xc
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
mov byte [eax + edx], 0
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], ecx
push dword [ebp - 0x24]
call fcn.004a5d58
pop ecx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, 0x1715
je 0x408d4b
mov edx, dword [ebp - 8]
cmp edx, 0x17180
je 0x408d4b
mov ecx, dword [ebp - 8]
cmp ecx, 0x17170
jne 0x408d9c
push dword [ebp - 0x14]
lea eax, [ebp - 0xaf0]
push eax
call fcn.0049dac8
add esp, 8
lea edx, [ebp - 0xaf0]
push edx
call fcn.0049daf8
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
test ecx, ecx
jle 0x408e2e
mov eax, dword [ebp - 0x28]
movsx edx, byte [ebp + eax - 0xaf1]
cmp edx, 0xa
jne 0x408e2e
mov ecx, dword [ebp - 0x28]
mov byte [ebp + ecx - 0xaf1], 0
jmp 0x408e2e
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x408e1b
push dword [ebp - 0x14]
call fcn.0049daf8
pop ecx
mov dword [ebp - 0xc], eax
push 0x4c24b4
push dword [ebp - 0x14]
call fcn.0049dc09
add esp, 8
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x408dd4
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
sub ecx, eax
mov dword [ebp - 0xc], ecx
push dword [ebp - 0xc]
push dword [ebp - 0x14]
imul edx, dword [ebp - 0x2c], 0x104
lea ecx, [ebp - 0xaf0]
add edx, ecx
push edx
call fcn.0049dcf8
add esp, 0xc
mov eax, dword [ebp - 0x2c]
mov edx, eax
shl eax, 6
add eax, edx
lea ecx, [ebp + eax*4 - 0xaf0]
mov eax, dword [ebp - 0xc]
mov byte [ecx + eax], 0
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x408e2e
mov ecx, dword [ebp - 0x10]
inc ecx
mov dword [ebp - 0x14], ecx
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp eax, 0xa
jge 0x408e2e
mov edx, dword [ebp - 0x10]
test edx, edx
jne 0x408da3
mov dword [ebp - 0x30], 0xffffffff
mov esi, 0x4bf0f0
lea edi, [ebp - 0xef0]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
mov esi, 0x4bf4f0
lea edi, [ebp - 0x12f0]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
mov esi, 0x4bf8f0
lea edi, [ebp - 0x13f4]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x12f0]
push eax
push 0x4c24b6
lea edx, [ebp - 0x13f4]
push edx
call fcn.0040d5c4
add esp, 0xc
mov ecx, dword [ebp - 8]
cmp ecx, 0x1715
jg 0x408edf
je 0x4092b0
cmp ecx, 0x1710
jg 0x408ec5
je 0x4090a0
sub ecx, 0x1401
je 0x408fe0
dec ecx
je 0x409a18
sub ecx, 0x302
je 0x408f26
jmp 0x409c3a
sub ecx, 0x1711
je 0x4090fc
sub ecx, 3
je 0x409158
jmp 0x409c3a
cmp ecx, 0x1719
jg 0x408f0c
je 0x40995a
sub ecx, 0x1716
je 0x409980
dec ecx
je 0x409515
dec ecx
je 0x4098a1
jmp 0x409c3a
sub ecx, 0x17170
je 0x40946f
sub ecx, 0x10
je 0x4093c2
jmp 0x409c3a
push 0x20c
call fcn.0049ce44
pop ecx
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0xaf0]
push eax
push dword [ebp - 0x38]
call fcn.0049dac8
add esp, 8
lea edx, [ebp - 0x9ec]
push edx
mov ecx, dword [ebp - 0x38]
add ecx, 0x104
push ecx
call fcn.0049dac8
add esp, 8
lea eax, [ebp - 0x8e8]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x3c]
call fcn.004a5d58
pop ecx
or eax, 0x40000
mov edx, dword [ebp - 0x38]
mov dword [edx + 0x208], eax
xor ecx, ecx
mov dword [ebp - 0x40], ecx
jmp 0x408fa2
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x40]
movsx ecx, byte [eax + edx]
cmp ecx, 0x3b
jne 0x408f9f
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x40]
mov byte [eax + edx], 0xa
inc dword [ebp - 0x40]
push dword [ebp - 0x38]
call fcn.0049daf8
pop ecx
mov ecx, dword [ebp - 0x40]
cmp eax, ecx
ja 0x408f86
lea eax, [ebp - 0x34]
push eax
push 0
push dword [ebp - 0x38]
push 0x4087b8
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [ebp - 0x44], eax
push dword [ebp - 0x44]
call sub.KERNEL32.DLL_CloseHandle
mov dword [ebp - 0x30], 1
jmp 0x409c4a
mov esi, 0x4bf9f4
lea edi, [ebp - 0x14f8]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14f8]
push eax
push 0x103
call sub.KERNEL32.DLL_GetTempPathA
lea edx, [ebp - 0x14f8]
push edx
call fcn.0049daf8
pop ecx
movsx ecx, byte [ebp + eax - 0x14f9]
cmp ecx, 0x5c
je 0x409031
push 0x4c24c2
lea eax, [ebp - 0x14f8]
push eax
call fcn.0049d9ec
add esp, 8
push str.TERM_UPDATE.EXE
lea edx, [ebp - 0x14f8]
push edx
call fcn.0049d9ec
add esp, 8
lea ecx, [ebp - 0x14f8]
push ecx
push dword [ebp - 4]
call fcn.0040c244
add esp, 8
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x409096
mov dword [ebp - 0x30], 1
push 0
push 4
lea edx, [ebp - 0x30]
push edx
push dword [ebp - 4]
call sub.WSOCK32.DLL_send
push 5
push 0
push 0
lea ecx, [ebp - 0x14f8]
push ecx
push 0x4c24d4
push 0
call sub.SHELL32.DLL_ShellExecuteA
jmp 0x409c4a
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x409c4a
xor edx, edx
mov dword [ebp - 0x48], edx
call fcn.0040dc60
test eax, eax
je 0x4090cb
lea ecx, [ebp - 0x48]
push ecx
call fcn.0040dd8c
pop ecx
push 1
push 0x4c24d9
lea eax, [ebp - 0x48]
push eax
call fcn.0040dde4
add esp, 0xc
push 8
push 5
call sub.USER32.DLL_ExitWindowsEx
call fcn.0040dc60
test eax, eax
je 0x4090f0
push 0
push 0x4c24ed
lea edx, [ebp - 0x48]
push edx
call fcn.0040dde4
add esp, 0xc
mov dword [ebp - 0x30], 1
jmp 0x409c4a
xor ecx, ecx
mov dword [ebp - 0x4c], ecx
call fcn.0040dc60
test eax, eax
je 0x409127
lea eax, [ebp - 0x4c]
push eax
call fcn.0040dd8c
pop ecx
push 1
push 0x4c2501
lea edx, [ebp - 0x4c]
push edx
call fcn.0040dde4
add esp, 0xc
push 0
push 6
call sub.USER32.DLL_ExitWindowsEx
call fcn.0040dc60
test eax, eax
je 0x40914c
push 0
push str.SeShutdownPrivilege
lea ecx, [ebp - 0x4c]
push ecx
call fcn.0040dde4
add esp, 0xc
mov dword [ebp - 0x30], 1
jmp 0x409c4a
mov esi, 0x4bfaf8
lea edi, [ebp - 0x1508]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov esi, 0x4bfb08
lea edi, [ebp - 0x160c]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xaf0]
push eax
lea edx, [ebp - 0x160c]
push edx
call fcn.0049dac8
add esp, 8
lea ecx, [ebp - 0x14fc]
push ecx
lea eax, [ebp - 0x14fe]
push eax
lea edx, [ebp - 0x1500]
push edx
lea ecx, [ebp - 0x1502]
push ecx
lea eax, [ebp - 0x1506]
push eax
lea edx, [ebp - 0x1508]
push edx
push 0x4c2529
lea ecx, [ebp - 0x160c]
push ecx
call fcn.004a17c4
add esp, 0x20
lea eax, [ebp - 0x1508]
push eax
call sub.KERNEL32.DLL_SetLocalTime
push 0x4c2564
call fcn.0049daf8
pop ecx
push eax
push 0x4c2561
push 0x4c2554
push 0x4c253b
call fcn.0049aac4
add esp, 0x10
push 0x4c2594
call fcn.0049daf8
pop ecx
push eax
push 0x4c2590
push 0x4c2580
push 0x4c2567
call fcn.0049aac4
add esp, 0x10
mov dword [ebp - 0x30], 1
push 0x20c
call fcn.0049ce44
pop ecx
mov dword [ebp - 0x50], eax
lea edx, [ebp - 0x12f0]
push edx
push str.PROMPT_OFFLINE_PERMIT
lea ecx, [ebp - 0xef0]
push ecx
call fcn.0040d5c4
add esp, 0xc
push eax
push dword [ebp - 0x50]
call fcn.0049dac8
add esp, 8
lea eax, [ebp - 0x13f4]
push eax
mov edx, dword [ebp - 0x50]
add edx, 0x104
push edx
call fcn.0049dac8
add esp, 8
mov ecx, dword [ebp - 0x50]
mov dword [ecx + 0x208], 0x40040
xor eax, eax
mov dword [ebp - 0x54], eax
lea edx, [ebp - 0x54]
push edx
push 0
push dword [ebp - 0x50]
push 0x4087b8
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [ebp - 0x58], eax
push dword [ebp - 0x58]
call sub.KERNEL32.DLL_CloseHandle
jmp 0x409c4a
push 0x4c25d7
call fcn.0049daf8
pop ecx
push eax
push 0x4c25d4
push 0x4c25c7
push 0x4c25ae
call fcn.0049aac4
add esp, 0x10
push 0x4c2606
call fcn.0049daf8
pop ecx
push eax
push 0x4c2603
push 0x4c25f3
push 0x4c25da
call fcn.0049aac4
add esp, 0x10
mov dword [ebp - 0x30], 1
push 0x20c
call fcn.0049ce44
pop ecx
mov dword [ebp - 0x5c], eax
lea ecx, [ebp - 0x12f0]
push ecx
push str.PROMPT_OFFLINE_DENY
lea eax, [ebp - 0x1a0c]
push eax
call fcn.0040d5c4
add esp, 0xc
lea edx, [ebp - 0xaf0]
push edx
lea ecx, [ebp - 0x12f0]
push ecx
push 0x4c261d
lea eax, [ebp - 0x1e0c]
push eax
call fcn.0040d5c4
add esp, 0x10
lea edx, [ebp - 0x1e0c]
push edx
lea ecx, [ebp - 0x1a0c]
push ecx
push str._s_n_n_s
push dword [ebp - 0x5c]
call fcn.004a16bc
add esp, 0x10
mov eax, dword [ebp - 0x5c]
mov byte [eax + 0x103], 0
lea edx, [ebp - 0x13f4]
push edx
mov ecx, dword [ebp - 0x5c]
add ecx, 0x104
push ecx
call fcn.0049dac8
add esp, 8
mov eax, dword [ebp - 0x5c]
mov dword [eax + 0x208], 0x40040
xor edx, edx
mov dword [ebp - 0x60], edx
lea ecx, [ebp - 0x60]
push ecx
push 0
push dword [ebp - 0x5c]
push 0x408820
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [ebp - 0x64], eax
push dword [ebp - 0x64]
call sub.KERNEL32.DLL_CloseHandle
jmp 0x409c4a
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x68], 0xe
lea eax, [ebp - 0xaf0]
push eax
lea edx, [ebp - 0x12f0]
push edx
push str.REASON_OF_REJECT
lea ecx, [ebp - 0xef0]
push ecx
call fcn.0040d5c4
add esp, 0x10
push 4
lea eax, [ebp - 0x68]
push eax
mov edx, dword [sym.terminal.exe__MainForm]
mov ecx, dword [edx]
push dword [ecx + 0xe8c]
call fcn.0049cd84
add esp, 0xc
test eax, eax
jle 0x409c4a
lea eax, [ebp - 0xef0]
push eax
call fcn.0049daf8
pop ecx
inc eax
push eax
lea edx, [ebp - 0xef0]
push edx
mov ecx, dword [sym.terminal.exe__MainForm]
mov eax, dword [ecx]
push dword [eax + 0xe8c]
call fcn.0049cd84
add esp, 0xc
test eax, eax
jle 0x409c4a
xor edx, edx
mov dword [ebp - 0x6c], edx
push 4
lea ecx, [ebp - 0x6c]
push ecx
mov eax, dword [sym.terminal.exe__MainForm]
mov edx, dword [eax]
push dword [edx + 0xe8c]
call fcn.0049cd44
add esp, 0xc
jmp 0x409c4a
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x70], 0xe
lea ecx, [ebp - 0x12f0]
push ecx
push str.PROMPT_DECRYPT_FILE_DONT_EDIT_FILE
lea eax, [ebp - 0xef0]
push eax
call fcn.0040d5c4
add esp, 0xc
push 4
lea edx, [ebp - 0x70]
push edx
mov ecx, dword [sym.terminal.exe__MainForm]
mov eax, dword [ecx]
push dword [eax + 0xe8c]
call fcn.0049cd84
add esp, 0xc
test eax, eax
jle 0x409c4a
lea edx, [ebp - 0xef0]
push edx
call fcn.0049daf8
pop ecx
inc eax
push eax
lea ecx, [ebp - 0xef0]
push ecx
mov eax, dword [sym.terminal.exe__MainForm]
mov edx, dword [eax]
push dword [edx + 0xe8c]
call fcn.0049cd84
add esp, 0xc
test eax, eax
jle 0x409c4a
xor ecx, ecx
mov dword [ebp - 0x74], ecx
push 4
lea eax, [ebp - 0x74]
push eax
mov edx, dword [sym.terminal.exe__MainForm]
mov ecx, dword [edx]
push dword [ecx + 0xe8c]
call fcn.0049cd44
add esp, 0xc
jmp 0x409c4a
mov esi, 0x4bfc0c
lea edi, [ebp - 0x1f10]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov esi, 0x4bfd10
lea edi, [ebp - 0x2014]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov esi, 0x4bfe14
lea edi, [ebp - 0x2418]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x4c0218
lea edi, [ebp - 0x318c]
mov ecx, 0x35d
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x9ec]
push eax
call fcn.0049daf8
pop ecx
test eax, eax
jbe 0x40964d
lea edx, [ebp - 0x2014]
push edx
lea ecx, [ebp - 0xaf0]
push ecx
call fcn.0046e7ec
add esp, 8
lea eax, [ebp - 0x9ec]
push eax
lea edx, [ebp - 0x2014]
push edx
call fcn.0049da7c
add esp, 8
test eax, eax
je 0x40964d
lea ecx, [ebp - 0xaf0]
push ecx
lea eax, [ebp - 0x12f0]
push eax
push str.PROMPT_DECRYPT_FILE_CHANGED
lea edx, [ebp - 0xef0]
push edx
call fcn.0040d5c4
add esp, 0x10
mov dword [ebp - 0x78], 0xe
push 4
lea ecx, [ebp - 0x78]
push ecx
mov eax, dword [sym.terminal.exe__MainForm]
mov edx, dword [eax]
push dword [edx + 0xe8c]
call fcn.0049cd84
add esp, 0xc
test eax, eax
jle 0x409c4a
lea ecx, [ebp - 0xef0]
push ecx
call fcn.0049daf8
pop ecx
inc eax
push eax
lea eax, [ebp - 0xef0]
push eax
mov edx, dword [sym.terminal.exe__MainForm]
mov ecx, dword [edx]
push dword [ecx + 0xe8c]
call fcn.0049cd84
add esp, 0xc
test eax, eax
jle 0x409c4a
xor eax, eax
mov dword [ebp - 0x7c], eax
push 4
lea edx, [ebp - 0x7c]
push edx
mov ecx, dword [sym.terminal.exe__MainForm]
mov eax, dword [ecx]
push dword [eax + 0xe8c]
call fcn.0049cd44
add esp, 0xc
jmp 0x409c4a
push 0x103
lea edx, [ebp - 0x2014]
push edx
call sub.KERNEL32.DLL_GetSystemDirectoryA
push 0x4c268b
lea ecx, [ebp - 0x2014]
push ecx
push 0x4c2685
lea eax, [ebp - 0x1f10]
push eax
call fcn.004a16bc
add esp, 0x10
lea edx, [ebp - 0x318c]
push edx
lea ecx, [ebp - 0x1f10]
push ecx
call fcn.0049afb4
add esp, 8
test eax, eax
je 0x409c4a
lea eax, [ebp - 0x2418]
push eax
push dword [ebp - 0x2d78]
lea edx, [ebp - 0x3088]
push edx
call fcn.0046cd5c
add esp, 0xc
mov esi, 0x4c0f8c
lea edi, [ebp - 0x3394]
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
push 0x103
lea eax, [ebp - 0x3394]
push eax
push 0xffffffffffffffff
lea edx, [ebp - 0xaf0]
push edx
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
lea ecx, [ebp - 0x3394]
push ecx
call fcn.0046ce7c
pop ecx
test eax, eax
jne 0x4097b0
mov dword [ebp - 0x30], 1
lea eax, [ebp - 0xaf0]
push eax
lea edx, [ebp - 0x12f0]
push edx
push 0x4c2695
lea ecx, [ebp - 0xef0]
push ecx
call fcn.0040d5c4
add esp, 0x10
mov dword [ebp - 0x80], 0xe
push 4
lea eax, [ebp - 0x80]
push eax
mov edx, dword [sym.terminal.exe__MainForm]
mov ecx, dword [edx]
push dword [ecx + 0xe8c]
call fcn.0049cd84
add esp, 0xc
test eax, eax
jle 0x409c4a
lea eax, [ebp - 0xef0]
push eax
call fcn.0049daf8
pop ecx
inc eax
push eax
lea edx, [ebp - 0xef0]
push edx
mov ecx, dword [sym.terminal.exe__MainForm]
mov eax, dword [ecx]
push dword [eax + 0xe8c]
call fcn.0049cd84
add esp, 0xc
test eax, eax
jle 0x409c4a
xor edx, edx
mov dword [ebp - 0x84], edx
push 4
lea ecx, [ebp - 0x84]
push ecx
mov eax, dword [sym.terminal.exe__MainForm]
mov edx, dword [eax]
push dword [edx + 0xe8c]
call fcn.0049cd44
add esp, 0xc
jmp 0x409c4a
mov dword [ebp - 0x30], 1
push 0
push 4
lea ecx, [ebp - 0x30]
push ecx
push dword [ebp - 4]
call sub.WSOCK32.DLL_send
lea eax, [ebp - 0x2418]
push eax
lea edx, [ebp - 0x3394]
push edx
lea ecx, [ebp - 0x3394]
push ecx
call fcn.0046d284
add esp, 0xc
test eax, eax
je 0x4097ef
mov dword [ebp - 0x30], 1
lea eax, [ebp - 0xaf0]
push eax
lea edx, [ebp - 0x12f0]
push edx
push 0x4c26ba
lea ecx, [ebp - 0xef0]
push ecx
call fcn.0040d5c4
add esp, 0x10
mov dword [ebp - 0x88], 0xe
push 4
lea eax, [ebp - 0x88]
push eax
mov edx, dword [sym.terminal.exe__MainForm]
mov ecx, dword [edx]
push dword [ecx + 0xe8c]
call fcn.0049cd84
add esp, 0xc
test eax, eax
jle 0x409c4a
lea eax, [ebp - 0xef0]
push eax
call fcn.0049daf8
pop ecx
inc eax
push eax
lea edx, [ebp - 0xef0]
push edx
mov ecx, dword [sym.terminal.exe__MainForm]
mov eax, dword [ecx]
push dword [eax + 0xe8c]
call fcn.0049cd84
add esp, 0xc
test eax, eax
jle 0x409c4a
xor edx, edx
mov dword [ebp - 0x8c], edx
push 4
lea ecx, [ebp - 0x8c]
push ecx
mov eax, dword [sym.terminal.exe__MainForm]
mov edx, dword [eax]
push dword [edx + 0xe8c]
call fcn.0049cd44
add esp, 0xc
jmp 0x409c4a
mov dword [ebp - 0x30], 1
lea ecx, [ebp - 0xaf0]
push ecx
lea eax, [ebp - 0x12f0]
push eax
push str.PROMPT_DECRYPT_FILE_DENY
lea edx, [ebp - 0xef0]
push edx
call fcn.0040d5c4
add esp, 0x10
mov dword [ebp - 0x90], 0xe
push 4
lea ecx, [ebp - 0x90]
push ecx
mov eax, dword [sym.terminal.exe__MainForm]
mov edx, dword [eax]
push dword [edx + 0xe8c]
call fcn.0049cd84
add esp, 0xc
test eax, eax
jle 0x409c4a
lea ecx, [ebp - 0xef0]
push ecx
call fcn.0049daf8
pop ecx
inc eax
push eax
lea eax, [ebp - 0xef0]
push eax
mov edx, dword [sym.terminal.exe__MainForm]
mov ecx, dword [edx]
push dword [ecx + 0xe8c]
call fcn.0049cd84
add esp, 0xc
test eax, eax
jle 0x409c4a
xor eax, eax
mov dword [ebp - 0x94], eax
push 4
lea edx, [ebp - 0x94]
push edx
mov ecx, dword [sym.terminal.exe__MainForm]
mov eax, dword [ecx]
push dword [eax + 0xe8c]
call fcn.0049cd44
add esp, 0xc
jmp 0x409c4a
lea edx, [ebp - 0xaf0]
push edx
push dword [ebp - 4]
call fcn.0040c070
add esp, 8
test eax, eax
je 0x409c4a
mov dword [ebp - 0x30], 1
jmp 0x409c4a
push 1
push 1
call fcn.00408854
add esp, 8
test eax, eax
jne 0x40999a
xor ecx, ecx
mov dword [ebp - 0x30], ecx
jmp 0x409c4a
mov dword [ebp - 0x30], 1
push 0
push 4
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 4]
call sub.WSOCK32.DLL_send
mov dword [ebp - 0x98], 0xa
push 4
lea edx, [ebp - 0x98]
push edx
mov ecx, dword [sym.terminal.exe__MainForm]
mov eax, dword [ecx]
push dword [eax + 0xe8c]
call fcn.0049cd84
add esp, 0xc
push 0x40040
lea edx, [ebp - 0x13f4]
push edx
lea ecx, [ebp - 0x12f0]
push ecx
push str.PROMPT_REMOVE_TERM_COMPLETE
lea eax, [ebp - 0xef0]
push eax
call fcn.0040d5c4
add esp, 0xc
push eax
push 0
call sub.USER32.DLL_MessageBoxA
mov eax, 0xfffffffd
jmp 0x409e86
mov esi, 0x4c1194
lea edi, [ebp - 0x3498]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov esi, 0x4c1298
lea edi, [ebp - 0x359c]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov esi, 0x4c139c
lea edi, [ebp - 0x4310]
mov ecx, 0x35d
rep movsd dword es:[edi], dword [esi]
push 0x103
lea eax, [ebp - 0x3498]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
push 0x4c2710
lea edx, [ebp - 0x3498]
push edx
push 0x4c270a
lea ecx, [ebp - 0x359c]
push ecx
call fcn.004a16bc
add esp, 0x10
lea eax, [ebp - 0x4310]
push eax
lea edx, [ebp - 0x359c]
push edx
call fcn.0049afb4
add esp, 8
test eax, eax
je 0x409c4a
push 0x393001
call fcn.0049cfe8
pop ecx
mov dword [ebp - 0x9c], eax
xor ecx, ecx
mov dword [ebp - 0xa0], ecx
lea eax, [ebp - 0xa0]
push eax
push dword [ebp - 0x9c]
lea edx, [ebp - 0x359c]
push edx
call fcn.0049aff8
add esp, 0xc
test eax, eax
je 0x409c4a
push 0x41001
call fcn.0049cfe8
pop ecx
mov dword [ebp - 0xa4], eax
push 0x41001
push 0
push dword [ebp - 0xa4]
call fcn.0049d948
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xa8], ecx
xor eax, eax
mov dword [ebp - 0xac], eax
mov edx, dword [ebp - 0xac]
mov ecx, dword [ebp - 0xa0]
cmp edx, ecx
jge 0x409bc8
mov eax, dword [ebp - 0x9c]
mov edx, dword [ebp - 0xac]
add eax, edx
mov dword [ebp - 0xb0], eax
mov ecx, dword [ebp - 0xb0]
mov eax, dword [ecx]
test eax, eax
je 0x409ba2
mov edx, dword [ebp - 0xb0]
add edx, 4
push edx
call fcn.0049daf8
pop ecx
test eax, eax
je 0x409ba2
mov ecx, dword [ebp - 0xb0]
add ecx, 4
push ecx
push dword [ebp - 0xa4]
call fcn.0049d9ec
add esp, 8
push 0x4c271a
push dword [ebp - 0xa4]
call fcn.0049d9ec
add esp, 8
mov eax, dword [ebp - 0xb0]
add eax, 4
push eax
call fcn.0049daf8
pop ecx
mov edx, dword [ebp - 0xa8]
add eax, edx
inc eax
mov dword [ebp - 0xa8], eax
mov ecx, dword [ebp - 0xac]
add ecx, 0xe4c
mov dword [ebp - 0xac], ecx
mov eax, dword [ebp - 0xac]
mov edx, dword [ebp - 0xa0]
cmp eax, edx
jl 0x409b24
inc dword [ebp - 0xa8]
push 0
push 4
lea ecx, [ebp - 0xa8]
push ecx
push dword [ebp - 4]
call sub.WSOCK32.DLL_send
mov dword [ebp - 0xb4], eax
push 0
push dword [ebp - 0xa8]
push dword [ebp - 0xa4]
push dword [ebp - 4]
call sub.WSOCK32.DLL_send
push 0
push 0xd74
lea eax, [ebp - 0x4310]
push eax
push dword [ebp - 4]
call sub.WSOCK32.DLL_send
mov dword [ebp - 0xb8], eax
push dword [ebp - 0xa4]
call fcn.0049ce20
pop ecx
push dword [ebp - 0x9c]
call fcn.0049ce20
pop ecx
mov dword [ebp - 0x30], 1
jmp 0x409c4a
push 0
push 4
lea edx, [ebp - 0x30]
push edx
push dword [ebp - 4]
call sub.WSOCK32.DLL_send
push dword [ebp - 0x1c]
call fcn.0049ce20
pop ecx
push 0
push 4
lea ecx, [ebp - 0x30]
push ecx
push dword [ebp - 4]
call sub.WSOCK32.DLL_send
mov eax, dword [ebp - 8]
cmp eax, 0x1718
je 0x409c78
mov edx, dword [ebp - 8]
cmp edx, 0x1717
jne 0x409c82
mov eax, 1
jmp 0x409e86
push 0x620
call fcn.0049ce44
pop ecx
mov dword [ebp - 0xbc], eax
push 0x620
push 0
push dword [ebp - 0xbc]
call fcn.0049d948
add esp, 0xc
push dword [ebp - 0xbc]
push dword [ebp - 4]
call fcn.0040d004
add esp, 8
mov esi, 0x4c2110
lea edi, [ebp - 0x4414]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x4414]
push eax
call fcn.0049b558
pop ecx
lea edx, [ebp - 0x4414]
push edx
mov ecx, dword [ebp - 0xbc]
add ecx, 0x104
push ecx
call fcn.0049dac8
add esp, 8
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xbc]
mov dword [edx + 0x208], eax
xor ecx, ecx
mov dword [ebp - 0xc0], ecx
imul eax, dword [ebp - 0xc0], 0x104
lea edx, [ebp - 0xaf0]
add eax, edx
push eax
call fcn.0049daf8
pop ecx
test eax, eax
je 0x409dc1
mov ecx, dword [ebp - 0xbc]
add ecx, 0x20c
push ecx
call fcn.0049daf8
pop ecx
test eax, eax
je 0x409d85
push 0x4c271c
mov eax, dword [ebp - 0xbc]
add eax, 0x20c
push eax
call fcn.0049d9ec
add esp, 8
imul edx, dword [ebp - 0xc0], 0x104
lea ecx, [ebp - 0xaf0]
add edx, ecx
push edx
mov eax, dword [ebp - 0xbc]
add eax, 0x20c
push eax
call fcn.0049d9ec
add esp, 8
jmp 0x409dac
imul edx, dword [ebp - 0xc0], 0x104
lea ecx, [ebp - 0xaf0]
add edx, ecx
push edx
mov eax, dword [ebp - 0xbc]
add eax, 0x20c
push eax
call fcn.0049dac8
add esp, 8
inc dword [ebp - 0xc0]
mov edx, dword [ebp - 0xc0]
cmp edx, 0xa
jl 0x409d0b
mov ecx, dword [ebp - 0x30]
dec ecx
je 0x409dcf
mov eax, dword [ebp - 0x30]
cmp eax, 3
jne 0x409de1
mov edx, dword [ebp - 0xbc]
mov dword [edx + 0x61c], 1
jmp 0x409def
mov ecx, dword [ebp - 0xbc]
xor eax, eax
mov dword [ecx + 0x61c], eax
mov dword [ebp - 0xc4], 0xf
push 4
lea edx, [ebp - 0xc4]
push edx
mov ecx, dword [sym.terminal.exe__MainForm]
mov eax, dword [ecx]
push dword [eax + 0xe8c]
call fcn.0049cd84
add esp, 0xc
test eax, eax
jg 0x409e23
mov eax, 1
jmp 0x409e86
push 0x620
push dword [ebp - 0xbc]
mov edx, dword [sym.terminal.exe__MainForm]
mov ecx, dword [edx]
push dword [ecx + 0xe8c]
call fcn.0049cd84
add esp, 0xc
test eax, eax
jg 0x409e4f
mov eax, 1
jmp 0x409e86
xor edx, edx
mov dword [ebp - 0xc8], edx
push 4
lea ecx, [ebp - 0xc8]
push ecx
mov eax, dword [sym.terminal.exe__MainForm]
mov edx, dword [eax]
push dword [edx + 0xe8c]
call fcn.0049cd44
add esp, 0xc
push dword [ebp - 0xbc]
call fcn.0049ce10
pop ecx
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4