Function at 0x405ce0
Capabilities:
Allocate or change rwx memory
Create pipe
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov dword [ebp - 0x48], 0x731
mov eax, dword [0x766550]
mov dword [ebp - 0x20], eax
mov ecx, dword [0x7665a0]
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0xc], 0x5cf
jae 0x405d24
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 4]
jae 0x405e05
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
sub eax, 0x59
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xa0
ja case.0x405d5b.1
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x40684c]
jmp dword [edx*4 + 0x406834]
movzx eax, word [ebp - 0xc]
mov ecx, dword [ebp - 4]
sub ecx, eax
or ecx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], ecx
jmp 0x405e03
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 0x14]
add edx, eax
or edx, dword [ebp - 8]
or edx, dword [ebp - 0x10]
mov word [ebp - 4], dx
jmp 0x405e03
movzx ecx, byte [ebp - 0x10]
xor ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x10]
or ecx, edx
movzx eax, word [ebp - 0x14]
or ecx, eax
or ecx, 0x2ca
mov dword [ebp - 0x1c], ecx
jmp 0x405e03
movzx ecx, word [ebp - 4]
movzx edx, word [ebp - 0x18]
add ecx, edx
sub ecx, dword [ebp - 8]
sub ecx, 0x375
or ecx, 0x6ed
mov dword [ebp - 0x14], ecx
jmp 0x405e03
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
lea edx, [ecx + eax - 0x96f]
add edx, dword [ebp - 0x10]
or edx, dword [ebp - 0xc]
movzx eax, word [ebp - 0x14]
or edx, eax
mov word [ebp - 4], dx
jmp 0x405e03
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x10]
movzx edx, byte [ebp - 0x1c]
sub ecx, edx
and ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
jmp 0x405e1a
movzx eax, byte [ebp - 0xc]
add eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 4]
and eax, ecx
and eax, dword [ebp - 0x18]
mov byte [ebp - 0x1c], al
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x14]
jb 0x405e55
movzx ecx, word [ebp - 0xc]
add ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 4]
movzx eax, byte [ebp - 8]
sub ecx, eax
mov edx, dword [ebp - 0x10]
shl edx, cl
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DrawIcon]
mov dword [ebp - 4], eax
jmp 0x405e62
movzx ecx, word [ebp - 0x18]
add ecx, dword [ebp - 0x18]
and ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
movzx edx, word [ebp - 8]
and edx, dword [ebp - 8]
and edx, dword [ebp - 0x10]
or edx, dword [ebp - 0x14]
mov dword [ebp - 0xc], edx
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0xcb70a
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0xc], 0
je 0x405eb9
cmp dword [ebp - 0x1c], 0
jbe 0x405eb9
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x10]
ja 0x405eeb
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
lea edx, [ecx + eax - 0x8f8]
movzx eax, byte [ebp - 0x1c]
add eax, dword [ebp - 0xc]
and edx, eax
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_DrawIcon]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
ja 0x405f58
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x10]
jae 0x405f58
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jne 0x405f09
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x18]
jae 0x405f11
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 8]
je 0x405f2b
push str.mehkqcntohas
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.USER32.dll_AppendMenuW]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x54]
push ecx
push 0x38
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov dword [ebp - 0x1c], eax
push 0
push 0
push 3
push 0
push 1
push 1
push str.osetp
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x14]
sub edx, 0x7a6
sub edx, dword [ebp - 0x18]
add edx, 0xab6
and edx, dword [ebp - 0x14]
or edx, dword [ebp - 0x10]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jae 0x405fa6
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x14]
jbe 0x405fa6
push str.dnyeuhyaonma
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0xc], eax
push 0
push 0
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x38]
add ecx, 0x84000
mov dword [ebp - 0x38], ecx
push str.eurkfeartutnblselaf
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x18], eax
imul edx, dword [ebp - 0x10], 0xbe
add edx, dword [ebp - 0xc]
or edx, 0xe6
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
movzx ecx, word [ebp - 8]
sub eax, ecx
add eax, dword [ebp - 0x1c]
or eax, dword [ebp - 8]
or eax, dword [ebp - 0x10]
mov word [ebp - 4], ax
cmp dword [ebp - 8], 0x81b
jne 0x406026
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x1c]
jne 0x406005
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jae 0x406015
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x10]
or ecx, dword [ebp - 0x10]
mov word [ebp - 0x14], cx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x4c], 0x75b020
movzx ecx, word [ebp - 0x18]
cmp dword [ebp - 8], ecx
ja 0x406071
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x10]
ja 0x406071
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_DrawIcon]
mov dword [ebp - 4], eax
movzx ecx, byte [ebp - 8]
add ecx, dword [ebp - 0xc]
and ecx, dword [ebp - 4]
movzx edx, word [ebp - 0x18]
xor eax, eax
sub eax, edx
and eax, dword [ebp - 4]
or ecx, eax
mov dword [ebp - 0x10], ecx
movzx ecx, word [ebp - 0x14]
mov edx, 0x5ce
sub edx, dword [ebp - 0x14]
movzx eax, word [ebp - 4]
add edx, eax
and ecx, edx
movzx edx, word [ebp - 0x18]
or ecx, edx
mov dword [ebp - 0x10], ecx
push str.hstwbmnhtsaeh
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.USER32.dll_AppendMenuW]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
add ecx, 0xad2
mov eax, dword [ebp - 0x1c]
shl eax, cl
mov ecx, dword [ebp - 8]
imul ecx, dword [ebp - 0x10]
movzx edx, word [ebp - 0x1c]
add ecx, edx
and eax, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x1c]
and eax, 0xfffffd31
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
and ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
add edx, 0x4dc
and ecx, edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 8]
movzx ecx, byte [ebp - 0x18]
add ecx, dword [ebp - 4]
and ecx, dword [ebp - 0x14]
and ecx, dword [ebp - 0xc]
or eax, ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0xc], 0
ja 0x406115
cmp dword [ebp - 8], 0
jbe 0x406177
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x14]
ja 0x40613c
cmp dword [ebp - 0x14], 0
jae 0x406159
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 8]
ja 0x406159
movzx eax, word [ebp - 4]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
add ecx, dword [ebp - 8]
movzx edx, byte [ebp - 4]
add edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x1c]
and ecx, edx
mov dword [ebp - 0x10], ecx
jmp 0x406177
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 0xb27]
movzx eax, word [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
sub ecx, dword [ebp - 0x18]
shl edx, cl
mov dword [ebp - 0xc], edx
movzx ecx, byte [ebp - 8]
add ecx, dword [ebp - 0x1c]
or ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp - 0x18]
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x18]
and edx, eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x10]
or edx, ecx
or edx, dword [ebp - 0x18]
mov dword [ebp - 4], edx
mov dword [ebp - 0x2c], 0x51287ae8
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x18]
add edx, dword [ebp - 0xc]
and edx, dword [ebp - 0xc]
and edx, dword [ebp - 0x1c]
and edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
sub ecx, 0x25
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], 0x71
ja case.0x4061d9.1
mov edx, dword [ebp - 0x34]
movzx eax, byte [edx + 0x406904]
jmp dword [eax*4 + 0x4068f0]
movzx ecx, byte [ebp - 0xc]
sub ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x10]
or ecx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
jmp 0x40624f
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x10]
add edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
jmp 0x40624f
imul eax, dword [ebp - 0x1c], 0
add eax, dword [ebp - 0x10]
movzx ecx, word [ebp - 0xc]
sub eax, ecx
movzx edx, byte [ebp - 0xc]
or eax, edx
mov word [ebp - 0x18], ax
jmp 0x40624f
movzx eax, byte [ebp - 0x1c]
mov ecx, 0x2e0
sub ecx, eax
movzx edx, word [ebp - 4]
imul edx, dword [ebp - 0x1c]
movzx eax, word [ebp - 0x10]
add edx, eax
or ecx, edx
mov dword [ebp - 0x18], ecx
jmp 0x40624f
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
lea eax, [edx + ecx - 0x3b5]
sub eax, dword [ebp - 0x18]
and eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], 0x45668157
mov ecx, dword [ebp - 0x18]
add ecx, 0x221
and ecx, dword [ebp - 0x14]
or ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x18]
or ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x10]
or eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov dword [ebp - 0x28], 0xc9eaf1ac
cmp dword [ebp - 0x10], 0
jae 0x406295
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x14]
jae 0x4062c2
lea edx, [ebp - 0x74]
push edx
lea eax, [ebp - 0x58]
push eax
push 0x63
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov dword [ebp - 8], eax
push 0
push 0
push 3
push 0
push 1
push 1
push str.acoeoaetceituw
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
movzx ecx, word [ebp - 0xc]
mov edx, dword [ebp - 0x14]
sub edx, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x40], 0xd6fdea69
movzx eax, word [ebp - 0xc]
cmp dword [ebp - 0x18], eax
jne 0x4062f4
movzx ecx, byte [ebp - 4]
add ecx, dword [ebp - 8]
or ecx, 0xfffff8bc
movzx edx, byte [ebp - 0xc]
or ecx, edx
mov dword [ebp - 0x18], ecx
mov eax, 0x570
sub eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0xc]
movzx ecx, word [ebp - 4]
or eax, ecx
imul edx, dword [ebp - 0x14], 0x3ec
or eax, edx
mov dword [ebp - 8], eax
movzx eax, byte [ebp - 0x14]
cmp dword [ebp - 4], eax
jne 0x40632a
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0xc]
je 0x40632a
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x14]
jb 0x40633e
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 4]
movzx ecx, word [ebp - 8]
xor ecx, dword [ebp - 0x1c]
or eax, ecx
mov dword [ebp - 0xc], eax
jmp 0x406352
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
lea ecx, [eax + edx + 0xa3e]
and ecx, dword [ebp - 0x1c]
mov word [ebp - 0x10], cx
mov dword [ebp - 0x20], 0
cmp dword [ebp - 0x20], 0xa118
jae 0x4067d6
movzx edx, byte [ebp - 0x14]
add edx, 0x1d5
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 8]
or edx, eax
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
lea eax, [edx + ecx - 0x177]
add eax, dword [ebp - 0x10]
sub eax, dword [ebp - 4]
and eax, 0
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x2c]
xor ecx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x10]
jbe 0x4063ba
movzx eax, byte [ebp - 4]
movzx ecx, word [ebp - 4]
or eax, ecx
or eax, dword [ebp - 0x10]
or eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
jmp 0x4063d2
movzx edx, byte [ebp - 4]
sub edx, dword [ebp - 4]
add edx, dword [ebp - 0x18]
or edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
and eax, dword [ebp - 0x1c]
or edx, eax
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 4]
and ecx, dword [ebp - 0x1c]
and ecx, dword [ebp - 0xc]
or ecx, dword [ebp - 0x14]
mov word [ebp - 0x10], cx
mov edx, dword [ebp - 0x24]
xor edx, dword [ebp - 0x28]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 8]
or eax, dword [ebp - 0x10]
movzx ecx, word [ebp - 0x1c]
add ecx, dword [ebp - 0x10]
movzx edx, word [ebp - 0xc]
add edx, dword [ebp - 0x18]
and ecx, edx
or eax, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
ja 0x406419
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x18]
jae 0x406432
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.USER32.dll_DrawIcon]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
xor eax, dword [ebp - 0x40]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], 0x64
je 0x40645b
cmp dword [ebp - 0x3c], 0xa2
je 0x406467
cmp dword [ebp - 0x3c], 0xb5
je 0x40647d
jmp 0x40648e
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0xc]
mov word [ebp - 0x10], dx
jmp 0x4064aa
mov eax, 0x30b
sub eax, dword [ebp - 0x14]
sub eax, dword [ebp - 4]
sub eax, dword [ebp - 0x14]
or eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
jmp 0x4064aa
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
or ecx, 0xfffff72b
mov dword [ebp - 0x10], ecx
jmp 0x4064aa
xor edx, edx
sub edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
sub eax, 0x965
or edx, eax
or edx, 0x675
mov word [ebp - 0xc], dx
movzx ecx, byte [ebp - 0xc]
movzx edx, byte [ebp - 4]
add ecx, dword [ebp - 0x18]
lea eax, [edx + ecx - 0x3d]
sub eax, dword [ebp - 4]
and eax, 0
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x40]
mov dword [ebp - 0x28], ecx
push str.odnnrtonke
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x2c]
xor ecx, dword [ebp - 0x40]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x18]
jae 0x406535
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x1c]
jbe 0x406535
lea ecx, [ebp - 0x80]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 0x18
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov dword [ebp - 0x10], eax
push 0
push 0
push 3
push 0
push 3
push 0x40000000
push str.ndlcthiboeylcw
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
jmp 0x40654c
mov eax, dword [ebp - 0x1c]
add eax, 0x5f6
sub eax, dword [ebp - 0xc]
movzx ecx, word [ebp - 0x10]
sub eax, ecx
and eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x24]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 8]
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
lea ecx, [eax + edx - 0x744]
movzx edx, word [ebp - 0x10]
add ecx, edx
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x1c
je 0x40659d
cmp dword [ebp - 0x44], 0x79
je 0x4065d2
cmp dword [ebp - 0x44], 0xbf
je 0x4065b3
jmp 0x4065e0
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
and edx, dword [ebp - 0xc]
or ecx, edx
mov dword [ebp - 0x1c], ecx
jmp 0x4065f3
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
sub eax, dword [ebp - 0x18]
movzx ecx, byte [ebp - 4]
add eax, ecx
mov ecx, dword [ebp - 0x18]
shl eax, cl
movzx edx, byte [ebp - 4]
or eax, edx
mov dword [ebp - 0xc], eax
jmp 0x4065f3
mov eax, dword [ebp - 0x18]
and eax, dword [ebp - 8]
and eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
jmp 0x4065f3
movzx ecx, byte [ebp - 0x1c]
add ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x18]
movzx edx, word [ebp - 0x1c]
add ecx, edx
mov byte [ebp - 0xc], cl
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 4]
add eax, dword [ebp - 0x1c]
movzx ecx, byte [ebp - 0x14]
add eax, ecx
movzx edx, word [ebp - 0x14]
sub eax, edx
or eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jae 0x406651
cmp dword [ebp - 8], 0xaa1
je 0x40662b
cmp dword [ebp - 0xc], 0
jne 0x406643
cmp dword [ebp - 0x14], 0
jb 0x406643
movzx ecx, word [ebp - 0x10]
sub ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x14]
or ecx, edx
mov dword [ebp - 0x1c], ecx
push str.iheude
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x50], eax
movzx ecx, word [ebp - 0x1c]
cmp dword [ebp - 0xc], ecx
jbe 0x40666c
movzx edx, word [ebp - 0x1c]
cmp dword [ebp - 0x14], edx
je 0x4066b5
cmp dword [ebp - 0x1c], 0x6ea
jb 0x40667d
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jae 0x406686
cmp dword [ebp - 0xc], 0x5e8
jne 0x4066a0
push str.uhbvnpowgoor
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_AppendMenuW]
mov dword [ebp - 8], eax
push 0
push 0
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0xc]
or ecx, dword [ebp - 4]
or ecx, 0x5db
xor edx, edx
sub edx, dword [ebp - 0xc]
or ecx, edx
mov word [ebp - 0x10], cx
push str.tohoamsooad
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_AppendMenuW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x10]
or ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
lea edx, [eax + edx - 0xa06]
or ecx, edx
mov dword [ebp - 0xc], ecx
movzx eax, byte [ebp - 4]
add eax, 0x234
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x10]
movzx edx, byte [ebp - 8]
and ecx, edx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 8]
sub eax, dword [ebp - 8]
sub eax, dword [ebp - 0x14]
and eax, 0x1194
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x48]
mov edx, dword [ecx]
xor edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x50]
mov dword [eax], edx
movzx ecx, word [ebp - 8]
cmp dword [ebp - 0x14], ecx
je 0x406769
movzx edx, byte [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
sub eax, 0x2cb
and edx, eax
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
shl edx, cl
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x20]
sub eax, 0x76d6
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 8]
or ecx, edx
or ecx, dword [ebp - 0x1c]
mov word [ebp - 0x14], cx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 4]
je 0x4067c6
cmp dword [ebp - 0x18], 0x70b
jne 0x4067c6
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x14]
movzx edx, byte [ebp - 4]
add edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0xc]
sub edx, dword [ebp - 8]
or ecx, edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x20]
add eax, 0x76da
mov dword [ebp - 0x20], eax
jmp 0x406359
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0xc]
je 0x4067fd
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 4]
jb 0x4067fd
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 8], eax
jmp 0x406819
movzx edx, byte [ebp - 0x1c]
add edx, dword [ebp - 0x18]
movzx eax, byte [ebp - 8]
sub edx, eax
movzx ecx, word [ebp - 0x18]
add ecx, dword [ebp - 0x1c]
or edx, ecx
or edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 0x38]
add edx, 0x7e3d
mov dword [0x7665bc], edx
mov dword [ebp - 8], 0xb2f
mov esp, ebp
pop ebp
ret